| opendevreview | Rodolfo Alonso proposed openstack/neutron master: DNM - Test "neutron-ovn-tempest-ipv6-only-ovs*" with WSGI https://review.opendev.org/c/openstack/neutron/+/932601 | 07:37 |
|---|---|---|
| opendevreview | Rodolfo Alonso proposed openstack/neutron master: [eventlet-removal] Use non-eventlet metadata proxy in OVN metadata agent https://review.opendev.org/c/openstack/neutron/+/938393 | 07:42 |
| opendevreview | Sahid Orentino Ferdjaoui proposed openstack/neutron master: async_process: remove usage of eventlet for AsyncProcess https://review.opendev.org/c/openstack/neutron/+/939348 | 07:44 |
| opendevreview | Sahid Orentino Ferdjaoui proposed openstack/neutron master: ovs: reimplement signals handling https://review.opendev.org/c/openstack/neutron/+/939321 | 07:44 |
| opendevreview | Sahid Orentino Ferdjaoui proposed openstack/neutron master: common: fix wait_until_true to support native thread https://review.opendev.org/c/openstack/neutron/+/937843 | 07:44 |
| opendevreview | Sahid Orentino Ferdjaoui proposed openstack/neutron master: ovs: remove the usage of eventlet in the OVS agent https://review.opendev.org/c/openstack/neutron/+/937765 | 07:44 |
| opendevreview | Lajos Katona proposed openstack/tap-as-a-service master: Doc: add documentation for usage and driver details for SRIOV driver https://review.opendev.org/c/openstack/tap-as-a-service/+/881807 | 07:56 |
| sahid | ralonsoh: o/ | 08:09 |
| sahid | I just replied to https://review.opendev.org/c/openstack/neutron/+/939627 if you don't mind commenting again ;-) I may have missed something | 08:09 |
| ralonsoh | I'll check it | 08:12 |
| opendevreview | Fernando Royo proposed openstack/ovn-octavia-provider master: Member batch actions to increase performance https://review.opendev.org/c/openstack/ovn-octavia-provider/+/936765 | 08:38 |
| opendevreview | Lajos Katona proposed openstack/tap-as-a-service master: bandit: add bandit and bashate checks for tox https://review.opendev.org/c/openstack/tap-as-a-service/+/915421 | 08:38 |
| opendevreview | Slawek Kaplonski proposed openstack/neutron master: Don't change original target dict by the OwnerCheck policy rule https://review.opendev.org/c/openstack/neutron/+/939624 | 10:59 |
| opendevreview | Slawek Kaplonski proposed openstack/neutron master: Make API policies for tags to be working with resource attributes https://review.opendev.org/c/openstack/neutron/+/938135 | 11:00 |
| opendevreview | Rodolfo Alonso proposed openstack/neutron master: [eventlet-removal] Remove the usage of eventlet in the Neutron API https://review.opendev.org/c/openstack/neutron/+/938659 | 12:24 |
| opendevreview | Rodolfo Alonso proposed openstack/neutron master: WIP == [OVN] ``PortBindingUpdateUpEvent`` https://review.opendev.org/c/openstack/neutron/+/939345 | 12:26 |
| opendevreview | Rodolfo Alonso proposed openstack/neutron master: DNM - Test "neutron-ovn-tempest-ipv6-only-ovs*" with WSGI https://review.opendev.org/c/openstack/neutron/+/932601 | 12:27 |
| opendevreview | Bence Romsics proposed openstack/neutron master: Do not assume the existence of a trunk bridge since os-vif may have deleted it https://review.opendev.org/c/openstack/neutron/+/939786 | 12:43 |
| opendevreview | Sahid Orentino Ferdjaoui proposed openstack/neutron master: async_process: remove usage of eventlet for AsyncProcess https://review.opendev.org/c/openstack/neutron/+/939348 | 12:50 |
| opendevreview | Sahid Orentino Ferdjaoui proposed openstack/neutron master: ovs: reimplement signals handling https://review.opendev.org/c/openstack/neutron/+/939321 | 12:50 |
| opendevreview | Sahid Orentino Ferdjaoui proposed openstack/neutron master: common: fix wait_until_true to support native thread https://review.opendev.org/c/openstack/neutron/+/937843 | 12:50 |
| opendevreview | Sahid Orentino Ferdjaoui proposed openstack/neutron master: ovs: remove the usage of eventlet in the OVS agent https://review.opendev.org/c/openstack/neutron/+/937765 | 12:50 |
| opendevreview | Rodolfo Alonso proposed openstack/neutron master: Add to setup.cfg the long_description and type fields https://review.opendev.org/c/openstack/neutron/+/939806 | 14:27 |
| ralonsoh | lajoskatona, slaweq ^ if you don't mind, a trivial patch | 14:27 |
