Thursday, 2018-03-08

« Wednesday, 2018-03-07 Index Friday, 2018-03-09 »
rm_workso this is just dumb00:00
rm_workwe can't get a clean run because random useless unrelated shit keeps happening00:00
rm_workwhat happened to the py3x one...00:00
rm_workah yeah the other thing00:00
rm_workok one sec, f this00:00
openstackgerritAdam Harwell proposed openstack/neutron-lbaas master: Switch to stestr and wait for LB delete on cleanup  https://review.openstack.org/55028200:03
cgoncalveslol00:03
rm_workliterally nothing i can do about the statusline bug00:04
rm_workthe gates are just taunting us00:04
rm_workI really want an override, like "f#$% this, i know this works, these gates are bulls#%@, merge this"00:05
cgoncalvesthe sleep fine for me. it's tests code and at cleanup00:06
rm_worktime.sleep() in tests is ridiculously dumb but i don't feel like we have a choice00:06
rm_workanything that relies on hoping timing works out is a really fragile test00:07
rm_workand normally should be rewritten to not rely on timing00:07
rm_workbut this is stuff that's async, and kind of out of our control, and we have no way to check with certainty00:08
cgoncalvesah, plus this is neutron-lbaas so....00:08
rm_workyes00:08
rm_workit can be hacky, we're lighting it on fire soon anyway00:08
openstackgerritCarlos Goncalves proposed openstack/octavia master: [DNM] Add experimental ovsfw-scenario job  https://review.openstack.org/55043100:37
*** AlexeyAbashkin has joined #openstack-lbaas00:45
rm_workcgoncalves: did you get an email after the PTG about a code for the vancouver summit?00:46
*** AlexeyAbashkin has quit IRC00:50
cgoncalvesrm_work: I did00:51
cgoncalvesLB operating_status=ONLINE && provisioning_status=PENDING_CREATE00:53
cgoncalvesis it correct to setting operating_status=ONLINE while privisioning is still PENDING_CREATE?00:54
openstackgerritCarlos Goncalves proposed openstack/octavia master: [WIP] Add grenade support  https://review.openstack.org/54965400:57
cgoncalveshttp://logs.openstack.org/82/550282/7/check/neutron-lbaasv2-dsvm-api-namespace/ed15e24/job-output.txt.gz#_2018-03-08_00_54_01_54170601:04
cgoncalvesblank string issue again01:04
*** jniesz has quit IRC01:14
*** annp has joined #openstack-lbaas01:51
rm_workcgoncalves: what was the subject line of that email01:52
rm_workummm, not sure about the pending_create vs online thing01:53
rm_workit depends on what you're looking at01:53
rm_workif it's a test it might be fine01:53
rm_workpending* are transient states and we really shouldn't be looking for them in anything besides unit tests anyway01:53
rm_workand for the blank project_id... WHAT THE F01:56
*** imacdonn has quit IRC02:03
*** imacdonn has joined #openstack-lbaas02:03
rm_workI'm about to throw an @skip on that test02:06
rm_workand call it done02:06
*** AlexeyAbashkin has joined #openstack-lbaas02:45
*** harlowja has quit IRC02:49
*** AlexeyAbashkin has quit IRC02:49
openstackgerritAdam Harwell proposed openstack/neutron-lbaas master: Switch to stestr and wait for LB delete on cleanup  https://review.openstack.org/55028203:32
rm_workcgoncalves: yeah, screw it, added a skip for now on that test as it isn't making any sense03:33
*** harlowja has joined #openstack-lbaas04:37
*** jappleii__ has joined #openstack-lbaas04:42
*** jappleii__ has quit IRC04:43
*** threestrands_ has quit IRC04:44
rm_workso, now we should be good to go with that patch, if others agree with me about skipping it for now04:48
