| *** threestrands has joined #openstack-fwaas | 02:27 | |
| *** threestrands has quit IRC | 02:27 | |
| *** threestrands has joined #openstack-fwaas | 02:27 | |
| *** annp has joined #openstack-fwaas | 02:34 | |
| *** yamamoto has joined #openstack-fwaas | 02:37 | |
| openstackgerrit | Tuan Luong-Anh proposed openstack/neutron-fwaas master: Enable hacking-extensions H204, H205 https://review.openstack.org/539776 | 02:47 |
|---|---|---|
| *** hoangcx has quit IRC | 03:18 | |
| *** hoangcx has joined #openstack-fwaas | 03:18 | |
| *** chandanc has joined #openstack-fwaas | 04:58 | |
| chandanc | Hello yushiro | 04:58 |
| *** chandanc_ has joined #openstack-fwaas | 05:08 | |
| *** chandanc has quit IRC | 05:08 | |
| *** chandanc_ is now known as chandanc | 05:08 | |
| yushiro | hi chandanc | 05:46 |
| chandanc | Hello yushiro | 05:46 |
| yushiro | chandanc, Thanks for your great work for CT_zone patch. | 05:46 |
| chandanc | wanted to know how to get the workflow on the patch | 05:46 |
| chandanc | thanks yushiro :) | 05:46 |
| yushiro | 2 days ago, Akihiro and I talked about your patch and he discussed in neutron driver team. | 05:47 |
| chandanc | is it automatic or do i need to ping someone ? | 05:47 |
| chandanc | oh ok, thanks for the help | 05:47 |
| *** threestrands has quit IRC | 05:48 | |
| chandanc | if i need to ping someone, who would be the right person ? | 05:49 |
| yushiro | chandanc, OK, just a moment. | 05:49 |
| chandanc | sure | 05:49 |
| yushiro | chandanc, I think this bug has been set 'queens-rc1' So, the deadline is maybe Feb 05 (https://releases.openstack.org/queens/schedule.html) | 05:52 |
| yushiro | chandanc, So, currently, it's OK to wait I think. | 05:53 |
| chandanc | ok | 05:53 |
| chandanc | sure | 05:53 |
| yushiro | chandanc, Now, I and annp are trying to fix auto-association patch(https://review.openstack.org/#/c/539461/ | 05:54 |
| chandanc | ya i saw that yushiro | 05:54 |
| yushiro | Also, thanks for your review :) | 05:54 |
| chandanc | i will have to read the code more carefully :) | 05:55 |
| yushiro | Thanks. | 05:55 |
| yushiro | A point is a timing 'newly created VM port' | 05:55 |
| yushiro | @registry.receives(resources.PORT, [events.AFTER_CREATE]) handles newly created port but there is no way to judge this is VM port or not. | 05:56 |
| chandanc | hmm, i think the patch is now looking for the owner attribute right ? | 05:57 |
| yushiro | chandanc, correct. | 05:58 |
| yushiro | However, it is not enough only checking 'device_owner' | 05:58 |
| chandanc | s what else need to be taken care of ? | 05:59 |
| yushiro | I think it is also necessary to check 'binding:vif_type'. | 05:59 |
| chandanc | ovs vs LB ? | 06:00 |
| yushiro | Newly created VM port is handles as follows: 1.created(binding:vif_type = 'unbound') --> update_port( called bind_port and associated binding:vif_type = 'ovs') | 06:00 |
| chandanc | hmm, in that case is it not better to listen for port update events ? | 06:01 |
| chandanc | and specifically for a transition from “unbound” to “ovs” | 06:02 |
| yushiro | chandanc, no-no. It's OK to listen update events. In this timing, argument 'kwargs' includes 2 kind of port information. current port dict(after updated) and original port dict(before updating) | 06:02 |
| chandanc | yes, so the orig_port vif==unbound and cur_port.vif==ovs check | 06:04 |
| chandanc | that should be good enough ? | 06:04 |
| yushiro | chandanc, Indeed!! | 06:04 |
| yushiro | chandanc, and check 'device_owner' starts 'compute:...' | 06:04 |
| chandanc | yes | 06:04 |
| yushiro | BTW, I saw my friends on this docment :) Congrats. http://superuser.openstack.org/articles/firewall-service-openstack | 06:11 |
| yushiro | chandanc, xgerman_ :) | 06:11 |
| chandanc | ya it happened yesterday | 06:12 |
| chandanc | i have put it on linkedin :) | 06:13 |
| yushiro | Oh, sure. I'll put +1 in linkedin ;) | 06:19 |
| chandanc | cool :) | 06:20 |
| openstackgerrit | Nguyen Phuong An proposed openstack/neutron-fwaas master: Fix auto associate default fwg https://review.openstack.org/539461 | 06:49 |
| annp | yushiro, chandanc, hi | 06:51 |
| annp | yushiro, chandanc: I've just updated auto associate default fwg. Could you have a look at it? | 06:53 |
| yushiro | Sure | 06:59 |
| *** yushiro is now known as yushiro_afk | 06:59 | |
| annp | yushiro: Regarding to check 'vif_type'=ovs or lb. It should cover in https://review.openstack.org/#/c/536234/, Do you think so? | 07:01 |
| *** AlexeyAbashkin has joined #openstack-fwaas | 07:18 | |
| *** hoangcx has quit IRC | 07:33 | |
| *** annp has quit IRC | 07:33 | |
| *** hoangcx has joined #openstack-fwaas | 07:33 | |
| *** annp has joined #openstack-fwaas | 07:33 | |
| *** AlexeyAbashkin has quit IRC | 07:37 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 07:50 | |
