| gyee | I don't see any get_scoped_token call in test_v3_identity | 00:00 |
|---|---|---|
| openstackgerrit | A change was merged to openstack/cinder: Add a safe_minidom_parse_string function. https://review.openstack.org/22310 | 00:00 |
| dolphm | gyee: class IdentityTestCase(test_v3.RestfulTestCase) | 00:01 |
| *** reed has joined #openstack-dev | 00:01 | |
| *** kagan has joined #openstack-dev | 00:02 | |
| *** vipul is now known as vipul|away | 00:02 | |
| *** vipul|away is now known as vipul | 00:02 | |
| gyee | right, but it is essentially using user_foo's scoped token | 00:02 |
| dolphm | gyee: test_create_domain calls self.post() which calls self.v3_request() which calls self.get_scoped_token() | 00:02 |
| gyee | right | 00:02 |
| gyee | but it is using user_foo's account | 00:02 |
| *** hemna is now known as hemnafk | 00:03 | |
| *** vkmc has quit IRC | 00:03 | |
| *** epim has joined #openstack-dev | 00:03 | |
| dolphm | gyee: i take it you see the issue that needs to be fixed with test coverage then? | 00:05 |
| *** topol has quit IRC | 00:05 | |
| *** pabelanger has quit IRC | 00:06 | |
| gyee | dolphm, I am not sure if we need to lump this all together with token API changes | 00:06 |
| lifeless | sdague: https://bugs.launchpad.net/testtools/+bug/1130429 | 00:07 |
| uvirtbot | Launchpad bug 1130429 in testtools "ConcurrentTestSuite silently eats exceptions from run(result)" [Critical,Triaged] | 00:07 |
| gyee | clearly, there's a bug in policy engine | 00:07 |
| gyee | keystone.policy.backends.rules: DEBUG: enforce identity:update_user: {'tenant_id': u'bar', 'user_id': u'foo', u'roles': [u'admin', u'_member_']} | 00:07 |
| gyee | keystone.common.wsgi: WARNING: You are not authorized to perform the requested action: identity:update_user | 00:07 |
| gyee | user has admin role | 00:07 |
| dolphm | gyee: if keystone isn't testing it's own tokens against itself, then what's the point? | 00:07 |
| gyee | dolphm, we are testing tokens in test_v3_token | 00:08 |
| gyee | see the POST /auth/tokens there | 00:08 |
| *** david-lyle has quit IRC | 00:09 | |
| dolphm | gyee: http://en.wikipedia.org/wiki/Eating_your_own_dog_food | 00:09 |
| gyee | :) | 00:09 |
| gyee | but we are keep adding pork to this bill | 00:09 |
| *** zykes- has quit IRC | 00:09 | |
| dolphm | gyee: all the v3 tests are designed to dogfood auth, which is supposed to be our core competency | 00:09 |
| dolphm | gyee: bypassing that doesn't get us anywhere | 00:09 |
| gyee | not bypassing | 00:10 |
| *** donaldh has quit IRC | 00:10 | |
| gyee | see policy.json, almost all the APIs there need to be admin | 00:10 |
| gyee | I don't think the bug's in token API | 00:10 |
| *** alexxu has joined #openstack-dev | 00:11 | |
| heckj | gyee, dolphm, henrynash: not super critical, but merging in the installvenv fix from oslo upstream for keystone: https://review.openstack.org/22383 | 00:11 |
| lifeless | sdague: and https://bugs.launchpad.net/subunit/+bug/1130432 | 00:11 |
| uvirtbot | Launchpad bug 1130432 in subunit "broken details objects break reporting of errors - invalid stream generated" [Wishlist,Triaged] | 00:11 |
| lifeless | clarkb: ^ both that and the other one I linked to sdague a few minutes back,. FYI no action required. | 00:12 |
| dolphm | heckj: +2'd | 00:12 |
| gyee | dolphm, right now is_admin is dictated by the ADMIN token | 00:12 |
| dolphm | gyee: which is absolutely not a token | 00:12 |
| dolphm | gyee: policy is not exercised, @protected is completely bypassed, and we throw warnings in the logs | 00:13 |
| gyee | https://github.com/openstack/keystone/blob/master/keystone/middleware/core.py#L61 | 00:13 |
