| *** cshen has joined #openstack-qa | 00:15 | |
| *** cshen has quit IRC | 00:20 | |
| *** fnaval has joined #openstack-qa | 00:38 | |
| *** fnaval has quit IRC | 00:46 | |
| *** fnaval has joined #openstack-qa | 00:49 | |
| *** markvoelker has joined #openstack-qa | 00:50 | |
| *** mriedem_away is now known as mriedem | 00:54 | |
| *** mriedem has quit IRC | 01:04 | |
| *** artom has joined #openstack-qa | 01:11 | |
| openstackgerrit | Ghanshyam Mann proposed openstack/tempest master: DNM: Testing all legacy jobs on bionic https://review.openstack.org/641893 | 01:19 |
|---|---|---|
| *** markvoelker has quit IRC | 01:23 | |
| *** whoami-rajat has joined #openstack-qa | 01:23 | |
| *** cshen has joined #openstack-qa | 02:15 | |
| *** cshen has quit IRC | 02:20 | |
| *** markvoelker has joined #openstack-qa | 02:20 | |
| *** hongbin has joined #openstack-qa | 02:42 | |
| *** jhesketh has quit IRC | 02:45 | |
| *** jhesketh has joined #openstack-qa | 02:47 | |
| *** markvoelker has quit IRC | 02:53 | |
| *** ramishra has joined #openstack-qa | 02:55 | |
| openstackgerrit | Ghanshyam Mann proposed openstack-dev/bashate master: DNM: Testing bionic nodeset https://review.openstack.org/641903 | 02:57 |
| openstackgerrit | Ghanshyam Mann proposed openstack/devstack-plugin-ceph master: DNM: Testing bionic nodeset https://review.openstack.org/641904 | 03:02 |
| *** ianw_pto has quit IRC | 03:23 | |
| *** ianw has joined #openstack-qa | 03:23 | |
| *** lbragstad has quit IRC | 03:32 | |
| *** markvoelker has joined #openstack-qa | 03:50 | |
| openstackgerrit | Ghanshyam Mann proposed openstack/stackviz master: DNM: Testing bionic nodeset https://review.openstack.org/641916 | 04:15 |
| openstackgerrit | Ghanshyam Mann proposed openstack/stackviz master: Move legacy-periodic-package-stackviz-element job to stackviz repo https://review.openstack.org/641918 | 04:23 |
| *** markvoelker has quit IRC | 04:23 | |
| *** whoami-rajat has quit IRC | 04:33 | |
| openstackgerrit | Ghanshyam Mann proposed openstack-dev/grenade master: DNM: Testing bionic nodeset https://review.openstack.org/641921 | 04:36 |
| openstackgerrit | Ghanshyam Mann proposed openstack/stackviz master: Move legacy-periodic-package-stackviz-element job to stackviz repo https://review.openstack.org/641918 | 04:41 |
| *** whoami-rajat has joined #openstack-qa | 04:53 | |
| *** lbragstad has joined #openstack-qa | 05:15 | |
| *** markvoelker has joined #openstack-qa | 05:20 | |
| *** hongbin has quit IRC | 05:42 | |
| *** markvoelker has quit IRC | 05:53 | |
| *** ccamposr has joined #openstack-qa | 06:49 | |
| *** markvoelker has joined #openstack-qa | 06:51 | |
| openstackgerrit | Manik Bindlish proposed openstack/tempest master: Add py37 tox env https://review.openstack.org/641935 | 06:51 |
| *** Luzi has joined #openstack-qa | 06:53 | |
| *** sridharg has joined #openstack-qa | 07:06 | |
| *** ramishra has quit IRC | 07:10 | |
| openstackgerrit | Manik Bindlish proposed openstack/patrole master: Add py36 and py37 tox envs https://review.openstack.org/641949 | 07:21 |
| *** markvoelker has quit IRC | 07:23 | |
| openstackgerrit | Manik Bindlish proposed openstack/tempest-stress master: Add py36 and py37 tox envs https://review.openstack.org/641952 | 07:25 |
| *** ramishra has joined #openstack-qa | 07:25 | |
| *** pcaruana has joined #openstack-qa | 07:26 | |
| *** lbragstad has quit IRC | 07:28 | |
| *** cshen has joined #openstack-qa | 07:29 | |
| openstackgerrit | Manik Bindlish proposed openstack/stackviz master: Add py36 and py37 tox envs https://review.openstack.org/641954 | 07:39 |
| *** gkadam__ has joined #openstack-qa | 07:50 | |
| *** rpittau|afk is now known as rpittau | 08:06 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/tempest master: Fixing test cases of role_assignment by project https://review.openstack.org/641959 | 08:08 |
| *** markvoelker has joined #openstack-qa | 08:20 | |
| *** rfolco has joined #openstack-qa | 08:36 | |
| *** rfolco|ruck has quit IRC | 08:38 | |
| *** iurygregory|home is now known as iurygregory | 08:40 | |
| *** markvoelker has quit IRC | 08:53 | |
| *** pcaruana has quit IRC | 09:12 | |
| *** cshen has quit IRC | 09:23 | |
| *** pcaruana has joined #openstack-qa | 09:27 | |
| *** rcernin has quit IRC | 09:47 | |
| *** markvoelker has joined #openstack-qa | 09:51 | |
| *** ramishra has quit IRC | 10:05 | |
| *** amodi has quit IRC | 10:15 | |
| *** markvoelker has quit IRC | 10:23 | |
| openstackgerrit | afazekas proposed openstack/tempest master: Add autopep8 to tox.ini https://review.openstack.org/641978 | 10:28 |
| *** gfidente has joined #openstack-qa | 10:32 | |
| *** yamamoto has quit IRC | 10:43 | |
| *** ramishra has joined #openstack-qa | 10:48 | |
| *** cshen has joined #openstack-qa | 10:51 | |
| *** dtantsur|afk is now known as dtantsur | 11:08 | |
| *** yamamoto has joined #openstack-qa | 11:18 | |
| *** markvoelker has joined #openstack-qa | 11:20 | |
| *** yamamoto has quit IRC | 11:25 | |
| *** yamamoto has joined #openstack-qa | 11:26 | |
| *** cshen has quit IRC | 11:35 | |
