*** jerrygb_ has joined #openstack-lbaas | 00:04 | |
*** jerrygb has quit IRC | 00:05 | |
*** crc32 has quit IRC | 00:05 | |
*** bana_k has quit IRC | 00:09 | |
*** manishg has joined #openstack-lbaas | 00:11 | |
*** Kennan has joined #openstack-lbaas | 00:16 | |
*** bana_k has joined #openstack-lbaas | 00:27 | |
*** Kennan has quit IRC | 00:31 | |
*** Kennan has joined #openstack-lbaas | 00:32 | |
*** ducttape_ has quit IRC | 00:34 | |
*** manishg has quit IRC | 00:40 | |
xgerman | rm_work since I can’t trust CI I have to install and execute all the tests manually — do you run our tempest tests against it? | 00:43 |
---|---|---|
*** ajmiller has quit IRC | 00:43 | |
xgerman | do=did? | 00:43 |
*** diogogmt has quit IRC | 00:45 | |
*** manishg has joined #openstack-lbaas | 00:48 | |
*** Kennan has left #openstack-lbaas | 00:52 | |
*** openstackgerrit has quit IRC | 01:22 | |
*** openstackgerrit has joined #openstack-lbaas | 01:22 | |
*** ducttape_ has joined #openstack-lbaas | 01:33 | |
*** ktrmzn has quit IRC | 01:34 | |
*** yamamoto has joined #openstack-lbaas | 01:51 | |
*** jerrygb_ has quit IRC | 01:51 | |
*** jerrygb has joined #openstack-lbaas | 01:52 | |
*** jerrygb has quit IRC | 01:55 | |
*** prabampm has joined #openstack-lbaas | 01:58 | |
*** diogogmt has joined #openstack-lbaas | 02:04 | |
*** prabampm has quit IRC | 02:20 | |
openstackgerrit | Paul Michali proposed openstack/neutron-lbaas: Pin pylint and astroid https://review.openstack.org/251609 | 02:24 |
*** madhu_ak has quit IRC | 02:28 | |
*** prabampm has joined #openstack-lbaas | 02:34 | |
*** prabampm has quit IRC | 02:47 | |
*** prabampm has joined #openstack-lbaas | 02:49 | |
*** blogan_ has joined #openstack-lbaas | 02:54 | |
*** bana_k has quit IRC | 02:59 | |
*** bana_k has joined #openstack-lbaas | 03:13 | |
*** yuanying has quit IRC | 03:23 | |
xgerman | dougwig so we are getting the boot from Armando? | 03:42 |
xgerman | since his examples are L2 only... | 03:43 |
*** bana_k has quit IRC | 04:05 | |
*** yuanying has joined #openstack-lbaas | 04:07 | |
reedip | Hi All, I am trying to use HaproxyNSDriver for LBaaSV2 | 04:20 |
reedip | For the same I added the following in /etc/neutron/neutron_lbaas.conf | 04:21 |
reedip | ervice_provider=LOADBALANCERV2:Haproxy:neutron.services.loadbalancer.drivers.haproxy.synchronous_namespace_driver.HaproxyNSDriver:default | 04:21 |
reedip | service_provider=LOADBALANCERV2:Haproxy:neutron.services.loadbalancer.drivers.haproxy.synchronous_namespace_driver.HaproxyNSDriver:default | 04:21 |
reedip | on restarting neutron using the neutron_lbaas.conf Configuration, I am getting the following error: | 04:22 |
reedip | ImportError: No module named drivers.haproxy.synchronous_namespace_driver . Although this driver actually exists under the HAProxy drivers directory. | 04:22 |
reedip | wanted to know if there is something else I need to do, or is there something which I am doing, is wrong? | 04:23 |
*** prabampm has quit IRC | 04:30 | |
*** blogan_ has quit IRC | 04:31 | |
*** blogan_ has joined #openstack-lbaas | 04:31 | |
blogan_ | reedip: any reason why you're wanting to use that driver? | 04:32 |
reedip | blogan_ : experiment | 04:33 |
reedip | blogan_ I actually wanted to use an HAProxy driver | 04:33 |
reedip | blogan_: Using the following driver was not yeilding the results I wanted | 04:33 |
reedip | LOADBALANCERV2:Haproxy:neutron_lbaas.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default | 04:33 |
blogan_ | reedip: reason i ask is we should probably just remove that driver, it was a stop gap in kilo, and i don't think anyone is using | 04:34 |
blogan_ | reedip: what results are you looking for? | 04:34 |
blogan_ | oh and you're service providers line is using neutron. and not neutron_lbaas. | 04:34 |
blogan_ | which is the problem | 04:34 |
reedip | blogan_ : In order to verify the fix for a bug, I was looking to use the HAProxy driver, as the changes are mainly related to it | 04:34 |
reedip | blogan_ : I updated neutron_lbaas | 04:35 |
reedip | and there is no service_providers line in neutron | 04:35 |
reedip | blogan_ : I guess you are correct, let me try it the other way ( using the service provider in neutron) | 04:35 |
blogan_ | no i mean | 04:35 |
blogan_ | service_provider=LOADBALANCERV2:Haproxy:neutron.services.loadbalancer.drivers.haproxy.synchronous_namespace_driver.HaproxyNSDriver:default | 04:36 |
blogan_ | should be | 04:36 |
blogan_ | service_provider=LOADBALANCERV2:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.synchronous_namespace_driver.HaproxyNSDriver:default | 04:36 |
reedip | Oh, neutron_lbaas | 04:36 |
reedip | Got it | 04:36 |
blogan_ | and be sure that you start neutron-server with --config-file /etc/neutron/neutron_lbaas.conf too (along with the neutron.conf) | 04:36 |
reedip | Blogan : restarted using the following | 04:37 |
reedip | In /etc/neutron/neutron_lbaas : | 04:37 |
reedip | service_provider = LOADBALANCERV2:Haproxy:neutron_lbaas.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default | 04:37 |
reedip | restarted with this : | 04:38 |
reedip | /usr/local/bin/neutron-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/neutron_lbaas.conf | 04:38 |
reedip | On creating a LoadBalancer, it is currently showing the provider as Octavia | 04:38 |
reedip | Is that correct? | 04:38 |
*** ianbrown has joined #openstack-lbaas | 04:41 | |
rm_work | xgerman: hmm i had not, I need to do that, I keep forgetting we still don't have scenario tests running in the gate | 04:42 |
reedip | blogan_ : Any suggestions ? | 04:45 |
