| opendevreview | Steve Baker proposed openstack/tripleo-image-elements master: Simplify openvswitch, remove os-svc-install https://review.opendev.org/c/openstack/tripleo-image-elements/+/838636 | 00:15 |
|---|---|---|
| opendevreview | Steve Baker proposed openstack/tripleo-image-elements master: Remove the remaining os-*-config elements https://review.opendev.org/c/openstack/tripleo-image-elements/+/838637 | 00:15 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-heat-templates master: Verify RsyslogExtraLoggingSource in CI https://review.opendev.org/c/openstack/tripleo-heat-templates/+/831130 | 00:48 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-heat-templates master: Remove leftover of MongoDB support https://review.opendev.org/c/openstack/tripleo-heat-templates/+/847682 | 00:50 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-common master: Remove password migrations for placement and rpc services https://review.opendev.org/c/openstack/tripleo-common/+/846073 | 00:51 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-heat-templates master: Validate CollectdConnectionType https://review.opendev.org/c/openstack/tripleo-heat-templates/+/847236 | 00:52 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-heat-templates master: Octavia: remove unused mocking of nova_flavor https://review.opendev.org/c/openstack/tripleo-heat-templates/+/845332 | 00:52 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-heat-templates master: Ironic: Remove unused step_config from base class https://review.opendev.org/c/openstack/tripleo-heat-templates/+/856974 | 01:02 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-heat-templates master: Revert "Disable pxe_tftp systemd services during upgrade" https://review.opendev.org/c/openstack/tripleo-heat-templates/+/856884 | 01:16 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-heat-templates master: Revert "Disable pxe_tftp systemd services during upgrade" https://review.opendev.org/c/openstack/tripleo-heat-templates/+/856976 | 01:19 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-heat-templates master: Revert "Disable pxe_tftp systemd services during upgrade" https://review.opendev.org/c/openstack/tripleo-heat-templates/+/856884 | 01:19 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-heat-templates master: Ironic: Remove old clean up tasks for xinetd https://review.opendev.org/c/openstack/tripleo-heat-templates/+/856977 | 01:22 |
| tkajinam | stevebaker[m], hi. May I ask for you review about https://review.opendev.org/c/openstack/tripleo-heat-templates/+/846083 when you have time ? | 01:23 |
| stevebaker[m] | tkajinam: sure thing, looks good to me | 01:32 |
| tkajinam | stevebaker[m], thanks ! | 01:35 |
| opendevreview | Takashi Kajinami proposed openstack/ansible-role-collect-logs master: Get OVS DB query results https://review.opendev.org/c/openstack/ansible-role-collect-logs/+/856978 | 01:43 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-heat-templates master: Manage CA certificates using ansible https://review.opendev.org/c/openstack/tripleo-heat-templates/+/839296 | 01:47 |
| lecris[m] | tkajinam: about CA management, you should check this issue https://bugs.launchpad.net/tripleo/+bug/1988578? | 01:50 |
| lecris[m] | It realistically happens when ipa CA roots are renewed | 01:51 |
| tkajinam | that CA management does not related to IPA afaik. that task installs a static cert | 01:52 |
| lecris[m] | Yes, but when installing CA certs, it should be filtered of any invalid certs | 01:54 |
| lecris[m] | Otherwise you can get that issue in rabbitmq | 01:54 |
| lecris[m] | Granted it is an upstream issue, but who knows when similar issues will pop up | 01:55 |
| tkajinam | validation certs is out of scope of individual tasks imho. | 01:58 |
| tkajinam | even if we add the capability, that is completely different from the above patch which just replaces puppet by ansible | 01:59 |
| tkajinam | I mean it should be a completely separate topic. | 01:59 |
| lecris[m] | So where should something like that be patched? Afaiu, the heat templates for ipa use preexisting CA files on the hosts, which could be patched in the enrollment stage. But this issue could happen with self-signed or other third party CAs | 02:03 |
| lecris[m] | Or is tls-e via ipa the only one that uses tls for rabbitmq and other services? | 02:04 |
| tkajinam | I don't get your point. If CA cert expires then you need to update the template to include the new cert and run deploy to install the new certs | 02:09 |
| opendevreview | Brendan Shephard proposed openstack/tripleo-heat-templates master: Move update_tasks for tripleo-packages https://review.opendev.org/c/openstack/tripleo-heat-templates/+/838605 | 02:12 |
| lecris[m] | The issue with rabbitmq is if there exists expired certificates together with the renewed one. This happened to me because ipa added the renewed one, not replaced the bundle | 02:12 |
| lecris[m] | So even if you did that, this issue would appear | 02:14 |
