Thursday, 2018-01-25

*** AlexeyAbashkin has joined #openstack-fwaas00:11
*** AlexeyAbashkin has quit IRC00:15
*** hoangcx has joined #openstack-fwaas01:47
*** openstackgerrit has quit IRC03:33
*** yamamoto has joined #openstack-fwaas03:37
*** annp has joined #openstack-fwaas03:49
*** AlexeyAbashkin has joined #openstack-fwaas06:22
*** AlexeyAbashkin has quit IRC06:30
*** threestrands_ has quit IRC07:02
*** bbzhao has quit IRC08:02
*** bbzhao has joined #openstack-fwaas08:03
*** AlexeyAbashkin has joined #openstack-fwaas08:04
*** jafeha has joined #openstack-fwaas09:12
*** jafeha__ has quit IRC09:14
*** yamamoto has quit IRC10:04
*** bbzhao has quit IRC10:26
*** annp has quit IRC10:46
*** yamamoto has joined #openstack-fwaas11:05
*** yamamoto has quit IRC11:18
*** yamamoto has joined #openstack-fwaas11:31
*** eN_Guruprasad_Rn has joined #openstack-fwaas11:57
*** AlexeyAbashkin has quit IRC11:58
*** AlexeyAbashkin has joined #openstack-fwaas11:58
*** yamamoto has quit IRC12:31
*** yamamoto has joined #openstack-fwaas12:31
*** yamamoto has quit IRC12:52
*** yamamoto has joined #openstack-fwaas13:07
*** annp has joined #openstack-fwaas13:25
*** eN_Guruprasad_Rn has quit IRC13:31
*** openstackgerrit has joined #openstack-fwaas13:39
openstackgerritOpenStack Release Bot proposed openstack/neutron-fwaas-dashboard master: Update reno for stable/queens  https://review.openstack.org/53790713:39
*** yamamoto has quit IRC13:42
*** cleong has joined #openstack-fwaas13:42
*** yushiro has joined #openstack-fwaas13:57
yushiroHi14:00
annphi14:00
*** SridarK has joined #openstack-fwaas14:01
yushiroHi~14:01
SridarKHi FWaaS folks14:01
yushiro#startmeeting fwaas14:01
openstackMeeting started Thu Jan 25 14:01:58 2018 UTC and is due to finish in 60 minutes.  The chair is yushiro. Information about MeetBot at http://wiki.debian.org/MeetBot.14:01
openstackUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.14:02
*** openstack changes topic to " (Meeting topic: fwaas)"14:02
openstackThe meeting name has been set to 'fwaas'14:02
SridarKyushiro: i think ur turn to run the mtg today ?14:02
yushiro#chair SridarK yushiro  xgerman_14:02
openstackCurrent chairs: SridarK xgerman_ yushiro14:02
*** chandanc has joined #openstack-fwaas14:02
yushiroSridarK, Hi. I think today is xgerman_  :)14:02
*** yamamoto has joined #openstack-fwaas14:02
chandancHello all14:02
SridarKah ok14:02
yushirochandanc, Hi14:02
chandanchello yushiro14:02
yushiroSridarK, However, if he is difficult to handle today, I will.14:03
yushiroIs xgerman_ online?14:03
SridarKsure yushiro and i am ok to run it - if it is difficult for u today as well14:04
yushiroThanks SridarK :)14:04
SridarKI see xgerman_ online14:04
SridarKperhaps he had to step away14:04
yushiroyes, OK, let's start today's meeting.14:05
SridarKyes14:05
yushiro#topic Queens14:06
*** openstack changes topic to "Queens (Meeting topic: fwaas)"14:06
yushiroToday is Q-3(FF) deadline.14:07
yushiroThanks for your review14:07
yushiroFixed default fwg bug,   co-existing,  netlink for ipv6, auto-association for default fwg14:09
SridarK+114:09
annp+114:10
yushiroRegarding co-existing patch( https://review.openstack.org/#/c/535237), we need reno  I think.14:11
annpyes, I think so too14:11
chandancyushiro: do you mean for the migration ?14:11
yushirochandanc, annp Thanks for your discussion.  I'm sorry I couldn't join your discussion more..14:11
SridarKi believe we managed to get all the patches in before the deadline14:12
SridarKwe should also discuss https://review.openstack.org/#/c/536234/14:12
annpLet me confirm: Have we tested with co-existence in case of sg=iptables_hybrid and fwaas=OVS?14:12
yushiroSridarK, +114:12
yushirochandanc, not migration but 'why this fix is necessary or background'14:13
chandancyushiro: ok got it14:13
annpyushiro, +114:14
yushiro#link https://review.openstack.org/#/c/536234/14:14
chandancfor patch from annp14:14
SridarKyushiro: have we covered coexistence in one of our earlier L2 support patches (in terms of reno)14:14
SridarKif we describle that earlier and this if 535237 is just a bugfix - we may be ok - but chandanc can u pls double check that14:15
