| * nibalizer dissapear | 00:03 | |
| nibalizer | sorry clark | 00:03 |
|---|---|---|
| *** yolanda has quit IRC | 00:07 | |
| *** dfflanders has quit IRC | 00:08 | |
| clarkb | such snow | 00:31 |
| *** rfolco has quit IRC | 01:07 | |
| *** maximo1 has joined #openstack-sprint | 01:25 | |
| *** maximo1 has left #openstack-sprint | 01:27 | |
| med_ | snow is a good thing | 02:25 |
| med_ | unless you have to walk back to your hotel in it | 02:25 |
| med_ | and don't have the right shoes | 02:25 |
| *** baoli has quit IRC | 02:34 | |
| *** baoli has joined #openstack-sprint | 02:35 | |
| *** baoli has quit IRC | 03:36 | |
| fungi | meh, it was solid in the air but liquid on the ground. sandals were just fine | 03:49 |
| *** yolanda has joined #openstack-sprint | 04:17 | |
| *** mrmartin has joined #openstack-sprint | 05:40 | |
| *** mrmartin has quit IRC | 05:45 | |
| *** mrmartin has joined #openstack-sprint | 05:51 | |
| *** mrmartin has quit IRC | 06:08 | |
| *** mrda has quit IRC | 07:32 | |
| *** lucas-dinner is now known as lucasagomes | 09:27 | |
| *** mrmartin has joined #openstack-sprint | 11:14 | |
| *** gabriel has left #openstack-sprint | 11:30 | |
| *** rfolco has joined #openstack-sprint | 11:42 | |
| *** rfolco has quit IRC | 11:50 | |
| *** rfolco has joined #openstack-sprint | 11:51 | |
| *** lucasagomes is now known as lucas-hungry | 12:16 | |
| *** mrmartin has quit IRC | 12:27 | |
| *** baoli has joined #openstack-sprint | 13:20 | |
| *** baoli_ has joined #openstack-sprint | 13:21 | |
| *** baoli has quit IRC | 13:24 | |
| *** lucas-hungry is now known as lucasagomes | 13:26 | |
| *** mrmartin has joined #openstack-sprint | 13:39 | |
| *** mrmartin has quit IRC | 13:46 | |
| *** krtaylor has quit IRC | 14:01 | |
| *** jesusaurus has joined #openstack-sprint | 14:24 | |
| *** jesusaurus has quit IRC | 14:32 | |
| *** mrmartin has joined #openstack-sprint | 14:53 | |
| *** yolanda has quit IRC | 15:24 | |
| crinkle | pleia2: https://review.openstack.org/#/c/208751/57/hiera/group/baremetal.yaml is the list of machines | 15:52 |
| pleia2 | crinkle: thank you! | 15:52 |
| *** yolanda has joined #openstack-sprint | 15:57 | |
| yolanda | clarkb https://review.openstack.org/#/c/275477/ ? | 16:00 |
| *** dfflanders has joined #openstack-sprint | 16:05 | |
| rcarrillocruz | do we have a clouds.yaml already on the west jumphost? | 16:07 |
| clarkb | rcarrillocruz: no, we put it on the puppetmaster | 16:08 |
| rcarrillocruz | ok, so nothing cowboy'd | 16:08 |
| clarkb | which is what that change above does | 16:08 |
| rcarrillocruz | reviewing | 16:08 |
| clarkb | rcarrillocruz: I think some people may have personal clouds.yaml but I am not aware of a global one | 16:08 |
| *** rockstar has joined #openstack-sprint | 16:12 | |
| rockstar | o/ | 16:13 |
| *** krtaylor has joined #openstack-sprint | 16:13 | |
| pleia2 | rockstar is local to us :) we don't have dinner plans for tonight yet, I think some folks were looking at breweries (but nothing was open Mondays) | 16:14 |
| Clint | well, coopersmith's was open | 16:19 |
| rockstar | Yeah, Coops is kinda the old standby. | 16:20 |
| *** yolanda has quit IRC | 16:21 | |
| *** yolanda has joined #openstack-sprint | 16:22 | |
| nibalizer | openstack user set project openstackjenkins openstackjenkins | 16:24 |
| clarkb | nibalizer: yolanda rcarrillocruz https://review.openstack.org/283671 | 16:25 |
| clarkb | nibalizer: what about openstackci? | 16:25 |
| clarkb | nibalizer: since that is where we will be booting the mirror here shortly | 16:26 |
| nibalizer | clarkb: i ran th ecommand there too | 16:26 |
| nibalizer | openstack user set --project openstackci openstackci | 16:26 |
| clarkb | kk thanks | 16:26 |
| nibalizer | hiera is set and the projects/users/tenants are set | 16:27 |
| clarkb | nibalizer: we should just need https://review.openstack.org/283671 then https://review.openstack.org/#/c/275477/ then we can boot a mirror | 16:27 |
| clarkb | yolanda: rcarrillocruz ^ | 16:27 |
| *** mrmartin has quit IRC | 16:28 | |
| clarkb | and those two changes will conflict | 16:28 |
| clarkb | I will rebase | 16:28 |
| nibalizer | ok | 16:30 |
| yolanda | nibalizer i put a -1 in https://review.openstack.org/#/c/275485, for the same infra domain issue | 16:30 |
| yolanda | i can fi xit | 16:31 |
| jeblair | mordred: do you have any work in progress to alter launch-node to avoid needing the puppetmaster? | 16:35 |
| mordred | jeblair: I thought that was up on the shade-launch-node patch already | 16:35 |
| mordred | jeblair: ut it's possible I imagined that | 16:36 |
| jeblair | mordred: i don't think i wrote such a thing... | 16:36 |
| mordred | no - I thought I added a patch on top of ... on esec | 16:36 |
| *** yolanda has quit IRC | 16:36 | |
| *** Clint has quit IRC | 16:37 | |
| mordred | https://review.openstack.org/#/c/247099/ | 16:37 |
| mordred | jeblair: ^^ | 16:37 |
| *** Clint has joined #openstack-sprint | 16:37 | |
| jeblair | mordred: awesome, thanks :) | 16:37 |
| rcarrillocruz | mordred: confused, i think we agreed last week we would do tenant/user creation with puppet, rest we would drive it with ansible | 16:38 |
| rcarrillocruz | jeblair telling me you talked about doing all that with ansible? | 16:38 |
| mordred | yes. but I think we can move to that later - I think your tenant creatoin patch in puppet is fine for now | 16:40 |
| rcarrillocruz | alright, so should i continue with user creation in puppet for now, tackle later with ansible? | 16:40 |
