| *** EdwinGrubbs has quit IRC | 00:05 | |
| *** JordanRinke has joined #openstack | 00:21 | |
| *** jeremyb_ has quit IRC | 00:39 | |
| *** jeremyb_ has joined #openstack | 00:39 | |
| *** jeremyb_ is now known as jeremyb | 00:39 | |
| *** ccustine has quit IRC | 00:41 | |
| *** gaveen has quit IRC | 00:43 | |
| *** neogenix has joined #openstack | 00:46 | |
| *** gaveen has joined #openstack | 00:56 | |
| *** neogenix_ has joined #openstack | 01:02 | |
| *** ar1 has joined #openstack | 01:04 | |
| *** kim0 has quit IRC | 01:04 | |
| *** neogenix has quit IRC | 01:04 | |
| *** neogenix has joined #openstack | 01:06 | |
| *** azneita has joined #openstack | 01:06 | |
| *** neogenix_ has quit IRC | 01:08 | |
| *** pvo has joined #openstack | 01:11 | |
| *** ChanServ sets mode: +v pvo | 01:11 | |
| *** aliguori has quit IRC | 01:17 | |
| *** rsampaio has joined #openstack | 01:23 | |
| *** Cybodog has joined #openstack | 01:27 | |
| *** azneita has quit IRC | 01:31 | |
| *** aliguori has joined #openstack | 01:32 | |
| *** joearnold has joined #openstack | 01:49 | |
| *** aliguori has quit IRC | 02:00 | |
| *** joearnol_ has joined #openstack | 02:01 | |
| *** joearnold has quit IRC | 02:02 | |
| *** MarkAtwood has joined #openstack | 02:08 | |
| *** sirp1 has joined #openstack | 02:09 | |
| *** daleolds has quit IRC | 02:09 | |
| *** msinhore has joined #openstack | 02:14 | |
| *** sandywalsh has joined #openstack | 02:14 | |
| *** msinhore has quit IRC | 02:36 | |
| *** deshantm has quit IRC | 02:52 | |
| *** deshantm_cosi has quit IRC | 02:52 | |
| *** deshantm has joined #openstack | 02:56 | |
| *** deshantm_cosi has joined #openstack | 02:56 | |
| *** pvo has quit IRC | 02:56 | |
| *** hazmat has quit IRC | 02:58 | |
| *** abecc_ has quit IRC | 03:10 | |
| *** ArdRigh has joined #openstack | 03:13 | |
| *** pvo has joined #openstack | 03:14 | |
| *** ChanServ sets mode: +v pvo | 03:14 | |
| *** colinnich_ has joined #openstack | 03:17 | |
| *** colinnich_ has quit IRC | 03:19 | |
| *** colinnich has quit IRC | 03:21 | |
| *** kw1 has left #openstack | 03:23 | |
| *** lyetz has joined #openstack | 03:31 | |
| *** sirp2 has joined #openstack | 03:39 | |
| *** sirp1 has quit IRC | 03:39 | |
| *** colinnich has joined #openstack | 03:54 | |
| *** azneita has joined #openstack | 04:01 | |
| *** littleidea has joined #openstack | 04:17 | |
| *** ArdRigh has quit IRC | 04:21 | |
| *** EdwinGrubbs has joined #openstack | 04:30 | |
| *** EdwinGrubbs has joined #openstack | 04:30 | |
| *** AimanA is now known as HouseAway | 04:30 | |
| *** sophiap has quit IRC | 05:00 | |
| *** blamar has quit IRC | 05:08 | |
| *** rsampaio has quit IRC | 05:11 | |
| *** blamar has joined #openstack | 05:22 | |
| *** sirp1 has joined #openstack | 05:30 | |
| *** sirp2 has quit IRC | 05:30 | |
| *** thingee has joined #openstack | 05:32 | |
| *** gaveen has quit IRC | 05:33 | |
| *** sirp1 has quit IRC | 05:39 | |
| *** sirp1 has joined #openstack | 05:40 | |
| *** f4m8_ is now known as f4m8 | 05:45 | |
| *** smoser has joined #openstack | 05:46 | |
| *** colinnich has quit IRC | 05:46 | |
| *** sirp1 has quit IRC | 05:49 | |
| *** thingee has quit IRC | 05:52 | |
| *** joearnol_ has quit IRC | 05:53 | |
| *** MarkAtwood has quit IRC | 05:55 | |
| *** f4m8 has quit IRC | 06:05 | |
| *** perestre1ka has quit IRC | 06:11 | |
| *** perestrelka has joined #openstack | 06:14 | |
| *** almaisan-away is now known as al-maisan | 06:14 | |
| *** littleidea has quit IRC | 06:15 | |
| *** ramkrsna has joined #openstack | 06:24 | |
| *** ramkrsna has joined #openstack | 06:24 | |
| *** kashyapc has joined #openstack | 06:24 | |
| *** miclorb has quit IRC | 07:00 | |
| *** ramkrsna has quit IRC | 07:00 | |
| *** ramkrsna has joined #openstack | 07:13 | |
| *** ibarrera has joined #openstack | 07:24 | |
| *** pvo has quit IRC | 07:41 | |
| *** miclorb_ has joined #openstack | 07:45 | |
| *** miclorb_ has quit IRC | 07:48 | |
| *** smoser has quit IRC | 08:04 | |
| *** kim0 has joined #openstack | 08:10 | |
| *** kim0 has joined #openstack | 08:10 | |
| *** sandywalsh has quit IRC | 08:14 | |
| *** dendrobates is now known as dendro-afk | 08:17 | |
| *** azneita has quit IRC | 08:26 | |
| *** miclorb has joined #openstack | 08:30 | |
| *** pvo has joined #openstack | 08:33 | |
| *** ChanServ sets mode: +v pvo | 08:33 | |
| *** allsystemsarego has joined #openstack | 08:40 | |
| *** miclorb has quit IRC | 08:49 | |
| *** pvo has quit IRC | 08:51 | |
| *** f4m8 has joined #openstack | 08:54 | |
| *** sandywalsh has joined #openstack | 09:01 | |
| *** smoser has joined #openstack | 09:01 | |
| *** miclorb_ has joined #openstack | 09:08 | |
| *** miclorb_ has quit IRC | 09:28 | |
| *** sandywalsh has quit IRC | 09:44 | |
| *** jfluhmann has quit IRC | 09:50 | |
| *** clayg has quit IRC | 09:51 | |
| *** jfluhmann has joined #openstack | 09:51 | |
| *** miclorb has joined #openstack | 09:51 | |
| *** clayg has joined #openstack | 09:52 | |
| *** dendro-afk is now known as dendrobates | 10:04 | |
| *** miclorb has quit IRC | 10:06 | |
| *** smoser has quit IRC | 10:18 | |
| *** littleidea has joined #openstack | 10:26 | |
| *** smoser has joined #openstack | 10:30 | |
| patri0t | hey, anyone has idea why nova-manage may not work at all? | 10:38 |
|---|---|---|
| *** smoser has quit IRC | 10:46 | |
| *** littleidea has quit IRC | 10:46 | |
| *** msinhore has joined #openstack | 10:48 | |
| *** smoser has joined #openstack | 10:49 | |
| *** littleidea has joined #openstack | 10:53 | |
| *** BK_man has joined #openstack | 10:57 | |
| *** al-maisan is now known as almaisan-away | 10:58 | |
| *** hazmat has joined #openstack | 11:04 | |
| *** msinhore has quit IRC | 11:13 | |
| *** ArdRigh has joined #openstack | 11:16 | |
| *** msinhore has joined #openstack | 11:28 | |
| *** littleidea has quit IRC | 11:44 | |
| *** kashyapc has quit IRC | 11:56 | |
| *** ArdRigh has quit IRC | 11:58 | |
| *** ctennis has quit IRC | 12:06 | |
| *** arthurc has joined #openstack | 12:13 | |
| *** msinhore has quit IRC | 12:13 | |
| *** DubLo7 has quit IRC | 12:18 | |
| *** msinhore has joined #openstack | 12:21 | |
| *** eldarnugaev has joined #openstack | 12:23 | |
| *** ctennis has joined #openstack | 12:23 | |
| *** msinhore has quit IRC | 12:36 | |
| *** eldarnugaev has quit IRC | 12:38 | |
| *** jeevan_ullas has quit IRC | 12:43 | |
| *** jeevan_ullas has joined #openstack | 12:43 | |
| *** hazmat has quit IRC | 12:45 | |
| *** almaisan-away is now known as al-maisan | 13:00 | |
| *** DubLo7 has joined #openstack | 13:16 | |
| *** tomo_bot_ has joined #openstack | 13:17 | |
| *** tomo_bot has quit IRC | 13:17 | |
| *** ramkrsna has quit IRC | 13:17 | |
| *** gustavomzw has joined #openstack | 13:18 | |