chandanccan we ask the end user to move to OVS based SG ? this is my only concern14:15
SridarKchandanc: also in regard to question from annp on testing coexistence with sg iptables and FWaaS L214:17
SridarKi think we are good on that correct ?14:17
chandancSridarK: annp yes i did try the iptable + OVS combination14:18
yushiroSridarK, Just a moment, let me check our previous patch.14:18
chandancand the failed case was the one we discussed in length14:18
chandancdefault firewall group should solve the issue14:18
annpchandanc, really?14:18
SridarKThe failed case is mainly to due to conn track14:18
chandancyes14:18
chandancI still have to investigate one thing that annp pointed14:19
annpchandanc, actually, I  don't think default fwg can resolve the issue.14:20
annpbecause there is one conntrack system on a compute node14:20
chandancannp: can you describe the case ?14:20
annpToday I try to test with case:14:20
chandancsure, please update the thread14:21
annpSG=iptables, FWaaS=OVS,14:21
annpVM1 with default SG allow ping, VM1 is attached with FWGA(No firewall rule)14:22
annpVM2 is attached with SG only,14:22
annpPing from VM2 to VM114:22
annpWe can ping from VM2 to VM114:23
annpVM2 is attached to default SG allow ping.14:23
yushiroSridarK, we said "if a port is associated with both firewall group and security group, then a packet must be allowed by both features.14:23
yushiro"14:23
SridarKyushiro: +114:23
chandancyushiro: +114:23
annpI think the ct_state is change from new -> +est-repl,14:24
xgerman_o/14:24
chandancannp: please confirm your findings14:24
chandanconce you have the results,14:25
-openstackstatus- NOTICE: We're currently experiencing issues with the logs.openstack.org server which will result in POST_FAILURE for jobs, please stand by and don't needlessly recheck jobs while we troubleshoot the problem.14:25
annpSo if vm2 is attached to default fwg with allow ping rules, I think VM2 can ping vm1.14:25
chandanci can test on my system, but i have to redo my devstack14:25
annpSo I think default fwg is not good solution.14:26
annpchandanc, please confirm the my test.14:26
yushiroHowever, I think previous reno says about SG for OVS...(Not explicitly mentioned)14:26
SridarKannp: but VM1 is attached to a FWG without a permit for icmp ?14:26
annpyes,14:26
annpI expect VM2 can't ping VM114:27
SridarKannp: yes14:27
SridarKso it almost seems like FWaaS is bypassed ?14:27
annpSridarK, yes, Because conntrack state is changed.14:28
SridarKdue to SG14:28
SridarKon iptables14:28
chandancSridarK: annp i did not see this happen on my system, even with icmp allowed in FWG ping was not going through14:29
annpHave you test with my case?14:29
xgerman_same OS?14:29
SridarKchandanc: annp: So i think we need to confirm this14:29
chandancyes, i will confirm14:30
yushiroVM1(defaulg SG allow:ICMP) (FWG A)  ----- (default SG allow:ICMP)VM214:30
annpyes, ping from VM2 to VM1 is ok?14:31
annpI don't have my system at home. But I just tested in my office.14:31
yushiroOK, I'll test it on Ubuntu.14:32
chandancannp: as per my tests VM2 to VM1 ping fails, let me confirm14:33
SridarKSo on this case, one observation was that without VM2 having a default FWG (even if we had permit for icmp) things will fail14:33
chandancyes, that is the test i did14:33
SridarKchandanc: ^^^ this is what u had observed correct ?14:33
chandancSridarK: +114:33
annpchandanc, hmm, let wait yushiro confirm. I think we should test careful14:34
chandancannp +114:34
yushiroannp sorry, I confused.    expect: failed to send ICMP from VM2 --> VM1   actual: success  ?14:34
annpyushiro, yes, I expect failed14:35
yushiroOK, I see.  will try it.14:35
chandancannp: can you send your test case in the same mail thread with expected result14:35
annpyes, I will to in tomorrow.14:35
yushiroannp, chandanc  +114:35
SridarKok lets confirm the difference in findings on this scenario14:36
chandancok14:36
annpHowever, I think my patch still necessary :)14:36
SridarKand we can continue the email thread14:36
SridarKannp: on ur patch lets discuss that14:36