| *** gcheresh_ has joined #openstack-qa | 11:37 | |
| *** cshen has joined #openstack-qa | 11:40 | |
| *** raissa has joined #openstack-qa | 11:44 | |
| *** raissa has quit IRC | 11:46 | |
| *** markvoelker has quit IRC | 11:54 | |
| *** gcheresh_ has quit IRC | 11:58 | |
| *** gkadam__ has quit IRC | 12:02 | |
| *** raildo has joined #openstack-qa | 12:03 | |
| *** gkadam has joined #openstack-qa | 12:04 | |
| *** gfidente has quit IRC | 12:07 | |
| *** tosky has joined #openstack-qa | 12:12 | |
| *** gfidente has joined #openstack-qa | 12:45 | |
| *** zbr|ssbarnea has quit IRC | 12:46 | |
| *** zbr has joined #openstack-qa | 12:47 | |
| openstackgerrit | Kashyap Chamarthy proposed openstack-dev/devstack master: Capture the content of 'audit.log' file https://review.openstack.org/638757 | 12:49 |
| *** iurygregory is now known as iurygregory_mtg | 12:53 | |
| *** sridharg has quit IRC | 12:56 | |
| *** sridharg has joined #openstack-qa | 12:59 | |
| *** rh-jelabarre has joined #openstack-qa | 13:04 | |
| *** frickler has quit IRC | 13:17 | |
| *** frickler has joined #openstack-qa | 13:18 | |
| *** iurygregory_mtg is now known as iurygregory | 13:24 | |
| *** ramishra has quit IRC | 13:27 | |
| *** yamamoto has quit IRC | 13:27 | |
| *** pcaruana has quit IRC | 13:30 | |
| *** dave-mccowan has joined #openstack-qa | 13:30 | |
| *** dave-mccowan has quit IRC | 13:34 | |
| *** mriedem has joined #openstack-qa | 13:38 | |
| *** lbragstad has joined #openstack-qa | 13:44 | |
| *** yamamoto has joined #openstack-qa | 13:54 | |
| openstackgerrit | Matt Riedemann proposed openstack-infra/elastic-recheck master: Add query for nova evacuate --force bug 1819166 https://review.openstack.org/642020 | 14:00 |
| openstack | bug 1819166 in OpenStack Compute (nova) "nova-live-migration evacuation tests fail with "error: unrecognized arguments: --force"" [Critical,In progress] https://launchpad.net/bugs/1819166 - Assigned to sean mooney (sean-k-mooney) | 14:00 |
| afazekas | gmann, tosky: what do you think about autopep8 ? https://review.openstack.org/#/c/641978/ is it something worth to add to the requirements ? | 14:08 |
| *** rfolco is now known as rfolco|ruck | 14:08 | |
| afazekas | It is auto-formatting tool, so the tool does the formatting for you | 14:09 |
| mriedem | that would ruin diffs wouldn't it? | 14:11 |
| tosky | but do we need format.sh? People could use the tox environment, or another tox environment could be focused on reformatting only | 14:13 |
| *** sridharg has quit IRC | 14:18 | |
| afazekas | mriedem, That why added it to the pep8 task as well | 14:18 |
| afazekas | tosky, invoking things outside tox usually faster, but IMHO I can add tox entry as well (or instead) | 14:20 |
| *** markvoelker has joined #openstack-qa | 14:20 | |
| afazekas | mriedem, in the tox pep8 entry it checks is the source pep8auto formatted , the format.sh is the one which does the auto formating ATM | 14:21 |
| * afazekas BTW, the alphabet rule can be done with isort -rc -sl | 14:23 | |
| gmann | afazekas: it seems follow PEP 8 style guide and uses the pycodestyle which make it safe. | 14:23 |
| gmann | yeah as along as we fix all formatting in starting and then run as part of pep8 env it would not introduce any format change other than current patch modified code. | 14:24 |
| afazekas | it may shift things too right and you need to break it after (4 line case) | 14:24 |
| afazekas | gmann, yes, it keeps this format stable | 14:25 |
| gmann | means? it will check line length also right | 14:25 |
| * afazekas let me retest something ~ 5min | 14:25 | |
| gmann | sure | 14:27 |
| openstackgerrit | Merged openstack-infra/elastic-recheck master: Add query for nova evacuate --force bug 1819166 https://review.openstack.org/642020 | 14:27 |
| openstack | bug 1819166 in OpenStack Compute (nova) "nova-live-migration evacuation tests fail with "error: unrecognized arguments: --force"" [Critical,In progress] https://launchpad.net/bugs/1819166 - Assigned to sean mooney (sean-k-mooney) | 14:28 |
| afazekas | gmann, http://pastebin.test.redhat.com/733976 looks like it some cases makes the line longer , it was only 4 line case in the whole tempest | 14:28 |
| *** awaugama has joined #openstack-qa | 14:30 | |
| afazekas | gmann, sorry, wrong url : http://paste.openstack.org/show/747453/ | 14:30 |
| gmann | afazekas: :) i was about to ask the redhat access from yo | 14:30 |
| gmann | you | 14:30 |
| afazekas | gmann, The current version made me to format 4 line after running it | 14:30 |
| afazekas | gmann, send a CV ;-) | 14:31 |
| *** sridharg has joined #openstack-qa | 14:31 | |
| gmann | afazekas: and does it control of usual line length ? | 14:32 |
| gmann | and when u correct those 4 line does it fail saying format is not correct now? and will it change them again when re run ? | 14:33 |
| afazekas | gmann, no, after that it keeps it as is | 14:34 |
| gmann | humm | 14:34 |
| afazekas | gmann, In the given exmple it wanted it to be alligned to some upper thing | 14:35 |
