| *** prometheanfire is now known as Guest0 | 06:23 | |
| dpawlik | fungi, gmann: hey. Sorry for delay, yesterday was bank holidays in poland. If e-r does not use much resources, we can add it on logscraper host. | 07:30 |
|---|---|---|
| dpawlik | The e-r in rdo branch is working with Opensearch. It should not be a problem to connect to opensearch.logs.openstack.org | 07:31 |
| *** pojadhav is now known as pojadhav|lunch | 07:38 | |
| *** pojadhav|lunch is now known as pojadhav | 07:58 | |
| fungi | also it's worth reminding, the master branch of e-r is essentially abandoned now, the rdo branch is the only one being maintained as far as i'm aware so it should probably be merged to master and the rdo branch itself deleted | 11:43 |
| *** pojadhav is now known as pojadhav|brb | 12:04 | |
| dpawlik | agree | 12:36 |
| gmann | dpawlik: thanks | 12:47 |
| gmann | yeah it is better to merge that in master | 12:47 |
| *** pojadhav|brb is now known as pojadhav | 13:03 | |
| *** diablo_rojo is now known as Guest83 | 13:36 | |
| fungi | slurp is catchy | 15:52 |
| clarkb | one thing to keep in mind is that the queries in the rdo branch and the queries formerly in the master branch are unlikely to have complete overlap | 15:54 |
| clarkb | this is sort of what I was talking about using the tripleo e-r instance you might have to tag queries ro something for what server to apply them to | 15:54 |
| fungi | though the queries in the master branch also didn't seem to be catching anything relevant any longer | 15:54 |
| fungi | because nobody was updating them for a year or more | 15:54 |
| clarkb | ya its just that tripleo ci is not going to have any queries for debuntu issues for example | 15:54 |
| clarkb | so there needs to be some way of reconciling that. Currently the master branch list is for upstream development and the rdo branch is for downstream and that is how that problem is handled (though without a running instance for master now) | 15:55 |
| gmann | but if we merge both then they can be used for both upstream and downstream. means keep maintaining queries for rdo downstream too | 15:57 |
| fungi | granted there's no reason i can think of not to just put all the queries in master | 15:57 |
| gmann | yeah, just add all there and we will get more people to help. | 15:57 |
| gmann | do not reject any downstream only query | 15:57 |
| fungi | if the rdo queries don't match upstream jobs and the upstream queries don't match rdo jobs, that seems fine. if they do match one another that's probably good too? | 15:57 |
| gmann | yeah, it can be in different folder to have a clear view. | 15:58 |
| clarkb | the issue is more which server to apply them against. but I guess you are saying apply all queries against all servers | 15:58 |
| clarkb | and ya that should work | 15:58 |
| gmann | yeah | 15:59 |
| clarkb | I would suggest that whoever does the merge not delete the master queries and instaed prune those afterwards then | 16:00 |
| clarkb | because you'll get data on what matches if anything | 16:01 |
| clarkb | and can prune form there | 16:01 |
| gmann | yes, merging should not leads to delete the master and copy rdo one, it should be both merged | 16:05 |
| gmann | spotz: dpawlik ^^ important things to note | 16:05 |
| ade_lee | gmann, so I'm looking at your comments on the fips goal doc | 17:05 |
| ade_lee | gmann, I've added the requested specificity regarding pipelines, branches etc. | 17:05 |
| ade_lee | for your comment about refstack -- my understanding is that there is a refstack project that runs a sets of tempest tests to test overall openstack functionality | 17:06 |
| ade_lee | ie. they curate a set of tempest tests | 17:07 |
| gmann | ade_lee: refstack is a tool run the test needed by interop program. not overall openstack functionality | 17:07 |
| ade_lee | the goal would be to run that curated set of tempest tests under fips | 17:07 |
| gmann | ade_lee: you can mention 'the relevant integrated tempest tests' | 17:08 |
| ade_lee | ok | 17:08 |
| ade_lee | gmann, as for the goal checklist .. | 17:08 |
| fungi | i think it's that we want to make sure anyone who has a fips-compliant deployment of openstack can expect to still be able to run refstack against it and successfully qualify as interoperable, right? | 17:09 |
| fungi | so the question being how we make sure the tests refstack runs can work against a fips-on devstack i guess | 17:09 |
| gmann | humm not exactly. refstack does not run any admin test, scenario tests so I am not sure passing refstack can be mention as fips-compliant | 17:10 |
