13:00:52 <redrobot> #startmeeting barbican 13:00:53 <openstack> Meeting started Tue Jul 14 13:00:52 2020 UTC and is due to finish in 60 minutes. The chair is redrobot. Information about MeetBot at http://wiki.debian.org/MeetBot. 13:00:54 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 13:00:57 <openstack> The meeting name has been set to 'barbican' 13:01:09 <redrobot> #topic Roll Call 13:01:19 <tosky> o/ 13:01:21 <Luzi> o/ 13:01:21 <moguimar> o/ 13:01:38 <redrobot> Hello everyone! 13:01:42 <moguimar> iurygregory, around? 13:01:51 <iurygregory> moguimar, yup 13:02:10 <moguimar> hey y'all 13:02:15 <redrobot> Courtesy ping for ade_lee dave-mccowan hrybacki jamespage lxkong mhen raildo rm_work xek nearyo 13:02:23 <redrobot> hi iurygregory! 13:02:40 <iurygregory> hey redrobot o/ 13:03:18 <redrobot> As usual, our agenda can be found here: 13:03:20 <redrobot> #link https://etherpad.opendev.org/p/barbican-weekly-meeting 13:03:39 <redrobot> #topic Review Past Meeting Action Items 13:04:14 <redrobot> #link http://eavesdrop.openstack.org/meetings/barbican/2020/barbican.2020-07-07-13.00.html 13:04:25 <redrobot> First action item: moguimar to update Core Team roster in wiki 13:04:30 <moguimar> done 13:04:41 <redrobot> moguimar, nice! 13:05:04 <redrobot> Here is the link: 13:05:06 <redrobot> #link https://wiki.openstack.org/wiki/Barbican#Core_Team 13:05:25 <redrobot> Next action item: 13:05:27 <redrobot> tosky to check if barbican/volume tests works if moved into cinder-tempest-plugin 13:05:36 <redrobot> tosky, did you get a chance to work on that? 13:05:41 <tosky> not yet, sorry 13:05:54 <tosky> but I will come to that 13:06:07 <redrobot> no worries 13:06:14 <redrobot> We'll check in again next week 13:06:16 <redrobot> #action tosky to check if barbican/volume tests works if moved into cinder-tempest-plugin 13:06:41 <redrobot> #topic Liaison Updates 13:06:56 <redrobot> moguimar, any news from Oslo? 13:07:04 <moguimar> nope 13:08:17 <moguimar> we had a good meeting with plenty of topics, but none that I recall invoves castellan or barbican 13:08:55 <redrobot> moguimar, cool 13:09:06 <redrobot> tosky, any news from the testing side of things? 13:09:57 <tosky> not much (I guess it's linked to the point above) 13:10:14 <tosky> I rechecked the barbican grenade job but I'm still not sure about the reason of the failure 13:10:33 <redrobot> Gotcha 13:10:39 <redrobot> OK, moving on 13:10:51 <moguimar> iurygregory also checked the barbican grenate 13:10:53 <moguimar> grenade 13:11:04 <redrobot> #topic Grenade Gate 13:11:08 <moguimar> I guess you two could join forces 13:11:59 <iurygregory> the failure seems to be related to cinder (and since the grenade didn't test barbican before it's a bit tricky) XD 13:12:41 <iurygregory> I was looking at the cinder job with barbican to get an idea of the configuration and I'm trying to test locally =) 13:12:41 <tosky> right now the grenade job on master doesn't test barbican 13:12:56 <tosky> hence my patch to add barbican 13:12:56 <iurygregory> tosky, yep, it never tested XD 13:13:07 <tosky> but barbican fails at some point during the upgrade process 13:13:34 <tosky> this is the patch: https://review.opendev.org/#/c/724258/ 13:13:49 <iurygregory> it fails with Order creation attempt not allowed - please review your user/project privileges: oslo_policy.policy.PolicyNotAuthorized: orders:post is disallowed by policy 13:14:06 <iurygregory> this is while trying to create an encrypted volume 13:14:31 <iurygregory> so maybe is just a miss configuration on