| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-operator master: Add initial withCertManager input toggle https://review.opendev.org/718840 | 00:17 |
|---|---|---|
| *** saneax_ has quit IRC | 00:29 | |
| *** jamesmcarthur has quit IRC | 00:31 | |
| *** jamesmcarthur has joined #zuul | 00:36 | |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-operator master: Add gearman tls secret provided by cert-manager https://review.opendev.org/719110 | 01:21 |
| *** swest has quit IRC | 01:23 | |
| *** jamesmcarthur has quit IRC | 01:38 | |
| *** swest has joined #zuul | 01:38 | |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-operator master: Add initial withCertManager input toggle https://review.opendev.org/718840 | 01:42 |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-operator master: Add gearman tls secret provided by cert-manager https://review.opendev.org/719110 | 01:42 |
| *** jamesmcarthur has joined #zuul | 01:42 | |
| *** jamesmcarthur has quit IRC | 01:56 | |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-operator master: Improve logs collection https://review.opendev.org/719129 | 01:59 |
| *** jamesmcarthur has joined #zuul | 02:09 | |
| *** bhavikdbavishi has joined #zuul | 02:56 | |
| *** cdearborn has quit IRC | 02:58 | |
| *** bhavikdbavishi1 has joined #zuul | 02:59 | |
| *** bhavikdbavishi has quit IRC | 03:01 | |
| *** bhavikdbavishi1 is now known as bhavikdbavishi | 03:01 | |
| *** jamesmcarthur has quit IRC | 03:13 | |
| *** Goneri has quit IRC | 03:22 | |
| *** jamesmcarthur has joined #zuul | 03:37 | |
| *** bhavikdbavishi has quit IRC | 03:42 | |
| *** bhavikdbavishi has joined #zuul | 03:43 | |
| *** bhavikdbavishi has quit IRC | 04:22 | |
| *** bhavikdbavishi has joined #zuul | 04:24 | |
| *** bhavikdbavishi has quit IRC | 04:30 | |
| *** evrardjp has quit IRC | 04:37 | |
| *** evrardjp has joined #zuul | 04:37 | |
| *** jamesmcarthur_ has joined #zuul | 04:44 | |
| *** jamesmcarthur has quit IRC | 04:47 | |
| *** jamesmcarthur has joined #zuul | 04:48 | |
| *** jamesmcarthur_ has quit IRC | 04:52 | |
| *** jamesmcarthur has quit IRC | 04:52 | |
| *** jamesmcarthur has joined #zuul | 04:52 | |
| *** jamesmcarthur_ has joined #zuul | 04:54 | |
| *** jamesmcarthur has quit IRC | 04:58 | |
| *** bhavikdbavishi has joined #zuul | 05:03 | |
| *** jamesmcarthur_ has quit IRC | 05:28 | |
| *** msuszko has joined #zuul | 06:48 | |
| *** bhavikdbavishi has quit IRC | 07:26 | |
| *** bhavikdbavishi has joined #zuul | 07:50 | |
| *** tosky has joined #zuul | 08:29 | |
| zbr | can we merge https://review.opendev.org/#/c/718284/ ? | 09:07 |
| zbr | mnaser: AJaeger corvus ^ | 09:08 |
| AJaeger | zbr: there's a question by corvus on the change that ianw should answer first IMHO | 10:09 |
| zbr | ahh, the one I answered two days ago, not sure if needs addresing but lets wait for them. | 10:23 |
| *** gtema has joined #zuul | 11:11 | |
| *** gtema has quit IRC | 11:48 | |
| *** sgw has quit IRC | 11:52 | |
| AJaeger | zbr: then let's wait for corvus to answer back - or agree to move forward with 718284 (and the stack on top of it) | 12:25 |
| *** ChanServ has quit IRC | 12:55 | |
| *** ChanServ has joined #zuul | 13:03 | |
| *** tepper.freenode.net sets mode: +o ChanServ | 13:03 | |
| *** ChanServ has quit IRC | 13:08 | |
| *** ChanServ has joined #zuul | 13:10 | |
| *** tepper.freenode.net sets mode: +o ChanServ | 13:10 | |
| *** bhavikdbavishi has quit IRC | 13:14 | |
| openstackgerrit | Tristan Cacqueray proposed zuul/nodepool master: config_validator: refactor the schema to a static method https://review.opendev.org/718582 | 13:47 |
| *** msuszko has quit IRC | 13:53 | |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-operator master: Add gearman tls secret provided by cert-manager https://review.opendev.org/719110 | 13:57 |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-operator master: Improve logs collection https://review.opendev.org/719129 | 13:57 |
| tristanC | zuul-maint : please find another stack of operator changes to enable using the cert-manager, i tried to keep the modification atomic in logical orders, but this getting difficult to rebase and update previous changes. Tip of the stack is: https://review.opendev.org/719129. Reviews would be very much appreciated, thanks in advance! | 14:19 |
| *** bhavikdbavishi has joined #zuul | 14:33 | |
