| Xenith | Hmm. Has anyone tried getting nova working on FreeBSD yet? | 00:06 |
|---|---|---|
| *** zenmatt has quit IRC | 00:09 | |
| *** pvo has joined #openstack | 00:17 | |
| *** azneita has joined #openstack | 00:23 | |
| *** azneita has joined #openstack | 00:23 | |
| vishy | Xenith: no although the tests all run on Darwin, so the python code should run fine. If you can install all the cli tools (bridge_utils, etc.), you might be able to get it to work. | 00:32 |
| vishy | Does libvirt run on FreeBSD? | 00:32 |
| Xenith | Don't think so, actually. http://forums.freebsd.org/showthread.php?t=17564 | 00:36 |
| tripson_ | afaik not natively | 00:36 |
| *** adiantum has quit IRC | 00:36 | |
| *** adiantum has joined #openstack | 00:42 | |
| *** miclorb has quit IRC | 00:45 | |
| *** rchavik has joined #openstack | 00:46 | |
| *** adiantum has quit IRC | 00:54 | |
| *** deshantm_xenorg has quit IRC | 00:54 | |
| *** te has quit IRC | 00:55 | |
| *** zenmatt has joined #openstack | 00:58 | |
| *** mahadev has joined #openstack | 00:59 | |
| *** dubsquared has joined #openstack | 00:59 | |
| dubsquared | creiht: around? | 01:00 |
| *** zul has quit IRC | 01:00 | |
| *** adiantum has joined #openstack | 01:00 | |
| *** rchavik has quit IRC | 01:02 | |
| *** mahadev has quit IRC | 01:03 | |
| *** adiantum has quit IRC | 01:09 | |
| *** mahadev has joined #openstack | 01:10 | |
| *** adiantum has joined #openstack | 01:15 | |
| *** zul has joined #openstack | 01:21 | |
| *** adiantum has quit IRC | 01:21 | |
| *** adiantum has joined #openstack | 01:22 | |
| *** zenmatt has quit IRC | 01:24 | |
| *** adiantum has quit IRC | 01:31 | |
| *** reldan has quit IRC | 01:34 | |
| *** adiantum has joined #openstack | 01:35 | |
| *** adiantum has quit IRC | 01:43 | |
| *** gregp76 has joined #openstack | 01:44 | |
| *** miclorb_ has joined #openstack | 01:51 | |
| *** vvuksan has joined #openstack | 01:55 | |
| *** adiantum has joined #openstack | 01:55 | |
| *** adiantum has quit IRC | 02:05 | |
| *** adiantum has joined #openstack | 02:10 | |
| *** zenmatt has joined #openstack | 02:11 | |
| *** miclorb_ has quit IRC | 02:11 | |
| *** Ryan_Lane has quit IRC | 02:13 | |
| *** Ryan_Lane_ has joined #openstack | 02:13 | |
| *** westmaas has joined #openstack | 02:19 | |
| *** vvuksan has quit IRC | 02:20 | |
| *** adiantum has quit IRC | 02:21 | |
| *** bcwaldon has joined #openstack | 02:26 | |
| *** adiantum has joined #openstack | 02:27 | |
| *** Ryan_Lane_ is now known as Ryan_Lane | 02:28 | |
| *** gregp76 has quit IRC | 02:28 | |
| *** lamar has quit IRC | 02:33 | |
| *** ewindisch has joined #openstack | 02:33 | |
| ewindisch | hello | 02:34 |
| *** adjohn has quit IRC | 02:39 | |
| *** combo has joined #openstack | 02:41 | |
| *** mahadev has quit IRC | 02:43 | |
| *** combo has quit IRC | 02:43 | |
| *** deshantm has joined #openstack | 02:44 | |
| *** lamar has joined #openstack | 02:47 | |
| *** ppetraki has joined #openstack | 02:52 | |
| *** miclorb has joined #openstack | 02:57 | |
| *** pvo has quit IRC | 02:59 | |
| *** adiantum has quit IRC | 03:04 | |
| *** adjohn has joined #openstack | 03:05 | |
| *** adiantum has joined #openstack | 03:06 | |
| *** mahadev has joined #openstack | 03:11 | |
| *** rchavik has joined #openstack | 03:14 | |
| *** mahadev has quit IRC | 03:18 | |
| *** Vaternz has joined #openstack | 03:19 | |
| Vaternz | goodevening | 03:20 |
| Vaternz | any documents on how to create an image for openstack? | 03:21 |
| Vaternz | like i want to create my own centos, ubuntu, etc... images... | 03:22 |
| Vaternz | procedures and howto's please... btw i'm just an I.T student | 03:22 |
| deshantm | Vaternz: there are images available | 03:25 |
| deshantm | Vaternz: what hypervisor do you intend to use? | 03:26 |
| Vaternz | i've seen those sir... which i can just download... but i want to know how to create an image for myself... kvm? or xen? which one do you recommend sir? | 03:27 |
| deshantm | http://wiki.openstack.org/XenServerDevelopment | 03:27 |
| deshantm | Vaternz: XCP is a good open source solution based on Xen | 03:28 |
| Vaternz | XCP... alright i will take note of that... great. | 03:29 |
| Vaternz | and by the way sir deshantm, i used one of the images available and attach it my openstack, it was successful but i cant connect to it, do know what seems to be the problem? | 03:30 |
| jeremyb | Vaternz: debian/ubuntu have vmbuilder | 03:30 |
| jeremyb | idk how they work or not with nova/xen/kvm (they do work with ec2/eucalyptus aiui) | 03:31 |
| deshantm | another good tools is the Stacklet bundler | 03:31 |
| deshantm | Vaternz: did you set up the SSH keys? | 03:32 |
| Vaternz | sir jeremyb, alright great, i will take note of those details.... | 03:32 |
| deshantm | Vaternz: what are you trying to accomplish in general with openstack? | 03:34 |
| deshantm | or are you just in learning mode? | 03:34 |
| jeremyb | deshantm: can you build stacklets yourself or just use what they provide? | 03:34 |
| Vaternz | sir deshantm, where using this nova-rc to load the ssh keys? do you see any short-comings on what i'm doing? | 03:34 |
| deshantm | jeremyb: they have open source software | 03:34 |
| deshantm | jeremyb: http://stacklet.com/stackbundler and https://bitbucket.org/stacklet | 03:35 |
| jeremyb | cool, i'll look some more in a bit | 03:35 |
| Vaternz | Sir deshantm, i'm mean using this nova-rc to load or the ssh keys. | 03:36 |
| deshantm | Vaternz: what howto are you following exactly. I'm not sure what nova-rc you are referring too, but in context I could probably try to explain | 03:38 |
| *** Vaternz_ has joined #openstack | 03:42 | |
| Vaternz_ | sorry, got DC | 03:42 |
| *** Vaternz has quit IRC | 03:44 | |
| deshantm | Vaternz_: what howto are you following exactly. I'm not sure what nova-rc you are referring too, but in context I could probably try to explain | 03:44 |
| deshantm | need to reboot this system, bbl | 03:46 |
| *** deshantm has quit IRC | 03:46 | |
| *** ppetraki has quit IRC | 03:46 | |
| *** Vaternz_ has quit IRC | 03:47 | |
| *** adiantum has quit IRC | 03:49 | |
| *** deshantm has joined #openstack | 03:51 | |
| *** adiantum has joined #openstack | 03:53 | |
| *** Guest22828 is now known as antonym | 03:56 | |
| *** antonym is now known as Guest87577 | 03:56 | |
| *** Vaternz has joined #openstack | 03:56 | |
| *** Guest87577 has quit IRC | 03:57 | |
| *** Guest87577 has joined #openstack | 03:57 | |
| *** ChanServ sets mode: +v Guest87577 | 03:57 | |
| Vaternz | why does the image i attached, is still in 'scheduling'? should it be 'up' in just a matter of seconds? | 03:59 |
| *** paltman has quit IRC | 04:00 | |
| *** ewindisch has quit IRC | 04:00 | |
| *** paltman has joined #openstack | 04:00 | |
| Vaternz | i did euca-run-instances, then did euca-describe-instances to check the image, but it is still in 'scheduling'... what seems to be the problem? | 04:01 |
| *** adiantum has quit IRC | 04:02 | |
| jarrod | check logs | 04:05 |
| Vaternz | sir jarrod, is that for me? check logs? | 04:05 |
| *** adiantum has joined #openstack | 04:07 | |
| *** herki has joined #openstack | 04:09 | |
| *** herki_ has quit IRC | 04:10 | |
| Vaternz | i did euca-run-instances, then did euca-describe-images to check the image, but it is still in 'scheduling'... and still in 'scheduling'. what am i doing wrong? | 04:11 |
| *** markwash has quit IRC | 04:19 | |
| *** markwash has joined #openstack | 04:21 | |
| *** Vaternz has quit IRC | 04:29 | |
| *** adiantum has quit IRC | 04:31 | |
| markwash | is file injection supposed to show up in the admin api for nova? | 04:35 |
| *** adiantum has joined #openstack | 04:36 | |
| *** bcwaldon has quit IRC | 04:42 | |
| *** adiantum has quit IRC | 04:47 | |
| *** adiantum has joined #openstack | 04:59 | |
| *** kashyap has joined #openstack | 05:22 | |
| *** Ryan_Lane has quit IRC | 05:24 | |
| *** alekibango has quit IRC | 05:25 | |
| *** adiantum has quit IRC | 05:44 | |
| *** lamar has quit IRC | 05:48 | |
| *** adiantum has joined #openstack | 05:49 | |
| *** f4m8_ is now known as f4m8 | 05:49 | |
| *** openstack has joined #openstack | 05:56 | |
| *** ChrisAM has quit IRC | 05:56 | |
| *** Guest87577 is now known as antonym | 05:56 | |
| *** larissa has quit IRC | 05:57 | |
| *** larissa has joined #openstack | 05:58 | |
| *** jk0 has quit IRC | 05:58 | |
| *** rdw has quit IRC | 05:58 | |
| *** iRTermite has quit IRC | 05:59 | |
| *** jk0 has joined #openstack | 05:59 | |
| *** jk0 has joined #openstack | 05:59 | |
| *** ChanServ sets mode: +v jk0 | 05:59 | |
| *** rdw has joined #openstack | 06:00 | |
| *** adiantum has quit IRC | 06:01 | |
| *** iRTermite has joined #openstack | 06:01 | |
| *** ChrisAM1 has joined #openstack | 06:01 | |
| *** adjohn has quit IRC | 06:04 | |
| *** adiantum has joined #openstack | 06:05 | |
| *** adjohn has joined #openstack | 06:05 | |
| *** Mani2 has joined #openstack | 06:08 | |
| Mani2 | hi all, i have given bzr branch lp:nova | 06:08 |
| Mani2 | ssh: connect to host bazaar.launchpad.net port 22: Connection refused | 06:08 |
| Mani2 | bzr: ERROR: Connection closed: Unexpected end of message. Please check connectivity and permissions, and report a bug if problems persist. | 06:08 |
| *** adjohn has quit IRC | 06:09 | |
| *** adjohn has joined #openstack | 06:10 | |
| *** dubsquared has quit IRC | 06:22 | |
| *** kashyap has quit IRC | 06:32 | |
| *** kashyap has joined #openstack | 06:32 | |
| *** guigui1 has joined #openstack | 06:42 | |
| *** mahadev has joined #openstack | 06:43 | |
| *** adiantum has quit IRC | 06:44 | |
| *** adjohn has quit IRC | 06:48 | |
| *** mahadev has quit IRC | 06:51 | |
