16:29:42 #startmeeting fedora_coreos_meeting 16:29:42 Meeting started Wed Jun 22 16:29:42 2022 UTC. 16:29:42 This meeting is logged and archived in a public location. 16:29:42 The chair is travier. Information about MeetBot at https://fedoraproject.org/wiki/Zodbot#Meeting_Functions. 16:29:42 Useful Commands: #action #agreed #halp #info #idea #link #topic. 16:29:42 The meeting name has been set to 'fedora_coreos_meeting' 16:29:51 #topic roll call 16:29:59 .hello siosm 16:30:00 travier: siosm 'Timothée Ravier' 16:30:41 .hi 16:30:42 bgilbert: bgilbert 'Benjamin Gilbert' 16:30:50 .hi 16:30:51 Gris: Sorry, but user 'Gris' does not exist 16:30:56 .hello2 16:30:57 jlebon: jlebon 'None' 16:31:17 .hi 16:31:18 ffmancera: ffmancera 'Fernando F. Mancera' 16:31:32 #chair bgilbert jlebon ffmancera Gris 16:31:32 Current chairs: Gris bgilbert ffmancera jlebon travier 16:33:29 low turn out :/ 16:34:32 ./ I am from kubevirt network team and kubernetes-nmstate maintainer 16:34:40 #chari qinqon 16:34:44 Welcome! 16:34:51 #chair qinqon 16:34:51 Current chairs: Gris bgilbert ffmancera jlebon qinqon travier 16:34:57 .hi 16:34:58 dustymabe: dustymabe 'Dusty Mabe' 16:35:00 hi qinqon! 16:35:03 #chair dustymabe 16:35:03 Current chairs: Gris bgilbert dustymabe ffmancera jlebon qinqon travier 16:35:04 * bnemec lurks 16:35:12 #chair bnemec 16:35:12 Current chairs: Gris bgilbert bnemec dustymabe ffmancera jlebon qinqon travier 16:35:48 Let's get started. How about we start with nmstate as folks are there? 16:35:49 .hi 16:35:50 mnguyen: mnguyen 'Michael Nguyen' 16:35:54 #chair mnguyen 16:35:54 Current chairs: Gris bgilbert bnemec dustymabe ffmancera jlebon mnguyen qinqon travier 16:36:04 #topic Action items from last meeting 16:36:07 o/ 16:36:07 hi, I am on the openshift networking team 16:36:18 #chair nemric jaime 16:36:18 Current chairs: Gris bgilbert bnemec dustymabe ffmancera jaime jlebon mnguyen nemric qinqon travier 16:36:51 Action items 16:36:51 cverna to open ticket for FCOS as an edition and update 16:36:51 jlebon to open investigation tickets for the IMA/FIDO changes 16:37:26 #action cverna to open ticket for FCOS as an edition and update 16:37:39 Re-actionning this one given that cverna what out for a while 16:37:46 jlebon: any update on yours? 16:38:00 travier: i did not do that yet, so we can re-action it 16:38:08 +1 16:38:17 #action jlebon to open investigation tickets for the IMA/FIDO changes 16:38:38 #topic New Package Request: nmstate-libs and nmstate 16:38:45 #link https://github.com/coreos/fedora-coreos-tracker/issues/1175 16:39:05 bgilbert maybe for the summary? 16:39:32 sure 16:39:55 there have been a couple changes since we last discussed this 16:40:42 first, qinqon has contributed coreos-installer support for nmstate configs: https://github.com/coreos/coreos-installer/pull/864 16:40:59 🎉 16:41:05 Awesome! 16:41:05 this will allow coreos-installer iso/pxe customize commands to take a --network-nmstate option similar to --network-keyfile 16:41:19 it'll pre-render the nmstate configs to keyfiles and embed them in the ISO/PXE image 16:41:46 this allows nmstate configs to be applied to the live system (including the Ignition run) and the installed system (including the Ignition run). 16:42:03 the downside is: because nmstate is being run off-node, it doesn't have an opportunity to validate the config on the running system. 16:42:19 but the upside is: the resulting config affects the Ignition run. 16:42:29 (other downside: bare-metal only) 16:42:58 So trade offs, but looks cool 16:43:20 second: a separate use case is putting nmstate configs in Ignition and having them applied at runtime. 16:43:48 this allows more validation, but by design, Ignition itself can't affect the Ignition run, so it'd only affect the real root. 16:44:28 if we supported this, both features could be used together: use --network-nmstate to bootstrap just enough network config to get Ignition talking to internal servers, then put the rest of the nmstate config inside the Ignition config and allow it to be validated at runtime. 16:44:58 validation in that case happen post-pivot, right? 16:45:08 yes 16:45:41 the nmstate team has agreed to support an /etc/nmstate directory, and add a systemd unit to take its contents and apply them to the running system: https://github.com/nmstate/nmstate/pull/1936 16:45:48 #link https://github.com/coreos/coreos-installer/pull/864 16:45:56 #link https://github.com/nmstate/nmstate/pull/1936 16:46:21 Anything specific blocking at Ignition run time validation of nmstate files? 