| -openstackstatus- NOTICE: Restarting gerrit to fix an issue from yesterday's maintenance | 14:35 | |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-operator master: Add gearman tls secret provided by cert-manager https://review.opendev.org/719110 | 14:40 |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-operator master: Improve logs collection https://review.opendev.org/719129 | 14:40 |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-operator master: Add registry tls secret provided by cert-manager https://review.opendev.org/719185 | 14:40 |
| *** Goneri has joined #zuul | 14:46 | |
| *** bhavikdbavishi has quit IRC | 14:50 | |
| openstackgerrit | James E. Blair proposed zuul/nodepool master: Add requires to zuul-quick-start job https://review.opendev.org/718708 | 14:55 |
| *** sassyn has joined #zuul | 16:08 | |
| sassyn | hi again | 16:09 |
| sassyn | I have a simple question: I understand the nodepool have two components: building and launching. | 16:10 |
| sassyn | What I understand is that building build the image in the cloud providers, using openstack element. | 16:10 |
| sassyn | launching is for using this build image in the IAAS provider | 16:11 |
| sassyn | and I assume that the zuul executor.private_key_file should be the key that the image was build with. | 16:12 |
| sassyn | my questions: 1. is that true? and if so nodepool doesn't need this key? | 16:13 |
| sassyn | 2. where is ansible take part? | 16:13 |
| sassyn | providers.[static].pools.nodes.username point that The username nodepool will use to validate it can connect to the node, but how can it connect? if it doesn't have the key? | 16:16 |
| sassyn | host-key: is the fingure print and not the ssh private key? what do I miss? | 16:16 |
| fungi | so... nodepool doesn't necessarily build images *in* the iaas provider | 16:19 |
| fungi | for typical cases it builds images locally in a chroot on the builder, and then uploads those images to the iaas provider | 16:20 |
| fungi | but yes, then the launcher communicates with the iaas provider to "boot" nodes from those uploaded images | 16:21 |
| corvus | sassyn: you can either build the key into the image, or ask the cloud provider to install the key for you (if it supports that) when it launches the vm. nodepool doesn't need the private key because it never logs into the vms; only zuul needs it. | 16:21 |
| corvus | sassyn: that's a good question about that doc for the static driver; let me check | 16:22 |
| fungi | for typical dynamic/ephemeral nodes though, zuul uses the private key to bootstrap a build key onto the nodes before handing off to the sandboxed ansible process with that key loaded into the ssh agent, so ansible never gets access to the original key | 16:23 |
| fungi | that way if someone manages to get ansible to spit out the private key it's connecting to nodes with, that key can't be reused against nodes for any other build because it's a throwaway key | 16:24 |
| corvus | sassyn: i think that documentation is just wrong and should say "the username that zuul should use to log into the node" or something like that | 16:25 |
| *** evrardjp has quit IRC | 16:37 | |
| *** evrardjp has joined #zuul | 16:37 | |
| openstackgerrit | Michał Suszko proposed zuul/nodepool master: diskimage.username setting was not read from configuration file https://review.opendev.org/719191 | 16:37 |
| sassyn | fungi as always thank u | 16:38 |
| fungi | you're welcome! we're all here to answer questions if you have more | 16:38 |
| sassyn | to be honest I have few | 16:39 |
| sassyn | but the work the team did is amazing! | 16:39 |
| sassyn | I debug the docker files how the all process is going and WOW! | 16:39 |
| fungi | i'm thrilled to hear that! | 16:40 |
| sassyn | so if I many summaries: nodepool only creating the instances with or without the help of the nodepool-building | 16:41 |
| sassyn | Nodepool-builder | 16:42 |
| *** msuszko has joined #zuul | 16:42 | |
| sassyn | why do I need the host-key ? | 16:43 |
| sassyn | in the /etc/nodepool/nodepool.yaml | 16:43 |
| sassyn | with static driver | 16:43 |
| clarkb | sassyn: I expect the driveris passing that along to zuul so that ansible connects to the host with verified host key | 16:46 |
| sassyn | ALSO in the https://zuul-ci.org/docs/zuul/howtos/nodepool_install.html there is a step "ssh-keygen -t rsa -m PEM -b 2048 -f nodepool_rsa -N '' | 16:46 |
| sassyn | understood clarkb | 16:46 |
| sassyn | thank u clarkb | 16:46 |
| tristanC | corvus: oops, the cert-manager change are actually not working for gear, it seems like the resulting certicates contains `X509v3 extensions` which result in python ssl lib to fails with `unsupported certificate purpose` | 16:46 |
| sassyn | I sill don't understand where is the ansible part | 16:49 |
