Wednesday, 2015-02-04

*** dkingshott has quit IRC00:04
*** EricGonczer_ has quit IRC01:18
*** rmoe has quit IRC01:21
*** MentalRay has joined #openstack-dns01:29
*** stanzgy has joined #openstack-dns01:37
*** rmoe has joined #openstack-dns01:37
*** EricGonczer_ has joined #openstack-dns02:08
*** EricGonczer_ has quit IRC02:31
*** ToMiles has joined #openstack-dns03:32
*** ToMiles has quit IRC03:37
*** MentalRay has quit IRC03:54
*** richm has quit IRC04:15
*** ToMiles has joined #openstack-dns05:32
*** ToMiles has quit IRC05:37
*** nihilifer has joined #openstack-dns06:05
*** chlong has joined #openstack-dns07:07
*** chlong has quit IRC07:28
*** nkinder has joined #openstack-dns08:08
*** stanzgy has quit IRC08:52
*** jordanP has joined #openstack-dns08:53
*** stanzgy has joined #openstack-dns08:54
*** kodokuu has joined #openstack-dns09:09
kodokuuHi, Question : If I have a domain toto.com, Can I create a domain tata.toto.com with designate ?09:10
*** jordanP has quit IRC09:18
*** jordanP has joined #openstack-dns09:25
*** jordanP has quit IRC09:25
*** boris-42 has joined #openstack-dns09:39
ekarlsokodokuu: yes as the same tenant09:49
*** jordanP has joined #openstack-dns09:58
kodokuuekarlso  same tenant ? I need just to create a new domain ?10:16
ekarlsokodokuu: just create a new domain ye10:17
kodokuuok10:19
kodokuuand the feature like tenantA.domain.com, tenantB.domain.com is possible, in future ?10:19
ekarlsokodokuu: good q :/10:45
*** stanzgy has quit IRC10:47
*** MentalRay has joined #openstack-dns10:50
*** MentalRay has quit IRC10:57
*** untriaged-bot has joined #openstack-dns11:03
untriaged-botUntriaged bugs so far:11:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/141626411:03
untriaged-bothttps://bugs.launchpad.net/python-designateclient/+bug/141556011:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/141380611:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/141243111:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/141633711:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/141626311:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/141302411:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/128944411:03
*** untriaged-bot has quit IRC11:03
*** kodokuu has quit IRC11:47
*** mwagner_lap has quit IRC12:20
*** mwagner_lap has joined #openstack-dns12:27
*** vipul has quit IRC12:59
*** vipul has joined #openstack-dns13:03
*** nkinder has quit IRC13:10
*** richm has joined #openstack-dns14:13
*** Claudio_ has joined #openstack-dns14:16
*** nkinder has joined #openstack-dns14:31
*** EricGonczer_ has joined #openstack-dns14:41
*** EricGonc_ has joined #openstack-dns14:55
*** EricGonczer_ has quit IRC14:55
*** zhang_liang has joined #openstack-dns14:57
*** timsim has joined #openstack-dns15:02
*** EricGonczer_ has joined #openstack-dns15:02
*** EricGonc_ has quit IRC15:03
*** nkinder has quit IRC15:04
*** nkinder has joined #openstack-dns15:06
dvorakI'm investigating using designate for our prod environment, and I'm curious if people would recommend using juno or master15:08
*** vinod has joined #openstack-dns15:08
*** paul_glass has joined #openstack-dns15:08
dvorakjuno branch rather15:08
*** vinod has quit IRC15:08
*** vinod has joined #openstack-dns15:08
timsimdvorak: Juno is best at the moment.15:09
*** kodokuu has joined #openstack-dns15:10
*** vinod has quit IRC15:13
kodokuuHi, I enabled keystone authentification and now I can't reach records with API : 404 errors15:13
kodokuuekarlso Kiall_ http://pastebin.com/6ZjvF9nD15:14
zhang_liangKiall_, is the doc for msdns-agent ready ? or there is any new design for that?15:14
kodokuuWhen I request /domains  I have 0 domain O_o15:15
Kiall_zhang_liang: apologies, I'm literally back in the office today after like a month of travel..15:16
*** Kiall_ is now known as Kiall15:16
Kiall(actually back in the office for like 6 minutes so far)15:16
Kiallkodokuu: Now that you have auth enabled, the domains are registered under the "no project" project, but your request is for a specific project15:17
timsimkodokuu: If you were using the noauth middleware before, you're zones/records will be under the tenant "noauth-project"15:17
kodokuuyes i see tenant_id in domains table15:17
*** EricGonczer_ has quit IRC15:17
KiallYou can drop into the DB and change all the tenant_id columns to whatever your keystone tenant (also known as project) id is15:17
kodokuuSo Can I have one domains for all tenant ?15:17
