openSUSE admin

2017-04-09 #opensuse-admin

[20:00:21] <tampakrap> so let's start?

[20:00:32] <cboltz> yes ;-)

[20:01:36] <pjessen> yup

[20:01:44] <skriesch> yes

[20:01:49] <orangecms> Go go go :)

[20:02:44] <tampakrap> good

[20:02:48] <tampakrap> who's here?

[20:03:06] * orangecms me

[20:03:11] * cboltz hides

[20:03:26] <skriesch> me

[20:03:31] <tampakrap> cboltz: we have topics list?

[20:03:39] <cboltz> https://progress.opensuse.org/issues/17528

[20:03:43] <pjessen> me

[20:04:09] <cboltz> (+ https://progress.opensuse.org/issues/17272 for the definition of "everything" in "status report about everything" ;-)

[20:04:41] <sysrich> Hi Heroes - just FYI, I will be chasing up with MF IT the stuck DNS migration this week

[20:04:41] <tampakrap> okay wanna chair this meeting?

[20:05:08] <cboltz> why not ;-)

[20:05:10] <sysrich> no I do not want to chair the meeting, pure luck that I gave this FYI at the time for your meeting ;)

[20:05:27] <skriesch> Thanks! :)

[20:05:49] <tampakrap> sysrich: was talking to cboltz :) thanks for the update

[20:06:19] <cboltz> sysrich: can you share some details how you managed to get root access in Provo? Or is everything top secret?

[20:06:56] <cboltz> I have to admit that I didn't even hope that this would work ;-)

[20:06:58] <sysrich> cboltz, I took a page out of the cboltz guide to getting things done - Keep on asking, and if you don't get an answer you like, ask someone else ;)

[20:07:46] <cboltz> ;-)

[20:07:56] <cboltz> hi Lars!

[20:08:07] <cboltz> so, first planned topic - questions and answers from the community

[20:08:10] <sysrich> cboltz, I'm not sure I have everything - didn't have much time last week with Beta 1, but I hope to have a look at it this week. I know for sure I have the wiki and www, not sure where the rest is on the server, but I got DB dumps for lizards and news at least

[20:08:49] <cboltz> sounds good

[20:09:19] <cboltz> you and mmaher_ should be able to get DB dumps for the wiki yourself - just run mysqldump on the wiki VMs ;-)

[20:10:07] <skriesch> We had a mail by Aleksa on opensuse-project.

[20:10:44] <cboltz> right, the idea about using kubic

[20:11:01] <tampakrap> opensuse-project mailing list or IRC channel?

[20:11:08] <skriesch> mailing list

[20:11:12] <tampakrap> link please?

[20:11:15] <skriesch> What is k8s?

[20:11:24] <sysrich> skriesch, kubernetes

[20:11:28] <orangecms> ubernetes

[20:11:33] <orangecms> yes, with k :D

[20:11:44] <cboltz> tampakrap: http://lists.opensuse.org/opensuse-project/2017-04/msg00004.html

[20:12:02] <skriesch> I didn't know what to answer there...

[20:12:13] <skriesch> I wnted to wait until now. ^^

[20:12:22] <sysrich> SUSE is making a kubernetes based product called 'CaaSP' - Aleksa is working on it. It's basically a small, focused, cut down version of SLES with fancy features like transactional updates for creating easy, scalable, container based clouds

[20:12:42] <sysrich> 'Kubic', aka 'openSUSE Kubic' is a half-announced new openSUSE Project, basically all the CaaSP stuff open sourced

[20:12:51] <tampakrap> correct, there's nothing to reply as there is no question there

[20:13:12] <cboltz> there's one problem in this mail: "once it's ready" ;-)

[20:13:13] <skriesch> Ok.

[20:13:15] <lrupp> skriesch: what do you want to answer? That he is welcome to join the heroes and start working on applications? ;-)

[20:13:25] <tampakrap> he wants when his project will be finished to be used in the official opensuse infra

[20:13:29] <sysrich> lrupp, that's what I told him privately ;)

[20:13:34] <skriesch> Why not? ;-)

[20:14:03] <lrupp> Looks like we all have the same mindset already ;-)

[20:14:47] <cboltz> indeed ;-)

[20:15:06] <cboltz> any other questions from the community?

