| jlk | SpamapS: define "we" | 00:09 |
|---|---|---|
| jlk | oh wait, I think I see what you're saying. I think the github driver uses an API call to do the "merge" | 00:09 |
| mordred | jlk: yah | 00:10 |
| jlk | I seem to recall there was a subtle difference, and that pushing instead of clicking the button doesn't do some of the things you want it to | 00:10 |
| mordred | jlk: and at a point in the future zuul shoudl also grow the option of pushing the refs that it created in the gate rather than API/button-click | 00:11 |
| mordred | we should remember when we do that that github tends to use the PR message as the commit message for the merge commit it makes - and that GH users might want to retain that behavior | 00:14 |
| SpamapS | I think that would match gerrit's behavior for merge commits. | 00:37 |
| *** studarus has quit IRC | 01:38 | |
| *** studarus has joined #zuul | 01:39 | |
| *** chandan_kumar has quit IRC | 02:19 | |
| *** etp has quit IRC | 02:19 | |
| *** chandan_kumar has joined #zuul | 02:21 | |
| *** etp has joined #zuul | 02:21 | |
| *** manjeets_ has joined #zuul | 02:39 | |
| *** studarus has quit IRC | 02:46 | |
| *** pwhalen has quit IRC | 02:46 | |
| *** nhicher has quit IRC | 02:46 | |
| *** toabctl has quit IRC | 02:46 | |
| *** manjeets has quit IRC | 02:46 | |
| *** odyssey4me has quit IRC | 02:46 | |
| *** panda has quit IRC | 02:49 | |
| *** panda has joined #zuul | 02:51 | |
| *** rlandy|bbl is now known as rlandy | 04:07 | |
| *** rlandy has quit IRC | 04:07 | |
| *** bjackman has joined #zuul | 05:15 | |
| openstackgerrit | Tristan Cacqueray proposed openstack-infra/nodepool master: Fix OpenShift driver typo https://review.openstack.org/631391 | 05:21 |
| *** saneax has joined #zuul | 05:26 | |
| openstackgerrit | Tristan Cacqueray proposed openstack-infra/zuul-jobs master: Add prepare-workspace-openshift role https://review.openstack.org/631402 | 05:43 |
| *** rcarrillocruz has joined #zuul | 06:27 | |
| openstackgerrit | Simon Westphahl proposed openstack-infra/zuul master: Add change message to Zuul vars in inventory https://review.openstack.org/631207 | 06:33 |
| *** quiquell|off is now known as quiquell | 06:35 | |
| *** bjackman has quit IRC | 06:46 | |
| *** bjackman has joined #zuul | 06:47 | |
| *** threestrands has quit IRC | 07:17 | |
| *** pcaruana has joined #zuul | 07:36 | |
| openstackgerrit | Simon Westphahl proposed openstack-infra/zuul master: Add change message to Zuul vars in inventory https://review.openstack.org/631207 | 07:45 |
| *** quiquell is now known as quiquell|brb | 07:47 | |
| *** saneax has quit IRC | 07:47 | |
| *** saneax has joined #zuul | 08:11 | |
| *** gtema has joined #zuul | 08:14 | |
| *** sanjayu_ has joined #zuul | 08:25 | |
| *** saneax has quit IRC | 08:28 | |
| *** themroc has joined #zuul | 08:30 | |
| *** hashar has joined #zuul | 08:33 | |
| *** jpena|off is now known as jpena | 08:39 | |
| openstackgerrit | Tristan Cacqueray proposed openstack-infra/zuul master: WIP: runner: implement prep-workspace https://review.openstack.org/607082 | 08:53 |
| openstackgerrit | Tristan Cacqueray proposed openstack-infra/zuul master: WIP: runner: add execute sub-command https://review.openstack.org/630944 | 08:53 |
| *** bjackman has quit IRC | 08:53 | |
| tristanC | got a successful local reproducer using https://review.openstack.org/630944 , including a working upload-logs phase | 08:53 |
| *** avass has joined #zuul | 08:54 | |
| openstackgerrit | Tobias Urdin proposed openstack-infra/zuul-jobs master: Fix upload-puppetforge role https://review.openstack.org/631194 | 09:16 |
| openstackgerrit | Tobias Urdin proposed openstack-infra/zuul-jobs master: Use PDK to build puppet module https://review.openstack.org/627534 | 09:17 |
| openstackgerrit | Tristan Cacqueray proposed openstack-infra/nodepool master: Implement an OpenShift Pod provider https://review.openstack.org/590335 | 09:32 |
| *** odyssey4me has joined #zuul | 09:44 | |
| *** quiquell|brb is now known as quiquell | 09:47 | |
| avass | is there any role like prepare-workspace for windows nodes? | 10:10 |
| openstackgerrit | Matthieu Huin proposed openstack-infra/zuul-jobs master: install-nodejs: add support for RPM-based OSes https://review.openstack.org/631049 | 10:14 |
