| *** openstack has joined #tripleo | 13:49 | |
| *** yfaykya has quit IRC | 13:50 | |
| *** robsparker has joined #tripleo | 13:50 | |
| *** yfaykya has joined #tripleo | 13:51 | |
| *** edmund has joined #tripleo | 13:53 | |
| *** pcrews has joined #tripleo | 13:55 | |
| *** yfaykya has quit IRC | 13:56 | |
| *** yfaykya has joined #tripleo | 13:57 | |
| openstackgerrit | Stuart McLaren proposed a change to openstack/tripleo-incubator: Run the overcloud with an SSL enabled public IP https://review.openstack.org/85098 | 13:58 |
|---|---|---|
| *** ramishra has joined #tripleo | 13:59 | |
| *** CaptTofu has joined #tripleo | 13:59 | |
| *** yfaykya has quit IRC | 14:02 | |
| *** yfaykya has joined #tripleo | 14:04 | |
| *** jang has quit IRC | 14:05 | |
| *** yfaykya has quit IRC | 14:08 | |
| *** yfaykya has joined #tripleo | 14:10 | |
| *** yfaykya has quit IRC | 14:14 | |
| *** yfaykya has joined #tripleo | 14:16 | |
| *** rwsu has joined #tripleo | 14:16 | |
| *** rdopieralski has quit IRC | 14:16 | |
| openstackgerrit | A change was merged to openstack/tuskar-ui: Update the pbr version https://review.openstack.org/103394 | 14:18 |
| openstackgerrit | Stuart McLaren proposed a change to openstack/tripleo-incubator: Run the overcloud with an SSL enabled public IP https://review.openstack.org/85098 | 14:18 |
| *** yfaykya has quit IRC | 14:21 | |
| *** yfaykya has joined #tripleo | 14:22 | |
| *** yfaykya has quit IRC | 14:27 | |
| tzumainn | jdob, heya, quick question - if I deploy a provider resource in a stack, the resource_type of that resource matches what's in the resource registry, right? | 14:28 |
| *** yfaykya has joined #tripleo | 14:28 | |
| jdob | yes | 14:29 |
| jdob | in the resource_registry: Foo::Bar = bar.yaml | 14:29 |
| jdob | in the master template, the type of resource is Foo::Bar | 14:29 |
| tzumainn | okay - athomas, jcoufal ^ we can get the role mapping that way | 14:29 |
| jdob | and heat will bomb if you dont give it an environment it can use to resolve what the hell Foo::Bar is | 14:29 |
| jdob | tzumainn: you can't though, since that doesn't have the version | 14:30 |
| jdob | unless you shove the version info into the filename | 14:30 |
| tzumainn | crap | 14:30 |
| tzumainn | jdob, well, if the stack knows about the plan - and I think it has to - then it can derive that information, right? | 14:31 |
| jdob | derive what information/ | 14:32 |
| jdob | ? | 14:32 |
| tzumainn | the role versions | 14:32 |
| jdob | no, in fact, the stack is gonna have even less of a clue | 14:32 |
| jdob | arguably, it's not even going to know about what roles it has | 14:32 |
| jdob | since roles is just a tuskar concept | 14:32 |
| *** yfaykya has quit IRC | 14:32 | |
| tzumainn | wait | 14:32 |
| * jdob waits | 14:33 | |
| tzumainn | either a plan needs to know about the deployed stack, or the stack needs to know what plan deployed it - it's impossible to coordinate them otherwise | 14:33 |
| jdob | right, and we decided the stack should be able to point to the plan that created it | 14:34 |
| tzumainn | right, so if a stack knows the plan | 14:34 |
| tzumainn | then in theory it can know what kind of roles it contains within it, right? | 14:34 |
| *** yfaykya has joined #tripleo | 14:34 | |
| jdob | in theory "it" meaning what, the plan? | 14:35 |
| tzumainn | no, the stack | 14:35 |
| tzumainn | but through the plan | 14:35 |
| jdob | i'm totally not getting the context here | 14:35 |
| jdob | if the plan can know its role versions, then yes, thats all transitive | 14:35 |
| tzumainn | given a stack, how do we know which roles are deployed on which nodes | 14:35 |
| jdob | stack -> plan -> roles and versions | 14:35 |
| tzumainn | currently we do it by comparing image names | 14:35 |
| jdob | but from your initial point, we can't just look at resource_registry in the plan to know the roles and versions | 14:35 |
| TheJulia | win 3 | 14:36 |
| jdob | so for that chain to work, there has to be a way for the plan to know the roles and versions | 14:36 |
| tzumainn | jdob, which it does, according to the spec | 14:36 |
| * TheJulia should just learn to use alt-3 instead of typing out window changes in her irc client | 14:36 | |
| tzumainn | jdob, what's missing here is that I think this all means a plan needs to be versioned too | 14:36 |
| jdob | ya, i agree | 14:37 |
| jdob | otherwise there's that disconnect | 14:37 |
| jdob | when the plan changes past the live stack | 14:37 |
| jdob | assuming we care to keep that relationship | 14:37 |
| tzumainn | I think we need to | 14:37 |
| jdob | i think I could see it argued either way | 14:37 |
| tzumainn | because the UI will need plan-level information regarding the deployment | 14:37 |
| jdob | but it certainly wouldn't hurt to version the plans | 14:38 |
| tzumainn | but it can't be a version per change, otherwise you'll have 5 different versions when you add four roles | 14:38 |
| *** yfaykya has quit IRC | 14:39 | |
| tzumainn | meaning, unlike role and template, it seems to me that we have to have the UI explicitly tell the api to mark a new version or something | 14:39 |
| tzumainn | or make it read-only? | 14:40 |
| jdob | you could tie the version to when you request the compiled heat templates | 14:40 |
| tzumainn | and any further changes automatically create a new version | 14:40 |
| jdob | call that a "commit" sort of concept | 14:40 |
| jdob | <change><change><change><change> commit, version the plan, get templates, presumably make live | 14:40 |
| jdob | <change><change><change> | 14:40 |
| *** yfaykya has joined #tripleo | 14:40 | |
| tzumainn | so regardless of when that "commit" happens, I think it'd be sufficient to have a read only flag or something act as the commit | 14:41 |
| jdob | why a read-only flag instead of a version number? | 14:42 |
| jdob | what does the flag actually get us? | 14:42 |
| tzumainn | it act as a commit flag | 14:43 |
| tzumainn | because there are times when you don't want a new version of a plan | 14:44 |
| tzumainn | i.e., when you're adding roles, messing with config parameters | 14:44 |
| tzumainn | and any update to the plan should be a true update | 14:44 |
| tzumainn | then you set the read_only flag after, say, a deployment | 14:44 |
| jdob | through a separate REST API call? | 14:44 |
| tzumainn | and now any update to the plan creates a new version instead | 14:44 |
| tzumainn | if you don't want tuskar to operate directly with heat, I think it'd have to be | 14:45 |