| *** hazmat has joined #openstack | 06:52 | |
| *** adiantum has joined #openstack | 06:56 | |
| *** adjohn has joined #openstack | 06:57 | |
| *** mahadev has joined #openstack | 06:58 | |
| *** naehring has joined #openstack | 07:04 | |
| *** gasbakid has joined #openstack | 07:06 | |
| *** miclorb has quit IRC | 07:07 | |
| *** DIgitalFlux has joined #openstack | 07:08 | |
| *** adjohn has quit IRC | 07:09 | |
| *** MarkAtwood has joined #openstack | 07:15 | |
| *** MarkAtwood has left #openstack | 07:15 | |
| Mani2 | bzr branch lp:nova it show error ssh :connect to bazzar.lp.net connection refeused | 07:17 |
| *** reldan has joined #openstack | 07:20 | |
| *** gregp76 has joined #openstack | 07:24 | |
| *** ramkrsna has joined #openstack | 07:24 | |
| jeremyb | Mani2: you should talk to #launchpad ... doesn't appear to be anything wrong afaict: | 07:25 |
| jeremyb | $ nc bazaar.launchpad.net 22 </dev/null | head -n 1 | 07:25 |
| jeremyb | SSH-2.0-Twisted | 07:25 |
| jeremyb | (they may have you blocked with e.g. fail2ban) | 07:26 |
| Mani2 | ok, thank u | 07:26 |
| *** DigitalFlyx has joined #openstack | 07:27 | |
| *** kashyap has quit IRC | 07:28 | |
| *** kashyap has joined #openstack | 07:29 | |
| *** adiantum has quit IRC | 07:29 | |
| *** DIgitalFlux has quit IRC | 07:29 | |
| *** adiantum has joined #openstack | 07:35 | |
| *** stewart has quit IRC | 07:35 | |
| *** pothos has quit IRC | 07:40 | |
| *** pothos has joined #openstack | 07:41 | |
| *** stewart has joined #openstack | 07:49 | |
| *** mahadev has quit IRC | 08:05 | |
| *** piezo has quit IRC | 08:07 | |
| *** azneita has quit IRC | 08:08 | |
| *** gregp76 has quit IRC | 08:09 | |
| *** adiantum has quit IRC | 08:29 | |
| *** adiantum has joined #openstack | 08:35 | |
| *** DIgitalFlux has joined #openstack | 08:35 | |
| *** reldan has quit IRC | 08:36 | |
| *** DigitalFlyx has quit IRC | 08:36 | |
| *** Nacx has joined #openstack | 08:41 | |
| *** adiantum has quit IRC | 08:42 | |
| *** skiold has joined #openstack | 08:48 | |
| *** mgoldmann has joined #openstack | 08:48 | |
| *** mgoldmann has joined #openstack | 08:48 | |
| soren | ttx: It looks like tarmac has "Needs Review" hardcoded as the status for branches that fail the pre commit check. | 08:50 |
| ttx | soren: yes -- I wanted to make that configurable, post the patch and see if we can apply it to our setup | 08:50 |
| ttx | soren: had a good time off ? | 08:51 |
| soren | ttx: Cool. | 08:51 |
| soren | ttx: Yeah, Berlin is nice, even this time of year. | 08:51 |
| ttx | soren: met with some of our common friends ? | 08:51 |
| soren | Yeah, met with dholbach. | 08:52 |
| ttx | soren: a few things while you catch up: | 08:52 |
| soren | He took us to the burger place we also visited when we were sprinting there in 2009. | 08:52 |
| ttx | oh right | 08:52 |
| ttx | soren: glance builds seem to be broken on PPA | 08:52 |
| soren | craptastic | 08:52 |
| ttx | soren: and is there any way to run the 2011.1.1 candidate build on your magic setup | 08:53 |
| soren | Yup. | 08:53 |
| soren | I can just feed it a bzr branch url, and it'll do its magic. | 08:53 |
| soren | glance looks easy. | 08:54 |
| * soren fixes. | 08:54 | |
| ttx | soren: would like to validate bug 716427 + any weird regression (compared to bexar) | 08:54 |
| uvirtbot | Launchpad bug 716427 in nova/bexar "RPC concurrency problem" [High,Fix committed] https://launchpad.net/bugs/716427 | 08:54 |
| *** photron has joined #openstack | 08:54 | |
| *** adiantum has joined #openstack | 08:54 | |
| *** DIgitalFlux has quit IRC | 08:54 | |
| *** DigitalFlux has joined #openstack | 08:54 | |
| * soren wishes the hudson box would be accessible over https. | 08:56 | |
| *** daveiw has joined #openstack | 08:58 | |
| *** ctennis_ has joined #openstack | 09:04 | |
| *** ctennis has quit IRC | 09:06 | |
| *** ctennis_ is now known as ctennis | 09:06 | |
| *** allsystemsarego has joined #openstack | 09:09 | |
| *** reldan has joined #openstack | 09:19 | |
| uvirtbot | New bug: #726359 in nova "utils.execute uses potentially insecure shell=True" [High,In progress] https://launchpad.net/bugs/726359 | 09:21 |
| *** uksysadmin has joined #openstack | 09:29 | |
| soren | ttx: Glance packaging fixed, but https://code.launchpad.net/~soren/glance/glance-upload-sys.path/+merge/51501 needs to land before the build actually works. | 09:32 |
| *** sateesh has joined #openstack | 09:33 | |
| ttx | ok | 09:34 |
| *** gasbakid has quit IRC | 09:38 | |
| *** sateesh has quit IRC | 09:40 | |
| *** sateesh has joined #openstack | 09:44 | |
| *** MarcMorata has joined #openstack | 09:51 | |
| *** gasbakid has joined #openstack | 09:52 | |
| *** adiantum has quit IRC | 10:00 | |
| *** photron has quit IRC | 10:02 | |
| *** adiantum has joined #openstack | 10:06 | |
| *** adiantum has quit IRC | 10:30 | |
| doude | Hi all, I've got a problem with the serial console with libvirt. I copy the Nova XML template of libvirt instances and I set manually the parameters. I create the domain with 'virsh' command but I cannot acces to the serial console through the command 'virsh console mydomain' | 10:32 |
| doude | If I remove the part '<serial type="file">' in ht e XML file, the serial console is available | 10:32 |
| doude | It works for you ? | 10:33 |
| *** sateesh has quit IRC | 10:38 | |
| *** adiantum has joined #openstack | 10:42 | |
| *** sateesh has joined #openstack | 10:45 | |
| sateesh | ttx: when is 2011.1.1 getting released? | 10:46 |
| ttx | sateesh: probably wednesday. | 10:51 |
| sateesh | ttx: thanks | 10:51 |
| ttx | sateesh: the go/nogo will be discussed at the weekly meeting tomorrow | 10:51 |
| sateesh | ttx: ok | 10:52 |
| *** vijay_ has joined #openstack | 10:53 | |
| *** shoaib has joined #openstack | 10:57 | |
| shoaib | hi | 10:57 |
| shoaib | i would like to ask if there is a way to start a service which got stopped due to a restart of host machine? | 10:57 |
| shoaib | anyone? | 10:58 |
| *** adiantum has quit IRC | 10:59 | |
| *** vijay_ has quit IRC | 10:59 | |
| shoaib | hello?? | 11:01 |
| *** adiantum has joined #openstack | 11:01 | |
| shoaib | help is needed!!! pls | 11:04 |
| Mani2 | hi all, i have given bzr branch lp:nova ssh: connect to host bazaar.launchpad.net port 22: Connection refused bzr: ERROR: Connection closed: Unexpected end of message. Please check connectivity and permissions, and report a bug if problems persist. | 11:06 |
| ttx | Mani2: your issue is not specific to lp:nova... Did you try to ask in #bzr for help ? | 11:07 |
| ttx | shoaib: I don't understand your question. | 11:07 |
| Mani2 | no one in #bzr | 11:08 |
| ttx | Mani2: there is plenty of people there. Just let them some time to answer. | 11:09 |
| *** avishay has joined #openstack | 11:12 | |
| avishay | Hi all. I am trying to set up swift according to development_saio.html. I can connect with curl from the same machine, but not from another machine. | 11:16 |
| avishay | I changed the IP from 127.0.0.1 to the external one in bin/remakerings, /etc/swift/auth-server.conf, and /etc/rsyncd.conf, but no luck. | 11:16 |
| avishay | Is anybody available to help me? | 11:16 |
| *** jtimberman has quit IRC | 11:17 | |
| *** jtimberman has joined #openstack | 11:19 | |
| *** DigitalFlux has quit IRC | 11:25 | |
| uksysadmin | shoaib - what service has been stopped? | 11:25 |
| shoaib | the instance has stopped | 11:28 |
| shoaib | nova and other related services are running | 11:28 |
| shoaib | my machine rebooted and all instances are down now | 11:28 |
| *** ahale has joined #openstack | 11:29 | |
| *** adiantum has quit IRC | 11:30 | |
| shoaib | anyway to start them? i can see their folder in /var/lib/nova | 11:31 |
| uksysadmin | start nova-{api,compute,objectstore,scheduler,network} etc... | 11:33 |
| shoaib | yes all are running | 11:33 |
| uksysadmin | you mean the instances have stopped, not the services? | 11:33 |
| shoaib | yes | 11:34 |
| uksysadmin | your machine rebooted - and the instances live in memory... erm... euca-run-instance again... | 11:34 |
| shoaib | and what about data? | 11:34 |
| *** DigitalFlux has joined #openstack | 11:35 | |
| shoaib | if i euca-run-instance it will create a new instance right? | 11:35 |
| uksysadmin | if they didn't have some volume attached (from swift?) then the instances don't have persistent storage | 11:36 |
| *** bobya has joined #openstack | 11:36 | |
| *** adiantum has joined #openstack | 11:37 | |
| shoaib | so what do we hav then in /var/lib/nova/disk? | 11:38 |
| shoaib | i mean /var/lib/nova/instabces/instance folder/disk | 11:38 |
| *** adiantum has quit IRC | 11:44 | |
| *** hazmat has quit IRC | 11:45 | |
| *** avishay has quit IRC | 11:47 | |
| *** patri0t has joined #openstack | 11:48 | |
| *** adiantum has joined #openstack | 11:50 | |
| zul | vishy: ill have some instructions and an image up today for you for lxc | 11:53 |
| *** markwash has quit IRC | 11:56 | |
| *** hazmat has joined #openstack | 11:58 | |
| *** romain_lenglet_ has joined #openstack | 11:58 | |
| shoaib | where can i get a centos image i386.tar.gz? anyone? | 11:58 |
| *** romain_lenglet_ has quit IRC | 11:59 | |
| *** ahmedelgamil has joined #openstack | 12:00 | |
| * uksysadmin renames himself to 'google': http://open.eucalyptus.com/wiki/EucalyptusUserImageCreatorGuide_v1.6 | 12:03 | |
| *** DigitalFlux has quit IRC | 12:04 | |
| *** reldan has quit IRC | 12:10 | |
| *** adiantum has quit IRC | 12:12 | |
| *** jaypipes has quit IRC | 12:12 | |
| *** ctennis has quit IRC | 12:17 | |
| *** adiantum has joined #openstack | 12:18 | |
| *** Mani2 has quit IRC | 12:24 | |
| *** shoaib has quit IRC | 12:25 | |
| *** adiantum has quit IRC | 12:26 | |