Cinder/Barbican 13:14:43 <redrobot> Oh, interesting... sounds like a mismatch in oslo.policy 13:15:02 <iurygregory> hummm 13:15:12 <iurygregory> this would be solved by configuration or nope? 13:15:20 <redrobot> i.e. cinder policy is allowing the operation, but barbican poicy is not 13:15:37 <tosky> here is the error: https://zuul.opendev.org/t/openstack/build/896eb6b045ce4b48880340b92007b413/log/controller/logs/screen-barbican-svc.txt#67 13:15:49 <redrobot> we'll have to check the role assignments for the user credentials that are being used 13:15:56 * redrobot makes a note to look into that patch 13:16:35 <tosky> the timestamp matches the failed operation (well, it's the only error, I'd be surprised if it wasn't the case): https://zuul.opendev.org/t/openstack/build/896eb6b045ce4b48880340b92007b413/log/controller/logs/grenade.sh_log.txt#1424 13:18:54 <tosky> maybe something changed between ussuri and master around policies? Because I think this error should be visible also with a normal devstack job 13:18:59 <tosky> but I don't know too much about that part 13:19:20 <redrobot> 🤔 13:19:36 <redrobot> I am not sure... but I'll try to look into it this week, and ping you if I find anything. 13:20:17 <iurygregory> probably we can run with a different tempest role 13:20:52 <tosky> iirc I tried two of them 13:21:01 <tosky> maybe I still missed the right one 13:21:28 <iurygregory> humm I will do some tests locally to see how it goes 13:24:25 <redrobot> another thing to check is to see whether we need barbican-specific roles to be added? 13:24:52 <redrobot> e.g. "creator" 13:24:59 <iurygregory> the config we have only creator 13:25:14 <iurygregory> on the cinder job I saw they set member, creator 13:25:20 <iurygregory> so maybe would need both? 13:26:16 <redrobot> I am not sure. I think I need to learn a little bit more about tempest to be helpful. 😞 13:26:44 <iurygregory> I will give a try locally with both options on the tempest.conf 13:27:10 * iurygregory was checking the cinder job and will check diffs from cinder/barbican.conf 13:27:26 <redrobot> awesome, thank you for the help iurygregory! 13:27:33 <iurygregory> np o/ 13:27:34 <redrobot> and tosky! :D 13:28:05 <redrobot> OK, moving on 13:28:09 <redrobot> #topic Kanban Review 13:28:34 <redrobot> #link https://tree.taiga.io/project/dmend-openstack-barbican/kanban 13:28:55 <redrobot> moguimar, any updates on the HVAC rewrite for Castellan 13:28:57 <redrobot> ? 13:28:59 <moguimar> yep 13:29:01 <moguimar> https://review.opendev.org/#/c/739698/ 13:29:13 <moguimar> got some good reviews from herve and stephen 13:29:21 <redrobot> Nice! 13:29:25 <moguimar> with this one in, the next one is hvac 13:29:29 <redrobot> I need to give it a good review as well. 13:29:51 <redrobot> very cool, moguimar! :D 13:30:10 <redrobot> I need to add a card on here to track the Secret Consumers progress. 13:31:38 <redrobot> OK, moving on ... 13:31:46 <redrobot> #topic Bug Review 13:32:05 <redrobot> First up Barbican Storyboards 13:32:08 <redrobot> #link https://storyboard.openstack.org/#!