woodster_ | ptoohill: are you just trying to develop with Barbican locally? If so you can run in the standalone mode with a queue | 00:01 |
---|---|---|
ptoohill | woodster_: I set it up with devstack, I would have to look into that. I was getting errors about user_id none from the queue. Is there somethign known possibly? | 00:03 |
ptoohill | I would have to look into it more to see if thats the real error or i had something else going on but i could not reg a consumer. | 00:03 |
*** bharath has quit IRC | 00:09 | |
woodster_ | ptoohill: queues should only be needed for orders, not containers and consumers | 00:12 |
ptoohill | Then its possible im having other issues but the logs were filled with those errors. Ill dig into it more tonight. | 00:13 |
*** mixos has joined #openstack-lbaas | 00:27 | |
*** mixos is now known as mixos-away | 00:27 | |
*** mixos-away is now known as mixos | 00:28 | |
madhu_ak | mixos, xgerman: sorry, didn't notice your messages. | 00:33 |
*** SumitNaiksatam has quit IRC | 00:52 | |
*** madhu_ak has quit IRC | 01:11 | |
*** hitalia has quit IRC | 01:35 | |
*** amotoki has joined #openstack-lbaas | 01:46 | |
*** amotoki_ has joined #openstack-lbaas | 01:47 | |
*** bradjones has quit IRC | 01:52 | |
*** amotoki_ has quit IRC | 01:52 | |
*** bradjones has joined #openstack-lbaas | 01:56 | |
*** kiran-r has joined #openstack-lbaas | 02:20 | |
*** kiran-r has quit IRC | 02:56 | |
*** kiran-r has joined #openstack-lbaas | 02:57 | |
*** madhu_ak has joined #openstack-lbaas | 02:59 | |
*** vivek-ebay has quit IRC | 02:59 | |
*** kiran-r has quit IRC | 03:03 | |
*** bharath has joined #openstack-lbaas | 03:10 | |
*** barra204 has quit IRC | 03:11 | |
*** barra204 has joined #openstack-lbaas | 03:13 | |
*** bharath has quit IRC | 03:14 | |
*** amotoki_ has joined #openstack-lbaas | 03:36 | |
openstackgerrit | Doug Wiegley proposed openstack/neutron-lbaas: Pull lbaasv1 tempest tests in-tree, and run v1/v2 tests directly https://review.openstack.org/186219 | 03:40 |
*** amotoki_ has quit IRC | 03:41 | |
*** TrevorV|Home has joined #openstack-lbaas | 03:46 | |
openstackgerrit | Doug Wiegley proposed openstack/neutron-lbaas: Pull lbaasv1 tempest tests in-tree, and run v1/v2 tests directly https://review.openstack.org/186219 | 03:53 |
*** mixos has left #openstack-lbaas | 03:54 | |
*** TrevorV_ has joined #openstack-lbaas | 04:00 | |
*** TrevorV_ has quit IRC | 04:00 | |
*** TrevorV|Home has quit IRC | 04:06 | |
*** ajmiller has quit IRC | 04:12 | |
*** vivek-ebay has joined #openstack-lbaas | 04:13 | |
*** amotoki has quit IRC | 04:15 | |
*** amotoki has joined #openstack-lbaas | 04:37 | |
*** madhu_ak has quit IRC | 04:55 | |
*** Kunal has joined #openstack-lbaas | 05:02 | |
*** LouieC has joined #openstack-lbaas | 05:13 | |
*** LouieC has left #openstack-lbaas | 05:13 | |
*** kiran-r has joined #openstack-lbaas | 05:23 | |
*** amotoki_ has joined #openstack-lbaas | 05:25 | |
*** amotoki_ has quit IRC | 05:30 | |
*** SumitNaiksatam has joined #openstack-lbaas | 05:35 | |
*** madhu_ak has joined #openstack-lbaas | 05:36 | |
*** vivek-ebay has quit IRC | 05:46 | |
*** kiran-r has quit IRC | 05:58 | |
openstackgerrit | Doug Wiegley proposed openstack/neutron-lbaas: Pull lbaasv1 tempest tests in-tree, and run v1/v2 tests directly https://review.openstack.org/186219 | 06:11 |
