21:00:18 <serpent> #startmeeting 21:00:18 <MeetBot> Meeting started Wed Feb 26 21:00:18 2020 UTC. The chair is serpent. Information about MeetBot at http://wiki.debian.org/MeetBot. 21:00:18 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic. 21:00:24 <zigo> hi o/ 21:00:53 <waldi> hi 21:01:02 <serpent> Welcome in New Yaar :-) Our last meeting was in December 2019, so it's 2 months 21:01:10 <marcello^> hi there ! 21:02:00 <serpent> Looking at our mailing list - Emmanuel is working on Vagrant 21:02:13 <serpent> Bastian started working on AWS user management 21:02:37 <serpent> We still don't have official AWS account - process is still stuck at SPI 21:02:56 <noahm> we have the account, but can't yet publish AMIs to the marketplace. 21:03:15 <noahm> The account is in use and all the buster AMIs are there and usable by any AWS customer 21:03:21 <serpent> Yes - we're still missing marketplace and gov aggreemeng 21:03:59 <serpent> #action I'll ping SPI again, either this week or beginning next week about that 21:04:01 <noahm> We're *so* close to being able to publish to the marketplace. SPI has given signoff, but apparently they want to actually be the ones to click the Accept button for the agreement, for some unknown reason. 21:04:44 <waldi> well. in the meantime they are not longer sure who are "they" 21:05:15 <noahm> afaik it's just tpot. 21:06:10 <serpent> Regardless - it's long time. I even got question about Buster images in my company, so I assume this is a bit confusing for ordinary people 21:06:11 <noahm> Anyway, we have had quite a few contacts about this, and it would be *really* nice to finally resolve it. 21:06:46 <serpent> And as we're so close, it would be nice to finish it 21:07:22 <noahm> It's a good thing I don't have admin access to the AWS account, I might just go click the button and then beg forgiveness from SPI. ;) 21:07:38 <serpent> :-) 21:08:16 <serpent> I also don't have admin access there ;-/ Not sure if it's worrying or safer this way 21:08:35 <serpent> Should we move to next topic? E.g. Image Finder? 21:08:43 <noahm> before we move on... 21:08:52 <noahm> is there anything we actually *can* do to move the process along? 21:09:09 <serpent> Not except for sending more emails 21:09:19 * noahm sets up a cron job... 21:09:29 <serpent> Who has acccess to our root account? 21:10:12 <noahm> waldi and ? 21:10:42 <waldi> currently me and zobel, as this are the ones i encrypted the files to. we never talked about it 21:11:21 <serpent> It's not really urgent, but IMO people from SPI and delegates should also have access 21:11:31 <serpent> Or at least ability to get access 21:11:52 * Mrfai nods 21:12:20 <serpent> I know that zobel is in SPI, but he was quite absent for last 3 months (which is worrying as he was supposed to drive marketplace agreement) 21:14:15 <serpent> #topic Delegates 21:14:30 <serpent> As we're on this topic... 21:14:51 <serpent> #action I'll send email to Sam reminding him about appointing more delegates. 21:15:13 <noahm> these are the delegates we agreed on at the MIT cloud sprint? 21:15:40 <serpent> Yes - me, MrFai and rvandegrift 21:15:46 <noahm> ok 21:16:05 <Mrfai> ok. next topic please 21:16:08 <serpent> Sam was busy recently, so response for my first email was to sent it later 21:16:15 <serpent> #topic Image Finder 21:16:38 <Mrfai> status? 21:16:43 <serpent> The most urgent IMO is putting information about images built on Salsa to database 21:16:51 <serpent> I don't think it's done 21:16:52 <zigo> Right. 21:17:10 <noahm> I don't even think we've settled on an approach to doing so. 21:17:28 <serpent> Not really - the only thing from sprint is that it should be done 21:17:35 <zigo> We need that, then 1/ make it so that it can work with MySQL 21:17:35 <zigo> 2/ Get the db sync stuff out of manage.py and provide a standalone /usr/bin tool. 21:17:43 <noahm> Is it going to be push based? Pull based? How are we going to handle auth? 21:18:54 <noahm> Is anybody actually planning on dedicating time to this in the next month? 21:19:14 <zigo> There's also still the problem that we need to figure out which image is really new (ie: with one package updated), so we don't pull silly daily images which would make the list of image just huge ! 