| yushiro_afk | annp yes, but it should be separated by usage. | 07:53 |
| *** yushiro_afk is now known as yushiro | 07:53 | |
| yushiro | a | 07:53 |
| annp | yushiro, Thanks for your comments. I'm updating the patch as your suggestion. I will let you know later. | 07:59 |
| yushiro | annp, oK. I think it's better to be merged this bug first. | 08:00 |
| annp | yushiro, it's better to be merged both patch. | 08:01 |
| yushiro | annp, yes, I said its priority. | 08:01 |
| yushiro | I think this bug is critical | 08:02 |
| annp | yushiro, Got it. I'd like to get both patch in Q-RC1 if possible. | 08:02 |
| openstackgerrit | Nguyen Phuong An proposed openstack/neutron-fwaas master: Fix auto associate default fwg https://review.openstack.org/539461 | 08:24 |
| *** reedip has quit IRC | 08:48 | |
| openstackgerrit | Nguyen Phuong An proposed openstack/neutron-fwaas master: Fix auto associate default fwg https://review.openstack.org/539461 | 10:22 |
| *** AlexeyAbashkin has quit IRC | 10:28 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 10:53 | |
| openstackgerrit | Nguyen Phuong An proposed openstack/neutron-fwaas master: Add checking whether a port is supported by FWaaS L2 driver or not https://review.openstack.org/536234 | 10:56 |
| *** annp has quit IRC | 10:57 | |
| *** Aju has joined #openstack-fwaas | 11:09 | |
| *** chandanc has quit IRC | 11:09 | |
| *** afranc has quit IRC | 11:11 | |
| *** AlexeyAbashkin has quit IRC | 11:33 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 11:33 | |
| *** AlexeyAbashkin has quit IRC | 12:35 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 13:13 | |
| amotoki | hi, when I enable neutron-fwaas devstack plugin, I got the following error | 13:29 |
| amotoki | 2018-02-01 13:20:28.683 | +functions-common:run_plugins:1668 [[ -f /opt/stack/neutron-fwaas/devstack/plugin.sh ]] | 13:29 |
| amotoki | 2018-02-01 13:20:28.687 | +functions-common:run_plugins:1669 source /opt/stack/neutron-fwaas/devstack/plugin.sh stack post-config | 13:29 |
| amotoki | 2018-02-01 13:20:33.281 | tee: etc/neutron/plugins/ml2/ml2_conf.ini: No such file or directory | 13:29 |
| amotoki | 2018-02-01 13:20:33.284 | Error on exit | 13:29 |
| amotoki | Is it only for me? | 13:29 |
| amotoki | more detail log with xtrace http://paste.openstack.org/show/658314/ | 13:54 |
| *** yamamoto has quit IRC | 13:55 | |
| *** SridarK has joined #openstack-fwaas | 13:58 | |
| *** annp has joined #openstack-fwaas | 13:58 | |
| *** hoangcx_ has joined #openstack-fwaas | 14:00 | |
| SridarK | Hi FWaaS folks | 14:00 |
| xgerman_ | Hi | 14:00 |
| SridarK | I think yushiro it is ur turn to run the mtg | 14:01 |
| annp | hi | 14:01 |
| SridarK | thx for updating the etherpad | 14:01 |
| xgerman_ | is he here? | 14:02 |
| *** chandanc has joined #openstack-fwaas | 14:02 | |
| SridarK | i see him online | 14:02 |
| chandanc | hello all | 14:02 |
| SridarK | lets give him a minute | 14:02 |
| amotoki | hi | 14:02 |
| xgerman_ | ok | 14:02 |
| SridarK | yushiro: ping | 14:02 |
| SridarK | ok maybe we can get started | 14:03 |
| amotoki | SridarK: yushiro sends a mail that he cannot join today's meeting | 14:03 |
| SridarK | #startmeeting fwaas | 14:03 |
| openstack | Meeting started Thu Feb 1 14:03:37 2018 UTC and is due to finish in 60 minutes. The chair is SridarK. Information about MeetBot at http://wiki.debian.org/MeetBot. | 14:03 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 14:03 |
| *** openstack changes topic to " (Meeting topic: fwaas)" | 14:03 | |
| openstack | The meeting name has been set to 'fwaas' | 14:03 |
| xgerman_ | #topic Announcements | 14:03 |
| SridarK | amotoki: ah ok thx - sorry i just got up so have not gone thru email yet | 14:04 |
| SridarK | #chair xgerman_ | 14:04 |
| openstack | Current chairs: SridarK xgerman_ | 14:04 |
| SridarK | xgerman_: pls go ahead | 14:04 |
| xgerman_ | #link #topic Announcements | 14:04 |
| xgerman_ | #link http://superuser.openstack.org/articles/firewall-service-openstack/ | 14:04 |
| SridarK | xgerman_: +1 great | 14:04 |
| amotoki | good writing xgerman_ chandanc | 14:04 |
| annp | +1 | 14:04 |
| xgerman_ | chandanc: +1 | 14:04 |
| chandanc | thanks all and xgerman_ | 14:04 |
| SridarK | xgerman_: chandanc: thx | 14:05 |
| xgerman_ | RC-1 is next week - I haven’t heard from Neutron how many RCs they are planning but… | 14:05 |
| xgerman_ | if we get bug fixes in in the next few days they might make it | 14:06 |
| amotoki | no strict plan. RC1 will be cut as usual | 14:06 |
| SridarK | ok | 14:06 |
| amotoki | more RC(s) are on-demand and depending on critical bugs | 14:06 |
| SridarK | shall we get into some outstanding issues | 14:07 |
| xgerman_ | PTG prices are going up BTW today | 14:07 |
| xgerman_ | #topic Queen Bugs/Outstanding issuesd | 14:07 |
