Wednesday, 2021-08-18

*** pojadhav|out is now known as pojadhav01:42
fricklerclarkb: good point. maybe then we just need to remove the installation of the system pkg here https://opendev.org/openstack/devstack/src/branch/master/lib/nova_plugins/functions-libvirt#L61 or make it optional06:29
opendevreviewDr. Jens Harbott proposed openstack/devstack master: Drop the installation of system pkg python3-libvirt on Ubuntu  https://review.opendev.org/c/openstack/devstack/+/80495006:37
opendevreviewDr. Jens Harbott proposed openstack/devstack master: Install libvirt-python with pip instead from system pkg  https://review.opendev.org/c/openstack/devstack/+/80495106:37
fricklerrpittau|afk: iurygregory_: ^^ testing those options now against ironic, too, with https://review.opendev.org/c/openstack/ironic-python-agent/+/80495306:40
*** iurygregory_ is now known as iurygregory06:42
yoctozeptofrickler: going back and forth, are we? :D we have to decide on one of the approaches duh; also, if we decide on using the one from u-c, we should do it on all the platforms ;/06:45
frickleryoctozepto: well, I'm always open to reasonable arguments. and consider those patches wip for now, guess I should flag them as such06:47
yoctozeptofrickler: so am I, but going back and forth ain't gonna help :D I know ceilometer has already reacted; masakari patch (by me) on hold06:50
yoctozeptoI will check if masakari passes with the new arrangement06:53
yoctozeptofrickler, iurygregory, rpittau|afk: so, on that issue with ironic and libvirt - where does ironic actually touch libvirt? basically, from my kolla-based understanding we touch libvirt only in nova-compute, ceilometer-compute and masakari-instancemonitor (both variants) - all these components live on a machine with running libvirtd that they07:20
yoctozeptointeract with07:20
rpittau|afkyoctozepto: ironic itself does not interact with libvirt, it's another component that uses the bindings, virtualbmc07:22
*** rpittau|afk is now known as rpittau07:22
* iurygregory just noticed he didn't get the ping notifications =(07:24
yoctozeptorpittau: ack, I have just completed a codesearch and was about to ask if it's virtualbmc ;D07:24
rpittau;)07:24
yoctozeptook, so ceilometer has actually kinda followed nova before and they have already been *not* including libvirt in requirements, yet they had some code duplication with devstack that started failing and they simply removed it https://review.opendev.org/c/openstack/ceilometer/+/80458707:32
yoctozeptomakes sense07:33
yoctozeptothey mock libvirt in their unit tests07:33
*** jpena|off is now known as jpena07:34
yoctozeptoso, your situation is more alike masakari-monitors07:35
rpittauunfortuantely in our case it's not just testing07:35
rpittauvirtualbms is literally built on top of libvirt07:36
yoctozeptorpittau: so are the others, at least interesting parts of them; so there must be a trick to deliver the best experience for all projects; I need to learn how virtualbmc gets included in your jobs07:37
yoctozeptoah, I see now07:38
yoctozeptoyou are just installing it in devstack plugin07:38
yoctozeptook, that's how it gets pulled in and then breaks on pip07:39
rpittauwe could remove the system pkg before installing virtualbmc, as in one of the tested options07:42
rpittauisnide the install_virtualbmc function07:42
rpittauhttps://opendev.org/openstack/ironic/src/branch/master/devstack/lib/ironic#L93207:43
yoctozeptobased on the way I read your tests, you could also mock the whole libvirt away for that and then simply drop libvirt from reqs; that would make it work like nova-compute and ceilometer-compute work now; that could possibly be the most optimal route; the lightweight option I have found is to do like for masakari-monitors07:44
yoctozeptohttps://review.opendev.org/c/openstack/masakari-monitors/+/80491307:44
yoctozeptoI did not have time to mock it for masakari-monitors so doing it less elegantly07:44
yoctozeptorpittau: yeah, I would not do that though, to be more compatible with the base devstack jobs07:45
yoctozeptomeh, forgot to add to test-requirements there07:47
yoctozeptoperhaps I will just mock it away because it gets on my nerves with the back-and-forth nature07:48
rpittauyoctozepto: our priority right now is to unlock the CI, not sure I have the time to do a radical change, I can propose both, removing the sys pkg as temp solution, and then work on the virtualbmc part itself as long term solution07:52
yoctozeptorpittau: ok, for a minimal change try moving libvirt-python to test-requirements07:53
yoctozeptothat might help immediately07:53
rpittauyoctozepto: ack07:54
