Thursday, 2015-06-04

*** mixos has joined #openstack-lbaas01:00
*** mixos is now known as mixos-away01:07
*** mixos-away is now known as mixos01:10
*** openstack has joined #openstack-lbaas01:21
*** openstack has joined #openstack-lbaas01:37
*** openstack has quit IRC01:52
*** openstack has joined #openstack-lbaas01:53
*** Aish has quit IRC01:59
*** madhu_ak has quit IRC02:09
*** bharath has quit IRC02:12
*** kobis has joined #openstack-lbaas02:28
*** KunalGan_ has joined #openstack-lbaas02:33
*** KunalGandhi has quit IRC02:37
*** KunalGan_ has quit IRC02:38
*** kobis has quit IRC02:54
*** ajmiller has joined #openstack-lbaas02:59
*** sbalukoff has quit IRC03:19
*** Aish has joined #openstack-lbaas03:26
*** Aish has left #openstack-lbaas03:26
*** Santosh_ has joined #openstack-lbaas03:37
Santosh_Hi03:37
Santosh_all03:37
Santosh_Hi blogan03:37
*** jhova has quit IRC04:16
dougwigraminoid: check the python-neutronclient package docs04:19
dougwighiya Santosh_04:20
*** mordred has quit IRC04:21
*** mordred has joined #openstack-lbaas04:25
*** sbalukoff has joined #openstack-lbaas04:34
*** kiran-r has joined #openstack-lbaas05:00
Santosh_https://bugs.launchpad.net/neutron/+bug/146175205:09
openstackLaunchpad bug 1461752 in neutron "Error at listener's barbican container validation" [Undecided,New]05:09
Santosh_Plz comment05:10
Santosh_Hi doug05:10
Santosh_Looks there is a minor bug05:10
Santosh_at barbican_cert_manager while validating barbican container05:11
rm_workhmm05:11
rm_worki don't know how the system is GETTING uuids instead of full refs05:12
rm_workit's supposed to take in a full ref from the user on the initial API call05:12
rm_workand that is stored05:12
rm_workand it should never even bother separating the uuid05:13
Santosh_I am planning to fix it . We should introduce barbican base uri at neutron.conf and could prepare ref_url05:13
rm_workno05:13
rm_workso, trying to build the URL is not a great approach05:13
rm_workbecause we immediately lose support for multi-barbican deployments05:13
Santosh_I was in opinion that default_tls_container_id is container_id only05:13
rm_workthe user passes a full URI05:13
Santosh_passed from user05:13
rm_workno05:13
rm_workit is supposed to be a full URI05:14
rm_workthere is no single obvious base-uri05:14
rm_workwe should not be in the business of building that05:14
rm_workin fact, the user would even have to do some effort to parse out UUID, because every barbican object returns its reference as a full URL05:15
Santosh_Then we can update the documents , default_tls_container and sni is mentioned as container_id and list of container_ids respectively05:15
rm_workthat would be best05:15
rm_workI thought the examples showed passing full URLs though05:15
Santosh_Every reference document mentions as container_id and list container_ids05:16
*** mixos has left #openstack-lbaas05:16
rm_workwhere ARE the reference docs05:16
Santosh_I avoided validation to get rid of error to continue. Will update the reference documents05:18
rm_workcan you link me to them>05:18
rm_workwhere are the reference docs05:18
rm_workI can't actually find any <_<05:19
Santosh_give me a min05:20
Santosh_hmm i looked at http://specs.openstack.org/openstack/neutron-specs/specs/juno-incubator/lbaas-tls.html05:22
Santosh_Somehow i was always in opinion default_tls_container_id is uuid and sni is list of UUIDs05:25
*** numan has joined #openstack-lbaas05:28
rm_workhmm yes05:29
rm_worki see in this design doc05:29
rm_workthe examples use UUIDs05:29
rm_workbut this is oooool05:29
rm_work*ooold05:29
rm_worklots of stuff here has changed slightly -- trying to use this as an API reference doc would not go well :P05:29
Santosh_somehow i didn't find mentioning of default_tls_container_id as ref_url except from https://wiki.openstack.org/wiki/Network/LBaaS/docs/how-to-create-tls-loadbalancer it could be figured out its a ref_url05:33
