| SpamapS | SamYaple: non-tunneled means what? | 00:34 |
|---|---|---|
| *** masuberu has quit IRC | 00:35 | |
| *** masuberu has joined #openstack-kolla | 00:37 | |
| *** ipsecguy has quit IRC | 00:39 | |
| *** caoyuan has joined #openstack-kolla | 00:40 | |
| *** xinliang has quit IRC | 00:41 | |
| *** litmaj0r has joined #openstack-kolla | 00:41 | |
| litmaj0r | hello! i'm trying to wrap my mind around pre-reqs for kolla-ansible deployment | 00:42 |
| litmaj0r | I'm deploying multinode, but when I kick off the prechecks playbook, it looks like it's expecting the pip package "kolla-ansible" on the remote machines ... but this strikes me as odd considering the deployment seems to be docker oriented | 00:44 |
| litmaj0r | further, the docs really don't call out what to install aside from docker ... does it assume certain things exist (e.g. python, kolla-ansible)? | 00:44 |
| litmaj0r | logically, It seems like a deployment host ("host that I deploy kolla containers from") would need pythonm ansible, and kolla-ansible installed when hosts-deployed-to only need docker ... what am i missing? | 00:47 |
| *** tovin07_ has joined #openstack-kolla | 00:51 | |
| *** ipsecguy has joined #openstack-kolla | 00:51 | |
| SamYaple | SpamapS: not-tunneled through libvirt. qemu to qemu | 00:53 |
| SpamapS | SamYaple: is there a document on that? because the ones I find are about libvirt. | 00:53 |
| *** xinliang has joined #openstack-kolla | 00:54 | |
| SamYaple | libvirt does not do live migration. qemu does. libvirt *can* tunnel the data if needed at a big performance impact | 00:54 |
| SamYaple | but at the endofthe day, qemu isthe one doing the livemigration and can do it without libvirt | 00:54 |
| *** zhubingb_ has joined #openstack-kolla | 00:55 | |
| SamYaple | so with that in mind, libvirt (just like memcached) should be on a private non-routable network | 00:55 |
| SamYaple | tls becomes less important | 00:55 |
| *** calbers has quit IRC | 00:56 | |
| SpamapS | private non-routable isn't security. ;) | 00:57 |
| SamYaple | it absolutely is | 00:57 |
| SpamapS | it's a great way to isolate your compromise to just your internal employees, which are responsible for *most* security compromises. | 00:57 |
| SpamapS | So, yeah, TLS is important to us. | 00:57 |
| SamYaple | also, memcached and ceph have 0 security and rely entirely on network security fyi | 00:57 |
| SpamapS | memcached has auth available and has for years, though I don't know if OpenStack makes use of it yet. Ceph has CEPHX auth, though maybe kolla-ansible doesn't use that. | 00:58 |
| SpamapS | https://github.com/memcached/memcached/wiki/SASLHowto | 00:59 |
| SamYaple | cephx is auth, not encryption. and that doesnt affect the backend network which transfers everything in the clear | 00:59 |
| *** zhubingb_ has quit IRC | 00:59 | |
| SamYaple | memcached sasl is only auth too | 01:00 |
| SamYaple | not end to end encryption as your link clearly states | 01:00 |
| SpamapS | so, 1 component of this complex system relies on dedicated network security, and thus, the entire system is exposed? | 01:00 |
| SamYaple | ive named 2 so far | 01:00 |
| SpamapS | We don't use Ceph here.. and would likely set it up with ipsec tunnels if we did. | 01:00 |
| SamYaple | well you can do that. whats the problem here? | 01:00 |
| *** pengdake_ has joined #openstack-kolla | 01:01 | |
| SpamapS | oh and the memcached sasl auth + encrypted key/values should be sufficient. | 01:01 |
| SamYaple | not all services encrypt the values | 01:02 |
| SamYaple | thats up to the client | 01:02 |
| SpamapS | Agreed, that's a little bit scary. ;) | 01:02 |
| SamYaple | nova consoleauth being the biggest offender here | 01:02 |
| *** zhangfei has joined #openstack-kolla | 01:02 | |
| SamYaple | youre welcome to add tls support, but its not been a priority since memcached and ceph (which most of openstack does use) needs proper network isolation anyway. most just use that to provide the security they need for the services | 01:03 |
| SpamapS | anyway, I acknowledge there are holes. I do not, however, agree that it's ok to let the whole system security slide because some corners are less secure than others. | 01:03 |
| SamYaple | and afaik openstack doesnt support memcache sasl for what its worth | 01:03 |
| SamYaple | i happen to disagree that non-tls libvirt on a properly isolated network is letting "the whole system security slide". but thats not really relevant here | 01:04 |
| SamYaple | i said initially you should add it | 01:04 |
| SpamapS | Oh I'm actually referring to all the things I see in kolla-ansible on that level. | 01:04 |
| SamYaple | oh yea im sure it could use some... love | 01:05 |
| SpamapS | All the API's are also setup to be http:// | 01:05 |
| SamYaple | configurably..... | 01:05 |
| SpamapS | and I've already pushed up a patch to fix that | 01:05 |
| *** zhaochao has joined #openstack-kolla | 01:05 | |
| SpamapS | no not configurably | 01:05 |
| SamYaple | oh you found a bug? | 01:05 |
| SpamapS | without my patch, internal API's are always http | 01:05 |
| SpamapS | https://review.openstack.org/#/c/548407/ | 01:06 |
| SamYaple | oh yea i dont think the internals were ever properlly ssl'd | 01:07 |
| SamYaple | but thats because eventlet sucks | 01:07 |
| SamYaple | much easier with wsgi | 01:07 |
| SpamapS | it's not eventlet though | 01:07 |
| SpamapS | it's just haproxy | 01:07 |
| SamYaple | you cant ssl the internal services with just haproxy | 01:07 |
| SamYaple | haproxy is the client to the internal services | 01:07 |
| SpamapS | Right, so this patch is 80% of the way there | 01:08 |
| SamYaple | the internal services (eventlet/wsgi) have to have teh ssl | 01:08 |
| SamYaple | lol its not even 20% | 01:08 |
| SpamapS | we also need to drop the backend servers to just 127.0.0.1 when this is set | 01:08 |
| SamYaple | but its worth the effort | 01:08 |
| SamYaple | i would sugget doing it with teh wsgi work though | 01:08 |
| SpamapS | and let an external LB do the spreading/failing over. | 01:08 |
| SpamapS | Anyway haven't finished designing it just yet. | 01:10 |
| SpamapS | I'll take a look at the wsgi | 01:10 |
| SpamapS | Might simplify what I'm attempting. | 01:10 |
| *** itlinux has joined #openstack-kolla | 01:10 | |
| *** david-lyle has joined #openstack-kolla | 01:10 | |
| *** masahisa has quit IRC | 01:11 | |
| SpamapS | SamYaple: I'm still a little confused at how I tell nova not to use libvirt for migrations. | 01:11 |
| SpamapS | And would def appreciate pointers to docs | 01:12 |
| SpamapS | the docs I read have it going through libvirt. | 01:12 |
| SamYaple | you sound like you dont want that | 01:12 |
| SamYaple | since qemu-qemu is not encrypted authed or anything | 01:12 |
| SpamapS | I want to understand. :) | 01:12 |
| SamYaple | sounds like you *want* to force the super slow tunnelled stuff (it really will cripple performance) | 01:12 |
| SpamapS | We might decide to ipsec that network if it would perform better than TLS'd libvirtd. | 01:13 |
| *** pengdake_ has quit IRC | 01:14 | |
| SpamapS | Or we might just tell management we're going to have to accept the risk and build a stronger border. My point is.. the docs I've found aren't helpful here. | 01:14 |
| SamYaple | let me find the nova option | 01:16 |
| SamYaple | https://github.com/openstack/nova/blob/9e391b06c38cd95a348fc54a6314dbf55bb27380/nova/conf/libvirt.py#L313 | 01:16 |