blogan_ | no thats not correct | 04:45 |
blogan_ | i mean it showing octavia as the provider is not correct | 04:45 |
blogan_ | unless you have another service_provider line there with octavia | 04:45 |
blogan_ | but it shoudl complain about there being 2 defaults if that were the case | 04:46 |
blogan_ | rm_work, xgerman: i was actually going to start getting hte scenario tests working tonight | 04:46 |
blogan_ | or at least starting that work effort | 04:46 |
blogan_ | and then hopefully we can get those voting | 04:46 |
xgerman | Awesome. Looking forward to that | 04:48 |
dougwig | xgerman: boot or not, we're ready-ish for either. but i think he's trying to make things saner, and i wouldn't expect any immediate change. | 04:48 |
dougwig | xgerman: nor will a change like that happen without input. | 04:48 |
dougwig | well, i'd hope not. :) | 04:49 |
reedip | blogan_ : http://paste.openstack.org/show/480457/ shows the current information for the configuration I am using | 04:49 |
xgerman | Me too :-) | 04:49 |
*** ducttape_ has quit IRC | 04:49 | |
reedip | blogan_ : Octavia is disabled , HAProxy enabled but still its showing the provider as octavia. Loading any other driver( a10, radware) reports error like HAProxy did ( ImportError: No module named .....) | 04:50 |
blogan_ | reedip: hmm interesting, i dont see why this would happen | 04:51 |
reedip | blogan_ : Any suggestions of resolving it? | 04:54 |
blogan_ | reedip: not off the top of my head, other than looking at logs and seeing what driver it says its loading (obviously octavia), but if possible even debugging through that to see why its loading octavia | 04:55 |
blogan_ | but i was going to do that too as soon as my stack was successful | 04:55 |
blogan_ | but of course...problems with stacking | 04:55 |
reedip | blogan_ : Ok , let me try to work on it a bit more. | 04:57 |
reedip | If there is any problem , I will get back here | 04:57 |
*** ducttape_ has joined #openstack-lbaas | 04:58 | |
blogan_ | reedip: sounds good, thanks | 04:58 |
reedip | thnx :) | 04:59 |
dougwig | reminder to rsvp on the meetup etherpad. | 05:00 |
openstackgerrit | OpenStack Proposal Bot proposed openstack/neutron-lbaas: Updated from global requirements https://review.openstack.org/250960 | 05:03 |
*** manishg has quit IRC | 05:07 | |
rm_work | blogan_: cool, godspeed | 05:11 |
*** prabampm has joined #openstack-lbaas | 05:12 | |
*** prabampm has quit IRC | 05:19 | |
*** prabampm has joined #openstack-lbaas | 05:21 | |
*** amotoki has joined #openstack-lbaas | 05:26 | |
*** numans has joined #openstack-lbaas | 05:27 | |
*** ianbrown has quit IRC | 05:32 | |
*** jerrygb has joined #openstack-lbaas | 05:35 | |
*** ducttape_ has quit IRC | 05:52 | |
*** jerrygb has quit IRC | 05:52 | |
openstackgerrit | OpenStack Proposal Bot proposed openstack/neutron-lbaas: Updated from global requirements https://review.openstack.org/250960 | 06:07 |
openstackgerrit | OpenStack Proposal Bot proposed openstack/octavia: Updated from global requirements https://review.openstack.org/250566 | 06:08 |
*** bana_k has joined #openstack-lbaas | 06:23 | |
*** prabampm1 has joined #openstack-lbaas | 06:26 | |
*** prabampm has quit IRC | 06:26 | |
*** sc68cal has quit IRC | 06:40 | |
*** sc68cal has joined #openstack-lbaas | 06:44 | |
*** ducttape_ has joined #openstack-lbaas | 06:53 | |
*** amit213 has quit IRC | 06:55 | |
*** amit213 has joined #openstack-lbaas | 06:55 | |
*** ducttape_ has quit IRC | 06:59 | |
*** ducttape_ has joined #openstack-lbaas | 07:03 | |
blogan_ | reedip: btw finaly got devstack fixed for me and used the same service_provider line you used and it works for me | 07:16 |
reedip | blogan_ : and I am still having the same issue :) | 07:19 |
blogan_ | reedip: gotta be something simple | 07:20 |
reedip | blogan_ : Still working on it.... but will be getting back to you | 07:20 |
blogan_ | but easy to overlook | 07:20 |
*** ducttape_ has quit IRC | 07:20 | |
reedip | blogan_ : Thats what I am wondering... everything which should work is there | 07:20 |
blogan_ | reedip: sure there isn't a service_provider line in neutron.conf? | 07:20 |
reedip | something external is messing with the setup | 07:20 |
reedip | blogan_ : Yes, I made sure of that. Also verified that if there is a service_provider in neutron.conf, then getting an error | 07:21 |
blogan_ | damn, i hate these kind of errors, feels like such a waste figuring them out | 07:22 |
blogan_ | unavoidable though, they always happen | 07:22 |
reedip | blogan_ : I hope I get to learn something useful at the end of the day, though | 07:23 |
reedip | I will work on it today | 07:23 |
blogan_ | lol i hope so too | 07:23 |
reedip | :) | 07:23 |
blogan_ | of course the only thing i usually learn is that i'm an idiot | 07:23 |
reedip | same here, but when someone else faces it, the idiocity helps out ...practical experience , you see :) | 07:24 |
blogan_ | you're an optimist at heart eh? we need more of that! | 07:25 |
*** kobis has joined #openstack-lbaas | 07:27 | |
reedip | :) lets see | 07:27 |
blogan_ | if you have a chance, set a breakpoint (i'm using pdb at the moment) here: https://github.com/openstack/neutron-lbaas/blob/master/neutron_lbaas/services/loadbalancer/plugin.py#L393 | 07:30 |
blogan_ | and then see what this returns: pconf.ProviderConfiguration('neutron_lbaas').providers | 07:30 |
*** prabampm1 has quit IRC | 07:31 | |
reedip | I have added logs there and checking q-svc.log | 07:32 |
reedip | blogan_ something weird which I found while restarting neutron is that when I restarted neutron with HAproxy, the output on the screen showed HAProxy | 07:33 |
