18:02:50 <SumitNaiksatam> #startmeeting Networking FWaaS 18:02:51 <openstack> Meeting started Wed Feb 12 18:02:50 2014 UTC and is due to finish in 60 minutes. The chair is SumitNaiksatam. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:02:52 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 18:02:55 <openstack> The meeting name has been set to 'networking_fwaas' 18:03:06 <SumitNaiksatam> garyduan: hi 18:03:10 <SumitNaiksatam> lets start with your patch 18:03:15 <RajeshMohan> Hi all 18:03:25 <SumitNaiksatam> #topic service_type framework 18:03:46 <garyduan> Regarding Eugene's comment 18:04:14 <SumitNaiksatam> garyduan: i think we are stuck with enikanorov's comment 18:04:36 <SumitNaiksatam> garyduan: can you ping him again? 18:04:45 <garyduan> SumitNaiksatam: I can 18:04:48 <SumitNaiksatam> garyduan: we really need to move on now 18:05:12 <SumitNaiksatam> garyduan: gate is also doing better now, and RajeshMohan is waiting on this patch 18:05:20 <garyduan> SumitNaiksatam: another option is to add upgrade to associate existing fw to default provider 18:05:47 <SumitNaiksatam> garyduan: can you set up an IRC meeting with enikanorov to discuss this? 18:06:00 <garyduan> SumitNaiksatam: OK 18:06:22 <SumitNaiksatam> did the other folks get a chance to review garyduan's patch? 18:07:09 <SumitNaiksatam> lets give our suggestions at the earliest so we wrap up the patch 18:07:58 <SumitNaiksatam> garyduan: separately lets try to ping nachi again as well 18:08:09 <garyduan> SumitNaiksatam: sure 18:08:31 <SumitNaiksatam> garyduan: he has a similar patch for VPNaaS, so as long as we are in sync he should be fine for this as well 18:08:59 <garyduan> SumitNaiksatam: right 18:09:10 <SumitNaiksatam> sorry forgot to add link to patch 18:09:16 <ivoks> dem doma 18:09:20 <pcm_> I have a client side patchf or STF 18:09:30 <SumitNaiksatam> #link https://review.openstack.org/#/c/60699 18:09:32 <ivoks> sigh :) 18:09:33 <pcm_> to go with Nachi's patch 18:09:41 <SumitNaiksatam> pcm_: ok 18:10:06 <SumitNaiksatam> pcm_: are you find with garyduan's patch ^^^ 18:10:11 <SumitNaiksatam> *fine 18:10:33 <pcm_> Just joined in, what's the link(sorry)? 18:11:00 <enikanorov> SumitNaiksatam: garyduan hi 18:11:16 <enikanorov> i'm just walking by. how can i help? 18:11:21 <garyduan> pcm_: https://review.openstack.org/#/c/60699 18:11:51 <SumitNaiksatam> enikanorov: thanks for joining, we are waiting on you for: #link https://review.openstack.org/#/c/60699 18:11:58 <garyduan> enikanorov: we are talking about the fwaas service framework patch 18:12:06 <pcm_> garyduan: thanks. I'll look at it. 18:12:10 <enikanorov> ah, ok, yep, I have to say something on this 18:12:16 <enikanorov> let me quickly go over the comments 18:12:27 <garyduan> enikanorov: regarding yours and Sumit's comments 18:12:46 <SumitNaiksatam> enikanorov: thanks, we need to make a move on this patch since others a waiting on this 18:12:51 <SumitNaiksatam> *are 18:13:10 <enikanorov> ok, so you think it's fine because of experimental status. i'm ok with that 18:13:16 <enikanorov> i'll remove -1 18:13:42 <SumitNaiksatam> enikanorov: yeah, i dont think this in production anywhere yet (happy to be corrected) 18:13:52 <SumitNaiksatam> enikanorov: so migration would not be a concern to me 18:13:58 <enikanorov> and also we're now discussing flavors with markmcclain and salv-orlando, i think it will eventually take place of providers 18:14:02 <SumitNaiksatam> what does the rest of the FWaaS team think 18:14:21 <SumitNaiksatam> enikanorov: good to know, please include me in that discussion 18:14:25 <pcm_> SumitNaiksatam: is the FWaaS STF in-line with the VPNaaS patches? 