| *** aliguori has joined #openstack | 13:19 | |
| *** tomo_bot__ has joined #openstack | 13:19 | |
| *** gustavomzw has quit IRC | 13:20 | |
| *** tomo_bot_ has quit IRC | 13:22 | |
| *** rossij has quit IRC | 13:31 | |
| *** dendrobates is now known as dendro-afk | 13:33 | |
| *** perestrelka has quit IRC | 13:33 | |
| *** perestrelka has joined #openstack | 13:33 | |
| *** rossij has joined #openstack | 13:34 | |
| *** tomo_bot__ has quit IRC | 13:43 | |
| *** tomo_bot__ has joined #openstack | 13:43 | |
| *** aliguori has quit IRC | 13:44 | |
| *** tomo_bot___ has joined #openstack | 13:49 | |
| letterj | JordanRinke: Can I get an account on the swift cluster set up for the summit? | 13:50 |
| *** tomo_bot__ has quit IRC | 13:50 | |
| JordanRinke | letterj: pm | 13:52 |
| letterj | thank you | 13:54 |
| *** ppetraki has joined #openstack | 13:56 | |
| *** DubLo7 has quit IRC | 13:57 | |
| *** Cybodog has quit IRC | 13:57 | |
| *** aliguori has joined #openstack | 14:00 | |
| *** f4m8 is now known as f4m8_ | 14:01 | |
| *** piken_afk is now known as piken | 14:05 | |
| piken | morning | 14:05 |
| JordanRinke | morning | 14:11 |
| *** tomo_bot___ has quit IRC | 14:11 | |
| *** JordanRinke has left #openstack | 14:11 | |
| *** tomo_bot___ has joined #openstack | 14:11 | |
| *** westmaas has joined #openstack | 14:15 | |
| *** ar1 has quit IRC | 14:17 | |
| letterj | Jordan the account you gave me returns a 401 on auth | 14:19 |
| *** tomo_bot____ has joined #openstack | 14:22 | |
| *** gondoi has joined #openstack | 14:23 | |
| *** tomo_bot___ has quit IRC | 14:24 | |
| piken | ok, question, why in utils.py is a connect being made to google.com? | 14:25 |
| *** Ryan_Lane has quit IRC | 14:28 | |
| *** BK_man has quit IRC | 14:29 | |
| *** londo__ has quit IRC | 14:29 | |
| *** EdwinGrubbs has joined #openstack | 14:29 | |
| *** EdwinGrubbs has joined #openstack | 14:29 | |
| *** BK_man has joined #openstack | 14:30 | |
| *** tomo_bot____ has quit IRC | 14:42 | |
| *** tomo_bot____ has joined #openstack | 14:43 | |
| *** smoser has quit IRC | 14:45 | |
| *** tomo_bot_____ has joined #openstack | 14:47 | |
| piken | Soren: Vishy: you around? | 14:48 |
| piken | Or anyone that can help figure out why --fake_tests=True is not forcing binding to localhost | 14:48 |
| *** JordanRinke has joined #openstack | 14:48 | |
| *** Podilarius has joined #openstack | 14:50 | |
| *** tomo_bot____ has quit IRC | 14:50 | |
| *** Cybodog has joined #openstack | 14:57 | |
| *** jonkelly has joined #openstack | 14:59 | |
| *** pvo has joined #openstack | 15:00 | |
| *** ChanServ sets mode: +v pvo | 15:00 | |
| *** dendro-afk is now known as dendrobates | 15:03 | |
| JordanRinke | word | 15:05 |
| *** zul has joined #openstack | 15:05 | |
| pvo | noun | 15:05 |
| *** rossi_j has joined #openstack | 15:05 | |
| *** Ryan_Lane has joined #openstack | 15:06 | |
| jonkelly | number? | 15:07 |
| *** rossij has quit IRC | 15:08 | |
| *** BK_man has quit IRC | 15:11 | |
| *** BK_man has joined #openstack | 15:13 | |
| *** jaypipes has joined #openstack | 15:15 | |
| *** jdarcy has joined #openstack | 15:15 | |
| *** neogenix has quit IRC | 15:16 | |
| vishy | hoyoo! | 15:16 |
| jaypipes | vishy: yooho! | 15:16 |
| *** rsampaio has joined #openstack | 15:16 | |
| *** zaitcev has joined #openstack | 15:16 | |
| *** gustavomzw has joined #openstack | 15:19 | |
| *** kim0 has quit IRC | 15:19 | |
| vishy | piken: in get_my_ip, it doesn't work if get_my_ip is in the flag definition, since that runs at import time, before --fake_tests has been set | 15:21 |
| *** gustavomzw has quit IRC | 15:21 | |
| Ryan_Lane | is it possible to run the nodes and the controller on shared storage, like NFS? is it a good/bad idea? | 15:21 |
| *** thingee has joined #openstack | 15:22 | |
| jaypipes | Ryan_Lane: wouldn't that be a single point of failure? | 15:23 |
| Ryan_Lane | jaypipes: yes/no | 15:24 |
| *** smoser has joined #openstack | 15:24 | |
| Ryan_Lane | depends on how you architect the NFS storage | 15:24 |
| Ryan_Lane | using netapps with fully redundant hardware, and failover units using snapmirror, no | 15:24 |
| *** gondoi has quit IRC | 15:25 | |
| Ryan_Lane | also a little more flexible than iscsi | 15:25 |
| *** littleidea has joined #openstack | 15:26 | |
| *** pharkmillups has joined #openstack | 15:27 | |
| jaypipes | Ryan_Lane: not sure why you'd want/need to run the actual node/controller code on NFS. I don't see much benefit to it. Can you elaborate what you're htinking? | 15:27 |
| Ryan_Lane | so the current architecture pulls images from the storage node, and runs them on the compute nodes right? | 15:28 |
| Ryan_Lane | what about persistance instances? | 15:28 |
| *** kim0 has joined #openstack | 15:28 | |
| *** kim0 has joined #openstack | 15:28 | |
| Ryan_Lane | In the VMware world, all instances live on shared storage | 15:29 |
| Ryan_Lane | this makes things like HA much easier | 15:29 |
| Ryan_Lane | and allows for deduplication of persistance images | 15:29 |
| Ryan_Lane | if the architecture is completely different, and makes this kind of thing irrelevant, then there isn't much reason | 15:30 |
| Ryan_Lane | I'm trying to avoid buying a lot of storage for each compute node | 15:30 |
| jaypipes | Ryan_Lane: well, like I said, there's nothing (AFAIK) preventing you from doing it :) | 15:30 |
| *** thingee has quit IRC | 15:31 | |
| Ryan_Lane | does the openstack architecture make this kind of thing irrelevant? | 15:31 |
| BK_man | ppl, is there are a kind of list with nova's python modules deps (with versions)? | 15:31 |
| Ryan_Lane | is there a better way of going about things? If so, I'd like to follow best practices | 15:31 |
| jaypipes | BK_man: see tools/pip-requires | 15:31 |
| * BK_man trying to install Nova on RHEL6 | 15:31 | |
| jaypipes | Ryan_Lane: one sec | 15:31 |
| BK_man | jaypipes: thanks! | 15:32 |
| Ryan_Lane | I should also mention that this is for a fairly small cluster. Not planning on using a million nodes, like you guys ;). | 15:33 |
| * BK_man started almost every nova service except volume | 15:34 | |
| BK_man | I didn't found any dep on twisted and have version 8.2.0 installed. Is it ok for nova-volume? | 15:36 |
| BK_man | nova.exception.Error: volume group nova-volumes doesn't exist | 15:37 |
| jaypipes | Ryan_Lane: sorry, sitting in meeting here at summit trying to pick the name for next release... it's "Cactus" | 15:38 |
| jaypipes | BK_man: no, need the 10.0.4 backported version noted in pip-requires... | 15:38 |
| Ryan_Lane | jaypipes: no worries :) | 15:39 |
| Ryan_Lane | i wanted to make it to the summit | 15:39 |
| Ryan_Lane | I'll be at the meetup in SF though | 15:39 |
| *** dagger has quit IRC | 15:44 | |
