| *** ramishra has joined #openstack-lbaas | 02:18 | |
| openstackgerrit | Michael Johnson proposed openstack/octavia master: Fix the API list performance regression https://review.openstack.org/603242 | 02:31 |
|---|---|---|
| johnsom | Alright, more work to do on that tomorrow, but on a decent path. two minutes down to a few seconds. Yes, I know the functional tests have a few issues. | 02:32 |
| *** hongbin has joined #openstack-lbaas | 02:37 | |
| *** hongbin has quit IRC | 03:25 | |
| *** abaindur has joined #openstack-lbaas | 03:50 | |
| *** abaindur_ has joined #openstack-lbaas | 03:55 | |
| *** abaindur has quit IRC | 03:59 | |
| *** abaindur has joined #openstack-lbaas | 04:03 | |
| *** yamamoto has joined #openstack-lbaas | 04:06 | |
| *** abaindur_ has quit IRC | 04:06 | |
| *** reedipb has quit IRC | 04:11 | |
| *** abaindur has quit IRC | 04:24 | |
| cgoncalves | johnsom, excellent! | 04:37 |
| cgoncalves | xgerman_, doesn't that look better now and is backport material?! ;-) | 04:39 |
| *** dayou has quit IRC | 05:28 | |
| *** dayou has joined #openstack-lbaas | 05:58 | |
| sapd1 | johnsom: So It's a bug in base repository code :D | 06:11 |
| rm_work | ehh | 06:25 |
| rm_work | the repo work just helps | 06:26 |
| rm_work | i don't know if it's necessary | 06:26 |
| rm_work | but it seemed like the easiest way to fix stuff probably | 06:26 |
| sapd1 | rm_work: I just delete joinedload('*') in get_all function . | 06:28 |
| *** ccamposr has joined #openstack-lbaas | 06:43 | |
| rm_work | yeah, that .... helps somewhat | 07:01 |
| *** rcernin has quit IRC | 07:03 | |
| sapd1 | rm_work: have you reviewed my patch for redirect prefix yet? | 07:09 |
| rm_work | i think i looked at it | 07:09 |
| rm_work | i will look again in the morning | 07:09 |
| rm_work | it's just after midnight, hopped on to check on some test runs. :P | 07:10 |
| rm_work | I just got back and caught up from travel today | 07:10 |
| rm_work | but, i believe i looked during the PTG and thought it was basically correct | 07:10 |
| *** celebdor has joined #openstack-lbaas | 07:10 | |
| rm_work | need to test, really | 07:10 |
| sapd1 | rm_work: yes. In Vietnam, It's afternoon. We are working :D | 07:10 |
| sapd1 | rm_work: I think we have some cases such as set status code when redirect. | 07:11 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/octavia-dashboard master: Imported Translations from Zanata https://review.openstack.org/603304 | 07:28 |
| *** luksky has joined #openstack-lbaas | 08:19 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/neutron-lbaas-dashboard master: Imported Translations from Zanata https://review.openstack.org/603317 | 08:19 |
| *** hvhaugwitz has quit IRC | 08:55 | |
| *** hvhaugwitz has joined #openstack-lbaas | 08:55 | |
| openstackgerrit | Reedip proposed openstack/octavia-tempest-plugin master: Add configuration support for skipping tests https://review.openstack.org/599393 | 09:49 |
| *** Emine has joined #openstack-lbaas | 09:58 | |
| *** reedipb has joined #openstack-lbaas | 10:05 | |
| *** dayou has quit IRC | 10:08 | |
| ArchiFleKs | cgoncalves: LB update was stuck because LB had no agent associated, I don't know why but lbassloadbalanceragentbinding tale was empty after the update so I updated the DB with existing agent and existing LBaaS and they got recreated | 10:19 |
| *** yamamoto has quit IRC | 10:31 | |
| *** dayou has joined #openstack-lbaas | 10:35 | |
| *** yamamoto has joined #openstack-lbaas | 10:44 | |
| *** yamamoto has quit IRC | 11:37 | |
| *** yamamoto has joined #openstack-lbaas | 12:01 | |
| *** salmankhan has joined #openstack-lbaas | 13:10 | |
| *** reedipb has quit IRC | 13:52 | |
| *** Emine has quit IRC | 14:06 | |
| *** KeithMnemonic has quit IRC | 14:14 | |
| *** KeithMnemonic has joined #openstack-lbaas | 14:14 | |
| *** Emine has joined #openstack-lbaas | 14:19 | |
| *** yamamoto has quit IRC | 14:19 | |
| *** yamamoto has joined #openstack-lbaas | 14:24 | |
| *** yamamoto has quit IRC | 14:24 | |
| *** yamamoto has joined #openstack-lbaas | 14:24 | |
