| *** tosky has quit IRC | 00:05 | |
| *** udesale has joined #openstack-ansible | 03:55 | |
| *** evrardjp has quit IRC | 05:33 | |
| *** evrardjp has joined #openstack-ansible | 05:33 | |
| *** dave-mccowan has quit IRC | 05:34 | |
| *** cshen has joined #openstack-ansible | 07:44 | |
| *** soren has joined #openstack-ansible | 07:46 | |
| soren | Does anyone happen to know why the letsencrypt integration in the haproxy_server role doesn't use the letsencrypt module from Ansible? | 07:47 |
|---|---|---|
| *** sep has quit IRC | 08:03 | |
| *** sep has joined #openstack-ansible | 08:03 | |
| *** bverschueren has joined #openstack-ansible | 08:10 | |
| *** rpittau|afk is now known as rpittau | 08:39 | |
| *** DanyC has joined #openstack-ansible | 08:47 | |
| jrosser | soren: I think because it needs to set up a cron to continually refresh the very rather than obtain/deploy it in a one-off manner with ansible | 08:54 |
| jrosser | *refresh the cert | 08:54 |
| *** DanyC has quit IRC | 08:59 | |
| *** electrofelix has joined #openstack-ansible | 09:03 | |
| *** DanyC has joined #openstack-ansible | 09:09 | |
| *** DanyC has quit IRC | 09:20 | |
| *** DanyC has joined #openstack-ansible | 09:24 | |
| soren | jrosser: Hm. Yeah, that's a good point. | 09:30 |
| soren | I'm pretty new to Ansible, so I may be thinking about this all wrong.. I'm making some changes to the haproxy_server role. I have two tasks and in between those two tasks, I need to run another task in the Horizon containers. How do I do that? I thought delegate_to was what I needed, but that doesn't let me specify a group, only a host. | 09:33 |
| soren | I read a suggestion somewhere to add a task with "delegate_to: 127.0.0.1" that simply invokes ansible-playbook. That would certainly work, but it feels wrong. | 09:36 |
| *** jawad_axd has joined #openstack-ansible | 09:43 | |
| jrosser | soren: that sounds like you are orchestrating some changes between haproxy and horizon..... the haproxy role shouldnt really know anything about horizon | 09:45 |
| jrosser | what are you trying to do? | 09:45 |
| soren | I have multiple infrastructure nodes. I want them to have unique letsencrypt certs. This means I need to run the first phase of the letsencrypt module on the haproxy nodes to generate the ACME challenges, then I need to install these on the Horizon nodes so that they are available for verification by letsencrypt, and then I need to run the second phase of the letsencrypt module to trigger the verification. | 09:47 |
| soren | Alternatively, I need to set up another webserver just for this purpose, but that feels like overkill. | 09:47 |
| soren | jrosser: ^ | 09:50 |
| jrosser | soren: well, i don't know - is that the right thing to do? | 09:52 |
| soren | jrosser: What, set up another web server? | 09:53 |
| jrosser | i mean having multiple difference LE certs | 09:53 |
| soren | jrosser: In a sense, yes. You could still need SSL certs, even if you're not running Horizon. | 09:53 |
| soren | Yes, that's the right thing to do. You shouldn't ever share private keys between servers. | 09:53 |
| *** pcaruana has joined #openstack-ansible | 09:53 | |
| jrosser | and setting up another web server makes a single point of failure which all of this haproxy/keepalived stuff is designed to eliminate | 09:54 |
| soren | People do all the time. I've done it, too, but I'm trying to do this the right way :) | 09:54 |
| soren | jrosser: Oh, not another server like that. | 09:54 |
| soren | jrosser: Just another web server process the can serve the files. | 09:54 |
