| *** gangil1 has joined #openstack-neutron-ovn | 00:08 | |
| *** gangil has quit IRC | 00:09 | |
| *** armax has quit IRC | 00:11 | |
| *** shettyg has quit IRC | 00:39 | |
| *** chandrav has quit IRC | 00:49 | |
| *** gangil1 has quit IRC | 01:02 | |
| *** chandrav has joined #openstack-neutron-ovn | 01:09 | |
| switchcade | russellb: yeah, so it looks like the ingress/egress sides weren't really mirrored | 01:25 |
|---|---|---|
| switchcade | well, it's a bit more subtle than that | 01:25 |
| russellb | switchcade: sorted out what was going on? | 01:26 |
| switchcade | I believe so. We hit some minor snags trying to patch OVN to do the right thing in the interim | 01:27 |
| switchcade | but basically if stateful rules were enabled anywhere, then they were enabled everywhere. | 01:27 |
| switchcade | so, for the VM port, you had rules to handle the traffic correctly | 01:27 |
| switchcade | but for the logical port, conntrack would occur at ingress for the initial packet... then when the response comes, on egress towards local port, it would go through conntrack and be marked as "invalid" | 01:28 |
| switchcade | it seems if a SYN packet is sent through conntrack for a new connection, it will report back "+trk+new" | 01:28 |
| switchcade | if a response packet comes back through conntrack, but the connection cannot be found, it will report back "+trk+inv" | 01:29 |
| switchcade | in this case, we didn't commit ingress from in_port=2 | 01:29 |
| switchcade | so, reply in egress to port=2 would come back invalid | 01:29 |
| switchcade | basic solution is probably to massage the rules to have explicit rules handling both ports | 01:30 |
| switchcade | better solution is to improve flow generation in OVN so that conntrack doesn't occur on a port if there is no stateful firewall there | 01:31 |
| switchcade | Justin said he'll look a bit more tonight. | 01:32 |
| russellb | cool thanks a bunch for diving in! | 01:32 |
| switchcade | np:) | 01:33 |
| *** azbiswas has joined #openstack-neutron-ovn | 01:46 | |
| *** yamamoto has joined #openstack-neutron-ovn | 01:47 | |
| *** azbiswas has quit IRC | 01:52 | |
| *** azbiswas has joined #openstack-neutron-ovn | 01:52 | |
| *** chandrav has quit IRC | 02:14 | |
| *** yamamoto has quit IRC | 02:42 | |
| *** chandrav has joined #openstack-neutron-ovn | 03:08 | |
| *** yamamoto has joined #openstack-neutron-ovn | 03:19 | |
| *** chandrav has quit IRC | 03:35 | |
| *** armax has joined #openstack-neutron-ovn | 03:38 | |
| *** chandrav has joined #openstack-neutron-ovn | 03:57 | |
| *** azbiswas has quit IRC | 04:18 | |
| *** shettyg1 has quit IRC | 04:18 | |
| *** azbiswas has joined #openstack-neutron-ovn | 05:14 | |
| *** azbiswas has quit IRC | 05:15 | |
| *** azbiswas has joined #openstack-neutron-ovn | 05:38 | |
| *** armax has quit IRC | 05:40 | |
| switchcade | russellb: so the changes Justin put together got it working on that server. I also noticed an unrelated bug which I believe affects OVS-2.4 and hasn't been otherwise noticed :-) | 05:54 |
| switchcade | I just ran the neutron commands to clear the rules, then re-instated the defaults and I can ping/ssh through | 05:54 |
| *** azbiswas has quit IRC | 06:36 | |
| *** azbiswas has joined #openstack-neutron-ovn | 06:45 | |
| *** subscope has quit IRC | 07:29 | |
| ajo | switchcade, you're having real fun | 08:09 |
| ajo | :) | 08:09 |
| * ajo on envy... ;D | 08:10 | |
| *** fzdarsky has joined #openstack-neutron-ovn | 08:17 | |
| *** ajo has quit IRC | 08:37 | |
| *** ajo has joined #openstack-neutron-ovn | 08:39 | |
| *** subscope has joined #openstack-neutron-ovn | 08:44 | |
| *** azbiswas has quit IRC | 09:08 | |
| *** azbiswas has joined #openstack-neutron-ovn | 09:08 | |
