| *** sdake has quit IRC | 00:00 | |
| odyssey4me | cloudnull unfortunately no git history - but that can't be helped I guess | 00:02 |
|---|---|---|
| odyssey4me | cool - thank you for doing that | 00:03 |
| odyssey4me | lemme get my vote it | 00:03 |
| odyssey4me | hopefully they can vote it through tomorrow | 00:03 |
| jmccrory | how does the initial commit get into those repos? could the history be extracted and pushed or is it only through gerrit? | 00:05 |
| odyssey4me | cloudnull ^ you'll have to explain, I'm out for the night | 00:06 |
| jmccrory | later, odyssey4me | 00:08 |
| *** cloudtra_ has quit IRC | 00:21 | |
| *** sdake has joined #openstack-ansible | 00:22 | |
| *** daneyon has quit IRC | 00:28 | |
| *** eil397 has joined #openstack-ansible | 00:32 | |
| *** sdake has quit IRC | 00:36 | |
| openstackgerrit | Michael Carden proposed openstack/openstack-ansible: Remove deprecated config variables https://review.openstack.org/281555 | 00:37 |
| *** izaakk has quit IRC | 00:37 | |
| *** izaakk has joined #openstack-ansible | 00:47 | |
| openstackgerrit | Merged openstack/openstack-ansible: Add Kilo to Liberty upgrade scaffold https://review.openstack.org/283823 | 00:49 |
| openstackgerrit | Merged openstack/openstack-ansible: Docs: Explanation of dynamic inventory https://review.openstack.org/284457 | 00:49 |
| *** eil397 has quit IRC | 00:57 | |
| *** keedya has quit IRC | 01:23 | |
| *** daneyon has joined #openstack-ansible | 01:28 | |
| *** daneyon_ has joined #openstack-ansible | 01:30 | |
| *** skamithi has joined #openstack-ansible | 01:31 | |
| *** daneyon has quit IRC | 01:33 | |
| *** retreved has joined #openstack-ansible | 01:35 | |
| *** keedya has joined #openstack-ansible | 01:55 | |
| *** keedya has quit IRC | 01:58 | |
| *** weezS has quit IRC | 02:18 | |
| *** fawadkhaliq has joined #openstack-ansible | 02:48 | |
| *** abitha has quit IRC | 02:49 | |
| *** izaakk has quit IRC | 02:57 | |
| openstackgerrit | Stanley Kamithi proposed openstack/openstack-ansible-specs: Virtual AIO Using Vagrant https://review.openstack.org/285090 | 03:20 |
| *** fawadkhaliq has quit IRC | 03:32 | |
| *** markvoelker has quit IRC | 03:51 | |
| *** daneyon_ has quit IRC | 03:54 | |
| *** brad[] has quit IRC | 04:17 | |
| *** appprod0 has joined #openstack-ansible | 04:18 | |
| appprod0 | is there any specific reason cinder is the only service that tries to verify the VIP/port? https://github.com/openstack/openstack-ansible/blob/11.2.9/playbooks/roles/os_cinder/tasks/cinder_backends.yml#L16-L22 | 04:23 |
| appprod0 | just curious, ran into this on an install where the VIP wasn't working for a few services, commended out os-cinder-install.yml and setup-openstack.yml completed, but the other services were still broken. it seems like cinder is the only one that actually checks the VIP during install | 04:25 |
| *** skamithi has left #openstack-ansible | 04:38 | |
| appprod0 | ah, would help if i read the second task. it uses cinder client | 04:39 |
| *** markvoelker has joined #openstack-ansible | 04:51 | |
| *** markvoelker has quit IRC | 04:56 | |
| *** fawadkhaliq has joined #openstack-ansible | 04:58 | |
| *** rgogunskiy has quit IRC | 05:10 | |
| *** severion has joined #openstack-ansible | 05:12 | |
| *** sdake has joined #openstack-ansible | 05:13 | |
| *** v1k0d3n has quit IRC | 05:14 | |
| *** cemmason has joined #openstack-ansible | 05:20 | |
| *** sdake has quit IRC | 05:23 | |
| *** asettle has joined #openstack-ansible | 05:37 | |
| *** asettle has quit IRC | 05:42 | |
| *** javeriak has joined #openstack-ansible | 06:17 | |
| *** javeriak has quit IRC | 06:18 | |
| *** javeriak has joined #openstack-ansible | 06:18 | |
| *** javeriak_ has joined #openstack-ansible | 06:21 | |
| *** javeriak has quit IRC | 06:23 | |
| *** rgogunskiy has joined #openstack-ansible | 06:30 | |
| *** markvoelker has joined #openstack-ansible | 06:53 | |
| *** markvoelker has quit IRC | 06:57 | |
| *** asettle has joined #openstack-ansible | 07:14 | |
| *** asettle has quit IRC | 07:19 | |
| *** javeriak_ has quit IRC | 07:27 | |
| *** swati_ has joined #openstack-ansible | 07:52 | |
| *** furlongm_ has joined #openstack-ansible | 07:52 | |
| *** furlongm has quit IRC | 07:52 | |
| *** zhangjn has quit IRC | 08:02 | |
| *** sdake has joined #openstack-ansible | 08:02 | |
| *** sdake has quit IRC | 08:04 | |
| *** admin0_ has joined #openstack-ansible | 08:06 | |
| *** zhangjn has joined #openstack-ansible | 08:07 | |
| *** admin0_ has quit IRC | 08:11 | |
| *** admin0_ has joined #openstack-ansible | 08:11 | |
| *** swati_ has quit IRC | 08:17 | |
| *** mikelk has joined #openstack-ansible | 08:22 | |
| *** jiteka has quit IRC | 08:27 | |
| *** jiteka has joined #openstack-ansible | 08:33 | |
| *** markvoelker has joined #openstack-ansible | 08:53 | |
| *** markvoelker has quit IRC | 08:57 | |
| *** asettle has joined #openstack-ansible | 08:59 | |
| odyssey4me | appprod0 it checks the service to validate that it's ready before moving on to the next action which is to interact with the service | 09:02 |
| *** asettle has quit IRC | 09:04 | |
| *** metral has quit IRC | 09:14 | |
| *** appprod0 has quit IRC | 09:14 | |
| *** metral_zzz has joined #openstack-ansible | 09:16 | |
| *** metral_zzz is now known as metral | 09:16 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Add support for the nova_api db https://review.openstack.org/274932 | 09:18 |
| *** appprod0 has joined #openstack-ansible | 09:19 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Use current, but pinned versions of pip, setuptools and wheel https://review.openstack.org/284977 | 09:22 |
| *** appprod0 has quit IRC | 09:23 | |
| mattt | odyssey4me: so what are we doing regarding caps? | 09:28 |
| mattt | are we pushing those reviews through to unblock gate? | 09:28 |
| *** appprod0 has joined #openstack-ansible | 09:28 | |
| odyssey4me | setuptools pulled the broken versions, so everything's working regardless | 09:28 |
| odyssey4me | but that doesn't help production - right | 09:29 |
| odyssey4me | so I've proposed https://review.openstack.org/284977 - what do you think? | 09:29 |
| *** electrofelix has joined #openstack-ansible | 09:30 | |
| odyssey4me | also, kevin has proposed https://review.openstack.org/#/q/status:open+topic:repeatable-build - your thoughts? | 09:30 |
| odyssey4me | unfortunately those two patches kevin's done are dependent and our gating can't do dependent patches between repositories just yet - I'm working on fixing that today | 09:31 |
| *** mgoddard_ has joined #openstack-ansible | 09:31 | |
| *** v1k0d3n has joined #openstack-ansible | 09:32 | |
| *** appprod0 has quit IRC | 09:33 | |
| *** severion has quit IRC | 09:35 | |
| *** mgoddard has quit IRC | 09:35 | |
| *** fawadkhaliq has quit IRC | 09:37 | |
| *** mattt has quit IRC | 09:37 | |
| *** appprod0 has joined #openstack-ansible | 09:37 | |
| *** mattt has joined #openstack-ansible | 09:38 | |
| odyssey4me | mattt ^ | 09:39 |
| *** asettle has joined #openstack-ansible | 09:40 | |
| *** appprod0 has quit IRC | 09:42 | |
| *** bsv___ has joined #openstack-ansible | 09:43 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Gate: Enable 'Depends-On' cross-repo dependent patching for roles https://review.openstack.org/285188 | 09:45 |
| *** appprod0 has joined #openstack-ansible | 09:47 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Added the pip packages for the repo-build process https://review.openstack.org/284896 | 09:47 |
| *** appprod0 has quit IRC | 09:51 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Gate: Enable 'Depends-On' cross-repo dependent patching for roles https://review.openstack.org/285188 | 09:51 |
| mattt | odyssey4me: did cloudnull do that in conjunction with your review? | 09:51 |
| mattt | because if not i'm not sure what that solves | 09:52 |
| *** asettle has quit IRC | 09:52 | |
| odyssey4me | mattt he did that after our discussion about the issue where the repo server isn't using the upper constraints | 09:52 |
| mattt | but pip, setuptools, and wheel aren't in upper constraints | 09:53 |
| mattt | so what does that give us | 09:53 |
| odyssey4me | so now what's happening is that the repo build process installs what it needs, but uses the upper constraints in the install process | 09:53 |
| *** asettle has joined #openstack-ansible | 09:53 | |
| odyssey4me | so that's where my patch comes in | 09:53 |
| odyssey4me | my patch aims to fix pip, wheel and setuptools at a specific version for each tag | 09:53 |
| mattt | my word | 09:53 |
| odyssey4me | whenever we bump the sha, we update the versions of those files | 09:53 |
| odyssey4me | this we we get to keep up to date, but we also ensure that we're always at the same version for any given tag - no surprises | 09:54 |
| odyssey4me | what was tested is what is delivered | 09:54 |
| odyssey4me | my patch isn't fully complete - changes need to also go into the pip install role, but I wanted to field the idea and see what everyone thought | 09:55 |
| mattt | odyssey4me: ok, i was just about to ask where the rest of it is | 09:55 |
| *** appprod0 has joined #openstack-ansible | 09:56 | |
| odyssey4me | mattt different repositories, so I need to work out how to make this a bit more automatic | 09:56 |
| mattt | there's def. no issue with pip upgrading itself between tags right? | 09:56 |
| odyssey4me | I was thinking that perhaps the pip install role should not have any restrictions, and a group var can be used to provide the restrictions | 09:56 |
| odyssey4me | mattt keeping up to date with pip versions is exactly what sigmavirus24_awa, pypa and infra have all recommended | 09:57 |
| odyssey4me | so yeah - as long as what was tested is what is delivered then we have a fully repeatable experience | 09:57 |
| mattt | k | 09:58 |
| mattt | no real major objection then | 09:58 |
| odyssey4me | before pip8 came out we used to do this all the time anyway :p | 09:58 |
| mattt | i think it would be easier to review if all changes can be put into a single review when this is ready tho | 09:58 |
| odyssey4me | yup, lemme WIP it and add the missing machinery | 09:58 |
| odyssey4me | thanks for the review thus far though | 09:58 |
| *** gparaskevas has joined #openstack-ansible | 09:59 | |
| *** asettle has quit IRC | 10:00 | |
| *** asettle has joined #openstack-ansible | 10:00 | |
| *** appprod0 has quit IRC | 10:00 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible-pip_install: Provide the option to specify a list of requirements when installing pip https://review.openstack.org/284701 | 10:05 |
| *** appprod0 has joined #openstack-ansible | 10:05 | |
| mattt | odyssey4me: in https://review.openstack.org/#/c/284977/, would you not need some validation to ensure what pypi returns is compatible with openstack requirements? | 10:05 |
| mattt | because with taht you could be installing stuff blacklisted by openstack | 10:06 |
| odyssey4me | mattt sure, that's fair - I can work something out - can you add a comment to the patch to remind me? | 10:07 |
| admin0_ | what ? you guys are still awake ? | 10:09 |
| odyssey4me | checking those pins against upper constraints would be a good idea | 10:09 |
| odyssey4me | admin0_ we just woke up :) we work from the uk | 10:09 |
| admin0_ | oh :D | 10:09 |
| admin0_ | ok | 10:09 |
| mattt | odyssey4me: yep sure | 10:09 |
| admin0_ | i thought from the US | 10:09 |
| admin0_ | ok | 10:09 |
| * admin0_ is in NL | 10:09 | |
| *** appprod0 has quit IRC | 10:09 | |
| odyssey4me | admin0_ there are quite a few US-based people in the community, but there are a few of us Europeans lurking | 10:10 |
| odyssey4me | so o/ over the channel to you :p | 10:10 |
| admin0_ | :) | 10:10 |
| mattt | admin0_: should have swung round for the openstack-ansible summit last week! | 10:11 |
| admin0_ | well, next time .. . i am waiting for my 5 year residence permit ..and then will apply for a UK visa | 10:11 |
| * admin0_ is originally from Nepal | 10:11 | |
| *** javeriak has joined #openstack-ansible | 10:12 | |
| admin0_ | i have relatives in reading,Uk .. plan to visit them soon .. | 10:12 |
| mattt | admin0_: hah, odyssey4me and i are both in reading | 10:12 |
| admin0_ | hmm | 10:13 |
| admin0_ | oh :D | 10:13 |
| admin0_ | nice | 10:13 |
| admin0_ | i plan to host a party ( for my anniversary ) .. might call you guys :D | 10:13 |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Gate: Enable 'Depends-On' cross-repo dependent patching for roles https://review.openstack.org/285188 | 10:14 |
| admin0_ | for us(nepalese) , we do not need to meet before to invite in parties :D | 10:14 |
| admin0_ | it can be a start of knowing as well :D | 10:14 |
| admin0_ | \o/ | 10:14 |
