| opendevreview | Buddhika Sanjeewa proposed openstack/kolla-ansible master: Deploy Zun with Cinder Ceph support https://review.opendev.org/c/openstack/kolla-ansible/+/824722 | 02:39 |
|---|---|---|
| opendevreview | Buddhika Sanjeewa proposed openstack/kolla-ansible master: Deploy Zun with Cinder Ceph support https://review.opendev.org/c/openstack/kolla-ansible/+/824722 | 02:43 |
| opendevreview | Buddhika Sanjeewa proposed openstack/kolla-ansible master: Deploy Zun with Cinder Ceph support https://review.opendev.org/c/openstack/kolla-ansible/+/824722 | 03:15 |
| frickler | yoctozepto: mnasiadka: checking https://review.opendev.org/c/openstack/openstack-manuals/+/825171 I noticed that kolla is also still commented out for xena. I guess we want to fix that and also update our release process to include this? I can propose a similar patch for k-a if you agree | 07:12 |
| yoctozepto | frickler: yeah, let's do it, thanks for noticing | 08:09 |
| opendevreview | jinyuanliu proposed openstack/kolla-ansible master: ADD venus for kolla-ansible https://review.opendev.org/c/openstack/kolla-ansible/+/793897 | 08:34 |
| frickler | yoctozepto: wow, you were fast with reviewing, I was just adding some questions https://review.opendev.org/c/openstack/openstack-manuals/+/825266 | 08:38 |
| frickler | we can of course amend in a followup if needed, also deal with older releases | 08:39 |
| opendevreview | likui proposed openstack/kolla-ansible master: Use Docker healthchecks for ironic-neutron-agent services https://review.opendev.org/c/openstack/kolla-ansible/+/817706 | 08:43 |
| opendevreview | Radosław Piliszek proposed openstack/kolla-ansible master: [CI] Test Ironic when touching Neutron https://review.opendev.org/c/openstack/kolla-ansible/+/825289 | 10:06 |
| opendevreview | Radosław Piliszek proposed openstack/kolla-ansible master: Use Docker healthchecks for ironic-neutron-agent services https://review.opendev.org/c/openstack/kolla-ansible/+/817706 | 10:06 |
| opendevreview | Radosław Piliszek proposed openstack/kolla-ansible master: Use Docker healthchecks for ironic-neutron-agent services https://review.opendev.org/c/openstack/kolla-ansible/+/817706 | 10:06 |
| mgoddard | yoctozepto: do I remember you having a dnm patch to switch to host libvirt? | 13:20 |
| yoctozepto | mgoddard: not one that I heard of! | 13:36 |
| yoctozepto | only this one about stricter insulation https://review.opendev.org/c/openstack/kolla-ansible/+/794262 | 13:36 |
| yoctozepto | it seems not to change behaviour | 13:36 |
| yoctozepto | might be fixing polkit for parallax but I think he did not finish testing it | 13:37 |
| parallax | no, sorry | 13:43 |
| mgoddard | yoctozepto: worth a try | 13:51 |
| ironfoot | Somehow just enabling `kolla_enable_tls_external` doesn't redirect horizon to https://. I was expecting that to be enough, but looks like https:// will only work if i also set `kolla_enable_tls_internal` | 14:30 |
| ironfoot | Is that right? | 14:30 |
| spatel | guys help me with command line. | 14:54 |
| spatel | can i restart all container start with or regex with keystone using command like this docker restart --filter keystone ? | 14:54 |
| hrw | meeting? | 15:00 |
| yoctozepto | mgoddard mnasiadka hrw egonzalez yoctozepto rafaelweingartne cosmicsound osmanlicilegi bbezak parallax Fl1nt frickler adrian-a | 15:00 |
| yoctozepto | meeting | 15:00 |
| yoctozepto | #startmeeting kolla | 15:00 |
| opendevmeet | Meeting started Wed Jan 19 15:00:40 2022 UTC and is due to finish in 60 minutes. The chair is yoctozepto. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:00 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:00 |
| opendevmeet | The meeting name has been set to 'kolla' | 15:00 |
