| cardoe | cid: JayF: why do I feel like Iām reading an ebuild? | 01:10 |
|---|---|---|
| rpittau | good morning ironic! o/ | 08:09 |
| opendevreview | Riccardo Pittau proposed openstack/bifrost master: Remove ubuntu bionic support leftovers https://review.opendev.org/c/openstack/bifrost/+/942767 | 09:38 |
| frickler | omg, is only supermicro so picky or what? ironic: shove this file into your vmedia floppy slot. supermicro: eh, 100KiB, you kidding me? floppy images are 1440KiB. and also don't do this to me without prot^Wa .img suffix | 10:25 |
| * frickler prepares a patch | 10:25 | |
| opendevreview | Merged openstack/python-ironicclient master: Drop remaining use of iteritems https://review.opendev.org/c/openstack/python-ironicclient/+/942613 | 10:36 |
| Sandzwerg[m] | Morning Ironic | 10:39 |
| Sandzwerg[m] | Has anyone ever tried to use a HPE Superdome with ironic? | 10:39 |
| opendevreview | Verification of a change to openstack/ironic-python-agent master failed: Fix the way qemu-img is called with prlimits https://review.opendev.org/c/openstack/ironic-python-agent/+/942690 | 10:49 |
| opendevreview | cid proposed openstack/ironic-python-agent-builder master: More reliable TinyIPA builds with network retries https://review.opendev.org/c/openstack/ironic-python-agent-builder/+/942369 | 11:58 |
| opendevreview | cid proposed openstack/ironic-python-agent-builder master: More reliable TinyIPA builds with network retries https://review.opendev.org/c/openstack/ironic-python-agent-builder/+/942369 | 12:02 |
| opendevreview | Merged openstack/networking-generic-switch master: Add support for Neutron routed segments https://review.opendev.org/c/openstack/networking-generic-switch/+/939211 | 12:09 |
| opendevreview | Dr. Jens Harbott proposed openstack/ironic master: Make floppy images more floppy https://review.opendev.org/c/openstack/ironic/+/942787 | 12:16 |
| opendevreview | Vasyl Saienko proposed openstack/ironic master: Do not review debug multinode https://review.opendev.org/c/openstack/ironic/+/942725 | 13:15 |
| iurygregory | frickler, well it's supermicro :D | 13:23 |
| iurygregory | they have all sort of things :D | 13:23 |
| iurygregory | do you have the license for vmedia for it? | 13:23 |
| TheJulia | good morning | 14:07 |
| frickler | iurygregory: yes, and with the above patch things do work for me | 14:08 |
| iurygregory | ack, tks for the patch o/ | 14:09 |
| TheJulia | Sandzwerg[m]: I've never had one. I know HPE made a "driver" for it specifically but chose not to upstream | 14:10 |
| TheJulia | Sandzwerg[m]: checkout https://support.hpe.com/hpesc/public/docDisplay?docId=a00038168en_us&page=GUID-91FD8D1A-4032-4FA2-8666-F295E18F986E.html | 14:10 |
| cardoe | I can't +W, frickler's patch but yeah that's something that needs to be done. frickler a lot of vendors have that demand from experience. | 14:13 |
| cardoe | I feel like somone has a requirement on like .flp or .fpy | 14:13 |
| frickler | well we can make the suffix configurable if needed, but I'd like to avoid the complexity unless there is a real demand for that | 14:15 |
| cardoe | No. That vendor can go <censored> | 14:15 |
| * TheJulia blinks | 14:16 | |
| cardoe | If someone else is available, let's land https://review.opendev.org/c/openstack/ironic-python-agent-builder/+/942369 | 14:16 |
| * TheJulia needs more coffeeeeeeeeeeeeeeee | 14:16 | |
| cardoe | TheJulia: what I'm not allowed to be mean to hardware vendors with silly requirements/ | 14:16 |
| cardoe | dtantsur: poke on https://review.opendev.org/c/openstack/ironic/+/940333 | 14:17 |
| TheJulia | cardoe: Always be nice and polite, while your preparing to lead them into the meeting where they are told "we'll be using the alternative vendor" ;) | 14:18 |
| cardoe | lol. yes this. | 14:18 |
| TheJulia | afterwards, all bets are off | 14:18 |
| TheJulia | "Oh, checkout your server SMELTED!" | 14:18 |
| TheJulia | "Your servers make AWFUL slag!" | 14:18 |
| TheJulia | And so on, and so forth | 14:19 |
| cardoe | You implemented an ethernet controller as an AGP extension to get faster unidirectional bandwidth. While novel, it has made me vomit up what I ate last year. | 14:19 |
| TheJulia | It occurs to me now we should have never shredded hard drives. We should have melted them. | 14:20 |
