| opendevreview | Brian Haley proposed openstack/networking-ovn stable/train: Add Health Monitor support https://review.opendev.org/c/openstack/networking-ovn/+/796063 | 00:04 |
|---|---|---|
| opendevreview | Brian Haley proposed openstack/networking-ovn stable/train: Add Health Monitor support https://review.opendev.org/c/openstack/networking-ovn/+/796063 | 00:29 |
| kklimonda | Hi, I'm looking for some clarifications on vlan-based provider networks. how would networking configuration for that work, when interface is shared between tunnel interface (used by computes to communicate with each other) and "external" interface (the one that provider networks are connected to)? | 06:53 |
| kklimonda | I see two ways of doing that - adding an internal port to vswitchd, or adding a vlan interface directly on the interface managed by ovs (marked with "master ovs-system" in ip l output). I've actually tested the second approach and it works, the first one should also work in theory. | 06:55 |
| *** rpittau|afk is now known as rpittau | 07:07 | |
| ralonsoh | lajoskatona, hi, can you rebase https://review.opendev.org/c/openstack/oslo.privsep/+/794993 | 07:21 |
| ralonsoh | and address the comments on https://review.opendev.org/c/openstack/neutron-specs/+/767337 | 07:21 |
| ralonsoh | (I think the spec is almost ready) | 07:22 |
| lajoskatona | ralonsoh: sure, I am already started | 07:22 |
| ralonsoh | perfect | 07:22 |
| opendevreview | Slawek Kaplonski proposed openstack/neutron-tempest-plugin master: Fix required extensions for the subnet's service type API tests https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/797594 | 07:39 |
| opendevreview | Rodolfo Alonso proposed openstack/neutron master: Sanitize MAC addresses https://review.opendev.org/c/openstack/neutron/+/789831 | 07:41 |
| opendevreview | Slawek Kaplonski proposed openstack/neutron master: [OVN] Add subnet-service-types as supported by OVN mech driver https://review.opendev.org/c/openstack/neutron/+/797595 | 07:48 |
| opendevreview | Mamatisa Nurmatov proposed openstack/neutron master: use payloads for PORT BEFORE_UPDATE events https://review.opendev.org/c/openstack/neutron/+/795964 | 08:51 |
| opendevreview | Lajos Katona proposed openstack/networking-bgpvpn stable/train: [EM releases] Move non-voting jobs to the experimental queue https://review.opendev.org/c/openstack/networking-bgpvpn/+/796476 | 09:07 |
| opendevreview | Mamatisa Nurmatov proposed openstack/neutron master: use payloads for PORT BEFORE_UPDATE events https://review.opendev.org/c/openstack/neutron/+/795964 | 09:15 |
| ralonsoh | slaweq, https://review.opendev.org/c/openstack/neutron/+/797051 | 09:18 |
| ralonsoh | good catches, I'll propose a new PS now | 09:19 |
| opendevreview | Slawek Kaplonski proposed openstack/neutron-tempest-plugin master: Fix required extensions for the subnet's service type API tests https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/797594 | 09:20 |
| slaweq | ralonsoh thx, sorry for catching it so late but I just though about it today when I was reviewing it :) | 09:21 |
| ralonsoh | slaweq, that's ok and I'll propose changes for the other projects too | 09:21 |
| slaweq | ralonsoh++ thx | 09:21 |
| JohnnyW | Hi, just a question regarding neutron vpnaas functionality, I just upgraded all neutron controllers from rocky to stein and was doing verification of functionalities. I realized that when I'm creating new ipsec s2s connection it finally stays in status PENDING_CREATE even if it's working correctly, I mean I can connect from both sides correctly. | 09:54 |
| JohnnyW | Unfortunately this status is not changing even in several hours, it looks like it stays. I installed the newest package for stein(14.0.1 -> python3-neutron-vpnaas 2:14.0.1-0ubuntu1~cloud0 ), I checked the strongswan logs from both sides and they're looking exactly the same(connection established/installed). Anyone observed something | 09:54 |
| JohnnyW | similar? Thanks in advance for info! :) | 09:54 |
| opendevreview | Rodolfo Alonso proposed openstack/neutron master: Make explicit the network backend used in the CI jobs https://review.opendev.org/c/openstack/neutron/+/797051 | 10:07 |
