| *** sshnaidm has quit IRC | 00:06 | |
| *** sshnaidm has joined #openstack-ansible | 00:07 | |
| *** ahosam has quit IRC | 00:08 | |
| *** ianychoi_ has joined #openstack-ansible | 00:09 | |
| *** ianychoi has quit IRC | 00:11 | |
| *** macz has quit IRC | 00:17 | |
| *** DanyC has quit IRC | 00:21 | |
| *** schwicht has quit IRC | 00:26 | |
| openstackgerrit | Mohammed Naser proposed openstack/openstack-ansible-os_neutron master: Update vpnaas rootwrap filters https://review.opendev.org/702311 | 00:36 |
|---|---|---|
| openstackgerrit | Mohammed Naser proposed openstack/openstack-ansible-os_neutron stable/train: Update vpnaas rootwrap filters https://review.opendev.org/702312 | 00:37 |
| openstackgerrit | Mohammed Naser proposed openstack/openstack-ansible-os_neutron stable/stein: Update vpnaas rootwrap filters https://review.opendev.org/702313 | 00:38 |
| openstackgerrit | Mohammed Naser proposed openstack/openstack-ansible-os_neutron stable/rocky: Update vpnaas rootwrap filters https://review.opendev.org/702314 | 00:39 |
| *** nicolasbock has quit IRC | 01:18 | |
| *** gyee has quit IRC | 01:34 | |
| *** schwicht has joined #openstack-ansible | 03:47 | |
| *** macz has joined #openstack-ansible | 03:56 | |
| *** udesale has joined #openstack-ansible | 04:21 | |
| *** jhesketh has quit IRC | 04:23 | |
| *** jhesketh has joined #openstack-ansible | 04:24 | |
| *** macz has quit IRC | 05:06 | |
| *** macz has joined #openstack-ansible | 05:07 | |
| *** evrardjp has quit IRC | 05:33 | |
| *** evrardjp has joined #openstack-ansible | 05:34 | |
| *** schwicht has quit IRC | 05:52 | |
| *** macz has quit IRC | 06:06 | |
| *** pcaruana has quit IRC | 06:17 | |
| *** elenalindq has joined #openstack-ansible | 06:34 | |
| *** hamzy has quit IRC | 06:49 | |
| *** hamzy has joined #openstack-ansible | 06:50 | |
| *** rgogunskiy has joined #openstack-ansible | 07:39 | |
| *** cshen has joined #openstack-ansible | 07:40 | |
| *** tosky has joined #openstack-ansible | 08:08 | |
| *** zbr|rover has quit IRC | 08:14 | |
| *** zbr has joined #openstack-ansible | 08:16 | |
| *** shyamb has joined #openstack-ansible | 08:20 | |
| *** DanyC has joined #openstack-ansible | 08:53 | |
| *** pcaruana has joined #openstack-ansible | 08:56 | |
| *** shyamb has quit IRC | 09:02 | |
| *** shyamb has joined #openstack-ansible | 09:04 | |
| *** rpittau|afk is now known as rpittau | 09:16 | |
| *** shyamb has quit IRC | 09:46 | |
| *** ygk_12345 has joined #openstack-ansible | 10:23 | |
| *** pcaruana has quit IRC | 10:23 | |
| *** CeeMac has joined #openstack-ansible | 10:30 | |
| CeeMac | morning | 10:31 |
| ygk_12345 | can anyonen tell me how to bypass the default repo container for installing packages thru apt in the OSA ? | 10:31 |
| ygk_12345 | i am trying to install mysqldb library for python in the utility contianer but its not installing it saying appropriate version not found | 10:32 |
| ygk_12345 | pip -vvv install MySQL-python | 10:32 |
| ygk_12345 | could not find a version that satisfies the requirement MySQL-python (from versions: ) | 10:33 |
| ygk_12345 | Could not fetch URL http://example.com:8181/simple/mysql-python/: 404 Client Error: Not Found for url: http://example.com:8181/simple/mysql-python/ - skipping | 10:33 |
| *** yolanda has joined #openstack-ansible | 10:37 | |
| ygk_12345 | can anyone let me know if the mysql-python pkg is already installed in OSA ? | 10:49 |
| ygk_12345 | i dont find it | 10:50 |
| *** shyamb has joined #openstack-ansible | 10:53 | |
| *** pcaruana has joined #openstack-ansible | 11:02 | |
| *** rpittau is now known as rpittau|bbl | 11:11 | |
| noonedeadpunk | ygk_12345: do you mean distro install or source one? I think it might be placed inside virtualenvs for packages that do require it | 11:15 |
| noonedeadpunk | for distro install I'm not really sure - worth checking | 11:16 |
| ygk_12345 | noonedeadpunk i am able to install the pkg now. Thanks to CeeMac. However when I try connecting to it through the python, it is refusing the connection, but when I just say mysql at the command prompt of util container, it is logging in | 11:17 |
| ygk_12345 | donno why ? | 11:17 |
| ygk_12345 | how to connect using the python connector ? | 11:17 |
| ygk_12345 | i am trying the python stuff from the util contianer itself | 11:18 |
| noonedeadpunk | so mysql command is provided by mysql_client distro package | 11:18 |
| ygk_12345 | yes | 11:18 |
| noonedeadpunk | But this package do not provide any python library - if you need one, it should be installed independently. | 11:19 |
| ygk_12345 | db = MySQLdb.connect("localhost","root","heat" ) is failing | 11:19 |
