Thursday, 2020-03-05

*** sgw has quit IRC00:09
*** Defolos has quit IRC00:13
*** toabctl has quit IRC00:19
*** toabctl has joined #zuul00:22
*** sgw has joined #zuul00:28
*** mattw4 has quit IRC00:29
*** igordc has quit IRC00:33
*** igordc has joined #zuul00:53
openstackgerritTristan Cacqueray proposed zuul/zuul master: Implement zookeeper-auth  https://review.opendev.org/61915601:31
*** nhicher has quit IRC01:38
*** nhicher has joined #zuul01:38
*** igordc has quit IRC02:07
*** Goneri has quit IRC02:24
*** sanjayu_ has joined #zuul02:42
*** bhavikdbavishi has joined #zuul02:51
*** sanjayu_ has quit IRC02:53
*** raukadah is now known as chandankumar03:02
*** rlandy|bbl is now known as rlandy04:29
*** rlandy has quit IRC04:53
*** zxiiro has joined #zuul05:00
*** swest has joined #zuul05:28
*** evrardjp has quit IRC05:35
*** evrardjp has joined #zuul05:35
*** reiterative has quit IRC05:40
*** reiterative has joined #zuul05:40
*** marvs has joined #zuul06:06
*** saneax has joined #zuul06:36
*** pabelanger has quit IRC06:41
*** threestrands has quit IRC06:48
*** jcapitao_off has joined #zuul07:20
*** jcapitao_off is now known as jcapitao07:22
*** migi has quit IRC07:40
openstackgerritBenedikt Löffler proposed zuul/zuul master: Fix override variables in zuul_return  https://review.opendev.org/71100207:43
*** Defolos has joined #zuul07:50
AJaegerzuul-maint, FYI, zuul-ci.org is down currently. If you add "23.253.245.150  zuul-ci.org" to /etc/hosts, you can reach it. Further discussion on #openstack-infra08:22
*** jpena|off is now known as jpena08:26
*** avass has joined #zuul08:28
*** saneax has quit IRC08:29
*** saneax has joined #zuul08:30
openstackgerritFelix Edel proposed zuul/zuul master: Allow check runs to be configured as required status in pipeline config  https://review.opendev.org/71124108:34
openstackgerritFelix Edel proposed zuul/zuul master: Allow check runs to be configured as required status in pipeline config  https://review.opendev.org/71124108:45
*** hashar has joined #zuul08:49
*** hashar_ has joined #zuul08:50
*** hashar__ has joined #zuul08:53
*** hashar has quit IRC08:54
*** hashar_ has quit IRC08:55
openstackgerritIan Wienand proposed opendev/zone-zuul-ci.org master: Use static.opendev.org  https://review.opendev.org/71140308:56
openstackgerritMerged opendev/zone-zuul-ci.org master: git.zuul-ci.org : point to static.opendev.org  https://review.opendev.org/71014209:02
*** hashar__ is now known as hashar09:03
openstackgerritMerged opendev/zone-zuul-ci.org master: Use static.opendev.org  https://review.opendev.org/71140309:06
*** zxiiro has quit IRC09:07
*** Shrews has quit IRC09:07
*** irclogbot_2 has quit IRC09:08
*** portdirect has quit IRC09:08
openstackgerritFelix Edel proposed zuul/zuul master: Don't rely on report-build-page when building the buildset result url  https://review.opendev.org/71140609:19
*** sugaar has joined #zuul09:20
*** tosky has joined #zuul09:25
AJaegerzuul-maint, zuul-ci.org should be up again.09:31
*** bhavikdbavishi has quit IRC09:35
*** sshnaidm|afk is now known as sshnaidm09:37
*** zxiiro has joined #zuul09:43
*** Shrews has joined #zuul09:43
*** irclogbot_2 has joined #zuul09:43
*** portdirect has joined #zuul09:43
*** openstackstatus has quit IRC09:45
*** jcapitao has quit IRC10:20
*** jcapitao has joined #zuul10:21
*** armstrongs has joined #zuul10:26
*** jcapitao has quit IRC10:32
*** jcapitao has joined #zuul10:32
*** hashar has quit IRC10:38
openstackgerritSorin Sbarnea proposed zuul/zuul-jobs master: Tests bindep role on all-platforms  https://review.opendev.org/70870411:00
openstackgerritSorin Sbarnea proposed zuul/zuul-jobs master: Improve ensure-tox role  https://review.opendev.org/70864211:13
*** pabelanger has joined #zuul11:30
*** zxiiro has quit IRC11:48
*** jcapitao is now known as jcapitao_lunch11:54
*** rlandy has joined #zuul12:02
openstackgerritBenedikt Löffler proposed zuul/zuul master: Fix override variables in zuul_return  https://review.opendev.org/71100212:07