| logan- | I don't know anything about how to configure it in kolla but I just saw the convo while flipping thru channels.. fwiw here is an example using libvirt tunneled migrations over ssh: https://github.com/openstack/openstack-ansible-os_nova/blob/52d075839dc9ce96151ae6e2c40df6dcad5b0423/templates/nova.conf.j2#L274-L275 | 01:17 |
| *** zhangfei has quit IRC | 01:18 | |
| SpamapS | we're trying to avoid SSH | 01:18 |
| SpamapS | would rather one hypervisor escape doesn't lead to all-hypervisor-compromise. | 01:19 |
| logan- | fair enough then yea enable libvirt tunneled migrations in nova and config libvirt for tls listener | 01:19 |
| SpamapS | Also in our tests the performance was perfeclty acceptable. | 01:20 |
| *** kbaegis has quit IRC | 01:20 | |
| SamYaple | i bet yo uwerent using tunneled migration lol. the performance really is terrible | 01:21 |
| SpamapS | We saw transfers of VMs at 300Mbps .. it wouldn't really matter to us if it were 3x faster. | 01:21 |
| SpamapS | we were | 01:21 |
| SpamapS | looking at the docs | 01:21 |
| SamYaple | yea defeinetely not using tunneled if you got 300 | 01:21 |
| logan- | tunnelled performs fine for us also tbh | 01:21 |
| SpamapS | Oh haha.. you know what | 01:22 |
| SpamapS | block_migration_flag=VIR_MIGRATE_UNDEFINE_SOURCE, VIR_MIGRATE_PEER2PEER, VIR_MIGRATE_LIVE, VIR_MIGRATE_NON_SHARED_INC | 01:22 |
| SpamapS | PEER2PEER == not tunneled I bet | 01:22 |
| SamYaple | SpamapS: yea and that entire flag is deprecated (removed?) so you may not even be using it | 01:22 |
| *** masahisa has joined #openstack-kolla | 01:22 | |
| logan- | all of those options were reworked in newton | 01:22 |
| SamYaple | itll default to non-tunneled | 01:22 |
| logan- | yeah | 01:23 |
| SpamapS | this was a test on Liberty | 01:23 |
| SpamapS | we're standing up Pike now with kolla-ansible. | 01:24 |
| *** hongbin has joined #openstack-kolla | 01:24 | |
| SpamapS | funny because a lot of the effort spent was in configuring libvirt tls | 01:24 |
| * SpamapS playing telephone through 3 devs... now figuring out what really happened in the test. :_P | 01:25 | |
| *** pengdake_ has joined #openstack-kolla | 01:25 | |
| openstackgerrit | zhongshengping proposed openstack/kolla-ansible master: Error path of WSGIScriptAlias of panko for ubuntu https://review.openstack.org/550299 | 01:26 |
| SpamapS | SamYaple: thanks for the info. Sorry for the somewhat combative tone this might have had. Security is always a silly thing to argue about when what we really mean by "that's not secure" is "that carries more risk than I am comfortable with". | 01:28 |
| *** zhangfei has joined #openstack-kolla | 01:31 | |
| *** itlinux has quit IRC | 01:42 | |
| litmaj0r | per my last message, if anyone is following, it looks like the "Detect openstack_release variable" task (/usr/local/share/kolla-ansible/ansible/site.yml) runs this as local_action, which clarifies the "where is kolla-ansible installed" question a bit | 01:44 |
| *** zhurong has joined #openstack-kolla | 01:45 | |
| *** david-lyle has quit IRC | 01:47 | |
| openstackgerrit | caoyuan proposed openstack/kolla-ansible master: Optimise the destroy role by script module https://review.openstack.org/534079 | 01:48 |
| *** dave-mccowan has joined #openstack-kolla | 01:56 | |
| *** litmaj0r has quit IRC | 02:00 | |
| *** tovin07_ has quit IRC | 02:03 | |
| *** zhaochao has quit IRC | 02:06 | |
| *** pengdake_ has quit IRC | 02:13 | |
| *** harlowja has quit IRC | 02:13 | |
| *** tovin07_ has joined #openstack-kolla | 02:17 | |
| *** zhaochao has joined #openstack-kolla | 02:20 | |
| *** itlinux has joined #openstack-kolla | 02:22 | |
| *** pengdake_ has joined #openstack-kolla | 02:23 | |
| *** pengdake has joined #openstack-kolla | 02:32 | |
| *** pengdake_ has quit IRC | 02:33 | |
| *** caoyuan has quit IRC | 02:33 | |
| *** itlinux has quit IRC | 02:36 | |
| *** chmarkus has quit IRC | 02:37 | |
| *** chmarkus has joined #openstack-kolla | 02:39 | |
| *** masuberu has quit IRC | 02:42 | |
| *** pengdake has quit IRC | 02:44 | |
| *** pengdake_ has joined #openstack-kolla | 02:44 | |
| *** salv-orl_ has joined #openstack-kolla | 02:57 | |
| *** salv-orlando has quit IRC | 03:00 | |
| *** masber has joined #openstack-kolla | 03:02 | |
| *** itlinux has joined #openstack-kolla | 03:04 | |
| *** itlinux has quit IRC | 03:07 | |
| *** caoyuan has joined #openstack-kolla | 03:11 | |
| *** kbaegis has joined #openstack-kolla | 03:16 | |
| *** kbaegis has joined #openstack-kolla | 03:16 | |
| *** caoyuan has quit IRC | 03:16 | |
| *** kbaegis has joined #openstack-kolla | 03:16 | |
| *** kbaegis has joined #openstack-kolla | 03:17 | |
| *** kbaegis has joined #openstack-kolla | 03:17 | |
| *** kbaegis has joined #openstack-kolla | 03:18 | |
| *** skramaja has joined #openstack-kolla | 03:35 | |
| *** masber has quit IRC | 03:36 | |
| *** masber has joined #openstack-kolla | 03:47 | |
| *** devananda has quit IRC | 03:55 | |
| *** tvignaud has quit IRC | 04:00 | |
| *** pengdake_ has quit IRC | 04:03 | |
| *** dave-mccowan has quit IRC | 04:08 | |
| *** hongbin has quit IRC | 04:15 | |
| *** caoyuan has joined #openstack-kolla | 04:17 | |
| *** hrw has quit IRC | 04:21 | |
| *** kbaegis has quit IRC | 04:24 | |
| openstackgerrit | Jeffrey Zhang proposed openstack/kolla-ansible master: Disable memcached UDP-based protocol by default https://review.openstack.org/550325 | 04:28 |
| *** masuberu has joined #openstack-kolla | 04:36 | |
| *** masber has quit IRC | 04:40 | |
| *** masber has joined #openstack-kolla | 04:40 | |
| *** masuberu has quit IRC | 04:42 | |
| *** ANKITA_ has joined #openstack-kolla | 04:44 | |
| *** radeks has joined #openstack-kolla | 04:47 | |
| *** kevinz has quit IRC | 05:05 | |
| *** masahisa_ has joined #openstack-kolla | 05:07 | |
| *** masahisa has quit IRC | 05:07 | |
| *** zhurong has quit IRC | 05:08 | |
| *** devananda has joined #openstack-kolla | 05:10 | |
| *** jaosorior has joined #openstack-kolla | 05:18 | |
| *** masahisa_ has quit IRC | 05:28 | |
| *** masahisa has joined #openstack-kolla | 05:30 | |
| *** masuberu has joined #openstack-kolla | 05:32 | |
| *** pengdake_ has joined #openstack-kolla | 05:32 | |
| *** masber has quit IRC | 05:35 | |
| openstackgerrit | zhongshengping proposed openstack/kolla-ansible master: Error path of WSGIScriptAlias of panko for ubuntu https://review.openstack.org/550299 | 05:39 |
| *** mdnadeem has joined #openstack-kolla | 05:47 | |
| *** zshi_ is now known as zshi | 05:49 | |
| *** sanjayu has quit IRC | 05:54 | |
| *** janki has joined #openstack-kolla | 05:55 | |
| *** zhubingbing_ has joined #openstack-kolla | 05:57 | |
| *** david-lyle has joined #openstack-kolla | 05:59 | |
| openstackgerrit | Jeffrey Zhang proposed openstack/kolla-ansible master: Disable memcached UDP-based protocol by default https://review.openstack.org/550325 | 06:21 |
| *** cah_link has joined #openstack-kolla | 06:22 | |
| *** lxdong has joined #openstack-kolla | 06:26 | |
| lxdong | how to upgrade mariadb from 10.1 to 10.2.13? | 06:26 |
| lxdong | Upgrading directly from MySQL 10.1 to MariaDB 10.2 may not be safe in all cases. A manual dump and restore using mysqldump is recommended. It is important to review the MariaDB manual's Upgrading section for version-specific incompatibilities. A manual upgrade is required. | 06:26 |
| *** kiennt26 has joined #openstack-kolla | 06:31 | |
| *** tvignaud has joined #openstack-kolla | 06:32 | |
| openstackgerrit | Jeffrey Zhang proposed openstack/kolla stable/queens: Use centos-release-openstack-queens instead of delorean repo https://review.openstack.org/549132 | 06:34 |
| *** jtriley has quit IRC | 06:34 | |
| *** masuberu has quit IRC | 06:38 | |
| *** powerd has joined #openstack-kolla | 06:41 | |
