*** hoonetorg has quit IRC | 00:14 | |
*** k_mouza has joined #openstack-ironic | 00:14 | |
*** tosky has quit IRC | 00:17 | |
*** k_mouza has quit IRC | 00:19 | |
*** hoonetorg has joined #openstack-ironic | 00:28 | |
*** Goneri has quit IRC | 00:37 | |
*** outbrito has joined #openstack-ironic | 00:53 | |
*** thiagop has quit IRC | 00:53 | |
*** hoonetorg has quit IRC | 01:26 | |
*** zzzeek has quit IRC | 01:26 | |
*** zzzeek has joined #openstack-ironic | 01:26 | |
*** Qianbiao has joined #openstack-ironic | 01:29 | |
*** zzzeek has quit IRC | 01:31 | |
*** zzzeek has joined #openstack-ironic | 01:32 | |
*** ociuhandu has joined #openstack-ironic | 01:37 | |
*** hoonetorg has joined #openstack-ironic | 01:39 | |
dking | Do Ironic-Inspector collectors have access to the node and port classes? | 01:40 |
---|---|---|
*** ociuhandu has quit IRC | 01:41 | |
*** outbrito has quit IRC | 01:41 | |
dking | Those are passed as parameters to clean steps, but I have some code that I would like to run during inspection, and I would like to share a function between inspection and cleaning using dispatch_to_managers, and I'm trying to figure out the best way to do that. | 01:43 |
*** rloo has quit IRC | 01:47 | |
dking | I'm wanting to set .driver_info.ipmi_password during inspection. So far, I'm only seeing that it would have to be set that in data, and then pass it into ipmi_password during introspection rules. However, that doesn't seem to be secure. | 01:49 |
Qianbiao | hi dking, there has a rule can archive your goal. | 01:50 |
Qianbiao | but i did not use it in fact, i can share you a doc. | 01:50 |
*** zzzeek has quit IRC | 01:50 | |
dking | Qianbiao: I would appreciate that. | 01:51 |
*** zzzeek has joined #openstack-ironic | 01:51 | |
Qianbiao | wait a minute, need to find it | 01:51 |
Qianbiao | that is it: https://docs.openstack.org/ironic-inspector/latest/user/usage.html | 01:53 |
Qianbiao | dking ^^ | 01:54 |
dking | Qianbiao: Thank you very much. However, I was looking for something different. I know that I can use introspection rules to set that value. However, I was hoping to create the password (and set it) during the inspection step inside of the Ironic Python Agent. I'm going to be using ipmitool to set the BMC credentials to use a random password, and I would like to save that password, preferably directly into the database, at that | 01:56 |
dking | time. | 01:56 |
Qianbiao | then you may want to add a customer processor i think | 01:57 |
Qianbiao | check inspect processing config segment, there has : processing_hooks = $default_processing_hooks,extra_hardware,lldp_basic,local_link_connection | 01:58 |
dking | ...and I was hoping to share the same function between introspection (called from a custom collector) and by node cleaning (called from a custom hardware manager). | 01:58 |
Qianbiao | you may add a customer hook to do that | 01:58 |
Qianbiao | yes, i think you can share the code. | 01:59 |
Qianbiao | they are run in IPA i think. | 01:59 |
Qianbiao | not sure. | 01:59 |
Qianbiao | TheJulia may have a better idea. | 01:59 |
TheJulia | o/ | 02:00 |
TheJulia | I've been summoned! | 02:00 |
TheJulia | what is up? | 02:00 |
dking | The problem for me at the moment is that hardware manager clean steps receive the node and port objects, but collectors only receive the data and failures objects. | 02:00 |
*** tzumainn has quit IRC | 02:00 | |
Qianbiao | Good night, TheJulia o/. I guess you may still around. :) | 02:01 |
dking | I suppose that I could just have a wrapper for each that calls the one routine to create and set the password, and then have the wrappers update in the db, with the one setting it in data for intrpsection rules to pick up, and the other setting in the node object directly. | 02:01 |
dking | TheJulia: Oh, wow. You're up late. | 02:02 |
TheJulia | not that late... | 02:02 |
TheJulia | only 6pm here | 02:02 |
TheJulia | dking: the anticipated path to use introspection rules, and yeah, that is not great but it is only really viable for those with static BMC passwords. Dynamic is... more difficult. | 02:02 |
dking | Oh. It's 9pm here, and definitely not work hours (officially). | 02:02 |
TheJulia | and really, inspector has no access to that data by default really. often when the collectors are executing, they may have zero context of the ironic node, just that they have data before them | 02:03 |
dking | Yeah, that's what we're going for, dynamic. We would prefer not having the same password for every machine, and we want it to be set by introspection since we won't know the actual password. We boot right into PXE for our first exposure to a new node, and they all have random pws set by the manufacturer. | 02:04 |
TheJulia | hmm | 02:05 |
TheJulia | This is a wonderful conundrum | 02:05 |
dking | I suppose that makes sense. It seems that the original intent, or common usage, is to have nodes already entered manually. So, we do things a bit differently. | 02:05 |
TheJulia | or to reconcile it in the end | 02:05 |
TheJulia | but yeah, that is still not fun | 02:05 |
*** openstackgerrit has joined #openstack-ironic | 02:06 | |
openstackgerrit | Steve Baker proposed openstack/ironic master: JSON conversion followup change https://review.opendev.org/c/openstack/ironic/+/763279 | 02:06 |
openstackgerrit | Steve Baker proposed openstack/ironic master: Improve object_to_dict arguments https://review.opendev.org/c/openstack/ironic/+/763501 | 02:06 |
openstackgerrit | Steve Baker proposed openstack/ironic master: Test patching booleans with string values https://review.opendev.org/c/openstack/ironic/+/763713 | 02:06 |
TheJulia | dking: out of curiosity, are you getting an inventory of the random passwords? | 02:06 |
TheJulia | from the vendor that is? | 02:06 |
