| jrosser | good morning | 07:39 |
|---|---|---|
| damiandabrowski | hi! | 07:44 |
| jrosser | did we break the distro jobs by updating ansible collection..... | 07:44 |
| jrosser | like here https://zuul.opendev.org/t/openstack/build/18a33263c09d4702a5ba4a510e17c6c6 | 07:44 |
| jrosser | this merged https://review.opendev.org/c/openstack/openstack-ansible/+/878778 | 07:48 |
| jrosser | and then anything related to heat started breaking - that is suspicious as i think heat adds users/roles which may have modules changed | 07:49 |
| noonedeadpunk | mornings | 07:53 |
| noonedeadpunk | Yeah, I found the reason why heat is breaking | 07:53 |
| noonedeadpunk | It's due to supplying empty project here https://opendev.org/openstack/openstack-ansible-os_heat/src/branch/master/tasks/heat_service_setup.yml#L60 | 07:54 |
| noonedeadpunk | and we do this to create a user with domain scope | 07:55 |
| noonedeadpunk | In identity_user module, and now they have condition like that `if default_project_name_or_id is not None` which treats empty string as true | 07:56 |
| noonedeadpunk | regarding distro - I think we will fix that with updating repos to track antelope instead of zed | 07:57 |
| jrosser | i think mgariepy left a comment on that patch | 07:59 |
| noonedeadpunk | "that"? | 08:02 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-os_manila master: Remove unused variable https://review.opendev.org/c/openstack/openstack-ansible-os_manila/+/880026 | 08:04 |
| jrosser | sorry this one https://review.opendev.org/c/openstack/openstack-ansible/+/878235 | 08:05 |
| noonedeadpunk | aha, yes, missed this one | 08:11 |
| jrosser | then this is interesting https://github.com/noonedeadpunk/ansible-role-pacemaker_corosync/blob/master/templates/corosync.conf.j2#L1-L5 | 08:13 |
| jrosser | similar sort of thing that i had in the os_swift role to look at | 08:13 |
| jrosser | and tbh this is one i find more surprising with how the fact vars work | 08:13 |
| noonedeadpunk | btw for adjutant to unblock upgrade jobs we should start from yoga https://review.opendev.org/c/openstack/openstack-ansible-os_adjutant/+/879859 | 08:15 |
| noonedeadpunk | yeah, I've fixed in some places usage of injects, but I missed templates... | 08:15 |
| noonedeadpunk | For heat case I've pushed "trivial" thing to colelctions - https://review.opendev.org/c/openstack/ansible-collections-openstack/+/880027 | 08:16 |
| noonedeadpunk | But we still need to patch service_setup at least for now... | 08:17 |
| noonedeadpunk | As I'm not really sure it will be merged at all | 08:18 |
| jrosser | i can imagine them saying to use omit | 08:19 |
| noonedeadpunk | yeah.... | 08:19 |
| jrosser | so actually, we have most roles working, at least with small/understandable fixes | 08:21 |
| jrosser | for the pacemaker role would be interested to see what you think if the code can be made compatible with inject vars true/false | 08:22 |
| noonedeadpunk | yeah, I already tried yestarday but obviously missed tempaltes https://github.com/noonedeadpunk/ansible-role-pacemaker_corosync/commit/855e21f42cac99dced3417395a0d2f37120830c0 | 08:23 |
| noonedeadpunk | I think I will adjust CI to ensure it works with no injected fact vars | 08:23 |
| noonedeadpunk | Actually, I think that {} is treated in yaml as None, isn't it? Just wonder if there's easy way to trick module to think it's None | 08:25 |
| noonedeadpunk | or maybe null will do the trick... | 08:26 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-plugins master: Workaround failures when project is unset https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/880028 | 08:31 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-plugins master: Workaround failures when project is unset https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/880028 | 08:32 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_heat master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_heat/+/879963 | 08:32 |
| noonedeadpunk | we probably should move corosync role to opendev one day | 08:41 |
| noonedeadpunk | I was just lazy doing so | 08:41 |