*** Miouge_ has joined #openstack-lbaas | 06:18 | |
*** Miouge has quit IRC | 06:20 | |
*** Miouge_ is now known as Miouge | 06:20 | |
*** madhu_ak has quit IRC | 06:24 | |
*** amotoki_ has joined #openstack-lbaas | 06:41 | |
*** amotoki_ has quit IRC | 06:45 | |
*** woodster_ has quit IRC | 06:50 | |
*** Miouge_ has joined #openstack-lbaas | 07:02 | |
*** Miouge has quit IRC | 07:03 | |
*** Miouge_ is now known as Miouge | 07:03 | |
*** kiran-r has joined #openstack-lbaas | 07:04 | |
openstackgerrit | Phillip Toohill proposed stackforge/octavia: Hooking TLS together https://review.openstack.org/185540 | 07:09 |
*** Kunal has quit IRC | 07:14 | |
*** Miouge has quit IRC | 07:25 | |
*** Miouge has joined #openstack-lbaas | 07:33 | |
*** apuimedo has joined #openstack-lbaas | 08:19 | |
*** apuimedo has quit IRC | 08:27 | |
*** ByPasS has quit IRC | 08:44 | |
*** Miouge has quit IRC | 08:58 | |
*** Miouge has joined #openstack-lbaas | 09:01 | |
*** Miouge has quit IRC | 09:01 | |
*** amotoki_ has joined #openstack-lbaas | 10:17 | |
*** amotoki_ has quit IRC | 10:22 | |
*** apuimedo has joined #openstack-lbaas | 10:29 | |
*** apuimedo has quit IRC | 10:38 | |
*** amotoki has quit IRC | 10:53 | |
*** apuimedo has joined #openstack-lbaas | 10:55 | |
*** Miouge has joined #openstack-lbaas | 10:59 | |
*** amotoki has joined #openstack-lbaas | 11:49 | |
*** Miouge has quit IRC | 11:52 | |
*** amotoki has quit IRC | 11:54 | |
*** kiran-r has quit IRC | 12:05 | |
*** kiran-r has joined #openstack-lbaas | 12:05 | |
*** kiran-r has quit IRC | 12:16 | |
*** amotoki has joined #openstack-lbaas | 12:49 | |
*** woodster_ has joined #openstack-lbaas | 12:50 | |
*** apuimedo has quit IRC | 12:52 | |
*** amotoki has quit IRC | 12:54 | |
*** apuimedo has joined #openstack-lbaas | 13:09 | |
*** mixos has joined #openstack-lbaas | 13:49 | |
*** jhova has joined #openstack-lbaas | 13:50 | |
*** mixos has quit IRC | 13:56 | |
*** apuimedo has quit IRC | 14:00 | |
*** apuimedo has joined #openstack-lbaas | 14:16 | |
*** amotoki has joined #openstack-lbaas | 14:38 | |
*** amotoki has quit IRC | 14:43 | |
*** vivek-ebay has joined #openstack-lbaas | 14:46 | |
*** ajmiller has joined #openstack-lbaas | 14:48 | |
*** amotoki has joined #openstack-lbaas | 14:52 | |
*** TrevorV|Home has joined #openstack-lbaas | 15:04 | |
*** apuimedo has quit IRC | 15:07 | |
*** apuimedo has joined #openstack-lbaas | 15:24 | |
TrevorV|Home | I think devstack is broken again... | 15:35 |
TrevorV|Home | Why this always happen when I'm in a time crunch? | 15:35 |
*** apuimedo has quit IRC | 15:38 | |
ptoohill | TrevorV|Home: what is it doing? | 15:43 |
TrevorV|Home | Failing. | 15:43 |
TrevorV|Home | I'll gist you | 15:43 |
TrevorV|Home | ptoohill, https://gist.github.com/interminator/2fc03730b31de01573cd | 15:43 |
ptoohill | do you see other 500's by chance? | 15:44 |
ptoohill | check the git status of glance/other projects. If you have a bunch of req files not commited youre in bad state. Blow away repos and start fresh :/ | 15:45 |
ptoohill | its been doing that more often for me lately' | 15:45 |
TrevorV|Home | I did that ptoohill | 15:45 |
ptoohill | well i dont know if that error is in/from glance itself or like octavia trying to find image | 15:46 |
TrevorV|Home | I did it from just a "git pull" on devstack originally, then I removed the virtualenv on the directory I was stacking in, and then I nuked the /opt/stack/* stuffs and tried again | 15:46 |
TrevorV|Home | All failed with same error | 15:46 |
ptoohill | possible the image didnt get built/uploaded | 15:46 |
*** mixos has joined #openstack-lbaas | 15:46 | |
*** mixos is now known as mixos-away | 15:46 | |
ptoohill | hmm | 15:46 |
TrevorV|Home | But the "cirros" one should have regardless, right? | 15:47 |
