| *** mickeys has quit IRC | 00:02 | |
| *** mickeys has joined #openstack-neutron-ovn | 00:08 | |
| *** rpb has joined #openstack-neutron-ovn | 00:20 | |
| *** fzdarsky_ has joined #openstack-neutron-ovn | 01:31 | |
| *** fzdarsky has quit IRC | 01:35 | |
| *** s3wong has quit IRC | 01:41 | |
| *** gongysh has joined #openstack-neutron-ovn | 01:50 | |
| openstackgerrit | ZongKai LI proposed openstack/networking-ovn: Support native OVN DHCPv6 https://review.openstack.org/326964 | 02:19 |
|---|---|---|
| *** armax has quit IRC | 02:39 | |
| *** rpb has quit IRC | 02:40 | |
| *** armax has joined #openstack-neutron-ovn | 02:42 | |
| *** zkassab__ has joined #openstack-neutron-ovn | 02:56 | |
| *** portdirect has quit IRC | 03:05 | |
| *** portdirect_ has joined #openstack-neutron-ovn | 03:07 | |
| *** portdirect_ is now known as portdirect | 03:08 | |
| *** armax has quit IRC | 03:36 | |
| *** zkassab__ has quit IRC | 04:02 | |
| *** numans has joined #openstack-neutron-ovn | 04:36 | |
| *** yamamoto has quit IRC | 05:20 | |
| *** yamamoto has joined #openstack-neutron-ovn | 05:57 | |
| *** trinaths has joined #openstack-neutron-ovn | 06:09 | |
| *** pcaruana has joined #openstack-neutron-ovn | 06:18 | |
| *** gongysh has quit IRC | 06:27 | |
| *** mickeys has quit IRC | 07:07 | |
| *** cryptarium has joined #openstack-neutron-ovn | 08:04 | |
| *** openstackgerrit has quit IRC | 08:04 | |
| *** openstackgerrit has joined #openstack-neutron-ovn | 08:05 | |
| *** mickeys has joined #openstack-neutron-ovn | 08:08 | |
| *** cryptarium has quit IRC | 08:09 | |
| *** mickeys has quit IRC | 08:13 | |
| *** openstackgerrit has quit IRC | 09:04 | |
| *** openstackgerrit has joined #openstack-neutron-ovn | 09:04 | |
| *** trinaths2 has joined #openstack-neutron-ovn | 09:20 | |
| *** trinaths has quit IRC | 09:21 | |
| *** yamamoto has quit IRC | 10:23 | |
| *** trinaths2 has quit IRC | 10:52 | |
| *** numans has quit IRC | 10:55 | |
| *** portdirect has quit IRC | 10:59 | |
| *** portdirect has joined #openstack-neutron-ovn | 11:00 | |
| *** rtheis has joined #openstack-neutron-ovn | 11:03 | |
| *** yamamoto has joined #openstack-neutron-ovn | 11:11 | |
| *** numans has joined #openstack-neutron-ovn | 11:22 | |
| *** fzdarsky_ is now known as fzdarsky|afk | 11:22 | |
| *** fzdarsky|afk is now known as fzdarsky|lunch | 11:22 | |
| *** trinaths has joined #openstack-neutron-ovn | 11:29 | |
| ajo | numans, do we have instructions anywhere to try out floating ips manually on OVN? | 12:09 |
| numans | ajo, not really | 12:12 |
| numans | ajo, there is a patch for NAT and fip support | 12:12 |
| numans | ajo, https://review.openstack.org/#/c/346646/ | 12:13 |
| numans | not sure when it will be rebased | 12:13 |
| ajo | numans, yes I was looking at it, but I wondered if we had something written somewhere | 12:15 |
| *** fzdarsky|lunch is now known as fzdarsky | 12:15 | |
| numans | ajo, i am sure you would have looked into this - https://etherpad.openstack.org/p/Integration_with_OVN_L3_Gateway | 12:15 |
| ajo | numans, it's also unclear to me, l3 implementation of OVN will always be distributed / DVR ? | 12:15 |
| russellb | ajo: yes, always distributed | 12:15 |
| ajo | :) cool | 12:16 |
| russellb | actually it's more complicated than that .... | 12:16 |
| russellb | i haven't even finished coffee cup #1 though | 12:16 |
| ajo | and it also provides NAT on every compute ? | 12:16 |
| ajo | russellb, finish it :D no hurry :D | 12:16 |
| russellb | that's where it gets more complicated | 12:16 |
| ajo | I'm digesting numans link :D | 12:16 |
