)]}'
{"doc/source/design/version1/component-design.rst":[{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":16,"context_line":"----------------"},{"line_number":17,"context_line":"This is the front-end that users (and user GUIs or what have you) talk to to"},{"line_number":18,"context_line":"manipulate load balancing services. All implementation details are hidden from"},{"line_number":19,"context_line":"the user in this interface."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"**Notes:**"},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_f676c33f","line":19,"updated":"2014-08-06 00:18:51.000000000","message":"This sentence is duplicated below in the notes section.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":16,"context_line":"----------------"},{"line_number":17,"context_line":"This is the front-end that users (and user GUIs or what have you) talk to to"},{"line_number":18,"context_line":"manipulate load balancing services. All implementation details are hidden from"},{"line_number":19,"context_line":"the user in this interface."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"**Notes:**"},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_63b2d4e9","line":19,"in_reply_to":"baada198_f676c33f","updated":"2014-08-07 00:06:56.000000000","message":"Fixing.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"a784854ddbfc1dba709849d1fc24b398649275bc","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"* Talks some \"intermediate driver interface\" with the driver, which might be a"},{"line_number":45,"context_line":"  combination of database records, or objects passed directly within the python"},{"line_number":46,"context_line":"  code to the driver."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":49,"context_line":"LBaaS / Octavia Crossover"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_08531317","line":46,"updated":"2014-08-06 02:57:26.000000000","message":"This needs to just be plain python objects and not sqlalchemy models.  This goes along with keeping the database logic out of the driver layer if at all possible.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"* Talks some \"intermediate driver interface\" with the driver, which might be a"},{"line_number":45,"context_line":"  combination of database records, or objects passed directly within the python"},{"line_number":46,"context_line":"  code to the driver."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":49,"context_line":"LBaaS / Octavia Crossover"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_63a7500a","line":46,"in_reply_to":"baada198_08531317","updated":"2014-08-06 05:05:00.000000000","message":"+1","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"* Talks some \"intermediate driver interface\" with the driver, which might be a"},{"line_number":45,"context_line":"  combination of database records, or objects passed directly within the python"},{"line_number":46,"context_line":"  code to the driver."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":49,"context_line":"LBaaS / Octavia Crossover"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_a3fa2c75","line":46,"in_reply_to":"baada198_08531317","updated":"2014-08-07 00:06:56.000000000","message":"Done","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":62,"context_line":"OPERATOR API HANDLER"},{"line_number":63,"context_line":"--------------------"},{"line_number":64,"context_line":"This is exactly like the USER API HANDLER in function, except that"},{"line_number":65,"context_line":"implementation details are exposed to the operator. This is also the \"admin\""},{"line_number":66,"context_line":"API where, for example, flavors get defined."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"**Notes:**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_43c96c79","line":65,"updated":"2014-08-06 05:05:00.000000000","message":"I would argue we also need additional functionality which might be used by support, e.g. listing a tenant\u0027s load balancers, etc. by an admin user","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":62,"context_line":"OPERATOR API HANDLER"},{"line_number":63,"context_line":"--------------------"},{"line_number":64,"context_line":"This is exactly like the USER API HANDLER in function, except that"},{"line_number":65,"context_line":"implementation details are exposed to the operator. This is also the \"admin\""},{"line_number":66,"context_line":"API where, for example, flavors get defined."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"**Notes:**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_031d98bf","line":65,"in_reply_to":"baada198_43c96c79","updated":"2014-08-07 00:06:56.000000000","message":"I\u0027ll update the wording on this. Let me know what you think of the new copy.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":63,"context_line":"--------------------"},{"line_number":64,"context_line":"This is exactly like the USER API HANDLER in function, except that"},{"line_number":65,"context_line":"implementation details are exposed to the operator. This is also the \"admin\""},{"line_number":66,"context_line":"API where, for example, flavors get defined."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"**Notes:**"},{"line_number":69,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_83fe24ae","line":66,"updated":"2014-08-06 05:05:00.000000000","message":"The flavor framework should be the Neutron one (see https://review.openstack.org/#/c/102723/)  - why would there be extra flavors","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":63,"context_line":"--------------------"},{"line_number":64,"context_line":"This is exactly like the USER API HANDLER in function, except that"},{"line_number":65,"context_line":"implementation details are exposed to the operator. This is also the \"admin\""},{"line_number":66,"context_line":"API where, for example, flavors get defined."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"**Notes:**"},{"line_number":69,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_43a15039","line":66,"in_reply_to":"baada198_83fe24ae","updated":"2014-08-07 00:06:56.000000000","message":"Good call-- this copy was written well before the flavor framework discussion at the mid-cycle sprint, where it was still very unclear how flavors would work at all.\n\nHaving said this, if the way flavors are implemented in the end requires certain service-specific controls not covered by the flavors API itself, then that would logically fall into the operator/admin API. But for now I\u0027ll remove the verbage implying there might be more than one way to manipulate flavors.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"* It may make sense to (eventually) combine the actual daemon (or CGI script or"},{"line_number":76,"context_line":"  whatever) that handles the operator API with the one that handles the user"},{"line_number":77,"context_line":"  API."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* This interface must by capable of being \"extended\" by the driver in ways that"},{"line_number":80,"context_line":"  allow vendors to expose advanced features of their devices to operators."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_e3d36035","line":77,"updated":"2014-08-06 05:05:00.000000000","message":"At HP we found use in doing exactly the opposite. Whereas we make the the user api available to the public we use a restricted port/network for the admin api and hence have to app servers. Arguably, that can be achieved differently but I would like to not limit the implementation by this requirement.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"* It may make sense to (eventually) combine the actual daemon (or CGI script or"},{"line_number":76,"context_line":"  whatever) that handles the operator API with the one that handles the user"},{"line_number":77,"context_line":"  API."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* This interface must by capable of being \"extended\" by the driver in ways that"},{"line_number":80,"context_line":"  allow vendors to expose advanced features of their devices to operators."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_862536af","line":77,"in_reply_to":"baada198_e3d36035","updated":"2014-08-07 00:06:56.000000000","message":"Hmmm...  I don\u0027t think the wording above limits the implementation at all since this isn\u0027t a hard requirement, just speculation on where things might go given that Octavia is presently subservient to Neutron LBaaS. It might also make sense to never combine the user and operator APIs. :/\n\nShould I remove this bit of speculation? What do others think?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"a784854ddbfc1dba709849d1fc24b398649275bc","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Talks some \"intermediate driver interface\" with the driver, which might be a"},{"line_number":88,"context_line":"  combination of database records, or objects passed directly within the python"},{"line_number":89,"context_line":"  code to the driver."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"DRIVER"},{"line_number":92,"context_line":"------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_c86f5bc6","line":89,"updated":"2014-08-06 02:57:26.000000000","message":"same comment as above.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Talks some \"intermediate driver interface\" with the driver, which might be a"},{"line_number":88,"context_line":"  combination of database records, or objects passed directly within the python"},{"line_number":89,"context_line":"  code to the driver."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"DRIVER"},{"line_number":92,"context_line":"------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_a6531a15","line":89,"in_reply_to":"baada198_c86f5bc6","updated":"2014-08-07 00:06:56.000000000","message":"Fixing.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":99,"context_line":"* Configuration of the driver is beyond the scope of this design, but could"},{"line_number":100,"context_line":"  happen either via config files, via extended operator API, via flavors, or"},{"line_number":101,"context_line":"  some other means appropriate for the back-end. This is ultimately up to the"},{"line_number":102,"context_line":"  vendor."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"* Driver will be loaded by the daemon that does the user API and operator API."},{"line_number":105,"context_line":"  It is not, in and of itself, its own daemon, though a given vendor\u0027s back-end"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_d6e8df7d","line":102,"updated":"2014-08-06 00:18:51.000000000","message":"It seems like we should define this and not leave it so open.  Won\u0027t we be developing this driver for Octavia?  I.e. we are the vendor.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":99,"context_line":"* Configuration of the driver is beyond the scope of this design, but could"},{"line_number":100,"context_line":"  happen either via config files, via extended operator API, via flavors, or"},{"line_number":101,"context_line":"  some other means appropriate for the back-end. This is ultimately up to the"},{"line_number":102,"context_line":"  vendor."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"* Driver will be loaded by the daemon that does the user API and operator API."},{"line_number":105,"context_line":"  It is not, in and of itself, its own daemon, though a given vendor\u0027s back-end"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_46b07e40","line":102,"in_reply_to":"baada198_d6e8df7d","updated":"2014-08-07 00:06:56.000000000","message":"So you\u0027re right in that this was better defined in Mark McClain\u0027s proposal for the flavor framework. The above verbage predates that. I\u0027ll update accordingly.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10980,"name":"Doug Wiegley","email":"dougwig@parkside.io","username":"dougw"},"change_message_id":"fc387500622f20ae09cea9deddb53200a708ccf6","unresolved":false,"context_lines":[{"line_number":110,"context_line":"  it horizontally scalable and to preserves the statelessness of the user and"},{"line_number":111,"context_line":"  operator API handlers. Note that the driver may interface with back-end"},{"line_number":112,"context_line":"  components which need not be stateless."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"NEUTRON-SHIM"},{"line_number":115,"context_line":"------------"},{"line_number":116,"context_line":"In order to keep Octavia\u0027s design more clean as a pure consumer of network"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_7549a265","line":113,"updated":"2014-08-06 20:38:12.000000000","message":"Also note that multiple instances of the driver may talk to the same Octavia, at the same time.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"54621197fdfd8e49549e9cd50e0f41488419c04a","unresolved":false,"context_lines":[{"line_number":110,"context_line":"  it horizontally scalable and to preserves the statelessness of the user and"},{"line_number":111,"context_line":"  operator API handlers. Note that the driver may interface with back-end"},{"line_number":112,"context_line":"  components which need not be stateless."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"NEUTRON-SHIM"},{"line_number":115,"context_line":"------------"},{"line_number":116,"context_line":"In order to keep Octavia\u0027s design more clean as a pure consumer of network"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_365f2d12","line":113,"in_reply_to":"baada198_7549a265","updated":"2014-08-07 00:23:13.000000000","message":"Good point, I\u0027ll add the note.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10980,"name":"Doug Wiegley","email":"dougwig@parkside.io","username":"dougw"},"change_message_id":"fc387500622f20ae09cea9deddb53200a708ccf6","unresolved":false,"context_lines":[{"line_number":132,"context_line":"* Obviously, as we discover missing functionality in the Neutron API, we should"},{"line_number":133,"context_line":"  work with the Neutron core devs to get these added to the API in a timely"},{"line_number":134,"context_line":"  fashion: We want the Neutron Shim to be a \"temporary\" work around."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":138,"context_line":"Octavia Components"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_5542de3b","line":135,"updated":"2014-08-06 20:38:12.000000000","message":"So, it\u0027s a driver agent, but not submitted to neutron, to increase velocity.  Yep.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"54621197fdfd8e49549e9cd50e0f41488419c04a","unresolved":false,"context_lines":[{"line_number":132,"context_line":"* Obviously, as we discover missing functionality in the Neutron API, we should"},{"line_number":133,"context_line":"  work with the Neutron core devs to get these added to the API in a timely"},{"line_number":134,"context_line":"  fashion: We want the Neutron Shim to be a \"temporary\" work around."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":138,"context_line":"Octavia Components"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_f67bf577","line":135,"in_reply_to":"baada198_5542de3b","updated":"2014-08-07 00:23:13.000000000","message":"Exactly. :) Well-- I want to emphasize that the goal is to get any of the \"dirty hacks\" this shim will need to do into Neutron eventually (and hopefully sooner rather than later). But I also think it\u0027s fairly clear that these two projects will see development at different speeds, and we shouldn\u0027t let one delay progress on the other.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":149,"context_line":"------------------------"},{"line_number":150,"context_line":"This is how the components that make up Octavia send messages to each other"},{"line_number":151,"context_line":"(except the controller to octavia VMs). It is thought that we\u0027d use OpenStack\u0027s"},{"line_number":152,"context_line":"existing queueing system (oslo/rabbitmq, mostly) for this. The only constraint"},{"line_number":153,"context_line":"here is that all the components (except the octavia VMs) need to be able to"},{"line_number":154,"context_line":"talk with the intermediate message bus."},{"line_number":155,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_76b71389","line":152,"updated":"2014-08-06 00:18:51.000000000","message":"Can\u0027t we decide this and state it will be OpenStack\u0027s Oslo messaging?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":149,"context_line":"------------------------"},{"line_number":150,"context_line":"This is how the components that make up Octavia send messages to each other"},{"line_number":151,"context_line":"(except the controller to octavia VMs). It is thought that we\u0027d use OpenStack\u0027s"},{"line_number":152,"context_line":"existing queueing system (oslo/rabbitmq, mostly) for this. The only constraint"},{"line_number":153,"context_line":"here is that all the components (except the octavia VMs) need to be able to"},{"line_number":154,"context_line":"talk with the intermediate message bus."},{"line_number":155,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_66282237","line":152,"in_reply_to":"baada198_76b71389","updated":"2014-08-07 00:06:56.000000000","message":"So, I\u0027ve also heard suggestions that we should have RESTful APIs attached to each component to avoid the Oslo messaging system and its inherent difficulties. I think this deserves more discussion before we decide on one path or another here.\n\nAlso, this is something we can hold off on defining this for the immediate future because version 0.5 of Octavia will have most of the control components combined into a single daemon which won\u0027t need an intermediate message bus since it\u0027s self-contained. (And yes, I\u0027m still working on the 0.5 design spec and hope to have it out this week.)","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":158,"context_line":"* As certain sensitive data (TLS private keys, for example) will be transmitted"},{"line_number":159,"context_line":"  over this communication infrastructure, and because we can\u0027t guarantee the"},{"line_number":160,"context_line":"  security of the message bus, it\u0027s important that sensitive messages (like"},{"line_number":161,"context_line":"  those containing an TLS private key) are encrypted on the bus."