| openstackgerrit | Adam Harwell proposed openstack/octavia master: DNM: three dumb downstream things to fix, IGNORE https://review.openstack.org/593986 | 00:37 |
|---|---|---|
| *** harlowja has quit IRC | 01:06 | |
| *** abaindur has joined #openstack-lbaas | 01:28 | |
| *** abaindur has quit IRC | 01:30 | |
| *** abaindur has joined #openstack-lbaas | 01:31 | |
| openstackgerrit | Adam Harwell proposed openstack/octavia master: DNM: three dumb downstream things to fix, IGNORE https://review.openstack.org/593986 | 01:38 |
| *** abaindur has quit IRC | 01:48 | |
| *** hongbin has joined #openstack-lbaas | 01:57 | |
| openstackgerrit | Michael Johnson proposed openstack/octavia master: Fix the amphora noop driver https://review.openstack.org/595390 | 02:05 |
| openstackgerrit | Michael Johnson proposed openstack/octavia-tempest-plugin master: Fix tests to honor Octavia API versioning https://review.openstack.org/594786 | 02:18 |
| *** jiteka has quit IRC | 02:29 | |
| *** ctracey has quit IRC | 02:29 | |
| *** hongbin_ has joined #openstack-lbaas | 03:21 | |
| *** hongbin has quit IRC | 03:24 | |
| *** abaindur has joined #openstack-lbaas | 03:49 | |
| *** abaindur has quit IRC | 03:53 | |
| *** KeithMnemonic has quit IRC | 04:27 | |
| *** yboaron_ has joined #openstack-lbaas | 04:43 | |
| *** ramishra has joined #openstack-lbaas | 04:44 | |
| *** abaindur has joined #openstack-lbaas | 04:51 | |
| *** abaindur has quit IRC | 04:56 | |
| *** hongbin_ has quit IRC | 05:19 | |
| *** dmellado has joined #openstack-lbaas | 05:27 | |
| *** dolly has quit IRC | 06:14 | |
| *** abaindur has joined #openstack-lbaas | 06:33 | |
| *** pcaruana has joined #openstack-lbaas | 06:33 | |
| *** ramishra has quit IRC | 06:49 | |
| *** rcernin has quit IRC | 06:59 | |
| *** ramishra has joined #openstack-lbaas | 07:07 | |
| openstackgerrit | Carlos Goncalves proposed openstack/octavia-tempest-plugin master: Gate on CentOS 7 and check on Ubuntu Bionic https://review.openstack.org/587414 | 07:12 |
| *** numans_ has joined #openstack-lbaas | 07:15 | |
| *** abaindur has quit IRC | 07:17 | |
| *** abaindur has joined #openstack-lbaas | 07:21 | |
| *** yboaron_ has quit IRC | 07:22 | |
| *** celebdor has joined #openstack-lbaas | 07:38 | |
| *** abaindur has quit IRC | 07:40 | |
| *** abaindur has joined #openstack-lbaas | 07:41 | |
| *** abaindur_ has joined #openstack-lbaas | 07:45 | |
| *** abaindur has quit IRC | 07:46 | |
| *** velizarx has joined #openstack-lbaas | 08:02 | |
| *** ktibi has joined #openstack-lbaas | 08:04 | |
| *** abaindur_ has quit IRC | 08:06 | |
| *** velizarx has quit IRC | 08:18 | |
| *** yboaron_ has joined #openstack-lbaas | 08:30 | |
| *** velizarx has joined #openstack-lbaas | 08:35 | |
| *** pck has quit IRC | 08:49 | |
| *** pck has joined #openstack-lbaas | 08:50 | |
| openstackgerrit | ZhaoBo proposed openstack/octavia master: [UDP] Update amphora agent api ref https://review.openstack.org/588893 | 09:15 |
| sapd1 | Hi johnsom I would like to add expected status as format (2|3|4)[0-9][0-9]. How to do that? | 10:18 |
| openstackgerrit | Carlos Goncalves proposed openstack/octavia master: WIP: Ensure required options are set on startup https://review.openstack.org/595578 | 10:41 |
| *** jiteka has joined #openstack-lbaas | 11:14 | |
| openstackgerrit | Yang JianFeng proposed openstack/octavia master: Add quota support to octavia's l7policy and l7rule https://review.openstack.org/590620 | 11:38 |
| openstackgerrit | Yang JianFeng proposed openstack/octavia master: Add quota support to octavia's l7policy and l7rule https://review.openstack.org/590620 | 11:40 |
| *** yboaron_ has quit IRC | 11:50 | |
| *** yboaron_ has joined #openstack-lbaas | 11:51 | |
| *** yboaron_ has quit IRC | 12:02 | |
| *** pcaruana has quit IRC | 12:16 | |
| *** pcaruana has joined #openstack-lbaas | 12:16 | |
| *** yboaron_ has joined #openstack-lbaas | 12:27 | |