*** links has joined #openstack-lbaas04:59
*** links has quit IRC04:59
*** threestrands has joined #openstack-lbaas05:00
*** threestrands has quit IRC05:00
*** threestrands has joined #openstack-lbaas05:00
*** links has joined #openstack-lbaas05:16
*** threestrands has quit IRC05:25
*** kobis has joined #openstack-lbaas05:33
*** kobis has quit IRC05:36
*** kobis has joined #openstack-lbaas05:38
*** kobis has quit IRC05:39
*** pcaruana has joined #openstack-lbaas05:57
*** harlowja has quit IRC06:05
*** pcaruana has quit IRC06:08
*** atoth has quit IRC06:20
*** atoth has joined #openstack-lbaas06:22
*** dims has quit IRC06:24
*** dims has joined #openstack-lbaas06:30
openstackgerritHengqing Hu proposed openstack/octavia-dashboard master: Replace noop tests with registration test  https://review.openstack.org/55072106:51
*** rcernin has quit IRC07:22
*** kobis has joined #openstack-lbaas07:26
*** atoth has quit IRC07:27
openstackgerritOpenStack Proposal Bot proposed openstack/octavia-dashboard master: Imported Translations from Zanata  https://review.openstack.org/55037107:29
*** jaff_cheng has joined #openstack-lbaas07:35
*** jaff_cheng has left #openstack-lbaas07:36
*** AlexeyAbashkin has joined #openstack-lbaas07:45
*** KeithMnemonic has joined #openstack-lbaas07:49
*** AlexeyAbashkin has quit IRC07:49
*** pcaruana has joined #openstack-lbaas08:04
*** b_bezak has joined #openstack-lbaas08:11
*** yamamoto has quit IRC08:33
*** tesseract has joined #openstack-lbaas08:36
*** yamamoto has joined #openstack-lbaas08:42
*** pcaruana has quit IRC08:43
*** tesseract has quit IRC08:43
*** kberger has joined #openstack-lbaas08:47
*** kberger has quit IRC08:48
*** KeithMnemonic has quit IRC08:49
*** yamamoto has quit IRC08:50
*** pcaruana has joined #openstack-lbaas08:52
*** tesseract has joined #openstack-lbaas08:52
*** yamamoto has joined #openstack-lbaas08:57
*** yamamoto has quit IRC08:58
*** yamamoto has joined #openstack-lbaas09:00
*** pcaruana has quit IRC09:02
*** tesseract has quit IRC09:02
*** bonky has left #openstack-lbaas09:03
*** bonky has joined #openstack-lbaas09:04
*** yamamoto has quit IRC09:05
cgoncalvesrm_work: "Your Vancouver Summit Code: OpenStack PTG"09:06
cgoncalvesfrom summit@openstack.org09:06
bonkyrm_work: I've made some progress, pretty far, but not reached a successful deploy yet though :P09:07
bonkythe errors I get now are,09:07
bonky2018-03-08 08:58:20.082 19 DEBUG octavia.amphorae.drivers.haproxy.rest_api_driver [-] request url plug/vip/10.10.10.100 request /usr/lib/python2.7/site-packages/octavia/amphorae/drivers/haproxy/rest_api_driver.py:25409:08
bonky2018-03-08 08:58:20.082 19 DEBUG octavia.amphorae.drivers.haproxy.rest_api_driver [-] request url https://10.40.6.15:9443/0.5/plug/vip/10.10.10.100 request /usr/lib/python2.7/site-packages/octavia/amphorae/drivers/haproxy/rest_api_driver.py:25709:08
bonky2018-03-08 08:58:20.084 19 WARNING octavia.amphorae.drivers.haproxy.rest_api_driver [-] Could not connect to instance. Retrying.: SSLError: [Errno 2] No such file or directory <- the error09:08
bonkyIt's not really specific about what files its missing so its a bit hard to debug09:08
bonkyso the amphorae gets depoyed correcttly, and the endpoint on the vm is reachable, but something is off09:10
*** pcaruana has joined #openstack-lbaas09:15
*** yamamoto has joined #openstack-lbaas09:15
*** tesseract has joined #openstack-lbaas09:16
bonkyhm alot of certificates that is needed to get this working09:16
*** yamamoto has quit IRC09:20
nmagnezi_cgoncalves, rm_work, I just W+1 https://review.openstack.org/#/c/55028209:29
nmagnezi_cgoncalves, rm_work, but we should get to the bottom of this eventually..09:30