| mordred | rcarrillocruz: we also need to create/manage users in blueboxcloud, but we do not puppet that cloud because we do not run it | 16:40 |
| rcarrillocruz | or hjust start with user creation with ansible onwards | 16:40 |
| rcarrillocruz | k, i'll up a role/playbook for user creation | 16:41 |
| rcarrillocruz | system-config, yah? | 16:41 |
| mordred | rcarrillocruz: so the most sensible thing to me is for us to have an ansible playbook that groks our clouds.yaml that verifies the users exist on the clouds where we managed them | 16:41 |
| mordred | yah | 16:41 |
| mordred | then we just add an admin account to clouds.yaml and we've got something that handles both infra-cloud and blueboxcloud | 16:41 |
| pabelanger | regarding shade-launch-node.py, is a future step to convert that directly into an ansible playbook? Or simply continue using it as a python script? | 16:41 |
| jeblair | yeah, i brought it up because it sounded like getting credentials to puppet for the user creation might be a little difficult and didn't want to waste work on that | 16:41 |
| mordred | pabelanger: yes. in the future that will be an ansible playbook | 16:41 |
| rcarrillocruz | fwiw: | 16:42 |
| rcarrillocruz | http://git.openstack.org/cgit/openstack-infra/infra-ansible/tree/roles/setup_openstack_resources/tasks/main.yml | 16:42 |
| rcarrillocruz | i'll push the same role name to system-config, and put users | 16:42 |
| rcarrillocruz | we can pile on it later on for other resources | 16:42 |
| pabelanger | So, I don't have anything to work on ATM. So don't mind hacking on that if needed. | 16:43 |
| *** yolanda has joined #openstack-sprint | 16:46 | |
| clarkb | pabelanger: it is probably worth poking at just because this infra cloud work exposes the holes in how we currently launch things | 16:47 |
| jeblair | crinkle: i have a question in https://review.openstack.org/231757 | 16:49 |
| nibalizer | https://review.openstack.org/275485 | 16:49 |
| nibalizer | please to reviewing | 16:49 |
| yolanda | hi, can you review https://review.openstack.org/#/c/140840 ? that will create infra element, so we can use that element to deploy puppet on our infra cloud | 16:52 |
| crinkle | jeblair: answered and fixing | 16:59 |
| jeblair | mordred: i'm looking at 140840 with yolanda, and i'm struggling with it being in the project-config repo rather than system-config (or really anywhere else)... | 17:05 |
| mordred | jeblair: yes. I do not like it being in project-config | 17:06 |
| mordred | jeblair: but at the time project-config was the only location where we had elements | 17:06 |
| yolanda | crinkle, i answered your comment for neutron parameterized entries | 17:07 |
| nibalizer | do these quotas look right | 17:08 |
| nibalizer | http://paste.openstack.org/show/487920/ ? | 17:08 |
| rcarrillocruz | hmm, mordred, do you know when 'default_project' was added to os_user | 17:10 |
| rcarrillocruz | ? | 17:10 |
| rcarrillocruz | getting "unsupported parameter for module: default_project" on ansible 2.0.0.0 | 17:10 |
| jeblair | mordred: my gut says that "infra elements" should be in system-config, and we should use them in bifrost to build our infra cloud controller/compute images. and then in projcect-config we should count on them being installed (by puppet or whatever) on the nodepool host, and the nodepool config in project-config should say "use the infra elements and also the devstack and git repo etc elements" | 17:11 |
| jeblair | mordred: does that sound reasonable? | 17:11 |
| mordred | jeblair: yes. I think that is an excellent idea | 17:13 |
| crinkle | jeblair: ++ | 17:14 |
| GheRivero | jeblair: +1 | 17:14 |
| fungi | mordred: jeblair: i agree | 17:15 |
| yolanda | sounds good to me | 17:15 |
| fungi | so basically 231757 is a good next step, and then 140840 should be reproposed to system-config | 17:16 |
| jeblair | woot, a way forward. 231757 adds something similar to system-config, so we can probably land that and then build on top of it | 17:16 |
| jeblair | fungi: ya | 17:16 |
| pleia2 | anteaya: https://review.openstack.org/283670 | 17:16 |
| rcarrillocruz | nm | 17:16 |
| rcarrillocruz | pebcak | 17:16 |
| yolanda | mordred, jeblair, i can do some work on that, because on east servers i was depending on that infra element | 17:16 |
| anteaya | pleia2: thanks | 17:17 |
| crinkle | anteaya: https://review.openstack.org/#/c/208751/57/hiera/group/baremetal.yaml | 17:17 |
| anteaya | crinkle: thank you | 17:17 |
| mordred | yolanda, jeblair: once those elements are there and we're happy with them I'll push up an ansible playbook to make and upload base images for all of our clouds using os_image - unless yolanda beats me too it | 17:17 |
| mordred | becuase I think we can make an infra-trusty base image and have it uploaded to all of our openstackci projects and use that as the base image for things we launch with launch-node, yeah? | 17:18 |
| fungi | possibly even have nodepool generate/update those for us in the future, though we'd need to access them in the openstackci tenant and nodepool's uploading images to openstackjenkins so... maybe not | 17:20 |
| nibalizer | http://paste.openstack.org/show/487922/ | 17:20 |
| jeblair | fungi: yeah, we could either trust nodepool some more, or set up a second nodepool just to do those builds | 17:21 |
| yolanda | i'd like the idea to use nodepool for long lived servers as well | 17:22 |
| clarkb | greghanyes is hardcore afk but that was the motivation behind more speration betwee nnodepool and image building | 17:22 |
| clarkb | then you could just have a daemon running wherever updating images for whatever | 17:22 |
