| jeblair | i don't know, but this is getting complicated and i'd like to defer it to now+13 days | 00:01 |
|---|---|---|
| pabelanger | ya, thats what I planned on doing | 00:02 |
| pabelanger | hack up something at PTG after all the other stuff was done | 00:02 |
| dmsimard | jeblair: oh, I got something now that I hardcoded the role name: http://logs.openstack.org/52/496952/8/check/role-integration-emit-ara-html/fbb43ad/job-output.txt.gz#_2017-08-23_23_47_09_807264 | 00:18 |
| dmsimard | I guess ara is installed outside the bubblewrap or something like that ? | 00:18 |
| dmsimard | Or no, wait, that job is running on a node, not an executor | 00:18 |
| dmsimard | Yeah, I don't see how we can test the roles in the base job unless the base job picks them up from a review. For example, ara is installed (and the database) is on the executor, not on the nodepool VM. | 01:01 |
| dmsimard | So when trying to do a job that tests emit-ara-html, ara isn't installed there and the database isn't there either. | 01:02 |
| openstackgerrit | David Moreau Simard proposed openstack-infra/zuul-jobs master: WIP: Add a job to test emit-ara-html https://review.openstack.org/496952 | 01:03 |
| openstackgerrit | David Moreau Simard proposed openstack-infra/zuul-jobs master: WIP: Add a job to test emit-ara-html https://review.openstack.org/496952 | 01:04 |
| openstackgerrit | David Moreau Simard proposed openstack-infra/zuul-jobs master: WIP: Add a job to test emit-ara-html https://review.openstack.org/496952 | 01:05 |
| dmsimard | I tried in those attempts ^ to take out the "nodes" parameter so that it would run on the executor ? But I can't find a way to make it work. | 01:06 |
| openstackgerrit | Paul Belanger proposed openstack-infra/zuul-jobs master: WIP: Add test-role-ensure-twine job https://review.openstack.org/496994 | 03:15 |
| openstackgerrit | Paul Belanger proposed openstack-infra/zuul-jobs master: WIP: Add test-role-ensure-twine job https://review.openstack.org/496994 | 03:23 |
| openstackgerrit | Paul Belanger proposed openstack-infra/zuul-jobs master: WIP: Add test-role-ensure-twine job https://review.openstack.org/496994 | 03:25 |
| *** bhavik1 has joined #zuul | 05:03 | |
| *** bhavik1 has quit IRC | 05:51 | |
| *** smyers has quit IRC | 09:03 | |
| *** smyers has joined #zuul | 09:15 | |
| *** jkilpatr has quit IRC | 10:39 | |
| *** xinliang has quit IRC | 10:44 | |
| *** xinliang has joined #zuul | 10:57 | |
| *** xinliang has quit IRC | 10:57 | |
| *** xinliang has joined #zuul | 10:57 | |
| *** jkilpatr has joined #zuul | 11:13 | |
| mordred | dmsimard: that's good - we've spent a lot of effort to prevent you from doing that :) | 12:54 |
| *** dkranz has joined #zuul | 12:57 | |
| mordred | dmsimard: ultimately the thing we need (which is why it's gonna wind up being a post-PTG task) is a 2-node job that sets the things up on node one, then runs ansible-playbook on one node pointed at the other node and checks the results of having done so | 12:57 |
| *** amoralej is now known as amoralej|lunch | 13:05 | |
| openstackgerrit | Monty Taylor proposed openstack-infra/zuul feature/zuulv3: Document list of configuration items for include/exclude https://review.openstack.org/496928 | 13:08 |
| *** amoralej|lunch is now known as amoralej | 13:43 | |
| pabelanger | dmsimard: mordred: my dirty hack for testing roles, see 496994 | 14:59 |
| mordred | pabelanger: yah- that's largely the thing- needs to run on the remote node :) | 15:03 |
| mordred | pabelanger: although venv and that role don't seem super happy | 15:04 |
| *** bhavik1 has joined #zuul | 15:18 | |
| Shrews | i so love it when adding debug logging statements solves the problem you were trying to hunt down | 15:18 |
| jeblair | Shrews: better than comments | 15:33 |
| jeblair | turbo c++ 4ever | 15:35 |
| pabelanger | mordred: ya, pip install --user foo doesn't work well inside virtualenv | 15:36 |
| pabelanger | jeblair: mordred: I pushed up a patch last night to https://review.openstack.org/496428/ to reduce the number of post-run playbooks. Do you mind reviewing again? I'd like to try gpg signing for wheels / tarballs for testpypi | 15:37 |
| pabelanger | if you didn't see: https://testpypi.python.org/pypi/sandbox 0.0.13 uploaded yesterday | 15:37 |
| jeblair | pabelanger: lgtm | 15:40 |
