| *** amotoki has joined #openstack-lbaas | 00:14 | |
| *** woodster_ has quit IRC | 01:00 | |
| *** madhu_ak has joined #openstack-lbaas | 02:07 | |
| *** madhu_ak has quit IRC | 02:26 | |
| *** woodster_ has joined #openstack-lbaas | 02:28 | |
| *** sbalukoff has quit IRC | 03:07 | |
| *** sbalukoff has joined #openstack-lbaas | 03:20 | |
| *** santosh_ns has joined #openstack-lbaas | 03:22 | |
| *** ajmiller has quit IRC | 04:34 | |
| *** vivek-eb_ has joined #openstack-lbaas | 04:48 | |
| *** vivek-ebay has quit IRC | 04:51 | |
| *** BrianShang has quit IRC | 04:56 | |
| *** BrianShang has joined #openstack-lbaas | 04:57 | |
| *** _kiran_ has joined #openstack-lbaas | 05:15 | |
| *** rdekel has joined #openstack-lbaas | 05:15 | |
| *** vivek-eb_ has quit IRC | 05:20 | |
| *** sbalukoff has quit IRC | 05:34 | |
| *** sbalukoff has joined #openstack-lbaas | 05:51 | |
| *** woodster_ has quit IRC | 06:30 | |
| *** kobis has joined #openstack-lbaas | 06:48 | |
| *** apuimedo has joined #openstack-lbaas | 06:54 | |
| *** chlong has quit IRC | 07:29 | |
| *** kiranr has joined #openstack-lbaas | 07:38 | |
| *** _kiran_ has quit IRC | 07:39 | |
| *** _kiran_ has joined #openstack-lbaas | 07:57 | |
| *** kiranr has quit IRC | 07:57 | |
| *** f13o has joined #openstack-lbaas | 08:47 | |
| *** chlong has joined #openstack-lbaas | 08:50 | |
| *** kbyrne has joined #openstack-lbaas | 08:54 | |
| *** apuimedo has quit IRC | 08:54 | |
| *** rdekel has quit IRC | 09:03 | |
| *** chlong has quit IRC | 09:20 | |
| *** pcaruana has quit IRC | 09:27 | |
| *** pcaruana has joined #openstack-lbaas | 09:30 | |
| *** chlong has joined #openstack-lbaas | 09:32 | |
| *** amotoki has quit IRC | 09:35 | |
| *** Tiancheng has joined #openstack-lbaas | 09:55 | |
| *** rdekel has joined #openstack-lbaas | 10:49 | |
| *** Tiancheng has quit IRC | 10:56 | |
| openstackgerrit | Salvatore Orlando proposed openstack/neutron-lbaas: Remove load_admin_roles from calls to get_admin_context https://review.openstack.org/175351 | 11:12 |
|---|---|---|
| *** apuimedo has joined #openstack-lbaas | 11:38 | |
| *** woodster_ has joined #openstack-lbaas | 11:46 | |
| *** apuimedo_ has joined #openstack-lbaas | 11:55 | |
| *** chlong has quit IRC | 11:58 | |
| *** apuimedo_ has quit IRC | 12:03 | |
| *** jschwarz has joined #openstack-lbaas | 12:33 | |
| *** f13o has quit IRC | 13:07 | |
| *** f13o has joined #openstack-lbaas | 13:12 | |
| jschwarz | Hi guys | 13:36 |
| jschwarz | I'm watching https://www.youtube.com/watch?v=dwAedB1jiYQ and was wondering about the status of L7, HA and TLS in LBaaS v2 | 13:36 |
| jschwarz | Are they mature enough? | 13:37 |
| *** apuimedo has quit IRC | 13:55 | |
| *** ajmiller has joined #openstack-lbaas | 14:08 | |
| ptoohill | jschwarz: lbaasv2 currently supports TLS and can do HA to an extent. L7 has patch out there but is not complete. Lbaas v2 is still marked as expirimental | 14:11 |
| jschwarz | ptoohill, how do I go about using TLS on my lbaasv2? | 14:14 |
| ptoohill | i should say L7 is just not tested/merged. I believe its 'complete' but didnt make it in time | 14:14 |
| ptoohill | jschwarz: do you have lbaasv2 running? | 14:14 |
| jschwarz | ptoohill, I have 'q-lbaas' enabled on my devstack, so that must be v1? | 14:15 |
| ptoohill | If you have lbaasv2 running you will also need barbican. Ill link a wiki article i put together to explain how to build a TLS enabled load balancer. | 14:15 |
| jschwarz | ptoohill, I'm looking at the neutron CLI though for options and can't find any | 14:15 |
| jschwarz | thanks :) | 14:16 |
| jschwarz | rdekel, ^ | 14:16 |
| ptoohill | https://wiki.openstack.org/wiki/Network/LBaaS/docs/how-to-create-tls-loadbalancer | 14:16 |
| ptoohill | This will help you get lbaasv2 and barbican spun up in devstack and shows how to actually build/test TLS load balancer. Let me know if you have any questions. | 14:17 |
| jschwarz | ptoohill, thanks load, we'll look into it | 14:17 |
| jschwarz | ptoohill, to what extend is HA available for v2? | 14:18 |
| *** apuimedo has joined #openstack-lbaas | 14:18 | |
| jschwarz | also will appreciate links for the L7 patches | 14:18 |
| ptoohill | https://review.openstack.org/#/c/148859/ | 14:19 |
