Thursday, 2018-04-19

*** hoangcx has quit IRC00:14
*** hoangcx has joined #openstack-fwaas00:15
openstackgerritYushiro FURUKAWA proposed openstack/neutron-fwaas master: Fix python3 dict values breakage  https://review.openstack.org/55994100:58
*** AlexeyAbashkin has joined #openstack-fwaas01:39
*** AlexeyAbashkin has quit IRC01:43
*** annp has quit IRC05:15
*** annp has joined #openstack-fwaas05:15
*** sapd_ has joined #openstack-fwaas06:26
*** sapd__ has quit IRC06:26
*** velizarx has joined #openstack-fwaas06:52
*** velizarx has quit IRC07:07
*** AlexeyAbashkin has joined #openstack-fwaas07:26
*** velizarx has joined #openstack-fwaas07:27
*** sapd_ has quit IRC08:00
*** sapd_ has joined #openstack-fwaas08:00
*** velizarx has quit IRC11:44
*** velizarx has joined #openstack-fwaas11:48
*** yamamoto_ has quit IRC12:21
*** yamamoto has joined #openstack-fwaas12:27
*** AlexeyAbashkin has quit IRC12:34
*** AlexeyAbashkin has joined #openstack-fwaas12:36
*** velizarx has quit IRC12:43
*** hoangcx has quit IRC13:06
*** AlexeyAbashkin has quit IRC13:23
*** AlexeyAbashkin has joined #openstack-fwaas13:25
*** hoangcx has joined #openstack-fwaas13:36
*** hoangcx_ has joined #openstack-fwaas13:37
*** hoangcx has quit IRC13:41
*** wkite has joined #openstack-fwaas13:46
*** wkite has quit IRC13:46
*** wkite has joined #openstack-fwaas13:47
*** yushiro has joined #openstack-fwaas13:49
*** wkite has quit IRC13:50
*** AlexeyAbashkin has quit IRC13:52
*** wkite has joined #openstack-fwaas13:56
*** AlexeyAbashkin has joined #openstack-fwaas13:57
*** annp_ has joined #openstack-fwaas13:58
yushiro2 minutes left..13:58
*** SridarK has joined #openstack-fwaas13:59
SridarKHi FWaaS folks13:59
annp_Hi Sridark13:59
SridarKannp_: hi13:59
SridarK#startmeeting fwaas14:00
openstackMeeting started Thu Apr 19 14:00:06 2018 UTC and is due to finish in 60 minutes.  The chair is SridarK. Information about MeetBot at http://wiki.debian.org/MeetBot.14:00
openstackUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.14:00
*** openstack changes topic to " (Meeting topic: fwaas)"14:00
openstackThe meeting name has been set to 'fwaas'14:00
yushiroHi14:00
SridarK#chair xgerman_ yushiro14:00
openstackCurrent chairs: SridarK xgerman_ yushiro14:00
annp_Hi yushiro14:00
yushiroThanks SridarK and xgerman_ for last week meeting.14:00
SridarKyushiro: no worries14:00
SridarKi think today is xgerman_14:01
xgerman_o/14:01
xgerman_ok14:01
SridarKxgerman_: hi the chair is yours14:01
xgerman_#topic Announcements14:01
*** openstack changes topic to "Announcements (Meeting topic: fwaas)"14:01
yushiroOK, I'll do next week :)  Thanks xgerman_14:01
xgerman_TC nominations are open: so either run yourself or read the candidate statements14:02
SridarK+114:02
yushiro+114:03
annp_+114:03
xgerman_so this week R-1 should be cut14:03
xgerman_I haven’t paid much attention and with armax gone don’t really know who is cutting it this time14:04
xgerman_#topic Rocky: Pluggable backend Driver14:06
*** openstack changes topic to "Rocky: Pluggable backend Driver (Meeting topic: fwaas)"14:06
xgerman_doude?14:06
yushiroOh, doube is not here today.14:06
SridarKhmm ok14:06
xgerman_anyone can comment on the open issues?14:06
SridarKi think once we clarify on the issues on tests reported by annp_ and yushiro - we can move fwd14:07
xgerman_ok, sounds good — R-2 it is14:07
yushiroSridarK, yes, the cause was calling update_firewall_group instead of set_port_default_firewall_group().14:07
SridarKAlso there was some concern from VWWare on their driver that we need to clarify on14:07
SridarKwith the changes14:07
SridarKyes i think once we address these issues we can move fwd14:08
xgerman_+114:08
annp_+114:08
xgerman_#topic Rocky Address Group Spec14:08
