| *** aojea has joined #openstack-kuryr | 00:04 | |
| *** aojea has quit IRC | 00:09 | |
| *** limao has joined #openstack-kuryr | 00:53 | |
| *** kiennt26 has joined #openstack-kuryr | 00:59 | |
| *** aojea has joined #openstack-kuryr | 01:05 | |
| *** aojea has quit IRC | 01:10 | |
| *** caowei has joined #openstack-kuryr | 01:17 | |
| *** yamamoto has joined #openstack-kuryr | 01:21 | |
| *** wangbo has joined #openstack-kuryr | 01:43 | |
| *** caowei has quit IRC | 01:44 | |
| *** caowei has joined #openstack-kuryr | 01:44 | |
| *** edisonxiang has joined #openstack-kuryr | 02:10 | |
| *** gouthamr has quit IRC | 02:27 | |
| *** yamamoto_ has joined #openstack-kuryr | 02:36 | |
| *** yamamoto has quit IRC | 02:39 | |
| *** wangbo has quit IRC | 02:53 | |
| *** wangbo has joined #openstack-kuryr | 02:58 | |
| *** aojea has joined #openstack-kuryr | 03:07 | |
| *** aojea has quit IRC | 03:11 | |
| *** edisonxiang has quit IRC | 03:30 | |
| *** wangbo has quit IRC | 03:38 | |
| *** wangbo has joined #openstack-kuryr | 03:42 | |
| *** vikasc has joined #openstack-kuryr | 03:43 | |
| *** hongbin_ has quit IRC | 04:24 | |
| *** wangbo has quit IRC | 04:34 | |
| *** kiennt26 has quit IRC | 04:54 | |
| *** aojea has joined #openstack-kuryr | 05:08 | |
| *** aojea has quit IRC | 05:13 | |
| *** yboaron has joined #openstack-kuryr | 05:16 | |
| *** wangbo has joined #openstack-kuryr | 05:27 | |
| *** janki has joined #openstack-kuryr | 05:42 | |
| *** wangbo has quit IRC | 05:50 | |
| janonymous | irenab: useful link, thanks! | 06:05 |
|---|---|---|
| *** aojea has joined #openstack-kuryr | 06:09 | |
| *** aojea has quit IRC | 06:14 | |
| *** openstackgerrit has quit IRC | 06:28 | |
| *** kiennt26 has joined #openstack-kuryr | 06:36 | |
| *** wangbo has joined #openstack-kuryr | 06:36 | |
| *** openstackgerrit has joined #openstack-kuryr | 06:41 | |
| openstackgerrit | Berezovsky Irena proposed openstack/kuryr-kubernetes master: Enable port debug in devstack https://review.openstack.org/512184 | 06:41 |
| irenab | janonymous, great minds think alike | 06:45 |
| irenab | ltomasbo, hi | 06:45 |
| ltomasbo | irenab, hi! | 06:46 |
| irenab | ltomasbo, I want to check something with you | 06:46 |
| ltomasbo | sure | 06:46 |
| irenab | Did you check the LoadBalancer service type in ovn or odl environment? | 06:47 |
| janonymous | irenab: true! like apuimedo's and urs :) | 06:47 |
| ltomasbo | irenab, nope | 06:47 |
| ltomasbo | did you find any issue with it in df? | 06:48 |
| irenab | I wanted to verify it with Dragonflow and since there is currently some issue with Octavia, I used HAProxy | 06:48 |
| ltomasbo | there are problems with octavia too with ODL | 06:48 |
| irenab | It does not work, but actually I do not understand how it works with reference implementation | 06:48 |
| irenab | I see that service VIP SG is the same as Pods' | 06:49 |
| ltomasbo | I found out one issue with octavia and odl, that also needed to be fixed in ovn | 06:49 |
| ltomasbo | so, perhaps you are hitting the same problem in odl (regarding octavia, not the LoadBalancer type) | 06:49 |
| irenab | but since it does not contain any rule to allow service (TCP port 80), curl to FIP does not work | 06:50 |
| *** vikasc has quit IRC | 06:50 | |
| ltomasbo | https://bugs.opendaylight.org/show_bug.cgi?id=9232 | 06:50 |
| openstack | bugs.opendaylight.org bug 9232 in General "Allow Address Pairs not working across tenant networks" [Normal,Unconfirmed] - Assigned to bugs | 06:50 |
