Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

The only issue with the separate service proxying API calls is that it can't receive requests between the service and core plugins. What kind of stability requirements were you concerned about? A response change would be similar to having a custom policy.json file where things that violate constra

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On Aug 8, 2014, at 10:56 AM, Kevin Benton wrote: > There is an enforcement component to the group policy that allows you to use > the current APIs and it's the reason that group policy is integrated into the > neutron project. If someone uses the current APIs, the group policy plugin > will ma

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

e questions)" mailto:openstack-dev@lists.openstack.org>> Date: Wednesday, August 6, 2014 at 2:52 PM To: "OpenStack Development Mailing List (not for usage questions)" mailto:openstack-dev@lists.openstack.org>> Subject: Re: [openstack-dev] [Neutron] Group Based Policy and

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

ck Development Mailing List (not for usage questions)" < > openstack-dev@lists.openstack.org> > Date: Wednesday, August 6, 2014 at 1:41 PM > To: "OpenStack Development Mailing List (not for usage questions)" < > openstack-dev@lists.openstack.org> > Subject: Re: [open

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

stack.org>> Date: Wednesday, August 6, 2014 at 1:41 PM To: "OpenStack Development Mailing List (not for usage questions)" mailto:openstack-dev@lists.openstack.org>> Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way forward Hi Edgar, Actually, I think that other re

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

ts were totally ignored: > >>>> > >>>> > https://docs.google.com/document/d/1ZbOFxAoibZbJmDWx1oOrOsDcov6Cuom5aaB > >>>>Ir > >>>>upCD9E/edit > >>>> > >>>> I clearly saw this kind of issues coming.

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

>>>> suggested: "For instance: "endpoints" should be "enforcement point" >>>> >>>> I do not understand why GBP did not include this suggestionŠ >>>> >>>> Edgar >>>> >>>> From: Kevin Benton

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

+1 From: Edgar Magana [mailto:edgar.mag...@workday.com] Sent: Wednesday, August 06, 2014 10:40 AM To: OpenStack Development Mailing List (not for usage questions) Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way forward This is the consequence of a proposal that is not

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

List (not for usage questions) Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way forward As Ronak said, this thread is starting to move in a lot of different directions, ranging from correctness of the blueprint approval process to nova/neutron integration, which are rather off

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

forcement point" >>> >>> I do not understand why GBP did not include this suggestionŠ >>> >>> Edgar >>> >>> From: Kevin Benton >>> Reply-To: "OpenStack Development Mailing List (not for usage questions)" >

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

>> >> Edgar >> >> From: Kevin Benton >> Reply-To: "OpenStack Development Mailing List (not for usage questions)" >> >> Date: Wednesday, August 6, 2014 at 10:22 AM >> To: "OpenStack Development Mailing List (not for usage questions)&qu

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

Salvatore, Can you expand on point 2? Not sure what means in this case to 'treat it accordingly'. Thanks, Ivar. On Wed, Aug 6, 2014 at 7:44 PM, Salvatore Orlando wrote: > As Ronak said, this thread is starting to move in a lot of different > directions, ranging from correctness of the bluepri

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

Benton > Reply-To: "OpenStack Development Mailing List (not for usage questions)" > > Date: Wednesday, August 6, 2014 at 10:22 AM > To: "OpenStack Development Mailing List (not for usage questions)" > > > Subject: Re: [openstack-dev] [Neutron] Group Based Policy

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On 08/06/2014 01:22 PM, Kevin Benton wrote: What I was referring to was also not Keystone's definition of an endpoint. It's almost as if the term has many uses and was not invented for Keystone. :-) http://www.wireshark.org/docs/wsug_html_chunked/ChStatEndpoints.html Did a similar discussion oc

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

As Ronak said, this thread is starting to move in a lot of different directions, ranging from correctness of the blueprint approval process to nova/neutron integration, which are rather off topic. In particular it seems things are being skewed towards a discussion around nova parity, whereas actua

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

Which kind of uncertainty are you referring to? Given that the blueprint was approved long ago, and the code has been ready and under review following those specs... I think GBP is probably the patch with the least effort to be merged right now. Ivar. On Wed, Aug 6, 2014 at 7:34 PM, Joe Gordon

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

uestions)" mailto:openstack-dev@lists.openstack.org>> Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way forward What I was referring to was also not Keystone's definition of an endpoint. It's almost as if the term has many uses and was not in

