| *** sdake has quit IRC | 00:00 | |
| *** sdake has joined #openstack-meeting-4 | 00:01 | |
| *** sdake has quit IRC | 00:01 | |
| *** sdake has joined #openstack-meeting-4 | 00:02 | |
| *** sdake has quit IRC | 00:03 | |
| *** sdake has joined #openstack-meeting-4 | 00:04 | |
| *** julim has joined #openstack-meeting-4 | 00:04 | |
| *** dave-mcc_ has joined #openstack-meeting-4 | 00:08 | |
| *** dave-mccowan has quit IRC | 00:10 | |
| *** dave-mcc_ has quit IRC | 00:13 | |
| *** rainya has quit IRC | 00:15 | |
| *** neiljerram has quit IRC | 00:25 | |
| *** salv-orl_ has quit IRC | 00:27 | |
| *** sdake has quit IRC | 00:28 | |
| *** dave-mccowan has joined #openstack-meeting-4 | 00:40 | |
| *** thorst has joined #openstack-meeting-4 | 00:41 | |
| *** thorst has quit IRC | 00:45 | |
| *** thorst has joined #openstack-meeting-4 | 00:46 | |
| *** thorst has quit IRC | 00:46 | |
| *** dave-mccowan has quit IRC | 00:51 | |
| *** SerenaFeng has joined #openstack-meeting-4 | 00:58 | |
| *** limao has joined #openstack-meeting-4 | 00:58 | |
| *** tovin07 has joined #openstack-meeting-4 | 01:27 | |
| *** salv-orlando has joined #openstack-meeting-4 | 01:28 | |
| *** sacharya has joined #openstack-meeting-4 | 01:31 | |
| *** salv-orlando has quit IRC | 01:35 | |
| *** amotoki has joined #openstack-meeting-4 | 01:42 | |
| *** l4yerffeJ_ has joined #openstack-meeting-4 | 01:53 | |
| *** l4yerffeJ has quit IRC | 01:53 | |
| *** armax has joined #openstack-meeting-4 | 02:01 | |
| *** armax has quit IRC | 02:01 | |
| *** zhihui has joined #openstack-meeting-4 | 02:10 | |
| *** nkrinner_afk has quit IRC | 02:12 | |
| *** nkrinner_afk has joined #openstack-meeting-4 | 02:13 | |
| *** hongbin has joined #openstack-meeting-4 | 02:17 | |
| *** Dmitrii-Sh has quit IRC | 02:19 | |
| *** stevemar has quit IRC | 02:21 | |
| *** stevemar has joined #openstack-meeting-4 | 02:21 | |
| *** baoli has joined #openstack-meeting-4 | 02:24 | |
| *** links has joined #openstack-meeting-4 | 02:25 | |
| *** salv-orlando has joined #openstack-meeting-4 | 02:31 | |
| *** salv-orlando has quit IRC | 02:36 | |
| *** links has quit IRC | 02:38 | |
| *** yifei has joined #openstack-meeting-4 | 02:43 | |
| *** links has joined #openstack-meeting-4 | 02:46 | |
| *** thorst has joined #openstack-meeting-4 | 02:47 | |
| *** chandanc_ has joined #openstack-meeting-4 | 02:50 | |
| *** bobh has quit IRC | 02:52 | |
| *** thorst has quit IRC | 02:52 | |
| *** chandanc_ has quit IRC | 02:53 | |
| *** rainya has joined #openstack-meeting-4 | 03:01 | |
| *** dave-mccowan has joined #openstack-meeting-4 | 03:02 | |
| *** dave-mccowan has quit IRC | 03:06 | |
| *** severion has joined #openstack-meeting-4 | 03:10 | |
| *** thorst has joined #openstack-meeting-4 | 03:14 | |
| *** thorst has quit IRC | 03:14 | |
| *** Jeffrey4l_ has quit IRC | 03:21 | |
| *** Jeffrey4l has joined #openstack-meeting-4 | 03:21 | |
| *** dave-mccowan has joined #openstack-meeting-4 | 03:32 | |
| *** salv-orlando has joined #openstack-meeting-4 | 03:32 | |
| *** salv-orlando has quit IRC | 03:36 | |
| *** galstrom_zzz is now known as galstrom | 03:40 | |
| *** galstrom is now known as galstrom_zzz | 03:42 | |
| *** dave-mccowan has quit IRC | 03:45 | |
| *** janki has joined #openstack-meeting-4 | 03:51 | |
| *** julim has quit IRC | 03:53 | |
| *** julim has joined #openstack-meeting-4 | 03:54 | |
| *** julim has quit IRC | 03:58 | |
| *** psachin has joined #openstack-meeting-4 | 04:01 | |
| *** SerenaFeng has quit IRC | 04:01 | |
| *** hongbin has quit IRC | 04:07 | |
| *** hongbin has joined #openstack-meeting-4 | 04:07 | |
| *** cathrich_ has quit IRC | 04:11 | |
| *** hongbin has quit IRC | 04:13 | |
| *** salv-orlando has joined #openstack-meeting-4 | 04:33 | |
| *** baoli has quit IRC | 04:36 | |
| *** salv-orlando has quit IRC | 04:38 | |
| *** nick-ma has joined #openstack-meeting-4 | 04:52 | |
| *** sp__ has joined #openstack-meeting-4 | 04:57 | |
| *** nick-ma has quit IRC | 04:57 | |
| *** Sukhdev has joined #openstack-meeting-4 | 04:59 | |
| *** rainya_ has joined #openstack-meeting-4 | 05:08 | |
| *** amotoki_ has joined #openstack-meeting-4 | 05:09 | |
| *** rainya has quit IRC | 05:09 | |
| *** unicell has joined #openstack-meeting-4 | 05:11 | |
| *** amotoki has quit IRC | 05:12 | |
| *** rainya_ has quit IRC | 05:13 | |
| *** thorst has joined #openstack-meeting-4 | 05:15 | |
| *** severion has quit IRC | 05:18 | |
| *** v1k0d3n has quit IRC | 05:18 | |
| *** thorst has quit IRC | 05:20 | |
| *** sgordon has quit IRC | 05:31 | |
| *** salv-orlando has joined #openstack-meeting-4 | 05:34 | |
| *** v1k0d3n has joined #openstack-meeting-4 | 05:35 | |
| *** sacharya has quit IRC | 05:38 | |
| *** salv-orlando has quit IRC | 05:38 | |
| *** sacharya has joined #openstack-meeting-4 | 05:39 | |
| *** sgordon has joined #openstack-meeting-4 | 05:39 | |
| *** SerenaFeng has joined #openstack-meeting-4 | 05:45 | |
| *** v1k0d3n has quit IRC | 05:48 | |
| *** v1k0d3n has joined #openstack-meeting-4 | 05:49 | |
| *** Sukhdev has quit IRC | 05:50 | |
| *** bobh has joined #openstack-meeting-4 | 05:55 | |
| *** bobh has quit IRC | 05:59 | |
| *** rainya has joined #openstack-meeting-4 | 06:10 | |
| *** rainya has quit IRC | 06:15 | |
| *** unicell has quit IRC | 06:22 | |
| *** madhuri has joined #openstack-meeting-4 | 06:25 | |
| *** madhuri has quit IRC | 06:25 | |
| *** yfauser has joined #openstack-meeting-4 | 06:32 | |
| *** yfauser has joined #openstack-meeting-4 | 06:33 | |
| *** salv-orlando has joined #openstack-meeting-4 | 06:35 | |
| *** nick-ma has joined #openstack-meeting-4 | 06:36 | |
| *** salv-orlando has quit IRC | 06:39 | |
| *** karthiks has joined #openstack-meeting-4 | 06:47 | |
| *** sp__ has quit IRC | 06:48 | |
| *** greghaynes has quit IRC | 06:52 | |
| *** mordred has quit IRC | 06:53 | |
| *** greghaynes has joined #openstack-meeting-4 | 06:59 | |
| *** mordred has joined #openstack-meeting-4 | 07:03 | |
| *** greghaynes has quit IRC | 07:04 | |
| *** yamamoto has quit IRC | 07:04 | |
| *** greghaynes has joined #openstack-meeting-4 | 07:15 | |
| *** thorst has joined #openstack-meeting-4 | 07:16 | |
| *** thorst has quit IRC | 07:21 | |
| *** hogepodge_ has joined #openstack-meeting-4 | 07:24 | |
| *** nkrinner_afk is now known as nkrinner | 07:24 | |
| *** pcaruana has joined #openstack-meeting-4 | 07:34 | |
| *** salv-orlando has joined #openstack-meeting-4 | 07:36 | |
| *** hogepodge_ has quit IRC | 07:37 | |
| *** marst has quit IRC | 07:40 | |
| *** marst has joined #openstack-meeting-4 | 07:40 | |
| *** salv-orlando has quit IRC | 07:40 | |
| *** ralonsoh has joined #openstack-meeting-4 | 07:43 | |
| *** ricolin has joined #openstack-meeting-4 | 07:44 | |
| *** Dmitrii-Sh has joined #openstack-meeting-4 | 07:44 | |
| *** amirv has joined #openstack-meeting-4 | 07:47 | |
| *** barmaley has joined #openstack-meeting-4 | 07:50 | |
| *** nick-ma has quit IRC | 08:00 | |
| *** zhurong has joined #openstack-meeting-4 | 08:05 | |
| *** SerenaFeng has quit IRC | 08:05 | |
| *** _degorenko|afk is now known as degorenko | 08:07 | |
| *** amotoki has joined #openstack-meeting-4 | 08:07 | |
| *** nick-ma has joined #openstack-meeting-4 | 08:09 | |
| *** amotoki_ has quit IRC | 08:11 | |
| *** rainya has joined #openstack-meeting-4 | 08:12 | |
| *** rainya has quit IRC | 08:16 | |
| *** idan_hefetz has joined #openstack-meeting-4 | 08:29 | |
| *** nick-ma has quit IRC | 08:32 | |
| *** alexchadin has joined #openstack-meeting-4 | 08:34 | |
| *** adisky_ has joined #openstack-meeting-4 | 08:35 | |
| *** nick-ma has joined #openstack-meeting-4 | 08:36 | |
| *** salv-orlando has joined #openstack-meeting-4 | 08:37 | |
| *** salv-orlando has quit IRC | 08:41 | |
| *** matrohon has joined #openstack-meeting-4 | 08:42 | |
| *** sdake has joined #openstack-meeting-4 | 08:52 | |
| *** sdake_ has joined #openstack-meeting-4 | 09:00 | |
| yuli_s | hi | 09:00 |
|---|---|---|
| *** hshan has joined #openstack-meeting-4 | 09:00 | |
| *** rajivk has joined #openstack-meeting-4 | 09:00 | |
| oanson | #startmeeting Dragonflow | 09:00 |
| openstack | Meeting started Mon Jan 16 09:00:52 2017 UTC and is due to finish in 60 minutes. The chair is oanson. Information about MeetBot at http://wiki.debian.org/MeetBot. | 09:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 09:00 |
| *** openstack changes topic to " (Meeting topic: Dragonflow)" | 09:00 | |
| openstack | The meeting name has been set to 'dragonflow' | 09:00 |
| dimak | Good morning | 09:01 |
| lihi | Hi | 09:01 |
| *** SerenaFeng has joined #openstack-meeting-4 | 09:01 | |
| hshan | hi~ | 09:01 |
| rajivk | Hi | 09:01 |
| *** ishafran has joined #openstack-meeting-4 | 09:01 | |
| *** qwebirc27203 has joined #openstack-meeting-4 | 09:01 | |
| oanson | Al right. Let's begin | 09:01 |
| irenab | hi | 09:01 |
| oanson | Actually, before we begin. | 09:01 |
| *** qwebirc27203 is now known as itamaro | 09:01 | |
| *** amirv has quit IRC | 09:01 | |
| itamaro | hi | 09:01 |
| oanson | Please note that our gate is broken again :) | 09:01 |
| *** sdake has quit IRC | 09:02 | |
| oanson | Looks like Neutron removed the tenant_id from their objects. | 09:02 |
| oanson | I think it's from patch https://review.openstack.org/#/c/382659 | 09:03 |
| oanson | I am looking at it, but if anyone has any info, please share :) | 09:03 |
| oanson | Now we can begin. | 09:03 |
| dimak | I'll look into it :) | 09:03 |
| oanson | #info dimak lihi hshan rajivk irenab itamaro in meeting | 09:03 |
| ishafran | me too | 09:04 |
| oanson | dimak, note I uploaded a test here: https://review.openstack.org/420587 but it's just a test | 09:04 |
| oanson | #info ishafran is also in meeting | 09:04 |
| oanson | #topic roadmap | 09:04 |
| *** openstack changes topic to "roadmap (Meeting topic: Dragonflow)" | 09:04 | |
| oanson | IPv6. lihi, the floor is yours | 09:04 |
| lihi | I've stopped working on the Router Discovery for now. I'm having issues detecting the socilitations when there are multiple routers, and advertising the same response as the periodic router advertisemts messages. | 09:04 |
| lihi | So I've started to work on the DHCPv6 | 09:04 |
| yuli_s | oanson, i think they use project_id instead of tenant_id | 09:05 |
| irenab | lihi: can you please elaborate on the issues you see | 09:05 |
