[01:16] jcastro: hahahahah no I made that for the Cloud Days presentation like 3 months ago. ;) [01:24] SpamapS: I didn't know about it before [01:24] I am going to steal it [01:26] jcastro: the one on the wiki is svg ... make sure to steal *that* :) [01:26] We should ask someone on design to prettyfy it [01:26] yeah that would be cool [01:27] I'm hesitant to make the marketing assets more polished than ensemble itself tho ;) [01:27] well, I see people are using it and reporting the annoyances [01:28] robert collins just filed a few [06:34] Good morning all [07:49] fwereade: Morning [07:53] <_mup_> ensemble/trunk r288 committed by gustavo@niemeyer.net [07:53] <_mup_> Merged fix-status-scope branch from Clint [r=bcsaller,fwereade] [07:53] <_mup_> Fixes ensemble status to work with multiple scope filters as per the [07:53] <_mup_> help documentation. Tests were also adapted to reflect the arguments [07:53] <_mup_> one should expect from argparse. === jamespage1 is now known as jamespage [08:08] Morning all [08:17] kim0: Morning! [08:17] niemeyer: hey .. oh you're up so early :) [08:17] kim0: Yeah, I'm actually about to step back to try to sleep some more [08:18] have some nice rest then [08:18] Just couldn't sleep for a while, and decided to get up and do something useful [08:18] Thanks, see you soon :) [08:18] :) [08:22] niemeyer: hey! totally missed you, don't expect people on IRC at this time :p [08:23] nice w/e? [08:23] and hey kim0 ;) [08:23] fwereade: Hey Morning o/ :) [08:35] I think one should expect people on IRC at about any time [08:36] given there's people who live all around the globe (and even have internet access) [10:16] I have a recollection that "fix released" currently means "merged into trunk" rather than actually "released" -- can anyone confirm? [10:17] if so I can mark a couple of bugs "fix released", and tidy up kanban a little [10:25] raphink: yeah pretty much :) [10:40] Hi! Does anyone know if m_3 's psql branch is near ready for inclusion in principia ? https://bugs.launchpad.net/principia/+bug/803841 [10:40] <_mup_> Bug #803841: Formula needed (postgresql) < https://launchpad.net/bugs/803841 > [11:15] SpamapS: oh nice work on the graphic at http://askubuntu.com/questions/55179/what-is-the-purpose-of-the-bootstrapping-instance-ensemble :) [11:15] wonder if that should be added to the bootstrapping section of the user-tutorial [11:56] g'morning [11:58] hazmat: heyhey [12:04] fwereade, how's your day so far? [12:04] * hazmat tries to figure out if there's a way to see what the service-config settings are for a service [12:05] hazmat: ah, not too bad... I think I may have actually just run out of work for the moment, I was about to take a look at some reviews [12:05] once I get confirmation from andres that cobbler-launch-machine works for him I'll have anothe 3 branches to propose [12:06] fwereade, nice re cobbler, that's awesome [12:06] and you; nice weekend? [12:06] hazmat: there are a few more things we need to think about but I've been concentrating on getting parity with the spike branch [12:08] fwereade, quiet weekend, don't remember much of it ;-) spent some time cutting a computer case with with a rotary blade so it could fit some 5x3 drive enclosures, also picked up a 4g hotspot device till my new internet connection is setup (my old isp sucked and 'accidentally' dropped me when i made an unrelated request). [12:08] fwereade, do you have a local cobbler instance for testing or is it based on extraction from the spike w/ mocking? [12:09] my local cobbler is, er, partially working [12:10] most stuff I can test directly, but actually completing a netboot install of oneiric has had a long series of hilarious and bizarre problems [12:10] I might grid my lions and have another go shortly but it's a dispiriting prospect ;) [12:27] btw, hazmat, I was going to take a look at lp:~hazmat/ensemble/security-groups, but I'm a bit confused about its status [12:29] it claims to depend on lp:~hazmat/ensemble/security-connection... which lp thinks exists, but bzr doesn't [12:54] fwereade, it depends on lp:~hazmat/ensemble/security-connection-redux [12:55] fwereade, i'm not