17:30:59 #startmeeting Networking Advanced Services 17:31:00 Meeting started Wed Jun 4 17:30:59 2014 UTC and is due to finish in 60 minutes. The chair is mestery. Information about MeetBot at http://wiki.debian.org/MeetBot. 17:31:01 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 17:31:03 The meeting name has been set to 'networking_advanced_services' 17:31:11 #link https://wiki.openstack.org/wiki/Meetings/AdvancedServices Agenda 17:31:14 hi 17:31:24 So, SumitNaiksatam can't be with us today, he asked me to run this. 17:31:39 I'd mainly like to go over the BP reviews/approval process, per SumitNaiksatam's request. 17:31:57 mestery: OK 17:32:10 #link https://wiki.openstack.org/wiki/Neutron/AdvancedServices/JunoPlan 17:32:18 OK, so shall we walk through the JunoPlan here? 17:32:27 mestery: sure 17:32:34 ok 17:32:36 hi! 17:32:37 yeah 17:32:41 OK, so lets just start at the top. 17:32:53 The over-arching BP was approved already. 17:33:02 The next one on the list is flavor framework. 17:33:06 enikanorov: Are you around? 17:33:23 so this one has been under review for a long time 17:33:36 Yes, there were some issues which markmcclain had wiht htis one if I recall. 17:33:42 There is a ML thread as well I believe from enikanorov. 17:33:49 mestery: yes 17:33:50 We need to close on this one ASAP I believe. 17:34:10 #action enikanorov to re-post ML thread. 17:34:19 #action mestery to bringup flavor framework discussion at Neutron meeting on Monday. 17:34:26 Anything else with flavor framework? 17:34:44 no 17:34:48 mestery: sorry, i'm late 17:34:50 OK, cool, 17:35:01 Next one is service insertion. 17:35:13 This one has gone through many iterations as well. 17:35:17 so i think it makes sense to limit initial implementation to those aspects that don't involve integration with services 17:35:25 mestery: well, since enikanorov is here, does he have anything else to say about flavor framework? 17:35:26 so the question posted to ML could be addressed later 17:35:36 enikanorov: for flavor framework? 17:35:39 yes 17:35:50 Servicde Insertion I did not find any sharing of a given service, any comments? 17:35:52 enikanorov: OK, got it. 17:36:10 i'm planning to have implementation at ~J-1 time so we could spend J-2 reviewing and hopefully merge it by J-02 17:36:19 enikanorov: Perfect! 17:36:26 enikanorov: J-1 is next week, right? :-) 17:36:39 s3wong: right, but flavors API is no big deal IMO 17:36:49 still hoping to get whole patch < 1k lines 17:37:31 enikanorov: that's including STF, which is still part of flavor, right? 17:37:31 enikanorov: Cool! 17:37:45 I have added mysellf to service Insertion and will see what I can contribute after review 17:37:49 that's probably it from my side 17:37:59 feel free to approve flavor framework bp 17:38:00 :) 17:38:08 enikanorov: done! 17:38:18 enikanorov: Ha! I will review it again this afternoon. 17:38:21 enikanorov: Thanks! 17:38:27 OK, so service insertion now. 17:38:46 This one is also looking like it's ready for some core reviewer and approval love I think. 17:38:49 mestery: OK, since kanzhe and kevinbenton aren't here, I will take this one 17:38:55 s3wong: thanks! 17:39:18 mestery: yes, I have been advertising it everywhere, so it is now waiting for cores to look at, if they have time 17:39:43 this one has not received many reviews outside the advanced service sub team 17:39:49 as kanzhe talked about last week, the division of tasks between kanzhe, kevinbenton and me were decided 17:40:11 Does the Service Insertion bp require any reveiw or is it approved? 17:40:12 OK, perfect! 17:40:16 and I believe kanzhe and kevinbenton are currently working on API and db 17:40:21 pgpus: It's not approved yet, reviews welcome. 17:40:23 s3wong: so first target will be fwaas - no change correct ? 17:40:41 SridarK: FWaaS is the natural first, the tough one is LBaaS 17:40:50 s3wong: :-) 17:40:55 ok did one pass and will do another to make sure it meets J-1 time farme deliveries 17:41:02 s3wong: Lets see if we can get this integrated before LBaaS departs Neutron. ;) 17:41:21 pgpus: J-1 is next week, none of this is targeted for J-1 17:41:23 and luckiy and forunately, LBaaS is going through model change at J-2, so we can work with their db migration naturally 17:41:27 This is all J-2 and beyond at this point. :) 17:41:27 on the right time :-) 17:41:28 mestery: without this no one can go anywhere :-) 17:41:47 Has anyone looked at ServiceBase class definitions? 