| opendevreview | Ade Lee proposed openstack/openstack-zuul-jobs master: Enable support for fips on the jobs https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/816855 | 00:29 |
|---|---|---|
| mlavalle | hi, I recently joined Red Hat and I am trying to set up my new laptop to upload changes to gerrit. Is this guide still valid: https://docs.openstack.org/contributors/common/setup-gerrit.html? | 00:51 |
| fungi | mlavalle: yes, that's right | 00:55 |
| fungi | screenshots in it may be outdated since the recent gerrit upgrade though | 00:55 |
| mlavalle | I think I've followed all the steps and still getting: minsel@review.opendev.org: Permission denied (publickey). | 00:56 |
| clarkb | mlavalle: are you on fedora? | 00:56 |
| mlavalle | clarkb: yes | 00:56 |
| clarkb | did you use an ssh rsa key? | 00:56 |
| mlavalle | I used ssh-keygen, like the fuide says | 00:57 |
| mlavalle | I did exactly like the guide indicates | 00:58 |
| clarkb | yes that generates an rsa key. Fedora's openssh and gerrit's MINA SSHD don't work together using rsa keys due to a deprecation that hasn't been handled in the java server | 00:58 |
| clarkb | I'ev asked for the guide to be updated to use ed25519 keys but maybe I should just write that change already | 00:58 |
| clarkb | mlavalle: your options are to explicitl reenable the deprecated functionality in fedora's openssh or use an ecdsa or ed25519 key instead | 00:59 |
| clarkb | mlavalle: https://www.openssh.com/txt/release-8.8 under "potentially breaking changes" for the first thing. We recommend against this as it reduces the security stance set by your distro and software | 01:00 |
| mlavalle | clarkb: so to be clear, what I need to use is ed25519 keys, right? | 01:02 |
| clarkb | mlavalle: or ecdsa keys. Yes | 01:03 |
| mlavalle | and the guide should mention that, correct? | 01:03 |
| clarkb | or don't use fedora, or tell fedora/openssh to allow the old less secure rsa implementation. Note rsa itself isn't the problem its the hash used with it. Which is by default sha1 and openssh and fedora didn't update the default to sha2 | 01:03 |
| mlavalle | let's do something, I'll fix my situation and update the guide | 01:04 |
| clarkb | mlavalle: yes, I've asked that the guide be updated to do ed25519 but that hasn't happened yet | 01:04 |
| fungi | though folks on fips-140 compliant systems may be stuck using ecdsa instead as nist has not yet approved ed25519 | 01:04 |
| clarkb | ya but I would err on more secure by default ratehr than telling people to use potentailly compromised ecdsa | 01:05 |
| fungi | agreed | 01:05 |
| clarkb | if you are using fips then you should be prepared to figure this stuff out :) | 01:05 |
| fungi | on those massive government salaries civil servants get paid, right ;) | 01:05 |
| mlavalle | clarkb, fungi: ok, with this guidance I'll figure out what needs to be done in my case, and with that I'll go to the guide and fix it. does that help? | 01:06 |
| clarkb | mlavalle: yes that would be great. | 01:06 |
| fungi | yes, thanks so much! | 01:06 |
| clarkb | mlavalle: I wouldn't worry about trying to explain all this though. Just change the guide to use a key time (ed25519) that works more universally | 01:06 |
| mlavalle | clarkb, fungi: I may ask more questions on the way there | 01:06 |
| clarkb | mlavalle: yup feel free. I'll try to keep on eye on this for the next little bit | 01:06 |
| mlavalle | clarkb: I'll do it tomorrow. I'm going to work out now | 01:07 |
| fungi | i'll certainly be around tomorrow too | 01:07 |
| clarkb | mlavalle: that works too :) | 01:07 |
| mlavalle | and yeah, I am not going to include this conversation in the guide, just that ed25519 is needed | 01:08 |
| fungi | sgtm | 01:09 |
| clarkb | also upsteram gerrit is aware of this problem and there are some fixes in flight. The SSHD updated but we are waiting on a release of that then we need to update the release of MINA in gerrit which may require jgit updates | 01:11 |
| clarkb | the jgit updates are why I stopped looking into pushing this upstream as that library is something I don't understand | 01:11 |
| *** rlandy|ruck|bbl is now known as rlandy|ruck | 02:19 | |
| *** rlandy|ruck is now known as rlandy|out | 02:23 | |
