| openstackgerrit | Stephen Balukoff proposed openstack/octavia: Add L7 database structures https://review.openstack.org/265430 | 00:04 |
|---|---|---|
| openstackgerrit | Stephen Balukoff proposed openstack/octavia: Update repos for L7 objects / methods https://review.openstack.org/265529 | 00:06 |
| *** bana_k has joined #openstack-lbaas | 00:21 | |
| openstackgerrit | Stephen Balukoff proposed openstack/octavia: Add L7 database structures https://review.openstack.org/265430 | 00:26 |
| *** chlong has quit IRC | 00:32 | |
| openstackgerrit | Stephen Balukoff proposed openstack/octavia: Update repos for L7 objects / methods https://review.openstack.org/265529 | 00:38 |
| *** bana_k has quit IRC | 00:42 | |
| *** ducttape_ has quit IRC | 00:43 | |
| *** blogan_ has quit IRC | 00:47 | |
| *** chlong has joined #openstack-lbaas | 00:49 | |
| *** bochi-michael has joined #openstack-lbaas | 00:51 | |
| *** ducttape_ has joined #openstack-lbaas | 00:52 | |
| *** mixos has joined #openstack-lbaas | 00:53 | |
| *** ducttape_ has quit IRC | 00:54 | |
| *** _ducttape_ has joined #openstack-lbaas | 00:54 | |
| *** _ducttape_ has quit IRC | 01:05 | |
| *** chlong has quit IRC | 01:09 | |
| *** mixos has quit IRC | 01:13 | |
| *** mixos has joined #openstack-lbaas | 01:15 | |
| *** chlong has joined #openstack-lbaas | 01:23 | |
| openstackgerrit | tianqing proposed openstack/neutron-lbaas: Remove invalid fields of healthmonitor when its type is TCP/PING https://review.openstack.org/263141 | 01:37 |
| *** mixos has quit IRC | 01:39 | |
| *** paco20151113 has joined #openstack-lbaas | 01:41 | |
| *** bana_k has joined #openstack-lbaas | 01:50 | |
| *** mixos has joined #openstack-lbaas | 01:57 | |
| openstackgerrit | Paco Peng proposed openstack/octavia: Move docstrings to the first line of the function definition https://review.openstack.org/265141 | 01:57 |
| *** Tiancheng has joined #openstack-lbaas | 02:03 | |
| *** ducttape_ has joined #openstack-lbaas | 02:06 | |
| *** ducttape_ has quit IRC | 02:10 | |
| *** prabampm has joined #openstack-lbaas | 02:11 | |
| *** johnsom has quit IRC | 02:16 | |
| *** bana_k has quit IRC | 02:20 | |
| *** armax has joined #openstack-lbaas | 02:32 | |
| *** johnsom has joined #openstack-lbaas | 03:29 | |
| *** links has joined #openstack-lbaas | 03:48 | |
| *** ducttape_ has joined #openstack-lbaas | 03:49 | |
| *** ducttape_ has quit IRC | 03:53 | |
| *** prabampm1 has joined #openstack-lbaas | 04:02 | |
| *** prabampm has quit IRC | 04:03 | |
| *** prabampm1 has quit IRC | 04:06 | |
| *** bana_k has joined #openstack-lbaas | 04:31 | |
| *** davidlenwell_ is now known as davidlenwell | 04:35 | |
| *** prabampm has joined #openstack-lbaas | 04:43 | |
| *** ducttape_ has joined #openstack-lbaas | 04:50 | |
| *** ducttape_ has quit IRC | 04:56 | |
| *** armax has quit IRC | 04:58 | |
| openstackgerrit | Phillip Toohill proposed openstack/octavia: Remove OpenSSL from cert_parser https://review.openstack.org/265467 | 05:00 |
| *** mixos has quit IRC | 05:02 | |
| *** yamamoto has joined #openstack-lbaas | 05:04 | |
| *** yamamoto has quit IRC | 05:04 | |
| *** yamamoto has joined #openstack-lbaas | 05:05 | |
| *** yamamoto has quit IRC | 05:05 | |
| *** blogan_ has joined #openstack-lbaas | 05:05 | |
| *** allan_h has joined #openstack-lbaas | 05:17 | |
| *** yamamoto has joined #openstack-lbaas | 05:18 | |
| *** allan_h has quit IRC | 05:19 | |
| *** yamamoto has quit IRC | 05:22 | |
| *** yamamoto has joined #openstack-lbaas | 05:22 | |
| openstackgerrit | Phillip Toohill proposed openstack/octavia: Remove OpenSSL from cert_parser https://review.openstack.org/265467 | 05:23 |
| *** yamamoto has quit IRC | 05:25 | |
| openstackgerrit | Phillip Toohill proposed openstack/octavia: Remove OpenSSL from cert_parser https://review.openstack.org/265467 | 05:35 |
| openstackgerrit | Stephen Balukoff proposed openstack/octavia: WIP: Add L7 api https://review.openstack.org/265690 | 05:59 |
| openstackgerrit | Brandon Logan proposed openstack/octavia: Implementing EventStreamer https://review.openstack.org/218735 | 06:15 |
| *** yamamoto has joined #openstack-lbaas | 06:22 | |
| *** bochi-michael has quit IRC | 06:30 | |
| *** bochi-michael has joined #openstack-lbaas | 06:34 | |
| openstackgerrit | Stephen Balukoff proposed openstack/octavia: WIP: Add L7 api https://review.openstack.org/265690 | 06:53 |
| *** blogan_ has quit IRC | 07:00 | |
| *** paco20151113 has quit IRC | 07:22 | |
| *** yamamoto has quit IRC | 07:37 | |
| *** chlong has quit IRC | 07:39 | |
| openstackgerrit | Stephen Balukoff proposed openstack/octavia: WIP: Add L7 api https://review.openstack.org/265690 | 08:15 |
| *** openstackgerrit has quit IRC | 08:32 | |
| *** openstackgerrit has joined #openstack-lbaas | 08:33 | |
| *** yamamoto has joined #openstack-lbaas | 08:37 | |
| openstackgerrit | Stephen Balukoff proposed openstack/octavia: WIP: Tests for L7 API https://review.openstack.org/265718 | 08:41 |
| *** yamamoto has quit IRC | 08:44 | |
| *** bana_k has quit IRC | 08:44 | |
| *** numans has joined #openstack-lbaas | 09:09 | |
| *** bochi-michael has quit IRC | 09:11 | |
| openstackgerrit | Elena Ezhova proposed openstack/neutron-lbaas: Add scenario test for load balancer's session persistence https://review.openstack.org/207945 | 09:23 |
| *** yamamoto has joined #openstack-lbaas | 09:36 | |
| *** yamamoto has quit IRC | 09:38 | |
| *** yamamoto has joined #openstack-lbaas | 09:39 | |
