| *** tonanhngo has joined #openstack-kuryr | 00:23 | |
| *** tonanhngo has quit IRC | 00:25 | |
| *** yamamoto_ has joined #openstack-kuryr | 00:27 | |
| *** yamamoto_ has quit IRC | 00:35 | |
| *** huikang has joined #openstack-kuryr | 00:36 | |
| *** akanksha_ has quit IRC | 00:37 | |
| *** huikang has quit IRC | 00:53 | |
| *** huikang has joined #openstack-kuryr | 00:54 | |
| *** huikang has quit IRC | 00:58 | |
| *** tonanhngo has joined #openstack-kuryr | 01:23 | |
| *** tonanhngo has quit IRC | 01:25 | |
| *** tonanhngo has joined #openstack-kuryr | 01:37 | |
| *** salv-orlando has joined #openstack-kuryr | 02:04 | |
| *** salv-orlando has quit IRC | 02:08 | |
| *** huikang has joined #openstack-kuryr | 02:26 | |
| *** sdake has quit IRC | 02:29 | |
| *** huikang has quit IRC | 02:31 | |
| *** yuanying has quit IRC | 02:52 | |
| *** yuanying has joined #openstack-kuryr | 02:53 | |
| *** lezbar has quit IRC | 03:03 | |
| *** lezbar has joined #openstack-kuryr | 03:03 | |
| *** salv-orlando has joined #openstack-kuryr | 03:04 | |
| *** salv-orlando has quit IRC | 03:09 | |
| *** sdake has joined #openstack-kuryr | 03:21 | |
| *** yamamoto_ has joined #openstack-kuryr | 03:31 | |
| *** sdake_ has joined #openstack-kuryr | 03:38 | |
| *** sdake has quit IRC | 03:40 | |
| *** yuanying has quit IRC | 03:44 | |
| *** huikang has joined #openstack-kuryr | 03:49 | |
| *** yuanying has joined #openstack-kuryr | 03:51 | |
| *** huikang has quit IRC | 03:57 | |
| *** huikang has joined #openstack-kuryr | 03:58 | |
| *** huikang has quit IRC | 04:02 | |
| *** salv-orlando has joined #openstack-kuryr | 04:05 | |
| *** salv-orlando has quit IRC | 04:10 | |
| *** vikasc has quit IRC | 04:14 | |
| *** vikasc has joined #openstack-kuryr | 04:28 | |
| *** yamamoto_ has quit IRC | 04:38 | |
| openstackgerrit | Ilya Chukhnakov proposed openstack/kuryr-kubernetes: K8s and Neutron clients support https://review.openstack.org/376042 | 04:42 |
|---|---|---|
| openstackgerrit | Ilya Chukhnakov proposed openstack/kuryr-kubernetes: [WIP] Watcher and event processing base https://review.openstack.org/376043 | 04:48 |
| *** yuanying has quit IRC | 04:59 | |
| *** yuanying_ has joined #openstack-kuryr | 04:59 | |
| openstackgerrit | Ilya Chukhnakov proposed openstack/kuryr-kubernetes: K8s and Neutron clients support https://review.openstack.org/376042 | 05:01 |
| *** salv-orlando has joined #openstack-kuryr | 05:04 | |
| vikasc | apuimedo, ping | 05:15 |
| *** vikasc has quit IRC | 05:20 | |
| *** yamamoto_ has joined #openstack-kuryr | 05:28 | |
| openstackgerrit | Jaivish Kothari(janonymous) proposed openstack/kuryr-libnetwork: Update file mode 777->664 https://review.openstack.org/380925 | 05:31 |
| *** janki has joined #openstack-kuryr | 05:36 | |
| *** vikasc has joined #openstack-kuryr | 05:37 | |
| *** salv-orlando has quit IRC | 06:00 | |
| *** sdake has joined #openstack-kuryr | 06:22 | |
| *** sdake_ has quit IRC | 06:23 | |
| *** tonanhngo has quit IRC | 06:27 | |
| *** yuanying_ has quit IRC | 06:33 | |
| *** salv-orlando has joined #openstack-kuryr | 06:50 | |
| *** tonanhngo has joined #openstack-kuryr | 07:02 | |
| *** tonanhngo has quit IRC | 07:04 | |
| apuimedo | apuimedo: pong | 07:12 |
| *** sdake has quit IRC | 07:15 | |
| *** sdake has joined #openstack-kuryr | 07:26 | |
| *** tonanhngo has joined #openstack-kuryr | 07:38 | |
| *** tonanhngo has quit IRC | 07:39 | |
| *** salv-orl_ has joined #openstack-kuryr | 07:44 | |
| *** salv-orlando has quit IRC | 07:48 | |
| *** lezbar has quit IRC | 07:55 | |
| *** garyloug has joined #openstack-kuryr | 07:55 | |
| *** lezbar has joined #openstack-kuryr | 07:56 | |