| *** yamamoto has quit IRC | 14:29 | |
| *** celebdor has quit IRC | 14:57 | |
| ltomasbo | ping johnsom | 14:58 |
| *** luksky has quit IRC | 14:59 | |
| johnsom | ltomasbo Hello | 15:01 |
| ltomasbo | johnsom, I would like to know your opinion on this patch (as a temporal solution) https://review.openstack.org/#/c/602564/ | 15:02 |
| johnsom | ltomasbo Generally I am against it. We are already seeing problems with the current change allowing users to see the VIP port. People are running bulk delete tools that are deleting their VIP ports. | 15:03 |
| johnsom | ltomasbo Can't you just delete the security group that is there and add your own? | 15:04 |
| ltomasbo | johnsom, I tried that but it is not working | 15:04 |
| ltomasbo | johnsom, the security group being applied is the one on the amphora port | 15:04 |
| ltomasbo | not the one on the VIP | 15:04 |
| johnsom | ltomasbo Since we are a stable API project, temporary changes to the API are really rough | 15:04 |
| ltomasbo | johnsom, but this is not changing the API, right? | 15:05 |
| ltomasbo | johnsom, it will just change the ownership of the listeners being created after the change, so that users can just restrict the access to their loadbalancer in a more fine grain | 15:06 |
| johnsom | One approach would be, the other would change the behavior of the VIP ports. | 15:06 |
| johnsom | ltomasbo Can you do what you need be using FWaaS? | 15:06 |
| ltomasbo | johnsom, that will only work on the SDN that implements that feature | 15:06 |
| ltomasbo | johnsom, and it feels kind of wrong that you would allow access to a VM based on the ports attached through allow_address_pairs | 15:07 |
| ltomasbo | johnsom, that said, I even already asked about that, and it seems that was not the purpose of allow_address_pair, and enabling such thing will be a completely different feature that allow_address_pairs | 15:07 |
| johnsom | I think at the PTG we requested a few folks to go research options on this. One was proposed in stacking SGs, one was using shared FWaaS groups. I think there are others too. If I remember the RFE on this was going to add ACLs to our API. | 15:07 |
| *** ramishra has quit IRC | 15:07 | |
| johnsom | ltomasbo Well, AAP is to allow a secondary address on the neutron port. | 15:08 |
| ltomasbo | johnsom, this is the storyboard I openned about it: | 15:08 |
| ltomasbo | https://storyboard.openstack.org/#!/story/2003686 | 15:08 |
| ltomasbo | johnsom, yep, but it is thought for HA issues, not to enable SG on it. Actually, security group attached to the VIP is kind of useless as it is not being used... | 15:09 |
| ltomasbo | johnsom, I know the solution is not the right one, but it is a simple fix until a proper one (extending the listeners API with more flexibility) will be in place | 15:09 |
| ltomasbo | johnsom, and removing it once that is there will be trivial too | 15:10 |
| johnsom | ltomasbo Well, make sure your user story is in the storyboard story and how you envision it rolling back. I will be sure to bring it up during the weekly meeting so we don't forget about the research spike on this. | 15:11 |
| ltomasbo | johnsom, German Eichberger (who I don't know the nick) mentioned that could be a good temporal solution due to the other development being stuck at the moment | 15:12 |
| johnsom | ltomasbo German is xgerman_ | 15:12 |
| ltomasbo | ooh, thanks! good to know! | 15:12 |
| * xgerman_ reading... | 15:12 | |
| ltomasbo | xgerman_, is about this (temporal) fix: https://review.openstack.org/#/c/602564/ | 15:12 |
| ltomasbo | johnsom, well, use case is simple. You may want to have a loadbalancer that is only accessible from a given subnet or specific remote group (similarly to VMs), and currently is all or nothing | 15:15 |
| xgerman_ | Yeah, we talked at the PTG and discussed several options. It’s a valid use case but SGs already complicate load balancer delete operations so this will need some more exploration and testing | 15:16 |
| ltomasbo | xgerman_, you mean the security group could not be deleted if created in a different tenant? | 15:18 |