| *** westmaas has quit IRC | 15:45 | |
| *** zul has quit IRC | 15:46 | |
| *** dagger has joined #openstack | 15:46 | |
| *** dagger has joined #openstack | 15:46 | |
| *** dysinger has joined #openstack | 15:48 | |
| *** zaitcev has quit IRC | 15:50 | |
| *** daleolds has joined #openstack | 15:52 | |
| *** zaitcev has joined #openstack | 15:52 | |
| *** hggdh has quit IRC | 15:55 | |
| vishy | Ryan_Lane: I don't think there is really a best-practices yet. Others have mentioned doing something similar | 15:56 |
| piken | Vishy: We got around it for now by faking www.google.com in our hosts file. | 15:56 |
| piken | But we have another issue. All components come up correctly | 15:57 |
| *** zaitcev has quit IRC | 15:57 | |
| piken | All one server | 15:57 |
| Ryan_Lane | vishy: ah, using shared storage? | 15:57 |
| piken | we can add a key without an issue, but when we create an instance it never is created | 15:57 |
| piken | describe instances says it is scheduled, but we see nothing in the network log, scheduler log, or compute log and the instance is nver created | 15:57 |
| Ryan_Lane | vishy: there are plans for HA, correct? how would one do so without shared storage? | 15:58 |
| piken | I made sure rabbit is up and nova-api's log shows the message going into rabbitmq | 15:58 |
| *** dendrobates is now known as dendro-afk | 15:59 | |
| vishy | Ryan_Lane: we haven't fully addressed HA for vms, we are looking at adding sheepdog support for instances as one possibility | 16:00 |
| *** zul has joined #openstack | 16:00 | |
| *** thingee has joined #openstack | 16:01 | |
| Ryan_Lane | sheepdog? | 16:01 |
| * Ryan_Lane googles | 16:01 | |
| *** pvo has quit IRC | 16:01 | |
| Ryan_Lane | ah. distributed storage | 16:02 |
| jdarcy | If I had unlimited free time, I'd consider using some of it to make a non-qemu-specific version of sheepdog. But I don't. | 16:04 |
| piken | anyone have an idea why I can't spawn instances even though all components are using the same mysql and rabbit and all on the same server | 16:04 |
| *** hggdh has joined #openstack | 16:04 | |
| Ryan_Lane | looks like this is optimized for KVM, which is nice | 16:04 |
| vishy | piken: is the scheduler getting the message? | 16:05 |
| piken | no | 16:05 |
| Ryan_Lane | well, if this is going to be the case, then shared storage via NFS looks unnecessary | 16:05 |
| Ryan_Lane | which makes my life a little easier | 16:05 |
| piken | There is no activity in any log othe then the object store, network, and api | 16:05 |
| piken | s/othe/other/ | 16:05 |
| vishy | is scheduler running? | 16:05 |
| piken | yes | 16:05 |
| piken | They were all started by nova.sh. I also ran them all by hand with the previously generated conf | 16:06 |
| piken | It seems almost like the messages are getting lost even though they can be seen in the rabbit message logs | 16:06 |
| *** dendro-afk is now known as dendrobates | 16:06 | |
| vishy | possible you have another scheduler/other component eating messages out of the queue | 16:07 |
| *** rnirmal has joined #openstack | 16:07 | |
| *** ttx has joined #openstack | 16:08 | |
| *** ttx has joined #openstack | 16:08 | |
| piken | I don't think there is. We made sure that the node had nothing running on it first. But I will check again | 16:08 |
| piken | I just stopped all things on the box and made sure there was nothing running that would eat it. | 16:14 |
| piken | Still same issue | 16:14 |
| *** guynaor has left #openstack | 16:16 | |
| piken | Is there a way to change the message queue name to 100% make sure nothing else is pulling from the queue | 16:17 |
| *** heckj has joined #openstack | 16:18 | |
| heckj | nova question: what algorithms are used by the scheduler to lay down VMs on hardware, or where does that code live? | 16:20 |
| *** sandywalsh has joined #openstack | 16:22 | |
| vishy | heckj: see nova/scheduler/simple.py | 16:23 |
| heckj | thanks vish! | 16:23 |
| piken | vishy: yeah, defn do not have something else on there eating things from the queue that I can tell | 16:23 |
| kim0 | Is there any code walk through yet | 16:23 |
| *** iammartian has joined #openstack | 16:24 | |
| *** clayg_ has joined #openstack | 16:24 | |
| *** heckj has quit IRC | 16:25 | |
| *** al-maisan is now known as almaisan-away | 16:25 | |
| vishy | piken: if i'm down to that level, I usually turn on messages from amqlib so i can see the messages going in the nova logs | 16:26 |
| piken | how can I turn them on? | 16:26 |
| piken | never have before | 16:26 |
| *** smoser has quit IRC | 16:27 | |
| vishy | logging.getLogger('amqplib').setLevel(logging.WARN) | 16:27 |
| vishy | there is a line like that in twistd.py | 16:27 |
| vishy | and in server.py (for api) | 16:28 |
| *** zul has quit IRC | 16:28 | |
| piken | so set them to logging.DEBUG | 16:28 |
| vishy | yeah | 16:28 |
| vishy | it is kind of chatty, but it should show the messages that are getting sent | 16:29 |
| vishy | so you can see if one doesn't get received | 16:29 |
| piken | ok, so I don't see api having any messages going into the queue after all so there for no messages to be pulled by sched | 16:31 |
| piken | now I am even more confused | 16:31 |
| *** thingee has quit IRC | 16:32 | |
| *** littleidea has quit IRC | 16:32 | |
| piken | What would cause that? | 16:32 |
| BK_man | Khm... Can I use twisted 10.1.0 instead of 10.0.4 with nova-volume? | 16:33 |
| piken | I don't think that should make a difference. At least I hope not as I am using that on centos 5.5 | 16:35 |
| vishy | MK_man, twisted 10.1 should be fine afaik | 16:35 |
| BK_man | vishy: thanks! | 16:35 |
| vishy | piken: weird, it is getting the requests and returning success but not putting anything into the queue? | 16:36 |
| *** zul has joined #openstack | 16:36 | |
| piken | no success coming back on run instance, just freezes, but adds it to the db | 16:36 |
| *** pvo has joined #openstack | 16:37 | |
| *** ChanServ sets mode: +v pvo | 16:37 | |
| letterj | JordanRinke: Did you get my note about the account failing auth | 16:37 |
| *** sirp1 has joined #openstack | 16:37 | |
| vishy | hmm, nova-network failure? | 16:37 |
| piken | no errors reported and I do see logs of iptables stuff in there from the starting net config | 16:38 |
| letterj | No, | 16:38 |
| *** westmaas has joined #openstack | 16:38 | |
| *** dragondm has joined #openstack | 16:38 | |
| letterj | no the swift instance set up for the conference | 16:38 |
| vishy | so the first thing it does is set network host for project, if that call is failing | 16:38 |
| BK_man | Khm... error still the same: nova.exception.Error: volume group nova-volumes doesn't exist | 16:38 |
| vishy | it would cause a situation like you are describing | 16:38 |
