Thursday, 2018-07-12

*** longkb has joined #openstack-fwaas00:36
*** yamamoto has joined #openstack-fwaas00:49
*** yamamoto has quit IRC00:54
*** hoangcx has quit IRC01:50
*** yamamoto has joined #openstack-fwaas01:50
*** hoangcx has joined #openstack-fwaas01:50
*** yamamoto has quit IRC01:55
*** yamamoto has joined #openstack-fwaas02:03
openstackgerritKim Bao Long proposed openstack/neutron-fwaas master: [log] Logging driver based iptables for FWaaS  https://review.openstack.org/55373804:00
*** njohnston has quit IRC04:07
*** reedip has quit IRC04:07
*** njohnston has joined #openstack-fwaas04:07
*** reedip has joined #openstack-fwaas04:19
*** velizarx has joined #openstack-fwaas06:56
*** velizarx has quit IRC07:13
*** velizarx has joined #openstack-fwaas07:22
*** yamamoto has quit IRC07:48
*** yamamoto has joined #openstack-fwaas08:44
*** yamamoto has quit IRC08:50
*** yamamoto has joined #openstack-fwaas09:46
*** yamamoto has quit IRC09:51
*** yamamoto has joined #openstack-fwaas10:03
*** hungpv has joined #openstack-fwaas10:26
*** velizarx has quit IRC10:53
*** reedip has quit IRC10:54
*** reedip has joined #openstack-fwaas11:07
*** velizarx has joined #openstack-fwaas11:09
*** hungpv has quit IRC11:20
*** longkb has quit IRC11:34
*** yamamoto has quit IRC13:01
*** velizarx has quit IRC13:12
*** velizarx has joined #openstack-fwaas13:16
*** longkb has joined #openstack-fwaas13:18
*** yamamoto has joined #openstack-fwaas13:28
*** yamamoto has quit IRC13:29
*** hoangcx_ has joined #openstack-fwaas13:32
*** yamamoto has joined #openstack-fwaas13:34
*** yamamoto_ has joined #openstack-fwaas13:41
*** yamamoto has quit IRC13:41
*** hoangcx_ has quit IRC13:50
*** SridarK has joined #openstack-fwaas13:50
*** wkite has joined #openstack-fwaas13:51
*** wkite has quit IRC13:55
*** yushiro has joined #openstack-fwaas13:55
*** annp_ has joined #openstack-fwaas13:56
yushiro annp hi13:56
annp_yushiro, hi13:56
yushiroI built latest devstack with logging patch.  However, q-svc cannot restart with following error:  global name 'server_rpc' is not defined.13:57
yushiroDid you hit such error?13:57
yushiroI just applied 3 patches and ran 'sudo python setup.py install'.  After that, I restarted q-svc.service.13:58
annp_did you build with master branch or latest patch?13:58
longkbhmm13:58
annp_longkb, did you see the error?13:59
yushirodeployed devstack with master branch,  after that I applied each patches as longkb described on github.13:59
longkbyushiro, could you show me your error log?13:59
longkbI did not meet this error before13:59
SridarKHi FWaaS folks13:59
SridarKshall we continue in the mtg13:59
annp_yushiro, longkb can we discuss later?14:00
yushiroHi SridarK :)14:00
SridarK#startmeeting fwaas14:00
annp_hi SridarK14:00
openstackMeeting started Thu Jul 12 14:00:06 2018 UTC and is due to finish in 60 minutes.  The chair is SridarK. Information about MeetBot at http://wiki.debian.org/MeetBot.14:00
yushiroannp_, Yeah, later is better.14:00
openstackUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.14:00
*** openstack changes topic to " (Meeting topic: fwaas)"14:00
longkbhi SridarK14:00
openstackThe meeting name has been set to 'fwaas'14:00
SridarK#chair yushiro xgerman_14:00
openstackCurrent chairs: SridarK xgerman_ yushiro14:00
SridarKJust got back from long PTO14:00
yushiroWelcome back, SridarK :)14:00
SridarKsorry could not stay on top of things completely but caught up on logs14:00
SridarKso let me do my turn today14:01
SridarKthx xgerman_ and yushiro14:01
yushiroOK14:01
xgerman_o/14:01
longkb+1 SridarK14:01
SridarK#topic announcements14:01
*** openstack changes topic to "announcements (Meeting topic: fwaas)"14:01
SridarKwe are getting close14:01
SridarKbut seems like things are chugging along, lets get to updates quickly so we can focus on the patches14:02
SridarK#topic FWaaS logging14:02
*** openstack changes topic to "FWaaS logging (Meeting topic: fwaas)"14:02
SridarK#link https://review.openstack.org/#/c/529814/14:02
