| *** JayF has quit IRC | 01:23 | |
| *** ricolin_ has joined #openstack-ironic | 01:23 | |
| *** iurygregory has joined #openstack-ironic | 02:07 | |
| *** JayF has joined #openstack-ironic | 02:40 | |
| *** rcernin has quit IRC | 02:59 | |
| *** rcernin has joined #openstack-ironic | 03:08 | |
| *** mkrai has joined #openstack-ironic | 03:08 | |
| *** rcernin has quit IRC | 03:19 | |
| *** rcernin has joined #openstack-ironic | 03:30 | |
| *** ricolin_ has quit IRC | 07:11 | |
| *** mkrai has quit IRC | 07:13 | |
| *** hoonetorg has joined #openstack-ironic | 07:46 | |
| *** rcernin has quit IRC | 07:51 | |
| *** mkrai has joined #openstack-ironic | 07:53 | |
| arne_wiebalck | Good morning, ironic! | 07:58 |
|---|---|---|
| janders | good morning arne_wiebalck o/ | 08:05 |
| arne_wiebalck | hey janders, good morning o/ | 08:05 |
| *** rpittau|afk is now known as rpittau | 08:33 | |
| rpittau | good morning ironic! o/ | 08:33 |
| *** dougsz has joined #openstack-ironic | 08:39 | |
| *** yoctozepto has quit IRC | 08:48 | |
| *** sshnaidm|afk is now known as sshnaidm|ruck | 08:57 | |
| janders | good morning rpittau o/ | 08:57 |
| rpittau | hey janders :) | 08:58 |
| *** lucasagomes has joined #openstack-ironic | 09:00 | |
| *** Qianbiao has joined #openstack-ironic | 09:07 | |
| *** ociuhandu has joined #openstack-ironic | 09:18 | |
| openstackgerrit | Mark Goddard proposed openstack/bifrost master: Update APT metadata before install debootstrap https://review.opendev.org/c/openstack/bifrost/+/769219 | 09:18 |
| *** akahat is now known as akahat|rover | 09:41 | |
| *** ociuhandu has quit IRC | 09:43 | |
| *** derekh has joined #openstack-ironic | 09:44 | |
| *** ociuhandu has joined #openstack-ironic | 09:53 | |
| *** ociuhandu has quit IRC | 09:58 | |
| *** tosin has joined #openstack-ironic | 10:02 | |
| *** ociuhandu has joined #openstack-ironic | 10:09 | |
| *** ociuhandu has quit IRC | 10:14 | |
| *** ociuhandu has joined #openstack-ironic | 10:15 | |
| *** ociuhandu has quit IRC | 10:29 | |
| *** ociuhandu has joined #openstack-ironic | 10:30 | |
| *** dtantsur|afk is now known as dtantsur | 10:37 | |
| dtantsur | happy Monday, ironic | 10:37 |
| *** mkrai has quit IRC | 10:54 | |
| janders | hey dtantsur o/ | 11:00 |
| *** ociuhandu has quit IRC | 11:18 | |
| *** ociuhandu has joined #openstack-ironic | 11:23 | |
| *** ociuhandu has quit IRC | 11:28 | |
| *** ociuhandu has joined #openstack-ironic | 11:30 | |
| *** zzzeek has quit IRC | 11:33 | |
| *** ociuhandu has quit IRC | 11:35 | |
| *** zzzeek has joined #openstack-ironic | 11:35 | |
| iurygregory | good morning arne_wiebalck rpittau dtantsur janders and Ironic! | 11:37 |
| arne_wiebalck | hey iurygregory o/ | 11:38 |
| iurygregory | o/ | 11:38 |
| *** ociuhandu has joined #openstack-ironic | 11:43 | |
| *** rcernin has joined #openstack-ironic | 11:51 | |
| *** ociuhandu has quit IRC | 11:51 | |
| tosin | Hello Ironic! I proposed a change in ansible modules but it failed bifrost tests. Could someone please help check? I still have a lot to figure out o/ | 11:55 |
| tosin | Here's my change https://review.opendev.org/c/openstack/ansible-collections-openstack/+/770037 | 11:55 |
| dtantsur | KeyError: 'deploy' | 11:56 |
| dtantsur | tosin: I think because of module.params['deploy']. I don't know what you meant, but this thing does not exist. | 11:56 |
| dtantsur | commented. I think you need to check what validation does, the whole patch seems not quite right to me. | 11:58 |
| *** ociuhandu has joined #openstack-ironic | 12:05 | |
| tosin | dtantsur: module.params['deploy'] had already been used before I made changes. On line 315. | 12:08 |
| dtantsur | ah, it's a boolean value. well, you don't need to touch it anyway | 12:09 |
| dtantsur | you could probably add a new boolean flag "validate" to control the validation | 12:09 |
| dtantsur | then KeyError may be because of node['deploy'] | 12:09 |
| *** ociuhandu has quit IRC | 12:11 | |
| *** zzzeek has quit IRC | 12:19 | |
| *** rcernin has quit IRC | 12:21 | |
| *** zzzeek has joined #openstack-ironic | 12:21 | |
| *** ociuhandu has joined #openstack-ironic | 12:24 | |
| *** nam-est has quit IRC | 12:28 | |
| *** ociuhandu has quit IRC | 12:37 | |
| *** bfournie has joined #openstack-ironic | 12:38 | |
| *** rh-jelabarre has joined #openstack-ironic | 12:41 | |
| *** ociuhandu has joined #openstack-ironic | 13:10 | |
| openstackgerrit | Merged openstack/ironic-python-agent stable/victoria: Fix default disk label with partition images https://review.opendev.org/c/openstack/ironic-python-agent/+/769748 | 13:12 |
| *** ociuhandu has quit IRC | 13:14 | |
| *** ociuhandu_ has joined #openstack-ironic | 13:14 | |
| openstackgerrit | Dmitry Tantsur proposed openstack/ironic master: [WIP] Common framework for configuring secure boot https://review.opendev.org/c/openstack/ironic/+/769961 | 13:17 |
| *** ociuhandu_ has quit IRC | 13:22 | |
| openstackgerrit | Dmitry Tantsur proposed openstack/ironic master: [WIP] Common framework for configuring secure boot https://review.opendev.org/c/openstack/ironic/+/769961 | 13:23 |
| openstackgerrit | Dmitry Tantsur proposed openstack/ironic master: [WIP] Switch iLO and iRMC to the new secure boot framework https://review.opendev.org/c/openstack/ironic/+/770122 | 13:23 |