ptoohill | octavia uses special one | 15:47 |
ptoohill | would need more context to know if this is 'global' error or specific to our image | 15:47 |
TrevorV|Home | Yes, I know, but I don't see any trace of it dying specifically in octavia, and it should at least show ONE image, when it shows none | 15:47 |
ptoohill | true | 15:48 |
*** mixos-away is now known as mixos | 15:48 | |
ptoohill | i just know when i was seeing the unrecognized args (for multiple projects) i wiped /opt/stack got latest master devstack and re ran. everything worked after that. but its done it a few times now | 15:49 |
ptoohill | i dont know what causes this :/ | 15:50 |
TrevorV|Home | I've done that as a "standard debug step" every time I run into errors and come running to others for help ha ha. | 15:50 |
ptoohill | I havnt had to debug beyond that, i wont be of much help then | 15:51 |
ptoohill | sorry | 15:51 |
johnsom | I saw that they were moving the cirros image location to here: http://download.cirros-cloud.net/ Not sure what you have in your localrc | 15:51 |
johnsom | I think 0.3.0 is the last image in launchpad | 15:52 |
ptoohill | its complaining about bad args though. And when i get this its for multiple projects | 15:52 |
ptoohill | hopefully its just an image location issue for him | 15:53 |
TrevorV|Home | johnsom, thanks for the heads up | 15:53 |
TrevorV|Home | I have the 0.3.0 specifically in my localrc though, so it probably shouldn't fail there | 15:53 |
ptoohill | the error, to me, means the clients/project are out of sync somehow | 15:54 |
ptoohill | openstack image list: error: unrecognized arguments: --property status=active | 15:54 |
ptoohill | may need to specifically wipe the installed clients since they arent installed seperately from devstack | 15:55 |
ptoohill | are* | 15:55 |
TrevorV|Home | does that not happen when I run "./clean.sh"? | 15:55 |
ptoohill | not sure, i dont think so | 15:55 |
TrevorV|Home | well since I've never seen "openstack image list" as a command in general until this morning, I'd say its probably installed via devstack | 15:56 |
ptoohill | devstack does install it yes, but its not installed in /opt/stack | 15:56 |
ptoohill | though, barbican is | 15:56 |
ptoohill | and i pull them down if im working on one specifically | 15:56 |
ptoohill | Theres a place in the docs for devstack regarding the installtion of clients | 15:57 |
ptoohill | eh, neutronclient is there too. unless i pulled that one. cant remember. but the others are not | 15:58 |
*** vivek-eb_ has joined #openstack-lbaas | 16:02 | |
*** vivek-ebay has quit IRC | 16:04 | |
TrevorV|Home | I nuked all the clients | 16:09 |
TrevorV|Home | I'm re-stacking now | 16:09 |
TrevorV|Home | See if that helps | 16:09 |
*** vivek-eb_ has quit IRC | 16:14 | |
*** mixos is now known as mixos-away | 16:23 | |
*** mixos-away is now known as mixos | 16:23 | |
*** amotoki has quit IRC | 16:24 | |
openstackgerrit | Doug Wiegley proposed openstack/neutron-lbaas: Pull lbaasv1 tempest tests in-tree, use installed neutron for v1/v2 job https://review.openstack.org/186219 | 16:28 |
openstackgerrit | Doug Wiegley proposed openstack/neutron-lbaas: Pull lbaasv1 tempest tests in-tree, use installed neutron for v1/v2 job https://review.openstack.org/186219 | 16:29 |