sure what happened to security-connection branch, but lp doesn't like it.. the revisions are the same though [12:58] hazmat: heh, ok, thanks :) [13:11] * hazmat pokes at fwereade fds testing work [13:11] * fwereade wishes to make clear he has no idea what he's doing, and really appreciates fixes and explanations ;) [13:12] fwereade, i'm curious to see if we manually run the gc how the numbers change [13:12] hazmat: good idea [13:13] fwereade, alternatively to scanning all fds, it might have been easier to just scan the /proc/pid/fd [13:14] oh.. that's what's its doing [13:15] 'self' [13:15] hazmat: that's what I do, is there some code lying around still doing things the dumb way? [13:15] hey, I don't think I fixed ... er ... the branch it was originally flagged on, whatever it was [13:16] fwereade, yeah my mistake, looks fine, i hadn't seen the 'self' syntax before [13:16] (and it turns out I did fix lp:~fwereade/ensemble/storage-file-objects :)) [13:16] hazmat: cool :) [13:17] one other issue, if a test fails and had temp files/dirs they stick around post test run [13:17] not related to the branch, just a general test issue [13:19] hazmat: I view that as a feature, myself: when a test fails I really like to be able to look at the problematic temp files ;) [13:21] fwereade, so this is actually pointing out alot of failures in things that are okay [13:22] fwereade, the addCleanup calls from lib/mocker.py run after teardown [13:22] which take care of self.makeDir, self.makeFile afaicr [13:22] * hazmat double checks [13:22] hazmat: gaah! nice catch :D [13:22] mocker isn't deferred aware so the ordering is a little odd at times [13:23] hazmat: I assumed teardown happened in tearDown, but you know what they say about assumptions :) [13:23] (they make an ass of u and mptions... hmm, doesn't quite work like that) [13:26] fwereade, i made a one line change to fix it against spurious tests, in the modified _run, if methodName=="tearDown": self.addCleanup(self._diff_fds) [13:26] spurious failures that is [13:26] hazmat: awesome, how much nicer does it come out? [13:27] fwereade, not catching normal operations, reduces the problem almost entirely afaics [13:27] hazmat: and I guess we're pretty safe from having further cleanups added at that point [13:27] fwereade, doing a full run now [13:28] hazmat, brb [13:32] b [13:36] noodles775: currently the basic pg formula works. authentication is wide open and there's no replication. [13:37] hmm, trial has an addCleanup that masks mocker's addCleanup [13:37] k, thanks m_3. [13:37] noodles775: I should get the acls working before inclusion into principia [13:38] fwereade: howdy!! [13:38] RoAkSoAx: heyhey! [13:38] RoAkSoAx: nice weekend? [13:38] m_3: Yep, sounds sane :) I've subscribed to the bug so I'll know when I can try it. Thanks mor working on it! [13:39] fwereade: yeah!! busy though!! how was yours? [13:40] RoAkSoAx: nice, very peaceful, cath and laura were still in the UK for most of it [13:41] noodles775: awesome, I'll keep it updated [13:41] fwereade: cool ;) [13:41] fwereade: anywas, what's your latest branch? [13:42] RoAkSoAx: hmm :) [13:43] RoAkSoAx: shadow-trunk is not yet updated with either lp:~fwereade/ensemble/cobbler-kill-machine or lp:~fwereade/ensemble/bootstrap-verify-storage [13:43] but maybe best to skip bootstrap-verify-storage for now: I think it's good, but it could interact with launch-machine (which is merged) [13:44] and I'd like to be sure of cobbler-launch-machine's status [13:46] fwereade: ok [13:47] fwereade: i'll work on top of shadow-trunk first then [13:47] RoAkSoAx: awesome [13:47] RoAkSoAx: if it looks healthy, I'll merge in 2 more and make 3 merge proposals [13:50] fwereade: awesome! [13:50] RoAkSoAx: it actually works? [13:52] hazmat: I'm sorry, but I'm really confused about your security-* pipeline: would you please tell me exactly what order I should be looking at them in? I'm driving myself slightly insane [13:53] fwereade: havent started yet [13:53] will let you know as soon as I do [13:53] fwereade: im updating all the cobbler-side pieces first [14:03] hazmat: don't worry, I think I've figured it out [14:36] Good