| opendevreview | Julia Kreger proposed openstack/ironic master: DNM/WIP - Add FIPS jobs https://review.opendev.org/c/openstack/ironic/+/797739 | 00:05 |
|---|---|---|
| opendevreview | Jacob Anders proposed openstack/ironic master: Add support for verify steps https://review.opendev.org/c/openstack/ironic/+/800001 | 00:38 |
| opendevreview | Jacob Anders proposed openstack/ironic master: Make iDRAC management steps verify steps https://review.opendev.org/c/openstack/ironic/+/804032 | 00:49 |
| opendevreview | Jacob Anders proposed openstack/ironic master: Make iDRAC management steps verify steps https://review.opendev.org/c/openstack/ironic/+/804032 | 00:50 |
| *** pmannidi is now known as pmannidi|AFK | 01:17 | |
| opendevreview | ZhouHao proposed openstack/ironic master: [iRMC] Avoid repeatedly resuming clean after creating raid configuration https://review.opendev.org/c/openstack/ironic/+/809022 | 01:29 |
| opendevreview | ZhouHao proposed openstack/ironic master: [iRMC] Set polling after RAID is built https://review.opendev.org/c/openstack/ironic/+/809023 | 01:29 |
| *** pmannidi|AFK is now known as pmannidi | 02:22 | |
| opendevreview | Merged openstack/ironic master: Set stage for release 18.2 https://review.opendev.org/c/openstack/ironic/+/810323 | 03:11 |
| opendevreview | Steve Baker proposed openstack/ironic master: Add missing mode setting on pxe created directories https://review.opendev.org/c/openstack/ironic/+/809294 | 03:17 |
| opendevreview | Steve Baker proposed openstack/ironic master: chmod fetched pxe kernel/ramdisk files https://review.opendev.org/c/openstack/ironic/+/809295 | 03:17 |
| opendevreview | Merged openstack/ironic master: Remove docker reference from legacy image build https://review.opendev.org/c/openstack/ironic/+/810311 | 03:19 |
| opendevreview | Steve Baker proposed openstack/ironic master: WIP Use cp to copy local images to preserve sparseness https://review.opendev.org/c/openstack/ironic/+/800152 | 03:37 |
| opendevreview | Jacob Anders proposed openstack/ironic master: Add support for verify steps https://review.opendev.org/c/openstack/ironic/+/800001 | 05:07 |
| *** pmannidi is now known as pmannidi|brb | 05:17 | |
| *** pmannidi|brb is now known as pmannidi|Lunch | 05:22 | |
| arne_wiebalck | Good morning, Ironic! | 06:03 |
| arne_wiebalck | mnasiadka: heh, that is symptom no. 1 :-) | 06:05 |
| dtantsur | morning ironic | 06:08 |
| iurygregory | good morning arne_wiebalck dtantsur and Ironic o/ | 06:18 |
| arne_wiebalck | hey iurygregory, good morning! o/ | 06:19 |
| *** pmannidi|Lunch is now known as pmannidi | 06:20 | |
| dtantsur | \o | 06:20 |
| dtantsur | iurygregory: JFYI I want to request a sushy-tools release with the recently merged fix | 06:21 |
| iurygregory | dtantsur, ++ go ahead and I will +1 | 06:26 |
| dtantsur | iurygregory: just did | 06:26 |
| dtantsur | https://review.opendev.org/c/openstack/releases/+/810343 | 06:26 |
| iurygregory | 0.18.1 makes sense =) +1 | 06:26 |
| iurygregory | oh wow, google chrome is evaluating using Rust in the future :O | 06:42 |
| dtantsur | nice | 06:46 |
| opendevreview | Dmitry Tantsur proposed openstack/ironic master: Use an ImageCache for provided boot/deploy ISO images https://review.opendev.org/c/openstack/ironic/+/810241 | 06:58 |
| * dtantsur -> errands, brb | 06:58 | |
| opendevreview | Dmitry Tantsur proposed openstack/ironic master: Use an ImageCache for provided boot/deploy ISO images https://review.opendev.org/c/openstack/ironic/+/810241 | 07:00 |
| opendevreview | ZhouHao proposed openstack/ironic master: [iRMC] Avoid repeatedly resuming clean after creating raid configuration https://review.opendev.org/c/openstack/ironic/+/809022 | 07:26 |
| opendevreview | ZhouHao proposed openstack/ironic master: [iRMC] Set polling after RAID is built https://review.opendev.org/c/openstack/ironic/+/809023 | 07:26 |
| *** rpittau|afk is now known as rpittau | 07:28 | |
