Tuesday, 2024-03-05

opendevreviewMerged opendev/git-review master: Use importlib.metadata instead of pkg_resources  https://review.opendev.org/c/opendev/git-review/+/90710100:26
*** benj_6 is now known as benj_03:57
opendevreviewMichael Kelly proposed zuul/zuul-jobs master: debugging registry config  https://review.opendev.org/c/zuul/zuul-jobs/+/91104206:06
opendevreviewMichael Kelly proposed zuul/zuul-jobs master: debugging registry config  https://review.opendev.org/c/zuul/zuul-jobs/+/91104206:16
opendevreviewMichael Kelly proposed zuul/zuul-jobs master: debugging registry config  https://review.opendev.org/c/zuul/zuul-jobs/+/91104206:25
opendevreviewMichael Kelly proposed zuul/zuul-jobs master: debugging registry config  https://review.opendev.org/c/zuul/zuul-jobs/+/91104207:11
opendevreviewMichael Kelly proposed zuul/zuul-jobs master: debugging registry config  https://review.opendev.org/c/zuul/zuul-jobs/+/91104207:24
opendevreviewMichael Kelly proposed zuul/zuul-jobs master: debugging registry config  https://review.opendev.org/c/zuul/zuul-jobs/+/91104207:55
opendevreviewMichael Kelly proposed zuul/zuul-jobs master: debugging registry config  https://review.opendev.org/c/zuul/zuul-jobs/+/91104208:24
elodillesfungi clarkb : we were very late with yoga as it should have been moved to EM/Unmaintained in early November, so the plan was to deal with that first. but now we have patches against rest of the EM branches so should be ready with them soon: https://review.opendev.org/q/topic:vwx-unmaintained08:32
fungielodilles: cool, thanks. sounds like we should merge cleanup patches to stable/victoria through stable/xena rather than waiting for them to transition to unmaintained12:48
elodillesfungi: well, we are about to start merging the transition patches14:41
opendevreviewJeremy Stanley proposed opendev/git-review master: Add CC similarly to reviewers  https://review.opendev.org/c/opendev/git-review/+/84921914:41
clarkbfungi: other than ^ and all the changes that have been approved/merged already are there any other we want to get in before making a relesae?15:03
fungiclarkb: i brushed that one up because it was close to ready, need to look back through the rest15:18
fungiseveral of my other git-review changes haven't been approved/merged yet15:18
fungiall the proposed changes open for git-review seem to be passing tests now15:19
clarkboh I thought the commit hook changes were approved15:19
clarkblooks like the child is but not the parent if you want to +a it now they should both go in15:20
fungithe remote branch and worktree support changes (not mine) could also use a look15:20
fungii just un-wip'd the rebase unwind change too, forgot it was still wip awaiting input15:21
clarkbfungi: the worktree commit conflicts with your commit msg hook change I think. But also reading it I'm not sure it is useful? The chagne basically says if the hook exists in any possible hook dir then the hook is installed and we don't need to install it15:23
clarkbso we should be able to continue installing the hook into the local location and have it work?15:24
clarkbotherwise that check wouldn't be appropriate15:24
clarkboh maybe it doesn't conflict becuse it checks a level about set_hooks_commit_msg(). I still don't understand why it is necessary given the check to determien if the hook should be installed15:24
opendevreviewMerged opendev/git-review master: Test that the --version option returns something  https://review.opendev.org/c/opendev/git-review/+/91101015:26
clarkbfungi: fwiw I'm torn on the branch filter, cc change, and commit msg hooks. For the first two I'm not sure we need to keep up with gerrit features or make git-review a do it all gerrit interaction tool. And for the third I interpret the code there are implying this isn't strictly necessary15:39
clarkbthey aren't bad changes, but its more features and code we'll have to maintain in a tool that has largely been stable over time and whose primary purpose (in my opinion) is to make the `git push` step to gerrit easier15:39
clarkbI have no problem with extra code for commit msg hooks and worktree if we can determine that is necessary to support worktree15:40
clarkbmy concern is only that it isn't necessary.15:40
