16:31:45 #startmeeting fedora_coreos_meeting 16:31:45 Meeting started Wed Mar 25 16:31:45 2020 UTC. 16:31:45 This meeting is logged and archived in a public location. 16:31:45 The chair is bgilbert. Information about MeetBot at http://wiki.debian.org/MeetBot. 16:31:45 Useful Commands: #action #agreed #halp #info #idea #link #topic. 16:31:45 The meeting name has been set to 'fedora_coreos_meeting' 16:31:47 lorbus: In #fedora-meeting-1 is Fedora Infrastructure (starting in a day) 16:31:50 lorbus: In #fedora-meeting-1 is Fedora Packaging Committee (starting in a day) 16:31:51 #topic roll call 16:31:55 .hello2 16:31:55 lorbus: lorbus 'Christian Glombek' 16:31:58 .hello2 16:31:59 bgilbert: bgilbert 'Benjamin Gilbert' 16:32:01 .hello2 16:32:02 darkmuggle: darkmuggle 'None' 16:32:10 .hello2 16:32:12 lorbus: lorbus 'Christian Glombek' 16:32:16 .hello2 16:32:17 jlebon: jlebon 'None' 16:32:38 .hello2 16:32:39 .hello2 16:32:39 dustymabe: dustymabe 'Dusty Mabe' 16:32:45 #chair lorbus darkmuggle jlebon dustymabe davdunc 16:32:45 Current chairs: bgilbert darkmuggle davdunc dustymabe jlebon lorbus 16:32:52 .hello2 16:32:53 cyberpear: cyberpear 'James Cassell' 16:33:00 .hello2 16:33:01 jbrooks: Sorry, but you don't exist 16:33:03 .hello sohank2602 16:33:08 skunkerk: sohank2602 'Sohan Kunkerkar' 16:33:21 #chair cyberpear jbrooks skunkerk 16:33:21 Current chairs: bgilbert cyberpear darkmuggle davdunc dustymabe jbrooks jlebon lorbus skunkerk 16:33:57 .hello2 16:33:58 rfairley: rfairley 'None' 16:34:03 .hello shivarammysore 16:34:03 shivarammysore: Sorry, but you don't exist 16:34:15 #chair rfairley shivarammysore 16:34:15 Current chairs: bgilbert cyberpear darkmuggle davdunc dustymabe jbrooks jlebon lorbus rfairley shivarammysore skunkerk 16:34:36 rfairley: nice to see you! :) 16:34:42 * bgilbert waves at rfairley 16:34:46 .hello redbeard 16:34:47 red_beard: redbeard 'Brian 'redbeard' Harrington' 16:34:54 #chair red_beard 16:34:54 Current chairs: bgilbert cyberpear darkmuggle davdunc dustymabe jbrooks jlebon lorbus red_beard rfairley shivarammysore skunkerk 16:34:55 wow - quite the crowd here today 16:35:02 welcome all! 16:35:10 jlebon: you as well :) 16:35:18 * rfairley waves back at bgilbert 16:35:43 o/ 16:35:43 sorry it's been a while :) 16:35:58 #topic Action items from last meeting 16:36:24 #info no action items from last meeting \o/ 16:36:48 #topic RFC: Adding a Network TUI 16:36:55 #link https://github.com/coreos/fedora-coreos-tracker/issues/427 16:37:19 I'll give some background on this 16:38:03 basically downstream in RHCOS land we've had some users who are having a lot of trouble with providing static networking configuration via kernel command line arguments (when required for fetching ignition configs) 16:38:39 we'd like to provide some sort of interactive way for people who are doing bare metal installs to specify the network setup on their machine 16:39:20 The interactive element typically goes against what we recommend for *CoreOS stle machines that are provisioned via Ignition 16:39:30 *style 16:40:20 but we may be able to provide something interactive without compromising our values here 16:40:36 * dustymabe waits for discussion before bringing up possible solutions 16:40:53 is there anything I missed in the framing ? 16:41:34 * jbrooks installed a bare metal cluster a while back and this was painful, so it sounds interesting 16:43:29 dustymabe: i think you can carry on :) 16:43:54 jlebon: +1 - was writing up the next stuff in a separate window :) 16:44:06 possible solutions to the problem: 16:44:08 1: detect on firstboot (ignition boot) that networking isn't set up and present a TUI to the user 16:44:10 2: use the live ISO installer environment to allow users to inspect the hardware profile and provide a TUI to allow them to interactively configure networking that can then be passed to the installed system 16:45:18 will pause here again for discussion 16:45:29 before adding comments about the approaches 16:45:32 dustymabe: is there a reason why some of that couldn't be: configure on vanilla fedora and then snapshot state of some configurations to ignition/kernel command line? 16:45:34 is this TUI specific to *COS in any way? or could we imagine it being part of NM itself? 