| rpittau | good morning ironic! o/ | 07:28 |
| janders | hey rpittau o/ | 07:31 |
| rpittau | hey janders :) | 07:31 |
| iurygregory | hey janders and rpittau o/ | 07:36 |
| rpittau | hey iurygregory :) | 07:36 |
| janders | hey iurygregory o/ | 07:36 |
| opendevreview | Jacob Anders proposed openstack/ironic master: Add support for verify steps https://review.opendev.org/c/openstack/ironic/+/800001 | 07:47 |
| opendevreview | Riccardo Pittau proposed openstack/bifrost master: Support debian 11 "bullseye" https://review.opendev.org/c/openstack/bifrost/+/806328 | 07:47 |
| opendevreview | Riccardo Pittau proposed openstack/bifrost master: Support debian 11 "bullseye" https://review.opendev.org/c/openstack/bifrost/+/806328 | 07:48 |
| iurygregory | dtantsur, if you have some time later today https://review.opendev.org/c/openstack/releases/+/810149 I just updated the release patch to create stable/xena for Ironic | 08:23 |
| iurygregory | I've looked at the open patches and we can backport them so we should be fine | 08:24 |
| rpittau | iurygregory: did we double-check release notes ? | 08:26 |
| iurygregory | rpittau, yup =) | 08:26 |
| rpittau | ok | 08:26 |
| iurygregory | rpittau, https://review.opendev.org/c/openstack/ironic/+/810323 | 08:27 |
| rpittau | I double-checked the patches, looks good, added my +1 | 08:29 |
| iurygregory | rpittau, tks! | 08:29 |
| iurygregory | I'm going to check ipa and inspector patches to see if there is something we want to include for the xena release | 08:29 |
| iurygregory | feel free to ping if you find any patch that might be important | 08:30 |
| rpittau | do we plan to have victoria and wallaby released soon ? | 08:31 |
| iurygregory | rpittau, we can ofc =) | 08:32 |
| iurygregory | maybe next week? (so we can take a look this week at backports etc) | 08:32 |
| rpittau | yeah, let's finish xena first :) | 08:33 |
| opendevreview | Jacob Anders proposed openstack/ironic master: Add support for verify steps https://review.opendev.org/c/openstack/ironic/+/800001 | 08:56 |
| opendevreview | OpenStack Release Bot proposed openstack/ironic stable/xena: Update .gitreview for stable/xena https://review.opendev.org/c/openstack/ironic/+/810378 | 10:11 |
| opendevreview | OpenStack Release Bot proposed openstack/ironic stable/xena: Update TOX_CONSTRAINTS_FILE for stable/xena https://review.opendev.org/c/openstack/ironic/+/810379 | 10:11 |
| opendevreview | OpenStack Release Bot proposed openstack/ironic master: Update master for stable/xena https://review.opendev.org/c/openstack/ironic/+/810380 | 10:11 |
| opendevreview | OpenStack Release Bot proposed openstack/ironic master: Add Python3 yoga unit tests https://review.opendev.org/c/openstack/ironic/+/810381 | 10:11 |
| dtantsur | yay | 10:15 |
| dtantsur | iurygregory: so we have inspector and IPA left? | 10:15 |
| iurygregory | dtantsur, correct (I've checked the open patches for ipa so far most of them have -1 from CI and they don't seem urgent...) | 10:16 |
| iurygregory | maybe for inspector we want https://review.opendev.org/c/openstack/ironic-inspector/+/807578 ? | 10:17 |
| dtantsur | iurygregory: I can add it to my list and try to review today. but it's also not quite urgent, especially since we cannot get CLI in Xena | 10:18 |
| iurygregory | yeah | 10:19 |
| iurygregory | I also noticed that still need some changes | 10:19 |
| iurygregory | I will check the releasenotes for inspector/ipa to see if we need to change something | 10:20 |
| dtantsur | ++ | 10:22 |
| iurygregory | going to grab some lunch before the downstream meeting brb | 10:23 |
| opendevreview | ZhouHao proposed openstack/ironic master: [iRMC] Avoid repeatedly resuming clean after creating raid configuration https://review.opendev.org/c/openstack/ironic/+/809022 | 10:24 |
| opendevreview | ZhouHao proposed openstack/ironic master: [iRMC] Set polling after RAID is built https://review.opendev.org/c/openstack/ironic/+/809023 | 10:24 |