| noonedeadpunk | jrosser: hm, do you recall how to workaround when you need a remote host fact rather then inventory_hostname? like here https://github.com/noonedeadpunk/ansible-role-pacemaker_corosync/blob/master/templates/corosync.conf.j2#L44 | 08:49 |
| jrosser | i'll have a look | 08:51 |
| noonedeadpunk | probably I can access ansible_facts through hostvars | 08:55 |
| noonedeadpunk | Ok, that worked indeed :) | 09:02 |
| jrosser | noonedeadpunk: like this https://paste.opendev.org/show/bA5tKoLoe98kguccK7gM/ | 09:05 |
| noonedeadpunk | yeah, exactly... | 09:09 |
| noonedeadpunk | thanks for taking time! | 09:09 |
| jrosser | i think this is a breaking thing isnt it with ANSIBLE_INJECT_FACT_VARS | 09:10 |
| jrosser | how to write code in the role that works both ways | 09:10 |
| noonedeadpunk | but whatever works without injected facts works with them regardless | 09:11 |
| noonedeadpunk | so ansible_facts is always added? | 09:11 |
| jrosser | oh right i was confused | 09:12 |
| jrosser | i was not sure that ansible_facts['eth0'] was always there | 09:13 |
| jrosser | but it is always there | 09:13 |
| jrosser | if thats the case we probably have places that we can simplify a little | 09:14 |
| noonedeadpunk | though I'd start simplification from nova playbook :D | 09:14 |
| noonedeadpunk | but yes :) | 09:14 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Install zuul-provided collections as directories https://review.opendev.org/c/openstack/openstack-ansible/+/880031 | 09:27 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-plugins master: Allow to manage more the one vhost with mq_setup https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/875399 | 09:28 |
| hamidlotfi | https://www.irccloud.com/pastebin/zczps5gf/ | 09:40 |
| jrosser | hamidlotfi: rabbitmq is not using haproxy | 09:42 |
| hamidlotfi | OK right, why putted in the behind of haproxy ? | 09:43 |
| jrosser | hamidlotfi: the haproxy config here is for the rabbitmq managment console https://github.com/openstack/openstack-ansible/blob/master/inventory/group_vars/haproxy/haproxy.yml#L522-L534 | 09:43 |
| jrosser | hamidlotfi: the rabbitmq service is not behind haproxy | 09:43 |
| hamidlotfi | Ok, understand | 09:44 |
| jrosser | the management console is loadbalanced with haproxy, the MQ themself is is a cluster without haproxy | 09:44 |
| hamidlotfi | ohmmm, thanks for your response | 09:45 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_nova master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/880033 | 09:54 |
| noonedeadpunk | hm, octavia looks weirdly off | 10:00 |
| noonedeadpunk | amphora get's stuck in `PENDING_CREATE` | 10:00 |
| noonedeadpunk | https://storage.bhs.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_b88/879988/1/check/openstack-ansible-deploy-aio_metal-ubuntu-jammy/b88a24b/logs/openstack/aio1-utility/stestr_results.html | 10:00 |
| jrosser | https://zuul.opendev.org/t/openstack/build/b88a24b4bb914acdb7da08d08a0437a4/log/logs/openstack/aio1-utility/tempest_run.log.txt#1451-1452 | 10:02 |
| noonedeadpunk | seems like it can't attach port or smth like that | 10:04 |
| noonedeadpunk | like somewhere here https://zuul.opendev.org/t/openstack/build/b88a24b4bb914acdb7da08d08a0437a4/log/logs/host/octavia-worker.service.journal-18-33-15.log.txt#2279 | 10:05 |
| noonedeadpunk | jrosser: what you're reffering is teardown problem | 10:06 |
| noonedeadpunk | but I don't see anything too off in nova logs | 10:11 |
| noonedeadpunk | looks like instance is spawned and no obvious issues there... so maybe there's some connectivity thing to reach amphora... | 10:14 |
| noonedeadpunk | hm, maybe it's because octavia_amp_image_owner_id is not set properly | 10:17 |
