| -@gerrit:opendev.org- Dong Zhang proposed: [zuul/zuul] 941235: Implement command for deleting OIDC signing keys https://review.opendev.org/c/zuul/zuul/+/941235 | 06:44 | |
| -@gerrit:opendev.org- Dong Zhang proposed wip: [zuul/zuul] 942169: WIP: test fix fd leak https://review.opendev.org/c/zuul/zuul/+/942169 | 06:50 | |
| -@gerrit:opendev.org- Dong Zhang proposed wip: [zuul/zuul] 942169: WIP: test fix fd leak https://review.opendev.org/c/zuul/zuul/+/942169 | 07:12 | |
| -@gerrit:opendev.org- Dong Zhang proposed: [zuul/zuul] 940872: Implement keystore functions for OIDC RS256 https://review.opendev.org/c/zuul/zuul/+/940872 | 07:12 | |
| -@gerrit:opendev.org- Dong Zhang proposed: [zuul/zuul] 941235: Implement command for deleting OIDC signing keys https://review.opendev.org/c/zuul/zuul/+/941235 | 09:01 | |
| -@gerrit:opendev.org- Dong Zhang proposed: [zuul/zuul] 942886: Prepare oidc token for playbook execution in executor. https://review.opendev.org/c/zuul/zuul/+/942886 | 10:01 | |
| -@gerrit:opendev.org- Dong Zhang proposed: [zuul/zuul] 942886: Prepare oidc token for playbook execution in executor. https://review.opendev.org/c/zuul/zuul/+/942886 | 12:21 | |
| @joao15130:matrix.org | Hello, I'm trying to enable the Auto-hold feature wihci requires if my understanding is correct, keycloak | 12:28 |
|---|---|---|
| @joao15130:matrix.org | however, and even if I have now access to the keycloak UI, it looks like the sign in button in the Zuul UI isn't effective | 12:29 |
| @mhuin:matrix.org | not necessarily, you need an external OpenID Connect-compatible Identity Provider service (such as keycloak) if you want to enable users to autohold from the web ui | 12:30 |
| @joao15130:matrix.org | ok in my case I'm just following the doc from zuul, and I use keycloak in a container | 12:30 |
| @mhuin:matrix.org | otherwise you can also generate a token with the zuul-admin cli that can be used in turn with the zuul-client CLI to autohold | 12:30 |
| @joao15130:matrix.org | I'd like to use the zuul UI to manage the auto-hold, is that possible? | 12:31 |
| @joao15130:matrix.org | there is a tabl called autoholds | 12:31 |
| @joao15130:matrix.org | * there is a tab called autoholds | 12:31 |
| @mhuin:matrix.org | you can, as I said you need an OpenID Connect-compatible Identity Provider such as keycloak, then configure Zuul to authenticate with that IdP, and configure admin rules in Zuul's main.yaml to let Zuul know who is allowed to autohold on which tenant | 12:32 |
| @mhuin:matrix.org | the quickstart compose should have everything set up for you I believe | 12:33 |
| @joao15130:matrix.org | Can I follow https://zuul-ci.org/docs/zuul/latest/howtos/openid-with-keycloak.html ? | 12:33 |
| @mhuin:matrix.org | I'd say that's the right doc, yeah | 12:34 |
| @mhuin:matrix.org | how have you deployed keycloak? Did you create a realm and users? | 12:35 |
| @joao15130:matrix.org | for now there's only a keycloak container | 12:35 |
| @joao15130:matrix.org | and I sue the quickstart compose file | 12:35 |
| @joao15130:matrix.org | * and I used the quickstart compose file | 12:36 |
| -@gerrit:opendev.org- Simon Westphahl proposed: [zuul/zuul] 942896: Respect replication delay in event pre-processing https://review.opendev.org/c/zuul/zuul/+/942896 | 12:36 | |
| @mhuin:matrix.org | this compose? https://opendev.org/zuul/zuul/src/branch/master/doc/source/examples/keycloak/docker-compose.yaml | 12:37 |
| @joao15130:matrix.org | And I can successfully login with admin on the keycloak UI | 12:37 |
| @joao15130:matrix.org | yes | 12:38 |
| @mhuin:matrix.org | so it's a demo setup, I think you should follow https://zuul-ci.org/docs/zuul/latest/tutorials/keycloak.html as some changes need to be applied to the zuul containers' config in order for authentication to be enabled | 12:39 |