| lecris[m] | I think this is done so on the freeipa to check old pki signed objects like S/MIME emails | 02:16 |
| tkajinam | for management of static CA, the task should replace the existing file in /etc/pki/ directory as long as you use the same name. AFAIK update-ca-trust extract should remove the key which was removed from the directory so it's not likely to cause the same problem as long as you keep the same name. | 02:18 |
| lecris[m] | Public or private key? | 02:20 |
| lecris[m] | Does the update task support having external signed CA? | 02:22 |
| lecris[m] | If so, then this issue can occur higher up in the chain | 02:23 |
| tkajinam | I was talking about CA cert, which is public | 02:24 |
| tkajinam | TripleO supports using static TLS cert + CA cert to use TLS in public endpoints. | 02:24 |
| tkajinam | as well as TSL-e | 02:24 |
| tkajinam | what do you mean by "the update task" ? | 02:25 |
| lecris[m] | the `uptdate-ca-trust` you mentioned | 02:27 |
| lecris[m] | <tkajinam> "I was talking about CA cert..." <- Indeed the issue I am referencing is occurring in the CA cert, i.e. somewhere in the CA trust chain there exists expired certificate, not the leaf/newly deployed certificate being expired | 02:29 |
| tkajinam | In TLS-e certmonger is responsible to manage certificates installed in each node | 02:31 |
| tkajinam | while in case you use static certs you inject certs using tht parameters, part of which I'm fixing in my patch above | 02:32 |
| opendevreview | Rabi Mishra proposed openstack/python-tripleoclient master: Add role split feature to extract provisioned https://review.opendev.org/c/openstack/python-tripleoclient/+/856929 | 02:32 |
| tkajinam | your problem is likely the one causes by something wrong with certmonger or regeneration process but I don't think that is really related to the task to install the static cert, which is NOT used in TLS-e | 02:34 |
| tkajinam | the command I mention updates the local cert repositories from the keys installed in /etc/pki directory | 02:34 |
| tkajinam | I guess certmonger might use it internally but I don't have enough understanding to tell you how/whether it is used in TLS-e | 02:35 |
| lecris[m] | tkajinam: I don't think this is a certmonger issue, because the leaf certificates are valid. The intermediate CA certificate in `/etc/ipa/ca.crt` is the problem. | 03:07 |
| lecris[m] | And my concern is if the CA cert chain bundle (excluding the leaf) is being updated using the same logic as ipa's (add renewed CA, but keep old expired ones), then if that new certificate is added to the trust chain `/etc/pki/CA/certs` and rabbitmq or other similarly faulty components use it, than it can create deployment issues | 03:10 |
| lecris[m] | So just to confirm 2 things about static certs: | 03:12 |
| lecris[m] | - Are they used in service components like rabbitmq as well? | 03:12 |
| lecris[m] | - does `update-ca-trust` role update the CA chain and/or the leaf certificate. (The naming suggests it only updates the former, in which case the issue I had can occur) | 03:12 |
| tkajinam | if you use TLS-e then internal certificates are used in most components, not only rabbitmq | 03:13 |
| tkajinam | again the task I'm updating is not used in TLS-e. update-ca-trust extact is the command, used in the role to install the static CA certificate, and it only handles CA cert. does not affect leaf certificates. but again the task/role is not used in TLS-e | 03:14 |
| lecris[m] | Yes, and the issue with expired certificates is about expired intermediate CA certificates, not leaf certificates | 03:15 |
| lecris[m] | But static certs (outside TLS-e) are not used for components? | 03:16 |
| tkajinam | in case you use static certs instead of tls-e then you can update all certificates by updating the ones in your deployment templates | 03:17 |
| tkajinam | as long as you modify templates with keeping certificate names then it should replace the existing ones. it should not leave expired ones | 03:17 |
| lecris[m] | But you said static certs support being externally signed. So let's say the deployment template downloads the CA chain from `/etc/pki/CA/certs/external_root.crt` or `http://my_provider.com/root_ca.crt`. Then it should check for expired certificates in this downloaded chain. I.e. even if the certificates are replaced, if the replaced chain contains expired ones that's the issue. | 03:21 |
| lecris[m] | The issue is not that the CA certificates are expired before the deployment, but after the deployment due to externally managed root CA chian. | 03:22 |
| lecris[m] | Something like `/etc/pki/CA/certs/external_root.crt` has:... (full message at https://matrix.org/_matrix/media/r0/download/matrix.org/SzJvlaGcWsxIgrKWasMXNehk) | 03:26 |
| lecris[m] | But I think the thing I am trying to figure out is: is there some step where I can edit the file in the Heat parameter: `InternalTLSCAFile`, to do some sanity checks on it: check for validity and so on? | 03:29 |
| tkajinam | we might be able to implement some validation but that's not something we have now | 03:30 |