| oanson | yuli_s, yes. I gathered that too. That's what I put in the test | 09:05 |
| yuli_s | ok | 09:05 |
| nick-ma | hi | 09:06 |
| oanson | nick-ma, hi | 09:06 |
| oanson | #info nick-ma also in meeting | 09:06 |
| lihi | The requests are sent to the broadcast link local address, and I can't build the response in the flows the same way I did in the flows. | 09:07 |
| lihi | I still need to think how to do it properly | 09:07 |
| irenab | how does it work with ref. impementation? | 09:08 |
| oanson | irenab, I don't think ref implementation uses responders | 09:08 |
| *** matrohon has quit IRC | 09:09 | |
| oanson | lihi, I am not sure I understand the issues you're running into | 09:09 |
| lihi | All the requests are send to the broadcast linklocal address. The address is the same for all routers | 09:09 |
| lihi | Usually, each router that receives the messages response. | 09:10 |
| oanson | You can detect your network using the 'metadata' field in OVS | 09:10 |
| oanson | This way you know which router interfaces need to respond | 09:10 |
| lihi | OK, I will look into it | 09:11 |
| lihi | I wasn't sure what to do, so I've started working on the DHCPv6 in the meanwhile. But I think this might help | 09:12 |
| oanson | Both directions are important | 09:12 |
| lihi | yeah I know :) | 09:12 |
| oanson | All right | 09:13 |
| oanson | If you have any issues, feel free to ask in the channel | 09:13 |
| oanson | NB refactor | 09:13 |
| oanson | dimak, you want to update? | 09:13 |
| dimak | Yeah | 09:13 |
| dimak | I think we are starting to have a better picture of how everything should look and be used | 09:14 |
| oanson | All right. | 09:14 |
| dimak | I've talked to Irena and Omer and we decided to try dropping CRUD layer\ | 09:14 |
| dimak | And add custom functionality to NB api operations with hooks | 09:15 |
| dimak | we still have to update the spec (if we see that it works well for us) | 09:15 |
| dimak | Other than that, jsonmodels requirements is in! | 09:15 |
| lihi | What was the issue with CRUD? | 09:16 |
| dimak | I've asked library maintainer to roll out a version with my changes into PyPI | 09:16 |
| dimak | We tried to add CRUD logic to each model | 09:16 |
| oanson | All right. I'll update the spec probably tomorrow. I'd ask that you'd all vote so we can get it in | 09:17 |
| dimak | And we wanted to add shared model functionality with mixins | 09:17 |
| *** thorst has joined #openstack-meeting-4 | 09:17 | |
| dimak | (e.g. Mixin that adds unique key or version fields) | 09:17 |
| dimak | And some fields might require special treatment in CRUD layer | 09:17 |
| oanson | Anything else for NB refactor? | 09:18 |
| dimak | But if we add a CRUD layer to each mixin that requires it, and then use several mixins, deciding on ordering that CRUDs are called are not that simple or readable | 09:18 |
| dimak | Be patient :P | 09:18 |
| oanson | Sorry. Didn't know you had such a big buffer | 09:18 |
| oanson | You should limit your mtu :) | 09:19 |
| dimak | We though of exploring hooks because they sit on the models/mixins themselves and obey to super() rules | 09:19 |
| dimak | lihi, I can draw up some more elaborate example with code why we wanted to avoid CRUD layer when using mixins | 09:20 |
| *** amirv has joined #openstack-meeting-4 | 09:20 | |
| itamaro | I will be glad to sit in too | 09:20 |
| itamaro | :) | 09:20 |
| nick-ma | it may be better to update the spec along with these pictures. | 09:21 |
| dimak | Other than that, I want to see if the chassis refactor works (fullstack-wise) | 09:21 |
| lihi | yeah, that would be nice | 09:21 |
| irenab | lihi: in short it required to count on the model inheritance order, which is really bad practice | 09:21 |
| lihi | ok, makes sense | 09:21 |
| *** thorst has quit IRC | 09:22 | |
| oanson | dimak, could you prepare these diagrams, I'll add them to the spec? | 09:22 |
| dimak | Sure | 09:22 |
| dimak | I'll post them in #dragonflow too to facilitate some discussion :) | 09:22 |
| dimak | Oh | 09:23 |
| dimak | jsonmodels maintaner just pushed a new version :) | 09:23 |
| oanson | Great! | 09:23 |
| lihi | :) | 09:23 |
| irenab | looks like you are their super user :-) | 09:23 |
| nick-ma | good news. | 09:24 |
| nick-ma | ~ | 09:24 |
| oanson | All right. dimak, is there any more? | 09:24 |
| dimak | I think thats all | 09:24 |
| oanson | Chassis | 09:24 |
| oanson | Chassis health | 09:24 |
| oanson | rajivk, anything to update? | 09:25 |
| rajivk | I have put patch for it. | 09:25 |
| oanson | This one: https://review.openstack.org/#/c/415997/ ? | 09:25 |
| rajivk | yes | 09:25 |
| rajivk | Once i get enough comment and it get freeze. | 09:26 |
| rajivk | I will add UT and commands of df-db to service enable and disable. | 09:26 |
| rajivk | Do you think, current patch is ok or does it require major changes? | 09:26 |
| oanson | From what I saw, there are a few minor things | 09:27 |
| dimak | rajivk, I think df-db is getting a bit too overloaded | 09:27 |
| oanson | dimak, on the other hand, your work should fix that :) | 09:27 |
| rajivk | I think, there is a specs for dragonflow-api. | 09:27 |
| oanson | And that is the only CLI utility we have for the moment | 09:27 |
| rajivk | may be i should add API directly in that specs. | 09:28 |
| oanson | Yes. This should be a model-API | 09:28 |
| dimak | oanson, we can just rename it to df-client or something 😉 | 09:28 |
| irenab | so ‘service’ will be a model object? | 09:28 |
| rajivk | yes | 09:28 |
| oanson | IIRC, that's how it is in the spec | 09:28 |
| rajivk | dimak, +1 | 09:29 |
| rajivk | I think, df-db will become too complex soon. | 09:29 |
| rajivk | If we keep on adding functionality. | 09:29 |
| irenab | dimak: df-client will be confising, we will need it once add proper API | 09:30 |
| nick-ma | i suggest to add a subproject named python-dfclient for the api spec. | 09:30 |
| oanson | The CLI requirement is in the API spec. I think df-db will become a troiubleshooting tool. And we will have a cli client for the northbound stuff | 09:30 |
| oanson | Not a bad idea | 09:30 |
| irenab | nick-ma: please check the spec and post comments for what you think is missing | 09:30 |
| nick-ma | but it is just cli implementation. | 09:31 |
| nick-ma | the api is belonging to df project as the rest layer. | 09:31 |
| nick-ma | irenab: sure. | 09:31 |
| oanson | In general, maybe we should start splitting things off into smaller subprojects. e.g. specific database drivers, external applications (once the NB refactor is complete) | 09:31 |
| rajivk | we will have to integrate with keystone as well. | 09:31 |
| nick-ma | project splitting is another big topic to discuss. | 09:31 |
| rajivk | If we provide support for APIs. | 09:31 |
| nick-ma | maybe in another spec. | 09:31 |
| oanson | nick-ma, that's something I wanted cleared up - is the API REST, or a python library with REST on top? | 09:32 |
| irenab | oanson: by subpojects you mean diferent repos? | 09:32 |
| oanson | irenab, ^^^^ | 09:32 |
| irenab | 09:32 | |
| oanson | Like Neutron have a stadium, we'll have a... errr.. theatre... | 09:32 |
| nick-ma | oanson: in my opinion, it should be the standard api framework as nova, cinder, etc. | 09:32 |
| nick-ma | rest api with python library. | 09:32 |
| oanson | You mean REST, and the CLI client will send REST requests to the API? | 09:32 |
| irenab | oanson: we need to have both, REST API and pythion clinet | 09:33 |
| oanson | nick-ma, beat me to it :) | 09:33 |
| nick-ma | irenab: yes | 09:33 |
| oanson | irenab, no argument. I wanted to verify where everything connects | 09:33 |
| irenab | oanson: will upload the updated spec version soon, hope it will get more clear | 09:34 |
| nick-ma | ok. | 09:34 |
| oanson | irenab, great, thanks! | 09:34 |
| oanson | rajivk, one more questions: How do you plan to do the UT? | 09:34 |
| *** sshnaidm|off is now known as sshnaidm | 09:35 | |
| oanson | And do you plan to add fullstack tests? | 09:35 |
| rajivk | No, idea. Give me ideas :) | 09:36 |
| rajivk | Which is the best for the project? | 09:36 |
| oanson | I guess you could set up something inheriting Service, and see if the NB database is updated (fullstack test) | 09:36 |
| rajivk | ok, i will start looking at it. | 09:37 |
| oanson | Thanks. This can be done as a separate patch if you'd like, since the main patch already seems to be very advanced | 09:37 |
| rajivk | ok, i will do it in other patch. | 09:37 |
| *** salv-orlando has joined #openstack-meeting-4 | 09:37 | |
| *** zhurong has quit IRC | 09:37 | |
| oanson | Great. Thanks! | 09:38 |
| oanson | Anything else on this topic? | 09:38 |
| rajivk | no, that's all. | 09:38 |
| oanson | TAPaaS - yuli_s, any updates? | 09:38 |
| yuli_s | Yes | 09:38 |
| yuli_s | today I submitted first patch | 09:38 |
| yuli_s | to make ids more sparse | 09:38 |
| oanson | Looks promising. | 09:39 |
| yuli_s | after that I will start to other parts | 09:39 |
| yuli_s | ;) | 09:39 |
| oanson | Great. Only downside is that I now need to re-memorise all the table numbers :) | 09:40 |
| yuli_s | we use constants in code, so, I guess it will not be that hard | 09:40 |
| rajivk | I saw one constants, can we make enums? | 09:41 |
| oanson | Yes. If we behaved well, this patch should go very smoothly. | 09:41 |
| *** sgordon has quit IRC | 09:41 | |
| yuli_s | I am also working on submitting the rally project I mare | 09:41 |
| yuli_s | I am also working on submitting the rally project I was working on too | 09:41 |
| *** sdake_ has quit IRC | 09:41 | |
| oanson | rajivk, sure. What are the benefits? | 09:42 |
| oanson | yuli_s, great! | 09:42 |
| itamaro | Would you like to discuss how we can do connectivity tests using naitive DF api only (openstack less)? | 09:42 |
| *** salv-orlando has quit IRC | 09:42 | |
| yuli_s | rajivk, send you comments in the patch, I think we will continue from their | 09:42 |
| rajivk | ok | 09:43 |
| yuli_s | rajivk, https://review.openstack.org/#/c/420602/ | 09:43 |
| irenab | itamaro: native API is only speced now | 09:43 |
| oanson | itamaro, yes, but let's wait for the open discussion | 09:43 |
| irenab | # link https://review.openstack.org/#/c/418842/ | 09:43 |
| itamaro | tests are not even there | 09:43 |
| itamaro | ok | 09:44 |
| oanson | sNAT application | 09:44 |