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

cycle. Thanks Sridar From: Ivar Lazzaro mailto:ivarlazz...@gmail.com>> Reply-To: OpenStack List mailto:openstack-dev@lists.openstack.org>> Date: Wednesday, August 6, 2014 at 12:01 PM To: OpenStack List mailto:openstack-dev@lists.openstack.org>> Subject: Re: [openstack-dev] [Ne

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On Aug 6, 2014 10:21 AM, "Ronak Shah" wrote: > > We have diverged our attention towards nova-network-> neutron parity on this thread unnecessarily. > > Can we discuss and collectively decide on what is the way forward for GBP in Juno release? > > Efforts have been made by the subteam starting from

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

What I was referring to was also not Keystone's definition of an endpoint. It's almost as if the term has many uses and was not invented for Keystone. :-) http://www.wireshark.org/docs/wsug_html_chunked/ChStatEndpoints.html Did a similar discussion occur when Heat wanted to use the word 'template

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

We have diverged our attention towards nova-network-> neutron parity on this thread unnecessarily. Can we discuss and collectively decide on what is the way forward for GBP in Juno release? Efforts have been made by the subteam starting from throwing PoC at last summit to spec approval to code re

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

As a cloud admin one needs to make sure the endpoints in keystone publicurl, internalurl and adminurl all map to the right places in the infrastructure. As a cloud user (for example when using the HP/RAX public cloud that has multiple regions/endpoints) a user needs to be aware of which region maps

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

In the weekly neutron meetings it hasn't been mentioned that any of these items are at risk due to developer shortage. That's why I wanted Mark McClain to reply here because he has been leading the parity effort. On Aug 6, 2014 8:56 AM, "Joe Gordon" wrote: > > > > On Wed, Aug 6, 2014 at 4:12 PM,

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

It sounds to me like you are describing how a developer uses Keystone, not a user. My reference to 'application deployer' was to someone trying to run something like a mail server on an openstack cloud. On Aug 6, 2014 7:07 AM, "Russell Bryant" wrote: > On 08/05/2014 06:13 PM, Kevin Benton wrote:

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

Hi Joe, Are you suggesting to stop/remove everything that is not related to Nova Parity for the Juno release? Because then I fail to see why this and Mark's proposal are targeted only to GBP. In my humble opinion, these kind of concerns should be addressed at BP approval time. Otherwise the whol

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On 08/06/2014 02:12 AM, Kevin Benton wrote: Given that, pointing to the Nova parity work seems a bit like a red herring. This new API is being developed orthogonally to the existing API endpoints You see how you used the term endpoints there? :P -jay __

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On Wed, Aug 6, 2014 at 4:12 PM, Kevin Benton wrote: > Are there any parity features you are aware of that aren't receiving > adequate developer/reviewer time? I'm not aware of any parity features that > are in a place where throwing more engineers at them is going to speed > anything up. Maybe Ma

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On Aug 6, 2014, at 1:11 AM, Aaron Rosen mailto:aaronoro...@gmail.com>> wrote: I agree, I had actually proposed this here: https://blueprints.launchpad.net/nova/+spec/nova-api-quantum-create-port :), though there are some issues we need to solve in neutron first -- allowing the mac_address o

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On 08/05/2014 06:13 PM, Kevin Benton wrote: > That makes sense. It's not quite a fair analogy though to compare to > reintroducing projects or tenants because Keystone endpoints aren't > 'user-facing' so to speak. i.e. a regular user (application deployer, > instance operator, etc) should never hav

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On 08/05/2014 05:24 PM, Sumit Naiksatam wrote: > On Tue, Aug 5, 2014 at 1:41 PM, Jay Pipes wrote: >> On 08/05/2014 04:26 PM, Stephen Wong wrote: >>> >>> Agreed with Kevin and Sumit here. As a subgroup we talked about Nova >>> integration, and the preliminary idea, as Bob alluded to, is to add >>>

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

nStack List >> Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way >> forward >> >> >> On Tue, Aug 5, 2014 at 11:18 PM, Gary Kotton wrote: >>> >>> >>> >>> On 8/5/14, 8:53 PM, "Russell Bryant"

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

ack List >> Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way >> forward >> >> >> On Tue, Aug 5, 2014 at 11:18 PM, Gary Kotton wrote: >> >>> >>> >>> On 8/5/14, 8:53 PM, "Russell Bryant" wrote

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

OpenStack List mailto:openstack-dev@lists.openstack.org>> Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way forward On Tue, Aug 5, 2014 at 11:18 PM, Gary Kotton mailto:gkot...@vmware.com>> wrote: On 8/5/14, 8:53 PM, "Russell Bryant" mailto:rbry...@redha