21:19:47 <noahm> I don't think we should look at the daily builds at all. 21:20:09 <noahm> The release builds are generated by a different salsa project, so they should be very easy to distinguish. 21:20:34 <Mrfai> Let's focus on the release builds for now 21:20:37 <marcello^> how often does a release build take place ? 21:20:44 <noahm> every point release 21:20:50 <serpent> Agreed. Let's start with something smaller and easier to manage 21:20:58 <noahm> plus usually for things like kernel security updates 21:21:12 <noahm> (things that require a reboot to take effect) 21:21:22 <marcello^> I see 21:21:59 <Mrfai> Will anybody work on importing data? 21:22:13 <noahm> I will plan on spending some time on this in the next month. 21:22:20 <Mrfai> great 21:22:24 <noahm> I'll post on the mailing list if I get anywhere. 21:22:28 <serpent> You mean existing data, taken from e.g. marketplace? 21:22:34 <Mrfai> I we have all info in the json files on cloud.d.org a simple pull can be used. No auth needed. 21:22:43 <noahm> serpent: no, salsa is the source of truth 21:22:51 <serpent> OK 21:23:01 <noahm> Mrfai: right, if we want to pull from there, we can, and that'll be fine. 21:23:14 <zigo> I'm still not satisfied on the way the tool is deployed, and this should be reworked, the way I wrote above. 21:23:23 <serpent> #info We only take image info from Salsa, no other soource is considered official 21:24:06 <noahm> zigo: I will look at that as well 21:24:12 <serpent> zigo: agreed, but IMO it does not make sense to make perfect setup for service publishing old data 21:24:33 <serpent> Unless we can work on this independently 21:24:34 <zigo> We're not talking about a "perfect setup" here, but something that will just not work. 21:24:34 <Mrfai> btw, is the cloud finder currently online? 21:24:56 <zigo> It runs in a docker, and if it fails, I simply have no idea how to bring it back online. 21:25:16 <zigo> I want the image finder to be properly packaged and easy to deploy, maybe with some ansible / puppet. 21:25:17 <serpent> Then I agree this is problem 21:25:23 <zigo> Otherwise, I don't think it's sustainable. 21:25:24 <noahm> Mrfai: I don't think so. 21:25:28 <zigo> Please don't take it lightly. 21:26:10 <noahm> zigo: I'm not sure I agree. A docker container likely has far fewer moving parts than something managed by ansible or puppet. 21:26:34 <zigo> noahm: Not really, it's pulling from pypi right now ... 21:26:38 <Mrfai> http://image-finder.debian.net/ currently only shows an apache under construction page 21:26:40 <zigo> It's not reproducible. 21:26:45 <noahm> zigo: yeah, that's not good 21:26:59 <zigo> Oh ... 21:27:03 <zigo> Well, it used to work ! :) 21:27:05 <waldi> pypi is reproducible 21:27:45 <noahm> It depends on when it's pulling from pypi, really; if it's during the container image build, then it's probably ok. 21:27:52 <noahm> If it's during startup... then that would be bad. 21:27:53 <zigo> waldi: I saw really a lot of hacks based on pypi, I'm sure we can do so many things with it, but that's IMO off topic. 21:28:14 <noahm> zigo: agreed, let's move on. 21:28:25 <zigo> For the image-finder being broken right now, well ... I didn't know and just discover it now ! :) 21:28:26 <zigo> :( 21:28:41 <zigo> Anyway, since it has old data in it only, it wasn't very valuable. 21:28:43 <noahm> it's got stale data anyway, right? So it's just a demo more than anything else. 21:29:04 <zigo> Does anyone know if Arturo has some time available, btw? 21:29:18 <zigo> noahm: Correct ! 21:29:24 <serpent> But without at least something running, we cannot work on importing new images to it 21:29:25 <zigo> And we need to figure out how to make it fetch data. 21:29:30 <zigo> Right now, I have no idea how ... 21:29:48 <noahm> Given that we haven't heard or seen anything from him, I'm guessing he has no time. Which is why I am volunteering to work on this. 21:29:52 <serpent> Accoring to Arthur there is some API to use. 21:30:03 <serpent> Or we could just insert data into database 21:30:17 <zigo> serpent: Yeah, but same, we have no idea how, documentation is missing there too. 21:31:05 <zigo> So anyway, that's the state of things for the image-finder... 