16:46:08 jlebon: one proposal for the TUI to use is nmtui, so yes 16:46:09 jlebon: I'm imagining the network part as exactly nmtui, maybe with a small wrapper menu 16:46:15 that way it separates concerns allows folks to noodle around as needed and then convert a working NM configuration into the needed setup 16:46:40 (sorry, missing commas in there breaking up thoughts) 16:46:44 red_beard: isn't that pretty much what 2 is? except we're just using a FCOS interactive live environment 16:46:51 red_beard: we've been told that some users specifically want to type in static networking info when setting up the machine 16:47:02 red_beard: this isn't just for experimentation, it's for prod installs 16:47:12 i understand 16:47:35 red_beard: your proposal is to require non-self-hosted mechanisms for that? 16:47:37 it's just giving folks a way to have a process of building the config in a general purpose environment 16:47:48 the tl;dr is that users hate catching grub prompts to use kargs. 16:48:07 darkmuggle: yep 16:48:28 The idea for using nmtui was to give people a friendly way to configure it 16:48:51 bgilbert: the proposal is "there will always be endless reasons users think they need to add things to the OS. in this case it's that they want to treat a deterministic deployment as non-deterministic" 16:48:52 Then users don't have to know the interface naming, or have to figure out the ip= karg syntaxxx 16:49:32 You still have to present list of network interfaces and allow user to pick which one they want to configure 16:49:49 "so allow users to explore in the more flexible environment, generate their configuration, and then try to use it" 16:49:57 red_beard: I think "if you want to configure static networking, do it from that OS over there -->" is a tough sell 16:50:24 it's not "in that OS over there", it's making it more obvious how the concerns are separated. 16:50:37 also, it gives us less control. they either have to do an extra reboot (boot the Other OS, generate network config, reboot into live ISO for installer) 16:50:47 or they run coreos-installer from the other OS, where we can't give them nice affordances 16:51:32 maybe I'm not understanding your proposal 16:52:12 eh... never mind. no point in fighting the tide. 16:52:18 red_beard: let's try this 16:52:30 here is the current proposal 2 which sounds somewhat similar to what you're proposing 16:52:38 red_beard: the live ISO is essentially what you're describing, right? it's a flexible environment in which to play around with settings 16:52:38 2: use the live ISO installer environment to allow users to inspect the hardware profile and provide a TUI to allow them to interactively configure networking that can then be passed to the installed system 16:52:49 red_beard: how would you change that? ^^ 16:53:15 To build on bgilbert proposal, have a UI to collect network info first and then feed it into Live installer - only if the option to select static network (timeout after 10seconds) 16:53:34 shivarammysore: yep, that's basically proposal 2 16:53:41 no timeout though 16:54:11 the live ISO currently boots to a prompt if no kargs, or to the installer if given coreos.inst.* kargs 16:54:25 timeout is specified so that one does not need to use this case in most cases. Users would not like to press any buttons 16:54:32 we could change the former to boot to TUI, or have users run the TUI themselves 16:54:39 shivarammysore: pressing buttons is exactly the problem, though 16:54:51 a 10-second timeout after a 40-minute BIOS POST is a non-starter 16:54:57 agree 16:55:05 shivarammysore: you can use the live ISO and automate the install already 16:55:18 hmm, one way to bridge the TUI <--> coreos-installer gap is to have a `coreos-installer install --import-nm-keyfiles` which takes the keyfile from the current boot 16:55:18 we're talking about the case where a user was already doing it interactively 16:55:37 jlebon: right, that's an implementation detail of proposal 2 16:56:09 dustymabe: right, wanted to talk about the details :) 16:56:11 jlebon: fun fact, CL coreos-install had a little-used option to do that for networkd 16:56:49 i guess that's fine. it sounds like more work to me to try to start building those machines with a magic image (the live ISO) as opposed to what's already built Fedora and FCOS 