| *** bana_k has joined #openstack-lbaas | 09:40 | |
| *** bana_k has quit IRC | 09:47 | |
| *** yamamoto has quit IRC | 09:57 | |
| *** yamamoto has joined #openstack-lbaas | 09:57 | |
| *** yamamoto has quit IRC | 10:10 | |
| *** yamamoto has joined #openstack-lbaas | 10:11 | |
| *** Tiancheng has quit IRC | 10:32 | |
| *** yamamoto has quit IRC | 11:00 | |
| *** yamamoto has joined #openstack-lbaas | 11:00 | |
| *** yamamoto has quit IRC | 11:03 | |
| *** yamamoto has joined #openstack-lbaas | 11:03 | |
| *** yamamoto has quit IRC | 11:26 | |
| *** bana_k has joined #openstack-lbaas | 11:28 | |
| *** bana_k has quit IRC | 11:33 | |
| *** eezhova has joined #openstack-lbaas | 11:37 | |
| *** chlong has joined #openstack-lbaas | 11:57 | |
| *** rtheis has joined #openstack-lbaas | 12:09 | |
| *** rtheis_ has joined #openstack-lbaas | 12:20 | |
| *** rtheis has quit IRC | 12:22 | |
| *** yamamoto has joined #openstack-lbaas | 12:26 | |
| *** HenryG has quit IRC | 12:27 | |
| *** HenryG has joined #openstack-lbaas | 12:27 | |
| *** yamamoto has quit IRC | 12:30 | |
| *** alejandrito has joined #openstack-lbaas | 12:45 | |
| *** alejandrito has quit IRC | 12:46 | |
| *** alejandrito has joined #openstack-lbaas | 12:46 | |
| *** ljxiash has joined #openstack-lbaas | 12:58 | |
| *** nmagnezi has joined #openstack-lbaas | 12:59 | |
| *** yamamoto has joined #openstack-lbaas | 13:02 | |
| *** prabampm has quit IRC | 13:05 | |
| *** doug-fish has joined #openstack-lbaas | 13:09 | |
| *** links has quit IRC | 13:13 | |
| *** ducttape_ has joined #openstack-lbaas | 13:13 | |
| *** bana_k has joined #openstack-lbaas | 13:16 | |
| *** bana_k has quit IRC | 13:21 | |
| *** prabampm has joined #openstack-lbaas | 13:26 | |
| *** ducttape_ has quit IRC | 13:35 | |
| *** yamamoto has quit IRC | 13:42 | |
| *** bana_k has joined #openstack-lbaas | 14:00 | |
| *** yamamoto has joined #openstack-lbaas | 14:02 | |
| *** bana_k has quit IRC | 14:05 | |
| *** ducttape_ has joined #openstack-lbaas | 14:19 | |
| *** ducttape_ has quit IRC | 14:24 | |
| *** Tiancheng has joined #openstack-lbaas | 14:25 | |
| *** xiaohhui has quit IRC | 14:30 | |
| *** xiaohhui has joined #openstack-lbaas | 14:31 | |
| *** numans has quit IRC | 14:39 | |
| *** ducttape_ has joined #openstack-lbaas | 14:43 | |
| *** neelashah has joined #openstack-lbaas | 14:49 | |
| *** Tiancheng has quit IRC | 14:55 | |
| *** Tiancheng has joined #openstack-lbaas | 14:55 | |
| *** prabampm has quit IRC | 14:59 | |
| *** nmagnezi has quit IRC | 15:09 | |
| *** neelashah has quit IRC | 15:12 | |
| *** neelashah has joined #openstack-lbaas | 15:12 | |
| *** neelashah1 has joined #openstack-lbaas | 15:15 | |
| *** mixos has joined #openstack-lbaas | 15:16 | |
| *** neelashah has quit IRC | 15:17 | |
| *** neelashah has joined #openstack-lbaas | 15:19 | |
| *** neelashah1 has quit IRC | 15:20 | |
| *** mixos has quit IRC | 15:25 | |
| *** mixos has joined #openstack-lbaas | 15:27 | |
| *** neelashah1 has joined #openstack-lbaas | 15:42 | |
| *** neelashah has quit IRC | 15:43 | |
| *** neelashah has joined #openstack-lbaas | 15:45 | |
| *** neelashah1 has quit IRC | 15:46 | |
| *** neelashah has quit IRC | 15:49 | |
| *** neelashah has joined #openstack-lbaas | 15:50 | |
| *** neelashah1 has joined #openstack-lbaas | 15:53 | |
| *** neelashah has quit IRC | 15:54 | |
| *** neelashah has joined #openstack-lbaas | 15:57 | |
| *** sbalukoff has quit IRC | 15:57 | |
| *** neelashah1 has quit IRC | 15:58 | |
| *** neelashah1 has joined #openstack-lbaas | 16:03 | |
| *** neelashah has quit IRC | 16:04 | |
| *** neelashah has joined #openstack-lbaas | 16:07 | |
| *** neelashah1 has quit IRC | 16:08 | |
| blogan | good morning | 16:08 |
| *** Tiancheng has quit IRC | 16:12 | |
| xgerman | good morning | 16:26 |
| xgerman | johnsom is already on his way to San Antonio… how’s the weather? Do I need to bring a (rain) coat? | 16:27 |
| blogan | 30% chance of rain wednesday and thursday | 16:27 |
| blogan | colder than normal 50s-60s | 16:28 |
| *** mixos has quit IRC | 16:30 | |
| xgerman | so basically - Seattle? | 16:30 |
| *** ljxiash has quit IRC | 16:31 | |
| *** jwarendt has joined #openstack-lbaas | 16:31 | |
| *** bdrich has joined #openstack-lbaas | 16:33 | |
| blogan | just maybe! | 16:34 |
| blogan | we changed the weather for yall | 16:34 |
| *** mixos has joined #openstack-lbaas | 16:46 | |
| *** yamamoto has quit IRC | 16:53 | |
| *** armax has joined #openstack-lbaas | 16:55 | |
| *** mixos has quit IRC | 17:01 | |
| openstackgerrit | Phillip Toohill proposed openstack/neutron-lbaas: Pass service admin auth from the Octavia driver https://review.openstack.org/264382 | 17:02 |
| *** mixos has joined #openstack-lbaas | 17:03 | |
| *** eranra has joined #openstack-lbaas | 17:05 | |
| *** mixos has quit IRC | 17:11 | |
| *** mixos has joined #openstack-lbaas | 17:12 | |
| *** yamamoto has joined #openstack-lbaas | 17:13 | |
| *** yamamoto has quit IRC | 17:13 | |
| *** bana_k has joined #openstack-lbaas | 17:28 | |
| *** bharathm has joined #openstack-lbaas | 17:28 | |
| *** ajmiller_ has joined #openstack-lbaas | 17:33 | |
| *** bana_k has quit IRC | 17:35 | |
| *** minwang2 has joined #openstack-lbaas | 17:36 | |
| *** ajmiller__ has joined #openstack-lbaas | 17:36 | |
| *** ajmiller has quit IRC | 17:36 | |
| *** bana_k has joined #openstack-lbaas | 17:37 | |
| *** ajmiller_ has quit IRC | 17:38 | |
| *** doug-fish has quit IRC | 17:41 | |
