Friday, 2014-06-27

*** banix has joined #openstack-meeting-300:03
*** jackib has joined #openstack-meeting-300:03
*** sarob has quit IRC00:04
*** zehicle_at_dell has joined #openstack-meeting-300:09
*** jackib has quit IRC00:09
*** banix has quit IRC00:11
*** seizadi has joined #openstack-meeting-300:18
*** markmcclain1 has quit IRC00:20
*** lenrow has quit IRC00:20
*** yamamoto has joined #openstack-meeting-300:24
*** garyduan has joined #openstack-meeting-300:29
*** yamamoto has quit IRC00:29
*** jackib has joined #openstack-meeting-300:29
*** seizadi has quit IRC00:30
*** sarob has joined #openstack-meeting-300:33
*** cjellick_ has joined #openstack-meeting-300:33
*** cjellick has quit IRC00:37
*** garyduan has quit IRC00:37
*** cjellick_ has quit IRC00:38
*** sarob has quit IRC00:43
*** sarob has joined #openstack-meeting-300:47
*** nati_ueno has quit IRC00:50
*** nati_ueno has joined #openstack-meeting-300:50
*** yamamoto has joined #openstack-meeting-300:51
*** mfer has quit IRC00:54
*** mfer has joined #openstack-meeting-300:55
*** Sukhdev has quit IRC00:59
*** mfer has quit IRC01:00
*** banix has joined #openstack-meeting-301:06
*** TravT has quit IRC01:06
*** zehicle_at_dell has quit IRC01:10
*** yamamoto has quit IRC01:12
*** jackib has quit IRC01:19
*** sarob has quit IRC01:36
*** sarob has joined #openstack-meeting-301:37
*** seizadi has joined #openstack-meeting-301:39
*** nati_ueno has quit IRC01:39
*** sarob has quit IRC01:42
*** seizadi has quit IRC01:53
*** sarob has joined #openstack-meeting-301:55
*** prad_ has quit IRC01:58
*** eghobo has quit IRC02:38
*** sankarshan_away is now known as sankarshan02:45
*** carl_baldwin has joined #openstack-meeting-302:46
*** banix has quit IRC02:51
*** kenhui has joined #openstack-meeting-302:53
*** banix has joined #openstack-meeting-303:15
*** nati_ueno has joined #openstack-meeting-303:19
*** ivar-lazzaro has quit IRC03:21
*** kenhui has quit IRC03:29
*** garyduan has joined #openstack-meeting-303:35
*** garyduan has quit IRC03:40
*** kenhui has joined #openstack-meeting-303:43
*** yamamoto has joined #openstack-meeting-303:54
*** eghobo has joined #openstack-meeting-303:55
*** kenhui has quit IRC03:57
*** kenhui has joined #openstack-meeting-303:59
*** amitpp has joined #openstack-meeting-303:59
*** kenhui has quit IRC04:06
*** seizadi has joined #openstack-meeting-304:10
*** zehicle_at_dell has joined #openstack-meeting-304:10
*** eghobo has quit IRC04:16
*** banix has quit IRC04:17
*** zehicle_at_dell has quit IRC04:20
*** zehicle_at_dell has joined #openstack-meeting-304:21
*** carl_baldwin has quit IRC04:26
*** sarob has quit IRC04:28
*** sarob has joined #openstack-meeting-304:28
*** sarob has quit IRC04:32
*** eghobo has joined #openstack-meeting-304:46
*** SumitNaiksatam has joined #openstack-meeting-304:49
*** sarob_ has joined #openstack-meeting-304:58
*** sarob_ has quit IRC05:02
*** coolsvap|afk is now known as coolsvap05:22
*** ivar-lazzaro has joined #openstack-meeting-305:25
*** ivar-lazzaro has quit IRC05:30
*** yamamoto has quit IRC05:32
*** nelsnelson has quit IRC05:32
*** eghobo has quit IRC05:38
*** eghobo has joined #openstack-meeting-305:38
*** zehicle_at_dell has quit IRC05:48
*** sarob has joined #openstack-meeting-305:58
*** sarob has quit IRC06:02
*** seizadi has quit IRC06:03
*** eguz has joined #openstack-meeting-306:06
*** eghobo has quit IRC06:10
*** ivar-lazzaro has joined #openstack-meeting-306:13
*** ivar-lazzaro has quit IRC06:18
*** yamamoto has joined #openstack-meeting-306:19
*** enykeev has joined #openstack-meeting-306:23
*** jcoufal has joined #openstack-meeting-306:54
*** mrunge has joined #openstack-meeting-307:10
*** eguz has quit IRC07:15
*** devvesa has joined #openstack-meeting-307:26
*** devvesa has left #openstack-meeting-307:26
*** zz_johnthetubagu is now known as johnthetubaguy07:59
*** sarob has joined #openstack-meeting-308:00
*** MaxV has joined #openstack-meeting-308:02
*** sarob has quit IRC08:04
*** nacim has joined #openstack-meeting-308:05
*** safchain has joined #openstack-meeting-308:24
*** ttrifonov_zZzz is now known as ttrifonov08:32
*** lsmola has joined #openstack-meeting-308:49
*** nati_ueno has quit IRC08:49
*** ttrifonov is now known as ttrifonov_zZzz08:51
*** lsmola has quit IRC08:52
*** yamamoto has quit IRC08:55
*** igordcard has joined #openstack-meeting-308:58
*** ttrifonov_zZzz is now known as ttrifonov08:59
*** ttrifonov is now known as ttrifonov_zZzz09:00
*** sarob has joined #openstack-meeting-309:00
*** ttrifonov_zZzz is now known as ttrifonov09:01
*** sarob has quit IRC09:05
*** ttrifonov is now known as ttrifonov_zZzz09:07
*** MaxV has quit IRC09:16
*** MaxV has joined #openstack-meeting-309:18
*** nati_ueno has joined #openstack-meeting-310:00
*** sarob has joined #openstack-meeting-310:02
*** nati_ueno has quit IRC10:05
*** sarob has quit IRC10:06
*** yamahata has quit IRC10:09
*** coolsvap is now known as coolsvap|afk10:28
*** MaxV_ has joined #openstack-meeting-310:37
*** MaxV has quit IRC10:37
*** sarob has joined #openstack-meeting-311:03
*** sarob has quit IRC11:08
*** ttrifonov_zZzz is now known as ttrifonov11:09
*** salv-orlando has quit IRC11:20
*** julim has joined #openstack-meeting-311:21
*** banix has joined #openstack-meeting-311:22
*** johnthetubaguy is now known as zz_johnthetubagu11:37
*** banix has quit IRC11:47
*** ttrifonov is now known as ttrifonov_zZzz11:58
*** sankarshan is now known as sankarshan_away12:02
*** sarob has joined #openstack-meeting-312:05
*** sarob has quit IRC12:09
*** amitpp has quit IRC12:16
*** zz_johnthetubagu is now known as johnthetubaguy12:18
*** erecio has joined #openstack-meeting-312:21
*** alexpilotti has joined #openstack-meeting-312:30
*** jackib has joined #openstack-meeting-312:39
*** nacim has quit IRC12:44
*** nacim has joined #openstack-meeting-312:44
*** MaxV_ has quit IRC12:45
*** MaxV has joined #openstack-meeting-312:47
*** erecio has quit IRC12:54
*** erecio has joined #openstack-meeting-312:55
*** sarob has joined #openstack-meeting-313:06
*** jackib has quit IRC13:10
*** sarob has quit IRC13:10
*** thomasem has joined #openstack-meeting-313:14
*** lblanchard has joined #openstack-meeting-313:15
*** nati_ueno has joined #openstack-meeting-313:15
*** mfer has joined #openstack-meeting-313:19
*** nacim has quit IRC13:37
*** banix has joined #openstack-meeting-313:40
*** jackib has joined #openstack-meeting-313:47
*** peristeri has joined #openstack-meeting-313:48
*** prad_ has joined #openstack-meeting-313:52
*** seizadi has joined #openstack-meeting-313:54
*** enykeev has quit IRC14:11
*** jaypipes is now known as leakypipes14:15
*** nati_ueno has quit IRC14:17
*** kenhui has joined #openstack-meeting-314:18
*** MaxV has quit IRC14:24
*** otherwiseguy has joined #openstack-meeting-314:25
*** MaxV has joined #openstack-meeting-314:26
*** seizadi has quit IRC14:26
*** seizadi has joined #openstack-meeting-314:27
*** nelsnelson has joined #openstack-meeting-314:32
*** seizadi has quit IRC14:35
*** thomasem has quit IRC14:38
*** dansmith is now known as superdan14:43
*** shakamunyi has joined #openstack-meeting-314:53
*** otherwiseguy has quit IRC14:58
*** mrunge has quit IRC14:59
*** carl_baldwin has joined #openstack-meeting-315:02
*** sarob has joined #openstack-meeting-315:03
*** salv-orlando has joined #openstack-meeting-315:03
*** jackib has quit