Thursday, 2016-09-29

*** ducttape_ has joined #openstack-lbaas00:07
*** fnaval has joined #openstack-lbaas00:08
*** ducttape_ has quit IRC00:46
*** bana_k has quit IRC01:12
*** ducnc has joined #openstack-lbaas01:21
*** reedip has quit IRC01:27
*** reedip has joined #openstack-lbaas01:28
*** ducnc has quit IRC01:35
*** armax has joined #openstack-lbaas01:46
*** ducttape_ has joined #openstack-lbaas01:46
*** woodster_ has joined #openstack-lbaas01:51
*** ducttape_ has quit IRC01:52
openstackgerritzhangyanxian proposed openstack/octavia: Fix typo in active-active-distributor.rst  https://review.openstack.org/37907702:12
openstackgerritzhangyanxian proposed openstack/octavia: Fix typo in active-active-distributor.rst  https://review.openstack.org/37907702:14
*** ducttape_ has joined #openstack-lbaas02:16
*** armax has quit IRC02:31
*** ducttape_ has quit IRC02:42
stickeris there a trick to allowing neutron access to certificates for HTTPS offload?  I can't seem to find it02:49
*** yuanying_ has quit IRC02:50
*** yamamoto_ has joined #openstack-lbaas02:59
*** bdeschenes has quit IRC03:05
*** yuanying has joined #openstack-lbaas03:05
*** armax has joined #openstack-lbaas03:22
*** saju_m has joined #openstack-lbaas03:24
sbalukoffsticker: Yes there is. http://docs.openstack.org/developer/octavia/guides/basic-cookbook.html#deploy-a-tls-terminated-https-load-balancer03:31
rm_work"Grant the admin user access to all the secret and secret container barbican resources above." is a little vague :(03:32
rm_workI think I missed reviewing that03:33
rm_workdue to all the ... weirdness the past bit03:33
stickerhaha sorry and thanks.  i don't know how i haven't seen that doc.. i'll take a look! *shamefully runs away*03:33
rm_workIi'll look at submitting a patch for that03:33
rm_workI think it's new03:33
*** links has joined #openstack-lbaas03:33
*** yuanying has quit IRC03:33
sbalukoffIt's a very new doc.03:33
rm_worksticker: for step three, that means setting Barbican ACLs03:33
rm_workhttp://docs.openstack.org/developer/barbican/api/quickstart/acls.html#how-to-set-replace-acl03:34
sbalukoffYeah, that's what's shown in the commands that follow immediately.03:34
rm_workah03:34
rm_workok so it's just vague in the instructions, should have kept going03:34
*** yuanying has joined #openstack-lbaas03:34
*** armax has quit IRC03:34
rm_workthe example makes it clear03:34
sticker"The admin user on this cloud installation has keystone ID admin_id" <- is that referring to the service account for Octavia, Neutron, or something else?03:36
rm_worksoooo03:37
stickeri see all requests coming from neutron in barbican03:37
rm_workIt needs to be both03:37
rm_workSO they either need to share a service user03:37
stickerahh okay03:37
rm_workor you need to do both ACLs03:37
rm_workthe idea is that they'd share a service user, because we're merging them into one service in Ocata anyway03:37
sbalukoffYep.03:38
sbalukoffAnd right now it's the 'admin' user, though we intend to use an actual service user in Ocata.03:38
rm_workwell, for devstack03:38
sbalukoffI'm also hoping we can get a better user story around the barbican secret ACLs, because right now that whole part of the process is pretty confusing.03:38
rm_workin your deployment, it is whatever you've set as the service user03:38
rm_workyeah, the ACLs thing is a little unfortunate03:38
stickerokay no probs.  I have separate users for octavia and neutron at the moment, but i can merge it together to one user03:39
rm_worklike, if there were a "recursive" ACL feature sbalukoff?03:39
rm_workis that what you were thinking?03:39