| jschwarz | ptoohill, thank you very much | 14:21 |
| *** f13o has quit IRC | 14:40 | |
| *** f13o has joined #openstack-lbaas | 14:40 | |
| ajmiller | blogan and dougwig I would really appreciate reviews of https://review.openstack.org/#/c/173438/ and https://review.openstack.org/#/c/175174/ | 15:05 |
| openstackgerrit | John Schwarz proposed openstack/neutron-lbaas: Prevent deletion of a subnet with lbaas v1 pool https://review.openstack.org/174384 | 15:11 |
| *** vivek-ebay has joined #openstack-lbaas | 15:11 | |
| *** vivek-ebay has quit IRC | 15:14 | |
| *** xgerman has joined #openstack-lbaas | 15:16 | |
| *** _kiran_ has quit IRC | 15:18 | |
| *** sbalukoff has quit IRC | 15:25 | |
| *** vivek-ebay has joined #openstack-lbaas | 15:28 | |
| *** vivek-ebay has quit IRC | 15:36 | |
| openstackgerrit | Phillip Toohill proposed stackforge/octavia: Preparing for tempest testing https://review.openstack.org/172199 | 15:37 |
| *** vivek-ebay has joined #openstack-lbaas | 15:38 | |
| xgerman | dougwig, blogan: https://s3.amazonaws.com/uploads.hipchat.com/8522/699764/584BqDI9R3dA2uW/Screenshot%20from%202015-04-20%2008%3A40%3A05.png | 15:41 |
| xgerman | some quality metrics for your pleasure | 15:42 |
| blogan | xgerman: looks pretty slick! | 15:43 |
| xgerman | yep, we have a new initiative over here focused on (code) quality | 15:44 |
| blogan | xgerman: is that the ui from rally? | 15:44 |
| xgerman | no, it's the UI from sonar cube our static code analysis tool | 15:45 |
| blogan | xgerman: i like it | 15:46 |
| dougwig | what's it say about neutron-lbaas? | 15:47 |
| blogan | dougwig: shhh | 15:47 |
| blogan | dougwig: thats like a horror movie where the person runs back into the house | 15:47 |
| xgerman | lol | 15:48 |
| xgerman | when I get numbers I will post them (we have a whole team tasked with making numbers for us) | 15:48 |
| dougwig | blogan: but if it's chuck norris, the house will run away. | 15:48 |
| *** kobis has quit IRC | 15:48 | |
| xgerman | anyhow, from my tox -ecover runs it's not too shabby | 15:49 |
| xgerman | and static code analysis for a dynamic language has it's own challenges | 15:49 |
| *** mlavalle has joined #openstack-lbaas | 15:50 | |
| *** rdekel has quit IRC | 15:52 | |
| *** rm_work is now known as rm_work|away | 15:52 | |
| *** smcgough has joined #openstack-lbaas | 15:54 | |
| *** smcgough has left #openstack-lbaas | 15:54 | |
| openstackgerrit | Al Miller proposed openstack/neutron-lbaas: Add Vagrant file that can bring up a working LBaaS devstack https://review.openstack.org/175174 | 15:59 |
| *** smcgough has joined #openstack-lbaas | 16:05 | |
| *** jorgem has joined #openstack-lbaas | 16:10 | |
| *** apuimedo has quit IRC | 16:16 | |
| *** fnaval has joined #openstack-lbaas | 16:18 | |
| *** apuimedo has joined #openstack-lbaas | 16:20 | |
| *** madhu_ak has joined #openstack-lbaas | 16:30 | |
| *** rm_work|away is now known as rm_work | 16:31 | |
| *** jschwarz has quit IRC | 16:37 | |
| *** vivek-ebay has quit IRC | 16:42 | |
| madhu_ak | blogan, xgerman: I need reviews for https://review.openstack.org/#/c/171832/, Thanks! | 16:43 |
| *** bharath has joined #openstack-lbaas | 16:46 | |
| *** jschwarz has joined #openstack-lbaas | 16:47 | |
| *** mwang2 has joined #openstack-lbaas | 16:50 | |
| openstackgerrit | Al Miller proposed openstack/neutron-lbaas: Add Vagrant file that can bring up a working LBaaS devstack https://review.openstack.org/175174 | 16:53 |
| openstackgerrit | Al Miller proposed openstack/neutron-lbaas: Add Vagrant file that can bring up a working LBaaS devstack https://review.openstack.org/175174 | 16:55 |
| *** f13o has quit IRC | 16:57 | |
| *** vivek-ebay has joined #openstack-lbaas | 17:02 | |
| *** jschwarz has quit IRC | 17:30 | |
| *** jorgem has quit IRC | 17:33 | |
| openstackgerrit | min wang proposed openstack/neutron-lbaas: Introduced tempest API tests for openstack/neutron-lbaas https://review.openstack.org/168439 | 17:38 |
| *** jorgem has joined #openstack-lbaas | 17:53 | |
| *** crc32 has joined #openstack-lbaas | 17:54 | |
| openstackgerrit | min wang proposed openstack/neutron-lbaas: Admin API tempest for healthmonitor https://review.openstack.org/173542 | 17:55 |
| *** jorgem has quit IRC | 18:09 | |
