| *** frenzy_friday is now known as frenzyfriday|rover | 03:00 | |
| *** frenzy_friday is now known as frenzyfriday|rover | 07:44 | |
| *** frenzy_friday is now known as frenzyfriday|rover | 10:01 | |
| *** frenzy_friday is now known as frenzyfriday|rover | 10:51 | |
| *** dviroel|out is now known as dviroel | 11:22 | |
| mgariepy | admin1, did you find what is causing your issue with horizon? | 12:32 |
|---|---|---|
| admin1 | mgariepy, i actually did a tcpdump capture .. intend to start on it in the next 30 mins to figure out where its stuck | 12:33 |
| mgariepy | for galera what is your max connection ? | 12:33 |
| admin1 | 6000 | 12:41 |
| mgariepy | is it a new deployment or an upgrade? | 12:55 |
| gokhani | Hi folks, I wonder can I use zfs pool shared with nfs for nova vm disks and do you recommend this? | 13:06 |
| noonedeadpunk | #startmeeting openstack_ansible_meeting | 15:04 |
| opendevmeet | Meeting started Tue Mar 8 15:04:18 2022 UTC and is due to finish in 60 minutes. The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:04 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:04 |
| opendevmeet | The meeting name has been set to 'openstack_ansible_meeting' | 15:04 |
| damiandabrowski[m] | hi! | 15:04 |
| noonedeadpunk | #topic office hours | 15:04 |
| noonedeadpunk | Hey! | 15:04 |
| noonedeadpunk | Sorry, I'm not really around right now as clean forgot about meeting and in the middle of shopping mall now :D | 15:05 |
| noonedeadpunk | I guess main questions is CI functional tests that I failed to suggest poc for to compare with jrosser idea | 15:06 |
| damiandabrowski[m] | haha, that's a dedication :D | 15:06 |
| NeilHanlon | hehe | 15:06 |
| jamesdenton | morninm | 15:06 |
| noonedeadpunk | Then Rocky patch seems super close, just blocked with collection issue | 15:07 |
| noonedeadpunk | And we have keystone scopes to figure out at least for Y | 15:07 |
| noonedeadpunk | And tempest stuff is still blocked I bet | 15:08 |
| noonedeadpunk | I will try to proceed with some topics this week for real now | 15:08 |
| noonedeadpunk | But now I need to search for belongings my son dropped all over mall :D | 15:09 |
| noonedeadpunk | Feel free to discuss stuff and endmeeting | 15:10 |
| noonedeadpunk | :) | 15:10 |
| damiandabrowski[m] | I'll also plan to focus on OSA(mainly tempest patches) next week | 15:10 |
| NeilHanlon | thanks noonedeadpunk! :) | 15:10 |
| noonedeadpunk | Great! | 15:10 |
| noonedeadpunk | I guess question is also if we want to backport rocky support to Xena? | 15:11 |
| noonedeadpunk | As changes were quite trivial? | 15:11 |
| NeilHanlon | yeah i think I'd like to if it's relatively easy | 15:12 |
| noonedeadpunk | Yeah, I think it should be doable at least if we say it's experimental | 15:13 |
| NeilHanlon | cool, i'll take a look at that this week if I can | 15:14 |
| noonedeadpunk | #endmeeting | 15:56 |
| opendevmeet | Meeting ended Tue Mar 8 15:56:41 2022 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:56 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/openstack_ansible_meeting/2022/openstack_ansible_meeting.2022-03-08-15.04.html | 15:56 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/openstack_ansible_meeting/2022/openstack_ansible_meeting.2022-03-08-15.04.txt | 15:56 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/openstack_ansible_meeting/2022/openstack_ansible_meeting.2022-03-08-15.04.log.html | 15:56 |
| jrosser | noonedeadpunk: on CI functional tests i had some ideas about making molecule stuff more manageable. However i can't spend any time on it at all until next week. | 16:07 |
| *** dviroel is now known as dviroel|lunch | 16:57 | |
| jamesdenton | johnsom Do you know offhand what might be causing this error when creating a TERMINATED_HTTPS listener? "The selected protocol is not allowed in this deployment: TERMINATED_HTTPS" | 16:57 |
| jamesdenton | This is Ussuri, fwiw | 16:57 |
| johnsom | jamesdention. Yes, on minute | 16:58 |
| johnsom | jamesdention https://docs.openstack.org/octavia/latest/configuration/configref.html#api_settings.allow_tls_terminated_listeners | 16:58 |
| agemuend | Hi jrosser. You once said you worked considerably on openstack-ansible-os_keystone. I hope it's okay if I ask a question here. | 16:59 |
| jrosser | agemuend: my team did a lot of work on OIDC integration | 17:00 |
| *** frenzyfriday|rover is now known as frenzyfriday|pto | 17:00 | |
| jamesdenton | doh! thanks, johnsom | 17:00 |
| johnsom | NP | 17:00 |
| agemuend | We'd like to set OIDCOAuthIntrospectionEndpoint, OIDCOAuthClientID and OIDCOAuthClientSecret in addition to the OIDC counterparts to allow CLI auth. How could we best achieve that as they are not supported by the role directly? | 17:01 |
| agemuend | Its to support the EGI "Federated Cloud", a federation of academic Cloud sites in the wider European Open Science Cloud (EOSC) effort, if you're interested in the background | 17:02 |
| jrosser | we did CLI using PKCE | 17:03 |
| jrosser | https://github.com/bbc/keystoneauth-oidc | 17:04 |
| agemuend | Oh its interesting that this is forked from IFCA, as they are part of the initiative I'm talking about | 17:05 |
| jrosser | ok | 17:06 |