clarkbside note we can always make 2 releases too15:46
fungiyeah, for the --cc change it seems that ship sort of sailed once --reviewers got accepted. it seems like --cc is a less heavy way to add "non-required" reviewers15:57
clarkbfungi: also had a couple thoughts on the rebase abort change. I did +2 it if you feel those aren't necessary to update16:04
fungithanks, i'll revisit those in a sec now that the public part of the board meeting has wrapped16:11
clarkbI'm going to go do morning things now that the meeting is done for me16:12
fungiinfra-root: i just received this for my personal account, but we'll probably get a similar notification for our accounts soon... "Starting on Tuesday, March 26, 2024, Rackspace mandates multi-factor authentication (MFA) for all customers that access MyCloud (login.rackspace.com) portal. From this date, you must use a secondary authentication method to access your Rackspace portal account."16:36
fungiit goes on to link https://docs.rackspace.com/docs/cloud-article-for-configuring-multi-factor-authentication16:37
clarkbfungi: as long as we can use totp I think we can set that up similar to what we did for github and pypi16:37
fungithat's my plan, yeah16:37
clarkbthe mobile authenticators they point at all do totp so very likely that is the common method between them16:37
fungianyway, we've got 3 weeks to sort it out so not super urgent16:37
clarkbfungi: note the bit about api access though16:38
clarkbwe will need to switch nodepool over to using a token16:38
frickleroh, that's for the openstack api, too?16:39
clarkbfrickler: yes there is a note about it in the link fungi posted16:39
clarkbwill affect launch node stuff too16:39
clarkbshould be addressable we'll just need to update clouds.yaml stuff appropriately. Ideally we switch to token first then add mfa16:39
clarkbwhich means we need to get it done before the deadline16:39
fungithat's going to be... fun. the rackspace test account i lined up for gtema only came with a token, and he was unable to get that working in openstacksdk configuration16:40
clarkbas I assume post deadline we'll be forced to setup mfa immediately then that will break clouds.yaml16:40
fungisomething about rackspace having a customized keystone that takes different fields only implemented in their rackspace sdk16:41
clarkbfungi: that concern may be worth bringing up with cloudnull ?16:41
clarkbsince the document you linked implies it should work, but if the maintainer of the software can't get it to work us normal users don't have much of a chance16:41
fungiit's also entirely possible that the account didn't have the right permissions granted to the api token, because i'm pretty sure i've used openstackclient with a token i issued with my personal account before16:41
fungibut point being, it will need some testing16:42
clarkb++ we should test that and ideally sooner than later if we can16:42
fricklerhmm, also usually the keystone tokens should have very limited lifetime? like 1h? increasing that a lot would IMHO make the whole thing pretty insecure instead of more secure16:42
fungifrickler: i think it's an api authentication token that isn't a normal keystone bearer token. it's an alternative to username+password16:43
clarkbfrickler: should be equivalent right? except that you can scope a token?16:43
clarkb"If you are using a client that supports token authentication, use URL to get the authentication token."16:44
clarkbI wonder if URL was meant to be replaced16:44
fricklerwell that note explicitly mentions OS_TOKEN, which is that bearer token16:44
fungioh, are those interchangeable?16:44
clarkbbut ya I agree this would make nodepool pretty useless if we can't give it a long lived credential16:45
fricklerI would think so, yes, but iana keystone expert, too16:45
clarkboh this may also impact log uploads16:45
clarkbbut I think those already use some special auth mechanism using scoped credentials16:46
fungimy notes say it's the "api_key" option in clouds.yaml's auth blocks16:47
clarkbfungi: https://docs.openstack.org/openstacksdk/wallaby/user/config/vendor-support.html#rackspace that does seem to indicate this is a different thing because you have to install `rackspaceauth`16:49
