| f0o | Moving the v6 onto a vlan made me notice that OVN-DHCP does not really work well when there are no OVN Routers attached to the network | 05:49 |
|---|---|---|
| f0o | but at least (external) SLAAC will always work | 05:49 |
| f0o | re DHCP I found that there were no dhcp-options set on the LRPs | 05:50 |
| noonedeadpunk | good morning | 06:34 |
| noonedeadpunk | hm, I indeed can't recall how dhcp does behave without router.... | 06:35 |
| noonedeadpunk | jrosser: do you mind proposing your venv patch to the fork https://github.com/adriacloud/ansible-collection-kubernetes ? | 08:20 |
| noonedeadpunk | spent some time yesterday on bumping versions and tested OS as well | 08:21 |
| noonedeadpunk | as it's been a week after our previous discussion and pings... | 08:21 |
| opendevreview | Dmitriy Chubinidze proposed openstack/openstack-ansible master: Deprecate br-vlan bridge usage https://review.opendev.org/c/openstack/openstack-ansible/+/955457 | 09:16 |
| opendevreview | Dmitriy Chubinidze proposed openstack/openstack-ansible master: Deprecate br-vlan bridge usage https://review.opendev.org/c/openstack/openstack-ansible/+/955457 | 09:27 |
| noonedeadpunk | folks, should we try out and go ahead with https://review.opendev.org/c/openstack/openstack-ansible/+/949497 ? | 09:31 |
| jrosser | noonedeadpunk: i made a PR for the venv patch - not even looked at the code to see if we need to fix/improve it at all though | 13:05 |
| noonedeadpunk | hm, why I didn't got any email for that... | 13:07 |
| noonedeadpunk | I merged and tagged the repo | 13:31 |
| jrosser | we should be able to switch the ops repo stuff over to point to that? | 13:47 |
| noonedeadpunk | yeah, totally | 13:47 |
| noonedeadpunk | though namespace should be changed in playbooks... | 13:47 |
| noonedeadpunk | I didn't play enough with azimuth driver though... | 13:49 |
| noonedeadpunk | will propose patch though | 13:50 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-ops master: Switch to using vexxhost.kubernetes fork https://review.opendev.org/c/openstack/openstack-ansible-ops/+/955476 | 14:02 |
| jrosser | damiandabrowski: are we talking about two completely different things about private keys in https://review.opendev.org/c/openstack/ansible-role-pki/+/954239 | 14:12 |
| damiandabrowski | hmm maybe, what did you have in mind? :D | 14:14 |
| jrosser | well, just that if we were doing this all again from scratch, the private key would have never been on the pki host | 14:15 |
| jrosser | we would (should) have generated the private key on the target server and signed the CSR on the pki host | 14:15 |
| jrosser | so if we did a v2 of the standalone backend, thats how it should work | 14:16 |
| jrosser | my question really for the vault backend is if we are trying to follow the same semantics as the standalone backend, or follow best practice for the private key | 14:17 |
| damiandabrowski | okay, but now we're not talking about my comment in https://review.opendev.org/c/openstack/ansible-role-pki/+/954239 but hashi_vault concept in general? | 14:18 |
| damiandabrowski | i.e. you want to clarify if we want to generate a CSR and issue cert with this (using vault) or just obtain a certificate and key from vault directly | 14:19 |
| damiandabrowski | i picked the latter because it's just simpler and I don't see any drawbacks. The key is not stored either on deploy host or in vault | 14:20 |
| damiandabrowski | and I don't think that this approach is against best practices. Vault's docs explain it as an advantage | 14:22 |
| damiandabrowski | "The PKI secrets engine generates dynamic X.509 certificates. | 14:22 |
| damiandabrowski | With this secrets engine, services can get certificates without going through the usual manual process of generating a private key and CSR, submitting to a CA, and waiting for a verification and signing process to complete." | 14:22 |
| damiandabrowski | https://developer.hashicorp.com/vault/docs/secrets/pki | 14:22 |
| noonedeadpunk | `No matching distribution found for ansible-core==2.18.6` huh | 14:24 |
| noonedeadpunk | oh, `osa-ubuntu-jammy-32GB` | 14:24 |
