| ianw | I wonder if it's worth switching our realm to OPENDEV.ORG | 00:05 |
|---|---|---|
| clarkb | I think that came up when we were switching thigns and we decided it would be painful? | 00:05 |
| ianw | less painful with 778840 i think :) but yes, still a lot of fiddling | 00:08 |
| ianw | it would be a good chance to, instead of hand-generating service keytabs, get that done via ansible. similar to letsencrypt where we could loop through client requests and generate keytabs for distribution | 00:10 |
| ianw | another one for the "todo" list if anyone wants an introductory project :) | 00:11 |
| clarkb | would the transition look like running two realms on the same hardware then transition the clients over? | 00:11 |
| ianw | something like that might work, that way you could validate all the hosts have the new key material | 00:13 |
| ianw | "Database propagation to kdc-replica.opendev.org: SUCCEEDED" | 00:14 |
| clarkb | do all the afs clients need to be in the same realm at though? | 00:14 |
| ianw | yay, so the roles now setup both hosts, ensure everything is going and can replicate the db between primary/replica | 00:14 |
| clarkb | neat | 00:16 |
| ianw | yeah, i was reading about cross-realm authentication which maybe works. i dunno. definitely would need more investigation | 00:17 |
| ianw | the new roles shouldn't change anything on the production hosts, but will handle distribution of key material and host principal generation etc. | 00:18 |
| *** tosky has quit IRC | 00:26 | |
| *** mlavalle has quit IRC | 01:00 | |
| openstackgerrit | Ian Wienand proposed opendev/system-config master: [wip] kerberos ansible https://review.opendev.org/c/opendev/system-config/+/778840 | 01:01 |
| *** dmellado has quit IRC | 01:25 | |
| *** dmellado has joined #opendev | 01:52 | |
| openstackgerrit | Merged openstack/project-config master: Add the Gerrit reviewers plugin repository to Zuul https://review.opendev.org/c/openstack/project-config/+/724913 | 02:15 |
| openstackgerrit | Merged openstack/project-config master: Change gerrit ACLs for glance-tempest-plugin https://review.opendev.org/c/openstack/project-config/+/778758 | 02:23 |
| openstackgerrit | Merged openstack/project-config master: Add New Repo for StoryBoard-vue https://review.opendev.org/c/openstack/project-config/+/777244 | 02:23 |
| openstackgerrit | Merged openstack/project-config master: Add create ref acl for osh release groups https://review.opendev.org/c/openstack/project-config/+/779872 | 02:23 |
| openstackgerrit | Ian Wienand proposed opendev/system-config master: kerberos-kdc: role to manage Kerberos KDC servers https://review.opendev.org/c/opendev/system-config/+/778840 | 02:25 |
| *** SotK has quit IRC | 02:36 | |
| *** SotK has joined #opendev | 02:37 | |
| openstackgerrit | Ian Wienand proposed opendev/system-config master: kerberos: switch servers to Ansible control https://review.opendev.org/c/opendev/system-config/+/779890 | 02:49 |
| openstackgerrit | Ian Wienand proposed opendev/system-config master: kerberos-kdc: add database backups https://review.opendev.org/c/opendev/system-config/+/779891 | 02:49 |
| *** openstackgerrit has quit IRC | 03:25 | |
| *** openstackgerrit has joined #opendev | 03:27 | |
| openstackgerrit | Ian Wienand proposed opendev/system-config master: [wip] handle zuul-summary-results as .jar / per-project config https://review.opendev.org/c/opendev/system-config/+/778116 | 03:27 |
| openstackgerrit | Merged opendev/system-config master: refstack: Edit URL of public RefStackAPI https://review.opendev.org/c/opendev/system-config/+/776292 | 03:43 |
| fungi | looks like we finally caught up on the node request backlog a couple of hours ago | 04:19 |
| openstackgerrit | Ian Wienand proposed opendev/system-config master: [wip] handle zuul-summary-results as .jar / per-project config https://review.opendev.org/c/opendev/system-config/+/778116 | 05:17 |
| *** marios has joined #opendev | 06:01 | |
| *** zbr6 has joined #opendev | 06:03 | |
| *** zbr has quit IRC | 06:06 | |
| *** zbr6 is now known as zbr | 06:06 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/project-config master: Normalize projects.yaml https://review.opendev.org/c/openstack/project-config/+/779906 | 06:13 |
| *** ralonsoh has joined #opendev | 06:51 | |
| *** gothicserpent has quit IRC | 07:00 | |