| slaweq | ralonsoh can You maybe +W https://review.opendev.org/c/openstack/neutron/+/787691/ ? | 10:32 |
| slaweq | it already have +2 from You and haleyb :) | 10:32 |
| opendevreview | Slawek Kaplonski proposed openstack/neutron master: DVR: Populate ARP entries of the allowed_address_pairs to the routers https://review.opendev.org/c/openstack/neutron/+/601336 | 10:37 |
| ralonsoh | slaweq, let me check | 10:37 |
| velizarx | Hey ralonsoh. I want to raise my question about RBAC bgpvpn implementation again. As I see we cannot initialize RBAC Object class for bgpvpn inside networking-bgpvpn repository because of this dinamic load (https://github.com/openstack/neutron/blob/1ad9ca56b07ffdc9f7e0bc6a62af61961b9128eb/neutron/db/rbac_db_models.py#L85). I've already tried to do this and it did not work. So my question, can I add RBACObject and RBAC database model to the | 10:42 |
| velizarx | main neutron repo? | 10:42 |
| velizarx | sorry :( it was old message c&p | 10:43 |
| ralonsoh | velizarx, did you import the module from networking_ggpvpn.neutron.services.plugin? | 10:43 |
| velizarx | working on it now | 10:44 |
| velizarx | and testing | 10:44 |
| ralonsoh | so what you did? | 10:44 |
| velizarx | ralonsoh, my message above was a misclick, I've just sent the old message again, sorry. I'm trying to change the code as you mentioned and will let you know soon. | 10:47 |
| ralonsoh | perfect | 10:48 |
| velizarx | I also wanna ask about this bug/feature https://bugs.launchpad.net/neutron/+bug/1933242 What was the main reason to do not add 'shared' field as other objects have? | 10:50 |
| ralonsoh | velizarx, you can share SGs using RBAC, the "shared" field was the old way to share objects | 10:54 |
| ralonsoh | having RBACs, this field is not necessary | 10:54 |
| ralonsoh | slaweq can provide better feedback, I think | 10:55 |
| velizarx | but what if we have our own policy.json config? how we can show shared SG for special role? It's impossible without shared field | 10:57 |
| ralonsoh | then you need to change your policy file | 10:59 |
| velizarx | already changed, please re-read the link https://bugs.launchpad.net/neutron/+bug/1933242 all the problem described there | 11:00 |
| slaweq | velizarx I think those are 2 different things: one is "shared" attribute which is available for some resources, and then resource is shared with everyone always | 11:03 |
| slaweq | that can be included in the policy | 11:03 |
| slaweq | and other thing is RBAC which allows You to share things with only some tenants | 11:03 |
| slaweq | and that is "independent" of policy file | 11:03 |
| opendevreview | Merged openstack/ovn-octavia-provider master: Ensure that load balancer is added to logical switch https://review.opendev.org/c/openstack/ovn-octavia-provider/+/796095 | 11:11 |
| opendevreview | Slawek Kaplonski proposed openstack/neutron master: Remove tox_install_siblings=False from the functional job's definition https://review.opendev.org/c/openstack/neutron/+/797622 | 11:12 |
| opendevreview | Slawek Kaplonski proposed openstack/neutron-lib master: Add Neutron's functional job to the neutron-lib's CI https://review.opendev.org/c/openstack/neutron-lib/+/797281 | 11:13 |
| opendevreview | Manu B proposed openstack/neutron-specs master: BGPaaS enhancements https://review.opendev.org/c/openstack/neutron-specs/+/783791 | 11:15 |
| opendevreview | Mamatisa Nurmatov proposed openstack/neutron master: use payloads for PORT AFTER_UPDATE events https://review.opendev.org/c/openstack/neutron/+/795117 | 11:33 |
| velizarx | slaweq, thx for explanation. My task is to share special SG to special projects, and the same time the users in those projects should not have 'admin' role. For subnetpools for example we use rule like "field:subnetpools:shared=True" and it works. For SG I cannot find a way how to do it. | 12:14 |
| gregraka | ndeevy | 12:19 |
| amotoki | velizarx: I looked at the bug you mentioned. one question: why do you need to change the default policy of "get_security_group"? | 12:53 |
| amotoki | velizarx: if you would like to share a special SG to specific projects, I think what you need to do is just to configure RBAC of secgroups. | 12:54 |
| amotoki | velizarx: I wonder you have more requirements. | 12:54 |
