| *** flwang has joined #openstack-containers | 02:42 | |
| *** ykarel|away has joined #openstack-containers | 02:50 | |
| *** ykarel|away has quit IRC | 02:55 | |
| *** hongbin has joined #openstack-containers | 02:58 | |
| *** ykarel|away has joined #openstack-containers | 03:54 | |
| *** udesale has joined #openstack-containers | 04:09 | |
| *** janki has joined #openstack-containers | 04:30 | |
| *** ivve has joined #openstack-containers | 04:41 | |
| *** ykarel|away has quit IRC | 04:47 | |
| openstackgerrit | Akhil jain proposed openstack/magnum master: Add framework for magnum-status upgrade check https://review.openstack.org/611505 | 04:58 |
|---|---|---|
| *** ykarel|away has joined #openstack-containers | 05:04 | |
| *** hongbin has quit IRC | 05:07 | |
| *** ykarel|away is now known as ykarel | 05:51 | |
| *** spsurya has joined #openstack-containers | 06:39 | |
| *** pcaruana has joined #openstack-containers | 07:20 | |
| *** pcaruana has quit IRC | 07:34 | |
| *** ykarel is now known as ykarel|lunch | 07:35 | |
| *** pcaruana has joined #openstack-containers | 07:40 | |
| *** ykarel|lunch is now known as ykarel | 08:35 | |
| *** mgoddard has joined #openstack-containers | 09:36 | |
| *** shrasool has joined #openstack-containers | 10:02 | |
| kevko | hi, is there plan to switch scripts used in service instances to python3 ? | 10:34 |
| *** shrasool has quit IRC | 11:07 | |
| *** shrasool has joined #openstack-containers | 11:08 | |
| *** udesale has quit IRC | 11:11 | |
| openstackgerrit | Ashish Billore proposed openstack/magnum master: Add k8s_centos_ironic_v1 driver https://review.openstack.org/464544 | 11:35 |
| *** brtknr has joined #openstack-containers | 12:00 | |
| *** janki has quit IRC | 12:10 | |
| *** shrasool has quit IRC | 12:25 | |
| brtknr | strigazi: how does cern handle autoscaling of k8s cluster? | 13:17 |
| strigazi | brtknr: I'm implementing smth here: https://github.com/cernops/autoscaler/ I haven't push yet | 13:20 |
| strigazi | s/push/pushed/ | 13:20 |
| brtknr | Nice! | 13:21 |
| brtknr | It talks to Nova? | 13:22 |
| strigazi | no, to heat for scale down, to magnum to scale up. | 13:22 |
| brtknr | s/Nova/Magnum | 13:23 |
| brtknr | sorry I meant to say Magnum... | 13:23 |
| brtknr | Why not magnum directly to scale down? | 13:23 |
| strigazi | brtknr: to delete specific nodes. | 13:24 |
| strigazi | brtknr: this functionality is not there yet. | 13:24 |
| strigazi | brtknr: this functionality is not there yet in magnum. To delete a specific node. | 13:24 |
| brtknr | So Magnum will think there are still n+1 node even after heat has removed the node? | 13:25 |
| strigazi | for the prototype, yes | 13:25 |
| brtknr | strigazi: Ok cool, I'll play around with it | 13:26 |
| strigazi | brtknr: whatch the repo, I'll ping as soon as it works. | 13:27 |
| strigazi | brtknr: whatch the repo, I'll ping you as soon as it works. | 13:27 |
| brtknr | strigazi: Ah I assumed it already worked :P | 13:29 |
| *** lpetrut has joined #openstack-containers | 13:44 | |
| *** ign0tus has joined #openstack-containers | 13:58 | |
| *** shrasool has joined #openstack-containers | 14:17 | |
| *** ykarel is now known as ykarel|away | 14:31 | |
| *** ykarel|away has quit IRC | 14:37 | |
| *** ign0tus has quit IRC | 14:51 | |
| *** munimeha1 has joined #openstack-containers | 14:53 | |
| *** udesale has joined #openstack-containers | 15:05 | |
| *** lpetrut has quit IRC | 15:40 | |
| *** salmankhan has joined #openstack-containers | 15:43 | |