| rcarrillocruz | hmm | 17:22 |
| clarkb | and consumers would use the glance api to consume the results | 17:22 |
| rcarrillocruz | isn't shrews around | 17:22 |
| jeblair | clarkb: sure, but no further changes are needed for us to start using nodepool in that manner | 17:23 |
| jeblair | mordred: we're having a conversation about quota -- it seems that not only is there a project quota, but there seem to be user quotas too. i'm not sure i've ever seen this (i don't see it in bluebox).... | 17:24 |
| jeblair | mordred: is this ringing a bell? | 17:24 |
| mordred | yes | 17:24 |
| mordred | so - there are a few things to know here | 17:24 |
| mordred | one is that setting quotas does not error on bad input | 17:24 |
| mordred | so you might be thinking you're setting a quota, but you're not | 17:25 |
| Clint | \o/ | 17:25 |
| clarkb | mordred: nova quotas as a key value service | 17:26 |
| mordred | yes. that is EXACTLY what it is | 17:26 |
| mordred | the parameters tenant-id and user-id are exactly that | 17:26 |
| mordred | they must be the UUID | 17:26 |
| mordred | so nova quota-update --user-id=$USER_UUID --cores 100 $TENANT_UUID | 17:26 |
| mordred | and if you get uuid's wrong, you're just a bad person and nova will lie to you | 17:27 |
| jeblair | mordred: do you know why this doesn't show up in horizon on bluebox? | 17:27 |
| mordred | dunno. by default I tink setting it for tenant is fine | 17:27 |
| mordred | user is an optional overlay on top of it | 17:28 |
| mordred | if it looks like you set it for the tenatn but you do a nova absolute-limits as that user and do not see the quotas updated | 17:28 |
| jeblair | mordred: nibalizer says that has caused problems.... maybe we need to remove a user quota completely? | 17:28 |
| mordred | yah | 17:28 |
| mordred | there's no need for it | 17:28 |
| mordred | it likely means you did not actually increase the tenant quota | 17:28 |
| nibalizer | heh | 17:31 |
| jeblair | mordred: you may want to look at the clouds.yaml in https://review.openstack.org/275485 | 17:31 |
| jeblair | mordred: they keystonev3 usage looks maybe a little rough around the edges, particularly needing to specify the default domain, which is named default... | 17:32 |
| nibalizer | heh | 17:34 |
| nibalizer | so adding the user quota has always been needed in my experience | 17:34 |
| nibalizer | but I can look at deleting it | 17:34 |
| mordred | jeblair: why is the domain named default? | 17:35 |
| nibalizer | okay i have deleted the uqota | 17:35 |
| jeblair | mordred: i'm told keystonev3 requires a domain, and so it creates one, and it names it default, but none of the cliens know that. | 17:35 |
| mordred | SO | 17:36 |
| yolanda | for quotas, i used puppet to set them: https://review.openstack.org/281770 and https://review.openstack.org/283304 did the trick for me | 17:36 |
| mordred | the last time we talked about this I requested that we create a domain called infra and inside of that domain we created the openstackci and openstackjenkins users and tenants | 17:37 |
| crinkle | mordred: why would we not use the default domain for that? | 17:37 |
| mordred | in fact, lasst time I worked with the users in west I in fact created that comain and those users | 17:37 |
| mordred | crinkle: because the default domain is syntactic sugar to help with transitions from keystone v2 | 17:37 |
| mordred | we do not have keystone v2 transitions | 17:37 |
| mordred | so we should create a domain and put our things in it | 17:38 |
| jeblair | it will be really nice to have this in version control | 17:38 |
| crinkle | it is worth noting that the puppet modules have fairly recently added support for v3 and there are still a lot of issues with using non-default domains | 17:38 |
| mordred | yup | 17:39 |
| mordred | I did, in fact, create an infra domain | 17:39 |
| jeblair | because the rumour here in the room was that both users were in a single infra tenant | 17:39 |
| mordred | so - quick terminology thing | 17:39 |
| mordred | users are not in tenants | 17:39 |
| jeblair | which isn't really what we want, but also isn't what you just said you did... | 17:39 |
| mordred | there are constructs called users and projects | 17:39 |
| mordred | projects container resources, such as servers | 17:39 |
| mordred | projects contain resources, such as servers | 17:40 |
| mordred | a user can be granted access to one or more projects | 17:40 |
| mordred | a user and a project each exist inside of a domain | 17:40 |
| jeblair | i understand now. | 17:40 |
| rcarrillocruz | mordred: i missed that domain thing | 17:41 |
| rcarrillocruz | given that i put in puppet tenants creation | 17:41 |
| rcarrillocruz | i'll put the domain as well | 17:42 |
| rcarrillocruz | so those are put on infra domain | 17:42 |
| rcarrillocruz | ? | 17:42 |
| clarkb | rcarrillocruz: yes that is what mordred is asking for | 17:42 |
| rcarrillocruz | k | 17:42 |
| mordred | there is a user and a project called 'infra' in the infra domain that can be removed - that was me poking at this earlier | 17:43 |
| fungi | so user:project is a many:many relationship | 17:43 |
| mordred | yes | 17:43 |
| jeblair | crinkle says the admin user will need to be in the default domain for $puppet-reasons. so i think default domain with admin user; use that to create infra domain with openstackci and openstackjenkins projects and users. | 17:43 |
| fungi | but within the scope of a domain | 17:43 |
| mordred | jeblair: ++ | 17:43 |
| mordred | I think the admin user being in the default domain is a great idea | 17:43 |
