Wednesday, 2021-01-20

*** tosky has quit IRC00:02
*** ociuhandu has quit IRC00:03
*** iurygregory has quit IRC00:06
*** jamesmcarthur has quit IRC00:17
*** harlowja has quit IRC00:17
*** jamesmcarthur has joined #openstack-infra00:18
*** rcernin_ has joined #openstack-infra00:19
*** jamesmcarthur has quit IRC00:20
*** rcernin has quit IRC00:20
*** jamesmcarthur has joined #openstack-infra00:21
*** CrayZee has quit IRC00:35
*** snapiri has joined #openstack-infra00:35
*** Adri2000 has quit IRC00:43
*** iurygregory has joined #openstack-infra00:43
*** jamesmcarthur has quit IRC00:44
*** Adri2000 has joined #openstack-infra00:44
*** jamesmcarthur has joined #openstack-infra00:45
*** rlandy has quit IRC00:48
*** jamesmcarthur has quit IRC00:48
*** jamesmcarthur has joined #openstack-infra00:49
*** jamesden_ has joined #openstack-infra01:01
*** abhishekk has quit IRC01:02
*** stevebaker has quit IRC01:03
*** jamesdenton has quit IRC01:03
*** abhishekk has joined #openstack-infra01:04
*** hamalq has quit IRC01:26
*** jamesmcarthur has quit IRC01:34
*** jamesmcarthur has joined #openstack-infra01:35
*** jamesmcarthur has quit IRC01:40
*** armax has quit IRC01:47
*** dychen has joined #openstack-infra02:06
*** jamesmcarthur has joined #openstack-infra02:06
*** dychen has quit IRC02:11
*** dychen has joined #openstack-infra02:11
*** dchen has quit IRC02:12
*** jamesmcarthur has quit IRC02:14
*** jamesmcarthur has joined #openstack-infra02:15
*** stevebaker has joined #openstack-infra02:37
*** ajitha has joined #openstack-infra02:38
*** ricolin has joined #openstack-infra02:45
*** jamesmcarthur has quit IRC02:47
*** jamesmcarthur has joined #openstack-infra02:49
*** jamesmcarthur has quit IRC02:50
*** jamesmcarthur has joined #openstack-infra02:50
*** dklyle has quit IRC02:52
*** david-lyle has joined #openstack-infra02:52
*** david-lyle has quit IRC03:01
*** zzzeek has quit IRC03:04
*** zzzeek has joined #openstack-infra03:05
*** rcernin_ has quit IRC03:23
*** rcernin_ has joined #openstack-infra04:01
*** psachin has joined #openstack-infra04:11
*** ykarel|away has joined #openstack-infra05:03
*** rakhmerov has joined #openstack-infra05:17
*** iurygregory has quit IRC05:33
*** ricolin_ has joined #openstack-infra05:47
*** ricolin has quit IRC05:47
*** jamesmcarthur has quit IRC05:50
*** jamesmcarthur has joined #openstack-infra05:52
*** vishalmanchanda has joined #openstack-infra05:52
*** jamesmcarthur has quit IRC05:57
*** dingyichen has joined #openstack-infra05:58
*** gyee has quit IRC05:59
*** dychen has quit IRC06:00
*** jamesmcarthur has joined #openstack-infra06:00
*** zbr5 has joined #openstack-infra06:04
*** zbr has quit IRC06:06
*** zbr5 is now known as zbr06:06
*** dingyichen has quit IRC06:09
*** dychen has joined #openstack-infra06:09
*** matt_kosut has joined #openstack-infra06:13
*** ykarel_ has joined #openstack-infra06:17
*** ykarel|away has quit IRC06:19
*** ykarel_ is now known as ykarel06:26
*** jamesmcarthur has quit IRC06:37
*** nightmare_unreal has joined #openstack-infra06:45
*** slaweq has joined #openstack-infra07:04
*** rcernin_ has quit IRC07:28
*** slaweq has quit IRC07:30
*** openstackgerrit has joined #openstack-infra07:30
openstackgerritRico Lin proposed openstack/project-config master: Add ubuntu-bionic-arm64-xlarge  https://review.opendev.org/c/openstack/project-config/+/77156507:30
*** eolivare has joined #openstack-infra07:31
*** rcernin_ has joined #openstack-infra07:32
*** xek has joined #openstack-infra07:35
*** jcapitao has joined #openstack-infra07:51
*** dychen has quit IRC07:59
*** slaweq has joined #openstack-infra08:00
*** hashar has joined #openstack-infra08:03
*** dchen has joined #openstack-infra08:03
*** dchen has quit IRC08:05
*** amoralej|off is now known as amoralej08:06
*** andrewbonney has joined #openstack-infra08:09
*** sboyron_ has joined #openstack-infra08:12
*** rpittau|afk is now known as rpittau08:17
*** rcernin_ has quit IRC08:35
*** jamesmcarthur has joined #openstack-infra08:37
*** sboyron__ has joined #openstack-infra08:38
*** abhishekk has quit IRC08:40
*** sboyron_ has quit IRC08:41
*** psachin has quit IRC08:41
*** stevebaker has quit IRC08:41
*** abhishekk has joined #openstack-infra08:41
*** jamesmcarthur has quit IRC08:42
*** akahat|rover is now known as akahat|lunch08:46
*** tosky has joined #openstack-infra08:47
*** jpena|off is now known as jpena08:54
*** yamamoto has quit IRC08:56
*** lucasagomes has joined #openstack-infra09:12
*** DinaBelova has quit IRC09:17
*** freerunner has quit IRC09:17
*** ramishra has quit IRC09:17
*** ramishra has joined #openstack-infra09:18
*** tristanC has quit IRC09:18
*** freerunner has joined #openstack-infra09:19
*** DinaBelova has joined #openstack-infra09:19
*** tristanC has joined #openstack-infra09:20
*** yamamoto has joined #openstack-infra09:21
*** yamamoto has quit IRC09:23
*** yamamoto has joined #openstack-infra09:30
*** yamamoto has quit IRC09:37
*** yamamoto has joined #openstack-infra09:45
*** ysandeep is now known as ysandeep|afk09:45
*** yamamoto has quit IRC09:45
*** yamamoto has joined #openstack-infra09:47
*** derekh has joined #openstack-infra09:49
*** yamamoto has quit IRC09:50
hberaudo/ Can someone say me how to create a launchpad bug tracker page for a new project (etcd3gw)? I didn't find useful info https://docs.openstack.org/project-team-guide/bugs.html09:58
hberaudI guess this should be hosted by openstack/project-config or openstack/governance but I'm not sure09:59
*** yamamoto has joined #openstack-infra10:03
*** gfidente|afk is now known as gfidente10:03
*** ociuhandu has joined #openstack-infra10:07
fricklerhberaud: IIUC you'd just create that page manually with the launchpad UI and then give the openstack user account the needed access rights10:07