clarkband then set a special flag16:49
clarkbrackspaceauth was last updated more than 6 years ago16:49
fungiyeah, that's the config documentation i was trying to rediscover16:50
clarkbso I guess there are two things 1) we need to see if our accounts are affected and 2) whether or not we can sanely get api tooling to auth to them if so, nodepool, launch node, and openstackclient in particular16:51
fungiyeah, where it says "If you are using the nova-client, configure the client to authenticate with an API key." i assume they mean openstacksdk with the rackspaceauth plugin16:54
clarkbbut given the age who knows if that even works anymore16:54
clarkboh and 3) is our use of swift affected since that already uses special sub accoutns and keys iirc16:56
clarkb1) will require waiting for emails to show up or reaching out to rax directly. We should be able to figure out 2 and 3 on our own17:03
fungithey've also added a notification about it immediately above the input fields on the portal login page17:26
clarkbya  I guess the bit that confused me was "for all customers that access MyCloud portal" wasnt' clear to me if that is a different login method than we use17:30
clarkbmaybe if we never login to the console again this won't affect us >_>17:30
fungiclarkb: the good news is i just tested my personal rackspace account with a recent version of openstackclient and the latest (2018) version of rackspaceauth configured for an api_key and it's working17:30
clarkbfungi: oh cool I was just going to ask if anyone has time to test that. How do you provision the api_key itself?17:31
clarkbfungi: if provisioning an api_key is easy I think we should probably go ahead and do that and switch the smallest rax region over to it in our nodepool clouds.yaml17:31
fungigo to the cloud portal and navigate to account settings, then under security settings there's a field for "rackspace api key" with a show/hide and reset button next to it17:32
clarkbthen if launcher and builder are happy with that we should switch all of rax17:32
clarkbthen seprately do the same for our regular account and test a launch node. And then finally switch on MFA for both accounts17:32
clarkboh we'll need to install the lib into the nodepool images17:32
clarkbthats the first step probably17:32
fungiagreed, that sounds like the smoothest path17:32
clarkbok I can push a change to nodepool to add the lib. Maybe you can work on the system-config side to update nodepool's clouds.yaml17:33
fungialso, while i did test the api_key auth, i didn't do more than make sure openstack server list is returning my server details17:33
clarkbI think we add a new rax cloud to clouds.yaml with a different name and have that use the api_key17:34
fungiand yeah, steps for system-config update will involve first putting the relevant api keys into our private hostvars, then setting up the relevant templating17:34
clarkbthen we can switch nodepool providers over one by one as we confirm things work17:35
clarkbfungi: ++17:35
fungioh, yeah i suppose we could do separate cloud entries with different names17:35
fungirather than cutting over the existing name17:35
clarkbyes I think that is what I would do otherwise it will cut over all of rax at the same time whcih I'd prefer we not do17:35
* clarkb reboots to pick up local updates and then will get a change pushed to nodepool to add the library17:36
fungii'm using topic:rackspace-mfa on reviews for this17:37
fungiin case anyone wants to coordinate17:37
clarkb++17:37
clarkbI've not been able to find the upstream source code for rackspaceauth but its sdist shows an Apache 2 license file so we should be fine from that perspective17:46
clarkbits dep list should also be fine (keystoneauth1 which it is a plugin for, requests and urllib3)17:48
clarkbhopefully its use of requests is forward compatible. fungi any chance you are using a modern requests with it in the env that did the server listing?17:48
fungirequests 2.31.017:49
fungiso latest version (2023-05-22)17:49
clarkbhttps://review.opendev.org/c/zuul/nodepool/+/91116317:53
opendevreviewJeremy Stanley proposed opendev/system-config master: Transition to Rackspace API keys  https://review.opendev.org/c/opendev/system-config/+/91116418:00