| *** appprod0 has joined #openstack-ansible | 10:14 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Gate: Enable 'Depends-On' cross-repo dependent patching for roles https://review.openstack.org/285188 | 10:14 |
| odyssey4me | lol, sounds like fun :) | 10:15 |
| * admin0_ adds odyssey4me and mattt to the invitigation checklist :D | 10:16 | |
| admin0_ | invitation* | 10:16 |
| odyssey4me | admin0_ have you made progress in doing the setup you wanted for one install using another's keystone? | 10:17 |
| admin0_ | not yet .. tonight is the plan to do that | 10:17 |
| *** appprod0 has quit IRC | 10:19 | |
| mattt | admin0_: there are a lot of nepalese in reading for some reason | 10:19 |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Gate: Enable 'Depends-On' cross-repo dependent patching for roles https://review.openstack.org/285188 | 10:19 |
| admin0_ | odyssey4me: i have https://www.openstackfaq.com/ and i had planned something else .. but now i have a change of mind .. .. i am going to re-format that site and do questions like … 1. how to install liberty using ansible, 2. how to installl liberty wtih another keystone , 3, how to install liberty with hosted database and rabbitmq , 4. how to install liberty as econd region | 10:20 |
| odyssey4me | admin0_ why not just do each of those as a blog post? | 10:21 |
| odyssey4me | admin0_ alternatively, why not submit them to our repository as documentation - perhaps an appendix per scenario? | 10:22 |
| *** appprod0 has joined #openstack-ansible | 10:23 | |
| admin0_ | i will do that | 10:23 |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Added the pip packages for the repo-build process https://review.openstack.org/284896 | 10:24 |
| admin0_ | how to install liberty while driving :D ( all using ansible ) | 10:25 |
| *** dalees has quit IRC | 10:25 | |
| *** appprod0 has quit IRC | 10:27 | |
| odyssey4me | admin0_ haha, great! | 10:28 |
| *** ScarZy has joined #openstack-ansible | 10:30 | |
| *** appprod0 has joined #openstack-ansible | 10:32 | |
| *** appprod0 has quit IRC | 10:37 | |
| *** dalees has joined #openstack-ansible | 10:38 | |
| *** admin0_ has quit IRC | 10:40 | |
| *** admin0 has joined #openstack-ansible | 10:40 | |
| *** appprod0 has joined #openstack-ansible | 10:42 | |
| *** appprod0 has quit IRC | 10:46 | |
| *** appprod0 has joined #openstack-ansible | 10:51 | |
| bsv___ | what is the difference between the eth0 and eth1 NIC's in figure 3.2 (http://docs.openstack.org/developer/openstack-ansible/liberty/install-guide/targethosts-networkexample.html) when speaking of functionality? | 10:52 |
| bsv___ | The guide is mixing up (or forgot to use the correct color in the diagram) two networks. | 10:53 |
| *** markvoelker has joined #openstack-ansible | 10:54 | |
| bsv___ | Does the service bind on eth1, and then leave eth0 for pure management? | 10:54 |
| bsv___ | eth1 is marked as "Management Network", but it seems to be more like a Service/API Network? | 10:55 |
| *** appprod0 has quit IRC | 10:55 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Gate: Enable 'Depends-On' cross-repo dependent patching for plugins https://review.openstack.org/285217 | 10:57 |
| *** markvoelker has quit IRC | 10:58 | |
| *** appprod0 has joined #openstack-ansible | 11:00 | |
| tiagogomes___ | Hmm, I can't use the metadata service inside a VM. The neutron metadata agent has "Unauthorized" in the log | 11:03 |
| *** appprod0 has quit IRC | 11:04 | |
| *** gparaskevas has quit IRC | 11:05 | |
| tiagogomes___ | argh, I restart it and now it works. Odd | 11:05 |
| *** appprod0 has joined #openstack-ansible | 11:09 | |
| *** spotz_zzz is now known as spotz | 11:11 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Add testing for dynamic_inventory.py https://review.openstack.org/242225 | 11:12 |
| *** appprod0 has quit IRC | 11:13 | |
| openstackgerrit | Matt Thompson proposed openstack/openstack-ansible: Add relnote for openstack_host_systat_ rename https://review.openstack.org/285237 | 11:18 |
| *** appprod0 has joined #openstack-ansible | 11:18 | |
| *** appprod0 has quit IRC | 11:23 | |
| Bofu2U | bgmccollum thanks for the tag and update on that, perfect. :) | 11:26 |
| Bofu2U | rolling my cassandra cluster today so it should make a big difference ha | 11:26 |
| *** appprod0 has joined #openstack-ansible | 11:27 | |
| *** appprod0 has quit IRC | 11:32 | |
| *** appprod0 has joined #openstack-ansible | 11:37 | |
| odyssey4me | mattt here's a fun one, and now I see how this all starts to unravel if we pin pip/setuptools/wheel - the latest virtualenv requires setuptools 20.0 and wheel 0.29.0 | 11:41 |
| *** appprod0 has quit IRC | 11:41 | |
| mattt | add another pin to the list :P | 11:42 |
| odyssey4me | turtles all the way down | 11:42 |
| odyssey4me | mattt would you mind giving https://review.openstack.org/285188 a review - it'll help move this all along | 11:43 |
| mattt | sure gimme a sec | 11:44 |
| *** appprod0 has joined #openstack-ansible | 11:46 | |
| *** appprod0 has quit IRC | 11:50 | |
| *** appprod0 has joined #openstack-ansible | 11:55 | |
| *** woopstar has joined #openstack-ansible | 11:56 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Use current, but pinned versions of pip, setuptools and wheel https://review.openstack.org/284977 | 11:57 |
| woopstar | Hi there. When running the os-cinder-install playbook, when it comes to task "Add apt pin preferences", the cinder_scheduler_container suddenly becomes unresponsive. I've looked at the container, at eth0 is DHCP as usual, eth1 is configured for the container network, but seems not brigded correctly suddenly. Cannot ping from physical host to the co | 11:58 |
| woopstar | ntainer ip. It's the only container that gives error. Rest it working perfectly | 11:58 |
| woopstar | Any ideas what to look for? | 11:59 |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Use current, but pinned versions of pip, setuptools and wheel https://review.openstack.org/284977 | 11:59 |
| *** appprod0 has quit IRC | 11:59 | |
| odyssey4me | woopstar it sounds to me like it has nothing to do with that task, but instead something to do with something else happening in the background | 12:01 |
| odyssey4me | is the container online? | 12:01 |
| woopstar | The lxc.network.veth.pair is set in the config file for the container. And the value (interface) exists | 12:01 |
| woopstar | yeah, container is online and i can attach to it | 12:02 |
| *** asettle has quit IRC | 12:02 | |
| woopstar | but the eth1 network (container network) is not working. Only eth0 (lxc 10.0.3.0/24 network) works | 12:02 |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Use current, but pinned versions of pip, setuptools and wheel https://review.openstack.org/284977 | 12:02 |
| odyssey4me | mattt how does ^ look to you? I think that's about it - mancdaz thanks for the previous review - if you could take a peek again at what I think is a final version that'd be awesome | 12:03 |
| odyssey4me | woopstar so it seems to me that you have something to look into - I'm afriad I'm not able to help with that - I really suck at networking :/ | 12:04 |
| *** appprod0 has joined #openstack-ansible | 12:04 | |
| *** hlkv6 has joined #openstack-ansible | 12:04 | |
| hlkv6 | hello | 12:04 |
| woopstar | :( Odd thing is. Other container on the server is working perfectly. The api container | 12:04 |
| woopstar | it has a equally eth1 network, and that ip is working as it should | 12:05 |
| woopstar | and the container not working does have the interface and does have an ip :( But it cannot connect from the physical host to it | 12:06 |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Use current, but pinned versions of pip, setuptools and wheel https://review.openstack.org/284977 | 12:07 |
| odyssey4me | ^ updated commit msg mattt mancdaz | 12:07 |
| odyssey4me | hlkv6 hi there! | 12:07 |
| *** appprod0 has quit IRC | 12:08 | |
| *** ccesario has quit IRC | 12:12 | |
| *** krotscheck_dcm is now known as krotscheck | 12:13 | |
| *** appprod0 has joined #openstack-ansible | 12:13 | |
| mattt | odyssey4me: wondering if we're going to hit any bumps with https://review.openstack.org/#/c/285188/ | 12:15 |
| odyssey4me | mattt what sort of bumps are you thinking of? | 12:16 |
| mattt | well by dumping a role into the root of the project's dir | 12:16 |
| mattt | and then including that in ANSIBLE_ROLES_PATH | 12:16 |
| odyssey4me | it doesn't go into the root - it goes into the parent | 12:16 |
| mattt | ah ok, that's better | 12:17 |
| odyssey4me | hmm, did I get the level wrong? | 12:17 |
| odyssey4me | so basically you have 'workspace/<location of all clones>' | 12:17 |
| *** appprod0 has quit IRC | 12:18 | |
| odyssey4me | so openstack ansible is in the path 'workspace/openstack-ansible' and any depending clone goes into 'workspace/myawesomerole' | 12:18 |
| mattt | odyssey4me: i think your path is wrong then | 12:18 |
| mattt | which is why i was confused | 12:18 |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Gate: Enable 'Depends-On' cross-repo dependent patching for roles https://review.openstack.org/285188 | 12:21 |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Gate: Enable 'Depends-On' cross-repo dependent patching for plugins https://review.openstack.org/285217 | 12:21 |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Gate: Enable 'Depends-On' cross-repo dependent patching for plugins https://review.openstack.org/285217 | 12:22 |
| *** appprod0 has joined #openstack-ansible | 12:22 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Use current, but pinned versions of pip, setuptools and wheel https://review.openstack.org/284977 | 12:23 |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Added the pip packages for the repo-build process https://review.openstack.org/284896 | 12:23 |
| *** asettle has joined #openstack-ansible | 12:24 | |
| odyssey4me | mattt are you happy with https://review.openstack.org/284701 though? it's the fundamental base patch to activate all this | 12:24 |
| mattt | i have no idea, i've not looked yet :) | 12:24 |
| *** ccesario has joined #openstack-ansible | 12:25 | |
| *** appprod0 has quit IRC | 12:27 | |
| mattt | i'll look once i am done with hter other 2 you just asked me to look at :) | 12:27 |
| * mattt operates at normal human speeds | 12:28 | |
| odyssey4me | :) | 12:28 |
| mattt | i just wnat to make sure this depends-on change actually does what we expect | 12:28 |
| mattt | i think you'd find out pretty quickly if it doesn't | 12:28 |
| mattt | but let's just square it away now | 12:29 |
| odyssey4me | yeah, that's why I'm gating the others on top of that - to verify it | 12:29 |
| *** sdake has joined #openstack-ansible | 12:29 | |
| mattt | ah ok | 12:29 |
| *** appprod0 has joined #openstack-ansible | 12:32 | |
| mattt | odyssey4me: https://review.openstack.org/#/c/284701 could use a test | 12:35 |
| mattt | odyssey4me: or rather, i think this functionality should be tested | 12:35 |
| mattt | odyssey4me: i suppose functionality isn't changing and the test can go in a separate review | 12:35 |
| mattt | odyssey4me: i'll put the test through on top of https://review.openstack.org/#/c/284701 | 12:36 |
| *** appprod0 has quit IRC | 12:36 | |
| *** markvoelker has joined #openstack-ansible | 12:40 | |
| Bofu2U | morn | 12:40 |
| *** appprod0 has joined #openstack-ansible | 12:41 | |
| *** woopstar has quit IRC | 12:43 | |
| odyssey4me | mattt good plan | 12:43 |
| odyssey4me | o/ Bofu2U how goes it? | 12:44 |
| Bofu2U | not too shabby | 12:44 |
| Bofu2U | about to start really pushing it today | 12:44 |
| Bofu2U | so, fingers crossed lol | 12:44 |
| Bofu2U | that and trying to renegotiate a colo deal for a cage. | 12:44 |
| *** markvoelker has quit IRC | 12:44 | |
| Bofu2U | #serverlyfe | 12:44 |
| Bofu2U | how about you, odyssey4me ? | 12:45 |
| *** bsv___ has quit IRC | 12:45 | |
| *** appprod0 has quit IRC | 12:45 | |
| odyssey4me | mattt I'll figure out a patch on top of https://review.openstack.org/284977 which verifies that we aren't implementing any versions that are blocked in global-requirements - I think it's more important to get this done right now, I can verify that manually for now. | 12:45 |
| *** MCoLo has quit IRC | 12:48 | |
| *** appprod0 has joined #openstack-ansible | 12:50 | |
| *** appprod0 has quit IRC | 12:54 | |
| *** appprod0 has joined #openstack-ansible | 12:59 | |
| openstackgerrit | Matt Thompson proposed openstack/openstack-ansible-pip_install: Test version of pip being installed https://review.openstack.org/285284 | 13:02 |
| mattt | odyssey4me: circling back | 13:02 |
| odyssey4me | mattt so I see in the gate test that the pip install isn't upgrading pip to the expected version, as it's already installed | 13:02 |