| *** nam-est has joined #openstack-ironic | 13:31 | |
| nam-est | Hi all, anyone please give a review to these PRs? We really need this feature to go in ASAP. | 13:31 |
| nam-est | https://github.com/metal3-io/baremetal-operator/pull/728 | 13:31 |
| nam-est | https://github.com/metal3-io/ironic-image/pull/230 | 13:31 |
| nam-est | https://github.com/metal3-io/ironic-inspector-image/pull/70 | 13:31 |
| nam-est | Thank you | 13:31 |
| nam-est | btw, the first two PRs need other to be merged before they can pass the CI. In detail, the first PR can pass when the second one is merged, but the second one cannot pass if the first one is not merged. | 13:33 |
| nam-est | Are there anyways to solve that problem? | 13:33 |
| iurygregory | I'm not sure if can just remove the support for http_basic in ironic.conf.j2 | 13:34 |
| iurygregory | we would still need to configure things in ironic.conf | 13:35 |
| *** ociuhandu has joined #openstack-ironic | 13:35 | |
| iurygregory | I think it would end up with auth_strategy = noauth in all scenarios (please correct me if I'm wrong) | 13:36 |
| nam-est | iurygregory: the basic authentication is moved to the Apache server, so in my PR, Apache will handle the authentication | 13:36 |
| nam-est | iurygregory: that is why I put it as noauth in ironic.conf. Any idea how we can configure in this case? | 13:38 |
| dtantsur | nam-est: mm, no, you're using "WSGIPassAuthorization On" | 13:39 |
| iurygregory | no idea atm, but I don't think we can just move the auth to part to apache and have ironic with only noauth... | 13:39 |
| iurygregory | I would say some variable will control if we need to set in ironic.conf or not like before | 13:39 |
| *** ociuhandu has quit IRC | 13:40 | |
| *** ociuhandu has joined #openstack-ironic | 13:40 | |
| *** ociuhandu has quit IRC | 13:40 | |
| *** ociuhandu has joined #openstack-ironic | 13:41 | |
| dtantsur | nam-est: https://github.com/metal3-io/ironic-inspector-image/pull/70 has outstanding comments since early December | 13:41 |
| *** ociuhandu has quit IRC | 13:41 | |
| nam-est | <dtantsur>: I forgot to remove that `"WSGIPassAuthorization On`. | 13:42 |
| nam-est | dtantsur: However, it is also true that moving the basic_auth to apache means that we cannot configurate it using ironic.conf. Should we keep it on Ironic, or still move to Apache? | 13:44 |
| dtantsur | nam-est: I don't have a strong opinion here, but probably handling it on the httpd level makes more sense | 13:45 |
| *** yoctozepto has joined #openstack-ironic | 13:45 | |
| iurygregory | we just need to make sure everybody the metal3 community is ok | 13:45 |
| dtantsur | I'd like to get our openshift folks involved in this as well | 13:46 |
| *** ociuhandu has joined #openstack-ironic | 13:47 | |
| iurygregory | yeah, zaneb maybe you would like to look at this ^ | 13:47 |
| nam-est | Ok, I will tag him to the PR | 13:49 |
| nam-est | In the PR in ironic-inspector-image repo, I added a httpd as a reverse proxy to handle TLS since we have an issue with Eventlet handling TLS. | 13:56 |
| nam-est | How do you think about that approach? Since this is a new approach, so I would like to hear from you. | 13:56 |
| dtantsur | it's probably the way to go, yes | 13:56 |
| nam-est | dtantsur: Cool | 13:57 |
| dtantsur | you could also try an eventlet-compatible wsgi server, like uwsgi (?) | 13:57 |
| dtantsur | or gunicorn | 13:57 |
| nam-est | dtantsur: in that case, do we need to separate the inspector-api and inspector-conductor | 13:59 |
| nam-est | ? | 13:59 |
| dtantsur | that's an orthogonal question, let's not involve it for now | 13:59 |
| dtantsur | this split currently requires rabbitmq which we don't want | 13:59 |
| nam-est | dtantsur: that is true | 13:59 |
| dtantsur | with an eventlet-compatible server you may end up with only one process, yes | 14:00 |
| dtantsur | the best way to decide is to build a testing lab and test a few approaches under load | 14:01 |
| nam-est | we can use the reverse proxy for now, and think about the way to use uwsgi or gunicorn in the later versions. | 14:01 |
| dtantsur | yep | 14:01 |
| openstackgerrit | Aija Jauntēva proposed openstack/ironic master: Add 'deploy steps' parameter for provisioning API https://review.opendev.org/c/openstack/ironic/+/768353 | 14:01 |
| nam-est | Also, we are worrying that the same SSL problems can happen if we let ironic-conductor handles TLS itself. We haven't seen the problem from log of the conductor, but cannot make sure that it will not happen | 14:03 |
| nam-est | should we also add reverse proxy for the ironic-conductor? | 14:03 |
| openstackgerrit | Aija Jauntēva proposed openstack/python-ironicclient master: Add 'deploy steps' for provisioning API https://review.opendev.org/c/openstack/python-ironicclient/+/768354 | 14:04 |
| dtantsur | nam-est: I feel that it could be an unnecessary overcomplication | 14:04 |
| dtantsur | (even the switch to API may be premature, unless you actually handle hundreds or thousands of nodes with many API consumers) | 14:05 |
| TheJulia | good morning | 14:07 |
| *** rloo has joined #openstack-ironic | 14:08 | |
| nam-est | dtantsur: I see from https://bugs.python.org/issue31122 that the SSL issue happens when the SSL handshake is disrupted for some reasons. | 14:08 |
| nam-est | Not sure if this kind of disruption happens when ironic-api and ironic-conductor talks to each other | 14:09 |
