14:01:38 <SridarK> #startmeeting fwaas 14:01:39 <openstack> Meeting started Tue Aug 8 14:01:38 2017 UTC and is due to finish in 60 minutes. The chair is SridarK. Information about MeetBot at http://wiki.debian.org/MeetBot. 14:01:40 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 14:01:42 <openstack> The meeting name has been set to 'fwaas' 14:01:43 <SarathMekala> hi all o/ 14:01:54 <SridarK> #chair yushiro xgerman_ 14:01:55 <openstack> Current chairs: SridarK xgerman_ yushiro 14:02:16 <SridarK> xgerman_: to run the mtg today ? Sorry i forget 14:02:36 <reedip_> Its hot here 14:02:43 <SridarK> ok i can do it 14:02:56 <SridarK> #topic Pike 14:03:16 <yushiro> thanks, SridarK 14:03:47 <SridarK> yushiro: chandanc: pls go ahead 14:04:04 <yushiro> #link https://review.openstack.org/#/c/323971/ 14:04:12 <SridarK> chandanc: & I discussed over the weekend on some the pending issues with L2 support 14:04:34 <xgerman_> o/ 14:04:42 <yushiro> SridarK, chandanc yes, thanks for your discussion. 14:04:45 <xgerman_> sorry being late 14:04:51 <yushiro> xgerman_, NP :) 14:04:53 <chandanc> we have captured the discussion in mail 14:04:57 <SridarK> adding an option to ensure that the plugin will flag L2 ports is defn an option 14:05:12 <SridarK> xgerman_: sorry i think today is ur turn - i just got started 14:05:17 <SridarK> u can take over 14:05:54 <yushiro> OK, now, I just fixed some bugs in L2-agent patch and added UTs. 14:06:15 <chandanc> I have 2 more fixes to be done 14:06:18 <yushiro> sorry just late.. but will update once after this meeting 14:06:29 <chandanc> sorry yushiro carry on 14:06:48 <SridarK> thx yushiro 14:07:01 <xgerman_> +1 14:07:24 <yushiro> current patch included a validation between agent version('v1' or 'v2') and l2. 14:07:43 <yushiro> https://review.openstack.org/#/c/323971/43/neutron_fwaas/services/firewall/agents/firewall_agent_api.py@65 14:08:23 <yushiro> I think l2 support is only for 'v2'. Therefore, I added the validation with agent version. 14:08:30 <reedip_> guys , I will be right back , need to go to the medical store ( 15 min ) 14:08:46 <chandanc> from the driver part i have to fix one of the delete rule flows to be more specific and one pep8 issue 14:08:48 <yushiro> reedip_, OK, please take care!! 14:08:53 <SridarK> reedip_: no prob 14:09:14 <xgerman_> +1 14:09:43 <SridarK> yushiro: yes indeed no L2 support for v1 14:10:18 <SridarK> so for v1 we will not even be running the L2 agent piece correct ? 14:10:23 <SridarK> i will look at PS too 14:11:05 <yushiro> SridarK, yes correct. If agent version is 'v1' and l2 feature is enabled, then failed to start q-agt. 14:11:20 <yushiro> SridarK, this is current behavior in patch 43. 14:12:21 <yushiro> In other words, this validation is for checking configuration in agent-side. 14:12:48 <SridarK> yushiro: ok 14:13:20 <yushiro> Next, default firewall_group, it is OK for testing now.. 14:13:41 <xgerman_> nice 14:14:05 <yushiro> #link https://review.openstack.org/#/c/475183/ Add configurable option for default_firewall_group 14:14:38 <yushiro> I'm also updating this patch in local environment. ( Although it is WIP in gerrit ) 14:15:35 <yushiro> BTW, SridarK, can I update l2-agent patch today? 14:16:00 <yushiro> Maybe you're trying to add some validation for server-side, aren't you? 14:16:30 <SridarK> yushiro: yes - the only piece is the check on ml2_conf.ini 14:16:44 <yushiro> SridarK, OK, thanks. 14:16:49 <SridarK> yushiro: i will send something to u 14:17:05 <yushiro> SridarK, Thank you so much! 14:17:10 <SridarK> best not to create another patch 14:17:45 <yushiro> Indeed. 14:17:49 <SridarK> yushiro: i am just thinking around the validation for v1 14:18:21 <yushiro> chandanc, https://review.openstack.org/#/c/447251/22 Do you know a reason for jenkins -1? 14:19:03 <chandanc> No i havent lookt yet 14:19:19 <chandanc> 2 tests are failing though 14:19:24 <SridarK> my thought on the validation for L2 support was to fail CRUD operations if an L2 port is provided and L2 support is not enabled 14:19:50 <SridarK> can we have the same approach for v1 14:20:28 <yushiro> SridarK, yes, we can validate on server-side I think. 14:20:49 <SridarK> yushiro: i think the scenario u are mentioning is if someone had a v2 server and started a v1 agent ? 