| irenab | ltomasbo, Octavia works for DF with ClusterIP type | 06:50 |
| ltomasbo | irenab, does it work the curl to the VIP? | 06:50 |
| ltomasbo | irenab, with L2 or L3? | 06:50 |
| ltomasbo | (or both) | 06:50 |
| irenab | ltomasbo, I think for both | 06:51 |
| ltomasbo | ok, great then! | 06:51 |
| irenab | curl for VIP works from one of the pods | 06:51 |
| irenab | since SG contains only rules for ingress/egress of the same SG group | 06:51 |
| ltomasbo | as for the FIP, that is mainly just a SNAT/DNAT translation, so I think SGs that apply are the ones from the neutron port, not the FIP | 06:52 |
| ltomasbo | irenab, ahh, I think I get your point now | 06:52 |
| irenab | exactly, and since one access the FIP from outside, it should not work without explicetly allowing service protocol/port. so actually I do not understand how it works for ref. implementation | 06:53 |
| ltomasbo | yep, you are right, we need to allow curl (port 80 or whatever port is needed) to the lbaas network | 06:53 |
| irenab | but it works with reference impementation ... | 06:53 |
| ltomasbo | well, I think that will work thanks to the kubeXXX interface that it created with devstack | 06:54 |
| ltomasbo | with is in the pod members subnet | 06:54 |
| ltomasbo | and that one is allowed at the lbaas subnet | 06:54 |
| ltomasbo | I bet if you set that one down, it should not work | 06:54 |
| ltomasbo | irenab, one question about this: https://review.openstack.org/#/c/512184/ | 06:57 |
| ltomasbo | irenab, the idea you had is to set the port_debug to true always, or just for the devstack deployments, but still keep the default to false in other deployments? | 06:58 |
| ltomasbo | irenab, just double checking that you skipped the config.py on purpose (which I agree with) | 06:59 |
| *** vikasc has joined #openstack-kuryr | 07:03 | |
| irenab | but then I do not understand why it does not work for DF | 07:05 |
| ltomasbo | I don't know about DF, but perhaps the veth kubectlXXX is not properly configure | 07:06 |
| ltomasbo | irenab, can you ping/curl the members directly from the host? | 07:07 |
| ltomasbo | if you can't then the issue is on how we connect this kubectlXXX to the br-int | 07:07 |
| ltomasbo | if you can, then the issue is a different one (I guess) | 07:08 |
| irenab | ltomasbo, regarding https://review.openstack.org/#/c/512184/, I wanted to enable port debug by default but still be able to disable it. Didn't plan to change the default in config.py to keep production default to False. Does it make sense? | 07:09 |
| *** aojea has joined #openstack-kuryr | 07:10 | |
| ltomasbo | irenab, yep, it does, I agree with this! Just double checking that was the intention -- to only enable portdebug for devstack deployments | 07:11 |
| irenab | and still keep it tunable | 07:11 |
| irenab | regarding the host to pod: ping works, curl doesn't | 07:12 |
| ltomasbo | ummm | 07:12 |
| ltomasbo | curl to 8080? (if apuimedo's demo pod is being use) | 07:13 |
| irenab | this one works :-) | 07:13 |
| ltomasbo | ok, so the kubectlXXX interface is properly configure | 07:14 |
| *** karimb has joined #openstack-kuryr | 07:14 | |
| ltomasbo | then I don't know why it is working for ml2/ovs and not for df | 07:14 |
| ltomasbo | I'll try to give it a try with ovn later today if time allows | 07:14 |
| *** aojea has quit IRC | 07:15 | |
| irenab | but curl to VIP does not work | 07:15 |