| *** sboyron has joined #opendev | 07:07 | |
| *** slaweq has joined #opendev | 07:13 | |
| *** jaicaa has quit IRC | 07:33 | |
| *** jaicaa has joined #opendev | 07:34 | |
| *** eolivare has joined #opendev | 07:34 | |
| *** lpetrut has joined #opendev | 07:41 | |
| *** marios has quit IRC | 07:49 | |
| *** marios has joined #opendev | 07:55 | |
| *** hashar has joined #opendev | 08:08 | |
| openstackgerrit | Merged openstack/project-config master: Normalize projects.yaml https://review.opendev.org/c/openstack/project-config/+/779906 | 08:22 |
| *** gothicserpent has joined #opendev | 08:22 | |
| *** andrewbonney has joined #opendev | 08:24 | |
| *** jpena|off is now known as jpena | 08:33 | |
| *** tosky has joined #opendev | 08:33 | |
| *** tosky_ has joined #opendev | 08:52 | |
| *** tosky is now known as Guest86814 | 08:53 | |
| *** tosky_ is now known as tosky | 08:53 | |
| *** Guest86814 has quit IRC | 08:55 | |
| *** marios has quit IRC | 09:25 | |
| *** toomer has joined #opendev | 09:33 | |
| *** toomer has quit IRC | 09:35 | |
| *** toomer has joined #opendev | 09:37 | |
| *** toomer has quit IRC | 09:40 | |
| *** toomer has joined #opendev | 09:45 | |
| *** toomer has quit IRC | 09:46 | |
| *** toomer has joined #opendev | 09:47 | |
| *** toomer has quit IRC | 09:49 | |
| *** toomer has joined #opendev | 09:49 | |
| *** toomer has quit IRC | 09:50 | |
| *** toomer has joined #opendev | 09:52 | |
| *** SWAT has quit IRC | 10:09 | |
| *** SWAT has joined #opendev | 10:12 | |
| *** dtantsur|afk is now known as dtantsur | 10:17 | |
| openstackgerrit | Merged zuul/zuul-jobs master: Bits to keep ansible-lint happy https://review.opendev.org/c/zuul/zuul-jobs/+/779276 | 11:41 |
| openstackgerrit | Merged opendev/irc-meetings master: Add Cinder bug squad meeting https://review.opendev.org/c/opendev/irc-meetings/+/779818 | 11:52 |
| openstackgerrit | Sorin Sbârnea proposed zuul/zuul-jobs master: Upgrade ansible-lint to 5.0 https://review.opendev.org/c/zuul/zuul-jobs/+/773245 | 12:03 |
| *** jpena is now known as jpena|lunch | 12:35 | |
| openstackgerrit | Sorin Sbârnea proposed zuul/zuul-jobs master: Upgrade ansible-lint to 5.0 https://review.opendev.org/c/zuul/zuul-jobs/+/773245 | 12:56 |
| *** openstack has joined #opendev | 13:16 | |
| *** ChanServ sets mode: +o openstack | 13:16 | |
| *** jpena|lunch is now known as jpena | 13:30 | |
| *** SWAT has quit IRC | 13:36 | |
| *** klonn has joined #opendev | 13:44 | |
| *** klonn has quit IRC | 13:48 | |
| openstackgerrit | Aurelien Lourot proposed openstack/project-config master: Add Manila-NetApp backend charm to OpenStack charms https://review.opendev.org/c/openstack/project-config/+/780005 | 13:51 |
| *** weshay|ruck has joined #opendev | 13:57 | |
| openstackgerrit | Aurelien Lourot proposed openstack/project-config master: Add Manila-NetApp backend charm to OpenStack charms https://review.opendev.org/c/openstack/project-config/+/780005 | 14:01 |
| *** chandankumar is now known as raukadah | 15:02 | |
| *** spotz has joined #opendev | 15:10 | |
| hashar | tristanC: fungi: thank you for approval of the opendev/gear changes :] | 15:19 |
| fungi | hashar: yw, i'm looking to see what other polish it may need prior to a new release | 15:19 |
| *** dirk2 is now known as dirk | 15:23 | |
| *** lpetrut has quit IRC | 15:29 | |
| hashar | there is one to bump tox min version https://review.opendev.org/c/opendev/gear/+/615144 | 15:35 |
| hashar | and another one to run tests against more python versions https://review.opendev.org/c/opendev/gear/+/703418 | 15:35 |
| hashar | that is probably the only last trivial changes ;] | 15:36 |
| fungi | yeah, i asked a question on the tox version bump, i'm dubious of that change | 15:37 |
| fungi | it talks about increasing the minimum tox version to support things we don't use it for on gear. like the unicode removal patch (which i was on the fence about) i think it was one of someone's barrage of mass changes strafing every repository based on incomplete assumptions | 15:38 |
| fungi | the polish i'm thinking of is things like fixing up the docs theming/publishing location, package metadata, et cetera like i did before the most recent bindep and git-review releases, and making sure we've moved the project to our new zuul tenant and moved its jobs in-repo | 15:39 |