| velizarx | amotoki, In our installation we use lots of roles for the users. And only users which have special role 'security_group_admin' should be able to manage them. Full our policy.json file https://github.com/sapcc/helm-charts/blob/master/openstack/neutron/templates/etc/_neutron-policy.json.tpl | 12:57 |
| velizarx | yes, I use RBAC, and rule is created, but the end-user cannot see shared SG because of policies. Because of policies cannot understand that the SG was shared. | 12:59 |
| amotoki | velizarx: what happens if you use the default policy for "get_security_group". If a normal user (I mean a user without the special role) cannot create a new security group or rule, such user can only see SG shared to a project the user belongs to. | 13:01 |
| amotoki | velizarx: I might be missing something though. | 13:01 |
| opendevreview | Rodolfo Alonso proposed openstack/os-vif master: Make explicit the network backend used in the CI jobs https://review.opendev.org/c/openstack/os-vif/+/797640 | 13:05 |
| velizarx | amotoki, not everyone in the projects should see the SGы. Should see only those have other special role 'securitygroup_viewer'. So our policy looks like: "get_security_group": "rule:context_is_securitygroup_viewer" (https://github.com/sapcc/helm-charts/blob/master/openstack/neutron/templates/etc/_neutron-policy.json.tpl#L152) | 13:08 |
| velizarx | we controls everything what the user can see/do in the project by our roles | 13:09 |
| amotoki | velizarx: so can only users who matches context_is_securitygroup_viewe use such security group? | 13:16 |
| amotoki | velizarx: or do you want users without special roles (role for management and role for view) to use a shared SG when creating a serverr or associating it to a port? | 13:17 |
| velizarx | yes, and only users who matches context_is_securitygroup_admin (role:security_group_admin underhood) can manage (create/delete/update) SGs | 13:17 |
| velizarx | this is answer for first question :) | 13:18 |
| amotoki | velizarx: my first question is about visibility (not managablity) | 13:18 |
| velizarx | yes, only users which have 'viewer' role should use SGs | 13:19 |
| velizarx | not everyone in the project | 13:19 |
| velizarx | this is why we need to understand that SG was shared on the policy level also. Because for now the 'viewer' can see only own (created in this project) SGs | 13:21 |
| amotoki | velizarx: ack. what happens if you define a role like "sg_viewer" and allow only users with "sg_viewer" role in the policy? | 13:23 |
| velizarx | amotoki, in this case the users will not see 'shared' SGs (this is current problem) | 13:24 |
| amotoki | velizarx: with the default policy or your costomized policy? | 13:25 |
| velizarx | amotoki, with customized | 13:25 |
| opendevreview | Merged openstack/ovn-octavia-provider stable/victoria: Ensure that load balancer is added to logical switch https://review.opendev.org/c/openstack/ovn-octavia-provider/+/796877 | 13:26 |
| amotoki | velizarx: I am checking the default current behavior when project-A shares a resource to project-B. | 13:33 |
| amotoki | velizarx: and what happens in project-B in the default policy. I need to remember/check the current behavior for further advise. | 13:33 |
| opendevreview | Merged openstack/ovn-octavia-provider stable/ussuri: Ensure that load balancer is added to logical switch https://review.opendev.org/c/openstack/ovn-octavia-provider/+/796876 | 13:38 |
| opendevreview | Slawek Kaplonski proposed openstack/neutron-lib master: Add Neutron's functional job to the neutron-lib's CI https://review.opendev.org/c/openstack/neutron-lib/+/797281 | 13:44 |
| amotoki | velizarx: I got the situation. I succeeded to reproduce it when disabling the old deprecated rules (enforce_new_defaults=True) | 13:47 |
| amotoki | velizarx: I will confirm the bug. | 13:47 |
| velizarx | amotoki, could you explain a bit where is a problem in the description of the bug? I can take the bug and try to fix it by myself. | 13:49 |
| amotoki | velizarx: sure. I will add a note on the bug. | 13:50 |
| velizarx | thank you for debugging | 13:50 |