21:31:13 <zigo> Let's move on? :) 21:31:23 <serpent> #info Arthur sent email with link to some documentation: https://cloud-team.pages.debian.net/image-finder/ 21:31:36 <zigo> noahm: If you're volunteering, I'd happily work with you on this. 21:32:15 <noahm> ok. I'll first just spend some time familiarizing myself with the existing implementation. 21:35:35 <serpent> Should we move to next topic? 21:35:40 <Mrfai> yes 21:35:42 <noahm> yes 21:35:49 <serpent> if so - which one? AWS user accounts (waldi) or Vagrant? 21:36:13 <marcello^> I can talk about Vagrant 21:36:19 <serpent> OK 21:36:25 <serpent> #topic Vagrant 21:37:05 <marcello^> so I have started to move some of the work from the vagrant-boxes repo on salsa to debian-cloud-images, to use FAI instead of packer 21:37:05 <serpent> So what's the status? Do you have plans or need help? 21:37:41 <marcello^> I think around a third of the work is done 21:37:47 <serpent> Cool! 21:37:53 <marcello^> I have this open merge request: https://salsa.debian.org/cloud-team/debian-cloud-images/-/merge_requests/186 21:38:43 <serpent> I can see you're disussing this with waldi 21:38:49 <marcello^> I would prefer if someone can review my work in the beginning and then I can commit directly, as I mostly will touch my own FAI classes 21:39:00 <marcello^> yes waldi is reviewing :) 21:39:06 <noahm> I'll take a look at that, as well. We should get it into the daily pipeline as well. 21:39:22 <marcello^> noahm: thank you. 21:39:28 <waldi> i opened issues for the tasks 21:39:36 <marcello^> What is the daily pipeline ? 21:40:01 <serpent> Salsa job to build daily images 21:40:06 <noahm> marcello^: https://salsa.debian.org/cloud-admin-team/debian-cloud-images-daily builds cloud images daily using GitLab CI 21:40:17 <serpent> We discussed it shortly regarding image finder 21:40:21 <marcello^> noahm: thanks. 21:40:21 <noahm> for buster, bullseye, and sid. 21:40:33 <waldi> #info issues for vagrant support https://salsa.debian.org/cloud-team/debian-cloud-images/issues/18 21:40:36 <serpent> Basically it's good way of testing our images 21:41:31 <marcello^> I am not 100% sure of the overlap of Vagrant and cloud images, but I will try :) 21:41:50 <marcello^> other question, what do I have to do to make the Vagrant boxes official ? 21:42:16 <marcello^> the stuff here: https://app.vagrantup.com/debian/ 21:42:17 <waldi> does someone have a running ubuntu system and can take a look if they still build ssh keys during boot? 21:42:21 <serpent> marcello^: initial idea was to try also with cd images, so don't worry about scope or overlap :-) 21:43:30 <marcello^> waldi: are you talking about Ubuntu Vagrant box specifically or general Ubuntu ? 21:43:44 <waldi> general ubuntu 21:44:17 <waldi> the hashicorp ubuntu vagrant boxes are darn weird, they include multiple kernel version 21:45:11 <marcello^> the hashicorp ubuntu boxes are to be forgotten I think, but Ubuntu has their own, you can download them amount their cloud images IIRC 21:45:37 <marcello^> s/amount/amongst/ 21:46:20 <waldi> #action waldi continue working with marcello^ on vagrant build 21:46:37 <marcello^> ok I don't have anything more on the topic, noah if you activate the daily build I'd be happy to see it 21:47:06 <noahm> once we get your MR merged, I'll look at that. 21:47:12 <Mrfai> marcello^: If there's anything FAI related, just ask me 21:48:10 <marcello^> Mrfai: I'll sure have some questions, I'll probably ask on Debian cloud ML if that's fine for you 21:48:38 <Mrfai> yes, or just write me personally 21:49:32 <serpent> Should we move to next topic? 21:49:44 <marcello^> marcello^: yes 21:49:50 <noahm> yep 21:50:07 <serpent> So - AWS user accounts (via Salsa) or DebConf? 21:50:17 <serpent> CFP was just announced 21:50:35 <serpent> Is it too early to discuss it yet? 21:50:56 <noahm> I think it's reasonably to agree that we should talk about something there. ;) 21:51:03 <noahm> *reasonable 21:51:46 <noahm> I hope to attend, and would be interested in presenting something, as well as having a BoF 21:51:50 <serpent> Yes. It looks like I won't come there (work related conflict) 21:52:10 <serpent> #topic DebConf 21:53:49 <rvandegrift> not 100% sure yet, but I probably have a conflict too 21:54:24 <Mrfai> I'll try to come 21:54:24 <zigo> I've attended all debconf since 2011, but wont come this year. 21:54:40 <serpent> I guess we'll need to return to this closer to registration period 21:55:28 <zigo> I'd be ok attending a BoF remotely, if that can be setup. 