16:01:09 <mestery> #startmeeting networking_policy
16:01:10 <openstack> Meeting started Thu Nov 21 16:01:09 2013 UTC and is due to finish in 60 minutes.  The chair is mestery. Information about MeetBot at http://wiki.debian.org/MeetBot.
16:01:11 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
16:01:13 <openstack> The meeting name has been set to 'networking_policy'
16:01:29 <mestery> #link https://wiki.openstack.org/wiki/Meetings/Neutron_Group_Policy Agenda
16:01:43 <mestery> Anyone besides banix and myself?
16:02:46 <mestery> alagalah: Welcome!
16:02:57 <alagalah> mestery: Thank you sir
16:02:59 <mestery> michsmit: yo
16:03:15 <mestery> For those who missed it earlier: Agenda is here (https://wiki.openstack.org/wiki/Meetings/Neutron_Group_Policy)
16:04:07 <mestery> #link https://etherpad.openstack.org/p/NeutronIcehouseProjectPlan Neutron Icehouse Project Plan
16:04:19 <mestery> I wanted to mention the Project Plan for Neutron in Icehouse first.
16:04:39 <mestery> Per the Neutron IRC meeting on Monday, the policy work we're doing here is unlikely to make it into Icehouse.
16:04:53 <mestery> But we should continue exploring it and prototyping it to make sure it gets into "J" release.
16:05:04 <mestery> Any questions on that?
16:05:16 <banix> Yeah let's push the ball forward
16:05:33 <mestery> banix: Agreed. And we should certainly shoot to get some WIP type patches out for review at some point as well.
16:06:04 <mestery> #link https://wiki.openstack.org/wiki/Icehouse_Release_Schedule Icehouse Release Schedule (for reference)
16:06:10 <mestery> Not the Icehouse dates there, for reference.
16:06:25 <mestery> #topic Group Based Policy Discussion
16:07:05 <mestery> So, what I'd like to start doing here is to make sure we all are in agreement around the high level constructs and terms.
16:07:17 <mestery> That will make it easier to move forward in discussions and implementation.
16:08:03 <mestery> #link https://docs.google.com/document/d/1ZbOFxAoibZbJmDWx1oOrOsDcov6Cuom5aaBIrupCD9E/edit?usp=sharing Group Policy Document
16:08:15 <mestery> I encourage people to comment in the document as well as on the openstack-dev mailing list.
16:08:26 <mestery> Questions on that?
16:08:48 <thinrichs2> I brought this up on the mailing list---I'd like to discuss whether there are plans to include a concrete policy language (or several).
16:09:47 <mestery> thinrichs2: There are currently no plans at the moment, partially because of how high level the proposal currently is.
16:09:53 <mestery> Perhaps it can evolve in this direction though.
16:10:13 <thinrichs2> I ask mainly because I'm trying to figure out how another OS component would use this API.
16:10:45 <thinrichs2> For example, if I were writing Heat, if I don't know what policy language to use, I can't figure out which API calls to make.
16:11:15 <michsmit> I think getting the constructs into the current model would come first and then a policy language could potentially be layered on top later.
16:11:15 <thinrichs2> I would know that I need to insert policy/group statements, but I wouldn't know which ones.--unless I knew which plugin we were using for Neutron.
16:11:19 <thinrichs2> Or am I missing something?
16:11:57 <banix> thinrichs2: how is this done in Heat now for other resources?
16:12:11 <mestery> thinrichs2: I think the constructs would dictate what an API user could do, as michsmit is leading to.
16:12:15 <banix> Isn't the resource specified and the corresponding API called for it?
16:12:22 <thinrichs2> Heat knows what routers/switches/etc are, and uses them appropriately.
16:13:01 <thinrichs2> Banix: But this is different in that the API basically allows us to pass arbitrary strings (policy statements), and we don't know what strings are even syntactically valid, let alone what they mean.
16:13:38 <thinrichs2> The thought experiment I did was to assume I was trying to build a super-simple version of Heat where I only accepted app templates with a DB tier and a web tier.
16:13:51 <thinrichs2> So the template just said how many DB servers and how many Web servers we want.
16:14:29 <thinrichs2> I then need to write a function that takes as arguments number-of-db-servers and number-of-web-servers and outputs a sequence of neutron API policy calls that implements that app.
16:14:38 <michsmit> The policy should describe desired connectivity abstracted from topology i.e. group A can talk to group B using Web
16:14:42 <thinrichs2> But I can't write that down *unless* I know the policy language.
16:15:08 <thinrichs2> Does any of that make sense?
16:15:34 <banix> So to make it easier to begin with, let us assume someone will create the Heat template
16:16:04 <michsmit> The "language" could be fairly simple at first.  L4 protocol and ports
16:16:12 <michsmit> L4 port that is
16:16:24 <banix> Resources are defined based on what Neutron objects are
16:18:43 <mestery> I think based on this discussion it's clear we should flesh out the objects and attributes we're talking about a bit more.
16:18:47 <michsmit> banix: Agree, I would expect the more topology specific constructs to not be described in the policy such as network but rendered by the extension.
16:18:49 <mestery> Any volunteers to do that in the Google doc?