fricklerhttps://launchpad.net/projects/+new10:08
*** akahat|lunch is now known as akahat|rover10:09
hberaudAlso, can someone reenque this job? https://zuul.opendev.org/t/openstack/build/aba1acc623e74cf08e82ffc4d73134aa/log/job-output.txt it failed previously and the monasca team ask to reenqueue the failing job http://lists.openstack.org/pipermail/openstack-discuss/2021-January/019891.html10:09
hberaudfrickler: thanks I'll take a look10:09
*** ociuhandu has quit IRC10:12
hberaudah I missed that the bugtracker page already existed https://launchpad.net/python-etcd3gw so nothing new to create, frickler thank you anyway10:13
fricklerhberaud: regarding monasco, it isn't obvious to me why the job wouldn't fail again with the issue you mention in your mail. I'll leave that to some other infra-root to look at10:13
hberaudfrickler: ack10:14
hberaudapparently the team fixed the issue http://lists.openstack.org/pipermail/openstack-discuss/2021-January/019928.html10:14
hberaudbut I'm not a zuul expert too10:15
*** ysandeep|afk is now known as ysandeep10:17
fricklerhberaud: hmm, then it still might make more sense to just push a new tag. I don't see any 2.x releases on https://hub.docker.com/r/monasca/tempest-tests/tags anyhow, so it shouldn't matter much10:19
*** rpittau is now known as rpittau|bbl10:20
*** yamamoto has quit IRC10:20
hberaudfrickler: Do you mind replying directly to the ML thread? It will allow to the Monasca team to reply directly10:21
hberaudI asked them to join this IRC channel, but for now they aren't not there10:22
hberauds/aren't not there/aren't there10:23
fricklerhberaud: yes, I do mind, but I'll also wait for some other root to take a look at this anyway10:24
hberaudfrickler: ok10:25
*** ociuhandu has joined #openstack-infra10:26
*** priteau has joined #openstack-infra10:31
*** rcernin_ has joined #openstack-infra10:34
*** rcernin_ has quit IRC10:41
*** sshnaidm|afk is now known as sshnaidm|ruck10:43
*** dtantsur|afk is now known as dtantsur10:44
*** hashar has quit IRC10:50
*** ociuhandu has quit IRC10:54
*** ociuhandu_ has joined #openstack-infra10:54
*** ociuhandu_ has quit IRC10:54
*** ociuhandu has joined #openstack-infra10:54
*** yamamoto has joined #openstack-infra10:59
*** chaconpiza has joined #openstack-infra11:05
*** yamamoto has quit IRC11:07
*** ociuhandu has quit IRC11:14
*** ociuhandu_ has joined #openstack-infra11:14
*** jcapitao is now known as jcapitao_lunch11:24
*** rpittau|bbl is now known as rpittau11:24
*** iurygregory has joined #openstack-infra11:27
*** sboyron__ has quit IRC11:30
*** ociuhandu_ has quit IRC11:42
*** yamamoto has joined #openstack-infra11:42
*** rcernin_ has joined #openstack-infra11:42
*** yamamoto has quit IRC11:45
*** zzzeek has quit IRC12:18
*** rlandy has joined #openstack-infra12:20
*** yamamoto has joined #openstack-infra12:20
*** zzzeek has joined #openstack-infra12:21
*** jpena is now known as jpena|lunch12:29
*** yamamoto has quit IRC12:31
*** ociuhandu has joined #openstack-infra12:42
*** ociuhandu has quit IRC12:44
*** sboyron has joined #openstack-infra12:45
*** ociuhandu has joined #openstack-infra12:45
*** ociuhandu has quit IRC12:54
*** ociuhandu has joined #openstack-infra12:56
*** rcernin_ has quit IRC12:58
*** ociuhandu has quit IRC13:00
*** jcapitao_lunch is now known as jcapitao13:02
*** rcernin_ has joined #openstack-infra13:08
*** amoralej is now known as amoralej|lunch13:09
*** ociuhandu has joined #openstack-infra13:19
*** ysandeep is now known as ysandeep|afk13:24
*** ociuhandu has quit IRC13:26
*** jpena|lunch is now known as jpena13:28
*** ociuhandu has joined #openstack-infra13:38
*** ociuhandu has quit IRC13:45
*** ociuhandu has joined #openstack-infra13:47
*** sboyron has quit IRC13:48
*** ociuhandu has quit IRC13:51
*** sboyron has joined #openstack-infra13:51
*** derekh has quit IRC13:51
*** ociuhandu has joined #openstack-infra13:54
*** amoralej|lunch is now known as amoralej13:56
*** rcernin_ has quit IRC14:13
*** vishalmanchanda has quit IRC14:15
*** derekh has joined #openstack-infra14:17
*** Nisha_Agarwal has joined #openstack-infra14:25
Nisha_Agarwalianw, hi14:25
*** irclogbot_0 has quit IRC14:27
Nisha_Agarwalianw, we were testing glean with ironic using CentOS8 image. but after glean apply the network data in network scripts, the networkmanager is not restarted14:29
*** irclogbot_3 has joined #openstack-infra14:31
Nisha_Agarwalianw, and thats the reason the deploy fails as the interface doesnt gets the IP address provided as an input14:31
*** gfidente has quit IRC14:31
fungiNisha_Agarwal: we pretty much only know that glean works reliably on our specific cloud images with the odd combinations of provider metadata choices and the network management frameworks we've picked (or distros have picked for us). if you find a combination which doesn't work, don't be surprised but please feel free to provide a patch to fix it14:35
Nisha_Agarwalfungi, i couldnt find how to patch glean...but manually when i just did "systemctl restart NetworkManager", the ip address got assigned14:36
Nisha_Agarwaland deploy passed14:36
Nisha_Agarwalfungi, specific cloud images mean what?14:37
fungiNisha_Agarwal: the cloud images we build with diskimage-builder for nodepool to boot as our continuous integration test nodes in opendev14:38
fungias for patches, you'd push them to gerrit for review just like any other openstack project14:39
Nisha_Agarwalfungi, the image is built using diskimage-builder14:39
fungithe repository is https://opendev.org/opendev/glean14:39