17:42:27 or is it wating for Data Models? 17:42:41 pgpus: I deifned it, please look into it and see if it fits into your expectation :-) 17:42:54 regXboi: Any comments wrt the service insertion beyond your comments on the review system? 17:43:09 banix: sorry for being late - no - I need to re-read the new patch 17:43:11 Thanks s3wong 17:43:15 regXboi: just noticed you joined; thats the topic being discussed 17:43:50 s3wong: what are you referring to? in the service insertion spec? 17:43:50 I read through all the BPs on the status page as of Sunday and added comments where I had them - haven't had a chance to follow up on all of them since 17:44:00 will we cover more than l2, l3 insertion in j-1 17:44:09 banix: regarding love outside of adv serv. subteam, what we really want is people from LBaaS (no one), FWaaS ( SridarK ) and VPNaaS ( nachi_ueno ) 17:44:20 pgpus: Again, none of this work is being done for J-1, the specs are targeted to be approved by J-1. 17:44:27 https://review.openstack.org/#/c/93128/9/specs/juno/service-base-and-insertion.rst 17:44:31 pgpus: J-1 is next week, it may be cut Tuesday, but as late as Thursday. :) 17:44:42 s3wong: speak of love got me confised for a second :) 17:45:00 banix: no love so far :-( 17:45:10 actually, banix, I'm worng 17:45:16 I did read through the new SI draft 17:45:22 s3wong: I'm from the LBaaS team, I'll review in more detail and spread the word with the broader team. 17:45:23 ok atleast lets get bp clerared for coding on service insertion 17:45:30 and I still want some text on equating service port and service attachment point 17:45:42 mestery: cool, but you are everywhere, so I don't know if it counts :-) 17:45:52 because if I read it as someone from outside, the equivalency isn't obvious 17:45:57 s3wong: :P 17:46:00 mestery: but we do need your approval eventually for sure :-) 17:46:06 regXboi: agree; that should be easily addressed 17:46:24 s3wong: i am on board - have had many discussions with u and kanzhe - will put my +1 soon - just minor things i am trying to work out 17:47:11 SridarK: cool, We can talk more if you want (even f2f) 17:47:20 s3wong: sure thanks 17:47:38 OK, should we move on to traffic steering now? 17:47:49 Integration with devstack, heat and other modules for service insertion is bit unclear and does anyone have any clue on that? 17:47:50 mestery: sure, I have nothing else to say :-) 17:48:26 pgpus: There are people signed up for some of those, but I don't see devstack under that project at all. 17:48:37 or we leave the impact to later time frames? 17:48:57 pgpus: not yet, though Louis volunteered for Heat 17:49:22 and kanzhe , kevinbenton , and I will likely include devstack work as part of our ongoing development and testing 17:49:27 Good atleast Heat as Orchestartion tools and template of Service will help us give some idea 17:49:39 s3wong: need to add devstack to the tables 17:49:39 pgpus: however, if you want to volunteer to join in, we welcome you :-) 17:49:54 banix: yes 17:50:00 May I can look into devstack and add my comments to bp 17:50:01 s3wong: thanks 17:50:19 pgpus: of course. Thanks! 17:51:00 OK, on to traffic steering. 17:51:05 cgoncalves: This is your area I believe. 17:51:13 mestery: indeed 17:51:15 devstack will need nova / neutron config changes for service creation by few params possibly will verify by flow one time 17:51:33 since last week we addressed some comments and submitted a new patchset 17:51:46 we are in need of more reviewers I believe 17:51:50 pgpus: OK 17:51:55 Ok we move to traffic steering 17:51:55 cgoncalves: OK, good to know! 17:52:06 #info Traffic Steering BP is in need of more reviewers 17:52:10 cgoncalves: will review 17:52:10 and I apologise for the late patchset 17:52:23 s3wong: thanks 17:52:24 mestery: I plan on reading 17:52:41 cgoncalves: though I am still hoping that traffic steering will take advantage on the connectivity map that we are going to store in ServiceBase objects 17:52:46 s3wong regXboi: Thanks! 