| opendevreview | Merged openstack/ironic master: fix inspectwait logic https://review.opendev.org/c/openstack/ironic/+/872658 | 02:12 |
|---|---|---|
| opendevreview | Merged openstack/ironic master: Relaxing console pid looking https://review.opendev.org/c/openstack/ironic/+/871262 | 04:40 |
| rpittau | good morning ironic! o/ | 07:48 |
| rpittau | JayF: I'll have a look today | 08:00 |
| rpittau | JayF: I went ahead and proposed releases for all the cycle-with-intermediary except bifrost, since we're still fixing CI there | 08:15 |
| opendevreview | Riccardo Pittau proposed openstack/bifrost master: CI fixes and workarounds https://review.opendev.org/c/openstack/bifrost/+/874650 | 08:19 |
| vanou | JayF: If you have any feedback/suggestion on https://review.opendev.org/c/openstack/ironic/+/872750, please share with me. I'll refine it. | 08:55 |
| opendevreview | Ebbex proposed openstack/bifrost master: Finally fix jinja[spacing] https://review.opendev.org/c/openstack/bifrost/+/872634 | 09:19 |
| opendevreview | Ebbex proposed openstack/bifrost master: Fix no-free-form linter warnings https://review.opendev.org/c/openstack/bifrost/+/874852 | 09:19 |
| opendevreview | Ebbex proposed openstack/bifrost master: Fix yaml[octal-values] linter warnings https://review.opendev.org/c/openstack/bifrost/+/874853 | 09:19 |
| opendevreview | Ebbex proposed openstack/bifrost master: Fix key-order[task] linter warnings https://review.opendev.org/c/openstack/bifrost/+/874854 | 09:19 |
| opendevreview | Ebbex proposed openstack/bifrost master: Fix schema[meta] linter warnings https://review.opendev.org/c/openstack/bifrost/+/874855 | 09:19 |
| opendevreview | Ebbex proposed openstack/bifrost master: Fix schema[vars] linter warning https://review.opendev.org/c/openstack/bifrost/+/874856 | 09:19 |
| opendevreview | Ebbex proposed openstack/bifrost master: Simplify set_fact for ssh_public_key https://review.opendev.org/c/openstack/bifrost/+/874857 | 09:19 |
| rpittau | ebbex: CI in bifrost is not fixed yet | 09:28 |
| opendevreview | Merged openstack/ironic-inspector master: Use UTC for the timezone in functional tests https://review.opendev.org/c/openstack/ironic-inspector/+/874661 | 10:09 |
| opendevreview | Mark Goddard proposed openstack/networking-generic-switch master: Add ngs-stress test script https://review.opendev.org/c/openstack/networking-generic-switch/+/874789 | 11:07 |
| iurygregory | morning Ironic | 11:13 |
| opendevreview | Merged openstack/ironic master: Set lockutils default logging https://review.opendev.org/c/openstack/ironic/+/872608 | 11:23 |
| opendevreview | Iury Gregory Melo Ferreira proposed openstack/networking-baremetal master: DNM - Testing CI for Antelope Release https://review.opendev.org/c/openstack/networking-baremetal/+/874913 | 11:50 |
| iurygregory | just a heads-up I've abandoned some ngs patches that were very old (2017/2018). 2019 till 2021 I'm also planing to abandon if there is no updates (but not going to do this today) | 12:13 |
| iurygregory | rpittau, I was planning to push the release patches today, but you were faster XD | 12:23 |
| opendevreview | Iury Gregory Melo Ferreira proposed openstack/ironic-python-agent-builder master: DNM - Testing Antelope https://review.opendev.org/c/openstack/ironic-python-agent-builder/+/874918 | 12:34 |
| opendevreview | Mark Goddard proposed openstack/networking-generic-switch master: Support batching up commands https://review.opendev.org/c/openstack/networking-generic-switch/+/743283 | 12:36 |
| opendevreview | Mark Goddard proposed openstack/networking-generic-switch master: Support batching up commands https://review.opendev.org/c/openstack/networking-generic-switch/+/743283 | 12:44 |
| kubajj | TheJulia, JayF: could I also ask you some questions for the evaluation part of my dissertation (I am still finalising them with my supervisor, might have them next week) | 12:57 |