| janders | see you tomorrow Ironic o/ | 11:14 |
| opendevreview | Merged openstack/ironic stable/xena: Update .gitreview for stable/xena https://review.opendev.org/c/openstack/ironic/+/810378 | 11:21 |
| opendevreview | Merged openstack/ironic stable/xena: Update TOX_CONSTRAINTS_FILE for stable/xena https://review.opendev.org/c/openstack/ironic/+/810379 | 11:21 |
| opendevreview | Merged openstack/ironic master: Update master for stable/xena https://review.opendev.org/c/openstack/ironic/+/810380 | 11:42 |
| opendevreview | Dmitry Tantsur proposed openstack/ironic master: Devstack: don't scan /opt, /etc looking for isolinux https://review.opendev.org/c/openstack/ironic/+/810327 | 11:43 |
| opendevreview | Aija Jauntēva proposed openstack/ironic master: Update iDRAC doc for idrac-redfish RAID https://review.opendev.org/c/openstack/ironic/+/810414 | 12:15 |
| opendevreview | Merged openstack/bifrost stable/xena: Update .gitreview for stable/xena https://review.opendev.org/c/openstack/bifrost/+/810294 | 12:25 |
| opendevreview | Merged openstack/bifrost stable/xena: Update TOX_CONSTRAINTS_FILE for stable/xena https://review.opendev.org/c/openstack/bifrost/+/810295 | 12:25 |
| opendevreview | Merged openstack/bifrost master: Update master for stable/xena https://review.opendev.org/c/openstack/bifrost/+/810296 | 12:25 |
| opendevreview | Merged openstack/bifrost master: Add Python3 yoga unit tests https://review.opendev.org/c/openstack/bifrost/+/810297 | 12:27 |
| opendevreview | Harald Jensås proposed openstack/metalsmith master: Write network_data.json metadata to config-dirve https://review.opendev.org/c/openstack/metalsmith/+/810320 | 12:33 |
| opendevreview | Harald Jensås proposed openstack/metalsmith master: Write network_data.json metadata to config-dirve https://review.opendev.org/c/openstack/metalsmith/+/810320 | 12:54 |
| rpittau | mmmm we have the 2 redfish vmedia jobs in bifrost check as voting, but not in the gate, is that intended ? | 13:08 |
| iurygregory | O.o | 13:09 |
| rpittau | https://opendev.org/openstack/bifrost/src/branch/master/zuul.d/project.yaml#L14 | 13:09 |
| iurygregory | rpittau, interesting :D | 13:10 |
| rpittau | yeah, if it's in purpose I don't remember the reasoning behind it | 13:10 |
| TheJulia | good morning | 13:11 |
| rpittau | good morning TheJulia :) | 13:12 |
| iurygregory | good morning TheJulia =) | 13:12 |
| opendevreview | Dmitry Tantsur proposed openstack/ironic master: Clean up caches periodically https://review.opendev.org/c/openstack/ironic/+/810428 | 13:19 |
| opendevreview | Dmitry Tantsur proposed openstack/ironic master: Clean up caches periodically https://review.opendev.org/c/openstack/ironic/+/810428 | 13:19 |
| dtantsur | morning TheJulia | 13:19 |
| dtantsur | rpittau: I'm quite sure it's a mistake | 13:20 |
| rpittau | ok, I'll submit a patch | 13:20 |
| opendevreview | Riccardo Pittau proposed openstack/bifrost master: Support debian 11 "bullseye" https://review.opendev.org/c/openstack/bifrost/+/806328 | 13:20 |
| opendevreview | Riccardo Pittau proposed openstack/bifrost master: Add redfish vmedia jobs to gate https://review.opendev.org/c/openstack/bifrost/+/810430 | 13:21 |
| opendevreview | Riccardo Pittau proposed openstack/bifrost master: Support debian 11 "bullseye" https://review.opendev.org/c/openstack/bifrost/+/806328 | 13:23 |
| * TheJulia feels like a zombie this morning | 13:32 | |
| dtantsur | craving for some tasty brains? | 13:33 |
| dtantsur | oh, mmm, we need to decide this week re outreachy | 13:34 |
| rpittau | every time I think about Indiana Jones and the Temple of Doom | 13:34 |
| dtantsur | anyone feels like mentoring? iurygregory, rpittau, TheJulia? | 13:34 |
| rpittau | dtantsur: I'm available | 13:35 |
| TheJulia | dtantsur: stevebaker is pondering a few things | 13:35 |
| dtantsur | cool! could you folks coordinate before EOW? | 13:35 |
