| jamesdenton | FWIW: Cisco ASAv flavor type defines throughput capabilities. The ASAv5 is 100Mbps, ASAv10 is 1Gbps, ASAv30 is 2Gbps for multi-protocol; those numbers drop w/ ipsec. Multiple iPerf streams might be used to fill the pipe, if necessary | 02:18 |
|---|---|---|
| jamesdenton | so even though a VM might be 10G capable, the ASA flavor will really bottleneck you | 02:18 |
| NeilHanlon | cisco: only when i have to | 02:43 |
| jamesdenton | :D | 02:46 |
| jamesdenton | i live in it every day, for better or worse | 02:46 |
| noonedeadpunk | mornings | 06:17 |
| noonedeadpunk | damiandabrowski: can you review https://review.opendev.org/c/openstack/ansible-role-pki/+/893247 | 06:17 |
| noonedeadpunk | woud be also great to land these https://review.opendev.org/q/parentproject:openstack/openstack-ansible+branch:%255Estable/zed+status:open+label:Verified | 06:30 |
| noonedeadpunk | I've also issued couple of rechecks due to diskfull for 2023.1 | 06:31 |
| noonedeadpunk | wanna do Zed bump to hopefully solve these diskfulls | 06:31 |
| jrosser | morning | 07:27 |
| damiandabrowski | hi | 07:42 |
| damiandabrowski | noonedeadpunk: i see it's not needed anymore :D | 07:42 |
| jrosser | is there a dependancy order with this https://review.opendev.org/c/openstack/openstack-ansible/+/873618 | 07:50 |
| jrosser | like do we have to land things in the roles before that one? | 07:51 |
| noonedeadpunk | no, not really. to land things in roles we need to be able to disable applying HA policy | 07:53 |
| noonedeadpunk | that's basically why I've also pushed https://review.opendev.org/c/openstack/openstack-ansible/+/887850/ to check that things are working with quorum queues | 07:54 |
| noonedeadpunk | as 873618 is basically first thing to land in series | 07:54 |
| jrosser | and 873618 removes the HA policy completely? | 07:56 |
| jrosser | oh wait | 07:56 |
| jrosser | ok yes i see now | 07:58 |
| * jrosser too early | 07:58 | |
| opendevreview | Merged openstack/openstack-ansible-apt_package_pinning master: Fix linters issue and metadata https://review.opendev.org/c/openstack/openstack-ansible-apt_package_pinning/+/888172 | 08:05 |
| jrosser | is this wrong? https://opendev.org/openstack/openstack-ansible/src/branch/master/etc/openstack_deploy/openstack_user_config.yml.aio.j2#L114 | 08:06 |
| jrosser | br-lbaas perhaps? | 08:06 |
| jrosser | how does the octavia role CI even work right now | 08:08 |
| jrosser | oh /o\ becasue its always a metal job | 08:08 |
| jrosser | `lxc-start aio1_octavia_server_container-f58e8ea4 20230831075959.932 ERROR network - network.c:netdev_configure_server_veth:711 - No such file or directory - Failed to attach "f58e8ea4_eth14" to bridge "br-octavia", bridge interface doesn't exist` | 08:15 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible master: Fix container bridge name for octavia https://review.opendev.org/c/openstack/openstack-ansible/+/893315 | 08:19 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible master: WIP - test Vexxhost CAPI driver for magnum https://review.opendev.org/c/openstack/openstack-ansible/+/893240 | 08:20 |
| opendevreview | Merged openstack/ansible-role-pki stable/2023.1: Add defaults for owner/group/mode on pki_install_host https://review.opendev.org/c/openstack/ansible-role-pki/+/893247 | 08:36 |
| opendevreview | Merged openstack/openstack-ansible-os_senlin stable/zed: Ensure service is restarted on unit file changes https://review.opendev.org/c/openstack/openstack-ansible-os_senlin/+/881988 | 09:01 |
| derekokeeffe85 | mgariepy just scrolled back and saw it wasn't you :( haha. Just finished a support call with Thales and she doesn't know what the issue is either so I guess it's back to googling | 09:29 |
