16:29:48 #startmeeting fedora_coreos_meeting 16:29:48 Meeting started Wed Sep 29 16:29:48 2021 UTC. 16:29:48 This meeting is logged and archived in a public location. 16:29:48 The chair is dustymabe. Information about MeetBot at https://fedoraproject.org/wiki/Zodbot#Meeting_Functions. 16:29:48 Useful Commands: #action #agreed #halp #info #idea #link #topic. 16:29:48 The meeting name has been set to 'fedora_coreos_meeting' 16:29:53 #topic roll call 16:29:58 .hi 16:30:00 dustymabe: dustymabe 'Dusty Mabe' 16:30:27 .hi 16:30:30 lucab: lucab 'Luca BRUNO' 16:30:33 .hi 16:30:34 bgilbert: bgilbert 'Benjamin Gilbert' 16:30:41 .hello2 16:30:42 jlebon: jlebon 'None' 16:31:10 #chair lucab bgilbert jlebon 16:31:10 Current chairs: bgilbert dustymabe jlebon lucab 16:32:08 light attendance today.. I know there is a conference going on that some people are attending 16:32:21 .hi 16:32:22 lorbus: lorbus 'Christian Glombek' 16:32:30 welcome lorbus :) 16:32:53 #chiar lorbus 16:33:00 * lorbus waves 16:33:03 will wait another minute and then get started 16:34:14 #topic Action items from last meeting 16:34:20 * lorbus and jlebon to reach out to the containers team to discuss what cri-o versions will be supported and how at the modular level to pull it off (context: https://github.com/coreos/fedora-coreos-tracker/issues/767) 16:34:42 can you re-action that one? 16:34:50 #action lorbus and jlebon to reach out to the containers team to discuss what cri-o versions will be supported and how at the modular level to pull it off (context: https://github.com/coreos/fedora-coreos-tracker/issues/767) 16:34:51 .hello2 16:34:52 jaimelm: jaimelm 'Jaime Magiera' 16:34:55 I haven't come around to doing that. Not sure if jlebon has. Maybe re-action this one? 16:34:57 #chair jaimelm 16:34:57 Current chairs: bgilbert dustymabe jaimelm jlebon lucab 16:35:01 done :) 16:35:07 lorbus: let's get together at some point to chat :) 16:35:29 #topic [F35] Fedora CoreOS Test Day 16:35:36 jlebon: yes, definitely :) 16:35:40 #link https://github.com/coreos/fedora-coreos-tracker/issues/973 16:35:45 jlebon++ 16:35:47 lorbus++ 16:36:19 we're going to try to have a FCOS test day for the f35 rebase here soon 16:36:31 since our `next` stream is switched over it should be a good candidate for testing 16:37:08 in the past we've added test cases that help test our documentation 16:37:19 since most of our CI automates other testing that we care about 16:37:44 does that sound reasonable for this iteration? 16:38:10 +1 16:38:20 esp. platforms we don't have any coverage on 16:38:49 i think sumantro was suggesting we possibly use next week for the "test day" 16:39:08 we could possibly try to go later if we think that's a bit ambitious 16:39:32 It would be good to note down the last F34 release on next and manually test the upgrades from that 16:39:33 probably need to spend some time before hand identifying where our docs have changed or adding new test cases for new docs that have been added 16:39:45 lucab: indeed 16:40:47 +1 on testing day, +1 on identifying docs changes beforehand. Next week sounds ambitious. 16:41:19 ok, maybe we can push to the following week and schedule a day next week for syncing on test case changes 16:41:26 ^^ 16:41:59 #action dustymabe to talk to sumantro to try to get FCOS testing on the week of oct 11 16:42:35 jaimelm: we should schedule some time now to try to identify test case changes (and interested parties) 16:42:42 i'm interested 16:43:00 jaimelm: would love some help organizing too if you're able/willing 16:43:07 I think last time we may have caught you at a bad time 16:44:07 for time: next Monday (morning US) works for me - any other suggestions? 16:45:22 is anyone else that's interested in looking at the docs test cases able to make it Monday (anytime)? 16:45:32 yup, WFM too! 16:45:35 i can help 16:45:54 dustymabe: Monday works for me 16:46:14 * jaimelm is in two meetings at once. responses may be delayed. 16:46:18 #action dustymabe to schedule some time on Monday to identify docs test cases and prepare for F35 test day 16:46:33 #topic tracker: Fedora 35 changes considerations 16:46:39 #link https://github.com/coreos/fedora-coreos-tracker/issues?q=is%3Aissue+is%3Aopen+label%3AF35-changes 16:46:56 looks like we only have two subtickets left! 16:46:58 almost done 16:47:05 woohoo! 