| JordanRinke | letterj: sorry no I was AFK | 16:39 |
| vishy | api is calling out to nova-network to set network host | 16:39 |
| letterj | JordanRinke: Can you send me the info again | 16:39 |
| BK_man | what is differences between nova.volume.manager.VolumeManager and nova.volume.manager.AOEManager ? | 16:40 |
| piken | vishy: I don't see anything past the inital setup in the output from network-manager | 16:40 |
| piken | *nova-network | 16:40 |
| BK_man | I have AOEManager on Ubuntu installation and VolumeManager on RHEL6. Where can I configure this? | 16:40 |
| vishy | piken: is it possible you have old data in the database? | 16:41 |
| vishy | if the network for your project has an invalid host name | 16:41 |
| vishy | select host from networks where project_id is not null | 16:42 |
| vishy | might help | 16:42 |
| *** littleidea has joined #openstack | 16:42 | |
| vishy | BK_man: AOEManager existed in austin release | 16:42 |
| *** dubsquared1 has joined #openstack | 16:42 | |
| vishy | VolumeManager is in current trunk | 16:43 |
| piken | vishy: using nova.sh to launch. It does a drop on the database and create each start | 16:43 |
| dubsquared1 | oh hello | 16:43 |
| BK_man | vishy: ok. What should I do to get nova-volume service to run? | 16:43 |
| *** zul has quit IRC | 16:43 | |
| BK_man | vishy: I mean what should I configure in advance | 16:43 |
| vishy | funny i just added that info to my readme | 16:44 |
| vishy | https://github.com/vishvananda/novascript | 16:44 |
| *** hornbeck has joined #openstack | 16:44 | |
| vishy | scroll down to the Notes section and there are a few commands explaining how to create a volume group for it | 16:44 |
| BK_man | vishy: i see. thanks! | 16:45 |
| vishy | piken: :( try running that sql and see if the host is set for the network | 16:45 |
| piken | no results returned | 16:46 |
| vishy | oh rly | 16:46 |
| piken | mysql> select host from networks where project_id is not null; | 16:46 |
| piken | Empty set (0.00 sec) | 16:46 |
| vishy | after trying to run an instance? | 16:47 |
| piken | yes, the instance is never run or created. There is no log entry's that it was ever attmpted other then in api | 16:47 |
| vishy | so an empty set means that db.project_get_network is not getting called | 16:48 |
| *** neogenix has joined #openstack | 16:48 | |
| vishy | so either nova-api is failing before it gets to that, or it is not talking to the db | 16:49 |
| *** sandywalsh has quit IRC | 16:51 | |
| piken | hmm, now I am seeing a little more. | 16:52 |
| piken | the request went to api, and it looks like it is failing when calling the object store | 16:52 |
| piken | looks like it is sitting at establishing HTTP connection | 16:52 |
| vishy | whoot! | 16:55 |
| vishy | is nova-objectstore running correctly? | 16:55 |
| piken | I can telnet to localhost on 3333 | 16:56 |
| JordanRinke | word | 16:56 |
| piken | is there anyway I can test it? | 16:57 |
| piken | yeah, it looks like api cannot hit the objectstore | 16:57 |
| Ryan_Lane | If I need to use a specific vlan, such as 103, can I simply create the bridge/vlan on the compute node and controller directly, then modify the database to use br103 and vlan 103 explicitly? | 16:57 |
| piken | http://paste.openstack.org/show/116/ there is the log output of objectstore | 16:58 |
| uvirtbot | New bug: #674597 in swift "SAIO docs need a link to skip the loopback section" [Low,New] https://launchpad.net/bugs/674597 | 17:02 |
| *** rlucio has joined #openstack | 17:03 | |
| *** gondoi has joined #openstack | 17:04 | |
| *** kw1 has joined #openstack | 17:05 | |
| *** dubsquared1 has quit IRC | 17:09 | |
| *** dubsquared1 has joined #openstack | 17:09 | |
| *** jaypipes has quit IRC | 17:09 | |
| *** ttx has quit IRC | 17:10 | |
| *** dendrobates has quit IRC | 17:10 | |
| *** glange has quit IRC | 17:10 | |
| *** ttx has joined #openstack | 17:10 | |
| *** Mr_T has quit IRC | 17:10 | |
| *** dfg has quit IRC | 17:10 | |
| *** exlt has quit IRC | 17:10 | |
| *** hazmat has joined #openstack | 17:11 | |
| *** Mr_T has joined #openstack | 17:11 | |
| *** glange has joined #openstack | 17:11 | |
| vishy | piken: you could try one of the commands that only hits the objectstore | 17:12 |
| vishy | piken: like euca-upload-bundle | 17:13 |
| *** letterj has quit IRC | 17:13 | |
| *** gholt has quit IRC | 17:13 | |
| *** annegentle has quit IRC | 17:13 | |
| *** letterj has joined #openstack | 17:13 | |
| *** annegentle has joined #openstack | 17:13 | |
| vishy | Ryan_Lane: you could just set vlan_start to that value | 17:13 |
| *** dendrobates has joined #openstack | 17:14 | |
| *** dfg has joined #openstack | 17:14 | |
| Ryan_Lane | vishy: yeah, found that :) | 17:14 |
| vishy | but i don't know if you want host managed vlans if you only have one | 17:14 |
| Ryan_Lane | I need to do vlan tagging... | 17:14 |
| *** gholt has joined #openstack | 17:15 | |
| Ryan_Lane | we are segregating our virtual machines from our production cluster | 17:15 |
| piken | vishy: Since it uses rest, I did a GET /_images/ HTTP/1.1 | 17:15 |
| piken | It hangs | 17:15 |
| vishy | :( | 17:15 |
| vishy | that sucks | 17:15 |
| vishy | no error message? just hanging? | 17:15 |
| piken | just hanging | 17:15 |
| Ryan_Lane | the vm stats on br103, but now I need to figure out how to get the dhcp server to listen on the right ip, and use the correct range... | 17:16 |
| piken | vishy: yeah. This is defn the issue. And I can't figure out why | 17:20 |
| *** gustavomzw has joined #openstack | 17:20 | |
| Ryan_Lane | though, if I'm using flat networking, it should inject the ip info, correct? no dhcp server necessary? | 17:20 |
| piken | hmm, I set the s3_host in the flagfile and it ignored it for localhost | 17:22 |
| *** gustavomzw has quit IRC | 17:22 | |
| *** exlt has joined #openstack | 17:24 | |
| *** ChanServ sets mode: +v exlt | 17:24 | |
| *** clayg__ has joined #openstack | 17:24 | |
| *** clayg___ has joined #openstack | 17:26 | |
| *** clayg_ has quit IRC | 17:26 | |
| *** clayg_ has joined #openstack | 17:27 | |
| *** clayg__ has quit IRC | 17:29 | |
| *** msinhore has joined #openstack | 17:30 | |
| *** clayg___ has quit IRC | 17:30 | |
| *** ChanServ sets mode: +v letterj | 17:30 | |
| piken | woot, got objectstore up | 17:31 |
| piken | it fails if you have fake_tests set so we can't bypass the connect to google.com which is bad as we have no net access on these nodes. | 17:31 |
| *** kw1 has left #openstack | 17:32 | |
| piken | http://paste.openstack.org/show/117/ here is the logout put of the request going to api and rabbit | 17:32 |
| *** clayg__ has joined #openstack | 17:32 | |
| piken | and here is the sched output http://paste.openstack.org/show/118/ | 17:33 |