| @joao15130:matrix.org | ok | 12:40 |
| @mhuin:matrix.org | If all goes well by https://zuul-ci.org/docs/zuul/latest/tutorials/keycloak.html#log-into-zuul you should be able to test admin rules in the GUI | 12:40 |
| @joao15130:matrix.org | in this doc, I was unable to do the hosts change | 12:40 |
| @joao15130:matrix.org | If I do it, nothing is working | 12:40 |
| @mhuin:matrix.org | updating /etc/hosts you mean? | 12:41 |
| @joao15130:matrix.org | $HOME/.config/containers/containers.conf | 12:41 |
| @mhuin:matrix.org | are you deploying your containers with podman? | 12:41 |
| @joao15130:matrix.org | I'm using podman-compose | 12:43 |
| @joao15130:matrix.org | and for now everything is working correctly | 12:43 |
| @mhuin:matrix.org | maybe this option is not needed anymore, I'm not sure the tutorial has been updated in a while | 12:44 |
| @joao15130:matrix.org | ok | 12:44 |
| @joao15130:matrix.org | however I'm not able to perform the last action | 12:44 |
| @joao15130:matrix.org | `Visit http://localhost:9000/t/example-tenant/autoholds and click the login icon on the top right. You will be directed to Keycloak, where you can log into the Zuul realm with the user admin and password admin.` | 12:45 |
| @mhuin:matrix.org | what matters is that you should be able to reach the keycloak server from your web browser using the `keycloak` FQDN instead of localhost | 12:45 |
| @joao15130:matrix.org | When I click on the login button, nothing happens | 12:45 |
| @joao15130:matrix.org | I'm able to login to the keycloak UI | 12:46 |
| @mhuin:matrix.org | can you reach http://keycloak:8082/ ? | 12:46 |
| @joao15130:matrix.org | yes | 12:46 |
| @joao15130:matrix.org | I'm reaching keycloak from my laptop so I'm typing the IP instead of keycloak | 12:47 |
| @joao15130:matrix.org | but I'm on the UI | 12:47 |
| @joao15130:matrix.org | it seems to work | 12:47 |
| @mhuin:matrix.org | so the keycloak container is NOT running on your local machine? ie your browser, zuul and keycloak are not all running on the same laptop? | 12:48 |
| @joao15130:matrix.org | zuul and keycloak are running on a VM | 12:48 |
| @joao15130:matrix.org | and I'm accessing them via my laptop | 12:48 |
| @joao15130:matrix.org | through my browser | 12:48 |
| @mhuin:matrix.org | well that's a pretty important detail, the instructions are for a setup where everything is running locally. I guess the doc needs patching to clarify that | 12:49 |
| @mhuin:matrix.org | so try to edit your laptop's /etc/hosts so that there's an entry for keycloak pointing at your VM's IP | 12:50 |
| @mhuin:matrix.org | Because here's what's happening: both zuul and keycloak are running on a shared internal network created via the compose, with resolution mapped to the containers' names (zuul, keycloak etc) | 12:51 |
| @mhuin:matrix.org | this network (and name resolution) is strictly limited to the compose's context on your VM | 12:51 |
| @mhuin:matrix.org | zuul is configured to forward auth queries, and check the validity of claims, against a host called "keycloak" - which it can reach on the internal network | 12:52 |
| @joao15130:matrix.org | ok I'm now accessing the keycloak via its name definition via the hosts file on the laptop | 12:53 |
| @mhuin:matrix.org | but it's also sending your browser for authentication on a host called "keycloak" - for which you don't have name resolution unless you configure your laptop's /etc/hosts properly | 12:53 |
| @mhuin:matrix.org | ok that sounds like progress | 12:53 |
| @joao15130:matrix.org | ok now when I click on sign in, it redirects me to a keycloak page which says Inavlid parameter: redirect_url | 12:55 |
