15:00:47 #startmeeting neutron_drivers 15:00:47 Meeting started Tue Dec 1 15:00:47 2015 UTC and is due to finish in 60 minutes. The chair is armax. Information about MeetBot at http://wiki.debian.org/MeetBot. 15:00:49 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 15:00:50 o/ 15:00:51 The meeting name has been set to 'neutron_drivers' 15:01:00 welcome back to some of you 15:01:01 \o 15:01:02 o\ 15:01:03 o/ 15:01:05 o/ 15:01:07 o/ 15:01:18 o/ 15:01:28 * kevinbenton thinks mestery is doing yoga 15:01:38 kevinbenton: That's one interpretation 15:01:57 #link https://wiki.openstack.org/wiki/Meetings/NeutronDrivers 15:02:01 welcome to the uncaffeinated drivers meeting! 15:02:16 indeed 15:02:32 we have 10 triaged bugs to go through and deliberate on 15:02:36 #link https://bugs.launchpad.net/neutron/+bugs?field.status%3Alist=Triaged&field.tag=rfe&orderby=datecreated&start=0 15:03:11 #bug 1023156 15:03:11 bug 1023156 in neutron "[RFE] QuantumDbPluginV2 should support extended attributes on core resources" [Wishlist,Triaged] https://launchpad.net/bugs/1023156 - Assigned to Ihar Hrachyshka (ihar-hrachyshka) 15:03:36 can we timebox at max 5 mins per bug? 15:03:39 ihrachys: you care to comment on this one? 15:03:41 dougwig: we should 15:03:44 armax: aye 15:03:48 dougwig: if we could 15:03:50 o/ 15:03:53 so the bug is to make ml2 extensions not ml2 specific 15:04:14 to have some core resource extension manager that can consume extensions like ml2 extensions and can be integrated into any plugin 15:04:26 integrate once, get more extensions automagically 15:04:39 i like the goal, at least 15:04:40 f.e. for now qos is ml2 specific for that reason 15:04:53 that's been a problem for networking-ovn 15:05:00 well, plugins can dup the code to support it, but it's not ideal 15:05:00 isn't this an end run around the ORM? 15:05:03 do we really want to ml2-fy the core plugins? 15:05:40 armax: how is it ml2-ying anything? it's just making some existing features working for all other plugins. 15:05:46 My vote is to not ml2-fy the core plugins 15:05:50 if anything, it's un-ml2-fying neutron 15:06:11 so now ml2 has become a verb? 15:06:11 mestery: you vote for each plugin to be updated for any 3rd party service plugin? 15:06:19 ihrachys: you’ll have to call methods in a loop don’t you 15:06:20 ? 15:06:30 does ml2-ying mean to allow to dsiable extensions by config? 15:06:44 armax: inside the manager, yes. but in the plugin, you just call to the manager once and it makes the magic. 15:06:45 not that there’s anything wrong with that per se 15:07:00 ihrachys: did you do any PoC investigation on how that would look like? 15:07:08 ihrachys: Nope, not what I want. 15:07:09 o/ sorry, I got distracted and wanted to join 15:07:16 armax: no, and probably I won't have time for that in M due to... you know... stuff 15:07:42 ihrachys: stuff, we all love *the* stuff 15:07:44 magic is bad because it's easily misunderstood/abused 15:07:47 ihrachys: you should be careful 15:07:49 1 min... 15:08:07 armax: our own stuff especially 15:08:21 ihrachys: ok, right now no staffing, plus some concern on the complexity of the resulting implementation 15:08:31 I’ll capture this on the bug report 15:08:40 next 15:08:49 #bug 1438159 15:08:49 bug 1438159 in neutron "[RFE] Make neutron agents less chatty on AMQP" [Wishlist,Triaged] https://launchpad.net/bugs/1438159 15:08:50 so, reading it again, this is enabling filtering across an extension mechanism that already exists, right? 15:09:36 ihrachys, kevinbenton you both commented on this one 15:09:38 thoughts? 15:09:43 armax: I suspect that one is (partial?) dup for kevin's rpc refactoring 15:09:50 kevinbenton: you have the push notification discussion going on 15:09:53 yes 15:09:57 ihrachys: right 15:09:58 looks like a dup 15:10:10 yeah, i think this is already basically going to be covered by RPC callbacks and the stuff i am doing 15:10:30 not exactly a dup, since some stuff there is on top of it, like per agent topic for pushing updates. 