| ygk_12345 | import MySQLdb is successful | 11:20 |
| noonedeadpunk | You can either create a separate virtualenv for your application (which is probably the safest recommended option), try to use utility virtualenv, or install package for system python | 11:20 |
| ygk_12345 | i have already installed the pkg | 11:20 |
| ygk_12345 | now the connection is the problem | 11:20 |
| noonedeadpunk | I think you shoulkd connect not to localhost but to external vip | 11:20 |
| ygk_12345 | ok let me try | 11:20 |
| noonedeadpunk | *internal | 11:20 |
| ygk_12345 | ok | 11:21 |
| ygk_12345 | >>> db = MySQLdb.connect("172.29.236.9","root","heat") | 11:22 |
| ygk_12345 | mysql_exceptions.OperationalError: (1045, "Access denied for user 'root'@'example.cloud' (using password: YES)") | 11:22 |
| ygk_12345 | but from command prompt just a 'mysql' is working and logging me in | 11:23 |
| noonedeadpunk | so .my.cnf file should be placed in /root which provides login credentials | 11:23 |
| ygk_12345 | it is in the root already | 11:24 |
| ygk_12345 | how do I use it in the MySQLdb.connect ? | 11:24 |
| noonedeadpunk | you can just use the same credentials provided there (or you may try to parse it with configparser) | 11:25 |
| ygk_12345 | ahh it worked now | 11:26 |
| ygk_12345 | thanks | 11:26 |
| *** udesale has quit IRC | 11:28 | |
| *** shyam89 has joined #openstack-ansible | 11:29 | |
| *** shyam89 has quit IRC | 11:30 | |
| *** shyam89 has joined #openstack-ansible | 11:30 | |
| *** shyamb has quit IRC | 11:32 | |
| *** shyam89 has quit IRC | 12:08 | |
| *** DanyC has quit IRC | 12:20 | |
| *** DanyC has joined #openstack-ansible | 12:29 | |
| *** ygk_12345 has left #openstack-ansible | 12:37 | |
| *** ansmith has quit IRC | 12:42 | |
| *** DanyC_ has joined #openstack-ansible | 12:59 | |
| *** DanyC__ has joined #openstack-ansible | 13:01 | |
| *** DanyC has quit IRC | 13:02 | |
| *** DanyC_ has quit IRC | 13:05 | |
| openstackgerrit | Merged openstack/openstack-ansible-os_neutron master: Update vpnaas rootwrap filters https://review.opendev.org/702311 | 13:15 |
| openstackgerrit | Merged openstack/openstack-ansible-os_tempest stable/stein: Fix stackwiz venv pip install args https://review.opendev.org/700817 | 13:15 |
| *** schwicht has joined #openstack-ansible | 13:22 | |
| *** rpittau|bbl is now known as rpittau | 13:26 | |
| *** ansmith has joined #openstack-ansible | 13:28 | |
| *** schwicht has quit IRC | 13:29 | |
| *** schwicht has joined #openstack-ansible | 13:30 | |
| *** shyamb has joined #openstack-ansible | 13:37 | |
| openstackgerrit | Dmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible master: [WIP] ceph-mds setup https://review.opendev.org/702424 | 13:42 |
| *** DanyC has joined #openstack-ansible | 13:53 | |
| *** schwicht has quit IRC | 13:54 | |
| *** DanyC__ has quit IRC | 13:55 | |
| *** shyamb has quit IRC | 13:59 | |
| *** DanyC has quit IRC | 14:10 | |
| openstackgerrit | Merged openstack/ansible-role-uwsgi master: Test linters with integrated repo https://review.opendev.org/679245 | 14:24 |
| *** schwicht has joined #openstack-ansible | 14:29 | |
| *** udesale has joined #openstack-ansible | 14:30 | |
| guilhermesp | noonedeadpunk: i guess -w can be removed? https://review.opendev.org/#/c/702135/ | 14:34 |
| noonedeadpunk | why so? I was thinking about backporting https://review.opendev.org/#/c/702234/ and adding that sha to the bump | 14:35 |
| guilhermesp | or we want the rootwrap oh ok, it is not verified yet, i miss that | 14:36 |
| noonedeadpunk | Or we can leave that fix for the next bump.... | 14:36 |
| guilhermesp | repheasing: ok, i missed that patch is not verified | 14:37 |
| noonedeadpunk | yeah, I'd bump vpn staff as well, but it's not so critical for ppl | 14:37 |
| noonedeadpunk | as horizon is | 14:37 |
| *** gokhani has quit IRC | 14:41 | |
| *** sshnaidm is now known as sshnaidm|mtg | 14:44 | |
| *** DanyC has joined #openstack-ansible | 14:50 | |
| *** DanyC has joined #openstack-ansible | 14:51 | |
| *** vesper has quit IRC | 14:53 | |
| *** vesper11 has joined #openstack-ansible | 14:53 | |
| *** DanyC has quit IRC | 15:10 | |
| *** fyx has quit IRC | 15:13 | |
| *** rgogunskiy has quit IRC | 15:17 | |
| *** fyx has joined #openstack-ansible | 15:17 | |
| *** tacco has joined #openstack-ansible | 15:18 | |
| tacco | hi there.. what is the recomended way of doing a galera cluster backup? | 15:18 |
| tacco | i guess simple mysqldump won't help much. | 15:18 |
| *** DanyC has joined #openstack-ansible | 15:26 | |
| openstackgerrit | Merged openstack/openstack-ansible-os_horizon master: Make use of horizon_git_track_branch https://review.opendev.org/702234 | 15:34 |