| afazekas | gmann, I applied the --experimental option, then it keeped the length | 14:36 |
| gmann | ok so we need to make those line shorter with following the autopep8 format otherwise it should change them back | 14:36 |
| *** pcaruana has joined #openstack-qa | 14:37 | |
| afazekas | gmann, This is what it did instead: http://paste.openstack.org/show/747454/ | 14:37 |
| afazekas | gmann, If you check my patch, I broken the long sting literals to smaller ones | 14:38 |
| afazekas | gmann, L197 change is hand made: https://review.openstack.org/#/c/641978/1/tempest/tests/lib/services/compute/test_images_client.py | 14:38 |
| afazekas | gmann, --experimental did not changed the formatting did by the non experimental after breaking the lines , maybe we want to have --experimental | 14:41 |
| afazekas | beside the scary name it works so far .. | 14:42 |
| *** markvoelker has quit IRC | 14:54 | |
| * afazekas creating an experimental variant | 15:03 | |
| openstackgerrit | afazekas proposed openstack/tempest master: Add autopep8 to tox.ini https://review.openstack.org/641978 | 15:04 |
| afazekas | gmann, The tool did it fully automatically this time ^ | 15:04 |
| *** Luzi has quit IRC | 15:08 | |
| afazekas | If the experimental causes issues anytime we just need to remove the flag or the tool until it gets fixed or lock it to an exact version | 15:10 |
| gmann | afazekas: but --experimental is not always consistent. it says "enable experimental fixes' and currenrtly it is for shorten line - https://github.com/hhatto/autopep8/blob/462069ef65448ac7dcb46d58b079c769587ec0fa/autopep8.py#L1872 | 15:10 |
| gmann | so in your case it did not change the manual format of lenght line because --experimental allow that . | 15:11 |
| gmann | so other than line length any other issue without --experimental | 15:12 |
| afazekas | I am not aware of any other issue, it could be faster , but I am never happy with tools speed ;-) | 15:13 |
| gmann | ok | 15:14 |
| lbragstad | gmann you're in CST now, yeah? | 15:15 |
| gmann | lbragstad: yeah | 15:16 |
| gmann | enjoying the cold :) its really too cold | 15:16 |
| lbragstad | lol | 15:17 |
| lbragstad | welcome ;) | 15:17 |
| *** amodi has joined #openstack-qa | 15:18 | |
| lbragstad | gmann i'm wondering if you'd like to sync on https://review.openstack.org/#/c/624794/ sometime today? | 15:19 |
| afazekas | gmann, we can try the aggressive option .. | 15:23 |
| gmann | lbragstad: sure. how about an hour. i will update myself on previous results of system scope testing etc | 15:23 |
| lbragstad | sweet - that works for me | 15:23 |
| lbragstad | cc cmurphy (if you're interested) | 15:24 |
| fungi | so... moving here from #openstack-infra, sean-k-mooney noticed that privsep-helper was being executed under python2 on python3-based devstack jobs and i think i've narrowed it down to the entrypoint wrappers getting overwritten when devstack does this: http://git.openstack.org/cgit/openstack-dev/devstack/tree/inc/python#n441 | 15:24 |
| gmann | lbragstad: cmurphy setting a ad hoc meeting at 10.30 CST (4:30 p.m UTC) today on qa channel. | 15:25 |
| lbragstad | ack | 15:25 |
| fungi | projects want to call the privsep-helper entrypoint directly, due to how it's implemented, but reinstalling it with python2 overwrites the entrypoint wrapper it provides | 15:25 |
| fungi | is this already a known problem with an established solution? | 15:26 |
| cmurphy | gmann: lbragstad will try to check in after some errands | 15:30 |
| * lbragstad nods | 15:30 | |
| fungi | anyway, i need to run, but if anyone has any ideas i'll check scrollback when i return from errands | 15:31 |
| gmann | fungi: does it install under py3 also - http://git.openstack.org/cgit/openstack-dev/devstack/tree/inc/python#n451 | 15:31 |
| gmann | s/does it/does not it | 15:32 |
| fungi | gmann: it does first under python3 and then under python2 and the latter overwrites the entrypoint wrapper form the former | 15:32 |
| fungi | so when you call privsep-helper directly it gets executed under python2 | 15:33 |
| fungi | due to the shebang in the wrapper | 15:33 |
| fungi | i'll be back in a couple hours to continue | 15:33 |
| *** yamamoto has quit IRC | 15:48 | |
| *** yamamoto has joined #openstack-qa | 15:49 | |
| *** mjturek has joined #openstack-qa | 15:49 | |
| *** TheJulia is now known as needssleep | 15:50 | |
| *** markvoelker has joined #openstack-qa | 15:51 | |
| *** yamamoto has quit IRC | 15:51 | |
| *** dtantsur is now known as creepy_owlet | 15:52 | |
| *** mjturek has quit IRC | 15:54 | |
| *** mjturek has joined #openstack-qa | 15:56 | |
| *** lbragstad is now known as elbragstad | 15:58 | |
| gmann | afazekas: have not checked aggressive option. | 16:00 |
| *** yamamoto has joined #openstack-qa | 16:01 | |
| *** cmurphy is now known as cmorpheus | 16:02 | |
| *** mjturek has quit IRC | 16:05 | |
| *** artom has quit IRC | 16:05 | |
| *** yamamoto has quit IRC | 16:07 | |
| *** mjturek has joined #openstack-qa | 16:10 | |
| *** mjturek has quit IRC | 16:11 | |
| *** mjturek has joined #openstack-qa | 16:12 | |
| *** artom has joined #openstack-qa | 16:20 | |
