| bharathm | For your other question, "barbican" is the default cert manager while using TLS terminated listeners.. For non-tls listeners barbican is not needed.. Also you can change the cert manager to local if you want though it's not secure | 00:01 |
|---|---|---|
| *** bana_k has quit IRC | 00:06 | |
| kong | thanks for your answer, bharathm, looking at that patch | 01:11 |
| kong | and, anyone is woking on this patch: (Basic LoadBalancer Scenario Test) https://review.openstack.org/#/c/172199/? | 01:22 |
| kong | I saw a bunch of patchsets... | 01:23 |
| kong | IIUC, scenario tests will be included in the structure proposed in that patch, but what about API test? I mean, testing for separated API, creating lb, listing lb...etc. | 01:29 |
| *** manishg has quit IRC | 01:44 | |
| *** ducttape_ has joined #openstack-lbaas | 01:54 | |
| *** ducttape_ has quit IRC | 01:55 | |
| *** ducttape_ has joined #openstack-lbaas | 01:55 | |
| *** manishg has joined #openstack-lbaas | 02:18 | |
| *** yamamoto has quit IRC | 02:27 | |
| *** yamamoto has joined #openstack-lbaas | 02:31 | |
| *** ducttape_ has quit IRC | 02:33 | |
| *** ducttape_ has joined #openstack-lbaas | 02:34 | |
| *** ducttape_ has quit IRC | 02:34 | |
| *** ducttape_ has joined #openstack-lbaas | 02:34 | |
| *** manishg has quit IRC | 02:41 | |
| *** links has joined #openstack-lbaas | 02:46 | |
| *** yamamoto has quit IRC | 02:50 | |
| *** ducttape_ has quit IRC | 02:57 | |
| *** ducttape_ has joined #openstack-lbaas | 02:58 | |
| *** ducttape_ has quit IRC | 02:58 | |
| *** manishg has joined #openstack-lbaas | 03:38 | |
| *** yamamoto has joined #openstack-lbaas | 04:01 | |
| *** Alex_Stef has joined #openstack-lbaas | 04:26 | |
| *** numans has joined #openstack-lbaas | 04:30 | |
| *** kobis has joined #openstack-lbaas | 04:33 | |
| *** prabampm has joined #openstack-lbaas | 04:45 | |
| *** manishg has quit IRC | 04:49 | |
| *** Alex_Stef has quit IRC | 04:53 | |
| *** Alex_Stef has joined #openstack-lbaas | 04:53 | |
| *** kobis has quit IRC | 04:58 | |
| *** amotoki has joined #openstack-lbaas | 05:11 | |
| *** amotoki has quit IRC | 05:18 | |
| *** anilvenkata has joined #openstack-lbaas | 05:19 | |
| *** eranra has quit IRC | 05:20 | |
| *** manishg has joined #openstack-lbaas | 05:20 | |
| *** manishg has quit IRC | 05:25 | |
| *** prabampm has quit IRC | 05:33 | |
| *** amotoki has joined #openstack-lbaas | 05:37 | |
| *** prabampm has joined #openstack-lbaas | 05:39 | |
| *** cody-somerville has quit IRC | 05:41 | |
| *** numans has quit IRC | 05:47 | |
| *** Purandar has quit IRC | 05:58 | |
| *** numans has joined #openstack-lbaas | 06:16 | |
| *** ihrachys has joined #openstack-lbaas | 06:21 | |
| *** ihrachys has quit IRC | 06:21 | |
| *** manishg has joined #openstack-lbaas | 06:21 | |
| *** bana_k has joined #openstack-lbaas | 06:21 | |
| *** manishg has quit IRC | 06:26 | |
| *** Alex_Stef has quit IRC | 06:33 | |
| *** prabampm has quit IRC | 06:49 | |
| *** bana_k has quit IRC | 06:56 | |
| *** prabampm has joined #openstack-lbaas | 06:56 | |
| *** nmagnezi has joined #openstack-lbaas | 06:58 | |
| *** ihrachys has joined #openstack-lbaas | 07:03 | |
| *** yamamoto has quit IRC | 07:04 | |
| *** yamamoto has joined #openstack-lbaas | 07:06 | |
| *** jschwarz has joined #openstack-lbaas | 07:13 | |
| *** manishg has joined #openstack-lbaas | 07:22 | |
| *** manishg has quit IRC | 07:26 | |
| *** yamamoto has quit IRC | 07:29 | |