yoctozeptorpittau: I proposed in the meantime07:55
yoctozeptoI don't know what jobs that will trigger07:55
yoctozeptoso you might need to test depending on that07:55
rpittauoh thanks!07:55
rpittauwe probably need to add the system package to bindep at least, but let's see how the tests go first08:00
iurygregorywe probably need to push using Depends-On on ironic and ipa to see how it goes08:00
rpittauyep, I was exactly doing that :)08:00
yoctozeptorpittau: nah, based on working examples, you shouldn't :D08:02
yoctozeptoit will likely create further issues down the road08:02
yoctozeptomaybe not08:02
yoctozeptobut who knows08:02
iurygregorywell virtualbmc only runs 1 job :D08:02
rpittaummm ok I just hope to not see libvirt-python removed from some RPM specs at some point :D08:03
yoctozeptoiurygregory: yeah, I'm not negating your statement08:03
iurygregoryhehehehe08:03
yoctozeptorpittau: yeah, it's in my nightmares already :-)08:03
yoctozeptothough I can see it proactively installed by kolla, tripleo, osa and loci08:03
opendevreviewSlawek Kaplonski proposed openstack/devstack master: Stop creating userrc_early  https://review.opendev.org/c/openstack/devstack/+/78041708:41
opendevreviewSlawek Kaplonski proposed openstack/devstack master: Deploy Neutron with enforced new RBAC rules  https://review.opendev.org/c/openstack/devstack/+/79745008:41
*** brinzhang0 is now known as brinzhang11:05
*** dviroel|ruck|out is now known as dviroel|ruck11:12
*** jpena is now known as jpena|lunch11:34
*** jpena|lunch is now known as jpena12:32
slaweqgmann: hi12:45
slaweqgmann: may I have a question about system scopes and tempest testing?12:45
slaweqgmann: I started patch https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/796612 to see how it will work with enforced new defaults12:46
slaweqbut it seems that it is terrible now12:46
slaweqso my question is about is there any guidance about how we should do it? Should we try to modify existing tests so they will work with both old and new scopes?12:47
slaweqor maybe we should skip old tests if new scopes are enabled and add completly new API tests for system scope personas?12:47
slaweqgmann: I'm not sure in which direction I should go with all that12:48
dansmithslaweq: in glance we're testing both in parallel and will for some time, using a tempest plugin and job config13:36
slaweqdansmith: but do You have the same tests and run them for old and new personas?13:36
slaweqor do You have completly different tests for each?13:36
dansmithwell actually, we don't really have any system-scope things yet, so maybe I'm not helping here, but we have kinda "old policy" and "new rbac-style policy" and we largely run the same tests in both modes13:38
dansmithwhen we do have system scope-y things I think we'll end up with tests specifically for system scope details, but also tests that run both ways until we're ready to drop non-scoped personas13:39
dansmithour tempest plugin tests a bunch of new-style rbac stuff, and will test any system scope stuff we have, and those tests are specific to the new arrangement and won't run on jobs in the old mode13:40
rpittauyoctozepto: good and bad news, the virtualbmc change should fix the issue there, although we'll have to release a new version to fix the jobs that do not have virtualbmc in the required-projects list (e.g. metalsmith)13:41
slaweqdansmith: ok, the reason I'm asking is mostly because when I want to use new personas, like e.g. system_admin, I need to modify a lot of things to pass project_id in the request body - otherwise it won't work at all13:41
rpittauwe also found one more porject that has libvirt-python in requirements, virtualpdu13:41
slaweqand we have a lot of tests which are testing e.g. what "admin" can do13:41
dansmithslaweq: I think you should avoid doing that, personally.. have you seen the x-project-id proposal?13:42
slaweqdansmith: yes, I did13:42
dansmithbasically a header where a system-scoped token holder can say "and this is the project I want to be acting on"13:42
dansmithokay13:42
slaweqbut that is kind of workaround for now at least13:42
dansmithwhy do you say that?13:42
slaweqat least it works in devstack https://review.opendev.org/c/openstack/devstack/+/797450 and let's me deploy neutron with new scopes :)13:43
dansmithjust to be clear, I'm talking about this: https://review.opendev.org/c/openstack/keystone-specs/+/78764013:44
opendevreviewLukas Piwowarski proposed openstack/tempest master: Fix cleanup of default security group when preprov creds are used  https://review.opendev.org/c/openstack/tempest/+/80408813:44