*** jpena is now known as jpena|lunch12:09
*** dpawlik has quit IRC12:14
*** dpawlik has joined #zuul12:15
*** jcapitao_lunch has quit IRC12:19
*** jcapitao_lunch has joined #zuul12:21
*** dpawlik has quit IRC12:22
*** dpawlik has joined #zuul12:36
*** armstrongs has quit IRC12:37
openstackgerritBenedikt Löffler proposed zuul/zuul master: Fix override variables in zuul_return  https://review.opendev.org/71100212:51
openstackgerritBenedikt Löffler proposed zuul/zuul master: Fix override variables in zuul_return  https://review.opendev.org/71100212:56
*** jcapitao_lunch is now known as jcapitao13:15
*** jamesmcarthur has joined #zuul13:20
*** hashar has joined #zuul13:22
*** jamesmcarthur has quit IRC13:38
*** jamesmcarthur has joined #zuul13:40
*** jamesmcarthur has quit IRC13:45
*** avass has quit IRC13:47
*** jamesmcarthur has joined #zuul14:09
*** jamesmcarthur has quit IRC14:15
*** flaper87 has joined #zuul14:27
*** jpena|lunch is now known as jpena14:29
*** Goneri has joined #zuul14:31
*** hashar has quit IRC14:32
*** hashar has joined #zuul14:32
*** sgw has quit IRC14:33
*** jamesmcarthur has joined #zuul14:35
*** flaper87 has quit IRC14:38
*** flaper87 has joined #zuul14:38
*** jamesmcarthur has quit IRC14:41
*** jcapitao has quit IRC14:42
*** jamesmcarthur has joined #zuul14:42
*** jcapitao has joined #zuul14:44
*** sgw has joined #zuul14:49
*** jamesmcarthur has quit IRC14:58
*** jamesmcarthur has joined #zuul14:58
*** hashar has quit IRC15:16
*** jamesmcarthur has quit IRC15:23
*** jamesmcarthur has joined #zuul15:27
*** jamesmcarthur has quit IRC15:36
*** jamesmcarthur has joined #zuul15:45
*** jamesmcarthur has joined #zuul15:45
openstackgerritFelix Edel proposed zuul/zuul master: Provide some documentation for the checks API implementation  https://review.opendev.org/71149315:55
*** jcapitao is now known as jcapitao_afk15:56
openstackgerritFelix Edel proposed zuul/zuul master: Make github file annotation levels configurable via zuul return  https://review.opendev.org/71117915:58
mordredcorvus: ^^ that seems like a thing we should point out to our gerrit friends as a potential improvement to the robot_comments feature16:02
mordredpaladox: ^^16:02
*** jcapitao_afk is now known as jcapitao16:10
*** mattw4 has joined #zuul16:11
*** jcapitao has quit IRC16:12
openstackgerritFelix Edel proposed zuul/zuul master: Dequeue changes via github checks API  https://review.opendev.org/70913516:16
*** jcapitao has joined #zuul16:18
*** felixedel has joined #zuul16:19
*** bhavikdbavishi has joined #zuul16:25
felixedelmnaser, pabelanger, corvus, mordred: Tobias told me about the discussion you had two days ago about some aspects of the current checks API implementation: I've tried to cover them in the documentation https://review.opendev.org/#/c/711493/. I'm not sure if that's the right place to put it, but I think it wouldn't be bad to have it somewhere :-) The other topic was about whether or not a check can be used as pipeline.require - currently not16:26
felixedel, but with that it would be possible https://review.opendev.org/#/c/711241/16:26
zenkurohi, is there a way to chech zuul config(config project)? to debug errors16:27
corvusfelixedel: thanks!16:29
AJaegerThe infra manual says "Visit the `OpenStack Zuul App <https://github.com/apps/openstack-zuul>`_ page on GitHub" - but that URL is not working for me. What is the current URL?16:33
paladoxmordred: I think they’ve done improvements in that area.16:34
*** felixedel has quit IRC16:37
mordredpaladox: cool. so we might be able to follow up with that and add support for gerrit too16:38
mordredAJaeger: https://github.com/apps/opendev-zuul16:39
*** zxiiro has joined #zuul16:40
paladoxYup16:40
AJaegerthx, mordred16:41
corvuszenkuro: zuul itself should tell you if a proposed change to a config-project has errors16:46
corvuszenkuro: here's an example of what that looks like from just this morning: https://review.opendev.org/71147416:47
*** Defolos has quit IRC16:53
corvuspabelanger, tobiash: can you take a look at my comment on https://review.opendev.org/711241 ?17:01
*** jamesmcarthur_ has joined #zuul17:21
*** igordc has joined #zuul17:22
tobiashcorvus: you're right17:24