| *** yifei has quit IRC | 09:44 | |
| oanson | ishafran, any updates? | 09:44 |
| oanson | Please note that the patch is here: https://review.openstack.org/#/c/417799/ | 09:44 |
| ishafran | I posted first implementation + UT on review | 09:44 |
| ishafran | Since then no update | 09:45 |
| oanson | All right. I left some comments there. Please review. | 09:45 |
| ishafran | ok | 09:46 |
| *** asettle has joined #openstack-meeting-4 | 09:46 | |
| oanson | Did you get a chance to try what I suggested regarding passing the zone as an immediate value (and not via the regs)? | 09:46 |
| oanson | I'm curious to know if that worked and could be done | 09:46 |
| *** asettle is now known as Guest58506 | 09:46 | |
| oanson | Please also rebase the spec, so that we can vote on it | 09:46 |
| ishafran | my environment is broken now due to rebase to DF master, so still not tried it | 09:47 |
| oanson | All right. Please keep me posted - as I said, I am very curious :) | 09:47 |
| ishafran | ok | 09:47 |
| oanson | Anything else on sNAT? | 09:47 |
| oanson | Anything else for roadmap? | 09:47 |
| irenab | oanson: any update on LBaaS or vlan amware VMs? | 09:48 |
| oanson | No update on LBaaS. It's looking for a carrier | 09:48 |
| rajivk | I am going through specs | 09:48 |
| oanson | rajivk, that's for VLAN aware VMs, right? | 09:48 |
| rajivk | yes. I am checking how it can be done in dragonflow. | 09:48 |
| rajivk | Currently, how vlans etc work and then map implementation from neutron to dragonflow | 09:49 |
| *** sgordon has joined #openstack-meeting-4 | 09:49 | |
| rajivk | I will discuss on IRC, if i need information. | 09:49 |
| irenab | rajivk: thanks for update | 09:49 |
| oanson | Anything else? | 09:50 |
| rajivk | not from my side. | 09:50 |
| oanson | #topic Bugs | 09:50 |
| *** openstack changes topic to "Bugs (Meeting topic: Dragonflow)" | 09:50 | |
| oanson | Just a quick update here: nick-ma posted some workarounds for the critical bug 1651643 | 09:51 |
| openstack | bug 1651643 in DragonFlow "metadata service cannot start due to zmq binding conflict" [High,In progress] https://launchpad.net/bugs/1651643 - Assigned to Li Ma (nick-ma-z) | 09:51 |
| oanson | It is now reduced to High. | 09:51 |
| oanson | nick-ma, thanks! | 09:51 |
| oanson | Also thanks to xiaohhui for quickly fixing the broken gate last time. The gate was stable for a whole day before Neutron broke it again :D | 09:51 |
| nick-ma | you are welcome. the bug has not been closed yet. | 09:51 |
| irenab | oanson: its good to have gate watching | 09:52 |
| oanson | Yes, but it is no longer Critical. That's not to be ignored. | 09:52 |
| nick-ma | yes. | 09:53 |
| oanson | irenab, not sure what to do on this front. Maybe I'll ask Neutron to add a Dragonflow check, but I don't know if they'll approve | 09:53 |
| *** sambetts|afk is now known as sambetts | 09:53 | |
| *** Guest58506 has quit IRC | 09:53 | |
| irenab | not sure if this change was communcated well enough, we should have not got by suprise | 09:54 |
| oanson | I think I'll free up some time and start watching the Neutron changes. | 09:55 |
| oanson | At least we'll know what could have broken the gate when it happens, rather than go looking for it in retrospect | 09:55 |
| irenab | oanson: bot is less expensive :-) | 09:55 |
| oanson | Not sure a bot can do that. | 09:55 |
| oanson | No matter. Let's move on. | 09:56 |
| nick-ma | yes. | 09:56 |
| oanson | #topic Open Discussion | 09:56 |
| *** openstack changes topic to "Open Discussion (Meeting topic: Dragonflow)" | 09:56 | |
| oanson | Floor is for the taking. | 09:56 |
| nick-ma | do you guys go to project gathering? | 09:56 |
| oanson | I plan on attending, yes. | 09:56 |
| oanson | (I think I have to :D ) | 09:56 |
| nick-ma | cool, I don't have opportunity to attend, :-( | 09:57 |
| oanson | That's a shame. We'll miss you | 09:57 |
| nick-ma | :-) | 09:57 |
| oanson | Anyone else coming to the PTG? | 09:58 |
| oanson | Not all at once :( | 09:58 |
| rajivk | no | 09:58 |
| oanson | I have to admit, this isn't very surprising when it's split from the summit | 09:59 |
| oanson | All right. That's our time. | 10:00 |
| oanson | Thanks everyone for coming. Thanks for the great work! | 10:00 |
| oanson | #endmeeting | 10:00 |
| *** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings" | 10:00 | |
| openstack | Meeting ended Mon Jan 16 10:00:20 2017 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 10:00 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/dragonflow/2017/dragonflow.2017-01-16-09.00.html | 10:00 |
| yuli_s | thanks ! | 10:00 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/dragonflow/2017/dragonflow.2017-01-16-09.00.txt | 10:00 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/dragonflow/2017/dragonflow.2017-01-16-09.00.log.html | 10:00 |
| *** ishafran has quit IRC | 10:01 | |
| *** amotoki has quit IRC | 10:01 | |
| *** nick-ma has quit IRC | 10:02 | |
| *** anilvenkata has joined #openstack-meeting-4 | 10:03 | |
| *** limao has quit IRC | 10:07 | |
| *** amotoki has joined #openstack-meeting-4 | 10:08 | |
| *** zhurong has joined #openstack-meeting-4 | 10:08 | |
| *** dtardivel has joined #openstack-meeting-4 | 10:10 | |
| *** rainya has joined #openstack-meeting-4 | 10:14 | |
| *** rainya has quit IRC | 10:18 | |
| *** amotoki has quit IRC | 10:24 | |
| *** yifei has joined #openstack-meeting-4 | 10:32 | |
| *** yifei has quit IRC | 10:36 | |
| *** salv-orlando has joined #openstack-meeting-4 | 10:38 | |
| *** salv-orlando has quit IRC | 10:43 | |
| *** pbourke has quit IRC | 10:47 | |
| *** pbourke has joined #openstack-meeting-4 | 10:48 | |
| *** neiljerram has joined #openstack-meeting-4 | 10:51 | |
| *** SerenaFeng has quit IRC | 10:52 | |
| *** SerenaFeng has joined #openstack-meeting-4 | 10:52 | |
| *** asettle has joined #openstack-meeting-4 | 10:53 | |
| *** asettle has quit IRC | 10:54 | |
| *** asettle has joined #openstack-meeting-4 | 10:59 | |
| *** asettle__ has joined #openstack-meeting-4 | 11:01 | |
| *** asettle has quit IRC | 11:01 | |
| *** rfolco has joined #openstack-meeting-4 | 11:05 | |
| *** asettle__ has quit IRC | 11:10 | |
| *** ricolin has quit IRC | 11:11 | |
| *** asettle has joined #openstack-meeting-4 | 11:11 | |
| *** asettle is now known as Guest74297 | 11:11 | |
| *** SerenaFeng has quit IRC | 11:14 | |
| *** SerenaFeng has joined #openstack-meeting-4 | 11:14 | |
| *** Guest74297 has quit IRC | 11:17 | |
| *** thorst has joined #openstack-meeting-4 | 11:18 | |
| *** rajivk has left #openstack-meeting-4 | 11:18 | |
| *** SerenaFeng has quit IRC | 11:18 | |
| *** thorst has quit IRC | 11:23 | |
| *** iyamahat has joined #openstack-meeting-4 | 11:23 | |
| *** sshnaidm is now known as sshnaidm|afk | 11:24 | |
| *** iyamahat has quit IRC | 11:29 | |
| *** amotoki has joined #openstack-meeting-4 | 11:37 | |
| *** salv-orlando has joined #openstack-meeting-4 | 11:39 | |
| *** salv-orlando has quit IRC | 11:43 | |
| *** yfauser has quit IRC | 11:47 | |
| *** asettle_ has joined #openstack-meeting-4 | 11:50 | |
| *** asettle_ is now known as asettle | 11:52 | |
| *** jamespage has joined #openstack-meeting-4 | 12:04 | |
| *** amirv has quit IRC | 12:07 | |
| *** rtheis has joined #openstack-meeting-4 | 12:07 | |
| *** rainya has joined #openstack-meeting-4 | 12:15 | |
| *** janki has quit IRC | 12:18 | |
| *** rainya has quit IRC | 12:20 | |
| *** janki has joined #openstack-meeting-4 | 12:20 | |
| *** sdague has joined #openstack-meeting-4 | 12:22 | |
| *** khushbu_ has joined #openstack-meeting-4 | 12:37 | |
| *** salv-orlando has joined #openstack-meeting-4 | 12:40 | |
| *** klamath has joined #openstack-meeting-4 | 12:44 | |
| *** klamath has quit IRC | 12:44 | |
| *** salv-orlando has quit IRC | 12:44 | |
| *** thorst has joined #openstack-meeting-4 | 12:45 | |
| *** klamath has joined #openstack-meeting-4 | 12:45 | |
| *** salv-orlando has joined #openstack-meeting-4 | 12:46 | |
| *** janki has quit IRC | 12:58 | |
| *** julim has joined #openstack-meeting-4 | 12:59 | |
| *** bobh has joined #openstack-meeting-4 | 13:00 | |
| *** zhurong has quit IRC | 13:03 | |
| *** bobh has quit IRC | 13:04 | |
| *** janki has joined #openstack-meeting-4 | 13:06 | |
| *** matrohon has joined #openstack-meeting-4 | 13:07 | |
| *** beagles_afk is now known as beagles | 13:08 | |
| *** SerenaFeng has joined #openstack-meeting-4 | 13:11 | |
| *** khushbu_ has quit IRC | 13:16 | |
| *** l4yerffeJ_ has quit IRC | 13:19 | |
| *** l4yerffeJ_ has joined #openstack-meeting-4 | 13:19 | |
| *** sshnaidm|afk is now known as sshnaidm | 13:30 | |
| *** gnuoy has quit IRC | 13:32 | |
| *** psachin has quit IRC | 13:34 | |
| *** janki has quit IRC | 13:38 | |
| *** sdake has joined #openstack-meeting-4 | 13:40 | |
| *** baoli has joined #openstack-meeting-4 | 13:45 | |
| *** salv-orlando has quit IRC | 13:46 | |
| *** limao has joined #openstack-meeting-4 | 13:49 | |
| *** sacharya has quit IRC | 13:52 | |
| *** amirv has joined #openstack-meeting-4 | 13:52 | |
| *** julim has quit IRC | 13:55 | |
| *** yedongcan has joined #openstack-meeting-4 | 13:55 | |
| *** mchiappero has joined #openstack-meeting-4 | 13:55 | |
| *** dougbtv has joined #openstack-meeting-4 | 13:55 | |
| *** l4yerffeJ_ has quit IRC | 13:58 | |
| *** l4yerffeJ_ has joined #openstack-meeting-4 | 13:59 | |
| *** baoli has quit IRC | 13:59 | |
| *** limao has quit IRC | 14:00 | |
| *** l4yerffeJ_ has quit IRC | 14:00 | |
| apuimedo | #startmeeting kuryr | 14:00 |
| openstack | Meeting started Mon Jan 16 14:00:50 2017 UTC and is due to finish in 60 minutes. The chair is apuimedo. Information about MeetBot at http://wiki.debian.org/MeetBot. | 14:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 14:00 |
| *** openstack changes topic to " (Meeting topic: kuryr)" | 14:00 | |
| openstack | The meeting name has been set to 'kuryr' | 14:00 |
| *** l4yerffeJ_ has joined #openstack-meeting-4 | 14:00 | |
| *** garyloug has joined #openstack-meeting-4 | 14:01 | |
| *** ivc_ has joined #openstack-meeting-4 | 14:01 | |
| apuimedo | Hello and welcome everybody to another Kuryr weekly IRC meeting | 14:01 |
| garyloug | o/ | 14:01 |
| ivc_ | o/ | 14:01 |
| yedongcan | o/ | 14:01 |
| apuimedo | Today vikasc and irenab have excused themselves and won't be able to join | 14:01 |
| mchiappero | o/ | 14:01 |