| *** yamamoto has joined #openstack-lbaas | 07:30 | |
| *** reedip__ has quit IRC | 07:37 | |
| *** dhlorenz has joined #openstack-lbaas | 07:43 | |
| *** rcernin has joined #openstack-lbaas | 07:43 | |
| *** reedip__ has joined #openstack-lbaas | 07:44 | |
| *** fawadkhaliq has joined #openstack-lbaas | 07:54 | |
| *** fawadkhaliq has quit IRC | 08:10 | |
| *** numans has quit IRC | 08:14 | |
| *** anilvenkata has quit IRC | 08:15 | |
| *** Alex_Stef has joined #openstack-lbaas | 08:17 | |
| *** anilvenkata has joined #openstack-lbaas | 08:18 | |
| *** manishg has joined #openstack-lbaas | 08:22 | |
| *** manishg has quit IRC | 08:27 | |
| *** numans has joined #openstack-lbaas | 08:27 | |
| rm_work | bharathm / kong: unfortunately local was actually unusable because we never did the API-side work to make it possible to pass raw cert data in -- so it was removed, unless someone wants to re-add it and do the work on the API to make it possible to use | 08:28 |
| rm_work | ^^ just FYI since it was discussed earlier | 08:28 |
| *** mdavidson has quit IRC | 08:39 | |
| kong | rm_work: thanks for the info. that is really a bad new for me :-( | 08:39 |
| rm_work | well, if you do not need TLS Termination, you do not need Barbican | 08:39 |
| kong | depending on another openstack service will make things more complex | 08:39 |
| kong | rm_work: hmm, will consider that | 08:40 |
| rm_work | you can deploy Octavia for just HTTP and HTTPS Passthrough | 08:40 |
| kong | rm_work: that will depend on waht our customers want | 08:40 |
| rm_work | yes... Are you deploying Neutron-LBaaS with Octavia, or just Octavia? | 08:41 |
| rm_work | or, just Neutron-LBaaS with something like the namespace haproxy driver? | 08:41 |
| rm_work | I assume Neutron-LBaaS with Octavia, as this is the recommended model at the moment | 08:42 |
| kong | rm_work: yes, you are right. we are about to deploy neutron+lbaasv2+ocatavia | 08:43 |
| kong | rm_work: since octavia has a lot of features our customers want | 08:43 |
| rm_work | OK | 08:44 |
| rm_work | Then, getting TLS Termination to work without Barbican would require a large amount of effort :( | 08:44 |
| kong | rm_work: honestly speaking, I don't know the TLS termination mechanism, but I'll try to understand it | 08:45 |
| rm_work | you'd have to update the n-lbaas API to optionally allow passing in raw cert data, validate that only raw OR barbican data was passed, and pass this data on to the driver -- then update the Octavia API to allow for the same, and re-commit the local cert manager | 08:46 |
| rm_work | kong: with TLS Termination, the HTTPS connection would be decrypted on the LoadBalancer (amphora) and then the connection would continue to the member nodes unencrypted | 08:47 |
| rm_work | this allows for doing L7 operations and such on the traffic | 08:47 |
| rm_work | also it takes load off the backend members because TLS decryption is expensive | 08:47 |
| kong | rm_work: that means, haproxy will have more control about the data, right? | 08:47 |
| rm_work | yes | 08:47 |
| rm_work | otherwise, HAProxy can't inspect the traffic or headers | 08:48 |
| rm_work | so it has limited ability to make decisions | 08:48 |
| *** amotoki has quit IRC | 08:49 | |
| kong | rm_work: I hope lack of that feature will not stop us :-) | 08:49 |
| *** amotoki has joined #openstack-lbaas | 08:49 | |
| rm_work | Barbican is ... not THAT difficult to deploy? Though it is "yet another service" to worry about... but it is highly recommended for security | 08:50 |