| *** sshnaidm|afk is now known as sshnaidm | 10:25 | |
| tobiash | avass: not yet in zuul-jobs afaik | 10:36 |
| tobiash | avass: maybe I can upstream what we have today or tomorrow | 10:37 |
| *** sanjayu_ has quit IRC | 10:49 | |
| *** odyssey4me has quit IRC | 10:49 | |
| *** gtema has quit IRC | 10:51 | |
| quiquell | tobiash: hello there, I have a modified version of zuul quickstart connected to upstream gerrit, but scheduler fails with exit 1 | 11:13 |
| quiquell | tobiash: http://logs.rdoproject.org/52/18352/8/check/tripleo-ci-reproducer-fedora-28/1310cd6/tripleo-ci-reproducer/docker-compose.log | 11:13 |
| quiquell | tobiash: Maybe you can help me | 11:13 |
| quiquell | tobiash: the docker-compose ps is at the top of the file | 11:13 |
| *** hashar has quit IRC | 11:15 | |
| *** sanjayu_ has joined #zuul | 11:19 | |
| avass | tobiash: that would be nice | 11:21 |
| *** hashar has joined #zuul | 12:27 | |
| *** jpena is now known as jpena|lunch | 12:45 | |
| *** snapiri has joined #zuul | 12:46 | |
| *** shachar has joined #zuul | 12:47 | |
| sshnaidm | pabelanger, clarkb tristanC can you please review in your time | 12:47 |
| *** irclogbot_3 has quit IRC | 12:47 | |
| sshnaidm | https://review.openstack.org/#/c/630649/ | 12:47 |
| *** CrayZee has joined #zuul | 12:47 | |
| *** CrayZee has quit IRC | 12:47 | |
| *** shachar has quit IRC | 12:47 | |
| *** irclogbot_3 has joined #zuul | 12:59 | |
| mordred | corvus, tristanC: I donm't think the build page is quite ready to be the thing we return in all of the job status links ... but what if we returned it instead of the finger:// urls in the times when we don't havea log url | 13:06 |
| *** logan- has joined #zuul | 13:09 | |
| tristanC | mordred: what about adding a link to the buildset page proposed in 630079 ? | 13:10 |
| *** gtema has joined #zuul | 13:11 | |
| tristanC | mordred: right now it doesn't do much, but it could do the "fetch last failed task output" thing for each failed job | 13:13 |
| tristanC | mordred: so would it possible to add an extra link to the report message? | 13:14 |
| mordred | tristanC: well - I was thinking ahead a little bit to gerrit 2.15 with the build results reporting interface - and to the github checks api with essentially the same thing | 13:18 |
| *** rlandy has joined #zuul | 13:19 | |
| mordred | adn a bit to the current situation where when something happens like a bad POST_FAILURE or a DISK_FULL and there is no log_url returned - we're returning a finger url which is *never* a valid thing | 13:19 |
| mordred | tristanC: I donm't thinkm returning a link to ath buildset page is a bad idea - especially in teh "starting" message | 13:20 |
| mordred | tristanC: was mostly thinking that dashboard/tenant/:tenant/build/:build_id would be a better fallback url than the finger:// in those extreme error cases | 13:21 |
| mordred | because at least it's a link that goes somewhere rather tahn a completely non-functional url to a thing that by the time it is reported cant even be used for finger anymore | 13:22 |
| mordred | :) | 13:22 |
| tristanC | mordred: good point, the buildset page could even try to foldback to the change status when the buildset isn't complete yet | 13:22 |
| tristanC | mordred: how the scheduler would know what is the zuul-web url and if it's white-labelled? | 13:22 |
| tristanC | something like a per tenant configuration? | 13:23 |
| *** irclogbot_3 has quit IRC | 13:35 | |
| openstackgerrit | Paul Belanger proposed openstack-infra/zuul master: Add data_files entry for zuul/web/static https://review.openstack.org/631494 | 13:36 |
| pabelanger | mordred: corvus: tobiash: tristanC: what do you think about adding the data_files section to setup.cfg, to make it more friendly to find the path of static folder? ^ | 13:36 |
| *** quiquell is now known as quiquell|lunch | 13:38 | |
| *** jpena|lunch is now known as jpena | 13:41 | |
| mordred | tristanC: I thnik some config is unavoidable there | 13:48 |
| *** irclogbot_3 has joined #zuul | 13:49 | |
| *** quiquell|lunch is now known as quiquell | 13:59 | |
