- service-discuss - lists.openstack.org

Team Meeting Agenda for January 18, 2022
by Clark Boylan 18 Jan '22

18 Jan '22

We will meet January 18, 2022 at 19:00 UTC in #opendev-meeting with this agenda: * Announcements ** OpenInfra Summit CFP and programming committee need your input: https://openinfra.dev/summit/ * Actions from last meeting * Specs Review * Topics ** Improving OpenDev's CD throughput (clarkb 20220118) *** Bootstrapping bridge via Zuul is now a complicated subject. Can use zuul secrets to make it happen. Are we comfortable with this? *** https://review.opendev.org/c/opendev/infra-specs/+/821645 -- spec outlining some of the issues with secrets *** https://review.opendev.org/c/opendev/system-config/+/821155 -- sample of secret writing; more info in changelog ** Container maintenance (clarkb 20220118) *** https://etherpad.opendev.org/p/opendev-container-maintenance *** Buster to Bullseye updates are complete. *** Running container with dedicated users. Next up all the ircbots. *** Upgrading Zookeeper *** Upgrading MariaDB *** Eventually convert MariaDB container's from uid 999 to something that makes more sense on the system. ** Spring cleaning our Nodepool images (clarkb 20220118) *** http://lists.opendev.org/pipermail/service-announce/2021-December/000029.ht… cleanup announcement *** Tumbleweed has been removed *** CentOS 8 removal process has begun. Gave projects until the end of the month before we remove the nodeset and nodepool configs. ** Scheduling Gerrit Project Renames (clarkb 20220118) *** Target January 24 around 22:00 UTC? ** Spring cleaning for old reviews? (frickler 20220113) *** system-config has >300 open reviews, most of them in merge-conflict and >1y old *** Do we see value in keeping those or could we run some script to auto-abandon those with a helpful comment? *** Neutron has a script that could be easily adopted for this task **** https://opendev.org/openstack/neutron/src/branch/master/tools/abandon_old_r… * Open discussion

1 0

Re: [service-announce] Changes to OpenDev's stable of CI images
by Clark Boylan 12 Jan '22

12 Jan '22

On Tue, Dec 7, 2021, at 8:38 AM, Clark Boylan wrote: > Hello, > > CentOS 8 reaches end of life on December 31, 2021. This means now is > the time for you to convert jobs to CentOS 8|9 Stream or some other > appropriate platform. The OpenDev team will plan to remove CentOS 8 > images and mirrors from our infrastructure in early January, hopefully > by January 14, 2022. Again, please update your jobs now so that you are > prepared. These changes are necessary as the distro will no longer be > supported, and there is no way for us to ensure that the images will be > secure or that we'll even be able to build them. > > We've also got Fedora 35 lined up to replace Fedora 34. Due to Fedora's > short support window we typically swap out one Fedora release with the > next when the next is ready. If you are using the fedora-34 label > please update it to fedora-35. If you are using fedora-latest we'll be > updating that to use fedora-35 and the swap will happen automatically > for you. We expect to have Fedora 34 cleaned up by the end of the year. > > Additionally both OpenSUSE 15 and Tumbleweed could use some help. For > OpenSUSE 15 we need to update it to 15.3 as well as updating the > associated mirrors if we plan to keep it around. I'm happy to keep this > image around if we can get volunteers in the community that can help > with that. If there isn't interest in modernizing the OpenSUSE 15 > images I'd like to propose we clean them up in January along with the > CentOS 8 images. For Tumbleweed, the images haven't received much use > or attention. I'd like to propose that we simply retire this image and > clean it up. We had thought it might be a good platform for monitoring > upcoming changes in the Linux world, but the reality is that only works > if you've got people active caring for it and adjusting to those > changes. The Tumbleweed cleanup will likely begin before the end of the > year. > > Finally, our Gentoo images bounce between being buildable and broken > with more time spent being broken than not. I'd like to propose that > this image also get cleaned up in the near future. Again, if there is > interest in the community for keeping this alive I think we can make > that happen. But as is this image is not in a sustainable place and it > would be better for us to stop running jobs on it. > > Let us know if you have any questions or comments, To followup on this we have found volunteers for Gentoo and OpenSUSE Leap 15 maintenance. This means those images are not immediately up for removal. However, if those volunteers find they aren't sustainable for one reason or another they may still be removed. OpenSUSE Tumbleweed has been removed and as far as we could tell nothing was using it when we removed it. Shouldn't create any problems. CentOS 8 removal has begun with a number of changes [0] to start removing some of the infrastructure bits (like wheel mirrors and openafs packages) that supported it. I will be reaching out to OpenStack as well as they seem to be the primary users of the centos-8 label. Hopefully we'll be able to remove all of the existing centos-8 jobs cleanly, but if not then we'll wait until a reasonable amount of time and cleanup has passed (a couple of weeks?) before force merging the removal of the nodeset and label from our zuul configs. Fedora 34 cleanup is still in progress, but should pick up again as people return from holiday. [0] https://review.opendev.org/q/topic:%22remove-centos-8%22+status:open

