| *** hongbin has quit IRC | 00:33 | |
| *** portdirect is now known as portdirect_travl | 00:40 | |
| *** limao has joined #openstack-kuryr | 00:41 | |
| *** huikang has joined #openstack-kuryr | 01:06 | |
| *** yedongcan has joined #openstack-kuryr | 01:26 | |
| *** huikang has quit IRC | 01:41 | |
| *** huikang has joined #openstack-kuryr | 01:41 | |
| *** huikang has quit IRC | 01:47 | |
| openstackgerrit | dengshaolin proposed openstack/fuxi: Replace hardcode values with OptGroup in config setting https://review.openstack.org/415378 | 03:05 |
|---|---|---|
| *** hongbin has joined #openstack-kuryr | 04:10 | |
| janonymous | irenab: ping | 04:19 |
| *** hongbin has quit IRC | 04:56 | |
| *** hongbin has joined #openstack-kuryr | 04:56 | |
| *** hongbin_ has joined #openstack-kuryr | 05:09 | |
| *** hongbin has quit IRC | 05:11 | |
| *** hongbin_ has quit IRC | 05:21 | |
| irenab | janonymous, hi | 05:27 |
| janonymous | irenab: i was trying the ssl doc : http://tech.paulcz.net/2016/01/secure-docker-with-tls/ Openssl section | 05:28 |
| irenab | janonymous, did it work for you? | 05:28 |
| janonymous | i have a few doubts: | 05:28 |
| janonymous | In openssl genrsa -out ~/.docker/ca-key.pem 2048 ..-out did you gave same paths? | 05:28 |
| janonymous | Also in openssl req -x509 -new -nodes -key ~/.docker/ca-key.pem \ | 05:29 |
| janonymous | -days 10000 -out ~/.docker/ca.pem -subj '/CN=docker-CA' what did you mentioned in /CN | 05:29 |
| janonymous | irenab: testing it now | 05:29 |
| irenab | janonymous, I just copied the cert, ca and key files into the path you suggested, didn't change anything in the commands | 05:29 |
| irenab | janonymous, then when I restarted docker-engine, I added TLS arguments to the service invocation line | 05:30 |
| janonymous | also you copied certs from ~/.docker/ or /etc/ssl ? | 05:31 |
| janonymous | and did you generated both client and server certs | 05:31 |
| janonymous | irenab: sry for a lot of questions, i will try this out now. | 05:31 |
| irenab | janonymous, followed all the instructions, justr did manually, not with the container they suggest as an alternative | 05:31 |
| irenab | both client asnd server | 05:32 |
| irenab | --tlsverify --tlscacert=/etc/docker/ssl/ca.pem --tlscert=/etc/docker/ssl/cert.pem --tlskey=/etc/docker/ssl/key.pem" | 05:32 |
| irenab | check the files that are required for invocation, this is where I copied them from to the /var/lib/kuryr/certs | 05:33 |
| janonymous | ohkay, will check and get back | 05:34 |
| irenab | janonymous, I was running all in one machine, maybe it is easier since both server and client are local | 05:34 |
| janonymous | by all-in-one you mean devstack on single node or something else? | 05:35 |
| irenab | yes | 05:39 |
| irenab | and docker client is also invoked from the devstack node | 05:40 |
| janonymous | Do you have that env now? | 05:40 |
| janonymous | irenab: ^^ | 05:40 |
| irenab | janonymous, no ... | 05:40 |
| irenab | But I can deploy | 05:40 |
| irenab | will take some time though | 05:41 |
| irenab | let me kick it for now | 05:41 |
| janonymous | mine was giving error | 05:41 |
| janonymous | http://paste.openstack.org/show/596537/ | 05:42 |
| janonymous | irenab: can you record your termnal this time | 05:42 |
| janonymous | :) it would be helpful to me | 05:42 |
| irenab | janonymous, try to copy all 3 cert files into /var.../kuryr/cert | 05:49 |
| irenab | and then restart kuryr and docker | 05:49 |
| irenab | maybe its the matter of access permissions | 05:49 |
