Friday, 2021-08-20

*** pmannidi|brb is now known as pmannidi00:09
stevebakerjanders: good noon00:22
jandershey stevebaker :)00:23
*** pmannidi is now known as pmannidi|AFK00:47
*** pmannidi|AFK is now known as pmannidi00:47
opendevreviewJacob Anders proposed openstack/sushy master: Change defaults - optional insert_media attributes  https://review.opendev.org/c/openstack/sushy/+/80245201:05
opendevreviewJacob Anders proposed openstack/sushy master: Change defaults - optional insert_media attributes  https://review.opendev.org/c/openstack/sushy/+/80245201:16
opendevreviewJacob Anders proposed openstack/sushy master: Change defaults - optional insert_media attributes  https://review.opendev.org/c/openstack/sushy/+/80245205:09
opendevreviewJacob Anders proposed openstack/ironic master: Remove hardcoded parameters from insert_media call  https://review.opendev.org/c/openstack/ironic/+/80264305:14
iurygregorygood morning Ironic, happy friday06:21
arne_wiebalckGood morning iurygregory and Ironic!06:27
iurygregorymorning arne_wiebalck o/06:27
*** pmannidi is now known as pmannidi|AFK06:43
*** rpittau|afk is now known as rpittau07:38
rpittaugooooood morning ironic! Happy Friday! o/07:38
rpittauI like constraints shenaningans https://zuul.opendev.org/t/openstack/build/1ec156a09a9e43c2bafe0bc7a05212f407:40
* rpittau rephrase07:40
rpittau"I love the smell of constraints shenanigans in the morning"07:41
iurygregorygood morning rpittau o/07:43
cenneHappy Friday rpittau. 07:43
rpittauhey iurygregory cenne :)07:44
cenneGood mornings iurygregory, arne_wiebalck , ironic!07:44
iurygregoryops seems like we have a monday problem in CI again :D07:44
iurygregorymorning cenne o/07:44
cennehey o/07:44
arne_wiebalckhey cenne and rpittau o/07:44
rpittauhey arne_wiebalck :)07:44
rpittauiurygregory: monday CI problem on friday is the worst07:45
iurygregoryrpittau, exactly!07:49
rpittaummmmm I have the terrible suspect that the  resolver is broken in pip08:01
iurygregorynew version in use?08:01
rpittauyeah08:03
iurygregorydon't release on fridays...08:03
iurygregory(they probably did yesterday? :D)08:03
rpittaunot sure :)08:04
rpittaubut I think they've uncapped pip in devstack recentyl08:04
iurygregoryOGW D:08:04
rpittauyep  they did08:05
iurygregory\o/08:06
iurygregoryhttps://media.giphy.com/media/9M5jK4GXmD5o1irGrF/giphy.gif08:07
rpittau:)08:19
rpittauwe do really abuse that gif :D08:20
opendevreviewRiccardo Pittau proposed openstack/sushy-tools master: Add lower-constraints job to current development branch  https://review.opendev.org/c/openstack/sushy-tools/+/80437608:39
dtantsurmorning ironic09:28
rpittauhey dtantsur :)09:28
iurygregorymorning dtantsur 09:32
jandershey iurygregory arne_wiebalck rpittau cenne dtantsur and Ironic o/09:36
rpittauhey janders :)09:36
arne_wiebalckhey janders o/09:36
iurygregoryhey janders o/09:36
jandersfurther to the unfinished sushy/vmedia discusion yesterday09:42
janderswhat do you think about this: https://review.opendev.org/c/openstack/sushy/+/802452/13/sushy/resources/manager/virtual_media.py09:43
jandersIt's an attempt to have insert_media have Inserted=None and WriteProtected=None by defaults, without breaking PATCH method, which needs Inserted=True (I kept WriteProtected=True as well for the sake of least change)09:44
jandersit's convoluted but seems to make sense... what do you guys think?09:44
dtantsurjanders: looks correct to me09:45
jandersthere is an Ironic change to match: https://review.opendev.org/c/openstack/ironic/+/802643/5/ironic/drivers/modules/redfish/boot.py09:45
jandersthank you dtantsur! :)09:46
jandersrpittau you raised valid concerns last time we were discussing this (but then we needed this to be backportable too). What do you think about this?09:47
rpittaujanders: so the "default" for WriteProtected is actually going to change to True09:47
rpittaufor PATCH I mean09:48
jandersif we look at it in the Ironic context, theoretically yes, practically no (cause Ironic used to pass True,True)09:49
dtantsurmaybe we shouldn't send WriteProtected by default? Could we confirm that it's required?09:49
iurygregoryin lenovo docs I couldnt find saying its required09:49
rpittaujanders: yeah, if it's called by ironic09:49
iurygregorybut Inserted is09:49
