| *** saneax has joined #zuul | 00:48 | |
| *** hamalq_ has quit IRC | 02:21 | |
| *** bhavikdbavishi has joined #zuul | 02:58 | |
| *** zbr9 has joined #zuul | 03:03 | |
| *** irclogbot_1 has quit IRC | 03:04 | |
| *** tobberydberg_ has quit IRC | 03:04 | |
| *** zbr has quit IRC | 03:04 | |
| *** dpawlik2 has quit IRC | 03:04 | |
| *** zbr9 is now known as zbr | 03:04 | |
| *** wuchunyang has joined #zuul | 03:05 | |
| *** irclogbot_3 has joined #zuul | 03:08 | |
| *** tobberydberg has joined #zuul | 03:10 | |
| *** wuchunyang has quit IRC | 03:11 | |
| *** wuchunyang has joined #zuul | 03:11 | |
| *** wuchunyang has quit IRC | 03:13 | |
| *** wuchunyang has joined #zuul | 03:15 | |
| *** wuchunyang has quit IRC | 03:17 | |
| *** wuchunyang has joined #zuul | 03:20 | |
| *** wuchunyang has joined #zuul | 03:21 | |
| *** wuchunyang has quit IRC | 03:25 | |
| *** wuchunyang has joined #zuul | 03:26 | |
| *** wuchunyang has joined #zuul | 03:29 | |
| *** wuchunyang has quit IRC | 03:33 | |
| *** wuchunyang has joined #zuul | 03:36 | |
| *** bhavikdbavishi has quit IRC | 03:42 | |
| *** wuchunyang has quit IRC | 03:44 | |
| *** wuchunyang has joined #zuul | 03:45 | |
| *** wuchunyang has quit IRC | 03:48 | |
| *** wuchunyang has joined #zuul | 03:48 | |
| *** wuchunyang has quit IRC | 03:51 | |
| *** wuchunyang has joined #zuul | 03:54 | |
| *** wuchunyang has quit IRC | 03:56 | |
| *** wuchunyang has joined #zuul | 03:57 | |
| *** wuchunyang has quit IRC | 04:00 | |
| *** bhavikdbavishi has joined #zuul | 04:00 | |
| *** wuchunyang has joined #zuul | 04:03 | |
| *** wuchunyang has quit IRC | 04:05 | |
| *** wuchunyang has joined #zuul | 04:09 | |
| *** wuchunyang has quit IRC | 04:10 | |
| *** evrardjp has quit IRC | 04:33 | |
| *** evrardjp has joined #zuul | 04:33 | |
| *** raukadah is now known as chkumar|rover | 04:43 | |
| *** bhavikdbavishi1 has joined #zuul | 05:05 | |
| *** bhavikdbavishi has quit IRC | 05:07 | |
| *** bhavikdbavishi1 is now known as bhavikdbavishi | 05:07 | |
| *** sanjayu_ has joined #zuul | 05:26 | |
| *** saneax has quit IRC | 05:28 | |
| *** wuchunyang has joined #zuul | 05:28 | |
| *** wuchunyang has quit IRC | 05:31 | |
| *** wuchunyang has joined #zuul | 05:31 | |
| *** sanjayu_ has quit IRC | 05:33 | |
| *** sanjayu_ has joined #zuul | 05:34 | |
| *** wuchunyang has quit IRC | 05:35 | |
| *** wuchunyang has joined #zuul | 05:38 | |
| *** wuchunyang has quit IRC | 05:40 | |
| *** wuchunyang has joined #zuul | 05:41 | |
| *** wuchunyang has quit IRC | 05:43 | |
| *** wuchunyang has joined #zuul | 05:47 | |
| *** wuchunyang has quit IRC | 05:49 | |
| *** wuchunyang has joined #zuul | 05:50 | |
| *** wuchunyang has quit IRC | 05:52 | |
| *** wuchunyang has joined #zuul | 05:52 | |
| *** wuchunyang has quit IRC | 05:54 | |
| *** wuchunyang has joined #zuul | 05:54 | |
| *** wuchunyang has quit IRC | 06:00 | |
| *** wuchunyang has joined #zuul | 06:06 | |
| *** wuchunyang has quit IRC | 06:11 | |
| *** bhavikdbavishi has quit IRC | 06:13 | |
| *** wuchunyang has joined #zuul | 06:15 | |
| *** wuchunyang has quit IRC | 06:19 | |
| *** wuchunyang has joined #zuul | 06:20 | |
| *** wuchunyang has quit IRC | 06:24 | |
| *** wuchunyang has joined #zuul | 06:25 | |
| *** wuchunyang has quit IRC | 06:27 | |
| *** wuchunyang has joined #zuul | 06:30 | |
| *** wuchunyang has quit IRC | 06:33 | |
| *** wuchunyang has joined #zuul | 06:33 | |
| openstackgerrit | Felix Edel proposed zuul/zuul master: PF4: Update filter toolbar on builds and buildsets page https://review.opendev.org/741385 | 06:35 |
|---|---|---|
| *** danpawlik has joined #zuul | 06:36 | |
| *** wuchunyang has quit IRC | 06:38 | |