*** openstack changes topic to "Rocky Address Group Spec (Meeting topic: fwaas)"14:08
SridarKyushiro: thx i see ur comment14:08
xgerman_#link https://review.openstack.org/#/c/557137/14:08
xgerman_wkite: please go ahead14:09
xgerman_we have comments from SridarK and njohnston which need to be addressed14:09
wkiteI see is concerned about the ip address range.14:10
xgerman_yes14:10
SridarKwkite: we will need to assess the changes that may be needed on the drivers (iptables (which may be easy) and ovs(needs some evaluation))14:11
xgerman_BTW iptables is being replaced with BPF14:11
SridarKwkite: there were some other minor comments - if u can address and we continue the review on gerrit14:12
annp_+114:12
xgerman_+114:12
SridarKxgerman_: hmm - so we will need a migration strategy - is that for L3 and L2 ?14:12
xgerman_#link https://cilium.io/blog/2018/04/17/why-is-the-kernel-community-replacing-iptables/14:13
SridarKwill be more in line with times14:13
xgerman_yep14:13
doudeHi, sorry late14:13
xgerman_ok, let’s circle back14:13
yushiroxgerman_, Aha!  I saw this document 2 days ago :)14:14
*** hoangcx_ is now known as hoangcx14:14
xgerman_:-)14:14
xgerman_#topic Rocky: Pluggable backend Driver14:14
*** openstack changes topic to "Rocky: Pluggable backend Driver (Meeting topic: fwaas)"14:14
xgerman_doude: you have the floor14:14
doudebut no much to say, I did not had time to look at it (Contrail release plan for the end of the week)14:14
doudeI'll work on it next week14:15
doudesorry for that14:15
xgerman_thanks — let’s target R-2 for it thrn14:15
SridarKdoude: other than the issues reported - we should ensure VMWare has no issue14:15
SridarKdoude: i suspect we just need to clarify14:15
doudeyes I think14:16
doudeno yet confirm14:16
SridarKlets pick it up when u have cycles next week maybe ?14:16
doudeyes I hope14:16
wkiteboth iprange module of iptable and object group-based ACLs support any ip address to any ip address,we don't need subnet to check the ip range object.14:16
wkiteIn other words, these problems have been solved at the driver level.14:17
yushirodoude, I'd like to talk about the issue of current patchset.  Do you have some time after this meeting?(about 10 minutes)14:18
doudeyes yushiro14:19
SridarKwkite: lets pick up during open discussion or on gerrit14:19
yushirodoude, cool.  Thanks.  I'd like to discuss about how to solve current issue.14:20
yushirowkite, Hi.  I'll review your spec as well.  I'm sorry I was late review .14:20
xgerman_sounds good14:21
xgerman_#topic Rocky FWaaS Logging spec14:21
*** openstack changes topic to "Rocky FWaaS Logging spec (Meeting topic: fwaas)"14:21
xgerman_ #link https://review.openstack.org/#/c/509725/14:21
annp_I think the spec is look good14:23
*** wenranxiao has joined #openstack-fwaas14:23
annp_but it should be get more attention from core14:23
*** AlexeyAbashkin has quit IRC14:23
SridarKI had no major concerns too14:23
annp_:)14:23
yushirowill check it annp_ .  Sorry I was late as well.14:23
SridarKlet me run thru once later today and i think we can move fwd14:23
annp_SridarK, thanks.14:23
yushiroyes, totally LGTM I think.14:24
xgerman_#action cores, review https://review.openstack.org/#/c/509725/14:24
annp_yushiro, thanks.14:24
annp_xgerman_: +114:24
xgerman_#topic Rocky Remote FWG14:25
*** openstack changes topic to "Rocky Remote FWG (Meeting topic: fwaas)"14:25
*** AlexeyAbashkin has joined #openstack-fwaas14:25
xgerman_#link https://review.openstack.org/#/c/521207/14:25
xgerman_I split out the plugin part since the driver will need ovs conjectures — learning as I go14:26
SridarK+114:27
xgerman_not sure what’s up with the gates  though14:27
annp_+114:27
yushiro++114:28
wkiteSridarK: My network is not good, Let's discuss it on gerrit.14:29
SridarKwkite: ok14:29
