Tuesday, 2021-12-14

opendevreviewJeffrey Zhang proposed openstack/kolla-ansible master: Continue to run all actions if one action failed in curator  https://review.opendev.org/c/openstack/kolla-ansible/+/82163301:07
opendevreviewlixuehai proposed openstack/kolla-ansible master: Add logrotate configuration for placement service  https://review.opendev.org/c/openstack/kolla-ansible/+/82164202:04
opendevreviewMichal Nasiadka proposed openstack/kolla stable/ussuri: Ensure nvme-cli is present in nova-compute images  https://review.opendev.org/c/openstack/kolla/+/82117306:51
*** amoralej|off is now known as amoralej08:15
opendevreviewMichal Nasiadka proposed openstack/kolla stable/ussuri: Add Swift lock path in Swift containers  https://review.opendev.org/c/openstack/kolla/+/81889508:22
opendevreviewMichal Nasiadka proposed openstack/kayobe master: WIP: Use openstack-ci-mirrors in ipa image build  https://review.opendev.org/c/openstack/kayobe/+/82167508:49
kevko\o/09:09
shyambHi09:24
shyambenable_horizon variable is not uncommented in my globals.yml file09:25
shyambstill horizon service is getting deployed09:25
shyambHere is my globals.yml file: https://paste.openstack.org/show/811647/09:26
guesswhat guys? its not possible to reload haproxy with docker kill -s HUP haproxy ( when cert is changed for example ), its here https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/loadbalancer/templates/haproxy/haproxy.json.j2#L2, but seems its fixed for tripleo https://review.opendev.org/c/openstack/tripleo-heat-templates/+/504412/, any chance to fix this ?09:27
holtgreweshyamb: try placing `false` there or `"no"`09:27
shyambholtgrewe: Hi, I am looking for a variable which indicates if horizon is installed or not09:28
shyambI relied on 'enable_horizon' variable and it turns to be not defined09:29
shyambeven if horizon is installed.09:29
holtgreweshyamb: https://opendev.org/openstack/kolla-ansible/src/branch/master/etc/kolla/globals.yml#L32209:38
holtgreweprobably you can use `{{ enable_horizon | default(enable_openstack_core) }}`?09:39
opendevreviewMerged openstack/kolla stable/ussuri: Ensure nvme-cli is present in nova-compute images  https://review.opendev.org/c/openstack/kolla/+/82117309:45
kevkoshyamb: i have wallaby branch cloned ..and if I set enable_horizon: "no" ..it's not going to be installed .. so..you have something somewhere bad :D 09:51
shyambkevko: okay09:52
shyambLet me re-verify09:52
holtgreweBut if the default of enable_horizon is true then this would explain the behaviour?09:54
shyambholtgrewe: Yes10:04
shyambIssue looks something else10:04
shyambOne more query here, how can I access this condition on some other role than horizon:  inventory_hostname in groups[horizon.group]10:04
shyamblooks like this horizon group variable is defined in horizon defaults yaml10:05
shyamband only accessible to horizon role10:05
shyambI want to access it in my role10:05
holtgreweyou could in dumping all variables where you want to access it10:05
holtgreweI'm not sure how to do this with ansible10:06
holtgrewemaybe host vars?10:06
shyambholdgrewe: I have written one more role for our trilio service.10:06
shyambit's horizon plugin10:06
shyambSo, we just want to execute our code on horizon nodes only10:07
shyambIs there any way that one service's inventory group variable can be accessed in other service's role? 10:08
shyamblike, If I want to use nova.group in cinder ansible role, how can I use that?10:09
holtgreweshyamb: depends on the architecture of your ansible code10:12
holtgreweyou probably need to use the same inventory as for kolla?10:14
opendevreviewMichal Nasiadka proposed openstack/kayobe master: WIP: Use openstack-ci-mirrors and centos-minimal in ipa image build  https://review.opendev.org/c/openstack/kayobe/+/82167510:28
guesswhatwhat is difference between kolla and kolla-ansible launchpad ? i need to report a bug. thanks10:41
mgoddardguesswhat: kolla for images, kolla-ansible for ansible10:42
opendevreviewMark Goddard proposed openstack/kolla-ansible stable/victoria: Revert "CI: Temporarily disable rabbitmq internal tls"  https://review.opendev.org/c/openstack/kolla-ansible/+/77914811:00
opendevreviewDr. Jens Harbott proposed openstack/kolla master: Cap elasticsearch gem for fluentd  https://review.opendev.org/c/openstack/kolla/+/82169512:12
ignaziocassanoHELLO Evveryone, please I'd like to know in l2gw is supported in kolla 12:16
holtgreweDoes anyone successfully boot baremetal compute hosts with UEFI? I somehow get "bootx64.efi" from the neutron DHCP server to boot from but that file is present nowhere on my controllers.12:26
ignaziocassanoHello Everyone,please I'd like to know if opendaylight and l2gw are supported in kolla12:29
kevkoyoctozepto: i was checking "Modernize swift role" review you've already commented some time ago 12:34
kevkoright now I'm trying to tempest kolla built swift ..12:34
kevkoand it's working on 90 percent ..found some bugs in configuration ..12:34
kevkoand probably i will also change few things ..12:34
kevkoso, then we should merge that "Modernize swift role" 12:35
*** amoralej is now known as amoralej|lunch13:16
guesswhatmgoddard: i am not sure, where to create issue... can you help, please?  its not possible to reload haproxy with docker kill -s HUP haproxy ( when cert is changed for example ), its here https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/loadbalancer/templates/haproxy/haproxy.json.j2#L2, but seems its fixed for tripleo https://review.opendev.org/c/openstack/tripleo13:18