jandersdtantsur: I do not believe it is (although we don't have hardware to test, but we can ask other contributors)09:49
rpittauI agree we should double-check WriteProtected09:49
jandersmy thinking was if we always had it set to True, we might keep this behavior (principle of least change)09:50
jandersespecially given this is a bit of a hack anyway (forcing it into the payload for PATCH)09:50
dtantsuron the other hand, we risk hitting hardware that does not have WriteProtected09:50
iurygregoryoh wait in the restapi book they have WriteProtected09:50
iurygregoryhttps://sysmgt.lenovofiles.com/help/topic/com.lenovo.systems.management.xcc.restapi.doc/xcc_restapi_book.pdf09:50
jandersyeah I'm really in two minds about this09:51
jandersbased on the doc (thanks iurygregory) I think it will be fine on Lenovo09:52
jandersbut09:52
jandersquestion by dtantsur is valid too09:52
iurygregoryyeah09:52
iurygregoryif some hardware uses PATCH but doesn't support WriteProtected (or doesn't like if the information is on the payload)09:52
jandersI kind of feel that things may go wrong either way, but if no one complained about Inserted=True, WriteProtected=True in PATCH maybe it would be the safest to leave it that way?09:53
rpittauprobably it's safER to leave WriteProtected09:53
rpittaujanders: I was thinking the smae :)09:53
rpittausame*09:54
rpittauwell, I think I'm ok with that09:54
jandersdtantsur - what do you think? Have we managed to convince you a little to leave PATCH/WriteProtected=True or not really? :)09:55
rpittaujanders: maybe add a unit test for the default values ?09:56
rpittauif it's not there yet09:56
jandersyeah I need to tweak tests a bit more09:56
jandersfor now I just made them pass without doing anything too outrageous 09:56
jandersbut the entire approach will need to change with the move to None,None, otherwise they are not really testing things in a reality-like way09:57
rpittauyeah09:57
janders(should be trivial changes though)09:57
jandersI just didnt want to do it before we decide on the direction09:58
dtantsurneither option is safer10:04
dtantsurboth options imply a change in the defaults of sushy10:05
dtantsurand the goal of this change is to stop providing the defaults in ironic, so I'm not sure what we're gaining10:05
janders(sorry was away for dinner, back now)10:32
jandersdtantsur - would you like me to change the patch so that we are not sending WriteProtected=True if no value is provided?10:32
dtantsurin the end I don't care too much10:37
dtantsurif you think it's safer to send it - go for it10:37
jandersOK! thank you dtantsur 10:38
jandersrpittau w/r/t changes to test, would it be sufficient if I modify the test_insert_media_rf_default only (https://opendev.org/openstack/sushy/src/branch/master/sushy/tests/unit/resources/manager/test_virtual_media.py#L96) or do you think it needs more than this?10:48
janders(I am thinking passing just the image (drop the two bools) and making sure that is all we get in the payload10:48
rpittaujanders: yep, that hsould be neough10:49
jandersrpittau great, thank you, I will update the change10:49
opendevreviewJacob Anders proposed openstack/sushy master: Change defaults - optional insert_media attributes  https://review.opendev.org/c/openstack/sushy/+/80245210:50
jandersallright - let's see if CI is happy with this, meanwhile I will pack up the 4WD for yet another trip on the weekend10:51
jandersback in 30-60min10:51
rpittaumy keyboard dyslexia is getting worse  and worse as I'm getting hungrier10:51
jandershah I get that too10:51
opendevreviewDmitry Tantsur proposed openstack/sushy master: Support credentials for VirtualMedia URI  https://review.opendev.org/c/openstack/sushy/+/80536711:53
dtantsurgoing to have a merge conflict ^^11:53
opendevreviewMerged openstack/networking-baremetal master: Add lower-constraints job to current development branch  https://review.opendev.org/c/openstack/networking-baremetal/+/80393312:50
jandershttps://review.opendev.org/c/openstack/sushy/+/802452 passed CI (with updated tests) - when you have time I'd welcome reviews12:50
janderssee you on Monday Ironic, have a great weekend everyone o/12:52
rpittauthanks janders, you too :)13:04
TheJuliagood morning13:06
