19:00:48 #startmeeting networking_policy 19:00:48 Meeting started Thu Mar 20 19:00:48 2014 UTC and is due to finish in 60 minutes. The chair is mestery. Information about MeetBot at http://wiki.debian.org/MeetBot. 19:00:49 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 19:00:50 Hi Kyle and the rest of policy fanatics :) 19:00:51 The meeting name has been set to 'networking_policy' 19:00:55 mestery, all: hi! 19:01:00 hi all 19:01:00 banix: policy fanatics, love it! :) 19:01:06 hi 19:01:11 hi there 19:01:18 #link https://wiki.openstack.org/wiki/Meetings/Neutron_Group_Policy#March_20.2C_2014 Agenda 19:01:29 * mestery considers renaming the meeting "policy fanatics" in honor of banix's comment. 19:01:38 hi 19:01:40 :) 19:01:49 mestery banix: +1 :-) 19:01:50 hi 19:01:55 #topic Action Item Review 19:02:04 A very light action item review to start today. 19:02:18 hello 19:02:19 Just a note to continue updating the model with SumitNaiksatam for folks who haven't done so already. 19:02:37 mestery: we had numerous discussions 19:02:56 mestery: we are making progress 19:03:00 SumitNaiksatam: Very good! Was this all updated in your Google doc/ppt? 19:03:05 If so, can you #link it here? 19:03:17 mestery: yes, and banix has updated as well 19:03:30 mestery: #link https://docs.google.com/a/noironetworks.com/presentation/d/1Nn1HjghAvk2RTPwvltSrnCUJkidWKWY2ckU7OYAVNpo/edit#slide=id.g1c910cf8b_00 19:03:33 Great teamwork! 19:03:46 #link https://docs.google.com/a/noironetworks.com/presentation/d/1Nn1HjghAvk2RTPwvltSrnCUJkidWKWY2ckU7OYAVNpo/edit#slide=id.g1c910cf8b_00 Policy Model Presentation 19:03:49 Thanks SumitNaiksatam! 19:03:53 #topic PoC Brainstorm 19:04:10 I thought it would be good to spend the bulk of this meeting agreeing on the use case(s) we want the PoC to cover. 19:04:13 Does that sound fair to folks? 19:04:19 yeah 19:04:23 high time :-) 19:04:24 yes 19:04:25 yes 19:04:34 Cool. :) 19:04:36 SumitNaiksatam: sorry for reading the updated doc before the meeting; quickly glanced over, how do I specify qos parameters with the new policy-rule structure? 19:04:50 s3wong: still work in progress :-) 19:05:13 The prototype use-case in the blueprint is the 3-tier app, should we focus on that as the PoC use case? 19:05:25 The suggestion to have a use case for the PoC, or essentially having a demo we work towards realizing by the summit time is very good 19:05:30 s3wong: needless to say, feel free to add your comments (you did a lot of work on the actions earlier) 19:05:36 mandeep: That seems reasonable to me. 19:05:56 I think lets step back a bit 19:06:02 with respect to the Poc 19:06:03 Note tho' the real value of the policy framework shows up when we start adding the lifecycle events - and they need to be flushed out better 19:06:11 SumitNaiksatam: yes, I was defining policy-rule originally - the new structure certainly lacks the extensibility that we targeted at that time 19:06:42 we want to show case the capability of the policy framework, so as such we have to demonstrate why using such a policy makes life easier or better 19:06:50 s3wong: ok lets discuss that (as follow up perhaps?) 19:06:58 banix: +1 19:07:00 don't get me wrong, a good start nevertheless :-) 19:07:00 banix: That's ag ood point, aligns with what mandeep is indicating as well. 19:07:39 banix: please go on 19:07:44 the three tier case is good case but I think the punch line would be how we end up realizing it in an application centric way 19:07:45 banix: you have some thoughts? 19:07:58 banix: absolutely 19:07:59 Agreed banix. 19:08:21 so far i think we have been thinking about how we can realize the legacy model using this new model 19:08:22 SO I am saying the power should come out as how easy it is for end users/apps define and deploy these policies 19:08:44 I think both banix and SumitNaiksatam are bringing up good points here. 19:09:15 SumitNaiksatam: Agree, which is necessary but we need to go beyond that 19:09:19 banix: Yes. Clear sepration on app/infra concerns - and automatic deduction of specific low level details 19:09:34 banix: just typing that its necessary but not sufficient 19:09:49 * SumitNaiksatam thinks banix can mind read :-) 19:09:57 man deep, SumitNaiksatam: exactly 19:09:59 mandeep: by lifecycle events, do you mean adding endpoints into a group and having the policy apply auto 19:10:41 hemanthravi: That, and other more dynamic ganges -like new consumers, new infra policy like "inspect all external traffic by IDS", etc 19:12:11 OK, so circling back here, do we need to go beyond 3-tier app for the PoC? 19:12:13 In particular, with initial app creation, then updating the app policy, updating the infra policy, updating connectivity issues (like subnets, routes, service insertion, etc) 19:12:17 mandeep: that would be more a UI functions, our Neutron APIs would still be 'redirect' to service that happens to be IDS 19:12:42 are we saying that we will demo 3 tier model and then show agility of using this for dynamic changes will show the power of group policy? 