| dtantsur | (I'm available too, but I can just as well leave it up to someone else, especially if stevebaker want to try) | 13:36 |
| TheJulia | I suspect so, I noted to him the submission deadline is now the 29th | 13:36 |
| rpittau | yeah, same, I did it two times already so if stevebaker wants to go for it I can just help | 13:36 |
| dtantsur | yeah, we may need someone to cover this side of the Earth | 13:37 |
| TheJulia | The only project idea that has come to mind in my brain is likely... too... obscure of a hardware issue | 13:37 |
| dtantsur | may be worth checking storyboard for easy RFEs | 13:38 |
| TheJulia | yeah | 13:39 |
| opendevreview | Julia Kreger proposed openstack/ironic master: DNM/WIP - Add FIPS jobs https://review.opendev.org/c/openstack/ironic/+/797739 | 13:52 |
| opendevreview | Merged openstack/ironic master: Add Python3 yoga unit tests https://review.opendev.org/c/openstack/ironic/+/810381 | 13:52 |
| JayF | TheJulia: dtantsur: I wonder if there are opportunities in documentation | 13:57 |
| JayF | although that could be a big lift for an intern | 13:57 |
| TheJulia | I mean, for low hanging fruit/clarity items, docs make sense to familuarize interns with the ins and outs, but some sort of code feature is kind of preferred in that context since there is ultimately a backing funding thing going on where the desire is to help guide the interns into becoming code contributors | 14:00 |
| * iurygregory is wondering why git review is taking more than 1min... | 14:00 | |
| iurygregory | I've checked inspector releasenotes and they look good, I've updated the release patch https://review.opendev.org/c/openstack/releases/+/810147 | 14:01 |
| TheJulia | I'm actually wondering why a change I uploaded a few minutes ago is not in zuul yet | 14:01 |
| JayF | I dislike the base assumption in that statement that doc contibutions are not a form of code contribution; but I understand that's likely a transferred assumption from outreachy and not from you directly :) | 14:01 |
| TheJulia | Yeah, there whole thing is largely get a feature, solve a problem, gain and move that "real world" experience forward | 14:02 |
| TheJulia | *but* I *do* think it is worthwhile to chat with Sage Sharp in person about this at some point | 14:02 |
| TheJulia | When you know... when we can have such things and all | 14:02 |
| opendevreview | Merged openstack/ironic master: Update iDRAC doc for idrac-redfish RAID https://review.opendev.org/c/openstack/ironic/+/810414 | 14:11 |
| dtantsur | JayF: let's put is this way: experience in fixing docs is not likely to land you a job in software engineering. | 14:12 |
| JayF | the oof-ness of that statement is immeasurable, and saddens me greatly | 14:12 |
| dtantsur | I don't disagree with that, but that's life | 14:12 |
| JayF | I'd rather have someone with dev chops who has only fixed docs than someone with dev chops who has never fixed docs :| | 14:12 |
| dtantsur | we're trying to give these people the best start possible | 14:12 |
| JayF | you're 100% right | 14:13 |
| JayF | but I wish reality was different | 14:13 |
| dtantsur | yep | 14:13 |
| dtantsur | that being said, we could use some doc tasks for the selection round | 14:13 |
| TheJulia | ++ | 14:13 |
| iurygregory | I've checked ipa and it looks good also, I've pushed 8.2.0 https://review.opendev.org/c/openstack/releases/+/810148/ | 14:14 |
| dtantsur | and also to be fair: there have been outreachy projects to work on docs | 14:14 |
| TheJulia | around setting boot mode would be good since that we already got a complaint about it downstream :( | 14:14 |
| dtantsur | so maybe I'm too harsh. but then again, I don't know how to get someone busy with our docs for 3 months | 14:14 |
| TheJulia | make the api self-documenting from the api surface?! | 14:15 |
| * TheJulia hides | 14:15 | |
| dtantsur | you mean api-ref? | 14:15 |
| TheJulia | get rid of it in favor of in code | 14:16 |
| dtantsur | that could be an interesting task | 14:17 |