18:14:32 <garyduan> enikanorov: just a name change? 18:14:39 <enikanorov> yeah, it has just started but i think it going to have some implications 18:14:43 <enikanorov> garyduan: not really 18:14:49 <SumitNaiksatam> enikanorov: while we still have STF, we would like to make sure FWaaS is compliant 18:14:52 <enikanorov> it's much more flexible and complex thing 18:15:27 <SumitNaiksatam> enikanorov: we can eventually migrate along with the other services whenever they move to the new flavors or whatever it ends up being 18:15:46 <SumitNaiksatam> pcm_: my understanding is yes 18:15:53 <enikanorov> SumitNaiksatam: i understand. I think i'll just write an email with the problem overview and you will decide if you want to move forward with STF or wait for flavors 18:15:58 <pcm_> SumitNaiksatam: cool 18:16:15 <garyduan> enikanorov: I think, it was mentioned in HK meeting, but like to know the detail 18:16:41 <enikanorov> garyduan: flavors is something that was proposed at least a year ago 18:16:43 <SumitNaiksatam> enikanorov: so we have to go with STF, you are +1 for the current patch? 18:16:47 <enikanorov> (with a bit different name may be) 18:16:55 <enikanorov> but no one closely worked on this 18:17:08 <enikanorov> service type fw, 'providers' is a simplistic implementation of this 18:17:53 <enikanorov> SumitNaiksatam: i'll need to look closer to give +1 (i remember i found no issues except migration) 18:18:33 <SumitNaiksatam> enikanorov: ok, if you can take a few minutes at the earliest, would be much appreciated 18:18:41 <enikanorov> sure i will 18:18:48 <SumitNaiksatam> enikanorov: great thanks 18:19:03 <SumitNaiksatam> garyduan: anything else to discuss on this patch? 18:19:21 <garyduan> no 18:19:30 <garyduan> Thanks enikanorov and pcm_ 18:19:46 <pcm_> np 18:20:02 <pcm_> do you guys have a corresponding client side change out for review? 18:20:19 <SumitNaiksatam> pcm_: no 18:20:24 <SumitNaiksatam> rather, not yet 18:20:36 <garyduan> pcm_: what is client side change? 18:21:01 <pcm_> For VPNaaS we needed change to neutronclient too... https://review.openstack.org/#/c/53602/1 18:21:12 <garyduan> pcm_: OK 18:21:38 <garyduan> pcm_: not for service framework 18:22:03 <SumitNaiksatam> pcm_: we can add similar functionality for FWaaS as well, once server side patch is in 18:22:24 <pcm_> yeah, just giving heads up 18:22:29 <SumitNaiksatam> pcm_: thanks 18:22:53 <SumitNaiksatam> ok moving on 18:23:24 <SumitNaiksatam> #topic Service Insertion and Firewall 18:23:54 <SumitNaiksatam> #link https://review.openstack.org/#/c/62599 18:24:04 <SumitNaiksatam> RajeshMohan: you rebased the patch 18:24:09 <SumitNaiksatam> thanks! 18:24:32 <RajeshMohan> I am working on the agent and driver side now 18:24:37 <SumitNaiksatam> RajeshMohan: are you on track to respond to the review comments? 18:24:47 <SumitNaiksatam> RajeshMohan: great 18:25:11 <SumitNaiksatam> RajeshMohan: agent and driver side changes are hopefully not too many, right? 