| irenab | from the host | 07:15 |
| irenab | if you get to it, would be great to know if its specific issue to DF | 07:16 |
| openstackgerrit | Berezovsky Irena proposed openstack/kuryr-kubernetes master: Enable port debug in devstack https://review.openstack.org/512184 | 07:21 |
| openstackgerrit | Michał Dulko proposed openstack/kuryr-kubernetes master: Add basic DevStack installation tutorial https://review.openstack.org/509763 | 07:28 |
| ltomasbo | curl to the VIP should not work from the host (I think) | 07:29 |
| *** yboaron has quit IRC | 07:29 | |
| ltomasbo | irenab, I assume df does not have namespaces, right? | 07:29 |
| ltomasbo | irenab, can you check if you have a route in your host to the FIP? | 07:30 |
| ltomasbo | or if you can access FIPs that are assigned to VMs/containers without lbaas? | 07:30 |
| irenab | ltomasbo, without enabling ping/ssh for SG? | 07:31 |
| ltomasbo | I mean, it is only access to the lbaas subnet, or a problem with the FIPs? I usually add this in my deployments to ensure FIP connectivity | 07:31 |
| ltomasbo | sudo ip link set br-ex up | 07:31 |
| ltomasbo | sudo ip route add 172.24.4.0/24 dev br-ex | 07:31 |
| ltomasbo | sudo ip addr add 172.24.4.1/24 dev br-ex | 07:31 |
| *** yamamoto_ has quit IRC | 07:35 | |
| irenab | ltomasbo, assigned FIP to Pod, no ping or curl from the host | 07:41 |
| ltomasbo | irenab, then it seems the problem is with FIP itself | 07:42 |
| irenab | let me add sg rule to enable it | 07:43 |
| ltomasbo | you can just try to remove the sg and disable port security at the pod's port | 07:43 |
| ltomasbo | and check again | 07:43 |
| *** egonzalez has joined #openstack-kuryr | 07:47 | |
| irenab | ltomasbo, removed port security and still cannot ping to FIP of that port | 07:57 |
| ltomasbo | so, it is not sgs | 07:57 |
| ltomasbo | I think it could be related to the FIP management itself | 07:57 |
| ltomasbo | did you try setting br-ex up and the ip and route? as I suggested above? | 07:58 |
| ltomasbo | (not sure if br-ex exists on DF) | 07:58 |
| irenab | yes, probably. But must admit I am still not sure how FIP should work if we do not enable specific rule per service | 07:58 |
| irenab | yes, did the settings | 07:58 |
| ltomasbo | irenab, I'm not sure anymore that actually works from outside either | 08:00 |
| irenab | :-) | 08:00 |
| ltomasbo | most probably we are taking advantage of the kubectlXXX tap, and the traffic goes from there | 08:01 |
| ltomasbo | so, probably without that being configure, it will not work | 08:01 |
| irenab | but in case of devstack we do have it properly set | 08:01 |
| *** garyloug has joined #openstack-kuryr | 08:02 | |
| openstackgerrit | Michał Dulko proposed openstack/kuryr-kubernetes master: Add basic DevStack installation tutorial https://review.openstack.org/509763 | 08:02 |
| ltomasbo | irenab, yes, to access the VIP and the members, not the FIP | 08:03 |
| dulek | dmellado: Do you have any comments on gates status after Zuul v3 was enabled yesterday? | 08:04 |
| ltomasbo | irenab, another thing is that lbaas deals with taht internally | 08:04 |
| ltomasbo | and adds the needed sgs when created | 08:04 |
| dulek | dmellado: I'm not sure what I can expect from gates now. | 08:04 |
| dmellado | dulek: well, our basic zuulv3 status should be fine | 08:05 |
| dmellado | I was reading those emails now, as I've been on pto for a few days :P | 08:05 |
| irenab | ltomasbo, do you see where its done in the code? | 08:05 |