| *** openstack changes topic to "Queen Bugs/Outstanding issuesd (Meeting topic: fwaas)" | 14:07 | |
| SridarK | xgerman_: +1 thx | 14:07 |
| annp | SridarK: +1 | 14:07 |
| xgerman_ | thanks amotoki | 14:08 |
| SridarK | i think we have 2 issues | 14:08 |
| SridarK | xgerman_: sorry go ahead pls drive | 14:08 |
| xgerman_ | ok | 14:08 |
| xgerman_ | #link https://review.openstack.org/539461 | 14:09 |
| xgerman_ | there is a problem with auto-associate for the firewall | 14:09 |
| xgerman_ | and | 14:09 |
| xgerman_ | #link https://review.openstack.org/536234 | 14:09 |
| xgerman_ | I think both are pretty close but need some more work | 14:10 |
| SridarK | +1 | 14:10 |
| chandanc | +1 | 14:10 |
| annp | xgerman_, Yes. I have to test more careful. So sorry about previous patch | 14:10 |
| SridarK | annp: no worries - good that we have fix in the works | 14:11 |
| xgerman_ | +1 | 14:11 |
| xgerman_ | at least we found it before the release which is huge! | 14:11 |
| annp | thanks SridarK | 14:11 |
| chandanc | agree | 14:11 |
| SridarK | On 536234 - this will prevent that one combination in the support matrix table | 14:12 |
| SridarK | so with that we should be covered | 14:12 |
| xgerman_ | yes, that is my understanding… | 14:12 |
| *** jhesketh has quit IRC | 14:12 | |
| SridarK | and once ur fix for the auto-associate is done we are in good shape | 14:13 |
| annp | SridarK +1 | 14:13 |
| *** jhesketh has joined #openstack-fwaas | 14:13 | |
| xgerman_ | +1 | 14:13 |
| SridarK | IMHO, 539461 is the higher priority | 14:13 |
| xgerman_ | I am confident we can get both in before release. Worst case we ask for another RC | 14:13 |
| SridarK | the other one can be a potential documentation - worst case - i think u are in good shape to get it in | 14:14 |
| SridarK | xgerman_: +1 | 14:14 |
| annp | xgerman_: i believe we can get merge both patch on tomorrow or next few days. | 14:15 |
| SridarK | annp: +1 | 14:15 |
| xgerman_ | annp: +1 | 14:15 |
| annp | thanks. chandanc: can you help me test 539461 in your environment? | 14:16 |
| xgerman_ | we all should test + verify amotoki ’s problem earlier in the channel | 14:16 |
| chandanc | sure will test | 14:16 |
| xgerman_ | #link http://paste.openstack.org/show/658314/ | 14:17 |
| amotoki | xgerman_: I am now testing with neutron-fwaas devstack only. | 14:17 |
| annp | chandanc, thanks a lot. :) | 14:17 |
| xgerman_ | amotoki: thanks | 14:17 |
| amotoki | previously I enalbed both neutron-fwaas and vpnaas. I am testing with neutron-fwaas only to identify the problem | 14:17 |
| *** yamamoto has joined #openstack-fwaas | 14:17 | |
| amotoki | my devstack just stoped with the same error :( | 14:18 |
| amotoki | will investigate more | 14:18 |
| xgerman_ | ok, thanks — we definitely need to make sure we didn’t break devstack… | 14:18 |
| chandanc | 2018-02-01 13:50:16.085 | tee: etc/neutron/plugins/ml2/ml2_conf.ini: No such file or directory | 14:19 |
| hoangcx_ | amotoki: https://review.openstack.org/#/c/527040/ | 14:19 |
| chandanc | missing / ? | 14:19 |
| hoangcx_ | amotoki: Maybe you encountered same issue with me | 14:19 |
| amotoki | it is missing a leading / but | 14:19 |
| amotoki | NEUTRON_CONF_DIR is defined with / in devstack | 14:20 |
| amotoki | so I am wondering what's wrong | 14:20 |
| xgerman_ | mmh | 14:20 |
| amotoki | note that i am not using neutron-*. I use default q-* now. | 14:20 |
| chandanc | variable not sourced properly may be | 14:20 |
| chandanc | will test | 14:20 |
| hoangcx_ | amotoki: same here. I use q-* | 14:20 |
| amotoki | let's share info if we have more after the meeting | 14:21 |
| xgerman_ | +1 | 14:21 |
| annp | +1 | 14:21 |
| amotoki | I am facing this issue for several weeks and did not fwaas for weeks due to this :( | 14:21 |
| amotoki | btw, I have one more thing to ask. | 14:22 |
| xgerman_ | yeah, we need to get to the bottom of this | 14:22 |
| xgerman_ | sure, go ahead | 14:22 |
| amotoki | I would like to know what is remaining to complete https://blueprints.launchpad.net/neutron/+spec/fwaas-api-2.0 | 14:22 |
| amotoki | I think the drivers team will discuss queens blueprints in tomorrow meeting. | 14:23 |
| amotoki | some status update would be appreciated. | 14:23 |
| xgerman_ | we tried to mark it complete but didn’t have access | 14:23 |
| amotoki | xgerman_: i think everyone can update the whiteboard | 14:23 |
| SridarK | amotoki: there are probab a few items there which are a bit more futuristic - will be good to have some use cases before we prioritize | 14:24 |
| xgerman_ | let’s close that one and file new one for additional features | 14:24 |
| SridarK | but i think with L2 support we are quite complete | 14:24 |
| SridarK | xgerman_: i think the Remote FWG that u started is possibly the one thing that is realistic needed in the near term | 14:25 |