| apuimedo | #topic kuryr-lib | 14:02 |
| *** openstack changes topic to "kuryr-lib (Meeting topic: kuryr)" | 14:02 | |
| *** limao has joined #openstack-meeting-4 | 14:02 | |
| *** alraddarla has joined #openstack-meeting-4 | 14:03 | |
| alraddarla | o/ | 14:03 |
| apuimedo | There's basically no news on kuryr-lib :-) | 14:03 |
| apuimedo | No news, good news | 14:03 |
| apuimedo | as they say | 14:03 |
| apuimedo | only this patch | 14:03 |
| apuimedo | #link https://review.openstack.org/#/c/418792/ | 14:03 |
| apuimedo | which pisses me off a bit that came so late | 14:04 |
| apuimedo | but... What can we do, we merge it now and we'll consider if we do a point release to get the requirement upped | 14:04 |
| ltomasbo | o/ | 14:05 |
| *** cathrichardson has joined #openstack-meeting-4 | 14:05 | |
| apuimedo | Anybody's got anything on kuryr-lib? | 14:05 |
| apuimedo | very well! | 14:06 |
| apuimedo | Moving on | 14:06 |
| apuimedo | #topic kuryr-libnetwokr | 14:06 |
| *** openstack changes topic to "kuryr-libnetwokr (Meeting topic: kuryr)" | 14:06 | |
| apuimedo | darn!!! | 14:06 |
| apuimedo | typo | 14:06 |
| mchiappero | eheh | 14:06 |
| apuimedo | #topic kuryr-libnetwork | 14:06 |
| *** openstack changes topic to "kuryr-libnetwork (Meeting topic: kuryr)" | 14:06 | |
| apuimedo | ltomasbo: can you update us on the race? | 14:07 |
| ltomasbo | Hi | 14:07 |
| ltomasbo | the problem is that, after calling to attach the (sub)port to the trunk | 14:07 |
| ltomasbo | we (kuryr-libnetwork) calls update_port | 14:07 |
| ltomasbo | and it seems attach_subport also calls update_port internally | 14:07 |
| ltomasbo | therefore, there is a race there | 14:08 |
| ltomasbo | and something me device_owner is not properly set | 14:08 |
| ltomasbo | which makes kuryr-libnetwork not able to remove the port after removing the container | 14:08 |
| *** cathrich_ has joined #openstack-meeting-4 | 14:08 | |
| ltomasbo | since there is a filter by deviceowner before removing the port | 14:08 |
| apuimedo | #link https://review.openstack.org/#/c/419028/ | 14:09 |
| *** idan_hefetz has quit IRC | 14:09 | |
| ltomasbo | I've been discussing with armax about the possibility of reverting the patch that set device_owner for trunk ports | 14:09 |
| *** baoli has joined #openstack-meeting-4 | 14:09 | |
| ltomasbo | another easy fix could ve to remove the device_owner filter we do on ipam_release before calling the remove_port | 14:10 |
| *** cathrich_ has left #openstack-meeting-4 | 14:10 | |
| apuimedo | #info there is a race in container-in-VM flow due to subport addition usage of device owner | 14:10 |
| mchiappero | I'm sorry, but I'm not sure I've understood the root cause of the race | 14:11 |
| apuimedo | ltomasbo: it is kind of a nice service we provide our users to mark which ports we manage for them automatically | 14:11 |
| ltomasbo | apuimedo, yes, I agree | 14:11 |
| apuimedo | so we should try to preserve it as much as possible | 14:11 |
| *** mattmceuen has joined #openstack-meeting-4 | 14:11 | |
| apuimedo | mchiappero: basically we update the device:owner field to container:kuryr | 14:11 |
| ltomasbo | the problem is that, the patch I proposed to revert is setting a different device_owner to the subports | 14:11 |
| apuimedo | and the trunk_subport_add does the same behind the scene | 14:11 |
| *** cathrichardson has quit IRC | 14:12 | |
| ltomasbo | therefore we call attach_subport and then update_port | 14:12 |
| ltomasbo | but attach_subport internally calls to update_port too | 14:12 |
| apuimedo | so IIRC, if the trunk_subport_add op finds it changed before it finishes, it goes boom. Is that right ltomasbo? | 14:12 |
| ltomasbo | and both update_ports set a different device_owner | 14:12 |
| *** aheczko-mirantis has joined #openstack-meeting-4 | 14:12 | |
| apuimedo | or is it only that it breaks our removal? | 14:12 |
| ltomasbo | we need to call first trunk_subport_add and then update_port | 14:13 |
| ltomasbo | since trunk_subport_add will fail if device_id is already set in the port | 14:13 |
| ltomasbo | butn trunk_subport_add also calls update_port to set the device_owner to trunk:subport | 14:13 |
| *** dave-mccowan has joined #openstack-meeting-4 | 14:14 | |
| ltomasbo | while we call update_port from kuryr-libnetwork to set device_owner to kuryr:container | 14:14 |
| ivc_ | ltomasbo wait a sec, if trunk_subport_add fails, does that mean that it does not support device_id? or is it a bug in neutron? | 14:14 |
| ltomasbo | with the current implementation, there is no problem with device_id, as we call first trunk_subport_add | 14:14 |
| ltomasbo | the problem is that, as device_owner is not set to kuryr:container | 14:14 |
| ltomasbo | the port will not be deleted after the container is removed | 14:15 |
| ltomasbo | and, the fact that turnk_subport_add fails if device_id is already set is not a bug | 14:15 |
| ivc_ | what is the device_owner then? if not 'kuryr:container'? | 14:15 |
| ltomasbo | is the way it should work | 14:15 |
| ltomasbo | if the port is already in used, it should not be made part of a trunk | 14:15 |
| *** janki has joined #openstack-meeting-4 | 14:16 | |
| apuimedo | ivc_: no, it is trunk:subport | 14:16 |
| ltomasbo | device_owner is set to trunk:subport | 14:16 |
| apuimedo | sometimes, depending on the race | 14:16 |
| ivc_ | apuimedo thats what i see as the problem. neutron trunk code set it to 'trunk:subport' and we reset it to 'kuryr:container', right? | 14:16 |
| ivc_ | i think we are breaking some neutron contract here | 14:16 |
| apuimedo | ivc_: I think so | 14:16 |
| apuimedo | no, no contract | 14:17 |
| ltomasbo | yes | 14:17 |
| mchiappero | yes, no? :D | 14:17 |
| apuimedo | they only set it to trunk:subport for no specific reason | 14:17 |
| ltomasbo | they just tagged subports to kuryr:container for simplicity | 14:17 |
| ltomasbo | there is no real need for that on neutron | 14:17 |
| *** rainya has joined #openstack-meeting-4 | 14:17 | |
| ivc_ | neutron might expect it to be 'trunk:subport' | 14:17 |
| ivc_ | maybe it's not used now, but we should not rely on it | 14:17 |
| apuimedo | ivc_: mchiappero: "Altough this is not currently required by any of the business logic, it is handy to have this set to help users quickly identify ports used in trunks" | 14:17 |
| apuimedo | This is the justification for setting trunk:subport in the original patch | 14:18 |
| apuimedo | nothing uses this fact | 14:18 |
| ivc_ | 'currently' | 14:18 |
| apuimedo | ivc_: this 'currently' has not changed | 14:18 |
| apuimedo | and there's no good reason it should | 14:18 |
| ivc_ | at some point neutron could add the business logic that would rely on it | 14:18 |
| mchiappero | I agree with using kuryr as device owner, but still, I don't fully understand whether it's a timing issue or what | 14:18 |
| ltomasbo | we can modify (I'm waiting for Armax answer) the way trunk_subport_owner set the device_owner | 14:18 |
| apuimedo | ivc_: I agree with you on that | 14:19 |
| apuimedo | I find it misguided | 14:19 |
| ltomasbo | and make it possible to not set it to anything (for the kuryr case) | 14:19 |
| apuimedo | ivc_: I honestly just don't see the point of setting it to trunk:subport | 14:19 |
| ltomasbo | neither do I | 14:20 |
| apuimedo | when it is something that can be checked in the API, that it belongs to a trukn | 14:20 |
| apuimedo | *trunk | 14:20 |
| ltomasbo | I think it is just to easily find the subports | 14:20 |
| ivc_ | apuimedo i understand that, but thats the current api | 14:20 |
| apuimedo | but now the damage is done | 14:20 |
| apuimedo | exactly | 14:20 |
| ivc_ | imo best course of action is to update neutron trunk api in a way that would allow us to legitimately set device_owner | 14:21 |
| ltomasbo | yes, it seems reverting that could affect already set deployments | 14:21 |
| ivc_ | excluding the potential conflict between trunk code and kuryr | 14:21 |
| apuimedo | it is quite annoying, but we'll probably have to consider whether we do not mark subports or use tags or something else | 14:21 |
| apuimedo | ivc_: that was my first thought | 14:21 |
| apuimedo | to extend the api of trunk_subport_add | 14:21 |
| apuimedo | so that you can pass it a device owner | 14:21 |
| *** rainya has quit IRC | 14:21 | |
| apuimedo | (which by the way saves us one neutron call :P ) | 14:22 |
| ivc_ | yup | 14:22 |
| apuimedo | ltomasbo: did you propose that to armax? | 14:22 |
| ltomasbo | and easy modifications could be to just change the config option, and allow not to set any device_owner | 14:22 |
| apuimedo | Is there a mailing list thread for that? | 14:22 |
| ltomasbo | without needed to modify the API | 14:22 |
| ltomasbo | which is always trickier | 14:22 |
| apuimedo | ivc_: the problem with extending the API is that we're probably too close to freeze or already frozen | 14:23 |
| ltomasbo | it is being discussed on the revert patch: | 14:23 |
| ltomasbo | https://review.openstack.org/#/c/419028 | 14:23 |
| apuimedo | ltomasbo: gotcha | 14:23 |
| ivc_ | -2 ... | 14:23 |
| ltomasbo | :D | 14:23 |
| ltomasbo | I know! But still discussing with armax | 14:24 |
| apuimedo | ltomasbo got the hammer of justice! | 14:24 |
| ltomasbo | and I agree reverting could not be done, but we are using that to discuss | 14:24 |
| ltomasbo | and then (I suppose) another solution will be proposed | 14:24 |
| ltomasbo | I see the other option, not setting TRUNK_SUBPORT_OWNER | 14:24 |
| apuimedo | ltomasbo: from the commit message discussion I see an interesting option | 14:25 |
| ltomasbo | and making the code not setting the device owner on trunk_add_subport | 14:25 |
| apuimedo | we could probably argue for having the device:owner unchanged if it is not None | 14:25 |
| ltomasbo | it will be just a couple of lines | 14:25 |
| ivc_ | so how tricky it would be to keep 'trunk:subport' owner? do we have some sort of workaround? | 14:25 |
| apuimedo | and move the update before the trunk_port_add | 14:25 |
| apuimedo | *trunk_subport_add | 14:25 |
| mchiappero | sorry but I guess there is no guarantee on the serialization of the operations in neutron | 14:25 |
| mchiappero | but shouldn't be that way for the same port? | 14:25 |
| mchiappero | shouldn't actions to the same port be serialized? | 14:26 |
| mchiappero | wouldn't this solve the issue? | 14:26 |