| rm_work | of course, you need a HSM for it to be effective, and they are expensive :/ | 08:50 |
| kong | rm_work: anyway, it's not widely deployed. some of our operators even didn't heard about that | 08:51 |
| kong | if we deploy Babican only for Octavia, seems like a overkill | 08:52 |
| rm_work | I suppose so | 08:52 |
| rm_work | but it is to be used by many other services too, I think | 08:52 |
| kong | then that will be good for Babican to be more visible to the whole community | 08:53 |
| kong | I even thought, why not we provide another option for cert management in octavia. Users will take their choice | 08:54 |
| kong | s/take/make | 08:55 |
| rm_work | Yes, it would be great to have more choices, and it should be easy to add them -- IF they are external services | 08:55 |
| rm_work | an internal storage option (like database) could be added easily on the backend (with CertManager interface) BUT it is impossible to get any data to it without the API accepting raw cert data | 08:56 |
| rm_work | we'd welcome a CR to add this | 08:56 |
| *** numans has quit IRC | 08:56 | |
| rm_work | It was on my very long list of TODOs but I was never able to get to it | 08:56 |
| *** numans has joined #openstack-lbaas | 08:57 | |
| kong | i think if i understand it more, maybe i could help do something about this | 08:57 |
| kong | rm_work: it's very late for me, have to get sleep, nice talking to you | 08:59 |
| rm_work | Ok, yeah. 6pm here :) | 08:59 |
| rm_work | Talk to you later :) | 08:59 |
| kong | rm_work: have a good dinner :-) | 08:59 |
| openstackgerrit | Kobi Samoray proposed openstack/octavia: Implement custom header support for Octavia https://review.openstack.org/257901 | 09:08 |
| *** amotoki has quit IRC | 09:17 | |
| *** amotoki has joined #openstack-lbaas | 09:18 | |
| *** banszmar has quit IRC | 09:20 | |
| *** manishg has joined #openstack-lbaas | 09:23 | |
| *** manishg has quit IRC | 09:28 | |
| *** mdavidson has joined #openstack-lbaas | 09:35 | |
| *** banszmar has joined #openstack-lbaas | 09:37 | |
| *** links has quit IRC | 09:53 | |
| *** links has joined #openstack-lbaas | 09:54 | |
| *** yamamoto has quit IRC | 10:03 | |
| *** yamamoto has joined #openstack-lbaas | 10:04 | |
| *** dhlorenz_ has joined #openstack-lbaas | 10:06 | |
| *** dhlorenz has quit IRC | 10:08 | |
| *** numans has quit IRC | 10:16 | |
| *** yamamoto has quit IRC | 10:16 | |
| *** yamamoto has joined #openstack-lbaas | 10:17 | |
| *** manishg has joined #openstack-lbaas | 10:24 | |
| *** yamamoto has quit IRC | 10:26 | |
| *** anilvenkata is now known as anilvenkata_afk | 10:29 | |
| *** manishg has quit IRC | 10:29 | |
| *** openstackgerrit has quit IRC | 10:48 | |
| bharathm | rm_work: Thanks for clarifying on the local cert manager.. Apparently I didn't consider it's implementation (or lack of it) at the API front.. | 10:48 |
| *** openstackgerrit has joined #openstack-lbaas | 10:49 | |
| rm_work | yeah, it is a problem :( | 10:50 |
| rm_work | I wasn't thinking about it when I first implemented it either, i was living in a fantasy backend world :) | 10:50 |
| rm_work | thus the problem | 10:50 |
| *** nmagnezi has quit IRC | 10:57 | |
| *** dhlorenz_ has quit IRC | 11:03 | |
| *** dhlorenz has joined #openstack-lbaas | 11:05 | |
| *** nmagnezi has joined #openstack-lbaas | 11:10 | |
| *** krotscheck_vaca is now known as krotscheck | 11:13 | |