16:18:51 <thinrichs2> I agree we could invent a bunch of different languages to do this.  Each plugin, for example, could have its own language.  But therein lies the problem.  We don't want Heat to have to know which plugin is being used in order to use the policy API.
16:19:25 <banix> mestery: I can get it started
16:19:32 <mestery> banix: Thanks!
16:19:33 <thinrichs2> For the policy API to be useful, we should be able to write the following function today, and that function should work for every plugin.
16:19:42 <michsmit> mestery:  I can help as well
16:20:06 <mestery> #action banix and michsmit to flesh out the objects and attributes we want to expose in more detail in the design document
16:20:10 <thinrichs2> void create_simple_app(int db-server-num, int web-server-num) { ... }
16:20:49 <thinrichs2> I'm happy to help as well.  But I'm sure I understand what constructs we're talking about.
16:20:54 <mestery> thinrichs2: I think the idea is to specify the desired connectivity, but let the plugins handle how that connectivity is achieved (michsmit correct me if I'm wrong here).
16:21:03 <banix> thinrich2: I think this where we want to get to but we are not there yet
16:21:14 <s3wong> thinrichs2: that abstraction seems to be more than what Neutron can handle, right? Nova has to be involved as well?
16:21:26 <mestery> thinrhcs2: Great! DM me your gmail and I can add you to the google doc.
16:21:35 <thinrichs2> s3wong: Correct--but we *should* be able to write the Neutron API calls today.
16:21:47 <s3wong> mestery: I would like to be added to that Google Doc as well
16:21:49 <banix> What you are suggesting is perhaps done in an enhanced version of Heat engine or on something on top of it that produces appropriate Heat templates
16:21:56 <thinrichs2> thinrichs@nicira.com
16:22:09 <mestery> s3wong: Sure, DM me your google ID so I can add you as well.
16:22:20 <s3wong> mestery: My email address is s3wong@midokura.com
16:22:28 <thinrichs2> But I'm still a bit unsure what we're proposing to put into the google doc.
16:22:54 <thinrichs2> Are we talking about a full language (grammar + semantics)?
16:23:54 <mestery> Not a full language, but the actual objects/resources we're talking about adding for the extension API, along with attributes.
16:24:01 <michsmit> I think the Google doc should focus on what needs to be described so that the extension plugin would have enough information to render the existing Neutron objects
16:24:21 <banix> thinrich2: no, we were talking about Neutron object model here.
16:24:21 <michsmit> but yet be independent of network topology
16:24:50 <thinrichs2> If we only talk about the objects, we still aren't giving enough information to actually use the API.
16:25:16 <thinrichs2> Suppose I want to add a policy statement.  I don't know which strings are syntactically valid to pass into that API call.
16:25:37 <banix> So if you look at the current doc, we are saying we will have these new objects, we want to specify them more precisely to begin with
16:27:08 <thinrichs2> Anyway--hope my position is clear at this point.  I think that before we start talking about implementing the proposal, we need to hammer out a concrete policy language (that could be extended, etc.)
16:27:48 <thinrichs2> I'm happy to move onto other topics.
16:28:17 <mestery> Well, this is pretty much the only topic for today per the agenda. :)
16:28:21 <banix> I think we are looking at this from different angles which is perfectly fine; thinrichs2, could you say a bit more, may be later on the dev list ….
16:28:50 <s3wong> Policy implies rules - wouldn't defining better rules premitives for Neutron be a pre-requisite?
16:29:02 <thinrichs2> I'm happy to write the example up and send to the dev list.
16:29:14 <thinrichs2> s3wong: could you elaborate?
16:29:28 <banix> thinrichs2: thanks
16:29:46 <s3wong> Policy is a set of rules, rules would be {classifier/match -> set of actions}
16:30:44 <banix> s3wong: agree, that's what we need to define too. At least start with a set of possible rules, or types of rules
16:31:01 <s3wong> banix: absolutely
16:31:22 <thinrichs2> banix: agreed.  With the current proposal, it's impossible to write down 1 valid API call (and know it's valid for all plugins).
16:32:10 <mestery> banix s3wong: Are you volunteering to define the initial rules?
16:32:11 <alagalah> Excuse my naivety, but if the end game is to make this a part of core Neutron, with Step1 being a plugin, does it make sense to create any missing Neutron primitives in the plugin first since they'll be rolled in eventually anyway?
16:32:35 <mestery> alagalah: Not a plugin, an API extension at first, implemented in ML2 as the open source reference implementation.
16:32:40 <s3wong> mestery: certainly, I would love to
16:32:49 <mestery> s3wong: Cool, thanks!
16:32:54 <prasad_> dont we have to define other APIs too such as connectivity group? What goes into the group?
16:33:09 <banix> mestery: yes sure
16:33:19 <alagalah> mestery: Sorry, I misread the paragraph in the doc on OpenSrouce Reference Implementation.
16:33:38 <mestery> alagalah: No worries.
16:34:59 <michsmit> prasad_: yes, the group would contain the endpoints i.e. entities that source/sink traffic on the network
16:35:06 <banix> prasad_: yes, that is part of the extension. that's what we want to define more precisely.