| piken | It never saw the message in the queue even though it is | 17:33 |
| *** hggdh has quit IRC | 17:36 | |
| *** clayg_ has quit IRC | 17:36 | |
| *** msinhore has quit IRC | 17:36 | |
| *** sirp1 has quit IRC | 17:38 | |
| piken | AAAAAHAHHHH | 17:38 |
| piken | vishy: the problem is 100% that get_my_ip connect to google. | 17:38 |
| piken | I just commented it out and returned localhost and it worked. | 17:39 |
| *** pandemicsyn has quit IRC | 17:39 | |
| *** pvo has quit IRC | 17:39 | |
| piken | It was failing because first call from api for provisioning is to compute to determine what node to place it on. | 17:39 |
| *** smoser has joined #openstack | 17:40 | |
| piken | Here is the actual spawn error | 17:41 |
| piken | http://paste.openstack.org/show/119/ | 17:41 |
| piken | Any ideas? | 17:41 |
| *** pharkmillups has quit IRC | 17:43 | |
| *** dendrobates is now known as dendro-afk | 17:44 | |
| *** ramkrsna has joined #openstack | 17:47 | |
| *** ramkrsna has joined #openstack | 17:47 | |
| *** ttx has quit IRC | 17:49 | |
| *** littleidea has quit IRC | 17:49 | |
| *** exlt has quit IRC | 17:50 | |
| *** exlt has joined #openstack | 17:50 | |
| *** ChanServ sets mode: +v exlt | 17:50 | |
| *** clayg__ has quit IRC | 17:50 | |
| piken | and yay. Back to where I was with the channel not being read. | 17:51 |
| piken | :( | 17:51 |
| *** dysinger has quit IRC | 17:52 | |
| *** littleidea has joined #openstack | 17:52 | |
| rlucio | piken: what version of libblkid are you using? the error seems to indicate you are using the wrong one.. .also, is it a 32 bit or 64 bit system? | 17:55 |
| piken | rlucio: 64bit centos5 | 17:56 |
| *** topspinkyle has joined #openstack | 17:57 | |
| *** gondoi has quit IRC | 17:57 | |
| *** sophiap has joined #openstack | 17:58 | |
| piken | it is part of util-linux and we built 2.18 from source as centos5 comes with 2.13 by default and its losetup doesn't have --show | 17:59 |
| *** kim0 has quit IRC | 17:59 | |
| piken | what version should we be using? | 18:00 |
| *** sophiap has quit IRC | 18:02 | |
| *** sophiap has joined #openstack | 18:03 | |
| *** kim0 has joined #openstack | 18:07 | |
| *** dysinger has joined #openstack | 18:11 | |
| *** Ryan_Lane is now known as Ryan_Lane|food | 18:11 | |
| *** rlucio has quit IRC | 18:13 | |
| *** sophiap has quit IRC | 18:17 | |
| vishy | piken: yeah there is actaully a patch for that, just needs to be merged | 18:18 |
| *** Ryan_Lane|food has quit IRC | 18:18 | |
| piken | ah, k | 18:18 |
| BK_man | vishy: I created a volume - but there is no /dev/nova-volume device exists. Wha'ts missing? | 18:19 |
| *** sophiap has joined #openstack | 18:19 | |
| piken | man, this is random. Some times it will create an instance and seem to work fine, but fail durring the spawn. But others it is back to round 1 with the the queue not being read. | 18:19 |
| vishy | BK_man: ubuntu? | 18:23 |
| BK_man | vishy: RHEL6 | 18:23 |
| vishy | hmm | 18:23 |
| BK_man | vishy: how it looks on Ubuntu? | 18:24 |
| vishy | does rhel have different udev rules? | 18:24 |
| BK_man | let me check.... | 18:24 |
| JordanRinke | sooo | 18:25 |
| JordanRinke | all my services but nova-compute start and in the log I get 2010-11-12 12:23:47-0600 [-] socket.error: [Errno 111] Connection refused | 18:25 |
| JordanRinke | guesses? | 18:25 |
| *** smoser has quit IRC | 18:25 | |
| JordanRinke | also, I have active hosts on 3333, 8773 and 8774 | 18:25 |
| vishy | on ubuntu a folder is created in /dev for each volume group | 18:26 |
| vishy | and each lv has a symlink inside of it | 18:26 |
| *** sophiap has quit IRC | 18:26 | |
| vishy | like so: lrwxrwxrwx 1 root root 37 2010-11-08 11:11 vol-k6hu2up9 -> ../mapper/nova--volumes-vol--k6hu2up9 | 18:26 |
| vishy | i assume it is udev doing it | 18:26 |
| vishy | JordanRinke: rabbit isn't running | 18:26 |
| JordanRinke | bah good call | 18:27 |
| vishy | :) | 18:27 |
| *** sophiap has joined #openstack | 18:27 | |
| JordanRinke | correct, rabbitmq isnt installed :-D accidently snipped it off the end of my apt-get hah | 18:28 |
| *** msinhore has joined #openstack | 18:34 | |
| *** dragondm has quit IRC | 18:35 | |
| *** almaisan-away is now known as al-maisan | 18:35 | |
| *** msinhore has quit IRC | 18:36 | |
| xtoddx | https://blueprints.launchpad.net/nova/+spec/austin-puppet-deployment can be targeted to bexar and assigned to me or anso. I'm going to work with Yoko from NII to include their configs as well. | 18:36 |
| xtoddx | https://blueprints.launchpad.net/nova/+spec/refactor-auth-unittest is in trunk's version of nova/tests/auth_unittest.py | 18:37 |
| BK_man | vishy: I have 1 VG nova-volumes and it's free. Is it correct setup? | 18:40 |
| vishy | should be right, how big is it? | 18:40 |
| BK_man | vishy: 1020Mb | 18:41 |
| vishy | that won't be very useful :) | 18:41 |
| BK_man | create with losetup in /openstack/nova | 18:41 |
| BK_man | vishy: just for testing | 18:41 |
| vishy | k | 18:41 |
| vishy | sure that should be fine | 18:42 |
| BK_man | vishy: what is a way to create a shared storage for VMs? | 18:42 |
| vishy | if you vgs and it shows up you should be good | 18:42 |
| BK_man | vishy: it's ok:" | 18:42 |
| BK_man | ]# vgs | 18:42 |
| BK_man | VG #PV #LV #SN Attr VSize VFree | 18:42 |
| BK_man | nova-volumes 1 0 0 wz--n- 1020.00m 1020.00m | 18:42 |
| BK_man | vg_rhel6b2 1 3 0 wz--n- 271.45g 0 | 18:42 |
| vishy | BK_man: no support for true shared storage yet | 18:42 |
| piken | vishy: So I think I found the issue. For some reason on my centos5 box, when a message is put in the queue the first time. There is almost a 2-4 min delay before it is seen by the other components. | 18:42 |
| piken | Very wierd | 18:43 |
| vishy | piken: yes, weird, sounds like amqp is having some trouble | 18:43 |
| BK_man | vishy: can I use a king of cluster fs? GPFS from IBM? | 18:43 |
| BK_man | s/king/kind/ | 18:43 |
| BK_man | :) | 18:43 |
| vishy | BK_man: any type of shared storage for vm backing will have to be on the host level | 18:44 |
| neogenix | JordanRinke: thought you had it working already :P | 18:44 |
| vishy | for the moment | 18:44 |
| BK_man | vishy: ok. stupid question - can nova run on several hosts at the moment? | 18:45 |
| piken | vishy: Pretty soon there will be a blueprint for VirtFS and implementation for it not making it host level :) | 18:46 |
| piken | BK_man: yes | 18:47 |
| piken | I have gotten 5 cloud controllers with schedulers and such running using mysql and the same rabitmq queue with nginx load blancing to them. | 18:47 |
| piken | Then I have right now 5 compute nodes with just compute running on them. | 18:47 |
| BK_man | piken: why not to use existing clustered FS in each availability zone? | 18:48 |