| *** wuchunyang has joined #zuul | 06:39 | |
| *** bhavikdbavishi has joined #zuul | 06:41 | |
| *** wuchunyang has quit IRC | 06:43 | |
| *** wuchunyang has joined #zuul | 06:48 | |
| *** hashar has joined #zuul | 06:49 | |
| *** wuchunyang has quit IRC | 06:52 | |
| *** wuchunyang has joined #zuul | 06:53 | |
| *** danpawlik has quit IRC | 06:54 | |
| *** danpawlik has joined #zuul | 06:55 | |
| *** wuchunyang has quit IRC | 06:58 | |
| *** hashar has quit IRC | 07:05 | |
| *** wuchunyang has joined #zuul | 07:07 | |
| *** wuchunyang has quit IRC | 07:09 | |
| *** wuchunyang has joined #zuul | 07:10 | |
| *** wuchunyang has quit IRC | 07:12 | |
| *** wuchunyang has joined #zuul | 07:12 | |
| *** jcapitao has joined #zuul | 07:14 | |
| *** wuchunyang has quit IRC | 07:17 | |
| *** wuchunyang has joined #zuul | 07:17 | |
| *** wuchunyang has quit IRC | 07:19 | |
| *** wuchunyang has joined #zuul | 07:20 | |
| *** wuchunyang has quit IRC | 07:22 | |
| *** wuchunyang has joined #zuul | 07:22 | |
| *** wuchunyang has quit IRC | 07:24 | |
| *** wuchunyang has joined #zuul | 07:38 | |
| *** tosky has joined #zuul | 07:41 | |
| *** wuchunyang has quit IRC | 07:46 | |
| *** wuchunyang has joined #zuul | 07:46 | |
| *** wuchunyang has quit IRC | 07:49 | |
| *** wuchunyang has joined #zuul | 07:50 | |
| *** hashar has joined #zuul | 07:51 | |
| *** wuchunyang has quit IRC | 07:53 | |
| *** jpena|off is now known as jpena | 07:54 | |
| *** wuchunyang has joined #zuul | 07:54 | |
| *** wuchunyang has quit IRC | 07:56 | |
| *** wuchunyang has joined #zuul | 07:56 | |
| *** wuchunyang has quit IRC | 08:00 | |
| *** wuchunyang has joined #zuul | 08:04 | |
| *** wuchunyang has quit IRC | 08:06 | |
| *** wuchunyang has joined #zuul | 08:06 | |
| *** wuchunyang has quit IRC | 08:08 | |
| avass | Hi everyone, I'm back from vacation. Have I missed anything important or interesting the last couple of weeks? :) | 08:09 |
| *** nils has joined #zuul | 08:10 | |
| *** wuchunyang has joined #zuul | 08:16 | |
| *** wuchunyang has quit IRC | 08:19 | |
| *** wuchunyang has joined #zuul | 08:26 | |
| *** wuchunyang has quit IRC | 08:29 | |
| *** wuchunyang has joined #zuul | 08:30 | |
| *** wuchunyang has quit IRC | 08:32 | |
| *** wuchunyang has joined #zuul | 08:32 | |
| *** wuchunyang has quit IRC | 08:37 | |
| *** wuchunyang has joined #zuul | 08:40 | |
| *** jcapitao is now known as jcapitao_afk | 08:41 | |
| *** wuchunyang has quit IRC | 08:42 | |
| *** wuchunyang has joined #zuul | 08:42 | |
| *** wuchunyang has quit IRC | 08:44 | |
| *** wuchunyang has joined #zuul | 08:45 | |
| *** wuchunyang has quit IRC | 08:47 | |
| *** wuchunyang has joined #zuul | 08:47 | |
| *** jcapitao_afk is now known as jcapitao | 08:53 | |
| *** brendangalloway has joined #zuul | 08:55 | |
| *** wuchunyang has quit IRC | 08:56 | |
| *** wuchunyang has joined #zuul | 08:56 | |
| brendangalloway | Hello - I'm trying to connect a kubernetes cluster as a nodepool provider. I am able to connect to the cluster from the nodepool host, but when I try define a pod in nodepool.yaml I get the following error: | 08:57 |
| brendangalloway | File "/usr/lib/python3.6/site-packages/nodepool/driver/kubernetes/config.py", line 62, in load full_config.labels[label['name']].pools.append(self)KeyError: 'pod-centos-7-7' | 08:57 |
| *** wuchunyang has quit IRC | 09:02 | |
| *** wuchunyang has joined #zuul | 09:05 | |
| *** wuchunyang has quit IRC | 09:13 | |
| *** wuchunyang has joined #zuul | 09:14 | |
| openstackgerrit | Simon Westphahl proposed zuul/zuul master: Add optional support for circular dependencies https://review.opendev.org/685354 | 09:14 |