| @joao15130:matrix.org | I think I need to change something from the zuul conf | 12:55 |
| @joao15130:matrix.org | ``` | 12:55 |
| [auth keycloak] | ||
| default=true | ||
| driver=OpenIDConnect | ||
| realm=zuul-demo | ||
| issuer_id=http://keycloak:8082/realms/zuul-demo | ||
| client_id=zuul | ||
| ``` | ||
| @joao15130:matrix.org | probably | 12:56 |
| @mhuin:matrix.org | you need to change the client config in keycloak actually | 12:56 |
| @joao15130:matrix.org | But I need this snippet of config right? | 12:56 |
| @mhuin:matrix.org | log in as admin on keycloak, pick the zuul-demo realm, check clients and pick "zuul" | 12:56 |
| @mhuin:matrix.org | this snippet of config is correct | 12:56 |
| @joao15130:matrix.org | OK I'm on zuul client | 12:58 |
| @mhuin:matrix.org | check the client config and edit the redirect url parameter to match your VM's ip or fqdn | 12:58 |
| @mhuin:matrix.org | add one that doesn't refer to localhost | 12:59 |
| @joao15130:matrix.org | ok I've added two redirect URL | 13:00 |
| @joao15130:matrix.org | one for 3000 and one for 9000 | 13:00 |
| @joao15130:matrix.org | didin't touch the localhost one | 13:00 |
| @mhuin:matrix.org | good, you don't have to | 13:00 |
| @joao15130:matrix.org | ok so now redirect works | 13:00 |
| @joao15130:matrix.org | it prompts me for creds | 13:01 |
| @mhuin:matrix.org | they're mentioned in the tutorial doc | 13:01 |
| @joao15130:matrix.org | yes I got it | 13:02 |
| @joao15130:matrix.org | ok I'm now able to create a request | 13:02 |
| @mhuin:matrix.org | congrats! | 13:03 |
| @joao15130:matrix.org | thanks | 13:03 |
| @joao15130:matrix.org | so now let's say I want to use a realm called zuul instead of zuul-demo | 13:03 |
| @joao15130:matrix.org | I just need to create a new realm? | 13:03 |
| @joao15130:matrix.org | That's an environment we'll use for our CI and I'd like something more informal than zuul-demo | 13:04 |
| @mhuin:matrix.org | yeah, and you'll need to follow the actual documentation about interfacing zuul with keycloak | 13:04 |
| @joao15130:matrix.org | ok | 13:04 |
| @joao15130:matrix.org | thank you | 13:04 |
| @mhuin:matrix.org | you shouldn't use the compose example as is for a production deployment anyway | 13:04 |
| @joao15130:matrix.org | what change do you suggest? | 13:05 |
| @mhuin:matrix.org | with that said would like like to patch the keycloak tutorial documentation to clarify that it's intended for local deployment? Or shall I do it? | 13:05 |
| @mhuin:matrix.org | I haven't checked the compose in a while but it was never intended to be production-ready IIRC | 13:06 |
| @joao15130:matrix.org | ok for now it's enough for us but I'd appreciate any advice from you guys | 13:07 |
| @joao15130:matrix.org | oh spoke too fast | 13:08 |
| @joao15130:matrix.org | doesn't work when I create a request | 13:09 |
| @joao15130:matrix.org | it says unable to fetch URL | 13:09 |
| @mhuin:matrix.org | let me guess, it starts with localhost | 13:09 |
| @joao15130:matrix.org | it's not mentioned | 13:10 |
| @joao15130:matrix.org | > Unable to fetch URL, check your network connectivity, browser plugins, ad-blockers, or try to refresh this page | 13:10 |
| @mhuin:matrix.org | I'm like 95% sure that's the issue - again that compose is meant for local testing, but since it's running on a VM there's going to be issues with URLs starting with `localhost` | 13:11 |
| @mhuin:matrix.org | I strongly suggest testing that compose on your laptop or where you're running your browser if it's only for testing things out | 13:12 |
| @mhuin:matrix.org | if you want to confirm the issue, open your browser's developer tools (ctrl+I usually) while you reproduce the autohold request, and check the networking panel | 13:14 |