| *** udesale_ has joined #openstack-ansible | 15:34 | |
| *** schwicht has quit IRC | 15:35 | |
| *** udesale has quit IRC | 15:37 | |
| *** fyx has quit IRC | 15:48 | |
| openstackgerrit | Dmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_horizon stable/train: Make use of horizon_git_track_branch https://review.opendev.org/702464 | 15:50 |
| *** fyx has joined #openstack-ansible | 15:51 | |
| noonedeadpunk | tacco: actually myslqdump also works :) but ofc it's better to use mariabackup tool https://mariadb.com/kb/en/mariabackup/ | 15:52 |
| *** cshen has quit IRC | 15:54 | |
| noonedeadpunk | #startmeeting openstack_ansible_meeting | 16:02 |
| openstack | Meeting started Tue Jan 14 16:02:06 2020 UTC and is due to finish in 60 minutes. The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot. | 16:02 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 16:02 |
| *** openstack changes topic to " (Meeting topic: openstack_ansible_meeting)" | 16:02 | |
| openstack | The meeting name has been set to 'openstack_ansible_meeting' | 16:02 |
| noonedeadpunk | #topic office hours | 16:02 |
| *** openstack changes topic to "office hours (Meeting topic: openstack_ansible_meeting)" | 16:02 | |
| openstackgerrit | Dmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_horizon stable/stein: Make use of horizon_git_track_branch https://review.opendev.org/702467 | 16:10 |
| *** theintern_ has joined #openstack-ansible | 16:12 | |
| *** arxcruz is now known as arxcruz|off | 16:13 | |
| noonedeadpunk | anyone for meeting? | 16:14 |
| *** elenalindq has quit IRC | 16:16 | |
| *** elenalindq has joined #openstack-ansible | 16:16 | |
| *** dave-mccowan has joined #openstack-ansible | 16:17 | |
| *** rh-jelabarre has joined #openstack-ansible | 16:17 | |
| guilhermesp | o/ | 16:29 |
| guilhermesp | late i guess :P | 16:29 |
| noonedeadpunk | not so much:) | 16:29 |
| guilhermesp | so currently we are waiting https://review.opendev.org/#/c/702135/ to release 20.0.0.1? | 16:30 |
| noonedeadpunk | I kinda have the same question regarding backporting py3 centos 7 stuff into train... | 16:30 |
| noonedeadpunk | 20.0.1 | 16:30 |
| noonedeadpunk | Yes, I think we should wait for horizon patch to merge, as it's pretty serious bugfix | 16:31 |
| guilhermesp | it's merged https://review.opendev.org/#/c/702234/ | 16:31 |
| guilhermesp | so we need to backport it to train | 16:31 |
| noonedeadpunk | It;s already backported https://review.opendev.org/#/c/702464/1 | 16:31 |
| guilhermesp | nohttps://review.opendev.org/#/c/702234/ | 16:31 |
| guilhermesp | yes | 16:31 |
| noonedeadpunk | also I was thinking about freezing calico version and setting some tag with manual updates. | 16:32 |
| *** hamzy has quit IRC | 16:33 | |
| noonedeadpunk | As they are instantly breaking pbr and installation by SHA (or from master) by assigning several tags on the same commit | 16:33 |
| noonedeadpunk | so https://review.opendev.org/#/c/702313/1 is not going to merge because of it | 16:34 |
| noonedeadpunk | Or we can backport setting it to non-voting ofc... | 16:34 |
| guilhermesp | hum.. not sure tbh... that's a fix for those who uses vpnaas and as this bug stands for a long time means no one is using vpnaas. | 16:36 |
| *** dave-mccowan has quit IRC | 16:36 | |
| noonedeadpunk | fix for vpnaas, yes, but we do not test vpnaas, but we do test calico driver. | 16:36 |
| noonedeadpunk | https://bugs.launchpad.net/networking-calico/+bug/1849110 | 16:37 |
| openstack | Launchpad bug 1849110 in networking-calico "Tagging several versions on a single commit breaks installation" [Undecided,New] | 16:37 |
| *** dave-mccowan has joined #openstack-ansible | 16:38 | |
| openstackgerrit | Dmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_manila master: Add manila CI https://review.opendev.org/675934 | 16:41 |
| *** gyee has joined #openstack-ansible | 16:42 | |
| openstackgerrit | Dmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_manila master: Add manila CI https://review.opendev.org/675934 | 16:43 |
| *** udesale_ has quit IRC | 16:43 | |
| *** schwicht has joined #openstack-ansible | 16:46 | |
| *** macz has joined #openstack-ansible | 16:54 | |
| *** rpittau is now known as rpittau|afk | 17:01 | |
| jrosser | i think thats a good idea about freezing the networking-calico SHA | 17:06 |
| jrosser | becasue this is happening a lot and they don't actually seem to change the code much, just put on a lot of tags to match the upstream service, i think | 17:06 |
| noonedeadpunk | yeah, this how I feel it as well... | 17:07 |
| noonedeadpunk | #endmeeting | 17:07 |