| * ajo starts asking questions | 12:17 | |
| ajo | what does DTRP and GTRP pean | 12:17 |
| ajo | RP = router port | 12:17 |
| ajo | now, DT/GT ? :) | 12:17 |
| ajo | oh | 12:19 |
| ajo | I just had to keep reading | 12:19 |
| ajo | Logical Gateway Transit Router Port | 12:19 |
| russellb | ajo: http://blog.spinhirne.com/p/blog-series.html | 12:19 |
| ajo | logical distributed transit router port | 12:19 |
| russellb | may be helpful to you | 12:19 |
| russellb | ok so L3 in OVN .... | 12:19 |
| russellb | first we had logical routers, implemented as always fully distributed | 12:19 |
| russellb | that's what networking-ovn always creates for neutron routers in the current code | 12:20 |
| *** portdirect has quit IRC | 12:20 | |
| russellb | mostly useful for east/west | 12:20 |
| *** portdirect has joined #openstack-neutron-ovn | 12:20 | |
| russellb | we later also added L3 gateways | 12:20 |
| russellb | and L3 gateways are bound to chassis (specific host) | 12:21 |
| ajo | russellb, so, there's even no need to set the router_distributed flag on /etc/neutron.conf ? | 12:21 |
| russellb | correct, we ignore it | 12:21 |
| ajo | russellb, ack, /me wonders if it's worth making sure it's set so admins know the difference (random thought) | 12:21 |
| russellb | things get a little more complicated when you have an L3 gateway that also needs to do NAT | 12:22 |
| ajo | aha, so one thing is a logical router | 12:22 |
| russellb | when it does NAT, we need to ensure it always happens on the same host, because it's stateful | 12:22 |
| ajo | and then there's an l3 gateway | 12:22 |
| russellb | yes | 12:22 |
| russellb | the patch that does L3 gateways with NAT does something a little tricky | 12:22 |
| russellb | it's actually how NSX works | 12:22 |
| * ajo listens with open eyes :D | 12:23 | |
| russellb | it's basically that diagram in the etherpad | 12:23 |
| russellb | first there's the distributed router for east/west | 12:23 |
| ajo | ah, ok :) | 12:23 |
| russellb | that diagram is what you'd have when you create a neutron router between a tenant network and a provider network with NAT | 12:24 |
| ajo | but that construct is only for nat, right? | 12:24 |
| russellb | yes | 12:24 |
| ajo | ok | 12:24 |
| russellb | we basically have to create 2 routers in OVN | 12:24 |
| russellb | a distributed one, and then a central one that does the NAT | 12:24 |
| russellb | if you were connecting to a physical network without NAT, we could do that fully distributed | 12:26 |
| ajo | ok, and that central one is just in one host, right? | 12:26 |
| russellb | yes | 12:26 |
| russellb | now, with floating IPs, the current patch puts them on the gateway router | 12:26 |
| russellb | so, they're central | 12:26 |
| russellb | we can make them distributed, but that code isn't finished yet | 12:26 |
| russellb | it's an obvious improvement we need ot make | 12:26 |
| russellb | but that's the current state | 12:26 |
| ajo | ack | 12:26 |
| ajo | ok, for now it will do if I get to set it up manually on the same host | 12:27 |
| ajo | I guess it'd be very similar in terms of perf | 12:27 |
| russellb | yes | 12:27 |
| ajo | okay | 12:27 |
| ajo | another question, do we have any way to re-schedule those central routers to another "network node" if network node fails ? | 12:28 |
| ajo | that'd be similar to the current l3-plugin automatic rescheduling on failure | 12:28 |
| russellb | L3 HA? | 12:28 |
| ajo | no | 12:28 |
| ajo | something in the middle | 12:28 |
| ajo | we have it in neutron, let me look for the option | 12:28 |
