| opendevreview | OpenStack Proposal Bot proposed openstack/openstack-ansible master: Imported Translations from Zanata https://review.opendev.org/c/openstack/openstack-ansible/+/949556 | 03:43 |
|---|---|---|
| opendevreview | Ivan Anfimov proposed openstack/openstack-ansible master: docs: fix for mistakes with Ansible, OpenStack-Ansible and RabbitMQ https://review.opendev.org/c/openstack/openstack-ansible/+/949537 | 07:36 |
| opendevreview | Ivan Anfimov proposed openstack/openstack-ansible master: wip https://review.opendev.org/c/openstack/openstack-ansible/+/949570 | 07:40 |
| opendevreview | Ivan Anfimov proposed openstack/openstack-ansible master: wip https://review.opendev.org/c/openstack/openstack-ansible/+/949570 | 07:41 |
| noonedeadpunk | I think we need to figure out wtf is wrong with https://zuul.opendev.org/t/openstack/build/9199af1212034c2fbc4f086c0569416a | 07:43 |
| opendevreview | Ivan Anfimov proposed openstack/openstack-ansible master: docs: update Project scope - remove duplicate phrase https://review.opendev.org/c/openstack/openstack-ansible/+/949570 | 07:55 |
| opendevreview | Merged openstack/openstack-ansible master: Fix links to Ansible documentation https://review.opendev.org/c/openstack/openstack-ansible/+/949536 | 08:12 |
| opendevreview | Merged openstack/openstack-ansible master: docs: fix for mistakes with Ansible, OpenStack-Ansible and RabbitMQ https://review.opendev.org/c/openstack/openstack-ansible/+/949537 | 08:12 |
| opendevreview | Merged openstack/openstack-ansible master: docs: remove old note about bug for Ansible https://review.opendev.org/c/openstack/openstack-ansible/+/949541 | 08:12 |
| opendevreview | Merged openstack/openstack-ansible master: Imported Translations from Zanata https://review.opendev.org/c/openstack/openstack-ansible/+/949556 | 08:16 |
| opendevreview | Merged openstack/openstack-ansible-tests stable/2024.2: Remove retired qdrouterd repo from zuul jobs https://review.opendev.org/c/openstack/openstack-ansible-tests/+/949193 | 08:34 |
| opendevreview | Merged openstack/openstack-ansible-tests stable/2024.1: Remove retired qdrouterd repo from zuul jobs https://review.opendev.org/c/openstack/openstack-ansible-tests/+/949194 | 08:40 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_cinder master: Include ceph_client role instead of importing https://review.opendev.org/c/openstack/openstack-ansible-os_cinder/+/949580 | 09:17 |
| opendevreview | Ivan Anfimov proposed openstack/openstack-ansible master: wip https://review.opendev.org/c/openstack/openstack-ansible/+/949583 | 09:31 |
| opendevreview | Ivan Anfimov proposed openstack/openstack-ansible master: docs: fix for issues when switching between pages using localization https://review.opendev.org/c/openstack/openstack-ansible/+/949583 | 09:44 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_cinder master: Use dynamic include instead of static imports for conditional tasks https://review.opendev.org/c/openstack/openstack-ansible-os_cinder/+/949585 | 09:53 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_cinder master: Remove quotes from conditional statements https://review.opendev.org/c/openstack/openstack-ansible-os_cinder/+/949588 | 09:57 |
| opendevreview | Dmitriy Chubinidze proposed openstack/openstack-ansible master: docs: enable translation for deploy guide https://review.opendev.org/c/openstack/openstack-ansible/+/947634 | 10:08 |
| opendevreview | Dmitriy Chubinidze proposed openstack/openstack-ansible master: docs: enable translation for deploy guide https://review.opendev.org/c/openstack/openstack-ansible/+/947634 | 10:08 |
| jpw_ | hey, i'm trying to get name based endpoints working and i'm following the instructions in https://docs.openstack.org/openstack-ansible/latest/user/prod/pretty_endpoint_naming.html#configuring-domain-based-endpoints-recommended. there seems to be a bit of wierdness here. | 10:18 |