| dmellado | dulek: anything I should check? | 08:05 |
| ltomasbo | irenab, actually, I think it does that! create a sg that allows the traffic based on the listening pool ports | 08:05 |
| ltomasbo | irenab, you mean in kuryr side? I don't think that is kuryr, but octavia/lbaasv2 | 08:05 |
| dulek | dmellado: https://review.openstack.org/#/c/509763/ - Zuul run on patchset # | 08:05 |
| dulek | dmellado: Patchset #3. | 08:06 |
| irenab | I see only the remote group for ingess and egress | 08:06 |
| dulek | dmellado: Octavia and lbaasv2 tests were triggered even though this was docs only change. | 08:06 |
| *** wangbo has quit IRC | 08:06 | |
| dulek | dmellado: Moreover both failed, Octavia with ECONNREFUSED. | 08:06 |
| dmellado | http://zuulv3.openstack.org/ | 08:07 |
| dulek | dmellado: Okay, both on "Max retries exceeded with url: /v1/loadbalancers" | 08:07 |
| dmellado | dulek: we'll need to check that | 08:07 |
| irenab | ltomasbo, I had a type in the address setting command for the br-ex ... now it works | 08:08 |
| irenab | typo | 08:08 |
| dmellado | on the docs only we'll need to check if we can tweak the gate now to only trigger sphinx gate | 08:08 |
| dulek | dmellado: It should be possible - see e.g. https://review.openstack.org/#/c/512184/ | 08:09 |
| *** wangbo has joined #openstack-kuryr | 08:09 | |
| dulek | dmellado: On my docs change install tests were skipped. | 08:09 |
| dulek | dmellado: But not tempest. I guess there's a simple switch missing. | 08:09 |
| dulek | dmellado: Nevertheless - looks like tempest is failing in the gate. | 08:09 |
| dmellado | I'll need to check how this is done on the dreaded zuulv3 | 08:10 |
| irenab | ltomasbo, so it is SG related, I added ping rule and it works, curl still does not. | 08:10 |
| dmellado | dulek: any link to the failures? so far tempest is doing a *really* simple thing | 08:10 |
| dmellado | so if it fails, houston we've an issue | 08:10 |
| janonymous | dulek: zuul +1 | 08:10 |
| dulek | dmellado: https://review.openstack.org/#/c/512184/ - you have two failed tempest runs here. | 08:11 |
| *** aojea has joined #openstack-kuryr | 08:11 | |
| irenab | added tcp pot 80 (the one of the service) and it works | 08:11 |
| ltomasbo | ummm | 08:11 |
| ltomasbo | irenab, and that was with octavia or lbaasv2? | 08:12 |
| irenab | ltomasbo, so still not sure why it works withoiut explicit rule for the ref. impl. | 08:12 |
| irenab | lbaasv2 + DF | 08:12 |
| dmellado | WTF ft1.1: devstack_StringException | 08:12 |
| ltomasbo | ok, so maybe this was tested just with octaviaL3 then... | 08:12 |
| ltomasbo | but yep, I don't understand why it happens | 08:13 |
| irenab | it works with ref. Both Yaron and myself checked this | 08:13 |
| ltomasbo | with lbaasv2 too? | 08:13 |
| irenab | yes | 08:13 |
| ltomasbo | ummm | 08:13 |
| irenab | So if you happen to deploy ovn or odl , please see what happens | 08:14 |
| dmellado | dulek: this could be just a devstack issue, as you said | 08:14 |
| dmellado | 2017-10-16 07:54:41.466 | Driver error: HTTPConnectionPool(host='127.0.0.1', port=9876): Max retries exceeded with url: /v1/loadbalancers (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5ee0d9b510>: Failed to establish a new connection: [Errno 111] ECONNREFUSED',)) | 08:14 |
| ltomasbo | then, maybe there are some different devstack deployment steps for ml2/ovs that are not happening for others, related to FIP configuration | 08:14 |