2 1

Infra Team Meeting Agenda for January 11, 2022
by Clark Boylan 11 Jan '22

11 Jan '22

Our first meeting of the year will be held January 11, 2022 at 19:00 UTC in #opendev-meeting. I expect it will still be pretty quiet due to holidays so we might get through it quickly. This is our agenda: == Agenda for next meeting == * Announcements ** OpenInfra Foundation Board Election happening this week. Don't forget to vote. * Actions from last meeting * Specs Review * Topics ** ansible-lint failures (clarkb 20220111) *** An unpinned dep (rich) in old ansible-lint has updated and broken ansible-lint. Need to pin rich or update ansible-lint. *** clarkb has a number of these changes up for review now. topic:ansible-lint ** Improving OpenDev's CD throughput (clarkb 20220111) *** Bootstrapping bridge via Zuul is now a complicated subject. Can use zuul secrets to make it happen. Are we comfortable with this? *** https://review.opendev.org/c/opendev/infra-specs/+/821645 -- spec outlining some of the issues with secrets *** https://review.opendev.org/c/opendev/system-config/+/821155 -- sample of secret writing; more info in changelog ** Container maintenance (clarkb 20220111) *** https://etherpad.opendev.org/p/opendev-container-maintenance *** Updating Buster images to Bullseye **** https://review.opendev.org/q/hashtag:%22bullseye-image-update%22+status:open The uwsgi image update in particular could use review. *** Running container with dedicated users. Next up all the ircbots. *** Upgrading Zookeeper *** Upgrading MariaDB *** Eventually convert MariaDB container's from uid 999 to something that makes more sense on the system. ** Spring cleaning our Nodepool images (clarkb 20220111) *** http://lists.opendev.org/pipermail/service-announce/2021-December/000029.ht… cleanup announcement *** CentOS 8 and OpenSUSE Tumbleweed need cleanup this month. ** Scheduling Gerrit Project Renames (clarkb 20220111) * Open discussion

1 0

No Team Meeting December 28, 2021
by Clark Boylan 28 Dec '21

28 Dec '21

Just a heads up that things have been quiet (as expected) the last week. I think we can go ahead and cancel tomorrow's meeting. See you all in a couple weeks as we return to normal scheduling in the new year. Clark

1 0

Team Meeting Agenda for December 14, 2021
by Clark Boylan 14 Dec '21

14 Dec '21

We will meet with this agenda on December 14, 2021 at 19:00 UTC in #opendev-meeting: == Agenda for next meeting == * Announcements ** Meetings Cancelled December 21, 2021 and January 4, 2022 for Holidays ** We may have a meeting on December 28, 2021 depending on who is around. * Actions from last meeting * Specs Review * Topics ** Log4j vulnerability fun (clarkb 20211214) *** Discuss what we've learned about this bug and its impact. ** Improving OpenDev's CD throughput (clarkb 20211214) *** Bootstrapping bridge via Zuul is now a complicated subject. Can use zuul secrets to make it happen. Are we comfortable with this? ** Container maintenance (clarkb 20211214) *** https://etherpad.opendev.org/p/opendev-container-maintenance *** Updating Buster images to Bullseye *** Running container with dedicated users. Next up all the ircbots. *** Upgrading Zookeeper *** Upgrading MariaDB *** Eventually convert MariaDB container's from uid 999 to something that makes more sense on the system. ** Adding a lists.openinfra.dev mailman site (fungi 20211214) *** Ansible newlist invocations still struggling *** Stack at https://review.opendev.org/c/opendev/system-config/+/820900/ should correct this. ** Spring cleaning our Nodepool images (clarkb 20211214) *** CentOS 8, Fedora 34, Gentoo, OpenSUSE 15, and OpenSUSE tumbleweed are either EOL, going EOL, or lacking care necessary to keep building up to date images. *** http://lists.opendev.org/pipermail/service-announce/2021-December/000029.ht… cleanup announcement *** Will need volunteers for the work. Probably ok if this proceeds a little slower than advertised. * Open discussion

1 0

Re: [service-announce] Changes to OpenDev's stable of CI images
by Jack Morgan 08 Dec '21