| cardoe | That A) shows my age and B) was a real conversation I've had | 14:20 |
| TheJulia | ugh | 14:20 |
| cardoe | So even though https://review.opendev.org/c/openstack/ironic/+/942496 failed tests (cause tinyipa timeouts, I'm waiting for cid's fix above to land first to recheck it). I just wanted to mention it before I get too heads down again today. | 14:21 |
| cardoe | So once again trying to follow commit history and read code to divine the expected behavior. | 14:21 |
| TheJulia | so taking a glance at HPE's docs, it makes me think nobody tested them after they last updated them | 14:21 |
| TheJulia | it makes me wonder if we need a warning about vendor docs in our docs | 14:22 |
| cardoe | If we merge that change and backport it. I think that's the "safer" option. | 14:22 |
| cardoe | But afterwards I've got a much bigger non-backportable change that's munging how image_properties are copied around. Do we have any set list of what we use or want to actually copy to the instance_info? | 14:23 |
| cardoe | Cause no promises I won't break someone's weird use case. | 14:23 |
| cardoe | Cause now it's literally JUST going to be image properties set by the user. | 14:23 |
| cid | tks, cardoe, TheJulia for the review ;) | 14:26 |
| * cid waves iurygregory, a welcome back wave :D | 14:26 | |
| TheJulia | what we extract for kernel/ramdisk with partition images (even though we don't actually use the artifacts), checksum fields/values, and what we download for glance. I think that about covers it for glance. That shouldn't conflict with anything specifically populated from nova though | 14:26 |
| iurygregory | hey cid o/ | 14:26 |
| TheJulia | cid: o/ I need some clarity on https://review.opendev.org/c/openstack/ironic/+/942112 when you get a chance | 14:35 |
| cid | TheJulia: I think that particular header was from ironic/common/utils | 14:38 |
| cid | it appears a few other places as well | 14:39 |
| TheJulia | But did the places it came from have it originally | 14:39 |
| TheJulia | for the code it has been paired up with | 14:39 |
| TheJulia | I guess I'm trying to figure out does it really apply at this point since it as been 12-13 years since then... | 14:40 |
| cid | So, I replicated that header since it's inside of commons and the entirety of inspection rules is located within it as well. | 14:41 |
| TheJulia | so the file where the content came from had the header. Was the other content substantially modified in this process? | 14:41 |
| cid | I don't think I made any changes at to where it came from. | 14:42 |
| cid | I just took the header | 14:43 |
| TheJulia | you mean preserved the license header with the content? | 14:43 |
| TheJulia | I'm being pedantic because this is a touchy area (the early copyrights) | 14:44 |
| cid | So, ... | 14:46 |
| cid | We had a function in the utils file | 14:46 |
| TheJulia | and that function was wholesale copied yes? | 14:47 |
| TheJulia | like, copied and pasted | 14:48 |
| cid | But I had to move it out into a separate where every aspect of inspection rules code and logic is self contained in a subdirectory /inspection_rules/. | 14:49 |
| cid | So, in code in `ironic/common/inspection_rules/utils.py` and `ironic/common/inspection_rules/validation.py` have been different places before where they are now. | 14:49 |
| cid | Re: wholesale copy: added, and then moved out | 14:50 |
| TheJulia | okay, cool | 14:50 |
| TheJulia | Thanks! | 14:50 |
| cid | Should I change the headers? I think that was the result of the carryover of the code from originally `ironic/common/utils.py` into separate modules. | 14:51 |
| TheJulia | They should only be used if the file was copied in whole or if the content of the file substantially originates from a file where that was the header. | 14:55 |
| TheJulia | Hopefully that made sense | 15:02 |
| cid | It did and that's not the case here either. So, I think it needs changing. | 15:04 |
| TheJulia | okay | 15:04 |
| TheJulia | cid: thanks! | 15:05 |
| cid | TheJulia: Yep! Are there any standard headers I could turn to, in cases like this when I'm uncertain. | 15:07 |
| * cid have seen at least 3 different ones | 15:07 | |
| JayF | If I was creating a new file today, I would just put the Apache license at the top and not include a copyright line | 15:10 |