| *** openstack changes topic to "Launchpad: https://launchpad.net/openstack-ansible || Weekly Meetings: https://wiki.openstack.org/wiki/Meetings/openstack-ansible || Review Dashboard: http://bit.ly/2xA1eZC" | 17:07 | |
| openstack | Meeting ended Tue Jan 14 17:07:56 2020 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 17:07 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/openstack_ansible_meeting/2020/openstack_ansible_meeting.2020-01-14-16.02.html | 17:07 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/openstack_ansible_meeting/2020/openstack_ansible_meeting.2020-01-14-16.02.txt | 17:08 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/openstack_ansible_meeting/2020/openstack_ansible_meeting.2020-01-14-16.02.log.html | 17:08 |
| jrosser | sorry for lateness btw! | 17:08 |
| *** ryan3 has joined #openstack-ansible | 17:09 | |
| noonedeadpunk | you actually didn't miss anything :p | 17:10 |
| ryan3 | Hey all had a question about how to configure my openstack ansible deploy for stein. I'm using the NFS backend for cinder but I'm noticing that cinder isn't getting the nova configuration which I think I need for getting snapshots to work. | 17:15 |
| ryan3 | I'm running qcow2 on NFS. | 17:15 |
| ryan3 | Looking for a way to tell the ansible deploy to create a role or user for cinder so it can talk to nova | 17:17 |
| noonedeadpunk | ryan3: so cinder has it's own 'cinder' user in keystone with kinda 'admin' privileges (assigned to service project') | 17:20 |
| openstackgerrit | Dmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible master: Set fixed version for networking-calico https://review.opendev.org/702488 | 17:20 |
| ryan3 | I'm probably missing something but I wasn't able to get a snapshot to process until I manually put https://pastebin.com/X26eX81K in the cinder config. | 17:22 |
| noonedeadpunk | ok, you can use config overrides so ansible would place that block of code for you | 17:23 |
| noonedeadpunk | with cinder_cinder_conf_overrides variable | 17:24 |
| ryan3 | I was trying to avoid doing that since I'd have to generate that stanza | 17:24 |
| ryan3 | Is there a place in the ansible config I can say cinder gets nova access? or something | 17:25 |
| noonedeadpunk | You can use cinder credentials in that section | 17:25 |
| noonedeadpunk | Actually, I thought that providing keystone_authtoken should be enough (with setting interface in nova section) | 17:26 |
| noonedeadpunk | even more - most of these params are not valid for [nova] section accoording to cinder docs | 17:28 |
| noonedeadpunk | If default do not work for you - you can provide auth_section and set it to keystone_authtoken | 17:29 |
| noonedeadpunk | ryan3: have you changed region name to some custom one? | 17:30 |
| ryan3 | I have not changed the region | 17:30 |
| noonedeadpunk | Just in paste you have "region_name = region" - that's why I've asked | 17:31 |
| ryan3 | ah yeah sorry I guess I didn't need to change that part lol | 17:31 |
| ryan3 | so when you say auth_section to keystone_authtoken where is that getting set? | 17:32 |
| noonedeadpunk | Anyway like providing username and password seems not to be supported options for this section according to https://docs.openstack.org/cinder/stein/configuration/block-storage/config-options.html#id7 | 17:32 |
| ryan3 | oh I see it | 17:33 |
| ryan3 | yeah looks like my config is just wrong | 17:33 |
| *** hamzy has joined #openstack-ansible | 17:33 | |
| *** evrardjp has quit IRC | 17:33 | |
| *** evrardjp has joined #openstack-ansible | 17:34 | |
| ryan3 | ok I think I see what you're saying | 17:35 |
| ryan3 | so I use overrides to make the [nova] stanza and set auth-section to keystone_authtoken | 17:35 |
| ryan3 | if I'm reading this correctly | 17:35 |
| ryan3 | that's all in the cinder.conf | 17:36 |
| *** elenalindq has quit IRC | 17:37 | |
| noonedeadpunk | Yep | 17:44 |
| ryan3 | https://pastebin.com/RNv3avVY | 17:44 |
| ryan3 | so I put that in and restarted cinder | 17:44 |
| ryan3 | seem to be back to throwing the original error | 17:45 |
| noonedeadpunk | and how keystone_authtoken section does look like? As it seems nothing to do with nova section.... | 17:46 |
| *** theintern_ has quit IRC | 17:46 | |
| ryan3 | ah crap yeah I found the problem | 17:46 |
| ryan3 | my vip is throwing ssl errors now | 17:46 |
| ryan3 | I guess specifying http instead of https was the reason my original config worked | 17:47 |
| noonedeadpunk | Yeah, that might be the case | 17:47 |
| noonedeadpunk | so generally you don't need to add anything into nova section | 17:47 |
| noonedeadpunk | for cinder.conf | 17:48 |