| piken | We use drdb on the mysql data store to make it stored accross all 5 nodes and also on the persistant rabbit store. | 18:48 |
| piken | But if we loose 1 node, everything still runs fine. | 18:48 |
| BK_man | piken: what will happen if you will loose 2 nodes? cluster split-brain? | 18:50 |
| *** mdomsch has joined #openstack | 18:50 | |
| BK_man | vishy: I create same volume group on a host with Maverick installed and it does not have /dev/nova-volumes directory after that too... | 18:52 |
| *** joearnold has joined #openstack | 18:52 | |
| BK_man | vishy: just using your instructions from "Notes" section | 18:53 |
| *** ibarrera has quit IRC | 18:53 | |
| BK_man | vishy: dd, mkfs.ext4, losetup && vgcreate - nothing else | 18:53 |
| *** sophiap has quit IRC | 18:55 | |
| dubsquared1 | piken: JordanRinke told me you may have or are close to running Nova on CentOS/RHEL? | 18:55 |
| BK_man | dubsquared1: I have all services running except volumes | 18:57 |
| anticw | redbo: about? | 18:58 |
| *** MarkAtwood has joined #openstack | 18:58 | |
| BK_man | dubsquared1: on RHEL6 release | 18:58 |
| dubsquared1 | nice, im going to playing with that soon | 18:58 |
| dubsquared1 | do you have a blog, or any notes posted? | 18:58 |
| BK_man | dubsquared1: not yet, just a pilot project. | 18:59 |
| BK_man | dubsquared1: we need to wait while EPEL repo will be announced for RHEL6. It was for RHEL6 Beta, but RHEL6 was released a couple of days ago and I think that repo isn't available anymore | 19:00 |
| BK_man | dubsquared1: my plan is to create my own repo for RHEL6 to satisfy nova deps | 19:00 |
| dubsquared1 | ah excellent | 19:01 |
| *** iammartian_ has joined #openstack | 19:01 | |
| dubsquared1 | yeah, haven't heard the latest on the EPEL for 6 | 19:01 |
| *** iammartian_ has quit IRC | 19:01 | |
| dubsquared1 | that will be super nice | 19:01 |
| dubsquared1 | i support that plan | 19:01 |
| redbo | anticw: yeah | 19:03 |
| *** Ryan_Lane|food has joined #openstack | 19:08 | |
| *** Ryan_Lane|food is now known as Ryan_Lane | 19:09 | |
| *** BK_man has quit IRC | 19:09 | |
| *** hggdh has joined #openstack | 19:10 | |
| *** gaveen has joined #openstack | 19:10 | |
| piken | dubsquared1: almost there on centos5.5 but util-linux is what has been killing it | 19:11 |
| piken | That and rabbit having weird issues. | 19:11 |
| piken | dubsquared1: I am also in the middle of implementing the unified-installer so we have a single working installer for all os'es that we create an install manifest for. | 19:12 |
| dubsquared1 | what part of util-linux is the problem? | 19:12 |
| dubsquared1 | or parts, rather | 19:13 |
| piken | losetup and libblkid | 19:13 |
| *** westmaas has quit IRC | 19:13 | |
| piken | we need a newer losetup for centos5, but that brings a new libblkid in that breaks all mount related tools on the box. | 19:13 |
| piken | ie. don't reboot after the make install | 19:14 |
| *** ramkrsna has quit IRC | 19:14 | |
| JordanRinke | euca-describe-instances if giving me an error 111 :/ | 19:14 |
| *** kim0 has quit IRC | 19:14 | |
| JordanRinke | and I don't know why now | 19:14 |
| dubsquared1 | righto | 19:14 |
| *** [ack]_ is now known as [ack] | 19:16 | |
| JordanRinke | user error lol | 19:18 |
| dubsquared1 | where were you trying to use it? | 19:18 |
| dubsquared1 | locally? | 19:18 |
| *** rmatte has joined #openstack | 19:19 | |
| *** rmatte has left #openstack | 19:19 | |
| *** Gibby has joined #openstack | 19:20 | |
| *** abecc_ has joined #openstack | 19:23 | |
| *** abecc_ has joined #openstack | 19:23 | |
| *** abecc_ is now known as abecc | 19:26 | |
| *** burris has quit IRC | 19:31 | |
| *** gustavomzw has joined #openstack | 19:31 | |
| *** gustavomzw has quit IRC | 19:36 | |
| *** rlucio has joined #openstack | 19:40 | |
| *** neogenix has quit IRC | 19:44 | |
| xtoddx | pvo: https://blueprints.launchpad.net/nova/+spec/admin-only-api could have https://blueprints.launchpad.net/nova/+spec/nova-paste-deploy as a dependency, if you want to take that route (I think it sounds easiest, and swift team likes it) | 19:45 |
| *** clayg_ has joined #openstack | 19:46 | |
| xtoddx | https://blueprints.launchpad.net/nova/+spec/bexar-nova-api-docs should have https://blueprints.launchpad.net/nova/+spec/aws-api-validation as a prepreq | 19:48 |
| xtoddx | i really wish i could edit blueprints, by the way :( | 19:48 |
| *** ctennis has quit IRC | 19:49 | |
| *** hggdh has quit IRC | 19:50 | |
| *** johnbergoon has joined #openstack | 19:50 | |
| *** hggdh has joined #openstack | 19:52 | |
| anticw | redbo: nm, i found the guthub thang to email you | 19:53 |
| anticw | redbo: or i assume it did anyhow | 19:53 |
| redbo | the pull request? I got it. | 19:54 |
| anticw | yeah ... i thought maybe i had to do something else, im used to emailing udiffs about | 19:54 |
| redbo | I pulled it, wasn't sure if you meant to leave that fprintf in there, but I changed it to a debugf. | 19:55 |
| Ryan_Lane | I just upgraded nova on lucid, and I'm getting the following error trying to start some services: No such file or directory: '/usr/lib/pymodules/python2.6/nova/virt/libvirt.rescue.qemu.xml.template' | 19:58 |
| annegentle | for the InstallFest, we're editing an RST file in Etherpad: http://etherpad.openstack.org/NovaInstallRST | 19:58 |
| Ryan_Lane | any idea what that's from? | 19:58 |
| anticw | redbo: oh, the fprintf shouldn't have been there ... that was me debugging somehting ... a debugf is fine i guess though, not sure the cost is very high | 19:59 |
| *** zul_ has joined #openstack | 19:59 | |
| *** joearnold has quit IRC | 20:00 | |
| *** joearnold has joined #openstack | 20:00 | |
| *** ctennis has joined #openstack | 20:01 | |
| redbo | should be negligible, it just returns without doing anything when it's ran in the background | 20:01 |
| notmyname | gholt: I'm looking at the devauth middleware. I must be missing something. where is the HTTP_X_AUTH_TOKEN getting set in the env? | 20:01 |
| redbo | why would it ever be set in the env by middleware? | 20:02 |
| *** hazmat has quit IRC | 20:03 | |
| *** burris has joined #openstack | 20:06 | |
| notmyname | the first line of the middleware checks the env for that var. I'm wondering how it gets there from the header value | 20:08 |
| redbo | that's WSGI | 20:10 |
| notmyname | all the headers go to the env? | 20:10 |
| redbo | and CGI before WSGI | 20:10 |
| notmyname | ok ok :-) | 20:11 |
| *** rlucio has quit IRC | 20:12 | |
| *** MarkAtwood has quit IRC | 20:15 | |
| *** westmaas has joined #openstack | 20:15 | |
| *** burris has quit IRC | 20:17 | |
| *** joearnold has quit IRC | 20:17 | |
| *** zul_ is now known as zul | 20:19 | |
| *** MarkAtwood has joined #openstack | 20:20 | |