*** rcernin_ has joined #openstack-infra14:40
Nisha_Agarwalfungi, i know the repo :)14:40
fungioh, got it, seemed like you were asking how to submit a patch14:41
*** rcernin_ has quit IRC14:45
*** vishalmanchanda has joined #openstack-infra14:52
*** rcernin_ has joined #openstack-infra14:58
*** ricolin_ has quit IRC15:00
*** rcernin_ has quit IRC15:03
*** hashar has joined #openstack-infra15:04
*** rcernin_ has joined #openstack-infra15:07
*** rcernin_ has quit IRC15:12
*** d34dh0r53 has quit IRC15:12
*** d34dh0r53 has joined #openstack-infra15:19
*** slaweq has quit IRC15:21
*** slaweq has joined #openstack-infra15:23
*** dklyle has joined #openstack-infra15:31
*** ysandeep|afk is now known as ysandeep15:31
*** Nisha_Agarwal has quit IRC15:39
*** armax has joined #openstack-infra15:41
*** sboyron has quit IRC15:45
*** gfidente has joined #openstack-infra15:49
*** sboyron has joined #openstack-infra16:02
*** ykarel has quit IRC16:21
*** ricolin_ has joined #openstack-infra16:22
*** ociuhandu has quit IRC16:25
*** yamamoto has joined #openstack-infra16:30
*** yamamoto has quit IRC16:35
*** ociuhandu has joined #openstack-infra16:36
*** lamt has joined #openstack-infra16:42
*** gyee has joined #openstack-infra16:50
*** DannyMassa has joined #openstack-infra16:52
DannyMassaHello. I recently lost access to my account and there doesn't seem to be a way to recover it. I added a new email on review.opendev.org, made it the preferred email, and removed the old email. I added the new email to Ubuntu One, but logging in sends me to a new account. Is there any way to 'reconnect' my review.opendev.org account with my Ubuntu16:55
DannyMassaOne account?16:55
clarkbthat implies a new openid was created for you on the openid provider side when you made your changes there16:56
clarkbwith the old sql setup we had a process for collapsing those together. There is probably a way to do that in notedb but I don't know what that process is16:57
*** lucasagomes has quit IRC16:57
clarkbthe apis appear t oallow us to get and delete external ids but not set them?16:58
DannyMassaThat's what I have read so far16:58
clarkbfungi: I think you looked at similar stuff when someone had an email address collision? do you know if you found any useful info around this?16:59
clarkbIdeally we'd avoid direct git repo manipulation since the notedb stuff is hashed in a number of complicated ways and gerrit does internal consistency checking (so I worry we'll get things half updated then it won't work at all)17:00
fungii believe i saw that you can now add a new openid to your account in the version of gerrit we're using17:01
fungihowever that doesn't help if you don't have access to the account any longer17:01
clarkbfungi: I think DannyMassa is saying they don't have access to the gerrit account becaues when they login they get a new account17:02
fungias for e-mail address collisions, i think what i found was that now gerrit won't allow two accounts to have the same e-mail address associated with them even if one of them is set to inactive17:02
clarkbI only see get and delete. This might be worth an email to the gerrit ml17:03
*** nightmare_unreal has quit IRC17:03
clarkbto see if they've got any suggestions better than manually manipulate the git repo directly17:03
*** amoralej is now known as amoralej|off17:03
*** jcapitao has quit IRC17:03
clarkbDannyMassa: can you confirm you still have the same ubuntuone account? ordid that change too?17:04
clarkb(just to help us understand the way this happened)17:04
DannyMassaI (wrongly) assumed updating the email on both services would have me keep the same account. give me one sec I'll give you the rest of the details17:05
*** rcernin_ has joined #openstack-infra17:08
*** jamesmcarthur has joined #openstack-infra17:10
DannyMassaI added a new email to Gerrit, made it the preferred, removed the old email. For Ubuntu, I added the new email and made it the preferred. I cannot log in at all with Ubuntu using the new email, having to roll back to the old email. When signing on with the old email, I am given a new Gerrit account.17:11
clarkbthanks that helps. I think that implies we're likely experiencing the email conflict too17:12
*** rcernin_ has quit IRC17:12
clarkb"I cannot log in at all with Ubuntu using the new email, having to roll back to the old email." <- that is likely due to the email conflict17:13
DannyMassaThe new empty account has my Ubuntu Identity and Old email. So presumably my regular account has no Ubuntu Identification, just the new email17:13
clarkbDannyMassa: they should both have your ubuntu openid, I think the problem is that you've got two of them17:14
DannyMassaoh OK17:14
clarkbthat second new one is why you end up with a new gerrit account when logging in there17:14
DannyMassaNow I understand how the issues tie together17:14
DannyMassaIs there a next step I can take?17:18
clarkbDannyMassa: on your login.ubuntu.com side does it show you multiple openids? When this was all in launchpad it used to be that you could view your user page source to see them. Not sure how ubuntu one does it (and I'm in a meeting so not a great spot to check my own)17:18
clarkbDannyMassa: I think we'll need to engage upstream gerrit and see what they say. I think there are two related issues here that upstream gerrit should make simpler17:20
clarkbbut I'm wary of hacking the external ids directly myself for fear of making it worse (through internal inconsistencies that the server dislikes)17:20
DannyMassaI don't see anything about OpenIDs on my account page. Just name, user-name, email addresses, password17:21