| kolla-slack | <george.price> maridb | 06:47 |
| *** kfox1111 has quit IRC | 06:47 | |
| *** zhurong has joined #openstack-kolla | 06:48 | |
| *** tvignaud has quit IRC | 06:49 | |
| *** hrw has joined #openstack-kolla | 06:49 | |
| *** powerd has quit IRC | 06:50 | |
| *** masahisa_ has joined #openstack-kolla | 06:53 | |
| hrw | Jeffrey4l: https://review.openstack.org/#/c/549132 - shouldn't it go through master first? | 06:54 |
| *** masahisa has quit IRC | 06:56 | |
| Jeffrey4l | hrw, i think no. master will still using the delorean repo. | 06:57 |
| hrw | ok | 06:57 |
| hrw | will do test build on aarch64 and then +2 | 06:57 |
| Jeffrey4l | but there are some bug in master. ppc64le is still using a pike repo, which should bump to queens i think | 06:57 |
| *** gkadam has joined #openstack-kolla | 06:58 | |
| *** coolsvap has joined #openstack-kolla | 07:00 | |
| *** jtriley has joined #openstack-kolla | 07:01 | |
| *** sai_p has quit IRC | 07:02 | |
| *** egonzalez has joined #openstack-kolla | 07:03 | |
| *** masahisa_ has quit IRC | 07:03 | |
| *** jtriley has quit IRC | 07:06 | |
| *** masahisa has joined #openstack-kolla | 07:08 | |
| *** elgxl has joined #openstack-kolla | 07:08 | |
| *** jtriley has joined #openstack-kolla | 07:09 | |
| *** threestrands_ has joined #openstack-kolla | 07:09 | |
| *** threestrands_ has quit IRC | 07:09 | |
| *** threestrands_ has joined #openstack-kolla | 07:09 | |
| *** threestrands has quit IRC | 07:10 | |
| hrw | eh. | 07:11 |
| hrw | centos/aarch64 is on jewel ;( | 07:11 |
| openstackgerrit | Marcin Juszkiewicz proposed openstack/kolla master: centos/aarch64: use Ceph luminous https://review.openstack.org/550367 | 07:13 |
| *** threestrands_ has quit IRC | 07:13 | |
| *** jtriley has quit IRC | 07:14 | |
| hrw | Jeffrey4l: +2 on your | 07:14 |
| Jeffrey4l | hrw, cloud we upgrade to ceph luminous? | 07:15 |
| hrw | Jeffrey4l: queens is luminous | 07:15 |
| hrw | I just not noticed that because concentrated on Debian | 07:16 |
| *** jtriley has joined #openstack-kolla | 07:17 | |
| kolla-slack | <george.price> hey guys idk if you would be help me but im having an error with this guide | 07:18 |
| kolla-slack | <george.price> https://docs.openstack.org/kolla-kubernetes/latest/deployment-guide.html | 07:18 |
| Jeffrey4l | hrw why delorean repo is not used in master for aarch64 | 07:19 |
| kolla-slack | <george.price> in step 3 where I have to Create and register the Kolla config maps with the following | 07:19 |
| kolla-slack | <george.price> kollakube res create configmap \ mariadb keystone horizon rabbitmq memcached nova-api nova-conductor \ nova-scheduler glance-api-haproxy glance-registry-haproxy glance-api \ glance-registry neutron-server neutron-dhcp-agent neutron-l3-agent \ neutron-metadata-agent neutron-openvswitch-agent openvswitch-db-server \ openvswitch-vswitchd nova-libvirt nova-compute nova-consoleauth \ nova-novncproxy | 07:19 |
| kolla-slack | nova-novncproxy-haproxy neutron-server-haproxy \ nova-api-haproxy cinder-api cinder-api-haproxy cinder-backup \ cinder-scheduler cinder-volume iscsid tgtd keepalived \ placement-api placement-api-haproxy | 07:19 |
| kolla-slack | <george.price> it returns with this error | 07:19 |
| kolla-slack | <george.price> Unable to locate mariadb directory in search_paths=[/etc/kolla, /etc/kolla-kubernetes, /usr/local/lib/python2.7/dist-packages/etc/kolla, /usr/local/lib/python2.7/dist-packages/etc/kolla-kubernetes] | 07:19 |
| hrw | george: no idea, sorry | 07:19 |
| hrw | Jeffrey4l: will take a look and clean up | 07:20 |
| Jeffrey4l | hrw, reviewd you patch | 07:20 |
| *** devananda has quit IRC | 07:20 | |
| hrw | Jeffrey4l: wanted to make small patch with just ceph bump so we can backport it for stable/queens | 07:21 |
| Jeffrey4l | ok. work for me. | 07:21 |
| Jeffrey4l | just change the description for ceph-luminous hrw | 07:21 |
| hrw | done | 07:21 |
| openstackgerrit | Marcin Juszkiewicz proposed openstack/kolla master: centos/aarch64: use Ceph luminous https://review.openstack.org/550367 | 07:22 |
| hrw | next one will update other parts | 07:22 |
| Jeffrey4l | hrw, since it should be backported to stable branch, could you file a bug for tracking | 07:23 |
| hrw | sure | 07:23 |
| *** jtriley has quit IRC | 07:23 | |
| hrw | dlrn stuff may get simplified now as kvm-common is now on mirrors | 07:24 |
| openstackgerrit | Marcin Juszkiewicz proposed openstack/kolla master: centos/aarch64: use Ceph luminous https://review.openstack.org/550367 | 07:26 |
| kolla-slack | <george.price> is there a better guide for launching openstack services on a kolla kuber cluster | 07:26 |
| hrw | Jeffrey4l: done | 07:26 |
| * hrw did not yet touched k8s | 07:26 | |
| * Jeffrey4l too ;( | 07:27 | |
| Jeffrey4l | re kvm-common repo, i think we should use buildlog in master and use centos mirror repo for stable branch. need i update it in my patch? | 07:28 |
| Jeffrey4l | hrw, ^ | 07:28 |
| *** masahisa has quit IRC | 07:28 | |
| hrw | Jeffrey4l: will +2 still if you do but imho we can stay with current situation | 07:29 |
| Jeffrey4l | hrw, there is no aarch64 for kvm-common in centos mirror | 07:30 |
| Jeffrey4l | http://mirror.centos.org/centos-7/7/virt/ | 07:30 |
| *** masahisa has joined #openstack-kolla | 07:30 | |
| Jeffrey4l | so current situation is OK. | 07:30 |
| hrw | Jeffrey4l: /altarch/7/ | 07:31 |
| Jeffrey4l | aha, found it. | 07:31 |
| Jeffrey4l | is there any different for https://buildlogs.centos.org/centos/7/virt/aarch64/kvm-common/ and http://mirror.centos.org/altarch/7/virt/aarch64/kvm-common/ | 07:32 |
| hrw | in theory mirror is official repo and buildlogs is 'whatever got built' | 07:33 |
| hrw | in practise we had to wait years to get sync | 07:34 |
| hrw | when it comes to repos Debian is the only sane distro from list of kolla supported | 07:34 |
| Jeffrey4l | so without sync delay, the content in these two repos are the same? | 07:35 |
| *** jtriley has joined #openstack-kolla | 07:35 | |
| hrw | mirror has latest package only, buildlogs has also older ones. other than that: same | 07:35 |
| Jeffrey4l | got thanks | 07:35 |
| openstackgerrit | Marcin Juszkiewicz proposed openstack/kolla master: centos/aarch64: sync up repositories with x86-64 https://review.openstack.org/550378 | 07:42 |
| *** jtriley has quit IRC | 07:44 | |
| Jeffrey4l | there is no need to use Depend-On on single one repo. it mainly used for cross project patches. | 07:47 |
| *** Jeffrey4l has left #openstack-kolla | 07:47 | |
| *** Jeffrey4l has joined #openstack-kolla | 07:47 | |
| Jeffrey4l | hrw, ^^ done https://review.openstack.org/#/c/550378/ | 07:48 |
| openstackgerrit | Marcin Juszkiewicz proposed openstack/kolla master: centos/aarch64: sync up repositories with x86-64 https://review.openstack.org/550378 | 07:49 |
| *** jtriley has joined #openstack-kolla | 07:50 | |
| *** pcaruana has joined #openstack-kolla | 07:54 | |
| *** pcaruana has quit IRC | 07:55 | |
| *** pcaruana has joined #openstack-kolla | 07:55 | |
| *** jtriley has quit IRC | 07:55 | |
| *** SatyaR has joined #openstack-kolla | 07:57 | |
| SatyaR | Hi Jeffrey4l | 07:57 |
| Jeffrey4l | sup SatyaR | 07:57 |
| SatyaR | How are you | 07:58 |
| SatyaR | hope you remember me :) | 07:58 |
| Jeffrey4l | hrm :/ | 07:59 |
| SatyaR | satyar was working with oracle https://review.openstack.org/#/c/404944 | 08:01 |
| Jeffrey4l | SatyaR, are you? sorry my RAM is less ;) | 08:01 |
| SatyaR | lol | 08:01 |
| SatyaR | yes | 08:01 |
| SatyaR | just want to check on the first comment | 08:02 |
| Jeffrey4l | yeah, | 08:02 |
