Tuesday, 2018-12-18

*** Emine has quit IRC00:04
*** PagliaccisCloud has quit IRC00:09
*** PagliaccisCloud has joined #openstack-lbaas00:15
rm_workok well, found one bug00:20
johnsomIn the doc?00:20
rm_workyes00:20
rm_workone sec, finishing up my review00:21
rm_workerr, maybe another00:21
openstackgerritMichael Johnson proposed openstack/octavia master: Updates Octavia to support octavia-lib  https://review.openstack.org/61370900:22
rm_workoh nm, fallout from the first one00:22
openstackgerritMichael Johnson proposed openstack/octavia master: Migrate constants to use octavia-lib - Part 1  https://review.openstack.org/61701500:29
openstackgerritMichael Johnson proposed openstack/octavia master: Migrate constants to use octavia-lib - Part 2  https://review.openstack.org/61705800:29
*** Emine has joined #openstack-lbaas00:34
rm_workok yeah this needs some help00:34
rm_workbut it's close :)00:35
johnsomhmmm, I ran through that step by step00:35
openstackgerritMichael Johnson proposed openstack/octavia-tempest-plugin master: Adds get_amphora_stats to the service client  https://review.openstack.org/58506000:37
openstackgerritMichael Johnson proposed openstack/octavia-tempest-plugin master: Add an active/standby scenario test  https://review.openstack.org/58468100:37
johnsomOh crumb00:37
johnsomOh, nevermind, that is fine.00:38
rm_workposted comments00:41
rm_worki ran into *two* issues00:41
rm_worki was trying to be pretty dumb, so that accounts for one of them, but the other is a legit issue00:41
johnsomOk, looking. Hey, BTW, when you have a chance, can you look at this? https://review.openstack.org/60691800:41
openstackgerritMichael Johnson proposed openstack/octavia master: Adds a simple golang udp server  https://review.openstack.org/62128100:49
rm_workerr johnsom, if the VIP is ipv6, can the user point an ipv4 FLIP at it? does that work?00:51
rm_workdoes it depend on the FLIP implementation?00:51
johnsomNo, neutron doesn't support it00:51
johnsomTechnically there is no reason it could not work, but neutron doesn't support it00:52
rm_workk00:52
*** dmellado has joined #openstack-lbaas00:53
openstackgerritMerged openstack/neutron-lbaas master: Fix the scenario test gates  https://review.openstack.org/62565801:01
rm_workjohnsom: not sure how your run-through of that guide worked, with that naming consistency issue >_>01:03
johnsomrm_work look at the patchset 2 comments. Tobias asked me to change that and I must have fumbled it.01:05
rm_workah01:05
rm_workyep :P01:06
rm_workthat reminds me of the 1000 times i've done a "quick fix" and not re-run pep8 and then cried01:07
johnsomYep01:07
rm_worksuch tears01:07
johnsomI have missed the shame nun while you were gone....01:07
rm_worklol01:07
johnsomrm_work You think a default CN is a good idea???  I guess I can throw in example.org01:18
bzhao__Ehh, I have no idea to make jinja to output '\n', could anybody know and give some help? Thanks..;-)01:19
rm_worki mean01:27
rm_worki don't know01:27
rm_workthat or a comment01:27
rm_workin the doc01:28
openstackgerritMichael Johnson proposed openstack/octavia master: Adds a certificates configuration guide  https://review.openstack.org/61345401:30
johnsombzhao__ Can you give me more context on what you are trying to do?01:30
bzhao__johnsom:  Thanks, I',m trying to implement the http health check based on domain name feature yesterday. And I make the jinja template like:01:33
bzhao__https://usercontent.irccloud-cdn.com/file/UpWu0qk0/image.png01:34
bzhao__This is the output, but I only want the '\r\n' string, seem jinja treat "\n" as a newline. https://usercontent.irccloud-cdn.com/file/w7FWmxMX/image.png01:34
