| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2017-02-07 | |||
| 17:20:55 | lyarwood | mdbooth: sure | |
| 17:20:57 | sfinucan | sean-k-mooney: Yup | |
| 17:21:11 | sean-k-mooney | sfinucan: so this si currently called after plug but im not sure its valide to call it here in all cases. | |
| 17:21:13 | sfinucan | and it's used for "MAC, IP, and ARP spoofing protection" | |
| 17:21:18 | lyarwood | nikeshm: what virt_type are you using? | |
| 17:21:25 | mdbooth | lyarwood: Thanks! It's a date. | |
| 17:21:31 | sean-k-mooney | sfinucan: i dont think this will have any effect for vhost-user for example | |
| 17:21:46 | sfinucan | sean-k-mooney: No? How come? | |
| 17:22:10 | nikeshm | lyarwood: virt_type = qemu | |
| 17:22:16 | sean-k-mooney | how would that function configure mac,arp,ip spoofing on a vhost-user interfaces | |
| 17:22:30 | sean-k-mooney | sfinucan: that would have to be done in ovs | |
| 17:22:33 | lyarwood | nikeshm: and which verison of qemu? | |
| 17:22:41 | sfinucan | sean-k-mooney: aha, correct | |
| 17:22:48 | sfinucan | that is for IPTables only | |
| 17:23:03 | sfinucan | it's part of the IptablesFirewallDriver | |
| 17:23:09 | sean-k-mooney | sfinucan: it is for when you are using the old nova firewall not neutron security groups | |
| 17:23:23 | sfinucan | sean-k-mooney: danpb suggested otherwise though | |
| 17:23:25 | sean-k-mooney | sfinucan: it basically part of nova networks i think | |
| 17:23:36 | sean-k-mooney | sfinucan: i could be wrong | |
| 17:23:46 | mdbooth | lyarwood: Plan is to walk through the errors reported here: http://logs.openstack.org/09/395709/6/check/gate-tempest-dsvm-full-devstack-plugin-nfs-nv/c8091c2/logs/screen-n-cpu.txt.gz?level=ERROR | |
| 17:24:06 | sean-k-mooney | sfinucan: but i dont think this will have any eefect with the conntrack firewall driver in neutron for example | |
| 17:24:12 | dansmith | mriedem: you want me to replicate that multiline warning on each help string for transport and db? | |
| 17:24:43 | mriedem | dansmith: well they'd be slightly different but yeah, i don't think the actual docstring gets dumped in the cli help | |
| 17:24:45 | mriedem | i can check quick | |
| 17:25:15 | dansmith | oh I thought it did | |
| 17:25:18 | sean-k-mooney | sfinucan: looking at https://github.com/openstack/nova/blob/d5f113de34589933c23a7cecc25ca0bf5f47207d/nova/virt/libvirt/firewall.py#L117-L120 | |
| 17:25:22 | dansmith | that's the point of putting return value stuff in there right? | |
| 17:25:23 | mriedem | the help for the args is printed out, | |
| 17:25:31 | sean-k-mooney | sfinucan: it will disable this code if securty groupd are enabled | |
| 17:25:36 | mriedem | but i don't think the docstring gets into the help output for the command | |
| 17:25:45 | mriedem | and i guess i don't have a test vm handy to verify | |
| 17:25:50 | mriedem | but i had that issue with the nova-status stuff | |
| 17:25:55 | mriedem | which is why i also pushed for man pages | |
| 17:26:36 | dansmith | hmm | |
| 17:26:58 | dansmith | mriedem: remember you making me document the return values for the new cells commands there? I thought that was because the user, you know, sees that shit :) | |
| 17:27:38 | mriedem | do you have a devstack you can verify quick because i don't | |
| 17:27:42 | lyarwood | nikeshm: feel free to write this up in a bug btw if it's easier - https://bugs.launchpad.net/nova/+filebug | |
| 17:28:14 | dansmith | mriedem: I have an old one only, but let me look | |
| 17:28:46 | mriedem | just do like: nova-manage cell_v2 create_cell -h | |
| 17:29:01 | dansmith | it's too old for that :) | |
| 17:29:08 | sfinucan | sean-k-mooney: Yeah, all the guides I'm seeing suggest that nwfilter - the thing that reads that config - is only for ebtables | |
| 17:29:11 | sfinucan | i.e. not OVS | |
| 17:29:14 | sfinucan | https://www.redhat.com/archives/libvir-list/2013-November/msg00234.html | |
| 17:29:23 | dansmith | mriedem: my liberty system doesn't show that text at least | |
| 17:29:27 | dansmith | so unless something has changed... | |
| 17:29:37 | mriedem | nova-manage db sync -h | |
| 17:29:47 | mriedem | would show "Sync the database up to the most recent version" if it worked | |
| 17:30:08 | mriedem | it should show the help on the --version option though "Database version" | |