*** yamamoto has joined #openstack-lbaas09:30
*** tesseract has quit IRC09:32
*** pcaruana has quit IRC09:32
cgoncalvesnmagnezi_: agreed09:33
*** yamamoto has quit IRC09:35
*** yamamoto has joined #openstack-lbaas09:45
*** pcaruana has joined #openstack-lbaas09:45
*** tesseract has joined #openstack-lbaas09:46
*** yamamoto has quit IRC09:50
*** yamamoto has joined #openstack-lbaas10:00
*** yamamoto has quit IRC10:05
*** dmellado has quit IRC10:08
*** dmellado has joined #openstack-lbaas10:13
*** annp has quit IRC10:13
*** yamamoto has joined #openstack-lbaas10:15
*** salmankhan has joined #openstack-lbaas10:16
openstackgerritCarlos Goncalves proposed openstack/octavia master: [WIP] Add grenade support  https://review.openstack.org/54965410:17
*** yamamoto has quit IRC10:20
*** yamamoto has joined #openstack-lbaas10:23
*** yamamoto has quit IRC10:23
*** yamamoto has joined #openstack-lbaas10:30
openstackgerritMerged openstack/neutron-lbaas master: Switch to stestr and wait for LB delete on cleanup  https://review.openstack.org/55028210:35
cgoncalvesnmagnezi_: ^ has been merged. CI is not gating https://review.openstack.org/#/c/550134/10:51
cgoncalvesdo we need to recheck or cores to press the "Submit" button?10:51
nmagnezi_cgoncalves, there is not submit button, but I tried to recheck plus additional W+111:07
cgoncalvesnmagnezi_: k, thanks11:08
cgoncalves(FWIW in other gerrits I've used, there was a submit button)11:08
nmagnezi_cgoncalves, it's permission based :)11:09
cgoncalves3x +2 and 2x +W \o/11:09
nmagnezi_yeah. lol11:09
openstackgerritCarlos Goncalves proposed openstack/octavia master: [WIP] Add grenade support  https://review.openstack.org/54965411:20
openstackgerritwangqi proposed openstack/octavia-tempest-plugin master: Update links in README  https://review.openstack.org/55078911:33
nmagnezi_we should really start a policy of auto -2 for those "Update links" patches ^^ .. :-|11:34
*** salmankhan has quit IRC11:39
*** salmankhan has joined #openstack-lbaas11:39
*** salmankhan has quit IRC11:59
*** salmankhan has joined #openstack-lbaas12:07
*** salmankhan has quit IRC12:20
openstackgerritCarlos Goncalves proposed openstack/octavia master: [WIP] Add grenade support  https://review.openstack.org/54965412:22
openstackgerritMerged openstack/octavia master: Migrate to stestr  https://review.openstack.org/55013412:30
*** yamamoto has quit IRC12:32
nmagnezi_cgoncalves, merged ^12:35
openstackgerritNir Magnezi proposed openstack/neutron-lbaas master: [DNM]: Test CI  https://review.openstack.org/55008512:35
*** yamamoto has joined #openstack-lbaas12:38
*** salmankhan has joined #openstack-lbaas12:47
*** salmankhan has quit IRC13:14
*** salmankhan has joined #openstack-lbaas13:17
cgoncalvesnmagnezi_: thanks!13:28
openstackgerritCarlos Goncalves proposed openstack/octavia master: [WIP] Add grenade support  https://review.openstack.org/54965413:39
*** salmankhan has quit IRC13:48
*** links has quit IRC13:51
*** salmankhan has joined #openstack-lbaas13:56
*** fnaval has joined #openstack-lbaas14:27
*** beagles is now known as beagles|brb14:40
cgoncalvesdamn you octavia, you and your immutable resource fellas :/14:46
openstackgerritCarlos Goncalves proposed openstack/octavia master: [WIP] Add grenade support  https://review.openstack.org/54965414:47
*** Swami has joined #openstack-lbaas14:49
openstackgerritHengqing Hu proposed openstack/octavia master: Bring up lo when plugging interfaces  https://review.openstack.org/55086115:07