IRC15:05
*** nacim has joined #openstack-meeting-315:05
*** thomasem has joined #openstack-meeting-315:09
*** cjellick has joined #openstack-meeting-315:16
*** cjellick has quit IRC15:16
*** cjellick has joined #openstack-meeting-315:16
*** otherwiseguy has joined #openstack-meeting-315:24
*** thomasem_ has joined #openstack-meeting-315:28
*** thomasem_ has quit IRC15:28
*** thomasem_ has joined #openstack-meeting-315:28
*** david-lyle has joined #openstack-meeting-315:29
*** thomasem has quit IRC15:30
*** nacim has quit IRC15:35
*** igordcard has quit IRC15:39
*** erw has quit IRC15:49
*** erw has joined #openstack-meeting-315:50
*** amitpp has joined #openstack-meeting-315:51
*** armax has joined #openstack-meeting-315:51
*** yamamoto has joined #openstack-meeting-315:51
*** pballand has joined #openstack-meeting-315:59
*** eghobo has joined #openstack-meeting-316:04
*** erecio has quit IRC16:04
*** eghobo has quit IRC16:04
*** eghobo has joined #openstack-meeting-316:05
*** johnthetubaguy is now known as zz_johnthetubagu16:05
*** devlaps has joined #openstack-meeting-316:11
*** jcoufal has quit IRC16:12
*** shakamunyi has quit IRC16:28
*** MaxV has quit IRC16:31
*** markmcclain has joined #openstack-meeting-316:36
*** otherwiseguy has quit IRC16:36
*** markmcclain1 has joined #openstack-meeting-316:37
*** markmcclain1 has quit IRC16:38
*** markmcclain1 has joined #openstack-meeting-316:39
*** markmcclain has quit IRC16:40
*** markmcclain1 has quit IRC16:46
*** safchain has quit IRC16:51
*** sarob has quit IRC16:52
*** zehicle_at_dell has joined #openstack-meeting-316:54
*** yamamoto_ has joined #openstack-meeting-316:55
*** ivar-lazzaro has joined #openstack-meeting-316:56
*** yamamoto_ has quit IRC16:57
*** ivar-lazzaro has quit IRC17:01
*** ivar-lazzaro has joined #openstack-meeting-317:04
*** markmcclain has joined #openstack-meeting-317:05
*** TravT has joined #openstack-meeting-317:05
*** zehicle_at_dell has quit IRC17:05
*** garyduan has joined #openstack-meeting-317:06
*** ijw has joined #openstack-meeting-317:12
*** thomasem has joined #openstack-meeting-317:13
*** MaxV has joined #openstack-meeting-317:15
*** yisun has joined #openstack-meeting-317:16
*** thomasem_ has quit IRC17:17
*** seizadi has joined #openstack-meeting-317:21
*** s3wong has joined #openstack-meeting-317:25
s3wong#endmeeting17:26
*** sarob has joined #openstack-meeting-317:27
mesteryEveryone here for the flavor meeting?17:29
enikanorovyep17:29
mesteryenikanorov: Howdy!17:29
enikanorovhi Kyle!17:29
banixmestery: hi17:29
markmcclainhi17:29
garyduanHi17:29
SumitNaiksatamhi17:30
*** seizadi has quit IRC17:30
*** seizadi has joined #openstack-meeting-317:30
SumitNaiksatami will let people know on -neutron that we are having the meeting here17:30
mesteryLooks like we have mostly a quorm, I'll get started then!17:30
*** LouisF has joined #openstack-meeting-317:30
s3wonghello17:30
mesteryGoing to put this meeting under the Adv Svcs banner show the logs show up there.17:30
*** seizadi has quit IRC17:30
mestery#startmeeting Networking Advanced Services17:30
openstackMeeting started Fri Jun 27 17:30:35 2014 UTC and is due to finish in 60 minutes.  The chair is mestery. Information about MeetBot at http://wiki.debian.org/MeetBot.17:30
openstackUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.17:30
*** openstack changes topic to " (Meeting topic: Networking Advanced Services)"17:30
openstackThe meeting name has been set to 'networking_advanced_services'17:30
mestery#topic Flavor Framework Conclusions17:30
*** openstack changes topic to "Flavor Framework Conclusions (Meeting topic: Networking Advanced Services)"17:30
mesteryHopefully by now most people ahve read both proposals from enikanorov and markmcclain.17:31
*** seizadi has joined #openstack-meeting-317:31
SumitNaiksatammestery: yes17:31
mesteryWhat I'd like to see here is we come to an agreement on these which moves us forward for Juno.17:31
SumitNaiksatammarkmcclain: thanks for posting yours17:31
mesterymarkmcclain: Yes, thanks for posting that!17:31
dougwighi17:31
*** andyshi_ has joined #openstack-meeting-317:31
SumitNaiksatammestery: +117:31
markmcclainsorry it took so long.. connectivity in west montana wasn't so good :)17:31
mesteryI think banix and enikanorov made some good attempts at summarizing hte key differences between the proposals in comments on markmcclain's spec.17:32
mesteryI think first of all, we're all in agreement we want flavors in Juno, right? :)17:32
*** yamamoto has quit IRC17:32
SumitNaiksatammestery: yes! :-)17:32
enikanorovyes17:32
garyduanyes17:32
SumitNaiksatammestery: +2, A17:33
*** pgpus has joined #openstack-meeting-317:33
banixyes17:33
markmcclainyes17:33
mesteryI also think we need to move forward quickly on this, given where we're at and the time left, so something simple which can grwo in future releases makes sense.17:33
mesteryAfter saying all that, where should we start on coming to a conclusion here? :)17:33
markmcclainyes time is critical here17:34
*** sbalukoff has joined #openstack-meeting-317:34
enikanorovthe approaches are quite different, to me it doesn't seem that one is simpler then the other17:34
*** xgerman has joined #openstack-meeting-317:34
enikanorovso basically it's about doing something that could be easily extended later17:34
SumitNaiksatamshould we first looks for things which are obvious and we certainly want to do as a first iteration?17:34
SumitNaiksatam*look17:35
markmcclainSumitNaiksatam: yes that was make approach when I stepped back last week to look at the problem anew17:35
mesteryenikanorov: Agreed, something simple for now which allows for expansion in the future.17:35
*** overlayer has joined #openstack-meeting-317:35
SumitNaiksatammarkmcclain: great!17:35
markmcclains/make/my/17:35
*** vinay_yadhav has joined #openstack-meeting-317:36
SumitNaiksatamso we have been all talking about differences, what are the common things between the two proposals?17:36
SumitNaiksatamis the user facing API consistent across the two17:36
enikanorovSumitNaiksatam: yes17:36
enikanorovit's flavor_id on the service instance17:36
enikanorovbut that's integration part, I'd say17:36
*** mandeep has joined #openstack-meeting-317:36
SumitNaiksatamenikanorov markmcclain: so what the user sees as a part of the flavor definition is the same across both the proposals?17:37
*** pcm_ has joined #openstack-meeting-317:37
enikanorovSumitNaiksatam: that's no so similar17:37
SumitNaiksatam(i have read the proposals, but just want to make sure that we are all on teh same page here)17:37
markmcclainyeah we agree on attaching flavor_id to the logical service and also once it's bound dispatching calls directly to driver17:37
enikanorovin markmcclain's proposal user sees description, in my proposal user sees tags as more formal contract17:37
SumitNaiksatammarkmcclain enikanorov: can we potentially add tags later as a second iteration enhancement?17:38
markmcclainenikanorov is correct, my proposal also exposes the set of API extensions available for a flavor (ie TLS, L7)17:38
markmcclainSumitNaiksatam: yes17:38
enikanorovextension list is questionable, imo17:38
mesterySumitNaiksatam: +117:38
SumitNaiksatammarkmcclain: ok cool17:38
enikanorovwhy do coarse grained when we later move to fine grained?17:38
sbalukoffI think it's less questionable than tags. :P17:38