*** jamesmcarthur has quit IRC17:24
*** evrardjp has quit IRC17:35
*** evrardjp has joined #zuul17:35
openstackgerritMerged zuul/nodepool master: Use explicit provides/requires for container jobs  https://review.opendev.org/71011517:46
clarkbcorvus: tristanC left some thoughts on https://review.opendev.org/#/c/619155/32 I think my biggest concern is that we don't appear to be testing with ssl? but expect people to use ssl in production?18:02
ShrewstristanC: corvus: the nodepool side of zk-auth lgtm except for the script name referenced in the release notes18:04
corvusclarkb: good points.  i think we should figure out the tls story.  do we need explicit support in zuul/nodepool for that?  adding it to tests would help us confirm.18:04
corvusclarkb: also your point on zk.py line 965 relates to my point on configuration.rst line 14618:05
clarkbcorvus: ya whether it should be structured or not. I can go either way, it just felt ewird to be converting back and forth in several places18:05
corvusyep.18:05
corvusShrews: i walked back my +2 a little bit after seeing the zuul change -- i think there are a couple of details we should hammer out first18:06
corvusbut yeah, i think we're just about there18:07
*** jcapitao is now known as jcapitao_off18:10
*** jamesmcarthur_ has quit IRC18:10
Shrewscorvus: does zuul create any zuul-only znodes currently? i can't recall18:12
corvusShrews: autohold?18:12
Shrewsooh, yeah. so only running the update script from nodepool (as suggested in the release notes) is not enough18:13
Shrewswe need a separate one18:13
*** jcapitao_off has quit IRC18:15
Shrewsleft comments on the zuul change18:15
*** chandankumar is now known as raukadah18:18
fungii've been asked to provide an overview of zuul at the next cd foundation interoperability sig meeting on march 19. i'm planning to give a little history and talk about what specific features of zuul were designed with interoperability in mind. will circulate my draft slide deck next week to get input from the community, so be thinking about whether there's anything in particular you want me to make sure to18:21
fungicover18:21
mordredfungi: cool18:22
*** Goneri has quit IRC18:23
fungithey've so far been getting presentations from tekton, spinnaker, et cetera. i want to be sure i explain at a low level how zuul is different18:24
mordredfungi: terms/buzzwords: multi-repo jobs, multi-node jobs, multi-source jobs, multi-tenant service, scalable-service, gating, speculative-execution, multi-zuul ecosystem,18:25
mordredfungi: and I can't buzzword it - but "we're not opinonated about how you write your app, we're good if you use baremetal, VMs or containers"18:25
corvuscross-repo-dependencies, cross-source-dependencies?18:26
*** jpena is now known as jpena|off18:26
fungiyeah, in case it's not obvious, this is what drove me to start fleshing out our glossary doc18:26
mordredfungi: :)18:26
mordredfungi: oh - there'sa. REALLY important difference18:27
*** Goneri has joined #zuul18:27
fungibut yeah, i like the point about flexibility on where workloads run. a bunch of newer ci systems assume all your jobs are containers and you have a kubernetes18:28
mordredin zuul, overall workflows are global and shared - we have a per-tenant description of a few discreet ways that all changes react to stimuli and report back18:28
mordredthis is vastly different to the model they're all used to where triggers and reporters are attached to the individual definition of a job18:28
fungithat's a nice systemic description, i like that. thanks!18:29
*** bhavikdbavishi has quit IRC18:29
mordredit's possible one of the largest semantic divergences18:29
fungiright, define jobs anywhere, instantiate them where you need them18:29
mordredyeah - but not just that ... because tekton has job libraries18:30
fungilike .h vs .c files18:30
clarkbfungi: mordred: another major difference after poking around at these things to possibly writea thing that I got side tracked from is multiple code system inputs. Many will only talk to github18:30
clarkbspeculative execution support as a top level feature (and from that scalable proper gating) is another huge divergence18:30