| *** sbalukoff has joined #openstack-lbaas | 18:13 | |
| johnsom | TLS made it into LBaaS v2 Kilo | 18:23 |
| johnsom | Ack, that was strange, that was an old question and strange scroll back behavior. | 18:24 |
| *** vivek-eb_ has joined #openstack-lbaas | 18:27 | |
| *** vivek-ebay has quit IRC | 18:27 | |
| dougwig | i added stuff to our meetup etherpad: https://etherpad.openstack.org/p/LBaaS-FWaaS-VPNaaS_Summer_Midcycle_meetup | 18:40 |
| johnsom | You can get it to load? I get undefined module errors | 18:41 |
| johnsom | Ah, reload two worked | 18:41 |
| dougwig | i used it in chrome on a mac, if that makes any difference. | 18:42 |
| johnsom | Yeah, I was running chrome too. Just a strange etherpad error we got when etherpad.openstack had an issue. Maybe it was just cached poorly | 18:45 |
| *** jorgem has joined #openstack-lbaas | 19:06 | |
| blogan | i got that error too on chrome in linux | 19:11 |
| blogan | reload #4 fixed it | 19:11 |
| *** madhu_ak has quit IRC | 19:27 | |
| *** ajmiller_ has joined #openstack-lbaas | 19:29 | |
| *** ajmiller has quit IRC | 19:33 | |
| *** mwang2 has quit IRC | 19:33 | |
| *** bharath has quit IRC | 19:34 | |
| *** bharath has joined #openstack-lbaas | 19:34 | |
| *** ajmiller_ is now known as ajmiller | 19:34 | |
| *** ptoohill-oo has joined #openstack-lbaas | 19:37 | |
| *** ptoohill-oo has quit IRC | 19:41 | |
| dougwig | yikes | 19:41 |
| dougwig | is it the weird name in the url? | 19:42 |
| johnsom | My guess is it is leftovers of the etherpad outage | 19:42 |
| xgerman | Bozeman... | 19:50 |
| *** mwang2 has joined #openstack-lbaas | 19:54 | |
| blogan | bozeman sounds good to me | 19:58 |
| *** bharath has quit IRC | 20:04 | |
| *** bharath has joined #openstack-lbaas | 20:04 | |
| johnsom | I would totally go to Bozeman | 20:04 |
| xgerman | I like that town but it's hard to get to and the national park is still a bit away | 20:05 |
| blogan | exactly! | 20:07 |
| xgerman | ok, +1 | 20:07 |
| blogan | i think its a pipe dream bc it'd be hard to get people there and who would host? | 20:07 |
| blogan | also im not sure i'd be able to go to any of these, no matter the dates | 20:07 |
| xgerman | well, there is no HP office | 20:07 |
| johnsom | We need to find some fishing club that needs load balancing | 20:08 |
| xgerman | maybe the university would host us | 20:08 |
| xgerman | a10 can bribe them with some lbs | 20:08 |
| *** madhu_ak has joined #openstack-lbaas | 20:08 | |
| xgerman | I will bring a printer | 20:08 |
| blogan | ill bring a cloud | 20:09 |
| blogan | just an empty box, no one will know | 20:10 |
| johnsom | Well, since you have it covered, I will bring my fly rod | 20:11 |
| openstackgerrit | Al Miller proposed stackforge/octavia: Add devstack plugin for octavia https://review.openstack.org/167796 | 20:14 |
| openstackgerrit | min wang proposed openstack/neutron-lbaas: Admin API tempest for healthmonitor https://review.openstack.org/173542 | 20:31 |
| *** jorgem has quit IRC | 20:39 | |
| *** jorgem has joined #openstack-lbaas | 20:40 | |
| dougwig | if we go somewhere without an office ,we can book a hotel conference room. | 20:41 |
| blogan | dougwig: under who's bill? | 20:43 |
| *** jorgem has quit IRC | 20:44 | |
| dougwig | i can pay it. | 20:44 |
| blogan | big bucks | 20:45 |
| dougwig | looks like 800-2500 or so for a big enough room for 3 days. | 20:45 |
| blogan | can you get hotel rooms for all of us too? | 20:46 |
| blogan | that'd be grrreat | 20:46 |
| dougwig | ha, no. | 20:46 |
| blogan | if we did it in boise, we could all just crash at your house | 20:47 |
| dougwig | sure, i'll just lay out sleeping bags. it'll be like a slumber party. | 20:47 |
| dougwig | with scotch. | 20:47 |
| dougwig | we can also blow up watermelons in the desert. with a 300 magnum. | 20:48 |
| dougwig | you know, redneck fun. | 20:48 |
| blogan | yeah! | 20:48 |
| blogan | team building | 20:48 |
| blogan | shoot apples off each other's head, for trust building | 20:49 |
| openstackgerrit | Al Miller proposed stackforge/octavia: Add devstack plugin for octavia https://review.openstack.org/167796 | 21:00 |
| xgerman | I have a gig tent I cna bring so people can sleep in somebody's garden or oarking lot | 21:10 |
| xgerman | gig=big | 21:10 |
