Tuesday, 2024-03-12

f0oGood morning; Edited my /etc/openstack/upper_constraint/* with the new ovs version that was updated in 2023.1 and everything seems to be working fine so far (os-neutron-install passed, now running os-nova-install so fingers crossed)07:23
f0odid a repo-install prior ofc - forgot to mention07:23
f0ocycled the ovn-controllers and the reconnect-loop of the metadata-agent is now working correctly after bumping ovs to 2.17.208:00
noonedeadpunko/08:19
noonedeadpunkah, ok, so you've faced the same issue....08:20
noonedeadpunkit's a shame that folks rejected patches to update ovs version in u-c we've proposed08:21
f0owhy did they reject it? it seems that all OS vendors packaged it as high sev bug08:23
noonedeadpunkf0o: oh, wait, it was merged o_O https://review.opendev.org/c/openstack/requirements/+/89289208:25
f0oyeah to 2023.1 not .208:25
noonedeadpunkjust like - after half a year after being proposed08:25
f0othat patch should be backported to .208:26
noonedeadpunkso then it should be in some of latest releases I assume08:26
f0oit is not, 2023.2 is still using the bugged ovs version08:26
noonedeadpunkthat;s stupid08:26
f0omaster is having a super new one so the Next Release will likely fix it but 2023.2 is broken although 2023.1 is fixed08:26
noonedeadpunkhttps://review.opendev.org/c/openstack/requirements/+/89289108:27
noonedeadpunkso this is why it's not in 2023.2....08:27
noonedeadpunk /o\08:27
f0oI mean... I can understand that a major bump is rejected but the minor bump from 2.17..1->.2 should still be backported08:28
noonedeadpunkwell, dunno if "backport" is applicable to the newer branches, as that's basically  a regression08:30
f0ocorrect just lack of better wording08:31
noonedeadpunkfair enough08:31
f0oreversed backport?08:31
f0o:D08:31
noonedeadpunkforwardport08:31
noonedeadpunkdunno08:31
f0oforwardport. let's coin it08:31
f0oIETF forwardport - a backport that was made to an ancient branch but forgotten to apply to the newer ports thus breaking lineage08:32
f0oidk08:32
noonedeadpunk:D08:32
noonedeadpunkyeah, sounds sweet 08:32
f0oI need more coffee - breaking my head over how to get FIPs to both gateway nodes which are our edge/TO-Routers so both can resolve it without flushing to the wire08:33
f0oI mean worst case they flush it to the wire and done, they got beefy MLAG interconnects for those sort of spillages08:34
noonedeadpunkbut, um, gateway nodes are the ones who held routers?08:34
noonedeadpunkor you mean core routers08:35
f0obut both are connected to the OVN/OVS so they have end-to-end connectivity to everything so flushing to wire is just one hop08:35
f0oyeah OVN Gateway Nodes hold routers and make N/S traffic happen08:35
f0onot doing Distributed FIPs because it seems a bit messy to drag the public VLAN to all compute nodes and have it resolve in arp for all FIPs (very linux bridge)08:36
f0oso my idea was to consolidate to the top-of-rack switches which BGP the FIP range to the rest of the network and then just go BGP<>OVS<>Compute08:36
f0obut OVS only applies the flow to one of the two and the kernel has no way of knowing which so routing only works on one of the nodes despite both annoucning the prefix08:37
f0oeither need to get the OVS flow on both routers and do VRRP on the br-ext subinterface for L3 to work internally - or teach the kernel's routing table that FIPs are onlink on an OVS08:38
f0oOr bridge the OVS to an interconnect and let standard ARP resolve the whole thing adding in worst case one additional wire08:38
f0o_OR_ my decaffeinated brain cannot see the forest from all the trees and the solution is super obvious somewhere08:39
jrossergood morning08:56
f0oMorning08:57
*** Guest6972 is now known as starkis09:17
nixbuilderI read fOo posting about Full Deployment Example for OVN and the response.  I am working on the same thing (I think) and am having similar issues.  I was wondering if you had made any progress. Anyway I would like to help with documentation and my configuration for an example when I get this figured out and deployed.10:58
jrosserpart of the complexity is that there are many possible scenarios with OVN11:02
jrosserso if we are able to describe particular scenarios well, that would be excellent11:02