DannyMassaI just have the one username if that's what you're talking about.17:21
clarkbno, its a url that identifies your ubuntu one account with external services17:22
clarkbthe problem historically is that in some situations ubuntu one will give you multiple of them17:22
*** dtantsur is now known as dtantsur|afk17:23
DannyMassaI only see OpenID from the Gerrit side, I can't find anything on the Ubuntu side.17:25
clarkbok17:25
*** rpittau is now known as rpittau|afk17:26
clarkbgive me a bit to finish up meetings and I'll take a look at my side and then see what we can find from gerrit to dig in more17:26
clarkbI think we need to build a complete picture of what is going on and then figure out what our steps from there are17:26
DannyMassaThank you so much for looking into this.17:26
*** ysandeep is now known as ysandeep|away17:26
DannyMassawell I'll be here when you're free17:26
fungii'll try to catch up on the problem description once i'm out of my current meeting17:26
*** ociuhandu_ has joined #openstack-infra17:38
*** ociuhandu has quit IRC17:42
*** ociuhandu_ has quit IRC17:42
zbrfungi: easy https://review.opendev.org/c/opendev/gerritbot/+/76410417:50
zbrbtw, i see that default permissions do not allow us to edit hastags, but allow us to change topics. it should be both.17:51
zbrdo we have any reasons for not allowing users to hashtags? if not, i can look into making a CR to address this.17:52
*** sreejithp has joined #openstack-infra17:55
*** DannyMassa has quit IRC17:58
*** ralonsoh has quit IRC17:58
*** derekh has quit IRC18:01
*** DannyMassa has joined #openstack-infra18:03
fungiit sounds fine, we can discuss in a bit. my meeting is running long18:05
*** ricolin_ has quit IRC18:15
*** cloudnull has quit IRC18:19
*** cloudnull has joined #openstack-infra18:20
*** eolivare has quit IRC18:21
zbrfungi: sure. ok to abandon https://review.opendev.org/c/opendev/git-review/+/681906 -- it personally do not like the idea  of spaces and i doubt you have time to make it work.18:25
*** cloudnull5 has joined #openstack-infra18:26
*** cloudnull has quit IRC18:27
*** cloudnull5 is now known as cloudnull18:27
*** jpena is now known as jpena|off18:32
clarkbfungi: DannyMassa gave me identity details via pm which I can share if you are going to look too18:36
*** gfidente is now known as gfidente|afk18:36
sreejithphello, newly added opendev to github mirroring job is failing with error "Load key "/tmp/ansible._wq583d2": invalid format".18:36
sreejithpi can use the ssh key to authenticate with github successfully18:36
clarkbsreejithp: could it be a problem with the secret encoding in zuul?18:36
clarkbdouble check no newlines were added maybe? (though I think those are fine at the end of key files)18:37
sreejithpi encoded with this command "zuul/tools/encrypt_secret.py --infile keys/airshipbot --tenant openstack https://zuul.openstack.org airship/vino --strip STRIP --outfile newsecret.yaml"18:37
clarkbfungi: I'm going to promote my user account to make api interaction more straightforward18:37
sreejithpclarkb: i see newline only at the end18:38
*** vishalmanchanda has quit IRC18:40
clarkbsreejithp: it definitelyseems like the issue is using the key at all on the client side based on that error message18:40
clarkbwhich is why I suspect somethign with the encoding of the key18:40
clarkbI wonder is base64 assumed maybe?18:40
sreejithpis there a way to validate the keys?18:41
clarkbI'm not sure since it is asymetric18:42
*** sboyron has quit IRC18:44
fungisorry, scarfing down some lunch real quick but catching up on the extra openid problem now18:48
fungiclarkb: DannyMassa: so what's probably going to be the solution here is that we query the openid string from the new account, then remove it and set that account inactive; once that's done add that openid string as an external id for the old account18:53
clarkbfungi: yup its the last step that has me worried since I don't see an api method for it18:54
clarkbbut working on concrete details now via read apis18:54
clarkbfungi: DannyMassa this is very curious though, the old account doesn't appear to have an openid external id at all18:56
clarkbthe new one does18:56
clarkbI think that disproves the idea that ubuntu one is the problem by creating two openids?18:56
clarkband that does make me wonder if gerrit saw a new preffered id from the provider and dieced to migrat DannyMassa to a new account18:57
clarkbalso none of the email addresses seem to overlap if I list emails and external.ids18:57
clarkbso don't think we've collided tehre either18:58
fungiweird18:58
*** DannyMassa has quit IRC18:59
clarkbif you can confirm you see the same thing that would be great just ot make sure I'm not missing something obivous there18:59
fungiyeah, i'm getting to it, be another minute or two19:00
*** hashar is now known as hasharAway19:00
fungineed to switch computers now that i'm done lunching19:00
clarkbboth accounts appear active so gerrit didn't go as far as to disable the old one19:01
fungiokay, i've added my web account to the admin group temporarily19:03
*** DannyMassa has joined #openstack-infra19:04
DannyMassaI'm in a meeting but I'll try to remain responsive here19:04
clarkbI've also cross checked the gerrit error log and that has some interesting clues19:08
clarkbit seems there was a second openid19:08
clarkbso at first it says "I cannot create the new account with new openid because the email address is already in use on the old account"19:08
*** rcernin_ has joined #openstack-infra19:09
*** andrewbonney has quit IRC19:09
clarkbthen it switches to the openid on the new account and says it cannot create the openid there because of the email address conflict19:10