dansmithnova and glance aren't modifying all of our api calls to take project_id in the body for system scope, because that would be really destabilizing for a project that has been using project-scoped tokens forever, and doesn't really make sense to change, IMHO13:45
dansmithif a system scoped token holder wants to do something on a project-scoped resource, they need to declare some project affiliation for that operation13:46
slaweqdansmith: I agree, I'm just saying about temporary solution for now as neutron already allows passing project_id in body and it works even with old personas13:46
dansmithokay13:47
slaweqso to make it properly I probably should add whole bunch of new api tests for new personas13:48
slaweqas their privileges are different than in old rules13:48
yoctozeptorpittau: meh! how are you going to proceed then?13:48
dansmithslaweq: or wait until the project header is available and wrap it in the client behavior so you can run both, where it makes sense13:49
rpittauyoctozepto: apparently this https://review.opendev.org/c/openstack/devstack/+/804951 works better for us at least on IPA, we're testing ironic now13:49
slaweqdansmith: ok13:49
yoctozeptorpittau: it seems fine for masakari and ceilometer too - I checked it; but it needs qa team discussion; I don't want to go back and forth with this; in kolla we know already that python-libvirt package compatibility is not best-in-breed, so to speak, so we risk hitting a wall the next time something moves with it, hence why I'm concerned :/13:53
yoctozeptorelying on distro seems more reliable13:53
yoctozeptobut seemingly it breaks some assumptions in the ecosystem13:54
yoctozeptoironic is quite complex nowadays so I see you are at worse position to tackle this than others13:54
yoctozeptowe could also merge this now, since it seems to be reliable for now, but discuss soon13:55
yoctozeptofrickler, gmann, kopecmartin: wdyt? ^ my discussion with rpittau and ironic gate breakage due to libvirt-python13:55
rpittauyoctozepto: I totally understand, although I don't see a way to fix all the projects that has libvirt-python in the requirements, especially the ones that we don't control, like virtualpdu13:56
rpittauI still have the idea of removing the sys packaage when installing virtualbmc in ironic devstack plugin13:56
yoctozeptorpittau: if you could leave a comment on my test change that "it helps but..." and list the issues then that would help others to digest the flow of the possibilites13:56
rpittauyoctozepto: aboslutely, I think iurygregory already left a comment, I'll add one too :)13:57
yoctozeptorpittau: I have seen none :D13:57
yoctozeptoI mean the virtualbmc one13:57
yoctozeptooh, I see, virtualpdu is in x/13:57
yoctozeptoif ironic removes the package to reinstall it with pip, then it leaves ironic vulnerable to breakages from elsewhere still13:58
yoctozeptowe have already discussed that13:58
yoctozeptobut I guess it could be accepted as well13:58
yoctozeptowe are also planning to gate on ironic in devstack so it should be safer in the future anyhow13:59
iurygregorywell we need the CI fixed asap, and we can try to figure out better approaches later I would say :D14:00
rpittauconsider that we use virtualbmc in 2 ways (excluding CI): in virtualenv, or packaged; in both cases there should not be risk of conflicts. The issue happens when installing virtualbmc (and libvirt-python dependency) as root using pip14:00
frickleryoctozepto: I was just looking at https://docs.openstack.org/nova/latest/reference/libvirt-distro-support-matrix.html but I'm not sure what nova's plans are for y and beyond14:01
fricklermaybe I should wrap my change with a flag, so that ironic can switch while others keep the current behavior14:02
yoctozeptoiurygregory: agreed14:04
fricklerlyarwood: ^^ can you share some thoughts as to whether nova would prefer to have libvirt-python from distro or keep using latest from pypi?14:04
yoctozepto^ yeah, good thinking to actually ask the main consumer :D14:04
yoctozeptobut keep in mind the issues were never nova failing on libvirt but rather libvirt failing to compile against another libvirtd14:05
opendevreviewLukas Piwowarski proposed openstack/tempest master: Fix cleanup of default security group when preprov creds are used  https://review.opendev.org/c/openstack/tempest/+/80408814:07
dansmithhas anyone been seeing py36 jobs fail with timeout all the sudden?14:21
dansmithglance team is seeing our py36 functional tests time out with one worker stuck like 80% of the time, but the same job on py38 works fine 100% of the time14:21
dansmithit looks like maybe some other jobs are hitting timed_out, some of which may be py36, but we're kinda stuck on what is going on14:21
