| *** jpena|off is now known as jpena | 08:35 | |
| *** cloudnull2 is now known as cloudnull | 09:09 | |
| *** rlandy|out is now known as rlandy | 11:09 | |
| opendevreview | Elod Illes proposed openstack/openstack-zuul-jobs master: Remove queens branch from periodic-stable templates https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/871594 | 11:18 |
|---|---|---|
| *** dviroel|out is now known as dviroel | 11:18 | |
| opendevreview | Elod Illes proposed openstack/openstack-zuul-jobs master: Clean up queens branch filters https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/871596 | 11:30 |
| opendevreview | Elod Illes proposed openstack/openstack-zuul-jobs master: Clean up queens branch filters https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/871596 | 11:45 |
| opendevreview | Merged openstack/openstack-zuul-jobs master: Remove queens branch from periodic-stable templates https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/871594 | 12:44 |
| opendevreview | Elod Illes proposed openstack/openstack-zuul-jobs master: Clean up queens branch filters https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/871596 | 12:45 |
| ade_lee | fungi, hey - what am I doing wrong here ? https://review.opendev.org/c/openstack/devstack/+/871606 | 13:53 |
| fungi | ade_lee: i've got a tight deadline for something at the moment and can't look deeper until later today, but something there seems to be resulting in tempest-full-py3 getting marked as only usable in post-review pipelines (presumably because of the use of a secret). i'm pretty sure with the job that's directly using that secret defined in a trusted config project it shouldn't raise that | 13:58 |
| fungi | error, so there's probably still some detail we're missing | 13:58 |
| *** dasm|off is now known as dasm | 13:58 | |
| ade_lee | fungi, no worries - whenever you get a chance- thanks | 14:02 |
| *** dviroel is now known as dviroel|lunch | 15:19 | |
| clarkb | ade_lee: the job it complains about is the first devstack job defined in the check queue. THe first overall is a grenade job. But that implies that all devstack jobs that go through that inheritance tree would be affected and it isn't specific to a single job somehow | 16:20 |
| clarkb | which means time to work backward on the inheritance tree | 16:20 |
| clarkb | if I had to guess it is because you pass the secret to the parent here: https://opendev.org/openstack/project-config/src/commit/e3fe2736e6859481a3b8faea18a4c86257266798/zuul.d/jobs.yaml#L1276 and the parent is in an untrusted repo here: https://opendev.org/zuul/zuul-jobs/src/commit/096e8bd9c1eaed78619c1f8aaba9f0643b1a01a0/zuul.d/general-jobs.yaml#L42 | 16:22 |
| fungi | oh, does pass-to-parent need the parent to also be in a trusted config repo? | 16:25 |
| clarkb | I think so because the parent could be depends-on'd and pulled in speculatively? | 16:27 |
| *** dviroel|lunch is now known as dviroel | 16:30 | |
| ade_lee | fungi, clarkb so how can we make it work? | 16:39 |
| clarkb | you could stop doing pass to parent and process the secret in that job (not sure if this works for order of operations though). You can define the parent job in a trusted repo like opentack/project-config. | 16:40 |
| clarkb | if you put the logic in a role in zuul-jobs then have a job in openstack/project-config run the role that should work. | 16:41 |
| *** dviroel is now known as dviroel|doc_appt | 16:43 | |
| ade_lee | clarkb, so the thing that we are trying to do is create a job where the multinode playbook executes after the fips playbook | 16:56 |
| ade_lee | clarkb, if I understand what you're saying then we need a job in project-config that basically copies over the fips and multinode playbooks | 16:57 |
| ade_lee | (both those playbooks call roles in zuul-jobs | 16:57 |
| ade_lee | clarkb, or I guess I need a multinode-fips role in zuul-jobs that basically copies over all the logic from multinode playbook and fips playbook | 16:59 |
| ade_lee | (which is called from project-config | 16:59 |
| fungi | probably the ua registration role can be called from a playbook in project-config as a solution? | 17:00 |