| mordred | fungi: actually, a user can be granted access to a project in a different domain | 17:43 |
| fungi | oh, so user:domain is also a many:many | 17:44 |
| jeblair | mordred: dear me. | 17:44 |
| mordred | fungi: a domain is purely a namespace inside of which user and project names are unique | 17:44 |
| mordred | fungi: no | 17:44 |
| mordred | fungi: a user has one and only one domain | 17:44 |
| fungi | but can have access to projects within different domains from its own? | 17:44 |
| fungi | freaky | 17:44 |
| jeblair | internal federation? :) | 17:44 |
| mordred | yes. that is possible - but is more of an admin like thing | 17:45 |
| fungi | so, yeah, just plain namespacing, not limiting scope i guess | 17:45 |
| mordred | it's a way you could have a service user run by something in the cloud that could have the ability to go touch everyone's stuff | 17:45 |
| mordred | like if you wanted a global auditing user that could run reports on the resources in all of the projects in the cloud | 17:45 |
| mordred | normally a consumer of the cloud would have an account that would be a domain admin account | 17:46 |
| mordred | an in that domain they would be free to create users and projects as they want to | 17:46 |
| mordred | without any knowledge or visibility of what's going on in other domains | 17:46 |
| mordred | the ability to grant things across domains is a super specialized thing | 17:46 |
| mordred | one of the reasons, btw, that I want us to make an infra domain is largely so that we can all wrap our heads around this construct | 17:48 |
| mordred | which seems like good future proofing for our thinking | 17:48 |
| clarkb | I mean | 17:48 |
| mordred | and/or any tooling we write - to make sure it deals properly with clouds that are both multi-tenant and give each user a domain | 17:48 |
| clarkb | the chances we ever need multiple domains for namespacing to avoid needing knowledge across projects/users seems to be 0 | 17:48 |
| nibalizer | yep | 17:48 |
| nibalizer | clarkb: has it | 17:48 |
| nibalizer | we have a functional user and quota set now | 17:49 |
| nibalizer | and domain set in patches that are in the process of landing | 17:49 |
| nibalizer | i think we should roll forward and nerd-out on setting up domains in east when that comes online | 17:49 |
| mordred | I disagree | 17:50 |
| mordred | I think we should delete the user and project in the default domain | 17:50 |
| mordred | recreate them in the infra domain that has existed the entire time | 17:50 |
| mordred | and set their quota | 17:51 |
| *** lucasagomes has left #openstack-sprint | 17:52 | |
| nibalizer | so the issue with that is that we then have to wait for patches to pull out domain and replace it with infra | 17:53 |
| rcarrillocruz | mordred, nibalizer, clarkb: https://review.openstack.org/283717 | 17:55 |
| nibalizer | ok | 17:55 |
| nibalizer | i will set the user to the infra domain | 17:55 |
| nibalizer | clrark will manually change allclouds.yaml and boot up a mirror | 17:56 |
| clarkb | and propose the change to record the manual changes | 17:56 |
| crinkle | mordred: yolanda I don't understand https://review.openstack.org/#/c/280720/ , isn't /increasing/ max-connections what we did to fix "too many connections" error? i.e. https://review.openstack.org/#/c/256897/ | 17:56 |
| mordred | sorry for the churn - thanks for humoring me on this everybody | 17:57 |
| jeblair | mordred: as bikesheds go it's not the worst | 17:57 |
| yolanda | ah the commit message was misleading... | 17:57 |
| mordred | crinkle, yolanda: the commit message is bad | 17:57 |
| clarkb | my grump is mostly I have argued with keystone over this directly | 17:57 |
| yolanda | yep, going to amend it | 17:57 |
| clarkb | and its incredibly confusing without proper docs and doesn't make sense to the vast majority of your users | 17:58 |
| clarkb | it is good for complicated ogs | 17:58 |
| clarkb | *orgs | 17:58 |
| clarkb | its the neutron network problem all over again | 17:58 |
| mordred | clarkb: sure. but it is the way that it is and us ignoring it and pretending that we're still running keystone v2 is not going to solve anything | 17:58 |
| yolanda | so crinkle, we are talking about that and sounded that reduce the mysql connections first, to the recommended settings was good, then we need to add some changes to nova, neutron... to reduce the connection attemps, and some extra mysql tuning | 17:59 |
| mordred | so bringing the need for better docs is a great outcome we can produce | 17:59 |
| crinkle | yolanda: okay | 18:00 |
| yolanda | crinkle i'll put that one in -w because there are more settings that need to be tuned there, reducing the connections without actually optimizing some other settings can be even worse | 18:02 |
| jeblair | mordred: how should i run openstackclient on puppetmaster? | 18:02 |
| mordred | jeblair: what do you mean? | 18:04 |
| jeblair | mordred: well, we have instructions on how to use virtualenvs to run various commands, for example https://git.openstack.org/cgit/openstack-infra/system-config/tree/launch/README | 18:05 |
| crinkle | yolanda: cool wfm | 18:06 |
| jeblair | mordred: do we have a venv for openstackclient....or what? | 18:06 |
| mordred | jeblair: we do not - perhaps we should make one | 18:06 |
| mordred | jeblair: or, maybe we should just install python-openstackclient since we have shade globally installed in support of openstack inventory anyway | 18:06 |
| *** mrmartin has joined #openstack-sprint | 18:07 | |
| jeblair | mordred: maybe we already have that? | 18:07 |