rm_workah yeah, it could, though that is obtuse05:34
rm_workbecause you'd need to know how barbican client returns the IDs05:34
rm_workwhich is, as full refs05:34
rm_workcommenting on your bug, so this conversation doesn't get lost05:35
rm_worktotally agree this is a doc issue05:37
rm_workour docs suck05:37
Santosh_in fact at at barbican_cert_manager.py  in comments it is mentioned as UUID,it could be corrected .  < :param cert_ref: the UUID of the cert to retrieve>05:40
rm_workah yes05:54
rm_workyou are correct, that is wrong05:54
rm_worki thought i always put something like "full HATEOAS reference"05:54
rm_workBarbican is written HATEOAS compliant05:55
*** Kunal has joined #openstack-lbaas06:36
*** KunalGandhi has joined #openstack-lbaas06:36
*** kobis has joined #openstack-lbaas06:42
*** amotoki has joined #openstack-lbaas06:52
*** woodster_ has quit IRC07:00
*** amotoki has quit IRC07:03
*** apuimedo has joined #openstack-lbaas07:06
*** nmagnezi has joined #openstack-lbaas07:19
*** amotoki has joined #openstack-lbaas07:27
*** KunalGandhi has quit IRC07:32
*** Kunal has quit IRC07:35
*** ebagdasa has joined #openstack-lbaas07:42
*** chlong has quit IRC07:44
*** jschwarz__ has joined #openstack-lbaas07:54
*** bharath has joined #openstack-lbaas08:01
*** jschwarz__ is now known as jschwarz08:04
*** amotoki has quit IRC08:20
*** amotoki has joined #openstack-lbaas08:20
*** sbalukoff has quit IRC08:57
*** amotoki has quit IRC09:08
*** amotoki has joined #openstack-lbaas09:38
*** amotoki has quit IRC09:42
*** bharath has quit IRC10:37
*** woodster_ has joined #openstack-lbaas11:00
*** kiran-r has quit IRC11:49
*** jschwarz_ has joined #openstack-lbaas12:00
*** jschwarz has quit IRC12:03
*** jschwarz_ has quit IRC12:18
*** chlong has joined #openstack-lbaas12:20
*** jschwarz has joined #openstack-lbaas12:22
*** ajmiller has quit IRC12:26
*** kiran-r has joined #openstack-lbaas12:58
*** Miouge_ has joined #openstack-lbaas13:09
*** Miouge has quit IRC13:12
*** Miouge_ is now known as Miouge13:12
nmagnezidougwig, ping13:34
*** jhova has joined #openstack-lbaas13:38
*** kiran-r has quit IRC13:41
*** kobis has quit IRC14:01
*** nmagnezi has quit IRC14:01
*** ptoohill_ has quit IRC14:11
*** mixos has joined #openstack-lbaas14:13
*** mixos has quit IRC14:17
*** ptoohill_ has joined #openstack-lbaas14:28
*** ptoohill_ has quit IRC14:28
openstackgerritTrevor Vardeman proposed stackforge/octavia: Update PUT methods to send update through queue  https://review.openstack.org/17098914:31
*** TrevorV_ has joined #openstack-lbaas14:31
*** ptoohill_ has joined #openstack-lbaas14:32
*** ptoohill_ has quit IRC14:38
*** ptoohill_ has joined #openstack-lbaas14:42
*** chlong has quit IRC14:47
*** apuimedo has quit IRC14:47
*** kobis has joined #openstack-lbaas14:49
*** kobis has quit IRC15:12
*** jschwarz_ has joined #openstack-lbaas15:14
*** jschwarz has quit IRC15:16
*** kobis has joined #openstack-lbaas15:17
*** ajmiller has joined #openstack-lbaas15:28
*** kobis has quit IRC15:35
*** numan has quit IRC15:53
*** mixos has joined #openstack-lbaas15:53
*** nmagnezi has joined #openstack-lbaas16:15
*** kobis has joined #openstack-lbaas16:16
dougwignmagnezi: hiya16:23
*** kobis has quit IRC16:24
nmagnezidougwig, hi there!16:24
*** localloop127 has joined #openstack-lbaas16:25
*** kobis has joined #openstack-lbaas16:34
*** amotoki has joined #openstack-lbaas16:39
*** amotoki has quit IRC16:45
*** kobis has quit IRC16:46
*** ajmiller has quit IRC16:52
*** KunalGandhi has joined #openstack-lbaas16:52
*** ajmiller has joined #openstack-lbaas17:04
*** Youcef has joined #openstack-lbaas17:12
*** jschwarz_ has quit IRC17:13
xgermanjorgem did you give blogan another day off?17:18
