| *** sapd1_y has quit IRC | 02:05 | |
| *** sapd1_y has joined #openstack-lbaas | 02:05 | |
| *** rcernin has quit IRC | 02:58 | |
| *** rcernin has joined #openstack-lbaas | 03:13 | |
| *** rcernin has quit IRC | 03:27 | |
| *** rcernin has joined #openstack-lbaas | 03:36 | |
| *** rcernin has quit IRC | 03:39 | |
| *** rcernin has joined #openstack-lbaas | 03:39 | |
| *** sapd1 has joined #openstack-lbaas | 03:55 | |
| *** vishalmanchanda has joined #openstack-lbaas | 04:23 | |
| *** gcheresh has joined #openstack-lbaas | 04:44 | |
| *** ianychoi__ has joined #openstack-lbaas | 04:48 | |
| *** gregraka has quit IRC | 04:48 | |
| *** sapd1_y has quit IRC | 04:48 | |
| *** sapd1_x has joined #openstack-lbaas | 04:48 | |
| *** gregraka2 has joined #openstack-lbaas | 04:48 | |
| *** ianychoi_ has quit IRC | 04:50 | |
| *** sapd1 has quit IRC | 05:04 | |
| *** xgerman has quit IRC | 05:23 | |
| *** yamamoto has quit IRC | 05:56 | |
| *** yamamoto has joined #openstack-lbaas | 06:31 | |
| *** yamamoto has quit IRC | 06:38 | |
| *** yamamoto has joined #openstack-lbaas | 06:38 | |
| *** rcernin has quit IRC | 07:15 | |
| *** rpittau|afk is now known as rpittau | 07:35 | |
| *** yamamoto has quit IRC | 07:40 | |
| *** luksky has joined #openstack-lbaas | 07:40 | |
| *** yamamoto has joined #openstack-lbaas | 07:49 | |
| openstackgerrit | zhangboye proposed openstack/python-octaviaclient master: Use py3 as the default runtime for tox https://review.opendev.org/c/openstack/python-octaviaclient/+/787140 | 07:58 |
|---|---|---|
| *** yamamoto has quit IRC | 08:03 | |
| *** rcernin has joined #openstack-lbaas | 08:17 | |
| *** rcernin has quit IRC | 08:39 | |
| *** yamamoto has joined #openstack-lbaas | 08:43 | |
| *** yamamoto has quit IRC | 08:57 | |
| *** vishalmanchanda has quit IRC | 09:52 | |
| *** psachin has joined #openstack-lbaas | 10:01 | |
| openstackgerrit | Gregory Thiemonge proposed openstack/octavia-tempest-plugin master: Fix owner_or_admin API tests https://review.opendev.org/c/openstack/octavia-tempest-plugin/+/787177 | 10:04 |
| *** rpittau is now known as rpittau|bbl | 10:04 | |
| *** rcernin has joined #openstack-lbaas | 10:10 | |
| *** ccamposr__ has quit IRC | 10:14 | |
| *** ccamposr__ has joined #openstack-lbaas | 10:14 | |
| *** rcernin has quit IRC | 10:17 | |
| *** yamamoto has joined #openstack-lbaas | 10:19 | |
| *** rcernin has joined #openstack-lbaas | 10:24 | |
| *** yamamoto has quit IRC | 10:25 | |
| *** zzzeek has quit IRC | 10:42 | |
| *** zzzeek has joined #openstack-lbaas | 10:43 | |
| *** vishalmanchanda has joined #openstack-lbaas | 10:49 | |
| *** yamamoto has joined #openstack-lbaas | 10:57 | |
| *** rcernin has quit IRC | 10:58 | |
| *** yamamoto has quit IRC | 11:03 | |
| *** rcernin has joined #openstack-lbaas | 11:23 | |
| *** masterpe has joined #openstack-lbaas | 11:40 | |
| masterpe | We use magnum to build k8s clusters, when using inbound with port 80 and 443 on a Octavia Amphora loadbalancer, some times the haproxy config in the Amphora lb gets mess up. Probably when k8s sends a update with 0 changes for the pool. My feeling is that https://review.opendev.org/c/openstack/octavia/+/782342 will fix this issue. Can I install this patch on a Train cluster. | 11:55 |
| *** gregraka2 is now known as gregraka-afk | 11:55 | |
| *** rcernin has quit IRC | 11:55 | |
| openstackgerrit | Carlos Goncalves proposed openstack/octavia stable/ussuri: Fix empty Batch Member Update to unlock objects https://review.opendev.org/c/openstack/octavia/+/787190 | 11:58 |
| gthiemonge | cgoncalves: thanks ;-) | 11:58 |
| cgoncalves | gthiemonge, were you also working on the backport? | 11:58 |