| *** guigui1 has quit IRC | 12:29 | |
| *** adiantum has joined #openstack | 12:33 | |
| *** ahmedelgamil has quit IRC | 12:33 | |
| *** ctennis has joined #openstack | 12:35 | |
| *** ctennis has joined #openstack | 12:35 | |
| *** DigitalFlux has joined #openstack | 12:45 | |
| *** DigitalFlux has joined #openstack | 12:45 | |
| *** guigui1 has joined #openstack | 12:50 | |
| zul | ttx: hey i was wondering if libguestfs is required now? | 12:53 |
| ttx | zul: depends on the direction the discussion is going... but it's certainly very welcome | 12:54 |
| zul | ttx: ok i think i can squeeze it in | 12:55 |
| soren | Wait, what? | 12:55 |
| soren | Where's this discussino? | 12:55 |
| * soren hates libguestfs | 12:55 | |
| ttx | haha | 12:55 |
| ttx | soren: you prefer NBD ? | 12:55 |
| soren | If those are my options, yes. | 12:55 |
| ttx | soren: see the thread on the RHEL build | 12:56 |
| ttx | soren: one of the patches they have in is a switch from NBD to libguestfs | 12:56 |
| ttx | soren: given that there are complains on how difficult it is to interact with qemu-nbd, I was wondering if a switch to libguestfs wasn't appropriate | 12:56 |
| ttx | soren: you should explain your hatred there :) | 12:57 |
| * ttx has no opinion on it, but the resulting code in NOva certainly looks better. | 12:57 | |
| soren | Where's said code? | 12:58 |
| ttx | let me dig that for you | 12:59 |
| ttx | soren: https://github.com/abrindeyev/openstack-nova-rhel6/commit/1a59fcbedab62b85fa273c06becf100d78b2c77c | 12:59 |
| ttx | gets rid of the inframous sleep loop | 13:00 |
| *** reldan has joined #openstack | 13:00 | |
| soren | I'd much rather throw the 5 needed lines of code at qemu-nbd to fix that. | 13:01 |
| *** westmaas has quit IRC | 13:02 | |
| *** sateesh has quit IRC | 13:15 | |
| *** kashyap has quit IRC | 13:15 | |
| *** matclayton has joined #openstack | 13:17 | |
| *** fabiand_ has joined #openstack | 13:19 | |
| *** ChrisAM1 is now known as ChrisAM | 13:21 | |
| *** Ryan_Lane has joined #openstack | 13:23 | |
| *** guigui1 has quit IRC | 13:26 | |
| *** Glacee has quit IRC | 13:41 | |
| *** stewart has quit IRC | 13:42 | |
| *** stewart has joined #openstack | 13:43 | |
| *** zul_ has joined #openstack | 13:48 | |
| *** zul has quit IRC | 13:48 | |
| uvirtbot | New bug: #726534 in glance "daemon_options are not loaded by glance bin files" [Undecided,New] https://launchpad.net/bugs/726534 | 13:51 |
| *** vvuksan has joined #openstack | 13:52 | |
| *** fabiand_ has quit IRC | 13:52 | |
| *** Ryan_Lane has quit IRC | 13:53 | |
| *** zul_ is now known as zul | 13:55 | |
| *** zul has joined #openstack | 13:55 | |
| *** bcwaldon has joined #openstack | 14:00 | |
| *** ppetraki has joined #openstack | 14:03 | |
| *** dprince has joined #openstack | 14:04 | |
| *** adiantum has quit IRC | 14:07 | |
| *** pvo has joined #openstack | 14:13 | |
| soren | ttx: The stuff you want me to test... Is it in a PPA or is it a particular branch? | 14:14 |
| ttx | both | 14:15 |
| ttx | soren: lp:nova/bexar and ppa:ttx/nova-bexar-updates | 14:15 |
| * soren tires the former first | 14:15 | |
| soren | tries, even. | 14:16 |
| soren | I've just pushed lp:~linux2go/nova/jenkins-config, by the way. | 14:16 |
| *** bcwaldon has quit IRC | 14:16 | |
| *** westmaas_away is now known as westmaas | 14:18 | |
| *** adiantum has joined #openstack | 14:19 | |
| soren | ttx: Hmm... That went less than perfect. | 14:20 |
| patri0t | which one is right? http://nova.openstack.org/_images/arch.png OR http://nova.openstack.org/_images/Novadiagram.png | 14:20 |
| *** piken_ has quit IRC | 14:21 | |
| soren | patri0t: Without looking at either, I'm going to guess the answer is "neither". | 14:23 |
| patri0t | soren: Cool, then do you have any diag for Nova? | 14:24 |
| * soren doesn't even know what a "cloud controller" is | 14:24 | |
| patri0t | soren: :D, probably should be RabbitMQ | 14:24 |
| *** bcwaldon has joined #openstack | 14:24 | |
| soren | That would be a very, very odd. | 14:25 |
| soren | s/ a / /G | 14:25 |
| soren | s/G/g/ | 14:25 |
| * soren fails at typing today | 14:26 | |
| patri0t | soren: even this one: http://nova.openstack.org/_images/fabric.png | 14:28 |
| *** Ryan_Lane has joined #openstack | 14:28 | |
| *** adiantum has quit IRC | 14:29 | |
| soren | patri0t: I like that last one. | 14:30 |
| soren | patri0t: There are so few details that the amount of wrong information is very small. | 14:30 |
| patri0t | soren: that is also the problem | 14:30 |
| patri0t | soren: what is between object store and API endpoint in the last one? | 14:31 |
| soren | patri0t: What exactly are you trying to find out? | 14:31 |
| patri0t | Nova architecture | 14:31 |
| soren | Can you phrase it as a question? | 14:32 |
| soren | :) | 14:32 |
| patri0t | I'm looking for design details of Nova, and its architecture | 14:34 |
| *** adiantum has joined #openstack | 14:34 | |
| patri0t | soren: Do you have any more concrete details about Nova architecture? | 14:35 |
| *** ramkrsna has quit IRC | 14:36 | |
| patri0t | soren: Can you explain what is wrong in those diags, so I can update them, Or should I start reading the code to find it out? | 14:36 |
| *** gasbakid has quit IRC | 14:38 | |
| *** GasbaKid has joined #openstack | 14:39 | |
| *** pvo has quit IRC | 14:40 | |
| *** gondoi has joined #openstack | 14:42 | |
| *** hub_cap has joined #openstack | 14:44 | |
| ttx | soren: how so ? | 14:53 |
| *** m_3 has quit IRC | 14:54 | |
| *** adiantum has quit IRC | 14:55 | |
| *** m_3 has joined #openstack | 14:55 | |
| *** GasbaKid has quit IRC | 14:56 | |
| *** adiantum has joined #openstack | 14:59 | |
| soren | ttx: Seems to be an environmental oddity. | 14:59 |
| *** kashyap has joined #openstack | 14:59 | |
| soren | ttx: Or something. I don't quite understand. | 14:59 |
| * ttx will have a shot at the Nova architecture diagram for a presentation soon. I think I'll make it three-dimensional for clarity. | 15:01 | |
| uvirtbot | New bug: #726569 in nova "gzip content encoding" [Undecided,New] https://launchpad.net/bugs/726569 | 15:01 |
| *** rnirmal has joined #openstack | 15:01 | |
| doude | Hi, what's the objectif of the iptables rules in FORWARD table juste after 'nova-local' which authorize flow form/to the bridge of a project ? (source in network/linux_net.py line 270-271 in bexar release) | 15:03 |
| soren | doude: It's so that traffic can pass through network nodes to compute nodes. | 15:04 |
| patri0t | ttx: good, when will it be? | 15:04 |
| soren | ttx: I can't work out what changed, but for some reason, patches in debian/patches no longer get applied automatically. | 15:07 |
| ttx | patri0t: end of March | 15:14 |
| ttx | oh, right | 15:14 |
| ttx | soren: the nova-manage needs to be refreshed. I did that in my local packaging | 15:14 |
| ttx | nova-manage patch* | 15:14 |
| doude | soren: But the policy of FORWARD table is accept and the policy of the 2 rules are also accept, so what's the interest ? | 15:16 |
| ttx | soren: current natty/trunk packaging branch probably has the new version of the patch. | 15:17 |
| *** dendrobates is now known as dendro-afk | 15:22 | |
| *** patcoll has joined #openstack | 15:23 | |
| *** dragondm has joined #openstack | 15:33 | |
| *** adiantum has quit IRC | 15:37 | |
| *** reldan has quit IRC | 15:42 | |
| *** adiantum has joined #openstack | 15:43 | |
| *** hub_cap has quit IRC | 15:49 | |
| *** pvo has joined #openstack | 15:49 | |
| *** sateesh has joined #openstack | 15:50 | |
| *** reldan has joined #openstack | 15:54 | |
| annegentle | uksysadmin: are you around? I have a question about your virtualbox instructions. For me, when I run sudo nova-manage service list, the nova-api service is not listed. Is that intentional? | 15:55 |
| uksysadmin | yeah I'm here | 15:55 |
| uksysadmin | I've never ran that set of commands :-S... where you running it from - the node that has everything on, or a compute node? | 15:56 |
| *** dprince has quit IRC | 15:56 | |
| annegentle | uksysadmin: I'm trying to install all-in-one, maybe that's not the use case? | 15:57 |
| *** naehring has quit IRC | 15:57 | |
| annegentle | uksysadmin: and I run it on thenode that I ran the script on, during the post-config steps | 15:57 |
| annegentle | uksysadmin: could be a nova bug, that service list command was just introduced | 15:57 |
| annegentle | uksysadmin: last release | 15:58 |
| *** hub_cap has joined #openstack | 15:58 | |
| DigitalFlux | annegentle: uksysadmin | 15:58 |
| DigitalFlux | Wow, Nova supports VirtualBox now ?! | 15:58 |
| *** adiantum has quit IRC | 15:59 | |
| uksysadmin | erm... not really | 15:59 |
| annegentle | DigitalFlux: well it's a nice demo enviornment for installing nova within, http://wiki.openstack.org/NovaVirtually | 15:59 |
| soren | doude: We don't set the default policy. | 15:59 |
| uksysadmin | (as a hypervisor) | 15:59 |
| DigitalFlux | annegentle: Ah this one | 15:59 |
| soren | doude: So it could be anything. | 15:59 |
| uksysadmin | but for a test environment it works great | 16:00 |
| DigitalFlux | annegentle: I thought that VirtualBox can actually be the Hypervisor | 16:00 |
| soren | doude: We try pretty hard not to interfere with whatever rules are already set on the system. | 16:00 |
| uksysadmin | annegentle: I'll have a play | 16:00 |
| uksysadmin | to confirm | 16:00 |
| uksysadmin | the code is waiting for a merge and tlc according to the developer | 16:00 |
| *** DigitalFlux has quit IRC | 16:01 | |
| annegentle | uksysadmin: ok, thank you | 16:02 |
| soren | ttx: I'll get those tests running today. I'll let you know when they're rolling. | 16:02 |
| * soren wanders off | 16:02 | |