| noonedeadpunk | as it's empty https://zuul.opendev.org/t/openstack/build/ead159671dee47dca0748e3d0914f304/log/logs/etc/host/octavia/octavia.conf.txt#83 | 10:17 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_octavia master: Adopt info modules fetch to collection 2.0 https://review.opendev.org/c/openstack/openstack-ansible-os_octavia/+/879988 | 10:37 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_placement master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_placement/+/880036 | 10:42 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_senlin master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_senlin/+/880037 | 10:43 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_senlin master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_senlin/+/880037 | 10:45 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_sahara master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_sahara/+/880038 | 10:46 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_swift master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_swift/+/880040 | 10:47 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_tacker master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_tacker/+/880041 | 10:50 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_trove master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_trove/+/880042 | 10:53 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Install zuul-provided collections as directories https://review.opendev.org/c/openstack/openstack-ansible/+/880031 | 11:00 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_zun master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_zun/+/880043 | 11:02 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_heat master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_heat/+/879963 | 11:11 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible master: Define external_network_id in magnum_cluster_templates https://review.opendev.org/c/openstack/openstack-ansible/+/880047 | 12:00 |
| damiandabrowski | noonedeadpunk: when pushing osa/systemd_restart_on_unit_change patches you might have noticed that magnum gating is broken | 12:02 |
| damiandabrowski | the above patch #880047 along with yours #880027 should hopefully fix it | 12:02 |
| opendevreview | Merged openstack/openstack-ansible-rabbitmq_server stable/zed: Switch rabbitmq repo back to packagecloud https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/879855 | 12:05 |
| noonedeadpunk | damiandabrowski: it's heat that is broken | 12:14 |
| *** dviroel_ is now known as dviroel | 12:14 | |
| noonedeadpunk | https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/880028 should fix it | 12:14 |
| damiandabrowski | so do you think magnum isn't broken? | 12:22 |
| damiandabrowski | https://review.opendev.org/c/openstack/openstack-ansible-os_magnum/+/879922?tab=change-view-tab-header-zuul-results-summary | 12:22 |
| damiandabrowski | https://review.opendev.org/c/openstack/openstack-ansible-os_magnum/+/879970?tab=change-view-tab-header-zuul-results-summary | 12:23 |
| noonedeadpunk | damiandabrowski: magnum does deploy heat before itself | 12:23 |
| noonedeadpunk | so if heat is broken - couple of other roles, like magnum, will also be | 12:23 |
| noonedeadpunk | both of these patches fail before starting magnum | 12:23 |
| noonedeadpunk | or well | 12:24 |
| noonedeadpunk | second is :D | 12:24 |
| noonedeadpunk | first one is different. and yeah... it's also related to collection 2.0, you're right | 12:24 |
| damiandabrowski | at least on my aio I wasn't able to create magnum resources without https://review.opendev.org/c/openstack/openstack-ansible/+/880047 | 12:24 |
| damiandabrowski | so there may be 2 separate issues i think | 12:25 |
| noonedeadpunk | damiandabrowski: also - you pushed https://review.opendev.org/c/openstack/openstack-ansible-os_magnum/+/879922 before https://review.opendev.org/c/openstack/openstack-ansible/+/873092 was merged | 12:27 |
| noonedeadpunk | and 873092 could fix this specific issue | 12:27 |
| noonedeadpunk | as issue there is in collection/sdk compatability that could be a result of old collection and too new sdk | 12:28 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_magnum master: [DNM] Test magnum gating https://review.opendev.org/c/openstack/openstack-ansible-os_magnum/+/879922 | 12:28 |
| noonedeadpunk | and that depends on won't work :) | 12:29 |
| damiandabrowski | yeah, i was thinking about the same thing | 12:31 |
| noonedeadpunk | because depends-on for plugins repo don't work in general. Hopefully https://review.opendev.org/c/openstack/openstack-ansible/+/880031 will fix that, but I'm not 100% sure yet | 12:31 |
| damiandabrowski | let's wait until we merge it hen | 12:31 |