15:10:37 ok, I’ll make sure I capture that and clean up any loose end 15:10:48 but it’s definitely related 15:10:54 ihrachys: is it not? 15:10:54 but I don't believe we need RFE for that now until we settle on kevin's work and assess it 15:11:25 armax: it is related 15:11:26 ihrachys: +1 15:11:37 armax: and it should be reassessed after we have rpc refactored 15:11:39 ok 15:11:43 can be closed/postponed for now 15:12:07 #bug 1486388 15:12:07 bug 1486388 in neutron "use timestamp of resources to reduce the agent sync load" [Wishlist,Triaged] https://launchpad.net/bugs/1486388 15:12:31 this is also related, in that it’s proposign a different approach to deal with loadd 15:12:32 load 15:12:55 is this introducing a dependency on ntp, or do we alrady require that? 15:12:59 but I think it’s one or the other 15:13:01 -1 15:13:05 because if your clocks are out of sync... 15:13:18 using timestamps for sync is a workaround for other innefficiencies imo 15:13:30 We don't require NTP 15:13:31 kevinbenton: agreed 15:13:32 But we should 15:13:32 we should be able to fetch 500 things from a DB in short order 15:13:44 yes, should not be an issue after switching to rpc callbacks (assuming we handle raciness for the latter) 15:13:47 if we do this at all, i'd think it should be with sequence numbers, not time. 15:13:50 running a cloud without NTP is a disaster waiting to happen 15:14:04 out-of-sync clocks can create other problems too 15:14:11 Exactly. 15:14:12 dougwig : +1 for seqnumbers 15:14:17 ntp is effectively required already 15:14:17 exactly 15:14:20 fwiw.. 15:14:21 dougwig: lamport clock 15:14:23 even if synced they can drift 15:14:28 Right 15:14:47 yes, time is unreliable as to what is 'newest' without distributed locking that can account for drift 15:14:54 I think this proposal is effectively clashing with some of the things that kevinbenton and ihrachys were talking about eralier 15:15:07 (ala google's spanner paper) 15:15:11 it does. it won't apply once kevinbenton does... stuff 15:15:12 ok, off with it's head. 15:15:15 so for that reason, I’d say ‘wonfix’ 15:15:37 bug 1508243 15:15:37 bug 1508243 in neutron "Store Private Key Passphrase in Neutron-LBaaS for TLS Terminations" [Wishlist,Triaged] https://launchpad.net/bugs/1508243 - Assigned to Doug Wiegley (dougwig) 15:15:53 defer to dougwig :) 15:16:04 everyone wants a pony but no-one is willing to pay for it 15:16:08 that’s the gist on this bug? 15:16:09 are we even considering storing a private key in neutron? 15:16:15 sorry RFE 15:16:21 they were debating this one internally, and i can't say i'm thrilled with the idea of storing passwords in the db. 15:16:38 store it in the description field or as a tag :) 15:16:42 what’s wrong with storing passowrds in clear? 15:16:53 :D 15:16:54 i'd like to talk with adam/rm_work about this one. 15:17:03 just use simple ones 15:17:08 like mysecret123 15:17:14 sex or money or password 15:17:27 if you have nothing to hide, you have nothing to worry 15:17:37 * neiljerram heads off to armax's Gerrit account... 15:17:41 * ihrachys makes notes 15:17:44 salv-orlando: said the man who’s hiding something 15:17:47 neiljerram: exactly 15:17:54 dougwig: ok, I think this needs a spec to say the least 15:18:14 but if no-one is willing/able to staff it…this is dying ‘incomplete’ 15:18:15 armax: ack, but let me vet it first. i'll put it on my list for today. 15:18:18 is that a fair assessement? 15:18:21 ok 15:18:36 what’s the existing workaround today, dougwig? 15:18:56 hm 15:19:01 good question 15:19:01 don't use a passphrase on your tls cert, or it's in barbican. 15:19:20 and i'm not certain why that's not enough. 15:20:07 if so, it is better to be clarified. 15:20:14 aye 15:20:59 ok 15:21:16 #bug 1508384 15:21:16 bug 1508384 in neutron "QoS proxy functions" [Wishlist,Triaged] https://launchpad.net/bugs/1508384 15:21:19 this might be quick 15:21:31 that sounds like a challenge. 