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"* The nature of this message bus is asynchronous. Therefore, anything which"},{"line_number":164,"context_line":"  uses this bus to communicate must be written with this in mind."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_942ca095","line":161,"updated":"2014-08-06 00:18:51.000000000","message":"I think we need to define an implementation here.  Though things like TLS private keys should be handled the way barbican handles them.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":158,"context_line":"* As certain sensitive data (TLS private keys, for example) will be transmitted"},{"line_number":159,"context_line":"  over this communication infrastructure, and because we can\u0027t guarantee the"},{"line_number":160,"context_line":"  security of the message bus, it\u0027s important that sensitive messages (like"},{"line_number":161,"context_line":"  those containing an TLS private key) are encrypted on the bus."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"* The nature of this message bus is asynchronous. Therefore, anything which"},{"line_number":164,"context_line":"  uses this bus to communicate must be written with this in mind."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_0673e64f","line":161,"in_reply_to":"baada198_942ca095","updated":"2014-08-07 00:06:56.000000000","message":"So, Octavia will be using Barbican as its TLS key store. The point of the above verbage is that if we ever send sensitive data on the bus, we can\u0027t guarantee the security of the bus, so we need to take the extra step of encrypting the message payload. It\u0027s still unclear whether we will need to send sensitive data over the bus, so I figured we could cross the bridge of defining an encryption scheme when we get there. (Besides, this design document is already plenty lengthy!)\n\nDo you have a specific implementation in mind?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":163,"context_line":"* The nature of this message bus is asynchronous. Therefore, anything which"},{"line_number":164,"context_line":"  uses this bus to communicate must be written with this in mind."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"LB NETWORK"},{"line_number":167,"context_line":"----------"},{"line_number":168,"context_line":"This is the subnet that controllers will use to communicate with octavia VMs."},{"line_number":169,"context_line":"This means that controllers must have connectivity (either layer 2 or routed)"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_343cb4c0","line":166,"updated":"2014-08-06 00:18:51.000000000","message":"I liked it when you had management here to clarify it\u0027s role.  Maybe LB Mgmt Network?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":163,"context_line":"* The nature of this message bus is asynchronous. Therefore, anything which"},{"line_number":164,"context_line":"  uses this bus to communicate must be written with this in mind."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"LB NETWORK"},{"line_number":167,"context_line":"----------"},{"line_number":168,"context_line":"This is the subnet that controllers will use to communicate with octavia VMs."},{"line_number":169,"context_line":"This means that controllers must have connectivity (either layer 2 or routed)"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_e64fd2bd","line":166,"in_reply_to":"baada198_343cb4c0","updated":"2014-08-07 00:06:56.000000000","message":"The reason I changed the name is because \u0027management\u0027 network is misleading. In other environments, a management network can be assumed to be \"secure\" and therefore devices attached to it will often have fewer access controls when accessed from the management network. Management network connectivity often happens over a dedicated \u0027management\u0027 interface, which is often one with less bandwidth than the \u0027main\u0027 interface. Management networks are also often isolated and have no default gateway.\n\nNone of these things is true for the LB Network:\n* When using \u0027routed\u0027 connectivity for the front-end, then data will also get routed over this network.\n* Since this network becomes part of the data path:\n** It can\u0027t be assumed that anything happening on this network can necessarily be trusted.\n** The network interfaces must not be underpowered-- they\u0027re \"real\" production interfaces.\n** The LB network should usually not be isolated, and should have a default gateway.\n* For back-end connectivity to members without a subnet ID defined, the octavia VMs will probably attempt to get at these by talking out their primary network interface, which will probably be on the LB network (this is another factor which means the LB network is in the data path).","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":168,"context_line":"This is the subnet that controllers will use to communicate with octavia VMs."},{"line_number":169,"context_line":"This means that controllers must have connectivity (either layer 2 or routed)"},{"line_number":170,"context_line":"to this subnet in order to function, and visa versa. Since Octavia VMs will be"},{"line_number":171,"context_line":"communicating on it, this means the network is not part of the \"undercloud.\""},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"**Notes:**"},{"line_number":174,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_14a6d00f","line":171,"updated":"2014-08-06 00:18:51.000000000","message":"I would propose we specify this should be an IPv6 network to reduce issues with customer network addressing overlaps, etc.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":168,"context_line":"This is the subnet that controllers will use to communicate with octavia VMs."},{"line_number":169,"context_line":"This means that controllers must have connectivity (either layer 2 or routed)"},{"line_number":170,"context_line":"to this subnet in order to function, and visa versa. Since Octavia VMs will be"},{"line_number":171,"context_line":"communicating on it, this means the network is not part of the \"undercloud.\""},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"**Notes:**"},{"line_number":174,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_669102f7","line":171,"in_reply_to":"baada198_14a6d00f","updated":"2014-08-07 00:06:56.000000000","message":"That would be great if we could guarantee that all implementations are going to be on IPv6-ready networks, or heck, if Neutron even had functional IPv6 support.\n\nDon\u0027t get me wrong: I\u0027m a huge fan of IPv6 and we use it pretty much everywhere at Blue Box. But I know there are... \"less forward-thinking\" operations that have yet to implement IPv6 on their networks, and I think we need to be able to work with these for the forseeable future. :P","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":176,"context_line":"  over this communication infrastructure, all messages carrying a sensitive"},{"line_number":177,"context_line":"  payload should be done via encrypted and authenticated means. Further, we"},{"line_number":178,"context_line":"  recommend that messages to and from octavia VMs be signed regardless of the"},{"line_number":179,"context_line":"  sensitivity of their content."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"DISPATCHER"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_74b9cc15","line":179,"updated":"2014-08-06 00:18:51.000000000","message":"What is the protocol we will use for this communication?  I would propose a REST API.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":176,"context_line":"  over this communication infrastructure, all messages carrying a sensitive"},{"line_number":177,"context_line":"  payload should be done via encrypted and authenticated means. Further, we"},{"line_number":178,"context_line":"  recommend that messages to and from octavia VMs be signed regardless of the"},{"line_number":179,"context_line":"  sensitivity of their content."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"DISPATCHER"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_a34168a8","line":179,"in_reply_to":"baada198_74b9cc15","updated":"2014-08-06 05:05:00.000000000","message":"I think that should be operator specific. Some operators might choose to have their own messaging system fro Octavia with SSL certs, etc, Others might share a central messaging queue. Encrypting payload makes it difficult to debug so that should be optional.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":176,"context_line":"  over this communication infrastructure, all messages carrying a sensitive"},{"line_number":177,"context_line":"  payload should be done via encrypted and authenticated means. Further, we"},{"line_number":178,"context_line":"  recommend that messages to and from octavia VMs be signed regardless of the"},{"line_number":179,"context_line":"  sensitivity of their content."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"DISPATCHER"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_c908212a","line":179,"in_reply_to":"baada198_a34168a8","updated":"2014-08-07 00:06:56.000000000","message":"Well...  *not* encrypting the payload in some way violates the \"security is not an afterthought\" part of the project constitution / hacking guide. Perhaps we can make turning off encryption for sensitive payloads a debug-related configuration option, but by default we should be encrypting all these payloads.\n\nAlso German-- this is the communication infrastructure between Octavia VMs and their controllers, not between the rest of the Octavia components. I\u0027m strongly against using Oslo or a shared message bus at this layer. (In fact, when Alex from HP was in town a week or so ago, he was also adamant about this component specifically *not* being a rabbitmq-based message queue, as apparently y\u0027all have had major headaches with Libra because it uses a similar queue at this level.)\n\nAlso, I\u0027m all for using RESTful APIs for this communication, with the caveat that it\u0027s been suggested that some messages happen over UDP. We should have a wider discussion about this.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":194,"context_line":"  When a new dispatcher is started, it tries to discover other dispatchers via"},{"line_number":195,"context_line":"  a configured message queue. If it finds other dispatchers, these negotiate"},{"line_number":196,"context_line":"  who will be the \"active\" one in the group, and all dispatchers monitor each"},{"line_number":197,"context_line":"  other\u0027s health."},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"* The \"active\" dispatcher is the one that will respond to requests to the"},{"line_number":200,"context_line":"  dispatcher on the shared message bus. Other dispatcher(s) are \"standby\" and"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_d40538c2","line":197,"updated":"2014-08-06 00:18:51.000000000","message":"Since this is a stateful component and database backed, wouldn\u0027t it be easier to make this active-active now with something like LVS and not implement the health monitoring ourselves?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":194,"context_line":"  When a new dispatcher is started, it tries to discover other dispatchers via"},{"line_number":195,"context_line":"  a configured message queue. If it finds other dispatchers, these negotiate"},{"line_number":196,"context_line":"  who will be the \"active\" one in the group, and all dispatchers monitor each"},{"line_number":197,"context_line":"  other\u0027s health."},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"* The \"active\" dispatcher is the one that will respond to requests to the"},{"line_number":200,"context_line":"  dispatcher on the shared message bus. Other dispatcher(s) are \"standby\" and"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_693395c4","line":197,"in_reply_to":"baada198_d40538c2","updated":"2014-08-07 00:06:56.000000000","message":"So, LVS here imposes some restrictions on where the dispatcher can run that I\u0027m not sure we want to bake into the design.\n\nThe point of the health monitors, IMO, is mostly to complain loudly if ever the dispatchers go into a non-redundant state.\n\nAnd how would you recommend building an active-active configuration here which doesn\u0027t require all dispatcher daemons to parse all messages to all dispatchers on the queue?  (Keep in mind this is essentially the only major bottleneck in the design that we know about right now.)","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":225,"context_line":"  cache this loadbalancer-\u003econtroller association for a small amount of time to"},{"line_number":226,"context_line":"  reduce load on the dispatcher. (As both the driver and the controller will"},{"line_number":227,"context_line":"  occasionally need to access the dispatcher, we should create a shared library"},{"line_number":228,"context_line":"  to handle caching.)"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"* The dispatcher needs to be able to monitor controller availablilty and should"},{"line_number":231,"context_line":"  re-shuffle assigned loadbalancer instances to other controllers when a given"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_548da834","line":228,"updated":"2014-08-06 00:18:51.000000000","message":"We will need to talk more to cache management here if caching is needed.  What happens when a stale entry is pulled from the cache for a request and the controller no longer owns the Octavia VM?  Do we expect a high rate of requests for the same LB that the calling code would not cache on it\u0027s own?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":225,"context_line":"  cache this loadbalancer-\u003econtroller association for a small amount of time to"},{"line_number":226,"context_line":"  reduce load on the dispatcher. (As both the driver and the controller will"},{"line_number":227,"context_line":"  occasionally need to access the dispatcher, we should create a shared library"},{"line_number":228,"context_line":"  to handle caching.)"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"* The dispatcher needs to be able to monitor controller availablilty and should"},{"line_number":231,"context_line":"  re-shuffle assigned loadbalancer instances to other controllers when a given"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_a9b04dfe","line":228,"in_reply_to":"baada198_548da834","updated":"2014-08-07 00:06:56.000000000","message":"A stale entry should result in an error. We expect this to be a pretty rare occurrence, as state here should only be cached for a matter of a few seconds at most.\n\nAnd, well... we can\u0027t guarantee that the user API isn\u0027t going to do stupid / nasty things like hitting the same LB over an over in separate requests because the user API can be driven by poorly-written user code. The point here is that in a large cloud environment, we don\u0027t want a single user to effectively be able to DOS the system for everybody by overloading the dispatcher (intentionally or not).\n\nIn any case, though-- using a cache here might be premature optimization. We should hold off on implementing such a cache until it\u0027s apparent that it\u0027s needed. The reason for the above verbage was to show one possible solution to the problem, if the dispatcher ever becomes a bottleneck in the system. I mention this specifically because others have raised concerns that it might be-- so having some kind of plan to mitigate the problem was necessary to proof the design.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":230,"context_line":"* The dispatcher needs to be able to monitor controller availablilty and should"},{"line_number":231,"context_line":"  re-shuffle assigned loadbalancer instances to other controllers when a given"},{"line_number":232,"context_line":"  controller fails. It should also emit an alert when it detects such a"},{"line_number":233,"context_line":"  failure."},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"* The disatcher is not responsible for spinning up new controllers (processes"},{"line_number":236,"context_line":"  or instances). But it should complain if we pass a useage percentage"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_e3ee008a","line":233,"updated":"2014-08-06 05:05:00.000000000","message":"We need to pay special attention to that feature in case we have a network split and now doubled the controllers and their respective nodes -- in libra we have thresholds to not react if we loose the network connection to an entire az...","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":230,"context_line":"* The dispatcher needs to be able to monitor controller availablilty and should"},{"line_number":231,"context_line":"  re-shuffle assigned loadbalancer instances to other controllers when a given"},{"line_number":232,"context_line":"  controller fails. It should also emit an alert when it detects such a"},{"line_number":233,"context_line":"  failure."},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"* The disatcher is not responsible for spinning up new controllers (processes"},{"line_number":236,"context_line":"  or instances). But it should complain if we pass a useage percentage"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_898e2925","line":233,"in_reply_to":"baada198_e3ee008a","updated":"2014-08-07 00:06:56.000000000","message":"Aah, good point. I\u0027ll update the verbage here.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":240,"context_line":""},{"line_number":241,"context_line":"* The dispatcher needs to have intelligence about colocation of loadbalancers"},{"line_number":242,"context_line":"  in order to make sure colocated loadbalancers are all handled by the same"},{"line_number":243,"context_line":"  controller. (It doesn\u0027t need to care about apolocation of loadbalancers.)"