| jrosser | we were not happy using a client secret for CLI users | 17:06 |
| jrosser | the client secret is really for trusted server<>server use cases | 17:07 |
| jrosser | though CLI is "hard" so client secrets are abused for that | 17:07 |
| jrosser | it would be great to upstream our changed back to the IFCA repo | 17:07 |
| jrosser | *changes | 17:07 |
| jrosser | we have an architecture where keycloak is the IdP, and we have in integration between keycloak and horizon for GUI, and we enable PKCE on keycloak to enable CLI users without needing a client secret | 17:08 |
| jrosser | PKCE dynamically generates the equivalent of a client secret on demand, so it is ephemeral | 17:09 |
| agemuend | Interesting | 17:09 |
| agemuend | The federation suggests the client secret for the introspection endpoint though: https://docs.egi.eu/providers/cloud-compute/openstack/aai/#apache-configuration | 17:10 |
| jrosser | have you checked this out? https://docs.openstack.org/openstack-ansible-os_keystone/latest/configure-federation-sp.html#service-provider-configuration-for-oidc-using-mod-auth-openidc | 17:10 |
| agemuend | Yes, but the variables I mentioned are not part of that list | 17:11 |
| agemuend | I guess for now we need to hardcode the variables into the keystone-httpd.conf.j2 | 17:14 |
| jrosser | well | 17:14 |
| jrosser | we are talking about openid-connect, or oauth2 ? | 17:15 |
| jrosser | the options in the role already have been completely sufficent to do horizon and CLI between openstack ans keycloak using OIDC | 17:15 |
| jrosser | this is all sufficuently complex that i'm likley confused with what you are needing to do | 17:18 |
| jrosser | agemuend: also see the warning here https://github.com/zmartzone/mod_auth_openidc/blob/master/auth_openidc.conf#L322-L334 | 17:22 |
| agemuend | probably I'm misunderstanding something. I was judging from the comment in that reference config I linked to, which says "# OAuth for CLI access" | 17:24 |
| agemuend | Interesting thanks | 17:26 |
| jrosser | right yes interesting, the egi docs use --os-auth-type v3oidcaccesstoken | 17:26 |
| jrosser | and we used --os-auth-type v3oidccode | 17:27 |
| jrosser | so there are two completely different OIDC flows involved there | 17:27 |
| jrosser | if you need support for those other variables then it should be easy to create a patch for os_keystone to support those | 17:27 |
| jrosser | the patch would look something like this https://github.com/openstack/openstack-ansible-os_keystone/commit/3b283edf8a2c2d51236631a9fcd9b3f5f744f6ed | 17:29 |
| jrosser | agemuend: i suspect that the OIDC code flow + PKCE is a more modern variant on OIDC + access token, it's probably worth some study on the relative security/benefits of both | 17:30 |
| jrosser | though really it is no problem to support both in the os_keystone role | 17:30 |
| agemuend | Cool, you'd consider the PR? on Github? (never used opendev) | 17:31 |
| jrosser | ah no, you need to submit to gerrit..... theres is just automatic mirroring to github | 17:31 |
| jrosser | if thats too much hassle, create a diff and put it at paste.opendev.org and we can make a patch for you | 17:31 |
| jrosser | a diff against master | 17:32 |
| jrosser | for gerrit workflow see this https://docs.opendev.org/opendev/infra-manual/latest/gettingstarted.html | 17:32 |
| agemuend | Okay cool, thx | 17:34 |
| agemuend | We'll take a stab at the Gerrit workflow tomorrow, I guess its good to get acquainted with that | 17:37 |
| jrosser | that would be great if you could | 17:38 |
| *** odyssey4me is now known as Guest1620 | 17:47 | |
| *** dviroel|lunch is now known as dviroel | 17:52 | |
| mgariepy | jrosser, can we push this one ?https://review.opendev.org/c/openstack/openstack-ansible/+/831536/4 | 18:42 |
| jrosser | mgariepy: done | 19:38 |
| mgariepy | thanks | 19:41 |
| mgariepy | should we disable voting on rocky ? | 19:41 |
| mgariepy | :/ failing on dependecy issue while building nova.. | 19:41 |
| mgariepy | https://paste.openstack.org/show/b3Eh0w86aGlAfwYzb01Z/ | 19:43 |
| jrosser | pypowervm 1.1.27 depends on futures>=3.0 / The user requested (constraint) futures===3.0.5 | 19:44 |
| mgariepy | LOL | 19:45 |
| jrosser | i thought that this was fixed by a bump in nova | 19:45 |
| jrosser | i bet we need this first https://review.opendev.org/c/openstack/openstack-ansible/+/830273 | 19:46 |
| mgariepy | ho. wow. the relation chain is somewhat inconsistent accross reviews .. | 19:47 |
| jrosser | yes lets have this merge https://review.opendev.org/c/openstack/openstack-ansible/+/831536/2 | 19:47 |
| jrosser | rather than rease | 19:47 |
| jrosser | rebase | 19:47 |
| jrosser | fix ansible collections -> merge sha bump -> rebase rocky patch | 19:48 |
| jrosser | something like that | 19:48 |
| mgariepy | ok | 20:27 |
| mgariepy | kinda too late now. but at worst for the next patch we maybe can stack them and merge them together. | 20:28 |
| mgariepy | arf. bulleyes failed :( | 20:31 |
| mgariepy | bullseye i meant :( | 20:33 |
| *** odyssey4me is now known as Guest1634 | 21:15 | |
| *** dviroel is now known as dviroel|afk | 22:03 | |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!