| *** jrd-redhat has quit IRC | 00:03 | |
| *** anniec_ has joined #openstack-dev | 00:08 | |
| *** anniec has quit IRC | 00:12 | |
| *** anniec_ is now known as anniec | 00:12 | |
| *** blamar has quit IRC | 00:12 | |
| *** daddyjoseph97 has joined #openstack-dev | 00:20 | |
| *** markmcclain has quit IRC | 00:22 | |
| *** andrewsmedina has joined #openstack-dev | 00:24 | |
| *** andrewbogott is now known as andrewbogott_afk | 00:25 | |
| *** pixelbeat has quit IRC | 00:28 | |
| *** cloudvirt has quit IRC | 00:31 | |
| *** johnpur has quit IRC | 00:33 | |
| *** spiffxp has quit IRC | 00:34 | |
| *** Ryan_Lane has quit IRC | 00:41 | |
| *** novas0x2a|laptop has quit IRC | 00:41 | |
| *** novas0x2a|laptop has joined #openstack-dev | 00:42 | |
| *** jakedahn is now known as jakedahn_zz | 00:42 | |
| *** Gordonz has quit IRC | 00:47 | |
| *** maoy has joined #openstack-dev | 00:55 | |
| *** novas0x2a|laptop has quit IRC | 00:55 | |
| *** roge has quit IRC | 00:57 | |
| *** anniec has quit IRC | 01:00 | |
| *** nati_ueno has quit IRC | 01:07 | |
| *** nati_ueno has joined #openstack-dev | 01:07 | |
| *** renier_ has joined #openstack-dev | 01:26 | |
| *** renier has quit IRC | 01:26 | |
| *** lifeless has quit IRC | 01:26 | |
| *** nati_ueno has quit IRC | 01:29 | |
| *** nati_ueno has joined #openstack-dev | 01:30 | |
| *** lifeless has joined #openstack-dev | 01:36 | |
| *** daddyjoseph97 has quit IRC | 01:46 | |
| *** mestery has joined #openstack-dev | 01:51 | |
| *** dolphm has quit IRC | 01:53 | |
| *** dwalleck has joined #openstack-dev | 01:57 | |
| *** sniperd has joined #openstack-dev | 01:57 | |
| *** PotHix has quit IRC | 01:58 | |
| rmk | vishy: What about moving to libvirt for snapshots? | 02:01 |
|---|---|---|
| *** jtran has quit IRC | 02:14 | |
| *** anniec has joined #openstack-dev | 02:16 | |
| *** anniec_ has joined #openstack-dev | 02:19 | |
| *** mjfork has quit IRC | 02:22 | |
| *** thinrhino has joined #openstack-dev | 02:22 | |
| *** anniec has quit IRC | 02:23 | |
| *** anniec_ is now known as anniec | 02:23 | |
| *** colinmcnamara has joined #openstack-dev | 02:24 | |
| *** cloudvirt has joined #openstack-dev | 02:25 | |
| *** jtran has joined #openstack-dev | 02:27 | |
| *** dolphm has joined #openstack-dev | 02:28 | |
| *** shang has joined #openstack-dev | 02:29 | |
| *** roge has joined #openstack-dev | 02:33 | |
| *** maoy has quit IRC | 02:38 | |
| *** jtran has quit IRC | 02:41 | |
| *** cloudvirt has quit IRC | 02:44 | |
| *** rpedde_away is now known as rpedde | 02:45 | |
| colinmcnamara | does anyone know how to push files from sourcetree into gerrit for review? | 02:48 |
| *** adalbas has quit IRC | 02:48 | |
| *** lifeless has quit IRC | 02:49 | |
| clarkb | colinmcnamara: use git review | 02:51 |
| clarkb | colinmcnamara: see http://wiki.openstack.org/GerritWorkflow | 02:51 |
| clarkb | you do need to sign the CLA first. see http://wiki.openstack.org/HowToContribute if you haven't done that | 02:51 |
| colinmcnamara | already signed the CLA | 02:52 |
| colinmcnamara | at a hackathon @ yahoo with sean roberts and crew | 02:52 |
| colinmcnamara | we put a team together to implement some changes | 02:52 |
| colinmcnamara | kinda struggling on using GIT | 02:52 |
| *** jtran has joined #openstack-dev | 02:53 | |
| clarkb | the GerritWorkflow wiki page is a good place to start. It should cover the basics and get code into gerrit | 02:53 |
| *** roge has quit IRC | 02:54 | |
| colinmcnamara | we have that page open, like all good engineering types, struggling through it | 02:57 |
| colinmcnamara | hopefully disk_QOS should be submitted for review pretty soon | 02:58 |
| clarkb | anything in particular you need more clarification on? | 02:58 |
| *** anniec has quit IRC | 03:02 | |
| *** thinrhino has quit IRC | 03:10 | |
| *** otter2 has joined #openstack-dev | 03:11 | |
| colinmcnamara | tool specifically, I was looking to see if anyone used sourcetree and how to use git-review with it | 03:12 |
| colinmcnamara | though, we are doing it through git now following the gerrit workflow | 03:12 |
| *** Ruetobas has quit IRC | 03:14 | |
| *** tgall_foo has joined #openstack-dev | 03:15 | |
| *** tgall_foo has quit IRC | 03:15 | |
| *** tgall_foo has joined #openstack-dev | 03:15 | |
| *** rpedde is now known as rpedde_away | 03:19 | |
| *** matwood has quit IRC | 03:19 | |
| *** anniec has joined #openstack-dev | 03:20 | |
| *** Ryan_Lane has joined #openstack-dev | 03:23 | |
| *** dolphm has quit IRC | 03:30 | |
| *** asalkeld has quit IRC | 03:31 | |
| *** jtran has quit IRC | 03:33 | |
| *** roge has joined #openstack-dev | 03:36 | |
| *** asalkeld has joined #openstack-dev | 03:41 | |
| *** andrewsmedina has quit IRC | 03:42 | |
| *** jakedahn_zz is now known as jakedahn | 03:43 | |
| *** anniec has quit IRC | 03:44 | |
| *** jtran has joined #openstack-dev | 03:45 | |
| *** sacharya has joined #openstack-dev | 03:48 | |
| *** spiffxp has joined #openstack-dev | 03:49 | |
| *** vodanh86 has joined #openstack-dev | 03:50 | |
| vodanh86 | hello, i want to debug how nova work, i'm already installed pydev, but i can't debug or run test nova project | 03:50 |
| vodanh86 | can anyone help me | 03:51 |
| *** jtran has quit IRC | 03:59 | |
| *** asalkeld has quit IRC | 04:06 | |
| *** lifeless has joined #openstack-dev | 04:07 | |
| *** thinrhino has joined #openstack-dev | 04:09 | |
| colinmcnamara | I am getting an internal server error when putting my ssh keys into review.openstack.org | 04:11 |
| colinmcnamara | I had changed my username on launchpad a couple days ago. I think that could be the root of my problem | 04:11 |
| colinmcnamara | any ideas? | 04:11 |
| *** mdomsch has quit IRC | 04:15 | |
| *** asalkeld has joined #openstack-dev | 04:21 | |
| colinmcnamara | ok, now for whatever reason when I submit git review it doesn't see my signed CLA | 04:26 |
| colinmcnamara | fatal: A Contributor Agreement must be completed before uploading: | 04:27 |
| colinmcnamara | which I have contributed under the username colinmcnamara | 04:27 |
| colinmcnamara | ideas? | 04:27 |
| *** ewindisch has quit IRC | 04:28 | |
| *** roge has quit IRC | 04:29 | |
| zaitcev | I eventually gave up and signed up another CLA in this situation. Who cares, it's not like I'm going to sue anyone. | 04:30 |
| colinmcnamara | Yeah, I did the same | 04:30 |
| colinmcnamara | apparently it takes time to sync? | 04:30 |
| zaitcev | Hmm. | 04:30 |
| zaitcev | I forgot the details now, but I seem to recall that yes, there was some hold-up. | 04:31 |
| *** colinmcnamara has quit IRC | 04:34 | |
| *** winston-d has joined #openstack-dev | 04:46 | |
| *** almaisan-away is now known as al-maisan | 04:46 | |
| *** vodanh86 has quit IRC | 04:47 | |
| *** Gordonz has joined #openstack-dev | 04:48 | |
| *** anniec has joined #openstack-dev | 04:49 | |
| *** anniec_ has joined #openstack-dev | 04:50 | |
| *** dwalleck has quit IRC | 04:51 | |
| *** tgall_foo has quit IRC | 04:52 | |
| *** Gordonz has quit IRC | 04:52 | |
| *** jakedahn is now known as jakedahn_zz | 04:54 | |
| *** anniec has quit IRC | 04:54 | |
| *** anniec_ is now known as anniec | 04:54 | |
| *** spiffxp has quit IRC | 04:58 | |
| *** shang has quit IRC | 05:02 | |
| *** jerdfelt has quit IRC | 05:02 | |
| *** jimfehlig has joined #openstack-dev | 05:02 | |
| *** markmcclain has joined #openstack-dev | 05:02 | |
| *** asalkeld has quit IRC | 05:02 | |
| *** al-maisan is now known as almaisan-away | 05:05 | |
| *** zaitcev has quit IRC | 05:06 | |
| *** sniperd has quit IRC | 05:16 | |
| *** ncode has quit IRC | 05:16 | |
| *** chmouel has quit IRC | 05:27 | |
| *** chmouel has joined #openstack-dev | 05:28 | |
| *** zhuadl has joined #openstack-dev | 05:31 | |
| vishy | rmk: you should look at the historical discussion on the mailing list | 05:34 |
| vishy | libvirt does not support what we need for snapshots | 05:34 |
| vishy | rmk: thread starts here | 05:36 |
| vishy | rmk: https://lists.launchpad.net/openstack/msg08427.html | 05:36 |
| *** sacharya has quit IRC | 05:36 | |
| *** almaisan-away is now known as al-maisan | 05:44 | |
| *** Ryan_Lane has quit IRC | 05:44 | |
| *** colinmcnamara has joined #openstack-dev | 05:53 | |
| *** lifeless_ has joined #openstack-dev | 05:55 | |
| colinmcnamara | @ zaitcev apparently someone needs to re-approve my contributors agreement | 05:57 |
| *** dayou has joined #openstack-dev | 05:57 | |
| *** lifeless has quit IRC | 05:57 | |
| *** lifeless_ is now known as lifeless | 05:58 | |
| *** dwalleck has joined #openstack-dev | 06:02 | |
| *** markmcclain has quit IRC | 06:03 | |
| *** jimfehlig has quit IRC | 06:05 | |
| *** dwalleck has quit IRC | 06:06 | |
| *** uvg has joined #openstack-dev | 06:07 | |
| uvg | Please review: https://review.openstack.org/#/c/11016/ - HTTP POST Notifier for OpenStack projects. | 06:09 |
| *** uvg has quit IRC | 06:09 | |
| *** uvg has joined #openstack-dev | 06:10 | |
| *** al-maisan is now known as almaisan-away | 06:17 | |
| *** littleidea has quit IRC | 06:19 | |
| *** lifeless has quit IRC | 06:19 | |
| *** Exhar has joined #openstack-dev | 06:25 | |
| *** Exhar has quit IRC | 06:28 | |
| *** mindpixel has joined #openstack-dev | 06:39 | |
| *** lifeless has joined #openstack-dev | 06:46 | |
| *** salv-orlando has joined #openstack-dev | 06:56 | |
| *** Exhar has joined #openstack-dev | 06:58 | |
| *** EmilienM has joined #openstack-dev | 06:59 | |
| *** Exhar has quit IRC | 07:03 | |
| *** EmilienM has quit IRC | 07:03 | |
| *** EmilienM has joined #openstack-dev | 07:03 | |
| *** colinmcnamara has quit IRC | 07:05 | |
| *** Ryan_Lane has joined #openstack-dev | 07:07 | |
| *** creiht has quit IRC | 07:11 | |
| *** jakedahn_zz is now known as jakedahn | 07:11 | |
| *** shang has joined #openstack-dev | 07:14 | |
| *** jerdfelt has joined #openstack-dev | 07:14 | |
| *** Ryan_Lane has quit IRC | 07:16 | |
| *** Exhar has joined #openstack-dev | 07:20 | |
