| tafkamax | aha | 07:17 |
|---|---|---|
| tafkamax | I have back with some news atleast, my colleague who setup the previous cluster ran into this issue. https://bugs.launchpad.net/kolla-ansible/+bug/2134455 | 07:18 |
| tafkamax | the fix there helped him | 07:18 |
| tafkamax | I want to create a patch to fix this | 07:18 |
| tafkamax | I used the command specified there: `cp -r /etc/kolla/keystone/federation /etc/kolla/keystone-httpd/ && docker restart keystone_httpd` | 07:23 |
| tafkamax | running deploy again, let's see | 07:23 |
| tafkamax | yup seems this fix worked. I did this command on all controller hosts. | 07:31 |
| tafkamax | I wonder why this issue is not present in the CI | 07:34 |
| tafkamax | in the 2025.2 branch: https://opendev.org/openstack/kolla-ansible/src/commit/b45acb4879e33fa5af808f68ca99bea2df6199c6/ansible/roles/keystone/tasks/config.yml#L166 | 07:37 |
| tafkamax | this is where configuration files are copied | 07:37 |
| tafkamax | Well it seems the federation files are configured here: https://opendev.org/openstack/kolla-ansible/src/commit/b45acb4879e33fa5af808f68ca99bea2df6199c6/ansible/roles/keystone/tasks/config-federation-oidc.yml | 07:39 |
| tafkamax | https://opendev.org/openstack/kolla-ansible/src/branch/master/ansible/roles/keystone/defaults/main.yml#L266 | 07:43 |
| tafkamax | the config dirs are specified here | 07:44 |
| tafkamax | Aha, keystone uses uswgi and keystone_httpd uses apache2! | 07:44 |
| tafkamax | Does the federation config need to be configured even under /etc/kolla/keystone/federation ? | 07:48 |
| tafkamax | Or can I change the path myself? | 07:48 |
| tafkamax | Let's see I will do destroy and deploy again. | 07:53 |
| tafkamax | Changed this in globals: keystone_host_federation_base_folder: "{{ node_config_directory }}/keystone-httpd/federation" | 07:53 |
| bbezak | Right, it was omitted when uwsgi was implemented | 08:20 |
| bbezak | So now you can now what to fix! | 08:20 |
| bbezak | :) | 08:20 |
| tafkamax | What was omitted? keystone-httpd service? | 08:21 |
| tafkamax | I have both keystone and keystone-httpd running. I don't know exactly why the httpd is needed, maybe for oidc? | 08:22 |
| bbezak | Yes it does | 08:41 |
| tafkamax | Seems like the fix above did not work. ERROR MissingRequiredSource: /var/lib/kolla/config_files/federation/oidc/metadata file is not found" 11:54 | 09:58 |
| tafkamax | I think I will need to try to create a fix somehow and maybe try to create a patch. | 09:59 |
| tafkamax | Currently the only place where the `keystone-httpd` folder is created is in this one template command. | 09:59 |
| tafkamax | https://opendev.org/openstack/kolla-ansible/src/commit/5b5b1d668ad7f5e28fa5d783463538cf152388da/ansible/roles/keystone/tasks/config.yml#L168 | 09:59 |
| bbezak | Let me see | 10:15 |
| bbezak | Ok, so federation CI is not failing because of we got keystone_identity_providers empty in CI | 10:19 |
| bbezak | :) | 10:19 |
| *** jhorstmann is now known as Guest1680 | 10:25 | |
| tafkamax | Aha | 10:30 |
| tafkamax | Can it even be tested showhow? It requires somekind of IDP to be configured? | 10:35 |
| tafkamax | or it can be "blackhole" ? | 10:35 |
| * tafkamax sent a code block: https://matrix.org/oftc/media/v1/media/download/AZDEa7S0yVupSZM6aCRiI57it_6vb5ou4dzfk6DnsyFclIDnab9d0YCJUgfl6m3TdBVHRwR1jRI9UvJxCvKSTbpCeceqAUBQAG1hdHJpeC5vcmcvRXhTUkx1Vnl3R2VPaU5KTUFVbExUZ092 | 10:37 | |
| tafkamax | * ```... (full message at <https://matrix.org/oftc/media/v1/media/download/AbFRdHSwdG-qJgm5MKltdYJAb1r-fgt6ig2jXIPJan9Qleng3TKBRIUbxAwz8B5ss1h45BAOLkcLGGvU1z6qqqVCeceqBfxQAG1hdHJpeC5vcmcvcUxBTEFWWkFLQkV5WXVlamN0YnFXcFdH>) | 10:37 |
| tafkamax | If I wish to work on a bug then this is a good branch name, correct? git checkout -b bug/2134455 | 10:56 |
| bbezak | IIRC then Gerrit will create this change with topic based on your branch name | 11:00 |
| bbezak | You can work directly on master branch, gerrit will handle that | 11:00 |
| tafkamax | aha okay | 11:01 |
| tafkamax | I don't think I have any more time today. I am still trying to understand if the main keystone container even needs the "federation" folder or it can all live inside the keystone-httpd folder. | 11:02 |
| tafkamax | One solution would be to just add duplicate config options for everything keystone-httpd and federation related. | 11:02 |