clarkbfungi: left a note on ^18:10
fungiclarkb: just launch/pyproject.toml or is there an additional env i need to add it into?18:12
clarkbfungi: that one and the one we install ansible to. I think we have an install ansible role18:13
clarkbfungi: ebcause that file I commented on is input to an ansible role that ensures cloud state18:13
clarkbI think personally I would avoid having us try to assert that state until we worth through other places to see if this works at all18:13
fungisure, i can split that file out to a separate wip child change18:14
corvusin other news, the zuul restart is still proceeding; almost done with executors.  the graph is pretty neat: you can see each of the executors sequentially falling back into line as they are taken offline and restarted with the new code.18:24
clarkbcorvus: it definitely takes longer during the week than over a weekend18:24
clarkbshould go quickly once the executors are done though18:24
corvusyup!18:24
fungilooks like playbooks/roles/install-ansible/tasks/main.yaml18:28
opendevreviewJeremy Stanley proposed opendev/system-config master: Transition to Rackspace API keys  https://review.opendev.org/c/opendev/system-config/+/91116418:30
opendevreviewJeremy Stanley proposed opendev/system-config master: Switch cloud setup to new Rackspace entries  https://review.opendev.org/c/opendev/system-config/+/91122918:30
opendevreviewJeremy Stanley proposed opendev/git-review master: Don't keep incomplete rebase state by default  https://review.opendev.org/c/opendev/git-review/+/85006119:24
opendevreviewJeremy Stanley proposed opendev/system-config master: Transition to Rackspace API keys  https://review.opendev.org/c/opendev/system-config/+/91116419:31
opendevreviewJeremy Stanley proposed opendev/system-config master: Switch cloud setup to new Rackspace entries  https://review.opendev.org/c/opendev/system-config/+/91122919:31
fricklertonyb: do you know more about that openeuler session? are they part of openinfra now?19:52
clarkbthey are part of the openatom foundation19:53
fungiopeneuler is also an associate member organization of openinfra foundation: https://openinfra.dev/members/19:58
frickleryeah, that still doesn't explain to me what the expected topic or scope of that session will be20:07
fricklerI also never heard of an openstack team named VDI20:07
clarkbI think the VDI thing is related to virtual desktop stuff there has been some discussion on the mailing list20:08
clarkbnot erally an openstack team but a common use case people are trying to figure out how to enable20:08
fungiyes, the person who registered "vdi" as a team is the one who was recently asking for help on the openstack-discuss ml getting a vdi deployment working20:09
fungimaybe they'll succeed in drawing in other people interested in vdi-related topics20:09
fricklerso anyone can propose a team and that will end up in the PTG?20:10
fungiyep, pretty much20:10
fungithink of it like a classic unconference, people pitch ideas for bof-style rooms and then see who comes20:10
fungitechnically, the opendev collaboratory isn't an official openinfra project, nor a subteam of one20:11
fricklerI'm just a bit worried by the way it is listed on https://openinfra.dev/ptg/ , which could be read as confirming this as "official" OpenStack team20:13
fungiah, yeah, those categories are curated by a human who probably just didn't know where to file it exactly20:15
clarkbit says "allows OpenInfra community groups (and adjacent open source community project teams) working on open source projects to meet virtually" at the top at least20:15
fricklerit says "The April 2024 Project Teams List is Official" and then lists VDI under "Other OpenStack teams". it is not obvious that this is only within the context of the PTG20:18
frickleranyway, is anyone of you planning to be in Berlin? I won't be at the summit but might be able to arrange for some offsite meeting20:19
clarkbI don't think I'll be there20:19
fungii've got a vacation at the same time, but it was scheduled long before dates were known for the events20:20
fungi(a vacation to somewhere that isn't berlin, to be clear)20:20
