Tuesday, 2016-03-29

*** Qiming has quit IRC00:06
*** Liuqing has joined #senlin01:06
*** zzxwill has joined #senlin01:10
*** Liuqing has quit IRC01:15
*** Qiming has joined #senlin01:15
openstackgerritMerged openstack/senlin: Refactor API version range support  https://review.openstack.org/29812901:25
openstackgerritQiming Teng proposed openstack/senlin: Add support to 'latest' version  https://review.openstack.org/29848701:35
*** yanyanhu has joined #senlin01:38
xuhaiweiQiming, are you around?01:48
*** Liuqing has joined #senlin01:51
xuhaiweihave someting to discuss01:52
xuhaiweiabout container cluster, what kind of image should we use?01:53
Qimingwhat ever01:53
Qimingthe easiest one would be coreos01:53
Qimingyou can build your own using fedora, ubuntu ... etc01:53
xuhaiweiI mean for senlin to support container, we should support a default image01:53
Qimingwe just assume there is a docker daemon running inside a vm, isn't that sufficient?01:54
Qimingwe may need to consider the differences between container engines and/or guest os distros when we want to manipulate the networking/storage stuff01:56
xuhaiweibut there should be some configuration in the image when you want to start a container from senlin01:56
Qimingbut I think we are not there yet01:56
Qimingfor example? what configuration do you need?01:56
xuhaiweifor example, change unix socket ot tcp?01:57
Qimingright, you will need to do that when creating your VM01:59
Qimingit can be part of the user-data01:59
Qimingof the nova server profile, right?01:59
*** elynn has joined #senlin01:59
xuhaiweiyes, in that case, all the information are open to users also the bind port02:00
xuhaiweiuser can also get the floating IP, anyone can start a container then02:01
Qiminghow about we make them open to senlin only02:01
Qimingit is a cloud-init thing02:01
xuhaiweihow to do it?02:01
xuhaiweinot using user-data?02:01
Qimingwhen you are playing with container clusters, do you also want to expose the underlying vm clusters to users?02:02
xuhaiweiI think so02:02
xuhaiweiat least for cloud operator02:03
Qimingwhat are you talking about?02:03
Qimingcloud operators or users?02:03
*** elynn has quit IRC02:04
xuhaiweiIMO sometimes they are all users02:04
*** elynn has joined #senlin02:04
Qimingokay ... won't try convince you on this02:05
Qimingwe have talked about this 2 weeks ago, I think02:06
Qimingthe users we are talking about only cares about their app/micro-services get deployed and executed02:06
Qimingwe are not intending to provide a complete kubernetes environment02:07
xuhaiweiI know that02:07
Qimingthen why are we exposing the underlying vm clusters to those users?02:07
Qimingwe may be running containers on bare-metal, eventually02:08
Qimingbut the underlying resource pool is always supposed to be transparent to users02:08
xuhaiweifor end users they don't need to know the vms clusters , I agree with you on that02:08
Qimingyes, operators do care about the vms (or bms)02:09
Qimingand to them, there is no security concern02:09
Qimingeven there are security concern, we can solve it when we ARE there02:09
Qimingmy feeling is that we are standing where we were two weeks ago, worrying about the future two months later02:10
Qimingwe might have learned a lot of first hand lessons if we started getting our hands dirty02:12
Qimingsorry for being impatient, but we really don't have time to hesitate02:13
xuhaiweilet me think about it02:14
Qimingwe got to build up something02:14
Qimingit is not about thinking02:14
Qimingit is about doing02:14
yuanyingI just propose xuhaiwei to use magnum to setup coreos cluster02:14
Qimingpull a coreos image and create a cluster02:14
yuanyingIt's easy to build environment02:15
Qiminghi, yuanying, we don't have to use magnum to create coreos cluster02:15
Qimingusing os.nova.server profile, it is just a different image id02:15
xuhaiweiI can understand you, I just starting some vms with coreos images, and succeeded in starting containers outside vms02:15
Qimingthen in a second, you get a vm cluster up and running02:16
xuhaiweis/outside vms/from outside vms/02:16
Qimingxuhaiwei, that's good progress we need desperately02:16
Qimingxuhaiwei, I'm guessing that you are doing that manually today02:17
Qimingthe problem then is really about automate the whole process02:17
