Tuesday, 2025-03-18

fricklerinfra-root: nb04 shouldn't have been affected by the new nb stuff, or should it? it did send a cron mail with "docker-compose: not found"07:56
fricklernb05 is also not completely happy: time="2025-03-18T09:19:02Z" level=warning msg="/etc/nodepool-builder-compose/docker-compose.yaml: `version` is obsolete"09:24
fricklerI still cannot see any indication of branch creation events having been missed at https://review.opendev.org/q/topic:%22create-2025.1%22+status:open . I wonder whether the issue we had was more about branch deletions. I guess we'll find out in a couple of weeks when we EOL 2023.2 ;)10:07
Ajayhi guys 12:13
Ajayis this channel active ?12:14
fricklerwell not as active as some people would expect it to be, seemingly ...12:33
opendevreviewJeremy Stanley proposed opendev/system-config master: Use explicit docker-compose path in cronjobs  https://review.opendev.org/c/opendev/system-config/+/94486713:21
fungifrickler: ^ that should address the cron email13:22
zigoI've been looking for hours on how to set vendor metadata to have VMs of our public cloud to use our Debian mirror rather than the cloudflare CDN, and I wonder if you guys know how ... (I know this is not a support channel here, just asking an advice as a friend... )13:26
opendevreviewKarolina Kula proposed opendev/glean master: WIP: Add support for CentOS 10 keyfiles  https://review.opendev.org/c/opendev/glean/+/94167213:27
fricklerzigo: I think usually you would just bake the mirror selection into custom images that you offer your customers. I don't know how you would achieve this with generic upstream images13:28
frickler(that's kind of what we do for our CI)13:28
zigofrickler: I'm quite sure it's possible to do that through the cloud-init APT plugin and vendor metadata.13:28
zigoI've found already what to put in the metadata.13:29
zigoI just didn't find out how to actually *SET* the vendor metadata ...13:29
zigoThe doc tells about a .json file, however, cloud-init takes a yaml as input.13:29
fungifwiw, we do just bake a preferred sources list into our own images13:30
fungibut obviously we're not using distro-supplied images13:31
fungibecause we want to include git repository caches and other things in ours to speed up jobs13:31
fricklerzigo: setting the vendordata is a deployer thing, which we are not. maybe amorin or mnaser know more. or people in the nova channel13:33
fungihttps://docs.cloud-init.io/en/latest/reference/yaml_examples/apt.html does talk about how to set it with yaml, e.g. with a userdata boot option13:33
zigoThanks guys.13:34
zigoI'll ask Arnaud or Mohamed.13:34
fungilooks like it talks about how amazon is setting it in ec2, could possibly reverse-engineer from an ec2 metadata dump13:34
amorinI dont think we provide any vendor data for this in our situation. And I don't think we change the image neither, so I believe it goes to the official debian cdn just like you zigo13:43
zigoOh ok.13:44
amorinIIRC the only thing we do is that we install qemu-guest-agent, and we put that inside the image with a manifest in /etc/cloud to let the customer know about this13:46
zigoWe found that qemu-guest-agent is too intrusive for linux, and decided to push it only in our Windows image since we build these, when we prefer to keep Linux images pristine. Maybe installing qemu-guest-agent at boot time with the vendor metadata would also be the way.13:48
jrosseri have some distant memory that ubuntu using nova.clouds.archive.ubuntu.com in its cloud images was a mechanism to somehow allow the operator to make that be a local mirror without messing with the image13:49
jrosserbut i cannot find any reference to that just now13:50
jrosseri have also some memory that the first part of that is the name of the openstack compute az13:51
Clark[m]fungi: frickler since docker-compose is going away (it's just a shim we add to pass to docker compose on noble) I don't think we need to worry about relying on PATH in the cron job. There isn't a future where docker-compose is a thing we will get from the distro.13:58
fungik13:59
Clark[m]Instead, we're more likely to switch to docker compose which isn't in /usr/local/bin and a non issue for cron paths13:59
mnaserzigo: https://bugs.launchpad.net/cloud-init/+bug/1837530 might give you some context. I believe you need a json with cloud-init key defined. And I think it needs to be set on all computes too if you want it to work with config drive14:23
opendevreviewKarolina Kula proposed opendev/glean master: WIP: Add support for CentOS 10 keyfiles  https://review.opendev.org/c/opendev/glean/+/94167214:23
clarkblooking at ubuntu noble images in nodepool I think nodepool did clean up the records for the old image even though it was owned by either nb01 or nb0214:34