| *** velizarx has quit IRC | 12:35 | |
| *** dims_ is now known as dims | 12:37 | |
| *** yboaron_ has quit IRC | 12:38 | |
| *** KeithMnemonic has joined #openstack-lbaas | 12:46 | |
| *** velizarx has joined #openstack-lbaas | 12:47 | |
| openstackgerrit | Nguyen Hai proposed openstack/neutron-lbaas master: import zuul job settings from project-config https://review.openstack.org/595749 | 13:13 |
| openstackgerrit | Nguyen Hai proposed openstack/neutron-lbaas master: switch documentation job to new PTI https://review.openstack.org/595750 | 13:13 |
| openstackgerrit | Nguyen Hai proposed openstack/neutron-lbaas-dashboard master: import zuul job settings from project-config https://review.openstack.org/595751 | 13:13 |
| openstackgerrit | Nguyen Hai proposed openstack/neutron-lbaas-dashboard master: switch documentation job to new PTI https://review.openstack.org/595752 | 13:13 |
| openstackgerrit | Nguyen Hai proposed openstack/octavia master: import zuul job settings from project-config https://review.openstack.org/595753 | 13:13 |
| openstackgerrit | Nguyen Hai proposed openstack/octavia master: switch documentation job to new PTI https://review.openstack.org/595754 | 13:13 |
| openstackgerrit | Nguyen Hai proposed openstack/octavia master: add python 3.6 unit test job https://review.openstack.org/595755 | 13:13 |
| openstackgerrit | Nguyen Hai proposed openstack/octavia-dashboard master: import zuul job settings from project-config https://review.openstack.org/595756 | 13:13 |
| openstackgerrit | Nguyen Hai proposed openstack/octavia-dashboard master: switch documentation job to new PTI https://review.openstack.org/595757 | 13:13 |
| openstackgerrit | Nguyen Hai proposed openstack/octavia-tempest-plugin master: import zuul job settings from project-config https://review.openstack.org/595758 | 13:14 |
| openstackgerrit | Nguyen Hai proposed openstack/octavia-tempest-plugin master: switch documentation job to new PTI https://review.openstack.org/595759 | 13:14 |
| openstackgerrit | Nguyen Hai proposed openstack/python-octaviaclient master: import zuul job settings from project-config https://review.openstack.org/595760 | 13:14 |
| openstackgerrit | Nguyen Hai proposed openstack/python-octaviaclient master: switch documentation job to new PTI https://review.openstack.org/595761 | 13:14 |
| openstackgerrit | Nguyen Hai proposed openstack/python-octaviaclient master: add python 3.6 unit test job https://review.openstack.org/595762 | 13:14 |
| *** velizarx has quit IRC | 13:35 | |
| *** ktibi has quit IRC | 13:35 | |
| *** ktibi_ has joined #openstack-lbaas | 13:35 | |
| *** fnaval has joined #openstack-lbaas | 13:41 | |
| *** yboaron has joined #openstack-lbaas | 13:44 | |
| *** velizarx has joined #openstack-lbaas | 13:50 | |
| *** celebdor has quit IRC | 13:51 | |
| cgoncalves | speaking of py3 community goal ^ | 13:57 |
| *** ianychoi has quit IRC | 13:59 | |
| *** ianychoi has joined #openstack-lbaas | 14:00 | |
| *** celebdor has joined #openstack-lbaas | 14:01 | |
| nmagnezi | cgoncalves, looks like *all* projects are going to meet the goal :D https://review.openstack.org/#/q/owner:%22Nguyen+Hai%22+status:open | 14:06 |
| cgoncalves | fine by me | 14:46 |
| *** sapd1 has quit IRC | 14:49 | |
| *** Swami has joined #openstack-lbaas | 14:50 | |
| *** sapd1 has joined #openstack-lbaas | 14:50 | |
| cgoncalves | [health_manager]/controller_ip_port_list doesn't seem to be the right place. it misleads admins to thinking the opt is consumed by the health manager service | 14:55 |
| cgoncalves | [controller_worker]/controller_ip_port_list would be better, no? | 14:55 |
| *** rpittau has quit IRC | 14:57 | |
| johnsom | Hm is the only process listening on the ip:ports in that list... | 14:59 |
| *** ktibi_ has quit IRC | 15:23 | |
| *** ktibi_ has joined #openstack-lbaas | 15:23 | |
| *** velizarx has quit IRC | 15:36 | |
| *** pcaruana has quit IRC | 15:36 | |
| *** ktibi_ has quit IRC | 16:07 | |