16:56:58 keeping separate packages in each 16:57:07 bgilbert: ohh neat 16:57:07 the live ISO already exists in FCOS 16:57:49 we're already working to an installer flow which is more or less: boot live ISO, run coreos-installer 16:58:18 #link https://docs.fedoraproject.org/en-US/fedora-coreos/bare-metal/#_installing_from_live_iso 16:59:25 so the only different I can see between doing what red_beard is proposing and 2 is that we would make sure to keep unneeded packages out of the base 16:59:48 if we were to include nmtui (we currently don't) then we'd need to add that 17:00:07 i think if we were going to be included a lot of new software I'd agree more with red_beard 17:00:30 but if it's small to me it's not worth the completely separate env 17:00:50 can we ship nmtui in a container image? :-P 17:01:19 :), yes but we'd be making the live ISO image much larger to achieve that goal IIUC 17:01:24 we should look at how much it'll expand the image, because of course we'd ship it everywhere unless we made special provisions 17:01:29 *base image 17:01:33 250K if memory serves 17:02:02 including deps? 17:02:30 it's 3 packages right now: NetworkManager-tui-1:1.20.10-1.fc31.x86_64 17:02:32 newt-0.52.21-2.fc31.x86_64 17:02:33 we already have the other ones, there's just two depes 17:02:34 slang-2.3.2-6.fc31.x86_64 17:03:14 if we really didn't want those we could probably do something crafty just with the live ISO 17:03:33 though that would also affect live ISO boots that aren't meant for installs 17:03:58 ok, so it seems like we've had a lot of discussion around `2` 17:04:03 anyone want to talk about `1` ? 17:04:24 which is basically "have ignition detect failure and present interactive interface" 17:04:37 for 1, I assume you'd want nmtui in the initrd? 17:04:45 cyberpear: or equivalent, yet 17:04:48 yes* 17:04:50 so that NM can bring up networking, per the recent merges 17:05:11 cyberpear: OR detect failure and boot into some sort of live real root enironment (i.e. not the initrd) 17:05:40 my main issue with 1 is that it's an implicit way to try to achieve your goal 17:06:05 jlebon: right, we would be assuming the user wants an interactive environment 17:06:15 but there are some cases where you don't need or want networking in the initramfs 17:06:16 imagine the docs saying: "if you want to provide network configuration interactively, just let ignition fail" 17:06:41 the idea for 1 is that it would apply for things where the user had interacted or was reasonably assumed to interact with it 17:06:47 e.g. `ignition.url=http....` 17:07:20 darkmuggle: +1 - so cases where we can detect the user had already interacted 17:07:20 the problem is, in general, it's hard to figure out when we have enough networking configured for Ignition to succeed 17:07:30 I'd "assume" that networking is by far the most common case, and be fine w/ having a `ignition.no-network` or similar option to skip the nmtui w/o networking 17:07:46 darkmuggle: if you have access to the kernel cmdline, then you could have an explicit karg for opting into it :) 17:08:19 and the "failure" would be one the fetch stage 17:08:25 users who use NTUI would most likely not know how to handle kargs 17:08:42 you would be surprised... kargs are not fun 17:09:02 ip= kargs are miserable especially when counting colons 17:09:19 regardless, the ask is to provide an ergonomic way 17:09:35 * lorbus notes that he has something for Open Floor 17:09:41 ok we've gone quite a while on this topic 17:09:51 let's see if we can take any conclusions away 17:10:00 can I ask if we will add whois package? 17:10:15 shivarammysore: openfloor would be a good time 17:10:20 is the matrix bridge down again? 😅 17:10:20 coming soon 17:10:28 lorbus: we heard you 17:10:29 yeah, dustymabe, i think the world i live in and the world FCOS users _want_ to live in are just different and it's time for me to accept that. 17:10:58 so we have two proposals: 17:11:07 1: detect on firstboot (ignition boot) that networking isn't set up and present a TUI to the user 17:11:09 2: use the live ISO installer environment to allow users to inspect the hardware profile and provide a TUI to allow them to interactively configure networking that can then be passed to the installed system 17:11:27 and a possible 3rd, which is to not use FCOS at all for 2 but use Fedora base instead 17:11:48 the main advantages I can see to #2 over #1 are: 17:12:11 - we already have live ISO environment for installs where users have an interactive experience for doing an install 17:12:34 - failure detection in ignition is hard and there are many cases where we'll have to work out exactly what the right behavior should be 17:13:22 do all of you see those as advantages? 