| TheJulia | it could | 14:18 |
| JayF | oh what a brilliant idea | 14:19 |
| JayF | do other openstack projects do this already? Are there libraries and examples? | 14:19 |
| TheJulia | afaik no, somehow we got on this pattern of api-ref in templated documentes with variables way in the communit | 14:20 |
| TheJulia | which I think as we all know is kind of "annoying" | 14:20 |
| TheJulia | Another thing I *do* want to see is us start to consume settings/overrides to firing up ironic becomes easier to just "start the service" and the needful occurs without human interaction or human driven steps | 14:20 |
| TheJulia | hmmm | 14:22 |
| dtantsur | I have mixed feelings about this | 14:22 |
| dtantsur | on one hand - YES PLEASE, on the other - we have too many dependencies | 14:22 |
| TheJulia | I want to at least push dependencies to packagers to be aware of | 14:22 |
| dtantsur | (which is why I'm investing so much in Bifrost) | 14:22 |
| TheJulia | and possibly drop the requisite configuration | 14:22 |
| TheJulia | so distro specific lives at the distro layer | 14:23 |
| dtantsur | I rather mean things like dnsmasq, httpd, neutron... | 14:23 |
| TheJulia | oh yeah | 14:23 |
| TheJulia | those | 14:23 |
| TheJulia | :( | 14:23 |
| TheJulia | those are the ones I'm not sure we can just get rid of | 14:23 |
| TheJulia | my personal mission seems to always be related to just pxe and bootloaders | 14:23 |
| dtantsur | maybe we should once again entertain the idea of official containers? | 14:23 |
| dtantsur | (maybe in collaboration with kolla/metal3/...) | 14:23 |
| TheJulia | Do we have any zuul cookies laying around? I think it needs some giant chocolate chip coookies | 14:24 |
| TheJulia | possibly with ice cream on top | 14:24 |
| dtantsur | yummy | 14:24 |
| JayF | You're not going to get a software dev job just tossing stuff in containers, either ;) | 14:24 |
| dtantsur | JayF: I hope you're right, but sometimes I feel like you're not :) | 14:24 |
| JayF | although I guess you could argue that I am the counterexample :P | 14:24 |
| dtantsur | :D | 14:24 |
| dtantsur | in any case, I don't think we're ready to give this as a task to an intern before we make up our mind | 14:25 |
| dtantsur | a PTG topic? | 14:25 |
| JayF | how about heartbeat only mode for IPA? :P | 14:25 |
| JayF | that is a pretty big lift | 14:25 |
| dtantsur | yeah. and requires diving into somewhat convoluted code. but doable | 14:26 |
| dtantsur | TheJulia: https://etherpad.opendev.org/p/ironic-yoga-ptg line 90 | 14:28 |
| dtantsur | tweak it as you wish | 14:28 |
| TheJulia | Added a thing, but otherwise lgtm | 14:30 |
| sdanni | Hi! I'm running metalsmith deploy command with a node lessee role and having error "Access was denied to the following resource: baremetal:allocation:create_pre_rbac". After putting create_pre_rbac policy into my policy file and adding is_node_lessee rule in it, it's still access denied. I notice that pre_rbac is deprecated now, is it the reason why it doesn't work? | 14:31 |
| TheJulia | okay, zuuls backed up like 40 minutes | 14:32 |
| TheJulia | sdanni: what is your role issued by keystone? | 14:32 |
| sdanni | TheJulia: it's a member role | 14:33 |
| TheJulia | sdanni: so realistically its a policy to bridge the gap between prior models and the new rbac model | 14:35 |
| TheJulia | https://github.com/openstack/ironic/blob/af0e5ee096fa237290776969a37f3bced96b7456/releasenotes/notes/allocations-restricted-rbac-create-2847943150656432.yaml | 14:35 |
| TheJulia | The existing policy is '(rule:is_member and role:baremetal_admin) or (is_admin_project:True and role:admin)' | 14:36 |
| TheJulia | so you need to logically or it, or try the new defaults | 14:36 |
| TheJulia | sdanni: it may just because you don't have admin rights presently on the tenant, and running with member role and lessee level of access in the new model is going to be a bit painful. Owner would be easier, admin/lessee should be the level of access you need/want | 14:38 |
