| openstackgerrit | Adam Harwell proposed openstack/octavia master: Fix amp failover where failover already failed https://review.openstack.org/548989 | 00:05 |
|---|---|---|
| rm_work | johnsom: not sure why the rebase on that kvm patch was so wonky | 00:05 |
| rm_work | sometimes git is weird | 00:05 |
| johnsom | yeah, I created a replacement, we can probably abandon that one | 00:06 |
| johnsom | Interestingly enough, the first run with OVH re-enabled passed | 00:06 |
| rm_work | i did already | 00:06 |
| rm_work | ah actually i see | 00:06 |
| rm_work | it wasn't a rebase issue | 00:07 |
| rm_work | the patch that originally did the kvm disablement actually had the cert_parser test fixes in it, lol | 00:07 |
| rm_work | because we had to put it in the same patch, because both needed to merge at the same time | 00:08 |
| rm_work | so a true revert was never going to work actually, lol | 00:08 |
| rm_work | johnsom: did it pass *on OVH hosts*? | 00:08 |
| rm_work | hmm, looks like it i guess | 00:09 |
| johnsom | http://logs.openstack.org/54/549054/1/check/octavia-v1-dsvm-scenario/5e1058d/zuul-info/zuul-info.primary.txt | 00:09 |
| rm_work | and the timing looks right | 00:10 |
| johnsom | yeah, but maybe that is the lucky region. rechecking | 00:10 |
| rm_work | maybe we waited long enough that they fixed it | 00:10 |
| johnsom | Right | 00:10 |
| rm_work | ah is there a lucky region? :P | 00:10 |
| rm_work | i thought it was 100% | 00:10 |
| johnsom | I thought so too, but .... rechecking | 00:10 |
| rm_work | LOLWUT | 00:17 |
| rm_work | i made a new image | 00:17 |
| rm_work | uhh | 00:17 |
| rm_work | did i do something wrong | 00:17 |
| rm_work | u"Build of instance b811ce0f-f6be-470c-a53b-0df8c3a5bec3 aborted: Flavor's disk is too small for requested image. Flavor disk is 2147483648 bytes, image is 3221225472 bytes." | 00:18 |
| rm_work | it's centos so i did size 3 | 00:18 |
| rm_work | was it somehow building in size 2 before? | 00:18 |
| rm_work | O_o | 00:18 |
| rm_work | johnsom: ok so i may have found a bug with that haproxy18 | 00:32 |
| rm_work | and the one cgoncalves built as well | 00:32 |
| rm_work | so it might be an haproxy upstream thing??? | 00:32 |
| rm_work | if you add a HM, the checks don't run unless you *restart* haproxy | 00:33 |
| rm_work | a *reload* doesn't do it | 00:33 |
| rm_work | that's why i was having that weird HM issue the other day, and why i said it went away after i added the logline and restarted | 00:33 |
| johnsom | That would be a huge bug | 00:33 |
| rm_work | gonna see if i can get some better info | 00:34 |
| johnsom | What version are you running? | 00:34 |
| rm_work | 1.8.1 and 1.8.3 | 00:34 |
| rm_work | were the two i tried | 00:34 |
| rm_work | uhhh also since when is listener delete cascading? | 00:35 |
| rm_work | ah nm it's because the pool isn't actually a child | 00:35 |
| rm_work | though pool delete does delete members AND any HMs apparently | 00:36 |
| johnsom | Yeah, pool cascade has been a thing for a long time. Wasn't sure if HM worked, but I knew members did | 00:36 |
| rm_work | i didn't think HM would work because it's a real object but i guess it isn't actually | 00:40 |
| rm_work | alright whelp. i guess there's no need to port "cascade" to anything at all | 00:40 |
| johnsom | I am suspect as I don't see anything in the release notes and that would be a MAJOR bug: http://git.haproxy.org/?p=haproxy-1.8.git;a=blob_plain;f=CHANGELOG;hb=HEAD | 00:40 |
| rm_work | since that means the only object that even checks is LB | 00:40 |
| rm_work | well i'm about to get more debug | 00:40 |
| rm_work | one sec | 00:40 |
| johnsom | Really, Listener? | 00:41 |
| johnsom | L7 policy/ | 00:41 |
| johnsom | ? | 00:41 |