| apuimedo | mchiappero: not sure | 14:26 |
| ivc_ | mchiappero afaik they are. as soon as you got confirmation for your request, it is commited | 14:26 |
| ltomasbo | yes, but calls are async, so, they can be executed in different orders | 14:27 |
| mchiappero | so in this case our update port could get confirmed first, right? | 14:27 |
| apuimedo | ivc_: re keeping trunk:subport would break our contract of marking our resources | 14:27 |
| ivc_ | the problem is not the race as i understand it but just the conflict between kuryr's port update and trunk logic | 14:27 |
| ltomasbo | yes and not | 14:27 |
| apuimedo | ivc_: For me the race is just a symptom | 14:27 |
| ltomasbo | if it ensure that our call is called after trunk_add_subport fully finished | 14:27 |
| *** hongbin has joined #openstack-meeting-4 | 14:27 | |
| mchiappero | apuimedo: right | 14:28 |
| ltomasbo | then from kuryr point of view, that will work | 14:28 |
| ltomasbo | but I agree with apuimedo | 14:28 |
| hongbin | o/ | 14:28 |
| ltomasbo | the problem is the use of device_owner | 14:28 |
| apuimedo | exactly | 14:28 |
| ivc_ | yup | 14:28 |
| mchiappero | I would expect neutron to perform some ordering or take some port specific lock | 14:28 |
| apuimedo | I would really like to have the extra parameter in the trunk_subport_add | 14:28 |
| ltomasbo | but that will not solve the problem | 14:29 |
| ltomasbo | if we set device_owner to whatever we want | 14:29 |
| ltomasbo | we can still do that | 14:29 |
| ltomasbo | but the problem will be the same | 14:29 |
| ltomasbo | not an unified view of what device_owner should be about | 14:29 |
| apuimedo | ltomasbo: recognizing that it can be set to something else kind of forces Neutron to acknowledge that this field is informative for them and not for logic | 14:29 |
| ivc_ | ltomasbo, toni's point is if we get 'device_owner' as part of 'trunk_subport_add' api, it would make 'kuryr:container' device owner legit | 14:30 |
| ltomasbo | got it | 14:30 |
| apuimedo | ivc_: or a "use at your own risk" | 14:30 |
| apuimedo | depends on the wording in the method doc | 14:30 |
| *** links has quit IRC | 14:30 | |
| apuimedo | that gets merged | 14:30 |
| ltomasbo | of course, for kuryr deployment we can state that TRUNK_SUBPORT_OWNER should be set to kuryr:container | 14:31 |
| mchiappero | I still don't fully understand: does setting the owner after a well finished and seccessful trunk_subport_add work? | 14:31 |
| ltomasbo | and that will solve the problem, at the expense of flexibility | 14:31 |
| apuimedo | ivc_: I didn't want to say it. But the right fix, things being what they are now, would be that there would be multiple owners | 14:31 |
| apuimedo | but that is even more API breaking :/ | 14:31 |
| *** SerenaFeng has quit IRC | 14:31 | |
| apuimedo | mchiappero: it does | 14:31 |
| mchiappero | ok, so the problem is neutron | 14:31 |
| apuimedo | but it makes us tread in unsafe waters | 14:32 |
| mchiappero | that's something for them to fix | 14:32 |
| apuimedo | that if neutron subport related code started relying on this (like for upgrades) | 14:32 |
| apuimedo | it could render our subports useless | 14:32 |
| apuimedo | the fix I'd like to avoid, but that work work right away | 14:33 |
| ivc_ | apuimedo i think multiple owners would only add confusion. the 'owner' should be unique, but the device_owner field should not be used for storing 'informative' date as it is the case with 'trunk:subport' | 14:33 |
| ivc_ | data* | 14:33 |
| mchiappero | ivc_: agree | 14:33 |
| apuimedo | is to use a new tag instead of the device:owner | 14:33 |
| ivc_ | imo kuryr is the real owner in this case | 14:34 |
| apuimedo | ivc_: I agree with you, if Neutron wanted so much to have this informative to avoid checking in DB whether it was a subport, it could have added a field for that | 14:34 |
| apuimedo | ivc_: no question about that | 14:34 |
| apuimedo | but we need a pragmatic solution | 14:34 |
| apuimedo | let's wait to hear what ltomasbo gets from armax in proposing a new parameter for the trunk operations | 14:35 |
| ltomasbo | would you agree/like the other solution? just disabling trunk_add_subport to write on device:owner? | 14:35 |
| ivc_ | the problem is HCF | 14:35 |
| apuimedo | #action ltomasbo to continue discussion with armax, proposing trunk_subport_add to receive optionally an API owner name | 14:35 |
| apuimedo | ltomasbo: disabling it how? | 14:36 |
| apuimedo | ivc_: HCF? | 14:36 |
| ivc_ | hard code freeze | 14:36 |
| ltomasbo | as they just set whatever value is in TRUNK_SUBPORT_OWNER in the config.py file | 14:36 |
| ltomasbo | just setting that to none | 14:36 |
| ltomasbo | and if it is set to none, then just don't call update_port | 14:37 |
| ltomasbo | and if it is set to wahtever it is, keep working as it is | 14:37 |
| ltomasbo | so that it does not break current deployments | 14:37 |
| apuimedo | ltomasbo: that would apply to all the ports, not just those used by kuryr | 14:37 |
| ltomasbo | only to subports | 14:37 |
| apuimedo | right, but a user may use subports for other purposes | 14:38 |
| ivc_ | apuimedo ltomasbo if we look at it from different perspective, do we need 'device_owner' for cleanup only? | 14:38 |
| ltomasbo | we don't even really needed | 14:38 |
| ltomasbo | is just a filter to speed up the search | 14:38 |
| apuimedo | ivc_: we use it for cleanup. But its main purpose is to notify that it is automatically handled by kuryr to users | 14:38 |
| apuimedo | it was sort of... Since it is already there, let's use it | 14:39 |
| ltomasbo | to me, it makes sense, as it is kuryr service creating/managing them | 14:39 |
| mchiappero | I used it a lot while working on ipvlan | 14:39 |
| ivc_ | as much as i dislike special-casing, maybe then we could have a special case for 'trunk:subport' that would fetch the ports for kuryr-managed nodes somehow | 14:39 |
| mchiappero | i often had leftovers | 14:39 |
| ltomasbo | while tagging that it is a subport, should not go on device_owner, but device_type or something like that if they need it | 14:40 |
| ivc_ | ofc until we get a proper api update on neutron side | 14:40 |
| *** julim has joined #openstack-meeting-4 | 14:40 | |
| apuimedo | ivc_: let's wait a week to see what Neutron people say | 14:41 |
| apuimedo | and then we can decide on contingency measures | 14:41 |
| ivc_ | sure | 14:41 |
| *** janki has quit IRC | 14:41 | |
| apuimedo | anything else about kuryr-libnetwork? | 14:42 |
| *** v1k0d3n has quit IRC | 14:43 | |
| apuimedo | very well | 14:43 |
| apuimedo | moving on | 14:43 |
| apuimedo | #topic fuxi | 14:43 |
| *** openstack changes topic to "fuxi (Meeting topic: kuryr)" | 14:43 | |
| apuimedo | #chair hongbin | 14:43 |
| openstack | Current chairs: apuimedo hongbin | 14:43 |
| hongbin | hi | 14:43 |
| hongbin | in last week, there are several proposed fixes | 14:44 |
| hongbin | #link https://review.openstack.org/#/c/419767/ | 14:44 |
| apuimedo | hongbin: today I was asked about fuxi on magnum. Do we have some docs on that? Or it only targets bare metal? | 14:44 |
| hongbin | apuimedo: i am happy to explore fuxi on magnum | 14:44 |
| hongbin | apuimedo: it is definitely one of the target | 14:44 |
| hongbin | apuimedo: there are several things that needs to be done | 14:45 |
| hongbin | apuimedo: 1. containerized fuxi | 14:45 |
| hongbin | apuimedo: 2. trust support | 14:45 |
| *** lrensing has joined #openstack-meeting-4 | 14:45 | |
| hongbin | apuimedo: then, we are ready to propose it to magnum | 14:45 |
| apuimedo | cool | 14:45 |
| apuimedo | sorry for the interruption | 14:46 |
| hongbin | apuimedo: np | 14:46 |
| apuimedo | :-) | 14:46 |
| hongbin | yes, to continue, | 14:46 |
| hongbin | i was trying to move fuxi to py35 | 14:46 |
| hongbin | #link https://review.openstack.org/#/c/419683/ | 14:46 |
| *** salv-orlando has joined #openstack-meeting-4 | 14:47 | |
| hongbin | the last one, i have a pov for making multi-tenancy support | 14:47 |
| *** baoli has quit IRC | 14:47 | |
| hongbin | #link https://review.openstack.org/#/c/420386/ | 14:47 |
| hongbin | all of those are under review, feedback is appreciate | 14:47 |
| hongbin | apuimedo: that is all from my side | 14:47 |
| *** baoli has joined #openstack-meeting-4 | 14:47 | |
| apuimedo | hongbin: I suppose swift's failure with py3 is reported as a bug, right? | 14:47 |
| apuimedo | thanks hongbin | 14:47 |
| *** galstrom_zzz is now known as galstrom | 14:48 | |
| apuimedo | #topic kuryr-kubernetes | 14:48 |
| *** openstack changes topic to "kuryr-kubernetes (Meeting topic: kuryr)" | 14:48 | |
| hongbin | apuimedo: yes, we worked around swift | 14:48 |
| *** galstrom is now known as galstrom_zzz | 14:48 | |
| apuimedo | #info ivc_ is a new core for Kuryr-kubernetes! Congratulations! | 14:49 |
| ivc_ | thanks! :) | 14:49 |
| apuimedo | ivc_: and now that you are congratulated, pls review https://review.openstack.org/#/c/419933/ for merge :P | 14:49 |
| apuimedo | #info vikasc reported that he is finishing addressing ltomasbo and ivc_'s comments to https://review.openstack.org/#/c/410578/ | 14:50 |
| *** galstrom_zzz is now known as galstrom | 14:50 | |
| apuimedo | hongbin: we could appreciate help into drafting a plan to integrate kuryr-kubernetes with Magnum once that patch is merged | 14:50 |
| apuimedo | a TODO list or something like that | 14:50 |
| hongbin | apuimedo: i can try | 14:50 |
| apuimedo | s/could/would/ | 14:51 |
| ltomasbo | nice, I'm trying to follow the instruction to set it up, but so far no luck with it | 14:51 |
| apuimedo | :-) | 14:51 |
| apuimedo | thanks hongbin | 14:51 |
| apuimedo | ltomasbo: you mean vikasc's patch? | 14:51 |
| ltomasbo | yep | 14:51 |
| ltomasbo | using the devstack templates | 14:51 |
| apuimedo | ltomasbo: ping him in the morning then :P | 14:51 |
| *** Michael-zte has joined #openstack-meeting-4 | 14:51 | |
| *** salv-orlando has quit IRC | 14:51 | |
| ltomasbo | I'll do | 14:51 |
| apuimedo | cool | 14:51 |
| *** Michael-zte has quit IRC | 14:51 | |
| apuimedo | ivc_: any news on the services front? | 14:51 |
| ivc_ | nope | 14:52 |
| apuimedo | very well | 14:52 |
| ltomasbo | servivcs == lbaas/octavia? | 14:52 |
| ltomasbo | s/servivcs/services | 14:52 |
| apuimedo | ltomasbo: neutron-lbaasv2 | 14:52 |
