15:02:05 <noonedeadpunk> #startmeeting openstack_ansible_meeting 15:02:06 <opendevmeet> Meeting started Tue Jun 1 15:02:05 2021 UTC and is due to finish in 60 minutes. The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot. 15:02:07 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 15:02:09 <opendevmeet> The meeting name has been set to 'openstack_ansible_meeting' 15:02:16 <noonedeadpunk> #topic rollcall 15:03:12 <noonedeadpunk> o/ 15:04:41 <jrosser> o/ hello 15:07:14 <noonedeadpunk> #topic office hours 15:07:32 <noonedeadpunk> Ok, so proably worth discussing irc change? 15:08:00 <noonedeadpunk> Patch to docs have merged, but I'm not sure about the best way to update all our members with that 15:08:18 <noonedeadpunk> considering we can't change topic now 15:08:38 <noonedeadpunk> And I actually didn't got TC recomendation about having volunteers :( 15:08:45 <jrosser> i forget to stay in the freenode channel, perhaps worth rejoining to herd people over to here 15:08:49 <noonedeadpunk> *didn't get 15:09:07 <noonedeadpunk> I'm keeping an eye on the channel 15:09:16 <noonedeadpunk> *old one 15:10:09 <noonedeadpunk> I wonder if it's worth to write independent ML as well 15:10:43 <noonedeadpunk> I guess no, as one has been sent with [all] tag... 15:11:40 <noonedeadpunk> and according to ppl number in channels, at least 50% have moved here 15:12:59 <noonedeadpunk> So probably we can just keeping an eye for some time and redirect using link to the https://docs.openstack.org/openstack-ansible/latest/contributor/contributing.html#irc-channel 15:13:54 <noonedeadpunk> oh, btw I did some cleanup of the projects wiki pages 15:14:05 <noonedeadpunk> and dropped all stuf from 2015 from there... 15:15:00 <noonedeadpunk> #idea we can continue keeping track of our etherpads on https://wiki.openstack.org/wiki/OpenStack-Ansible 15:15:22 <jrosser> oh yes that would be helpful 15:15:41 <noonedeadpunk> I put there only the last ones I could recall 15:17:39 <noonedeadpunk> #agreed to use project wiki page for keeping track on etherpads 15:18:44 <noonedeadpunk> ok, so another thing is bulsseye 15:18:54 <jrosser> should we go over what is outstanding in order to branch for W 15:18:56 <jrosser> oh yes 15:19:10 <noonedeadpunk> I got lxc working now 15:19:18 <jrosser> ahha, was it systemd? 15:19:36 <noonedeadpunk> yes and it also required extra cgroups permissins 15:19:38 <jrosser> there was related chatter in #lxc irc channel last night 15:19:40 <noonedeadpunk> *permissions 15:19:51 <noonedeadpunk> so I switched from ro to mixed 15:20:04 <jrosser> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=825394 15:20:06 <opendevmeet> Debian bug 825394 in systemd "systemd kill background processes after user logs out" [Normal,Fixed] 15:20:09 <noonedeadpunk> Well, systemd is "broken" since 2019 in this regard 15:20:16 <noonedeadpunk> *apparmor 15:20:19 <jrosser> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989317 15:20:19 <opendevmeet> Debian bug 989317 in systemd "systemd kill background processes after user logs out (#825394 regression)" [Normal,Open] 15:20:47 <noonedeadpunk> but we use unconfined profile anyway 15:21:03 <noonedeadpunk> no, that wasn't it 15:21:28 <jrosser> unconfined had to come in for buster 15:21:31 <noonedeadpunk> that was more apparmour and systemd-networkd in terms of trying to do weird mounts 15:21:57 <noonedeadpunk> yeah, but we set it explicitly for 10 only:) 15:22:09 <jrosser> aaaahhhh 15:22:46 <noonedeadpunk> and 11 was missing templates and this thing https://review.opendev.org/c/openstack/openstack-ansible-lxc_container_create/+/793896/1/tasks/lxc_container_config.yml 15:23:11 <noonedeadpunk> eventually that was the reason why containers were not starting at all 15:24:18 <noonedeadpunk> the only thing that stopps us is still linters. as eventually I missed some roles with automated patching 15:24:31 <noonedeadpunk> because they were using template with linters included 15:25:22 <jrosser> i need to revisit the pki role patch to the openstack-ansible repo 15:25:37 <jrosser> move things to group_vars and make some better docs 15:25:42 <opendevreview> Merged openstack/openstack-ansible-lxc_hosts master: Replace linters test with integarted one https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/793937 15:25:44 <noonedeadpunk> yeah, that's I guess close to last blocker for us 15:26:05 <noonedeadpunk> but docs we can do even after branching with follow-up 15:26:21 <noonedeadpunk> eventually, we can do even RC1 without branching 15:26:38 <noonedeadpunk> but it still better to be usable 15:27:20 <noonedeadpunk> oh, well! we also must merge our facts gathering issue 15:28:31 <noonedeadpunk> https://review.opendev.org/c/openstack/openstack-ansible/+/790042 15:28:59 <noonedeadpunk> ah, you just voted :) 15:31:22 <noonedeadpunk> and we need to also fix linters on V, as things are bad there as well 15:31:38 <noonedeadpunk> But I think we should just workaround there somehow 15:31:45 <noonedeadpunk> Will try to look into this as well 15:31:46 <jrosser> oh hmm i wonder if we have circular dependancies on the PKI stuff too 15:31:53 <jrosser> in order to merge the rabbitmq and haproxy changes 15:32:58 <noonedeadpunk> https://review.opendev.org/c/openstack/openstack-ansible/+/788031 looks like mergable? 