enikanorovthe problem is that most drivers going to implement all extensions17:39
enikanorovif two drivers implement SSL, but different cyphers17:39
enikanorov...17:39
enikanorovthat's where tags help17:39
dougwigor the description.17:39
enikanorovthat just one example of many17:39
SumitNaiksatamenikanorov: i think the claim is that coarse grain is currently simpler to achieve in Juno, but does not leave out the eventual path towards fine grained17:39
mesterySumitNaiksatam: +117:40
xgerman+117:40
SumitNaiksatammarkmcclain: is that an accurate assessment?17:40
enikanorovconsidering implementation - it's not17:40
markmcclainWe can always formalize the contract over time17:40
*** jackib has joined #openstack-meeting-317:40
enikanorovalso, each author sees implementation of his proposal to be simpler :)17:40
SumitNaiksatamenikanorov: :-)17:40
garyduanI also agree tag will be difficult to control17:40
*** natarajk has joined #openstack-meeting-317:41
enikanorovthe next thing is driver profiles17:41
mesteryenikanorov: human nature :)17:41
enikanorovwhere metadata seem to be the same tags as in my proposal17:41
garyduanbut I'd like to understand more how metadata works17:41
garyduanenikanorov: +117:41
banixenikanorov: would it be conceptually possible to think of profiles as a set of tags?17:41
markmcclainso metadata is a dict of driver specific parameters passed at driver init time17:41
*** andyshi_ has quit IRC17:42
enikanorovbanix: yes, i think it's close17:42
mesterybanix: That's kind of what I was thinking as well17:42
enikanorovso the problem for operator then that he needs to know driver specific details17:42
markmcclainthe metadata is really designed to toggle behavior in a driver to match the profile's description/sla17:42
banixso can we agree on using the spec as teh vehicle for carrying the info, tags or metadata?17:42
mandeepbanix: That is what I was thinking as well17:42
sbalukoffmarkmcclain: the idea being that drivers won't necessarily share the same specific parameters17:42
dougwigit could be just a set of tags, or it could configure the driver slightly different for each flavor (simple example, you tell driver A to use backend hosts 1-2 for flavor X and hosts 3-10 for flavor Y).17:42
*** TravT has quit IRC17:42
sbalukoffeven if they are implementing the same "feature"17:42
markmcclainenikanorov: operators already know that info because most go through selection process when purchasing equipment17:43
markmcclainsbalukoff: +117:43
enikanorovmarkmcclain: right, but metadata should really be bound to implementation, e.g. code17:43
markmcclaindougwig: yes17:43
garyduanmarkmcclain: metadata is created by admin,right?17:43
enikanorovit's not purely ask-API-create-flavor17:43
enikanorovso it really requires introspection into how it's done on the inside17:44
markmcclainenikanorov: no it is configuration options or it could even be a pointer of where to read in config file17:44
enikanorovyou can't just pass anything17:44
markmcclaingaryduan: yes17:44
enikanorovyep, the pointer of where to read is better17:44
sbalukoffenikanorov: Why can't you just pass anything?17:45
markmcclainenikanorov: the operator does not have to read the code, just understand the init options a vendor might offer17:45
enikanorovbut then it's just the same as to use tag from a flavor to do the same17:45
garyduanmarkmcclain: does driver need to expose anything?17:45
mesterymarkmcclain: This is similar to what they'd need to put in a config file when using the driver, right?17:45
enikanorovsbalukoff: because it makes no sense for the driver17:45
markmcclainie pass ha=true at initialization time to ensure the backends creates pairs17:45
enikanorovmarkmcclain: ok, that's a tag. and it's on a profile17:45
pgpuswhynot have two ways of specifiying service parameters tagOr metadata and point to a location where you can find key,vals or whateber minimum per service17:46
markmcclaingaryduan: no drivers should not need to be aware of flavors at this time17:46
sbalukoffenikanorov: It does if the driver knows how to interpret the metadata passed to it. :P17:46
enikanorovso why not to put it on Flavor so user see it, formally?17:46
markmcclainmestery: yes17:46
markmcclainpgpus: two ways = confusion17:46
ijwI think the issue will be with tags that you have no formal description of what the tag means.  Clearly it means a function is supported, but how do you document what that means in practice?17:46
xgermanijw +117:46
mesterymarkmcclain: that makes sense to me.17:46
SumitNaiksatamijw: but that problem is not solved17:46
SumitNaiksatamijw: we now have the operator figure that out17:46
sbalukoffijw: +117:47
ijwIt's not the operator that cares: it's the tenant.17:47
ijwExtensions are self-documenting but per enikanorov's point they can't possibly catch nuances.17:47
enikanorovtags are self-descriptive via their names17:47
markmcclainenikanorov: it's not put on flavor because that exposes specific details of the implementation backend and may not be the same for multilple vendors17:47
s3wongijw: but operators are the one exposing metadata here, right?17:47
ijws3wong: yes, but wouldn't you like those tags to be cross-operator?17:47
garyduanI'd agree operator should define the tag or metadata17:47
sbalukoffs3wong: I don't think tenants get to see the metadata17:48
enikanorovmarkmcclain: yes, that's why specific details are kept in driver's config17:48
markmcclainijw: standardizing the set of tags and letting everyone implement will take time17:48
sbalukoffs3wong: So that's not actually exposed to the tenant.17:48
enikanorovwhile on flavors only generic stuff like 'HA: True' is set17:48
ijwI mean, surely the point here is 'I want a service X supporting Y' and whoever I ask it of I get a service that suits my purposes.17:48
garyduanif he/she says the driver support L7, the drivers supports L717:48
ijwmarkmcclain: yup - I'm not really solving your problem, I'm trying to define it17:48
s3wongijw: if tags are exposed by drivers, then driver-tags would be cross-operator17:48
SumitNaiksatamok, can i summarize from a user facing API perspective, that the main difference between the two proposals is that in markmcclain’s proposal the meta-information is not exposed to the user, the operator configures that17:48
SumitNaiksatamwhere as in enikanorov’s proposal17:48
SumitNaiksatamit gets exposed as tags within the flavor17:48
ijws3wong: only if drivers agree what those tags mean, and that's the definition issue I'm referring ot.17:48
markmcclainSumitNaiksatam: correct17:49
enikanorovtags are implementation-agnostic definitions of the service17:49
SumitNaiksatamand the user can choose the flavors based on the tags17:49
s3wongsbalukoff: right, but operator would need to set metadata as part of what features drivers can expose, thus a manual process17:49
enikanorovso no impl details sneak into flavor17:49
SumitNaiksatammarkmcclain: ok17:49
SumitNaiksatamenikanorov markmcclain: hence my earlier suggestion, can we add tags as a second iteration enhancement17:49
s3wongijw: that has always been the question on enikanorov 's proposal - that we as community would have to define some common tags per service type17:49
SumitNaiksatamenikanorov markmcclain: that way we can have the best of both proposals17:50
sbalukoffs3wong: Defining what products an operator wants to offer is going to be a manual process in any case. ;)17:50