| ltomasbo | xgerman_, should be exactly the same as the VIP port, right? | 15:18 |
| ltomasbo | let me see if I get leftovers... | 15:18 |
| xgerman_ | yep, and we have trouble with that since we gave it to the tennat since they keep deleting it out of band | 15:19 |
| ltomasbo | ahh, you mean if the tenant deletes the SG? | 15:19 |
| xgerman_ | yep | 15:19 |
| xgerman_ | or if the tenant adds ports and we can’t delete SG | 15:19 |
| ltomasbo | true, though as you have the right sg in the database | 15:20 |
| ltomasbo | if you get a NotFound exception you should just skipt it, right? | 15:20 |
| ltomasbo | and, if the security group is in use, the tenant cannot remove it, right? | 15:20 |
| ltomasbo | and the SG is on the amphora port, so even if it belongs to the tenant, it cannot be removed | 15:20 |
| xgerman_ | Probably - but what if the tenant added a port - we have logic to delete all [ports pn the SG if we can’t delete | 15:21 |
| ltomasbo | ahh, the other case is true... | 15:21 |
| ltomasbo | though I guess in that case is not a left over and you can just leave it undeleted | 15:22 |
| ltomasbo | from that point, the users is the one that needs to consider it | 15:22 |
| xgerman_ | yeah, and then we leave stuff behind which irks other people... | 15:22 |
| ltomasbo | xgerman_, but if the tenant is using the security group, is not left behind... | 15:24 |
| ltomasbo | of course it is nicer to not allow the user to use that SG in other VMs | 15:24 |
| ltomasbo | so that you will remove it for sure | 15:24 |
| xgerman_ | well, users always blame Octavia... | 15:24 |
| *** amuller has joined #openstack-lbaas | 15:24 | |
| ltomasbo | xD | 15:24 |
| ltomasbo | in that case, they are the one to blame... xD | 15:25 |
| ltomasbo | but yep, I agree the best solution is to offer it through the octavia API, so that the user cannot do that | 15:25 |
| xgerman_ | but I am in favor of turning it over to the client. I will see if we can switch internally from SG to FWG (if the network supports that) and then have the user just do what they want... | 15:25 |
| ltomasbo | xgerman_, FWG? | 15:26 |
| xgerman_ | Firewall Group | 15:26 |
| ltomasbo | ahh, ok | 15:26 |
| xgerman_ | Also the API idea or ACL’s are high on our list | 15:26 |
| ltomasbo | nice to hear! | 15:27 |
| ltomasbo | problem is that current status is a security concern as the LBaaS need to be wide open, and that is why I wanted to have it temporary fix until the API/ACL solution is in | 15:28 |
| xgerman_ | K, understood - but as johnsom siad if we do soemthing temporary we need to support it for 2+ cycles... | 15:29 |
| cgoncalves | +1 for ACL option: we solve the issue without adding a requirement on FWaaS (for now). neither ACL or FWaaS options would be backportable as would require API version bump | 15:30 |
| xgerman_ | What? Everyone needs FWaaS ;-) | 15:31 |
| *** Emine has quit IRC | 15:31 | |
| ltomasbo | xgerman_, yep I agree 2+ cycles is not desired, but there is not much to support regarding the change anyway | 15:31 |
| ltomasbo | xgerman_, it would have been better to put it there 2 cycles ago xD | 15:32 |
| cgoncalves | ltomasbo, where were you 2 cycles ago? :P | 15:32 |
| * ltomasbo thinking... | 15:32 | |
| xgerman_ | well, to be fair, gophercloud queries the SG and references it on the VMs somehow ;-) | 15:32 |
| xgerman_ | Which infuriates aus, too | 15:33 |
| ltomasbo | xgerman_, you are using gophercloud too?? nice | 15:33 |
| xgerman_ | Yeah, I know it has some SG hacking in it | 15:33 |
| ltomasbo | :D | 15:39 |
| *** luksky has joined #openstack-lbaas | 15:45 | |
| ltomasbo | xgerman_, cgoncalves, johnsom: btw, just one more thing. If the patch make the SG ownership configurable, and by default belongs to the admin, would it be ok-ish (or better) | 15:49 |
| ltomasbo | that way only on those env that needs to have this restrictions will be switched to the tenant creating the LBaaS | 15:49 |
| xgerman_ | mmh, that would definitely be better | 15:56 |
| cgoncalves | ltomasbo, by means of adding a new config opt? | 15:56 |
| xgerman_ | yeah, that’s my interpretation | 15:56 |