| odyssey4me | I also see that the depends-on patch isn't having the desired effect | 13:03 |
| *** appprod0 has quit IRC | 13:04 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Use current, but pinned versions of pip, setuptools and wheel https://review.openstack.org/284977 | 13:04 |
| *** cemmason has quit IRC | 13:05 | |
| *** cemmason has joined #openstack-ansible | 13:06 | |
| odyssey4me | mattt so I've made the update to ensure that pip does the upgrade | 13:07 |
| odyssey4me | but I'm thinking that perhaps the depends-on needs to be more like - if there happens to be another folder in the workspace root, remove any folder by the same name (minus the 'openstack-ansible-' prefix) in /etc/ansible/roles/ and move the folder from the workspace there | 13:08 |
| odyssey4me | it's a bit clunky :/ | 13:08 |
| *** appprod0 has joined #openstack-ansible | 13:08 | |
| odyssey4me | heh, I just realised why it's not working | 13:10 |
| odyssey4me | the role name is different to the repo name - so I need to make sure that the folder is appropriately renamed | 13:10 |
| mattt | ah yeah | 13:11 |
| mhayden | mornin' | 13:11 |
| *** appprod0 has quit IRC | 13:13 | |
| *** MCoLo has joined #openstack-ansible | 13:15 | |
| mattt | odyssey4me: is gating broken at the minute? no right | 13:17 |
| mattt | if so is there a mad rush to get these patches in? | 13:17 |
| odyssey4me | mattt nope, but we do need to do a release for kilo and liberty and I'm not feeling good about releasing another tag until we sort this out | 13:17 |
| *** appprod0 has joined #openstack-ansible | 13:17 | |
| odyssey4me | that said, I suppose we could do it regardless as things are working | 13:18 |
| odyssey4me | this isn't a blocker right now I suppose | 13:18 |
| odyssey4me | it just means that the tags now and before will never be consistent deployments | 13:19 |
| *** markvoelker has joined #openstack-ansible | 13:20 | |
| *** appprod0 has quit IRC | 13:22 | |
| *** retreved has joined #openstack-ansible | 13:22 | |
| *** ric has joined #openstack-ansible | 13:23 | |
| *** spotz is now known as spotz_zzz | 13:25 | |
| *** brad[] has joined #openstack-ansible | 13:25 | |
| *** appprod0 has joined #openstack-ansible | 13:27 | |
| mattt | odyssey4me: yeah, i just think rather than rushing through a solution we should get it right | 13:27 |
| odyssey4me | yep | 13:28 |
| *** cemmason1 has joined #openstack-ansible | 13:30 | |
| *** appprod0 has quit IRC | 13:31 | |
| *** cemmason has quit IRC | 13:31 | |
| *** fawadkhaliq has joined #openstack-ansible | 13:36 | |
| *** appprod0 has joined #openstack-ansible | 13:36 | |
| *** appprod0 has quit IRC | 13:40 | |
| *** woodard has joined #openstack-ansible | 13:41 | |
| *** automagically_ is now known as automagically | 13:41 | |
| *** woodard has quit IRC | 13:42 | |
| *** woodard has joined #openstack-ansible | 13:43 | |
| openstackgerrit | Merged openstack/openstack-ansible: Doc: Minor grammar and typo fixes https://review.openstack.org/281589 | 13:44 |
| *** javeriak has quit IRC | 13:44 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Gate: Enable 'Depends-On' cross-repo dependent patching for roles https://review.openstack.org/285188 | 13:44 |
| *** appprod0 has joined #openstack-ansible | 13:45 | |
| *** ric has quit IRC | 13:47 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Gate: Enable 'Depends-On' cross-repo dependent patching for roles https://review.openstack.org/285188 | 13:48 |
| *** appprod0 has quit IRC | 13:49 | |
| *** rgogunskiy has quit IRC | 13:50 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Added the pip packages for the repo-build process https://review.openstack.org/284896 | 13:52 |
| odyssey4me | mattt how annoying - as it turns out it doesn't get cloned there - now I need to figure out where it does get cloned | 13:54 |
| *** appprod0 has joined #openstack-ansible | 13:54 | |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: [WIP] Gate: Enable 'Depends-On' cross-repo dependent patching for roles https://review.openstack.org/285188 | 13:56 |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Added the pip packages for the repo-build process https://review.openstack.org/284896 | 13:57 |
| *** appprod0 has quit IRC | 13:58 | |
| *** johnmilton has joined #openstack-ansible | 14:00 | |
| *** skamithi13 has joined #openstack-ansible | 14:00 | |
| *** appprod0 has joined #openstack-ansible | 14:03 | |
| *** appprod0 has quit IRC | 14:08 | |
| *** zhangjn has quit IRC | 14:08 | |
| *** skamithi has joined #openstack-ansible | 14:08 | |
| *** zhangjn has joined #openstack-ansible | 14:09 | |
| *** Bjoern_ has joined #openstack-ansible | 14:11 | |
| *** Bjoern_ is now known as Bjoern_zZzZzZzZ | 14:11 | |
| *** Bjoern_zZzZzZzZ is now known as Bjoern_ | 14:12 | |
| *** appprod0 has joined #openstack-ansible | 14:12 | |
| *** appprod0 has quit IRC | 14:17 | |
| *** karimb has joined #openstack-ansible | 14:17 | |
| *** karimb has quit IRC | 14:17 | |
| *** jaypipes is now known as sicklypipes | 14:22 | |
| *** appprod0 has joined #openstack-ansible | 14:22 | |
| mhayden | don't post emoji to gerrit -- you'll get a 500 | 14:22 |
| automagically | I always knew Gerrit was no fun | 14:24 |
| *** appprod0 has quit IRC | 14:26 | |
| *** Mudpuppy has joined #openstack-ansible | 14:31 | |
| *** appprod0 has joined #openstack-ansible | 14:31 | |
| *** appprod0 has quit IRC | 14:35 | |
| *** sdake has quit IRC | 14:35 | |
| mattt | odyssey4me: i'm killing this one: https://review.openstack.org/#/c/283657/ | 14:37 |
| *** keedya has joined #openstack-ansible | 14:38 | |
| *** appprod0 has joined #openstack-ansible | 14:40 | |
| *** kencjohnston has joined #openstack-ansible | 14:41 | |
| *** appprod0 has quit IRC | 14:44 | |
| *** KLevenstein has joined #openstack-ansible | 14:47 | |
| *** appprod0 has joined #openstack-ansible | 14:49 | |
| openstackgerrit | Matt Thompson proposed openstack/openstack-ansible: Ansible galaxy issues workaround https://review.openstack.org/280822 | 14:53 |
| *** appprod0 has quit IRC | 14:54 | |
| *** fawadkhaliq has quit IRC | 14:55 | |
| *** appprod0 has joined #openstack-ansible | 14:58 | |
| *** appprod0 has quit IRC | 15:03 | |
| openstackgerrit | Merged openstack/openstack-ansible-pip_install: Provide the option to specify a list of requirements when installing pip https://review.openstack.org/284701 | 15:05 |
| *** sdake has joined #openstack-ansible | 15:05 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:07 | |
| *** appprod0 has joined #openstack-ansible | 15:08 | |
| *** cemmason1 has quit IRC | 15:08 | |
| *** appprod0 has quit IRC | 15:12 | |
| *** ShannonM has joined #openstack-ansible | 15:12 | |
| *** galstrom_zzz is now known as galstrom | 15:15 | |
| *** asettle has quit IRC | 15:16 | |
| *** appprod0 has joined #openstack-ansible | 15:17 | |
| *** joseg has joined #openstack-ansible | 15:17 | |
| *** woodard has quit IRC | 15:21 | |
| *** appprod0 has quit IRC | 15:21 | |
| openstackgerrit | Matt Thompson proposed openstack/openstack-ansible: Cosmetic PLUMgrid doc updates https://review.openstack.org/285355 | 15:23 |
| *** appprod0 has joined #openstack-ansible | 15:26 | |
| lbragstad | cloudnull quick question on https://github.com/os-cloud/openstack-ansible-os_keystone/blob/master/tasks/main.yml#L62-L64 | 15:27 |
| lbragstad | cloudnull I am setting `keystone_service_setup` to false yet I still have the keystone_multi_ldap.yaml plays run? | 15:28 |
| odyssey4me | mhayden if your emoji is an ascii emoji, does it blend? | 15:30 |
| *** appprod0 has quit IRC | 15:30 | |
| odyssey4me | mattt good call | 15:31 |
| cloudnull | morning | 15:31 |
| *** raddaoui has joined #openstack-ansible | 15:31 | |
| cloudnull | lbragstad: are they running, or skipped? | 15:31 |
| odyssey4me | lbragstad does it run, or does it skip? | 15:32 |
| odyssey4me | haha, that's what I get for processing in serial :p | 15:32 |
| odyssey4me | o/ cloudnull | 15:33 |
| lbragstad | odyssey4me cloudnull \o/ | 15:33 |
| cloudnull | hows it ? | 15:33 |
| lbragstad | after running that play - I do see the domains directory in /etc/keystone | 15:33 |
| *** asettle has joined #openstack-ansible | 15:34 | |
| cloudnull | lbragstad: https://github.com/os-cloud/openstack-ansible-os_keystone/blob/master/tasks/keystone_pre_install.yml#L62-L80 | 15:34 |
| cloudnull | the dirs are created in an earlier set of tasks | 15:35 |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Use current, but pinned versions of pip, setuptools and wheel https://review.openstack.org/284977 | 15:35 |
| *** appprod0 has joined #openstack-ansible | 15:35 | |
| odyssey4me | cloudnull ^ how do you like that option for pinning pip/setuptools/wheel, but still also keeping up to date? | 15:35 |
| odyssey4me | automagically jmccrory when you're online, please also peek at it | 15:35 |
| * cloudnull looking | 15:36 | |
| * automagically looking | 15:36 | |
| cloudnull | +2 LGTM | 15:37 |
| openstackgerrit | Jesse Pretorius (odyssey4me) proposed openstack/openstack-ansible: Added the pip packages for the repo-build process https://review.openstack.org/284896 | 15:37 |
| cloudnull | w/ the change in pip install to allow for package pass through | 15:37 |
| lbragstad | cloudnull ah - ok | 15:37 |
| cloudnull | this should work well | 15:37 |
| odyssey4me | yeah, I think this is really good - the role for pip_install is generic and the specifics are in the orchestration, as it should be | 15:38 |
| lbragstad | cc dolphm ^ | 15:38 |
| odyssey4me | the only thing missing now is a validation that the versions we're set to use are not versions that are currently blocked in global-requirements... I'll manually check for that on SHA bumps for now and implement a check at a later time | 15:39 |
| *** appprod0 has quit IRC | 15:40 | |
| odyssey4me | cloudnull I think that https://review.openstack.org/284896 might need the up to date pip/setuptools/wheel in order to work properly - virtualenv is spitting errors out during the venv builds | 15:40 |
| openstackgerrit | Kevin Carter proposed openstack/openstack-ansible: Added the pip packages for the repo-build process https://review.openstack.org/284896 | 15:41 |
| *** neilus has quit IRC | 15:41 | |
| cloudnull | I just updated per mattt suggestion to have it use a separate task file. | 15:42 |
| *** spotz_zzz is now known as spotz | 15:42 | |
| cloudnull | odyssey4me: w/ the dependent patches it should work. are the errors coming from setuptools ? | 15:43 |
| odyssey4me | cloudnull http://logs.openstack.org/96/284896/6/check/gate-openstack-ansible-dsvm-commit/ee2b248/console.html#_2016-02-26_14_41_50_565 | 15:44 |
| *** appprod0 has joined #openstack-ansible | 15:44 | |
| openstackgerrit | Kevin Carter proposed openstack/openstack-ansible: Added the pip packages for the repo-build process https://review.openstack.org/284896 | 15:45 |
| cloudnull | maybe the --no-download option was removed ? | 15:46 |
| cloudnull | i made the repo-build patch depend on your pip updaterator patch | 15:47 |
| cloudnull | so maybe that'll help | 15:47 |
| *** sdake has quit IRC | 15:47 | |
| cloudnull | version 14.0.6 seems to have it | 15:48 |
| *** appprod0 has quit IRC | 15:49 | |
| cloudnull | it seems 13.1.2, which was being used in that run, does not | 15:49 |
| odyssey4me | hmm, why was that version being used - that's odd | 15:50 |
| odyssey4me | upper-constraints has the current version, as I recall | 15:50 |
| cloudnull | and our current master os-u-c file https://github.com/openstack/requirements/blob/332278d456e06870150835564342570ec9d5f5a0/upper-constraints.txt | 15:51 |
| cloudnull | is constraining it https://github.com/openstack/requirements/blob/332278d456e06870150835564342570ec9d5f5a0/upper-constraints.txt#L356 | 15:51 |
| cloudnull | head of master has the updates we'd need https://github.com/openstack/requirements/blob/master/upper-constraints.txt#L369 | 15:52 |
| palendae | bgmccollum: RE: the convo last night about global_overrides being merged - I *think* it'll be merged based on how we have the environment defined, with https://github.com/openstack/openstack-ansible/blob/master/etc/openstack_deploy/openstack_environment.yml being basically empty and the env.d files populating it | 15:53 |
| cloudnull | if i change the option to never-download instead of no-download itll be compatible with both versions. | 15:53 |
| *** appprod0 has joined #openstack-ansible | 15:53 | |
| *** cloudtrainme has joined #openstack-ansible | 15:54 | |
| openstackgerrit | Kevin Carter proposed openstack/openstack-ansible: Added the pip packages for the repo-build process https://review.openstack.org/284896 | 15:54 |
