14:02:13 <SridarK> #startmeeting fwaas 14:02:13 <openstack> Meeting started Thu Oct 26 14:02:13 2017 UTC and is due to finish in 60 minutes. The chair is SridarK. Information about MeetBot at http://wiki.debian.org/MeetBot. 14:02:13 <reedip_> did the Daylight saving start ? 14:02:14 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 14:02:17 <openstack> The meeting name has been set to 'fwaas' 14:02:25 <SridarK> #chair xgerman_ yushiro 14:02:26 <openstack> Current chairs: SridarK xgerman_ yushiro 14:02:32 <SridarK> xgerman_: sorry pls go ahead 14:02:52 <SridarK> reedip_: no that is Nov 5 i believe 14:03:46 <xgerman_> One sec my computer is still booting 14:03:56 <reedip_> i5 or i7 ? 14:04:02 <SridarK> xgerman_: no worries 14:04:04 <xgerman_> i5 — but here I am 14:04:12 <yushiro> NP 14:04:13 <xgerman_> #topic Announcements 14:04:23 <reedip_> :) 14:04:32 <xgerman_> Neutron Q-1 was cut yesterday 14:04:44 <xgerman_> Newton also went EOL yesterday 14:04:51 <xgerman_> and we have a new TC 14:05:01 <reedip_> damn .. it seems only like yesterday that we were working on newton 14:05:03 <reedip_> :P 14:05:37 <doude> hi 14:05:47 <reedip_> hi doude 14:06:15 <xgerman_> yeah, I don’t have a TC link handy so you’ll need to google that ;-) 14:06:56 <reedip_> https://www.openstack.org/foundation/tech-committee/ ? 14:07:31 <xgerman_> thanks reedip_ 14:07:33 <xgerman_> #topic Queens L2 support 14:07:49 <xgerman_> So we didn’t get that into Q-1 but got close!! 14:08:38 <xgerman_> yushiro what’s the latest? 14:08:45 <yushiro> xgerman_, sure. 14:09:11 <yushiro> #link https://etherpad.openstack.org/p/fwaas-v2-l2 Please refer 'Test cases for OVS firewall driver:' section 14:09:34 <SridarK> yushiro: thx this i think makes it more clear to test 14:09:45 <SridarK> and i think we can add more to it 14:09:47 <xgerman_> +1 14:10:02 <annp> yushiro, thanks 14:10:07 <yushiro> Now, I tested a few patterns. 14:10:16 <SridarK> I had some PTO this week so not much progress from me on testing - but will defn do some now 14:10:49 <xgerman_> I am swamped at work so not much FWaaS testing from me (though found some Octavia bugs I now need to fix) 14:10:57 <SridarK> but yushiro this is very clear 14:11:48 <yushiro> I'm checking diff before/after ovs-ofctl dump-flows br-int for OVS firewall driver. 14:13:05 <yushiro> e.g. If we add 'allow' icmp rule, it is added http://paste.openstack.org/compare/624411/624408/ 14:14:01 <xgerman_> ok, and we are aiming for FWaaS standalone (switch off SG for test)? 14:14:16 <xgerman_> just double checking 14:14:42 <yushiro> xgerman_, yes, sure. Now I'm testing sg + fwg with 'openvswitch' driver. 14:14:43 <reedip_> annp just pushed a patch for SG and FWG 14:15:12 <annp> yes, https://review.openstack.org/#/c/515368/2 14:15:29 <xgerman_> awesome - I think this needs to be our default 14:15:57 <yushiro> annp, If we add 'deny' icmp rule, what rule will be added in ovs flow? I tested before, but no specific rule is added. 14:16:50 <annp> yushiro, if you add deny icmp, no flows related icmp is added. 14:17:14 <annp> yushiro, icmp packets will be dropped. 14:17:38 <yushiro> annp, aha, OK. thx. 14:17:59 <annp> regarding to fwg and sg can work as a defense in depth solution 14:18:55 <yushiro> annp, (start) ---> fwg ---> sg ---> (end) Is that right? 14:18:55 <annp> my patch is under develop, however it can work with security group based ovs, for iptables_hybrid needs more works. 