*** kiran-r has joined #openstack-lbaas | 16:30 | |
*** madhu_ak has joined #openstack-lbaas | 16:33 | |
*** vivek-ebay has joined #openstack-lbaas | 16:36 | |
*** mlavalle has joined #openstack-lbaas | 16:53 | |
*** TrevorV|Home has quit IRC | 16:56 | |
*** hitalia has joined #openstack-lbaas | 16:58 | |
*** TrevorV|Home has joined #openstack-lbaas | 16:58 | |
*** SumitNaiksatam has quit IRC | 17:19 | |
*** SumitNaiksatam has joined #openstack-lbaas | 17:20 | |
*** mixos is now known as mixos-away | 17:25 | |
*** barra204 has quit IRC | 17:26 | |
TrevorV|Home | Sorry, for anyone who followed the conversation earlier, after I manually removed all the openstack related python clients, the stack worked successfully, but I may have found a bug in the "./unstack.sh" process | 17:27 |
*** kiranr has joined #openstack-lbaas | 17:31 | |
*** SumitNaiksatam has quit IRC | 17:31 | |
*** SumitNaiksatam has joined #openstack-lbaas | 17:33 | |
*** kiran-r has quit IRC | 17:35 | |
*** kiranr has quit IRC | 17:41 | |
*** kiran-r has joined #openstack-lbaas | 17:42 | |
*** kiran-r has quit IRC | 17:46 | |
rm_work | heh, unstack | 17:55 |
rm_work | something i've never actually bothered running :P | 17:55 |
*** bharath has joined #openstack-lbaas | 17:56 | |
johnsom | Yeah, I have moved on to just using clean.sh | 17:57 |
rm_work | i still just re-image and stack | 17:58 |
rm_work | guaranteed clean :P | 17:58 |
*** mixos-away is now known as mixos | 17:59 | |
*** SumitNaiksatam has quit IRC | 18:05 | |
*** SumitNaiksatam has joined #openstack-lbaas | 18:06 | |
*** barra204 has joined #openstack-lbaas | 18:08 | |
*** kiran-r has joined #openstack-lbaas | 18:11 | |
*** kiran-r has quit IRC | 18:11 | |
*** barra204 has quit IRC | 18:15 | |
*** barra204 has joined #openstack-lbaas | 18:20 | |
openstackgerrit | Aishwarya Thangappa proposed openstack/neutron-lbaas: Tempest tests for Listener using testscenarios. https://review.openstack.org/179818 | 18:20 |
TrevorV|Home | johnsom, I was running this: "./unstack.sh && ./clean.sh" and it still didn't clean up everything that was causing a conflict | 18:22 |
*** crc32 has joined #openstack-lbaas | 18:24 | |
*** barra204_ has joined #openstack-lbaas | 18:27 | |
*** crc32 has quit IRC | 18:30 | |
*** crc32 has joined #openstack-lbaas | 18:30 | |
*** barra204 has quit IRC | 18:31 | |
ptoohill | TrevorV|Home: clean.sh calls unstack | 18:34 |
TrevorV|Home | ....srsly.... I'm dumb | 18:34 |
ptoohill | :P | 18:34 |
*** crc32 has quit IRC | 18:35 | |
*** crc32 has joined #openstack-lbaas | 18:40 | |
*** bharath has quit IRC | 18:49 | |
*** barra204_ is now known as shakamunyi | 18:52 | |
*** madhu_ak has quit IRC | 19:02 | |
*** crc32 has quit IRC | 19:10 | |
*** ajmiller has quit IRC | 19:12 | |
*** ajmiller has joined #openstack-lbaas | 19:13 | |
openstackgerrit | Sungjin Yook proposed openstack/neutron-lbaas: Add a new lbaas agent Scheduler, LeastPoolAgentScheduler https://review.openstack.org/181609 | 19:15 |
*** madhu_ak has joined #openstack-lbaas | 19:16 | |
openstackgerrit | Sungjin Yook proposed openstack/neutron-lbaas: Add a new lbaas agent Scheduler, LeastPoolAgentScheduler https://review.openstack.org/181609 | 19:17 |
*** madhu_ak has quit IRC | 19:42 | |
ajmiller | TrevorV|Home if clean.sh is leaving something behind that is causing a conflict, we should look into it and get it fixed. It should (and used to) work. | 19:50 |
TrevorV|Home | Well ajmiller it doesn't remove a single client. | 19:51 |
TrevorV|Home | If it INSTALLS the clients with ./stack.sh, then I'd argue it should remove the clients when you do a clean.sh | 19:51 |
TrevorV|Home | Which apparently isn't happening | 19:52 |
ajmiller | Yes, I agree that is what it should do. | 19:52 |