| JayF | I have no idea if that's correct or not. But I think it is | 15:10 |
| TheJulia | Standard, just the license header. | 15:10 |
| TheJulia | yeah, exactly what JayF proposes | 15:10 |
| TheJulia | The fun thing is copyright is basically enforced through analysis of content. Most companies/orgs that stamp it at the top of the file is much more "this is org policy that I must do this" | 15:11 |
| TheJulia | When I was at HP, it was stressed internally to "always add an HP copyright entry" if appropriate | 15:12 |
| cid | Got it. tks | 15:15 |
| TheJulia | cid: no, thank you! | 15:20 |
| cid | ;) | 15:22 |
| opendevreview | Verification of a change to openstack/ironic master failed: Trivial: Enable disabling tftp setup https://review.opendev.org/c/openstack/ironic/+/941742 | 15:29 |
| opendevreview | Verification of a change to openstack/ironic master failed: ci: focus ironic-tempest-bios-ipmi-direct-tinyipa https://review.opendev.org/c/openstack/ironic/+/942204 | 15:36 |
| opendevreview | Satoshi Shirosaka proposed openstack/ironic-python-agent master: WIP Add ContainerHardwareManager https://review.opendev.org/c/openstack/ironic-python-agent/+/941714 | 15:44 |
| opendevreview | cid proposed openstack/ironic-tempest-plugin master: Test double encoding of error message https://review.opendev.org/c/openstack/ironic-tempest-plugin/+/935740 | 15:51 |
| Sandzwerg[m] | <TheJulia> "Sandzwerg: checkout https://..." <- You gotta love vendors for not upstreaming things š but that might be helpful, thanks for sharing. We try to use the redfish driver right now and some things work but deployments fail. However that seems to be a network thing, not entirely sure and haven't had too much time to look into that. I think I need to make some time eventually as we will get some of them (we only have a | 15:54 |
| Sandzwerg[m] | single node for testing so far). So far, not a fan. | 15:54 |
| TheJulia | I think the challenge is the took the line and merged it with their flexline | 15:57 |
| TheJulia | so in essence they muddied the waters | 15:57 |
| Sandzwerg[m] | I'm not sure how they looked before but I'm sure what we'll get would have been considered a Superdome even before. Iirc hpe is the only vendor to offer 16 socket machines and for reasons I don't know and don't agree with we still try to solve developing issues with bigger hardware instead of a different software architecture so no way around them. š« | 16:03 |
| Sandzwerg[m] | But hey apparently my company is one big reason vendors still offer 8 socket machines so, yay. | 16:04 |
| cardoe | Anyone know where in the config drive creation we'd prefix the path data with /var/lib/cloud/seed/config_drive ? | 16:31 |
| dtantsur | cardoe: I don't think we do. It looks like a mount point of cloud-init or something | 16:32 |
| cardoe | okay cause the anaconda kickstart stuff prefixes /var/lib/cloud/seed/config_drive to the data it gets from configdrive when it parses it. | 16:33 |
| cardoe | The tests validate that the path is prefixed with /var/lib/cloud/seed/config_drive | 16:33 |
| cardoe | But comically stuff is being written to /var/lib/cloud/seed/config_drive/var/lib/cloud/seed/config_drive/<blah> | 16:33 |
| cardoe | So the tests pass. | 16:33 |
| JayF | Sandzwerg[m]: I do know people who have versions of that hardware in production, but I don't believe it's running the off-the-shelf HP config w/r/t BMC. | 16:34 |
| cardoe | ah ignore me. I see it. | 16:34 |
| JayF | Sandzwerg[m]: so that's /probably/ not helpful for you but at least any data point at all | 16:35 |
| cardoe | When we read the ISO data we prefix that path. Then when we create the kickstart metadata we always prefix that path again. | 16:35 |
| Sandzwerg[m] | JayF: It's certainly interesting. Did they wrote their own BMC or is there a possiblity to use something else like openBMC or so_ | 16:37 |
| Sandzwerg[m] | s/so_/so?/ | 16:37 |
| JayF | Sandzwerg[m]: I'm going to dm you. | 16:37 |
| opendevreview | cid proposed openstack/ironic master: Follow-up: Apply Inspection Rules https://review.opendev.org/c/openstack/ironic/+/942112 | 16:38 |
| opendevreview | cid proposed openstack/ironic master: API/Testing: Inspection rules migration https://review.opendev.org/c/openstack/ironic/+/939217 | 16:38 |