| SridarK | xgerman_: yes i agree - we can put some notes and Close it | 14:25 |
| amotoki | SridarK: xgerman_: can't we file anotehr blueprint on that? | 14:25 |
| xgerman_ | +1 | 14:25 |
| xgerman_ | yes, we can | 14:25 |
| SridarK | amotoki: +1 | 14:25 |
| SridarK | amotoki: so for status i think we can call it complete | 14:26 |
| annp | +1 | 14:26 |
| amotoki | SridarK: xgerman_: could you add some note to the top of the whiteboard of the BP? | 14:26 |
| SridarK | L2 support was the main outstanding item | 14:26 |
| xgerman_ | I added COPLETED ;-) | 14:26 |
| SridarK | amotoki: sure | 14:26 |
| amotoki | SridarK: thanks! | 14:26 |
| amotoki | I see COMPLETED, yay :) | 14:27 |
| xgerman_ | :- | 14:27 |
| annp | :) | 14:27 |
| xgerman_ | ) | 14:27 |
| xgerman_ | #todo (xgerman) File Blueprint for remote FWG | 14:28 |
| xgerman_ | but let’s talk in a few weeks what other features we want for R (e.g. address group) | 14:29 |
| SridarK | xgerman_: +1 | 14:29 |
| SridarK | i would also think to revisit the requirements | 14:30 |
| xgerman_ | +1 | 14:30 |
| xgerman_ | #topic Documentation | 14:30 |
| *** openstack changes topic to "Documentation (Meeting topic: fwaas)" | 14:30 | |
| xgerman_ | A while back we decided to go in-tree with that | 14:31 |
| xgerman_ | and we should have something up before Q gets released… | 14:32 |
| xgerman_ | (at least our compatibility matrix) | 14:32 |
| chandanc | +1 | 14:33 |
| SridarK | And will have time - does this land in like bug fixes ? | 14:33 |
| SridarK | *do we have time | 14:33 |
| xgerman_ | Technically they can publish anytime but they version | 14:34 |
| xgerman_ | amotoki: wondering if you know more about that process | 14:34 |
| -amotoki- is looking at logs.. | 14:34 | |
| -amotoki- was afk for a while | 14:35 | |
| xgerman_ | no worries | 14:35 |
| amotoki | it looks like about doc process | 14:35 |
| xgerman_ | yes, how long do we have for Queen docs? | 14:35 |
| amotoki | in general feature freeze is not applied to doc | 14:35 |
| SridarK | amotoki: ok | 14:36 |
| amotoki | we can update our docs in master and backport them after stable/queens is cut. | 14:36 |
| SridarK | amotoki: ah ok | 14:36 |
| xgerman_ | sweet | 14:36 |
| SridarK | we will need to evaluate if some other ground work in needed for in tree docs | 14:37 |
| xgerman_ | I think we have the skeleton… need to see if we have a doc job… | 14:38 |
| SridarK | ok | 14:38 |
| amotoki | looking at fwaas v2 section in the networking guide, i think we need some basic information about fwaas v2 concept | 14:38 |
| amotoki | as explained in the superuser blog. | 14:38 |
| xgerman_ | +10 | 14:38 |
| SridarK | amotoki: yes agreed - i think we need to lay some foundational things on differences btwn L3 and L2 | 14:39 |
| SridarK | otherwise the API is the same | 14:39 |
| annp | +1 | 14:39 |
| amotoki | if you want, you can maintain your docs in neutron-fwaas repo. it is up to individual teams | 14:39 |
| xgerman_ | we like in-tree | 14:39 |
| amotoki | you can choose etther neutron in-tree or neutron-fwaas in-tree docs. | 14:40 |
| xgerman_ | I also think we need a cookbook style guide with use cases | 14:40 |
| amotoki | if the latter, we can add a link to the netwokring guide and/or installation guide. | 14:40 |
| xgerman_ | we aim for neutron-fwaas-in-tree | 14:41 |
| xgerman_ | amotoki: sounds good | 14:41 |
| SridarK | amotoki: if we are in tree - how will the doc get rendered for a user ? | 14:41 |
| SridarK | Will there be a separate guide for fwaas | 14:42 |
| xgerman_ | #link https://github.com/openstack/neutron-fwaas/tree/master/doc/source | 14:42 |
| SridarK | or will it still get rendered as part of networking guide with content coming from fwaas repo | 14:42 |
| amotoki | SridarK: yes. it will be puslished at docs.o.o/neutron-fwaas/latest or neutron-fwaas/queens/ | 14:42 |
| amotoki | so we need some guide links in networking guide in that case so that reader can easily find contents | 14:43 |
| SridarK | So for the users - it will be separate guide ? | 14:43 |
| amotoki | at now it will be a separate guide | 14:43 |
| SridarK | amotoki: ok so there will be link we need in the networking guide | 14:43 |
| SridarK | but if we put it in neutron - it will show up as a chapter in the networking guide | 14:44 |
| amotoki | i think the toc of networking guide needs to be improved a bit | 14:44 |
| amotoki | SridarK: exactly if we put it in neutron | 14:44 |
| SridarK | amotoki: ok thx | 14:45 |
| amotoki | sfc/vpnaas/bgpvpn/dynamic-routing have similar problems | 14:45 |
| SridarK | xgerman_: do u think it will be better if we put it in neutron so it is more cohesive with the networking guide | 14:45 |
