<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Hey folks,</div>
<div><br>
</div>
<div>I guess we agreed to do this at the Kolla midcycle already, but the core team is mostly on vacation this week, and I was having trouble getting a discussion going on this on IRC. The team talks faster then I can write notes :) I really want to thank
the Operators that have responded on this thread – its really fantastic to see Operators "bother" to care about a new deployment tool since past deployment tools have been so painful :)</div>
<div><br>
</div>
<div>On that note, if there are other requirements where Kolla doesn't really meet an Operational deployment needs, we would definitely like to know. I think deployment tools are developed mostly in a vacuum and that’s a real shame. We have some operational
experience on our development team, but more feedback is better then less.</div>
<div><br>
</div>
<div>Here is Sam's email to me that he asked me to forward to the operator's list. Sam is a core reviewer in the Kolla project and doing the external ssl work. He is having permissions problems posting to the list.</div>
<div><br>
</div>
<div><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">From: Sam Yaple <</span><a href="mailto:samuel@yaple.net" target="_blank" style="color: rgb(17, 85, 204); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">samuel@yaple.net</a><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">></span></div>
<div><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">To: </span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">
<span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">Cc: </span><a href="mailto:openstack-operators@lists.openstack.org" target="_blank" style="color: rgb(17, 85, 204); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">openstack-operators@lists.<wbr>openstack.org</a><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">
<span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">Date: Fri, 12 Feb 2016 23:08:36 +0000</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">
<span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">Subject: Re: [Openstack-operators] [kolla] Question about how Operators deploy</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">
<p dir="ltr" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">
To disperse any confusion here, Kolla currently does not prevent an external VIP. It simply does not manage it. Right now you can do ssl termination and add an external vip if you as the operator set that up outside of Kolla (preferably firewalled, possibly
load-balanced). What is being suggested here is that _kolla_ handle creating a user-specified public VIP and assigning the it to the keepalived/haproxy nodes and so it can properly automate ssl termination at haproxy for the external VIP.</p>
<p dir="ltr" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">
At the mid-cycle for Liberty it was discussed to use haproxy for ssl termination, but no agreement was reached as to whether Kolla should setup a public facing VIP. It was agreed in the Mitaka (3 days ago) mid-cycle that automating an optional ssl-termination
at haproxy was a desire. This means we _must_ do a second VIP as initially discussed in Liberty.</p>
<p dir="ltr" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">
All in all what operators should get out of this is the following:</p>
<p dir="ltr" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">
* You can currently use external loadbalancers and firewalls and completely disable Kolla deploying and managing keepalived and haproxy for both internal and external vips<br>
* You can currently use Kolla to deploy keepalived and haproxy with only an internal VIP and configure an external VIP on your own firewall/loadbalancer gear<br>
* You will be able configure a separate VIP for your internal and a separate VIP for your external traffic with automated setup of ssl termination at haproxy (the operator must still handle firewalling the external VIP)</p>
<p dir="ltr" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">
The first two options are available now. All three options will be at the disposal of operators very soon here. I believe Dave submitted a patch for this already (though I have not yet reviewed it).</p>
<p dir="ltr" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">
Hopefully this clears up any confusion. Does anyone have any questions or comments about this explanation?</p>
<p dir="ltr" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);">
Sam Yaple</p>
</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Jonathan Abdiel Gonzalez Valdebenito <<a href="mailto:jonathan.abdiel@gmail.com">jonathan.abdiel@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Saturday, February 13, 2016 at 6:08 PM<br>
<span style="font-weight:bold">To: </span>Robert Starmer <<a href="mailto:robert@kumul.us">robert@kumul.us</a>>, Steven Dake <<a href="mailto:stdake@cisco.com">stdake@cisco.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>" <<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openstack-operators] [kolla] Question about how Operators deploy<br>
</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>
<div>
<p dir="ltr">Hi, </p>
<p dir="ltr">We also use two VIPs for tracking and security reasons a +1 for two VIP</p>
<br>
<div class="gmail_quote">
<div dir="ltr">On Sat, Feb 13, 2016, 21:00 Robert Starmer <<a href="mailto:robert@kumul.us">robert@kumul.us</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">+1 on two VIPs</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Feb 12, 2016 at 6:04 AM, Steven Dake (stdake) <span dir="ltr">
<<a href="mailto:stdake@cisco.com" target="_blank">stdake@cisco.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>Hi folks,</div>
<div><br>
</div>
<div>Unfortunately I won't be able to make it to the Operator midcycle because of budget constraints or I would find the answer to this question there. The Kolla upstream is busy sorting out external ssl termination and a question arose in the Kolla community
around operator requirements for public<span style="font-style:italic">URL vs internal</span>URL VIP management.</div>
<div><br>
</div>
<div>At present, Kolla creates 3 Haproxy containers across 3 HA nodes with one VIP managed by keepalived. The VIP is used for internal communication only. Our PUBLIC_URL is set to a DNS name, and we expect the Operator to sort out how to map that DNS name
to the internal VIP used by Kolla. The way I do this in my home lab is to use NAT to NAT my public_URL from the internet (hosted by dyndns) to my internal VIP that haproxies to my 3 HA control nodes. This is secure assuming someone doesn't bust through my
NAT.</div>
<div><br>
</div>
<div>An alternative has been suggested which is to use TWO vips. One for internal_url, one for public_url. Then the operator would only be responsible for selecting where to to allocate the public_url endpoint's VIP. I think this allows more flexibility
without necessarily requiring NAT while still delivering a secure solution.</div>
<div><br>
</div>
<div>Not having ever run an OpenStack cloud in production, how do the Operators want it? Our deciding factor here is what Operators want, not what is necessarily currently in the code base. We still have time to make this work differently for Mitaka, but
I need feedback/advice quickly.</div>
<div><br>
</div>
<div>The security guide seems to imply two VIPs are the way to Operate: (big diagram):</div>
<div>
<div><a href="http://docs.openstack.org/security-guide/networking/architecture.html" target="_blank">http://docs.openstack.org/security-guide/networking/architecture.html</a></div>
</div>
<div><br>
</div>
<div>The IRC discussion is here for reference:</div>
<div><a href="http://eavesdrop.openstack.org/irclogs/%23kolla/%23kolla.2016-02-12.log.html#t2016-02-12T12:09:08" target="_blank">http://eavesdrop.openstack.org/irclogs/%23kolla/%23kolla.2016-02-12.log.html#t2016-02-12T12:09:08</a></div>
<div><br>
</div>
<div>Thanks in Advance!</div>
<div>-steve</div>
<div><br>
</div>
</div>
<br>
_______________________________________________<br>
OpenStack-operators mailing list<br>
<a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
<br>
</blockquote>
</div>
<br>
</div>
_______________________________________________<br>
OpenStack-operators mailing list<br>
<a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
</blockquote>
</div>
</div>
</div>
</blockquote>
</span>
</body>
</html>