*** beagles|brb is now known as beagles15:12
*** yamamoto has quit IRC15:14
*** yamamoto has joined #openstack-lbaas15:16
*** yamamoto has quit IRC15:21
*** b_bezak has quit IRC15:29
*** yamamoto has joined #openstack-lbaas15:29
openstackgerritHengqing Hu proposed openstack/octavia master: ACTIVE-ACTIVE: Initial distributor data model  https://review.openstack.org/52885015:32
openstackgerritHengqing Hu proposed openstack/octavia master: L3 ACTIVE-ACTIVE data model  https://review.openstack.org/52472215:32
openstackgerritHengqing Hu proposed openstack/octavia master: Make frontend interface attrs less vrrp specific  https://review.openstack.org/52113815:32
openstackgerritHengqing Hu proposed openstack/octavia master: Able to set frontend network for loadbalancer  https://review.openstack.org/52993615:32
openstackgerritHengqing Hu proposed openstack/octavia master: Provide devstack samples for l3 active active  https://review.openstack.org/52087815:33
*** yamamoto has quit IRC15:34
openstackgerritCarlos Goncalves proposed openstack/octavia master: [WIP] Add grenade support  https://review.openstack.org/54965415:36
*** kobis has quit IRC15:37
*** yamamoto has joined #openstack-lbaas15:38
*** yamamoto has quit IRC15:38
bonkyHi again, ok this makes me crazy. No matter what I have under [haproxy_amphora] client_cert, server_ca I cant get the octavia.amphorae.drivers.haproxy.rest_api_driver to connect to the instance.16:05
bonkyCould not connect to instance. Retrying.: SSLError: [SSL] PEM lib (_ssl.c:2535)16:05
bonky^^ thats what I get16:05
*** pcaruana has quit IRC16:06
bonkyI really dont understand what to put there since nothing I try work16:07
xgerman_bonky: ok, you can check manually what is going on. Look at p 13 in https://docs.google.com/presentation/d/1p8ekZ99E30XR6w1hkPufTQJKCwkX9tRctnCIWVlx4Zw/edit#slide=id.p2616:14
xgerman_try to curl the amphora with -kv that should give you an idea about the certs16:14
xgerman_on the control plane side you need a client cert and it will check the server cert (from the amphora) against the CA in /etc/octavia/certs16:16
xgerman_for devstack I think we use the same CA for client/server certs…16:16
xgerman_cgoncalves: this is done - https://review.openstack.org/#/c/549259/2116:29
nmagnezi_xgerman_, maybe worth to rebase ^16:37
xgerman_ok16:38
*** yamamoto has joined #openstack-lbaas16:38
openstackgerritGerman Eichberger proposed openstack/octavia master: Periodic job to build + publish diskimage  https://review.openstack.org/54925916:38
openstackgerritCarlos Goncalves proposed openstack/octavia master: [WIP] Add grenade support  https://review.openstack.org/54965416:42
cgoncalvesxgerman_: out of curiosity, why 'test-images' and not 'images'? other projects that publish images use 'images/'16:43
xgerman_we want people to build their own images and not rely on us for timely security updates to the OS16:44
cgoncalvesxgerman_: also, why prefixing image filename with 'test-only-'16:45
*** yamamoto has quit IRC16:45
cgoncalveshmmm16:45
xgerman_to avoid people running them in production16:45
xgerman_;-)16:45
xgerman_also our main purpose for the images is to speed up kuryr and osa testing16:46
*** salmankhan has quit IRC16:46
cgoncalveswell, that will not prevent them, only (hopefully) warn16:47
xgerman_yep16:47
xgerman_out of our hands16:47
cgoncalvesokay, I would not block because of this naming detail16:47
xgerman_yeah, let’s see what johnsom/rm_work think ;-)16:48
nmagnezi_I'm okay with "test-images".16:49
cgoncalvesxgerman_: you've not checked the centos job though16:49
xgerman_I assume it works16:49