| masterpe | In http://eavesdrop.openstack.org/meetings/octavia/2020/octavia.2020-04-15-16.01.log.html#l-70 it is stated that https://review.opendev.org/#/c/711275/ has a requirement for octavia-lib in version 1.5.0+ | 11:58 |
| cgoncalves | couple of merge conflicts on stable/train. if you were already working on that, I can stop | 11:59 |
| gthiemonge | cgoncalves: nop, I was looking at the story | 11:59 |
| gthiemonge | masterpe: cgoncalves is backporting the fix to stable/train | 12:03 |
| masterpe | ah, nice. I'm I right that this patch solve the issue that the amphora mixes the diffrents pools into one haproxy backend? | 12:11 |
| *** gregraka-afk is now known as gregraka | 12:12 | |
| gthiemonge | masterpe: not sure, this patch fixes an issue with the provisioning status of the load balancer | 12:16 |
| gthiemonge | masterpe: what happens in your case? an invalid/weird haproxy configuration file? | 12:16 |
| masterpe | yes, after on update the pool with 0 changes. We get a mixed of multiple backends | 12:23 |
| masterpe | in the haproxy | 12:23 |
| cgoncalves | I'm not sure it is feasible to backport the patch to stable/train. it seems it to depend on https://review.opendev.org/c/openstack/octavia/+/688548 which as not backportable to stable/train either | 12:29 |
| icey | anybody have an idea why I might see Details: {'code': 403, 'message': 'You are not authorized to perform the requested action: identity:list_role_assignments.', 'title': 'Forbidden'}(full trace: https://pastebin.ubuntu.com/p/2rnzVs2xy4/) running tempest octavia_tempest_plugin.tests.scenario.v2.test_traffic_ops.TrafficOperationsScenarioTest? Running 89 other tests seems fine, and the tempest config has an admin credentials configured with https:// | 12:29 |
| icey | pastebin.ubuntu.com/p/nM47WsyGKG/ | 12:29 |
| masterpe | cgoncalves: That why i'm asking, 782342 is rework of 688548. | 12:32 |
| cgoncalves | masterpe, right. it also depends on a non-backportable octavia-lib change | 12:33 |
| cgoncalves | folks downstream could get creative and workaround the issue, I think | 12:34 |
| gthiemonge | icey: probably related to this change https://review.opendev.org/c/openstack/octavia-tempest-plugin/+/776817 | 12:35 |
| gthiemonge | icey: please check the release note, there's probably a tempest config issue: https://review.opendev.org/c/openstack/octavia-tempest-plugin/+/776817/5/releasenotes/notes/Add-RBAC-scoped-tokens-tests-920aa35faf4a8c9d.yaml | 12:36 |
| *** rpittau|bbl is now known as rpittau | 12:37 | |
| icey | gthiemonge: so I should expect TrafficOperationsScenarioTest to fail with a fairly basic loac_balancer config in the tempest.conf? | 12:41 |
| *** rcernin has joined #openstack-lbaas | 12:42 | |
| icey | would it be worth adding in `enforce_scope.octavia`? | 12:43 |
| gthiemonge | icey: no it should not fail | 12:44 |
| icey | gthiemonge: would you expect it to work correctly on Ussuri (as that's where I'm hitting this) - would I have better luck with a newer release? (not that I won't have to figure out how to get it passing on ussuri as well at some point) | 12:45 |
| gthiemonge | yeah it is strange that os_admin client fails | 12:45 |
| icey | right before the access error in Keystone's logs, I also see `UserWarning: Policy identity:list_role_assignments failed scope check. The token used to make the request was project scoped but the policy requires ['system', 'domain'] scope. This behavior may change in the future where using the intended scope is required` | 12:46 |
| *** rcernin has quit IRC | 12:46 | |