16:47:20 looks like travier is the brave soul assigned to both of them 16:47:23 .hello2 16:47:24 walters: walters 'Colin Walters' 16:47:38 #chair walters 16:47:38 Current chairs: bgilbert dustymabe jaimelm jlebon lucab walters 16:47:40 welcome! 16:47:58 travier: feels like we can drop the rpmautospec one? definitely nice to have, but no need to tie to f35 16:48:24 (i.e. let's keep the ticket, but drop the label) 16:48:33 yeah, I think there's less discuss needed on that one 16:48:48 once we close off the SSSD ticket I'll drop the meeting label and close out the top level ticket 16:48:57 so we won't bring it up any longer 16:49:25 I think he may be AFK (didn't see him in roll call) so we'll punt on this one for now 16:49:31 .hello2 16:49:32 copperi[m]1: Sorry, but user 'copperi [m] 1' does not exist 16:49:40 #chair copperi[m]1 16:49:40 Current chairs: bgilbert copperi[m]1 dustymabe jaimelm jlebon lucab walters 16:49:49 #topic Actually move iptables to the nft backend 16:49:54 #link https://github.com/coreos/fedora-coreos-tracker/issues/676 16:50:28 this came up again recently because we switched to f35 and they broke it out to an iptables-legacy package 16:50:54 I thought we had done this before, but let's get agreement on the proposal in https://github.com/coreos/fedora-coreos-tracker/issues/676#issuecomment-824225675 and then execute 16:51:22 migrate new nodes 16:51:23 declare iptables-legacy in a deprecation period and provide instructions on how to migrate (possibly with doc links for e.g. additional OKD/k8s-specific instructions) 16:51:25 is on board with jlebon's proposal. Did we define x? 16:51:25 wait X months 16:51:27 force migrate old nodes 16:51:29 no longer consider iptables-legacy supported 16:51:33 was thinking about this, and it's a little trickier than the proposal makes it seem 16:51:42 the "migrate new nodes" part is the hard bit 16:52:03 i'm not very confident in the proposal at https://github.com/coreos/fedora-coreos-tracker/issues/676#issuecomment-732514979 16:52:18 so my proposal now is https://github.com/coreos/fedora-coreos-tracker/issues/676#issuecomment-732515968 16:53:11 notably, the first 2-barrier proposal is complex, and even then not foolproof 16:53:34 the steps would still roughly be: 16:53:43 - declare iptables-legacy in a deprecation period 16:53:47 - wait X months 16:53:58 - force migrate old and new nodes 16:54:07 so that'd be the key difference 16:54:30 (unless explicitly opted into not migrating) 16:55:03 seems reasonable to me 16:55:22 basically users have the ability to opt out if they touch the stamp file 16:55:26 I think there's two classes of user here; the "small scale non-kube" case where they may use iptables manually, or equally well may not (in cloud) versus kubernetes where it's an important part of networking setup 16:55:37 ^^ 16:55:40 obviously requires them to be engaged and reading notices 16:55:41 the forced migration seems like a risk for Typhoon 16:55:53 (and OKD?) 16:56:11 Not so much for OKD 16:56:19 yeah, this approach would require e.g. Typhoon to touch the stamp file 16:56:23 I ran it by the team a few months ago. Not a big concern. 16:56:40 jlebon: good point. the integration platform could do it 16:56:41 then it's in their hands when they want to move to nft 16:57:40 well hmm. trying to think about how easy that would be 16:58:02 not exactly sure how updates to typhoon are handled 16:58:28 i thought the stamp file was about marking use of nft? is there another stamp file for "I want iptables-legacy"? 16:58:32 we can run the proposal by Dalton to see what he thinks 16:58:43 yeah, +1 for running the proposal by Dalton 16:58:50 to the best of my knowledge, the usual FCOS way through zincati 16:58:58 walters: in https://github.com/coreos/fedora-coreos-tracker/issues/676#issuecomment-732515968, the stamp file would be "i want to stay on legacy" 16:59:18 lucab: but what about the platform on top? i.e. could they define new containers in a new version that put a file on the host? 16:59:21 ok 17:00:54 dustymabe: in theory yes, but I think it would still require manual intervention as typhoon down not auto-upgrade itself 17:01:42 #proposal 1. declare iptables-legacy in a deprecation period 2. allow people to opt out of automigration 3. wait 3 months 4. force migrate old and new nodes 17:01:56 hmm - should have added in there talking with typhoon 17:02:07 https://typhoon.psdn.io/topics/maintenance/#upgrades 17:02:23 #proposal Talk with typhoon about proposed migration. The proposed migration is: 1. declare iptables-legacy in a deprecation period 2. allow people to opt out of automigration 3. wait 3 months 4. force migrate old and new nodes 17:02:50 +1 17:02:52 jlebon: does that reflect your proposal? 