banixSumitNaiksatam: right. so the difference is granulaity of what tenant sees; markmcclain shows well defined limitted number of extensions enikanorov shows fine grained properties17:50
ijws3wong: and if they're common tags, are they not attributes of the implementation?17:50
SumitNaiksatamenikanorov markmcclain: we can start with somethin “simpler”17:50
markmcclainSumitNaiksatam: right tags can be added later once we have standard set17:50
mesterymarkmcclain SumitNaiksatam: +117:50
*** pballand has quit IRC17:50
SumitNaiksatamenikanorov: does that seem reasonable?17:50
mesteryI think we need something simple for Juno at this stage.17:50
s3wongijw: yes, they would be17:50
enikanorovi have a couple more questions17:51
enikanorovone is do we really need driver entry poins in driver profile?17:51
*** otherwiseguy has joined #openstack-meeting-317:51
enikanorovi think current provider framework can be used for this purpose17:51
garyduanenikanorov: same question here17:51
pgpusevery service needs to be managed by driver so why not just expose managment parameter and leave alone vwndor variations and just provide basic defalt services we have like FW,LB, VPN etc17:51
s3wongsbalukoff: that's a fair point :-)17:51
SumitNaiksatamenikanorov: one sec17:51
banixenikanorov: let’s see if we can get an agreement on the API as SumitNaiksatam was suggesting17:51
SumitNaiksatamlets all first have agreement on the tenant facing API17:52
SumitNaiksatambanix: yeah17:52
SumitNaiksatamwe will get to the admin side of the API in a but17:52
SumitNaiksatambit17:52
mandeepSumitNaiksatam: +117:52
SumitNaiksatamenikanorov markmcclain mestery: what say?17:52
enikanorovwell, not having tags on the flavor actually creates another question i was going to ask17:52
mesterySumitNaiksatam: I think we're close on this front, so yes.17:52
markmcclainI think from user perspective yes17:52
SumitNaiksatammestery markmcclain: cool17:53
SumitNaiksatamenikanorov: whats your question17:53
enikanorovdo we really need to associate flavor with driver profile17:53
enikanorovbut it seems that if no tags - we have to do that17:54
enikanorovbut scheduling would not make much sense then17:54
markmcclainenikanorov: right there has to be some kind of association layer17:54
banixenikanorov: yes. need the association. will still have a list of possible choices17:54
enikanorovbecause from flavor perspective there's no hint to use when choosing from associated profiles17:54
markmcclainwhich enables an operator to make a flavor to several possible backend implementation options17:54
s3wongenikanorov: it is a list of driver profile though, not really one to one mapping, so some sort of scheduling still needed, right?17:54
enikanorovbut what would be the criteria other than random choice?17:55
pgpusTake the case of nova flavor did we really tie it to the drivers there?17:55
markmcclainenikanorov: german has pointed out that I had left weight off as an initial metric of the list17:55
SumitNaiksatamenikanorov: perhaps in the first iteration this will be limited without the hints/tags17:55
* markmcclain pushed update with that17:55
SumitNaiksatammarkmcclain: do you agree ^^^?17:55
enikanorovyep, i've seen update with weight, but...17:55
enikanorovwhat does it solve?17:55
enikanorovare you going to get max weight each time?17:55
markmcclains3wong: yes there is a selection call to bind flavor to a driver17:55
ijwRight, so to be clear, the question is: a tenant has requirements that are met by several available service implementations: what should happen.  Is that right?17:56
enikanorovweight is actually a hardcoded kind of tag17:56
*** pballand has joined #openstack-meeting-317:56
markmcclainenikanorov: enables operator control to say set a preference that backend A should be preferred over backend B17:56
enikanorov*implementation A over B17:56
sbalukoffenikanorov: Not the same kind of tag that's in your proposal17:56
enikanorovsbalukoff: the same, indeed17:56
markmcclainpgpus: nova can still bind because of extra data for flavor17:57
enikanorovmarkmcclain: but how impl B is ever chosen?17:57
enikanorovit it's weight is lower17:57
markmcclainenikanorov: depends on selection algorithm17:57
markmcclainI've also intentionally kept it simple too17:57
markmcclainbecause I think that making a really good one is a great future BP :)17:58
enikanorovwell, that's important, because simplest is random choice17:58
garyduanfor example, round-robin in first release17:58
s3wongenikanorov: where there is no more resources for backend A?17:58
ijwNo, actually simplest is offering the tenant the choice.17:58
enikanorovweighting scheduler need to consider capacity or something17:58
enikanorovs3wong: exactly17:58
sbalukoffOr weighted round robin17:58
sbalukoffOr weighted random choice.17:58
SumitNaiksatamenikanorov: i think its okay to have limitations in the first release17:58
SumitNaiksatamas long as we know what they are, and we have path towards evolution17:58
mandeepijw: The tenant should have no view of resources, only logical entities after they have been scheduled17:59
SumitNaiksatamin this case the path is to to incoroporate tags17:59
mesteryFolks: Scheduling needs to be dirt simple for Juno or this won't land, that's the reality at this point.17:59
xgermanmandeep +117:59
pgpuscan you sggest what extra data for flvor is equivalent for neutron to tie it to neutron plugins? is it metadata/17:59
garyduanif driver A has no resource, it can be feedback to plugin and select the next one17:59
mesteryI don't want to rathole on scheduling here either.17:59
enikanorovi mean that's just a workarounds for the fact that 'naked flavor' is not a scheduling hint17:59
sbalukoffmestery: Good point.17:59
mandeepmestery: +117:59
markmcclainmestery: +1 scheduling is for Paris :)17:59
mesterymarkmcclain: :P17:59
SumitNaiksatamok lets get an agreement here17:59
SumitNaiksatamhang folks18:00
SumitNaiksatam* hang on18:00
SumitNaiksatami think its okay to have limitations in the first release18:00
mesterySumitNaiksatam: Whew, had me worried there ;)18:00
enikanorovas for something simple - I remember avishay's patch where he enabled driver to choose it's configuration based on provider name18:00
SumitNaiksatamas long as we know what they are, and we have path towards evolution18:00
enikanorovthat's actually very close to what is called driver profile18:00
mesterySumitNaiksatam: +118:00
SumitNaiksatamin this case the path is to to incoroporate tags18:00
SumitNaiksatamas a future iteration18:00
SumitNaiksatamenikanorov markmcclain: can we agree?18:00
SumitNaiksatamthis is in the context of the user/tenant facing API18:01
markmcclainSumitNaiksatam: +118:01
SumitNaiksatammarkmcclain: great, enikanorov?18:01
enikanorovyep, as simple first step we may just introduce flavors layer on top of providers18:01
pgpusyou service profile's path and that service prpofile will have tags?18:01
SumitNaiksatamenikanorov: i know this is not ideal18:01
SumitNaiksatamenikanorov markmcclain: nice18:01
enikanorovmay be with just 1:1 and no scheduling and such18:01
SumitNaiksatamenikanorov: nice18:01
enikanorovmarkmcclain: how does it sounds?18:01
enikanorovthen we could flush out what we really want from driver profiles18:02
markmcclainenikanorov: operators need more than 1:118:02
enikanorovmarkmcclain: sure18:02
sbalukoffmarkmcclain: +118:02
enikanorovbut at least we'll get user-facing api more or less stable18:02