| @joao15130:matrix.org | it says status 404 autohold to domain <IP>:9000 | 13:16 |
| @mhuin:matrix.org | what's the exact API call made ? | 13:22 |
| @joao15130:matrix.org | {"change":null,"job":"powerflex-v4-cinder-tempest","ref":null,"reason":"Requested from the web UI by admin","count":1,"node_hold_expiration":86400} | 13:24 |
| @joao15130:matrix.org | ``` | 13:25 |
| POST | ||
| http://10.x.x.x:9000/api/tenant/openstack/project/openstack/autohold | ||
| ``` | ||
| @mhuin:matrix.org | do you have a tenant named openstack? a project named openstack within that tenant? | 13:26 |
| @joao15130:matrix.org | yes that's our tenant | 13:26 |
| @mhuin:matrix.org | what about the project, is it correct? | 13:27 |
| @joao15130:matrix.org | Oh I see | 13:27 |
| @joao15130:matrix.org | project for now is opendev/ci-sandbox | 13:28 |
| @joao15130:matrix.org | we're still testing | 13:28 |
| @joao15130:matrix.org | project should be updated to openstack/cinder when we'll be ready | 13:28 |
| @joao15130:matrix.org | ok | 13:29 |
| @joao15130:matrix.org | I just replaced the project name and it works | 13:29 |
| @mhuin:matrix.org | good | 13:30 |
| @joao15130:matrix.org | I'm still leaning all that stuff | 13:30 |
| -@gerrit:opendev.org- Dong Zhang proposed: [zuul/zuul] 942432: Implement zuul-web OIDC endpoints https://review.opendev.org/c/zuul/zuul/+/942432 | 13:30 | |
| -@gerrit:opendev.org- Dong Zhang proposed: [zuul/zuul] 942886: Prepare oidc token for playbook execution in executor. https://review.opendev.org/c/zuul/zuul/+/942886 | 13:31 | |
| -@gerrit:opendev.org- James E. Blair https://matrix.to/#/@jim:acmegating.com proposed: | 17:07 | |
| - [zuul/zuul] 942158: Add a test for Gerrit merge event order https://review.opendev.org/c/zuul/zuul/+/942158 | ||
| - [zuul/zuul] 942159: Process gerrit change-merged events before ref-updated https://review.opendev.org/c/zuul/zuul/+/942159 | ||
| -@gerrit:opendev.org- James E. Blair https://matrix.to/#/@jim:acmegating.com proposed: [zuul/zuul] 942938: Add test for locked branch filtering on validation https://review.opendev.org/c/zuul/zuul/+/942938 | 18:11 | |
| -@gerrit:opendev.org- James E. Blair https://matrix.to/#/@jim:acmegating.com proposed: [zuul/zuul] 942938: Add test for locked branch filtering on validation https://review.opendev.org/c/zuul/zuul/+/942938 | 18:13 | |
| -@gerrit:opendev.org- James E. Blair https://matrix.to/#/@jim:acmegating.com proposed: [zuul/nodepool] 942939: Clear allocation when unlocking failed node requests https://review.opendev.org/c/zuul/nodepool/+/942939 | 18:57 | |
| -@gerrit:opendev.org- Jeremy Stanley https://matrix.to/#/@fungicide:matrix.org proposed on behalf of James E. Blair https://matrix.to/#/@jim:acmegating.com: [zuul/nodepool] 942939: Clear allocation when unlocking failed node requests https://review.opendev.org/c/zuul/nodepool/+/942939 | 20:23 | |
| -@gerrit:opendev.org- Jeremy Stanley https://matrix.to/#/@fungicide:matrix.org proposed: [zuul/nodepool] 942945: Pin grpcio and revert googleapis-common-protos pin https://review.opendev.org/c/zuul/nodepool/+/942945 | 20:23 | |
| -@gerrit:opendev.org- Clark Boylan proposed on behalf of Jeremy Stanley https://matrix.to/#/@fungicide:matrix.org: [zuul/nodepool] 942945: Pin grpcio and revert googleapis-common-protos pin https://review.opendev.org/c/zuul/nodepool/+/942945 | 22:36 | |
| -@gerrit:opendev.org- Clark Boylan proposed on behalf of James E. Blair https://matrix.to/#/@jim:acmegating.com: [zuul/nodepool] 942939: Clear allocation when unlocking failed node requests https://review.opendev.org/c/zuul/nodepool/+/942939 | 22:36 | |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!