16:35:18 <mestery> #action banix and s3wong to make first pass at defining initial rules.
16:35:41 <thinrichs2> Could someone explain why we wouldn't want to define groups as part of the policy?  Just curious.
16:35:57 <prasad_> the question is how are end points defined? VMs, IP addresses?
16:36:09 <michsmit> Groups are a fundamental primitive that could be used in higher layer policy languages
16:36:33 <michsmit> prasad_:
16:37:06 <banix> prasad_: yes, may be ports, as a first step
16:37:07 <michsmit> prasad_: vnic, ip address as well for external subnets
16:37:28 <prasad_> dont they have to be precise just like rule definition discussed above. Else it will again be pllugin dependent isnt it?
16:38:06 <mestery> I think it's a safe assumption to assume that if we make any of this plugin dependent we've failed.
16:38:06 <thinrichs2> I only ask b/c often we end up defining groups implicitly within the policy itself.
16:38:19 <thinrichs2> mestery: agreed
16:38:29 <mestery> The entire goal of this is to abstract things at a higher level, by exposing plugin primitives this doesn't by us anything.
16:38:42 <mestery> Look at the current state of Neutron extension APIs per-plugin to get an idea of why this is a bad idea.
16:39:05 <mestery> Cloud management vendors need to understand which plugin is running in Neutron before they can appropriately use Neutron, which is bad IMHO.
16:39:16 <mestery> So these new APIs need to abstract that away and simplify that state of affairs.
16:39:57 <uri__> what happens whrn the Plugin can't support a given policy?
16:40:11 <KDurazzo> quit
16:40:53 <thinrichs2> uri__: I would imagine we have a core policy language that *every* plugin must support, with extensions to the language that plugins can choose to support or not.
16:41:06 <thinrichs2> Sort of like the API and its extensions.
16:41:17 <mestery> thinrichs2: I partially agree, although the extensions idea is a slippery slope.
16:41:28 <michsmit> The policy should express the intent of the connectivity independent of the low level networking details.  This should allow the plugin some freedom in making it happen, but at some point if the intent cannot be realized, it would fail the call.
16:41:33 <uri__> so the "bsic" set maybe  a good starting point
16:41:38 <mestery> It all comes down to the API user an the choices they make.
16:42:12 <s3wong> michsmit: agree, if a policy is not supported by a particular plugin, logically it should return error
16:43:03 <thinrichs2> mestery: I'm certainly happy to have a language w/o extensions.  But extensions are something to keep in the back of our minds, if we find we need them.
16:43:24 <mestery> thinrichs2: Realistically, I agree.
16:44:10 <uri__> and in the first version, we assume all policies implemented by ONE plugin? any way for few Plugin to implement each a share? Will ML2 for example divide it up among its mechanism drivers?
16:45:17 <mestery> uri__: These APIs will work similar to how the existing APIs work in ML2.
16:45:44 <banix> Well, I suppose if there are multiple segments in a network, the policy implementation may lead to different mechanism drivers.
16:46:02 <mestery> For example, if a single MechanismDriver fails a create call, ML2 will roll things back and clean up the ones which succeeded prior.
16:47:06 <uri__> mestery: so i'm not sure how ML2 will guarantee to teh User all policy has been implemented. i hope in the opensource we see how this happens and how policies are handled by more than one Mech Driver
16:47:49 <mestery> uri__: It can guarantee success by the fact that each MechanismDriver returned success when it was called.
16:48:49 <s3wong> mestery: uri_: and I think that is necessary, otherwise if the policy is only applied partially, it would be a messy state
16:49:24 <mestery> Yes, agreed.
16:49:37 <mestery> OK, so we have about 10 minutes left, and I recored two action items so far.
16:49:52 <mestery> Is there anything else we should focus on this week?
16:49:59 <mestery> With regards to action items for future meetings
16:50:00 <mestery> ?
16:50:48 <banix> The next meeting will be in two weeks. Right?
16:50:57 <michsmit> do we have timelines for the actions ?
16:51:04 <prasad_> are the api definition discussions going to take place on the mailing lists?
16:51:04 <s3wong> Thanksgiving next Thursday :-)
16:51:08 <mestery> banix: I was going to get to that, hold on. :)
16:51:09 <alagalah> mestery: I'm sure you and I will talk before then....
16:51:40 <mestery> #info No meeting next week (11-28-2013) due to Thanksgiving holiday in the US.
16:51:56 <mestery> michsmit: The action items will show up in the meeting logs, and I'll add them to the wiki page.
16:52:01 <mestery> We'll cover those first at our next meeting.
16:52:22 <mestery> prasad_: Mailing list and Google doc. If you want on that, please DM me your google ID so I can add you.
16:53:51 <prasad_> mestery_: prasad.vellanki@oneconvergence.com
16:53:56 <mestery> Thanks prasad_
16:54:05 <mestery> OK, thanks everyone for joining the first Neutron Group Policy meeting!
16:54:13 <alagalah> mestery: thank you
16:54:14 <mestery> Looking forward to continuing to make progress with everyone!
16:54:17 <mestery> #endmeeting