*** zzzeek has quit IRC | 02:07 | |
dking | Technically, yes. They come to us on tags physically on the servers, which is a huge hassle, and for our first batch, 2 out of 20 didn't seem to respond to the passwords on the stickers. | 02:07 |
dking | We're going to send a request for them to send us that data in a spreadsheet, but even if we know them, we'd have to create a secure system to maintain those creds and serve them, which would be an even bigger hassle. | 02:08 |
dking | I suppose that if it comes down to it, perhaps I could see what part of the process finally gets a UUID, from node_not_found_hook, and make some code somewhere to call the API directly, but I was really hoping to use existing tools. | 02:11 |
*** zzzeek has joined #openstack-ironic | 02:11 | |
TheJulia | if you get a spreadsheet, you could just map them up really easily | 02:11 |
dking | Yjru | 02:12 |
dking | sorry | 02:12 |
TheJulia | That is exactly what some folks have done | 02:12 |
TheJulia | or create and have a cron job add the password in after matching the host in the state | 02:12 |
*** k_mouza has joined #openstack-ironic | 02:14 | |
TheJulia | if you do that, you could have it just be kicked to the next step by the same script or job | 02:14 |
dking | I suppose that we could have the process which updates the node state from enroll to manageable add the IPs. The frustration here is that the process would have to be able to collect that information securely. So, we'd have to create some method for it to be accessed and updated and then secured. | 02:14 |
dking | Rather than just having the password in the only place where we really want it, the Ironic db. | 02:15 |
*** k_mouza has quit IRC | 02:15 | |
TheJulia | I feel like maybe we do need a "go check $thing" somehow | 02:16 |
*** zzzeek has quit IRC | 02:16 | |
TheJulia | but with the rules that might not be viable | 02:16 |
*** zzzeek has joined #openstack-ironic | 02:18 | |
TheJulia | dking: maybe a better question, so once you get the spreadsheet, would that be before or after you have the rack? | 02:20 |
TheJulia | or racks | 02:20 |
TheJulia | and then, would that be a human and could it be local to them submitting it in whatever process | 02:21 |
dking | TheJulia: Ideally, if we can get something worked out, we could get them as they are shipped, before being racked. But we want to save the DC from having to do more work than necessary, and we're planning on doing things on a large scale (we hope). | 02:22 |
Qianbiao | I am courious if there has a method can update node's management password without getting it first? | 02:23 |
*** uzumaki has joined #openstack-ironic | 02:23 | |
Qianbiao | From inband? | 02:23 |
dking | In our use case, we're trying to have the process super automated. So, eventually, that's going to mean that we'd probably be having servers shipped to datacenters to which we have very little direct access ourselves, outside of perhaps having them setup. From there, we'd like to just be able to slot machines and power them on. | 02:23 |
*** iurygregory has quit IRC | 02:25 | |
dking | Qianbiao: Yes, we won't have the password. But when we power on the servers, they PXE boot, kicking off the inspect process. While all of that is running, we can use command line tools, like ipmitool (or also the vendor specific command line tools), which can set a password without needing one first. So, we can set a secondary user with a random password. I just need to get that random password into Ironic securely. | 02:25 |
TheJulia | I think nobodycam had worked out a process where they had the inventory data in advance, dc ops would hookup cables/power, inspection would get the data, $thing would do reconcile set passwords and move them into use | 02:27 |
Qianbiao | yeah, that is what i mean, from inband, we can set password directly. IBMC seems has same technical. | 02:28 |
TheJulia | Qianbiao: we tried that, and ripped the feature out a long long time ago due to bmc issues/inconsistencies with resetting the bmc password from the OS. Also some operators didn't want that as a thing at all | 02:28 |
Qianbiao | TheJulia IIRC, ibmc can visit a special IPV6 address from inband os, and update password directly. | 02:29 |
Qianbiao | forget the details. | 02:29 |
TheJulia | yeah, there is a standard for that :) | 02:29 |
Qianbiao | ok :) | 02:30 |
TheJulia | that is awesome ibmc supports that, btw | 02:30 |
*** zzzeek has quit IRC | 02:30 | |
*** zzzeek has joined #openstack-ironic | 02:31 | |
Qianbiao | dking, from your requirement, I think you should make a modify to IPA, you may did it there i think. and add a hook/rule in inspector to update password | 02:31 |
dking | Hmm... I'm trying to think. I really don't like the idea of having to maintain a service to serve the creds, which is why we were hoping to just set a new user. | 02:31 |
TheJulia | to do it via ipmi, I'm fairly sure you have to define a user number | 02:32 |
TheJulia | if you collide with the admin, you replace it | 02:32 |
TheJulia | that can be good, or bad depending on use case | 02:32 |
dking | Qianbiao: Yes, I am looking at something in IPA. I'm trying to find a good type of hook to do that. | 02:32 |
*** rcernin has quit IRC | 02:33 | |
dking | TheJulia: yes, you give it user numbers, but admin should always be the same number, and I can do checks for that. | 02:33 |
dking | You give it a number and a username. | 02:34 |
TheJulia | I don't think we could just revert the patch that removed password setting, for that and we would likely extend it a little, but maybe it is viable if we can navigate the cases around the account number | 02:34 |
dking | TheJulia: I'm not sure I follow entirely. Are you referring to a previous version that set the password? I did see some very old documentation for an Ironic discover process that looked like it did that. | 02:37 |
TheJulia | yeah | 02:37 |
