| *** tzn has quit IRC | 00:00 | |
| *** diogogmt has joined #kolla | 00:00 | |
| *** dims has joined #kolla | 00:00 | |
| *** dims_ has quit IRC | 00:02 | |
| *** tzn has joined #kolla | 00:11 | |
| *** tzn has quit IRC | 00:15 | |
| *** sdake_ has quit IRC | 00:19 | |
| *** signed8bit is now known as signed8bit_ZZZzz | 00:21 | |
| *** dims has quit IRC | 00:25 | |
| *** achanda has joined #kolla | 00:28 | |
| *** dims has joined #kolla | 00:35 | |
| *** sdake has joined #kolla | 00:37 | |
| *** achanda_ has joined #kolla | 00:37 | |
| *** achanda_ has quit IRC | 00:38 | |
| *** cloudnautique has quit IRC | 00:38 | |
| *** achanda has quit IRC | 00:41 | |
| *** dims has quit IRC | 00:45 | |
| *** dims has joined #kolla | 00:51 | |
| *** sdake has quit IRC | 00:52 | |
| *** sdake has joined #kolla | 00:53 | |
| *** dwalsh has joined #kolla | 00:54 | |
| *** dims has quit IRC | 00:57 | |
| asalkeld | do you guys run you own local registry? | 01:04 |
|---|---|---|
| asalkeld | (docker registry) | 01:04 |
| *** mbound has quit IRC | 01:06 | |
| asalkeld | ok, i see that vagrant does that | 01:06 |
| *** dims has joined #kolla | 01:07 | |
| *** sdake has quit IRC | 01:08 | |
| *** dwalsh has quit IRC | 01:08 | |
| *** asalkeld has quit IRC | 01:19 | |
| *** tzn has joined #kolla | 01:20 | |
| *** ssurana has quit IRC | 01:24 | |
| *** weiyu_ has joined #kolla | 01:25 | |
| *** tzn has quit IRC | 01:25 | |
| *** kjelly has quit IRC | 01:26 | |
| *** tzn has joined #kolla | 01:35 | |
| *** asalkeld has joined #kolla | 01:42 | |
| *** tfukushima has joined #kolla | 01:49 | |
| *** tpot has joined #kolla | 01:57 | |
| *** mbound has joined #kolla | 02:06 | |
| *** mbound has quit IRC | 02:11 | |
| *** kejlly_ has joined #kolla | 02:16 | |
| *** stvnoyes has quit IRC | 02:22 | |
| *** openstackgerrit has quit IRC | 02:22 | |
| *** stvnoyes has joined #kolla | 02:23 | |
| *** openstackgerrit has joined #kolla | 02:24 | |
| *** tpot has quit IRC | 02:25 | |
| *** weiyu_ has quit IRC | 02:28 | |
| *** tpot has joined #kolla | 02:30 | |
| *** bigjools_ has joined #kolla | 02:33 | |
| *** bigjools has quit IRC | 02:33 | |
| *** bigjools_ has quit IRC | 02:33 | |
| *** bigjools has joined #kolla | 02:34 | |
| *** kbyrne has quit IRC | 02:34 | |
| *** weiyu_ has joined #kolla | 02:35 | |
| *** kbyrne has joined #kolla | 02:36 | |
| *** cemmason has quit IRC | 02:36 | |
| *** alisonh has quit IRC | 02:36 | |
| *** Ti-mo has quit IRC | 02:36 | |
| *** ArchiFleKs has quit IRC | 02:37 | |
| *** harmw has quit IRC | 02:37 | |
| *** harmw_ has joined #kolla | 02:42 | |
| *** Ti-mo has joined #kolla | 02:44 | |
| *** cemmason has joined #kolla | 02:44 | |
| *** alisonh has joined #kolla | 02:44 | |
| *** ArchiFleKs has joined #kolla | 02:44 | |
| *** harmw has joined #kolla | 02:44 | |
| *** ArchiFleKs has quit IRC | 02:44 | |
| *** harmw has quit IRC | 02:44 | |
| *** ArchiFleKs has joined #kolla | 02:45 | |
| *** tpot has quit IRC | 02:58 | |
| *** suro-patz has joined #kolla | 03:01 | |
| *** tpot has joined #kolla | 03:02 | |
| *** signed8bit_ZZZzz has quit IRC | 03:08 | |
| *** signed8bit has joined #kolla | 03:09 | |
| *** achanda has joined #kolla | 03:09 | |
| *** tfukushima has quit IRC | 03:21 | |
| *** tfukushima has joined #kolla | 03:25 | |
| *** sdake has joined #kolla | 03:28 | |
| *** signed8bit has quit IRC | 03:31 | |
| *** tpot has quit IRC | 03:38 | |
| *** tpot has joined #kolla | 03:41 | |
| *** jasonsb has joined #kolla | 03:42 | |
| *** vbel has quit IRC | 03:56 | |
| *** dims has quit IRC | 03:56 | |
| *** suro-patz has quit IRC | 03:58 | |
| *** vbel has joined #kolla | 04:01 | |
| *** kejlly_ has quit IRC | 04:13 | |
| *** tfukushima has quit IRC | 04:29 | |
| *** weiyu_ has quit IRC | 04:30 | |
| *** kejlly_ has joined #kolla | 04:48 | |
| *** kejlly_ is now known as kjelly | 04:48 | |
| *** sacharya has joined #kolla | 04:50 | |
| *** sdake has quit IRC | 04:50 | |
| nihilifer | good morning | 05:19 |
| *** weiyu_ has joined #kolla | 05:30 | |
| *** tpot has quit IRC | 05:30 | |
| asalkeld | hi | 05:37 |
| kjelly | morning | 05:44 |
| *** tfukushima has joined #kolla | 05:44 | |
| *** suro-patz has joined #kolla | 05:46 | |
| *** weiyu_ has quit IRC | 05:47 | |
| *** suro-patz has quit IRC | 06:01 | |
| *** weiyu_ has joined #kolla | 06:16 | |
| *** sacharya has quit IRC | 06:36 | |
| *** sacharya has joined #kolla | 06:37 | |
| *** suro-patz has joined #kolla | 06:40 | |
| nihilifer | Diogo Monteiro, are you here on IRC? | 07:06 |
| nihilifer | ah, ok, diogogmt :) | 07:06 |
| nihilifer | you here? | 07:06 |
| *** suro-patz has quit IRC | 07:15 | |
| *** CBR09 has joined #kolla | 07:17 | |
| openstackgerrit | Michal Rostecki proposed openstack/kolla: Drop root for HAProxy https://review.openstack.org/245013 | 07:29 |
| *** jasonsb has quit IRC | 07:32 | |
| SamYaple | asalkeld: i run my own | 07:43 |
| openstackgerrit | Merged openstack/kolla: Drop root privileges for rabbitmq https://review.openstack.org/244721 | 07:53 |
| *** sdake has joined #kolla | 07:56 | |
| *** slotti has joined #kolla | 07:57 | |
| *** sdake_ has joined #kolla | 07:58 | |
| *** sdake has quit IRC | 08:01 | |
| *** jasonsb has joined #kolla | 08:03 | |
| *** jasonsb has quit IRC | 08:08 | |
| *** sacharya has quit IRC | 08:08 | |
| openstackgerrit | Michal Rostecki proposed openstack/kolla: Remove "../../etc/kolla" from synced folders in Vagrant https://review.openstack.org/245022 | 08:08 |
| *** egonzalez has joined #kolla | 08:12 | |
| *** tfukushima has quit IRC | 08:19 | |
| *** achanda has quit IRC | 08:20 | |
| *** tfukushima has joined #kolla | 08:27 | |
| openstackgerrit | Kuo-tung Kao proposed openstack/kolla: suggest to upgrade kernel in image-building.rst https://review.openstack.org/245025 | 08:31 |
| kjelly | Hi, does anyone have the issue? run ` docker run ubuntu setcap 'cap_net_bind_service=ep' /bin/bash` with error | 08:32 |
| kjelly | the issue make me failed to build horizon images. | 08:32 |
| *** itsuugo has joined #kolla | 08:32 | |
| kjelly | linux kernel Linux user-GA-6PXSV3 4.2.0-16-generic and Linux vagrant-ubuntu-trusty-64 3.13.0-68-generic | 08:33 |
| kjelly | linux kernel Linux user-GA-6PXSV3 4.2.0-16-generic with Docker version 1.9.0 and Linux vagrant-ubuntu-trusty-64 3.13.0-68-generic with Docker version 1.8.2 | 08:34 |
| SamYaple | kjelly: i do not have that issue but my understanding is horizon for ubuntu is broken due to a recent change sdake did anyway | 08:37 |
| *** shardy has joined #kolla | 08:39 | |
| *** CBR09 has quit IRC | 08:39 | |
| kjelly | SamYaple: failed because the commit https://github.com/openstack/kolla/commit/f9ccb1c8829cef551b875c7c387530e7980414a7 | 08:40 |
| SamYaple | kjelly: right but the horizon implementation is busted anyway | 08:40 |
| kjelly | SamYaple: And the reason is setcap 'cap_net_bind_service=ep' /usr/sbin/httpd failed | 08:40 |
| SamYaple | it needs to be the apache user | 08:40 |
| *** exploreshaifali has joined #kolla | 08:41 | |
| SamYaple | kjelly: httpd is only for centos | 08:41 |
| kjelly | SamYaple: the error msg is "Failed to set capabilities on file `/bin/bash' (Invalid argument)" | 08:41 |
| *** rmart04 has joined #kolla | 08:42 | |
| kjelly | SamYaple: whis is the reason you build horizon images failed? | 08:44 |
| SamYaple | kjelly: they don't fail for me | 08:44 |
| SamYaple | they fail to run | 08:44 |