| amotoki | slaweq: after checking the current behavior of RBAC (during the dsicussion with velizarx above), when set enforce_new_defaults=True, a SG shared via RBAC is NOT visible in a target project. Previously we did not hit it with the default policy but it will be a problem when we enforce new rules. | 13:51 |
| amotoki | slaweq: above is just FYI. I will look into it more. | 13:51 |
| opendevreview | Slawek Kaplonski proposed openstack/neutron-lib master: Add Neutron's functional job to the neutron-lib's CI https://review.opendev.org/c/openstack/neutron-lib/+/797281 | 13:52 |
| slaweq | amotoki thx, please open bug for that | 13:52 |
| slaweq | we will probabably have more issues like that in the future | 13:52 |
| amotoki | slaweq: the bug is https://bugs.launchpad.net/neutron/+bug/1933242 | 13:53 |
| amotoki | I am adding a comment. I just would like to share it as it is related to secure rbac work. | 13:53 |
| slaweq | I'm now trying to get some API job to be running with enforced new defaults, but it's not really supported in devstack nor tempest yet | 13:53 |
| slaweq | so it's not easy | 13:53 |
| amotoki | :( | 13:54 |
| amotoki | velizarx: I added a comment to the bug and it describes what I checked. | 14:04 |
| opendevreview | Sebastian Lohff proposed openstack/neutron master: Correctly label port as SubPort in SubPortNotFound https://review.opendev.org/c/openstack/neutron/+/788706 | 14:14 |
| opendevreview | Merged openstack/ovn-octavia-provider stable/wallaby: Ensure that load balancer is added to logical switch https://review.opendev.org/c/openstack/ovn-octavia-provider/+/796839 | 15:11 |
| opendevreview | Oleg Bondarev proposed openstack/neutron master: Improve Port list and show https://review.opendev.org/c/openstack/neutron/+/790691 | 15:24 |
| opendevreview | Terry Wilson proposed openstack/networking-ovn stable/train: DNM, testing dsvm-functional-py27 https://review.opendev.org/c/openstack/networking-ovn/+/797682 | 15:34 |
| opendevreview | Oleg Bondarev proposed openstack/neutron stable/wallaby: Improve Subnet create performance https://review.opendev.org/c/openstack/neutron/+/797588 | 15:35 |
| opendevreview | Oleg Bondarev proposed openstack/neutron stable/victoria: Improve Subnet create performance https://review.opendev.org/c/openstack/neutron/+/797589 | 15:36 |
| opendevreview | Oleg Bondarev proposed openstack/neutron stable/ussuri: Improve Subnet create performance https://review.opendev.org/c/openstack/neutron/+/797590 | 15:36 |
| opendevreview | Oleg Bondarev proposed openstack/neutron stable/train: Improve Subnet create performance https://review.opendev.org/c/openstack/neutron/+/797591 | 15:36 |
| opendevreview | Oleg Bondarev proposed openstack/neutron stable/wallaby: Improve Subnet delete performance https://review.opendev.org/c/openstack/neutron/+/797592 | 15:37 |
| opendevreview | Oleg Bondarev proposed openstack/neutron stable/victoria: Improve Subnet delete performance https://review.opendev.org/c/openstack/neutron/+/797693 | 15:38 |
| opendevreview | Oleg Bondarev proposed openstack/neutron stable/ussuri: Improve Subnet delete performance https://review.opendev.org/c/openstack/neutron/+/797695 | 15:39 |
| opendevreview | Oleg Bondarev proposed openstack/neutron stable/train: Improve Subnet delete performance https://review.opendev.org/c/openstack/neutron/+/797696 | 15:39 |
| opendevreview | Lajos Katona proposed openstack/neutron-specs master: BFD support for Neutron https://review.opendev.org/c/openstack/neutron-specs/+/767337 | 15:40 |
| *** gthiemon1e is now known as gthiemonge | 15:49 | |
| opendevreview | Merged openstack/neutron master: [OVN] Disable mcast_flood on localnet ports https://review.opendev.org/c/openstack/neutron/+/797418 | 15:51 |
| *** rpittau is now known as rpittau|afk | 16:08 | |
| opendevreview | Terry Wilson proposed openstack/networking-ovn stable/train: Use TCP keepalives for ovsdb connections https://review.opendev.org/c/openstack/networking-ovn/+/797692 | 16:10 |
| opendevreview | Terry Wilson proposed openstack/networking-ovn stable/train: Use TCP keepalives for ovsdb connections https://review.opendev.org/c/openstack/networking-ovn/+/797714 | 16:14 |
| opendevreview | Terry Wilson proposed openstack/networking-ovn stable/train: Use TCP keepalives for ovsdb connections https://review.opendev.org/c/openstack/networking-ovn/+/795633 | 16:15 |