enikanorovand then extend this with other more advanced features18:03
*** yamamoto has joined #openstack-meeting-318:03
*** lenrow has joined #openstack-meeting-318:03
enikanorovin terms of implementation that seems to be the simplest. plus migration is also simple, as well as operators workflow18:03
markmcclainso service profiles are must18:04
enikanorovthat's solvable with providers18:04
markmcclainbecause the mutli-vendor requirement why we started the who flavor discussion in the first place18:04
*** otherwiseguy has quit IRC18:04
garyduanI have questions about profile, but I want to wait until we get there :-)18:05
enikanorovmarkmcclain: so i agree, i'm just saying someone already impemented the idea very close to driver profiles18:05
enikanorovthat coudl be reused and merged with flavors18:05
pgpusOK lets take a sample service profile for existing FW,LB,VPN as see if this makes sense18:05
dougwigenikanorov: sounds like you're agreeing about profiles, just not where to put them?18:05
enikanorovmarkmcclain: so we both get rid of provider attribute on the service instance, plus not too much changing the existing flow18:06
*** dlenrow has joined #openstack-meeting-318:06
enikanorovdougwig: i'm not opposed to profiles, just honestly it is possible right now with very small changes in the code18:06
pgpusWhat should a fw profile conatin like neutron firewall-list18:07
pgpusneutron firewall-policy-list18:07
pgpusneutron firewall-rule-list18:07
enikanorovthat's however has another issues listed in markmcclain's proposal in the beginning, but with flavor layer it is solvable18:07
*** jorgem has joined #openstack-meeting-318:07
garyduanpgpus: firewall itself is the service instance18:07
banixsounds like we have reached an agreement. right?18:08
pgpuswill flavor and proivder type be able to express these in profiles in terms of some unit of measure to say like weight vwe discussed for user to undertsand which profile they pickup?18:08
*** yamamoto has quit IRC18:08
mesterybanix: Seems like it.18:08
markmcclainI think so18:08
markmcclainthe one contention seems to be profiles18:09
markmcclainwhich are a evolved form of providers18:09
enikanorovmarkmcclain: I'm for using current workflow with keeping it in conf18:09
enikanorovat least for now18:09
enikanorovwith flavors we are able to solve issues of providers18:10
sbalukoffI think there a benefits to keeping providers in the DB and not in conf.18:10
sbalukoffEr... not in conf files.18:10
garyduanenikanorov: are you saying 1:1 mapping between profile and driver?18:10
enikanorovprofile:driver is N:118:10
enikanorovdriver may have multiple profiles18:10
pgpuswe will have to re-invent like ml2 an mlProfile18:10
garyduanthat my question,18:11
garyduanMark's spec says, metadata can be used by driver to behave differently18:11
mandeepenikanorov: it is more likely n:m - same profile may be provided by multiple drivers as well18:11
SumitNaiksatammandeep: +118:11
markmcclainenikanorov: my only concern about keeping current provider conf is there's no operator control18:11
sbalukoffmandeep: Not if metadata is driver-specific18:12
enikanorovmandeep: that's more complex. not sure that would be easy with storing profiles in config18:12
SumitNaiksatamsbalukoff: that is just a special case18:12
enikanorovmarkmcclain: the control of what?18:12
mandeepSumitNaiksatam: exactly18:12
s3wongmandeep: oh really? if so, how is metadata passed - because that needs to be driver specific?18:12
SumitNaiksatamsbalukoff: mandeep’s suggestion for n:m includes that18:12
markmcclainwhich provider is selected18:12
SumitNaiksatamsbalukoff: n or m is 1!18:12
enikanorovmarkmcclain: how's it different from your proposal besides the fact that it is configured in conf, not by API?18:12
markmcclainthe original reason we started with flavors months ago was the operator need for multi-vendor/multi-driver for same SLA18:13
SumitNaiksatamfolks, sorry for interrupting18:13
SumitNaiksatamhave we moved on from the user/tenant facing API discussion?18:13
*** otherwiseguy has joined #openstack-meeting-318:13
sbalukoffSumitNaiksatam: No, what I mean is, if the metadata in the profile is only meant to be interpreted by one driver, then that profile can only apply to one driver.  Are y'all suggesting the metadata might be not driver-specific?18:13
markmcclainSumitNaiksatam: yes18:13
SumitNaiksatamsorry for repeating this over and over again18:13
enikanorovmarkmcclain: as we discussed, flavors associated with providers, which ae actually a driver profile18:13
markmcclainso I think we have agreement on user API18:13
SumitNaiksatammarkmcclain: ok cool18:13
s3wongsbalukoff: that was my question above as well... to me it seems n:118:14
SumitNaiksatammestery: can we summarize the agreement?18:14
mandeeps3wong: I expect that common profiles (say providing cookie rewriting), will be implemented by multiple backends. That is whjat allows you to reschedule a tenant to a new backend transparently18:14
enikanorovSumitNaiksatam: yep, i think so as well18:14
banixSumitNaiksatam: i think the only remaining question is driver in profile or not issue18:14
SumitNaiksatamenikanorov markmcclain: perhaps you can summarize18:14
mesterySumitNaiksatam: Yes, lets have enikanorov markmcclain summarize :)18:14
markmcclainso there's agreement that the user will select a flavor18:14
enikanorovthat's for sure :)18:15
SumitNaiksatam:-)18:15
*** cjellick has quit IRC18:15
markmcclainflavor definition will include list of API extensions18:15
markmcclainthe API extensions will be used to activate logic in teh server for configuring the logical model18:15
*** cjellick has joined #openstack-meeting-318:15
enikanorovnot sure we need that...18:15
SumitNaiksatammarkmcclain: the list of API extensions is in a user friendly form?18:15
enikanorovif API extension is not used for scheduling, then why have it?18:16
markmcclainSumitNaiksatam: about as friendly as our current /extensions endpoint :)18:16
markmcclainenikanorov: not all flavors will implement every API extension18:16
SumitNaiksatammarkmcclain: ok may be i misunderstood that part, but i can go back to the spec18:16
enikanorovmarkmcclain: right, admin will need to write this in the description18:17
garyduanmarkmcclain: extension list seems informational to me18:17
markmcclainenikanorov, garyduan: it is18:17
enikanorovthat's the same as with API aspects18:17
markmcclainmainly because the extensions should be defined in our API spec18:17
garyduanmarkmcclain: OK18:17
enikanorovmarkmcclain: also, the problem i see with this is the usage18:18
markmcclainie the user knows that if TLS is enable these extra child resources are available for a service18:18
markmcclainenikanorov: what is the usage issue?18:18
enikanorovmarkmcclain: so say instance ID1 doesn't suport L7. user calls L7 on instance with ID1, API layer need to goo to DB and find out which extensions are enabled18:18
enikanorovto decide whether to forward rest call18:18
enikanorovor to reply with 404 or 40018:19
enikanorovif that's what you're proposing, then it's not easy to do. but if we're not doing this, then we don't need extension list as a separate attribute18:19
markmcclainenikanorov: yep for service extensions that will be required18:19
*** cjellick has quit IRC18:19
markmcclainnot every backend may implement an extension18:20
enikanorovyep, just raise unimplemented18:20