bzhao__I'm doing it based on http://cbonte.github.io/haproxy-dconv/1.8/configuration.html#option%20httpchk .01:36
bzhao__https://www.irccloud.com/pastebin/MpNy3vjp/01:37
bzhao__what a naughty "\n". ;-)01:39
*** hongbin has joined #openstack-lbaas01:42
*** bbbbzhao_ has joined #openstack-lbaas01:44
*** phuoc has joined #openstack-lbaas01:50
johnsombzhao__ This works for me:01:51
johnsom{% set test = "%s foo\\nbar"|format("test") %}01:51
johnsom{{ test }}01:51
johnsomtest foo\nbar01:51
johnsomThat last line is the result. I think that accomplishes what you are trying to do.01:52
bzhao__This is my test. ;-), running the current template and print.. https://usercontent.irccloud-cdn.com/file/ev4FJUpR/image.png01:56
bzhao__I change the macro to : https://usercontent.irccloud-cdn.com/file/ridqGeky/image.png01:57
bzhao__But the output is..., is that some other issue I didnt realized. https://usercontent.irccloud-cdn.com/file/xYhmWYwB/image.png01:58
johnsomThe difference is probably this: https://github.com/openstack/octavia/blob/master/octavia/common/jinja/haproxy/jinja_cfg.py#L11101:59
johnsomI wasn't running with those settings01:59
*** Emine has quit IRC02:00
bzhao__seem this also doesn't work. ;-) https://usercontent.irccloud-cdn.com/file/CkYQb0a5/image.png02:02
johnsomYeah, it would have to be around the {% set } block I think02:02
bzhao__OH, Thanks, let me try again.02:03
johnsomI think that is a bad idea though given the string takes user input. I think we need to come up with another option, or substitute in the \n separate from the user variable setting.02:04
johnsomIt is an important setting so that user input cannot have \n in them and allow a user to inject new haproxy settings.02:06
johnsomexample, if pool.health_monitor.domain_name = 'example.org\noption insecure-haproxy\n'02:07
johnsom<not a true command, but you get the idea02:07
bzhao__Sorry, michael. I'm not follow you, Oh..I know. You mean that user input the domain name "example.org\n" and requests.  Please hold I test with this case as I bring a new paratype for validate domain name.02:10
bzhao__Please wait some seconds.02:11
johnsomWe don't want the user to be able to insert a "\n" string via user input and have it become a newline in the config file.02:11
johnsomThere is also the "safe" filter that tells jinja a string should not be escaped, but again we have to use it very carefully.02:13
johnsomhttps://overiq.com/flask-101/basics-of-jinja-template-language/#escaping02:13
bzhao__Oh, the validator pass this case. https://usercontent.irccloud-cdn.com/file/2PZnT4YE/image.png02:14
johnsombzhao__ I need to go make dinner.  Please message me a link to what you come up with and I will validate it is ok and safe in the morning.02:15
johnsomI think I have given you the pointers you need to move forward.02:15
bzhao__Agree, we need to process internally if user input / not input the para like "example.org\n"02:16
johnsomWell, or just break the jinja template down in a way that all user input is still checked by autoescape and your strings are preserved. I think that is the best case02:17
bzhao__johnsom:  Thanks very much for help. And I think if it can be done, I can continue the last work of  tls_client_cert staff.. ;-)02:17
johnsom+102:17
bzhao__johnsom:  Have a great dinner! ;-) Thank you.02:18
johnsomsomething like: httpchk {{ http_method }} HTTP/{{ http_version }} {{ "\r\n"|safe }}'Host':\ {{domain_name}}02:19
johnsomor even httpchk {{ http_method }} HTTP/{{ http_version }}\r\n Host:\ {{domain_name}}02:20