| *** cshen has quit IRC | 16:22 | |
| *** markvoelker has quit IRC | 16:23 | |
| clarkb | fungi: gmann it should probably install the requested global python version last so that it defaults to that version | 16:24 |
| clarkb | but then keep py2 around or py3 in case there are things that need it | 16:25 |
| gmann | clarkb: ok. but in py3 job case py3 version should be installed as last as per installation order of that function. | 16:31 |
| gmann | need to check more after meeting | 16:31 |
| gmann | elbragstad: cmorpheus i am here for admin domain scope discussion | 16:32 |
| cmorpheus | hi | 16:32 |
| elbragstad | o/ | 16:32 |
| *** artom has quit IRC | 16:33 | |
| * elbragstad is about to push a string of patches for an example | 16:33 | |
| gmann | ok | 16:33 |
| *** gkadam has quit IRC | 16:33 | |
| elbragstad | ok - so here https://review.openstack.org/#/c/624218/7 | 16:36 |
| elbragstad | ^ is the start of a string of patches that add support for domain users to access the project API | 16:36 |
| elbragstad | (in addition to system users - but that all landed in previous string of patches) | 16:37 |
| elbragstad | based on what I know about devstack options and tempest - those patches will trip on https://review.openstack.org/#/c/624794/ | 16:37 |
| elbragstad | er - because admin_domain_scope defaults to True | 16:37 |
| elbragstad | (e.g., the responses for domain administrators are going to include projects outside of the domain the user actually has authorization on) | 16:38 |
| gmann | as 624218 add he domain_id in target for policy authorization, does not that mean cross domain resource access are stopped ? | 16:40 |
| elbragstad | so - additionally in that patch we're doing this | 16:41 |
| elbragstad | https://review.openstack.org/#/c/624218/7/keystone/api/projects.py@135 | 16:41 |
| elbragstad | which filters the project list based on the domain_id, iff the API was called with a domain scoped token and passed the initial policy check | 16:42 |
| elbragstad | (which is done at line 120) | 16:42 |
| *** artom has joined #openstack-qa | 16:45 | |
| gmann | ok. but it still need domain scope to be requested with when say list projects etc | 16:46 |
| elbragstad | yes | 16:46 |
| elbragstad | that's handled here - https://review.openstack.org/#/c/624218/7/keystone/common/policies/project.py,unified@41 | 16:46 |
| clarkb | gmann: I see | 16:51 |
| gmann | elbragstad: ok so when tempest will request without domain scope then, how keystone still pass the request. | 16:54 |
| *** iurygregory has quit IRC | 16:55 | |
| elbragstad | gmann so - if you write a test that attempts to call GET /v3/projects with a project-scoped token - you should receive a 403 | 16:56 |
| elbragstad | conversely, if you call GET /v3/projects with a system-scoped token, you should receive a list of all projects in the deployment (e.g., not filtered by domain) | 16:56 |
| mriedem | gmann: why is nova-live-migration non-voting in the tempest check queue? http://git.openstack.org/cgit/openstack/tempest/tree/.zuul.yaml#n559 | 17:00 |
| mriedem | it's voting and gating in nova, | 17:00 |
| mriedem | so if you're going to run it in check, wouldn't you want it to be voting? | 17:00 |
| gmann | elbragstad: and with new rule in 624218, it should be success if domain scope right ? | 17:01 |
| elbragstad | correct - if you call GET /v3/projects with a domain-scoped token, you'll get back a list of project, but only with that domain | 17:01 |
| elbragstad | right now tempest asserts domain admins have the ability to list all domains in the deployment when configured a certain way | 17:01 |
| gmann | mriedem: it might be from starting. but do we need to run it on tempest as tempest-multinode-full is voting on tempest. | 17:02 |
| gmann | elbragstad: yeah my next question is about list domains tests - https://github.com/openstack/tempest/blob/master/tempest/api/identity/admin/v3/test_domains.py | 17:02 |
| *** e0ne has joined #openstack-qa | 17:03 | |
| elbragstad | gmann yep - we landed support for all that in the series starting here - https://review.openstack.org/#/c/623334/ | 17:04 |
| elbragstad | system users have the ability to do anything with domains | 17:04 |
| elbragstad | domain users and project users are allowed to access domains they have authorization on | 17:05 |
| gmann | elbragstad: i see. | 17:05 |
| mriedem | gmann: nova-live-migration runs live migration tests with lvm (local disk) and rbd (shared) and it also runs evacuate testing, which we don't have in any other ojb | 17:06 |
| mriedem | *job | 17:06 |
| elbragstad | it's a little weird to wrap your head around all of it - but it depends a lot on the resource | 17:06 |
| gmann | elbragstad: keystone does support the old rules also and that's why 624794 pass | 17:06 |
| mriedem | it should probably be renamed to nova-live-migrate-evacuate | 17:06 |
| elbragstad | gmann correct - in fact oslo.policy is what does that for us | 17:06 |
| gmann | elbragstad: but when you remove the admin domain scope and start system_scope then only it will pass otherwise fail. | 17:06 |