| jrosser | what about everything thats not horizon? that is just one of many api endpoints served by SSL | 09:55 |
| soren | And said web server would also need to live on all the infrastructure nodes, because the verification request from letsencrypt could hit any one of them. | 09:55 |
| soren | jrosser: Yes, but only Horizon makes is easy to just add some flat files to be served. | 09:56 |
| soren | jrosser: But as I mentioned just before, running Horizon is not a requirement. Without Horizon, you'd still need SSL certs for all the other endpoints. That's a good reason to not rely on Horizon for this. | 09:57 |
| soren | ...but the alternative is running another webserver process to simply serve these files. It just feels like massive overkill. | 09:58 |
| jrosser | haproxy is doing the ssl termination | 09:58 |
| jrosser | not the web server serving horizon | 09:58 |
| soren | I know. | 09:58 |
| soren | Not sure where you're going with that :) | 09:59 |
| jrosser | i guess i just totally don't understand what you are trying to achieve | 10:00 |
| soren | Ok. | 10:00 |
| soren | I want to use letsenrypt to generate my ssl certs. I have multiple infrastructure nodes. Only one of them currently has the public VIP managed by keepalived. This means only one of them can succesfully complete the letsencrypt verification. | 10:01 |
| soren | Makes sense so far? | 10:01 |
| jrosser | and the current approach with certbot is insufficient? | 10:02 |
| soren | Yes. | 10:02 |
| soren | For several reasons: | 10:02 |
| soren | 1. It takes down haproxy to do the verification. | 10:02 |
| soren | 2. Since only one node has the public VIP managed by keepalived, only one node can succesfully complete the verification. The others will fail. | 10:03 |
| soren | ...because they also tear down haproxy and try to serve up the response to the ACME challenge, but since they don't currently have the vip, the verification request from letsencrypt will not find the correct challenge response. | 10:04 |
| jawad_axd | @jrosser : I am planning os update in OSA environment..A thing to clarify. I have stein environment on centos7.. python 2.7 is what I have now on all management/compute nodes... In case of OS update..if python is upgraded to 3.6 then will it break the environment ? Should I keep the same python version..till I upgrade to TRAIN ? | 10:04 |
| jrosser | soren: well that seems like a bug in the design | 10:06 |
| soren | jrosser: *Exactly* | 10:06 |
| jrosser | but modifying the content in the backend horizon servers feels equally wrong | 10:06 |
| soren | What do you mean? | 10:07 |
| soren | What content? | 10:07 |
| soren | Oh. | 10:07 |
| soren | Sorry. | 10:07 |
| soren | Misread "horizon". | 10:07 |
| soren | Yeah. I know it's not ideal. I just kinda needed this to work yesterday :) | 10:07 |
| soren | And throwing these files on horizon's webroot seemed a heck of a lot easier than adding another webserver process somewhere. | 10:08 |
| jrosser | horizon is optional | 10:08 |
| soren | Yes, I'm aware. | 10:08 |
| soren | I've pointed out more than once that that's a good reason not to rely on it. | 10:09 |
| jrosser | jawad_axd: you should be OK on centos7 with python2.7 for train | 10:10 |
| *** pcaruana has quit IRC | 10:11 | |
| jawad_axd | @jrosser Thanks | 10:11 |
| *** pcaruana has joined #openstack-ansible | 10:12 | |
| jrosser | soren: it seems that haproxy can be convinced to serve a static file, or do some lua tricks | 10:12 |