| *** itlinux has quit IRC | 15:57 | |
| *** shrasool has quit IRC | 15:57 | |
| *** hongbin has joined #openstack-containers | 16:07 | |
| *** udesale has quit IRC | 16:11 | |
| *** shrasool has joined #openstack-containers | 16:13 | |
| *** shrasool has quit IRC | 16:28 | |
| *** itlinux has joined #openstack-containers | 16:43 | |
| *** shrasool has joined #openstack-containers | 17:07 | |
| *** shrasool has quit IRC | 17:20 | |
| *** lpetrut has joined #openstack-containers | 17:24 | |
| *** tobias-urdin is now known as tobias-urdin_afk | 17:27 | |
| *** shrasool has joined #openstack-containers | 17:52 | |
| *** salmankhan has quit IRC | 18:13 | |
| *** imdigitaljim has joined #openstack-containers | 18:13 | |
| *** tobias-urdin_afk is now known as tobias-urdin | 18:38 | |
| *** pcaruana has quit IRC | 18:47 | |
| *** itlinux has quit IRC | 20:39 | |
| strigazi | Anyone here for the meeting? | 20:58 |
| flwang | strigazi: i have a meeting now | 20:59 |
| flwang | sorry, i can't join the meeting today | 20:59 |
| flwang | i will be back after 1 hour | 21:00 |
| strigazi | flwang: thanks, no problem | 21:00 |
| *** shrasool has quit IRC | 21:00 | |
| flwang | strigazi: still around? | 21:01 |
| flwang | my meeting just cancelled | 21:01 |
| strigazi | I'll wait a bit more in case someone shows up | 21:01 |
| cbrumm_ | We'll have people here today | 21:02 |
| flwang | cbrumm_: will Jim around? | 21:02 |
| strigazi | Let's start then, the meeting was set for 2100 UTC | 21:03 |
| strigazi | ##startmeeting containers | 21:03 |
| cbrumm_ | yeah, he's here, just not paying attention right now | 21:03 |
| strigazi | #startmeeting containers | 21:03 |
| openstack | Meeting started Tue Nov 20 21:03:29 2018 UTC and is due to finish in 60 minutes. The chair is strigazi. Information about MeetBot at http://wiki.debian.org/MeetBot. | 21:03 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 21:03 |
| *** openstack changes topic to " (Meeting topic: containers)" | 21:03 | |
| openstack | The meeting name has been set to 'containers' | 21:03 |
| strigazi | #topi Roll Call | 21:03 |
| strigazi | o/ | 21:03 |
| strigazi | #topic Roll Call | 21:03 |
| *** openstack changes topic to "Roll Call (Meeting topic: containers)" | 21:03 | |
| strigazi | o/ | 21:04 |
| cbrumm_ | o/ | 21:04 |
| imdigitaljim | o/ | 21:04 |
| flwang | o/ | 21:04 |
| strigazi | #topic Stories/Tasks | 21:05 |
| *** openstack changes topic to "Stories/Tasks (Meeting topic: containers)" | 21:05 | |
| strigazi | tasks I added in the agenda: | 21:05 |
| strigazi | #link https://wiki.openstack.org/wiki/Meetings/Containers#Agenda_for_2018-11-20_2100_UTC | 21:05 |
| strigazi | 1. Helm in k8s clusters | 21:06 |
| strigazi | After some discussion in gerrit, we decided not to have the binary in the heat-agent | 21:06 |
| strigazi | since the agent has specific purpose related to heat and versioning is complicated. | 21:07 |
| strigazi | I implemented an alternative where a k8s job is deployed by the agent | 21:07 |
| strigazi | The job runs in a minimal container which includes the helm bin | 21:08 |
| strigazi | and this container is versioned with the helm verion | 21:08 |
| strigazi | Does this make sense? | 21:08 |
| flwang | you mean running Helm as a pod on top of k8s cluster | 21:10 |
| flwang | ? | 21:10 |
| cbrumm_ | I'd like to see more, but yes it makes sense | 21:10 |
| strigazi | one moment to dig the code. | 21:10 |
| strigazi | Can't http://paste.openstack.org/raw/735868/ | 21:13 |