| gmann | yea | 17:07 |
| * elbragstad grabs a link | 17:07 | |
| elbragstad | https://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/policies/domain.py#n26 | 17:07 |
| gmann | mriedem: evacuate testing from tempest tests ? i think that is from nova script only | 17:07 |
| mriedem | yeah it's a post-script on the job | 17:08 |
| gmann | elbragstad: yeah | 17:08 |
| mriedem | https://github.com/openstack/nova/blob/master/gate/test_evacuate.sh | 17:08 |
| *** e0ne has quit IRC | 17:08 | |
| mriedem | so that's not really something tempest cares about... | 17:08 |
| mriedem | gmann: anyway, you probably don't really need the job on tempest at all then | 17:08 |
| elbragstad | so - you're right gmann, the reason why some of those tests pass is because they are being executed as a user that passes the old check string | 17:08 |
| gmann | mriedem: yeah but do you think any test change can break this when those tests covered as run by tempest-multinode-full | 17:09 |
| gmann | mriedem: yeah, i will check check why we added that at first place may be for live migration tests coverage because tempest-multinode-full was not there that time | 17:09 |
| mriedem | not it's really just a different environment setup | 17:10 |
| mriedem | local disk + shared disk + evacuate | 17:10 |
| gmann | mriedem: yeah i mean from tempest gate side. for nova it make sense along with tempest-multinode-full | 17:10 |
| gmann | to avoid any break in that job due to tempest tests change | 17:11 |
| gmann | elbragstad: but tempest does pass system ready role yet and removing domain scope access should fail tests(because old rule required it right ?) | 17:12 |
| gmann | s/does/does not | 17:12 |
| *** pcaruana has quit IRC | 17:12 | |
| cmorpheus | oslo.policy still uses enforce_scope=false so it shouldn't make a difference yet iiuc | 17:14 |
| *** amodi has quit IRC | 17:14 | |
| elbragstad | gmann so - this is part where i still getting confused | 17:15 |
| elbragstad | https://git.openstack.org/cgit/openstack/tempest/tree/tempest/api/identity/admin/v3/test_list_projects.py?id=c975f08e9be0273ff0832bc24e6acb2f704c2717#n26 | 17:15 |
| elbragstad | ^ that fails https://review.openstack.org/#/c/624218/7 if admin_domain_scope = True | 17:16 |
| elbragstad | so - it's almost as if tempest is assert the domain admin has access to things isn't doesn't have authorization | 17:17 |
| elbragstad | to access | 17:17 |
| gmann | mriedem: this is where i added in favor of removing the live migration test from old scenario job (tempest-slow now) but tempest-multinode-full cover them - Ia4d13ae6dd8bcbfd40dcd624e1837cc07898bb36 | 17:17 |
| elbragstad | results: http://logs.openstack.org/18/624218/6/check/tempest-full/843d72c/testr_results.html.gz | 17:18 |
| *** fnaval has joined #openstack-qa | 17:19 | |
| *** markvoelker has joined #openstack-qa | 17:20 | |
| gmann | elbragstad: in second fail project, it seems it get empty project list | 17:24 |
| elbragstad | yeah | 17:24 |
| *** gfidente has quit IRC | 17:24 | |
| gmann | but test user is still admin (with domain scope) so it should be able to access the project list | 17:25 |
| elbragstad | ps4 https://review.openstack.org/#/c/624218/4 apparently passed that test when i disabled admin_domain_scope | 17:25 |
| *** creepy_owlet is now known as dtantsur|afk | 17:29 | |
| elbragstad | well - i guess that depends on if the projects in that tests are under the domain the user has access to? | 17:30 |
| *** rpittau is now known as rpittau|afk | 17:31 | |
| gmann | i think it has access to that domain. | 17:34 |
| gmann | i am checking if domain_id is something different when tempest add the domain scope. | 17:36 |
| elbragstad | ok - https://git.openstack.org/cgit/openstack/tempest/tree/tempest/api/identity/admin/v3/test_list_projects.py?id=c975f08e9be0273ff0832bc24e6acb2f704c2717#n67 | 17:36 |
| elbragstad | ^ that test is just testing a user can filter by enabled, right? | 17:37 |
| gmann | filter projects with enabled. | 17:38 |
| gmann | or does 'enable' filter has access restriction ? | 17:38 |
| elbragstad | ok - yeah, that makes sense | 17:39 |
| elbragstad | it's just filtering by the enabled attribute | 17:40 |
| elbragstad | fwiw - i just did this locally https://pasted.tech/pastes/8ee2aa79d9ceabf475306d5c3434bf17977109be.raw | 17:40 |
| elbragstad | and it passes for domain reader, members, and admins https://pasted.tech/pastes/84f1b02a3ebbbd10c75f7d0856690fec3c0c7fb5.raw | 17:40 |
| *** mriedem is now known as mriedem_burgers | 17:43 | |
| gmann | in log of PS6 - domain id while creating project is "domain_id": "d5e25e40081d434a89a6ff785e3cb7e9" - http://logs.openstack.org/18/624218/6/check/tempest-full/843d72c/controller/logs/tempest_log.txt.gz#_2019-02-21_22_32_12_027 | 17:48 |
| elbragstad | so - this patch https://review.openstack.org/#/c/624218/6 | 17:51 |
| elbragstad | http://logs.openstack.org/18/624218/6/check/tempest-full/843d72c/controller/logs/tempest_log.txt.gz#_2019-02-21_22_32_12_368 comes up empty | 17:51 |