xuhaiweiI did the configuration inside vms by user-data, just wonder if it is the right way02:18
yuanyingI guess, coreos must have Floating IP to use docker api from senlin02:18
Qimingthat is, IMO, the right way02:18
Qimingyuanying, that is something we need to figure out02:19
Qimingfloating IP is mostly about the public subnet02:19
Qimingit is about something you will expose to service users (by service, I am referring to the application running inside the containers, not the "container service")02:20
Qimingwe can still ssh into the VMs from the private subnet02:21
Qimingfloating ip is not a blocking factor, iirc02:22
yuanyingI'm not sure, how senlin login to vms from the private subnet?02:25
Qimingyuanying, it can be just some routing rules on your router02:26
Qiming10.0.0.0   UG    0      0        0 br-ex02:26
QimingDestination     Gateway         Genmask         Flags Metric Ref    Use Iface02:27
yuanyingI heard details from xuhaiwei, it means senlin will be in compute node?02:27
Qimingsenlin is on controller node02:27
yuanyinglike senlin-agent02:27
Qimingno, we don't have senlin-agent02:28
Qimingbtw, I "hate" agents, :)02:28
Qimingmakes sense?02:29
yuanyingcompute node will become a router to access core os instance?02:29
Qimingyuanying, you can feel that I'm trying to enable an ansible way of managing VMs and VM configurations02:31
QimingI'm not sure if kuryr is gonna help make the whole thing a lot simpler02:33
yuanyingI hope kuryr will become an answer02:35
Qimingme too. but I'm not so optimistic because kuryr sounds to me more of a service to interconnecting the containers than a service that paves a way for routing requests to VMs we need02:36
Qimingmaybe, someday, when container isolation problem is solved (they will get solved, just a matter of time, right?)02:37
Qimingthe whole process becomes a lot easier02:38
Qimingit is just about bringing up a number of containers across many bare metal machines02:38
Qimingthen ... as a cloud service provider02:39
Qimingyou may have to choose between k8s or openstack, :)02:39
Qimingdepending on your users' requirements: containers for micro-services or vms for other/traditional workloads02:40
Qiminginstead of running a single cloud platform, you will need at least two02:41
xuhaiweiQiming, for the demo, is it ok to use floating IP?02:45
Qimingwhatever that works02:47
Qiminghere is my inapproriate metaphor02:48
Qimingyou have container runtime as icecreams, you will like it02:49
Qimingand you have vm based cloud offered as pissa, you will like it too02:49
Qimingbut you may not like your pizza with icecream on top of it02:50
xuhaiweifor using Senlin to start containers, shall we start a container in a specific node or couple of nodes?02:50
Qimingstart with a single node would be okay02:50
Qimingthen we can strive to enable multi-node scenario02:51
Qimingit could be a simple placement policy, say, round-robin02:51
Qimingor a complicated scheduler, incorporating all kinds of requirements/constraints, such as workload, memory consumption, ...02:52
Qimingwe build our prototype/confidence step by step02:52
Qimingyou are a hero, xuhaiwei02:53
*** idonotknow_ has joined #senlin02:54
Qimingit is gonna be a very challenging and rewarding journey02:54
xuhaiweiwish I can be02:54
xuhaiweineed to learn a lot02:54
*** Qiming has quit IRC03:16
*** Qiming has joined #senlin03:17
openstackgerritQiming Teng proposed openstack/senlin: Add hacking rule for api_version  https://review.openstack.org/29850603:24
openstackgerritMerged openstack/senlin: Modify location to point to action  https://review.openstack.org/29817503:32
*** elynn has quit IRC04:08
*** elynn has joined #senlin04:39
*** elynn has quit IRC04:44
*** elynn has joined #senlin04:44
openstackgerritNguyen Hung Phuong proposed openstack/senlin: Fix typos in Senlin files  https://review.openstack.org/29852904:50
elynnHi yanyanhu , have you try to create a node with security group?05:20
yanyanhuelynn, no, I never tried it05:21
elynnidonotknow_, try to create a node with security group but failed, got a bad request.05:23
Qimingoh, seems security group is not implemented in nova server profile?05:24
elynnI thought it might be a bug, my env is broken again.05:24
yanyanhuthat's true05:25
idonotknow_I have tried without security_groups, everything goes on well05:25