| russellb | well, no | 12:28 |
| ajo | it's active passive | 12:28 |
| russellb | :) | 12:28 |
| ajo | รง | 12:29 |
| ajo | # Automatically reschedule routers from offline L3 agents to online L3 agents. | 12:29 |
| ajo | # (boolean value) | 12:29 |
| ajo | #allow_automatic_l3agent_failover = false | 12:29 |
| ajo | it's agent based, | 12:29 |
| ajo | but, an idea for improvement :) | 12:29 |
| russellb | yes | 12:29 |
| russellb | ovn is agent based in a sense, too | 12:30 |
| ajo | I guess northd could detect the failure may be and move it ? | 12:30 |
| russellb | conceptually, perhaps, but not easy today for a couple reasons | 12:30 |
| russellb | first, networking-ovn actually does the scheduling | 12:30 |
| ajo | aha | 12:30 |
| russellb | and second, we don't have a way to auto detect failure | 12:30 |
| ajo | so may be it's better to report agents to neutron database, and let neutron move them | 12:30 |
| russellb | they're all listed in the OVN southbound database | 12:31 |
| ajo | but ovn (standalone) would lack that feature, which is nice :) | 12:31 |
| russellb | yeah, but OVN isn't really intended to be used standalone ... | 12:31 |
| russellb | well, it certainly can be | 12:31 |
| ajo | I guess it depends on where you draw the line :) | 12:32 |
| russellb | but mostly intended to be integrated into another system (OpenStack, Kubernetes, Mesos, Docker networking, oVirt, so far) | 12:32 |
| ajo | makes sense | 12:32 |
| russellb | yeah, drawing the line has been tough | 12:32 |
| russellb | different systems want the line in different places | 12:32 |
| russellb | Neutron has no interest in IPAM from OVN | 12:32 |
| ajo | ''':D | 12:32 |
| russellb | but oVirt really wants it | 12:33 |
| russellb | Kubernetes uses features OpenStack doesn't | 12:33 |
| russellb | since we're on the topic of gateways .... | 12:33 |
| ajo | discussion brought to a new level :D | 12:33 |
| russellb | an interesting feautre going in primarily for Kubernetes was some initial "policy based routing" | 12:33 |
| russellb | basically, multiple L3 gateways on the same network, and having traffic distributed among them | 12:34 |
| russellb | i don't think that's something we can really express through the Neutron API, but maybe we can figure out a way to integrate it ... | 12:34 |
| russellb | i haven't thought too hard about it yet | 12:34 |
| ajo | hmmm | 12:34 |
| russellb | but it seems very useful | 12:34 |
| ajo | what kind of policies can you use? | 12:34 |
| ajo | traffic type? packet flags? sources ? | 12:34 |
| russellb | well, we can add new types of policy | 12:35 |
| russellb | first implementation is just based on source | 12:35 |
| russellb | https://patchwork.ozlabs.org/patch/679069/ | 12:35 |
| ajo | this sounds in harmony with the traffic classification thing | 12:35 |
| russellb | hm, could be | 12:35 |
| ajo | you add a classifier to each router | 12:35 |
| russellb | would be easy to extend this to a more general traffic match instead of just source | 12:35 |
| russellb | oh, then yes, | 12:35 |
| russellb | that would line up with this | 12:35 |
| ajo | to steer specific types of traffic through it | 12:35 |
| russellb | so, another really key thing to note with this feature | 12:36 |
| ajo | well the TC were intended for other stuffs, but I guess such model could work | 12:36 |
| russellb | if you look at the implementation, and discard test cases, docs, and client command line helper code, this feature took ***24*** lines of code | 12:36 |
| russellb | C code, even | 12:36 |