| noonedeadpunk | If https://review.opendev.org/c/openstack/openstack-ansible-os_heat/+/879963 will pass now - then it works) | 12:31 |
| noonedeadpunk | So https://review.opendev.org/c/openstack/openstack-ansible/+/880031 works in general) | 13:18 |
| noonedeadpunk | hm, but seems upgrade now fails with `ERROR! Invalid play strategy specified: openstack.osa.linear` | 13:21 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible master: Implement separated haproxy service config https://review.opendev.org/c/openstack/openstack-ansible/+/871189 | 13:26 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible master: Rename openstack_haproxy_horizon_stick_table variable https://review.opendev.org/c/openstack/openstack-ansible/+/879791 | 13:28 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible master: Add support for TLS backends https://review.opendev.org/c/openstack/openstack-ansible/+/879085 | 13:28 |
| opendevreview | Merged openstack/openstack-ansible-rabbitmq_server stable/yoga: Do not use 'always' tag in inappropriate places https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/878016 | 13:28 |
| noonedeadpunk | Soooo.... I kinda wonder if it was really same to drop linear startegy, as seems that we're simply were installing | 13:34 |
| noonedeadpunk | that is really weird as we do have `unset ANSIBLE_STRATEGY` | 13:38 |
| noonedeadpunk | and also functional tests for centos is another annoying thing | 13:42 |
| *** spotz_ is now known as spotz | 14:00 | |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_trove master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_trove/+/880042 | 14:32 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible master: [DNM] Run haproxy-install.yml normally during openstack upgrade https://review.opendev.org/c/openstack/openstack-ansible/+/880058 | 14:39 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_horizon master: Add PKI support to horizon backends https://review.opendev.org/c/openstack/openstack-ansible-os_horizon/+/879517 | 14:39 |
| noonedeadpunk | #startmeeting openstack_ansible_meeting | 15:00 |
| opendevmeet | Meeting started Tue Apr 11 15:00:18 2023 UTC and is due to finish in 60 minutes. The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:00 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:00 |
| opendevmeet | The meeting name has been set to 'openstack_ansible_meeting' | 15:00 |
| noonedeadpunk | #topic rollcall | 15:00 |
| noonedeadpunk | o/ | 15:00 |
| damiandabrowski | hey! | 15:00 |
| NeilHanlon | o/ hey folks | 15:03 |
| noonedeadpunk | #topic office hours | 15:03 |
| mgariepy | half there as usual :D | 15:03 |
| noonedeadpunk | So, seems we have couple of broken things lately. | 15:04 |
| noonedeadpunk | mainly due to collection version bump | 15:04 |
| jrosser | o/ hello | 15:05 |
| noonedeadpunk | 1. Heat role should be fixed with https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/880028 | 15:05 |
| noonedeadpunk | 2. trove/designate at very least - this topic covers it https://review.opendev.org/q/topic:osa%252Fansible-collection-2 | 15:06 |
| noonedeadpunk | 3. We have weirdly broken Octavia - have close to no idea what's wrong with it | 15:06 |
| jrosser | broken centos functional job on 880028 as well | 15:07 |
| jrosser | more gpg fun by the look of it | 15:08 |
| noonedeadpunk | well. we've disabled centos lxc jobs for $reason, but that didn't touch functional ones | 15:09 |
| noonedeadpunk | likely this should be just patched or dunno | 15:09 |
| noonedeadpunk | (and replaced with rocky) | 15:09 |
| noonedeadpunk | I'm quite afraid to touch tests repo for that | 15:09 |
| noonedeadpunk | On the good side - overall role health look decent accourding to this series of patches https://review.opendev.org/q/topic:osa/systemd_restart_on_unit_change | 15:10 |
| noonedeadpunk | Ah, forgot. | 15:10 |
| noonedeadpunk | 4. Adjutant has backported django version fix, so we should start merging patches since Y to fix upgrade jobs | 15:11 |
| noonedeadpunk | But Octavia is the most concerning at the moment from all | 15:12 |
| noonedeadpunk | We also had some progress on landing haproxy stuff | 15:13 |