openstackgerritMerged openstack/senlin: Fix typos in Senlin files  https://review.openstack.org/29852905:27
Qimingthe request was rejected by nova05:29
QimingProfile failed in creating node due to: Invalid input for field/attribute 0. Value: default. u'default' is not of type 'object'05:29
idonotknow_yes,the same error05:29
elynnCan you create node or cluster with latest senlinclient?05:33
elynnI always failed with: openstack cluster node create: error: argument --profile is required05:33
elynneven I specify --profile05:33
QimingI don't have that problem, elynn05:34
elynnok... might be my env's problem, I will check.05:35
QimingI'm having some other problems because I have latest nova ...05:40
elynnI know the reason why my command line doesn't work.06:11
elynnopenstackclient use --profile ... https://github.com/openstack/python-openstackclient/blob/master/openstackclient/shell.py#L232-L24206:12
elynnOpen a bug for it https://bugs.launchpad.net/python-senlinclient/+bug/156319406:13
openstackLaunchpad bug 1563194 in python-senlinclient "node/cluster create not work if enable osprofiler" [Undecided,New]06:13
elynnShould we rename --profile ?06:13
Qimingit doesn't matter I think06:13
Qimingif you do openstack cluster node create --profile <yourprofile> <node_name>06:14
Qimingthe '--profile' argument should be properly parsed06:14
elynnIn my env, it won't parsed...06:15
Qimingit should be like this:06:15
Qimingopenstack --debug <some_command> should be different from openstack <some_command> --debug06:16
elynnOnly if I uninstall osprofiler, it can work.06:18
elynnI think our --profile can not override the default one.06:19
elynntwo ways to solve this, 1. rename our --profile. 2. rename openstack's --profile to --os-profile, but might be chanllenge06:22
Qimingthe later one makes sense06:22
elynnchallenge with backward compatibility.06:22
Qimingthat key is not providing a profile, it is a HMAC key06:22
Qimingit is a stupid argument name06:23
elynnYes, I think so..06:23
elynnHaven't notice that before.06:23
elynnTry to propose a patch and see the feedbacks?06:24
Qimingseems I'm gonna waste my whole afternoon just doing some pip install06:28
elynnwell...good luck06:28
Qimingcausing stomachache each time doing this ...06:32
idonotknow_is this patch related to security_groups?06:34
elynnidonotknow_, no...06:36
elynnI will look into it now.06:38
idonotknow_can you help debug this?06:38
idonotknow_thank you06:39
Qimingidonotknow_, I was trying that06:42
Qimingbut I cannot pinpoint the source code lines in nova server because my running nova process is not using the code base I pulled recently06:43
Qimingso I'm upgrading nova manually06:43
Qimingand neutron06:43
Qiming... now I'm trapped06:44
elynnI can take a look now :)06:44
idonotknow_I really appreciate it.06:46
QimingI took me about 40 minutes to upgrade oslo_log ...06:49
Qimingstill seeing no progress06:50
*** EldonZhao has joined #senlin06:52
elynnI think I can make it work now.06:55
openstackgerritEthan Lynn proposed openstack/senlin: [WIP] Support security_groups in nova profile  https://review.openstack.org/29856306:58
idonotknow_you are really awesome06:59
elynnI will fix unit tests later.06:59
idonotknow_I will have it a try on my local env07:00
idonotknow_still failed in my env...07:11
openstackgerritEthan Lynn proposed openstack/senlin: Support security_groups in nova profile  https://review.openstack.org/29856307:11
idonotknow_elynn, what does your template file look like?07:15
elynnI don't use a template file, I use command line.07:15
idonotknow_what does it look like?07:17
elynnYou mean the profile I used?07:17
elynnwait a minute, let me paste it.07:20
elynnJust the same I gave you this morning.07:21
idonotknow_but if I use heat template,still the same error as before.so it is heat's problem ?07:22
elynnDo you restart senlin-engine after applying the patch?07:22
idonotknow_my bad....07:23
idonotknow_kind of dizzy now...it worked07:24
elynntake a break and eat some snacks07:24
*** yuanying has quit IRC07:38
*** yuanying has joined #senlin07:41
openstackgerritMerged openstack/senlin: Add support to 'latest' version  https://review.openstack.org/29848707:50
*** idonotknow_ has quit IRC07:56
openstackgerritQiming Teng proposed openstack/senlin: Add hacking rule for api_version  https://review.openstack.org/29850608:01