| mordred | jeblair: oh - look there - we do | 18:07 |
| nibalizer | mordred: jeblair clarkb http://paste.openstack.org/show/487928/ | 18:08 |
| nibalizer | does that look the way we want | 18:08 |
| mordred | jeblair: https://review.openstack.org/283729 | 18:09 |
| mordred | nibalizer: brilliant | 18:09 |
| Clint | yolanda: for http proxy use http://web-proxy.houston.hp.com:8080/ and for all other tcp traffic you can use http://socks-server.fc.hp.com:1080/ | 18:10 |
| Clint | or for your web browser you can use the PAC at http://autocache.hp.com/ | 18:10 |
| yolanda | thx i'll try | 18:11 |
| Clint | well, actually not all other tcp traffic; you should be able to use ports 22 and 443 without a proxy | 18:12 |
| clarkb | jeblair: mordred nibalizer https://review.openstack.org/283733 does the s/default/infra/ | 18:15 |
| *** yolanda has quit IRC | 18:18 | |
| rcarrillocruz | clarkb, nibalizer: mind reviewing https://review.openstack.org/#/c/283717/ ? | 18:24 |
| rcarrillocruz | the users change i will need to rebase onto that one | 18:25 |
| nibalizer | more users/project/domains: http://paste.openstack.org/show/487931/ | 18:25 |
| nibalizer | mordred: plz to review | 18:25 |
| crinkle | I would like to land https://review.openstack.org/#/c/266902 nowish, which will require destroying the three currently active nodes and deleting the existing subnet, is that reasonable or are mirrors etc too far down the road? | 18:25 |
| *** mrmartin has quit IRC | 18:25 | |
| rcarrillocruz | mordred: i'm thinking we should probably split http://git.openstack.org/cgit/openstack-infra/infra-ansible/tree/roles/setup_openstack_resources into its own openstack-infra/setup_openstack_resources repo | 18:26 |
| rcarrillocruz | what you think? | 18:26 |
| rcarrillocruz | then we would put a play on system-config for all clouds we care about | 18:26 |
| rcarrillocruz | that role would need to be refactored to have cloud specific resources | 18:26 |
| rcarrillocruz | like per-cloud servers/keypairs/networks/flavors/blah | 18:27 |
| jeblair | clarkb: lgtm | 18:29 |
| jeblair | clarkb, mordred, nibalizer: https://review.openstack.org/283739 adds the infracloud admin user to all-clouds | 18:29 |
| fungi | are we ready to merge 208751 as well? lgtm and already has another +2, previous comments seem addressed, dependency is merged... | 18:30 |
| pabelanger | rcarrillocruz: I prefer we prefix with ansible-role, but breaking out is good | 18:31 |
| clarkb | jeblair: it is actually wrong for other reasons | 18:34 |
| clarkb | "the request yo uhave made requires authentication" | 18:34 |
| clarkb | which doesn't indicate if auth failed or was simply not attempted | 18:34 |
| mordred | jeblair: fwiw ... if we want to - os-client-config supports local vendor profiles | 18:35 |
| mordred | jeblair: so we could make an infracloud east and infracloud west profile file and drop them on puppetmaster and nodepool containing auth_url, identity_api_version, auth_type and cacert settings | 18:35 |
| mordred | jeblair: and reference those by name in our clouds.yaml | 18:36 |
| mordred | not important | 18:37 |
| clarkb | mordred: if you can inspect openstackci-infracloud-west in /etc/openstack/all-clouds.yaml and tell me if anything looks from which would result in "the request yo uhave made requires authentication" that may be helpful | 18:38 |
| clarkb | since I think what is on disk is correct (puppet is not correct) | 18:38 |
| clarkb | I am running `OS_CLIENT_CONFIG_FILE=/etc/openstack/all-clouds.yaml openstack --os-cloud openstackci-infracloud-west --os-region-name RegionOne --debug catalog list` | 18:38 |
| mordred | clarkb: kk. doing now | 18:38 |
| clarkb | but flavor list results in the same thing | 18:38 |
| clarkb | is it possible the cacert thing isn't working? | 18:39 |
| clarkb | let me try with --insecure | 18:39 |
| clarkb | nope that didn't change the output | 18:39 |
| mordred | clarkb: | 18:39 |
| mordred | username: | 18:40 |
| mordred | password: | 18:40 |
| mordred | project_name: | 18:40 |
| mordred | those are empty in /etc/openstack/all-clouds.yaml | 18:40 |
| clarkb | mordred: thats the wrong one | 18:40 |
| clarkb | that is openstackjenkins (known problem) | 18:40 |
| mordred | oh. ci. one sec | 18:40 |
| mordred | sorry | 18:40 |
| clarkb | np I was confused initially myself | 18:40 |
| *** baoli_ has quit IRC | 18:45 | |
| mordred | clarkb: there was no role assignment | 18:48 |
| mordred | clarkb: I just ran this by hand: | 18:48 |
| mordred | openstack role add --user b93e0f20dbd84fd8a1e7a46ca086aac7 --project 352c2a7cd67f4633a8b520214f938577 _member_ | 18:48 |
| mordred | as the admin user | 18:49 |
| mordred | that granted the _member_ role on the openstackci project to the openstackci user | 18:49 |
| mordred | I'm not sure how we're doing that with config management at the moment | 18:50 |
| mordred | I have done: openstack role add --user 7dbe0f121e424a74be2eed25399e2c75 --project 894a11e0a16a4c29bb8b884c1c70bf2c _member_ | 18:51 |
| clarkb | mordred: rcarrillocruz has some changes but it was manual | 18:51 |
| mordred | which is the same for openstackjenkins | 18:51 |
| mordred | k | 18:51 |
| clarkb | mordred: if I run the command I get the same error fwiw | 18:52 |
| clarkb | so that may be a thing but is not the oonly thing | 18:54 |
| clarkb | 2016-02-23 18:53:46.405 14134 TRACE keystone.auth.controllers DomainNotFound: Could not find domain: infra | 18:56 |
| *** mrmartin has joined #openstack-sprint | 18:57 | |
| nibalizer | https://review.openstack.org/#/c/208751/60/hiera/group/baremetal.yaml | 18:58 |