| rm_work | https://gist.github.com/rm-you/2de6beeccb8f63174ff50799c61ca57d | 00:46 |
| rm_work | ah i didn't try listener with l7policies | 00:46 |
| rm_work | (the log lines after reloaded/started are me curling the vip) | 00:47 |
| johnsom | http://git.haproxy.org/?p=haproxy-1.8.git;a=commitdiff;h=a91f557 | 00:47 |
| johnsom | Maybe | 00:47 |
| johnsom | Do you have the worker mode enabled? | 00:48 |
| rm_work | i didn't think so | 00:48 |
| rm_work | that's the -W right? | 00:48 |
| johnsom | Don't know, it's new and I haven't played with it yet | 00:49 |
| rm_work | ahh I see -Ws finally | 00:49 |
| rm_work | '-Ws master-worker mode with systemd notify support.' | 00:49 |
| rm_work | but no, it's not enabled | 00:49 |
| johnsom | How is that tempest plugin looking? | 00:54 |
| johnsom | Catch you in the morning | 00:55 |
| rm_work | <_< | 00:55 |
| rm_work | night | 00:55 |
| *** jdavis has quit IRC | 01:01 | |
| *** slaweq has joined #openstack-lbaas | 01:05 | |
| *** slaweq has quit IRC | 01:10 | |
| *** jniesz has quit IRC | 01:13 | |
| openstackgerrit | Adam Harwell proposed openstack/octavia master: Update HAProxy version for Centos https://review.openstack.org/548420 | 01:20 |
| rm_work | johnsom: switching it *to* master-worker mode fixed it | 01:20 |
| rm_work | so... yay? >_> | 01:20 |
| *** yamamoto has joined #openstack-lbaas | 01:35 | |
| *** yamamoto_ has quit IRC | 01:38 | |
| *** fnaval has joined #openstack-lbaas | 01:50 | |
| *** harlowja has quit IRC | 01:58 | |
| *** fyx has joined #openstack-lbaas | 02:23 | |
| *** slaweq has joined #openstack-lbaas | 03:07 | |
| *** slaweq has quit IRC | 03:11 | |
| *** AlexeyAbashkin has joined #openstack-lbaas | 03:59 | |
| *** AlexeyAbashkin has quit IRC | 04:03 | |
| *** hogepodge has quit IRC | 04:10 | |
| *** amitry has quit IRC | 04:10 | |
| *** kong has quit IRC | 04:10 | |
| *** mnaser has quit IRC | 04:10 | |
| *** fyx has quit IRC | 04:10 | |
| *** zioproto has quit IRC | 04:10 | |
| *** coreycb has quit IRC | 04:10 | |
| *** xgerman_ has quit IRC | 04:11 | |
| *** ctracey has quit IRC | 04:11 | |
| *** redondo-mk has quit IRC | 04:11 | |
| *** johnsom has quit IRC | 04:11 | |
| *** kong has joined #openstack-lbaas | 04:12 | |
| *** amitry has joined #openstack-lbaas | 04:12 | |
| *** hogepodge has joined #openstack-lbaas | 04:12 | |
| *** johnsom has joined #openstack-lbaas | 04:12 | |
| *** redondo-mk has joined #openstack-lbaas | 04:12 | |
| *** zioproto has joined #openstack-lbaas | 04:12 | |
| *** xgerman_ has joined #openstack-lbaas | 04:12 | |
| *** coreycb has joined #openstack-lbaas | 04:12 | |
| *** mnaser has joined #openstack-lbaas | 04:13 | |
| *** coreycb has quit IRC | 04:16 | |
| *** ctracey has joined #openstack-lbaas | 04:18 | |
| *** coreycb has joined #openstack-lbaas | 04:31 | |
| *** fyx has joined #openstack-lbaas | 04:40 | |
| *** yamamoto has quit IRC | 04:40 | |
| *** yamamoto has joined #openstack-lbaas | 04:40 | |
| *** fnaval_ has joined #openstack-lbaas | 04:42 | |
| *** fnaval has quit IRC | 04:42 | |
| *** annp has joined #openstack-lbaas | 04:49 | |
| *** harlowja has joined #openstack-lbaas | 05:00 | |
| *** gcheresh has joined #openstack-lbaas | 05:02 | |
| *** gcheresh has quit IRC | 05:08 | |
| *** gcheresh has joined #openstack-lbaas | 05:42 | |
| *** gcheresh has quit IRC | 06:04 | |
| *** kobis has joined #openstack-lbaas | 06:16 | |
| *** AlexeyAbashkin has joined #openstack-lbaas | 06:16 | |
| *** harlowja has quit IRC | 06:23 | |
| *** gcheresh has joined #openstack-lbaas | 06:27 | |
| *** AlexeyAbashkin has quit IRC | 06:29 | |
| *** bbzhao has quit IRC | 06:33 | |
| *** bbzhao has joined #openstack-lbaas | 06:33 | |
| *** kobis has quit IRC | 06:36 | |