| openstackgerrit | Simon Westphahl proposed zuul/zuul master: Check cycle items are mergeable before reporting https://review.opendev.org/743450 | 09:14 |
| *** wuchunyang has quit IRC | 09:16 | |
| *** wuchunyang has joined #zuul | 09:16 | |
| *** wuchunyang has quit IRC | 09:22 | |
| *** wuchunyang has joined #zuul | 09:23 | |
| *** wuchunyang has quit IRC | 09:26 | |
| *** wuchunyang has joined #zuul | 09:26 | |
| *** wuchunyang has quit IRC | 09:29 | |
| *** wuchunyang has joined #zuul | 09:30 | |
| *** wuchunyang has quit IRC | 09:32 | |
| *** wuchunyang has joined #zuul | 09:33 | |
| *** wuchunyang has quit IRC | 09:39 | |
| *** wuchunyang has joined #zuul | 09:40 | |
| openstackgerrit | Albin Vass proposed zuul/zuul-jobs master: add-build-sshkey: call cmd with command https://review.opendev.org/745646 | 09:41 |
| avass | tobiash: you might want to take a look ad that ^ | 09:42 |
| *** bhavikdbavishi has quit IRC | 09:42 | |
| *** wuchunyang has quit IRC | 09:43 | |
| *** wuchunyang has joined #zuul | 09:43 | |
| *** wuchunyang has quit IRC | 09:45 | |
| *** wuchunyang has joined #zuul | 09:46 | |
| *** wuchunyang has quit IRC | 09:48 | |
| *** wuchunyang has joined #zuul | 09:48 | |
| *** wuchunyang has quit IRC | 09:50 | |
| *** wuchunyang has joined #zuul | 09:56 | |
| *** wuchunyang has quit IRC | 09:59 | |
| *** wuchunyang has joined #zuul | 09:59 | |
| *** wuchunyang has quit IRC | 10:02 | |
| *** wuchunyang has joined #zuul | 10:03 | |
| *** wuchunyang has quit IRC | 10:05 | |
| *** bhavikdbavishi has joined #zuul | 10:29 | |
| *** hashar has quit IRC | 10:53 | |
| *** sanjayu_ has quit IRC | 10:53 | |
| *** sanjayu_ has joined #zuul | 10:54 | |
| *** sanjayu__ has joined #zuul | 10:58 | |
| zbr | avass: welcome back! | 10:58 |
| *** brendangalloway has quit IRC | 10:59 | |
| *** sanjayu_ has quit IRC | 11:01 | |
| zbr | felixedel: please add me as reviewer on pf4 changes that you consider ready, i want to help. | 11:06 |
| *** wuchunyang has joined #zuul | 11:11 | |
| *** hashar has joined #zuul | 11:12 | |
| *** wuchunyang has quit IRC | 11:17 | |
| *** wuchunyang has joined #zuul | 11:18 | |
| *** wuchunyang has quit IRC | 11:21 | |
| tobiash | avass: welcome back!, that change lgtm, but I didn't test it | 11:21 |
| tobiash | tristanC: didn't we have the aws iam profile config in the nodepool docs somewhere? I don't find it. | 11:22 |
| *** wuchunyang has joined #zuul | 11:25 | |
| openstackgerrit | Simon Westphahl proposed zuul/zuul master: Add optional support for circular dependencies https://review.opendev.org/685354 | 11:32 |
| openstackgerrit | Simon Westphahl proposed zuul/zuul master: Check cycle items are mergeable before reporting https://review.opendev.org/743450 | 11:32 |
| *** jpena is now known as jpena|lunch | 11:33 | |
| openstackgerrit | Tobias Henkel proposed zuul/nodepool master: Document aws iam profile https://review.opendev.org/745658 | 11:35 |
| *** wuchunyang has quit IRC | 11:39 | |
| *** jcapitao is now known as jcapitao_lunch | 11:40 | |
| avass | tobiash: I'm pretty confident it should work, currently it dumps the "Microsoft Windows ...." header to authorized keys :) | 11:43 |
| tobiash | yay | 11:44 |
| avass | tobiash: do you mean: https://zuul-ci.org/docs/nodepool/configuration.html#attr-providers.[aws].pools.labels.iam-instance-profile ? | 11:44 |
| tobiash | avass: no I mean the permissions nodepool needs to have to be able to work with aws | 11:45 |
| avass | oh, I haven't seen one at least. But I've wanted one :) | 11:45 |
| *** wuchunyang has joined #zuul | 11:50 | |
| *** wuchunyang has quit IRC | 11:52 | |
| *** wuchunyang has joined #zuul | 11:55 | |