| *** troytoman-away is now known as troytoman | 16:04 | |
| *** blueadept has joined #openstack | 16:04 | |
| *** mgoldmann has quit IRC | 16:05 | |
| annegentle | uksysadmin: I'm a junior, deputy, junior sysadmin. Very junior. :) So it's possible I'm missing something. It seems to be working anyhow. | 16:05 |
| *** hazmat has quit IRC | 16:05 | |
| *** johnpur has joined #openstack | 16:06 | |
| *** ChanServ sets mode: +v johnpur | 16:06 | |
| *** ccustine has joined #openstack | 16:07 | |
| *** mahadev has joined #openstack | 16:07 | |
| *** adiantum has joined #openstack | 16:11 | |
| *** mahadev has quit IRC | 16:11 | |
| *** dprince has joined #openstack | 16:14 | |
| *** mahadev has joined #openstack | 16:15 | |
| *** lvaughn has quit IRC | 16:15 | |
| *** adiantum has quit IRC | 16:21 | |
| *** sateesh has quit IRC | 16:21 | |
| *** clauden_ has joined #openstack | 16:25 | |
| *** adiantum has joined #openstack | 16:26 | |
| *** dprince has quit IRC | 16:26 | |
| *** skiold has quit IRC | 16:27 | |
| *** lamar has joined #openstack | 16:29 | |
| *** dprince has joined #openstack | 16:29 | |
| *** j05h has left #openstack | 16:32 | |
| *** j05h has joined #openstack | 16:34 | |
| *** kashyap has quit IRC | 16:34 | |
| *** adiantum has quit IRC | 16:36 | |
| *** KenD has joined #openstack | 16:36 | |
| *** viirya has quit IRC | 16:37 | |
| *** dendro-afk is now known as dendrobates | 16:38 | |
| *** adiantum has joined #openstack | 16:42 | |
| *** bcwaldon has quit IRC | 16:44 | |
| doude | soren: ok, thanks for the explanation. I forget that's not Nova set the policy | 16:44 |
| kim0 | howdy openstack hackers o/ .. I'd like to invite you to register a session at the very first Ubuntu Cloud Days event → https://wiki.ubuntu.com/UbuntuCloudDays/ | 16:48 |
| kim0 | Rocking the Ubuntu cloud scene :) | 16:48 |
| *** daveiw has quit IRC | 16:49 | |
| *** kashyap has joined #openstack | 16:50 | |
| *** Pentheus has quit IRC | 16:56 | |
| *** adiantum has quit IRC | 16:57 | |
| *** KenD has quit IRC | 16:57 | |
| *** adiantum has joined #openstack | 16:58 | |
| *** hazmat has joined #openstack | 16:58 | |
| *** maplebed has joined #openstack | 17:00 | |
| *** pvo has quit IRC | 17:02 | |
| *** bobya has quit IRC | 17:03 | |
| ttx | vishy, berendt: if one of you could post a simple way to reproduce bug 713430 (on the bug), I could use it for 2011.1.1 validation | 17:05 |
| uvirtbot | Launchpad bug 713430 in nova/bexar "Restart of nova-volume with volumes in wrong state: global name 'volume_ref' is not defined" [High,Fix committed] https://launchpad.net/bugs/713430 | 17:05 |
| *** imsplitbit has joined #openstack | 17:11 | |
| *** uksysadmin has quit IRC | 17:12 | |
| *** hazmat has quit IRC | 17:14 | |
| *** rcc has joined #openstack | 17:15 | |
| *** adiantum has quit IRC | 17:17 | |
| ironcamel2 | any core devs around? this branch has been approved and is ready to be merged https://code.launchpad.net/~ironcamel/nova/openstack-api-hostid/+merge/50200 | 17:18 |
| *** mdomsch has joined #openstack | 17:19 | |
| *** maple_bed has joined #openstack | 17:21 | |
| *** maplebed has quit IRC | 17:21 | |
| justinsb | ironcamel2: Not a core dev, but I just took a quick look because I wasn't familiar with the patch. Did you mean "if inst['host']:" or "if inst.get('host'):" ? I've made this mistake too many times myself now! | 17:21 |
| *** KenD has joined #openstack | 17:22 | |
| ironcamel2 | justinsb: i believe 'host' should always be available | 17:23 |
| *** mahadev has quit IRC | 17:23 | |
| ironcamel2 | justinsb: is that not a safe assumption? | 17:23 |
| ironcamel2 | isn't it defined at the data model layer | 17:23 |
| ironcamel2 | yeah, it's in models.py | 17:24 |
| justinsb | ironcamel2: Just wanted to be sure you were sure! | 17:24 |
| ironcamel2 | justinsb: thanks :) | 17:24 |
| *** KenD has quit IRC | 17:24 | |
| sirp- | nova-core: we officially have +2 on https://code.launchpad.net/~rconradharris/nova/xs-unified-images/+merge/50102; anyone object to me marking it as Approved? | 17:26 |
| *** rcc has quit IRC | 17:28 | |
| *** maple_bed is now known as maplebed | 17:28 | |
| *** adiantum has joined #openstack | 17:29 | |
| *** gregp76 has joined #openstack | 17:29 | |
| *** bcwaldon has joined #openstack | 17:35 | |
| *** ewindisch has joined #openstack | 17:37 | |
| *** jaypipes has joined #openstack | 17:39 | |
| *** kbringard has joined #openstack | 17:40 | |
| openstackhudson | Project nova build #588: SUCCESS in 1 min 55 sec: http://hudson.openstack.org/job/nova/588/ | 17:43 |
| openstackhudson | Tarmac: Adds VHD build support for XenServer driver. | 17:43 |
| openstackhudson | * Adds new ImageType DISK_VHD | 17:43 |
| openstackhudson | * Adds determine_disk_image_type which uses Glance `type` to figure out whether an image is a VHD or not | 17:43 |
| openstackhudson | * Adds code to Glance XenServer plugin to handle downloading a VHD and depositing it into the Storage Repository | 17:43 |
| openstackhudson | * Modifies the remove_kernel_ramdisk code to account for RAW and VHD images | 17:43 |
| openstackhudson | * Adds to unit tests for determine_disk_image_type and basic test for spawning a VHD image | 17:43 |
| openstackhudson | Notes: | 17:43 |
| openstackhudson | Currently Nova'a Compute-API makes use of FLAGS.null_kernel ('nokernel') to determine whether an image is "RAW/VHD"-ish. I've left that requirement in for now; however, I plan on adding a bug to make that optional. | 17:43 |
| openstackhudson | Requires Glance patch https://code.launchpad.net/~rconradharris/glance/bug720459/+merge/50098 | 17:43 |
| kbringard | speaking of Glance... if I want to launch a VM with the kernel and ramdisk all in the image, I have to use Glance at this point, correct? | 17:46 |
| *** adiantum has quit IRC | 17:48 | |
| *** mahadev has joined #openstack | 17:48 | |
| kbringard | or, perhaps I have to use the OpenStack API to launch them? | 17:49 |
| sirp- | kbringard: not sure if it's the *only* way at this point, but you can certainly use the OSAPI+Glance to do it | 17:50 |
| kbringard | OK cool... I'm thinking the EC2 api just doesn't support it at this point, since it requires coupling a kernel and image | 17:51 |
| kbringard | or I should say, it *appears* to require coupling them | 17:52 |
| *** Ryan_Lane has quit IRC | 17:53 | |
| *** joearnold has joined #openstack | 17:57 | |
| *** ramkrsna has joined #openstack | 17:58 | |
| *** ramkrsna has joined #openstack | 17:58 | |
| *** adiantum has joined #openstack | 18:00 | |
| jaypipes | sirp-: not sure if you noticed, but I proposed a branch for merging into Glance that adds POST/PUT support for the Swift backend. | 18:04 |
| *** pvo has joined #openstack | 18:05 | |
| sirp- | jaypipes: yep saw that, catching up on Glance reviews, should get to that shortly :) | 18:05 |
| jaypipes | sirp-: cool, no worries. in jury duty this week, so off and on from IRC... in the jury sequester room right now, even though have yet to be placed into a trial. | 18:06 |
| uvirtbot | New bug: #726685 in glance "Image_properties 'key' column collides with SQL KEY keyword" [Undecided,New] https://launchpad.net/bugs/726685 | 18:06 |
| *** gondoi_ has joined #openstack | 18:06 | |
| *** piken has joined #openstack | 18:06 | |
| *** h0cin has joined #openstack | 18:07 | |
| *** gondoi has quit IRC | 18:09 | |
| *** gondoi_ is now known as gondoi | 18:09 | |
| *** ewindisch has quit IRC | 18:11 | |
| *** dw_jhake has joined #openstack | 18:11 | |
| *** dragondm has quit IRC | 18:16 | |
| *** dendrobates is now known as dendro-afk | 18:28 | |
| *** mahadev_ has joined #openstack | 18:33 | |
| *** Nacx has quit IRC | 18:33 | |
| *** mahadev has quit IRC | 18:35 | |
| *** gregp76_ has joined #openstack | 18:36 | |
| *** bcwaldon has quit IRC | 18:36 | |
| *** dendro-afk is now known as dendrobates | 18:36 | |
| uvirtbot | New bug: #726700 in glance "glance-manage doesn't use config file" [Undecided,New] https://launchpad.net/bugs/726700 | 18:36 |
| *** bcwaldon has joined #openstack | 18:37 | |
| *** jaypipes has quit IRC | 18:38 | |
| *** etet has joined #openstack | 18:39 | |
| *** dysinger has joined #openstack | 18:39 | |
| *** gregp76 has quit IRC | 18:39 | |
| *** joearnol_ has joined #openstack | 18:39 | |
| *** joearnold has quit IRC | 18:40 | |
| *** rds__ has joined #openstack | 18:40 | |
| *** DigitalFlux has joined #openstack | 18:42 | |
| *** hvaldivia has joined #openstack | 18:43 | |
| hvaldivia | Hi everybody. | 18:43 |
| *** markwash has joined #openstack | 18:45 | |
| *** KenD has joined #openstack | 18:46 | |
| hvaldivia | How can I set up my cloud for assigning ip from a DHCP Server?. I am not the network administrator and I can't grab a range of IP in my network. | 18:47 |
| *** iammartian has joined #openstack | 18:47 | |
| *** syah has quit IRC | 18:47 | |
| *** joearnol_ has quit IRC | 18:48 | |
| hvaldivia | Following this tutorial https://help.ubuntu.com/10.04/serverguide/C/libvirt.html , I could create a VM using KVM and I remember that the VM can grab an IP from the DHCP Server. | 18:49 |
| *** reldan has quit IRC | 18:49 | |
| *** KyleM1 has joined #openstack | 18:50 | |
| hvaldivia | Can I do this using nova? | 18:50 |
| *** adiantum has quit IRC | 18:54 | |
| *** dw_jhake has quit IRC | 18:54 | |
| *** syah has joined #openstack | 18:55 | |
| *** adiantum has joined #openstack | 18:56 | |
| *** dragondm has joined #openstack | 18:59 | |
| *** dragondm has quit IRC | 19:01 | |
| *** dragondm has joined #openstack | 19:01 | |
| *** hub_cap_ has joined #openstack | 19:02 | |
| *** mahadev_ has quit IRC | 19:03 | |
| openstackhudson | Project nova build #589: SUCCESS in 1 min 49 sec: http://hudson.openstack.org/job/nova/589/ | 19:03 |