18:25:13 <RajeshMohan> I have not closely looked at review comments 18:25:20 <RajeshMohan> (since it is still WIP) 18:25:41 <RajeshMohan> I know I have to add unit tests to remove -2 from you 18:25:50 <SumitNaiksatam> RajeshMohan: i think if the agent and driver side changes are small, they can all be in the same patch, no need to split further 18:25:53 <RajeshMohan> Are there any other major comments 18:26:02 <RajeshMohan> Ofcourse 18:26:11 <RajeshMohan> THat is the plan 18:26:24 <RajeshMohan> Next patch will have agent and driver changes 18:26:33 <SumitNaiksatam> RajeshMohan: nice 18:27:02 <SumitNaiksatam> RajeshMohan: as for comments, I dont think my comments on the validation have been fully addressed 18:27:03 <RajeshMohan> SumitNaiksatam: Can you remove -2 and put -1 18:27:18 <SumitNaiksatam> RajeshMohan: we went back and forth several times on this 18:27:25 <RajeshMohan> SumitNaiksatam: Ok. 18:27:49 <RajeshMohan> SumitNaiksatam: I will go through the comments again. I deferred some to do it as part service-tyep framework 18:28:02 <SumitNaiksatam> RajeshMohan: I believe we left at the point where you were going to fix it (after rebasing) 18:28:09 <SumitNaiksatam> RajeshMohan: yeah 18:28:19 <SumitNaiksatam> ok moving on to the client/CLI 18:28:24 <SumitNaiksatam> SridarK: hi 18:28:50 <SridarK> The thought on the CLI is something like: 18:29:11 <SridarK> neutron firewall-create <policy-id> --service-context routers=<router-uuid- list> networks=<ne-uuid-tlist> subnets=<subnet-uuid-list> ports=<ports-uuid-list> 18:29:39 <SumitNaiksatam> SridarK: that looks okay 18:29:51 <SumitNaiksatam> SridarK: it will be more like: 18:31:08 <SumitNaiksatam> firewall-create <policy-id> [--service-context [routers=<router-uuid- list>] [networks=<ne-uuid-tlist>] [subnets=<subnet-uuid-list> ports=<ports-uuid-list>]] 18:31:22 <SridarK> yes ofcourse 18:31:25 <SumitNaiksatam> SridarK: meant to indicate that the context is optional 18:31:38 <SridarK> absoultely that was the intent 18:31:48 <SumitNaiksatam> SridarK: and that when the context is specified, not all types are required 18:31:55 <SumitNaiksatam> SridarK: yeah i am sure you meant that 18:32:07 <SumitNaiksatam> SridarK: just wanted to clarify my understanding 18:32:08 <SridarK> yes, i have some json dumps from RajeshMohan: 18:32:20 <SumitNaiksatam> RajeshMohan, garyduan: does that look ok? 18:32:27 <SridarK> so will get a patch pushed out in the next couple of days 18:32:39 <RajeshMohan> SumitNaiksatam: Just to highlight - it slightly deviates from outPI design. IN API, the list of insertion types (routers, ports) can be anything by changing validtors (without changing API). But CLI has to change if we introduce a new type of insertion 18:33:08 <RajeshMohan> s/outPI/our API 18:33:09 <garyduan> SumitNaiksatam: looks fine 18:33:26 <SumitNaiksatam> RajeshMohan: thats correct, in the CLI we are more explicit, but that's the client side 18:33:42 <RajeshMohan> SumitNaiksatam: Just wanted to make sure that is ok 18:33:48 <SumitNaiksatam> RajeshMohan: we would ideally like it to be more user friendly 18:34:38 <SumitNaiksatam> RajeshMohan: i believe the other option would be not to have, say, "routers=...", but i think its better to be more explicit 18:35:13 <SumitNaiksatam> SridarK: there used to be some quirks when having to specify a list of values 18:35:25 <RajeshMohan> SumitNaiksatam: I agree with the current CLI. Just wanted to bring it up so that it is recorded that we discussed this. 18:35:34 <SridarK> ok rather than a single value ? 18:35:45 <SridarK> on each option ? 