| ralonsoh | a CI job is failing because of that | 14:27 |
| opendevreview | Rodolfo Alonso proposed openstack/neutron master: Add to setup.cfg the long_description and type fields https://review.opendev.org/c/openstack/neutron/+/939806 | 15:07 |
| haleyb | ralonsoh: i'll take a look as well | 15:11 |
| opendevreview | Rodolfo Alonso proposed openstack/neutron master: DNM - Test "neutron-ovn-tempest-ipv6-only-ovs*" with WSGI https://review.opendev.org/c/openstack/neutron/+/932601 | 15:26 |
| slaweq | ralonsoh I just commented on https://review.opendev.org/c/openstack/neutron/+/939806 | 15:34 |
| ralonsoh | slaweq, yes, this is related to the README file | 15:35 |
| haleyb | changing to # didn't help, there's some indendation it doesn't like? how do we run that job locally? | 15:36 |
| ralonsoh | haleyb, it is needed to execute some zuul-config roles manually | 15:37 |
| opendevreview | Rodolfo Alonso proposed openstack/neutron master: Add to setup.cfg the long_description and type fields https://review.opendev.org/c/openstack/neutron/+/939806 | 15:38 |
| haleyb | right, i was just wondering how to run it locally with tox | 15:38 |
| ralonsoh | no, I don't know how to do this | 15:39 |
| ralonsoh | but you can build the dist and then run twine | 15:39 |
| haleyb | ack, hopefully your latest change makes it happy | 15:39 |
| ralonsoh | stack@u22ovn:/opt/stack/neutron$ twine check dist/* | 15:40 |
| ralonsoh | Checking dist/neutron-26.0.0.0b3.dev135.tar.gz: PASSED | 15:40 |
| haleyb | \o/ | 15:40 |
| ralonsoh | this is passing locally... but I don't know why is failing in the CI | 15:40 |
| haleyb | because it knows we're watching it :) | 15:41 |
| opendevreview | Merged openstack/neutron-fwaas master: [OVN] Fix the provider error in devstack settings https://review.opendev.org/c/openstack/neutron-fwaas/+/934103 | 15:45 |
| ralonsoh | haleyb, I don't understand | 15:49 |
| ralonsoh | https://documatt.com/restructuredtext-reference/element/section.html | 15:49 |
| ralonsoh | according to this, PS1 should be correct | 15:49 |
| opendevreview | Bodo Petermann proposed openstack/neutron master: Allow plugins to add periodics to maintenance worker https://review.opendev.org/c/openstack/neutron/+/939817 | 15:51 |
| haleyb | ralonsoh: i'm looking at other repos, and most don't have this. But pyroute2 does - it has no '=====' on the top line, and in setup.cfg has "file: README.rst" for long_description (no ""), don't know what else to try yet | 15:56 |
| ralonsoh | haleyb, yes, I was looking at something like this | 15:56 |
| ralonsoh | because we already have description_file = | 15:56 |
| ralonsoh | README.rst | 15:56 |
| ralonsoh | so my current patch is redundant | 15:56 |
| haleyb | ah | 15:57 |
| haleyb | so you just need the long_description_content_type line? | 15:58 |
| *** gthiemon1e is now known as gthiemonge | 15:58 | |
| ralonsoh | yes, I think so, I'm testing locally | 16:01 |
| ralonsoh | 30 mins for a packaing error... | 16:01 |
| ralonsoh | pffff | 16:01 |
| haleyb | i can take over if you want to work on other things, i have the time to wait-out zuul failures | 16:02 |
| ralonsoh | next patch will be the last for today | 16:02 |
| ralonsoh | I need to go in 5 mins | 16:02 |
| opendevreview | Rodolfo Alonso proposed openstack/neutron master: Add to setup.cfg the long_description_content_type field https://review.opendev.org/c/openstack/neutron/+/939806 | 16:04 |
| ralonsoh | see you tomorrow | 16:04 |
| opendevreview | Brian Haley proposed openstack/neutron master: Add to setup.cfg the long_description_content_type field https://review.opendev.org/c/openstack/neutron/+/939806 | 17:26 |
| opendevreview | Brian Haley proposed openstack/neutron master: Make API policies for tags to be working with resource attributes https://review.opendev.org/c/openstack/neutron/+/938135 | 17:37 |
| opendevreview | Brian Haley proposed openstack/neutron master: Add to setup.cfg the long_description_content_type field https://review.opendev.org/c/openstack/neutron/+/939806 | 17:53 |
| frickler | https://www.openwall.com/lists/oss-security/2025/01/22/5 relevant for anyone running OVN I guess | 19:24 |
| sean-k-mooney | oh fun | 19:29 |