[20:16:22] <cboltz> doesn't look so, so let's continue with the status reports

[20:17:21] <skriesch> Let's do so.

[20:17:31] <cboltz> sysrich already told us that he'll poke MF-IT about the DNS migration again

[20:17:46] <lrupp> sysrich: thanks!

[20:17:58] <cboltz> so let's hope this becomes a nice easter egg ;-)

[20:18:12] <lrupp> should I repeat my report I sent to the mailing list already?

[20:18:44] <cboltz> a quick summary might be useful (no need for all details)

[20:19:05] <lrupp> ok

[20:19:09] <skriesch> We should send sysrich my easter message of TI. ;-)

[20:19:20] <lrupp> status.opensuse.org => IMHO ready to get announced and moved into "production"

[20:19:47] <cboltz> skriesch: good idea ;-)

[20:19:57] <lrupp> news on progress vs. articles on news.opensuse.org => we might use progress news more often to update ourselfs

[20:20:04] <skriesch> I'll do it at home...

[20:20:25] <lrupp> once we have finish some thing that is useful also for the community, I would post it to news.o.o

[20:20:52] <lrupp> but via the progress news, we can inform us about some work that has been done ...

[20:20:57] <skriesch> :Thumbs up:

[20:21:01] <tampakrap> +1

[20:21:06] <cboltz> agreed

[20:21:16] <lrupp> this will not obsolete the mailing list, but widens up the status updates to our users

[20:21:37] <tampakrap> lrupp: you or someone with privs will have to replicate the news articles, most of us don't have access there

[20:21:52] <lrupp> So, if some team/someone has done something regarding administration, he should sent an update note to the mailing list AND (optional) put some news on progress

[20:22:06] <lrupp> tampakrap: this is something we should fix soon

[20:22:35] <lrupp> We might re-use stuff over and over again - but this way we should reach our community

[20:22:49] <lrupp> Next Status report: openSUSE Cloud in Provo

[20:23:01] <skriesch> Martin created a ticket for getting such access on new.o.o 2 years ago. And it is assigned to Henne...

[20:23:27] <tampakrap> I wouldn't mind if it goes through the news@o.o guys actually, they might have suggestions on how to make the post better/more interesting

[20:23:41] <lrupp> The sync of 12TB from NUE to Provo is work in progress - I hope we can push changes in the future (the bandwidth at the moment is limited to avoid traffic problems

[20:24:30] <cboltz> sounds like it will become a full mirror

[20:24:37] <lrupp> right: the guys behind news@o.o can not only review the articles before they get online, they often enough have good ideas for better marketing speech ;-)

[20:24:41] <cboltz> do those 12 TB include all OBS repos (including home:*)?

[20:24:44] <skriesch> How much time do they need to get better bandwith? ....

[20:24:54] <lrupp> cboltz: yes, this is the plan - but I need to figure out if this will work in the end

[20:25:38] <lrupp> skriesch: this is not clear at the moment. The "good" thing is that the current sync goes via internal network (MPLS)

[20:25:47] <cboltz> we have a ticket saying that there's no OBS mirror in USA, so it would be very good to have one ;-)

[20:26:03] <lrupp> the final setup need to go via the public bandwidth, which is not so good - that's why i need to play a bit with the setup.

[20:26:16] <skriesch> That is a good idea and a step forward. ;-)

[20:26:20] <lrupp> But I hope that we can provide at least the updates and distribution repos

[20:27:03] <cboltz> actually OBS repos might be more interesting

[20:27:12] <lrupp> everything else behind /repositories/ is optional for me at the moment - while I hope to get at least the big 320GB chunk alway up-to date

[20:28:10] <tampakrap> speaking about provo, I have saltmaster(s) ready there as well, waiting for the connection to come alive to connect it with the nuremberg ones

[20:28:21] <lrupp> cboltz: at the moment we need to start - and I'm planning to start "big", while this might be a problem later, when it comes to contunious updates. But this is something we can just try out in "production"

[20:28:33] <lrupp> tampakrap: good news! Thanks!