| KeithMnemonic | johnsom: Hello Michael how are you doing? Do you know if/when what release does not use the neutron db for the loadbalancers? | 16:00 |
| KeithMnemonic | and only octavia | 16:00 |
| johnsom | KeithMnemonic Hi Keith, doing well. Missed you at the PTG. Umm, tricky question to answer. Octavia has always had it's own DB, but to totally eliminate the neutron DB need, you want the Octavia V2 API which was released in the Octavia 1.0 release (Pike) | 16:02 |
| cgoncalves | ltomasbo, hacky approach. I don't like it still but would be better, sure | 16:02 |
| KeithMnemonic | thanks! is octavia v1 deprecated yet. or could it be a customer does not have to eliminate the neutron db yet? | 16:03 |
| KeithMnemonic | working on my troubleshooting talk for berlin and wanted to cover DBs a small bit | 16:04 |
| johnsom | octavia v1 will deprecate with the neutron-lbaas deprecation | 16:04 |
| johnsom | So, yes | 16:04 |
| cgoncalves | johnsom, speaking of that, have you started the deprecation clock? | 16:04 |
| KeithMnemonic | ok so i will focus on octavia but maybe make a small reference to neutrob | 16:05 |
| KeithMnemonic | neutron | 16:05 |
| johnsom | cgoncalves Sigh, no, focused on the API perf issue yesterday | 16:05 |
| cgoncalves | fair | 16:05 |
| johnsom | KeithMnemonic This might help you: https://wiki.openstack.org/wiki/Neutron/LBaaS/Deprecation | 16:05 |
| johnsom | cgoncalves Yeah, seemed like a hot issue impacting a few folks | 16:06 |
| KeithMnemonic | Thanks! | 16:07 |
| *** ccamposr has quit IRC | 16:49 | |
| *** salmankhan has quit IRC | 17:10 | |
| *** celebdor has joined #openstack-lbaas | 17:18 | |
| *** amuller has quit IRC | 17:24 | |
| *** sapd1_ has joined #openstack-lbaas | 17:47 | |
| openstackgerrit | Carlos Goncalves proposed openstack/neutron-lbaas master: Fix memory leak in the haproxy provider driver https://review.openstack.org/603460 | 17:59 |
| openstackgerrit | German Eichberger proposed openstack/octavia master: Updates the operator docs with the new lb failover command https://review.openstack.org/603463 | 18:13 |
| openstackgerrit | German Eichberger proposed openstack/octavia master: Updates the operator docs with the new lb failover command https://review.openstack.org/603463 | 18:16 |
| openstackgerrit | Merged openstack/octavia-dashboard master: Imported Translations from Zanata https://review.openstack.org/603304 | 18:18 |
| *** abaindur has joined #openstack-lbaas | 18:35 | |
| *** abaindur has quit IRC | 18:35 | |
| *** abaindur has joined #openstack-lbaas | 18:36 | |
| *** luksky11 has joined #openstack-lbaas | 18:42 | |
| *** luksky has quit IRC | 18:46 | |
| *** celebdor has quit IRC | 18:56 | |
| openstackgerrit | Carlos Goncalves proposed openstack/neutron-lbaas master: Fix memory leak in the haproxy provider driver https://review.openstack.org/603460 | 18:59 |
| rm_work | ah found the issue with the lvsquery tests | 19:00 |
| *** sapd1_ has quit IRC | 19:03 | |
| rm_work | bzhao__: are you around? | 19:04 |
| openstackgerrit | Carlos Goncalves proposed openstack/neutron-lbaas master: Fix memory leak in the haproxy provider driver https://review.openstack.org/603460 | 19:28 |
| *** fnaval has joined #openstack-lbaas | 19:42 | |
| *** dmellado has quit IRC | 20:01 | |
| *** cgoncalves is now known as cgoncalves|pto | 20:13 | |
| *** KeithMnemonic has quit IRC | 20:16 | |
| openstackgerrit | Adam Harwell proposed openstack/octavia master: Simplify keepalived lvsquery parsing for UDP https://review.openstack.org/603490 | 20:39 |
| rm_work | johnsom: ^^ | 20:41 |
| *** abaindur has quit IRC | 21:17 | |
| *** abaindur has joined #openstack-lbaas | 21:19 | |
| *** dmellado has joined #openstack-lbaas | 21:20 | |
| *** Emine has joined #openstack-lbaas | 21:28 | |
| openstackgerrit | Michael Johnson proposed openstack/octavia master: Fix the API list performance regression https://review.openstack.org/603242 | 21:34 |
| *** Emine has quit IRC | 21:40 | |
| rm_work | johnsom: ^^ done? | 21:48 |
| johnsom | I wish, not just fixed. LB and Listener are done in that | 21:48 |