| openstackgerrit | Jim Bach proposed openstack/magnum master: Make providing a keypair optional https://review.openstack.org/590443 | 21:13 |
| *** itlinux has joined #openstack-containers | 21:13 | |
| strigazi | Since we create the role, we can leverage it deploy tiller. | 21:14 |
| strigazi | In the same way we can deploy charts. | 21:15 |
| cbrumm_ | looks good, pretty straight forward . | 21:15 |
| strigazi | What I need your input on though is the following. | 21:16 |
| strigazi | The best practice of helm, is secure tiller with tls and one tiller per ns | 21:16 |
| strigazi | I think it would make sense to have tiller configured in kube-system for us to deploy additional components, eg prometheus, sssd, node problem detector, k8s-keystone-auth and so on | 21:17 |
| strigazi | And for users can deploy tiller in other namespaces, they shouldn't use the global tiller anyway and tiller in kube-system should have powers only there. | 21:19 |
| strigazi | makes some sense? | 21:19 |
| imdigitaljim | yup | 21:19 |
| strigazi | the default tiller sounds like a no-go to me | 21:19 |
| cbrumm_ | yes, split tillers are better I feel | 21:19 |
| strigazi | no tls and admin access is pretty bad | 21:20 |
| strigazi | on the other hand, if we use the job model I posted, we can deploy components with helm template && k apply -f | 21:21 |
| strigazi | Enough with helm, we can continue on gerrit. let's mode on to upgrades. | 21:22 |
| strigazi | 2. We discusses briefly with flwang in Berlin about it, the work I've done I'll break it in four patches and move things: | 21:23 |
| strigazi | a. patch for the API: https://review.openstack.org/#/c/514959/ | 21:24 |
| strigazi | b. add the heat agent in all nodes: https://review.openstack.org/#/c/561858/ | 21:25 |
| strigazi | c. part from https://review.openstack.org/#/c/561858/ to move most software configs in software deployments | 21:25 |
| strigazi | d. final software deployment to upgrade the nodes: https://review.openstack.org/#/c/514960/ | 21:26 |
| flwang | looks good for me | 21:26 |
| strigazi | This way it will be more review friendly and modular. | 21:26 |
| strigazi | well "modular" | 21:27 |
| cbrumm_ | will check these out | 21:27 |
| strigazi | and one last item from me | 21:27 |
| strigazi | For k8s-keystone-auth | 21:28 |
| strigazi | I discussed with Ricardo chaning the magnum client to produce a k8s-keystone-auth friendly kubeconfig, would that make sense? | 21:28 |
| flwang | strigazi: that would be great | 21:29 |
| cbrumm_ | I think so | 21:29 |
| strigazi | openstack coe cluster config --keystone-auth | 21:29 |
| strigazi | or similar | 21:29 |
| flwang | i will pick up that patch asap | 21:29 |
| strigazi | --k8s-keystone-auth | 21:29 |
| flwang | strigazi: i love it | 21:29 |
| strigazi | The question is, what would that be | 21:29 |
| strigazi | the simplest way is: | 21:29 |
| strigazi | http://paste.openstack.org/raw/735869/ | 21:30 |
| strigazi | with the token encoded in kubeconfig. | 21:30 |
| strigazi | it is very similar the the certs options | 21:31 |
| strigazi | in that case you have everything in one file in the filesystem | 21:31 |
| cbrumm_ | would the user be adding their token to it or would the cli be filling that part in? | 21:31 |
| strigazi | the clo | 21:31 |
| strigazi | the cli | 21:31 |
| strigazi | IMO the user should always do a single cmd. | 21:32 |
| imdigitaljim | so they have to get a new config when their token expires or edit it every time? | 21:32 |