| *** sdake has quit IRC | 07:58 | |
| *** lmdaly has joined #openstack-kuryr | 07:59 | |
| *** lezbar has quit IRC | 08:33 | |
| *** lezbar has joined #openstack-kuryr | 08:34 | |
| *** yuanying has joined #openstack-kuryr | 08:59 | |
| apuimedo | vikasc: please, merge https://review.openstack.org/#/c/379556/ | 09:03 |
| vikasc | apuimedo, done! | 09:05 |
| apuimedo | thanks | 09:06 |
| vikasc | yw | 09:06 |
| apuimedo | vikasc: https://review.openstack.org/#/c/375389/ is also ready | 09:07 |
| apuimedo | and also https://review.openstack.org/#/c/376173/ | 09:08 |
| vikasc | apuimedo, sure | 09:08 |
| openstackgerrit | Merged openstack/kuryr-libnetwork: Fix tox -e cover in kuryr-libnetwork https://review.openstack.org/379556 | 09:12 |
| *** ivc_ has joined #openstack-kuryr | 09:25 | |
| openstackgerrit | Merged openstack/kuryr: Remove redundant 'limitations' section https://review.openstack.org/380681 | 09:27 |
| apuimedo | lmdaly: sorry I forgot to put the reference to the PoC | 09:31 |
| apuimedo | I'll address it now | 09:31 |
| apuimedo | thanks for pointing it out | 09:31 |
| lmdaly | No problem at all, thanks! :) | 09:31 |
| *** sdake has joined #openstack-kuryr | 09:44 | |
| *** garyloug has quit IRC | 09:54 | |
| apuimedo | lmdaly: here it is | 10:07 |
| apuimedo | https://blueprints.launchpad.net/kuryr/+spec/driver-binding-ipvlan | 10:07 |
| apuimedo | I put the info here | 10:07 |
| apuimedo | and in gerrit I'll reference the blueprint | 10:07 |
| lmdaly | apuimedo, looks good! thanks again | 10:16 |
| apuimedo | thanks to you | 10:16 |
| apuimedo | for bringing it up | 10:16 |
| *** yamamoto_ has quit IRC | 10:24 | |
| *** tonanhngo has joined #openstack-kuryr | 10:27 | |
| openstackgerrit | Antoni Segura Puimedon proposed openstack/kuryr: binding: Add driver based subsystem https://review.openstack.org/375864 | 10:29 |
| *** tonanhngo has quit IRC | 10:29 | |
| apuimedo | vikasc: ivc_ lmdaly: ^^ | 10:29 |
| vikasc | apuimedo, ack | 10:29 |
| ivc_ | apuimedo what about veth_dst_prefix https://review.openstack.org/#/c/375864/8/kuryr/lib/config.py@67 ? | 10:32 |
| apuimedo | ivc_: sorry. I had forgotten to publish my comments | 10:33 |
| apuimedo | just pushed it now | 10:33 |
| apuimedo | it's something I prefer to do on a separate patch | 10:33 |
| apuimedo | which I'll send now | 10:33 |
| apuimedo | funnily enough, I don't think that config variable was being used | 10:34 |
| ivc_ | btw apuimedo, vikasc I've lifted [WIP] from https://review.openstack.org/#/c/376042/; now focused on bringing os-vif objects/models to https://review.openstack.org/#/c/376044/ | 10:34 |
| apuimedo | only in kuryr-libnetwork I see it used | 10:35 |
| apuimedo | great! | 10:35 |
| apuimedo | ivc_: going to it | 10:35 |
| vikasc | ivc_, thanks! | 10:36 |
| openstackgerrit | Antoni Segura Puimedon proposed openstack/kuryr: Replace link_remove with link delete https://review.openstack.org/374591 | 10:37 |
| openstackgerrit | Antoni Segura Puimedon proposed openstack/kuryr: binding: use cached interface info https://review.openstack.org/335500 | 10:37 |
| ivc_ | also thnx for your reviews on k8s events devref | 10:38 |
| *** diga_ has joined #openstack-kuryr | 10:41 | |
| vikasc | ivc_, eagerly waiting for an update patch on k8s events devref. :) | 10:41 |
| ivc_ | vikasc I'm deliberately not updating it until I've settled with the implementation approach :) | 10:43 |
| ivc_ | the blocker for me is https://review.openstack.org/#/c/376043/ | 10:44 |
| ivc_ | as i'm not quite happy with the implementation yet | 10:44 |