| *** al-maisan is now known as almaisan-away | 20:21 | |
| *** rlucio has joined #openstack | 20:23 | |
| *** johnbergoon_ has joined #openstack | 20:31 | |
| *** johnbergoon has quit IRC | 20:34 | |
| *** johnbergoon_ is now known as johnbergoon | 20:34 | |
| *** dysinger has quit IRC | 20:35 | |
| *** btorch has quit IRC | 20:38 | |
| *** gaveen has quit IRC | 20:43 | |
| *** clayg_ has quit IRC | 20:45 | |
| *** pvo has joined #openstack | 20:46 | |
| *** pvo has joined #openstack | 20:46 | |
| *** ChanServ sets mode: +v pvo | 20:46 | |
| *** clayg_ has joined #openstack | 20:49 | |
| *** gaveen has joined #openstack | 20:56 | |
| *** littleidea has quit IRC | 21:00 | |
| KnightHacker | gholt: I just saw your comments on the authentication blueprint https://blueprints.launchpad.net/nova/+spec/openstack-authn . I just wanna make sure that I understand it. So, are you saying that after it gets implemented, we'll integrate it and ship it in OpenStack?, but you are concerned about getting it done during this release? | 21:00 |
| KnightHacker | s/this/bexar | 21:00 |
| *** mdomsch has quit IRC | 21:00 | |
| uvirtbot | New bug: #674687 in swift "Multi node install needs instructions to point proxy to auth if on different servers" [Medium,Triaged] https://launchpad.net/bugs/674687 | 21:01 |
| *** pothos_ has joined #openstack | 21:02 | |
| *** hazmat has joined #openstack | 21:02 | |
| *** gaveen has quit IRC | 21:03 | |
| *** pothos has quit IRC | 21:05 | |
| *** pothos_ is now known as pothos | 21:05 | |
| *** littleidea has joined #openstack | 21:09 | |
| *** msinhore has joined #openstack | 21:09 | |
| *** londo has joined #openstack | 21:09 | |
| piken | ok, solution for the losetup and libblkid on centos5 is to build util-linux-ng-2.18 and copy the new losetup binary to the nova install directory and patch nova to call the new binary instead of the one from the path. | 21:10 |
| gholt | KnightHacker: More a concern that it is trying to claim as being THE way to do auth and puts requirements on the services besides just "make auth pluggable with WSGI and optional callbacks". | 21:15 |
| *** joearnold has joined #openstack | 21:16 | |
| *** msinhore has quit IRC | 21:16 | |
| *** burris has joined #openstack | 21:19 | |
| *** sophiap has joined #openstack | 21:19 | |
| *** gaveen has joined #openstack | 21:20 | |
| piken | gholt: maybe there should be an AuthManager like the VolumeManager and NetorkManager that way multipe auth sets can be added by default like oauth and openid, and still leave the abbility to be extended to others by end users. | 21:29 |
| *** msinhore has joined #openstack | 21:31 | |
| KnightHacker | gholt: the only thing that it requires services to implement is the communication protocl between the auth component (WSGI component) and the service. | 21:32 |
| *** msinhore has quit IRC | 21:34 | |
| *** gustavomzw has joined #openstack | 21:34 | |
| *** gustavomzw has quit IRC | 21:36 | |
| KnightHacker | And this is something that we can help contribute as well. | 21:41 |
| *** lyetz has quit IRC | 21:42 | |
| *** rlucio has quit IRC | 21:46 | |
| *** westmaas has quit IRC | 21:48 | |
| *** dubsquared1 has left #openstack | 21:49 | |
| *** JordanRinke has quit IRC | 21:50 | |
| *** zul has quit IRC | 21:51 | |
| *** joearnold has quit IRC | 21:55 | |
| *** joearnol_ has joined #openstack | 21:55 | |
| *** rlucio has joined #openstack | 21:57 | |
| *** joearnol_ has quit IRC | 21:58 | |
| *** MarkAtwood has quit IRC | 22:00 | |
| *** jdarcy has quit IRC | 22:01 | |
| *** sirp1 has joined #openstack | 22:03 | |
| *** burris has quit IRC | 22:04 | |
| *** clayg_ has quit IRC | 22:08 | |
| *** dendro-afk is now known as dendrobates | 22:09 | |
| *** dendrobates has joined #openstack | 22:09 | |
| *** ChanServ sets mode: +v dendrobates | 22:09 | |
| *** rsampaio has quit IRC | 22:13 | |
| *** littleidea has quit IRC | 22:20 | |
| *** johnbergoon has quit IRC | 22:21 | |
| *** rlucio has quit IRC | 22:21 | |
| *** johnbergoon has joined #openstack | 22:21 | |
| *** zul has joined #openstack | 22:25 | |
| *** Podilarius has left #openstack | 22:28 | |
| *** Cybodog has quit IRC | 22:31 | |
| *** zul has quit IRC | 22:39 | |
| *** ppetraki has quit IRC | 22:40 | |
| gholt | KnightHacker: It's probably just semantics and maybe not all that important. | 22:42 |
| gholt | KnightHacker: It reads as if it will make integrating with existing authentication systems easier, but really it just pushes the integration work to a different area. In fact, forcing support of a reverse proxy option and basic auth will likely make it harder if those options aren't really needed or desired. | 22:42 |
| gholt | KnightHacker: I think (but I'm just one opinion) that it'd be better to change the purpose of the blueprint to creating a default authentication implementation that works with all OpenStack services, but isn't somehow the be-all-end-all last-word on how to do it. | 22:43 |
| KnightHacker | gholt: Maybe the blueprint isn't worded right .. or we are having a problem expressing it. But I don't think that we are proposing that this becomes THE authentication. | 22:44 |
| gholt | KnightHacker: Also, specific nitpick, all unauthed requests should not be refused. In Swift, we have the concept of public containers, so unauthed requests should be allowed through and possibly allowed at a lower level. | 22:45 |
| KnightHacker | It is only an attempt to standardize on how these auth components communicate with the service. So that 3rd party can write different reusable auth components for different standards | 22:45 |
| KnightHacker | without having to touch the OpenStack service code. | 22:45 |
| gholt | They can already do that with WSGI middleware. ;) | 22:46 |
| KnightHacker | And our proposed protocol states using WSGI ;). | 22:46 |
| KnightHacker | middleware that is. | 22:46 |
| KnightHacker | gholt: unauthed requests can be accepted as well. | 22:46 |
| gholt | With Swift, they just set the REMOTE_USER to the authenticated user if there is one and a swift_authorize callback if they'd like to do authorization checks. They can call out to their auth system however they deem best. | 22:46 |
| KnightHacker | You can deploy two auth components .. one that passes unauthed or public (anonymous) requests. | 22:47 |
| gholt | ^^ Which is much like how repoze.who and repoze.what already work | 22:47 |
| uvirtbot | gholt: Error: "^" is not a valid command. | 22:47 |
| KnightHacker | Oh .. you can implement the proposed blueprint using any library if you want. | 22:48 |
| KnightHacker | The reference implementation is just reference for correctness and completeness .. it wasn't intended to be production ready or highly performant or whatever. | 22:48 |