| noonedeadpunk | so you can set backend to http or set "insecure = True" to ignore ssl errors | 17:48 |
| ryan3 | Ah ok | 17:48 |
| *** DanyC_ has joined #openstack-ansible | 17:50 | |
| *** DanyC_ has quit IRC | 17:50 | |
| *** DanyC has quit IRC | 17:53 | |
| *** elenalindq has joined #openstack-ansible | 17:54 | |
| ryan3 | hey @noonedeadpunk thanks for the help | 17:55 |
| noonedeadpunk | you're welcome | 17:55 |
| *** sshnaidm|mtg is now known as sshnaidm|afk | 18:00 | |
| *** elenalindq has quit IRC | 18:01 | |
| *** theintern_ has joined #openstack-ansible | 18:15 | |
| *** ahosam has joined #openstack-ansible | 18:33 | |
| *** theintern_ has quit IRC | 18:47 | |
| *** theintern_ has joined #openstack-ansible | 18:59 | |
| *** pcaruana has quit IRC | 19:16 | |
| *** macz has quit IRC | 19:50 | |
| *** macz has joined #openstack-ansible | 19:51 | |
| *** theintern_ has quit IRC | 20:05 | |
| *** hamzy_ has joined #openstack-ansible | 20:08 | |
| *** hamzy has quit IRC | 20:11 | |
| *** gshippey has quit IRC | 20:23 | |
| *** rgogunskiy has joined #openstack-ansible | 20:26 | |
| *** hamzy__ has joined #openstack-ansible | 20:43 | |
| *** hamzy_ has quit IRC | 20:46 | |
| *** hamzy_ has joined #openstack-ansible | 20:51 | |
| *** hamzy__ has quit IRC | 20:53 | |
| *** rgogunskiy has quit IRC | 20:54 | |
| *** eat_those_lemons has joined #openstack-ansible | 20:58 | |
| *** hamzy__ has joined #openstack-ansible | 21:02 | |
| *** hamzy_ has quit IRC | 21:04 | |
| *** hamzy_ has joined #openstack-ansible | 21:10 | |
| eat_those_lemons | could anyone help me with the `internal_lb_vip_address`? I cant seem to figure out the syntax and am stuck at that particular step of: | 21:13 |
| eat_those_lemons | https://docs.openstack.org/project-deploy-guide/openstack-ansible/latest/run-playbooks.html | 21:13 |
| eat_those_lemons | #5 | 21:13 |
| *** hamzy__ has quit IRC | 21:13 | |
| eat_those_lemons | openstack-ansible setup-openstack.yml | 21:13 |
| openstackgerrit | Merged openstack/openstack-ansible-os_neutron stable/train: Update vpnaas rootwrap filters https://review.opendev.org/702312 | 21:16 |
| *** hamzy has joined #openstack-ansible | 21:22 | |
| *** hamzy_ has quit IRC | 21:23 | |
| jrosser | eat_those_lemons: i have the defined that as internal_lb_vip_address: 10.11.128.30 | 21:24 |
| jrosser | where thats the ipv4 address i have chosen for the internal VIP in my lab | 21:24 |
| eat_those_lemons | I have that chosen I thought in the openstack_user_config.yml file however `openstack-ansible setup-openstack.yml` complains that that variable is not set | 21:26 |
| *** ansmith has quit IRC | 21:26 | |
| eat_those_lemons | using (can put it in a paste if you want but for just 2 lines seems overkill) | 21:26 |
| eat_those_lemons | global_overrides: | 21:26 |
| eat_those_lemons | internal_lb_vip_address: 10.0.0.51 | 21:27 |
| eat_those_lemons | although that is the actual ip of the machine | 21:27 |
| *** ryan3 has quit IRC | 21:27 | |
| eat_those_lemons | so assuming I need to setup vlans first? (have only one NIC on each machine so no separate management network (assuming that is what the vip network is the management network)) | 21:27 |
| *** ryan3 has joined #openstack-ansible | 21:39 | |
| *** schwicht has quit IRC | 21:40 | |
| ryan3 | Is there an configuration setting in openstack-ansible stein to set the deploy to not use TLS on the internal and external vip? | 21:42 |
| *** hamzy_ has joined #openstack-ansible | 21:50 | |
| ryan3 | Basically due to limitations with the load balancer I'm using I can't do some of the ports required for TLS termination | 21:51 |
| eat_those_lemons | jrosser: I am working on setting up the vlans just was trying to get a test setup before hand | 21:51 |
| eat_those_lemons | ryan3: what loadbalancer are you using? | 21:51 |
| ryan3 | it's the load balancers provided by gcp | 21:52 |
| *** hamzy has quit IRC | 21:53 | |
| eat_those_lemons | ah I don't know about that one unfortunately | 21:53 |
| ryan3 | no worries it's lame | 21:53 |
| eat_those_lemons | is the issue that your services on the openstack instance don't know how to handle the tls from google cloud platform? | 21:53 |
| eat_those_lemons | Assuming that google cloud platform requires all communications to be done with tls | 21:53 |
| ryan3 | no I can't terminate ssl on port 5000 in their service | 21:53 |
| eat_those_lemons | ah | 21:54 |
| ryan3 | they have a list of ports they'll do it on and that's not one | 21:54 |
| eat_those_lemons | why are you using port 5000 for tls? | 21:54 |
| jrosser | eat_those_lemons: if you have more than one controller then the VIP is not one of the IP you have assigned | 21:54 |
