| opendevreview | Merged openstack/openstack-ansible master: Use the 'generated' apparmor profile for all containers https://review.opendev.org/c/openstack/openstack-ansible/+/924661 | 00:46 |
|---|---|---|
| platta | Checking out 29.0.1 and running scripts/bootstrap-ansible.sh is giving an error when it tries to check out a commit with hash 49e70b6511812b61ebe1d61107ab5413b79ec7ba from https://opendev.org/openstack/openstack-ansible-os_skyline. I've been testing with the same steps for a few days and just tonight this error started happening. Any chance the | 01:58 |
| platta | above merges could be the cause? | 01:58 |
| platta | I checked the repo and it does not have a commit with that hash. Wondering if the merge squashed away that specific commit. I'm hand-changing ansible-role-requirements.yml locally to reference master instead of that commit hash just to get things working. That's the only repo that caused an issue. | 02:05 |
| noonedeadpunk | hey there | 07:24 |
| noonedeadpunk | huh, that's really weird... | 07:26 |
| noonedeadpunk | Indeed I don't see the SHA in repo either... | 07:26 |
| noonedeadpunk | We will fix this obviously in the next release | 07:27 |
| noonedeadpunk | oh wait, here it is: https://opendev.org/openstack/openstack-ansible-os_skyline/commit/49e70b6511812b61ebe1d61107ab5413b79ec7ba | 07:29 |
| noonedeadpunk | platta: ^ | 07:29 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/2024.1: Bump SHAs for 2024.1 (Caracal) https://review.opendev.org/c/openstack/openstack-ansible/+/925732 | 08:17 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Bump SHAs for master https://review.opendev.org/c/openstack/openstack-ansible/+/924997 | 08:17 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_neutron stable/2024.1: Correct 'neutron-policy-override' tag https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/925733 | 08:18 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_neutron stable/2023.2: Correct 'neutron-policy-override' tag https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/925734 | 08:19 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_neutron stable/2023.1: Correct 'neutron-policy-override' tag https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/925735 | 08:19 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-tests master: Respect depends-on for collection installation https://review.opendev.org/c/openstack/openstack-ansible-tests/+/925746 | 09:03 |
| opendevreview | Merged openstack/ansible-role-uwsgi stable/2023.1: Ensure uWSGI is built with pcre support https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/925683 | 09:32 |
| opendevreview | Merged openstack/ansible-role-uwsgi stable/2023.2: Ensure uWSGI is built with pcre support https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/925682 | 09:32 |
| jrosser | can we merge https://review.opendev.org/c/openstack/openstack-ansible-tests/+/925719 to unblock other unmaintained branches | 09:51 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/2023.2: Bump SHAs for 2023.2 (Bobcat) https://review.opendev.org/c/openstack/openstack-ansible/+/925751 | 09:59 |
| opendevreview | Merged openstack/openstack-ansible master: Remove the get_md5 parameter from ansible stat tasks https://review.opendev.org/c/openstack/openstack-ansible/+/925564 | 10:01 |
| jrosser | noonedeadpunk: there is some kind of circular dep here on bookworm https://zuul.opendev.org/t/openstack/build/e2bc03b60bd84ba09225cd9e3af3cf96/log/logs/openstack/aio1-keystone-container-c4eb5e23/keystone-wsgi-public.service.journal-08-37-41.log.txt | 10:52 |
| jrosser | that failed patch is a depends-on here https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/924922 | 10:52 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: [doc] Add documentation on spawning HAProxy inside LXC https://review.opendev.org/c/openstack/openstack-ansible/+/924353 | 10:54 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: [doc] Add documentation on spawning HAProxy inside LXC https://review.opendev.org/c/openstack/openstack-ansible/+/924353 | 10:55 |
| noonedeadpunk | jrosser: well.... uwsgi is not directly dependent | 10:57 |
| noonedeadpunk | probavbly, I should reverse the dependency other way around | 10:57 |
| noonedeadpunk | I just wanted to ensure that both of them lead to uwsgi being built with pcre | 10:58 |
| jrosser | yeah looks like on bookworm uwsgi in the keystone container is built expecting pcre but for some reason it's not there | 10:59 |