mordredbut that the system overall defines "as a group of peope we want to always respond to pull requests when they get a lgtm vote and we always want to then merge them"18:30
clarkball the other platforms basically force you to figure that out on your own18:30
fungimordred: ahh, i get what you're saying. triggers being tied to the pipeline definitions18:30
mordredyes18:30
clarkb(and prow punts and just does batching)18:31
mordredit's a HUGE semantic difference18:31
fungithis is helpful as i have very limited user experience with ci systems other than zuul18:31
*** mattw4 has quit IRC18:32
mordredfungi: the other huge thing is speculative job definitions including which jobs should be run by the input trigger ... because that's one of the incompatibilities between our world view and the tekton worldview - where they manage a job as a k8s resource - but that means that the job, since it defines the trigger and reporter as part of its contents, MUST pre-exist and be managed outside of the patches18:32
*** mattw4 has joined #zuul18:32
clarkb(note it is possible that a batching dependent pipeline manager would be desireable in zuul but no one has asked for it yet)18:32
fungiand i definitely want to be sure to explain these concepts in ways to which users of other ci systems can relate18:33
mordredyeah - this is one of the few times when talking about zuul in the terms of the other systems is desirable and valuable18:33
clarkbmordred: in the tekton world view you'd have a job that made new jobs aiui18:33
clarkbmordred: so again its doable there, but it isn't a top level feature so users are left to figure it out themselges18:34
mordredclarkb: yes - possibly so18:34
fungiclarkb: the desire for circular dep resolution in gating sort of qualifies as asking fr batching18:34
clarkbfungi: ya I guess that is a particular variant of it18:34
mordredoh - the other thing that's different - we're VERY focused on being a system that is driven by and operates on git changes18:34
fungiright, that's one point i'm planning to put at the forefront18:35
mordredmany of the other systems are systems that are built to handle arbitrary triggers and perform arbitrary automation and git triggers are simply one of the set18:35
clarkbmordred: fungi ya they seem to be of two extremes: either only github triggers or all the things (and often humans clicking buttons)18:35
*** mattw4 has quit IRC18:37
*** mattw4 has joined #zuul18:38
*** hashar has joined #zuul18:46
*** erbarr has joined #zuul19:11
*** Defolos has joined #zuul19:12
*** saneax has quit IRC19:42
*** sgw has quit IRC20:23
openstackgerritMerged zuul/zuul master: Don't rely on report-build-page when building the buildset result url  https://review.opendev.org/71140620:28
openstackgerritMerged zuul/zuul master: Use explicit provides/requires for container jobs  https://review.opendev.org/71011620:28
*** sgw has joined #zuul20:39
*** hashar has quit IRC20:48
*** sshnaidm is now known as sshnaidm|afk20:48
*** jamesmcarthur has joined #zuul20:59
*** jamesmcarthur has quit IRC21:16
*** jamesmcarthur has joined #zuul21:18
*** dpawlik has quit IRC21:18
*** michael-beaver has joined #zuul21:42
corvusShrews: i haven't been able to get zk-shell to work with sasl21:54
corvusthe only thing i can see to try is "add_auth sasl super:adminsecret" and that isn't working so well21:55
Shrewshmm. so it's *supposed* to work with sasl?21:55
Shrewsi've never tried (or even thought about it, tbh)21:55
corvusi don't know; i get the feeling sasl with passwords is an unusual use case for zk21:56
Shrewsmaybe we should try the client that comes with zookeeper21:57
corvusShrews: what's that?21:57
ShrewszkCli.sh i think21:57
Shrewsi actually haven't used it, but i'm hoping it's similar21:58
corvusShrews, clarkb: https://cwiki.apache.org/confluence/display/ZOOKEEPER/ZooKeeper+SSL+User+Guide  that says "There is currently no support for SSL for the communication between ZooKeeper servers."21:58
corvusthat seems like something that may be be concerning?21:59
corvushttps://zookeeper.apache.org/doc/r3.5.5/zookeeperAdmin.html seems to contradict that with references to "quorum tls"22:01