| *** bbzhao has quit IRC | 07:23 | |
| *** bbzhao has joined #openstack-lbaas | 07:23 | |
| *** gcheresh has quit IRC | 07:25 | |
| *** pcaruana has joined #openstack-lbaas | 07:34 | |
| *** b_bezak has joined #openstack-lbaas | 07:51 | |
| *** kobis has joined #openstack-lbaas | 07:51 | |
| *** kobis has quit IRC | 07:56 | |
| *** slaweq_ has joined #openstack-lbaas | 08:01 | |
| *** harlowja has joined #openstack-lbaas | 08:01 | |
| *** harlowja has quit IRC | 08:02 | |
| *** rcernin has quit IRC | 08:04 | |
| *** slaweq_ has quit IRC | 08:06 | |
| openstackgerrit | ZhaoBo proposed openstack/octavia master: UDP for [2] https://review.openstack.org/529651 | 08:17 |
| openstackgerrit | ZhaoBo proposed openstack/octavia master: UDP for [3][5][6] https://review.openstack.org/539391 | 08:17 |
| *** danpawlik has joined #openstack-lbaas | 08:19 | |
| *** AlexeyAbashkin has joined #openstack-lbaas | 08:22 | |
| *** yamamoto has quit IRC | 08:26 | |
| *** slaweq_ has joined #openstack-lbaas | 08:50 | |
| *** slaweq_ has quit IRC | 08:55 | |
| *** cristicalin has joined #openstack-lbaas | 09:06 | |
| *** cristicalin has quit IRC | 09:11 | |
| *** yamamoto has joined #openstack-lbaas | 09:15 | |
| *** cristicalin has joined #openstack-lbaas | 09:16 | |
| *** yamamoto has quit IRC | 09:29 | |
| *** slaweq_ has joined #openstack-lbaas | 09:43 | |
| *** cristicalin has quit IRC | 09:43 | |
| *** slaweq_ has quit IRC | 09:50 | |
| *** cristicalin has joined #openstack-lbaas | 09:50 | |
| *** ipsecguy has quit IRC | 09:52 | |
| *** ipsecguy has joined #openstack-lbaas | 09:54 | |
| *** dayou has quit IRC | 09:59 | |
| *** dayou has joined #openstack-lbaas | 10:00 | |
| *** gcheresh has joined #openstack-lbaas | 10:17 | |
| *** salmankhan has joined #openstack-lbaas | 10:21 | |
| *** kobis has joined #openstack-lbaas | 10:24 | |
| *** kobis has quit IRC | 10:24 | |
| *** kobis has joined #openstack-lbaas | 10:29 | |
| *** kobis has quit IRC | 10:29 | |
| *** gcheresh has quit IRC | 10:29 | |
| *** gcheresh has joined #openstack-lbaas | 10:30 | |
| johnsom | OSPrivate is the network, password is (with a space between the n and the 5): 0p3n 5t@cK | 10:32 |
| *** kobis has joined #openstack-lbaas | 10:33 | |
| *** gcheresh has quit IRC | 10:54 | |
| *** AlexeyAbashkin has quit IRC | 11:03 | |
| *** AlexeyAbashkin has joined #openstack-lbaas | 11:09 | |
| *** cristicalin has quit IRC | 11:18 | |
| *** cristicalin has joined #openstack-lbaas | 11:22 | |
| *** kobis has quit IRC | 11:26 | |
| *** kobis has joined #openstack-lbaas | 11:27 | |
| *** kobis has quit IRC | 11:27 | |
| *** kobis has joined #openstack-lbaas | 11:27 | |
| *** kobis has quit IRC | 11:28 | |
| openstackgerrit | ZhaoBo proposed openstack/octavia master: UDP jinja template https://review.openstack.org/525420 | 11:28 |
| openstackgerrit | ZhaoBo proposed openstack/octavia master: UDP for [2] https://review.openstack.org/529651 | 11:28 |
| openstackgerrit | ZhaoBo proposed openstack/octavia master: UDP for [3][5][6] https://review.openstack.org/539391 | 11:28 |
| *** mewald has joined #openstack-lbaas | 11:38 | |
| *** slaweq_ has joined #openstack-lbaas | 11:47 | |
| *** mewald has quit IRC | 11:50 | |
| *** slaweq_ has quit IRC | 11:52 | |
| *** annp has quit IRC | 11:57 | |
| *** yamamoto has joined #openstack-lbaas | 12:06 | |
| *** cristicalin has quit IRC | 12:12 | |
| *** cristicalin has joined #openstack-lbaas | 12:13 | |
| *** cristicalin has quit IRC | 12:25 | |
| *** yamamoto has quit IRC | 12:29 | |
| *** yamamoto has joined #openstack-lbaas | 13:02 | |
| *** danpawlik has quit IRC | 13:22 | |
| *** yamamoto has quit IRC | 13:33 | |
| *** salmankhan has quit IRC | 13:33 | |
| *** cristicalin has joined #openstack-lbaas | 13:34 | |
