| *** dviroel is now known as dviroel|out | 00:20 | |
| gillesMo | Hello ! We're in a move to forbid all root user access on aur servers. I have problems to run openstack-ansible from a standrad user. I see somm tasks in playbooks/roles with "user: root", why not "become: true" ? | 08:34 |
|---|---|---|
| jrosser | gillesMo: that would be an excellent piece of long term work to contribute | 08:35 |
| jrosser | i expect that there are a bunch of corner cases and hidden things that would need to be fixed | 08:38 |
| jrosser | some work was done on the ssh connection plugin to allow become: to work for lxc containers already | 08:38 |
| gillesMo | jrosser: a grep on all the roles shows that it's certainly a long term work :-( | 08:41 |
| jrosser | if it is a priority for you then the best advice i can give is to contribute patches | 08:42 |
| jrosser | and i feel that it is sufficiently subtle that the CI jobs would need to be adjusted to cover this use case as I think that it is easy to overlook something | 08:43 |
| gillesMo | Of course ! but we have an audit very soon, and we will certainly manage an exception for the moment... | 08:43 |
| jrosser | you would have yo grant passwordless sudo to another user, who would need to be able to run any command | 08:44 |
| jrosser | this question does come up a lot in #ansible and the discussion really does always end up at what the actual risk is that is being mitigated, rather than just ticking boxes | 08:44 |
| jrosser | if you are concerned about arbitrary users having permanent access to ssh keys which allow root access to everything, there are other ways to mitigate that other than disallowing root access | 08:45 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/ansible-role-python_venv_build stable/xena: Slurp constraints.txt separately for each host in a batch https://review.opendev.org/c/openstack/ansible-role-python_venv_build/+/830369 | 08:54 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/ansible-role-python_venv_build stable/wallaby: Slurp constraints.txt separately for each host in a batch https://review.opendev.org/c/openstack/ansible-role-python_venv_build/+/830570 | 08:54 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/ansible-role-python_venv_build stable/victoria: Slurp constraints.txt separately for each host in a batch https://review.opendev.org/c/openstack/ansible-role-python_venv_build/+/830571 | 08:54 |
| jrosser | gillesMo: you could probably get a long way through it by working on an lxc AIO deployment in a VM | 09:07 |
| *** dviroel|out is now known as dviroel | 11:26 | |
| lowercase | noonedeadpunk: Last week we talked about enabling fluentd in oslo logging. I made alterations to the config and I'm not getting any different output. In my default config file, I add [loggers], handlers, formatters and hander_fluent. However, I do not see any difference in the logs or an open port 24224 | 13:54 |
| noonedeadpunk | well, that's sad to hear :( tbh I'm even not sure who could be asked for some help regarding that... | 13:55 |
| lowercase | simply adding the use_json param is working for me howevor. Fluentd likes that. | 13:57 |
| jrosser | lowercase: did you also `pip install fluent-logger` ? | 14:07 |
| lowercase | yes | 14:07 |
| jrosser | and debug=true in the config file can help | 14:08 |
| jrosser | pip install inside the nova venv? | 14:09 |
| lowercase | yes, both are true | 14:29 |
| lowercase | i just verified my results. use_json isn't enough to get fluentd to recognize the different fields and break apart the json. fluentd escapes all of the quotes, invaliding the json. | 14:31 |
| lowercase | "{\"message\": \"Creating TransportKeyController\", \"asctime\": \"2022-02-23 14:21:18\", \"name\": \"barbican.api.controllers.transportkeys\", \"msg\": \"Creat | 14:31 |
| lowercase | I'm testing with barbican because i can restart the barbi service anytime i want, vs nova i do not have the same luxery. | 14:31 |
| jrosser | this sort of thing is really good to poke at in an AIO | 14:32 |
| jrosser | you can make one in an hour in a VM | 14:32 |
| *** gmann is now known as gmann_afk | 15:59 | |
| jrosser | i have still not any good ideas about testing ansible roles | 16:04 |
| *** gmann_afk is now known as gmann | 16:17 | |
| admin1 | is there a safe way to move from 3x controllers to 1x controller ? | 16:42 |
| admin1 | for rabbitmq and galera | 16:42 |
| admin1 | in one of my cluster, 2 controllers went down ( and not able to recover) | 16:42 |
| jrosser | noonedeadpunk: did this ever work properly? https://review.opendev.org/c/openstack/ansible-role-pki/+/821023 | 16:43 |
| jrosser | i forget what we needed it for, but i have lots of trouble with that and the keystone changes right now | 16:43 |
| noonedeadpunk | I think for galera | 16:45 |
| jrosser | is rejectattr('condition', 'false') even valid? | 16:46 |
| jrosser | i get some error like "no test 'false'" | 16:46 |
| noonedeadpunk | https://opendev.org/openstack/openstack-ansible-galera_server/src/branch/master/defaults/main.yml#L209 | 16:46 |
| jrosser | oh well thats conditional ca | 16:47 |
| noonedeadpunk | says that it is.... https://jinja.palletsprojects.com/en/3.0.x/templates/#jinja-tests.false | 16:48 |
| noonedeadpunk | but it's for jinja 2.11+ only... | 16:48 |
| noonedeadpunk | but u-c says should be 3.0.3 | 16:49 |
| jrosser | oh that explains a lot | 16:50 |
| jrosser | i am doing some basic tests of the pki role in a vanilla focal vm | 16:50 |
| jrosser | and there i have Jinja2==2.10.1 | 16:50 |
| noonedeadpunk | oh | 16:51 |
| noonedeadpunk | does jinja upgrade helps?:) | 16:51 |
| jrosser | well, actually i refactored out the rejectattr just now | 16:51 |
| noonedeadpunk | would be interesting to understand if we did smth wrong or it's just wrong jinja version... | 16:52 |
| jrosser | yes, forcing the version to 3.0.3 makes it work | 16:57 |
| jrosser | i will work on this some more | 16:57 |
| spatel | admin1 can you re-build 2 controller? | 17:22 |
| admin1 | spatel, i cannot.. the m1000e cmc is unresponsive :( .. | 17:45 |
| spatel | i meant fix hardware and build it.. or get new server and do it | 17:45 |
| spatel | :) | 17:45 |
| *** dviroel is now known as dviroel|out | 21:18 | |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!