| openstackhudson | Tarmac: Wrapped the instance_types comparison with an int and added a test case for it. Removed the inadvertently added newline | 19:03 |
| annegentle | hvaldivia: yes, you can configure nova networking to be FlatDHCP - let me find a link for you, just a sec | 19:03 |
| *** mahadev has joined #openstack | 19:03 | |
| *** hub_cap has quit IRC | 19:04 | |
| *** hub_cap_ is now known as hub_cap | 19:04 | |
| *** bcwaldon_ has joined #openstack | 19:04 | |
| annegentle | hvaldivia: See http://docs.openstack.org/openstack-compute/admin/content/ch04.html | 19:04 |
| *** hub_cap has joined #openstack | 19:04 | |
| hvaldivia | annegentle: Thanks, I have problems understanding the network configuration, the ranges, etc | 19:05 |
| annegentle | hvaldivia: I know, sorry it's not diagrammed or explained with an image. | 19:06 |
| hvaldivia | annegentle: What does --flat_network_dhcp_start mean? | 19:06 |
| *** bcwaldon has quit IRC | 19:07 | |
| *** reldan has joined #openstack | 19:09 | |
| annegentle | hvaldivia: that's an entry in the nova.conf flags file - see http://wiki.openstack.org/FlagsGrouping for all of them | 19:10 |
| annegentle | basically it's the IP address for starting the list of DHCP IPs | 19:10 |
| annegentle | that nova hands out? injects? Not sure of the right verb | 19:10 |
| vishy | kbringard: no | 19:11 |
| annegentle | hvaldivia: vishy is a great resource | 19:11 |
| vishy | kbringard: you can launch whole images through ec2 with objectstore | 19:11 |
| annegentle | hey, there you are :) | 19:11 |
| kbringard | vishy: oh, that is awesome | 19:12 |
| kbringard | when I bundle it, I just don't give it a kernel and a ramdisk? | 19:12 |
| hvaldivia | annegentle: Thank you :) | 19:12 |
| vishy | kbringard: I'm not sure exactly how it works using bundling because I usually create mine manually | 19:12 |
| kbringard | ah, OK... I looked around a bit and didn't see anything... is there documentation for the preferred way to do it? | 19:13 |
| vishy | but if you launch an instance that has no kernel and ramdisk in the info.json | 19:13 |
| vishy | it will boot as a whole disk | 19:13 |
| kbringard | ah, OK, that is good to know | 19:14 |
| vishy | i believe euca-bundle will grab kernel and ramdisk values out of metadata | 19:14 |
| kbringard | I'll play with it then | 19:14 |
| vishy | so you might end up with an image that has them set by accident | 19:14 |
| vishy | kbringard: if you pass in --kernel nokernel it will always try to boot without kernel | 19:15 |
| *** adiantum has quit IRC | 19:15 | |
| kbringard | ah, perfect | 19:15 |
| kbringard | this is why vishy is the man :-) | 19:15 |
| vishy | kbringargd: imo --kernel nokernel should actually be in euca-upload-bundle to always create without a kernel | 19:15 |
| vishy | and not in run instance but it hasn't been moved yet | 19:16 |
| vishy | hvaldivia: using external dhcp is a little bit tricky | 19:16 |
| *** reldan has quit IRC | 19:16 | |
| vishy | hvaldivia: there isn't really a way for the cloud to know what address was assigned to the instance | 19:17 |
| vishy | hvaldivia: that said, if you come up with some sort of magic dns, you might be able to get it to work | 19:17 |
| vishy | hvaldiva: metadata won't work though, so you'll have to rely on key injection into the image most likely | 19:18 |
| hvaldivia | Vishy. If I understood, OpenStack needs to have a range of ip available for its use. | 19:21 |
| vishy | hvaldivia: it needs a private range of ips | 19:22 |
| hvaldivia | I want to connect to a VM from outside (through internet) | 19:22 |
| vishy | hvaldivia: and optionally a public range | 19:22 |
| vishy | hvaldivia: yes you need a public range for that | 19:23 |
| vishy | hvaldiva: well actually you need 1 or more public ips, it doesn't have to be a range specifically | 19:23 |
| *** gregp76 has joined #openstack | 19:24 | |
| *** matclayton has left #openstack | 19:24 | |
| *** nelson has quit IRC | 19:25 | |
| *** nelson has joined #openstack | 19:26 | |
| hvaldivia | vishy: interesting. But I need to specify these IPs in advance. Am I right? | 19:26 |
| vishy | hvaldivia: correct | 19:26 |
| hvaldivia | Okey. So I should talk with my network admin to reserve ips for my openstack installation. right? | 19:27 |
| *** adiantum has joined #openstack | 19:28 | |
| vishy | hvaldivia: correct | 19:28 |
| *** MarcMorata has quit IRC | 19:28 | |
| vishy | havldivia: they will be associated with the network host when they are used | 19:29 |
| vishy | hvaldivia: they are natted to the vms through the network host | 19:29 |
| hvaldivia | vishy: thanks, now I can understand a little how nova works. | 19:30 |
| hvaldivia | vishy: I have 4 instances running on my cloud. their ips are: 10.0.0.x. but I can only connect to them from my cloud controller. How can I connect to them from the other machines in my network? | 19:33 |
| *** joearnold has joined #openstack | 19:33 | |
| vishy | there are a few options, but probably the easiest is to add a route to your other boxes | 19:34 |
| vishy | route add -net 10.0.0.0/8 gw <ip of your network host> | 19:34 |
| vishy | you could also use a smaller range, if you need other parts of the 10.x for other services etc. | 19:35 |
| vishy | hvaldivia: one warning though | 19:35 |
| *** clauden_ has quit IRC | 19:35 | |
| vishy | hvaldivia: if you add a route like that, the instance firewall will block traffic | 19:35 |
| *** joearnold has quit IRC | 19:36 | |
| vishy | hvaldivia: so you will need to add specific exceptions for services: euca-authorize -P tcp -p 22 default | 19:36 |
| hvaldivia | vishy: What should I do in that case? | 19:36 |
| hvaldivia | I did. | 19:36 |
| vishy | the above would authorize ssh for example | 19:37 |
| vishy | you can also just add rules from your specific range | 19:37 |
| vishy | hvaldivia: a secondary option would be to give all of your hosts an ip in the subnet used by your private ips | 19:37 |
| vishy | (although if you do that, you should mark those ips reserved in your fixed_ips table so that nova doesn't try to give them out | 19:38 |
| *** hub_cap has quit IRC | 19:38 | |
| hvaldivia | vishy: Do You mean that my hosts ips should be set to 10.0.0.x for example | 19:40 |
| vishy | hvaldivia: I mean that you can give your hosts a secondary ip that is that | 19:42 |
| vishy | hvaldivia: which networking mode are you using? Vlan (the default) or FlatDHCP? | 19:43 |
| *** adiantum has quit IRC | 19:44 | |
| hvaldivia | Last week I used a Flat configuration. Now I am using Vlan (default) | 19:45 |
| hvaldivia | When should I use FlatDHCP? any advangate over Flat? | 19:46 |
| kbringard | it lets OpenStack manage the IPs, so you can get IP info for the VMs straight from the API without having to do weird workarounds | 19:49 |
| *** adiantum has joined #openstack | 19:49 | |
| *** neckwarmer has joined #openstack | 19:51 | |
| *** mgoldmann has joined #openstack | 19:51 | |
| uvirtbot | New bug: #726742 in glance "Producing useless traceback info" [Undecided,New] https://launchpad.net/bugs/726742 | 19:52 |
| *** reldan has joined #openstack | 19:55 | |
| *** brd_from_italy has joined #openstack | 19:55 | |
| vishy | hvaldivia: yes Flat doesn't support a lot of features like metadata out of the box and it requires network injection into the instance | 19:55 |
| hvaldivia | vishy: well I will to FlatDHCP. | 19:57 |
| hvaldivia | I do not have access to my switch for creating vlans | 19:58 |
| *** photron has joined #openstack | 19:58 | |
| vishy | so in FlatDHCP mode, you will have a bridge (by default it is br100) bridged into your interface | 19:59 |
| vishy | you can give each host an (additional) ip on that bridge | 19:59 |
| vishy | in the 10.x range | 19:59 |
| vishy | if you want them to talk to vms | 19:59 |
| vishy | to talk from separate L2 networks, you will need to add routes as i mentioned in option 1 | 20:00 |
| *** adiantum has quit IRC | 20:01 | |
| hvaldivia | vishy: I understand what you say, but I do not how to " give each host an (additional) ip on that bridg". I am feel as a moron | 20:03 |
| *** Ryan_Lane has joined #openstack | 20:04 | |
| *** DigitalFlux has quit IRC | 20:07 | |
| *** ramkrsna has quit IRC | 20:07 | |
| *** adiantum has joined #openstack | 20:07 | |
| *** DigitalFlux has joined #openstack | 20:07 | |
| vishy | ip addr add 10.0.0.241 scope global dev br100 | 20:08 |
| vishy | actually perhaps 10.0.0.241/24 depending on how big the network you created | 20:08 |
| vishy | is | 20:08 |
| *** gondoi has quit IRC | 20:09 | |
| *** bcwaldon_ has quit IRC | 20:10 | |
| *** joearnold has joined #openstack | 20:12 | |
| *** h0cin has quit IRC | 20:12 | |
| *** MarcMorata has joined #openstack | 20:15 | |
| kbringard | vishy: will nova take an "all in one" image that's qcow2? | 20:18 |
| kbringard | by all in one, I mean the kernel, ramdisk, etc | 20:18 |
| *** hvaldivia has quit IRC | 20:21 | |
| *** bcwaldon has joined #openstack | 20:22 | |
| zul | vishy: hey i hope those instructions on the wiki make sense | 20:22 |
| vishy | zul: thanks appreciate it | 20:24 |
| vishy | kbringard: I think so | 20:24 |
| vishy | kbringard: i | 20:24 |
| *** reldan has quit IRC | 20:24 | |
| vishy | "think" that you can do cow backing to another qcow2, but I'm not totally sure | 20:25 |
| vishy | kbringard: it would definitely work with --nouse_cow_images | 20:25 |
| kbringard | cool, I didn't think it would matter, but the docs kept referring to "raw disk images", so I wasn't sure if that meant the actual format, or if it was a misnomer referring to no longer needing a separate kernel and ramdisk | 20:25 |