| jeblair | clarkb: do the words "ironic_key" mean anything to you in the devstack-gate context? | 15:53 |
| jeblair | clarkb: oops, meant to ask that in infra | 15:53 |
| dmsimard | pabelanger: I don't understand what your hack is -- you mean you're running on localhost instead of on the node ? | 15:57 |
| dmsimard | pabelanger: re: testing roles | 15:57 |
| pabelanger | dmsimard: it is using ansible_connection=local, to avoid setting up SSH keys (but I think they are setup now), on a node from nodepool. | 15:58 |
| dmsimard | pabelanger: okay, that doesn't help me though ? The problem is that what I want to test is in the base job | 16:00 |
| dmsimard | and has some other dependencies -- like for emit-ara-html, the database and ara are on the executor, not the node | 16:01 |
| dmsimard | does localhost mean the executor or the node ? | 16:01 |
| pabelanger | dmsimard: that's what I am saying, you'll need to mock the executor on the node | 16:01 |
| pabelanger | you won't be able to run it on the executor pre-merge | 16:01 |
| *** bhavik1 has quit IRC | 16:02 | |
| pabelanger | dmsimard: we'll have some time at PTG to talk more about it :) | 16:02 |
| dmsimard | pabelanger: yeah I think that'd be best left for the PTG -- I just wanted to prevent unfortunate breakages from the base role | 16:03 |
| pabelanger | dmsimard: for now, we've been proposing changes to base-test first in project-config. That is a little more tricky when it comes to roles, since both playbooks use the same role | 16:04 |
| *** openstackgerrit has quit IRC | 16:04 | |
| *** openstackgerrit has joined #zuul | 16:22 | |
| openstackgerrit | David Shrewsbury proposed openstack-infra/nodepool feature/zuulv3: Revert "Allow launcher to stop quicker when asked" https://review.openstack.org/497480 | 16:22 |
| *** dmsimard is now known as dmsimard|afk | 17:30 | |
| jlk | good (late) morning all! | 18:17 |
| openstackgerrit | Merged openstack-infra/zuul feature/zuulv3: Document list of configuration items for include/exclude https://review.openstack.org/496928 | 18:26 |
| *** olaph has joined #zuul | 18:38 | |
| *** olaph1 has quit IRC | 18:40 | |
| openstackgerrit | Paul Belanger proposed openstack-infra/zuul-jobs master: Fix matched condition for gpg signing https://review.openstack.org/497551 | 18:49 |
| pabelanger | jlk: jeblair: mordred: ^mind a review, for sign-artifact role | 18:49 |
| pabelanger | http://logs.openstack.org/bd/f9d1843b6068bde096425166ba2f1c98e122e1bd/release/release-openstack-python/b0f7a57/job-output.txt.gz | 18:49 |
| jlk | reading. | 18:50 |
| pabelanger | jeblair: mordred: I also have a question / comment about secrets, specifically, why we don't use group / host vars for them. I think we could add some additional filtering, secrect side, and limit where we want that secret to show up. Today, we add it to extra_vars and any host will be able to access it. | 18:52 |
| jlk | Wasn't part of that decision the variable precedent? -e rules over all and cannot be changed during playbook execution (even with set_fact). | 18:56 |
| pabelanger | Ya, maybe that was it. offers protection for changing a serect | 18:58 |
| pabelanger | and everything I've read says you cannot limit -e to hosts / groups | 18:58 |
| jlk | right, it's global. | 18:58 |
| pabelanger | ya, so is having a global secret better? | 18:59 |
| jlk | what's the use case of limiting it to hosts? | 18:59 |
| jlk | I task could spread it around | 18:59 |
| jlk | and you could always access it via hostvars['hostname']['secret_name'] | 18:59 |
| pabelanger | so, our secrets in project-config, are only going to to be for localhost | 18:59 |
| jlk | every host has "access" to the variables for every other host | 19:00 |
| pabelanger | however, it is possible that a secret could be mistakenly run against not localhost (I just did this). While the key wasn't leaked into logs, it was copied to a remote node and then the node was deleted | 19:00 |
| pabelanger | if the secret was a hostvar for localhost, that would offer some protection I think | 19:01 |
| jlk | it doesn't limit where it's available | 19:01 |
| pabelanger | Ah, okay. | 19:01 |
| clarkb | this was one of the reasons why we kept our hiera data separate from ansible almost entirely with ansible-puppet iirc | 19:02 |
| pabelanger | so, like you say. you could hostvars['localhost']['secret_name'] from another node | 19:02 |