| vikasc | ivc_, i was thinking that details on devref will help better understand and review implentation patches. No worries. Please update once you feel comfortable :) | 10:45 |
| ivc_ | and also I'll probably get rid of context/providers concept in favour of a more simple approach like in https://review.openstack.org/#/c/376044/ | 10:45 |
| ivc_ | there are literally just 2 things that i don't quite like that. one is that watcher/events patch (but thats mostly a cleanup issue) | 10:46 |
| ivc_ | and the other one is i need some container for a shared state like global_context in https://review.openstack.org/#/c/376046/1/kuryr_kubernetes/controller/service.py@39 | 10:47 |
| ivc_ | to hold the namespace/node specific networking configuration (e.g. neutron subnet/network/tenant ids) | 10:47 |
| *** openstackgerrit has quit IRC | 10:48 | |
| ivc_ | ofc we could just http 'get' namespace/node annotations on each pod event, but thats something i'd like to avoid | 10:48 |
| *** openstackgerrit has joined #openstack-kuryr | 10:48 | |
| ivc_ | that was the main reason for the context/providers approach i described in devref, but when it gets to code it really just makes things more complex than it should be and hard to read/navigate the codebase | 10:50 |
| apuimedo | indeed | 10:52 |
| apuimedo | maybe we can find another way of avoiding the extra get | 10:52 |
| ivc_ | its quite simple. that 'global_context' in https://review.openstack.org/#/c/376046/1/kuryr_kubernetes/controller/service.py@39 does solve the problem | 10:54 |
| ivc_ | i just want it to have some better name than 'context' and some clean api rather then just a dict | 10:55 |
| apuimedo | well, I think it's okay if we just put retrieval methods as needed | 10:56 |
| apuimedo | for 0.1.0 | 10:56 |
| ivc_ | i was for a moment thinking of using config.CONF as a storage for that | 10:56 |
| apuimedo | and in 1.0.0 we take the experience to make a better API | 10:56 |
| apuimedo | ivc_: that's a bit brutal :P | 10:57 |
| ivc_ | but that info is indeed part of the config | 10:57 |
| apuimedo | I consider it more state than info | 10:58 |
| apuimedo | s/info/config/ | 10:58 |
| ivc_ | but its static | 10:58 |
| apuimedo | example? | 10:59 |
| ivc_ | and as you said once it could even be driven by the config (e.g. when we are leaving namespaces without network annotations and sticking with default subnet from config) | 10:59 |
| ivc_ | the namespace annotation i'm talking about is the pod subnet id / service subnet id / tenant id | 11:00 |
| apuimedo | oh, I thought you meant namespace live annotation state | 11:00 |
| ivc_ | its live but its static | 11:00 |
| ivc_ | i mean we can start k8s without annotations on namespace | 11:01 |
| ivc_ | but then use our (yet to be implemented) cli to update namespace with neutron subnets | 11:01 |
| ivc_ | but that annotation would be write-once as there's no sane way to reconfigure pods/services if we want to change subnet on namespace | 11:02 |
| apuimedo | mmm | 11:02 |
| apuimedo | so the options are | 11:03 |
| ivc_ | tho that annotation is live as it would be configurable in runtime with our cli and will be picked by watchers' namespace event processor | 11:03 |
| apuimedo | a) We have a config option that says, for each namespace we see, we get a subnet from a pool | 11:03 |
| ivc_ | b) we will specify subnet with cli | 11:04 |
| apuimedo | c) we rely completely on the users creating the namespaces with annotations of existing subnets | 11:04 |
| ivc_ | no (c). that is covered by (b) | 11:04 |
| ivc_ | and (a) would just add annotations for (b), so the annotation handling is the same for both options | 11:07 |
| ivc_ | just that (a) is automation for (b) | 11:07 |