| lecris[m] | Kay, which step should I look at for that? I can try to see if I can do these | 03:31 |
| tkajinam | I understand it can be a good improvement but I've been saying that's a different topic from the change to replace puppet by ansible | 03:31 |
| lecris[m] | Yes indeed, sorry for the confusion. I am only concerned if the same issue can occur outside of the tls-e setup due to external CAs | 03:32 |
| tkajinam | there are two implementations to install cert certs now. one is puppet and the other is ansible. I'm replacing puppet by ansible now so once that is completed then you can add validation task in tripleo-ansible | 03:32 |
| tkajinam | and for > The issue is not that the CA certificates are expired before the deployment, but after the deployment due to externally managed root CA chian. | 03:33 |
| lecris[m] | Ok, I understand | 03:33 |
| tkajinam | IMO replacing the static certs automatically is quite overkilling IMHO. If a user decides to use static certs then he/she is responsible to install a new cert before the current one expires. | 03:34 |
| opendevreview | Brendan Shephard proposed openstack/python-tripleoclient master: Change git user for config-download https://review.opendev.org/c/openstack/python-tripleoclient/+/856591 | 03:41 |
| opendevreview | Merged openstack/tripleo-heat-templates master: ironic: Remove tasks for image migration https://review.opendev.org/c/openstack/tripleo-heat-templates/+/846083 | 04:32 |
| *** ysandeep|out is now known as ysandeep | 04:36 | |
| opendevreview | chandan kumar proposed openstack/tripleo-common master: Add an Ansible execution environment to our Build https://review.opendev.org/c/openstack/tripleo-common/+/776674 | 04:38 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-heat-templates master: MySQL: Use common volumes in containers https://review.opendev.org/c/openstack/tripleo-heat-templates/+/856228 | 04:41 |
| opendevreview | chandan kumar proposed openstack/tripleo-common master: Add an Ansible execution environment to our Build https://review.opendev.org/c/openstack/tripleo-common/+/776674 | 05:10 |
| opendevreview | chandan kumar proposed openstack/tripleo-ci master: Add support for tcib_extra_config https://review.opendev.org/c/openstack/tripleo-ci/+/850736 | 05:50 |
| *** ysandeep is now known as ysandeep|afk | 05:54 | |
| opendevreview | chandan kumar proposed openstack/tripleo-common master: Add an Ansible execution environment to our Build https://review.opendev.org/c/openstack/tripleo-common/+/776674 | 05:55 |
| opendevreview | chandan kumar proposed openstack/tripleo-common master: [DNM] Build tripleo-ansible-ee container https://review.opendev.org/c/openstack/tripleo-common/+/850458 | 06:20 |
| *** ysandeep|afk is now known as ysandeep | 06:30 | |
| opendevreview | Cedric Jeanneret proposed openstack/tripleo-ansible master: New roles for apache/httpd management https://review.opendev.org/c/openstack/tripleo-ansible/+/853481 | 06:38 |
| chandankumar | Tengu: https://review.opendev.org/c/openstack/tripleo-ansible/+/856339 is good to go | 06:43 |
| opendevreview | Cedric Jeanneret proposed openstack/tripleo-ansible master: New tripleo_ironic role https://review.opendev.org/c/openstack/tripleo-ansible/+/855873 | 06:43 |
| Tengu | chandankumar: heya! lemme check | 06:43 |
| *** jm1|ruck is now known as jm1|rover | 06:45 | |
| opendevreview | Cedric Jeanneret proposed openstack/tripleo-heat-templates master: Convert httpd ironic_api configurations to new role https://review.opendev.org/c/openstack/tripleo-heat-templates/+/854568 | 07:05 |
| *** jpena|off is now known as jpena | 07:10 | |
| Tengu | folks, care to have a look at https://review.opendev.org/c/openstack/tripleo-ansible/+/856487 ? | 07:21 |
| opendevreview | Takashi Kajinami proposed openstack/python-tripleoclient master: Remove unused arguments from generate_passwords https://review.opendev.org/c/openstack/python-tripleoclient/+/857000 | 07:30 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-common master: Remove unused arguments from generate_passwords https://review.opendev.org/c/openstack/tripleo-common/+/857002 | 07:40 |
| opendevreview | chandan kumar proposed openstack/tripleo-common master: Add an Ansible execution environment to our Build https://review.opendev.org/c/openstack/tripleo-common/+/776674 | 07:57 |
| opendevreview | Merged openstack/puppet-tripleo master: Add etcd3gw api_version to cinder backend_url https://review.opendev.org/c/openstack/puppet-tripleo/+/852368 | 08:13 |
| opendevreview | Bhagyashri Shewale proposed openstack/openstack-tempest-skiplist master: Revert "Update "hard_reboot_after_vol_snap_deletion" entry" https://review.opendev.org/c/openstack/openstack-tempest-skiplist/+/856886 | 08:13 |
| opendevreview | chandan kumar proposed openstack/tripleo-common master: [DNM] Build tripleo-ansible-ee container https://review.opendev.org/c/openstack/tripleo-common/+/850458 | 08:15 |
| opendevreview | Bhagyashri Shewale proposed openstack/openstack-tempest-skiplist master: Revert "Update "hard_reboot_after_vol_snap_deletion" entry" https://review.opendev.org/c/openstack/openstack-tempest-skiplist/+/856886 | 08:20 |