21:56:14 <serpent> We'll try to do it - a bit like we did during first and second sprint (IRC, maybe something more) 21:56:29 <noahm> tangentially related: I don't suppose anybody is attending SCALE next week, are they? 21:56:42 <serpent> #idea Ability for remove BoF attendance 21:56:56 <waldi> remove… 21:57:12 <serpent> Sorry: s/remove/remote/ 21:57:41 <serpent> It's not Freudian slip :-) 21:58:06 <serpent> It's almost 1h - should we discuss something more, or finish? 21:58:55 <zigo> Yeah. 21:58:57 <zigo> cloud-utils 21:59:10 <serpent> #topic cloud-utils 21:59:14 <zigo> noahm: Looks like we have another good candidate for a buster update, no? 21:59:19 <noahm> yes, we do 21:59:29 <zigo> Will you take care of it? 21:59:36 <noahm> though afaik even upstream hasn't added IMDSv2 support there yet. 21:59:42 <noahm> Yes, I plan on working on it. 21:59:48 <zigo> I'm also worried that we're getting no reply from the release team for cloud-init. Worried, but kind of not surprised ... :( 22:00:15 <noahm> yeah, I will prepare a 19.4 upload for stable and test that, then bug the release team again. 22:00:36 <noahm> IMDSv2 support will likely impact other cloud SDKs (e.g. for Ruby, Go, Python, etc) 22:00:47 <waldi> zigo: well, you ignored what they said for bug reports: include the diff 22:00:51 <zigo> I've opened already maybe half a dozen bug for openstack related updates too, so it'd be nice if someone else than me was bugging them indeed. 22:00:58 <zigo> Oh... 22:01:03 <zigo> waldi: I just didn't see it. 22:02:06 <noahm> many of the packages that need updates for IMDSv2 are not owned by the cloud-team. Somebody (probably me) should engage with the maintainers and look at backporting that support to the stable versions. 22:02:08 <zigo> waldi: There's no such request in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947351 22:02:27 <zigo> noahm: What packages are we talking about? 22:03:29 <noahm> python-boto, golang-github-aws-aws-sdk-go-dev, awscli, ruby-aws-sdk 22:03:35 <noahm> etc 22:03:43 <zigo> Oh, so quite a bunch ... :/ 22:04:07 <noahm> it's specifically an AWS feature, so people who don't care about AWS won't be impacted (i.e. OpenStack) 22:04:27 <noahm> But AWS customers who want to enable that feature will find that a lot of things break in stable today. 22:05:12 <noahm> If you don't turn on IMDSv2, then everything still works fine, but some people will likely want it. 22:05:28 <waldi> noahm: how long until it get mandatory? 22:05:37 <noahm> I don't know that it will ever be mandatory. 22:06:09 <noahm> I'll send mail to debian-cloud with more details. 22:07:11 <serpent> noahm thanks, we can discuss it more fully there 22:07:15 <noahm> Bug #952563 contains some background and links. 22:09:10 <waldi> serpent: something more? you brought up aws users, do you want to know something about it? 22:09:42 <serpent> If you have something new (more than what you wrote in email) we could discuss it 22:09:53 <serpent> Otherwise - let's slowly finish it 22:10:43 <waldi> noahm: i don't think there are news on those further aws accounts? 22:10:56 <noahm> davdunc: are you here? ^^^ 22:11:03 <davdunc> I am . 22:11:07 <noahm> I nagged davdunc about them last week. And again just now. ;) 22:11:30 <davdunc> :D there has been a modification in the way the accounts work. 22:11:48 <davdunc> it has slowed me down because i have some cleanup to do with the business team. 22:12:07 <davdunc> moved from linked to aws organizations. 22:12:21 <davdunc> I will keep you posted. 22:13:06 <serpent> Thanks. Should we test it a bit? 22:13:22 <waldi> test what? 22:13:45 <serpent> https://awsauth.debian.net/ 22:13:56 <serpent> I haven't yet tried to login using this link 22:14:03 <waldi> you can try. but you won't get far 22:14:41 <serpent> ok, then send info to ML when it makes sense to try to login 22:15:27 <waldi> so noone sees problems with that approach? 