| jpw_ | if i have the name based haproxy configuration enabled during the first run it will fail since map files have not been created yet, yet if i try to create the maps using `openstack-ansible openstack.osa.keystone --tags haproxy-service-config` it will also fail on subsequent nodes because the haproxy configuration hasn't progressed to the point where /etc/haproxy/conf.d hasn been created. | 10:20 |
| jpw_ | so my solution right now is to oscillate between running the two commands until everything is in place then run setup_infrastructure again. but it makes me feel like i'm doing something wrong. is there a better way? | 10:24 |
| * noonedeadpunk on the meeting right now | 10:30 | |
| jpw_ | actually i think i've solved it. i was using wildcard DNS records, switching back to A records seems to have made the error go away | 10:53 |
| * noonedeadpunk just finished | 11:21 | |
| noonedeadpunk | jpw_: good that you've solved it though | 11:22 |
| jpw_ | im not convinded i have tbh | 11:22 |
| jpw_ | im just having another run through | 11:23 |
| noonedeadpunk | So I don;t think it has anything to do with DNS records per say | 11:23 |
| noonedeadpunk | As map file is created during openstack.osa.haproxy run | 11:24 |
| jpw_ | im more just checking that i'm using this feature correctly. the doc's say that if those variables are modified to re run the parts of the playbook that they affect. | 11:24 |
| noonedeadpunk | and then you pretty much extend regexpes for each service | 11:24 |
| jpw_ | but those play's will be run as part of a general run right? so it should work from a deployment from scratch | 11:25 |
| noonedeadpunk | from scratch - yes, sure | 11:25 |
| noonedeadpunk | but eventually the base regexp should be added regardless tbh | 11:26 |
| noonedeadpunk | as part of this: https://opendev.org/openstack/openstack-ansible/src/branch/master/inventory/group_vars/haproxy/haproxy.yml#L83-L84 | 11:26 |
| noonedeadpunk | as we serve horizon/skyline/security through it already | 11:26 |
| jrosser | it would be very helpful to share whatever errors you get | 11:27 |
| jpw_ | was I wrong to assume this configuration went in user_variables.yml? | 11:27 |
| jpw_ | i'll make a paste | 11:27 |
| noonedeadpunk | it can go either to user_variables or to group_vars for a specific service | 11:28 |
| jpw_ | https://paste.openstack.org/show/bmYHIKHP6RYIj23Diaim/ | 11:31 |
| jpw_ | the important bit of line #6 for me was `failed to parse sample expression <req.hdr(host),map_dom(/etc/haproxy/base_domain.map)]> : invalid args in converter 'map_dom' : failed to open pattern file </etc/haproxy/base_domain.map>` | 11:32 |
| noonedeadpunk | jpw_: huh | 11:43 |
| noonedeadpunk | jpw_: what was the result of previous handlers? | 11:46 |
| noonedeadpunk | as map files should have been generated here: https://opendev.org/openstack/openstack-ansible-haproxy_server/src/branch/master/handlers/main.yml#L28-L37 | 11:46 |
| jpw_ | unfortunatly i'ts gone from my scrollback | 11:49 |
| noonedeadpunk | can you jsut run openstack.osa.haproxy ? | 11:50 |
| noonedeadpunk | as context around is important | 11:51 |
| jpw_ | yeah i've got it one moment | 11:51 |
| noonedeadpunk | I can assume that smth is off as logic is quite complex, but I don't see anything obvious | 11:52 |
| jpw_ | https://paste.openstack.org/show/bFhzBSLff9wBHYggBQVg/ | 11:52 |
| noonedeadpunk | do you have anything in /etc/haproxy/map.conf.d/ ? | 11:52 |
| noonedeadpunk | hm | 11:53 |
| jpw_ | drwxr-x--- 2 root haproxy 4096 May 13 11:27 base_regex | 11:53 |
| jpw_ | contains -rw-r----- 1 root haproxy 83 May 13 11:27 00-base.map | 11:53 |