| *** tonanhngo has joined #openstack-kuryr | 11:08 | |
| *** tonanhngo has quit IRC | 11:09 | |
| ivc_ | i think i'll just make some simple dict-wrapping api e.g. class NetworkSettings(): def get_pod_subnet(namespace, node) / get_service_subnet(namespace) | 11:10 |
| ivc_ | and make it a singleton | 11:10 |
| ivc_ | yeah! i like it now | 11:11 |
| ivc_ | thnx guys :) | 11:11 |
| ivc_ | (sry for spam) | 11:12 |
| apuimedo | mm | 11:12 |
| *** sdake_ has joined #openstack-kuryr | 11:12 | |
| apuimedo | if you want to make it a singleton, why to use a class and not directly a module, which is guaranteed to be a singleton? | 11:12 |
| ivc_ | its an object | 11:13 |
| *** salv-orl_ has quit IRC | 11:14 | |
| ivc_ | and it complicates testing | 11:14 |
| *** sdake has quit IRC | 11:14 | |
| ivc_ | if you do like you said with modules | 11:14 |
| apuimedo | ok, go ahead with the dict wrapper | 11:17 |
| *** salv-orlando has joined #openstack-kuryr | 11:18 | |
| apuimedo | and it is not spam, it is wanted and healthy discussion | 11:20 |
| apuimedo | lmdaly: please, review the new binding patch when you get a chance | 11:21 |
| apuimedo | vikasc: waiting for your +2 two :P | 11:21 |
| *** yamamoto has joined #openstack-kuryr | 11:26 | |
| *** lmdaly has quit IRC | 11:30 | |
| vikasc | apuimedo, i am on it | 11:41 |
| apuimedo | cool, thanks | 11:42 |
| *** tonanhngo has joined #openstack-kuryr | 11:43 | |
| openstackgerrit | Ilya Chukhnakov proposed openstack/kuryr-kubernetes: K8s and Neutron clients support https://review.openstack.org/376042 | 11:44 |
| *** tonanhngo has quit IRC | 11:45 | |
| * apuimedo reviewing ^^ | 11:49 | |
| *** lezbar has quit IRC | 11:49 | |
| *** lezbar has joined #openstack-kuryr | 11:50 | |
| *** sdake_ is now known as sdake | 11:52 | |
| ivc_ | apuimedo, agreed on using kuryr_lib get_neutron_client | 11:55 |
| apuimedo | ivc_: what are the cycles for in the watch test? | 11:56 |
| ivc_ | but then we should probably update kuryr_lib to use OpenStackConfig | 11:56 |
| ivc_ | apuimedo, cycles are how many times it will go through while True loop | 11:57 |
| apuimedo | ivc_: ? | 11:57 |
| apuimedo | it uses keystoneauth1 | 11:57 |
| apuimedo | just like the other projects | 11:57 |
| apuimedo | os-client-config it uses only for testing | 11:57 |
| apuimedo | https://github.com/openstack/kuryr-libnetwork/blob/master/kuryr_libnetwork/controllers.py#L47-L65 | 11:58 |
| ivc_ | but https://review.openstack.org/#/c/376042/4/kuryr_kubernetes/clients.py uses both keystoneauth1 and os-client-config | 11:58 |
| ivc_ | i actually just 'borrowed' the implementation from neutronclient itself | 11:58 |
| ivc_ | https://github.com/openstack/python-neutronclient/blob/master/neutronclient/shell.py#L889 | 11:59 |
| *** lmdaly has joined #openstack-kuryr | 12:00 | |
| ivc_ | i think its the way we should do it in kuryr.lib | 12:00 |
| openstackgerrit | Merged openstack/kuryr-libnetwork: Using kuryr-lib constants https://review.openstack.org/375389 | 12:09 |
| openstackgerrit | Ilya Chukhnakov proposed openstack/kuryr-kubernetes: K8s and Neutron clients support https://review.openstack.org/376042 | 12:10 |
| ivc_ | apuimedo ^^ updated to use kuryr.lib get_neutron_client | 12:11 |
| *** tonanhngo has joined #openstack-kuryr | 12:13 | |
| *** tonanhngo has quit IRC | 12:14 | |
| ivc_ | apuimedo, regarding cycles, K8sClient.watch is a generator and is infinite (it will take care of retrying http calls on failures, tho the http connection failures are not handled atm). so the cycles is the means to limit that generator. think of cycles as if the k8s 'watch' get request was ended by k8s api server and restarted | 12:15 |