14:19:16 <xgerman_> yeah, I think most installs have SG and until we offer some sort of migration co-existance is the way to go 14:19:44 <annp> yushiro, it's right in https://review.openstack.org/#/c/515368/2 14:19:59 <xgerman_> well, let’s get OVS into Q-2 and then we cna worry about hybrid later ;-) 14:20:25 <yushiro> xgerman_, +1 We should target 'openvswitch' firewall driver first. 14:20:49 <annp> xgerman_, tomorrow, i will remove hybrid and make it available for testing and reviewing. thanks. 14:21:07 <SridarK> yes i think that is best 14:21:23 <xgerman_> +1 14:21:27 <xgerman_> #topic Queens Dashboard 14:21:37 <annp> yushiro, regarding to l2 agent patch 14:21:59 <yushiro> yes 14:22:16 <annp> yushiro, we're missing allowed_address_pair and 'port_security_enabled' in port_details 14:22:57 <annp> yushiro, These attrs need for ovs driver 14:23:13 <SridarK> Also annp on the driver PS - are u good with things ? 14:23:14 <annp> yushiro, can i update l2 agent patch? 14:23:28 <yushiro> annp, OK, plz update. 14:23:43 <yushiro> annp, I think that is good point. 14:23:57 <annp> SridarK, yes! we need these attrs 14:24:31 <SridarK> thx annp 14:24:47 <yushiro> annp, I still don't get the point why these parameter is necessary for fwaas. Please tell me after :) 14:25:00 <yushiro> s/is/are 14:25:01 <xgerman_> well port_security makes sense 14:25:11 <annp> ok, let me paste link for you 14:25:19 <yushiro> xgerman_, regarding dashboard 14:25:30 <xgerman_> yep, did we cut the release 14:25:31 <xgerman_> ? 14:25:32 <reedip_> guys ,I would be leaving now, will check the logs later .. sorry, urgent work 14:25:42 <yushiro> I'm so sorry I couldn't have bandwidth to cut release yet. 14:25:53 <yushiro> in last week. 14:26:02 <annp> https://review.openstack.org/#/c/447251/46/neutron_fwaas/services/firewall/drivers/linux/l2/openvswitch_firewall/firewall.py@125 14:26:11 <yushiro> amotoki, hi, are you there? 14:27:15 <yushiro> annp, ah, we should allow from/to mac_address which includes 'allowed_address_pairs'. Thanks. 14:27:42 <xgerman_> ok, let’s try this week — ping me if you run into trouble and I will lean on some people I know who cut releases frequently (armax ahem) 14:27:47 <annp> SridarK, xgerman_, yuhsiro, I think allowed_address_pair is added on neutron. So I think we can keep this feature for neutron port 14:28:16 <xgerman_> yes, we need to support it — most people use it 14:28:27 <SridarK> +1 14:28:30 <xgerman_> but it’s an extension - so technically need to be able to run without 14:28:41 <xgerman_> but not Q-2 14:28:55 <annp> xgerman_, you're right. 14:28:59 <yushiro> xgerman_, I think so. 14:29:52 <yushiro> xgerman_, sure. I will. 14:30:11 <yushiro> xgerman_, And, I'll migrate existing bugs for dashboard into launchpad. 14:30:28 <xgerman_> ok, thanks 14:30:30 <yushiro> from https://etherpad.openstack.org/p/fwaas-v2-dashboard 14:30:40 <xgerman_> sounds good 14:30:48 <annp> that's all from me. :) 14:30:56 <xgerman_> thanks! 14:31:12 <yushiro> SarathMekala, If you find another bug on dashboard, feel fee to file a bug into fwaas dashboard launchpad :) 14:31:22 <yushiro> s/fee/free 14:31:28 <amotoki> yushiro: hi 14:31:37 <xgerman_> hi 14:31:40 <SarathMekala> hi yushiro .. yes... I was planning to sync up with you on that 14:31:57 <amotoki> ah... fwaas meeting time :) 14:32:02 <xgerman_> yes, I was curious about our next development after the Q-1 release 14:32:33 <xgerman_> or are we focusing on bug fixes? 14:32:44 <yushiro> amotoki, hi. Sorry for last week. I couldn't reach out you to get your help for cutting release. 14:33:21 <amotoki> yushiro: sorry too. it is not complicated. 