*** pmannidi|brb is now known as pmannidi | 00:09 | |
stevebaker | janders: good noon | 00:22 |
---|---|---|
janders | hey stevebaker :) | 00:23 |
*** pmannidi is now known as pmannidi|AFK | 00:47 | |
*** pmannidi|AFK is now known as pmannidi | 00:47 | |
opendevreview | Jacob Anders proposed openstack/sushy master: Change defaults - optional insert_media attributes https://review.opendev.org/c/openstack/sushy/+/802452 | 01:05 |
opendevreview | Jacob Anders proposed openstack/sushy master: Change defaults - optional insert_media attributes https://review.opendev.org/c/openstack/sushy/+/802452 | 01:16 |
opendevreview | Jacob Anders proposed openstack/sushy master: Change defaults - optional insert_media attributes https://review.opendev.org/c/openstack/sushy/+/802452 | 05:09 |
opendevreview | Jacob Anders proposed openstack/ironic master: Remove hardcoded parameters from insert_media call https://review.opendev.org/c/openstack/ironic/+/802643 | 05:14 |
iurygregory | good morning Ironic, happy friday | 06:21 |
arne_wiebalck | Good morning iurygregory and Ironic! | 06:27 |
iurygregory | morning arne_wiebalck o/ | 06:27 |
*** pmannidi is now known as pmannidi|AFK | 06:43 | |
*** rpittau|afk is now known as rpittau | 07:38 | |
rpittau | gooooood morning ironic! Happy Friday! o/ | 07:38 |
rpittau | I like constraints shenaningans https://zuul.opendev.org/t/openstack/build/1ec156a09a9e43c2bafe0bc7a05212f4 | 07:40 |
* rpittau rephrase | 07:40 | |
rpittau | "I love the smell of constraints shenanigans in the morning" | 07:41 |
iurygregory | good morning rpittau o/ | 07:43 |
cenne | Happy Friday rpittau. | 07:43 |
rpittau | hey iurygregory cenne :) | 07:44 |
cenne | Good mornings iurygregory, arne_wiebalck , ironic! | 07:44 |
iurygregory | ops seems like we have a monday problem in CI again :D | 07:44 |
iurygregory | morning cenne o/ | 07:44 |
cenne | hey o/ | 07:44 |
arne_wiebalck | hey cenne and rpittau o/ | 07:44 |
rpittau | hey arne_wiebalck :) | 07:44 |
rpittau | iurygregory: monday CI problem on friday is the worst | 07:45 |
iurygregory | rpittau, exactly! | 07:49 |
rpittau | mmmmm I have the terrible suspect that the resolver is broken in pip | 08:01 |
iurygregory | new version in use? | 08:01 |
rpittau | yeah | 08:03 |
iurygregory | don't release on fridays... | 08:03 |
iurygregory | (they probably did yesterday? :D) | 08:03 |
rpittau | not sure :) | 08:04 |
rpittau | but I think they've uncapped pip in devstack recentyl | 08:04 |
iurygregory | OGW D: | 08:04 |
rpittau | yep they did | 08:05 |
iurygregory | \o/ | 08:06 |
iurygregory | https://media.giphy.com/media/9M5jK4GXmD5o1irGrF/giphy.gif | 08:07 |
rpittau | :) | 08:19 |
rpittau | we do really abuse that gif :D | 08:20 |
opendevreview | Riccardo Pittau proposed openstack/sushy-tools master: Add lower-constraints job to current development branch https://review.opendev.org/c/openstack/sushy-tools/+/804376 | 08:39 |
dtantsur | morning ironic | 09:28 |
rpittau | hey dtantsur :) | 09:28 |
iurygregory | morning dtantsur | 09:32 |
janders | hey iurygregory arne_wiebalck rpittau cenne dtantsur and Ironic o/ | 09:36 |
rpittau | hey janders :) | 09:36 |
arne_wiebalck | hey janders o/ | 09:36 |
iurygregory | hey janders o/ | 09:36 |
janders | further to the unfinished sushy/vmedia discusion yesterday | 09:42 |
janders | what do you think about this: https://review.opendev.org/c/openstack/sushy/+/802452/13/sushy/resources/manager/virtual_media.py | 09:43 |
janders | It's an attempt to have insert_media have Inserted=None and WriteProtected=None by defaults, without breaking PATCH method, which needs Inserted=True (I kept WriteProtected=True as well for the sake of least change) | 09:44 |
janders | it's convoluted but seems to make sense... what do you guys think? | 09:44 |
dtantsur | janders: looks correct to me | 09:45 |