15:21:57 I personally don’t see much of an issue to add client support as server capability increases 15:22:07 with no huge benefit for those who add support for new qos rule types 15:22:15 that’s not where the bulk of the cost lies 15:22:27 It makes neutron client more usable 15:22:40 but, it increases the amount of server queries we need to do 15:22:48 ajo: how so, assuming client is updated with new CLI? 15:23:06 may be I got it wrong 15:23:13 also it's something new for neutron to maintain API schema accessible thru REST 15:23:21 but my understanding was that the proxy functions lived on the python-neutronclient 15:23:42 if the qos client support was part of the neutron package, as an extension, couldn't it be updated with the same commit that makes the api change, too? 15:24:07 ajo: see comment #5, David proposes to inspect API schema. 15:24:18 we made similar discussions on finding capabilities. 15:24:23 ahh, ok, I missed that update 15:24:26 * ajo is outdated :( 15:24:36 exposing API schema sounds good to me. 15:25:08 If we expose the API schema, probably isn't something we'd like to do neutron-wise? 15:25:21 amotoki: I can consider it, but then not just for QoS. 15:25:22 I appreciate that there’s the neat way of doing things and the dull way of doing things 15:25:24 ajo: maybe... 15:25:32 if a client library can expose this kind of information, we can use it from CLI, horizon or other stuff. 15:25:40 since you can dynamically extend the client, isn't a better model to put new client feature support where the feature lives, instead of a workaround like api introspection? 15:26:08 if someone wants to go on a quest to rewrite every possible framework we rely on to embrace this working model, sure that’s a possibility 15:26:20 armax: +1 who's paying? 15:26:26 exactly 15:26:28 a client library has two options: define them inside it or fetch them from neutron. 15:26:34 ihrachys: Don Quixote, Inc. 15:27:22 ihrachys: that’s one quesiton, the other question is: what’s the long term gain, and how it related to the short-term one? 15:28:08 how frequently does functionalitiy have to evolve for this working model to be worthwhile 15:28:20 i don't have a strong opinion here, beyond not liking jamming every little thing inside the monolithic client, which doesn't affect this rfe. (though client extensions did exist before qos.) 15:28:22 the initial investment of getting qos capabilities in the client is done already 15:28:41 no idea why we did it in core :) 15:28:56 we could move it away, but it's irrelevant to rfe 15:29:05 and if we had resources to spare I’d rather have someone work on the openstack client for a bit 15:29:33 as a matter of fact there’s an rfe on it too…but that’s much newer and I am going chronologically 15:29:36 armax : +1 15:29:59 ok, let me capture the conversation that we had here and we’ll see 15:30:01 so can we move forward then? or people feel strongly we need API schema right now? 15:30:22 ihrachys: I’d say hold it for now 15:30:27 bug #1511574 15:30:27 bug 1511574 in neutron "[RFE] Support cleanup of all resources associated with a given tenant with a single API call" [Wishlist,Triaged] https://launchpad.net/bugs/1511574 - Assigned to John Davidge (john-davidge) 15:31:06 amuller is not the room 15:31:22 he’s the one who had some concern about this 15:31:23 should it really be API, or local db crawling tool is enough? 15:31:45 ihrachys: it’s gotta be API I think 15:31:53 becxause cleaning up the DB is not enough 15:32:01 you may want to issue RPC messages and all 15:32:12 i think crawling db is not enough. we need to clean up on nodes. 15:32:23 i'd be in favor of adding a purge, and if the eventual cross project definition differs, support that as well. punting a real ops concern for some unicorn definition later seems like just passing the buck. 15:32:26 * ajo asks armax for a slot on 1512587 (QoS/RBAC) and 1461000 (OVS/CT Firewall -status update-) when other priorities are sorted out 15:32:45 dougwig: how bad can they differ? 15:32:49 armax: ok. not that we cannot issue RPC without API calls. 15:32:53 in the simplest of cases the API call should be 15:33:07 armax: agree. purge(tenant). 