14:33:28 <yushiro> xgerman_, SarathMekala Currently, there is no critical bug on dashboard. 14:33:38 <SarathMekala> xgerman_, you are right we need to do both 14:34:03 <SarathMekala> I have some thoughts on improving the UI screens.. will do a write up and share to the team 14:34:27 <SarathMekala> yushiro, good to know :) 14:34:32 <xgerman_> amotoki should we do a spec for that 14:34:34 <xgerman_> ? 14:34:52 <amotoki> xgerman_: on dashboard imporvements? 14:34:56 <xgerman_> yep 14:35:11 <amotoki> i think it is better to use a blueprint in neutron-fwaas-dashboard launchpad 14:35:50 <amotoki> if you prefer to RFE bugs, it also works :) 14:35:52 <xgerman_> ok, SarathMekala if you could do your writeup in a blueprint —much appreciated 14:36:06 <SarathMekala> xgerman_, sure.. will do that 14:36:13 <amotoki> there is no need to discuss with the driver team. it's an UI project 14:36:13 <xgerman_> thanks 14:36:20 <yushiro> Changing UI needs spec, OK I understood. 14:36:32 <SridarK> SarathMekala: but for some prelim discussion with screenshots and to get some discussions going - google doc could be a first step leading to a bp 14:36:54 <SarathMekala> SridarK, got it.. 14:37:00 <xgerman_> +1 14:37:02 <yushiro> SridarK, +1 14:37:24 <amotoki> that would be a good idea 14:37:24 <SarathMekala> will start with a google doc and will create a blueprint after some priliminary discussions 14:37:47 <amotoki> SarathMekala: you can create a blueprint and add a link to a google doc 14:38:05 <SarathMekala> amotoki, +1 14:38:31 <yushiro> SarathMekala, Could you discuss with me about 'bug' or 'improvement' in https://etherpad.openstack.org/p/fwaas-v2-dashboard 14:38:39 <yushiro> later ? 14:39:14 <SarathMekala> yushiro, sure 14:39:22 <yushiro> SarathMekala, OK, thank you. 14:39:28 <SarathMekala> we need to clean up the etherpad as well 14:40:36 <amotoki> IMHO it is better to file bugs rather than tracking remaining things in the etherpad 14:40:55 <xgerman_> +1 14:41:11 <xgerman_> especially after release 14:41:14 <yushiro> amotoki, all of etherpad? 14:41:44 <amotoki> yushiro: yeah, all *remaining* topics 14:41:53 <xgerman_> yes, so users don’t file known bugs 14:42:07 <yushiro> amotoki, Aha OK, will do it. 14:42:16 <amotoki> yushiro: it is not clear to me what are remaining (in "Blocking Issues" section) 14:42:27 <SarathMekala> right.. will sync up with yushiro on this 14:42:40 <amotoki> "How to Install" should be converted into the in-tree doc 14:43:06 <amotoki> https://bugs.launchpad.net/neutron-fwaas-dashboard (with v2-dashboard tag) 14:43:07 <xgerman_> action convert “How to Install" into the in-tree doc 14:43:18 <xgerman_> #action convert “How to Install" into the in-tree doc 14:44:00 <yushiro> amotoki, 'Blocking Issues' was mandatory issues to solve before merging v2 dashboard. So, it's OK to ignore. 14:44:39 <amotoki> yushiro: okay. I was just not sure the status of each item 14:44:53 <amotoki> for the install documentation, perhaps https://docs.openstack.org/neutron-fwaas-dashboard/latest/install/index.html and https://docs.openstack.org/neutron-fwaas-dashboard/latest/contributor/devstack-plugin.html covers almost all. if any, let's add it. 14:45:31 <SarathMekala> amotoki, true..this doc needs to be cleaned up to track only pending issues... 14:45:33 <yushiro> 'Future improvements' are our next target. 