xgerman_Today was fast14:30
xgerman_#topic Open Discussion14:30
*** openstack changes topic to "Open Discussion (Meeting topic: fwaas)"14:30
yushiroya :)14:31
wkiteyushiro:welcome,thx14:31
xgerman_ok, for the ones who have not cimmented yet:14:31
xgerman_#link https://etherpad.openstack.org/p/fwaas-v2-L7-filtering14:31
annp_xgerman_: are you going to vancouver?14:32
xgerman_yes14:32
yushiroannp_ has registered forum candidate about l7 and logging.14:32
xgerman_nice14:32
annp_I just add this topic at vancouver forum14:32
xgerman_+100014:32
yushiroxgerman_, SridarK Unfortunately, I cannot go Vancouver summit ;;  But annp_ can join :)14:32
SridarKyushiro: oh sorry14:33
xgerman_:-(14:33
SridarKannp_: so u will be there14:33
annp_Yes, I can join the summit. Yushiro I'm so sad to hear that14:33
SridarKSo it seems that 3 of us will be there14:34
yushiroyees :)  Safety trip !!14:34
annp_SridarK, yes. maybe there are more member. Because Foundation will give us free hotel14:35
SridarKannp_: ok14:35
yushiroAh, I found some minor issue about devstack configuration for [fwaas]firewall_l2_driver14:35
yushiroSorry, just changing a topic.14:36
xgerman_go ahead14:36
yushiroIf we specify FW_L2_DRIVER=ovs in local.conf,  [fwaas]firewall_l2_driver is added on /etc/neutron/plugins/ml2/ml2_conf.ini14:36
annp_xgerman_, Do you think we should prepare some document for L7 filtering such as how L7 rule look like in fwaas?14:37
yushiroHowever, it wasn't loaded successfully.   -->  firewall_l2_driver = noop14:37
xgerman_annp_: yes, it’s always good to have something to show in the session14:38
SridarKyushiro: do u see what is happening ?14:38
yushiroI defined [fwaas]firewall_l2_driver = openvswitch into /etc/neutron/l3_agent.ini by manually, it succeeded.14:39
SridarKannp_: i think u can have a workflow, what the rules will look like and what is needed from an implementation to achieve this14:39
yushiroSridarK, Now I'm researching and haven't clarified yet.14:39
SridarKyushiro: ok14:39
xgerman_+114:40
xgerman_we really need to get our tempest house in order14:40
SridarKxgerman_: +1 will get on that shortly14:40
*** AlexeyAbashkin has quit IRC14:40
SridarKwe have no L2 coverage at all14:41
SridarKyushiro: this is odd - some regression or some change in devstack14:41
SridarKpossibly impacts us14:41
yushiroSridarK, Yes, I think so too.  Only effects developer :)14:42
annp_xgerman_, SridarK, +1, So we will investigate and create a basic workflow for L7 fitlering before the summit. I will create a mail thread for that. Is it ok?14:42
SridarKannp_: +114:42
*** AlexeyAbashkin has joined #openstack-fwaas14:42
yushiroannp_, That's good.14:42
annp_SridarK, thanks. :)14:42
xgerman_+114:43
annp_+114:43
yushiroannp_, I think it's more better to talk about backend technology.14:43
*** wkite has quit IRC14:44
yushiroxgerman_ pasted the link about BPF replacing in linux kernel instead of iptables.14:44
annp_In addition, As you know, iptables is being replaced by bpfilter So we can come up with bpf14:44
yushiroYes, that is :p14:44
annp_I think :)14:44
yushiroannp_, do you have link for forum candidate ?14:45
xgerman_yep, we just need to check kernel versions — things move slow in OpenStack14:45
yushiroxgerman_, +114:45
annp_http://forumtopics.openstack.org/cfp/details/14414:46
*** wkite has joined #openstack-fwaas14:46
yushiroTHX!14:46
xgerman_+114:47
annp_I think we can discuss more in next mtg.14:48
annp_:)14:48
SridarKsounds good annp_14:48
yushiroYes14:48
xgerman_we should probably beef up the description14:48
annp_yushiro, Do you want to discuss with double's patch now?14:48
xgerman_not sure who is revieiwing this and whow familiar they are with FWaaS V214:48
yushiroannp_, Yes, OK14:49
yushiroping doude14:49