| jdob | not necessarily, you could key it off an event like downloading the templates, but i dont see a problem with a save operation too | 14:45 |
| *** yfaykya has quit IRC | 14:45 | |
| *** jprovazn has quit IRC | 14:46 | |
| jdob | i dont agree with the idea of slapping down a read-only flag, but I get the workflow you're going after | 14:46 |
| *** yfaykya has joined #tripleo | 14:47 | |
| *** yfaykya has quit IRC | 14:51 | |
| *** yfaykya has joined #tripleo | 14:53 | |
| openstackgerrit | Stuart McLaren proposed a change to openstack/tripleo-image-elements: stunnel: Allow CA certificate to be specified https://review.openstack.org/85099 | 14:54 |
| *** yfaykya has quit IRC | 14:57 | |
| *** yfaykya has joined #tripleo | 14:59 | |
| *** sballe has joined #tripleo | 14:59 | |
| *** untriaged-bot has joined #tripleo | 15:00 | |
| untriaged-bot | Untriaged bugs so far: | 15:00 |
| untriaged-bot | https://bugs.launchpad.net/tripleo/+bug/1334581 | 15:00 |
| uvirtbot | Launchpad bug 1334581 in tripleo "os-collect-config.conf need support to Heat userdata" [Undecided,In progress] | 15:00 |
| untriaged-bot | https://bugs.launchpad.net/tripleo/+bug/1335042 | 15:00 |
| untriaged-bot | https://bugs.launchpad.net/tripleo/+bug/1335105 | 15:00 |
| untriaged-bot | https://bugs.launchpad.net/tripleo/+bug/1335016 | 15:00 |
| untriaged-bot | https://bugs.launchpad.net/tripleo/+bug/1333649 | 15:00 |
| uvirtbot | Launchpad bug 1335042 in tripleo "diskimage-builder: extlinux installation failure" [Undecided,New] | 15:00 |
| untriaged-bot | https://bugs.launchpad.net/diskimage-builder/+bug/1332458 | 15:00 |
| uvirtbot | Launchpad bug 1335105 in tuskar-ui "Devtest init script: sourcing tripleorc fails" [Undecided,New] | 15:00 |
| untriaged-bot | https://bugs.launchpad.net/diskimage-builder/+bug/1332521 | 15:00 |
| uvirtbot | Launchpad bug 1335016 in tripleo "diskimage-builder fails for Debian" [Undecided,New] | 15:00 |
| uvirtbot | Launchpad bug 1333649 in tripleo "/etc/hosts entries written by hosts element doesn't survive reboot" [Undecided,In progress] | 15:00 |
| *** untriaged-bot has quit IRC | 15:00 | |
| uvirtbot | Launchpad bug 1332458 in diskimage-builder "Not able to build armhf or arm64 images on amd64 arch systems." [Undecided,In progress] | 15:00 |
| uvirtbot | Launchpad bug 1332521 in diskimage-builder "failed to remove `/tmp/image.A2aupYJb/mnt/tmp/in_target.d': Device or resource busy" [Undecided,New] | 15:00 |
| *** yfaykya has quit IRC | 15:04 | |
| *** yfaykya has joined #tripleo | 15:05 | |
| *** marun has joined #tripleo | 15:06 | |
| *** marun has quit IRC | 15:08 | |
| *** vinsh has joined #tripleo | 15:09 | |
| *** martyntaylor has quit IRC | 15:09 | |
| *** yfaykya has quit IRC | 15:09 | |
| *** yfaykya has joined #tripleo | 15:11 | |
| *** marun has joined #tripleo | 15:12 | |
| *** nati_ueno has joined #tripleo | 15:12 | |
| *** marun is now known as marun_afk | 15:14 | |
| *** ifarkas_ has quit IRC | 15:16 | |
| *** yfaykya has quit IRC | 15:16 | |
| *** yfaykya has joined #tripleo | 15:17 | |
| *** jcoufal has quit IRC | 15:18 | |
| *** lazy_prince is now known as killer_prince | 15:20 | |
| *** yfaykya has quit IRC | 15:22 | |
| *** andreaf_ has quit IRC | 15:23 | |
| *** yfaykya has joined #tripleo | 15:23 | |
| *** martyntaylor has joined #tripleo | 15:25 | |
| openstackgerrit | Derek Higgins proposed a change to openstack-infra/tripleo-ci: Use the pre-downloaded Fedora image https://review.openstack.org/103566 | 15:25 |
| regebro | Aha... "Command output matched '(CREATE|UPDATE)_FAILED'. Exiting..." Did that mean that installing Devstack worked, or that it failed? :-) | 15:25 |
| derekh_ | dprince: just trying that out ^ , I think the image build precaches the fedora image | 15:26 |
| openstackgerrit | Adam Vinsh proposed a change to openstack/tripleo-image-elements: Add nova url to neutron.conf https://review.openstack.org/103568 | 15:26 |
| *** yfaykya has quit IRC | 15:28 | |
| dprince | derekh_: if it works I'd be happy to eliminate that call. It would be nice to have the nodepool pre-caching script use our Squid though | 15:28 |
| dprince | derekh_: should be do-able I think... although it might be worth putting in a squid-test function to set or unset it based upon whether an in-rack squid has been deployed | 15:29 |
| *** yfaykya has joined #tripleo | 15:29 | |
| derekh_ | dprince: ya, although its a non tripleo thing, we could do it as you node in your original comment (i.e. in prepare_node_tripleo.sh ), actually my patch may not work at all , lets see | 15:31 |
| derekh_ | s/node/note/ | 15:31 |
| *** rcarrill` has quit IRC | 15:32 | |
| *** rakesh_hs has quit IRC | 15:32 | |
| *** rcarrillocruz has joined #tripleo | 15:33 | |
| *** yfaykya has quit IRC | 15:34 | |
| *** yfaykya has joined #tripleo | 15:36 | |
| openstackgerrit | Adam Vinsh proposed a change to openstack/tripleo-image-elements: Add nova url to neutron.conf https://review.openstack.org/103568 | 15:36 |
| *** yfaykya has quit IRC | 15:40 | |
| dprince | derekh_: did you see https://review.openstack.org/#/c/102213/ | 15:40 |
| derekh_ | dprince: I hadn't, looking now | 15:42 |
| *** yfaykya has joined #tripleo | 15:42 | |
| *** dsneddon has joined #tripleo | 15:43 | |
| *** beekneemech is now known as bnemec | 15:45 | |
| openstackgerrit | Adam Vinsh proposed a change to openstack/tripleo-image-elements: Add nova url to neutron.conf https://review.openstack.org/103568 | 15:45 |
| *** yfaykya has quit IRC | 15:46 | |
| *** nati_ueno has quit IRC | 15:47 | |
| *** yfaykya has joined #tripleo | 15:48 | |
| *** athomas has quit IRC | 15:48 | |
| *** yfaykya has quit IRC | 15:52 | |
| *** yfaykya has joined #tripleo | 15:54 | |
| howleyt | Hi, would there be any objections to splitting out the reset-db script of the boot-stack element and moving it into the related elements. e.g. cinder, nova, etc.? | 15:57 |
| *** athomas has joined #tripleo | 15:57 | |
| *** yfaykya has quit IRC | 15:58 | |
| *** blamar has joined #tripleo | 16:00 | |
| *** yfaykya has joined #tripleo | 16:00 | |
| *** marun_afk is now known as marun | 16:00 | |
| *** pblaho has quit IRC | 16:02 | |
| *** yfaykya has quit IRC | 16:05 | |
| *** yfaykya has joined #tripleo | 16:06 | |
| *** rcarrillocruz has quit IRC | 16:11 | |
| *** yfaykya has quit IRC | 16:11 | |
| *** yfaykya has joined #tripleo | 16:12 | |
| *** IvanBerezovskiy has left #tripleo | 16:13 | |