| opendevreview | Takashi Kajinami proposed openstack/puppet-tripleo master: cinder + etcd3gw: Remove logic for CentOS/RHEL 8 https://review.opendev.org/c/openstack/puppet-tripleo/+/857006 | 08:22 |
| opendevreview | Bhagyashri Shewale proposed openstack/openstack-tempest-skiplist master: Revert "Update "hard_reboot_after_vol_snap_deletion" entry" https://review.opendev.org/c/openstack/openstack-tempest-skiplist/+/856886 | 08:44 |
| *** amoralej is now known as amoralej|afk | 08:51 | |
| opendevreview | Bhagyashri Shewale proposed openstack/tripleo-quickstart-extras master: Adding temporary workaround for libvirt-failures https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/856244 | 08:56 |
| opendevreview | Bhagyashri Shewale proposed openstack/tripleo-quickstart-extras master: Adding temporary workaround for libvirt-failures https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/856244 | 09:01 |
| opendevreview | Bhagyashri Shewale proposed openstack/tripleo-quickstart-extras master: Adding temporary workaround for libvirt-failures https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/856244 | 09:06 |
| opendevreview | chandan kumar proposed openstack/tripleo-common master: Add an Ansible execution environment to our Build https://review.opendev.org/c/openstack/tripleo-common/+/776674 | 09:24 |
| opendevreview | Bhagyashri Shewale proposed openstack/tripleo-quickstart-extras master: Adding temporary workaround for libvirt-failures https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/856244 | 09:43 |
| opendevreview | Manojkatari proposed openstack/tripleo-heat-templates master: new t-h-t template for Cinder NFS backend https://review.opendev.org/c/openstack/tripleo-heat-templates/+/854398 | 09:53 |
| opendevreview | Jiri Podivin proposed openstack/validations-libs master: Removing unused imports and variable https://review.opendev.org/c/openstack/validations-libs/+/857037 | 10:04 |
| lecris[m] | jpodivin: About #1989247 (keystoned_db_sync erroring with unable to send audit message). I have added the logs to that | 10:05 |
| jpodivin | lecris[m]: thanks. As I've said in the comment it was a mistake not to make proper note of the fix. Hopefully not much time was lost. | 10:06 |
| lecris[m] | Can you give me a hint on how to change the Caps of a container and/or add podman flags to how that container is called? | 10:06 |
| lecris[m] | Is it an issue with the containers upstream? | 10:08 |
| jpodivin | lecris[m]: for that I would have to know the circumstances. This failed on your personal deployment? | 10:08 |
| lecris[m] | What I am encountering is that this issue only occurs for tls-e, which I don't understand how that one is affecting there | 10:09 |
| lecris[m] | Yes, personal deployment | 10:09 |
| jpodivin | lecris[m]: ok, that narrows things down a bit. Could you put the config you have used in the bug description? | 10:10 |
| jpodivin | so we can properly triage it. | 10:10 |
| jpodivin | Especially things like release, topology and services. | 10:10 |
| lecris[m] | Should I upload the full `config-download`? | 10:11 |
| lecris[m] | or `overcloud-deploy` | 10:12 |
| jpodivin | lecris[m]: I don't think that's necessary atm. It should be enough to note release and arguments you have given to quickstart | 10:12 |
| jpodivin | so we can replicate if needed. | 10:12 |
| jpodivin | full dirs would be nice, but it's not necessary per se. | 10:12 |
| lecris[m] | Not using quickstart, using manual provision steps | 10:12 |
| jpodivin | bhagyashris|ruck: do we have this in upstream ^ ? I don't think we do. | 10:13 |
| jpodivin | lecris[m]: ok, that's another thing to note | 10:13 |
| lecris[m] | `network_data.yaml`, `vip_data.yaml`, and such files are ok? | 10:13 |
| jpodivin | lecris[m]: it can help. But the most important facts are: release of openstack, deployment procedure. services and topology | 10:14 |
| jpodivin | that's the basics. | 10:14 |
| lecris[m] | Ok, I'll try to add them | 10:14 |
| lecris[m] | release wise, both master and yoga | 10:14 |
| jpodivin | lecris[m]: which one? Yoga is slightly behind master(zed) | 10:15 |
| lecris[m] | What do you mean by which one? Both on stable/yoga and master (tripleo-repos command wise) | 10:16 |
| lecris[m] | I am not sure if the containers are updated to become yoga though | 10:17 |
| jpodivin | lecris[m]: I'm looking at the logs. I see quite of few other errors in there. Am I correct that you have successfully diagnosed and rectified them? | 10:19 |
| lecris[m] | The ansible log might include older deployments. If it's after a step of `overcloud node provision` it should be the most recent | 10:20 |
| lecris[m] | Also I've added the configuration details | 10:21 |
| jpodivin | lecris[m]: thanks a lot. I'll take a look. | 10:25 |
| lecris[m] | Thanks for the support | 10:25 |
| lecris[m] | I think the relevant log begins at `2022-09-12 03:08:26,009` | 10:26 |