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On Wed, Aug 6, 2014 at 12:59 AM, Gary Kotton wrote: > > > From: Aaron Rosen > Reply-To: OpenStack List > Date: Wednesday, August 6, 2014 at 10:09 AM > > To: OpenStack List > Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way > forward > >

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

From: Aaron Rosen mailto:aaronoro...@gmail.com>> Reply-To: OpenStack List mailto:openstack-dev@lists.openstack.org>> Date: Wednesday, August 6, 2014 at 10:09 AM To: OpenStack List mailto:openstack-dev@lists.openstack.org>> Subject: Re: [openstack-dev] [Neutron] Group Based

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

ply-To: OpenStack List > Date: Wednesday, August 6, 2014 at 9:12 AM > > To: OpenStack List > Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way > forward > > Are there any parity features you are aware of that aren't receiving > adequate developer/reviewer

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

Hi, I'm Masakazu Shinohara of Cyberagent corporation in Japan. I am a representative of our new cloud network project. We have a lot of services such as on line games blogs or all kind of web services. Now we have been testing Openstack and Cisco ACI. It is a really important thing that they can

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On Tue, Aug 5, 2014 at 11:18 PM, Gary Kotton wrote: > > > On 8/5/14, 8:53 PM, "Russell Bryant" wrote: > > >On 08/05/2014 01:23 PM, Gary Kotton wrote: > >> Ok, thanks for the clarification. This means that it will not be done > >> automagically as it is today ­ the tenant will need to create a Ne

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

t;> Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way forward Are there any parity features you are aware of that aren't receiving adequate developer/reviewer time? I'm not aware of any parity features that are in a place where throwing more engineers at them i

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On 8/5/14, 8:53 PM, "Russell Bryant" wrote: >On 08/05/2014 01:23 PM, Gary Kotton wrote: >> Ok, thanks for the clarification. This means that it will not be done >> automagically as it is today ­ the tenant will need to create a Neutron >> port and then pass that through. > >FWIW, that's the dir

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

Are there any parity features you are aware of that aren't receiving adequate developer/reviewer time? I'm not aware of any parity features that are in a place where throwing more engineers at them is going to speed anything up. Maybe Mark McClain (Nova parity leader) can provide some better insigh

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On 08/05/2014 07:28 PM, Joe Gordon wrote: > > > > On Wed, Aug 6, 2014 at 12:20 AM, Robert Kukura > wrote: > > On 8/4/14, 4:27 PM, Mark McClain wrote: >> All- >> >> tl;dr >> >> * Group Based Policy API is the kind of experimentation we be >>

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On Wed, Aug 6, 2014 at 12:20 AM, Robert Kukura wrote: > On 8/4/14, 4:27 PM, Mark McClain wrote: > > All- > > tl;dr > > * Group Based Policy API is the kind of experimentation we be should > attempting. > * Experiments should be able to fail fast. > * The master branch does not fail fast. > * Sta

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

That makes sense. It's not quite a fair analogy though to compare to reintroducing projects or tenants because Keystone endpoints aren't 'user-facing' so to speak. i.e. a regular user (application deployer, instance operator, etc) should never have to see or understand the purpose of a Keystone end

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On 08/05/2014 05:22 PM, Kevin Benton wrote: >Is anyone listening to what I'm saying? The term "endpoint" is obtuse and completely disregards the existing denotation of the word "endpoint" in use in OpenStack today. Sorry, I didn't understand the confusion because you didn't provide a reference

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On Tue, Aug 5, 2014 at 1:41 PM, Jay Pipes wrote: > On 08/05/2014 04:26 PM, Stephen Wong wrote: >> >> Agreed with Kevin and Sumit here. As a subgroup we talked about Nova >> integration, and the preliminary idea, as Bob alluded to, is to add >> "endpoint" as an option in place of Neutron port. But

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

>Is anyone listening to what I'm saying? The term "endpoint" is obtuse and completely disregards the existing denotation of the word "endpoint" in use in OpenStack today. Sorry, I didn't understand the confusion because you didn't provide a reference to how "endpoint" is used in OpenStack now. I h

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On 08/05/2014 04:26 PM, Stephen Wong wrote: Agreed with Kevin and Sumit here. As a subgroup we talked about Nova integration, and the preliminary idea, as Bob alluded to, is to add "endpoint" as an option in place of Neutron port. But if we can make Nova EPG-aware, it would be great. Is anyone

