| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/2023.1: Ensure that the inventory tox job runs on an ubuntu-jammy node https://review.opendev.org/c/openstack/openstack-ansible/+/932080 | 07:12 |
|---|---|---|
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/2023.1: Bump SHAs for 2023.1 https://review.opendev.org/c/openstack/openstack-ansible/+/931742 | 07:12 |
| sykebenX | Can anyone help me or point me to documentation on the proper procedure to rotate ca certs using openstack-ansible? | 13:31 |
| noonedeadpunk | so we have bunch of regen variables in a role | 13:32 |
| noonedeadpunk | about CA specifically - I think it should be this one: https://opendev.org/openstack/ansible-role-pki/src/branch/master/defaults/main.yml#L72-L73 | 13:32 |
| noonedeadpunk | But, regenerating RootCA is gonna be quite painful | 13:32 |
| noonedeadpunk | though, you can define an alternative name there, and it will just generate a new alternative, and use it for new certs | 13:33 |
| noonedeadpunk | which is what usually needed | 13:33 |
| sykebenX | Hmm I see - yeah the reason I am asking is because I accidentally misplaced my openstack_inventory.json file and ran setup-hosts which screwed up a bunch of the certs. I was able to get the old one again so that I could fix it temporarily, but looking to move from the old cert now to the new one on backend services. | 13:34 |
| noonedeadpunk | then, we were trying to use a `- pki` in service roles | 13:34 |
| noonedeadpunk | oh, so if it's all about certs, rather then CA - then it's easier | 13:35 |
| noonedeadpunk | pretty much you can run `openstack-ansible galera-install.yml -e pki_regen_cert=true` | 13:38 |
| noonedeadpunk | or smth - depending what's missing | 13:38 |
| noonedeadpunk | `--tags pki` is present somewhere, but not for galera, for instance (probably worth fixing that) | 13:38 |
| sykebenX | Ahh and then I just do that for each service that we're running then? | 13:40 |
| noonedeadpunk | yeah, kind of | 13:40 |
| noonedeadpunk | as PKI installation is part of the service role | 13:40 |
| noonedeadpunk | (as well as generation) | 13:40 |
| sykebenX | ahh that makes sense | 13:41 |
| noonedeadpunk | jut be careful with Nova | 13:41 |
| noonedeadpunk | as regenerating CA (not certs) may result in issues with VNC console | 13:42 |
| sykebenX | I will keep that in mind. Thanks so much for your help :) | 13:45 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: [WIP] Add autocomplete script for playbooks https://review.opendev.org/c/openstack/openstack-ansible/+/932220 | 17:16 |
| noonedeadpunk | this is very early stage and needs more work ^ | 17:16 |
| noonedeadpunk | Just pushed not to loose it :D | 17:18 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: [WIP] Add autocomplete script for playbooks https://review.opendev.org/c/openstack/openstack-ansible/+/932220 | 17:55 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Add autocomplete script for playbooks https://review.opendev.org/c/openstack/openstack-ansible/+/932220 | 19:10 |
| noonedeadpunk | NeilHanlon: do you have any idea of why I don't have bash completition by default after placing the file under /etc/bash_completion.d/ (or even /usr/share/bash-completion/completions/)? Isn't it smth that should work "by default"? | 19:16 |
| noonedeadpunk | as when I source file explicitly - it works | 19:16 |
| noonedeadpunk | (and it works on Ubuntu) | 19:16 |
| noonedeadpunk | just owndering if this is not intended to work unless user will edit their bashrc, or I'm having some very limited image here... | 19:19 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Add autocomplete script for playbooks https://review.opendev.org/c/openstack/openstack-ansible/+/932220 | 19:48 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Add autocomplete script for playbooks https://review.opendev.org/c/openstack/openstack-ansible/+/932220 | 19:50 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!