| *** Michael-zte has joined #openstack-meeting-4 | 14:52 | |
| apuimedo | we should add octavia after that | 14:52 |
| ltomasbo | is there a patch on that already? I would like to take a look | 14:53 |
| ivc_ | ltomasbo i think toni is referring to the split of https://review.openstack.org/#/c/376045/ :) | 14:53 |
| apuimedo | it should be a matter of changing the driver | 14:53 |
| ltomasbo | great! | 14:53 |
| apuimedo | ltomasbo: there is a patch, the one ivc_ links to. However, it needs a bit of splitting and UT | 14:53 |
| ltomasbo | should that include the floating ip support too (in a follow up patch)? | 14:53 |
| apuimedo | let me check | 14:54 |
| ltomasbo | (maybe it already does...) | 14:54 |
| ivc_ | ltomasbo it does not | 14:54 |
| ltomasbo | just asking... | 14:54 |
| ltomasbo | ok | 14:54 |
| apuimedo | I was checking if you could define externalIP for pod | 14:55 |
| apuimedo | apparently you can't | 14:55 |
| apuimedo | so yeah, it should be a follow-up patch | 14:55 |
| apuimedo | anybody's got anything about kuryr-kubernetes? | 14:55 |
| ivc_ | apuimedo ltomasbo thats a rather trivial change technically, but i'm not yet certain if floating ip is the right fit for external IP | 14:56 |
| apuimedo | ivc_: why? | 14:57 |
| ltomasbo | I think it is something you can add to the VIP in lbaas, so that the loadbalancer can get reached from outside | 14:57 |
| *** beagles is now known as beagles_brb | 14:57 | |
| ivc_ | ltomasbo apuimedo because there's also 'loadbalancer' type service | 14:58 |
| *** alraddarla has left #openstack-meeting-4 | 14:58 | |
| ivc_ | my understanding was that external ip (https://kubernetes.io/docs/user-guide/services/#external-ips) from k8s point of view is a an IP configured on the node's interface | 14:58 |
| sigmavirus | apuimedo: y'all wrapping up? | 14:59 |
| apuimedo | sigmavirus: we are | 14:59 |
| apuimedo | sorry about that | 14:59 |
| sigmavirus | No problem :) | 14:59 |
| apuimedo | let's move to the channel | 14:59 |
| apuimedo | thank you all for joining | 14:59 |
| apuimedo | #endmeeting | 14:59 |
| *** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings" | 14:59 | |
| openstack | Meeting ended Mon Jan 16 14:59:36 2017 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 14:59 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/kuryr/2017/kuryr.2017-01-16-14.00.html | 14:59 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/kuryr/2017/kuryr.2017-01-16-14.00.txt | 14:59 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/kuryr/2017/kuryr.2017-01-16-14.00.log.html | 14:59 |
| sigmavirus | #startmeeting craton | 14:59 |
| openstack | Meeting started Mon Jan 16 14:59:42 2017 UTC and is due to finish in 60 minutes. The chair is sigmavirus. Information about MeetBot at http://wiki.debian.org/MeetBot. | 14:59 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 14:59 |
| *** openstack changes topic to " (Meeting topic: craton)" | 14:59 | |
| openstack | The meeting name has been set to 'craton' | 14:59 |
| *** yedongcan has left #openstack-meeting-4 | 14:59 | |
| sigmavirus | #chair sigmavirus sulo jimbaker | 14:59 |
| openstack | Current chairs: jimbaker sigmavirus sulo | 14:59 |
| sigmavirus | #link https://etherpad.openstack.org/p/craton-meetings | 14:59 |
| sigmavirus | #link https://etherpad.openstack.org/p/craton-meetings | 15:00 |
| *** garyloug has left #openstack-meeting-4 | 15:00 | |
| sigmavirus | #topic Roll Call | 15:00 |
| *** openstack changes topic to "Roll Call (Meeting topic: craton)" | 15:00 | |
| sulo | o/ | 15:00 |
| sigmavirus | o/ | 15:00 |
| *** ivc_ has left #openstack-meeting-4 | 15:00 | |
| sigmavirus | palendae: jimbaker reminder, we have our meeting | 15:01 |
| *** spotz_zzz is now known as spotz | 15:01 | |
| sigmavirus | sulo: I'll give them a few more minutes but if no one else shows up, want to cancel it? | 15:02 |
| sigmavirus | Seems a bit ... hard to have a meeting with just two people | 15:02 |
| sulo | ok | 15:02 |
| sigmavirus | I mean, we can discuss the agenda | 15:02 |
| sigmavirus | :P | 15:02 |
| sulo | so was there some discussion on secrets mgt last time ? | 15:03 |
| sulo | did we decide to start with barbican ? | 15:03 |
| sigmavirus | sulo: well let's go in order :P | 15:04 |
| sigmavirus | #topic Action Items from Last Meeting | 15:04 |
| *** openstack changes topic to "Action Items from Last Meeting (Meeting topic: craton)" | 15:04 | |
| sulo | heh ok | 15:04 |
| sigmavirus | #link http://eavesdrop.openstack.org/meetings/craton/2017/craton.2017-01-09-14.59.html | 15:04 |
| sigmavirus | dangit | 15:04 |
| sigmavirus | #link http://eavesdrop.openstack.org/meetings/craton/2017/craton.2017-01-09-14.59.html | 15:04 |
| sigmavirus | #info there were no action items last week | 15:04 |
| sigmavirus | #topic Storing secrets in Craton | 15:04 |
| *** openstack changes topic to "Storing secrets in Craton (Meeting topic: craton)" | 15:04 | |
| sigmavirus | So there's been frequent discussion of storing secrets in craton, sulo (to answer your question) | 15:05 |
| sigmavirus | There seems to be an unqualified resistance to using Barbican (either by having a soft or hard requirement on it) that I have yet to get any reasoning about | 15:05 |
| sigmavirus | Beyond the reasoning that operators don't want to have to deploy things (like Keystone) to deploy Craton | 15:05 |
| *** git-harry has joined #openstack-meeting-4 | 15:05 | |
| sulo | right .. but can we do secrets without going that route ? | 15:06 |
| palendae | Not against using Barbican; I think I'm past being able to use Craton without Keystone, as everyone else seems to think that's the preferred method | 15:06 |
| sigmavirus | sulo: well the design that jimbaker has in mind hasn't made any sense to me personally | 15:06 |
| sigmavirus | I think he wants some way of storing the private keys that encrypt the secrets in Craton | 15:06 |
| sigmavirus | So that Craton can decrypt the secrets itself | 15:07 |
| sigmavirus | I don't think Craton's in the position to do that right now though | 15:07 |
| palendae | I'd be -1 to Craton doing secret management itself | 15:07 |
| sigmavirus | And I'd rather have the user encrypt the secrets, ship them to craton, and then be in charge of decrypting them | 15:07 |
| sigmavirus | palendae: me too | 15:07 |
| *** antonym has joined #openstack-meeting-4 | 15:08 | |
| sigmavirus | That leads me to | 15:08 |
| sigmavirus | #info Barbican already provides an HA way of storing secrets | 15:08 |
| sigmavirus | Barbican also has a really good access control mechanism for secrets which might not match what we're brewing up for Craton | 15:08 |
| *** hongbin has quit IRC | 15:08 | |
| sigmavirus | Further | 15:08 |
| sigmavirus | #info If Craton absolutely must store its own secrets, it should investigate Castellan | 15:08 |
| sigmavirus | Castellan is a project made by the Barbican team for people who need to access secrets storage devices, e.g., TPMs without using Barbican | 15:09 |
| *** bobh has joined #openstack-meeting-4 | 15:09 | |
| sigmavirus | #link http://docs.openstack.org/developer/castellan/ | 15:09 |
| *** bobh has quit IRC | 15:09 | |
| sigmavirus | #info Topic on mailing list about projects avoiding Barbican, please contribute | 15:09 |
| sigmavirus | #link http://lists.openstack.org/pipermail/openstack-dev/2017-January/110192.html | 15:09 |
| sigmavirus | #link http://lists.openstack.org/pipermail/openstack-dev/2017-January/110192.html | 15:09 |
| sigmavirus | So if y'all have reasons why not to use Barbican in Craton, I'd like y'all to contribute to that thread | 15:10 |
| sigmavirus | We should be contributing (at the very least) information back to that project so they know what is holding it back from wider spread adoption | 15:10 |
| *** anilvenkata has quit IRC | 15:10 | |
| sigmavirus | I really don't want us to have to come up with ways of storing secrets securely | 15:10 |
| sigmavirus | And I really think Barbican has done all of the heavy lifting done w/r/t security and cryptography | 15:11 |
| sulo | sigmavirus: is there a bp on secrets mgt ? | 15:11 |
| sigmavirus | sulo: jimbaker is the owner so I'm not sure but I haven't seen one | 15:11 |
| sulo | ok | 15:11 |
| *** l4yerffeJ__ has joined #openstack-meeting-4 | 15:12 | |
| *** alexchad_ has joined #openstack-meeting-4 | 15:12 | |
| *** l4yerffeJ_ has quit IRC | 15:12 | |
| *** alexchadin has quit IRC | 15:12 | |
| sigmavirus | If we had more of the team here, I'd start a vote about craton storing its own secrets, but there's only 3 of us, so I won't | 15:13 |
| palendae | IMO it should be a bp/spec and voting happens there | 15:14 |
| sigmavirus | sulo, palendae do you have any topics you want to cover? | 15:14 |
| *** l4yerffeJ__ has quit IRC | 15:14 | |
| palendae | With explanation of why Barbican doesn't fit and how exactly Craton will manage things differently | 15:14 |
| *** l4yerffeJ__ has joined #openstack-meeting-4 | 15:14 | |
| palendae | sigmavirus: Not really; been focused on internal stuff this past week | 15:14 |
| jimbaker | o/ - tech problems here, but online now | 15:14 |
| sulo | sigmavirus: well, few topics but moslty for my own catchup really | 15:15 |
| sulo | like cli work | 15:15 |
| sulo | and where we are with the url structure discussion and pagination support | 15:15 |
| jimbaker | sulo, in reqs meeting that we had with toan and dusty, we did bring up CLI | 15:15 |
| sigmavirus | sulo: pagination spec was merged, and I'm hacking on it | 15:15 |
| jimbaker | (as well as pagination) | 15:15 |
| sulo | thats where we were before i went on a break | 15:15 |
| jimbaker | will read log before my much more commenting :) | 15:16 |
| sulo | jimbaker: sigmavirus: ok cool | 15:16 |
| jimbaker | sulo, but in a nutshell, toan asked for a demo of inventory against the requirements dusty put together. end of january | 15:16 |
| jimbaker | this is not all of the reqs mind you :) | 15:17 |
| sulo | jimbaker: ok | 15:17 |
| sulo | jimbaker: this is from last meeting ? | 15:17 |
| sulo | last week i mean ? | 15:17 |
| jimbaker | just doing stuff like getting/setting variables against a host for its hardware/software inventory | 15:17 |
| jimbaker | sulo, correct - this is the friday meeting you missed because of leave | 15:18 |
| sulo | ok | 15:18 |
| *** rainya has joined #openstack-meeting-4 | 15:18 | |
