| nmickus | johnsom does it need to be added to the set/update commands as well? | 00:00 |
|---|---|---|
| johnsom | ^^^ I think that is what I just said. lol | 00:01 |
| nmickus | commands not tests I wanted to double check since you didn't comment about the command | 00:03 |
| nmickus | oh wait read that wrong | 00:03 |
| johnsom | nmickus Yeah, we added it to create and the update commands | 00:11 |
| johnsom | https://docs.openstack.org/api-ref/load-balancer/v2/index.html?expanded=update-a-listener-detail#update-a-listener | 00:12 |
| nmickus | johnsom I added the tests and am getting an error saying the fake resource does not have that attribute for both tests | 00:38 |
| johnsom | So you missed something there | 00:38 |
| nmickus | http://paste.openstack.org/show/791772/ | 00:39 |
| nmickus | my additions are at the end of both lists | 00:40 |
| nmickus | I can | 00:40 |
| nmickus | I can't see what i missed | 00:40 |
| johnsom | line 3, did you update the listener_info? | 00:40 |
| nmickus | no | 00:42 |
| nmickus | do i need to add a specific string style to the test? | 00:45 |
| nmickus | johnsom? | 00:50 |
| johnsom | nmickus For the of the ciphers field? | 00:51 |
| johnsom | content? | 00:51 |
| nmickus | yeah in the tests constants file | 00:51 |
| johnsom | I would put in a same string like the API reference has | 00:51 |
| johnsom | Tests that are close to the real world use are usually best. | 00:52 |
| nmickus | so from dawson's patch? | 00:52 |
| johnsom | https://docs.openstack.org/api-ref/load-balancer/v2/index.html?expanded=create-listener-detail#id35 | 00:53 |
| johnsom | yes | 00:53 |
| *** JayLiu has joined #openstack-lbaas | 00:57 | |
| openstackgerrit | Noah Mickus proposed openstack/python-octaviaclient master: Add the ability to specify the cipher list for a listener https://review.opendev.org/717811 | 00:59 |
| johnsom | Hi JayLiu. Welcome to working on Octavia. | 01:01 |
| JayLiu | hello! | 01:02 |
| johnsom | I understand you are interested in the Active/Active work | 01:02 |
| johnsom | Have you reviewed our existing spcecifications? | 01:02 |
| JayLiu | yes I read a lot | 01:02 |
| johnsom | Ok, great. | 01:02 |
| JayLiu | now octavia has standby and single modes, right? | 01:03 |
| johnsom | There are two different proposals in our specifications. One uses a "distributor" or load-balancer of load-balancers. The other is an L3 BGP/ECMP style. | 01:03 |
| johnsom | Correct. Both active/active specifications have not completed the development | 01:04 |
| johnsom | What style of active/active are you interested in developing? | 01:05 |
| JayLiu | I saw that our code has been writen some code about active/active mode? My team want to how to participate into the community develop | 01:06 |
| johnsom | Ok. So you maybe want to help finish one of the existing proposals? | 01:06 |
| JayLiu | Sorry I am a member of my team, our code is more like the combination of the two different proposals | 01:08 |
| JayLiu | I wish you can give our team several days to prepare a ppt for further discuss? | 01:10 |
| johnsom | Oh, ok. Then we should start with writing a proposal that describes what you want to add. This will be a document similar to the specifications you saw. Let me provide some links to review. | 01:10 |
| JayLiu | ok | 01:11 |
| johnsom | This file describes what content is needed: https://github.com/openstack/octavia/blob/master/specs/template.rst | 01:11 |
| johnsom | This file is a template you can fill out: https://github.com/openstack/octavia/blob/master/specs/skeleton.rst | 01:11 |
| johnsom | JayLiu I am happy to review a powerpoint and discuss with you, but the OpenStack community will want a specification file that can be commented on and reviewed. Then this specification will be approved for development. | 01:12 |
| johnsom | My review of the powerpoint would just be to help guide you, but would not be approval to develop from the OpenStack community. | 01:13 |
| JayLiu | ok! thx! we will commit a proposals later~ | 01:13 |
| JayLiu | thank you for your guide :) | 01:14 |
| johnsom | Ok, sounds great. It is nice to have you working with the Octavia team. | 01:14 |