nixbuilderjrosser: OK... well I will work on it.11:11
noonedeadpunkI personally got OVN working quite nicely in our full-scale sandbox, except ovn-bgp agent part which is slightly /o\13:07
opendevreviewMerged openstack/openstack-ansible stable/2023.2: Bump SHAs for 2023.2  https://review.opendev.org/c/openstack/openstack-ansible/+/91194313:39
opendevreviewAleksandr Chudinov proposed openstack/openstack-ansible-os_nova master: fix apparmor profile for non-standard nova home  https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/91258313:52
f0oI'm looking at /var/log/journal and see some very large journals from the LXC containers (from the crashloops over weeks) - is there a quick way to tell ansible to run something by the lines of `journalctl --vacum-size=1G`? Looking at https://docs.openstack.org/openstack-ansible-lxc_container_create/latest/ it's not super obvious if I can use lxc_container_extra_commands14:19
ThiagoCMCjrosser, noonedeadpunk, check this out: https://github.com/ceph/ceph-ansible/issues/749614:23
jrosserf0o: you can use an ansible ad-hoc command for that i think?14:27
jrossersomething like this i think https://docs.openstack.org/openstack-ansible/latest/admin/maintenance-tasks.html#running-the-shell-module14:28
noonedeadpunkf0o: and then we also have `openstack_hosts_journald_config` variable which you can use to configure journald on lxc/host14:45
noonedeadpunkie we do smth like this for CI machines: https://opendev.org/openstack/openstack-ansible/src/branch/master/tests/roles/bootstrap-host/templates/user_variables.aio.yml.j2#L39-L4514:46
jrosserThiagoCMC: /o\ https://github.com/ceph/ceph-ansible/commit/9c467e41b39af63dec9a0b237b550edb9c57da8514:46
noonedeadpunkwow14:46
jrosseri really wonder what is going on there14:49
ThiagoCMCLet's make some noise in there!14:51
NeilHanlonfyi https://www.openwall.com/lists/oss-security/2024/03/12/5 -- CVE in OVN14:53
ThiagoCMCI can deploy Ceph Reef with `stable-7.0`, but only works if using `ceph-ansible` alone, not via OSA. I tried to force OSA with `ceph_stable_release: reef` but it creates a APT pinning which locks it down to Ceph Quincy anyway.14:53
jrosserThiagoCMC: there is an argument to say we should adjust all that to deploy Reef for the upcoming OSA release14:53
jrosseri asked in the ceph slack where the roadmap for the changes to ceph-ansible is14:54
ThiagoCMCYeah, I need it. But the thing is that `stable-8.0` alone is failing. This should be fixed first. Then integrate the new version with OSA.14:55
noonedeadpunk`ceph_stable_release: reef`?14:55
jrosserThiagoCMC: why would we try to fix stable-8.0 first? they broke so much already14:56
ThiagoCMCnoonedeadpunk, yes, if we use `stable-7.0` but "force" ``ceph_stable_release: reef`, it deploys Ceph Reef on Ubuntu 22.04 with Bobcat UCA.14:56
ThiagoCMCjrosser, well, I'm asking `ceph-ansible` to fix it (and also to bring back what OSA needs).14:58
noonedeadpunkjrosser: well, looking in the patch, probably nothing too bad happened14:59
noonedeadpunkprobably, from their prespective/intended focus containing openstack bits explicitly is an overkill14:59
jrosserdidnt they also take out the config overrides stuff earlier too?14:59
noonedeadpunkso if they wanna reduce codebase and have just good working core - it's reasonable thing to do14:59
noonedeadpunkthey did, yes14:59
ThiagoCMCYes, they did removed the overrides. I mentioned this in the Github issue.15:00
noonedeadpunkbut again - I think config today is not in ceph.conf mainly anyway?15:00
noonedeadpunkit's like injected in daemon or smth like that - ending up in raft?15:00
jrosserit doesnt have to be in ceph.conf, thats true15:00
jrossercertainly those openstack specific tasks could be put into openstack-ansible-plugins collection15:01
ThiagoCMCI'm okay with that =P15:01
noonedeadpunkwhat they really dropped right now - is explicit variables for openstack15:01
noonedeadpunkso we just need to define more things now explicitly leveraging "native" vars 15:02
noonedeadpunkjrosser: I don't think we need even that?15:02
jrosserperhaps not? i didnt look too closely15:02
noonedeadpunkthese tasks were just creating pools/generating cephx. I think they do that anyway somewhere else?15:03