19:12:45 mestery: I would think if we can do end to end 3-tier app for PoC, that would already be very good 19:12:45 I think if we demonstrate how easily we can deploy a three tier app with a simple heat template with little reference to the nuts and bolts of "networking"" being used that would be a good start. What do you think? There is a few neat things we can build on top of that but is this a good start? other suggestions? 19:13:07 s3wong: In the model, you want to do that without impacting the provider contract since that is an app constraint orthogonal to the app concerns 19:13:13 that is, from Horizon -> Heat template -> Neutron...etc 19:13:33 s3wong: Fair point, just want to make sure everyone is in agreement on the 3-tier app being enough. 19:13:51 s3wong: playing devil's advocate - you can realize the same three tier app using legacy model 19:14:07 banix: Sounds interesting, but adds heat to PoC [tho' it might be worth it] 19:14:22 i think its good to add heat to the PoC 19:14:29 but we have to be careful here 19:14:30 +1 to adding heat 19:14:39 we need to show clear separation of concerns 19:14:41 It stresses the value of the abstractions we have come up with 19:14:41 SumitNaiksatam: absolutely. Reference to banix 's presentation back in the I-Summit; instead of using 20 Neutron APIs, we are now using 5 19:14:57 My concern was not about it being good, but about resources ;-) 19:15:10 mandeep: :) 19:15:16 people often tend to ask as to whether the policy model is merely orchestration, that can be subsumed in heat 19:15:24 i don't agree with that 19:15:29 but if we drive this from heat 19:15:36 Yes, and PoC can answer that question 19:15:39 SumitNaiksatam: and that most of the construct abstracts out the port/address level knowledge 19:15:40 we might loose those people 19:15:47 s3wong: that's what I was going to add, and in that presentation towards the end there are a couple of things that go beyond simple 3-tier 19:16:03 SumitNaiksatam: that is a very good point that point was raised in the summit 19:16:07 sumitnaiksatam: There is a little bit of overlap with heat though 19:16:07 banix: Can you send a link to your presentation? 19:16:20 we need to be clear as to the boundaries 19:16:22 sure. let me dig it out. 19:16:42 prasadv: i agree, and we need to have a crisp understanding of this, which we will, but difficult to convey to others who see this for the first time 19:16:46 and yes I like having heat in it answer questions 19:17:01 prasadv: Yes, that is why we need to be crisp as SumitNaiksatam identified 19:17:03 particularly dynamic changes and instantiation 19:17:33 i would dare to suggest, lets try to bring out the value in this PoC without using Heat 19:17:40 so as not to confuse the audience 19:17:46 #link https://www.openstack.org/summit/openstack-summit-hong-kong-2013/session-videos/presentation/network-abstraction-at-different-layers-of-the-stack 19:17:46 just a thought 19:17:50 +1 19:17:59 besides, per mandeep i am not sure we have the resources either 19:18:04 will find the pdf; watching the video may be painful :) 19:18:19 SumitNaiksatam: I think using application template as a frontend is one of the major advantages of group-policy, no? 19:18:28 prasadv: Exactly. It is in dynamic behavior that policy really differentiates over heat type of ochestration 19:18:29 so it might just be infeasible from a resource perspective to do it (in which case we don't have a choice) 19:18:38 banix: thanks 19:18:45 s3wong: not disagreeing with that 19:19:21 s3wong: but then the policy abstractions are probably lost on the people 19:19:34 It's a fine balance SumitNaiksatam, I agree. 19:19:40 mestery: yeah 19:19:44 SumitNaiksatam: what do you suggest that we show? Let's say we do not use heat, you are suggesting something like a 3-tier app or something different? 