clarkbthen later I suppose the email address conflict was resolved (the two accounts do have distinct email addrs)19:10
clarkband that allowed the new account with the new openid to be created19:10
clarkbits almost like gerrit decided to move the external id from the old account to the new account because the email addr changed?19:11
clarkbI'm assuming the old account had the same openid previously which is maybe not a great assumption19:11
fungiclarkb: yeah, so i confirm that accounts/<id>/external.ids lists an openid for the new account and one e-mail address, for the old account it has no openids and two other e-mail addresses19:11
clarkbya, I'm beginning to suspect this is Gerrit's way of resolving an exceptional situation. Unfortauntely it isn't helping :(19:12
clarkband ya I think the way to fix this since there is no email conflict and no openid conflict is to add the openid(s) to the old account and remove them from the new19:12
clarkbbut I think only the removal step is possible via the api?19:13
clarkbhttps://gerrit-review.googlesource.com/Documentation/config-accounts.html#external-ids I'm reading that next19:13
*** rcernin_ has quit IRC19:14
DannyMassaI still have access to all of the emails and the empty Gerrit account if there is anything that needs to be done on my end19:14
clarkbthat document says that if we push via gerrit it should do a consistency check and reject things if we're out of sync19:15
fungii agree the rest api docs indicate the available options for handling external ids are get and delete, no set/create/update19:15
clarkbhwoever, it doesn't say how it resolves a race between other people updating their external ids and us pushing over that19:15
clarkbsince in theory we could pull the state, make our updates, then push and in that period of time someone could've created a new account and then break?19:16
fungiunlikely, but yeah probably something to keep an eye out for19:16
fungioh! it's in a shared ref? not per-user?19:17
fungithat's... unfortunate19:17
clarkbyes19:17
clarkbI'm beginning to suspect there isn't a truly safe method for doing this19:19
clarkbwe can stop gerrit and push directly but lose all checks19:19
clarkbor we can push to gerrit and race other accounts19:19
fungiprobably something worth raising on the gerrit ml19:19
clarkbya I'll work on a draft for that in an etherpad and describe the scenario and our concerns with brute forcing the fix19:20
fungireading the details on how external ids are indexed in notedb, i suspect what happened is that the openid plugin overwrite the external id reference for that openid (the object identifier would have remained the same since it's a sha1 hash over the openid value alone)19:24
clarkbaha19:25
*** rcernin_ has joined #openstack-infra19:25
clarkbhttps://etherpad.opendev.org/p/N3E3V8APKHlBadW8IOsg fwiw19:25
funginot sure why it would have done that, maybe because the id came in with a new e-mail address which wasn't one of the two associated with the old account?19:25
clarkbyes I think that is it19:27
fungiDannyMassa: to confirm, you have three e-mail addresses in gerrit. you associated all of them with your old gerrit account before logging into ubuntu.com with a new address? just trying to work out the exact steps which might be used to reproduce the problem19:27
clarkbgerrit updated the external id with email address that didn't map to any other accounts so then it created a new account19:27
clarkband that new account now owns the existing openid19:27
fungiDannyMassa: or did you have two of them associated with the old account and then log into ubuntu.com with a third address?19:27
clarkbit is possible, though I don't think we're ready to test it that we can delete the exteranl id for the new account then have DannyMassa log in with ubuntu one updated  back to the dsired value? that would then create a new openid and map it to the existing account?19:28
clarkbhrm no beacuse it will probably do the email check at that point and fail?19:29
clarkbya I don't think that will actually work19:29
*** rcernin_ has quit IRC19:30
fungii've also confirmed there's not, like, a third account which ended up getting created with only the name or something (only two accounts returned by a query for that name)19:33
fungiin theory the old account could still be accessible by http password, it still has a username associated with it19:34
DannyMassasorry this meeting is relentless I'll need to catchup in a second19:34
clarkbfungi: yes and likely ssh too19:35
fungiDannyMassa: no need to apologize, we don't really have anything for you yet, still brainstorming19:36
portdirectDannyMassa: you've got a long way to go before you encounter a relentless meeting ;)19:36
*** jamesmcarthur has quit IRC19:39
DannyMassaportdirect Haha. I'm trying to understand these stories. 'Relentless' in the fact that I can't stop listening or I'll miss something.19:40
fungiclarkb: so one possible explanation for why pushing to refs/meta/external-ids is safe is that each external id is a separate object in git?19:40
fungiDannyMassa: so no zombies at least?19:40
fungior maybe that's why it's important you listen closely19:40
clarkbfungi: they are but since they all live at a single ref and refs are version all their objects I don't think that helps?19:41
clarkbeach ref represents an entire state of the world19:41
fungiahh, yeah so maybe the fact that the ids are individual notes doesn't really help19:42
fungiunless a conflict would appear as a non-fast-forward update19:42
fungiso maybe safe as long as it's not push --force19:42