janders | there is an Ironic change to match: https://review.opendev.org/c/openstack/ironic/+/802643/5/ironic/drivers/modules/redfish/boot.py | 09:45 |
janders | thank you dtantsur! :) | 09:46 |
janders | rpittau you raised valid concerns last time we were discussing this (but then we needed this to be backportable too). What do you think about this? | 09:47 |
rpittau | janders: so the "default" for WriteProtected is actually going to change to True | 09:47 |
rpittau | for PATCH I mean | 09:48 |
janders | if we look at it in the Ironic context, theoretically yes, practically no (cause Ironic used to pass True,True) | 09:49 |
dtantsur | maybe we shouldn't send WriteProtected by default? Could we confirm that it's required? | 09:49 |
iurygregory | in lenovo docs I couldnt find saying its required | 09:49 |
rpittau | janders: yeah, if it's called by ironic | 09:49 |
iurygregory | but Inserted is | 09:49 |
janders | dtantsur: I do not believe it is (although we don't have hardware to test, but we can ask other contributors) | 09:49 |
rpittau | I agree we should double-check WriteProtected | 09:49 |
janders | my thinking was if we always had it set to True, we might keep this behavior (principle of least change) | 09:50 |
janders | especially given this is a bit of a hack anyway (forcing it into the payload for PATCH) | 09:50 |
dtantsur | on the other hand, we risk hitting hardware that does not have WriteProtected | 09:50 |
iurygregory | oh wait in the restapi book they have WriteProtected | 09:50 |
iurygregory | https://sysmgt.lenovofiles.com/help/topic/com.lenovo.systems.management.xcc.restapi.doc/xcc_restapi_book.pdf | 09:50 |
janders | yeah I'm really in two minds about this | 09:51 |
janders | based on the doc (thanks iurygregory) I think it will be fine on Lenovo | 09:52 |
janders | but | 09:52 |
janders | question by dtantsur is valid too | 09:52 |
iurygregory | yeah | 09:52 |
iurygregory | if some hardware uses PATCH but doesn't support WriteProtected (or doesn't like if the information is on the payload) | 09:52 |
janders | I kind of feel that things may go wrong either way, but if no one complained about Inserted=True, WriteProtected=True in PATCH maybe it would be the safest to leave it that way? | 09:53 |
rpittau | probably it's safER to leave WriteProtected | 09:53 |
rpittau | janders: I was thinking the smae :) | 09:53 |
rpittau | same* | 09:54 |
rpittau | well, I think I'm ok with that | 09:54 |
janders | dtantsur - what do you think? Have we managed to convince you a little to leave PATCH/WriteProtected=True or not really? :) | 09:55 |
rpittau | janders: maybe add a unit test for the default values ? | 09:56 |
rpittau | if it's not there yet | 09:56 |
janders | yeah I need to tweak tests a bit more | 09:56 |
janders | for now I just made them pass without doing anything too outrageous | 09:56 |
janders | but the entire approach will need to change with the move to None,None, otherwise they are not really testing things in a reality-like way | 09:57 |
rpittau | yeah | 09:57 |
janders | (should be trivial changes though) | 09:57 |
janders | I just didnt want to do it before we decide on the direction | 09:58 |
dtantsur | neither option is safer | 10:04 |
dtantsur | both options imply a change in the defaults of sushy | 10:05 |
dtantsur | and the goal of this change is to stop providing the defaults in ironic, so I'm not sure what we're gaining | 10:05 |
janders | (sorry was away for dinner, back now) | 10:32 |
janders | dtantsur - would you like me to change the patch so that we are not sending WriteProtected=True if no value is provided? | 10:32 |
dtantsur | in the end I don't care too much | 10:37 |
dtantsur | if you think it's safer to send it - go for it | 10:37 |
janders | OK! thank you dtantsur | 10:38 |
