| gmann | johnsom: this is passing now https://review.opendev.org/c/openstack/octavia/+/925532 | 03:49 |
|---|---|---|
| johnsom | gmann There is no depends-on for that patch. It passes unit tests, but not functional. I have been working to track down the functional test issues, but still WIP | 03:51 |
| johnsom | It doesn't seem to be the scope, but some issue with the new defaults and the layering of roles. | 03:52 |
| gmann | johnsom: ohk, I see now. this is why this is failing - https://review.opendev.org/c/openstack/octavia/+/925625 | 03:53 |
| johnsom | If you need it merged for UC, we can merge this and work to fix the functionals in. a follow on. | 03:53 |
| johnsom | Yeah, I have been working on it | 03:53 |
| gmann | I think I will avoid merging the u-c if we have know failure. let's wait | 03:53 |
| gmann | johnsom: thanks, let's wait | 03:54 |
| johnsom | Ok, feel free to ping me if we are holding things up. | 03:54 |
| gmann | sure | 03:54 |
| opendevreview | Gregory Thiemonge proposed openstack/octavia master: Add spec for custom SGs on VIP ports https://review.opendev.org/c/openstack/octavia/+/915114 | 09:59 |
| *** tkajinam is now known as Guest2415 | 12:52 | |
| *** tkajinam is now known as Guest2416 | 13:00 | |
| noonedeadpunk | hey folks. I was looking through some small bugs in ovn_octavia_provider and spotted that thing in octavia code: https://opendev.org/openstack/octavia/src/branch/master/octavia/common/clients.py#L82 | 14:52 |
| noonedeadpunk | How that does not break right away, given there's no such option registered for the group? | 14:53 |
| noonedeadpunk | https://opendev.org/openstack/octavia/src/branch/master/octavia/common/config.py#L759-L781 | 14:53 |
| noonedeadpunk | what am I missing? | 14:53 |
| gthiemonge | noonedeadpunk: hey | 15:01 |
| gthiemonge | noonedeadpunk: I think this stuff https://opendev.org/openstack/octavia/src/branch/master/octavia/common/config.py#L922-L930 | 15:01 |
| gthiemonge | noonedeadpunk: adds more options for the neutron group (options defined by keystone auth) | 15:01 |
| noonedeadpunk | ah | 15:01 |
| noonedeadpunk | I overlooked it | 15:02 |
| noonedeadpunk | just saw that glance/nova/etc still have these options and got slightly confused | 15:02 |
| noonedeadpunk | thanks! | 15:02 |
| gthiemonge | https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/loading/adapter.py#L187 | 15:02 |
| gthiemonge | we recently removed them from config.py to use the dynamic registration from keystonauth | 15:03 |
| gthiemonge | recently == ~2 cycles ago | 15:04 |
| noonedeadpunk | so basically now neutron group might be empty and it will just use opts from [service_auth], right? | 15:09 |
| noonedeadpunk | or well... it will rather propogate options to the neutron group? | 15:11 |
| gthiemonge | yes, this is the idea, the default are in [service_auth], but you can override them in [neutron] | 15:12 |
| gthiemonge | #startmeeting Octavia | 16:00 |
| opendevmeet | Meeting started Wed Aug 7 16:00:17 2024 UTC and is due to finish in 60 minutes. The chair is gthiemonge. Information about MeetBot at http://wiki.debian.org/MeetBot. | 16:00 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 16:00 |
| opendevmeet | The meeting name has been set to 'octavia' | 16:00 |
| gthiemonge | o/ | 16:00 |
| tweining | o/ | 16:00 |
| johnsom | o/ | 16:00 |
| gthiemonge | #topic Announcements | 16:01 |
| gthiemonge | * 2024.2 Dalmatian Release Schedule | 16:01 |
| gthiemonge | just a heads-up | 16:01 |
| gthiemonge | Dalmatian-3 milestone is in 3 weeks (feature freeze) | 16:01 |
| gthiemonge | we made good progress, the LB resize spec was merged | 16:01 |
| gthiemonge | let's continue ;-) https://etherpad.opendev.org/p/octavia-priority-reviews | 16:02 |
| tweining | well, a little progress I'd say | 16:02 |
| tweining | something that slows progress really down if people don't follow up after updates IMO | 16:04 |
| gthiemonge | you mean when you comment a review or when you update your reviews? | 16:06 |
| tweining | I mean when someone updates the change after you commented you should review again soon | 16:06 |
| johnsom | Our review backlog is pretty big, so I know it takes me a bit to come back around for re-reviews | 16:07 |
| tweining | I don't want to sound like a broken record as I complained about it before, but I think it's also a good idea to keep an eye on changes that have a single CR+2 | 16:08 |
| johnsom | Looking at the review list, that isn't many.... | 16:09 |
| tweining | it's not many, but they are open for a long time. | 16:10 |
| tweining | there are more annoncements, right? | 16:11 |
| gthiemonge | I'll take a look at those patches | 16:12 |
| gthiemonge | no tha'ts it | 16:12 |
| gthiemonge | #topic New oslo.policy version | 16:12 |