SridarK#link https://review.openstack.org/#/c/553738/14:02
SridarKannp_: longkb pls go ahead14:03
longkbThanks SridarK14:03
*** wkite has joined #openstack-fwaas14:03
SridarKyushiro: i think u were just asking just as we started too14:03
longkbI draft a review plan for fwaas logging. You guys can check it in https://etherpad.openstack.org/p/Logging_service_for_FWaaS_review_plan14:04
longkbI also mark the order for review  these patches14:04
yushiroSridarK, yeah, longkb explains about how to test.14:04
SridarKlongkb: ah thx - very informative14:04
SridarKso we have dependencies on the neutron patches14:05
longkbthanks SridarK, yushiro14:05
longkbyep14:05
SridarKdo u think the neutron patches will make it in time ?14:05
longkbannp_: how to you think?14:06
annp_longkb, that's great14:06
yushiroSridarK, Currently, I think these patches in neutron are OK except some nits.  However, it's better to ask Miguel for FFE.14:06
SridarKyushiro: ok14:07
annp_yushiro +!14:07
annp_SridarK, +!14:07
longkbannp_, yushiro: +114:07
yushiroAnd annp_ will ask Miguel and Jakub :)14:07
SridarKyushiro: so we will need an FFE for the FWaaS side as well14:07
SridarKif we have a dependency14:07
yushiroSridarK, Aha, yes.14:07
annp_yushiro, I will ask Miguel in next neutron meeting for FFE14:08
SridarKannp_: +114:08
SridarKDo we need all 3 neutron patches to merge before merging any patch on FWaaS side ?14:08
yushiroI think YES. annp_ longkb , right?14:09
longkbSridarK: I think neutron patches should be merged first14:09
annp_Sriark, yushiro, right. We need 3 patches to get merge first.14:09
SridarKok so we will need 3 patches in neutron and 8 patches in FWaaS to merge on FFE14:10
annp_Sridark, So please help us to review it. :)14:10
SridarKannp_: yes on it will work on it today14:10
longkbthanks SridarK14:10
annp_SridarK, Thanks a ton!14:10
SridarKok do u want to discuss any other issues here14:11
annp_SridarK, please go ahead14:12
yushiroannp_, longkb As I said before, for testing perspective, in FWaaS side patches, do we need to add dependencies?14:12
SridarKi think if we document our test results in a similar manner to the review plan (which is great) - we make our chances better for FFE14:12
yushiroSridarK, +10  I think so.14:12
annp_SridarK, +10.14:13
longkbSridarK, +1014:13
SridarKIs that a 10 decimal or binary ? :-) (I am trying to be like yushiro ) :-)14:13
*** velizarx has quit IRC14:14
SridarKok lets move on - i think we have a plan14:14
yushiroSridarK, Hahaha :p14:14
SridarKand now that i am back from PTO - i will also work on reviews14:14
xgerman_sweet14:14
SridarK#topic Remote FWG14:14
*** openstack changes topic to "Remote FWG (Meeting topic: fwaas)"14:14
SridarKxgerman_: pls go ahead14:14
SridarK#link https://review.openstack.org/#/c/521207/14:15
xgerman_Most of it is done but I am at my wits end with ovs…14:15
xgerman_not sure how to debug that effectively :-(14:15
SridarKsigh - let me also reach out chandanc and annp is here too14:16
xgerman_thanks — yeah, I could probably figure it out but I also have other priorities which eat up my time :-(14:16
SridarKxgerman_: yes indeed totally understand14:16
annp_xgerman_, I have a question: There is no DENY action for each remote group rule?14:17
xgerman_mmh, I thought I had deny14:17
annp_xgerman_, I mean there are only ALLOW action for remote group rule, right?14:17
xgerman_they are just a way to describe a group of ports so deny is plausible14:18
xgerman_or more general we should support all actions14:18
annp_xgerman_, OK. I got it.14:20
yushiroremote_group_id allows from all neutron ports which is associated with its firewall_group, right?14:20
yushirooops, sorry.  remote_firewall_group_id.14:20
annp_xgerman_, So we only support action "Allow" in remote group rule ATM?14:20
xgerman_I can see also a use case where you would deny certain traffic from those ports14:20