| jrosser | and confusingly 924922 is the thing that should make it be there..... i wasnt really understanding why this does not fail for the other OS | 11:00 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/ansible-role-uwsgi master: Install pcre on destination hosts https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/924922 | 11:01 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_keystone master: Do not install uWSGI as part of Keystone https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/924928 | 11:01 |
| noonedeadpunk | I've just reverted the dependency now to if it it's going to work out better | 11:02 |
| platta | noonedeadpunk: Thanks for finding it. I’m not sure why it doesn’t seem to show up when browsing commits, or why ansible can’t seem to find it. | 11:02 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-tests master: Respect depends-on for collection installation https://review.opendev.org/c/openstack/openstack-ansible-tests/+/925746 | 11:29 |
| jrosser | platta: if you delete/rename the os_skyline repo that bootstrap-ansible creates, does it then work? | 11:55 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-tests master: Respect depends-on for collection installation https://review.opendev.org/c/openstack/openstack-ansible-tests/+/925746 | 12:00 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-plugins master: Ensure haproxy_service_config targets right host group https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/924341 | 12:10 |
| platta | jrosser: I re-imaged my machine and started from scratch. Yesterday when I did that it still wasn't working. Today, it seems to be working fine! | 12:49 |
| jrosser | platta: i was wondering if the issue was that the code did not fetch the up to date repo contents when it already existed | 12:50 |
| jrosser | if you clone from fresh it might be different behaviour and you always get the latest repo content | 12:50 |
| platta | I do always start fresh. I took an image of my server after a fresh Debian install, and I always start there, cloning the openstack-ansible repository. Maybe something was somehow out of sync for a time, but it does look ok now. If I see any other oddities I'll let you know here. | 12:52 |
| platta | jrosser: Following your advice from the other day, I've actually made my own customized version of the prepare_networking.yml that AIO uses. Basically I swapped out dummy-vlan for my real interface and adjusted the CIDRs accordingly. The issue I hit yesterday was the only thing preventing me from seeing if it actually worked. | 12:54 |
| jrosser | cool - the idea is that openstack-ansible is completely decoupled from how you choose to setup the host networking | 12:55 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-tests master: Respect depends-on for collection installation https://review.opendev.org/c/openstack/openstack-ansible-tests/+/925746 | 12:56 |
| jrosser | you can have anything you want, with whichever config tool is best for you | 12:56 |
| noonedeadpunk | (though you can configure host networking with openstack-ansible if you really want to) | 12:56 |
| jrosser | oh yes this is new isnt it | 12:56 |
| jrosser | i keep forgetting about that | 12:56 |
| platta | Hahaha, that's exactly what I decided to do. | 12:57 |
| noonedeadpunk | jrosser: since 2023.1: https://review.opendev.org/c/openstack/openstack-ansible-openstack_hosts/+/868534 | 12:57 |
| noonedeadpunk | so not _that_ new, but relatively to how long we're running osa internally - quite new xD | 12:58 |
| jrosser | platta: ^ make sure you've seen that too | 12:58 |
| opendevreview | Merged openstack/openstack-ansible-os_cinder stable/2023.1: Disable heartbeat_in_pthread by default https://review.opendev.org/c/openstack/openstack-ansible-os_cinder/+/924833 | 12:59 |
| platta | That is excellent! I am using the systemd_networkd role the same way AIO does. For now, I'm trying to build things a few pieces at a time, but it's good to know I might be able to just incorporate that into my overall configuration. | 13:00 |
| noonedeadpunk | I have some sample doc somewhere.... | 13:00 |
| noonedeadpunk | https://docs.openstack.org/openstack-ansible/latest/user/network-arch/example.html#configuring-network-interfaces | 13:00 |
| platta | I'm very much out of my depth on the majority of what I'm trying to do. The documentation and examples have been crucial for me, and very helpful. I'm learning a lot! | 13:01 |