| gyee | what I am saying is policy is a separate change being worked on by henrynash | 00:13 |
| dolphm | gyee: yes, that is middleware that should be completely removed in a production environment | 00:13 |
| *** alunduil has joined #openstack-dev | 00:14 | |
| *** davidlenwell has quit IRC | 00:14 | |
| gyee | dolphm, what? that's where we are getting the X-Subject-Token | 00:14 |
| *** jergerber has quit IRC | 00:15 | |
| dolphm | gyee: no, it's not -- that's a hack | 00:15 |
| gyee | you got me confused | 00:16 |
| dolphm | gyee: useful for perhaps bootstrapping a keystone deployment and then it should be discarded | 00:16 |
| *** zykes- has joined #openstack-dev | 00:16 | |
| dolphm | keystone.conf admin_token is useful for creating a real admin user in keystone, and then you should remove the AdminTokenAuthMiddleware from your pipeline | 00:16 |
| gyee | k | 00:17 |
| dolphm | gyee: if your deployment is backed by ldap or any other external user store, you should never have it in your pipeline at all | 00:17 |
| gyee | I am not fan of the ADMIN token either | 00:17 |
| *** digitalsanctum has quit IRC | 00:17 | |
| *** digitalsanctum has joined #openstack-dev | 00:18 | |
| *** markmcclain has quit IRC | 00:20 | |
| Ryan_Lane | how do things work without the admin token? | 00:22 |
| *** digitalsanctum has quit IRC | 00:23 | |
| Ryan_Lane | does the admin user need to be in an admin role of every project? | 00:23 |
| Ryan_Lane | or a single project? | 00:23 |
| *** sulrich has quit IRC | 00:23 | |
| Ryan_Lane | admin token is easy to deal with and is no less secure than a user | 00:24 |
| Ryan_Lane | I'd argue that it's possibly more secure, as when you need to change the credentials, you push it out to every node and you're done. No need to worry about revoking tokens and such | 00:25 |
| *** mrodden has quit IRC | 00:26 | |
| *** jkoelker has quit IRC | 00:26 | |
| *** rgoodwin has quit IRC | 00:26 | |
| *** jkoelker has joined #openstack-dev | 00:27 | |
| *** eharney has quit IRC | 00:28 | |
| *** vipul is now known as vipul|away | 00:28 | |
| dolphm | Ryan_Lane: without the static admin_token, a user with the role defined by your policy.json's "admin_required" rule will be applied across all v2 api calls, which tenant it was granted on doesn't matter, although you could restrict that with policy.json as well | 00:28 |
| *** rgoodwin has joined #openstack-dev | 00:28 | |
| dolphm | Ryan_Lane: the v3 API is enumerated call by call in policy.json so that you can be more granular about that stuff | 00:29 |
| *** vipul|away is now known as vipul | 00:29 | |
| Ryan_Lane | so a role in a single tenant is treated like a global role? | 00:30 |
| *** pabelanger has joined #openstack-dev | 00:31 | |
| *** BLZbubba has quit IRC | 00:31 | |
| *** dontalton has quit IRC | 00:33 | |
| *** mjfork has quit IRC | 00:33 | |
| *** tomoe_ has quit IRC | 00:36 | |
| *** tomoe_ has joined #openstack-dev | 00:36 | |
| *** Tross has quit IRC | 00:37 | |
| openstackgerrit | A change was merged to openstack/oslo-incubator: Avoid using cfg in install_venv_common https://review.openstack.org/22368 | 00:37 |
| *** yidclare has quit IRC | 00:39 | |
| *** kmartin is now known as kmartin_zz | 00:40 | |
| *** kmansel has quit IRC | 00:41 | |
| *** jergerber has joined #openstack-dev | 00:41 | |
| *** yidclare has joined #openstack-dev | 00:41 | |
| *** nati_ueno has quit IRC | 00:43 | |
| *** tomoe_ has quit IRC | 00:43 | |
| *** tomoe_ has joined #openstack-dev | 00:43 | |
| *** nati_ueno has joined #openstack-dev | 00:43 | |
| *** digitalsanctum has joined #openstack-dev | 00:44 | |
