| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2022-01-24 | |||
| 17:33:30 | artom | Wow | |
| 17:33:50 | artom | Also, I will never not think of https://knowyourmeme.com/memes/rage-guy-fffffuuuuuuuu | |
| 17:48:51 | opendevreview | sean mooney proposed openstack/nova master: [WIP] add initial healthcheck support https://review.opendev.org/c/openstack/nova/+/825015 | |
| 18:22:37 | ade_lee__ | gmann, sean-k-mooney trying to decide how to handle issue in https://review.opendev.org/c/openstack/tempest/+/810808 | |
| 18:23:28 | ade_lee__ | gmann, sean-k-mooney it sounds to me like we're never going to fix the plain encryptor provider . | |
| 18:27:34 | gmann | ade_lee__: I am very unclear on how many tests we are going to skip or fix for FIPs mode. so my suggestion is to exclude the tests run using --exclude-regex/--exclude-list instead of permanently marking those tests as skip in code. | |
| 18:28:07 | gmann | that is how we do for ceph case, 'xyz list of tests does not work for ceph backend so just do not run' | |
| 18:29:23 | ade_lee__ | ok | |
| 18:41:59 | sean-k-mooney | gmann: the regex approch makes sense to me | |
| 18:42:35 | sean-k-mooney | proably using the exclude regex in this case to skip non fips complent tests | |
| 18:42:35 | gmann | cool | |
| 18:42:42 | gmann | yeah | |
| 18:42:45 | sean-k-mooney | the disadvantage to that is running locally | |
| 18:42:53 | sean-k-mooney | so can we do it with a tox env | |
| 18:42:58 | sean-k-mooney | rather then in the job | |
| 18:43:07 | sean-k-mooney | so you can repoduce locally too | |
| 18:43:42 | sean-k-mooney | e.g. like https://github.com/openstack/tempest/blob/master/tox.ini#L151-L162 | |
| 18:44:20 | sean-k-mooney | we can define an integrated-fips target | |
| 18:45:39 | gmann | yeah, we can do that. | |
| 18:46:45 | sean-k-mooney | ade_lee__: does ^ work for you | |
| 18:48:13 | ade_lee__ | gmann, sean-k-mooney we can do that. | |
| 18:48:58 | sean-k-mooney | i think from a downstream pserspcitive that wil make things simpler since we wont have to translate the regex into a jenkins jobs it will just invoke the fips target and get teh same set of test as upstream | |
| 18:49:22 | gmann | ade_lee__: cool, so let's add that in follow up patch after paramiko one which has already +2 and under zuul result. | |
| 18:49:23 | sean-k-mooney | with that said i have not looked at what our downstream jobs will look like | |
| 18:50:04 | ade_lee__ | gmann, sean-k-mooney I suspect for nova though the test suite might pass without the skip, given that the test did not have the fips flag set | |
| 18:50:52 | ade_lee__ | so this may be moot for right now for the nova fips test -- it shows up for sure in the cinder tests though | |
| 18:51:10 | sean-k-mooney | i dont really see how this would be project specific | |
| 18:51:32 | sean-k-mooney | we are both using the the same integrated-fips jobs no? | |
| 18:51:43 | ade_lee__ | sean-k-mooney, its more a matter of which tests run in which test jobs .. | |
| 18:52:13 | sean-k-mooney | well my point is the latest version fo the nova patch uses a common job | |
| 18:52:26 | sean-k-mooney | https://review.opendev.org/c/openstack/nova/+/790519/20/.zuul.yaml | |
| 18:52:27 | gmann | yeah it run all the tests | |
| 18:52:30 | sean-k-mooney | its not nova specific | |
| 18:53:22 | ade_lee__ | sean-k-mooney, gmann where the fips flag was shown to be needed was here -- https://review.opendev.org/c/openstack/cinder/+/790535/24/.zuul.yaml#134 | |
| 18:53:52 | ade_lee__ | one or more of those in any case .. | |
| 18:54:11 | sean-k-mooney | that because fo ceph? | |
| 18:54:27 | sean-k-mooney | where is the common job currently defiend | |
| 18:54:28 | ade_lee__ | tempest-integrated-storage-fips I think .. | |
| 18:55:06 | gmann | this one https://github.com/openstack/tempest/blob/master/zuul.d/integrated-gate.yaml#L301 | |
| 18:55:25 | sean-k-mooney | here https://github.com/openstack/tempest/blob/master/zuul.d/integrated-gate.yaml#L300-L314 | |
| 18:55:27 | ade_lee__ | sean-k-mooney, remember this test is for skipping something related to encrypted volumes .. | |
| 18:55:27 | sean-k-mooney | ya | |
| 18:55:38 | gmann | not sure how that flag which is not there will pass the test. let's see in result | |
| 18:55:45 | sean-k-mooney | right but in genally we woudl expect those test to run on nova too | |
| 18:55:52 | gmann | yes, it will run | |
| 18:56:02 | gmann | its tempest-full run | |
| 18:56:05 | sean-k-mooney | ade_lee__: i would guess this is speicifc to useing ceph | |
| 18:56:18 | sean-k-mooney | as by default we will use lvm + iscsi | |
| 18:56:51 | sean-k-mooney | or rather looking at https://review.opendev.org/c/openstack/cinder/+/790535 | |
| 18:57:07 | sean-k-mooney | it need in a few non lvm/isci default cases | |
| 18:57:54 | sean-k-mooney | its proably related to ISCSID_ENABLE_FIPS: True | |