iurygregorygood morning TheJulia =)13:07
TheJuliaHow is everyone doing this morning?13:07
iurygregoryit's friday \o/13:08
TheJuliaIndeed13:09
* TheJulia brews coffee as there are emails to read/reply to13:09
rpittaugood morning TheJulia :)13:14
dtantsurgood morning TheJulia 13:24
* TheJulia caffinates13:24
TheJulia\o/ email thread I was dreading yesterday but didn't have time to read resolved itself \o/13:25
opendevreviewArne Wiebalck proposed openstack/ironic master: [doc] Update power sync documentation  https://review.opendev.org/c/openstack/ironic/+/80516813:28
opendevreviewMerged openstack/ironic master: Make curl in DevStack Bypass Proxy  https://review.opendev.org/c/openstack/ironic/+/80420113:29
arne_wiebalckTheJulia: procrastination-driven problem solving :-D13:31
arne_wiebalckdtantsur: I removed the defaults on https://review.opendev.org/c/openstack/ironic/+/80516813:32
dtantsurk thx13:32
dtantsurI'm trying to come to terms with the fact that all hardware vendors update TLS certificates differently via Redfish (if at all)13:32
dtantsurand neither of the ways is even remotely obvious...13:34
dtantsurmraineri: hi! is there a developer-friendly documentation on how I replace/add a TLS certificate for Redfish API via Redfish itself?13:35
* arne_wiebalck goes and looks for the xkcd standards cartoon13:35
dtantsurand, well, not only for Redfish API, also for virtual media and other stuff13:35
dtantsur(assuming vendors will ever validate certificates for virtual media)13:36
TheJuliaarne_wiebalck: A wise choice ;)13:38
iurygregoryarne_wiebalck, https://xkcd.com/927/ =)13:43
arne_wiebalckiurygregory: yep, that one :-D13:44
iurygregoryI just found this one https://xkcd.com/930/large/ 13:45
TheJuliaarne_wiebalck: it was not as much procrastination, but a long thread and I was slammed with issues/items requiring attention13:46
arne_wiebalckTheJulia dtantsur there are two more simple changes for related to power syncing if you want to have a look: https://review.opendev.org/c/openstack/ironic/+/801425 https://review.opendev.org/c/openstack/puppet-ironic/+/80535713:47
mraineridtantsur: we do have a certificate management white paper; it doesn't specifically call out the Redfish HTTPS certificate, but gives the general workflows for replacing any sort of certificate13:47
dtantsurmraineri: a link handy?13:47
mrainerihttps://www.dmtf.org/sites/default/files/standards/documents/DSP2059_1.0.0.pdf13:47
mraineriWould certainly like the eyes of others on it if things are not clear13:47
dtantsurthank you, reading!13:48
arne_wiebalckTheJulia: yeah, my proposed book title/cover did not fully fit to your case ... :-)13:48
TheJuliaOh, I look forward to reading this book13:48
arne_wiebalckTheJulia: I only do covers.13:48
TheJuliaarne_wiebalck: lolz13:48
TheJuliaarne_wiebalck: since you do book covers how bleak is the "a whole generation in the US will never be able to retire" book cover?13:49
* dtantsur requests an ironic comics13:50
TheJulia"You did what with how many bare metal machines?!"13:50
TheJulia"And you did it for SCIENCE!? Awesome!"13:50
arne_wiebalckTheJulia: who wants to retire if working on Ironic?13:51
TheJuliaI wasn't thinking about ironic13:51
* TheJulia tries to wake up and is failing13:54
dtantsur"3.1.4. Install a certificate" bingo!13:55
rpittauBye everyone, have a great weekend! o/13:55
iurygregorybye rpittau o/13:55
TheJuliadtantsur: can you put that in the form of an animated gif?13:55
*** rpittau is now known as rpittau|afk13:55
dtantsurTheJulia: right in the sushy repo? :D13:55
TheJuliaI was thinking in IRC13:55
* TheJulia should get some more coffee and prepare to go drop off the car at the mechanic... and then maybe work on something good today13:57
dtantsurmraineri: it's much clearer now, thank you! I only need to understand why the Dell machine I have here pretends it has 0 HTTP certificates :)13:57
dtantsurwhich means, I don't know what happens if I try replacing the cert on it13:57
dtantsuror even: I cannot replace the certificate that is not in Redfish.13:58
arne_wiebalckTheJulia: ... and skip the news maybe for a day or so ... too depressing atm.13:58
TheJuliadtantsur: this seems to be along the lines of certificate replacements https://www.youtube.com/watch?v=FUVj61gruwg13:59