| sulo | sigmavirus: jimbaker: another topic that was in the middle of discussion was access control | 15:18 |
| jimbaker | we need an interface that's not just the python client. so the CLI will satisfy | 15:19 |
| jimbaker | sulo, right, i made good progress on rbac | 15:19 |
| sulo | jimbaker: nice | 15:19 |
| sulo | is there a bp ? we are going with oslo policy ? | 15:19 |
| sigmavirus | jimbaker: ah, I never got that invite from dusty | 15:19 |
| jimbaker | so in addition to scoped role assignments that's discussed in the rbac blueprint | 15:20 |
| sigmavirus | sulo: our rbac seems to becoming quite involved beyond oslo.policy | 15:20 |
| jimbaker | as sigmavirus points out, there's stuff beyond just mere oslo.policy | 15:20 |
| jimbaker | last week i discussed and showed a gist that lets us connect scoped role assignments to oslo.policy | 15:21 |
| sulo | ok .. is there a bp ? | 15:21 |
| jimbaker | sulo, it's going in a spec | 15:22 |
| sulo | its not merged i guess .. ill check reviews | 15:22 |
| sulo | i only see pagination and url specs | 15:22 |
| *** rainya has quit IRC | 15:22 | |
| jimbaker | sulo, no, not merged, or even in gerrit | 15:22 |
| jimbaker | just still in the writing stage | 15:22 |
| sulo | ah gotcha | 15:23 |
| jimbaker | but i think it's very much worthwhile to discuss now :) | 15:23 |
| jimbaker | anyway, the key to the whole work here is | 15:23 |
| jimbaker | 1. scoped role assignments are managed in the database. they are implemented as triples connecting principals (users, workflows) with other mixed in resources on some role | 15:24 |
| jimbaker | 2. rest api to actually manage | 15:24 |
| jimbaker | 3. usage with oslo.policy as attributed assertions that can then be used as part of standard backwards chaining inference to a given goal as part of the enforce method | 15:25 |
| sigmavirus | jimbaker: so the way I see this is that there will be actually two layers of policy | 15:25 |
| sigmavirus | oslo.policy and whatever policy enforcement craton does with those scoped assignments | 15:25 |
| *** beekneemech is now known as bnemec | 15:26 | |
| sigmavirus | The layer of granularity that you're talking about isn't presently done by anyone with oslo.policy | 15:26 |
| jimbaker | sigmavirus, it is two level, but more like how it's two level in keystone | 15:26 |
| sigmavirus | jimbaker: care to elaborate on what you mean by "it's two level in keystone"? | 15:26 |
| jimbaker | sigmavirus, what i mean by that is keystone captures a similar idea in terms of how users and domains are managed in a db; then pulled together using attributes | 15:28 |
| jimbaker | anyway, probably best to be discussed in the context of the spec itself | 15:29 |
| *** alexchad_ has quit IRC | 15:29 | |
| *** aheczko-mirantis has quit IRC | 15:30 | |
| *** marst has quit IRC | 15:31 | |
| jimbaker | going through the log: i think there's a difference between managing HSM for master keys themselves; and any encrypted secrets with respect to those master keys | 15:32 |
| jimbaker | so castellan/barbican could be good options; so too amazon cloudhsm | 15:33 |
| sulo | jimbaker: so just encrypt and store secrets on how to access the real secrets in barbican etc | 15:33 |
| jimbaker | then there are tools for managing secrets. so hashicorp vault is a good example here. i don't believe integrations have been done with hsm and hashicorp vault | 15:34 |
| sigmavirus | jimbaker: vault would be integrated at the level of barbican | 15:34 |
| sigmavirus | barbican is meant to abstract all of that | 15:34 |
| sigmavirus | no one has done the work yet though | 15:34 |
| jimbaker | the dev work for vault seems to be more focused on rolling secrets | 15:34 |
| sigmavirus | jimbaker: like the secrets that sit on top of spaghetti? | 15:35 |
| *** nkrinner is now known as nkrinner_afk | 15:35 | |
| jimbaker | sigmavirus, yeah, and i want to avoid us going down that path if possible. first, implement hsm integration... | 15:35 |
| *** l4yerffeJ__ has quit IRC | 15:35 | |
| sigmavirus | jimbaker: in craton? | 15:35 |
| sigmavirus | Why reimplement what barbican has already painstakingly done? | 15:35 |
| jimbaker | sigmavirus, as in a dev path to avoid | 15:36 |
| sigmavirus | huh? | 15:36 |
| jimbaker | yes, if we re-implement stuff that has been painstakingly done... not a good idea | 15:36 |
| *** l4yerffeJ__ has joined #openstack-meeting-4 | 15:36 | |
| *** sshnaidm has quit IRC | 15:36 | |
| jimbaker | sigmavirus, i think we are in agreement here | 15:36 |
| *** sshnaidm has joined #openstack-meeting-4 | 15:36 | |
| jimbaker | at least at a high level. details maybe need to be worked out about our agreement? ;) | 15:36 |
| *** l4yerffeJ__ has quit IRC | 15:37 | |
| sigmavirus | fair | 15:37 |
| *** l4yerffeJ__ has joined #openstack-meeting-4 | 15:37 | |
| jimbaker | related to secrets is, why do we need them anyway? so there are alternatives like trusts | 15:38 |
| jimbaker | but apparently the future, while implemented, is not yet widely adopted/distributed | 15:38 |
| *** alexchadin has joined #openstack-meeting-4 | 15:39 | |
| jimbaker | so we need secrets for the time being. anyway... best discussed i think over a spec | 15:39 |
| sigmavirus | jimbaker: I think secrets are deployment secrets and trusts are related to identity | 15:39 |
| sigmavirus | so a user can use a trust to authenticate to craton and let it reuse that token with other services taht the users has scoped that too (iiuc) | 15:40 |
| sigmavirus | secrets, in the context of an inventory system, are secrets you might use when doing automatic remediation | 15:40 |
| sigmavirus | or in the OSA context, passwords that services use when auuthenticating to mariadb | 15:40 |
| jimbaker | sigmavirus, trusts and similar tooling like opengrid's myproxy can replace the need for tooling like craton to store secrets to complete the next credentialling hop | 15:40 |
| *** beagles_brb is now known as beagles | 15:41 | |
| jimbaker | consider for example that myproxy can remove the need to use ssh keys by an intermediary | 15:41 |
| sigmavirus | jimbaker: not familiar with myproxy but it seems we're getting a little off into the weeds too | 15:42 |
| palendae | jimbaker: Definitely agreed with needing a spec. I'm skeptical that craton needs to add secrets | 15:42 |
| jimbaker | all it takes is modified ssh servers. or maybe ssh servers that can talk to kerberos. i don't know. as i said, adoption/distribution means this is not really relevant. eg weeds | 15:42 |
| jimbaker | interesting weeds. perspective weeds ;) | 15:42 |
| jimbaker | so we still need to manage secrets somewhere. that's the conclusion | 15:43 |
| palendae | A deployer does; not craton | 15:43 |
| sigmavirus | ^ | 15:43 |
| *** marst has joined #openstack-meeting-4 | 15:43 | |
| sigmavirus | I think we should start with barbican and castellan and let people develop integrations into the services they need | 15:44 |
| sigmavirus | we'll have done our dilligence in creating a driver API for that | 15:44 |
| sigmavirus | and then people can either hook into barbican or craton or wherever makes most sense to them | 15:44 |
| palendae | Or, at the absolute simplest, use TLS and they'll encrypte/decrypt on their end | 15:44 |
| sigmavirus | castellan will be for PoC deployments | 15:44 |
| sigmavirus | palendae: yeah, I think we'd just keep references to the secret stored in teh driver | 15:45 |
| sigmavirus | I don't think we should handle the secret at all if at all possible | 15:45 |
| palendae | sigmavirus: Well, I'm talking about the scenario of storing an encrypted secret without a 3rd service. But, for me, that's preferable to Craton adding yet more stuff | 15:45 |
| sulo | sigmavirus: jimbaker: i thought that was always the plan ? driver support for one or two backends by default .. | 15:45 |
| sulo | so all we have to do is be able to handle .. where the secret is and how to get it | 15:46 |
| sigmavirus | sulo: I don't know if that was always teh plan | 15:46 |
| sigmavirus | sulo: right | 15:46 |
| sigmavirus | we have 12 min left | 15:46 |
| sigmavirus | do we have other topics? | 15:46 |
| jimbaker | sulo, yes, for master keys. whether for secrets as a whole like ssh access keys, clearly we didn't go there | 15:46 |
| *** limao has quit IRC | 15:47 | |
| sulo | i dont have anything .. ihave a few things to catchup on | 15:47 |
| *** mattmceuen has left #openstack-meeting-4 | 15:47 | |
| *** salv-orlando has joined #openstack-meeting-4 | 15:48 | |
| jimbaker | sulo, we should just sync up with the reqs meeting | 15:48 |
| sulo | jimbaker: ok | 15:48 |
| jimbaker | so no changes there on that doc that dusty is putting together | 15:49 |
| sulo | jimbaker: sigmavirus: i think we have things on our priority list | 15:49 |
| jimbaker | which should be published soon | 15:49 |
| *** hongbin has joined #openstack-meeting-4 | 15:49 | |
| sulo | but maybe its worth putting down the workitems and goals for this cycle etc | 15:49 |
| jimbaker | sulo, i assume by this you mean | 15:49 |
| *** dave-mccowan has quit IRC | 15:50 | |
| jimbaker | sulo, i assume by this you mean current inventory model stability/production scale | 15:50 |
| jimbaker | plus CLI | 15:50 |
| sulo | jimbaker: i mean, access control, secrets mgt, workflow and cli work | 15:50 |
| sulo | jimbaker: yes | 15:50 |
| sulo | pretty much | 15:50 |
| jimbaker | sulo, yes, we can do that in parallel for access, secrets, auditing, and remote inventory integration ("inventory fabric") | 15:50 |
| jimbaker | sulo, with these last aspects, we have a comprehensive inventory system | 15:51 |
| *** rtheis has quit IRC | 15:51 | |
| jimbaker | the other piece is workflows, but that can be on the back burner | 15:51 |
| jimbaker | inventory seems to be far more important to get complete first | 15:52 |
| * sigmavirus thinks auditing is higher prio than secrets | 15:52 | |
| jimbaker | sigmavirus, likely is | 15:52 |
| *** salv-orlando has quit IRC | 15:52 | |
| sulo | right .. i think inventory is taknig shape .. for next phase of work though | 15:52 |
| jimbaker | secrets are for sure harder to get right | 15:52 |
| sulo | like auditing | 15:52 |
| sulo | we need secrets and access control | 15:52 |
| sulo | to we can hit machines | 15:53 |
| jimbaker | exactly, it all works together | 15:53 |