dansmithdoesn't repro locally either14:21
yoctozeptonot me14:23
yoctozeptobut I remember there was a buggy patch proposed to masakari and it was failing on py38, yet timing out on py36 - it looked like a stack handling difference then14:24
yoctozeptobut it's not the case here if py38 is entirely here14:24
yoctozeptoentirely green*14:24
dansmithyeah.. if I could repro locally I'd start bisecting, but... I can't14:25
dansmiththere are also some py36-specific deps that I figured could be related, but none that look super close to us, so I dunno14:26
opendevreviewMerged openstack/devstack stable/queens: [stable-only] Use queens-eol for horizon  https://review.opendev.org/c/openstack/devstack/+/80488914:29
lyarwoodfrickler: sorry was on a call, I had thought it was safer from the distros14:32
lyarwoodat least that was the impression I had after talking to the libvirt folks about this a few weeks ago when https://review.opendev.org/c/openstack/devstack/+/798514 came up14:33
lyarwoodah and I now see ianw 's comment in the bug14:34
fricklerlyarwood: oh, interesting, I hadn't seen that patch. what I did with https://review.opendev.org/c/openstack/devstack/+/804951 for ironic would essentially revert it, I didn't intend to do that14:46
fricklerso likely having a flag to choose either variant looks like the better option even more14:47
yoctozeptofrickler: duh, I thought you did14:47
yoctozeptook, I think I have just imagined a better approach, will propose in a bit14:47
lyarwoodfrickler: what's the reasoning for using pip over the distro?14:54
lyarwoodfrickler: the fact that some projects have it listed in requirements?14:54
lyarwoodfrickler: tbh I'd rather drop it from requirements given the way the bindings are generated at build time against a specific version of libvirt14:54
gmannslaweq: dansmith on system scope testing, plan is to move all  the existing tempest plugins tests towards new policy defaults. it will take time. and we need to have flag which is CONF.<service>.enforce_scope to keep using old defaults for stable branch testing (for stable those does not have new policy). 14:59
yoctozeptolyarwood: yeah, ceilometer dropped it, masakari followed as well, but ironic ecosystem is overly complicated to handle quickly14:59
lyarwoodyoctozepto: kk, then could we do this just when ironic is used?15:00
gmannslaweq: dansmith  and once all stable using master tempest has the new policy defaults then we can only test the new personas. basically at the end we need to migrate all the test tempest and plugins tests to new defaults   15:01
* dansmith nods15:01
opendevreviewRadosÅ‚aw Piliszek proposed openstack/devstack master: Remove libvirt-python from upper-constraints  https://review.opendev.org/c/openstack/devstack/+/80504015:02
yoctozeptorpittau, iurygregory, frickler, lyarwood: better approach ^15:02
yoctozeptojust help me testing it, I need to focus on something else now15:03
iurygregoryyoctozepto, https://review.opendev.org/c/openstack/requirements/+/804874 ? :D15:03
rpittauyoctozepto: ok, thanks15:03
rpittauiurygregory: that's different though15:03
iurygregoryoh ok15:03
iurygregoryI saw u-c so I thought it was in requirements lol15:03
rpittauwe remove that in devstack but not from general u-c15:03
iurygregory:D15:03
yoctozeptoiurygregory: requirements team will not allow that; also, u-c is also affecting unit tests and there we have venv and much more flexibility in-project15:03
rpittau:)15:04
rpittauI'll add another DNM patch to test that15:04
rpittauyoctozepto: thanks a lot for the help15:04
yoctozeptorpittau: yw :-)15:04
iurygregorytks!15:04
frickleryoctozepto: I like your patch, if it works for ironic, we can go ahead with it15:38
clarkbfrickler: re libvirt-python I think using the system pacakges is fine. I just wanted to be clear with what hte prior problem was. Previously we were mixing wheels built for one platform on another platform and that isn't a good idea. But if we had built a libvirt-python wheel for the actual platform it is expected to work fine and it not doing so is a bug according to upstream15:41
yoctozeptofrickler: :D it came to my mind while I was brushing my teeth (always remember to brush your teeth at least twice a day, it helps with fixing openstack gates 8-) )15:41
yoctozeptoclarkb: the upstream does not have good back-and-forward-compatibility testing it seems15:42
*** jpena is now known as jpena|off15:42
clarkbyoctozepto: I don't think that is true the error we experienced was related to the wheel linking and not a fault of their forward and backward compatibility15:43