| SatyaR | https://review.openstack.org/#/c/404944/22/ansible/library/rabbitmq_hostname.py | 08:02 |
| *** jtriley has joined #openstack-kolla | 08:03 | |
| Jeffrey4l | SatyaR, "use ansible stand module"? | 08:04 |
| Jeffrey4l | https://github.com/openstack/kolla-ansible/blob/master/ansible/library/kolla_container_facts.py#L60 | 08:04 |
| SatyaR | yes | 08:04 |
| Jeffrey4l | SatyaR, this is a stand anisble python version module. | 08:04 |
| Jeffrey4l | there are lots class/function can be used to write module. | 08:05 |
| SatyaR | ok going to check that | 08:05 |
| Jeffrey4l | like "module.exit_json()" | 08:05 |
| *** olivierbourdon3- has quit IRC | 08:05 | |
| *** jtriley has quit IRC | 08:08 | |
| *** olivierbourdon38 has joined #openstack-kolla | 08:09 | |
| *** jtriley has joined #openstack-kolla | 08:15 | |
| *** ArminderSingh has quit IRC | 08:17 | |
| *** jtriley has quit IRC | 08:23 | |
| *** tvignaud has joined #openstack-kolla | 08:24 | |
| *** ArminderSingh has joined #openstack-kolla | 08:25 | |
| *** jtriley has joined #openstack-kolla | 08:28 | |
| *** threestrands has joined #openstack-kolla | 08:32 | |
| *** threestrands has quit IRC | 08:32 | |
| *** threestrands has joined #openstack-kolla | 08:32 | |
| *** jtriley has quit IRC | 08:33 | |
| *** shardy has joined #openstack-kolla | 08:34 | |
| *** threestrands has quit IRC | 08:36 | |
| *** mnasiadka has joined #openstack-kolla | 08:36 | |
| *** masahisa has quit IRC | 08:37 | |
| *** jaosorior_ has joined #openstack-kolla | 08:37 | |
| *** jtriley has joined #openstack-kolla | 08:39 | |
| *** jaosorior has quit IRC | 08:40 | |
| *** dougsz has quit IRC | 08:40 | |
| *** ANKITA_ has quit IRC | 08:42 | |
| *** jtriley has quit IRC | 08:44 | |
| *** SatyaR has quit IRC | 08:47 | |
| *** athomas has joined #openstack-kolla | 08:53 | |
| *** jtriley has joined #openstack-kolla | 08:54 | |
| *** jtriley has quit IRC | 08:59 | |
| *** Satyar has joined #openstack-kolla | 09:03 | |
| *** jaosorior_ is now known as jaosorior | 09:03 | |
| *** jtriley has joined #openstack-kolla | 09:07 | |
| *** k_mouza has joined #openstack-kolla | 09:09 | |
| *** jtriley has quit IRC | 09:12 | |
| *** mgoddard_ has joined #openstack-kolla | 09:14 | |
| *** dougsz has joined #openstack-kolla | 09:15 | |
| *** olivierbourdon38 has quit IRC | 09:20 | |
| *** calbers has joined #openstack-kolla | 09:21 | |
| *** jtriley has joined #openstack-kolla | 09:21 | |
| *** Satyar has quit IRC | 09:22 | |
| *** jtriley has quit IRC | 09:26 | |
| *** jtriley has joined #openstack-kolla | 09:27 | |
| *** ktibi has joined #openstack-kolla | 09:28 | |
| *** ktibi has joined #openstack-kolla | 09:28 | |
| *** jtriley has quit IRC | 09:31 | |
| *** ktibi has quit IRC | 09:32 | |
| *** olivierbourdon38 has joined #openstack-kolla | 09:34 | |
| *** ktibi has joined #openstack-kolla | 09:34 | |
| *** olivierbourdon38 has quit IRC | 09:35 | |
| *** k_mouza has quit IRC | 09:36 | |
| *** jtriley has joined #openstack-kolla | 09:38 | |
| *** jtriley has quit IRC | 09:43 | |
| *** jtriley has joined #openstack-kolla | 09:43 | |
| *** olivierbourdon38 has joined #openstack-kolla | 09:47 | |
| *** jtriley has quit IRC | 09:48 | |
| *** k_mouza has joined #openstack-kolla | 09:53 | |
| openstackgerrit | Chason Chan proposed openstack/kolla master: Migrate neutron-vpnaas-agent to neutron-l3-agent https://review.openstack.org/530208 | 09:55 |
| *** jtriley has joined #openstack-kolla | 09:55 | |
| *** k_mouza has quit IRC | 09:57 | |
| *** kiennt26 has quit IRC | 09:57 | |
| *** tovin07_ has quit IRC | 09:59 | |
| *** jtriley has quit IRC | 10:00 | |
| *** jtriley has joined #openstack-kolla | 10:05 | |
| *** k_mouza has joined #openstack-kolla | 10:07 | |
| *** hw_wutianwei has quit IRC | 10:08 | |
| *** hw_wutianwei has joined #openstack-kolla | 10:08 | |
| openstackgerrit | Kevin Tibi proposed openstack/kolla-ansible stable/pike: Add permission to notify dns server from worker https://review.openstack.org/550420 | 10:08 |
| *** ArminderSingh has quit IRC | 10:08 | |
| *** pengdake has joined #openstack-kolla | 10:09 | |
| *** pengdake_ has quit IRC | 10:10 | |
| *** jtriley has quit IRC | 10:10 | |
| *** ArminderSingh has joined #openstack-kolla | 10:12 | |
| *** jtriley has joined #openstack-kolla | 10:12 | |
| openstackgerrit | Kevin Tibi proposed openstack/kolla-ansible master: Skydive: Fix endpoint for keystone (analyser) https://review.openstack.org/540827 | 10:14 |
| *** jtriley has quit IRC | 10:18 | |
| openstackgerrit | Mark Goddard proposed openstack/kolla-ansible master: [DNM] Proof of concept molecule test for ironic https://review.openstack.org/542750 | 10:21 |
| openstackgerrit | Mark Goddard proposed openstack/kolla-ansible master: [DNM] Add tox environment for running molecule tests https://review.openstack.org/550423 | 10:21 |
| openstackgerrit | Mark Goddard proposed openstack/kolla-ansible master: [DNM] Add common molecule files https://review.openstack.org/550424 | 10:21 |
| *** jtriley has joined #openstack-kolla | 10:22 | |
| *** hw_wutianwei has quit IRC | 10:23 | |
| *** zhurong has quit IRC | 10:23 | |
| *** lvdombrkr has joined #openstack-kolla | 10:25 | |
| *** pbourke has quit IRC | 10:25 | |
| *** pbourke has joined #openstack-kolla | 10:25 | |
| *** duonghq has quit IRC | 10:26 | |
| *** kolla-slack1 has joined #openstack-kolla | 10:28 | |
| *** kolla-slack has quit IRC | 10:29 | |
| *** jtriley has quit IRC | 10:30 | |
| *** hw_wutianwei has joined #openstack-kolla | 10:31 | |
| *** jtriley has joined #openstack-kolla | 10:36 | |
| *** pengdake has quit IRC | 10:37 | |
| *** jtriley has quit IRC | 10:41 | |
| *** jtriley has joined #openstack-kolla | 10:43 | |
| lvdombrkr | folks i have question about aodh service, someone used it? can it for example suspend instance when one if trigers is True? | 10:46 |
| *** jtriley has quit IRC | 10:48 | |
| *** coolsvap has quit IRC | 10:49 | |
| ktibi | lvdombrkr, do you use heat with aodh ? | 10:50 |
| *** jtriley has joined #openstack-kolla | 10:53 | |
| lvdombrkr | ktibi: at the moment i use heat, but not aodh and celeimoter, but i have usecase to start it use.. i need to suspend instance after some trigers from it (for example if ram is overused etc) | 10:54 |
| *** mdnadeem has quit IRC | 10:54 | |
| *** mdnadeem has joined #openstack-kolla | 10:54 | |
| ktibi | lvdombrkr, when you say suspend, what do you want exactly ? shutdown, pause, shelve ? | 10:55 |
| lvdombrkr | ktibi: i mean - openstack server suspend <server> | 10:57 |
| *** jtriley has quit IRC | 10:59 | |
| *** jtriley has joined #openstack-kolla | 11:04 | |
| *** serlex has joined #openstack-kolla | 11:05 | |
| *** jtriley has quit IRC | 11:09 | |
| *** jtriley has joined #openstack-kolla | 11:10 | |
| *** jtriley has quit IRC | 11:15 | |
| *** janki has quit IRC | 11:15 | |
| *** kbaegis has joined #openstack-kolla | 11:15 | |
| *** jtriley has joined #openstack-kolla | 11:17 | |
| *** kbaegis has quit IRC | 11:17 | |
| *** k_mouza has quit IRC | 11:17 | |
| *** shardy has quit IRC | 11:20 | |
| *** shardy has joined #openstack-kolla | 11:21 | |
| *** shardy has quit IRC | 11:21 | |
| *** jtriley has quit IRC | 11:22 | |
| *** shardy has joined #openstack-kolla | 11:22 | |
| *** jtriley has joined #openstack-kolla | 11:26 | |
| *** k_mouza has joined #openstack-kolla | 11:26 | |
| elgxl | is it possible to change the containers IPs? they are overlaping with my office network | 11:28 |
| *** salv-orl_ has quit IRC | 11:29 | |
| *** salv-orlando has joined #openstack-kolla | 11:29 | |
| *** jtriley has quit IRC | 11:31 | |