| *** doug-fish has joined #openstack-lbaas | 17:42 | |
| *** neelashah1 has joined #openstack-lbaas | 17:44 | |
| *** eranra has quit IRC | 17:45 | |
| *** neelashah has quit IRC | 17:45 | |
| *** doug-fish has quit IRC | 17:47 | |
| *** neelashah has joined #openstack-lbaas | 17:47 | |
| *** neelashah1 has quit IRC | 17:48 | |
| *** ajmiller__ is now known as ajmiller | 17:49 | |
| *** neelashah1 has joined #openstack-lbaas | 17:51 | |
| *** neelashah has quit IRC | 17:52 | |
| *** numans has joined #openstack-lbaas | 17:55 | |
| *** neelashah1 has quit IRC | 17:56 | |
| *** neelashah has joined #openstack-lbaas | 17:56 | |
| *** numans has quit IRC | 18:06 | |
| *** kevo has joined #openstack-lbaas | 18:06 | |
| *** yamamoto has joined #openstack-lbaas | 18:13 | |
| *** madhu_ak has joined #openstack-lbaas | 18:16 | |
| openstackgerrit | Phillip Toohill proposed openstack/neutron-lbaas: Update admin auth data for devstack https://review.openstack.org/265968 | 18:17 |
| ptoohill | neutron.conf needs those same values, ajmiller johnsom blogan ^ | 18:17 |
| *** _cjones_ has joined #openstack-lbaas | 18:18 | |
| *** yamamoto has quit IRC | 18:21 | |
| *** Aish has joined #openstack-lbaas | 18:27 | |
| xgerman | blogan I thought I saw a pack tenant_id -> project_id in neutron labs - Heat thinks they can keep tenant_id: https://review.openstack.org/#/c/239755/20/heat/tests/openstack/neutron/inline_templates.py | 18:27 |
| rm_work | xgerman: I think that's internally in our DB but externally on the API we take project_id? | 18:30 |
| rm_work | or at least, both? | 18:30 |
| rm_work | let me look | 18:30 |
| xgerman | yeah, I don’t really understand why heat thinks they should do tenenat_id | 18:30 |
| rm_work | i think he is just saying he thinks it still expects tenant_id | 18:31 |
| xgerman | mmh, if we do both they should use the new one - my 2 ct | 18:31 |
| rm_work | hmmm | 18:31 |
| rm_work | https://github.com/openstack/neutron-lbaas/blob/master/neutron_lbaas/extensions/loadbalancerv2.py#L159 | 18:31 |
| rm_work | looks like still project_id there too | 18:32 |
| rm_work | but I remember there being a patch to change this | 18:32 |
| rm_work | same as you :/ | 18:32 |
| rm_work | blogan: blogan T_T | 18:32 |
| xgerman | yep | 18:32 |
| *** bana_k has quit IRC | 18:32 | |
| *** bharathm has quit IRC | 18:33 | |
| *** bharathm has joined #openstack-lbaas | 18:40 | |
| *** neelashah has quit IRC | 18:44 | |
| *** barra204 has joined #openstack-lbaas | 18:55 | |
| *** shakamunyi has quit IRC | 18:56 | |
| *** diogogmt has joined #openstack-lbaas | 19:01 | |
| *** doug-fish has joined #openstack-lbaas | 19:03 | |
| *** doug-fish has quit IRC | 19:07 | |
| *** doug-fish has joined #openstack-lbaas | 19:07 | |
| *** shakamunyi has joined #openstack-lbaas | 19:12 | |
| *** barra204 has quit IRC | 19:12 | |
| *** neelashah has joined #openstack-lbaas | 19:15 | |
| openstackgerrit | Phillip Toohill proposed openstack/neutron-lbaas: Pass service admin auth from the Octavia driver https://review.openstack.org/264382 | 19:19 |
| blogan | xgerman: tenant_id for neutron-lbaas was never changed to project-id, just octavia | 19:22 |
| xgerman | :-=( | 19:22 |
| blogan | xgerman: the reason being, neutron itself hasn't done that change either and a lot of the tenant_id figuring out resides in neutron | 19:22 |
| xgerman | ok, so, they are right | 19:23 |
| dougwig | We should take and emit both. Don't care what we store it as. And a helper accessor for internal method lookups. iMO | 19:23 |
| blogan | unless heat is doing octavia stuff | 19:23 |
| blogan | dougwig: we can start adding project_id into the bodies | 19:24 |
| dougwig | And silently accept with doc ing it. There's no good reason to break anyone with that kind of thing imo. | 19:27 |
| dougwig | Without doc ing | 19:27 |
| blogan | i agree, just wait until neutron v3 to totally remove it | 19:27 |
| doug-fish | hey all, I'm talking with jpomeroy about the lbaas-dashboard and certificates ... and trying to make sure we understand how the SSL certificates page should be driven by the APIs | 19:28 |
| doug-fish | are we correct in assuming that the only container types that should be listed are certificate containers? | 19:28 |
| doug-fish | so we should exclude rsa and generic containers? | 19:28 |
| xgerman | rm_work - would know more. But I have only seen certificate containers so far | 19:29 |
| rm_work | for LBaaS that is all we use | 19:29 |
| ptoohill | For our impl we only utilize cert containers | 19:29 |
| ptoohill | yea | 19:30 |
| doug-fish | cool | 19:30 |
| markvan | rm_work: and those cert containers are equally applicable to other backends besides octavia, like haproxy? | 19:30 |
| rm_work | yes | 19:31 |
| markvan | rm_work: thx | 19:31 |
| *** neelashah has quit IRC | 19:31 | |
| rm_work | the code to handle them is in neutron-lbaas | 19:31 |
| rm_work | so any driver can just ask "give me the cert and key for this LB" and it gets it | 19:31 |
| *** neelashah has joined #openstack-lbaas | 19:31 | |
| rm_work | the octavia driver just ... doesn't ask, and passes the reference directly | 19:31 |
| markvan | ok, that makes sense. For octavia, it also has a cert_manager= local option, that would not be supported then? | 19:32 |
| rm_work | augh | 19:32 |
| rm_work | cert_manager=local is ... | 19:33 |
| rm_work | a bit of a relic | 19:33 |
| rm_work | I don't know that it would ever really work | 19:33 |
| markvan | ok | 19:33 |