},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"* If colocation constraints are added by the user after loadbalancers are"},{"line_number":246,"context_line":"  deployed, the dispatcher needs to have the ability to inform controllers to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_1436d051","line":243,"updated":"2014-08-06 00:18:51.000000000","message":"Hmm, can we say more here.  Is this talking to handling availability zones?  Does this mean the dispatcher needs to track the nova instance locations for the lbs?  Is there an advantage to this added this logic?  I suspect it is to reduce the distance of monitoring traffic, etc.\nWe should also probably make a statement about load balancers colocated with tenant instances.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":240,"context_line":""},{"line_number":241,"context_line":"* The dispatcher needs to have intelligence about colocation of loadbalancers"},{"line_number":242,"context_line":"  in order to make sure colocated loadbalancers are all handled by the same"},{"line_number":243,"context_line":"  controller. (It doesn\u0027t need to care about apolocation of loadbalancers.)"},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"* If colocation constraints are added by the user after loadbalancers are"},{"line_number":246,"context_line":"  deployed, the dispatcher needs to have the ability to inform controllers to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_141dccbf","line":243,"in_reply_to":"baada198_1436d051","updated":"2014-08-07 00:06:56.000000000","message":"So, just to clarify, by \"loadbalancer\" here we\u0027re talking about the object as defined for the Neutron LBaaS API (version 2). This isn\u0027t \"octavia VMs\" or anything like that.\n\nWe discussed the need for colocation / apolocation controls pretty extensively on the mailing list, though, admittedly, none of these have made it into the Neutron LBaaS API, so it might be a bit moot to bring it up here.\n\nThe reasons a user might have need to have load balancers colocated or apolocated are many (and are all usually \"business logic\" reasons having to do with redundancy, security, compliance, or something else), but oddly few of them have to do with where the octavia VMs actually doing the load balancing are located. Yes, if we\u0027re concerned about apolocation on physical hardware, then this is something that primarily the spares node controller needs to be concerned with, and potentially the dispatcher in the event of a re-balance event. So yes, keeping track of which nodes the octavia VMs are located on is important, but I don\u0027t think we have to do that ourselves because I\u0027m pretty sure we can get this info out of Nova (ie. Nova keeps track of it).\n\nI\u0027m not sure what you mean when you say \"we should probably make a statement about load balancer colocated with tenant instances.\"","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":255,"context_line":"and standby octavia VMs. Among the responsibilities the active-node controller"},{"line_number":256,"context_line":"has are:"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"* Generating configuration files for haproxy, stunnel, and PEM-formatted user"},{"line_number":259,"context_line":"  certificates and sending these to individual octavia VMs"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"* Keeping a queue of configuration updates that need to be applied to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_d41298b2","line":258,"updated":"2014-08-06 00:18:51.000000000","message":"With HAProxy 1.5 being released I think we should drop stunnel from this design.  By the time of this release haproxy with have about a year of cooking time.  One less component to manage and monitor.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":255,"context_line":"and standby octavia VMs. Among the responsibilities the active-node controller"},{"line_number":256,"context_line":"has are:"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"* Generating configuration files for haproxy, stunnel, and PEM-formatted user"},{"line_number":259,"context_line":"  certificates and sending these to individual octavia VMs"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"* Keeping a queue of configuration updates that need to be applied to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_9478fcf8","line":258,"in_reply_to":"baada198_d41298b2","updated":"2014-08-07 00:06:56.000000000","message":"Done","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10980,"name":"Doug Wiegley","email":"dougwig@parkside.io","username":"dougw"},"change_message_id":"fc387500622f20ae09cea9deddb53200a708ccf6","unresolved":false,"context_lines":[{"line_number":257,"context_line":""},{"line_number":258,"context_line":"* Generating configuration files for haproxy, stunnel, and PEM-formatted user"},{"line_number":259,"context_line":"  certificates and sending these to individual octavia VMs"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"* Keeping a queue of configuration updates that need to be applied to"},{"line_number":262,"context_line":"  individual octavia VMs."},{"line_number":263,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_15d4e649","line":260,"updated":"2014-08-06 20:38:12.000000000","message":"Suggest specifying this as jinja template files, similar to the current haproxy ref driver.  Also some method of loosely keeping the haproxy specific stuff in its own module/directory (config + vm specific nonsense.)","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"54621197fdfd8e49549e9cd50e0f41488419c04a","unresolved":false,"context_lines":[{"line_number":257,"context_line":""},{"line_number":258,"context_line":"* Generating configuration files for haproxy, stunnel, and PEM-formatted user"},{"line_number":259,"context_line":"  certificates and sending these to individual octavia VMs"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"* Keeping a queue of configuration updates that need to be applied to"},{"line_number":262,"context_line":"  individual octavia VMs."},{"line_number":263,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_d6efd11b","line":260,"in_reply_to":"baada198_15d4e649","updated":"2014-08-07 00:23:13.000000000","message":"Okeedokee! Updating verbage.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":259,"context_line":"  certificates and sending these to individual octavia VMs"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"* Keeping a queue of configuration updates that need to be applied to"},{"line_number":262,"context_line":"  individual octavia VMs."},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"* Informing each octavia VM when it has a non-empty queue."},{"line_number":265,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_b45b6488","line":262,"updated":"2014-08-06 00:18:51.000000000","message":"What is the advantage of this over having the configuration rendering centralized and simply pushing a complete new configuration to the Octavia VMs?\nThis implies persistent queues on the controllers.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":259,"context_line":"  certificates and sending these to individual octavia VMs"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"* Keeping a queue of configuration updates that need to be applied to"},{"line_number":262,"context_line":"  individual octavia VMs."},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"* Informing each octavia VM when it has a non-empty queue."},{"line_number":265,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_f4fdb83d","line":262,"in_reply_to":"baada198_039bf417","updated":"2014-08-07 00:06:56.000000000","message":"Aah--  so the idea here is that the queue is processed sequentially? That makes sense.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":259,"context_line":"  certificates and sending these to individual octavia VMs"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"* Keeping a queue of configuration updates that need to be applied to"},{"line_number":262,"context_line":"  individual octavia VMs."},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"* Informing each octavia VM when it has a non-empty queue."},{"line_number":265,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_039bf417","line":262,"in_reply_to":"baada198_b45b6488","updated":"2014-08-06 05:05:00.000000000","message":"I like to add that configuration updates should be fed into the oslo queue the controller is listening to -- so there shouldn\u0027t be any need for an internal queue.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":259,"context_line":"  certificates and sending these to individual octavia VMs"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"* Keeping a queue of configuration updates that need to be applied to"},{"line_number":262,"context_line":"  individual octavia VMs."},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"* Informing each octavia VM when it has a non-empty queue."},{"line_number":265,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_14d22ccf","line":262,"in_reply_to":"baada198_b45b6488","updated":"2014-08-07 00:06:56.000000000","message":"That was the plan actually. The point is that pushing out complete configuration changes is asynchronous and therefore can also see a back-log and needs a queue.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":262,"context_line":"  individual octavia VMs."},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"* Informing each octavia VM when it has a non-empty queue."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"* Interfacing with neutron networking to plumb additional interfaces on the"},{"line_number":267,"context_line":"  octavia VMs as necessary."},{"line_number":268,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_838e24d0","line":265,"updated":"2014-08-06 05:05:00.000000000","message":"Why would the VM\u0027s need to queue? The controller could send synchronous commands to the vms..","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":262,"context_line":"  individual octavia VMs."},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"* Informing each octavia VM when it has a non-empty queue."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"* Interfacing with neutron networking to plumb additional interfaces on the"},{"line_number":267,"context_line":"  octavia VMs as necessary."},{"line_number":268,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_0f3139ee","line":265,"in_reply_to":"baada198_838e24d0","updated":"2014-08-07 00:06:56.000000000","message":"There was a suggestion that in order to keep the communication path between the octavia VMs and their controllers simple, that only one side should be running a RESTful API (I think it was the controllers). Therefore, in order to know whether there were pending configuration changes, an octavia VM would periodically poll the controller for any such pending updates.\n\nNote that this kind of topology does reduce the number of TLS certificates we need to keep track of for controller \u003c-\u003e octavia VM communcation (ie. controllers have a \"server\" certificate and octavia VMs have a \"client\" certificate), but it does mean that configuration changes all happen asynchronously from the end user\u0027s perspective, and aren\u0027t instantaneous.\n\nTo be honest, I think having the ability to have more synchronous (or close to synchronous) commands outweighs the extra overhead of needing to keep track of both a client and server certificate for both the controller and each octavia VM.\n\nThen again...  I suppose it\u0027s possible to generate a certificate that can be used either as a client or server certificate (though I\u0027ve not tested this)...\n\nHmmm...  In any case, if we have communication that can be initiated from either the controller or the octavia VM, then it\u0027s not necessary to have a \"you have waiting updates\" command. I\u0027ll remove the verbage.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":266,"context_line":"* Interfacing with neutron networking to plumb additional interfaces on the"},{"line_number":267,"context_line":"  octavia VMs as necessary."},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"* Monitoring the health of active octavia VMs."},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"* Requesting \"clean up\" and redispatch for failed octavia VMs from the spare"},{"line_number":272,"context_line":"  node controller."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_f4e31c9e","line":269,"updated":"2014-08-06 00:18:51.000000000","message":"What network will this happen over?\nI would propose the management network.\nI would also like us to talk about using the monitoring URL capability in HAProxy to get a true proof-of-life out of the daemon.  Probably a UUID based path that the operator can specify.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":266,"context_line":"* Interfacing with neutron networking to plumb additional interfaces on the"},{"line_number":267,"context_line":"  octavia VMs as necessary."},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"* Monitoring the health of active octavia VMs."},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"* Requesting \"clean up\" and redispatch for failed octavia VMs from the spare"},{"line_number":272,"context_line":"  node controller."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_ef91659c","line":269,"in_reply_to":"baada198_f4e31c9e","updated":"2014-08-07 00:06:56.000000000","message":"This will happen over the LB network.\n\nPlease understand that octavia VMs will be running zero or more separate haproxy instances (each haproxy instance corresponding with a separate listener, and \"zero\" instances in the case of an octavia VM in the spares pool.) So we can\u0027t use haproxy\u0027s  monitoring URL here to determine the overall health of the load balancer.\n\nNow... each octavia VM should be monitoring every one of the haproxy instances it is running using the URL you\u0027ve described, and inform its controller if any of them have a problem. But that\u0027s separate from monitoring the overall health of the octavia VM itself.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":274,"context_line":"* Requesting new octavia VMs be deployed or migrated locally by the spare node"},{"line_number":275,"context_line":"  controller."},{"line_number":276,"context_line":""},{"line_number":277,"context_line":"* Migrating empty octavia VMs back to the spare node controller."},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"* Receiving and routing certain kinds of notifications originating on the"},{"line_number":280,"context_line":"  octavia VMs (ex. \"member down\")"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_03b21496","line":277,"updated":"2014-08-06 05:05:00.000000000","message":"I think the safest approach is to never recycle vms. There are some security concerns about left behind log data, etc. So easiest and safest is to just destroy them--","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":274,"context_line":"* Requesting new octavia VMs be deployed or migrated locally by the spare node"},{"line_number":275,"context_line":"  controller."},{"line_number":276,"context_line":""},{"line_number":277,"context_line":"* Migrating empty octavia VMs back to the spare node controller."},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"* Receiving and routing certain kinds of notifications originating on the"},{"line_number":280,"context_line":"  octavia VMs (ex. \"member down\")"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_0f73f94f","line":277,"in_reply_to":"baada198_03b21496","updated":"2014-08-07 00:06:56.000000000","message":"Yep, agreed! I\u0027m just saying that the active node controller doesn\u0027t actually destroy used VMs itself-- it should hand them back to the spares node controller, which is the the entity that manages all aspects of octavia VM lifecycle (including destruction).\n\nNote that I think this paradigm is important if we ever want Octavia to eventually support 3rd party load balancers--  dedicated load balancing hardware can\u0027t be  destroyed quite the same way after use every time. :)","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":297,"context_line":"  data about specific loadbalancers or sub-objects, their status, and"},{"line_number":298,"context_line":"  statistics."},{"line_number":299,"context_line":""},{"line_number":300,"context_line":"* Sending regular heartbeats to the dispatcher."},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"**Notes:**"},{"line_number":303,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_636f50fb","line":300,"updated":"2014-08-06 05:05:00.000000000","message":"This is likely the worng approach:\n1) The dispatcher might be overloaded missing a heartbeat\n2) If the dispatcher fails over the controller needs to know which new dispatcher to send the heartbeat to\n\nI therefore suggest that the dispatcher polls for heartbeat","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":297,"context_line":"  data about specific loadbalancers or sub-objects, their status, and"},{"line_number":298,"context_line":"  statistics."},{"line_number":299,"context_line":""},{"line_number":300,"context_line":"* Sending regular heartbeats to the dispatcher."},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"**Notes:**"},{"line_number":303,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_6fc39506","line":300,"in_reply_to":"baada198_636f50fb","updated":"2014-08-07 00:06:56.000000000","message":"The active dispatcher should be using a \"well known address\" (or queue, in this case), so any failover of dispatchers that might happen should take over this same address.\n\nThe idea behind push notifications is that you have one-way communications going on. The dispatcher doesn\u0027t need to acknowledge that it got the heartbeat, it just has to have some way to process the heartbeat and discover if one has been missing for too long (and something similar would also be necessary with poll-based heartbeats).