19:20:05 okay, so i am just thinking loud 19:20:12 SumitNaiksatam: if not using Heat, we have to pick something else to emphasize (more visually) for people to see the advantage of group-policy 19:20:15 mastery, Sumit: yeah I agree, we need be careful of that concern 19:20:25 Cant we do primary demo WITHOUT heat to clarify policy concept; and than add heat in a last few minute doing same stuff as a quick video? 19:20:28 that issue will come up as it did during the design session 19:20:44 rms_13_: yes, sure 19:21:02 rms_13_: interesting suggestion 19:21:04 s3wong: visually can be achieved with horizon integration, no? 19:21:37 ok, i also don't want us to miss the main point of this discussion, which is the use case 19:21:37 SumitNaiksatam: perhaps visually is a poor way to say it - to demo the ease of operation via group-policy 19:21:52 yes lets focus on the use case 19:21:55 sumitnaiksatam: we would need a policy builder in UO right? 19:21:59 *UI 19:22:02 we can decide on heat or not later 19:22:29 prasadv: well, at least some representation 19:22:38 so coming back to the use case 19:22:40 We do have a PoC doc, should this discussion move to that doc? 19:22:50 SumitNaiksatam: Please go ahead; Do you have any particular use case in mind 19:23:12 mandeep: yeah we can put thoughts on the doc 19:23:38 SumitNaiksatam: use case? 19:23:39 3-tier app is something which people would relate to very easily as a use case. Solving that end to end + "just mentioning" few more should suffice 19:23:59 s3wong banix: it was more of a question 19:24:12 i think 3-tier is good, but the same can be shown with a single tier as well 19:24:40 SumitNaiksatam: please elaborate 19:24:55 so let's develop that single tier use case a bit further 19:25:03 s3wong: i mean the benefits we are trying to show for the policy model 19:25:30 s3wong: multiple tiers would be an extension of that 19:26:02 but really, the benefit should be evident even with a single tier 19:26:13 i am not saying that we will not show 3-tier 19:26:36 but for our own understanding, i think we need to flesh out a single tier 19:26:42 workflow, etc 19:26:47 let's see what we have in that single tier, so we can decide ... 19:27:04 SumitNaiksatam banix: for those who are interested, the ODL project google doc has TONS of use cases 19:27:05 banix: go ahead 19:27:12 #link https://docs.google.com/document/d/12Z1JHhCFS6ta-ux3UdUbFaEPzAig_3Xgnbj29Nejfug/edit 19:27:17 s3wong: thanks 19:27:19 i think showing single tier with redirection and allow/deny would be good to show? 19:27:20 * mestery has walked through those use cases far too many times. :P 19:27:27 then we can see if we need to build on it to make it more interesting (assuming we have time to do that) 19:27:56 Sumit: That was more of a suggestion to you :) 19:27:56 mestery: i think stands out to you from venturing there? 19:28:09 *anything 19:28:10 in a way that is 2 tier - service tier and app tier 19:28:24 prasadv: that makse more sense 19:28:40 SumitNaiksatam: I think we should try to keep it simple at first to prove the points as you say, then see how far we can take it. Sound good? 19:28:41 I think that is probably what Sumit and others mean by a single tier 19:28:55 agreed 19:28:55 mestery: yes 19:28:57 so internal users go through simpler service tier and external users go through more secure tier? 19:29:10 Agreed banix 19:29:10 prasadv: yes 19:29:23 we show case tags, classifers etc 19:29:28 prasadv: that probably already requires labels, right? 19:29:40 not tags but labels 19:29:41 let's not get into details of how we do it 19:29:48 Yes, the doc can have details right? 19:29:54 that looks like a data center access use case 19:30:16 right, let's focus on what we want to demo such that we showcase the power of policies. makes sense? 19:30:29 mestery: banix: Yes, let move this to doc, IRC is probably not the best way to work out the PoC details 19:30:39 nbouthers_: it is application deployment use case 19:30:45 #action Team to flesh out PoC details in doc 19:30:47 then we go back to work as how we can realize that demo 19:30:52 mandeep: Do you have the link for that doc we can post here? 19:31:10 mestery: let me get it. 19:31:14 Thanks mandeep! 