08 Dec '21

Hey Clark, I'd like to help out / volunteer on whatever needs to be done. It doesn't have to be specific to image clean up. I'm not sure how to get started so thought we could meet for coffee but open to other suggestions. On 12/7/21 08:38, Clark Boylan wrote: > Hello, > > CentOS 8 reaches end of life on December 31, 2021. This means now is the time for you to convert jobs to CentOS 8|9 Stream or some other appropriate platform. The OpenDev team will plan to remove CentOS 8 images and mirrors from our infrastructure in early January, hopefully by January 14, 2022. Again, please update your jobs now so that you are prepared. These changes are necessary as the distro will no longer be supported, and there is no way for us to ensure that the images will be secure or that we'll even be able to build them. > > We've also got Fedora 35 lined up to replace Fedora 34. Due to Fedora's short support window we typically swap out one Fedora release with the next when the next is ready. If you are using the fedora-34 label please update it to fedora-35. If you are using fedora-latest we'll be updating that to use fedora-35 and the swap will happen automatically for you. We expect to have Fedora 34 cleaned up by the end of the year. > > Additionally both OpenSUSE 15 and Tumbleweed could use some help. For OpenSUSE 15 we need to update it to 15.3 as well as updating the associated mirrors if we plan to keep it around. I'm happy to keep this image around if we can get volunteers in the community that can help with that. If there isn't interest in modernizing the OpenSUSE 15 images I'd like to propose we clean them up in January along with the CentOS 8 images. For Tumbleweed, the images haven't received much use or attention. I'd like to propose that we simply retire this image and clean it up. We had thought it might be a good platform for monitoring upcoming changes in the Linux world, but the reality is that only works if you've got people active caring for it and adjusting to those changes. The Tumbleweed cleanup will likely begin before the end of the year. > > Finally, our Gentoo images bounce between being buildable and broken with more time spent being broken than not. I'd like to propose that this image also get cleaned up in the near future. Again, if there is interest in the community for keeping this alive I think we can make that happen. But as is this image is not in a sustainable place and it would be better for us to stop running jobs on it. Thanks, -- Jack Morgan

2 1

Parallel production jobs changes
by Ian Wienand 07 Dec '21

07 Dec '21

Hi, To recap: currently production deployment jobs run sequentially. Zuul starts the job on an executor, which is setup to log into the bastion host. The job sets up the system-config playbooks on the bastion host and Ansible is run from there against the production server. To run in parallel, each job needs to not assume it owns the system-config playbooks on the bastion host. Each Zuul *buildset* can use the same system-config playbook checkout though. To achieve this we need to rework the dependencies; each production job needs to depend on a common source-setup job. Once the source is setup on the bastion host, the actual production jobs can run in parallel. To the changes... Firstly, I believe we're doing the setup steps for the executor to log into bridge twice: https://review.opendev.org/c/opendev/system-config/+/818190 removes this duplication, and should be safe to merge. As pointed out in prior reviews when running in the periodic or hourly pipelines each job overrides that bastion host checkout to master. https://review.opendev.org/c/opendev/base-jobs/+/818189 moves this step into base-jobs, in preparation for only being done once by the separate source-setup job. I believe this will be safe to merge; system-config will just do it again in an idempotent way, until: https://review.opendev.org/c/opendev/system-config/+/818191 merges, which drops this step from system-config. We can then merge the system-config job dependency updates in https://review.opendev.org/c/opendev/system-config/+/807672 This should mean that all jobs not only rely on the correct base jobs, but jobs that need certificates, etc. will be relying on the letsencrypt job, etc. This should be safe to merge as nothing should actually change, we just have stricter dependencies. After this, I think we are ready to refactor the base jobs into the two separate steps -- firstly setup the keys on the executor to log into the bastion host, then setup the source to use on the bastion host: https://review.opendev.org/c/opendev/base-jobs/+/807807 This initial refactor should be safe to merge as it creates two new jobs, but the existing base job keeps running both steps as-is. Then we are ready for the penultimate change: https://review.opendev.org/c/opendev/system-config/+/807808 This updates the system-config jobs to all depend on "infra-prod-setup-src" which will be the canonical job that sets up the source repository on bridge.o.o. All other jobs in the buildset will depend on this job, ensuring consistency for a run. This should also be safe, as it again doesn't actually change ordering. Once all this is in, we need the final change to enable parallel running (and think about correct semaphores between periodic/hourly and regular runs). That is yet to be written, but we have enough to get to that point! -i