annp_xgerman_, right?14:20
xgerman_I am confused then - I thought  remote FWG is another way to describe ports and it’s independent of the action14:21
SridarKWe should probab be in line with Remote SG here14:21
SridarKAnd the action is another attribute in the rule (which is independent)14:22
xgerman_aka if I have a remote FWG describing web servers I would want to  only allow certain traffic from there to a database and block the rest14:22
xgerman_SridarK: +114:22
annp_SridarK, +114:23
annp_xgerman_, I got it. Thanks.14:23
yushiroAha, if we use remote_fwg_id like SG, it means 'allow traffic from neutron ports'.  However, we can also extend to use as 'deny' as SridarK said.14:23
xgerman_yep, or drop14:24
yushiroxgerman_, I see :)14:24
SridarKI am not sure maybe we want alignment with SG - so there is no confusion with users14:24
SridarK*for users14:24
annp_SridarK, +10014:25
xgerman_yeah, the simple case should align + more advanced users should get more latitude14:25
yushiroxgerman_, I think it's OK to support 'allow' first like SG.  After that, we can also support 'drop' case :)14:25
xgerman_+114:25
yushirostep by step :p14:25
yushiroYeah14:25
SridarKxgerman_: ah yes exactyl what yushiro says14:25
annp_SridarK, +114:26
xgerman_+114:26
annp_xgerman_, please go ahead14:29
xgerman_yeah, the other two pieces are done (client + plugin)14:30
SridarKok cool xgerman_ - i reached out to chandan too - if we can leverage some of his scripts for ovs debugging (i recall he had some things)14:30
xgerman_that would be great!!14:30
SridarKok cool - lets move on14:30
xgerman_+114:30
yushiro+114:30
annp_+114:31
SridarK#topic Bugs14:31
*** openstack changes topic to "Bugs (Meeting topic: fwaas)"14:31
SridarK#link https://bugs.launchpad.net/neutron/+bug/176245414:31
openstackLaunchpad bug 1762454 in neutron "FWaaS: Invalid port error on associating ports (distributed router) to firewall group" [Medium,In progress] - Assigned to Yushiro FURUKAWA (y-furukawa-2)14:31
SridarKyushiro: thanks for picking this up14:31
SridarKsome history - i had talked to14:31
yushiroYou're welcome.14:31
yushiroOK14:32
SridarKswami before i left on PTO - i think we are good on the DVR side - i wanted to verify the ns implications where rules are applied14:32
SridarKbut i had concerns on the HA side14:32
SridarKthe validation check is easy but operationally i have some concerns14:33
SridarKhence i was a bit unsure - as it requires some thorough verification14:33
SridarKyushiro: not sure if u have more data on it14:33
yushiroSridarK, I just checked 'device_owner' of each case and namespace structure..  Not tested yet.14:34
SridarKyushiro: ok14:34
yushiroeach case means  1. DVR,  2. L3-HA   3.DVR + L3-HA14:34
SridarKyushiro: ok lets talk offline on it to make sure we have no issues14:35
SridarKI was good with (1) but (2) & (3) have some concerns on datapath14:35
SridarKyushiro: will sync up with u more on it14:35
yushiroSridarK, OK, thanks.14:36
SridarKany other bugs needing discussion14:36
annp_SriarK, Hi14:36
SridarKannp_: pls go ahead14:36
annp_In order to support wsgi server for neutron, there is a issue related fwaas rpc as http://lists.openstack.org/pipermail/openstack-dev/2018-June/131722.html14:37
annp_I and zigo try to fix that at https://review.openstack.org/#/c/580327/14:37
*** hongbin has joined #openstack-fwaas14:37
zigoo/14:38
annp_and https://review.openstack.org/#/c/579433/14:38
zigoI can confirm that the patch from annp_ works very well.14:38
SridarKah yes14:38
zigoI would very much warmly welcome merging, that one plus the other wsgi patches for Neutron itself.14:38
annp_zigo, Thanks zigo.14:38
SridarKannp_: zigo perfect many thx14:39
xgerman_+114:39
SridarKwill do14:39
annp_+1014:39
yushiroannp_, zigo Thanks.  In order to check these behavior, do we need 2 patches (neutron + neutron-fwaas)14:39
SridarKis there a dependency we need to be aware off ?14:39