| *** ArminderSingh has quit IRC | 11:33 | |
| *** salv-orlando has quit IRC | 11:34 | |
| *** jtriley has joined #openstack-kolla | 11:35 | |
| pbourke | elgxl: the containers don't have ips | 11:37 |
| pbourke | elgxl: kolla users host mode networking so the containers share the networks from the host they're running on | 11:38 |
| elgxl | runinng ip a insdie a container i see an ip of 172.17.0.10/24 | 11:39 |
| pbourke | that should match what's on your host | 11:40 |
| *** timut_ has joined #openstack-kolla | 11:41 | |
| *** timut_ has quit IRC | 11:42 | |
| *** timut has joined #openstack-kolla | 11:42 | |
| elgxl | i have set two interface one 172.23.2.0/24 for the internal ip and 172.23.153.0/24 for the external ip | 11:43 |
| elgxl | i see them insde the container plus the 172.17.0.10 | 11:44 |
| *** jtriley has quit IRC | 11:45 | |
| *** salv-orlando has joined #openstack-kolla | 11:48 | |
| pbourke | oh maybe that's the docker interface | 11:49 |
| elgxl | is it possible to change it? | 11:50 |
| *** jtriley has joined #openstack-kolla | 11:50 | |
| openstackgerrit | Christian Berendt proposed openstack/kolla-ansible stable/ocata: Extract log level from syslog https://review.openstack.org/550452 | 11:51 |
| pbourke | yes, you'd need to consult the docker docs | 11:51 |
| openstackgerrit | Christian Berendt proposed openstack/kolla-ansible stable/pike: Extract log level from syslog https://review.openstack.org/550453 | 11:51 |
| pbourke | maybe something like this could help: https://docs.docker.com/network/bridge/#configure-the-default-bridge-network | 11:51 |
| pbourke | though I imagine it varies by distro | 11:52 |
| *** jtriley has quit IRC | 11:55 | |
| openstackgerrit | Christian Berendt proposed openstack/kolla-ansible master: Allow custom fluentd input configurations https://review.openstack.org/550151 | 11:56 |
| lvdombrkr | pbourke: hi. quick question, can i get from ceilometer data from instance about lets say chrome websockets? | 11:57 |
| lvdombrkr | i mean something more detalized then network.outgoing.bytes , network.incoming.bytes etc | 11:58 |
| *** jtriley has joined #openstack-kolla | 11:58 | |
| openstackgerrit | Christian Berendt proposed openstack/kolla-ansible master: Allow custom fluentd input configurations https://review.openstack.org/550151 | 11:59 |
| *** caowei has quit IRC | 11:59 | |
| pbourke | lvdombrkr:not sure, Im not very familiar with ceilometer | 11:59 |
| *** imcsk8_ has joined #openstack-kolla | 12:00 | |
| *** rhallisey has joined #openstack-kolla | 12:00 | |
| *** jtriley has quit IRC | 12:03 | |
| *** imcsk8 has quit IRC | 12:03 | |
| *** jtriley has joined #openstack-kolla | 12:07 | |
| lvdombrkr | pbourke: okey thanks, i will ask in teleometry group | 12:07 |
| *** liuzz has quit IRC | 12:09 | |
| *** jtriley has quit IRC | 12:12 | |
| *** janki has joined #openstack-kolla | 12:13 | |
| *** jtriley has joined #openstack-kolla | 12:13 | |
| *** dciabrin has quit IRC | 12:16 | |
| *** dciabrin has joined #openstack-kolla | 12:18 | |
| *** salv-orl_ has joined #openstack-kolla | 12:18 | |
| *** livelace-link_ has joined #openstack-kolla | 12:20 | |
| *** bkero- has quit IRC | 12:20 | |
| *** salv-orlando has quit IRC | 12:20 | |
| *** caoyuan has quit IRC | 12:20 | |
| *** livelace-link has quit IRC | 12:20 | |
| *** bkero- has joined #openstack-kolla | 12:21 | |
| *** jtriley has quit IRC | 12:21 | |
| *** livelace-link_ has quit IRC | 12:21 | |
| *** gfidente has joined #openstack-kolla | 12:25 | |
| *** gfidente has quit IRC | 12:25 | |
| *** gfidente has joined #openstack-kolla | 12:25 | |
| *** kbaegis has joined #openstack-kolla | 12:29 | |
| lvdombrkr | pbourke: just to know - its not possible ) | 12:29 |
| *** jtriley has joined #openstack-kolla | 12:30 | |
| *** dave-mccowan has joined #openstack-kolla | 12:32 | |
| *** jtriley has quit IRC | 12:34 | |
| *** jtriley has joined #openstack-kolla | 12:41 | |
| *** yangyapeng has quit IRC | 12:42 | |
| *** yangyapeng has joined #openstack-kolla | 12:43 | |
| *** jtriley has quit IRC | 12:47 | |
| *** yangyapeng has quit IRC | 12:47 | |
| *** masahisa has joined #openstack-kolla | 12:48 | |
| ktibi | lvdombrkr, ceilometer use KVM for collect metric, so you can't have metric of app or your system :/ | 12:51 |
| *** jtriley has joined #openstack-kolla | 12:52 | |
| *** robbbe has joined #openstack-kolla | 12:53 | |
| lvdombrkr | ktibi pbourke : thanks for info, i find plugin like https://github.com/openstack/collectd-ceilometer-plugin | 12:53 |
| lvdombrkr | maybe it can help in my case | 12:53 |
| pbourke | cool | 12:55 |
| ktibi | lvdombrkr, yes why not, but I think the best way is to use your monitoring solution. | 12:56 |
| ktibi | and use it to trigger action in openstack | 12:57 |
| *** b_bezak has joined #openstack-kolla | 12:57 | |
| *** kbaegis has quit IRC | 12:57 | |
| *** devananda has joined #openstack-kolla | 12:59 | |
| *** k_mouza has quit IRC | 13:05 | |
| *** masahisa_ has joined #openstack-kolla | 13:09 | |
| *** masahisa has quit IRC | 13:09 | |
| *** kbaegis has joined #openstack-kolla | 13:15 | |
| *** k_mouza has joined #openstack-kolla | 13:16 | |
| *** masahisa has joined #openstack-kolla | 13:19 | |
| *** masahisa_ has quit IRC | 13:19 | |
| lvdombrkr | ktibi : but as i see i can deploy ths=is plugin from the kolla box https://github.com/openstack/collectd-ceilometer-plugin/blob/master/kolla/installation.rst | 13:20 |
| *** k_mouza has quit IRC | 13:21 | |
| *** k_mouza has joined #openstack-kolla | 13:21 | |
| *** masahisa has quit IRC | 13:24 | |
| *** caoyuan has joined #openstack-kolla | 13:28 | |
| *** yangyapeng has joined #openstack-kolla | 13:29 | |
| ktibi | lvdombrkr, you can deploy with kolla, but collectd still outside from your vms, like telegraf, or ceilometer agent. | 13:30 |
| ktibi | so metrics return by collectd are same :/ | 13:30 |
| ktibi | in your case you need to deploy a collectd in your instance, for collect metric like websocket... | 13:31 |
| *** yangyapeng has quit IRC | 13:33 | |
| *** cliles has quit IRC | 13:35 | |
| *** kbaegis has quit IRC | 13:37 | |
| lvdombrkr | ktibi : mhmmm, sounds like you are right | 13:37 |
| *** jtriley has quit IRC | 13:37 | |
| *** kbaegis has joined #openstack-kolla | 13:39 | |
| *** lxdong has quit IRC | 13:57 | |
| *** zhubingbing has joined #openstack-kolla | 13:57 | |
| *** zhangfei has quit IRC | 13:58 | |
| *** jtriley has joined #openstack-kolla | 14:04 | |
| *** jtriley has quit IRC | 14:09 | |
| *** jtriley has joined #openstack-kolla | 14:14 | |
| *** jtriley has quit IRC | 14:19 | |
| *** dangtrinhnt has quit IRC | 14:24 | |
| spsurya | Jeffrey4l: hi.... | 14:33 |
| Jeffrey4l | spsurya, sp | 14:34 |
| Jeffrey4l | sup | 14:34 |
| spsurya | hope all kk8s cores would be in meeting | 14:34 |
| spsurya | today | 14:34 |
| Jeffrey4l | yeah | 14:35 |
| spsurya | so that we can get our roadmap for rocky cycle | 14:35 |
| spsurya | for kk8s | 14:35 |
| spsurya | Jeffrey4l: i am travelling now and might be on slow connection in meeting | 14:36 |
| Jeffrey4l | Ok. have a holiday? | 14:37 |
| *** yangyapeng has joined #openstack-kolla | 14:37 | |
| ktibi | spsurya, I'am very interested by kk8s, but when I see contribution since 6 month, I can't see how is the project going. | 14:38 |
| spsurya | not exactly....taking care of father's health now days | 14:38 |
| spsurya | ktibi: we will have discussion today in meeting | 14:39 |
| spsurya | be there | 14:39 |
| *** zhangfei has joined #openstack-kolla | 14:39 | |
| ktibi | I would be :) | 14:39 |