| cgoncalves | johnsom, sorry, didn't understand | 16:09 |
| openstackgerrit | Carlos Goncalves proposed openstack/octavia-tempest-plugin master: WIP: Add octavia-v2-dsvm-scenario-ipv6 https://review.openstack.org/594078 | 16:16 |
| *** harlowja has joined #openstack-lbaas | 16:17 | |
| *** harlowja has quit IRC | 16:40 | |
| *** Swami has quit IRC | 16:49 | |
| *** ramishra has quit IRC | 16:52 | |
| *** yboaron has quit IRC | 16:56 | |
| *** bbbbzhao_ has quit IRC | 18:14 | |
| *** pcaruana has joined #openstack-lbaas | 18:52 | |
| *** abaindur has joined #openstack-lbaas | 18:53 | |
| *** pcaruana has quit IRC | 19:09 | |
| *** vakuznet has joined #openstack-lbaas | 19:48 | |
| vakuznet | hi, can ocatavia work with barbican? if so how to set it up? | 19:50 |
| rm_work | yes | 19:51 |
| rm_work | our devstack plugin is a good place to look for sample config -- it will use barbican | 19:51 |
| vakuznet | i'm getting octaviaclient.api.v2.octavia.OctaviaClientException: Could not retrieve certificate: | 19:54 |
| jiteka | sapd1 johnsom : so about these API call that were never failing for any GET (that stay with the API) but sometime fail silently on POST action that are forwarded to octavia-worker got a simple explaination that won't require a story | 19:56 |
| jiteka | sapd1 johnsom : I just forgot to kill a test server that was running all octavia service with older version and wrong configuration and octacvia-worker was fetching msg from rabbitMQ and failing on every attempt to contact amphora Rest API (cert problem) | 19:57 |
| rm_work | haha yeah that has happened to me | 19:59 |
| rm_work | "wtf why do some of my requests just disappear" | 19:59 |
| jiteka | rm_work: I absolutely looking everywhere | 19:59 |
| rm_work | "oh right i forgot about that old defunct control-plane test from a month ago" | 19:59 |
| rm_work | still pulling from RMQ :P | 19:59 |
| jiteka | rm_work: was like, ok it's haproxy in front, no because I have the get. So it's probably between uwsgi/nginx or between octavia-api binary and uwsgi | 20:00 |
| rm_work | vakuznet: what version of octavia are you using? | 20:01 |
| jiteka | rm_work: the worst part was that failure was random so insisting on the same command would always work (if another octavia-worker take it) | 20:01 |
| rm_work | yes | 20:02 |
| rm_work | lol | 20:02 |
| vakuznet | rm_work: 2.0.2.dev30 | 20:06 |
| rm_work | err | 20:06 |
| rm_work | is that master? | 20:06 |
| rm_work | or rocky basically? | 20:06 |
| rm_work | or was 2.0 queens? | 20:07 |
| vakuznet | queens | 20:08 |
| rm_work | cgoncalves: did we merge the barbican auto-acl stuff? | 20:09 |
| rm_work | i've been a little out of the loop | 20:09 |
| johnsom | rm_work Yeah, it merged, but for Rocky | 20:14 |
| rm_work | and not backported, k | 20:14 |
| rm_work | vakuznet: so probably octavia's service account does not have access to that secret in barbican | 20:15 |
| rm_work | you'll either need to create an ACL on the secret to allow it, or else grant the octavia account global access to barbican secrets via policy (this is gross but lots of people do it if they don't care so much about security) | 20:15 |
| cgoncalves | rm_work, yes | 20:46 |
| cgoncalves | oh, johnsom had already replied sorry :) | 20:46 |
| vakuznet | like that? openstack acl user add --user octavia $URI | 20:52 |
| rm_work | ah, no | 20:54 |
| rm_work | oh, wait, maybe it is | 20:58 |
| rm_work | i thought they put acl under the secret resource but i guess not | 20:58 |
| rm_work | so yeah, looks like your command is correct | 20:58 |
| *** abaindur has quit IRC | 21:05 | |
| *** abaindur has joined #openstack-lbaas | 21:06 | |
| *** abaindur_ has joined #openstack-lbaas | 21:10 | |
| *** abaindur has quit IRC | 21:12 | |
| *** abaindur has joined #openstack-lbaas | 21:16 | |
| *** abaindur_ has quit IRC | 21:16 | |
| vakuznet | rm_work, still got 400 Could not retrieve certificate | 21:16 |