| lecris[m] | But jpodivin, do you have any hint of how to add/change the container execution to add the `CAP_AUDIT_WRITE` to the current deployment to see if that's the cause? | 10:28 |
| bhagyashris|ruck | jpodivin, ? | 10:28 |
| bhagyashris|ruck | this one https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/856244 | 10:28 |
| jpodivin | lecris[m]: honestly I don't. At this point I'm fairly certain this is a different beast to that in the older bug | 10:28 |
| jpodivin | bhagyashris|ruck: is that the same thing? | 10:29 |
| jpodivin | ours is permission error | 10:29 |
| bhagyashris|ruck | jpodivin, hey i am not clear what you are asking | 10:30 |
| jpodivin | bhagyashris|ruck: https://bugs.launchpad.net/tripleo/+bug/1989247 | 10:30 |
| jpodivin | bhagyashris|ruck: lecris[m] has been deploying manually and keystone container got in trouble | 10:30 |
| lecris[m] | It's about `keystone_db_sync` container not being able to execute due to permission error | 10:30 |
| bhagyashris|ruck | jpodivin, hey i am not sure will need to check i am currently focusing downstream | 10:31 |
| bhagyashris|ruck | jm1, may know this^ | 10:31 |
| jpodivin | bhagyashris|ruck: thanks. Container just needs permissions to write audit msg. But the question is how to set them up. | 10:31 |
| *** ysandeep is now known as ysandeep|lunch | 10:34 | |
| opendevreview | Luca Miccini proposed openstack/tripleo-ansible master: Ensure /run/frr is present after (re)boot https://review.opendev.org/c/openstack/tripleo-ansible/+/857038 | 10:35 |
| lecris[m] | jpodivin: I've added a quick dirty runtime "fix?" for that in the bug report | 10:43 |
| opendevreview | chandan kumar proposed openstack/tripleo-common master: Add an Ansible execution environment to our Build https://review.opendev.org/c/openstack/tripleo-common/+/776674 | 10:48 |
| opendevreview | Rabi Mishra proposed openstack/tripleo-heat-templates master: Support actual hostnames in DeploymentServerBlacklist https://review.opendev.org/c/openstack/tripleo-heat-templates/+/857039 | 11:16 |
| opendevreview | Manojkatari proposed openstack/tripleo-heat-templates master: new t-h-t template for Cinder RBD backend https://review.opendev.org/c/openstack/tripleo-heat-templates/+/857071 | 11:17 |
| opendevreview | Vijayalakshmi proposed openstack/tripleo-ansible master: Restart tuned service to apply tuned boot options https://review.opendev.org/c/openstack/tripleo-ansible/+/857040 | 11:17 |
| bogdando | hi, ykarel, slaweq, do you know anything about those neutron/ovn related failures https://storage.bhs.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_6cd/855187/3/check/tripleo-ci-centos-8-9-multinode-mixed-os/6cd1757/logs/subnode-2/var/log/containers/neutron/ovn-metadata-agent.log ? those looked unlreated to 855187 to me | 11:18 |
| bogdando | https://review.opendev.org/c/openstack/tripleo-heat-templates/+/855187 | 11:18 |
| ykarel | bogdando, ahhk seems caused by recent update for ovs/ovn in c9 wallaby | 11:37 |
| ykarel | as there is different version for these in C8 | 11:37 |
| bogdando | yay | 11:37 |
| ykarel | controller version - 21.12.3-20.21.0-61.4 mismatch with northd version - 22.06.1-20.23.0-63.4 | 11:37 |
| bogdando | so, the job related, not the patch | 11:37 |
| bogdando | thanks | 11:37 |
| ykarel | yes right, ^ the reason of failure | 11:38 |
| ykarel | bhagyashris|ruck, jm1|rover is ^ already known? | 11:40 |
| *** dviroel_ is now known as dviroel | 11:45 | |
| jm1 | lecris[m]: thank you for reporting that bug! actually i saw that issue a couple of times before but it usually intermittent and as such had no time to hunt it down. example: https://logserver.rdoproject.org/57/44657/9/check/periodic-tripleo-ci-centos-9-ovb-3ctlr_1comp-featureset001-clients-master/3fb6e42/logs/overcloud-controller-0/var/log/containers/stdouts/keystone_db_sync.log.txt.gz | 11:46 |
| lecris[m] | It is rather weird that it is being intermittent. It indicates that sometimes podman does not properly check permission? Or is it that podman sometimes adds `CAP_AUDIT_WRITE` and sometimes not? | 11:48 |
| lecris[m] | Right now I am trying to run with `privileged: true` in https://opendev.org/openstack/tripleo-ansible/src/branch/master/tripleo_ansible/roles/tripleo_keystone/templates/keystone_db_sync.yaml.j2#L4 | 11:49 |
| opendevreview | Merged openstack/tripleo-heat-templates master: Neutron: Deprecate unmaintained features https://review.opendev.org/c/openstack/tripleo-heat-templates/+/846249 | 11:50 |
| lecris[m] | Otherwise, I do not see in https://opendev.org/openstack/tripleo-ansible/src/commit/96e9b135cdabf6d51cd5d107774d2b1c8e9efffc/tripleo_ansible/ansible_plugins/modules/tripleo_container_manage.py how to `--cap-add` or add custom flags | 11:52 |
| opendevreview | Cedric Jeanneret proposed openstack/tripleo-ansible master: New roles for apache/httpd management https://review.opendev.org/c/openstack/tripleo-ansible/+/853481 | 11:54 |
| opendevreview | Cedric Jeanneret proposed openstack/tripleo-ansible master: New tripleo_ironic role https://review.opendev.org/c/openstack/tripleo-ansible/+/855873 | 11:55 |