| *** thingee is now known as thingee_zz | 07:26 | |
| *** zing has joined #openstack-dev | 07:32 | |
| *** alex88 has joined #openstack-dev | 07:47 | |
| *** alex88 has joined #openstack-dev | 07:47 | |
| *** shang has quit IRC | 07:48 | |
| *** zaneb has joined #openstack-dev | 07:52 | |
| *** shang has joined #openstack-dev | 07:54 | |
| *** salv-orlando has quit IRC | 07:55 | |
| *** salv-orlando has joined #openstack-dev | 07:58 | |
| *** lifeless has quit IRC | 08:02 | |
| *** salv-orlando has quit IRC | 08:02 | |
| *** winston-d has quit IRC | 08:04 | |
| *** jakedahn is now known as jakedahn_zz | 08:06 | |
| *** sniperd has joined #openstack-dev | 08:12 | |
| *** EmilienM has quit IRC | 08:14 | |
| *** EmilienM has joined #openstack-dev | 08:14 | |
| *** seats has quit IRC | 08:14 | |
| *** seats has joined #openstack-dev | 08:16 | |
| *** derekh has joined #openstack-dev | 08:17 | |
| *** samkottler|afk is now known as samkottler | 08:19 | |
| *** EmilienM has quit IRC | 08:20 | |
| *** lifeless has joined #openstack-dev | 08:23 | |
| *** pixelbeat has joined #openstack-dev | 08:24 | |
| *** EmilienM has joined #openstack-dev | 08:29 | |
| *** almaisan-away is now known as al-maisan | 08:34 | |
| *** winston-d has joined #openstack-dev | 08:35 | |
| *** darraghb has joined #openstack-dev | 08:39 | |
| *** lifeless has quit IRC | 08:43 | |
| *** kyriakos has joined #openstack-dev | 08:44 | |
| *** Gordonz has joined #openstack-dev | 08:48 | |
| *** Gordonz has quit IRC | 08:53 | |
| *** winston-d has quit IRC | 09:02 | |
| *** thinrhin_ has joined #openstack-dev | 09:03 | |
| *** derekh has quit IRC | 09:04 | |
| *** k4n0 has joined #openstack-dev | 09:05 | |
| *** thinrhino has quit IRC | 09:06 | |
| *** mrunge has joined #openstack-dev | 09:07 | |
| *** asalkeld has joined #openstack-dev | 09:07 | |
| *** thinrhino has joined #openstack-dev | 09:23 | |
| *** thinrhin_ has quit IRC | 09:27 | |
| *** derekh has joined #openstack-dev | 09:30 | |
| *** zhuadl has quit IRC | 09:45 | |
| *** dayou has quit IRC | 09:56 | |
| *** salv-orlando has joined #openstack-dev | 10:04 | |
| *** waa has quit IRC | 10:12 | |
| *** mjfork has joined #openstack-dev | 10:13 | |
| *** apevec has joined #openstack-dev | 10:17 | |
| *** apevec has joined #openstack-dev | 10:17 | |
| *** mnewby has joined #openstack-dev | 10:18 | |
| *** markmc has joined #openstack-dev | 10:23 | |
| *** salv-orlando has quit IRC | 10:23 | |
| *** JStoker has quit IRC | 10:24 | |
| *** al-maisan has quit IRC | 10:25 | |
| *** al-maisan has joined #openstack-dev | 10:26 | |
| *** al-maisan is now known as almaisan-away | 10:28 | |
| *** almaisan-away is now known as al-maisan | 10:28 | |
| *** al-maisan has quit IRC | 10:34 | |
| *** rohit404 has joined #openstack-dev | 10:55 | |
| *** mnewby has quit IRC | 10:59 | |
| *** al-maisan has joined #openstack-dev | 11:02 | |
| *** cloudvirt has joined #openstack-dev | 11:10 | |
| *** thinrhin_ has joined #openstack-dev | 11:13 | |
| *** JStoker has joined #openstack-dev | 11:14 | |
| *** thinrhino has quit IRC | 11:17 | |
| *** al-maisan is now known as almaisan-away | 11:19 | |
| *** ncode has joined #openstack-dev | 11:22 | |
| *** salv-orlando has joined #openstack-dev | 11:25 | |
| *** thinrhino has joined #openstack-dev | 11:30 | |
| *** cloudvirt has quit IRC | 11:30 | |
| *** thinrhi__ has joined #openstack-dev | 11:32 | |
| *** thinrhin_ has quit IRC | 11:33 | |
| *** thinrhino has quit IRC | 11:35 | |
| *** wiliam has joined #openstack-dev | 11:39 | |
| *** cloudvirt has joined #openstack-dev | 11:44 | |
| *** wiliam has quit IRC | 11:46 | |
| *** wiliam has joined #openstack-dev | 11:50 | |
| *** mnewby has joined #openstack-dev | 11:50 | |
| *** mnewby_ has joined #openstack-dev | 11:58 | |
| *** mnewby has quit IRC | 12:01 | |
| *** mnewby_ is now known as mnewby | 12:01 | |
| *** jrd-redhat has joined #openstack-dev | 12:10 | |
| *** mjfork has quit IRC | 12:17 | |
| *** mjfork has joined #openstack-dev | 12:18 | |
| *** apevec has quit IRC | 12:19 | |
| *** lifeless has joined #openstack-dev | 12:20 | |
| *** lts has joined #openstack-dev | 12:20 | |
| *** roge has joined #openstack-dev | 12:22 | |
| *** mjfork has quit IRC | 12:22 | |
| *** mjfork has joined #openstack-dev | 12:23 | |
| *** dolphm has joined #openstack-dev | 12:24 | |
| *** mjfork has quit IRC | 12:25 | |
| davidkranz | dansmith: You there? | 12:31 |
| *** thinrhi__ has quit IRC | 12:31 | |
| *** bla_ has joined #openstack-dev | 12:32 | |
| *** cloudvirt1 has joined #openstack-dev | 12:33 | |
| *** salv-orlando_ has joined #openstack-dev | 12:34 | |
| *** kbringard has joined #openstack-dev | 12:37 | |
| *** Xtrapni has joined #openstack-dev | 12:37 | |
| *** BLZbubba_ has joined #openstack-dev | 12:37 | |
| *** guitarza1 has joined #openstack-dev | 12:37 | |
| *** roge_ has joined #openstack-dev | 12:38 | |
| *** almaisan` has joined #openstack-dev | 12:40 | |
| *** kbringard has quit IRC | 12:40 | |
| *** roge has quit IRC | 12:42 | |
| *** cloudvirt has quit IRC | 12:42 | |
| *** salv-orlando has quit IRC | 12:42 | |
| *** almaisan-away has quit IRC | 12:42 | |
| *** dachary has quit IRC | 12:42 | |
| *** trapni has quit IRC | 12:42 | |
| *** openstackjenkins has quit IRC | 12:42 | |
| *** BLZbubba has quit IRC | 12:42 | |
| *** dabo has quit IRC | 12:42 | |
| *** guitarzan has quit IRC | 12:42 | |
| *** ogelbukh has quit IRC | 12:42 | |
| *** eafonichev has quit IRC | 12:42 | |
| *** ijw has quit IRC | 12:42 | |
| *** salv-orlando_ is now known as salv-orlando | 12:42 | |
| *** kbringard has joined #openstack-dev | 12:42 | |
| *** ijw has joined #openstack-dev | 12:44 | |
| *** eafonichev has joined #openstack-dev | 12:48 | |
| *** openstackjenkins has joined #openstack-dev | 12:48 | |
| *** dachary has joined #openstack-dev | 12:49 | |
| *** dabo has joined #openstack-dev | 12:49 | |
| *** Gordonz has joined #openstack-dev | 12:49 | |
| *** ijw has quit IRC | 12:50 | |
| *** ijw has joined #openstack-dev | 12:52 | |
| *** ogelbukh has joined #openstack-dev | 12:52 | |
| *** JStoker has quit IRC | 12:52 | |
| *** btorch has quit IRC | 12:52 | |
| *** btorch has joined #openstack-dev | 12:53 | |
| *** Gordonz has quit IRC | 12:54 | |
| *** macjack has joined #openstack-dev | 12:55 | |
| *** littleidea has joined #openstack-dev | 12:58 | |
| *** ijw has quit IRC | 12:58 | |
| *** rpedde_away is now known as rpedde | 13:00 | |
| *** ijw has joined #openstack-dev | 13:00 | |
| *** almaisan` is now known as al-maisan | 13:03 | |
| *** dprince has joined #openstack-dev | 13:05 | |
| *** cloudvirt1 has quit IRC | 13:07 | |
| sdague | davidkranz: dansmith is on PST, so expect him online in another hour or so | 13:08 |
| davidkranz | sdague: OK, thanks. | 13:08 |
| *** cloudvirt has joined #openstack-dev | 13:08 | |
| *** zhuadl has joined #openstack-dev | 13:12 | |
| *** k4n0 has left #openstack-dev | 13:15 | |
| *** JStoker has joined #openstack-dev | 13:16 | |
| *** apevec has joined #openstack-dev | 13:24 | |
| *** apevec has joined #openstack-dev | 13:24 | |
| *** guitarza1 is now known as guitarzan | 13:25 | |
| dansmith | davidkranz: and I'm in here too, your preference :) | 13:27 |
| dansmith | sdague: another hour? you know be better than that, don't you? :) | 13:27 |
| davidkranz | dansmith: Forgot to change channels. I sent an email to you and Daryl. I'm not sure what the current status is. | 13:27 |
| davidkranz | Was there agreement about how to proceed? | 13:28 |
| dansmith | davidkranz: I think daryl isn't quite happy that both sets of tests get run each time, but is willing to push them along to avoid blocking the effort | 13:28 |
| dansmith | which I'm extremely thankful for :) | 13:28 |
| dansmith | I understand his argument, but I think I agree with jaypipes that running them both makes the most sense | 13:29 |
| davidkranz | dansmith: I can push them through now if that was the decision. | 13:29 |
| dansmith | although understand if that needs to be trimmed for a faster gate or something | 13:29 |
| davidkranz | dansmith: We have spent a lot of time reducing the runtime for tempest. | 13:29 |
| dansmith | davidkranz: yeah, his comment to that effect was in the rest client patch, if you want to see it | 13:29 |
| dansmith | davidkranz: you'd officially make my weekend if you did :) | 13:30 |
| dansmith | (push them in, that is) | 13:30 |
| davidkranz | dansmith: It is ultimately a hopeless task as openstack functionality grows and grows. | 13:30 |
| dansmith | heh, yeah | 13:30 |
| davidkranz | dansmith: We need a way to "run all" of the tests that is not gating. | 13:30 |
| dansmith | yeah, I was thinking about that | 13:30 |
| dansmith | also, wondering: | 13:30 |
| dansmith | does openstack-ci run on top of openstack? it would ne nice to be able to fan out jenkins worker instances based on demand... | 13:31 |
| davidkranz | dansmith: It is possible for any organization to contribute to the jenkins pool by contributing hardware. | 13:31 |
| dansmith | ah, okay, I guess I need to brush up on that :) | 13:32 |
| davidkranz | dansmith: In the past I have used a nightly build with a rotating person on the hook to investigate any failures immediately. | 13:32 |
| davidkranz | dansmith: But the infrastructure has to be rock solid for that. | 13:32 |
| dansmith | davidkranz: yeah.. sdague had the idea of a nightly run that would also bisect failures and email the owner about the issue | 13:33 |
| davidkranz | dansmith: But it gets painful when there are flakey failures. | 13:33 |
| *** sniperd has quit IRC | 13:34 | |
| davidkranz | dansmith: I will push these through now. Does this impact the tests marked 'smoke' at all? | 13:35 |
| dansmith | davidkranz: several of the servers tests are 'smoke' ones, | 13:40 |
| dansmith | so it runs a few extra tests in that case, | 13:40 |
| dansmith | but I don't think it's a signficant increase in time | 13:40 |
| dansmith | oh, jeez, vincent rebased my patches on his branch in gerrit | 13:44 |