| gmann | better if to run the integrated tempest test job any projects run with FIPs | 17:10 |
| fungi | not having refstack test for fips compliance, but having refstack able to still pass even if a cloud is fips compliant | 17:10 |
| gmann | refstack test a very basic set of things. | 17:11 |
| fungi | yes, and some of those tests might break on a fips-compliant cloud, if those tests try to do/use things which don't work under fips | 17:12 |
| gmann | ade_lee: for checklist, it will help to check the goal readiness. and you can answer/mention any FIPs job passing. nova or tempest etc | 17:12 |
| gmann | fungi: I am saying refstack is very basic subset of tempest tests so just passing refstack and saying OpenStack is FIPs compliant is not true | 17:13 |
| ade_lee | gmann, do we have a more comprehensive set of tests we tell folks to run to tell them that their cloud is working? | 17:14 |
| fungi | gmann: that's precisely the opposite of the problem though | 17:14 |
| gmann | ade_lee: I will say same integration test they run for their CI/CD. for example, we can say tempest-full or any specific tempest test jobs you have configured to test your project functionality | 17:15 |
| fungi | people have a cloud, their customers are government organizations who require fips compliance, so they have run whatever compliance and assurance tests are needed to make sure it's fips compliant, that's totally different. the company also wants to be able to use the openstack trademark/logo and state that their cloud offering is officially interoperable, but to do that they must get a | 17:15 |
| fungi | passing interoperability grade from refstack | 17:15 |
| gmann | ade_lee: and it can be more than one job as single job does not cover all the configuration/test you want to run. | 17:16 |
| gmann | ade_lee: but at initial it can start with integrated job and then projects can extend the testing based on what all configuration/tests they want to run | 17:16 |
| fungi | i guess to restate the problem, companies currently come to the foundation and say "we have a fips-compliant cloud. we want to also be able to say it's an official openstack (interoperable) cloud, but we can't because some of the refstack tests don't pass. those tests don't pass because our cloud is fips compliant, and that's causing the tempest tests run by refstack to break" | 17:19 |
| gmann | yeah, that they get if we run more extra test with integrated gate projects does. we will be testing extra than just refstack list | 17:20 |
| fungi | so the fips testing effort currently underway is a solution to that, but we'd like to specifically know that the tests run by refstack will pass | 17:20 |
| gmann | tempest integrated tests = refstack + lot more tests | 17:21 |
| fungi | so we don't want projects getting fips testing "working" by disabling some of those required tests | 17:21 |
| gmann | that is what goal is to run all and make them pass | 17:21 |
| *** whoami-rajat__ is now known as whoami-rajat | 17:25 | |
| ade_lee | gmann, fungi ok - going to replace "refstack tests" with "elevant integrated tempest tests" | 17:25 |
| fungi | ade_lee: gmann: yes, i agree that captures the need | 17:26 |
| ade_lee | gmann, and then I guess refactor whats there to the new goal checklist format | 17:26 |
| gmann | +1, and that is always more test than refstack. for example microversion tests | 17:26 |
| gmann | ade_lee: +1, just add checklist only, I do not want you to more to new template completely. | 17:27 |
| fungi | as long as it's understood that *at least* the tempest tests required by refstack will be covered, then also having other tests in addition to those covered seems fine | 17:27 |
| gmann | yeah, there is no project run less test that what refstack does, refstack tests list has not been updated since many many years | 17:31 |
| gmann | ade_lee: any other comment you would like to discuss before I go to cook lunch? | 17:32 |
| fungi | though projects do frequently disable tests if they're consistently failing. i think it's generally known that not running the base set of tests for extended periods is bad, we just need to make sure people are aware that goes for the fips testing jobs too | 17:33 |
| ade_lee | gmann, nope - thanks - I'llhave an update up today | 17:33 |
| gmann | cool, thanks | 17:34 |
| opendevreview | Ade Lee proposed openstack/governance master: Update milestones for FIPS goal https://review.opendev.org/c/openstack/governance/+/838601 | 17:58 |
| *** Guest0 is now known as prometheanfire | 19:47 | |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!