14:59:59 <mattmceuen> #startmeeting airship 15:00:01 <openstack> Meeting started Tue Dec 3 14:59:59 2019 UTC and is due to finish in 60 minutes. The chair is mattmceuen. Information about MeetBot at http://wiki.debian.org/MeetBot. 15:00:02 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 15:00:03 <mattmceuen> #topic Rollcall 15:00:04 <openstack> The meeting name has been set to 'airship' 15:00:11 <mattmceuen> Hello everyone - time for our weekly IRC meeting! 15:00:11 <uzumaki> o/ 15:00:13 <souradage> o/ 15:00:15 <howell> o/ 15:00:16 <alexanderhughes> o/ 15:00:20 <mattmceuen> Here's the agenda: https://etherpad.openstack.org/p/airship-meeting-2019-12-03 15:00:21 <ian-pittwood> o/ 15:00:24 <michael-beaver> o/ 15:00:29 <mattmceuen> please add any additional items, we'll wait a couple minutes to get giong 15:00:47 <aaronsheffield> o/ 15:00:55 <seaneagan> o/ 15:02:17 <nishantkr> o/ 15:02:42 <kskels> o/ 15:02:50 <mattmceuen> Thanks for joining everyone 15:02:58 <mattmceuen> #topic Some interfaces between airshipctl and kustomize are not avaialble yet 15:03:13 <mattmceuen> We have several items left from last week which we didn't have time to get to 15:03:26 <mattmceuen> And I'm not certain now who added them to the agenda :) 15:04:06 <mattmceuen> re: interface between airshipctl and kustomize, I know Alan had been working to get a patchset in for that before the holidays, and I'm not sure where that landed 15:04:12 <uzumaki> treasuremap 2.0 thing, I added it, it got answered last week, so, we can skip that 15:04:20 <mattmceuen> ok awesome - thanks uzumaki 15:04:50 <mattmceuen> I think we covered the Treasuremap 2.0 general topic last well - any other discussion you'd like to have on that uzumaki? 15:05:23 <uzumaki> Not yet, so we're good 15:05:51 <mattmceuen> ok cool 15:05:58 <mattmceuen> #topic Image and Userdata parameters are missing in baremetal.yaml in airshipctl under spec Baremetalhost 15:06:53 <mattmceuen> Are those missing fields due to old/incomplete generated code in airshipctl, do you know? Or, are they not in the upstream Metal3 spec yet? 15:07:52 <openstackgerrit> diwakar thyagaraj proposed airship/porthole master: Mysqlclient UC Python and Ubuntu upgrade. https://review.opendev.org/696184 15:08:46 <mattmceuen> Hmm I'm also not finding a baremetal.yaml in airshipctl, so I'm unclear on this topic. Is anyone familiar with it? 15:09:19 <howell> mattmceuen: the file is testdata. It's located at pkg/document/testdata/baremetal.yaml 15:09:34 <howell> I'm not too familiar with the issue though.. 15:11:13 <mattmceuen> alright, let's hold off on that till the owner is here and we can talk through it 15:11:39 * ildikov is lurking :) 15:11:43 <mattmceuen> #topic what is equivalent to openshift-machine-api 15:11:47 <mattmceuen> o/ ildikov :) 15:11:59 <ildikov> mattmceuen: hi :) 15:12:15 <mattmceuen> Do we have the owner of this openshift-machine-api topic here this week? 15:12:31 <mattmceuen> " what is equivalent to openshift-machine-api (https://github.com/metal3-io/baremetal-operator/blob/master/examples/worker-0.yaml#L27) in metal3" 15:13:17 <mattmceuen> the question seems to be around the last line in there, defining the namespace 15:14:19 <mattmceuen> I think next time we carry over a bunch of topics to the next meeting, we can start by having the topic owners signal they are here and still want to discuss -- lesson learned :) 15:15:06 <mattmceuen> alright, moving on to new topics this week: 15:15:09 <mattmceuen> #topic Revisit use of root user in Airship containers - Pegleg, Spyglass, others? Can these be changed to either generic "airship" project or to project specific user? 15:15:24 <mattmceuen> alexanderhughes, is this one your shade of lavender? 15:15:38 <alexanderhughes> lavender is the best color 15:16:03 <mattmceuen> +1 15:16:04 <alexanderhughes> yes, so I was looking at projects again after reading some articles over the break. I'd like to change containers to run as a non-root user in Airship where possible 15:16:31 <portdirect> sounds good to me 15:16:47 <alexanderhughes> currently Pegleg and Spyglass are root. I don't see a reason for this so I'd like to change them if there aren't any concerns from community. in doing so if we plan to continue accepting documents in Pegleg container from Promenade should we consider changing both Promenade and Pegleg to a generic "airship" user to avoid chowns? 