| janonymous | irenab: yeah, tried that... scp -r /etc/docker/ssl/* /var.../kuryr/certs/ | 05:50 |
| irenab | try this | 05:52 |
| irenab | $ export DOCKER_TLS_VERIFY=1 | 05:52 |
| irenab | $ export DOCKER_CERT_PATH=~/.docker | 05:52 |
| irenab | $ docker info | 05:52 |
| irenab | docker info | 05:52 |
| irenab | does it work? | 05:52 |
| irenab | check that client and docker are ok with certs | 05:53 |
| janonymous | lemme check | 05:55 |
| janonymous | http://paste.openstack.org/show/596541/ | 05:59 |
| janonymous | irenab: Is sudo /usr/bin/docker daemon -H unix:///var/run/docker.sock -H tcp://0.0.0.0:2375 --tlsverify --tlscacert=/var/lib/kuryr/certs/ca.pem --tlscert=/var/lib/kuryr/certs/cert.pem --tlskey=/var/lib/kuryr/certs/key.pem --cluster-store etcd://localhost:5001 correct? i mean /var/lib/kuryr/certs/* are copied from /etc/docker/ssl/* | 06:05 |
| irenab | janonymous, as far as I remember yes. Seems it worked for you | 06:07 |
| irenab | by default kuryr uses port 4001 for etcd. I changed it, sinc eI am deploying with Dragonflow and it uses 4001 for REdis | 06:08 |
| irenab | janonymous, my devstack is not ready yet, so cannot check currently | 06:09 |
| *** janonymous has quit IRC | 06:13 | |
| *** janonymous has joined #openstack-kuryr | 06:13 | |
| *** saneax has joined #openstack-kuryr | 06:34 | |
| *** saneax is now known as saneax-_-|AFK | 06:46 | |
| *** yedongcan has left #openstack-kuryr | 07:31 | |
| apuimedo | still dealing with the certs patch reproduction irenab janonymous ? | 07:38 |
| *** yamamoto has quit IRC | 07:41 | |
| janonymous | apuimedo: yeah, was trying to get it done | 07:41 |
| apuimedo | :-) | 07:52 |
| apuimedo | good! | 07:52 |
| *** yamamoto has joined #openstack-kuryr | 08:16 | |
| *** limao has quit IRC | 09:17 | |
| openstackgerrit | Jaivish Kothari(janonymous) proposed openstack/kuryr-kubernetes: Remove link to modindex https://review.openstack.org/425597 | 09:38 |
| *** garyloug has joined #openstack-kuryr | 09:41 | |
| irenab | apuimedo, I deployed it again and it worked for me. Waiting for janonymous to confirm if it works for him | 09:49 |
| apuimedo | cool | 09:50 |
| apuimedo | irenab: did you finally agree with ivc_ on anything regarding your comment ot https://review.openstack.org/#/c/423903/ | 09:51 |
| apuimedo | s/ot/to/ | 09:51 |
| ltomasbo | have anyone tried kuryr-kubernetes with native-ovs? | 09:53 |
| ltomasbo | I saw VIF support was added, but I'm getting some errors, most probably missing some configuration step | 09:54 |
| ltomasbo | I'm getting this: Error adding network: No 'kuryr_kubernetes.cni.binding' driver found, looking for 'VIFOpenVSwitch' | 09:55 |
| ltomasbo | though I see it is preceded by trying to use eth0, while the nic name is different | 09:56 |
| ltomasbo | NetworkPlugin cni failed on the status hook for pod 'busybox-sleep' - Unexpected command output Device "eth0" does not exist. | 09:56 |
| ltomasbo | with error: exit status 1 | 09:56 |
| apuimedo | ltomasbo: both vikas and irenab have tried it | 09:58 |
| ltomasbo | any quick tip where to change that? is it kuryr.conf? | 09:58 |
| apuimedo | ltomasbo: bare-metal? | 09:59 |
| ltomasbo | yep | 09:59 |
| ltomasbo | I think it is getting the wrong nic name, and failing to load the binding driver | 10:02 |
| *** devvesa has quit IRC | 10:08 | |
| apuimedo | irenab: any idea? | 10:10 |
| *** devvesa has joined #openstack-kuryr | 10:23 | |
| apuimedo | ltomasbo: paste me your local.conf | 10:32 |