17:13:36 +1 17:14:02 +1 17:14:09 advantages of #1 over #2: 17:14:09 +1 17:14:37 - it could allow for a user to correct something that was misconfigured 17:14:51 so, #2 is "install time network conifg" where #1 is "first boot time network config" 17:15:14 cyberpear: roughly, yes 17:16:02 it's not exactly that simple because we do need to take into account how hard it would be to achieve the goal in each implementation 17:16:13 seems reasonable for all cases except for where machines are built in a different env than where they are deployed, such as an OEM 17:16:31 cyberpear: true 17:16:54 yes, that is one limitation 17:17:25 ok i'll take this summary to the ticket 17:17:33 or installing the OS while on the network, and deploying to a disconnected network, though not sure how common that is 17:17:54 cyberpear: DHCP makes life so much simpler :) 17:18:14 ok will move to open floor soon. 17:18:42 #info dustymabe will record a summary of this discussion in ticket #427 17:18:44 agreed on DHCP, though some/many folks still insist on static 17:19:37 #proposed there are advantages and disadvantes of the two approaches to solve this problem. Right now we'd like to explore the implementation of using the live ISO installer environment to preset a TUI to the user to see if that solves the pain points for our users 17:19:44 acks/nacks ? 17:20:09 I'd drop the first sentence, but sure :-) 17:20:19 can you check with the user who posted this request if this solution would solve their problem? 17:20:32 #proposed Right now we'd like to explore the implementation of using the live ISO installer environment to preset a TUI to the user to see if that solves the pain points for our users 17:20:54 shivarammysore: we've been told that it does 17:20:58 shivarammysore: i mentioned early on it's actually requested by downstream customers using RHEL CoreOS 17:21:06 awesome. thanks 17:21:12 +1 17:21:20 s/preset/present/ otherwise ack :) 17:21:25 so our management teams have been communicating with us through this process to help give feedback 17:21:48 +1 17:21:57 +1 on the jlebon mod. 17:22:03 +1 17:22:22 #agreed Right now we'd like to explore the implementation of using the live ISO installer environment to present a TUI to the user to see if that solves the pain points for our users 17:22:36 we can of course continue to have the discussion in the ticket 17:22:40 #topic open floor 17:22:47 lorbus: shivarammysore: your turns!! 17:23:04 I seem to experience lag on the IRC to matrix bridge -- nvmd if you receive this or the following messages at a weird time 17:23:06 are we going to add whois package to FCOS? If so, which release? 17:23:47 right now I have a work around. I would like my production setup to use something without hacks 17:24:01 shivarammysore: any reason you can't run it in a container? 17:24:06 shivarammysore: so for whois you're just querying domain name ownership information ? 17:24:07 what does the whois package do? 17:24:14 jwhois? 17:24:24 cyberpear: for example `whois dustymabe.com` 17:24:33 yeah, which is `jwhois` 17:24:35 schema verification of JSON/YAML - need whois 17:24:49 can't use it on containers. 17:25:15 why not? 17:25:22 i'm curious as well 17:25:32 shivarammysore: can you give us an example of a json file you're verifying using whois? 17:26:30 to be clear, we're talking about this one https://src.fedoraproject.org/rpms/whois/blob/master/f/whois.spec ? 17:26:32 when you start having lots of containers, management is an issue. We maintain containers for all serivces 17:26:56 is there a technical reason it can't run in a container? 17:27:01 we don't user K8s. that is too heavy for us. we rolled our own 17:27:05 shivarammysore: that's kindof the point though, determinism around deployments 17:27:10 #link https://github.com/coreos/fedora-coreos-tracker/issues/432 17:27:10 and you don't need k8s to do that 17:27:17 in general, with FCOS, we only ship software in the host that must be there 17:27:32 and everything else should run in a container. 