dking | And I can understand not wanting to make Ironic maintain the process, as BMCs can be funny. But I do think having some kind of option to allow some kind of custom code to set the password during inspection would be hlepful. | 02:38 |
TheJulia | so the conundrum _during_ inspection is there is no way to send commands back to IPA | 02:39 |
TheJulia | It is a one way "Hey, here is that data you may or may not have wanted" action | 02:39 |
dking | Is there anything that would allow hardware managers add in steps that could be run during inspection? I assume that one blocker for that has been the fact that most of them don't have any node object set yet? | 02:39 |
TheJulia | allow, not at the moment, but nothing preventing an invocation | 02:40 |
dking | Oh, so IPA during inspection doesn't listen on a socket? | 02:40 |
TheJulia | dispatch_to_managers could be invoked | 02:40 |
TheJulia | dking: it doesn't even start the webserver until inspection is done | 02:40 |
TheJulia | if your in discovery only mode, you can't send commands at all | 02:40 |
TheJulia | because the agent doesn't know anything and to allow commands in without any sort of authentication is not great | 02:41 |
TheJulia | but yeah, there is absolutely nothing preventing a hardware manager from doing $thing really | 02:41 |
TheJulia | in fact, it could do it on start-up of the hardware manager | 02:41 |
TheJulia | "If it looks like were in inspection, and we don't have a user in the bmc, let me set a password and save it in the data posted to inspector ?!? | 02:42 |
TheJulia | " | 02:42 |
dking | One obstacle for me at the moment is that I don't have the node object. Does the data object (sent to the collectors) contain the UUID? | 02:43 |
dking | You mention saving it data posted to the inspector. Does that in some way get back into the db without having to be sent back in the inspector data that gets logged? | 02:45 |
dking | I don't really care where it's set, or even if it's set first in the db and then sent in, as long as it gets to some function during inspection. I just need the same thing in the db that's on the server, and that can go either way. | 02:48 |
Qianbiao | dking inspection has two mode, one trigger by admin, one auto enroll. | 02:55 |
Qianbiao | first one you need to set a password manually, second one, there are no node in ironic util inspection finished. | 02:56 |
Qianbiao | basicly, if you know it's auto enroll, you can set a random password, and then send the password back in inspect data. | 02:57 |
Qianbiao | and then you can did anything you want like set it to node's driver info. | 02:57 |
dking | Qianbiao: That is true. The concern I have is that if the data is passed back in the inspection data, it will be logged on the conductor, exposing that password, which is not ideal. | 03:00 |
Qianbiao | yes, need to remove the log. | 03:02 |
*** rcernin has joined #openstack-ironic | 03:03 | |
dking | I suppose that I might need to look into node_not_found_hook = enroll to see how that works. | 03:04 |
Qianbiao | yes | 03:05 |
*** rcernin has quit IRC | 03:11 | |
*** rcernin has joined #openstack-ironic | 03:11 | |
*** uzumaki has quit IRC | 03:15 | |
*** uzumaki has joined #openstack-ironic | 03:15 | |
TheJulia | dking: the uuid that is stamped in the system, but that can be wrong and it can also be all 0's depending on the make or vendor | 03:22 |
TheJulia | or like... if you get a replacement motherboard that was never flashed with the OEM details | 03:22 |
TheJulia | the uuid assigned in ironic, is assigned on create unless it is posted, and I *don't* think the embedded uuid is used | 03:23 |
TheJulia | that is of course it is flashed in | 03:23 |
*** ociuhandu has joined #openstack-ironic | 03:25 | |
dking | TheJulia: I was talking about the UUID for Ironic. I was hoping that at some point, the node would have to know or set that if it's enrolling itself. And if it did, I was thinking I could just do an API call. | 03:27 |
TheJulia | you'd have to embed creds into the agent which is downloaded for inspector | 03:28 |
dking | ...but if that's only set on the API's side after the inspection and introspection data is sent, then I suppose that wouldn't work. | 03:28 |
TheJulia | an administrative credential | 03:28 |
TheJulia | yeah | 03:28 |
dking | Oh, yeah. I suppose there's that, too. I'm not currently using any authentication for Ironic, but I don't plan for it to stay like that. | 03:29 |
*** ociuhandu has quit IRC | 03:29 | |
dking | I really hate it, but I'm starting to re-consider just setting it in the introspection data and just hoping that nobody malicious gets access to that server. | 03:30 |
dking | If they can access the controller, they have access to the nodes, anyway. It just feels very dirty and dangerous. | 03:31 |
dking | And the conductor logs will likely be exported. I suppose that we could see about filtering those lines out. I just don't see a good solution. | 03:33 |
*** uzumaki has quit IRC | 04:04 | |
TheJulia | dking: do you actually need inspetor to save that information? are you using inspectin data post inspection? | 04:10 |
*** paras333 has quit IRC | 04:14 | |
*** k_mouza has joined #openstack-ironic | 04:15 | |
*** k_mouza has quit IRC | 04:16 | |
*** k_mouza_ has joined #openstack-ironic | 04:16 | |
*** zzzeek has quit IRC | 04:18 | |
*** zzzeek has joined #openstack-ironic | 04:19 | |
*** k_mouza_ has quit IRC | 04:21 | |
*** k_mouza has joined #openstack-ironic | 04:34 | |
*** zzzeek has quit IRC | 04:34 | |
*** zzzeek has joined #openstack-ironic | 04:35 | |
*** k_mouza has quit IRC | 04:38 | |
*** zzzeek has quit IRC | 04:59 | |
*** zzzeek has joined #openstack-ironic | 05:00 | |
*** zzzeek has quit IRC | 05:10 | |
*** zzzeek has joined #openstack-ironic | 05:11 | |
*** ociuhandu has joined #openstack-ironic | 05:13 | |
openstackgerrit | ankit proposed openstack/ironic master: Adds config params to support firmware update gate https://review.opendev.org/c/openstack/ironic/+/763341 | 05:14 |
