Monday, 2018-07-30

*** huntxu has joined #openstack-qinling01:43
*** blkart has quit IRC03:33
*** blkart has joined #openstack-qinling03:35
openstackgerritMerged openstack/python-qinlingclient master: handle required parameters not provided case in function creation  https://review.openstack.org/58646304:00
*** caoyuan has joined #openstack-qinling09:51
*** caoyuan has quit IRC10:14
*** caoyuan has joined #openstack-qinling10:29
*** caoyuan has quit IRC10:50
*** huntxu has quit IRC11:15
*** larainema has quit IRC11:27
*** caoyuan has joined #openstack-qinling12:04
*** caoyuan has quit IRC12:04
chiragaroralxcong: I just cloned the qinling repo and installed tempest using pip. Is anything else required?12:33
*** ChanServ changes topic to "Qinling uses StoryBoard for feature and bug tracking: https://storyboard.openstack.org/#!/project/927"14:37
*** mnaser has joined #openstack-qinling17:58
mnaserhi everyone!  we're looking to see how to deploy qinling on our public cloud17:58
mnaserso we wanted to make it part of openstack ansible first17:58
mnasercan we setup a magnum cluster and link it to qinling?17:59
lxkongmnaser: yes, you can. Qinling can connect to any k8s cluster by changing some config options21:04
lxkongmnaser: FYI, https://docs.openstack.org/qinling/latest/admin/install/config_kubernetes.html21:05
mnaserlxkong: i noticed that docment, so how worried would one be for scope of things in a public cloud21:05
mnaserin terms of like multitenancy/etc21:05
lxkongmnaser: i don't understand what you mean by `how worried would one be for scope of things in a public cloud`21:06
mnaserwell the idea of how controlled a serverless function is because the kubernetes cluster would be a multitenant one at that point21:06
mnaserso tenant A and tenant B are sharing the same k8s cluster for their funcs21:06
lxkongmnaser: k8s cluster is shared between tenants in openstack.21:07
lxkongbut that's transparent to the end users21:07
mnaserright.  but does that mean i can maybe create a serverless function that talks to k8s api and lists pods.. or maybe something that loops forever and disturbs other tenants, etc?21:07
lxkongmnaser: unless you have the k8s credentials, othwewise you can not talk to k8s21:08
mnasergotcha. i thought pods could talk to k8s by default, but maybe i don't know much about k8s that much :)21:08
lxkongservice account is disabled in the pod21:08
mnaserack21:09
lxkonglxkong: and we are also working on security hardening in k8s for qinling21:09
mnaseri might write an openstack-ansible role to deploy it21:10
lxkongmnaser: but be aware of that, in public cloud, maybe you want to have your own runtime implentation21:10
lxkongmnaser: that will be great21:10
mnaserwhy not leverage the upstream runtimes?21:10
lxkongmnaser: you are running public cloud, do you want your end users know the implemenation details of the runtime?21:11
mnaseri mean the runtime is nothing more than a docker image with a language, no?21:11
lxkongthe malicious user may write 'bad' functions to try to exploit your cloud21:11
lxkongdocker is not safe21:11
lxkongthat's the reason we need to work on the security part21:11
lxkongs/docker/container21:11
mnaserso still not ready for public cloud as fully upstream21:12
lxkongmnaser: but that's up to you21:12
lxkongwe also working on hardening the reference runtime implementation to make it more close to production ready21:12
lxkongjust let you know, it's open source, and it's just a docker image, so you have full control of it21:13
mnaseryeah but we'd want to upstream anything, we wouldn't want to run downstream stuff :)21:13
mnaseri don't see a lot of docs around the runtime stuff21:13
lxkongmnaser: yeah, doc is difficult part for now :-) we are trying our best to improve, you know, we are a small team for now21:14
mnaserof course, i totally understand21:14
lxkongmnaser: may i know which cloud are you working on?21:14
lxkongor company?21:14
mnaservexxhost.com21:14
lxkongooh, i know21:14
lxkongmnaser: you can test qinling first, we welcome any feedback21:15
mnaseri wonder if qinling + kata would be the solution21:15
lxkonghah, yeah, definitely. That rely on the stability of kata21:15
lxkongi already tested that21:15
mnaserwell given how short lived the vms generally are21:15
mnaserwe might get away with a lot21:15
lxkongmnaser: qinling supports to run image type function, which means end user can package their function written in any programming language in a docker image21:16
lxkongand run the function by specifying the image21:16
mnaserwe have nested virt in our infra21:16
mnaserso if we run kata with k8s, it would be near native21:17
lxkongbut that will bring security conerns to the cloud21:17
lxkongso qinling supports to create 'untrusted' runtime21:17
mnaserat that point, if someone wants to run malicious code, it is the same thing as starting a vm and writing malicious code in it?21:17
lxkongyeah, vm will be safe21:17
mnaseri'll have to experiment running on kata, that might be the best solution21:18
mnaserthere's no settings to put timeouts on how long jobs run and stuff, right?21:18
lxkongkata is still in beta, maybe not suitable to run in production21:18
lxkongit's on the roadmap, but not implemented yet21:19
mnasergotcha21:19
mnasernotifications would be big too i guess to do billing21:19
lxkongyou are correct!21:19
mnaseryou know what would be cool though21:19
mnaserif using the api you can connect it to your own k8s cluster21:19
mnaserso user can create cluster using the way they want (magnum, kubeadm, etc)21:20
lxkongyeah,21:20
mnaserand then make an api request to 'authorize' qinling to use it21:20
mnaserthat might avoid the whole untrusted/billing/etc problem.. there's a lot of interesting solutions :)21:20
lxkongyou can find something you probably need here https://storyboard.openstack.org/#!/project/927, all on the roadmap21:20
mnaserwe're in the middle of creating 3 regions right now so we have a few things to iron out first, aha21:21
mnaserbut hopefully soon it will be ready21:21
lxkongmnaser: awesome. and any kind of contribution from you are welcomed :-)21:22
mnaserof course, you'll see it pick up when we're evalating it more :)21:22
lxkongnice21:22

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!