| *** woodard has joined #openstack-ansible | 15:55 | |
| cloudnull | odyssey4me: ^ thatll do i t | 15:55 |
| *** asettle has quit IRC | 15:56 | |
| *** izaakk has joined #openstack-ansible | 15:57 | |
| odyssey4me | haha, of course - that makes sense | 15:57 |
| mattt | thanks cloudnull | 15:57 |
| *** appprod0 has quit IRC | 15:58 | |
| cloudnull | thanks for reviewing it mattt :) | 15:58 |
| palendae | Will anyone else have a chance to test https://review.openstack.org/#/c/272652/ today? I gave it a shot a few weeks ago and it appeared to work, but more eyes doesn't hurt | 15:59 |
| *** asettle has joined #openstack-ansible | 16:00 | |
| *** woodard has quit IRC | 16:00 | |
| *** cloudtrainme has quit IRC | 16:02 | |
| *** appprod0 has joined #openstack-ansible | 16:03 | |
| openstackgerrit | Merged openstack/openstack-ansible: Automate setting of glance_api_version https://review.openstack.org/283508 | 16:04 |
| mattt | palendae: i'll start building my kilo now to test it, but may not get that review updated before i head out today | 16:04 |
| palendae | mattt: Thanks | 16:04 |
| openstackgerrit | Merged openstack/openstack-ansible: Update PLUMgrid Appendix Doc paths https://review.openstack.org/284564 | 16:04 |
| SamYaple | hey how are you guys dealing with the "show_image_direct_url" security hole with ceph? | 16:05 |
| SamYaple | last i remember you were just setting the option and having the security hole be present | 16:05 |
| *** cloudtrainme has joined #openstack-ansible | 16:06 | |
| cloudnull | mattt: ^ | 16:07 |
| *** appprod0 has quit IRC | 16:07 | |
| mattt | SamYaple: yeah not aware of us doing anything out of the ordinary there | 16:07 |
| cloudnull | sorry SamYaple im not that in the know about about ceph. | 16:08 |
| odyssey4me | sigmavirus24 your review of the approach in https://review.openstack.org/284977 would be appreciated, as the resident pip wizard :) | 16:08 |
| SamYaple | same boat with Kolla. I was considering running a second glance-api server, one internal for show_image_direct_url, one external without the bad option | 16:08 |
| palendae | SamYaple: In Ceph itself, or the client side stuff? | 16:08 |
| palendae | Ceph install, rather | 16:08 |
| mattt | SamYaple: that's an interesting approach | 16:09 |
| SamYaple | palendae: this is a setting in glance-api | 16:09 |
| palendae | Ahh, ok | 16:09 |
| SamYaple | its needed to do CoW stuff | 16:09 |
| mattt | palendae: it leaks your storage details iirc | 16:09 |
| palendae | =\ | 16:09 |
| SamYaple | mattt: and you can read random files like... /etc/shadow | 16:09 |
| odyssey4me | SamYaple refresh my memory on the issue? if you use ceph, then you kinda need glance v2, but glance v2 shows the image url publically and that's exposing too much info, even if it's inaccessible? | 16:09 |
| odyssey4me | oh wow, that's rather lovely | 16:10 |
| SamYaple | odyssey4me: with show_image_direct_url you can read /etc/shadow on the system (they may have fixed _that_) but its still a security hole | 16:10 |
| SamYaple | its needed for ceph to be useful since ceph requires that for CoW cloning | 16:10 |
| SamYaple | it returns the rbd://<location> mapping | 16:10 |
| cloudnull | looks like the ceph docs still recommend setting that http://docs.ceph.com/docs/master/rbd/rbd-openstack/ | 16:10 |
| SamYaple | oh its a hard requirements | 16:10 |
| SamYaple | doubt that going to change | 16:11 |
| odyssey4me | well, I suppose we could work around it - as you're clearly thinking of doing - but the fact of the matter is that this is an issue in glance itself, it seems, and should be fixed there | 16:11 |
| mattt | SamYaple: i thought that was fixed no? | 16:11 |
| SamYaple | mattt: glance docs and nova people still say its a security risk | 16:11 |
| mattt | sigmavirus24: do you recall? i thought we addressed this some time ago | 16:11 |
| SamYaple | it may have been lessened (like you can no longer read /etc/shadow) but the docs still say its bad | 16:11 |
| cloudnull | sigmavirus24 stevelle ^ | 16:12 |
| *** appprod0 has joined #openstack-ansible | 16:12 | |
| odyssey4me | that said, if you're looking for ideas, then perhaps an easy one would be to put glance behind apache and do rewrites based on the location of the client - that's assuming that glance can run as a wsgi process (it couldn't in grizzly) | 16:12 |
| cloudnull | idk that it can now either. | 16:12 |
| odyssey4me | the alternative is what I used to do - which was to implement a reverse proxy (Apache) as the public endpoint for all services - that way you have more flexibility to do what you need for information that goes through to non-internal clients | 16:14 |
| SamYaple | this issue came up in https://review.openstack.org/#/c/205282/ again so i assumed it was still a security issue | 16:14 |
| *** logan- has quit IRC | 16:14 | |
| sigmavirus24 | mattt: what are we talking about? | 16:14 |
| *** logan- has joined #openstack-ansible | 16:14 | |
| sigmavirus24 | allowing the user to see/user locations? | 16:14 |
| sigmavirus24 | Or CoW with ceph? | 16:14 |
| sigmavirus24 | I'm a little lost | 16:14 |
| odyssey4me | sigmavirus24 the weather | 16:14 |
| Nepoc | good morning, my day is looking better. I slogged my way through all my ssl issues. If anyone is interested I have the system working with a custom ca, individual certs for each endpoint and ssl termination. | 16:14 |
| * odyssey4me is a helper | 16:14 | |
| automagically | Nepoc: Awesome, any changes needed? | 16:15 |
| odyssey4me | Nepoc very cool - it'd be great if you could write up a blog about what you did :) | 16:15 |
| Nepoc | Plenty :) | 16:15 |
| mattt | sigmavirus24 SamYaple : https://review.openstack.org/#/q/233a71022e0ee90ddacc05126a0bc7265c1ad166 | 16:15 |
| mattt | is what i was thinking | 16:15 |
| odyssey4me | Nepoc alternatively, add your notes to an etherpad and we can work through them | 16:15 |
| Nepoc | I should be able to write something up in a week or two | 16:15 |
| sigmavirus24 | mattt: I'm still confused about what we're talking about | 16:15 |
| SamYaple | sigmavirus24: direct_url in glance. its needed for CoW in ceph. its still a security issue though yes? | 16:16 |
| stevelle | wasn't part of the point of retiring v1 glance to get away from that? | 16:16 |
| sigmavirus24 | SamYaple: it used to be at least | 16:16 |
| sigmavirus24 | stevelle: no v2 still has image-locations | 16:16 |
| odyssey4me | mattt and we no longer have that as we've reverted to using pure upstream policies | 16:16 |
| Nepoc | I'm currently implementing a WAF installer for Openstack | 16:16 |
| automagically | Nepoc: +1 to the etherpad. We could definitely see how your changes relate to the work that went into https://review.openstack.org/#/c/277199/ | 16:16 |
| sigmavirus24 | But only if the op turns it on | 16:16 |
| *** appprod0 has quit IRC | 16:16 | |
| SamYaple | sigmavirus24: and for ceph its kinda a requirement | 16:16 |
| mattt | odyssey4me: yeah i was thinking about that, i recall you stripped that out | 16:16 |
| sigmavirus24 | That said, there was an issue where a user could delete all image locations and then replace the locations with a fake one | 16:16 |
| SamYaple | without it no CoW sigmavirus24 | 16:17 |
| sigmavirus24 | SamYaple: it's a requirement for CoW, not for Ceph | 16:17 |
| sigmavirus24 | SamYaple: right, ceph can operate without CoW though | 16:17 |
| stevelle | I thought v2 had a way to manage that, or am I thinking of another glance security issue | 16:17 |
| SamYaple | sigmavirus24: yea but it would be mostly worthless i think | 16:17 |
| sigmavirus24 | It's slower, but it's still possible as I understand it | 16:17 |
| SamYaple | it is | 16:17 |
| SamYaple | each image just has to be downloaded and repushed into the cluster | 16:17 |
| SamYaple | no cloning | 16:17 |
| sigmavirus24 | SamYaple: I don't disagree. You could restrict image location deletion though and I think that'd be roughly safer | 16:17 |
| SamYaple | sigmavirus24: could that still leak other files with a crafted "get"? | 16:18 |
| SamYaple | IIRC you has to set image location to a file then download the "image" | 16:18 |
| SamYaple | coolj: ping, i think you did this once | 16:18 |
| odyssey4me | palendae have you tested https://review.openstack.org/272652 ? if so, please add your review! | 16:20 |
| palendae | odyssey4me: I did in the review at Feb 15 3:03 PM; I've not updated those findings since there hasn't been a material change in the code from what I can see | 16:21 |
| mattt | mancdaz: you mentioned something about show_image_direct_url the other day, what issue were referring to? | 16:21 |
| *** appprod0 has joined #openstack-ansible | 16:21 | |
| cloudnull | Nepoc: +1 I'd love to read about the SSL bits you've worked through. especially as automagically and I have been working on the ssl termination reviews. | 16:21 |
| palendae | Realize that's kind of lost in the noise though | 16:21 |
| sigmavirus24 | SamYaple: so what other files could it leak | 16:21 |
| mancdaz | mattt it was something that needs to be enabled to allow cow between glance pool and cinder pool | 16:21 |
| *** skamithi has quit IRC | 16:21 | |
| sigmavirus24 | I've honestly forgotten that OSSN, so maybe I'm forgetting that getting the list of locations did something funky | 16:22 |
| *** skamithi has joined #openstack-ansible | 16:22 | |
| SamYaple | sigmavirus24: at the time, whatever files the user running glance had access to. this included /etc/shadow | 16:22 |
| SamYaple | sigmavirus24: i dont know about now | 16:22 |
| mattt | yeah the only issue i'm aware of is https://bugs.launchpad.net/glance/+bug/1400966, and i thought it was fixed | 16:24 |
| openstack | Launchpad bug 1400966 in OpenStack Security Advisory "[OSSA-2014-041] Glance allows users to download and delete any file in glance-api server (CVE-2014-9493)" [Critical,Fix released] - Assigned to Grant Murphy (gmurphy) | 16:24 |
| mattt | sounds like SamYaple is referring to something else | 16:24 |
| sigmavirus24 | SamYaple: ah we implemented a fix for that as I recall | 16:24 |
| sigmavirus24 | That should be fine now | 16:25 |
| palendae | odyssey4me: Want me to run that test again and report back? | 16:25 |
| sigmavirus24 | SamYaple: so yeah, multiple_locations = True should be fine (or whatever the config setting is) | 16:25 |
| *** appprod0 has quit IRC | 16:26 | |
| mattt | SamYaple: do you have something indicating the bug you are referring to? | 16:26 |
| odyssey4me | palendae up to you, I'm just looking to rustle up more reviews from people who actually tested the patch | 16:29 |
| palendae | odyssey4me: Yeah, understood | 16:29 |
| *** skamithi has quit IRC | 16:29 | |
| palendae | odyssey4me: Just making sure that previous test met expectations | 16:30 |
| odyssey4me | palendae also, considering you're now documenting your patches - I thought a fresh eye on what was done would be good | 16:30 |
| *** appprod0 has joined #openstack-ansible | 16:30 | |
| palendae | Fair enough | 16:30 |
| palendae | I'll spin up an AIO and run it | 16:30 |
| palendae | Since the surround code calling the playbook did change | 16:30 |
| palendae | surrounding* | 16:31 |
| Nepoc | cloudnull: Send me a url to etherpad and I'll dump in everything | 16:31 |
| mattt | mancdaz: enabling that is a bit revealing, but with rbd it's a bit cryptic and really isn't going to reveal a whole lot to the end user | 16:31 |
| odyssey4me | Nepoc you're able to create an etherpad yourself at any time: https://etherpad.openstack.org/ | 16:31 |
| Nepoc | Ah ok | 16:32 |
| cloudnull | Nepoc: https://etherpad.openstack.org/p/osa-ssl-termination | 16:32 |
| mattt | mancdaz: i know if you're using swift or something then it's really dangerous | 16:32 |
| Nepoc | Quick question, is there anyway to pull the host definitions from the openstack_user_config.yml into a user_blah.yml file? | 16:32 |
| *** skamithi has joined #openstack-ansible | 16:33 | |
| automagically | Nepoc: Take a look at conf.d | 16:33 |
| palendae | ^ We started adding new host definitions into conf.d, but some of the existing ones haven't been migrated out by default yet | 16:34 |
| automagically | Nepoc: and for docs: https://review.openstack.org/#/c/284457/7/doc/source/developer-docs/inventory.rst,unified | 16:34 |
| *** appprod0 has quit IRC | 16:34 | |
| palendae | automagically, Nepoc: Now merged and prettily rendered - file:///Users/nola7999/projects/openstack-ansible/doc/build/html/developer-docs/inventory.html#developer-inventory | 16:37 |
| odyssey4me | logan- does https://review.openstack.org/284977 meet your requirements? | 16:37 |
| palendae | automagically, Nepoc: Let me try again - http://docs.openstack.org/developer/openstack-ansible/developer-docs/inventory.html | 16:38 |