KiallOut of the box, no.. The system is multi-tenant, one tenant can't see or change another tenant's stuff15:18
KiallYou can edit the policy.json file to allow everyone "all_tenants" access, then GET /v1/domains?all_tenants=True to get everything if you like...15:19
kodokuuok Each tenant can create domain like tenantA.mydomain.com, tenantB.mydomain.com  ?15:19
KiallIs this Juno or master?15:20
kodokuuJuno15:20
Kiall(different way of doing that in juno vs master)15:20
dvorakKiall: but at that point, you have to trust your tenants not to break each other?15:20
Kialldvorak: Yes, but how else would you allow different tenants access to the same zone without trust?15:21
Kiall(Hence we don't allow 1 tenant to change another tenants stuff out of the box)15:21
dvorakI'm not complaining, just making sure I understood correctly :)15:21
Kiallah :)15:21
kodokuuyes, now i just need all instance create a record in same tenant, and all users of all tenant can create a records in this domain15:21
kodokuucreate in same domain*15:21
KiallSo - Effectivly, everyone has access to everything in the domain? or am I reading that wrong?15:22
kodokuuyes15:22
kodokuueveryone has access15:22
kodokuuBut If each domain can manage his domain, How sink add records ?15:23
*** MentalRay has joined #openstack-dns15:24
KiallSink has access to everything, so can do anything with any zone regardles of who owns it. The stock sink handlers are intended as little more than examples for you to customize - everyone wants something different from sink - so we wrote some examples and made it support plugins to decide exactly what to do when it sees an event15:25
KiallSo - When sink get's an "instance created event" you might want to create <instance>.domain.com, or <instance>.tenant1.com, or <instance>.tenant1.domain.com, etc15:26
kodokuu<instance>.tenant1.domain.com15:26
kodokuuBut before that i need to create one domain for each tenant ?15:27
kodokuuAnd change tenant_id in mysql with each tenant15:27
KiallSo, none of the samples will do that, but writing a plugin is pretty easy.. We have a sample (including all the python packaging boilerplate etc) here: https://github.com/openstack/designate/tree/master/contrib/designate-ext-samplehandler15:27
kodokuuok and if i need <instance>.domain.com ?15:29
kodokuuwith keystone authenficaiton15:29
KiallThe stock sink handlers will create those records, but end users won't be able to see them via the API unless they belong to the same tenant as the domain does... If you want that, you can do the all_tenants thing I mentioned above15:30
kodokuuok with /v1/domains?all_tenants=True ?15:30
timsimkodokuu: HTTP header X-Auth-All-Projects = True15:32
KiallYea, that'll return all domains - so long as the end user passes the all_tenants policy15:32
Kialltimsim: or ^ header.. both are accepted15:32
Kiallhttps://github.com/openstack/designate/blob/stable/juno/etc/designate/policy.json#L8 is the default rule15:32
Kiallchanging that to "all_tenants": "@", would let everyone in15:32
zhang_liangunderstand, Kiall, could you please provide the doc about msdns-agent by the end of week, I would be happy and spend my whole weekend on it if that happens.15:32
Kiall(@ is the oslo.policy way of saying "This rule will always pass")15:33
kodokuuok works15:33
dvorakKiall: so owner is always at the domain level, not at the record level then?15:33
Kiallkodokuu: also, there is future work been talked about before around "sharing" a zone.. e.g. zone is owned by tenant1, but tenant1 chooses to allow tenant2 and tenant3 access, but not tenant4 etc15:33
kodokuuBut I'am admin, so for that i need to change policy like "all_tenants": "rule:admin" ==> "all_tenants": ""  ?15:34
Kiallowner is a tenant_id match between the domain and user15:34
Kiall"all_tenants": "rule:admin" ==> "all_tenants": "@"  - the @ is oslo.policy way of saying "This rule will always pass"15:34
kodokuuok i test now :p15:35
Kiall(The policy.json file is a config file BTW - Just not one 90% of users would need to customize..)15:35
Kiallzhang_liang: I can make that work :)15:39
kodokuuOk works, Sink record in my domain, and i can see with API :)15:41
Kiall:)15:42
kodokuuBut my dev told me hard to add X-Auth-All-Projects: True with binding python for ansible15:42
KiallBoth the query string and the header do the same thing, just 2 ways of supplying it15:43
kodokuuRedHat does not want add designate to RDO ?15:47
KiallUnsure, I've not spoke with any of the RDO folks15:49