SridarKannp: so u will prevent this scenario all together ?14:37
annpSridark, I mean we should prevent linuxbridge port14:37
chandancannp: you mean hybrid plug right ?14:37
SridarKannp: yes14:38
annpchandanc, no, if hybrid plug work corrects in coexistence mode. we no need to prevent.14:38
chandancoh14:38
xgerman_+114:38
annphowever, we should prevent linuxbridge port14:38
chandancannp +114:39
SridarKannp: so if we are doing coexistence we need both sg and FWaaS to be using ovs14:39
chandanci agree14:39
SridarKannp: and ur patch validates that14:40
chandanc        if port.binding.vif_type == pb_def.VIF_TYPE_OVS:14:40
chandanc            if not port.binding.vif_details[pb_def.OVS_HYBRID_PLUG]:14:40
chandanc                return True14:40
chandanci was confused by this14:40
annpSridarK, I mean mechanism driver= ovs or linuxbrige14:40
yushiroSridarK, +1  This is our target14:40
annpchandanc, we can remove if f not port.binding.vif_details[pb_def.OVS_HYBRID_PLUG] if hybrid port test ok14:40
chandancannp: i am more confused now14:41
chandancSG=iptables, FWaaS=OVS case you mmentioned14:41
chandancis it iptables or iptables_hybrid14:42
annpmy patch intend to prevent all ports, which doesn't support by fwg14:42
yushiroannp, In current validation, there is no relation for mechanism driver.  I think it relates firewall_driver for security_group.14:42
*** hoangcx_ has joined #openstack-fwaas14:42
yushirofirewall_driver for security_group are 'noop', 'iptables_hybrid' or 'openvswitch'.14:42
chandancyushiro: yes +114:43
annpyushiro, current source code in master branch?14:43
annpor my patch?14:43
yushiroannp,  I mean ur patch14:43
annpNo,14:43
annpmy patch intend to prevent all ports, which are not supported by FWG at API side.14:44
annpLet me take an example:14:45
annpThere is 2 compute node:14:45
annpcompute A(ml2=LinuxBridge),14:45
annpComputeB(ml2=OVS)14:45
yushiroannp, Yes, I know.  However, a point is different.  My point is a parameter 'vif_details' of the port  relates firewall_driver.14:45
annpyushiro, We can remove vif_details line if all tested with SG=iptables_hybrid and FWaaS(OVS) passed in code coexistence.14:47
chandancannp: am i correct in saying that your patch will allow only OVS + OVS case14:47
annpchandanc, yes.14:47
yushirochandanc, I think so.14:47
chandancok, in that case14:47
chandanci have only one concern14:47
chandanccan we ask the user to move SG to OVS14:48
annpBecause I need your confirm with hybrid port test.14:48
chandancSridarK: xgerman_ do you think operators will agree14:48
SridarKi have one clarfication before14:49
chandancSridarK: sure14:49
xgerman_hard to know — we need to chat with them at one of the summits14:49
chandanchmm14:49
SridarKannp: so on Compute A - we are running SG on iptables and Compute B SG on ovs ?14:49
yushirochandanc, Yes, that is your concern.  I think it's  so difficult to modify existing system.  So, preparing a new compute node with OVS ... or14:50
yushirohmm14:50
annpSridarK, compute B can running with sg=iptables_hybrid or ovs14:50
chandancyushiro: agree if there is a staged migration path14:50
annpFrom my understanding, compute A will running SG=iptables14:51
annpwith ml2 driver = openvswitch, there is 2 solution for SG: SG based iptables, it called iptables_hybrid14:52
annpand SG based OVS14:52
chandancyes14:52
SridarKagreed14:53
yushiroSorry guys, there is 8 minutes left.  Could you please continue after this meeting?14:53
annpSo, My patch will prevent ports, which are landed at compute A14:53
SridarKok14:53
chandancannp14:54
chandanci dont agree to prevent iptables based ports14:54
SridarKyes lets put the specifics down on the email thread as well14:54
yushiro#topic Open Discussion14:54
chandanchybrid is the only issue14:54
*** openstack changes topic to "Open Discussion (Meeting topic: fwaas)"14:54
SridarKok one quick update in parallel14:54
SridarKregarding the service driver Patch from doude14:55
doudehi14:55
yushiroYes.14:55
yushiroHi14:55
SridarKdoude: pls go ahead14:55
doudeok14:56
doudeso given the deadline we decided to postpone it for R14:56