| xgerman | holds like 8 people | 21:10 |
| xgerman | (according to the manufacturer) | 21:11 |
| openstackgerrit | Michael Johnson proposed stackforge/octavia: Fix the common/keystone.py for identity v3 https://review.openstack.org/175575 | 21:14 |
| johnsom | blogan ^^^ fixes the keystone 3 issue | 21:15 |
| *** fnaval has quit IRC | 21:22 | |
| openstackgerrit | min wang proposed openstack/neutron-lbaas: Admin API tempest for healthmonitor https://review.openstack.org/173542 | 21:35 |
| *** madhu_ak has quit IRC | 21:38 | |
| *** madhu_ak has joined #openstack-lbaas | 21:45 | |
| *** fnaval has joined #openstack-lbaas | 21:48 | |
| ptoohill | johnsom: ping | 21:54 |
| johnsom | Hi | 21:55 |
| johnsom | Looking at that as I just hit another problem with blogan's code | 21:55 |
| johnsom | BadRequest: Expecting to find domain in project - | 21:55 |
| ptoohill | Yea, i got the same, but using the code similar to what is found in the link to neutron_lbaas works with v2 and v3 i just verified | 21:55 |
| ptoohill | ill gist it | 21:56 |
| johnsom | Cool, yeah, I wanted to read up on Client and then I will update the patchset. | 21:56 |
| ptoohill | Fair enough, its not deprecated even though the docs make it seem like it is sorta. The deprecation is referring to 'non-session' based authentication, not the 'Client' itself | 21:57 |
| ptoohill | Others were confused about that, wanted to clear that up | 21:57 |
| ptoohill | everything will be/should be using this right? | 21:58 |
| ptoohill | the keystone.py for any auth related ops? | 21:59 |
| johnsom | Right, it is common | 21:59 |
| ptoohill | asking because im wondering if we should return the client rather then session. ill link example shortly | 21:59 |
| ptoohill | if we return sesison the caller will have to build client themselves | 21:59 |
| ptoohill | I havnt tested this particular code with/in octavia. But testing in intrepter works as expected. | 22:00 |
| ptoohill | https://gist.github.com/the2hill/6fb8ff1d06905d98d0bb | 22:00 |
| johnsom | Well, since that code is currently returning the session, I'm not sure I want to do the surgery to swap that out. | 22:01 |
| ptoohill | fair enough | 22:01 |
| ptoohill | the caller will have to import the client and build themselves is all | 22:02 |
| johnsom | Let me try the client method. I have octavia code handy in a runnable environment | 22:02 |
| ptoohill | which, if the caller builds client, they will have to do the v2/v3 check also and use the appropriate one. If this is a bug fix for auth/v3 it may be good to refactor it. im ok either way i suppose, but with just the sesion being passed as is isnt going to work | 22:04 |
| ptoohill | reason it will work for barbicanclient is because that takes a session, but any other module that needs to use/authenticate with keystone will have to do that | 22:05 |
| ptoohill | maybe add another method, one that builds/returns client and one that builds/returns session. That would keep it from breaking barbican and allow for other modules to use it without those additional checks | 22:06 |
| johnsom | I'm sort on time, so I'm in "get it functional" mode. I agree that if we are doing the client work in a bunch of places we should pull that up into this keystone.py | 22:08 |
| johnsom | My initial test did work. I need to run two more tests and then I will push up another patchset | 22:08 |
| ptoohill | fair enough. I can add the additional method if need be | 22:08 |
| johnsom | Sounds good | 22:08 |
| ptoohill | so it only looks like the barbican and nova modules are using it and both of those clients take the sesions. So if we use the Client and keep it DRY im fine with it the way it is. If we ever need to call keystone directly for authentication then adding the method would be the right way imo | 22:10 |
| johnsom | Hmm, with client I'm getting "EndpointNotFound" | 22:17 |
| ptoohill | youre using v3? | 22:17 |
| johnsom | Testing with v2 | 22:17 |
| ptoohill | odd | 22:17 |
| johnsom | BTW, that is after auth at the nova call | 22:17 |
| ptoohill | oh, hmm :/ | 22:18 |
| ptoohill | so like a service endpoint not found? | 22:18 |
| johnsom | Yeah, I guess so | 22:18 |
| johnsom | I even tried throwing in the region name in the client call, but no luck | 22:19 |