| russellb | because it's something we can express in logical flows | 12:37 |
| ajo | :o | 12:37 |
| russellb | logical flows are one of the key powerful abstractions inside of OVN | 12:37 |
| russellb | OVN is a big distributed compiler of these higher level logical flows down into physical OpenFlow on each host based on the current state of the world | 12:38 |
| russellb | and i just think that is super cool. | 12:38 |
| ajo | :D | 12:38 |
| ajo | it is | 12:38 |
| russellb | anyway, off topic | 12:38 |
| russellb | i'm in OVN sales mode over here | 12:38 |
| ajo | lol :D | 12:38 |
| *** fzdarsky_ has joined #openstack-neutron-ovn | 12:42 | |
| *** fzdarsky_ has quit IRC | 12:42 | |
| *** portdirect has quit IRC | 12:47 | |
| *** portdirect has joined #openstack-neutron-ovn | 12:47 | |
| *** zkassab__ has joined #openstack-neutron-ovn | 13:01 | |
| *** fzdarsky_ has joined #openstack-neutron-ovn | 13:09 | |
| *** fzdarsky_ has quit IRC | 13:19 | |
| *** mlavalle has joined #openstack-neutron-ovn | 13:59 | |
| -openstackstatus- NOTICE: We are away of pycparser failures in the gate and working to address the issue. | 14:05 | |
| *** trinaths has quit IRC | 14:06 | |
| ajo | russellb, is dustin in this chat? :) | 14:16 |
| russellb | ajo: i don't know, don't think so | 14:17 |
| ajo | http://blog.spinhirne.com/2016/09/the-ovn-gateway-router.html misses a step (creating tenant1) | 14:17 |
| russellb | gotcha | 14:17 |
| russellb | i think he's on the ovs dev list ... i believe posted a link to his blog series | 14:18 |
| russellb | ajo: is it obvious enough what's missing? | 14:23 |
| ajo | russellb, nah, it's me, I had to start from his previous blog post | 14:39 |
| russellb | ajo: oh, yeah, sorry | 14:40 |
| *** mickeys has joined #openstack-neutron-ovn | 14:53 | |
| *** mickeys has quit IRC | 15:00 | |
| *** armax has joined #openstack-neutron-ovn | 15:31 | |
| ajo | russellb, ok, so I got snat (VMs->outside) | 15:47 |
| ajo | ovn-nbctl -- --id=@nat create nat type="snat" logical_ip=172.16.255.128/25 \ | 15:47 |
| ajo | external_ip=10.127.0.129 -- add logical_router edge1 nat @nat | 15:47 |
| ajo | but, how do I get snat-dnat ? | 15:47 |
| * ajo looks for the nat patch :) | 15:47 | |
| russellb | i.e., floating ip? | 15:47 |
| ajo | yup | 15:47 |
| ajo | ohhh, I see flaviof has been having fun https://github.com/flavio-fernandes/just-ovn-nodes/blob/master/scripts/tutorial/l3_nat/setup.sh uh? ;) | 15:48 |
| flaviof | ajo: hahah... always fun! | 15:48 |
| * flaviof playing with sfc demo next | 15:49 | |
| ajo | flaviof, so the equivalent of a "floating ip" is adding both a dnat + snat rule, right? | 15:50 |
| ajo | one for ingress, another for egress ? | 15:50 |
| flaviof | yes, that is right. | 15:50 |
| ajo | thanks flaviof :) | 15:50 |
| russellb | the NAT table supports a few different types of NAT | 15:50 |
| russellb | snat, dnat, or dnat_and_snat | 15:50 |
| flaviof | btw, I adapted http://blog.spinhirne.com/2016/09/the-ovn-gateway-router.html to just-ovn-nodes recently | 15:50 |
| flaviof | dnat_and_snat, I think. Finding the line.... | 15:51 |
| russellb | http://openvswitch.org/support/dist-docs/ovn-nb.5.html | 15:51 |
| russellb | search for "NAT TABLE" | 15:51 |
| *** numans has quit IRC | 16:01 | |
| flaviof | what russellb says ^^ | 16:02 |
| *** fzdarsky is now known as fzdarsky|afk | 16:10 | |
| -openstackstatus- NOTICE: pycparser 2.16 released to fix assertion error from today. | 16:11 | |
| *** numans has joined #openstack-neutron-ovn | 16:20 | |
| numans | russellb, can you please have a look at https://review.openstack.org/#/c/326964/ and https://review.openstack.org/#/c/386016/ if you get some time | 16:21 |