| rm_work | it was supposed to go along with a change to allow EITHER a ref OR actual certs to be passed in | 19:33 |
| rm_work | but that part was never added to the API | 19:33 |
| rm_work | so there is no way to actually use it currently | 19:33 |
| rm_work | it can probably be removed :/ | 19:33 |
| rm_work | considering adding a Swift driver | 19:34 |
| doug-fish | I feel like Indiana Jones | 19:34 |
| rm_work | heh | 19:34 |
| *** minwang2 has quit IRC | 19:34 | |
| rm_work | xgerman: are you flying currently? not flying yet? already arrived? | 19:35 |
| rm_work | xgerman: what is your state, RE: Flying | 19:35 |
| doug-fish | has anyone had a chance to look at the lbaas-dashboard patches? We've got quite a few awaiting review | 19:35 |
| rm_work | hopefully we will this week | 19:35 |
| *** ducttape_ has quit IRC | 19:36 | |
| *** minwang2 has joined #openstack-lbaas | 20:00 | |
| *** bharathm has quit IRC | 20:04 | |
| xgerman | rm_work will start flying around 4 ish — was at lunch | 20:05 |
| blogan | rm_work: are you sitting? standing? talking? what is your state RE: physical body | 20:05 |
| xgerman | (4 ish pacific) | 20:05 |
| xgerman | blogan lol | 20:05 |
| rm_work | blogan: sitting | 20:14 |
| rm_work | xgerman: ok, so you get in late | 20:14 |
| rm_work | won't try to meet you for BBQ dinner then :P | 20:14 |
| xgerman | well, I will be hungry at 9 pm when I get in :-) | 20:14 |
| xgerman | johnsom gets in way earlier | 20:15 |
| blogan | xgerman, rm_work: https://review.openstack.org/#/c/265322/ | 20:19 |
| rm_work | blogan: what does like 118 return? doesn't 119 *run* the result of 118? my bash might be rusty, but ..... | 20:22 |
| rm_work | https://review.openstack.org/#/c/265322/2/devstack/plugin.sh | 20:22 |
| *** ducttape_ has joined #openstack-lbaas | 20:24 | |
| rm_work | yeah you're forking the run of the result of 118, IIRC, which seems weird | 20:25 |
| blogan | yeah, but easiest way to assign it a variable, only problme with it is you won't see the output but i don't think thats a big deal | 20:30 |
| blogan | and my bash sucks so there could be a better way to do that but thats just the way i've seen it done | 20:30 |
| rm_work | alright | 20:33 |
| rm_work | well, as long as that's the intention | 20:33 |
| rm_work | I was just confused because | 20:34 |
| rm_work | $(neutron port-create --name octavia-health-manager-listen-port --binding:host_id=$(h | 20:34 |
| rm_work | ostname) lb-mgmt-net | awk '/ id | mac_address / {print $4}') | 20:34 |
| rm_work | at its heart is the return from "neutron port-create" | 20:34 |
| rm_work | which ... why would that return something that is valid bash code | 20:35 |
| blogan | yeah and grepping through taht to find the values | 20:35 |
| openstackgerrit | Phillip Toohill proposed openstack/neutron-lbaas: Update admin auth data for devstack https://review.openstack.org/265968 | 20:35 |
| blogan | s/grepping/awking | 20:35 |
| rm_work | what *value* would it return that would be valid bash | 20:35 |
| openstackgerrit | Phillip Toohill proposed openstack/neutron-lbaas: Pass service admin auth from the Octavia driver https://review.openstack.org/264382 | 20:35 |
| blogan | its returning strings after the awk | 20:35 |
| rm_work | .... | 20:36 |
| rm_work | what is an example of what it returns | 20:36 |
| *** bharathm has joined #openstack-lbaas | 20:36 | |
| rm_work | "rm -rf /" ? :P | 20:36 |
| blogan | uuid\nmac | 20:36 |
| rm_work | that command is making a port, why would it return CODE? | 20:36 |
| rm_work | ok so | 20:36 |
| rm_work | why would you EXECUTE a uuid? | 20:36 |
| blogan | when you create anything with neutron or nova it always returns text | 20:37 |
| rm_work | ... ok | 20:37 |
| rm_work | it returns text | 20:37 |
| rm_work | then you RUN the text | 20:37 |
| rm_work | that it returned | 20:37 |
| blogan | no i'm assigning it a variable | 20:37 |
| rm_work | as bash | 20:37 |
| rm_work | uhh | 20:37 |
| rm_work | are we reading the same thing? | 20:37 |
| rm_work | 118 you run the command and store the result in a variable | 20:37 |
| blogan | oh you're talking about 119 | 20:37 |
| rm_work | 119 you RUN the result that you just stored, and save THAT result in the same variable | 20:38 |
| rm_work | which if the result of 118 has id_and_mac="someUUID" | 20:38 |
| rm_work | then you're going to have the result be an error | 20:38 |
| rm_work | lol | 20:38 |
| rm_work | yeah I don't exactly understand how this works | 20:38 |
| blogan | oh honestly i just pulled that off stackoverflow on how to basically split a string and then pull each token out | 20:38 |
| blogan | all i know is it works | 20:39 |
| rm_work | <_< | 20:39 |
| rm_work | it shouldn't | 20:39 |
| blogan | if you've got a better way to do that please do it | 20:39 |
| blogan | well you could just copy those lines and run it yourself and see | 20:39 |
| blogan | bc it does | 20:39 |
| rm_work | i need to see what running "neutron port-create" returns | 20:39 |
| rm_work | dont' have a devstack box up right now | 20:39 |
| blogan | a tabel of values like any neutron/nova | 20:40 |
| ptoohill | it returns a table thing doesnt it? like every call does | 20:40 |
| blogan | no different than neutron port-get | 20:40 |
| ptoohill | yea | 20:40 |
| rm_work | ok but like, WHAT | 20:40 |
| rm_work | what is in the table | 20:40 |
| blogan | just test it out! | 20:40 |
| ptoohill | so, i thought thats how you were supposed to pull it out | 20:40 |