| openstackgerrit | Michael Johnson proposed openstack/octavia master: Add amphora delete API https://review.opendev.org/718293 | 01:32 |
| johnsom | It is a start | 01:32 |
| johnsom | not done however | 01:33 |
| openstackgerrit | Noah Mickus proposed openstack/python-octaviaclient master: Add the ability to specify the cipher list for a pool https://review.opendev.org/717834 | 01:34 |
| *** zasherif has joined #openstack-lbaas | 01:59 | |
| *** zasherif has quit IRC | 02:03 | |
| *** yamamoto has joined #openstack-lbaas | 02:14 | |
| openstackgerrit | Dawson Coleman proposed openstack/octavia master: Add ability to specify TLS cipher list for pools https://review.opendev.org/717154 | 02:30 |
| lxkong | Hi guys, we had a security testing the other day, one Octavia related issue was found, I'd like to hear your suggestion | 02:57 |
| lxkong | ```It was found that it was possible to create a load balancer and add compute resources located in a restricted private network that belong to another project, as pool members, if the subnet ID is known. This allows a malicious user to configure a load balancer to act as a router or bridge, to access services that are intended to be restricted. Because this attack requires a subnet ID and the IP address of the | 02:57 |
| lxkong | resource, which are not necessarily guessable (although potentially exposed through documentation or source code repositories).``` | 02:57 |
| lxkong | For octavia stable/train | 02:57 |
| lxkong | i checked the code, even on master, we are using octavia service user to check the subnet | 02:58 |
| lxkong | johnsom, rm_work ping | 02:58 |
| rm_work | Right, we're aware of this, or at least I am definitely aware of this, and actually it is part of the normal workflow of my users that we do things across tenants | 03:08 |
| lxkong | rm_work: and also the vip_xxx_id when creating load balancer? | 03:08 |
| lxkong | we don't check that neither | 03:08 |
| lxkong | rm_work: any plan to fix that? | 03:09 |
| rm_work | Err sorry, we don't actually need the plugging technically tho lol | 03:09 |
| rm_work | But we still use it for whatever reason <_< I should actually tell my users to stop :D | 03:09 |
| rm_work | No plan to fix it exactly... | 03:10 |
| lxkong | rm_work: the issue is supposed to be critical for one of our private customer :-( | 03:10 |
| lxkong | priviate cloud customer | 03:11 |
| lxkong | rm_work | 03:11 |
| lxkong | I can offer help if needed | 03:11 |
| lxkong | introduce a new config option as you still have cross tenant usage? | 03:12 |
| rm_work | Maybe can do it as config, yes | 03:12 |
| rm_work | Basically we'd have to temperately switch to tenant context and confirm the tenant can see the subnet | 03:13 |
| rm_work | Since still need to be admin to plug it | 03:13 |
| rm_work | Can do it on the API call | 03:13 |
| lxkong | rm_work: ok, i will do more testing before submitting a patch | 03:13 |
| lxkong | rm_work: thanks for responding | 03:13 |
| rm_work | The only thing is that if it ever becomes inaccessible to the tenant after (unshared, for example) we won't check again | 03:13 |
| rm_work | So yeah, on the member create validation we can check not just the subnet exists but that it is also visible to the lb tenant | 03:14 |
| rm_work | Will require creating new sdk instance using the hijacked client token from the request I think | 03:15 |
| *** psachin has joined #openstack-lbaas | 03:28 | |
| *** yamamoto has quit IRC | 03:42 | |
| *** yamamoto has joined #openstack-lbaas | 03:44 | |
| *** vishalmanchanda has joined #openstack-lbaas | 03:53 | |
| openstackgerrit | Michael Johnson proposed openstack/octavia master: Add amphora delete API https://review.opendev.org/718293 | 04:07 |
| *** zasherif has joined #openstack-lbaas | 04:13 | |
| openstackgerrit | Michael Johnson proposed openstack/octavia master: Add amphora delete API https://review.opendev.org/718293 | 04:39 |
| *** yamamoto has quit IRC | 04:42 | |
| *** yamamoto has joined #openstack-lbaas | 04:47 | |
| *** zasherif has quit IRC | 04:55 | |
| *** zasherif has joined #openstack-lbaas | 05:12 | |
| *** armax has quit IRC | 05:27 | |
| *** armax has joined #openstack-lbaas | 05:28 | |
| *** armax has quit IRC | 05:33 | |