17:52:54 cgoncalves: link? 17:52:57 traffic steering can play a significant role in the new openstack nfv sub-team vision 17:53:03 #link https://review.openstack.org/#/c/92477 17:53:12 mestery: tks 17:53:15 mestery: thx 17:53:38 cgoncalves: yes, I noticed your participation during the NFV meeting this morning 17:54:16 also, I have not nominated myself to all items that are in the wiki 17:54:37 cgoncalves: there are others in your team as well, right? 17:54:37 cgoncalves: OK, can you remove yourself where appropriate? 17:54:47 so I look forward for volunteers wanting to help me on heat, horizon, etc 17:54:48 https://blueprints.launchpad.net/neutron/+spec/traffic-steering-abstraction 17:55:05 mestery: ok 17:55:28 s3wong: yes, but not directly involved in openstack 17:55:45 s3wong: jsoares is collaborating with me on the proposal though 17:55:49 looks like port to port traffic forwarding is involved and will help service chaining is it states 17:56:02 pgpus: yes 17:56:03 s3wong: have a pointer to the nfv meeting wiki? 17:56:06 pgpus: Correct 17:56:12 #link https://wiki.openstack.org/wiki/Meetings/NFV 17:56:16 banix: ^ 17:56:21 cgoncalves: thx 17:56:28 banix: https://wiki.openstack.org/wiki/Meetings/NFV 17:56:39 s3wong: thx 17:57:04 Are we using ovs flolw control to steer traffic and does it mean control plane data plane seperation as sdn/nfv here? 17:57:24 on the implementation side I have still some concerns, but probably are out of scope for now 17:57:47 Sure I will lookinto nfv meetings and join that besides here 17:58:42 OK, anything else on traffic steering or should we move onto the service chaining BP? 17:58:57 mestery: I think I've nothing more to add for now. thanks 17:59:03 cgoncalves: Thanks! 17:59:51 mandeep: I believe Service Chaining is your BP? 17:59:58 mestery: Correct 18:00:03 How is the review going for this one? 18:00:03 The status is: 18:00:12 I am still not sure what's the assumption here , do we steer traffic first or chain the phyiscal pipe (logical pipe ) first, as what preceeds what, chaining or steering? 18:00:20 1. A use-case needs to be added to the BP, that is still pending 18:00:43 2. I just updated the plan and I am targeting J1 for BP approval and J3 for code in neutron/CLI 18:00:44 OK mandeep that's a good point to start 18:01:18 for which one steering or chaining you mean? 18:01:21 3. I still need to identify volunteers for Heat/Horizon/Devstack - TBD 18:01:31 mestery: That is all 18:01:51 pgpus: Chaining 18:01:55 mandeep: thanks! 18:02:17 mandeep: I had one comment in the latest review around creating a separate launchpad BP for this one as well so we can track it with LP milestones. 18:02:22 mandeep: I added it in the review. 18:02:35 OK, will do. 18:02:37 devstack for neutron service shaining you mean mandeep, may be let me review it for you 18:02:40 I'm still concerned about the non-sunny day 18:02:51 pgpus: Sure 18:02:53 regXboi: I saw your concerns as well 18:03:01 regXboi: non-sunny day? 18:03:18 what happens in re notifications if something goes wrong 18:03:42 the statement " 1. All updates to service-chain resources need to be relayed to the configured service-chain-providers" 18:03:52 needs clarification around what happens if the relay fails 18:03:53 regXboi: somethig goes wrong meaning something within the chain going down? 18:03:53 regXboi: I am hoping that is where an infrastructure like group-policy can hep 18:04:37 mandeep: I think you should identify that dependency in the text then 18:04:45 regXboi: Got it. That is a function call, not a message, 18:05:00 regXboi: Good point. I will add that 18:05:04 Are we looing Infra GP and Service GP as layered GP for Endpoints involved? 18:05:08 mandeep: ah, I read the text as a message, not an rpc 18:05:46 pgpus: by service GP do you mean an EPG wrapping a service? 18:05:48 in general though, I'm going to be thinking about the "how do we handle something not working" aspect 18:05:57 regXboi: So ignore my comment on GP, that was in a generic sense - not for this specific interaction 18:05:59 Sure that is Group Policy within Group Policy hierarcy that was demoed by Sumit's team and had some codes in github I believe 18:06:06 mandeep: got it 18:06:37 pgpus: that is hierarchical contracts, which is division more between infra owner and app owner (roles) 18:06:46 OK lets move on ignore GP for now 18:06:48 but I will followup with the "fixup" concept on 175 needs some thought about what do we do if a servicechaininstance can't be "fixed up" 18:06:58 regXboi: it should also be of interest for this spec to know what are ODL plans on this as I see there is a Service Function Chaining proposal there and you're somehow involved :-) 18:07:20 #link https://wiki.opendaylight.org/view/Project_Proposals:Service_function_chaining 18:07:25 Service failure is diff from Infra failure so will need some thinking and borrow some ideas from service VM or wherever 18:07:33 cgoncalves: guilty as charged - I'm not 100% sure yet - I'm only peripherally involved at this point 18:07:59 regXboi: You are involved in more than I am I believe. ;) 18:08:03 cgoncalves: I'll have a better idea when I have a chance to dig through the proposed yang models 18:08:10 pgpus: My comment was that in general, your "actual" can deviate from "expected" and there needs to be a way to recover to the "expected" state, anf group-policy allows a clean way to achieve that. 18:08:11 mestery: jealous? hehe 18:08:15 cgoncalves: Ha! 18:08:43 mandeep: that's a very good thing to say in the BP I think 18:08:55 because it takes care of a lot of my budding concerns :) 18:08:57 regXboi: Yes, I will add that. 18:09:04 mandeep: thx 18:09:13 Is Service chaing tied to ODL or is it generic ? this links shows ODL way? 18:09:15 regXboi: ok, thanks. I'd also like to get a peek on ODL's work on this matter. anyway... i'm offtopic-ing, sorry 18:09:31 pgpus: I certainly hope we don't have to tie it to the ODL project 18:09:32 cgoncalves: there is a patch spec in ODL gerrit right now... 18:09:35 will pm it to you 18:10:01 pgpus: As defined, it is designed to independent of any specific backend/provider 18:10:19 mandeep: +1 18:10:21 yeah lets not mix in the group policy here 18:10:48 this is more generic as mandeep said 18:10:56 OK, 20 minutes left and 2 BPs to go. 18:11:03 * mestery thinks we have a chance at completing these. 18:11:11 banix: yes, a service chain can be implemented by GBP 18:11:15 banix: Agreed 18:11:20 That is welcome, so the focus is stitching service and default is OVS for underlay and for overlay we need Group or Chain policy 18:11:24 mestery: don't say that - murphy will hear! 18:11:31 regXboi: hehehehe 18:11:37 regXboi: ;-) 18:12:33 OK, moving on to L3 agent consolidation. 18:12:51 Looks this needs more detail look into bp, will try cover this offline, but what's the last date for approval on this one? 18:14:12 Could be per Service Chaining policy 18:14:12 pgpus: +1 18:14:37 add to that per Tenant 18:14:37 Does anyone know the IRC nick of hte L3 agent consolidation author? 18:15:05 Looks like it's iwamoto, who likely is sleeping right now. :) 18:15:23 yes 18:15:46 I have some serious concerns with this BP, adding comments now. 18:15:56 pgpus: Please go ahead and add review comments, it is more important that we get it right. 18:16:06 mestery: join the club, we've got jackets? 18:16:09 Ok madeep will do that 18:16:10 regXboi: :) 18:16:33 Anyways, lets move on to the last one, and my personal "favorite named BP of all time": Tap as a Service. 18:16:41 :) 18:16:46 * regXboi hears trumpets in the background 18:16:51 it is on Tap!!! 18:17:00 good one 18:17:16 I haven't had a chance to read the new patchset 18:17:36 well reviews are on and we are refining it each patch set 18:18:00 targeting juno 2 for spec as well as neutron code 18:18:03 understood I'm just saying I commented on ps 3 and haven't had a chance to re-read ps 4 18:18:11 vinay_yadhav: Cool, thanks! I haven't reviewed this one yet either. 18:18:19 so I still owe a re-read 18:18:22 regXboi: Get on that man! ;) 18:18:25 regXboi: i got it :) 18:18:26 vinay_yadhav: great work on quickly addressing reviewers' comments! 18:18:31 mestrey: right behind you :) 18:18:36 where is the link for tap, I see virtualResource one did I miss tap one? 18:18:49 #link https://review.openstack.org/#/c/96149/ 18:19:23 Did not see any major concerns 18:19:25 so, one thing that jumps out at me 18:19:32 is this tp mirroring intended for HA or reslliance to service? 18:19:32 who can create a tap service? 