| opendevreview | Riccardo Pittau proposed openstack/ironic master: [WIP] [PoC] A metal3 CI job https://review.opendev.org/c/openstack/ironic/+/863873 | 13:29 |
| opendevreview | Riccardo Pittau proposed openstack/bifrost master: CI fixes and workarounds https://review.opendev.org/c/openstack/bifrost/+/874650 | 13:51 |
| iurygregory | networking-baremetal CI is broken .-. | 14:08 |
| iurygregory | https://zuul.opendev.org/t/openstack/build/0353dc4b15844933a52728484d2bcfdc | 14:08 |
| iurygregory | "/bin/bash: coredumpctl: command not found" | 14:23 |
| iurygregory | I'm wondering if something changed in ubuntu... | 14:23 |
| rpittau | maybe missing command in jammy ? | 14:23 |
| iurygregory | yeah | 14:23 |
| iurygregory | trying to double check that | 14:23 |
| *** dking is now known as Guest5661 | 14:45 | |
| *** Guest5661 is now known as dking | 15:00 | |
| zigo | What's the ipa-trusted-cert.pem for? | 15:04 |
| * zigo is trying to make sense of the mess in ironic-python-agent-builder ... | 15:05 | |
| dtantsur | zigo: IPA makes HTTP(s) requests against Ironic, this can be used to validate them IIRC | 15:10 |
| TheJulia | good morning | 15:12 |
| dtantsur | morning TheJulia | 15:12 |
| TheJulia | I'm taking a low key day working on some presentation stuff unless the world expldoes | 15:13 |
| TheJulia | kubajj: sure! | 15:13 |
| TheJulia | ... that test is running a bunch of jobs | 15:16 |
| TheJulia | it looks like dhcp might have failed | 15:16 |
| TheJulia | failed to work which is a known neutron issue right now | 15:16 |
| zigo | dtantsur: Ok, so that would be an internal PKI to Ironic? | 15:16 |
| dtantsur | zigo: likely yes | 15:16 |
| zigo | ok | 15:16 |
| TheJulia | I believe it is so a end user certificate can be truested which they have configured on their APIs which may not be a signed CA | 15:17 |
| zigo | FYI, we (at infomaniak) are starting to build an Ironic env, so likely, I'll be doing some Debian work to clean-up the Ironic package and make them prod-ready forus. | 15:17 |
| zigo | I probably will have more questions as we go... | 15:17 |
| TheJulia | zigo: cool cool | 15:17 |
| zigo | That's a good thing for the state of Ironic in Debian... :) | 15:18 |
| TheJulia | excellent | 15:22 |
| iurygregory | good morning TheJulia | 15:22 |
| dking | Does anybody know about using hardware-detect inspection? It seems that I previously had to add an element for it when building the IPA image, but now I don't see the element. Maybe it's already built in these days? | 15:23 |
| dtantsur | zigo: great news | 15:23 |
| dtantsur | dking: rpittau and I know something. https://opendev.org/openstack/ironic-python-agent-builder/src/branch/master/dib/extra-hardware is the element you're looking for. | 15:24 |
| JayF | kubajj: the best way to contact me for that is my email; jay at jvf dot cc | 15:25 |
| dking | Oh, interesting. I was looking for it here: https://docs.openstack.org/diskimage-builder/latest/elements.html I suppose it's just missing there? | 15:25 |
| dtantsur | dking: we don't maintain elements specific to IPA in DIB any more | 15:25 |
| dtantsur | https://docs.openstack.org/ironic-python-agent-builder/latest/admin/dib.html#ironic-python-agent-ipa-extra-hardware is the docs | 15:26 |
| TheJulia | kubajj: same, juliaashleykreger at gmail.com | 15:26 |
| kubajj | JayF, TheJulia: thanks | 15:26 |
| dking | Ohh! Now I remember. I knew that I saw it somewhere unusual, and that my brain was telling me that I didn't have to write my own element, but I completely forgot where. Thanks dtantsur! | 15:29 |
| * TheJulia suggests lots of coffeee | 15:30 | |
| TheJulia | speaking of! | 15:30 |
| dtantsur | too late for coffee here :) | 15:30 |
| TheJulia | I need to put this to use! https://usercontent.irccloud-cdn.com/file/ckr6h80X/IMG_1269.JPG | 15:31 |