| gmann | but did not find the complete list of projects during GET project request. . other tests request does get the project with 'default ' domain though - http://logs.openstack.org/18/624218/6/check/tempest-full/843d72c/controller/logs/tempest_log.txt.gz#_2019-02-21_22_32_12_453 | 17:52 |
| elbragstad | http://logs.openstack.org/18/624218/6/check/tempest-full/843d72c/controller/logs/tempest_log.txt.gz#_2019-02-21_22_32_11_892 shows the domain id being "d5e25e40081d434a89a6ff785e3cb7e9" | 17:53 |
| gmann | yeah but i was thinking to check the complete existing list of project with their domain id when tempest requested with 'enabled=false' | 17:53 |
| *** markvoelker has quit IRC | 17:54 | |
| gmann | yes, that domain_is is used for project cls.p1 creation - https://git.openstack.org/cgit/openstack/tempest/tree/tempest/api/identity/admin/v3/test_list_projects.py?id=c975f08e9be0273ff0832bc24e6acb2f704c2717#n48 | 17:54 |
| gmann | we can add debug log with GET projects without filter in same test before GET projects with filter | 17:55 |
| openstackgerrit | Ghanshyam Mann proposed openstack/tempest master: DNM: for testing domain scope https://review.openstack.org/642097 | 17:57 |
| elbragstad | huh | 17:57 |
| elbragstad | interesting | 17:57 |
| gmann | elbragstad: ^^ with this we will be able to see all project present in keystone and what tempest test get | 17:57 |
| gmann | oh but it will use your devstack patch also as depends-on | 17:58 |
| elbragstad | awesome | 17:58 |
| elbragstad | so - i _think_ the domain being used in the tokens scope actually mismatches the domain the projects live in for that test | 17:58 |
| gmann | can i do Depends-On with PS? | 17:58 |
| elbragstad | gmann yep | 17:58 |
| openstackgerrit | Ghanshyam Mann proposed openstack/tempest master: DNM: for testing domain scope https://review.openstack.org/642097 | 17:59 |
| gmann | elbragstad: ^^ this work? | 17:59 |
| elbragstad | this in the dynamic creds code | 17:59 |
| elbragstad | with this we will be able to see all project present in k | 17:59 |
| elbragstad | bah - bad paste... | 17:59 |
| elbragstad | https://git.openstack.org/cgit/openstack/tempest/tree/tempest/lib/common/dynamic_creds.py?id=c975f08e9be0273ff0832bc24e6acb2f704c2717#n192 | 17:59 |
| elbragstad | which calls https://git.openstack.org/cgit/openstack/tempest/tree/tempest/lib/common/cred_client.py?id=c975f08e9be0273ff0832bc24e6acb2f704c2717#n177 | 18:00 |
| *** mattw4 has joined #openstack-qa | 18:01 | |
| elbragstad | i don't think that's actually getting the domain from https://git.openstack.org/cgit/openstack/tempest/tree/tempest/api/identity/admin/v3/test_list_projects.py?id=c975f08e9be0273ff0832bc24e6acb2f704c2717#n43 ? | 18:01 |
| gmann | but that gets called before tests create projects in resource_setup | 18:01 |
| elbragstad | ah | 18:02 |
| gmann | that is all setup before test code. its during setUpClass - | 18:02 |
| elbragstad | ok - so the clients have a creds object to use i suppose | 18:03 |
| gmann | yes. | 18:03 |
| elbragstad | so - we'd either need to update the credentials in the test class or reuse the domain that is used for the domain credentials | 18:04 |
| gmann | i think we reuse it from domain cred. let me check | 18:05 |
| gmann | oh it create new domain - https://git.openstack.org/cgit/openstack/tempest/tree/tempest/api/identity/admin/v3/test_list_projects.py?id=c975f08e9be0273ff0832bc24e6acb2f704c2717#n43 | 18:06 |
| elbragstad | mmmmm | 18:06 |
| elbragstad | so - that's in then? | 18:07 |
| elbragstad | s/in/it/ | 18:07 |
| gmann | humm but how a user with different domain access can create project in different domain ? | 18:07 |
| gmann | or i am missing something | 18:07 |
| gmann | because it has admin domain scope ? | 18:08 |
| elbragstad | well - 624218 is for domain reader support | 18:08 |
| gmann | ohk not in POST etc. | 18:09 |
| elbragstad | 624220 includes support for domain admins - which shouldn't be allowed to create projects in domains they don't have authorization on | 18:09 |
| elbragstad | the policy for POST /v3/projects hasn't been updated for domain admin support yet https://review.openstack.org/#/c/624218/7/keystone/common/policies/project.py@114 | 18:10 |
| elbragstad | er - at the time of writing domain reader support | 18:10 |
| elbragstad | ok, so i think we have 3 options? | 18:14 |
| elbragstad | 1.) implement those tests to use the domain from credentials iff admin_domain_scope = True | 18:15 |
| elbragstad | 2.) disable admin_domain_scope for the time being? | 18:16 |
| openstackgerrit | Ghanshyam Mann proposed openstack/tempest master: DNM: testing with using cred domain https://review.openstack.org/642102 | 18:16 |
| elbragstad | actually - think that's it... | 18:16 |
| elbragstad | it's friday, i guess i can be off by one | 18:16 |
| gmann | elbragstad: first option sounds good. trying the same in 642102 | 18:17 |
| gmann | and later we can see if admin_domain_scope things is really needed to set in tempest or not. | 18:17 |
| elbragstad | ++ | 18:17 |