| dansmith | I hope that doesn't cause a problem | 13:44 |
| dansmith | sdague: I know that -R should help with that, but was there a fix coming to gerrit itself to prevent that by non-admins? | 13:45 |
| *** zhuadl has quit IRC | 13:49 | |
| *** bla_ has left #openstack-dev | 13:51 | |
| *** shang has quit IRC | 13:56 | |
| *** JStoker has quit IRC | 13:56 | |
| *** zaneb has quit IRC | 13:57 | |
| *** sniperd has joined #openstack-dev | 13:57 | |
| *** zaneb has joined #openstack-dev | 13:57 | |
| sdague | dansmith: the ci tests are running on openstack clouds, they get spun up in parallel | 13:59 |
| sdague | that might have been why daryl wanted seperate xml / json flags, so they could be run in parallel instead of in series | 13:59 |
| dansmith | sdague: it just seems like when the queue is long, the time it takes to get an answer from jenkins is proportional | 14:00 |
| *** mtreinish has joined #openstack-dev | 14:00 | |
| dansmith | sdague: perhaps, but I don't think that's what jaypipes was expecting | 14:00 |
| sdague | dansmith: at some point they run out of quota on their clouds | 14:00 |
| dansmith | sdague: okay, it just didn't seem to be anything other than linear from my eyeball measurements, but fair enough | 14:01 |
| sdague | mtaylor, jeblair, or LinuxJedi could share more about it, that's just want I've picked up from them | 14:02 |
| *** JStoker has joined #openstack-dev | 14:04 | |
| *** tgall_foo has joined #openstack-dev | 14:06 | |
| *** tgall_foo has quit IRC | 14:06 | |
| *** tgall_foo has joined #openstack-dev | 14:06 | |
| *** ewindisch has joined #openstack-dev | 14:08 | |
| *** Ruetobas has joined #openstack-dev | 14:08 | |
| *** EmilienM has quit IRC | 14:08 | |
| *** EmilienM has joined #openstack-dev | 14:09 | |
| *** jimfehlig has joined #openstack-dev | 14:10 | |
| *** daddyjoseph97 has joined #openstack-dev | 14:13 | |
| *** e1mer has quit IRC | 14:14 | |
| *** samkottler is now known as samkottler|brb | 14:16 | |
| *** ewindisch has quit IRC | 14:18 | |
| *** e1mer has joined #openstack-dev | 14:20 | |
| *** andrea__ has quit IRC | 14:21 | |
| *** andrea__ has joined #openstack-dev | 14:21 | |
| *** garyk has joined #openstack-dev | 14:23 | |
| *** samkottler|brb is now known as samkottler | 14:23 | |
| *** andrewbogott_afk is now known as andrewbogott | 14:26 | |
| *** sacharya has joined #openstack-dev | 14:27 | |
| jeblair | dansmith: hi | 14:27 |
| jeblair | dansmith: zuul tells jenkins to run tests in parallel | 14:28 |
| jeblair | dansmith: don't limit the number of tests that tempest runs when gating on account of run-time; we'll spin up as many vms as we need. | 14:30 |
| *** creiht has joined #openstack-dev | 14:30 | |
| *** ChanServ sets mode: +v creiht | 14:30 | |
| *** dwalleck has joined #openstack-dev | 14:33 | |
| *** salv-orlando has quit IRC | 14:34 | |
| *** samkottler has quit IRC | 14:35 | |
| *** samkottler has joined #openstack-dev | 14:35 | |
| *** Exhar has quit IRC | 14:49 | |
| *** rnirmal has joined #openstack-dev | 14:49 | |
| *** jtran has joined #openstack-dev | 14:51 | |
| *** sniperd has quit IRC | 14:52 | |
| *** sniperd has joined #openstack-dev | 14:52 | |
| *** cloudvirt has quit IRC | 14:52 | |
| *** sniperd has joined #openstack-dev | 14:53 | |
| *** datsun180b has joined #openstack-dev | 14:53 | |
| *** andrewsmedina has joined #openstack-dev | 14:56 | |
| *** andrewsmedina has quit IRC | 14:58 | |
| *** al-maisan is now known as almaisan-away | 14:58 | |
| *** andrewsmedina has joined #openstack-dev | 14:58 | |
| *** cloudvirt has joined #openstack-dev | 15:00 | |
| *** Gordonz has joined #openstack-dev | 15:01 | |
| *** Gordonz has quit IRC | 15:03 | |
| *** rods1 has joined #openstack-dev | 15:03 | |
| *** Gordonz has joined #openstack-dev | 15:03 | |
| *** JStoker has quit IRC | 15:06 | |
| *** maoy has joined #openstack-dev | 15:07 | |
| *** sniperd_ has joined #openstack-dev | 15:08 | |
| *** JStoker has joined #openstack-dev | 15:08 | |
| *** sniperd has quit IRC | 15:08 | |
| *** Exhar has joined #openstack-dev | 15:16 | |
| *** e1mer has quit IRC | 15:16 | |
| *** cp16net is now known as cp16net|away | 15:19 | |
| *** cloudvirt has quit IRC | 15:20 | |
| *** cp16net|away is now known as cp16net | 15:21 | |
| *** Exhar has quit IRC | 15:21 | |
| *** markmc has quit IRC | 15:21 | |
| *** littleidea has quit IRC | 15:22 | |
| *** derekh has quit IRC | 15:23 | |
| *** littleidea has joined #openstack-dev | 15:24 | |
| *** mindpixel has quit IRC | 15:24 | |
| *** nunosantos has joined #openstack-dev | 15:25 | |
| *** dwalleck has quit IRC | 15:25 | |
| *** AlanClark has joined #openstack-dev | 15:26 | |
| *** dachary has quit IRC | 15:28 | |
| *** dachary1 has joined #openstack-dev | 15:28 | |
| *** molten has joined #openstack-dev | 15:29 | |
| *** rods1 has quit IRC | 15:30 | |
| molten | mtaylor, jeblair: hey, I'm having issues with Gerrit, can't set my username so I can't push a change set | 15:30 |
| *** dachary1 is now known as dachary | 15:32 | |
| jeblair | molten: you don't need to set your username, there's a sync script that does it for you | 15:32 |
| *** dachary has quit IRC | 15:32 | |
| *** dachary has joined #openstack-dev | 15:32 | |
| jeblair | molten: what is the account id on this page? | 15:32 |
| jeblair | https://review.openstack.org/#/settings/ | 15:32 |
| molten | jeblair: 5387 | 15:32 |
| jeblair | molten: and what's your launchpad username? | 15:33 |
| molten | jeblair: andrew-melton | 15:33 |
| *** EmilienM has quit IRC | 15:35 | |
| *** EmilienM has joined #openstack-dev | 15:36 | |
| *** lloydde has joined #openstack-dev | 15:36 | |
| *** johnpur has joined #openstack-dev | 15:36 | |
| *** ChanServ sets mode: +v johnpur | 15:36 | |
| *** daddyjoseph97 has quit IRC | 15:37 | |
| jeblair | molten: you should be all set now | 15:40 |
| molten | jeblair: kk thanks! | 15:41 |
| *** dspano has joined #openstack-dev | 15:41 | |
| *** daddyjoseph97 has joined #openstack-dev | 15:42 | |
| *** Exhar has joined #openstack-dev | 15:42 | |
| *** heckj has joined #openstack-dev | 15:44 | |
| *** salgado is now known as salgado-lunch | 15:46 | |
| *** daddyjoseph97 has quit IRC | 15:47 | |
| *** macjack has quit IRC | 15:48 | |
| *** maoy has quit IRC | 15:49 | |
| *** markmcclain has joined #openstack-dev | 15:53 | |
| *** maoy has joined #openstack-dev | 15:56 | |
| molten | jeblair: having more issues, i get this trying to run git review: "Exception: Could not connect to gerrit at ssh://andrew-melton@review.openstack.org:29418/openstack/glance.git" | 15:57 |
| *** datsun180b_ has joined #openstack-dev | 16:01 | |
| *** Exhar has quit IRC | 16:01 | |
| *** dwalleck has joined #openstack-dev | 16:01 | |
| jeblair | molten: ssh -p 29418 andrew-melton@review.openstack.org gerrit ls-projects | 16:03 |
| jeblair | molten: what does that get you? | 16:03 |
| *** datsun180b_ has quit IRC | 16:03 | |
| jeblair | molten: make sure your public key is listed here: https://review.openstack.org/#/settings/ssh-keys | 16:03 |
| *** datsun180b has quit IRC | 16:04 | |
| molten | jeblair: yup, it's listed | 16:04 |
| *** daddyjoseph97 has joined #openstack-dev | 16:04 | |
| molten | that call still gets me "Permission denied (publickey)." | 16:04 |
| jeblair | molten: Gerrit says "no-matching-key" in the error log. | 16:06 |
| molten | let me redo the key | 16:06 |
| molten | jeblair: there we go, must have been a copy-paste error | 16:07 |
| jeblair | molten: cool | 16:07 |
| *** hemna has joined #openstack-dev | 16:13 | |
| *** Exhar has joined #openstack-dev | 16:17 | |
| *** darraghb has quit IRC | 16:18 | |
| *** Exhar has quit IRC | 16:21 | |
| *** dubsquared has joined #openstack-dev | 16:26 | |
| *** ewindisch has joined #openstack-dev | 16:28 | |
| *** ewindisch has quit IRC | 16:31 | |
| *** samkottler is now known as samkottler|bbiab | 16:32 | |
| *** matwood has joined #openstack-dev | 16:37 | |
| *** timbock2 has quit IRC | 16:37 | |
| *** dwalleck has quit IRC | 16:40 | |
| *** wiliam has quit IRC | 16:45 | |
| *** salgado-lunch is now known as salgado | 16:49 | |
| *** Mandell has joined #openstack-dev | 16:49 | |
| *** rods1 has joined #openstack-dev | 16:54 | |
| devananda | jgriffith: you may be intrested in the comment i just posted on bug 1007038. | 16:57 |
| uvirtbot | Launchpad bug 1007038 in nova "Nova is issuing unnecessary ROLLBACK statements to MySQL" [Low,Confirmed] https://launchpad.net/bugs/1007038 | 16:57 |
| jgriffith | devananda: Thanks... just saw the update notification but haven't had a chance to read it yet. | 16:57 |
| *** spiffxp has joined #openstack-dev | 16:59 | |
| jgriffith | devananda: Interesting... | 16:59 |
| devananda | jgriffith: i fixed my fix to the other bug (SELECT 1 spam), but can't fix this one :( | 17:00 |
| *** dubsquared has quit IRC | 17:01 | |
| jgriffith | devananda: seems like the pragmatic way to go | 17:01 |
| *** cp16net is now known as cp16net|away | 17:01 | |
| *** cp16net|away is now known as cp16net | 17:04 | |
| *** zing has quit IRC | 17:04 | |
| ayoung | dolphm, heckj, do we have a plan in place to deal with "Token in URL is a security risk" for Folsom? | 17:05 |
| ayoung | Is there something we can do short of V3> | 17:05 |
| heckj | ayoung: definitely -it's the V3 API updates to Token | 17:05 |
| ayoung | heckj, yeah, but V3 is not going into folsom | 17:05 |
| heckj | ayoung: sorry, I read grizzly when you said folsom | 17:06 |
| ayoung | or can we grab just that piece? | 17:06 |
| *** thingee_zz is now known as thingee | 17:06 | |
| heckj | ayoung: at this point, no freakin' way. | 17:06 |
| heckj | ayoung: any change there is going to have massive impact across all the components and clients | 17:06 |
| heckj | ayoung: the change we need to do is changing the API - it's relatively simple, but the impact spreads across all the projects. | 17:07 |
| ayoung | heckj, sure ,but what if we added the ability toi verify outside the URL and left it at that | 17:07 |