| * clarkb tries to figure out how to list domains | 18:59 | |
| mordred | clarkb: sorry | 19:01 |
| mordred | clarkb: I made one change locally that I did not propagate | 19:02 |
| mordred | clarkb: it's project_domain_name and user_domain_name not id | 19:02 |
| mordred | infra is the name of the domain, not the id of the domain | 19:02 |
| clarkb | ok I can make that update | 19:02 |
| mordred | 'default' is 'special' because it's not created with openstack domain create - it's injected into the db - so default is both its name and its id | 19:02 |
| clarkb | thank you | 19:02 |
| fungi | aha, and otherwise the "id" would have to be a uuid? | 19:03 |
| mordred | yah | 19:03 |
| fungi | magical | 19:03 |
| mordred | for some reason the unversioned keystone url is not working | 19:03 |
| mordred | ah. there we go | 19:03 |
| *** mrmartin has quit IRC | 19:04 | |
| mordred | clarkb: are you editing the file by hand or via puppet? | 19:04 |
| mordred | clarkb: nm. I see the patch :) | 19:05 |
| clarkb | mordred: both, 283733 but manually editing to test before pushing tons of stuff | 19:05 |
| clarkb | ok that got it working | 19:06 |
| clarkb | so 283733 should eb what we need | 19:06 |
| clarkb | then once nibalizer and crinkle say it is safe we can boot a mirror node | 19:07 |
| rcarrillocruz | clarkb: are we good to land https://review.openstack.org/#/c/283717/ | 19:12 |
| rcarrillocruz | ? | 19:12 |
| *** yolanda has joined #openstack-sprint | 19:13 | |
| clarkb | rcarrillocruz: I think that is a better question for crinkle and nibalizer | 19:13 |
| clarkb | rcarrillocruz: it seems fine but I am not sure | 19:13 |
| rcarrillocruz | crinkle: ^ | 19:13 |
| crinkle | rcarrillocruz: i think it's good | 19:17 |
| nibalizer | has anyone set quotas on the users? | 19:17 |
| nibalizer | I have not | 19:17 |
| nibalizer | rcarrillocruz: lgpm | 19:17 |
| nibalizer | lgtm | 19:18 |
| *** sivaramakrishna has joined #openstack-sprint | 19:30 | |
| crinkle | this is a potentially scary change that would happen when 208751 lands: Notice: /Stage[main]/Ansible/Package[ansible]/ensure: current_value 1.9.4, should be 2.0.0.2 (noop) | 19:30 |
| crinkle | nibalizer: this is a bug https://review.openstack.org/283766 | 19:41 |
| nibalizer | crinkle: on what host | 19:45 |
| *** sivaramakrishna has quit IRC | 19:45 | |
| pabelanger | crinkle: do any of your bifrost roles / playbooks use the ansible_user / ansible_ssh_user? | 19:48 |
| crinkle | pabelanger: i don't think so, i don't see those anywhere in bifrost | 19:50 |
| pabelanger | crinkle: okay, the only issue I ran into with 2.0.0.2 was https://github.com/ansible/ansible/issues/13669 | 19:51 |
| mordred | yah. 2.0 should be safe | 19:51 |
| mordred | and is also desirable | 19:51 |
| crinkle | thejulia also confirms it should be safe | 19:51 |
| clarkb | nibalizer: https://cloud-images.ubuntu.com/trusty/current/trusty-server-cloudimg-amd64-disk1.img is the image we want I think. Should be added as admin so that all users can see it | 19:52 |
| nibalizer | http://paste.openstack.org/show/487922/ | 19:52 |
| nibalizer | kk | 19:52 |
| mordred | clarkb: yah. as admin with public=True set | 19:58 |
| yolanda | hi, before we start using nodepool we need to be sure that https://review.openstack.org/#/c/281310/ lands | 20:05 |
| yolanda | we will have a problem with deleting if not | 20:05 |
| clarkb | export FQDN=mirror.regionone.infracloud-west.openstack.org | 20:09 |
| clarkb | jeblair: fungi etc ^ that name look correct? | 20:09 |
| rcarrillocruz | mordred: it seems ansible os modules doesn't allow to modify quotas? per-project compute, network, etc | 20:11 |
| rcarrillocruz | ? | 20:11 |
| rcarrillocruz | or am i missing something | 20:11 |
| crinkle | haha | 20:11 |
| crinkle | thou shalt not modify per-project quotas via automation | 20:11 |
| *** mrmartin has joined #openstack-sprint | 20:11 | |
| rcarrillocruz | aka, you can lock out yourself from doing anything useful by mistake :-) | 20:12 |
| rcarrillocruz | it seems i'm left with doing an ansible command: openstack quota blah | 20:13 |
| GheRivero | I'll take a look to add the quota thing to ansible | 20:15 |
| yolanda | crinkle so look at my global vars https://review.openstack.org/#/c/267438/ , you will see i add rsyslog to extra packages, it should be useful to have it | 20:29 |
| crinkle | yolanda: sounds good to me | 20:31 |
| crinkle | yolanda: iputils-ping also very very useful :) | 20:31 |
| rcarrillocruz | yeah, that's another one missing | 20:32 |
| rcarrillocruz | so is less | 20:32 |
| rcarrillocruz | vi | 20:32 |
| rcarrillocruz | really minimal :/ | 20:32 |
| nibalizer | rcarrillocruz: this was the output of running your stuff | 20:43 |
| nibalizer | Notice: /Stage[main]/Openstack_project::Infracloud::Controller/Keystone_tenant[openstackjenkins]/description: description changed 'Infra short lived resources' to '' | 20:43 |
| nibalizer | Notice: /Stage[main]/Openstack_project::Infracloud::Controller/Keystone_tenant[openstackci]/description: description changed 'Infra Long Lived Resources' to '' | 20:43 |
| nibalizer | so we lost descriptions (if we care) | 20:43 |
| rcarrillocruz | thx, i can re-add those descriptions to puppet | 20:44 |
| clarkb | https://review.openstack.org/283792 should fix puppet on nodepool.o.o | 21:04 |
| nibalizer | mordred: clarkb https://review.openstack.org/283796 should give us a chance at debugging it | 21:10 |
| jeblair | clarkb: could you +A https://review.openstack.org/283739 | 21:12 |
| clarkb | looking | 21:13 |