| KnightHacker | I am not against using repoze.who at all. | 22:49 |
| KnightHacker | gholt: bare in mind that the proposed blueprint is just to standardize on how it should look between all the OpenStack services. Most of what we are proposing already exists in Swift, as far as I understand. | 22:50 |
| gholt | So, pretty much, I guess the requirement for a service should simply be "allow a pluggable component that can process requests before they get to a service, setting documented variables indicating authenticated users". | 22:51 |
| gholt | I don't understand why it'd have to be X-Authorization, or Authorization, or X-Auth-Token, or REMOTE_USER, or any particular thing. | 22:52 |
| *** pvo has quit IRC | 22:52 | |
| KnightHacker | So, that's the first requirement .. yes. You got it. | 22:53 |
| gholt | I don't see the need for any further requirements. Just example implementations. | 22:53 |
| KnightHacker | Your second question .. it is about standardization. | 22:53 |
| *** jfluhmann has quit IRC | 22:53 | |
| KnightHacker | Why would you ever want every OpenStack service to implement it differently .. or ever worse .. RE-implementing it similarly. | 22:54 |
| *** DubLo7 has joined #openstack | 22:54 | |
| gholt | Different languages, different libraries. WSGI is just Python for instance. | 22:54 |
| KnightHacker | As far as I know we are only accepting Python and C in OpenStack. All APIs, as far as I know .. are in Python. But even then, having the python middleware is a communication between the openstack service and the authentication or IDM system. | 22:55 |
| KnightHacker | So you can have an IDM system in Java or whatever .. but as long as you have a WSGI middleware, you are set. | 22:55 |
| KnightHacker | Moreover, this argument falls for how it is done today anyways because we are still using WSGI in swift and nova. | 22:56 |
| KnightHacker | But back again to your original point about how "heavy" the change is.. I honestly don't think it is that much of a chance at all. | 22:57 |
| gholt | Sure, but why define how those folks implement their middleware? What if they want to use ActiveDirectory calls in their middleware? Or do they have to change their ActiveDirectory server to support HTTP workflows? | 22:57 |
| KnightHacker | And this may be not communicated well during the design summit. | 22:57 |
| KnightHacker | Nope. They certainly can write a middleware that talks AD to their AD server. | 22:58 |
| KnightHacker | Then after they do the authentication, it talks back to the openstack service using the predefined protocol. | 22:58 |
| KnightHacker | We don't care how the auth component authenticates the user. We just care (as already implemented in Swift) about the username after he is authenticated to be passed down to the service. | 22:59 |
| KnightHacker | s/talks AD/talks LDAP/ | 22:59 |
| gholt | Circles. :) If I make WSGI middleware that sets REMOTE_USER, I should be done. I shouldn't have to offer support for reverse proxy's and basic auth if it's just not needed, desired, feasible, w/e. | 23:00 |
| KnightHacker | haha. OK .. now that's a different question. | 23:01 |
| gholt | Well, that and the fact that setting REMOTE_USER to the authenticated user is kinda already a convention in use out there. | 23:02 |
| KnightHacker | We do require that the auth component authenticates itself if it is separated to mitigate security concerns | 23:02 |
| KnightHacker | So, we can discuss the "name" of the header as one point. The other point I am hearing from you is if I follow the protocol, why do I need to implement the rest of it. | 23:02 |
| gholt | I may be confused by the statement "OpenStack services MUST support both embedded (Option (a)) and external (Option (b)) deployment strategies." Perhaps I'm reading more into that than I should. If Python services must support WSGI middleware authentication components, then the statement is redundant. | 23:03 |
| KnightHacker | For the second point, it is best practices .. that's what we "require" OpenStack services to implement it so that we avoid again security stuff .. etc. | 23:03 |
| *** rnirmal has quit IRC | 23:04 | |
| KnightHacker | In this statement, we just meant to say that services shouldn't always assume that the middleware is safe and secure and not injected or poisened. | 23:04 |
| KnightHacker | Because an Operator can deploy OpenStack service with that middleware separated from the actual service. | 23:05 |
| *** dubsquared has joined #openstack | 23:05 | |
| gholt | WSGI middleware by definition is part of the processes's execution stack doesn't it? How do you have an external WSGI middleware? | 23:07 |
| *** deshantm has quit IRC | 23:07 | |
| gholt | Poor typing and grammar, sorry, heh. | 23:07 |
| KnightHacker | gholt: haha .. np :) If you look at the ref implementation. You can run a middleware that is completely separated from an app. | 23:08 |
| gholt | But... you have to have some middleware that calls out to that separate authentication service. That separate auth service isn't middleware itself. | 23:09 |
| KnightHacker | This provides the Operator with a lot more flexbility on how to structure and scale his auth scheme. | 23:09 |
| KnightHacker | In the ref implementation, there is an App or Service. Another file that acts as a middleware (auth component), that you can run separately and it can talk to any authentication system you want. | 23:10 |
| KnightHacker | Those are two different things, I meant to say. | 23:10 |
| KnightHacker | So, the middleware doesn't have to be "embedded" in your app. | 23:10 |
| KnightHacker | So, in other words, you can actually run your middleware on a completely separate endpoint if you want to. | 23:13 |
| KnightHacker | Anyways, I am gonna have to head out now, but I would love to continue this discussion later if you still have more questions. | 23:13 |
| KnightHacker | gholt: have a good weekend :). | 23:13 |
| gholt | You too. :) | 23:14 |
| *** joearnold has joined #openstack | 23:14 | |
| *** littleidea has joined #openstack | 23:16 | |
| *** jtimberman has quit IRC | 23:20 | |
| *** joearnold has quit IRC | 23:27 | |
| *** joearnold has joined #openstack | 23:27 | |
| *** jtimberman has joined #openstack | 23:29 | |
| *** deshantm has joined #openstack | 23:30 | |
| *** schisamo has joined #openstack | 23:32 | |
| *** neogenix has joined #openstack | 23:39 | |
| *** jonkelly has quit IRC | 23:43 | |
| *** schisamo has quit IRC | 23:49 | |
| *** joearnold has quit IRC | 23:53 | |
| *** ArdRigh has joined #openstack | 23:54 | |
| *** aimon has joined #openstack | 23:54 | |
| *** littleidea has quit IRC | 23:55 | |
| *** MarkAtwood has joined #openstack | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!