| ayoung | so that people have the alternative API available if the issue impacts them | 17:07 |
| *** troytoman-away is now known as troytoman | 17:08 | |
| ayoung | ie, just add in the V3 API for verification | 17:08 |
| *** alex88 has quit IRC | 17:08 | |
| heckj | ayoung: if we weren't in the lock down/no features time of these release, that would be fine - but the issue really isn't solved until the defaults for all the clients and such have been changed to NOT use the existing V2 API setup | 17:08 |
| ayoung | yeah, I realize that...just hate leavin an issue like that unresolved through a major release. | 17:10 |
| heckj | ayoung: I understand. I do too - there's just a bug deeply endemic to the API structure - it's one of those "A lot tougher to unwind" bugs | 17:10 |
| ayoung | K | 17:11 |
| heckj | ayoung: another reason to get rolling with the feature branch to push on that and make it available quickly for grizzly | 17:11 |
| ayoung | heckj, so what is priority of effort now? | 17:11 |
| ayoung | looks like all open reviews have been dealt with | 17:12 |
| heckj | ayoung: first priority - any bugs/tracebacks in stabilizing Folsom release. Second, V3 API implementation and feature work there | 17:12 |
| clayg | rpedde: wkelly: ping | 17:12 |
| heckj | ayoung: actually, it would be worth having you take a look through the bugs that are open and seeing if you spot any that I categorized lower (or higher) than you think appropriate | 17:13 |
| ayoung | heckj, doing so now | 17:13 |
| *** molten has quit IRC | 17:13 | |
| dolphm | heckj: let me know if there's any bugs you want me to tackle, otherwise i'm focusing on v3 | 17:13 |
| heckj | dolphm: I think you're already tackling this one: https://bugs.launchpad.net/keystone/+bug/1040626 - let me know if not | 17:14 |
| *** titankiller has joined #openstack-dev | 17:14 | |
| dolphm | heckj: that's actually merged | 17:14 |
| ayoung | heckj, that is fixed in Folsom,. needs to be backproted. Want me to tkae that? | 17:14 |
| dolphm | heckj: i don't think jenkins had permission to update the bug or something? | 17:14 |
| heckj | dolphm: should I change the status to FixCOmmitted? | 17:14 |
| wkelly | clayg: sup!? | 17:14 |
| dolphm | ayoung: stable/essex patch is a diff in the bug report | 17:15 |
| dolphm | heckj: sure | 17:15 |
| dolphm | ayoung: as requested by ttx | 17:15 |
| heckj | dolphm: thanks, done | 17:15 |
| dolphm | ayoung: apparently i shouldn't have gone straight for gerrit :-/ i know for next time | 17:15 |
| ayoung | dolphm, shouldn't it be submitted to Gerrit now, then? | 17:15 |
| dolphm | ayoung: for stable/essex? | 17:16 |
| ayoung | dolphm, yes | 17:16 |
| clayg | wkelly: pm, thanks | 17:16 |
| *** clayg has left #openstack-dev | 17:16 | |
| dolphm | ayoung: ttx wanted a diff, that's all | 17:16 |
| *** clayg has joined #openstack-dev | 17:16 | |
| *** nati_ueno has quit IRC | 17:17 | |
| *** nati_ueno has joined #openstack-dev | 17:17 | |
| ayoung | dolphm, ah. Ok. I'll leave that alone for now. Looks like it is taken care of. | 17:17 |
| dolphm | ayoung: so, i deleted that banana, btw. if we want it to land, i need help with the ldap driver | 17:18 |
| *** kyriakos has quit IRC | 17:18 | |
| dolphm | ayoung: https://review.openstack.org/#/c/11935/ | 17:20 |
| ayoung | dolphm, looking | 17:20 |
| *** epim has joined #openstack-dev | 17:20 | |
| ayoung | dolphm, OK, let me pull | 17:20 |
| *** colinmcnamara has joined #openstack-dev | 17:20 | |
| dolphm | ayoung: i started down this whole path because things get more complex with both user-domain and user-tenant relationships in v3 -- i figure simplify what we have to manage now, and then building v3 on top will be easier | 17:20 |
| ayoung | dolphm, so that is V3/Grizzly stuff, right? | 17:21 |
| heckj | dolphm: just tried to load that review, said I didn't have permissions? | 17:21 |
| *** daddyjoseph97 has quit IRC | 17:21 | |
| heckj | oh - I need ot be logged in to see it | 17:22 |
| dolphm | heckj: it's a draft, but i added you | 17:22 |
| dolphm | ayoung: i'd like to rebase my v3 impl on top of this, yes | 17:22 |
| *** epim has quit IRC | 17:22 | |
| *** epim_ has joined #openstack-dev | 17:22 | |
| ayoung | dolphm, OK. Let me tackle the ldap failures | 17:22 |
| ayoung | dolphm, so the first test fails becasue there is no longer a tenant_id in the response to authenticate? | 17:23 |
| ayoung | AssertionError: {'id': 'foo', 'name': 'FOO'} != {'tenant_id': 'bar', 'id': 'foo', 'name': 'FOO'} | 17:23 |
| ayoung | That is a general purpose test, run the same across all of the backends | 17:24 |
| dolphm | ayoung: yeah, i'm not clear on why | 17:25 |
| dolphm | ayoung: if you look in the diffs of the other drivers (kvs and sql, at least)... i made a couple specific changes | 17:26 |
| dolphm | ayoung: removed the add_user_to_tenant() and remove_user_from_tenant() calls (and removed everything from the rest of keystone that called those) | 17:26 |
| dolphm | ayoung: create_user() needs to store the tenant_id attribute passed in (in SQL, i just made it an indexed column on the User table) | 17:26 |
| ayoung | dolphm, I think the Gorillas are starting to close in | 17:26 |
| ayoung | we need to keep this API as is for V2. How are we going to split it for V3? | 17:26 |
| dolphm | ayoung: and then there's a couple calls for listing users in a specific tenant and listing tenants a user has access to -- how those lists are populated needs to be updated | 17:27 |
| dolphm | ayoung: none of this is exposed via rest | 17:27 |
| ayoung | ah | 17:27 |
| dolphm | ayoung: the only place it's "exposed" is by legacy nova auth migrations, which i also updated in that patch | 17:27 |
| ayoung | heckj, is anything done with user/tenant assignments OUTSIDE of the roles? dolphm and I think not. termie can you chime in as well? | 17:28 |
| dolphm | bcwaldon: could use your feedback on that bit, as you wrote the migration code ^^ | 17:28 |
| bcwaldon | dolphm: werr? | 17:28 |
| dolphm | bcwaldon: in nova legacy auth, i think there were (are?) user-tenant relationships outside of role assignments -- is that correct? | 17:28 |
| bcwaldon | dolphm: yes | 17:29 |
| bcwaldon | dolphm: BUT legacy auth is gone | 17:29 |
| bcwaldon | dolphm: so feel free to blow things away | 17:29 |
| dolphm | bcwaldon: still need to support migrations from legacy auth to keystone past folsom? | 17:29 |
| heckj | ayoung: I don't believe so, but I'd need to re-read through the code to be 100% | 17:29 |
| *** maurosr has joined #openstack-dev | 17:30 | |
| bcwaldon | dolphm: hmm | 17:31 |
| bcwaldon | dolphm: what things are in keystone only for nover? | 17:31 |
| bcwaldon | dolphm: and I have to walk out the door right now | 17:31 |
| bcwaldon | dolphm: so can this wait until later today? | 17:31 |
| dolphm | bcwaldon: essentially a table that stores arbitrary user-tenant relationships, without specific role assignments | 17:31 |
| bcwaldon | dolphm: you can control everything below the API, so if that isnt useful for you feel free to ignore it | 17:32 |
| dolphm | bcwaldon: well, the nova migration probably put user-tenant pairs into that table that aren't otherwise modeled in keystone, so i can't just blow the table away in a migration without moving that data into the user-tenant-role model | 17:33 |
| *** EmilienM has quit IRC | 17:33 | |
| bcwaldon | dolphm: sorry, gotta run | 17:33 |
| *** EmilienM has joined #openstack-dev | 17:33 | |
| dolphm | bcwaldon: no worries, ping me later | 17:33 |
| *** EmilienM has quit IRC | 17:34 | |
| *** EmilienM has joined #openstack-dev | 17:34 | |
| * dolphm runs off to grab lunch | 17:34 | |
| *** dolphm has quit IRC | 17:34 | |
| jtran | what do i do to troubleshoot a ceilometer-gate problem , when the tests all pass locally ? From the full console , i can see where it's failing but i cannot reproduce it locally to fix it | 17:37 |
| *** zaneb has quit IRC | 17:39 | |
| *** zaneb has joined #openstack-dev | 17:40 | |
| colinmcnamara | Dumb question, I screwed up my launchpad login (changed username) and had to re-submit a contributors agreement. How long does it take for the openstack-cla group to get approved? (I have code I need to submit for review) | 17:42 |
| *** rbasak has quit IRC | 17:42 | |
| colinmcnamara | username is colinmcnamara | 17:42 |
| kbringard | any horizon devs gotta few moments? | 17:45 |
| *** dwalleck has joined #openstack-dev | 17:46 | |
| *** EmilienM has quit IRC | 17:49 | |
| *** EmilienM has joined #openstack-dev | 17:50 | |
| *** dwalleck has quit IRC | 17:51 | |
| *** PotHix has joined #openstack-dev | 17:52 | |
| ayoung | heckj, for dolphm's issue: could we make a default role in the tenant for migration that indicates whatever Nova's membership meant? | 17:54 |
| *** Ryan_Lane has joined #openstack-dev | 17:55 | |
| *** utlemming has quit IRC | 17:56 | |
| *** utlemming has joined #openstack-dev | 17:56 | |
| kbringard | jakedahn_zz: if you happen to wake up in the next 4 or so hours, let me know | 17:56 |
| colinmcnamara | kbringard - I've been poking around horizon, whats up? | 17:56 |
| heckj | ayoung: I think that's a good idea | 17:56 |
| *** markmcclain has quit IRC | 17:56 | |
| kbringard | colinmcnamara: it looks like there's a bug in the ec2 credential generation/retrieval | 17:57 |
| kbringard | I think I've figured out what's wrong, but not really sure the best way to go about fixing it | 17:57 |
| ayoung | heckj, are you familiar with the old Nova code? What did membership in a tenant mean before? And do we need to carry that over during a migration? | 17:57 |
| *** adjohn has joined #openstack-dev | 17:58 | |
| *** almaisan-away is now known as al-maisan | 17:58 | |
| kbringard | colinmcnamara: this is in essex… if you look at line 67 in dashboard/settings/ec2/forms.py | 17:58 |
| *** adjohn has quit IRC | 17:59 | |
| kbringard | http://paste.openstack.org/show/20470/ | 17:59 |