clarkbyoctozepto: we compiled and linked libvirt-python against one versions of libvirt then tried to use it against a different version of libvirt15:43
clarkbif you compiled libvirt-python against the actual libvirt in use it should work15:43
opendevreviewElod Illes proposed openstack/devstack stable/pike: [stable-only] Use pike-eol for horizon  https://review.opendev.org/c/openstack/devstack/+/80504715:43
yoctozeptoclarkb: yeah, that one not, I agree; but libvirt-python was failing to compile on too new package in fedora iirc15:44
clarkbI am not aware of that one15:44
yoctozeptoalso, it was failing on stream with rdo repos bumping libvirt to fedora one15:44
yoctozepto7.5.015:44
clarkbif you mean the more recent issue that came up around failing to uninstall the system packges that is why we avoided using system packages in the first place. It is a system packge issue nothing to do with the pip wheel build direclty15:45
yoctozeptoand it tried to compile it15:45
yoctozeptoclarkb: no, I am about compilation here15:45
yoctozeptothe pip thing we are fixing15:45
yoctozeptowe decided we want the latest pip15:45
yoctozeptobut libvirt-python from distro15:45
yoctozeptoand now juggling this15:45
yoctozepto;d15:45
clarkbyes that is a problem with the system libvirt-python packaging using distutils15:46
clarkbwhen something else tries to install libvirt-python from pypi15:46
clarkbthis is why we stopped installing these packages from the system in the first place15:46
clarkbdo you have a link to logs for the compilation failure on centos-8-stream?15:47
clarkbwas the libvirt-python an older version thanthe libvirt version? I think that is also not supposed to work15:48
clarkblibvirt python must be >= libvirt15:48
yoctozeptoclarkb: yeah, it was older15:50
yoctozeptoI think the links have expired15:51
yoctozeptobut it was older15:51
clarkbya so that isn't really a problem either15:51
clarkbjust bump libvirt-python and move on15:52
yoctozeptoyeah, it's supposed not to be a problem but u-c holds it to be a problem15:52
yoctozeptoso we have to work around one way or another15:52
clarkbyes you bump u-c when that happens and move on15:53
clarkbthat is why u-c exists to help us manage these problems and make controlled updates15:53
clarkbconversely rdo shouldn't bump libvirt if upstream says the newest working version is <15:54
clarkbits meant to communicate in both directions15:54
yoctozeptoclarkb: well, fwiw, we don't have any bells and whistles from libvirt-python newer than libvirt15:57
yoctozeptoso I guess I accept the current workaround as requiring the least work... for now at least :D15:58
*** rpittau is now known as rpittau|afk16:06
opendevreviewJames Parker proposed openstack/whitebox-tempest-plugin master: Limit returned compute hosts  https://review.opendev.org/c/openstack/whitebox-tempest-plugin/+/80505416:17
gmannyoctozepto: rpittau|afk we can test libvirt things in devstack gate itself in ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa job which is n-v for now16:34
yoctozeptogmann: yeah, we will be testing further impact on ironic there16:34
yoctozeptofor now, we are trying to fix ironic's gates16:34
yoctozeptothis seems to be doing it https://review.opendev.org/c/openstack/devstack/+/80504016:34
gmannyeah ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa job currently fail on devstack gate too16:35
yoctozepto you can read more backlog for backstory16:36
yoctozeptobut the commit should have all the necessary details to understand it in the future16:37
gmannyeah, i am saying we do not need another testing patch on ironic gate instead we can test it in devstack gate itself if it work or not16:38
yoctozeptogmann: ironic's already testing it; they have a multitude of jobs; another approach was fixing only a part of the problem so we are verifying it to the fullest with that16:39
yoctozeptobut yeah, in the future that should be enough16:39
yoctozeptoif not, we can gate on a better job16:39
gmannyeah16:41
yoctozeptofor now, review that patch as it seems to be worky16:41
yoctozeptoand we will want to merge it asap16:41
gmannyoctozepto: yeah lgtm, waiting for full set of ironic gate to pass. 16:43
yoctozeptoack16:43
yoctozeptocc'ed you on https://review.opendev.org/c/openstack/ironic/+/805041/16:44
gmannand that seems passing all job on this16:44
yoctozeptolooks passing in zuul though16:44
gmannyeah16:44
gmann+216:45
yoctozeptothanks16:46
*** dviroel|ruck is now known as dviroel|ruck|out19:07
opendevreviewMerged openstack/devstack stable/pike: [stable-only] Use pike-eol for horizon  https://review.opendev.org/c/openstack/devstack/+/80504722:29

Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!