clarkbas mentioend that won't clean things up on disk on those servers since the builder process isn't running but that is ok as we'll clean up nb01 and nb02 compeltely at some point in the near future14:35
clarkbzigo: it isn't clear if the problem is having VMs respect the vendor data or if you are having trouble configuring nova to set the vendor data in the first place. In case the problem is having nova provide the vendor data I think https://docs.openstack.org/nova/latest/admin/vendordata.html has some pointers14:39
JayFclarkb: fungi: https://www.youtube.com/watch?v=n32_afoiBJA your episode of GROSS-OUT just went live14:40
clarkbexciting14:41
fungithanks! it was fun, looking forward to doing it again14:47
opendevreviewClark Boylan proposed opendev/lodgeit master: Run lodgeit with granian instead of uwsgi  https://review.opendev.org/c/opendev/lodgeit/+/94480514:50
clarkboh I just discovered granian has a factory flag that should simplify all of this14:56
opendevreviewClark Boylan proposed opendev/lodgeit master: Run lodgeit with granian instead of uwsgi  https://review.opendev.org/c/opendev/lodgeit/+/94480515:01
opendevreviewBenjamin Schanzel proposed zuul/zuul-jobs master: mirror-container-images: use skopeo to mirror multiarch images  https://review.opendev.org/c/zuul/zuul-jobs/+/94487815:13
opendevreviewBenjamin Schanzel proposed zuul/zuul-jobs master: mirror-container-images: use skopeo to mirror multiarch images  https://review.opendev.org/c/zuul/zuul-jobs/+/94487815:22
opendevreviewClark Boylan proposed opendev/system-config master: Run lodgeit with granian  https://review.opendev.org/c/opendev/system-config/+/94480615:26
opendevreviewBenjamin Schanzel proposed zuul/zuul-jobs master: mirror-container-images: use skopeo to mirror multiarch images  https://review.opendev.org/c/zuul/zuul-jobs/+/94487815:37
opendevreviewBenjamin Schanzel proposed zuul/zuul-jobs master: mirror-container-images: use skopeo to mirror multiarch images  https://review.opendev.org/c/zuul/zuul-jobs/+/94487815:56
opendevreviewBenjamin Schanzel proposed zuul/zuul-jobs master: mirror-container-images: use skopeo to mirror multiarch images  https://review.opendev.org/c/zuul/zuul-jobs/+/94487816:03
hspeaseHi everyone! The OpenInfra Foundation would like to highlight OpenDev for the March newsletter.  I could use your help to develop the content for this. What I need from you all is 1-2 paragraphs for the newsletter blurb. If you would like to do something a bit longer form, we can do a full article that the newsletter links out to. I have put together an etherpad to start drafting in 17:02
hspeasehttps://etherpad.opendev.org/p/opendev_newsletter17:02
hspeaseThe newsletter will go out on March 31, so if we can finalize the draft in the etherpad by March 26 that would be wonderful!17:02
fungithanks hspease! it'll be fun to talk about some of the things we've been doing recently17:02
hspeaseYay!17:03
opendevreviewJeremy Stanley proposed opendev/system-config master: docs: Switch a mailing list to default moderation  https://review.opendev.org/c/opendev/system-config/+/94489317:08
fungiJayF: just a heads up, i've gone ahead and done that ^ on openstack-discuss due to the recent spate of spam subscribers since the weekend; we can see if it's manageable, or try other things too if needed17:12
fungii'm going to send a quick mail to the list about the change, though it should only impact us (the moderators) and any new subscribers17:13
JayFso basically new subs need their first post approved?17:13
fungidansmith: ^ related to earlier conversation in #openstack-tc17:13
dansmithfungi: ++17:14
fungiJayF: basically, yes. more like approve their first post and also switch the moderation setting for them, i don't think it can be done all at once in a single action, but will know more as we try it out17:14
*** dmellado0755393733 is now known as dmellado07553937317:14
dansmithfungi: it can17:15
fungioh, even better17:15
dansmithfungi: in the moderation thing if you click on the message itself, it will show you the text, and let you approve/reject and there's also a drop-down to "change this user's moderation flag to..."17:15
dansmithat least in my version of hyperkitty/postorious17:15
fungiperfect, i had overlooked that drop-down, but otherwise that's my basic workflow already17:16
fungiand we're on the latest versions, so presumably works like yours17:16
dansmithyeah, I wish I could constrain the box to only have a few options because there are things in there I would never want to do (like mark a user as "skips all other checks and allow immediately" etc17:16
dansmithbut it's better than a multi-step17:17
fungiyes, i included a comment about the "allow (skip other processing)" option in the above docs addition, since it seeems like a bit of a foot gun17:17
dansmithfo'shizzle17:17