17:02:59 yup 17:03:13 +1 from my side 17:03:28 +1 17:03:47 +1 17:04:25 walters lucab bgilbert.. look good? 17:04:29 +1 17:04:45 #agreed Talk with typhoon about proposed migration. The proposed migration is: 1. declare iptables-legacy in a deprecation period 2. allow people to opt out of automigration 3. wait 3 months 4. force migrate old and new nodes 17:05:04 as a side note I'm in the "BPF is the future" camp and NFT vs iptables is...eh, not very interesting 17:05:19 * dustymabe wants to learn more about BPF - like a lot more 17:05:20 wfm 17:06:04 anybody want to reach out to dalton to check this plan once I add it to the ticket (jlebon might also be able to add a little more design detail about how the "opt-out" service would operate 17:06:27 dustymabe: was thinking mostly of pinging dalton on the ticket :) 17:06:42 i can do that if you'd like 17:06:45 that works!! 17:07:37 #action jlebon to add some design details to the proposal in the ticket and also reach out to dgubble to see if this can be handled in typhoon 17:07:51 jaimelm: ^^ also worth confirming 100% with OKD this won't be a problem 17:07:59 (my IRC client is having large latency/lagging issues) 17:07:59 #undo 17:07:59 Removing item from minutes: ACTION by dustymabe at 17:07:37 : jlebon to add some design details to the proposal in the ticket and also reach out to dgubble to see if this can be handled in typhoon 17:08:17 #action jlebon to add some design details to the proposal in the ticket (#676) and also reach out to dgubble to see if this can be handled in typhoon 17:08:25 lucab: noted 17:08:29 *dghubble 17:08:37 bgilbert: boo 17:08:39 #undo 17:08:39 Removing item from minutes: ACTION by dustymabe at 17:08:17 : jlebon to add some design details to the proposal in the ticket (#676) and also reach out to dgubble to see if this can be handled in typhoon 17:08:47 #action jlebon to add some design details to the proposal in the ticket (#676) and also reach out to dghubble to see if this can be handled in typhoon 17:08:53 better :) 17:08:57 dustymabe: straight from the man himself... https://github.com/openshift/okd/discussions/613 17:09:07 but I'll ask again 17:09:18 +1 17:09:23 He's OOTO but will be back next week-ish 17:09:29 sound sgood 17:09:31 thanks jaimelm 17:09:40 #topic Handle re-invocations of coreos-installer on a new disk 17:09:44 #link https://github.com/coreos/fedora-coreos-tracker/issues/976 17:09:47 * sumantrom is here 17:09:53 bgilbert: want to set the stage for this one? 17:10:05 not my ticket, but I'll be happy to chime in 17:10:13 oops - let me check 17:10:20 walters? 17:10:27 +1 walters? 17:10:49 We've had a lot of problems I'm pretty sure are rooted in races on multiple disks with partitions that have `LABEL=boot` 17:11:29 It is *possible* for this to happen in cloud, in theory but I think it's mostly a metal thing 17:12:12 I haven't checked other distributions but at least the way Anaconda works for example it injects a uuid for `/boot` into both the kernel and grub cfg 17:12:43 (hmm actually Fedora Cloud presumably inherits this too) 17:13:30 anyways that's the intro 17:14:06 hmm, i'm not sure that's the case re. Anaconda setting it in the kernel kargs. though definitely seeing it in the grub config 17:15:35 right, sorry it's not on the kargs for Anaconda, it's in `/etc/fstab` - because most uses of Anaconda-generated-systems don't need /boot in the initramfs 17:15:38 so basically the problem is when you have more than one disk attached to a system and both of them have a label of `boot` on one of the filesystems? 17:15:43 what's so insidious about it is that the way problems manifest it makes you question everything 17:15:48 jlebon: +1 17:16:18 I would tend to lean toward solutions that keep coreos-installer out of it, since that'd be another cloud vs. metal divergence 17:16:44 yeah, i worked on https://blog.verbum.org/2020/12/01/committed-to-the-integrity-of-your-root-filesystem/ partially because of this, which was a lot of fun and valuable for other reasons obviously 17:16:59 (thinking there was some race on shutdown/update around power failures) 17:17:06 e.g. failing if we find multiple /boot partitions, or burning in a per-build FS UUID + adding it to kargs + replacing it with a generated UUID on first boot 17:17:32 failing in the OS boot, or failing in coreos-installer? 