| johnsom | Yeah, so we added that because otherwise tempest doesn't log the roles assigned to the credentials tempest creates. This makes debugging nearly impossible with all of the keystone role changes going on. | 12:47 |
| johnsom | So, icey, yes, you seem to be running keystone with scope checking, but tempest that doesn't have the scopes added? | 12:48 |
| icey | johnsom: awesome that the rest of a tempest smoke run doesn't have issues with this :) | 12:49 |
| johnsom | I would check your tempest version first, make sure it is up to date. If so, then ask in the #openstack-qa channel how to setup that admin credential to have the required system scope. | 12:49 |
| icey | johnsom: fresh from master ;-) | 12:49 |
| johnsom | Yeah, that part is confusing to me as each tempest run should dump that list of roles.... | 12:50 |
| johnsom | It's in the base class for every tempest test.... | 12:50 |
| icey | it seems like that line's a warning, followed by a hard error, and I don't usually go through logs when tests pass /shrug | 12:50 |
| johnsom | Keystone changed this scope requirement in queens if I remember right | 12:50 |
| johnsom | But recently they turned on checking the scope in a bunch of places | 12:51 |
| icey | it doesn't look like my keystone has `enforce_scope = true`, so I'm confused about how I'd be walking into this :-/ | 12:54 |
| icey | (/me is tempted to override the policy to allow whatever, as the purpose of my testing isn't to validate RBAC< but to validate, in this moment, Octavia in Ubuntu :-P | 12:54 |
| icey | ) | 12:55 |
| johnsom | Yeah, It's been hard for me too. The changes are all over the place, keystone, keystoneauth, oslo, tempest | 12:55 |
| johnsom | Yeah, as a work around, you could disable that accounts.yaml override and run the test | 12:55 |
| icey | I'm also using 1 point release back on Ussuri, so not super fresh OpenStack bits | 12:56 |
| icey | johnsom: you expect that it'd work with no accounts.yaml set? | 12:56 |
| icey | should I add in `use_dynamic_credentials = true` as well? | 12:57 |
| johnsom | I do. This is a tempest issue, probably they require something special when using the accounts.yaml override file for the new scopes stuff | 12:57 |
| johnsom | I would just leave it the defaults personally | 12:57 |
| icey | will try that next! | 12:58 |
| icey | and will also let you know how it goes, it'll be nice to get regular Octavia point releaess into Ubuntu with more validation :) | 12:58 |
| icey | s/releaess/releases/ | 12:58 |
| johnsom | +1 | 12:59 |
| johnsom | icey This seems related: https://review.opendev.org/c/openstack/tempest/+/773173 | 13:00 |
| johnsom | I would ask your question in #openstack-qa. The two people that would know how to fix your admin credential hang out there. | 13:00 |
| icey | should have still been getting that fix as I really enjoy my clean venvs and the requirements.txt is pointing at github | 13:01 |
| icey | johnsom: the part that's driving me insane is that it's only this one octavia test that's failing :-/ | 13:01 |
| *** psachin has quit IRC | 13:22 | |
| *** gcheresh has quit IRC | 13:38 | |
| *** vishalmanchanda has quit IRC | 13:39 | |
| *** vishalmanchanda has joined #openstack-lbaas | 13:47 | |
| zigo | Excuse me, but what is octavia-housekeeping for? | 14:21 |
| zigo | I never ran it, and the Octavia service seemed working well anyways... | 14:22 |
| zigo | johnsom: ^ | 14:22 |
| johnsom | Periodic jobs. It cleans old database records, rotates the certificates issued to the amphora when they come close to expiration, manage the spares pool, etc. | 14:22 |
| johnsom | Without it your database tables will grow forever and your amphora will eventually drop off the network as they will no longer be trusted. | 14:23 |