| opendevreview | chandan kumar proposed openstack/tripleo-common master: [DNM] Build tripleo-ansible-ee container https://review.opendev.org/c/openstack/tripleo-common/+/850458 | 12:03 |
| opendevreview | Merged openstack/tripleo-heat-templates master: Remove old network_data examples https://review.opendev.org/c/openstack/tripleo-heat-templates/+/856343 | 12:09 |
| opendevreview | Merged openstack/tripleo-heat-templates master: Add parameter OVNEncapTos https://review.opendev.org/c/openstack/tripleo-heat-templates/+/854127 | 12:09 |
| opendevreview | Merged openstack/tripleo-ansible master: TripleO os_net_config playbooks should allow re-run https://review.opendev.org/c/openstack/tripleo-ansible/+/848411 | 12:09 |
| *** amoralej is now known as amoralej|lunch | 12:18 | |
| jm1 | ykarel, bogdando: we are facing this issue in periodic jobs since friday as well, will create a bug report. thanks for reporting it! | 12:22 |
| bogdando | cool, thanks! | 12:23 |
| bogdando | chandankumar: hi, I can see https://review.opendev.org/c/openstack/tripleo-ansible/+/855358 is still blocked by /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta: no such file or directory | 12:23 |
| ykarel | jm1, ack Thanks, we would need to update versions for c8 stream to clear this | 12:23 |
| bogdando | hasn't https://review.opendev.org/c/openstack/tripleo-ansible/+/856283 fixed it? | 12:23 |
| ykarel | but that would take some time, i was discussion with amoralej|lunch on #rdo | 12:24 |
| chandankumar | bogdando: can you recheck the patch? https://zuul.opendev.org/t/openstack/builds?job_name=tripleo-ansible-centos-stream-molecule-test_deps&project=openstack/tripleo-ansible seems to be good today | 12:27 |
| chandankumar | the fix merged on 8th | 12:28 |
| chandankumar | bogdando: we again merged one more fix https://review.opendev.org/c/openstack/tripleo-ansible/+/856758 | 12:30 |
| chandankumar | recheck would fix it | 12:30 |
| opendevreview | Bogdan Dobrelya proposed openstack/tripleo-ansible master: Add openssh test_deps as container manager needs it https://review.opendev.org/c/openstack/tripleo-ansible/+/855358 | 12:35 |
| opendevreview | Bogdan Dobrelya proposed openstack/tripleo-ansible master: tripleo_nova_libvirt: add for standalone roles https://review.opendev.org/c/openstack/tripleo-ansible/+/842152 | 12:35 |
| opendevreview | Bogdan Dobrelya proposed openstack/tripleo-ansible master: tripleo_nova_compute: add for standalone roles https://review.opendev.org/c/openstack/tripleo-ansible/+/843659 | 12:35 |
| opendevreview | Merged openstack/openstack-tempest-skiplist master: Skip neutron_tempest_plugin.api.test_port_forwardings.PortForwardingTestJSON https://review.opendev.org/c/openstack/openstack-tempest-skiplist/+/856764 | 12:36 |
| opendevreview | Sandeep Yadav proposed openstack/tripleo-quickstart-extras master: Create a yaml with custom CI rules for Firewall https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/857096 | 12:44 |
| *** ysandeep|lunch is now known as ysandeep | 12:44 | |
| opendevreview | Sandeep Yadav proposed openstack/tripleo-quickstart-extras master: Create a yaml with custom CI rules for Firewall https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/857096 | 12:46 |
| opendevreview | yatin proposed openstack/puppet-tripleo stable/wallaby: [DNM] Test mis match northd version https://review.opendev.org/c/openstack/puppet-tripleo/+/857101 | 12:46 |
| *** amoralej|lunch is now known as amoralej | 12:51 | |
| opendevreview | Sandeep Yadav proposed openstack/tripleo-quickstart-extras master: Create a yaml with custom CI rules for Firewall https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/857096 | 12:51 |
| jm1 | ykarel, bogdando: https://bugs.launchpad.net/tripleo/+bug/1989341 | 12:54 |
| ykarel | Thanks jm1 | 12:57 |
| opendevreview | Sandeep Yadav proposed openstack/tripleo-quickstart master: Include custom ci firewall rule in deployment https://review.opendev.org/c/openstack/tripleo-quickstart/+/857128 | 12:59 |
| opendevreview | Sandeep Yadav proposed openstack/tripleo-quickstart-extras master: Create a yaml with custom CI rules for Firewall https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/857096 | 13:02 |
| opendevreview | chandan kumar proposed openstack/tripleo-common master: Add an Ansible execution environment to our Build https://review.opendev.org/c/openstack/tripleo-common/+/776674 | 13:02 |
| opendevreview | Sandeep Yadav proposed openstack/tripleo-quickstart-extras master: Create a yaml with custom CI rules for Firewall https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/857096 | 13:04 |
| opendevreview | Cedric Jeanneret proposed openstack/tripleo-heat-templates master: Convert httpd ironic_api configurations to new role https://review.opendev.org/c/openstack/tripleo-heat-templates/+/854568 | 13:04 |
| opendevreview | chandan kumar proposed openstack/tripleo-ci master: Add support for tcib_extra_config https://review.opendev.org/c/openstack/tripleo-ci/+/850736 | 13:04 |