15:17:04 <alexanderhughes> or let operators use chowns between containers as has been in the case up til this point 15:17:41 <portdirect> id advocate for a generic user 15:17:54 <portdirect> this is what was done in the loci project to address similar concerns 15:17:57 <mattmceuen> I don't have any concerns with that - sounds good to me 15:18:01 <michael-beaver> I like the idea of them having a generic 'airship' user 15:18:24 <portdirect> 42424 is what loci used 15:18:37 <portdirect> so 42425 sounds good to me ;) 15:18:42 <mattmceuen> lol 15:18:47 <souradage> Don't most projects currently use the 'nobody' user? 15:19:08 <portdirect> nobody has some baggage around it 15:19:22 <portdirect> and where we are, we can make use of a 'real' user 15:19:36 <portdirect> which makes it much easier to set up ownership etc 15:20:01 <souradage> Right. Then I think an airship user would also be a good thing to move towards 15:20:03 <alexanderhughes> I'm all for "airship" user across all the projects 15:20:06 <portdirect> if we made airship use `nobody` then everyone who uses `nobody` would have the same rights for files 15:20:21 <mattmceuen> I would still think they should be overridable though 15:20:22 <alexanderhughes> this went to design call a few weeks ago, and we couldn't get consensus 15:20:23 <howell> +1 for "airship" 15:20:33 <portdirect> mattmceuen: ++ this is how we did it for loci 15:20:38 <openstackgerrit> Merged airship/porthole master: Enable runtime-default Apparmor Profile to Openstack-Utility Container. https://review.opendev.org/696186 15:20:39 <mattmceuen> And I don't think we should add dependencies between containers 15:20:57 <mattmceuen> I.e., don't want one container to assume another container is running as a particular user 15:21:15 <mattmceuen> w.r.t your promenade + pegleg concern alexanderhughes- can you please dive into that issue? 15:21:47 <alexanderhughes> the end goal is that pegleg is the access point for promenade commands - render, generate bundle, gen certs etc. but we haven't finished that transition yet 15:22:12 <alexanderhughes> as a result operators are rendering in promenade/collecting. then sending those documents to pegleg, but they have different owners "root" "promenade" and causes issues without chown 15:22:36 <alexanderhughes> in the case of pegleg->promenade in particular the files pegleg generates for promenade to consume can't be used because of the 640 permissions on root owned files 15:23:01 <alexanderhughes> standardizing the users or chown documents shared between containers are only paths forward I see until the transition to all pegleg is complete 15:23:41 <mattmceuen> I am less concerned about the promenade CLI portion (since it's deprecated) 15:23:47 <openstackgerrit> diwakar thyagaraj proposed airship/porthole master: Enable runtime-default Apparmor Profile to Calicoctl Utility Container. https://review.opendev.org/694793 15:24:10 <mattmceuen> The promenade API portion is already configurable, so we should avoid tying it down to a uid along with the CLI: https://opendev.org/airship/promenade/src/branch/master/charts/promenade/values.yaml#L180 15:24:19 <mattmceuen> how does that sound? 15:26:04 <mattmceuen> i.e., I'm ok with locking down the prom CLI to a specific UID (temporarily, till transitioned to pegleg), provided we keep the API uid configurable 15:26:17 <alexanderhughes> sure 15:26:26 <mattmceuen> ok awesome 15:27:19 <mattmceuen> #topic Moving issues from Jira to Github 15:27:29 <mattmceuen> uzumaki I think this one is yours 15:27:54 <uzumaki> yup, we had a discussion last week about the issue movement. Any updates from the WC/TC? 15:27:54 <mattmceuen> From my perspective, no progress since last week, when everyone seemed to be pretty positive around a change to github issues 15:28:32 <mattmceuen> The holiday got in the way last week sorry :) I will send out a note on the ML to make sure there aren't any concerns 15:28:47 <uzumaki> well, how do we plan to pursue it, the actual movement itself? 15:28:53 <uzumaki> mattmceuen, that's alright, no worries 15:29:12 <mattmceuen> I guess we have three choices 15:29:23 <mattmceuen> 1. manual copy and paste to move items 15:29:37 <mattmceuen> 2. "drain" jira and finish out work there while adding new work in github issues 15:29:56 <mattmceuen> 3. put work into an automated job to migrate stuff into github 15:30:28 <mattmceuen> any preference from your side uzumaki? 15:30:48 <openstackgerrit> Prateek Dodda proposed airship/porthole master: [WIP] https://review.opendev.org/697113 15:31:04 <uzumaki> My concern is, if people are joining in the community, during the migration, is there a way to make it easier for them to understand what is what? 15:31:18 <mattmceuen> +1 15:31:40 <mattmceuen> +1 to acknowledge that's a very good concern 15:31:59 <uzumaki> Otherwise, if it's only for us, the current members, any option out of 2/3 is fine (1 is too much work) 15:32:32 <mattmceuen> I suspect 3 may also be too much work ;-) 15:32:47 <uzumaki> haha 15:33:04 <mattmceuen> Rodolfo has a weekly meeting on JIra scope tracking, I think it would be a good place to pitch the "drain" idea 15:33:09 <mattmceuen> There may be a good "cut" point 15:33:27 <uzumaki> Escalate this, along with this concern to the other WC/TC members, this needs to be thought through 15:33:31 <mattmceuen> i.e., maybe starting with e.g. Airship 2.0 beta, scope moves to github, or something like this 15:33:39 <uzumaki> mattmceuen, yeah, drain idea seems fine, least work 15:33:59 <mattmceuen> for sure, we have a WC meeting next week, I will bring this up there as well 15:34:11 <uzumaki> that'd be great! 