| noonedeadpunk | and there was another sample here: https://review.opendev.org/c/openstack/openstack-ansible/+/924353/7/doc/source/user/prod/haproxy_in_lxc.rst | 13:02 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-plugins master: Always escalate privileges for attaching to containers https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/925272 | 13:26 |
| noonedeadpunk | so https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/924928 seems better now | 13:38 |
| noonedeadpunk | but https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/924922 needs to be re-voted now | 13:38 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_octavia master: Ensure Octavia communicates with Neutron through internal URL https://review.opendev.org/c/openstack/openstack-ansible-os_octavia/+/925770 | 13:49 |
| opendevreview | Merged openstack/openstack-ansible-tests unmaintained/zed: Remove use of debian-buster job https://review.opendev.org/c/openstack/openstack-ansible-tests/+/925719 | 14:10 |
| noonedeadpunk | #startmeeting openstack_ansible_meeting | 15:00 |
| opendevmeet | Meeting started Tue Aug 6 15:00:12 2024 UTC and is due to finish in 60 minutes. The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:00 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:00 |
| opendevmeet | The meeting name has been set to 'openstack_ansible_meeting' | 15:00 |
| noonedeadpunk | #topic rollcall | 15:00 |
| noonedeadpunk | o/ | 15:00 |
| jrosser | o/ hello | 15:00 |
| hamburgler | o/ | 15:00 |
| noonedeadpunk | #topic office hours | 15:03 |
| noonedeadpunk | So, I think we're ready to have new bugfix releases for stable branches | 15:03 |
| noonedeadpunk | though, I realized that it's probably worth pinging/bumping config_template collection for that | 15:04 |
| noonedeadpunk | #link https://review.opendev.org/c/openstack/releases/+/925750 | 15:04 |
| noonedeadpunk | or, we can include it in the next one | 15:04 |
| noonedeadpunk | there's 1 "bugfix" that mainly affects 1 nova thing | 15:04 |
| noonedeadpunk | so this topic is useless without config_template update | 15:05 |
| noonedeadpunk | #link https://review.opendev.org/q/Ifc1239e4ef768e94c44d8d07df7a0b93c73638f9 | 15:05 |
| noonedeadpunk | Im kinda fine with both options | 15:05 |
| jrosser | ah so in order to be able to use that we need to bump the version of config_template on stable branches? | 15:07 |
| noonedeadpunk | yeah | 15:07 |
| noonedeadpunk | maybe frickler will be able to help landing it when around :D | 15:08 |
| jrosser | well - the change it needs to config_template is kind of small | 15:08 |
| jrosser | not like a large change | 15:08 |
| noonedeadpunk | yeah, so it should be not an issue to update it's version | 15:09 |
| noonedeadpunk | just matter of time | 15:09 |
| jrosser | i think thats OK if your happy with that | 15:09 |
| noonedeadpunk | then, I just found an outstanding topic, that's been a while after initial discussion. | 15:10 |
| noonedeadpunk | #link https://review.opendev.org/c/openstack/openstack-ansible-os_octavia/+/922837 | 15:10 |
| noonedeadpunk | was going to ask if probably you have a better workaround already in place? | 15:10 |
| jrosser | that would be a question best for andrewbonney i think | 15:11 |
| noonedeadpunk | as I wasn;t able to iterate on that and even already forgot what the problem was :( | 15:12 |
| andrewbonney | Just reminding myself... | 15:12 |
| noonedeadpunk | and that sounds like smth worth backporting to 2024.1 at very least | 15:12 |
| jrosser | well yes - i think that at the moment the code doesnt really account for the deploy host being seperate | 15:12 |
| jrosser | ^ sort of | 15:12 |
| jrosser | and that you want to treat the utility containers as deleteable | 15:13 |
| noonedeadpunk | yeah, true | 15:13 |
| noonedeadpunk | now I've recalled | 15:13 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Enchance reference_group logic for inventory https://review.opendev.org/c/openstack/openstack-ansible/+/923596 | 15:13 |
| jrosser | perhaps it is actually better that the keypair is created on the deploy host, completely seperate | 15:13 |
| hamburgler | For this since we use an ansible role to deploy OSA to our deployment host, we copy over the octavia private key to deployment host, which then gets deployed to utility lxc, and added a task to utility playbook to deploy the key to utility lxc in event it is deleted | 15:14 |
| hamburgler | Maybe doesn't fit the use case here | 15:15 |
| jrosser | i think the issue here is that in the past it worked kind of like that | 15:15 |
| jrosser | but refactoring to use the openstack_resources role to handle creating the keypair has pretty different behaviour | 15:16 |