ajmiller | BTW, I have found/fixed a couple of bugs in devstack clean.sh that were a result of the plugin decomposition. Would not surprise me if there are more. | 19:53 |
TrevorV|Home | Yeah, well, at this point I don't really ever expect devstack to be completely function at any given time. It "should" be, but I run into issues all the time | 19:54 |
TrevorV|Home | functional*** | 19:54 |
ajmiller | LOL | 19:55 |
ajmiller | Yeah, it can be a bit fragile. They've been doing a ton of refactoring, and I believe they have some more changes coming | 19:56 |
*** SumitNaiksatam has quit IRC | 19:59 | |
rm_work | i will repeat the (probably unhelpful) advice I give all the time: nuke it from orbit | 19:59 |
rm_work | which requires setting it up in such a way that you can do that | 20:00 |
rm_work | IE, not local dev :( | 20:00 |
TrevorV|Home | rm_work, not interested in NOT local dev | 20:03 |
*** madhu_ak has joined #openstack-lbaas | 20:03 | |
*** SumitNaiksatam has joined #openstack-lbaas | 20:04 | |
*** openstack has joined #openstack-lbaas | 20:05 | |
johnsom | It's the only way to be sure.... | 20:05 |
ptoohill | any thoughts on the consumers? | 20:05 |
TrevorV|Home | Its also NOT an appropriate solution for a fragile environment. | 20:05 |
rm_work | ptoohill: ugh, i think we just have to fake it for Octavia, and just do a register call in the driver | 20:07 |
rm_work | ptoohill: though, lets make failing that call a hard-stop error | 20:07 |
rm_work | err, no-continue | 20:07 |
rm_work | you know what i mean | 20:07 |
*** SumitNaiksatam has quit IRC | 20:11 | |
ptoohill | yea | 20:11 |
*** SumitNaiksatam has joined #openstack-lbaas | 20:11 | |
ptoohill | This means we are getting the barbican data several times then.. | 20:12 |
rm_work | well, only the container | 20:12 |
rm_work | which is just one single call | 20:12 |
rm_work | not too bad | 20:12 |
ptoohill | 3 times.. | 20:12 |
rm_work | it isn't actually pulling any of the secrets | 20:12 |
rm_work | or, it should not | 20:13 |
ptoohill | it does... | 20:13 |
rm_work | why? | 20:13 |
ptoohill | it validates the data on the first go | 20:13 |
ptoohill | then driver would be second, that shouldnt need to | 20:13 |
rm_work | i thought validate was manual | 20:13 |
ptoohill | then third to use the data | 20:13 |
ptoohill | manual? | 20:13 |
rm_work | you had to do .validate() | 20:13 |
rm_work | or something | 20:13 |
rm_work | it lazy-loads the data | 20:13 |
rm_work | so unless you actually try to fetch the key/cert/whatever | 20:14 |
rm_work | it doesn't fetch them | 20:14 |
ptoohill | yea? It loads the certificate data and uses the tls_utils to verify certificates | 20:14 |
rm_work | but only if you tell it to | 20:14 |
ptoohill | what would we be validating if we didnt validate the certs | 20:14 |
rm_work | not just on the first get | 20:14 |
ptoohill | yea... | 20:14 |
rm_work | so, neutron-lbaas validates the stuff as part of the user's API call | 20:14 |
ptoohill | would be nice if barbican did the validation | 20:14 |
ptoohill | yes | 20:14 |
rm_work | (which does load everything) | 20:14 |
ptoohill | yes | 20:14 |
rm_work | then it passes it to the driver | 20:14 |
ptoohill | correct | 20:14 |
rm_work | the driver should just be able to do the register call | 20:15 |
ptoohill | not the data, just the ref | 20:15 |
rm_work | which will only be one single http hit | 20:15 |
ptoohill | and then octavia will also load everything | 20:15 |
rm_work | ptoohill: err, it should be validating the data on the first neutron-lbaas hit | 20:15 |
ptoohill | this is 8 calls for one process | 20:15 |