| gthiemonge | johnsom: ^ | 16:13 |
| tweining | I've read something about the upcoming election season on the ml | 16:13 |
| gthiemonge | yeah I think it starts next week | 16:13 |
| johnsom | So oslo.policy 4.4.0 is proposed for addition to upper-constraints. | 16:13 |
| tweining | probably not relevant since Octavia has a BDFL already ;) | 16:13 |
| johnsom | This version sets "new defaults" and "scope" to True by default. | 16:14 |
| johnsom | The catch is "scope" to True will now cause any use of a system scoped token to be an Error | 16:14 |
| johnsom | This is requiring some adjustments in unit and functional tests. With the latest patch posted, the unit tests are fixed, but functional tests are failing with 4.4 | 16:15 |
| johnsom | I'm not 100% sure why yet as it doesn't seem to be a scope problem. | 16:15 |
| johnsom | For example, getting the quota defaults now fails with loadbalancer_member role, but passes with loadbalancer_admin. | 16:16 |
| johnsom | I am working to track that down. | 16:16 |
| johnsom | #link https://review.opendev.org/c/openstack/octavia/+/925532 | 16:16 |
| johnsom | This is the patch that resolves the unit tests (enough to unblock the UC merge) | 16:17 |
| johnsom | This patch shows the functional issues: https://review.opendev.org/c/openstack/octavia/+/925625 | 16:17 |
| johnsom | That is the summary of the new SRBAC breakage/changes | 16:18 |
| tweining | that doesn't sound like fun | 16:19 |
| johnsom | I am just burned out dealing with this stuff frankly | 16:19 |
| gthiemonge | johnsom: do you need help for these functional tests? | 16:19 |
| johnsom | Not yet, let me keep poking at it | 16:19 |
| gthiemonge | it's already late for me today, but I can take a look tomorrow morning | 16:19 |
| johnsom | My current theory is this is causing the problems: https://github.com/openstack/octavia/blob/master/octavia/policies/base.py#L25 | 16:20 |
| johnsom | I.e. interactions with our Advanced RBAC and the "new defaults" changes | 16:20 |
| johnsom | Well, those two "deprecated" rules | 16:21 |
| gthiemonge | can we remove them? | 16:21 |
| gthiemonge | deprecated since W | 16:21 |
| johnsom | I think that 4.4 is essentially removing them and causing the failures | 16:21 |
| gthiemonge | johnsom: please update me when you're done today, I may continue tomorrow | 16:24 |
| johnsom | Ack | 16:24 |
| gthiemonge | thanks for the update on this topic | 16:24 |
| gthiemonge | I'm going to skip CI status: no update | 16:25 |
| gthiemonge | #topic Brief progress reports / bugs needing review | 16:25 |
| johnsom | Well, one item there is CentOS 9 Stream is broken with devstack due to missing rabbitmq RPMs | 16:25 |
| gthiemonge | oh right | 16:26 |
| gthiemonge | it's on devstack, right? | 16:27 |
| johnsom | Yeah, devstack blows up | 16:27 |
| gthiemonge | I'm wondering if it impacts rockylinux jobs | 16:29 |
| johnsom | I don't know. I doubt it | 16:30 |
| gthiemonge | https://zuul.opendev.org/t/openstack/builds?job_name=octavia-v2-dsvm-scenario-centos-9-stream&project=openstack/octavia | 16:32 |
| gthiemonge | interesting, the package was succesfully installed 2 days ago | 16:33 |
| gthiemonge | I'll try to follow up | 16:34 |
| johnsom | Yeah, odd | 16:34 |
| gthiemonge | FYI I proposed a fix for a bug in octavia-dashboard when using multi-region (with some multiple keystone instances) | 16:35 |
| gthiemonge | https://review.opendev.org/c/openstack/octavia-dashboard/+/925672 | 16:35 |
| gthiemonge | I also proposed the new etcd jobboard plugin for Octavia | 16:36 |
| gthiemonge | it includes a jobboard_etcd job in the experimental jobs | 16:36 |
| gthiemonge | https://review.opendev.org/c/openstack/octavia/+/915834 | 16:36 |
| opendevreview | Merged openstack/octavia-dashboard master: Remove old excludes https://review.opendev.org/c/openstack/octavia-dashboard/+/917600 | 16:36 |
| tweining | there is an indirect relation in the patch chain, so I guess the others in the chain need to be rebased | 16:38 |
| opendevreview | Merged openstack/octavia-dashboard master: Bump hacking https://review.opendev.org/c/openstack/octavia-dashboard/+/917601 | 16:38 |
| opendevreview | Gregory Thiemonge proposed openstack/octavia master: Update amphorav2/jobboard doc https://review.opendev.org/c/openstack/octavia/+/923763 | 16:39 |
| gthiemonge | done | 16:39 |
| gthiemonge | https://review.opendev.org/c/openstack/devstack/+/925400 was merged this morning, maybe it fixes the rabbitmq issue (devstack-platform-centos-9-stream passed) | 16:42 |
| gthiemonge | #topic Open Discussion | 16:42 |
| tweining | https://review.opendev.org/c/openstack/octavia/+/923318 should we talk about the rate limiting spec proposal? | 16:42 |
| gthiemonge | yes | 16:43 |