| dtantsur | nam-est: is updating Python an option for you? | 14:15 |
| dtantsur | you're pretty much building a complex work around for a known and fixed bug | 14:15 |
| dtantsur | nam-est: also (forgot if I've asked) do you have eventlet at least 0.25.2? | 14:19 |
| nam-est | dtantsur: we cannot update Python to something more than 3.6, unfortunately. Otherwise, my life is much easier ^^ | 14:20 |
| nam-est | I will check the eventlet version. Is the problem solved from 0.25.2? | 14:21 |
| *** tzumainn has joined #openstack-ironic | 14:21 | |
| dtantsur | nam-est: it might. re python.. you're not tied to Red hat technologies, are you? I think you use Ubuntu for base OS, you could probably use it for containers and/or even build them from source. | 14:22 |
| *** bdodd has joined #openstack-ironic | 14:24 | |
| nam-est | dtantsur: Yes, we are not tied to Redhat. But still, we cannot use something other than Python 3.6 because of some technical reasons. | 14:26 |
| dtantsur | okay, if eventlet 0.25.2 does not fix the problem, you can try newer versions as well | 14:31 |
| nam-est | ok, thank you, dtantsur. | 14:34 |
| *** tosky has joined #openstack-ironic | 14:39 | |
| *** kaifeng has joined #openstack-ironic | 14:43 | |
| arne_wiebalck | anyone ever connected to a KVMIP endpoint (retrieved via Redfish)? | 14:45 |
| * arne_wiebalck apparently struggles to do this | 14:45 | |
| *** ociuhandu has quit IRC | 14:45 | |
| *** ociuhandu has joined #openstack-ironic | 14:46 | |
| dtantsur | not me, maybe dell folks? | 14:53 |
| TheJulia | Did we like merge everything and not post new patches? | 14:55 |
| TheJulia | arne_wiebalck: I think you can on hp gear, but you need to use a specific vnc clients that grok the reversed encoding if memory serves | 14:55 |
| arne_wiebalck | dtantsur: TheJulia: thanks | 14:56 |
| arne_wiebalck | I have a server and Redfish provides me with a port, telnet reports RFB 3.8, so this looks like a VNC server ... | 14:56 |
| *** spotz has joined #openstack-ironic | 14:57 | |
| TheJulia | Yeah, the secret is the encoding is completely swapped around | 14:57 |
| arne_wiebalck | reports == returns "RFB 003.008" | 14:57 |
| TheJulia | the recommended vnc client for nova virtual machines is supposed to work if memory serves | 14:57 |
| arne_wiebalck | oh, yeah? I tried different ones, different encryptions, but so far without luck | 14:58 |
| arne_wiebalck | could be network, though, as I do this from home via tunnels and socks proxies ... | 14:58 |
| arne_wiebalck | I am just not sure if I should expect a VNC server on the other side | 14:59 |
| arne_wiebalck | (also: Redfish tells me the service is disabled, but I can still connect) | 14:59 |
| *** stendulker has joined #openstack-ironic | 14:59 | |
| TheJulia | #startmeeting ironic | 15:00 |
| TheJulia | o/ | 15:00 |
| openstack | Meeting started Mon Jan 11 15:00:25 2021 UTC and is due to finish in 60 minutes. The chair is TheJulia. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:00 |
| *** openstack changes topic to " (Meeting topic: ironic)" | 15:00 | |
| openstack | The meeting name has been set to 'ironic' | 15:00 |
| stendulker | \o | 15:00 |
| erbarr | o/ | 15:00 |
| bdodd | o/ | 15:00 |
| rloo | o/ | 15:00 |
| TheJulia | Good morning everyone, and welcome to our first weekly meeting of 2021! | 15:00 |
| ajya | o/ | 15:00 |
| rpittau | o/ | 15:00 |
| arne_wiebalck | o/ | 15:01 |
| kaifeng | o/ | 15:01 |
| rpioso | \o | 15:01 |
| *** nam-est has quit IRC | 15:01 | |
| TheJulia | Our agenda can be found on the wiki, as always. | 15:01 |
| TheJulia | #link https://wiki.openstack.org/wiki/Meetings/Ironic#Agenda_for_next_meeting | 15:01 |
| TheJulia | #topic Announcements/Reminders | 15:01 |
| *** openstack changes topic to "Announcements/Reminders (Meeting topic: ironic)" | 15:01 | |
| dtantsur | o/ | 15:01 |
| TheJulia | Right before the holidays, we performed another release. Thanks everyone! | 15:02 |
| dtantsur | \o/ | 15:03 |
| TheJulia | This week is R-13 on the OpenStack release schedule. It appears requirements freezes go into effect project wide on R-5 this cycle along with R-6 for client libraries. In other words, Time is starting to run short for getting things into Wallaby. | 15:04 |
| TheJulia | #link https://releases.openstack.org/wallaby/schedule.html | 15:04 |
| dtantsur | #link https://owlet.today/posts/ironic-2020/ dtantsur's top picks from year 2020 | 15:04 |
| TheJulia | Does anyone have any other items to announce or remind us of this year? | 15:04 |
| dtantsur | when is our next release? | 15:05 |
| TheJulia | good question | 15:05 |
| dtantsur | the week of February 8th, 2021 | 15:05 |
| *** MentalSiege has joined #openstack-ironic | 15:05 | |
| dtantsur | 4 weeks to go, let's make them count :) | 15:05 |
| TheJulia | #link https://specs.openstack.org/openstack/ironic-specs/priorities/wallaby-priorities.html | 15:05 |
| TheJulia | Correct | 15:05 |
| TheJulia | ++ | 15:05 |
| TheJulia | If there is nothing else, time to proceed on to the next item on our agenda. | 15:06 |
| rloo | when do we think it might be time for a mid-cycle meeting (maybe this is an open discussion question) | 15:06 |
| dtantsur | a great question | 15:06 |
| iurygregory | yeah, zaneb maybe you would like to look at this ^ | 15:06 |