16:47:11 travier: hmm, I don't know whether nmstate can validate nmstate configs without also applying them 16:47:11 I see the validation as slightly less useful if it happens post pivot.. i.e. we make it to the real root anyway and the system could "limp along" in a half configured state.. that being said, it's really no different than someone offering keyfiles today 16:47:28 we could in theory chroot run nmstate to validate before pivoting 16:47:29 dustymabe: that's the thing. Ignition doesn't guarantee that the configs it's writing out are valid 16:47:47 in general 16:47:56 bgilbert: good point 16:48:00 yeah, just making notes 16:48:03 +1 16:48:13 sure, but what if we could? (not saying we must) 16:48:25 travier: if we could, then we can :-) 16:48:38 qinqon jaime WDYT? 16:48:41 travier: that can also be added as a retrofit without a compat break IIUC 16:48:49 since the config is already invalid, we're just catching it earlier 16:49:20 one other note: --copy-network 16:49:29 Is it possible to validate nmstate config files from the initrd whitout applying them? 16:49:50 (question above for the nmstate folks) 16:49:56 travier: validation is done checking state after apply on the final system state 16:50:07 AIUI (nmstate people, please correct me if I'm wrong), nmstate could be used at the live ISO prompt to configure the network, which would cause NM keyfiles to be written into /etc, and then the user could use coreoos-installer install --copy-network to propagate them to the installed system 16:50:10 nmstate can do memory only apply and verification if NetworkManager provide dbus interface in intrd 16:50:10 similar to the `nmtui` flow 16:50:38 bgilbert: +1 16:50:58 Gris: what does "memory only apply" mean here? 16:51:35 do not write persistent network configuration, only ask NetworkManaget to set the network and nmstate do verification afterwords. Nmstate will rollback if verfifcation failed. 16:51:42 I think validating in initrd would be problematic because NetworkManager isn't actually running and neither are some other services like openvswitch that might be required by the config. 16:52:13 Gris: right, but that does actually affect the NICs on the running system, it just doesn't write out the config to disk 16:52:19 correct? 16:52:22 dustymabe: correct 16:52:28 +1 16:52:45 bgilbert: the --nmstate-network options would be the same `nmstatectl gc` + `--copy-network` I think 16:52:46 ok I think we should separate the "validation in Ignition" thread into a later discussion 16:53:02 or rather "validation in initramfs" 16:53:07 +1 to separating out validation 16:53:08 Gris: re. https://github.com/nmstate/nmstate/pull/1936, i think that's the case but to confirm: after application, the .applied nmstate files are no longer used in any way and the generated NM keyfiles become source of truth? 16:53:08 Can the live system run with a different set of network kernel arguments than the real root? Can this influence any validation in one place or the other? 16:53:11 qinqon: +1 16:53:13 yes, looks like this is more complex 16:53:30 Well, I think (please Gris correct me if I am wrong), that nmstate is doing early validation. So it will report failures if the nmstate config is wrong.. that should detect not compatible options, etc.. 16:53:52 jaime: network _kernel_ arguments are sorta out of scope here, I think. we're generally trying to discourage their use 16:53:56 jaime: but yes, they're independent 16:54:01 jlebon: Correct. once applied(verified), it is NetworkManager's work/config to persistent the network config on reboot. 16:55:05 so, since we now have a path to applying nmstate configs from the Ignition config, I propose that we consider shipping nmstate in FCOS 16:55:06 ffmancera: Nmstate has two stage of checking. Pre-applied check for know limitations and typo, after-applied verification for kernel or hardware limitations. 16:55:51 👍 16:56:00 Gris: so in this case the pre-applied check for known limitations could be useful.. what do you think? 16:56:35 Maybe we should run that in Butane / Ignition as part of config validation? 16:57:06 That would already happen as part of the processing for --network-nmstate, right? 