\n\nWith poll-based heartbeats, the dispatcher needs a way to (in parallel) send a message to each controller, and then wait for a response for a given period before deciding that a non-responsive controller is down. This means that two messages need to be sent for each heartbeat (the request and the response). This is actually more work than receiving heartbeats and then periodically scanning the list to see what\u0027s been missing for too long.\n\nHaving said this, if others think we should go with poll-based heartbeats, I\u0027m not so married to the idea of push-based heartbeats that I\u0027m not willing to change my stance on this. ;)","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":304,"context_line":"* Almost all the intelligence around putting together and validating"},{"line_number":305,"context_line":"  loadbalancer configurations will live here-- the octavia VM API is meant to"},{"line_number":306,"context_line":"  be as simple as possible so that minor feature improvements do not"},{"line_number":307,"context_line":"  necessarily entail pushing out new octavia VMs across an entire installation."},{"line_number":308,"context_line":""},{"line_number":309,"context_line":"SPARE-NODE CONTROLLER"},{"line_number":310,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_43596c5b","line":307,"updated":"2014-08-06 05:05:00.000000000","message":"Stephen knows I disagree here and prefer to hide the implementation detail of haproxy behind some interface and not just ship configuration files around... but I am happy to follow the majority.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"54621197fdfd8e49549e9cd50e0f41488419c04a","unresolved":false,"context_lines":[{"line_number":304,"context_line":"* Almost all the intelligence around putting together and validating"},{"line_number":305,"context_line":"  loadbalancer configurations will live here-- the octavia VM API is meant to"},{"line_number":306,"context_line":"  be as simple as possible so that minor feature improvements do not"},{"line_number":307,"context_line":"  necessarily entail pushing out new octavia VMs across an entire installation."},{"line_number":308,"context_line":""},{"line_number":309,"context_line":"SPARE-NODE CONTROLLER"},{"line_number":310,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_f6405508","line":307,"in_reply_to":"baada198_43596c5b","updated":"2014-08-07 00:23:13.000000000","message":"Well, the interface would be a jinja template on the controller. But I feel pretty strongly that this is a \"centralize intelligence\" kind of issue. Octavia VMs should be as dumb as possible, so the ability to generate their own haproxy configurations is something I *don\u0027t* want them to have to do.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":321,"context_line":"* Maintaining a pool of spare octavia VMs (ie. spawning new ones as necessary"},{"line_number":322,"context_line":"  and deleting ones from the pool when we have too much inventory here.)"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"* Receiving and processing requests to migrate services VMs to other"},{"line_number":325,"context_line":"  controllers."},{"line_number":326,"context_line":""},{"line_number":327,"context_line":"* Gracefully spinning down \"dirty old octavia VMs\""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_14a09041","line":324,"updated":"2014-08-06 00:18:51.000000000","message":"Does \"services VMs\" \u003d\u003d \"Octavia VMs\"?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":321,"context_line":"* Maintaining a pool of spare octavia VMs (ie. spawning new ones as necessary"},{"line_number":322,"context_line":"  and deleting ones from the pool when we have too much inventory here.)"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"* Receiving and processing requests to migrate services VMs to other"},{"line_number":325,"context_line":"  controllers."},{"line_number":326,"context_line":""},{"line_number":327,"context_line":"* Gracefully spinning down \"dirty old octavia VMs\""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_cfe741aa","line":324,"in_reply_to":"baada198_14a09041","updated":"2014-08-07 00:06:56.000000000","message":"Yep. Fixed!","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":326,"context_line":""},{"line_number":327,"context_line":"* Gracefully spinning down \"dirty old octavia VMs\""},{"line_number":328,"context_line":""},{"line_number":329,"context_line":"* Sending regular heartbeats to the dispatcher."},{"line_number":330,"context_line":""},{"line_number":331,"context_line":"**Notes:**"},{"line_number":332,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_c32c9cb5","line":329,"updated":"2014-08-06 05:05:00.000000000","message":"Again prefers when the dispatcher pulls","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":326,"context_line":""},{"line_number":327,"context_line":"* Gracefully spinning down \"dirty old octavia VMs\""},{"line_number":328,"context_line":""},{"line_number":329,"context_line":"* Sending regular heartbeats to the dispatcher."},{"line_number":330,"context_line":""},{"line_number":331,"context_line":"**Notes:**"},{"line_number":332,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_effde53d","line":329,"in_reply_to":"baada198_c32c9cb5","updated":"2014-08-07 00:06:56.000000000","message":"See response above.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":331,"context_line":"**Notes:**"},{"line_number":332,"context_line":""},{"line_number":333,"context_line":"* The size of the spare octavia VM pool should be determined by the flavor"},{"line_number":334,"context_line":"  being offered."},{"line_number":335,"context_line":""},{"line_number":336,"context_line":"* The spares pool controller also handles spinning up octavia VMs in the case"},{"line_number":337,"context_line":"  of a true active/standby topology (ie. where the spares pool is effectively"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_233c78e1","line":334,"updated":"2014-08-06 05:05:00.000000000","message":"I think it should be determined by operational constraints. A popular region might need more spare nodes to meet demand than an unpopular one...","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":331,"context_line":"**Notes:**"},{"line_number":332,"context_line":""},{"line_number":333,"context_line":"* The size of the spare octavia VM pool should be determined by the flavor"},{"line_number":334,"context_line":"  being offered."},{"line_number":335,"context_line":""},{"line_number":336,"context_line":"* The spares pool controller also handles spinning up octavia VMs in the case"},{"line_number":337,"context_line":"  of a true active/standby topology (ie. where the spares pool is effectively"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_275f0112","line":334,"in_reply_to":"baada198_233c78e1","updated":"2014-08-07 00:06:56.000000000","message":"Yep. I\u0027m not sure \u0027flavor\u0027 is the right place to do this (after all, what does the spare node controller know about the \"flavor\"?) How specifically would you recommend configuring this?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":340,"context_line":""},{"line_number":341,"context_line":"* It also handles spinning up new octavia VMs when one fails in the above"},{"line_number":342,"context_line":"  topology. Since it doesn\u0027t monitor these directly, it will be up to the"},{"line_number":343,"context_line":"  active node controller to inform the spares controller this is necessary."},{"line_number":344,"context_line":""},{"line_number":345,"context_line":"* Since spinning up a new octavia VM is a task that can take a long time, the"},{"line_number":346,"context_line":"  spares node controller should spawn a job or child process which handles"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_747c6cb7","line":343,"updated":"2014-08-06 00:18:51.000000000","message":"Should this have a concept of availability zones/colocation as discussed above?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":340,"context_line":""},{"line_number":341,"context_line":"* It also handles spinning up new octavia VMs when one fails in the above"},{"line_number":342,"context_line":"  topology. Since it doesn\u0027t monitor these directly, it will be up to the"},{"line_number":343,"context_line":"  active node controller to inform the spares controller this is necessary."},{"line_number":344,"context_line":""},{"line_number":345,"context_line":"* Since spinning up a new octavia VM is a task that can take a long time, the"},{"line_number":346,"context_line":"  spares node controller should spawn a job or child process which handles"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_6787395c","line":343,"in_reply_to":"baada198_747c6cb7","updated":"2014-08-07 00:06:56.000000000","message":"That\u0027s not a bad idea. I\u0027m a but fuzzy on what the specific AZ requirements might be, because I understand that different operators use AZ to represent different things. (At RAX, for example, I understand a single AZ is a single building. But at HP a single building might contain several AZs-- and the AZ might be split across several buildings.)  So... before we bake knowledge around AZs into the design, it would be good to get more specific operator requirements around this.\n\nAt Blue Box, we\u0027ve not needed to deal with AZs as much because we\u0027re dealing exclusively with private clouds, which tend to be small enough to fit within one AZ. In our legacy product, we use something akin to what RAX is doing, where a single datacenter is a single AZ.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":348,"context_line":""},{"line_number":349,"context_line":"* This is a stateful service, and should keep its state in a central, highly"},{"line_number":350,"context_line":"  available database of some sort (as node controllers can fail.)"},{"line_number":351,"context_line":""},{"line_number":352,"context_line":"OCTAVIA VM"},{"line_number":353,"context_line":"----------"},{"line_number":354,"context_line":"This is a Nova VM which actually provides the load balancing services as"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_1445f06e","line":351,"updated":"2014-08-06 00:18:51.000000000","message":"This might be a good place to monitor the Octavia VM tenant quota levels.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":348,"context_line":""},{"line_number":349,"context_line":"* This is a stateful service, and should keep its state in a central, highly"},{"line_number":350,"context_line":"  available database of some sort (as node controllers can fail.)"},{"line_number":351,"context_line":""},{"line_number":352,"context_line":"OCTAVIA VM"},{"line_number":353,"context_line":"----------"},{"line_number":354,"context_line":"This is a Nova VM which actually provides the load balancing services as"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_87cc4dc0","line":351,"in_reply_to":"baada198_1445f06e","updated":"2014-08-07 00:06:56.000000000","message":"Er... wouldn\u0027t tenant quotas be handled in the user API? Or are you thinking of putting quotas on things like number of requests, bandwidth, or stuff like that?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":357,"context_line":"* Actually accomplishing the load balancing services for user-configured"},{"line_number":358,"context_line":"  loadbalancers using haproxy."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":"* Sending regular heartbeats (which should include some status information)."},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"* Responding to notifications about pending configuration tasks (ie."},{"line_number":363,"context_line":"  transactionally downloading tasks from the queue on the controller, running"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_541da876","line":360,"updated":"2014-08-06 00:18:51.000000000","message":"What component would be looking for missing heartbeats?  Wouldn\u0027t it be better to have this polled?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":357,"context_line":"* Actually accomplishing the load balancing services for user-configured"},{"line_number":358,"context_line":"  loadbalancers using haproxy."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":"* Sending regular heartbeats (which should include some status information)."},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"* Responding to notifications about pending configuration tasks (ie."},{"line_number":363,"context_line":"  transactionally downloading tasks from the queue on the controller, running"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_47ba350c","line":360,"in_reply_to":"baada198_541da876","updated":"2014-08-07 00:06:56.000000000","message":"Either the spare node controller or the active node controller currently in charge of the given octavia VM. (Which means that, yes, the octavia VM needs to know who its controller is.) See my discussion above about push- vs. poll-based heartbeats.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":361,"context_line":""},{"line_number":362,"context_line":"* Responding to notifications about pending configuration tasks (ie."},{"line_number":363,"context_line":"  transactionally downloading tasks from the queue on the controller, running"},{"line_number":364,"context_line":"  them, and reporting results)."},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"* Responding to specific requests from the controller for very basic"},{"line_number":367,"context_line":"  loadbalancer or sub-object status data, including statistics."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_6304b019","line":364,"updated":"2014-08-06 05:05:00.000000000","message":"Not a big fan of the queue :-)","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":361,"context_line":""},{"line_number":362,"context_line":"* Responding to notifications about pending configuration tasks (ie."},{"line_number":363,"context_line":"  transactionally downloading tasks from the queue on the controller, running"},{"line_number":364,"context_line":"  them, and reporting results)."},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"* Responding to specific requests from the controller for very basic"},{"line_number":367,"context_line":"  loadbalancer or sub-object status data, including statistics."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_c73d6590","line":364,"in_reply_to":"baada198_6304b019","updated":"2014-08-07 00:06:56.000000000","message":"Yeah, I think being able to initiate communication from either end means the queue is unnecessary. So I\u0027ll remove this.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":364,"context_line":"  them, and reporting results)."},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"* Responding to specific requests from the controller for very basic"},{"line_number":367,"context_line":"  loadbalancer or sub-object status data, including statistics."},{"line_number":368,"context_line":""},{"line_number":369,"context_line":"* Shipping listener logs to a swift data store, if configured."},{"line_number":370,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_d7fffafe","line":367,"updated":"2014-08-06 00:18:51.000000000","message":"Does this include billing?  Is that a role that the controller will have?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":364,"context_line":"  them, and reporting results)."},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"* Responding to specific requests from the controller for very basic"},{"line_number":367,"context_line":"  loadbalancer or sub-object status data, including statistics."},{"line_number":368,"context_line":""},{"line_number":369,"context_line":"* Shipping listener logs to a swift data store, if configured."},{"line_number":370,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_a75dd1ed","line":367,"in_reply_to":"baada198_d7fffafe","updated":"2014-08-07 00:06:56.000000000","message":"It will probably include billing unless there are specific ways of logging billing data that the octavia VM won\u0027t have access to. We actually have yet to flesh out how billing should work at all, and really need a bigger discussion about this.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":366,"context_line":"* Responding to specific requests from the controller for very basic"},{"line_number":367,"context_line":"  loadbalancer or sub-object status data, including statistics."},{"line_number":368,"context_line":""},{"line_number":369,"context_line":"* Shipping listener logs to a swift data store, if configured."},{"line_number":370,"context_line":""},{"line_number":371,"context_line":"* Sending \"edge\" notifications (ie. status changes) to the controller when"},{"line_number":372,"context_line":"  members go up and down, when listeners go up and down, etc."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_176fb2c5","line":369,"updated":"2014-08-06 00:18:51.000000000","message":"Should we define a log message format here?\nWhat mechanism will collect and send these?\nOver what network?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":366,"context_line":"* Responding to specific requests from the controller for very basic"},{"line_number":367,"context_line":"  loadbalancer or sub-object status data, including statistics."},{"line_number":368,"context_line":""},{"line_number":369,"context_line":"* Shipping listener logs to a swift data store, if configured."},{"line_number":370,"context_line":""},{"line_number":371,"context_line":"* Sending \"edge\" notifications (ie. status changes) to the controller when"},{"line_number":372,"context_line":"  members go up and down, when listeners go up and down, etc."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_db69bcf9","line":369,"in_reply_to":"baada198_176fb2c5","updated":"2014-08-07 00:06:56.000000000","message":"Also something that\u0027s not fleshed out just yet. I don\u0027t think we necessarily want to bake the log format into the design. :/ And collection and sending can be worked out when we build the Octavia VM image. (At Blue Box, haproxy passes its logs to syslog-ng, and from there there are a variety of ways to store them, pass them off in real time, or periodically dump logs to any external destination.) I\u0027m also not sure it\u0027s worthwhile to pursue the specifics of this at this point.