| damiandabrowski | regarding haproxy & internal-tls i have two things for today | 15:14 |
| damiandabrowski | 1. https://review.opendev.org/c/openstack/openstack-ansible/+/879791/ | 15:14 |
| damiandabrowski | openstack_haproxy_horizon_stick_table vs. horizon_haproxy_stick_table vs. haproxy_horizon_stick_table | 15:14 |
| noonedeadpunk | I was just looking at this one | 15:14 |
| damiandabrowski | 2. do we still need this for Z-> A upgrade? https://opendev.org/openstack/openstack-ansible/commit/befd8424e2efd4e1bebe89b5085032bf120de148 | 15:14 |
| jrosser | we should not keep changing var names | 15:14 |
| jrosser | they're like fixed, really, unless it's really really needing changing | 15:15 |
| damiandabrowski | regarding var name, i don't really mind if we change it or not. | 15:16 |
| damiandabrowski | regarding upgrade process: after we implemented haproxy base service, we probably need to run haproxy-install.yml normally(in setup-infrastucture.yml): https://review.opendev.org/c/openstack/openstack-ansible/+/880058 | 15:16 |
| noonedeadpunk | I tend to agree here, I don't really see necessity in renaming. At very least, if we want to rename we'd better introduce deprecation of old one and then drop after couple of releases | 15:17 |
| noonedeadpunk | So at very least, I'd assume heaving `haproxy_stick_table: "{{ openstack_haproxy_horizon_stick_table| default(horizon_haproxy_stick_table) }}"` | 15:17 |
| jrosser | why does horizon affect tempest? | 15:17 |
| damiandabrowski | jrosser: https://opendev.org/openstack/openstack-ansible/src/branch/master/tests/roles/bootstrap-host/templates/user_variables_horizon.yml.j2#L17 | 15:18 |
| jrosser | oh well that would do it :) | 15:19 |
| noonedeadpunk | regarding upgrade, I think that with separated config, we can revert that | 15:20 |
| noonedeadpunk | IIRC there was a bug, that haproxy was re-configuring galera backend, making it fully unavailable until run of galera role | 15:20 |
| damiandabrowski | okok thanks, i'll check it | 15:21 |
| noonedeadpunk | well, not a bug, but upgrade issue | 15:21 |
| damiandabrowski | was just curious if you see any blockers from top of your head | 15:21 |
| noonedeadpunk | But since we run haproxy with galera almost at the same time - we can remove that process now | 15:21 |
| noonedeadpunk | the only possible one would be case of upgrade from Y to A, but I think it will be still covered | 15:22 |
| noonedeadpunk | Btw, I've proposed patches for upgrade script to test Y->AA https://review.opendev.org/c/openstack/openstack-ansible/+/879884 | 15:23 |
| noonedeadpunk | It obviously fails, but in quite reasonable way | 15:23 |
| noonedeadpunk | also right now we basically are testng Y->AA upgrade always, and we have Z->AA broken without that patch | 15:23 |
| noonedeadpunk | another thing - we're about to move Xena to the EM | 15:30 |
| noonedeadpunk | It should have been already done, but I bought some time to merge things we want for the last proper release | 15:30 |
| jrosser | have we done that with earlier branches already? | 15:30 |
| noonedeadpunk | Yes | 15:31 |
| noonedeadpunk | All before xena is already in Extended Maintenance | 15:31 |
| noonedeadpunk | With that, rocky should be EOLed (stable/rocky branch, not rocky linux) | 15:32 |
| noonedeadpunk | So basically current blocker is rabbitmq patch https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/879856 | 15:33 |
| noonedeadpunk | After that couple of rechecks can be made. That will also fix upgrade jobs for Y | 15:34 |
| jrosser | i just +W the Y version of that - trying to do them in order i guess | 15:34 |
| noonedeadpunk | Do we want to discuss anything about haproxy stuff or smth else maybe? | 15:39 |
| damiandabrowski | from my side everything is clear, I'll keep adding tls support to service roles | 15:40 |
| jrosser | for haproxy i think james added a lot of complexity to the template to handle simultaneous http/https backends | 15:41 |
| jrosser | which we said we would revert once a migration is done | 15:41 |
| jrosser | if now we are going to not use that, we could remove it | 15:41 |
| noonedeadpunk | good point | 15:42 |