| dulek | dmellado: Yeah, looks like Octavia/LBaaS wasn't sintalled? | 08:14 |
| ltomasbo | irenab, yes, I'll test later today with ovn | 08:14 |
| irenab | ltomasbo, I am not sure how it may be FIP related, since SGs are on VIP | 08:15 |
| ltomasbo | and if I manage to finish a multinode setup with ODL, I'll test it too | 08:15 |
| ltomasbo | but you said VIP was accessible, but not FIP, right? | 08:15 |
| *** aojea has quit IRC | 08:15 | |
| ltomasbo | or none of them are? | 08:15 |
| dmellado | dulek: looks like it | 08:15 |
| irenab | VIP was from one of the pods (not host) | 08:15 |
| dmellado | for instance I'm not seeing any octavia logs here | 08:15 |
| dmellado | http://logs.openstack.org/84/512184/2/check/tempest-kuryr-kubernetes-octavia/2ab668c/logs/ | 08:15 |
| irenab | FIP from the host after the rule addition | 08:16 |
| ltomasbo | ahh, true | 08:16 |
| ltomasbo | and you checked the rules after deployment for both, df and ml2-ovs, and there were the same sgs? | 08:16 |
| irenab | yes | 08:17 |
| dmellado | dulek: let me trigger a octavia enabled dsvm just to check | 08:17 |
| ltomasbo | so, unless something weird is managed at the qrouter or qlbaas namespace, I don't see a reason why this should happend | 08:18 |
| irenab | with lbaasv2 I only see the SG remote_group for ingress and egress in the VIP associated SG | 08:18 |
| irenab | ltomasbo, which more looks like bug than feature actually | 08:19 |
| ltomasbo | :) | 08:19 |
| *** yamamoto has joined #openstack-kuryr | 08:36 | |
| *** yboaron has joined #openstack-kuryr | 08:37 | |
| *** yamamoto has quit IRC | 08:42 | |
| *** zarka has joined #openstack-kuryr | 08:42 | |
| *** zarka has quit IRC | 08:43 | |
| *** yamamoto has joined #openstack-kuryr | 09:04 | |
| *** yamamoto has quit IRC | 09:09 | |
| *** wangbo has quit IRC | 09:10 | |
| openstackgerrit | Merged openstack/kuryr-kubernetes master: Enable port debug in devstack https://review.openstack.org/512184 | 09:10 |
| *** aojea has joined #openstack-kuryr | 09:12 | |
| apuimedo | ltomasbo: if you want to try the lbaasv2 thing irenab reported with ovn, you'll need numans' patches | 09:13 |
| *** yamamoto has joined #openstack-kuryr | 09:13 | |
| *** wangbo has joined #openstack-kuryr | 09:13 | |
| *** aojea has quit IRC | 09:16 | |
| *** wangbo has quit IRC | 09:16 | |
| ltomasbo | apuimedo, which ones? aren't they merged upstream? | 09:20 |
| ltomasbo | I mean, it will not work with TripleO but I thought it should work with dvstack using master branches | 09:20 |
| apuimedo | ltomasbo: I think it was a PoC | 09:20 |
| apuimedo | not sure he intends to send it upstream at all | 09:20 |
| ltomasbo | ok | 09:21 |
| ltomasbo | I'll check, I'm still confident enough on the odl multinode to be able to test it there! xD | 09:21 |
| *** wangbo has joined #openstack-kuryr | 09:22 | |
| dmellado | ltomasbo: that's like saying 'follow me, I know the way' xD | 09:26 |
| ltomasbo | xD | 09:26 |
| ltomasbo | well, I didn't mean that... | 09:27 |
| ltomasbo | but if you want to follow me, a couple of extra eyes are always welcome :D | 09:27 |
| openstackgerrit | Berezovsky Irena proposed openstack/kuryr-kubernetes master: Update dragonflow devstack local.conf https://review.openstack.org/512232 | 09:33 |
| ltomasbo | apuimedo, I have a ovn deployment | 09:36 |
| ltomasbo | and I cannot log it (kubectl exec -it) into the container with kubernets, but I can do it with docker exec | 09:36 |