*** vinod has joined #openstack-dns15:52
*** zhang_liang has quit IRC15:54
kodokuuI have a contact with a red hat engineer who RDO package. I can ask him15:54
*** nkinder has quit IRC16:02
Kiallvinod: about?16:02
vinodyes16:03
Kiallre https://review.openstack.org/#/c/152174/16:03
KiallI'm thinking the def get_action_and_status(self, recordset): method you added in the RRSet view should really be attached to the RRSet object instead..  Thoughts?16:03
openstackgerritMerged openstack/designate: Updated from global requirements  https://review.openstack.org/15271016:04
vinodso do you want method with the RRset object or the action and status fields (which would be calculated) on the rrset object?16:05
*** nkinder has joined #openstack-dns16:06
KiallI think that method would split into 2 - 1 for action, 1 for status.. those would be defined as @property methods on the RRSet object, and they could be used like recordset['action'] or recordset.action etc, but you wouldn't be able to set them directly16:07
KiallI think.. Hence asking what you think ;)16:07
vinodthat sounds good - i will do that16:07
KiallLooking at the base object code.. https://github.com/openstack/designate/blob/master/designate/objects/base.py#L36316:08
vinodhow about the calculation of the status and action - any thoughts on that?16:08
kodokuuHow can I add X-Auth-All-Projects: True  with python client ?16:08
KiallI think we still have some issues with how you calculate it - But - I'm not sure if it's worth blocking this review on. Specifically, if I update the RRSet TTL - All records change, but nothing changes to PENDING16:09
vinodhmm for that we need to modify the central code - i think16:11
KiallYea - I've not given much thought to the right way to do that yet..16:11
KiallLiterally just back in the office after way too much travel.16:12
Kiallkodokuu: Ehh - Looking at the python bindings, I'm not sure we expose a way to trigger that .. Humm16:12
vinodKiall, when you have a chance - could you also review https://review.openstack.org/#/c/148779/16:13
KiallYou can certainly do it in a roundabout way, by setting the headers field on a Reuests session then, using that to create a Keystoneclient Session, then finally give that session to the Designate bindings16:13
Kiallvinod: yep, trying to work through code reviews now :)16:13
*** EricGonczer_ has joined #openstack-dns16:21
*** EricGonczer_ has quit IRC16:22
*** nihilifer has quit IRC16:31
openstackgerritEndre Karlson proposed openstack/designate: Support secondary zones  https://review.openstack.org/13368216:31
ekarlsotimsim: ^ addressed your comments16:31
timsimCool!16:34
*** MentalRay has quit IRC16:36
openstackgerritEndre Karlson proposed openstack/designate: MDNS part of Secondary zones  https://review.openstack.org/13368316:38
ekarlsohttps://review.openstack.org/#/c/133683/18/designate/mdns/handler.py16:39
ekarlsoregarding your comment there timsim I think the idea was to add zones based on some special rrdata16:40
timsimInteresting, so you would query the master for some private-use recordset and transfer/add if so?16:41
ekarlsotimsim: I think that's outside this atm ;P16:43
ekarlsoKiall: maybe u got a clue on ^?16:44
timsimOh I definitely agree.16:44
ekarlsotimsim: another issue that I've not addressed at16:45
ekarlsois where to place logic for periodic sync a'la scan for domains where the domain is expired and re-axfr them16:45
timsimI still think Designate should catch that DomainNotFound exception and handle it gracefully though. I guess it's not the worst thing in the world if that function just stops when it can't find it though.16:45
ekarlsotimsim: yeah, I did return response if it's not found now16:46
timsimNot here yet? https://review.openstack.org/#/c/133683/16:47
ekarlsonope -,,-16:48
timsimI suppose periodic sync could ask for an AXFR, but it would seem ok to me that you could either just resend the NOTIFY from the master side, or touch the zone, which would ask for an AXFR, rather than have Periodic Sync do it.16:48
timsimtouch via the API that is16:48
*** kodokuu has quit IRC16:48
*** MentalRay has joined #openstack-dns16:48
ekarlsotimsim: but meh, what happens if someone asks designate for a query then in a zone that's expired ?16:48
timsimHm. Well I suppose at that point it should check it's master. Or just send back "you're all good." If you've got a lot of secondary zones it would put a lot of strain on mdns trying to do axfrs every time a refresh interval came up.16:50
timsimOf course, you'd still have to do a database query to find out of it's a secondary zone.16:51