| johnsom | It's been a part of the service since day one... | 14:24 |
| johnsom | Day one/Juno, lol | 14:24 |
| *** gcheresh has joined #openstack-lbaas | 14:25 | |
| icey | johnsom: still no luck, I think these are all of the relevant bits for the Octavia tempest test, wonder if you see anything: https://pastebin.ubuntu.com/p/v4z2t6rfbJ/ | 14:29 |
| zigo | johnsom: Ok, I'll fix my puppet then ! :) | 14:29 |
| zigo | Thanks. | 14:29 |
| johnsom | icey Yeah, it's the "auth" section I think. That is overriding some of the tempest defaults which I am guessing isn't doing the scope stuff keystone requires. Best place to ask is #openstack-qa | 14:30 |
| johnsom | I would ask in that channel "The tempest default os_admin account can no longer list roles in keystone with scope errors. How to I fix that? Here is my tempest config" | 14:32 |
| johnsom | That should probably get you started over there. | 14:32 |
| icey | johnsom: I think I'll quote you directly on that | 14:35 |
| icey | :-D | 14:37 |
| johnsom | Please do, lol | 14:37 |
| *** sapd1 has joined #openstack-lbaas | 14:39 | |
| *** rcernin has joined #openstack-lbaas | 14:42 | |
| *** rcernin has quit IRC | 14:48 | |
| *** sapd1 has quit IRC | 14:49 | |
| johnsom | icey I was hoping to not confuse them with a specific test as it's really not test related. | 14:53 |
| *** sapd1 has joined #openstack-lbaas | 15:04 | |
| openstackgerrit | Adam Harwell proposed openstack/octavia master: Alias change amphorav2 -> amphora https://review.opendev.org/c/openstack/octavia/+/740432 | 15:33 |
| *** rcernin has joined #openstack-lbaas | 15:50 | |
| *** rcernin has quit IRC | 15:55 | |
| *** gcheresh has quit IRC | 16:11 | |
| *** rpittau is now known as rpittau|afk | 16:59 | |
| *** rcernin has joined #openstack-lbaas | 17:51 | |
| *** rcernin has quit IRC | 17:56 | |
| *** luksky has quit IRC | 18:21 | |
| *** luksky has joined #openstack-lbaas | 18:21 | |
| *** vishalmanchanda has quit IRC | 19:09 | |
| *** luksky has quit IRC | 19:33 | |
| *** luksky has joined #openstack-lbaas | 19:33 | |
| *** gcheresh has joined #openstack-lbaas | 19:34 | |
| openstackgerrit | Michael Johnson proposed openstack/octavia master: Add Octavia performance guide and 2vcpu flavor https://review.opendev.org/c/openstack/octavia/+/787286 | 19:41 |
| *** rcernin has joined #openstack-lbaas | 19:45 | |
| *** gcheresh has quit IRC | 19:55 | |
| openstackgerrit | Greg Rakauskas proposed openstack/octavia master: Edits for "Operator Maintenance Guide" https://review.opendev.org/c/openstack/octavia/+/787287 | 20:38 |
| *** rcernin has quit IRC | 20:48 | |
| openstackgerrit | Greg Rakauskas proposed openstack/octavia master: Edits for "Operator Maintenance Guide" https://review.opendev.org/c/openstack/octavia/+/787287 | 21:00 |
| *** jamesdenton has quit IRC | 21:11 | |
| openstackgerrit | Greg Rakauskas proposed openstack/octavia master: Edits for "Operator Maintenance Guide" https://review.opendev.org/c/openstack/octavia/+/787287 | 21:21 |
| *** rcernin has joined #openstack-lbaas | 21:30 | |
| *** rcernin has quit IRC | 21:38 | |
| *** yamamoto has joined #openstack-lbaas | 22:01 | |
| *** yamamoto has quit IRC | 22:15 | |
| *** yamamoto has joined #openstack-lbaas | 22:16 | |
| *** rcernin has joined #openstack-lbaas | 22:21 | |
| *** rcernin has quit IRC | 22:26 | |
| *** rcernin has joined #openstack-lbaas | 22:39 | |
| *** rcernin has quit IRC | 22:44 | |
| *** rcernin has joined #openstack-lbaas | 22:46 | |
| *** rcernin has quit IRC | 22:53 | |
| *** rcernin has joined #openstack-lbaas | 22:53 | |
| *** luksky has quit IRC | 23:22 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!