| *** rcarrillocruz has joined #tripleo | 16:16 | |
| *** yfaykya has quit IRC | 16:17 | |
| *** yfaykya has joined #tripleo | 16:18 | |
| *** yfaykya has quit IRC | 16:23 | |
| *** yfaykya has joined #tripleo | 16:25 | |
| openstackgerrit | Tzu-Mainn Chen proposed a change to openstack/tuskar-ui: Fixed docstrings to match api reorganization https://review.openstack.org/103579 | 16:29 |
| *** yfaykya has quit IRC | 16:29 | |
| *** andreaf_ has joined #tripleo | 16:30 | |
| *** morganfainberg_Z is now known as morganfainberg | 16:30 | |
| *** yfaykya has joined #tripleo | 16:31 | |
| *** ccrouch has joined #tripleo | 16:31 | |
| openstackgerrit | Nicholas Randon proposed a change to openstack/tripleo-incubator: Update configure-vm to use abspath and join. https://review.openstack.org/102816 | 16:33 |
| openstackgerrit | Nicholas Randon proposed a change to openstack/tripleo-incubator: Clean-up os-apply-config lines in devtest. https://review.openstack.org/101286 | 16:33 |
| openstackgerrit | Nicholas Randon proposed a change to openstack/tripleo-image-elements: Move masquerade host_ip to config.json https://review.openstack.org/101280 | 16:33 |
| openstackgerrit | Tzu-Mainn Chen proposed a change to openstack/tuskar-ui: Use util version of list_to_dict https://review.openstack.org/103580 | 16:33 |
| *** martyntaylor has left #tripleo | 16:34 | |
| *** yfaykya has quit IRC | 16:35 | |
| *** yfaykya has joined #tripleo | 16:37 | |
| *** andreaf_ has quit IRC | 16:41 | |
| *** yfaykya has quit IRC | 16:42 | |
| *** dkehn__ has joined #tripleo | 16:42 | |
| *** yfaykya has joined #tripleo | 16:43 | |
| *** ramishra has quit IRC | 16:45 | |
| *** ramishra has joined #tripleo | 16:45 | |
| *** dkehnx has quit IRC | 16:45 | |
| *** yfaykya has quit IRC | 16:47 | |
| *** yfaykya has joined #tripleo | 16:49 | |
| *** ramishra has quit IRC | 16:50 | |
| *** yfaykya has quit IRC | 16:54 | |
| *** CaptTofu has quit IRC | 16:54 | |
| *** jtomasek has quit IRC | 16:55 | |
| *** yfaykya has joined #tripleo | 16:55 | |
| *** SpamapS_ is now known as SpamapS | 16:57 | |
| *** SpamapS has quit IRC | 16:57 | |
| *** SpamapS has joined #tripleo | 16:57 | |
| *** yfaykya has quit IRC | 17:00 | |
| *** yfaykya has joined #tripleo | 17:01 | |
| *** derekh_ has quit IRC | 17:05 | |
| *** yfaykya has quit IRC | 17:06 | |
| *** yfaykya has joined #tripleo | 17:07 | |
| *** yfaykya has quit IRC | 17:12 | |
| *** yfaykya has joined #tripleo | 17:13 | |
| *** nati_ueno has joined #tripleo | 17:14 | |
| *** Penick has joined #tripleo | 17:15 | |
| *** yfaykya has quit IRC | 17:18 | |
| *** yfaykya has joined #tripleo | 17:20 | |
| *** regebro has quit IRC | 17:20 | |
| *** yfaykya has quit IRC | 17:24 | |
| openstackgerrit | lifeless proposed a change to openstack/tripleo-image-elements: Fix issues with provider networks and public ips https://review.openstack.org/103449 | 17:24 |
| *** yfaykya has joined #tripleo | 17:26 | |
| *** yfaykya has quit IRC | 17:30 | |
| *** yfaykya has joined #tripleo | 17:32 | |
| *** rcarrill` has joined #tripleo | 17:32 | |
| adam_g` | lifeless, re 93844 i was never able to get as far as reproducing the issue. after https://review.openstack.org/#/c/93083/ merged we dropped 93844 from our testing patch set and haven't run into the starvation issue at 30+ nodes | 17:33 |
| *** rcarrillocruz has quit IRC | 17:34 | |
| *** yfaykya has quit IRC | 17:37 | |
| *** yfaykya has joined #tripleo | 17:38 | |
| *** pelix has quit IRC | 17:40 | |
| *** martyntaylor has joined #tripleo | 17:41 | |
| *** lucasagomes is now known as lucas-afk | 17:42 | |
| *** yfaykya has quit IRC | 17:42 | |
| lifeless | adam_g`: huh, so where do we stand on that review then ? | 17:43 |
| *** rdopieralski has joined #tripleo | 17:43 | |
| lifeless | pcrews: hi, how goes it ? | 17:43 |
| lifeless | TheJulia: also hi - I just wanted to touch base and see if you'd settled in enough to get your hands dirty, metaphorically speaking | 17:44 |
| *** yfaykya has joined #tripleo | 17:44 | |
| pcrews | lifeless: hi. good. I finished the elastic-recheck patch and am about to push a new version of that ~*~&! log patch :) | 17:44 |
| lifeless | pcrews: cool | 17:44 |
| *** rcarrillocruz has joined #tripleo | 17:45 | |
| *** rcarrill` has quit IRC | 17:45 | |
| *** edmund has quit IRC | 17:48 | |
| openstackgerrit | patrick-crews proposed a change to openstack-infra/tripleo-ci: Alter how we grab and store machine files to use logstash indexing. https://review.openstack.org/99250 | 17:48 |
| *** yfaykya has quit IRC | 17:49 | |
| *** rcarrillocruz has quit IRC | 17:49 | |
| *** rcarrillocruz has joined #tripleo | 17:50 | |
| *** yfaykya has joined #tripleo | 17:50 | |
| TheJulia | lifeless: Settled... not exactly, but I'm ready and willing to begin getting my hands dirty. I've been looking through blueprints and trying to figure out where I could really get started at. | 17:52 |
| adam_g` | lifeless, lemme try one more round of focused testing and ill update review | 17:54 |
| *** yfaykya has quit IRC | 17:54 | |
| *** rcarrillocruz has quit IRC | 17:56 | |
| *** edmund has joined #tripleo | 17:56 | |
| *** yfaykya has joined #tripleo | 17:56 | |
| openstackgerrit | lifeless proposed a change to openstack/tripleo-image-elements: Fix issues with provider networks and public ips https://review.openstack.org/103449 | 18:00 |
| lifeless | TheJulia: cool, so the first hands-dirty thing is to make sure you have a local dev environment - have you run through devtest locally (e.g. run devtest.sh and let it do its thing?) | 18:01 |
| *** rcarrillocruz has joined #tripleo | 18:01 | |
| *** yfaykya has quit IRC | 18:01 | |
| TheJulia | I have, it runs quite nicely on my macbook | 18:02 |
| *** yfaykya has joined #tripleo | 18:02 | |
| *** dkehn__ is now known as dkehnx | 18:03 | |
| lifeless | cool | 18:05 |
| lifeless | so the next thing then is to pick a thing to push forward on; right now there are several intiatives happening | 18:06 |
| lifeless | HA | 18:06 |
| lifeless | update | 18:06 |
| lifeless | vlan support sufficient to get the hp1 and hp2 regions online | 18:06 |
| lifeless | moving code from incubator to os-cloud-config to support tuskar | 18:06 |
| lifeless | and of course, tuskar itself | 18:06 |
| lifeless | set against a background of general as-needed improvements to ironic, heat, nova etc | 18:07 |
| greghaynes | lifeless: https://review.openstack.org/#/c/83883/ HA patch | 18:07 |
| *** yfaykya has quit IRC | 18:07 | |