| noonedeadpunk | but to be fair - location on the deploy host was also very unfortunate, as it was under ${HOME} | 15:16 |
| jrosser | oh indeed yes | 15:16 |
| andrewbonney | Yeah, I think I worked around this when upgrading to C making sure the existing keys were manually in the right places to prevent tasks running, but that doesn't fix things if we needed to do a fresh deploy with our model | 15:16 |
| noonedeadpunk | so, we had some envs, where keypair was created under certain user home directories rather then "assumed" /root | 15:17 |
| jrosser | we could move to the ssh_keypairs role we have in the plugins repo | 15:17 |
| jrosser | then i think this all gets regularised with the other autogenerated keys | 15:17 |
| noonedeadpunk | but I think this is smth we'd need to fix before doing 29.1.0? as this totally will mess upgrades... | 15:17 |
| noonedeadpunk | and thinking about that... I guess I will get some time this week to look into the patch as part of upgrade preparation.. | 15:18 |
| jrosser | imho it is just making things more difficult by having nova generate the keypair | 15:19 |
| noonedeadpunk | So openstack_resources role does not rely on nova for that anymore | 15:19 |
| noonedeadpunk | moreover - this behaviour is deprecated in nova | 15:20 |
| noonedeadpunk | so current microapi will refuse to generate a keypair for you | 15:20 |
| jrosser | oh then we need to fix `comment: Generated-by-Nova` | 15:20 |
| noonedeadpunk | well. the problem with the comment is... that for existing keys module will either fail or rewrite the key depending on options | 15:21 |
| noonedeadpunk | so it's done to make it idempotent for upgrades case... | 15:21 |
| jrosser | ah | 15:21 |
| noonedeadpunk | (but as we know - upgrades are borked out of aio anyway) | 15:21 |
| jrosser | we should just patch octavia to have an ssh CA :) | 15:21 |
| jrosser | then you could make the key only when you need it | 15:22 |
| noonedeadpunk | hehe | 15:22 |
| noonedeadpunk | that would be too good | 15:22 |
| noonedeadpunk | ok, another thing, is that we have a lot of CI failures recently | 15:23 |
| jrosser | hmm well if you have some time to think about it - i don't think we will fix it here just now | 15:23 |
| jrosser | yes i was trying to keep a list of whats failing | 15:23 |
| jrosser | a bunch of failing to retrieve u-c which i think could be some regression as i thought we got that locally | 15:24 |
| jrosser | a bunch of failing to download cirros which needs openstack_resources to have a concept of a cache directiry | 15:24 |
| noonedeadpunk | one big change is that nginx got replaced with apache | 15:24 |
| jrosser | ceph seems fragile | 15:24 |
| noonedeadpunk | and there was obvious issue with rocky tls jobs which is now fixed | 15:25 |
| noonedeadpunk | yeah, openstack_resources totally needs a bit more love regarding images... | 15:25 |
| noonedeadpunk | And I also spotted ceph, but it seems to fail somewhere on tempest | 15:26 |
| jrosser | right - we did discuss caching / format conversion / which SHA to specify previously | 15:26 |
| noonedeadpunk | yeah, though was not able to check on that specifically | 15:28 |
| noonedeadpunk | was trying to fix the tests repo - utter waste of time :( | 15:29 |
| noonedeadpunk | we're doing so much things differently now.... | 15:29 |
| noonedeadpunk | ah. btw I've tried to propose some change to the apache role which we could potentially use, but seems it didn't went particulary well: https://github.com/geerlingguy/ansible-role-apache/pull/256 | 15:31 |
| noonedeadpunk | and yeah. there's quite some complexity needed not to break existing deployments | 15:32 |
| noonedeadpunk | so likely we'd need to come up with own one (as usual) | 15:32 |
| noonedeadpunk | and it's still on me to document how to run services on domain.com/<service_type> | 15:33 |
| noonedeadpunk | pretty much got that example working :D | 15:34 |
| noonedeadpunk | ended pretty much with this for services that use uwsgi: https://paste.openstack.org/show/bExMotkR2J2rZFmR9AzH/ | 15:37 |
| noonedeadpunk | but for those, that are not, I have to add `public_endpoint` option, ie for glance https://paste.openstack.org/show/bTA86aXPXL5rjHOJ6njP/ | 15:37 |
| noonedeadpunk | so having subdomains is way more neat, imo... | 15:38 |
| noonedeadpunk | but question stands - how to make such setup neat enough | 15:40 |
| noonedeadpunk | or just let it be documentation only | 15:41 |
| hamburgler | subdomains are much neater - especially when dealing with multiple regions, prefer this too | 15:44 |