| kjelly | SamYaple: Ok, I see. | 08:45 |
| SamYaple | but you are right, the implementaiton is bust | 08:45 |
| kjelly | SamYaple: there are some issue in docker and kernel to make me failed to build horizon images. | 08:45 |
| kjelly | :( | 08:46 |
| *** itsuugo has quit IRC | 08:48 | |
| SamYaple | kjelly: im going to revert that change. the recommened practice for apache is to run as root | 08:48 |
| SamYaple | https://httpd.apache.org/docs/2.2/misc/security_tips.html | 08:48 |
| SamYaple | well i supose i dont have to revert it, just change it to launch apache as root | 08:49 |
| *** jmccarthy has quit IRC | 08:53 | |
| *** kjelly has quit IRC | 08:53 | |
| *** kjelly has joined #kolla | 08:54 | |
| kjelly | my computer crush ... | 08:54 |
| openstackgerrit | Sam Yaple proposed openstack/kolla: Revert "Drop root for Horizon service" https://review.openstack.org/245035 | 08:56 |
| SamYaple | kjelly: ^ that patch reverts the horizon stuff | 08:57 |
| SamYaple | I am not sure we need to change anything for horizon or keystone | 08:57 |
| SamYaple | apache already does priv dropping | 08:57 |
| kjelly | SamYaple: Ok. I test it now | 08:58 |
| *** jmccarthy has joined #kolla | 09:00 | |
| *** athomas has joined #kolla | 09:00 | |
| SamYaple | sdake_: naked ping | 09:01 |
| *** openstackgerrit has quit IRC | 09:01 | |
| *** openstackgerrit has joined #kolla | 09:01 | |
| kjelly | SamYaple: why we drop root priv? apache will do the thing. | 09:06 |
| *** gfidente has joined #kolla | 09:07 | |
| SamYaple | kjelly: yea we dont | 09:07 |
| SamYaple | i pointed this out yesterday to sdake | 09:07 |
| kjelly | SamYaple: Ok. I see. | 09:08 |
| *** mbound has joined #kolla | 09:10 | |
| *** kproskurin has joined #kolla | 09:27 | |
| *** tpot has joined #kolla | 09:33 | |
| kproskurin | Hi guys | 09:35 |
| kproskurin | I heard you’re gonna revert horizon root drop commit | 09:35 |
| nihilifer | kproskurin: https://review.openstack.org/#/c/245035/ | 09:37 |
| SamYaple | kproskurin: i just submitted a patch. i expect pushback on it | 09:37 |
| SamYaple | luckily i have 'best-practice' on my side | 09:37 |
| kproskurin | Yeah, It’s probably best idea, BUT I still curios what’s was wrong with the permission? Anyone dig into it? | 09:38 |
| SamYaple | kproskurin: different kernels produce different results | 09:38 |
| SamYaple | we really shouldnt be setting different caps on binaries like that | 09:39 |
| SamYaple | its not a commonly done thing | 09:39 |
| kproskurin | Yeah, but I didn’t get setcap problem, I got file permission one. :-) Well, anyway. | 09:39 |
| SamYaple | yea who knows what else we would run into with it | 09:41 |
| SamYaple | best to follow apaches best practice on the matter | 09:41 |
| *** tfukushima has quit IRC | 09:52 | |
| vbel | good morning/evening | 09:57 |
| vbel | which minimal docker version we should stick into reqs? | 09:57 |
| SamYaple | vbel: i know the lowest veersion is 1.6.0 | 09:58 |
| vbel | I thought of this too - worked well for long time | 09:58 |
| *** tzn has quit IRC | 09:58 | |
| vbel | SamYaple: is there any reason to stick with 1.8.x ? | 09:59 |
| vbel | like registry issues | 09:59 |
| SamYaple | vbel: what do you mean? we are capped at 1.8.2 for now | 10:06 |
| vbel | SamYaple: so anything from 1.6.0 up to 1.8.2 is ok | 10:06 |
| SamYaple | vbel: yes should be | 10:08 |
| vbel | ok, thanks | 10:09 |
| *** openstackgerrit has quit IRC | 10:16 | |
| *** openstackgerrit has joined #kolla | 10:16 | |
| *** pbourke has quit IRC | 10:16 | |
| *** pbourke has joined #kolla | 10:17 | |
| openstackgerrit | Michal Rostecki proposed openstack/kolla: Add Ansible support for Magnum https://review.openstack.org/236223 | 10:31 |
| *** cemmason has quit IRC | 10:32 | |
| *** cemmason has joined #kolla | 10:32 | |
| *** kjelly has quit IRC | 10:34 | |
| *** diogogmt has quit IRC | 10:51 | |
| *** dwalsh has joined #kolla | 10:53 | |
| *** tzn has joined #kolla | 10:55 | |
| *** alisonh has quit IRC | 10:57 | |
| *** exploreshaifali has quit IRC | 10:58 | |
| *** tzn has quit IRC | 11:00 | |
| *** dwalsh has quit IRC | 11:02 | |
| *** alisonh has joined #kolla | 11:13 | |
| openstackgerrit | Sam Yaple proposed openstack/kolla: Remove unused tox jobs https://review.openstack.org/245096 | 11:23 |
| *** tpot has quit IRC | 11:24 | |
| *** weiyu_ has quit IRC | 11:25 | |
| *** kjelly has joined #kolla | 11:35 | |
| openstackgerrit | Sam Yaple proposed openstack/kolla: Convert gate to Ansible setup https://review.openstack.org/244538 | 11:35 |
| openstackgerrit | Vladislav Belogrudov proposed openstack/kolla: Add playbook for hosts pre-deployment checks (ports, files) https://review.openstack.org/239882 | 11:46 |
| openstackgerrit | Vladislav Belogrudov proposed openstack/kolla: Add playbook for hosts pre-deployment checks (ports, files) https://review.openstack.org/239882 | 11:49 |
| openstackgerrit | Vladislav Belogrudov proposed openstack/kolla: Add playbook for hosts pre-deployment checks (ports, files) https://review.openstack.org/239882 | 11:50 |
| *** jasonsb has joined #kolla | 12:07 | |
| *** tzn has joined #kolla | 12:07 | |
| *** jasonsb has quit IRC | 12:11 | |
| *** tzn has quit IRC | 12:12 | |
| vbel | SamYaple, do we need to put Checking to all tasks? I mean Checking free port for Cinder API and so on? | 12:12 |
| SamYaple | vbel: i hadn't thought of that. but we probably should. Our tasks naming convention is 'Doing this' 'Running that' 'Starting this' so 'Checking port' would make sense | 12:14 |
| vbel | SamYaple, ok, thanks | 12:14 |
| SamYaple | sed -i 's/name: /name: Checking/g' | 12:14 |
| *** rhallisey has joined #kolla | 12:15 | |
| vbel | I am in vi :) but it is similar | 12:16 |
| openstackgerrit | Vladislav Belogrudov proposed openstack/kolla: Add playbook for hosts pre-deployment checks (ports, files) https://review.openstack.org/239882 | 12:16 |
| SamYaple | :%s/name: /name: Checking/g | 12:17 |
| vbel | Checking free port for .... | 12:17 |
| vbel | ? | 12:17 |
| SamYaple | works for me | 12:17 |
| vbel | other stuff is corrected | 12:17 |
| openstackgerrit | Sam Yaple proposed openstack/kolla: Convert gate to Ansible setup https://review.openstack.org/244538 | 12:20 |
| *** kjelly has quit IRC | 12:22 | |
| openstackgerrit | Vladislav Belogrudov proposed openstack/kolla: Add playbook for hosts pre-deployment checks (ports, files) https://review.openstack.org/239882 | 12:25 |
| *** kjelly has joined #kolla | 12:27 | |
| *** jmccarthy has quit IRC | 12:35 | |
| *** jmccarthy has joined #kolla | 12:38 | |
| *** dims has joined #kolla | 12:40 | |
| kjelly | SamYaple: around ? | 12:49 |
| SamYaple | kjelly: yea | 12:54 |
| kjelly | SamYaple: I have interesting why I have the issue, but you don't have. https://review.openstack.org/#/c/245025/ | 12:55 |
| openstackgerrit | Sam Yaple proposed openstack/kolla: Convert gate to Ansible setup https://review.openstack.org/244538 | 12:55 |
| kjelly | SamYaple: I reproduce the issue using vagrant withi image ubuntu/trusty64. | 12:55 |
| kjelly | SamYaple: Could you try it? | 12:55 |
| SamYaple | kjelly: the gate is 3.13 and it doesnt have an issue either | 12:55 |
| SamYaple | i dont use vagrant | 12:56 |
| *** dims has quit IRC | 12:56 | |
| *** dims has joined #kolla | 12:56 | |
| kjelly | SamYaple: Ok. it seems that I often hit strange issues. | 12:58 |
| SamYaple | dont we all :) | 12:58 |