| rm_work | do the octavia api logs show any more info? a traceback or something? | 21:17 |
| *** abaindur_ has joined #openstack-lbaas | 21:21 | |
| *** abaindur has quit IRC | 21:23 | |
| *** abaindur has joined #openstack-lbaas | 21:27 | |
| *** abaindur_ has quit IRC | 21:28 | |
| *** vakuznet has quit IRC | 21:29 | |
| *** abaindur_ has joined #openstack-lbaas | 21:33 | |
| *** vakuznet has joined #openstack-lbaas | 21:33 | |
| *** abaindur has quit IRC | 21:35 | |
| *** vakuznet has quit IRC | 21:37 | |
| *** abaindur has joined #openstack-lbaas | 21:42 | |
| *** abaindur_ has quit IRC | 21:43 | |
| *** rcernin has joined #openstack-lbaas | 21:46 | |
| abaindur | johnsom: have some other cert related questions | 22:33 |
| johnsom | Uh-Oh... grin | 22:33 |
| abaindur | the Docs say that octavia acts as a certificate authority itself | 22:33 |
| abaindur | when you spin up new amphora, does it create a new cert for each amphora? | 22:33 |
| abaindur | or Do they use the same cert specified in client_cert in [haproxy_amphora] | 22:34 |
| johnsom | It does, yes, correct. Each amphora gets it's own cert. The housekeeping process will rotate them automatically | 22:34 |
| abaindur | what is the client_cert in haproxy_amphora then? | 22:34 |
| johnsom | We do two-way authentication with the amphora when connecting. The amp presents it's certificate, the controller presents the "client" certificate. Both sides validate them against the CA's they have | 22:36 |
| johnsom | https://en.wikipedia.org/wiki/Mutual_authentication | 22:36 |
| abaindur | How do they certs get into the amphora? | 22:36 |
| johnsom | They are loaded at amphora boot time via config drive or via the amphora agent API. | 22:37 |
| johnsom | Each amp cert has it's amphora ID as the subject, making them unique | 22:38 |
| abaindur | ah ok, and johnsom: what then is diff between server_ca and client_ca? | 22:43 |
| abaindur | i remember reading previously here we arent supposed to use the same? | 22:43 |
| johnsom | Server CA is what the controllers use to validate the amphora certs. Client CA is what the amphora uses to validate the controller "client" certs | 22:44 |
| johnsom | Right, you don't want an amp to use it's own cert to pretend to be a controller, thus both roles have their own CA | 22:45 |
| abaindur | ok, still trying to wrap my head around it, its a little confusing :) | 22:49 |
| abaindur | i got it to work by blindly running the create certs scrit, and emulating what devstack does | 22:49 |
| abaindur | But want to understand what needs to be done in production | 22:49 |
| johnsom | Yeah we still need that detailed installation guide... | 22:49 |
| abaindur | ca_certificate refers to which CA? | 22:51 |
| abaindur | the client or server? | 22:51 |
| abaindur | and server here referst o the octavia controller worker, and client, the amphora? | 22:51 |
| johnsom | Should be the other way around. The amphora is the "server" the controllers are the clients. | 22:52 |
| *** threestrands has joined #openstack-lbaas | 22:53 | |
| *** celebdor has quit IRC | 22:55 | |
| abaindur | johnsom: i guess i am confused between the ca_certificate and the client_ca then | 23:00 |
| abaindur | we have them set to the same .pem key | 23:00 |
| *** fnaval has quit IRC | 23:01 | |
| abaindur | noticed the ca_certificate and ca_private_key is missing from the config docs too | 23:01 |
| rm_work | <johnsom>Should be the other way around. The amphora is the "server" the controllers are the clients. | 23:02 |
| rm_work | ^^ THAT is the part that is the real confusing bit for most people | 23:02 |
| johnsom | Yeah, I need to look if I can fix that or not. It's because those config definitions are in the certificate driver code | 23:02 |
| rm_work | it even took me a bit to really internalize that | 23:03 |
| rm_work | and i still get confused periodically | 23:03 |