*** bradjones is now known as bradjones_away17:19
*** mixos is now known as mixos-away17:26
*** ajmiller_ has joined #openstack-lbaas17:28
*** ajmiller has quit IRC17:31
*** madhu_ak has joined #openstack-lbaas17:34
*** numan has joined #openstack-lbaas17:41
*** mixos-away is now known as mixos17:49
*** SumitNaiksatam has joined #openstack-lbaas17:49
*** mwang2 has joined #openstack-lbaas17:53
*** sbalukoff has joined #openstack-lbaas17:54
*** ajmiller_ has quit IRC17:57
*** ajmiller_ has joined #openstack-lbaas17:57
*** barra204 has joined #openstack-lbaas18:01
*** barra204 has quit IRC18:07
*** Aish has joined #openstack-lbaas18:11
*** Aish has left #openstack-lbaas18:12
*** Youcef has quit IRC18:16
*** sballe has joined #openstack-lbaas18:17
*** bharath has joined #openstack-lbaas18:21
johnsomdougwig I'm starting the setup sonar as a pilot non-voting gate project.  You mentioned having it fire as part of your gate to make setup/cleanup easy.  Still up for that?18:24
mixosHi dougwig, johnsom, https://review.openstack.org/#/c/181609/    one more review needed :- )  :- )18:28
*** amotoki has joined #openstack-lbaas18:28
*** bradjones_away is now known as bradjones18:29
rm_workxgerman: i keep getting started on your review and getting sidetracked after like one file T_T18:31
xgermanwell, you need to probably hide somewhere in the compound - maybe nobody will look once you are near the big-ass-fan18:32
rm_workheh18:32
*** amotoki has quit IRC18:33
*** numan has quit IRC18:34
bloganxgerman: meetings all day18:40
*** amrith has joined #openstack-lbaas18:40
xgermanalmost like my life18:40
*** bradjones is now known as bradjones_away18:40
amrithhello!18:40
bloganhi amrith18:40
amriththat's why I couldn't find any of you yesterday; I joined #openstack-octavia. There is such a channel with one person on it ;)18:40
bloganah some squatter in there eh?18:41
amrithno, he's here as well. davidlenwell18:41
davidlenwellhello18:41
xgermanhi18:41
xgermanwell, this is where we all hang18:41
amrithgreetings all!18:41
amrithI saw my name in your meeting chat yesterday18:41
amrithhow can we help each other18:41
amrithwhat I read in your scrollback already helps me ;)18:42
davidlenwellmy irc client doesn't like to actually leave channels for some reason.. they vanish from my list of open chats.. but my name stil lingers18:43
davidlenwellI joined that one a while ago before I knew you used this channel18:44
xgermanneat18:44
xgermanamrith we were looking at your proposal and trying to figure out if it’s useful to our endeavour18:44
davidlenwellby the way.. sorry I missed the meeting yesterday.. I've been heads down on some kinda related work.. the nginx lb service vm18:44
xgermancool18:45
blogandavidlenwell: your ghost remains18:45
amrithxgerman, what's your endeavor?18:45
amrithI know little about octavia18:45
bloganamrith: basically service vms with haproxy18:45
bloganbut not supposed to be visible to tenants18:45
amrithand what's on said service VM?18:46
amritha user defined image or an image stipulated by octavia?18:46
bloganoctavia image18:46
bloganusers won't have any control over it18:46
amrithi.e. just haproxy18:46
amrithand an os and other stuff18:46
bloganyep18:47
bloganmaybe an agent or two we write as well18:47
amrithfair enough, haproxy + agent(s).18:47
amrithjust like trove database + agent18:47
bloganprobably from my limited understanding of it18:47
blogandoes trove currently just deploy using a service account?18:50
amrithnot currently18:51
amriththat is one option which has been discussed18:51
bloganis each vm owned by the tenant?18:52
amrithcurrently that is the way trove operates.18:52
bloganso teh tenant would see that VM in their nova list18:52
amriththe authenticated user (to trove) credentials are used to launch vms18:52
amrithyes they would.18:52
bloganand i assume that is one reason for the shadow tenant bc you dont want them to see it?18:53
amrithyes, that is correct.18:53