timsimSo wouldn't it just send back whatever is in it's database?16:51
timsimit=Designate16:51
ekarlsohmm sure16:52
*** timsim has quit IRC16:54
*** timsim has joined #openstack-dns16:54
*** rjrjr has joined #openstack-dns16:55
*** nkinder has quit IRC16:57
ekarlsotimsim: regarding https://review.openstack.org/#/c/133683/18/designate/mdns/xfr.py what piece would you want to have moved ?16:58
timsimit seems like you could have that domain_sync function in dnsutils, and use the current do_axfr function that's in there for some of that.16:59
timsimThen you could elimnate the Class and the rest of the file.16:59
timsimJust a refactoring thing, not that important.16:59
mugsie /j #openstack-meeting-alt16:59
mugsie /j #openstack-meeting-alt16:59
Kialllol17:01
*** rmoe has quit IRC17:02
*** untriaged-bot has joined #openstack-dns17:03
untriaged-botUntriaged bugs so far:17:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/141626417:03
untriaged-bothttps://bugs.launchpad.net/python-designateclient/+bug/141556017:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/141380617:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/141243117:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/141633717:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/141626317:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/141302417:03
untriaged-bothttps://bugs.launchpad.net/designate/+bug/128944417:03
*** untriaged-bot has quit IRC17:03
*** lmd has joined #openstack-dns17:03
*** lmd has quit IRC17:04
*** openstack-dns114 has joined #openstack-dns17:04
*** nkinder has joined #openstack-dns17:07
*** rmoe has joined #openstack-dns17:21
dvorakSo we're using galera to do mysql replication across sites, but our RabbitMQ clusters are local to each site.  Would it be possible to have a separate Designate instance in each site, but share a database, so that domains don't have to be site specific?17:23
dvorakSeems like that could be a really bad idea, depending on how the messaging works17:23
timsimdvorak: We're in #openstack-meeting-alt right now, you should join us :) and ask that question during open discussion (right now)17:25
dvorakdoh, I forgot the time changed17:25
*** MentalRay has quit IRC17:29
*** nkinder has quit IRC17:30
fillerhi dvorak17:52
fillerglad to see another designate ops/infra/arch person here.  :)17:53
dvorakWell, hopefuilly I'll know enough about designate in the not so distant future to fit that description :)17:54
fillerwell, we too are going through the motions of how to scale this out for production use.17:55
dvorakah, ok :)17:56
dvorakdo you mind saying who you're with?17:56
fillerdvorak: yep.  i work at rackspace with timsim, vinod, others.17:56
dvorakah, cool :)17:56
dvorakI'm with Time Warner Cable.  I'm finishing up some other work and just started working out how we might use designate.  We've gotten a lot of requests from our internal customers for DNS.  It's a big pain point17:59
fillercan i ask what your resolver backend is?  bind9?  powerdns?17:59
dvorakstill working that out, I'm playing with powerdns for the time  being18:00
filleror is that up in the air for the internal greenfield also18:00
fillerah, ok18:00
dvorakwe currently use infoblox for our auth dns, so given that it's a domain per tenant, we might do integration there18:00
dvorakwe'll have to work out what the intake process will look like18:01
*** dkingshott has joined #openstack-dns18:12
boris-42Kiall: hey18:20
boris-42Kiall: there are some new benchmarks recently merged into Rally18:20
boris-42Kiall: maybe we should put them in designate gates?18:29
*** vinod has quit IRC18:41
*** vinod1 has joined #openstack-dns18:41
*** jordanP has quit IRC18:41
*** MentalRay has joined #openstack-dns18:41
dkingshottAre there any troubleshooting docs for designate? I've deployed but am getting an error when creating a new domain and nothing is being logged to indicate the error..18:43
timsimdkingshott: Is debug logging on?18:44
dkingshottSure is.18:44
timsimInteresting...I've usually found some hint there.18:44
dkingshottit's a very generic error: Error 'DNS'18:45
timsimWe don't have troubleshooting docs, per se. If you describe the deployment you're working on, we might be able to help though :)18:45
dkingshottOk, so I actually sit about 6 feet away from Kiall's boss :) I followed the 'getting started guide' on docs.openstack.org, straight up powerdns back end with DB.18:46