| strigazi | there is the option with the client in the cpo repo but at cern is a no-go due to the lack of kerberos. | 21:33 |
| strigazi | imdigitaljim: every 24h at least for us. how long is for you? | 21:33 |
| imdigitaljim | i think the same | 21:34 |
| strigazi | other options include getting a token per call. but user will hate it | 21:34 |
| strigazi | I would | 21:34 |
| strigazi | with certs in our cloud k8s replies in 70ms | 21:34 |
| strigazi | with the token in kubeconfig in ~120ms | 21:35 |
| strigazi | with the small script in exec to do a single openstack token issue it takes 1s | 21:35 |
| strigazi | pythonclient speed levels... | 21:36 |
| imdigitaljim | http://paste.openstack.org/show/735870/ | 21:36 |
| imdigitaljim | this is what we do | 21:36 |
| imdigitaljim | (ive shared this in irc before) | 21:36 |
| imdigitaljim | and i would propose this as well | 21:37 |
| cbrumm_ | it works until the token expires, then users lose their minds and don't know what to do | 21:37 |
| strigazi | that works too, I couldn'g find it :) | 21:37 |
| imdigitaljim | ^ not referring to what was pasted | 21:38 |
| colin- | hi, sorry i'm late | 21:38 |
| *** rcernin has joined #openstack-containers | 21:38 | |
| flwang | imdigitaljim: btw, mind me picking up https://review.openstack.org/#/c/577477/ ? | 21:39 |
| imdigitaljim | oh for sure | 21:39 |
| imdigitaljim | go for it | 21:39 |
| imdigitaljim | we've switched to a centos driver | 21:39 |
| colin- | flwang: thought of you when we came across this the other day https://github.com/kubernetes/kubernetes/pull/70398 in case it affects your implementation of ipvs | 21:39 |
| colin- | (it does ours) | 21:39 |
| imdigitaljim | that id like to shoot for putting it up by stein | 21:39 |
| imdigitaljim | ill try to have blueprint documents for everyone to review in the meantime | 21:39 |
| strigazi | imdigitaljim: mainly to use a custom image? | 21:40 |
| imdigitaljim | its isolated from existing except https://review.openstack.org/#/c/615592/ https://review.openstack.org/#/c/615591/ https://review.openstack.org/#/c/590443/ | 21:40 |
| imdigitaljim | it can use upstream centos image | 21:40 |
| imdigitaljim | but yes we additionally customize it | 21:41 |
| flwang | colin-: thanks | 21:41 |
| strigazi | how do you install k8s? | 21:41 |
| imdigitaljim | ill have it in the blueprints :D | 21:41 |
| *** lpetrut has quit IRC | 21:41 | |
| flwang | imdigitaljim: for your adding clients patches, are you aware of the patch lingxian proposed? | 21:42 |
| strigazi | in stories | 21:42 |
| flwang | to add a hook for deleting resources | 21:42 |
| imdigitaljim | which one particularly | 21:42 |
| imdigitaljim | https://review.openstack.org/#/q/owner:anlin.kong%2540gmail.com+status:merged | 21:44 |
| imdigitaljim | * https://review.openstack.org/#/q/owner:anlin.kong%2540gmail.com | 21:44 |
| flwang | imdigitaljim: https://review.openstack.org/497144 | 21:45 |
| imdigitaljim | oh ok thats an okay PR but unnecessary | 21:46 |
| imdigitaljim | you can just make function calls in the delete section | 21:46 |
| imdigitaljim | ./shrug | 21:46 |
| flwang | imdigitaljim: we do know that | 21:47 |
| imdigitaljim | but yeah our driver is isolated from that | 21:47 |
| flwang | imdigitaljim: you better understand the whole picture | 21:47 |
| strigazi | imdigitaljim: are you going to maintain the centos driver upstream? | 21:47 |
| flwang | there are some case we'd like to handle with a plugin approach | 21:47 |