sbalukoffsticker: Also, there's an open bug about intermediate certificates. If they're in PKCS7 PEM format right now, Octavia won't pick them up properly.03:39
stickerahh okay, thanks03:40
sbalukoffSo for now, just use a concatenated list of PEM-encoded certificates. (That should always work.)03:40
rm_workyeah they are supposed to be a concatenated list of standard PEMs03:40
rm_workoh so that's why you were poking at PKCS703:40
sbalukoffrm_work: Honestly, I think it would be better if service users could just access certain types of barbican secrets at a global cloud-configuration level.03:41
sbalukoffSo we can eliminate the whole "grant permissions with an ACL" story for users.03:41
rm_workah, you want the god account03:41
rm_workwhich is actually what i was specifically trying to avoid :/03:42
sbalukoff*shrug*03:42
sbalukoffIn order to do this stuff, you need to grant that kind of access anyway.03:42
rm_workthat makes me .... uncomfortable.03:43
rm_workbut03:43
sbalukoffrm_work: The whole PKCS7 thing is because barbican specifies intermediates should be in PKCS7 format. :P03:43
rm_workyou know I am crazy security paranoid03:43
rm_worklol03:43
rm_workgreat03:43
sbalukoffrm_work: It does to me too. But having had a look at other barbican code, there are a *lot* of things that make me uncomfortable in that project. :P03:43
rm_worklol03:43
rm_workyou aren't ... wrong03:43
sbalukoffIn any case, I've finally pieced together code that can convert PKCS7 (DER or PEM) into a sequence of PEM-encoded certificates using just the python modules that are already in the global requirements.03:44
sbalukoffI just need to finish updating the Octavia code, write some tests for it, and then I think octavia will have no problem with PKCS7 certificate bundles.03:44
rm_workkk03:45
rm_workit's interesting that cryptography is completely lacking support for that03:45
rm_workbut i guess it wasn't actually supposed to necessarily handle the higher level stuff03:45
sbalukoffI guess I should probably mark that bug as being worked on by me so people know I'm working on it and don't duplicate efforts.03:45
sbalukoffWell... it turns out you can get the job done with just the base64 and pyasn1 and pyasn1-modules modules.03:46
sbalukoffUgly, but it works.03:46
*** diltram has quit IRC03:46
*** pcaruana has quit IRC03:47
sbalukoffI've tested it on bundles I made myself with the openssl CLI, as well as random p7b bundles I've downloaded from various sites on the internet. It looks like it works.03:47
*** Dave___ has joined #openstack-lbaas03:48
rm_workyeah03:48
rm_workwe were using those at first03:49
*** yuanying has quit IRC03:49
sbalukoffOh?03:49
rm_workuntil i was like "please stop"03:49
sbalukoffHaha!03:49
sbalukoffYeah, it's...  ugly.03:49
rm_workbut if it's really unsupported in higher level libs...03:49
rm_workthen yeah, fine03:49
rm_workugh03:49
sbalukoffcryptography should really support this.03:49
*** Kiall has quit IRC03:49
rm_workyeah, poke at reaperhulk :P03:49
sbalukoffBut... it doesn't. At all.03:49
rm_workor I can do it03:49
sbalukoffI have no idea who that is.03:50
*** diltram has joined #openstack-lbaas03:50
*** xgerman has quit IRC03:50
stickerstill no certs.. hmm.. is that bug about only being able to deploy TLS in the admin project still open or is that fixed?03:50
*** Kiall has joined #openstack-lbaas03:50
rm_workoh, i think someone was reporting that it still doesn't work <_<03:51
rm_workso maybe that bug isn't fixed03:51
sbalukoffsticker: It should work for non-admin users. The instructions in the document I linked to you were all tested using a demo project.03:51
rm_workor rather, the specific bug might be fixed but it exposed another bug with the same result03:51
rm_workhmm03:51