*** ociuhandu has quit IRC | 05:21 | |
openstackgerrit | Jacob Anders proposed openstack/ironic master: Use OOB inspection to fetch MACs for IB inspection https://review.opendev.org/c/openstack/ironic/+/750943 | 05:47 |
openstackgerrit | Jacob Anders proposed openstack/ironic-inspector master: Use OOB inspection to fetch MACs for IB inspection https://review.opendev.org/c/openstack/ironic-inspector/+/758994 | 05:48 |
*** k_mouza has joined #openstack-ironic | 06:35 | |
*** Qianbiao has quit IRC | 06:36 | |
*** k_mouza has quit IRC | 06:39 | |
*** Qianbiao has joined #openstack-ironic | 06:48 | |
*** zzzeek has quit IRC | 06:49 | |
*** zzzeek has joined #openstack-ironic | 06:49 | |
*** iurygregory has joined #openstack-ironic | 07:02 | |
iurygregory | Good morning | 07:03 |
iurygregory | o/ | 07:03 |
*** ociuhandu has joined #openstack-ironic | 07:15 | |
*** ociuhandu has quit IRC | 07:19 | |
*** ociuhandu has joined #openstack-ironic | 07:24 | |
*** ociuhandu has quit IRC | 07:29 | |
arne_wiebalck | Good morning iurygregory and ironic! | 07:37 |
*** rpittau|afk is now known as rpittau | 07:39 | |
rpittau | good morning ironic! o/ | 07:39 |
iurygregory | hey arne_wiebalck and rpittau o/ | 07:40 |
*** ociuhandu has joined #openstack-ironic | 07:41 | |
rpittau | hey iurygregory :) | 07:46 |
*** rcernin has quit IRC | 07:49 | |
*** ociuhandu has quit IRC | 07:52 | |
*** rcernin has joined #openstack-ironic | 07:57 | |
openstackgerrit | Dmitry Tantsur proposed openstack/ironic-python-agent stable/victoria: Make mdadm a soft requirement https://review.opendev.org/c/openstack/ironic-python-agent/+/763902 | 07:58 |
*** mkrai has joined #openstack-ironic | 08:02 | |
*** ociuhandu has joined #openstack-ironic | 08:06 | |
*** ociuhandu has quit IRC | 08:13 | |
*** rcernin has quit IRC | 08:15 | |
*** ociuhandu has joined #openstack-ironic | 08:22 | |
*** ociuhandu has quit IRC | 08:22 | |
*** Qianbiao has quit IRC | 08:30 | |
*** k_mouza has joined #openstack-ironic | 08:36 | |
*** Qianbiao has joined #openstack-ironic | 08:36 | |
*** k_mouza has quit IRC | 08:40 | |
*** ociuhandu has joined #openstack-ironic | 08:43 | |
*** mgoddard has joined #openstack-ironic | 08:44 | |
*** tosky has joined #openstack-ironic | 08:48 | |
*** zzzeek has quit IRC | 08:50 | |
*** zzzeek has joined #openstack-ironic | 08:54 | |
*** dougsz has joined #openstack-ironic | 08:55 | |
*** dtantsur|afk is now known as dtantsur | 09:01 | |
dtantsur | morning ironic | 09:02 |
*** lucasagomes has joined #openstack-ironic | 09:03 | |
rpittau | good morning dtantsur :) | 09:04 |
iurygregory | good morning dtantsur | 09:08 |
*** zzzeek has quit IRC | 09:09 | |
*** zzzeek has joined #openstack-ironic | 09:09 | |
rpittau | btw there should be a new release soon, I think, but that one should work | 09:11 |
*** derekh has joined #openstack-ironic | 09:12 | |
rpittau | ^ iurygregory this was for you :D | 09:16 |
*** mkrai has quit IRC | 09:16 | |
*** mkrai has joined #openstack-ironic | 09:16 | |
iurygregory | rpittau, hehehe good to know | 09:17 |
*** zzzeek has quit IRC | 09:18 | |
*** ricolin has joined #openstack-ironic | 09:19 | |
*** zzzeek has joined #openstack-ironic | 09:19 | |
iurygregory | dtantsur, since in stable/victoria we did change the default value for api_workers and the latest we have is 16.0.1 we need a minor bump? | 09:20 |
dtantsur | mmm, no, why? | 09:20 |
iurygregory | was wondering because you listed as upgrade | 09:20 |
iurygregory | =) | 09:20 |
dtantsur | we have a track of changing options values in patch release | 09:21 |
dtantsur | I'd not bother | 09:21 |
iurygregory | ack | 09:21 |
*** fmuyassarov has joined #openstack-ironic | 09:24 | |
*** dougsz has quit IRC | 09:25 | |
*** zzzeek has quit IRC | 09:26 | |
fmuyassarov | Hello all. Would you mind please to review https://review.opendev.org/c/openstack/ironic/+/762343 ? Thanks in advance. | 09:26 |
* dtantsur looks | 09:27 | |
fmuyassarov | dtantsur, thanks | 09:27 |
*** zzzeek has joined #openstack-ironic | 09:28 | |
*** ociuhandu has quit IRC | 09:32 | |
*** mkrai has quit IRC | 09:35 | |
dtantsur | fmuyassarov: reviewed. this is really close, left a couple more comments. feel free to ping me again after you update it. | 09:35 |
fmuyassarov | Sure, thank you dtantsur | 09:36 |
iurygregory | brb need to reboot the pc | 09:36 |
*** iurygregory has quit IRC | 09:37 | |
openstackgerrit | Riccardo Pittau proposed x/sushy-oem-idrac master: Use safe version of hacking https://review.opendev.org/c/x/sushy-oem-idrac/+/727260 | 09:38 |
*** dougsz has joined #openstack-ironic | 09:40 | |
*** iurygregory has joined #openstack-ironic | 09:43 | |
*** ricolin has quit IRC | 09:44 | |
iurygregory | dtantsur, newbie question the repo to extend ironic ansible modules is https://opendev.org/openstack/ansible-collections-openstack/ right? | 09:47 |
dtantsur | iurygregory: correct | 09:47 |
iurygregory | oh they don't have any doc page with contributor guide right? only the https://opendev.org/openstack/ansible-collections-openstack/src/branch/master/CONTRIBUTING.rst | 09:49 |
janders | good morning iurygregory arne_wiebalck rpittau dtantsur fmuyassarov and Ironic o/ | 09:49 |
janders | how's everyone? | 09:50 |
iurygregory | hey janders o/ | 09:50 |
arne_wiebalck | hey janders o/ | 09:50 |
rpittau | hey janders :) | 09:50 |
iurygregory | almost ready to travel \o/ | 09:50 |
*** k_mouza has joined #openstack-ironic | 09:50 | |
iurygregory | (just need to do the covid test tomorrow) | 09:50 |
fmuyassarov | good morning janders | 09:50 |
janders | iurygregory way to go! | 09:50 |
janders | (not so enthusiastic about the covid test, but the travel part for sure! :) | 09:50 |
iurygregory | is not that bad tbh | 09:51 |