| kjelly | SamYaple: the system of all gate is ubuntu 3.13? | 13:03 |
| SamYaple | yes | 13:05 |
| *** tzn has joined #kolla | 13:07 | |
| rhallisey | vbel, I'm +2 on you pre-deploy. I just left a comment in there I'm curious about | 13:10 |
| vbel | rhallisey, if you put there 1.8.2.1 as max - will it work? | 13:10 |
| rhallisey | let me try it. I don't think so though | 13:12 |
| vbel | I think it depends on how version filter is implemented. At the same time we could cut version to 3 digits | 13:12 |
| *** tzn has quit IRC | 13:12 | |
| rhallisey | that would be best | 13:12 |
| rhallisey | 1.8.2.1 didn't work | 13:13 |
| SamYaple | rhallisey: when you run `docker version` it returns fc21? | 13:13 |
| rhallisey | ya | 13:13 |
| SamYaple | can you pastebin that? i want to compare the differences with ubuntu | 13:13 |
| rhallisey | http://fpaste.org/290105/20433144/ | 13:13 |
| SamYaple | if thats different what else is | 13:13 |
| SamYaple | rhallisey: thats the client | 13:14 |
| SamYaple | we need to be checking the server | 13:14 |
| SamYaple | the server shouldn't be 1.8.2.fc21 | 13:14 |
| SamYaple | http://fpaste.org/290106/42044514/ | 13:15 |
| rhallisey | sorry that was incomplete | 13:15 |
| rhallisey | either way | 13:15 |
| rhallisey | server has same thing | 13:15 |
| SamYaple | can you paste so i can compare the differences with ubuntu? | 13:16 |
| rhallisey | ya | 13:16 |
| rhallisey | http://fpaste.org/290109/20629144/ | 13:17 |
| rhallisey | looks like the server doesn't show unless you run with root | 13:17 |
| rhallisey | so if we need the server going to have to run with root | 13:17 |
| SamYaple | we do have a standing requirement for kolla to run with elevated permissions | 13:18 |
| SamYaple | so no shocker there | 13:18 |
| rhallisey | kk | 13:18 |
| *** signed8bit has joined #kolla | 13:18 | |
| rhallisey | just pointing it out | 13:18 |
| SamYaple | how did you install docker rhallisey? | 13:19 |
| rhallisey | rdo-release | 13:19 |
| rhallisey | repo | 13:19 |
| SamYaple | ugh rdo | 13:19 |
| SamYaple | always causing issues | 13:19 |
| SamYaple | worst pacakging ever | 13:19 |
| SamYaple | yea the official docker packages dont have that version issue | 13:20 |
| *** dims_ has joined #kolla | 13:23 | |
| *** dims has quit IRC | 13:23 | |
| vbel | I am checking regex_replace('(\d+\.\d+\.\d+).*', '\1') | 13:26 |
| SamYaple | yea or we could convert it to tuples | 13:27 |
| SamYaple | not sure whats cleanest | 13:27 |
| *** dims_ has quit IRC | 13:27 | |
| *** dims has joined #kolla | 13:27 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/kolla: Updated from global requirements https://review.openstack.org/245140 | 13:27 |
| SamYaple | w00t | 13:28 |
| SamYaple | Kennan: ^^^ it finally went through that patch | 13:28 |
| *** weiyu has joined #kolla | 13:31 | |
| *** weiyu has quit IRC | 13:32 | |
| openstackgerrit | Vladislav Belogrudov proposed openstack/kolla: Add playbook for hosts pre-deployment checks (ports, files) https://review.openstack.org/239882 | 13:35 |
| vbel | SamYaple, rhallisey : one more version to cover 1.8.2.whatever versions :) | 13:36 |
| rhallisey | hehe thanks vbel | 13:36 |
| *** cemmason has quit IRC | 13:38 | |
| vbel | rhallisey, can you please check this with fc21 to be sure? | 13:38 |
| *** cemmason has joined #kolla | 13:38 | |
| rhallisey | vbel, it works | 13:38 |
| rhallisey | nice job | 13:38 |
| vbel | rhallisey, thanks! :) | 13:38 |
| SamYaple | vbel: can you stop the docker daemon and then run your tests again? | 13:41 |
| SamYaple | it fails with a bad message about not being able to convert to yaml | 13:42 |
| SamYaple | now id be ok with this since the task name is pretty clear, but perhaps there is a cleaner way to do it | 13:42 |
| vbel | SamYaple, yes | 13:42 |
| *** athomas has quit IRC | 13:43 | |
| SamYaple | just give it some thought. im going to wait for the gate and merge unless you -W we can always improve later | 13:43 |
| vbel | http://paste.openstack.org/show/478795/ | 13:43 |
| SamYaple | yea thats fine with me it seems pretty clear | 13:44 |
| SamYaple | fyi vbel, this is the perfect time for custom filters | 13:45 |
| vbel | SamYaple, I already understood it :) Existing filters don't do such tasks easily | 13:46 |
| SamYaple | yea vbel ive been waiting for 2.0 to start doign filters because they change a little bit i beleive | 13:47 |
| SamYaple | but we can use filters for this | 13:47 |
| SamYaple | for database stuff | 13:48 |
| *** athomas has joined #kolla | 13:48 | |
| *** egonzalez has quit IRC | 13:49 | |
| vbel | would be great to have such | 13:51 |
| britthouser | So catching up since I was swamped yesturday. For horizon nothing was required for droproot, since apache does that already. I think the same will be true for Keystone, right? | 13:55 |
| *** rmart04 has quit IRC | 13:56 | |
| *** mbound has quit IRC | 13:57 | |
| *** rmart04 has joined #kolla | 13:57 | |
| *** ashishjain has joined #kolla | 13:58 | |
| *** signed8bit is now known as signed8bit_ZZZzz | 13:58 | |
| *** mbound has joined #kolla | 13:59 | |
| ashishjain | SamYaple: Hi | 13:59 |
| *** openstackgerrit has quit IRC | 14:01 | |
| *** openstackgerrit has joined #kolla | 14:01 | |
| SamYaple | hello ashishjain | 14:03 |
| SamYaple | britthouser: this is correct | 14:03 |
| SamYaple | any compromisable process will be running as an unelevated user britthouser | 14:04 |
| ashishjain | SamYaple: I am of the view that kolla deployment on a baremetal laptop should not be recommended, instead an individual should do the same over a VM | 14:04 |
| britthouser | Thanks SamYaple! I'll just mark keystone as no-op in the blue print and continue on to my other containers. | 14:04 |
| ashishjain | which runs on his laptop | 14:04 |
| ashishjain | I am updating the bug https://bugs.launchpad.net/kolla/+bug/1514227 with my comments, you can probably provide your review comments | 14:05 |
| openstack | Launchpad bug 1514227 in kolla "Update Documentation for bare metal deployment of kolla with single network interface " [Critical,Triaged] - Assigned to Ashish (ashish-jain14) | 14:05 |
| openstackgerrit | Chris Ricker proposed openstack/kolla: Fix typo in Fedora section of quickstart https://review.openstack.org/245164 | 14:08 |
| *** tzn has joined #kolla | 14:08 | |
| *** slotti has quit IRC | 14:09 | |
| *** tzn has quit IRC | 14:13 | |
| *** ashishjain has quit IRC | 14:16 | |
| *** dwalsh has joined #kolla | 14:16 | |
| britthouser | So digging into keepalive container. | 14:20 |
| britthouser | It is running as root | 14:20 |
| britthouser | but their appears to be no keepalive user included as part of packaging. I'm guessing this is b/c keepalive has to modify the networking stack to add/remove the VIP. | 14:20 |
| britthouser | So therefore keepalive doesn't need drop root either. | 14:21 |
| britthouser | that's what it looks like to me, but could use some confirmation. | 14:21 |
| *** signed8bit_ZZZzz is now known as signed8bit | 14:24 | |
| vbel | britthouser: yes, it adds ip to interface, also it does multicasting. So it should be root | 14:24 |
| * britthouser is terrible at picking containers to fix | 14:25 | |
| *** dims_ has joined #kolla | 14:29 | |
| SamYaple | any compromisable process will be running as an unelevated user britthouser | 14:30 |
| SamYaple | britthouser: oops repeat | 14:30 |