| rm_work | because yeah, the "server" is the amp-agent | 23:03 |
| johnsom | We could have named the stuff better in the config file too | 23:03 |
| johnsom | So, in production, you don't want those two to be the same. | 23:04 |
| johnsom | The ca_certificate configs are for the controllers to generate the "server" certs issued to the amphora and to validate them. | 23:04 |
| johnsom | client_ca is loaded onto the amphora to validate the "client" certificate the controllers are going to present to the amphora on connection | 23:05 |
| abaindur | So it seems like server_ca == ca_ceritifcate? | 23:10 |
| abaindur | that is what I am now confused on | 23:10 |
| abaindur | "Server CA is what the controllers use to validate the amphora certs." | 23:11 |
| abaindur | "ca_certificate configs are for the controllers to generate the "server" certs issued to the amphora and to validate them." | 23:12 |
| abaindur | johnsom: ? | 23:30 |
| johnsom | Sorry, got distracted here | 23:30 |
| johnsom | So here are a few things you might be confused on. | 23:31 |
| johnsom | 1. In production you want to create two CAs. One is "server" one is "client" | 23:32 |
| johnsom | 2. Each CA has the following files: ca_cert, a cert.pem file, a cert.key file. | 23:32 |
| abaindur | right that makes sense... client CA in amphora validates the client cert presented by octavia, and server_ca is used to generate the cert used by the amphora | 23:33 |
| johnsom | 3. ca_cert is used to validate the cert.pem | 23:33 |
| johnsom | 4. No "CA" is located in the amphora, only the ca_cert file for the client CA, it's "server.pem" and "server.key". | 23:35 |
| johnsom | 5. When the controller makes an HTTPS connection to the amphora a few things happen: | 23:36 |
| johnsom | a. The amphora presents it's "server.pem" to the controller. | 23:37 |
| johnsom | b. The controller validates it a using the "server" ca_cert file. | 23:37 |
| johnsom | c. The controller then presents it's "client.pem" to the amphora. | 23:38 |
| johnsom | d. The amphora validates the "client.pem" against the "client" ca_cert file. | 23:38 |
| johnsom | 6. The controllers use the "server" CA files to generate new "server.pem" files for new or renewing amphora. | 23:39 |
| *** abaindur_ has joined #openstack-lbaas | 23:44 | |
| *** abaindur has quit IRC | 23:47 | |
| *** abaindur has joined #openstack-lbaas | 23:47 | |
| *** abaindur_ has quit IRC | 23:50 | |
| abaindur | johnsom: that all makes sense, but I am confused by the aactual names of the config | 23:51 |
| abaindur | "The controllers use the "server" CA files to generate new "server.pem" files for new or renewing amphora." | 23:51 |
| abaindur | is this server_ca under [haproxy_amphora], or ca_certificate under [certificates] | 23:52 |
| abaindur | from what you've said It seems to me like the config entries ca_certificate and server_ca are the same. They are the ca_cert used to generate the amphora's server.pem, and to validate it | 23:52 |
| abaindur | I understand that client_ca in [controller_worker section] is the CA cert used to validate the client.pem presented by controller (the value of client_cert in [certificates] section) | 23:53 |
| johnsom | [certificates] gets the following: | 23:54 |
| johnsom | cert_generator = local_cert_generator | 23:54 |
| johnsom | ca_certificate = server CA's "server.pem" file | 23:55 |
| johnsom | ca_private_key = server CA's "server.key" file | 23:55 |
| johnsom | ca_private_key_passphrase = pass phrase for ca_private_key | 23:55 |
| johnsom | [controller_worker] | 23:56 |
| johnsom | client_ca = Client CA's ca_cert file | 23:56 |
| johnsom | [haproxy_amphora] | 23:57 |
| johnsom | client_cert = Client CA's client.pem file (I think with it's key concatenated is what rm_work said the other day) | 23:57 |
| johnsom | server_cert = Server CA's ca_cert file | 23:58 |
| johnsom | That should be it. | 23:59 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!