opendevreviewJeremy Stanley proposed opendev/system-config master: docs: Switch a mailing list to default moderation  https://review.opendev.org/c/opendev/system-config/+/94489317:23
dansmithfungi: btw, are you as disappointed with mm3 as I am?17:24
funginot terribly. i like it better than sticking with mm2 anyway17:24
dansmithI nursed my mm2 along for way too long and was expecting/hoping to gain a lot of features in mm3 that were always lacking, yet it seems less feature-rich and more like a bag of parts17:25
tonybhspease: cool beans I'll take a stab too!17:25
dansmithsticking with mm2 isn't really an option AFAICT, but I was just super disappointed17:25
fungiyes, it does seem like the different components were designed by different groups of people17:25
fungiand i'm not a huge django fan17:25
dansmithyeah17:25
dansmithmine (the web side) also goes off the rails every once in a while and sends loadavg to 24 until I kill it17:26
fungiand too much of what i would think of as application admin functionality is still punted down a layer to django (though it's getting incrementally better)17:26
dansmithresource controls on docker and a healthcheck has automated that, but it's pretty stupid17:26
dansmithyeah, that's insanity.. "oh you want to admin something? here's the python api"17:26
dansmithlike, it's nice that it's there but... no knobs for some basic stuff is pretty crazy17:27
fungii don't even entirely mind the python repl like mailman client interactive shell, so much as having to do some things through django itself (for example, accounts are handled as django native constructs and only partly exposed by the mailman services)17:28
dansmithhyperkitty also doesn't (apparently) show web-posters that their message is moderated, so I get a lot of someone posting the same thing eight times overnight until they realize maybe it's something else, so I have to approve one and delete 7 each time17:28
fungigranted, i see people do th same thing when posting by e-mail, they miss or ignore the moderation hold notification and just send the same thing again, and again...17:29
dansmiththe repl shell just seems obscure and foot-gun-esque to me.. it has been okay, and I like that I can script it when I need, but it's not very "make a quick change from my phone while traveling" friendly17:29
clarkbits definitely obscure17:29
dansmithsure, it just seems way worse if the person is using the web forum view and it just never shows up at all17:29
clarkbthey don't even really show you how to invoke it iirc. Its just heres a thing17:29
fungiagreed, it does feel more like that's a backstop for features that haven't been added in the ui yet17:30
dansmithclarkb: yeah, it's pretty disappointing17:30
fungibut, again, mm2 was also that way to a great extent17:30
dansmithI keep thinking "surely there's some way to do this" or even "there must be a better example of how to do this"17:30
fungithere was the cli for some things, but anything complicated meant writing a python script (and dealing with pickle files)17:31
dansmithfungi: to some extent yes, but not as much and the CLI tools at least had better help IME17:31
fungiso it's more like that simply hasn't improved in mm317:31
dansmithwell, I never had to do those complicated things with mm2,17:31
dansmithbut I have in mm3 already which means it's a regression17:31
dansmithanyway, sounds like I'm not missing some major UI improvement that everyone else has, which is comforting at least :)17:32
clarkbfungi: I posted a question on your change17:33
fungidansmith: not really, though i've found the mailman-users mailing list extremely helpful, and the maintainers generally willing to add small improvements on request17:34
dansmithwell, that's good.. I usually just resort to swearing instead of productive, constructive activities like that :)17:44
fungithe next version is going to have some improvements i requested, like ways to not include the bodies of messages in moderator notifications and verp probes, because when people try to post spam or mailservers bounce back posts as suspected spam sending new copies just makes matters worse17:46
dansmithah yeah, I get that sometimes for sure, although I do a lot of moderation by seeing those posts send to me17:47
dansmithmaybe they should render the message to a PNG and email that :P17:47
dansmith(email that to the admin I mean)17:49
fungiright, it's a catch-22. knowing that there's a legitimate post waiting does sometimes prompt me to visit the moderator panel earlier than i otherwise would, but we have a lot of lists whose moderators are using e.g. gmail accounts and it ends up causing gmail to consider our list server a spam source when we're constantly sending them copies of the spam caught in moderation17:52
dansmithyeah17:55
dansmithI'm telling you.. render to PNG.. :)17:55
dansmithI guess maybe gmail would OCR them.. sounds like something they'd do17:55