| lifeless | TheJulia: are any of those things more (or less :)) interesting to you? | 18:07 |
| *** rcarrillocruz has quit IRC | 18:08 | |
| *** yfaykya has joined #tripleo | 18:09 | |
| *** yfaykya has quit IRC | 18:13 | |
| openstackgerrit | A change was merged to openstack/tripleo-heat-templates: Add galera clustering properties https://review.openstack.org/83883 | 18:14 |
| greghaynes | \O/ | 18:14 |
| lifeless | NEXT | 18:14 |
| lifeless | :) | 18:14 |
| *** yfaykya has joined #tripleo | 18:15 | |
| TheJulia | lifeless: Sorry, was typing a rather large message to Ng. HA and vlan support seems interesting. Update just seems big and scary to me when I know it shouldn't be. :) | 18:18 |
| *** yfaykya has quit IRC | 18:19 | |
| *** andreaf_ has joined #tripleo | 18:20 | |
| lifeless | TheJulia: ok, so vlan support has me and tchaypo working on right now and neither of us are particularly timezone sympatico with you; so you'd be a bit thrown-in-the-deep-end; HA has greg and jprovazn and me (a tteennyy bit) on it, which means you'd have solid overlap with folk breathing it every day. | 18:21 |
| *** yfaykya has joined #tripleo | 18:21 | |
| lifeless | TheJulia: I'd suggest jumping on HA, by asking greghaynes for the set of open reviews he tests with | 18:21 |
| greghaynes | Thats a good question | 18:21 |
| lifeless | TheJulia: and then running through devtest_overcloud (e.g. keep a stable seed and run the overcloud directly against it using the HA patch sets) | 18:22 |
| lifeless | TheJulia: and pick a facet that isn't quite right, and poke at it | 18:22 |
| lifeless | TheJulia: (and use greghaynes as a mentor to get deeper into it all) | 18:22 |
| *** andreaf_ has quit IRC | 18:23 | |
| TheJulia | So greghaynes, about that question :) | 18:23 |
| greghaynes | https://review.openstack.org/#/c/95101/, https://review.openstack.org/#/c/94609/, https://review.openstack.org/#/c/98709, https://review.openstack.org/#/c/94354/ | 18:24 |
| *** andreaf_ has joined #tripleo | 18:24 | |
| greghaynes | I *think* thats it for overcloud_controlscale > 1 with no ssl | 18:24 |
| *** jp_at_hp has quit IRC | 18:24 | |
| lifeless | greghaynes: you know what might be cool? a trello card or wiki page that ists the set of stuff to burn down | 18:25 |
| TheJulia | (That would be most excellent to have) | 18:25 |
| greghaynes | hrm, ill trello | 18:25 |
| *** yfaykya has quit IRC | 18:26 | |
| *** andreaf_ has quit IRC | 18:26 | |
| lifeless | greghaynes: there are cards in the current MVP about this :) | 18:26 |
| greghaynes | Yep, seems like they could get broken out a bit | 18:26 |
| *** rcarrillocruz has joined #tripleo | 18:27 | |
| lifeless | greghaynes: you can also create todo items within a card | 18:27 |
| *** andreaf_ has joined #tripleo | 18:27 | |
| *** yfaykya has joined #tripleo | 18:27 | |
| greghaynes | aha! thats what I was looking for | 18:27 |
| lifeless | greghaynes: e.g. see https://trello.com/c/siJrd0BE/80-ha-db-percona-xtradb-cluster-to-start-with | 18:27 |
| *** lsmola__ has joined #tripleo | 18:31 | |
| *** yfaykya has quit IRC | 18:31 | |
| *** martyntaylor has left #tripleo | 18:32 | |
| *** yfaykya has joined #tripleo | 18:33 | |
| openstackgerrit | lifeless proposed a change to openstack/tripleo-specs: Also bind public services to a dedicated VIP https://review.openstack.org/100151 | 18:34 |
| greghaynes | TheJulia: ok, added some TODO's to the top 3 cards on https://trello.com/b/0jIoMrdo/tripleo | 18:36 |
| greghaynes | which are super MVP'ey | 18:36 |
| *** yfaykya has quit IRC | 18:37 | |
| greghaynes | pretty sure there does not exist any kind of work done on HAProxying mysql clients | 18:37 |
| greghaynes | and the rest have patches up | 18:37 |
| lifeless | tchaypo: https://trello.com/c/fTNQfscE/105-restore-vlan-support-for-public-apis may help lay things out a little - work items pulled together | 18:38 |
| lifeless | greghaynes: is the galera intra-cluster communication on the same port clients talk to ? | 18:39 |
| *** yfaykya has joined #tripleo | 18:39 | |
| *** shadower has quit IRC | 18:41 | |
| *** dtantsur has quit IRC | 18:41 | |
| *** jprovazn has joined #tripleo | 18:42 | |
| *** shadower has joined #tripleo | 18:42 | |
| *** dtantsur has joined #tripleo | 18:43 | |
| greghaynes | lifeless: I dont think so | 18:44 |
| greghaynes | looks like 4567 | 18:44 |
| *** yfaykya has quit IRC | 18:44 | |
| greghaynes | Asking for ssl? | 18:44 |
| lifeless | no, making sure when we put haproxy in front of mysql we dont' break the cluster | 18:44 |
| greghaynes | ah, looks like 4567 is for replication | 18:44 |
| greghaynes | I am confused because I dont see the iptables rule for this though | 18:44 |
| *** jang has joined #tripleo | 18:45 | |
| greghaynes | op, nvm, found it | 18:45 |
| greghaynes | elements/mysql-common/os-refresh-config/pre-configure.d/97-mysql-galera-iptables | 18:45 |
| *** yfaykya has joined #tripleo | 18:45 | |
| TheJulia | Can somebody add me to the trello board? juliakreger | 18:49 |
| TheJulia | well, the tripleo team | 18:49 |
| *** yfaykya has quit IRC | 18:50 | |
| *** lsmola__ has quit IRC | 18:50 | |
| lifeless | TheJulia: done, I think | 18:50 |
| *** andreaf has quit IRC | 18:51 | |
| TheJulia | greghaynes: good to know re: mysql... I now have a challenge! | 18:51 |
| *** yfaykya has joined #tripleo | 18:51 | |
| *** andreaf has joined #tripleo | 18:52 | |
| greghaynes | sweet | 18:53 |
| TheJulia | lifeless: Thank you, it looks good | 18:53 |
| *** lucas-afk is now known as lucasagomes | 18:53 | |
| *** lucasagomes has left #tripleo | 18:53 | |
| *** rcarrill` has joined #tripleo | 18:56 | |
| *** yfaykya has quit IRC | 18:56 | |
| *** yfaykya has joined #tripleo | 18:58 | |
| *** rcarrillocruz has quit IRC | 18:58 | |
| *** yfaykya has quit IRC | 19:02 | |
| *** jang1 has joined #tripleo | 19:03 | |
| *** lsmola__ has joined #tripleo | 19:03 | |
| *** yfaykya has joined #tripleo | 19:04 | |
| SpamapS | shadower: hey thanks for picking up the "compute all hosts matrix once" patch :) | 19:06 |
| *** adam_g` is now known as adam_g | 19:07 | |
| *** yfaykya has quit IRC | 19:08 | |
| *** lsmola__ has quit IRC | 19:08 | |
| *** yfaykya has joined #tripleo | 19:10 | |
| lifeless | dprince: ohai - netcnofig spec reviewed | 19:11 |
| *** nati_ueno has quit IRC | 19:11 | |
| dprince | lifeless: ack, let me check it out. | 19:12 |
| *** nati_ueno has joined #tripleo | 19:12 | |
| *** yfaykya has quit IRC | 19:15 | |