| openstackgerrit | Michael Johnson proposed openstack/python-octaviaclient master: Add amphora delete command https://review.opendev.org/718311 | 05:57 |
| *** armax has joined #openstack-lbaas | 06:13 | |
| *** armax has quit IRC | 06:18 | |
| *** gcheresh has joined #openstack-lbaas | 06:31 | |
| *** zasherif has quit IRC | 06:49 | |
| *** yamamoto has quit IRC | 06:52 | |
| *** gcheresh has quit IRC | 06:52 | |
| *** gcheresh has joined #openstack-lbaas | 06:59 | |
| *** maciejjozefczyk has joined #openstack-lbaas | 07:00 | |
| *** yamamoto has joined #openstack-lbaas | 07:05 | |
| *** rpittau|afk is now known as rpittau | 07:17 | |
| *** born2bake has joined #openstack-lbaas | 07:37 | |
| *** dmellado has quit IRC | 08:01 | |
| *** dmellado has joined #openstack-lbaas | 08:05 | |
| *** gcheresh has quit IRC | 08:22 | |
| *** gcheresh has joined #openstack-lbaas | 08:23 | |
| *** rcernin has quit IRC | 08:27 | |
| *** gcheresh has quit IRC | 08:31 | |
| *** gcheresh has joined #openstack-lbaas | 08:33 | |
| openstackgerrit | Ann Taraday proposed openstack/octavia master: Jobboard based controller https://review.opendev.org/647406 | 08:43 |
| *** gcheresh has quit IRC | 08:44 | |
| *** tkajinam has quit IRC | 08:51 | |
| *** gcheresh has joined #openstack-lbaas | 09:00 | |
| *** ataraday_ has joined #openstack-lbaas | 09:04 | |
| *** gcheresh has quit IRC | 09:15 | |
| *** gcheresh has joined #openstack-lbaas | 09:26 | |
| *** gcheresh has quit IRC | 09:39 | |
| openstackgerrit | Ann Taraday proposed openstack/octavia master: Jobboard based controller https://review.opendev.org/647406 | 10:00 |
| *** yamamoto has quit IRC | 10:13 | |
| *** rpittau is now known as rpittau|bbl | 10:24 | |
| *** gcheresh has joined #openstack-lbaas | 10:30 | |
| *** yamamoto has joined #openstack-lbaas | 10:33 | |
| *** yamamoto has quit IRC | 10:34 | |
| *** gcheresh has quit IRC | 10:49 | |
| *** yamamoto has joined #openstack-lbaas | 10:53 | |
| ataraday_ | cgoncalves, Hi! About your comment I checked the console of job https://zuul.opendev.org/t/openstack/stream/331985a665ce43f0bab803e079e3ee76?logfile=console.log Seems DIB_LOCAL_ELEMENTS are set corretly | 11:12 |
| cgoncalves | ataraday_, hi! yeah, I see it too. it is still unclear to me when Zuul merges configurations or overrides them | 11:15 |
| cgoncalves | ataraday_, I'll +2 as soon as Zuul verifies | 11:16 |
| ataraday_ | cgoncalves, , Yeah, all job stuff is really confusing for me :) glad I'm not the only one | 11:19 |
| ataraday_ | thanks! | 11:19 |
| openstackgerrit | Ann Taraday proposed openstack/octavia master: Add option to set default ssl ciphers in haproxy https://review.opendev.org/685337 | 11:25 |
| *** gcheresh has joined #openstack-lbaas | 12:07 | |
| *** tkajinam has joined #openstack-lbaas | 12:14 | |
| *** gcheresh has quit IRC | 12:17 | |
| *** ccamposr__ has joined #openstack-lbaas | 12:19 | |
| *** ccamposr has quit IRC | 12:21 | |
| *** rpittau|bbl is now known as rpittau | 12:23 | |
| openstackgerrit | Ann Taraday proposed openstack/octavia master: Add option to set default ssl ciphers in haproxy https://review.opendev.org/685337 | 12:39 |
| *** gcheresh has joined #openstack-lbaas | 12:40 | |
| openstackgerrit | Ann Taraday proposed openstack/octavia master: Jobboard based controller https://review.opendev.org/647406 | 12:49 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/octavia-dashboard master: Imported Translations from Zanata https://review.opendev.org/718430 | 12:55 |
| *** spatel has joined #openstack-lbaas | 12:58 | |
| *** spatel has quit IRC | 12:59 | |
| *** gcheresh has quit IRC | 13:20 | |
| *** gcheresh has joined #openstack-lbaas | 13:24 | |
| *** yamamoto has quit IRC | 13:50 | |
| *** tobias-urdin has joined #openstack-lbaas | 13:51 | |
| tobias-urdin | cgoncalves: can i bother you for a sec :) since there is no "default" fields on flavor does it default to using the values from octavia.conf or will it select the "first one" if you only have one flavor? | 13:53 |
| tobias-urdin | or will octavia API just reject create requests without any flavor? | 13:54 |
| tobias-urdin | (i assume no on second since flavor_id is optional) | 13:55 |
| johnsom | tobias-urdin It will fall back to the configuration file defaults | 13:55 |