opendevreviewJeremy Stanley proposed opendev/system-config master: docs: Switch a mailing list to default moderation  https://review.opendev.org/c/opendev/system-config/+/94489317:56
fungiclarkb: ^ amended the text to clarify based on your question17:57
fungisee if that helps17:57
clarkbfungi: yes thanks17:57
fungidansmith: could have a feature to encrypt the messages with e.g. openpgp or s/mime17:59
dansmithfungi: now you're talkin'18:02
clarkbfungi: I'm wondering if we shoudl go ahead and approve your doc update and the cronjob fix for nodepool builders18:02
opendevreviewSylvain Bauza proposed opendev/irc-meetings master: Add René as nova meeting chair  https://review.opendev.org/c/opendev/irc-meetings/+/94492418:03
fungiclarkb: i mean, they're my changes, so obviously i'm a fan of having them merged, no argument from me ;)18:04
fricklerdidn't we have a size limit on ML messages? https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org/message/HXDJYFT4HEXHNQQIKL4BP7KPDRZYZOFR/attachment/2/l3-agent.log-20250315 is almost 1M encoded18:05
opendevreviewKarolina Kula proposed opendev/glean master: WIP: Add support for CentOS 10 keyfiles  https://review.opendev.org/c/opendev/glean/+/94167218:05
fungifrickler: yes, that message was held in moderation, i approved it hesitantly rather than try to get the sender to shrink their attached log18:06
clarkbIf you look at the message headers I believe that mailman records when moderators approve things18:07
fungithough if they make a habit of it, i probably would18:07
fungiyes, there are special headers indicating it was held for moderation and approved18:07
fricklerah, yes, "X-Mailman-Rule-Hits: max-size" also18:08
fungicool, that's also useful to be able to see in there18:09
opendevreviewMerged opendev/irc-meetings master: Add René as nova meeting chair  https://review.opendev.org/c/opendev/irc-meetings/+/94492418:17
clarkbI think the new builders have built eveything but bookworm, centos-9-stream, gentoo, and openeuler. Gentoo and openeuler are not building anyway due to problems18:51
clarkbI'm going to manually trigger builds for bookworm and centos-9-stream so that we can get feedback on whether those work18:51
clarkband maybe that is a good indicator we should consider removing those images until interested parties can resurrect them?18:54
cardoeSo I'm trying to make heads or tails of the OpenStack Helm image building which is in the loci repo. It's using the buildset-registry (the only project to do so I think?) but then it seems to run its own registry again for creating a container of requirements wheels and pushing it there. Is the buildset-registry not shared between nodes?19:27
cardoeI'm also looking to change maybe to a mount=cache instead of having a container with wheels running nginx being necessary. Is mount=cache supported in container building on zuul?19:28
clarkbcardoe: the buildset registry is intended to be shared between all running builds within the buildset19:28
tonybcardoe: We (OpenDev sysadmins) use the buildset-registry in a lot of jobs.  You should trivially be able to share it between nodes in a given job/build19:30
tonybcardoe: I don't know about mount=cache or where you'd like to use it but a node deployed as part of a job should be able to run podman/docker with any args you like19:31
cardoegot an example somewhere? I just want something else to compare against19:32
clarkblook int system-config/zuul.d/system-config-run.yaml19:32
clarkbre mount=cache you may also want to look at system-config/docker/python-builder and system-config/docker/python-base19:32
cardoeopendev.org/opendev/system-config ?19:32
clarkbwe use multistage builds with a builder to produce all the wheels for a thing then those get copied to python-base based images and installed when actually installing the thing19:32
clarkbavoids having a bunch of extra dependencies and build artifacts laying around19:33
clarkbcardoe: yes19:33
cardoeYeah that's how I build mine.19:33
cardoeI'm just trying to negotiate upstreaming what I've got. 19:33
cardoeI've noticed that even vexxhost builds it themselves like https://github.com/vexxhost/atmosphere/blob/main/images/ironic/Dockerfile19:34
cardoeAll part of my crazy dream of uniting downstreams into upstream.19:35
opendevreviewClark Boylan proposed opendev/system-config master: Rebuild our base python container images  https://review.opendev.org/c/opendev/system-config/+/94478920:00
clarkbnow with the uwsgi pin20:01
clarkbcardoe: ^ that change is actually going to exercise a lot of what you are talking about20:06
cardoeperfect thank you20:06
clarkbcardoe: you'll notice there is a buildset registry job running. Then we'll build python-base and python-builder images and upload them to that registry. Then the uwsgi-base jobs will start and fetch the python-base image from the buildset registry as uwsgi-base is built on python-base20:06