*** ociuhandu has joined #openstack-ironic | 09:51 | |
iurygregory | I did once already hehe, this will be my second time | 09:51 |
*** k_mouza has quit IRC | 09:55 | |
*** derekh has quit IRC | 10:01 | |
*** derekh has joined #openstack-ironic | 10:01 | |
*** ociuhandu has quit IRC | 10:02 | |
*** zzzeek has quit IRC | 10:04 | |
*** mkrai has joined #openstack-ironic | 10:05 | |
*** zzzeek has joined #openstack-ironic | 10:06 | |
*** mgoddard has quit IRC | 10:11 | |
*** zzzeek has quit IRC | 10:21 | |
*** zzzeek has joined #openstack-ironic | 10:22 | |
*** mgoddard has joined #openstack-ironic | 10:24 | |
*** zzzeek has quit IRC | 10:26 | |
*** mkrai has quit IRC | 10:27 | |
*** zzzeek has joined #openstack-ironic | 10:28 | |
*** mkrai has joined #openstack-ironic | 10:28 | |
*** ociuhandu has joined #openstack-ironic | 10:32 | |
*** mgoddard has quit IRC | 10:35 | |
*** k_mouza has joined #openstack-ironic | 10:37 | |
*** ociuhandu has quit IRC | 10:37 | |
*** ociuhandu has joined #openstack-ironic | 10:38 | |
openstackgerrit | Jacob Anders proposed openstack/ironic-inspector master: Use OOB inspection to fetch MACs for IB inspection https://review.opendev.org/c/openstack/ironic-inspector/+/758994 | 10:43 |
*** zzzeek has quit IRC | 10:47 | |
*** ociuhandu has quit IRC | 10:47 | |
*** zzzeek has joined #openstack-ironic | 10:47 | |
*** mgoddard has joined #openstack-ironic | 10:49 | |
*** ociuhandu has joined #openstack-ironic | 10:53 | |
*** ociuhandu has quit IRC | 10:53 | |
*** mkrai has quit IRC | 10:56 | |
dtantsur | ianw: I've sent you an email to avoid chatting at weird hours | 10:56 |
openstackgerrit | Verification of a change to openstack/ironic failed: Sync boot mode when changing the boot device via Redfish https://review.opendev.org/c/openstack/ironic/+/762439 | 11:05 |
*** ociuhandu has joined #openstack-ironic | 11:10 | |
*** ociuhandu has quit IRC | 11:10 | |
*** ociuhandu has joined #openstack-ironic | 11:10 | |
openstackgerrit | Kaifeng Wang proposed openstack/ironic-specs master: Support node history https://review.opendev.org/c/openstack/ironic-specs/+/652811 | 11:16 |
*** mkrai has joined #openstack-ironic | 11:16 | |
ajya | Hi dtantsur, saw you talking about DHCP-less. Are you testing some specific configuration or could it be that the feature currently is not working? | 11:20 |
ajya | dtantsur: oh, saw the post in the mailing list, it looks like it's not specific to setup | 11:30 |
*** zzzeek has quit IRC | 11:31 | |
*** zzzeek has joined #openstack-ironic | 11:32 | |
*** ociuhandu has quit IRC | 11:34 | |
*** ociuhandu has joined #openstack-ironic | 11:35 | |
*** mkrai has quit IRC | 11:35 | |
*** ociuhandu has quit IRC | 11:41 | |
*** ociuhandu has joined #openstack-ironic | 11:41 | |
*** ociuhandu has quit IRC | 11:44 | |
*** ociuhandu has joined #openstack-ironic | 11:45 | |
dtantsur | I suspect the latter, but I'd be happy to be proved wrong | 11:49 |
openstackgerrit | Merged openstack/ironic-python-agent stable/victoria: Make mdadm a soft requirement https://review.opendev.org/c/openstack/ironic-python-agent/+/763902 | 11:53 |
*** ociuhandu has quit IRC | 11:55 | |
*** ociuhandu has joined #openstack-ironic | 11:58 | |
openstackgerrit | Jacob Anders proposed openstack/ironic-inspector master: Use OOB inspection to fetch MACs for IB inspection https://review.opendev.org/c/openstack/ironic-inspector/+/758994 | 12:00 |
*** ociuhandu has quit IRC | 12:04 | |
janders | wrapping up for the night, have a good rest of your day Ironic, catch you tomorrow o/ | 12:09 |
iurygregory | bye janders | 12:10 |
*** anuradha1904 has joined #openstack-ironic | 12:10 | |
*** outbrito has joined #openstack-ironic | 12:11 | |
*** ociuhandu has joined #openstack-ironic | 12:15 | |
*** ociuhandu has quit IRC | 12:20 | |
*** dtantsur is now known as dtantsur|brb | 12:22 | |
*** k_mouza has quit IRC | 12:35 | |
*** k_mouza has joined #openstack-ironic | 12:47 | |
*** k_mouza has quit IRC | 13:05 | |
*** belmoreira has joined #openstack-ironic | 13:07 | |
*** k_mouza has joined #openstack-ironic | 13:09 | |
*** k_mouza has quit IRC | 13:19 | |
*** ociuhandu has joined #openstack-ironic | 13:26 | |
*** ociuhandu has quit IRC | 13:30 | |
*** k_mouza has joined #openstack-ironic | 13:31 | |
*** ociuhandu has joined #openstack-ironic | 13:35 | |
*** Goneri has joined #openstack-ironic | 13:36 | |
*** dtantsur|brb is now known as dtantsur | 13:41 | |
*** paras333 has joined #openstack-ironic | 13:44 | |
*** mgoddard has quit IRC | 13:46 | |
Qianbiao | Hello, does anyone try dynamic vendordata metadata service.? | 13:52 |
* dtantsur hasn't | 13:53 | |
Qianbiao | my vendordata is available through "curl http://169.254.169.254/openstack/2018-08-27/vendor_data2.json" | 13:53 |
Qianbiao | but cloud-init seems does not load it. | 13:53 |
*** mgoddard has joined #openstack-ironic | 13:53 | |
*** fmuyassarov has quit IRC | 13:54 | |
* TheJulia wipes sleep from her eyes | 13:57 | |
TheJulia | good morning everyone | 13:57 |
*** k_mouza has quit IRC | 13:57 | |
*** k_mouza has joined #openstack-ironic | 13:58 | |
iurygregory | good morning TheJulia =) | 13:59 |
rpittau | good morning TheJulia :) | 14:01 |
Qianbiao | morning TheJulia | 14:03 |
dtantsur | TheJulia: morning! | 14:03 |
*** zzzeek has quit IRC | 14:07 | |
*** zzzeek has joined #openstack-ironic | 14:09 | |
iurygregory | dtantsur, I'm going to push the release for IPA since https://review.opendev.org/c/openstack/ironic-python-agent/+/763902 merged | 14:11 |
*** rloo has joined #openstack-ironic | 14:20 | |
dtantsur | ack, cool | 14:24 |
openstackgerrit | Bob Fournier proposed openstack/ironic master: Add vendor_passthru method for virtual media https://review.opendev.org/c/openstack/ironic/+/763007 | 14:26 |
*** fmuyassarov has joined #openstack-ironic | 14:26 | |
*** mkrai has joined #openstack-ironic | 14:29 | |
*** zzzeek has quit IRC | 14:39 | |
*** tzumainn has joined #openstack-ironic | 14:42 | |
iurygregory | rpioso, hey you around? | 14:42 |