fricklerI wouldn't expect anyone to do a vacation in berlin, though it seems quite a lot of people actually do20:21
JayFfrickler: I'll be in UK/France/Switzerland the last week of May/first week of June (culminating in the openinfra days + BM SIG at CERN)20:34
JayFfrickler: Happy to meet up if that's convenient to you20:34
fricklerJayF: that doesn't sound like you'd be anywhere near berlin and I don't plan to do any actual travelling20:52
fungisounded from the board meeting like mnaser may have been planning to be in berlin?20:53
JayFfrickler: ah, was hoping that perhaps you were going to the CERN events; I don't have a good sense of what is close to what in EU20:54
clarkbJayF: I thnk our sense of close is different than a european's perspective too :)20:55
clarkbI'm like SF is close i can drive there in a day20:55
fungii feel like i'm close to vancouver because i don't have to cross an ocean to get to it20:55
JayFEven by a US-ian perspective, Portland<>SF is not that close :D 20:55
JayFI feel like I'm close to Vancouver because it's 3 hours by car :-)20:56
clarkbthat said if I start driving east its amazing how little is out there. only made it as far as craters of the moon and round drop was still about 3k miles20:56
fungivancouver washington or bc? ;)20:56
clarkbcould've driven all the way to nyc instead20:56
clarkb/drop/trip/20:56
JayFfungi: even if you count "stopped at a 7/11 for a soda", I suspect I've been to V, BC about 2x as much as V, WA20:57
fungihah20:57
clarkbbc is more interesting but wa is older20:58
JayFVancouver is a bedroom community for Portland, and Portland is a grocery store community for Vancouver :P 20:59
clarkbalso driving north/south along timezone barriers is weird. I've never been so happy to haev a dumb clock in the car21:02
clarkbyou'll go over a hill/ridge and phone will reset to the other timezone21:03
clarkband it happens randomly and gets really confusing21:03
fungii can't stand that, just keep my phone's clock nailed to utc21:07
clarkbfungi: looks like the git review rebase abort tests fail because failed command execution raises by default?21:08
clarkbprobably need to tell it to not raise by default and then check the output21:08
fungiyeah, i'll rewrite those in a sdec21:08
fungiin a sec21:08
clarkbya the existingtest does an assert raises actually21:08
clarkbso you can do that too and then check the output ?21:08
fungii couldn't find where to tell it not to raise, but i can catch the exceptions instead21:09
fungiright, the existing test already does it once21:09
fungiclarkb: oh, i remember why i didn't try that first... assertRaises takes the function as a parameter, so i guess i'll need a lambda or local def to be able to pass parameters to the function being executed? oh, or maybe it has a kwargs that defaults to empty21:18
fungiaka, yep, it expands kwargs. easy enough21:19
JayFfungi: with assertRaises(x): constructs exist21:20
JayFfungi: I can find you an example somewhere if you want21:21
JayFI prefer that syntax SO MUCH to the "proxy the args" pattern21:21
opendevreviewJeremy Stanley proposed opendev/git-review master: Don't keep incomplete rebase state by default  https://review.opendev.org/c/opendev/git-review/+/85006121:35
fungiJayF: i think i found it, but feel free to take a look ^21:36
fungiJayF: oh, i see what you're saying now21:37
fungibut yeah, in this case it's just a function and a couple of args, so brevity wins21:38
JayFoooooh that's a GOOD change21:39
fungithe tests are already wrappers on top of wrappers for running git and whatnot in a shell anyway21:40
opendevreviewJeremy Stanley proposed opendev/git-review master: Don't keep incomplete rebase state by default  https://review.opendev.org/c/opendev/git-review/+/85006121:59
tbachman_I have a question about upstream gate jobs. Some of our stable branches have been failing due to conflicting requirements. I believe the conflict is caused by our project using the wrong branch for upstream constraints. I also realized that I'd missed the change from some of the stable branch to unmainted status, and was wondering if the upstream gates are relying on projects to follow the same convention in order to pick up the c22:05