| *** yamamoto has joined #openstack-lbaas | 13:39 | |
| *** slaweq_ has joined #openstack-lbaas | 13:48 | |
| *** slaweq_ has quit IRC | 13:52 | |
| openstackgerrit | German Eichberger proposed openstack/neutron-lbaas master: Gate API test for the lbaasv2-proxy plugin https://review.openstack.org/539350 | 13:59 |
| openstackgerrit | German Eichberger proposed openstack/neutron-lbaas-dashboard master: Adds some notes on running both dashboards https://review.openstack.org/544589 | 14:04 |
| *** cristicalin has quit IRC | 14:05 | |
| *** cristicalin has joined #openstack-lbaas | 14:06 | |
| *** cristicalin has quit IRC | 14:10 | |
| *** yamamoto has quit IRC | 14:16 | |
| *** cristicalin has joined #openstack-lbaas | 14:20 | |
| johnsom | Alright, room isn't ready, but I can have tea and work | 14:23 |
| *** salmankhan has joined #openstack-lbaas | 14:31 | |
| johnsom | Well, we have seen two OVH regions have successful runs with KVM now. Maybe it has been resolved. | 14:39 |
| *** slaweq_ has joined #openstack-lbaas | 14:45 | |
| johnsom | https://www.dropbox.com/sh/dtei3ovfi7z74vo/AABBio92MSfZm3sCp49PNY6qa/Octavia?dl=0 | 14:46 |
| johnsom | Team photos | 14:46 |
| rm_work | noice | 14:48 |
| cgoncalves | such handsome men ;) | 14:48 |
| *** slaweq_ has quit IRC | 14:50 | |
| cgoncalves | johnsom: did you have the hotel staff calling a taxi for you or you had to wander around outside to flag one? | 14:53 |
| johnsom | Well, I used the app, but while I was waiting the concierge said he already have a taxi called that I could have. | 14:54 |
| johnsom | So, yes, better luck with the hotel staff than the app. | 14:54 |
| johnsom | The app hadn't found a car... | 14:54 |
| cgoncalves | hotel doing everything possible to kindly kick people out :D | 14:55 |
| *** jdavis has joined #openstack-lbaas | 14:57 | |
| johnsom | Ah, yeah, seems full over here | 14:58 |
| johnsom | Had to wait on my room | 14:58 |
| johnsom | Very nice though, good wifi | 14:59 |
| rm_work | cool | 14:59 |
| johnsom | I can start reading the bashing rm_work gave me. Grin | 14:59 |
| rm_work | so we should come downtown and crash your suite? :P | 14:59 |
| johnsom | Haven't seen it yet, so.... | 14:59 |
| johnsom | Could be the broom closet | 14:59 |
| rm_work | I'm working on a tangent again ATM... Trying to port a fix for the SG-in-use delete failures | 14:59 |
| rm_work | I had fixed it in my flip driver... | 14:59 |
| rm_work | it's plagueing me in my devstack | 15:00 |
| johnsom | I did a fix for that not too long ago, let me see if it is still open | 15:00 |
| rm_work | ah | 15:00 |
| rm_work | what's taking the time is properly adding tests for it | 15:00 |
| rm_work | it's ... complex | 15:00 |
| rm_work | also i found an off-by-one in our retry logic | 15:00 |
| rm_work | we try "CONF.networking.max_retries + 1" times, lol | 15:01 |
| johnsom | Opps | 15:01 |
| johnsom | Yeah, looks like mine merged, so... | 15:01 |
| rm_work | umm | 15:01 |
| rm_work | well | 15:01 |
| rm_work | yours doesn't actually fix the thing i'm talking about then | 15:01 |
| rm_work | what was yours | 15:01 |
| rm_work | i'll be able to post this one in a sec | 15:01 |
| johnsom | https://review.openstack.org/#/c/541494/ was the last one | 15:03 |
| johnsom | This was the one before: https://review.openstack.org/#/c/538408/ | 15:03 |
| johnsom | rm | 15:08 |
| johnsom | rm_work So, you were fine with the test_base in general? | 15:08 |
| rm_work | uhhh | 15:08 |
| rm_work | i had only gotten that far | 15:08 |
| rm_work | i needed to go back and look a little deeper | 15:08 |
| johnsom | Ok, really interested in your thoughts on the structure / capability of the test_base | 15:08 |
| *** cristicalin has quit IRC | 15:16 | |