| openstackgerrit | Paul Belanger proposed openstack-infra/zuul master: Fix missing safe_args for add_host https://review.openstack.org/630866 | 14:00 |
| openstackgerrit | Paul Belanger proposed openstack-infra/zuul master: Allow known_hosts to be run in untrusted context https://review.openstack.org/631020 | 14:00 |
| openstackgerrit | Matthieu Huin proposed openstack-infra/zuul-jobs master: Propose some job writing guidelines https://review.openstack.org/631507 | 14:00 |
| pabelanger | mordred: corvus: clarkb: I noticed openstack system-config job is also seeing add_host issue from executor: http://logs.openstack.org/47/631047/1/promote/infra-prod-zuul_reconfigure/bf54c38/job-output.txt.gz#_2019-01-15_19_50_36_589792 | 14:01 |
| chandan_kumar | pabelanger: Hello | 14:20 |
| chandan_kumar | pabelanger: I am getting this error python-tempestconf-tempest-os-tempest python-tempestconf-tempest-os-tempest : ERROR Unable to find role in /var/lib/zuul/builds/3a67128ccb74446a8351daea168b48fc/ansible/playbook_0/role_2/config_template on this review https://review.openstack.org/#/c/627482/ | 14:20 |
| pabelanger | chandan_kumar: lets move this to #openstack-infra | 14:28 |
| avass | it's not possible to set node-specific variables for ansible in nodepool is it? | 14:28 |
| chandan_kumar | pabelanger: we are talking on #openstack-ansible with dmsimard | 14:28 |
| pabelanger | k | 14:29 |
| mordred | avass: no - not right now - what sort of thing are you trying to do? | 14:31 |
| *** gtema has quit IRC | 14:31 | |
| mordred | avass: I think pabelanger was woring a while back on adding variables to a nodeset definition - but I don't think we got anywhere with that | 14:31 |
| mordred | pabelanger: ^^ ? | 14:31 |
| pabelanger | mordred: avass: yah, discussed it never wrote any code. Best I could come up with was new jobs per nodeset and use inventory variables per normal | 14:33 |
| openstackgerrit | Monty Taylor proposed openstack-infra/zuul master: Return the dashboard build url for builds with no URL https://review.openstack.org/631516 | 14:33 |
| mordred | tristanC, corvus: ^^ there's a stab at returning links to dashboard build page instead of finger:// urls when really bad errors happen | 14:34 |
| avass | morderd, pabelanger: damn, would have been nice to have on static nodes with deviating setup | 14:35 |
| mordred | there was also discussion of trying to collect some of the error logging in the executor if the final playbook is a failure and storing it in the db so that the dashboard could show people those errors that are often otherwise hidden | 14:35 |
| mordred | avass: should those be different labels? (mostly just thinking out loud and poking at what you need a bit to understand the issue) | 14:36 |
| avass | mordred: don't think so since they would do the same job, mostly just putting the workspace on different places | 14:36 |
| mordred | avass: or is it more "I have 4 static nodes that are all *basically* the same from a scheduling perspective, but they have specific characteristics tht would be good to know about" | 14:36 |
| mordred | nod | 14:37 |
| avass | mordred: pretty much that yes | 14:37 |
| mordred | avass: well ... could you encode that workspace location relative to the home dir of whatever user zuul uses to log in? | 14:37 |
| mordred | avass: then use {{ ansible_user_dir }}/workspace or something like that in your jobs? | 14:38 |
| mordred | I don't see a way to set ansible_user_dir in the inventory and think that pretty much just always comes from $HOME of the ansible_user | 14:40 |
| avass | mordred: it's windows nodes and I need to be able to place the workspace on different hard-drives. but i could probably create some sort of workaround | 14:41 |
| mordred | ah - gotcha | 14:41 |
| mordred | interesting | 14:41 |
| avass | would make a lot of sense setting it as a node variable | 14:41 |
| mordred | tobiash: ^^ that sounds like a setting that might be generally useful for people with windows nodes? | 14:41 |
| mordred | yeah. pondering it in my brainhole - I can see the usecase at leadt | 14:42 |
| pabelanger | does each job you are working with, need a different nodeset? | 14:44 |
| avass | pabelanger: some jobs need different nodesets | 14:45 |