bzhao__Yeah, I will refactor this part. And make the validator to check the user input not '\n' inject.. I will test them both. ;-) . Thanks micheal. You help me so much.02:23
*** hongbin_ has joined #openstack-lbaas02:28
*** hongbin has quit IRC02:29
*** reedipb has quit IRC02:37
openstackgerritMerged openstack/octavia master: Add missing ws separator between words  https://review.openstack.org/61913702:37
*** psachin has joined #openstack-lbaas02:40
*** hongbin has joined #openstack-lbaas03:20
*** hongbin_ has quit IRC03:21
*** rcernin has quit IRC03:25
*** rcernin has joined #openstack-lbaas03:27
*** rcernin has quit IRC03:28
*** rcernin has joined #openstack-lbaas03:28
*** ramishra has joined #openstack-lbaas03:32
*** hongbin has quit IRC03:43
*** PagliaccisCloud has quit IRC04:31
*** PagliaccisCloud has joined #openstack-lbaas04:36
openstackgerritMerged openstack/octavia master: Tags support for lb resources  https://review.openstack.org/60600604:41
*** PagliaccisCloud has quit IRC05:01
*** sapd1_x has joined #openstack-lbaas05:53
sapd1_xjohnsom: Do we need create VIP port on user tenant/05:55
sapd1_x*?05:55
sapd1_xhttps://github.com/openstack/octavia/blob/master/octavia/network/drivers/neutron/allowed_address_pairs.py#L41005:55
sapd1_xbecause user can see this port and delete this port.05:55
sapd1_xIt makes load balancer will be failed05:55
*** gcheresh_ has joined #openstack-lbaas06:01
*** PagliaccisCloud has joined #openstack-lbaas06:06
*** gcheresh has joined #openstack-lbaas06:13
*** gcheresh_ has quit IRC06:13
*** yboaron has joined #openstack-lbaas06:17
*** PagliaccisCloud has quit IRC06:27
johnsomsapd1_x I agree, this is a problem. We put it in place to allow floating IPs be assigned, but it is bad. I think we need to work towards refactoring this so users cannot access the port. We see many tenants "deleting all" and breaking things they don't expect.06:35
sapd1_xjohnsom: I will fire a story and fix this problem.06:36
johnsomWe may need to add the ability to allocate a FIP via the ocatvia API so we don't expose the port06:36
sapd1_xjohnsom: I think we should allocate this port to tenant service.06:37
*** ccamposr has joined #openstack-lbaas06:48
*** sapd1_x has quit IRC07:10
*** rpittau has joined #openstack-lbaas07:59
*** celebdor has joined #openstack-lbaas08:10
*** celebdor has quit IRC08:10
*** celebdor has joined #openstack-lbaas08:10
*** velizarx has joined #openstack-lbaas08:11
*** yboaron has quit IRC08:23
openstackgerritNir Magnezi proposed openstack/octavia master: Change openstack-dev to openstack-discuss  https://review.openstack.org/62200508:54
openstackgerritCarlos Goncalves proposed openstack/octavia-tempest-plugin master: Fix dependency on requests library version  https://review.openstack.org/62583608:56
cgoncalvesnmagnezi, ^ there08:56
nmagnezicgoncalves, I had a feeling that would be it :)08:57
nmagnezicgoncalves, thanks for this08:57
*** yboaron has joined #openstack-lbaas09:06
*** rcernin has quit IRC09:18
openstackgerritCarlos Goncalves proposed openstack/octavia master: Install HAProxy 1.8 from Software Collections  https://review.openstack.org/62567209:45
openstackgerritCarlos Goncalves proposed openstack/octavia-tempest-plugin master: Fix dependency on requests library version  https://review.openstack.org/62583610:00
*** abaindur has quit IRC10:00
*** salmankhan has joined #openstack-lbaas10:16
*** sapd1_x has joined #openstack-lbaas10:47
*** salmankhan has quit IRC10:52
openstackgerritYang JianFeng proposed openstack/octavia master: Add compute_flavor field for amphora api  https://review.openstack.org/58291410:53
openstackgerritYang JianFeng proposed openstack/octavia master: Add compute_flavor field for amphora api  https://review.openstack.org/58291410:58