| *** azbiswas has quit IRC | 09:12 | |
| *** subscope has quit IRC | 09:32 | |
| *** subscope has joined #openstack-neutron-ovn | 09:33 | |
| *** subscope has quit IRC | 09:52 | |
| *** subscope has joined #openstack-neutron-ovn | 10:59 | |
| *** subscope has quit IRC | 11:20 | |
| *** subscope has joined #openstack-neutron-ovn | 11:22 | |
| *** subscope has quit IRC | 11:29 | |
| *** subscope has joined #openstack-neutron-ovn | 11:34 | |
| *** subscope has quit IRC | 11:44 | |
| *** subscope has joined #openstack-neutron-ovn | 11:45 | |
| *** azbiswas has joined #openstack-neutron-ovn | 12:11 | |
| *** yamamoto has quit IRC | 12:12 | |
| *** azbiswas has quit IRC | 12:17 | |
| *** subscope has quit IRC | 12:29 | |
| *** subscope has joined #openstack-neutron-ovn | 12:29 | |
| *** subscope has quit IRC | 12:31 | |
| *** subscope has joined #openstack-neutron-ovn | 12:33 | |
| *** regXboi has joined #openstack-neutron-ovn | 12:51 | |
| *** yamamoto has joined #openstack-neutron-ovn | 12:57 | |
| *** flaviof has quit IRC | 13:30 | |
| *** chandrav has quit IRC | 13:36 | |
| *** chandrav has joined #openstack-neutron-ovn | 13:53 | |
| *** azbiswas has joined #openstack-neutron-ovn | 14:17 | |
| *** shettyg has joined #openstack-neutron-ovn | 14:27 | |
| *** thumpba has joined #openstack-neutron-ovn | 14:30 | |
| *** azbiswas has quit IRC | 14:30 | |
| *** chandrav has quit IRC | 14:37 | |
| *** flaviof has joined #openstack-neutron-ovn | 14:42 | |
| *** azbiswas has joined #openstack-neutron-ovn | 14:44 | |
| *** azbiswas has quit IRC | 14:48 | |
| *** yamamoto has quit IRC | 14:51 | |
| *** yamamoto has joined #openstack-neutron-ovn | 14:59 | |
| *** azbiswas has joined #openstack-neutron-ovn | 15:26 | |
| *** subscope has quit IRC | 15:28 | |
| *** thumpba has quit IRC | 15:36 | |
| *** azbiswas has quit IRC | 15:41 | |
| *** azbiswas has joined #openstack-neutron-ovn | 15:42 | |
| *** yamamoto has quit IRC | 15:46 | |
| *** thumpba has joined #openstack-neutron-ovn | 15:47 | |
| *** armax has joined #openstack-neutron-ovn | 16:01 | |
| *** yamamoto has joined #openstack-neutron-ovn | 16:08 | |
| *** gangil has joined #openstack-neutron-ovn | 16:10 | |
| *** gangil has quit IRC | 16:10 | |
| *** gangil has joined #openstack-neutron-ovn | 16:10 | |
| *** thumpba has quit IRC | 16:12 | |
| *** chandrav has joined #openstack-neutron-ovn | 16:12 | |
| *** thumpba has joined #openstack-neutron-ovn | 16:19 | |
| *** azbiswas_ has joined #openstack-neutron-ovn | 16:38 | |
| *** azbiswas has quit IRC | 16:40 | |
| *** yamamoto has quit IRC | 16:43 | |
| *** salv-orlando has quit IRC | 16:44 | |
| *** thumpba has quit IRC | 16:50 | |
| *** thumpba has joined #openstack-neutron-ovn | 16:53 | |
| *** chandrav has quit IRC | 16:56 | |
| *** azbiswas_ has quit IRC | 16:58 | |
| *** azbiswas has joined #openstack-neutron-ovn | 16:58 | |
| mestery | russellb: Have you ever seen this error when trying to run devstack with OVN? http://paste.openstack.org/show/475905/ | 17:11 |
| mestery | Looks like it's trying to use tox to generate the config | 17:12 |
| mestery | and tox isn't installed | 17:12 |
| * mestery is in devstack nomans land lately | 17:12 | |
| * russellb looks | 17:12 | |
| russellb | mestery: in other envs we must be installing tox as a side effect elsewhere | 17:22 |
| russellb | mestery: in my configs tempest is usually enabled, so that would get it installed if nothing else | 17:23 |
| mestery | russellb: Exactly, I'm tracking that down now. | 17:23 |
| mestery | Into the rabbit hole I go! :) | 17:23 |
| russellb | so probably just need to add tox explicitly in our plugin | 17:23 |
| russellb | or just enable tempest in your local.conf | 17:23 |