16:57:32 ffmancera: `nmstatectl gc` already has pre-applied check, but of course without accessing host network current status, these check are limited. 16:57:33 via coreos-installer yes, but not for independently written config 16:57:34 travier: that's relatively easy in coreos-installer because nmstate has a Rust crate. in Go it'd be harder 16:57:35 s* 16:57:56 bnemec: yes same as `nmstatectl gc` does 16:57:59 bgilbert: yes, that's what I'm worried about too 16:58:17 Gris: +1 nice that simplifies the story 16:58:29 I don't think we should necessarily expect a higher bar than already exists for deploying NM keyfiles 16:58:37 travier: nmstate has go binding(wrapping from c library), not sure that helps or not. 16:58:46 we can always document "here's how you validate nmstate configs" 16:59:09 Gris: yeah, the issue is that the C library may not be installed on the system running Butane 16:59:26 we support downloading the Butane bare binary and running it 16:59:34 Unfortunately it would need to be pure Go :/ 16:59:42 shipping nmstate would also allow it to be used by installed software to modify the network config on day 2, but I think that's less relevant to us 16:59:52 but recommending user check their config beforehand is also good eough 16:59:53 (presumably useful to someone though) 16:59:57 bgilbert, travier: We can zip nmstate at butane ignition same that is done a terraform on openshift installer (I think) 17:00:19 qinqon: the nmstate binary, you mean? 17:01:00 bikeshed for later time: /etc/nmstate/ -> /etc/NetworkManager/nmstate/ ? 17:01:31 bgilbert: I understand this is to do pre-validation at ignition before apply it with nmstatectl apply at fcos right ? 17:01:54 we'll need to adjust our initrd teardown logic to also check for nmstate files before propagating initrd-generated NM keyfiles 17:01:58 qinqon: it'd probably be at Butane time, not Ignition time 17:02:02 It's to do pre-verification before generating the Ignition configuration 17:02:13 jlebon: ah, yes 17:02:23 implementation detail note: do we need to think about selinux policies? 17:02:40 Ignition itself is pretty low-level; it just writes the files it's told to 17:02:45 the messy thing here though is that it's an all or nothing thing which might make the bootstrap scenario you mentioned earlier more awkward bgilbert 17:02:46 Butane is where higher-level validation happens 17:03:00 jaime: SELinux is enabled at initrd time in FCOS & RHCOS 17:03:21 but yes, probably not a concern 17:03:33 would be the same policy work as system runtime 17:03:46 travier: not exactly. labeling is done at initrd time. the policy is still loaded by systemd at pivot time 17:03:52 travier: the generated ignition from butane after validation will have the nmstate yamls that will be later applied right ? 17:04:00 jlebon: hmm. would it help for the coreos-installer sugar to record that it's injected nmstate-derived configs? 17:04:12 whoops then, my bad 17:04:24 qinqon: right 17:05:06 qinqon: yes 17:05:16 bgilbert, travier: we have also static linking go->clib->rust if necessary so we end up with one butane binary 17:05:40 qinqon: hmm, okay, we could consider that 17:06:00 bgilbert: on second thought, i think the same awkward issue exists today with NM keyfiles 17:06:02 overall, more validation is always useful but I don't think it should be a blocker here 17:06:02 alright, it generaly feels like we don't have blockers here but are looking at the detalis to make things right. Should we make a proposal? 17:06:17 jlebon: to what extent is that a blocker? 17:06:45 bgilbert: not a blocker 17:06:48 I think it's still useful to support Ignition-delivered nmstate via, say, an autoconfigured management interface 17:07:02 without any coreos-installer-delivered injection 17:07:31 the issue i'm thinking of is that if a keyfile was injected in e.g. the ISO, you'll need those to describe the full network state instead of partially because we can't easily tell whether what's in the rootfs vs what's in the initrd is conflicting or independent 17:08:01 which is why today we basically just don't propagate anything if keyfiles were written by Ignition 17:08:15 hmm, couldn't it describe a partial network state, and then the nmstate config in the real root overwrites the entire thing? 