| *** rlandy has joined #zuul | 11:59 | |
| *** wuchunyang has quit IRC | 12:02 | |
| tristanC | tobiash: i don't remember, i only used the basic free tier for the initial testing | 12:03 |
| *** wuchunyang has joined #zuul | 12:05 | |
| *** wuchunyang has quit IRC | 12:07 | |
| *** wuchunyang has joined #zuul | 12:10 | |
| *** wuchunyang has quit IRC | 12:12 | |
| *** wuchunyang has joined #zuul | 12:13 | |
| *** wuchunyang has quit IRC | 12:15 | |
| *** iurygregory has quit IRC | 12:25 | |
| *** iurygregory has joined #zuul | 12:26 | |
| *** hashar has joined #zuul | 12:36 | |
| *** jpena|lunch is now known as jpena | 12:39 | |
| fungi | zuul-maint: just a heads up, recent point releases of ansible seem to have changed default file modes: https://github.com/ansible/ansible/issues/71200 | 12:43 |
| fungi | we frequently have files tasks with no mode specified i think, so this could easily impact jobs (though probably mostly jobs which involve multiple users) | 12:43 |
| *** sanjayu__ has quit IRC | 12:50 | |
| *** sanjayu__ has joined #zuul | 12:52 | |
| *** vishalmanchanda has joined #zuul | 13:04 | |
| *** bhavikdbavishi has quit IRC | 13:04 | |
| *** jcapitao_lunch is now known as jcapitao | 13:14 | |
| zbr | fungi: well, i think they do have a decent explanation for the breaking change. | 13:21 |
| fungi | zbr: explanation sure, but that doesn't mean users will immediately realize an ansible stable update is what caused all their file permissions to change | 13:24 |
| zbr | yep, that is why I am subscribed to all their releases and read the changelog each time. | 13:25 |
| fungi | also that does seem like a rather sudden behavior change to introduce in stable point releases rather than just in development. it's not like ansible prevented you from setting secure file permissions | 13:25 |
| zbr | i am sure that I will see few tripleo jobs failing due to it, part of the daily chores | 13:25 |
| fungi | choosing to suddenly protect users from themselves in a stable patch bump is surprising | 13:25 |
| zbr | it is a grey area, and they are experts in it ;) | 13:27 |
| tristanC | zbr: is there an ansible-lint rule to detect missing file mode? | 13:29 |
| fungi | i'm actually stunned that the solution to cve-2020-1736 was to explicitly set the file mode when copying rather than copying the source file mode | 13:29 |
| zbr | tristanC: nope, but if you do one, I can merge it, even make a release. | 13:29 |
| fungi | https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1736 | 13:30 |
| zbr | seems like a good opportunity to make one | 13:30 |
| zbr | tristanC: i already starting to write the linter rule, any other modules than template affected? | 13:36 |
| zbr | https://github.com/ansible/ansible-lint/pull/943 | 13:48 |
| zbr | lots of occurences in zuul-roles: http://paste.openstack.org/show/796730/ | 13:49 |
| fungi | it's worth bearing in mind that most of those are probably not actually a problem because they'll be accessed by the same user which creates them | 13:50 |
| zbr | fungi: yep, still i have no idea how distinguish between one are or another. I am open to suggestions. | 13:51 |
| fungi | this will really only be an issue if the account under which ansible runs is creating files which another user needs to read. i don't think there's going to be an automated way to identify those stiuations, no | 13:51 |
| fungi | so maybe just avoiding the situation by always having explicit file modes is the solution, to avoid ~undefined behavior | 13:52 |
| zbr | am I wrong or the docs were not updated at https://docs.ansible.com/ansible/latest/modules/template_module.html ? | 13:53 |