| jrosser | that might be a better approach | 10:12 |
| soren | jrosser: You can trick it into serving one file by abusing its http error handler. I guess using Lua, I could do more. | 10:13 |
| jrosser | https://discourse.haproxy.org/t/how-do-i-serve-a-single-static-file-from-haproxy/32/11 | 10:14 |
| noonedeadpunk | mornings | 10:18 |
| soren | I'm not convinced that works. | 10:18 |
| *** gokhani has joined #openstack-ansible | 10:19 | |
| soren | a) TTBOMK haproxy chroots, so it wouldn't at runtime be able to read those files. | 10:20 |
| soren | b) io.* shouldn't (can't?) be invoked at runtime, but only at initialization time. | 10:20 |
| soren | Anyway. I'll play around some. Thanks for your input. | 10:20 |
| noonedeadpunk | outerrim: hm, http://paste.openstack.org/show/788058/ - that is weird... What I have in my sandbox is: http://paste.openstack.org/show/788073/ | 10:26 |
| *** aedc has joined #openstack-ansible | 10:32 | |
| *** cshen has quit IRC | 10:32 | |
| noonedeadpunk | and actually from one stein prod http://paste.openstack.org/show/788074/ | 10:33 |
| noonedeadpunk | so maybe we have a bug somewhere, or maybe there's smth wrong in your env.d? | 10:34 |
| noonedeadpunk | ups, looks like we don't have an appripriate tempest test neither for heat nor for magnum... https://72ff4c45cca76c771f66-bf1557974eaea0470e1cf519ed1ae972.ssl.cf1.rackcdn.com/701038/1/check/openstack-ansible-deploy-aio_metal-ubuntu-bionic/e33047d/logs/openstack/aio1-utility/stestr_results.html | 10:42 |
| *** outerrim23 has joined #openstack-ansible | 11:12 | |
| *** udesale has quit IRC | 11:16 | |
| *** admin0 has quit IRC | 11:33 | |
| *** cshen has joined #openstack-ansible | 11:44 | |
| *** outerrim23 has left #openstack-ansible | 11:55 | |
| *** gshippey has joined #openstack-ansible | 12:07 | |
| *** cshen has quit IRC | 12:19 | |
| *** cshen has joined #openstack-ansible | 12:40 | |
| *** ansmith has quit IRC | 12:43 | |
| *** outerrim has quit IRC | 13:05 | |
| *** outerrim has joined #openstack-ansible | 13:06 | |
| outerrim | q | 13:08 |
| *** outerrim has quit IRC | 13:08 | |
| *** outerrim has joined #openstack-ansible | 13:09 | |
| outerrim | @noonedeadpunk: Mybe I miss something, but for some services there is (still) a reference to os-infra_*, like https://opendev.org/openstack/openstack-ansible/src/branch/master/inventory/env.d/nova.yml#L44 | 13:15 |
| noonedeadpunk | hm, and nova_api_placement shouldn't be there as well... | 13:16 |
| noonedeadpunk | I think we should do some clean up then... | 13:17 |
| *** mgariepy has quit IRC | 13:21 | |
| *** joshualyle has joined #openstack-ansible | 13:39 | |
| *** joshualyle has quit IRC | 13:40 | |
| *** ahosam has joined #openstack-ansible | 13:46 | |
| *** goldyfruit_ has quit IRC | 13:54 | |
| *** tosky has joined #openstack-ansible | 14:01 | |
| *** ansmith has joined #openstack-ansible | 14:03 | |
| *** admin0 has joined #openstack-ansible | 14:03 | |
| *** goldyfruit_ has joined #openstack-ansible | 14:13 | |
| *** mgariepy has joined #openstack-ansible | 14:17 | |
| *** schwicht has joined #openstack-ansible | 14:18 | |
| *** ahosam has quit IRC | 14:20 | |
| openstackgerrit | Dmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible master: Deploy heat with magnum https://review.opendev.org/701233 | 14:27 |
| *** aedc has quit IRC | 14:51 | |
| *** aedc has joined #openstack-ansible | 14:51 | |
| *** jftalta has joined #openstack-ansible | 14:52 | |
| *** jawad_axd has quit IRC | 14:58 | |
| *** jawad_axd has joined #openstack-ansible | 14:59 | |