| mgoddard | Hi, currently bumping into https://storyboard.openstack.org/#!/story/2010537. Looks like the fix has been released for all releases back to xena. Can I propose a wallaby release? | 15:31 |
| TheJulia | And no, I don't do that particular exercise, although some stackers have encouraged me to take it up. Ugh long covid effects | 15:32 |
| opendevreview | Merged openstack/networking-generic-switch master: Add support for Cisco Nexus devices (NX-OS) https://review.opendev.org/c/openstack/networking-generic-switch/+/868481 | 15:32 |
| TheJulia | mgoddard: sure! | 15:32 |
| TheJulia | ... I thought we did backport that to wallaby though | 15:32 |
| * TheJulia might be loosing her mind | 15:32 | |
| rpittau | bye everyone, see you on monday! o/ | 15:33 |
| dtantsur | TheJulia: this cup rocks :) | 15:33 |
| mgoddard | TheJulia:it's backported but not yet released | 15:34 |
| JayF | Is wallaby EM? | 15:36 |
| JayF | Wallaby is EM. | 15:36 |
| JayF | It gets no more releases mgoddard, sorry | 15:36 |
| JayF | that is openstack policy; not ironic policy | 15:36 |
| JayF | you'll have to pull it from git | 15:36 |
| JayF | https://releases.openstack.org/ | 15:36 |
| dtantsur | JayF: that does suck though that we have a significant regression in the stable release that we cannot fix | 15:37 |
| dtantsur | I wonder if we can request an exception | 15:37 |
| mgoddard | JayF: ah, of course | 15:37 |
| JayF | I honestly don't know, lets ask in -releases | 15:37 |
| JayF | er, -release | 15:37 |
| dtantsur | yup | 15:37 |
| TheJulia | I think we've managed to pull it off at least once in the past, but it has been a long time | 15:39 |
| JayF | I'm asking; worse thing that can happen is a no; and we're in the same spot we're in now. | 15:40 |
| TheJulia | ++ | 15:43 |
| dtantsur | btw we should probably release sushy yoga and zed | 15:44 |
| TheJulia | ++ | 15:45 |
| dtantsur | I guess it was a no, sorry, mgoddard | 15:50 |
| JayF | dtantsur: part of me wonders if a non-wallaby-line sushy could be combined with wallaby ironic for mgoddard's case | 15:52 |
| dtantsur | JayF: we have done similar things in metal3. Just don't cross the major version boundary. | 15:52 |
| dtantsur | sushy is reasonable semver-following | 15:53 |
| TheJulia | I suspect it would... | 15:59 |
| JayF | someone in -release suggested we should consider sushy being independent | 15:59 |
| JayF | rather than cycle | 15:59 |
| JayF | which makes sense to me on the surface, but I haven't thought about it in depth | 15:59 |
| TheJulia | it.. does make more sense to be independent | 16:01 |
| TheJulia | (and maybe that case long ago in the past was independent or something | 16:01 |
| dtantsur | rebooting for updates, brb | 16:17 |
| TheJulia | iurygregory: I think networking-baremetal is a test issue | 16:22 |
| TheJulia | iurygregory: I think it is fine, otherwise | 16:22 |
| TheJulia | It looks like on tear down we're expecting to delete something but they are in the gray area of items which nova may delete, I think | 16:23 |
| * dtantsur is back | 16:23 | |
| TheJulia | Feb 23 14:05:06.327929 np0033234847 neutron-server[84968]: WARNING neutron.pecan_wsgi.controllers.root [None req-a829a11c-bfa8-4654-8f98-4cc60a57673c admin admin] No controller found for: security-groups - returning response code 404: pecan.routing.PecanNotFound | 16:28 |
| TheJulia | iurygregory: I think we're fine to release, but we need to figure out what changed. I bet this is fallout from the default plugin changes, oddly enough only the single tenant case hits it | 16:29 |
| iurygregory | TheJulia, oh ack | 16:32 |
| TheJulia | the underlying test passes, it is the cleanup from the test which detonates | 16:33 |
| TheJulia | *why* only that test, I have zero idea | 16:33 |
| TheJulia | and it is because somewhere port security is getting turned on | 16:36 |