| *** yamamoto has joined #openstack-lbaas | 11:14 | |
| *** yamamoto_ has joined #openstack-lbaas | 11:15 | |
| *** yamamoto has quit IRC | 11:19 | |
| *** numan_ has joined #openstack-lbaas | 11:19 | |
| *** rtheis has joined #openstack-lbaas | 11:22 | |
| *** manishg has joined #openstack-lbaas | 11:25 | |
| *** manishg has quit IRC | 11:29 | |
| *** anilvenkata_afk is now known as anilvenkata | 11:39 | |
| *** neelashah has joined #openstack-lbaas | 11:58 | |
| *** nmagnezi_ has joined #openstack-lbaas | 12:08 | |
| *** nmagnezi has quit IRC | 12:12 | |
| *** numan_ has quit IRC | 12:43 | |
| openstackgerrit | Kobi Samoray proposed openstack/octavia: Implement custom header support for Octavia https://review.openstack.org/257901 | 12:47 |
| *** dhlorenz has quit IRC | 12:54 | |
| *** dhlorenz has joined #openstack-lbaas | 12:55 | |
| *** matt-borland has joined #openstack-lbaas | 13:15 | |
| *** links has quit IRC | 13:21 | |
| *** dhlorenz has quit IRC | 13:25 | |
| *** dhlorenz has joined #openstack-lbaas | 13:27 | |
| *** neelashah has quit IRC | 13:30 | |
| *** prabampm1 has joined #openstack-lbaas | 13:33 | |
| *** prabampm has quit IRC | 13:35 | |
| *** woodster_ has joined #openstack-lbaas | 13:36 | |
| *** TrevorV has joined #openstack-lbaas | 13:41 | |
| *** yamamoto_ has quit IRC | 13:56 | |
| *** yamamoto has joined #openstack-lbaas | 13:56 | |
| *** prabampm1 has quit IRC | 14:01 | |
| *** anilvenkata has quit IRC | 14:11 | |
| *** doug-fish has joined #openstack-lbaas | 14:15 | |
| *** ajmiller has joined #openstack-lbaas | 14:16 | |
| *** neelashah has joined #openstack-lbaas | 14:21 | |
| *** prabampm has joined #openstack-lbaas | 14:22 | |
| ptoohill | Hey xgerman, you around? Could I bug you regarding agent plug vip | 14:31 |
| *** Bjoern has joined #openstack-lbaas | 14:31 | |
| *** piet has joined #openstack-lbaas | 14:32 | |
| *** amotoki has quit IRC | 14:35 | |
| ptoohill | xgerman: Please let me know if you get a chance to chat with me at some point today, please. | 14:37 |
| ajmiller | pthoohil xgerman is out most of this week, with questionable internet access. | 14:38 |
| rm_work | so kinda like me last week | 14:41 |
| *** ducttape_ has joined #openstack-lbaas | 14:41 | |
| ptoohill | ajmiller: Ah thank you for info :) | 14:43 |
| *** mixos has joined #openstack-lbaas | 14:59 | |
| *** Alex_Stef has quit IRC | 15:00 | |
| *** cody-somerville has joined #openstack-lbaas | 15:07 | |
| *** cody-somerville has quit IRC | 15:07 | |
| *** cody-somerville has joined #openstack-lbaas | 15:07 | |
| *** neelashah has quit IRC | 15:08 | |
| *** Purandar has joined #openstack-lbaas | 15:15 | |
| *** mixos has quit IRC | 15:24 | |
| *** mixos has joined #openstack-lbaas | 15:27 | |
| *** neelashah has joined #openstack-lbaas | 15:27 | |
| *** johnsom has joined #openstack-lbaas | 15:31 | |
| *** mixos has quit IRC | 15:37 | |
| *** mixos has joined #openstack-lbaas | 15:42 | |
| *** mixos has quit IRC | 15:48 | |
| *** amotoki has joined #openstack-lbaas | 15:48 | |
| *** mixos has joined #openstack-lbaas | 15:53 | |
| *** piet has quit IRC | 15:53 | |
| *** jschwarz has quit IRC | 16:01 | |
| *** mixos has quit IRC | 16:01 | |
| *** mixos has joined #openstack-lbaas | 16:02 | |
| *** mixos has quit IRC | 16:02 | |
| *** mixos has joined #openstack-lbaas | 16:09 | |
| TrevorV | Hey dougwig you around just yet? | 16:28 |
| dougwig | TrevorV: yo | 16:30 |
| *** TrevorV has quit IRC | 16:30 | |