[20:28:57] <lrupp> tampakrap: I definitively need a training session with you to learn more about the setup of the salt repos

[20:29:15] <lrupp> Status report: DNS of opensuse.org

[20:29:17] <tampakrap> sure

[20:29:23] <cboltz> yeah, mirrorbrain will handle any fallout, so trying in production sounds good

[20:29:35] <lrupp> => I would hand that over to sysrich at the moment. The SUSE-IT part is done

[20:29:56] <lrupp> Just want to remind everyone that the freeipa installation is now in production mode

[20:30:14] <lrupp> Status report: Monitoring and status page

[20:30:15] <tampakrap> so we can start integrating it with services?

[20:30:18] <tampakrap> eg gitlab?

[20:30:31] <lrupp> tampakrap: yes, this is also part of the monitoring status report

[20:30:44] <lrupp> I setup the monitoring to allow accounts from our freeipa installation

[20:30:59] <lrupp> so people with a freeipa account should be able to log in on monitor.opensuse.org/icinga/ already

[20:31:08] <lrupp> sadly at the moment that are just 3 ...

[20:31:11] <tampakrap> okay can you send me details on the ldap structure etc so I can test it?

[20:31:26] <skriesch> I hadn't a lot of time...

[20:31:42] <skriesch> I have to give a Linux workshop next Wednesday.

[20:31:54] <tampakrap> and give me access to the freeipa installation, then I could handle creating the rest of the accounts

[20:32:03] <lrupp> tampakrap: AuthLDAPURL "ldaps://$internal_freeipa_ip/cn=users,cn=accounts,dc=infra,dc=opensuse,dc=org?uid"

[20:32:05] <skriesch> The good thing. Our easter holidays will start next week. :)

[20:32:06] <tampakrap> I have already the list of the needed accounts in gitlab

[20:32:14] <lrupp> tampakrap: it's very basic LDAP auth

[20:32:16] <skriesch> I'll do it.

[20:32:42] <lrupp> I guess we should work on the openVPN setup, to allow every hero to access the WebUI

[20:32:55] <tampakrap> agreed

[20:33:02] <lrupp> tampakrap: you already have an account there - darix should have sent you your credentials

[20:33:08] <tampakrap> ah yes I remember

[20:33:17] <tampakrap> we were setting it up together duh :P

[20:33:39] <tampakrap> okay so AI for me, integrate it with gitlab and create all the remaining accounts

[20:33:50] <lrupp> does someone know who wanted to setup the openVPN ?

[20:34:06] <skriesch> I believe, that was darix...

[20:34:17] <lrupp> tampakrap: we might have a interesting problem here ... ;-)

[20:34:23] <tampakrap> mcaj is also interested, not sure if he has time though

[20:34:35] <lrupp> I guess we want to use freeipa to authenticate the openVPN users, right ... ?

[20:34:53] <tampakrap> yes

[20:35:11] <lrupp> So we need to create their accounts first and ask them to login to openVPN to change their password afterward, right?

[20:35:29] <tampakrap> correct

[20:35:30] <lrupp> which - if successful - should log them out immediately :-)

[20:35:45] <tampakrap> from freeipa, not from openvpn

[20:35:48] <lrupp> but this should be ok from my point of view

[20:35:59] <lrupp> tampakrap: ah, yes, you are right.