markmcclainalso if we don't do this how do vendor differentiate?18:20
markmcclainenikanorov: except that as an operator18:20
dougwighow is a user going to call L7 on something that doesn't support it unless the operator has misconfigured their flavors/profiles?18:20
enikanorovthey differentiate. on user-facing side, flavor descriptions are different18:20
enikanorovdougwig: well, user just calls... it should get reasonable error18:21
enikanorov'not implemented' seems reasonable to me18:21
markmcclainenikanorov: an operator may want to make a driver that offers more features to a flavor that offers no features18:22
markmcclains/no/few/18:22
enikanorovi'm saying that extension list as an attribute is not extendible, if we want to declare API aspects in the future18:22
sbalukoffenikanorov: That's true... but I guess I'm still not following why markmcclain's proposal wouldn't be able to do that? What is the usage problem here?18:22
markmcclainenikanorov: it is extensible18:22
mandeepmarkmcclain: As a generic neutron question, we have the same issue of exposing APIs exposed by a driver to the tenant (say for ML2), so should we be exposing API extensions from drivers in a generic way, not in a service flavor specific way?18:22
sbalukoff"That's true" was meant to apply to the 'not implemented' error comment you said above.18:23
enikanorovi guess that's not about APIs exposed by drivers18:23
enikanorovit's about core service API that driver may not support18:23
markmcclainthe operator ensures the deployed backends have support and then add extension to the list if they choose18:23
enikanorovanyway, flavor-based discpatching seems the complexity we would like to avoid18:24
markmcclainenikanorov: if we keep the core service API small then everyone should be able to support it18:24
markmcclainenikanorov: flavor based dispatching is not that difficult of a problem18:24
*** kenhui has quit IRC18:24
enikanorovi'd say it's not a step-1 task18:24
markmcclainmainly because the mechanics of dispatching usually involve retrieving teh flavor info18:25
pgpuscan we describe falvor info for one service say fw to understand heer?18:25
enikanorovfirewall has no extensions, i guess18:26
enikanorovgaryduan: is that so?18:26
markmcclainpgpus: mind if I talk lbaas example case?18:26
pgpusOK lets take LB18:26
garyduanno ext.18:26
enikanorovso is vpn, i guess18:26
sbalukoffWell, there's also the problem of an extension "mostly" being supported:  For example, if a particular implementation can support most of L7 in LBaaS, but there are one of two things it doesn't support within the L7 functionality, can it report that a given configuration is not implemented?18:26
markmcclainsbalukoff: right18:27
enikanorovsbalukoff: that may make sense for particular not supported attr. like unsupported cypher of certificate or something18:27
pgpuspool, member, protocol say http supported but not https does it make sense?18:28
mesteryFolks, where are we at here? We're at an hour, and I'd like to ensure we wrap this up at some point. :)18:28
sbalukoffenikanorov: Yes18:28
enikanorovpgpus: there's not way with extension list to say 'i don't support https protocol'18:28
pgpusOK so flavor can be L7LBsimplehttp types18:28
sbalukoffmestery: Sorry for throwing a monkey-wrench into the clockwork. :P18:29
enikanorovpgpus: that goes down to a vervose description18:29
mesteryWe can't sit here all day discussing this, I'm sure most of us have backlogs that are huge at this point. :)18:29
enikanorovthat's my point, extension list is not helping much, not to say dispatching based on it is not necessary18:29
mesterySo moving forward, is there anything else that isn't agreed on? I lost track to be honest. :)18:29
pgpusOK I am trying to understand flavor in terms of am I drinking a Darjeeling tea or a colombian cofee18:29
markmcclainhow to map flavor to driver is the point of contention18:29
enikanorovmestery: that's still about user api18:30
SumitNaiksatamthe last i remember, markmcclain was summarizing what we agreed on18:30
LouisFcan we get a merged  proposal with examples to review?18:30
markmcclainbut I really don't think it is that far off18:30
s3wongmestery: I think we are still on APIs - since we have disagreement on extensions18:30
enikanorovmarkmcclain: let's do it the way you proposed18:30
enikanorovat least for now18:30
enikanorovit's hidden from user anyway18:30
markmcclainenikanorov: right and then we can add advance capabilities as follow up work18:30
mesterymarkmcclain: +118:31
mesteryenikanorov: +118:31
sbalukoff+118:31
markmcclainthis will also break the dependency bottleneck the adv services are experiencing18:31
mesterymarkmcclain: HUGE +118:31
sbalukoffYes!18:31
garyduanone more question18:31
sbalukoffDamn.18:31
sbalukoff;)18:31
garyduanmeta data in profile18:31
banixso the optimism of the other day was well founded :)18:31
sbalukoffIt's drier specific!18:31
sbalukoffdriver18:31
garyduanhow is it used to make driver work differently?18:31
markmcclaingaryduan: it's a vendor choice18:32
markmcclaina vendor could create a driver that require no additional metadata18:32
markmcclainso the operator would leave the field blank18:32
sbalukoffThat is, vendor defines what metadata should look like and what the driver will understand, operator decides which metadata to put in there to enable which features.18:32
* markmcclain envisions there will be vendors who do exactly that18:32
garyduanvendor defines what meta data should look like ?18:33
garyduanwhere?18:33
sbalukoffAnd thus, vendors can differentiate, and operators control their product offerings.18:33
markmcclaingaryduan: in their docs on how to deploy their solution18:33
banixmestery: i think converging to one spec as LouisF suggested would be great18:33
garyduanOk. It's an external process.18:33
markmcclaingaryduan: yes18:33
sbalukoffYes!18:33
garyduanI agree18:33
SumitNaiksatambanix: i agree, one spec would be good18:34
garyduanthen, multiple driver instances?18:34
mandeepbanix: +118:34
s3wonggaryduan: yeah, we talked about that a bit earlier too (as I had with sbalukoff) - that metadata is a manual process for operators18:34
garyduanDo we do dynamic loading?18:34
mesterymarkmcclain enikanorov: We need to move to one spec and continue the discussion there.18:34
garyduanof vendor driver?18:34
mesteryAt this point, I'm going to end this meeting (or pass chair to someone else).18:35
markmcclaingaryduan: yes dynamic loading via entrypoint18:35
mesteryenikanorov markmcclain: ^^^ Sound ok?18:35
markmcclainmestery: I've got a hard stop too18:35
mesteryOK, lets move to one spec and continue the conversation there.18:35
sbalukoffThanks, y'all!18:35
mesteryI think at this point we're at "implementation detaiuls" anyways, and we coudl all stay here the rset of the day talking it feels like. :)18:35
SumitNaiksatamenikanorov markmcclain: thanks for indulging in this discussion18:35
mesteryThanks for joining folks!18:35
s3wongSumitNaiksatam: so we can skip talking about flavor during next week's adv service meeting? :-)18:35
mesterysbalukoff: +118:35
enikanorovmarkmcclain: salv-orlando would not be happy to do dynamic loading. at least he was no-no about that18:35
SumitNaiksatams3wong: :-)18:36
*** seizadi has quit IRC18:36
mestery#endmeeting18:36
*** openstack changes topic to "Services’ integration (Meeting topic: networking_policy)"18:36
openstackMeeting ended Fri Jun 27 18:36:12 2014 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)18:36