| iurygregory | ops hehe | 15:06 |
| iurygregory | o/ | 15:06 |
| TheJulia | And an item already noted on the Discussion agenda item :) | 15:06 |
| rpittau | I think it's in the meeting agenda | 15:06 |
| rloo | ++ | 15:06 |
| rpittau | yeah, that :) | 15:06 |
| * iurygregory need to get used to new keyboard | 15:06 | |
| zaneb | lol | 15:06 |
| TheJulia | Since we dind't have prior meetings this year, and it has been a while, I'm going to declare action item bankruptcy and move directly to reviewing subteam status reports | 15:07 |
| TheJulia | #topic Review subteam status reports | 15:07 |
| *** openstack changes topic to "Review subteam status reports (Meeting topic: ironic)" | 15:07 | |
| TheJulia | #link https://etherpad.openstack.org/p/IronicWhiteBoard | 15:07 |
| TheJulia | Starting at line 291 | 15:07 |
| TheJulia | dtantsur: commonizing the secure boot interface seems like separate from the work of *just* trying to cleanup the headache of the UEFI code, perhaps a separate item? | 15:09 |
| dtantsur | as you wish, although it's kinda related to cleaning up this area (just not the very bit you're cleaning up) | 15:10 |
| dtantsur | I understood this topic as a wider one | 15:10 |
| rloo | so i understand -- the only thing left (so far) is the common interface for secure boot? | 15:11 |
| TheJulia | Yeah, lets break it apart, I kind of just want to mark whole parts done | 15:11 |
| TheJulia | rloo: it was never defined as part of the initial work | 15:11 |
| TheJulia | But it is a logical item that should be performed | 15:11 |
| TheJulia | I'm fine if we track it as a separate item | 15:12 |
| rloo | then yeah, lets break it up. would at least be easier to get the status of the new thing, w/o reading all the old stuff :) | 15:12 |
| *** MentalSiege has quit IRC | 15:12 | |
| TheJulia | ++ | 15:12 |
| TheJulia | arne_wiebalck: You do have a UEFI + raid question, and my comment on the etherpad is that I *think* the patches covered that, but I don't think there was ever a reply. | 15:12 |
| rloo | (what sprint are we in now?) | 15:13 |
| TheJulia | sprint 2 | 15:13 |
| rloo | thx | 15:13 |
| arne_wiebalck | I have a question on the whiteboard? | 15:13 |
| TheJulia | arne_wiebalck: line..... 333 | 15:14 |
| arne_wiebalck | ah, right | 15:14 |
| arne_wiebalck | this was mostly about the technical debt we added when we merged UEFI RAID | 15:14 |
| arne_wiebalck | we had foreseen to clean this up "later" :) | 15:15 |
| TheJulia | So w/r/t nvme secure erase I got an email from janders, he expects to work on that this next week or two | 15:15 |
| arne_wiebalck | so, I was wondering if the ongoing work would remove that debt | 15:15 |
| TheJulia | arne_wiebalck: so you may be "off the hook" of needing to do that now | 15:15 |
| * arne_wiebalck feels busted | 15:15 | |
| TheJulia | lol | 15:15 |
| TheJulia | No need, it happens. :) | 15:15 |
| TheJulia | kaifeng: Any update on node history? | 15:17 |
| TheJulia | Okay, looks like you started proposing the work | 15:17 |
| kaifeng | TheJulia: yeah, have proposed some basic db code | 15:17 |
| kaifeng | but I'd like to get batch ops in the patch, so it still a wip | 15:18 |
| TheJulia | Noted, adding notes | 15:18 |
| TheJulia | and the patch to the review list | 15:18 |
| TheJulia | bdodd: ajya: I saw the redfish raid patch was being revised this weekend, will that be good for general review soon? | 15:19 |
| TheJulia | iurygregory: Thanks for updating the oslo.privsep item | 15:20 |
| iurygregory | TheJulia, np! | 15:20 |
| TheJulia | dtantsur: network manager with ramdisk unchanged? | 15:21 |
| bdodd | TheJulia Still some work still to do. I didn't get as much done of the holidays as I had hoped. But working on it mostly full-time now. I'll add some notes to the whiteboard. | 15:21 |
| TheJulia | bdodd: awesome | 15:21 |
| dtantsur | TheJulia: I haven't done anything about it afterwards | 15:21 |
| TheJulia | k | 15:21 |
| TheJulia | who is medium purple color today in the etherpad? | 15:22 |
| TheJulia | Etherpad says "Anonymous" | 15:22 |
| rloo | might be me. | 15:22 |
| TheJulia | Anaconda? | 15:22 |
| rloo | yeah | 15:22 |
| TheJulia | thanks for the update there! | 15:23 |
| TheJulia | dtantsur: and I moved the secure boot interface stuff to line 419 | 15:23 |
| dtantsur | thx! | 15:23 |
| TheJulia | np | 15:23 |
| TheJulia | Okay, that was a lot! | 15:24 |
| TheJulia | So next on the agenda is priorities for the coming week | 15:24 |
| TheJulia | #topic Deciding on priorities for the coming week | 15:24 |
| *** openstack changes topic to "Deciding on priorities for the coming week (Meeting topic: ironic)" | 15:24 | |
| TheJulia | #link https://etherpad.openstack.org/p/IronicWhiteBoard | 15:24 |
| TheJulia | Starting at line 126 | 15:25 |
| TheJulia | Worth noting, MANY things have merged | 15:25 |
| TheJulia | So I guess first I'll delete those items and delete the struck through items. | 15:25 |
| TheJulia | Please add new items below line 216 | 15:25 |
| TheJulia | Looks like a fairly long list, but a solid number of items have merged and new items proposed | 15:29 |
| TheJulia | Any objections or concerns? | 15:30 |
| * TheJulia hears crickets | 15:30 | |
| TheJulia | I'll take that as none and that we can proceed to our discussion topic | 15:31 |