| *** dims has quit IRC | 14:32 | |
| SamYaple | britthouser: yea keepalived is expected to run as root | 14:38 |
| britthouser | And I was helping a guy on my team with memcached, but it looks like it already runs unelevated, even without this change. | 14:39 |
| britthouser | somehow we chose all teh containers that need no work! =P | 14:39 |
| SamYaple | britthouser: right memcahced is controled by the -u flag | 14:40 |
| SamYaple | and we already drop that | 14:40 |
| SamYaple | however, you can still add the USER command to the dockerfile | 14:40 |
| SamYaple | so im not sure how we are going to go about it | 14:40 |
| SamYaple | for the ones that need root to run, sdake may want to use sudo on those commands | 14:41 |
| SamYaple | the container itself will still be privlege dropped | 14:41 |
| SamYaple | dont know | 14:41 |
| britthouser | So you're saying for keystone/horizon/keepalived - one option would be to run teh container as USER, and sudo the command that launches the process. | 14:42 |
| britthouser | vs leaving it as is. | 14:42 |
| openstackgerrit | Merged openstack/kolla: Add playbook for hosts pre-deployment checks (ports, files) https://review.openstack.org/239882 | 14:43 |
| SamYaple | britthouser: correct | 14:44 |
| SamYaple | my guess is sdake will probably want that | 14:44 |
| *** jtriley has joined #kolla | 14:45 | |
| *** cemmason has quit IRC | 14:45 | |
| *** dwalsh has quit IRC | 14:47 | |
| *** dwalsh has joined #kolla | 14:47 | |
| *** cemmason has joined #kolla | 14:47 | |
| britthouser | Yeah that makes sense. I'll work toward that on keystone and see if I can figure out how todo it. | 14:48 |
| britthouser | As for memcached - if I add USER to the end, I'd also have to remove the -u right? | 14:49 |
| britthouser | otherwise its kinda redundant | 14:49 |
| SamYaple | britthouser: dunno. sounds right | 14:49 |
| SamYaple | -u <username> | 14:49 |
| SamYaple | Assume the identity of <username> (only when run as root). | 14:50 |
| SamYaple | from the man page | 14:50 |
| openstackgerrit | Merged openstack/kolla: Fix typo in Fedora section of quickstart https://review.openstack.org/245164 | 14:50 |
| britthouser | ok, I'll submit that, but honestly I'm on th fence if its needed since its already doing what we want.... | 14:50 |
| *** exploreshaifali has joined #kolla | 14:51 | |
| SamYaple | britthouser: yea but there are other reasons like `docker exec` now runs as that user rather than root | 14:51 |
| SamYaple | little things that could potentially increase security | 14:51 |
| britthouser | ahh...ok that is good to know. Thanks for the extra info | 14:52 |
| SamYaple | for the record, its _very_ little security | 14:52 |
| SamYaple | you can set teh user `with docker exec -u` | 14:53 |
| SamYaple | but idk uniformity accross the project and all i gues | 14:53 |
| britthouser | yeah uniformity is a good enough reason for me. =) | 14:54 |
| *** masterbound has joined #kolla | 15:01 | |
| openstackgerrit | Chris Ricker proposed openstack/kolla: Update commands in kolla-build section https://review.openstack.org/245192 | 15:03 |
| *** mbound has quit IRC | 15:05 | |
| *** tzn has joined #kolla | 15:09 | |
| *** sdake_ has quit IRC | 15:10 | |
| *** sdake has joined #kolla | 15:10 | |
| sdake | morning | 15:11 |
| SamYaple | mmorning sdake | 15:11 |
| britthouser | morning sdake | 15:12 |
| britthouser | question for you sdake: SamYaple and I were discussing containers that require root (keystone/horizon/keepalived). Are they OK as is, or should be still include USER but sudo the start command? | 15:13 |
| *** tzn has quit IRC | 15:13 | |
| sdake | user | 15:14 |
| britthouser | Ok. | 15:14 |
| sdake | docker exec could easily be used to blow up the container contents | 15:14 |
| sdake | with suer it still possible but harder | 15:14 |
| sdake | i alredy did horizion - it did not require root | 15:14 |
| SamYaple | sdake: you know `docker exec` has a user option | 15:14 |
| SamYaple | sdake: no thats gotta be reverted | 15:14 |
| SamYaple | https://review.openstack.org/#/c/245035/ sdake | 15:15 |
| sdake | i tested it on ubuntu | 15:15 |
| *** signed8bit has quit IRC | 15:16 | |
| SamYaple | sdake: it builds on some systems, not on others. it launches and runs on some, but not others | 15:16 |
| SamYaple | either way, its not best practice | 15:16 |
| sdake | it doenst seem to run on my overlayfs | 15:16 |
| sdake | because ubuntu is a pile of shit | 15:17 |
| sdake | ;) | 15:17 |
| SamYaple | either way were gonna revert it cause its not best practice | 15:17 |
| sdake | so what do you propose we do - nothing? | 15:17 |
| SamYaple | your opninions not need to matter | 15:17 |
| sdake | my opinion always amtters samyaple | 15:17 |
| SamYaple | in your own head | 15:17 |
| SamYaple | for one it already has privlege dropping | 15:18 |
| SamYaple | apache does that already | 15:18 |
| SamYaple | it works | 15:18 |
| sdake | so do nothing then? | 15:18 |
| SamYaple | but for consistency with other containers i thought perhaps we run apache as sudo | 15:18 |
| SamYaple | so we still have the USER directive | 15:18 |
| SamYaple | but apache runs as root | 15:18 |
| sdake | then sudo ends up as pid 1 | 15:19 |
| SamYaple | not a problem as weve been over | 15:19 |
| SamYaple | but if you have an issue wit hthat then yea, we do nothing | 15:19 |
| sdake | i disageee with your anaysis | 15:19 |
| SamYaple | be that as it may, its not best practice and its broken | 15:20 |
| SamYaple | best practice says run as root since it does priv dropping | 15:20 |
| sdake | that is a super weak argument | 15:20 |
| sdake | the doesnt work on some ubuntus is better | 15:20 |
| SamYaple | no. right now if a proccess gets compriomised it could write to the very logs tracking it and remove any trace of access | 15:21 |
| SamYaple | thats bad security | 15:21 |
| SamYaple | this is why apache does its own priv handling | 15:21 |
| SamYaple | again your opinion on the matter doesnt mean anything when best practice says otherwise | 15:21 |
| SamYaple | smarter people than us have worked on it longer than us to make this secure, i trust them | 15:22 |
| sdake | log alteration is a weak arguemnt, all of our containers suffer from log alteration | 15:23 |
| SamYaple | not apache | 15:23 |
| *** masterbound has quit IRC | 15:23 | |
| SamYaple | and this is about security, any security is better | 15:23 |
| SamYaple | and no sdake non of our containers do | 15:23 |
| SamYaple | why? they log to syslog | 15:23 |
| SamYaple | well when logging is 100% working non of them will | 15:24 |
| sdake | ok well then do nothing | 15:24 |
| sdake | i dont want sudo as pid1 | 15:24 |
| SamYaple | fair enough. i won't fight you on implementation that doesnt affect security | 15:25 |
| SamYaple | i wish su worked properly on all the kernels :( | 15:25 |
| sdake | britthouser looks like nothing need be done with keystone | 15:25 |
| sdake | the kenels it doen't work on are pile of shit ubuntu | 15:26 |
| sdake | ubuntu is just one big peice of garbage | 15:26 |
| britthouser | Ok. I still need sudo for keepalived since that process does run as root in teh container. correct? | 15:26 |
| sdake | keepalived can run as nonroot | 15:26 |
| SamYaple | sdake: try to be a bit more professional would ya | 15:26 |
| sdake | just set perissions | 15:26 |
| SamYaple | sdake: best practice says its runs as root | 15:26 |