| colinmcnamara | ok, let me check out he essex code | 17:59 |
| heckj | ayoung: not super familiar - but it was a basic role that didn't confer any specific attributes - it was the "not an admin" relationship that had been previously defined | 17:59 |
| *** adjohn has joined #openstack-dev | 17:59 | |
| kbringard | if keys doesn't exist, it'll generate them | 17:59 |
| kbringard | if it does, it'll always return element 0 | 17:59 |
| kbringard | which doesn't work if the user is a member of more than one tenant | 17:59 |
| *** bitblt has joined #openstack-dev | 18:00 | |
| kbringard | so the end result is that in the dashboard, no matter what tenant you select to download your ec2 keys for, you'll always get the keys for the first tenant you genned keys for (or well, the first tenant keystone returns, but I assume it's doing it in order of creation) | 18:00 |
| colinmcnamara | that makes sense | 18:01 |
| *** jog0 has joined #openstack-dev | 18:01 | |
| *** markmcclain has joined #openstack-dev | 18:01 | |
| colinmcnamara | vs getting keys for each individual tennant | 18:01 |
| kbringard | right, sure, but then that info is what gets passed to | 18:01 |
| kbringard | keys = find_or_create_access_keys(request, data.get('tenant')) | 18:02 |
| kbringard | context = {'ec2_access_key': keys.access, | 18:02 |
| kbringard | on line 80 | 18:02 |
| kbringard | so when it creates the zip file | 18:02 |
| kbringard | it's always got the keys from the first tenant | 18:02 |
| bitblt | hey, has anyone had their horizon logins just stop working? I started getting "'NoneType' is not iterable (HTTP 500)" errors. it looks like it can't get a list of tenants from keystone maybe? | 18:02 |
| kbringard | so the end result is you can't get keys for any other tenant in the dashboard | 18:02 |
| colinmcnamara | and in the design docs, you are supposed to be able to gen access keys per tenant | 18:04 |
| colinmcnamara | even though having a user may belong to multiple tenants | 18:04 |
| kbringard | I only just started looking into it, but it seems like you'd just want to iterate over the array and return the position that matches the tenant the user requested | 18:04 |
| *** jtran has quit IRC | 18:05 | |
| kbringard | instead of just indiscriminately returning position 0 | 18:05 |
| *** nati_ueno_2 has joined #openstack-dev | 18:05 | |
| colinmcnamara | that sounds right | 18:06 |
| colinmcnamara | so, this is for essex | 18:06 |
| kbringard | but I don't know enough about the whole process to know why position 0 is always returned… if that was just an oversight or if that was done on purpose for some reason | 18:06 |
| colinmcnamara | I think in folsom though we are going to be requesting that data from keystone right? | 18:06 |
| colinmcnamara | I don't know the answer, but I am guessing oversight | 18:07 |
| *** nati_ueno has quit IRC | 18:09 | |
| *** salgado is now known as salgado-afk | 18:11 | |
| *** tgall_foo has quit IRC | 18:16 | |
| *** datsun180b has joined #openstack-dev | 18:17 | |
| *** nati_ueno_2 has quit IRC | 18:21 | |
| *** nati_ueno has joined #openstack-dev | 18:22 | |
| *** nati_ueno has quit IRC | 18:22 | |
| *** ewindisch has joined #openstack-dev | 18:24 | |
| *** ewindisch_ has joined #openstack-dev | 18:26 | |
| *** jtran has joined #openstack-dev | 18:27 | |
| *** ewindisch has quit IRC | 18:29 | |
| *** ewindisch_ is now known as ewindisch | 18:29 | |
| *** negronjl has quit IRC | 18:30 | |
| *** negronjl has joined #openstack-dev | 18:31 | |
| *** andrewbogott is now known as andrewbogott_afk | 18:34 | |
| *** apevec has quit IRC | 18:36 | |
| *** bitblt has quit IRC | 18:37 | |
| *** heckj has quit IRC | 18:41 | |
| *** heckj has joined #openstack-dev | 18:44 | |
| *** heckj has quit IRC | 18:44 | |
| *** mrunge has quit IRC | 18:45 | |
| *** andrewbogott_afk is now known as andrewbogott | 18:45 | |
| *** ewindisch has quit IRC | 18:46 | |
| *** ewindisch has joined #openstack-dev | 18:49 | |
| *** ewindisch has quit IRC | 18:52 | |
| *** ewindisch_ has joined #openstack-dev | 18:52 | |
| *** EmilienM has quit IRC | 18:52 | |
| *** dolphm has joined #openstack-dev | 19:03 | |
| *** markmcclain has quit IRC | 19:04 | |
| *** lifeless has quit IRC | 19:09 | |
| *** lifeless has joined #openstack-dev | 19:10 | |
| *** adjohn has quit IRC | 19:15 | |
| dolphm | can jenkins run a draft review? | 19:18 |
| *** jkoelker has quit IRC | 19:19 | |
| *** jkoelker has joined #openstack-dev | 19:22 | |
| *** dwalleck has joined #openstack-dev | 19:25 | |
| clarkb | dolphm: I don't think so as draft events are hidden from zuul. What you can do is publish the draft, then change it to work in progress | 19:25 |
| clarkb | work in progress is like a public draft | 19:25 |
| *** rods1 has quit IRC | 19:25 | |
| ayoung | dolphm, so for migrations now we should define an default "not and admin" role and use that to replace membership | 19:28 |
| *** dwalleck_ has joined #openstack-dev | 19:28 | |
| dolphm | ayoung: if necessary, yeah | 19:28 |
| dolphm | ayoung: i don't think we need it outside of migrations | 19:28 |
| dolphm | clarkb: thanks | 19:29 |
| ayoung | dolphm, so, why would we grant access to someone if they were not an admin? | 19:29 |
| *** dwalleck has quit IRC | 19:29 | |
| *** colinmcnamara has quit IRC | 19:29 | |
| ayoung | I mean, isn't openstack essetial an admin tool? | 19:29 |
| dolphm | ayoung: to a tenant? | 19:29 |
| ayoung | yeah | 19:29 |
| ayoung | I mean, other than "cycle the power" don't you need admin to do anything interesting? | 19:30 |
| dolphm | ayoung: 'access' depends on the details of policy, no? | 19:30 |
| ayoung | dolphm, so, right now, with the membership stuff, doesn;'t that essentially deny the user the ability to do anything to the tenant? They have to have a role, so migrating them into member is essentially disabling their tenant access | 19:31 |
| dolphm | ayoung: hopefully 'member' is an exceptional case ... in that most records in the membership table represent "default tenancy" | 19:32 |
| dolphm | ayoung: which i'm moving to the User.tenant_id attribute | 19:32 |
| ayoung | hmmmm | 19:33 |
| *** markmcclain has joined #openstack-dev | 19:33 | |
| ayoung | dolphm, that seems like a stretch for an assumption. Anything to back it up? | 19:33 |
| dolphm | ayoung: i'm thinking the migration to remove the UserTenantMembership table will go like this... | 19:34 |
| dolphm | ayoung: 1) if the user has a role on the tenant already, it's safe to delete the record of Membership | 19:34 |
| *** dwalleck_ has quit IRC | 19:34 | |
| dolphm | ayoung: 2) if the user has no role on the tenant, make it their default tenant | 19:34 |
| dolphm | ayoung: 3) if they already have a default tenant... grant the 'member' role (creating such a role only if necessary) | 19:35 |
| dolphm | 4) nuke the membership table :) | 19:35 |
| ayoung | dolphm, that makes it a little order dependant, no? | 19:35 |
| dolphm | ayoung: yeah -- not sure how else to handle it? | 19:36 |
| dolphm | ayoung: go back and revoke default tenancy and grant 'member' role twice? | 19:36 |
| ayoung | dolphm, so there was no comparable concpet to default tenant in Nova before hand? | 19:36 |
| dolphm | ayoung: or just panic and sqldump | 19:36 |
| dolphm | ayoung: i think 'membership' is what the idea of 'default tenancy' grew out of -- however, we use it for a default authentication scope now | 19:37 |
| *** maurosr has quit IRC | 19:37 | |
| dolphm | ayoung: and i don't think there was anything in nova legacy auth that prevented you from having multiple memberships | 19:38 |
| dolphm | ayoung: so the concepts aren't 1:1 | 19:38 |
| dolphm | (1:1 as in analogous to each other) | 19:38 |
| ayoung | dolphm, OK, but should we have a parking lot for any user that does not have a default tenant_id then:? | 19:39 |
| dolphm | ayoung: what do you mean? | 19:39 |
| ayoung | dolphm, well, if we migrate someone, and they don't have any tenants in Nova, they end up in Limbo in Keystone, right? | 19:40 |
| ayoung | Or, is that acceptable? | 19:40 |
| *** jkoelker_ has joined #openstack-dev | 19:45 | |
| *** thinrhino has joined #openstack-dev | 19:45 | |
| *** jkoelker_ has quit IRC | 19:47 | |
| *** dwalleck has joined #openstack-dev | 19:47 | |
| dolphm | ayoung: you mean they don't have any tenants, period? | 19:51 |
| ayoung | dolphm, yeah | 19:51 |
| dolphm | ayoung: nothing would change for them, right? | 19:51 |
| ayoung | yeah | 19:51 |
| ayoung | so no problem | 19:52 |
| dolphm | ayoung: they didn't have any membership records before, they don't get anything new | 19:52 |
| ayoung | the only issue would be what if a user got the wrong default? THat should be OK, but who could change it for them? | 19:52 |
| dolphm | ayoung: what would make it wrong? | 19:52 |
| dolphm | ayoung: we could also avoid setting User.tenant_id and just grant lots of 'member' roles, and market it as the new hotness | 19:53 |
| ayoung | dolphm, let me restate. How would a user go about changing their default tenant_id? | 19:53 |
| dolphm | ayoung: in v2, that'd be admin | 19:54 |
| dolphm | ayoung: in v3, it could be doable with a policy.json allowing a user to update themselves | 19:54 |
| *** Exhar has joined #openstack-dev | 19:54 | |
| ayoung | dolphm, OK...I think your logic works | 19:54 |
| dolphm | PATCH /users/{my_user_id}: {'user': {'tenant_id': 'my-preferred-default'}} | 19:55 |
| dolphm | dashboard users of course expect to be able to set their own passwords ^^ a *major* reason i don't want to split the identity api into two halves ... the dividing line between halves is going to be blurry and fought over | 19:56 |
| *** dwalleck has quit IRC | 19:57 | |
| dolphm | ayoung: what would you rather do, set default tenancy or *just* grant 'member' | 19:57 |
| *** dwalleck has joined #openstack-dev | 19:58 | |
| dolphm | ayoung: and i'm still curious about how all this is going to work in ldap? :) | 19:58 |