jrosserhere ? https://github.com/ceph/ceph-ansible/blob/main/roles/ceph-client/tasks/create_users_keys.yml15:06
noonedeadpunkyeah, for instance15:08
noonedeadpunkcan't find where to define pools to create....15:08
noonedeadpunkbut potentially, they would be fine with more "generic" naming for that feature15:08
noonedeadpunkoh, damn15:14
NeilHanlonoh.. is it meeting time? noonedeadpunk15:14
NeilHanlonfucking timezones15:14
noonedeadpunk#startmeeting openstack_ansible_meeting15:14
opendevmeetMeeting started Tue Mar 12 15:14:42 2024 UTC and is due to finish in 60 minutes.  The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot.15:14
opendevmeetUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.15:14
opendevmeetThe meeting name has been set to 'openstack_ansible_meeting'15:14
noonedeadpunk#topic rollcall15:14
NeilHanlono/15:14
noonedeadpunko/15:14
noonedeadpunksorry folks for being late15:14
jrossero/ hello15:15
NeilHanloni got a notification 5 mins before and then got distracted, so...15:15
noonedeadpunkyeah, I did pretty much the same15:15
noonedeadpunk#topic office hours15:17
noonedeadpunkJust wanted to ask, if things got any more clear regarding occupancy during the PTG week 15:17
noonedeadpunk(which timing is slightly unfortunate this time around)15:17
NeilHanloni think my availability is largely the same, that is, pretty open15:18
noonedeadpunkOk, seems that our highlights were published for the upcoming release15:20
noonedeadpunk#link https://releases.openstack.org/caracal/highlights.html#openstackansible15:20
noonedeadpunkI guess out of the list, we still have octavia ovn driver not merged15:33
noonedeadpunkhttps://review.opendev.org/c/openstack/openstack-ansible-os_octavia/+/86846215:33
noonedeadpunkas well as ovn-bgp-agent15:34
noonedeadpunkI'm still playing with this though, so it's in WIP15:34
noonedeadpunkbut should be really ready in a week or so15:34
noonedeadpunkI've also proposed new minor releases today15:34
noonedeadpunk#link https://review.opendev.org/q/topic:%22release_osa%22+status:open15:35
jrosserwould be nice to have a zuul job for he ovn octavia provider15:35
noonedeadpunkyeah, I can recall promising that15:35
noonedeadpunkit also feels, that on top of these highlights, we may finally be able to have skyline support15:36
jrossershould we make it so horizon and skyline can co-exist?15:37
jrosseri.e you might want to test skyline alongside15:38
opendevreviewDmitriy Rabotyagov proposed openstack/openstack-ansible-os_skyline master: Re-add Zuul testing to the project  https://review.opendev.org/c/openstack/openstack-ansible-os_skyline/+/91233315:38
jrosserthats perhaps just a case of making sure that the port numbers are programmable and don't assume 443 for either15:38
noonedeadpunkyeah15:39
noonedeadpunkI was actually thinking about some logic15:39
noonedeadpunkLike what we agreed on PTG was - whoever runs last - wins15:39
noonedeadpunkbut I was going to look into more complex logic frankly speaking15:39
noonedeadpunkalso I guess that having nginx is probably least concern, especially since we'd need to serve staticfiles somehow anyway...15:40
noonedeadpunkso these weekends I had plans to look into haproxy maps15:40
noonedeadpunkand make skyline to co-exist with horizon15:40
jrosserapache would be a good move for metal deploys15:41
jrosserso that it drops in as another thing alongside keystone15:41
noonedeadpunkI guess idea was to make /horizon and /skyline when both exist with redirect of / to /horizon by default15:41
noonedeadpunkactually. we have 1 thing left on nginx - repo server15:41
noonedeadpunkso metal deploys still have it15:41
jrosserwe do, that should ideally be tidied up too15:41
noonedeadpunkyeah15:42
noonedeadpunkagree15:42
noonedeadpunkok15:42
opendevreviewDmitriy Rabotyagov proposed openstack/openstack-ansible-os_skyline master: Add EL distro support  https://review.opendev.org/c/openstack/openstack-ansible-os_skyline/+/91237015:42
noonedeadpunkbut otherwise at least role/playbook do pass here: https://review.opendev.org/c/openstack/openstack-ansible-os_skyline/+/91237015:42
noonedeadpunkso thing is not super noop at least15:43
jrosserits very nice to see some work on that15:43