| clarkb | because ya ansible doesn't really partition data access | 19:02 |
| clarkb | so we did it independently | 19:02 |
| pabelanger | clarkb: right | 19:02 |
| pabelanger | tests.unit.test_executor.TestExecutorRepos failed, is that a new failure? | 19:06 |
| pabelanger | http://logs.openstack.org/51/497551/1/check/tox-py35-on-zuul/bcc250f/testr_results.html.gz | 19:06 |
| openstackgerrit | Merged openstack-infra/zuul-jobs master: Fix matched condition for gpg signing https://review.openstack.org/497551 | 19:16 |
| openstackgerrit | Paul Belanger proposed openstack-infra/zuul-jobs master: Stat pubring.gpg / secring.gpg for debugging https://review.openstack.org/497603 | 20:27 |
| pabelanger | jlk: jeblair: ^ collects some debug information about gpg files to help see what is going on with invalid packet issue | 20:28 |
| jeblair | pabelanger: are you saying that stat will calculate the sha1sum of a file? | 20:29 |
| jeblair | that's a very expensive operation. that seems counter-intuitive to me. | 20:30 |
| pabelanger | jeblair: ya, that is included in the results | 20:30 |
| jeblair | then we should stop using stat everywhere | 20:30 |
| pabelanger | ok | 20:31 |
| *** jkilpatr has quit IRC | 20:31 | |
| jeblair | or set get_checksoum to false or something | 20:33 |
| openstackgerrit | Paul Belanger proposed openstack-infra/zuul-jobs master: sha1sum pubring.gpg / secring.gpg for debugging https://review.openstack.org/497603 | 20:33 |
| jeblair | pabelanger: why did you change that? | 20:34 |
| pabelanger | that was your original suggestion, just seen get_checksum false | 20:35 |
| pabelanger | sorry, confused on which you'd like. | 20:35 |
| jeblair | pabelanger: yes, that was before i knew stat ran sha1sum. so either works. i had already approved that change, so i wonder why you changed it. | 20:35 |
| jeblair | pabelanger: i don't care | 20:35 |
| jeblair | pabelanger: i only want *something* to run sha1sum on those file | 20:35 |
| pabelanger | okay, I didn't see your +A, was writing patch | 20:36 |
| jeblair | pabelanger: i *don't* want to run sha1sum in all the places we used 'stat' to verify a file exists because it's overkill. but that's a different discussion. | 20:36 |
| pabelanger | jeblair: understood. We'll need to change that in tarball uploading, we stat today | 20:37 |
| openstackgerrit | Merged openstack-infra/zuul-jobs master: sha1sum pubring.gpg / secring.gpg for debugging https://review.openstack.org/497603 | 20:52 |
| *** jkilpatr has joined #zuul | 21:00 | |
| *** jkilpatr has quit IRC | 21:07 | |
| *** jkilpatr has joined #zuul | 21:18 | |
| clarkb | jlk: thanks for sorting out the offset confusion in the overlay change | 21:58 |
| clarkb | jlk: something like a delegate to localhost for loop over all the inventory entries and give each one offset of offset + 1 would work? | 22:01 |
| *** dmsimard|afk is now known as dmsimard | 22:46 | |
| mordred | pabelanger: also (re hostvars/groupsvars) we publish the inventory so people can see it, and putting secrets into a separate file allows us to not publish those | 23:13 |
| pabelanger | mordred: ya, the part I am unsure of is if /etc/ansible/host_vars/foosball would also end up in inventory files. If ansible did merging or something | 23:18 |
| pabelanger | but extra_vars does work | 23:18 |
| mordred | pabelanger: not in a way that would make us happy today - however - with the inventory plugin rework in 2.4 smart merging is possible | 23:19 |
| mordred | (things merge in 2.3, but it's ... wonkly) | 23:19 |
| mordred | pabelanger: cooll - mostly just wanted to respond - have been in meetings most of today | 23:19 |
| pabelanger | understood | 23:19 |
| pabelanger | mordred: np! When you have time tomorrow, I have gpg_key secret questions | 23:20 |
| mordred | pabelanger: awesome. I'm back home and online all of tomorrow | 23:21 |
| pabelanger | ++ | 23:21 |
| mordred | pabelanger: (are they in scrollback?) | 23:21 |
| pabelanger | mordred: ya, #openstack-infra | 23:21 |
| *** jkilpatr has quit IRC | 23:40 | |
| *** jkilpatr has joined #zuul | 23:40 | |
| openstackgerrit | James E. Blair proposed openstack-infra/zuul feature/zuulv3: Add proc to bubblewrap https://review.openstack.org/497698 | 23:59 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!