| *** zkassab has joined #openstack-neutron-ovn | 16:25 | |
| *** zkassab__ has quit IRC | 16:28 | |
| russellb | numans: yes, i need to get lunch, but i will look | 16:29 |
| numans | russellb, thanks. | 16:30 |
| ajo | awesome, russellb | 17:07 |
| ajo | thanks | 17:07 |
| *** numans has quit IRC | 17:26 | |
| ajo | russellb, flaviof, what I don't see now, is how to have the floating IP (DVR) without the intermediate (chasis bound GW) | 17:29 |
| ajo | Isn't that always necessary because we need to translate back & forth to the VM fixed IP ? | 17:30 |
| ajo | it will always be a local router to each chasis so we're able to do that? | 17:30 |
| * russellb tries to understand the question.. | 17:32 | |
| russellb | ajo: are you asking how we'll distribute floating IPs? | 17:32 |
| russellb | instead of putting them all on the central router? | 17:32 |
| *** igordcard has quit IRC | 17:33 | |
| *** basilAB has quit IRC | 17:33 | |
| *** ltomasbo has quit IRC | 17:33 | |
| *** SpamapS has quit IRC | 17:33 | |
| *** kevinbenton has quit IRC | 17:33 | |
| *** switchcade has quit IRC | 17:33 | |
| *** igordcard has joined #openstack-neutron-ovn | 17:33 | |
| *** switchcade has joined #openstack-neutron-ovn | 17:34 | |
| ajo | russellb, about the implementation detail on the OVN side | 17:34 |
| ajo | russellb, just to know if it's always going to have a transit router | 17:34 |
| *** basilAB has joined #openstack-neutron-ovn | 17:34 | |
| russellb | oh, i see | 17:34 |
| *** SpamapS has joined #openstack-neutron-ovn | 17:34 | |
| ajo | well or transit network to the edge router, and an edge router for the floating ips (of the VMs on the node) | 17:34 |
| russellb | someone had patches in progress to eliminate the need for the transit network in between | 17:35 |
| ajo | russellb, oh, /me looks at ozworks | 17:35 |
| *** fkautz has quit IRC | 17:36 | |
| russellb | i don't see them | 17:36 |
| *** kevinbenton has joined #openstack-neutron-ovn | 17:36 | |
| ajo | ok, just curious, just to know if what I was trying to test make sense | 17:36 |
| *** ltomasbo has joined #openstack-neutron-ovn | 17:37 | |
| russellb | ajo: for a single node setup, i don't expect the performance to be any different ... | 17:37 |
| russellb | with or without it | 17:37 |
| russellb | since it'll all get optimized out in the fast path | 17:38 |
| ajo | hmmm russellb right, may be for new connection establishements / RR tests can be any difference | 17:38 |
| *** SpamapS has quit IRC | 17:39 | |
| *** SpamapS has joined #openstack-neutron-ovn | 17:39 | |
| ajo | not sure if for a new connection we need a new rule on the datapath | 17:39 |
| ajo | may be not with CT | 17:39 |
| ajo | hmm | 17:39 |
| flaviof | ack; I agree. But yes, you need gateway router (bind to a chassis) in order to have north-south. Same as in the DVR reference model, right? | 17:39 |
| ajo | flaviof, right, just less messier | 17:39 |
| russellb | flaviof: so, i had a thought of how we could do distributed SNAT with OVN | 17:39 |
| ajo | I wonder why do we end up having those intermediate networks everywhere ;D | 17:39 |
| ajo | russellb++ | 17:40 |
| russellb | ajo: you can think of the intermediate networks as a convenience thing that may not remain | 17:40 |
| russellb | it's convenient because then we don't need special logic in OVN to figure out when to be distributed vs not automatically | 17:40 |
| russellb | it's much more explicit this way | 17:40 |
| ajo | yes | 17:41 |
| ajo | that's true | 17:41 |