| *** fnaval_ has quit IRC | 15:17 | |
| *** yamamoto has joined #openstack-lbaas | 15:20 | |
| openstackgerrit | German Eichberger proposed openstack/octavia master: [WIP] Periodic job to build + publish diskimage https://review.openstack.org/549259 | 15:22 |
| xgerman_ | ^^ johnsom please have a look | 15:22 |
| johnsom | Ok | 15:22 |
| xgerman_ | yeah, sat for 5 minutes with clarkb so it should be colose | 15:22 |
| xgerman_ | close | 15:22 |
| johnsom | Nice! | 15:22 |
| rm_work | ah maybe this isn't an off-by-one | 15:24 |
| johnsom | lol | 15:24 |
| *** kobis has joined #openstack-lbaas | 15:25 | |
| rm_work | because it's not only for retries | 15:25 |
| johnsom | I think there is one or two that looked ob1, but it didn't really matter so I bother creating a patch. That one however, is "maximum" | 15:25 |
| rm_work | the original try goes through this logic :P | 15:25 |
| rm_work | so technically "total tries" is max_retries+1 | 15:25 |
| rm_work | i was assuming this warning message was just for retries but it's for ALL tries | 15:26 |
| johnsom | xgerman_ Does this just overwrite or is there a directory structure that separates the builds? | 15:30 |
| xgerman_ | overwrite | 15:30 |
| xgerman_ | it’s for testing | 15:31 |
| johnsom | Ok, Will it run since it's a periodic? | 15:31 |
| xgerman_ | clark says yes | 15:31 |
| xgerman_ | but not sure | 15:31 |
| johnsom | Ok, looking in zuul | 15:31 |
| *** yamamoto has quit IRC | 15:35 | |
| rm_work | come on johnsom ... https://review.openstack.org/#/c/548991/ if it passes for you locally... | 15:37 |
| rm_work | also, we do technically run the functionals | 15:37 |
| rm_work | http://logs.openstack.org/91/548991/1/check/openstack-tox-cover/6e7d193/testr_results.html.gz | 15:37 |
| rm_work | they run as part of coverage | 15:37 |
| johnsom | rm_work You saw my slight encouragement to review the tempest patch | 15:37 |
| rm_work | lol yes | 15:38 |
| rm_work | wait actually, is our coverage gate ONLY running functional right now? >_> | 15:38 |
| rm_work | or is it just that only functional shows up in that testr results html | 15:38 |
| openstackgerrit | Adam Harwell proposed openstack/octavia master: When SG delete fails on vip deallocate, try harder https://review.openstack.org/549263 | 15:38 |
| rm_work | ^^ there's what I'm talking about -- a bit more extreme | 15:38 |
| johnsom | rm_work It might be because coverage does two runs an then merges the results files, so the run output may only be the last run | 15:39 |
| rm_work | ah, possibly yeah | 15:39 |
| *** slaweq has joined #openstack-lbaas | 15:42 | |
| johnsom | rm_work So.... This is similar to something someone else posted. I am a bit uncomfortable just deleting ports. Especially when we are handling the VIPs. | 15:43 |
| rm_work | this is OUR SG | 15:43 |
| rm_work | I don't think we could have applied it to any user-created ports? | 15:44 |
| rm_work | so this is kinda an "orphaned" thing | 15:44 |
| johnsom | Agreed, but do we own it or did xgerman_'s patch change that to make it tenant visible? | 15:44 |
| rm_work | i think we still own it? | 15:44 |
| johnsom | I'm not sure which project ID is on it | 15:44 |
| rm_work | ah I should make the LOG messages "warning" at least, not debug | 15:44 |
| rm_work | well, if we don't own them, they won't get deleted | 15:45 |
| rm_work | because the list is filtered by OUR project id | 15:45 |
| johnsom | Yeah, that is definitely warning | 15:45 |
| rm_work | see how I pull the list of extra_ports | 15:45 |
| rm_work | it's based on our neutron_client's project | 15:45 |
| rm_work | so if it's a tenant port, it wouldn't come up | 15:45 |
| johnsom | Ugh, that is getting EVERY port in out project..... | 15:46 |