| noonedeadpunk | I think I understand what is the issue now | 11:53 |
| jpw_ | contains `#Regular expression map file - this comment is defined in the base frontend config` | 11:54 |
| noonedeadpunk | jpw_: what if you do like https://paste.openstack.org/show/bkNduoLbM2Rbm3uZOhY7/ | 11:56 |
| noonedeadpunk | btw | 11:56 |
| noonedeadpunk | you also don't have to use base_domain either... this could be written through regex as well | 11:57 |
| jpw_ | that seems happy now | 11:59 |
| jpw_ | so what's the difference. the docs don't give a choice between domain/regex | 12:00 |
| noonedeadpunk | also, I think you need to change the order of elemets in haproxy_maps for precedence to work properly... but not sure | 12:00 |
| noonedeadpunk | ah, no, forget it | 12:00 |
| noonedeadpunk | it's correct now | 12:00 |
| noonedeadpunk | so map_dom should be slightly faster then map_reg | 12:01 |
| noonedeadpunk | but you could also do `'use_backend %[req.hdr(host),map_reg(/etc/haproxy/base_regex.map)]'` | 12:01 |
| noonedeadpunk | and then entry can look like `"volume.cloud.* cinder_api-back" | 12:02 |
| noonedeadpunk | if you can help and patch the doc - that will be really appreciated | 12:02 |
| jpw_ | oh i see, your fix ensures that files exists using haproxy_map_entries | 12:03 |
| noonedeadpunk | yeah | 12:04 |
| noonedeadpunk | as they are added only in later services, not in base one | 12:04 |
| noonedeadpunk | which raises the race condition | 12:04 |
| jpw_ | sorry, where's the documentation repo? | 12:07 |
| jpw_ | never mind, i just found it in the main repo | 12:08 |
| noonedeadpunk | yeah | 12:08 |
| jrosser | i think we should be able to test this? | 12:14 |
| jrosser | theres already some fake stuff for external fqdn for the stepca job | 12:14 |
| jrosser | so that could be adapted with some extra /etc/hosts entries for identity.blah volume.blah etc | 12:15 |
| noonedeadpunk | we probably can. I'm a bit concerned about amount of jobs we already run though | 12:17 |
| jrosser | its probably enough for an infra job | 12:17 |
| noonedeadpunk | yeah, right | 12:17 |
| noonedeadpunk | or maybe add something for haproxy specifically.... | 12:18 |
| noonedeadpunk | or even for molecule.... | 12:18 |
| jrosser | indeed, there can be something specific here | 12:18 |
| noonedeadpunk | as that actually boils down to testing of haproxy maps I guess... | 12:19 |
| noonedeadpunk | but not sure really | 12:19 |
| *** tosky_ is now known as tosky | 12:27 | |
| jpw_ | this scm is interesting. im not sure what it's asking me to do. so i clone the repo, do i create a branch or modify main directly? | 12:32 |
| noonedeadpunk | you can modify directly | 12:36 |
| noonedeadpunk | you'd need to have git-review plugin though | 12:36 |
| noonedeadpunk | you can also create the branch :) | 12:37 |
| noonedeadpunk | the branch is used as a change topic | 12:37 |
| noonedeadpunk | (so you can group changes across multiple repos) | 12:38 |
| noonedeadpunk | you also need an account https://review.opendev.org/, define a username, upload the ssh key | 12:38 |
| opendevreview | James Park-Watt proposed openstack/openstack-ansible master: doc: haproxy_base_service_overrides https://review.opendev.org/c/openstack/openstack-ansible/+/949625 | 12:46 |
| jpw_ | phew, made it | 12:46 |
| noonedeadpunk | jpw_: thanks! | 13:07 |
| jpw_ | yw | 13:07 |
| opendevreview | Merged openstack/openstack-ansible master: doc: haproxy_base_service_overrides https://review.opendev.org/c/openstack/openstack-ansible/+/949625 | 13:44 |
| noonedeadpunk | #startmeeting openstack_ansible_meeting | 15:00 |
| opendevmeet | Meeting started Tue May 13 15:00:34 2025 UTC and is due to finish in 60 minutes. The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:00 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:00 |