| ayoung | dolphm, in LDAP, we drop the members attribute | 19:58 |
| ayoung | default tenant_id is stored in... | 19:58 |
| *** dprince has quit IRC | 19:59 | |
| ayoung | um, default tenant_id is not stored in LDAP | 20:00 |
| ayoung | is it even necessary? | 20:00 |
| *** dwalleck has quit IRC | 20:01 | |
| *** rkukura has quit IRC | 20:01 | |
| *** EmilienM has joined #openstack-dev | 20:01 | |
| *** rkukura has joined #openstack-dev | 20:01 | |
| *** dwalleck has joined #openstack-dev | 20:02 | |
| dolphm | ayoung: lol i'd call it a convenience, personally | 20:02 |
| dolphm | ayoung: i would drop it all together if i could, and just return a list of tokens on POST /tokens | 20:03 |
| *** salgado-afk is now known as salgado | 20:04 | |
| ayoung | dolphm, this is what I have to work with http://www.fpaste.org/NMmX/ | 20:04 |
| dolphm | ayoung: obviously it belongs in homePhone | 20:05 |
| ayoung | dolphm, which descends from http://www.fpaste.org/ptSh/ | 20:05 |
| *** dwalleck has quit IRC | 20:06 | |
| ayoung | actually, I guess I could have gone with organizationalPerson...thought I had | 20:06 |
| *** Exhar has quit IRC | 20:11 | |
| *** al-maisan is now known as almaisan-away | 20:12 | |
| *** novas0x2a|laptop has joined #openstack-dev | 20:16 | |
| dolphm | ayoung: ldap changes more or less complicated than corresponding sql changes? | 20:16 |
| *** openstackgerrit has quit IRC | 20:18 | |
| *** openstackgerrit has joined #openstack-dev | 20:18 | |
| *** dwalleck has joined #openstack-dev | 20:20 | |
| ayoung | dolphm, I think comparable...still looking. Not sure where the tenant_id change you made comes from | 20:21 |
| ayoung | Oh, I might have been reading it backward | 20:22 |
| ayoung | ok, so you are *adding* tenant_id to the user object, not removing it. Um..can I veto that? | 20:23 |
| ayoung | how was default tenant recorded in sql before? | 20:24 |
| *** sniperd_ has quit IRC | 20:27 | |
| ayoung | dolphm, yeah, I don't see any reason to put tenant_id in the user table. If anything, we want to move away from default tenant_id, I think | 20:28 |
| ayoung | AFAICT it is a poor mans "preferences" for the web UI. | 20:28 |
| vishy | annegentle: responded on: https://review.openstack.org/#/c/11263/ | 20:30 |
| *** roge_ has quit IRC | 20:31 | |
| *** japage has quit IRC | 20:31 | |
| *** roge has joined #openstack-dev | 20:34 | |
| dolphm | ayoung: accurate description, imo | 20:40 |
| ayoung | dolphm, so, lets leave it out of V3? | 20:41 |
| dolphm | ayoung: well... you won't get disagreement from me... | 20:41 |
| annegentle | vishy: thx that's a small list so far :) | 20:43 |
| dolphm | ayoung: i'd still be nice to have a way to auth in a single call though, without knowing a tenant id/name | 20:44 |
| dolphm | ayoung: so, we'll get less resistance dropping that feature if we have another solution for that use case ^ (returning a list of tokens is my suggestion, i know i've heard of another?) | 20:45 |
| ayoung | dolphm, I am tending to disagree. I've been thinking that auth should be specific to the tenant you want....there is a nice separation of concerns where you use userid-password to get unscoped token, and only unscoped to get a scoped token | 20:45 |
| dolphm | ayoung: as in, authn vs authz? | 20:47 |
| ayoung | then we can add an additional type of token for cross domain requests | 20:47 |
| *** Exhar has joined #openstack-dev | 20:47 | |
| ayoung | dolphm, yes | 20:47 |
| *** chrisfer has quit IRC | 20:47 | |
| ayoung | But maybe I've lived in the kerberos world for too long | 20:48 |
| dolphm | ayoung: not disagreeing, but it's 3 calls :-/ ... POST /tokens, GET /users/{user_id}/tenants, POST /tokens | 20:49 |
| *** thinrhino has quit IRC | 20:49 | |
| dolphm | i wonder how many users don't actually know their tenant id/name from the beginning, and actually go through the entire flow? | 20:50 |
| Ryan_Lane | having to get tenant tokens is annoying | 20:50 |
| Ryan_Lane | it's especially annoying that they also embed the role info into them | 20:50 |
| ayoung | Ryan_Lane, security is annoying | 20:50 |
| dolphm | GET /users/{user_id}/projects* | 20:50 |
| Ryan_Lane | if I modify a user's roles, their old tokens are now invalid | 20:51 |
| ayoung | passing userid password around is not the best practice | 20:51 |
| Ryan_Lane | ayoung: how's it more secure? | 20:51 |
| Ryan_Lane | it's less secure imo | 20:51 |
| Ryan_Lane | what happens when they user is disabled? | 20:51 |
| Ryan_Lane | are all of their tenant tokens still valid? | 20:51 |
| ayoung | nope | 20:51 |
| ayoung | they are all invalidated | 20:51 |
| Ryan_Lane | I'm still not seeing how tenant tokens are more secure | 20:52 |
| dolphm | how would username/password be different in the case of a user being disabled? | 20:52 |
| Ryan_Lane | embeded roles are my biggest complaint, though | 20:52 |
| Ryan_Lane | user gets a token, their roles change, now they need a new token | 20:53 |
| dolphm | Ryan_Lane: honestly, i see them both as credentials, except you can only exchange one for the other in a single direction (i can't trade a token for your password) | 20:53 |
| *** jimfehlig has quit IRC | 20:53 | |
| ayoung | Ryan_Lane, OK...the short of it is that all web based authn is insecure. The best option is to use PKI or Kerberos. | 20:53 |
| Ryan_Lane | but they get a token based on the authentication, that token can get any other token | 20:53 |
| Ryan_Lane | it all goes back to the same insecure authentication | 20:54 |
| ayoung | Ryan_Lane, it is worse than that | 20:54 |
| ayoung | as the token is a shared secret. Once someone knows a token, they have your auth | 20:54 |
| Ryan_Lane | yes | 20:54 |
| dolphm | until the token expires or is revoked | 20:55 |
| Ryan_Lane | so, I don't see how tenant tokens make this situation any better | 20:55 |
| ayoung | dolphm, yep | 20:55 |
| ayoung | so, if an unscoped token can only get a scoped token, and then only the scoped tokens are passed around, you limit the likely damage to just that tenant | 20:55 |
| Ryan_Lane | the worry isn't in transit | 20:56 |
| Ryan_Lane | that's what https is for | 20:56 |
| Ryan_Lane | you have to assume you are fucked if you aren't using https | 20:56 |
| dolphm | +1 | 20:56 |
| Ryan_Lane | the worry is hijacking the token before transit | 20:57 |
| Ryan_Lane | web interfaces save all of the tokens. an sql injection or similar attack vector will be able to get all of the tokens | 20:57 |
| Ryan_Lane | same with the cli | 20:57 |
| Ryan_Lane | hell, the cli currently only accepts passwords | 20:58 |
| Ryan_Lane | I guess that's pluggable now | 20:58 |
| dolphm | Ryan_Lane: only accepts passwords? | 20:58 |
| Ryan_Lane | sorry. I'm thinking of the essex version | 20:58 |
| Ryan_Lane | I don't see an option for using a token | 20:58 |
| Ryan_Lane | it re-auths every single attempt in the essex version | 20:59 |
| *** openstackgerrit has quit IRC | 20:59 | |
| *** matwood has quit IRC | 20:59 | |
| dolphm | Ryan_Lane: i feel like --token and --endpoint have been options since before essex | 20:59 |
| *** openstackgerrit has joined #openstack-dev | 20:59 | |
| dolphm | or some equivalent | 20:59 |
| ayoung | Ryan_Lane, so the CLI does tokens under the covers. I was proposing using Keyring as a way to cache tokens | 20:59 |
| Ryan_Lane | dolphm: only keystone cli accepts tokens | 20:59 |
| Ryan_Lane | the keyring is a good idea, but tenant tokens don't help there either | 20:59 |
| ayoung | But seriosuly, It feels like we've reimplemented a good chunk of Kerberos as it is | 20:59 |
| Ryan_Lane | the keyring is going to take the generic token | 21:00 |
| Ryan_Lane | which means if it's owned, then all your projects are owned | 21:00 |
| kbringard | what's the best way to perform a healthcheck against the EC2 api for something that considered 4XX errors to be a failure | 21:02 |
| kbringard | / gives a 404 and /services/Cloud gives a 400 if you didn't auth | 21:02 |
| Ryan_Lane | ayoung: so, is there any reasonable solution to the issue of roles? | 21:03 |
| Ryan_Lane | right now I invalidate project tokens from my web interface's cache when a role changes, but that doesn't work if the roles are changed outside of the interface | 21:03 |
| *** dwalleck has quit IRC | 21:04 | |
| Ryan_Lane | I don't see why roles are embedded in a token | 21:04 |
| vishy | annegentle: yes there is a lot to be done :) | 21:04 |
| annegentle | heh it looks better now than it did when I first clicked :) | 21:04 |
| openstackgerrit | A change was merged to openstack/quantum: fixes cisco nexus plugin delete network issue https://review.openstack.org/11917 | 21:04 |
| dolphm | Ryan_Lane: i'm not sure end-users need to see their list of roles in the first place? seems like an management concern | 21:06 |
| Ryan_Lane | dolphm: that's not what I mean | 21:06 |
| Ryan_Lane | dolphm: the web interface will automatically fetch a project token for the user when they try to access a project | 21:07 |
| Ryan_Lane | the token has the roles in it | 21:07 |
| dolphm | sure | 21:07 |
| Ryan_Lane | if I add the user to the sysadmin group, then their project token is now invalid | 21:07 |
| Ryan_Lane | because the roles are embedded in the token | 21:07 |
| Ryan_Lane | the web interface has no clue of this. it sees the user has a valid project token | 21:08 |
| dolphm | Ryan_Lane: the user gets an Unauthorized on their next request, they re-authenticate, and go on their merry way | 21:08 |
| Ryan_Lane | from its perspective, it shouldn't get a new one for another day (or in my case a week) | 21:08 |
| Ryan_Lane | no | 21:08 |
| Ryan_Lane | they don't | 21:08 |
| Ryan_Lane | the old token is still valid | 21:08 |
| dolphm | Ryan_Lane: not if they can't use it | 21:08 |
| Ryan_Lane | how does the web interface know? | 21:08 |
| Ryan_Lane | from its perspective the token is valid. the user just isn't in the role | 21:09 |
| *** openstackgerrit has quit IRC | 21:09 | |