| zbr | if I understand correctly, new default is 0x600 or not really? | 13:53 |
| zbr | probably I should suggest using "preserve" as a workaround that does avoid triggering the rule violation? | 13:54 |
| fungi | i guess "preserve" keeps the source file's mode? | 13:55 |
| fungi | s/keeps/copies/ | 13:55 |
| zbr | yep, which is also acting as "default" | 13:55 |
| zbr | but there are 9 core modules with mode, i need to see if all support it.... | 13:56 |
| fungi | i'm just surprised that copying the source file's mode wasn't the default behavior, as opposed to hard-coding a default file mode, but i guess there must be reasons | 13:56 |
| * yoctozepto surprised too | 13:57 | |
| yoctozepto | or not getting the real issue... | 13:57 |
| zbr | only synchronize module has different docs on mode param | 13:58 |
| fungi | yoctozepto: the underlying trigger for this seems to have been cve-2020-1736 about atomic_copy using a very loose umask and not copying the original file's mode by default | 14:00 |
| fungi | so the end result was that it created files world-writeable when copying | 14:01 |
| fungi | that i get is a real problem | 14:01 |
| yoctozepto | fungi: yeah, noticed, I replied with my suprisement in the bug report | 14:01 |
| *** smcginnis has quit IRC | 14:01 | |
| yoctozepto | that one truly is | 14:01 |
| fungi | but yeah, it seems like there are multiple ways that vulnerability could have been addressed | 14:02 |
| yoctozepto | also, the defaults for non-overridable mode might better be more strict | 14:02 |
| yoctozepto | but for regular actions, one rather expects normal posix behaviour | 14:02 |
| yoctozepto | and changing default to more secure is fine but not in stable for devops sake | 14:02 |
| yoctozepto | well, they went with the hammer approach :-) | 14:03 |
| fungi | i concur. the original behavior is not posix-like, but neither is the fixed behavior | 14:03 |
| fungi | i would also have expected something which behaved like the `cp` command | 14:03 |
| SpamapS | :| | 14:04 |
| SpamapS | They should know better. | 14:04 |
| SpamapS | There will be flames. | 14:04 |
| yoctozepto | ah, true, I was speaking about newly-created files | 14:04 |
| SpamapS | 50% chance of revert in urgent stable patch. | 14:04 |
| yoctozepto | cause that is what has bitten us | 14:04 |
| yoctozepto | but yeah, cp behaviour for copying would be just right | 14:04 |
| SpamapS | (Regarding Ansible changing mode behavior in a stable update) | 14:04 |
| yoctozepto | and mv for moves | 14:04 |
| SpamapS | Does Ansible even have a move? | 14:05 |
| SpamapS | It didn't, a few years back. | 14:05 |
| yoctozepto | SpamapS: well, internally | 14:05 |
| yoctozepto | the changed part is 'atomic_move' | 14:05 |
| fungi | i guess the argument could be that if you want posix-like behaviors, use the command module | 14:05 |
| yoctozepto | true that, but no kidding :-) | 14:06 |
| SpamapS | fungi: but then you're back in making sure every command is idempotent. ;) | 14:06 |
| fungi | sure | 14:06 |
| yoctozepto | no, seriously, one can set those modes where necessary but sometimes the default umask behaviour was just fine | 14:07 |
| yoctozepto | why would you want to touch perfect defaults | 14:07 |
| yoctozepto | anyhow, everything up to ansible team | 14:07 |
| clarkb | SpamapS: fungi and the linter will complain you should use copy/template/etc | 14:13 |
| yoctozepto | clarkb: true that | 14:14 |
| yoctozepto | so it's easy to fight this argument | 14:14 |
| fungi | that's easy, disable those linting rules | 14:15 |
| *** wuchunyang has joined #zuul | 14:16 | |
| *** wuchunyang has quit IRC | 14:17 | |