| tobiash | avass: you can set node specific variables in the nodeset at least | 14:45 |
| pabelanger | yah, I am thinking maybe just use host-vars, and setup new jobs for each different nodeset you need | 14:46 |
| pabelanger | or even group-vars | 14:47 |
| avass | tobiash: yes but I'll still have to check which node I got don't I? | 14:47 |
| tobiash | quiquell: sorry, I was really busy today (and not with the fun stuff). Still need help? | 14:47 |
| avass | tobiash: since the same label might have a different setup | 14:48 |
| tobiash | avass: ah ok, so that would require adding some metadata to the node in nodepool | 14:48 |
| avass | yep | 14:48 |
| pabelanger | do you have example job stanza now? my brain isn't up to speed as tobiash this morning :) | 14:50 |
| tobiash | pabelanger: what example? | 14:51 |
| * tobiash needs more coffy | 14:51 | |
| mordred | tobiash: zomg me too | 14:51 |
| * tobiash needs more coffee for better typing | 14:51 | |
| pabelanger | tobiash: I am confused why you need to check the label | 14:51 |
| quiquell | tobiash: no problem thanks, found the issue was totally unrelated to zuul :-) | 14:51 |
| quiquell | tobiash: zuul is perfect | 14:51 |
| tobiash | pabelanger: I had the wrong use case in mind | 14:52 |
| tobiash | I just noted the possibilities to add host vars to the nodeset in zuul config | 14:53 |
| tobiash | but I learned that this doesn't match avass's use case ;) | 14:53 |
| tobiash | avass: in nodepool (for dynamic nodes) there is node-attributes: https://zuul-ci.org/docs/nodepool/configuration.html#attr-providers.[openstack].pools.node-attributes | 14:54 |
| tobiash | but I'm not sure if that's plumbed through to the inventory | 14:54 |
| tobiash | if yes, the same thing could be added to static nodes | 14:54 |
| avass | tobiash: I'll take a look at it | 14:55 |
| openstackgerrit | Merged openstack-infra/nodepool master: Implement an OpenShift resource provider https://review.openstack.org/570667 | 15:39 |
| *** avass has quit IRC | 15:47 | |
| tobiash | jlk: what's the preferred pr update process in github3.py? followup commit or force push? | 15:48 |
| tobiash | tests failed on https://github.com/sigmavirus24/github3.py/pull/920 | 15:48 |
| *** quiquell is now known as quiquell|off | 16:06 | |
| corvus | mordred: why isn't it time to return the build url? | 16:20 |
| corvus | mordred: oh, right, sql database isn't required yet :) | 16:21 |
| corvus | mordred: here's the plan i proposed to tristanC: after we require the database, switch to returning the build url always. | 16:21 |
| corvus | mordred: i think we should do that instead of the 'return instead of finger' change because it suffers from the same problem (lack of sql db) | 16:22 |
| mordred | corvus: nod | 16:22 |
| mordred | corvus: I think we also need to either puts links to the console log directly or render the json directly or something - because if we switch to build page before that, it'll be "click to build page, click to logs dir, click to console.log" | 16:23 |
| mordred | (the logs dir is linked, so that's awesome - and it would totally be functional - but I thnik the extra click might get old ... although the "this is your error" section makes thing MUCH better | 16:24 |
| corvus | mordred: we should be able to add a link to the console log easily. remember we also have the plan to actually render all the logs in the js; maybe we can have some of that done by then too, but if not, the link will be good | 16:25 |
| mordred | corvus: ++ | 16:26 |
| corvus | tristanC's work to show the errors has incidentally created a framework for 'fetch some data from the log server and render it', so... you know, the rest is just typing :) | 16:26 |
| mordred | ++ | 16:32 |
| mordred | corvus: I think the patch I shoved up will still be mostly useful once we're ready to return the build urls | 16:32 |
| mordred | since it puts in thigs to let an admin tell zuul where the dashboard is | 16:33 |
| mordred | but I'll WIP it for now | 16:33 |
| corvus | mordred: yeah, i 'spect we'll need that | 16:33 |
| mordred | corvus: with the switch to Dockefiles and a bindep builder image - I think switching from python:alpine to python:slim is in order ... I believe tobiash has stopped using alpine as his base image for reasons | 16:36 |