DannyMassaRE: so no zombies at least?:: not that I know of. All emails are under 1 Ubuntu account so there should only be the two accounts. I'll PM a third email a third email that's on the ubuntu account just to make sure nothing else got created19:43
clarkbya we see three emails in 2 accounts19:43
clarkbas noted in the email draft this feels like a proper gerrit bug, it should've refused to create a new account with the old openid because that would orphan the old account19:47
clarkbI think my draft is largely complete19:48
clarkbfungi: DannyMassa maybe you can look that over and I'll send it out?19:48
clarkbif we can get away with it I think waiting a day or two to hear back from usptream would be nice19:48
DannyMassaWell one of these accounts is usable so I'll survive a couple days.19:49
clarkbwell using the new account might make things more complicated for merging later19:49
clarkbbecause we'd end up orphaning the new account if we fix the new one19:50
DannyMassaThen I will stay away19:50
clarkbI mean, thats not the end of the world for us on the gerrit side of things I don't think19:50
clarkbbut may irritate you :)19:50
DannyMassayeah no worries. I'll figure something out.19:51
clarkbthe simplest thing for us would actualyl be to just accept the old account is orphaned and move forawrd with the new account. But I'm not super happy with that as a user experience19:51
clarkbwe are able to manage email addresses for an account so in theory could remove the conflicting email addresses from the old account and put them on the new account for you19:52
clarkbbut thats still not a great answer :/19:53
DannyMassaIf my permissions are transferred, I don't mind. I don't have a ton of history in need of saving.19:53
clarkbok maybe we keep that in our back pocket depending on what upstream says19:53
*** jamesmcarthur has joined #openstack-infra19:53
clarkbalso sorry for the trouble19:54
DannyMassano worries.19:57
fungiyeah, permissions transfer would be a challenge as far as change owner status on your prior changes, for group membership it's not hard (we can query for groups which include the old account and replace with the new one)19:58
clarkbmade another small update to the etherpad, fungi if you're happy with it I can send it out?19:59
fungibut more for us, we'd like to figure out for sure 1. how this happens, and 2. what the "correct" way out is19:59
fungiclarkb: would it help to mention how we fixed similar external id problems pre-notedb?20:00
clarkbfungi: I briefly hit at that in the etherpad btu I can be mroe explicit. Might help people understand why this is so much more complicated (and consequently annoying)20:00
fungiyour sql finger memory is better than mine20:02
*** jamesmcarthur has quit IRC20:05
clarkbfungi: you think that is ready enough to send out now?20:08
fungiyeah, should be good20:09
openstackgerritKendall Nelson proposed openstack/project-config master: Remove Karbor projects from infra  https://review.opendev.org/c/openstack/project-config/+/76705720:12
*** rcernin_ has joined #openstack-infra20:12
clarkbemail sent and I've removed myself from admin20:16
DannyMassa(y)  Thanks for all the help today. If there is any news and you don't see me here, you have all of my email addresses.20:18
clarkbDannyMassa: ha20:19
clarkbgood point20:19
DannyMassaXD20:19
fungisreejithp: were you able to sort out your account credentials for github mirroring? in your example encrypt_secret command, is keys/airshipbot an ssh private key file? it looks like the problem is ssh failing to read it due to formatting errors... there are some openssh versions which want pkcs#8 rather than pkcs#1/pem formatted keys... i wonder if that could be the problem20:19
clarkbhttps://groups.google.com/g/repo-discuss/c/4mbykY3oS1o if anyone wants to follow along and isn't subscribed I Think updates to the thread will show up there20:20
clarkbfungi: oh I hadn't considered that but ya that could be it because our zuul executors are xenial?20:20
DannyMassaawesome. bookmarked.20:20
fungiclarkb: well, that's the other interesting bit. i thought we ran that on the executors but this seems to be running on an ubuntu-bionic node? https://zuul.opendev.org/t/openstack/build/2fbfecc152684a77938d982dc535692e/console20:21
clarkbcertainly looks like bionic there20:22
*** rcernin_ has quit IRC20:23
fungihere's another airship project doing it, and it's ubuntu-bionic there too: https://zuul.opendev.org/t/openstack/build/13d386428409486ebc4250cb9aad3ad1/console20:25
fungiopenstack's jobs do just use the executor though: https://zuul.opendev.org/t/openstack/build/bd5be45baa9f4bd5aa856695c5e898dc/console20:27
*** jamesmcarthur has joined #openstack-infra20:35
fungiclarkb: also, not to pile on worries, but what happens when we upgrade the underlying operating system for the executors and suddenly the openssh on them no longer wants to read the old key format, i wonder?20:37
fungii suppose we can decorate the jobs with some sort of sanity/version check and extra convert step20:37
fungithough the project keys on the scheduler will need to be mass updated too right?20:38
fungi(the ssh ones i mean)20:38
sreejithpfungi: yes its the ssh private key and it work well will github. i have tested it with this command "ssh -T git@github.com -i keys/airshipbot"20:38
fungisreejithp: that makes me increasingly suspicious that the version of openssh on ubuntu 18.04 (where that job is configured to run) doesn't understand the same private key format. what openssh version are you using?20:39
*** dave-mccowan has joined #openstack-infra20:39
sreejithpssh version is OpenSSH_8.2p120:41
sreejithpi am using ubuntu 20.04 to generate the secret20:41