| clarkb | jeblair: gerrit claims "cannot merge" | 21:13 |
| clarkb | jeblair: but before you rebase, we should rename *_domain_id to *_domain_name | 21:14 |
| clarkb | but maybe it works this way due to the specialness of default modrred was talking about | 21:14 |
| jeblair | clarkb: okay, i was clearly cargo culting from something untested | 21:14 |
| nibalizer | oh i didn't see the cannot merge | 21:14 |
| nibalizer | i also wonder if we need the 'floating ip source' since likely we'll never boot nodes as the admin | 21:15 |
| jeblair | i thought this was worked out already with the other changes | 21:15 |
| jeblair | i'll just go create this from scratch from first principles | 21:15 |
| clarkb | jeblair: it is worked out as of the last change that merged which I thought I linked oyu to earlier | 21:16 |
| jeblair | clarkb: updated https://review.openstack.org/283739 with my own creation | 21:33 |
| jeblair | clarkb: it looks different | 21:33 |
| clarkb | jeblair: did you test it? yolanda was saying that without the domain stuff did not wrk for them in east | 21:34 |
| jeblair | clarkb: i tested it in west | 21:34 |
| clarkb | ok | 21:34 |
| clarkb | and that does strip out the extra stuff that mordred pointed out | 21:34 |
| jeblair | clarkb: i used 'domain list' and 'server list' | 21:34 |
| jeblair | i thought that would be fairly representative | 21:34 |
| clarkb | yup that should both go through keystone auth so would be sufficient | 21:35 |
| jhesketh | Morning | 21:35 |
| clarkb | good morning | 21:36 |
| clarkb | OS_CLIENT_CONFIG_FILE=/etc/openstack/all-clouds.yaml | 21:37 |
| clarkb | jeblair: ^ | 21:37 |
| *** baoli has joined #openstack-sprint | 21:37 | |
| fungi | if any other infra-core reviewer is okay approving https://review.openstack.org/283768 in system-config i'll watch the run_all and puppet logs | 21:41 |
| yolanda | fungi approved | 21:42 |
| fungi | thanks yolanda | 21:43 |
| fungi | mordred: interesting observation, ansible-inventory.cache seems to group servers by "region" alone, and we're about to have two (soon three) clouds with the same region name. is this purely cosmetic, or likely to lead to any unforeseen issues? | 21:49 |
| *** mrmartin has quit IRC | 21:50 | |
| jeblair | fungi: i think it is cosmetic unless we actually try to use that for something (eg, a hiera group) | 21:51 |
| jeblair | clarkb, nibalizer, crinkle, yolanda: remote: https://review.openstack.org/283821 Simplify infracloud clouds.yaml | 21:53 |
| rcarrillocruz | clarkb, nibalizer, yolanda, crinkle: https://review.openstack.org/#/c/283816/ | 21:56 |
| rcarrillocruz | and also https://review.openstack.org/#/c/283737/ | 21:56 |
| rcarrillocruz | missed a comma in a param in earlier patchset | 21:56 |
| clarkb | rcarrillocruz: see comment on https://review.openstack.org/#/c/283816/1 | 21:59 |
| *** dfflanders has quit IRC | 22:00 | |
| jeblair | clarkb: remote: https://review.openstack.org/283825 Make all-clouds.yaml admin readable | 22:01 |
| anteaya | jhesketh: nice to see you | 22:07 |
| anteaya | jhesketh: I hope everything is going well in your world | 22:07 |
| jhesketh | Yep not bad thanks | 22:07 |
| anteaya | jhesketh: good to hear | 22:07 |
| jhesketh | Hoping to help out some more today. Lots to catch up on though | 22:08 |
| anteaya | jhesketh: lots to catch up on | 22:08 |
| nibalizer | jhesketh: currently we're working on getitng the puppet-ansible-apply pipeline to work better, so that it puppets infracloud, so that we can boot nodes | 22:09 |
| jhesketh | nibalizer: okay cool | 22:09 |
| jeblair | clarkb: final patch in series: remote: https://review.openstack.org/283829 Add instructions on using openstackclient | 22:10 |
| nibalizer | there is also a group working on getting baremetal00 under puppet/ansible management | 22:11 |
| nibalizer | and jeblair is working on getting config files and docs set up so that infra-roots on puppetmaster can run openstackclient | 22:11 |
| pabelanger | So, it would be interested to see us run https://github.com/jtaleric/browbeat on infracloud | 22:18 |
| pabelanger | IIRC, there is a playbook to do some performance tuning and ensure settings are configured properly | 22:19 |
| yolanda | mordred, i was looking at moving the infra element to system-config. How do you see that working with puppet-openstackci and nodepool ? i was thinking in create an elements directory, that gets deployed with puppet to, for example /etc/system-config/elements, and then make nodepool to use that as element path, as long as the one from project-config | 22:23 |
| clarkb | pabelanger: don't worry nodepool is harder on clouds than any other benchmark system if the number of times we break clouds is any indication | 22:24 |
| pabelanger | clarkb: I think there is some roles to check for tuning too. Never used it | 22:26 |
| clarkb | pabelanger: that would be interesting if it could point out plcaes we could be more better | 22:28 |
| pabelanger | clarkb: ya, I think it does something like that. Simple noop checks | 22:28 |
| *** cdelatte has quit IRC | 22:29 | |
| anteaya | https://storyboard.openstack.org/#!/board/7 | 22:34 |
| *** baoli has quit IRC | 22:43 | |
| *** baoli has joined #openstack-sprint | 22:44 | |
| *** baoli has quit IRC | 22:45 | |
| *** baoli has joined #openstack-sprint | 22:46 | |
| *** baoli has quit IRC | 22:58 | |
| *** Clint has quit IRC | 22:58 | |
| *** Daviey has quit IRC | 22:58 | |
| *** dhellmann has quit IRC | 22:58 | |
| *** mjturek1 has quit IRC | 22:58 | |
| *** aarefiev has quit IRC | 22:58 | |
| *** krtaylor has quit IRC | 22:58 | |