| *** TrevorV has joined #openstack-lbaas | 16:30 | |
| TrevorV | Hah... dougwig I just "ctrl+q" and closed my chat... RIP. | 16:30 |
| TrevorV | So the single-create "functions", as in, receives the request... But the response object is not right, and octavia is failing to build an amp. So I have some bugs somewhere that need sorted methinks. | 16:31 |
| TrevorV | I'm only telling you because you did a few rechecks on the patch set, just wanted you to know it wasn't quite ready | 16:31 |
| *** nmagnezi_ has quit IRC | 16:31 | |
| dougwig | TrevorV: oh, my CI was pissy on friday, so i might've been trying to get it a clean run. | 16:32 |
| *** barra204 has quit IRC | 16:32 | |
| TrevorV | Oh, gotcha, but it may just be a dirty run in general from it being incomplete, so I wouldn't stress on it, you know? | 16:32 |
| dougwig | hey, if it fails for reals, good. if it fails because i broke my infrastructure, it's gonna get a recheck. :) | 16:33 |
| dougwig | it no longer costs me a quarter every time you jackals push a patchset. | 16:34 |
| TrevorV | Ha ha ha hey now, I'm no jackal. | 16:34 |
| TrevorV | Though I think I'm a contender for most patch sets on a single review... | 16:34 |
| rm_work | damn, mind telling me what it costs you now? | 16:45 |
| rm_work | need to reprogram the algorithm I use for my dougwig-money-wasted counter app | 16:45 |
| *** numan_ has joined #openstack-lbaas | 16:46 | |
| *** nmagnezi_ has joined #openstack-lbaas | 16:47 | |
| *** rcernin has quit IRC | 16:48 | |
| johnsom | Has anyone tried adding a member on a second network/subnet recently? I.e. 1 member on private, another member on a different network? | 16:50 |
| johnsom | In testing my namespace patch I see the network plugged in nova, but in the amp eth2 doesn't show up. | 16:50 |
| johnsom | lshw -C NET shows: *-network:2 DISABLED | 16:51 |
| *** bana_k has joined #openstack-lbaas | 16:57 | |
| *** armax has joined #openstack-lbaas | 17:07 | |
| *** Frito has joined #openstack-lbaas | 17:08 | |
| *** crc32 has joined #openstack-lbaas | 17:10 | |
| *** neelashah has quit IRC | 17:14 | |
| *** nmagnezi_ has quit IRC | 17:23 | |
| *** amotoki has quit IRC | 17:23 | |
| *** ihrachys has quit IRC | 17:24 | |
| *** kevo has joined #openstack-lbaas | 17:39 | |
| *** piet has joined #openstack-lbaas | 17:42 | |
| *** dhlorenz has quit IRC | 17:48 | |
| *** yamamoto has quit IRC | 18:01 | |
| *** yamamoto has joined #openstack-lbaas | 18:01 | |
| dougwig | rm_work: internal openstack cloud, and the landlord pays electricity. | 18:02 |
| dougwig | rm_work: do your worst. | 18:02 |
| *** anilvenkata has joined #openstack-lbaas | 18:02 | |
| *** doug-fish has quit IRC | 18:03 | |
| *** doug-fish has joined #openstack-lbaas | 18:03 | |
| *** doug-fish has quit IRC | 18:03 | |
| *** mixos has quit IRC | 18:04 | |
| *** neelashah has joined #openstack-lbaas | 18:11 | |
| *** numan_ has quit IRC | 18:14 | |
| *** mixos has joined #openstack-lbaas | 18:14 | |
| *** neelashah has quit IRC | 18:15 | |
| *** neelashah has joined #openstack-lbaas | 18:22 | |
| *** mixos has quit IRC | 18:27 | |
| *** mixos has joined #openstack-lbaas | 18:28 | |
| *** mixos has quit IRC | 18:31 | |
| *** diogogmt has joined #openstack-lbaas | 18:34 | |
| *** mixos has joined #openstack-lbaas | 18:36 | |
| *** crc32 has quit IRC | 18:38 | |
| *** mixos has quit IRC | 18:41 | |
| *** mixos has joined #openstack-lbaas | 18:55 | |
| *** mixos has quit IRC | 18:56 | |
| *** dhlorenz has joined #openstack-lbaas | 19:01 | |