| uvirtbot | New bug: #726763 in nova "negative api offsets" [Undecided,In progress] https://launchpad.net/bugs/726763 | 20:26 |
| *** MarcMorata has quit IRC | 20:26 | |
| vishy | kbringard: misnomer, although raw might be best for compatibility (same images with xen and kvm) although I don't think it would matter for most deployments | 20:26 |
| *** reldan has joined #openstack | 20:27 | |
| annegentle | kbringard: ah good point. | 20:27 |
| kbringard | cool, I'll probably start with raw to get rid of excess complexity, then once I determine everything is working, I'll try other formats | 20:27 |
| kbringard | annegentle: it's not a super big deal, just wanted to make sure I understood what I could and couldn't do :-) | 20:27 |
| kbringard | more than anything I'm just getting tired of moving 10GB files all over the place | 20:28 |
| kbringard | even over gig, it still takes awhile ;-) | 20:28 |
| vishy | kbringard: yeah it is kinda slow :) | 20:29 |
| *** bradshaw has joined #openstack | 20:29 | |
| bradshaw | Happy Monday to all, We are working on expanding out our nova-network servers, but are having a terrible time with SNAT and the 169.254.169.254 address for metadata service. Does anyone have a "reasonable" solution cause right now we are white boarding some stuff that seems way to complex to solve this? | 20:32 |
| bradshaw | the issue we are seeing is that the rewrite that turns 169.252.169.254 into a real IP is happening just fine, but then the NAT rule rewrites the original 10net VM address to the external IP of the nova-network | 20:37 |
| devcamcar | hey all, anyone here have luck using cyberduck with swift? | 20:41 |
| devcamcar | i can't get it to validate my credentials | 20:41 |
| devcamcar | creiht, notmyname, gholt: ^^ | 20:41 |
| * creiht doesn't have a mac or windows, but have heard it works | 20:42 | |
| devcamcar | yea it looks like it should work | 20:42 |
| devcamcar | it has only a username field | 20:42 |
| devcamcar | so i'm assuming project:user format | 20:42 |
| notmyname | I think there was a wiki page | 20:42 |
| devcamcar | notmyname: thanks, i'll do some more digging | 20:43 |
| annegentle | devcamcar: I never could get it to validate either. | 20:43 |
| notmyname | ya, username should be account:name | 20:43 |
| notmyname | (in the context of a swift dev auth/swauth account) | 20:44 |
| devcamcar | yea thats what i would think | 20:44 |
| annegentle | devcamcar: I did a write up here: http://docs.openstack.org/openstack-object-storage/admin/content/ch05s01.html | 20:44 |
| *** gondoi has joined #openstack | 20:44 | |
| creiht | devcamcar: which instructions are you using to connect? | 20:44 |
| devcamcar | annegentle: thanks | 20:45 |
| notmyname | hmm..I get an SSL error (cause I'm not using SSL) | 20:45 |
| devcamcar | creiht: just started poking at this, but just using instructs in cyberduck | 20:45 |
| *** gondoi has quit IRC | 20:45 | |
| devcamcar | annegentle: "If you are using swauth for authorization, you want to change the context of the URL from the default /v1.0 by using defaults write ch.sudo.cyberduck cf.authentication.context <string> and substitute /auth/v1.0." | 20:45 |
| devcamcar | this looks relevant, but does that change it globally? | 20:45 |
| devcamcar | seems like you'd want to set that per connection | 20:46 |
| *** adiantum has quit IRC | 20:46 | |
| annegentle | devcamcar: yeah I think that's part of the problem, why I couldn't get it working | 20:46 |
| annegentle | devcamcar: I haven't dug into a way to do a per-connection context string config | 20:48 |
| annegentle | ctennis: any ideas? ^^ | 20:48 |
| devcamcar | hah, ouch! official docs say to modify cyberduck's source and recompile :) http://swift.openstack.org/howto_cyberduck.html | 20:49 |
| creiht | heh... that's a bit out dated | 20:49 |
| annegentle | hee. | 20:49 |
| creiht | devcamcar: http://trac.cyberduck.ch/wiki/help/en/howto/openstack | 20:49 |
| *** adiantum has joined #openstack | 20:51 | |
| annegentle | general cloudy question: Do people always use the same hypervisor once they get one working? Or would a given cloud provider use multiple hypervisors? | 20:51 |
| * creiht tries to install under wine | 20:51 | |
| annegentle | I suppose if you're a Windows/Linux VM provider, you have to use 2 hypervisors at a minimum, right? | 20:52 |
| creiht | oh... it uses .net :( | 20:52 |
| vishy | ttx, soren, mtaylor: looks like we need the new libvirt (from natty) in the ppa to support lxc | 20:52 |
| devcamcar | annegentle: not necessarily | 20:52 |
| *** paltman has quit IRC | 20:53 | |
| devcamcar | creiht, annegentle: i tried setting the global defaults for the auth prefix, but still didn't work. my assumption is that cyberduck is built with support for devauth but not swauth, or something like that | 20:53 |
| devcamcar | still seems like setting that value should have fixed it but who knows | 20:53 |
| creiht | hrm | 20:53 |
| devcamcar | anyway not the end of the world, i just wanted to see if it worked | 20:53 |
| annegentle | devcamcar: ok, asking so that I can organize the guide best... networking and hypervisors seem like big decisions, each worthy of their own config chapter | 20:54 |
| soren | vishy: If mtaylor doesn't beat me to it, I'll get it done tomorrow. | 20:54 |
| annegentle | devcamcar: and I'd like to figure out the Cyberduck config to document it more clearly, so thanks for trying it | 20:55 |
| devcamcar | annegentle: xen supports windows guests, kvm does to with some handholding | 20:55 |
| annegentle | devcamcar: ah, okay. | 20:55 |
| devcamcar | annegentle: i'm going to file a bug with cyberduck | 20:55 |
| vishy | soren: cool thx | 20:55 |
| devcamcar | annegentle: even though the hypervisor supports it, you still have to configure separate zones for windows/linux | 20:55 |
| annegentle | devcamcar: ah, okay | 20:56 |
| *** hvaldivia has joined #openstack | 20:56 | |
| devcamcar | annegentle: ultimately its up to the scheduler to figure that out, and will require zones to define via metadata what guest types they support | 20:56 |
| *** adiantum has quit IRC | 20:57 | |
| *** paltman has joined #openstack | 20:59 | |
| annegentle | devcamcar: is there more than one scheduler_manager option? | 21:01 |
| devcamcar | annegentle: i think there are blueprints for this, the metadata stuff doesn't exist yet | 21:02 |
| devcamcar | creiht, notmyname: swauth was introduced in swift 1.2, correct? | 21:02 |
| annegentle | devcamcar: ok, got it. thanks for the help | 21:02 |
| *** mdomsch has quit IRC | 21:03 | |
| *** adiantum has joined #openstack | 21:03 | |
| notmyname | devcamcar: yes | 21:04 |
| *** gregp76 has quit IRC | 21:05 | |
| *** grapex1 has joined #openstack | 21:05 | |
| devcamcar | creiht, notmyname, annegentle: http://trac.cyberduck.ch/ticket/5735 | 21:06 |
| devcamcar | hopefully we'll get some help on it :) | 21:07 |
| *** viirya has joined #openstack | 21:08 | |
| *** dfg has joined #openstack | 21:08 | |
| notmyname | devcamcar: thanks. the cyberduck dev is pretty good about being on top of bugs/features | 21:08 |
| devcamcar | awesome | 21:08 |
| *** hvaldivia has quit IRC | 21:11 | |
| *** grapex1 has left #openstack | 21:12 | |
| notmyname | of course, watch this time he'll take weeks to get to it ;-) | 21:14 |
| *** adiantum has quit IRC | 21:17 | |
| *** miclorb has joined #openstack | 21:21 | |
| *** ctennis has quit IRC | 21:21 | |
| *** adiantum has joined #openstack | 21:23 | |
| *** DigitalFlux has quit IRC | 21:28 | |
| *** DigitalFlux has joined #openstack | 21:30 | |
| *** DigitalFlux has joined #openstack | 21:30 | |
| *** glange has left #openstack | 21:31 | |
| *** adiantum has quit IRC | 21:31 | |
| *** dprince has quit IRC | 21:32 | |
| *** brd_from_italy has quit IRC | 21:32 | |
| *** gregp76 has joined #openstack | 21:34 | |
| *** photron has quit IRC | 21:35 | |
| *** DigitalFlux has quit IRC | 21:35 | |
| *** ctennis has joined #openstack | 21:36 | |
| *** ctennis has joined #openstack | 21:36 | |
| *** adiantum has joined #openstack | 21:36 | |
| *** adiantum has quit IRC | 21:44 | |
| *** adiantum has joined #openstack | 21:50 | |
| *** lvaughn has joined #openstack | 21:51 | |
| *** dirakx has quit IRC | 21:53 | |
| *** allsystemsarego has quit IRC | 21:57 | |
| *** gregp76 has quit IRC | 21:58 | |
| devcamcar | creiht, notmyname: having some odd authentication issues with a swift account i just created | 21:59 |
| *** bcwaldon has quit IRC | 22:00 | |
| devcamcar | this step works: curl -k -v -H 'X-Storage-User: system:root' -H 'X-Storage-Pass: testpass' https://<AUTH_HOSTNAME>:11000/v1.0 | 22:00 |
| devcamcar | this step dies: curl -k -v -H 'X-Auth-Token: <token-from-x-auth-token-above>' <url-from-x-storage-url-above> | 22:00 |
| devcamcar | gives a 403 and i can't figure out why | 22:00 |
| devcamcar | any ideas on how i can debug? | 22:00 |
| creiht | devcamcar: did you create the account as an admin? otherwise it has no perms until you grant them | 22:02 |
| notmyname | did you add that user to the auth system with a "-a"? | 22:02 |
| creiht | hehe | 22:02 |
| devcamcar | argh yea thats it | 22:02 |
| devcamcar | thanks :) | 22:02 |
| devcamcar | one other strange thing i saw - | 22:02 |
| devcamcar | its storage service was set to http:// instead of https:// | 22:03 |
| notmyname | check the storage url in the config | 22:03 |
| *** reldan has quit IRC | 22:03 | |
| devcamcar | default_swift_cluster? | 22:04 |
| devcamcar | or something else | 22:04 |
| notmyname | default_swift_cluster | 22:04 |
| notmyname | yes | 22:04 |
| devcamcar | yea i have both public and private urls set there | 22:04 |
| devcamcar | public is https | 22:04 |
| devcamcar | but they are different hostnames | 22:04 |