| 18:58:10 | sean-k-mooney | that is set in all the jobs that failed | |
| 18:58:34 | sean-k-mooney | but its not in tempest-centos8-stream-fips | |
| 18:58:38 | ade_lee__ | sean-k-mooney, that just sets the iscsi chap algorithms to not use md5 -- we actually don't need that any more | |
| 18:58:56 | ade_lee__ | sean-k-mooney, so it has no effect. | |
| 18:59:17 | ade_lee__ | sean-k-mooney, abishop and eharney are still investigating the failures | |
| 18:59:30 | ade_lee__ | sean-k-mooney, there is something going on with cryptsetup and fips | |
| 18:59:42 | sean-k-mooney | i see well right now the generic fips env is running https://github.com/openstack/tempest/blob/master/tox.ini#L101-L113 | |
| 18:59:44 | ade_lee__ | even in the luks case | |
| 19:00:52 | sean-k-mooney | the fips jobs seam to be all using the singel node node sets is that intentinal | |
| 19:02:49 | ade_lee__ | sean-k-mooney, no - not intentional - thats what we had defeined for nova while testing | |
| 19:03:01 | sean-k-mooney | gmann: actully looking at how those run it proably does not make sense to use a tox target | |
| 19:03:14 | ade_lee__ | sean-k-mooney, we can change if needed | |
| 19:03:19 | sean-k-mooney | ade_lee__: for nova we would want multi node for live migration and colde migration coverage | |
| 19:04:53 | ade_lee__ | sean-k-mooney, ack - so do we want to change in the generic job as defined here - or define a new job? gmann ^^? | |
| 19:05:03 | sean-k-mooney | gmann: we will need to exclude non fips compatible test but we need to include tests form the tempest plugins for ceph ectra | |
| 19:05:41 | sean-k-mooney | so doing that in the job configuation actully proable makes more sense then backing it into a bunch of tox envs | |
| 19:06:45 | sean-k-mooney | ade_lee__: porbaly have both so just inhirt form the current jobs and defien the nodeset to be a multi node variant | |
| 19:07:07 | sean-k-mooney | then the porject can decided which one they want to included | |
| 19:07:57 | ade_lee__ | sean-k-mooney, sounds reasonable to me | |
| 19:08:22 | gmann | sean-k-mooney: ade_lee__ ok, so for multinode case we can inherit from tempest-multinode-full-py3 https://github.com/openstack/tempest/blob/master/zuul.d/integrated-gate.yaml#L230 | |
| 19:08:55 | sean-k-mooney | that also works | |
| 19:09:26 | sean-k-mooney | i was thinking of just inhirting form tempest-centos8-stream-fips and setting the nodeset | |
| 19:09:41 | sean-k-mooney | so you dont have to redfiene the fips specific things in two places | |
| 19:10:33 | ade_lee__ | sean-k-mooney, though presumably you have to refine all the multinode things .. | |
| 19:10:39 | sean-k-mooney | no | |
| 19:10:49 | sean-k-mooney | all the devstack jobs inhrit form multinode | |
| 19:11:06 | sean-k-mooney | so a single node job is a multi node jobs without a second node defiend | |
| 19:11:41 | ade_lee__ | sean-k-mooney, I meant all the things in https://github.com/openstack/tempest/blob/master/zuul.d/integrated-gate.yaml#L232-L242 | |
| 19:12:14 | gmann | ade_lee__: you do not need USE_PYTHON3 as it is default to true in devstack now | |
| 19:12:40 | sean-k-mooney | ade_lee__ none of that is relevent to multi node | |
| 19:13:00 | gmann | ade_lee__: sean-k-mooney so you are saying two jobs 1. existing tempest-centos8-stream-fips 2. new multinode one ? | |
| 19:13:15 | sean-k-mooney | what we need to do is https://github.com/openstack/devstack/blob/master/.zuul.yaml#L179-L207 | |
| 19:13:18 | sean-k-mooney | for centos | |
| 19:13:27 | gmann | if so why not converting the existing one to multinode | |
| 19:13:41 | sean-k-mooney | gmann: we could convert it to multinode | |
| 19:13:58 | sean-k-mooney | but we still need to override the nodeset to use centos-8-stream | |
| 19:14:04 | sean-k-mooney | since the current jobs assumes that | |
| 19:14:24 | gmann | yeah | |
| 19:14:52 | sean-k-mooney | so either in devstack or in tempest we need a openstack-two-node-centos-8-stream nodeset | |
| 19:15:25 | gmann | we need to define that in devstack | |
| 19:15:27 | sean-k-mooney | gmann: i was assumign it would be simpler to get the fips jobs stable single node then add multi node | |
| 19:15:48 | sean-k-mooney | gmann: by convention yes. althoguh its not required by zuul | |
| 19:16:23 | ade_lee__ | sean-k-mooney, we should probably stick with convention .. | |
| 19:16:24 | gmann | sean-k-mooney: we can see what all test fails and if that is multinode related or not. if so then we can separate the efforty | |
| 19:16:40 | sean-k-mooney | ack | |
| 19:16:58 | sean-k-mooney | ok im going to go cook dinner so ill let ye figure out the best way forward | |
| 19:17:18 | ade_lee__ | sean-k-mooney, gmann -- so , as I understand the plan | |
| 19:17:19 | gmann | sean-k-mooney: have a good one. lunch time for me too | |
| 19:17:23 | gmann | ade_lee__: thanks | |