nmagnezi_each operator can use that as a base and add his own stuff16:49
cgoncalvesmy concern is that it might fail due to package names differing from ubuntu16:49
xgerman_ah. no, we will build the centos image on Ubuntu16:50
cgoncalvesIIRC there's somewhere a conditional on rhel-based to install qemu with a different package name16:50
cgoncalvesaaah right right16:50
cgoncalvesstill, I'd like first to see it verifying for the centos job ;)16:50
*** salmankhan has joined #openstack-lbaas16:51
cgoncalvesxgerman_: one other improvement could be suffixing filename with branch name. I know it's master and only master (at least for the time being)16:51
xgerman_yeah, that would be good once we “btranch” out16:53
bonkyxgerman_: thanks!16:53
bonkyFINALLY, I created a lb and its state got ACTIVE16:53
bonky:D16:54
bonkyOnly took me four days :P16:54
xgerman_<happy dance>16:54
cgoncalvesbonky: you want to see operating_status==ONLINE and then double-check :P16:54
*** harlowja has joined #openstack-lbaas16:54
xgerman_Please submit a patch to our docs to make sure  others have an easier time16:54
bonkyxgerman, oh there is much to wish regarding docs here I have to say. But also, I'm the "trial / error" kind of guy, which sometimes makes my life miserable, hehe16:55
bonkycgoncalves: operating_status : ONLINE16:55
cgoncalvesgreat!16:58
*** kobis has joined #openstack-lbaas17:12
*** kobis has quit IRC17:26
*** ivve has joined #openstack-lbaas17:31
*** Swami has quit IRC17:36
*** yamamoto has joined #openstack-lbaas17:40
*** yamamoto has quit IRC17:46
*** ivve has quit IRC17:55
*** SumitNaiksatam has joined #openstack-lbaas18:13
rm_workcgoncalves: which things are immutable? you mean, LB between updates? or, some of the fields on things like HM or Listener?18:19
cgoncalvesrm_work: users can't e.g. create members if pool is not yet online18:22
rm_workright18:22
rm_worksingle-create may help18:23
rm_workas we move that up the chain18:23
cgoncalvesright18:23
openstackgerritGerman Eichberger proposed openstack/octavia master: [WIP] Switch amphora agent to use privsep  https://review.openstack.org/54929518:23
cgoncalveshave you guys considered queueing CRUD operations?18:24
rm_workyeah i talked to someone else at the PTG about that18:24
cgoncalvesif pool in PENDING_CREATE and POST member, add member create to queue18:24
rm_workit's something we talked about originally and opted to do this for simplicity so we could get stuff going18:25
rm_workthere are some drawbacks18:25
rm_workbut i think we could do it in a way that's sane18:25
rm_workand i would like to re-investigate it later18:25
rm_workmaybe we could fit it in this cycle if we have a lot of time <_< but more likely next18:25
cgoncalvesk. because for now users have to poll status before continuing18:25
rm_workyes18:25
cgoncalvesincluding me in grenade18:26
rm_workwhich is how most of the rest of openstack works18:26
cgoncalvesor... create <resource> --wait18:26
*** harlowja has quit IRC18:26
rm_workyeah i think having that in the client would be fantastic18:26
rm_worki might look at doing that18:26
rm_workwhen i have time, which is ... not now18:26
cgoncalvesclient would poll behind the scenes?18:27
rm_workwasted way too much time this week on the gate stuff18:27
rm_workyeah there's --poll for nova at least18:27
cgoncalveshmmm right. not ideal but would suffice18:27
rm_workoh actually yeah it's --wait in this client18:27
rm_workit was --poll in the old one18:27
rm_workyeah if you have a free minute you could look at how nova did that, and either steal their method or rewrite it18:28