| opendevreview | Marios Andreou proposed openstack/tripleo-ci master: Mark tripleo-ci-centos-8-9-multinode-mixed-os non voting https://review.opendev.org/c/openstack/tripleo-ci/+/857142 | 13:05 |
| marios | jm1: bogdando: ykarel: amoralej: rlandy: as discussed ^^ non voting | 13:05 |
| amoralej | marios, ykarel i did a scratch build of rdo-openvswitch-2.17 and looks good, i'm doing a final build and i'll propose the update | 13:06 |
| ykarel | Thanks amoralej marios | 13:06 |
| marios | thank you amoralej | 13:06 |
| amoralej | ykarel, there is some way to test the update in the mix job with a temp repo? | 13:06 |
| opendevreview | Sandeep Yadav proposed openstack/tripleo-quickstart master: Include custom ci firewall rule in deployment https://review.opendev.org/c/openstack/tripleo-quickstart/+/857128 | 13:06 |
| rlandy | marios: thanks - voted | 13:07 |
| ykarel | amoralej, atleast should work with release file updates | 13:08 |
| ykarel | wallaby release file in this case | 13:08 |
| opendevreview | chandan kumar proposed openstack/tripleo-common master: [DNM] Build tripleo-ansible-ee container https://review.opendev.org/c/openstack/tripleo-common/+/850458 | 13:18 |
| opendevreview | yatin proposed openstack/tripleo-quickstart master: [DNM] Test c8s wallaby with rdo-openvswitch-2.17 https://review.opendev.org/c/openstack/tripleo-quickstart/+/857171 | 13:27 |
| opendevreview | Cedric Jeanneret proposed openstack/tripleo-heat-templates master: Switch default firewall engine https://review.opendev.org/c/openstack/tripleo-heat-templates/+/852808 | 13:31 |
| opendevreview | yatin proposed openstack/tripleo-heat-templates stable/wallaby: [DNM] Test c8s wallaby with rdo-openvswitch-2.17 https://review.opendev.org/c/openstack/tripleo-heat-templates/+/857182 | 13:31 |
| *** dasm|off is now known as dasm | 13:33 | |
| opendevreview | Rodolfo Alonso proposed openstack/tripleo-heat-templates stable/wallaby: Add parameter OVNEncapTos https://review.opendev.org/c/openstack/tripleo-heat-templates/+/857189 | 13:34 |
| opendevreview | yatin proposed openstack/tripleo-heat-templates stable/wallaby: [DNM] Test c8s wallaby with rdo-openvswitch-2.17 https://review.opendev.org/c/openstack/tripleo-heat-templates/+/857182 | 13:38 |
| opendevreview | Cedric Jeanneret proposed openstack/tripleo-ansible master: New roles for apache/httpd management https://review.opendev.org/c/openstack/tripleo-ansible/+/853481 | 13:58 |
| opendevreview | Cedric Jeanneret proposed openstack/tripleo-ansible master: New tripleo_ironic role https://review.opendev.org/c/openstack/tripleo-ansible/+/855873 | 13:58 |
| opendevreview | Brendan Shephard proposed openstack/python-tripleoclient master: Change git user for config-download https://review.opendev.org/c/openstack/python-tripleoclient/+/856591 | 14:03 |
| opendevreview | Sandeep Yadav proposed openstack/tripleo-quickstart-extras master: Create a yaml with custom CI rules for Firewall https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/857096 | 14:19 |
| opendevreview | Juan Larriba proposed openstack/tripleo-ansible stable/wallaby: [RFE] Add a new Snapshot And Revert feature to Backup and Restore https://review.opendev.org/c/openstack/tripleo-ansible/+/857056 | 14:23 |
| opendevreview | Juan Larriba proposed openstack/tripleo-ansible stable/wallaby: [RFE] Add a new Snapshot And Revert feature to Backup and Restore https://review.opendev.org/c/openstack/tripleo-ansible/+/857056 | 14:26 |
| opendevreview | chandan kumar proposed openstack/tripleo-common master: Add an Ansible execution environment to our Build https://review.opendev.org/c/openstack/tripleo-common/+/776674 | 14:31 |
| opendevreview | Takashi Kajinami proposed openstack/tripleo-heat-templates master: Nova: Set unprivileged_userfaultfd only when post-copy is enabled https://review.opendev.org/c/openstack/tripleo-heat-templates/+/856025 | 14:35 |
| jm1 | Tengu: hello :) do you know how to add a capability to podman containers in tripleo? https://bugs.launchpad.net/tripleo/+bug/1989247 (lecris[m] fyi) | 14:41 |
| Tengu | jm1: you can have a look at nova containers in tripleo heat templates. Im off duty now, we can check back tomorrow if you want/need | 14:48 |
| opendevreview | Takashi Kajinami proposed openstack/python-tripleoclient master: admin authorize: Deprecate ineffective --overcloud-ssh-network https://review.opendev.org/c/openstack/python-tripleoclient/+/857196 | 14:56 |
| jm1 | Tengu: ack, lets talk about this tomorrow. have a nice evening :) | 14:59 |
| opendevreview | Jiri Podivin proposed openstack/validations-libs master: Logging facility for VF https://review.opendev.org/c/openstack/validations-libs/+/857198 | 15:00 |
| opendevreview | Merged openstack/tripleo-quickstart master: Exclude kernel from dnf update https://review.opendev.org/c/openstack/tripleo-quickstart/+/856603 | 15:07 |
| opendevreview | Mikolaj Ciecierski proposed openstack/tripleo-heat-templates master: Fix Update ovn_controller. from external-update playbook https://review.opendev.org/c/openstack/tripleo-heat-templates/+/857199 | 15:08 |