| Nepoc | hehe | 16:38 |
| odyssey4me | :) | 16:38 |
| *** appprod0 has joined #openstack-ansible | 16:39 | |
| Nepoc | I was hoping to consolodate all the "somekindof_hosts: host1: ip: 1.2.3.4" definitions into one yaml file. | 16:40 |
| logan- | yeah I think that makes sense thanks | 16:40 |
| cloudnull | Nepoc: in conf.d/ you can do that nova_compute.yml in one file glance.yml in another . | 16:43 |
| cloudnull | we do that with swift now | 16:43 |
| SamYaple | sigmavirus24: mattt: i do not have a bug. so you are saying direct_url is safe for use? no security risk? | 16:43 |
| cloudnull | but you could do others too | 16:43 |
| Nepoc | So I could do ... all_nodes.yml? | 16:43 |
| openstackgerrit | Nolan Brubaker proposed openstack/openstack-ansible: Add notes on running the upgrade script https://review.openstack.org/285419 | 16:43 |
| cloudnull | Nepoc: yes | 16:43 |
| sigmavirus24 | odyssey4me: that looks okay to me | 16:43 |
| mattt | SamYaple: there is a security risk of course | 16:43 |
| sigmavirus24 | SamYaple: I believe so yes | 16:43 |
| Nepoc | cloudnull: excellent | 16:43 |
| sigmavirus24 | I mean there isn't 0 security risk | 16:44 |
| mattt | SamYaple: because it leaks your storage backend details | 16:44 |
| sigmavirus24 | But I'd say it's low | 16:44 |
| *** appprod0 has quit IRC | 16:44 | |
| mattt | SamYaple: but i'm not aware of being able to overwrite files etc. | 16:44 |
| sigmavirus24 | mattt: openstack wants glance to do that all the time anyway | 16:44 |
| sigmavirus24 | "We don't want to download image data through glance. Let us access the backend on its own because we want to just get it from wherever the source is" | 16:44 |
| mattt | sigmavirus24: yeah if you do an image-show w/ v2 api it will show you your backend, which IIRC can leak your swift details if you have a swift backend | 16:44 |
| odyssey4me | sigmavirus24 be gentle, that's my first 'from scratch' python tool :) | 16:44 |
| sigmavirus24 | mattt: shouldn't because people shouldn't be swift creds in the swift urls | 16:45 |
| odyssey4me | for the project, at least | 16:45 |
| sigmavirus24 | That should be in glance's conf | 16:45 |
| SamYaple | mattt: so your saying its just informational leakage though? no data can be leaked. interesting | 16:45 |
| sigmavirus24 | mattt: I don't think we should be generating swift urls with credentials in them anymore in glance | 16:45 |
| SamYaple | i guess there is some misinformation floating around | 16:45 |
| mattt | SamYaple: i'm not saying that no | 16:45 |
| *** mgoddard__ has joined #openstack-ansible | 16:45 | |
| mattt | SamYaple: i'm just saying the only issue i'm aware of :) | 16:45 |
| mattt | sigmavirus24: i'll need to look, i know i checked like a yaer or two ago and it was a problem | 16:46 |
| sigmavirus24 | mattt: can we confirm that's still a problem with kilo/liberty/mitaka glance? | 16:46 |
| sigmavirus24 | mattt: yeah, I saw the bug from ~2 years ago | 16:46 |
| sigmavirus24 | The bug also wanted a migration to fix those urls for the administrator | 16:46 |
| sigmavirus24 | which no one ever wrote :/ | 16:46 |
| *** jiteka1 has joined #openstack-ansible | 16:46 | |
| *** jiteka has quit IRC | 16:46 | |
| SamYaple | maybe i should have brought this up in #glance i thought that was a permant issue and wanted to see if you guys wrote a workaround, but it sort of sounds like it might not even be an issue | 16:47 |
| mattt | SamYaple: can you keep us posted with what you find? | 16:47 |
| mattt | SamYaple: you've got me all hot and bothered now | 16:47 |
| * SamYaple plan is working perfectly | 16:48 | |
| *** appprod0 has joined #openstack-ansible | 16:48 | |
| *** mgoddard_ has quit IRC | 16:49 | |
| *** Bjoern_ is now known as BjoernT | 16:50 | |
| lbragstad | cloudnull another os_keystone ansible question for you | 16:51 |
| cloudnull | shoot | 16:51 |
| lbragstad | cloudnull if i opt out of deploying a database behind keystone - can i shutoff the galera-client install stuff too? | 16:52 |
| vdo | /j #nodejitsu | 16:52 |
| openstackgerrit | Nolan Brubaker proposed openstack/openstack-ansible: Add notes on running the upgrade script https://review.openstack.org/285419 | 16:52 |
| lbragstad | or skip the galera client install based on https://github.com/rackerlabs/capstone-deploy/blob/master/deploy.yaml#L35 | 16:52 |
| automagically | lbragstad: You should be able to | 16:52 |
| cloudnull | lbragstad: yes that should be possible. | 16:52 |
| *** mikelk has quit IRC | 16:53 | |
| lbragstad | cloudnull is that already supported and I'm just not seeing it? | 16:53 |
| *** appprod0 has quit IRC | 16:53 | |
| mattt | are we really looking to backport https://review.openstack.org/284937 to kilo ? | 16:54 |
| mattt | i know it's a bug and all but .... | 16:54 |
| odyssey4me | lbragstad cloudnull this is why I don't think that should be a role dep - it should instead be implemented via the playbook | 16:54 |
| mattt | if so, we should fix the sysstat issue and leave the variables as they are | 16:54 |
| cloudnull | odyssey4me: that would be a lot slower. | 16:55 |
| cloudnull | we just need a param | 16:55 |
| odyssey4me | mattt yeah, I'd agree with that - the backport should be a backport in principle, but not an exact cherry pick | 16:55 |
| odyssey4me | this is assuming we even want that to be backported | 16:55 |
| lbragstad | cloudnull a parameter to turn off the galera client install? | 16:55 |
| palendae | lbragstad, cloudnull: I don't think we can do conditional installs of galaxy roles. mrda ran into this with the ironic role and openstack_openrc | 16:56 |
| automagically | You can conditionalize the metadata dependency though | 16:56 |
| *** weezS has joined #openstack-ansible | 16:56 | |
| palendae | True | 16:57 |
| lbragstad | but the playbooks aren't run on galaxy install are they? | 16:57 |
| palendae | Might be a better way to do it | 16:57 |
| palendae | No | 16:57 |
| odyssey4me | how would doing that be different from simply telling the playbook to execute the role? | 16:57 |
| cloudnull | lbragstad: https://github.com/os-cloud/openstack-ansible-os_keystone/pull/2 | 16:57 |
| odyssey4me | I'm not against the idea - I just want to understand the implications. | 16:57 |
| openstackgerrit | Matt Thompson proposed openstack/openstack-ansible: Automate setting of glance_api_version https://review.openstack.org/284182 | 16:57 |
| *** appprod0 has joined #openstack-ansible | 16:58 | |
| cloudnull | odyssey4me: deps are rendered 1 on a host where roles are executed everywhere the playbook touches regardless. | 16:58 |
| cloudnull | also if the keystone role has a DB then its required that the DB clients be present. | 16:59 |
| cloudnull | so a dep makes more sense. | 16:59 |
| odyssey4me | cloudnull sure, but what if the user wants to use mysql, not mariadb - or postgresql ofr that matter | 16:59 |
| cloudnull | or DB2 for that matter | 17:00 |
| *** tiagogomes___ has quit IRC | 17:00 | |
| odyssey4me | cloudnull also, WUT? ;) | 17:00 |
| *** tiagogomes has joined #openstack-ansible | 17:00 | |
| admin0 | what processes adds bridges to the vlans ? the neutron-linuxbridge-agent right ? | 17:00 |
| odyssey4me | tell me the bit about the deps again, in laymans terms :p | 17:00 |
| admin0 | if that misses, or the vlans are not there, is there a manual way to add them ? | 17:00 |
| admin0 | somehow for new networks, i have the interfaces, btu they are not added to the bridges . for some, they arein the bridge, but the bridge is not in the VM | 17:01 |
| odyssey4me | admin0 if you're talking about bridges created by networks which are built in openstack - then the neutron agent does those | 17:01 |
| cloudnull | odyssey4me: http://docs.ansible.com/ansible/playbooks_roles.html#role-dependencies | 17:01 |
| cloudnull | "By default, roles can also only be added as a dependency once - if another role also lists it as a dependency it will not be run again." | 17:02 |
| *** appprod0 has quit IRC | 17:02 | |
| *** joseg has quit IRC | 17:03 | |
| odyssey4me | cloudnull ah, so your concern is that it would run multiple times because multiple plays execute against the same hosts | 17:03 |
| openstackgerrit | Andy McCrae proposed openstack/openstack-ansible: Fix typo in swift_rings_check.py.j2 https://review.openstack.org/285435 | 17:03 |
| cloudnull | odyssey4me: yes | 17:03 |
| cloudnull | lbragstad: so with https://github.com/os-cloud/openstack-ansible-os_keystone/pull/2/files if you have the DB disabled it wont run the galera_client role | 17:03 |
| cloudnull | if you can give that a go and post in the PR it'd be appreciated. | 17:04 |
| cloudnull | we're still waiting on getting that role into the OS namespace. | 17:04 |
| *** electrofelix has quit IRC | 17:04 | |
| odyssey4me | cloudnull ok, then I'm game for implementing vars - this goes towards the discussion around implementing code paths based on vars instead of tags though | 17:04 |
| cloudnull | huh? | 17:05 |
| lbragstad | cloudnull sure thing - can I pass a PR to my ansible requirements file? | 17:06 |
| cloudnull | im not sure this has anything to with tagging . | 17:06 |
| odyssey4me | cloudnull we discussed before, and at the mid cycle, vars can be used to activate code paths - in marketing speak, we can implement var-based implementation of 'life cycle events' :p | 17:06 |
| odyssey4me | anyway, that's a tangent | 17:07 |
| *** appprod0 has joined #openstack-ansible | 17:07 | |
| cloudnull | im lost. how is that related to adding a conditional to the dep? | 17:07 |
| odyssey4me | that's adding a code path based on a var setting | 17:07 |
| odyssey4me | you were against that before :) | 17:07 |
| odyssey4me | we'll discuss it again at the summit, as I think we're going to have to do something like that | 17:08 |
| *** asettle has quit IRC | 17:08 | |
| cloudnull | we have vars that activate code paths all over the place. | 17:08 |
| cloudnull | galera, rabbit, nova, etc | 17:08 |
| lbragstad | federation | 17:08 |
| cloudnull | ^ that | 17:09 |
| cloudnull | this is not new. | 17:09 |
| cloudnull | maybe im just confused here. | 17:09 |
| odyssey4me | heh, exactly - so I'd like to formalise some standard path activators as a pattern | 17:09 |
| lbragstad | so - making all code paths dependent on setting specific variables? | 17:09 |
| odyssey4me | some examples - maybe you want to install, but not configure or start services... and maybe you want to not install, but configure and start services | 17:10 |
| odyssey4me | other examples - you want to configure a set of features | 17:10 |
| cloudnull | the start service thing i can get behind. the not install but do other magic, no | 17:10 |
| odyssey4me | effectively the default is to do what we do today - everything | 17:10 |
| cloudnull | use a tag | 17:10 |
| odyssey4me | but allow the playbook to set a var that turns off key actions | 17:11 |
| odyssey4me | playbooks can't do tags | 17:11 |
| odyssey4me | so to do that you'd need a human, or a wrapper script | 17:11 |
| *** Mudpuppy_ has joined #openstack-ansible | 17:11 | |
| *** appprod0 has quit IRC | 17:11 | |
| *** KLevenstein_ has joined #openstack-ansible | 17:11 | |
| odyssey4me | this means, for instance, that you could do staged implementations - an example would be to deploy the new code, implement the configs, but not restart the services until you're ready to | 17:12 |
| cloudnull | we can already do that, use a tag | 17:13 |
| *** xek__ has joined #openstack-ansible | 17:13 | |
| cloudnull | I think we need to standardize on how we've implemented the tags | 17:13 |
| odyssey4me | if tags are the preferred option, then we need to standardise tags properly and implement the code paths according to a standardised set of tags | 17:13 |
| odyssey4me | right now it's the wild west :) | 17:14 |
| cloudnull | but adding vars all overthe place is the re-invention of the wildwest | 17:14 |
| *** admin0 has quit IRC | 17:14 | |
| *** gfa_ has joined #openstack-ansible | 17:14 | |
| odyssey4me | I'm ok with either option. But it's a discussion that needs to be had. | 17:14 |
| cloudnull | if we could have starard tags for config, install, etc and use them everywhere we'd solve that | 17:14 |
| cloudnull | and i dont think we're going to get away from vars activating code paths. | 17:15 |
| cloudnull | we need both. | 17:15 |
| *** Trident has joined #openstack-ansible | 17:15 | |
| *** neillc_ has joined #openstack-ansible | 17:15 | |
| *** ggillies_ has joined #openstack-ansible | 17:16 | |
| *** kmARC_ has joined #openstack-ansible | 17:16 | |
| odyssey4me | why choose, when you can have it all! | 17:16 |
| *** appprod0 has joined #openstack-ansible | 17:16 | |
| *** sshen_ has joined #openstack-ansible | 17:16 | |