yushirohttps://review.openstack.org/#/c/480265/19/neutron_fwaas/services/firewall/fwaas_plugin_v2.py@29414:50
doudeyushiro: ack14:50
yushirodoude, Plz open above link ^^^14:50
*** velizarx has joined #openstack-fwaas14:51
annp_xgerman_, +1. Can you update the description for l7 filtering? Because I'm not good at english and also technical :)14:51
xgerman_I can comment :-)14:51
doudedone yushiro14:51
annp_xgerman_, yeah. Thanks in advance.14:51
yushirodoude, In handle_update_port(), we shouldn't call update_firewall_group().   And, I think we have 2 solutions.14:53
yushiro1. Implement set_port_for_default_fwg() into plugin layer and call this method14:54
*** AlexeyAbashkin has quit IRC14:54
yushiro2. call update_firewall_group with some parameter (e.g. ignore_validation=True) and merge set_port_for_default_fwg into update_firewall_group14:55
yushiroCould you tell your opinion for plugable backend perspective.  I think you'd like to avoid calling set_ports_for_default_fwg().14:56
*** AlexeyAbashkin has joined #openstack-fwaas14:56
doudeyou mean we doesn't call update_firewall_group agent RPC method?14:56
yushirodoude, Yes. and performance perspective, at that timing, we should call set_ports_for_default_fwg().14:57
doudewhat's set_port_for_default_firewall_group ?14:58
yushirohttps://github.com/openstack/neutron-fwaas/blob/master/neutron_fwaas/db/firewall/v2/firewall_db_v2.py#L111314:58
yushiroDB layer's method.14:59
annp_set_port_for_default_fwg just added port to firewall group associated table.14:59
doudeso how the agent aware of port added to FG?15:00
xgerman_annp_: commented on the forum proposal15:00
SridarKdoude: L2 scenario is handled a bit differently15:00
annp_doube, agent will receive a port add event if there is a port is added to bridge15:00
xgerman_also time - should we close the meeting?15:00
SridarKxgerman_: +115:01
yushiroxgerman_, Yes, It's OK to close :)15:01
xgerman_#endmeeting15:01
*** openstack changes topic to "Queens (Meeting topic: fwaas)"15:01
openstackMeeting ended Thu Apr 19 15:01:13 2018 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)15:01
openstackMinutes:        http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-04-19-14.00.html15:01
openstackMinutes (text): http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-04-19-14.00.txt15:01
openstackLog:            http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-04-19-14.00.log.html15:01
annp_then agent will callback to server to check whether or not a fwg, which is attached with the port15:01
doudeok15:01
annp_you can get more detail in function handle_port at agent side15:02
doudebut I don't really like to add DB layer specific stuff in the plugin15:02
doudeperhaps e can detect in the driver is adding port to a default FG and then just add link in DB?15:02
doudethe objective of that patch is to have a plugin interface independent to the backend15:03
yushirohandle_update_port(): Associate a port with default FWG and status has changed 'PENDING_UPDATE' ---> handle_port() (agent-side) : In this method, OVS flow rule will be set into the specified port.  After that, this agent tries to send 'changing status' to ACTIVE or other status.15:03
annp_xgerman_, wow, thank you :)15:04
*** AlexeyAbashkin has quit IRC15:04
xgerman_y.w. — for the next few years just add “kubernetes” to each proposal15:05
yushirodoude, OK, so you mean 'plugin interface' is 'create_firewall_group' or 'update_firewall_group', right?15:05
doudeyes15:05
doudethen in the agent driver which is based on agent DB interface, have two hooks to handle each plugin actions: pre and post hooks15:06
yushirodoude, Aha.  So, for other vendors perspective, maybe they don't want to override set_ports_for_default_firewall_group.15:06