| TheJulia | and the plugin is not by default. | 16:36 |
| opendevreview | Julia Kreger proposed openstack/networking-baremetal master: Add port-security to devstack config https://review.opendev.org/c/openstack/networking-baremetal/+/874939 | 16:39 |
| opendevreview | Julia Kreger proposed openstack/ironic master: add default conductor group capability https://review.opendev.org/c/openstack/ironic/+/855705 | 16:48 |
| opendevreview | Julia Kreger proposed openstack/networking-baremetal master: [CI] Explicitly disable port security https://review.opendev.org/c/openstack/networking-baremetal/+/874939 | 17:11 |
| TheJulia | okay, that should work | 17:11 |
| sschmitt | This is more of a meta question, but whats the logical/feature boundary between ngs and networking-baremetal. It seems like they both have switch configuration abilities now. If I wanted to add some functionality in this area which one would make sense? | 17:13 |
| dtantsur | kubajj: you haven't added API reference for inventory API, have you? | 17:16 |
| dtantsur | hmm, you have actually, why am I not seeing it.. | 17:17 |
| kubajj | dtantsur: isn't it this? https://review.opendev.org/c/openstack/ironic/+/866876/12/api-ref/source/baremetal-api-v1-nodes-inventory.inc | 17:18 |
| dtantsur | kubajj: I see the problem, this file is not included anywhere. I'll fix it now, no worries | 17:18 |
| * dtantsur working on adding the inventory API to gophercloud | 17:19 | |
| dtantsur | kubajj: we definitely haven't updated the ironic client and openstacksdk, right? | 17:19 |
| dtantsur | folks, could someone take a look at https://docs.openstack.org/api-ref/baremetal/ please? Am I the only who only sees very few headings? | 17:25 |
| * dtantsur raises it to infra | 17:28 | |
| JayF | dtantsur: feel free to @ me on gophercloud PRs, I'm generally interested, it's used downstream here, and I know some go | 17:29 |
| dtantsur | JayF: it will take me some time, but will do | 17:29 |
| JayF | dtantsur: you aren't the only one, it is on a very long list for me to look at it, if you tackle it you'd be doing me a favor | 17:29 |
| kubajj | dtantsur: I don't think we did (I don't really know what those are though) | 17:30 |
| dtantsur | heh, okay | 17:30 |
| dtantsur | JayF: fun fact, we have exactly one heading. I wonder what makes it special | 17:31 |
| JayF | Which one works? | 17:31 |
| dtantsur | Deleting history entries for a node | 17:31 |
| dtantsur | also the only one without any actual API reference. interesting. | 17:31 |
| * dtantsur turns to firefox dev tools | 17:32 | |
| dtantsur | .docs-body section h1 { | 17:33 |
| dtantsur | display: none; | 17:33 |
| dtantsur | } | 17:33 |
| dtantsur | WTF\ | 17:33 |
| dtantsur | if I disable this rule, the sections are back. W.T.F. | 17:33 |
| JayF | what css file is that in? | 17:33 |
| dtantsur | JayF: comes from combined.css, which is probably something rendered | 17:34 |
| JayF | we should see if that occurs in other api refs | 17:34 |
| dtantsur | JayF: compute too | 17:34 |
| JayF | I wonder if it's a theme decision that our API ref dislikes for some reason | 17:34 |
| JayF | https://github.com/openstack/openstackdocstheme/blob/master/openstackdocstheme/theme/openstackdocs/static/css/combined.css#L929 | 17:35 |
| JayF | dtantsur: ^ | 17:35 |
| dtantsur | https://github.com/openstack/openstackdocstheme/commit/f81f3344076a09482545534e014318d7e961f825 has been around for a while.. | 17:36 |
| dtantsur | JayF: let's move to openstack-infra? it affects not only us | 17:36 |
| JayF | I'm happy to drop from the troubleshooting | 17:36 |
| JayF | and go finish my client support for shards :D | 17:37 |
| dtantsur | dropping not allowed ;) | 17:37 |
| JayF | which probably should include gophercloud at some point if I'm honest :| | 17:37 |