| cloudnull | we'd need both. | 17:17 |
| cloudnull | coherent tags should be a priority though | 17:17 |
| cloudnull | if ansible ever lets a pay set tags at run time it'd solve for both | 17:18 |
| cloudnull | but we'll likely be waiting for ansible 3 | 17:18 |
| odyssey4me | yep | 17:18 |
| automagically | +1 on the discussion of tags vs vars | 17:20 |
| *** KLevenstein has quit IRC | 17:20 | |
| *** Mudpuppy has quit IRC | 17:20 | |
| *** xek_ has quit IRC | 17:20 | |
| *** Bofu2U has quit IRC | 17:20 | |
| *** miguelgrinberg has quit IRC | 17:20 | |
| *** krotscheck has quit IRC | 17:20 | |
| *** loquacities has quit IRC | 17:20 | |
| *** McMurlock has quit IRC | 17:20 | |
| *** mgariepy has quit IRC | 17:20 | |
| *** gfa has quit IRC | 17:20 | |
| *** sshen has quit IRC | 17:20 | |
| *** neillc has quit IRC | 17:20 | |
| *** hughsaunders has quit IRC | 17:20 | |
| *** admiralboom has quit IRC | 17:20 | |
| *** dolphm has quit IRC | 17:20 | |
| *** nwonknu has quit IRC | 17:20 | |
| *** kmARC has quit IRC | 17:20 | |
| *** ggillies has quit IRC | 17:20 | |
| *** bapalm has quit IRC | 17:20 | |
| *** Tridde has quit IRC | 17:20 | |
| *** jcannava has quit IRC | 17:20 | |
| *** KLevenstein_ is now known as KLevenstein | 17:20 | |
| odyssey4me | cloudnull FYI, to make 'depends-on' actually pull in a clone of the dependent repo/path requires us to implement a whole different way of pulling in the roles | 17:20 |
| *** krotscheck has joined #openstack-ansible | 17:20 | |
| *** appprod0 has quit IRC | 17:20 | |
| cloudnull | yuk | 17:20 |
| *** miguelgrinberg_ has joined #openstack-ansible | 17:21 | |
| *** bapalm has joined #openstack-ansible | 17:21 | |
| *** dolphm has joined #openstack-ansible | 17:21 | |
| odyssey4me | I'll work on it next week. It's going to need us to implement options when we bootstrap ansible - one is to use galaxy, another to use the git sources (I think this should be an option), and another is to use zuul-cloner. | 17:21 |
| *** miguelgrinberg_ is now known as miguelgrinberg | 17:21 | |
| jmccrory | morning all | 17:21 |
| automagically | morning | 17:21 |
| *** hughsaunders has joined #openstack-ansible | 17:21 | |
| *** jcannava has joined #openstack-ansible | 17:21 | |
| cloudnull | morning | 17:21 |
| odyssey4me | For the gate we would need to use zuul-cloner, which is the thing that's instrumented to do what we need. | 17:22 |
| cloudnull | so zuul-cloner will pull in the depends on change ? | 17:22 |
| odyssey4me | yep | 17:23 |
| cloudnull | can we force zuul-cloner to run ? | 17:23 |
| *** loquacities has joined #openstack-ansible | 17:23 | |
| odyssey4me | So I figured I'd make an adjustment to bootstrap-ansible to allow different ways of grabbing the roles, and just set the gate to use zuul-cloner. | 17:23 |
| cloudnull | IE let our scripts do all the things they already do, then have zuul-cloner blowaway what it needs ? | 17:23 |
| *** Mudpuppy_ is now known as Mudpuppy | 17:24 | |
| odyssey4me | at this point I don't know enough | 17:24 |
| cloudnull | me neither. | 17:24 |
| *** nwonknu has joined #openstack-ansible | 17:24 | |
| odyssey4me | I spent the whole day building something to work with what I thought was going on, then discovered that everything I thought I knew was a lie. | 17:24 |
| cloudnull | you've stepped into the OpenStack zone! | 17:25 |
| odyssey4me | ie https://review.openstack.org/285188 was a waste of time | 17:25 |
| spotz | :( | 17:25 |
| *** appprod0 has joined #openstack-ansible | 17:25 | |
| odyssey4me | but it's there as yet another WIP patch in my list to remind me to get back to it, as this will be a critical feature for work going forward | 17:25 |
| odyssey4me | it would certainly smooth the glide path on the magical journey | 17:25 |
| odyssey4me | and yes, it's 17:30 on a friday :) | 17:26 |
| odyssey4me | sliante! | 17:26 |
| cloudnull | gate is 2.5 hours behind now. | 17:26 |
| cloudnull | :( | 17:26 |
| odyssey4me | *slainte | 17:26 |
| cloudnull | afk a bit | 17:27 |
| odyssey4me | I'm out for the weekend. Have a great day everyone! | 17:27 |
| *** mgariepy has joined #openstack-ansible | 17:27 | |
| lbragstad | odyssey4me o/ | 17:27 |
| automagically | odyssey4me enjoy your weekend | 17:28 |
| *** McMurlock has joined #openstack-ansible | 17:28 | |
| *** admiralboom has joined #openstack-ansible | 17:29 | |
| *** appprod0 has quit IRC | 17:30 | |
| *** v1k0d3n has quit IRC | 17:33 | |
| *** BjoernT has quit IRC | 17:34 | |
| *** sdake has joined #openstack-ansible | 17:34 | |
| *** appprod0 has joined #openstack-ansible | 17:34 | |
| *** galstrom is now known as galstrom_zzz | 17:35 | |
| *** cloudtrainme has quit IRC | 17:37 | |
| *** appprod0 has quit IRC | 17:39 | |
| *** raddaoui has quit IRC | 17:40 | |
| *** appprod0 has joined #openstack-ansible | 17:43 | |
| *** appprod0 has quit IRC | 17:48 | |
| *** eil397 has joined #openstack-ansible | 17:48 | |
| *** eil397 has left #openstack-ansible | 17:49 | |
| *** appprod0 has joined #openstack-ansible | 17:50 | |
| *** appprod0 has quit IRC | 17:56 | |
| *** appprod0 has joined #openstack-ansible | 17:59 | |
| *** shanec_ has joined #openstack-ansible | 18:03 | |
| *** appprod0 has quit IRC | 18:05 | |
| openstackgerrit | Major Hayden proposed openstack/openstack-ansible-security: Security: Check for grub.cfg first https://review.openstack.org/285483 | 18:16 |
| *** mgoddard__ has quit IRC | 18:17 | |
| *** mgoddard has joined #openstack-ansible | 18:17 | |
| *** Mudpuppy has quit IRC | 18:22 | |
| *** Mudpuppy has joined #openstack-ansible | 18:22 | |
| cloudnull | anyone need help on anything ? Gate is >3 hours behind so I've got some time to kill :) | 18:26 |
| openstackgerrit | Kevin Carter proposed openstack/openstack-ansible: Remove deprecated config variables https://review.openstack.org/281555 | 18:29 |
| spotz | wow | 18:31 |
| *** v1k0d3n has joined #openstack-ansible | 18:33 | |
| openstackgerrit | Merged openstack/openstack-ansible: Cosmetic PLUMgrid doc updates https://review.openstack.org/285355 | 18:33 |
| *** abitha has joined #openstack-ansible | 18:33 | |
| *** v1k0d3n is now known as Guest46696 | 18:34 | |
| *** turtle-learner has joined #openstack-ansible | 18:35 | |
| *** admin0 has joined #openstack-ansible | 18:36 | |
| openstackgerrit | Merged openstack/openstack-ansible: Release note for dynamic inventory args change https://review.openstack.org/284757 | 18:36 |
| *** Guest46696 has quit IRC | 18:37 | |
| stevelle | cloudnull: care to give my gnocchi role a once-over? | 18:38 |
| cloudnull | sure sure | 18:38 |
| stevelle | https://github.com/stevelle/openstack-ansible-gnocchi -- I know it's a bit behind the state of the art for our OS roles but it should only be pretty close | 18:39 |
| stevelle | docs and tests are the current work queue, then I'll work on getting it caught up on the tweaks | 18:40 |
| cloudnull | it looks pretty close. | 18:43 |
| cloudnull | does gnocchi have an http proxy header that it can set ? | 18:44 |
| cloudnull | something similar to https://review.openstack.org/#/c/277199/8/playbooks/roles/os_heat/defaults/main.yml | 18:44 |
| cloudnull | https://review.openstack.org/#/c/277199/8/playbooks/roles/os_heat/templates/heat.conf.j2 | 18:44 |
| *** abitha has quit IRC | 18:44 | |
| stevelle | cloudnull: I believe so. I haven't done the TLS enablement work. | 18:45 |
| cloudnull | ok | 18:45 |
| cloudnull | was just curious | 18:45 |
| stevelle | and no docs so every feature is fun | 18:45 |
| cloudnull | reading through the defaults | 18:45 |
| stevelle | At this point I think the best bet would be to put Apache in as a reverse-proxy instead of doing mod_wsgi | 18:46 |
| cloudnull | does gnocchi support mod_wsgi ? | 18:47 |
| *** jiteka1 has quit IRC | 18:47 | |
| stevelle | yeah, I have that set as default behavior now. not doing venvs correct since mattt fixed them for other services | 18:48 |
| stevelle | there's a var to have it run standalone though for dev tinkering | 18:48 |
| *** agireud has quit IRC | 18:55 | |
| cloudnull | stevelle: this all looks good to import into the namespace | 18:56 |
| stevelle | nice, thx | 18:56 |
| *** agireud has joined #openstack-ansible | 18:57 | |
| *** tiagogomes has quit IRC | 19:01 | |
| *** galstrom_zzz is now known as galstrom | 19:02 | |
| jmccrory | hey cloudnull, whenever you get a moment, what prevents splitting out existing role histories for independent repos? | 19:03 |
| cloudnull | nothing really. if you have a good way to do it we can get it done. | 19:04 |
| *** admin0 has quit IRC | 19:05 | |
| *** admin0 has joined #openstack-ansible | 19:05 | |
| *** permalac has joined #openstack-ansible | 19:05 | |
| jmccrory | this worked for me in the past https://help.github.com/articles/splitting-a-subfolder-out-into-a-new-repository/ | 19:05 |
| cloudnull | ill try that on the os_ roles | 19:06 |
| cloudnull | it was a mess at my last go | 19:06 |
| cloudnull | but ill try it again | 19:07 |
| *** raddaoui has joined #openstack-ansible | 19:12 | |
| *** Mudpuppy_ has joined #openstack-ansible | 19:16 | |
| *** Mudpuppy has quit IRC | 19:16 | |
| *** Mudpuppy_ has quit IRC | 19:17 | |
| *** Mudpuppy has joined #openstack-ansible | 19:18 | |
| openstackgerrit | Bjoern Teipel proposed openstack/openstack-ansible-rabbitmq_server: Adding ERLANG VM tuning parameters https://review.openstack.org/284899 | 19:24 |
| openstackgerrit | Bjoern Teipel proposed openstack/openstack-ansible: Adding release notes for erlang VM tuning parameters https://review.openstack.org/285506 | 19:24 |
| *** skamithi14 has joined #openstack-ansible | 19:29 | |
| *** raddaoui has quit IRC | 19:29 | |
| *** raddaoui has joined #openstack-ansible | 19:30 | |
| openstackgerrit | Bjoern Teipel proposed openstack/openstack-ansible: Adding release notes for erlang VM tuning parameters https://review.openstack.org/285506 | 19:30 |
| *** Bjoern_ has joined #openstack-ansible | 19:31 | |
| Nepoc | cloudnull: just when I thought I had everything ironed out with ssl offloading... half of my setup broke | 19:31 |
| automagically | Nepoc: oh no, what happened | 19:31 |
| cloudnull | ^ ++ | 19:32 |
| *** skamithi13 has quit IRC | 19:32 | |
| Nepoc | cloudnull: I have some other playbooks that run various nova commands such as "nova --insecure list"... I get back "stderr: /usr/local/lib/python2.7/dist-packages/requests/packages/urllib3/util/ssl_.py:100: InsecurePlatformWarning: A true SSLContext object is not available" | 19:33 |
| Nepoc | Followed by "InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised" | 19:34 |
| automagically | Nepoc: But that should be a warning only, not a failure | 19:34 |
| cloudnull | that should be just a warning. | 19:34 |
| cloudnull | it shouldnt be stopping the services from running. | 19:35 |
| admin0 | hmm .. anyone seen this before ? ERROR 1932 (42S02): Table 'keystone.user' doesn't exist in engine | 19:35 |
| admin0 | a new 3 cluster openstack install | 19:35 |
| Nepoc | automagically: Technically everything is running... except my additional playbooks | 19:35 |
| admin0 | 3 controller node standard ansible install | 19:35 |
| admin0 | but it had data before reboot :D | 19:36 |
| admin0 | test data .. so phew ! | 19:36 |
| Nepoc | cloudnull: any ideas on getting the ca in the right place so i don't have any errors? | 19:36 |
| cloudnull | admin0: seems like the the keystone db migration has not run ? | 19:36 |
| Nepoc | cloudnull: also I can then drop the --insecure which is breaking my other playbooks | 19:36 |
| admin0 | well, it had data .. ( a test clsuter ) .. we shut it down .. now its up .. and says that | 19:37 |
| cloudnull | is the db cluster in a bad state? | 19:37 |
| cloudnull | maybe its out of sync ? | 19:37 |
| admin0 | hmm.. would out of sync cause this ?.. table not found | 19:38 |
| cloudnull | Nepoc: /etc/ssl/certs normally -- then update the certs -- http://manpages.ubuntu.com/manpages/trusty/man8/update-ca-certificates.8.html | 19:38 |
| cloudnull | admin0: if the cluster was split brained or having replications issues i guess it could. | 19:39 |
| openstackgerrit | Bjoern Teipel proposed openstack/openstack-ansible: Adding release notes for erlang VM tuning parameters https://review.openstack.org/285506 | 19:39 |
| admin0 | hmm. .. i am going to reformat, redo the OS .. and retry , but this time with a managed mysql | 19:39 |
| cloudnull | is this our galera cluster ? | 19:40 |
| admin0 | ansible created cluster :D | 19:40 |
| cloudnull | IE mariadb + galera3 deployed from our playbooks ? | 19:40 |
| admin0 | yes sir | 19:40 |
| cloudnull | have you rebootstrapped the cluster after bringing it back online ? | 19:40 |
| admin0 | yep | 19:40 |
| Nepoc | cloudnull: I did that, still complains | 19:40 |