morning! [14:37] Hmm.. funny to say that twice in the same day [14:38] Aram, Aram2: Morning to both of you [14:38] hi :-). [14:38] I'm having some issues running the tests. http://pastebin.com/GPkiK7uZ [14:39] * niemeyer looks [14:39] I assume it doesn't parse ~/.ensemble/environments.yaml ? [14:40] Aram2: Hmmm [14:40] Aram2: That's strange.. have you touched any code? [14:40] no. [14:40] latest rev from bzr. [14:40] Aram2: Let me try to run this test [14:40] Aram2: In theory, this test should be mocked [14:40] Aram2: Sorry, I actually mean that this part of the logic should be mocked [14:41] I see. [14:41] Aram2: Test passes here [14:41] Hmm [14:41] * niemeyer reads the test [14:42] how can I run only this tests and not all? [14:42] Aram2: Just take that last string at the end of your paste and put it after ./test [14:43] also, I am using bzr branch lp:ensemble , I assume this is the branch I am interested about. [14:43] ah, ok. [14:43] Aram2: It is indeed [14:43] yeah, test fails. [14:43] ensemble works though. [14:44] Aram2: Phew.. that's actually good [14:44] Aram2: If it passed it'd mean the failure would come from the interaction between tests, and would be harder to debug :-) [14:46] Aram2: Hah [14:47] Aram2: This test is actually broken, nevermind [14:47] heh. [14:47] Aram2: It's just that pretty much all of us have the environment set up [14:47] Aram2: The real env, I mean [14:47] Aram2: Not ~/.ensemble [14:48] aha. [14:48] Aram2: Many EC2 tools depend on the AWS_ACCESS_KEY_ID variable [14:48] Aram2: and it's partner (AWS_SECRET_ACCESS_KEY) [14:48] Aram2: Our tests should not depend on it to run, though [14:49] yeah... [14:49] Aram2: For the moment, you can just disable this test [14:50] <_mup_> Bug #819329 was filed: Tests depend on AWS_ACCESS_KEY_ID being set < https://launchpad.net/bugs/819329 > [14:51] niemeyer, good afternoon ;-) [14:52] hazmat: Hey! [14:54] * hazmat hands off review queue crown to fwereade [14:55] * fwereade peers at it, and tries to put it on his foot [14:58] :-) [14:58] robbiew: heya do you have those 5 reasons narrowed down? I need them for a slide [14:58] yeah...but they aren't "blessed" yet [14:59] need to run them by sabdfl with jono [14:59] * jcastro nods [14:59] they are in the Messaging whatever [14:59] ok [14:59] one of the bazillion ensemble google docs [15:02] :) [15:03] Aram2: How's it going overall, btw? Have you started doing any coding, or still at the understanding phase? [15:04] Aram2: I have been busy a little bit... I have played with ensemble, read he current code and now I'm trying to make Go and Python work together nicely in some way. [15:04] it would be nice if you could call one from the other but unfortunately you can' [15:04] t :-). [15:05] Aram2: Right, agreed [15:05] Aram2: Note that for this experiment, you don't really have to make them play together [15:05] Aram2: The question is more how it'd look like if some pieces were ported over [15:06] yeah. [15:13] <_mup_> ensemble/states-with-principals r302 committed by kapil.thangavelu@canonical.com [15:13] <_mup_> use constant for otp identity key in domain state dict, machine state tracks otp data reference. [15:36] niemeyer, hazmat: security-otp-principal [15:36] intended only to narrow the window of opportunity for a potential attacker, rather than anything stronger? [15:37] fwereade, i'm in progress on a reply on the mp, the nutshell is your assessment is correct, there is a window till the otp is consumed that an attacker can gain access to the persistent principal credentials if they can get ahold of the otp prinicipal/data enroute. [15:38] hazmat: thanks [15:39] is there any way to review "approve so long as you file a bug about this shortcoming when you merge it"? :p [15:39] It would be mitigated by encryption, though [15:39] niemeyer: sorry, what's encrypted? [15:40] fwereade: Nothing.. [15:40] fwereade: It would :) [15:40] niemeyer: ah :) [15:40] For now this is already good progress on top of what we do now [15:40] fwereade, atm i don't see a good way to manage that risk alternatively without a dedicated security agent.. we effectively create the structure with acls