15:00:52 <noonedeadpunk> #startmeeting openstack_ansible_meeting
15:00:52 <opendevmeet> Meeting started Tue May  3 15:00:52 2022 UTC and is due to finish in 60 minutes.  The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:00:52 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
15:00:52 <opendevmeet> The meeting name has been set to 'openstack_ansible_meeting'
15:01:00 <noonedeadpunk> #topic rollcall
15:01:25 <mgariepy> hey !
15:01:31 <noonedeadpunk> o/
15:02:49 <ebbex> o/
15:05:25 <jrosser> o/ hello
15:05:49 <noonedeadpunk> #topic bug triage
15:06:23 <NeilHanlon> heyo o/
15:06:29 <noonedeadpunk> we have some new bug reports that we likely want to triage:)
15:08:08 <noonedeadpunk> #link https://bugs.launchpad.net/openstack-ansible/+bug/1971179
15:10:40 <noonedeadpunk> jrosser any thoughtson that? As I haven't looked into CSP at all...
15:12:09 <jrosser> well i'm not sure acutally
15:13:37 <jrosser> we set some cors overrides here
15:13:40 <jrosser> allow_headers: origin,content-md5,x-image-meta-checksum,x-storage-token,accept-encoding,x-auth-token,x-identity-status,x-roles,x-service-catalog,x-user-id,x-tenant-id,x-openstack-request-id
15:13:57 <jrosser> allowed_origin: "{{ external_horizon_fqdn }}"
15:15:05 <jrosser> it would help with some actual error there on LP to help
15:15:33 <NeilHanlon> ^ agree
15:16:02 <noonedeadpunk> +1 to that
15:16:46 <jrosser> https://github.com/openstack/openstack-ansible-os_glance/blob/1d8cb0dbd9472e4bbd82a61bb569626e5b89d205/defaults/main.yml#L190
15:17:01 <jrosser> this suggests that they configure the external vip to be an IP rather than FQDN
15:18:20 <NeilHanlon> i was able to replicate in my AIO
15:18:40 <NeilHanlon> https://paste.opendev.org/show/bXO5EAH3U9G3eEeffzsd/
15:18:46 <NeilHanlon> indeed external vip is an IP
15:19:44 <jrosser> and that was something like `openstack image create <blah> <blah>` ?
15:20:37 <NeilHanlon> No, uploading via horizon
15:20:42 <jrosser> oh yes right
15:20:57 <noonedeadpunk> yeah, well, than I'd say it's confirmed
15:22:05 <NeilHanlon> I'll put what I found in the LP
15:22:40 * jrosser wonders why it connects to the external VIP
15:23:30 <NeilHanlon> me too, i would've expected some horizon-layer proxy into glance, not a direct call to the api port
15:24:01 <mgariepy> are the endpoint in keystone set to the IP ?
15:24:44 <noonedeadpunk> Well, it depends on image upload mode
15:24:49 <noonedeadpunk> There's a direct and legacy one
15:25:08 <NeilHanlon> possibly. it looks like glance returns the upload_url to the client, and then that url is used to POST the image
15:25:37 <noonedeadpunk> https://opendev.org/openstack/openstack-ansible-os_horizon/src/branch/master/defaults/main.yml#L163-L168
15:26:04 <NeilHanlon> a-ha :)
15:27:46 <noonedeadpunk> let's go next
15:28:13 <noonedeadpunk> #link https://bugs.launchpad.net/openstack-ansible/+bug/1971175
15:28:39 <noonedeadpunk> It kind of sounds related
15:29:06 <noonedeadpunk> And at this point I'm not sure how previous one is valid
15:30:41 <noonedeadpunk> Maybe we should jsut suggest setting vip to domain and that's it...
15:31:13 <jrosser> yes - i'm not sure it will ever really work with the IP?
15:31:42 <jrosser> well......