| SridarK | or rather all subprojects should follow a consistent model | 14:46 |
| SridarK | amotoki: may be we should strive for consistency with the other projects - all of us should adopt the same approach | 14:46 |
| xgerman_ | yes, consitency is good but I think having the docs in our tree gives us more autonomy | 14:46 |
| xgerman_ | but I am good with whatever standard we come up with | 14:47 |
| amotoki | SridarK: at now there is no guideline on this according to what we discussed at Denver. | 14:47 |
| SridarK | amotoki: ok | 14:47 |
| amotoki | i think either approach works. most important is to write contents :) | 14:48 |
| SridarK | that i agree :-) | 14:48 |
| hoangcx_ | amotoki: If so, I think neutron doc liaison should define some detail guideline for all subprojects to follow. though? | 14:48 |
| amotoki | hoangcx_: true to some extent :p | 14:49 |
| amotoki | boden is a current liaison | 14:49 |
| amotoki | I am involved in the process much too | 14:49 |
| SridarK | While we work thru that - let me take an action to review what we have and start pulling some things together | 14:49 |
| *** AlexeyAbashkin has quit IRC | 14:50 | |
| xgerman_ | yeah, I was thinking about writing as well | 14:50 |
| SridarK | xgerman_: surely - lets sync up offline | 14:50 |
| xgerman_ | +1 | 14:50 |
| xgerman_ | #topic Open Discussion | 14:50 |
| *** openstack changes topic to "Open Discussion (Meeting topic: fwaas)" | 14:50 | |
| annp | I have one | 14:50 |
| xgerman_ | go ahead | 14:51 |
| SridarK | chandanc: Thanks for getting this in https://review.openstack.org/#/c/538154/ | 14:51 |
| annp | chandanc, xgerman_, sridark: Related to detect sg enable email thread | 14:51 |
| chandanc | SridarK: ya i am close but still stuck with merging | 14:51 |
| *** AlexeyAbashkin has joined #openstack-fwaas | 14:51 | |
| annp | Shall we go with my draft idea for default fwg to resolve problem of sg=noop and fwaas=ovs? | 14:52 |
| chandanc | annp: +1 | 14:52 |
| SridarK | annp: u mean https://review.openstack.org/#/c/536234/ | 14:52 |
| annp | If so, I think we should remove the option https://github.com/openstack/neutron-fwaas/blob/master/neutron_fwaas/services/firewall/fwaas_plugin_v2.py#L39 | 14:53 |
| amotoki | what does sg=noop mean? | 14:53 |
| xgerman_ | there is a noop driver for SG | 14:53 |
| amotoki | so will SG be disabled? | 14:54 |
| annp | SridarK, No related to 536234 | 14:54 |
| xgerman_ | we have this as an option | 14:54 |
| SridarK | annp: yes | 14:54 |
| *** hoangcx_ has quit IRC | 14:54 | |
| xgerman_ | an operator can choose to enable SG, FW, or both | 14:54 |
| annp | amotoki: I mean we set firewall_driver of security group is noop | 14:54 |
| xgerman_ | (or none) | 14:55 |
| amotoki | I see. | 14:55 |
| annp | if we go with my draft idea i think we should remove option auto_associate_default_fwg | 14:55 |
| amotoki | there is 'enable_security_group' option in securitygroups_rpc.py | 14:56 |
| annp | and revert https://github.com/openstack/neutron-fwaas/commit/e5f5c3f44531d2b6c9d813bc8f6d69e685af8c14 this patch | 14:56 |
| xgerman_ | mmh, there was a use case where people wanted FWaaS but only on ports they choose | 14:56 |
| annp | Because I don't want to change behavior of user. | 14:56 |
| xgerman_ | I am not 100% in that camp so removing would be ok for me | 14:57 |
| chandanc | annp: i agree , as soon as the DFWG fix patch goes in | 14:57 |
| xgerman_ | SridarK: thoughts? | 14:57 |
| SridarK | yes we went thru to have some option for users | 14:58 |
| annp | I means fwaas api only allow admin to set or unset port to default fwg | 14:58 |
| amotoki | annp: doesn't it depend on operators' choice? | 14:59 |
| annp | if user want to use security group only, i think user should contact with admin | 14:59 |
| SridarK | if some one does not want to associate the default fwg - then they are relying on SG | 15:00 |
| chandanc | annp: in either case he needs to contact admin | 15:00 |
| SridarK | or they really know what they are doing and relying on perimeter security | 15:00 |
| xgerman_ | yes, the thought of the switch was that operators would be reluctant to switch something on which alters all their ports and wanted to go at a slower pace | 15:00 |
| annp | amotoki: sorry, can you explain more your question? | 15:00 |
| annp | chandanc: +1 | 15:00 |
| amotoki | annp: no problem. I feel there seems several use cases on who can control FWG. | 15:01 |
| amotoki | annp: my point is what happens if operators allow users to configure default FWG by policy. | 15:02 |
| amotoki | annp: but it depends on usecases and we need to summarize usecases. then we can clarify what is the first target. | 15:02 |
| xgerman_ | yeah, I think we need to release and see what the field is doing… | 15:03 |
| xgerman_ | anyhow we are at time… | 15:03 |