| dtantsur | I cannot object since I added half of them :) | 15:31 |
| iurygregory | ++ | 15:31 |
| TheJulia | #topic Discussion | 15:31 |
| *** openstack changes topic to "Discussion (Meeting topic: ironic)" | 15:31 | |
| *** anuradha1904 has joined #openstack-ironic | 15:31 | |
| TheJulia | We have one discussion topic this week, midcycle call. | 15:31 |
| TheJulia | Is anyone interested in having a midcycle call say in two weeks? | 15:31 |
| rloo | yes, if there are things to discuss :) | 15:32 |
| TheJulia | I think there are some, I suspect we would only need ~3 hours | 15:32 |
| TheJulia | How do others feel? | 15:32 |
| iurygregory | +1 from me | 15:32 |
| arne_wiebalck | +1 for havin a call | 15:32 |
| rpittau | let's do it :) | 15:32 |
| dtantsur | ++ | 15:33 |
| TheJulia | Awesome, I'll create a doodle and etherpad later today | 15:33 |
| TheJulia | Then I guess that leaves us at the BareMetal SIG | 15:33 |
| TheJulia | #topic Baremetal SIG | 15:33 |
| *** openstack changes topic to "Baremetal SIG (Meeting topic: ironic)" | 15:33 | |
| TheJulia | arne_wiebalck do you have anything for us? | 15:33 |
| arne_wiebalck | Meeting tomorrow at 2pm UTC | 15:33 |
| TheJulia | I guess, w/r/t midcycle, we should maybe dedicate some time to the sig as well | 15:34 |
| arne_wiebalck | tzumainn on multi-tenancy | 15:34 |
| arne_wiebalck | will be the topic tmrw | 15:34 |
| arne_wiebalck | TheJulia: sure | 15:34 |
| TheJulia | #link https://etherpad.opendev.org/p/bare-metal-sig | 15:34 |
| TheJulia | Is there anything besides that this week? | 15:34 |
| openstackgerrit | Dmitry Tantsur proposed openstack/ironic master: Common framework for configuring secure boot https://review.opendev.org/c/openstack/ironic/+/769961 | 15:34 |
| arne_wiebalck | otherwise NTR | 15:34 |
| TheJulia | Okay then! | 15:34 |
| TheJulia | Well, we have no RFEs listed | 15:35 |
| TheJulia | so off to Open Discussion we go! | 15:35 |
| TheJulia | #topic Open Discussion | 15:35 |
| *** openstack changes topic to "Open Discussion (Meeting topic: ironic)" | 15:35 | |
| rpittau | just wanted to point out that stable/v CI is broken in inspector | 15:35 |
| * TheJulia wonders if this is a record, to open discussion in 35 minutes | 15:35 | |
| openstackgerrit | Dmitry Tantsur proposed openstack/ironic master: [WIP] Switch iLO and iRMC to the new secure boot framework https://review.opendev.org/c/openstack/ironic/+/770122 | 15:35 |
| rpittau | the ironic-inspector-grenade job seems to fail consistenly | 15:35 |
| rpittau | an example here: https://review.opendev.org/c/openstack/ironic-inspector/+/767536 | 15:36 |
| rpittau | it seems the wrong kernel options are sent to ipa | 15:36 |
| rpittau | I did some troubleshooting but couldn't find a solution | 15:37 |
| rpittau | ussuri and master work just fine | 15:37 |
| iurygregory | so far I couldn't figure out a way to make it work also =( | 15:37 |
| rpittau | the reason why it'se getting wrong kernel optioin is because it's loading boot.ipxe instead of ironic-inspecto.ipxe | 15:37 |
| rpittau | as show here: https://storage.gra.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_761/767536/2/check/ironic-inspector-grenade/761e24d/controller/logs/ironic-bm-logs/node-0_no_ansi_2021-01-05-09%3A19%3A30_log.txt | 15:38 |
| TheJulia | I'm sensing I'm going to need to spend a few days on stable branches | 15:38 |
| TheJulia | If there are issues fixed in victoria, please backport them further if needed | 15:38 |
| TheJulia | rpittau: so it doesn't handle managed introspection? | 15:39 |
| rpittau | TheJulia: from what I can tell this is the only issue in Victoria, ussuri still has some interesting failures in other projects | 15:39 |
| zer0c00l | \o | 15:39 |
| TheJulia | Yeah, ussuri-> train is a bit of a disaster at the moment :( | 15:39 |
| rpittau | yep :/ | 15:39 |
| TheJulia | care and feeding of stable branches is a thing, and many cross branch issues the past few months :( | 15:40 |
| rpittau | I'll give ussuri another look this week, but for inspector in Victoria I definitely need help | 15:40 |
| TheJulia | I bet that will need to be dtantsur or myself taking a look | 15:41 |
| dtantsur | could you ping me tomorrow with all the details? | 15:41 |
| rpittau | dtantsur: will do | 15:42 |
| TheJulia | Okay then | 15:42 |
| TheJulia | Do we have anything esle to discuss this morning? Recipes to take over the world? Baked goods to cause all to deploy ironic? | 15:43 |
| rloo | crickets | 15:44 |
| rloo | baked | 15:44 |
| dtantsur | :D | 15:44 |
| TheJulia | gently roasted on a cleaning compute node? | 15:44 |
| rpittau | mmmmh crickets | 15:45 |
| TheJulia | Well everyone, Thanks for the great first meeting of the year! Now onward to taking over the world... well... taking over it even more! | 15:45 |
| iurygregory | well done for me =P | 15:45 |
| TheJulia | Have a wonderful week! | 15:45 |
| dtantsur | o/ | 15:45 |
| rpittau | thanks :) | 15:45 |
| arne_wiebalck | Thanks, TheJulia ! | 15:46 |
| iurygregory | o/ | 15:46 |
| kaifeng | thanks! | 15:46 |
| rpioso | Thank you! | 15:46 |
| TheJulia | #endmeeting | 15:47 |
| *** openstack changes topic to "Bare Metal Provisioning | Status: http://bit.ly/ironic-whiteboard | Docs: http://docs.openstack.org/ironic/ | Bugs: https://storyboard.openstack.org/#!/project_group/75 | Contributors are generally present between 6 AM and 12 AM UTC, If we do not answer, please feel free to pose questions to openstack-discuss mailing list." | 15:47 | |