| sdanni | can't I customize the policy? (rule:is_member and role:baremetal_admin) or (is_admin_project:True and role:admin) or (rule:is_node_owner) or (rule:is_node_lessee)" | 14:38 |
| TheJulia | you can, but you no node is associated yet | 14:39 |
| TheJulia | sdanni: https://github.com/openstack/ironic/blob/af0e5ee096fa237290776969a37f3bced96b7456/ironic/api/controllers/v1/allocation.py#L311 | 14:40 |
| sdanni | I think enforce_new_defaults is set to false on my ironic controller, so should i enable it? | 14:41 |
| TheJulia | sdanni: I'd give it a spin :) | 14:41 |
| TheJulia | ideally, with that, you whouldn't need to modify the policy file to do what your trying to do | 14:42 |
| TheJulia | sdanni: you *will* need an admin to grant access to nodes to match your project ID for the allocation process to actually work in the rbac model, since your not running as an admin presently | 14:43 |
| sdanni | alright! so ironic will check the lessee project ID and grant the allocation access? | 14:45 |
| sdanni | how does admin grant access to nodes? :) | 14:45 |
| TheJulia | a system scoped admin needs to set the owner or lessee fields appropriately on the nodes. | 14:47 |
| TheJulia | to match the project ID your trying to use | 14:47 |
| TheJulia | the db query adds the project you make the allocation request with and returns from that available list to make an allocation | 14:48 |
| TheJulia | dtantsur: JayF: You know, a small-ish project would be to update our smbios handling to capture redfish addressing information | 14:49 |
| TheJulia | *or* grab it from efi variables exposed to the running OS | 14:49 |
| JayF | Is that reasonably doable by someone without access to special hardware and/or can we provide a hardware lab for the intern to use? | 14:49 |
| TheJulia | the person learning that *would* need to learn some some really low level DMTF standards in the process | 14:49 |
| JayF | I'll also note that something hardware-centric might be a little bit more difficult | 14:49 |
| TheJulia | oh, agree it is a bit more difficult | 14:50 |
| sdanni | TheJulia: thanks! The node's lessee field is already set. I'll take a try! | 14:50 |
| TheJulia | I don't think they would be able to really test it fully without bleeding access to brand new hardware | 14:50 |
| TheJulia | Unfortunately vendors are still implementing the redfish hci side of things | 14:50 |
| TheJulia | but the smbios vars should be present if it is there in smbios 2.6 | 14:50 |
| TheJulia | and those field id values are assigned | 14:51 |
| dtantsur | I'm a bit reserved about projects that are not testable in any form by interns | 14:51 |
| JayF | ++ | 14:52 |
| dtantsur | anyway, have to run now. see you tomorrow folks! | 14:53 |
| JayF | o/ | 14:53 |
| iurygregory | bye dtantsur o/ | 14:53 |
| TheJulia | dtantsur: ditto | 15:03 |
| TheJulia | goodnight dtantsur | 15:03 |
| opendevreview | Julia Kreger proposed openstack/ironic master: Remove legacy rpm install list and use bindep https://review.opendev.org/c/openstack/ironic/+/810313 | 15:23 |
| TheJulia | freaky | 15:24 |
| TheJulia | mysql setup is broken doing that | 15:24 |
| iurygregory | random failures or really broken? | 15:32 |
| TheJulia | like... really broken | 15:34 |
| TheJulia | it *looks* like actually using bindep may short circuit thigns for devstack | 15:34 |
| iurygregory | woot | 15:35 |
| * TheJulia digs through devstck to confirm that bidnep is invoked *without* a filter | 15:36 | |
| opendevreview | Julia Kreger proposed openstack/ironic master: Remove legacy rpm install list and use bindep https://review.opendev.org/c/openstack/ironic/+/810313 | 15:44 |
| rpittau | good night! o/ | 15:45 |
| *** rpittau is now known as rpittau|afk | 15:45 | |
| iurygregory | woot, we need bindep in another dir to work? O.o | 15:47 |
| TheJulia | yup | 15:50 |
