Thursday, 2018-05-17

*** mgoddard has joined #openstack-kayobe08:05
*** dougsz has joined #openstack-kayobe08:14
*** gkadam has joined #openstack-kayobe08:35
*** ktibi has joined #openstack-kayobe09:53
*** ktibi has quit IRC09:54
*** ktibi has joined #openstack-kayobe09:55
ktibimgoddard, If you have time, very interesting video on openstack security
mgoddardktibi: looks interesting, thanks for sharing :)10:18
*** ktibi_ has joined #openstack-kayobe10:42
*** ktibi has quit IRC10:45
*** ktibi has joined #openstack-kayobe10:46
*** ktibi_ has quit IRC10:46
*** ktibi has quit IRC12:05
*** ktibi has joined #openstack-kayobe12:23
ktibimgoddard, do you have tested kayobe for deploy flat network ?14:13
mgoddardktibi: no. Are you planning to use one?14:14
ktibimgoddard, I'm trying14:14
ktibifor my lab14:14
ktibiopenstack on openstack ^^14:14
mgoddard... on openstack?14:14
ktibiI think I'am good but missing maybe a conf14:14
ktibiyeah I deploy many openstack with kayobe in my main openstack plateform14:15
ktibifor dev, qualif, pre-prod envs14:15
mgoddardyou might be interested in this:
mgoddardstill a WIP14:16
mgoddardand also this:!/story/200200914:16
ktibiho O_o14:17
mgoddardwe're trying to improve our deployment pipeline story14:17
ktibivery interesting :)14:18
mgoddarddo you have any good procedures/tips in this area?14:18
ktibibut I need multiple kayobe instance and I guess it's one kayobe for multi openstack plateform ?14:18
mgoddardone kayobe-config, multiple environments14:19
ktibiyes good for manage multiple ENV :)14:19
ktibifor me, I deploy a new kayobe and all openstack plateform with a heat stack14:21
ktibibut it's because with work only on integration of kayobe, but I think we will need your feature very soon14:22
mgoddardis this just for testing?14:22
ktibiwe work*14:22
ktibifor now yes, like testing the neutron plugin for cisco ACI, ...14:23
ktibimgoddard, my issue on neutron ==>
mgoddardyou're using ACI?14:23
ktibiI think the bridge eth5-ovs (the floating network) doesn't have connection with my eth514:23
ktibiwe work on for now, just testing but I think yes14:24
mgoddardktibi: you should have a veth pair, called p-eth5-*14:28
ktibiI have14:29
ktibip-eth5-phy@p-eth5-ovs & p-eth5-ovs@p-eth5-phy14:29
mgoddardis the other end in a bridge?14:29
mgoddardand is that bridge connected to eth5?14:29
ktibifull conf
ktibifor now, I can't ping eth5 (eth5 have IP) from my neutron router (have ip in same network14:31
mgoddardI think you need to include 'ip address show'14:34
mgoddardthere's no connection between eth5 and eth5-ovs14:38
mgoddardnormally I create a bridge, plug eth5 into it, and then kayobe will plug p-eth5-phy into the bridge too14:38
mgoddard<network>-interface: breth514:38
mgoddard<network>_bridge_ports: [eth5]14:39
mgoddard<network>_interface: breth514:39
mgoddardmake sense?14:39
ktibimgoddard, ok I'll test15:00
ktibimgoddard, ok because for now I have : external_interface: "eth5"15:01
ktibiin my network-interfaces15:01
mgoddardif you set:15:03
mgoddard- <network>15:03
mgoddardin etc/kayobe/networks.yml15:03
mgoddardthat should make this all work15:03
ktibiwithout modift network-interfaces15:03
ktibiI have already external_net_name: external15:04
mgoddardoh, I see what you mean now15:04
ktibiyes ;)15:04
mgoddardok, so set external_interface: breth515:04
mgoddardexternal_bridge_ports: [eth5]15:04
ktibiexternal_interface: "breth5"15:05
ktibiexternal_bridge_ports: "eth5"15:05
mgoddard^ list15:05
ktibiok => external_bridge_ports: [eth5]15:05
mgoddardwe could make it work without a bridge, but I think it would require kayobe changes15:06
mgoddardthis code is already a bit hairy15:06
mgoddardbridge works better when there are vlans15:06
ktibiok but need to redeploy all now15:07
ktibior just reconfigure host ?15:07
mgoddardyeah, might work15:08
ktibimaybe need to reconfigure OVS no ?15:08
mgoddardprobably not - the veth is already present15:09
ktibiok I have the bridge15:12
ktibiwith two interfaces : eth5 & p-breth5-phy15:12
ktibibut I can't ping my gateway now :/15:12
mgoddardthe bridge should now have the IP of eth515:14
ktibihum no missing to load a module maybe ?15:16
ktibimaybe it's a neutron issue15:19
ktibibecause I'am on openstack15:19
ktibibecause bridge use other MAC :/15:19
mgoddardyeah that could be it15:19
ktibiI'll add15:19
ktibibut I use same IP15:19
mgoddardI think there's a MAC filter too15:20
ktibimgoddard, ho yes :)15:26
ktibineutron port-update 16cfa446-9dbf-40cf-b96f-518a2bd92784 --allowed-address-pairs list=true type=dict mac_address=8a:17:98:d7:ac:3f,ip_address=
ktibiand works :)15:26
ktibiSo hard to automate that !!15:31
mgoddardcan you make it a wildcard?15:32
mgoddardor disable port security for the port15:33
ktibimgoddard, yes maybe15:36
ktibihum so no change15:36
ktibimy router can't ping breth515:36
ktibibridge_mappings = physnet1:eth5-ovs15:38
ktibineed to reconfigure neutron I think15:38
mgoddardoh yes15:43
mgoddardalso maybe OVS to create breth5-ovs?15:43
ktibiOVS have created p-breth5-ovs@p-breth5-phy15:46
ktibibut OVS show Interface "phy-eth5-ovs"15:47
ktibimaybe need to recreate all OVS structure :/15:47
mgoddardcheck the OVS role's handlers in k-a15:47
ktibiyes  --no-security-groups15:55
ktibicommand: docker exec openvswitch_db /usr/local/bin/kolla_ensure_openvswitch_configured {{ item.0 }} {{ item.1 }}15:56
*** ktibi has quit IRC16:14
*** ktibi has joined #openstack-kayobe16:15
ktibimgoddard, ok all works :)16:18
ktibisecurity disable on port16:18
ktibineed to stop rm the container for purge OVS :/16:19
mgoddardare you going to share the scripts you're building for this?16:19
mgoddardcould be useful for us16:19
*** ktibi has quit IRC16:21
*** ktibi has joined #openstack-kayobe16:21
*** dougsz has quit IRC17:04
*** mgoddard has quit IRC17:06
*** mgoddard has joined #openstack-kayobe17:46
*** gkadam has quit IRC20:08
*** ktibi has quit IRC20:27
*** mgoddard has quit IRC21:40

Generated by 2.15.3 by Marius Gedminas - find it at!