| jrosser | it is another IP entirely that is managed/dynamically assigned with keepalived | 21:54 |
| ryan3 | it's the default port for keystone my understanding | 21:54 |
| ryan3 | the "public vip" | 21:54 |
| eat_those_lemons | jrosser: I only have 1 controller | 21:54 |
| jrosser | you do need to have some kind of mgmt network | 21:55 |
| eat_those_lemons | so should just be the ip that I statically set with dnsmasq? | 21:55 |
| eat_those_lemons | ie separate management network? | 21:55 |
| jrosser | have you run an all-in-one? | 21:56 |
| eat_those_lemons | I have not run an all on one machine I am attempting a multi-node deployment, physical machines for: controller, storage, compute, router | 21:57 |
| eat_those_lemons | trying to follow this guide | 21:57 |
| eat_those_lemons | https://magicalyak.org/openstack-multi-node-with-single-nic/ | 21:57 |
| eat_those_lemons | and the openstack-ansible guide | 21:57 |
| eat_those_lemons | https://docs.openstack.org/project-deploy-guide/openstack-ansible/rocky/index.html | 21:57 |
| ryan3 | I'm running 5 controllers and keepalive is also not an option since gcp doesn't actually allow any layer 2 control in the vm | 21:58 |
| eat_those_lemons | don't have the vlans setup yet though | 21:58 |
| eat_those_lemons | just wanted a test setup before the vlans | 21:58 |
| ryan3 | which is making this ansible deploy hard since it either wants an external vip or to run haproxy and keepalived | 21:58 |
| *** hamzy_ has quit IRC | 21:58 | |
| eat_those_lemons | ryan3: your saying between the vm's within google cloud you cant use port 5000 for tls terminations? | 21:59 |
| ryan3 | gcp ssl termination isn't possible at all on port 5000 | 21:59 |
| ryan3 | they don't support it | 21:59 |
| *** hamzy has joined #openstack-ansible | 21:59 | |
| jrosser | eat_those_lemons: i would recommend that you start with this https://docs.openstack.org/openstack-ansible/train/user/aio/quickstart.html | 22:00 |
| ryan3 | since this is all on private ips anyways I sort of want to just turn off deploying expecting SSL | 22:00 |
| ryan3 | is that possible? | 22:00 |
| eat_those_lemons | josser: ie use that setup for verifying configurations and then move to multi-node? | 22:01 |
| jrosser | that setup is the one that is run many times per day as part of the openstack-ansible development process | 22:02 |
| jrosser | and also serves as a reference config | 22:03 |
| *** ansmith has joined #openstack-ansible | 22:03 | |
| jrosser | all our CI jobs to merge code must run that successfully | 22:03 |
| eat_those_lemons | so should be able to pull the configs from there directly into a multi-node deployment? | 22:03 |
| jrosser | eat_those_lemons: to a degree yes because you are not proposing an HA setup so the controller is fairly similar to an AIO | 22:04 |
| jrosser | but the all-in-one creates it's own networking environment all behind one IP which is ideal for a test setup, but less so for multinode | 22:05 |
| *** hamzy_ has joined #openstack-ansible | 22:06 | |
| eat_those_lemons | So sounds like I would learn less than I was hoping for with the AIO since I need to still learn the networking portion and the configuration would need to be changed for the networking correctly? | 22:06 |
| jrosser | you would instead be wanting a cut down version of this https://github.com/openstack/openstack-ansible/blob/master/etc/openstack_deploy/openstack_user_config.yml.prod.example | 22:06 |
| *** hamzy has quit IRC | 22:09 | |
| jrosser | i think i would be sticking as close to the reference config as possible, particularly if you want to learn all the networking stuff | 22:10 |
| eat_those_lemons | ah so base my config on prod.example instead of the openstack_user_config.yml.example | 22:10 |
| eat_those_lemons | so basically only modify the networking portion of prod.example | 22:11 |
| eat_those_lemons | makes sense | 22:11 |
| jrosser | there is a production network config here https://github.com/openstack/openstack-ansible/blob/master/etc/network/interfaces.d/openstack_interface.cfg.prod.example | 22:11 |
| jrosser | which you can strip out the bits you maybe don't need like the bonds | 22:11 |
| jrosser | but the idea there is you lay down the same interfaces across all your nodes and make everything look the same | 22:11 |
| eat_those_lemons | I have been trying to base things on the yam.example which I assume doesn't have a correct config to base off of | 22:12 |
| eat_those_lemons | got it | 22:12 |
| eat_those_lemons | do you know if there is a netplan version of this for ubuntu? Or do you run all your systems on a debian image that still has interfaces.d | 22:13 |
