| -openstackstatus- NOTICE: due to unscheduled restart of zuulv3.o.o you will need to 'recheck' your jobs that were last running. Sorry for the inconvenience. | 00:31 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 01:23 | |
| *** AlexeyAbashkin has quit IRC | 01:27 | |
| *** yamamoto has joined #openstack-fwaas | 01:56 | |
| *** hoangcx has quit IRC | 01:58 | |
| *** hoangcx has joined #openstack-fwaas | 02:01 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 02:23 | |
| *** AlexeyAbashkin has quit IRC | 02:27 | |
| *** hoangcx has quit IRC | 02:56 | |
| *** hoangcx has joined #openstack-fwaas | 02:57 | |
| openstackgerrit | Cao Xuan Hoang proposed openstack/neutron-fwaas master: Adopt a new abstract method ha_state_change https://review.openstack.org/512926 | 03:13 |
|---|---|---|
| *** openstackgerrit has quit IRC | 03:22 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 03:23 | |
| *** AlexeyAbashkin has quit IRC | 03:27 | |
| *** annp has joined #openstack-fwaas | 03:37 | |
| *** yamamoto_ has joined #openstack-fwaas | 03:39 | |
| *** yamamoto has quit IRC | 03:42 | |
| *** vks1 has joined #openstack-fwaas | 04:39 | |
| *** vks1 has quit IRC | 04:51 | |
| *** vks1 has joined #openstack-fwaas | 04:53 | |
| *** openstackgerrit has joined #openstack-fwaas | 05:58 | |
| openstackgerrit | Cao Xuan Hoang proposed openstack/neutron-fwaas master: Adopt a new abstract method ha_state_change https://review.openstack.org/512926 | 05:58 |
| *** bzhao has joined #openstack-fwaas | 07:25 | |
| *** doude has joined #openstack-fwaas | 07:39 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 07:57 | |
| *** bzhao has quit IRC | 08:04 | |
| *** bzhao has joined #openstack-fwaas | 08:04 | |
| *** Trident has joined #openstack-fwaas | 08:36 | |
| *** yamamoto_ has quit IRC | 08:37 | |
| *** yamamoto has joined #openstack-fwaas | 08:40 | |
| *** yamamoto has quit IRC | 08:40 | |
| *** yamamoto has joined #openstack-fwaas | 09:07 | |
| *** yamamoto has quit IRC | 09:11 | |
| *** yamamoto has joined #openstack-fwaas | 09:17 | |
| hoangcx | Hi team. FWaaS gate is failing. Is anyone taking care of that? | 09:18 |
| hoangcx | Or I will do it? | 09:19 |
| *** yamamoto has quit IRC | 09:21 | |
| *** yamamoto has joined #openstack-fwaas | 09:28 | |
| *** yamamoto_ has joined #openstack-fwaas | 09:34 | |
| ivasilevskaya | annp, hi. I didn't get your comment in l2 ext driver. | 09:36 |
| ivasilevskaya | annp, what do you suggest to remove and where do you suggest to handle fixed_ips? | 09:37 |
| *** yamamoto has quit IRC | 09:37 | |
| openstackgerrit | Cao Xuan Hoang proposed openstack/neutron-fwaas master: Fix UTs gate failed https://review.openstack.org/512985 | 09:38 |
| annp | ivasilevskaya, in l2 agent patch, we should remove updating fixed_ips format. | 09:39 |
| annp | ivasilevskaya, In l2_driver side we can handle that. | 09:39 |
| hoangcx | ^^ | 09:40 |
| ivasilevskaya | hoangcx: thanks! | 09:41 |
| annp | ivasilevskaya, If you already handle about format of fixed_ips, please ignore this. That's all my suggestion on l2 agent patch. | 09:43 |
| ivasilevskaya | annp: currently l2 agent doesn't do anything with fixed ips format in PS68 | 09:44 |
| annp | what did you change in PS68? | 09:44 |
| ivasilevskaya | annp: there's just port['fixed_ips'] = port.get('fixed_ips', []) | 09:45 |
| annp | yep, Please remove this line. | 09:45 |
| annp | This line no need. that's my suggestion. | 09:46 |
| ivasilevskaya | annp: ok, just rerun the tests first. I might have it there for some reason | 09:46 |
| annp | ivasilevskaya, Sorry but I don't see any reason here :) Any handle should be done in driver side. So we can merge this patch. | 09:47 |
| *** AlexeyAbashkin has quit IRC | 09:49 | |