| bbezak | Seems to me that keystone_httpd_default_volumes needs to mount the same volume | 11:11 |
| bbezak | As RO | 11:11 |
| tafkamax | aha interesting variable | 11:13 |
| tafkamax | I will try patch | 11:15 |
| tafkamax | I will try it on my cluster first... I have a deploy running with another potential fix that will probably fail so it will take some time... | 11:19 |
| tafkamax | What do you think about creating some blackhole/devnull type of config for the keystone_identity_providers though in CI to test this use case? Or does it need to be an service that actually responds to requests? | 11:19 |
| tafkamax | Then it might need to be more complicated to setup an simple IDP that responds :/ | 11:20 |
| bbezak | Depends what we want to test. If just we want to extend the CI just to test templating, then I think we can just add some dummy templates | 11:29 |
| bbezak | potentially | 11:29 |
| bbezak | I didn’t check it deeply | 11:29 |
| bbezak | But to fix initial issue, maybe sth like: | 11:32 |
| bbezak | - "{{ keystone_host_federation_base_folder ~ ':' ~ container_config_directory ~ '/federation:ro' if keystone_enable_federation_openid | bool else '' }}" | 11:32 |
| bbezak | In keystone_httpd_default_volumes | 11:32 |
| bbezak | But it would be nice first extend CI indeed | 11:33 |
| bbezak | Not to break it again :) | 11:33 |
| tafkamax | Would it need to be under zuul.d or tests ? | 11:39 |
| tafkamax | I see there is zuul.d/keystone-federation.yaml | 11:40 |
| bbezak | maybe tests/templates/keystone-federation | 11:42 |
| tafkamax | i found tests/templates/globals-default.j2 that has this block:... (full message at <https://matrix.org/oftc/media/v1/media/download/AbVHe3FU3h9uGWlMfUTGG5DKaLfSQAetFOQERmJgKpcG4ZQumd3T5JDNIxrLdT5NvtoG012rRpU_DdBZyoPhUjpCecetyHJAAG1hdHJpeC5vcmcvQUlPU2ZiRUxYT2xTT2RmQ21iWHd4dFhn>) | 11:43 |
| tafkamax | All federation is not OIDC though. But adding it under that? | 11:43 |
| bbezak | yeah, keystone_identity_providers in tests/templates/globals-default.j2 | 11:46 |
| bbezak | (It should go there) | 11:46 |
| tafkamax | thx | 11:46 |
| *** amin is now known as AminAlimoradi | 11:58 | |
| AminAlimoradi | Hi all, just following up on issue #975351. Please let me know if I can assist with any further information.review.opendev.org/c/openstack/kolla-ansible/+/975351 | 11:58 |
| tafkamax | Hmm I can't seem to use git review, it asks for password instead of ssh key. | 11:59 |
| AminAlimoradi | Hi all, just following up on issue #975351. Please let me know if I can assist with any further information. review.opendev.org/c/openstack/kolla-ansible/+/975351 | 11:59 |
| bbezak | tafkamax: did you follow https://docs.openstack.org/doc-contrib-guide/quickstart/first-timers.html ? | 12:01 |
| tafkamax | I followed this one: https://docs.opendev.org/opendev/infra-manual/latest/developers.html | 12:02 |
| tafkamax | I just found the one you linked and there is an example ssh remote | 12:02 |
| bbezak | AminAlimoradi: thx. I added review priority to that patch | 12:02 |
| bbezak | I think I just need that in my .gitconfig: | 12:03 |
| bbezak | cat .gitconfig | 12:03 |
| bbezak | [gitreview] | 12:03 |
| bbezak | username = b.bezak | 12:03 |
| bbezak | (The same username as in gerrit options) | 12:04 |
| bbezak | And the same ssh key existing in ssh-agent | 12:04 |
| bbezak | And that was it | 12:04 |
| tafkamax | i almost got it | 12:06 |
| tafkamax | I need to use my personal email | 12:06 |
| tafkamax | port seemed to be ok now | 12:06 |
| AminAlimoradi | @bbezak: Thanks for your attention. | 12:06 |
| opendevreview | Taavi Ansper proposed openstack/kolla-ansible master: Add CI coverage for keystone_identity_providers under federation scenario. https://review.opendev.org/c/openstack/kolla-ansible/+/975901 | 12:08 |
| tafkamax | Ok thanks for help. | 12:09 |
| tafkamax | Lets see what CI does. I am thinking that I have defined custom mappings aswell, which require extra variables. I can try to add them aswell, but should they be as an variable or a separate file? | 12:10 |
| * tafkamax sent a code block: https://matrix.org/oftc/media/v1/media/download/AWueq6oGoHgvuCtAAV1BJ5NL9H9rb70gn5w-84kPEemPWIGvMv7XWRk_xDu4sEEbFYNZyLqn2zHDiEDCh3CPru1CecevXOCQAG1hdHJpeC5vcmcvcWRtYUtHbmFhVndSdU9QTmpBa1dvWElm | 12:10 | |
| tafkamax | Should I add somebody who I wish to add as reviewer myself or will people pick it up? https://review.opendev.org/c/openstack/kolla-ansible/+/975901 | 12:18 |