| opendevreview | Dmitry Tantsur proposed openstack/ironic master: Add missing include for inventory API reference https://review.opendev.org/c/openstack/ironic/+/874946 | 17:39 |
| dtantsur | I won't be able to finish the workaround for api-ref today, sorry | 17:49 |
| dtantsur | see you on Monday o/ | 17:49 |
| jjy | Hi openstack-ironic community? Have a quick question on ironic image service. My user OS images is hosted with HTTP server that requires client basic authentication. Does the ironic image service supports HTTP basic authentication with the HTTP server. I had a quick look at the code. Looks like it only validate the server certificate. | 19:29 |
| TheJulia | jjy: well.... That is not a requirement I think anyone has ever articulated | 19:32 |
| TheJulia | jjy: you could try using a https://user:pass@url/file ... which is awful and might reveal an issue in API responses (so if you see that, let us know | 19:32 |
| TheJulia | ewwwwww | 19:33 |
| TheJulia | irccloud... bad irccloud | 19:33 |
| JayF | TheJulia: :| | 19:33 |
| JayF | I'm pretty sure we block out image_url in api responses | 19:33 |
| JayF | I hope we do :) | 19:33 |
| TheJulia | https://paste.openstack.org/show/b3rYfSR2SfHfeUEMH23x/ | 19:33 |
| TheJulia | jjy: ^^ | 19:34 |
| JayF | it came across well here fwiw TheJulia | 19:34 |
| JayF | your "try using ... " message, originally | 19:34 |
| TheJulia | nice | 19:34 |
| TheJulia | well, irccloud itself changed it down to https://url/file and then added at thing about use of which username/password | 19:35 |
| TheJulia | I guess as a helper... | 19:35 |
| * TheJulia looks at the speed in which unit tests run and thinks "this desktop's days are numbered... substantially... because KSP2" | 19:42 | |
| opendevreview | Julia Kreger proposed openstack/ironic master: Get conductor metric data https://review.opendev.org/c/openstack/ironic/+/865447 | 19:45 |
| TheJulia | dtantsur: stevebaker[m] ^^ updated | 19:45 |
| JayF | if you get one, let me help pick out the parts, I <3 building custom desktops lol | 19:45 |
| JayF | or if there's a microcenter near SCALE, I should go on a pilgrimage there lol | 19:45 |
| jjy | The background is we host a ironic service. The image url will be feeded by another component I believe. Probably I need to make our HTTP image server accept the url like https://user:pass@url/file? | 19:45 |
| JayF | jjy: https://user:pass@url/file is a standard url syntax for basic auth | 19:46 |
| JayF | jjy: So that should work anywhere a URL would work, theoretically | 19:46 |
| TheJulia | iurygregory: I'll do the follow-up sometime next week. I would like to chat about the naming stuff since I think the comment could use a little more verbosity :) | 19:46 |
| TheJulia | yeah, the underlying HTTP client understands what to do with it | 19:46 |
| TheJulia | at least it should | 19:47 |
| * TheJulia tries | 19:47 | |
| jjy | Yep. I hope that. The image server is not developed by me. | 19:48 |
| TheJulia | well, python-requests didn't freak out when I asked it to use basic auth with my power meter | 19:49 |
| jjy | The architecture is the ironic cache the image from the external image server and then IPA download the image from ironic and write to the local disk. Right? | 19:50 |
| TheJulia | >>> print(r.request.headers) | 19:50 |
| TheJulia | {'User-Agent': 'python-requests/2.28.1', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive', 'Authorization': 'Basic dXNlcjpwYXNz'} | 19:50 |
| TheJulia | it groks it | 19:50 |
| TheJulia | jjy: it *can*, there is an option for that | 19:50 |
| TheJulia | if your using the direct deploy interface, it can also just go directly to the original image url supplied to ironic | 19:51 |
| * TheJulia makes sad face at only 2.55kW being generated right now | 19:51 | |
| TheJulia | (I have an iot webserver thing that montiors my power | 19:52 |