| sdake | SamYaple yu accosted me when i woke up, what the he fuck do you expect | 15:26 |
| sdake | next time wait an hour for me to boot up will ya | 15:27 |
| SamYaple | sdake: i didnt bring it up check the fucking logs dude | 15:27 |
| SamYaple | you started spouting shit and i stopped you | 15:27 |
| britthouser | yeah sorry that was my bad | 15:27 |
| sdake | and that doen't change the fact ubuntu is a pile of shit | 15:27 |
| britthouser | how about an easy question: how do I indicate in the blueprint a NOOP | 15:27 |
| SamYaple | britthouser: nah you arent being a douche right now. youre cool | 15:27 |
| SamYaple | britthouser: remove the work item or put it as DONE and make a note in work items | 15:28 |
| britthouser | do I infer from that at some point I was being a douche, SamYaple? =P | 15:28 |
| sdake | dont remove work items | 15:28 |
| sdake | britthouser i think the implication is i am being a douche | 15:28 |
| SamYaple | britthouser: there was that one time..... ;) | 15:28 |
| britthouser | I must have blockd it out. =) | 15:29 |
| SamYaple | britthouser: im joking dont worry | 15:29 |
| sdake | you bettr jusst shut the fuck up sam | 15:29 |
| SamYaple | jesus dude go back to bed | 15:29 |
| SamYaple | or eat a snikers | 15:29 |
| britthouser | so sdake when you wake up would liek to discuss keepalived too | 15:29 |
| sdake | well god damnit i'm awake lets disuss it | 15:30 |
| sdake | the reason you need to run keepalived as root is to get access to certain capabilities | 15:30 |
| britthouser | none of hte packaging for keepalived includes a keepalived user. I hitnk this is b/c keepalive has to alter the network stack to add the VIP to the interface and stuff | 15:31 |
| SamYaple | also best practice and thats how all other daemon services run it | 15:31 |
| sdake | this is how you gain capabilities | 15:31 |
| sdake | https://github.com/openstack/kolla/blob/master/docker/horizon/Dockerfile.j2#L69 | 15:31 |
| SamYaple | it doesnt matter because 1, thats breaking for some kernels 2, thats not how anyone else runs it | 15:32 |
| sdake | keepalived is run as root not becuse its best practic,but because the authros ar elazy | 15:32 |
| SamYaple | thats not true at all | 15:32 |
| britthouser | doggone...I thought this would be a less contentious question. =) | 15:32 |
| SamYaple | britthouser: i tried to warn you earlier | 15:32 |
| SamYaple | all pacakges and daemons run keepalived as root, neutron runs keepalived as root, i dont want to encounter a strange issue that turns out to be because we dont run it as root for not benefit at all | 15:34 |
| sdake | i eould tend to agree ,should run as root | 15:35 |
| britthouser | ok. So that being the case, you still are not in favor of sudo being the PID 1. | 15:35 |
| britthouser | therefore keepalived is noop? | 15:35 |
| sdake | right no pid=1 for sudo | 15:36 |
| kjelly | sdake: The command, "setcap 'cap_net_bind_service=ep' /usr/sbin/apache2" will failed in some env. For example, vagrant image ubuntu/trusty64 with docker 1.8.2 will failed. | 15:36 |
| britthouser | Ok. I'm either very bad or very good at picking containers to work on. =P | 15:36 |
| sdake | kjelly i get it - its because of overlayfs - fails on ubuntu in my evnrionment | 15:36 |
| SamYaple | britthouser: yes | 15:37 |
| sdake | kjelly that is the *only* reason to rver that horizon patch not becaue apache running as root is best practie | 15:38 |
| SamYaple | sdake: i disagree with that. there is seperation of users where some processes are running as apache2/httpd and others as the other user (horizon/keystone) | 15:39 |
| SamYaple | i dont know what all is involved in who can acecss what, but thats why there is a best practice | 15:40 |
| SamYaple | someone else does know and this is what they decided | 15:40 |
| *** dwalsh has quit IRC | 15:41 | |
| *** signed8bit has joined #kolla | 15:41 | |
| *** cloudnautique has joined #kolla | 15:48 | |
| *** tfukushima has joined #kolla | 15:50 | |
| openstackgerrit | Merged openstack/kolla: Update commands in kolla-build section https://review.openstack.org/245192 | 15:57 |
| *** sdake has quit IRC | 15:58 | |
| *** tfukushima has quit IRC | 16:02 | |
| *** tzn has joined #kolla | 16:10 | |
| SamYaple | had a successful multinode deploy! | 16:11 |
| *** tzn has quit IRC | 16:15 | |
| *** absubram has joined #kolla | 16:20 | |
| *** rmart04 has quit IRC | 16:21 | |
| *** sdake has joined #kolla | 16:21 | |
| kjelly | congratulate :) | 16:27 |
| *** sdake has quit IRC | 16:53 | |
| *** sdake has joined #kolla | 16:54 | |
| *** sacharya has joined #kolla | 16:58 | |
| openstackgerrit | Merged openstack/kolla: Add Ansible support for Magnum https://review.openstack.org/236223 | 17:01 |
| *** kproskurin has quit IRC | 17:06 | |
| *** shardy has quit IRC | 17:10 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/kolla: Updated from global requirements https://review.openstack.org/245140 | 17:11 |
| openstackgerrit | Michal Rostecki proposed openstack/kolla: [WIP] Use trusts in heat.conf https://review.openstack.org/236198 | 17:13 |
| openstackgerrit | Michal Rostecki proposed openstack/kolla: Add ZooKeeper support in kolla-ansible https://review.openstack.org/244474 | 17:26 |
| *** jasonsb has joined #kolla | 17:34 | |
| *** cloudnautique has quit IRC | 17:40 | |
| *** cloudnautique has joined #kolla | 17:45 | |
| *** cloudnautique has joined #kolla | 17:45 | |
| *** rmart04 has joined #kolla | 17:47 | |
| *** rmart04 has quit IRC | 17:47 | |
| *** rmart04 has joined #kolla | 17:48 | |
| *** rmart04 has quit IRC | 17:48 | |
| openstackgerrit | Michal Rostecki proposed openstack/kolla-mesos: add config generation script and some examples https://review.openstack.org/242912 | 17:51 |
| *** tzn has joined #kolla | 17:55 | |
| *** sacharya has quit IRC | 17:57 | |
| *** sacharya has joined #kolla | 17:58 | |
| openstackgerrit | Michal Rostecki proposed openstack/kolla-mesos: Rename package from kolla-mesos to kolla_mesos https://review.openstack.org/245276 | 17:58 |
| *** tzn has quit IRC | 18:00 | |
| sdake | SamYaple wake up dude | 18:08 |
| *** absubram has quit IRC | 18:09 | |
| *** tzn has joined #kolla | 18:10 | |
| openstackgerrit | Michal Rostecki proposed openstack/kolla-mesos: [WIP] Using DCOS library for Marathon https://review.openstack.org/244455 | 18:11 |
| sdake | jpeeler rhallisey mandre SamYaple - clock ticking on machal's core reviewer nominiation | 18:12 |
| sdake | if you want to abstain i understand but if you didn't check the mailing list lately - its up there | 18:12 |
| sdake | apologies for being an asshole this morning ,have some personal issues deaing with and i'min a a bad mood | 18:13 |
| openstackgerrit | Michal Rostecki proposed openstack/kolla-mesos: add config generation script and some examples https://review.openstack.org/242912 | 18:14 |
| *** ssurana has joined #kolla | 18:14 | |
| *** tzn has quit IRC | 18:15 | |
| *** vilobhmm has joined #kolla | 18:17 | |
| vilobhmm | sdake : ping | 18:17 |
| sdake | sup bro | 18:18 |
| openstackgerrit | Michal Rostecki proposed openstack/kolla-mesos: Rename package from kolla-mesos to kolla_mesos https://review.openstack.org/245276 | 18:18 |
| vilobhmm | :) | 18:18 |
| vilobhmm | sdake : have few questions regarding the HA proposal https://github.com/openstack/kolla/blob/master/specs/high-availability.rst | 18:19 |