| yoctozepto | #topic Roll-call | 15:00 |
| yoctozepto | o/ | 15:00 |
| o_horecny2 | o/ | 15:01 |
| mgoddard | \o | 15:01 |
| halomiva | \o | 15:01 |
| hrw | /o] | 15:01 |
| hinermar | o/ | 15:01 |
| yoctozepto | crowds today, welcome! | 15:02 |
| yoctozepto | #topic Agenda | 15:02 |
| yoctozepto | * Roll-call | 15:02 |
| yoctozepto | * Agenda | 15:02 |
| yoctozepto | * Announcements | 15:02 |
| yoctozepto | * Review action items from the last meeting | 15:02 |
| yoctozepto | * CI status | 15:02 |
| yoctozepto | * Release tasks | 15:02 |
| yoctozepto | * Current cycle planning | 15:02 |
| yoctozepto | * Additional agenda (from whiteboard) | 15:02 |
| yoctozepto | * Open discussion | 15:02 |
| yoctozepto | #topic Announcements | 15:02 |
| yoctozepto | I got my 3rd vaccine last weekend | 15:02 |
| yoctozepto | vaccine shot* | 15:02 |
| yoctozepto | and have no other announcements :-) | 15:03 |
| hrw | yoctozepto: good! | 15:03 |
| yoctozepto | hrw: :-0 | 15:03 |
| yoctozepto | :-) * | 15:03 |
| yoctozepto | (typos, typos everywhere :D ) | 15:03 |
| mgoddard | congrats | 15:03 |
| yoctozepto | mgoddard: yeah, though I feel more like "please accept my condolences" for the time being | 15:04 |
| hrw | welcome to the club etc | 15:04 |
| yoctozepto | anyhow, no announcements - we be moving forward | 15:04 |
| yoctozepto | #topic Review action items from the last meeting | 15:04 |
| hrw | my 2nd and 3rd dose went same way - all fine, arm hurting 2-3 days | 15:04 |
| yoctozepto | mnasiadka to triage security bugs and update them with resolution plan (if needed) | 15:05 |
| yoctozepto | mnasiadka post a patch for docs - standard topics that should be discussed over PTG and then revisited in mid-cycle | 15:05 |
| yoctozepto | kevko to let frickler know whether osism's solution is fine for his use case | 15:05 |
| yoctozepto | hrw: I wish it was arm only :-) | 15:05 |
| yoctozepto | kevko is not around | 15:05 |
| yoctozepto | mnasiadka not around either | 15:05 |
| yoctozepto | and they likely did not do these | 15:06 |
| yoctozepto | restating | 15:06 |
| yoctozepto | #action mnasiadka to triage security bugs and update them with resolution plan (if needed) | 15:06 |
| yoctozepto | #action mnasiadka post a patch for docs - standard topics that should be discussed over PTG and then revisited in mid-cycle | 15:06 |
| yoctozepto | #action kevko to let frickler know whether osism's solution is fine for his use case | 15:06 |
| yoctozepto | #topic Release tasks | 15:06 |
| yoctozepto | oopsie | 15:06 |
| yoctozepto | #undo | 15:06 |
| opendevmeet | Removing item from minutes: #topic Release tasks | 15:06 |
| yoctozepto | #topic CI status | 15:06 |
| yoctozepto | so, regarding CI | 15:07 |
| yoctozepto | we had one fire | 15:07 |
| yoctozepto | in the centos department | 15:07 |
| yoctozepto | a good followup would be to deprecate this department | 15:07 |
| yoctozepto | but I know some like it enough to endure all the pain | 15:07 |
| hrw | ping one? | 15:07 |
| yoctozepto | anyhow, the fire has been extinguished | 15:07 |
| yoctozepto | we can sip our sodas and watch the CI work again | 15:08 |
| yoctozepto | hrw: yeah | 15:08 |
| yoctozepto | so... that would be the status for k and k-a | 15:08 |
| yoctozepto | I've seen k-o-b stuff merging as well | 15:08 |
| yoctozepto | so would assume it's good too | 15:08 |
| yoctozepto | any kayobian to confirm? | 15:08 |
| priteau_ | Maybe some stable branches of kayobe are still be broken | 15:09 |
| priteau_ | s/be // | 15:09 |
| yoctozepto | ack | 15:09 |
| yoctozepto | please update the whiteboard when you feel like it | 15:10 |
| yoctozepto | #topic Release tasks | 15:10 |
| yoctozepto | it's R-10 | 15:11 |