| clarkb | infra-root my plan for this morning after I've caught up on email and scrollback is to retire that single users account which had problems recently then run the external id cleanup on it after | 16:03 |
| clarkb | then if that looks good I'd like to proceed with the ~70 something external id cleanups that I have proposed on review in my homedir | 16:03 |
| fungi | i'm around to help with that. i'll also be trying to work on getting gear ready for a release, when i'm not doing meetings | 16:04 |
| clarkb | fungi: thanks, if you can look over the proposed list and spot check it that would probably be the most useful thing | 16:05 |
| fungi | will do | 16:05 |
| *** fressi has quit IRC | 16:28 | |
| *** fressi_ has joined #opendev | 16:28 | |
| *** prometheanfire has joined #opendev | 16:34 | |
| clarkb | alright, account cleanup for that single account is done now | 16:35 |
| clarkb | that user should be able to login with new valid openids that conflict in email address now. They will get a new account id but the old one was never used so not a big deal | 16:36 |
| *** mlavalle has joined #opendev | 17:02 | |
| clarkb | fungi: I think I'm ready to do the bigger external id cleanup whenever you (and anyone else that wants to spot check) are. Just let me know. /me finds breakfast in the interim | 17:09 |
| fungi | i'm free to focus a little better after the openstack release management meeting wraps up, unless we end up doing a storyboard meeting | 17:12 |
| clarkb | cool, just ping me if/when I can help. | 17:21 |
| clarkb | Looks like that nodepool launcher id change landed yesterday so I'm going to take a look at restarting on that next | 17:21 |
| clarkb | though if we are under node contention maybe I should wait for later today? | 17:22 |
| clarkb | never a good time to do anything half scary during a feature freeze week | 17:22 |
| clarkb | node requests are currently falling but just under 1k. I'll give nodepool some time to catch up while it can before I introduce a delay | 17:23 |
| fungi | the node request backlog was minimal when i looked a couple hours back | 17:24 |
| fungi | haven't revisited it more recently though | 17:25 |
| clarkb | I just checked it is ~900 right now and falling | 17:25 |
| clarkb | two hours ago it was ~150 | 17:25 |
| fungi | so we got a bit of a bump in activity i guess | 17:27 |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-jobs master: bindep.txt: skip python-devel for el8 platform https://review.opendev.org/c/zuul/zuul-jobs/+/780050 | 17:31 |
| *** mfixtex has joined #opendev | 17:32 | |
| clarkb | the other thing I'm trying to give some brain time this morning is the PTG | 17:38 |
| clarkb | has anyone else formed strong opinions on whether or not we should be trying to run PTG sessions? | 17:38 |
| clarkb | I'm beginning to think that if we do participate in the PTG that the best use of our time may be as office hours. Basically helping others and not necessarily for our own get together since I think we can do that fairly easily whenever we want | 17:40 |
| *** fressi_ has quit IRC | 17:41 | |
| fungi | it's worked reasonably well in the past sometimes | 17:44 |
| openstackgerrit | Tristan Cacqueray proposed zuul/zuul-jobs master: bindep.txt: skip python-devel for el8 platform https://review.opendev.org/c/zuul/zuul-jobs/+/780050 | 17:44 |
| *** jpena is now known as jpena|off | 17:44 | |
| fungi | other times we've sat around with nobody asking for help | 17:44 |
| clarkb | ya exactly | 17:45 |
| *** eolivare has quit IRC | 18:10 | |
| *** andrewbonney has quit IRC | 18:12 | |
| *** mlavalle has quit IRC | 18:23 | |
| *** mlavalle has joined #opendev | 18:24 | |
| clarkb | down to ~700 now. I think if it gets to ~500 I may go for it on nl02 first since it has the lowest max-servers total count | 18:25 |
| *** hashar is now known as hasharDinner | 18:26 | |
| *** mfixtex has quit IRC | 18:34 | |
| fungi | that's really just going to lose in-progress boot calls, release any locks the launcher may have taken on node requests, and temporarily prevent it from creating new nodes in the provider, right? | 18:36 |
| fungi | providerS | 18:36 |
| fungi | (for that launcher) | 18:36 |
| fungi | so as long as it's brief, i don't expect it to severely impact the backlog | 18:37 |
| clarkb | ya the major impact is losing the inprogress boots they go back on the request queue | 18:37 |