| *** yamamoto has quit IRC | 12:21 | |
| apuimedo | understood | 12:44 |
| apuimedo | thanks | 12:44 |
| apuimedo | ivc_: why the __version__ removal? | 12:59 |
| apuimedo | https://review.openstack.org/#/c/376042/5/kuryr_kubernetes/__init__.py | 12:59 |
| *** yamamoto has joined #openstack-kuryr | 13:04 | |
| *** tonanhngo has joined #openstack-kuryr | 13:04 | |
| *** tonanhngo has quit IRC | 13:05 | |
| *** limao has joined #openstack-kuryr | 13:12 | |
| ivc_ | apuimedo, didn't notice __version__ there :) the intent was to remove config_map and py35-related watchers import | 13:22 |
| apuimedo | :-) | 13:22 |
| ivc_ | why do we need __version__ there btw? | 13:23 |
| apuimedo | ivc_: it's just nice when you import some package to check the __version__ | 13:25 |
| *** limao has quit IRC | 13:26 | |
| *** limao has joined #openstack-kuryr | 13:27 | |
| openstackgerrit | Ilya Chukhnakov proposed openstack/kuryr-kubernetes: K8s and Neutron clients support https://review.openstack.org/376042 | 13:27 |
| ivc_ | ^^ reverted the removal of __version__ | 13:28 |
| apuimedo | thanks ivc_ | 13:28 |
| apuimedo | ivc_: approved | 13:28 |
| apuimedo | vikasc: review it, when you have a moment | 13:28 |
| ivc_ | thnx apuimedo | 13:29 |
| vikasc | sure apuimedo | 13:29 |
| apuimedo | thanks to you ivc_ | 13:29 |
| apuimedo | ivc_: which should we check next | 13:34 |
| apuimedo | ? | 13:34 |
| *** limao_ has joined #openstack-kuryr | 13:35 | |
| *** janki has quit IRC | 13:36 | |
| ivc_ | apuimedo https://review.openstack.org/#/c/376043/ maybe | 13:36 |
| apuimedo | k | 13:36 |
| *** limao__ has joined #openstack-kuryr | 13:36 | |
| ivc_ | i still want to cleanup it a bit and have not fixed pep8 and no ut yet | 13:36 |
| ivc_ | but some sort of 'conceptual' review would not hurt :) | 13:37 |
| *** limao has quit IRC | 13:37 | |
| *** limao_ has quit IRC | 13:39 | |
| *** huikang has joined #openstack-kuryr | 13:41 | |
| *** huikang has quit IRC | 13:41 | |
| *** huikang has joined #openstack-kuryr | 13:41 | |
| *** diga_ has quit IRC | 13:43 | |
| *** salv-orl_ has joined #openstack-kuryr | 13:44 | |
| *** ivc_ has quit IRC | 13:47 | |
| *** salv-orlando has quit IRC | 13:47 | |
| *** hongbin has joined #openstack-kuryr | 13:47 | |
| *** limao has joined #openstack-kuryr | 13:47 | |
| *** limao_ has joined #openstack-kuryr | 13:48 | |
| *** limao_ has quit IRC | 13:49 | |
| *** ivc_ has joined #openstack-kuryr | 13:49 | |
| *** limao_ has joined #openstack-kuryr | 13:49 | |
| *** limao__ has quit IRC | 13:50 | |
| ivc_ | apuimedo, vikasc, also regarding https://review.openstack.org/#/c/376043/ i've got a naming issue :) | 13:50 |
| ivc_ | i dont like the 'Processor' name for those classes, maybe you got a better suggestion | 13:50 |
| ivc_ | e.g. Listener or Observer or just Callback | 13:51 |
| apuimedo | let me check | 13:51 |
| *** limao has quit IRC | 13:52 | |
| apuimedo | ivc_: well, it is processor or handler | 13:53 |
| apuimedo | I think I prefer handler | 13:54 |
| apuimedo | since it is more identifiable | 13:54 |
| *** tonanhngo has joined #openstack-kuryr | 13:57 | |
| *** yedongcan has joined #openstack-kuryr | 13:58 | |
| vikasc | +1 for handler | 13:58 |
| *** limao has joined #openstack-kuryr | 14:01 | |
| *** huikang has quit IRC | 14:01 | |
| apuimedo | ivc_: meeting in openstack-meeting-4\ | 14:01 |
| ivc_ | ok its handler then | 14:01 |
| ivc_ | yup | 14:01 |
| *** huikang has joined #openstack-kuryr | 14:01 | |