| ivasilevskaya | annp: how's ovs flows trouble (connectivity issue I found with ovs driver), did you debug it? | 09:52 |
| ivasilevskaya | annp: and just fyi - iptables_hybrid is not deprecated | 09:55 |
| ivasilevskaya | annp: that's a standard setup devstack gives you with neutron | 09:55 |
| annp | ivasilevskaya, sorry again. I haven't had a chance to debug it. Because I need to spent more effort to logging api in neutron. :( | 09:55 |
| *** yamamoto_ has quit IRC | 09:56 | |
| annp | ivasilevskaya, Your information is office? | 09:56 |
| ivasilevskaya | annp: ovsfw driver is extremely cool and promising, but I don't think it will be the default SG driver earlier than in a few cycles | 09:56 |
| ivasilevskaya | annp: my practice, absence of 'iptables_hybrid deprecation' information on the net and in summit notes | 09:58 |
| ivasilevskaya | annp: if you have other information please share | 09:58 |
| annp | ivasilevskaya,https://etherpad.openstack.org/p/neutron-ptg-pike-final L317 | 10:02 |
| ivasilevskaya | annp: and here's the information from the person who implemented it | 10:02 |
| ivasilevskaya | (13:01:49) jlibosva: ivasilevskaya: I think we aim for it but there was no patch to deprecate hybrid option. We merged a patch that supports migration path recently | 10:02 |
| ivasilevskaya | annp: so we'll have to keep in mind we have 2 drivers to support if fwaas ovs driver is to land in Q | 10:03 |
| annp | ivasileskaya, I think it should be discussed in meeting. | 10:09 |
| ivasilevskaya | annp: ok but support hybrid driver is a ton easier than ovsfw one - no other flows to keep in mind | 10:09 |
| annp | ivasilevskaya, Ok, and then? | 10:11 |
| annp | ivasilevskaya, IMO, firewall group should only handle port under a firewall group, right? | 10:12 |
| ivasilevskaya | annp: then we can think about ovsfw. Everything is broken for the easier hybrid case, it's too early to think how to coexist with another driver | 10:12 |
| ivasilevskaya | annp: I'm not saying we should have just 1 driver. I'm just saying we have to deal with the problems one by one - first make fwaas ovs driver working in the easiest case (with iptables_hybrid) and then aim for ovsfw compatibility | 10:14 |
| annp | ivasilevskaya, We should only have 2 case: 1. ml2 is ovs--> security group based ovs | 10:14 |
| annp | 2. ml2 is linuxbridge --> security group based iptables. | 10:14 |
| annp | otherwise, we shoudn't care I think. | 10:14 |
| ivasilevskaya | annp: what's otherwise? :) | 10:14 |
| annp | with case 1: we will have ovs driver for fwg | 10:15 |
| annp | case2: we will propose a iptables driver for fwg later. | 10:15 |
| annp | ivasilevskaya, I think you're caring to much. | 10:16 |
| ivasilevskaya | annp: that might be my last day of working on fwaas and I would like to fix the bug with the openflow pipeline | 10:17 |
| annp | ivasilevskaya, I don't think my comment is difficult to fwg can work with security group base ovs | 10:18 |
| ivasilevskaya | annp: I believe we don't need to add any new flows before we sort out current trouble (and we have plenty of it). That's why I bother much about you wanting to add any more flows when nothing works yet) | 10:20 |
| annp | ivasilevskaya, I think if our driver is not make sense, then we will meet unexpected problem. So Lets make it reasonable. | 10:20 |
| annp | ivasilevskaya, then we can debug something related openflow. | 10:21 |
| ivasilevskaya | annp: this problem isn't related to the driver, smth is wrong with the flow matching rules | 10:21 |
| ivasilevskaya | annp: you will hit it with ovsfw\ovs | 10:22 |
| annp | ivasilevskaya, No problem if driver can work correctly, lets make it reasonable and clean, | 10:22 |