| rm_work | k | 21:51 |
| *** luksky11 has quit IRC | 22:16 | |
| *** abaindur has quit IRC | 22:24 | |
| *** abaindur has joined #openstack-lbaas | 22:30 | |
| johnsom | rm_work Any idea where "self.l7policies" is defined here: https://github.com/openstack/octavia/blob/master/octavia/db/models.py#L309 | 22:35 |
| johnsom | ? | 22:35 |
| xgerman_ | pycharm failing you? | 22:36 |
| johnsom | I expected that response | 22:36 |
| johnsom | Oh, nevermind, found it | 22:37 |
| johnsom | It's already been a bit of a day staring at data models... | 22:38 |
| xgerman_ | Yeah, i started to turn my head into a bezel looking at the AAP driver | 22:39 |
| johnsom | Lots-o-refactor on the model so they actually have forward and back references, instead of just backrefs | 22:40 |
| johnsom | Should make our lives easier going forward, just a mental exercise to do the work. | 22:40 |
| *** fnaval has quit IRC | 22:43 | |
| *** rcernin has joined #openstack-lbaas | 22:47 | |
| rm_work | lol just got back from the post office | 23:40 |
| johnsom | Figured that out, but have another oddity, but I can work around it. Wish I had an sqlalchemy expert hanging around | 23:40 |
| rm_work | i can pretend to be that | 23:44 |
| rm_work | or ping zzzeek | 23:44 |
| rm_work | what's the oddity? | 23:45 |
| johnsom | Just a sec, running tests, I will push and show you | 23:46 |
| johnsom | https://www.irccloud.com/pastebin/8G2gJZof/ | 23:47 |
| johnsom | Well, I can paste the part. | 23:47 |
| johnsom | So this is pools, I want to joinedload l7policies with l7rules as I know I need both here. | 23:47 |
| johnsom | The only way I can get it to work is lazy load the l7policies, which causes a bunch of round trips to the DB for the l7rules. | 23:48 |
| johnsom | What I can't figure out is how to get that to join load. If I just put joinedload(models.Pool.l7policies) the rules don't come in at all | 23:49 |
| openstackgerrit | Michael Johnson proposed openstack/octavia master: Fix the API list performance regression https://review.openstack.org/603242 | 23:50 |
| johnsom | For me, even with the extra round trips it is still 4 seconds to list pools with 1000 pools, but... Wish I could stop the excessive DB connections/queries | 23:52 |
| rm_work | hmm | 23:53 |
| rm_work | can you do | 23:53 |
| rm_work | joinedload(models.Pool.l7policies).joinedload(models.L7Policy.l7rules) ? | 23:53 |
| rm_work | like... that should work? | 23:53 |
| rm_work | or subqueryload | 23:54 |
| rm_work | whatever you're using | 23:54 |
| rm_work | just add the subqueryload for the rules | 23:54 |
| * rm_work shrugs | 23:54 | |
| johnsom | ArgumentError: Can't find property 'l7rules' on any entity specified in this Query. Note the full path from root (Mapper|Pool|pool) to target entity must be specified. | 23:55 |
| rm_work | ah so | 23:55 |
| rm_work | maybe it's models.Pool.l7policies.l7rules | 23:55 |
| johnsom | AttributeError: Neither 'InstrumentedAttribute' object nor 'Comparator' object associated with Pool.l7policies has an attribute 'l7rules' | 23:56 |
| johnsom | Yeah, been down these paths.... | 23:56 |
| rm_work | is it called l7rules | 23:56 |
| rm_work | i'm not where you are exactly | 23:56 |
| rm_work | is it a simple test i can run if i pull down your patch? | 23:56 |
| johnsom | Yeah, create an LB with l7 redirect pool, that policy needs a rule | 23:57 |
| johnsom | openstack loadbalancer pool list | 23:57 |
| johnsom | I add | 23:57 |
| rm_work | ah i was hoping there was a functional test i could just run | 23:57 |
| johnsom | https://www.irccloud.com/pastebin/n9YVIBZm/ | 23:58 |
| rm_work | maybe something in test_pool | 23:58 |
| johnsom | into the repo Pool class, listeners properties section to make sure I get the rule back | 23:58 |
| johnsom | Not sure, I only ran the tests with my "working" version | 23:58 |
| johnsom | I would expect something to puke | 23:59 |
| johnsom | as the list of listeners included with the pool list should be short L7 attached pools if it's broken | 23:59 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!