noonedeadpunkhave no idea if that would be used by me, but as I got it working at least - feels that we should finilize it15:44
opendevreviewDmitriy Rabotyagov proposed openstack/openstack-ansible-os_skyline master: Re-add Zuul testing to the project  https://review.opendev.org/c/openstack/openstack-ansible-os_skyline/+/91233315:52
opendevreviewDmitriy Rabotyagov proposed openstack/openstack-ansible-os_skyline master: Add EL distro support  https://review.opendev.org/c/openstack/openstack-ansible-os_skyline/+/91237015:52
noonedeadpunkI also still not sure how I feel about skyline UX at all15:53
noonedeadpunkLooks very modern... But slightly weird15:53
noonedeadpunkIt took me a while to understand where admin UI is at all15:56
noonedeadpunkanyway15:56
noonedeadpunk#endmeeting15:57
opendevmeetMeeting ended Tue Mar 12 15:57:13 2024 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)15:57
opendevmeetMinutes:        https://meetings.opendev.org/meetings/openstack_ansible_meeting/2024/openstack_ansible_meeting.2024-03-12-15.14.html15:57
opendevmeetMinutes (text): https://meetings.opendev.org/meetings/openstack_ansible_meeting/2024/openstack_ansible_meeting.2024-03-12-15.14.txt15:57
opendevmeetLog:            https://meetings.opendev.org/meetings/openstack_ansible_meeting/2024/openstack_ansible_meeting.2024-03-12-15.14.log.html15:57
ThiagoCMCjrosser, not sure if you know this but, I'm deploying OSA_AIO 2023.2 branch with SCENARIO='aio_lxc_ceph', plus the following variables set: 'install_method: distro', 'rabbitmq_install_method: distro', 'ceph_origin: distro', 'ceph_stable_release: reef', and 'ceph_pkg_source: distro'. But it still deploys Ceph Quincy! I noticed if I remove the `/etc/apt/preferences.d/openstack_hosts_pin.pref` file, then `apt upgrade` will try to upgrade 16:56
ThiagoCMCCeph to Reef (inside of Ceph Mon container, for example). What would be the proper way of avoiding or setting `openstack_hosts_pin.pref`? Also, it creates another file called `ceph_community_pin.pref` which is not needed when `distro` is used.16:56
noonedeadpunkThiagoCMC: you probably need to add/override `ceph_apt_pinned_packages` as well17:03
noonedeadpunkbut that should be adding different file - `ceph_client_pin.pref`17:04
ThiagoCMCCool, I see that `ceph_apt_pinned_packages` belongs to the `ceph_client` role, not `ceph-ansible`. But I'll take a look into it too!17:10
jrossernoonedeadpunk: are you in the ceph slack? theres a ceph-ansible channel just been made17:14
noonedeadpunkI'm not17:16
* noonedeadpunk not having slack installed even17:16
jrosserthink i managed to get slightly frustrated talking to them :/17:17
noonedeadpunkaren't they in irc anymore....17:17
noonedeadpunkhow to get to slack....17:17
noonedeadpunkjsut to double-check - slack is not mirrored to the irc?17:19
jrosserfor the #ceph channel yes17:19
jrosserthough i guess there is a bot of some sort does that17:20
nixbuildernoonedeadpunk: What is neutron_is_first_play_host for?  I see it in a patch that I think your wrote???17:29
noonedeadpunkit's to run things only once17:30
nixbuilderMy current neutron install is failing on that variable.17:30
noonedeadpunklike db creation or rabbitmq creation17:30
noonedeadpunkit should not17:30
noonedeadpunklikely you're missing smth from inventory17:30
nixbuilderhttps://paste.openstack.org/show/b8vLMtRLTLuFYVrEoIqj/17:30
nixbuilderIt's hard for me to filter through all that mess of output... trying though.17:31
noonedeadpunkugh17:33
noonedeadpunkyeah, not easy to read for sure.17:34
noonedeadpunk`'dict object' has no attribute 'vlan,local,geneve'`17:34
noonedeadpunkbut that is really smth off with defenition of some var, as this should not be an attribute, but rather a value17:37
ThiagoCMCAnother quick question: is OSA_AIO 'aio_lxc' 'master' branch good to start playing with Ubuntu 24.04 with OpenStack Caracal?17:43
noonedeadpunkno17:48
noonedeadpunkor well17:48
jrosserit's the best place to start development work to make that supported :)17:48
noonedeadpunkI mean, we never started looking into that17:48
noonedeadpunkBut it's good place to start playing 17:49
noonedeadpunkyeah, exactly 17:49
ThiagoCMCCool! I'll give it a try.17:49