| *** mlavalle has quit IRC | 18:38 | |
| fungi | though the new code will change the identifier, right? are we likely to leak nodes and need to manually delete them because the launcher no longer considers them its own? | 18:38 |
| clarkb | fungi: We don't think so beacuse the old code wasn't using a static identifier anyway (it just happened to eb static the way we use it) | 18:39 |
| *** dtantsur is now known as dtantsur|afk | 18:39 | |
| fungi | oh, right, the identifier could change between restarts already | 18:39 |
| clarkb | folks like bmw run it on openshift/k8s and should get a unique name each time they restart their launchers | 18:39 |
| fungi | so if it was going to leak we'd have seen leaks before now | 18:39 |
| clarkb | that is a potential impact, but not considered likely | 18:39 |
| clarkb | given how others use the launchers and how the code was arleady semi random | 18:39 |
| clarkb | I think you've convinced me to just go for it | 18:42 |
| clarkb | I'll restart nl02 now | 18:42 |
| fungi | yeah, i see no need to wait around | 18:43 |
| *** ralonsoh has quit IRC | 18:48 | |
| clarkb | limestone and kna1 have both booted new instances after the restart. There is one deleting node and two in kna1 that were deleting prior to the restart that appear to not want to delete (and continue to not want to delete) | 18:49 |
| clarkb | otherwise it looks good. I'll let this run for a bit before doing the others so that we can confirm that more of the full lifecycle is exercised | 18:50 |
| fungi | one deleting node in limestone? | 18:51 |
| clarkb | yup and two in kna1 | 18:52 |
| clarkb | but they were that way before the restart based on logging timestamps | 18:52 |
| clarkb | I have observed nodes go from building -> ready -> in use now | 18:56 |
| clarkb | haven't found any finish up the delete portion of the lifecylce though | 18:56 |
| *** hamalq has joined #opendev | 19:01 | |
| *** hasharDinner is now known as hashar | 19:02 | |
| clarkb | I'vefound a server that was create a few hours ago that just got deleted. Seems to generally be working | 19:03 |
| clarkb | I'll let it rumble along a bit longer than look at restarting the others | 19:03 |
| *** fbo has quit IRC | 19:48 | |
| *** fbo has joined #opendev | 19:48 | |
| clarkb | 0023443410 is a node that did a full lifecycle on nl02 after the restart | 19:49 |
| clarkb | I can't think of anything else to check before restarting the others so will proceed with that now | 19:50 |
| clarkb | all but nl01 are done now. Decided to spread out nl01 since it has a high max-server value | 19:54 |
| fungi | node request backlog is down around 350 now | 19:55 |
| fungi | clarkb: your external_id_cleanups.txt.20210309.proposed looks good to me based on some spot checking and earlier conversations, e.g. about the tripleo-ci account | 19:57 |
| clarkb | fungi: ok, should I go ahead and run `python3 -u remove-user-external-ids.py` against that list now? | 19:59 |
| clarkb | the -u will apparently unbuffer the output so I can skim it as it moves along | 20:00 |
| fungi | yes, and i had forgotten about -u, good call | 20:00 |
| clarkb | alright proceeding with that momentarily | 20:01 |
| clarkb | and done | 20:08 |
| clarkb | logs have been pushed to review | 20:09 |
| clarkb | I'm going to get a consistency check run now | 20:09 |
| openstackgerrit | Jeremy Stanley proposed opendev/gear master: Update testing to Python 3.9 and linters https://review.opendev.org/c/opendev/gear/+/780103 | 20:14 |
| clarkb | sort of related to the account cleanup, its really annoying you have to remember to add a /a to your gerrit urls at times | 20:14 |
| clarkb | I've debugged cannot modify account errors several times in the last few weeks and its alwys I forgot the /a | 20:15 |
| fungi | i suppose that made it easy to force auth | 20:15 |
| clarkb | consistency check is over 5 minutes now, good thing I ran it against localhost | 20:15 |
| fungi | i suppose gerrit is busy | 20:16 |
| clarkb | took 6:08 | 20:17 |
| clarkb | down to 545 email conflicts now | 20:19 |
| fungi | where did we start? | 20:20 |
| clarkb | checking | 20:20 |
| clarkb | 643 | 20:21 |
| clarkb | thats about right ~30 for the already inactive accounts that we did in the first pass and ~70 on this pass | 20:21 |