reedip | I mean the logs on the screen showed HAProxy | 07:33 |
blogan_ | yeah that is weird | 07:33 |
reedip | However, VPN service providers are no working | 07:34 |
reedip | not* | 07:34 |
reedip | and probably thats the reason why it is not launching with HAProxy | 07:34 |
reedip | That's what the stderr log is saying on screen | 07:35 |
blogan_ | try running without vpn and only lbaas | 07:36 |
blogan_ | but at this point i'm just throwing shit on a wall seeing what sticks | 07:37 |
reedip | Yes, I am doing that itself ( not thworing shit, disabling vpn) | 07:37 |
reedip | :D | 07:37 |
blogan_ | lol | 07:37 |
*** eezhova has quit IRC | 07:51 | |
*** eezhova has joined #openstack-lbaas | 07:53 | |
*** bana_k has quit IRC | 07:53 | |
*** blogan_ has quit IRC | 08:04 | |
*** reedip has quit IRC | 08:05 | |
*** prabampm has joined #openstack-lbaas | 08:08 | |
*** prabampm has quit IRC | 08:13 | |
*** prabampm has joined #openstack-lbaas | 08:13 | |
*** prabampm1 has joined #openstack-lbaas | 08:16 | |
*** prabampm has quit IRC | 08:17 | |
*** ducttape_ has joined #openstack-lbaas | 08:21 | |
*** reedip has joined #openstack-lbaas | 08:22 | |
*** nmagnezi has joined #openstack-lbaas | 08:22 | |
*** ducttape_ has quit IRC | 08:25 | |
*** rcernin has joined #openstack-lbaas | 08:37 | |
*** jschwarz has joined #openstack-lbaas | 08:49 | |
*** jerrygb has joined #openstack-lbaas | 08:52 | |
*** ducttape_ has joined #openstack-lbaas | 09:21 | |
*** ducttape_ has quit IRC | 09:26 | |
*** yuanying has quit IRC | 09:30 | |
*** nmagnezi has quit IRC | 09:59 | |
*** itsuugo has quit IRC | 10:03 | |
*** itsuugo has joined #openstack-lbaas | 10:05 | |
*** nmagnezi has joined #openstack-lbaas | 10:07 | |
*** ducttape_ has joined #openstack-lbaas | 10:22 | |
*** kiran-r has joined #openstack-lbaas | 10:22 | |
*** ducttape_ has quit IRC | 10:28 | |
*** jerrygb has quit IRC | 10:31 | |
*** mdavidson has joined #openstack-lbaas | 10:48 | |
*** jerrygb has joined #openstack-lbaas | 11:16 | |
*** jerrygb has quit IRC | 11:19 | |
*** yamamoto has quit IRC | 11:20 | |
*** elarson has quit IRC | 11:26 | |
*** elarson has joined #openstack-lbaas | 11:26 | |
*** chlong has quit IRC | 11:35 | |
*** chlong has joined #openstack-lbaas | 11:35 | |
*** thehoffau has joined #openstack-lbaas | 11:58 | |
*** thehoffau has quit IRC | 12:00 | |
*** ducttape_ has joined #openstack-lbaas | 12:01 | |
*** rtheis has joined #openstack-lbaas | 12:02 | |
*** yamamoto has joined #openstack-lbaas | 12:04 | |
*** ducttape_ has quit IRC | 12:06 | |
*** jerrygb has joined #openstack-lbaas | 12:20 | |
*** kiranr has joined #openstack-lbaas | 12:20 | |
*** kiran-r has quit IRC | 12:21 | |
*** jerrygb has quit IRC | 12:27 | |
openstackgerrit | Jacky_lei_zhang proposed openstack/neutron-lbaas: LB_NFV KiloV1 :the default session limit is 2000 rather than unlimit https://review.openstack.org/251847 | 12:41 |
*** jschwarz has quit IRC | 12:45 | |
*** jschwarz has joined #openstack-lbaas | 12:58 | |
*** jerrygb has joined #openstack-lbaas | 13:01 | |
openstackgerrit | garyk proposed openstack/neutron-lbaas: Fix pep8 issues https://review.openstack.org/251855 | 13:02 |
*** ducttape_ has joined #openstack-lbaas | 13:10 | |
openstackgerrit | garyk proposed openstack/neutron-lbaas: Fix pep8 issues https://review.openstack.org/251855 | 13:12 |
*** kiranr has quit IRC | 13:19 | |
*** jschwarz has quit IRC | 13:20 | |
*** jschwarz has joined #openstack-lbaas | 13:28 | |
openstackgerrit | garyk proposed openstack/neutron-lbaas: Fix pep8 issues https://review.openstack.org/251855 | 13:29 |
*** ducttape_ has quit IRC | 13:33 | |
*** yamamoto has quit IRC | 13:40 | |
openstackgerrit | garyk proposed openstack/neutron-lbaas: Fix pep8 issues https://review.openstack.org/251855 | 13:40 |
openstackgerrit | garyk proposed openstack/neutron-lbaas: Fix pep8 issues https://review.openstack.org/251855 | 13:48 |
*** yamamoto has joined #openstack-lbaas | 13:50 | |
*** yamamoto has quit IRC | 13:57 | |
*** yamamoto has joined #openstack-lbaas | 13:57 | |
openstackgerrit | Jacky_lei_zhang proposed openstack/neutron-lbaas: LB_NFV KiloV1 :the default session limit is 2000 rather than unlimit https://review.openstack.org/251847 | 14:03 |
*** neelashah has joined #openstack-lbaas | 14:20 | |
*** ajmiller has joined #openstack-lbaas | 14:20 | |
*** ajmiller has quit IRC | 14:23 | |
*** amotoki_ has joined #openstack-lbaas | 14:24 | |
*** Piet has quit IRC | 14:36 | |
*** amotoki has quit IRC | 14:38 | |
dougwig | is our gate fixed? | 14:43 |
*** ducttape_ has joined #openstack-lbaas | 14:50 | |
*** amotoki_ is now known as amotoki | 15:01 | |
*** yamamoto_ has joined #openstack-lbaas | 15:04 | |
*** manishg has joined #openstack-lbaas | 15:05 | |
*** yamamoto has quit IRC | 15:05 | |
*** prabampm1 has quit IRC | 15:11 | |
xgerman | I did not fix it… so unless pc_m did I guess we are still toast | 15:18 |
*** ajmiller has joined #openstack-lbaas | 15:23 | |
*** TrevorV has joined #openstack-lbaas | 15:27 | |
openstackgerrit | garyk proposed openstack/neutron-lbaas: Unblock the gate. Did the following: https://review.openstack.org/251923 | 15:30 |
pc_m | xgerman: hi | 15:33 |
xgerman | hi | 15:33 |
pc_m | I think I have a fix for VPN on master. Trying same fix for LB, using a commit I tried before that didn't work. | 15:33 |
pc_m | Testing locally. | 15:34 |
xgerman | wondering if FWaaS is also affected. I am afraid it is | 15:34 |
pc_m | VPN change is pushed and will see if it works. | 15:34 |