| opendevmeet | The meeting name has been set to 'openstack_ansible_meeting' | 15:00 |
| noonedeadpunk | #topic rollcall | 15:00 |
| noonedeadpunk | o/ | 15:00 |
| David_Gomez | o/ | 15:00 |
| jrosser | o/ | 15:03 |
| noonedeadpunk | #topic office hours | 15:06 |
| noonedeadpunk | so I think we are super close today | 15:06 |
| noonedeadpunk | to get roles branched witrh 2025.1 | 15:06 |
| noonedeadpunk | I'm not sure we do have hard blockers actually | 15:07 |
| NeilHanlon | o/ | 15:07 |
| jrosser | it is a shame to miss the swift stuff | 15:08 |
| noonedeadpunk | there are some Swift outstanding improvements, but I think we may be able to backport them after branching | 15:08 |
| jrosser | hah :) | 15:08 |
| jrosser | ^ that | 15:08 |
| jrosser | its basically broken so this is bugfix work | 15:08 |
| noonedeadpunk | today the blocker for them are 0775 permissions in /etc on Rocky | 15:08 |
| noonedeadpunk | we can try to address it in ssh_keypairs role | 15:09 |
| noonedeadpunk | but I feel weird changing permissions for etc | 15:09 |
| jrosser | can we do it in zuul pre task or something | 15:10 |
| jrosser | thats less wierd | 15:10 |
| jrosser | as its a CI specific fix, in a CI specific place | 15:10 |
| NeilHanlon | yeah.. i can get it fixed but it probably will take too long to be meaningful for us | 15:10 |
| NeilHanlon | i have to build and test and publish containers, then nodepool would have to rebuild them... then propagate that out... | 15:10 |
| noonedeadpunk | I'm thinking if this can be done in CI for upgrade jobs... | 15:11 |
| noonedeadpunk | if in some pre_tasks | 15:11 |
| noonedeadpunk | it can work, yeah, I will try this out | 15:11 |
| noonedeadpunk | and the next confusing/broken thing is OVS for Noble. | 15:11 |
| noonedeadpunk | #link https://zuul.opendev.org/t/openstack/build/9199af1212034c2fbc4f086c0569416a | 15:12 |
| noonedeadpunk | and I was able to reproduce this, it seems | 15:12 |
| noonedeadpunk | so potentially this might be quite valid bug | 15:12 |
| jrosser | hmm i wonder if we have the right version | 15:13 |
| jrosser | like assumption of ovs version vs distro repo vs UCA ..... | 15:14 |
| noonedeadpunk | in AIO I got 3.5.0 | 15:14 |
| noonedeadpunk | but also | 15:14 |
| noonedeadpunk | metal is passing | 15:14 |
| noonedeadpunk | https://zuul.opendev.org/t/openstack/build/8f30d7d8d8e64d1ba25e6aa46f09f4cf | 15:14 |
| jrosser | having said all this - the other jobs are all OVN which uses OVS under the hood | 15:15 |
| jrosser | so that side of things is OK on noble | 15:16 |
| noonedeadpunk | well. OVN is kinda different, as it's not neutron code that need to deal with OVS wiring and namespaces and etc | 15:16 |
| noonedeadpunk | its Neutron -> OVN -> OVS | 15:16 |
| jrosser | and i just catch up with this - it's the LXC version of this job which fails but metal is OK | 15:17 |
| noonedeadpunk | yeah, which is weird | 15:18 |
| noonedeadpunk | but seems reproducible at very least | 15:18 |
| noonedeadpunk | I jsut did not check on logs in my AIO yet | 15:18 |
| noonedeadpunk | Other then that... I guess I'd love to land https://review.opendev.org/c/openstack/openstack-ansible/+/946281 regardless, before branching happens | 15:19 |
| noonedeadpunk | Probably it's a bit too late, but also I'm not sure what we are actually testing now | 15:19 |
| noonedeadpunk | this should have been done right after the beta | 15:19 |
| jrosser | theres some errors about dropped packets on bt-int https://3e3b9bb51c4bbfcca1ce-b2ab9ab260082d15bc4e79c36fac49d2.ssl.cf5.rackcdn.com/openstack/9199af1212034c2fbc4f086c0569416a/logs/host/openvswitch/ovs-vswitchd.log.txt | 15:20 |
| noonedeadpunk | I have same log pretty much on aio, yes | 15:21 |