| rm_work | yes <_< | 15:46 |
| rm_work | it's a backup | 15:46 |
| rm_work | I believe it's not THAT slow | 15:46 |
| johnsom | That is two per amp | 15:46 |
| rm_work | the alternative is, I think we know the possible port names | 15:46 |
| *** slaweq has quit IRC | 15:46 | |
| rm_work | yeah but it only executes if the first try on the SG fails | 15:47 |
| rm_work | which ... how often does that happen | 15:47 |
| johnsom | Man, deleting a port, that is like maybe even pushing ERROR | 15:47 |
| rm_work | so I had considered just looking for `octavia-lb-vrrp-<listener_id>` and `octavia-lb-<lb_id>` | 15:48 |
| rm_work | I think that's the two | 15:48 |
| rm_work | that could be orphaned | 15:48 |
| rm_work | I need to double check | 15:48 |
| rm_work | actually just the vrrp maybe | 15:49 |
| johnsom | But that will still match every port, not just the ports on the SG | 15:49 |
| *** kobis has quit IRC | 15:49 | |
| rm_work | errr | 15:49 |
| *** kobis has joined #openstack-lbaas | 15:49 | |
| rm_work | if we do a neutron list and filter on name? | 15:49 |
| johnsom | VRRP is the base port, lb is the VIP port (or I got that backwards again) | 15:49 |
| rm_work | so we look THOSE up, and filter by "on the SG" | 15:49 |
| johnsom | Oh, because you are adding the IDs | 15:49 |
| *** kobis has quit IRC | 15:49 | |
| *** kobis has joined #openstack-lbaas | 15:50 | |
| rm_work | the one in there now is like ... 100% guaranteed to work every time | 15:50 |
| rm_work | and is what I run in production | 15:50 |
| johnsom | all_ports = self.neutron_client.list_ports(project=self.project_id) | 15:50 |
| johnsom | This line. It pulls basically EVERY port in our project, which could be thousands. | 15:50 |
| *** kobis has quit IRC | 15:50 | |
| rm_work | (this is ported out from my flip driver patch) | 15:50 |
| rm_work | yes | 15:50 |
| rm_work | it could be like 20k+ ports, who knows | 15:50 |
| johnsom | This is not an argument in favor..... Grin | 15:51 |
| *** kobis has joined #openstack-lbaas | 15:51 | |
| rm_work | i don't think it's actually that bad | 15:51 |
| *** jdavis has quit IRC | 15:51 | |
| rm_work | again, remember when it runs | 15:51 |
| johnsom | Right, that is my worry. Huge memory bloat/network traffic. | 15:51 |
| rm_work | do you think it would have run EVER in most of your deployments? | 15:51 |
| rm_work | this only happens when something BAD / wonky has occurred | 15:51 |
| *** yamamoto has joined #openstack-lbaas | 15:51 | |
| rm_work | normally the SG delete will just work | 15:51 |
| rm_work | because everything is happy | 15:51 |
| johnsom | Yeah, still thinking about it | 15:51 |
| rm_work | well, I can try to trim it down | 15:52 |
| rm_work | like I said, we have a pretty good idea what the possible port names are | 15:52 |
| rm_work | given that we named them | 15:52 |
| johnsom | Yeah, I just tend to lean towards "when it hits the fan, DO NO MORE HARM, and let the operator figure out WTF" | 15:52 |
| johnsom | Yeah adding the IDs makes me feel a bit better. | 15:52 |
| rm_work | k let me look at that | 15:53 |
| *** slaweq has joined #openstack-lbaas | 15:55 | |
| *** slaweq has quit IRC | 16:00 | |
| *** cristicalin has joined #openstack-lbaas | 16:00 | |
| *** kobis has quit IRC | 16:01 | |
| *** kobis has joined #openstack-lbaas | 16:01 | |
| *** kobis has quit IRC | 16:02 | |
| *** kobis has joined #openstack-lbaas | 16:02 | |
| *** kobis has quit IRC | 16:03 | |
| rm_work | johnsom: nevermind, don't have the IDs | 16:04 |
| rm_work | johnsom: it's not listener ID, it's amphora-id | 16:04 |
| rm_work | and that's exactly what we often don't have (why they are orphaned) | 16:05 |