| apuimedo | please | 10:33 |
| ltomasbo | sure | 10:33 |
| ltomasbo | http://paste.openstack.org/show/596554/ | 10:34 |
| ltomasbo | I used that one, to try the loadbalancer stuff | 10:34 |
| ltomasbo | but then I when to /opt/stack/kuryr-kubernetes | 10:35 |
| ltomasbo | and did a checkout of the master (to have ovs-native support) | 10:35 |
| ltomasbo | and restarted screen kuryr services | 10:35 |
| irenab | apuimedo, just back to my desk, checking logs | 10:57 |
| irenab | apuimedo, do you have any reference how to move bp from one launchpad project to another | 10:59 |
| irenab | ltomasbo, I think that the service patch requires rebase | 11:00 |
| ltomasbo | I just used the master one | 11:01 |
| ltomasbo | without the service support | 11:01 |
| ltomasbo | (although I also tried with rebasing service patch too) | 11:01 |
| irenab | ltomasbo, from the beginning? | 11:01 |
| ltomasbo | same error | 11:01 |
| irenab | setup install? | 11:02 |
| ltomasbo | no | 11:02 |
| ltomasbo | just when to /opt/stack | 11:02 |
| ltomasbo | and inside kuryr-kubernetes | 11:02 |
| ltomasbo | I fetch the current master branch | 11:02 |
| ltomasbo | and restarted the kuryr-kubernetes services | 11:02 |
| irenab | I think you need to run kury-kubernetes setup install | 11:04 |
| irenab | or just restack with master | 11:04 |
| apuimedo | irenab: I'll do it and if it works, I'll tell you how | 11:06 |
| apuimedo | xd | 11:06 |
| apuimedo | irenab: link to the bp? | 11:06 |
| irenab | https://blueprints.launchpad.net/kuryr/+spec/kuryr-k8s-integration | 11:07 |
| ltomasbo | irenab, umm, ok, that is different from other openstack components | 11:07 |
| irenab | to move it to kuryr-kubernetes | 11:07 |
| ltomasbo | going to try that | 11:07 |
| irenab | ltomasbo, just due to the stevedor stuff it maybe required if initially you deployed ref to services patch | 11:08 |
| apuimedo | where the hell was that option to move it... | 11:09 |
| apuimedo | pffff | 11:09 |
| apuimedo | launchpad doesn't like me | 11:09 |
| irenab | apuimedo, I didn't find it ... | 11:09 |
| apuimedo | Yay! | 11:09 |
| apuimedo | I succeeded! | 11:09 |
| apuimedo | https://blueprints.launchpad.net/kuryr-kubernetes/+spec/kuryr-k8s-integration | 11:09 |
| apuimedo | the button is "Re-target blueprint" | 11:09 |
| irenab | apuimedo, wow! You are my hero for today :-) | 11:09 |
| apuimedo | irenab: I'm like JF with Jira xD | 11:10 |
| irenab | apuimedo, xD | 11:10 |
| *** openstackgerrit has quit IRC | 11:17 | |
| *** pc_m has quit IRC | 12:01 | |
| *** pc_m has joined #openstack-kuryr | 12:10 | |
| *** garyloug has quit IRC | 12:46 | |
| *** garyloug has joined #openstack-kuryr | 13:04 | |
| apuimedo | irenab: ivc_: I was thinking about the loadbalancer type | 13:09 |
| apuimedo | my current thought is to have a minimal kubernetes kuryr cloudprovider that does: | 13:10 |
| apuimedo | 1. Create a thirdparty resource with the IP request | 13:10 |
| apuimedo | 2. Wait for the service to be annotated with a fip resource | 13:11 |
| apuimedo | kuryr controller will watch for the third party resource and handle the rest | 13:11 |
| apuimedo | this way we don't need to have OSt credentials for the cloud provider | 13:12 |
| apuimedo | if we preferred to have credentials, We'd just create the fip from the kubernetes cloud provider, annotate and wait | 13:14 |
| irenab | apuimedo, what is this about? | 13:27 |
| ivc_ | apuimedo sounds good | 13:34 |
| apuimedo | ivc_: I'm now checking k8s code to see if it is possible | 13:35 |