| rm_work | [14:40:00] <rm_work>dont' have a devstack box up right now | 20:40 |
| ptoohill | or 'the way' | 20:40 |
| rm_work | 118 yes | 20:40 |
| rm_work | 119 wtf | 20:40 |
| rm_work | there is nothing wrong with what 118 does | 20:40 |
| rm_work | that looks perfectly correct | 20:40 |
| ptoohill | that should be the value that was parsed from the table with awk | 20:41 |
| rm_work | yes. | 20:41 |
| rm_work | then you run that value | 20:41 |
| rm_work | as bash code | 20:41 |
| rm_work | on line 119 | 20:41 |
| rm_work | exec(the_returned_uuid) | 20:42 |
| ptoohill | he got a return of values | 20:42 |
| ptoohill | oh, then hes doing it again | 20:42 |
| ptoohill | yea, why is 119 needed | 20:42 |
| ptoohill | which is what i think adam is getting at | 20:42 |
| rm_work | 119 SHOULD totally break this | 20:42 |
| rm_work | what does 118 return | 20:42 |
| ptoohill | well its just reassignment right? | 20:43 |
| rm_work | "echo ec2602e8-b8a3-11e5-8adb-28cfe9205489" ? | 20:43 |
| rm_work | no | 20:43 |
| ptoohill | if anything he doesnt need that line at all | 20:43 |
| ptoohill | what would that do then? | 20:43 |
| rm_work | ("ls") | 20:43 |
| rm_work | try that in BASH | 20:43 |
| rm_work | lol | 20:43 |
| rm_work | ("123456") | 20:43 |
| rm_work | it's an exec | 20:43 |
| rm_work | fork & execute | 20:43 |
| ptoohill | true | 20:44 |
| ptoohill | yea, im not sure what thats there for then | 20:44 |
| rm_work | it should not just be extraneous, it should be actively breaking this | 20:44 |
| ptoohill | magic blogan bashing | 20:44 |
| rm_work | I guess I will have to spin up devstack to see what neutron's port create function returns | 20:45 |
| rm_work | maybe it returns a table of "echo" commands | 20:45 |
| rm_work | >_> | 20:45 |
| ptoohill | it shouldnt :P | 20:45 |
| ptoohill | maybes its the new thing though | 20:46 |
| rm_work | I would like to see where blogan copied this from | 20:46 |
| ptoohill | he decided to run and hide | 20:47 |
| ptoohill | :P | 20:47 |
| rm_work | lol | 20:47 |
| ptoohill | think hes on his 1-1 | 20:47 |
| rm_work | ah | 20:47 |
| rm_work | do you have devstack up that you could run a port-create and gist the output? | 20:47 |
| ptoohill | not up, just failed | 20:47 |
| rm_work | k | 20:48 |
| rm_work | let me try to bring one up really quick I guess <_< | 20:48 |
| ptoohill | trying again | 20:48 |
| ptoohill | it didnt like my py3 env | 20:48 |
| rm_work | really quick -> 25min | 20:48 |
| ptoohill | :( | 20:48 |
| ptoohill | yea >< | 20:48 |
| ptoohill | mines running again | 20:48 |
| ptoohill | it should stack this time | 20:48 |
| rm_work | well I started one | 20:50 |
| ptoohill | well I started one | 20:50 |
| ptoohill | too | 20:50 |
| rm_work | :P will see | 20:50 |
| ptoohill | :P | 20:51 |
| *** amotoki has joined #openstack-lbaas | 20:52 | |
| ptoohill | sob | 20:53 |
| dougwig | ptoohill: ping. | 20:53 |
| ptoohill | dougwig: pong | 20:53 |
| dougwig | ptoohill: regarding your cert review, are there really no higher level routines that do all that parsing gunk for us? | 20:54 |
| ptoohill | That was a rework to remove OopenSSL | 20:54 |
| *** doug-fish has quit IRC | 20:54 | |
| ptoohill | What are you think about? Those are the api I was asked to use, I supposed we could look more into it, or maybe im unsure which part youre talking about. | 20:55 |
| *** doug-fish has joined #openstack-lbaas | 20:55 | |
| ptoohill | maybe i just coded something silly? | 20:55 |
| dougwig | and that's good, but why are we taking apart chains and such inside an lbaas module? there aren't routines to just stash and verify those without a bunch of tweaking? | 20:56 |
| dougwig | and aside from that, why'd the cert in the test change? if it's compatible, shouldn't the old test cert be valid? | 20:56 |
| ptoohill | Oh, hmm. Good question. Honestly, im not incredibly familiar and had to do some learning to rework it | 20:56 |
| ptoohill | i would need to ask/verify with carlos/adam for more info | 20:56 |
| ptoohill | that cert was invalid from the get go | 20:56 |
| ptoohill | :/ | 20:57 |
| dougwig | hahaha. | 20:57 |
| dougwig | ok, at some point my wi-fi challenged review will come back. let me know, and i'll flip it around. | 20:58 |
| *** doug-fish has quit IRC | 20:59 | |
| ptoohill | Ill see if i can get hold of carlos, maybe this is something we can clear up tomorrow or something. I think he went this route because we needed some data within the certs like SAN/hostnames for some reason | 20:59 |
| *** doug-fish has joined #openstack-lbaas | 21:00 | |
| dougwig | for SNI maybe? | 21:05 |
| ptoohill | Oh yea | 21:07 |
| ptoohill | thats right, we needed the hostnames for SNI | 21:07 |
| ptoohill | Though, i dont have an answer if theres something else that can do this | 21:07 |
| ptoohill | i know crypto is becoming the 'standard' and this is the way carlos intially did it. I'm asking him now for more info | 21:08 |
| dougwig | i'm surprised that we didn't just ask for the hostname along with the cert for SNI. be easier than trying to infer it. | 21:11 |
| dougwig | but i'm way way late on that feedback. | 21:12 |
| *** bdrich has quit IRC | 21:12 | |
| ptoohill | We would need a list of hosnames and the cert they match to when we just get a container. unless barbican gives some of that data i think this was required. though, thats just me and my 'knowledge' | 21:13 |
| *** madhu_ak has quit IRC | 21:16 | |
| *** madhu_ak has joined #openstack-lbaas | 21:19 | |