rm_workelsewise that sounds like the kind of thing i would enjoy hammering out, maybe in the next few weeks18:28
xgerman_or write a spec for a v3 API where we can queue :-)18:29
rm_worklol yeah so18:29
rm_workthat was the biggest thing18:29
rm_worki think we may just need to do queueing as part of V3 along with a number of other cleanups and optimizations18:29
cgoncalvesor queue that queue thing until we have microversions :P18:30
rm_workand we have to be really careful about moving on too soon from v218:30
xgerman_yep18:30
rm_workeh, the amount of change that would be to introduce queueing kinda feels like a v3 to me18:30
rm_workand there is a whole laundry list of stuff i'd like to fix in our API as well18:30
cgoncalvesi'm okay with not having it. just wanted to check if my thought was valid18:31
rm_workbut we can talk about it18:31
xgerman_+118:31
cgoncalvesrm_work: FYI octavia rdo-queens and rdo-master packages require jinja 2.10 now18:32
rm_workk18:32
rm_workdid we get a requirements bump yet locally?18:33
rm_workah i see it18:33
cgoncalvesyeah but again we can't backport it :(18:34
rm_work:(18:35
rm_workyeah that's unfortunate18:36
rm_workhow goes the grenade?18:36
cgoncalvesexplosive :)18:36
rm_worki see that18:37
cgoncalvesI need to fix some CLI commands. not blocked18:38
rm_workk18:38
openstackgerritCarlos Goncalves proposed openstack/octavia master: [WIP] Add grenade support  https://review.openstack.org/54965418:39
*** yamamoto has joined #openstack-lbaas18:42
*** yamamoto has quit IRC18:48
*** tesseract has quit IRC18:49
*** harlowja has joined #openstack-lbaas19:11
*** SumitNaiksatam has quit IRC19:11
*** Swami has joined #openstack-lbaas19:13
*** harlowja has quit IRC19:18
*** harlowja has joined #openstack-lbaas19:33
*** gcheresh_ has joined #openstack-lbaas19:42
*** salmankhan has quit IRC19:42
openstackgerritCarlos Goncalves proposed openstack/octavia master: [WIP] Add grenade support  https://review.openstack.org/54965419:44
*** yamamoto has joined #openstack-lbaas19:44
*** yamamoto has quit IRC19:50
openstackgerritAdam Harwell proposed openstack/octavia master: WIP: Floating IP Network Driver (spans L3s)  https://review.openstack.org/43561219:51
openstackgerritAdam Harwell proposed openstack/octavia master: DNM: Remove PING type from HM options list  https://review.openstack.org/52843919:51
xgerman_mmh19:57
xgerman_fun times19:57
xgerman_https://www.irccloud.com/pastebin/GnWaKxMD/19:58
*** gcheresh_ has quit IRC19:59
rm_workerr20:02
rm_workyeah the assert message is also really oddly worded :P20:02
xgerman_indeed, I also don’t like it when multi-process things don’t log the process-id20:04
xgerman_rm_work: is harlowja part of that privsep gang?20:04
rm_worknot sure ;)20:04
*** gcheresh_ has joined #openstack-lbaas20:12
harlowjanot really; though i do sorta know how it works20:24
xgerman_harlowja: somehow I am doing something wrong - I am calling a wrapped method in line 86 in https://review.openstack.org/#/c/549295/7/octavia/amphorae/backends/agent/api_server/plug.py20:29
xgerman_and then it bombs with the printout20:29
harlowjathe printout!20:30
harlowjawhat's the printout, ha20:30
harlowjaye olde printout20:30
xgerman_https://www.irccloud.com/pastebin/GnWaKxMD/20:30
*** beagles is now known as beagles|biab20:34
harlowjaya, its almost like it got 2 replies20:36
xgerman_yeah, very confused…20:36
harlowjawhat version of msgpack-python u have installed20:40
harlowjathinking maybe that lib had a bug where https://github.com/openstack/oslo.privsep/blob/master/oslo_privsep/comm.py#L75 wouldn't flush or something20:40