| opendevreview | Rodolfo Alonso proposed openstack/neutron stable/train: Revert "Increase log information when a RootHelperProcess fails" https://review.opendev.org/c/openstack/neutron/+/797703 | 16:32 |
| opendevreview | Merged openstack/neutron stable/wallaby: Make default hypervisor hostname compatible with libvirt https://review.opendev.org/c/openstack/neutron/+/796854 | 17:24 |
| opendevreview | Merged openstack/neutron stable/victoria: Make default hypervisor hostname compatible with libvirt https://review.opendev.org/c/openstack/neutron/+/796855 | 17:32 |
| opendevreview | Merged openstack/neutron stable/ussuri: Make default hypervisor hostname compatible with libvirt https://review.opendev.org/c/openstack/neutron/+/796856 | 17:32 |
| opendevreview | Merged openstack/neutron stable/wallaby: Force to close http connection after notify about HA router status https://review.opendev.org/c/openstack/neutron/+/797407 | 18:43 |
| opendevreview | Merged openstack/neutron stable/victoria: Force to close http connection after notify about HA router status https://review.opendev.org/c/openstack/neutron/+/797408 | 18:43 |
| opendevreview | Brian Haley proposed openstack/networking-ovn stable/train: Add Health Monitor support https://review.opendev.org/c/openstack/networking-ovn/+/796063 | 18:55 |
| opendevreview | Merged openstack/neutron stable/ussuri: Force to close http connection after notify about HA router status https://review.opendev.org/c/openstack/neutron/+/797409 | 19:00 |
| opendevreview | Merged openstack/neutron stable/train: Force to close http connection after notify about HA router status https://review.opendev.org/c/openstack/neutron/+/797410 | 19:01 |
| opendevreview | Brian Haley proposed openstack/networking-ovn stable/train: Add Health Monitor support https://review.opendev.org/c/openstack/networking-ovn/+/796063 | 19:17 |
| opendevreview | Brian Haley proposed openstack/networking-ovn stable/train: Add Health Monitor support https://review.opendev.org/c/openstack/networking-ovn/+/796063 | 20:13 |
| opendevreview | Merged openstack/neutron master: use callback payloads for SECURITY_GROUP_RULE https://review.opendev.org/c/openstack/neutron/+/792895 | 20:22 |
| opendevreview | Merged openstack/neutron master: Config option to enable OVN IDL on other workers https://review.opendev.org/c/openstack/neutron/+/795781 | 20:23 |
| opendevreview | Merged openstack/neutron stable/ussuri: Make phynet paramter also is optional when network_segment_range enabled https://review.opendev.org/c/openstack/neutron/+/795279 | 20:23 |
| admin1 | hi guys .. for a network $uuid, which table in sql holds what dhcp agents are in which nodes | 20:35 |
| admin1 | found it \o/ | 20:39 |
| opendevreview | Merged openstack/neutron master: [ovn] Clean-up unused ACL method for DHCP https://review.opendev.org/c/openstack/neutron/+/789777 | 20:58 |
| opendevreview | Terry Wilson proposed openstack/networking-ovn stable/train: Use TCP keepalives for ovsdb connections https://review.opendev.org/c/openstack/networking-ovn/+/795633 | 21:01 |
| opendevreview | Mamatisa Nurmatov proposed openstack/neutron master: use callback payloads for SUBNET https://review.opendev.org/c/openstack/neutron/+/796011 | 21:15 |
| opendevreview | Mamatisa Nurmatov proposed openstack/neutron master: use callback payloads for SECURITY_GROUP https://review.opendev.org/c/openstack/neutron/+/674044 | 21:17 |
| opendevreview | Mamatisa Nurmatov proposed openstack/neutron master: use payloads for PORT AFTER_UPDATE events https://review.opendev.org/c/openstack/neutron/+/795117 | 21:19 |
| opendevreview | Mamatisa Nurmatov proposed openstack/neutron master: use payloads for PORT AFTER_DELETE events https://review.opendev.org/c/openstack/neutron/+/797004 | 21:19 |
| opendevreview | Merged openstack/neutron-specs master: L3 router support ndp proxy https://review.opendev.org/c/openstack/neutron-specs/+/728628 | 22:01 |
| opendevreview | Merged openstack/neutron master: Bump neutron-lib to 2.12.0 https://review.opendev.org/c/openstack/neutron/+/796404 | 22:37 |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!