| *** rlandy has quit IRC | 00:01 | |
| *** saneax has quit IRC | 00:25 | |
| *** jamesmcarthur has joined #zuul | 00:29 | |
| *** jamesmcarthur has quit IRC | 01:07 | |
| *** wxy-xiyuan_ has joined #zuul | 01:07 | |
| *** jamesmcarthur has joined #zuul | 01:07 | |
| *** jamesmcarthur has quit IRC | 01:12 | |
| *** jamesmcarthur has joined #zuul | 01:38 | |
| *** jamesmcarthur has quit IRC | 02:16 | |
| openstackgerrit | Gabor Lekeny proposed zuul/zuul master: Decode k8s ServiceAccount bearer token https://review.opendev.org/687107 | 02:18 |
|---|---|---|
| *** wxy-xiyuan_ is now known as wxy-xiyuan | 02:33 | |
| *** jamesmcarthur has joined #zuul | 02:36 | |
| *** jamesmcarthur has quit IRC | 02:41 | |
| *** igordc has quit IRC | 02:52 | |
| *** bhavikdbavishi has joined #zuul | 02:57 | |
| *** bhavikdbavishi1 has joined #zuul | 03:00 | |
| *** bhavikdbavishi has quit IRC | 03:01 | |
| *** bhavikdbavishi1 is now known as bhavikdbavishi | 03:01 | |
| *** rfolco has quit IRC | 03:12 | |
| *** igordc has joined #zuul | 03:19 | |
| openstackgerrit | Merged zuul/project-config master: Trigger gate after reverify https://review.opendev.org/686933 | 04:18 |
| openstackgerrit | Merged zuul/project-config master: Make recheck alias reverify in gate https://review.opendev.org/687136 | 04:18 |
| *** fungi has quit IRC | 04:21 | |
| *** fungi has joined #zuul | 04:26 | |
| *** badboy has joined #zuul | 05:16 | |
| *** bolg has joined #zuul | 05:42 | |
| *** swest has quit IRC | 06:44 | |
| *** swest has joined #zuul | 06:45 | |
| *** themroc has joined #zuul | 06:56 | |
| *** tosky has joined #zuul | 07:24 | |
| bolg | Shrews: Yes, Mac/Darwin uses kqueue. The issue in https://review.opendev.org/c/671674 is that Zuul grar uses Epoll (since it targets Linux machines) using some extended features over Poll (which has broader OS support). For development purposes (developer's machines) we want it to run localy and do not care so much about performance. Implementing KQueue would be significantly more effort since the API is completely different and there would be no benefit. We | 07:33 |
| bolg | are not running Zuul production on BSD/Darwin systems. Maybe I can improve the commit message. | 07:33 |
| openstackgerrit | Luigi Toscano proposed zuul/zuul-jobs master: fetch-subunit-output: collect additional subunits (2nd try) https://review.opendev.org/674334 | 07:38 |
| *** jpena|off is now known as jpena | 07:47 | |
| openstackgerrit | Luigi Toscano proposed zuul/zuul-jobs master: fetch-subunit-output: collect additional subunits (2nd try) https://review.opendev.org/674334 | 08:28 |
| *** hashar has joined #zuul | 08:47 | |
| openstackgerrit | Luigi Toscano proposed zuul/zuul-jobs master: fetch-subunit-output: collect additional subunits (2nd try) https://review.opendev.org/674334 | 08:51 |
| openstackgerrit | Luigi Toscano proposed zuul/zuul-jobs master: fetch-subunit-output: collect additional subunits (2nd try) https://review.opendev.org/674334 | 08:57 |
| *** kerby has quit IRC | 09:03 | |
| *** bhavikdbavishi has quit IRC | 09:17 | |
| tosky | so, https://review.opendev.org/674334 - now with working tests! ^^^ Shrews, AJaeger | 09:23 |
| *** pcaruana has joined #zuul | 09:30 | |
| *** gtema has joined #zuul | 09:31 | |
| *** rfolco has joined #zuul | 09:32 | |
| AJaeger | \o/ | 09:33 |
| openstackgerrit | Fabien Boucher proposed zuul/zuul master: Pagure - Manage project connector refresh when EINVALIDTOK https://review.opendev.org/687259 | 10:01 |
| *** gtema has quit IRC | 10:18 | |
| *** hashar has quit IRC | 10:28 | |
| openstackgerrit | Simon Westphahl proposed zuul/nodepool master: Assign static 'building' nodes in cleanup handler https://review.opendev.org/687261 | 10:31 |
| *** jamesmcarthur has joined #zuul | 11:15 | |
| *** bolg has quit IRC | 11:15 | |
| openstackgerrit | Simon Westphahl proposed zuul/nodepool master: Sort waiting static nodes by creation time https://review.opendev.org/687271 | 11:18 |