| spsurya | ktibi: possibly you will come to know more about its past and future contribution | 14:40 |
| spsurya | ktibi: gr8 | 14:41 |
| *** yangyapeng has quit IRC | 14:42 | |
| Jeffrey4l | could you review https://review.openstack.org/549132 spsurya | 14:42 |
| spsurya | Jeffrey4l: sure | 14:43 |
| *** lvdombrkr has quit IRC | 14:45 | |
| *** cah_link has quit IRC | 14:45 | |
| ktibi | Jeffrey4l, for pike kolla use dolorean repo ? | 14:46 |
| spsurya | once journey end.....currently on phone | 14:46 |
| Jeffrey4l | ktibi, now. in pike kolla use "centos-release-openstack-pike repo" | 14:47 |
| Jeffrey4l | sure thanks. | 14:47 |
| *** jtriley has joined #openstack-kolla | 14:47 | |
| *** seanrmurphy has joined #openstack-kolla | 14:48 | |
| seanrmurphy | hi all - we have a q about deployment of rgw with kolla - we have an external ceph, but we would like to just deploy (and configure) rgw via kolla | 14:51 |
| *** timut has quit IRC | 14:51 | |
| *** k_mouza_ has joined #openstack-kolla | 14:51 | |
| seanrmurphy | it seems enable_ceph_rgw is dependent on enable_ceph (which is intended for deploying ceph) | 14:51 |
| seanrmurphy | and there is no specific option for deploying rgw alone | 14:52 |
| seanrmurphy | we could prob deploy the containers directly without using kolla, but it seems to be missing the point/going against the philosophy | 14:52 |
| seanrmurphy | any pointers? | 14:52 |
| *** k_mouza has quit IRC | 14:53 | |
| *** yangyapeng has joined #openstack-kolla | 14:53 | |
| pbourke | seanrmurphy: the ceph role could probably do with been a little more modular in that way | 14:55 |
| ktibi | seanrmurphy, you want to deploy rgw with an external ceph ? | 14:55 |
| pbourke | seanrmurphy: you could try adding a new play to site.yml to just trigger the rgw role? | 14:55 |
| *** yangyape_ has joined #openstack-kolla | 14:56 | |
| seanrmurphy | ktibi: yep - we have an external ceph and we want to deploy rgw on the openstack cluster | 14:57 |
| seanrmurphy | pbourke: thanks for the pointer - i tried a variant of this, but did not do it properly...i will give this a go | 14:58 |
| *** mathlin has joined #openstack-kolla | 14:58 | |
| pbourke | seanrmurphy: yeah you may need other tweaks | 14:58 |
| *** yangyapeng has quit IRC | 14:58 | |
| seanrmurphy | i think it will not solve it fully as the ceph play comprises of tasks in the ceph_rgw play iiuc, so having a specific, dedicated ceph_rgw play could result in some conflict i guess | 14:59 |
| seanrmurphy | i'll give it a go and report back | 14:59 |
| *** yangyape_ has quit IRC | 15:06 | |
| *** yangyapeng has joined #openstack-kolla | 15:07 | |
| *** yangyapeng has quit IRC | 15:07 | |
| *** yangyapeng has joined #openstack-kolla | 15:07 | |
| *** zhangfei has quit IRC | 15:10 | |
| seanrmurphy | is there a way to make the ceph-mon and ceph-osd host variables be empty sets? | 15:15 |
| seanrmurphy | it seems they default to the controllers but i can't seem to make them null | 15:15 |
| *** radeks has quit IRC | 15:16 | |
| Jeffrey4l | pbourke, do you have any idea why https://github.com/openstack/loci-horizon is end? | 15:17 |
| *** radeks has joined #openstack-kolla | 15:17 | |
| pbourke | Jeffrey4l: all images are generated from the one dockerfile now | 15:17 |
| pbourke | so its just https://github.com/openstack/loci | 15:17 |
| pbourke | bindep profiles are used to determine what gets installed in the image | 15:17 |
| Jeffrey4l | got | 15:18 |
| openstackgerrit | Paul Bourke (pbourke) proposed openstack/kolla-ansible master: [WIP] Move keystone start scripts into ansible https://review.openstack.org/550500 | 15:19 |
| pbourke | Jeffrey4l: that is a proof of concept patch that would allow us to use loci with relative ease | 15:19 |
| pbourke | will raise in the meeting for dicsussion | 15:20 |
| pbourke | SamYaple: ^ | 15:20 |
| Jeffrey4l | pbourke i like this idea. | 15:21 |
| pbourke | good to hear :) | 15:21 |
| pbourke | Jeffrey4l: that reminds me I need to look again at your docker compose patch | 15:21 |
| Jeffrey4l | is it helpful for this? pbourke | 15:22 |
| pbourke | probably not very related | 15:22 |
| pbourke | but it looked good all the same | 15:23 |
| pomac | Uhhmmm... https://github.com/openstack/kolla-ansible/commit/5b79aa6066e7bdd06d73e09f2aa14a0e80d1f630 | 15:24 |
| pomac | This is not good - it basically means "allow any data to be passed unless we use ssl" | 15:24 |
| pomac | I mean, we should be using ssl but still | 15:25 |
| Jeffrey4l | pomac, since all services are bebind a proxy, isn't it good to pass the real header to backend servers? | 15:26 |
| pomac | Jeffrey4l: no, not when you can say all kinds of things that affect the behaviour of that service | 15:27 |
| pomac | Actually, all headers handled by the proxy layer should be removed and set explicitly by the proxy service | 15:28 |
| Jeffrey4l | pomac, what do you think it should be? | 15:29 |
| pomac | Jeffrey4l: basically, in this case the haproxy is used as a protection - which is useless when it doesn't actually protect you =) | 15:32 |
| openstackgerrit | Paul Bourke (pbourke) proposed openstack/kolla-ansible master: [WIP] Move keystone start scripts into ansible https://review.openstack.org/550500 | 15:33 |
| *** serlex has quit IRC | 15:33 | |
| pomac | Jeffrey4l: so, since it now only deletes and sets it when using ssl - i can say "i'm using ssl" when i'm not using ssl | 15:34 |
| Jeffrey4l | i am not very familiar with this. But from haproxy to backend server, it just tell the bakend server, before the reverse proxy is ahead and using ssl or not. | 15:37 |
| Jeffrey4l | pomac, ^^ | 15:37 |
| Jeffrey4l | could you give an example you think? | 15:37 |
| pomac | so the patch changes the behaviour - it only clears the x-forward-proto when the client connects to ssl - else it will pass *any-header-value-i-set* | 15:38 |
| *** yangyapeng has quit IRC | 15:40 | |
| Jeffrey4l | so this " http-request del-header X-Forwarded-Proto if { ssl_fc }" should be changed to " http-request del-header X-Forwarded-Proto", right? | 15:40 |
| pomac | yes, the change i referenced undid that | 15:40 |
| *** yangyapeng has joined #openstack-kolla | 15:41 | |
| pomac | it feels like a fast clobber to fix a more important issue - in a too simplistic way | 15:41 |
| *** skramaja has quit IRC | 15:41 | |
| pomac | ie, they wanted to have another frontend server - it feels like they should specify that... haproxy will be even more of a mess if you want to use f.ex. a f5 as a ssl termination infront of harpoxy | 15:42 |
| Jeffrey4l | pomac, is there any possisble vulnerable issue i add any header to request? | 15:42 |
| pomac | Jeffrey4l: it's off by default since it's actually a potential security issue - i can't how one could do it but i'd rater be safe than sorry | 15:43 |
| ktibi | pomac, so If I use a firewall for SSL, front of my haproxy with ssl disable, this is an use case with a risk ? | 15:45 |
| pomac | it feels like they wanted "trusted_frontend_servers" as a array and then generate that in to haproxy | 15:45 |
| *** yangyapeng has quit IRC | 15:45 | |
| pomac | ktibi: well, the configuration as is redirects you to https - mode http does magic - but potentially i could attack buffers and things in the service | 15:47 |
| *** salv-orlando has joined #openstack-kolla | 15:48 | |
| *** duonghq has joined #openstack-kolla | 15:50 | |
| duonghq | evening gúy | 15:50 |
| duonghq | evening guys | 15:50 |
| *** salv-orl_ has quit IRC | 15:50 | |
| Jeffrey4l | sup duonghq | 15:50 |
| Jeffrey4l | pbourke, duonghq could you review https://review.openstack.org/549132 | 15:51 |