| *** yfaykya has joined #tripleo | 19:16 | |
| *** bnemec has quit IRC | 19:18 | |
| *** rcarrill` has quit IRC | 19:20 | |
| *** yfaykya has quit IRC | 19:21 | |
| *** bnemec has joined #tripleo | 19:21 | |
| *** morazi has quit IRC | 19:22 | |
| *** yfaykya has joined #tripleo | 19:22 | |
| *** dshulyak_ has quit IRC | 19:22 | |
| *** rcarrillocruz has joined #tripleo | 19:26 | |
| lifeless | dprince: I realised today that testing vlans in CI will require the ability to do two static ips on the sewed | 19:26 |
| *** yfaykya has quit IRC | 19:26 | |
| lifeless | dprince: one for the untagged lan and one for the vlan; so I'm thinking to do some explicitly unsupported hack | 19:26 |
| lifeless | dprince: in the interim until the new shiny comes along | 19:26 |
| lifeless | dprince: what do you think ? | 19:27 |
| dprince | lifeless: I think that sounds reasonable. sewed? | 19:27 |
| lifeless | seed | 19:28 |
| dprince | lifeless: ah, seed. yes | 19:28 |
| openstackgerrit | Gregory Haynes proposed a change to openstack/os-cloud-config: Make keystone_pki less keystone specific https://review.openstack.org/103637 | 19:28 |
| lifeless | specifically I need to do ensure-bridge and set a static IP on the bridge and a static IP on a vlan port | 19:28 |
| * vinsh makes lifeless less specific | 19:28 | |
| *** yfaykya has joined #tripleo | 19:28 | |
| greghaynes | hehe | 19:28 |
| lifeless | dprince: ok, so I'll document a hacky not-supported thing and let it die when the new shiny comes together | 19:29 |
| lifeless | dprince: btw dunno if you saw my mail - you -2'd the mac setting thing, I'm hoping you can reconsider | 19:29 |
| lifeless | bbiaw | 19:29 |
| *** julim has quit IRC | 19:30 | |
| *** morazi has joined #tripleo | 19:31 | |
| dprince | lifeless: I suppose I'd like to understand a bit more why this is happening I guess. Having to hard code the MAC on the bridge means we are duplicating information | 19:32 |
| *** yfaykya has quit IRC | 19:33 | |
| *** julim has joined #tripleo | 19:33 | |
| dprince | lifeless: I'd rather not have to push a MAC address override in via heat metadata. Especially when the intent is that it should just work | 19:33 |
| *** yfaykya has joined #tripleo | 19:34 | |
| lifeless | dprince: oh I think you misunderstand - its not via heat metadata; its picking up the MAC of the ethernet card | 19:35 |
| lifeless | dprince: which is the one it should use | 19:35 |
| *** amitpp has joined #tripleo | 19:35 | |
| *** mestery has joined #tripleo | 19:36 | |
| lifeless | dprince: but we're going to have something similar turn up when doing bonding | 19:38 |
| lifeless | dprince: chuckC has a draft spec for neutron to support bonding metadata - specifically to enable boot from degraded state | 19:38 |
| lifeless | chuckC: have you pushed that up to gerrit ? | 19:39 |
| *** yfaykya has quit IRC | 19:39 | |
| greghaynes | https://review.openstack.org/#/c/95101/ the new docs checking is awesome | 19:39 |
| *** panda has quit IRC | 19:39 | |
| greghaynes | tchaypo: ^ | 19:39 |
| *** panda has joined #tripleo | 19:39 | |
| *** yfaykya has joined #tripleo | 19:40 | |
| dprince | lifeless: ah, I see. But it *could* be via heat metadata too. Perhaps I was thinking about the new spec implementation of this already. | 19:42 |
| dprince | lifeless: I always sort of considered this an advanced option I guess. I hate to see us use it as our default... (especially since I see no reason for it on Fedora at this point) | 19:42 |
| *** yfaykya has quit IRC | 19:45 | |
| *** yfaykya has joined #tripleo | 19:47 | |
| dprince | lifeless: So in the case where one adds multiple physical NICs onto a bridge we'd need a way for the bridge config to know which MAC to choose. Right now that logic is in OVS because it selects the MAC for us (based on standard bridge behavoir/logic) | 19:48 |
| dprince | lifeless: honestly, would it be possible to move this one commit out of that patch series? It seems to be a different issue... I hate that the VLAN fix is blocked due to it | 19:50 |
| *** yfaykya has quit IRC | 19:51 | |
| tchaypo | greghaynes: You creepy | 19:51 |
| dprince | lifeless: I do like it better that we won't have to set the MAC via heat metadata though. Thanks for pointing that out. Still would like to understand some things on this myself though | 19:52 |
| *** yfaykya has joined #tripleo | 19:53 | |
| *** bcrochet has quit IRC | 19:54 | |
| *** nati_ueno has quit IRC | 19:55 | |
| *** markmc has quit IRC | 19:55 | |
| *** nati_ueno has joined #tripleo | 19:55 | |
| tchaypo | greghaynes: i had literally just rolled out of bed when i got the notification that you mentioned me. IT's like you were watching me | 19:56 |
| *** yfaykya has quit IRC | 19:57 | |
| *** bcrochet has joined #tripleo | 19:57 | |
| chuckC | lifeless: not yet. Had a question for you first. | 19:58 |
| chuckC | lifeless: has anyone considered using dhcp client_id instead of mac address? | 19:58 |
| *** yfaykya has joined #tripleo | 19:59 | |
| tchaypo | d | 19:59 |
| *** julim has quit IRC | 20:00 | |
| tchaypo | d | 20:00 |
| *** julim has joined #tripleo | 20:02 | |
| tchaypo | I need to get coffee beans today. Cannot survive mornings without them. | 20:02 |
| *** yfaykya has quit IRC | 20:03 | |
| *** dsneddon has quit IRC | 20:04 | |
| greghaynes | tchaypo: :) | 20:05 |
| tchaypo | greghaynes: i was going to say that the one thing I don't like so much about it is that the errors refer to a line in the generated .rst, and it's not always immediately clear which line of the .sh that corresponds to | 20:05 |
| tchaypo | but you managed to find an error that's new and special and completely clear. Well done sir! | 20:05 |
| *** yfaykya has joined #tripleo | 20:05 | |
| *** yfaykya has quit IRC | 20:09 | |
| *** yfaykya has joined #tripleo | 20:11 | |
| lifeless | chuckC: if you get it up we can get more eyeballs; no, I don't think they have. Its an interesting idea | 20:13 |
| *** amitpp has quit IRC | 20:14 | |
| openstackgerrit | James Polley proposed a change to openstack/tripleo-incubator: Generate overcloud keystone keys/certs https://review.openstack.org/95101 | 20:15 |
| *** morazi has quit IRC | 20:15 | |
| *** yfaykya has quit IRC | 20:16 | |
| *** dsneddon has joined #tripleo | 20:16 | |
| *** yfaykya has joined #tripleo | 20:17 | |
| greghaynes | tchaypo: Not sure I agree with that ^ | 20:17 |
| greghaynes | I dont see why we need to have that doc in our list | 20:17 |