| yoctozepto | still waiting for R-8: "Switch binary images to current release" | 15:11 |
| yoctozepto | nothing else to report | 15:11 |
| yoctozepto | #topic Current cycle planning | 15:11 |
| yoctozepto | in here we can already tackle the "additional agenda" as it's related today | 15:11 |
| hrw | I tested R-8 situation and images are buildable | 15:11 |
| yoctozepto | (o.horecny2) Podman support | 15:11 |
| yoctozepto | hrw: oh, great! finally some good news :-) | 15:12 |
| o_horecny2 | Hi guys, we would like to move forward with Podman things | 15:12 |
| yoctozepto | o_horecny2 halomiva hinermar ^^ | 15:13 |
| yoctozepto | on podman | 15:13 |
| yoctozepto | you wrote: | 15:13 |
| yoctozepto | Asking for code review: | 15:13 |
| yoctozepto | DockerWorker class refactor - https://review.opendev.org/c/openstack/kolla-ansible/+/823783 | 15:13 |
| yoctozepto | Systemd container control - https://review.opendev.org/c/openstack/kolla-ansible/+/816724 | 15:13 |
| yoctozepto | Next steps? | 15:13 |
| yoctozepto | Deadline? | 15:13 |
| yoctozepto | code freeze for Yoga release | 15:13 |
| yoctozepto | it's good to remind ourselves it's one of major priorities for this cycle | 15:13 |
| mgoddard | Kolla feature freeze: Mar 21 - Mar 25 | 15:13 |
| o_horecny2 | yes, we would like to ask you about some code review, because we have already prepared change with podman on top of this changes | 15:14 |
| yoctozepto | and we can have an exception if we *really* need it | 15:14 |
| yoctozepto | but this should be merged by the next ptg in april | 15:14 |
| mgoddard | I would suggest that we aim for systemd managed docker in yoga | 15:14 |
| yoctozepto | so that we can throw a little podman party | 15:14 |
| mgoddard | (just setting expectations based on past team review performance) | 15:15 |
| yoctozepto | hmm | 15:15 |
| mgoddard | bear in mind that podman might bring such questions as 'how to install it', 'how to migrate from docker to podman' | 15:16 |
| mgoddard | does that seem like a reasonable target? | 15:16 |
| o_horecny2 | in case that change with docker managed by systemd is ok for you then we have same thing with podman. | 15:16 |
| mgoddard | feel free to propose your podman change | 15:17 |
| mgoddard | but I would suggest that we focus review effort on the systemd patch | 15:17 |
| o_horecny2 | yes, I understand. That is what we would like to focus now, but firsly we need to know that way how it is prepared is ok for you | 15:17 |
| yoctozepto | mgoddard: we can have a preview | 15:17 |
| yoctozepto | with no migration path | 15:17 |
| mgoddard | possibly, although that is an easy way to end up with unfinished features :) | 15:18 |
| yoctozepto | I can action myself to review these patches | 15:18 |
| o_horecny2 | halomiva hinermar what do you think? Do you expect some troubles with migration? | 15:18 |
| mgoddard | same | 15:18 |
| yoctozepto | mgoddard: I think it is possible to end up the other way around - people losing interest because of yet another cycle | 15:19 |
| mgoddard | one issue may be with having both podman and docker installed | 15:19 |
| yoctozepto | #action yoctozepto to review going-podman patches | 15:19 |
| yoctozepto | #action mgoddard to review going-podman patches | 15:19 |
| hinermar | i believe you can't have both docker and podman installed simutaneously | 15:19 |
| yoctozepto | mgoddard, hinermar: last time I checked they can work side by side | 15:20 |
| yoctozepto | but we should not mix the containers this way | 15:20 |
| mgoddard | I've seen troubles with containers | 15:20 |
| mgoddard | *containerd | 15:20 |
| yoctozepto | yeah, something could misbehave, though I think they put things in containerd in two different namespaces | 15:21 |