*** zzzeek has joined #openstack-ironic | 14:45 | |
TheJulia | stevebaker: I believe congratulations are in order.... See Mailing List. | 15:03 |
TheJulia | I feel like I need stronger coffee for today | 15:06 |
iurygregory | congrats stevebaker =) | 15:07 |
trandles | TheJulia: I need that stronger coffee too. This morning, trying to clear up an issue on a testbed, I nuked /var/lib/mysql. Problem is, I was on my ironic testbed and not the testbed with the problem. I lost everything about my 25-node baremetal cluster. :( | 15:08 |
dtantsur | stevebaker++ | 15:08 |
TheJulia | trandles: eek :( | 15:09 |
dtantsur | ouch | 15:11 |
TheJulia | Hopefully once back up you can celebrate with some colkegan or something similar | 15:12 |
trandles | That's a good suggestion. It won't be too bad to recover, just a pain and squandering time I really should be using to do something else. | 15:13 |
JayF | stevebaker: \o/ | 15:14 |
JayF | trandles: /o\ | 15:15 |
rpittau | congratulations stevebaker! :) | 15:20 |
openstackgerrit | Dmitry Tantsur proposed openstack/ironic-python-agent-builder master: Add ironic-python-agent-minimal element https://review.opendev.org/c/openstack/ironic-python-agent-builder/+/762815 | 15:34 |
*** Qianbiao has quit IRC | 15:37 | |
openstackgerrit | Mark Goddard proposed openstack/tenks master: CI: Fix ansible-lint failure https://review.opendev.org/c/openstack/tenks/+/763991 | 15:38 |
openstackgerrit | Jason Anderson proposed openstack/ironic master: Always retry locking when performing task handoff https://review.opendev.org/c/openstack/ironic/+/761653 | 15:42 |
rpittau | thanks mgoddard didn't really have the time today for that :) | 15:44 |
openstackgerrit | Riccardo Pittau proposed openstack/tenks master: Increase verbosity of ansible lint command https://review.opendev.org/c/openstack/tenks/+/763765 | 15:49 |
openstackgerrit | Dmitry Tantsur proposed openstack/ironic-python-agent-builder master: Repair the previous image name https://review.opendev.org/c/openstack/ironic-python-agent-builder/+/763993 | 15:51 |
dtantsur | rpittau: FYI ^^ | 15:51 |
dtantsur | this results in old images used by ironic IIUC | 15:51 |
JayF | dtantsur: I don't understand how that patch does what you say it does. It seems to only add `centos` to the supported elements for centos 8? | 15:53 |
JayF | oooh, that second ansible stanza is to set the name | 15:53 |
JayF | got it | 15:53 |
dtantsur | JayF: well, we modify the number from {{ distro }} to {{ distro }}{{ release }} | 15:53 |
dtantsur | ouch, which number? the name | 15:53 |
dtantsur | https://tarballs.opendev.org/openstack/ironic-python-agent/dib/files/ illustrates the current problem | 15:54 |
JayF | I +2'd it, I quacked myself through it | 15:54 |
dtantsur | my minimal element saves only 1 MiB. sigh. well, that's a start :D | 15:54 |
openstackgerrit | Dmitry Tantsur proposed openstack/ironic-python-agent-builder master: Clean up package installation https://review.opendev.org/c/openstack/ironic-python-agent-builder/+/762816 | 16:02 |
*** mkrai has quit IRC | 16:15 | |
JayF | Ugh. With the new gerrit, the emails no long indicate if w+1 was put in | 16:18 |
JayF | I got an email that rpittau +2'd that image name change, but it didn't show W+1... but he workflow'd it too | 16:18 |
rpittau | JayF: I WF'ed after you +2ed :) | 16:18 |
JayF | yeah, and the email only shows your +2 | 16:18 |
JayF | not the W+1 | 16:19 |
rpittau | oh ok | 16:19 |
dtantsur | I've noticed that as well | 16:22 |
openstackgerrit | Julia Kreger proposed openstack/ironic-python-agent master: Option to enable bootloader config failure bypass https://review.opendev.org/c/openstack/ironic-python-agent/+/764016 | 16:24 |
iurygregory | new gerrit still doesn't deserve a cookie it seems... | 16:35 |
TheJulia | will something so drasticly different ever get a cookie? | 16:37 |
fmuyassarov | dtantsur, I have addressed your comments in 762343(not pushed yet), but my local test run is failing (link: https://paste.centos.org/view/0078abfb ) to pass the unit test that I added. Do you know what am I missing in this unit test https://paste.centos.org/view/2f5d825b ? | 16:40 |
*** hoonetorg has quit IRC | 16:41 | |
dking | TheJulia: I don't need inspector to save the information, specifically, but I don't know another way to get it into Ironic. The inspector collectors seem to only have access to write to the inspector data, and during inspection, I'm under the impression that there's no way for the new, yet unenrolled node, to talk to Ironic directly? Or am I missing something? | 16:41 |
-openstackstatus- NOTICE: The Gerrit service on review.opendev.org is being restarted quickly to troubleshoot an SMTP queuing backlog, downtime should be less than 5 minutes | 16:42 | |
*** anuradha1904 has quit IRC | 16:50 | |
*** hoonetorg has joined #openstack-ironic | 16:53 | |
dtantsur | fmuyassarov: your test verifies a negative response, but you expect HTTP OK | 16:54 |
dtantsur | you need to change the last line to the correct error code and add expect_errors=True to patch_json() | 16:54 |
fmuyassarov | got it. Thanks | 16:55 |
dtantsur | rpittau, JayF, I've just got a notification about W+1. I guess it is taking time. | 16:57 |
JayF | yeah; same. Just slow | 16:57 |
rpittau | mmm maybe related to the issue mentioned before | 16:57 |
rpittau | good night! o/ | 17:01 |
*** rpittau is now known as rpittau|afk | 17:01 | |
*** ociuhandu_ has joined #openstack-ironic | 17:06 | |
*** ociuhandu_ has quit IRC | 17:06 | |
TheJulia | dking: absolutely no way for the new node to send information to ironic, it would have to go through inspector, but if your not saving the introspection information, then you identify/collect it and then pass it through and it shouldn't be retained. If your logging level is default, I don't think it will even log details about the node so it would be completely transitory to inspector afaik. | 17:08 |