| clarkb | and a few accounts have multiple collisions of which we've only handled a subset so they still show up as errors | 20:21 |
| clarkb | and for the no external id for preferred eamil address problem we are down from 109 to 13 | 20:22 |
| clarkb | for those remaining 13 we can either set the preferred email address to a value in the external ids for an account, we can remove teh preferred email address entirely (is this properly valid though?), or we can retire the accounts | 20:22 |
| clarkb | considering how close to being done with those we are I should probably try and get those fixed next | 20:23 |
| clarkb | the latest consistency check results including the formatted diffable version are on review in my homedir now too | 20:24 |
| fungi | i suppose those accounts could still be usable, but not having a preferred address suggests they're probably also remnants of old cleanups/mergers | 20:24 |
| clarkb | fungi: yup, there are about 3 that appear to be maybe the only account for real users that I can find | 20:25 |
| clarkb | however I think those users haven't done anything with our gerrit in a few years | 20:25 |
| fungi | i don't think gerrit would have allowed those accounts to get into that situation without manual intervention on our part editing the db contents | 20:26 |
| fungi | and i can't recall any case where we would have removed the preferred address from an account which was expected to still be used | 20:26 |
| clarkb | I need to page that content back in again and look at those 13 accounts more closely, but I suspect we can simply retire them | 20:28 |
| clarkb | those accounts don't require external id cleanups so unretiring them if their users show up again is pretty straightforward | 20:28 |
| fungi | if none were recently used, i would go ahead and just do that, yeah | 20:29 |
| clarkb | if I fidn evidence of recent activity we can reach out to them directly but pretty sure when I last dug into these there was no recent use | 20:29 |
| fungi | this is amusing: https://zuul.opendev.org/t/opendev/build/366f6f140b2f41e4b3f1ee519bb6e1ac/log/job-output.txt#1869-1886 | 20:34 |
| fungi | i can't reproduce it locally with my python 3.9 | 20:34 |
| fungi | leads me to suspect it's not python but maybe openssl having a problem | 20:35 |
| *** tobiash_ is now known as tobiash | 20:36 | |
| fungi | maybe https://bugs.python.org/issue43382 | 20:39 |
| fungi | which points to https://launchpad.net/bugs/1899878 | 20:41 |
| openstack | Launchpad bug 1899878 in openssl (Ubuntu) "Python's test_ssl fails starting from Ubuntu 20.04" [Undecided,Incomplete] | 20:41 |
| clarkb | fungi: I modified the audit script to not skip if < 2 accounts are found by email and ran it against the 13. It reports none of the 13 have been used in the last year. One of the 13 appears to have a second account that has been actively used. The other 12 are lost completely to time I suspect. Two of the 12 also have external id conflicts so if we retire them they will show up in top of the | 20:42 |
| clarkb | cleanup list for external id cleanups | 20:42 |
| clarkb | that makes me feel more confident that we can retire them | 20:43 |
| clarkb | we can stew on that a bit though and do the cleanups tomorrow if no better ideas pop up | 20:43 |
| fungi | yeah, sounds pretty straightforward though | 20:44 |
| fungi | this ubuntu python ssl rabbit hole goes deeper than i'd hoped | 20:45 |
| fungi | and the only workaround i've found so far is "don't use ubuntu focal" | 20:48 |
| clarkb | I've restart nl01's launcher now | 20:53 |
| clarkb | fungi: this is the thing that guillaumec was working on I think | 20:54 |
| clarkb | the problem is the options used to configure tls on startup | 20:54 |
| clarkb | fungi: https://review.opendev.org/c/opendev/gear/+/741288 is the related change | 20:54 |
| fungi | ahh | 20:56 |
| *** slaweq has quit IRC | 20:56 | |
| clarkb | fungi: there isn't a good way on python 3.5 to set things up in a generic way for best tls available | 20:56 |
| clarkb | well more specifically on xenial's 3.5 | 20:56 |
| clarkb | newer 3.5 did end up fixing that | 20:56 |
| clarkb | there is a way to use a default ssl context which may work for xenial 3.5 | 20:57 |
| fungi | i wonder if switching on python version would help there | 20:57 |
