Friday, 2021-01-15

*** openstackgerrit has quit IRC00:03
*** irclogbot_2 has quit IRC00:03
*** hamalq has quit IRC00:03
*** jmlowe has quit IRC00:03
*** rm_work has quit IRC00:03
*** hamalq has joined #senlin00:05
*** jmlowe has joined #senlin00:05
*** rm_work has joined #senlin00:05
*** irclogbot_2 has joined #senlin00:06
*** irclogbot_2 has quit IRC00:10
*** spatel has joined #senlin00:12
*** irclogbot_0 has joined #senlin00:13
*** spatel has quit IRC00:17
*** hamalq has quit IRC00:40
*** spatel has joined #senlin02:17
*** sapd1 has joined #senlin02:28
spateldtruong: around ?02:42
spatelsenlin default use all public endpoint to talk to other servers like keystone/nova/neutron etc.. is there a way i can tell senlin to use internal endpoint (non SSL)02:44
spatelI am trying these options but still no luck -
spateli have set interface = internal but still senlin trying to talk to public endpoint and failing02:45
*** sapd1 has quit IRC02:50
*** sapd1 has joined #senlin03:06
eanderssonspatel talking about senlin to another service? e.g. keystone05:25
spatelsenlin obtain all endpoint from keystone and use public endpoint to talk to other services05:26
spateli am trying to figure out how it can use internal endpoint05:26
eanderssonIn theory that patch should work05:27
eanderssonbut I think the problem is that it is getting it from the context05:28
spatelIn my HAproxy i have external/internal IP and my senlin on internal IP ( and its failing to because can05:28
spatelcan't talk to public interface)05:28
spatelhmmm context?05:28
eanderssonIt basically means that it passes on what it got from the user05:29
eanderssonDo you have the endpoint set under05:30
spatelbut its still trying to talk to external IP05:30
eanderssonYea - I think what is happening is basically that the interface is passed on from the user request which will always be public05:31
spatelcan we change that behavior?05:31
spatelsenlin should get all endpoint from keystone itself right?05:32
spatelwhy end-user influencing that behavior ?05:32
eanderssonI think for Senlin the idea is that you are acting on behalf of the user.05:34
eanderssonSo it's like the user talking to nova etc05:34
spatelyes senlin acting like end-user05:34
spatelif somehow we can hardcode endpoint in senlin config then may be it will use internal endpoint05:36
spateljust like other openstack services, they have dedicated section for neutron/heat etc..05:37
eanderssonYea - the problem is that the design is very different.05:37
eanderssonWe would probably need to look at something like Heat.05:37
eanderssonbtw could you try to change this to internal?05:38
eanderssonJust to see if that works?05:38
spateli had interface=internal in senlin.conf but that didn't help05:39
spatelthat is what you asking?05:40
eanderssonI was thinking maybe setting it directly in code05:40
eanderssonActually do you know if keystone is using the internal?05:40
eanderssonOr is even keystone using the public interface?05:41
eanderssonI might be able to set up an env this weekend to look at it if dtruong does not have the answer05:42
spatelIn tcpdump i have noticed it talked to internal URL to talk to keystone and it fetch all endpoint but then i noticed it started poking public side of keystone URL and just hanging there05:42
spatelI spent whole day and then in frustration i replaced my HAproxy with F5 load-balance05:44
spatelto solve this issue05:44
spatelHAproxy has two interface and its creating routing loop when senlin try to talk to external IP05:44
spatelI will setup lab tomorrow or in weekend to collect data to verify behavior05:45
spatelI will collect some pcap tomorrow to get better understanding05:51
eanderssonWe have two keystones set up for something similar05:53
eanderssonTwo different catalogs, one internal and one for the user05:53
eanderssonSenlin would only talk to the internal one and the user would only talk to the public one05:54
eanderssonBut we have a very specialized setup and probably wouldn't work for most.05:56
spatelhmm interesting05:57
spatelbut codebase should be same right? or you have very customized senlin?05:58
eanderssonIt's the same05:59
eanderssonBut you need two different catalogs05:59
eanderssonWe use keystone templatized catalogs to achieve this05:59
spatelvery advance level :)06:00
spateli have basic setup06:00
eanderssonSo if you talk to public keystone you get different endpoints for public than you would for the internal keystone06:00
eanderssonYea overkill06:00
eanderssonLet me know how it goes and I'll try to take a look as well06:01
spatelThis is what i have is running on external IP of haproxy and is internal side of haproxy06:02
eanderssonThe same for everything, nova etc right?06:02
spatelYes same for all services06:02
spateleverything working fine except senlin :)06:03
eanderssonspatel are you able to modify the senlin source code?06:06
eanderssonIf so could you try to add06:06
eanderssonparams['interface'] = 'internal'06:06
spatelI need to setup lab.. currently i moved my senlin to F5 to fix this issue06:08
spateltomorrow i will spin up new lab and verify your suggestion06:08
spatelthat part looks interesting to test06:08
eanderssonSounds good06:09
spatelits 1:00AM here :)06:09
spatelsure in morning i will give it a shot and post result here06:09
eandersson10PM here06:13
spatelYes West cost :)06:16
spateleandersson: there06:37
spatelAs soon as i tried   params['interface'] = 'internal'  it works!06:38
spatellook like you are right! we need that in param in sdk06:39
spateloh! wait.. i just removed that and it still working..06:42
spateleandersson: i don't trust this lab.. tomorrow i will give it a try with fresh mind06:43
*** spatel has quit IRC07:03
*** spatel has joined #senlin09:16
*** spatel has quit IRC09:21
*** sapd1 has quit IRC10:04
*** sapd1 has joined #senlin13:26
*** spatel has joined #senlin13:48
*** jrosser has joined #senlin14:05
*** jmlowe has quit IRC15:27
*** sapd1 has quit IRC17:01
*** spatel has quit IRC19:03
*** spatel has joined #senlin22:53
*** spatel has quit IRC22:53
eanderssonLet me know how it goes22:57
*** jrosser has quit IRC23:01
*** jrosser has joined #senlin23:03
*** eandersson has quit IRC23:20
*** eandersson has joined #senlin23:21

Generated by 2.17.2 by Marius Gedminas - find it at!