| damiandabrowski | so: with separated haproxy config we can keep downtime minimal during http->https transition(downtime will start after haproxy config and finish when first host is properly configured) | 15:44 |
| damiandabrowski | if it's ok for us(i think it should be ok) then we can revert james' patches mainly because they are quite complex | 15:45 |
| damiandabrowski | but if we want to provide literally zero-downtime http->https transition, we will still need them | 15:45 |
| noonedeadpunk | Are we leveraging them in any way? | 15:47 |
| damiandabrowski | AFAIK this feature is currently broken: https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/864784 | 15:48 |
| noonedeadpunk | damiandabrowski: well, we can apply filter there, like `"{{ 'ansible_' ~ haproxy_bind_external_lb_vip_interface | replace('-','_') }}"` | 15:53 |
| noonedeadpunk | to gather facts only for interfaces of interest | 15:53 |
| noonedeadpunk | like we do for masakari for example https://opendev.org/openstack/openstack-ansible/src/tag/wallaby-em/playbooks/os-masakari-install.yml#L34-L35 | 15:53 |
| damiandabrowski | yeah, it will most likely help | 15:55 |
| noonedeadpunk | #endmeeting | 16:04 |
| opendevmeet | Meeting ended Tue Apr 11 16:04:19 2023 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:04 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/openstack_ansible_meeting/2023/openstack_ansible_meeting.2023-04-11-15.00.html | 16:04 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/openstack_ansible_meeting/2023/openstack_ansible_meeting.2023-04-11-15.00.txt | 16:04 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/openstack_ansible_meeting/2023/openstack_ansible_meeting.2023-04-11-15.00.log.html | 16:04 |
| opendevreview | Merged openstack/openstack-ansible master: Enable TLS frontend for repo_server by default https://review.opendev.org/c/openstack/openstack-ansible/+/876426 | 16:08 |
| noonedeadpunk | folks, any thoughts on how that is possible? https://zuul.opendev.org/t/openstack/build/da1bc3c8cd32468d8fc6e2ad6a1d4b11/log/job-output.txt#18124 | 16:41 |
| noonedeadpunk | given we do `unset ANSIBLE_STRATEGY` right before that | 16:42 |
| noonedeadpunk | hm, might be because of that https://zuul.opendev.org/t/openstack/build/da1bc3c8cd32468d8fc6e2ad6a1d4b11/log/job-output.txt#17350 | 16:48 |
| noonedeadpunk | which gives ENV for bootstrap script... | 16:48 |
| jrosser | so we should bootstrap-ansible a second time, and that should remove the strategy? | 16:50 |
| jrosser | well, though i guess if we are using our ansible to run the bootstrap, then the env vars from the first run will be present | 16:51 |
| jrosser | and it might then pick up that value to use in the second bootstrap | 16:51 |
| noonedeadpunk | I think this is what results https://opendev.org/openstack/openstack-ansible/src/branch/master/scripts/gate-check-commit.sh#L250 | 16:53 |
| noonedeadpunk | or well, we;re sourcing it 2 times | 16:54 |
| noonedeadpunk | in gate-check-commit before executing run-upgrade | 16:54 |
| noonedeadpunk | and then here in run-upgrade https://opendev.org/openstack/openstack-ansible/src/branch/master/scripts/run-upgrade.sh#L118 | 16:54 |
| jrosser | isnt it this though? https://github.com/openstack/openstack-ansible/blob/stable/zed/scripts/openstack-ansible.rc#L57 | 16:55 |
| jrosser | all those exports | 16:55 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible master: Add support for TLS backends https://review.opendev.org/c/openstack/openstack-ansible/+/879085 | 17:01 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Install zuul-provided collections as directories https://review.opendev.org/c/openstack/openstack-ansible/+/880031 | 17:04 |
| noonedeadpunk | I wonder if that will help | 17:05 |
| opendevreview | Merged openstack/openstack-ansible-galera_server stable/yoga: fix indentation for condition https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/879479 | 17:09 |
| opendevreview | Merged openstack/openstack-ansible-rabbitmq_server stable/yoga: Switch rabbitmq repo back to packagecloud https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/879857 | 17:10 |
