June 2021 - Zuul-discuss - lists.opendev.org

install and use ansible collections in zuul v3 ansible native job?
by Marios Andreou 23 Nov '21

23 Nov '21

hi folks long story short: can we install and use ansible collections in a zuul v3/ansible native job? In the tripleo-ci squad we are trying to use the tripleo_overcloud_image_build role from the tripleo-operator-ansible collection [1]. We are already using other roles from this collection - e.g. there [2]. This is possible because in that case we have zuul calling bash calling ansible... which means we get to configure collections in the bash bit setting ANSIBLE_COLLECTIONS_PATHS [3] before invoking ansible. For the case I'm having trouble with - what i refer to as ansible native - here https://review.opendev.org/#/c/733818/33/roles/oooci-build-images/tasks/mai… we have a zuul job playbook directly trying to install and use a collection. Currently it fails because instead of collections: (doesn't work " 'collections' is not a valid attribute? [4] ) I am trying to use include_role but then it can't find the collection's modules "ERROR! no action detected in task" [5]. I tried to set it in ansible.cfg but that won't work and anyway it is surely the wrong approach. The one thing left to try is to explicitly require ansible 2.9 for the job - but wanted to reach out and see if anyone else has any problems trying to install and use ansible collections (with modules importantly) as part of a zuul v3/ansible native job. thanks for reading and for any comments, marios [1] https://github.com/openstack/tripleo-operator-ansible/tree/master/roles/tri… [2] https://opendev.org/openstack/tripleo-quickstart-extras/src/commit/55e74bb8… [3] https://opendev.org/openstack/tripleo-quickstart/src/commit/299131bcc6dca86… [4] https://23fd78c0f6b01b9c4209-59c294b8f46eb75cda2bd004e2a1c97f.ssl.cf1.rackc… [5] https://2063b7e2bb67f86f8ec5-87fe67c942382c6ee875c514bffa4f21.ssl.cf2.rackc…

3 8

[Diversity] Diversity and Inclusion July Meeting Update
by Amy Marrich 30 Jun '21

30 Jun '21

Due to most US companies having July 5th off, we will be moving the Jully D&I WG meeting Please join us Monday, July 19th at 17:00 UTC in the #openinfra-diversity channel on OFTC. The agenda can be found at https://etherpad.openstack.org/p/ diversity-wg-agenda. Thanks, Amy (spotz)

1 0

Representation at Ansiblefest?
by Jeremy Stanley 22 Jun '21

22 Jun '21

As David mentioned earlier today in #zuul, the CFP[*] for Ansiblefest[**] closes in one week. In the past there have been a number of great 'Fest talks on and related to Zuul as well as Zuul contributors/users in attendance. Is anyone submitting a Zuulish talk this year? [*] https://reg.rainfocus.com/flow/redhat/ansible21/cfp [**] https://www.ansible.com/ansiblefest -- Jeremy Stanley

1 0

lockstep of nodepool / zuul
by Paul Belanger 22 Jun '21

22 Jun '21

Hi, Looking for confirmation, because there is no direct dependency between nodepool and zuul, there is no need to lockstep the 4.0 releases of each right? I'd like to upgrade nodepool first, to confirm TLS is setup propelry, then deal with zuul. Thanks, Paul

2 1

Proposal: gating.dev website
by James E. Blair 16 Jun '21

16 Jun '21

Hi, I have a domain name, gating.dev, that I'd like to turn over to the Zuul community/OIF, if we're interested. Here's my vision for it: * A one-page site that explains/promotes the concept of project gating. * It's not immediately focused on Zuul; if the word "Zuul" shows up, it's probably at the bottom. * Currently, when we talk to people about Zuul and project gating, they don't immediately "get it". We should be able to direct people to this site, and in short order, they should "get it" (ideally, they should want it, but at the least, they should understand it). * The simple URL makes it easy to remember and casually drop into conversations (e.g., twitter threads, etc). * It's not super complex. It's maybe not the place to explain the NNFI or Tarjan's algorithms. * Clear, direct text with images. I think there are folks in this community that can contribute to this far better than I can. I may be kicking this off, but if we relied on me to write the text/images, we'd just end up with another copy of the reference manual, so don't do that. :) Just to try to communicate the framework I'm thinking -- maybe a "hero" sentence at the top to set the stage, then maybe one of those things where there's a row of 3 benefits with nice graphics, then under that there's more text... I just described the Zuul website, so... we could use that structure -- it seems to work for a lot of folks, or maybe someone has an actual different idea. ;) Okay, that's enough rambling from me. Do folks like this idea? Any suggestions to get started? Maybe we can brainstorm here for a bit and if it sounds like the idea has legs, we can set up a new repo for it. -Jim