15:32:12 <jrosser> i think what i mean is that in a real deployment (not AIO) we expect the external VIP to have a certificate with the fqdn in it
15:32:23 <jrosser> and the fqdn to be used as the external vip in openstack_user_config
15:33:15 <jrosser> tbh there is more info needed here on this bug too
15:33:21 <noonedeadpunk> yeah, we likely should just explain there
15:38:29 <jrosser> i left a quick comment there asking for more info
15:38:45 <noonedeadpunk> ok, great, thanks!
15:39:11 <noonedeadpunk> #link https://bugs.launchpad.net/openstack-ansible/+bug/1970226
15:39:30 <noonedeadpunk> andrewbonney: did you have a chance to test out the patch mentioned to oslo?
15:40:36 <jrosser> i'm not sure andrewbonney is around just now but we can certainly look at that patch
15:40:48 <noonedeadpunk> ok, gotcha
15:41:29 <noonedeadpunk> I will likely leave other things for next meeting as we likely need to have smth else to discuss
15:41:47 <noonedeadpunk> #topic office hours
15:43:24 <noonedeadpunk> I will push a patch today for EM of V
15:43:40 <jrosser> thanks to mgariepy for looking at a bunch of older patches last week
15:47:08 <jrosser> things are looking reasonable for ubuntu 22.04, for the basic AIO jobs
15:47:50 <jrosser> there are a couple of small constraints things in horizon and rally which i guess are becasue they've not been tested on py3.10 before
15:49:55 <mgariepy> so i started to fix/abandon old patches we have in gerrit last week.
15:49:56 <noonedeadpunk> ok, that's great. bad that it can't be more then exeprimantal though
15:50:10 <noonedeadpunk> but that's fair I believe
15:50:24 <jrosser> that sounds reasonably, it can be supported for Zed i think
15:50:41 <mgariepy> some patches are backport on older branches . how far should we try to fix them ?
15:51:05 <jrosser> regarding older branches there are these patches https://review.opendev.org/c/openstack/openstack-ansible/+/838022
15:51:22 <jrosser> those are passing suprisingly many jobs with just some wierd error in the linters job
15:51:56 <noonedeadpunk> uh
15:52:15 <noonedeadpunk> should be easy to fix though
15:52:38 <jrosser> oh yes it's that same sha for config_template which broke on other branches
15:53:16 <jrosser> i forget that config_template does not branch
15:56:36 <mgariepy> ho. on the rocky tests the ci does not have the passwd pkg installed.. which makes the hardening role fail.
15:57:03 <mgariepy> should we ask opendev to add the pkg or shall we install it ourself?
15:57:28 <mgariepy> for this one: https://review.opendev.org/c/openstack/ansible-hardening/+/835733
15:57:44 <opendevreview> Jonathan Rosser proposed openstack/openstack-ansible stable/train: Mark OSA repository as safe in git.config in CI  https://review.opendev.org/c/openstack/openstack-ansible/+/838022
15:59:09 <opendevreview> Jonathan Rosser proposed openstack/openstack-ansible stable/stein: Mark OSA repository as safe in git.config in CI  https://review.opendev.org/c/openstack/openstack-ansible/+/838023
16:00:43 <jrosser> mgariepy: we would put it here? https://github.com/openstack/openstack-ansible-openstack_hosts/blob/master/vars/redhat-8.yml#L53
16:01:59 <jrosser> NeilHanlon: any thoughts on that - if we should expect passwd to be present in the CI image?
16:03:03 <mgariepy> it is in the cloud image..
16:03:34 <NeilHanlon> yeah that's.. weird. I guess because we are making the image from a container base.
16:06:20 <NeilHanlon> I did a https://review.opendev.org/c/openstack/diskimage-builder/+/840352
16:06:52 <mgariepy> cool.
16:07:19 <NeilHanlon> i could patch os_hosts too if it'd help clear up the tests quickly
16:08:10 <noonedeadpunk> #endmeeting