17:17:36 the two cases I've seen so far are mostly human/hardware failures, and most of the pain is that it become apparent way too late (on the first upgrade) 17:17:38 failing in the OS boot 17:18:03 (which is fundamentally subject to races of course) 17:18:07 we could fail in both places 17:18:18 though coreos-installer isn't always run directly on the target hardware 17:18:26 i don't think we should fail in coreos-installer 17:18:30 sometimes the disk is written to and then "moved" 17:18:43 jlebon: what about a warning then? 17:18:44 +1, we can't assume c-i is run on the target 17:18:46 https://github.com/coreos/coreos-installer/pull/642#issuecomment-930351108 17:19:13 that warning will fire if c-i is run from inside FCOS, which feels a bit odd 17:19:26 *an installed FCOS 17:19:35 yeah, maybe more of a "Hey, I noticed that ..." 17:20:04 I do generally agree with the directions walters want to go (more uuids), but at the same time I find valuable that we can say "by-label/boot" 17:20:22 +1 lucab 17:20:28 lucab: it'd be good to enumerate the things we know today are using the label 17:20:49 note the proposal is just *adding* and using a uuid, not dropping the label though 17:21:21 I only did a quick grep through the initrd, and we use that for ordering units 17:21:54 (side thread: all agreed we do need boot=UUID=$x on the kernel cmdline unlike anaconda because we need access to it in the initramfs?) 17:22:14 kinda feels like it's going out of our way to try to be resilient something that most likely indicates something wrong that ideally should be rectified 17:22:15 sure, but the underlying story is "we move to uuid so that there can be multiple 'boot' labels" 17:22:31 hmm side note, the RHEL FIPS stuff requires this which is why we already have https://github.com/openshift/os/blob/9cd6b20bf01aee14c4c96946b84b14dce35d5c87/overlay.d/05rhcos/usr/lib/dracut/modules.d/40rhcos-fips/rhcos-fips.sh#L58 17:22:35 jlebon: +1 17:22:46 so this is basically moving that bit of FIPS to be default 17:22:46 we want to own the machine and we need users to know that too 17:23:23 if there's two boot partitions, is it possible they booted from the wrong device? 17:23:28 what's the scope of the problem we're trying to solve? I can see several options: 1. bootloader disk doesn't match boot disk, 2. root doesn't match boot, 3. user booted not from the disk they thought 17:24:08 e.g. it should be easy to fail on 2 17:24:41 2 rephrased: / and /boot come from different disks 17:24:42 hmm true... 17:25:28 it'd still be racy though 17:25:33 it would 17:26:32 we reached here through reported symptoms, so we basically only know about cases of 2. 17:27:11 any ways to make it less racy? is there a moment in time where we are sure all fs with label boot should be up? 17:27:28 even if it's late and we've already done some $work 17:28:18 I guess when we say racy here we mean "somebody can add another 'boot' partition at any point at runtime" 17:28:18 well, no. hotplug can happen at any time 17:28:43 let's say we're up and we get a boot 17:28:52 hmm, we don't need to do any waiting. we could have a stamp in /boot and / which match each other and verify they match at mount time 17:28:58 and then we mount a root fs - and it doesn't match (through some heuristic) 17:29:07 jlebon: +1 17:29:45 we dynamically generate the stamp on first boot. so whatever devices we agreed on first boot, those are what they have to remain for the rest of its life 17:29:51 jlebon: stamp isn't necessary if we check for a common backing device 17:29:59 yeah but we could also find /boot from the same block device 17:30:01 bgilbert: we support moving rootfs to a different device 17:30:07 ...right 17:30:09 ok true 17:30:46 time check 17:31:13 jlebon: can you drop the stamp proposal in the ticket for discussion point? 17:31:25 sounds like we're coalescing (spelling) around trying to figure out a good way to error in this case rather than change our UUID design for this particular instance 17:31:28 sure thing! 17:31:55 by error do we actually fail the boot, or do we just loudly warn? 17:32:28 #proposal attempt to find a good way to show the user an error and fail the boot rather than change our UUID design for this particular invalid setup. 