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":384,"context_line":"* Since octavia VMs speak to controllers in a \"trusted\" way, it\u0027s important to"},{"line_number":385,"context_line":"  ensure that users do not have command-line access to the octavia VMs. In"},{"line_number":386,"context_line":"  other words, the octavia VMs should be a black box from the users\u0027"},{"line_number":387,"context_line":"  perspective."},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"* Octavia VMs will be powered using haproxy and stunnel initially. May decide"},{"line_number":390,"context_line":"  to use other software (especially for SSL termination) later on."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_578e8a7b","line":387,"updated":"2014-08-06 00:18:51.000000000","message":"Does this mean per-VM certificates?\nDoes the VM need to talk to the controller or is controller-\u003evm enough?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":384,"context_line":"* Since octavia VMs speak to controllers in a \"trusted\" way, it\u0027s important to"},{"line_number":385,"context_line":"  ensure that users do not have command-line access to the octavia VMs. In"},{"line_number":386,"context_line":"  other words, the octavia VMs should be a black box from the users\u0027"},{"line_number":387,"context_line":"  perspective."},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"* Octavia VMs will be powered using haproxy and stunnel initially. May decide"},{"line_number":390,"context_line":"  to use other software (especially for SSL termination) later on."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_1b5a5451","line":387,"in_reply_to":"baada198_578e8a7b","updated":"2014-08-07 00:06:56.000000000","message":"Yes, and based on previous discussion, I would think having the ability to initiate communication from either side is a good idea (meaning certificates should be valid both for the server and client role). It would be great if Barbican had the ability to serve the full PKI functionality here; Not sure it will be the time we need it to, eh.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"a784854ddbfc1dba709849d1fc24b398649275bc","unresolved":false,"context_lines":[{"line_number":387,"context_line":"  perspective."},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"* Octavia VMs will be powered using haproxy and stunnel initially. May decide"},{"line_number":390,"context_line":"  to use other software (especially for SSL termination) later on."},{"line_number":391,"context_line":""},{"line_number":392,"context_line":"* The \"glue scripts\" which communicate with the controller should be as"},{"line_number":393,"context_line":"  lightweight as possible: Intelligence about how to put together an haproxy"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_88fe43ae","line":390,"updated":"2014-08-06 02:57:26.000000000","message":"Since haproxy 1.5 is out do we still need stunnel?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"8606e526b8cc7fd52bbe7a8fb9f51df6b6d47ee8","unresolved":false,"context_lines":[{"line_number":387,"context_line":"  perspective."},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"* Octavia VMs will be powered using haproxy and stunnel initially. May decide"},{"line_number":390,"context_line":"  to use other software (especially for SSL termination) later on."},{"line_number":391,"context_line":""},{"line_number":392,"context_line":"* The \"glue scripts\" which communicate with the controller should be as"},{"line_number":393,"context_line":"  lightweight as possible: Intelligence about how to put together an haproxy"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_c034764b","line":390,"in_reply_to":"baada198_88fe43ae","updated":"2014-08-06 17:29:03.000000000","message":"+1","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":387,"context_line":"  perspective."},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"* Octavia VMs will be powered using haproxy and stunnel initially. May decide"},{"line_number":390,"context_line":"  to use other software (especially for SSL termination) later on."},{"line_number":391,"context_line":""},{"line_number":392,"context_line":"* The \"glue scripts\" which communicate with the controller should be as"},{"line_number":393,"context_line":"  lightweight as possible: Intelligence about how to put together an haproxy"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_3b55581f","line":390,"in_reply_to":"baada198_88fe43ae","updated":"2014-08-07 00:06:56.000000000","message":"Fixed.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":392,"context_line":"* The \"glue scripts\" which communicate with the controller should be as"},{"line_number":393,"context_line":"  lightweight as possible: Intelligence about how to put together an haproxy"},{"line_number":394,"context_line":"  config, for example, should not live on the octavia VM. Rather, the octavia"},{"line_number":395,"context_line":"  VM should perform simple syntax checks"},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"* With few exceptions, most of the API commands the octavia VM will ever do"},{"line_number":398,"context_line":"  should be safely handled synchronously (ie. nothing should take longer than a"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_f7c5de90","line":395,"updated":"2014-08-06 00:18:51.000000000","message":"Should we also configure the Octavia VM\u0027s iptables rules?  I think we should to tune for the topologies, management network, etc.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":392,"context_line":"* The \"glue scripts\" which communicate with the controller should be as"},{"line_number":393,"context_line":"  lightweight as possible: Intelligence about how to put together an haproxy"},{"line_number":394,"context_line":"  config, for example, should not live on the octavia VM. Rather, the octavia"},{"line_number":395,"context_line":"  VM should perform simple syntax checks"},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"* With few exceptions, most of the API commands the octavia VM will ever do"},{"line_number":398,"context_line":"  should be safely handled synchronously (ie. nothing should take longer than a"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_fb3a00e5","line":395,"in_reply_to":"baada198_f7c5de90","updated":"2014-08-07 00:06:56.000000000","message":"So, Octavia VMs should only be listening on their API interface, and any configured service interfaces.\n\nI\u0027d rather ensure there are no extra listening services rather than have to manage firewall rules. :/ Though if others disagree, we can certainly go down that path.\n\nThough, full disclosure: The way we do this at Blue Box, we do use iptables rules for traffic accounting purposes. This is actually a pretty good solution which doesn\u0027t rely on haproxy directly to provide this data (ie. data doesn\u0027t get reset when haproxy restarts.)","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10980,"name":"Doug Wiegley","email":"dougwig@parkside.io","username":"dougw"},"change_message_id":"fc387500622f20ae09cea9deddb53200a708ccf6","unresolved":false,"context_lines":[{"line_number":393,"context_line":"  lightweight as possible: Intelligence about how to put together an haproxy"},{"line_number":394,"context_line":"  config, for example, should not live on the octavia VM. Rather, the octavia"},{"line_number":395,"context_line":"  VM should perform simple syntax checks"},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"* With few exceptions, most of the API commands the octavia VM will ever do"},{"line_number":398,"context_line":"  should be safely handled synchronously (ie. nothing should take longer than a"},{"line_number":399,"context_line":"  second or two to complete)."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_95cf16b2","line":396,"updated":"2014-08-06 20:38:12.000000000","message":"Can we just specify cloud-init hooks as the interface?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"54621197fdfd8e49549e9cd50e0f41488419c04a","unresolved":false,"context_lines":[{"line_number":393,"context_line":"  lightweight as possible: Intelligence about how to put together an haproxy"},{"line_number":394,"context_line":"  config, for example, should not live on the octavia VM. Rather, the octavia"},{"line_number":395,"context_line":"  VM should perform simple syntax checks"},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"* With few exceptions, most of the API commands the octavia VM will ever do"},{"line_number":398,"context_line":"  should be safely handled synchronously (ie. nothing should take longer than a"},{"line_number":399,"context_line":"  second or two to complete)."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_f65775c7","line":396,"in_reply_to":"baada198_95cf16b2","updated":"2014-08-07 00:23:13.000000000","message":"I\u0027m afraid I don\u0027t follow. How are cloud-init hooks supposed to update an haproxy configuration file on an already-running octavia VM? (Sorry, if the cloud-init hooks are capable of doing this, then chalk this up to my ignorance, but please also explain how it would be done.)","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":403,"context_line":"  ever service is going to consume that data. (for example, if logs are being"},{"line_number":404,"context_line":"  shunted off to swift on a nightly basis, the octavia VM should handle this"},{"line_number":405,"context_line":"  directly and not go through the controller.)"},{"line_number":406,"context_line":""},{"line_number":407,"context_line":"INTERNAL HEALTH MONITORS"},{"line_number":408,"context_line":"------------------------"},{"line_number":409,"context_line":"There are actually a few of these, all of which need to be driven by some"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_1742520f","line":406,"updated":"2014-08-06 00:18:51.000000000","message":"What about internal logs for the operator?  Should we discuss how things like security logs from the Octavia VMs is collected?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":403,"context_line":"  ever service is going to consume that data. (for example, if logs are being"},{"line_number":404,"context_line":"  shunted off to swift on a nightly basis, the octavia VM should handle this"},{"line_number":405,"context_line":"  directly and not go through the controller.)"},{"line_number":406,"context_line":""},{"line_number":407,"context_line":"INTERNAL HEALTH MONITORS"},{"line_number":408,"context_line":"------------------------"},{"line_number":409,"context_line":"There are actually a few of these, all of which need to be driven by some"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_1b08942d","line":406,"in_reply_to":"baada198_1742520f","updated":"2014-08-07 00:06:56.000000000","message":"That\u0027s not a bad idea, though with Octavia VMs essentially being cattle that will be spawned and killed with some frequency, it does make me wonder how useful said logs would be. What do others think?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":425,"context_line":"  availability and overall health of octavia VMs they control. For active node"},{"line_number":426,"context_line":"  octavia VMs, this check should happen pretty quickly: About once every 5"},{"line_number":427,"context_line":"  seconds. For spare node octavia VMs, the check can happen much more"},{"line_number":428,"context_line":"  infrequently (say, once every 10 minutes)."},{"line_number":429,"context_line":""},{"line_number":430,"context_line":"The idea here is that internal health monitors will monitor a periodic"},{"line_number":431,"context_line":"heartbeat coming from the octavia VMs or Controller daemons, and take"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_57f12add","line":428,"updated":"2014-08-06 00:18:51.000000000","message":"We should be specific about what we are checking.  I think we should be checking the agent API and the HAProxy monitoring URL for each Octavia VM.  Maybe at different rates, maybe with local monitoring code that polls more often and does something like kill the agent api to force a failover.\nAlso, ten minutes for the spares pool monitoring seems too long.  We check spare VMs every minute.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":425,"context_line":"  availability and overall health of octavia VMs they control. For active node"},{"line_number":426,"context_line":"  octavia VMs, this check should happen pretty quickly: About once every 5"},{"line_number":427,"context_line":"  seconds. For spare node octavia VMs, the check can happen much more"},{"line_number":428,"context_line":"  infrequently (say, once every 10 minutes)."},{"line_number":429,"context_line":""},{"line_number":430,"context_line":"The idea here is that internal health monitors will monitor a periodic"},{"line_number":431,"context_line":"heartbeat coming from the octavia VMs or Controller daemons, and take"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_360acd1e","line":428,"in_reply_to":"baada198_57f12add","updated":"2014-08-07 00:06:56.000000000","message":"See my above comments about using haproxy\u0027s monitoring URL(s). And yes, once every 10 minutes vs. once per minute is pretty immaterial to me. Updating verbage.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":441,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":442,"context_line":"In order to keep things as scalable as possible, the thought was that short,"},{"line_number":443,"context_line":"periodic and arguably less vital messages being emitted by the octavia VM and"},{"line_number":444,"context_line":"associated controller would be done via HMAC-signed UDP, and more vital, more"},{"line_number":445,"context_line":"sensitive, and potentially longer transactional messages would be handled via a"},{"line_number":446,"context_line":"RESTful API on the controller, accessed via bi-directionally authenticated"},{"line_number":447,"context_line":"HTTPS."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_1727b264","line":444,"updated":"2014-08-06 00:18:51.000000000","message":"Why a custom UDP protocol.  Why can\u0027t we use a REST api for the whole thing?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":441,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":442,"context_line":"In order to keep things as scalable as possible, the thought was that short,"},{"line_number":443,"context_line":"periodic and arguably less vital messages being emitted by the octavia VM and"},{"line_number":444,"context_line":"associated controller would be done via HMAC-signed UDP, and more vital, more"},{"line_number":445,"context_line":"sensitive, and potentially longer transactional messages would be handled via a"},{"line_number":446,"context_line":"RESTful API on the controller, accessed via bi-directionally authenticated"},{"line_number":447,"context_line":"HTTPS."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_3631edee","line":444,"in_reply_to":"baada198_1727b264","updated":"2014-08-07 00:06:56.000000000","message":"The idea was that it would be much lighter weight to use a signed UDP packet for non-sensitive frequently updating data. (Hitting a REST api entails that 7-part TLS handshake since we\u0027re doing bi-directional certificate verification for such connections.)\n\nNote that I\u0027m not married to the idea of using UDP here. If others would rather use a REST API for all of these kinds of communications, I\u0027m fine with that, eh.","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"2b69affc278caaa29542fc50947cfb205c9dce66","unresolved":false,"context_lines":[{"line_number":447,"context_line":"HTTPS."},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"Specifically, we should expect the following to happen over UDP:"},{"line_number":450,"context_line":"* heartbeats from the octavia VM to the controller"},{"line_number":451,"context_line":""},{"line_number":452,"context_line":"* stats data from the octavia VM to the controller"},{"line_number":453,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_0eef9b1e","line":450,"updated":"2014-08-06 05:05:00.000000000","message":"As long as it isn\u0027t multicast...","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":447,"context_line":"HTTPS."},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"Specifically, we should expect the following to happen over UDP:"},{"line_number":450,"context_line":"* heartbeats from the octavia VM to the controller"},{"line_number":451,"context_line":""},{"line_number":452,"context_line":"* stats data from the octavia VM to the controller"},{"line_number":453,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_9649d968","line":450,"in_reply_to":"baada198_0eef9b1e","updated":"2014-08-07 00:06:56.000000000","message":"Haha! Yeah, no multicast in this design. XD","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"75f266e4fb15e4ccb4e9fb3111df675d099f33ef","unresolved":false,"context_lines":[{"line_number":457,"context_line":"* Notification of pending tasks in queue from controller to octavia VM"},{"line_number":458,"context_line":""},{"line_number":459,"context_line":"And the following would happen over TCP:"},{"line_number":460,"context_line":"* haproxy / stunnel / tls certificate configuration changes"},{"line_number":461,"context_line":""},{"line_number":462,"context_line":"* octavia VM migrations to a new controller"},{"line_number":463,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_77154ee5","line":460,"updated":"2014-08-06 00:18:51.000000000","message":"We need to discuss TLS certificate configuration change workflows.