| gmann | as per new changes in keystone policy | 18:18 |
| elbragstad | i guess we use a similar approach for https://review.openstack.org/#/c/623319/6 | 18:18 |
| elbragstad | which is for users (not projects) | 18:18 |
| gmann | yeah make sense. | 18:19 |
| gmann | let's see the result of 642102. | 18:20 |
| elbragstad | cool | 18:20 |
| gmann | thanks for time. even friday :). | 18:20 |
| gmann | elbragstad: we keep this for PTG or you want to catch up sometime before PTG - https://review.openstack.org/#/c/604909/ | 18:21 |
| elbragstad | i guess it's not super critical to get that in prior to the PTG | 18:22 |
| elbragstad | if we have time on the schedule - we might be able to schedule a couple hours to hack on all that stuff and merge it in person? | 18:22 |
| gmann | cool. +1 | 18:23 |
| elbragstad | pending how the ptg schedule shakes out for keystone, er what cmorpheus has up her sleeve | 18:23 |
| gmann | yeah it all within 3 days even horizontal teams might have conflict with other teams sessions. | 18:24 |
| elbragstad | i think the system scope stuff in tempest will be more of a priority in train, especially if we start removing deprecated policies | 18:26 |
| gmann | ok. but we need to see ho much modification it need in tempest as we need to support old policy testing for stable branch with same set of code. | 18:27 |
| gmann | anyways lets figure out during PTG | 18:27 |
| elbragstad | right - that's a good point | 18:27 |
| elbragstad | if https://review.openstack.org/#/c/642102/1 goes green | 18:28 |
| elbragstad | would it be possible to get that merged so we can get https://review.openstack.org/#/c/624218/7 in Stein yet? | 18:28 |
| gmann | yeah if that work, i think we can merge soon | 18:28 |
| elbragstad | cool | 18:28 |
| elbragstad | thanks for all the help gmann | 18:29 |
| gmann | np!. thanks for all discussion. have nice weekend. | 18:29 |
| elbragstad | you, to | 18:29 |
| elbragstad | stay warm | 18:29 |
| gmann | :) | 18:29 |
| gmann | i am waiting for summer so that i can roam out more and more :) | 18:31 |
| *** ccamposr has quit IRC | 18:32 | |
| *** sridharg has quit IRC | 18:34 | |
| elbragstad | summer in that area is awesome | 18:36 |
| fungi | gmann: yeah. i guess the comment there (Turn off Python 3 mode and install the package again, forcing a Python 2 installation.) is somewhat misleading. maybe this isn't what's causing the entrypoint wrapper to point to python2? | 18:43 |
| fungi | clarkb: ^ | 18:44 |
| fungi | yeah, here it's installing via python2 first: http://logs.openstack.org/32/639732/3/check/os-vif-linuxbridge/9f6f380/controller/logs/devstacklog.txt.gz#_2019-02-27_16_42_33_782 | 18:46 |
| fungi | and then via python3 after: http://logs.openstack.org/32/639732/3/check/os-vif-linuxbridge/9f6f380/controller/logs/devstacklog.txt.gz#_2019-02-27_16_43_12_456 | 18:47 |
| gmann | yeah. | 18:48 |
| fungi | but later on when it tries to call privsep-helper it's raising an exception with a python2.7 libpath | 18:48 |
| fungi | http://logs.openstack.org/32/639732/3/check/os-vif-linuxbridge/9f6f380/controller/logs/screen-q-agt.txt.gz | 18:49 |
| fungi | refers to /usr/local/lib/python2.7/dist-packages/oslo_privsep/daemon.py | 18:50 |
| fungi | raising ImportError: No module named neutron.privileged | 18:51 |
| *** markvoelker has joined #openstack-qa | 18:51 | |
| fungi | confusing, for sure | 18:53 |
| *** amodi has joined #openstack-qa | 18:55 | |
| clarkb | do we only install that entrpoint under python2? | 19:10 |
| gmann | clarkb: under both version | 19:11 |
| *** rfolco|ruck is now known as rfolco|ruck|brb | 19:11 | |
| gmann | same kidn of set work fine for all other lib too. for example oslo.config - http://logs.openstack.org/91/637691/1/check/tempest-full-py3/e243108/controller/logs/devstacklog.txt.gz | 19:11 |
| *** mriedem_burgers is now known as mriedem | 19:16 | |
| *** markvoelker has quit IRC | 19:24 | |
| *** artom has quit IRC | 19:42 | |
| *** mjturek has quit IRC | 19:50 | |
| *** mjturek has joined #openstack-qa | 20:02 | |
| *** irclogbot_2 has quit IRC | 20:13 | |
| *** cshen has joined #openstack-qa | 20:16 | |
| *** cshen has quit IRC | 20:20 | |
| *** markvoelker has joined #openstack-qa | 20:21 | |
| *** rfolco|ruck|brb is now known as rfolco|ruck | 20:21 | |
| *** mvkr has quit IRC | 20:24 | |
| *** e0ne has joined #openstack-qa | 20:24 | |
| *** mvkr has joined #openstack-qa | 20:25 | |
| *** artom has joined #openstack-qa | 20:42 | |
| *** yamamoto has joined #openstack-qa | 20:49 | |
| *** markvoelker has quit IRC | 20:53 | |
| *** yamamoto has quit IRC | 20:54 | |
| *** artom has quit IRC | 20:57 | |
| *** slaweq has quit IRC | 20:57 | |
| *** slaweq has joined #openstack-qa | 20:58 | |
| *** mjturek has quit IRC | 21:01 | |
| *** e0ne has quit IRC | 21:03 | |
| openstackgerrit | Merged openstack/tempest master: Remove admin test_l3_agent_scheduler API test module https://review.openstack.org/640767 | 21:18 |
| *** artom has joined #openstack-qa | 21:22 | |
| *** raildo has quit IRC | 21:40 | |
| *** markvoelker has joined #openstack-qa | 21:51 | |
