| opendevreview | Merged openstack/ironic master: project scoped manager support https://review.opendev.org/c/openstack/ironic/+/818299 | 00:53 |
|---|---|---|
| opendevreview | Merged openstack/ironic master: Deprecate syslinux https://review.opendev.org/c/openstack/ironic/+/842229 | 00:53 |
| opendevreview | Merged openstack/ironic-tempest-plugin master: Add iDRAC Redfish virtual media boot deploy test https://review.opendev.org/c/openstack/ironic-tempest-plugin/+/845356 | 00:53 |
| opendevreview | Merged openstack/ironic-lib master: json_rpc.client: log the URL and exceptions https://review.opendev.org/c/openstack/ironic-lib/+/849661 | 00:53 |
| opendevreview | Merged openstack/ironic master: [iRMC] Add SNMPv3 authentication functionality https://review.opendev.org/c/openstack/ironic/+/845347 | 00:54 |
| opendevreview | SONG SHUKUN proposed openstack/ironic stable/yoga: [iRMC] Add SNMPv3 authentication functionality https://review.opendev.org/c/openstack/ironic/+/850553 | 01:27 |
| opendevreview | SONG SHUKUN proposed openstack/ironic stable/yoga: [iRMC] Add SNMPv3 authentication functionality https://review.opendev.org/c/openstack/ironic/+/850553 | 01:31 |
| opendevreview | SONG SHUKUN proposed openstack/ironic stable/xena: [iRMC] Add SNMPv3 authentication functionality https://review.opendev.org/c/openstack/ironic/+/850554 | 01:41 |
| opendevreview | SONG SHUKUN proposed openstack/ironic stable/xena: [iRMC] Add SNMPv3 authentication functionality https://review.opendev.org/c/openstack/ironic/+/850554 | 01:55 |
| opendevreview | SONG SHUKUN proposed openstack/ironic stable/xena: [iRMC] Add SNMPv3 authentication functionality https://review.opendev.org/c/openstack/ironic/+/850554 | 02:21 |
| opendevreview | SONG SHUKUN proposed openstack/ironic stable/wallaby: [iRMC] Add SNMPv3 authentication functionality https://review.opendev.org/c/openstack/ironic/+/850707 | 02:37 |
| opendevreview | SONG SHUKUN proposed openstack/ironic stable/wallaby: [iRMC] Add SNMPv3 authentication functionality https://review.opendev.org/c/openstack/ironic/+/850707 | 02:40 |
| *** akahat is now known as akahat|ruck | 05:00 | |
| *** undefined is now known as Guest5693 | 05:12 | |
| rpittau | good morning ironic, happy Friday! o/ | 08:01 |
| jssfr | good morning ironic!:) | 08:50 |
| jssfr | is there any integration for Ironic to use Smart NICs with NVMe emulation as alternative to PXE boot? | 08:50 |
| timeu | is there something in the openstack client tools that replicates: ironic node-set-provision-state ? | 09:55 |
| opendevreview | Swapnil Machikar proposed openstack/ironic-tempest-plugin master: Add iDRAC Redfish sync boot mode test https://review.opendev.org/c/openstack/ironic-tempest-plugin/+/848709 | 12:47 |
| TheJulia | jssfr: no, and I'm not sure anyone has even tried to wire it together or even asked the community about something like that before now. From everything I hear across the industyr, basically everyone struggles with the pre-baked OS on the cards. | 13:05 |
| opendevreview | Merged openstack/ironic-python-agent master: Remove unused lines of code https://review.opendev.org/c/openstack/ironic-python-agent/+/850498 | 13:06 |
| TheJulia | jssfr: most people who just don't want to touch PXE boot tend to be using the BMC with virutal media these days | 13:06 |
| TheJulia | timeu: openstack baremetal <state verb> <uuid> | 13:07 |
| jssfr | TheJulia, myeah. The folks I'm talking to don't like BMCs. | 13:08 |
| jssfr | nor do they like PXEs | 13:08 |
| jssfr | they're super into smartnics though | 13:08 |
| jssfr | in their setup, the smartnic is the only thing they trust | 13:08 |
| * TheJulia tries to not laugh | 13:08 | |
| TheJulia | smartnics have some huge security issues which are inherent in their design, unfortunately | 13:08 |
| jssfr | :shrug: | 13:08 |
| TheJulia | direct bus access, and all | 13:08 |
| jssfr | I'm not going to argue with them. | 13:09 |
| TheJulia | but... I guess if your paranoid about the admin doing things to your BMC... | 13:09 |
| jssfr | I'm not so sure about that, I think they simply don't trust BMC implementations. | 13:09 |
| jssfr | for authentication and authorization. | 13:09 |
| *** Guest5693 is now known as rcastillo | 13:09 | |
| TheJulia | oh, that is valid too, but is kind of the more common lesser evil really | 13:09 |
| jssfr | they have the smartnics anyway, so it makes sense from their perspective to see if those can be used to solve the issue of non-trustworthy BMC implementations and the inherent issues with PXE security | 13:10 |
| TheJulia | so, how would they suggest these smartnics be configured? | 13:10 |
| jssfr | the idea would be that they pretend to be an NVMe and provide the IPA that way to the machine. | 13:11 |
| jssfr | (they = smartnics here) | 13:11 |
| jssfr | the code on the NIC would presumably have to talk to ironic in order to get boot configuration and whatnot | 13:11 |
| TheJulia | I guess, at present, I think an agent or something would be needed to live in the card's OS, and have credentials stuff. Somehow the bios settings woudl need to be toggled and all that | 13:11 |
| TheJulia | well, the boot configuration via the bmc | 13:11 |
| jssfr | they have a whole bunch of agent stuff on those already | 13:11 |
| TheJulia | yeah | 13:11 |
| jssfr | hm, if an EFI system partition is on the smart nic NVMe emulation if and only if ironic wants to do something to the node, the bios configuration *could* be static? | 13:12 |
| TheJulia | yeah, that is a possibility, it would have to be written of course | 13:13 |