\nShould this be in the document or should TLS be seperate?","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"d3d23d2bde307d5333ba110b0ac2f5d2ce82ba1c","unresolved":false,"context_lines":[{"line_number":457,"context_line":"* Notification of pending tasks in queue from controller to octavia VM"},{"line_number":458,"context_line":""},{"line_number":459,"context_line":"And the following would happen over TCP:"},{"line_number":460,"context_line":"* haproxy / stunnel / tls certificate configuration changes"},{"line_number":461,"context_line":""},{"line_number":462,"context_line":"* octavia VM migrations to a new controller"},{"line_number":463,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_9670f9a8","line":460,"in_reply_to":"baada198_77154ee5","updated":"2014-08-07 00:06:56.000000000","message":"Really? How would updating a TLS certificate significantly differ from updating an haproxy configuration?  (The controller just sends the new file to the Octavia VM, and the latter restarts haproxy using the new certificate, right?)\n\nNote that this document is not meant to be the place for specific API command discussion-- that document will come later. :)","commit_id":"cdcb6a1d5c132f520f722cdcdf8bd65e6446a360"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":12,"context_line":"LBaaS project, with which Octavia interfaces to deliver load balancing"},{"line_number":13,"context_line":"services."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"USER API HANDLER"},{"line_number":16,"context_line":"----------------"},{"line_number":17,"context_line":"This is the front-end that users (and user GUIs or what have you) talk to to"},{"line_number":18,"context_line":"manipulate load balancing services."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_594c7b9d","line":15,"updated":"2014-08-09 21:01:32.000000000","message":"I just want to be clear.  The User API and Operator API are what Neutron LBaaS is currently correct (even though there isn\u0027t an Operator API yet)","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":12,"context_line":"LBaaS project, with which Octavia interfaces to deliver load balancing"},{"line_number":13,"context_line":"services."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"USER API HANDLER"},{"line_number":16,"context_line":"----------------"},{"line_number":17,"context_line":"This is the front-end that users (and user GUIs or what have you) talk to to"},{"line_number":18,"context_line":"manipulate load balancing services."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_5dedbdc2","line":15,"in_reply_to":"baada198_594c7b9d","updated":"2014-08-14 23:06:23.000000000","message":"So, this is evolving now based on goings on in Neutron, but yes, at the time of this writing the User API is essentially handled by Neutron LBaaS, though it look like the operator API is probably going to be controlled by Octavia directly.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":15,"context_line":"USER API HANDLER"},{"line_number":16,"context_line":"----------------"},{"line_number":17,"context_line":"This is the front-end that users (and user GUIs or what have you) talk to to"},{"line_number":18,"context_line":"manipulate load balancing services."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"**Notes:**"},{"line_number":21,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_5072aa4a","line":18,"updated":"2015-06-03 00:12:14.000000000","message":"We should talk about the frontend Neutron LBaaS v2 as it relates to the operator API here.  Another words, update it for the current design","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":70,"context_line":"  configure services this way. There will probably only be \"fatal\" errors in"},{"line_number":71,"context_line":"  this case."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* It may make sense to (eventually) combine the actual daemon (or CGI script or"},{"line_number":74,"context_line":"  whatever) that handles the operator API with the one that handles the user"},{"line_number":75,"context_line":"  API."},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_b0267ecc","line":73,"updated":"2015-06-03 00:12:14.000000000","message":"CGI No","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":103,"context_line":"* Driver will be loaded by the daemon that does the user API and operator API."},{"line_number":104,"context_line":"  It is not, in and of itself, its own daemon, though a given vendor\u0027s back-end"},{"line_number":105,"context_line":"  may contain its own daemons or other services that the driver interfaces"},{"line_number":106,"context_line":"  with."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"* It is thought that the driver front-end should be stateless in order to make"},{"line_number":109,"context_line":"  it horizontally scalable and to preserves the statelessness of the user and"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_392ee7ab","line":106,"updated":"2014-08-09 21:01:32.000000000","message":"If we\u0027re talking about the Neutron LBaaS as the daemon, then I can see in a future improvement how this might become inaccurate.  However, if we\u0027re not talking about neutron lbaas I will shutup.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":103,"context_line":"* Driver will be loaded by the daemon that does the user API and operator API."},{"line_number":104,"context_line":"  It is not, in and of itself, its own daemon, though a given vendor\u0027s back-end"},{"line_number":105,"context_line":"  may contain its own daemons or other services that the driver interfaces"},{"line_number":106,"context_line":"  with."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"* It is thought that the driver front-end should be stateless in order to make"},{"line_number":109,"context_line":"  it horizontally scalable and to preserves the statelessness of the user and"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_7df8b97c","line":106,"in_reply_to":"baada198_392ee7ab","updated":"2014-08-14 23:06:23.000000000","message":"Will be clarified and carried forward in the v0.5 component design (since this aspect shouldn\u0027t change.)","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":113,"context_line":"* It is also possible for multiple instances of the driver will talk to the"},{"line_number":114,"context_line":"  same Octavia VM at the same time. Emphasis on the idempotency of the update"},{"line_number":115,"context_line":"  algorithms used should help minimize the issues this can potentially cause."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"NEUTRON-SHIM"},{"line_number":118,"context_line":"------------"},{"line_number":119,"context_line":"In order to keep Octavia\u0027s design more clean as a pure consumer of network"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_790bff2c","line":116,"updated":"2014-08-09 21:01:32.000000000","message":"I am understanding this as multiple updates at the same time can go to the same VM.  Would it not be possible to just not allow an update to a VM while it is in a transitional state?  Or should that be left up to the user facing APIs to handle?","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"9f9a4172d0e1eef9abae38683dd51b6fe120d8bd","unresolved":false,"context_lines":[{"line_number":113,"context_line":"* It is also possible for multiple instances of the driver will talk to the"},{"line_number":114,"context_line":"  same Octavia VM at the same time. Emphasis on the idempotency of the update"},{"line_number":115,"context_line":"  algorithms used should help minimize the issues this can potentially cause."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"NEUTRON-SHIM"},{"line_number":118,"context_line":"------------"},{"line_number":119,"context_line":"In order to keep Octavia\u0027s design more clean as a pure consumer of network"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_b400a3ab","line":116,"in_reply_to":"7ac7a964_7d3fd925","updated":"2014-08-15 04:09:00.000000000","message":"I like what we\u0027ve done with our current API in that we do not allow load balancers in transitional states to be modified.  PENDING_CREATE, PENDING_UPDATE, PENDING_DELETE.  If an entity is in that state it, it\u0027s just not allowed to be modified until it becomes ACTIVE.  I don\u0027t foresee a load balancing API to be a high request volume API.  So I don\u0027t think this kind of lock would be an issue.  It simplifies the workflow too, so the code can expect to only be dealing with one modification to a loadbalancer at one time instead of dealing with the concurrency problem of two threads/processes pulling off the queue and deciding which one should be done first.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":113,"context_line":"* It is also possible for multiple instances of the driver will talk to the"},{"line_number":114,"context_line":"  same Octavia VM at the same time. Emphasis on the idempotency of the update"},{"line_number":115,"context_line":"  algorithms used should help minimize the issues this can potentially cause."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"NEUTRON-SHIM"},{"line_number":118,"context_line":"------------"},{"line_number":119,"context_line":"In order to keep Octavia\u0027s design more clean as a pure consumer of network"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_93c02c7e","line":116,"in_reply_to":"7ac7a964_b400a3ab","updated":"2015-06-03 00:12:14.000000000","message":"+1 and as implemented.  This section needs updating","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":113,"context_line":"* It is also possible for multiple instances of the driver will talk to the"},{"line_number":114,"context_line":"  same Octavia VM at the same time. Emphasis on the idempotency of the update"},{"line_number":115,"context_line":"  algorithms used should help minimize the issues this can potentially cause."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"NEUTRON-SHIM"},{"line_number":118,"context_line":"------------"},{"line_number":119,"context_line":"In order to keep Octavia\u0027s design more clean as a pure consumer of network"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_7d3fd925","line":116,"in_reply_to":"baada198_790bff2c","updated":"2014-08-14 23:06:23.000000000","message":"German raised a similar point on the v0.5 design document. Are y\u0027all advocating a locking scheme to prevent two clients from triggering changes to the same objects at the same time? If so, is there a specific scheme you\u0027d recommend here?\n\n(will be altered in the v0.5 design and carried forward into this one.)","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":115,"context_line":"  algorithms used should help minimize the issues this can potentially cause."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"NEUTRON-SHIM"},{"line_number":118,"context_line":"------------"},{"line_number":119,"context_line":"In order to keep Octavia\u0027s design more clean as a pure consumer of network"},{"line_number":120,"context_line":"services, yet still be able to develop Octavia at a time when it is impossible"},{"line_number":121,"context_line":"to provide the kind of load balancing services we need to provide without"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_535194d7","line":118,"updated":"2015-06-03 00:12:14.000000000","message":"So far we haven\u0027t needed this.  Drop?","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"892b667eec756e8eb32500f2085cdb7b646eabe6","unresolved":false,"context_lines":[{"line_number":115,"context_line":"  algorithms used should help minimize the issues this can potentially cause."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"NEUTRON-SHIM"},{"line_number":118,"context_line":"------------"},{"line_number":119,"context_line":"In order to keep Octavia\u0027s design more clean as a pure consumer of network"},{"line_number":120,"context_line":"services, yet still be able to develop Octavia at a time when it is impossible"},{"line_number":121,"context_line":"to provide the kind of load balancing services we need to provide without"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_ac9f3e4f","line":118,"in_reply_to":"5afe65bd_535194d7","updated":"2015-06-03 05:28:15.000000000","message":"well its kind of there, its the network driver. but yeah this should be redone to reflect that.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":140,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":141,"context_line":"Octavia Components"},{"line_number":142,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":143,"context_line":"Everything from here down are entities that have to do with the Octavia driver"},{"line_number":144,"context_line":"and load balancing system. Other vendor drivers are unlikely to have the same"},{"line_number":145,"context_line":"components and internal structure. It is planned that Octavia will become the"},{"line_number":146,"context_line":"new reference implementation for LBaaS, though it of course doesn\u0027t need to be"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_d905eb15","line":143,"updated":"2014-08-09 21:01:32.000000000","message":"minor subjective nit: i wouldn\u0027t call these parts a driver.  This is more the Octavia application.  The driver lives in the LBaaS part as I understand it.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"892b667eec756e8eb32500f2085cdb7b646eabe6","unresolved":false,"context_lines":[{"line_number":140,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":141,"context_line":"Octavia Components"},{"line_number":142,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":143,"context_line":"Everything from here down are entities that have to do with the Octavia driver"},{"line_number":144,"context_line":"and load balancing system. Other vendor drivers are unlikely to have the same"},{"line_number":145,"context_line":"components and internal structure. It is planned that Octavia will become the"},{"line_number":146,"context_line":"new reference implementation for LBaaS, though it of course doesn\u0027t need to be"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_accdfe5e","line":143,"in_reply_to":"5afe65bd_33bbb8e7","updated":"2015-06-03 05:28:15.000000000","message":"i wouldn\u0027t consider the queue part of the controller so this should be updated to include API, DB, Queue, and Controller","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":140,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":141,"context_line":"Octavia Components"},{"line_number":142,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":143,"context_line":"Everything from here down are entities that have to do with the Octavia driver"},{"line_number":144,"context_line":"and load balancing system. Other vendor drivers are unlikely to have the same"},{"line_number":145,"context_line":"components and internal structure. It is planned that Octavia will become the"},{"line_number":146,"context_line":"new reference implementation for LBaaS, though it of course doesn\u0027t need to be"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_33bbb8e7","line":143,"in_reply_to":"7ac7a964_bde5f1a9","updated":"2015-06-03 00:12:14.000000000","message":"Controller?","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":140,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":141,"context_line":"Octavia Components"},{"line_number":142,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":143,"context_line":"Everything from here down are entities that have to do with the Octavia driver"},{"line_number":144,"context_line":"and load balancing system. Other vendor drivers are unlikely to have the same"},{"line_number":145,"context_line":"components and internal structure. It is planned that Octavia will become the"},{"line_number":146,"context_line":"new reference implementation for LBaaS, though it of course doesn\u0027t need to be"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_bde5f1a9","line":143,"in_reply_to":"baada198_d905eb15","updated":"2014-08-14 23:06:23.000000000","message":"Aah-- this should have been \u0027project\u0027 and not driver. Will fix in the next push.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":155,"context_line":"existing queueing system (Oslo) for this. The only constraint here is that all"},{"line_number":156,"context_line":"the components (except the octavia VMs) need to be able to talk with the"},{"line_number":157,"context_line":"intermediate message bus."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"**Notes:**"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"* As certain sensitive data (TLS private keys, for example) will be transmitted"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_19fcc30c","line":158,"updated":"2014-08-09 21:01:32.000000000","message":"Responding to a previous comment about using RESTful APIs.  I think that should be done later as taking advantage of oslo will speed this up in the beginning.  If oslo had a rest api library then that would make it just as easy and the only thing I\u0027d worry about is the extra overhead a REST API may incur.  Still I think it better to use what has already been implemented for openstack at first.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":155,"context_line":"existing queueing system (Oslo) for this. The only constraint here is that all"},{"line_number":156,"context_line":"the components (except the octavia VMs) need to be able to talk with the"},{"line_number":157,"context_line":"intermediate message bus."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"**Notes:**"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"* As certain sensitive data (TLS private keys, for example) will be transmitted"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_ddf9cd4e","line":158,"in_reply_to":"baada198_19fcc30c","updated":"2014-08-14 23:06:23.000000000","message":"I\u0027m OK with that so long as the Oslo stuff is ready for prime-time as it were. When we get to the point of coding v1, if Oslo isn\u0027t ready, I don\u0027t want to be held up by it (though, it would be good to know where it\u0027s at and going so we can potentially rewrite this to use it when it\u0027s ready.)","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":186,"context_line":"----------"},{"line_number":187,"context_line":"This is intended to be a light-weight daemon whose sole job it is to associate"},{"line_number":188,"context_line":"\"loadbalancer\" instances (as defined in the user API documents) with controller"},{"line_number":189,"context_line":"back-ends, and monitor controllers and other dispatchers for failure."