14:21:17 <SridarK> i think we have validation for that already 14:21:30 <SridarK> yushiro: this in reference to ur latest change 14:21:42 <SridarK> maybe let me go thru the PS and then discuss 14:22:48 <yushiro> SridarK, ah, no. My patch only validates between agent-side configuration parameters. To tell the truth, I'd like to validate as you said.. 14:24:06 <yushiro> Now, agent-side in fwaas has some parameters named 'agent_version', 'enabled', 'conntrack_driver', 'driver'... 14:24:14 <SridarK> yushiro: ok i am trying to think thru this too 14:25:11 <yushiro> In the future, we should validate a version between server-side and agent-side but it is difficult now because we don't have O.VO ( Oslo version object). 14:26:15 <SridarK> yushiro: yes u are correct 14:26:35 <reedip_brb> back 14:26:58 <yushiro> So, in this cycle, it's OK to have your validation(in server-side) and my patch's one(in agent-side). 14:28:16 <SridarK> yushiro: i think so - the validation i am talking abt is to ensure that no L2 ports will be handled at the plugin in case L2 support is not enabled 14:28:48 <SridarK> (either thru an explicit flag or checking for the presence of the FWaaS L2 driver in the .ini file) 14:29:34 <xgerman_> let’s back off we envisioned to ease migartion to let people run V1 and V2 side-by-side 14:31:33 <yushiro> OK. 14:31:35 <SridarK> xgerman_: yes I am not sure what issues will surface there 14:31:47 <SridarK> xgerman_: but good point to think thru that 14:31:54 <reedip_> Wont V1 be similar to V2 having the L2 agent support turned OFF ? 14:32:18 <SridarK> reedip_: yes that was my thinking as well 14:32:33 <xgerman_> +1 14:32:56 <reedip_> sounds about right then 14:33:20 <xgerman_> well, we need to test all those combinations… 14:33:38 <reedip_> Note: We should keep this information as a documentation , so that when we start writing our migration document, we dont have to do a LOT of work 14:33:48 <SridarK> if u had a v1 plugin - i think we validate to ensure that ports are L3 already 14:34:03 <SridarK> reedip_: +1 14:34:15 <reedip_> Just an etherpad for now would work , I guess 14:34:40 <xgerman_> +1 14:35:18 <xgerman_> Most projects have docs in the code tree — we can always start a patch 14:36:00 <reedip_> xgerman_ : for the documentation, yes , I think a patch can be started 14:36:17 <yushiro> xgerman_, +1 we also need documentation for setting up and something... 14:36:55 <xgerman_> indeed… 14:37:48 <SridarK> yushiro: ok so i think we need to ensure that we have validation for L2 support and some UT fixes with the L2 agent PS 14:38:01 <amotoki> re: docs, it is nice to have in-tree documentation. If you feel the networking guide fits more, feel free to propose it to the neturon repo. 14:38:23 <yushiro> amotoki, thanks for your information.. 14:38:26 <amotoki> I think we need more clear guideline on documentation in the neutron stadium projects in Queens 14:38:37 <SridarK> amotoki: +1 14:38:37 <xgerman_> +1 14:38:54 <yushiro> amotoki, in document deadline is same as neutron's one? 14:39:07 <reedip_> amotoki : how is the FWaaS documentation generated ? Can you advice? 14:39:12 <reedip_> SridarK : ^^ 14:39:16 <SridarK> we have some level of docs on the setup and install but it can always be improved 14:39:24 <xgerman_> I think right now we are just in the networking guide 14:39:26 <amotoki> documentation with url /latest/ is always published from the master branch 14:39:44 <yushiro> aha, good, thanks. 14:40:02 <amotoki> perhaps we will have a branch version of documentation with /<foo>/pike or something, but at the moment I am not sure on this 14:40:19 <SridarK> reedip_: yes it is primarly networking guide 14:40:39 <yushiro> wow, it is reasonable for me but we should accerelate to publish our document . 14:40:59 <reedip_> Ok, because I got a comment from amotoki that FWaaS doesnt handle ICMP , as per the networking guide... so I wondered where to fix it :) 14:41:03 <amotoki> for docs, if it fits to stable branches, you can backport it 14:41:25 <amotoki> reedip_: I cannot remmeber the context .. 14:41:28 <yushiro> good idea 14:41:52 <SridarK> #action Team to check on doc updates 14:42:01 <reedip_> amotoki : https://review.openstack.org/#/c/440331/ 14:42:02 <amotoki> for docs question feel free to ping me. if you have a specific document, i can advise more 14:42:11 <SridarK> amotoki: thx 14:42:28 <SridarK> yushiro: anything more on L2 agent ? 