15:00:19 <noonedeadpunk> #startmeeting openstack_ansible_meeting
15:00:19 <opendevmeet> Meeting started Tue Aug 18 15:00:19 2026 UTC and is due to finish in 60 minutes.  The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:00:19 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
15:00:19 <opendevmeet> The meeting name has been set to 'openstack_ansible_meeting'
15:00:23 <noonedeadpunk> #topic rollcall
15:00:25 <noonedeadpunk> o/
15:00:33 <noonedeadpunk> it's been a while since last meeting:)
15:05:14 <noonedeadpunk> #topic CI status
15:05:27 <noonedeadpunk> Seems that CentOS Stream 10 jobs are passing now again
15:05:51 <noonedeadpunk> I'd assume that regression was in the image has been resolved and/or image has been rebuild
15:07:18 <noonedeadpunk> But there are bad news as well - Rocky 10 is failing now
15:08:15 <noonedeadpunk> I digged into Rocky 10, and the issue is not present in official images, as they were last updated on may 29
15:08:25 <noonedeadpunk> but it exists only in LXC containers
15:08:53 <noonedeadpunk> So basically Rocky team have issued new PQC GPG key, which gets installed with rpm install for the lxc image
15:10:07 <noonedeadpunk> ansible-core 2.21 does solve the issue, as rpm_key has been refactored there
15:10:47 <noonedeadpunk> and it's not backportable, as python requirement is too high for debian 12 we still had on 2027.1
15:11:59 <noonedeadpunk> So I also proposed a little bit weird workaround:
15:12:01 <noonedeadpunk> #link https://review.opendev.org/c/openstack/openstack-ansible-openstack_hosts/+/1001344
15:13:41 <noonedeadpunk> There is also alternative approach, which actually might be better idea to have... Potentially....
15:13:51 <noonedeadpunk> #link https://review.opendev.org/c/openstack/openstack-ansible-openstack_hosts/+/1001223
15:17:31 <jrosser> o/ hello
15:18:39 <noonedeadpunk> the problem with alternative approach is that we'd need to replace rpm_key in all occurances which is nasty thing to deal with
15:18:46 <noonedeadpunk> and horrible dependency cycle
15:19:01 <opendevreview> Dmitriy Rabotyagov proposed openstack/openstack-ansible-openstack_hosts master: Remove Rocky release PQC GPG key  https://review.opendev.org/c/openstack/openstack-ansible-openstack_hosts/+/1001344
15:19:11 <opendevreview> Dmitriy Rabotyagov proposed openstack/openstack-ansible-openstack_hosts master: Revert "Remove Rocky release PQC GPG key"  https://review.opendev.org/c/openstack/openstack-ansible-openstack_hosts/+/1001346
15:21:36 <jrosser> Just deleting the key is not so bad
15:21:50 <noonedeadpunk> unless they start signing everything with it....
15:22:03 <noonedeadpunk> and drop old one...
15:22:55 <noonedeadpunk> but with this issue gone - we should be able to issue rechecks.
15:23:08 <noonedeadpunk> and it's been a while since we were able to merge things
15:23:33 <noonedeadpunk> Eventually for master we may land https://review.opendev.org/c/openstack/openstack-ansible/+/1001337 first
15:24:09 <jrosser> hopefully there are not too many big changes
15:24:28 <noonedeadpunk> It's failing now on copr - it's unrelated as there was an outage
15:24:41 <noonedeadpunk> but this should unblock CI as well
15:24:56 <noonedeadpunk> #topic office hours
15:25:02 <noonedeadpunk> talking about big changes
15:25:34 <noonedeadpunk> I resumed working on PEP503 and updated my patch yesterday
15:25:36 <noonedeadpunk> #link https://review.opendev.org/c/openstack/ansible-role-python_venv_build/+/985531
15:26:14 <noonedeadpunk> which actually makes a change for envs with limited connectivity, as index-url is supplied explicitly
15:27:03 <noonedeadpunk> or well, even that
15:27:06 <noonedeadpunk> #link https://review.opendev.org/c/openstack/openstack-ansible-repo_server/+/1001179
15:27:28 <jrosser> when you say all expected packages should be present - that means build dependancies
15:28:02 <noonedeadpunk> oops, I need to update wording
15:28:11 <noonedeadpunk> I meant wheels obviously
15:28:15 <jrosser> oh i mean it as a question tbh
15:28:19 <noonedeadpunk> or python packages
15:28:24 <jrosser> like python deps or apt packages or whatever
15:28:52 <noonedeadpunk> yeah, so my thinking was that actual services, when wheels build is enabled, should be only consuming things from repo container
15:29:03 <noonedeadpunk> and they don't need an external index anyway
15:29:17 <noonedeadpunk> it's needed only when wheel build is disabled
15:29:24 <jrosser> what about non-built dependencies?
15:30:23 <noonedeadpunk> I think this is where https://review.opendev.org/c/openstack/openstack-ansible-repo_server/+/1001179 comes to play, and doing rewrite to the defined index in case of 404
15:31:20 <noonedeadpunk> and when weels are not built, I have that, but I am on the fence about it. I was not able to come up with decent enough solution not to break anybody with it....
15:31:29 <noonedeadpunk> #link https://review.opendev.org/c/openstack/openstack-ansible-openstack_hosts/+/1001222
15:32:05 <noonedeadpunk> As it's neat to have pip.conf managed obviously, but I know ppl already do have an internal ways of doing that...
15:32:26 <noonedeadpunk> But any other thing I was trying was conflicting on one way or another...
15:32:44 <jrosser> so long as the internal way can be replaced with something in OSA, it might be OK
15:33:00 <jrosser> but if stuff needs python packages before that, then it could be tricky
15:34:08 <noonedeadpunk> so we run only pki role before I think
15:34:18 <noonedeadpunk> which needs python stuff but only on deploy?
15:35:37 <noonedeadpunk> and deploy is not managed with openstack_hosts in general anyway...
15:38:40 <noonedeadpunk> I also made a change to repect infra pipy mirrors: https://review.opendev.org/c/openstack/openstack-ansible/+/1001231
15:39:18 <noonedeadpunk> but it doesn't prove any chicken-egg situation, as we don't firewall pypi index to be unreachable
15:39:28 <noonedeadpunk> maybe we can/should do that for the proxy job?
15:42:39 <noonedeadpunk> we also do have some tiny mass-changes to do actually
15:43:02 <noonedeadpunk> like changing direct format for python - we changed only for gnocchi but should be done for rest as well
15:43:53 <noonedeadpunk> and then I think we might be able to drop "admin" role from services, as well as clean-up service_token_roles_required
15:44:43 <noonedeadpunk> I think this option has been removed, as secure rbac considered as completed
15:50:19 <opendevreview> Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/2026.1: Fix ceph version for Ubuntu 24.04  https://review.opendev.org/c/openstack/openstack-ansible/+/1001112
15:53:05 <opendevreview> Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/2026.1: Fix ceph version for Ubuntu 24.04  https://review.opendev.org/c/openstack/openstack-ansible/+/1001112
15:54:43 <opendevreview> Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/2026.1: Fix ceph version for Ubuntu 24.04  https://review.opendev.org/c/openstack/openstack-ansible/+/1001112
15:55:32 <opendevreview> Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Switch ceph release to Umbrella  https://review.opendev.org/c/openstack/openstack-ansible/+/1001103
15:55:42 <noonedeadpunk> #endmeeting