Kialldkingshott: I'm pretty sure I met you like 2.5 weeks ago ;)18:46
dkingshottYep :)18:46
dkingshottThe english guy...18:46
KiallYep - That;s the one18:47
KiallIf Error 'DNS' is coming out of the CLI, it's because of a missing keystone catalog entry for the DNS service.18:47
dkingshottOk, even if it's not integrated with keystone?18:47
Kiall(Keystoneclient raises an excetion with 'dns' as the message)18:47
dkingshottI see.. so the getting started guide needs updating then :)18:47
KiallAh.. Yes, we have a docs sprint next week to refresh our docs ;)18:48
dkingshottI did see bug 1268310 but didn't think it applied as I hadn't integrated keystone, i'll go back and do that and see how far I get18:48
dkingshottthank you.18:48
Kiallyou can supply a token and endpoint directly with --os-token and --os-endpoint args to the CLI18:48
KiallBypassing Keystone that way18:48
dkingshottgot it. thanks18:49
Kiallthe keystone catalog*18:49
Kialland if KS integration isn't on, any old token value will do18:49
dkingshottcool.. got further and have a different error now, so i'll dig some more, thank you Kiall18:50
KiallHeh - Never a good thing.18:51
KiallLet us know what's missing from the docs, https://etherpad.openstack.org/p/designate-documentation-sprint is the WIP list of things we're going to try tackle next week18:51
Kialldkingshott: and if your guys are bored the morning of Fri 13th - Join us to help fix the gaps ;)18:53
Kiallyou guys*18:53
Kiallboris-42: heya, I saw Rama added those :)18:54
boris-42Kiall: ya18:55
KiallI'll have a look and see if I can add them to our gate, see how that section of code performs ;)18:58
boris-42Kiall: ok =) btw you can put bigger load19:02
boris-42Kiall: even in current one19:02
dvorakI've not seen designate-agent or designate-pool-manager mentioned in any of the docs.  Are they not commonly used?19:12
*** EricGonczer_ has joined #openstack-dns19:13
openstackgerritEndre Karlson proposed openstack/designate: MDNS part of Secondary zones  https://review.openstack.org/13368319:13
timsimdvorak: They've very new. No docs for them yet.19:14
dvorakah, ok.  I just realized that while I switched to the juno branch, I didn't rerun the local install to switch to the juno bits19:15
dvorakdkingshott: I just ran into the same 'dns' error :)19:17
*** EricGonczer_ has quit IRC19:18
timsimrjrjr: Is the memcached stuff in https://review.openstack.org/#/c/149428/6 testable or does it need more work?19:20
*** rudrajit has joined #openstack-dns19:52
vinod1kiall: Re https://review.openstack.org/#/c/152174/, adding readonly fields to the Recordset object seems to be a messy implementation with checks at various places in base.py to check if this is a computed field - any ideas on how to do this more cleanly?19:57
*** dkingshott has quit IRC19:58
KiallI think we get most of it for free by not defining a field, and doing an @property method20:00
Kiallvinod1: ^20:00
vinod1Hmm - I seem to have seen some problems with that - let me try that again20:02
*** dkingshott has joined #openstack-dns20:06
*** timsim has quit IRC20:08
*** timsim has joined #openstack-dns20:08
vinod1Kiall: The problem with that I see is that the status and action seem to be evaluated at the object creation time - so they are always the default values - 'ACTIVE' and 'NONE20:11
*** EricGonczer_ has joined #openstack-dns20:15
*** EricGonczer_ has quit IRC20:25
*** EricGonczer_ has joined #openstack-dns20:26
*** timsim_ has joined #openstack-dns20:27
*** EricGonczer_ has quit IRC20:31
*** penick has joined #openstack-dns20:35
*** timsim__ has joined #openstack-dns20:56
*** timsim has quit IRC20:57
*** timsim_ is now known as timsim20:57
*** timsim has quit IRC20:57
*** d34dh0r53 is now known as blarnath21:48
*** blarnath is now known as d34dh0r5322:05
*** rjrjr_ has joined #openstack-dns22:27
rjrjr_timsim: the cache work is ready to test/review/etc.22:35
*** rudrajit has quit IRC22:40
*** MentalRay has quit IRC22:45
*** vinod1 has quit IRC22:50
*** timsim__ has quit IRC22:54
*** rjrjr__ has joined #openstack-dns23:09
*** paul_glass has quit IRC23:09
*** rjrjr_ has quit IRC23:09
*** rjrjr__ has left #openstack-dns23:10
*** rjrjr_ has joined #openstack-dns23:10
*** rjrjr has quit IRC23:11
*** rjrjr_ has left #openstack-dns23:11
*** rjrjr has joined #openstack-dns23:13
*** penick has quit IRC23:13
*** penick has joined #openstack-dns23:17
*** EricGonczer_ has joined #openstack-dns23:18
*** EricGonczer_ has quit IRC23:19

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!