| cgoncalves | +1 | 13:56 |
| tobias-urdin | thanks! | 14:12 |
| *** yamamoto has joined #openstack-lbaas | 14:17 | |
| *** dayou_ has joined #openstack-lbaas | 14:19 | |
| *** dayou has quit IRC | 14:22 | |
| *** gcheresh has quit IRC | 14:38 | |
| *** dayou_ has quit IRC | 14:44 | |
| *** dayou has joined #openstack-lbaas | 14:44 | |
| *** armax has joined #openstack-lbaas | 15:01 | |
| *** TrevorV has joined #openstack-lbaas | 15:02 | |
| *** yamamoto has quit IRC | 15:06 | |
| *** yamamoto has joined #openstack-lbaas | 15:15 | |
| *** yamamoto has quit IRC | 15:15 | |
| openstackgerrit | Ann Taraday proposed openstack/octavia master: Jobboard based controller https://review.opendev.org/647406 | 15:53 |
| *** yamamoto has joined #openstack-lbaas | 15:55 | |
| johnsom | #startmeeting Octavia | 16:02 |
| openstack | Meeting started Wed Apr 8 16:02:07 2020 UTC and is due to finish in 60 minutes. The chair is johnsom. Information about MeetBot at http://wiki.debian.org/MeetBot. | 16:02 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 16:02 |
| *** openstack changes topic to " (Meeting topic: Octavia)" | 16:02 | |
| openstack | The meeting name has been set to 'octavia' | 16:02 |
| ataraday_ | hi | 16:02 |
| cgoncalves | hi | 16:02 |
| dawzon | hi | 16:02 |
| *** zasherif has joined #openstack-lbaas | 16:02 | |
| haleyb | hi | 16:03 |
| gthiemonge | hi | 16:03 |
| johnsom | Sorry for being a minute or two late | 16:03 |
| johnsom | It's been a busy morning. | 16:03 |
| johnsom | #topic Announcements | 16:03 |
| *** openstack changes topic to "Announcements (Meeting topic: Octavia)" | 16:03 | |
| *** zasherif has quit IRC | 16:03 | |
| johnsom | You are stuck with me for the Victoria release cycle. | 16:04 |
| cgoncalves | bummer! | 16:04 |
| *** zasherif has joined #openstack-lbaas | 16:04 | |
| johnsom | I.e. I will be the PTL for the next release. | 16:04 |
| johnsom | No matter how much Adam tries, he is still the PTL until May. lol | 16:05 |
| cgoncalves | congratulations and THANK YOU | 16:05 |
| johnsom | Thanks! | 16:05 |
| cgoncalves | thanks also to Adam for being PTL this past release | 16:05 |
| johnsom | Yes, thank you to Adam for stepping up to PTL for Train and Ussuri! | 16:05 |
| * johnsom thinks 4 more years.... | 16:06 | |
| haleyb | johnsom: you're welcome to be lifetime PTL :) | 16:06 |
| johnsom | Please consider if you would like to be PTL after Victoria. I am happy to discuss or help folks feel comfortable to run. | 16:06 |
| * johnsom looks for his coffee | 16:07 | |
| johnsom | Ok, other super important announcement: | 16:07 |
| johnsom | This week is final release for the python-octaviaclient and is feature freeze for everything else!!!!!! | 16:07 |
| johnsom | Please, if you have a feature that you want into Ussuri, speak up during this meeting and make sure the core reviews are tracking it. | 16:08 |
| * cgoncalves cancels his dinner out plans. oh wait, covid-19 | 16:08 | |
| johnsom | I know that we have some TLS patches and jobboard still in plan for Ussuri. | 16:09 |
| *** zasherif has quit IRC | 16:09 | |
| johnsom | My recent amphora delete feature is fine to push to Victoria IMO, so not stressing over that. | 16:09 |
| *** yamamoto has quit IRC | 16:09 | |
| johnsom | If you have other features, please raise them. | 16:09 |
| johnsom | Docs, tests, and bug fixes are still open until April 20th week. | 16:10 |
| johnsom | #link https://releases.openstack.org/ussuri/schedule.html | 16:10 |
| cgoncalves | it is not a feature and not super important but would not be backportable: noop certificate manager. I understand it was uploaded less than a week ago. if someone has cycles to review it, I'd appreciate. if not, all good still! | 16:11 |
| johnsom | Also of note, we are starting to get the translation patches. Please help us review. | 16:11 |
| cgoncalves | #link https://review.opendev.org/#/c/717619/ | 16:11 |
| cgoncalves | the noop certificate manager would allow us to do TLS-related testing in Tempest API | 16:11 |
| johnsom | cgoncalves That kind of falls into the testing category as it should only be used during tests. Not sure if it impacts other parts of the code, but may not fall under the feature freeze. | 16:12 |