xgerman | ok | 15:34 |
pc_m | FWaaS is ok. they actually do NOT run pylint as part of pep8, so are not affected (but are not testing!) | 15:35 |
pc_m | armax: ^^ | 15:36 |
pc_m | My LB fix works locally. | 15:36 |
pc_m | Testing py27 for grins, and will push up change as soon as that is done. | 15:36 |
xgerman | yeah, I have seen a lot of test skipping in this world... | 15:37 |
pc_m | xgerman: I'm not test skipping | 15:37 |
pc_m | Found a really simple solution. | 15:37 |
xgerman | no, I know. It’s just one of my general gripes with OpenStack that we have to skip tests to fir into the tiny window infra give sis in the gate... | 15:38 |
xgerman | (it’s my favorite yak BTW) | 15:38 |
pc_m | I hear ya | 15:39 |
openstackgerrit | Doug Wiegley proposed openstack/neutron-lbaas: Remove pylint from pep8 https://review.openstack.org/251928 | 15:39 |
*** diogogmt has quit IRC | 15:39 | |
pc_m | dougwig: I have a good solution. | 15:39 |
pc_m | Will push in a min. Please consider it, as it is better than removing pyllint. | 15:40 |
dougwig | pc_m: is it in queue *right now* ? if not, let's fix the gate, then fix the issue. if it is, ignore mine. | 15:40 |
dougwig | pc_m: nothing precludes re-adding pylint later. | 15:40 |
openstackgerrit | garyk proposed openstack/neutron-lbaas: Unblock the gate https://review.openstack.org/251923 | 15:40 |
pc_m | I'm going to push in a min. it will fix gate. | 15:40 |
pc_m | LB sets pylint dependency in tox.ini. I added astroid and pinned them there. | 15:40 |
*** diogogmt has joined #openstack-lbaas | 15:41 | |
dougwig | honestly, pylint was about *this close* to being disabled before this anyway. :) | 15:45 |
pc_m | dougwig: I have my fix ready? Should I push? I see you've disabled pylint | 15:47 |
dougwig | pc_m: push it, though it may fail the requirements job. | 15:47 |
openstackgerrit | Paul Michali proposed openstack/neutron-lbaas: Fix pylint/astroid breakage https://review.openstack.org/251609 | 15:47 |
pc_m | dougwig: no it won't | 15:47 |
pc_m | dougwig: I think :) | 15:47 |
pc_m | dougwig: xgerman: ^^ | 15:48 |
dougwig | i'd still rather approve them both and deal with whichever merges afterwards. | 15:48 |
pc_m | dougwig: sure | 15:49 |
pc_m | VPN one passed pep8 on gate. | 15:50 |
pc_m | Need approvals... hint hint :) | 15:50 |
ajmiller | pc_m on it | 15:50 |
pc_m | ajmiller: thanks! | 15:51 |
ajmiller | pc_m: could you give a quick summary of which patches you've submitted | 15:52 |
ajmiller | Just the links | 15:52 |
*** TrevorV has quit IRC | 15:53 | |
johnsom | I can look at things too this morning | 15:53 |
pc_m | My LB commit just ran pep8 and passed. | 15:54 |
ajmiller | cool | 15:54 |
pc_m | VPN: https://review.openstack.org/#/c/251556/ | 15:54 |
pc_m | LB: https://review.openstack.org/#/c/251609/ | 15:54 |
dougwig | ajmiller, johnsom - an alternative - https://review.openstack.org/251928 | 15:54 |
pc_m | VPN kilo: https://review.openstack.org/#/c/251874/ | 15:54 |
*** TrevorV has joined #openstack-lbaas | 15:54 | |
*** diogogmt has quit IRC | 15:55 | |
pc_m | Neutron Kilo: https://review.openstack.org/#/c/251827/ | 15:55 |
johnsom | dougwig +2 | 15:55 |
pc_m | We need LB kilo pinning, similar to what VPN did. | 15:56 |
johnsom | dougwig Won't the local pinning get blocked from merge due to global requirements? | 16:00 |
pc_m | Actually, I guess if we use 251609, we could cherry pick that for Kilo | 16:00 |
dougwig | i was expecting some complications there. | 16:00 |
dougwig | pc_m: looks like kilo's tox is too different. | 16:00 |
pc_m | (or any of the other solutions, like removing pylint) | 16:00 |
pc_m | dougwig: ah. no pylint that can be pinned in tox.ini? | 16:01 |
pc_m | dougwig: For VPN, do you think I should cherry pick 251556 versus use the traditional pinning that 251874 is doing (and requires the infra change)? | 16:02 |
dougwig | liberty - https://review.openstack.org/#/c/251935/ | 16:02 |
dougwig | kilo - https://review.openstack.org/#/c/251939/ | 16:02 |
dougwig | no pylint in juno. | 16:04 |
*** jschwarz_ has joined #openstack-lbaas | 16:04 | |
dougwig | pc_m: sec, in a meeting | 16:04 |
*** rcernin has quit IRC | 16:04 | |
*** jschwarz has quit IRC | 16:06 | |
*** nmagnezi has quit IRC | 16:15 | |
*** numans has quit IRC | 16:15 | |
rm_work | armax / dougwig: it looks like people didn't catch the spec for the TLS RFE? | 16:22 |
dougwig | rm_work: i missed it. link? | 16:22 |
rm_work | I commented in the RFE -- it was linked at the top but not in the summary, I added it there | 16:23 |
rm_work | looking | 16:23 |
rm_work | https://review.openstack.org/#/c/237807/ | 16:23 |
rm_work | I was sad the discussion happened without anyone reading that :P | 16:24 |
dougwig | rm_work: indeed. ok, let me shower, then let's talk. | 16:25 |
rm_work | k | 16:25 |
rm_work | there was a bit of discussion around this at the summit too | 16:26 |
rm_work | but you may have been elsewhere | 16:26 |
rm_work | it was mostly RAX/HP/BB involved in that | 16:26 |
dougwig | indeed. | 16:26 |
*** fnaval has joined #openstack-lbaas | 16:26 | |
*** yamamoto_ has quit IRC | 16:28 | |
xgerman | well, I was hoping it died… but | 16:37 |
xgerman | yeah, let me know where I can out my -1s | 16:37 |
*** diogogmt has joined #openstack-lbaas | 16:41 | |
openstackgerrit | Kyle Mestery proposed openstack/neutron-lbaas: Remove version from setup.cfg https://review.openstack.org/251962 | 16:46 |
*** woodster_ has joined #openstack-lbaas | 16:51 | |
*** amotoki has quit IRC | 16:55 | |
openstackgerrit | James Arendt proposed openstack/neutron-lbaas: Add flavor option to loadbalancerv2 creation https://review.openstack.org/223232 | 16:58 |