| fungi | that's the only task which needs to access the token | 17:01 |
| ade_lee | yeah I was just coming back to the registration role idea .. | 17:01 |
| fungi | though we might need to do that in the base job itself since we don't control the parentage of the multinode-fips job in zuul/zuul-jobs | 17:02 |
| clarkb | ya the way to think about it is jobs are a zuul level construct that inform zuul on what to do. Part of that is handling of secrets safely. Zuul is saying you a violating the rules of that at a job level due to your inheritance. But within a job you can reuse roles and zuul will apply the correct safe version of that role based on what job information it has | 17:02 |
| fungi | basically we need to register with ua in some job's pre-run phase before the pre-run playbook for multinode-fips installs the packages and reboots the nodes | 17:04 |
| fungi | and i think the only way we'll be able to do that is through implicit parentage of multinode-fips, which means the "base" job is the only place we can do that, right? | 17:05 |
| clarkb | fungi: you can just add a new parent | 17:06 |
| clarkb | I wouldn't add that to the base job | 17:06 |
| fungi | how? make a job in the zuul-jobs standard library parent to a job in opendev's deployment? | 17:06 |
| clarkb | the base job should be as small as possible due to its broad impact | 17:06 |
| fungi | otherwise i think we're left with forking multinode-fips and using a copy in a different repo we control, so that we can insert another parent | 17:06 |
| clarkb | fungi: make a new job in openstack/project-config called fips or whatever that does base <- fips <- multinode-fips <- devstack | 17:07 |
| clarkb | yes you have to fork the job | 17:07 |
| fungi | i need to go run an errand real quick, but can continue brainstorming in a few minutes | 17:07 |
| clarkb | reuse at the level of roles not jobs here due to the secrets | 17:07 |
| clarkb | One thing to cross check against is how the docker image jobs work | 17:09 |
| ade_lee | I suppose we could do something like fips <- openstack-multinode-fips <- devstack - given that the job multinode-fips will really be openstack specific | 17:09 |
| ade_lee | (even though its in zuul-jobs) | 17:09 |
| clarkb | looking at the docker image jobs (they also use pass to parent) we seem to define the job in base-jobs and not zuul-jobs. I believe for this very reason | 17:10 |
| clarkb | but we reuse the roles in zuul-jobs | 17:10 |
| ade_lee | huh , I'm learning more and more - I didn't even know there was a base-jobs till now .. | 17:11 |
| ade_lee | clarkb, I'm not I follow which job you;re looking at -- which docker job in base-jobs uses pass-to-parent? Is base-jobs lower than zuul-jobs in the inheritance hierarchy? | 17:20 |
| *** jpena is now known as jpena|off | 17:21 | |
| clarkb | ade_lee: in opendev/system-config our docker image builds pass to parent our dockerhub secret and the parent is in opendev/base-jobs. There is no zuul-jobs jobs in the hierarchy we reuse roles defined in zuul-jobs though | 17:23 |
| *** dviroel|doc_appt is now known as dviroel | 19:13 | |
| opendevreview | Merged openstack/project-config master: nodepool: empty linaro-us cloud https://review.opendev.org/c/openstack/project-config/+/871220 | 19:44 |
| opendevreview | Merged openstack/project-config master: nodepool: drop linaro-us https://review.opendev.org/c/openstack/project-config/+/871196 | 22:06 |
| opendevreview | Ian Wienand proposed openstack/project-config master: nodepool: fix new linaro provider name in nb04 https://review.opendev.org/c/openstack/project-config/+/871666 | 22:07 |
| clarkb | https://groups.google.com/g/repo-discuss/c/056Q3NEF5Jc/m/1ys5dgGsAQAJ and https://groups.google.com/g/repo-discuss/c/tZwIp3Hx-wA/m/rJgmT_OsAQAJ sent to clarify those two different Gerrit items | 22:10 |
| *** dviroel is now known as dviroel|out | 22:44 | |
| *** rlandy is now known as rlandy|out | 23:01 | |
| *** dasm is now known as dasm|off | 23:09 | |
| opendevreview | Merged openstack/project-config master: nodepool: fix new linaro provider name in nb04 https://review.opendev.org/c/openstack/project-config/+/871666 | 23:38 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!