| openstack | Meeting ended Mon Jan 11 15:47:21 2021 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:47 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/ironic/2021/ironic.2021-01-11-15.00.html | 15:47 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/ironic/2021/ironic.2021-01-11-15.00.txt | 15:47 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/ironic/2021/ironic.2021-01-11-15.00.log.html | 15:47 |
| *** ociuhandu has quit IRC | 16:16 | |
| *** eagereagle1 has joined #openstack-ironic | 16:22 | |
| *** ociuhandu has joined #openstack-ironic | 16:23 | |
| *** stendulker has quit IRC | 16:39 | |
| *** Qianbiao has quit IRC | 16:39 | |
| *** gyee has joined #openstack-ironic | 16:55 | |
| *** lucasagomes has quit IRC | 16:57 | |
| *** ociuhandu_ has joined #openstack-ironic | 17:02 | |
| *** ociuhandu has quit IRC | 17:05 | |
| *** ociuhandu_ has quit IRC | 17:07 | |
| rpittau | good night! o/ | 17:10 |
| *** rpittau is now known as rpittau|afk | 17:10 | |
| *** tosky has quit IRC | 17:24 | |
| *** tosky has joined #openstack-ironic | 17:25 | |
| *** dougsz has quit IRC | 17:25 | |
| dtantsur | TheJulia, lbragstad, I'm looking at https://review.opendev.org/c/openstack/ironic/+/768135/ and really puzzled that we even try to test the memcached bits | 17:26 |
| dtantsur | cannot we just stub them out completely? | 17:26 |
| openstackgerrit | Merged openstack/ironic master: Support configdrive when doing ramdisk deploy with redfish-virtual-media https://review.opendev.org/c/openstack/ironic/+/764333 | 17:29 |
| *** ociuhandu has joined #openstack-ironic | 17:36 | |
| *** openstackgerrit has quit IRC | 17:37 | |
| *** ociuhandu has quit IRC | 17:41 | |
| TheJulia | dtantsur: we need to test all the way through to the policy check itself since there is an implicit logical OR statement in oslo_policy, so the idea is to mock out memcache, let to run the check and compare, and if the result is is appropriate or as-expected. | 17:55 |
| TheJulia | hopefully that provides a little clarity on why? | 17:55 |
| *** dsneddon has joined #openstack-ironic | 17:59 | |
| *** derekh has quit IRC | 18:05 | |
| dtantsur | TheJulia: I guess I'm confusing why cannot we just check its memcache object to a fresh dict and call it a day | 18:05 |
| *** dsneddon has quit IRC | 18:08 | |
| *** kaifeng has quit IRC | 18:12 | |
| *** mgoddard has quit IRC | 18:14 | |
| *** mgoddard has joined #openstack-ironic | 18:15 | |
| TheJulia | Why would we check it though? | 18:17 |
| TheJulia | we're updating/replacing it as-necessary to run the tests based on different data | 18:17 |
| dtantsur | mm, I need to re-read the patch with a fresher head | 18:20 |
| TheJulia | no worries | 18:20 |
| TheJulia | I don't think I'm going to be doing anything to steve's two wip patches, but I'll be looking at lance's reply and trying to sift those changes in with the additional testing... maybe. Still not 100% sure of how I'm going to proceed there, just trying to piece it all together in a way that makes sense and that allows us to not break anything and expand the rbac matrix as we go. | 18:22 |
| TheJulia | FWIW, there is also a spec which proposes hyper-specifics, I'd like to nail that down as well, but it may also be a little too specific in hind sight | 18:22 |
| arne_wiebalck | bye everyone o/ | 18:24 |
| *** mgoddard has quit IRC | 18:24 | |
| *** openstackgerrit has joined #openstack-ironic | 18:33 | |
| openstackgerrit | Merged openstack/ironic master: Register all hardware_interfaces together https://review.opendev.org/c/openstack/ironic/+/764911 | 18:33 |
| openstackgerrit | Merged openstack/ironic master: Rewrite existing ACL tests with ddt, yaml https://review.opendev.org/c/openstack/ironic/+/767434 | 18:33 |
| *** dsneddon has joined #openstack-ironic | 18:38 | |
| openstackgerrit | Dmitry Tantsur proposed openstack/ironic master: Follow-up for ramdisk deploy configdrive support https://review.opendev.org/c/openstack/ironic/+/770172 | 19:03 |
| dtantsur | TheJulia: ^^^ | 19:03 |
| TheJulia | Thanks! | 19:03 |
| openstackgerrit | Dmitry Tantsur proposed openstack/ironic master: Common framework for configuring secure boot https://review.opendev.org/c/openstack/ironic/+/769961 | 19:14 |
| openstackgerrit | Dmitry Tantsur proposed openstack/ironic master: [WIP] Switch iLO and iRMC to the new secure boot framework https://review.opendev.org/c/openstack/ironic/+/770122 | 19:14 |
| *** dtantsur is now known as dtantsur|afk | 19:15 | |
| dtantsur|afk | o/ | 19:16 |
| *** gmann is now known as gmann_afk | 19:25 | |
| *** paras333 has joined #openstack-ironic | 19:30 | |
| *** tosin has quit IRC | 19:52 | |
| guilhermesp | hey there! Is there any additional parametess when cleaning nodes with nvme drivers? It looks like it is failing to run hdparm and smartctl... https://usercontent.irccloud-cdn.com/file/hTgdHxJI/MicrosoftTeams-image.png | 20:07 |
| TheJulia | guilhermesp: interesting! I've never seen that before | 20:48 |
| TheJulia | looks like we're going to need to explicitly go "oh, well, run the nvme specific commands, we'll just need to identify what | 20:52 |