[20:36:55] <lrupp> tampakrap: btw: you also need the ca-certificates-freeipa-opensuse package from openSUSE:infrastructure to make the ldaps work

[20:37:08] <cboltz> for the records - the tickets from the offsite meeting say tampakrap for the NBG VPN and darix for the Provo VPN - but I won't complain if someone else does it ;-)

[20:37:10] <lrupp> if you setup the authentication

[20:37:25] <tampakrap> this package is in the common packages in salt, so installed in all salt-managed machines

[20:37:37] <lrupp> ok

[20:37:50] <lrupp> Status update for www.opensuse.org / auth-provider for openSUSEso my last status update:

[20:37:59] <tampakrap> so for the openvpn I could ask mcaj and darix if they are still interested and start working on it

[20:38:11] <lrupp> Matthew already answered to my email, so I hope we see some progress there in the next weeks, too

[20:38:40] <lrupp> tampakrap: I can setup by and help if they don't have time. But only then ;-)

[20:38:50] <tampakrap> ack

[20:39:13] * cboltz notes down that lrupp will do it ;-)

[20:39:19] <lrupp> that's it from my side.

[20:39:35] <cboltz> that was a lot - thanks!

[20:39:36] <lrupp> cboltz: if needed, yes. But I don't want to block other people from learning ;-)

[20:40:01] <lrupp> need to go back to the party again - will join back in 10minutes

[20:40:03] <tampakrap> thanks lrupp

[20:40:06] <lrupp> sorry

[20:40:43] <cboltz> so, next status report - tickets

[20:41:07] <cboltz> the number of open tickets is slightly increasing again, so I'd like to remind everybody to work on the tickets

[20:41:31] <tampakrap> it was down because progress.o.o ticket creation was broken twice haha

[20:41:43] <skriesch> But we aren't allowed to use Due Dates any more...

[20:41:43] <pjessen> lets break it again ...

[20:42:03] <pjessen> huh, I just did today.

[20:42:07] <tampakrap> skriesch: what do you mean?

[20:42:44] <skriesch> Christian and I received a message by sysrich, that Max and Gerhard don't like it.

[20:42:48] <cboltz> pjessen: no problem if you do it for your own tickets (to enforce getting reminders) or if someone allowed you to set a due date

[20:43:00] <skriesch> We aren't allowed to set it any more.

[20:43:40] <pjessen> who determines who is "allowed" ?

[20:44:03] <tampakrap> cboltz: +1

[20:44:07] <skriesch> mmaher Tell pjessen all....

[20:44:08] <cboltz> typically the assignee - because he/she will get the reminders

[20:44:31] <sysrich> I wouldn't say it's not "allowed" - I have a strong, philisophical dislike when the openSUSE project has some people imposing deadlines on other people

[20:44:58] <sysrich> we don't allow contributors to set Bugzilla priorities of other contributors, because it can hurt their feelings, and I would strongly please that the Heroes consider the same with Due Dates

[20:45:22] <sysrich> ie. I have no problem if Heroes set Due Dates themselves, for themselves, but I worry about how people feel when other contributors are giving them deadlines

[20:46:11] <tampakrap> I agree

[20:46:25] <cboltz> I get the point and agree with it

[20:46:31] <pjessen> I guess I am not quite aware of who these other contributors are.

[20:46:33] <skriesch> I agree, too

[20:47:03] <cboltz> nevertheless, as much as I hate to say it, the due dates helped to finally handle *lots of* tickets ;-))

[20:47:52] <tampakrap> I still believe it was accidental, the mass handling of tickets happened during suse's hackweek :)

[20:48:21] <cboltz> indeed, that might also be a reason

[20:49:14] <sysrich> I need to disconnect, anything else I can help with before I do?

[20:50:08] <cboltz> sysrich: I don't see anything for you on my list, so enjoy the evening - and maybe read the IRC log tomorrow ;-)

[20:50:37] <tampakrap> sysrich: thanks, have a nice evening

[20:50:41] <sysrich> thanks..and thank you Heroes for doing such an awesome job - I'm really happy with the direction of our infrastructure and want to do what I can over the next year to help get more people involved in this awesome taem

[20:50:42] <sysrich> team*

[20:51:23] <cboltz> :-)

[20:51:30] <skriesch> :-)

[20:52:26] <cboltz> so, next status report: wiki

[20:52:54] <cboltz> I was busy with some other stuff, so there's not too much progress

[20:53:32] <skriesch> You wrote something about an update...