rm_work | ptoohill: ok, but it's only one more than current | 20:15 |
rm_work | is what i'm saying | 20:15 |
ptoohill | fair enough | 20:15 |
rm_work | right now neutron-lbaas does check_only (container, 2-4 pieces of data, total of 3-5 calls to barbican), then octavia does a full pull to set up the amp (same 3-5) | 20:16 |
rm_work | so really now it's 6-10 | 20:16 |
rm_work | if we add a register call in the octavia driver, it SHOULD be 7-11 | 20:17 |
rm_work | which is ... yeah, not ideal | 20:17 |
rm_work | but the other option is passing only the data, not the container-id | 20:17 |
rm_work | so octavia doesn't hit barbican at all | 20:17 |
ptoohill | what about having the needed data passed to octavia somehow? | 20:17 |
rm_work | which puts us back to having duplicate customer data in octavia | 20:17 |
rm_work | because then we have to store everything that comes in | 20:18 |
rm_work | on our own account | 20:18 |
ptoohill | do we HAVE to | 20:18 |
rm_work | yes | 20:18 |
rm_work | because we no longer have a barbican-id to work with | 20:18 |
ptoohill | true | 20:18 |
rm_work | we have just the raw cert/pk data | 20:18 |
rm_work | so it doesn't really solve the problem :/ | 20:18 |
ptoohill | yea, hrmph | 20:18 |
rm_work | but, this is the amount of calls i already cleared with them | 20:19 |
rm_work | (the barbican team) | 20:19 |
ptoohill | ok, ill pull check out of octavia and work on driver | 20:19 |
rm_work | it isn't pretty, but... yeah, the only way to fix it would be if barbican could validate | 20:19 |
rm_work | which would be great, but they don't want to do at the moment :( | 20:19 |
ptoohill | people were confused when i brought that up | 20:20 |
ptoohill | it should be something they do... | 20:20 |
openstackgerrit | Sungjin Yook proposed openstack/neutron-lbaas: Add a new lbaas agent Scheduler, LeastPoolAgentScheduler https://review.openstack.org/181609 | 20:20 |
rm_work | ptoohill: i have asked before | 20:21 |
rm_work | it seems straight forward | 20:21 |
rm_work | but there are a couple of issues | 20:21 |
ptoohill | I would have thought so | 20:21 |
rm_work | one, it adds a lot of load to their API calls if there is validation at that layer | 20:21 |
ptoohill | but they are the secret store | 20:21 |
ptoohill | how hard are they going to be hit for one | 20:22 |
rm_work | and second, it may not even be POSSIBLE, because if they use transport key encryption, their API may not even be able to see the secrets | 20:22 |
ptoohill | for two.. that should be their job | 20:22 |
ptoohill | oh :/ | 20:22 |
rm_work | yeah | 20:22 |
rm_work | :( | 20:22 |
ptoohill | well dern | 20:22 |
rm_work | so the KMIP/HSM device would need to somehow support doing validation internally | 20:22 |
rm_work | which... i don't think is the case | 20:23 |
rm_work | since from the perspective of those devices, the secrets are just blobs | 20:23 |
rm_work | IIRC | 20:23 |
ptoohill | I was questioned at the summit... 'what good is a keystore if they dont validate for you' | 20:23 |
rm_work | excepting a couple of special cases, but barbican has to be generic enough to work with any backend | 20:23 |
rm_work | what good is a keystore if it isn't secure :P | 20:23 |
ptoohill | >< | 20:23 |
rm_work | and validating the data en-route is basically saying it isn't secure | 20:23 |
ptoohill | so we make the data insucre by validating it? | 20:24 |
rm_work | because you are by definition a 3rd-party intercepting the secret data :P | 20:24 |
ptoohill | same as the backends then | 20:24 |
rm_work | barbican isn't actually the keystore | 20:24 |