janders | rpittau w/r/t changes to test, would it be sufficient if I modify the test_insert_media_rf_default only (https://opendev.org/openstack/sushy/src/branch/master/sushy/tests/unit/resources/manager/test_virtual_media.py#L96) or do you think it needs more than this? | 10:48 |
janders | (I am thinking passing just the image (drop the two bools) and making sure that is all we get in the payload | 10:48 |
rpittau | janders: yep, that hsould be neough | 10:49 |
janders | rpittau great, thank you, I will update the change | 10:49 |
opendevreview | Jacob Anders proposed openstack/sushy master: Change defaults - optional insert_media attributes https://review.opendev.org/c/openstack/sushy/+/802452 | 10:50 |
janders | allright - let's see if CI is happy with this, meanwhile I will pack up the 4WD for yet another trip on the weekend | 10:51 |
janders | back in 30-60min | 10:51 |
rpittau | my keyboard dyslexia is getting worse and worse as I'm getting hungrier | 10:51 |
janders | hah I get that too | 10:51 |
opendevreview | Dmitry Tantsur proposed openstack/sushy master: Support credentials for VirtualMedia URI https://review.opendev.org/c/openstack/sushy/+/805367 | 11:53 |
dtantsur | going to have a merge conflict ^^ | 11:53 |
opendevreview | Merged openstack/networking-baremetal master: Add lower-constraints job to current development branch https://review.opendev.org/c/openstack/networking-baremetal/+/803933 | 12:50 |
janders | https://review.opendev.org/c/openstack/sushy/+/802452 passed CI (with updated tests) - when you have time I'd welcome reviews | 12:50 |
janders | see you on Monday Ironic, have a great weekend everyone o/ | 12:52 |
rpittau | thanks janders, you too :) | 13:04 |
TheJulia | good morning | 13:06 |
iurygregory | good morning TheJulia =) | 13:07 |
TheJulia | How is everyone doing this morning? | 13:07 |
iurygregory | it's friday \o/ | 13:08 |
TheJulia | Indeed | 13:09 |
* TheJulia brews coffee as there are emails to read/reply to | 13:09 | |
rpittau | good morning TheJulia :) | 13:14 |
dtantsur | good morning TheJulia | 13:24 |
* TheJulia caffinates | 13:24 | |
TheJulia | \o/ email thread I was dreading yesterday but didn't have time to read resolved itself \o/ | 13:25 |
opendevreview | Arne Wiebalck proposed openstack/ironic master: [doc] Update power sync documentation https://review.opendev.org/c/openstack/ironic/+/805168 | 13:28 |
opendevreview | Merged openstack/ironic master: Make curl in DevStack Bypass Proxy https://review.opendev.org/c/openstack/ironic/+/804201 | 13:29 |
arne_wiebalck | TheJulia: procrastination-driven problem solving :-D | 13:31 |
arne_wiebalck | dtantsur: I removed the defaults on https://review.opendev.org/c/openstack/ironic/+/805168 | 13:32 |
dtantsur | k thx | 13:32 |
dtantsur | I'm trying to come to terms with the fact that all hardware vendors update TLS certificates differently via Redfish (if at all) | 13:32 |
dtantsur | and neither of the ways is even remotely obvious... | 13:34 |
dtantsur | mraineri: hi! is there a developer-friendly documentation on how I replace/add a TLS certificate for Redfish API via Redfish itself? | 13:35 |
* arne_wiebalck goes and looks for the xkcd standards cartoon | 13:35 | |
dtantsur | and, well, not only for Redfish API, also for virtual media and other stuff | 13:35 |
dtantsur | (assuming vendors will ever validate certificates for virtual media) | 13:36 |
TheJulia | arne_wiebalck: A wise choice ;) | 13:38 |
iurygregory | arne_wiebalck, https://xkcd.com/927/ =) | 13:43 |
arne_wiebalck | iurygregory: yep, that one :-D | 13:44 |
iurygregory | I just found this one https://xkcd.com/930/large/ | 13:45 |
TheJulia | arne_wiebalck: it was not as much procrastination, but a long thread and I was slammed with issues/items requiring attention | 13:46 |
arne_wiebalck | TheJulia dtantsur there are two more simple changes for related to power syncing if you want to have a look: https://review.opendev.org/c/openstack/ironic/+/801425 https://review.opendev.org/c/openstack/puppet-ironic/+/805357 | 13:47 |