dtantsurnow the "fun" part: neither supermicro nor openbmc seems compatible with the standard13:59
TheJuliaarne_wiebalck: yeah. ugh13:59
iurygregory<insert not surprised gif here>13:59
mraineridtantsur: Ick! There should be at least ONE certificate...14:00
dtantsurmraineri: https://paste.opendev.org/show/808220/14:00
mraineriThat seems broken... At least the systems I have available show 1 certificate in that collection14:01
* TheJulia needs to go dig through policy docs first() today :(14:01
dtantsurle sigh14:01
mraineriAt least the document I gave you is helping :)14:01
mraineriI'm also fairly up to date firmware-wise; do you have the firmware version of your iDRAC handy?14:02
dtantsurlemme check.. I'm using someone's (bfournie?) Dell, so I cannot really try things on it, only read :)14:02
dtantsurmraineri: 4.22.00.0014:03
mraineriHmmm, that's not too old... I've certainly done some certificate stuff on the version (but I don't remember the contents of the HTTPS certificate collection though)14:04
iurygregorydtantsur, I think i have one dell with the latest FW if you want access14:04
dtantsuriurygregory: could you PM me the credentials? I only need to read a few things (for now)14:04
iurygregorydtantsur, sure 1min14:04
dtantsuraha, the only iurygregory just gave me does have a certificate there!14:06
iurygregory\o/14:07
dtantsurokay, this part is clear14:08
dtantsurnow I wonder if any vendors care about certificates when accessing virtual media URLs14:08
dtantsurmraineri: do you know if there is any official guidance re ^^14:08
mraineriGenerally I haven't seen anyone have explicit checks internally; there have been additional certificate collections added to various resources over time for letting users configure certificate checking as needed14:10
mraineriFor example, in VirtualMedia, we added a "Certificates" property to contain the server certificates for the server hosting the image14:10
mraineriAnd an additional "VerifyCertificates" property to enable that checking; so, if set to true, the service is required to verify the certificate of the server hosting the image14:11
dtantsuroh!14:11
dtantsurmraineri: which version of VirtualMedia was it?14:11
mraineriIt would probably be good to add that to the white paper for how to use these collections... The scope and capability of these things has been growing over time14:11
mraineri1.4.014:11
mraineriIt was published fairly recently14:12
dtantsurah, right, I was looking at 1.3.214:12
mraineriSo, I wouldn't expect much support yet14:12
dtantsuryeah, Iury's iDRAC has 1.3.214:12
dtantsurmraineri: please fix: the schema doesn't specify the default of VerifyCertificate14:14
dtantsurI assume false in case of Redfish, which is not a commonly used default for this purpose14:14
mraineriYou mean what the behavior is if not present?14:14
dtantsuryep14:15
mraineriOkay, I can have that clarified14:15
mraineriCertainly is "false" if not present14:15
dtantsurI remember some version stated that Inserted defaults to true, I don't see it in 1.4.014:16
mraineriThat's just for the parameter in the action "InsertMedia"14:16
dtantsurah, right14:16
mraineriIt's not in the property since the property simply exists14:16
dtantsurhmmm14:16
mraineriAnd you can read it prior to PATCHing14:16
dtantsurcan I configure TLS certificates before attaching a media?14:17
mraineriYes14:17
dtantsurin other words: are certificates persistent across insert/eject events?14:17
mraineriThat's what we'd generally expect to happen; 1) set up the necessary certificates on the media instance, 2) insert the media14:17
mraineriI would expect it to be; could certainly clarify that14:17
dtantsurokay, thanks!14:18
mraineriOr at least ask around if others agree14:18
dtantsurI'd especially like a consensus on what the default of VerifyCertificates is14:18
mraineriI certainly don't like the idea of the certificates vanishing after ejecting the media :)14:18
dtantsurbecause there is a desire in OpenShift to start using TLS for virtual media storage14:18
mraineriI would assume most vendors implement it as "false", and require clients to come in and set it to "true" if needed14:19