| *** craige has quit IRC | 22:58 | |
| *** zhenguo_ has quit IRC | 22:58 | |
| *** clayton has quit IRC | 22:58 | |
| *** sergek has quit IRC | 22:58 | |
| *** devananda has quit IRC | 22:58 | |
| *** yolanda has quit IRC | 22:58 | |
| *** GheRivero has quit IRC | 22:58 | |
| *** ianw has quit IRC | 22:58 | |
| *** jroll has quit IRC | 22:58 | |
| *** dteselkin has quit IRC | 22:58 | |
| *** rfolco has quit IRC | 22:58 | |
| *** SpamapS has quit IRC | 22:58 | |
| *** clarkb has quit IRC | 22:58 | |
| *** _degorenko|afk has quit IRC | 22:58 | |
| *** sweston has quit IRC | 22:58 | |
| *** EmilienM has quit IRC | 22:58 | |
| *** natorious has quit IRC | 22:58 | |
| *** fungi has quit IRC | 22:58 | |
| *** mfisch has quit IRC | 22:58 | |
| *** NobodyCam has quit IRC | 22:58 | |
| *** tristanC has quit IRC | 22:58 | |
| *** yarkot has quit IRC | 22:58 | |
| *** mordred has quit IRC | 22:58 | |
| *** anteaya has quit IRC | 22:58 | |
| *** krotscheck has quit IRC | 22:58 | |
| *** morgabra has quit IRC | 22:58 | |
| *** pleia2 has quit IRC | 22:58 | |
| *** jeblair has quit IRC | 22:58 | |
| *** clif_h has quit IRC | 22:58 | |
| *** crinkle has quit IRC | 22:58 | |
| *** sbadia has quit IRC | 22:58 | |
| *** rockstar has quit IRC | 22:58 | |
| *** nibalizer has quit IRC | 22:58 | |
| *** sbadia has joined #openstack-sprint | 23:01 | |
| *** crinkle has joined #openstack-sprint | 23:01 | |
| *** clif_h has joined #openstack-sprint | 23:01 | |
| *** nibalizer has joined #openstack-sprint | 23:01 | |
| *** rockstar has joined #openstack-sprint | 23:01 | |
| *** aarefiev has joined #openstack-sprint | 23:01 | |
| *** mjturek1 has joined #openstack-sprint | 23:01 | |
| *** dhellmann has joined #openstack-sprint | 23:01 | |
| *** Daviey has joined #openstack-sprint | 23:01 | |
| *** Clint has joined #openstack-sprint | 23:01 | |
| *** devananda has joined #openstack-sprint | 23:01 | |
| *** sergek has joined #openstack-sprint | 23:01 | |
| *** clayton has joined #openstack-sprint | 23:01 | |
| *** zhenguo_ has joined #openstack-sprint | 23:01 | |
| *** craige has joined #openstack-sprint | 23:01 | |
| *** krtaylor has joined #openstack-sprint | 23:01 | |
| *** NobodyCam has joined #openstack-sprint | 23:01 | |
| *** mfisch has joined #openstack-sprint | 23:01 | |
| *** fungi has joined #openstack-sprint | 23:01 | |
| *** natorious has joined #openstack-sprint | 23:01 | |
| *** EmilienM has joined #openstack-sprint | 23:01 | |
| *** sweston has joined #openstack-sprint | 23:01 | |
| *** yolanda has joined #openstack-sprint | 23:01 | |
| *** ianw has joined #openstack-sprint | 23:01 | |
| *** GheRivero has joined #openstack-sprint | 23:01 | |
| *** jroll has joined #openstack-sprint | 23:01 | |
| *** dteselkin has joined #openstack-sprint | 23:01 | |
| *** baoli has joined #openstack-sprint | 23:01 | |
| *** anteaya has joined #openstack-sprint | 23:03 | |
| *** krotscheck has joined #openstack-sprint | 23:03 | |
| *** jeblair has joined #openstack-sprint | 23:03 | |
| *** morgabra has joined #openstack-sprint | 23:03 | |
| *** pleia2 has joined #openstack-sprint | 23:03 | |
| *** tristanC has joined #openstack-sprint | 23:03 | |
| *** yarkot has joined #openstack-sprint | 23:03 | |
| *** mordred has joined #openstack-sprint | 23:03 | |
| *** yolanda has quit IRC | 23:03 | |
| *** GheRivero has quit IRC | 23:04 | |
| *** rfolco has joined #openstack-sprint | 23:06 | |
| *** SpamapS has joined #openstack-sprint | 23:06 | |
| *** clarkb has joined #openstack-sprint | 23:06 | |
| *** _degorenko|afk has joined #openstack-sprint | 23:06 | |
| *** clarkb has quit IRC | 23:07 | |
| *** SpamapS has quit IRC | 23:07 | |
| *** SpamapS has joined #openstack-sprint | 23:09 | |
| *** cdelatte has joined #openstack-sprint | 23:24 | |
| anteaya | here is a board I created for the infra-cloud story: https://storyboard.openstack.org/#!/board/8 | 23:28 |
| anteaya | everyone should be able to view it | 23:28 |
| anteaya | new tasks need to be added here: https://storyboard.openstack.org/#!/story/2000175 | 23:29 |
| anteaya | then I can pull it onto the board as a card | 23:29 |
| *** yolanda has joined #openstack-sprint | 23:30 | |
| *** GheRivero has joined #openstack-sprint | 23:31 | |
| *** clarkb has joined #openstack-sprint | 23:34 | |
| jhesketh | are all the patches using the infra-cloud topic? | 23:46 |
| * jhesketh thinks he'll just go reviewing | 23:46 | |
| jhesketh | although let me know if there's something in particular I can help with | 23:46 |
| nibalizer | jhesketh: https://review.openstack.org/#/c/283862/ id like to see this reviewe | 23:48 |
| jhesketh | nibalizer: did you see Clint's query on that one? | 23:53 |
| anteaya | jhesketh: can you see the review lane on the infra-cloud board? https://storyboard.openstack.org/#!/board/8 | 23:53 |
| jhesketh | anteaya: yep, will work through that | 23:54 |
| anteaya | jhesketh: the cards aren't mapped to gerrit review ids | 23:54 |
| anteaya | but those cards have been prioritized | 23:54 |
| jhesketh | okay I'll try and find the corresponding reviews | 23:55 |
| anteaya | jhesketh: you are now an owner of the board | 23:57 |
| anteaya | jhesketh: you can move things around in the lanes and add lanes and such | 23:57 |
| anteaya | jhesketh: I also made you an owner on my test board: https://storyboard.openstack.org/#!/board/7 | 23:58 |
| anteaya | jhesketh: so you have a place to play | 23:58 |
| nibalizer | jhesketh: krm | 23:59 |
| nibalizer | so how does the del statement work | 23:59 |
| *** baoli has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!