mraineri | dtantsur: we do have a certificate management white paper; it doesn't specifically call out the Redfish HTTPS certificate, but gives the general workflows for replacing any sort of certificate | 13:47 |
dtantsur | mraineri: a link handy? | 13:47 |
mraineri | https://www.dmtf.org/sites/default/files/standards/documents/DSP2059_1.0.0.pdf | 13:47 |
mraineri | Would certainly like the eyes of others on it if things are not clear | 13:47 |
dtantsur | thank you, reading! | 13:48 |
arne_wiebalck | TheJulia: yeah, my proposed book title/cover did not fully fit to your case ... :-) | 13:48 |
TheJulia | Oh, I look forward to reading this book | 13:48 |
arne_wiebalck | TheJulia: I only do covers. | 13:48 |
TheJulia | arne_wiebalck: lolz | 13:48 |
TheJulia | arne_wiebalck: since you do book covers how bleak is the "a whole generation in the US will never be able to retire" book cover? | 13:49 |
* dtantsur requests an ironic comics | 13:50 | |
TheJulia | "You did what with how many bare metal machines?!" | 13:50 |
TheJulia | "And you did it for SCIENCE!? Awesome!" | 13:50 |
arne_wiebalck | TheJulia: who wants to retire if working on Ironic? | 13:51 |
TheJulia | I wasn't thinking about ironic | 13:51 |
* TheJulia tries to wake up and is failing | 13:54 | |
dtantsur | "3.1.4. Install a certificate" bingo! | 13:55 |
rpittau | Bye everyone, have a great weekend! o/ | 13:55 |
iurygregory | bye rpittau o/ | 13:55 |
TheJulia | dtantsur: can you put that in the form of an animated gif? | 13:55 |
*** rpittau is now known as rpittau|afk | 13:55 | |
dtantsur | TheJulia: right in the sushy repo? :D | 13:55 |
TheJulia | I was thinking in IRC | 13:55 |
* TheJulia should get some more coffee and prepare to go drop off the car at the mechanic... and then maybe work on something good today | 13:57 | |
dtantsur | mraineri: it's much clearer now, thank you! I only need to understand why the Dell machine I have here pretends it has 0 HTTP certificates :) | 13:57 |
dtantsur | which means, I don't know what happens if I try replacing the cert on it | 13:57 |
dtantsur | or even: I cannot replace the certificate that is not in Redfish. | 13:58 |
arne_wiebalck | TheJulia: ... and skip the news maybe for a day or so ... too depressing atm. | 13:58 |
TheJulia | dtantsur: this seems to be along the lines of certificate replacements https://www.youtube.com/watch?v=FUVj61gruwg | 13:59 |
dtantsur | now the "fun" part: neither supermicro nor openbmc seems compatible with the standard | 13:59 |
TheJulia | arne_wiebalck: yeah. ugh | 13:59 |
iurygregory | <insert not surprised gif here> | 13:59 |
mraineri | dtantsur: Ick! There should be at least ONE certificate... | 14:00 |
dtantsur | mraineri: https://paste.opendev.org/show/808220/ | 14:00 |
mraineri | That seems broken... At least the systems I have available show 1 certificate in that collection | 14:01 |
* TheJulia needs to go dig through policy docs first() today :( | 14:01 | |
dtantsur | le sigh | 14:01 |
mraineri | At least the document I gave you is helping :) | 14:01 |
mraineri | I'm also fairly up to date firmware-wise; do you have the firmware version of your iDRAC handy? | 14:02 |
dtantsur | lemme check.. I'm using someone's (bfournie?) Dell, so I cannot really try things on it, only read :) | 14:02 |
dtantsur | mraineri: 4.22.00.00 | 14:03 |
mraineri | Hmmm, that's not too old... I've certainly done some certificate stuff on the version (but I don't remember the contents of the HTTPS certificate collection though) | 14:04 |
iurygregory | dtantsur, I think i have one dell with the latest FW if you want access | 14:04 |
dtantsur | iurygregory: could you PM me the credentials? I only need to read a few things (for now) | 14:04 |
iurygregory | dtantsur, sure 1min | 14:04 |
dtantsur | aha, the only iurygregory just gave me does have a certificate there! | 14:06 |