| sdake | shoot | 18:19 |
| sdake | SamYaple is probably the person to ask though | 18:19 |
| vilobhmm | I did propose this https://blueprints.launchpad.net/oslo.middleware/+spec/distributed-control-layer | 18:19 |
| vilobhmm | but realized in kolla you guys are planning to do something similar | 18:20 |
| vilobhmm | wanted to check if both ideas match | 18:20 |
| *** athomas has quit IRC | 18:21 | |
| SamYaple | vilobhmm: whats the question again? | 18:21 |
| vilobhmm | SamYaple : I did propose this https://blueprints.launchpad.net/oslo.middleware/+spec/distributed-control-layer and then i stumbled upon the ha proposal in kolla | 18:22 |
| vilobhmm | wanted to check if there is overlap | 18:22 |
| vilobhmm | with the kolla proposal are we planning to target both sateless and stateful services ? how we plan to gurantee that stateful services start from the point they left off ? | 18:22 |
| SamYaple | vilobhmm: I think we only have two services that matter, rabbitmq and galera in this case | 18:23 |
| SamYaple | rabbitmq is handled by clusterer | 18:23 |
| vilobhmm | SamYaple : thats correct | 18:23 |
| SamYaple | and galera has its own stuff preventing starting without operator intervention | 18:24 |
| vilobhmm | ok | 18:24 |
| *** blahRus has joined #kolla | 18:24 | |
| *** jasonsb has quit IRC | 18:24 | |
| vilobhmm | SamYaple : so is the plan to containerized all services and run it on multiple hosts and then if one of them crashes who takes the responsibility to spin the containers on other nodes ? | 18:26 |
| vilobhmm | where is the mapping of cluster awareness maintained | 18:26 |
| SamYaple | vilobhmm: oh that. no. that doesnt happen. Kolla-ansible doesnt have any clustering stuff like that | 18:26 |
| SamYaple | for kolla-mesos will, but that implementation is a ways off | 18:27 |
| vilobhmm | is there a spec out for it | 18:27 |
| vilobhmm | if not can i propose it | 18:27 |
| SamYaple | vilobhmm: the kolla-mesos stuff is a new project so its entire implementation is up for grabs | 18:28 |
| vilobhmm | SamYaple : ok…is there a spec out for it which describes the tasks to be done….will something of this sort https://blueprints.launchpad.net/oslo.middleware/+spec/distributed-control-layer help the HA proposal | 18:28 |
| vilobhmm | this need not be in oslo jfyi | 18:29 |
| vilobhmm | SamYaple : ^^ | 18:31 |
| nihilifer | vilobhmm: generally, Mesos seems to do what you're talking about, if I understand you correctly. it means, when some Mesos slave fails, Mesos master schedules all containers from failed node on the another slave | 18:31 |
| nihilifer | that's the part of already existing blueprint about Mesos | 18:32 |
| nihilifer | but let me know if I misunderstood | 18:32 |
| *** signed8bit is now known as signed8bit_ZZZzz | 18:32 | |
| SamYaple | vilobhmm: that is unlikely to be a part of kolla-ansible, but nihilifer or asalkeld are the people to talk to about it for kolla-mesos | 18:32 |
| *** dwalsh has joined #kolla | 18:33 | |
| vilobhmm | nihilifer : but won't it add additional dependency on OS deployments to use mesos ? | 18:33 |
| nihilifer | vilobhmm: yes, Mesos will be a dependency | 18:35 |
| vilobhmm | nihilifer : ok | 18:35 |
| openstackgerrit | Michal Rostecki proposed openstack/kolla: Add ZooKeeper support in kolla-ansible https://review.openstack.org/244474 | 18:39 |
| *** mfalatic has quit IRC | 18:47 | |
| *** achanda has joined #kolla | 18:51 | |
| *** signed8bit_ZZZzz is now known as signed8bit | 18:55 | |
| *** sdake has quit IRC | 19:00 | |
| *** sacharya has quit IRC | 19:10 | |
| *** sacharya has joined #kolla | 19:11 | |
| *** sacharya_ has joined #kolla | 19:13 | |
| *** bmace has quit IRC | 19:15 | |
| *** bmace has joined #kolla | 19:15 | |
| *** sacharya has quit IRC | 19:16 | |
| openstackgerrit | Josh Lothian proposed openstack/kolla: Drop root for Zaqar service https://review.openstack.org/245302 | 19:16 |
| openstackgerrit | Josh Lothian proposed openstack/kolla: Drop root for Zaqar service https://review.openstack.org/245302 | 19:20 |
| *** suro-patz has joined #kolla | 19:21 | |
| *** achanda has quit IRC | 19:22 | |
| *** thumpba has joined #kolla | 19:26 | |
| openstackgerrit | Merged openstack/kolla: Add ZooKeeper support in kolla-ansible https://review.openstack.org/244474 | 19:28 |
| *** suro-patz1 has joined #kolla | 19:32 | |
| *** thumpba has quit IRC | 19:34 | |
| *** suro-patz has quit IRC | 19:34 | |
| *** thumpba has joined #kolla | 19:35 | |
| *** thumpba has quit IRC | 19:44 | |
| *** thumpba has joined #kolla | 19:45 | |
| *** achanda has joined #kolla | 19:47 | |
| *** sdake has joined #kolla | 19:48 | |
| sdake | yo | 19:48 |
| *** achanda has quit IRC | 19:52 | |
| *** sacharya has joined #kolla | 19:58 | |
| *** sacharya_ has quit IRC | 19:58 | |
| *** thumpba has quit IRC | 20:05 | |
| *** thumpba has joined #kolla | 20:07 | |
| *** signed8bit is now known as signed8bit_ZZZzz | 20:10 | |
| *** dwalsh has quit IRC | 20:12 | |
| openstackgerrit | Merged openstack/kolla: Drop root for Zaqar service https://review.openstack.org/245302 | 20:14 |
| *** thumpba has quit IRC | 20:18 | |
| *** thumpba has joined #kolla | 20:19 | |
| *** sdake has quit IRC | 20:19 | |
| *** thumpba has quit IRC | 20:21 | |
| britthouser | I have a probably a very n00b question. probably something easy I'm overlooking. I updated ansible/roles/memcached/templates/memcached.json.j2 | 20:24 |
| britthouser | and removed the -u {{ memcache_user }} | 20:25 |
| britthouser | but when I deploy | 20:25 |
| britthouser | (I also added USER memcached to the container) | 20:25 |
| britthouser | I still see -u in teh output of ps: /usr/bin/memcached -u memcached -vv -l 172.31.231.18 -p 11211 | 20:26 |
| britthouser | did I change th wrong spot? | 20:26 |
| *** thumpba has joined #kolla | 20:26 | |
| *** dwalsh has joined #kolla | 20:28 | |
| *** sacharya_ has joined #kolla | 20:35 | |
| *** macsz1 has joined #kolla | 20:38 | |
| *** sacharya has quit IRC | 20:38 | |
| *** macsz1 has left #kolla | 20:38 | |
| *** dwalsh has quit IRC | 20:39 | |
| *** thumpba has quit IRC | 20:49 | |
| *** kjelly_ has joined #kolla | 20:51 | |
| *** dwalsh has joined #kolla | 20:51 | |
| *** kjelly has quit IRC | 20:51 | |
| *** thumpba has joined #kolla | 20:54 | |
| *** suro-patz1 has quit IRC | 20:55 | |
| *** suro-patz has joined #kolla | 20:55 | |
| *** cloudnautique has quit IRC | 20:56 | |
| openstackgerrit | Britt Houser proposed openstack/kolla: WIP: drop root on memcached https://review.openstack.org/245330 | 20:58 |
| britthouser | So this is what I'm tried ^^ | 20:59 |
| britthouser | but still see memcached launched with -u | 20:59 |
| *** jasonsb_ has joined #kolla | 21:00 | |
| *** sdake has joined #kolla | 21:12 | |
| *** cloudnautique has joined #kolla | 21:14 | |
| *** sacharya_ has quit IRC | 21:18 | |
| *** cloudnautique has quit IRC | 21:20 | |
| sdake | britthouser wrote his first kolla patch! | 21:24 |
| sdake | say britthouser wh yis your ptach wip | 21:25 |
| britthouser | second! =P I had a docs one merger earlier. | 21:25 |
| britthouser | well, when testing it, I saw some weird behavior | 21:25 |
| britthouser | outlined above ^^ | 21:25 |
| sdake | i was disconnected | 21:25 |
| sdake | can you paste | 21:25 |
| britthouser | basically when I run that patch, but then I login to the memcached container I still see the '-u memcached' | 21:26 |