| corvus | mordred: agreed, and i think SpamapS would agree too | 16:36 |
| mordred | corvus: (although unlike pbrx, I do think it's reasonable to support multiple base images with bindep builder image) | 16:36 |
| corvus | ya | 16:37 |
| mordred | I'm only doing one for now - but I think in the future it won't be terribly hard to expand the matrix to support some different python versions as well as :slim and :alpine | 16:37 |
| pabelanger | when do we think db for zuul is a hard requirement? I assume 4.0 work? | 16:38 |
| corvus | pabelanger: yep, currently hashing it out in that spec | 16:39 |
| pabelanger | ack, thanks I haven't looked at it yet. I should | 16:39 |
| corvus | but we might be able to land it soon. tobiash already wrote the patch. | 16:39 |
| dmsimard | do we know of any users deploying zuul without the database ? I'm not saying we should assume, just legitimately curious | 16:40 |
| corvus | (the issue now is we just need to work out the dev/release process/schedule -- do we land that patch and release 3.5, or save it for 4.0?) | 16:40 |
| corvus | dmsimard: i don't know of any off the top of my head, but i don't know all of them and i haven't asked :) | 16:40 |
| dmsimard | fair, thanks | 16:41 |
| corvus | i believe it's a reasonable requirement to add, with appropriate notice | 16:41 |
| rcarrillocruz | what's the purpose of the DB, is that going to replace gearman or ... | 16:42 |
| corvus | rcarrillocruz: no, mostly to support the build pages | 16:42 |
| corvus | rcarrillocruz: (zookeeper will replace gearman) | 16:42 |
| rcarrillocruz | ah ok, so the plan for going full on with zokeeper remains | 16:42 |
| rcarrillocruz | k | 16:43 |
| corvus | yep, plan being developed in https://review.openstack.org/621479 | 16:43 |
| Shrews | hrm, reading that, i have concerns about using zk as the queue mechanism | 16:50 |
| corvus | now is the best time to raise them :) | 16:51 |
| Shrews | corvus: noted inline | 16:54 |
| corvus | Shrews: thanks, good points; we may want to look at alternatives there; i jotted some ideas in response. | 17:00 |
| tobiash | The sequence numbers are 10 digit so with one event per second it will take 7600 years to roll over | 17:02 |
| tobiash | If I've done the math correctly | 17:03 |
| Shrews | the "Year 2000" problem, but with sequences instead of dates | 17:03 |
| Shrews | :) | 17:04 |
| tobiash | But ++ for avoiding the queue recipe | 17:04 |
| tobiash | I've more thought to use the more manual style similar to node requests | 17:05 |
| fungi | mordred: not sure if it's relevant for zuul/nodepool, but one distinct issue with using alpine is, ironically, python manylinux wheels don't work because they assume glibc and alpine chose uclibc | 17:19 |
| mordred | hah | 17:19 |
| *** themroc has quit IRC | 17:19 | |
| tobiash | corvus: if you have time, 613261 would need a second review. It's not my change but I co authored it so I didn't vote but I think it's an important bugfix | 17:20 |
| mordred | fungi: yeah - it makes some things slower - and is one reason pbrx (and the upcoming bindep builder image) does a pass building wheels from scratch | 17:21 |
| fungi | so if we have (transitive) dependencies which aren't pure python, then pip install is going to need a build toolchain in the image or we need to prebuild targeted wheels against uclibc outside the container and use those | 17:21 |
| *** panda is now known as panda|off | 17:34 | |
| pabelanger | when setting up the github connection in zuul.conf, only zuul-web needs access to webhook_token, api_id, api_key right? zuul-merger and executor just fetch via public https, iirc | 17:34 |
| *** hashar has quit IRC | 17:34 | |
| pabelanger | looking to minimize which services have access to the private data | 17:35 |
| corvus | pabelanger: i think the sched too | 17:38 |
| pabelanger | ack, will test out | 17:39 |
| *** jpena is now known as jpena|off | 17:43 | |
| tobiash | pabelanger: Merger also needs api key | 17:49 |
| tobiash | At least for non public repos | 17:49 |
| corvus | may as well include it everywhere | 17:50 |