| imdigitaljim | yeah id imagine so | 21:48 |
| imdigitaljim | especially if any of you were considering switching once weighing the pros/cons | 21:48 |
| flwang | imdigitaljim: is there any big difference between your driver and the upstream version? | 21:48 |
| imdigitaljim | much | 21:48 |
| imdigitaljim | its faster, easier to read, easier to maintain, less effort to operate | 21:48 |
| flwang | much is not a sound answer ;D | 21:49 |
| imdigitaljim | allows easy customization based on your needs | 21:49 |
| flwang | but anyway, just propose it as a v2 or something like that, so that we can review | 21:49 |
| imdigitaljim | yeah itll be just a standalone in the drivers folder | 21:49 |
| flwang | imdigitaljim: cool | 21:49 |
| imdigitaljim | ill throw up a blue print of design and explain things | 21:49 |
| flwang | imdigitaljim: that would be nice | 21:50 |
| flwang | or you can even do both in parallel | 21:50 |
| strigazi | imdigitaljim: how fase? | 21:50 |
| strigazi | imdigitaljim: how fast? | 21:50 |
| strigazi | less than 3mins? | 21:50 |
| imdigitaljim | bootstraps in like 3 minutes | 21:50 |
| imdigitaljim | yeah | 21:50 |
| imdigitaljim | unless its spinning disk | 21:51 |
| flwang | i can't wait to see the code | 21:51 |
| imdigitaljim | which is like 6-8 | 21:51 |
| imdigitaljim | we were talking about sharing it offline | 21:51 |
| imdigitaljim | sending a zip | 21:51 |
| imdigitaljim | to you both | 21:51 |
| imdigitaljim | if you're interested in an unofficial preview at some point | 21:51 |
| flwang | imdigitaljim: that works as well | 21:51 |
| strigazi | the sooner the better we diverge. | 21:52 |
| strigazi | the sooner the better we converge . :) | 21:52 |
| imdigitaljim | https://imgur.com/a/gTazcKl | 21:53 |
| imdigitaljim | kind of a layout | 21:53 |
| flwang | looks good, code please ;) | 21:54 |
| strigazi | sounds good | 21:54 |
| imdigitaljim | also a side note as well, my wife is having a kid and ill be out about a month | 21:55 |
| imdigitaljim | but my colleagues will continue to meet | 21:55 |
| flwang | congrats first, then i would suggest sharing your code for review before your leaving | 21:56 |
| strigazi | imdigitaljim: congratulations :) | 21:56 |
| strigazi | We are reaching an hour, if there is anything else to discuss we can continue in the channel or tmr (tmr for me) | 21:58 |
| imdigitaljim | thanks@! | 21:58 |
| flwang | strigazi: i'm good | 21:59 |
| strigazi | cool, thanks for joining the meeting guys | 21:59 |
| strigazi | See you next week | 22:00 |
| flwang | see you all | 22:00 |
| strigazi | imdigitaljim: congrats again | 22:00 |
| strigazi | #endmeeting | 22:00 |
| *** openstack changes topic to "OpenStack Containers Team" | 22:00 | |
| openstack | Meeting ended Tue Nov 20 22:00:49 2018 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 22:00 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/containers/2018/containers.2018-11-20-21.03.html | 22:00 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/containers/2018/containers.2018-11-20-21.03.txt | 22:00 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/containers/2018/containers.2018-11-20-21.03.log.html | 22:00 |
| imdigitaljim | thank you! | 22:10 |
| *** itlinux has quit IRC | 22:44 | |
| *** munimeha1 has quit IRC | 22:49 | |
| *** ivve has quit IRC | 23:08 | |
| *** imdigitaljim has quit IRC | 23:20 | |
| *** hongbin has quit IRC | 23:30 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!