| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2022-01-24 | |||
| 18:49:22 | gmann | ade_lee__: cool, so let's add that in follow up patch after paramiko one which has already +2 and under zuul result. | |
| 18:49:23 | sean-k-mooney | with that said i have not looked at what our downstream jobs will look like | |
| 18:50:04 | ade_lee__ | gmann, sean-k-mooney I suspect for nova though the test suite might pass without the skip, given that the test did not have the fips flag set | |
| 18:50:52 | ade_lee__ | so this may be moot for right now for the nova fips test -- it shows up for sure in the cinder tests though | |
| 18:51:10 | sean-k-mooney | i dont really see how this would be project specific | |
| 18:51:32 | sean-k-mooney | we are both using the the same integrated-fips jobs no? | |
| 18:51:43 | ade_lee__ | sean-k-mooney, its more a matter of which tests run in which test jobs .. | |
| 18:52:13 | sean-k-mooney | well my point is the latest version fo the nova patch uses a common job | |
| 18:52:26 | sean-k-mooney | https://review.opendev.org/c/openstack/nova/+/790519/20/.zuul.yaml | |
| 18:52:27 | gmann | yeah it run all the tests | |
| 18:52:30 | sean-k-mooney | its not nova specific | |
| 18:53:22 | ade_lee__ | sean-k-mooney, gmann where the fips flag was shown to be needed was here -- https://review.opendev.org/c/openstack/cinder/+/790535/24/.zuul.yaml#134 | |
| 18:53:52 | ade_lee__ | one or more of those in any case .. | |
| 18:54:11 | sean-k-mooney | that because fo ceph? | |
| 18:54:27 | sean-k-mooney | where is the common job currently defiend | |
| 18:54:28 | ade_lee__ | tempest-integrated-storage-fips I think .. | |
| 18:55:06 | gmann | this one https://github.com/openstack/tempest/blob/master/zuul.d/integrated-gate.yaml#L301 | |
| 18:55:25 | sean-k-mooney | here https://github.com/openstack/tempest/blob/master/zuul.d/integrated-gate.yaml#L300-L314 | |
| 18:55:27 | ade_lee__ | sean-k-mooney, remember this test is for skipping something related to encrypted volumes .. | |
| 18:55:27 | sean-k-mooney | ya | |
| 18:55:38 | gmann | not sure how that flag which is not there will pass the test. let's see in result | |
| 18:55:45 | sean-k-mooney | right but in genally we woudl expect those test to run on nova too | |
| 18:55:52 | gmann | yes, it will run | |
| 18:56:02 | gmann | its tempest-full run | |
| 18:56:05 | sean-k-mooney | ade_lee__: i would guess this is speicifc to useing ceph | |
| 18:56:18 | sean-k-mooney | as by default we will use lvm + iscsi | |
| 18:56:51 | sean-k-mooney | or rather looking at https://review.opendev.org/c/openstack/cinder/+/790535 | |
| 18:57:07 | sean-k-mooney | it need in a few non lvm/isci default cases | |
| 18:57:54 | sean-k-mooney | its proably related to ISCSID_ENABLE_FIPS: True | |
| 18:58:10 | sean-k-mooney | that is set in all the jobs that failed | |
| 18:58:34 | sean-k-mooney | but its not in tempest-centos8-stream-fips | |
| 18:58:38 | ade_lee__ | sean-k-mooney, that just sets the iscsi chap algorithms to not use md5 -- we actually don't need that any more | |
| 18:58:56 | ade_lee__ | sean-k-mooney, so it has no effect. | |
| 18:59:17 | ade_lee__ | sean-k-mooney, abishop and eharney are still investigating the failures | |
| 18:59:30 | ade_lee__ | sean-k-mooney, there is something going on with cryptsetup and fips | |
| 18:59:42 | sean-k-mooney | i see well right now the generic fips env is running https://github.com/openstack/tempest/blob/master/tox.ini#L101-L113 | |
| 18:59:44 | ade_lee__ | even in the luks case | |
| 19:00:52 | sean-k-mooney | the fips jobs seam to be all using the singel node node sets is that intentinal | |
| 19:02:49 | ade_lee__ | sean-k-mooney, no - not intentional - thats what we had defeined for nova while testing | |
| 19:03:01 | sean-k-mooney | gmann: actully looking at how those run it proably does not make sense to use a tox target | |
| 19:03:14 | ade_lee__ | sean-k-mooney, we can change if needed | |
| 19:03:19 | sean-k-mooney | ade_lee__: for nova we would want multi node for live migration and colde migration coverage | |
| 19:04:53 | ade_lee__ | sean-k-mooney, ack - so do we want to change in the generic job as defined here - or define a new job? gmann ^^? | |
| 19:05:03 | sean-k-mooney | gmann: we will need to exclude non fips compatible test but we need to include tests form the tempest plugins for ceph ectra | |
| 19:05:41 | sean-k-mooney | so doing that in the job configuation actully proable makes more sense then backing it into a bunch of tox envs | |
| 19:06:45 | sean-k-mooney | ade_lee__: porbaly have both so just inhirt form the current jobs and defien the nodeset to be a multi node variant | |
| 19:07:07 | sean-k-mooney | then the porject can decided which one they want to included | |
| 19:07:57 | ade_lee__ | sean-k-mooney, sounds reasonable to me | |
| 19:08:22 | gmann | sean-k-mooney: ade_lee__ ok, so for multinode case we can inherit from tempest-multinode-full-py3 https://github.com/openstack/tempest/blob/master/zuul.d/integrated-gate.yaml#L230 | |