guesswhat-heat-templates/+/504412/, any chance to fix this ?13:18
mgoddardguesswhat: sounds like a kolla-ansible issue, please raise on launchpad13:22
kevkomgoddard: 3 days i'm trying to figure out why "swift capabilities" command is not working and getting 401 unauthorized 13:26
kevkomgoddard: now I found that kolla added option swift_delay_auth_decision: "False" to swift ...13:26
kevkomgoddard: https://bugs.launchpad.net/kolla/+bug/1768795 << 13:26
mgoddardkevko: rings a bell13:26
kevkowhy this option is not set to true ? :/ ? 13:27
kevkomgoddard: i've just pushed you, because you are author of last comment :P 13:29
guesswhatmgoddard: ty, i created https://bugs.launchpad.net/kolla-ansible/+bug/1954774 13:32
mgoddardkevko: there is probably a reason why we did not change the default, but I don't remember it13:34
mgoddardand don't really have time to check now13:34
mgoddardhave to looked at relevant gerrit reviews and commit messages?13:35
kevkomgoddard: yes :D - this is in commit message -> Added delay_auth_decision config option for swift13:43
kevkoThe authtoken config variable delay_auth_decision must be set to True.13:43
kevkoThe default is False, but that breaks public access, StaticWeb, FormPost,13:43
kevkoTempURL, and authenticated capabilities requests (using Discoverability).13:43
kevko"must be set to true"13:43
kevkobut kolla has default false 13:44
kevkowhich is same as before it was merged (because not present in config is the same - default value )13:44
mgoddardkevko: if it's that simple then there wouldn't be an option13:44
kevkomgoddard: well, i think kolla decided to preserve false and make it optional for users ..13:45
kevkobecause when it's true .. swift capabilities works (which show various info about swift stack)13:45
mgoddardkevko: clearly, yes - but what I'm saying is that there is probably some tradeoff - otherwise swift would just make it default to true13:46
mgoddardso we need to understand what that is13:46
kevkomgoddard: https://docs.openstack.org/mitaka/config-reference/object-storage/proxy-server.html << 13:46
kevkomgoddard: delay_auth_decision defaults to False, but leaving it as false will prevent other auth systems, staticweb, tempurl, formpost, and ACLs from working. This value must be explicitly set to True.13:46
kevkoofficial swift docs13:46
mgoddardkevko: " This value must be explicitly set to True." != "This value must be set to True."13:47
kevkomgoddard: ok, so question is, does kolla want to prevent other auth systems, staticweb, tempurl, formpost, and ACLs from working or NOT ? 13:49
fricklerkevko: IMHO the real question is: does kolla want to be backwards compatible? if yes, then the current solution is correct afaict13:51
kevkofrickler: ./ansible/roles/swift/defaults/main.yml:swift_delay_auth_decision: "{{ enable_swift_s3api | bool }}"13:51
kevko./ansible/group_vars/all.yml:enable_swift_s3api: "no"13:51
kevko./etc/kolla/globals.yml:#enable_swift_s3api: "no"13:51
kevkoFunny is, that if I was turned on s3api ..that option is True13:52
fricklerhmm, that's a weird combo indeed13:53
kevko:D 13:53
kevkoyeah :D 13:53
kevkothat's the reason why I am asking ..13:53
kevkobecause it looks like there is no argument to not have it set to True13:53
kevko1. False - discoverability is not working - 401 from swift, required refstack-client tests are not working (needed for openstack certification on Market place - so it's quite big argument), case only if s3api is turned off13:55
kevko1. True - discoverability is working - 200 from swift, required refstack-client testr are passing and everything is OK , only if S3api is turned on 13:55
kevko*213:55
kevkoso, If i turn s3api ..I secretly fix other issues ? That's weird .. :D 13:56
fricklerI really don't know enough about swift to judge and I also don't understand why anyone is using it at all, but likely changing the default together with an upgrade warning should be possible then13:56
kevkoif it is not problem for case when s3api is turned on ..let's set to true so both cases are working ..and leave it optional so user can change it ..and add reno 13:57
kevkofrickler: don't forget that we have more bright jewelry in kolla :D - freezer for example :D 13:58
*** amoralej|lunch is now known as amoralej14:04
holtgreweCould someone look into their ironic_pxe container into /tftboot and tell me which *.efi files they see. Somehow, neutron ironic agent wants snponly.efi but I have ipxe-snponly-x86_64.efi...14:13
kevkoopenstack-swift channel >>14:22
kevko<kevko> delay_auth_decision is this dangerous in swift ? 14:22
kevko<kevko> or why it is default false ? 14:22
kevko<kevko> i found that if it is false ..discoverability not working 14:22
kevko<zaitcev> IIRC it defaults to false because tempauth does not need it, so SAIO works without. But basically all it does is letting 2 auths coexist, or have an auth that has 2 middlewares like authtoken (obtains the tokens) and keystone (makes the decision).14:22
kevko<zaitcev> So it's "delayed" in a sense that it invokes the auth hook after all the middlewares had a chance to execute.14:22
kevko<zaitcev> But of course it occurs before the request proceeds.14:22
holtgreweIt looks like the ironic-conductor image does not have the "genisoimage" installed. This looks similar to https://bugs.launchpad.net/kolla/+bug/168622716:17
holtgreweHm, probably I'll just file a bug report. https://bugs.launchpad.net/kolla/+bug/195480816:22
*** amoralej is now known as amoralej|off17:26
*** hrww is now known as hrw19:23

Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!