| johnsom | I can take a quick scan | 16:12 |
| cgoncalves | johnsom, not falling under the feature freeze would be awesome | 16:12 |
| johnsom | Ok. Please by the end of the meeting speak up if you have something. Otherwise it may not make Ussuri and may be bumped to Victoria. | 16:14 |
| haleyb | johnsom: i'm not sure i'll have time to update the multiple VIP patch, https://review.opendev.org/#/c/660239/ - i'll at least get it rebased to master | 16:14 |
| johnsom | Yeah, Adam could not make the meeting today. I'm not sure the state on that. If you think you can get it ready for review, let's get it on the list. | 16:14 |
| johnsom | haleyb So, please reach out to me by this time tomorrow if you get time to get it "ready" | 16:15 |
| johnsom | #topic Brief progress reports / bugs needing review | 16:16 |
| *** openstack changes topic to "Brief progress reports / bugs needing review (Meeting topic: Octavia)" | 16:16 | |
| haleyb | it was still failing, so probably not, unless the light bulb just turns on as to the failure | 16:16 |
| johnsom | Ok | 16:16 |
| johnsom | I have been juggling.... | 16:16 |
| johnsom | I was working on tempest test cleanup. This found a bug in the OVN provider driver. I have opened a launchpad bug for that and the team is looking at it. | 16:17 |
| johnsom | I am pausing that work, mid-complete, to focus on the feature freeze, and release. | 16:17 |
| ataraday_ | Jobboard change #link https://review.opendev.org/#/c/647406/ (not a day without stupid pep8 error) | 16:18 |
| johnsom | So, many reviews as well. I will be working on failover patch cleanup today as well as it would be good to get that merged sooner than later. It's a bug fix, so still has a bit of time. | 16:18 |
| johnsom | ataraday_ Thanks. I did a full review on that this week as well. Looked pretty good. I will look again today | 16:19 |
| ataraday_ | and default cipher #link https://review.opendev.org/#/c/685337/ I rebased and updated it today | 16:19 |
| ataraday_ | johnsom, cgoncalves Thank for reviews! | 16:19 |
| johnsom | Oh! there is a good one to call out. I lost track of that one. Will look today as well | 16:20 |
| cgoncalves | ataraday_, you're welcome! | 16:20 |
| johnsom | TLS ciphers is going to make Ussuri for Octavia and client. | 16:20 |
| johnsom | Kudos to dawzon, great work! | 16:20 |
| cgoncalves | ataraday_, please see https://review.opendev.org/#/c/647406/104/devstack/plugin.sh@375. you removed the OCTAVIA_JOBBOARD_EXPIRATION_TIME part in plugin.sh in a follow-up patch set. I think we need it back | 16:21 |
| cgoncalves | with quick fixing | 16:21 |
| cgoncalves | I mean, minor fixing | 16:21 |
| johnsom | Ah, some changes there were part of my comments. Maybe I missed something? | 16:21 |
| cgoncalves | dawzon, great work on your patches! | 16:21 |
| cgoncalves | johnsom, yeah. there were some changes while you're offline | 16:22 |
| dawzon | Thanks! I really appreciate all the community help I received along the way | 16:23 |
| * johnsom sleep is such a pain. lol | 16:23 | |
| *** rpittau is now known as rpittau|afk | 16:23 | |
| *** psachin has quit IRC | 16:24 | |
| cgoncalves | so I pushed a patch that adds the noop certificate manager I mentioned earlier. | 16:24 |
| cgoncalves | #link https://review.opendev.org/#/c/717619/ | 16:24 |
| johnsom | That has been long needed, thank you. | 16:24 |
| cgoncalves | it is part of a chain of patches related to fixing issues with SNI | 16:24 |
| cgoncalves | we need noop cert manager for testing the API in tempest | 16:25 |
| ataraday_ | cgoncalves, I saw your commet, I think setting in job https://review.opendev.org/#/c/647406/106/zuul.d/jobs.yaml@81 is fine as for devstacks timeout which is as default also fits. | 16:25 |
| johnsom | Yeah, I know I put some TODO comments in for the need in the functional tests too | 16:25 |
| ataraday_ | only gates require higher timeout | 16:25 |
| johnsom | Yeah, that was my comment. For example, when I run local it is much faster than the zuul gates, so I would rather have devstack fall back to the config.py default setting by default, and we only override for the zuul jobs in the job definition | 16:26 |