18:19:37 i will start a dev thread soon as sumit suggested 18:19:49 tenant can create the service instance 18:20:04 tap mirroring on tap iterface of VM? 18:20:08 the work flow for using the service is described in short in the spec 18:20:15 Several use cases are documented - debugging and more importantly traffic monitoring/visiblity for security and analytics 18:20:21 vinay_yadhav: and admin can redirect traffic flow to it if they use GBP :-) 18:20:57 then we can rename this NSA-as-a-Service 18:21:09 haha sure :) 18:21:35 s3wong: Or the copy action for GBP can use the tap service ;-) 18:21:36 so... how does this interact with shared networks? 18:21:36 pgpus: we mirror the traffic transiting the port in the VSwitch 18:21:51 I see good use cases for port mirroring on neutron a good one need to study this , but what's security risk on this , any thoughts? 18:21:54 mandeep: yes, forgot about that, sorry :-( 18:22:29 s3wong: Nothing to be sorry about, another option! 18:22:30 We have documented the security aspects in the spec. We try to honor the existing Security Group policies . 18:22:53 What if some spurious process redirects the traffic will it not cause serious attack or compromise on the service? 18:23:00 anil_rao: you've identified the security aspects at the traffic/port level 18:23:12 anil_rao: I'm asking the administrative/tenant level 18:23:48 the service can be initiated by a tenant owner and its scope is restricted to that tenant. 18:23:50 regXboi: do u mean tenant misbehaving 18:24:18 vinay_yadhav: I'm thinking if I have a shared network and the tenant of the network can tap any port on that network, that might be an issue 18:24:20 regXboi: you want admin to have the ability to remove a tap from tenant? 18:24:24 well secuirty is wast bust aslong it covers for the said use case we should be OK 18:24:51 s3wong: I'm starting to think *only* admin can set up TaaS 18:24:59 regXboi: Have you expressed these concerns in the BP review? If not, please do. 18:25:14 we would like a tenant on say a public cloud to be able to initiate traffic monitoring for his/her tenat. Ideally without cloud admin intervention. 18:25:14 mestery: will do - honestly, I only started thinking of them just now 18:25:15 Why would a non-admin need to setup TaaS? 18:25:15 regXboi: need to think on the acpects of shared networks 18:25:26 regXboi: i think even that may have unwanted implications 18:25:45 anil_rao: agree 18:25:47 vinay_yadhav: I'll craft some comment text for the security impact section 18:25:56 sure thanx 18:25:59 The scope of the Tap is limited to the tenant that initated the service, so I believe it should be okay. 18:26:04 regXboi: please do 18:26:29 anil_rao: only on the tenant's own vport, right? 18:26:51 anil_rao: which may be more reasonable than allowing the admin to do so 18:26:56 stuff like external port is something tenants can't tap 18:27:00 Yes, that is correct. The ports in question must belong to the tenant 18:27:04 s3wong: yes only on tenants vports 18:27:08 3 minutes left folks, I think we should start wrapping this up now. 18:27:15 I propose this discussion move to the BP at this point. 18:27:24 It seems serious enough to warrant some thought, per regXboi. 18:27:25 anil_rao: aha! let me see if I find that text 18:27:47 mestery: sure 18:27:47 I believe port redirection is important for VM agents to Hypervisopr Agents communication and hence this should get priority irrespective of security which will evolve overtime 18:27:49 Vinay and I will make sure to update the spec with some additional detail 18:27:55 sure 18:28:06 anil_rao: ok, I found that text 18:28:09 pgpus: I'm not following that comment at all. 18:28:17 but I still need to think through shared networks 18:28:28 pgpus: er?!?!?! 18:28:36 regXboi: It's not just me at least. 18:28:50 mestery: no, I want an explanation before I say -1 18:29:10 Agreed, but with 1 minute left, not sure we'll get there. :) 18:29:14 OK, lets wrap this up for this week. 18:29:18 yes - let's go BP on this one 18:29:21 I think we're all focused on BP review at this point. 18:29:30 regXboi: Can you please leave your comment on the spec 18:29:38 tenant isolation is different but network sharing yes from that perspeactive, logical noverlays are allocated to tennat can be restricted to tenant to avoid security risks for those tenents who desire it 18:29:41 vinay_yadhav: yes 18:29:41 bye all 18:29:41 Please keep the momentum up, and I'll see if we can focus some attention on service BPs at the Neutron meeting on MOnday. 18:29:44 Thanks! 18:29:45 bye 18:29:47 #endmeeting