| cloudnull | :'( | 19:41 |
| cloudnull | to both the last replies | 19:41 |
| Nepoc | haha | 19:41 |
| * admin0 goes back to reformating the clsuter again | 19:41 | |
| admin0 | *cluster | 19:41 |
| cloudnull | admin0: is the table missing on all of the cluster nodes ? | 19:41 |
| admin0 | tables are there, data seems to be there | 19:41 |
| admin0 | just mysql select says not there | 19:41 |
| admin0 | and everything is just stuck :) | 19:41 |
| admin0 | i want to re-do it anyway | 19:42 |
| cloudnull | im going with cosmic rays .... | 19:42 |
| cloudnull | :) | 19:42 |
| admin0 | brb | 19:42 |
| cloudnull | kk. | 19:42 |
| cloudnull | Nepoc: if you execute the command manually does it complain ? | 19:44 |
| *** kencjohnston has quit IRC | 19:44 | |
| cloudnull | and is it complaining on the deployment node as well as the one of the api nodes ? | 19:44 |
| Nepoc | I'll let you know shortly, currently rebuilding | 19:44 |
| lbragstad | cloudnull another question on the os_keystone role ;) | 20:05 |
| cloudnull | jmccrory: thanks for the tip. i modified it a bit but have saved all of the history. IE https://github.com/os-cloud/openstack-ansible-repo_build | 20:05 |
| cloudnull | lbragstad: shoot | 20:05 |
| lbragstad | cloudnull have there been any discussions around breaking the install of dependencies into the installation of optional deps and required deps? | 20:06 |
| palendae | None that I'm aware of | 20:06 |
| cloudnull | pip/apt packages? | 20:06 |
| palendae | Though I think we should probably look into using the role meta files to define that | 20:06 |
| palendae | cloudnull: I took it to mean ansible role deps | 20:06 |
| lbragstad | cloudnull pip packages - https://github.com/os-cloud/openstack-ansible-os_keystone/blob/master/defaults/main.yml#L360-L376 | 20:07 |
| palendae | Oh! Nevermind then | 20:07 |
| lbragstad | cloudnull actually - I could just override those | 20:07 |
| * lbragstad facepalm | 20:07 | |
| cloudnull | you can override them | 20:07 |
| lbragstad | sweet | 20:08 |
| cloudnull | we have no plans as of yet to seperate optional and required deps | 20:08 |
| *** woopstar has joined #openstack-ansible | 20:11 | |
| Nepoc | Another question/thought... why was haproxy chosen over pound? | 20:11 |
| woopstar | When running the haproxy-install playbook on a clean setup, it fails at the task "haproxy_server | Create haproxy service config files" with the following: 'msg': 'AnsibleError: host not found: [', 'failed': True | 20:12 |
| *** javeriak has joined #openstack-ansible | 20:15 | |
| *** javeriak has quit IRC | 20:16 | |
| *** javeriak has joined #openstack-ansible | 20:16 | |
| *** raddaoui has quit IRC | 20:17 | |
| *** galstrom is now known as galstrom_zzz | 20:17 | |
| cloudnull | Nepoc: there was no real reason | 20:18 |
| cloudnull | its just something many of us know | 20:19 |
| cloudnull | im sure there are better solutions than haproxy but it works | 20:19 |
| Nepoc | Okay, we used pound here for our previous openstack deployment and the configuration is dead simple for ssl termination | 20:19 |
| Nepoc | I'm considering swapping it out if I have no more luck today | 20:20 |
| Nepoc | If I do I'll share the playbook | 20:20 |
| *** ShannonM has quit IRC | 20:20 | |
| *** alejandrito has joined #openstack-ansible | 20:20 | |
| *** javeriak_ has joined #openstack-ansible | 20:21 | |
| *** javeriak has quit IRC | 20:21 | |
| *** yarkot_ has joined #openstack-ansible | 20:22 | |
| Nepoc | Out of curiosity how many people are working on the openstack-ansible project? | 20:23 |
| admin0 | Nepoc: i am testing it out .. install it 2-4 times per day :D | 20:24 |
| Nepoc | Haha sounds like what I do | 20:24 |
| admin0 | but i am no developer yet | 20:24 |
| palendae | Nepoc: Active contributors? Mmmm, not sure | 20:25 |
| Nepoc | Acceptable answer :) | 20:25 |
| *** yarkot_ has quit IRC | 20:26 | |
| admin0 | well, i will start to contribute | 20:26 |
| admin0 | need to undstand fully what it does first | 20:26 |
| palendae | http://stackalytics.com/?module=openstack-ansible is a way to guess | 20:26 |
| admin0 | i will contribute on documentation for sure | 20:26 |
| palendae | Though No idea why Monty's so high on there cause I don't think he's provided many patches. Nor does he work for Racksapce | 20:26 |
| palendae | lol wut | 20:27 |
| palendae | THat's odyssey4me http://stackalytics.com/?user_id=jesse-pretorius&project_type=openstack&release=mitaka&company=&metric=marks&module=openstack-ansible | 20:27 |
| admin0 | no irc nicknames there .. http://stackalytics.com/?module=openstack-ansible | 20:27 |
| palendae | admin0: No | 20:27 |
| admin0 | boo :D | 20:27 |
| admin0 | should be there as well | 20:27 |
| palendae | But for rough number | 20:27 |
| admin0 | so we know who his who | 20:27 |
| palendae | I'm only #11 :( | 20:28 |
| admin0 | i am #0 :D | 20:28 |
| admin0 | maybe -11111111 | 20:28 |
| admin0 | #11 sounds much much better | 20:28 |
| Nepoc | Next random question, is the move to Ansible 2.0 on the horizon? | 20:29 |
| admin0 | yes ( far far horizon ) .. that i know so far | 20:29 |
| admin0 | from camping here | 20:29 |
| Nepoc | Yeah I thought I saw it pop by a few times | 20:29 |
| palendae | Nepoc: Yeah, people are trying it out, but there seem to be some bugs with 2.0 still, and it appears that using 2.0 will require a hard cut over in terms of playbook compatibility | 20:31 |
| Nepoc | Oh joy... | 20:31 |
| palendae | The people who have looked closest at it aren't confident in switching yet, at least on this project | 20:31 |
| Nepoc | Good :) | 20:32 |
| admin0 | ok guys .. my cluster is done .. lets say i have one hardware node called c11 with 172.29.236.11 .. and i installed mysql here .. what do I need to do such that: 1. i can pass the mysql host/user/pass so that ansible uses this database .. and 2. i tell the system to install haproxy in here | 20:33 |
| Nepoc | magic | 20:33 |
| admin0 | :) | 20:33 |
| admin0 | and myabe tell the system its the network node also ( all metal ) | 20:34 |
| admin0 | 3 birds with 1 stone :D | 20:34 |
| admin0 | with 1 ansible | 20:34 |
| Nepoc | If you're asking what I assume you're asking you just need to set the IP for all the host types to that | 20:34 |
| Nepoc | Sounds like you're almost doing a AIO | 20:35 |
| * admin0 has never done an AIO | 20:35 | |
| admin0 | aio = all in 1 server stuff right | 20:35 |
| Nepoc | yeah | 20:35 |
| admin0 | nah .. i got 8 servers to play wtih | 20:35 |
| Nepoc | haproxy one is pretty easy check in /etc/openstack_deploy/conf.d/haproxy.yml.example | 20:36 |
| Nepoc | If you want to run the galera node on hardware you might need to change this /etc/openstack_deploy/env.d/galera.yml | 20:40 |
| admin0 | thanks .. looking at those | 20:41 |
| admin0 | well, haproxy is fairly straightforward | 20:43 |
| admin0 | galera, could not make sense of it | 20:43 |
| admin0 | how to map it to metal/existing user/pass/host | 20:44 |
| Nepoc | I just looked through the playbooks... Looks like a lot of work to me. | 20:45 |
| admin0 | oh | 20:46 |
| admin0 | ok | 20:46 |
| admin0 | next stop, how to enable/add a new cluster as region2 in an exitsing clsuter | 20:47 |
| Nepoc | Though I wouldn't settle for my answer, cloudnull/palendae... anyone else might have a better idea | 20:47 |
| admin0 | https://review.openstack.org/#/c/284449/ | 20:47 |
| admin0 | i know from there odyssey4me knows this :D | 20:48 |
| admin0 | if it provides keystone commands I need to enter in some add-as-region2.txt file, i would be happy | 20:48 |
| stevelle | admin0: to make playbook run on hardware, update file in env.d/ as in https://github.com/openstack/openstack-ansible/blob/ac7bb0306fa2337238771a6591f4875b49ff56a4/etc/openstack_deploy/env.d/haproxy.yml#L31 | 20:48 |
| stevelle | though I think you got that | 20:49 |
| admin0 | yep :) | 20:49 |
| admin0 | that part is clear to me | 20:49 |
| admin0 | is_metal: true is the magic for anything that i want to shift from container to metal | 20:50 |
| stevelle | yup | 20:50 |
| stevelle | now next step I'm confused about the region2 bit | 20:51 |
| admin0 | ok .. the ansible is focused on new environemnt right ? | 20:51 |
| *** ShannonM has joined #openstack-ansible | 20:51 | |
| stevelle | sure | 20:51 |
| admin0 | i want to setup a new cluster, but as region2 .. ( reuse existing keystone ) | 20:51 |
| admin0 | so everything is new .. except it shares just the keystone | 20:52 |
| stevelle | you say new "cluster" | 20:52 |
| admin0 | so in an existing keystone, its added ( either manually or automatically ) as a region2 | 20:52 |
| stevelle | you're not talking about clustering galera right? :) | 20:52 |
| admin0 | no no | 20:53 |
| stevelle | that's it's own thing | 20:53 |
| admin0 | group of computers thrown together and called a cloud :D | 20:53 |
| stevelle | give me a sec to try and put this together. | 20:53 |
| woopstar | :D | 20:53 |
| admin0 | how do i refer to a group of systems where openstack is setup | 20:53 |
| stevelle | admin0: do you want keystone services (and presumably containers) in the deployment or do you want to exclude keystone entirely from region2 and just point region2 services at existing keystone api? | 20:54 |
| admin0 | ok.. i have 10 computers in roomA and where i setup openstack-ansible and its running .. now I have another room, where i have 10 more computers .. I can install ansible again, but it will be 2nd openstak .. means 2 sets of username , password, horizon etc .. instead, I want to setup openstack in room2, but add it as region2 in exisitng keystone | 20:54 |
| admin0 | well, exclude keystone entirely | 20:54 |
| admin0 | assume there is one keystone out there | 20:55 |
| stevelle | ok, first thing. for all the os_* services you do deploy, you will want to configure them as "region2" (or whatever name you pick). you need to add overrides to your user_variables for this: (cinder_service_region, neutron_service_region, etc) | 20:58 |
| admin0 | maybe a good idea to move this to user_config one place | 20:58 |
| admin0 | insead of using overrides for all | 20:58 |
| admin0 | maybe it can be my first contribution :D | 20:58 |
| admin0 | \o/ | 20:58 |
| admin0 | first thing noted down on the todo | 20:59 |
| stevelle | I think this might work as an example file or content in docs, keeping it up to date as variables shift is a little work but might be worth it | 20:59 |
| *** woodard has joined #openstack-ansible | 21:01 | |
| admin0 | stevelle: so 1. change all those variables 2. set keystone containers to zero i think .. waiting for 3. | 21:02 |
| stevelle | next thing is you have to tell all the os_* service where to find keystone. So override: keystone_service_adminurl and keystone_service_internaluri | 21:03 |
| admin0 | 3. check | 21:04 |
| admin0 | does the endpoint need to be added beforehand or after ansible-setup here ? | 21:04 |
| woopstar | Have you guys considered adding LetsEncrypt to the project? | 21:04 |
| stevelle | admin0: question not clear | 21:04 |
| admin0 | i mean when i am setting up a new cluster, do I need to add the endpoints beforehand to keysotne | 21:05 |
| admin0 | or the ansible scripts never do a keystone call to verify that its running and working as it should | 21:05 |
| stevelle | admin0: you don't have to add region2 endpoints. the playbooks will do that. See also tasks/cinder_service_add.yml -- Also you need to override keystone_auth_admin_token with the token from region1 | 21:06 |
| stevelle | all the os_* services have a service_add like task list | 21:07 |
| admin0 | ok | 21:07 |
| admin0 | so i am installing liberty .. the other keystone, what might be the minimum version requirement there ? | 21:07 |
| admin0 | can a icehouse or juno also work ? | 21:07 |
| admin0 | or that other one needs to be upgraded first to liberty | 21:08 |
| stevelle | I am going to bet you will have a bad time trying to use a juno Keystone. | 21:08 |
| admin0 | ok .. can a icehouse or juno install just work fine with only keystone upgraded to liberty | 21:09 |
| stevelle | One of the other things to note is Liberty wants to deploy with Keystone V3, so support for that is a reasonable lower bound on your keystone unless you want to further mess with things | 21:09 |
| admin0 | i have environments with icehouse and juno, and i want to add liberty as region2 to existing keystone | 21:09 |
| stevelle | I can't make any claims to knowledge about whether you can get that to work. | 21:09 |
| stevelle | (I dunno) | 21:09 |
| admin0 | ok | 21:09 |
| admin0 | my thought was irrespective of the openstack version, keystone can be upgraded independently | 21:10 |
| admin0 | but will need to test this | 21:10 |