bloganor is there a major benefit to them being able to see it?18:53
bloganokay18:53
amrithif trove provisions a number of instances (for example for a cluster), a nova user shooting one instance could be bad.18:54
bloganso what does the shadow tenant give over a service account? johnsom brought up iptables not being able to scale on the sam etenant18:54
amrithI believe that iptables scalability and tenants are orthogonal issues18:54
amriththe issue is (I believe) with vm's on a hypervisor18:54
amriththey could be for many tenants18:54
amrithand you'd have the same scale issue.18:54
bloganoh i totally agree, thats one headache you don't want to ahve to deal with, plus it seems like the user should treat the API as a black box and not be aware of implementation details18:54
amrithbut that's what I think.18:54
bloganah so its not because of vms on a tenant, just total vms in general18:56
blogantotal per hypervisor18:56
*** SlickNik has joined #openstack-lbaas18:56
bloganso what benefits do you think a shadow tenant would give over a service account?18:56
amrithas I understand it, if you have a hypervisor running a dozen VM's, then adding the 13th means that networking on all 13 need to reflect the new one.18:56
bloganand sorry if this was all in the spec, i haven't actually read it yet18:57
amritha shadow tenant gives you all of the benefits of a service account + some more.18:57
amrithoh, no worries blogan18:57
SlickNikhai18:57
blogandoesn't eman you need to create that shadow tenant for each tenant and also manage it?18:57
bloganSlickNik: hi!18:57
amrithblogan, yes, there is a cost18:58
amrithit isn't free18:58
blogani want free!18:58
bloganlol18:58
amrithI want free beer.18:58
amrithbut that's not available either18:58
bloganit was at the summi18:58
blogant18:58
amriththe issue with one tenant (at least one of them is this)18:58
bloganwell dpeending on yoru thinking18:58
amrithstrike that18:58
*** hitalia has joined #openstack-lbaas18:58
amrithlet's consider service account ~ shadow tenant per customer tenant18:59
bloganokay18:59
amriththe benefit is small and incremental also inconsequential to this issue.18:59
*** hitalia has quit IRC19:00
*** ptoohill_ has quit IRC19:01
bloganto the issue of deploying service vms and managing them?19:05
amrithok19:06
openstackgerritmin wang proposed openstack/neutron-lbaas: Introduced tempest API tests for openstack/neutron-lbaas  https://review.openstack.org/16843919:09
amrithblogan, was that a question? if yes, I'm not sure what it is ;)19:10
bloganamrith: lol were you saying the benefit was small and inconsequential to the issue of deploying and managing service vms?19:11
*** barclaac|2 has joined #openstack-lbaas19:11
*** barclaac has quit IRC19:11
amrithsorry, no. the benefits of a shadow tenant over a service account are inconsequential to the current issue at hand; namely the impact to trove when a user directly manipulates the provisioned vm's.19:12
amrithto address that issue a service account is analogous to a shadow tenant.19:12
xgermanwell, the “shadow tenant” would be an alternative to a service account19:12
amrithyes19:13
amrithand either would be as good for trove (i think)19:13
xgermanyeah, and we need to figure out what’s better for Oactavia ;-)19:13
amrithSlickNik is here as well, he may have a different perspective19:13
xgermanyep19:13
bloganah okay, i figure trove and octavia will probably be nearly the same when it comes to managing vms19:14
bloganwell except we also ahve to deal with hotplugging in networks at any time19:15
bloganbut the shadow tenant vs service account shouldn't matter much with that19:15
xgermanyep19:15
xgermanit’s just something to watch19:15
xgermanbut shadow tenants might make hotolugging easier19:16
bloganhow os?19:17
bloganso?19:17
xgermanwe don’t need to be admin to plug19:17
xgermaninto the tenants nertwork19:17