| tobiash | But an anonymous fallback will trigger api rate limits much faster | 17:50 |
| *** manjeets_ is now known as manjeets | 17:51 | |
| pabelanger | thanks | 17:51 |
| corvus | good point, we really do want it everywhere | 17:51 |
| clarkb | tobiash: out of curiousity does ssh work for non public repos too? | 17:53 |
| tobiash | I didn't try it, but it gets the url from the driver which doesn't assume ssh | 17:55 |
| tobiash | So using ssh might even require an enhancement in the github Driver | 17:56 |
| clarkb | got it | 17:57 |
| dmsimard | integration tests for zuul-jobs have historically been in openstack-zuul-jobs | 18:02 |
| dmsimard | and I remember us actually migrating them over from zuul-jobs | 18:02 |
| dmsimard | I sort of forget why, though ? | 18:02 |
| dmsimard | I want to add an integration test job for a role that isn't part of a base job and it feels appropriate for that job to live in zuul-jobs | 18:03 |
| corvus | dmsimard: perhaps to keep the library clean? | 18:04 |
| dmsimard | corvus: it's not openstack-specific, though ? | 18:04 |
| corvus | dmsimard: no, but zuul-jobs is special. it's a library. anything in there is a public api. | 18:05 |
| corvus | dmsimard: jobs and roles in zuul-jobs which aren't used in config projects are self-tested by any job that uses them | 18:05 |
| corvus | dmsimard: so the vast majority of roles/jobs in there don't have explicit integration testing; we usually just point a depends-on change at them to verify they work after a change | 18:06 |
| corvus | not saying an explicit integration test wouldn't be appropriate, i don't know the context, but just saying that it would be atypical. | 18:07 |
| dmsimard | corvus: so we're adding support for different distros in the install-nodejs role: https://review.openstack.org/#/c/631049/ there is no job running on that patch that would tell me if it's broken or not on any distro currently | 18:08 |
| clarkb | as a simple option you could do a depends on from the consumption point | 18:10 |
| dmsimard | I can write the job to avoid the burden on the reviewer or the contributor to create a depends-on, openstack-zuul-jobs just feels like an odd place to put it | 18:11 |
| corvus | dmsimard: especially since you're talking specific OS's, the job(s) would need nodeset definitions, which can't live in zuul-jobs. | 18:14 |
| corvus | dmsimard: we can create a 'zuul-jobs-tests' repo for those. we'd probably need to do so when we create a dedicated opendev zuul tenant anyway. | 18:14 |
| corvus | (and move the existing integration tests from openstack-zuul-jobs to the new repo) | 18:14 |
| dmsimard | sure, it would help disambiguate what is openstack specific and what isn't | 18:15 |
| corvus | (btw, the rule for zuul-jobs is that a 'job' is the only config object we allow in its .zuul.yaml, and the jobs should not depend on anything not in zuul-jobs or zuul-base-jobs. that way it can be loaded by any zuul in the world without having to add an "include:" line to the tenant config. that's why we can't reference nodesets in there) | 18:17 |
| corvus | (which is alo why its project-pipeline config is in project-config and not in-repo) | 18:18 |
| corvus | dmsimard: so maybe stick it in openstack-zuul-jobs for now and we'll forklift it later | 18:21 |
| dmsimard | Works for me, not a blocker for now | 18:42 |
| pabelanger | changes to zuul.conf don't fully support reconfigure yet right? eg: you should stop / start zuul to properly make changes. | 18:56 |
| tobiash | pabelanger: correct | 19:10 |
| pabelanger | tobiash: danke! | 19:12 |
| tobiash | pabelanger: I think ot doesn't even get reloaded at all | 19:13 |
| pabelanger | yah, I think we always stop /start zuul in openstack when we update it | 19:14 |
| corvus | mordred, clarkb: for pass-to-parent, should we allow a child-job secret to override a parent-job secret? i'm inclined to say "no" to reduce potential confusion (and, perhaps in some really complex cases which i can only hypothetically construct, open an actual vulnerability). and maybe, if we want to support that in the future, we later add yet another flag which is job.secret.allow-override. | 19:22 |