17:27:44 shivarammysore: are you running *any* containers on FCOS today? 17:27:51 the schema is proprietary to us and how we do validation - it should be no different for any 17:28:01 oh yes - we run most of the services on containers 17:28:07 shivarammysore +1 17:28:36 shivarammysore: you've mentioned before that you came from container linux, did you not have this problem there ? 17:28:37 we have a few Go binaries wrapped in systemd units for a few things 17:28:58 can't go into details :-( 17:29:35 okay, so unfortunately I'm not hearing an actionable reason for shipping whois in the host :-( 17:29:37 what is the disk impact? 17:29:39 per the issue, is the objective to use whois-nl package or whois 17:29:56 it's around adding packages which aren't needed to setup the _host_ 17:30:13 "Searches for an object in a RFC 3912 database." -- seems unnecessary to me, except that we already ship one of its sub-packages and layering doesn't work in this case 17:30:14 shivarammysore: you opened the issue, right. which package did you desire? 17:30:15 workloads run in containers. packages added to the host are to set it up so that it can run containers. 17:30:30 dustymabe need whois 17:30:34 right 17:30:59 but maybe we should fix the "can't upgrade base packages when installing another package" 17:31:21 before I drop: I wanted to ask on an update on the image upload to GCP and Azure issues (at least for Azure there is at least one open issue wrt fixed VHD file size) 17:31:21 It's not a immediate priority, though. So I'll bring that up again another time. 17:31:21 Bye everyone o/ 17:31:26 ok so I think in general it would be really easy to run this in a container and we don't have any reason to need it in the host. It would be extra container build overhead but in the future package layering should be better 17:31:27 cyberpear yes if that is fixed, I can live with it 17:31:54 bgilbert: I had a question for you in https://github.com/coreos/fedora-coreos-tracker/issues/432#issuecomment-602310619 17:32:01 I don't even think we need whois-nls in the host 17:32:24 and it looks like you responded 17:32:26 yeah, just commented there 17:32:32 that was an artifact of what I was doing at the time 17:32:40 I saw that whois-nls got removed by that change, so I added it back 17:32:51 which I don't think I would have done if whois wasn't also there 17:32:58 but that was F30, so maybe something pulled it in as a dep 17:33:04 anyway, I'm +1 to dropping -nls if we're not shipping the base 17:33:05 bgilbert: ahh, so maybe I should check if anything recommends whois-nls 17:33:37 shivarammysore: ok I'll try to summarize this in the ticket. we can help you either run it in a container, or try to unblock the package layering flow 17:33:44 * jlebon has to drop -- thanks all! 17:33:59 unblock package layering is what I would prefer dustymabe 17:34:10 shivarammysore: and thanks for helping us work through some early paper cuts in FCOS land 17:34:10 shivarammysore: but, as an editorial comment: please don't package-layer for that. layering has some problems and we don't encourage it unless necessary. 17:34:12 it helps 17:34:31 shivarammysore: in general, software should run in containers by default 17:34:36 Even I would not like to do that, but, sometimes needed 17:34:54 anything else before I close the meeting out? 17:35:04 one more 17:35:13 I am still working this ... 17:36:03 Create a instance on AWS. Then start a custom systemd service. Stop the instance, create a AMI and now launch a new Instance with the AMI 17:36:33 is there an open issue for this? 17:36:35 I see that reboot does not happen correctly -to restart service, . Still investigating . This is heads up 17:36:45 note that you'll get duplicate machine ID, duplicate ssh host keys, ... 17:36:48 no issue filed yet - just heads up 17:37:11 bgilbert totally understand 17:37:30 yeah it sounds problematic (similar to running packer). we should probably open an issue to discuss this and the problems it entails 17:37:43 ok I'm going to end the meeting now since we're over time and I've got to run 17:37:48 #endmeeting