| *** limao_ has quit IRC | 14:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/kuryr: Updated from global requirements https://review.openstack.org/357683 | 14:10 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/kuryr-libnetwork: Updated from global requirements https://review.openstack.org/351976 | 14:10 |
| *** huikang has quit IRC | 14:18 | |
| *** huikang has joined #openstack-kuryr | 14:18 | |
| *** huikang has quit IRC | 14:23 | |
| *** garyloug has joined #openstack-kuryr | 14:24 | |
| *** diogogmt has joined #openstack-kuryr | 14:50 | |
| *** limao_ has joined #openstack-kuryr | 14:52 | |
| *** limao has quit IRC | 14:55 | |
| *** limao has joined #openstack-kuryr | 15:00 | |
| apuimedo | ivc_: hongbin: tonanhngo: one option I considered with the no-auth approach | 15:01 |
| apuimedo | was to have ssl client side authentication to an nginx neutron proxy | 15:02 |
| *** yedongcan_ has joined #openstack-kuryr | 15:02 | |
| apuimedo | and have there some modification of the headers that put our service token auth | 15:02 |
| *** yedongcan_ has quit IRC | 15:03 | |
| *** limao_ has quit IRC | 15:03 | |
| hongbin | sorry, didn't get your question | 15:04 |
| *** limao_ has joined #openstack-kuryr | 15:04 | |
| *** yamamoto has quit IRC | 15:04 | |
| *** yedongcan has quit IRC | 15:05 | |
| *** limao has quit IRC | 15:06 | |
| apuimedo | not really a question | 15:06 |
| hongbin | apuimedo: the authentication happened between kuryr agent in VM and the neutron api? | 15:06 |
| apuimedo | I was more thinking while writing | 15:06 |
| apuimedo | the we could have kuryr in the instances have an ssl key and cert | 15:07 |
| apuimedo | and then an nging proxy to neutron outside of the instance that checked the client auth and dropped not whitelisted requests | 15:08 |
| apuimedo | but it sounds hacky | 15:08 |
| hongbin | the kuryr agent has to be installed in nova instance? | 15:09 |
| apuimedo | each nova instance that runs docker engine will need a kuryr agent | 15:09 |
| apuimedo | libnetwork driver or kubelet cni driver | 15:09 |
| hongbin | however, the libnetwork driver just needs to do the port binding, not necessary doing teh authentication | 15:10 |
| hongbin | right? | 15:10 |
| hongbin | (i am possibly wrong since i am not in the domain) | 15:10 |
| apuimedo | hongbin: kuryr-libnetwork needs to do both | 15:12 |
| apuimedo | kuryr cni driver only the binding | 15:12 |
| apuimedo | however | 15:12 |
| apuimedo | it would be possible to have kuryr-libnetwork broken out | 15:13 |
| apuimedo | in a way to have only one server doing the the auth and neutron actions | 15:13 |
| hongbin | the broken out seems to be more ideal | 15:13 |
| apuimedo | and then calling other servers in each machine to do the binding | 15:13 |
| hongbin | yes | 15:14 |
| apuimedo | hongbin: well, we could test the assumption of this being possible by writing a binding driver that does the operations via ssh to the hosts where the binding should happen :P | 15:14 |
| apuimedo | hacky as hell, but to proof the concept... | 15:15 |
| *** limao_ has quit IRC | 15:15 | |
| hongbin | apuimedo: you could have two agents | 15:15 |
| hongbin | apuimedo: one that is providing rest service for port binding | 15:15 |
| *** limao has joined #openstack-kuryr | 15:15 | |
| hongbin | apuimedo: another is doing the rest | 15:15 |
| apuimedo | sure, that would be the proper way | 15:15 |
| apuimedo | I was talking about a one day effort to try it out :P | 15:16 |
| hongbin | ok | 15:16 |
| tonanhngo | that would be good, to see if any issue pops up. | 15:16 |
| apuimedo | cause with the two agents, you should also set up some authentication between the main agent and the binding ones | 15:16 |
| apuimedo | exactly | 15:16 |