| opendevreview | Merged openstack/openstack-ansible-os_horizon stable/zed: Fix wrong neutron_ml2_drivers_type https://review.opendev.org/c/openstack/openstack-ansible-os_horizon/+/892354 | 09:33 |
| opendevreview | Merged openstack/openstack-ansible-haproxy_server master: Add HTTP/2 support for frontends/backends https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/891572 | 09:37 |
| opendevreview | Merged openstack/openstack-ansible-os_cinder stable/zed: Use v3 service type in keystone_authtoken config https://review.opendev.org/c/openstack/openstack-ansible-os_cinder/+/887058 | 09:41 |
| opendevreview | Merged openstack/openstack-ansible-haproxy_server master: Fix linters issue and metadata https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/888143 | 09:53 |
| opendevreview | Merged openstack/openstack-ansible-haproxy_server master: Do not use notify inside handlers https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/888762 | 10:03 |
| opendevreview | Merged openstack/openstack-ansible-galera_server stable/zed: Add optional compression to mariabackup https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/887143 | 10:46 |
| noonedeadpunk | would be also awesome to land https://review.opendev.org/q/topic:cherrypick-osa/db_port-24yhx0eaik+status:open+label:Verified | 11:30 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-os_tempest master: Ensure test exclusion file is removed when there are no exclusions https://review.opendev.org/c/openstack/openstack-ansible-os_tempest/+/891586 | 11:44 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-os_magnum master: Add tag for creating magnum resources https://review.opendev.org/c/openstack/openstack-ansible-os_magnum/+/893362 | 12:00 |
| opendevreview | Merged openstack/openstack-ansible-os_murano stable/2023.1: Use proper galera port in configuration https://review.opendev.org/c/openstack/openstack-ansible-os_murano/+/892360 | 13:36 |
| opendevreview | Merged openstack/openstack-ansible-os_blazar stable/2023.1: Use proper galera port in configuration https://review.opendev.org/c/openstack/openstack-ansible-os_blazar/+/892465 | 13:36 |
| opendevreview | Merged openstack/openstack-ansible-os_barbican stable/2023.1: Use proper galera port in configuration https://review.opendev.org/c/openstack/openstack-ansible-os_barbican/+/892469 | 13:39 |
| noonedeadpunk | this is yet another rather important thing for 2023.1: https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/889811 | 13:42 |
| noonedeadpunk | and this one of latest for _member_ cleaning-out https://review.opendev.org/c/openstack/openstack-ansible-os_sahara/+/892095 | 13:43 |
| opendevreview | Merged openstack/openstack-ansible-os_glance stable/2023.1: Use proper galera port in configuration https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/892463 | 14:06 |
| derekokeeffe | HMAC successfully generated! MKEK successfully generated! wooHoo :) | 14:20 |
| jrosser | what is the secret (no pun intended!) | 14:20 |
| noonedeadpunk | ++ | 14:28 |
| derekokeeffe | Haha, probably me being silly but I needed to put the safenet directory on the container (you probably though that's where I had it all along) :( | 14:34 |
| derekokeeffe | *thought | 14:36 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_adjutant stable/zed: Revert "Install mysqlclient devel package" https://review.opendev.org/c/openstack/openstack-ansible-os_adjutant/+/892505 | 14:46 |
| noonedeadpunk | derekokeeffe: yeah, eventually that's what would playbooks do I beleive... | 14:55 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_adjutant stable/2023.1: Use version mysqlclient<2.2.0 https://review.opendev.org/c/openstack/openstack-ansible-os_adjutant/+/891279 | 14:57 |
| derekokeeffe | Ah well got that part over the line, now on to the next challenge :) | 14:58 |