| blogan | i did a cleanup of it to get it working with v3, never could get a good v3 working and then i forgot to come back to it | 22:19 |
| rm_work | wait what DOESN'T take sessions? | 22:20 |
| ptoohill | This is how i tested in intrepreter | 22:22 |
| ptoohill | https://gist.github.com/the2hill/8b2918679eb876286e68 | 22:22 |
| johnsom | Well, I think I can get the current code working, with the tenant hack, if I drop in a domain | 22:22 |
| ptoohill | rm_work: what are you talking about? | 22:22 |
| johnsom | I think rm_work missed part of the conversation | 22:22 |
| ptoohill | :) | 22:22 |
| rm_work | possibly | 22:23 |
| rm_work | looks like you are discussing relacing the part that builds a session and have it return a client | 22:23 |
| blogan | ptoohill: did yous say other clients would not accept session? | 22:23 |
| ptoohill | that gist works with v2/v3 using essentialy what would be done in the code | 22:23 |
| rm_work | but i can't think of why you would ever need to do that | 22:23 |
| ptoohill | no | 22:23 |
| rm_work | all of the other libs just take a session | 22:23 |
| ptoohill | I was saying that if we ever needed to authenticate directly we should return a client not just a session | 22:23 |
| rm_work | err | 22:23 |
| rm_work | yeah but what would ever require that? | 22:23 |
| ptoohill | right now we return a session because the things that are using use a session | 22:24 |
| ptoohill | i dont know.... | 22:24 |
| rm_work | what do you mean by "auth directly"? | 22:24 |
| rm_work | get a token? | 22:24 |
| rm_work | because if you need it, you can get the token from the session | 22:24 |
| ptoohill | that was the point, i was sayinghat if we NEED to it would be best to build the client instead of making the caller do the v2/v3 checks | 22:24 |
| ptoohill | how so? | 22:24 |
| blogan | that can be another method then | 22:24 |
| blogan | this method is called get_session | 22:24 |
| blogan | we can have a method called get_client if we want | 22:25 |
| ptoohill | exactly what i was saying above, blogan | 22:25 |
| ptoohill | >< | 22:25 |
| rm_work | i thought we were hiding the checks from the user? | 22:25 |
| ptoohill | lol | 22:25 |
| ptoohill | yes, | 22:25 |
| blogan | ptoohill: okay then, works for me | 22:25 |
| rm_work | whatever, guess you guys have *whatever it is you're doing* under control | 22:25 |
| ptoohill | to explain mysef better | 22:25 |
| ptoohill | well, first you say you can get a token from the session? | 22:26 |
| ptoohill | whats that call look like? | 22:26 |
| ptoohill | if so then my point is moot | 22:26 |
| blogan | when do you need to get the token? | 22:26 |
| rm_work | not sure why you need anything other than a session, but yes, you could always add a method that builds a Client (though I would argue that if you need to use a Client instead of a session, you are doing something wrong) | 22:26 |
| rm_work | uhh let me get the code | 22:26 |
| rm_work | sec | 22:26 |
| ptoohill | it was just a suggstion for if something ever needed it | 22:26 |
| blogan | yeah i dont think you're advocating for it now are you? | 22:26 |
| rm_work | if something ever needed a Client, the correct solution would be to patch it to use a session instead >_> | 22:27 |
| ptoohill | no | 22:27 |
| ptoohill | i was saying we 'could' at some point | 22:27 |
| blogan | well that solution would not be feasible if we needed something to work now | 22:27 |
| ptoohill | if we needed | 22:27 |
| blogan | so are there any clients that do not take session? | 22:27 |
| ptoohill | so you can do session.get_token? | 22:27 |
| rm_work | essentially | 22:27 |
| rm_work | was going to find the actual code | 22:27 |
| ptoohill | then my argument is moot, i thought you needed client | 22:28 |
| rm_work | FFS, ERR_SSL_PROTOCOL_ERROR on github.com | 22:28 |
| rm_work | wtf is wrong with my machine | 22:28 |
| blogan | what do you need the token for? | 22:28 |
| ptoohill | i tried with session and couldnt get anythg | 22:28 |
| ptoohill | and examples all show calling from the ient | 22:28 |
| ptoohill | we dont need it for anything right now | 22:28 |
| blogan | okay | 22:28 |
| ptoohill | it was just a suggestion.. | 22:28 |