| russellb | downside is that it pushes some complexity on to what neutron (or whatever) has to configure | 17:41 |
| ajo | yeah, it's not an important thing, that eventually can be optimized if necessary | 17:41 |
| russellb | flaviof: have you seen guru's policy based routing patch? | 17:41 |
| russellb | ajo: yes | 17:41 |
| flaviof | russellb: ack | 17:42 |
| flaviof | yes, based on Guru's | 17:42 |
| russellb | flaviof: i was thinking with that patch, we could create an l3 gateway on every hypervisor | 17:42 |
| russellb | and set policy so that the traffic from each VM is directed to the local l3gw | 17:42 |
| russellb | no more code needed in OVN, just networking-ovn | 17:42 |
| russellb | and we'd have distributed SNAT (at the cost of a public IP and tenant network IP per hypervisor) | 17:43 |
| russellb | anyway, just a thought from earlier today.. | 17:43 |
| flaviof | ic; i may be missing out on the details, but I imagine only one of the 'l3_gw' should reply to arps (on the border outside ovn network) and fwd the packets to the internal ip. | 17:44 |
| *** fkautz has joined #openstack-neutron-ovn | 17:45 | |
| russellb | don't worry about it | 17:46 |
| russellb | maybe i'll document it in a proposal someday with pictures and such | 17:46 |
| russellb | and come back with something not half baked :) | 17:46 |
| russellb | ajo: so is following that blog working for you? | 17:47 |
| flaviof | ack. it is in extremely capable hands; so I have no worries whatsoever. | 17:47 |
| russellb | ajo: i have my own centos7 devstack ovn ready if we need to resurrect the original approach if that blog isn't getting you what you need | 17:50 |
| ajo | russellb, ack, thanks, I think I can probably make it with the blog post, or even flaviof's vagrant after some tunings for libvirt provider ;) | 17:51 |
| * flaviof facepalm | 17:51 | |
| russellb | ajo: ok | 17:51 |
| ajo | flaviof, using vbox?, I can't believe it ;) (joking) | 17:51 |
| ajo | russellb, don't destroy for just in case | 17:52 |
| flaviof | ajo: if you get a Vagrant provider on libvirt, please make a PR | 17:52 |
| russellb | ajo: i won't | 17:52 |
| ajo | thanks :) | 17:52 |
| ajo | I will continue tomorrow, have a nice evening ! ;) | 17:52 |
| flaviof | see you soon. both of you! | 17:52 |
| russellb | ajo: have a good night! | 17:54 |
| ajo | thanks :) | 17:56 |
| *** mickeys has joined #openstack-neutron-ovn | 18:30 | |
| openstackgerrit | Merged openstack/networking-ovn: Support native OVN DHCPv6 https://review.openstack.org/326964 | 18:42 |
| openstackgerrit | Merged openstack/networking-ovn: Fix the KeyError in neutron-ovn-db-sync-util https://review.openstack.org/386016 | 18:42 |
| openstackgerrit | Russell Bryant proposed openstack/networking-ovn: README: Add link to an OVN blog series. https://review.openstack.org/388192 | 19:53 |
| *** portdirect has quit IRC | 20:00 | |
| *** portdirect has joined #openstack-neutron-ovn | 20:05 | |
| *** s3wong has joined #openstack-neutron-ovn | 20:34 | |
| *** zkassab has quit IRC | 21:05 | |
| *** flaviof has quit IRC | 21:15 | |
| *** flaviof has joined #openstack-neutron-ovn | 21:16 | |
| *** rtheis has quit IRC | 21:39 | |
| *** portdirect has quit IRC | 21:48 | |
| *** portdirect has joined #openstack-neutron-ovn | 21:50 | |
| *** gongysh has joined #openstack-neutron-ovn | 22:41 | |
| *** gongysh has quit IRC | 22:46 | |
| *** mickeys has quit IRC | 23:20 | |
| *** mickeys has joined #openstack-neutron-ovn | 23:20 | |
| *** yamamoto has quit IRC | 23:38 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!