rm_workinteresting sbalukoff03:51
stickerahh okay03:51
rm_worki was seeing complaints in the barbican channel within the last couple days03:51
sbalukoffsticker: What release is your cloud using?03:52
*** yuanying has joined #openstack-lbaas03:52
stickerMitaka (latest RDO packages)03:52
sbalukoffsticker: It's possible that this was a bug that was fixed after the release you're on.03:52
stickerargh!03:52
*** xgerman has joined #openstack-lbaas03:52
sbalukoffrm_work: Did that bugfix land prior to the Mitaka release?03:52
*** Dave has quit IRC03:52
sbalukoffrm_work: You're talking about the consumer registration bug, right?03:53
stickeri'm barbican 2.0.0 and octavia 0.8.003:53
rm_workyou will need 0..9.003:53
rm_worksbalukoff: yes03:53
sbalukoffOk.03:53
sbalukoffSo yeah, that's a bugfix that landed after Mitaka.03:53
rm_workbut i heard rumblings there were further issues on master03:54
rm_workbut i didn't get a chance to reproduce03:54
rm_workbecause my devstack instances aren't mine anymore :(03:54
sbalukoffsticker: I don't know whether barbican's Newton release has been tagged yet, but the Octavia newton release has. I don't think it has any hard requirements for Newton in any of the other OpenStack components.03:54
sbalukoffrm_work: D'oh!03:55
*** diltram has quit IRC03:55
sbalukoffsticker: In any case, if it's the bugfix we've been discussing, then it's actually a bugfix for barbican. :/03:56
*** diltram has joined #openstack-lbaas03:56
stickerhaha cool.  I guess I will be upgrading parts of our cloud to Newton earlier than expected then03:56
sbalukoffrm_work: In any case, I went through all the instructions in the cookbook document using the demo user on the demo project (after granting it the 'creator' role on that project), and they work as listed.03:56
sbalukoffIn Newton, anyway.03:57
stickerthanks for your help03:57
sbalukoffWith the exception of intermediate certificates. Which I hope to have a fix for this week.03:57
sbalukoffsticker: No problem, eh! Let us know how it works out for you!03:57
*** pcaruana has joined #openstack-lbaas03:59
*** fnaval_ has joined #openstack-lbaas04:01
*** fnaval has quit IRC04:02
rm_workok cool04:04
rm_workyeah I need to figure out a solution for devstack testing :(04:04
rm_workI would like to continue to help with merge tasks04:04
rm_workand reviewing04:04
rm_workbut I relied VERY heavily on having free cloud04:05
rm_worklol04:05
*** amotoki has joined #openstack-lbaas04:57
*** amotoki has quit IRC05:02
*** yamamoto_ has quit IRC05:04
*** bana_k has joined #openstack-lbaas05:06
*** amotoki has joined #openstack-lbaas05:17
*** fnaval_ has quit IRC05:20
*** fnaval has joined #openstack-lbaas05:21
*** anilvenkata has joined #openstack-lbaas05:32
*** nmagnezi has joined #openstack-lbaas05:43
*** yamamoto_ has joined #openstack-lbaas05:46
zetabany ideas why lbaasv2 (haproxy) security groups does not apply?05:55
zetabi have created new load balancer, and added rules http://dpaste.com/1PQEBE5 to it but still all traffic is going through05:56
*** gcheresh_ has joined #openstack-lbaas05:57
zetabif i go to neutron host, and write ip netns exec <namespace> iptables -L -n the iptables is empty?05:57
zetabshould there be something if i have added that security group05:57
zetabopenstack version mitaka05:57