| gthiemonge | a few thoughts: | 16:43 |
| gthiemonge | the octavia resources are usually created by passing the ID of their parents (a pool is attached to a listner, a listenr to LB, a l7policy to a listener, etc..) | 16:44 |
| gthiemonge | in this spec, it's a bit different, the resource is created, then we need to call the listener api to add the resource to the listener | 16:45 |
| gthiemonge | I'm wondering we should be more consistent and do something similar (create with parent) | 16:45 |
| gthiemonge | note: pools can be created with or without parent, and associated with a listener later | 16:46 |
| johnsom | Yeah, resources have to be tied to *something* for the correct project_id relationship, etc. That is why if a shared L7 policy is created unbound to the listener, it must be bound to the LB | 16:46 |
| tweining | I don't have a strong opinion about that other than that it would be mainly a consistency issue it seems. | 16:46 |
| tweining | that is a very good point then, because that is not the case with the proposal. the rules can be created independent from everything else | 16:48 |
| gthiemonge | https://github.com/openstack/octavia/blob/master/octavia/api/v2/controllers/l7policy.py#L129 | 16:50 |
| johnsom | I guess I meant shared pools, not l7 | 16:50 |
| gthiemonge | yeah project_ids are inherited from the LB | 16:51 |
| johnsom | The ID of the listener for the pool. Either listener_id or loadbalancer_id must be specified. | 16:51 |
| johnsom | From the API ref | 16:51 |
| johnsom | Yeah, l7 policy requires an listener ID | 16:52 |
| tweining | well, the project_id is an attribute of the rule ATM. So I should change that to listener_id then I guess | 16:52 |
| tweining | not sure if we should allow multiple listener_ids | 16:53 |
| johnsom | Typically we want a project ID on all objects. It simplifies the RBAC and database queries | 16:53 |
| gthiemonge | you can keep project_id, it's always included in user defined resources | 16:53 |
| johnsom | Yeah, adding the listener ID the policy/rule is bound to is what I would expect to se | 16:54 |
| johnsom | see | 16:54 |
| tweining | does it make sense to you to share a rule with multiple listeners? | 16:55 |
| johnsom | I don't see a reply to my last comment and I think there was a revision that dropped having split action and rule, is that correct? So you can't do "AND" rule logic anylonger? | 16:55 |
| tweining | yeah, previously the action was part of a policy, which no longer exist. action is now part of the rule | 16:56 |
| johnsom | Why would we limit the ability to do AND with multiple rules on a policy? | 16:57 |
| tweining | if you have multiple rules they will still be ANDed AFAICT | 16:58 |
| johnsom | That would be an OR right? | 16:59 |
| * johnsom maybe I need to get my second cup of coffee this morning | 17:00 | |
| tweining | ah, you AND in the sense that all rules need to be violated to it to rate limit | 17:00 |
| tweining | *you mean | 17:00 |
| tweining | mmh, honestly I never thought of it that way | 17:00 |
| johnsom | Right, one policy "DROP" when BYTES AND REQUESTS exceed x | 17:01 |
| johnsom | or x and y respectfully | 17:01 |
| johnsom | That is how the l7 policies are setup I think | 17:01 |
| tweining | ok, understood. I am not sure if such AND behavior can be done with HAProxy. I think it does OR normally | 17:02 |
| gthiemonge | maybe we can describe some use cases in the review, and re-think about it | 17:03 |
| tweining | +1 good idea | 17:04 |
| johnsom | +1 | 17:04 |
| johnsom | use cases == tests. good stuff | 17:05 |
| gthiemonge | ok, let's do that | 17:05 |
| gthiemonge | anything else for today? | 17:05 |
| tweining | not from me | 17:05 |
| johnsom | https://docs.haproxy.org/dev/configuration.html#7.2 | 17:06 |
| johnsom | Nothing else from me this week | 17:06 |
| tweining | thanks | 17:06 |
| gthiemonge | ok! thank you guys! | 17:07 |
| gthiemonge | #endmeeting | 17:07 |
| opendevmeet | Meeting ended Wed Aug 7 17:07:04 2024 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 17:07 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/octavia/2024/octavia.2024-08-07-16.00.html | 17:07 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/octavia/2024/octavia.2024-08-07-16.00.txt | 17:07 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/octavia/2024/octavia.2024-08-07-16.00.log.html | 17:07 |
| opendevreview | Michael Johnson proposed openstack/octavia master: Fix tests for oslo.policy new defaults enable by default https://review.opendev.org/c/openstack/octavia/+/925532 | 21:29 |
| johnsom | gthiemonge https://review.opendev.org/c/openstack/octavia/+/925532 fixes the functional test issues. our test roles didn't include "member" | 21:30 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!