| *** jamesmcarthur has quit IRC | 11:19 | |
| *** sileht has quit IRC | 11:21 | |
| *** bolg has joined #zuul | 11:32 | |
| *** jpena is now known as jpena|lunch | 11:41 | |
| *** badboy has quit IRC | 12:19 | |
| *** jangutter_ has joined #zuul | 12:20 | |
| *** jangutter has quit IRC | 12:23 | |
| *** jamesmcarthur has joined #zuul | 12:26 | |
| *** jamesmcarthur has quit IRC | 12:31 | |
| *** jpena|lunch is now known as jpena | 12:37 | |
| *** rlandy has joined #zuul | 12:39 | |
| *** bhavikdbavishi has joined #zuul | 12:42 | |
| *** jamesmcarthur has joined #zuul | 12:51 | |
| *** pcaruana has quit IRC | 12:53 | |
| *** bhavikdbavishi has quit IRC | 13:15 | |
| *** jangutter has joined #zuul | 13:32 | |
| *** jangutter_ has quit IRC | 13:36 | |
| *** sileht has joined #zuul | 13:37 | |
| openstackgerrit | Merged zuul/nodepool master: Use real uuids in fake cloud resource IDs https://review.opendev.org/687144 | 13:53 |
| *** fdegir has quit IRC | 14:06 | |
| *** jamesmcarthur has quit IRC | 14:06 | |
| *** fdegir has joined #zuul | 14:07 | |
| *** themroc has quit IRC | 14:14 | |
| flaper87 | I learned today that it's possible to pass a script as the tenant_config instead of a yaml file. Has anyone implemented a script to load as untrusted-project all the projects that Zuul Github's app is installed for? | 14:29 |
| flaper87 | If not, is there an example of a script to load the tenant config? I'm assuming the output should be a yaml just like the config it expects | 14:29 |
| pabelanger | I think software factory might be using it, but dmsimard or tristanC may know more | 14:31 |
| flaper87 | pabelanger: danke | 14:32 |
| *** avass has joined #zuul | 14:35 | |
| fbo | flaper87: here is an example of script https://review.opendev.org/#/c/535878/18/tests/fixtures/config/tenant-parser/tenant_config_script.py. The format is yaml, the same as a classic main.yaml zuul tenant file | 14:36 |
| *** jamesmcarthur has joined #zuul | 14:37 | |
| *** bolg has quit IRC | 14:43 | |
| *** pcaruana has joined #zuul | 14:46 | |
| openstackgerrit | Kerby proposed zuul/nodepool master: AWS driver: add ability to determine AMI id using filters https://review.opendev.org/683205 | 14:46 |
| openstackgerrit | Kerby proposed zuul/nodepool master: AWS driver: add ability to determine AMI id using filters https://review.opendev.org/683205 | 14:50 |
| openstackgerrit | Kerby proposed zuul/nodepool master: AWS driver: add ability to determine AMI id using filters https://review.opendev.org/683205 | 14:52 |
| Shrews | fungi: your website change https://review.opendev.org/685799 makes the footer a bit weird. Your link text wraps: https://6dca5728c40d535db466-4fcaafdedb24be0c657932ab646595c9.ssl.cf2.rackcdn.com/685799/2/check/zuul-website-build/4120b5f/html/ | 15:02 |
| Shrews | which is weird, because there is tons of space there | 15:02 |
| fungi | Shrews: i was worried it might... want to figure out a phrase which people are likely to find when keyword-searching on a page | 15:04 |
| fungi | yet short enough to fit the flow of the other footer entries | 15:04 |
| Shrews | fungi: i'm guessing it's just a css width/limit that needs increasing | 15:04 |
| fungi | yeah, could be. i'll try to fiddle with that in a bit | 15:04 |
| corvus | fbo, flaper87: if anyone does have/write that github script, feel free to put it in the tools/ dir to share | 15:05 |
| Shrews | <section class="3u 6u$(narrower) 12u$(mobilep)"> | 15:05 |
| Shrews | such greek to me | 15:05 |
| corvus | Shrews: those numbers are a sort of css construct that says how wide to make it -- the screen is 12 "units" wide, normally that should be made 3 "units" wide (ie 1/4 of screen width) unless the window is small, in which case it should be 1/2 the width, or really small (mobile), it should be the full width | 15:07 |