| amotoki | hehe | 15:03 |
| SridarK | lets continue in channel | 15:03 |
| annp | amotoki: can we discuss after meeting? | 15:03 |
| amotoki | annp: sure | 15:03 |
| annp | thanks. | 15:03 |
| xgerman_ | I gotta run but will be back in like 30-45 minutes | 15:03 |
| xgerman_ | #endmeeting | 15:04 |
| *** openstack changes topic to "Queens (Meeting topic: fwaas)" | 15:04 | |
| openstack | Meeting ended Thu Feb 1 15:04:06 2018 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:04 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-02-01-14.03.html | 15:04 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-02-01-14.03.txt | 15:04 |
| SridarK | thanks all | 15:04 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-02-01-14.03.log.html | 15:04 |
| annp | Chandanc, SridarK: can we continue discuss? | 15:04 |
| SridarK | annp: we are still thinking of the model where the user can move from default fwg to a user defined fwg | 15:04 |
| chandanc | sure | 15:04 |
| SridarK | and if they remove the user defined fwg - we will apply the default fwg | 15:05 |
| amotoki | annp: I might miss the whole context. is there any pointer so that I can confirm the context? | 15:05 |
| chandanc | SridarK: yes | 15:05 |
| annp | amotoki: take a example for more clear | 15:05 |
| annp | There is 2 compute node: Compute Node A(sg_driver=noop, fwaas_driver=OVS), Compute Node B(sg_driver=ovs, fwaas_driver=ovs) | 15:07 |
| annp | There is 1 controller Node run neutron-server with config auto_associate_default_firewall_group=False | 15:08 |
| amotoki | okay | 15:08 |
| annp | IF there is VM1 and VM2 are landed at Compute Node A, Then VM1 and VM2 are associated with a FWGA, | 15:09 |
| annp | FWGA allow icmp traffic for both direction, | 15:09 |
| annp | The problem here: VM1 can't ping VM2 | 15:09 |
| amotoki | is FWGA a default FWG? | 15:09 |
| annp | sorry, VM1 is associated to FWGA | 15:10 |
| amotoki | okay | 15:10 |
| annp | VM2 doesn't associated to FWGA | 15:10 |
| annp | VM2 is associated to default SG with allow icmp rule | 15:11 |
| annp | We expect VM2 can ping VM1, right? | 15:11 |
| amotoki | on compute node A, SG driver is noop. this means no traffic filtering | 15:11 |
| annp | Yes. | 15:12 |
| amotoki | both FWGA and default SG allow icmp traffic | 15:12 |
| annp | amotoki: yes. | 15:12 |
| amotoki | so only FWG involves traffic control | 15:12 |
| annp | yep | 15:12 |
| amotoki | if the above my understanding is correct, ICMP traffic between VM1 and VM2 should be allowed. | 15:13 |
| annp | yes, your understanding is correct. | 15:13 |
| amotoki | so we can expect VM2 can ping VM1, as you said | 15:13 |
| chandanc | amotoki:annp sorry to jump in between | 15:14 |
| annp | However, the problem VM2 can't ping VM1 | 15:14 |
| amotoki | chandanc: no worries | 15:14 |
| annp | chandanc, no problem. | 15:14 |
| chandanc | let me give some context | 15:14 |
| chandanc | as we are making statefull FW, we need conntrack to see the traffic from the start of the communication, the way to achive this is to apply basic rules to make sure all traffic passes through contrack. we do it using default FWG. other option is to rely on SG to pass the traffic through conntrack, which will fale if SG is runing on noop driver | 15:14 |
| annp | chandanc: thanks. amotoki: that's problem. | 15:15 |
| chandanc | *fail :( | 15:15 |
| amotoki | annp: chandanc: so, is the problem partial conntrack information? | 15:16 |
| chandanc | ya | 15:16 |
| annp | amotoki: If VM1 and VM2 are landed at Compute Node B, VM1 is associated to FWGA and VM2 doesn't associate to FWGA, VM1 can ping VM2 | 15:17 |
| chandanc | we need both the src/dst to be part of some FWG so that conntrack is aware | 15:17 |
| annp | amotoki: yes, | 15:17 |
| SridarK | annp: and this will not happen if we always enable default fwg (and now allow a configurable option) | 15:17 |
| amotoki | hmm | 15:17 |
| annp | SridarK: yes. If we always enabled default fwg | 15:18 |
| chandanc | SridarK: my worry with the option is, if the user enables and disables the option, he will end up with some VMs associated with default FWG and some not | 15:18 |
| annp | and we don't allow normal user unset port from default fwg. The problem will be solved | 15:19 |
| chandanc | s/if the user enables/if the admin enables/ | 15:19 |
| SridarK | chandanc: ah yes that is for admins | 15:19 |
| chandanc | SridarK: yes | 15:20 |
| chandanc | it also means we are forced to throughly test Default FWG :) | 15:20 |
| annp | chandanc: yes. :) | 15:21 |
| SridarK | annp: yes if the default fwg is enabled - when a user unset a user defined fwg for a port - that port will fall back to a default fwg | 15:21 |
| SridarK | assuming default fwg is enabled ^^ | 15:21 |
| annp | SridarK, Yes. that's my draft idea | 15:22 |