| eat_those_lemons | ? | 22:13 |
| jrosser | openstack_user_config.yml.example is also ok, but you need to fill out yourseld | 22:13 |
| jrosser | it's up to you how you configure the networking, OSA doesnt care so long as the required br-mgmt, br-storage as per the documentation are there | 22:13 |
| jrosser | though some poeple have had a good experience with netplan, others have not | 22:14 |
| eat_those_lemons | ah so don't start with example start with prod.example got it | 22:14 |
| eat_those_lemons | It looks like the example scripts all use ifupdown instead of netplan so will just use ifupdown | 22:14 |
| jrosser | you can use the old type network interface files on bionic by installing ifupdown | 22:14 |
| eat_those_lemons | what os do you run on? | 22:15 |
| jrosser | personally on ubuntu bionic but we also have a fair few folk on centos | 22:15 |
| jrosser | eat_those_lemons: OSA doesnt try to interfere with any host provisioning or ideas the deployer might have about how the network is setup | 22:17 |
| eat_those_lemons | do you have anyone on strait debian? | 22:17 |
| jrosser | a lot of that is left up to you deliberalty as everyone has a different use case | 22:18 |
| eat_those_lemons | strait debian is my OS of choice but seems that isn't very common | 22:18 |
| eat_those_lemons | so don't want to stray too much of the beaten path for a first setup | 22:18 |
| eat_those_lemons | especially a hobby project one | 22:18 |
| jrosser | that does make it difficult to provide a one-size-fits-all deployment but the production examples are the best starting point | 22:18 |
| openstackgerrit | Merged openstack/openstack-ansible stable/rocky: Bump SHAs for stable/rocky https://review.opendev.org/700748 | 22:19 |
| jrosser | you can see here an example of the deployments that are tested in CI https://review.opendev.org/#/c/702135/ | 22:20 |
| jrosser | so we validate the deployment on stretch and buster today for the train branch, but i'm not sure how many people are using that for real | 22:20 |
| eat_those_lemons | so it is tested just might not be used kind of thing? | 22:21 |
| jrosser | i would be confident that you could deploy the AIO and it would work, becasue those CI jobs have to pass a full test suite | 22:21 |
| jrosser | and by extension a multinode should be OK | 22:21 |
| jrosser | there are gotchas at scale though like no official packages for ceph for modern debians | 22:22 |
| jrosser | which perhaps keeps people from switching | 22:23 |
| eat_those_lemons | official packages for? | 22:23 |
| eat_those_lemons | ie which components will I probably have issues with? | 22:23 |
| jrosser | for you probably nothing with 4 nodes | 22:24 |
| jrosser | but if you were building a storage cluster with https://ceph.io/ceph-storage/ and wanted to use debian things are maybe not so straightforward | 22:24 |
| eat_those_lemons | ah I do want to use ceph | 22:24 |
| eat_those_lemons | so good to know | 22:24 |
| jrosser | but only one node? | 22:24 |
| eat_those_lemons | well hopefully will be more nodes eventually | 22:25 |
| eat_those_lemons | I have 2 san arrays I hope to populate when I get more time so hope to have HA | 22:25 |
| eat_those_lemons | Its kinda overkill but want to eventually have a HA deployment | 22:25 |
| jrosser | given that you have 4 nodes, the more commonly trodden path is for 3 controllers | 22:25 |
| jrosser | if you are planning to expand | 22:26 |
| eat_those_lemons | I am more hoping to expand kinda depends on the homelab wife approval factor lol | 22:26 |
| eat_those_lemons | 3 controllers for a HA deployment? | 22:26 |
| eat_those_lemons | so jump from 1 to 3? | 22:26 |
| jrosser | for a HA control plane | 22:27 |
| eat_those_lemons | if I expand | 22:27 |
| eat_those_lemons | ah | 22:27 |
| eat_those_lemons | good to know | 22:27 |
| jrosser | 1 to 3 isnt an obvious just becasue you need to reconfigure a bunch of stuff | 22:27 |
| jrosser | no keepalived -> keepalived, move the VIP, blah blah blah | 22:27 |
| eat_those_lemons | sounds like ceph likes 3 nodes, and controllers like 3 nodes | 22:28 |
| eat_those_lemons | no keepalived -> keepalived? huh? | 22:28 |
| eat_those_lemons | so do don't use keepalived? | 22:28 |
| jrosser | for one controller thats not used, and the internal/external IP are actually on your interfaces | 22:28 |
| jrosser | as soon as you go >1 controller that all changes | 22:28 |
| eat_those_lemons | what does that change to? | 22:29 |
| eat_those_lemons | or is that a really should just expand storage and compute if I expand don't worry about controllers? | 22:29 |