Shrewsi'm not sure what the security impact of that might be. Is our goal to just keep unwanted users from connecting, or keeping the data from being read? We don't store anything of importance, really22:01
corvushopefully the docs are more accurate than the wiki :)22:01
corvusShrews: we're about to store everything of importance in zk22:01
mordredcorvus: why would ... like ... why would something choose to not have ssl support on intra-server communication?22:02
mordredI can't even22:02
Shrewsoh, for the scheduler changes. well then... yeah. that's a potential problem22:03
Shrewsetcd it is!22:03
Shrewslol22:03
corvuswell, i just pointed out docs that say there is support for server-to-server ssl22:03
mordredcorvus: looking at that doc - that also says "for quorum and leader election"22:03
corvusmordred: which one?22:04
*** mattw4 has quit IRC22:04
*** mattw4 has joined #zuul22:04
mordredthe doc not the wiki22:04
mordred"Please note that Quorum TLS encapsulates securing both leader election and quorum communication protocols."22:04
corvusright.  that's the sort of thing that makes me think that it is supported.22:04
mordredis that just a way of saying "server to server communication"? then22:06
clarkbcorvus: https://github.com/apache/zookeeper/pull/82622:06
mordredcorvus: but yeah - it seems to be a fundamental feature of netty -so as long as you tell zk to use netty instead of nio it seems doable22:06
corvusmordred: i think so.  even the wiki put that statement under the heading "quorum"22:06
clarkbcorvus: I believe that pull request says "yes this is supported and we updated logging to make it easier for you to confirm it"22:06
corvusclarkb: yeah, that change added the section to the doc i'm reading now which is an ssl howto22:07
corvus"Quorum TLS"  "New in 3.5.5"22:07
corvussorry can't deeplink22:07
mordredso - yeah - I think those docs describe what we want22:09
Shrewsseems like it22:09
corvuscool, i'll see about getting that going22:10
Shrewsi love this line in that doc:  "The disk is death to ZooKeeper."22:10
mordredcorvus: and it looks like "secure" is on a different port, so it should be decently easy to disallow insecure connection22:10
clarkbhttps://github.com/apache/zookeeper/pull/184 added the actual feature22:11
mordred(for client/server)22:11
clarkbthis PR also equates quorum with server - server22:11
mordredcool22:12
mordredclarkb, Shrews, corvus: while on this topic, ianw has some patches up to move towards ansible+containers for opendev's nodepool-builder - https://review.opendev.org/#/c/710908/ - and the first is setting up zk for testing for system-config ... should we put a pause on that and just wait until we know what this story is going to shake out to be?22:13
mordredor go ahead with that since non-ssl to ssl transition is going to be a transition anywa?22:13
corvusi believe our most recent thoughts on the subject were to store job secrets and project keys in zk, but still store them encrypted with a shared key, and make sure zuul components have that key installed out of band; so it shouldn't be super critical, but honestly, tls just seems like a good idea.22:14
clarkbmordred: maybe? we're likely to do a staged transition where we go from non ssl to ssl, then add auth, and I think we can probably start with non ssl in that testing22:14
corvusmordred: i don't feel that needs to be blocked on this22:14
corvus(also, the auth is using digest, so technically should be okay in the clear, but meh)22:15
clarkband for opendev that might me, redeploy all zk with containers on bionic, add ssl, remove not ssl, add auth22:15
clarkb*might be22:15
mordredkk. just wanted to check22:16
ianwthanks; i wouldn't want to block too much on it either -- it's really only there so the container can start and we see it running in testinfra ... i don't think we want to do full image builds in system-config testing, just validate the daemon starts22:19
*** mattw4 has quit IRC23:04
*** mattw4 has joined #zuul23:05
*** jamesmcarthur has quit IRC23:14
*** mattw4 has quit IRC23:18
*** mattw4 has joined #zuul23:19
*** jamesmcarthur has joined #zuul23:20
*** jamesmcarthur has quit IRC23:32

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!