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"**Notes:**"},{"line_number":192,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_5372b44a","line":189,"updated":"2015-06-03 00:12:14.000000000","message":"Current desire is to not associate loadbalancer instances with controllers.\nThis section needs re-thought","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"892b667eec756e8eb32500f2085cdb7b646eabe6","unresolved":false,"context_lines":[{"line_number":186,"context_line":"----------"},{"line_number":187,"context_line":"This is intended to be a light-weight daemon whose sole job it is to associate"},{"line_number":188,"context_line":"\"loadbalancer\" instances (as defined in the user API documents) with controller"},{"line_number":189,"context_line":"back-ends, and monitor controllers and other dispatchers for failure."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"**Notes:**"},{"line_number":192,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_ec01b66b","line":189,"in_reply_to":"5afe65bd_5372b44a","updated":"2015-06-03 05:28:15.000000000","message":"yeah i think at this point the dispatch will become just some kind of monitor and failure handler for all controllers","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":211,"context_line":"* Health checks take the form of a regular heartbeat emitted to all other"},{"line_number":212,"context_line":"  dispatcher peers via the above configured message queue a failed heartbeat"},{"line_number":213,"context_line":"  is one that is too stale. (Though the state of other peers\u0027 statuses should"},{"line_number":214,"context_line":"  not need to be kept in nonvolatile storage.)"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"* A dispatcher is also the only single bottleneck in the design-- hence the"},{"line_number":217,"context_line":"  reason it should be kept as lightweight as possible, and only pinged when"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_4b190275","line":214,"updated":"2014-08-09 21:01:32.000000000","message":"Stupid question maybe, but is there a reason this health check is sent over the message bus?","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":211,"context_line":"* Health checks take the form of a regular heartbeat emitted to all other"},{"line_number":212,"context_line":"  dispatcher peers via the above configured message queue a failed heartbeat"},{"line_number":213,"context_line":"  is one that is too stale. (Though the state of other peers\u0027 statuses should"},{"line_number":214,"context_line":"  not need to be kept in nonvolatile storage.)"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"* A dispatcher is also the only single bottleneck in the design-- hence the"},{"line_number":217,"context_line":"  reason it should be kept as lightweight as possible, and only pinged when"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_9d8675b8","line":214,"in_reply_to":"baada198_4b190275","updated":"2014-08-14 23:06:23.000000000","message":"We\u0027re not guaranteeing connectivity between internal components over anything but the internal message bus. (ie. it\u0027s the \"only\" communication channel between components that are part of \u0027control\u0027)","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":251,"context_line":"  deployed, the dispatcher needs to have the ability to inform controllers to"},{"line_number":252,"context_line":"  migrate a loadbalancer from one controller to another."},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"ACTIVE-NODE CONTROLLER"},{"line_number":255,"context_line":"----------------------"},{"line_number":256,"context_line":"This is the entity that controls the octavia VMs that are actually in use"},{"line_number":257,"context_line":"hosting user-configured loadbalancers. It is also the place where most of the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_d670d2de","line":254,"updated":"2015-06-03 00:12:14.000000000","message":"I think we don\u0027t want active/standby but instead any controller should be able to service the amp.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"892b667eec756e8eb32500f2085cdb7b646eabe6","unresolved":false,"context_lines":[{"line_number":251,"context_line":"  deployed, the dispatcher needs to have the ability to inform controllers to"},{"line_number":252,"context_line":"  migrate a loadbalancer from one controller to another."},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"ACTIVE-NODE CONTROLLER"},{"line_number":255,"context_line":"----------------------"},{"line_number":256,"context_line":"This is the entity that controls the octavia VMs that are actually in use"},{"line_number":257,"context_line":"hosting user-configured loadbalancers. It is also the place where most of the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_ec38963f","line":254,"in_reply_to":"5afe65bd_d670d2de","updated":"2015-06-03 05:28:15.000000000","message":"I believe that is the goal right now, though I think there could be problems with that in the future but hard to pinpoint right now.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":266,"context_line":"  specific to haproxy."},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"* Processing the queue of configuration updates that need to be applied to"},{"line_number":269,"context_line":"  individual octavia VMs, as sent via the Intermediate Message Bus."},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"* Interfacing with neutron networking to plumb additional interfaces on the"},{"line_number":272,"context_line":"  octavia VMs as necessary."}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_96737ae7","line":269,"updated":"2015-06-03 00:12:14.000000000","message":"This has changed, see pending_* above.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":271,"context_line":"* Interfacing with neutron networking to plumb additional interfaces on the"},{"line_number":272,"context_line":"  octavia VMs as necessary."},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"* Monitoring the health of active octavia VMs."},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"* Requesting \"clean up\" and redispatch for failed octavia VMs from the spare"},{"line_number":277,"context_line":"  node controller."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_4b6742ec","line":274,"updated":"2014-08-09 21:01:32.000000000","message":"Stephen, replying to your last comment in PS 5.  You mentioned that each haproxy instance would correspond with a separate listener.  Just to be clear, you weren\u0027t talking about the API Listener entity? But a listener for each haproxy instance to check the health of the instance?","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"9f9a4172d0e1eef9abae38683dd51b6fe120d8bd","unresolved":false,"context_lines":[{"line_number":271,"context_line":"* Interfacing with neutron networking to plumb additional interfaces on the"},{"line_number":272,"context_line":"  octavia VMs as necessary."},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"* Monitoring the health of active octavia VMs."},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"* Requesting \"clean up\" and redispatch for failed octavia VMs from the spare"},{"line_number":277,"context_line":"  node controller."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_54dd8f6f","line":274,"in_reply_to":"7ac7a964_cf5f500d","updated":"2014-08-15 04:09:00.000000000","message":"Definitely more clear.  Actually, I was just making sure you weren\u0027t talking about API listener.  And I wasn\u0027t suggesting using haproxy as the entity powering the RESTful API either.  I got my answer though. Thanks.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":271,"context_line":"* Interfacing with neutron networking to plumb additional interfaces on the"},{"line_number":272,"context_line":"  octavia VMs as necessary."},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"* Monitoring the health of active octavia VMs."},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"* Requesting \"clean up\" and redispatch for failed octavia VMs from the spare"},{"line_number":277,"context_line":"  node controller."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_cf5f500d","line":274,"in_reply_to":"baada198_4b6742ec","updated":"2014-08-14 23:06:23.000000000","message":"Almost-- I don\u0027t imagine we would be using haproxy as the entity powering the RESTful API on the Octavia VM itself, since haproxy can only proxy to another web service. I anticipate using something like lighttpd + cgi to power the API that lives on the Octavia VMs themselves. Something light-weight, predictable, and providing enough of the features we need (ie. TLS + client cert verification + CGI capability) and not much more than that. Though getting into the specifics of what powers the API webserver doesn\u0027t affect the component design, so we can leave it to a later discussion if it\u0027s important.\n\nThe point is, if we\u0027re doing health monitoring in a \"poll\" fashion (ie. controller hits a RESTful API endpoint living on the Octavia VM), then there\u0027s no reason the scripts powering the API on the Octavia VMs can\u0027t check the health of all the haproxy listeners running on the Octavia VMs and return status for each. If we\u0027re doing health checks using a \"push\" method (which we probably should), the periodic task running on the Octavia VM that checks in with control could also check the health of all its haproxy instances and report these back in one (JSON-encoded) update.\n\nHow this \"external\" script checks the status of the local haproxy processes is actually immaterial, though it probably makes sense to hit well known local haproxy control socket(s) or the haproxy monitoring URL to do this.  (The socket is preferable, IMO, as not every loadbalancer will be HTTP-based.)\n\nIs that any more clear?","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":279,"context_line":"* Requesting new octavia VMs be deployed or migrated locally by the spare node"},{"line_number":280,"context_line":"  controller."},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"* Migrating empty octavia VMs back to the spare node controller."},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"* Receiving and routing certain kinds of notifications originating on the"},{"line_number":285,"context_line":"  octavia VMs (ex. \"member down\")"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_b62676cc","line":282,"updated":"2015-06-03 00:12:14.000000000","message":"No, cattle, once we are done with an amphora we should delete it and move on.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":279,"context_line":"* Requesting new octavia VMs be deployed or migrated locally by the spare node"},{"line_number":280,"context_line":"  controller."},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"* Migrating empty octavia VMs back to the spare node controller."},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"* Receiving and routing certain kinds of notifications originating on the"},{"line_number":285,"context_line":"  octavia VMs (ex. \"member down\")"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_b65f9640","line":282,"updated":"2015-06-03 00:12:14.000000000","message":"No, cattle, once we are done with an amphora we should delete it and move on.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"892b667eec756e8eb32500f2085cdb7b646eabe6","unresolved":false,"context_lines":[{"line_number":279,"context_line":"* Requesting new octavia VMs be deployed or migrated locally by the spare node"},{"line_number":280,"context_line":"  controller."},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"* Migrating empty octavia VMs back to the spare node controller."},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"* Receiving and routing certain kinds of notifications originating on the"},{"line_number":285,"context_line":"  octavia VMs (ex. \"member down\")"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_cc403aa8","line":282,"in_reply_to":"5afe65bd_b65f9640","updated":"2015-06-03 05:28:15.000000000","message":"+1","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":296,"context_line":"* Receiving notifications, statistics data and other short, regular messages"},{"line_number":297,"context_line":"  from octavia VMs and routing them to the appropriate entity."},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"* Responding to requests from octavia VMs for configuration data, queue data."},{"line_number":300,"context_line":""},{"line_number":301,"context_line":"* Responding to requests from the user API or operator API handler driver for"},{"line_number":302,"context_line":"  data about specific loadbalancers or sub-objects, their status, and"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_811e9261","line":299,"updated":"2015-06-03 00:12:14.000000000","message":"Changed, comes are one way controller-\u003eamphora","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":302,"context_line":"  data about specific loadbalancers or sub-objects, their status, and"},{"line_number":303,"context_line":"  statistics."},{"line_number":304,"context_line":""},{"line_number":305,"context_line":"* Sending regular heartbeats to the dispatcher."},{"line_number":306,"context_line":""},{"line_number":307,"context_line":"**Notes:**"},{"line_number":308,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_6ba326ff","line":305,"updated":"2014-08-09 21:01:32.000000000","message":"So in this case, using the queue to do the heartbeat is because we don\u0027t care which dispatcher is up, as long as a dispatcher is up listening on the queue. Correct?","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":302,"context_line":"  data about specific loadbalancers or sub-objects, their status, and"},{"line_number":303,"context_line":"  statistics."},{"line_number":304,"context_line":""},{"line_number":305,"context_line":"* Sending regular heartbeats to the dispatcher."},{"line_number":306,"context_line":""},{"line_number":307,"context_line":"**Notes:**"},{"line_number":308,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_6f4b9c2b","line":305,"in_reply_to":"baada198_6ba326ff","updated":"2014-08-14 23:06:23.000000000","message":"Yes. Though it\u0027s not the job of the active node controller to monitor that. It\u0027s up to any active dispatchers that are running without a partner to complain if the standby goes away, and up to the standby dispatcher to take over the active role if the currently-active dispatcher goes away.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":311,"context_line":"  be as simple as possible so that minor feature improvements do not"},{"line_number":312,"context_line":"  necessarily entail pushing out new octavia VMs across an entire installation."},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"SPARE-NODE CONTROLLER"},{"line_number":315,"context_line":"---------------------"},{"line_number":316,"context_line":"This is the entity that controls the octavia VMs that are not actually in use"},{"line_number":317,"context_line":"hosting user-configured loadbalancers. Among the responsibilities it has are:"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_a1362ee5","line":314,"updated":"2015-06-03 00:12:14.000000000","message":"Again, I think we want all of the controllers active participants.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":329,"context_line":"* Receiving and processing requests to migrate octavia VMs to other"},{"line_number":330,"context_line":"  controllers."},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"* Gracefully spinning down \"dirty old octavia VMs\""},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"* Sending regular heartbeats to the dispatcher."},{"line_number":335,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_8bab1ad6","line":332,"updated":"2014-08-09 21:01:32.000000000","message":"My new rapper name.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":329,"context_line":"* Receiving and processing requests to migrate octavia VMs to other"},{"line_number":330,"context_line":"  controllers."},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"* Gracefully spinning down \"dirty old octavia VMs\""},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"* Sending regular heartbeats to the dispatcher."},{"line_number":335,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_cf52f0dc","line":332,"in_reply_to":"baada198_8bab1ad6","updated":"2014-08-14 23:06:23.000000000","message":"Haha!","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":336,"context_line":"**Notes:**"},{"line_number":337,"context_line":""},{"line_number":338,"context_line":"* The size of the spare octavia VM pool should be determined by the flavor"},{"line_number":339,"context_line":"  being offered."},{"line_number":340,"context_line":""},{"line_number":341,"context_line":"* The spares pool controller also handles spinning up octavia VMs in the case"},{"line_number":342,"context_line":"  of a true active/standby topology (ie. where the spares pool is effectively"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_2b84ce5b","line":339,"updated":"2014-08-09 21:01:32.000000000","message":"In the case of Nova VMs vs Nova Containers (which we (RAX) well want to use as soon as they are viable), I assume the flavor would be responsible for choosing that as well?","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":336,"context_line":"**Notes:**"},{"line_number":337,"context_line":""},{"line_number":338,"context_line":"* The size of the spare octavia VM pool should be determined by the flavor"},{"line_number":339,"context_line":"  being offered."