15:33:11 right 15:33:26 hi 15:33:29 and if not, then we logic is not going to change that dramaatically 15:33:34 hi amuller 15:33:43 someone must have pulled you in 15:33:48 we’re talking about 1511574 15:33:51 bug 1511574 15:33:51 bug 1511574 in neutron "[RFE] Support cleanup of all resources associated with a given tenant with a single API call" [Wishlist,Triaged] https://launchpad.net/bugs/1511574 - Assigned to John Davidge (john-davidge) 15:33:53 yeah Miguel pinged me 15:34:02 I worked on tenant deletion a yearish ago 15:34:03 I remember you had done some work on this already 15:34:04 * ajo whistles... 15:34:05 didn’t you? 15:34:07 yeah 15:34:19 I remember those patches; they were -2'd 15:34:31 they were ahead of their time 15:34:36 amuller: you were a visionary 15:34:38 :D 15:34:42 lol :) 15:34:53 armax: I get that literally every never 15:35:04 so, there's lots of ways of going about that 15:35:09 in the end something like os-purge does the job 15:35:13 right, plenty 15:35:21 we can say it's not Neutron's problem and use an external tool (like ospurge) 15:35:24 oh well some guy tried that a year before amuller I think 15:35:41 oh amuller sorry you’re no longer a visionary, I take it back 15:35:42 salv-orlando : seems like a hard wall 15:35:48 we can listen on the RPC bus for keystone tenant (sorry, project) deletion 15:35:49 salv-orlando: that one was genius, not visionary 15:36:05 but neutron-server may be down when that notification goes out 15:36:10 so you need a 'sync' mechanism 15:36:11 or 15:36:13 you expose it via the API 15:36:35 either way we need a consistent story across openstack 15:36:42 I think there are three positions here 15:36:44 it's a straight-forward definition, it has a volunteer, why would we just punt it? 15:36:58 dougwig: I'm not saying that 15:37:02 dougwig: strongly agree with you 15:37:02 you either have the whole pruning/purging all integrated and fully managed end-to-end 15:37:12 that’s one end of the sprecturm 15:37:19 the other end of the sprectrum is what we have today 15:37:26 the admin is on his/her own 15:37:43 I don't think we should go with the API approach without getting cross-project agreement with Nova and Cinder at the least 15:37:47 the middle ground is, neutron gives you a short-cut to clear tenant resources at once 15:37:53 at a push of a button 15:38:17 amuller: but we can go with a tool that triggers the operation inside neutron-server 15:38:29 amuller: I don’t understand why we’d preclude ourselves the ability to provide the shortcut based on what other projects might do 15:38:40 I mean API wise, even if Neutron does not own tenants, it is fair to assume it manages a TENANT resource on which you can only do GET and DELETE 15:38:44 I can talk to the Nova and Cinder PTL to see where they are on this 15:38:53 amuller: what's the risk of adding one sooner? maybe there's a slightly different cross-project signature, and we support both with the same code for awhile? that seems better to me than leaving ops in the cold. 15:39:03 amuller is probably bringing up a reasonable problem of API consistency 15:39:14 dougwig: I don't know why you assume that other projects would be against this? 15:39:19 it's reasonable to it via the API 15:39:30 Hopefully other projects would arrive at the same conclusion 15:39:40 doing it via RPC has its shortcomings 15:39:55 amuller: i'm just assuming that going cross-project punts it a cycle. 15:39:55 I agree with amuller that consistency will be nice 15:40:01 dougwig: so be it 15:40:04 but other projects had tags on teh api 15:40:16 and they didn’t wait for all projects to ocmply 15:40:28 that begs the question if we need to file a spec to openstack-specs 15:40:30 amuller: correct. For instance a REST API is way easier to integrate into whatever tools ops use than a RPC over AMQP call 15:40:34 and then proceed from there 15:40:48 this has been a problem for years, putting some arbitrary time limit on this and saying screw quality or what's right is misguided 15:40:58 we should do what's right for all of openstack 15:41:03 not just an rfe in neutron 15:41:16 amuller: totally agree 15:41:39 amuller: right, one can proceed with a spec in http://specs.openstack.org/openstack/openstack-specs/ 15:41:48 armax: that sounds great 15:41:52 but work can happen regardless in neutron 15:41:54 amuller: you're right, but this isn't an argument of absolutes. 