harlowja(had or has, ha)20:40
harlowjaand it did just release recentlyish20:41
xgerman_msgpack (0.5.6)20:42
harlowjacan u try 0.5.320:42
* harlowja looking at https://github.com/msgpack/msgpack-python/commits/master 20:42
xgerman_sure20:42
xgerman_I have to respin a devstack though20:43
harlowjaor just 0.520:43
xgerman_so will be some time20:43
harlowjak20:43
harlowjathere has been a bunch of buffer crap in that changelog20:43
harlowjaso thinking maybe one fucked it up20:43
*** yamamoto has joined #openstack-lbaas20:46
openstackgerritGerman Eichberger proposed openstack/octavia master: [WIP] Switch amphora agent to use privsep  https://review.openstack.org/54929520:46
xgerman_k, in 20 minutes we will know more ;-)20:48
harlowjaokie dokie20:49
harlowja`Fix fallback.Unpacker.feed() dropped unused data from buffer (#287)` is one recent fix20:49
harlowjamaybe that didn't fix it, lol20:49
harlowjaand feed is used for this stuff in privsep20:51
harlowja(or maybe that fix isn't released, hard to tell20:51
*** yamamoto has quit IRC20:51
openstackgerritAdam Harwell proposed openstack/octavia master: Fix kvm-centos.7 gate  https://review.openstack.org/55048720:55
*** sshank has joined #openstack-lbaas21:15
*** sshank has quit IRC21:35
xgerman_ok, so I changed our rwquirements to downgrade msgpack and it ignored me…21:40
xgerman_meeting time…21:40
*** threestrands has joined #openstack-lbaas21:47
*** yamamoto has joined #openstack-lbaas21:47
*** gcheresh_ has quit IRC21:51
*** yamamoto has quit IRC21:53
*** yamamoto has joined #openstack-lbaas21:53
openstackgerritCarlos Goncalves proposed openstack/octavia master: Prevent awk matching itself when stopping Octavia  https://review.openstack.org/55102122:02
openstackgerritCarlos Goncalves proposed openstack/octavia master: [WIP] Add grenade support  https://review.openstack.org/54965422:03
*** rcernin has joined #openstack-lbaas22:25
imacdonnrm_work: around ?22:31
rm_workyeah22:34
*** rcernin_ has joined #openstack-lbaas22:34
imacdonnwanted to discuss the secret access thing with you a bit more ... not urgent if you're busy22:35
rm_workcan in a moment22:35
imacdonnok22:35
rm_workgo ahead and start talking22:35
imacdonn:)22:35
rm_worki'll be able to read it soon22:35
imacdonnunderstood22:35
*** rcernin_ has quit IRC22:35
imacdonnlooking at https://review.openstack.org/#/c/550303/1..3/octavia/certificates/manager/barbican_legacy.py22:35
imacdonnand wondering if that covers all use-cases22:36
*** rcernin_ has joined #openstack-lbaas22:36
*** rcernin has quit IRC22:36
imacdonnwhen I was trying to get started with all of this (within the last couple of weeks), I was quite confused by a number of things, mostly due to docs that may be out of date (???)22:36
rm_workthat's the only things in the container object22:36
imacdonnone of the things was how to put certs in barbican22:36
imacdonnthere are docs which suggest making a PKCS#12, stuffing that into a barbican secret, then referencing that as a container for the listener22:37
imacdonnI couldn't get that to work22:37
imacdonneventually figured out how to do it the barbican way, and octavia seemed to like it OK22:37
*** rcernin_ has quit IRC22:37
imacdonnif I'm doing it the only right way now (i.e. create cert, key, intermediates, and maybe key passwd), plus a container with all of those22:38
imacdonnthe docs need to be updated22:38
imacdonnotherwise, I'm not sure if the fix will work for the PKCS#12 case22:38
imacdonnexample doc: https://docs.openstack.org/octavia/latest/user/guides/basic-cookbook.html - look under "Deploy a TLS-terminated HTTPS load balancer"22:39