| TheJulia | devstack only loads it from devstack/files | 15:50 |
| iurygregory | facepalm =( | 15:50 |
| TheJulia | iknowrite | 15:50 |
| opendevreview | Julia Kreger proposed openstack/ironic master: DNM/WIP - Add FIPS jobs https://review.opendev.org/c/openstack/ironic/+/797739 | 15:52 |
| TheJulia | hmmm | 16:01 |
| TheJulia | if anyone has patches to push to zuul, please hold off. Things are rather unhappy with zuul | 16:07 |
| TheJulia | Also, no rechecks | 16:07 |
| TheJulia | sooo many tests look for bios | 16:23 |
| arne_wiebalck | bye everyone o/ | 16:27 |
| opendevreview | Leo McGann proposed openstack/ironic master: Adds Attestation Interface to Node https://review.opendev.org/c/openstack/ironic/+/755836 | 16:56 |
| * TheJulia waves goodnight | 17:00 | |
| sdanni | TheJulia: I set enforce_new_defaults to true and it did work to skip checking deprecated policies. But idk why results for "baremetal node list" or "baremetal port list" are always empty for admin project since this change? A lessee project can view it's node tho. | 17:06 |
| TheJulia | sdanni: concept of an "admin project" in the new rbac world is actually wrong | 17:09 |
| TheJulia | in ironic, in the new rbac world, it is System Scoped authentication to see a global view | 17:09 |
| TheJulia | This honestly goes back to the age old keystone bug of if you have admin in one project, you can gain rights in other projects | 17:10 |
| * TheJulia senses a blog post coming | 17:10 | |
| TheJulia | and more documentation :( | 17:10 |
| *** mgoddard- is now known as mgoddard | 17:13 | |
| sdanni | TheJulia: if i understand it correctly, there's no admin project, but we can give a project a certain system scope to operate as an admin? | 17:14 |
| TheJulia | no project can have a system scope | 17:15 |
| TheJulia | an account exists in the system scope and think of it as global admin of the universe | 17:15 |
| TheJulia | as long as it has the admin role | 17:15 |
| TheJulia | you *could* always just change the rule to be functionally wide open to create allocations... *but* your questions are actually feedback in a sense, so its a good like of thought and questions for us to learn from | 17:16 |
| sdanni | hmm, i guess i need some time to go over and digest the new rbac world. For a project with admin role, what else does it need to view all baremetal nodes? | 17:21 |
| TheJulia | an assigned owner or lessee | 17:21 |
| TheJulia | matching *their* project id | 17:22 |
| TheJulia | sdanni: we do have a spec published regarding this, and additional questions I think I'll need to write up for a blog post, so as you come across questions or needing clarification I'm happy to provide insight | 17:22 |
| TheJulia | fwiw, all of openstack is moving to this delineated model, but it is just more extreme with ironic given we were not a fully multi-tenant API to begin with | 17:23 |
| sdanni | i tried with a project that is the node's lessee and it could list it's nodes and deploy. | 17:24 |
| TheJulia | \o/ | 17:25 |
| TheJulia | That is good | 17:25 |
| TheJulia | there is an overlap capability with owner/lessee fields both being populated | 17:25 |
| sdanni | but seems like a project with admin role but not the assigned lessee or owner, it can't actually view the node or deploy the node | 17:25 |
| TheJulia | sdanni: could you clarify that a little more. We have fairly explicit testing for the api side of that | 17:26 |
| sdanni | I have a project: moc that is the lessee of the node dell-14. And I also have an "admin project". Before I set enforce_new_defaults to true, the admin project can view all nodes and deploy nodes with metalsmith, but the moc project can't deploy dell-14 because pre_rbac:allocation_create policy. After the enforce_new_defaults set to true, the "admin project" suddenly can't view any nodes, but the moc project can | 17:31 |
| sdanni | deploy dell-14 | 17:31 |
| TheJulia | indeed, that is explicitly by design | 17:33 |