| bbezak | I can take a look | 12:18 |
| bbezak | thx | 12:18 |
| tafkamax | At first imperssions the git review is pretty cool as an mechanism | 12:22 |
| tafkamax | never used it before | 12:22 |
| bbezak | Yes, I love it too :) | 12:24 |
| bbezak | You can check the jobs running for your change here - https://zuul.opendev.org/t/openstack/status?change=975901 | 12:24 |
| bbezak | Even before they will finish | 12:25 |
| tafkamax | ok thxx | 12:25 |
| blanson[m] | wait I didn't you could see job results live | 12:58 |
| blanson[m] | I always waited a freaking hour or two to get the callback in gerrit | 12:58 |
| bbezak | :D | 12:58 |
| blanson[m] | that's very cool | 12:59 |
| bbezak | Now you know | 12:59 |
| blanson[m] | thanks ! :D | 12:59 |
| bbezak | Np ;) | 13:07 |
| opendevreview | Pierre Riteau proposed openstack/kolla-ansible master: Add support for changing Grafana admin username https://review.opendev.org/c/openstack/kolla-ansible/+/974993 | 14:21 |
| opendevreview | John Garbutt proposed openstack/kolla-ansible master: Stop setting ha_vrrp_health_check_interval by default https://review.opendev.org/c/openstack/kolla-ansible/+/975915 | 15:14 |
| opendevreview | Pierre Riteau proposed openstack/kolla-ansible master: Add support for changing Grafana admin username https://review.opendev.org/c/openstack/kolla-ansible/+/974993 | 15:16 |
| opendevreview | John Garbutt proposed openstack/kolla-ansible master: Stop setting ha_vrrp_health_check_interval by default https://review.opendev.org/c/openstack/kolla-ansible/+/975915 | 15:42 |
| tafkamax | Seems i need to add metadata folder | 17:03 |
| * tafkamax sent a code block: https://matrix.org/oftc/media/v1/media/download/AYUJKB75Y6om7jvJUzSmKEdiixeCMXZnLZAEOcjLsH10am3Cn3PAi0LMgLYIsaHw6kFx11jtdqtzR0kdpXo8os1CecfAHafgAG1hdHJpeC5vcmcvd3lkSlhQUEVjZnhvaVV3Yk9zc2tmRXNO | 17:03 | |
| tafkamax | sorry for long paste | 17:03 |
| tafkamax | https://zuul.opendev.org/t/openstack/build/a18d5b560f144c67a0396a1ef1510c53/log/primary/logs/ansible/deploy | 17:03 |
| opendevreview | Pablo Colson proposed openstack/kolla-ansible master: valkey: Fix undefined 'redis' group error during upgrade https://review.opendev.org/c/openstack/kolla-ansible/+/975932 | 17:07 |
| -opendevstatus- NOTICE: Gerrit on review.opendev.org will experience a short outage while we upgrade it to 3.11.8 | 17:50 | |
| opendevreview | Bartosz Bezak proposed openstack/kolla master: [release] Use UCA Gazpacho https://review.opendev.org/c/openstack/kolla/+/975940 | 18:21 |
| opendevreview | Piotr Milewski proposed openstack/kolla-ansible stable/2025.2: valkey: fix upgrade failure when redis inventory group is absent https://review.opendev.org/c/openstack/kolla-ansible/+/975941 | 18:27 |
| opendevreview | Piotr Milewski proposed openstack/kolla-ansible master: valkey: fix upgrade failure when redis inventory group is absent https://review.opendev.org/c/openstack/kolla-ansible/+/975945 | 18:47 |
| fungi | i like how https://devguide.python.org/developer-workflow/psrt/ relies on cut-and-paste response templates like we do | 20:05 |
| fungi | i notice they have sections on how to join their equivalent of a vmt, and enumerate the responsibilities | 20:06 |
| fungi | someone added a security advisory task to a 3yo public cinder bug earlier today: https://bugs.launchpad.net/cinder/+bug/2020113 | 20:49 |
| fungi | anyone know what that's about? | 20:49 |
| fungi | i just realized my buffer numbers shifted and this is not the #openstack-security channel. sorry everybody! | 20:50 |
| opendevreview | Pierre Riteau proposed openstack/kayobe master: Remove compatibility with Ansible 11 https://review.opendev.org/c/openstack/kayobe/+/975963 | 21:14 |
| opendevreview | Pierre Riteau proposed openstack/kayobe master: Remove compatibility with Ansible 11 https://review.opendev.org/c/openstack/kayobe/+/975963 | 21:14 |
| pabloclsn | is Piotr Milewski here ? | 22:38 |
| pabloclsn | what sould we do about those two : https://review.opendev.org/c/openstack/kolla-ansible/+/975932 https://review.opendev.org/c/openstack/kolla-ansible/+/975945 whats the best way they wre created 20 min apart | 22:40 |
| *** gmaan is now known as gmaan_afk | 22:46 | |
Generated by irclog2html.py 4.0.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!