| sean-k-mooney | frickler: so im not sure about ovn but egree in ovs i considerd ingress in neutron/nova | 19:30 |
| sean-k-mooney | as in egree form ovs is leaving ovs and entering the vm or nic | 19:31 |
| sean-k-mooney | at least in terms of qos | 19:31 |
| sean-k-mooney | so i think what they are descibing would affect security group ingress rules potientially if dns cahcing is enabled | 19:32 |
| sean-k-mooney | im not famiar enouch with how neuton uses ovn to say really, and if dns caching in ovn is normally enabled in an openstack context | 19:33 |
| frickler | yes, I don't understand the impact myself yet, but JayF and haleyb being listed as references makes me assume there is one for neutron | 19:35 |
| JayF | I emailed the list including the OpenStack bug ref | 19:36 |
| JayF | That openstack bug report describes the impact in a neutron context pretty clearly | 19:36 |
| JayF | AIUI the tl;dr is that in some configurations, DNS ports will be wide open to the internet regardless of your filtering config | 19:37 |
| sean-k-mooney | ah the email you jsut ssent title "[security-sig][ops][neutron] OVN Security issue can impact OpenStack users" | 19:37 |
| frickler | oh, I didn't see that mail before, thx for the pointer | 19:38 |
| sean-k-mooney | so https://bugs.launchpad.net/ossa/+bug/2088280 | 19:38 |
| JayF | Yeah, about two hours ago, it wasn't public/released until late last night my-local-time | 19:38 |
| sean-k-mooney | oh yep i didnt check the time it was just the top one in my openstack-discuss folder | 19:39 |
| sean-k-mooney | hum, so i tought udp port 53 was alwasy open in neutron by design for dns | 19:39 |
| sean-k-mooney | so that might be expected | 19:40 |
| sean-k-mooney | i.e. udp packets form port 53 are always allowed | 19:40 |
| JayF | I would take that up with the neutron developers who were consulting on that bug; Slawek Kaplonski and Brian Haley | 19:41 |
| JayF | I mainly played the role of paperwork-pusher with a VMT hat on; I'm not an OVN or really a neutron expert outside of NGS (which is technically Ironic) :D | 19:42 |
| sean-k-mooney | i metioned it to them internally just to make sure it was on there radar | 19:43 |
| JayF | either way, OVN clearly didn't intend the behavior so it's a win for them :) | 19:44 |
| sean-k-mooney | ah this is what i was thinking of, we allow dhcp/neber discovery by default not dns | 19:48 |
| sean-k-mooney | https://github.com/openstack/neutron/blob/master/neutron/agent/linux/iptables_firewall.py#L544-L555 | 19:48 |
| sean-k-mooney | we do the same for the openflow firewall https://github.com/openstack/neutron/blob/7031da2cc2bca3364e4c169975bfca8fba39f1bf/neutron/plugins/ml2/drivers/openvswitch/agent/openflow/native/br_int.py#L114 | 19:53 |
| sean-k-mooney | i personally stopped workign on neutron before ovn was brought in tree so i never look at how this works in that case btu we do knwo that there are difference between ml2/ovs and ml2/ovn | 19:54 |
| haleyb | right, this was just DNS, and luckily a pretty straightforward fix | 20:04 |
| frickler | well just udp src port 53 doesn't necessarily restrict it to DNS? even then this might be critical for some applications | 20:08 |
| sean-k-mooney | well if you explcitly open port 53 for ingress in your security group rules that woud take precendce | 20:13 |
| sean-k-mooney | nuetons default secufity groups allow all traiffc out and now trafic in except for dhcp adn related conenctions | 20:14 |
| sean-k-mooney | i.e. when clodu init reaches out to the metadata api that request will be trakced by hte kernel connection tracker to allow the responce to the tcp/http request | 20:15 |
| sean-k-mooney | so i think think this ovn fix shoudl break anything but if it did you could explcitly allow udp port 53 again | 20:15 |
| haleyb | sean-k-mooney: while i have you here, could you take a look at https://bugs.launchpad.net/neutron/+bug/2051863 ? i think it's really nova/os-vif figured you might have an opinion | 20:17 |
| sean-k-mooney | sure | 20:18 |
| sean-k-mooney | so that expected behgavior becuase we have to create the port in ovs before libvirt creates the tap so that neutron can wire it up before we start the vm | 20:18 |