| Shrews | corvus: ah, of course :) | 15:08 |
| Shrews | so possibly adjusting some of those numbers can help with the wrap around issue | 15:10 |
| *** jamesmcarthur_ has joined #zuul | 15:23 | |
| *** jamesmcarthur has quit IRC | 15:26 | |
| *** avass has quit IRC | 15:43 | |
| *** mattw4 has joined #zuul | 16:09 | |
| *** bhavikdbavishi has joined #zuul | 16:13 | |
| openstackgerrit | Fabien Boucher proposed zuul/zuul master: Pagure - add the enqueue_ref unit test https://review.opendev.org/687351 | 16:19 |
| *** igordc has quit IRC | 16:25 | |
| *** rfolco is now known as not_rlandy | 16:29 | |
| *** not_rlandy is now known as rfolco | 16:29 | |
| SpamapS | 3.10.2-67-g510efce0 ... 67 commits? Is there something preventing a release? | 16:57 |
| fungi | wow, that's a lot of commits for having only been 3 weeks | 16:59 |
| clarkb | I think the gerrit checks api support needed to be stable enough(eg not break ssh gerrit?) | 17:00 |
| clarkb | probably can be released nowish though | 17:00 |
| fungi | i expect it'll be 3.11.0 just looking at the list of commits since the last release | 17:01 |
| fungi | the new autohold stuff, some new reporter actions, gerrit checks plugin support, gerrit robot comments support, http-only gerrit support, new event handlers for pagure, the change to no longer encrypt job-output.txt by default... | 17:04 |
| Shrews | ooh, that reminds me to check my holds... | 17:04 |
| fungi | s/encrypt/compress/ | 17:10 |
| * fungi sighs | 17:10 | |
| fungi | er, i guess the job-output.txt compression default change was in zuul-jobs not in zuul, so the change in zuul was just about adapting the quickstart tests to deal with that | 17:11 |
| fungi | but the other stuff there still makes it at least a minor version bump | 17:12 |
| SpamapS | Agreed | 17:17 |
| corvus | yeah, the gerrit checks api is experimental -- no release notes or anything, but implementing it touched a bunch of other gerrit stuff which we needed to stabilize (it has been now). it also ended up meaning that some things we did over ssh with gerrit we may now do over http -- we should make sure there's a relnote for that | 17:25 |
| corvus | also, lots of flying around and conferences and stuff | 17:25 |
| fungi | looks like we've been running e6496fa in opendev since friday | 17:26 |
| corvus | looks like we're missing the gerrit http relnote. i'll add that, then i think we're probably set for a release unless others think of something else | 17:26 |
| fungi | and https://review.opendev.org/686853 is the only thing which has merged since opendev's zuul services were all restarted | 17:29 |
| fungi | fairly unobtrusive | 17:29 |
| Shrews | corvus: so, the quick start failures.... latest one is: https://zuul.opendev.org/t/zuul/build/57510d8c2bb745eba8bf2a0ffa742b89/log/job-output.txt#1149 | 17:29 |
| Shrews | corvus: if i do: curl http://localhost:8080/a/changes/test1~master~I5ea67b22d2a5467b0747ea0507587051ed9de563//detail | 17:30 |
| Shrews | i get "Unauthorized" | 17:30 |
| Shrews | maybe curl won't work there | 17:31 |
| fungi | Shrews: any api path starting in a/ needs (digest i think?) auth performed | 17:32 |
| fungi | are you sure the changes api needs a/ in there? | 17:32 |
| *** jpena is now known as jpena|off | 17:32 | |
| Shrews | fungi: oh, i see a username/password being specified in the playbook. yeah, i need "something" else there | 17:33 |
| openstackgerrit | James E. Blair proposed zuul/zuul master: Add a relnote about gerrit and http https://review.opendev.org/687365 | 17:33 |
| fungi | it used to be that gerrit api methods which required authentication were prefixed by a/ and those which didn't need authentication weren't, and methods were either one or the other (so you couldn't reach the anonymous methods under the a/ tree) | 17:34 |
| fungi | i don't know whether that still holds true for the version of gerrit installed in the quickstart job | 17:34 |