*** jschwarz__ has joined #openstack-lbaas | 17:06 | |
*** jschwarz_ has quit IRC | 17:10 | |
*** kobis has quit IRC | 17:18 | |
*** doug-fish has joined #openstack-lbaas | 17:25 | |
blogan | xgerman: btw the scenario jobs are running actual real drivers now, so if you see a review get pushed up and the scenario jobs fail -1 it for that since its non voting at this point | 17:29 |
blogan | i dont want to make it voting until it has a good track record though, so reviewers just need to be mindful of that job now | 17:29 |
xgerman | awesome | 17:31 |
xgerman | I really hated it that I needed to install every patch and test on my devstack or get ridiculed by johnsom | 17:31 |
dougwig | rm_work: ping? | 17:31 |
dougwig | reading that spec, isn't this a failure of the global lbaas creds to barbican? it's become a trusted source since it has global access, and that seems the security fail, not passwords that we'd then have to store in a db (double security fail.) | 17:32 |
xgerman | yeah, we can add a way to compare tenants-ids, e.g. if we create an LB on behalf of Bob we check that the TLS cert belongs to Bob, etc. | 17:33 |
xgerman | or better yet barbican client can | 17:33 |
*** manishg has quit IRC | 17:36 | |
*** manishg has joined #openstack-lbaas | 17:37 | |
*** bana_k has joined #openstack-lbaas | 17:47 | |
dougwig | xgerman: i'd rather see lbaas not have global creds to barbican. | 17:59 |
xgerman | we don’t. The user just sets up a trust with us… but if Bob sets up a trust and Alice we can see both their certs and hence the security implication. However, Charles who doesn’t trust us — we can’t access his stuff | 18:00 |
xgerman | and that trust is for TLS only. So if Bob has other secrets they are off limits for us | 18:01 |
xgerman | I think having god access is what all the services do with each other… hence service account. Not sure if we can recycle the user’s auth token somehow | 18:02 |
*** jschwarz__ is now known as jschwarz | 18:05 | |
*** madhu_ak has joined #openstack-lbaas | 18:07 | |
dougwig | xgerman: hmm, i was under the impression that trust was tied to the user. i do not like that it grants that users stuff to all of lbaas. our code has not been security vetted enough for that kind of exposure. | 18:08 |
xgerman | yeah, trust is tied to the LBaaS user BUT everybody using TLS needs to trust us. That’s how we get cross fire. Simple solution is to check if the tenant-id of the person creating LB matches the tenant-id of the one owning the TLS secret | 18:09 |
xgerman | also there is probably no good way around since a) we want to support fail overs without any user intervention b) we ideally don’t want to store secrets in our DB | 18:11 |
xgerman | I ran rm_work’s proposal by my security people and they said that checking tenant_ids was ok (preliminary) | 18:12 |
dougwig | well, you can limit it by doing things like storing the widget used for the third party encrypted with the user's password as the key, so it's only usable when they're making a change, e.g. ahh, but the failover case. hmm. | 18:13 |
*** neelashah has quit IRC | 18:13 | |
openstackgerrit | Merged openstack/neutron-lbaas: Remove pylint from pep8 https://review.openstack.org/251928 | 18:14 |
*** nmagnezi has joined #openstack-lbaas | 18:15 | |
xgerman | I belive checking tenant -id is sufficient for most sue cases. I am not opposed to optionally store the passpohrase (so I can switch that of) but if we go down that route I like to see that code be outside LBaaS so it can be shared with VPN and other services requiring TLS certificates | 18:17 |
dougwig | shouldn't the passphrase be stored by barbican? or stored there, and certs retrieved get the passphrase auto-stripped on the fly? storing passwords in a non-security database seems like a bad solution. | 18:20 |
xgerman | yep | 18:21 |
xgerman | I would not do it but RAX has some useless where it makes sense when I understood rm_work correctly | 18:22 |
xgerman | and if Barbican stores both it doesn’t matter to us and for us (or somebody else) enforcing that the tenat_ids match is good. That kills the sue case case that Bob store a cert for Alice to use. But I think it’s rare that somebody won’t use the same tenant and an acceptable limitation | 18:23 |
*** fnaval has quit IRC | 18:24 | |
xgerman | so to sum it up my vote is: | 18:24 |
xgerman | 1) Start enfocring that the tenant creating LB also owns TLS cert | 18:25 |
xgerman | 2) Ideally do that outside LBaas so it can be reused in other projects | 18:25 |
dougwig | my fundamental beef is that none of these proposals address the underlying security hole. which is either in how we're using barbican, or a fundamental flaw in their API itself. add "if tenant_id == foo:" in interpreted code still leaves a mountain of exploit available. | 18:27 |
*** neelashah has joined #openstack-lbaas | 18:28 | |
xgerman | yeah, that is sadly the best we can do | 18:29 |
xgerman | and believe me I am not a fan of them shooting everything which might help us down | 18:29 |
*** rcernin has joined #openstack-lbaas | 18:38 | |
*** jschwarz has quit IRC | 18:39 | |
*** neelashah1 has joined #openstack-lbaas | 18:43 | |
*** neelashah has quit IRC | 18:45 | |
*** neelashah has joined #openstack-lbaas | 19:05 | |
*** neelashah1 has quit IRC | 19:06 | |
xgerman | dougwig who can approve stuff on octavia stable/liberty? | 19:12 |