doudeso we should be able to identify port added on a default FG in the update_firewall_policy_precommit method of the driver15:07
doudeprobably, is specific to Neutron agent RPC implementation15:07
annp_xgerman_, "kubernetes" is hot keyword now :)15:08
*** AlexeyAbashkin has joined #openstack-fwaas15:08
doudewe could imagine a driver which use Neutron DB but not based on RCP agent mechanism15:08
SridarKdoude: When a VM come up and bound to a port - the trigger is from the agent side towards the plugin/db layer15:08
doudes/RCP/RPC15:08
SridarKunlike a user specifying a port for a FWG15:09
doudeor a driver that does not use the Neutron DB neither the RPC mechanism15:09
doudeunderstood SridarK15:09
SridarKi think we just need to fit that into the workflow15:09
doudeso I think we can fix that by using agent method 'update_firewall_policy_precommit' to catch update_firewall_group call for dding new port to default FG15:10
doudeand instead to send RPC update just add link in DB15:10
yushiroupdate_firewall_group_precommit?15:11
doudehttps://review.openstack.org/#/c/480265/19/neutron_fwaas/services/firewall/service_drivers/agents/agents.py@28915:11
doudeyushiro: --^15:11
doudeor perhaps in the postcommit, sorry my bad15:12
*** yamamoto has quit IRC15:13
*** yamamoto has joined #openstack-fwaas15:14
yushirodoude, Hmm, just a moment.15:15
SridarKyushiro: is the driver binding done after the notification to the plugin and then on a subsequent rpc from the plugin ?15:15
SridarKI have to step away for a bit - will catch the logs here15:16
yushiroSridarK, OK.15:16
doudenot sure to understand your question SridarK15:16
annp_doube, I think just instead to send RPC update by add link in DB is enough for defautl fwg.15:16
doudeyes it's what I understood annp_15:16
yushiroSridarK, Yes, it is.  After binded a port('ovs'), agent method: handle_port() is called15:17
annp_yushiro, agent will callback to server to get detail of firewall group and update firewall driver15:18
doudeI'll reproduce the bug on my sandbox and try a fix15:19
doudehope next week15:19
*** yamamoto has quit IRC15:19
annp_doube, +115:19
yushiroannp_, Ah, yes. https://github.com/openstack/neutron-fwaas/blob/master/neutron_fwaas/services/firewall/agents/l2/fwaas_v2.py#L35315:19
yushiro+1, doude15:20
doudesorry I must leave for the moment, I could read irc log later15:20
yushirodoude, OK15:20
doudethanks for your review15:20
yushiroNP :)15:20
annp_yushiro, I have to leave, now.15:22
yushiroannp_, Ah, OK.15:22
annp_yushiro, see you tmr, G9 :)15:22
yushirodoude, I'll comment on your patch.15:22
yushiroGN !!15:22
*** annp_ has quit IRC15:23
*** wkite has quit IRC15:27
*** yamamoto has joined #openstack-fwaas15:34
*** velizarx has quit IRC15:43
yushirodoude, Yes, calling update_firewall_group_precommit is just changing its status.  I think it's better.15:43
*** yushiro has quit IRC15:43
*** AlexeyAbashkin has quit IRC15:55
*** AlexeyAbashkin has joined #openstack-fwaas15:56
*** AlexeyAbashkin has quit IRC16:11
*** AlexeyAbashkin has joined #openstack-fwaas16:14
*** AlexeyAbashkin has quit IRC16:57
*** SridarK has quit IRC17:03
*** wenranxiao has quit IRC17:06
*** yamamoto has quit IRC17:20
*** mestery has quit IRC17:29
*** SumitNaiksatam has joined #openstack-fwaas17:30
*** mestery has joined #openstack-fwaas17:31
*** mestery has quit IRC18:07
*** SumitNaiksatam has quit IRC18:09
*** yamamoto has joined #openstack-fwaas18:20
*** yamamoto has quit IRC18:30
*** AlexeyAbashkin has joined #openstack-fwaas18:49
*** AlexeyAbashkin has quit IRC18:59
*** yamamoto has joined #openstack-fwaas21:49
*** hoangcx_ has joined #openstack-fwaas23:16
*** hoangcx has quit IRC23:18
*** hoangcx_ is now known as hoangcx23:22

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!