| noonedeadpunk | it can boil down to some brdige setup and veth | 15:24 |
| noonedeadpunk | as we connect br-provider in ovs with br-vlan in lxb thrtough veth eth12 | 15:24 |
| noonedeadpunk | but yeah - other then that things look pretty good | 15:30 |
| jrosser | it will be good to get the release done to work on new ansible and also cutting the number of jobs back where possible | 15:31 |
| noonedeadpunk | I don't think we will in fact drop anything | 15:32 |
| noonedeadpunk | as Debian 13 is pretty much released | 15:32 |
| noonedeadpunk | so I assume we'll need to look into it as well | 15:32 |
| jrosser | i have a few patches outstanding for zuul errors cleanup in stable and unmaintained | 15:33 |
| jrosser | and also a few that can't be merged | 15:34 |
| noonedeadpunk | wich are not passing | 15:34 |
| noonedeadpunk | yeah | 15:34 |
| jrosser | idk if we want to get them force merged or not | 15:34 |
| jrosser | but there is a problem that the 2023.2 branch is deleted from the service repos | 15:34 |
| jrosser | but not from ours | 15:34 |
| jrosser | so i think thats a big cause of the trouble | 15:35 |
| noonedeadpunk | oh... right... | 15:36 |
| noonedeadpunk | I think I need to look on EOM-ing the branch | 15:36 |
| jrosser | yep - there are several processes, EOM-ing, unmaintaining etc | 15:36 |
| jrosser | and of course we are somewhat offset from those today compared to the rest of the projects | 15:37 |
| jrosser | zed is messy right now in particular | 15:37 |
| noonedeadpunk | I frankly did not look into CI results except saw they're not feeling good | 15:38 |
| noonedeadpunk | ok, so to sum up plan for this week - branch roles, propose rc1, EOM 2023.2, check what's up with Zed | 15:40 |
| noonedeadpunk | and try to figure out OVS/Swift | 15:43 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Ensure /etc permissions in CI https://review.opendev.org/c/openstack/openstack-ansible/+/949647 | 15:51 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_swift master: Migrate ring distribution to SSHCA https://review.opendev.org/c/openstack/openstack-ansible-os_swift/+/946990 | 15:51 |
| noonedeadpunk | let's see if that will help | 15:51 |
| noonedeadpunk | oh, one thing I wanted to discuss actually | 15:52 |
| noonedeadpunk | which is this patch | 15:53 |
| noonedeadpunk | #link https://review.opendev.org/c/openstack/openstack-ansible/+/949497 | 15:53 |
| noonedeadpunk | and if we wanna go this route, or better to properly patch tooling and add support for deploy-guide folders import to Zanata instead | 15:53 |
| noonedeadpunk | as eventually - this patch is pretty much a workaround | 15:53 |
| noonedeadpunk | over stuff related to the translations overall | 15:54 |
| noonedeadpunk | so any input/ideas on how we prefer moving forward is really appreciated | 15:56 |
| noonedeadpunk | or we can try this way and revert if it does not work... | 15:59 |
| noonedeadpunk | #endmeeting | 15:59 |
| opendevmeet | Meeting ended Tue May 13 15:59:33 2025 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:59 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/openstack_ansible_meeting/2025/openstack_ansible_meeting.2025-05-13-15.00.html | 15:59 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/openstack_ansible_meeting/2025/openstack_ansible_meeting.2025-05-13-15.00.txt | 15:59 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/openstack_ansible_meeting/2025/openstack_ansible_meeting.2025-05-13-15.00.log.html | 15:59 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_glance master: Use dynamic include instead of static imports for conditional tasks https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/949653 | 16:27 |
| jpw_ | am i right that haproxy_user_ssl_cert,key,ca is the certificate applied to the external vip of haproxy? | 16:45 |