| jrosser | there might be more appropriate nested virt labels with the new zuul image changes | 14:28 |
| jrosser | but we need nested virt + 32G for sure | 14:28 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-ops master: Switch CAPI jobs to noble https://review.opendev.org/c/openstack/openstack-ansible-ops/+/955479 | 14:30 |
| noonedeadpunk | I _think_ I saw 16G ones as well recently... | 14:30 |
| jrosser | ah those might work - not sure | 14:30 |
| noonedeadpunk | which could be fine as well | 14:30 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-ops master: Switch to using vexxhost.kubernetes fork https://review.opendev.org/c/openstack/openstack-ansible-ops/+/955476 | 14:30 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-ops master: Switch to using vexxhost.kubernetes fork https://review.opendev.org/c/openstack/openstack-ansible-ops/+/955476 | 14:31 |
| opendevreview | Damian Dąbrowski proposed openstack/ansible-role-pki master: Add hashi_vault backend https://review.opendev.org/c/openstack/ansible-role-pki/+/948881 | 14:32 |
| jrosser | damiandabrowski: how would we deal with an improved standalone v2 backend if the handler to build the key/cert bundle was removed from the roles? | 14:33 |
| damiandabrowski | yeah, from the perspective of "standalone v2 backend" it may be problematic :/ | 14:42 |
| damiandabrowski | but current behavior may be problematic as well | 14:42 |
| damiandabrowski | Let's imagine that someone uses ansible-role-pki with some custom software that also expects cert+key combined in a single file. | 14:42 |
| damiandabrowski | They would need to prepare that file outside ansible-role-pki(like we do with this 'regen pem' handler) which just doesn't look optimal to me. | 14:43 |
| damiandabrowski | so idk...maybe there is no perfect solution | 14:43 |
| noonedeadpunk | jrosser: btw there was another thing about networkd and proxy and chicken-egg situation | 15:07 |
| jrosser | yeah i saw /o\ | 15:08 |
| noonedeadpunk | as using different values depending on lxc/metal does not work as expected when things are delegated | 15:08 |
| noonedeadpunk | I guess we'd need to use delegate_facts, but ugh | 15:08 |
| jrosser | tbh different values is probably something noone ever wants to do | 15:08 |
| noonedeadpunk | yeah | 15:09 |
| jrosser | so the danger is making the test case somehow wierd that doesnt match reality | 15:09 |
| noonedeadpunk | yeah | 15:12 |
| noonedeadpunk | but I really don't know good solution at this point | 15:12 |
| noonedeadpunk | except accepting that containers will be able to comminicate with public VIP. | 15:12 |
| noonedeadpunk | which we do not want to do to test that everything is communicating over internal one | 15:13 |
| noonedeadpunk | or make exeption for proxy job and br-mgmt and make it the only case which is provisioned in aio | 15:15 |
| noonedeadpunk | or just give up on this specific thing | 15:15 |
| jrosser | well or maybe its just that we are missing some IP on the host thats set up right at the start, purely for test fixtures | 15:22 |
| jrosser | and it's just never part of the openstack deployment, maybe only a route to it | 15:22 |
| noonedeadpunk | I am not sure I catched the idea tbh | 15:49 |
| noonedeadpunk | as all hosts are coming with a single interface/ip on it | 15:50 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-ops master: Switch to using vexxhost.kubernetes fork https://review.opendev.org/c/openstack/openstack-ansible-ops/+/955476 | 16:04 |
| noonedeadpunk | it seems we don't really consume/respect depends-on for ops repo nowadays | 16:05 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-ops master: Drop vexxhost.kubernetes from requirements https://review.opendev.org/c/openstack/openstack-ansible-ops/+/955493 | 16:05 |
| noonedeadpunk | or well... partially at least | 16:06 |
| noonedeadpunk | as https://zuul.opendev.org/t/openstack/build/80d65747972b431d99cddcac45321076 is really off a bit | 16:06 |
| noonedeadpunk | as while collection is no longer installed, playbok references are old | 16:06 |