noonedeadpunknixbuilder: so I would check places in your configs where you mention "vlan,local,geneve" and verify punctuation/mapping/values around that17:49
jrosserThiagoCMC: Caracal isnt released yet?17:50
noonedeadpunkneither is ubuntu 24.04 ;)17:51
noonedeadpunkBut I guess timing to start testing them is not bad17:51
nixbuildernonedeadpunk: Well I removed the 'local' so now I have just "vlan,geneve" but still get the almost the same error... minus the 'local'.  Still checking though.17:51
noonedeadpunkMy main concern if py3.12 will work with openstack17:51
noonedeadpunknixbuilder: I really think it's either wrong variable or smth off with delimiters17:52
noonedeadpunkas it's should be value, but role treats it as a key17:52
ThiagoCMCjrosser, damn, sorry... My bad. I meant that I'd like to try OSA_AIO with Ubuntu 24.04 (and whatever OpenStack version will be on it by default, I assumed it would be Caracal).17:53
ThiagoCMCAnyway, are you folks trying anything on Ubuntu 24.04 already, or not yet?17:53
noonedeadpunknot yet17:53
noonedeadpunkat least not me17:54
jrosserI might take a look as soon as there is a C release, which would be next month17:54
jrosserand i think a bunch of work has been done on python 3.12 for debian17:54
jrosserso thats fingers-crossed, but at the same time it could all just be a big bonfire17:55
ThiagoCMCOkdok, I plan to build a Private Cloud for a customer using Ubuntu 24.04 and Ceph Reef (without cephadm Docker crap). Let's hope for the best!  :-D18:02
noonedeadpunksounds like a plan18:04
ThiagoCMC^_^18:04
noonedeadpunkI also having a pet project around, and was thinking about same18:04
noonedeadpunkJust not going as extereme with full-distro source18:04
ThiagoCMCI really like Debian packages! I even run `apt upgrade` inside of the containers, no problem at all.18:05
jrosserwe need to make some adjustments anyway in OSA18:05
jrosserideally we would be deploying reef in the next release18:05
ThiagoCMCI'm ultra interested on that!18:06
ThiagoCMCCould OSA also provide a way of installing `ansible-core` Ubuntu package (`install_source: distro`), instead of `pip`? Including all of its "requirements.txt" (assuming they are all available as Ubuntu packages, leaving to `pip install` only what doesn't exist in Ubuntu itself)?18:13
ThiagoCMCIt seems that `scripts/bootstrap-ansible.sh` could just `apt install ansible-core` and be done with it.  =P18:15
jrosserbut how would you get the version we want?18:15
jrosserand on modern python you cannot co-exist distro python packages with pip ones18:16
ThiagoCMCWell, Ceph Ansible can easily leverage Ansible's Ubuntu PPA, works great.18:17
ThiagoCMCI didn't know about the co-exist issue with Python packages and pip ones. I personally almost never use `pip` in production (for non-OSA stuff). If the package doesn't exist on Debian (Sid) or Ubuntu rolling, I do my best to use the `stdeb` utility and make a Debian package out of a source Python project.18:19
spatelanyone have seen this error before - ForbiddenException: 403: Client Error for url: https://openstack01.example.com:9292/v2/images, You are not authorized to complete get_images action.<br /><br />18:19
spatelwhen I run openstack image list 18:19
noonedeadpunkactually, we had related report for horizon18:22
noonedeadpunkand I think i saw same happening there randomly in logs18:22
noonedeadpunkThiagoCMC: but does ubuntu ppa has all ballpark of ansible versions? at least by major releases?18:23
noonedeadpunklet me check...18:23
noonedeadpunkThiagoCMC: so Jammy has only 2.16? https://launchpad.net/~ansible/+archive/ubuntu/ansible?field.series_filter=jammy18:23
noonedeadpunkdefault repo is 2.1418:24
jrosseri just looked and it did not seem to have them all https://launchpad.net/~ansible/+archive/ubuntu/ansible?field.series_filter=jammy18:24
noonedeadpunkHow we are to install 2.15 we're currently using for 2023.2 and 2024.1?18:24
jrosserso this is basically not usable18:24
ThiagoCMCThere's the `ppa:ansible/ansible-2.10` - But I'm unsure if they are maintaining the versioned PPA repositories.18:32
ThiagoCMCIt's okay... I was just curious (I love Debian packages lol)18:32

Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!