Page MenuHomePhabricator

Q3 :rack/setup/install cloudvirt refresh
Closed, ResolvedPublic

Description

This task will track the racking, setup, and OS installation of X

Hostname / Racking / Installation Details

Hostnames: What are the hostnames, and have you updated https://wikitech.wikimedia.org/wiki/Infrastructure_naming_conventions ?
Racking Proposal: Where should these systems be racked? Can they share with any existing systems or should they avoid any other systems sharing their rack or row? Use https://fault-tolerance.toolforge.org/map to optimize this placement.
Networking Setup: # of Connections:1 - Speed: 10G. - VLAN: cloud-hosts
OS Distro: Bookworm (default unless otherwise specified)
Boot Method: Legacy BIOS or UEFI. Please note UEFI must have partman updates applied in advance of setup and is currently in pilot program: https://wikitech.wikimedia.org/wiki/UEFI_Boot
Sub-team Technical Contact: @Andrew

Per host setup checklist

Each host should have its own setup checklist copied and pasted into the list below.

cloudvirt1077:
  • Receive in system on procurement task T412418 & in Coupa
  • Rack system with proposed racking plan (see above) & update Netbox (include all system info plus location, state of planned)
  • Run the Provision a server's network attributes Netbox script - Note that you must run the DNS and Provision cookbook after completing this step
  • Immediately run the sre.dns.netbox cookbook
  • Immediately run the sre.hosts.provision cookbook
  • Run the sre.hardware.upgrade-firmware cookbook
  • Update the operations/puppet repo - this should include updates to preseed.yaml, and site.pp with roles defined by service group: https://wikitech.wikimedia.org/wiki/SRE/Dc-operations
  • Run the sre.hosts.reimage cookbook
cloudvirt1078:
  • Receive in system on procurement task T412418 & in Coupa
  • Rack system with proposed racking plan (see above) & update Netbox (include all system info plus location, state of planned)
  • Run the Provision a server's network attributes Netbox script - Note that you must run the DNS and Provision cookbook after completing this step
  • Immediately run the sre.dns.netbox cookbook
  • Immediately run the sre.hosts.provision cookbook
  • Run the sre.hardware.upgrade-firmware cookbook
  • Update the operations/puppet repo - this should include updates to preseed.yaml, and site.pp with roles defined by service group: https://wikitech.wikimedia.org/wiki/SRE/Dc-operations
  • Run the sre.hosts.reimage cookbook
cloudvirt1079:
  • Receive in system on procurement task T412418 & in Coupa
  • Rack system with proposed racking plan (see above) & update Netbox (include all system info plus location, state of planned)
  • Run the Provision a server's network attributes Netbox script - Note that you must run the DNS and Provision cookbook after completing this step
  • Immediately run the sre.dns.netbox cookbook
  • Immediately run the sre.hosts.provision cookbook
  • Run the sre.hardware.upgrade-firmware cookbook
  • Update the operations/puppet repo - this should include updates to preseed.yaml, and site.pp with roles defined by service group: https://wikitech.wikimedia.org/wiki/SRE/Dc-operations
  • Run the sre.hosts.reimage cookbook
cloudvirt1080:
  • Receive in system on procurement task T412418 & in Coupa
  • Rack system with proposed racking plan (see above) & update Netbox (include all system info plus location, state of planned)
  • Run the Provision a server's network attributes Netbox script - Note that you must run the DNS and Provision cookbook after completing this step
  • Immediately run the sre.dns.netbox cookbook
  • Immediately run the sre.hosts.provision cookbook
  • Run the sre.hardware.upgrade-firmware cookbook
  • Update the operations/puppet repo - this should include updates to preseed.yaml, and site.pp with roles defined by service group: https://wikitech.wikimedia.org/wiki/SRE/Dc-operations
  • Run the sre.hosts.reimage cookbook

Event Timeline

@Andrew
Please update the site.pp file with the insetup role for your team (detailed on https://wikitech.wikimedia.org/wiki/SRE/Dc-operations) and add the new servers to preseed.yml for partition info.

If possible, please reference this task number in your patch set, so it is clear when complete. Once complete, just un-assign yourself (leaving no assignee) for this task and once the hardware arrives on-site engineerss will claim this task for racking and setup. Please don't re-subscribe me to this task unless there is a direct question for me.

Thank you!

@Andrew, I’m assuming these will be cloudvirt1077–1080 and that they’re replacing six servers currently located in D5. That would leave two in D5, and we currently have none in C8.

I am racking one in D5 and three in C8.

Let me know if that is ok with you

Additionally we have
13 cloudvirt in E4
15 cloudvirts in F4

these servers are failing to provision. @elukey Supermicro...

Connecting to the BMC as user root (wmf_root_mgmt)
Testing Redfish API connection to cloudvirt1077 (10.65.1.144)
The response payload does not contain any valid JSON to log.
Failed to run cookbooks.sre.hosts.provision.SupermicroProvisionRunner._try_bmc_password: Client Response error when trying to contact the BMC.
==> What do you want to do? "retry" the last command, manually fix the issue and "skip" the last command to continue the execution or completely "abort" the execution.
>

@Jclark-ctr I didn't find the BMC passwords in our shared sheet, could you please send them to me so I can try to run provision?