| tchaypo | I was thinking it might make more sense to split out our TOC | 20:18 |
| greghaynes | Well, why not just make it so that doc doesnt match the glob | 20:18 |
| tchaypo | at the moment it's a list of links; i feel like it would make sense to group README.rst and devtest.rst into "overview" or "start here" or something | 20:18 |
| tchaypo | this would be part of a new "developer interest only" section | 20:19 |
| greghaynes | the point of those docs is someone can run these scripts manually-ish, and someone can do that without common_functions being added to the TOC | 20:19 |
| greghaynes | ah | 20:19 |
| tchaypo | changing the glob would be another option, but then you would have people looking at the docs for the bigger scripts unable to find out what the common functions did | 20:20 |
| greghaynes | IMO maybe do that in its own patch or somesuch | 20:20 |
| greghaynes | Why not just change the filename | 20:20 |
| tchaypo | without looking at the source. which should be fairly readable. | 20:20 |
| chuckC | lifeless: I'll post it today, probably later | 20:20 |
| greghaynes | (I made a comment about that on that review) | 20:20 |
| *** jang1 has quit IRC | 20:21 | |
| *** yfaykya has quit IRC | 20:22 | |
| *** yfaykya has joined #tripleo | 20:23 | |
| tchaypo | greghaynes: oh look, you did too. I read that earlier but thought you were talking about the check-tripleo-undercloud-precise failure. | 20:24 |
| openstackgerrit | Kiall Mac Innes proposed a change to openstack/diskimage-builder: Remove a few more `lsb_release -is` calls https://review.openstack.org/103651 | 20:25 |
| *** e0ne has joined #tripleo | 20:26 | |
| *** yfaykya has quit IRC | 20:28 | |
| *** e0ne has quit IRC | 20:28 | |
| tchaypo | greghaynes: the cleanest rename is probably to just drop the .sh | 20:28 |
| *** morazi has joined #tripleo | 20:29 | |
| *** yfaykya has joined #tripleo | 20:29 | |
| openstackgerrit | James Polley proposed a change to openstack/tripleo-incubator: Generate overcloud keystone keys/certs https://review.openstack.org/95101 | 20:31 |
| openstackgerrit | Kiall Mac Innes proposed a change to openstack/tripleo-image-elements: Remove a few more `lsb_release -is` calls https://review.openstack.org/103652 | 20:31 |
| *** yfaykya has quit IRC | 20:34 | |
| *** yfaykya has joined #tripleo | 20:36 | |
| *** e0ne has joined #tripleo | 20:36 | |
| *** yfaykya has quit IRC | 20:40 | |
| openstackgerrit | James Polley proposed a change to openstack/tripleo-incubator: Tidy/prettify/segregate the master toctree https://review.openstack.org/103656 | 20:41 |
| *** yfaykya has joined #tripleo | 20:42 | |
| *** e0ne has quit IRC | 20:42 | |
| tchaypo | http://docs-draft.openstack.org/56/103656/1/check/gate-tripleo-incubator-docs/1cbaa63/doc/build/html/ | 20:44 |
| tchaypo | not bad for a pre-caffiene tweak | 20:44 |
| *** jprovazn has quit IRC | 20:45 | |
| tchaypo | lifeless: my dreams this morning will help too - I think they helped me figure out how the parts of work tie together. | 20:45 |
| *** yfaykya has quit IRC | 20:46 | |
| * tchaypo heads out to address the 'feen situation | 20:47 | |
| *** yfaykya has joined #tripleo | 20:48 | |
| *** vinsh has quit IRC | 20:48 | |
| *** dprince has quit IRC | 20:51 | |
| *** yfaykya has quit IRC | 20:53 | |
| *** yfaykya has joined #tripleo | 20:54 | |
| *** yfaykya has quit IRC | 20:58 | |
| *** jdob has quit IRC | 20:59 | |
| *** weshay has quit IRC | 20:59 | |
| *** untriaged-bot has joined #tripleo | 21:00 | |
| untriaged-bot | Untriaged bugs so far: | 21:00 |
| untriaged-bot | https://bugs.launchpad.net/tripleo/+bug/1334581 | 21:00 |
| untriaged-bot | https://bugs.launchpad.net/tripleo/+bug/1335042 | 21:00 |
| untriaged-bot | https://bugs.launchpad.net/tripleo/+bug/1335105 | 21:00 |
| untriaged-bot | https://bugs.launchpad.net/diskimage-builder/+bug/1335932 | 21:00 |
| untriaged-bot | https://bugs.launchpad.net/tripleo/+bug/1335016 | 21:00 |
| uvirtbot | Launchpad bug 1334581 in tripleo "os-collect-config.conf need support to Heat userdata" [Undecided,In progress] | 21:00 |
| untriaged-bot | https://bugs.launchpad.net/tripleo/+bug/1333649 | 21:00 |
| uvirtbot | Launchpad bug 1335042 in tripleo "diskimage-builder: extlinux installation failure" [Undecided,New] | 21:00 |
| untriaged-bot | https://bugs.launchpad.net/diskimage-builder/+bug/1332458 | 21:00 |
| uvirtbot | Launchpad bug 1335105 in tuskar-ui "Devtest init script: sourcing tripleorc fails" [Undecided,New] | 21:00 |
| uvirtbot | Launchpad bug 1335932 in diskimage-builder "/bin/dib-run-parts fails for spanish locale" [Undecided,New] | 21:00 |
| untriaged-bot | https://bugs.launchpad.net/diskimage-builder/+bug/1332521 | 21:00 |
| uvirtbot | Launchpad bug 1335016 in tripleo "diskimage-builder fails for Debian" [Undecided,New] | 21:00 |
| uvirtbot | Launchpad bug 1333649 in tripleo "/etc/hosts entries written by hosts element doesn't survive reboot" [Undecided,In progress] | 21:00 |
| *** untriaged-bot has quit IRC | 21:00 | |
| uvirtbot | Launchpad bug 1332458 in diskimage-builder "Not able to build armhf or arm64 images on amd64 arch systems." [Undecided,In progress] | 21:00 |
| uvirtbot | Launchpad bug 1332521 in diskimage-builder "failed to remove `/tmp/image.A2aupYJb/mnt/tmp/in_target.d': Device or resource busy" [Undecided,New] | 21:00 |
| *** yfaykya has joined #tripleo | 21:00 | |
| *** edmund1 has joined #tripleo | 21:02 | |
| *** yamahata has joined #tripleo | 21:02 | |
| *** edmund has quit IRC | 21:02 | |
| *** yfaykya has quit IRC | 21:04 | |
| *** yfaykya has joined #tripleo | 21:06 | |
| *** davidlenwell_ is now known as davidlenwell | 21:07 | |
| *** ChanServ sets mode: +v davidlenwell | 21:08 | |
| *** yfaykya has quit IRC | 21:11 | |
| *** yfaykya has joined #tripleo | 21:12 | |
| *** yfaykya has quit IRC | 21:16 | |
| *** akrivoka has quit IRC | 21:18 | |
| *** yfaykya has joined #tripleo | 21:18 | |
| *** julim has quit IRC | 21:21 | |
| *** yfaykya has quit IRC | 21:23 | |
| *** yfaykya has joined #tripleo | 21:25 | |
| *** dsneddon has quit IRC | 21:26 | |
| *** nati_uen_ has joined #tripleo | 21:27 | |
| *** EntropyWorks_ has joined #tripleo | 21:28 | |
| *** dsneddon has joined #tripleo | 21:28 | |
| *** rcarrill` has joined #tripleo | 21:28 | |
| *** panda__ has joined #tripleo | 21:28 | |
| *** yamahata__ has joined #tripleo | 21:29 | |
| *** yfaykya has quit IRC | 21:29 | |
| *** ccrouch1 has joined #tripleo | 21:29 | |
| *** Daviey_ has joined #tripleo | 21:30 | |