| openstackgerrit | Mark Vanderwiel proposed openstack/neutron-lbaas-dashboard: fix unit tests https://review.openstack.org/296718 | 19:13 |
| *** mixos has joined #openstack-lbaas | 19:22 | |
| neelashah | johnsom: hi | 19:23 |
| neelashah | wondering about the linkgage of the lp to gerritt so the bugs get automatically updated with the patches? | 19:24 |
| johnsom | neelashah Hi. It is still on my todo list for more research. I think it is the group in the project.yaml, but I'm not 100% sure yet. | 19:33 |
| neelashah | johnsom: ok, thanks…let me know if I need to do something on that | 19:34 |
| johnsom | You are welcome to research as well. I need to understand the implications of removing the group: neutron from the project | 19:35 |
| *** Bjoern has quit IRC | 19:37 | |
| *** piet has quit IRC | 19:41 | |
| *** shakamunyi has joined #openstack-lbaas | 19:51 | |
| *** shakamunyi has quit IRC | 19:57 | |
| *** neelashah1 has joined #openstack-lbaas | 19:59 | |
| *** neelashah has quit IRC | 20:02 | |
| *** anilvenkata has quit IRC | 20:10 | |
| *** neelashah1 has quit IRC | 20:30 | |
| TrevorV | Anyone here know anything about the "git commit style"? | 20:47 |
| TrevorV | Like, "simple" versus ... another option I can't remember>? | 20:47 |
| TrevorV | I'm having the WORST time trying to google for it. | 20:47 |
| TrevorV | The problem I'm having is after doing a "git review -d #######", and making changes, I do a "git commit --amend" and it changes the name of my branch... Like, detaches me and stuff. | 20:48 |
| TrevorV | I don't like it. | 20:48 |
| TrevorV | Well, I didn't strictly figure it out, but I think I got a solution for this singular instance... | 20:57 |
| TrevorV | Sorry guys :D | 20:57 |
| *** ihrachys has joined #openstack-lbaas | 20:57 | |
| *** TrevorV has quit IRC | 21:01 | |
| openstackgerrit | Trevor Vardeman proposed openstack/neutron-lbaas: WIP - Get Me A LB https://review.openstack.org/257201 | 21:02 |
| *** mixos has quit IRC | 21:55 | |
| *** matt-borland has quit IRC | 21:58 | |
| *** mixos has joined #openstack-lbaas | 21:59 | |
| *** rtheis has quit IRC | 22:01 | |
| *** mixos has quit IRC | 22:05 | |
| *** ducttape_ has quit IRC | 22:12 | |
| *** mixos has joined #openstack-lbaas | 22:15 | |
| *** mixos has quit IRC | 22:21 | |
| *** mixos has joined #openstack-lbaas | 22:33 | |
| *** mixos has quit IRC | 22:47 | |
| openstackgerrit | Michael Johnson proposed openstack/octavia: Run amphora haproxy in a network namespace https://review.openstack.org/300292 | 22:48 |
| *** diogogmt has quit IRC | 22:56 | |
| *** diogogmt has joined #openstack-lbaas | 22:59 | |
| *** ihrachys has quit IRC | 23:11 | |
| *** chlong has joined #openstack-lbaas | 23:18 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/octavia: Updated from global requirements https://review.openstack.org/301394 | 23:20 |
| *** ducttape_ has joined #openstack-lbaas | 23:26 | |
| *** mixos has joined #openstack-lbaas | 23:26 | |
| *** ducttape_ has quit IRC | 23:28 | |
| *** mixos has quit IRC | 23:31 | |
| *** mixos has joined #openstack-lbaas | 23:32 | |
| *** mixos has quit IRC | 23:33 | |
| *** mixos has joined #openstack-lbaas | 23:35 | |
| *** mixos has quit IRC | 23:40 | |
| openstackgerrit | Tin Lam proposed openstack/neutron-lbaas-dashboard: Update requirement for horizon in stable/mitaka https://review.openstack.org/301404 | 23:55 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!