| TheJulia | ) | 19:52 |
| jjy | The option is in ironic or IPA? Could you point me to the option. Currently I am investigating where the authentication takes place. I was thinking the authentication is between ironic-conductor and the external HTTP image server. | 19:54 |
| TheJulia | one moment, I'll get it | 19:54 |
| TheJulia | in ironic.conf, you want the [agent] section option image_download_source | 19:56 |
| TheJulia | it can be set by conductor, and I believe the option you want is "local" | 19:56 |
| jjy | I see. We do not use that option. Do you suggest to add authentication between IPA and ironic-conductor? We do not have authentication between IPA and ironic-contuctor or ironic-inspector | 19:58 |
| TheJulia | for the image transfer? | 19:58 |
| TheJulia | or in general? | 19:58 |
| jjy | in general | 19:59 |
| TheJulia | ahh | 19:59 |
| TheJulia | inspector has no concept of it, but it is only for reporting data in to discover/model machines | 19:59 |
| TheJulia | https://docs.openstack.org/ironic/latest/admin/agent-token.html is how the IPA agent is basically authenticated beyond certificates which can also be used | 19:59 |
| jjy | inspector only does out of band, no interaction with IPA? | 20:00 |
| TheJulia | ipa always tries to call inspector if so configured | 20:00 |
| TheJulia | but it is not required | 20:00 |
| TheJulia | if you want to just always authenticate to a remote url for the image file download, use the configuration option I noted with the value "http" | 20:01 |
| TheJulia | fwiw, the agent will do checksum verification as well | 20:02 |
| iurygregory | TheJulia, sure | 20:02 |
| jjy | "if you want to just always authenticate to a remote url for the image file download, use the configuration option I noted with the value "http" | 20:45 |
| jjy | Was in lunch. That requires to add image server CA into IPA ramdisk OS/ | 20:46 |
| jjy | I plan to add authenticate between ironic-conductor and external HTTP image server. But it will not no authentication when IPA pull the image from irnoic-conductor. | 20:53 |
| JayF | If you're building your own ramdisk; including a custom CI is fairly trivial | 21:16 |
| JayF | I think we support it even if you don't build your own ramdisk, but I don't know how to configure that off the top of my head | 21:17 |
| JayF | **custom CA | 21:17 |
| JayF | https://github.com/openstack/ironic-python-agent-builder/tree/master/dib/ironic-python-agent-tls look at DIB_IPA_CA_FILE | 21:17 |
| jjy | We build our own ramdisk, but we do not plant add the cert bundles during the build time. https://github.com/openstack/ironic-python-agent-builder/tree/master/dib/ironic-python-agent-tls The link is to add cert bundles while building. | 21:23 |
| TheJulia | jjy: if you just define the credentials for basic auth in the url, the conductor will be able to use the credentials | 21:26 |
| jjy | That is the authentication between conductor and external image server. Conductor cache the image? How about authentication between IPA and ironic-conductor, when IPA pull the image from ironic and write to the machine disk ? | 21:40 |
| JayF | https://docs.openstack.org/kolla-ansible/latest/reference/deployment-and-bootstrapping/bifrost.html this looks pretty sweet | 21:41 |
| JayF | jjy: serach for image_download_source https://docs.openstack.org/ironic/latest/configuration/config.html | 21:42 |
| JayF | jjy: that behavior is configurable :D | 21:42 |
| JayF | jjy: by default, in master branch, it looks like IPA would fetch directly from the URL you provide | 21:42 |
| jjy | hmm we do not set up the image_download_source. The agent config is "[agent] | 22:00 |
| jjy | deploy_logs_collect = always | 22:00 |
| jjy | deploy_logs_local_path = /shared/log/ironic/deploy | 22:00 |
| jjy | max_command_attempts = 30 | 22:00 |
| JayF | it defaults, per that doc, to `http` | 22:00 |