1 1

Team Meeting Agenda for December 7, 2021
by Clark Boylan 07 Dec '21

07 Dec '21

Hello, We will meet with this agenda on December 7, 2021 at 19:00 UTC in #opendev-meeting: == Agenda for next meeting == * Announcements * Actions from last meeting * Specs Review * Topics ** Improving OpenDev's CD throughput (clarkb 20211207) *** We can run many of our jobs in parallel in all of our CD pipelines. But this requires we properly document/address dependencies *** We ended up in a weird spot after relying on the per buildset update source job: **** We weren't syncing updated repo content to bridge but to a single use test node **** We weren't hard depending on the job so if it didn't run we would run the other jobs without updated sources **** We weren't adding the update source job to hourly and daily periodic buildsets *** Next steps happening in https://review.opendev.org/c/opendev/system-config/+/820320 ** User management on our systems (clarkb 20211207) *** Still struggling with matrix-gerritbot. Now openssh on it complains that uid 11000 doesn't exist. *** Eventually convert mariadb container's from uid 999 to something that makes more sense on the system. ** Adding a lists.openinfra.dev mailman site (fungi 20211207) *** Ansible newlist invocations still struggling *** https://review.opendev.org/c/opendev/system-config/+/820397 and parent are a stack to investigate and fix this. ** keycloak.opendev.org exists now (clarkb 20211207) *** This can be used to gain more familiarity with the tool to implement our authentication spec. *** Are we treating this as production ready? Might be good to avoid that for now while we investigate how to apply this to our previous spec? ** Gerrit User Summit (clarkb 20211207) *** Gerrit 3.2 is EOL *** We can integrate with the new Checks UI stuff if we implement a Checks plugin for Zuul. **** This plugin would run within Gerrit and poll an API on the Zuul side for CI results and render them in a consistent manner. *** Composable Submit Requirements **** This is a new system for expressing what is required to merge a change **** Relies on boolean query language using Gerrit's existing query predicates. **** Mostly we should be careful to avoid accidentally allowing too much access when this shows up. *** ChronicleMap libmodule plugin persistent caches **** This replaces H2 caches for a number of things and gives the caches persistence. Can apparently have a big impact on performance **** One suggestion was that Gerrit incorporate this by default. ** Spring cleaning our Nodepool images (clarkb 20211207) *** CentOS 8, Fedora 34, Gentoo, OpenSUSE 15, and OpenSUSE tumbleweed are either EOL, going EOL, or lacking care necessary to keep building up to date images. *** https://etherpad.opendev.org/p/xvu2oKUQVLiHIHsvGRUt draft communications for proposed cleanups. * Open discussion

1 0

UbuntuOne/Launchpad two-factor authentication
by Jeremy Stanley 01 Dec '21

01 Dec '21

For a little over a year Ian, Clark and I have been using the multi-factor authentication feature of UbuntuOne SSO (i.e. Launchpad) in order to more strongly secure the accounts we rely on for OpenID logins to the Web interfaces of our services like Gerrit and StoryBoard. It's gone smoothly, I think, and so we're probably overdue on our plan to offer this capability to other OpenDev users. Support for this is not enabled by default, your SSO account needs to be a member of a group which is granted the feature. We have one such group authorized for this purpose, which can be found here: https://launchpad.net/~opendev-2fa Please see the information and important caveats documented in the group description. I expect the process would be something like using the LP group members page to request membership for your account, and then one of the group administrators would approve the request, after which you would be able to proceed with configuration of your token or other HOTP/TOTP authenticator. I'm bringing it up here first for discussion, in order to see if anyone has any concerns or related suggestions, but barring none I'd like to move forward with a "soft" (quiet) call for wider testing the first week of December. -- Jeremy Stanley

3 5

Team Meeting Agenda for November 30, 2021
by Clark Boylan 30 Nov '21

30 Nov '21

We will meet with this agenda on November 30, 2021 at 19:00 UTC in #opendev-meeting: == Agenda for next meeting == * Announcements ** Gerrit User Summit happening December 2&3 virtually. * Actions from last meeting * Specs Review * Topics ** Improving OpenDev's CD throughput (clarkb 20211130) *** We can run many of our jobs in parallel in all of our CD pipelines. But this requires we properly document/address dependencies *** https://review.opendev.org/c/opendev/system-config/+/807808 Update system-config once per buildset. *** https://review.opendev.org/c/opendev/base-jobs/+/818297/ Reduce actions needed to be taken in base-jobs. *** Next up is thinking about semaphores and actually trying to run jobs in parallel. Dependencies should be correct. ** Zuul multi scheduler setup (clarkb 20211130) *** Possible for zuul updates to break rolling system updates. Not sure if we've got signal on when that happens yet. ** User management on our systems (clarkb 20211130) *** Ran into problems with matrix-gerritbot. There is an updated image we can pull and use to try again. *** Eventually convert mariadb container's from uid 999 to something that makes more sense on the system. ** UbuntuOne/Launchpad two-factor OpenID authentication availability (fungi 20211130) *** http://lists.opendev.org/pipermail/service-discuss/2021-November/000298.html ** Adding a lists.openinfra.dev mailman site (fungi 20211130) *** https://review.opendev.org/818826 ** Proxying and caching Ansible Galaxy in our providers (fungi 20211130) *** https://review.opendev.org/818787 ** Gerrit Account cleanups (clarkb 20211130) *** 33 conflicts remain. Clarkb has written notes on proposed plans for each user in the comments of review02:~clarkb/gerrit_user_cleanups/audit-results-annotated.yaml * Open discussion

1 0