| ltomasbo | and I can curl the lbaas VIP from within the container | 09:37 |
| irenab | ltomasbo, waht about FIP? | 09:37 |
| ltomasbo | it was an old deployment, going to update it and test it with FIP | 09:37 |
| ltomasbo | give me five minutes! | 09:38 |
| *** janki has quit IRC | 09:40 | |
| apuimedo | ltomasbo: that's due to the dns IIRC | 09:41 |
| *** janki has joined #openstack-kuryr | 09:41 | |
| ltomasbo | apuimedo, could be | 09:44 |
| *** wangbo has quit IRC | 09:48 | |
| *** kiennt26 has quit IRC | 09:50 | |
| ltomasbo | irenab, it does not work either | 09:51 |
| *** wangbo has joined #openstack-kuryr | 09:53 | |
| *** aojea has joined #openstack-kuryr | 10:12 | |
| *** aojea has quit IRC | 10:17 | |
| apuimedo | dmellado: ltomasbo: https://review.openstack.org/#/c/510157/ | 10:26 |
| apuimedo | what to do when jenkins says no and zuul says yes? | 10:26 |
| ltomasbo | recheck... | 10:27 |
| *** wangbo has quit IRC | 10:29 | |
| *** danil has joined #openstack-kuryr | 10:29 | |
| dmellado | as of now, disregard jenkins | 10:32 |
| *** openstackgerrit has quit IRC | 10:33 | |
| apuimedo | dmellado: but it's still being run against the patches and blocking them | 10:36 |
| dmellado | apuimedo: in a meeting | 10:38 |
| dmellado | bbiab | 10:38 |
| *** caowei has quit IRC | 10:38 | |
| irenab | ltomasbo, good news. Trying something we discussed with apuimedo | 10:48 |
| apuimedo | irenab: ? | 10:49 |
| apuimedo | that sg rule? | 10:49 |
| irenab | yes | 10:49 |
| irenab | will update once check | 10:49 |
| apuimedo | perfect | 10:49 |
| apuimedo | thanks irenab ! | 10:49 |
| dmellado | apuimedo: back | 10:50 |
| dmellado | so what's up? | 10:50 |
| dmellado | huh, this is weird | 10:51 |
| dmellado | there were a few patches removing the legaxy gates | 10:51 |
| dmellado | apuimedo: recheck, the patch that removed the legacy jenkins got merged after OCt 11 | 10:52 |
| apuimedo | dmellado: ltomasbo did a recheck today at 7:31am CEST | 10:53 |
| *** vikasc has quit IRC | 10:55 | |
| dmellado | apuimedo: try abandoning and recovering.... | 10:56 |
| *** openstackgerrit has joined #openstack-kuryr | 10:59 | |
| openstackgerrit | Daniel Mellado proposed openstack/kuryr-kubernetes master: o[DNM] ZuulV3 test https://review.openstack.org/512263 | 10:59 |
| dmellado | apuimedo: ltomasbo dulek let's see how that foo patch behaves ^^ | 11:00 |
| dmellado | I'll also need to dig on the non-installing lbaas/octavia | 11:00 |
| dmellado | apuimedo: ltomasbo jenkins -1 shouldn't matter there | 11:09 |
| *** vikasc has joined #openstack-kuryr | 11:09 | |
| dmellado | in any case, folks, if you see any weird thing, pls post it here | 11:12 |
| dmellado | https://etherpad.openstack.org/p/zuulv3-issues | 11:12 |
| *** aojea has joined #openstack-kuryr | 11:13 | |
| *** aojea has quit IRC | 11:17 | |
| dmellado | it seems that the issues on those gates were already partially tracked there | 11:25 |
| dmellado | so... zuulv3gate, and not the good one xD | 11:25 |
| *** wangbo has joined #openstack-kuryr | 11:28 | |
| *** atoth has joined #openstack-kuryr | 11:36 | |
| *** yamamoto has quit IRC | 11:38 | |
| irenab | apuimedo, it didn't work | 11:42 |
| irenab | apuimedo, ltomasbo I think we may need something similar to octavia : https://github.com/openstack/octavia/blob/master/octavia/network/drivers/neutron/allowed_address_pairs.py#L202 | 11:54 |
| *** vikasc has quit IRC | 11:55 | |