| *** ysandeep is now known as ysandeep|out | 15:16 | |
| *** ysandeep|out is now known as ysandeep | 15:16 | |
| *** ysandeep is now known as ysandeep|out | 15:20 | |
| opendevreview | yatin proposed openstack/tripleo-quickstart-extras master: Fix resolution of tripleo_ceph_deploy_container_namespace https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/857201 | 15:24 |
| rlandy | slaweq: ykarel: hi - could someone on your team take a look at https://trello.com/c/ornI3NOX/2703-cixlp1989197tripleociproa-tempest-test-neutrontempestpluginapitestportforwardingsportforwardingtestjson-failing-on-periodic-trip? I think we promoted that up from the network component to clear another issue | 15:31 |
| rlandy | there is a skiplist - so it's not super urgent | 15:31 |
| rlandy | but we'd like to clear the skip if possible | 15:31 |
| rlandy | jm1: ^^ | 15:31 |
| rlandy | fyi | 15:31 |
| opendevreview | Merged openstack/tripleo-heat-templates stable/train: [Train-Only] Restore nova_api_db_sync_stein vols https://review.opendev.org/c/openstack/tripleo-heat-templates/+/856531 | 15:33 |
| ykarel | rlandy, /me leaving for today, i will check in my morning tomorrow if no one else picks up | 15:36 |
| rlandy | ykarel: thank you | 15:37 |
| ykarel | looks related to changes https://review.opendev.org/q/topic:bug%252F1971646 | 15:37 |
| *** marios is now known as marios|out | 15:47 | |
| opendevreview | Merged openstack/python-tripleoclient master: Use host network for db_sync https://review.opendev.org/c/openstack/python-tripleoclient/+/856226 | 15:51 |
| *** dviroel is now known as dviroel|lunch | 15:55 | |
| opendevreview | Oliver Walsh proposed openstack/tripleo-heat-templates master: Use python to template cell urls https://review.opendev.org/c/openstack/tripleo-heat-templates/+/851917 | 16:03 |
| *** dhill is now known as Guest117 | 16:04 | |
| *** jpena|off is now known as jpena | 16:09 | |
| *** jpena is now known as jpena|off | 16:10 | |
| sdanni | Hi! We are working on deploying overcloud with SSL. We use letsencrypt certificates which will expire in 90 days. I wonder what is the common way to renew ssl certificates in openstack environment without redeploying overcloud? | 16:23 |
| opendevreview | Sandeep Yadav proposed openstack/tripleo-quickstart master: Include custom ci firewall rule in deployment https://review.opendev.org/c/openstack/tripleo-quickstart/+/857128 | 16:43 |
| *** dviroel|lunch is now known as dviroel | 16:52 | |
| *** amoralej is now known as amoralej|off | 16:52 | |
| opendevreview | Merged openstack/tripleo-heat-templates master: Add role specific settings for ovn_bgp_agent parameters https://review.opendev.org/c/openstack/tripleo-heat-templates/+/854574 | 19:23 |
| opendevreview | Douglas Viroel proposed openstack/tripleo-heat-templates master: Test custom cpu_model on nested virt job https://review.opendev.org/c/openstack/tripleo-heat-templates/+/857226 | 19:33 |
| opendevreview | Merged openstack/tripleo-quickstart master: Mixed OS conditional dlrn_hash_tag for component line https://review.opendev.org/c/openstack/tripleo-quickstart/+/853860 | 20:07 |
| opendevreview | Merged openstack/tripleo-ci master: Mark tripleo-ci-centos-8-9-multinode-mixed-os non voting https://review.opendev.org/c/openstack/tripleo-ci/+/857142 | 20:07 |
| *** dviroel is now known as dviroel|afk | 20:28 | |
| opendevreview | Merged openstack/tripleo-quickstart-extras master: Adding temporary workaround for libvirt-failures https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/856244 | 20:48 |
| opendevreview | Brendan Shephard proposed openstack/python-tripleoclient master: Change git user for config-download https://review.opendev.org/c/openstack/python-tripleoclient/+/856591 | 21:25 |
| opendevreview | Lukas Bezdicka proposed openstack/tripleo-heat-templates stable/wallaby: WIP: FFWD3: enample templated haproxy/heat images https://review.opendev.org/c/openstack/tripleo-heat-templates/+/852898 | 21:37 |
| opendevreview | Brendan Shephard proposed openstack/tripleo-heat-templates master: Move update_tasks for tripleo-packages https://review.opendev.org/c/openstack/tripleo-heat-templates/+/838605 | 22:41 |
| *** dasm is now known as dasm|off | 22:59 | |
| opendevreview | Merged openstack/tripleo-quickstart master: Revert "Downgrade python3-sqlalchemy" https://review.opendev.org/c/openstack/tripleo-quickstart/+/850568 | 23:13 |
| opendevreview | Brendan Shephard proposed openstack/tripleo-ansible master: Add standalone ovn-controller role https://review.opendev.org/c/openstack/tripleo-ansible/+/845653 | 23:30 |
| opendevreview | Brendan Shephard proposed openstack/tripleo-ansible master: Add external update tasks to tripleo_ovn role https://review.opendev.org/c/openstack/tripleo-ansible/+/857242 | 23:49 |
| opendevreview | Brendan Shephard proposed openstack/tripleo-heat-templates master: Move OVN external_update_tasks to tripleo-ansible https://review.opendev.org/c/openstack/tripleo-heat-templates/+/857243 | 23:56 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!