SridarKwe agreed that doude will use an out of tree implementation for now for internal requirements14:56
doudeand for our customers we will write our own FWaaS service plugin for queens which implements my proposed interfece driver14:57
SridarKdoude: and u will file a bp and we will get this in R-114:57
xgerman_+114:58
SridarKdoude thx for ur understanding14:58
doudeabout that bp, how should proceed?14:58
chandanc+114:58
doude*I14:58
SridarKdoude pls file it and u can pretty much replicate the contents that u have in ur bug14:58
SridarKdoude: and we can discuss more offline14:59
doudeok14:59
yushiroIs it better to file RFE?14:59
yushiroBP ? Sorry, I just confused.14:59
SridarKah yes maybe14:59
SridarKyushiro: blueprint14:59
SridarKsorry14:59
yushiroNP. Ah, OK, BP not RFE15:00
SridarKannp: can u pls continue ur description after the mtg or put it in the email thread15:00
doudewhat's RFE?15:00
SridarKeither is ok, xgerman_ which do u think is better ?15:00
yushirodoude, Request For Enhancement.  It's same as bug report but adding a tag named 'rfe'.15:01
xgerman_I think RfE is less work and likely sufficient15:01
yushiroSridarK, xgerman_ I have 1 quick .15:01
yushirooh, it's time !15:01
xgerman_we can go over :-)15:01
SridarKxgerman_: ok makes sense15:01
SridarKoh yes we can :-)15:01
yushirolet's close weekly meeting now but please continue 1 thing :)15:02
SridarKok15:02
annpSridarK, I think we can continue discuss after meeting15:02
yushiroThanks.15:02
yushiro#endmeeting15:02
*** openstack changes topic to "Queens (Meeting topic: fwaas)"15:02
openstackMeeting ended Thu Jan 25 15:02:21 2018 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)15:02
openstackMinutes:        http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-01-25-14.01.html15:02
openstackMinutes (text): http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-01-25-14.01.txt15:02
SridarKannp: ok15:02
openstackLog:            http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-01-25-14.01.log.html15:02
yushirostart meeting :)15:02
annp:)15:02
annpchandanc, How fwg can work with ports, which are landed at compute A?15:03
annpwith current fwg l2 driver?15:03
chandancif compute A is running linuxbridge, it will not work15:03
yushiroSridarK, xgerman_ I and hoangcx are trying to support fwaas logging feature.  In this RFE https://bugs.launchpad.net/neutron/+bug/172072715:03
openstackLaunchpad bug 1720727 in neutron "[RFE] (Operator-only) Extend logging feature to support for FWaaS v2" [Wishlist,Triaged]15:03
annpyes, So I think we should prevent ports, which are landed at compute A15:04
SridarKyushiro: +115:04
SridarKand we can target that for R ?15:04
yushiroSridarK, xgerman_ miguel wants to know our FWaaS activity ( Whether fwaas v2 implementation has been finished or not)15:04
chandancannp: i agree15:04
SridarKyushiro: i think we can state that it is done15:04
SridarKnow we are fixing bugs15:04
yushiroSridarK, xgerman_  Yes, I'd like to implement until R.15:04
xgerman_+115:04
yushiroSridarK, yes,15:04
xgerman_yes15:05
SridarKyushiro: +1 for R15:05
SridarKi think we can kick of R with doude 's changes15:05
yushiroSridarK, xgerman_ Therefore, could you please comment this RFE about fwaas status?15:05
SridarKto avoid churn on code15:05
yushiroMiguel is waiting fwaaS member's reply :)15:05
annpOK, So let confirm with case compute B with sg=iptables_hybrid and Fwaas=OVS. Then we can consider remove the line https://review.openstack.org/#/c/536234/6/neutron_fwaas/services/firewall/fwaas_plugin_v2.py@27115:05
xgerman_ah, I told him in person ;-)15:06
annpchandanc, right?15:06
yushiroxgerman_, sweet :)15:06
chandancannp: yes15:06
xgerman_ok, will need to dig up the blueprint then15:06
yushiroSridarK, Yes, So, I think it's better to merge doube's patch super ASAP15:06
annpchandanc, :) OK.15:07
SridarKi think we can state the important aspects of the original bp are in15:08
SridarKi will comment to that effect as well15:08
yushiroOK thanks.15:08
chandancannp: preventing linuxbridge port is good, as we dont have a driver that can support linuxbridge ports, so i am in agreement on that.15:09