| *** dviroel is now known as dviroel|out | 02:53 | |
| *** bhagyashris_ is now known as bhagyashris | 03:02 | |
| *** akekane_ is now known as abhishekk | 07:32 | |
| *** gibi_ is now known as gibi | 07:52 | |
| *** ysandeep is now known as ysandeep|lunch | 08:08 | |
| *** ysandeep|lunch is now known as ysandeep | 08:38 | |
| opendevreview | Merged openstack/project-config master: Add NVidia vGPU plugin charm to OpenStack charms https://review.opendev.org/c/openstack/project-config/+/819818 | 09:02 |
| *** jpodivin_ is now known as jpodivin | 09:55 | |
| *** ysandeep is now known as ysandeep|afk | 10:21 | |
| *** redrobot6 is now known as redrobot | 10:23 | |
| *** jpena|off is now known as jpena | 10:35 | |
| *** dviroel|out is now known as dviroel | 10:49 | |
| *** ysandeep|afk is now known as ysandeep | 10:56 | |
| *** rlandy|out is now known as rlandy|ruck | 11:10 | |
| *** jcapitao is now known as jcapitao_lunch | 12:39 | |
| *** ykarel is now known as ykarel|away | 13:21 | |
| *** jcapitao_lunch is now known as jcapitao | 14:08 | |
| opendevreview | daniel.pawlik proposed openstack/ci-log-processing master: Add required fields for pypi upload https://review.opendev.org/c/openstack/ci-log-processing/+/821229 | 14:41 |
| fungi | ricolin: those devstack-platform-arm64 builds which aren't starting seem to use ubuntu-focal-arm64-xxxlarge nodes, so it's possible we're having trouble allocating them. i'm tracking down one of the node requests now | 15:25 |
| fungi | looks like we can only boot ubuntu-focal-arm64-xxxlarge in linaro-us, we don't have it in osuosl (our only other arm64/aarch64 provider currently) | 15:38 |
| *** ysandeep is now known as ysandeep|out | 15:45 | |
| ricolin | fungi, who I can contact to to added that flavor in? | 15:56 |
| fungi | ricolin: okay, so the situation is that most of the quota in linaro-us is taken up by stuck "deleting" server instances, we don't seem to be booting any new nodes there | 15:57 |
| ricolin | fungi, thanks, may I ask where I can see the deleting server list? | 16:00 |
| fungi | unfortunately they don't appear in https://zuul.opendev.org/t/openstack/nodes (i think because zk has been wiped more recently than those nodes went into deleting state) | 16:03 |
| fungi | if i `openstack server show` one of the stuck deleting instances, i see it's got a vm_state of "building" with a task_state of "deleting" | 16:06 |
| fungi | so possibly it was stuck building, we gave up waiting and issued a server delete for it | 16:07 |
| opendevreview | Merged openstack/project-config master: Allow Zuul API access from keycloak server https://review.opendev.org/c/openstack/project-config/+/820956 | 16:08 |
| ricolin | thanks fungi for the detail | 16:23 |
| fungi | ricolin: we'll need to engage the assistance of one of the linaro cloud operators (probably kevinz) to clear out those stuck instances as they're undeletable for us, but once that's done we should hopefully be able to boot new nodes there. as for adding a similar flavor to support ubuntu-focal-arm64-xxxlarge in osuosl, we'd probably need to bring it up with lance | 16:43 |
| ricolin | fungi, feel free to lave message to kevinz, I will double check with him tomorrow morning(8 hours later). | 16:51 |
| *** jpena is now known as jpena|off | 16:57 | |
| *** weechat1 is now known as amorin | 17:54 | |
| *** weechat1 is now known as amorin | 18:00 | |
| *** sshnaidm is now known as sshnaidm|afk | 19:05 | |
| *** dviroel is now known as dviroel|out | 21:13 | |
| opendevreview | Scott Little proposed openstack/project-config master: give starlingx-release branch and tag powers in metrics-server-armada-app https://review.opendev.org/c/openstack/project-config/+/821321 | 21:25 |
| opendevreview | Scott Little proposed openstack/project-config master: give starlingx-release branch and tag powers in metrics-server-armada-app https://review.opendev.org/c/openstack/project-config/+/821321 | 21:29 |
| *** rlandy|ruck is now known as rlandy|out | 23:30 | |
| opendevreview | Clark Boylan proposed openstack/ptgbot master: Update ptgbot's docker image to bullseye https://review.opendev.org/c/openstack/ptgbot/+/821338 | 23:36 |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!