| cgoncalves | ataraday_, ok. I just thought since you added that devstack config option we could keep it given we found the problem. however, it is not a hard requirement so I am good not having it | 16:27 |
| cgoncalves | ok, sure | 16:27 |
| johnsom | We tend to see devstack settings copied into actual deployment tools like tripleo and OSA, so I would rather not have settings need for zuul called out there unless we absolutely need it. | 16:30 |
| cgoncalves | fair point | 16:30 |
| johnsom | The nova boot timeout comes to mind | 16:30 |
| johnsom | ataraday_ Thanks for the quick spins on these patches. Huge accomplishment for you in Ussuri! | 16:31 |
| johnsom | #topic Open Discussion | 16:31 |
| *** openstack changes topic to "Open Discussion (Meeting topic: Octavia)" | 16:31 | |
| johnsom | Also of note, as I was writing up the release highlights and reviewing the release notes. We got some good stuff done this cycle. Thank you all for your work! | 16:32 |
| ataraday_ | johnsom, Thanks! quick 100+ patches :D | 16:33 |
| cgoncalves | johnsom, thanks for the release highlights! | 16:33 |
| born2bake | Hello guys, I am wondering if you have a guide how to use octavia with kolla-ansible since cant find any good documentation how to deploy it correctly. | 16:33 |
| johnsom | born2bake Hi. Since there are many deployment tools to deploy Octavia, the deployment tool specific docs are handled by the deployment tool team. There should be a section in the kolla docs for Octavia. | 16:35 |
| dawzon | cgoncalves I noticed your comment on the pool ciphers patch, I was under the impression that split_listeners wasn't really supported anymore? https://review.opendev.org/#/c/717154/ | 16:36 |
| *** zasherif has joined #openstack-lbaas | 16:36 | |
| *** zasherif has quit IRC | 16:37 | |
| cgoncalves | dawzon, it is still supported unless I missed something. we could argue it's deprecated and as so we don't add new features to it. | 16:37 |
| born2bake | johnsom there is not but thanks anyway. i will try google then | 16:37 |
| johnsom | born2bake I'm not finding it with a quick google search, maybe ask in the #openstack-kolla channel? | 16:37 |
| johnsom | cgonclaves I told the team they could ignore split listeners | 16:38 |
| born2bake | I am not really sure if its even that much in use with kolla cause it seems like its outdated. still 3 certs required instead of 4 and etc. | 16:38 |
| johnsom | But that brings up a good point that I should probably hammer out that mirror patch.... Sounds like a bug (grin???) | 16:39 |
| cgoncalves | dawzon, my thought was if the controller services have your work and one runs an older amphora image (split listeners only) but also supports the tls ciphers, it would technically still be possible to configure the ciphers | 16:39 |
| cgoncalves | it's an edge case, sure. we could go without split listener. if later we see it's actually needed we could consider that a bug...? | 16:40 |
| johnsom | born2bake Yeah, I can't keep up with the state of all of the deployment tools. Sorry. | 16:40 |
| cgoncalves | so split listener is deprecated and as so no new features added to it. is that it? I'm fine, just would like to have an agreement | 16:42 |
| johnsom | cgoncalves to some degree, we put release notes in that new features require a new amphora image. This is one that technically doesn't, but.... | 16:42 |
| cgoncalves | good point on the release note | 16:43 |
| johnsom | cgonvales I think we just need to add a mirror patch that makes split listener work. | 16:43 |
| johnsom | opps, typo. | 16:43 |
| cgoncalves | ok | 16:43 |
| johnsom | Maybe file a bug we can tag those fixes against so we don't block the main feature patch | 16:45 |
| cgoncalves | +1 | 16:45 |
| johnsom | Ok, any other topics today? | 16:46 |
| johnsom | Ok, thank you everyone! | 16:48 |
| cgoncalves | o/ | 16:48 |
| johnsom | #endmeeting | 16:48 |
| *** openstack changes topic to "Discussions for OpenStack Octavia | Priority bug review list: https://etherpad.openstack.org/p/octavia-priority-reviews" | 16:48 | |
| openstack | Meeting ended Wed Apr 8 16:48:30 2020 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:48 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/octavia/2020/octavia.2020-04-08-16.02.html | 16:48 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/octavia/2020/octavia.2020-04-08-16.02.txt | 16:48 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/octavia/2020/octavia.2020-04-08-16.02.log.html | 16:48 |