*** yamamoto has quit IRC11:01
*** sapd1_x has quit IRC11:15
*** sapd1 has joined #openstack-lbaas11:18
*** sapd1 has quit IRC11:21
*** sapd1 has joined #openstack-lbaas11:22
*** brtknr has quit IRC11:22
*** yangjianfeng has joined #openstack-lbaas11:28
*** yamamoto has joined #openstack-lbaas11:38
*** sapd1 has quit IRC11:44
*** sapd1 has joined #openstack-lbaas11:45
*** sapd1 has quit IRC11:47
*** sapd1 has joined #openstack-lbaas11:48
openstackgerritYang JianFeng proposed openstack/octavia master: Add compute_flavor field for amphora api  https://review.openstack.org/58291411:49
*** yamamoto has quit IRC11:54
*** yamamoto has joined #openstack-lbaas11:54
*** salmankhan has joined #openstack-lbaas11:54
*** yangjianfeng has quit IRC12:01
*** rpittau has quit IRC12:02
*** rpittau has joined #openstack-lbaas12:03
*** PagliaccisCloud has joined #openstack-lbaas12:07
*** rpittau is now known as rpittau|lunch12:08
*** sapd1 has quit IRC12:17
*** salmankhan has quit IRC12:27
*** ramishra has quit IRC12:27
*** salmankhan has joined #openstack-lbaas12:28
*** ramishra has joined #openstack-lbaas12:37
*** brtknr has joined #openstack-lbaas12:46
*** brtknr has quit IRC13:00
*** rpittau|lunch is now known as rpittau13:12
*** brtknr has joined #openstack-lbaas13:13
*** sapd1 has joined #openstack-lbaas13:18
*** ramishra has quit IRC13:22
*** ramishra has joined #openstack-lbaas13:22
*** brtknr has quit IRC13:25
*** brtknr has joined #openstack-lbaas13:25
*** brtknr has quit IRC13:29
*** brtknr has joined #openstack-lbaas13:29
*** velizarx has quit IRC13:30
*** yamamoto has quit IRC13:37
*** yamamoto has joined #openstack-lbaas13:38
*** velizarx has joined #openstack-lbaas13:39
*** yamamoto has quit IRC13:43
*** serhatd has joined #openstack-lbaas13:56
*** velizarx has quit IRC14:12
*** psachin has quit IRC14:12
serhatddo we need provider provider network for managing amphore instances? how can octavia-worker reach amhpora instances? I guess tenant networks are not suitable for this purpose, right?14:12
*** velizarx has joined #openstack-lbaas14:13
*** PagliaccisCloud has quit IRC14:20
*** yamamoto has joined #openstack-lbaas14:22
*** brtknr has quit IRC14:27
*** brtknr has joined #openstack-lbaas14:27
*** velizarx has quit IRC14:28
sapd1serhatd: yes. You can use tenant network with type: gre or vxlan for amphora management network.14:29
*** amuller has joined #openstack-lbaas14:32
serhatdsapd: you say octavia-worker(which is in management network) will be able to reach amphora instances in tenant network?14:37
serhatdsapd: btw we are using vlan tenant networks14:38
*** ramishra_ has joined #openstack-lbaas14:54
*** ramishra has quit IRC14:56
*** ramishra_ has quit IRC15:27
*** gcheresh has quit IRC15:28
*** fnaval has joined #openstack-lbaas15:53
sapd1serhatd: Yes. You can using a vlan for this network. Just create network15:58
sapd1serhatd: allow vlan for octavia-worker node. and add sub port.15:59
serhatdsapd1: do know any configuration guide that explains that steps? I am little confused:) not sure how can i add port to octavia-worker containers :)16:14
serhatdsapd1: I guess need to add subport health-managers too16:15
sapd1yes.16:15
sapd1serhatd: you are running worker and healthmanager inside container16:15
serhatdyep16:16
sapd1with healthmanager , bind container port to host port16:16
sapd1octavia-agent is not need reach octavia-worker16:16
sapd1octavia-worker will call octavia-agent.16:16