| ptoohill | i was mostly talking about using the method in my example instead of Password | 22:28 |
| ptoohill | and then those thoughts came up, i was not saying we needed anythg right now | 22:29 |
| blogan | well since v2 password and v3 password take different required arguments, it makes it a bit more complicated, not something easily overcome | 22:29 |
| ptoohill | i have futuristic on my badge, im sorry | 22:29 |
| ptoohill | ..... | 22:30 |
| ptoohill | use Client................................ | 22:30 |
| ptoohill | im not making self clear. im sorry | 22:30 |
| blogan | are you sure Client is not deprecated? | 22:30 |
| ptoohill | no, its not | 22:30 |
| ptoohill | non-session authentication is deprecated | 22:30 |
| ptoohill | weve discussed this before | 22:30 |
| blogan | i know and i dont think i was ever convinced | 22:30 |
| blogan | bc client sounds like non-session to me | 22:31 |
| rm_work | client is a stage in the "get a session" code anyway | 22:31 |
| rm_work | lol | 22:31 |
| rm_work | anyway yess | 22:31 |
| rm_work | if you have mysession | 22:32 |
| rm_work | mysession.get_token() | 22:32 |
| rm_work | gives you the token | 22:32 |
| rm_work | just verified | 22:32 |
| rm_work | and that way you're still properly using the single cached session | 22:32 |
| ptoohill | if you look at the docs where it says that it says that 'here's example of non-session, dont use this' but, if you use session you can add other args like below | 22:32 |
| ptoohill | ok, then cool. my argument and head esplodes is moot. im sorry >< | 22:32 |
| rm_work | lulz | 22:33 |
| rm_work | sorry, i have a habit of jumping into conversations like halfway through | 22:33 |
| rm_work | when i see something i worked on being talked about | 22:33 |
| blogan | ptoohill: from the docs: "A Session should be passed to the Client instead." | 22:34 |
| blogan | its just not overtly clear because they just import keystoneclient.client | 22:34 |
| johnsom | Sorry, someone walked up to my desk. Reading the scroll back | 22:35 |
| openstackgerrit | Merged openstack/neutron-lbaas: Use TLS container UUIDs in Radware LBaaS https://review.openstack.org/173278 | 22:35 |
| openstackgerrit | Merged openstack/neutron-lbaas: Add Kilo release milestone https://review.openstack.org/174497 | 22:35 |
| ptoohill | comp died. Sorry for the confusion guys, i was just trying to get my point across about using Client vs Password and thought a client was required if we wanted to use it directly. But thats not the case and i was over thinking things. My apologies | 22:36 |
| blogan | ptoohill: you get my last message? | 22:37 |
| ptoohill | i dont see it | 22:37 |
| blogan | ptoohill: still abotu what is deprecated and not | 22:37 |
| ptoohill | i see adams message as last thing | 22:37 |
| rm_work | blogan: they keep importing the client because you have to make a client to make a session :P | 22:37 |
| rm_work | blogan: you just never *use* anything besides a session | 22:37 |
| blogan | rm_work: i'm looking at the section about the deprecated version of doing it | 22:37 |
| ptoohill | if you see thing saying Client is deprecated then ok, i stand corrected. But the docs is misleading imo and i believe its not | 22:37 |
| rm_work | Client is supposed to be deprecated for use with other libs | 22:38 |
| blogan | ptoohill: from the docs: "A Session should be passed to the Client instead." | 22:38 |
| ptoohill | yea | 22:38 |
| rm_work | BUT again, you still have to MAKE A CLIENT to make a session | 22:38 |
| rm_work | sooooo | 22:38 |
| rm_work | it's a little wonky | 22:38 |
| johnsom | I just need the auth to work. Right now I can get farther with the tenant_name hack and passing a domain. | 22:38 |
| blogan | but passing the credentials into the clients does not sound right | 22:38 |
| ptoohill | Then im just incredibly confused, if Client is deprecated then we will need it the way it was | 22:38 |
| rm_work | johnsom: i am confused as to why you'd be having auth problems. AFAIK the auth in keystone.py works in devstack for v2/v3 | 22:39 |
| johnsom | Client blows chunks both v2 and v3 against our public cloud for whatever reason. | 22:39 |
| rm_work | because we use it in neutron-lbaas | 22:39 |