| yoctozepto | or whatever containerd calls that internal isolation | 15:21 |
| yoctozepto | yup | 15:21 |
| yoctozepto | https://github.com/containerd/containerd/blob/main/docs/namespaces.md | 15:21 |
| yoctozepto | the biggest issue I see is with volumes | 15:22 |
| mgoddard | +1 | 15:22 |
| yoctozepto | especially those multi-mounted ones | 15:22 |
| yoctozepto | because for single-mounted ones one can create a simple migration path | 15:23 |
| yoctozepto | but for multi-mounted it's not possible | 15:23 |
| yoctozepto | so we need to down all containers with that mount | 15:23 |
| yoctozepto | migrate volume | 15:23 |
| yoctozepto | and redo them | 15:23 |
| yoctozepto | restart* | 15:23 |
| yoctozepto | which might be trickier than you think | 15:23 |
| yoctozepto | :-) | 15:23 |
| yoctozepto | thankfully we run host networking so no "fun" there | 15:24 |
| o_horecny2 | that is right, so we need to test and try to find some trail | 15:25 |
| hinermar | I take it we should prevent users from having both managers and create migration tasks, right? | 15:25 |
| yoctozepto | hinermar: we need to figure out a sensible migration path | 15:26 |
| mgoddard | yes - if we ever have both installed it should only be for migration | 15:26 |
| yoctozepto | but my take on that is that it's important, that's true, but should not prevent us from supporting podman for new installations | 15:27 |
| o_horecny2 | yes, that is right | 15:28 |
| mgoddard | I wouldn't want to paint us into a corner though | 15:28 |
| mgoddard | anyway, let's see how we get on with systemd | 15:29 |
| yoctozepto | indeed | 15:30 |
| o_horecny2 | Do you guys think that this can be done inside upgrade action? Or should be for that prepared something new? | 15:30 |
| yoctozepto | btw, the systemd poc is red | 15:30 |
| yoctozepto | on CI | 15:30 |
| mgoddard | o_horecny2: I expect it will need a new action | 15:30 |
| yoctozepto | o_horecny2: I would imagine a separate action | 15:30 |
| yoctozepto | mgoddard ++ | 15:30 |
| o_horecny2 | yoctozepto: yes, some unite tests need to be finished, but guys firstly wanted to know if it is right way and not spend time on something which can be abandoned | 15:32 |
| halomiva | systemd poc was reverted to version without container worker so you can decide if you want to go with abstract class or not | 15:33 |
| yoctozepto | ah, ok | 15:34 |
| mgoddard | I think abstract class probably makes sense when we introduce podman | 15:34 |
| o_horecny2 | mgoddard: yes, it is preparation for podman | 15:35 |
| mgoddard | but it's not necessary for systemd, and it's hard to see what the interface should be without podman | 15:35 |
| o_horecny2 | so do you think that this abstract class patchset is not needed now? And we should focus onlu on systemd patchset? | 15:37 |
| mgoddard | +1 - focus on systemd | 15:37 |
| mgoddard | we can return to the container worker afterwards | 15:37 |
| yoctozepto | +1 | 15:37 |
| o_horecny2 | and what next? implement podman on top of systemd? or thirstly do that refactoring with abstract class? | 15:38 |
| o_horecny2 | *firstly | 15:38 |
| o_horecny2 | I mean this flow systemd change -> abstract class -> podman ? | 15:39 |
| mgoddard | I'd just share the podman patch that you have, whichever way it is | 15:39 |
| mgoddard | that is probably the right order | 15:39 |
| mgoddard | but we need to see the podman patch to review the abstract class patch | 15:39 |
| halomiva | now we have 3 version capable of basic deployment, docker worker + systemd worker, docker worker + container worker + systemd worker, podman worker + docker worker + container worker + systemd worker | 15:40 |