| *** yfaykya has joined #tripleo | 21:31 | |
| *** jogo_awa1 has joined #tripleo | 21:31 | |
| *** Shrews_ has joined #tripleo | 21:32 | |
| *** edmund has joined #tripleo | 21:34 | |
| *** EntropyWorks has quit IRC | 21:34 | |
| *** EntropyWorks_ is now known as EntropyWorks | 21:34 | |
| *** panda has quit IRC | 21:34 | |
| *** rcarrillocruz has quit IRC | 21:34 | |
| *** ubuntu has joined #tripleo | 21:35 | |
| *** nati_ueno has quit IRC | 21:35 | |
| *** Shrews has quit IRC | 21:35 | |
| *** jogo_away has quit IRC | 21:35 | |
| *** kevinbenton has quit IRC | 21:35 | |
| *** zaro has quit IRC | 21:35 | |
| *** Daviey has quit IRC | 21:35 | |
| *** juice has quit IRC | 21:35 | |
| *** yamahata has quit IRC | 21:35 | |
| *** greghaynes has quit IRC | 21:35 | |
| *** edmund1 has quit IRC | 21:36 | |
| *** ccrouch has quit IRC | 21:36 | |
| *** Daviey_ is now known as Daviey | 21:36 | |
| *** ubuntu is now known as Guest37445 | 21:36 | |
| *** yfaykya has quit IRC | 21:36 | |
| *** kevinbenton has joined #tripleo | 21:36 | |
| *** yfaykya has joined #tripleo | 21:37 | |
| *** juice has joined #tripleo | 21:37 | |
| *** hewbrocc` is now known as hewbrocca | 21:38 | |
| *** yfaykya has quit IRC | 21:41 | |
| openstackgerrit | Clint 'SpamapS' Byrum proposed a change to openstack/diskimage-builder: Last ditch effort to correct a wrong shasum. https://review.openstack.org/88084 | 21:42 |
| *** blamar has quit IRC | 21:43 | |
| *** yfaykya has joined #tripleo | 21:43 | |
| *** jang has quit IRC | 21:43 | |
| openstackgerrit | Gregory Haynes proposed a change to openstack/os-cloud-config: Make keystone_pki less keystone specific https://review.openstack.org/103637 | 21:44 |
| *** greghaynes has joined #tripleo | 21:44 | |
| *** yfaykya has quit IRC | 21:47 | |
| *** yfaykya has joined #tripleo | 21:49 | |
| *** yfaykya has quit IRC | 21:53 | |
| *** yfaykya has joined #tripleo | 21:55 | |
| *** andreaf_ has quit IRC | 21:56 | |
| *** chuckC has quit IRC | 21:58 | |
| *** yfaykya has quit IRC | 22:00 | |
| tchaypo | feen. | 22:00 |
| *** dsneddon has quit IRC | 22:01 | |
| *** yfaykya has joined #tripleo | 22:01 | |
| *** dsneddon_ has joined #tripleo | 22:02 | |
| *** dsneddon_ is now known as dsneddon | 22:02 | |
| *** panda__ is now known as panda | 22:05 | |
| *** panda is now known as Guest70067 | 22:05 | |
| *** yfaykya has quit IRC | 22:07 | |
| *** yfaykya has joined #tripleo | 22:07 | |
| *** Guest70067 is now known as panda | 22:08 | |
| *** Penick has quit IRC | 22:10 | |
| *** yfaykya has quit IRC | 22:12 | |
| *** yfaykya has joined #tripleo | 22:14 | |
| *** yfaykya has quit IRC | 22:19 | |
| *** yfaykya has joined #tripleo | 22:20 | |
| *** yfaykya has quit IRC | 22:24 | |
| *** yfaykya has joined #tripleo | 22:26 | |
| *** rdopieralski has quit IRC | 22:27 | |
| openstackgerrit | James Polley proposed a change to openstack/tripleo-heat-templates: Have HAProxy bind to the public IP as well as the internal IP https://review.openstack.org/103039 | 22:27 |
| *** morazi has quit IRC | 22:27 | |
| *** yfaykya has quit IRC | 22:30 | |
| *** blamar has joined #tripleo | 22:32 | |
| *** yfaykya has joined #tripleo | 22:32 | |
| *** yfaykya has quit IRC | 22:36 | |
| *** yfaykya has joined #tripleo | 22:38 | |
| *** rlandy has quit IRC | 22:41 | |
| *** yfaykya has quit IRC | 22:43 | |
| *** yfaykya has joined #tripleo | 22:44 | |
| *** yfaykya has quit IRC | 22:49 | |
| *** yfaykya has joined #tripleo | 22:50 | |
| greghaynes | StevenK: you around? | 22:51 |
| lifeless | ok, little break then onto hacks to get vlans in the seed | 22:51 |
| greghaynes | lifeless: https://review.openstack.org/#/c/95101/8 | 22:51 |
| lifeless | greghaynes: ready for +2 you think? | 22:52 |
| greghaynes | Yes (I just did) | 22:53 |
| greghaynes | I do think itd be nice to make it more general since were making other keys | 22:53 |
| greghaynes | er, since we have to make other certs | 22:53 |
| greghaynes | but that can happen in a later patch | 22:54 |
| lifeless | so the discussion I had with jprovazn seems to have had no impact, turned that into a -1 | 22:55 |
| *** yfaykya has quit IRC | 22:55 | |
| greghaynes | ah, some backscroll I should read up on? | 22:55 |
| lifeless | couple days ago yeah | 22:56 |
| *** yfaykya has joined #tripleo | 22:56 | |
| greghaynes | What do you mean by autogenerating? | 22:57 |
| greghaynes | just always assume we need to gen them? | 22:58 |
| lifeless | use their presence in the heat env as the flag to gen them or not. | 22:58 |
| greghaynes | ok, makes sense | 22:58 |
| greghaynes | Since we need to gen a handful of certs, we need to decouple the gen ca / gen cert scripts I think, when doing this though im unclear why we have the python in os-cloud-config for genning these rather then just running openssl directly | 22:59 |
| lifeless | tuskar | 23:00 |
| greghaynes | oh. that. | 23:00 |
| lifeless | the other cert we generate is the local API cert? | 23:01 |
| SpamapS | Jun 30 22:41:44 host-192-168-1-122 nova-compute[3549]: 2014-06-30 22:41:43.738 3549 TRACE nova.virt.baremetal.virtual_power_driver Stderr: 'Calling /usr/bin/virsh destroy "baremetalbrbm2_2" \nerror: Failed to destroy domain baremetalbrbm2_2\nerror: Failed to terminate process 8389 with SIGKILL: Device or resource busy\n' | 23:01 |
| SpamapS | known failure? | 23:01 |
| greghaynes | yes, and soon certs for internal replication | 23:01 |
| *** yfaykya has quit IRC | 23:02 | |
| lifeless | greghaynes: will they be a ca too? or just a cert | 23:02 |
| lifeless | we might want a spec about how many ca's we create :) | 23:02 |
| greghaynes | I was wondering why we ever do more than one CA? | 23:02 |
| greghaynes | seems like sharing a CA for seed/over/under cloud would be fine | 23:02 |
| *** yfaykya has joined #tripleo | 23:03 | |
| greghaynes | obviously we have to support specifing a different CA per service, but we just can use the same one all over | 23:03 |
| lifeless | mmm | 23:04 |
| lifeless | so seed+under is one security domain | 23:04 |
| lifeless | over is a different one | 23:04 |
| lifeless | I think we should take care not to conflate them | 23:04 |
| SpamapS | Yeah there are people who are excited about the separation we already have there. | 23:05 |
| greghaynes | Sure, my thinking is that this is all self-signed anyways so the separation doesnt really add anything. | 23:05 |
| SpamapS | self signed doesn't have a shared CA.. so ?? | 23:06 |
| SpamapS | you mean "same CA signed" ? | 23:06 |