| rm_work | would you prefer warning or error? :P I think technically it's maximum warning, because it's not *breaking*, but in fact enabling it to continue | 16:08 |
| *** kobis has joined #openstack-lbaas | 16:08 | |
| rm_work | though I admit i'm not sure if you're actually going to decide to allow it in or not, lol | 16:10 |
| *** kobis has quit IRC | 16:10 | |
| openstackgerrit | Adam Harwell proposed openstack/octavia master: When SG delete fails on vip deallocate, try harder https://review.openstack.org/549263 | 16:11 |
| *** b_bezak has quit IRC | 16:16 | |
| *** yamamoto has quit IRC | 16:17 | |
| *** AlexeyAbashkin has quit IRC | 16:19 | |
| *** yamamoto has joined #openstack-lbaas | 16:21 | |
| *** slaweq has joined #openstack-lbaas | 16:25 | |
| *** yamamoto has quit IRC | 16:26 | |
| *** yamamoto has joined #openstack-lbaas | 16:27 | |
| *** yamamoto has quit IRC | 16:35 | |
| johnsom | Moved to my room. Will take a look at the new spin. Your comment of "not sure if you will allow it in" makes me think you have reservations too | 16:35 |
| *** kobis has joined #openstack-lbaas | 16:42 | |
| *** yamamoto has joined #openstack-lbaas | 16:42 | |
| *** yamamoto has quit IRC | 16:43 | |
| xgerman_ | johnsom I think when I do privsep I will need to run the amphora-agent as a different user than root? | 16:46 |
| johnsom | Yes, or nobody | 16:47 |
| xgerman_ | but one which can do sudo so I can start privsept | 16:47 |
| xgerman_ | ok, should I create a new user? or just do nobody? | 16:47 |
| johnsom | Wait, you don't need sudo right? Doesn't privsep privledged side run as a systemd service? | 16:48 |
| xgerman_ | they seem to start it from the program? https://github.com/openstack/oslo.privsep/blob/master/oslo_privsep/priv_context.py | 16:49 |
| johnsom | https://docs.openstack.org/oslo.privsep/latest/reference/api/oslo_privsep.daemon.html | 16:51 |
| johnsom | I think we want to use the fork() method | 16:51 |
| johnsom | Then probably drop to nobody | 16:51 |
| *** yamamoto has joined #openstack-lbaas | 16:51 | |
| xgerman_ | how would I drop? | 16:53 |
| xgerman_ | ok, google: https://stackoverflow.com/questions/2699907/dropping-root-permissions-in-python | 16:54 |
| johnsom | I may be sending you down the wrong path, trying to read up | 16:55 |
| xgerman_ | yeah, neutron starts it with sudo is my impression | 16:55 |
| johnsom | Hmm | 16:55 |
| xgerman_ | and then use rootwrap to protect starting privsep | 16:56 |
| johnsom | Well, that might just be a migration thing | 16:57 |
| johnsom | migtrating from rootwrap to privsep | 16:58 |
| xgerman_ | https://github.com/openstack/neutron/blob/master/etc/neutron/rootwrap.d/privsep.filters | 16:59 |
| xgerman_ | but really no idea | 16:59 |
| *** harlowja has joined #openstack-lbaas | 17:00 | |
| xgerman_ | nova is doing the same | 17:01 |
| johnsom | Have you seen this: https://specs.openstack.org/openstack/oslo-specs/specs/liberty/privsep.html | 17:01 |
| johnsom | It seems like this would be the easiest for our current code: | 17:03 |
| johnsom | https://www.irccloud.com/pastebin/kVSZemIN/ | 17:03 |
| johnsom | Which is the fork method | 17:03 |
| xgerman_ | ok, so we fork and then drop priviliges | 17:03 |
| johnsom | Yeah, I think the privsep does the fork itself, but not sure | 17:04 |
| xgerman_ | privsep will fork | 17:04 |
| *** b_bezak has joined #openstack-lbaas | 17:04 | |
| xgerman_ | https://github.com/openstack/oslo.privsep/blob/master/oslo_privsep/priv_context.py#L219 | 17:05 |
| johnsom | Yep | 17:05 |
| *** prometheanfire has joined #openstack-lbaas | 17:07 | |
| xgerman_ | https://github.com/openstack/oslo.privsep/blob/master/oslo_privsep/priv_context.py#L219 | 17:07 |
| xgerman_ | I think they ehalpfully provide those methods | 17:08 |
| *** b_bezak has quit IRC | 17:08 | |