| *** thumpba has quit IRC | 21:26 | |
| sdake | are you using a registry? | 21:26 |
| britthouser | no | 21:26 |
| britthouser | AIO | 21:26 |
| britthouser | centos/binary | 21:26 |
| sdake | did you rebuild? | 21:26 |
| britthouser | I did...and when that didn't work, I wiped the entire system, made my change, and then built | 21:27 |
| britthouser | and then I banged my head on the desk | 21:27 |
| sdake | memecached.json | 21:27 |
| sdake | check that file out | 21:27 |
| sdake | oh isee you already did | 21:27 |
| sdake | rm -rf /etc/kolla/memcach* | 21:28 |
| *** thumpba has joined #kolla | 21:28 | |
| britthouser | oh! Ok. | 21:28 |
| sdake | do you run kolla-ansible deplooy as sudo? | 21:28 |
| britthouser | so I need to kolla/tools/cleanup-containers, rm -rf /ec/kolla/memcach*, kolla-ansible again? | 21:29 |
| britthouser | No I run as root | 21:29 |
| sdake | learn to run as your regular user then use sudo when necessary | 21:29 |
| sdake | imo :) | 21:29 |
| britthouser | yeah I need todo that. our lab kickstart just creates root user. | 21:30 |
| sdake | run docker images | grep memcach | 21:30 |
| sdake | docker images is the local system image cache | 21:30 |
| britthouser | Ok...I'll try all this in aout 30min or so | 21:31 |
| *** exploreshaifali has quit IRC | 21:34 | |
| *** sdake_ has joined #kolla | 21:36 | |
| *** tpot has joined #kolla | 21:36 | |
| *** sdake has quit IRC | 21:36 | |
| *** cloudnautique has joined #kolla | 21:36 | |
| sdake_ | britthouser the reason your container isn'tworkign is your not doing the usermod -g operation | 21:44 |
| *** sacharya has joined #kolla | 21:57 | |
| *** sacharya_ has joined #kolla | 21:58 | |
| britthouser | Ok so I see the '-u memcached' in /etc/kolla/memcached/config.json | 22:00 |
| britthouser | when does that get written? | 22:00 |
| *** gfidente has quit IRC | 22:01 | |
| *** sacharya has quit IRC | 22:01 | |
| sdake_ | that gets written during container startup to /run_command | 22:01 |
| sdake_ | and then run_command is run | 22:02 |
| sdake_ | but you need the usermod or sudo wont work | 22:02 |
| sdake_ | and run_command will never be written | 22:02 |
| openstackgerrit | Merged openstack/kolla: Updated from global requirements https://review.openstack.org/245140 | 22:02 |
| britthouser | Gotcha | 22:02 |
| britthouser | ok...so the regular workflow to redeploy we would be: cleanup-containers, make my update, kolla-build, kolla-ansible | 22:03 |
| britthouser | right? | 22:03 |
| *** signed8bit_ZZZzz is now known as signed8bit | 22:05 | |
| openstackgerrit | Merged openstack/kolla: Revert "Drop root for Horizon service" https://review.openstack.org/245035 | 22:06 |
| *** jtriley has quit IRC | 22:08 | |
| sdake_ | roger | 22:08 |
| sdake_ | SamYaple I am pretty certain containes are no being upgraded when being pulled from registry | 22:08 |
| sdake_ | do you have any thoughts on that? | 22:08 |
| britthouser | I think part of my problem is I was using kolla-build and not kolla/tools/build.py | 22:12 |
| sdake_ | britthouser the yare the same thing | 22:12 |
| sdake_ | although kolla-build pulls from /usr/share/kolla/docker | 22:12 |
| britthouser | so when I rebuilt memcached with the usermod update using kolla-build, nothing changed | 22:13 |
| sdake_ | right | 22:13 |
| *** thumpba has quit IRC | 22:13 | |
| sdake_ | use tools/build.py | 22:13 |
| britthouser | it was the same image ID | 22:13 |
| sdake_ | a docs change would be appreciated indicating the differences between eval/deployvs dev | 22:13 |
| britthouser | yeah when I used tools/build.py, I got different ID. | 22:13 |
| britthouser | Ok so kolla-build is for eval, but re-builds should use build.py ? | 22:14 |
| britthouser | or eval=initial ? | 22:14 |
| britthouser | I don' tknow enough of the difference yet... | 22:14 |
| sdake_ | eval means someone downloaded and intalled he pip package | 22:14 |
| sdake_ | vs cloned the git repo nd woring directly from it | 22:14 |
| britthouser | gotcha. | 22:15 |
| sdake_ | ls | 22:15 |
| *** thumpba has joined #kolla | 22:15 | |
| britthouser | 1@#$!@#$!@ | 22:15 |
| britthouser | Its doing the -u nonsense | 22:16 |
| britthouser | but at least when I docker exec into it. | 22:16 |
| britthouser | I'm the memcached user | 22:16 |
| sdake_ | did you add the usermod? | 22:16 |
| britthouser | yeah | 22:16 |
| openstackgerrit | Britt Houser proposed openstack/kolla: WIP: drop root on memcached https://review.openstack.org/245330 | 22:16 |
| britthouser | maybe I didn't del /etc/kolla/memcached/config.json | 22:17 |
| britthouser | lemme rm that and redeploy | 22:17 |
| sdake_ | yyou shouldn't havet o delete that file | 22:17 |
| sdake_ | it should be overwritten on a redeploy | 22:17 |
| sdake_ | ls -l /etc/kolla/mecached//config.json pleae | 22:18 |
| britthouser | it had the -u | 22:19 |
| britthouser | and I just deleted it...lemme see if its i my history | 22:19 |
| britthouser | http://paste.openstack.org/show/478846/ | 22:20 |
| britthouser | that is what it was | 22:20 |
| britthouser | now I deleted it | 22:20 |
| britthouser | and doing re deploy | 22:20 |
| sdake_ | what is python2-os-brick | 22:20 |
| * britthouser shug | 22:21 | |
| * britthouser shrug | 22:21 | |
| britthouser | 1@#$!@#$!@# | 22:21 |
| britthouser | when it was re-created, it had th -u in tehre | 22:22 |
| britthouser | I gotta be doing something stupid here | 22:22 |
| britthouser | I gotta walk away and look again alter. | 22:24 |
| britthouser | later | 22:24 |
| SamYaple | sdake_: when its set to "missing" there wont be | 22:24 |
| SamYaple | thats the only condition though | 22:24 |
| SamYaple | britthouser: did you pip install kolla? | 22:27 |
| SamYaple | is it using the pip install'd kolla configs? | 22:27 |
| *** dwalsh has quit IRC | 22:29 | |
| rhallisey | holy | 22:33 |
| rhallisey | anyone watching the news? | 22:33 |
| SamYaple | no whats up | 22:34 |
| rhallisey | huge attack in Paris | 22:35 |
| rhallisey | turn on the tv | 22:35 |
| SamYaple | dude i never had 'tv' in the sense i could turn it on and watch news | 22:35 |
| SamYaple | interwebs are all i have | 22:36 |
| SamYaple | my tv is for netflix | 22:36 |
| rhallisey | just type paris into google | 22:36 |
| SamYaple | ive already got it all open man | 22:36 |
| rhallisey | cnn says 60 casualties | 22:36 |
| SamYaple | no its 60 hostages | 22:36 |
| *** thumpba has quit IRC | 22:36 | |
| SamYaple | stupid cdd | 22:37 |
| SamYaple | cnn* | 22:37 |
| SamYaple | bbd says 15 killed | 22:37 |
| SamYaple | 60 hostages | 22:37 |
| rhallisey | they're all guessing | 22:37 |
| *** thumpba has joined #kolla | 22:37 | |
| SamYaple | indeed | 22:38 |
| SamYaple | https://www.reddit.com/live/vwwnkuplwr9y | 22:38 |
| SamYaple | someones doing the live thread thing again | 22:38 |
| *** daneyon_ has quit IRC | 22:40 | |
| SamYaple | thats horrible | 22:43 |
| *** thumpba has quit IRC | 22:43 | |
| rhallisey | just horrible | 22:44 |
| SamYaple | 30 hostages released | 22:45 |
| SamYaple | thats wierd | 22:45 |
| sdake_ | SamYaple the default is always isn't it? | 22:45 |
| sdake_ | i am pretty convinced always doesn't work like you think it does :) | 22:45 |
| SamYaple | sdake_: i know exactly how it works. and it will _always_ pull a new image anre restart the container if a new image exists | 22:46 |
| *** thumpba has joined #kolla | 22:46 | |