17:32:30 loudly warn 17:32:35 fail the boot in initrd, on each boot? 17:32:43 i was thinking people were leaning towards error 17:32:43 walters: fail? it's a pretty bad race 17:33:04 yeah basically it's a condition people would want to rectify 17:33:12 +1 to fail. way nicer error than other possible failure modes 17:33:23 true 17:33:24 because at some point, boot will fail 17:33:27 could we do even more? 17:33:43 with an obscure error like ostree failing to find the rootfs 17:33:43 dustymabe: like, wipe out the other disk(s) partitions automatically? 17:33:45 so basially we detect boot/root matching but also CLHM if we find more than one part with boot label 17:33:54 walters: ^^ 17:33:59 dustymabe: format one of the boot partition, random choice :) 17:34:09 let's say we get lucky and boot/root match on this boot 17:34:10 hehe 17:34:20 but next boot it might fail to match (race) 17:34:31 CLHM could help us show the user the potential problem 17:34:56 just an idea, either way current proposal stands 17:34:57 openshift users probably don't see CLHM on every boot 17:35:02 jlebon: good point 17:35:07 votes? 17:35:07 even if root/boot match, we should probably check for other boot partitions 17:35:15 In theory if we detect a mismatch, we could e.g. only delete/mark notable the invalid boot partition that we used 17:35:17 we may not find them in time (racy) but we could fail if we did 17:35:19 and then reboot 17:35:25 that would lead to eventual reconcilation 17:35:33 without arbitrary waiting 17:35:42 walters: mark ourselves invalid, or the other one? 17:35:49 ourselves, only if we detect it was invalid 17:36:08 unless we don't know if it's boot that's wrong or root 17:36:11 it may be valid but still on the "other" disk 17:36:18 hmm.. auto reconciliation here seems potentially problematic 17:36:22 :) 17:36:30 isn't it true that damage may have already been done? 17:36:37 i.e. stabilizing on one outcome isn't enough 17:36:57 can you elaborate on "damage"? 17:36:59 * dustymabe is really enjoying this detailed discussion 17:36:59 it's mostly on first boot that we do a lot of stuff with /boot 17:37:05 walters: update skew? 17:37:09 sorry jaimelm for $time 17:37:11 also, we don't know which disk the user intended us to use 17:37:29 agreed, this proposal is picking one arbitrarily 17:37:51 #proposal attempt to find a good way to show the user an error and fail the boot rather than change our UUID design for this particular invalid setup. 17:37:55 can bootloader order change on each boot without explicit action? 17:37:56 can we stick with this ^^ for now 17:38:08 sure would be nice if we had a reliable way to get that info from the bootloader 17:38:24 for reference, one of the reporter was happy enough to know there was a node problem coming from this duplicate partitions, and re-provision the node in a correct way 17:38:29 for now, and figure out a helpful way to notify the user 17:38:35 jlebon: I think this depends, but for a server with e.g. two nvme drives both with EFI partitions, it might simply race 17:38:36 dustymabe: maybe let's keep chatting in the ticket for now? 17:38:48 jlebon: +1 17:38:48 jlebon: i.e. no agreed upon outcome? 17:38:52 yeah 17:38:55 yeah, continue discussion 17:39:00 that's fine, but i'll atleast do a summary 17:39:04 ^^ 17:39:07 +1 17:39:14 well summary of the current proposed 17:39:18 #topic open floor 17:39:23 welcome all to open floor 17:39:26 sorry about $time 17:39:43 #info help wanted to chase down a containers-common issue in rawhide https://github.com/coreos/fedora-coreos-tracker/issues/981 17:40:02 #info the `next` stream has been moved to Fedora Linux 35 content - please please test! 17:40:05 walters: it should race and then /iterate/ 17:40:32 walters: assuming you're talking about the case where no variables are configured 17:40:33 any other topics for open floor? 17:41:23 for the containers-common issue, don't feel like you need to be an expert.. we can help guide you 17:41:26 * jaimelm will look at 981 but is busy 17:41:43 +1 17:41:45 * jaimelm isn't mediumxpert 17:41:56 will close out the meeting in 60s unless new topic come up 17:42:49 jlebon: reminder for the CI walkthrough - or anyone else that wants to give me the tour 17:43:09 jaimelm: let's chat in the channel 17:43:09 #endmeeting