| dolphm | it gets Unauthorized responses pointing at keystone | 21:09 |
| *** openstackgerrit has joined #openstack-dev | 21:09 | |
| Ryan_Lane | a 401 is actually a perfectly valid response for the interface to get | 21:09 |
| Ryan_Lane | it shouldn't try to re-auth the user | 21:09 |
| dolphm | Ryan_Lane: https://github.com/openstack/keystone/blob/master/keystone/middleware/auth_token.py#L333 | 21:10 |
| Ryan_Lane | otherwise, the interface should just re-auth the user every single request | 21:10 |
| Ryan_Lane | I don't see how that function means anything to me | 21:10 |
| dolphm | Ryan_Lane: auth rejection includes a WWW-Go-Authenticate-With-Keystone-And-Come-Back header | 21:10 |
| *** daddyjoseph97 has joined #openstack-dev | 21:10 | |
| Ryan_Lane | this occurs when a token is known to be bad? | 21:11 |
| Ryan_Lane | because the roles change? | 21:11 |
| *** jimfehlig has joined #openstack-dev | 21:11 | |
| dolphm | Ryan_Lane: authz rejection will occur from inside the service, and won't have that header | 21:11 |
| dolphm | Ryan_Lane: yes | 21:11 |
| Ryan_Lane | or does it also do this if the token's roles are valid too | 21:11 |
| dolphm | Ryan_Lane: if the token is valid this won't be hit | 21:11 |
| Ryan_Lane | so, this is a header I need to read? | 21:12 |
| dolphm | Ryan_Lane: this is just for authn failure (including revoked tokens) | 21:12 |
| *** dwalleck has joined #openstack-dev | 21:12 | |
| Ryan_Lane | what response will be given if a token is just rejected because the user isn't in the role? | 21:13 |
| dolphm | Ryan_Lane: http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2 "The response MUST include a WWW-Authenticate header field" "the 401 response indicates that authorization has been refused for those credentials" | 21:13 |
| Ryan_Lane | isn't that the exact same response I'll get if the user simply isn't in the role? | 21:14 |
| dolphm | Ryan_Lane: the answer to *that* depends on the policy engine in the underlying service that makes that decision | 21:14 |
| Ryan_Lane | o.O | 21:14 |
| *** dwalleck has quit IRC | 21:15 | |
| Ryan_Lane | is there a use case that makes having the roles in the token useful? | 21:15 |
| dolphm | Ryan_Lane: not one you'll hear from me | 21:15 |
| Ryan_Lane | :D | 21:15 |
| Ryan_Lane | :( | 21:15 |
| dolphm | Ryan_Lane: it's useful in the token validation response, of course, but i don't see how it's useful in the authentication response | 21:16 |
| jgriffith | Anybody else having issues trying to create instances in devstack today? | 21:16 |
| Ryan_Lane | if a user is removed from a role, and they authenticate using an old token that has the role in the token, what happens? | 21:16 |
| *** lts has quit IRC | 21:16 | |
| *** ncode has quit IRC | 21:16 | |
| Ryan_Lane | to another service, like nova, for instance | 21:17 |
| dolphm | old but not-expired? | 21:17 |
| Ryan_Lane | does nova check with keystone? or does it trust the token? | 21:17 |
| *** zaneb has quit IRC | 21:17 | |
| Ryan_Lane | yes | 21:17 |
| dolphm | nova is protected by auth_token | 21:17 |
| dolphm | auth_token validates the token with keystone | 21:17 |
| Ryan_Lane | the token is still valid, though, isn't it? | 21:17 |
| dolphm | injects roles from the validation response into the wsgi env for nova to use | 21:18 |
| Ryan_Lane | heh | 21:18 |
| Ryan_Lane | so, for removed roles this works properly, but when roles are added, it fails | 21:18 |
| dolphm | at that point, yes, nova trusts the token and the context | 21:18 |
| Ryan_Lane | wait.... | 21:18 |
| Ryan_Lane | maybe I misread you | 21:18 |
| Ryan_Lane | if I pass a non-expired token to nova that says I'm a sysadmin, it trusts the token? | 21:19 |
| *** openstackgerrit has quit IRC | 21:19 | |
| dolphm | if roles changes at all, validation with keystone *should* fail because the token *should* have been revoked as a result | 21:19 |
| *** openstackgerrit has joined #openstack-dev | 21:19 | |
| Ryan_Lane | even if I've been removed? | 21:19 |
| *** zaneb has joined #openstack-dev | 21:19 | |
| dolphm | so auth_token turns the validation failure into an Unauthorized-go-talk-to-keystone-and-come-back-later-401 | 21:19 |
| Ryan_Lane | ok. that's sane | 21:19 |
| Ryan_Lane | so, the roles are checked anyway | 21:20 |
| Ryan_Lane | so the roles in the token don't help there | 21:20 |
| dolphm | Ryan_Lane: if you remove auth_token from your middleware stack, you can trick nova into anything | 21:20 |
| dolphm | Ryan_Lane: nope | 21:20 |
| Ryan_Lane | the roles actively cause failures in the opposite situation, though | 21:20 |
| dolphm | Ryan_Lane: what's the opposite situation? | 21:21 |
| Ryan_Lane | if I pass a token to nova that says I'm in sysadmin, and try to do an action that requires netadmin it'll fail. even if I'm in netadmin in keystone | 21:22 |
| Ryan_Lane | the token just doesn't know | 21:22 |
| Ryan_Lane | I'll need to re-auth. the old token will still be valid for sysadmin actions, though | 21:22 |
| dolphm | Ryan_Lane: different roles for the same tenant? | 21:22 |
| Ryan_Lane | yes | 21:22 |
| Ryan_Lane | services both trust and don't trust the tokens | 21:23 |
| *** daddyjoseph97 has quit IRC | 21:23 | |
| Ryan_Lane | *the roles in the tokens | 21:23 |
| Ryan_Lane | they are being used as authn and authz, but not in an actually trusted way for authz | 21:24 |
| dolphm | Ryan_Lane: i'm pretty sure i'm not making this all up, but i actually don't see where role grants/revokes reach out and invalidate tokens in keystone... i wonder if that was missed in the rewrite? | 21:27 |
| *** andrewbogott is now known as andrewbogott_afk | 21:27 | |
| Ryan_Lane | that's scary | 21:27 |
| dolphm | Ryan_Lane: yes it is... i'm going to test it | 21:28 |
| dolphm | hopefully i'm just looking in the "wrong" place | 21:28 |
| *** mtreinish has quit IRC | 21:28 | |
| *** openstackgerrit has quit IRC | 21:29 | |
| dolphm | considering admins can't list tokens through the API, i'm not sure where you would remove that responsiblity to? | 21:29 |
| *** openstackgerrit has joined #openstack-dev | 21:29 | |
| Ryan_Lane | yeah. that's not a good situation | 21:30 |
| dolphm | move* | 21:30 |
| *** cloudvirt has joined #openstack-dev | 21:30 | |
| Ryan_Lane | I can invalidate from tokens from my web cache | 21:30 |
| Ryan_Lane | but i have no way to do it through keystone | 21:30 |
| dolphm | DELETE /tokens/{token_id} | 21:30 |
| Ryan_Lane | and really, in the case of an ldap backend, keystone doesn't even know that the roles have changed | 21:30 |
| *** rnirmal has quit IRC | 21:31 | |
| Ryan_Lane | really roles should be checked every time a token is used | 21:31 |
| dolphm | but you have to know the token ID, there's no GET /tokens or GET /users/{user_id}/tokens | 21:31 |
| Ryan_Lane | even then, you need to know to do it by project too | 21:31 |
| Ryan_Lane | and what if you manage roles through ldap directly? | 21:31 |
| Ryan_Lane | keystone really needs to handle this | 21:31 |
| Ryan_Lane | the responsibility can't be moved to a manager | 21:32 |
| *** Exhar has quit IRC | 21:32 | |
| *** openstackgerrit has quit IRC | 21:33 | |
| *** openstackgerrit has joined #openstack-dev | 21:33 | |
| *** openstackgerrit has quit IRC | 21:34 | |
| *** openstackgerrit has joined #openstack-dev | 21:34 | |
| ayoung | Ryan_Lane, so this is one artifact of PKI tokens. The user will likely need a way to say "get me a new scoped token" to the web UI. | 21:34 |
| ayoung | We don;t cache | 21:35 |
| ayoung | er | 21:35 |
| dolphm | Ryan_Lane: alternatively, keystone could just build the list of roles on every validation call, and then you wouldn't have to revoke tokens in that scenario | 21:35 |
| ayoung | we don't reissue tokens, so the new token will have the roles | 21:35 |
| Ryan_Lane | if the roles are checked every time, then the token can simply be used for authentication | 21:35 |
| ayoung | dolphm, nope | 21:35 |
| dolphm | ayoung: why not? | 21:35 |
| Ryan_Lane | and the roles can be removed from the token | 21:35 |
| ayoung | that means each call has to go back to Keystone, which is what PKI tries to avoid | 21:35 |
| Ryan_Lane | there's no way to change the expiration time of project vs generic tokens | 21:36 |
| ayoung | dolphm, what you described is how the uuid tokens currently work | 21:36 |
| openstackgerrit | A change was merged to openstack/nova: Adds integration testing for api samples https://review.openstack.org/11263 | 21:36 |
| Ryan_Lane | so, if I want my generic token to last a week, my project ones need to last a week too | 21:36 |
| dolphm | ayoung: right-- i'm trying to figure out why deleting a role from a user doesn't revoke tokens in our impl (or if it does, where that happens?) | 21:36 |
| *** openstackgerrit has quit IRC | 21:37 | |
| *** openstackgerrit has joined #openstack-dev | 21:37 | |
| Ryan_Lane | this means that I have no way of controlling how quickly my roles are valid/invalid | 21:37 |
| openstackgerrit | A change was merged to openstack/nova: Returns hypervisor_hostname in xml of extension https://review.openstack.org/11681 | 21:37 |
| Ryan_Lane | err | 21:37 |
| Ryan_Lane | how quickly they are invalidated | 21:37 |
| openstackgerrit | A change was merged to openstack/nova: Ensure hairpin_mode is set whenever vifs is added to bridge. https://review.openstack.org/11925 | 21:37 |
| dolphm | ayoung: i don't see anything calling delete_token other than the router | 21:39 |
| *** sacharya has quit IRC | 21:39 | |
| *** openstackgerrit has quit IRC | 21:39 | |
| *** openstackgerrit has joined #openstack-dev | 21:39 | |
| dolphm | ayoung: (one exception): disabling a user or changing a user's password revokes all tokens | 21:39 |
| ayoung | if a token gets revoked, the remote service will find out next time he revocation list gets published. But if a user gets 401s or something due to them recently getting a role, they need to get a new token that has the new roles in it | 21:40 |
| ayoung | dolphm, right | 21:40 |