| dougwig | weird flight. odd combo of dead calm and drink spilling turbulence. :) | 21:20 |
| ptoohill | dougwig: It seems that crc32|znc was convinced to use this level for it for whatever reason, he may jump in here and can explain better. But he went with this. Also, on the hostname topic, if we want to take in the hosts we would need to create another object of sorts that contains the barbican container and a mapping of names/cert since we read DNSName entries from intermediates. | 21:32 |
| blogan | rm_work: you may remove that -1 and do a +A at any time :) | 21:34 |
| rm_work | dougwig: so the old cert in the test was actually invalid, and the parsing in PyOpenSSL was incomplete and didn't notice it was invalid | 21:34 |
| rm_work | dougwig: the parsing is more accurate/complete in cryptography so it caught the error in the test cert | 21:34 |
| rm_work | blogan: yep :P | 21:34 |
| ptoohill | rm_work: carlos mentioned that he was using something else but was convinced to go this route | 21:34 |
| rm_work | so, AFAIK there is no good upstream cert parsing utility | 21:34 |
| rm_work | I was hoping cryptography would *add* some functions for this | 21:35 |
| rm_work | but they don't exist at the moment | 21:35 |
| rm_work | oslo was another option but getting new code into oslo is pain | 21:35 |
| ptoohill | asyn1 he said he was using that, but im not famililar enough in either direction to have opinion | 21:35 |
| *** crc32 has joined #openstack-lbaas | 21:36 | |
| ptoohill | Here he is | 21:36 |
| ptoohill | Though I dont know if dougwig hit turbulence again and we lost him. :) | 21:36 |
| rm_work | asyn1? | 21:37 |
| rm_work | oh | 21:38 |
| rm_work | ASN1 | 21:38 |
| ptoohill | crc32: The original question was why are we not using a higher level lib to do this parsing. You mentioned asyn1 as a higher level lib but was convinced to go another route. I was under the impression we needed this level to parse out hostnames, can asyn1 do that? | 21:38 |
| ptoohill | asn1 | 21:38 |
| ptoohill | yea, cp | 21:38 |
| rm_work | ASN1 is still pretty low level | 21:38 |
| rm_work | almost LOWEST level, in fact | 21:38 |
| blogan | can any1 do that? | 21:38 |
| rm_work | cryptography's parsing is higher level than using ASN1 to parse the cert :/ | 21:38 |
| dougwig | trying... blogan, you can +A if it doesn't go through | 21:38 |
| rm_work | well, *it* is using asn1 to parse the cert, because asn1 is a schema | 21:38 |
| blogan | rm_work: http://unix.stackexchange.com/questions/217877/single-parenthesis-in-bash-variable-assignment | 21:39 |
| crc32 | what ever we usee needs to get hostnames from both the CN of the subject names as well as from the AlternateNames from an extension field. | 21:39 |
| dougwig | that seems like a helper that should live in barbican or oslo. | 21:39 |
| rm_work | dougwig: oslo maybe | 21:39 |
| crc32 | if anyone wants to use a another library thats fine. I guess we difffer on what a High level library is. | 21:39 |
| rm_work | dougwig: barbican is looking to drop certificate support longterm | 21:40 |
| rm_work | dougwig: and split into KMS (barbican, going forward) and a CMS (some new project) | 21:40 |
| crc32 | at the time I wrote it even barbican cryptography wasn't parsing it out. | 21:40 |
| dougwig | crc32: if you have to crack a chain of int ca's, it's not high-level to me. :) | 21:40 |
| dougwig | but we're academic now, because it's in the gate. | 21:40 |
| blogan | i like academies | 21:40 |
| xgerman | rm_work barbican wants to split again... | 21:41 |
| rm_work | https://pypi.python.org/pypi/pem/ | 21:41 |
| rm_work | but it is currently failing build, so.... lol | 21:41 |
| crc32 | thats fine dougwigg. is there a library then that does this? I can generate certs for testing. | 21:41 |
| xgerman | those people!! | 21:41 |
| rm_work | xgerman: it'd be better for us if they did :/ | 21:41 |
| blogan | barbican = barbisplit | 21:41 |
| rm_work | though I am thinking for generation I'd rather use Anchor anyway | 21:41 |
| xgerman | yep, barbican't | 21:42 |
| xgerman | Anchor +! | 21:42 |
| rm_work | your anchor plugin for the cert manager interface is ready, right? | 21:42 |
| xgerman | yep, works | 21:42 |
| rm_work | i'd like to merge that and switch over to it in devstack if we can during the midcycle | 21:42 |
| rm_work | if we have time | 21:42 |
| crc32 | asyn1 to me just feels like XML parsing. Except theres no illusion that a human can read the actual format. | 21:42 |
| xgerman | Anchor is not in devstack… but I don;t see why not | 21:42 |
| xgerman | I runs fine for me in a screen (though manually installed) | 21:42 |
| rm_work | xgerman: it's just a thing to install | 21:43 |
| dougwig | rm_work: if barbican splits, can we get a sane API that doesn't delete in-use resources? :) | 21:43 |
| rm_work | heh | 21:43 |
| rm_work | maybe | 21:43 |
| rm_work | crc32: the pem library maybe | 21:43 |
| rm_work | crc32: https://pypi.python.org/pypi/pem/ | 21:43 |
| rm_work | import pem | 21:43 |
| rm_work | pem.parse(pem_string) | 21:43 |
| rm_work | and it gives a list of certs | 21:43 |
| rm_work | or keys | 21:44 |
| rm_work | or whatever | 21:44 |
| rm_work | though the failing build status in master concerns me slightly | 21:44 |
| rm_work | but it looks to support py2/py3 | 21:44 |
| rm_work | and has zero deps | 21:44 |
| rm_work | OH lol hynek manages this | 21:44 |
| rm_work | whelp | 21:45 |
| rm_work | yeah we should probably use this | 21:45 |