| noonedeadpunk | the problem I was trying to solve - have single let's encrypt certificate | 15:45 |
| noonedeadpunk | But well, it's possible to specify all subdomains in the list as well... | 15:46 |
| noonedeadpunk | though until you will want to have different certs for internal and external endpoints... | 15:47 |
| noonedeadpunk | but yeah - I wasn't able to make RGW to work under URI at all | 15:49 |
| hamburgler | one thing you can do, if you place behind cloudflare using advance cert subscription, it proxys all. Still uses lets encrypt but makes management very simple and only a small fee | 15:49 |
| noonedeadpunk | well - we can't use cloudflare compliance wise | 15:49 |
| hamburgler | ah :( | 15:49 |
| noonedeadpunk | but yeah, I have 2 options here, so hopefully will document both of them soon | 15:50 |
| platta | I successfully modified the network configuration of an AIO in between deployment steps and ended up with an environment where I can create floating IPs that live on my physical network. Now I'll re-image and try using the same configuration files for a standard install. | 15:50 |
| * frickler is reading backlog, but not sure about the context, which change needs more power? | 15:53 | |
| noonedeadpunk | with the release hat on:) https://review.opendev.org/c/openstack/releases/+/925750 | 15:54 |
| noonedeadpunk | #endmeeting | 16:02 |
| opendevmeet | Meeting ended Tue Aug 6 16:02:32 2024 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:02 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/openstack_ansible_meeting/2024/openstack_ansible_meeting.2024-08-06-15.00.html | 16:02 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/openstack_ansible_meeting/2024/openstack_ansible_meeting.2024-08-06-15.00.txt | 16:02 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/openstack_ansible_meeting/2024/openstack_ansible_meeting.2024-08-06-15.00.log.html | 16:02 |
| jrosser | noonedeadpunk: about rgw and putting it on a sub uri, imho it’s always better to give that its own fqdn/san | 16:18 |
| noonedeadpunk | and I think it was discontinued in S3 API as well | 16:19 |
| noonedeadpunk | so yeah | 16:19 |
| jrosser | especially if you want to do s3 | 16:19 |
| jrosser | yeah | 16:19 |
| frickler | noonedeadpunk: ah, easy task then, done ;) | 16:19 |
| jrosser | also it’s then super easy to move onto its own hardware if you have a bunch of object traffic | 16:19 |
| noonedeadpunk | yeah, true | 16:20 |
| noonedeadpunk | I was doing that mainly out of interest and was wondering if it's even possibly to do consistently | 16:20 |
| noonedeadpunk | so #not-a-technical-advice | 16:21 |
| jrosser | I think eventually we run 3 sets | 16:21 |
| jrosser | one for s3 one for swift and one for static sites | 16:21 |
| opendevreview | Merged openstack/openstack-ansible master: Use gather_extra_facts role from plugins collection https://review.opendev.org/c/openstack/openstack-ansible/+/923405 | 17:13 |
| opendevreview | Merged openstack/ansible-role-uwsgi master: Install pcre on destination hosts https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/924922 | 17:13 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/2023.2: Bump SHAs for 2023.2 (Bobcat) https://review.opendev.org/c/openstack/openstack-ansible/+/925751 | 17:30 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/2024.1: Bump SHAs for 2024.1 (Caracal) https://review.opendev.org/c/openstack/openstack-ansible/+/925732 | 17:30 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/2023.1: Bump SHAs for 2023.1 (Antelope) https://review.opendev.org/c/openstack/openstack-ansible/+/925792 | 17:39 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-tests master: Clone Ansible roles to /etc/ansible https://review.opendev.org/c/openstack/openstack-ansible-tests/+/925794 | 18:18 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_octavia master: Ensure Octavia communicates with Neutron through internal URL https://review.opendev.org/c/openstack/openstack-ansible-os_octavia/+/925770 | 18:23 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_keystone master: Do not install uWSGI as part of Keystone https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/924928 | 18:47 |
| platta | I'm doing SSL termination on my own NGINX server, so I want to disable SSL on Horizon. There's a setting called horizon_external_ssl, but also a comment from odyssey4me that says "This variable is actually badly named, as it applies settings which have nothing to do with SSL." Is there a better recommended way to disable SSL on Horizon? | 19:47 |