| *** yamamoto has joined #openstack-kuryr | 11:58 | |
| ltomasbo | irenab, yep, it may be needed | 12:05 |
| ltomasbo | irenab, what did you test btw? | 12:05 |
| *** vikasc has joined #openstack-kuryr | 12:10 | |
| *** aojea has joined #openstack-kuryr | 12:14 | |
| *** aojea has quit IRC | 12:19 | |
| *** yamamoto has quit IRC | 12:21 | |
| irenab | ltomasbo, curl to FIP from the host | 12:24 |
| ltomasbo | ok | 12:27 |
| *** wangbo has quit IRC | 12:34 | |
| openstackgerrit | Danil Golov proposed openstack/kuryr-kubernetes master: Allow passing multiple VIFs to CNI https://review.openstack.org/471012 | 12:39 |
| openstackgerrit | Danil Golov proposed openstack/kuryr-kubernetes master: [WIP] Add SR-IOV capabilities to VIF handler https://review.openstack.org/512280 | 12:39 |
| openstackgerrit | Danil Golov proposed openstack/kuryr-kubernetes master: [WIP] Add SR-IOV binding driver to CNI https://review.openstack.org/512281 | 12:39 |
| openstackgerrit | Danil Golov proposed openstack/kuryr-kubernetes master: [WIP] Allow requesting additional subnets via annotation https://review.openstack.org/512282 | 12:39 |
| *** yamamoto has joined #openstack-kuryr | 12:52 | |
| *** vikasc has quit IRC | 12:52 | |
| *** vikasc has joined #openstack-kuryr | 13:05 | |
| *** aojea has joined #openstack-kuryr | 13:15 | |
| *** aojea has quit IRC | 13:19 | |
| *** kiennt26 has joined #openstack-kuryr | 13:23 | |
| *** kiennt26 has quit IRC | 13:37 | |
| *** limao has quit IRC | 13:37 | |
| *** hongbin has joined #openstack-kuryr | 13:41 | |
| *** danil has quit IRC | 13:44 | |
| openstackgerrit | Hongbin Lu proposed openstack/kuryr master: Introduce a SR-IOV binding driver https://review.openstack.org/500420 | 13:45 |
| irenab | ltomasbo: can you please check if you add rule to enable tcp port 80 (assuming you are deploying apuimedo’s demo app) to the pod/service SG, does it work for FIP access? | 13:46 |
| ltomasbo | irenab, sure | 13:47 |
| ltomasbo | irenab, yep, it works | 13:50 |
| irenab | ltomasbo: great, same for dragonflow | 13:50 |
| irenab | seems we need to add Octavia like support to create VIP SG with service rule in it | 13:51 |
| irenab | at least I do not think how we can make it at deployment time, unless we deside to enable all tcp range | 13:51 |
| irenab | still do not know how it works for neutron-ovs | 13:52 |
| irenab | yboaron: any idea? | 13:52 |
| yboaron | irenab, Hmmmm , No .... | 13:53 |
| ltomasbo | I'm not sure how that needs to be handled | 13:53 |
| *** gouthamr has joined #openstack-kuryr | 13:54 | |
| irenab | it works for VIP since both service port and pods port have smae SG | 13:54 |
| ltomasbo | can fips have different sgs? | 13:54 |
| irenab | but with FIP, we need to have rule allowing to accept port and protocol that service provides | 13:54 |
| ltomasbo | and can/should that be decided when doing kubernetes expose? or should that be handle by the OpenStack provider? | 13:55 |
| irenab | are we talking about kuryr? | 13:55 |
| irenab | OpenStack provider works a bit different | 13:55 |
| ltomasbo | I mean, floating ip network is usually handle by the OpenStack admin | 13:57 |
| ltomasbo | not the tenants | 13:57 |
| *** kiennt26 has joined #openstack-kuryr | 13:57 | |
| apuimedo | the tenants can only request fips from it | 13:58 |
| ltomasbo | right | 13:58 |
| irenab | but the SG is on internal port (VIP in our case), not the FIP | 13:58 |
| ltomasbo | yep, the FIP has the sg disabled | 13:58 |