| *** awaugama has quit IRC | 21:52 | |
| *** rh-jelabarre has quit IRC | 22:00 | |
| *** rh-jelabarre has joined #openstack-qa | 22:03 | |
| *** cshen has joined #openstack-qa | 22:16 | |
| *** cshen has quit IRC | 22:21 | |
| *** markvoelker has quit IRC | 22:24 | |
| *** rh-jelabarre has quit IRC | 22:35 | |
| *** irclogbot_2 has joined #openstack-qa | 23:01 | |
| fungi | gmann: clarkb: it's possible they're all doing this and the reason we only see it in this case is because the entrypoint is calling something which wants to import a module which wasn't installed under python2 | 23:07 |
| fungi | the exception is specifically that /usr/local/lib/python2.7/dist-packages/oslo_privsep/daemon.py wants to import neutron.privileged which isn't found | 23:08 |
| clarkb | you'd expect to see that with everything else starting up and importing stuff though | 23:08 |
| fungi | most stuff seems to get double-installed under both python2 and python3 | 23:08 |
| clarkb | but not neutron? | 23:09 |
| fungi | in this case neutron==14.0.0.0b3.dev7 is showing up in pip3-freeze.txt but there's no neutron installed for pip2-freeze.txt | 23:09 |
| clarkb | looks like none of the services get installed under py2 | 23:10 |
| clarkb | which is what we expect so that is good | 23:10 |
| fungi | yeah, but other stuff we call via entrypoint wrappers seems to be getting called under python2 | 23:10 |
| fungi | which is fine until it wants to import something only installed under python3, but probably also not what we intend | 23:11 |
| mtreinish | fungi: is the shebang explicit on version or just python? | 23:11 |
| fungi | just python | 23:11 |
| gmann | yeah rest all will be under py3 only | 23:11 |
| fungi | and this ain't arch linux ;) | 23:11 |
| clarkb | oh! | 23:12 |
| mtreinish | yep, that's what I was thinking :) | 23:12 |
| clarkb | thats a good question mtreinish | 23:12 |
| fungi | the entrypoint wrapper installation _should_ make it python3 if that's what it was installed using, right? | 23:12 |
| clarkb | fungi: "yes" however I think pbr has its own shim | 23:12 |
| fungi | it==the shebang | 23:12 |
| clarkb | and that could be broken | 23:13 |
| clarkb | http://git.openstack.org/cgit/openstack-dev/pbr/tree/pbr/packaging.py#n381 | 23:14 |
| clarkb | its possible the easy install heade retrieval doesn't do what we expect | 23:14 |
| clarkb | ? | 23:14 |
| clarkb | like if easy_install is python2 only | 23:14 |
| fungi | let's see if i can tell | 23:14 |
| fungi | fungi@zuul01:~$ head -n1 /usr/local/bin/zuul | 23:15 |
| fungi | #!/usr/bin/python3 | 23:15 |
| fungi | looks to me like it works | 23:15 |
| clarkb | try the install python2 first tgen do python3 | 23:16 |
| clarkb | maybe that breaks easy install? | 23:16 |
| clarkb | but ya that looks fine | 23:16 |
| fungi | possible | 23:16 |
| fungi | i mean, that's what the sequence seems to be according to the log (it installs python2 first then python3, even though the comment confusingly implies the opposite) | 23:17 |
| fungi | could be it's silently refusing to overwrite the preexisting script there | 23:18 |
| clarkb | oh ya that vould be it too | 23:18 |
| *** markvoelker has joined #openstack-qa | 23:21 | |
| *** fnaval has quit IRC | 23:26 | |
| fungi | should i assume the extra python2 install of all these libs in the python3 job is only being done to accommodate services which are flagged as python2-only? | 23:27 |
| mtreinish | I think so, but it's been a long time. We probably should check git blame to see if it's explained there | 23:29 |
| gmann | yeah me too. i can think that's the only reason | 23:29 |
| mtreinish | https://github.com/openstack-dev/devstack/commit/a2eb89417fbb6d61526b1819cbe3d0a60537eedd | 23:31 |
| mtreinish | heh, I thought that block looked familiar: https://review.openstack.org/#/c/418135/ | 23:32 |
| *** whoami-rajat has quit IRC | 23:33 | |
| *** fnaval has joined #openstack-qa | 23:34 | |
| fungi | "I'll update the comment in a follow-up unless someone feels strongly I should fix it here." | 23:45 |
| fungi | guess that didn't happen ;) | 23:45 |
| fungi | so are there any services still being installed under python2 in the python3 jobs besides swift? the particular job in question disables swift anyway... wondering if we could somehow detect that case and just not install the python2 libs if nothing enabled actually needs them... but also would be good to get to the bottom of why the entrypoints are using python2 | 23:47 |
| gmann | only c-bak and swift services need on python2 | 23:50 |
| gmann | that was also disabled by the job | 23:51 |
| *** markvoelker has quit IRC | 23:54 | |
| gmann | here i can see failing from 3.6 path - http://logs.openstack.org/32/639732/3/check/os-vif-linuxbridge/9f6f380/controller/logs/devstacklog.txt.gz#_2019-02-27_16_53_35_933 | 23:55 |
| fungi | yeah, so likely invoked in a different way | 23:56 |
| fungi | i wonder how those invocations are differing that one gets called under python2.7 and one under python3.6 | 23:57 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!