15:41:59 as the effort to reconcile the two 15:42:01 won’t be hard 15:42:09 yup 15:42:15 there’s really not much to go wrong here IMO 15:42:23 armax: if we introduce an API in Neutron and the cross project effort dies we've screwed ourselves and the entire openstack community 15:42:29 armax: is it a way to say we will 'follow up' on it (never happens)? 15:42:31 the simplest purge(tenant_id) would suffice 15:42:34 and I shall say 15:42:37 purge(project_id) 15:42:47 armax: dougwig: What if John writes the code without the API endpoint 15:42:56 for example a CLI tool would invoke it 15:42:59 as first step 15:43:08 amuller: that wouldn’t be the first time something like that happens 15:43:11 a later step would add an API endpoint that would invoke the exact same code 15:43:29 or maybe we steal a play from other protocols, and let him implement /x-purge, saving the real /purge for the cross project effort, and knowing that one will likely silently call the other. 15:43:33 openstack is not exactly renowned for consistency 15:43:56 armax: and we should do our part to combat that, not accept it as some axiom 15:43:57 at least now we're conscious about it 15:44:02 as a first step 15:44:15 amuller: agree, but that’s the nature of the beast 15:44:26 amuller: you can fight it, but you’ll never kill it 15:44:34 dougwig: whatever... I'd just release note the API as experimental and warn all users that its syntax and/or semantics could change over time 15:44:35 I am for unblocking RFE as long as API is not included in first iteration, and we bring the API topic in cross project specs 15:44:38 we've done that before too. 15:44:45 ihrachys++ 15:44:58 having code that’s unreachable? 15:45:00 what’s the point? 15:45:06 armax: you would reach it via CLI 15:45:14 armax: how is it unreachable? it's avail thru ssh :) 15:45:16 tools/project-purge.sh 15:45:22 ihrachys: I can bring that up with the API WG, but I'm not sure if that is the right place, since it also involves interactions between keystone and everybody else 15:45:29 salv-orlando: the point of an experimental namespace is that you don't break backwards compatibility, but still get to say, "this might change". i hate backwards incompatibiliy. 15:45:35 amuller: even /usr/sbin/neutron-tenant-cleanup 15:45:41 ihrachys: true 15:45:45 ihrachys: you mean project :) 15:45:49 ihrachys: tenant is a bad word now 15:45:56 I am not sure I fully understand 15:45:56 ah 15:46:04 amuller: can you make your proposal on the bug report please? 15:46:04 tenant-- 15:46:07 * ihrachys hits himself hard 15:46:20 dougwig: yeah, I think we're on the same page. I was just pointing out that being the API not so well organized at the moment you might not bother with the exp namespace 15:46:23 armax: we have neutron-linuxbridge-cleanup; we don't expose it thru API 15:46:36 the bad part of having an opinion is action items 15:46:38 ihrachys: but that’s different 15:46:50 i think we're past our timebox on this one. 15:47:00 armax: I'll try to come up with something concrete 15:47:01 yeah, let's give amuller a chance to comment there. 