<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Mar 7, 2014 at 12:27 AM, Miguel Angel Ajo <span dir="ltr"><<a href="mailto:majopela@redhat.com" target="_blank">majopela@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
I'm really happy to see that I'm not the only one concerned about performance.<br>
<br>
<br>
I'm reviewing the thread, and summarizing / replying to multiple people on the thread:<br>
<br>
<br>
Ben Nemec,<br>
<br>
* Thanks for pointing us to the previous thread about this topic:<br>
<a href="http://lists.openstack.org/pipermail/openstack-dev/2013-July/012539.html" target="_blank">http://lists.openstack.org/<u></u>pipermail/openstack-dev/2013-<u></u>July/012539.html</a><br>
<br>
<br>
Rick Jones,<br>
<br>
* iproute commit f0124b0f0aa0e5b9288114eb8e6ff9<u></u>b4f8c33ec8 upstream,<br>
I have to check if it's on my system.<br>
<br>
* Very interesting investigation about sudo:<br>
<br>
<a href="http://www.sudo.ws/repos/sudo/rev/e9dc28c7db60" target="_blank">http://www.sudo.ws/repos/sudo/<u></u>rev/e9dc28c7db60</a> this is as important<br>
as the bottleneck in rootwrap when you start having lots of interfaces.<br>
Good catch!,<br>
<br>
* To your question: my times are only from neutron-dhcp-agent & neutron-l3-agent start, to completion, system boot times are excluded from the<br>
measurement (That's <1min).<br>
<br>
* About the Linux networking folks not exposing API interfaces to avoid<br>
lock in, in the end they're already locked in with the cmd api interface, if they made an API at the same level, it shouldn't be that bad... but of course, it's not free...<br>
<br>
<br>
Joe Gordon,<br>
<br>
* yes, pypy start time is too slow, and I must definitely investigate about the RPython toolchain.<br>
<br>
* Ideally, I agree, that a an automated py->C solution would be<br>
the best from the openstack project point of view. Have you had any<br>
experience with that using such toolchain? Could you point me to some example?<br></blockquote><div><br></div><div>Sorry I am afraid I don't have experience with this or any examples.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
* shedskin seems to do this kind of translation, for a limited python<br>
subset, which would mean rewriting rootwrap's python to accommodate<br>
such limitations.<br>
<br></blockquote><div><br></div><div>RPython is a subset of Python so rewritting will be needed for pypy as well.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
If no tool offers the translation we need, or if the result is slow:<br>
<br>
I'm not against a rewrite of rootwrap in C/C++, if we have developers<br>
on the project, with C/C++ experience, specially related to security.<br>
I have such experience, and I'm sure there are more around (even if<br>
not all openstack developers talk C). But, that doesn't exclude that<br>
we maintain a rootwrap in python to foster innovation around the tool.<br>
(here I agree with Vishvananda Ishaya)<br>
<br>
<br>
Solly Ross,<br>
I haven't tried cython, but I will check it in a few minutes.<br>
<br>
<br>
Iwamoto Toshihiro,<br>
<br>
Thanks for pointing us to "ip netns exec" too, I wonder if that's<br>
releated to the iproute upstream change Rick Jones was talking about.<br>
<br>
<br>
Cheers,<br>
Miguel Ángel.<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
<br>
<br>
<br>
<br>
On 03/06/2014 09:31 AM, Miguel Angel Ajo wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
On 03/06/2014 07:57 AM, IWAMOTO Toshihiro wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
At Wed, 05 Mar 2014 15:42:54 +0100,<br>
Miguel Angel Ajo wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
3) I also find 10 minutes a long time to setup 192 networks/basic tenant<br>
structures, I wonder if that time could be reduced by conversion<br>
of system process calls into system library calls (I know we don't have<br>
libraries for iproute, iptables?, and many other things... but it's a<br>
problem that's probably worth looking at.)<br>
</blockquote>
<br>
Try benchmarking<br>
<br>
$ sudo ip netns exec qfoobar /bin/echo<br>
</blockquote>
<br>
You're totally right, that takes the same time as rootwrap itself. It's<br>
another point to think about from the performance point of view.<br>
<br>
An interesting read:<br>
<a href="http://man7.org/linux/man-pages/man8/ip-netns.8.html" target="_blank">http://man7.org/linux/man-<u></u>pages/man8/ip-netns.8.html</a><br>
<br>
ip netns does a lot of mounts around to simulate a normal environment,<br>
where an netns-aware application could avoid all this.<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Network namespace switching costs almost as much as a rootwrap<br>
execution, IIRC.<br>
<br>
Execution coalesceing is not enough in this case and we would need to<br>
change how Neutron issues commands, IMO.<br>
</blockquote>
<br>
Yes, one option could be to coalesce all calls that go into<br>
a namespace into a shell script and run this in the<br>
ootwrap > ip netns exec<br>
<br>
But we might find a mechanism to determine if some of the steps failed,<br>
and what was the result / output, something like failing line + result<br>
code. I'm not sure if we rely on stdout/stderr results at any time.<br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
<br>
<br>
<br>
______________________________<u></u>_________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.<u></u>org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/<u></u>cgi-bin/mailman/listinfo/<u></u>openstack-dev</a><br>
<br>
</blockquote>
<br>
______________________________<u></u>_________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.<u></u>org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/<u></u>cgi-bin/mailman/listinfo/<u></u>openstack-dev</a><br>
</blockquote>
<br>
______________________________<u></u>_________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.<u></u>org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/<u></u>cgi-bin/mailman/listinfo/<u></u>openstack-dev</a><br>
</div></div></blockquote></div><br></div></div>