| amotoki | basic question: if no SG and no FWG are applied to a port, no conntrack is involved in the packet forwarding? (sorry for my lack of understanding the context) | 15:23 |
| chandanc | SridarK: for “assuming default fwg is enabled ^^” annp is suggesting not giving the option to admin, which i agrre provided we fix Default FWG | 15:24 |
| chandanc | amotoki: yes, | 15:24 |
| chandanc | amotoki: in that case no l3 processing happens | 15:24 |
| amotoki | chandanc: thanks. ovs flow calls conntrack processing | 15:24 |
| chandanc | amotoki: the ovs acts like l2 switch, which is faster | 15:25 |
| amotoki | chandanc: yes | 15:25 |
| chandanc | amotoki: yes | 15:25 |
| annp | chandanc +! | 15:25 |
| amotoki | so when we say "noop SG driver", it is different for iptable case and ovs-fw case. | 15:25 |
| chandanc | as soon as ports become part of SG/FWG l3/conntrack is enabled on the ports | 15:25 |
| amotoki | yeah | 15:26 |
| chandanc | amotoki: SG can be configured with IPtables/Openvswitch/noop | 15:26 |
| chandanc | driver | 15:26 |
| chandanc | in the last case no action is done on the packet | 15:27 |
| chandanc | we have similar case for FWG | 15:27 |
| amotoki | one tricky point is it depends on how it is plugged | 15:27 |
| annp | amotoki: yes | 15:28 |
| amotoki | if hybrid plug is used conntrack will be referred, but ovs native plug is used it is not true | 15:28 |
| chandanc | amotoki: actually ovs native is also using conntrack | 15:28 |
| chandanc | in SG | 15:28 |
| amotoki | chandanc: is it used if SG is enabled? | 15:29 |
| chandanc | yes amotoki | 15:29 |
| amotoki | thanks. my understanding is same | 15:29 |
| amotoki | hm.. I am wondering how we can classify this matrix | 15:29 |
| SridarK | For what it is worth - we did not start with a configurable option for Default FWG | 15:30 |
| chandanc | amotoki: we have one ready with the current combination that can be supported | 15:30 |
| chandanc | and if the conntrack patch in neutron is merged we should be good to support iptables_hybrid | 15:31 |
| chandanc | current matrix, is described here https://docs.google.com/document/d/1JMpJI4ypKwU-p7Dh1wGT_eVstD8QPX9xpmBxXXQifRc towards the end | 15:32 |
| amotoki | good news on devstack. stack.sh succeeds if I disabled neutron devstack plugin and only enable devstack plugin | 15:36 |
| amotoki | there seems a probelm in 'neutron' devstack plugin | 15:37 |
| chandanc | oh | 15:37 |
| SridarK | annp: back to ur original question - the knob enables folks who want try our FWG for L2 but rely on SG for defaults or a safety net | 15:37 |
| SridarK | but yes this is a tricky situation | 15:37 |
| SridarK | I need to step away for a bit to get ready to head to work - but shall we resume some discussion when u start ur day as it is late for all of u | 15:38 |
| annp | SridarK, you mean FWG will run in standalone mode? | 15:39 |
| SridarK | i will monitor logs | 15:39 |
| annp | SridarK, OK. We can discuss via email | 15:40 |
| SridarK | annp: no i am just stating some of the reasons for knob to enable auto association | 15:40 |
| chandanc | amotoki: i think https://review.openstack.org/#/c/538154/ is stuck due to some issue, could you take a look please | 15:40 |
| amotoki | chandanc: http://zuul.openstack.org/ answers to you :p | 15:41 |
| chandanc | oh, was not aware of that, let me check | 15:41 |
| amotoki | chandanc: your patch is in the long 'integrated' queue | 15:41 |
| amotoki | and it stays in the gate queue for 7hr 35min | 15:42 |
| annp | SridarK, if you see my example above, if we giving the option, and if operator configure auto_associate_default_fwg: then FWaaS API won't work correct with VMs at Compute Node A | 15:42 |
| chandanc | amotoki: thanks for the info :) | 15:42 |
| SridarK | annp: i agree | 15:42 |
| amotoki | if parent changes fail, gates for all pending changes will be restarted. this is the reason it takes time | 15:42 |
| annp | So I'd like to remove the option. | 15:42 |
| chandanc | amotoki: thanks i will keep a watch | 15:43 |
| annp | So all vms is always a part of a FWG | 15:44 |
| SridarK | Yes i am not really seeing how else we can get the functionality to work | 15:45 |
| annp | In case: There are some vms don't want to use FWG, admin tenant can unset vms from default fwg | 15:45 |
| SridarK | as i said this configurable option was not the intial intent | 15:45 |
| SridarK | so lets discuss more when u start ur day and get to some closure - so we can move on the fix | 15:47 |
| annp | SridarK: So we should remove the option in Q release? | 15:47 |
| SridarK | Definitely something to consider - I just want to weigh the pros and cons | 15:48 |
| SridarK | I will step away now - i am logged in - will check back in some time - if u guys are continuing the discussion | 15:50 |