*** neelashah1 has joined #openstack-lbaas | 19:16 | |
*** armax has quit IRC | 19:16 | |
*** neelashah has quit IRC | 19:18 | |
*** barclaac has joined #openstack-lbaas | 19:19 | |
*** nmagnezi has quit IRC | 19:23 | |
openstackgerrit | Paul Michali proposed openstack/neutron-lbaas: Remove dependency on neutron for topics https://review.openstack.org/252028 | 19:29 |
*** neelashah has joined #openstack-lbaas | 19:37 | |
*** neelashah1 has quit IRC | 19:39 | |
*** nmagnezi has joined #openstack-lbaas | 19:49 | |
*** armax has joined #openstack-lbaas | 19:51 | |
rm_work | xgerman / dougwig: neither of those are the actual issue T_T and i believe this is a problem for your deployment too, but you might just not care as much as I do (not sure even people here care as much as I do) | 19:54 |
rm_work | dougwig: I can talk through it on hangouts or something later today, I have a meeting presently | 19:55 |
xgerman | ok, I always like to learn how I am wrong | 19:55 |
xgerman | ;-) | 19:55 |
rm_work | I thought I had been through the issues with xgerman and that you understood at the summit | 19:55 |
rm_work | but maybe not | 19:55 |
rm_work | the real concern is internal actors (support/etc) | 19:55 |
rm_work | for me | 19:56 |
rm_work | the other problem can be taken care of with tenant-id checks | 19:56 |
xgerman | so it’s not that Alice can access Bob secret unless we do the tenant_id=foo | 19:56 |
rm_work | which i updated the spec for | 19:56 |
rm_work | yeah that isn't the issue | 19:56 |
xgerman | oh, I missed that with the internal actors | 19:56 |
*** neelashah has quit IRC | 19:56 | |
rm_work | the issue is that an internal actor who has a keystone admin account can get the ACTUAL token for a user | 19:56 |
rm_work | so there's literally no way to distinguish who is asking for the info | 19:56 |
rm_work | so if Barbican has everything necessary to decrypt the PK... | 19:57 |
rm_work | hosed. | 19:57 |
xgerman | well, good that the CIA buys their cloud from Amazon I guess ;-) | 19:57 |
rm_work | LBaaS can store half of the necessary data to decrypt, and since LBaaS wouldn't ever EXPOSE that data (even to the original user) then it is secure | 19:57 |
rm_work | I would bet me next month's paychecks both of our orgs have hostile government actors *working* internally on support/etc teams | 19:57 |
rm_work | just saying | 19:57 |
rm_work | I don't *think* that makes me paranoid, just a realist | 19:57 |
xgerman | well, but that a keystone admin can see everything is a general problem and should be resolved by barbican (e.g. access logs at the least) | 19:58 |
rm_work | err | 19:58 |
rm_work | well, access logs are great | 19:58 |
rm_work | for tracking down why someone lost millions of dollars | 19:58 |
rm_work | a week later | 19:58 |
rm_work | >_> | 19:58 |
xgerman | yeah, but we don’t have a public cloud | 19:58 |
rm_work | I would prefer to actually stop the problem | 19:58 |
rm_work | loooool alright xgerman | 19:58 |
rm_work | that is a valid point for you i guess :P | 19:58 |
rm_work | not so much for the rest of us T_T | 19:58 |
xgerman | yep, but I think if the person has keystone can;t they access the vm and steal the token right there? | 19:59 |
rm_work | no | 19:59 |
rm_work | well | 19:59 |
rm_work | yes? | 19:59 |
rm_work | i made a note about how it requires some specific deployment stuff internally as well to be effective | 19:59 |
rm_work | for instance, there's an assumption that the controlplane is on machines inaccessible with keystone credentials | 19:59 |
rm_work | IE baremetal or somesuch | 20:00 |
rm_work | in our deployment only like 6 people would be able to access those machines, and it'd be with SSH key auth | 20:00 |
xgerman | yeah, we at HP usually wave our hand and say appropriate structures exist to separate access... | 20:00 |
rm_work | T_T | 20:00 |
rm_work | wait did we just opt to REMOVE pylint checks? https://review.openstack.org/#/c/251928/ | 20:03 |
rm_work | instead of something like what I was working on with https://review.openstack.org/#/c/251546/ | 20:04 |
rm_work | surprising | 20:04 |
rm_work | seems pretty nuclear T_T | 20:04 |
*** neelashah has joined #openstack-lbaas | 20:06 | |
rm_work | I mean it isn't my repo, so >_> | 20:06 |
rm_work | but if it were octavia I would have -2'd that I think unless someone had a REALLY strong argument | 20:06 |
dougwig | rm_work: wait, so you're upset that root access is... root? | 20:13 |
dougwig | rm_work: feel free to put it back, but in gate breakage world: 1) fix the break, 2) fix it right. | 20:14 |
*** madhu_ak has quit IRC | 20:14 | |
johnsom | rm_work I agreed with dougwig as it was going on day two, we were finding more layers to the problem (astroid), and other projects were reporting dead ends trying to straighten out the import ordering. | 20:21 |
johnsom | So, yeah, disable it, fix it offline and bring it back in seemed like the right answer. | 20:21 |
*** madhu_ak has joined #openstack-lbaas | 20:22 | |
dougwig | rm_work: do you have any custom code running for lbaas? because if rax is the only ones with an issue here, you could put the passphrase in a custom table and call it a day. | 20:29 |
*** neelashah has quit IRC | 20:32 | |
*** nmagnezi has quit IRC | 20:41 | |
*** neelashah has joined #openstack-lbaas | 20:44 | |
*** crc32 has joined #openstack-lbaas | 20:46 | |
openstackgerrit | Adam Harwell proposed openstack/neutron-lbaas: Gatefix: ignore most new pylint rules, fix some imports https://review.openstack.org/251546 | 20:49 |
rm_work | johnsom / dougwig yeah that seems fair | 20:52 |