| TheJulia | your "admin project" either needs to be the owner of the node... *or* you need to use a system scoped admin account/token | 17:34 |
| TheJulia | (or member, system scoped members can also do stuff | 17:34 |
| TheJulia | ) | 17:34 |
| TheJulia | (and really, you just need reader at the system scope to see everything) | 17:34 |
| sdanni | I see. Thanks! I'll take a try! | 17:38 |
| -opendevstatus- NOTICE: Zuul has been restarted in order to address a performance regression related to event processing; any changes pushed or approved between roughly 17:00 and 18:30 UTC should be rechecked if they're not already enqueued according to the Zuul status page | 18:36 | |
| opendevreview | OpenStack Release Bot proposed openstack/ironic-python-agent stable/xena: Update .gitreview for stable/xena https://review.opendev.org/c/openstack/ironic-python-agent/+/810501 | 18:38 |
| opendevreview | OpenStack Release Bot proposed openstack/ironic-python-agent stable/xena: Update TOX_CONSTRAINTS_FILE for stable/xena https://review.opendev.org/c/openstack/ironic-python-agent/+/810502 | 18:38 |
| opendevreview | OpenStack Release Bot proposed openstack/ironic-python-agent master: Update master for stable/xena https://review.opendev.org/c/openstack/ironic-python-agent/+/810503 | 18:38 |
| opendevreview | OpenStack Release Bot proposed openstack/ironic-python-agent master: Add Python3 yoga unit tests https://review.opendev.org/c/openstack/ironic-python-agent/+/810504 | 18:38 |
| sdanni | TheJulia: I assume creating system scoped roles needs a system scoped admin to do so and I've found that admin user. How can I operate these things with it's account/token? | 18:40 |
| opendevreview | OpenStack Release Bot proposed openstack/ironic-inspector stable/xena: Update .gitreview for stable/xena https://review.opendev.org/c/openstack/ironic-inspector/+/810505 | 18:40 |
| opendevreview | OpenStack Release Bot proposed openstack/ironic-inspector stable/xena: Update TOX_CONSTRAINTS_FILE for stable/xena https://review.opendev.org/c/openstack/ironic-inspector/+/810506 | 18:40 |
| opendevreview | OpenStack Release Bot proposed openstack/ironic-inspector master: Update master for stable/xena https://review.opendev.org/c/openstack/ironic-inspector/+/810507 | 18:40 |
| opendevreview | OpenStack Release Bot proposed openstack/ironic-inspector master: Add Python3 yoga unit tests https://review.opendev.org/c/openstack/ironic-inspector/+/810508 | 18:40 |
| TheJulia | sdanni: with the token, you can't send a project_id... I don't remember the exact details *but* if you look for ironic/tests/unit/api/v1/*.yaml you'll see some examples of system scoped token formatting field wise | 19:06 |
| sdanni | will do | 19:10 |
| TheJulia | wow, we built up a lot of debt around uefi | 19:35 |
| janders | good morning Ironic o/ | 21:11 |
| JayF | o/ | 21:12 |
| TheJulia | good morning janders | 21:45 |
| opendevreview | Merged openstack/metalsmith master: Write network_data.json metadata to config-dirve https://review.opendev.org/c/openstack/metalsmith/+/810320 | 22:15 |
| opendevreview | Harald Jensås proposed openstack/metalsmith stable/xena: Write network_data.json metadata to config-dirve https://review.opendev.org/c/openstack/metalsmith/+/810480 | 22:17 |
| opendevreview | Harald Jensås proposed openstack/metalsmith stable/wallaby: Write network_data.json metadata to config-dirve https://review.opendev.org/c/openstack/metalsmith/+/810481 | 22:17 |
| TheJulia | umm, yeah. Changing the default boot mode is a major lift | 22:25 |
| TheJulia | but we need to do it | 22:25 |
| * TheJulia sighs | 22:25 | |
| * TheJulia goes and checks for a leaky tire and goes to find dinner | 22:30 | |
| opendevreview | Steve Baker proposed openstack/ironic master: Use cp to copy local images to preserve sparseness https://review.opendev.org/c/openstack/ironic/+/800152 | 23:31 |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!