| rm_work | let me poke at him | 21:45 |
| ptoohill | any problems with that license? | 21:45 |
| ptoohill | probably not, just curoius | 21:46 |
| rm_work | I'm asking him about it | 21:46 |
| rm_work | shouldn't be, it's MIT and is just a lib | 21:46 |
| blogan | neturon-lbaas jobs have been purring like a kitten lately, i haven't seen them have false negatives in a while | 21:46 |
| ptoohill | yea | 21:46 |
| *** bdrich has joined #openstack-lbaas | 21:46 | |
| dougwig | mit is a bsd derivative, as is apache. should be fine | 21:46 |
| ptoohill | you just jinx yourself blogan | 21:46 |
| rm_work | blogan: why u do dis | 21:47 |
| ptoohill | well, everyone | 21:47 |
| rm_work | ^^^ | 21:47 |
| blogan | i know | 21:47 |
| rm_work | jinxed by blogan | 21:47 |
| blogan | i just had to say it | 21:47 |
| ptoohill | >< | 21:47 |
| dougwig | there's a joke in there about blogan being a jinx or something. | 21:47 |
| crc32 | import pem | 21:47 |
| blogan | there's a jinx about dougwig being joke | 21:48 |
| crc32 | ImportError: No module named OpenSSL.SSL | 21:48 |
| blogan | being a | 21:48 |
| crc32 | yes thats cute | 21:48 |
| rm_work | lolwat | 21:48 |
| ptoohill | heh | 21:48 |
| rm_work | it says no deps | 21:48 |
| rm_work | that is not no deps | 21:48 |
| rm_work | poking the author now, he still hasn't responded | 21:48 |
| dougwig | import blogan | 21:48 |
| dougwig | NotFound: check tow lot | 21:48 |
| blogan | bwahahahaha you so funny | 21:49 |
| blogan | thats like a 2 year old joke now | 21:49 |
| dougwig | i have good source material. | 21:49 |
| blogan | 2014 called they want their joke back | 21:49 |
| rm_work | lol wow yeah this is part of the twisted plugin for it which we don't even need... lame | 21:49 |
| xgerman | I like the tow joke ;-) | 21:50 |
| crc32 | ImportErrorno module name twisted.internet??? | 21:50 |
| crc32 | I think I got the wrong pem package | 21:50 |
| blogan | twisted imports the internet?? | 21:50 |
| blogan | i mean it defines the internet | 21:50 |
| crc32 | pem==15.0.0 <-- is this our package? | 21:50 |
| rm_work | crc32: no this is it | 21:50 |
| rm_work | i see why it's happening | 21:51 |
| crc32 | no dependencies my ass | 21:51 |
| rm_work | I'm going to get him to fix it | 21:51 |
| rm_work | or submit a patch against it to fix it | 21:51 |
| rm_work | crc32: try "pem==0.3.0" | 21:52 |
| rm_work | :P | 21:52 |
| ptoohill | So my patches for 'remove OpenSSL' are still valid, this should be anotehr review to update to new lib? | 21:52 |
| ptoohill | or just drop these and wait? | 21:52 |
| rm_work | ptoohill: yes | 21:52 |
| rm_work | ptoohill: first one | 21:52 |
| ptoohill | kk | 21:52 |
| dougwig | they're in the gate already, fine to let them go | 21:53 |
| ptoohill | good deal | 21:53 |
| crc32 | I guess thats the new development model. Tear out existing working functionality in favor of search for a library that does it "higher level". Then fix the library when you find its broken. | 21:53 |
| *** ducttape_ has quit IRC | 21:54 | |
| rm_work | yeah essentially | 21:54 |
| rm_work | better than littering the same code all over the place and trying to maintain it in a ton of places | 21:54 |
| crc32 | to quote a soon to be ex lbaas-developer "It is what it is". | 21:54 |
| rm_work | heh | 21:55 |
| ptoohill | Yea, i certainly see value in not having to maintain it ourself, but if its not stable I dont want to use it | 21:55 |
| rm_work | I'm finding out | 21:55 |
| rm_work | it's maintained by one of the main crypto/pyopenssl devs that I already know | 21:55 |
| rm_work | so | 21:55 |
| crc32 | just find a working library. I'm not cool with the lets break our code and fix some one elses library instead mentality. | 21:55 |
| crc32 | ah thats explains it. | 21:56 |
| rm_work | just give me a bit to find out what's going on | 21:56 |
| ptoohill | crc32: On that note, i see your point, but I also think if we can remove 'low level code that doesnt really need to be part of ours then why not? It makes us a cleaner, hopefully more stable product | 21:57 |
| ptoohill | Assuming the libs we use are stable, but... | 21:57 |
| dougwig | i think half the lbaas team is on this flight. | 21:57 |
| ptoohill | on that note, we had neutron crap on us even this weekend | 21:58 |
| ptoohill | so yea | 21:58 |
| ptoohill | nice | 21:58 |
| xgerman | dougwig mine is at 4 pm so… still time to break somethinh but I need to start getting to the airport ;-) | 21:59 |
| *** davidlenwell has quit IRC | 22:05 | |
| *** woodster_ has joined #openstack-lbaas | 22:06 | |
| ptoohill | way to go blogan: http://logs.openstack.org/68/265968/2/check/gate-neutron-lbaasv2-dsvm-listener/47ab84d/console.html | 22:12 |
| *** doug-fish has quit IRC | 22:12 | |
| ptoohill | He did it, hes a walking curse | 22:13 |
| *** doug-fish has joined #openstack-lbaas | 22:13 | |
| crc32 | yea go for it.who's a walking curse? | 22:14 |
| ptoohill | blogan | 22:14 |
| ptoohill | He just HAD to say SOMETHING | 22:14 |
| ptoohill | Now everything will go up in flames | 22:15 |
| blogan | son of a | 22:15 |
| crc32 | yea now he's getting mad at me for no reason. | 22:15 |
| ptoohill | lol | 22:15 |
| ptoohill | lol | 22:15 |
| crc32 | I forget what I said but he snapped and put his head phones on. | 22:15 |
| ptoohill | He realized he cursed the rest of the week and is ashamed | 22:16 |
| blogan | really wish you could use assertEquals in classmethods | 22:16 |