*** lixinhui_ has joined #senlin08:04
*** lixinhui has quit IRC08:05
*** EldonZhao has quit IRC08:11
*** EldonZhao has joined #senlin08:11
openstackgerritQiming Teng proposed openstack/senlin: More test case for method with diff versions  https://review.openstack.org/29859308:15
openstackgerritEthan Lynn proposed openstack/senlin: Support security_groups in nova profile  https://review.openstack.org/29856308:46
openstackgerritEthan Lynn proposed openstack/senlin: Refactor do_create for nova profile  https://review.openstack.org/29860208:46
openstackgerritHieu LE proposed openstack/senlin: Fix minor typo in senlin project  https://review.openstack.org/29860608:56
*** zzxwill has quit IRC09:01
*** zzxwill has joined #senlin09:06
*** R_lixh has joined #senlin09:12
*** lixinhui_ has quit IRC09:12
*** zzxwill has quit IRC09:20
*** EldonZhao has quit IRC09:28
openstackgerritEthan Lynn proposed openstack/senlin: Re-enable E402 check  https://review.openstack.org/29862309:35
openstackgerritQiming Teng proposed openstack/senlin: Developer doc for API microversioning  https://review.openstack.org/29862609:41
*** elynn has quit IRC09:41
*** Liuqing has quit IRC09:47
openstackgerritMerged openstack/senlin: Fix minor typo in senlin project  https://review.openstack.org/29860609:47
openstackgerritMerged openstack/senlin: Add hacking rule for api_version  https://review.openstack.org/29850609:48
openstackgerritMerged openstack/senlin: More test case for method with diff versions  https://review.openstack.org/29859309:48
*** zzxwill has joined #senlin09:53
*** zzxwill has quit IRC10:03
openstackgerritQiming Teng proposed openstack/senlin: Developer doc for API microversioning  https://review.openstack.org/29862610:20
*** Qiming has quit IRC10:24
*** Liuqing has joined #senlin10:27
*** yanyanhu has quit IRC10:34
*** zzxwill has joined #senlin10:51
*** Liuqing has quit IRC10:56
*** Qiming has joined #senlin11:18
*** Liuqing has joined #senlin11:35
*** lixinhui_ has joined #senlin12:41
*** lixinhui_ has quit IRC12:46
*** lixinhui_ has joined #senlin12:48
*** elynn has joined #senlin12:50
Qimingmeeting time13:01
*** zzxwill has quit IRC13:46
*** zzxwill has joined #senlin13:51
elynnlixinhui_: yes?13:59
lixinhui_I want to know more about the security group thigns13:59
lixinhui_i am not quiet know heat14:00
lixinhui_I am thinking14:00
lixinhui_we have to extend senlin nova to support security group?14:01
lixinhui_I saw your patch from IRC log14:01
elynnYes, senlin nova profile can't correctly set security group until my patch add it.14:01
lixinhui_but security group has supported by heat for non-senlin resource14:02
*** Liuqing has quit IRC14:02
lixinhui_or my question is14:02
elynnI gave a example to  Idonotknow  and I think it's worked with my patch in senlin14:03
lixinhui_Yes, I see14:03
lixinhui_I know it works14:03
lixinhui_can we create senlin node by nova then adopt security group after that by heat template14:03
lixinhui_maybe nonsense14:03
lixinhui_or I do not understand heat implements14:04
lixinhui_just feel security group has been supported14:04
elynnI don't think it can14:04
elynnSince in senlin need to create a profile14:04
elynnThen create a node from this profile.14:04
elynnOnly if senlin support to update a profile  then heat can do it.14:05
lixinhui_but security group can be created after that and do not have to be part of the profile14:07
elynnBy now, profile resource in heat won't support to update it's spec, since senlin doesn't support to update a profile's spec.14:07
lixinhui_okay, I see. Thanks!!!14:08
elynnHeat can not see the nodes under cluster, so it can't add security group to these nodes.14:08
elynnOnly if there is an API in senlin cluster to do it.14:09
elynnHeat can do it.14:09
lixinhui_Thanks, now I get more understanding here :)14:10
elynnnp :)14:10
*** cschulz has quit IRC14:11
*** lixinhui_ has quit IRC14:29
openstackgerritMerged openstack/senlin: Refactor do_create for nova profile  https://review.openstack.org/29860214:30
openstackgerritMerged openstack/senlin: Support security_groups in nova profile  https://review.openstack.org/29856314:34
*** openstackgerrit has quit IRC15:06
*** openstackgerrit has joined #senlin15:07
*** zzxwill has quit IRC15:38
*** elynn has quit IRC15:41
*** Qiming has quit IRC16:03
*** Qiming has joined #senlin23:11

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!