| zbr | we may need to optimize this rule a little bit as it finds just too many occurences | 14:20 |
| yoctozepto | fungi: well then I want the new default configurable! :D | 14:23 |
| yoctozepto | (but then I would be setting myself into security issues, oh well) | 14:24 |
| yoctozepto | nasty one | 14:24 |
| *** adam_g has quit IRC | 14:25 | |
| *** adam_g has joined #zuul | 14:27 | |
| *** chkumar|rover is now known as raukadah | 14:42 | |
| zbr | yoctozepto: look at the bright side: they removed the non octals from ansible code while fixing this bug ;) | 14:45 |
| zbr | doing file permission checking using base-10, it would have not passed my review :D | 14:46 |
| clarkb | zbr: what happens to people using mode: 600 ? | 14:47 |
| clarkb | are they all broken now too? | 14:47 |
| yoctozepto | zbr: 😂 | 14:47 |
| zbr | clarkb: nope, when I said removed, removed internal implementation that was doing comparisions with some base-10 values | 14:48 |
| yoctozepto | clarkb: mode: 600 has quite surprising effects | 14:49 |
| yoctozepto | or at least had; I always write octals in there | 14:49 |
| clarkb | yoctozepto: I'm not suggesting its correct but suddenly beraking users that do that would be bad | 14:49 |
| clarkb | '600' too | 14:50 |
| yoctozepto | '600' works I guess | 14:50 |
| zbr | there is a rule in the linter for that issue too | 14:52 |
| *** Shrews has joined #zuul | 15:05 | |
| *** sanjayu_ has joined #zuul | 15:12 | |
| *** bhavikdbavishi has joined #zuul | 15:13 | |
| *** sanjayu__ has quit IRC | 15:14 | |
| *** jcapitao has quit IRC | 15:34 | |
| *** rlandy is now known as rlandy|ruck | 15:54 | |
| *** nils has quit IRC | 16:09 | |
| *** hamalq has joined #zuul | 16:10 | |
| *** hamalq_ has joined #zuul | 16:11 | |
| *** jpena is now known as jpena|off | 16:13 | |
| *** hamalq has quit IRC | 16:16 | |
| fungi | yay, looks like the ansible devs are considering revisiting the file mode change with a more measured approach | 16:19 |
| zbr | s/hammer/mallet/ | 16:26 |
| dmsimard | yeah I was about to mention that -- it's a bit late now that it's been released but oh well | 16:27 |
| fungi | usu mochi mallet | 16:27 |
| *** hamalq_ has quit IRC | 16:29 | |
| *** hamalq has joined #zuul | 16:30 | |
| *** tosky has quit IRC | 16:59 | |
| *** bhavikdbavishi has quit IRC | 17:07 | |
| *** bhavikdbavishi has joined #zuul | 17:07 | |
| *** hashar has quit IRC | 17:10 | |
| *** hamalq has quit IRC | 17:31 | |
| *** holser has quit IRC | 17:39 | |
| *** holser has joined #zuul | 17:39 | |
| *** sanjayu_ has quit IRC | 17:47 | |
| corvus | tristanC: i think it's okay to merge https://review.opendev.org/742971 now (cc infra-root: when that merges, we should be able to get ara repots from system run jobs again) | 17:47 |
| *** bhavikdbavishi has quit IRC | 17:48 | |
| *** saneax has joined #zuul | 17:51 | |
| tristanC | corvus: ok, i rechecked it to verify vexxhost ci is not affected | 17:56 |
| corvus | tristanC: good point; i opened up a window to watch streaming logs just in case | 17:57 |
| tristanC | the issue seems to be cleared, i put the +workflow now | 18:02 |
| clarkb | corvus: do we need to update our system-config jobs in opendev? or shold that get auto picked up? | 18:03 |
| corvus | clarkb: i think automatic | 18:11 |
| openstackgerrit | Merged zuul/zuul-jobs master: Allow ara-report to run on any node https://review.opendev.org/742971 | 18:18 |
| corvus | dmsimard: ^ | 18:18 |
| tristanC | after updating our local copy of zuul-jobs, some jobs started to fail because ensure-tox doesn't seems to install tox in the PATH anymore, we had to replace `tox` command by `{{ tox_executable }}` | 18:37 |