clarkbfungi: new ssh reads the old format just fine aiui20:41
clarkbfungi: its only the other way around that is a problem20:41
*** jamesmcarthur_ has joined #openstack-infra20:41
*** armax_ has joined #openstack-infra20:41
clarkbI've got notes on how to convert a key, one sec20:41
*** tosky has quit IRC20:41
*** armax has quit IRC20:42
*** armax_ is now known as armax20:42
*** tosky has joined #openstack-infra20:42
clarkb`ssh-keygen -p -m PEM -f ./$FILE -N '' -P ''` note that assumes an empty passphrase20:42
*** jamesmcarthur has quit IRC20:42
*** stevebaker has joined #openstack-infra20:42
clarkbessentially what that command does is say please change the passphrase from empty to empty and a side effectof that is we can control the format versino wtih -m PEM20:42
sreejithplet convert the key and test this20:45
fungiyeah, so the openssh on ubuntu 18.04 is 7.6p120:46
funginow to see when support for pkcs#8 format private keys was added20:46
*** rcernin_ has joined #openstack-infra20:48
fungilooks like rfc 4716 (new) format became the default for private keys in openssh 7.8: https://www.openssh.com/txt/release-7.820:56
fungi"ssh-keygen(1): write OpenSSH format private keys by default instead of using OpenSSL's PEM format. The OpenSSH format, supported in OpenSSH releases since 2014..." so, er, openssh should have already been supporting it since ages20:57
fungii see where paramiko didn't add support until circa 201820:58
*** jamesmcarthur_ has quit IRC21:00
*** jamesmcarthur has joined #openstack-infra21:11
*** DannyMassa has quit IRC21:12
*** jamesmcarthur has quit IRC21:16
*** sean-k-mooney has quit IRC21:16
*** jamesmcarthur has joined #openstack-infra21:17
*** jamesmcarthur has quit IRC21:20
*** jamesmcarthur has joined #openstack-infra21:20
sreejithpclarkb, fungi, thanks converting the key and generating new secret worked. now mirroring is happening21:27
*** jamesmcarthur has quit IRC21:29
*** ajitha has quit IRC21:47
*** rcernin_ has quit IRC21:49
*** rcernin has joined #openstack-infra21:50
*** jamesden_ has quit IRC21:51
*** jamesdenton has joined #openstack-infra21:51
*** matt_kosut has quit IRC21:53
*** matt_kosut has joined #openstack-infra21:54
*** matt_kosut has quit IRC21:58
fungisreejithp: thanks for trying that, we probably need to add something about that to https://docs.opendev.org/opendev/infra-manual/latest/drivers.html#using-secrets22:07
fungior somewhere22:07
clarkbfungi: maybe in the job details/info/docs22:07
clarkbsince that is a bit of a job specific behavior?22:08
fungimebbe22:09
fungithen again, it's also going to depend on the distro it's running from22:09
fungiwill need to noodle on that22:09
fungiif nothing else, it's good to keep in mind that's a potential pitfall22:09
clarkb++22:09
*** xek has quit IRC22:13
*** hasharAway has quit IRC22:14
*** yamamoto has joined #openstack-infra22:19
*** armax has quit IRC22:24
*** hamalq has joined #openstack-infra22:25
*** yamamoto has quit IRC22:30
*** yamamoto has joined #openstack-infra22:30
*** slaweq has quit IRC22:32
*** cloudnull8 has joined #openstack-infra22:44
*** cloudnull has quit IRC22:46
*** cloudnull8 is now known as cloudnull22:46
*** sreejithp has quit IRC23:03
*** lbragstad has quit IRC23:13
*** lbragstad_ has joined #openstack-infra23:13
dansmithfungi: clarkb: do you have a gut feeling for which of ovh or vexx is faster for devstack bootstrap?23:24
clarkbdansmith: vexx23:25
dansmithtoo varied? about the same? one better than the other? no freaking?23:25
dansmithokay I thought so23:25
clarkbvexx is running on new amds now iirc23:25
dansmithso, my patch23:25
clarkbovh has had iops limitations in the past23:25
dansmithwhich doesn't have every tweak in it locally,23:25
dansmithis 23% faster on ovh than the non-parallel one is on vexx23:25
fungii'm too out of the loop on who has what hardware to place a wager23:25
dansmithI have another 5% gain locally I have to push up23:25
clarkbthat sounds very promising23:26
clarkbdansmith: do you have a link to the faster ovh job logs?23:27
dansmithI'm also keeping the output from interleaving, which I think would be one of the primary complaints23:27
dansmithclarkb: https://d44b9fc81fe03a87c0e1-4e84cd8dd84809b3a32cd6523c3fd858.ssl.cf2.rackcdn.com/771505/4/check/devstack/8b7cae0/job-output.txt23:28
dansmithsearching for "async job" in there should get you the highlights23:28
*** dchen has joined #openstack-infra23:29
*** jamesmcarthur has joined #openstack-infra23:29
*** rlandy has quit IRC23:30
clarkbwe should be able to dig up a devstack job that ran on ovh recently too via logstash23:32
clarkbdansmith: double chekcing the job name for those logs is 'devstack' right?23:32
dansmithclarkb: yep, that's the bare "devstack" job23:33
dansmithwhich I think is just running devstack with all the bells on, no tempest23:33
fungiyep, it may also do smoketests23:33
dansmithdoesn't look like it23:34
*** jamesmcarthur has quit IRC23:34
fungioh neat, so a very good test for install/setup speedups in that case23:34
dansmithI have stacked locally more times in the last 72 hours than any one man should23:34
clarkbis 771505 your change?23:34
dansmithI feel like a nodepool worker23:34
dansmithhttps://review.opendev.org/c/openstack/devstack/+/77150523:35
dansmithyup23:35
clarkbok I've found it in logstash, now to find another recent example that doesn't have your improvements23:35
dansmithclarkb: I didn't mean to make work for you...23:35
clarkbdansmith: its ok, I think getting that data will be important for you to show the qa team if it shows a good improvement23:36
clarkb(also I'm waiting for nodepool to finish building an image so I can confirm some leaks on its disk)23:36