| *** skamithi14 has quit IRC | 21:11 | |
| stevelle | keystone is pretty serious about backward compat but that icehouse to liberty is a big jump | 21:11 |
| *** skamithi13 has joined #openstack-ansible | 21:11 | |
| *** yarkot_ has joined #openstack-ansible | 21:13 | |
| stevelle | in case I missed another variable for configuring region2 services, the key places you can look to identify possible issues is the *_service_add.yml task file in each service, and then peek at the *.conf.j2 file in the service role's template. You can probably work out what other variables you would need to set (like if keystone is running insecure there are vars for that) | 21:13 |
| admin0 | stevelle: my case for this is here: https://blueprints.launchpad.net/openstack-ansible/+spec/enable-installation-as-alternate-region in the opening arguments :D | 21:13 |
| stevelle | I remember getting the outline earlier this week | 21:14 |
| *** alejandrito has quit IRC | 21:16 | |
| stevelle | admin0: there will be other vars that probably will need to be overridden but this is the starting point for finding them | 21:16 |
| admin0 | all noted down | 21:16 |
| *** woopstar has quit IRC | 21:18 | |
| *** javeriak_ has quit IRC | 21:19 | |
| *** weezS has quit IRC | 21:23 | |
| *** johnmilton has quit IRC | 21:24 | |
| *** ShannonM has quit IRC | 21:29 | |
| *** yarkot_ has quit IRC | 21:29 | |
| *** bsv has joined #openstack-ansible | 21:35 | |
| cloudnull | ok, i've had enough cloud for today. bbl | 21:36 |
| spotz | later cloudnull! | 21:37 |
| admin0 | have a great weekend | 21:37 |
| *** agireud has quit IRC | 21:41 | |
| *** jamielennox is now known as jamielennox|away | 21:43 | |
| *** agireud has joined #openstack-ansible | 21:43 | |
| *** cloudtrainme has joined #openstack-ansible | 21:55 | |
| *** spotz is now known as spotz_zzz | 21:57 | |
| openstackgerrit | Nate Potter proposed openstack/openstack-ansible: Check for AODH host before adding alarm_connection https://review.openstack.org/284392 | 21:58 |
| openstackgerrit | Nolan Brubaker proposed openstack/openstack-ansible: Add upgrade config change tools https://review.openstack.org/285564 | 21:59 |
| *** KLevenstein has quit IRC | 22:07 | |
| *** raddaoui has joined #openstack-ansible | 22:10 | |
| bgmccollum | he'll be back...he always comes back. | 22:15 |
| Nepoc | Well some mild success... though I have no idea why the certificates are not valid with the ca imported. | 22:20 |
| openstackgerrit | Nolan Brubaker proposed openstack/openstack-ansible: Upgrades: Cleanup RabbitMQ / vhost https://review.openstack.org/272652 | 22:25 |
| *** keedya has quit IRC | 22:34 | |
| admin0 | so for galera, in env.d, i see galera_container: belongs to: infra_containers and shared-infra_containers .. so i can remove those 2 lines, and put say belongs to: galera_phsical_host, and then in the user_config, put galera_physical_host: ? | 22:37 |
| admin0 | is that how its mapped ? | 22:37 |
| stevelle | not exactly. we need better docs for the skeleton | 22:38 |
| admin0 | help me understand and i will write the docs :D | 22:42 |
| admin0 | i want to have a section called mysql_hosts: | 22:42 |
| admin0 | and for that, i need to do galera_container: belongs to mysql_hosts and in properties is_metal = true :D | 22:43 |
| stevelle | you want galera on the host instead of in a container? | 22:45 |
| admin0 | yes sir | 22:45 |
| *** raddaoui has quit IRC | 22:45 | |
| stevelle | https://github.com/openstack/openstack-ansible/blob/master/etc/openstack_deploy/env.d/galera.yml#L30 add "is_metal = true" as a property | 22:45 |
| stevelle | that should do it just like it did for haproxy | 22:46 |
| admin0 | but in haproxy, we have haproxy_hosts | 22:47 |
| stevelle | rather : instead of = | 22:48 |
| admin0 | and how/under what heading do I specify the hosts | 22:48 |
| admin0 | because the mysql server will be doign just mysql .. no other infra services there | 22:48 |
| *** neillc_ is now known as neillc | 22:49 | |
| admin0 | mysql will not be a part of infra_hosts or shared_infra_hosts | 22:49 |
| admin0 | galera_container: belongs to galera_containers , and in user_config, galera_hosts: ? | 22:51 |
| admin0 | right now, say galera, rabbit and memcache ,, all belong to infra_containers and shared-infra_containers .. suppose, I want to install them on metal on a different host that is not a part of the infra .. in that case, I do need to create that new group right ? | 22:54 |
| *** abitha has joined #openstack-ansible | 22:55 | |
| stevelle | ok, the symmetry isn't there so it's a little messy | 22:56 |
| stevelle | trying to work out the simplest model | 22:56 |
| admin0 | http://pastebin.com/YSph7AYe — like this ? | 22:57 |
| stevelle | first I would use galera_hosts instead of database_hosts for consistency | 22:58 |
| admin0 | yes for only galera, .. suppose if i want to run memcache, rabbit and mysql on a group of servers on metal , i can do something like high_mem_ssd_hosts on openstack_user_config .. and on each service i want to run, do the belong to: high_mem_ssd_container ..and is_metal: true | 23:00 |
| admin0 | is that how mapping is done ? | 23:00 |
| stevelle | ditto for database_containers | 23:00 |
| stevelle | you can't just make up a name without defining it somewhere else | 23:00 |
| admin0 | so there is a third file also where mapping is used ? .. i thought it was just beteen the env.d and user_config | 23:01 |
| admin0 | *between | 23:01 |
| stevelle | Where Things Live are defined by the merge of: openstack_user_config.yml and conf.d/* | 23:02 |
| stevelle | What Things goes to the openstack_environment.yml and env.d/* | 23:02 |
| stevelle | that much you get | 23:02 |
| stevelle | if a label is used in the Where side, you must define it in the What side | 23:02 |
| Nepoc | Yeah I made a custom node ovs_hosts, I had to enter it into env.d and openstack_user_config.yml | 23:04 |
| admin0 | stevelle: .. so is this understanding correct then? http://pastebin.com/Xy3PYNcF | 23:05 |
| stevelle | hmm, not quite yet | 23:06 |
| stevelle | still piecing together something to show you | 23:06 |
| admin0 | ko | 23:06 |
| admin0 | ok | 23:06 |
| Nepoc | http://pastebin.com/h40sJCpk | 23:06 |
| Nepoc | I'll laugh if that's not supposed to work :) | 23:07 |
| admin0 | Nepoc: .. i get the openstack_user_config.yml bit .. but i do not see where what is using the ovs_hosts ? | 23:08 |
| stevelle | Nepoc and admin0: this is my equivalent to adding a new os_* service for either bare metal or containered. similar to your ovs. https://github.com/stevelle/openstack-ansible-gnocchi/tree/master/ext/openstack_deploy | 23:08 |
| stevelle | but I'll go back to building my etherpad to show you | 23:08 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:08 | |
| Nepoc | The playbook determines what uses which hosts | 23:09 |
| stevelle | https://etherpad.openstack.org/p/ZhfQsOBkwp | 23:10 |
| *** Bjoern_ has quit IRC | 23:12 | |
| *** skamithi has quit IRC | 23:12 | |
| admin0 | i see it .. so no matter what you do, the infra_containers and shared-infra_containers is always evaluated .. | 23:13 |
| Nepoc | for galera the playbook shows hosts: galera_all | 23:15 |
| Nepoc | So you can define something new that is part of galera_all | 23:15 |
| Nepoc | physical_skel: | 23:16 |
| Nepoc | my_galera_hosts: | 23:16 |
| Nepoc | belongs_to: | 23:16 |
| Nepoc | - galera_all | 23:16 |
| Nepoc | oops | 23:16 |
| Nepoc | spam | 23:16 |
| Nepoc | Unless I'm just wrong, but I "believe" it works | 23:17 |
| Nepoc | It will also add it to anything under shared-infra_hosts if I'm not mistaken | 23:20 |
| Nepoc | So everything that is grouped by the shared-infra_hosts you would need to break out I think | 23:23 |
| admin0 | cat haproxy.yml | sed 's/haproxy/highRAM_SSD/g' > env.d/highRAM_SSD.yml # \o/ \o/ \o/ | 23:23 |
| admin0 | and then use the highRAM_SSD_hosts: mapping :D ? | 23:24 |
| admin0 | definately not a thing for friday evening chat :) | 23:24 |
| Nepoc | haha | 23:27 |
| Nepoc | no probably not... speaking of which I've been at the office for longer than I can remember. Time to go home | 23:27 |
| admin0 | i was thinking to run database on metal directly on DB_HOSTS ( say for example ) and instead of infra_hosts, create new group called NEUTRON_HOSTS (which physically have different network cards that do checksum offloading) .. .. so 1 new group for metal, 1 new group for containers ( both not infra, shared etc ) .. | 23:27 |
| admin0 | this is difficult to grasp :D | 23:27 |
| Nepoc | Yeah I bashed my head into the wall a few times getting it into my head | 23:28 |
| Nepoc | anyways! Have a good weekend everyone! | 23:28 |
| stevelle | Nepoc: may have given you a good lead there | 23:28 |
| admin0 | :) | 23:29 |
| stevelle | somewhere between the pad and that you should find something | 23:29 |
| stevelle | just doing and adhoc ansible -m ping of the highRAM_SSD_hosts group should help you see how you're doing along the way | 23:30 |
| *** johnmilton has joined #openstack-ansible | 23:30 | |
| admin0 | stevelle, so to create cotainers on specialized hosts, say NEUTRON_HOSTS, i can cat/sed/replace os-infra.yml to NEUTON-HOSTS.yml right ? that creates the new contianer-group and i just map services to this group via user_config.yml .. for is_metal:true stuff, I just do the physical_skel ? | 23:31 |
| admin0 | i will understand if there is a workign example of the new files or new groups | 23:31 |
| stevelle | running the galera nodes on metal really wouldn't necessarily buy you much would it? | 23:31 |
| stevelle | so long as it's on the right hardware | 23:32 |
| admin0 | well, i am an integrator/consultant .. there are customers who have ( thier awesome dba team/department ) insisting that all DB needs to be on X hardware | 23:32 |
| *** retreved has quit IRC | 23:33 | |
| stevelle | yeah, it would be on that hardware, just running chrooted :) | 23:33 |
| stevelle | not like there is a big virtualization cost there | 23:33 |
| admin0 | but as soon as I understnad this mapping . i think i can map anything anywhere :D | 23:33 |
| admin0 | you want it in your hardware sir, why not .. let me re-map for you .. viola . done | 23:33 |
| admin0 | :D | 23:33 |
| stevelle | not my problem | 23:34 |
| admin0 | yeah | 23:34 |
| stevelle | so service by service in env.d just point it at the right parent | 23:35 |
| admin0 | well in my ofice, i need the mysql on a high-io stuff, and the neutron containers on a dedicated hosts which have better cards for checksum offloading | 23:35 |
| admin0 | so trying to understand this mapping better | 23:35 |
| stevelle | and create the right parents as you're saying by defining the structure similar to os-infra or shared-infra files | 23:35 |
| admin0 | will use example of haproxy for is_metal possibility services | 23:35 |
| admin0 | and will us example of os_infra for the neutron group | 23:36 |
| admin0 | and see if it works | 23:36 |
| admin0 | the etherpad was useful | 23:36 |
| *** skamithi13 has quit IRC | 23:36 | |
| * admin0 gives a big pizza to stevelle | 23:36 | |
| stevelle | g/l | 23:37 |
| admin0 | err.. whats a g/l ? | 23:37 |
| stevelle | good luck | 23:37 |
| admin0 | :D | 23:37 |
| admin0 | thanks | 23:37 |
| admin0 | how do devs undstand all this ? | 23:38 |
| admin0 | is this a yml thing :D ? | 23:38 |
| admin0 | or a anisble thing | 23:39 |
| admin0 | or a rackspace/nasa thing :D | 23:39 |
| stevelle | application of copious amounts of salt fat sugar and often alcohol until the concepts penetrate | 23:39 |
| stevelle | ymmv | 23:40 |
| *** skamithi13 has joined #openstack-ansible | 23:40 | |
| * admin0 goes to gulp redlabel whiskey | 23:40 | |
| admin0 | Nepoc: banging the head in the wall was not the way :D .. need alcohol and sugar | 23:40 |
| stevelle | just different forms of the same stuff there | 23:41 |
| Nepoc | lol | 23:42 |
| admin0 | stevelle: this mapping concept will not change soon right ? i spend weeks to let it penetrate and viola .. changed in the next patch :D | 23:42 |
| Nepoc | I don't drink and rarely consume sugar... the wall was the best option | 23:42 |
| stevelle | admin0: I'm not aware of a plan to change it this week. No guarantees for what might happen in June | 23:43 |
| stevelle | we won't likely be reducing the flexibility | 23:44 |
| admin0 | and i left puppet and ceph thinking its in ansible . how hard could it be :D | 23:44 |
| admin0 | https://github.com/stevelle/openstack-ansible-gnocchi/tree/master/ext/openstack_deploy seems to help | 23:46 |
| stevelle | good | 23:50 |
| *** sdake has quit IRC | 23:53 | |
| *** sdake_ has joined #openstack-ansible | 23:53 | |
| stevelle | \o out | 23:56 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!