| jssfr | ack | 13:13 |
| jssfr | I told them that :-) | 13:13 |
| TheJulia | good! :) | 13:13 |
| jssfr | I did not expect anything to exist in this space, honestly. Just wanted to make sure. | 13:13 |
| TheJulia | the overall idea of using like ironic's storage interface with cinder to somehow orchstrate cinder volume attachment proxying has been floated before | 13:14 |
| jssfr | I'll point out BMC virtual media though, I had not mentioned that. | 13:14 |
| TheJulia | but nobody has really come forward with a "hey, xyz" or a solid case | 13:14 |
| TheJulia | Even though we discussed the base challenges and the internal os in the first generation of smartnics, the embedded OS still seems super challenging for everyone... which makes me sad :( | 13:14 |
| jssfr | they already do storage stuff on the NICs, but I honestly don't know how proprietary that is so I'm not gonna go into details ^_^ | 13:14 |
| jssfr | they *really* like those, so I think they overcame the struggles. | 13:15 |
| TheJulia | I mean, it is actually a kind of awesome solution if you can maintain the security barrier the card needs to hold | 13:15 |
| jssfr | my own experiences with smartnics are ........ well, let's say, the offloading did not work as expected and they fell over once the traffic reached a few 100 mbit/s :) | 13:15 |
| TheJulia | ooouch | 13:15 |
| TheJulia | the big security concern I have with smartnics is you basically have a fully open pci bus attack surface, designs that largely predicate the base OS can do whatever it wants with the card, and agents that need credentials internally to communicate with services... and in order to perform various actions, those credentials almost need to be privileged or have some elevated permissions in the infrastructure | 13:18 |
| TheJulia | anyway, in the grand scheme of the universe, I don't think anyone would say no to some sort of agent on a smartnic, but it is a radically different deploy model and authentication, and I think that would be the challenging aspects | 13:21 |
| TheJulia | Granted, we did create the agent token framework, and this would be very similar | 13:22 |
| TheJulia | at least in terms of authorization/access for a limited scope agent | 13:22 |
| timeu | TheJulia: I can't get this to work. Currently due the virtual media bug the node is stuck in deploying state and I want to move it to failed state so I can clean it again. openstack baremetal node abort does not work and also delete didn't | 13:35 |
| timeu | I can also probably update the state direclty in the database but I believe for that the ironic client had the ironic node-set-provision-state command to manually set it. | 13:36 |
| TheJulia | timeu: hmm in the active state... | 13:37 |
| TheJulia | that sounds like a bug, I wonder if the lock is stuck... | 13:37 |
| TheJulia | timeu: because, sepcifically, abort should work. | 13:37 |
| TheJulia | timeu: but can't work if there is a pre-existing lock :\ | 13:37 |
| timeu | I get this error: The requested action "abort" can not be performed on node "d77e4414-6a9b-41c5-9ecd-32b1920c73b2" while it is in state "deploying". (HTTP 400) | 13:38 |
| timeu | when I ruyn abort | 13:38 |
| timeu | I think the problem is that the error message from redfish caused an exception ihe database layer and thus the node was not moved into failed state | 13:38 |
| TheJulia | yeah, i bet the original task for deploying internally crashed out | 13:40 |
| TheJulia | so there is likey an exception we're not catching/handling there because the job does not fail :\ | 13:41 |
| TheJulia | oh, that would *definitely* do it | 13:41 |
| TheJulia | we've seen one of those before someplace | 13:41 |
| timeu | yeah this was because I believe the redfish endpoint returns a non json output and when the error message is stored in the database by ironic the json.dumps call fails | 13:44 |
| timeu | I was wondering if I can just simply update the state in the datbase of the node and then remove the node and re-add | 13:44 |
| TheJulia | timeu: set the node to "deploy fail" provision state | 13:45 |
| TheJulia | iurygregory: you around? | 14:00 |
| iurygregory | TheJulia, yeah | 14:00 |
| TheJulia | So, apparently the anaconda driver change broke unit testing for a packager | 14:01 |
| TheJulia | specifically, something was getting called which was not mocked. | 14:01 |
| iurygregory | RDO? | 14:01 |
| TheJulia | yuyp | 14:01 |
| TheJulia | patch inbound in a moment, if we can just approve it, I think the world would be happier | 14:01 |
| iurygregory | happy to do it | 14:02 |
| iurygregory | if is just unit test ofc =) | 14:02 |
| opendevreview | Julia Kreger proposed openstack/ironic master: Fix adoption unit test image check https://review.opendev.org/c/openstack/ironic/+/850754 | 14:04 |
| TheJulia | and then iurygregory ^ | 14:04 |
| iurygregory | ack o/ | 14:05 |
| iurygregory | it's green locally so I will +W | 14:11 |
| opendevreview | Merged openstack/ironic master: Fix adoption unit test image check https://review.opendev.org/c/openstack/ironic/+/850754 | 14:35 |
| TheJulia | \o/ | 14:46 |
| iurygregory | \o/ | 14:55 |
| rpittau | bye everyone, have a great weekend! o/ | 15:02 |
| *** undefined is now known as Guest5751 | 15:26 | |
| *** Guest5751 is now known as rcastillo_ | 15:26 | |
| *** kubajj_ is now known as kubajj | 15:27 | |
| *** rpioso_ is now known as rpioso | 15:27 | |
| *** johnsom_ is now known as johnsom | 15:27 | |
| *** rcastillo_ is now known as rcastillo | 17:54 | |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!