| corvus | Shrews: looking at the container logs, it looks like maybe zuul was in the process of running that job? | 17:34 |
| corvus | like we hit a timeout too soon? | 17:35 |
| corvus | Shrews: https://zuul.opendev.org/t/zuul/build/57510d8c2bb745eba8bf2a0ffa742b89/log/container_logs/executor.log | 17:35 |
| corvus | i have to run now; biab | 17:35 |
| Shrews | that task only waits 2 minutes, looks like | 17:37 |
| daniel2 | So when building the images, its failing at the final point, which kind of makes no sense: https://shafer.cc/paste/view/raw/1a65a4c9 | 17:38 |
| daniel2 | I'm curious where it's getting.r | 17:38 |
| fungi | daniel2: looks like that should be /var/lib/nodepool/images/bare-bionic-0000001650.tar not /var/lib/nodepool/images/bare-bionic-0000001650.r | 17:41 |
| fungi | curious how it's winding up with the latter | 17:41 |
| daniel2 | I'm not sure where its getting that | 17:41 |
| pabelanger | what does nodepool.yaml look like for the diskimage? | 17:42 |
| pabelanger | IMAGE_TYPES looks to be wrong? | 17:42 |
| daniel2 | I guess if I put the formats in the clouds.yaml file I don't need it in the nodepool.yaml file | 17:43 |
| pabelanger | possible you formatted it in correct? | 17:44 |
| pabelanger | r is from raw? | 17:44 |
| daniel2 | image_format: 'raw' is whats in clouds.yaml | 17:44 |
| fungi | i wonder if you have a string there instead of a list? | 17:45 |
| fungi | so it's iterating over the letters in the string "raw" | 17:45 |
| pabelanger | yah | 17:45 |
| pabelanger | thinking that too | 17:45 |
| pabelanger | in nodepool formats is a list | 17:45 |
| daniel2 | ah | 17:45 |
| pabelanger | https://zuul-ci.org/docs/nodepool/configuration.html#attr-diskimages.formats | 17:46 |
| daniel2 | So yeah, I dunno why I did that, it should just be raw without the quotes. | 17:46 |
| daniel2 | image_format: raw | 17:46 |
| *** igordc has joined #zuul | 17:46 | |
| pabelanger | ++ | 17:46 |
| daniel2 | | devstack-bionic-0000001651 | devstack-bionic | devops.boi.a10networks.com | a,r,raw,w | building | 00:00:25:51 | | 17:47 |
| daniel2 | I dunno why I didn't see that. | 17:47 |
| daniel2 | Thanks for the heads up. Sometimes it just takes another set of eyes :) | 17:47 |
| Shrews | corvus: oh, hrm... the uri 'content' looks like it's only partial (https://zuul.opendev.org/t/zuul/build/57510d8c2bb745eba8bf2a0ffa742b89/log/job-output.txt#1155). I bet that's messing up the 'until' part of the playbook since it can't parse it as json | 17:53 |
| Shrews | oh, nm. that's taken into account | 18:01 |
| *** jamesmcarthur_ has quit IRC | 18:02 | |
| *** jamesmcarthur has joined #zuul | 18:02 | |
| Shrews | corvus: there is, however, only a single message in the content.messages list. Running that task locally and the only entry is for "Uploaded patch set 1." | 18:04 |
| openstackgerrit | Kerby proposed zuul/nodepool master: AWS driver: add ability to determine AMI id using filters https://review.opendev.org/683205 | 18:07 |
| *** jamesmcarthur has quit IRC | 18:14 | |
| *** bhavikdbavishi has quit IRC | 18:18 | |
| *** daniel2 has quit IRC | 18:21 | |
| *** daniel2 has joined #zuul | 18:31 | |
| *** avass has joined #zuul | 18:51 | |
| *** hashar has joined #zuul | 18:52 | |
| *** ianw_pto is now known as ianw | 18:59 | |
| openstackgerrit | Kerby proposed zuul/nodepool master: AWS driver: add ability to determine AMI id using filters https://review.opendev.org/683205 | 19:07 |
| openstackgerrit | Merged zuul/zuul master: Add a relnote about gerrit and http https://review.opendev.org/687365 | 19:13 |
| *** jamesmcarthur has joined #zuul | 19:17 | |
| avass | does the zuul_console daemon stop tracking the log file for the current job if the file it's reading from isn't updated often enough? | 19:49 |
| fungi | avass: it shouldn't | 19:51 |