rm_work | dougwig: to some extent, yes, i am trying to protect against "root", if you define root as "half of your organization has root and shouldn't really" | 20:53 |
blogan | rm_work: i think we determined ignoring thsoe rules isn't the real fix, its pinning astroid | 20:53 |
rm_work | blogan: well, the new rules are valid, we just can't fix the issues where they exist because they aren't our code, they're vendor code | 20:53 |
blogan | whenever requirements gets it in | 20:53 |
rm_work | blogan: i FIXED the issues where I actually could | 20:53 |
rm_work | the long term solution can't be "pin the version to an old version that doesn't have the new checks" >_> | 20:54 |
rm_work | do we expect to be on an old version forever? or do we intend to get the pylint people to REMOVE the checks they added? | 20:54 |
rm_work | I mean... >_> i dunno what we are expecting here as a path forward | 20:54 |
blogan | no but we don't want to always pull in the new pylint checks, so pinning pylint and astroid for a release is the better way to go, then moving to the next version and evaluating then is probably better | 20:54 |
rm_work | maybe? although in this case, calling out the places where there are issues with the pylint comments in-line seems to be a better call IMO | 20:55 |
blogan | gotta worry about older stable releases | 20:55 |
rm_work | yeah for old/stable pin away | 20:55 |
rm_work | for master we should not do that | 20:55 |
blogan | i think we should, more work for nothing, just do it once per release | 20:55 |
blogan | start a new cycle, pin to a new version of pylint | 20:56 |
rm_work | the natural progression of that is "let's just pin all our reqs at day 1 of each cycle" | 20:56 |
rm_work | because when you start pinning high level reqs you are going to run into deps issues | 20:56 |
rm_work | as other things start REQUIRING them | 20:57 |
blogan | except pylint changes cause gate breakages frequently enough to warrant it this way | 20:57 |
rm_work | maybe i'm overreacting, i just think it's a bad idea when we have a clear way forward that doesn't just block new code | 20:57 |
*** Piet_ has joined #openstack-lbaas | 21:04 | |
dougwig | pylint is the devil anyway. i was an early fan, but it's caused way more churn than bug finding, compared to hacking. | 21:06 |
rm_work | hmm | 21:06 |
rm_work | i mean i don't think the things it's complaining about are invalid | 21:06 |
rm_work | which is why i was more a fan of calling out the places and hoping the authors will fix them | 21:06 |
blogan | if we enabled all the rules i would say a lot of those are invalid | 21:06 |
rm_work | just because i don't feel comfortable futzing with vendor code | 21:06 |
rm_work | some are, and we ignore some | 21:06 |
rm_work | but i don't mind a lot of the new ones | 21:06 |
*** neelashah has quit IRC | 21:18 | |
rm_work | this is so weird that it's failing in the checks though | 21:18 |
rm_work | passing locally and all the versions of everything i see are exactly the same | 21:18 |
*** harlowja has quit IRC | 21:27 | |
*** harlowja has joined #openstack-lbaas | 21:28 | |
*** crc32 has quit IRC | 21:28 | |
*** rcernin has quit IRC | 21:31 | |
*** jerrygb has quit IRC | 21:32 | |
*** manishg has quit IRC | 21:40 | |
*** crc32 has joined #openstack-lbaas | 21:42 | |
*** neelashah has joined #openstack-lbaas | 21:52 | |
*** rtheis has quit IRC | 21:56 | |
openstackgerrit | Doug Wiegley proposed openstack/neutron-lbaas: Switch to internal _i18n pattern, as per oslo_i18n guidelines https://review.openstack.org/250118 | 22:02 |
dougwig | rm_work: if it's in our repo, we own it, and we must futz with it. or being a decomp. | 22:06 |
dougwig | /being/begin/ | 22:06 |
dougwig | IMO | 22:06 |
rm_work | hmm k | 22:06 |
rm_work | but we have zero visibility into how their systems work | 22:06 |
rm_work | so when we mess with code doing REST requests/responses to their hardware ... ??? how do we even do that | 22:06 |
rm_work | I did change the one spot where it was an obviously non-impacting change | 22:07 |
*** TrevorV has quit IRC | 22:07 | |
dougwig | if they don't have adequate tests in place to cover that, it's on them. we have to maintain our codebase. | 22:07 |
rm_work | alright, noted | 22:07 |
rm_work | good to hear from a vendor at least :P | 22:08 |
doug-fish | anyone avail to give a +A to https://review.openstack.org/#/c/244318/ ? | 22:11 |
dougwig | doug-fish: looking | 22:14 |
xgerman | how do we test that? | 22:14 |
doug-fish | xgerman: yeah that's a fair question! let me see if we have that documented | 22:14 |
*** dnovosel has quit IRC | 22:15 | |
doug-fish | so far, the only instructions I know of are in the commit message for https://review.openstack.org/#/c/241764/ | 22:16 |
xgerman | I also alerted our Horizon people who will look tomorrow | 22:16 |
doug-fish | and frankly I think those are incomplete | 22:16 |
xgerman | yeah, we got bitten by the eBay panel. I tried to run it, parachuted some HP Horizon people in, just to learn that you could not create a load balancer :-) | 22:17 |
doug-fish | xgerman: fair warning: you can't create a load balancer with this UI yet either | 22:18 |
xgerman | ok | 22:18 |
doug-fish | but you can list them and see a few details | 22:18 |
xgerman | well, I guess I have my work cut out for the rest of the day... | 22:19 |
*** harlowja has quit IRC | 22:19 | |
*** dnovosel has joined #openstack-lbaas | 22:19 | |
dougwig | any chance we can add a lbaas-dashboard to our devstack plugin? | 22:20 |
doug-fish | dougwig: that would be cool - I don't know much about devstack plugins | 22:21 |