| apuimedo | irenab: loadbalancer service type | 13:35 |
| ivc_ | so we'll implement 'loadbalancer type' as just an fip on top of service's LB, right? | 13:35 |
| apuimedo | I'm afraid that it may be problematic and that we'll have to have different code for bare metal and pod-in-vm | 13:36 |
| apuimedo | ivc_: that's right | 13:36 |
| apuimedo | in any case | 13:36 |
| apuimedo | only variation is.. How | 13:36 |
| apuimedo | :-) | 13:36 |
| ivc_ | should not be much of a problem. instead of calling external APIs k8s will just call itself | 13:37 |
| ivc_ | and if it has to be a sync call you can just 'wait' for 'ready' flag on annotation | 13:38 |
| ivc_ | i like it :) | 13:38 |
| apuimedo | lol | 13:39 |
| apuimedo | //GCE requires that the name of a load balancer starts with a lower case letter. | 13:39 |
| apuimedo | ret := "a" + string(service.UID) | 13:39 |
| apuimedo | that's not in gce specific cloud provider btw | 13:40 |
| apuimedo | :-) | 13:40 |
| ivc_ | i wonder why they use uid instead of namespace/name | 13:40 |
| ivc_ | uids are so human-unfriendly | 13:41 |
| apuimedo | no idea | 13:42 |
| apuimedo | https://github.com/kubernetes/kubernetes/blob/master/pkg/cloudprovider/cloud.go#L88 | 13:42 |
| apuimedo | so we can't put annotation to the service from there | 13:42 |
| apuimedo | I'll have to check if at least we can create the thirdparty resource | 13:42 |
| apuimedo | (which is the preferred option anyway) | 13:42 |
| *** dimak_ has joined #openstack-kuryr | 14:01 | |
| *** saneax-_-|AFK is now known as saneax | 14:11 | |
| *** dimak_ has quit IRC | 14:33 | |
| *** gsagie has joined #openstack-kuryr | 14:47 | |
| *** tonanhngo has joined #openstack-kuryr | 14:52 | |
| *** tonanhngo has quit IRC | 14:53 | |
| *** tonanhngo has joined #openstack-kuryr | 14:53 | |
| *** tonanhngo has quit IRC | 14:58 | |
| *** hongbin has joined #openstack-kuryr | 15:21 | |
| hongbin | apuimedo: hi antoni, want your opinion on this bp, do you think if it is a good idea? | 15:26 |
| hongbin | https://blueprints.launchpad.net/kuryr-libnetwork/+spec/existing-subnetpool\ | 15:26 |
| apuimedo | ah, I saw in the morning that you added me as approver | 15:27 |
| apuimedo | let's take a look | 15:27 |
| apuimedo | hongbin: sounds good. I'd like to hear limao and janonymous's thoughts on it | 15:28 |
| apuimedo | but reusing is always good | 15:28 |
| hongbin | apuimedo: thx | 15:28 |
| apuimedo | hongbin: can you add more about "to specify the name of subnetpool, however, it is only used for handling overlapping cidr." | 15:29 |
| apuimedo | the current usage | 15:29 |
| hongbin | apuimedo: ack | 15:30 |
| apuimedo | I'd like if the bp explained exactly how it is used now | 15:30 |
| apuimedo | and how the proposed change will affect usages | 15:30 |
| apuimedo | thanks hongbin | 15:30 |
| apuimedo | :-) | 15:30 |
| hongbin | yes, will add the details. | 15:30 |
| hongbin | apuimedo: thanks for the feedback | 15:31 |
| apuimedo | you're welcome! | 15:32 |
| *** garyloug has quit IRC | 15:37 | |
| *** garyloug has joined #openstack-kuryr | 15:44 | |
| *** openstackgerrit has joined #openstack-kuryr | 16:24 | |
| openstackgerrit | Luis Tomas Bolivar proposed openstack/kuryr-libnetwork: [WIP] Moving from device_owner to tagging https://review.openstack.org/425772 | 16:24 |
| openstackgerrit | Merged openstack/fuxi: Replace hardcode values with OptGroup in config setting https://review.openstack.org/415378 | 16:34 |