referencing the intended principal credentials within the cli which need to get past through at least one other process (which creates the intended connected client/agent) before they get to their destination [15:40] niemeyer: absolutely, I don't want to reject it, just to make sure that we track the fact that it's a potential issue [15:41] fwereade: I know, I'm just explaining as well, rather than attempting to change your feeling about it :) [15:41] niemeyer, encryption of the otp data? the decrypt key needs to be passed as well [15:42] shall I file a bug then, and we can worry about it later? [15:42] niemeyer, fwereade i'm totally open to alternate ideas on this [15:44] hazmat, niemeyer: I think that at some stage in the future a security agent may be a good way around this (we could implement something that really did delete all unhashed records of the otp when it was first accessed) but for now I'm happy with it [15:44] hazmat: No, encrypt of the channel used to communicate back with zk with the key [15:45] hazmat: I think what you have is good progress already [15:45] niemeyer, fwereade its unclear to me if alternate solutions would work well without such an interception gap without implementing a new zk auth mechanism [15:45] hazmat: We can easily hack ZK to implement real OTPs, or other mechanisms in the future [15:45] niemeyer, sounds good [15:45] cool, I'll approve and file [15:45] fwereade: Agreed [15:47] <_mup_> Bug #819379 was filed: otp mechanism is vulnerable to interception < https://launchpad.net/bugs/819379 > [15:48] fwereade, thanks for the reviews! [15:48] hazmat: a pleasure :) [15:53] kim0: thats an older graphic, though updated with new understanding. :) [16:02] m_3: call time? [16:02] robbiew: yup [16:06] * hazmat enjoys googling for ensemble bugs [16:08] Lunch time.. biab [16:14] need to pop out for a little while, bbs [17:04] * niemeyer pops back [17:34] fwereade: so now the orchestra config should provide a storage-url? [17:37] RoAkSoAx: yes [17:38] it seemed foolish to assume it was *necessarily* on the same server as cobbler itself [17:38] fwereade: what's the formatting? http://W.X.Y.Z/abc? [17:38] RoAkSoAx: yep [17:38] fwereade: well kind of but given that the cobbler server was the "orchestra" server it made sense to keep it there [17:39] RoAkSoAx: fair point :) [17:41] fwereade: yes cause the idea is to make orchestra automatically configure the webdav server [17:41] fwereade: and have it up and running post installation and ready to serve ensemble [17:42] fwereade: let's do this, if no storage-url is provided, then assume a default, which would be the [17:42] RoAkSoAx: Agreed, at least defaulting to it sounds like a good plan [17:43] RoAkSoAx: then we can trim that back :) [17:43] sure, happy to add that [17:43] niemeyer: indeed [17:43] fwereade: yeah! that will allow us more flexibility in case someone would like to chagne the storage somewhere else [17:43] RoAkSoAx: ...but still nothassle people by asking them to configure it until they need it [17:43] perfect [17:43] cheers :) [17:44] fwereade: indeed [17:48] m_3, what's the status of the postgres formula ? [17:55] I think it's the end of my day now; RoAkSoAx, I'll probably be back on later to merge that change through the plumbing and into shadow-trunk (and everywhere else it needs to be) [17:55] fwereade: btw.. AFAIK, a "name" on a cobbler system cannot be changed [17:55] fwereade: cool I'll continue my testing [17:57] fwereade: and the changes on setting the provider-state using the UID doesn't really seem relevant because , as far as I can see, to be able to edit a system, you need to obtain the name of the UID [17:57] so at the end it seems to be the same [18:05] daker: in progress... eta few hours [18:06] ok [18:07] daker: have machine-based acls working (pg_hba) [18:33] * negronjl is away: out to lunch [18:51] * niemeyer finds his way through the maze of branches creates by fwereade ;-) [18:51] s/creates/created [19:07] RoAkSoAx: belatedly: I just changed a system name, to prove I could [19:07] RoAkSoAx: there's a rename button in the system list [19:08] RoAkSoAx: I think you *can't* change a name