| *** dviroel_ is now known as dviroel | 14:59 | |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-galera_server master: Install compatibility package for mariadb-dev https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/893404 | 15:01 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_adjutant master: Install pkg-config package https://review.opendev.org/c/openstack/openstack-ansible-os_adjutant/+/888985 | 15:01 |
| noonedeadpunk | derekokeeffe: but was you defining barbican_user_libraries ? | 15:03 |
| noonedeadpunk | Just wondering if it's enough or not to make things working for you | 15:04 |
| derekokeeffe | Yep I had them in user variables but did'nt seem to work. It was also looking for the certs from the HSM setup | 15:04 |
| noonedeadpunk | variable is around since victoria.... so I assume you should have it it... | 15:05 |
| noonedeadpunk | But what has changed then? | 15:06 |
| noonedeadpunk | Like we have _only_ libCryptoki2.so libdpod.plugin and Chrystoki.conf files on barbican containers and this seems enough | 15:06 |
| noonedeadpunk | So I'm really wondering what's different in your case and what specifically you did to make things working | 15:07 |
| noonedeadpunk | as it might be worth to udpate the doc, as we might be using some old HSM revision or smth.... | 15:07 |
| derekokeeffe | I'm not sure what the issue was but I noticed that it was looking for the certs I had created when setting up the client on the controller so I copied those to the container and then it moved past the original error to something I can't remember so I dropped the entire /usr/safenet dir in the correct location and it generated the keys first try | 15:08 |
| noonedeadpunk | huh | 15:08 |
| derekokeeffe | in the correct location on the container that is | 15:08 |
| noonedeadpunk | interesting | 15:08 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible master: WIP - test Vexxhost CAPI driver for magnum https://review.opendev.org/c/openstack/openstack-ansible/+/893240 | 15:13 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible master: WIP - test Vexxhost CAPI driver for magnum https://review.opendev.org/c/openstack/openstack-ansible/+/893240 | 15:13 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Set correct language for docs https://review.opendev.org/c/openstack/openstack-ansible/+/893407 | 15:39 |
| opendevreview | Merged openstack/openstack-ansible-os_tacker stable/2023.1: Use proper galera port in configuration https://review.opendev.org/c/openstack/openstack-ansible-os_tacker/+/892359 | 15:40 |
| opendevreview | Merged openstack/openstack-ansible-os_sahara stable/2023.1: Stop reffering _member_ role https://review.opendev.org/c/openstack/openstack-ansible-os_sahara/+/892095 | 15:46 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Fix container bridge name for octavia https://review.opendev.org/c/openstack/openstack-ansible/+/893315 | 15:57 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Fix ansible_ssh_extra_args extra newline https://review.opendev.org/c/openstack/openstack-ansible/+/893191 | 15:58 |
| opendevreview | Merged openstack/openstack-ansible-os_neutron stable/2023.1: Configure OVN NB and SB DB Connection probes https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/889811 | 16:06 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/2023.1: Bump SHAs for 2023.1 https://review.opendev.org/c/openstack/openstack-ansible/+/893413 | 16:18 |
| noonedeadpunk | damiandabrowski: jrosser mgariepy ^ this is bump for 27.1.0 | 16:18 |
| drarvese | Greetings! Does OSA support doing an IPv6-only install of all the components? All of the docs use IPv4 examples, so I get the feeling I'm going to run into issues down the road. | 16:25 |
| noonedeadpunk | drarvese: yeah, you most likely will. nobody ever worked or tested that, I would say | 16:28 |