| clarkb | I think maybe what we want to do is if hasattr(ssl, PROTOCOL_TLS) then use that elif hasattr(ssl, PROTOCOL_TLSv12) use that elif hasattr(ssl, PROTOCOL_TLSv11) use that and so on | 20:58 |
| clarkb | fungi: yes python >= 3.5.3 is fine I think | 20:58 |
| fungi | ahh, yeah maybe | 20:58 |
| clarkb | but xenial is 3.5.2 | 20:58 |
| fungi | i'll try the hasattr() approach. but probably not right now | 20:58 |
| clarkb | and probably if TLSv1 doesn't exist don't fall back to sslv23 and just error | 20:59 |
| ianw | infra-root: if you feel like some review time, the kerberos changes are ready, from https://review.opendev.org/c/opendev/system-config/+/778840 | 20:59 |
| ianw | kopecmartin: are we happy with the review rollout now? should i delete and re-sync the db to the production server and we can switch it over? | 21:00 |
| kopecmartin | ianw: yes please | 21:00 |
| clarkb | ianw: I'll try to get to it between afternoon meetings | 21:00 |
| ianw | clarkb: thanks, no huge rush :) | 21:01 |
| ianw | ok, i'll stop the container on refstack01, drop the existing db and then re-import it | 21:02 |
| ianw | kopecmartin / anyone : https://refstack01.openstack.org now updated to whatever was in the old trove db as of, about right now. if no issues, i'll change the cname and shutdown the old server | 21:11 |
| clarkb | ttx: ^ is there any other cooreindation you think we need for refstack? | 21:12 |
| kopecmartin | ianw: it seems ok | 21:15 |
| clarkb | maybe flip it over but keep the old server around for a few days in case we have to roll back? | 21:20 |
| ianw | yeah i'll only shut it down for now, not remove it | 21:20 |
| *** hamalq has quit IRC | 21:30 | |
| *** hamalq has joined #opendev | 21:31 | |
| ianw | #status log refstack.openstack.org CNAME created to the new refstack server. The A/AAAA records for the old server are renamed refstack-old until we decommission | 21:31 |
| openstackstatus | ianw: finished logging | 21:31 |
| corvus | ianw: is it the case that we make a custom grafana image only so we can run grafyaml in it? | 21:31 |
| ianw | corvus: well, to say another way we install the grafyaml tooling into the base grafana image, but yes | 21:33 |
| corvus | yeah, was trying to ascertain if that was the main/only reason or if there was another one | 21:34 |
| corvus | ianw: what do you think about making a grafyaml image instead? then we can run plain upstream image without rebuild; could bind-mount the same secrets in so we don't have to pass them on the "docker run" cmdline | 21:35 |
| ianw | corvus: not really opposed to it; it seems like quite a few more steps and maintaining our container rather than just an install into the existing container, but if you feel there's benefit i don't see why it won't work | 21:38 |
| corvus | ianw: should be same number of steps (we build exactly 1 container image). was mostly thinking it means we auto track grafana container upgrades (which are currently coupled to our image builds). and having a grafyaml container is useful for grafyaml users who are not us. | 21:41 |
| corvus | ianw: i think it's in-scope for a project i'm working on, so if you're not opposed, i'll see what getting a grafyaml build looks like | 21:42 |
| ianw | ++ | 21:42 |
| *** hashar has quit IRC | 21:51 | |
| openstackgerrit | James E. Blair proposed opendev/grafyaml master: Build docker images https://review.opendev.org/c/opendev/grafyaml/+/780119 | 21:54 |
| corvus | wow first add of .zuul.yaml to that repo :) | 21:54 |
| corvus | i feel like that may be missing something | 21:56 |
| openstackgerrit | James E. Blair proposed opendev/grafyaml master: Build docker images https://review.opendev.org/c/opendev/grafyaml/+/780119 | 21:57 |
| corvus | now with dockerfile | 21:57 |
| *** gothicserpent has quit IRC | 22:01 | |
| ianw | i got the system-config job taking screenshots, but didn't go through figuring out how to click on individual graphs in selenium yet. it would be good as sometimes we've updated grafana and required tweaks to the output json of grafyaml | 22:05 |
| ianw | it is probably significantly easier than the shadow-dom mess gerrit presents | 22:05 |
| openstackgerrit | James E. Blair proposed opendev/grafyaml master: Build docker images https://review.opendev.org/c/opendev/grafyaml/+/780119 | 22:11 |
| corvus | somehow that change which touches no python files fails pep8 | 22:12 |