17:08:18 my rule has always been if any configuration exists in the real root we don't propagate what was in the initrd 17:08:43 we should extend that to include nmstate configs 17:08:50 bgilbert: yes, in that case the nmstate config will have to repeat what was injected 17:08:59 that doesn't seem objectionable 17:09:13 #proposed We will add nmstate in Fedora CoreOS. 17:09:14 :-) 17:09:33 there are some details to work out, but we don't necessarily need to commit to them here (unless we want to) 17:09:34 +1 17:09:40 s/in/to/ 17:09:40 yup, just wasn't sure with your boostrap scenario if you were thinking each piece would bring just the parts it needs :) 17:10:04 I'm +1 - but we do need to consider how we present this to users (for example, our documentation) 17:10:08 interested in feedback from the nmstate team here, but I think it's probably cleaner to have the runtime config clobber the bootstrap one 17:10:33 +1 also from me (though... do we have a final tally on deps and sizes?) 17:11:29 jlebon: only depend on glibc and size is 1.6M in Fedora 35. 17:12:09 bgilbert: but as i mentioned it's a consideration that applies today to NM keyfiles too 17:12:11 jlebon: The nmstate-libs is 1.6M and nmstate is 6.3M. 17:12:27 Gris: ack, thanks 17:12:37 jlebon: right 17:13:05 ooft 1.6M was nice.. +6.3M not as much 17:13:17 bgilbert: feedback about how to present to users ? 17:13:32 dustymabe: we may be able to use some rust features to reduce size 17:13:37 +1 17:13:38 dustymabe: about average for Rust applications 17:13:40 qinqon: we should explicitly document the nmstate flows in the FCOS networking docs 17:13:50 coreos-installer flow, Ignition flow, and the hybrid one 17:14:00 maybe the --copy-network one 17:14:10 bgilbert: +1 17:14:12 jlebon: +1 17:14:18 any other votes? 17:14:43 +1 not sure my vote counts. 17:14:46 :-) 17:14:51 every vote counts :) 17:15:12 :) 17:15:27 #agreed We will add nmstate to Fedora CoreOS. 17:15:36 thanks for the discussion all, this was productive 17:15:43 Thanks for the productive discussion! 17:15:44 thanks a lot Gris and qinqon for all your work on this! 17:15:55 Thank you! 17:16:10 Should we do another small one or move to open floor? 17:16:10 thanks to all the team is being nice to work things out here 17:16:15 jlebon: Thank you! I got new stuff to learning after this meeting. 17:16:22 :) 17:16:48 yup, and thanks Gris and qinqon for walking us through this 17:16:53 travier: might be nice to discuss the pinger one 17:17:02 ok, let's do that 17:17:15 #topic Consider removing fedora-coreos-pinger 17:17:21 #link https://github.com/coreos/fedora-coreos-tracker/issues/770 17:17:28 Any taker for the summary? 17:17:30 me 17:17:39 now I get to argue in the other direction :-) 17:18:01 fedora-coreos-pinger is the component that was supposed to handle metrics gathering for FCOS. 17:18:20 this was before countme existed, and was intended to collect a broader set of metrics. 17:18:53 this wasn't a priority before FCOS was generally released, but we were conscious of privacy concerns re collection of metrics, so the plan was: 17:19:25 make sure the FCOS install documentation all included instructions on disabling metrics, for a future in which metrics collection existed. 17:20:11 ship a component that only validated the config file, to prevent any surprises from showing up when the rest of the metrics collection tool was deployed. 17:20:40 that's pinger. there is currently no metrics backend, and the frontend only validates a config file describing whether the user wants metrics to be collected. 17:20:54 ever since FCOS was first released, empirically it hasn't been a priority for us to build the rest of the tool. 17:21:20 also, importantly, we never actually documented how to disable metrics, except in one place in the Container Linux migration docs. 17:21:28 #link https://docs.fedoraproject.org/en-US/fedora-coreos/migrate-cl/ 17:21:37 +1 remove 17:21:42 :) 17:21:42 because of the latter, we haven't actually achieved our goal of giving advance warning that metrics collection may exist. 17:22:02 meanwhile, pinger is unmaintained. it needs to be ported from Travis to GH Actions, needs Dependabot, etc. 17:22:16 instead, I'd like to archive the upstream repo, retire the Fedora package, and drop it from the distro. 