*** spa-87 has joined #openstack-lbaas16:26
*** ccamposr has quit IRC16:44
*** dayou has quit IRC17:01
*** rpittau has quit IRC17:06
*** yboaron has quit IRC17:08
*** dayou has joined #openstack-lbaas17:17
*** spa-87 has quit IRC17:20
*** serhatd has quit IRC17:33
openstackgerritGerman Eichberger proposed openstack/octavia stable/queens: Fix health manager performance regression  https://review.openstack.org/61738517:36
*** salmankhan has quit IRC17:37
*** gcheresh has joined #openstack-lbaas18:03
*** sapd1 has quit IRC18:08
*** fnaval has quit IRC18:16
*** PagliaccisCloud has joined #openstack-lbaas18:20
*** gcheresh has quit IRC18:49
*** celebdor has quit IRC19:14
*** celebdor has joined #openstack-lbaas19:16
*** salmankhan has joined #openstack-lbaas19:34
*** salmankhan has quit IRC19:39
colby_Hey is it possible to trigger the build of a backup node on a load balancer that was created before we switched to always create a backup?19:50
*** abaindur has joined #openstack-lbaas20:19
rm_workcolby_: you mean switch a LB from SINGLE to ACTIVE_STANDBY topology?20:21
rm_workjohnsom / cgoncalves / xgerman could I beg a review for https://review.openstack.org/#/c/610284/ ? :)20:45
rm_workxgerman: an ipv6 gate?20:47
rm_workthat is what johnsom is working on i suppose -- but i did add unit tests to cover this20:48
rm_workactually i added unit tests that cover more than even what was changed :P20:48
xgermanyeah, without a gate I am not sure if it works… code looks reasonable though but didn’t want to be the first to +2 without proper testing20:48
rm_workyeah20:48
rm_workif you pull it down you can run the new unit test `test_write_vip_interface_file` with and without the change to the osutils.py20:49
rm_workand you can see what the issue is and how this resolves it20:49
rm_workit took me a minute to grasp exactly what the problem was, without having a test to illustrate it]20:49
*** PagliaccisCloud has quit IRC21:04
rm_workhmm, gonna make a slight tweak anyway21:06
openstackgerritAdam Harwell proposed openstack/octavia master: Fix prefix for vip_ipv6  https://review.openstack.org/61028421:07
johnsomThere are IPv6 gates: https://review.openstack.org/611980 and https://review.openstack.org/611405 just stuck waiting for reviews....21:08
openstackgerritMichael Johnson proposed openstack/octavia master: Updates Octavia to support octavia-lib  https://review.openstack.org/61370921:17
johnsomThere, coverage even for the silly cmd file....21:17
*** amuller has quit IRC21:17
*** gcheresh has joined #openstack-lbaas21:20
*** rcernin has joined #openstack-lbaas21:22
rm_workwell, it would be good if those gates were passing, johnsom :P21:26
johnsomWhat? they aren't now?  Argh. I saw the active/standby gate also bit-rot'd21:26
rm_workit's the stables, it seems21:26
rm_workstable-scenario21:27
johnsomOh, yeah, the IPv6 patches have to be backported21:27
rm_workis that... maybe because it's actually broken there? lol21:27
rm_workthey were21:27
rm_workmaybe the recheck will take care of it21:27
rm_workmight not have been done by the time it ran last21:27
johnsomYeah, it hasn't run the tests since the 6th when I know they were not backported yet21:27
rm_workthen maybe can merge that today :)21:27
colby_rm_work: yes. I was trying to avoid having to recreate21:28
rm_workthe one after it was failing all kinds of things but ... maybe it'll be ok too? dunno, more dubious on that one21:28
rm_workcolby_: yes, I have done it, theoretically possible if you are willing to muck around in the DB and do things no sane person should attempt :)21:28
johnsomSweet, they were all backported, so yes, this should be good to go21:29
rm_workcolby_: i was trying to do a PoC migration script but got stalled by it being crazy21:29