| clarkb | sassyn: zuul executes ansible to run the jobs. Its sort of the last compnent in the chain | 16:51 |
| sassyn | if I have diskimages which is used by the diskimage-builder which is trigger from Nodepool-builder | 16:52 |
| sassyn | clarkb so basically it is simple ssh call | 16:53 |
| clarkb | ya ansible uses normal openssh by default | 16:53 |
| sassyn | OK | 16:53 |
| sassyn | with paramiko | 16:53 |
| sassyn | I guess | 16:53 |
| sassyn | so the jobs is ansible script | 16:53 |
| sassyn | How to run Nodepool-builder | 16:54 |
| sassyn | https://zuul-ci.org/docs/nodepool/operation.html#nodepool-builder it says it is a daemon | 16:55 |
| clarkb | yes, it runs as a persistend service like the launcher and also connects to zookeeper | 16:55 |
| clarkb | probably the biggest difference is it needs enough disk to build your images | 16:56 |
| sassyn | can u point to a doc where I configure the service | 16:56 |
| sassyn | I think I got it. | 16:56 |
| sassyn | it is the same /etc/nodepool/nodepool.yaml | 16:57 |
| sassyn | but one u use for the nodepool-launcher and one for nodepool-builder | 16:57 |
| sassyn | in diffrent machine | 16:57 |
| clarkb | it can use the same file yes | 16:57 |
| clarkb | https://zuul-ci.org/docs/nodepool/installation.html as well as your link above | 16:58 |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-operator master: Add initial withCertManager input toggle https://review.opendev.org/718840 | 16:59 |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-operator master: Add gearman tls secret provided by cert-manager https://review.opendev.org/719110 | 16:59 |
| sassyn | clarkb, fungi can u explain more about elements? | 17:01 |
| tristanC | here is the cert-manager output: http://paste.openstack.org/show/791958/ , and changing SSLContext of https://opendev.org/opendev/gear/src/branch/master/gear/__init__.py#L211 to ssl.PROTOCOL_TLS results in `sslv3 alert unsupported certificate` | 17:02 |
| fungi | sassyn: "elements" are basic units of image configuration in diskimage-builder | 17:03 |
| fungi | sassyn: typically diskimage-builder starts from some base element for the operating system itself and then other elements are arbitrary scripts/executables which it runs either inside the chroot or on the chroot tree from the host system | 17:04 |
| sassyn | like debian-bootstap | 17:04 |
| sassyn | boostrap | 17:04 |
| fungi | yep, like debootstrap, but then additional elements might do things like install extra packages, put specific files in place, edit existing files in the chroot, et cetera | 17:05 |
| sassyn | understood | 17:05 |
| *** msuszko has quit IRC | 17:05 | |
| fungi | for example, in opendev we have an element we use to pre-cache copies of all our git repositories on our images, so that zuul only needs to push a few refs for things which have merged since the last image build | 17:06 |
| *** jamesmcarthur has joined #zuul | 17:29 | |
| *** jamesmcarthur has quit IRC | 17:34 | |
| *** msuszko has joined #zuul | 17:44 | |
| *** msuszko has quit IRC | 17:52 | |
| *** msuszko has joined #zuul | 17:53 | |
| *** msuszko has quit IRC | 18:58 | |
| *** msuszko has joined #zuul | 18:59 | |
| *** jamesmcarthur has joined #zuul | 19:20 | |
| *** jamesmcarthur has quit IRC | 20:40 | |
| *** jamesmcarthur has joined #zuul | 20:41 | |
| *** jamesmcarthur has quit IRC | 20:47 | |
| sassyn | clarkb. fungi - One more question: in the scheduler.tenant_config it is required to configure config-projects and untrusted-projects. From what I understand When Zuul starts, it examines all of the git repositories which are specified by the system administrator in Tenant Configuration and searches for files in the root of each repository. | 20:56 |
| sassyn | So we have a config-projects name zuul that have zuul.d/pipelines.yaml + zuul.d/projects.yaml and is says: "we want all of the projects in Gerrit to participate in the check and gate pipelines" (in https://zuul-ci.org/docs/zuul/tutorials/quick-start.html) so that means it skipping what is configure in the tenant_config ? | 20:58 |
| sassyn | or the projects.yaml regular expression will include all the project that are configure in the tenant_config | 21:00 |
| clarkb | sassyn: zuul will only evaluate projects in the tenant config | 21:02 |
| clarkb | this means the regex is limited to that list | 21:02 |
| sassyn | Understood! | 21:02 |
| sassyn | thank u | 21:03 |
| sassyn | I find the documentation to be great, but I think there need to be done some arrangement. | 21:03 |
| sassyn | Not criticize just giving a feedback here | 21:04 |
| sassyn | I hope it is fine. | 21:04 |