17:22:35 +1 17:22:48 none of that precludes changing our mind later, and it doesn't further increase the user notice requirements if we did so. 17:23:24 #proposed We will remove fedora-coreos-pinger from FCOS and archive the repo upstream. 17:23:31 +1 17:23:33 i'm kinda sad about this, but understand. i think if someone showed up to drive this forward, it'd be of great benefit to FCOS 17:24:09 i do want those metrics, and i think removing pinger will make it even less likely that we ever do this 17:24:30 but if no one sees a glimmer of hope of that direction changing in the future, i agree we should kill it 17:24:43 jlebon: honestly, the work it would take to build the backend and collection code >> the work to re-introduce a package 17:25:00 I think it would get more trackion as a distro independent project 17:25:38 I agree it'd be nice to have this someday. I think a major reason it's difficult is navigating the privacy issues 17:25:43 bgilbert: given the amount of discussion and debating each package addition gets, i'd say just > instead of >> :) 17:25:47 hah 17:25:51 fair 17:25:53 :D 17:26:25 any other votes/discussion? 17:26:47 Once you add RGPD into the mix, the backend work alone is a major project 17:27:00 and then there is hosting it 17:27:52 anyone else for the vote? 17:28:01 anyway, in the end +1 on this but make it clear that we do want it and that anyone interested to step up should do so. i'll admit i don't know much about how GDPR would affect implementation 17:28:14 s/we/some of us/ :) 17:28:22 :) 17:29:24 #proposed We will remove fedora-coreos-pinger from FCOS and archive the repo upstream. We still believe this functionality would be useful and are open to re-adding the package if the functionality is built out. 17:29:36 +1 17:29:44 +1 thanks! 17:29:45 +1 17:30:04 #agreed We will remove fedora-coreos-pinger from FCOS and archive the repo upstream. We still believe this functionality would be useful and are open to re-adding the package if the functionality is built out. 17:30:14 #topic Open Floor 17:30:24 We're at time, thus let's keep it short 17:30:40 I'll likely close in 5 min 17:30:57 pinger is 2.15M, so net change with the nmstate addition is +5.8M :) 17:31:02 :D 17:31:04 :-P 17:31:24 since we didn't get to it today is someone open to creating a new ticket for the additional requests in https://github.com/coreos/fedora-coreos-tracker/issues/1088 ? 17:31:34 so we can ship that boat that the river 17:31:58 a message came up on the CentOS CI users list re. testing rawhide, and I took the opportunity to plug FCOS :) https://lists.centos.org/pipermail/ci-users/2022-June/004556.html 17:32:04 I still don't think it needs a separate ticket, but I'm okay with that if desired 17:33:07 jlebon: :) - yeah, we have to be careful to ID what's opinion and what isn't 17:33:09 i'm OK with including it as part of the PR too 17:33:23 i think FCOS is awesome for many reasons 17:33:50 but often people compare FCOS to other fedora offerings and I try to be real careful when doing that 17:34:02 +1 dustymabe 17:34:32 dustymabe: it's funny because i wasn't even trying to go down that road 17:34:32 i.e. I risk essentially "bad-mouthing" another edition/variant 17:34:52 yeah, I know you weren't (I know who you are :)) 17:35:07 it's a fine line to walk for sure 17:35:12 fwiw it reads a bit strong to me too 17:35:18 What's this CI we're talking about here? 17:35:53 ack, thanks for the feedback! 17:36:00 travier: CentOS CI is migrating to AWS 17:36:10 it's used by a lot of upstream projects 17:36:27 https://lists.centos.org/pipermail/ci-users/2022-June/004556.html 17:36:33 that's the email we're discussing 17:36:58 now.. I *do* think we should start doing exactly what jlebon did, which is promote FCOS - it's ready!!! 17:36:59 i guess i should've s/*the*/a/ 17:37:07 jlebon: +1 17:37:13 jlebon: thank you for promoting FCOS 17:37:46 jlebon: +1 <3 17:38:27 +1 for more FCOS 17:38:41 (I've no idea how this other CI works however) 17:38:46 ETOOMANYCI 17:39:16 FYI - I probably won't be around next week for this meeting.. the following week is the 1st meeting of the month (usually video meeting) anyone want to volunteer to organize a video meeting? 17:39:33 oh also - This Month in FCOS ticket: 17:39:49 https://github.com/coreos/fedora-coreos-tracker/issues/1234 17:40:46 we can skip video if we don't have anything specific 17:40:53 Alright, closing in 30 secs. 17:42:01 #endmeeting