| crc32 | I remember when I used to be the one on the team with a temper. Then I had a heart attack. | 22:16 |
| *** rtheis_ has quit IRC | 22:17 | |
| *** doug-fish has quit IRC | 22:17 | |
| *** rtheis has joined #openstack-lbaas | 22:17 | |
| *** rtheis has quit IRC | 22:18 | |
| crc32 | finally pem loaded. | 22:19 |
| crc32 | I needed service_identity twisted pyopenssl. Some how I got pyasn1. | 22:19 |
| crc32 | hey rm_work which method disects an x509? | 22:20 |
| rm_work | pem.parse() | 22:22 |
| rm_work | just pass the pem string to it and it gives you a list back of certs | 22:23 |
| rm_work | I tried it on your test certs from octavia and it worked great | 22:23 |
| rm_work | even filtered the junk | 22:23 |
| ptoohill | dougwig: 1.0.1? | 22:27 |
| ptoohill | 1.1.0? | 22:28 |
| *** davidlenwell has joined #openstack-lbaas | 22:29 | |
| crc32 | it picked up the subject alt names? | 22:29 |
| dougwig | ptoohill: 1.0.1 is fine. we've probably missed bumps of it in the past. | 22:29 |
| ptoohill | :) | 22:29 |
| blogan | ptoohill: looks like that is failing bc that test is sending in odd tenant_ids and neutron-lbaas doesn't do validation on it, but octavia validates that its a uuid | 22:30 |
| ptoohill | the one i pasted? | 22:30 |
| blogan | yeah | 22:31 |
| blogan | but then i'd expect it to faill all the time | 22:31 |
| ptoohill | i was seeing provisioning status | 22:31 |
| blogan | so tahts the confusing piece | 22:31 |
| blogan | what do you mean? | 22:31 |
| crc32 | ptoohill what are you getting for the SNI hosts on this cert http://pastebin.com/xe9GAP7i | 22:36 |
| *** neelashah has quit IRC | 22:37 | |
| crc32 | I get back a Certificate inst but the library is hiding the methods on this object. I don't see any methods that are usfull in getting the SNI attrs | 22:38 |
| rm_work | oh, yeah no | 22:38 |
| rm_work | pem is literally just for splitting, lol | 22:39 |
| rm_work | you'd still need to load each up with cryptography to get the altnames out | 22:39 |
| rm_work | it just replaces the text parsing stuff | 22:39 |
| crc32 | you mean like its just using the "--- BEGIn <BLAH> ---- | 22:40 |
| crc32 | to detect the object type? | 22:40 |
| rm_work | yes | 22:40 |
| rm_work | wait do we even do that still? | 22:40 |
| crc32 | I don't unless you consider parsing "--- <BLAH BLAH BLH>----" to be a low level operation that we are against. | 22:41 |
| rm_work | ah yeah right, we do it with IMDs | 22:41 |
| rm_work | i mean... eh? | 22:41 |
| rm_work | i don't care a lot, was just trying to mollify dougwig | 22:41 |
| rm_work | for parsing out subjectAltNames, cryptography *is* high level | 22:42 |
| *** doug-fis_ has joined #openstack-lbaas | 22:42 | |
| dougwig | crc32: parsing protocol strings is low-level by definition. i'm not sure we are "against" it. | 22:42 |
| ptoohill | If PEM lib is 'saving' one line of code I dont see another dep worth it | 22:42 |
| rm_work | the only "low level" thing we do that we could really have a library do is parsing the intermediates string into individual certs | 22:42 |
| crc32 | thats low level? | 22:42 |
| dougwig | was just asking if there was something higher-level, not trying to require it. seems odd that a language like python has such poor utility routines for certs. | 22:43 |
| rm_work | notice the quotes | 22:43 |
| crc32 | ok as long as you find a way to get the SNI hosts and that method is RFC complient meaning subjectAltNames then go for it. | 22:43 |
| dougwig | crc32: if parsing strings is high-level for you, we have very different definitions. | 22:43 |
| rm_work | string parsing is, in general, not something I *ever* want to be responsible for | 22:43 |
| crc32 | Reeating: ok as long as you find a way to get the SNI hosts and that method is RFC complient meaning subjectAltNames then go for it. | 22:43 |
| dougwig | eh, question answered, we can move on. if we find a really good abstraction, we can revisit. | 22:44 |
| blogan | sounds like we should do our library | 22:44 |
| blogan | own | 22:44 |
| crc32 | dougwig I already knew we had differen't definitions between high and low level. For example back in the day C was still considered high level for me. | 22:44 |
| blogan | import neutron_lbaas_octavia_cert_parsing_library | 22:44 |
| rm_work | blogan: that's what we do now :P | 22:45 |
| blogan | boom release it | 22:45 |
| dougwig | crc32: well, we're in the context of a python wsgi app, not in the context of machine code. it's all bout frame of reference. :) | 22:45 |
| *** doug-fis_ has quit IRC | 22:46 | |
| crc32 | dougwig: yea I can agree with tha. | 22:52 |
| openstackgerrit | Phillip Toohill proposed openstack/neutron-lbaas: Pass service admin auth from the Octavia driver https://review.openstack.org/264382 | 22:54 |
| *** mixos has quit IRC | 22:54 | |
| *** crc32 has quit IRC | 23:08 | |
| openstackgerrit | Merged openstack/neutron-lbaas: Replace deprecated library function os.popen() with subprocess https://review.openstack.org/265590 | 23:09 |
| *** crc32 has joined #openstack-lbaas | 23:13 | |
| *** crc32 has quit IRC | 23:15 | |
| *** crc32 has joined #openstack-lbaas | 23:15 | |
| openstackgerrit | Merged openstack/neutron-lbaas: Remove OpenSSL from cert_parser https://review.openstack.org/265457 | 23:17 |
| *** ducttape_ has joined #openstack-lbaas | 23:25 | |
| *** amotoki has quit IRC | 23:25 | |
| *** alejandrito has quit IRC | 23:40 | |
| Aish | rm_work: hi | 23:56 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!