14:45:42 <SridarK> amotoki: yes Blocking Issues have all been addressed 14:46:01 <amotoki> SridarK: yushiro: good news. thanks 14:46:14 <xgerman_> ok, let’s move to 14:46:19 <SridarK> amotoki: +1 on updating the docs 14:46:39 <xgerman_> #topic Open Discussion 14:46:54 <xgerman_> I know we have some specs which need attention 14:47:42 <yushiro> yes 14:49:05 <yushiro> #link https://review.openstack.org/#/c/461657/ I'll reply to ZhaoBo 14:49:23 <xgerman_> thanks — 14:50:18 <xgerman_> SridarK any update on CCF? 14:50:25 <yushiro> #link https://review.openstack.org/#/c/509725/ firewall logging extension. (However, logging API in neutron is now trying to merge) 14:50:37 <yushiro> stay tuned!! 14:50:39 <SridarK> xgerman_: no i will write that up too and then link it to a bp 14:51:04 <xgerman_> ok, great 14:51:23 <yushiro> hoangcx, annp and I are discussing more detail design now. 14:51:33 <amotoki> this RFE is marked as rfe-postponed. if we have a volunteer to move this forward, we can change the tag to rfe-approved 14:51:52 <amotoki> https://bugs.launchpad.net/neutron/+bug/1628627 is the RFE bug for https://review.openstack.org/#/c/461657/ 14:51:54 <openstack> Launchpad bug 1628627 in neutron "In FWaaS, when someone makes a change to a firewall rule we know, Who, What, When, and Where" [Wishlist,In progress] - Assigned to zhaobo (zhaobo6) 14:52:40 <xgerman_> yeah, let’s aim for L2 in Q-2 and then we tackle other stuff ;-) 14:52:57 <hoangcx_> xgerman_: +1 14:53:44 <doude> did you established the list of 'other stuff'? 14:53:58 <amotoki> yushiro: for https://review.openstack.org/#/c/509725/, is there a RFE bug? 14:54:09 <mlavalle> is that the one for audit? 14:54:45 <SridarK> doude: i think we can take on ur changes 14:54:56 <hoangcx_> amotoki: https://bugs.launchpad.net/neutron/+bug/1720727 14:54:57 <openstack> Launchpad bug 1720727 in neutron "[RFE] (Operator-only) Extend logging feature to support for FWaaS v2" [Wishlist,Confirmed] 14:55:03 <doude> cool :) 14:55:04 <yushiro> amotoki, yes 14:55:10 <xgerman_> SridarK +1 14:55:13 <doude> did you had time to look at it? 14:55:20 <amotoki> hoangcx_: ah.. I found it in the content, but no reference in the commit msg. just it 14:55:21 <SridarK> doude: are u going to be at the summit 14:55:28 <doude> yes I'll 14:55:49 <hoangcx_> amotoki: It will change status of the bug and it will not go to the list of driver team attention 14:55:57 <doude> Mon-Thu 14:56:02 <yushiro> amotoki, We need to check 'rfe-approved', is it necessary from driver-team ? 14:56:06 <SridarK> doude: no i have been swamped - perhaps we can sit together with yushiro and others who will be there 14:56:15 <mlavalle> amotoki: RFE 1628627 is baing actively pursued by zhobo 14:56:17 <doude> sure 14:56:26 <yushiro> doude, I'll be there :) 14:56:53 <amotoki> mlavalle: yes, I noticed that a few minutes ago. 14:56:56 <doude> I'll prepare that. Is there an FWaaS etherpad to organize the summit? 14:56:59 <mlavalle> cool 14:58:05 <SridarK> #link https://etherpad.openstack.org/p/fwaas-sydney-discussions 14:58:17 <SridarK> doude lets use this to coordinate 14:58:40 <xgerman_> ok, one minute left 14:58:52 <mlavalle> SridarK, doude: you both going to Sydney? 14:59:00 <amotoki> before closing the meeting, let me share https://review.openstack.org/#/c/501978/ (devstack patch) 14:59:01 <SridarK> mlavalle: yes 14:59:11 <amotoki> I think it is related to fwaas as well 14:59:27 <SridarK> mlavalle: we can discuss the audit bp more in detail in person too 14:59:53 <SridarK> mlavalle: i think this a useful feature for compliance etc to have 14:59:59 <xgerman_> let’s try to do that in addition to commenting on the spec 15:00:04 <mlavalle> ++ 15:00:19 <xgerman_> #endmeeting