| o_horecny2 | with that abstract class or without it? because I believe that when we introduce podman together with abstract class, then you will want to split it again :) | 15:40 |
| halomiva | should we push all of them and then we decide what we want to do first? | 15:40 |
| yoctozepto | halomiva: that works for me | 15:41 |
| mgoddard | if you have a patch that is separate already, then push that | 15:41 |
| o_horecny2 | ok, so halomiva and hinermar do you know what to do next? | 15:42 |
| o_horecny2 | is it clear for you? | 15:43 |
| halomiva | yes | 15:43 |
| hinermar | yes | 15:44 |
| o_horecny2 | #action halomiva/hinermar propose change for podman | 15:45 |
| yoctozepto | #action halomiva/hinermar propose change for podman | 15:45 |
| yoctozepto | thanks o_horecny2 halomiva hinermar | 15:45 |
| yoctozepto | #topic Open discussion | 15:45 |
| o_horecny2 | thanks too | 15:46 |
| mgoddard | on the secure RBAC front, there is this one: https://review.opendev.org/c/openstack/kolla-ansible/+/815577 | 15:46 |
| mgoddard | adds the service role to service users | 15:47 |
| mgoddard | I started a discussion on the ML about it | 15:47 |
| yoctozepto | yeah, seen the hi | 15:47 |
| mgoddard | #link http://lists.openstack.org/pipermail/openstack-discuss/2022-January/026777.html | 15:47 |
| yoctozepto | :D | 15:47 |
| mgoddard | fat fingered the first one | 15:48 |
| yoctozepto | #link http://lists.openstack.org/pipermail/openstack-discuss/2022-January/026777.html | 15:48 |
| mgoddard | essentially, keystone gonna break us if we do nothing | 15:48 |
| mgoddard | so we should do something | 15:48 |
| mgoddard | unclear right now when they will change the default for enforce_scopes | 15:49 |
| mgoddard | just putting it out there | 15:50 |
| mgoddard | we can discuss in the ML, or on the patch | 15:50 |
| yoctozepto | we can save ourselves for the time being by pinning keystone of course | 15:51 |
| yoctozepto | but yeah, we need to address this | 15:51 |
| yoctozepto | I am lacking the time resources to handle it though | 15:51 |
| yoctozepto | I think we are out of other topics today | 15:53 |
| mgoddard | +1 | 15:54 |
| yoctozepto | thank you all for attending | 15:55 |
| yoctozepto | and see you next time | 15:55 |
| yoctozepto | #endmeeting | 15:55 |
| opendevmeet | Meeting ended Wed Jan 19 15:55:14 2022 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:55 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/kolla/2022/kolla.2022-01-19-15.00.html | 15:55 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/kolla/2022/kolla.2022-01-19-15.00.txt | 15:55 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/kolla/2022/kolla.2022-01-19-15.00.log.html | 15:55 |
| mgoddard | thanks yoctozepto | 15:56 |
| opendevreview | James Kirsch proposed openstack/kolla-ansible master: Add service role to service users https://review.opendev.org/c/openstack/kolla-ansible/+/815577 | 17:30 |
| opendevreview | Mark Goddard proposed openstack/kolla-ansible master: libvirt: make it possible to disable nova_libvirt container https://review.opendev.org/c/openstack/kolla-ansible/+/825357 | 17:42 |
| opendevreview | Mark Goddard proposed openstack/kolla-ansible master: libvirt: make it possible to disable nova_libvirt container https://review.opendev.org/c/openstack/kolla-ansible/+/825357 | 17:46 |
| opendevreview | Mark Goddard proposed openstack/kayobe master: libvirt: deploy libvirt on the host https://review.opendev.org/c/openstack/kayobe/+/825359 | 17:47 |
| opendevreview | James Kirsch proposed openstack/kolla-ansible master: Enable Keystone scope enforcement https://review.opendev.org/c/openstack/kolla-ansible/+/825406 | 23:14 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!