xgermanbut probably more thinking needed19:17
bloganwe'd still have to do it as the shadow tenant which really doesn't provide anything more than doing it as a service account19:18
bloganunless you're looking to minimize the number of admin accounts19:18
xgermanyep19:19
bloganah, well i don't see that being as a big win over the extra cost of managing all these shadow tenants19:20
xgermanyep, I need to see that fleshed out more19:20
bloganbut amrith did say there were more benefits, so i'm might just be short-sighted on this19:20
xgermanyeah, something to discuss at our midcycle19:20
amrithwhen/where is your mid-cycle19:21
xgermanI have been told there is some ML thread on that19:21
bloganfound a thread a over a year old19:22
xgermanit’s in Seattle - https://etherpad.openstack.org/p/LBaaS-FWaaS-VPNaaS_Summer_Midcycle_meetup19:22
amrithOK, that's right next to SlickNik's office ;)19:23
xgermanyep,19:23
bloganjust bust down a wall19:23
blogandrag him kicking and screaming in19:23
amrithnow now, be nice. he's trove ptl. only trove can do that ;)19:25
bloganall ptl's are subject to the abuse of the openstack community!19:25
bloganjust ask mestery19:26
xgermanSlickNik is super nice — so I would make an exception19:26
bloganxgerman: are you saying mestery isn't? i'm telling!19:26
xgermanI gotta see if his laptop now has an Octavia sticker before I make a decision19:29
openstackgerritPhillip Toohill proposed stackforge/octavia: Hooking TLS together  https://review.openstack.org/18554019:30
amrithfyi, here's a picture of my laptop19:38
amrithhttps://www.dropbox.com/s/n0jt6jmv23fjdn4/2015-06-04%2015.37.52.jpg?dl=019:38
amrithnotice a sticker there?19:38
xgermanYES!!19:39
bloganwho did you sell your soul to to get that sticker?19:39
amrithif I had to, then it was a cheap sticker19:41
xgermanblogan, when I talked to others about the shadwo tenant they mentioned rate limiting on some of the APIs tor just the network19:43
xgermanso it probably doesn’t make sense for us to load balance lot of bandwidth to some tenant who is rate limited19:44
xgermanbut I need to think that more through...19:44
bloganxgerman: ah i see, though rate limiting these tenants would be our problem i would think19:45
bloganxgerman: but its debatable19:45
xgermanyep19:45
xgermanwith shadow tenants we would be in their rate limiting domain19:45
bloganyeah so far this is the best reason19:48
xgermanok, I registered our interest on the ML19:48
blogandoes neutron allow configurable rate limiting through an API?19:49
xgermannot sure19:49
xgermanI know in our cloud we rate limit the cheap seats (m2.xsmall)19:50
bloganyeah we do the same i believe19:52
openstackgerritMerged openstack/neutron-lbaas: Add a new lbaas agent Scheduler, LeastPoolAgentScheduler  https://review.openstack.org/18160919:56
openstackgerritOpenStack Proposal Bot proposed openstack/neutron-lbaas: Updated from global requirements  https://review.openstack.org/18809720:00
ptoohillhttps://review.openstack.org/#/c/185540/ This is ready for reviews/use. It just doesnt register consumer, that will be handled higher up.20:13
*** SumitNaiksatam has quit IRC20:15
*** SumitNaiksatam has joined #openstack-lbaas20:16
*** amotoki has joined #openstack-lbaas20:17
mesterylol20:21
*** amotoki has quit IRC20:22
mesteryxgerman: I have the octavia sticker.20:23
mesteryxgerman blogan: The mid-cycle in seattle is for all services?20:23
* mestery wonders if he should try and make it20:23
ptoohillxgerman, sballe for TLS in the rest, you may need to change your cert_manager args to include check_only. I believe that should be the only check you need to make regarding this update.20:25
*** bradjones_away has quit IRC20:26
ptoohillgood question mestery, I was under the assumption it was lbaas only. Im probably wrong here20:26
johnsommestery We wanted to open it to VPNaaS and FWaaS but we didn't get sign ups from those projects.20:27