| irenab | so to allow external access we need to enable service related rule, smae as to allow ping/ssh/… | 13:59 |
| *** janki has quit IRC | 14:07 | |
| *** yamamoto has quit IRC | 14:07 | |
| *** janki has joined #openstack-kuryr | 14:07 | |
| *** aojea has joined #openstack-kuryr | 14:15 | |
| openstackgerrit | Merged openstack/kuryr master: Updated from global requirements https://review.openstack.org/496048 | 14:18 |
| openstackgerrit | Merged openstack/kuryr master: Introduce a SR-IOV binding driver https://review.openstack.org/500420 | 14:18 |
| openstackgerrit | Hongbin Lu proposed openstack/kuryr master: Allow multiple binding drivers https://review.openstack.org/508778 | 14:19 |
| *** aojea has quit IRC | 14:20 | |
| openstackgerrit | Hongbin Lu proposed openstack/kuryr master: Allow multiple binding drivers https://review.openstack.org/508778 | 14:23 |
| *** janki has quit IRC | 14:40 | |
| *** vikasc has quit IRC | 14:44 | |
| *** vikasc has joined #openstack-kuryr | 14:59 | |
| *** yamamoto has joined #openstack-kuryr | 15:08 | |
| *** yamamoto has quit IRC | 15:14 | |
| *** aojea has joined #openstack-kuryr | 15:16 | |
| *** yboaron has quit IRC | 15:19 | |
| *** aojea has quit IRC | 15:21 | |
| *** kiennt26 has quit IRC | 15:27 | |
| *** yamamoto has joined #openstack-kuryr | 16:10 | |
| *** yamamoto has quit IRC | 16:15 | |
| *** aojea has joined #openstack-kuryr | 16:21 | |
| *** egonzalez has quit IRC | 16:23 | |
| *** aojea has quit IRC | 16:23 | |
| *** yamamoto has joined #openstack-kuryr | 17:12 | |
| *** yamamoto has quit IRC | 17:18 | |
| *** aojea has joined #openstack-kuryr | 17:24 | |
| *** aojea has quit IRC | 17:29 | |
| *** tonygunk has joined #openstack-kuryr | 18:00 | |
| *** yamamoto has joined #openstack-kuryr | 18:14 | |
| *** yamamoto has quit IRC | 18:19 | |
| *** aojea has joined #openstack-kuryr | 18:25 | |
| *** aojea has quit IRC | 18:29 | |
| *** yamamoto has joined #openstack-kuryr | 19:15 | |
| *** yamamoto has quit IRC | 19:20 | |
| *** atoth has quit IRC | 19:22 | |
| *** aojea has joined #openstack-kuryr | 19:43 | |
| *** aojea has quit IRC | 19:48 | |
| *** hongbin has quit IRC | 20:05 | |
| *** salv-orlando has joined #openstack-kuryr | 20:16 | |
| *** yamamoto has joined #openstack-kuryr | 20:17 | |
| *** yamamoto has quit IRC | 20:22 | |
| *** tonygunk has quit IRC | 20:44 | |
| *** aojea has joined #openstack-kuryr | 20:44 | |
| *** aojea has quit IRC | 20:49 | |
| *** livelace-link has joined #openstack-kuryr | 20:56 | |
| *** yamamoto has joined #openstack-kuryr | 21:18 | |
| *** yamamoto has quit IRC | 21:24 | |
| *** karimb has quit IRC | 21:42 | |
| *** aojea has joined #openstack-kuryr | 21:45 | |
| *** aojea has quit IRC | 21:49 | |
| *** pmannidi has joined #openstack-kuryr | 22:08 | |
| *** salv-orlando has quit IRC | 22:14 | |
| *** yamamoto has joined #openstack-kuryr | 22:21 | |
| *** yamamoto has quit IRC | 22:26 | |
| *** gouthamr has quit IRC | 22:37 | |
| *** aojea has joined #openstack-kuryr | 22:46 | |
| *** aojea has quit IRC | 22:50 | |
| *** gouthamr has joined #openstack-kuryr | 22:57 | |
| *** salv-orlando has joined #openstack-kuryr | 23:15 | |
| *** salv-orlando has quit IRC | 23:21 | |
| *** yamamoto has joined #openstack-kuryr | 23:22 | |
| *** yamamoto has quit IRC | 23:28 | |
| *** aojea has joined #openstack-kuryr | 23:47 | |
| *** aojea has quit IRC | 23:51 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!