| guilhermesp | TheJulia: yeah, i tried this `openstack baremetal node set ac167bb9-3278-4941-809a-2c277157947b --property root_device='{"rotational": "false"}'` based on https://docs.openstack.org/ironic/latest/install/advanced.html#specifying-the-disk-for-deployment-root-device-hints | 20:53 |
| guilhermesp | but is seems had no effect | 20:53 |
| TheJulia | Hints don't get pulled in there | 20:57 |
| guilhermesp | but yeah, i think hdparm and smartl goes good only with ata devices. Maybe cleaning up nvme devices is somthing not implemented yet? | 20:59 |
| *** ociuhandu has joined #openstack-ironic | 21:01 | |
| TheJulia | hdparm oddly works for a lot, and I even think it works on my old laptop's nvme device | 21:01 |
| *** gmann_afk is now known as gmann | 21:13 | |
| JayF | Did anyone have a desire to put a review on https://review.opendev.org/c/openstack/ironic-specs/+/748503 before it's approved? It's got +2 from me, rloo, and rpittau | 21:20 |
| JayF | (and only has one line of change since Julia +2'd last patchset) | 21:20 |
| rloo | JayF: I suspect it is good to +A. | 21:21 |
| rloo | could always update later if need be | 21:21 |
| *** hoonetorg has quit IRC | 21:22 | |
| JayF | Yeah I'll approve it before EOD for sure. Just wanted to give folks a chance to squeal first :D | 21:23 |
| TheJulia | rloo: JayF: I was going to +A it sometime this afternoon | 21:27 |
| JayF | \o/ | 21:27 |
| rloo | thx TheJulia! | 21:27 |
| TheJulia | guilhermesp: yeah, explicit nvme cleaning is not implemented. We've got someone signed up to do it, and I evenhave hardwware to test with on my desk right now | 21:28 |
| JayF | I'll note we have an example of how to write a custom hardware manager to configure disk wiping for a specific kind of disk | 21:28 |
| JayF | so if you need NVMe wiping support now, you can implement it using https://opendev.org/openstack/ironic-python-agent/src/branch/master/examples/custom-disk-erase | 21:29 |
| guilhermesp | oh, if I can help in any way to move that forward, let me know! | 21:29 |
| guilhermesp | even to help testing it | 21:29 |
| guilhermesp | i have 4 nodes available with 1 nvme each | 21:29 |
| TheJulia | guilhermesp: so one of the concerns is appropriate information or commands to erase them manually. If your able to identify make/model and appropriate command if they are different, it would be a good data point | 21:31 |
| TheJulia | guilhermesp: we've got an entry on our whiteboard that your free to add information to | 21:33 |
| guilhermesp | cool TheJulia I will try to find out and let you know | 21:33 |
| TheJulia | guilhermesp: much appreciated! | 21:34 |
| *** ociuhandu has quit IRC | 21:36 | |
| *** hoonetorg has joined #openstack-ironic | 21:40 | |
| TheJulia | lbragstad: you still around? | 21:52 |
| lbragstad | i am | 21:52 |
| lbragstad | what's up? | 21:52 |
| TheJulia | Does assigning the values to an intermediate dictionary to pass into the policy check make sense for basically 3 checks, if owner or lessee matches considering we don't have a project_id on physical hardware and it is dependent upon mode ofa ccess | 21:54 |
| lbragstad | this was on one of the patches, right? | 21:56 |
| TheJulia | yeah, let me get the link | 21:56 |
| TheJulia | https://review.opendev.org/c/openstack/ironic/+/763255/3/ironic/common/policy.py | 22:00 |
| lbragstad | TheJulia ok - i have some naive questions | 22:02 |
| lbragstad | a baremetal resource has an owner, right? | 22:02 |
| TheJulia | it *can*, it is not required to have an owner | 22:02 |
| lbragstad | ok - are owners always projects? or can they be users, too? | 22:03 |
| TheJulia | A project | 22:03 |
| lbragstad | what's the difference between an owner and a lessee? | 22:04 |
| TheJulia | a lessee is a node an owner is surrendering over to another project for use, but an owner can have that node back at any time. | 22:05 |
| lbragstad | ok - so a lessee is also always a project | 22:05 |
| TheJulia | yes | 22:05 |
| * lbragstad nods | 22:05 | |
| lbragstad | owner and lessee clearly aren't mutually exclusive, correct? | 22:07 |
| *** rcernin has joined #openstack-ironic | 22:07 | |
| TheJulia | they are not mutually exclusive | 22:08 |
| lbragstad | from a policy perspective, would you let a project admin of the owning project do more or less things than a project admin of a lessee project? | 22:09 |
| TheJulia | but the whole idea being if one doesn't have the rights, they shouldn't see the node(s) they don't have access to. | 22:09 |
| *** rcernin has quit IRC | 22:09 | |
| *** rcernin has joined #openstack-ironic | 22:11 | |
| lbragstad | i guess i'm think that if a baremetal node can be loaned to another project, then the project admin of the owning project can pull that node back and that shouldn't be something the project admin of a lessee project can do | 22:15 |
| TheJulia | project admin by definition if matching | 22:16 |
| lbragstad | TheJulia going back to your original question - can you clarify what you mean by intermediate dictionary? | 22:21 |
| TheJulia | basically what your noting on your line 57 comment https://review.opendev.org/c/openstack/ironic/+/763255/3/ironic/common/policy.py | 22:26 |
| TheJulia | just both variables added to the target dictionary | 22:26 |
| lbragstad | oh - ok | 22:27 |
| lbragstad | so my example probably doesn't work since they're not mutually exclusive | 22:27 |