| noonedeadpunk | so yes, every time we call scripts-library.sh - we load old openrc until ansible is bootstrapped. And we call it twice during upgrade process | 17:23 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible master: Revert "Skip haproxy with setup-infrastructure for upgrades" https://review.opendev.org/c/openstack/openstack-ansible/+/880091 | 17:29 |
| noonedeadpunk | damiandabrowski: are you sure we need to backport that? ^ | 17:30 |
| noonedeadpunk | As I think we don't | 17:30 |
| damiandabrowski | ah, you're right | 17:33 |
| damiandabrowski | when you perform an upgrade from Z to A | 17:33 |
| damiandabrowski | it's only necessary to have this fix included in A | 17:33 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_horizon master: Fix horizon_enable_ssl logic https://review.opendev.org/c/openstack/openstack-ansible-os_horizon/+/879514 | 17:37 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_horizon master: Rename horizon_enable_ssl to horizon_backend_ssl https://review.opendev.org/c/openstack/openstack-ansible-os_horizon/+/879516 | 17:37 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_horizon master: Add PKI support to horizon backends https://review.opendev.org/c/openstack/openstack-ansible-os_horizon/+/879517 | 17:37 |
| noonedeadpunk | yeah, exactly. As upgrade to Z still needs this | 17:44 |
| noonedeadpunk | I see 1 unresolved comment here https://review.opendev.org/c/openstack/openstack-ansible/+/871189/32?tab=comments | 17:46 |
| noonedeadpunk | jrosser: ^ | 17:46 |
| jrosser | well it's nothing to do with horizon | 17:47 |
| jrosser | and it's not accessed via horizon either | 17:47 |
| jrosser | security.txt is served from the keystone web server because that is the only one that is guaranteed to exist in a horizon or !horizon deployment | 17:48 |
| noonedeadpunk | I think it should be in basic service now? | 17:49 |
| jrosser | and it's an ACL on the haproxy port 443 frontend to redirect the appropriate path to the keystone backend | 17:49 |
| noonedeadpunk | ah, well, except that basic don't have a web server | 17:49 |
| jrosser | well, base service has nothing | 17:49 |
| jrosser | all it can do is redirect elsewhere | 17:49 |
| jrosser | or "use backend <blah>" | 17:50 |
| noonedeadpunk | yeah, and acl for security should be likely there | 17:50 |
| jrosser | tbh i have not looked in detail at how this should work in the new setup | 17:50 |
| jrosser | but imho it "belongs" to haproxy | 17:50 |
| noonedeadpunk | yes, true, for sure not to horizon_all | 17:51 |
| noonedeadpunk | damiandabrowski: ^ | 17:52 |
| noonedeadpunk | That really looks to me like good candidate for map file | 17:52 |
| jrosser | yes, though it's a new map file i think | 17:52 |
| jrosser | if we could do a "path_end" based one it could perhaps handle LE and security.txt in one map | 17:53 |
| noonedeadpunk | yeah, I was thinking that LE should be quite close to what we want to do with security | 17:54 |
| noonedeadpunk | except we need to have a real web server to serve 1 static file.... | 17:55 |
| opendevreview | Merged openstack/openstack-ansible-os_glance stable/yoga: Disable uWSGI if ceph is used as a store https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/879698 | 17:55 |
| noonedeadpunk | Wait a second.... | 17:56 |
| jrosser | right - there is always keystone | 17:56 |
| jrosser | always nginx there | 17:56 |
| jrosser | sorry apache | 17:56 |
| noonedeadpunk | You can serve txt file with just haproxy | 17:56 |
| noonedeadpunk | https://sleeplessbeastie.eu/2020/05/11/how-to-serve-single-file-using-haproxy/ | 17:57 |
| noonedeadpunk | It's a weird hack, but still it's doable | 17:57 |
| noonedeadpunk | So we can leave security.txt just fully within haproxy context | 17:58 |
| jrosser | like it does, sort of :) | 17:58 |
| opendevreview | Merged openstack/openstack-ansible stable/yoga: Add documentation on refreshing hosts file https://review.opendev.org/c/openstack/openstack-ansible/+/879484 | 18:05 |
| * damiandabrowski working on security.txt PoC(serving security.txt directly via haproxy) | 19:06 | |
| noonedeadpunk | btw https://review.opendev.org/c/openstack/openstack-ansible/+/880031 looks quite good now | 19:16 |