| annp | that mean first, we need to make driver code clean and reasonable, then we can debug that | 10:23 |
| openstackgerrit | Inessa Vasilevskaya proposed openstack/neutron-fwaas master: FWaaS v2 extension for L2 agent https://review.openstack.org/323971 | 10:23 |
| annp | ivasilevskaya, So I'd like you update ovs code first, then we can debug to gather. | 10:24 |
| ivasilevskaya | annp: I have no idea what do you mean but "update ovs code" | 10:25 |
| *** yamamoto has joined #openstack-fwaas | 10:26 | |
| ivasilevskaya | annp: so either you do it yourself, or I locate the bug first and then push a PS with bugfix | 10:26 |
| annp | ivasilevskaya, ah OK. I will do it and share with you if it's make sense we can merge them. | 10:28 |
| ivasilevskaya | annp: you are going to MERGE not working code??? | 10:28 |
| annp | ivasilevskaya, NO no, I mean we can mixed my local patch with your patch. | 10:29 |
| ivasilevskaya | annp: you see we have trouble with the core rules generation. Regardless of what you do with ovsfw support - this trouble won't be fixed. Because packets will still get to table 60 and be dropped in table 63 | 10:30 |
| annp | ivasilevskaya, if my patch can be work and make more sense. | 10:30 |
| ivasilevskaya | annp: and ovsfw (neutron's) rules will be applied afterwards | 10:30 |
| ivasilevskaya | annp: ok, let's cut this conversation - give it a try and let's see, maybe on one of our approaches works out. | 10:32 |
| annp | ivasilevskaya, Have you read my last comment? | 10:32 |
| ivasilevskaya | annp: yes I did. Did you try it? | 10:34 |
| ivasilevskaya | annp: if this solves the connectivity problem - just verify it and file the patch | 10:34 |
| ivasilevskaya | you can even do it using ovs tools only by altering flows at br-int manually | 10:35 |
| annp | ivasilevskaya, I will make it in local and share with you if it works as my expectation. | 10:35 |
| ivasilevskaya | annp: ok | 10:36 |
| annp | ivasilevskaya, thanks for discussion. I'll leave office now. Have a great day ahead. | 10:37 |
| ivasilevskaya | annp: you too! :) | 10:37 |
| *** annp has quit IRC | 10:40 | |
| *** ivasilevskaya has left #openstack-fwaas | 10:51 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 10:55 | |
| openstackgerrit | yangzhenyu proposed openstack/neutron-fwaas master: Enable to use conntrack driver in fwaas_v2 https://review.openstack.org/489980 | 11:03 |
| *** vks1 has quit IRC | 11:17 | |
| *** yamamoto has quit IRC | 11:59 | |
| *** jhesketh_ has joined #openstack-fwaas | 12:38 | |
| *** jhesketh has quit IRC | 12:43 | |
| *** yamamoto has joined #openstack-fwaas | 12:59 | |
| *** yamamoto has quit IRC | 13:07 | |
| *** yamamoto has joined #openstack-fwaas | 13:54 | |
| *** yamamoto has quit IRC | 13:55 | |
| *** vks1 has joined #openstack-fwaas | 14:03 | |
| *** yamamoto has joined #openstack-fwaas | 14:55 | |
| *** vks1 has quit IRC | 14:59 | |
| *** yamamoto has quit IRC | 15:05 | |
| *** vks1 has joined #openstack-fwaas | 15:14 | |
| *** vks1 has quit IRC | 16:07 | |
| *** AlexeyAbashkin has quit IRC | 16:47 | |
| *** vks1 has joined #openstack-fwaas | 16:48 | |
| *** vks1 has quit IRC | 17:59 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 18:19 | |
| *** AlexeyAbashkin has quit IRC | 18:24 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 19:19 | |
| *** AlexeyAbashkin has quit IRC | 19:24 | |
| *** openstackgerrit has quit IRC | 20:17 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 21:19 | |
| *** AlexeyAbashkin has quit IRC | 21:24 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 23:19 | |
| *** AlexeyAbashkin has quit IRC | 23:23 | |
| *** lnicolas has joined #openstack-fwaas | 23:29 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!