| jimbaker | and i think secrets is harder with respect to daemon usage | 15:53 |
| sigmavirus | sulo: last time I was in a meeting with Rackspace's support team, automated remediation is a very low prio item given they don't want Craton doing things for them | 15:53 |
| jimbaker | like workflows | 15:53 |
| sulo | sigmavirus: ok .. yeah i guess we are kinda far from that also | 15:54 |
| jimbaker | hence my "back burner" prioritization | 15:54 |
| sulo | but auditing is the same process as remediation | 15:54 |
| jimbaker | yeah | 15:55 |
| sulo | the inner working is the same | 15:55 |
| jimbaker | and they will want it | 15:55 |
| jimbaker | otherwise we lose the efficiency gains we want to see here | 15:55 |
| jimbaker | and agreed about effectively the same | 15:55 |
| *** spotz is now known as spotz_zzz | 15:55 | |
| jimbaker | sulo, so nothing is changed as we look at 2017 | 15:56 |
| jimbaker | (and btw, welcome back!) | 15:56 |
| sulo | thanks :) | 15:56 |
| jimbaker | inventory first, get that deep | 15:56 |
| jimbaker | and build out workflows around it | 15:56 |
| jimbaker | jason's original priorities for us | 15:56 |
| jimbaker | we are just hearing it from toan and dusty as well | 15:57 |
| sigmavirus | Anyway, let's continue in #craton so we don't step on the next meeting's time | 15:57 |
| jimbaker | sigmavirus, agreed | 15:57 |
| *** amotoki has quit IRC | 15:57 | |
| sigmavirus | In the future, I think I'll run meetings and force us to stick to the posted agenda | 15:57 |
| *** spotz_zzz is now known as spotz | 15:57 | |
| sigmavirus | Because I can | 15:57 |
| sigmavirus | #endmeeting | 15:57 |
| *** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings" | 15:57 | |
| openstack | Meeting ended Mon Jan 16 15:57:36 2017 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:57 |
| sulo | sigmavirus: +1 | 15:57 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/craton/2017/craton.2017-01-16-14.59.html | 15:57 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/craton/2017/craton.2017-01-16-14.59.txt | 15:57 |
| *** apuimedo is now known as apuimedo|away | 15:57 | |
| openstack | Log: http://eavesdrop.openstack.org/meetings/craton/2017/craton.2017-01-16-14.59.log.html | 15:57 |
| Michael-zte | Is there a meeting of "Ironic-neutron" today? | 16:04 |
| *** git-harry has left #openstack-meeting-4 | 16:05 | |
| *** dave-mccowan has joined #openstack-meeting-4 | 16:05 | |
| *** dave-mcc_ has joined #openstack-meeting-4 | 16:08 | |
| *** dave-mccowan has quit IRC | 16:10 | |
| *** benj_ has joined #openstack-meeting-4 | 16:10 | |
| *** dandruta has joined #openstack-meeting-4 | 16:12 | |
| *** itamaro has quit IRC | 16:14 | |
| *** jose-phillips has joined #openstack-meeting-4 | 16:16 | |
| *** jose-phillips has quit IRC | 16:16 | |
| *** armax has joined #openstack-meeting-4 | 16:26 | |
| *** cwolferh has left #openstack-meeting-4 | 16:29 | |
| *** salv-orlando has joined #openstack-meeting-4 | 16:30 | |
| *** sdake has quit IRC | 16:33 | |
| *** Michael-zte2 has joined #openstack-meeting-4 | 16:38 | |
| *** Michael-zte has quit IRC | 16:40 | |
| *** jose-phillips has joined #openstack-meeting-4 | 16:52 | |
| *** jose-phi_ has joined #openstack-meeting-4 | 16:54 | |
| *** jose-phillips has quit IRC | 16:54 | |
| *** vsaienk0 has joined #openstack-meeting-4 | 16:55 | |
| *** vmorris has joined #openstack-meeting-4 | 16:57 | |
| *** amotoki has joined #openstack-meeting-4 | 16:57 | |
| *** markmcclain has quit IRC | 17:02 | |
| *** vsaienk0 has left #openstack-meeting-4 | 17:03 | |
| *** armax has quit IRC | 17:05 | |
| *** dave-mcc_ has quit IRC | 17:06 | |
| *** erikmwilson has quit IRC | 17:08 | |
| *** erikwilson has joined #openstack-meeting-4 | 17:08 | |
| *** alexchadin has quit IRC | 17:11 | |
| *** matrohon has quit IRC | 17:17 | |
| *** markmcclain has joined #openstack-meeting-4 | 17:19 | |
| *** acabot has quit IRC | 17:24 | |
| *** jose-phi_ has quit IRC | 17:24 | |
| *** jose-phillips has joined #openstack-meeting-4 | 17:30 | |
| *** johnsom has quit IRC | 17:30 | |
| *** johnsom has joined #openstack-meeting-4 | 17:30 | |
| *** julim_ has joined #openstack-meeting-4 | 17:31 | |
| *** julim has quit IRC | 17:32 | |
| *** jose-phillips has quit IRC | 17:35 | |
| *** jose-phillips has joined #openstack-meeting-4 | 17:36 | |
| *** tonytan4ever has joined #openstack-meeting-4 | 17:39 | |
| *** jose-phi_ has joined #openstack-meeting-4 | 17:40 | |
| *** neiljerram has quit IRC | 17:41 | |
| *** armax has joined #openstack-meeting-4 | 17:42 | |
| *** jose-phillips has quit IRC | 17:43 | |
| *** tonytan4ever has quit IRC | 17:44 | |
| *** tonytan_brb has joined #openstack-meeting-4 | 17:44 | |
| *** armax has quit IRC | 17:47 | |
| *** spzala has joined #openstack-meeting-4 | 17:59 | |
| *** sambetts is now known as sambetts|afk | 18:00 | |
| *** amirv has quit IRC | 18:00 | |
| *** ralonsoh has quit IRC | 18:01 | |
| *** Michael-zte2 has quit IRC | 18:01 | |
| *** amirv has joined #openstack-meeting-4 | 18:01 | |
| *** ivc_ has joined #openstack-meeting-4 | 18:05 | |
| *** rainya has joined #openstack-meeting-4 | 18:21 | |
| *** rainya has quit IRC | 18:25 | |
| *** dandruta has quit IRC | 18:26 | |
| *** salv-orlando has quit IRC | 18:35 | |
| *** salv-orlando has joined #openstack-meeting-4 | 18:36 | |
| *** dave-mccowan has joined #openstack-meeting-4 | 18:44 | |
| *** tonytan_brb has quit IRC | 18:47 | |
| *** barmaley has quit IRC | 18:47 | |
| *** tonytan4ever has joined #openstack-meeting-4 | 18:48 | |
| *** tonytan_brb has joined #openstack-meeting-4 | 18:51 | |
| *** tonytan4ever has quit IRC | 18:52 | |
| *** sacharya has joined #openstack-meeting-4 | 18:54 | |
| *** tonytan_brb has quit IRC | 19:09 | |
| *** woodard has joined #openstack-meeting-4 | 19:09 | |
| *** tonytan4ever has joined #openstack-meeting-4 | 19:09 | |
| *** amirv has quit IRC | 19:12 | |
| *** matrohon has joined #openstack-meeting-4 | 19:14 | |
| *** joanna has joined #openstack-meeting-4 | 19:19 | |
| *** bobmel has joined #openstack-meeting-4 | 19:26 | |
| *** bobmel has quit IRC | 19:31 | |
| *** vishnoianil has joined #openstack-meeting-4 | 19:56 | |
| *** sdake has joined #openstack-meeting-4 | 19:57 | |
| *** cfarquhar has joined #openstack-meeting-4 | 19:58 | |
| *** bobh has joined #openstack-meeting-4 | 20:07 | |
| *** bobh has quit IRC | 20:07 | |
| *** bobh has joined #openstack-meeting-4 | 20:07 | |
| *** bobh has quit IRC | 20:09 | |
| *** spzala has quit IRC | 20:14 | |
| *** dtardivel has quit IRC | 20:14 | |
| *** tonytan4ever has quit IRC | 20:17 | |
| *** tonytan4ever has joined #openstack-meeting-4 | 20:18 | |
| *** adisky_ has quit IRC | 20:19 | |
| *** rainya has joined #openstack-meeting-4 | 20:22 | |
| *** salv-orlando has quit IRC | 20:23 | |
| *** bobh has joined #openstack-meeting-4 | 20:23 | |
| *** bobh has quit IRC | 20:24 | |
| *** rainya has quit IRC | 20:27 | |
| *** Syed__ has joined #openstack-meeting-4 | 20:29 | |
| *** revon has joined #openstack-meeting-4 | 20:29 | |
| *** woodster_ has joined #openstack-meeting-4 | 20:32 | |
| *** jose-phi_ has quit IRC | 20:33 | |
| *** dave-mccowan has quit IRC | 20:34 | |
| *** rtheis has joined #openstack-meeting-4 | 20:34 | |
| *** jose-phillips has joined #openstack-meeting-4 | 20:36 | |
| *** rtheis has quit IRC | 20:48 | |
| *** spzala has joined #openstack-meeting-4 | 20:49 | |
| *** MeganR has joined #openstack-meeting-4 | 20:58 | |
| *** salv-orlando has joined #openstack-meeting-4 | 21:09 | |
| *** jose-phillips has quit IRC | 21:12 | |
| *** jose-phillips has joined #openstack-meeting-4 | 21:14 | |
| *** rfolco has quit IRC | 21:15 | |
| *** rainya has joined #openstack-meeting-4 | 21:23 | |
| *** sdake_ has joined #openstack-meeting-4 | 21:24 | |
| *** sdake has quit IRC | 21:24 | |
| *** rainya has quit IRC | 21:27 | |
| *** sdake_ has quit IRC | 21:27 | |
| *** sdake has joined #openstack-meeting-4 | 21:28 | |
| *** dave-mccowan has joined #openstack-meeting-4 | 21:32 | |
| *** l4yerffeJ has joined #openstack-meeting-4 | 21:34 | |
| *** l4yerffeJ__ has quit IRC | 21:34 | |
| *** Jeffrey4l has quit IRC | 21:34 | |
| *** Jeffrey4l has joined #openstack-meeting-4 | 21:35 | |
| *** sdake has quit IRC | 21:41 | |
| *** tonytan4ever has quit IRC | 21:44 | |
| *** salv-orlando has quit IRC | 21:47 | |
| *** v1k0d3n has joined #openstack-meeting-4 | 21:50 | |
| *** bobmel has joined #openstack-meeting-4 | 21:54 | |
| *** dave-mccowan has quit IRC | 21:54 | |
| *** thorst has quit IRC | 21:55 | |
| *** sdake has joined #openstack-meeting-4 | 21:57 | |
| *** bobmel has quit IRC | 21:58 | |
| *** bobh has joined #openstack-meeting-4 | 22:01 | |
| *** MeganR has quit IRC | 22:01 | |
| *** lrensing has quit IRC | 22:04 | |
| *** sdake_ has joined #openstack-meeting-4 | 22:12 | |
| *** salv-orlando has joined #openstack-meeting-4 | 22:12 | |
| *** spzala has quit IRC | 22:13 | |
| *** sdake has quit IRC | 22:14 | |
| *** marst has quit IRC | 22:15 | |
| *** yamamoto has joined #openstack-meeting-4 | 22:15 | |
| *** Dmitrii-Sh has quit IRC | 22:22 | |
| *** salv-orl_ has joined #openstack-meeting-4 | 22:24 | |
| *** thorst has joined #openstack-meeting-4 | 22:24 | |
| *** salv-orlando has quit IRC | 22:26 | |
| *** rbak has joined #openstack-meeting-4 | 22:27 | |
| *** thorst has quit IRC | 22:28 | |
| *** woodard has quit IRC | 22:28 | |
| *** woodard has joined #openstack-meeting-4 | 22:29 | |
| *** woodard has quit IRC | 22:33 | |
| *** matrohon has quit IRC | 22:35 | |
| *** julim_ has quit IRC | 22:38 | |
| *** rbak has quit IRC | 22:53 | |
| *** medberry is now known as med_ | 23:05 | |
| *** rbak has joined #openstack-meeting-4 | 23:08 | |
| *** v1k0d3n has quit IRC | 23:08 | |
| *** bobh has quit IRC | 23:09 | |
| *** spzala has joined #openstack-meeting-4 | 23:14 | |
| *** spzala has quit IRC | 23:18 | |
| *** jose-phillips has quit IRC | 23:23 | |
| *** rainya has joined #openstack-meeting-4 | 23:25 | |
| *** klamath has quit IRC | 23:25 | |
| *** rainya has quit IRC | 23:30 | |
| *** jose-phillips has joined #openstack-meeting-4 | 23:30 | |
| *** spzala has joined #openstack-meeting-4 | 23:36 | |
| *** galstrom is now known as galstrom_zzz | 23:38 | |
| *** salv-orl_ has quit IRC | 23:50 | |
| *** vmorris has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!