15:34:15 <dwalt> o/ 15:34:39 <mattmceuen> o/ dwalt - just to confirm (since I had to miss it) - you didn't discuss this yesterday, right? 15:35:09 <dwalt> we did not. As a WC member, it would be really helpful to get input from those already working scope in Jira 15:35:38 <dwalt> Since we want to cause as little disruption as possible 15:36:04 <uzumaki> indeed 15:37:00 <dwalt> as I am catching up, I see you said option 2 or option 3 :) 15:37:19 <uzumaki> we're open to suggestions! 15:37:24 <dwalt> We will discuss this next Monday (12/9) then. The meeting is open to anyone to join 15:37:42 <uzumaki> i'll be there, great! 15:37:50 <dwalt> great! Thanks uzumaki 15:37:51 <ildikov> can I ask a dumb question around the decision to use GitHub issues? 15:37:59 <mattmceuen> sure can ildikov 15:38:03 <uzumaki> go ahead! 15:38:03 <dwalt> additionally, the etherpad is here. You can also leave comments if you cannot attend: https://wiki.openstack.org/wiki/Airship/Airship-WC 15:38:12 <ildikov> if I know correctly you use Git/Gerrit for code development 15:38:22 <mattmceuen> yup 15:38:34 <ildikov> so I wonder if it doesn't get confusing to use GitHUb for issues but not for the rest of the flow? 15:38:48 <srwilkers> ildikov asking the good questions 15:38:57 <mattmceuen> I think that's a fair point 15:39:08 <ildikov> I assume you talked this through so if you have meeting logs somewhere for my understanding I can catch up on that as opposed to keep up the meeting on this :) 15:39:30 <mattmceuen> we would associate the issues with the github mirror of our opendev projects, so it wouldn't be "completely divorced" 15:40:00 <ildikov> it just looked confusing to me, who's not deeply involved at this point 15:40:17 <ildikov> that part makes sense, however the mirror is read only 15:40:19 <srwilkers> it'd be difficult to fight off the urge to open a pull request via github, i'll admit 15:40:38 <mattmceuen> we've had a couple brief conversations, but haven't gotten deep - I'll capture some of the potential gotchas/concerns in an etherpad, along with some feedback from the kubecon meetup 15:40:40 <openstackgerrit> Samuel Pilla proposed airship/promenade master: Upgrade Tiller version for k8s 1.16 https://review.opendev.org/693395 15:40:41 <mattmceuen> o/ srwilkers 15:40:44 <srwilkers> o/ 15:40:45 <ildikov> and my memories from OpenStack is that people get confused by the mirror even when you don't use any GitHub feature besides browsing the code 15:42:04 <mattmceuen> I admit it's not my favorite approach. However the pros/cons need to be weighed against overwhelming developer preference (so far) to using github issues for tracking scope, seems to hit a sweet spot of ease of use + functionality 15:42:31 <ildikov> mattmceuen: I'm happy to add this to a pro/con etherpad if/when you create one 15:42:45 <mattmceuen> I think in the wash it'll be "what's the least annoying of N evils" :) 15:42:54 <mattmceuen> so pros/cons lists will help with that 15:43:17 <ildikov> lol, I'm with you on the least annoying note 15:43:35 <mattmceuen> thanks much ildikov - will share w/ you as soon as I get it up, and will post it to the ML 15:43:40 <ildikov> I brought this up more from forward looking perspective and with new comers in mind 15:43:41 <openstackgerrit> Samuel Pilla proposed airship/treasuremap master: Upgrade Tiller version for k8s 1.16 https://review.opendev.org/694604 15:43:55 <ildikov> mattmceuen: sounds great, thank you! 15:44:02 <ildikov> I'll keep an eye on the ML 15:44:17 <mattmceuen> #topic Roundtable 15:44:35 <mattmceuen> That's it as far as the agenda goes, team - any additional topics, feedback, or requests for code review? 15:45:25 <uzumaki> nope, looking forward to the pros/cons list on the ML 15:45:55 <mattmceuen> awesome - I will prioritize that to the top of my overdue todo items :D 15:46:03 <uzumaki> I'm sure you will :D 15:46:08 <mattmceuen> hoping to catch up before xmas holidays 15:46:24 <openstackgerrit> Samuel Pilla proposed airship/treasuremap master: Upgrade Tiller version for k8s 1.16 https://review.opendev.org/694604 15:46:25 <mattmceuen> on that note, then - I'll give us 14 minutes back! 15:46:33 <mattmceuen> Thanks everyone for your time and the great discussion 15:46:48 <mattmceuen> have a great week, and see you here in IRC/ML in the meantime 15:46:50 <alexanderhughes> thanks all :) 15:47:01 <mattmceuen> #endmeeting