while something else is holding a reference to it though [19:09] fwereade: yeah maybe [19:09] fwereade: btw... [19:09] fwereade: the way how you obtaining the keys for clout-init user-data is broken [19:09] as it makes clout-init to fail [19:09] RoAkSoAx: bah :( [19:10] RoAkSoAx: I thought I was doing it just the same as in EC2, didn't expect *that* of all things to be a problem [19:10] fwereade: http://paste.ubuntu.com/656595/ [19:11] goodness me [19:11] negronjl: does redis support master<->master replication? [19:12] I guess it's travelling a very different path to the one it takes on EC2 [19:16] <_mup_> ensemble/webdav-storage-prereq r318 committed by gustavo@niemeyer.net [19:16] <_mup_> Merged generic-state-ops. [19:16] Please ignore this.. just a temp branch for review [19:17] fwereade: Hmm [19:18] niemeyer: Hmm? [19:18] (sorry, irresistible symetry) [19:20] fwereade: Sorry, just double checking [19:21] <_mup_> ensemble/webdav-storage-prereq r318 committed by gustavo@niemeyer.net [19:21] <_mup_> Merged generic-state-ops. [19:21] niemeyer: I'm fretting that I've done something unforgivably dumb now :/ [19:21] fwereade: No, I'm just a bit stuck on webdav-storage [19:21] fwereade: I can't find the proper review base [19:22] niemeyer: is that one of the ones with 2 parents? [19:22] fwereade: I get a 600 lines diff on it, including things I already reviewed [19:22] I seem to recall it requires cobbler-instance-ids as well [19:22] fwereade: Yes, but I'm taking that into account [19:22] fwereade: Yeah.. I'm merging both of these to form a base [19:22] There's still more, apparently [19:23] niemeyer: hmm, not that I recall... [19:23] niemeyer: I'm being called, bbs, I'll see if I can see what I've done [19:24] fwereade: Hmmm.. part of the diff is within one of the pre-req branches, actually [19:24] fwereade: Maybe it's just the diff that is bogus.. [19:24] fwereade: Let me try something else [19:26] fwereade: Alright, I think I got it [19:26] fwereade: Don't move too fast.. I'll review it quickly before the diff disappears.. ;) [19:27] niemeyer: back, shout if I can help at all [19:27] fwereade: Super, thanks [19:34] robbiew: ping [19:46] SpamapS: no. afaik redis only supports master-slave [19:47] negronjl: I wonder if we can take the redis-master and redis-slave formulas and just make a 'redis' formula.. [19:47] SpamapS: i'll give that a shot [19:48] negronjl: also can redis slaves be promoted to masters? [19:49] negronjl: if thats the case (and not too complicated) then it might make sense to have them work in a ring. [19:49] SpamapS: afaik. yes. still reading a bit about redis [20:17] jcastro: ping [20:18] robbiew: pong === daker is now known as daker_ [20:28] ok, I think that really is it for me for now :) [20:28] nn all === heckj_ is now known as heckj [21:07] niemeyer, the extra security work integrated into domain object creation (service, unit, machine) seems to have some impacts on total test run time, about 25-30% increases, for tests that heavily use the api.. the setup/teardown deltas are under 2%, its just the extra cost of manipulating the additional nodes afaics [21:12] hazmat: Hmm [21:13] hazmat: If you're comfortable the API is the right one, we can move forward with this no matter what [21:13] hazmat: and worry about optimization down the road [21:14] hazmat: We can do tricks like disabling the auth steps under controlled scenarios [21:14] hazmat: But I'd be happier to run them all the time until we're sure they are good [21:15] niemeyer, yeah.. i tried seeing what i can do about optimization now, but i'm not seeing any quick gains, i've got most of the api encapsulated into a class, that i could switch toggle by test [21:15] which might get things a bit closer [21:15] niemeyer, sounds good re goodness [22:43] * niemeyer steps out for watching a movie.. === heckj_ is now known as heckj [23:55] <_mup_> Bug #819562 was filed: ensemble.formula.tests.test_bundle fails on buildds < https://launchpad.net/bugs/819562 > [23:57] <_mup_> Bug #819563 was filed: ensemble.formula.tests.test_bundle.BundleTest.test_executable_extraction fails on buildds < https://launchpad.net/bugs/819563 >