19:31:16 https://docs.google.com/a/midokura.com/document/d/14UyvBkptmrxB9FsWEP8PEGv9kLqTQbsmlRxnqeF9Be8/edit 19:31:20 here it is :-) 19:31:41 the great PoC doc :-) 19:31:46 #link https://docs.google.com/a/noironetworks.com/document/d/14UyvBkptmrxB9FsWEP8PEGv9kLqTQbsmlRxnqeF9Be8/edit 19:31:47 s3wong: thanks :-) 19:32:01 s3wong: thanks 19:32:01 with about 5 lines of text :-) 19:32:03 Thanks s3wong and mandeep! 19:32:05 Ha! 19:32:05 :) 19:32:23 if you have to make a start somewhere :-) 19:32:59 SumitNaiksatam: as you can see we had no idea what we wanted to demo :-) 19:33:09 yeah, so prasadv: can you elaborate as the use case you mentioned 19:33:18 s3wong: :) 19:33:26 s/as/about 19:33:26 s3wong: i guess its called evolution :-) 19:33:36 organic evolution 19:33:49 banix: I was thinking we can deploy a app tier say lamp stack with redirection to service layer 19:34:07 say a firewall 19:34:23 prasadv: thanks 19:35:02 just thinking aloud around single tier showcase 19:35:06 prasadv: or firewall+lb? :-) 19:35:23 thinking outloud for PoC timeframe - API we can do whatever we want, so the limiting factor is OVS 19:35:34 cgoncalves: yes, some appliance(s) 19:35:44 prasadv 's suggestion seems to be feasible for OVS support POV 19:35:56 I think with a use case like the above we may run into ta question like: couldn't you do that today, using fwaas for example 19:36:25 banix: true, it is also not really "application" perspective... 19:37:25 banix: You could. The claim is that it is a higher level description on intent that may be realized using existing capabilities (or we can create new ones) 19:37:26 i am hoping it to be more than Fwaas with connectivity groups, Allow/deny 19:38:01 mandeep: yes, exactly, somehow we have to showcase that aspect of what we are doing 19:38:18 banix: Agreed 19:38:46 Using Heat is a convincing option (again assuming we have time to get there); if not what other options do we have 19:39:04 just asking the question 19:39:29 use case should be from user perspective. So it should start with "I am an app owner, I want to deploy an app... 19:39:39 i think of to consider the "app developer" role 19:39:45 * i think we have to 19:39:46 s3wong: I agree 19:39:47 prasadv: I think a single firewall would be fine, the point that we need to demonstrate is how we get to deploy it 19:39:53 s3wong: exactly 19:40:11 lets not get into the capabilities of services 19:40:12 s3wong: agrees 19:40:20 SumitNaiksatam: Agreed 19:40:20 i think that is bit orthogonal 19:40:39 mandeep earlier mentioned about lifecycle events 19:40:40 yes, the service itself not that important 19:40:52 any service would do; even one i think is fine 19:40:56 i think that is tied into the "app developer's" role 19:41:14 in the sense that, what he has to do today with the legacy abstractions 19:41:24 versus what he would have to do with the new policy abstractions 19:41:25 can you state the lifecyle events again 19:41:42 i will conveniently punt that to mandeep :-P 19:41:46 or I can go back above and read what you had said :) 19:42:05 SumitNaiksatam: agree - very simply, if I add a VM into my application pool, I need to connect vport to network, update security group...etc 19:42:08 1. Create (where the intent is expressed and low level automation is done) 19:42:19 s3wong: yes, nicely put 19:42:23 Just thinking loud here: would it make sense to create a video of achieving our use-case by today's model. Than explaining and demoing ease/differentiation policy provides for doing same thing? 19:42:25 now you can simply do it via automatically adding the new VM vport in a EPG 19:42:29 2. Update app behavior - Say updates to contarcts 19:42:38 3. Updates to infrastructure 19:42:39 rms_13_: good point, we should 19:42:48 4. Dynamic binding 19:42:59 rms_13_: sure but lets see what use case we pick first 19:43:09 +1 to that rms_13_. 19:43:22 5. Infrastructure based modulation (say QoS or path selection or service selection) 19:43:50 mandeep: perhaps you can add to the doc, i think we all need to be on the same on this basic understanding 19:44:20 Yes, I will do that 19:44:28 So I had this simple example, would that be a simple case of what you are describing' this example: 19:44:38 currently we don't have a "app developer" role in neutron 19:44:41 mandeep: thanks 19:44:52 banix: go ahead 19:45:37 maybe we should have an action item to have couple of proposals presented by individuals or groups next week 19:45:49 * s3wong waiting on banix... :-) 19:45:56 You specify a policy where you employ a loadbalancer between two groups (a provider and a consumer in new model); then adding a new endpoint to the group will automatically lead to the loadbalancer to adding it to its pool 19:46:04 * banix is slow 19:46:28 * SumitNaiksatam knew banix was coming up with something deep 19:46:37 banix: that seems to require us to add members to the pool for an LBaaS instance 19:47:04 which isn't one of our defined actions at this point... 