14:42:56 <yushiro> SridarK, It's all for me. I'll do my best during Pike!! 14:43:33 <SridarK> yushiro: yes no worries - we will need to do more testing as well - which we all can do 14:43:34 <amotoki> reedip_: regarding https://review.openstack.org/#/c/440331/, you changed the behavior on ICMP but you do not mention it in the relesae note 14:43:41 <SridarK> chandanc: u had somethings to cover as well 14:44:00 <amotoki> so I put -1 on your patch, but it seems not addressed in patch set 16 :( 14:44:14 <amotoki> it is not related to the networking guide 14:44:14 <reedip_> amotoki: oh ok , you also added something about the documentation, so I was wondering to ask it. anyways, I can discuss it with you later... 14:44:27 <chandanc> not much from my side 14:44:44 <chandanc> i have fixed most of the comments raised on the driver patch 14:44:45 <amotoki> reedip_: ??? 14:44:46 <reedip_> amotoki : both ICMPv4 an v6 will be checked 14:45:50 <SridarK> chandanc: on one of the issues u raised regarding conntrack across iptables and ovs 14:46:19 <SridarK> if we had SG on iptables and L2 FWaaS on ovs 14:46:51 <chandanc> SridarK: yes i mentioned that the contrack entries are managed in the kernel and are shared between the iptables and OVS driver 14:48:28 <chandanc> just wanted to bring this point to the discussion 14:48:38 <chandanc> the ovs based driver explicitly creates these entries 14:50:04 <SridarK> we should have some clarity on potential impacts here if any 14:50:58 <chandanc> SridarK: yes we should test the contrack part specifically 14:51:07 <SridarK> do others have some thoughts here too 14:51:28 <xgerman_> agree, we need to test 14:51:47 <yushiro> +1 14:52:32 <xgerman_> on the other hand we can always say you need to switch off SG for our current release 14:52:41 <xgerman_> and fix this in Queens 14:52:49 <chandanc> xgerman_: +1 14:53:04 <SridarK> xgerman_: yes that is where i was heading too - 14:53:22 <SridarK> this is probab needed until we test coexistence 14:53:50 <SridarK> I am not sure if we need to add another check here 14:54:12 <chandanc> SridarK: good idea 14:55:30 <SridarK> ok oops we are close to time 14:55:35 <SridarK> #topic Horizon 14:55:39 <TuanVu_> Hi guys, could you please check? 14:55:40 <TuanVu_> https://review.openstack.org/#/c/443385/ 14:55:40 <TuanVu_> I really appreciate it if anyone can have a quick look. 14:55:40 <TuanVu_> Thank you in advance. 14:55:41 <SridarK> SarathMekala: amotoki: 14:56:01 <SarathMekala> #link https://review.openstack.org/#/c/475840/ 14:56:14 <yushiro> TuanVu_, will take a look! 14:56:17 <SridarK> TuanVu_: yes i was wondering on one of the comments raised by Cedric on efficiency 14:56:19 <SarathMekala> I have uploaded a patch that adds the missing functionality of add/remove ports to FWG 14:56:24 <SridarK> needed to validate that 14:56:38 <SarathMekala> with this the UI is feature complete 14:56:57 <amotoki> hopefully test coverage is coming soon.... 14:56:59 <SridarK> SarathMekala: ok great and as pointed by amotoki we have some time here on the dashboard 14:57:17 <SarathMekala> I am working on the test cases and will post in a couple of days 14:57:26 <SridarK> i think we have a good chance to make it with added UT 14:57:27 <SarathMekala> amotoki, yes am working on it :) 14:57:28 <amotoki> but I will be off most of the remaining days... 14:57:53 <SarathMekala> amotoki, can you review the code 14:58:06 <SarathMekala> I will send another review request for the test cases 14:58:08 <reedip_> yushiro ; do we have a check for https://review.openstack.org/#/c/443385/27 at CLI ? 14:58:11 <amotoki> I can do static reviews from POV of horizon view 14:58:17 <reedip_> TuanVu_ :^^ 14:58:24 <SridarK> SarathMekala: can u send out a link on "How to test" for Horizon 14:58:47 <SridarK> maybe an etherpad ? 14:58:51 <SarathMekala> SridarK, sure.. I will prepared a document and share it across 14:58:59 <SridarK> yes email perhaps 14:59:06 <SarathMekala> sure.. will put it on ether pad 14:59:07 <amotoki> oh..... my devstack changes has been lost by SarathMekala new patch set :( 14:59:11 <SridarK> something simple is good enough 14:59:13 <yushiro> reedip_, OK, will test it after finishing the meeting. 14:59:23 <SridarK> ok we are at time 14:59:29 <amotoki> SarathMekala: could you recover it? 14:59:37 <SridarK> lets continue if anything in fwaas IRC 14:59:40 <SarathMekala> amotoki, I will check and do the needful 14:59:47 <SridarK> thanks all for joining 14:59:53 <SridarK> #endmeeting