| jrosser | keepalived owns the virtual IP and it floats between the controllers | 22:29 |
| eat_those_lemons | since it sounds like the architecture changes | 22:29 |
| eat_those_lemons | ah | 22:29 |
| eat_those_lemons | so each controller has an ip but the "virtual horizion ip" is passed around? | 22:30 |
| jrosser | but really, try the AIO :) | 22:30 |
| jrosser | yes thats right, it's the IP for all the API endpoints, and horizon if you deploy that | 22:31 |
| eat_those_lemons | It sounds like the AIO won't give me knowlege for setting up a multinode deployment, should I still do an AIO? | 22:31 |
| jrosser | up to you - if you want to understand how OSA works without having to get all that other stuff completely right, then fiddle with an AIO for a bit | 22:32 |
| eat_those_lemons | ah ie the networking is done so don't have to worry about that can just learn osa | 22:33 |
| eat_those_lemons | got it | 22:33 |
| eat_those_lemons | makes sense | 22:33 |
| jrosser | yes, it does all that and makes a bunch of loopback devices to fake up the storage | 22:33 |
| eat_those_lemons | so the storage "seems" redundant? | 22:34 |
| jrosser | so you get a potted envinroment thats trivally small, but functional | 22:34 |
| eat_those_lemons | makes sense | 22:35 |
| eat_those_lemons | is there a good place to learn the networking side of Openstack? or is it just a know it already and/or figure it out? | 22:35 |
| eat_those_lemons | well should have looked first lol | 22:36 |
| eat_those_lemons | seems there is quite a bit of information on the docs | 22:36 |
| eat_those_lemons | although looks like it might not have everything I need to know | 22:36 |
| jrosser | the docs should give you a reference design based on a bunch of vlans | 22:36 |
| jrosser | the docs should match very very closely what is in the example configs | 22:37 |
| jrosser | ^ the OSA docs | 22:38 |
| eat_those_lemons | would this be a doc you would recommend? | 22:39 |
| eat_those_lemons | https://docs.openstack.org/neutron/train/admin/ | 22:39 |
| eat_those_lemons | and https://docs.openstack.org/openstack-ansible/12.2.6/install-guide/overview-hostnetworking.html | 22:40 |
| jrosser | that tells you about the neutron service itself | 22:40 |
| jrosser | that is old docs | 22:41 |
| jrosser | https://docs.openstack.org/project-deploy-guide/openstack-ansible/latest/targethosts.html#configuring-the-network | 22:41 |
| jrosser | also here https://docs.openstack.org/openstack-ansible/latest/user/network-arch/example.html | 22:42 |
| eat_those_lemons | oh you mean just the small networking portion on the deploy guide? | 22:42 |
| eat_those_lemons | I assumed it would be a many many page document/book | 22:43 |
| eat_those_lemons | good to know it is much smaller than that | 22:43 |
| jrosser | here is an example almost totally like yours https://docs.openstack.org/openstack-ansible/latest/user/test/example.html | 22:43 |
| eat_those_lemons | well the stuff that I need to know assumed I needed the neutron docs | 22:43 |
| jrosser | like i say neutron docs tell you about the neutron service itself | 22:44 |
| jrosser | none of that will tell you the practicalities of building an actual deployment | 22:44 |
| jrosser | thats the value-add of projects like openstack-ansible | 22:44 |
| eat_those_lemons | that makes sense | 22:44 |
| eat_those_lemons | so if you want deployment information look at osa docs if you want internal documentation look at openstack ones? | 22:45 |
| jrosser | osa is one choice with a certain set of goals, there are others like tripleo and kolla that take variously different approaches | 22:45 |
| jrosser | there isn't one univerally agreed tool or architecture for deploying this stuff | 22:46 |
| eat_those_lemons | fair enough | 22:46 |
| eat_those_lemons | so would you say that tripleo, kolla and ansible are alternatives/competitors? Ie they for the most part are sovling the same issues with different results/architectures? | 22:47 |
| jrosser | pretty much | 22:48 |
| * jrosser calls it a day here, late | 22:49 | |
| eat_those_lemons | Thanks for all your help jrosser! | 22:49 |
| eat_those_lemons | it really helped pointing me in the right direction! | 22:50 |
| jrosser | no worries, good luck :) | 22:50 |
| eat_those_lemons | thanks! :) | 22:50 |
| *** j^2 has quit IRC | 22:56 | |
| *** tosky has quit IRC | 23:15 | |
| *** hwoarang has quit IRC | 23:15 | |
| *** hwoarang has joined #openstack-ansible | 23:22 | |
| *** hamzy_ has quit IRC | 23:38 | |
| *** ahosam has quit IRC | 23:55 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!