| tonanhngo | security is hard :) | 15:17 |
| hongbin | apuimedo: yes, there are several ways to deal with authentication between agents | 15:17 |
| hongbin | apuimedo: if one agent on swarm agents, another agent on swarm master, we could use security group and disable authentication | 15:18 |
| hongbin | apuimedo: if one agent on swarm agents, another agent on kuryr control plane, we could have a keystone role to limit the access of the agent | 15:18 |
| apuimedo | hongbin: I didn't mean keystone auth, I meant just so that the requests to the binding agent would only come from the kuryr-libnetwork agent running on the controller | 15:19 |
| hongbin | apuimedo: in magnum, we can place two agents in the same security group, that restrict the access to the agent port within that security group | 15:20 |
| hongbin | however, that is magnum specific | 15:21 |
| apuimedo | hongbin: I was more worried about local access to the binding server | 15:22 |
| apuimedo | but it may not be a problem after all | 15:22 |
| apuimedo | like, containers run with host networking could mess with the driver, but this is already the case | 15:22 |
| apuimedo | so yeah, we should probably try this agent separation | 15:22 |
| apuimedo | (we would need a blueprint and somebody to take up this task) | 15:23 |
| *** yamamoto has joined #openstack-kuryr | 15:23 | |
| hongbin | i might take the bp, but needs some times to pick up the kuryr codebase | 15:24 |
| apuimedo | hongbin: let me know when the bp is up and I'll review | 15:24 |
| apuimedo | and if you have time for coding it I can give you some tips | 15:24 |
| hongbin | apuimedo: sure. thx | 15:24 |
| apuimedo | thanks to you! | 15:25 |
| hongbin | my pleasure | 15:25 |
| *** limao_ has joined #openstack-kuryr | 15:27 | |
| openstackgerrit | Merged openstack/kuryr: binding: Add driver based subsystem https://review.openstack.org/375864 | 15:28 |
| *** limao has quit IRC | 15:30 | |
| *** huikang has joined #openstack-kuryr | 15:32 | |
| ivc_ | apuimedo, hongbin, i think for kuryr-k8s access to neutron from cni is not an issue as cni will only use k8s watch api to get the data | 15:34 |
| apuimedo | ivc_: agreed | 15:35 |
| apuimedo | :-) | 15:35 |
| ivc_ | and all neutron interactions are done by the controller (did we actually drop the 'raven' name?) | 15:35 |
| ivc_ | i think i understand the reason why you wanted the rpc server for libnetwork :) | 15:37 |
| *** lezbar has quit IRC | 15:44 | |
| *** lezbar has joined #openstack-kuryr | 15:45 | |
| openstackgerrit | Liping Mao proposed openstack/kuryr-libnetwork: [DO NOT MERGE] Test UT https://review.openstack.org/379295 | 15:49 |
| *** huikang has quit IRC | 15:58 | |
| *** huikang has joined #openstack-kuryr | 15:59 | |
| *** tonanhngo has quit IRC | 15:59 | |
| openstackgerrit | Ilya Chukhnakov proposed openstack/kuryr-kubernetes: K8s and Neutron clients support https://review.openstack.org/376042 | 16:01 |
| ivc_ | hongbin, apuimedo, ^^ updated the commit message to reflect that the K8sClient it introduces is a temporary solution | 16:02 |
| *** huikang_ has joined #openstack-kuryr | 16:03 | |
| *** huikang has quit IRC | 16:03 | |
| hongbin | ivc_: thx | 16:04 |
| openstackgerrit | Ilya Chukhnakov proposed openstack/kuryr-kubernetes: K8s and Neutron clients support https://review.openstack.org/376042 | 16:07 |
| ivc_ | ^^ l2spell issue:/ | 16:07 |
| ivc_ | they should really add a spellcheck to gerrit 'edit' form :) | 16:08 |
| *** huikang_ has quit IRC | 16:26 | |
| *** huikang has joined #openstack-kuryr | 16:26 | |
| *** sdake has quit IRC | 16:30 | |
| *** huikang has quit IRC | 16:31 | |
| *** sdake has joined #openstack-kuryr | 16:34 | |