[20:53:38] <cboltz> I'm working on moving the salt stuff to our official salt repo (right now, the test wiki uses a separate salt master for historical reasons)

[20:54:17] <tampakrap> we need to set up the gpg encryption for pillars urgently

[20:54:27] <tampakrap> and salt-mime

[20:54:47] <cboltz> this includes some cleanup of TODO items, so it takes some time, but it also means we'll have a clean salt repo afterwards

[20:55:18] <cboltz> tampakrap: yeah, password handling is one of the missing parts

[20:56:10] <cboltz> (not a real blocker - in worst case, I'll use an unmanaged PHP file on the wiki VM, but having it in salt would of course be better)

[20:56:36] <tampakrap> no don't do it please, no workarounds

[20:56:45] <tampakrap> since we have the solution, let's work on it

[20:57:41] <cboltz> I sayd "worst case" ;-) - and that implies "temporary"

[20:57:54] <cboltz> and yes, I completely agree that doing it right[tm] is much better

[20:58:05] <tampakrap> there's nothing more permanent than a temporary workaround :P

[20:58:05] <cboltz> so - when will it be ready? ;-)

[20:58:32] <tampakrap> well no idea, never did it again, but you could also give it a try

[20:58:47] <tampakrap> I only read the doc and it seems straightforward

[20:59:40] <pjessen> will need to leave now, sorry - I'll check the log tomorrow for the rest. See ya later.

[20:59:57] <cboltz> IIRC thomic offered to do it some weeks ago, so I'll ping him tomorrow

[21:00:08] <tampakrap> pjessen: thanks, cya

[21:00:12] <skriesch> I have to leave you in some minutes. I arrive Nuremberg.

[21:00:38] <tampakrap> no thomic offered to do the password-store repository

[21:01:14] <tampakrap> not related to salt

[21:01:33] <cboltz> that at least sounds like "half of it" ;-)

[21:02:15] <tampakrap> they are not related, it is a different repository with gpg encrypted passwords that we can manipulate using the `pass` tool (password-store package)

[21:02:25] <tampakrap> the gpg encrypted pillars need setup on the saltmaster

[21:02:29] <skriesch> Bye. I'll read the rest tomorrow.

[21:02:39] <tampakrap> skriesch: bye, thanks

[21:03:32] <cboltz> sounds like you know more about it than I do ;-)

[21:04:20] <tampakrap> so most people left, anything else to discuss or should we end the meeting?

[21:04:30] <cboltz> the next wiki-related topic is authentification

[21:04:40] <cboltz> lrupp: are you back or still on the party?

[21:05:19] <tampakrap> isn't this what matthew replied on at the mailing list?

[21:05:30] <cboltz> it looks like we can choose between openID and LDAP

[21:05:43] <cboltz> since I already tested openID and it would need some coding -

[21:06:00] <cboltz> who can help me to get the needed parameters for LDAP?

[21:06:39] <tampakrap> me, darix and lrupp

[21:07:09] <cboltz> ok, so I'll ping one of you in the next days when I have the LDAP extension installed

[21:08:28] <cboltz> on the positive side - authentification is one of the last big roadblocks for the wiki :-)

[21:09:54] <cboltz> that's it for the wiki from me

[21:10:38] <cboltz> let me check the remaining topics...

[21:11:24] <cboltz> we still didn't decide on the VM naming pattern

[21:11:57] <cboltz> but since several people already left, we'll probably have to move that once more or (better/faster) discuss it on the ML

[21:12:20] <tampakrap> yes it needs to be discussed either at the ML, or even better at our next offsite during oSC

[21:12:23] <tampakrap> or both

[21:13:19] <cboltz> some VMs created until then might end up with a "wrong" name, but that shouldn't be a big problem ;-)

[21:13:57] <tampakrap> the name is not the problem that much, as it is the domain

[21:14:23] <tampakrap> the name has to be a unique string across all locations/networks, the domain though is a huge topic

[21:15:37] <cboltz> can you re-start the discussion on the ML?