openstackMinutes:        http://eavesdrop.openstack.org/meetings/networking_advanced_services/2014/networking_advanced_services.2014-06-27-17.30.html18:36
markmcclainenikanorov: I'll follow up with salv-orlando18:36
openstackMinutes (text): http://eavesdrop.openstack.org/meetings/networking_advanced_services/2014/networking_advanced_services.2014-06-27-17.30.txt18:36
openstackLog:            http://eavesdrop.openstack.org/meetings/networking_advanced_services/2014/networking_advanced_services.2014-06-27-17.30.log.html18:36
*** mandeep has left #openstack-meeting-318:36
garyduandynamic loading of multiple instances of a vendor driver, ....18:36
s3wonggaryduan: I quite honestly didn't see that from markmcclain 's spec, so you may want to comment on it on the spec18:37
enikanorovs3wong: i have commented on that18:37
garyduans3wong: it is implied,18:37
pgpusare we co-relating between Service profile in conf to a generic or specific driver to load?18:38
enikanorovif driver profiles with entrypoint are pushed via API18:38
markmcclains3wong: the entrypoint loading will mean different threads would instantiate different ones18:38
enikanorovthen neutron need to load drivers dynamically18:38
banixs3wong: yes that is i,plied18:38
*** pcm_ has left #openstack-meeting-318:38
garyduanthe driver has to take care many synchronization issues18:38
enikanorovthat's one of the reasons to postpone this existing workflow18:39
enikanorovthat's not only driver synchronization, it's also a security hole18:39
markmcclaingaryduan: yes and many drivers do not functional well in the typical deployment of multiple neutron api servers and rpc worker processes18:39
enikanorov(potential, of course)18:39
s3wongenikanorov: yes, dynamic loading of driver seems like it needs to be a new feature for Neutron18:39
pgpuswill we consider them simlar to type drivers of ml2? so service drivers are also mudular?18:40
sbalukoffPlease add these comments to the spec, eh.18:40
markmcclains3wong: we already support dynamic load18:40
markmcclainand have for sometime via entrypoints18:40
enikanorovmarkmcclain: where we do?18:40
markmcclainpgpus: yep18:40
pgpusok18:40
enikanorovwhat is loaded dynamically?18:40
garyduanI posted a comment in #2 patch, do we really need dynamic loading or multiple instance?18:41
markmcclainmech drivers are loaded dynamically18:41
markmcclaingaryduan: yes18:41
markmcclainI wanted to harmonize how drivers work to follow ml2 pattern of entrypoints18:41
garyduanIf the driver exposes multiple entry points, basically, like different drivers18:42
enikanorovmechdrivers are loaded at startup18:42
LouisFmarkmcclain: so the driver entry points are specified in the config file?18:42
garyduanthen, the plugin doesn't have to load multiple instances dynamically18:42
markmcclainenikanorov: they are still loaded dynamically :)18:42
*** banix has quit IRC18:42
garyduanI guess dynamically means loaded when user request the service18:43
markmcclainLouisF: I'm proposing that they are stored in the service profile in the database18:43
garyduanloaded = load it18:43
s3wongmarkmcclain: OK - that's the dynamic loading you talked about :-)18:43
markmcclainto make deployment consistency guaranteed18:43
sbalukoffWhich is very important for large deployments.18:43
enikanorovmarkmcclain: yep, but know what i mean, we don't load attacker's code which attacker has pointed to via API :)18:43
LouisFmarkmcclain: i was refering to the ml2 mech drivers18:43
enikanorov*you18:44
markmcclainotherwise rolling configuration upgrades leave large deployments in inconsistent state18:44
garyduanif we load them at startup, we can use provider name, not entry points. Provider name is not shown to the tenant anyway.18:44
sbalukoffenikanorov: Given the operator is the one defining the profiles, are you worried about an attacker getting a hold of the operator's credentials/18:44
sbalukoff?18:44
sbalukoffIf so, that operator has bigger problems.18:44
*** Sukhdev has joined #openstack-meeting-318:45
*** banix has joined #openstack-meeting-318:45
markmcclainok.. I've got to run feel to free to leave additional questions on the review18:46
markmcclainthanks to everyone for discussing18:46
garyduanmarkmcclain: thanks18:46
s3wongmarkmcclain: thanks!18:46
sbalukoffYes, thanks!18:46
banixbye all18:47
enikanorovsbalukoff: that's kinda lame excuse for the software with security issues :)18:48
sbalukoffenikanorov: I don't see this as any worse issue than someone having access to the host to add malicious code that gets loaded at boot. :P18:49
*** lenrow has quit IRC18:50
enikanorovremember that is an API, not an access to the host18:50
sbalukoffRight, and SSH is a network service, too. :P18:51
pgpusAre we expecting some updates to18:52
pgpus* Flavors API extension5218:52
pgpus* Flavors persistence layer (DB plugin)5318:52
pgpus* Common code for service plugins and drivers to support capabilities5418:52
pgpusand scheduling.5518:52
sbalukoffIf there's a way to exploit the API that doesn't involve privileged access then that's a bug and should be dealt with as a bug.18:52
pgpus* DB migration18:52
*** yamamoto has joined #openstack-meeting-318:52
*** erecio has joined #openstack-meeting-318:52
pgpusI mean for security as you discuss here?18:52
pgpusOK what about key's provided by keystone before you can access API's does  that not secure suffucientlY the Service APIs'18:54
*** vinay_yadhav has quit IRC18:54
sbalukoffpgpus: Are you asking?18:55
pgpusYes to understand security issues you are pointing?18:55
sbalukoffOh! So I think enikanorov is uncomfortable with the idea of dynamically loaded code. I'm pointing out that the admin / operator is the only one who can control which code gets loaded dynamically, and that this is actually not much different than the admin / operator determining which code gets loaded at start up time.18:56
*** yamamoto has quit IRC18:56
sbalukoffFrom mark's spec:18:57
sbalukoffThe policy.json will be updated to allow all users to query the flavor14618:57
sbalukofflisting and requst details about a specific flavor entry. All other REST14718:57
sbalukoffpoints for create/update/delete operations will admin only. Additionally, the14818:57
sbalukoffCRUD operations for Driver Profiles will be restricted to administrators.14918:57
sbalukoffThe policy.json will be updated to allow all users to query the flavor14618:57
sbalukofflisting and requst details about a specific flavor entry. All other REST14718:57
sbalukoffpoints for create/update/delete operations will admin only. Additionally, the14818:57
sbalukoffCRUD operations for Driver Profiles will be restricted to administrators.14918:57
sbalukoffThe policy.json will be updated to allow all users to query the flavor14618:57
sbalukofflisting and requst details about a specific flavor entry. All other REST14718:57
sbalukoffpoints for create/update/delete operations will admin only. Additionally, the14818:57
*** sarob has quit IRC18:57
sbalukoffCRUD operations for Driver Profiles will be restricted to administrators.14918:57
sbalukoffThe policy.json will be updated to allow all users to query the flavor14618:57
sbalukofflisting and requst details about a specific flavor entry. All other REST14718:57
sbalukoffpoints for create/update/delete operations will admin only. Additionally, the14818:57