| prometheanfire | https://bugs.gentoo.org/649362 for the musl stage building | 17:11 |
| johnsom | This implies it's pretty straight forward: https://github.com/openstack/oslo.privsep/blob/master/oslo_privsep/tests/fixture.py | 17:11 |
| johnsom | rm_work Can't we filter a list ports by the SG? | 17:14 |
| rm_work | not that i can tell | 17:15 |
| rm_work | i think it's because it's a list | 17:15 |
| rm_work | if you figure it out, A++ | 17:15 |
| rm_work | i think I asked around before | 17:15 |
| johnsom | Yeah, back to our filter discussion earlier | 17:15 |
| openstackgerrit | German Eichberger proposed openstack/octavia master: [WIP] Switch amphora agent to use privsep https://review.openstack.org/549295 | 17:36 |
| openstackgerrit | Adam Harwell proposed openstack/octavia master: WIP: Add full_config parameter to LB GET https://review.openstack.org/549297 | 17:40 |
| rm_work | johnsom: ^^ so i got an itch to deal with that really fast | 17:41 |
| rm_work | it's almost there | 17:41 |
| *** AlexeyAbashkin has joined #openstack-lbaas | 17:42 | |
| johnsom | Nice | 17:42 |
| *** jdavis has joined #openstack-lbaas | 17:44 | |
| *** AlexeyAbashkin has quit IRC | 17:46 | |
| *** fnaval has joined #openstack-lbaas | 17:51 | |
| *** AlexeyAbashkin has joined #openstack-lbaas | 17:58 | |
| *** AlexeyAbashkin has quit IRC | 18:03 | |
| *** kobis has quit IRC | 18:25 | |
| *** kobis has joined #openstack-lbaas | 18:25 | |
| *** kobis has quit IRC | 18:25 | |
| *** kobis has joined #openstack-lbaas | 18:26 | |
| *** kobis has quit IRC | 18:26 | |
| *** kobis has joined #openstack-lbaas | 18:26 | |
| *** kobis has quit IRC | 18:27 | |
| *** kobis has joined #openstack-lbaas | 18:27 | |
| *** kobis has quit IRC | 18:28 | |
| *** kobis has joined #openstack-lbaas | 18:28 | |
| *** kobis has quit IRC | 18:29 | |
| *** harlowja has quit IRC | 18:30 | |
| *** cristicalin has quit IRC | 18:47 | |
| *** cristicalin has joined #openstack-lbaas | 18:48 | |
| *** dims has quit IRC | 18:51 | |
| *** beagles is now known as beagles|brb | 18:55 | |
| *** dims has joined #openstack-lbaas | 19:01 | |
| *** harlowja has joined #openstack-lbaas | 19:09 | |
| *** gcheresh has joined #openstack-lbaas | 19:09 | |
| *** jdavis has quit IRC | 19:14 | |
| *** salmankhan has quit IRC | 19:15 | |
| *** salmankhan has joined #openstack-lbaas | 19:17 | |
| *** salmankhan has quit IRC | 19:21 | |
| *** beagles|brb is now known as beagesl | 19:30 | |
| *** beagesl is now known as beagles | 19:30 | |
| *** imacdonn has quit IRC | 19:41 | |
| *** imacdonn has joined #openstack-lbaas | 19:42 | |
| *** fnaval has quit IRC | 20:25 | |
| *** fnaval has joined #openstack-lbaas | 20:31 | |
| *** AlexeyAbashkin has joined #openstack-lbaas | 20:58 | |
| *** AlexeyAbashkin has quit IRC | 21:02 | |
| *** atoth has quit IRC | 21:17 | |
| *** jdavis has joined #openstack-lbaas | 21:19 | |
| *** jdavis has quit IRC | 21:23 | |
| *** jdavis has joined #openstack-lbaas | 21:24 | |
| *** jdavis has quit IRC | 21:29 | |
| *** kbyrne has quit IRC | 21:39 | |
| *** gcheresh has quit IRC | 21:47 | |
| *** kbyrne has joined #openstack-lbaas | 21:53 | |
| *** jdavis has joined #openstack-lbaas | 21:57 | |
| *** jdavis_ has joined #openstack-lbaas | 22:01 | |
| *** jdavis has quit IRC | 22:01 | |
| *** pcaruana has quit IRC | 22:08 | |
| *** dims has quit IRC | 22:17 | |
| *** salmankhan has joined #openstack-lbaas | 22:18 | |
| *** salmankhan has quit IRC | 22:22 | |
| *** kbyrne has quit IRC | 22:55 | |
| *** jdavis_ has quit IRC | 22:58 | |
| *** kbyrne has joined #openstack-lbaas | 23:02 | |
| *** fnaval has quit IRC | 23:48 | |
| *** fnaval has joined #openstack-lbaas | 23:57 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!