| openstackgerrit | James E. Blair proposed openstack-infra/zuul-jobs master: docker: rename credentials rolevar https://review.openstack.org/631602 | 19:26 |
| corvus | clarkb, pabelanger, mordred: ^ also, i'm reminded we should have done that | 19:26 |
| *** rfolco has joined #zuul | 19:28 | |
| openstackgerrit | James E. Blair proposed openstack-infra/zuul-jobs master: docker: prefix role vars https://review.openstack.org/631602 | 19:29 |
| corvus | oops it's worse, code didn't match docs | 19:29 |
| corvus | clarkb, pabelanger, mordred: ^ | 19:29 |
| clarkb | corvus: I can't come up with a reason where overriding credentials would be useful. I think the implication ther eis the parent job does the wrong thing and maybe you need your own job? | 19:30 |
| clarkb | in any case that workaround is straightforward enough (if verbose) that having that restriction seems fine | 19:30 |
| corvus | clarkb: yeah, if i were to try to construct a use case, i'd lean toward "the job has default credentials but you could supply your own" | 19:31 |
| corvus | "you can upload to stackforge using the default job, or supply your own credentials otherwise". but, honestly, if you want that, you can probably construct a job hierachy that has a job with no credentials that people can just inherit from. | 19:32 |
| corvus | whereas the downside might be something like: a job uses two credentials, one to fetch an artifact and the other to publish, but a user overrode the fetch credentials to cause a malicious artifact to be published to a trusted location. | 19:33 |
| corvus | (of course, that job should probably have 'final:true' but...) | 19:33 |
| pabelanger | heads up, ansiblefest in Atlanta Sept 24-26, interested people: https://www.ansible.com/ansiblefest | 19:37 |
| corvus | pabelanger: thanks, can you add that to lsell's etherpad? | 19:39 |
| pabelanger | sure | 19:40 |
| *** rfolco has quit IRC | 19:49 | |
| Shrews | ooh, atlanta. that's drivable | 20:00 |
| Shrews | driveable? | 20:00 |
| pabelanger | I've done that before from here, fun trip. | 20:01 |
| corvus | did someone say dirigible? | 20:02 |
| clarkb | pabelanger: that is a longer drive for you than Shrews :P | 20:04 |
| *** toabctl has joined #zuul | 20:05 | |
| pabelanger | clarkb: Yah, 2 days of driving IIRC, was with leifmadsen. We stopped overnight in Ohio. Good times. | 20:05 |
| pabelanger | Astricon 2011, I think | 20:05 |
| pabelanger | would be 12hr drive now, which isn't that bad. We did 11hr drive up north to inlaws for Christmas. | 20:06 |
| *** pcaruana has quit IRC | 20:09 | |
| *** gtema has joined #zuul | 20:12 | |
| *** sanjayu_ has quit IRC | 20:18 | |
| openstackgerrit | Merged openstack-infra/zuul-jobs master: docker: prefix role vars https://review.openstack.org/631602 | 20:19 |
| *** irclogbot_3 has quit IRC | 20:41 | |
| *** irclogbot_3 has joined #zuul | 20:52 | |
| *** openstackgerrit has quit IRC | 20:56 | |
| *** threestrands has joined #zuul | 21:36 | |
| corvus | mordred: ptp requires a lot of tests :) | 22:14 |
| *** openstackgerrit has joined #zuul | 22:37 | |
| openstackgerrit | James E. Blair proposed openstack-infra/zuul master: Add pass-to-parent option for secrets https://review.openstack.org/631670 | 22:37 |
| openstackgerrit | Merged openstack-infra/zuul master: Fix missing safe_args for add_host https://review.openstack.org/630866 | 22:42 |
| openstackgerrit | James E. Blair proposed openstack-infra/zuul master: web: add OpenAPI documentation https://review.openstack.org/535541 | 22:52 |
| openstackgerrit | James E. Blair proposed openstack-infra/zuul master: web: add OpenAPI documentation https://review.openstack.org/535541 | 22:54 |
| *** threestrands has quit IRC | 23:04 | |
| openstackgerrit | Merged openstack-infra/zuul master: Allow known_hosts to be run in untrusted context https://review.openstack.org/631020 | 23:06 |
| openstackgerrit | Merged openstack-infra/zuul master: Add change message to Zuul vars in inventory https://review.openstack.org/631207 | 23:13 |
| *** threestrands has joined #zuul | 23:56 | |
| openstackgerrit | James E. Blair proposed openstack-infra/zuul master: openapi: use swagger.yaml instead of json https://review.openstack.org/631681 | 23:59 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!