rm_workthe pkcs12 thing is the "new" way22:39
rm_workit should work22:39
rm_workif it doesn't, i'm curious why not22:39
rm_workit worked in my testing and i believe johnsom also ran through tests for it22:39
imacdonnIIRC, the error I got was that the container had an invalid type of <blank>22:39
imacdonnsomething to that effect22:39
rm_workhmmm22:40
*** rcernin has joined #openstack-lbaas22:40
rm_workwell, i'm probably the right person to talk to, as i wrote all of the cert stuff22:40
rm_workbut i'd need to see more22:40
imacdonnheh22:40
imacdonnso... if you do this (per the doc):22:40
imacdonnopenssl pkcs12 -export -inkey server.key -in server.crt -certfile ca-chain.crt -passout pass: -out server.p1222:40
imacdonnopenstack secret store --name='tls_secret1' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server.p12)"22:40
imacdonn...22:40
imacdonnopenstack loadbalancer listener create --protocol-port 443 --protocol TERMINATED_HTTPS --name listener1 --default-tls-container=$(openstack secret list | awk '/ tls_secret1 / {print $2}' lb122:40
imacdonnyou're telling it to use a secret, not a *container*... as the... container22:41
imacdonnI don't see how that could work22:41
rm_workit's fine22:46
rm_workit works22:46
rm_workbecause it first goes through the barbican NEW driver22:47
rm_workwhich tries to use it as a secret22:47
rm_workwhen that FAILS, it tries barbican legacy22:47
imacdonnhmm, ok... I guess I'll have to try that way again22:47
rm_workhttps://github.com/openstack/octavia/blob/master/octavia/certificates/manager/barbican.py#L112-L12422:48
rm_worki still need to make the change to the driver to automatically use the end-user's token and register the ACLs on the initial setup22:49
rm_workso we don't have to make the user figure that shit out (it's ... dumb)22:50
imacdonnyeah, that'd be nice to not have to deal with22:50
imacdonnopenssl pkcs12 -export -inkey server.key -in server.crt -certfile ca-chain.crt -passout pass: -out server.p1223:21
imacdonnwhat is "pass:" supposed to be here ?23:21
*** yamamoto_ has joined #openstack-lbaas23:24
*** yamamoto has quit IRC23:27
imacdonnoh, never mind .. blank23:28
*** threestrands_ has joined #openstack-lbaas23:33
*** threestrands_ has quit IRC23:33
*** threestrands_ has joined #openstack-lbaas23:33
*** rcernin has quit IRC23:35
*** rcernin has joined #openstack-lbaas23:35
*** threestrands has quit IRC23:36
*** yamamoto has joined #openstack-lbaas23:38
*** yamamoto_ has quit IRC23:41
*** fnaval has quit IRC23:53
imacdonndifferent error this time :/23:55
imacdonn2018-03-08 23:45:46.453 24634 ERROR octavia.controller.worker.controller_worker   File "/usr/lib/python2.7/site-packages/octavia/certificates/common/pkcs12.py", line 35, in get_certificate23:55
imacdonn2018-03-08 23:45:46.453 24634 ERROR octavia.controller.worker.controller_worker     return self.certificate.to_cryptography().public_bytes(23:55
imacdonn2018-03-08 23:45:46.453 24634 ERROR octavia.controller.worker.controller_worker AttributeError: 'X509' object has no attribute 'to_cryptography'23:55
imacdonnmust've made the p12 wrong (?)23:55
imacdonn[imacdonn@home ~]$ openstack loadbalancer listener delete b1fe844e-076a-4948-9c35-a7239c0681f623:57
imacdonnLoad Balancer 8c99d487-d50f-462f-8312-f95fca8bbd20 is immutable and cannot be updated. (HTTP 409) (Request-ID: req-5eae3ba6-5dec-4c48-8d0a-112a364f8998)23:57
imacdonnw00t23:57
« Wednesday, 2018-03-07 Index Friday, 2018-03-09 »

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!