| noonedeadpunk | it might even for both, if you have tls for internal as well | 16:49 |
| * jrosser hopes those are independent | 16:50 | |
| noonedeadpunk | I don't think they are https://opendev.org/openstack/openstack-ansible-haproxy_server/src/branch/master/vars/main.yml#L65 | 16:50 |
| jrosser | feels like an error | 16:50 |
| * noonedeadpunk needs to refactor all that to enable indepenedent frontend configuration | 16:51 | |
| noonedeadpunk | a lot of legacy coming from our assumption of 2 frontend alway | 16:51 |
| jrosser | as likely use case would be user cert on the external vip and pki role on all internal things | 16:51 |
| noonedeadpunk | or no tls on internal... | 16:52 |
| noonedeadpunk | or do wildcard or SAN | 16:52 |
| noonedeadpunk | or rely on let's encrypt | 16:52 |
| jrosser | indeed, many options | 16:52 |
| jrosser | yes | 16:52 |
| noonedeadpunk | as let's encrypt on front and pki on back does work | 16:52 |
| jrosser | I think we never really explored anything but what you describe there | 16:52 |
| noonedeadpunk | but haproxy_user_ssl_cert should be wildcard/SAN as of today | 16:52 |
| noonedeadpunk | if you want to cover internal with TLS | 16:53 |
| noonedeadpunk | yeah, we jsut do SANs | 16:53 |
| jrosser | yes this all needs a revisit | 16:53 |
| jpw_ | yes it os both internal + external | 16:53 |
| jrosser | ipv6 is ugly in this area too | 16:53 |
| noonedeadpunk | but it is annoying in a way still | 16:53 |
| jpw_ | im planning to spin up an acme server in due course. i just need something i can sign with an existing ca so not to have CA sprawl | 16:54 |
| jrosser | you’ll just have to make sure all the services trust that CA | 16:55 |
| jrosser | if you use tls on the internal vip too | 16:55 |
| jrosser | which is optional | 16:55 |
| noonedeadpunk | or you can rely on OSA-issues CA | 16:55 |
| jrosser | well not if the user supplied cert is on both sides? | 16:56 |
| noonedeadpunk | no, not then | 16:56 |
| noonedeadpunk | but well | 16:56 |
| jrosser | jpw_: message is…. this can get complicated :/ | 16:57 |
| noonedeadpunk | you can pass custom root CA to OSA and it can generate an intermediate out of it | 16:57 |
| jpw_ | so if i want custom certs on the external api's + horizon i need to override the whole of pki? | 16:57 |
| jpw_ | eesh | 16:57 |
| noonedeadpunk | and then generate self-singed with the intermediate and add custom CA to trust store | 16:57 |
| noonedeadpunk | we did that in quite some places | 16:57 |
| noonedeadpunk | jpw_: it all depends, really | 16:58 |
| jpw_ | so generate an intermediate for the PKI playbooks to consume and use to sign services? | 16:58 |
| jrosser | if you want | 16:58 |
| jrosser | sorry that’s not specific | 16:58 |
| jpw_ | what would be ideal really | 16:58 |
| jrosser | in short the trust needs to exist in the right places | 16:59 |
| jpw_ | s/what/that/ | 16:59 |
| noonedeadpunk | Like - I'm using own self-signed CA for internal endpoints and then let's encrypt for public ones | 16:59 |
| noonedeadpunk | And then each region just issues an intermediate based of this root CA | 16:59 |
| jpw_ | is there not a way to use self signed for internal and just use a user provided cert for publilc endpoints? | 17:00 |
| noonedeadpunk | and certs in each region are based of it | 17:00 |
| noonedeadpunk | I'm afraid not today | 17:00 |
| jpw_ | ok that's fine | 17:00 |
| jrosser | jpw_: thats the one case you just need to take care with | 17:00 |
| noonedeadpunk | then user provided should include domains for internal | 17:00 |
| noonedeadpunk | so it should be SAN/wildcard | 17:00 |
| jrosser | and your CA should be injected into all the hosts/containers | 17:01 |
| noonedeadpunk | you can actually just define the variable and roles can do that injection for you | 17:01 |
