00:00:11 #startmeeting networking_fwaas 00:00:11 Meeting started Thu Sep 3 00:00:11 2015 UTC and is due to finish in 60 minutes. The chair is sc68cal. Information about MeetBot at http://wiki.debian.org/MeetBot. 00:00:12 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 00:00:15 The meeting name has been set to 'networking_fwaas' 00:00:16 #chair SridarK 00:00:17 Current chairs: SridarK sc68cal 00:00:25 Hi 00:00:31 o/ 00:00:38 * sc68cal has been sick this week - so will be leaning on SridarK and xgerman a bit tonight 00:00:49 :-) 00:00:50 sc68cal: hope u feel better - no worries 00:00:51 #chair xgerman 00:00:51 Current chairs: SridarK sc68cal xgerman 00:00:54 \o 00:01:01 hello all 00:01:03 yeah, hope so 00:01:18 just a cold, so been working from bed / couch 00:01:43 #link Agenda https://wiki.openstack.org/wiki/Meetings/FWaaS 00:02:34 #topic action items from last meeting 00:02:37 sc68cal: i did some scrubbing there is still some old stuff that i will clean out as well 00:02:52 SridarK: cool. thanks :) 00:02:58 +1 00:03:01 Hi. Did not realize the channel changed 00:03:14 we try to keep you on your toes 00:03:15 mickeys: we conflicted with the API WG I think, so I had to change the location 00:03:50 Action items from last week were for cores to just triage bugs 00:04:13 and speaking of which 00:04:16 #topic bugs 00:04:24 sc68cal: yes quick run thru - nothing major to report there 00:04:35 hi 00:05:20 I see Lin opened https://bugs.launchpad.net/horizon/+bug/1491637 00:05:21 Launchpad bug 1491637 in OpenStack Dashboard (Horizon) "Error when adding a new Firewall Rule" [Undecided,New] 00:05:48 yes as reported earlier today - 00:06:27 bharathm: I think we need a bug to track your issue from the ML around router_info and updates 00:07:06 sc68cal: it's not me. I work with German for HP. Whereas that Bharath is from Brocade :-) 00:07:31 bharathm: ah, sorry 00:07:36 yeah, even I occasionally make that mistake 00:08:18 However that error needs to be addressed. xgerman requested him to create a launchpad bug to follow up 00:08:42 yep 00:08:57 Hmm it seems this is just seen according to his email 00:09:33 we should see if we have a tempest scenario somewhere that covers the scenario he describes 00:09:54 if I read correctly, it's the case of not getting updates 00:10:05 if it is just adding a new fw rule, i did that on the CLI some time ago and it was fine 00:11:17 Isn't this a horizon issue - not server side- and wasn't horizon was working a few days ago? 00:11:36 yes it seems only horizon 00:11:45 yep 00:11:45 not sure sure if anything changed there 00:12:30 I think it's two different bugs he's referring to in two separate emails 00:12:38 and he seems to imply it is very recent regression 00:13:41 bharathm - can you clarify with bug numbers? 00:14:02 Vish, who is not on today - is familiar with Horizon side of FWaaS - i will reach out to him as well 00:14:41 jwarendt_: heh - bharathm != bharath 00:14:50 jwarendt_ : https://bugs.launchpad.net/horizon/+bug/1491637 is the horizon bug 00:14:52 Launchpad bug 1491637 in OpenStack Dashboard (Horizon) "Error when adding a new Firewall Rule" [Undecided,New] 00:15:13 But there was another email dated Aug 30 with the same subject where he had issue with the router info update 00:15:18 I dont think a bug was filed for that 00:15:34 yeah he likes that subject line .... :) 00:15:43 Sry, and thanks for the clarification. 00:16:10 jwarendt_: no worries - I did it like 5 mins ago :) 00:17:01 and me like two hours ago :-) 00:17:15 sc68cal: Actually I am facing a similar issue in my devstack setup.. When new routers/fips' are created after the FW create, these new namespaces are not getting updated automatically 00:17:38 yeah, we need to (re=add) the rioters to force an update 00:17:56 wonder when this Neutron event bus comes out... 00:18:06 xgerman: bharathm - that's .... not good. 00:18:19 sc68cal: hmm 00:18:26 xgerman and I found a work around to use "neutron firewall_update {name} --router {router_id} --router {router_id2}" 00:18:32 sridark i think we tahught about this 00:18:33 now u have to explicitly bind a router to a FW 00:18:53 well, worse is the same happens with floating ip 00:19:08 I am ok with routers not being updated after all we don’t list them in fiorewall-show 00:19:14 xgerman: ok that is something else :-) i am not claiming responsibility 00:19:19 SridarK: it happens with fip too though the fip belongs to the existing router with fw rules configured 00:19:24 but i do not think we will have the issue 00:19:26 xgerman: we do show the routers 00:19:40 we should not have the issue 00:19:51 yep, so I am ok with the routers not being updates/added automatically but fips bother me 00:20:07 since we don’t show a user which fits we cover 00:20:11 bharathm: if we have new router and there is an existing FW, then u need to update the FW if u want it on the new router 00:20:13 fips 00:20:28 the old model we installed the FW on all routers in the tenant 00:20:29 SridarK correct 00:20:41 something we wanted to move away from and we did with Kilo 00:20:44 SridarK: I agree. But what about creating a FIP after the FW is applied 00:21:13 Hmm that we need to see 00:21:35 As I do not see any event trigger from L3 Agent or new_namespace_check at set intervals, new FIP namespaces are completely ignored 00:21:50 +1 00:22:09 so basically traffic inbound to a FIP doesn't get filtered via the firwall 00:22:10 ? 