| *** tonanhngo has joined #openstack-kuryr | 16:48 | |
| *** tonanhngo has quit IRC | 16:50 | |
| *** tonanhngo has joined #openstack-kuryr | 16:50 | |
| *** lmdaly has quit IRC | 16:50 | |
| *** yamamoto has quit IRC | 16:59 | |
| *** salv-orl_ has quit IRC | 17:12 | |
| *** salv-orlando has joined #openstack-kuryr | 17:20 | |
| *** huikang has joined #openstack-kuryr | 17:37 | |
| *** sdake has quit IRC | 17:39 | |
| *** lezbar has quit IRC | 17:42 | |
| *** lezbar has joined #openstack-kuryr | 17:43 | |
| *** sdake has joined #openstack-kuryr | 17:44 | |
| *** salv-orlando has quit IRC | 17:53 | |
| *** huikang has quit IRC | 17:54 | |
| *** lezbar has quit IRC | 18:00 | |
| *** sdake has quit IRC | 18:01 | |
| *** lezbar has joined #openstack-kuryr | 18:01 | |
| *** ivc_ has quit IRC | 18:07 | |
| openstackgerrit | Merged openstack/kuryr: Replace link_remove with link delete https://review.openstack.org/374591 | 18:10 |
| openstackgerrit | Merged openstack/kuryr: binding: use cached interface info https://review.openstack.org/335500 | 18:10 |
| *** banix has joined #openstack-kuryr | 18:11 | |
| *** garyloug has quit IRC | 18:11 | |
| *** ivc_ has joined #openstack-kuryr | 18:11 | |
| *** yamamoto has joined #openstack-kuryr | 18:30 | |
| *** banix has quit IRC | 18:38 | |
| *** ivc_ has quit IRC | 18:39 | |
| *** banix has joined #openstack-kuryr | 18:52 | |
| *** yamamoto has quit IRC | 19:00 | |
| *** garyloug has joined #openstack-kuryr | 19:19 | |
| *** salv-orlando has joined #openstack-kuryr | 19:30 | |
| *** salv-orl_ has joined #openstack-kuryr | 19:44 | |
| *** salv-orlando has quit IRC | 19:47 | |
| banix | apuimedo: are you around by any chance? | 19:52 |
| *** tonanhngo has quit IRC | 19:57 | |
| *** sdake has joined #openstack-kuryr | 20:05 | |
| *** garyloug has quit IRC | 20:08 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/kuryr: Updated from global requirements https://review.openstack.org/357683 | 20:11 |
| *** tonanhngo has joined #openstack-kuryr | 20:18 | |
| *** tonanhngo has quit IRC | 20:23 | |
| *** tonanhngo has joined #openstack-kuryr | 20:27 | |
| *** garyloug has joined #openstack-kuryr | 20:28 | |
| *** banix has quit IRC | 20:30 | |
| *** lezbar has quit IRC | 21:10 | |
| *** lezbar has joined #openstack-kuryr | 21:11 | |
| *** banix has joined #openstack-kuryr | 21:14 | |
| *** openstackgerrit has quit IRC | 21:19 | |
| *** openstackgerrit has joined #openstack-kuryr | 21:19 | |
| *** garyloug has quit IRC | 21:19 | |
| *** diogogmt has quit IRC | 21:32 | |
| *** tonanhngo has quit IRC | 21:36 | |
| *** tonanhngo has joined #openstack-kuryr | 21:43 | |
| *** tonanhngo has quit IRC | 21:48 | |
| *** sdake has quit IRC | 22:16 | |
| *** salv-orlando has joined #openstack-kuryr | 22:28 | |
| *** salv-orl_ has quit IRC | 22:28 | |
| *** sdake has joined #openstack-kuryr | 22:34 | |
| *** lezbar has quit IRC | 22:48 | |
| *** lezbar has joined #openstack-kuryr | 22:49 | |
| *** salv-orlando has quit IRC | 22:55 | |
| *** hongbin has quit IRC | 22:59 | |
| *** tonanhngo has joined #openstack-kuryr | 23:15 | |
| *** tonanhngo has quit IRC | 23:18 | |
| *** pmannidi has joined #openstack-kuryr | 23:21 | |
| *** tonanhngo has joined #openstack-kuryr | 23:27 | |
| *** lezbar has quit IRC | 23:28 | |
| *** tonanhngo has quit IRC | 23:28 | |
| *** lezbar has joined #openstack-kuryr | 23:29 | |
| *** tonanhngo has joined #openstack-kuryr | 23:35 | |
| *** tonanhngo has quit IRC | 23:40 | |
| *** tonanhngo has joined #openstack-kuryr | 23:47 | |
| *** tonanhngo has quit IRC | 23:47 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!