tbachman_(e.g. our group-based-policy stable/yoga branch needs to be renamed unmaintained/yoga in order to pick up the correct constraints)22:05
fungitbachman_: yes, if your jobs use configuration or code from other projects, you need either explicitly override branch names for them or make them match. zuul will assume similarly-named branches and fall back to master if there is no matching branch name22:08
fungithis includes jobs which checkout the openstack/requirements project in order to access some branch of its upper-constraints.txt file22:09
tbachman_okay - I guess that last part is what we need to figure out22:10
tbachman_Let me poke around to get a better understanding of how that happens in the gate22:11
fungitbachman_: have an example build result?22:12
tbachman_Heh - I'm a bit embarrassed to show what's behind the curtain22:12
tbachman_we've been pushing this along with minimal maintenance, so it's probably worlds apart from how it should be done22:13
tbachman_https://review.opendev.org/c/x/group-based-policy/+/910902/10/test-requirements.txt22:13
tbachman_If you look for "ERROR" in this one, you'll see the conflict:22:13
tbachman_https://1fb95dd4def8c6637cda-5a27a6928b067674230014cedabdbd21.ssl.cf2.rackcdn.com/910902/10/check/openstack-tox-pep8/75ce450/job-output.txt22:13
tbachman_It's picking up master for sure:22:14
tbachman_https://opendev.org/openstack/requirements/src/branch/master/upper-constraints.txt#L59822:14
tbachman_I need to spend some time getting a better understanding of how stuff in tox.ini relates to the upstream gate jobs, so that I can see what needs to be done to make this work within the existing gates22:15
opendevreviewJeremy Stanley proposed openstack/project-config master: Try switching Rackspace DFW to an API key  https://review.opendev.org/c/openstack/project-config/+/91138122:19
fungiclarkb: ^ is that change what you had in mind?22:19
fungitbachman_: okay, so probably worth first understanding, upstream openstack projects have replaced their stable/yoga branches with branches named unmaintained/yoga to signal that they're no longer officially maintained by their respective project teams, following this new process: https://governance.openstack.org/tc/resolutions/20230724-unmaintained-branches.html22:23
tbachman_fungi: yeah - was just reading up on that. 22:24
tbachman_Was wondering if we replaced our stable/yoga with unmaintained/yoga, if that will help pick pu the right constraints22:25
tbachman_But my name won't let me believe that's true ;)22:26
fungitbachman_: well, also it looks like you do have some explicit checkout overrides in your job configuration already22:27
tbachman_fungi: ack. But it looks like it's still picking upper constraints from master. 22:27
fungilike https://opendev.org/x/group-based-policy/src/branch/stable/yoga/.zuul.yaml#L1822:27
tbachman_ah, of course22:28
tbachman_thanks fungi !22:28
tbachman_let me give that a shot22:28
fungithat may only be the first piece of the puzzle, but it's somewhere to start22:28
tbachman_yeah 22:29
tbachman_Certainly worth starting there22:29
tbachman_fungi: thanks for your help!22:29
tbachman_Always appreciate the folks on this channel! 22:29
fungifeel free to come back if you're still stuck and we can look deeper22:29
tbachman_k22:29
tbachman_Sometimes it's good to let folks struggle22:29
tbachman_that's where the real learning can happen ;)22:29
tbachman_but thanks again!22:30
fungiany time!22:30
fungiin pbr-related news... https://github.com/tox-dev/tox/pull/323322:55
fungilooks like you have to add fresh_subprocess=true to your tox.ini to get it though22:57
opendevreviewJeremy Stanley proposed opendev/git-review master: Don't keep incomplete rebase state by default  https://review.opendev.org/c/opendev/git-review/+/85006123:00
clarkbfungi: I left some notes on the project-config change for the api key update23:23
fungithanks!23:24
corvusthe zuul restart is complete, and job distribution appears nominal23:24
fungiawesome23:24
clarkbfungi: I wonder if some "important" project ended up needing the tox subprocess install thing23:32
fungiyeah, it seemed suspiciously spontaneous and out of left field to me as well23:33

Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!