| dolphm | ayoung: yes, but tokens should also be revoked when roles are granted/revoked | 21:40 |
| ayoung | dolphm, I am not sure if it is possible to get all tokens for a user/tenant combination | 21:40 |
| ayoung | revoked on revoke, certainly | 21:41 |
| Ryan_Lane | can we make a private channel for this discussion? | 21:41 |
| Ryan_Lane | temporarily? | 21:41 |
| dolphm | Ryan_Lane: pm me one | 21:41 |
| ayoung | and me | 21:42 |
| *** colinmcnamara has joined #openstack-dev | 21:42 | |
| *** cloudvirt has quit IRC | 21:43 | |
| openstackgerrit | A change was merged to openstack/nova: Clean up network create exception handling https://review.openstack.org/11927 | 21:43 |
| openstackgerrit | A change was merged to openstack/nova: Simplify network create logic https://review.openstack.org/11928 | 21:45 |
| *** lifeless has quit IRC | 21:45 | |
| *** belliott has quit IRC | 21:47 | |
| openstackgerrit | A change was merged to openstack/nova: Check volume status before detaching. https://review.openstack.org/11929 | 21:47 |
| *** cloudvirt has joined #openstack-dev | 21:47 | |
| openstackgerrit | A change was merged to openstack/nova: Trap iscsiadm error https://review.openstack.org/11930 | 21:47 |
| openstackgerrit | A change was merged to openstack/nova: Remove unused and old methods in hyperv and powervm driver. https://review.openstack.org/11932 | 21:48 |
| *** daddyjoseph97 has joined #openstack-dev | 21:49 | |
| *** openstackgerrit has quit IRC | 21:49 | |
| *** openstackgerrit has joined #openstack-dev | 21:49 | |
| openstackgerrit | A change was merged to openstack/nova: Make pre block migration create correct disk files. https://review.openstack.org/11934 | 21:49 |
| *** andrewbogott_afk is now known as andrewbogott | 21:51 | |
| *** ewindisch_ has quit IRC | 21:52 | |
| *** Gordonz has quit IRC | 21:53 | |
| *** markmcclain has quit IRC | 21:54 | |
| *** cloudvirt has quit IRC | 21:56 | |
| bcwaldon | clarkb: is the 'rfc.sh' script necessary anymore? | 21:57 |
| *** maoy has quit IRC | 21:57 | |
| jeblair | bcwaldon: it is not | 21:57 |
| clarkb | bcwaldon: I don't think so. jeblair deleted swift's I think | 21:57 |
| bcwaldon | word | 21:57 |
| bcwaldon | can I get one of you two to support this review? https://review.openstack.org/#/c/11958/ | 21:58 |
| *** openstackgerrit has quit IRC | 21:59 | |
| *** openstackgerrit has joined #openstack-dev | 21:59 | |
| *** ayoung is now known as ayoung-afk | 22:01 | |
| *** markmcclain has joined #openstack-dev | 22:02 | |
| bcwaldon | jeblair: thanks :) | 22:05 |
| *** openstackgerrit has quit IRC | 22:09 | |
| *** openstackgerrit has joined #openstack-dev | 22:09 | |
| *** dspano has quit IRC | 22:11 | |
| *** prao has joined #openstack-dev | 22:12 | |
| *** rpedde is now known as rpedde_away | 22:15 | |
| bcwaldon | dolphm: did you figure out your user-tenant issue? | 22:17 |
| *** datsun180b has quit IRC | 22:18 | |
| *** lifeless has joined #openstack-dev | 22:19 | |
| *** daddyjoseph97 has quit IRC | 22:20 | |
| jgriffith | Seemd create instances fails on devstack due to scheuling filter: http://paste.openstack.org/show/20475/ | 22:21 |
| jgriffith | Anybody know what changed? | 22:21 |
| *** colinmcnamara has quit IRC | 22:25 | |
| *** colinmcnamara has joined #openstack-dev | 22:25 | |
| *** pixelbeat has quit IRC | 22:27 | |
| *** troytoman is now known as troytoman-away | 22:29 | |
| dolphm | bcwaldon: dealing with another issue at the moment, but i think we have a direction for the time being, yes | 22:29 |
| bcwaldon | dolphm: cool | 22:29 |
| *** jkff has joined #openstack-dev | 22:29 | |
| *** kbringard has quit IRC | 22:35 | |
| *** rohit404 has quit IRC | 22:40 | |
| jkff | Hi. Can anyone remind me who can *approve* changes at review.openstack.org? It seems that a LGTM from a core reviewer is not the same thing. | 22:41 |
| jeblair | jkff: core reviewers for the project in question can approve changes | 22:42 |
| jkff | jeblair: thanks | 22:42 |
| clarkb | typically you need two +2 code reviews before approval is given | 22:43 |
| jkff | Yup, I see it now at http://wiki.openstack.org/GerritJenkinsGithub | 22:43 |
| jkff | Precisely http://wiki.openstack.org/GerritJenkinsGithub#Reviewing_a_Change | 22:43 |
| jkff | What is the polite way to ask a core reviewer to review a change without seeming pushy? | 22:44 |
| jkff | Also, is there a list of "core reviewer per project" somewhere? I can't find it on the project pages of review.openstack.org nor on the wiki | 22:47 |
| jeblair | jkff: check launchpad.net/~foo-core (where foo is the project) | 22:48 |
| jgriffith | hmm... seems memory requirements have changed | 22:53 |
| openstackgerrit | A change was merged to openstack/glance: Add nosehtmloutput as a test dependency. https://review.openstack.org/11756 | 22:57 |
| *** titankiller has quit IRC | 22:57 | |
| *** lifeless has quit IRC | 22:58 | |
| *** nunosantos has quit IRC | 22:59 | |
| jkff | jeblair: thanks again :) | 22:59 |
| *** lifeless has joined #openstack-dev | 22:59 | |
| openstackgerrit | A change was merged to openstack/glance: Correctly re-raise exception on bad v1 checksum https://review.openstack.org/11624 | 23:00 |
| jkff | Is it considered polite to add a core reviewer to a change, thus asking them to review it, or are they usually very busy people and one waits until they get to the change themselves in their "reviewable" queue? | 23:04 |
| *** lifeless has quit IRC | 23:04 | |
| *** lifeless has joined #openstack-dev | 23:05 | |
| jgriffith | jkff: I don't think that adding them to the reviewer list is impolite.... | 23:05 |
| jgriffith | jkff: Folks are rather busy right now, so sometimes things slip | 23:05 |
| clarkb | I have also pinged people on IRC asking for reviews | 23:05 |
| jgriffith | jkff: suggestion by clarkb is probably your best best | 23:06 |
| jkff | Ok, thanks! | 23:06 |
| *** rods1 has joined #openstack-dev | 23:07 | |
| *** jimfehlig has quit IRC | 23:07 | |
| jkff | well, then... | 23:08 |
| jkff | russellb: I've added you to a change about RabbitMQ H/A https://review.openstack.org/#/c/10305/, so I'd be happy if you took a look at it, it's been hanging there for quite a while :) | 23:08 |
| jkff | And on the topic of H/A, there's also a change by Deva van der Veen about database H/A which I think is very important: https://review.openstack.org/#/c/10797/ - without it, currently, you can't even restart a database server without breaking openstack | 23:09 |
| jkff | Once these two are in place, all that remains for solid H/A is probably retries on REST calls - which, I believe, are just keystone and glance API, right? | 23:10 |
| *** belliott has joined #openstack-dev | 23:10 | |
| openstackgerrit | A change was merged to openstack/quantum: Move metaplugin test for common test directory https://review.openstack.org/11447 | 23:11 |
| *** jkff_ has joined #openstack-dev | 23:14 | |
| *** jkff has quit IRC | 23:15 | |
| *** jkff_ has quit IRC | 23:15 | |
| *** jkff has joined #openstack-dev | 23:15 | |
| *** lloydde has quit IRC | 23:17 | |
| *** AlanClark has quit IRC | 23:18 | |
| *** jkff has quit IRC | 23:22 | |
| *** jkff has joined #openstack-dev | 23:23 | |
| *** e1mer has joined #openstack-dev | 23:24 | |
| *** e1mer has joined #openstack-dev | 23:24 | |
| jgriffith | jeblair: ping | 23:24 |
| clarkb | jgriffith: if you have generic CI questions/problems and don't specificly need jeblair I will be happy to help (or attempt to help) | 23:26 |
| jgriffith | clarkb: cool! | 23:27 |
| *** cloudvirt has joined #openstack-dev | 23:27 | |
| jgriffith | clarkb: I was just wondering, if it was possible to do *detailed* searches in gerrit? | 23:27 |
| *** samkottler|bbiab is now known as samkottler | 23:27 | |
| jgriffith | clarkb: So more than just "status:open nova" etc | 23:27 |
| clarkb | yes, you can filter on quite a lot of things | 23:27 |
| jgriffith | clarkb: Yay! | 23:27 |
| clarkb | jgriffith: https://review.openstack.org/Documentation/user-search.html | 23:28 |
| jgriffith | clarkb: EXCELLENT! Just what I was hoping for | 23:28 |
| clarkb | on that page there is a search operators list | 23:28 |
| jgriffith | clarkb: Thanks much! | 23:28 |
| clarkb | np | 23:28 |
| jkff | Cool! e.g. https://review.openstack.org/#/q/message:mysql,n,z | 23:29 |
| jgriffith | clarkb: Oh, this makes things soooo much easier! | 23:29 |
| *** markmcclain has quit IRC | 23:36 | |
| *** hemna has quit IRC | 23:36 | |
| *** dachary has quit IRC | 23:36 | |
| *** ncode has joined #openstack-dev | 23:36 | |
| *** cloudvirt has quit IRC | 23:40 | |
| openstackgerrit | A change was merged to openstack/glance: PEP8 fix in conf.py https://review.openstack.org/11850 | 23:42 |
| jkff | Whoa, the rate of merges is pretty high | 23:43 |
| *** zhuadl has joined #openstack-dev | 23:44 | |
| *** colinmcnamara has quit IRC | 23:44 | |
| *** markmcclain has joined #openstack-dev | 23:45 | |
| *** ncode has quit IRC | 23:45 | |
| *** asalkeld has quit IRC | 23:45 | |
| *** Ryan_Lane has quit IRC | 23:46 | |
| *** Ryan_Lane has joined #openstack-dev | 23:46 | |
| *** dolphm has quit IRC | 23:46 | |
| openstackgerrit | A change was merged to openstack/nova: Add missing context argument to start_transfer calls https://review.openstack.org/11951 | 23:48 |
| *** mnewby has quit IRC | 23:50 | |
| jkff | Heh, Mark McLoughlin's post answers some of my questions to an extent: http://blogs.gnome.org/markmc/2012/08/20/submitting-new-features-to-nova/ | 23:50 |
| jkff | "Think about what it is like to be a nova-core reviewer looking at a list of 40 to 60 reviews and having maybe 2 hours today to do reviews" | 23:50 |
| *** mnewby has joined #openstack-dev | 23:53 | |
| *** zhuadl has quit IRC | 23:55 | |
| *** mnewby has quit IRC | 23:56 | |
| *** tgall_foo has joined #openstack-dev | 23:59 | |
| *** tgall_foo has quit IRC | 23:59 | |
| *** tgall_foo has joined #openstack-dev | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!