zigoI didn't check the v2 one though, only v1...14:39
annp_yushiro, actually these patch doesn't depend on neutron.14:40
SridarKannp_: ok14:40
annp_zigo, Could you please help us to verify with v2?14:40
SridarKwill review14:40
annp_SridarK, thanks!14:41
yushiroannp_, You mean, if we apply https://review.openstack.org/#/c/580327/ and deploy devstack.  Then, we can check q-svc's status, right?14:41
yushirooops, strange english ...14:42
annp_yushrio, off-course!14:42
yushiroOK, will try it as well.14:42
zigoyushiro: You need 1/ the fix for neutron to load properly using neutron-api + neutron-rpc-server at https://review.openstack.org/#/c/555608/14:42
zigo2/ load neutron using uwsgi (if you're with devstack, some of these will help: https://review.openstack.org/#/c/580049/ https://review.openstack.org/#/c/473718/ )14:42
zigo3/ the fwaas patches: https://review.openstack.org/#/c/580327/ https://review.openstack.org/#/c/579433/14:42
zigoAll of these need to be merged.14:42
zigoYeah, that one too... https://review.openstack.org/#/c/580327/14:43
yushirozigo, Thanks.  Do I need to edit some config file ?14:43
zigoyushiro: If you're with devstack, I'm not sure, I do Debian packages integration, in my setup, it just work.14:43
annp_zigo, These step is necessary if yushiro want to deploy neutron-api under uwsgi. otherwise we don't need.14:43
zigoyushiro: You can also just run Debian with puppet-openstack and it will setup everything for you automatically, though that's going to be Queens ...14:44
yushirozigo, I usually use devstack :p  But thanks :)14:44
zigoRight.14:44
annp_yushrio, you can try with devstack by https://review.openstack.org/#/c/473718/14:44
yushirozigo, Aha!!  I had asked you same question ..14:44
yushiroannp_, Thanks.14:45
annp_yushrio, you should pull dow the patch and modify a bit https://review.openstack.org/#/c/473718/31/lib/neutron-legacy@9414:46
SridarKSounds good then we will target these 2 patches14:46
annp_NEUTRON_DEPLOY_MOD_WSGI should be set True14:46
yushiroannp_, +1 .  BTW, my name is yushiro.  Haha :p14:47
*** wkite has quit IRC14:47
annp_yushiro, oh, I'm so sorry. :)14:47
SridarKAlthough yushrio - has a nice ring to it too :-)14:47
yushiro:)14:47
yushiroannp_, no warries14:48
SridarKok lets move on14:48
annp_yushiro: thanks. :)14:48
SridarK#topic Address Groups14:48
*** openstack changes topic to "Address Groups (Meeting topic: fwaas)"14:48
annp_SridarK, thanks!14:48
SridarKoh looks like wkite is no longer here14:48
yushiroOh, I couldn't reach out miguel this week..14:49
SridarKyushiro: i will msg him14:49
yushiroSridarK, Thank you so much.14:49
SridarKmore time zone aligned14:49
SridarKhopefully we can get a +A14:49
SridarKelse it will be in S14:50
SridarK#topic Open Discussion14:50
*** openstack changes topic to "Open Discussion (Meeting topic: fwaas)"14:50
SridarKCFP closes soon14:50
xgerman_yep14:51
SridarKannp_: u think u may be able to pull together something for L7 ?14:51
SridarKnot sure if u had too much time to go thru it14:51
SridarKannp_: if u think u want to do something - we can talk on some possibilities14:51
yushiro+114:52
annp_SridarK, yeah. I'd like to propose this for CFP. Do you want to become a speaker?14:52
SridarKannp_: lets talk more - sure i can help out14:53
SridarKannp_: but lets have a plan on the content14:53
SridarKannp_: lets talk offline14:53
annp_SridarK, Yes. lets sync up via email.14:53
SridarKannp_: +114:54
annp_SridarK, I also want to propose this topic for vietnam openstack day :)14:54
yushiroannp_, Sounds good :)14:54
SridarKannp_: ok good14:54
xgerman_+114:54
longkb+1 annp_14:55
annp_SridarK, yushiro, xgerman_m thanks! :)14:55
annp_longkb, thanks!14:55
SridarKok if nothing else we can end14:56
SridarKThx all for joining14:56
yushiroThanks!!14:56
SridarKbye14:56
longkbbye guys14:56
annp_thanks all. See you14:56
SridarK#endmeeting14:56
*** openstack changes topic to "Queens (Meeting topic: fwaas)"14:56
openstackMeeting ended Thu Jul 12 14:56:43 2018 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)14:56