| SamYaple | the certain conditions you are tlaking about are probably because you have "missing" | 22:46 |
| SamYaple | because you were testing AIO without pushing to a registry | 22:46 |
| sdake_ | i dont ever set missing | 22:46 |
| sdake_ | so that is not the case | 22:46 |
| SamYaple | so you _always_ use a registry? | 22:47 |
| sdake_ | but let me create a typescript | 22:47 |
| sdake_ | lways use a ergistry | 22:47 |
| sdake_ | even on aio | 22:47 |
| SamYaple | alright | 22:47 |
| sdake_ | i could be mistaken and got confused after a long day of code dev | 22:47 |
| SamYaple | feel free to look at the code, but it compares layer hashes | 22:47 |
| sdake_ | i get the code may look right but i'm pretty sure it isn't behaving correctly | 22:48 |
| sdake_ | let me settle with typescript | 22:48 |
| sdake_ | then we will both know for sure | 22:48 |
| sdake_ | I am not sure myself | 22:48 |
| SamYaple | i do this all the time outside of kolla. push a new image and rerun my ansible stuff to pull it in and restart a container | 22:48 |
| *** cloudnautique has quit IRC | 22:49 | |
| sdake_ | wierd docker_pull_policy is set to missing | 22:49 |
| SamYaple | because of AIO | 22:49 |
| sdake_ | did you set that during the demo? | 22:49 |
| SamYaple | nope | 22:49 |
| sdake_ | is that he defualt in the code base config? | 22:49 |
| sdake_ | well that takes a load off | 22:49 |
| *** thumpba has quit IRC | 22:50 | |
| SamYaple | no the default is always | 22:50 |
| openstackgerrit | Ryan Hallisey proposed openstack/kolla: [WIP} Drop root privileges for openvswitch https://review.openstack.org/245366 | 22:51 |
| sdake_ | i dont have any idea how that demo worked with missing set | 22:53 |
| sdake_ | i *always* use a registry | 22:54 |
| *** thumpba has joined #kolla | 22:54 | |
| SamYaple | sdake_: it didnt... it was pulling images | 22:55 |
| SamYaple | but this calls into question how you have been testing all this stuff for the past 2 weeks | 22:55 |
| sdake_ | it calls into question how missing was set in my config file! | 22:55 |
| *** cloudnautique has joined #kolla | 22:55 | |
| sdake_ | thatmakes me really nervious | 22:55 |
| *** thumpba has quit IRC | 22:55 | |
| sdake_ | the way i have been testing is docker rmi imagename | 22:56 |
| sdake_ | which missing will then repull a new image | 22:56 |
| sdake_ | which is a huge pain in the ass | 22:56 |
| sdake_ | SamYaple was it you were suggesting we shuld make our own docker module for use with ansible? | 23:01 |
| sdake_ | or was I imagnging that | 23:01 |
| SamYaple | yea i was | 23:01 |
| sdake_ | i am in heavy support of that idea | 23:01 |
| SamYaple | i dont wanna. but man is ansible really dropping the ball | 23:01 |
| sdake_ | as annoying as it is | 23:01 |
| sdake_ | we can't fork their code unfortunately | 23:01 |
| sdake_ | so it would have to be a fresh rewrite | 23:01 |
| SamYaple | its fine. i have alot of code from the docker-compose one i wrote anywa | 23:02 |
| sdake_ | being pinned to 1.8.2 or ansible 2.0 is redonkulous | 23:02 |
| sdake_ | ansible is not going to tag a new release | 23:02 |
| sdake_ | of 1.9 | 23:03 |
| sdake_ | i dont know how they expect eveyrone to just upgrade to 2.0 | 23:03 |
| sdake_ | since the playbookos are not copatible | 23:03 |
| SamYaple | because they said it would be 100% compatible | 23:03 |
| sdake_ | and docker with their api changes - rediculous | 23:03 |
| SamYaple | thats how they sold themselves on it anyway | 23:03 |
| sdake_ | if it was, kolla would run unaltered | 23:03 |
| sdake_ | granted i dont know what it would take to port | 23:04 |
| SamYaple | this 2.0 nonsense is going to push alot of people to other options | 23:04 |
| sdake_ | maybe its a 5 hour job | 23:04 |
| sdake_ | there aren't alot of other mature optoins | 23:04 |
| SamYaple | saltstack is getting there | 23:04 |
| SamYaple | honestly thoguh would you call ansible "mature" after this? | 23:04 |
| SamYaple | 2.0 is a full rewrite | 23:04 |
| SamYaple | how can a full rewrite be mature | 23:04 |
| sdake_ | i would say a non-forward compatible upgrade is a failure | 23:04 |
| sdake_ | well heat is mature and it gets rewritten every 2 months ;) | 23:05 |
| sdake_ | the ideas are mature is what i mean | 23:05 |
| SamYaple | i wouldnt call heat mature | 23:05 |
| sdake_ | not the implementation | 23:05 |
| SamYaple | its where most of our breakage is | 23:05 |
| sdake_ | which heat? | 23:06 |
| SamYaple | the heat in the repo | 23:06 |
| sdake_ | that is just because we dont know how to handle their security model | 23:06 |
| SamYaple | no not the config | 23:06 |
| SamYaple | go back through the history without the rose colored glasses and see how many custom hacks weve done for heat | 23:06 |
| SamYaple | its our biggest breaker | 23:06 |
| sdake_ | i agree heat has been a pai in the ass to containerize and ansiblize | 23:07 |
| SamYaple | not to mention the legitamate openstack bugs.... | 23:07 |
| sdake_ | i think most of that is because of the security model tho | 23:07 |
| sdake_ | so topic change | 23:07 |
| sdake_ | libvirt | 23:07 |
| sdake_ | security | 23:07 |
| sdake_ | recommendations | 23:08 |
| sdake_ | run container as root and let libvirt drop privs? | 23:08 |
| sdake_ | or run libvirt as qemu and cross fingers | 23:08 |
| SamYaple | https://libvirt.org/drvqemu.html#securitydac | 23:09 |
| sdake_ | thaks reading | 23:09 |
| SamYaple | or follow best practices | 23:09 |
| SamYaple | always best practices | 23:09 |
| *** blahRus has quit IRC | 23:11 | |
| *** tpot has quit IRC | 23:12 | |
| sdake_ | Thus, if a vendor / distributor has configured their libvirt package to run as 'qemu' by default, a number of changes will be required before an administrator can change a host to run guests as root. In particular it will be necessary to change ownership on the directories /var/run/libvirt/qemu/, /var/lib/libvirt/qemu/ and /var/cache/libvirt/qemu/ back to root, in addition to changing the /etc/libvirt/qemu.conf settings. | 23:12 |
| sdake_ | well i read that whole document | 23:13 |
| sdake_ | it basicallly expects to start as root and drop its own capabilities | 23:13 |
| sdake_ | but with kolla we can drop capabilities before qemu desires to do so | 23:14 |
| *** sacharya_ has quit IRC | 23:16 | |
| *** dims_ has quit IRC | 23:17 | |
| sdake_ | so bifront license is gplv3 | 23:18 |
| * sdake_ groans | 23:18 | |
| *** signed8bit is now known as signed8bit_ZZZzz | 23:20 | |
| sdake_ | bmace i got a bit distracted with having my car towed | 23:24 |
| sdake_ | was it 3.0.0-inwork? | 23:24 |
| bmace | yeah, but we have a lot more changes since then, if you can't get that to work, just get master. | 23:25 |
| *** vilobhmm has quit IRC | 23:27 | |
| SamYaple | sdake_: we were never planning on forking/cloning bifrost | 23:28 |
| SamYaple | my understanding was it was just going ot be docs | 23:29 |
| SamYaple | i dont know what we would be providing here... | 23:29 |
| *** suro-patz1 has joined #kolla | 23:31 | |
| *** sdake has joined #kolla | 23:32 | |
| *** suro-patz has quit IRC | 23:32 | |
| sdake_ | doesn't nova-api rquire privileges to start? | 23:32 |
| *** sdake_ has quit IRC | 23:32 | |
| *** tummy has joined #kolla | 23:36 | |
| *** rhallisey has quit IRC | 23:42 | |
| *** rhallisey has joined #kolla | 23:47 | |
| *** thumpba has joined #kolla | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!