dansmithI guess I should collect some base numbers so I can compare new numbers regardless of what worker I land on23:37
clarkbdansmith: build_name:"devstack" AND node_provider:"ovh-bhs1" AND build_node:"ubuntu-focal" AND NOT build_change:"771505" is the logstash query I'm currently fiddling with if you want to take that and improve it23:37
dansmithcool thanks23:38
clarkbhttp://storage.gra.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_61b/765149/3/check/devstack/61b8d61/job-output.txt is an example on bhs1 that did not run against your changeI think23:38
clarkbits runtime was 1263 seconds as self reported by devsatck, your example was 191123:38
clarkbalmost a 6 minute improvement23:39
clarkbif that holds up thats a pretty decent improvment overall23:39
dansmiththat's backwards23:39
dansmith1263 is much faster than vexx at 2400 something23:39
clarkboh interesting I didn't expect vexx to be so slow23:39
clarkbmnaser: may be interested in that too I guess23:40
dansmiththe improvement I see from vexx to ovh with my change matches almost exactly my local findings, so it seemed legit23:40
clarkber wait I can't do math I thought it was 226323:40
dansmith1263 is faster than local bare metal23:40
clarkbso thats a curious result, but also may pointto ovh inconsistencies around io?23:41
dansmithI guess but that's like.. really fast23:41
dansmithmaybe someone turned off a bunch of stuff in localconf for that?23:41
clarkbya it could be change rlated23:41
fungimaybe they rubbed the servers with cheetah blood23:42
dansmithno, that was a cap-pip thing23:42
dansmithno changes to the config23:42
clarkbhttps://e9486e17b99c21dc6e90-b49d25c19e9456c92d7e602d475342ab.ssl.cf2.rackcdn.com/616416/12/check/devstack/3d23609/job-output.txt is a vexxhost example and it self reports 389023:42
dansmithyikes23:42
dansmiththat's over an hour23:43
clarkbI changed ovh-bhs1 to vexxhost-ca-ymq-1 in my example query to find it23:43
fungikeep in mind that test runtimes have a wide variance to begin with. all it takes is a node getting scheduled to a host where some other instance (entirely likely it's also one of ours!) is starving it of resources and the build winds up taking 2x or longer23:44
dansmiththat's the hostname right?23:44
dansmithbecause that's the same vexx I got 2400 from a couple days aog,23:44
dansmithso yeah may be too variable to compare single runs23:44
clarkbdansmith: thats the cloud name + region name23:44
*** tosky has quit IRC23:44
dansmithah okay23:44
fungii would caution against drawing too much conclusion from individual data points, yes23:44
dansmithfungi: yeah I thought they'd be closer than off by 25% just by luck of the draw23:45
dansmithbut I guess not23:45
dansmithit's very consistent locally23:45
fungiyou'll want a representative sample size to really have confidence23:45
dansmith(obviously)23:45
fungiyour local runs are probably not sharing a machine with some tripleo and neutron jobs ;)23:45
dansmithpresumably I could get a little more firmness by running once, unstack, restack, unstack, restack and then compare runs 2 and 323:46
dansmithcould have a new neighbor in the middle, but that's as close a proximity as I can imagine23:46
fungicould be, though i also wouldn't trust that the performance of a single node is constant over time23:46
dansmith"more firmness"23:47
dansmithlike, a stiff jello23:47
clarkbjust don't call it salad23:47
fungiadd some canned fruit, carrot shavings and little marshmallows23:47
fungithat'll firm it right up23:47
dansmithI'm from the south... lots of things are "salad"23:47
fungiwe do call pretty much anything "salad" here, yep23:48
dansmiththere has to be a "will it salad?" podcast..23:48
clarkbeven in the pnw people call things salad that I'm like uh wat23:49
clarkband usually jello is involved23:49
clarkbalso "dressing" is something you cook in a bird and not put on salad23:49
fungiin my part of the south, cooked greens are also colloquially referred to as "salad"23:49
fungioh no, dressing is cooked around a bird. stuffing is cooked inside the bird23:50
dansmithfungi: I think it's like, if it's not something a red-blooded 'merican would order as a main dish, then it's probably a salad23:50
fungimacaroni and cheese? yeah that's a salad23:50
dansmithobvi23:50
fungiand it's also a vegetable if you're at the buffet23:50
clarkblol23:50
dansmithalright, well, clarkb has sufficiently rained on my parade with his "data"23:50
clarkbsorry23:51
dansmithsuffice it to say, it's much faster locally. Hopefully we can get it disabled by default and then running on a couple jobs to see23:51
dansmithman, even with the tripleo stuff removed, neutron has a bunch of >1h jobs and a few >2h ones23:53
dansmithstill rechecking the patch to try to drop those, but it does not lottery well23:53
fungii remember urging people to keep jobs below 45 minutes. and then it was please at least don't run jobs longer than an hour23:54
dansmithfungi: don't you control the job timeout? :)23:54
fungia global one, yes23:55
clarkbif you ever want to institute chaos as a method for developing software: set the global timeout to 30 minutes23:55
fungibut we're hesitant to bring that particular hammer down23:55
dansmithit's been a struggle to get glance people to add tempest tests, so I really don't want it to be easier to write off those jobs23:55
dansmithclarkb: hah23:55
dansmithfungi: for sure, I'm only joking23:55
fungii figured. we mostly use the global timeout as a backstop for for "yeah this job isn't ever gonna finish"23:56
dansmithyup23:56

Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!