| devcamcar | so basically i have https://public and http://private | 22:05 |
| devcamcar | but it showed up as http://public | 22:05 |
| devcamcar | if that makes sense | 22:05 |
| notmyname | gholt: ^? I'm not an expert in swauth configs yet ;-) | 22:05 |
| *** hggdh has quit IRC | 22:05 | |
| devcamcar | notmyname: nevermind, i found it | 22:05 |
| notmyname | ah ok | 22:05 |
| notmyname | what was it? | 22:05 |
| devcamcar | devcamcar: for some reason chef-solo didn't update it properly | 22:05 |
| devcamcar | something else to fix now :) | 22:06 |
| notmyname | so what was the config like? | 22:06 |
| notmyname | s/like/line? | 22:06 |
| notmyname | you had http in both? | 22:07 |
| devcamcar | it was exactly that - i had http://public in the config instead of https://public, so swift did with that exactly what you'd expect | 22:07 |
| devcamcar | yea, just loser error on my end | 22:07 |
| notmyname | ah, ok. makes sense then | 22:08 |
| devcamcar | i'm just good enough with swift now to be really, really dangerous | 22:12 |
| notmyname | aren't we all? :-) | 22:13 |
| eday | creiht: whats the 30-second scoop on swift auth? I know there is the dev and swauth server, are both staying around long term? Any plans to split either into a standalone project for others to use? | 22:14 |
| notmyname | devcamcar: heh, just re-read what you said and my response. wasn't trying to say you were a loser. quite the opposite. mis-read on my part that made me respond with the wrong thing | 22:14 |
| eday | notmyname: or perhaps you can answer my q too :) | 22:15 |
| notmyname | eday: dev auth should be removed in diablo, swauth is staying around as a part of swift (middleware) | 22:15 |
| devcamcar | notmyname: hah, don't worry, that was my own interpretation :) | 22:15 |
| *** jwalters_ has joined #openstack | 22:16 | |
| *** mgoldmann has quit IRC | 22:17 | |
| jwalters_ | I'm getting an eventlet backtrace with the most recent version of nova, anyone have any thoughts?: http://go.pastie.org/1618530 | 22:17 |
| eday | notmyname: ok, thanks! so no plans to break it into it's own project with other backends? (ie, openstack-common with swauth, sql, ... drivers) | 22:17 |
| *** zul_ has joined #openstack | 22:17 | |
| sirp- | jwalters_: that's related to this: https://bitbucket.org/which_linden/eventlet/issue/77/subprocess-module-fails-if-os-module-is | 22:18 |
| notmyname | heh, swauth was a separate project that was merged into swift. no plans that I know of, but I'll be the first to say that I don't know all the plans | 22:18 |
| *** zul has quit IRC | 22:18 | |
| sirp- | jwalters_: you can go the ppa route, or like i did, just apply the included patch to eventlet | 22:18 |
| *** gregp76 has joined #openstack | 22:20 | |
| jwalters_ | thanks sirp, I'll give that patch a try | 22:20 |
| *** littleidea has joined #openstack | 22:20 | |
| creiht | eday: swauth is implemented as middleware backended by a swift cluster | 22:21 |
| creiht | so it kinda requires swift to be used | 22:21 |
| creiht | it could be extended if needed | 22:22 |
| *** blueadept has quit IRC | 22:22 | |
| creiht | not sure you really want to do that | 22:22 |
| eday | creiht: yeah, understood. but we could reuse some of that to power other backends as well | 22:22 |
| creiht | ahh... possibly | 22:22 |
| sirp- | paste.openstack.org is throwing 500's, anyone know who manages that? | 22:22 |
| eday | creiht: having a openstack-auth service is starting to make more sense, I don't want to make a one-off auth thing like nova and swift do for the queue service :) | 22:23 |
| *** bradshaw has left #openstack | 22:23 | |
| creiht | hehe | 22:23 |
| eday | creiht: and swauth is the closest thing we have right now, as nova-auth is very nova specific still | 22:23 |
| creiht | the only problem with that is that it requires a swift install to use | 22:24 |
| creiht | which may not be ideal | 22:24 |
| creiht | though if we can get a simpler (non-redundant) version of swift to use for dev/testing, that might be simpler | 22:24 |
| eday | creiht: right now, yes, but if we make the backends pluggable, a sqlite is just as easy to use | 22:24 |
| creiht | ahh | 22:24 |
| creiht | I'm not sure it is made in a way to be pluggable like that :) | 22:25 |
| eday | sure, certainly work to do | 22:25 |
| eday | any reason why you're removing the devauth server? seems useful for testing | 22:26 |
| creiht | eday: well dev auth is basically that :) | 22:26 |
| creiht | dev auth had some issues | 22:26 |
| creiht | mostly scaling | 22:27 |
| eday | heh, yeah :) | 22:27 |
| eday | but still useful for single-machine dev, no? or do you require swauth setup for dev now? | 22:27 |
| jk0 | who runs paste.openstack.org? getting a 500 | 22:27 |
| creiht | eday: yeah we will require swauth for dev | 22:28 |
| creiht | since in dev you have swift setup already :) | 22:28 |
| devcamcar | creiht, notmyname: can you point me to where you guys documented best practices for the amount of workers to run based on number of cores available? | 22:29 |
| eday | creiht: ahh, ok :) | 22:29 |
| creiht | eday: A better idea may be to have a simple reduced redundancy mode that requires only the main services running, and only stores one replica for stuff like that | 22:30 |
| creiht | We've talked about something like that to replace nova-objectstore | 22:30 |
| creiht | devcamcar: Not sure we have real hard numbers on that | 22:30 |
| *** adiantum has quit IRC | 22:31 | |
| creiht | devcamcar: a good starting point is a worker per core, then test and see where the bottle necks are :) | 22:31 |
| eday | creiht: yeah, perhaps. is there any docs on how reseller code works in swift? I see bits here and there, but not sure where it matters. is it basically a prefix that determines different auth service? | 22:33 |
| creiht | eday: more or less, yes | 22:33 |
| creiht | eday: http://swift.openstack.org/overview_auth.html | 22:34 |
| devcamcar | creiht: thanks, though in the past i remember you had more specific suggestions, like 4 workers per core for proxy/object/container, and like 1 for account or something. when we stood up our first swift test env i remember we went over that | 22:34 |
| *** vvuksan has quit IRC | 22:34 | |
| *** kbringard has quit IRC | 22:34 | |
| devcamcar | creiht: but i will experiment | 22:34 |
| eday | creiht: ahh, thanks. I read that, missed the reseller parts :) | 22:34 |
| creiht | eday: and http://swift.openstack.org/development_auth.html | 22:34 |
| *** adiantum has joined #openstack | 22:36 | |
| *** jwalters_ has quit IRC | 22:39 | |
| *** MarcMorata has joined #openstack | 22:40 | |
| *** imsplitbit has quit IRC | 22:44 | |
| *** MarcMorata has quit IRC | 22:50 | |
| *** mdomsch has joined #openstack | 22:52 | |
| *** ppetraki has quit IRC | 22:53 | |
| *** dubsquared has joined #openstack | 22:54 | |
| *** burris has quit IRC | 22:57 | |
| *** localhost3 has joined #openstack | 22:57 | |
| *** adiantum has quit IRC | 22:58 | |
| *** redbo_ has joined #openstack | 23:00 | |
| *** gdusbabe` has joined #openstack | 23:00 | |
| *** drico_ has joined #openstack | 23:01 | |
| *** magglass2 has joined #openstack | 23:01 | |
| *** flashn has joined #openstack | 23:01 | |
| *** gdusbabe` has quit IRC | 23:01 | |
| *** gdusbabe` has joined #openstack | 23:02 | |
| *** sandywalsh_ has joined #openstack | 23:02 | |
| *** iammartian_ has joined #openstack | 23:02 | |
| *** devcamcar_ has joined #openstack | 23:02 | |
| *** devcamcar has left #openstack | 23:02 | |
| *** devcamcar_ has left #openstack | 23:02 | |
| *** devcamcar has joined #openstack | 23:02 | |
| *** exlt_ has joined #openstack | 23:02 | |
| *** RichiH_ has joined #openstack | 23:03 | |
| *** huismon_ has joined #openstack | 23:03 | |
| *** JordanRi1ke has joined #openstack | 23:03 | |
| vishy | +1 for common auth | 23:04 |
| *** chmouel_ has joined #openstack | 23:04 | |
| vishy | authn and authz | 23:04 |
| *** soren_ has joined #openstack | 23:04 | |
| *** soren_ has quit IRC | 23:05 | |
| *** soren_ has joined #openstack | 23:05 | |
| *** ChanServ sets mode: +v soren_ | 23:05 | |
| *** lvaughn_ has joined #openstack | 23:06 | |
| *** soren has quit IRC | 23:07 | |
| *** soren_ is now known as soren | 23:07 | |
| *** zul_ has quit IRC | 23:08 | |
| *** lvaughn has quit IRC | 23:08 | |
| *** nelson has quit IRC | 23:08 | |
| *** iammartian has quit IRC | 23:08 | |
| *** patcoll has quit IRC | 23:08 | |
| *** deshantm has quit IRC | 23:08 | |
| *** zenmatt has quit IRC | 23:08 | |
| *** localhost2 has quit IRC | 23:08 | |
| *** RobertLaptop has quit IRC | 23:08 | |
| *** exlt has quit IRC | 23:08 | |
| *** arun_ has quit IRC | 23:08 | |
| *** Daviey has quit IRC | 23:08 | |
| *** fysa has quit IRC | 23:08 | |
| *** chmouel has quit IRC | 23:08 | |
| *** drico has quit IRC | 23:08 | |
| *** RichiH has quit IRC | 23:08 | |
| *** sandywalsh has quit IRC | 23:08 | |
| *** husimon has quit IRC | 23:08 | |
| *** ryker has quit IRC | 23:08 | |
| *** flashn_ has quit IRC | 23:08 | |
| *** filler has quit IRC | 23:08 | |
| *** magglass1 has quit IRC | 23:08 | |
| *** rackerhacker has quit IRC | 23:08 | |
| *** redbo has quit IRC | 23:08 | |
| *** dubs has quit IRC | 23:08 | |
| *** JordanRinke has quit IRC | 23:08 | |
| *** gdusbabek has quit IRC | 23:08 | |
| *** openfly has quit IRC | 23:08 | |
| *** iammartian_ is now known as iammartian | 23:08 | |
| *** joearnold has quit IRC | 23:08 | |
| *** markwash has quit IRC | 23:09 | |
| gholt | If any want to promote swauth to be some amazing common auth, I won't complain. But I don't personally have the time to make it all it could be (ldap hooks, oauth, w/e). It was just an idea, and it was just a weekend or so. :) | 23:09 |