iurygregory | \o/ | 14:07 |
dtantsur | okay, this part is clear | 14:08 |
dtantsur | now I wonder if any vendors care about certificates when accessing virtual media URLs | 14:08 |
dtantsur | mraineri: do you know if there is any official guidance re ^^ | 14:08 |
mraineri | Generally I haven't seen anyone have explicit checks internally; there have been additional certificate collections added to various resources over time for letting users configure certificate checking as needed | 14:10 |
mraineri | For example, in VirtualMedia, we added a "Certificates" property to contain the server certificates for the server hosting the image | 14:10 |
mraineri | And an additional "VerifyCertificates" property to enable that checking; so, if set to true, the service is required to verify the certificate of the server hosting the image | 14:11 |
dtantsur | oh! | 14:11 |
dtantsur | mraineri: which version of VirtualMedia was it? | 14:11 |
mraineri | It would probably be good to add that to the white paper for how to use these collections... The scope and capability of these things has been growing over time | 14:11 |
mraineri | 1.4.0 | 14:11 |
mraineri | It was published fairly recently | 14:12 |
dtantsur | ah, right, I was looking at 1.3.2 | 14:12 |
mraineri | So, I wouldn't expect much support yet | 14:12 |
dtantsur | yeah, Iury's iDRAC has 1.3.2 | 14:12 |
dtantsur | mraineri: please fix: the schema doesn't specify the default of VerifyCertificate | 14:14 |
dtantsur | I assume false in case of Redfish, which is not a commonly used default for this purpose | 14:14 |
mraineri | You mean what the behavior is if not present? | 14:14 |
dtantsur | yep | 14:15 |
mraineri | Okay, I can have that clarified | 14:15 |
mraineri | Certainly is "false" if not present | 14:15 |
dtantsur | I remember some version stated that Inserted defaults to true, I don't see it in 1.4.0 | 14:16 |
mraineri | That's just for the parameter in the action "InsertMedia" | 14:16 |
dtantsur | ah, right | 14:16 |
mraineri | It's not in the property since the property simply exists | 14:16 |
dtantsur | hmmm | 14:16 |
mraineri | And you can read it prior to PATCHing | 14:16 |
dtantsur | can I configure TLS certificates before attaching a media? | 14:17 |
mraineri | Yes | 14:17 |
dtantsur | in other words: are certificates persistent across insert/eject events? | 14:17 |
mraineri | That's what we'd generally expect to happen; 1) set up the necessary certificates on the media instance, 2) insert the media | 14:17 |
mraineri | I would expect it to be; could certainly clarify that | 14:17 |
dtantsur | okay, thanks! | 14:18 |
mraineri | Or at least ask around if others agree | 14:18 |
dtantsur | I'd especially like a consensus on what the default of VerifyCertificates is | 14:18 |
mraineri | I certainly don't like the idea of the certificates vanishing after ejecting the media :) | 14:18 |
dtantsur | because there is a desire in OpenShift to start using TLS for virtual media storage | 14:18 |
mraineri | I would assume most vendors implement it as "false", and require clients to come in and set it to "true" if needed | 14:19 |
mraineri | Otherwise it would put a burden on existing clients that aren't aware of setting certificates of the resource to turn off the flag | 14:19 |
dtantsur | yep, this is exactly my point | 14:20 |
dtantsur | okay, thanks again! This clarified a lot. | 14:20 |
mraineri | No problem | 14:20 |
dtantsur | mraineri: any plans to update the published mock-ups with 1.4.0? | 14:33 |
dtantsur | btw looking at https://redfish.dmtf.org/redfish/mockups/v1/1049#Managers--BMC--VirtualMedia--CD1, I don't think it's valid :) it has no scheme in Image and no TransferProtocol set | 14:33 |
opendevreview | Dmitry Tantsur proposed openstack/ironic-lib master: Drop an explicit requirement of oslo.log https://review.opendev.org/c/openstack/ironic-lib/+/805406 | 15:13 |