*** ociuhandu has quit IRC | 17:09 | |
*** lucasagomes has quit IRC | 17:10 | |
arne_wiebalck | bye everyone o/ | 17:13 |
TheJulia | goodnight | 17:13 |
dking | TheJulia: Thank you. So, just put put it in the inspect data[], and then let introspect set it into Ironic, and without debug, that shouldn't get logged? | 17:17 |
TheJulia | I believe so, dtantsur might think otherwise | 17:17 |
openstackgerrit | Feruzjon Muyassarov proposed openstack/ironic master: Allow disabling automated_clean per node https://review.opendev.org/c/openstack/ironic/+/762343 | 17:22 |
openstackgerrit | Feruzjon Muyassarov proposed openstack/ironic master: Allow disabling automated_clean per node https://review.opendev.org/c/openstack/ironic/+/762343 | 17:24 |
*** rloo has quit IRC | 17:26 | |
*** rloo has joined #openstack-ironic | 17:27 | |
fmuyassarov | dtantsur, updated the patchset. Thank you for your help. | 17:28 |
dtantsur | thank you, I'll try to get to it before EOD today | 17:28 |
fmuyassarov | Yes, take your time | 17:29 |
*** dougsz has quit IRC | 17:34 | |
*** ociuhandu has joined #openstack-ironic | 17:41 | |
*** jlvillal has quit IRC | 17:42 | |
*** jlvillal has joined #openstack-ironic | 17:43 | |
TheJulia | Interesting... did we turn off notifications for ironic-specs and ironic-python-agent? | 17:43 |
dtantsur | you mean, IRC? I don't think so | 17:44 |
dtantsur | I see a notification about your patch to IPA 1:20 ago | 17:44 |
TheJulia | but not on ironic specs I pushed like 3 minutse ago | 17:45 |
TheJulia | or irccloud has gotten super smart filtering AI | 17:45 |
dtantsur | the bot goes for a smoke from time to time | 17:45 |
*** ociuhandu has quit IRC | 17:45 | |
TheJulia | at which point it migh tas well be named Skynet | 17:45 |
dtantsur | heh | 17:45 |
dtantsur | but yeah, the bot does disappear occasionally | 17:45 |
TheJulia | ahh, yeah, I see the ipa notification | 17:45 |
TheJulia | it wasn't instant it looks like 1-2 minutes | 17:46 |
dtantsur | nothing about the new gerrit seems instant atm :) | 17:46 |
TheJulia | yeah :( | 17:47 |
* TheJulia cracks open a new spec file | 17:47 | |
TheJulia | looks like releases are borked for now | 17:54 |
dtantsur | yep | 17:55 |
*** iurygregory has quit IRC | 17:59 | |
*** dtantsur is now known as dtantsur|afk | 18:01 | |
dtantsur|afk | see you tomorrow | 18:01 |
TheJulia | goodnight dtantsur|afk | 18:01 |
*** derekh has quit IRC | 18:01 | |
*** mgoddard has quit IRC | 18:07 | |
*** rloo has quit IRC | 18:18 | |
*** rloo has joined #openstack-ironic | 18:19 | |
buhman | What's the "plan" for metalsmith? https://specs.openstack.org/openstack/ironic-specs/specs/12.1/allocation-api.html describes metalsmith as a "short-term" thing. Is it desired that metalsmith-like functionality be added as new Ironic API features (via the same spec process that the allocation api was added)? Or would some parts be better implemented as a completely separate service, like a lighter-weight nova? | 18:22 |
*** rloo has quit IRC | 18:23 | |
*** rloo has joined #openstack-ironic | 18:23 | |
*** jamesdenton has quit IRC | 18:26 | |
*** jamesden_ has joined #openstack-ironic | 18:26 | |
*** iurygregory has joined #openstack-ironic | 18:27 | |
*** k_mouza has quit IRC | 18:29 | |
*** fmuyassarov has quit IRC | 18:52 | |
iurygregory | rpioso, just fyi the problem I've mentioned yesterday about idrac8 with vmedia http://paste.openstack.org/show/800368/ I was able to get more logs to look at and seems like redfish/v1/Managers/iDRAC.Embedded.1/VirtualMedia/CD/Actions/VirtualMedia.InsertMedia returned 500 .-. wondering if this is expected http://paste.openstack.org/show/800368/ | 18:57 |
rpioso | iurygregory: o/ | 19:01 |
rpioso | iurygregory: If memory serves, weren't you chasing down a 40x status yesterday? | 19:02 |
rpioso | iurygregory: It would be hard to say an internal server error is ever expected :-) | 19:03 |
rpioso | iurygregory: Have you gotten that action to work outside of ironic/sushy, say via curl or https://github.com/dell/iDRAC-Redfish-Scripting/blob/master/Redfish%20Python/InsertEjectVirtualMediaREDFISH.py? | 19:05 |
iurygregory | rpioso, yeah but it was a warning log only | 19:10 |
iurygregory | they sent a full log later today | 19:10 |
rpioso | iurygregory: Gotcha ... And? | 19:11 |
iurygregory | and this 500 was what I've found but I do remember they saying idrac8 with 2.75.75.75 should work with vmedia .-. | 19:12 |
iurygregory | so it's a bit strange | 19:12 |
iurygregory | I'm wondering if maybe there is some configuration that needs to be set on idrac maybe? | 19:12 |
iurygregory | I will ask them to run https://github.com/dell/iDRAC-Redfish-Scripting/blob/master/Redfish%20Python/InsertEjectVirtualMediaREDFISH.py aganist the machine | 19:13 |
rpioso | iurygregory: I will try to ask around. | 19:13 |
iurygregory | tks! | 19:14 |
rpioso | iurygregory: np | 19:14 |
eandersson | Is there a way to make rebuild also clean? or is there a way to clean + rebuild with one api call? if not do you need to undeploy / deploy? | 19:16 |
*** dougsz has joined #openstack-ironic | 19:31 | |
TheJulia | eandersson: rebuild is just re-deploy, so guess maybe with steps, you could clean. I don't think we had ever thought about that. | 19:33 |
TheJulia | eandersson: largely rebuild was intended to be used to upgrade a long long time ago in a galaxy far away known as HP Helion. | 19:34 |
TheJulia | rebuilds in place with nova. So I guess we could also accept feature to do cleaning as well, but yeah, not been thought of before | 19:35 |