| *** zul__ has joined #openstack | 23:10 | |
| *** hggdh has joined #openstack | 23:10 | |
| *** patcoll has joined #openstack | 23:10 | |
| vishy | gholt: does it do authz? | 23:11 |
| * vishy goes to find the code | 23:11 | |
| *** Daviey has joined #openstack | 23:11 | |
| *** adiantum has joined #openstack | 23:11 | |
| *** fysa has joined #openstack | 23:11 | |
| gholt | Hehe. I does both authentication and authorization yes. | 23:11 |
| gholt | I would give you a link real quick, but launchpad is not real quick. | 23:11 |
| gholt | http://bazaar.launchpad.net/~hudson-openstack/swift/trunk/view/head:/swift/common/middleware/swauth.py | 23:12 |
| *** ryker has joined #openstack | 23:13 | |
| *** arun_ has joined #openstack | 23:13 | |
| *** arun_ has joined #openstack | 23:13 | |
| *** rackerhacker has joined #openstack | 23:13 | |
| gholt | Quick guide: get_groups is authentication, authorize is authorization. The rest is just management. :) | 23:13 |
| *** patcoll has quit IRC | 23:14 | |
| *** maplebed has quit IRC | 23:14 | |
| *** nelson has joined #openstack | 23:14 | |
| *** filler has joined #openstack | 23:14 | |
| *** dubs has joined #openstack | 23:14 | |
| *** RobertLaptop has joined #openstack | 23:14 | |
| *** deshantm has joined #openstack | 23:14 | |
| *** zenmatt has joined #openstack | 23:15 | |
| *** hggdh has quit IRC | 23:15 | |
| eday | vishy, gholt: One big Q I have is where should authz/access control go? For example, should a generic auth service keep nova-specific controls, or should each service maintain a auth DB as well for their own controls? | 23:15 |
| *** mdomsch has quit IRC | 23:15 | |
| *** hggdh has joined #openstack | 23:16 | |
| vishy | eday: i think a general service is "programmable" by the client service | 23:16 |
| vishy | I've been thinking of objects like a directory hierarchy | 23:16 |
| openstackhudson | Project swift build #207: SUCCESS in 29 sec: http://hudson.openstack.org/job/swift/207/ | 23:16 |
| openstackhudson | * Tarmac: small doc fix | 23:16 |
| openstackhudson | * Tarmac: lower memcached error limit duration. | 23:16 |
| eday | vishy: so a flag that says whether account X can create networks should be stored via a generic interface in an auth service? | 23:17 |
| vishy | as in an object is /org/unit/account/project/object/subobject | 23:17 |
| vishy | and the "general account services verifies up to project/" | 23:17 |
| vishy | the service verifies authz to object/subobject | 23:18 |
| vishy | but it could do that by hooking into the generalized auth system | 23:18 |
| vishy | and auth is controlled via subject (user), predicate (action), and object (which has a path like the above) | 23:19 |
| eday | I think we need to drop 'project' and start thinking of accounts. a project can be a shared account. I make want to modify /account1/volume/X, but am logging in with account2 (and account2 has certain perms on account1) | 23:19 |
| vishy | as far as I'm concerned /org/unit/account/project is opaque to the services | 23:20 |
| vishy | but internal to auth system it is arbitrarily nested groups and subgroups | 23:20 |
| eday | vishy: I guess I would say: /account/object..., and let account represent whatever it needs underneath | 23:20 |
| vishy | eday: sure, but the point is some services may have similar concerns (objects subobjects) swift for example | 23:21 |
| eday | this is basically how swift does it | 23:21 |
| eday | vishy: ok, we may be saying the same thing :) | 23:21 |
| vishy | at least i'm assuming you can have different access control on the bucket hierarchy | 23:22 |
| vishy | can you? | 23:22 |
| *** adiantum has quit IRC | 23:22 | |
| eday | per container, yes | 23:22 |
| *** gregp76 has quit IRC | 23:23 | |
| eday | at least you can have public and private containers | 23:23 |
| vishy | are there subcontainers though? | 23:23 |
| eday | nope | 23:23 |
| eday | /account/container/object, thats it | 23:23 |
| eday | your objects can have '/' in the for 'fake' paths | 23:23 |
| eday | vishy: do, getting back to service specific access control, you think we should store that in the generic auth service? | 23:24 |
| gholt | Sorry, wandered off for a bit there. The idea with swauth/devauth was that the auth would resolve to a list of groups/roles and that the service would store acls of those groups/roles. You want access to a Swift container, tell that Swift container to allow group 'whatever' and make sure your auth has you in that group. | 23:29 |
| vishy | sorry internet died | 23:29 |
| vishy | gholt so it only acl's for one action | 23:29 |
| *** maplebed has joined #openstack | 23:30 | |
| gholt | For now, in Swift we have X-Container-Read and X-Container-Write ACLs. | 23:30 |
| vishy | ah so you could in theory pass in any action as a header? | 23:31 |
| gholt | Sure, within the limits of what you can support with the service, but the auth[nz] part knows nothing about that. | 23:32 |
| gholt | We do have a bit of "seepage" to be honest. for instance, authz checks account creation and deletion permissions. | 23:33 |
| vishy | doing it within swift seems fairly useful for containers in swift, but I'm not sure if it would support another service. | 23:33 |
| vishy | meaning, is the idea that the auth data is on the same server as the actual container? | 23:34 |
| *** westmaas1 has joined #openstack | 23:34 | |
| vishy | or is it just arbitrarily using swift for consistency/availability? | 23:34 |
| gholt | Well, ignore what it uses to store account names, user names, passwords. Swauth does not store ACLs. It just stores account, users, passwords, and groups. | 23:35 |
| gholt | The ACLs are stored on the resource that they control. | 23:35 |
| gholt | Since there can be (and are) millions of containers in the cluster, it doesn't make much sense to replicate all those container names into the auth system just so you can store the acls there. | 23:36 |
| uvirtbot | New bug: #726864 in glance "Variable `id` shadowing builtin" [Low,New] https://launchpad.net/bugs/726864 | 23:36 |
| vishy | gholt: sure | 23:37 |
| vishy | gholt: so object level ACLs should be in the service | 23:37 |
| vishy | stored by whatever means the service deems necessary | 23:38 |
| gholt | Yeah, if we ever add that it would be stored in the service. | 23:38 |
| vishy | how does it find out which "group" the user is in? | 23:38 |
| *** RichiH_ is now known as RichiH | 23:38 | |
| vishy | s/group/groups | 23:38 |
| *** gregp76 has joined #openstack | 23:38 | |
| eday | gholt: can you define group? is it just a list of accounts that map to another account? | 23:40 |
| gholt | That's up to the auth side really. | 23:40 |
| *** gondoi has joined #openstack | 23:40 | |
| gholt | It can be anything, just opaque strings to the X-Container-Read acl header for instance. | 23:40 |
| eday | gholt: what is it indexed by? account? or just an arbitrary string? | 23:42 |
| gholt | Not really any index. Just, for instance, X-Container-Read: edayacct:eday,otheracct:user,yetanotheracct It's purposefully a limited list in Swift, as we don't want some crazy 2,000 group resolution stuff going on. | 23:43 |
| vishy | gholt: so it makes a request to the auth service saying get_user_groups? | 23:44 |
| gholt | What is "it" in that question? | 23:44 |
| vishy | the authz code. | 23:44 |
| vishy | if you have a user, and you are checking acls, how do you check which groups the user is in? | 23:45 |
| gholt | Ah, well, let's see. A request comes in with a token, the token is resolved to groups, the service tacks on an acl string if it applies and calls back to authorize, authorize checks if the token's groups and services groups match up. | 23:47 |
| eday | hmm, token resolved to groups? I though the group lookup happened in the auth service, not in swift itself? | 23:49 |
| * vishy is reading the doc. Starting to make sense | 23:51 | |
| gholt | Well, the token being resolved to groups can either be "inlined" when Swauth/Swift are the same cluster, or a call-out can be done if Swauth is somewhere else. | 23:51 |
| vishy | N groups are associated with a given account:password combination | 23:52 |
| vishy | The first group is a specific "username" group, then a specific "account" group, then followed by an arbitrary number of other groups | 23:53 |
| * gholt notes that Swauth/Swift *not* being inlined isn't available yet. | 23:53 | |
| gholt | I should really do that. :/ | 23:53 |
| vishy | gholt: so it looks like a command like "list all users in group X" would be impossibly slow? | 23:53 |
| vishy | gholt: assuming a large number of accounts, it would have to check all accounts, yes? | 23:54 |
| gholt | With Swauth, yeah. I tested to 100,000 users and it wasn't too bad really. So "it depends" :) | 23:54 |
| vishy | gholt: I'm just trying to understand the data storage, and if it can be mapped to other things. It would be pretty easy to pull out the account/group/password stuff into an external service, right? | 23:55 |
| vishy | and just leave the container level acls in swauth? | 23:55 |
| gholt | Exactly. :) | 23:55 |
| gholt | Swauth was just a fun "what if I stored authentication info in swift?" project. And is good enough for many uses. And scales within that limited use case (no large multi-account groupings). | 23:56 |
| vishy | in that case, the external service would just need to provide something like a user.get_groups() and all of your stuff would work | 23:57 |
| gholt | :) | 23:57 |
| *** gdusbabe` is now known as gdusbabek | 23:57 | |
| vishy | or perhaps get_groups(account, user) | 23:58 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