| sean-k-mooney | i have not read it fully yet by the way | 20:19 |
| haleyb | ack, just wondering if it's a new race condition | 20:20 |
| sean-k-mooney | so here they are tryign to sue flavor based qos on the tap | 20:20 |
| sean-k-mooney | which is sort of deprecated | 20:20 |
| sean-k-mooney | we tell peopel not ot od that any more and prefer neutorn qos | 20:21 |
| sean-k-mooney | because the flavor based qos only work when using linux bridge or ml2/ovs with iptables | 20:21 |
| sean-k-mooney | if this is ml2/ovs with the ovs secuirty group driver or ovn then you cant do qos with tc directly on the tap | 20:22 |
| sean-k-mooney | unless im misremebering | 20:22 |
| sean-k-mooney | its posible this was broken as a result of https://github.com/openstack/os-vif/commit/c0d101aa81cff200e1db2a0746598b72e26748e4 | 20:24 |
| haleyb | hah, i was looking at that bug too. in my case we also see this on yoga-series so that change isn't in play | 20:25 |
| sean-k-mooney | its posible that ovs and libvirt are fightign over the qdisk on the tap | 20:26 |
| haleyb | so in my case i do see flavor settings, like quota:vif_inbound_burst='250000' - when did we start recommending using neutron qos instead? i mean, if we can say "do this instead" and remove that it would be an easy answer | 20:30 |
| sean-k-mooney | about 6 to 8 years ago | 20:34 |
| sean-k-mooney | haleyb: basically when qos was added to neutron :) | 20:34 |
| haleyb | i see rocky and later then :) | 20:34 |
| sean-k-mooney | more or less | 20:35 |
| sean-k-mooney | as i said this was only supproted in a limite number of cases | 20:35 |
| haleyb | at least google found rocky | 20:35 |
| sean-k-mooney | ovs with iptabels and linux bridg if i recall | 20:35 |
| haleyb | so i have an outlier here then, they're running ml2/ovs with ovs firewall | 20:37 |
| haleyb | i can at least push them in a direction | 20:37 |
| sean-k-mooney | i have a comment pendign | 20:37 |
| sean-k-mooney | but i think https://github.com/openvswitch/ovs-issues/issues/268 | 20:37 |
| sean-k-mooney | is what broke this | 20:37 |
| haleyb | that nova bug ^^^ might need a similar push, don't know | 20:38 |
| sean-k-mooney | basically before ovs woudl ignore the qdisc on a tap if it had one that it did nto add | 20:38 |
| sean-k-mooney | but later ovs was chagned to override it | 20:38 |
| sean-k-mooney | haleyb: https://bugs.launchpad.net/neutron/+bug/2051863/comments/7 that a brain dump of the relevnet context i have | 20:46 |
| sean-k-mooney | haleyb: the only thing that i can think fo to try to make this work woudl be to modify https://github.com/openstack/os-vif/blob/master/vif_plug_ovs/ovs.py#L422-L426 to return None if the flavor has vif qos | 20:49 |
| sean-k-mooney | that would result in us creatign the port withotu addign any qos to it in ovs | 20:50 |
| sean-k-mooney | but i think that may not have the desired effect | 20:50 |
| sean-k-mooney | we no set it to linux-noop by default | 20:51 |
| sean-k-mooney | we could also allow a way to explcity opt out of a default here https://github.com/openstack/os-vif/blob/master/vif_plug_ovs/ovs.py#L104-L108 | 20:51 |
| sean-k-mooney | but again i think ovs will jsut remove the qdisc added by libvirt | 20:51 |
| sean-k-mooney | althoguh as the doc text says https://github.com/openstack/os-vif/blob/master/vif_plug_ovs/ovs.py#L110-L115 | 20:52 |
| sean-k-mooney | ovs shoudl not modify the qdsc fi we set linux-noop | 20:53 |
| haleyb | right, should leave alone | 20:53 |
| sean-k-mooney | so i dont think that is the actual probelm | 20:53 |
| sean-k-mooney | they are runing zed | 20:53 |
| sean-k-mooney | i wonder if that patch is backported to zed | 20:53 |
| sean-k-mooney | that woudl be a no | 20:54 |
| sean-k-mooney | https://review.opendev.org/c/openstack/os-vif/+/883016 | 20:54 |
| sean-k-mooney | i fixed it in bobcat | 20:54 |
| haleyb | this customer is going to yoga, so that wouldn't apply. i only saw that change back to 2024.2 i think? | 20:55 |
| sean-k-mooney | ya so i backported this downstream | 20:55 |
| sean-k-mooney | https://review.opendev.org/q/Id9ef7074634a0f23d67a4401fa8fca363b51bb43 | 20:55 |
| haleyb | 2023.2 was the backport | 20:55 |
| sean-k-mooney | upsteam we created them but the branches were out of supprot | 20:56 |