sbalukoffCRUD operations for Driver Profiles will be restricted to administrators.18:57
sbalukoffDang it... sorry!18:57
sbalukoffAnyway, all CRUD operations in the API are controlled by an admin account.18:57
sbalukoffSo, I don't see an issue.18:57
sbalukoffThough it should probably be noted in the spec that dynamic loading of code via the profiles is implied.18:58
sbalukoff(All CRUD operations having to do with profiles, I mean.)18:58
*** LouisF has quit IRC18:58
*** mfer has quit IRC18:59
pgpusOK so policy.json once managed by admin should reolve most of security issues18:59
sbalukoffThat is my opinion.18:59
pgpusGood that helps18:59
sbalukoffOthers should feel free to disagree with me and point out how I'm wrong. :)18:59
*** amitpp has quit IRC18:59
*** seizadi has joined #openstack-meeting-319:00
pgpusMark's point was all deriver loading at init time can slow down service in a bulk operations, so load just in time is good, but still its secure as you pointed out19:01
sbalukoffOk, I've gotta run off for a bit. Catch y'all later!19:02
pgpusI will leave now and will follow up on Flavor update as soon as that is put in BP and docs for design - thx19:02
*** yamamoto has joined #openstack-meeting-319:03
*** ijw has quit IRC19:03
*** xgerman has quit IRC19:03
*** yisun has quit IRC19:04
*** seizadi has quit IRC19:04
*** yamamoto has quit IRC19:08
*** sarob has joined #openstack-meeting-319:09
*** zehicle_at_dell has joined #openstack-meeting-319:13
*** pballand has quit IRC19:16
*** terryw has joined #openstack-meeting-319:18
*** otherwiseguy has quit IRC19:18
*** dlenrow has quit IRC19:19
*** s3wong has quit IRC19:22
*** nati_ueno has joined #openstack-meeting-319:23
*** sarob has quit IRC19:24
*** kenhui has joined #openstack-meeting-319:24
*** sarob has joined #openstack-meeting-319:24
*** leakypipes has quit IRC19:25
*** jorgem has left #openstack-meeting-319:25
*** xgerman has joined #openstack-meeting-319:25
*** sarob has quit IRC19:29
*** zehicle_at_dell has quit IRC19:30
*** cjellick has joined #openstack-meeting-319:34
*** cjellick has quit IRC19:35
*** cjellick has joined #openstack-meeting-319:35
*** jackib has quit IRC19:38
*** HenryG_ has joined #openstack-meeting-319:40
*** yamahata_ has joined #openstack-meeting-319:42
*** amotoki_ has joined #openstack-meeting-319:43
*** amotoki has quit IRC19:43
*** yamahata__ has quit IRC19:43
*** HenryG has quit IRC19:43
*** zz_johnthetubagu has quit IRC19:43
*** mordred has quit IRC19:43
*** mordred has joined #openstack-meeting-319:43
*** erw has quit IRC19:44
*** natarajk has left #openstack-meeting-319:45
*** erw has joined #openstack-meeting-319:46
*** zz_johnthetubagu has joined #openstack-meeting-319:47
*** zz_johnthetubagu is now known as johnthetubaguy19:47
*** mfer has joined #openstack-meeting-319:51
*** prad_ has quit IRC20:02
*** david-lyle has quit IRC20:03
*** yamamoto has joined #openstack-meeting-320:03
*** david-ly_ has joined #openstack-meeting-320:04
*** terryw has quit IRC20:05
*** prad has joined #openstack-meeting-320:05
*** yamamoto has quit IRC20:08
*** jackib has joined #openstack-meeting-320:08
*** erecio has quit IRC20:09
*** salv-orlando has quit IRC20:15
*** shakamunyi has joined #openstack-meeting-320:15
*** HenryG_ has quit IRC20:21
*** HenryG_ has joined #openstack-meeting-320:21
*** yamahata_ has quit IRC20:21
*** yamahata_ has joined #openstack-meeting-320:21
*** erw has quit IRC20:21
*** erw has joined #openstack-meeting-320:21
*** prad has quit IRC20:21
*** prad has joined #openstack-meeting-320:21
*** shakamunyi has quit IRC20:22
*** shakamunyi has joined #openstack-meeting-320:22
*** salv-orlando has joined #openstack-meeting-320:23
*** otherwiseguy has joined #openstack-meeting-320:28
*** nati_ueno has quit IRC20:28
*** peristeri has quit IRC20:35
*** kenhui has quit IRC20:37
*** nati_ueno has joined #openstack-meeting-320:39
*** pballand has joined #openstack-meeting-320:41
*** Sukhdev has quit IRC20:45
*** nati_ueno has quit IRC20:50
*** nati_ueno has joined #openstack-meeting-320:50
*** coolsvapl has joined #openstack-meeting-320:51
*** lblanchard has quit IRC20:51
*** johnthetubaguy has quit IRC20:52
*** coolsvap|afk has quit IRC20:52
*** zehicle has quit IRC20:52
*** johnthetubaguy has joined #openstack-meeting-320:57
*** jackib has quit IRC20:58
*** zehicle has joined #openstack-meeting-320:58
*** johnthetubaguy has quit IRC20:58
*** banix has quit IRC21:01
*** tylerdurden has joined #openstack-meeting-321:02
*** johnthetubaguy has joined #openstack-meeting-321:02
*** thomasem has quit IRC21:02
*** yamamoto has joined #openstack-meeting-321:03
*** shakamunyi has quit IRC21:05
*** shakamunyi has joined #openstack-meeting-321:11
*** mfer has quit IRC21:11
*** yamamoto has quit IRC21:11
*** tylerdurden has quit IRC21:12
*** Adri2000 has quit IRC21:13
*** alexpilotti has quit IRC21:13
*** alexpilotti has joined #openstack-meeting-321:14
*** david-ly_ has quit IRC21:14
*** Adri2000 has joined #openstack-meeting-321:14
*** notmyname has quit IRC21:14
*** Adri2000 is now known as Guest3473121:15
*** notmyname has joined #openstack-meeting-321:17
*** gduan has joined #openstack-meeting-321:23
*** zigo_ has joined #openstack-meeting-321:24
*** david-lyle has joined #openstack-meeting-321:27
*** pballand has quit IRC21:29
*** Guest34731 has quit IRC21:31
*** erw has quit IRC21:31
*** garyduan has quit IRC21:31
*** markmcclain has quit IRC21:31
*** edleafe has quit IRC21:31
*** wendar has quit IRC21:31
*** dolphm has quit IRC21:31
*** russellb has quit IRC21:31
*** vishy has quit IRC21:31
*** zigo has quit IRC21:31
*** briancurtin has quit IRC21:31
*** ttx has quit IRC21:31
*** abramley has quit IRC21:31
*** abramley has joined #openstack-meeting-321:32
*** pballand has joined #openstack-meeting-321:36
*** sarob has joined #openstack-meeting-321:43
*** nelsnelson has quit IRC21:53
*** yamamoto has joined #openstack-meeting-322:03
*** yamamoto has quit IRC22:08
*** jackib has joined #openstack-meeting-322:25
*** alexpilotti has quit IRC22:26
*** armax has quit IRC22:38
*** prad has quit IRC22:43
*** zehicle_at_dell has joined #openstack-meeting-322:44
*** otherwiseguy has quit IRC22:51
*** rhagarty has quit IRC22:54
*** jackib has quit IRC22:55
*** shakamunyi has quit IRC22:56
*** shakamunyi has joined #openstack-meeting-322:56
*** zehicle_at_dell has quit IRC22:58
*** devlaps has quit IRC22:59
*** sarob has quit IRC23:00
*** rhagarty has joined #openstack-meeting-323:01
*** sarob has joined #openstack-meeting-323:01
*** yamamoto has joined #openstack-meeting-323:03
*** ivar-lazzaro has quit IRC23:04
*** sarob has quit IRC23:05
*** david-lyle has quit IRC23:05
*** zehicle_at_dell has joined #openstack-meeting-323:07
*** david-lyle has joined #openstack-meeting-323:07
*** yamamoto has quit IRC23:08
*** nati_ueno has quit IRC23:09
*** nati_ueno has joined #openstack-meeting-323:10
*** david-lyle has quit IRC23:11
*** ivar-lazzaro has joined #openstack-meeting-323:18
*** sarob has joined #openstack-meeting-323:24
*** armax has joined #openstack-meeting-323:27
*** xgerman has quit IRC23:32
*** sarob has quit IRC23:38
*** sarob has joined #openstack-meeting-323:39
*** sarob has quit IRC23:43
*** shakamunyi has quit IRC23:47
*** seizadi has joined #openstack-meeting-323:52
*** MaxV has quit IRC23:59

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!