18:36:12 <SumitNaiksatam> SridarK: i think we have some convention when we specifying the firewall rule ids for a firewall policy 18:36:24 <SumitNaiksatam> SridarK: I would tend to think we can follow that convention 18:37:01 <SridarK> ok sounds good - will look at that FW Rules list SumitNaiksatam:: 18:37:06 <SridarK> Thanks 18:37:12 <SumitNaiksatam> SridarK: thanks 18:37:31 <SumitNaiksatam> RajeshMohan: do we anticipate devstack changes? 18:37:52 <RajeshMohan> SumitNaiksatam: I am hoping to avoid it 18:38:10 <RajeshMohan> SumitNaiksatam: If insertion type is not specified, then insert it on all 18:38:22 <SumitNaiksatam> RajeshMohan: so default will still be on all routers? 18:38:45 <SumitNaiksatam> i think we discussed that 18:38:48 <RajeshMohan> SumitNaiksatam: If someone can update devstack, htat will be great 18:39:15 <SumitNaiksatam> RajeshMohan: i can update devstack, just let me know what you have in mind 18:39:49 <RajeshMohan> SumitNaiksatam: I am not sure if there is any change required. 18:40:40 <SumitNaiksatam> RajeshMohan: ok good 18:41:07 <RajeshMohan> SumitNaiksatam: Netork issues on my side. I am gettising refresed late 18:41:08 <SumitNaiksatam> i think based on the tempest tests, we might need to, in case we want fwaas to be inserted as a part of the devstack process 18:41:28 <SumitNaiksatam> and don't want to be on all routers 18:41:35 <SumitNaiksatam> RajeshMohan: no worries 18:41:53 <SumitNaiksatam> SridarK: so we will have a CLI patch by friday :-) 18:42:05 <SridarK> Will certainly shoot for that. :-) 18:42:06 <RajeshMohan> SumitNaiksatam: yes, but config tells where it needs to be inserted. So, I am not sure where the no devstack changes 18:42:38 <SumitNaiksatam> RajeshMohan: also can we remove the WIP on your patch by this friday? 18:43:03 <RajeshMohan> SumitNaiksatam: I will try. Unit tests will most likely not be complete 18:43:33 <SumitNaiksatam> RajeshMohan: as long as you have some UT, it should be fine, there will always be a case for adding more 18:43:33 <RajeshMohan> SumitNaiksatam: But I will do my best to get it done by Friday 18:43:47 <RajeshMohan> SumitNaiksatam: Ok. 18:44:09 <SumitNaiksatam> RajeshMohan: with some UTs, and the patch out of WIP, people will feel more comfortable about reviewing 18:44:29 <RajeshMohan> SumitNaiksatam: and without -2 :-) 18:44:39 <SridarK> :-) 18:45:03 <SumitNaiksatam> RajeshMohan: yeah, i will remove, i wanted to make sure that the comment regarding the validation etc are not missed 18:45:15 <SridarK> it seems RajeshMohan: is hurt by the -2 ;-) 18:45:17 <RajeshMohan> SumitNaiksatam: I will add validators in reference implementation context and then you can remove that 18:45:29 <SumitNaiksatam> RajeshMohan: thanks 18:45:50 <SumitNaiksatam> SridarK: i will be more careful :-P 18:45:57 <SridarK> :-) 18:46:34 <SumitNaiksatam> anything else on this? 18:47:09 <SumitNaiksatam> ok moving on 18:47:27 <SumitNaiksatam> #topic Service Objects 18:47:41 <beyounn> ok 18:47:52 <SumitNaiksatam> beyounn: hi 18:47:52 <beyounn> I'm working on the FW side of changes 18:47:59 <SumitNaiksatam> beyounn: great 18:48:07 <beyounn> I may need to ping Rajesh for help when I update iptable part 18:48:24 <beyounn> but for now, I removed WIP from current review request 18:48:31 <SumitNaiksatam> beyounn: ok, do we have a chance of targeting this for I3? 