rm_worki felt a little like a magician attempting a trick with the warning "don't do this at home"21:29
colby_rm_work: sure I have no problem messing with db. Worst case scenario we have to recreate the lb anyways21:29
rm_workyeah21:29
rm_workso, what you can do21:30
rm_workduplicate the single amphora entry for the LB (giving it a new `id` field, obviously) and set the compute_id and vrrp_port_id to random new uuids as well21:31
rm_workset it as BACKUP and the original as MASTER21:31
rm_workchange the LB's topology to ACTIVE_STANDBY21:31
rm_workupdate the priority field to also match what MASTER/BACKUP amps should have21:31
rm_worklike, 90 and 10021:31
colby_out of curiosity too. It would be cool if you could decide on having active/standby per load balancer instead of them all having it. Is that something that is being looked at?21:32
rm_workand then trigger a failover on the new fake BACKUP amp21:32
rm_workcolby_: that will be possible with Flavors21:32
rm_workyou can choose a SINGLE topo flavor, or an ACTIVE_STANDBY topo flavor21:32
colby_oh nice. What version will that be enabled?21:32
rm_worki think johnsom is hoping to have it done for stein?21:33
rm_workthe initial patches for it are up for review21:33
colby_not all our users need HA, and Id rather not waste compute resources if not needed21:33
rm_workyeah, soon21:34
colby_thanks for the info on the standby migration. Maybe its just easier to recreate :-) might actually be fewer steps21:34
johnsomYeah, this is a committed Stein feature21:34
johnsomflavors that is21:34
rm_workcolby_: most definitely yes21:34
rm_worklol21:34
colby_thanks!21:35
rm_workdoing LB surgery like that in the DB is not for the faint of heart21:35
rm_worksometimes when I do things like that, I feel shame21:35
colby_haha21:36
rm_workbut also like a mad scientist21:36
*** rcernin has quit IRC21:37
*** gcheresh has quit IRC21:38
johnsomOk, sent out the e-mails cancelling the IRC meeting on the 26th and reminding folks that the neutron-lbaas/Octavia v1 API retirement is coming up in September 2019.22:00
*** rcernin has joined #openstack-lbaas22:04
*** yboaron has joined #openstack-lbaas22:16
cgoncalves\o/22:17
cgoncalvesFYI, I will probably not be able to attend tomorrow's meeting either, sorry22:18
johnsomOk, NP. I expect it to be semi-short. I have put an agenda up.22:18
*** celebdor has quit IRC22:32
*** rcernin has quit IRC22:37
*** rcernin has joined #openstack-lbaas22:41
*** rcernin has quit IRC22:43
*** rcernin has joined #openstack-lbaas22:45
openstackgerritMerged openstack/octavia master: Add compute_flavor field for amphora api  https://review.openstack.org/58291422:46
openstackgerritGerman Eichberger proposed openstack/octavia master: Amphora logging  https://review.openstack.org/62483522:46
*** yboaron has quit IRC22:56
*** ccamposr has joined #openstack-lbaas23:08
openstackgerritMichael Johnson proposed openstack/octavia-tempest-plugin master: Add traffic tests using an IPv6 VIP  https://review.openstack.org/61198023:42
johnsomrm_work Passed: https://review.openstack.org/#/c/611405/23:50
rm_worknoice23:50
rm_work+223:51
johnsomThe second one had a bug, so I'm looking at it23:51
rm_workkk23:51
johnsomMissed a noop test23:51
rm_workwas just gonna ask, since you posted another patchset23:51
johnsomYeah, it was trying to lookup a subnet even though it was running noop...23:51
rm_workxgerman: want to merge that one ^^ so you can have the gate you asked for on my other patch? :P23:51
rm_workah i guess we'll need both before that's technically true23:52
johnsomYeah, that first one is half the test suite23:52

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!