| 19:08:55 | sean-k-mooney | that also works | |
| 19:09:26 | sean-k-mooney | i was thinking of just inhirting form tempest-centos8-stream-fips and setting the nodeset | |
| 19:09:41 | sean-k-mooney | so you dont have to redfiene the fips specific things in two places | |
| 19:10:33 | ade_lee__ | sean-k-mooney, though presumably you have to refine all the multinode things .. | |
| 19:10:39 | sean-k-mooney | no | |
| 19:10:49 | sean-k-mooney | all the devstack jobs inhrit form multinode | |
| 19:11:06 | sean-k-mooney | so a single node job is a multi node jobs without a second node defiend | |
| 19:11:41 | ade_lee__ | sean-k-mooney, I meant all the things in https://github.com/openstack/tempest/blob/master/zuul.d/integrated-gate.yaml#L232-L242 | |
| 19:12:14 | gmann | ade_lee__: you do not need USE_PYTHON3 as it is default to true in devstack now | |
| 19:12:40 | sean-k-mooney | ade_lee__ none of that is relevent to multi node | |
| 19:13:00 | gmann | ade_lee__: sean-k-mooney so you are saying two jobs 1. existing tempest-centos8-stream-fips 2. new multinode one ? | |
| 19:13:15 | sean-k-mooney | what we need to do is https://github.com/openstack/devstack/blob/master/.zuul.yaml#L179-L207 | |
| 19:13:18 | sean-k-mooney | for centos | |
| 19:13:27 | gmann | if so why not converting the existing one to multinode | |
| 19:13:41 | sean-k-mooney | gmann: we could convert it to multinode | |
| 19:13:58 | sean-k-mooney | but we still need to override the nodeset to use centos-8-stream | |
| 19:14:04 | sean-k-mooney | since the current jobs assumes that | |
| 19:14:24 | gmann | yeah | |
| 19:14:52 | sean-k-mooney | so either in devstack or in tempest we need a openstack-two-node-centos-8-stream nodeset | |
| 19:15:25 | gmann | we need to define that in devstack | |
| 19:15:27 | sean-k-mooney | gmann: i was assumign it would be simpler to get the fips jobs stable single node then add multi node | |
| 19:15:48 | sean-k-mooney | gmann: by convention yes. althoguh its not required by zuul | |
| 19:16:23 | ade_lee__ | sean-k-mooney, we should probably stick with convention .. | |
| 19:16:24 | gmann | sean-k-mooney: we can see what all test fails and if that is multinode related or not. if so then we can separate the efforty | |
| 19:16:40 | sean-k-mooney | ack | |
| 19:16:58 | sean-k-mooney | ok im going to go cook dinner so ill let ye figure out the best way forward | |
| 19:17:18 | ade_lee__ | sean-k-mooney, gmann -- so , as I understand the plan | |
| 19:17:19 | gmann | sean-k-mooney: have a good one. lunch time for me too | |
| 19:17:23 | gmann | ade_lee__: thanks | |
| 19:17:52 | ade_lee__ | 1. merge current patches for single-node (assuming all tests pass, as I suspect they will) | |
| 19:18:03 | ade_lee__ | 2. add nodeset definition to devstack | |
| 19:18:34 | ade_lee__ | 3. add multinode job to tempest with that nodeset -- basically same as single + new nodeset | |
| 19:19:01 | ade_lee__ | 4. add to nova jobs / replace existing job | |
| 19:20:00 | ade_lee__ | thats it .. I think .. | |
| 19:20:01 | gmann | ade_lee__: in 3rd and 4th - let's modify existing job tempest-centos8-stream-fips to use multinode nodeset | |
| 19:20:04 | sean-k-mooney | ya that sounds resonable to me i suspect say keystone wont care about multi node so having both makes sense to me but 3 could be "update single node job to multi node " too as an alternitive | |
| 19:20:27 | ade_lee__ | jinx :) | |
| 19:20:33 | sean-k-mooney | gmann: im ok with either option so ill defer to your preferocne on one job or two | |
| 19:21:24 | ade_lee__ | deferring to ya'll - but I think its likely other projects may not care about multinode too | |
| 19:21:39 | gmann | sean-k-mooney: ade_lee__ let's start with multinode and if things fails more or so then we can have single node and then multinode separate jobs | |
| 19:22:19 | gmann | ade_lee__: sean-k-mooney you mean keystone only right? other projects anyways need to define the new jobs to include their tempest tests from their plugin | |
| 19:23:22 | ade_lee__ | gmann, I'm just thinking that given that we have a common place for fips jobs, other projects might want to use or inherit from them | |
| 19:23:37 | gmann | ade_lee__: ok, inherit is good point. | |
| 19:24:01 | gmann | ok. let's define both in that case. | |
| 19:24:07 | ade_lee__ | cool | |
| 19:24:27 | sean-k-mooney | gmann: i picked keystone at randmon bascially because noting in keystone should affect cold/live migration so keystone proabley dont want to waste ci resouces testing multi node | |
| 19:24:34 | sean-k-mooney | same for glance swift ectra | |
| 19:24:49 | gmann | yeah and even it can be treated as base for other tempest plugin jobs too | |
| 19:25:10 | gmann | so single and multinode jobs as separate sounds good | |
| 19:25:28 | ade_lee__ | cool - sounds like a plan ! thanks ya'll | |
| 19:25:40 | ade_lee__ | go eat! | |