ptoohill | should we never validate | 20:24 |
rm_work | the HSM is a keystore | 20:24 |
ptoohill | true, good point | 20:24 |
rm_work | barbican is just an API for the keystore :( | 20:24 |
rm_work | ptoohill: it's possible we SHOULDN'T | 20:24 |
rm_work | just fuck it | 20:25 |
rm_work | and send the thing through | 20:25 |
ptoohill | :P | 20:25 |
rm_work | if haproxy fails... that is the user's problem for specifying a bad config | 20:25 |
rm_work | if it can surface that the error is a bad ssl config -- and we can then pass that on to the user -- then perfect | 20:25 |
rm_work | if that isn't possible (it might not be) then it's a little less clear cut | 20:25 |
ptoohill | though, thats aync and they wont know unless they query some sort of logs | 20:26 |
ptoohill | or events | 20:26 |
rm_work | right | 20:26 |
rm_work | they'd have to wait while the LB is in PENDING_CREATE | 20:26 |
rm_work | and then query until it gos ACTIVE | 20:26 |
rm_work | and when it goes to ERROR | 20:26 |
ptoohill | yea | 20:26 |
rm_work | we'd need to have some detail | 20:26 |
ptoohill | :/ | 20:26 |
ptoohill | HRMMMM | 20:26 |
ptoohill | I suppose for now, the extra calls arent too bad. Nor do i think they ever will be. But think this could be better | 20:27 |
woodster_ | just noting that Barbican is starting to do some validation based on secret type. I don't think we'd be opposed to do so for the cert type actually, but probably need help to pull that off :) | 20:27 |
ptoohill | that does sound like a fun problem ;) | 20:28 |
rm_work | woodster_: how much of the backlog did you read through? :) | 20:28 |
*** openstack has joined #openstack-lbaas | 20:29 | |
ptoohill | yea, would happen 'once' (7-11 calls) per update/create of listener. | 20:30 |
woodster_ | but ideally the validation happens when the customer puts the cert in in the first place (or barbican generates it)...then no need to validate thereafter since secrets are immutable...correct? Just making sure I'm understanding 'ideal' here | 20:32 |
ptoohill | That would be the ideal situation woodster_ | 20:32 |
ptoohill | Then for our case we would just need to reg a consumer, then gather needed data in backend | 20:32 |
rm_work | woodster_: yep | 20:34 |
woodster_ | sounds cool. For transport key of a cert-typed secret, I'd expect them to do some validation, but need to feed that back to contribs | 20:34 |
rm_work | woodster_: i thought you guys couldn't intercept the data in your API because of transport-key encryption support | 20:34 |
rm_work | ah | 20:34 |
*** SumitNaiksatam has quit IRC | 20:50 | |
*** SumitNaiksatam has joined #openstack-lbaas | 20:53 | |
*** openstackgerrit has quit IRC | 20:59 | |
*** openstackgerrit has joined #openstack-lbaas | 21:00 | |
*** jorgem has joined #openstack-lbaas | 21:14 | |
*** shakamunyi has quit IRC | 21:26 | |
*** jhova has quit IRC | 21:29 | |
*** openstack has joined #openstack-lbaas | 21:31 | |
madhu_ak | dougwig, blogan : anyone around? | 21:42 |
blogan | madhu_ak: here | 21:42 |
madhu_ak | (thumbsup) | 21:42 |
openstackgerrit | Trevor Vardeman proposed stackforge/octavia: Update PUT methods to send update through queue https://review.openstack.org/170989 | 21:43 |
madhu_ak | there is a patch for flavor-framework (https://review.openstack.org/#/c/139758) and upon migrating the flavor version onto neutron master branch, when I create a flavor with right attributes, I end up getting a problem. | 21:46 |
madhu_ak | blogan ^^ | 21:46 |