openstackMinutes:        http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-07-12-14.00.html14:56
openstackMinutes (text): http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-07-12-14.00.txt14:56
openstackLog:            http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-07-12-14.00.log.html14:56
annp_yushiro, longkb, hi14:57
yushirohi14:57
longkbhi annp_14:57
annp_yushiro, can you show me your log when you devstack with logging patch?14:57
yushirosorry, I missed rebasing.  I just removed some import line.14:58
yushiroNow, q-svc can run.  Now, I'm trying to create some resources.14:58
annp_yushiro, wow, OK. :)14:58
yushiroI have 1 bug ( not related logging)14:59
annp_yushiro, What is your bug?15:00
yushiroIf we applied a router port into default firewall_group,  its status still 'INACTIVE'.15:00
longkbyushiro +10015:00
longkbfirewall group status is not stable, I think15:01
annp_yushiro, hm I didn't play with this scenario.15:01
yushirolongkb, status logic is a little different b/w L3 and L2.15:01
annp_yushiro, yes. So I think we should do some improve the logic of set_firewall_group_status15:02
longkbhmm, I think I should study more about fwaas :)15:03
yushiroI'll try to solve this bug.  BTW, did you check log data is outputted into /var/log/syslog?15:03
annp_yushiro, today, longkb had checked but we didn't see any log data in /var/log/syslog in his environment.15:04
yushirolongkb, If we associate L2 port with fwg, fwg's status is computed by _compute_status() in fwaas_v2.py.15:05
annp_yushiro, So tomorrow, I'll debug that. Anyway, please help me to check log data in /var/log/syslog.15:06
yushirolongkb, In order to be 'ACTIVE', fwg needs ('ingress_firewall_policy_id' or 'egress_firewall_policy_id') and fwg port15:06
longkbyushiro: +1 I got it.15:07
annp_yushiro, longkb, I have to go out now. So see you tomorrow.15:08
yushiroannp_, Thanks.  See you.15:08
longkbG9 annp_15:09
annp_yushiro, longkb, thanks and G9 :)15:09
*** annp_ has quit IRC15:09
yushirolongkb, For L3 port, if we create/update with fwg port and 'admin_state_up' is UP, then changed into 'ACTIVE'.  In other word, in L3 logic doesn't care 'ingress/egress_firewall_policy_id'.15:10
longkbhmm, I can see the difference bw L2 and L315:12
yushiroSo, it's better to align with same logic for L2.15:14
longkb+1 yushiro :D15:18
longkbI have to off now. See you tomorrow15:19
*** longkb has quit IRC15:21
*** yamamoto_ has quit IRC15:24
*** yushiro has quit IRC15:50
*** yamamoto has joined #openstack-fwaas16:12
*** yamamoto has quit IRC16:42
*** chandanc has joined #openstack-fwaas17:03
chandanchello xgerman_17:06
xgerman_hi17:06
chandancHello, do you have nay specific issue you want me to look at ?17:08
chandanci did not see any driver code change in the patch17:09
xgerman_https://review.openstack.org/#/c/564888/1017:09
chandancok17:09
xgerman_this is the OVS patch — I made it run without spying errors but I have trouble figuring out why it doesn’t do what I want it to do17:10
chandancoh ok17:10
xgerman_yeah, not sure how to debug it…17:12
*** SridarK has quit IRC17:13
chandancsorry i am abit out of touch, do you have the spec for remoteFWG ?17:18
chandancxgerman_: i will logout now, will go through the patch and get back , if you have the spec handy please share with me.17:22
xgerman_https://specs.openstack.org/openstack/neutron-specs/specs/mitaka/fwaas-api-2.0.html17:23
xgerman_it’s the original spec17:23
chandancthanks xgerman_ catch you seeon17:28
*** chandanc has quit IRC17:28
xgerman_thx17:34
*** yamamoto has joined #openstack-fwaas17:43
*** yamamoto has quit IRC18:00
*** SridarK has joined #openstack-fwaas18:02
*** SridarK has quit IRC18:19
*** SridarK has joined #openstack-fwaas18:26
*** SridarK has quit IRC23:16
*** hongbin has quit IRC23:19

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!