| jrosser | platta: would be interested to know why you'd like to use an extra nginx? | 20:07 |
| platta | jrosser: I already have it running for other services I run on my local network, and I have it acting as a reverse proxy so I can hit my one IP address from different domain names and have NGINX route to the appropriate service internally. | 20:11 |
| jrosser | also haproxy does all the api as ssl | 20:13 |
| jrosser | so thinking only about horizon is just part of the picture | 20:14 |
| platta | Hmm. Well, my thought with Horizon is that I don't want to get certificate warnings when I pull it up in a browser. I do all my certs with certbot, and although I know OSA supports that, my little one-node cloud isn't exposed directly to the internet for the ACME challenge. The only path for that is through the NGINX setup I have already. | 20:17 |
| platta | I haven't gotten far enough to start thinking about automating OpenStack actions with the APIs, but I probably will. I guess I should just wait for now and deal with the certificate warnings until I get things up and running a bit more. | 20:17 |
| jrosser | personally i would stick with the something that works for a while | 20:18 |
| jrosser | i think the comments you see in the horizon role point to legacy stuff that needs some more work | 20:19 |
| jrosser | and i think there is ugliness with x-forwarded-proto which will trip you up | 20:20 |
| platta | Oh I've definitely run into some issues like that. If I decide to do it, it'll probably take a week of digging to figure out. I think I'll leave it for now. | 20:20 |
| jrosser | if you do manage something like that it would be great to do a "home lab" section of the docs | 20:21 |
| platta | In the meantime, I've got to work through my current installation. Looks like the repo container isn't working properly, and the setup-infrastructure playbook is failing when the utility container tries to pull upper_constraints_cached.txt. Getting connection refused, so I assume the repo container isn't working properly. | 20:21 |
| jrosser | as we do get a fair few queries about things like that | 20:22 |
| platta | I'll gladly contribute to the documentation once I get things working. So far it's really not far from the AIO configuration, but it took a while to understand the exact tweaks I needed to make. | 20:22 |
| jrosser | usual way to debug that is to look at haproxy, see if it thinks the backend is up | 20:23 |
| platta | Actually, there's a fair chance you could build something similar to the bootstrap-aio script just for a single node home lab. | 20:23 |
| platta | I'll take a look at haproxy. Whole new set of tools I need to learn. I tend to work in AWS at my day job. | 20:24 |
| jrosser | haproxy is "center of the universe" in an osa deployment | 20:26 |
| jrosser | all services call each other via haproxy on the internal endpoint | 20:27 |
| jrosser | and your users hit the external endpont | 20:27 |
| platta | I guess maybe the fact that I don't have haproxy_hosts in my config might be part of the issue? I based my config on the AIO template, and it doesn't include that. | 20:29 |
| jrosser | platta: it will be like this https://storage.gra.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_cab/924311/3/check/openstack-ansible-deploy-aio_lxc-ubuntu-jammy/cab496a/logs/etc/host/openstack_deploy/conf.d/ | 20:35 |
| opendevreview | Merged openstack/openstack-ansible master: Bump SHAs for master https://review.opendev.org/c/openstack/openstack-ansible/+/924997 | 21:55 |
| platta | I got as far as the setup-openstack playbook. Keystone install is failing. I traced it as far as line 74 here https://opendev.org/openstack/openstack-ansible-os_keystone/src/commit/429dfbea39f0695f072a7dc339e3c772cc39df7d/tasks/main.yml but not entirely sure where the code for that role is. I also found this post | 22:15 |
| platta | https://bugs.launchpad.net/openstack-ansible/+bug/2017689. HAProxy seems to think Galera is up, and that user_variable suggestion did not work. | 22:15 |
| platta | I had a hiccup in the middle of one of the playbooks where I lost connectivity and had to reboot the server. I'm going to try re-imaging and starting from the beginning with all my updated configuration files in case that caused an issue. | 22:16 |
| platta | Also, the actual error from ansible is: {"censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result", "changed": false} | 22:16 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!