| 17:31:26 | sean-k-mooney | sfinucan: yes so this code should really only be run for linuxbridge or macvtap binding | |
| 17:31:47 | sean-k-mooney | so it proable should be moved into the linuxbridge pluging for os-vif | |
| 17:31:55 | sfinucan | sean-k-mooney: ...and even then, doesn't neutron have its own anti-spoofing stuff? | |
| 17:32:01 | sfinucan | e.g. http://kimizhang.com/neutron-ml2-port-security/ | |
| 17:32:03 | sean-k-mooney | for ovs yes | |
| 17:32:09 | sean-k-mooney | for linux bridge proably | |
| 17:32:13 | sean-k-mooney | not sure though | |
| 17:32:24 | sean-k-mooney | again i think this is mainly for nova-networks | |
| 17:32:25 | sfinucan | that blog suggests yes for linucbridge | |
| 17:32:31 | sfinucan | *linuxbridge | |
| 17:32:42 | openstackgerrit | Dan Smith proposed openstack/nova master: Add an update_cell command to nova-manage https://review.openstack.org/430354 | |
| 17:33:05 | sean-k-mooney | if you are using nova-netwokrs this code would be needed for firewall support because you would not have nova | |
| 17:33:09 | sean-k-mooney | * neutron | |
| 17:33:18 | nikeshm | lyarwood: qemu-utils 2.0.0+dfsg-2ubuntu1.30 amd64 QEMU utilities | |
| 17:33:23 | sean-k-mooney | nova-networks without nova would be hard | |
| 17:34:31 | sean-k-mooney | general question but is nova-networks dead yet? | |
| 17:35:06 | sean-k-mooney | can we actully start deleting the code for it. i kindof lost track of that effort | |
| 17:35:21 | lyarwood | nikeshm: and libvirt? | |
| 17:36:21 | nikeshm | lyarwood: libvirt-dev 1.2.2-0ubuntu13.1.17 amd64 development files for the libvirt library | |
| 17:40:34 | sfinucan | sean-k-mooney: Nope. It's there for another 2-3 cycles at least :( | |
| 17:41:10 | sean-k-mooney | :( really... why... | |
| 17:42:32 | sfinucan | sean-k-mooney: cells v1 | |
| 17:42:48 | sfinucan | need a migration path to cells v2 then another cycle for folks to switch over | |
| 17:42:49 | sean-k-mooney | cells v1 only works with nova-networks? | |
| 17:43:45 | sfinucan | from the looks of things, yup | |
| 17:43:57 | sean-k-mooney | sfinucan: so ocate cells v2 pike miragtion and queens remove nova networks? | |
| 17:44:20 | sfinucan | nope. cells v2 isn't complete yet | |
| 17:44:28 | sean-k-mooney | hum ok i taught cells v1 worked with neutron i guess not. | |
| 17:44:35 | sfinucan | you can't use more than one cell in cells v2 | |
| 17:44:54 | mriedem | sean-k-mooney: sfinucan: you can use neutron with cells v1 | |
| 17:44:58 | mriedem | godaddy is running ovs | |
| 17:45:07 | mriedem | it requires patches for the external vif plug event callbackstuff | |
| 17:45:10 | mriedem | but people are doing it | |
| 17:45:14 | sfinucan | mriedem: So what's the tie with nova-net? | |
| 17:45:24 | sfinucan | I thought that was the one blocker stopping us killing it | |
| 17:45:24 | mriedem | nova-net will only start in ocata if running cells v1 | |
| 17:45:36 | mriedem | nova-net will go when cells v1 goes | |
| 17:45:41 | sfinucan | right, but not the other way round | |
| 17:45:48 | sfinucan | ? | |
| 17:46:00 | mriedem | right | |
| 17:46:10 | lyarwood | nikeshm: hmmm can you document this in a bug and I'll take a look this evening? I can't reproduce that locally on Fedora 24 | |
| 17:46:18 | sfinucan | so why don't we keep cells v1 (which doesn't have a complete migration path) and kill nova-net (which does - neutron) | |
| 17:46:42 | mriedem | sfinucan: because then we'd have to switch the cells v1 CI job to neutron, | |
| 17:46:52 | mriedem | and we don't have that external vif plugging callback stuff plumbed into cells v1 upstream | |
| 17:47:00 | mriedem | which would require work to make cells v1 work with nova in our CI | |
| 17:47:12 | mriedem | work we don't care to do for something that we're effectively crippling and setting up to remove | |
| 17:48:13 | sfinucan | mriedem: ah, so it's a non-trivial amount of work | |
| 17:48:19 | mriedem | correct | |
| 17:48:34 | sfinucan | Gotcha. I didn't get that link. Thanks for clearing it up | |
| 17:48:50 | mriedem | np | |
| 17:49:33 | sfinucan | mikal: Do I recall talk of file injection going away? | |
| 17:49:35 | sean-k-mooney | sfinucan: so back to your original question we proably have to keep that function untill cells v1 goes... or move it to the linux bridge os-vif driver | |