| sean-k-mooney | so we didnt merge them in the end | 20:56 |
| sean-k-mooney | we backproted it all the way to wallaby for 17 downstream and made the pathces avaible for other to use if they wanted them | 20:56 |
| haleyb | i hate cherry-picking unmerged code downstream if i can help it, since like you i'd need to hit everything in-between lts releases :( | 20:57 |
| sean-k-mooney | well i alwasy do that regardless | 20:58 |
| sean-k-mooney | i.e. if im backproting it downstream ill bakcport to all open upstream stable patches first | 20:58 |
| sean-k-mooney | before doign the down stream cherry pick | 20:58 |
| haleyb | we do things differently here of course, no clone of upstream repos downstream, we *are* upstream :-p | 21:00 |
| sean-k-mooney | if our downsteam was not usign unreasonably old version i would love to do that | 21:01 |
| sean-k-mooney | i consierd any release of opesntack that is more then 2 year behidn master to be unreasonable old to use in production | 21:01 |
| haleyb | but our customers don't of course, and they pay the bills | 21:02 |
| sean-k-mooney | damb users and custoemrs | 21:03 |
| sean-k-mooney | expecting long term support and working software | 21:03 |
| sean-k-mooney | so unreasonabel | 21:03 |
| haleyb | can you re-create that on master with devstack doesn't work | 21:03 |
| sean-k-mooney | oh you tried it and it does not work | 21:04 |
| sean-k-mooney | are you usign ovn or ml2/ovs with iptables | 21:04 |
| haleyb | thanks for looking at the bug, i'll watch and see if there are any positive replies | 21:04 |
| haleyb | we are mostly ovn, occasional ml2/ovs with ovs firewall, but there are some unicorns out there | 21:05 |
| haleyb | i advised on using neutron qos, if i get feedback will add to the bug | 21:06 |
| sean-k-mooney | just to clarif did you try this on master? | 21:07 |
| sean-k-mooney | and it didnt work | 21:07 |
| sean-k-mooney | if its broken on master then it might eb somethign we can fix if its only broken on zed because that does nto have the os-vif chagne then thats differnt | 21:08 |
| sean-k-mooney | if it works on master using os-vif 3.2.0 might resolve the issue for them | 21:08 |
| haleyb | we can't re-create the issue of course on yoga, but fyi it involves instances with ~5 interfaces, just 1 is usually fine | 21:09 |
| sean-k-mooney | ack. i can see if i can replciate this tomorrow | 21:10 |
| sean-k-mooney | im just finishing for today but i have a releivly recent devstack with ovn i think | 21:10 |
| sean-k-mooney | so ill see if i can replcaite that or not | 21:10 |
| sean-k-mooney | o/ | 21:10 |
| haleyb | thanks sean o/ | 21:10 |
| opendevreview | Brian Haley proposed openstack/neutron master: Add to setup.cfg the long_description_content_type field https://review.opendev.org/c/openstack/neutron/+/939806 | 22:02 |
| opendevreview | Brian Haley proposed openstack/neutron master: Optionally configure IPv6 metadata address https://review.opendev.org/c/openstack/neutron/+/926497 | 22:13 |
| opendevreview | Jakub Libosvar proposed openstack/neutron master: Update NAT entry on FIP update https://review.opendev.org/c/openstack/neutron/+/939918 | 22:17 |
| opendevreview | Brian Haley proposed openstack/neutron master: Add to setup.cfg the long_description_content_type field https://review.opendev.org/c/openstack/neutron/+/939806 | 22:42 |
| opendevreview | Brian Haley proposed openstack/neutron master: Add to setup.cfg the long_description_content_type field https://review.opendev.org/c/openstack/neutron/+/939806 | 22:48 |
| -opendevstatus- NOTICE: The Gerrit service on review.opendev.org will be offline momentarily for a restart to put some database compaction config changes into effect, and will return within a few minutes | 22:54 | |
| opendevreview | Brian Haley proposed openstack/neutron master: Add to setup.cfg the long_description_content_type field https://review.opendev.org/c/openstack/neutron/+/939806 | 22:58 |
| opendevreview | Brian Haley proposed openstack/neutron master: Add to setup.cfg the long_description_content_type field https://review.opendev.org/c/openstack/neutron/+/939806 | 23:16 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!