| Sandzwerg[m] | hmm cardoe are you still looking for something to build vmware images? | 16:44 |
| cardoe | Yeah that would be great. Cause right now I'm tweaking the anaconda deploy interface to do VMware ESXi | 16:46 |
| Sandzwerg[m] | OK I'll DM you | 16:47 |
| TheJulia | cardoe: docs please! :) | 16:54 |
| rpittau | good night! o/ | 17:07 |
| opendevreview | Vasyl Saienko proposed openstack/ironic master: Do not review debug multinode https://review.opendev.org/c/openstack/ironic/+/942725 | 17:15 |
| JayF | cardoe: your comment on 2099276 is concerning | 17:22 |
| TheJulia | it actually makes sense mechanics wise | 17:27 |
| JayF | how is it okay if it bypasses an authorization check though? | 17:31 |
| JayF | that's why I'm concerned | 17:31 |
| TheJulia | the top level object is controlled by the entity who made it public. They point to ID values which they would need to know | 17:33 |
| TheJulia | beyond that, it is up to glance to enforce that access or not. | 17:33 |
| TheJulia | our check is purely around community comfort. | 17:34 |
| JayF | that makes sense | 17:34 |
| TheJulia | do we "trust" glance, do we "trust" users using community images, etc. | 17:36 |
| JayF | Is it wrong of me to assume Ironic is responsible for image security when we're using an ironic credential to interact with that image? | 17:37 |
| TheJulia | so, you have to delineate when ironic is using it's own token, or if it is re-using the requestor's context. | 17:38 |
| TheJulia | for example, user request comes in | 17:39 |
| TheJulia | we have their context (\o/) | 17:39 |
| JayF | I assumed at that stage of a anaconda deployment the user token would be gone; that's a bad assumption then | 17:39 |
| TheJulia | we download items and things using that context | 17:39 |
| TheJulia | we then release the lock and go into deploywait | 17:39 |
| JayF | so in cardoe's case that is either his token (standalone) or the nova compute's credential | 17:40 |
| TheJulia | we front load all of that artifact work stupidly early on | 17:40 |
| JayF | which calls us in an admin context unconditionally in the nova driver | 17:40 |
| TheJulia | That should be correct, yes | 17:40 |
| TheJulia | Going back to the policy check, that was a human preference of making sure rando user doesn't deploy rando artifact of evil | 17:41 |
| JayF | this seems circular to me then; are we saying it's the nova compute's job to enforce use of that token being sane? | 17:41 |
| * TheJulia creates CentosForEvil1.0 | 17:41 | |
| JayF | I'm more concerned about I published an image with secrets because I am bad at cloud | 17:41 |
| JayF | then someone in another tenant sees the secrets in that image | 17:42 |
| TheJulia | We can't be the ones to defend against that if a user does something stupid bad, which is in part why the public check requriement is there | 17:42 |
| TheJulia | so the admin has to be okay with the public artifact | 17:42 |
| TheJulia | which the *user* has requested, that admin can then say "this also needs x,y,z things as well" | 17:42 |
| TheJulia | in this case, nova uses an admin context to ironic which means it does run with admin privs :\ | 17:43 |
| TheJulia | but, we require public in the fall-through | 17:43 |
| TheJulia | or the owner to match | 17:43 |
| TheJulia | does that make sense? | 17:43 |
| JayF | this is where I cricle around to why is it okay then, in cardoe's case, that we used a nonpublic image? Just because it's ID was included in metadata on a public image? | 17:43 |
| JayF | since the token/context used to access those nonpublic images was the compute token from nova | 17:44 |
| JayF | not a user token | 17:44 |
| opendevreview | Kaifeng Wang proposed openstack/ironic master: [Trivial] Fix typo of exception error message https://review.opendev.org/c/openstack/ironic/+/927024 | 17:53 |
| opendevreview | Doug Goldstein proposed openstack/ironic master: doc: updates to anaconda deploy interface https://review.opendev.org/c/openstack/ironic/+/942839 | 18:03 |
| cardoe | JayF: I'm just reporting the behavior. I don't have enough know how to say what's good or bad. | 18:04 |
| JayF | Clearly I don't either :) | 18:04 |