| opendevreview | Merged openstack/openstack-ansible-os_swift master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_swift/+/880040 | 19:53 |
| opendevreview | Merged openstack/openstack-ansible-os_tacker master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_tacker/+/880041 | 19:53 |
| opendevreview | Merged openstack/openstack-ansible-os_masakari master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_masakari/+/879971 | 19:54 |
| opendevreview | Merged openstack/ansible-role-uwsgi master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/879955 | 19:54 |
| opendevreview | Merged openstack/openstack-ansible-os_blazar master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_blazar/+/879957 | 19:55 |
| opendevreview | Merged openstack/openstack-ansible-os_nova master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/880033 | 20:00 |
| opendevreview | Merged openstack/openstack-ansible-os_senlin master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_senlin/+/880037 | 20:01 |
| opendevreview | Merged openstack/openstack-ansible-os_manila master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_manila/+/879973 | 20:01 |
| opendevreview | Merged openstack/openstack-ansible-os_cloudkitty master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_cloudkitty/+/879959 | 20:02 |
| opendevreview | Merged openstack/openstack-ansible-os_mistral master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_mistral/+/879972 | 20:06 |
| opendevreview | Merged openstack/openstack-ansible-os_gnocchi master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_gnocchi/+/879962 | 20:09 |
| opendevreview | Merged openstack/openstack-ansible-os_barbican master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_barbican/+/879956 | 20:18 |
| opendevreview | Merged openstack/openstack-ansible-os_ironic master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_ironic/+/879968 | 20:22 |
| opendevreview | Merged openstack/openstack-ansible-os_placement master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_placement/+/880036 | 20:26 |
| opendevreview | Merged openstack/openstack-ansible-os_aodh master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_aodh/+/879954 | 20:31 |
| opendevreview | Merged openstack/openstack-ansible-os_glance master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/876328 | 20:37 |
| opendevreview | Merged openstack/openstack-ansible-os_cinder master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_cinder/+/879870 | 20:46 |
| opendevreview | Merged openstack/openstack-ansible-os_ceilometer master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_ceilometer/+/879958 | 21:01 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-haproxy_server master: Allow haproxy role to create security.txt file https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/880088 | 21:06 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible master: Change the order of horizon-back map entry https://review.opendev.org/c/openstack/openstack-ansible/+/880089 | 21:07 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible master: Serve security.txt directly from haproxy https://review.opendev.org/c/openstack/openstack-ansible/+/880110 | 21:07 |
| opendevreview | Merged openstack/openstack-ansible-os_neutron master: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/879977 | 21:07 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible master: Change the order of horizon-back map entry https://review.opendev.org/c/openstack/openstack-ansible/+/880089 | 21:08 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible master: Serve security.txt directly from haproxy https://review.opendev.org/c/openstack/openstack-ansible/+/880110 | 21:08 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_keystone master: Remove security.txt parts https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/880111 | 21:09 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_keystone master: Remove security.txt parts https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/880111 | 21:09 |
| noonedeadpunk | sooo, looks like you was able to make security.txt working without keystone :) | 22:10 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!