| clarkb | tristanC: you have to enable fact caching | 18:38 |
| clarkb | ensure-tox installs it to venv if tox_executable does not exist, then sets tox_executable as a fact | 18:39 |
| corvus | doesn't zuul enable fact caching? | 18:39 |
| tristanC | clarkb: this playbook used to work: https://pagure.io/fork/tdecacqu/fedora-qa/os-autoinst-distri-fedora/blob/637c605496e5253e99ff638eb2f3d7c3c392d9fd/f/ci/tox.yaml | 18:39 |
| clarkb | tristanC: I would expect that to still work if fact caching works | 18:40 |
| tristanC | or rahter this one https://pagure.io/fedora-qa/os-autoinst-distri-fedora/blob/master/f/ci/tox.yaml | 18:40 |
| clarkb | corvus: maybe? I'm not 100% sure on that | 18:40 |
| tristanC | first link is the patched version | 18:40 |
| corvus | clarkb: when you say "you need to enable fact caching" what does the user need to do? | 18:40 |
| tristanC | i can't find where this was announced, was this announced? | 18:40 |
| clarkb | corvus: I don't know. I just know that the role relies on setting that value as a fact to address tristanC's problem | 18:41 |
| clarkb | https://opendev.org/zuul/zuul-jobs/src/branch/master/roles/ensure-tox/tasks/main.yaml#L30-L33 in particular does it | 18:41 |
| corvus | tristanC: do you have a link to a failed build? | 18:42 |
| tristanC | corvus: https://fedora.softwarefactory-project.io/zuul/build/211ab6902e4b4e8b9da532eda802abd8 | 18:42 |
| tristanC | this is after updating our zuul-jobs copy from 86db3adeb1abdf2f2e03a8a4ef6fe1eab5d352c5 to fcf84346eff89398fd4f67cc7e2fa30ba443145c | 18:44 |
| corvus | i wonder if the issue is that ensure-tox is being used in an include_ | 18:45 |
| corvus | grr | 18:45 |
| corvus | i wonder if the issue is that ensure-tox is being used in an include_role task in the same playbook that then later relies on the cached fact | 18:45 |
| corvus | ie, maybe it only loads the fact from the cache at the start, so it's not there, and the fact doesn't persist beyond the include_role? | 18:46 |
| corvus | that second part is the troubling part | 18:46 |
| corvus | it seems like if we're in the same playbook, a set_fact should persist all they way through, even through an include_role | 18:46 |
| clarkb | yes if it is the same playbook I would expect it to work even more well | 18:47 |
| corvus | oh, wait: https://pagure.io/fedora-qa/os-autoinst-distri-fedora/c/85be99830bc7d9472ee307d80b3ee4c22bf37f29?branch=master | 18:47 |
| corvus | it used to just be "tox" | 18:47 |
| corvus | so i think the advice "you need to enable fact caching" is not relevant here; because the role wasn't relying on the fact before | 18:48 |
| corvus | or rather, the playbook | 18:48 |
| corvus | i think the issue is that the playbook was previously relying on tox being in the path, and with the changes to ensure-tox, it now should rely on the tox_executable output variable | 18:48 |
| corvus | (iow, tristanC's patch is the intended way to use the role now) | 18:49 |
| tristanC | corvus: yeah, the ensure-tox role used to do `type tox || $PIP install --user tox`. I can't find where the change was announced | 18:52 |
| corvus | tristanC: i think https://review.opendev.org/718284 is the implementing change | 18:52 |
| clarkb | oh I thought the two were tied to gether (and that is why we set the fact) | 18:54 |
| corvus | tristanC: i suspect that the reviewers only considered the case of other roles in zuul-jobs relying on the behavior, not end-user playbooks, and so probably didn't realize it would be a breaking change in that case | 18:55 |
| corvus | tristanC: (iow, we probably looked at it and said: "ensure-tox role + tox role" works, so we're good) | 18:55 |