| cardoe | TheJulia: ^ there's my initial take at the doc updates. The standalone section and the standalone repository section aren't something I've tested but just reading how it says it works, I would strongly doubt it. | 18:05 |
| cardoe | stage2 and/or stage_id is a HARD requirement. | 18:11 |
| cardoe | Trying to figure out if https://zuul.opendev.org/t/openstack/build/7d5bf59e260a469286999d53ee8e1af9 is really a failure in that patch? I don't think so because it seems like things just timeout based on the error but reading the conductor logs that instance went active and it's just failing waiting for it to teardown? | 18:18 |
| opendevreview | Verification of a change to openstack/ironic master failed: Trivial: Enable disabling tftp setup https://review.opendev.org/c/openstack/ironic/+/941742 | 18:37 |
| opendevreview | Julia Kreger proposed openstack/ironic-tempest-plugin master: CI: Dial back the non-voting jobs https://review.opendev.org/c/openstack/ironic-tempest-plugin/+/942846 | 18:37 |
| opendevreview | Vasyl Saienko proposed openstack/ironic master: Do not review debug multinode https://review.opendev.org/c/openstack/ironic/+/942725 | 19:02 |
| opendevreview | Doug Goldstein proposed openstack/ironic master: anaconda: more flexible config_drive in kickstart https://review.opendev.org/c/openstack/ironic/+/942849 | 19:10 |
| cardoe | And there's more docs and updates to give me enough breadcrumbs to make this work. | 19:12 |
| opendevreview | Doug Goldstein proposed openstack/ironic master: doc: updates to anaconda deploy interface https://review.opendev.org/c/openstack/ironic/+/942839 | 19:22 |
| opendevreview | Doug Goldstein proposed openstack/ironic master: anaconda: more flexible config_drive in kickstart https://review.opendev.org/c/openstack/ironic/+/942849 | 19:28 |
| cardoe | Did I do the co-author header correct? | 19:32 |
| opendevreview | Julia Kreger proposed openstack/ironic master: WIP: hooking in an external network simulator https://review.opendev.org/c/openstack/ironic/+/942298 | 19:44 |
| TheJulia | cardoe: looks like it | 19:48 |
| TheJulia | JayF: that check only runs against the image in image_source, not subsequent images retrieved to support specific interfaces/uses. In large part around the contracted behavior of image_source | 19:49 |
| TheJulia | cardoe: most likely there is some sort of networking problem we've not pinned down which is causing the jobs to log aggressively and because we have jobs... like that one, which are running everything and the kitchen sink, its near imposisble for us to figure out what is really going on | 19:51 |
| cardoe | Sandzwerg[m]: don't tease me with VMware info and then not message me. :( | 19:51 |
| TheJulia | which is also why I put in a change to turn down what that test executes *and* turned down the aggressiveness around short retry intervals creating large amounts of logging | 19:51 |
| TheJulia | but... something needs to pass first to get those in | 19:51 |
| opendevreview | Vasyl Saienko proposed openstack/networking-generic-switch master: Add vlan aware VMs support https://review.opendev.org/c/openstack/networking-generic-switch/+/928490 | 20:04 |
| Sandzwerg[m] | <cardoe> "Sandzwerg: don't tease me with..." <- I did, didn't you saw my messages? I'm not sure how good it works as I'm in via matrix but I could read your messages. And JayF was able to read my messages as well. You should have a email | 20:29 |
| JayF | yeah, I was surprised it worked earlier tbh | 20:29 |
| cardoe | hmm nope got nothing in irccloud | 20:30 |
| cardoe | ah I do have email. thank you! | 20:30 |
| Sandzwerg[m] | Weird. Hope it helps you. It's Apache licensed but I'm probably not going to follow the proper open source process as I hope I don't need to use it anymore sooner or later. Might be more or less adjusted to our use case but should at least give you some ideas what could work. I might be able to answer questions but the main work was done by an es colleague, I just try to keep it running | 20:35 |
| cardoe | I'm totally appreciative. This is definitely helpful. Anything that either shows a similar path or a dissimilar path is helpful validation as well. | 20:42 |
| cardoe | JayF: I can confirm with the latest version of my glance metadata fix patch the image_properties is much shorter now | 21:56 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!