6 5

Zookeeper and SSL
by Paul Belanger 15 Jun '21

15 Jun '21

Hi! So, I am in the process of enabling SSL on our instance of Zuul and a little surprised to see that no version of Zookeeper in debubuntu repos actually support SSL. The installation docs for Zuul, don't seem to reference how to install zookeeper, expect installing the version that doesn't support SSL. How are others doing this? Does anyone know of an existing PPA to pull zookeeper from? Paul

5 6

Re: Upcoming security release
by James E. Blair 10 Jun '21

10 Jun '21

I just sent the following message to zuul-announce: On 6/10/21 8:59 AM, James E. Blair wrote: > Multiple security issues have been identified in Zuul which could lead > to an exposure of secret data. The Zuul Maintainers have been preparing > fixes to these issues and plan to make a release of Zuul with them on > Thursday, June 24, 2021, around 14:00 UTC. > > Unfortunately, there is no known mitigation for these vulnerabilities, > and so the best advice we can offer for operators is to stop Zuul > shortly before the release, and restart it after updating. > > Additionally, there will be some modification to the functionality > offered by Zuul, which may cause some jobs to fail or behave > differently. More details will be provided along with the release. > > We encourage you to use the time between now and June 24th to ensure > that you are running the latest version of Zuul (4.5.0) in order to > prepare for the update. > > An announcement of the release and accompanying information will be sent > to zuul-announce(a)lists.zuul-ci.org when the release is available. > > Feel free to follow up to zuul-discuss(a)lists.zuul-ci.org or chat with us > in #zuul on OFTC if you have any questions. > In light of that, I think we should consider Zuul development mostly frozen until the release. Please continue to upload and review changes, but let's avoid merging significant functional changes, and limit merges to bugfixes, doc updates, etc. This will provide a stable platform for people to upgrade from 4.5.0 to the upcoming release. Meanwhile, we can continue to +2 changes and stack them up (either as git dependencies or using depends-on) to resume development after the release. -Jim

2 1

AWS driver for Nodepool IAM policies
by Fabien Boucher 08 Jun '21

08 Jun '21

Hi, We plan to use the AWS driver for Nodepool but looking at the documentation [1] it is not clear which IAM policies we need to configure for the Nodepool account. If some of you have experience with the AWS driver could it be possible to share some details about the policy setup for the Nodepool user ? For instance, which actions must be allowed [2] ? Fabien [1]: https://zuul-ci.org/docs/nodepool/aws.html [2]: https://docs.aws.amazon.com/service-authorization/latest/reference/list_ama…

1 0

file sync issue?
by Åsmund Østvold 08 Jun '21

08 Jun '21

Hi, I suddenly experience: 2021-06-08 07:59:39.647866 | 2021-06-08 07:59:39.870542 | PRE-RUN END RESULT_NORMAL: [trusted : review.resoptima.net/zuul/irma_config/playbooks/base/pre.yaml@master] 2021-06-08 07:59:39.870861 | RUN START: [trusted : review.resoptima.net/zuul/irma-common-jobs/playbooks/build_and_integrationt…] 2021-06-08 07:59:41.191318 | 2021-06-08 07:59:41.191500 | PLAY [Role run build.sh] 2021-06-08 07:59:41.228238 | 2021-06-08 07:59:41.228438 | TASK [buildsh.zuul : runs-build.sh-in-folder] 2021-06-08 08:00:45.088247 | ubuntu-bionic | + hostname 2021-06-08 08:00:45.088748 | ubuntu-bionic | stenant01 2021-06-08 08:00:45.088788 | ubuntu-bionic | + cd src/review.resoptima.net/zuul/irma-common-jobs 2021-06-08 08:00:45.088797 | ubuntu-bionic | + ../../resoptima/tools/automation/cleanup_and_setup.sh 2021-06-08 08:00:45.089124 | ubuntu-bionic | /bin/sh: 5: ../../resoptima/tools/automation/cleanup_and_setup.sh: not found I have sufficient disk on the node. Any idea what could be wrong? Cheers, Åsmund

1 1

Last call on two specs
by James E. Blair 04 Jun '21

04 Jun '21

Hi, The following specs have undergone several review cycles and I think they may be in or near their final state. I'd encourage anyone with an interest to review these and leave feedback. Zuul Maintainers, I'd like to merge these in a little over one week, on June 11, if there are no significant objections noted in review. If you need more time, please leave a review message to that effect, and we can extend the deadline. * Add spec for enhanced regional executor distribution https://review.opendev.org/663413 * Add Spec on Resource Quota per Tenant https://review.opendev.org/788481 -Jim

1 1