| lifeless | greghaynes was suggesting we make one self signed root CA | 23:06 |
| lifeless | and use that in the keystone in all three clouds | 23:06 |
| *** weshay has joined #tripleo | 23:06 | |
| *** yfaykya has quit IRC | 23:07 | |
| lifeless | I think the issue there is that we might fail to correctly copy in the right cert and not notice because in test we had them all the same | 23:07 |
| lifeless | so it seems like a correctness risk we don't need to take | 23:07 |
| greghaynes | that fair | 23:07 |
| greghaynes | er, thats | 23:08 |
| greghaynes | What about per-service then? | 23:08 |
| *** TravT has joined #tripleo | 23:08 | |
| lifeless | well | 23:08 |
| lifeless | do we need CA's | 23:08 |
| lifeless | or keys | 23:08 |
| lifeless | keystone is a CA | 23:08 |
| lifeless | it issues keys. | 23:08 |
| *** yfaykya has joined #tripleo | 23:09 | |
| greghaynes | huh.. I assumed that wasnt possible because were not passing in the CA private key anywhere | 23:09 |
| lifeless | we may find keystone is utterly broken then :) | 23:10 |
| greghaynes | fun | 23:10 |
| SpamapS | keystone issues signed tokens | 23:11 |
| lifeless | but a moments consideration - PKI tokens | 23:11 |
| lifeless | :) | 23:11 |
| *** yfaykya has quit IRC | 23:13 | |
| greghaynes | yes, im not finding anywhere that keystone can issue a cert | 23:15 |
| *** yfaykya has joined #tripleo | 23:15 | |
| lifeless | so tokens are made in keystone/token/providers/pki.py | 23:16 |
| lifeless | which calls out to keystoneclient to sign the token | 23:16 |
| lifeless | taking the cert and the keyfile | 23:16 |
| greghaynes | Yes, so that sounds like a signature using keystone's cert | 23:17 |
| SpamapS | using keystones key | 23:17 |
| SpamapS | but yes | 23:17 |
| *** chuckC has joined #tripleo | 23:17 | |
| morganfainberg | S/MIME != certificates, but is a function of x509 (CMS) | 23:18 |
| morganfainberg | and it uses certs (x509) | 23:18 |
| lifeless | so thats using the private key, no ? | 23:18 |
| lifeless | I guess not the CA's private key | 23:18 |
| greghaynes | exactly | 23:18 |
| morganfainberg | lifeless, the key and the cert | 23:18 |
| lifeless | morganfainberg: see backscroll for context | 23:18 |
| lifeless | morganfainberg: the question at hand is how many CA's we want | 23:18 |
| morganfainberg | lifeless, this was the use the same CA for all clouds? | 23:19 |
| lifeless | morganfainberg: and how many certs | 23:19 |
| morganfainberg | lifeless, right | 23:19 |
| morganfainberg | lifeless, if you want to verify tokens from one cloud to the other, the certs must be the same | 23:19 |
| *** openstackgerrit has quit IRC | 23:19 | |
| *** yfaykya has quit IRC | 23:19 | |
| morganfainberg | lifeless, i don't think that is what you want | 23:20 |
| morganfainberg | lifeless, but a single CA could service all three clouds (not sure how you're manging the CA) | 23:20 |
| *** openstackgerrit has joined #tripleo | 23:20 | |
| morganfainberg | s/three/any number really/ | 23:20 |
| morganfainberg | unless you're concerned about compromise of the CA, a single CA might be easier. | 23:20 |
| morganfainberg | but i would still go separate certs per cloud. | 23:21 |
| greghaynes | If we wanted to do it "really right"(tm) I think we sub-ca per cloud, that might be a bit overkill in complexity | 23:21 |
| lifeless | so | 23:21 |
| morganfainberg | greghaynes, right | 23:21 |
| *** yfaykya has joined #tripleo | 23:21 | |
| lifeless | right now we do selfsigned cert per cloud | 23:21 |
| lifeless | we need to add more certs | 23:21 |
| lifeless | galera replication | 23:21 |
| greghaynes | selfsigned CA | 23:21 |
| lifeless | rabbit | 23:21 |
| lifeless | API endpoint | 23:21 |
| morganfainberg | ok, then a self-signed CA sounds like the best bet | 23:22 |
| lifeless | externally we care about CA for the API endpoint only | 23:22 |
| morganfainberg | or a CA per cloud | 23:22 |
| lifeless | since its the only one that clients will verify | 23:22 |
| morganfainberg | right, you can publish the CA cert as needed. | 23:22 |
| lifeless | supplying one's own token for keystone isn't a feature | 23:22 |
| morganfainberg | for adding to the chain. | 23:22 |
| lifeless | s/token/cert/ | 23:22 |
| morganfainberg | for validate reasons tha tis | 23:22 |
| *** yamahata__ has quit IRC | 23:23 | |
| lifeless | greghaynes: so I think we probably have enough complexity here that this warrants a spec and operator eyeballs. | 23:23 |
| greghaynes | ok | 23:23 |
| lifeless | greghaynes: my inclination is to suggest we want a CA for seed+undercloud and a CA for each overcloud | 23:23 |
| lifeless | greghaynes: with separate certs per controller node for the replication stuff; a common cert for all controllers for keystone since it sounds like thats a limitation there. | 23:24 |
| morganfainberg | lifeless, greghaynes, with the number of certs you're talking about, that makes sense | 23:24 |
| lifeless | greghaynes: if the user doesn't supply certs for API endpoints, we should generate the ourselves, from a separate CA | 23:24 |
| lifeless | greghaynes: IMNSHO | 23:24 |
| greghaynes | Yes, I agree | 23:24 |
| greghaynes | That could plug in well with how companies internal PKI is setup - they may want to just gen a sub-ca per overcloud and then have us gen the certs from that | 23:25 |
| greghaynes | or at least ive heard of people wanting similar setups for things like puppet | 23:25 |
| lifeless | yah | 23:25 |
| *** yfaykya has quit IRC | 23:26 | |
| *** yfaykya has joined #tripleo | 23:27 | |
| *** yfaykya has quit IRC | 23:31 | |
| *** yfaykya has joined #tripleo | 23:33 | |
| *** xuhaiwei has joined #tripleo | 23:37 | |
| *** yfaykya has quit IRC | 23:37 | |
| *** yfaykya has joined #tripleo | 23:39 | |
| *** weshay has quit IRC | 23:41 | |
| *** yfaykya has quit IRC | 23:44 | |
| *** bkero has quit IRC | 23:44 | |
| *** yfaykya has joined #tripleo | 23:45 | |
| *** yfaykya has quit IRC | 23:50 | |
| *** yfaykya has joined #tripleo | 23:52 | |
| *** yfaykya has quit IRC | 23:57 | |
| *** yfaykya has joined #tripleo | 23:58 | |
| openstackgerrit | James Slagle proposed a change to openstack/tripleo-incubator: Update write-tripleorc https://review.openstack.org/97284 | 23:58 |
| openstackgerrit | James Slagle proposed a change to openstack/tripleo-incubator: Add vars to devtest_variables.sh https://review.openstack.org/97283 | 23:58 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!