| opendevreview | Merged openstack/openstack-ansible-os_horizon master: Remove outdated option (SAHARA_AUTO_IP_ALLOCATION_ENABLED) and updated outdated URLs https://review.opendev.org/c/openstack/openstack-ansible-os_horizon/+/955425 | 16:22 |
| jrosser | noonedeadpunk: i think what i mean is having some other IP on the host (maybe a dummy interface?) tht we just configure right at the start | 16:26 |
| jrosser | that gives squid/step-ca/whatever an IP to bind to | 16:27 |
| jrosser | then we could keep all the benefits of being able to configure the host networking that you've done in your patch | 16:28 |
| jrosser | but make the CI / AIO specific bits seperate from that | 16:28 |
| noonedeadpunk | jrosser: and then make it reachable via route? | 16:30 |
| jrosser | yeah, that seems the compromise in the middle of all this | 16:31 |
| noonedeadpunk | ok | 16:31 |
| jrosser | i like what you have done with your patch for configuring hosts completely | 16:31 |
| jrosser | and it does seem a shame to lose that for the sake of a test case which actually would not happen in the same way outside CI | 16:31 |
| noonedeadpunk | I'm not sure if step-ca needs that tbh, as we can do setup setp-ca after setup-hosts easily, as it;s needed only for setup-infrastructure | 16:31 |
| noonedeadpunk | so it can be a hook easily | 16:31 |
| noonedeadpunk | but proxy is very annoying thing :D | 16:32 |
| noonedeadpunk | I'll check what can be done there | 16:46 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Serve proxy on a standalone interface https://review.opendev.org/c/openstack/openstack-ansible/+/955498 | 17:21 |
| noonedeadpunk | huh. it adds third test to the list - which are static routes inside of LXC... | 17:21 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Serve proxy on a standalone interface https://review.opendev.org/c/openstack/openstack-ansible/+/955498 | 17:23 |
| jrosser | oh thats cool - we still have the dummy interfaces early on | 17:24 |
| noonedeadpunk | well. that was the thing I was trying to get rid off haha | 17:25 |
| noonedeadpunk | but will leave this speacial proxy case I guess | 17:25 |
| noonedeadpunk | as there's really no way around it | 17:25 |
| noonedeadpunk | if it works ofc | 17:26 |
| noonedeadpunk | and it does not :( | 17:33 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Serve proxy on a standalone interface https://review.opendev.org/c/openstack/openstack-ansible/+/955498 | 17:35 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Serve proxy on a standalone interface https://review.opendev.org/c/openstack/openstack-ansible/+/955498 | 17:48 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Serve proxy on a standalone interface https://review.opendev.org/c/openstack/openstack-ansible/+/955498 | 18:48 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Offload network provisionment for AIO to openstack_hosts https://review.opendev.org/c/openstack/openstack-ansible/+/953570 | 19:00 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Offload kernel module management to openstack_hosts https://review.opendev.org/c/openstack/openstack-ansible/+/953685 | 19:02 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Define losetup devices statically rather then dynamically https://review.opendev.org/c/openstack/openstack-ansible/+/953770 | 19:04 |
| opendevreview | Merged openstack/openstack-ansible stable/2023.2: Bump SHAs for EOL-ing 2023.2 https://review.opendev.org/c/openstack/openstack-ansible/+/950893 | 19:09 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Offload network provisionment for AIO to openstack_hosts https://review.opendev.org/c/openstack/openstack-ansible/+/953570 | 19:27 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Offload kernel module management to openstack_hosts https://review.opendev.org/c/openstack/openstack-ansible/+/953685 | 19:28 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Define losetup devices statically rather then dynamically https://review.opendev.org/c/openstack/openstack-ansible/+/953770 | 19:28 |
Generated by irclog2html.py 4.0.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!