| jpw_ | if it's not possible i'll just go the self signed osa managed route it's easier and just a POC. | 17:01 |
| jrosser | tbh this is a bit of an oversight - it should be easier than this | 17:02 |
| jrosser | we do have an entirely self contained example in the AIO using pki inside and acme outside | 17:02 |
| noonedeadpunk | is `openstack_pki_install_ca: [{'name': 'MyRoot'}] and then place your root CA under openstack_deploy/pki/roots/MyRoot/certs/MyRoot.crt | 17:02 |
| noonedeadpunk | if you also place private key under openstack_deploy/pki/roots/MyRoot/private/MyRoot.key.pem ou can override an intermediate details to use it for all cert issuing | 17:04 |
| noonedeadpunk | just set `openstack_pki_authorities` to this second part https://opendev.org/openstack/openstack-ansible/src/branch/master/inventory/group_vars/all/ssl.yml#L49-L63 and set `signed_by: MyRoot` | 17:05 |
| noonedeadpunk | once you run openstack.osa.certificate_authority - you should be able to drop the privbate key from openstack_deploy/pki/roots/MyRoot/certs/MyRoot.crt | 17:06 |
| jpw_ | i'll take another look in due course. thanks for the info. | 17:13 |
| jrosser | if it’s just a poc I would avoid something you won’t do in prod and is complex | 17:16 |
| jrosser | simpler to have a local acme server to stand in for LE, maybe | 17:16 |
| jpw | i think that's what my plan is except since i'm working in greenfield I don't have anywhere to run vault | 17:36 |
| jpw | it's of so long as i can clearly communicate for x i need y that's good enough for me | 17:37 |
| noonedeadpunk | nice - https://review.opendev.org/c/openstack/openstack-ansible-os_swift/+/946990 passes now | 18:15 |
| opendevreview | Daniel Preussker proposed openstack/openstack-ansible-os_swift master: Remove md5 checks of rings/builders https://review.opendev.org/c/openstack/openstack-ansible-os_swift/+/947021 | 18:15 |
| opendevreview | Daniel Preussker proposed openstack/openstack-ansible-os_swift master: swift-object-expirer is its own distro package https://review.opendev.org/c/openstack/openstack-ansible-os_swift/+/947048 | 18:15 |
| opendevreview | Daniel Preussker proposed openstack/openstack-ansible-os_swift master: Remove seemingly unsused mlocate cronjob https://review.opendev.org/c/openstack/openstack-ansible-os_swift/+/947050 | 18:15 |
| jrosser | thats great to see | 18:49 |
| opendevreview | Merged openstack/openstack-ansible master: docs: fix for issues when switching between pages using localization https://review.opendev.org/c/openstack/openstack-ansible/+/949583 | 21:30 |
| Wirednull | Hi all! In an OSA AIO Dalmatian Ubuntu 24.04 (SCENARIO=aio_lxc_ovs) I still get Linux bridges like br-vxlan and br-vlan (br-mgmt/br-storage/lxcbr0 are fine) while only br-tun/br-provider/br-int are on OVS; shouldn’t the vxlan/vlan bridges be OVS too, or is that expected? | 21:43 |
| Wirednull | Oh, there are also the other bridges like br-bmaas, br-dbaas, br-lbaas... Shouldn't those also br with OVS from now on? | 21:48 |
| opendevreview | Ivan Anfimov proposed openstack/openstack-ansible master: wip https://review.opendev.org/c/openstack/openstack-ansible/+/949683 | 21:48 |
| Wirednull | One more question, with this SCENARIO, the OVN is not included. Correct? | 21:49 |
| opendevreview | Ivan Anfimov proposed openstack/openstack-ansible master: wip https://review.opendev.org/c/openstack/openstack-ansible/+/949683 | 21:49 |
| opendevreview | Ivan Anfimov proposed openstack/openstack-ansible master: docs: replace broken url to "Getting Started with MariaDB Galera Cluster" https://review.opendev.org/c/openstack/openstack-ansible/+/949683 | 21:51 |
Generated by irclog2html.py 4.0.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!