| clarkb | sassyn: its been recently reorganized around howtos, tutorials, and reference material. I think now it needs to flesh out that content around those themes a bit more | 21:04 |
| sassyn | It is amazing project! | 21:05 |
| sassyn | So much insight and experience | 21:05 |
| sassyn | but it is not easy to learn | 21:06 |
| sassyn | I must admit | 21:06 |
| sassyn | I spent 3 days just to under stand how to work | 21:06 |
| sassyn | with this | 21:06 |
| sassyn | I didn't use the docker compose... I want to know what is going under the wood | 21:06 |
| sassyn | is this normal? | 21:07 |
| fungi | sassyn: i don't know what qualifies for normal, but i think it's a good way to learn how a complicated suite of software actually works | 21:11 |
| fungi | some people just want to use things without really needing to understand them at that level, which i suppose is also valid | 21:13 |
| fungi | i agree zuul can be hard to understand... it relies on novel concepts you don't find in other ci/cd applications, and is designed to solve very complicated problems | 21:14 |
| sassyn | Well, If i want to put this into production and replace around 200 slaves of jenkins with around 200+ jobs I need to know what I'm doing | 21:14 |
| fungi | i think we could still do a better job of making it approachable, but there is also some inherent complexity which just goes with the territory | 21:14 |
| sassyn | It is just there is many configuration | 21:15 |
| sassyn | to do, running the docker example is not really for production grade env | 21:15 |
| fungi | i believe the docker example was built primarily to serve as a demonstration | 21:16 |
| fungi | though it also gives us a nice framework to perform integration tests of the software itself | 21:17 |
| sassyn | yes | 21:20 |
| sassyn | true! | 21:20 |
| sassyn | but this is magic.. I had to learn about nodepool, how to install with groupadd + useradd | 21:21 |
| sassyn | I think I will build a deb ppa files | 21:21 |
| sassyn | for this | 21:21 |
| sassyn | so u can install it via apt-get | 21:22 |
| fungi | out of curiosity, how long did it take you to figure out how to get jenkins set up and running jobs on 200 servers? | 21:22 |
| sassyn | will see, step by step | 21:22 |
| *** jamesmcarthur has joined #zuul | 21:22 | |
| sassyn | can't tell - i"m working with jenkins for 8 years now | 21:23 |
| sassyn | I guess was quite quick | 21:23 |
| fungi | i mean when you first learned about jenkins ;) | 21:23 |
| sassyn | pipelines and jenkisfiles was more - cause u had to know grovvy (YAK | 21:23 |
| *** jamesmcarthur has quit IRC | 21:24 | |
| *** jamesmcarthur has joined #zuul | 21:24 | |
| sassyn | I guess zuul has too many moving parts and there is everything in the docs, but it is not organized | 21:24 |
| fungi | i remember it took me a few days to figure out hudson/jenkins the first time i encountered it | 21:25 |
| sassyn | jenkins is a great project as well, | 21:26 |
| fungi | i agree | 21:26 |
| sassyn | but the problem is there is too many jobs, and we don't want user to merge the code. | 21:26 |
| fungi | we relied on it for many years | 21:26 |
| sassyn | we want a machine to do it | 21:26 |
| sassyn | and it avoid the restest when we do rebase | 21:26 |
| sassyn | in a fast forward git repo based | 21:27 |
| sassyn | retest = rebase* | 21:27 |
| sassyn | I which I had time to learn and install openstack | 21:28 |
| sassyn | I remember it just started at 2008 by rackspace.... but never manage to really doing it, only use the devstack for playing | 21:28 |
| sassyn | anyway It is time to get some sleep. It is 12:30am already | 21:29 |
| sassyn | I'm from Israel - Tel Aviv | 21:29 |
| fungi | have a good night, and thanks for the feedback! | 21:29 |
| sassyn | thank u dude! u are rock! | 21:30 |
| sassyn | I will be back for sure :-) | 21:30 |
| fungi | we'll be here | 21:30 |
| sassyn | :-) | 21:30 |
| sassyn | Lalya Tov as we say in hebrew | 21:30 |
| sassyn | Goog Night friends! | 21:30 |
| *** jamesmcarthur has quit IRC | 22:12 | |
| *** jamesmcarthur has joined #zuul | 22:13 | |
| *** jamesmcarthur has quit IRC | 22:19 | |
| *** jamesmcarthur has joined #zuul | 22:20 | |
| *** jamesmcarthur has quit IRC | 22:33 | |
| *** jamesmcarthur has joined #zuul | 22:34 | |
| *** msuszko has quit IRC | 22:42 | |
| *** jamesmcarthur has quit IRC | 22:44 | |
| *** msuszko has joined #zuul | 22:48 | |
| *** saneax_ has joined #zuul | 23:02 | |
| *** tosky has quit IRC | 23:24 | |
| *** jamesmcarthur has joined #zuul | 23:27 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!