/project_group/barbican 13:32:18 <redrobot> Looks like we have not had any new bugs this week 13:32:20 <redrobot> so that's good 13:33:05 <moguimar> shouldn't openstack/ansible-role-atos-hsm and openstack/ansible-role-thales-hsm be listed too? 13:33:31 <redrobot> moguimar, great question ... I think we may not have created those projects in Storyboard 13:33:37 <redrobot> I can look into getting that added 13:33:54 <redrobot> #action redrobot to look into ansible-role-thales-hsm and ansible-role-atos-hsm bug projects 13:34:13 <redrobot> those two are still co-owned by the OpenStack Ansible team 13:34:27 <redrobot> and they're listed under that project in governance 13:34:42 <redrobot> and I'm not sure they're using Storyboard to track bugs on those 13:35:16 <redrobot> Next, the Castellan Launchpad 13:35:19 <redrobot> #link https://bugs.launchpad.net/castellan/ 13:35:43 <redrobot> Looks like no new bugs there either 13:35:47 <redrobot> OK, moving on 13:36:03 <redrobot> #topic Wayward Reviews 13:36:10 <redrobot> and this week we have a brand new link thanks to moguimar :D 13:36:25 <redrobot> #link https://tinyurl.com/ya2qgkw6 13:36:51 <moguimar> I'd like to focus on the stable branches first today 13:37:13 <moguimar> what about we tackle all S/T/U patches? 13:37:18 <redrobot> lots of -1s at the gate :( 13:37:22 <moguimar> yep 13:37:47 <moguimar> this one I got the gate fixed 13:37:49 <moguimar> https://review.opendev.org/#/c/738396/ 13:37:52 <moguimar> with tosky's help 13:38:20 <redrobot> m m m m merged! 13:38:21 <redrobot> :D 13:39:46 <moguimar> we have many of them failing docs 13:39:50 <openstackgerrit> Douglas Mendizábal proposed openstack/barbican stable/queens: Make broken fedora_latest job n-v https://review.opendev.org/695327 13:40:07 <moguimar> I'll backport the docs fix we had 13:40:14 <moguimar> and rebase them 13:40:16 <redrobot> ^^ rebased to see if gate is still passing on that one (last run was from December 2019 13:40:22 <redrobot> moguimar, awesome 13:40:53 <redrobot> I think maybe we should do them in LIFO order 13:41:07 <redrobot> eg. do U backports first, then T, then S 13:41:14 <moguimar> ok 13:41:35 <redrobot> Doesn't look like there's any we can merge right now 13:41:56 <moguimar> we have 2 patches by the release bot 13:42:01 <moguimar> and one by you redrobot 13:42:03 <moguimar> this one 13:42:05 <moguimar> Use Zuulv3 devstack jobs 13:42:40 <moguimar> but they are also failing devstack 13:42:51 <moguimar> not just docs 13:43:04 <redrobot> K, maybe we can tag team some of those this week 13:44:33 <redrobot> moguimar, here's one for master from the translation bot: https://review.opendev.org/#/c/735772/ 13:45:28 <moguimar> shipped 13:45:48 <redrobot> OK, let's move on 13:45:52 <redrobot> #topic Open Discussion 13:45:57 <redrobot> Anything else y'all want to talk about? 13:46:21 <moguimar> let me see the dashboard one last time 13:47:14 <moguimar> any tips on why this one is failing? 13:47:16 <moguimar> https://review.opendev.org/#/c/740698/ 13:49:11 <redrobot> moguimar, looks like a database integrity issue: https://zuul.opendev.org/t/openstack/build/b6dd7183a15c42f0a5fcc48e50d89c71/log/controller/logs/screen-barbican-svc.txt#202 13:49:20 <redrobot> which sounds super crappy 13:49:44 <redrobot> I'm not sure how you'd end up with duplicate rows during SecretOrder processing :( 13:50:50 <moguimar> is it some flakyness? 13:52:00 <redrobot> yeah, lets try a recheck and if it fails consistently with the same error we may need to dig into it some more 13:52:34 <moguimar> ok 13:53:12 <moguimar> cause I had a +1 from Zuul before 13:53:48 <moguimar> and then I got a -1 13:53:58 * redrobot shakes fist at Zuul 13:54:15 <moguimar> ok, I guess that' 13:54:18 <moguimar> s all 13:54:24 <redrobot> thanks moguimar 13:54:25 <moguimar> on my end 13:54:34 <redrobot> We're just about out of time too 13:54:44 * redrobot can't remember the last time that happened 13:54:53 <redrobot> Thanks for joining everyone! 13:55:01 <redrobot> #endmeeting