*** woodster_ has quit IRC06:00
*** numan_ has joined #openstack-lbaas06:18
*** rcernin has joined #openstack-lbaas06:22
*** saju_m has quit IRC06:33
*** numan_ has quit IRC06:37
*** numans has joined #openstack-lbaas06:37
*** bana_k has quit IRC06:46
*** nagyz has quit IRC07:35
*** saju_m has joined #openstack-lbaas07:42
*** ipsecguy has quit IRC07:43
*** nagyz has joined #openstack-lbaas07:44
*** ipsecguy has joined #openstack-lbaas07:44
*** ducnc has joined #openstack-lbaas07:55
*** Dave___ is now known as Dave08:07
*** strigazi_AFK is now known as strigazi08:29
*** ihrachys has joined #openstack-lbaas09:01
*** amotoki has quit IRC10:06
*** nagyz has quit IRC10:31
*** ihrachys has quit IRC10:37
*** yamamoto_ has quit IRC10:40
*** ducnc has quit IRC10:47
*** bdeschenes has joined #openstack-lbaas10:59
openstackgerritReedip proposed openstack/neutron-lbaas: Add Timeout on Listeners  https://review.openstack.org/27389611:02
*** bdeschenes has quit IRC11:16
*** yamamoto has joined #openstack-lbaas11:18
*** yamamoto_ has joined #openstack-lbaas11:18
*** yamamoto has quit IRC11:18
*** openstackgerrit has quit IRC11:19
*** openstackgerrit has joined #openstack-lbaas11:19
*** bdeschenes has joined #openstack-lbaas11:46
*** saju_m has quit IRC12:01
*** ducttape_ has joined #openstack-lbaas12:03
*** ducttape_ has quit IRC12:04
*** ducttape_ has joined #openstack-lbaas12:04
*** fnaval has quit IRC12:08
*** catintheroof has joined #openstack-lbaas12:18
*** ihrachys has joined #openstack-lbaas12:25
*** ducttape_ has quit IRC12:35
*** nagyz has joined #openstack-lbaas12:36
*** yamamoto_ has quit IRC12:54
openstackgerritValleriya Perelman proposed openstack/octavia: ACTIVE-ACTIVE Topology - Initial Cluster Manager  https://review.openstack.org/33692512:55
openstackgerritValleriya Perelman proposed openstack/octavia: ACTIVE-ACTIVE Topology - amphora cluster DB  https://review.openstack.org/32713812:55
openstackgerritValleriya Perelman proposed openstack/octavia: ACTIVE-ACTIVE Topology - Distributor image creation  https://review.openstack.org/32713712:55
*** ducttape_ has joined #openstack-lbaas12:57
*** ducttape_ has quit IRC13:05
*** matt-borland has joined #openstack-lbaas13:15
*** yamamoto has joined #openstack-lbaas13:16
*** links has quit IRC13:17
*** fnaval has joined #openstack-lbaas13:26
*** fnaval_ has joined #openstack-lbaas13:31
*** fnaval has quit IRC13:31
openstackgerritValleriya Perelman proposed openstack/octavia: ACTIVE-ACTIVE Topology - Initial Cluster Manager  https://review.openstack.org/33692513:39
openstackgerritValleriya Perelman proposed openstack/octavia: ACTIVE-ACTIVE Topology - amphora cluster DB  https://review.openstack.org/32713813:39
openstackgerritValleriya Perelman proposed openstack/octavia: ACTIVE-ACTIVE Topology - Distributor image creation  https://review.openstack.org/32713713:39
*** fnaval_ has quit IRC13:39
openstackgerritValleriya Perelman proposed openstack/octavia: ACTIVE-ACTIVE Topology - Initial Cluster Manager  https://review.openstack.org/33692513:42
openstackgerritValleriya Perelman proposed openstack/octavia: ACTIVE-ACTIVE Topology - amphora cluster DB  https://review.openstack.org/32713813:42
openstackgerritValleriya Perelman proposed openstack/octavia: ACTIVE-ACTIVE Topology - Distributor image creation  https://review.openstack.org/32713713:42
*** ducttape_ has joined #openstack-lbaas13:43
*** fnaval has joined #openstack-lbaas13:46
*** amoralej has joined #openstack-lbaas13:49
*** fnaval has quit IRC13:52
amoralejquestion about lbaas-dashboard13:53
amoralejwill be a new release for newton?13:54
*** yamamoto has quit IRC13:57
*** yamamoto has joined #openstack-lbaas14:05
*** fnaval has joined #openstack-lbaas14:11
*** fnaval_ has joined #openstack-lbaas14:13
*** fnaval__ has joined #openstack-lbaas14:15
openstackgerritMiguel Angel Ajo proposed openstack/octavia: Fix nova image-list which is unavailable.  https://review.openstack.org/37949314:17