| *** zasherif has joined #openstack-lbaas | 16:50 | |
| *** ataraday_ has quit IRC | 16:51 | |
| johnsom | born2bake I know people are using Octavia with Kolla, we get questions every once in a while. I'm just not sure where the kolla installation docs are. | 16:53 |
| born2bake | as far as I remember, the main problem was to make containers see neutron gw and make sure that octavia network will be reachable from lb to amphora instances. | 16:55 |
| born2bake | but I think its still cant be used with https and etc. | 16:55 |
| johnsom | Yeah, there is an lb-mgmt-net that is a "neutron network". There are a number of ways to set that up. Some have existing shared networks, some use provider networks (OSA), others create a dedicated network and bridge ports or route to it. | 16:56 |
| johnsom | born2bake Octavia fully supports TLS. It is required for the command/control connections (over the lb-mgmt-net), and is optional for the tenant load balancers on whatever network they specify for their VIPs. | 16:57 |
| johnsom | born2bake If you have questions about the command/control certificates, there is a detailed guide here: https://docs.openstack.org/octavia/latest/admin/guides/certificates.html | 16:58 |
| johnsom | I assume that is what kolla does when deploying Octavia. | 16:58 |
| openstackgerrit | Brian Haley proposed openstack/octavia master: Allow multiple VIPs per LB https://review.opendev.org/660239 | 16:59 |
| born2bake | Yeah, its just outdated. currently, it only needs cert/private/cakey.pem cert/ca_01.pem cert/client.pem - -b 4.0.1 https://github.com/openstack/octavia.git | 17:00 |
| born2bake | I think its still in process - https://bugs.launchpad.net/kolla-ansible/+bug/1862133 | 17:00 |
| openstack | Launchpad bug 1862133 in kolla-ansible ussuri "octavia train does not work due to the certificates configuration change" [High,In progress] - Assigned to Noboru Iwamatsu (rockpine) | 17:00 |
| johnsom | Hmmm, we didn't change the code really, you can still use a single CA for testing, etc. It's just never been a good practice. | 17:02 |
| johnsom | We certainly did clarify how certificates are used in train though. There seemed to be a bunch of confusion. | 17:03 |
| openstackgerrit | Merged openstack/octavia-dashboard master: Imported Translations from Zanata https://review.opendev.org/718430 | 17:08 |
| *** zasherif has quit IRC | 17:16 | |
| openstackgerrit | Merged openstack/octavia-dashboard master: Fix pyScss version in lower-constraints.txt https://review.opendev.org/716713 | 17:24 |
| openstackgerrit | Brian Haley proposed openstack/octavia master: Allow multiple VIPs per LB https://review.opendev.org/660239 | 17:45 |
| *** maciejjozefczyk has quit IRC | 19:24 | |
| *** vishalmanchanda has quit IRC | 19:32 | |
| *** Trevor_V has joined #openstack-lbaas | 19:48 | |
| *** TrevorV has quit IRC | 19:51 | |
| rm_work | haleyb: so, the followup patch is also pretty necessary, I don't think we really want to plan to merge one and not the other | 20:05 |
| rm_work | haleyb: and it still has an outstanding bug i needed to work with someone (probably johnsom) on, and he's also been super busy | 20:06 |
| rm_work | I don't think it's going to make U | 20:06 |
| rm_work | I would focus on other stuff for now unless you literally just have a ton of free time :D | 20:06 |
| rm_work | cgoncalves: i am trying to understand how noop cert-manager is different from local cert-manager? which was the one previously designed for testing | 20:07 |
| rm_work | but that will actually function | 20:07 |
| *** yamamoto has joined #openstack-lbaas | 20:07 | |
| *** yamamoto has quit IRC | 20:13 | |
| haleyb | rm_work: right, it won't make U, I was just in the rebase mood, but haven't looked-into the failure, probably can't for a couple of weeks | 20:23 |
| rm_work | yeah it probably needs actual work | 20:24 |
| rm_work | i'm in the same boat | 20:24 |
| rm_work | shit internal has been crazy and that is why i have been mostly absent :( | 20:24 |