rm_work | shouldn't be difficult? | 22:21 |
doug-fish | I think the manual setup instructions here would work https://github.com/openstack/neutron-lbaas-dashboard/blob/master/README.rst | 22:21 |
*** harlowja has joined #openstack-lbaas | 22:21 | |
doug-fish | but that's not quite the way I do it | 22:21 |
rm_work | if we pull in horizon and that project | 22:21 |
doug-fish | so I'm going to try them now | 22:21 |
rm_work | I would assume it'd just "work" | 22:22 |
doug-fish | almost | 22:22 |
*** diogogmt has quit IRC | 22:22 | |
doug-fish | pull in horizon, then the plugin, then do the readme (which again should work, but I want to try it) | 22:22 |
dougwig | ajmiller: you around? any chance you can work your devstack magic? | 22:22 |
*** barclaac has quit IRC | 22:22 | |
rm_work | yeah that's just part of the setup script | 22:22 |
ajmiller | dougwig: Yeah, whats up? | 22:22 |
rm_work | easy enough | 22:23 |
xgerman | that would be real cool indeed | 22:23 |
dougwig | ajmiller: neutron-lbaas-dashboard repo could use a devstack plugin, i'm thinking? | 22:23 |
rm_work | I would assume they should | 22:23 |
xgerman | well, can’t we just clone them with our plugin | 22:23 |
xgerman | ? | 22:23 |
rm_work | yes | 22:23 |
rm_work | but long-term it'd be good to "enable_plugin lbaas-dashboard" or whatever | 22:23 |
xgerman | when I read it right we just need to check out the repo and copy one file | 22:23 |
*** barclaac has joined #openstack-lbaas | 22:23 | |
rm_work | projects really should take care of their own installation | 22:24 |
rm_work | that's the point of the devstack plugins | 22:24 |
xgerman | well, I think we install Octavia so we could as well install our horizon panel | 22:25 |
rm_work | sure, but i would assume we install octavia via it's devstack plugin? or do we do it manually | 22:25 |
xgerman | plugin | 22:25 |
rm_work | yeah | 22:25 |
*** diogogmt has joined #openstack-lbaas | 22:25 | |
ajmiller | Well it looks like a devstack plugin would be pretty straight-forward... | 22:28 |
rm_work | I would assume so yeah | 22:28 |
xgerman | well, if you have cycles that would really help us to have that done ;-) | 22:28 |
* rm_work sits here and says agreeable things and waits for someone else to implement it :P | 22:28 | |
*** jerrygb has joined #openstack-lbaas | 22:32 | |
* ajmiller has been pondering the balance of other commitments, but I can do it. | 22:35 | |
*** jerrygb has quit IRC | 22:37 | |
openstackgerrit | Michael Johnson proposed openstack/octavia: Amphora Flows and Drivers for Active Standby https://review.openstack.org/206252 | 22:41 |
xgerman | dougwig, blogan. doug-fish: https://bugs.launchpad.net/neutron/+bug/1521783 | 22:46 |
openstack | Launchpad bug 1521783 in neutron "RfE: Cascading delete for LBaaS Objects" [Undecided,New] - Assigned to Bharath (bharathm) | 22:46 |
doug-fish | xgerman: nice! | 22:46 |
dougwig | xgerman: confirmed and commented. | 22:52 |
xgerman | thanks | 22:53 |
rm_work | neat | 22:54 |
*** harlowja has quit IRC | 22:57 | |
*** harlowja has joined #openstack-lbaas | 23:01 | |
*** TrevorV|Home has joined #openstack-lbaas | 23:05 | |
*** neelashah has quit IRC | 23:08 | |
*** fnaval has joined #openstack-lbaas | 23:23 | |
*** fnaval has quit IRC | 23:24 | |
*** fnaval has joined #openstack-lbaas | 23:25 | |
doug-fish | I see in bug 1321783 dougwig has mentioned an API to make a lb tree in one API call -- is that API arriving any time soon? | 23:33 |
openstack | bug 1321783 in gallery-app " QT_LOAD_TESTABILITY checking should be added to gallery-app to load qttestability driver" [Low,Fix released] https://launchpad.net/bugs/1321783 - Assigned to Arthur Mello (artmello) | 23:33 |
doug-fish | uh | 23:33 |
doug-fish | no | 23:33 |
doug-fish | how about bug 1521783 | 23:33 |
openstack | bug 1521783 in neutron "RfE: Cascading delete for LBaaS Objects" [Undecided,Confirmed] https://launchpad.net/bugs/1521783 - Assigned to Bharath (bharathm) | 23:33 |
dougwig | blogan was working on that. blogan? | 23:34 |
blogan | dougwig: i dont believe so | 23:34 |
dougwig | blogan: heh, are you hiding from the lb tree api now? | 23:34 |
blogan | dougwig: ha no but thats a create | 23:34 |
dougwig | blogan: that's what he's asking about. | 23:35 |
blogan | dougwig: no thats delete | 23:35 |
doug-fish | blogan: dougwig mentioned the create API in the delete bug | 23:35 |
xgerman | I am talking delete :-) | 23:35 |
doug-fish | I hadn't heard about this create API before | 23:35 |
dougwig | blogan: he's asking about create, since i mentioned that delete should parallel. | 23:35 |
blogan | ohh, sorry i just read a few lines above this | 23:35 |
blogan | then yes i am giogn to work on it :) | 23:36 |
dougwig | i might be easily amusable today, but (SFW): http://i.imgur.com/YAaM3PM.jpg | 23:36 |
blogan | someone was working on it but I believe it has been stale | 23:36 |
blogan | so i volunteered to pick it up once i got a chance | 23:36 |
blogan | thats a bit much | 23:37 |
xgerman | well, I have somebody for delete | 23:37 |
blogan | i mean thtat plane is a bit much | 23:38 |
openstackgerrit | Merged openstack/neutron-lbaas: Support for Name field in Members and HMs https://review.openstack.org/245664 | 23:39 |
*** madhu_ak_ has joined #openstack-lbaas | 23:39 | |
*** TrevorV|Home has quit IRC | 23:40 | |
*** madhu_ak has quit IRC | 23:43 | |
*** TrevorV|Home has joined #openstack-lbaas | 23:43 | |
*** jorgem is now known as jorgem[away] | 23:53 | |
*** crc32 has quit IRC | 23:56 | |
*** diogogmt has quit IRC | 23:57 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!