*** fnaval___ has joined #openstack-lbaas14:17
*** fnaval has quit IRC14:17
*** fnaval has joined #openstack-lbaas14:18
*** fnaval_ has quit IRC14:19
*** fnaval_ has joined #openstack-lbaas14:20
*** fnaval__ has quit IRC14:20
*** fnaval___ has quit IRC14:21
*** yamamoto has quit IRC14:22
*** fnaval__ has joined #openstack-lbaas14:22
*** yamamoto has joined #openstack-lbaas14:23
*** fnaval___ has joined #openstack-lbaas14:23
*** fnaval has quit IRC14:24
*** fnaval_ has quit IRC14:25
*** fnaval has joined #openstack-lbaas14:25
*** fnaval__ has quit IRC14:27
*** yamamoto has quit IRC14:27
*** yamamoto has joined #openstack-lbaas14:27
*** yamamoto has quit IRC14:27
*** fnaval_ has joined #openstack-lbaas14:27
*** fnaval__ has joined #openstack-lbaas14:29
*** fnaval___ has quit IRC14:29
*** fnaval___ has joined #openstack-lbaas14:30
*** fnaval has quit IRC14:31
*** ducttape_ has quit IRC14:31
*** fnaval_ has quit IRC14:32
*** fnaval has joined #openstack-lbaas14:32
*** fnaval__ has quit IRC14:33
*** fnaval_ has joined #openstack-lbaas14:34
*** fnaval___ has quit IRC14:35
*** fnaval__ has joined #openstack-lbaas14:36
*** fnaval___ has joined #openstack-lbaas14:37
*** fnaval has quit IRC14:38
*** amotoki has joined #openstack-lbaas14:38
*** fnaval has joined #openstack-lbaas14:39
*** fnaval_ has quit IRC14:39
*** fnaval_ has joined #openstack-lbaas14:40
*** fnaval__ has quit IRC14:41
*** fnaval__ has joined #openstack-lbaas14:42
*** fnaval__ has quit IRC14:42
*** fnaval___ has quit IRC14:43
*** fnaval__ has joined #openstack-lbaas14:43
*** fnaval__ has quit IRC14:43
*** fnaval__ has joined #openstack-lbaas14:44
*** fnaval has quit IRC14:45
*** fnaval__ has quit IRC14:45
*** fnaval_ has quit IRC14:46
*** fnaval has joined #openstack-lbaas14:46
*** fnaval has quit IRC14:48
*** amotoki has quit IRC14:48
*** fnaval has joined #openstack-lbaas14:48
*** pglass has joined #openstack-lbaas14:49
*** fnaval has quit IRC14:49
*** fnaval has joined #openstack-lbaas14:50
*** ducttape_ has joined #openstack-lbaas14:52
*** pglass has quit IRC14:56
*** pglass has joined #openstack-lbaas14:58
johnsomamoralej It's not clear that there was enough changes to warrant a release of neutron-lbaas-dashboard for newton.  Is there something in particular you wanted in a newton release?15:02
amoralejnot really, i'm working to introduce lbaasv2 in packstack15:03
amoralejand i'm checking if i should install -dashboard15:03
amoralejwhich is already packaged in RDO15:03
amoralejbut last tag is from mitaka15:03
johnsomOk.  Yeah.  Most of the developers changed jobs and work slowed on dashboard.15:04
amoraleji see, i'll test how it works on top of newton release and see how it works15:05
johnsomThere were no API changes in the Newton release, so I would expect it should be fine.15:05
johnsomLBaaSv2 API changes I should say.15:06
amoralejok, let's see, thanks johnsom15:06
*** gcheresh_ has quit IRC15:07
*** amotoki has joined #openstack-lbaas15:14
*** amotoki has quit IRC15:20
*** amotoki has joined #openstack-lbaas15:27
*** yamamoto has joined #openstack-lbaas15:28
*** amotoki has quit IRC15:28
*** numans has quit IRC15:29
*** yamamoto has quit IRC15:33
*** amotoki has joined #openstack-lbaas15:34
*** amotoki has quit IRC15:36
*** amoralej is now known as amoralej|off15:37
*** saju_m has joined #openstack-lbaas15:49
*** openstackgerrit has quit IRC15:49
*** openstackgerrit has joined #openstack-lbaas15:50
*** pcaruana has quit IRC16:03
*** woodster_ has joined #openstack-lbaas16:03
*** rcernin has quit IRC16:05
openstackgerritMichael Johnson proposed openstack/octavia: Use a cached get-pip.py if it is availble  https://review.openstack.org/37900016:15