| duonghq | Jeffrey4l, so we move out from delorean? | 15:53 |
| Jeffrey4l | yes. for queens release. | 15:53 |
| Jeffrey4l | the centos-release-openstack-queens repo is released. | 15:53 |
| duonghq | got it | 15:53 |
| Jeffrey4l | pomac, i thought you are correct ;D | 15:54 |
| *** david-lyle has quit IRC | 15:54 | |
| Jeffrey4l | rwellum, around? | 15:56 |
| hrw | meeting in few? | 15:57 |
| Jeffrey4l | yep | 15:58 |
| hrw | duonghq, pbourke (and others): please review https://review.openstack.org/#/c/550378/ https://review.openstack.org/#/c/550367/ so we will have centos/aarch64 repos fixed properly | 15:59 |
| *** mdnadeem has quit IRC | 16:00 | |
| caoyuan | hello everyone | 16:00 |
| rwellum | Jeffrey4l: yeah I am here | 16:00 |
| Jeffrey4l | will you join the daily meeting? rwellum | 16:00 |
| rwellum | Jeffrey4l: yup I just waved | 16:01 |
| *** wwriverrat has left #openstack-kolla | 16:01 | |
| *** egonzalez has quit IRC | 16:03 | |
| *** b_bezak has quit IRC | 16:03 | |
| *** b_bezak has joined #openstack-kolla | 16:04 | |
| *** iclon has joined #openstack-kolla | 16:06 | |
| ktibi | pomac, Jeffrey4l ok so for finish do you recommend to del header without the check 'if ssl' ?? | 16:07 |
| *** elgxl_ has joined #openstack-kolla | 16:07 | |
| *** b_bezak has quit IRC | 16:08 | |
| *** pcaruana has quit IRC | 16:10 | |
| *** zhaochao has quit IRC | 16:11 | |
| *** elgxl has quit IRC | 16:11 | |
| *** elgxl has joined #openstack-kolla | 16:16 | |
| *** elgxl has quit IRC | 16:19 | |
| *** elgxl has joined #openstack-kolla | 16:20 | |
| *** elgxl_ has quit IRC | 16:20 | |
| *** elgxl has quit IRC | 16:21 | |
| *** elgxl has joined #openstack-kolla | 16:21 | |
| hrw | Jeffrey4l: after meeting can you look at https://docs.google.com/presentation/d/1MhYtlOt8sv5aDVsPkakir-_CNYbW7fXmU3cZ6S93yiM/edit#slide=id.g31fa01e0ea_2_0 | 16:24 |
| hrw | shit. not that ;d | 16:24 |
| hrw | Jeffrey4l: after meeting can you look at https://review.openstack.org/#/c/547995/ one | 16:24 |
| SamYaple | pbourke: looks good. we can simplify it later on | 16:28 |
| SamYaple | this is what i would call least amount of change | 16:29 |
| pbourke | yeah that's the goal for now | 16:29 |
| *** k_mouza_ has quit IRC | 16:32 | |
| *** itlinux has joined #openstack-kolla | 16:35 | |
| *** zhubingbing has quit IRC | 16:35 | |
| *** cliles has joined #openstack-kolla | 16:38 | |
| *** mnasiadka has quit IRC | 16:39 | |
| *** olivierbourdon38 has quit IRC | 16:40 | |
| *** k_mouza has joined #openstack-kolla | 16:40 | |
| *** mnasiadka has joined #openstack-kolla | 16:42 | |
| *** mnasiadka has quit IRC | 16:47 | |
| *** zshi has quit IRC | 16:47 | |
| *** kfox1111 has joined #openstack-kolla | 16:51 | |
| *** sanjayu has joined #openstack-kolla | 16:53 | |
| *** krasmuss_ has joined #openstack-kolla | 16:56 | |
| *** mnasiadka has joined #openstack-kolla | 16:57 | |
| *** krasmussen has quit IRC | 16:59 | |
| *** yangyapeng has joined #openstack-kolla | 17:00 | |
| *** elgxl has quit IRC | 17:00 | |
| openstackgerrit | Merged openstack/kolla stable/queens: Use centos-release-openstack-queens instead of delorean repo https://review.openstack.org/549132 | 17:00 |
| *** zshi has joined #openstack-kolla | 17:01 | |
| *** mnasiadka has quit IRC | 17:02 | |
| *** elgxl has joined #openstack-kolla | 17:02 | |
| *** elgxl has quit IRC | 17:02 | |
| *** caoyuan has quit IRC | 17:03 | |
| Jeffrey4l | btw, here is the fix for ubuntu pike ceph issue https://review.openstack.org/549466 | 17:03 |
| Jeffrey4l | please review it inc0 pbourke duonghq ^^ | 17:03 |
| *** yangyapeng has quit IRC | 17:04 | |
| kfox1111 | morning all. | 17:08 |
| *** seanrmurphy has quit IRC | 17:08 | |
| inc0 | hey kfox1111 read log from todays meeting | 17:09 |
| Jeffrey4l | sup kfox1111 | 17:10 |
| *** gkadam has quit IRC | 17:11 | |
| *** mnasiadka has joined #openstack-kolla | 17:12 | |
| Jeffrey4l | inc0, ktibi already fixed the memcached in another patch https://review.openstack.org/#/c/549715/1 | 17:14 |
| inc0 | ok approved | 17:15 |
| Jeffrey4l | thx | 17:16 |
| *** david-lyle has joined #openstack-kolla | 17:16 | |
| *** mnasiadka has quit IRC | 17:17 | |
| *** janki has quit IRC | 17:18 | |
| kfox1111 | inc0: got a link handy? | 17:18 |
| *** tvignaud has quit IRC | 17:18 | |
| inc0 | http://eavesdrop.openstack.org/meetings/kolla/ | 17:18 |
| kfox1111 | thx | 17:22 |
| *** olivierbourdon38 has joined #openstack-kolla | 17:23 | |
| *** olivierbourdon38 has joined #openstack-kolla | 17:24 | |
| *** olivierbourdon38 has quit IRC | 17:24 | |
| openstackgerrit | Merged openstack/kolla-ansible master: Security memcached: disable UDP https://review.openstack.org/549715 | 17:25 |
| *** olivierbourdon38 has joined #openstack-kolla | 17:26 | |
| *** mnasiadka has joined #openstack-kolla | 17:27 | |
| *** mnasiadka has quit IRC | 17:32 | |
| *** olivierbourdon3- has joined #openstack-kolla | 17:32 | |
| *** olivierbourdon3- has quit IRC | 17:32 | |
| *** olivierbourdon3- has joined #openstack-kolla | 17:32 | |
| *** david-lyle has quit IRC | 17:33 | |
| *** olivierbourdon38 has quit IRC | 17:33 | |
| *** k_mouza has quit IRC | 17:36 | |
| *** ktibi_ has joined #openstack-kolla | 17:36 | |
| *** ktibi has quit IRC | 17:36 | |
| *** mnasiadka has joined #openstack-kolla | 17:42 | |
| *** duonghq has quit IRC | 17:43 | |
| *** mnasiadka has quit IRC | 17:48 | |
| *** yangyapeng has joined #openstack-kolla | 17:49 | |
| *** yangyapeng has quit IRC | 17:54 | |
| *** pcaruana has joined #openstack-kolla | 17:57 | |
| *** mnasiadka has joined #openstack-kolla | 17:57 | |
| *** dougsz has quit IRC | 18:00 | |
| *** mnasiadka has quit IRC | 18:02 | |
| *** tvignaud has joined #openstack-kolla | 18:02 | |
| *** mgoddard_ has quit IRC | 18:04 | |
| openstackgerrit | Merged openstack/kolla master: centos/aarch64: use Ceph luminous https://review.openstack.org/550367 | 18:06 |
| *** devananda has quit IRC | 18:08 | |
| *** mnasiadka has joined #openstack-kolla | 18:12 | |
| *** mnasiadka has quit IRC | 18:17 | |
| *** david-lyle has joined #openstack-kolla | 18:21 | |
| openstackgerrit | Merged openstack/kolla stable/pike: Fix ubuntu pin ceph version failure on pike branch https://review.openstack.org/549466 | 18:24 |
| *** gfidente is now known as gfidente|afk | 18:27 | |
| *** olivierbourdon3- has quit IRC | 18:27 | |
| *** mnasiadka has joined #openstack-kolla | 18:27 | |
| *** olivierbourdon38 has joined #openstack-kolla | 18:28 | |
| *** olivierbourdon38 has quit IRC | 18:30 | |
| *** olivierbourdon38 has joined #openstack-kolla | 18:31 | |
| *** shardy has quit IRC | 18:31 | |
| *** olivierbourdon38 has quit IRC | 18:32 | |
| *** mnasiadka has quit IRC | 18:32 | |
| *** olivierbourdon38 has joined #openstack-kolla | 18:32 | |
| *** david-lyle has quit IRC | 18:35 | |
| *** yangyapeng has joined #openstack-kolla | 18:39 | |
| *** mgoddard_ has joined #openstack-kolla | 18:40 | |
| *** tvignaud has quit IRC | 18:40 | |
| *** mnasiadka has joined #openstack-kolla | 18:42 | |
| *** yangyapeng has quit IRC | 18:44 | |
| *** mnasiadka has quit IRC | 18:47 | |
| *** sai_p has joined #openstack-kolla | 18:47 | |
| openstackgerrit | Mark Goddard proposed openstack/kolla-ansible master: WIP: Add a job for testing deployment of bifrost https://review.openstack.org/549775 | 18:48 |
| *** mnasiadka has joined #openstack-kolla | 18:57 | |
| *** sdake has joined #openstack-kolla | 18:59 | |
| *** sdake has quit IRC | 18:59 | |
| *** sdake has joined #openstack-kolla | 18:59 | |
| sdake | hey pepes | 19:00 |
| *** mnasiadka has quit IRC | 19:02 | |