| annp | SridarK: I got it. Shall we discuss via email? I guess we need time to thinking | 15:50 |
| SridarK | and we can continue when u are up in ur morning | 15:50 |
| SridarK | annp: yes | 15:50 |
| SridarK | annp: it must be quite late for u too ? | 15:50 |
| SridarK | annp: yes email is fine too - but we have to come to some workable solution for Q | 15:51 |
| annp | SridarK: I understand. :) | 15:51 |
| SridarK | annp: thx for ur diligence on this issue | 15:52 |
| annp | SridarK: not too late for me. But I'm feel sleepy now. :) | 15:52 |
| annp | amotoki, chandanc, Can we discuss via email thread? | 15:52 |
| annp | amotoki, chandanc, Can we continue discuss via email thread? | 15:53 |
| chandanc | sure | 15:53 |
| annp | chandanc, +1 | 15:53 |
| amotoki | sure. I am still catching up with the discussion | 15:53 |
| annp | amotoki, thanks. | 15:54 |
| annp | thanks all and see you tomorrow. | 15:54 |
| chandanc | i will have to go away for diner , lets discuss tomorrow | 15:54 |
| amotoki | chandanc: have a good time :) | 15:54 |
| chandanc | amotoki: you too :) | 15:54 |
| annp | chandanc, enjoy!!! | 15:54 |
| chandanc | annp: thanks :) | 15:55 |
| chandanc | bye all | 15:55 |
| xgerman_ | o/ | 15:55 |
| *** chandanc has quit IRC | 15:55 | |
| annp | xgerman_ hi, we will continue discuss via email | 15:55 |
| amotoki | hoangcx: some info on devstack failure we disucssed in the meeting. http://eavesdrop.openstack.org/irclogs/%23openstack-fwaas/%23openstack-fwaas.2018-02-01.log.html#t2018-02-01T15:36:46 | 15:55 |
| xgerman_ | k | 15:56 |
| annp | xgerman_ :) see you. | 15:56 |
| *** annp has quit IRC | 15:57 | |
| *** SridarK has quit IRC | 16:19 | |
| *** AlexeyAbashkin has quit IRC | 17:40 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 17:41 | |
| *** AlexeyAbashkin has quit IRC | 17:45 | |
| *** SumitNaiksatam has joined #openstack-fwaas | 18:00 | |
| *** yamamoto has quit IRC | 18:17 | |
| *** openstackgerrit has quit IRC | 18:18 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 19:11 | |
| *** yamamoto has joined #openstack-fwaas | 19:18 | |
| *** bbzhao has quit IRC | 19:25 | |
| *** bbzhao has joined #openstack-fwaas | 19:26 | |
| *** yamamoto has quit IRC | 19:29 | |
| *** AlexeyAbashkin has quit IRC | 19:55 | |
| *** SumitNaiksatam has quit IRC | 20:22 | |
| *** hoangcx has quit IRC | 20:24 | |
| *** hoangcx has joined #openstack-fwaas | 20:39 | |
| *** hoangcx has quit IRC | 20:49 | |
| *** hoangcx has joined #openstack-fwaas | 21:03 | |
| *** hoangcx has quit IRC | 21:25 | |
| *** hoangcx has joined #openstack-fwaas | 21:29 | |
| *** hoangcx has quit IRC | 21:33 | |
| *** hoangcx has joined #openstack-fwaas | 21:48 | |
| *** hoangcx has quit IRC | 21:59 | |
| *** threestrands has joined #openstack-fwaas | 21:59 | |
| *** threestrands has quit IRC | 22:00 | |
| *** threestrands has joined #openstack-fwaas | 22:00 | |
| *** hoangcx has joined #openstack-fwaas | 22:13 | |
| *** hoangcx has quit IRC | 22:32 | |
| *** hoangcx has joined #openstack-fwaas | 22:46 | |
| *** mlavalle has joined #openstack-fwaas | 23:03 | |
| mlavalle | xgerman_: would you and Sridar give your opinion about this RFE: https://bugs.launchpad.net/neutron/+bug/1738738? | 23:06 |
| openstack | Launchpad bug 1738738 in neutron "[Neutron][Firewall] Extend FWaaS to provide DSCP filtering" [Wishlist,Confirmed] - Assigned to Reedip (reedip-banerjee) | 23:06 |
| mlavalle | no rush. it doesn't have to be today | 23:06 |
| xgerman_ | looking | 23:07 |
| xgerman_ | I already was positive on it… | 23:08 |
| mlavalle | xgerman_: is this something that the FWaaS team would like implemented in Rocky? | 23:21 |
| xgerman_ | we haven’t done our planning but if reedip wants to work on it we welcome contributions | 23:21 |
| xgerman_ | our main goals are bug fixes, documentation, stadium, tempest tests | 23:22 |
| mlavalle | xgerman_: thanks for the input:-) you going to Dublin? | 23:23 |
| xgerman_ | yes | 23:23 |
| mlavalle | see you there :-) | 23:23 |
| xgerman_ | yep, looking forward! | 23:24 |
| *** SridarK has joined #openstack-fwaas | 23:48 | |
| yushiro | Morning SridarK and xgerman_ Sorry and thank you for yesterday's meeting. | 23:55 |
| xgerman_ | n.p. | 23:55 |
| mlavalle | hey SridarK: if you have a chance, would you please chime in here: https://bugs.launchpad.net/neutron/+bug/1738738? | 23:55 |
| openstack | Launchpad bug 1738738 in neutron "[Neutron][Firewall] Extend FWaaS to provide DSCP filtering" [Wishlist,Confirmed] - Assigned to Reedip (reedip-banerjee) | 23:56 |
| yushiro | I was leaving my company's laptop with logging-in this IRC. So, sorry for confusing. | 23:56 |
| yushiro | mlavalle, Hi. I'll also can go PTG and looking forward to meeting you :) | 23:59 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!