| corvus | but this case is more like "ensure-tox role + playbook runs 'tox' command" | 18:55 |
| clarkb | oh I see | 18:56 |
| clarkb | ya | 18:56 |
| tristanC | corvus: alright, thank you for the details | 18:57 |
| corvus | tristanC: i agree, we should have announced it, but i think we just missed that case in good faith, and we can try to think about that in the future. i do think that the documented output variables is a big improvement and should help avoid this problem in the future. | 18:57 |
| corvus | clarkb: i think the only "you need to enable caching" applicable here is: if you're writing a role like ensure-tox, and you want to produce an output variable, you need to set the cacheable flag on the set_fact task when you write that role. iow, it's a responsibility of a zuul-jobs role author; an end-user shouldn't need to worry about that detail. | 18:58 |
| clarkb | corvus: ya looking in the executor code we set up fact caching | 18:58 |
| clarkb | zuul should handle that side of things, then as you say the roles need to make specific values cacheable to translate between playbooks | 18:59 |
| tristanC | corvus: that's ok, i was just wondering if i missed a mailling list or something, the user wanted to know how to prepare for such change... | 19:01 |
| fungi | i thought it had been announced, but am probably wrong | 19:02 |
| tristanC | i think it would be to difficult to announce each role "api" change | 19:02 |
| fungi | also i thought we added a variable to cause it to symlink tox in /usr/local/bin as a solution for scripts which want to call the tox executable without a full path | 19:03 |
| fungi | ahh, it was the tox_envlist removal which got announced. the tox role installing to nonstandard paths looks like it happened as part of standardizing similar patterns for pip and virtualenv | 19:05 |
| fungi | tristanC: would adding https://zuul-ci.org/docs/zuul-jobs/python-roles.html#rolevar-ensure-tox.ensure_global_symlinks work better for you? | 19:06 |
| tristanC | fungi: oh that would have been another option, but that's ok, using "{{ tox_executable }}" fixed the issue | 19:07 |
| fungi | yeah, if you're calling tox from ansible then it's probably the better solution anyway. the ensure_global_symlinks toggle is more helpful when you have ansible calling shell scripts which call tox and want to work similarly when run locally by a developer | 19:08 |
| fungi | (though you can also do that with envvar magic and defaults) | 19:08 |
| *** hashar has joined #zuul | 19:31 | |
| openstackgerrit | Merged zuul/zuul-jobs master: add-build-sshkey: call cmd with command https://review.opendev.org/745646 | 19:34 |
| *** hashar has quit IRC | 20:07 | |
| *** hashar has joined #zuul | 20:09 | |
| *** openstackgerrit has quit IRC | 20:52 | |
| -openstackstatus- NOTICE: The openstackgerrit IRC bot (gerritbot) will be offline for a short period while we redeploy it on a new server | 20:53 | |
| *** hashar has quit IRC | 21:00 | |
| *** vishalmanchanda has quit IRC | 21:14 | |
| *** rlandy|ruck has quit IRC | 22:47 | |
| *** saneax has quit IRC | 23:02 | |
| *** logan- has quit IRC | 23:05 | |
| corvus | tristanC, mordred, tobiash: i updated gerrit's zuul to use tls zk with that series of patches i linked earlier (plus a couple of brown-bag followups). tristanC, you were right about the extended cert attributes ('client auth' is needed). i have no idea why it worked without that in my testing. | 23:32 |
| corvus | anyway, it's all up and appears to be working now, using zk tls. so that's both opendev and gerrit's zuul using that. | 23:33 |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!