| rm_work | ah, maybe custom HP stuff for your keystone deploy? | 22:39 |
| ptoohill | Then thats a whole 'nother problem then >< | 22:39 |
| rm_work | blogan: https://github.com/stackforge/octavia/blob/master/octavia/common/keystone.py#L47 | 22:39 |
| johnsom | rm_work Nope, testing octavia on devstack now. v3 breaks with the "tenant_name" that has disappeared. | 22:39 |
| blogan | rm_work: i've seen that | 22:40 |
| ptoohill | redundancy is too is too | 22:40 |
| rm_work | blogan: that is, AFAICT, correct | 22:40 |
| johnsom | rm_work fix that and it throws: BadRequest: Expecting to find domain in project | 22:40 |
| blogan | rm_work: well no docs use that form, and i thought i tried that out and couldn't get it working | 22:40 |
| rm_work | blogan: the docs are old and sucky | 22:40 |
| ptoohill | and youre using what i had in the gist johnsom | 22:40 |
| ptoohill | or still using the identiy.client | 22:40 |
| rm_work | I literall just did this right now against our public cloud | 22:41 |
| ptoohill | same | 22:41 |
| johnsom | rm_work No HP code in devstack, it's stock | 22:41 |
| rm_work | johnsom: then i don't know why your identity stuff is breaking <_< works for me | 22:41 |
| blogan | im gonna try it in devstack | 22:41 |
| blogan | of course i can't get v3 working in devstack | 22:41 |
| rm_work | johnsom: and remember we use the exact same code in neutron-lbaas | 22:41 |
| ptoohill | are you using the imports from like whats here | 22:41 |
| ptoohill | https://gist.github.com/the2hill/6fb8ff1d06905d98d0bb | 22:41 |
| rm_work | blogan: really? works in mine | 22:41 |
| blogan | rm_work: you have v3 deployed in your devstack? | 22:41 |
| ptoohill | and if you want to test via intrepreter use this | 22:42 |
| rm_work | blogan: yes | 22:42 |
| ptoohill | https://gist.github.com/the2hill/8b2918679eb876286e68 | 22:42 |
| blogan | rm_work: how? | 22:42 |
| rm_work | blogan: if you have "keystone" enabled, both are deployed automatically | 22:42 |
| ptoohill | i just tested mine with v2/v3 in fresh devstack also | 22:42 |
| johnsom | v2 has worked, v3 was borked on tenant_name and the domain thing | 22:42 |
| johnsom | It could be I have new versions and this is a fresh devstack from Friday | 22:42 |
| ptoohill | are you using Password? | 22:43 |
| ptoohill | just want to be clear what youre trying | 22:43 |
| rm_work | hmm | 22:44 |
| rm_work | oh right | 22:44 |
| rm_work | that is interesting | 22:44 |
| johnsom | Oye: DevStack - Password fails as octavia is in head on v3. Fix tenant_name to project_name, v3 gets to domain error. | 22:44 |
| rm_work | we didn't update Octavia to match Neutron-lbaas yet did we | 22:45 |
| johnsom | DevStack - client works v3. | 22:45 |
| rm_work | yeah sorry, uhhh | 22:45 |
| rm_work | look at the neutron-lbaas version | 22:45 |
| rm_work | which is actually probably what ptoohill linked | 22:45 |
| blogan | i tis | 22:46 |
| johnsom | HP Cloud, v2 works from octavia head, v3 doesn't. Client doesn't work v2 or v3 with strange errors about missing nova endpoints (with and without region ) | 22:46 |
| blogan | johnsom: both versions work with devstack? | 22:47 |
| johnsom | DevStack -Client works v3. haven't tested v2 | 22:47 |
| johnsom | Your code, I can get working with some changes | 22:48 |
| johnsom | "your code" meaning the last patchset you pushed up. | 22:48 |
| rm_work | yeah it's based on https://github.com/openstack/neutron-lbaas/blob/master/neutron_lbaas/common/cert_manager/barbican_cert_manager.py#L73 | 22:48 |
| rm_work | which is the correct version, sorry | 22:48 |
| rm_work | i was looking at that locally in pycharm but then linked the octavia version, which is incorrect T_T | 22:48 |
| rm_work | though that can be simplified to match ptoohill's gist | 22:49 |
| johnsom | rm_work That's the stuff that for whatever reason isn't working against HP cloud. I'm guessing a region issue | 22:49 |
| rm_work | hmm | 22:49 |
| rm_work | yeah but it all works in devstack, correct? | 22:50 |
| rm_work | so yeah, something about the HP keystone deployment is wonky possibly | 22:50 |
| johnsom | Yes | 22:50 |
| rm_work | to be fair, we can't even test v3 outside of devstack because RAX has no v3 deployment >_> | 22:50 |
| johnsom | That code doesn't do the regions right I think. | 22:51 |