clarkbwhen the jobs run in the gate they will also upload to docker hub. Then when the change merges jobs will run to promote those images by retagging them in docker hub to go from change specific tags to their production tag values20:07
clarkbcardoe: https://review.opendev.org/c/opendev/system-config/+/944806 and its depends on https://review.opendev.org/c/opendev/lodgeit/+/944805 may be a better example20:11
clarkbas that also shows using containers across buildsets using the intermediate registry20:11
clarkbcentos 9 stream and bookworm images have successfully built on the new builders20:13
clarkbI also approved the cronjob fix20:13
opendevreviewMerged opendev/system-config master: Use explicit docker-compose path in cronjobs  https://review.opendev.org/c/opendev/system-config/+/94486720:21
clarkbthat changes appears to have applied on nb05 at least20:39
clarkbthere is a gap in the weather. I'm going to pop out and get a bike ride in while I can20:39
clarkbI should be back well before gerrit meets20:39
fungihave fun!20:44
corvuscardoe: there's documentation (with pictures!) about what all the different registries and jobs and roles do here: https://docs.opendev.org/opendev/base-jobs/latest/docker-image.html21:00
corvuscardoe: technically, that's an implementation of the system described here: https://zuul-ci.org/docs/zuul-jobs/latest/docker-image.html  (this is a more general documentation; the other one is opendev-specific and should be preferred since it's more relevant)21:01
opendevreviewJames E. Blair proposed zuul/zuul-jobs master: Add upload-image-s3 role  https://review.opendev.org/c/zuul/zuul-jobs/+/94481322:28
clarkbhttps://zuul.opendev.org/t/openstack/build/f932b64a9e18445d8faebd1aae53f31c/log/job-output.txt#1933-1966 we are still failing the uwsgi build this time in amd64 too22:43
clarkboh maybe only amd64 the other build seems to be cancelled when this one fails22:43
clarkbhttps://github.com/unbit/uwsgi/issues/2630 I think this may be the issue22:46
clarkbthere is a 2.0.25.1 that apparently should address this22:47
clarkbI'm going to see about adding pcre support but that doesn't seem critical22:52
opendevreviewClark Boylan proposed opendev/system-config master: Rebuild our base python container images  https://review.opendev.org/c/opendev/system-config/+/94478922:57
clarkbsomething like that maybe22:57
clarkbnb06's cronjob will run at 00:01 I think23:10
clarkbthough I may be migrated to the couch to watch gerrit meets by then23:10
clarkbthe debian libpcre2 packages are weird23:28
opendevreviewClark Boylan proposed opendev/system-config master: Rebuild our base python container images  https://review.opendev.org/c/opendev/system-config/+/94478923:28
clarkbthey split out 8bit, 16 bit and 32 bit libraries23:28
clarkbfungi: is the openstack-discuss email about FIP mac addrs being incomplete something that went through the new moderation setup?23:37
clarkbit says rule miss: approved so not sure if that maens you have to approve it manually or not23:38
cardoeDoes that uWSGI include some of the latest commits?23:40
clarkbcardoe: no we are pinning to an older version because the latest versions don't build on aarch6423:41
clarkband it installs from the sdists on pypi. No special patching on our end23:41
clarkbhrm 2.0.25.1 segfaults. I can try 2.0.25 with the pcre libs in place and maybe that will work?23:52
clarkbstill wow23:52
cardoeI gotta find the patch but I linked it on the ML about OpenStack-helm. They aren’t gracefully stopping so it goes south on k8s.23:53
cardoeI’m just wanting to simplify how OpenStack services are containerized at the end of the day.23:54
clarkbin this case we're using uwsgi with paste/lodeit. And I've got chagnes up to switch that over to granian23:55
clarkbbut I want to get these new images  built first if I can then we can do the move away from uwsgi more carefully rather than rushing23:55
opendevreviewClark Boylan proposed opendev/system-config master: Rebuild our base python container images  https://review.opendev.org/c/opendev/system-config/+/94478923:57
clarkbif that doesn't work I'll try 2.0.2423:57
cardoeI don’t even know granian. I wanna move from uWSGI too.23:57
cardoeProjects are still moving to it which is surprising.23:57
clarkbgranian is a rust server that supports asgi, wsgi, and their own thing called rsgi23:58
clarkbI brought it up in #openstack-tc earlier and one of the concerns is it basically has one primary developer23:58
clarkband it isn't pacakged for distros23:58
clarkbbut the upside for me is they publish wheels for x86_64 and aarch64 so we don't have to build anything when pip installing23:58
clarkband it does both asgi and wsgi so in theory you don't need multiple tools as things become more async aware23:59

Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!