15:47:02 ihrachys: here we have stuff that spans a lot more than one agent 15:47:11 amuller: thanks amuller 15:47:14 armax: hence server side tool 15:47:20 please do move on 15:47:26 yes sir 15:47:48 bug 1512587 15:47:48 bug 1512587 in neutron "[RFE] Role-based Access Control for QoS policies" [Wishlist,Triaged] https://launchpad.net/bugs/1512587 - Assigned to Haim Daniel (hdaniel) 15:48:01 o/ 15:48:05 :) 15:48:15 armax , why do you believe this needs an spec? 15:48:49 https://bugs.launchpad.net/neutron/+bug/1512587/comments/8 15:48:49 Launchpad bug 1512587 in neutron "[RFE] Role-based Access Control for QoS policies" [Wishlist,Triaged] - Assigned to Haim Daniel (hdaniel) 15:48:57 yes, armax , but I didn't fully understand that 15:49:06 it's partly of what the bug is going to fix 15:49:26 the use case sounds more like flavors than rbac. 15:49:29 this is going to provide API changes etc 15:49:30 no? 15:49:43 armax: not finally, we talked about it on the QoS meeting 15:49:55 we were considering the drop of --shared in favor of using rbac directly 15:50:16 instead of --shared on policy, doing rbac access_as_shared * 15:50:17 but 15:50:20 ok, so where is this design discussion being captured? :) 15:50:22 as I told before, you can't drop, it's not compat. 15:50:22 the call was not to introduce api changes 15:50:30 exactly 15:50:43 either spec of devref, someone has to explain how this is going to work 15:51:05 armax , isn't the rfe good enough?, I will go over it and make sure there won't be any api changes 15:51:58 I see the rfe is now unconsistent with what we said on the meeting 15:52:02 ajo: the chance doesn’t sound trivial enough to warrant no information being captured in some forme or another 15:52:22 ajo: i think RFE is a place to discuss what feature we want. it is betetr to discuss how in spec or devref. 15:52:49 armax, ok, I will get it specced then 15:52:53 I am ok with the use case, but I think we need to document somehow the work involved 15:53:06 ok, as long as we're all on the same page, 15:53:07 spec or devref  15:53:15 I didn't fully understand your comment at #8, but now it's clear to me :) 15:53:18 but spec seems the most natural thing as this is very user visible 15:53:33 ajo: sorry, most of the times I talk with my eyes closed 15:53:40 ack, let's go for a spec with the high level details 15:53:44 and type like a monkey 15:54:02 armax : nope, the RFE details were outdated and missleading, I must admit 15:54:08 misleading 15:54:26 ok, so ajo updates the RFE bug and provides a spec. 15:54:29 ok next 15:54:33 bug 1517903 15:54:33 bug 1517903 in neutron "[RFE] Add agent specific API for l2 agent extensions" [Wishlist,Triaged] https://launchpad.net/bugs/1517903 - Assigned to Ihar Hrachyshka (ihar-hrachyshka) 15:54:36 ack 15:54:43 this actually shows as approved in the list of blueprints 15:54:47 for mitaka-1 15:55:17 yeah, saw you approved for M1 already. I agree spec is probably needed. 15:55:27 but I wanted to give the opportunity to talk 15:55:32 before doing the state transition 15:55:37 it's a blocker for qos, sfc, bgpvpn. that's what we know so far. 15:55:37 to rfe-approved 15:56:03 ihrachys: yes we need to execute based on some of the discussions that happened on the summit too 15:56:07 basically, features need access to br-int/br-tun and friends 15:56:11 and do it in l2 agent extensions 15:56:26 which currently lack access to those bridges 15:56:40 ihrachys: tap-as-a-service will likely want to use it too 15:56:44 if many efforts do rely on the ovs agents for delivering functionality 15:56:55 so there is a plan to provide extensions with per agent type API objects that will expose some agent details without exposing too much 15:56:58 it’s only fair to provide some extensibility mechanism 15:57:19 ihrachys , wouldn't a devref be more appropriate? 15:57:23 even though I fundamentally believe there’s a better more radical way to dealing with this 15:57:31 we have etherpad and some oral tales about how it will look like. I need spec/devref to document / notify folks 15:57:37 it's not a user facing feature, but an implementer feature/api 15:57:39 ajo: it could be both :) 15:57:39 ajo: I am fine with devrefs. I like them. 15:58:07 let's do both and steal from spec to devref 15:58:19 unless someone is against extensions, we can move 15:58:21 I gues 15:58:40 that's fine too :) as long as we end with a good documentation for developers, and make it clear it has to be an stable api :) 15:58:49 ok 15:59:01 2 mins left 15:59:16 1 15:59:19 i have one #1468236 15:59:19 I’ll capture the latest discussion on teh bug reports we talked about 15:59:24 #endmeeting