mraineriOtherwise it would put a burden on existing clients that aren't aware of setting certificates of the resource to turn off the flag14:19
dtantsuryep, this is exactly my point14:20
dtantsurokay, thanks again! This clarified a lot.14:20
mraineriNo problem14:20
dtantsurmraineri: any plans to update the published mock-ups with 1.4.0?14:33
dtantsurbtw looking at https://redfish.dmtf.org/redfish/mockups/v1/1049#Managers--BMC--VirtualMedia--CD1, I don't think it's valid :) it has no scheme in Image and no TransferProtocol set14:33
opendevreviewDmitry Tantsur proposed openstack/ironic-lib master: Drop an explicit requirement of oslo.log  https://review.opendev.org/c/openstack/ironic-lib/+/80540615:13
mraineridtantsur: nothing firm, but I can raise that too15:19
arne_wiebalckBye everyone, have a good weekend o/15:48
opendevreviewAija Jauntēva proposed openstack/ironic master: Fix iDRAC import configuration missing task handling  https://review.opendev.org/c/openstack/ironic/+/80542815:59
opendevreviewAija Jauntēva proposed openstack/ironic master: Fix iDRAC import configuration job with errors  https://review.opendev.org/c/openstack/ironic/+/80543116:00
opendevreviewTakashi Kajinami proposed openstack/ironic stable/train: Fix "is not" used to compare strings  https://review.opendev.org/c/openstack/ironic/+/80543416:13
opendevreviewTakashi Kajinami proposed openstack/ironic stable/train: Fix "is not" used to compare strings  https://review.opendev.org/c/openstack/ironic/+/80543416:16
opendevreviewTakashi Kajinami proposed openstack/ironic master: rfc3986: Replace deprecated URIReference.is_valid  https://review.opendev.org/c/openstack/ironic/+/80544016:49
dtantsurhave a nice weekend folks!17:26
opendevreviewTakashi Kajinami proposed openstack/ironic-inspector master: Update parameters for authtoken middleware  https://review.opendev.org/c/openstack/ironic-inspector/+/80544317:40
*** mgoddard- is now known as mgoddard17:43
NobodyCamgood afternoon Ironic folks20:11
opendevreviewJulia Kreger proposed openstack/ironic master: Revert "Allow reboot to hard disk following iso ramdisk deploy."  https://review.opendev.org/c/openstack/ironic/+/80528420:16
iurygregorygood afternoon NobodyCam 20:30
NobodyCam:) howdy happy Friday!20:30
NobodyCamarne_wiebalck: around?21:09
opendevreviewMerged openstack/sushy-tools master: Add lower-constraints job to current development branch  https://review.opendev.org/c/openstack/sushy-tools/+/80437621:12
TheJuliaNobodyCam: good afternoon21:25
TheJuliaNobodyCam: he left a couple hours ago, anything I can provide insight on?21:25
NobodyCam:) top of the afternoon TheJulia 21:25
opendevreviewMerged openstack/bifrost stable/wallaby: Improve main function  https://review.opendev.org/c/openstack/bifrost/+/80383321:26
NobodyCamoh I was going to let him know I believe I found a check that (seemingly) works for Ironic node deployment readiness 21:26
TheJuliaoh?!21:26
NobodyCamopenstack hypervisor show <NODEUUID> -c disk_available_least -f value  > 021:27
TheJuliadoesn't that wait until resource tracker is updated?21:28
opendevreviewMerged openstack/bifrost stable/wallaby: Fix Redeploy Playbook  https://review.opendev.org/c/openstack/bifrost/+/80037921:29
opendevreviewMerged openstack/bifrost master: Changes made to install documentation  https://review.opendev.org/c/openstack/bifrost/+/80454821:29
NobodyCamlooks it21:33
TheJulialooks like it?21:33
TheJuliaso would just cut down on I guess the placement overhead?21:33
opendevreviewMerged openstack/python-ironicclient master: Add lower-constraints job to current development branch  https://review.opendev.org/c/openstack/python-ironicclient/+/80437421:36
NobodyCamyea, I've been unsuccessfully checking ironic status and resource placement records, but adding the hypervisor check is working in my test bed..21:42
TheJuliaI guess it feels liike it shouldn't be that way21:43
TheJuliabut... I don't know the nova mechanics overhead21:43
NobodyCamI'm just happy to have something that works21:43
TheJulia++21:44
opendevreviewMerged openstack/networking-generic-switch master: Add lower-constraints job to current development branch  https://review.opendev.org/c/openstack/networking-generic-switch/+/80393922:14

Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!