| fungi | avass: though it does have to be restarted explicitly if stopped, like say because of a node reboot | 19:51 |
| *** jamesmcarthur has quit IRC | 19:52 | |
| avass | fungi: we have problem with a job where it doesn't output anything for a couple of seconds and it looks like that causes the daemon to stop tracking the file | 19:53 |
| *** jamesmcarthur has joined #zuul | 19:53 | |
| fungi | interesting | 19:56 |
| fungi | we have loads of jobs which are silent on their ansible output for more than "a couple of seconds" and haven't exhibited that behavior | 19:57 |
| avass | fungi: strange | 19:57 |
| fungi | i've looked at some which go silent for an hour (particularly when a task gets "stuck" deadlocked on something and output doesn't resume until it's timed out) | 19:58 |
| *** jamesmcarthur has quit IRC | 19:58 | |
| avass | are those different tasks then? | 19:58 |
| fungi | not sure which "those" you're referring to | 19:58 |
| fungi | do you still get the full job-output.txt archived when the build completes? or only up to where you saw the live stream cease? | 19:59 |
| avass | still get the output from ansible in the logs | 19:59 |
| clarkb | avass: could it be that your client is closing the connection (or some intermediate firewall?) Does reloading give you new output? | 20:00 |
| avass | it only happens if it's a single task that doesn't print anything for a couple of seconds, but it works for the next task | 20:00 |
| fungi | sounds like the websocket could be getting prematurely terminated, yeah, like by an overzealous web proxy or firewall | 20:02 |
| fungi | does reloading the live stream url show you more output after you see it cease? | 20:02 |
| fungi | that should reinitiate the websocket connection i think | 20:02 |
| avass | clarkb: nope | 20:02 |
| avass | fungi* | 20:03 |
| avass | clarkb: don't think it is since it's always the same task. the other ones are fine | 20:03 |
| fungi | ahh, okay, so maybe not a disconnect in the path between the client and the zuul-web service... though could i suppose be something disconnecting between zuul-web and the executor's finger socket | 20:04 |
| avass | it also ends with a 'Timeout exception waiting for the logger' | 20:04 |
| avass | I think it was, or something like that error | 20:07 |
| fungi | yeah, it gets raised here https://opendev.org/zuul/zuul/src/branch/master/zuul/ansible/base/callback/zuul_stream.py#L129 | 20:09 |
| avass | yeah exactly | 20:10 |
| avass | was looking at that earlier | 20:10 |
| avass | in the zuul_console source it looks to me that if there's nothing new to read it sleeps for 0.5 seconds and then stops unless the file was truncated | 20:12 |
| avass | https://opendev.org/zuul/zuul/src/branch/master/zuul/ansible/base/library/zuul_console.py#L106 | 20:13 |
| avass | unless I'm missing something | 20:13 |
| *** jamesmcarthur has joined #zuul | 20:15 | |
| *** rlandy has quit IRC | 20:16 | |
| SpamapS | sounds like maybe that timeout should be configurable | 20:24 |
| *** pcaruana has quit IRC | 20:35 | |
| avass | i'm probably just missing something | 20:35 |
| SpamapS | avass:worst case, you can wrap that command in something that spits out a log entry every 5 minutes or something. | 20:37 |
| avass | yeah I was thinking about doing something like that. but I really wanted to figure this out :) | 20:38 |
| avass | Have to look into it more tomorrow. I'll hop in if I found something | 20:40 |
| fungi | i'll be surprised if it's not environment-specific since we stream output from jobs which goes silent for very long periods sometimes | 20:41 |
| avass | fungi: it probably is since that's the only ansible task we have that behaves that way | 20:43 |
| *** igordc has quit IRC | 20:59 | |
| *** igordc has joined #zuul | 21:00 | |
| openstackgerrit | James E. Blair proposed zuul/zuul-registry master: Use JWT for authorization https://review.opendev.org/687422 | 21:20 |