| rm_work | i need to get back to a point where i can test stuff on that patch again | 20:25 |
| *** zasherif has joined #openstack-lbaas | 20:31 | |
| rm_work | right now my #1 priority (when I can even get to that, over fires) is making octavia's health-manager not trigger failovers when the DB is read-only (right now it only does that if the DB is fully down) | 20:32 |
| johnsom | https://images.app.goo.gl/9HzRwNqCZtdRi4QV6 | 20:34 |
| openstackgerrit | Merged openstack/octavia master: Add ability to specify TLS cipher list for pools https://review.opendev.org/717154 | 20:39 |
| *** zasherif has quit IRC | 20:40 | |
| openstackgerrit | Luke Tollefson proposed openstack/octavia-dashboard master: Add ciphers options for listeners and pools https://review.opendev.org/718550 | 20:42 |
| *** zasherif has joined #openstack-lbaas | 20:44 | |
| *** zasherif has quit IRC | 20:47 | |
| *** zasherif has joined #openstack-lbaas | 21:12 | |
| *** zasherif has quit IRC | 21:16 | |
| *** TrevorV has joined #openstack-lbaas | 21:29 | |
| *** Trevor__V has joined #openstack-lbaas | 21:31 | |
| *** Trevor_V has quit IRC | 21:32 | |
| rm_work | https://github.com/hagleitn/Openstack-Devstack2 :D | 21:33 |
| rm_work | and yes, josh is second most recent committer lol | 21:34 |
| johnsom | Latest commit 88d3eff on Mar 19, 2012 kind of says it alll | 21:34 |
| rm_work | yep :D | 21:34 |
| *** TrevorV has quit IRC | 21:34 | |
| johnsom | That is the kind of repo it would be fun to post a patch to, just to freak all of the old contributors out | 21:35 |
| rm_work | :P | 21:49 |
| rm_work | would have been agood April Fools joke | 21:49 |
| johnsom | Yes! | 21:49 |
| rm_work | maybe next year | 21:49 |
| rm_work | "ok google, remind me on March 29th 2021 to make a PR to devstack2" | 21:50 |
| johnsom | And propose it in governance | 21:50 |
| lxkong | hi johnsom, rm_work, are you able to see the content of https://storyboard.openstack.org/#!/story/2007531? | 22:09 |
| johnsom | lxkong no | 22:09 |
| lxkong | i realized i shouldn't paste the issue in the public channel, so created that security issue | 22:09 |
| johnsom | Thank you | 22:09 |
| johnsom | If it has a task against openstack/octavia and is marked security, we should be able to see it. | 22:10 |
| lxkong | yes, it's an openstack/octavia task | 22:10 |
| johnsom | If not, we can ask in #storyboard to see what is wrong | 22:10 |
| lxkong | anyway, as i menioned to rm_work yersterday, i can offer my help. However after checking the octavia code, the openstack client initialization is hardcoded to use the octavia service user credential, i guess the change will touch many functions. | 22:12 |
| lxkong | i am not sure i have enough time to merge the code asap, as my wife's due day is next week | 22:13 |
| *** zasherif has joined #openstack-lbaas | 22:14 | |
| johnsom | lxkong We should discuss on the story, but I don't think it would be hard to implement on our side. There are complications on the other side however. | 22:14 |
| johnsom | lxkong Congratulations! | 22:14 |
| lxkong | thanks, johnsom :-) | 22:15 |
| *** Trevor__V has quit IRC | 22:16 | |
| *** TrevorV has joined #openstack-lbaas | 22:17 | |
| *** zasherif has quit IRC | 22:22 | |
| rm_work | lxkong: congrats!!! | 22:31 |
| rm_work | hope everything goes well :) | 22:31 |
| *** rcernin has joined #openstack-lbaas | 22:32 | |
| lxkong | rm_work: yeah, it's challenging given the curent COVID-19 situation | 22:32 |
| rm_work | yeah T_T | 22:32 |
| rm_work | hmm yeah i can't see that bug either, will have to ask someone about that | 22:33 |
| johnsom | rm_work It's a storyboard bug, log out and back in and you can see it | 22:34 |
| rm_work | ah k | 22:35 |
| rm_work | yeah will post comments | 22:35 |
| * lxkong goes to a meeting | 22:36 | |
| johnsom | First tip of storyboard. Copy your comment to the clipboard before saving in case it blows up | 22:36 |
| *** TrevorV has quit IRC | 22:50 | |
| *** born2bake has quit IRC | 22:51 | |
| *** threestrands has joined #openstack-lbaas | 23:10 | |
| openstackgerrit | Adam Harwell proposed openstack/octavia master: Add availability-zone to loadbalancer object docs https://review.opendev.org/716358 | 23:24 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!