[21:15:52] <tampakrap> I can't till pretty much the end of month

[21:16:32] <cboltz> can you give a quick summary why the domain is a huge topic?

[21:16:46] <tampakrap> sure, in short

[21:17:37] <tampakrap> 1) the current situation is a mess, at the "DMZ" we have opensuse.org, build.opensuse.org, suse.de, suse.com, openqa.opensuse.org, infra.opensuse.org

[21:17:52] <tampakrap> 2) we should probably use different domain per network (needs discussion)

[21:18:10] <tampakrap> 3) we should have the purpose of the machine on the domain (production/infra, staging, testing)

[21:18:22] <tampakrap> 4) we should have the location on the domain (needs discussion)

[21:19:20] <cboltz> 1) indeed sounds funny ;-)

[21:19:49] <cboltz> 2), 3) and 4) are already included in the discussion on the ML

[21:20:13] <cboltz> there were some different opinions on the order, but IIRC in general nobody was against it

[21:20:47] <tampakrap> yes but to whatever we decide, we will need to have DNS and freeipa totally ready to be able to do mass changes with minimal to no downtime

[21:21:19] <cboltz> of course

[21:21:49] <tampakrap> so let's focus on these first

[21:22:10] <tampakrap> darix set up the slave DNS in salt directly through me proxy-committing btw, one step closer

[21:22:37] <cboltz> yeah, I've seen it in the salt repo :-)

[21:23:27] <orangecms> I need to leave, see you next time

[21:24:16] <tampakrap> bye orangecms, thanks

[21:24:44] <cboltz> the naming scheme was the last topic, so IMHO we can close the meeting ;-)

[21:25:15] <tampakrap> salt: global vs. role-specific pillar data

[21:25:20] <tampakrap> this one you want to discuss it?

[21:25:54] <cboltz> basically yes, but since most people already left, we are still at the "let's agree to disagree" state ;-)

[21:26:23] <tampakrap> can you remind me first what is it about?

[21:27:01] <cboltz> it's about putting pillar data in common.sls vs. putting it in role-specific files

[21:27:16] <cboltz> for example mysql server settings which are only relevant to the mysql server role

[21:27:39] <tampakrap> ah yes

[21:27:43] <tampakrap> didn't agree on that one?

[21:28:06] <tampakrap> we can put it in the role, and if we have to use it on more than one roles we either move them to common.sls or to another common role between them

[21:28:16] <tampakrap> it could be handled based on case

[21:28:20] <tampakrap> I remember wrong?

[21:28:43] <cboltz> IIRC you prefered to have nearly everything in common.sls back then

[21:29:01] <cboltz> but I won't complain about what you just said ;-)

[21:29:29] <cboltz> because that's what I'd also like

[21:29:49] <tampakrap> I prefer common.sls yes, to avoid moves between files as less as possible

[21:30:03] <tampakrap> and it is easier to first go to common.sls instead of searching in roles

[21:30:14] <tampakrap> but your solution works as well and I don't object with your arguments

[21:30:39] <cboltz> :-)

[21:30:46] <cboltz> so the summary is:

[21:30:59] <cboltz> if something is only needed for a specific role, put it into that role

[21:31:24] <cboltz> and if something is needed for multiple roles (now or in the near future), put it in common.sls

[21:31:41] <tampakrap> sure, which means we can start moving stuff from salt:master to the saltmaster role

[21:32:20] <tampakrap> wanna do it?

[21:32:55] <cboltz> I'm not really bored, but I should find some time for it ;-)

[21:33:29] <tampakrap> good

[21:34:24] <cboltz> is there another topic I missed?

[21:34:55] <tampakrap> nope

[21:35:14] <cboltz> ok, then let's finally close the meeting ;-)

[21:35:34] <cboltz> the next meeting will be 2017-05-07 at the usual time

[21:36:09] <cboltz> I'll create a ticket for it later

[21:36:39] <tampakrap> good thanks

[21:36:49] <cboltz> thanks everybody for joining the meeting and for all the work you do!