| *** david-lyle has joined #openstack-kolla | 19:03 | |
| *** olivierbourdon38 has quit IRC | 19:09 | |
| *** robbbe has quit IRC | 19:10 | |
| *** olivierbourdon38 has joined #openstack-kolla | 19:10 | |
| *** mnasiadka has joined #openstack-kolla | 19:12 | |
| *** olivierbourdon38 has quit IRC | 19:13 | |
| *** olivierbourdon38 has joined #openstack-kolla | 19:16 | |
| *** mnasiadka has quit IRC | 19:17 | |
| *** olivierbourdon38 has quit IRC | 19:18 | |
| *** olivierbourdon38 has joined #openstack-kolla | 19:19 | |
| *** mgoddard has quit IRC | 19:19 | |
| dmsimard | inc0, sdake: fyi https://twitter.com/genehack/status/971404236490620928 | 19:23 |
| dmsimard | Jeffrey4l: ^ | 19:23 |
| *** harlowja has joined #openstack-kolla | 19:26 | |
| *** mnasiadka has joined #openstack-kolla | 19:27 | |
| *** olivierb_ has joined #openstack-kolla | 19:29 | |
| *** mnasiadka has quit IRC | 19:32 | |
| *** olivierbourdon38 has quit IRC | 19:36 | |
| *** olivierbourdon38 has joined #openstack-kolla | 19:36 | |
| *** olivierbourdon38 has quit IRC | 19:38 | |
| *** olivierbourdon38 has joined #openstack-kolla | 19:39 | |
| openstackgerrit | Joshua Harlow proposed openstack/kolla-ansible master: Create and use keystone_admin[project|user] https://review.openstack.org/550579 | 19:40 |
| *** mnasiadka has joined #openstack-kolla | 19:42 | |
| *** olivierbourdon38 has quit IRC | 19:43 | |
| *** olivierbourdon38 has joined #openstack-kolla | 19:43 | |
| *** olivierbourdon38 has quit IRC | 19:47 | |
| *** mnasiadka has quit IRC | 19:47 | |
| *** olivierbourdon38 has joined #openstack-kolla | 19:48 | |
| *** olivierb_ has quit IRC | 19:51 | |
| *** kolla-slack has joined #openstack-kolla | 19:51 | |
| *** olivierbourdon38 has quit IRC | 19:51 | |
| *** olivierbourdon38 has joined #openstack-kolla | 19:51 | |
| *** kolla-slack1 has quit IRC | 19:52 | |
| *** radeks has quit IRC | 19:52 | |
| *** ssurana has joined #openstack-kolla | 19:52 | |
| *** zhubingbing__ has joined #openstack-kolla | 19:52 | |
| *** radeks has joined #openstack-kolla | 19:52 | |
| *** ssurana has quit IRC | 19:53 | |
| *** olivierbourdon38 has quit IRC | 19:53 | |
| *** olivierbourdon38 has joined #openstack-kolla | 19:53 | |
| *** zhubingbing_ has quit IRC | 19:55 | |
| *** mgoddard_ has quit IRC | 19:55 | |
| *** mnasiadka has joined #openstack-kolla | 19:57 | |
| *** mnasiadka has quit IRC | 20:03 | |
| *** david-lyle has quit IRC | 20:07 | |
| sdake | dmsimard thanks | 20:09 |
| sdake | dmsimard proprietary software FTL | 20:09 |
| dmsimard | sdake: apparently this irccloud thing has a native gateway of their own | 20:10 |
| dmsimard | can't vouch for it, haven't tried it | 20:10 |
| *** mnasiadka has joined #openstack-kolla | 20:12 | |
| *** gfidente|afk is now known as gfidente | 20:15 | |
| *** david-lyle has joined #openstack-kolla | 20:15 | |
| *** mnasiadka has quit IRC | 20:16 | |
| sdake | irccloud = more proprietary software | 20:24 |
| bkero- | :( | 20:24 |
| bkero- | You can just use weechat-slack | 20:24 |
| bkero- | It uses the websocket interface, not irc gateway | 20:25 |
| *** robbbe has joined #openstack-kolla | 20:25 | |
| *** mnasiadka has joined #openstack-kolla | 20:27 | |
| *** hw_wutianwei has quit IRC | 20:31 | |
| *** mnasiadka has quit IRC | 20:32 | |
| *** hw_wutianwei has joined #openstack-kolla | 20:32 | |
| *** mrunge has quit IRC | 20:36 | |
| *** mnasiadka has joined #openstack-kolla | 20:43 | |
| *** mnasiadka has quit IRC | 20:48 | |
| *** mrunge has joined #openstack-kolla | 20:48 | |
| *** david-lyle has quit IRC | 20:53 | |
| *** mnasiadka has joined #openstack-kolla | 20:56 | |
| *** zshi has quit IRC | 20:59 | |
| *** mnasiadka has quit IRC | 21:01 | |
| *** pcaruana has quit IRC | 21:12 | |
| *** mnasiadka has joined #openstack-kolla | 21:12 | |
| *** zshi has joined #openstack-kolla | 21:12 | |
| *** mnasiadka has quit IRC | 21:17 | |
| *** tvignaud has joined #openstack-kolla | 21:22 | |
| *** mnasiadka has joined #openstack-kolla | 21:27 | |
| *** robbbe has quit IRC | 21:30 | |
| *** mnasiadka has quit IRC | 21:32 | |
| *** robbbe has joined #openstack-kolla | 21:32 | |
| *** robbbe has quit IRC | 21:32 | |
| *** robbbe has joined #openstack-kolla | 21:33 | |
| *** robbbe has quit IRC | 21:33 | |
| *** robbbe has joined #openstack-kolla | 21:34 | |
| *** robbbe has quit IRC | 21:34 | |
| *** robbbe has joined #openstack-kolla | 21:35 | |
| *** robbbe has quit IRC | 21:35 | |
| *** k_mouza has joined #openstack-kolla | 21:35 | |
| *** mnasiadka has joined #openstack-kolla | 21:42 | |
| *** mnasiadka has quit IRC | 21:47 | |
| *** yangyapeng has joined #openstack-kolla | 21:48 | |
| *** radeks has quit IRC | 21:52 | |
| *** yangyapeng has quit IRC | 21:54 | |
| *** k_mouza has quit IRC | 21:55 | |
| *** mnasiadka has joined #openstack-kolla | 21:57 | |
| *** bmace has quit IRC | 21:58 | |
| inc0 | dmsimard: yeah I saw that | 21:58 |
| inc0 | sux | 21:58 |
| *** bmace has joined #openstack-kolla | 21:58 | |
| *** mnasiadka has quit IRC | 22:02 | |
| *** ktibi_ has quit IRC | 22:06 | |
| *** david-lyle has joined #openstack-kolla | 22:08 | |
| *** tvignaud has quit IRC | 22:08 | |
| *** mnasiadka has joined #openstack-kolla | 22:12 | |
| *** openstackstatus has quit IRC | 22:13 | |
| *** openstack has joined #openstack-kolla | 22:16 | |
| *** ChanServ sets mode: +o openstack | 22:16 | |
| *** mnasiadka has quit IRC | 22:17 | |
| *** yangyapeng has quit IRC | 22:19 | |
| *** jtriley has quit IRC | 22:25 | |
| *** mnasiadka has joined #openstack-kolla | 22:27 | |
| *** gfidente has quit IRC | 22:27 | |
| SamYaple | ill have to switch | 22:29 |
| *** mnasiadka has quit IRC | 22:32 | |
| *** tvignaud has joined #openstack-kolla | 22:34 | |
| *** dklyle has joined #openstack-kolla | 22:34 | |
| *** dardelean has joined #openstack-kolla | 22:34 | |
| *** itlinux has quit IRC | 22:36 | |
| *** ArminderSingh has joined #openstack-kolla | 22:40 | |
| *** openstackstatus has quit IRC | 22:42 | |
| *** openstack has joined #openstack-kolla | 22:45 | |
| *** ChanServ sets mode: +o openstack | 22:45 | |
| *** mnasiadka has quit IRC | 22:47 | |
| *** david-lyle has joined #openstack-kolla | 22:54 | |
| *** dklyle has quit IRC | 22:55 | |
| *** mnasiadka has joined #openstack-kolla | 22:57 | |
| *** jtriley has joined #openstack-kolla | 22:58 | |
| *** mnasiadka has quit IRC | 23:02 | |
| *** mnasiadka has joined #openstack-kolla | 23:12 | |
| *** threestrands has joined #openstack-kolla | 23:12 | |
| *** threestrands has quit IRC | 23:12 | |
| *** threestrands has joined #openstack-kolla | 23:12 | |
| openstackgerrit | Chason Chan proposed openstack/kolla-ansible master: Disable Memcached UDP https://review.openstack.org/550644 | 23:14 |
| *** mnasiadka has quit IRC | 23:17 | |
| *** jtriley has quit IRC | 23:18 | |
| *** k_mouza has joined #openstack-kolla | 23:24 | |
| *** kolla-slack has quit IRC | 23:26 | |
| *** kolla-slack has joined #openstack-kolla | 23:26 | |
| *** mnasiadka has joined #openstack-kolla | 23:27 | |
| *** k_mouza has quit IRC | 23:28 | |
| *** mnasiadka has quit IRC | 23:32 | |
| *** threestrands_ has joined #openstack-kolla | 23:34 | |
| *** threestrands_ has quit IRC | 23:35 | |
| *** threestrands_ has joined #openstack-kolla | 23:36 | |
| *** threestrands has quit IRC | 23:36 | |
| *** mnasiadka has joined #openstack-kolla | 23:42 | |
| *** dardelean has quit IRC | 23:45 | |
| *** dardelean has joined #openstack-kolla | 23:46 | |
| *** mnasiadka has quit IRC | 23:47 | |
| *** mnasiadka has joined #openstack-kolla | 23:57 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!