| rm_work | and our v2 deployment isn't ACTUALLY keystone | 22:51 |
| rm_work | SOON (tm) | 22:51 |
| johnsom | Even when I add region_name to the neutron-lbaas code it comes back with bad nova endpoints. | 22:52 |
| johnsom | Ugh | 22:52 |
| rm_work | ah yeah all of our DCs (and the devstack setup) are single-region | 22:52 |
| rm_work | err, though keystone is global I think | 22:52 |
| rm_work | so actually that's wrong | 22:52 |
| rm_work | RAX keystone has regions | 22:52 |
| rm_work | dunno <_< | 22:53 |
| openstackgerrit | German Eichberger proposed stackforge/octavia: Implements the haproxy amphora agent api server https://review.openstack.org/160034 | 22:57 |
| *** bharath has quit IRC | 22:58 | |
| *** bharath_ has joined #openstack-lbaas | 22:58 | |
| ptoohill | so Client is deprecated? | 22:58 |
| johnsom | Yeah, ok, the Client stuff isn't getting the right nova endpoint on devstack either. | 22:59 |
| johnsom | Going to go back to Password, add domain, see if I profit | 22:59 |
| ptoohill | is that a v3 bug in general then? | 22:59 |
| rm_work | err but I don't think Password is valid for v3 | 23:00 |
| ptoohill | v2/v3 use the same db right? | 23:00 |
| ptoohill | was sorta my point as to why use Client.. but if its deprecated i dont know what to use | 23:01 |
| ptoohill | Ill be on a bit later | 23:02 |
| rm_work | err | 23:04 |
| rm_work | so | 23:04 |
| rm_work | using keystone.Client itself is not deprecated | 23:04 |
| rm_work | you NEED to do that in order to make a session.Session() | 23:04 |
| rm_work | but *passing a Client to another lib* is deprecated | 23:05 |
| rm_work | ptoohill: ^^ | 23:05 |
| rm_work | only supposed to pass session objects | 23:05 |
| johnsom | ptoohill blogan rm_work This works on devstack v3: https://gist.github.com/anonymous/4f8a83713880645426bc | 23:10 |
| johnsom | Run as a test, not code I would check in | 23:11 |
| blogan | johnsom: do you even need project_name? | 23:28 |
| johnsom | Not sure, haven't tried it without | 23:28 |
| blogan | johnsom: well doesn't matter, we'll already have that in the config, might as well use it | 23:29 |
| rm_work | bbl | 23:29 |
| blogan | johnsom: okay i think using the Password object is the way to go, talked to a keystone guy in #openstack-keystone and he did say instantiated the Client and then using that as the auth part of the session was odd | 23:29 |
| johnsom | blogan Ok, so should I add those domains to the config and leave the code like that? | 23:30 |
| blogan | johnsom: i honestly dont know what the domains do and what user_domain_name and project_domain_name do | 23:31 |
| *** rm_work is now known as rm_work|away | 23:31 | |
| johnsom | I don't either, other than make the errors go away. | 23:31 |
| blogan | johnsom: lol config option of make_keystone_errors_go_away works | 23:32 |
| johnsom | There is reference here: https://bugs.launchpad.net/python-openstackclient/+bug/1375495 | 23:32 |
| openstack | Launchpad bug 1337422 in python-openstackclient "duplicate for #1375495 document different ways to authenticate" [Medium,Fix released] - Assigned to Dean Troyer (dtroyer) | 23:32 |
| blogan | yeah i saw that one | 23:32 |
| blogan | may as well put a config option for both that way they're configurable | 23:33 |
| blogan | fix it later when we realized what we need from it | 23:33 |
| johnsom | Sounds good, I will update the patchset. | 23:34 |
| *** chlong has joined #openstack-lbaas | 23:34 | |
| blogan | johnsom: alright thanks, you get my comment about building the kwarg dictionary? | 23:34 |
| johnsom | Looking | 23:35 |
| johnsom | Yeah, sure, NP | 23:36 |
| ptoohill | When i was testing i had to use domain also, until i configured it like my example. Sorry late to the convo i just dont understand why you would be getting errors with Client when its been tested by others and works | 23:42 |
| *** crc32 has quit IRC | 23:43 | |
| openstackgerrit | Al Miller proposed stackforge/octavia: Add devstack plugin for octavia https://review.openstack.org/167796 | 23:46 |
| *** ajmiller has quit IRC | 23:51 | |
| *** openstackgerrit has quit IRC | 23:58 | |
| *** openstackgerrit has joined #openstack-lbaas | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