madhu_ak | here is what I have tried so far: https://gist.github.com/akmadhusudhan/b712c7a7a9590fd2d75b | 21:47 |
blogan | you're rebasing it onto neutron master? | 21:47 |
madhu_ak | yep.. | 21:47 |
madhu_ak | rebasing is already done | 21:47 |
madhu_ak | and the unit tests seems passing for now...right now, I plan to write neutron api tests for flavor | 21:48 |
blogan | hmm tenant_id is obviously not being passed in | 21:48 |
madhu_ak | well, I did try specifying tenant_id in the body, it didn't help :( | 21:49 |
blogan | what kind of test is this? | 21:49 |
blogan | "unit" or tempest? | 21:49 |
blogan | i.e. doesn't require keystone | 21:49 |
madhu_ak | neutron api tests | 21:49 |
*** TrevorV|Home has quit IRC | 21:49 | |
*** bharath has joined #openstack-lbaas | 21:50 | |
blogan | so thats probably tempest | 21:50 |
blogan | tox -e api? | 21:50 |
madhu_ak | yes | 21:51 |
blogan | you have devstack running? | 21:51 |
madhu_ak | yep | 21:51 |
blogan | hmm | 21:51 |
blogan | well it should grab the tenant_id from the token | 21:51 |
blogan | obviously _verify_attributes is expecting tenant_id to be in there | 21:51 |
blogan | go up the stack and try to pinpoint where the tenant_id should be injected | 21:52 |
madhu_ak | I suspect populate_tenant_id seems broken ...I am *unsure* about this | 21:52 |
blogan | yeah this is just a troubleshooting job | 21:53 |
blogan | figuring out where it broke and why | 21:53 |
madhu_ak | aahh | 21:53 |
*** bharath has quit IRC | 21:54 | |
madhu_ak | how you meant this line -- go up the stack and pinpoint | 21:54 |
madhu_ak | somehow, I could not think of debugging it in pycharm | 21:55 |
blogan | i mean the stack trace there | 21:55 |
blogan | yeah i don't know what hte problem is so debugging woudl be what i would do | 21:55 |
blogan | you end up learning a lot more as you do it too | 21:56 |
madhu_ak | hmm, thats the right thing..by the way, if I dont need to use verify_attributes, I am able to do POST,PUT,DELETE the flavors though | 21:57 |
madhu_ak | In that case, it is not validating the tenant_id? | 21:58 |
blogan | probably | 21:59 |
blogan | though with admin its not really doing much validation | 21:59 |
madhu_ak | yeah, one has to be be an admin, when creating flavor.. | 22:00 |
madhu_ak | by the way, Isnt the correct way when an admin wants to don something (assuming he knows what needs to do) | 22:01 |
madhu_ak | like admin dont need to validate... | 22:01 |
*** ptoohill_ has joined #openstack-lbaas | 22:10 | |
blogan | you mean give admin total control? | 22:14 |
blogan | don't validate the data at all? | 22:14 |
xgerman | well, I was objecting to not validating the admin input — | 22:14 |
xgerman | so let’s not have made_ak go against the party line ;-) | 22:14 |
blogan | xgerman: you mean madhu_ak has to be part of the HP hive mind? | 22:15 |
xgerman | yep | 22:15 |
madhu_ak | :) | 22:15 |
blogan | resistance is futile | 22:16 |
*** jorgem has quit IRC | 22:29 | |
openstackgerrit | Sungjin Yook proposed openstack/neutron-lbaas: Add a new lbaas agent Scheduler, LeastPoolAgentScheduler https://review.openstack.org/181609 | 22:29 |
*** jorgem has joined #openstack-lbaas | 22:40 | |
*** jorgem has quit IRC | 22:58 | |
mixos | blogan: resistance is futile ==> my favorite line from Star Trek | 23:03 |
*** SumitNaiksatam has quit IRC | 23:04 | |
*** madhu_ak has quit IRC | 23:10 | |
*** mixos has quit IRC | 23:39 | |
*** mixos has joined #openstack-lbaas | 23:41 | |
*** mixos has left #openstack-lbaas | 23:46 | |
*** ajmiller has quit IRC | 23:54 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!