| JayF | which is the behavior I think you want, but I'm unsure | 22:00 |
| jjy | But I did see the ironic (not IPA) was trying to validate the external HTTP image server certificate. | 22:02 |
| JayF | interesting | 22:02 |
| JayF | > IPA ramdisk retrieves instance image from HTTP service served at conductor nodes. | 22:02 |
| JayF | I'm not sure I can tell what that (http) means | 22:03 |
| JayF | vs local | 22:03 |
| JayF | > Same as “http”, but HTTP images are also cached locally, converted and served from the conductor | 22:03 |
| JayF | http service /served at conductor nodes/ implies it's doing some caching, too | 22:03 |
| JayF | I don't have time to read the code and figure out exactly what this behavior is; I'll try to dedicate some time to you tomorrow afternoon if you'll be around jjy ? | 22:03 |
| jjy | The validate happens there https://github.com/openstack/ironic/blob/master/ironic/common/image_service.py#L100 | 22:04 |
| jjy | Yes I will be around. | 22:04 |
| JayF | I'm in pacific time, I'd say probably between 11a-noonish I should become available | 22:05 |
| JayF | we'll try and figure it out for you | 22:05 |
| JayF | BTW; can you let me know what your use case is? Just so we know who our users are? | 22:05 |
| jjy | We deploy the ironic for Baremetal provisioning using the K8S operator. Check this https://github.com/metal3-io/ironic-image | 22:07 |
| JayF | I'm very familiar with metal3.io :D | 22:08 |
| JayF | are you a developer on that, or just a user? | 22:08 |
| JayF | "just" comes off more pajorative than I mean, just trying to determine if you're implementing new stuff for metal3 or trying to get your things working :) | 22:09 |
| * JayF notes he's @jay.faulkner in the slack for metal3 | 22:09 | |
| jjy | To clarify the question, I want to confirm where the authentication takes place between ironic and external HTTP image server. We want to secure the communiation between ironic and external image server. | 22:10 |
| JayF | ack; that makes sense. I believe as Julia suggested, an https url + username/password should work | 22:11 |
| JayF | but we should nail down in what cases that connection would come from conductor, and what it comes from IPA | 22:11 |
| JayF | I think it's almost always going to be conductor, but we can figure it out for sure tomorrow | 22:12 |
| JayF | it's also possible one of the brilliant folks in the other time zones will just know the answer :D | 22:12 |
| jjy | If the connection come from dconductor, we would like to add the authentication between IPA and conductor. | 22:12 |
| jjy | Currently I am a user of metal3:) Sent out my first trial pull quest to the upstream. | 22:13 |
| JayF | I'm fairly certain we have push-button support for IPA<>Conductor secure comms | 22:45 |
| JayF | we use agent tokens as a form of auththentication to authenticate it's a valid agent | 22:45 |
| JayF | and use https certs to ensure data is secure in transit | 22:45 |
| TheJulia | Yes, it is a thing! I just remember the configuration knobs | 22:46 |
| JayF | is it okay that this exists? https://www.npmjs.com/package/bifrost-docker | 23:05 |
| JayF | it's 8 years old. | 23:05 |
| JayF | #3 on google for "bifrost container install" :| | 23:06 |
| TheJulia | Sign, nothing we found when we did the name search. Likely perfectly fine albeit confusing | 23:45 |
| JayF | ...does centos stream 9 just not operate like a normal operating system now? | 23:56 |
| JayF | the cloud image ships with no enabled repos, and it appears you need to do a subscription manager dance to get them working | 23:56 |
| TheJulia | dunno.... but that is... concerning | 23:58 |
| JayF | watch the last 5 minutes of my stream vod | 23:58 |
| JayF | I just know better than to try to use centos stream in the future lol | 23:59 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!