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

Agreed with Kevin and Sumit here. As a subgroup we talked about Nova integration, and the preliminary idea, as Bob alluded to, is to add "endpoint" as an option in place of Neutron port. But if we can make Nova EPG-aware, it would be great. On Tue, Aug 5, 2014 at 12:54 PM, Sumit Naiksatam wrote:

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

That's right Kevin, EPG (and its association to the L2/3_Policy) capture the attributes which would represent the "network-template" being referenced here. Jay, what Bob mentioned here was an option to use the "endpoint" as a one-to-one replacement for the option of using a Neutron port. This is m

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On 08/05/2014 03:24 PM, Kevin Benton wrote: Specifying an endpoint group would achieve the --networking-template effects you described. The endpoint group would have all of the security policies, IP allocation policies, connectivity policies, etc. already setup. OK. Is there any reason it was c

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

Specifying an endpoint group would achieve the --networking-template effects you described. The endpoint group would have all of the security policies, IP allocation policies, connectivity policies, etc. already setup. On Tue, Aug 5, 2014 at 1:04 PM, Jay Pipes wrote: > On 08/05/2014 01:13 PM, R

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On 08/05/2014 01:13 PM, Robert Kukura wrote: On 8/5/14, 11:04 AM, Gary Kotton wrote: Hi, Is there any description of how this will be consumed by Nova. My concern is this code landing there. Hi Gary, Initially, an endpoint's port_id is passed to Nova using "nova boot ... --nic port-id= ...",

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On 08/05/2014 01:23 PM, Gary Kotton wrote: > Ok, thanks for the clarification. This means that it will not be done > automagically as it is today – the tenant will need to create a Neutron > port and then pass that through. FWIW, that's the direction we've wanted to move in Nova anyway. We'd like

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

.org>> Date: Tuesday, August 5, 2014 at 8:13 PM To: OpenStack List <mailto:openstack-dev@lists.openstack.org>> Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way forward On 8/5/14, 11:04 AM, Gary Kotton wrote: Hi, Is there any description of how this will b

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

ck-dev@lists.openstack.org>> Date: Tuesday, August 5, 2014 at 8:13 PM To: OpenStack List mailto:openstack-dev@lists.openstack.org>> Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way forward On 8/5/14, 11:04 AM, Gary Kotton wrote: Hi, Is there any description of how this w

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

@lists.openstack.org>> Date: Tuesday, August 5, 2014 at 5:20 PM To: OpenStack List <mailto:openstack-dev@lists.openstack.org>> Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way forward On 8/4/14, 4:27 PM, Mark McClain wrote: All- tl;dr * Group Based Poli

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

o: OpenStack List mailto:openstack-dev@lists.openstack.org>> Subject: Re: [openstack-dev] [Neutron] Group Based Policy and the way forward On 8/4/14, 4:27 PM, Mark McClain wrote: All- tl;dr * Group Based Policy API is the kind of experimentation we be should attempting. * Experiments shou

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

On 8/4/14, 4:27 PM, Mark McClain wrote: All- tl;dr * Group Based Policy API is the kind of experimentation we be should attempting. * Experiments should be able to fail fast. * The master branch does not fail fast. * StackForge is the proper home to conduct this experiment. The disconnect her

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

+1 mark On Tue, Aug 5, 2014 at 4:27 AM, Mark McClain wrote: > All- > > tl;dr > > * Group Based Policy API is the kind of experimentation we be should > attempting. > * Experiments should be able to fail fast. > * The master branch does not fail fast. > * StackForge is the proper home to conduc

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

Hi, When I think about Group-Based Policy I cannot help myself but think about the degree of variety of sentiments (for lack of better words) that this subject has raised over the past few months on the mailing list and/or other venues. I speak for myself when I say that when I look at the end-to

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

+1 Hemanth. On Tue, Aug 5, 2014 at 12:24 AM, Hemanth Ravi wrote: > Hi, > > I believe that the API has been reviewed well both for its usecases and > correctness. And the blueprint has been approved after sufficient exposure > of the API in the community. The best way to enable users to adopt GB

Re: [openstack-dev] [Neutron] Group Based Policy and the way forward

Hi, I believe that the API has been reviewed well both for its usecases and correctness. And the blueprint has been approved after sufficient exposure of the API in the community. The best way to enable users to adopt GBP is to introduce this in Juno rather than as a project in StackForge. Just as