| mestery | Ooooooo | 17:26 |
| mestery | I bet that's it! | 17:26 |
| mestery | But | 17:26 |
| mestery | This is with my kuryr setup, so minimal set of things | 17:26 |
| mestery | I think it makes sense to enable it in the plugin itself | 17:26 |
| * russellb nods | 17:26 | |
| russellb | yes | 17:26 |
| mestery | I'll keep testing | 17:26 |
| mestery | and submit a patch once I get it working | 17:26 |
| russellb | adding tempest is just a hack without having to update our plugin | 17:27 |
| russellb | sweet sounds good | 17:27 |
| * mestery nods | 17:27 | |
| mestery | coolio | 17:27 |
| mestery | Sounds like a plan | 17:27 |
| russellb | go go go | 17:27 |
| *** azbiswas has quit IRC | 17:29 | |
| *** azbiswas has joined #openstack-neutron-ovn | 17:30 | |
| switchcade | russellb: o/ | 17:33 |
| * russellb hides | 17:33 | |
| russellb | jk :) | 17:33 |
| russellb | switchcade: what's up? | 17:33 |
| switchcade | :) I'm getting "ssh_exchange_identification: read: Connection reset by peer" connecting to that host now | 17:33 |
| russellb | lovely | 17:33 |
| russellb | i'm basically the worst sys admin | 17:33 |
| switchcade | hehe | 17:33 |
| russellb | works for me :/ | 17:34 |
| switchcade | hmm, could be something on my end. | 17:34 |
| russellb | try ssh -v? | 17:34 |
| switchcade | establishes connection, loads dsa key, enables compatibility mode for protocol 2.0... | 17:36 |
| switchcade | prints local version string, then connection reset message as above | 17:36 |
| russellb | welp. | 17:36 |
| switchcade | ubuntu user, right? | 17:37 |
| russellb | yes | 17:37 |
| *** thumpba has quit IRC | 17:40 | |
| *** thumpba has joined #openstack-neutron-ovn | 17:40 | |
| switchcade | figured it out:) | 17:41 |
| russellb | oh ok | 17:41 |
| russellb | on your end or mine? | 17:41 |
| switchcade | myine | 17:41 |
| russellb | k | 17:41 |
| switchcade | urgh, mine. | 17:41 |
| switchcade | I use the corporate wired network + wireless and was routing over the wrong one | 17:42 |
| russellb | damn networking | 17:42 |
| switchcade | corporate network drops SSH connections, wireless is free-for-all | 17:42 |
| russellb | ah | 17:42 |
| russellb | that sounds quite overly restrictive | 17:42 |
| russellb | guess they don't want people creating tunnels back into their network? | 17:42 |
| switchcade | well, they do also provide tunnel endpoints, I just don't use 'em ;) | 17:43 |
| switchcade | ssh gateways | 17:43 |
| russellb | gotcha | 17:43 |
| russellb | well anyway, hack away :) | 17:43 |
| russellb | it's a throwaway test vm | 17:43 |
| openstackgerrit | Kyle Mestery proposed openstack/networking-ovn: Explicitly install tox https://review.openstack.org/233195 | 17:44 |
| mestery | russellb: ^^^ | 17:44 |
| mestery | That's the fix, works with that! | 17:44 |
| mestery | Yay! | 17:44 |
| mestery | Now to actually test Kuryr with OVN :) | 17:44 |
| russellb | +2+1 | 17:44 |
| *** salv-orlando has joined #openstack-neutron-ovn | 17:44 | |
| mestery | yay! | 17:45 |
| russellb | mestery: that sounds like a good #success | 17:45 |
| mestery | Does that work in this channel? I think so, right? | 17:45 |
| russellb | hmm | 17:45 |
| russellb | guess not | 17:45 |
| russellb | it's openstackstatus | 17:45 |
| russellb | and that bot isn't in here | 17:45 |
| mestery | Ah, right | 17:46 |
| * mestery moves to #openstack-neutron | 17:46 | |
| *** salv-orlando has quit IRC | 17:48 | |
| *** chandrav has joined #openstack-neutron-ovn | 17:49 | |
| *** salv-orlando has joined #openstack-neutron-ovn | 17:49 | |
| *** yamamoto has joined #openstack-neutron-ovn | 17:50 | |
| *** gangil has quit IRC | 17:51 | |
| *** gangil has joined #openstack-neutron-ovn | 17:52 | |