It seems to me that the BMC is not getting an IP address, but for cloudvirt1078 I see:

elukey@install1005:~$ sudo journalctl -u isc-dhcp-server.service --since '2 hours ago' | grep 10.65.1.147
May 04 15:16:44 install1005 dhcpd[390969]: DHCPOFFER on 10.65.1.147 to 90:5a:08:29:67:25 via 10.65.0.1
May 04 15:16:44 install1005 dhcpd[390969]: DHCPREQUEST for 10.65.1.147 (208.80.154.134) from 90:5a:08:29:67:25 via 10.65.0.1
May 04 15:16:44 install1005 dhcpd[390969]: DHCPACK on 10.65.1.147 to 90:5a:08:29:67:25 via 10.65.0.1

So the BMC should get the right IP, but it fails to configure itself?

@elukey It looks like the servers powered themselves off. I power-cycled them again. They’re still failing, but they’re getting farther in the provisioning process.

Running IPMI command: ipmitool -I lanplus -H cloudvirt1078.mgmt.eqiad.wmnet -U root -E chassis power status
Error: Unable to establish IPMI v2 / RMCP+ session
Exception raised while executing cookbook sre.hosts.provision:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/spicerack/ipmi.py", line 90, in command
    output = run(command + command_parts, env=self.env.copy(), stdout=PIPE, check=True).stdout.decode()
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/subprocess.py", line 571, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['ipmitool', '-I', 'lanplus', '-H', 'cloudvirt1078.mgmt.eqiad.wmnet', '-U', 'root', '-E', 'chassis', 'power', 'status']' returned non-zero exit status 1.

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/spicerack/_menu.py", line 265, in _run
    raw_ret = runner.run()
              ^^^^^^^^^^^^
  File "/srv/deployment/spicerack/cookbooks/sre/hosts/provision.py", line 415, in run
    self.ipmi.check_connection()
  File "/usr/lib/python3/dist-packages/spicerack/ipmi.py", line 105, in check_connection
    self.power_status()
  File "/usr/lib/python3/dist-packages/spicerack/ipmi.py", line 115, in power_status
    status = self.command(["chassis", "power", "status"], is_safe=True)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/spicerack/ipmi.py", line 92, in command
    raise IpmiError(f"Remote IPMI for {self._target} failed (exit={e.returncode}): {e.output}") from e
spicerack.ipmi.IpmiError: Remote IPMI for cloudvirt1078.mgmt.eqiad.wmnet failed (exit=1): b''
Released lock for key /spicerack/locks/cookbooks/sre.hosts.provision:cloudvirt1078: {'concurrency': 1, 'created': '2026-05-04 17:31:38.217788', 'owner': 'jclark@cumin1003 [4071054]', 'ttl': 1800}
END (FAIL) - Cookbook sre.hosts.provision (exit_code=99) for host cloudvirt1078.mgmt.eqiad.wmnet with chassis set policy FORCE_RESTART

Change #1282402 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[operations/puppet@production] Initial entries for cloudvirt1077-1080

https://gerrit.wikimedia.org/r/1282402

Change #1282402 merged by Andrew Bogott:

[operations/puppet@production] Initial entries for cloudvirt1077-1080

https://gerrit.wikimedia.org/r/1282402

Change #1282413 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[operations/puppet@production] cloudvirt1077-1080: use efi in pressed

https://gerrit.wikimedia.org/r/1282413

Change #1282413 merged by Andrew Bogott:

[operations/puppet@production] cloudvirt1077-1080: use efi in pressed

https://gerrit.wikimedia.org/r/1282413

@Jclark-ctr okok the error makes more sense, those are X14-based supermicros like kafka-logging*, so we'll need the new provision cookbook for them.

Updating the root user's password on the BMC.
Changing password for the account with username root: /redfish/v1/AccountService/Accounts/3
Updating the ADMIN user's password on the BMC.
Changing password for the account with username ADMIN: /redfish/v1/AccountService/Accounts/2
Updated current instance password to the new password
Running IPMI command: ipmitool -I lanplus -H cloudvirt1077.mgmt.eqiad.wmnet -U root -E chassis power status
Error: Unable to establish IPMI v2 / RMCP+ session

I also tested it with spicerack-shell - it seems as if the root's password change is not set, so ipmi cannot use it.

@elukey is there anything I can do to help with this?

elukey changed the task status from Open to Stalled.May 13 2026, 1:39 PM

We got confirmation from Supermicro that the root user is reserved from now on, so we need to solve T426180 before proceeding.

@Jclark-ctr once T426180 is resolved and hosts can be reimaged, please rack as follows

1077 -> C8
1078 -> D5
1079 -> E4
1080 -> F4

Found another Redfish issue, this task need to wait for https://gerrit.wikimedia.org/r/c/operations/software/spicerack/+/1293593 to be merged and deployed (new spicerack release).