*** reedip has quit IRC16:18
*** saju_m has quit IRC16:21
*** tries_ has quit IRC16:25
*** reedip has joined #openstack-lbaas16:32
*** saju_m has joined #openstack-lbaas16:33
openstackgerritMichael Johnson proposed openstack/neutron-lbaas: Use a cached get-pip.py if it is availble  https://review.openstack.org/37900116:46
*** eezhova has quit IRC16:55
*** amotoki has joined #openstack-lbaas16:57
*** nmagnezi has quit IRC17:01
*** reedip has quit IRC17:02
*** amotoki has quit IRC17:03
*** ihrachys has quit IRC17:05
*** tries_ has joined #openstack-lbaas17:06
*** tries_ has quit IRC17:06
*** tries_ has joined #openstack-lbaas17:06
*** saju_m has quit IRC17:09
*** bana_k has joined #openstack-lbaas17:12
*** anilvenkata has quit IRC17:13
*** reedip has joined #openstack-lbaas17:15
openstackgerritPhillip Toohill proposed openstack/octavia: WIP: Add quota support to Octavia  https://review.openstack.org/36079417:19
*** reedip has quit IRC17:25
*** reedip has joined #openstack-lbaas17:38
*** bana_k has quit IRC17:39
*** numans has joined #openstack-lbaas17:46
*** SumitNaiksatam has joined #openstack-lbaas17:57
*** bana_k has joined #openstack-lbaas17:59
openstackgerritMichael Johnson proposed openstack/octavia: Use a cached get-pip.py if it is availble  https://review.openstack.org/37900018:02
*** reedip has quit IRC18:03
*** reedip has joined #openstack-lbaas18:15
*** ducttape_ has quit IRC18:19
*** woodster_ has quit IRC18:20
*** ducttape_ has joined #openstack-lbaas18:22
openstackgerritPhillip Toohill proposed openstack/octavia: WIP: Add quota support to Octavia  https://review.openstack.org/36079418:28
*** reedip has quit IRC18:42
*** ihrachys has joined #openstack-lbaas18:51
openstackgerritPhillip Toohill proposed openstack/octavia: WIP: Add quota support to Octavia  https://review.openstack.org/36079418:53
*** ihrachys has quit IRC18:55
*** gcheresh_ has joined #openstack-lbaas19:06
*** numans has quit IRC19:08
*** SumitNaiksatam has left #openstack-lbaas19:20
*** ihrachys has joined #openstack-lbaas19:31
*** anilvenkata has joined #openstack-lbaas19:33
*** afranc has quit IRC19:43
*** crc32 has joined #openstack-lbaas19:45
*** crc32 has quit IRC19:46
*** afranc has joined #openstack-lbaas19:47
openstackgerritMichael Johnson proposed openstack/octavia: Use a cached get-pip.py if it is availble  https://review.openstack.org/37900019:49
openstackgerritMichael Johnson proposed openstack/octavia: Use a cached get-pip.py if it is availble  https://review.openstack.org/37900019:50
*** crc32 has joined #openstack-lbaas19:50
*** woodster_ has joined #openstack-lbaas19:54
*** ihrachys has quit IRC19:56
*** bdeschenes has quit IRC20:13
*** anilvenkata has quit IRC20:20
*** catintheroof has quit IRC20:32
*** gcheresh_ has quit IRC20:37
openstackgerritMichael Johnson proposed openstack/octavia: Use a cached get-pip.py if it is availble  https://review.openstack.org/37900020:38
openstackgerritMichael Johnson proposed openstack/neutron-lbaas: Use a cached get-pip.py if it is availble  https://review.openstack.org/37900120:38
*** amoralej|off has quit IRC20:53
*** amoralej has joined #openstack-lbaas20:55
*** matt-borland has quit IRC21:00
*** amotoki has joined #openstack-lbaas21:00
*** amotoki has quit IRC21:05
openstackgerritPaul Glass proposed openstack/octavia: Basic session persistence scenario test  https://review.openstack.org/37982621:12
*** pglass has quit IRC21:41
*** woodster_ has quit IRC22:00
*** ducttape_ has quit IRC22:20
*** ducttape_ has joined #openstack-lbaas22:26
*** ducttape_ has quit IRC22:33
*** Kiall has quit IRC22:41
*** fnaval has quit IRC23:24
*** ducttape_ has joined #openstack-lbaas23:41
*** bdeschenes has joined #openstack-lbaas23:46
*** ducttape_ has quit IRC23:54

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!