| corvus | clarkb, fungi, tristanC: ^ that and two opendev system-config changes are a pre-req for shadowing | 21:22 |
| corvus | also, makes anonymous access friendlier | 21:22 |
| fungi | corvus: i appreciate your code comments about the docker client ;) | 21:27 |
| fungi | i continue to marvel at the insanity of that behavior | 21:27 |
| corvus | fungi: i thought you would, but i didn't want to spoil it for you by tipping you off :) | 21:27 |
| corvus | that is a case where they have explicitly chosen to break compatability with the docker client. that's something to file away for clarkb's appeal. | 21:31 |
| corvus | er, they=podman | 21:31 |
| corvus | (i saw a pr somewhere where they were like "we need to be really careful that we send the right creds to the registry". which is a nice thing for them to think.) | 21:31 |
| fungi | clearly the docker client doesn't care if you leak your dockerhub creds to just any ol' mirror | 21:33 |
| fungi | foot meet gun | 21:33 |
| mordred | corvus: bless it's little heart indeed | 21:33 |
| corvus | next up in supporting buildset registry is one more patch to add registry namespace support, then the rest is fiddling with configuration in zuul-jobs roles. | 21:36 |
| mordred | \o/ | 21:37 |
| openstackgerrit | James E. Blair proposed zuul/zuul-registry master: Use JWT for authorization https://review.opendev.org/687422 | 21:47 |
| corvus | mordred, tristanC: pep8 fixes ^ | 21:47 |
| mordred | corvus: +2 | 21:49 |
| SpamapS | fungi: I've been trying to get to podman for a while now.. hopefully it doesn't footgun in such obvious ways. :-P | 21:54 |
| tristanC | corvus: how do you test jwt auth? | 21:57 |
| corvus | tristanC: 'docker login' / 'podman login' | 21:58 |
| corvus | tristanC: it works the same way as basic auth did | 21:58 |
| corvus | tristanC: the test job is exercising it here: https://zuul.opendev.org/t/zuul/build/5f8286fa5ae948b8868dcd93e96f5e59/console#2/1/11/ubuntu-bionic | 21:59 |
| corvus | (though we don't have a negative test for that) | 21:59 |
| tristanC | corvus: using podman login i get AttributeError: module 'jwt' has no attribute 'encode' | 22:02 |
| tristanC | zuul_registry/main.py", line 127 | 22:03 |
| corvus | tristanC: did you 'pip install pyjwt' or 'pip install jwt'? | 22:03 |
| tristanC | oops, installed the wrong jwt library | 22:03 |
| corvus | tristanC: yeah, ask me how i know that :) | 22:04 |
| corvus | it's uncool that the 'pyjwt' library imports as 'jwt'. | 22:04 |
| *** jamesmcarthur has quit IRC | 22:04 | |
| fungi | much like the pyyaml library imports as 'yaml' i suppose | 22:04 |
| tristanC | alright, i was able to work, but i can't see the token in the conf in my auth.json, thus i'm not sure the code is actually tested | 22:05 |
| tristanC | podman was able to login* | 22:05 |
| corvus | tristanC: it should store the creds (but not the token) in /run/user/*/containers/auth.json | 22:06 |
| corvus | tristanC: mine looks like http://paste.openstack.org/show/782274/ | 22:08 |
| corvus | (that's testuser:testpass) | 22:08 |
| tristanC | same here, ok perhaps we should add a test to do: `curl -k -u testuser:testpass https://localhost:9000/auth/token` which outputs a jwt token | 22:09 |
| tristanC | oh my bad, i see that's what the client does already | 22:10 |
| corvus | yeah, but we should add tests that try to push and pull without auth (pull should work, push should fail) | 22:11 |
| openstackgerrit | Merged zuul/nodepool master: dib-functional : allow extra elements to be passed https://review.opendev.org/685884 | 22:11 |
| tristanC | it's just that doing `podman login` and `skopeo copy` worked without that jwt patch, thus it's unclear what this enable | 22:13 |
| corvus | tristanC: 2 things: it allows you to do 'podman pull' and 'skopeo copy' without providing any credentials. that will make it easier for folks to pull test images from the intermediate registry for debugging. | 22:14 |