19:47:23 s3wong: loadbalancer config will be required but thats orthogonal 19:47:33 s3wong: yes but the point is you don't do it (at the user level), it happens because of the policy being there 19:47:52 banix: i think you will still required the LB config 19:47:57 *require 19:48:05 banix: but how is it represented by what we have in group-policy today - that is, how do I set up such contract? 19:48:07 banix: but there is still value here 19:48:44 yes to all the above but that is the type of thing lifecycle events man deep was explaining would do? 19:49:20 banix: true, perhaps not use the loadbalancer 19:49:50 banix: just say, add another VM to the end point group? 19:49:59 exactly 19:50:07 banix: or another end point, that is 19:50:20 that's what I said or thought i was saying 19:50:25 SumitNaiksatam: now that makes sense, as a new endpoint to EPG will automatically get the new endpoint to inherit all the policy atrributes 19:50:51 "then adding a new endpoint to the group " 19:50:59 banix: I think we need to get this all in doc, there are too many issues here to get into on the IRC (I am an IRC newbie) 19:51:15 "will automatically lead to" 19:51:17 yes 19:51:33 mandeep: yeah, difficult to do this without diagrams :-) 19:51:42 or whiteboard :-) 19:51:55 so the question is not this particular example but is this what we want to aim for 19:52:02 this type of capability, i mean 19:52:25 OK, so at this point, should we just focus on getting this into the doc? 19:52:30 yeah, i think banix is validating the understanding of "lifecycle events" 19:52:32 It seems we have only 8 minutes left anyways. :) 19:52:35 I have writeup of mucb of this tbat Im drafting for ODL GBP and ONF NBI ( how gbp info model achieves a bunch ofuse cases) 19:52:41 banix: yes, this simple use case should demostrate ease of operation of GBP 19:52:49 mestery: can we move this meeting up an hour? 19:52:52 banix: Yes, we need to aim to show value as you identified, but I think we are getting mixed up with the scope issues (say LBaaS is included in POC or not) 19:53:05 for people who are making trek to noiro for ODL group policy meeting 19:53:20 prasadv: OK, let me look into that. 19:53:29 #action mestery to look at moving meeting up one hour. 19:53:30 Hmm... what is openstack-meetin talking about? I am a bit lost 19:53:38 s3wong: Same here. 19:54:03 mestery:thanks 19:54:11 openstack-meetin: can you identify yourself? ;-P 19:54:35 prasadv: amazing, I am OK with the time - being in the ODL meeting couple minutes late isn't a big deal - as webex setup typically takes that much time anyway :-) 19:54:46 Sorry dave lenrow, new irc client 19:55:01 Openstack-meetin: I am what controls everything from behind the scene: I am openstack! 19:55:05 just kidding 19:55:23 Ha! I like the nic openstack-meetin ;) 19:55:27 OK, 5 minutes left folks. 19:55:29 Almost out of time 19:55:31 Should we move to the document at this point? 19:55:38 #topic Closing Thoughts 19:55:39 mestery: absolutely 19:55:47 OK, cool. 19:55:53 yes but we need to close on this rather quickly. right? 19:56:29 dlenrow: welcome! 19:56:37 I will work with SumitNaiksatam on policy-rule definition refinement 19:56:44 banix: agree 19:56:46 I want to get doc aligned to neutron GBP POC work 19:56:58 dlenrow: That's a good goal! 19:57:10 dlenrow: which doc? 19:57:22 dlenrow: any loiters will be helpful 19:57:26 pointers 19:57:47 dlenrow: which doc are you referring to? 19:57:59 Doc Im drafting for ODL GBP (next call) 19:58:05 :) 19:58:15 dlenrow: Got it 19:58:34 * s3wong has no idea there is another doc for ODL project, but whatever :-) 19:58:44 s3wong: Docs for everyone! :P 19:58:51 OK, lets call this meeting now. 19:59:01 Lets get the PoC use case doc finished for next week's meeting if we can. 19:59:02 Sound good? 19:59:10 let's work on the poc use case through email 19:59:11 yeah 19:59:11 mestery: as you know, we started off with a doc which now points to another doc :-) 19:59:23 s3wong: Doc abstraction :) 19:59:25 s3wong: lol! 19:59:27 OK, thanks folks! 19:59:29 #endmeeting