*** dougsz has quit IRC | 19:36 | |
TheJulia | buhman: Basically remain a tool people can use to get and deploy baremetal nodes without having to know openstack commands, use ansible, or leverage an API client. Even if the internal lightweight selection logic was stripped out, it would still do the basic data population for users that they or a playbook or a few commands could send to the API. | 19:39 |
buhman | Oh.. I suppose I read the Allocation API problem description incorrectly. I thought it was blanket saying "metalsmith itself is a short-term hack", but it was referring specifically to the allocation feature as previously implemented in metalsmith. | 19:45 |
buhman | Curious: why is "a person doesn't need to leverage an API client" a desirable thing? | 19:46 |
buhman | Isn't metalsmith an "API client"? | 19:47 |
stevebaker | TheJulia, iurygregory, dtantsur|afk, JayF, rpittau|afk: oh wow, thanks everyone :D | 19:52 |
TheJulia | buhman: let me clarify. Someone use an api client for their direct interaction, so at worst they are writing their own, or they are basically at a code level, which is not exactly friendly for day to day operations | 19:53 |
buhman | Not sure if I understand. Do you mean "so at worst they are writing their own [reimplementation of metalsmith]"? | 20:00 |
iurygregory | rpioso, http://paste.openstack.org/show/800386/ | 20:02 |
iurygregory | this was the output he got running the script with -c "y" | 20:03 |
rpioso | iurygregory: Sounds like it was successful. | 20:04 |
rpioso | iurygregory: Did he try to one-time boot it, just to confirm? | 20:04 |
rpioso | iurygregory: https://github.com/dell/iDRAC-Redfish-Scripting/blob/master/Redfish%20Python/SetNextOneTimeBootVirtualMediaDeviceOemREDFISH.py | 20:05 |
iurygregory | let me see if I follow, on idrac8 this need to be done otherwise deploying with vmedia may fail or something? | 20:07 |
*** belmoreira has quit IRC | 20:08 | |
iurygregory | rpioso, ^ | 20:16 |
openstackgerrit | Merged openstack/ironic-python-agent-builder master: Repair the previous image name https://review.opendev.org/c/openstack/ironic-python-agent-builder/+/763993 | 20:18 |
rpioso | iurygregory: That second script is the basis for the sushy-oem-idrac code which sets the one-time boot device to the virtual CD. That's called by the idrac-redfish-virtual-media boot interface. | 20:20 |
iurygregory | yeah, they are using the idrac-redfish-virtual-media interface | 20:21 |
rpioso | iurygregory: I asked that they run that second script after successful execution of the first to get a second data point on its working. | 20:22 |
iurygregory | I see, I will ask | 20:22 |
iurygregory | do they needto set any extra args? | 20:23 |
iurygregory | like the values for -d and -r | 20:23 |
TheJulia | stevebaker: internal call? | 20:32 |
rpioso | iurygregory: -d 1 -r y | 20:34 |
iurygregory | rpioso, ack | 20:34 |
rpioso | iurygregory: They should point it at a "unique" OS and watch the system console to determine if it boots :-) | 20:35 |
rpioso | iurygregory: Are they exercising DHCP-less? | 20:35 |
iurygregory | rpioso, this is with metal3 basically =) | 20:36 |
iurygregory | no dhcp-less | 20:36 |
janders | good morning Ironic o/ | 20:41 |
iurygregory | morning janders o/ | 20:41 |
stevebaker | TheJulia: crap, I've got an appointment in town, I was just getting ready | 20:47 |
TheJulia | buhman: if that is what someone wants to do. If you think about it the basic steps are not difficult, the whole key of things is to make things easier and require less lower level knowledge of how APIs operate and behave, and maybe interop with other resources if they are also trying to leverage from the same pool of resources | 20:55 |
rpioso | iurygregory: Thank you! | 20:57 |
iurygregory | rpioso, np I'll be able to share the results in a few | 21:07 |
iurygregory | just got a message he said the machine booted | 21:08 |
iurygregory | so I'm wondering if it was bad luck when they did the deployment with metal3 .-. | 21:09 |
*** k_mouza has joined #openstack-ironic | 21:30 | |
*** k_mouza has quit IRC | 21:35 | |
*** zzzeek has quit IRC | 21:38 | |
*** zzzeek has joined #openstack-ironic | 21:40 | |
*** hjensas has quit IRC | 21:58 | |
*** hjensas has joined #openstack-ironic | 21:59 | |
*** rcernin has joined #openstack-ironic | 22:00 | |
*** Goneri has quit IRC | 22:08 | |
*** hjensas_ has joined #openstack-ironic | 22:16 | |
*** hjensas has quit IRC | 22:17 | |
*** hjensas__ has joined #openstack-ironic | 22:17 | |
*** hjensas__ has quit IRC | 22:17 | |
*** hjensas__ has joined #openstack-ironic | 22:18 | |
rpioso | iurygregory: Interesting ... Sounds like fog of vmedia war ;-) | 22:19 |
iurygregory | yeah =( | 22:19 |
*** hjensas_ has quit IRC | 22:21 | |
*** paras333 has quit IRC | 22:24 | |
openstackgerrit | Merged x/sushy-oem-idrac master: Use safe version of hacking https://review.opendev.org/c/x/sushy-oem-idrac/+/727260 | 22:31 |
openstackgerrit | Julia Kreger proposed openstack/ironic-specs master: WIP Ironic Secure RBAC https://review.opendev.org/c/openstack/ironic-specs/+/764070 | 22:35 |
TheJulia | stevebaker: ^ | 22:35 |
rpioso | TheJulia: Should the first release off a new stable branch include the updates to .gitreview, tox.ini, and Zuul project.yaml file(s) on that branch? | 22:47 |
*** hjensas__ has quit IRC | 22:47 | |
*** hjensas__ has joined #openstack-ironic | 22:48 | |
*** hjensas__ has quit IRC | 22:50 | |
*** hjensas__ has joined #openstack-ironic | 22:50 | |
*** jamesden_ is now known as jamesdenton | 22:50 | |
TheJulia | rpioso: before or after is fine. Those files don't need to be updated in the actual item tagged/released | 22:52 |
rpioso | TheJulia: Thank you for clarifying. | 22:53 |
*** hjensas__ has quit IRC | 23:09 | |
*** Goneri has joined #openstack-ironic | 23:18 | |
*** k_mouza has joined #openstack-ironic | 23:30 | |
*** k_mouza has quit IRC | 23:34 | |
*** tosky has quit IRC | 23:57 | |
*** openstackgerrit has quit IRC | 23:59 |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!