| *** goldyfruit_ has quit IRC | 14:59 | |
| *** goldyfruit_ has joined #openstack-ansible | 14:59 | |
| *** jawad_axd has quit IRC | 15:04 | |
| *** aedc_ has joined #openstack-ansible | 15:08 | |
| *** aedc has quit IRC | 15:12 | |
| *** goldyfruit_ has quit IRC | 15:16 | |
| *** jftalta has quit IRC | 15:47 | |
| *** jftalta has joined #openstack-ansible | 15:48 | |
| *** electrofelix has quit IRC | 15:56 | |
| *** cshen has quit IRC | 16:04 | |
| *** jawad_axd has joined #openstack-ansible | 16:08 | |
| *** jawad_axd has quit IRC | 16:09 | |
| *** arxcruz is now known as arxcruz|off | 16:11 | |
| *** gyee has joined #openstack-ansible | 16:15 | |
| *** ahosam has joined #openstack-ansible | 16:46 | |
| *** tosky has quit IRC | 16:46 | |
| *** jftalta has quit IRC | 16:54 | |
| *** rpittau is now known as rpittau|afk | 16:58 | |
| *** nicolasbock has joined #openstack-ansible | 17:12 | |
| *** sshnaidm is now known as sshnaidm|afk | 17:31 | |
| *** evrardjp has quit IRC | 17:33 | |
| *** evrardjp has joined #openstack-ansible | 17:33 | |
| *** ahosam has quit IRC | 17:39 | |
| *** pcaruana has quit IRC | 18:07 | |
| *** mhayden has quit IRC | 18:10 | |
| *** mhayden has joined #openstack-ansible | 18:11 | |
| *** outerrim has quit IRC | 18:12 | |
| *** nicolasbock has quit IRC | 18:15 | |
| *** DanyC_ has joined #openstack-ansible | 18:25 | |
| *** DanyC_ has quit IRC | 18:27 | |
| *** DanyC has quit IRC | 18:28 | |
| *** DanyC has joined #openstack-ansible | 18:38 | |
| openstackgerrit | Merged openstack/openstack-ansible master: Bump SHAs for master https://review.opendev.org/700747 | 18:38 |
| openstackgerrit | Merged openstack/openstack-ansible stable/stein: Bump SHAs for stable/stein https://review.opendev.org/700750 | 18:38 |
| *** DanyC has quit IRC | 18:43 | |
| *** cloudnull has quit IRC | 19:16 | |
| *** cloudnull has joined #openstack-ansible | 19:17 | |
| *** gshippey has quit IRC | 19:27 | |
| *** ianychoi has quit IRC | 20:04 | |
| *** dave-mccowan has joined #openstack-ansible | 20:17 | |
| *** ianychoi has joined #openstack-ansible | 20:19 | |
| *** mhayden has quit IRC | 20:30 | |
| *** mhayden has joined #openstack-ansible | 20:45 | |
| *** tosky has joined #openstack-ansible | 20:55 | |
| *** mhayden has quit IRC | 20:58 | |
| *** mhayden has joined #openstack-ansible | 21:00 | |
| *** zbr has quit IRC | 21:05 | |
| *** zbr has joined #openstack-ansible | 21:09 | |
| *** zbr has quit IRC | 21:14 | |
| *** zbr has joined #openstack-ansible | 21:32 | |
| *** ansmith has quit IRC | 21:37 | |
| *** zbr_ has joined #openstack-ansible | 21:38 | |
| *** zbr has quit IRC | 21:39 | |
| *** zbr_ has quit IRC | 22:02 | |
| *** zbr has joined #openstack-ansible | 22:03 | |
| *** zbr has quit IRC | 22:25 | |
| *** asettle has quit IRC | 22:42 | |
| *** ansmith has joined #openstack-ansible | 23:03 | |
| *** zbr has joined #openstack-ansible | 23:04 | |
| *** zbr has quit IRC | 23:09 | |
| *** zbr_ has joined #openstack-ansible | 23:09 | |
| *** zbr_ has quit IRC | 23:14 | |
| *** schwicht has quit IRC | 23:15 | |
| *** zbr has joined #openstack-ansible | 23:22 | |
| *** tosky has quit IRC | 23:23 | |
| *** mhayden has quit IRC | 23:23 | |
| *** schwicht has joined #openstack-ansible | 23:53 | |
| *** KeithMnemonic has quit IRC | 23:56 | |
| *** KeithMnemonic has joined #openstack-ansible | 23:57 | |
| *** KeithMnemonic has quit IRC | 23:58 | |
| *** KeithMnemonic has joined #openstack-ansible | 23:58 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!