chandanci will test hybrid and update the thread15:09
*** hoangcx_ has quit IRC15:09
yushirochandanc, +1015:09
annpchandanc, in case of there is some issue with sg=iptables_hybrid and fwaas=ovs, we should consider prevent them temporary at least we have way to support that15:09
chandancannp: agree15:10
annpchandanc, So I think we're same page now :)15:10
chandancannp, please check on your side if noop driver works for SG15:10
yushiroannp, chandanc let me sync up with you guys.  Now we're trying to investigate iptables_hybrid(SG) + FWG.15:11
annpchandanc, sure. I will check it and update the thread also15:11
chandancas that can be the last option for us if people dont want to move SG to OVS15:11
annpyushiro, yes.15:12
chandancyushiro: is associate default FWG true by default15:12
SridarKyushiro: added a comment15:12
yushirochandanc, Default is 'False'15:12
chandancok15:12
yushirochandanc, If you'd like to associate automatically, please configure /etc/neutron/plugins/ml2/ml2_conf.ini15:13
chandancyushiro: sure i understand15:13
annpyushiro, configure in /etc/neutron/neutron_fwaas.conf?15:14
SridarKok and once u have completed the investigation pls update the thread and we can file a bug to track this15:15
chandancSridarK: sure15:15
yushirowhatever is OK if you load the file to start q-svc.service15:15
annpFrankly to speaking, I don't like enforcing all ports to default FWG. But if there is no way,...15:15
SridarKand we can use that bug to get in annp's validation patch or a variation of that15:16
annpyushiro, got it15:16
yushiroannp, You mean you don't like default SG either, right?15:16
xgerman_https://blueprints.launchpad.net/neutron/+spec/fwaas-api-2.015:16
xgerman_can’t change anything there15:16
xgerman_except adding more work items15:17
yushiroxgerman_, +115:17
annpNo, I mean I don't mean that15:17
annpI don't like the solution use default fwg to fix communication between VMs15:18
annpin case of sg=iptables_hybrid, fwaas=OVS15:18
yushiroaha, I see what you mean15:19
annpyushiro, :)15:19
yushiroOK, I'm trying to test devstack with iptables_hybrid + ovs15:19
annpyushiro, +115:20
chandancok yushiro15:20
xgerman_+115:20
*** SridarK has quit IRC15:20
xgerman_need to get some coffee ;-)15:20
yushiro:)15:20
yushiroOK guys, see you ~15:21
annpThanks all, See you15:21
chandancyushiro: annp please update the thread15:21
chandanci have to log out now15:21
annpchandanc, sure!15:21
yushiroOK15:21
*** yushiro has quit IRC15:21
chandancthanks all15:21
*** chandanc has quit IRC15:21
annpbye bye15:22
*** annp has quit IRC15:22
*** SridarK has joined #openstack-fwaas15:24
*** yushiro has joined #openstack-fwaas15:38
*** yushiro has quit IRC15:48
-openstackstatus- NOTICE: logs.openstack.org is stabilized and there should no longer be *new* POST_FAILURE errors. Logs for jobs that ran in the past weeks until earlier today are currently unavailable pending FSCK completion. We're going to temporarily disable *successful* jobs from uploading their logs to reduce strain on our current limited capacity. Thanks for your patience !16:01
*** jafeha has quit IRC16:17
*** openstackstatus has quit IRC16:41
*** openstackstatus has joined #openstack-fwaas16:42
*** ChanServ sets mode: +v openstackstatus16:42
*** jafeha has joined #openstack-fwaas16:46
*** yamamoto has quit IRC17:40
*** yamamoto has joined #openstack-fwaas17:43
*** yamamoto has quit IRC17:44
*** yamamoto has joined #openstack-fwaas17:44
openstackgerritMerged openstack/neutron-fwaas-dashboard master: Updated from global requirements  https://review.openstack.org/53502717:52
*** AlexeyAbashkin has quit IRC17:59
*** SumitNaiksatam has joined #openstack-fwaas18:04
*** SridarK has quit IRC18:07
*** yamamoto has quit IRC18:42
*** SumitNaiksatam has quit IRC19:18
*** AlexeyAbashkin has joined #openstack-fwaas19:24
*** AlexeyAbashkin has quit IRC19:28
*** yamamoto has joined #openstack-fwaas19:43
*** reedip has quit IRC19:52
*** yamamoto has quit IRC19:55
*** reedip has joined #openstack-fwaas20:04
*** cleong has quit IRC21:32
*** yamamoto has joined #openstack-fwaas22:05

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!