| kopecmartin | ianw: when logging in i see it's trying to GET to refstack01 .. f.e. the request contains openid.return_to=https://refstack01.openstack.org/v1/auth/signin_return ... due to that I'm not redirected back (after I sign in) | 22:12 |
| kopecmartin | any chance there is still a var in a config set to refstack01 instead refstack ? | 22:12 |
| ianw | kopecmartin: hrrmmm ... maybe? i mean it's whatever is in system-config | 22:13 |
| openstackgerrit | James E. Blair proposed opendev/grafyaml master: Build docker images https://review.opendev.org/c/opendev/grafyaml/+/780119 | 22:15 |
| ianw | inventory/service/group_vars/refstack-docker.yaml:refstack_url: 'https://{{ ansible_fqdn }}' | 22:16 |
| ianw | kopecmartin: i think we need to set ^ to https://refstack.openstack.org in production, but leave it as ansible_fqdn in the gate; or setup /etc/hosts to override refstack.openstack.org | 22:21 |
| ianw | i am pretty sure the service should be using relative urls. but realistically i doubt anyone is fixing things at that level | 22:22 |
| clarkb | ya you can use an testing group file and a prod groupfile to change those values | 22:28 |
| openstackgerrit | Ian Wienand proposed opendev/system-config master: refstack: use CNAME for production server https://review.opendev.org/c/opendev/system-config/+/780125 | 22:30 |
| ianw | clarkb: haha great minds ^ :) | 22:30 |
| kopecmartin | ianw: thank you | 22:34 |
| * kopecmartin is gonna go to bed because he's falling asleep behind the computer | 22:35 | |
| *** gothicserpent has joined #opendev | 22:36 | |
| ianw | kopecmartin: np. i'll probably try rolling that out, and if it doesn't work, we can revert the old server and re-evaluate | 22:36 |
| *** hamalq has quit IRC | 22:38 | |
| openstackgerrit | Clark Boylan proposed opendev/gear master: Create SSL context using PROTOCOL_TLS, fallback to highest supported version https://review.opendev.org/c/opendev/gear/+/741288 | 22:55 |
| clarkb | guillaumec: fungi: ^ I had a few minutes between things and wrote that up really quickly | 22:56 |
| fungi | clarkb: ooh, thanks!!! | 22:57 |
| fungi | if that passes, i'll queue 780103 up behind it | 22:57 |
| johnsom | Hi opendev folks. Before I screw something up I thought I would ask here first. I would like to release x/wsme (merged a py3 deprecation warning fix). I have "release" permissions. I just create a tag and push origin the tag right? | 23:03 |
| *** smcginnis has quit IRC | 23:04 | |
| fungi | johnsom: pretty much, yep, we have the commands documented, lemme get that link for you | 23:04 |
| johnsom | Ah, cool. I looked in the project guide, but it was release team focused. (As I have been) | 23:04 |
| fungi | johnsom: https://docs.opendev.org/opendev/infra-manual/latest/drivers.html#tagging-a-release | 23:04 |
| openstackgerrit | James E. Blair proposed opendev/system-config master: Use grafyaml container image https://review.opendev.org/c/opendev/system-config/+/780128 | 23:05 |
| corvus | ianw: https://review.opendev.org/780119 should be ready to go, i tried it in my downstream env and it worked. https://review.opendev.org/780128 is written, we'll see how the tests go. but i think we can go ahead and merge 119 if you like it. | 23:06 |
| openstackgerrit | Ian Wienand proposed opendev/system-config master: refstack: use CNAME for production server https://review.opendev.org/c/opendev/system-config/+/780125 | 23:07 |
| johnsom | fungi https://docs.opendev.org/opendev/infra-manual/latest/drivers.html#tagging-a-release | 23:07 |
| johnsom | I think I found it | 23:07 |
| fungi | johnsom: yep, that's what i linked above | 23:07 |
| fungi | you found the right docs | 23:08 |
| johnsom | Thank you sir | 23:08 |
| fungi | yw | 23:08 |
| *** Dmitrii-Sh2 has joined #opendev | 23:10 | |
| fungi | that also reminds me that we make use of our lovely opendev logo in the infrastructure manual, i should start adding that to our docs builds for our opendev tools repos | 23:10 |
| *** fdegir has quit IRC | 23:10 | |
| *** fdegir has joined #opendev | 23:10 | |
| *** Dmitrii-Sh has quit IRC | 23:10 | |
| *** Dmitrii-Sh2 is now known as Dmitrii-Sh | 23:10 | |
| *** smcginnis has joined #opendev | 23:15 | |
| *** gothicserpent has quit IRC | 23:17 | |
| openstackgerrit | Merged opendev/grafyaml master: Build docker images https://review.opendev.org/c/opendev/grafyaml/+/780119 | 23:17 |