| TheJulia | well, I think it would still work | 22:28 |
| lbragstad | i was trying to make it so that the policy check string was "role:admin and project_id:%(project_id)s" | 22:28 |
| lbragstad | but that would mean you can only have one value for project_id, i think? | 22:29 |
| TheJulia | yeah, that is how I interpret it | 22:29 |
| * lbragstad double checks | 22:29 | |
| lbragstad | i wonder... | 22:30 |
| lbragstad | if we can do target['project_id'] = [baremetal.owner.id, baremetal.lessee.id] | 22:31 |
| lbragstad | the context object accepts iterables and substitutes them | 22:32 |
| lbragstad | or - the policy engine accepts context attributes that are iterables and substitutes them | 22:33 |
| TheJulia | but will that imply or | 22:33 |
| TheJulia | yeah, if it subsitutes them in place, then nope | 22:33 |
| lbragstad | wouldn't that mean we could do "role:admin and project_id:%(project_id)s" and then we pass in target = {'project_id': [owner, lessee]} ? | 22:35 |
| TheJulia | it could | 22:35 |
| lbragstad | and that would all project admins of the owning project or project admins of the lessee project to pass that policy check string | 22:36 |
| TheJulia | if supported and expanded internally | 22:36 |
| lbragstad | correct - i'm basing that on an unproven assumption :) | 22:36 |
| lbragstad | otherwise - we could do "role:admin and (project_id:%(owner)s or project_id:%(lessee)s)" | 22:37 |
| lbragstad | and modify the target accordingly | 22:37 |
| tzumainn | TheJulia, hi! I asked the question kinda badly on the PR, but maybe it's worth asking here - with the proposed changes you're talking about, is there a way for a user to be an owner of one node and have PROJECT_ADMIN access, and a lessee of another node and be limited to PROJECT_MEMBER access to that second node? | 22:39 |
| *** paras333 has quit IRC | 22:41 | |
| lbragstad | i think that's possible? | 22:44 |
| lbragstad | maybe something like "(role:admin and project_id:%(owner)s) or (role:member and project_id:%(lessee)s)" | 22:45 |
| tzumainn | but for the second node - if you have the admin role, wouldn't you still match PROJECT_ADMIN? | 22:45 |
| tzumainn | if it's PROJECT_ADMIN = ('(role:admin and project_id:%(owner)s or ' | 22:45 |
| tzumainn | '(role:admin and project_id:%(lessee)') | 22:45 |
| tzumainn | or am I misunderstanding how that rule would be interpreted? | 22:46 |
| lbragstad | ok - so node 1 is owned by project foo? | 22:46 |
| tzumainn | ah, yeah - node 1 owned by project foo, so foo has the admin role | 22:47 |
| lbragstad | ok - what about node 2? | 22:47 |
| tzumainn | foo becomes the lessee of node 2; would they have PROJECT_ADMIN over node 2? | 22:47 |
| janders | good morning Ironic o/ | 22:47 |
| lbragstad | tzumainn who is the owner of node 2? | 22:48 |
| tzumainn | lbragstad, some other arbitrary project | 22:49 |
| lbragstad | ok | 22:49 |
| lbragstad | so - "(role:admin and project_id:%(owner)s)" would allow project admins for foo to manage node 1 (i think?) | 22:51 |
| tzumainn | but wouldn't (role:admin and project_id:%(lessee)s) give admins for foo PROJECT_ADMIN access to node 2 as well? | 22:52 |
| TheJulia | the intent, is not for exclusiveness, as the node needs to be able to be reclaimed | 22:53 |
| lbragstad | yes - i believe so | 22:53 |
| lbragstad | i may need to look at some of the policies and where they're invoked in ironic to get a better picture | 22:55 |
| lbragstad | but i get the feeling something isn't granular enough if we're hitting this | 22:55 |
| TheJulia | I'm not sure text based chat is helping us in this right now | 22:55 |
| tzumainn | haha, perhaps not :) | 22:55 |
| TheJulia | oslo.policy, maybe? | 22:55 |
| TheJulia | but at the same time, very very few are experts in it | 22:56 |
| TheJulia | this is also not cloudy given it is a physical resource | 22:56 |
| TheJulia | so it is harder since its not an ephemeral single thing | 22:56 |
| lbragstad | maybe restrict it to system administrators and open it to project administrators later? | 22:57 |
| *** tkajinam has joined #openstack-ironic | 22:57 | |
| tzumainn | or would it be possible to have PROJECT_ADMIN just be 'role:admin and project_id:%(owner)s`, while PROJECT_MEMBER be `role:member and project_id:%(lessee)s`? | 22:57 |
| TheJulia | I suspect that is going to be the pattern anyway, but we need to see the path before us to chart a course | 22:58 |
| TheJulia | I'd prefer to try and avoid that because members in projects shouldn't be granted any level of admin rights | 22:58 |
| tzumainn | wouldn't members be restricted to PROJECT_MEMBER with my suggestion? | 22:59 |
| lbragstad | i have to run, but i'll read scroll back a little later tonight | 22:59 |
| tzumainn | oh, I guess it means that they couldn't be an admin for their project, which might be needed for other projects | 23:00 |
| TheJulia | https://review.opendev.org/c/openstack/ironic-specs/+/764070 is where that really needs to be settled | 23:00 |
| tzumainn | er, for other openstack services | 23:00 |
| tzumainn | okay, I'll add some comments there! | 23:02 |
| TheJulia | okay | 23:30 |
| * TheJulia orders groceries and goes to exercise | 23:30 | |
| *** rcernin_ has joined #openstack-ironic | 23:54 | |
| *** rcernin has quit IRC | 23:55 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!