mesterylol20:27
rm_workptoohill: what did we decide on check_only?20:27
rm_worki forget20:27
ptoohillneutron_lbaas will do reg20:28
sballejohnsom: did we tell them that thye were invited?20:28
ptoohillcheck only in driver to query for data only20:28
ptoohillWe invited but didnt tell them :)20:28
johnsomsballe Yes, xgerman talked to the leads and e-mails were sent out.20:28
sballejohnsom: ok then it there loss20:29
sballes/there/their20:29
johnsomI think there were travel challenges for some, etc.20:29
ptoohillrm_work: Though, i may have to just give lb id instead of individual listener if i do it at the validation point. I wont have listener id yet.20:29
sballeyeah next time let's not do a mid-cycle during school vacations. Hotels are much more expensive20:30
sballeand flights are more expensive too20:30
johnsomYes, hotel rates in summer are harsh20:30
bloganmestery: you can still come though!20:31
*** bradjones has joined #openstack-lbaas20:32
dougwigjohnsom: sure. what state is it in now?20:32
johnsomdougwig It is in the state that I am reading about how these third party CI gates work and I was going to ask you for any pointers you have.20:33
johnsomSo, I'm starting today20:33
dougwigso, you need jenkins with zuul or a gerrit plugin, a git clone cache, cached packages, a wire to fire up slaves that install devstack or repos, (run whatever tests), harvest logs, reformat and publish according to neutron standards, and then write the correct format message into gerrit. not hard, but a pain.  if you can launch a public node that can run20:36
dougwigsonar, which can run what's in parens above, then i'm happy to add jobs to all of our repos that do the rest of the stuff.20:36
dougwig /a wire/a way/20:36
johnsomCool, that I can do.  Let me get that setup, read a bit more, and I will circle back with you.20:39
dougwigjohnsom: ok, cool20:44
johnsomThanks!20:44
*** fnaval has joined #openstack-lbaas20:55
*** TrevorV_ has quit IRC20:59
*** localloop127 has quit IRC21:26
*** ajmiller_ has quit IRC21:31
*** ajmiller_ has joined #openstack-lbaas21:32
*** TrevorV2 has joined #openstack-lbaas21:38
*** ajmiller_ has quit IRC21:47
*** ajmiller has joined #openstack-lbaas21:47
*** TrevorV2 has quit IRC21:50
*** TrevorV2 has joined #openstack-lbaas21:52
*** apuimedo has joined #openstack-lbaas21:58
openstackgerritMerged openstack/neutron-lbaas: Nuke a useless and incorrect comment from requirements.txt  https://review.openstack.org/18819222:01
*** amotoki has joined #openstack-lbaas22:06
*** amotoki has quit IRC22:11
openstackgerritMerged openstack/neutron-lbaas: Enable random hash seeds  https://review.openstack.org/18729322:13
*** SumitNaiksatam has quit IRC22:17
*** TrevorV2 has quit IRC22:17
*** TrevorV2 has joined #openstack-lbaas22:19
*** amrith is now known as _amrith_22:22
*** mixos has quit IRC22:33
openstackgerritDoug Wiegley proposed openstack/neutron-lbaas: Remove unused modules from the test-requirements.txt file  https://review.openstack.org/18861622:37
*** nmagnezi has quit IRC22:48
*** fnaval has quit IRC22:53
*** TrevorV2 has quit IRC22:59
openstackgerritDoug Wiegley proposed openstack/neutron-lbaas: WIP - Stop doing any magic cloning of neutron during CI  https://review.openstack.org/18862623:10
*** chlong has joined #openstack-lbaas23:27
*** mixos has joined #openstack-lbaas23:29
*** enikanorov_ has quit IRC23:29
*** enikanorov__ has joined #openstack-lbaas23:29
*** _amrith_ is now known as amrith23:34
*** bradjones has quit IRC23:36
*** bradjones has joined #openstack-lbaas23:39
openstackgerritDoug Wiegley proposed openstack/neutron-lbaas: Remove unused modules from the test-requirements.txt file  https://review.openstack.org/18861623:40
*** jhova has quit IRC23:48
*** ajmiller has quit IRC23:59

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!