| guillaumec | clarkb, in https://review.opendev.org/c/zuul/zuul/+/777761 PS paragraph, I was saying that with PROTOCOL_TLS on focal, ".tox/py38/bin/stestr run TestSchedulerSSL" is OK but, the process hangs forever | 23:19 |
| clarkb | guillaumec: interesting, do we think that is a similar problem to the gear issue? | 23:23 |
| *** gothicserpent has joined #opendev | 23:23 | |
| openstackgerrit | Ian Wienand proposed opendev/system-config master: refstack: use CNAME for production server https://review.opendev.org/c/opendev/system-config/+/780125 | 23:24 |
| guillaumec | clarkb, http://paste.openstack.org/show/803489/ | 23:25 |
| clarkb | guillaumec: is the problem negotiation maybe, it never completes so the test hang? | 23:25 |
| *** smcginnis has quit IRC | 23:28 | |
| guillaumec | no clue, I did not look into it that much, provided that TLSv1_2 was ok, so "tox -e py38" worked for zuul test on focal :) | 23:31 |
| clarkb | guillaumec: but won't py38 use PROTOCOL_TLS in your change? | 23:31 |
| clarkb | it checks first that PROTOCOL_TLS is available and uses it if so and it should be available on focal + python 3.8 | 23:32 |
| clarkb | the fallback to PROTOCOL_TLSv1_2 shoudl never be used in zuul testing because python is always new enough to have PROTOCOL_TLS | 23:32 |
| fungi | guillaumec: https://zuul.opendev.org/t/opendev/build/366f6f140b2f41e4b3f1ee519bb6e1ac/log/job-output.txt#1869-1886 is what i'm seeing trying to add 3.9 testing on focal, fwiw | 23:33 |
| fungi | guessing it's related to https://bugs.python.org/issue43382 and https://launchpad.net/bugs/1899878 | 23:33 |
| openstack | Launchpad bug 1899878 in openssl (Ubuntu) "Python's test_ssl fails starting from Ubuntu 20.04" [Undecided,Incomplete] | 23:33 |
| fungi | your patch at least *sounds* like it's trying to address those | 23:34 |
| openstackgerrit | James E. Blair proposed opendev/system-config master: Use grafyaml container image https://review.opendev.org/c/opendev/system-config/+/780128 | 23:36 |
| guillaumec | clarkb, fungi, yes, gear is fine. and for zuul, with gear using PROTOCOL_TLS, SSL test is ok, but for somewhat reason, the process does terminate properly as the "self.poll_thread.join()" hangs. That's what i meant by : "does not work with PROTOCOL_TLS" in https://review.opendev.org/c/opendev/gear/+/741288 and ended up setting PROTOCOL_TLSv1_2 directly in zuul/.tox/py38/lib/python3.8/site-packages/gear/__init__.py so "tox -e py38" will run | 23:40 |
| guillaumec | without issue | 23:40 |
| guillaumec | on ubuntu focal, obviously :) | 23:41 |
| openstackgerrit | James E. Blair proposed opendev/system-config master: Use grafyaml container image https://review.opendev.org/c/opendev/system-config/+/780128 | 23:41 |
| fungi | looks like it passes tests, so i'll rebase my change on it and see if it's happy | 23:42 |
| clarkb | guillaumec: I see so https://review.opendev.org/c/zuul/zuul/+/777761 is unrelated? | 23:44 |
| clarkb | we can also do more testing with that change now that it passes gear side tests | 23:44 |
| guillaumec | it's related, in this one I was explaining a little my comment from gear change | 23:44 |
| openstackgerrit | Jeremy Stanley proposed opendev/gear master: Update testing to Python 3.9 and linters https://review.opendev.org/c/opendev/gear/+/780103 | 23:46 |
| clarkb | guillaumec: is it possible that focal + python 3.8 is using tls 1.3? | 23:48 |
| clarkb | and forcing tls 1.2 fixes the problem? | 23:48 |
| clarkb | PROTOCOL_TLS is documented as selecting the highest possible option including 1.3 if available | 23:49 |
| openstackgerrit | James E. Blair proposed opendev/system-config master: Use grafyaml container image https://review.opendev.org/c/opendev/system-config/+/780128 | 23:53 |
| openstackgerrit | Jeremy Stanley proposed opendev/gear master: DNM: see if intermediate Python versions work too https://review.opendev.org/c/opendev/gear/+/780131 | 23:56 |
| clarkb | guillaumec: ssl.HAS_TLSv1_3 is true on focal python 3.8 so I bet that is related | 23:57 |
| clarkb | basically PROTOCOL_TLS is going to use the latest that both sides support and that should be 1.3 if both use PROTOCOL_TLS on python3.8 on focal | 23:57 |
| clarkb | when you set it to PROTOCOL_TLSv1_2 then you downgrade slightly | 23:57 |
| *** mlavalle has joined #opendev | 23:59 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!