15:33:09 <noonedeadpunk> We just need to drop WIP from topic 15:33:43 <jrosser> thats the one where user_variables_pki needs to go to group vars, but yes that can merge 15:33:46 <noonedeadpunk> ahhh 15:36:01 <opendevreview> Merged openstack/openstack-ansible-os_nova master: Don't rely on compute_hosts existance https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/793954 15:36:17 <noonedeadpunk> haproxy should probably depend on https://review.opendev.org/c/openstack/openstack-ansible/+/788031 15:36:55 <noonedeadpunk> and then they all should be able to merge hopefully? 15:37:27 <noonedeadpunk> btw, we have a fresh bug https://bugs.launchpad.net/openstack-ansible/+bug/1930276 15:37:29 <opendevmeet> Launchpad bug 1930276 in openstack-ansible "Nova API not restarted when nova policy is updated" [Undecided,New] - Assigned to Dmitriy Rabotyagov (noonedeadpunk) 15:37:33 <opendevreview> Jonathan Rosser proposed openstack/openstack-ansible-haproxy_server master: Use external PKI role to manage haproxy self-signed certificates https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/790078 15:37:54 <noonedeadpunk> I haven't triaged it yet, was jsut about to start reproducing it 15:38:11 <noonedeadpunk> I believe I saw how policies are applied on fly without service restart... 15:38:24 <jrosser> oh interesting 15:38:47 <noonedeadpunk> and I pushed all policy-to-yaml keeping that in mind... 15:39:07 <noonedeadpunk> so it might be potentially another blocker 15:39:35 <noonedeadpunk> not for RC1 but for branching maybe 15:40:04 <noonedeadpunk> My plan would be to do RC1 as soon as we land PKI 15:41:02 <opendevreview> Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Don't collect virtual facts https://review.opendev.org/c/openstack/openstack-ansible/+/789926 15:42:37 <jrosser> hmm looks complicated https://github.com/openstack/oslo.policy/blob/92eae81048b392f140e35e060e4c66195a08613e/oslo_policy/policy.py#L598 15:43:41 <noonedeadpunk> oh, so like if policy file was not present, it won't be loaded without restart? 15:47:00 <jrosser> well the whole force_reload thing makes me wonder too - theres a layer of caching 15:47:50 <noonedeadpunk> It can leverage inotify for example 15:48:06 <noonedeadpunk> but then indeed not existent file won't be checked 15:48:30 <noonedeadpunk> I wonder if jsut creating empty policy file is a good solution if that's how it works 15:48:39 <jrosser> https://github.com/openstack/oslo.policy/blob/master/oslo_policy/_cache_handler.py#L25 15:51:35 <jrosser> not totally sure i understand why a restart fixes it 15:52:09 <jrosser> well or rather why it's not picked up 15:52:32 <noonedeadpunk> ok, so looking at it it seems like the same behaviour for non existent file and caching? 15:53:18 <noonedeadpunk> I wonder actually what version it's about 15:54:03 <noonedeadpunk> but worth testing in aio anyway imo 15:54:16 <noonedeadpunk> As I can't fully understand code right now... 15:55:23 <noonedeadpunk> I mean read_cached_file returns True in both cases... 15:56:59 <jrosser> maybe also worth asking the oslo people what the expected behaviour is 15:57:40 <jrosser> seems like it maybe up to other projects to call Enforcer.load_rules when they see fit 15:58:30 <noonedeadpunk> yeah, might be... 16:01:43 <jrosser> well it's in the docs actually `Whenever an API call to an OpenStack service is made, the service’s policy engine uses the appropriate policy definitions to determine if the call can be accepted. Any changes to policy.yaml are effective immediately, which allows new policies to be implemented while the service is running.` 16:02:16 <jrosser> https://docs.openstack.org/oslo.policy/latest/admin/policy-yaml-file.html 16:03:42 <noonedeadpunk> But I still can imagine different thing happen in reality in case policy.yaml doesn't exist... But yes, I totally saw things happening like this... 16:04:08 <noonedeadpunk> *like written in the doc 16:04:12 <noonedeadpunk> #endmeeting