@Jclark-ctr once T426180 is resolved and hosts can be reimaged, please rack as follows

1077 -> C8
1078 -> D5
1079 -> E4
1080 -> F4

i have moved servers to these locations i have also updated netbox and switch ports pending provisioning

elukey changed the task status from Stalled to Open.Jun 15 2026, 7:28 AM

@Jclark-ctr I am running a new version of the provision cookbook as a test and I see some serial-related errors for cloudvirt1078-1079-1080. The error says: the serial in Redfish doesn't match the one in Netbox. Could you please check when you have a moment?

Set all BMCs to DHCP, so they should now pick up the correct IPs. Verified the MAC addresses match in the BMC, NetBox, and on the server stickers.

It's possible some of the earlier provisioning attempts happened before the servers were moved, and they may have been renamed along the way, which could explain the discrepancies.

@Jclark-ctr all provisioned! I reimaged cloudvirt1077 and it is ready now, but cloudvirt1078 seems missing basic network setup on Netbox. Anything missing on that side?

Looks like this is failing with the provision script. @cmooney Said he can take a look later to resolve it

cloudvirt1078 (WMF11006): unsupported case, found 2 v4 prefixes and 1 v6 prefixes, expected 1 and 0 or 1 respectively, skipping IP allocation.

cloudvirt1077, 1079 and 1080 are running Trixie. The only one missing is 1078.

Looks like this is failing with the provision script. @cmooney Said he can take a look later to resolve it

cloudvirt1078 (WMF11006): unsupported case, found 2 v4 prefixes and 1 v6 prefixes, expected 1 and 0 or 1 respectively, skipping IP allocation.

The issue here is that you re-assigned the IP range 10.64.20.0/24 from vlan 1118(cloud-hosts1-eqiad) to vlan 1128 (cloud-hosts1-c8-eqiad) and then to vlan 1127 (cloud-hosts1-d5-eqiad):

https://netbox.wikimedia.org/extras/changelog/257868/
https://netbox.wikimedia.org/extras/changelog/257871/

As a result the Netbox script finds two subnets for the vlan in rack d5 and doesn't know which to allocate an IP from.

I've reset things now and re-tested the provisioning it worked ok.

[info] Called with parameters: {'device': <Device: cloudvirt1078 (WMF11006)>, 'z_port': 37, 'interface_type': '10gbase-x-sfpp', 'cable_id': '', 'z_nbdevice': None, 'vlan_type': 'cloud-hosts', 'vlan': None, 'mgmt_mac': '90:5a:08:29:6b:26'}
[warning] cloudvirt1078 (WMF11006): Skipping assignment of MGMT interface because already allocated
[success] cloudvirt1078 (WMF11006): created interface ##PRIMARY## (mgmt=False)
[debug] cloudvirt1078 (WMF11006): selecting address from prefix 10.64.150.0/24
[success] cloudvirt1078 (WMF11006): assigned IPv4 10.64.150.2/24 to interface ##PRIMARY## with DNS name 'cloudvirt1078.eqiad.wmnet'.
[success] cloudvirt1078 (WMF11006): marked IPv4 address 10.64.150.2/24 as primary IPv4 for device.
[success] cloudvirt1078 (WMF11006): assigned IPv6 2620:0:861:11e:10:64:150:2/64 to interface ##PRIMARY## with DNS name 'cloudvirt1078.eqiad.wmnet'.
[success] cloudvirt1078 (WMF11006): marked IPv6 address 2620:0:861:11e:10:64:150:2/64 as primary IPv6.
[success] cloudsw1-d5-eqiad (WMF4808):xe-0/0/37 configured vlan.
[warning] cloudvirt1078 (WMF11006): assuming Black  because 10gbase-x-sfpp
[success] cloudvirt1078 (WMF11006): created cable #11250

Change #1303355 had a related patch set uploaded (by Cathal Mooney; author: Cathal Mooney):

[operations/software/netbox-extras@master] Provision script: improve error message if two prefixes found for vlan

https://gerrit.wikimedia.org/r/1303355

@cmooney cloudvirt1078.eqiad.wmnet leads to a NX domain, but I see something provisioned in netbox: https://netbox.wikimedia.org/dcim/devices/6773/interfaces/

Are we missing some config?

@cmooney cloudvirt1078.eqiad.wmnet leads to a NX domain, but I see something provisioned in netbox: https://netbox.wikimedia.org/dcim/devices/6773/interfaces/

Are we missing some config?

I forgot to run the sre.dns.netbox cookbook is all, sorry. Running now.

Ahhh okok! I see all working now thanks!

Just reimaged cloudvirt1078, I think all hosts are ready now!

Please note: the provision/reimage changes to make this happen are not merged yet, I test-cookbooked them, so you cannot re-run immediately those if needed (ping me in case).

Jclark-ctr updated the task description. (Show Details)