| noonedeadpunk | THough, if talk about "external" networks (which are internal/external vips) - it should be pretty much trivial. | 16:29 |
| jrosser | yeah this depends what you mean | 16:29 |
| noonedeadpunk | But if talking about networks for LXC containers and dynamic inventory - there might be some troubles | 16:29 |
| jrosser | "as far as the tenants/projects are concerned its an ipv6 only environment" | 16:30 |
| jrosser | ^ not the same as environment is built only on ipv6 under the hood | 16:30 |
| drarvese | This is for the containers and all the services on the management bridge | 16:30 |
| noonedeadpunk | I'm not actually sure I get the point of private ipv6 networks, but yeah. | 16:31 |
| noonedeadpunk | This is smth we never tried | 16:31 |
| noonedeadpunk | or better - nobody was interested to invest time into that | 16:31 |
| noonedeadpunk | but we'd be interested to get this supported | 16:32 |
| jrosser | drarvese: this actually is it - we would need a contributor who has that use case to do the work | 16:32 |
| jrosser | almost universally, contributions and therefore functionality in openstack-ansible comes from operators who contribute to the code | 16:33 |
| jrosser | it is an interesting problemm though | 16:35 |
| drarvese | Yep, that makes sense | 16:35 |
| jrosser | i had already thought we could re-use the SLAAC algorithm to autogenerate ipv6 container interface addresses from the container macs | 16:35 |
| noonedeadpunk | I think most troublesome would be dynamic inventory | 16:35 |
| jrosser | and that would avoid having to deal with /64s in the inventory code | 16:36 |
| noonedeadpunk | but then I kinda wonder how that would stack with things like octavia | 16:37 |
| noonedeadpunk | as I'm not sure that amphoras will be happy about ipv6 network | 16:37 |
| noonedeadpunk | same might go for magnum/trove | 16:37 |
| jrosser | drarvese: is this just preference for ipv6, or is it a real hard requirement? | 16:38 |
| drarvese | It's a hard requirement (gov mandate) | 16:38 |
| jrosser | as noonedeadpunk says it's perhaps a problem more widely scoped than just "can the dpeloy tool do it" | 16:38 |
| noonedeadpunk | drarvese: and for public networks (for VMs) there will be dual stack or ipv6-only as well? | 16:39 |
| drarvese | They'd be dual-stacked | 16:39 |
| jrosser | bah :) | 16:39 |
| noonedeadpunk | I jsut can recall some issues with that when we were implementing ipv6... there was non trivial to spawn ipv6-only things for sure... but I can't recall what exactly - was quite a while ago | 16:40 |
| jrosser | cloud-init does not like it much | 16:40 |
| noonedeadpunk | drarvese: if you go metal only (without LXC) - this can almost "just work" | 16:40 |
| jrosser | becasue it tries really really hard to get it's data source ipv4 before falling back to ipv6 | 16:41 |
| noonedeadpunk | well, you can use config drive for that... | 16:41 |
| jrosser | so boot time can get pretty long with unmodified images | 16:41 |
| noonedeadpunk | I think our issue was related to get ipv6-only L3 router for double-stack public network | 16:42 |
| jrosser | drarvese: if you want to try this out and investigate, you'll get some help/guidance here | 16:43 |
| noonedeadpunk | ++ | 16:43 |
| jrosser | we probably even patch things for you as they come up | 16:43 |
| noonedeadpunk | (but better to push patches yourself - they will land faster) | 16:44 |
| jrosser | like a metal only deploy and a sprinking of ipwrap filter in the ansible and it probably mostly works | 16:45 |
| jrosser | the most obvious thing will be making any use of : or :: safe in config files for things that are normally ipv4-address:port | 16:46 |
| drarvese | I'll have to try a metal only deployment and see how it goes. | 16:47 |