| *** gangil has quit IRC | 17:52 | |
| *** gangil has joined #openstack-neutron-ovn | 17:52 | |
| switchcade | russellb: don't suppose you know off-hand where core dumps would end up if I deliberately crashed OVS? ;-) | 17:54 |
| russellb | ummmmmmm | 17:55 |
| russellb | no. | 17:55 |
| russellb | i don't know how this ubuntu thing works! | 17:55 |
| russellb | :-p | 17:55 |
| switchcade | :P | 17:55 |
| *** yamamoto has quit IRC | 17:55 | |
| *** azbiswas has quit IRC | 18:00 | |
| *** azbiswas has joined #openstack-neutron-ovn | 18:05 | |
| * mestery weeps | 18:06 | |
| mestery | After getting OVN up, now my "docker" CLI has lost the "service" command :( | 18:06 |
| * mestery grumbles and goes into the rabbit hole | 18:06 | |
| russellb | :/ | 18:06 |
| russellb | shave that yak | 18:07 |
| mestery | It's nuts | 18:07 |
| mestery | It was there yesterday | 18:07 |
| mestery | Now it's gone | 18:07 |
| * mestery thinks docker removed it | 18:07 | |
| russellb | probably | 18:07 |
| russellb | damn hipsters | 18:07 |
| mestery | I know, right! | 18:07 |
| *** cascardo` has joined #openstack-neutron-ovn | 18:11 | |
| *** cascardo has quit IRC | 18:14 | |
| *** njohnston has joined #openstack-neutron-ovn | 18:25 | |
| switchcade | <3 watch -d "ovs-ofctl dump-flows | grep foo..." | 18:29 |
| switchcade | get this beautiful blinking of packets flowing through the pipeline | 18:29 |
| russellb | switchcade: ooh, that's clever | 18:39 |
| switchcade | if you "tmux attach" on that server you'll see it:) | 18:40 |
| switchcade | the trick on a larger flow table is to get the filters down right | 18:40 |
| switchcade | openflow cookies could help with this, to some degree | 18:41 |
| switchcade | if we had one cookie for all the default rules, then one cookie per firewall rule, you could look for a fairly specific needle in the haystack | 18:41 |
| switchcade | it's not so bad at the moment with just ~70 flows, but this would help if you spin up lots of VMs | 18:42 |
| switchcade | and complex policies | 18:42 |
| *** salv-orlando has quit IRC | 18:44 | |
| *** salv-orlando has joined #openstack-neutron-ovn | 19:41 | |
| *** salv-orlando has quit IRC | 19:47 | |
| *** salv-orlando has joined #openstack-neutron-ovn | 19:49 | |
| openstackgerrit | Merged openstack/networking-ovn: Explicitly install tox https://review.openstack.org/233195 | 19:51 |
| *** salv-orlando has quit IRC | 20:35 | |
| *** njohnston is now known as nate_gone | 20:46 | |
| *** salv-orlando has joined #openstack-neutron-ovn | 21:34 | |
| *** azbiswas has quit IRC | 21:35 | |
| *** azbiswas has joined #openstack-neutron-ovn | 21:35 | |
| *** chandrav has quit IRC | 21:40 | |
| *** chandrav has joined #openstack-neutron-ovn | 21:40 | |
| *** chandrav has quit IRC | 21:40 | |
| *** azbiswas has quit IRC | 21:45 | |
| *** azbiswas_ has joined #openstack-neutron-ovn | 21:45 | |
| *** shettyg has quit IRC | 21:46 | |
| *** thumpba has quit IRC | 22:02 | |
| switchcade | russellb: btw, I'm done with your setup now, feel free to reclaim it | 22:05 |
| *** thumpba has joined #openstack-neutron-ovn | 22:14 | |
| *** thumpba has quit IRC | 22:17 | |
| *** thumpba has joined #openstack-neutron-ovn | 22:17 | |
| *** thumpba has quit IRC | 22:19 | |
| *** thumpba has joined #openstack-neutron-ovn | 22:19 | |
| *** thumpba has quit IRC | 22:20 | |
| *** thumpba has joined #openstack-neutron-ovn | 22:22 | |
| *** salv-orlando has quit IRC | 22:31 | |
| *** thumpba has quit IRC | 22:45 | |
| russellb | switchcade: cool, glad it helped | 22:51 |
| *** azbiswas_ has quit IRC | 23:03 | |
| *** regXboi has quit IRC | 23:10 | |
| *** salv-orlando has joined #openstack-neutron-ovn | 23:53 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!