00:22:13 bharathm: there is supposed to be an event triggered - that we listen too 00:22:20 sc68cal: correct 00:22:23 yep, and that event is not happening 00:22:34 hmm ok need some debugging on that 00:22:48 Ok - let's get a bug opened for that one so we can start tracking 00:22:50 bharathm: is there a bug on this already ? 00:22:55 sc68cal: +1 00:22:59 +1 00:23:15 SridarK: Oh. May be I didn't dive deep enough to find that event triggering source code 00:23:20 sridark the l3agent observer 00:23:33 part should be done correct? 00:23:36 bharathm: yes i believe we tested that 00:23:45 sc68cal: I shall create the bug 00:23:49 thanks 00:23:52 badveli: we have not yet moved to the observer model 00:24:04 but the code should get triggered from L3Agent 00:24:07 bharathm: excellent. Thanks. 00:24:37 yes we thaught this case should be covered 00:24:37 bharathm: cool thx - shoot me an email too and we do a quick run thru this and try to narrow down 00:24:47 awesome!! 00:24:55 SridarK: that's great. Will do that 00:25:02 badveli: yes that was my thought too at least when this was done in Juno 00:25:21 yes sridark we even discussed this 00:25:32 with dvr team and i am suprised 00:25:39 there me and my big mouth saying nothing major on bugs :-) 00:25:51 Heh 00:26:10 well, there is a workaround: just re-add the router 00:26:29 xgerman this is not we intended and i was under the impression of the new observer model 00:26:52 badveli: is there a spec I could refer to about this observer model ? 00:27:03 SridarK: :) 00:27:05 xgerman: ok i recall going thru this scenario before we added a trigger in another place in L3Agent 00:27:27 bharathm i do not have a spec 00:27:27 ok something clearly is broken - need some debugging 00:27:33 but i will try to send some info 00:27:43 badveli: cool. Thanks 00:27:53 ok, let’s move on — sc68cal other things we need to hit? 00:28:17 xgerman: I think the only thing at this point is the observation that our test coverage needs improvement 00:28:25 sc68cal: +1 00:28:30 +! 00:28:33 +1 00:28:33 and we need more tempest scenario tests for common fwaas opeartions 00:28:37 +1 00:28:57 sc68cal: initially we were trying to add functional tests 00:29:02 sc68cal: this should be our step 0 in the roadmap 00:29:05 and then move on to scenario tests 00:29:09 we should have had a tempest scenario for - create firewall+policy+rules, then start adding FIPs and deleting and other types of common things 00:29:15 badveli: yes u were trying to feet some traction here 00:29:24 yes sridark 00:29:26 I think we need to move tests from neutron to fwaas repo? 00:29:50 yep, that is step -1 00:29:54 madhu_ak currently the unit tests are under fwaas 00:29:57 xgerman: :-) 00:30:20 and we are adding functional tests and scenario tests in fwaas 00:30:27 ok sounds good 00:30:38 but there are some tests still in tempest tree we should move over 00:30:45 or neutron tree 00:30:54 yep, its in neutron tree 00:30:58 yes we will do 00:31:15 cool — once the dust settle we (=HP) can help 00:31:22 +1 00:31:23 does someone want to do a spike on that and report back next week? 00:31:26 i followed up with pcm regarding the functional tests 00:31:33 and then scenario tests 00:31:47 * sc68cal hopes for a volunteer 00:32:47 ok, no volunteers? I'll take the action item then 00:33:10 is there a dead line i can help but very limited time 00:33:18 sc68cal: pcm has done a lot of this for vpn 00:33:45 it's basically go look and see what is the status and report back, not looking to solve next week 00:33:50 badveli: may be u can provide a dump of ur discussions with pcm to sc68cal - if u have time that is 00:34:38 yes pcm had written it 00:35:08 how in wiki 00:35:11 #action sc68cal coordinate with badveli and others about scenario and functional tests 00:35:19 ok that can save some work for sc68cal 00:35:37 ok, thanks 00:36:05 I think since we're in l-3 that we can skip blueprints 00:36:20 sc68cal: +1 no action there for now 00:36:32 so I think we can go to open discussion 00:36:58 #topic open discussion 00:37:38 now with the new time where are our friends from APJ? 00:37:53 xgerman: good question :-) 00:38:20 xgerman: first week must be a teething issue on timing 00:39:06 probably — sc68cal maybe we need to send another advertisement on the ML 00:39:50 xgerman: odd since hoangcx was on the last APAC meting 00:40:04 yep... 00:42:24 If there are no objections, we'll wrap up for today and give everyone back 20 mins 00:42:32 sounds good 00:42:36 +1 00:42:43 +1 00:42:47 +1 00:42:50 fine with me 00:42:52 ok everyone, until next week - 18:30 UTC 00:42:55 bye 00:42:57 sounds good 00:42:58 #endmeeting