18:48:39 <beyounn> since it has passed both unit test and tempest 18:48:46 <RajeshMohan> beyounn: you can send me email and we can discuss 18:48:54 <beyounn> Sumit:When will be I3? 18:48:57 <SumitNaiksatam> beyounn: ok cool, i saw the update a few days back 18:49:00 <beyounn> Rajesh: Thanks 18:49:41 <SumitNaiksatam> beyounn: lets keep at least the rest of the team also in the loop on that discussion 18:49:51 <beyounn> Sumit:sure 18:49:55 <beyounn> Also, 18:50:17 <beyounn> enikanorov has reviewed it, for everyone else, please also help to take a look 18:50:33 <beyounn> Since this is the first time I'm writing python, so more feedback is better 18:50:42 <SumitNaiksatam> beyounn: milestones: #link https://wiki.openstack.org/wiki/Icehouse_Release_Schedule 18:50:49 <SumitNaiksatam> i believe its march 4th 18:51:04 <beyounn> Sumit: That could be hard 18:51:18 <SumitNaiksatam> beyounn: ok 18:51:26 <beyounn> Ok, I'm done 18:51:32 <SumitNaiksatam> beyounn: whatever you are comfortable with 18:51:54 <beyounn> Sumit: thanks 18:52:12 <SumitNaiksatam> beyounn: we would need corresponding CLI/client patch also for this (eventually) 18:52:26 <beyounn> I had CLI as well 18:52:26 <SumitNaiksatam> #topic general discussion 18:52:40 <SumitNaiksatam> beyounn: ok 18:52:42 <beyounn> https://review.openstack.org/#/c/69171/ 18:52:51 <SumitNaiksatam> oh thanks, i missed that 18:52:59 <beyounn> Sumit: Please take a look 18:53:06 <beyounn> Since no one has review it yet 18:53:40 <SumitNaiksatam> beyounn: but i think we first need to review and feel more comfortable about the server side patch 18:53:53 <beyounn> Sumit: Sure 18:53:59 <beyounn> enikanorov: are you still there? 18:54:09 <enikanorov> beyounn: yes 18:54:09 <SumitNaiksatam> so in terms of order of priority of reviews for our team, can i request that we first review garyduan's patch: 18:54:18 <enikanorov> what is it (sorry, i'm not following the meeting) 18:54:31 <SumitNaiksatam> #link https://review.openstack.org/#/c/60699 18:54:47 <beyounn> enikanorov: could you take a look at https://review.openstack.org/#/c/67784/ again 18:54:49 <beyounn> thanks 18:55:09 <SumitNaiksatam> can i request all FWaaS team members to review garyduan's patch first? 18:55:25 <beyounn> Sumit: Sure 18:55:26 <SridarK> will do 18:55:29 <SumitNaiksatam> second priority will be RajeshMohan's service insertion patch: 18:55:41 <SumitNaiksatam> #link https://review.openstack.org/#/c/62599 18:56:17 <SumitNaiksatam> meanwhile hopefully SridarK will have his CLI patch as well, and we can review that 18:56:36 <SumitNaiksatam> subsequently, we beyounn should be ready with his patch: 18:56:51 <SumitNaiksatam> #link https://review.openstack.org/#/c/67784 18:56:58 <SumitNaiksatam> and we can review that 18:57:30 <SumitNaiksatam> i am not suggesting that we do this sequentially, but in terms of priority i am proposing this as the plan to requests patches getting merged 18:58:01 <SumitNaiksatam> we have pretty much been working on these lines just restating it 18:58:12 <SumitNaiksatam> thats pretty much it from me 18:58:31 <SumitNaiksatam> #info feature proposal freeze deadline is feb 18th 18:59:04 <SumitNaiksatam> everyone is good otherwise? 18:59:53 <SumitNaiksatam> ok seems like :-) 18:59:57 <SumitNaiksatam> lets wrap up 19:00:02 <SumitNaiksatam> bye 19:00:04 <SridarK> ok bye all 19:00:09 <RajeshMohan> Bye all 19:00:12 <pcm_> bye 19:00:13 <SumitNaiksatam> #endmeeting