| corvus | tristanC: the other thing is that it will handle the case where we configure it as a buildset registry in front of dockerhub and the client is logged into dockerhub. in that case, we need to accept the credentials provided, whatever they are, and allow read access. | 22:15 |
| corvus | also, i guess this is a third thing, it is really the only way to have truly anonymous read access and authenticated write access. which we need for the buildset registry because we don't want to require auth for pulling, but we do need auth for pushing. | 22:18 |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-registry master: Add anonymous pull test https://review.opendev.org/687433 | 22:19 |
| tristanC | not sure how to test the proxy thing, but here is a test for the anonymous pull ^ | 22:20 |
| corvus | tristanC: we're not ready to test proxying; that's next | 22:22 |
| tristanC | corvus: could this happen by chaining two zuul-registries? | 22:22 |
| corvus | tristanC: what? | 22:22 |
| tristanC | e.g. have a zuul-registry pretending to be the real dockerhub, and another one to be the proxy | 22:23 |
| corvus | tristanC: we don't need to proxy -- the result of our conversation yesterday is that we decided to use registry mirrors to implement the buildset registry functionality. that means we'll be relying on docker/podman mirror fallback logic. | 22:24 |
| corvus | but i still need to write more code for zuul-registry before we're ready for that | 22:24 |
| corvus | (mostly around dealing with multiple namespaces) | 22:25 |
| tristanC | corvus: not sure to understand how mirror fallback logic works and why the zuul-registry needs to implement jwt and accept credentials in that case. i guess the next patch will shed some light :) | 22:28 |
| fungi | tristanC: at least the docker client will unconditionally authenticate to the fallback (better still, using the same credentials it used to authenticate to dockerhub) | 22:29 |
| tristanC | i thought this was because of the mitm solution. | 22:29 |
| tristanC | fungi: ha ok, got it | 22:29 |
| fungi | so if the fallback registry doesn't support (and eat) that authentication... | 22:30 |
| corvus | this is not to support mitm, this is to support the protocol as designed :) | 22:31 |
| *** jamesmcarthur has joined #zuul | 22:35 | |
| *** hashar has quit IRC | 22:35 | |
| *** jamesmcarthur has quit IRC | 22:36 | |
| *** jamesmcarthur has joined #zuul | 22:36 | |
| tristanC | iiuc, this is going to assume image names used by jobs are not fully qualified? for podman, we can configure multiple registries and it will try them in order when doing "podman pull image-name:ref", but when doing "podman pull docker.io/image-name:ref" then it directly pull from dockerhub | 22:36 |
| openstackgerrit | Merged zuul/zuul-registry master: Use JWT for authorization https://review.opendev.org/687422 | 22:37 |
| *** jamesmcarthur has quit IRC | 22:39 | |
| tristanC | which may be an issue as some user may hardcode the registry name when pulling, e.g. to avoid getting docker.io/fedora instead of registry.fedoraproject.org/fedora | 22:39 |
| openstackgerrit | Tristan Cacqueray proposed zuul/nodepool master: Ensure both kubernetes and openshift token are b64decoded https://review.opendev.org/687435 | 22:39 |
| corvus | tristanC: i'm pretty sure i have this covered -- let me finish work on it and we'll see :) | 22:45 |
| corvus | i should have something by tomorrow | 22:45 |
| *** jamesmcarthur has joined #zuul | 22:45 | |
| *** jamesmcarthur has quit IRC | 22:50 | |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-registry master: Add anonymous pull test https://review.opendev.org/687433 | 23:05 |
| *** saneax has joined #zuul | 23:08 | |
| *** tosky has quit IRC | 23:10 | |
| *** armstrongs has joined #zuul | 23:50 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!