},{"line_number":340,"context_line":""},{"line_number":341,"context_line":"* The spares pool controller also handles spinning up octavia VMs in the case"},{"line_number":342,"context_line":"  of a true active/standby topology (ie. where the spares pool is effectively"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_2f59a4fe","line":339,"in_reply_to":"baada198_2b84ce5b","updated":"2014-08-14 23:06:23.000000000","message":"Yes.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":340,"context_line":""},{"line_number":341,"context_line":"* The spares pool controller also handles spinning up octavia VMs in the case"},{"line_number":342,"context_line":"  of a true active/standby topology (ie. where the spares pool is effectively"},{"line_number":343,"context_line":"  zero.) It should have enough intelligence to communicate to Nova that these"},{"line_number":344,"context_line":"  octavia VMs should not be on the same physical host in this topology."},{"line_number":345,"context_line":""},{"line_number":346,"context_line":"* It also handles spinning up new octavia VMs when one fails in the above"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_ab8ffe74","line":343,"updated":"2014-08-09 21:01:32.000000000","message":"Wouldn\u0027t the spare pool be zero if there is no HA as well?  Do we plan on support no HA deployments?  I think I would like this for doing some testing and not hogging more resources than I need.  Actually, you mention it towards the end of this document.  This statement seems to contradict that.  I\u0027m pretty sure the intent is to support the 3 options, though.  So i\u0027m just nitpicking I know.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"9f9a4172d0e1eef9abae38683dd51b6fe120d8bd","unresolved":false,"context_lines":[{"line_number":340,"context_line":""},{"line_number":341,"context_line":"* The spares pool controller also handles spinning up octavia VMs in the case"},{"line_number":342,"context_line":"  of a true active/standby topology (ie. where the spares pool is effectively"},{"line_number":343,"context_line":"  zero.) It should have enough intelligence to communicate to Nova that these"},{"line_number":344,"context_line":"  octavia VMs should not be on the same physical host in this topology."},{"line_number":345,"context_line":""},{"line_number":346,"context_line":"* It also handles spinning up new octavia VMs when one fails in the above"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_b4b6e33b","line":343,"in_reply_to":"7ac7a964_2fde0440","updated":"2014-08-15 04:09:00.000000000","message":"What I meant by this was that the comment above implies that if the spares pool is 0 then you get true active / standby, whereas below at line 497 it describes a spare pools size of 0 as \"Single node\" topology, which is what I would define a spares pool of 0 to be as well.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":340,"context_line":""},{"line_number":341,"context_line":"* The spares pool controller also handles spinning up octavia VMs in the case"},{"line_number":342,"context_line":"  of a true active/standby topology (ie. where the spares pool is effectively"},{"line_number":343,"context_line":"  zero.) It should have enough intelligence to communicate to Nova that these"},{"line_number":344,"context_line":"  octavia VMs should not be on the same physical host in this topology."},{"line_number":345,"context_line":""},{"line_number":346,"context_line":"* It also handles spinning up new octavia VMs when one fails in the above"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_2fde0440","line":343,"in_reply_to":"baada198_ab8ffe74","updated":"2014-08-14 23:06:23.000000000","message":"Right, we do support three options... but the no HA option is exactly the same as the single active node + spares pool topology. I\u0027ll be more explicit about this in this section in the next revision.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":370,"context_line":"* Shipping listener logs to a swift data store, if configured."},{"line_number":371,"context_line":""},{"line_number":372,"context_line":"* Sending \"edge\" notifications (ie. status changes) to the controller when"},{"line_number":373,"context_line":"  members go up and down, when listeners go up and down, etc."},{"line_number":374,"context_line":""},{"line_number":375,"context_line":"**Notes:**"},{"line_number":376,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_8bd95a86","line":373,"updated":"2014-08-09 21:01:32.000000000","message":"Define listeners in this context.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":370,"context_line":"* Shipping listener logs to a swift data store, if configured."},{"line_number":371,"context_line":""},{"line_number":372,"context_line":"* Sending \"edge\" notifications (ie. status changes) to the controller when"},{"line_number":373,"context_line":"  members go up and down, when listeners go up and down, etc."},{"line_number":374,"context_line":""},{"line_number":375,"context_line":"**Notes:**"},{"line_number":376,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_2fb524ee","line":373,"in_reply_to":"baada198_8bd95a86","updated":"2014-08-14 23:06:23.000000000","message":"listener  \u003d haproxy instance. Also known as a \"Listener\" in the LBaaS object model.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":380,"context_line":"  by any loadbalancer service can still communicate on the network and receive"},{"line_number":381,"context_line":"  commands from its controller. Whether this IP address exists on the same"},{"line_number":382,"context_line":"  subnet as the loadbalancer services it hosts is immaterial, so long as"},{"line_number":383,"context_line":"  front-end and back-end interfaces can be plumbed after a VM is launched."},{"line_number":384,"context_line":""},{"line_number":385,"context_line":"* Since octavia VMs speak to controllers in a \"trusted\" way, it\u0027s important to"},{"line_number":386,"context_line":"  ensure that users do not have command-line access to the octavia VMs. In"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_0bcd4aba","line":383,"updated":"2014-08-09 21:01:32.000000000","message":"Note that neutron lbaas currently creates a port and then sends it to the driver.  It is the driver\u0027s responsibility to plumb based on the port (and update the port accordingly).\n\nHowever, when it comes to members that are on a specific subnet, it is the driver\u0027s responsibility to both create and plumb.  I don\u0027t think that will be a problem here (other than maybe having to use the neutron shim for the already create port passed to the driver).\n\nI\u0027m not a fan of the inconsistency of where a port is created.  I\u0027d rather the plugin take care of port creation for all needed, and pass those ports down to the driver, who then have to only update the port accordingly.  Anyone have any thoughts on this?  Probably something better left for ML, but I\u0027m thinking aloud here!","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"9f9a4172d0e1eef9abae38683dd51b6fe120d8bd","unresolved":false,"context_lines":[{"line_number":380,"context_line":"  by any loadbalancer service can still communicate on the network and receive"},{"line_number":381,"context_line":"  commands from its controller. Whether this IP address exists on the same"},{"line_number":382,"context_line":"  subnet as the loadbalancer services it hosts is immaterial, so long as"},{"line_number":383,"context_line":"  front-end and back-end interfaces can be plumbed after a VM is launched."},{"line_number":384,"context_line":""},{"line_number":385,"context_line":"* Since octavia VMs speak to controllers in a \"trusted\" way, it\u0027s important to"},{"line_number":386,"context_line":"  ensure that users do not have command-line access to the octavia VMs. In"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_b448a35c","line":383,"in_reply_to":"7ac7a964_6fa39c9e","updated":"2014-08-15 04:09:00.000000000","message":"Are you suggesting some drivers wont need the neutron port because they already have routing set up? or because they may not be using neutron or using some external \"port\"?\n\nThe bigger problem is the inconsistency in where the ports are created though.  The reason the VIP port is created in the plugin is because the user can specify the IP address.  Creating that port with the particular IP right away reserves it so nothing else can take it by the time the driver gets it.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":380,"context_line":"  by any loadbalancer service can still communicate on the network and receive"},{"line_number":381,"context_line":"  commands from its controller. Whether this IP address exists on the same"},{"line_number":382,"context_line":"  subnet as the loadbalancer services it hosts is immaterial, so long as"},{"line_number":383,"context_line":"  front-end and back-end interfaces can be plumbed after a VM is launched."},{"line_number":384,"context_line":""},{"line_number":385,"context_line":"* Since octavia VMs speak to controllers in a \"trusted\" way, it\u0027s important to"},{"line_number":386,"context_line":"  ensure that users do not have command-line access to the octavia VMs. In"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_6fa39c9e","line":383,"in_reply_to":"baada198_0bcd4aba","updated":"2014-08-14 23:06:23.000000000","message":"So, this is also just spit-balling, but:\n\nIn the context on Neutron LBaaS, isn\u0027t it possible and even likely that some drivers won\u0027t actually need the Neutron port? If that\u0027s the case, then why the extra overhead in the plugin? Why not let the driver create ports in either case.\n\nAnyway, I agree that port creation / plumbing should happen in the same place, whether that\u0027s in the plugin or the driver, and whether the port is the \"front-end\" port or various member ports.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":385,"context_line":"* Since octavia VMs speak to controllers in a \"trusted\" way, it\u0027s important to"},{"line_number":386,"context_line":"  ensure that users do not have command-line access to the octavia VMs. In"},{"line_number":387,"context_line":"  other words, the octavia VMs should be a black box from the users\u0027"},{"line_number":388,"context_line":"  perspective."},{"line_number":389,"context_line":""},{"line_number":390,"context_line":"* Octavia VMs will be powered using haproxy 1.5 initially. We may decide to use"},{"line_number":391,"context_line":"  other software (especially for SSL termination) later on."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_6bc886a7","line":388,"updated":"2014-08-09 21:01:32.000000000","message":"I may have missed this, but I assume that these will not be built on the user\u0027s behalf.  All the VMs will be built using a service user which wouldn\u0027t allow users to see any of the VMs on their account.  I\u0027m sure this is the way intended and the more I think about it the more it is clear the other way is the total wrong way.  But put my mind at ease!","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":385,"context_line":"* Since octavia VMs speak to controllers in a \"trusted\" way, it\u0027s important to"},{"line_number":386,"context_line":"  ensure that users do not have command-line access to the octavia VMs. In"},{"line_number":387,"context_line":"  other words, the octavia VMs should be a black box from the users\u0027"},{"line_number":388,"context_line":"  perspective."},{"line_number":389,"context_line":""},{"line_number":390,"context_line":"* Octavia VMs will be powered using haproxy 1.5 initially. We may decide to use"},{"line_number":391,"context_line":"  other software (especially for SSL termination) later on."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_2fb1a4e1","line":388,"in_reply_to":"baada198_6bc886a7","updated":"2014-08-14 23:06:23.000000000","message":"You are correct, Octavia VMs should exist only on a service user and not on \"real\" client tenant accounts. The point of the above statement is to re-emphasize that users getting command-line access to an Octavia VM is bad juju.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"bacbf470e7e9226d9eb9f2b22659955205890436","unresolved":false,"context_lines":[{"line_number":394,"context_line":"  lightweight as possible: Intelligence about how to put together an haproxy"},{"line_number":395,"context_line":"  config, for example, should not live on the octavia VM. Rather, the octavia"},{"line_number":396,"context_line":"  VM should perform simple syntax checks, start / restart haproxy if the checks"},{"line_number":397,"context_line":"  pass, and report success/failure of the haproxy restart."},{"line_number":398,"context_line":""},{"line_number":399,"context_line":"* With few exceptions, most of the API commands the octavia VM will ever do"},{"line_number":400,"context_line":"  should be safely handled synchronously (ie. nothing should take longer than a"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_ebb3b632","line":397,"updated":"2014-08-09 21:01:32.000000000","message":"If needed, we could possibly use ifconfig\u0027s tx/rx stats (or ip -s link).  If we\u0027re allowing multiple instances on the same VM then maybe that won\u0027t work.  Not too sure, more thought and discussions needed for this.\n\nCurrently at RAX we do have the logic to handle resets.  It is definitely a pain the ass though with all the edge cases.  I\u0027m all for some solution that doesn\u0027t have to deal with that.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"9f9a4172d0e1eef9abae38683dd51b6fe120d8bd","unresolved":false,"context_lines":[{"line_number":394,"context_line":"  lightweight as possible: Intelligence about how to put together an haproxy"},{"line_number":395,"context_line":"  config, for example, should not live on the octavia VM. Rather, the octavia"},{"line_number":396,"context_line":"  VM should perform simple syntax checks, start / restart haproxy if the checks"},{"line_number":397,"context_line":"  pass, and report success/failure of the haproxy restart."},{"line_number":398,"context_line":""},{"line_number":399,"context_line":"* With few exceptions, most of the API commands the octavia VM will ever do"},{"line_number":400,"context_line":"  should be safely handled synchronously (ie. nothing should take longer than a"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_7437ebe3","line":397,"in_reply_to":"7ac7a964_cf74b0ff","updated":"2014-08-15 04:09:00.000000000","message":"I think i laser focused on the \"reset of stats\" in a previous comment on this line.  Anyway, what I mean is that if haproxy\u0027s stats get reset (and i was only merely thinking about bandwidth), then other methods of getting stats would be great.  Since I\u0027ve had to deal with stats (bandwidth counters) resetting to 0 because a process got restarted.  Basically I went off on a tangent and drug you down with me.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"f6a01c95504cd78afd9fc4838a6ace248e27be64","unresolved":false,"context_lines":[{"line_number":394,"context_line":"  lightweight as possible: Intelligence about how to put together an haproxy"},{"line_number":395,"context_line":"  config, for example, should not live on the octavia VM. Rather, the octavia"},{"line_number":396,"context_line":"  VM should perform simple syntax checks, start / restart haproxy if the checks"},{"line_number":397,"context_line":"  pass, and report success/failure of the haproxy restart."},{"line_number":398,"context_line":""},{"line_number":399,"context_line":"* With few exceptions, most of the API commands the octavia VM will ever do"},{"line_number":400,"context_line":"  should be safely handled synchronously (ie. nothing should take longer than a"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7ac7a964_cf74b0ff","line":397,"in_reply_to":"baada198_ebb3b632","updated":"2014-08-14 23:06:23.000000000","message":"I\u0027m a little confused as to the problem you\u0027re suggesting we solve here: What does ifconfig\u0027s tx/rx status (or ip -s link) have to do with starting / restarting haproxy instances?  Also, when you say \u0027resets\u0027 what are you talking about specifically?\n\nAt Blue Box, we found it was really easy to do a syntax check on a new haproxy config file before executing it, and haproxy also allows for a method to do a graceful restart that\u0027s effective almost all the time. (It helps to have pretty good control over the kinds of things that go into the haproxy configuration file, which we do.) Checking process execution return codes is a simple way to know with near certainty how well the restart process worked each time.","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":486,"context_line":"  failure, but is much less efficient, as far as VM resource utilization is"},{"line_number":487,"context_line":"  concerned."},{"line_number":488,"context_line":""},{"line_number":489,"context_line":"* In this topology a floating IP address (different from a Neutron floating"},{"line_number":490,"context_line":"  IP!) is used to determine which octavia VM is the \"active\" one at any given"},{"line_number":491,"context_line":"  time."},{"line_number":492,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_41753a96","line":489,"updated":"2015-06-03 00:12:14.000000000","message":"VIP","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"}],"specs/version1/component-design.rst":[{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"68678facc4a954b456af3780db69d01e1cee2281","unresolved":false,"context_lines":[{"line_number":14,"context_line":"We need to define the various components that will make up Octavia v1.0."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Proposed change"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":18,"context_line":"In Octavia 0.5, several of these components are combined. Here we have split"},{"line_number":19,"context_line":"them apart to allow for horizontal scaling of these components."},{"line_number":20,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_219fdeb5","line":17,"updated":"2015-06-03 00:12:14.000000000","message":"Should be updated to reflect 1.0 goal of Active/Standby and HA controllers","commit_id":"9469ff0ab34ce608a17c6fcfb32aa0b402455de4"}]}