| apuimedo | ltomasbo: pretty big change there! | 16:47 |
| apuimedo | We gave up on the device_owner thing with Neutron? | 16:47 |
| ltomasbo | we'll it seems it is used in other places too, and armax told me that it is a field that should have never been exposed | 16:48 |
| ltomasbo | so, it will be probably safer in the future to go for tags | 16:49 |
| ltomasbo | https://review.openstack.org/#/c/419028/3 | 16:49 |
| ltomasbo | you can see the discussions there | 16:49 |
| ltomasbo | apuimedo: what's your opinion on this? | 16:51 |
| *** saneax is now known as saneax-_-|AFK | 16:52 | |
| apuimedo | ltomasbo: I think that gui wise it sucks | 16:52 |
| ltomasbo | I tried it with the tagging support for ports and it works, though it is an extra call to neutron to include the tag | 16:52 |
| apuimedo | since guis everywhere expose this | 16:53 |
| apuimedo | and not an arbitrary tag we use | 16:53 |
| apuimedo | ltomasbo: maybe this should be raised in the openstack mailing list | 16:53 |
| apuimedo | adding [horizon] | 16:54 |
| ltomasbo | so, you would like to push more for reverting and keep using device_owner? | 16:55 |
| ltomasbo | I just tested the tags, and created the patch as a way of not loosing the code (if needed) | 16:56 |
| ltomasbo | to be honest, we are not using that field that much, it was just used at deleting the port at kuryr-libnetwork, and we even remove it from there | 16:58 |
| ltomasbo | so, I did not have a strong opinion on what's better | 16:59 |
| ltomasbo | this other one I think is more important: https://review.openstack.org/#/c/421880 | 17:00 |
| apuimedo | ltomasbo: I'm just sorry to lose the visibility it gave | 17:00 |
| *** saneax-_-|AFK is now known as saneax | 17:00 | |
| ltomasbo | but I'm not getting the feedback from armax, as I'm not sure about the ironic complain here (not sure about the trunk port support at ironic) | 17:00 |
| *** tonanhngo has joined #openstack-kuryr | 17:05 | |
| apuimedo | ltomasbo: are you aware if nova marks the ports it manages in any way? | 17:08 |
| apuimedo | Or it just leverages its own db? | 17:08 |
| *** tonanhngo has quit IRC | 17:10 | |
| ltomasbo | I think it is marked as nova:compute | 17:11 |
| apuimedo | ltomasbo: so we should add [nova] to the email thread then | 17:14 |
| apuimedo | since their nova:compute for the parent is gonna get overwritten, won't it? | 17:14 |
| *** devvesa has quit IRC | 17:14 | |
| ltomasbo | no, it remains for the parent port | 17:14 |
| apuimedo | meh... That's a pity that we can't get them involved then | 17:16 |
| ltomasbo | :D | 17:16 |
| *** tonanhngo has joined #openstack-kuryr | 17:31 | |
| *** david-lyle has quit IRC | 17:59 | |
| *** v1k0d3n has quit IRC | 18:35 | |
| *** v1k0d3n has joined #openstack-kuryr | 18:43 | |
| *** garyloug has quit IRC | 18:52 | |
| *** saneax is now known as saneax-_-|AFK | 19:31 | |
| *** gsagie has quit IRC | 19:35 | |
| *** david-lyle has joined #openstack-kuryr | 19:45 | |
| *** dougbtv_ has joined #openstack-kuryr | 20:53 | |
| *** dougbtv has quit IRC | 20:54 | |
| *** dougbtv_ is now known as dougbtv | 20:54 | |
| *** yamamoto has quit IRC | 21:30 | |
| *** yamamoto has joined #openstack-kuryr | 22:11 | |
| *** neiljerram has quit IRC | 22:45 | |
| *** saneax-_-|AFK is now known as saneax | 23:02 | |
| *** pmannidi has joined #openstack-kuryr | 23:14 | |
| *** david-lyle has quit IRC | 23:51 | |
| *** david-lyle has joined #openstack-kuryr | 23:54 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!