mraineri | dtantsur: nothing firm, but I can raise that too | 15:19 |
arne_wiebalck | Bye everyone, have a good weekend o/ | 15:48 |
opendevreview | Aija Jauntēva proposed openstack/ironic master: Fix iDRAC import configuration missing task handling https://review.opendev.org/c/openstack/ironic/+/805428 | 15:59 |
opendevreview | Aija Jauntēva proposed openstack/ironic master: Fix iDRAC import configuration job with errors https://review.opendev.org/c/openstack/ironic/+/805431 | 16:00 |
opendevreview | Takashi Kajinami proposed openstack/ironic stable/train: Fix "is not" used to compare strings https://review.opendev.org/c/openstack/ironic/+/805434 | 16:13 |
opendevreview | Takashi Kajinami proposed openstack/ironic stable/train: Fix "is not" used to compare strings https://review.opendev.org/c/openstack/ironic/+/805434 | 16:16 |
opendevreview | Takashi Kajinami proposed openstack/ironic master: rfc3986: Replace deprecated URIReference.is_valid https://review.opendev.org/c/openstack/ironic/+/805440 | 16:49 |
dtantsur | have a nice weekend folks! | 17:26 |
opendevreview | Takashi Kajinami proposed openstack/ironic-inspector master: Update parameters for authtoken middleware https://review.opendev.org/c/openstack/ironic-inspector/+/805443 | 17:40 |
*** mgoddard- is now known as mgoddard | 17:43 | |
NobodyCam | good afternoon Ironic folks | 20:11 |
opendevreview | Julia Kreger proposed openstack/ironic master: Revert "Allow reboot to hard disk following iso ramdisk deploy." https://review.opendev.org/c/openstack/ironic/+/805284 | 20:16 |
iurygregory | good afternoon NobodyCam | 20:30 |
NobodyCam | :) howdy happy Friday! | 20:30 |
NobodyCam | arne_wiebalck: around? | 21:09 |
opendevreview | Merged openstack/sushy-tools master: Add lower-constraints job to current development branch https://review.opendev.org/c/openstack/sushy-tools/+/804376 | 21:12 |
TheJulia | NobodyCam: good afternoon | 21:25 |
TheJulia | NobodyCam: he left a couple hours ago, anything I can provide insight on? | 21:25 |
NobodyCam | :) top of the afternoon TheJulia | 21:25 |
opendevreview | Merged openstack/bifrost stable/wallaby: Improve main function https://review.opendev.org/c/openstack/bifrost/+/803833 | 21:26 |
NobodyCam | oh I was going to let him know I believe I found a check that (seemingly) works for Ironic node deployment readiness | 21:26 |
TheJulia | oh?! | 21:26 |
NobodyCam | openstack hypervisor show <NODEUUID> -c disk_available_least -f value > 0 | 21:27 |
TheJulia | doesn't that wait until resource tracker is updated? | 21:28 |
opendevreview | Merged openstack/bifrost stable/wallaby: Fix Redeploy Playbook https://review.opendev.org/c/openstack/bifrost/+/800379 | 21:29 |
opendevreview | Merged openstack/bifrost master: Changes made to install documentation https://review.opendev.org/c/openstack/bifrost/+/804548 | 21:29 |
NobodyCam | looks it | 21:33 |
TheJulia | looks like it? | 21:33 |
TheJulia | so would just cut down on I guess the placement overhead? | 21:33 |
opendevreview | Merged openstack/python-ironicclient master: Add lower-constraints job to current development branch https://review.opendev.org/c/openstack/python-ironicclient/+/804374 | 21:36 |
NobodyCam | yea, I've been unsuccessfully checking ironic status and resource placement records, but adding the hypervisor check is working in my test bed.. | 21:42 |
TheJulia | I guess it feels liike it shouldn't be that way | 21:43 |
TheJulia | but... I don't know the nova mechanics overhead | 21:43 |
NobodyCam | I'm just happy to have something that works | 21:43 |
TheJulia | ++ | 21:44 |
opendevreview | Merged openstack/networking-generic-switch master: Add lower-constraints job to current development branch https://review.opendev.org/c/openstack/networking-generic-switch/+/803939 | 22:14 |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!