| jrosser | i would recommend starting here with the "all in one" https://docs.openstack.org/openstack-ansible/latest/user/aio/quickstart.html | 16:49 |
| jrosser | putting an ipv4 one alongside an attempt at ipv6 would be interesting | 16:50 |
| jrosser | for comparison/debugging | 16:50 |
| noonedeadpunk | drarvese: just out of interest - is there some NIST or ISO or anything like that to require internal IPv6? | 16:57 |
| * noonedeadpunk wondering if we should prioritize that work regardless | 16:57 | |
| drarvese | It's from the US federal IPv6 mandate (OMB memo M-21-07). | 17:02 |
| drarvese | For us, specifically, Department of Commerce policy | 17:03 |
| noonedeadpunk | aha, so there's goal to transition * until 2025 | 17:13 |
| noonedeadpunk | interesting | 17:13 |
| * noonedeadpunk still don't have an IPv6 in the meantime | 17:14 | |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/zed: Bump SHAs for Zed https://review.opendev.org/c/openstack/openstack-ansible/+/893419 | 17:15 |
| noonedeadpunk | though I can't really commit to look into ipv6-only setup right now :( I wanna take time for Skyline and Debian 12 support in short-term perspective | 18:16 |
| Karni | I have launch two scenarios, one with multiqueue feature enabled on the Ubuntu image and the other one as usual without m.q. feature | 21:36 |
| Karni | For networking IO test, I use this command: | 21:36 |
| Karni | `iperf3 -c 10.1.1.10 -T s1 -t 90 -P 15 -p 5101 -A 1,1& iperf3 -c 10.1.1.10 -T s2 -t 90 -P 15 -p 5102 -A 2,2& iperf3 -c 10.1.1.10 -T s3 -t 90 -P 15 -p 5103 -A 3,3& iperf3 -c 10.1.1.10 -T s4 -t 90 -P 15 -p 5104 -A 4,4` | 21:37 |
| noonedeadpunk | I think these will launch just one after another | 21:37 |
| noonedeadpunk | or maybe not.... | 21:37 |
| noonedeadpunk | anyway, and whats' the result? | 21:38 |
| Karni | (I rum some iperf3 in parallel beacause iperf3 is still single-threaded) | 21:38 |
| Karni | run* | 21:38 |
| noonedeadpunk | I would just do that with xargs or in screen... But whatever | 21:38 |
| Karni | +1 | 21:38 |
| noonedeadpunk | so what you get? | 21:39 |
| Karni | In scenario1 where multique is enabled, it touch 400000 KB/s | 21:39 |
| Karni | In scenario2, without multiqueue: same result! | 21:39 |
| noonedeadpunk | Well, 400mbit means you're throtteled elsewhere | 21:40 |
| Karni | 400000Kb/s* | 21:40 |
| noonedeadpunk | As multiqueue is usually the bad guy, when you hit smth like 1.1-1.3 gbit/s | 21:41 |
| noonedeadpunk | (depending on CPU) | 21:41 |
| noonedeadpunk | as that's what you usually can do with a single core | 21:41 |
| Karni | I lost the conection for seconds. would you please repost your last messages, noonedeadpunk ? | 21:45 |
| noonedeadpunk | I said only that multiqueue is usually the issue when you hit 1.1-1.3 gbit/s, but not 400mbit. So I'd say you have bottleneck (or some QoS) elsewhere | 21:46 |
| noonedeadpunk | Karni: just in case - I assume that you just use virtio net? not some emulated e1000 or whatever else? | 21:47 |
| noonedeadpunk | (I know only how to check that only by checking resulted XML for domain on compute node) | 21:48 |
| noonedeadpunk | sorry, it's almost midnight here, so I need to sign off :( | 21:48 |
| Karni | And, In scenario2 where multiqueue has not been enabled, does it make sence to bind an iperf3 to a specific vCPU using `-A` switch that is for CPU affinity rule? I mean iperf3_1 on vCPU1 and iperf3_2 on vcPU2 and so on, | 21:48 |
| Karni | virtio net, andnot emulated e1000? what do you mean? I dealt with this statments when I was working on DPDK! | 21:50 |
| Karni | I just found this to run up to 5 processes in parallel (bash 4.3): `i=0 j=5; for elem in "${array[@]}"; do (( i++ < j )) || wait -n; my_job "$elem" & done; wait` | 22:14 |
| johnsom | noonedeadpunk Octavia has no issues with IPv6 | 23:56 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!