22:15:57 <noahm> it looks good to me. 22:16:14 <serpent> You mean that we use Salsa as identity provider? I'm OK with that, especially if also 2FA is used 22:16:21 <serpent> Can we check that? 22:16:59 <noahm> waldi: to be clear, the ultimate goal is to be able to open up cloud resources to DDs? 22:17:37 <rvandegrift> it sounded good to me 22:17:49 <noahm> serpent: I have one more short topic when we're done with AWS/salsa auth stuff 22:18:10 <waldi> no, the ultimate goal is to allow other teams, for example the qa people, to specify users with access to their resources without our intervention 22:18:32 <noahm> waldi: that's basically what I meant. :) 22:18:52 <serpent> noahm your topic? 22:19:11 <noahm> The AWS CloudFront archive mirror 22:19:21 <waldi> noahm: ah, i missread you 22:19:28 <serpent> #topic CloudFront mirror 22:19:49 <noahm> cdn-aws.deb.debian.org is the default apt source in EC2. 22:20:01 <noahm> It lives in JEB's account (the legacy AWS account) 22:20:26 <noahm> I have contacted him about rebuilding it in one of the newer accounts. 22:20:50 <noahm> He sounds generally supportive of the idea, since he has very little time to devote to it. 22:21:37 <noahm> There is also some possibility that AWS itself will be willing to offer Debian archive services, and I'll follow up on that internally. 22:21:37 <serpent> So I guess we need manpower to do it? 22:22:11 <noahm> well, at the very least, I am sure that I have more time to devote to this than JEB does. 22:22:17 <noahm> But I don't know how much is involved. 22:22:39 <waldi> noahm: i really would like to use a separate accounts for the different projects, one of them the mirror stuff. this however is someone in limbo 22:23:01 <noahm> waldi: agreed. this isn't something that could happen immediately anyway. 22:23:35 <serpent> waldi: you created many accounts during sprint. Was it for supporting different needs, like those mirrors? 22:23:42 <waldi> serpent: yes 22:24:12 <waldi> each part project can get it's own account, so we don't need to share and make sure the resources don't conflict 22:24:40 <serpent> So we need first to see what needs to be set up, and then decide how to set up 22:26:01 <serpent> noahm: anything for us to do, or will you send info to ML when more is known 22:26:35 <noahm> Nothing for us to do now. I'll keep in touch with JEB and the rest of the team 22:26:43 <serpent> Thanks. 22:26:47 <noahm> and will send an update when there's something substantial to say 22:26:59 <noahm> Just wanted to make sure people knew about it. 22:27:08 <serpent> Really thanks 22:28:19 <serpent> Unless there is anything urgent, I propose finishing. It's late and I'm getting tired. 22:28:33 <serpent> And don't want to sleep on keyboard :-) 22:28:38 <marcello^> me too, let's finish 22:28:38 <Mrfai> yes, let's finish 22:28:42 <zigo> I think it's done. 22:28:44 <zigo> Just one more thing ... 22:28:56 <zigo> Next meeting will be after dailight saving change, no? 22:29:09 <zigo> dailight 22:29:12 <zigo> daylight 22:29:14 <zigo> grrr... 22:29:30 <serpent> March? If we do it in last week, probably. If earlier, before daylight saving time 22:29:36 <zigo> So, should we keep the same time, meaning one hour less for UTC ? 22:29:41 <serpent> #topic next meeting 22:30:03 <serpent> You mean - let's keep 22:00 CET/CEST? 22:30:09 <serpent> And update UTC as needed? 22:30:09 <zigo> Yeah ! 22:30:17 <serpent> Any objections? 22:30:19 <zigo> If everyone agrees ... 22:30:28 <noahm> No objection here. I am OK with an hour in either direction. 22:30:29 <waldi> for me it's currently a bit late 22:30:50 <waldi> but after DST it should fit for now 22:30:58 <marcello^> for me too, I would prefer one hour earlier 22:31:15 <rvandegrift> either is okay with me 22:31:40 <Mrfai> i'm fine with all +1, -1 or stay at same time 22:32:05 <serpent> zigo - are you open to have meeting one hour earlier? 22:32:20 <zigo> It's hard for me to be there, because of kids ... 22:32:32 <zigo> We could do 30 mins earlier though ? :) 22:33:08 <serpent> OK - let's try 25th of March on 21:30 CET 22:33:16 <zigo> +1 22:33:19 <marcello^> +1 22:33:25 <serpent> #action I'll send email about that 22:33:54 <serpent> And sumary of this meeting - but most probaly at beginning of next week (i.e. 2-4th of March) 22:34:03 <serpent> #endmeeting