| dolphm | Ryan_Lane: policy.json's default definition for admin_required doesn't specify a tenant | 00:45 |
| Ryan_Lane | so an admin in any project is an admin everywhere? | 00:45 |
| dolphm | Ryan_Lane: according to policy.json default definition of admin_required, yes | 00:46 |
| Ryan_Lane | scary :) | 00:46 |
| Ryan_Lane | is some concept of global roles ever coming back. that's basically what this is | 00:46 |
| Ryan_Lane | except a scary version of it | 00:47 |
| *** krtaylor has quit IRC | 00:47 | |
| Ryan_Lane | s/./?/ | 00:47 |
| dolphm | Ryan_Lane: trying to work towards domain-specific roles to solve that use case | 00:47 |
| Ryan_Lane | great | 00:47 |
| Ryan_Lane | I need that badly :) | 00:47 |
| *** tomoe_ has quit IRC | 00:47 | |
| *** tomoe_ has joined #openstack-dev | 00:48 | |
| *** krtaylor has joined #openstack-dev | 00:48 | |
| *** gary_th has quit IRC | 00:48 | |
| henrynash | gyee: so unless I have this wrong, if you take out the 'ADMIN' it fails…it seems to because authenticate_for_token is itself protected….and tries to look up the token id…(which of course is indeed invalid) | 00:48 |
| openstackgerrit | A change was merged to openstack/nova: Support running periodic tasks immediately at startup https://review.openstack.org/22232 | 00:48 |
| openstackgerrit | A change was merged to openstack/keystone: Ensure user and tenant enabled in EC2 https://review.openstack.org/22319 | 00:49 |
| gyee | henrynash, I am having trouble with the policy engine | 00:49 |
| gyee | user has 'admin' role | 00:49 |
| henrynash | gyee: the old one I assume? | 00:50 |
| henrynash | gyee: (policy engine that is) | 00:50 |
| gyee | henrynash, I rebased to the latest code | 00:50 |
| gyee | keystone.policy.backends.rules: DEBUG: enforce identity:update_user: {'tenant_id': u'bar', 'user_id': u'foo', u'roles': [u'admin', u'_member_']} | 00:51 |
| gyee | keystone.common.wsgi: WARNING: You are not authorized to perform the requested action: identity:update_user | 00:51 |
| gyee | admin role is in the creds AFAICT | 00:52 |
| openstackgerrit | A change was merged to openstack/nova: Ensure rpc result is primitive types. https://review.openstack.org/22275 | 00:53 |
| henrynash | gyee: hmm, odd….I didn't have to change any of the formats of any of the test policies when swapping to the new engine…. | 00:53 |
| henrynash | so (at least on the surface) the formats are OK | 00:53 |
| *** tomoe_ has quit IRC | 00:53 | |
| *** tomoe_ has joined #openstack-dev | 00:54 | |
| gyee | henrynash, we were using the ADMIN token all along | 00:54 |
| openstackgerrit | A change was merged to openstack/nova: Fix key check in instance actions formatter. https://review.openstack.org/22068 | 00:54 |
| henrynash | gyee: are u saying you have removed that now? | 00:54 |
| gyee | after switched over to a real token with admin role, all the enforcement are failing | 00:54 |
| gyee | henrynash, dolphm made me do it | 00:54 |
| gyee | :) | 00:55 |
| henrynash | gyee: right, so I am trying to make it work too. | 00:55 |
| gyee | now I am stuck | 00:55 |
| gyee | I feel like that's a separate issue from the token APIs | 00:55 |
| gyee | clearly this is a separate issue | 00:56 |
| henrynash | gyee: I changed my patch (which is based on yours) to take out the ADMIN token part…and I get a failure which appears to be that the token_authentication api call is itself protected…and is expecting a token id to be already there | 00:57 |
| henrynash | gyee: surely anyone should be able to attempt to get a token…why is it protected? | 00:57 |
| gyee | henrynash, I've removed the protected decorator for get token | 00:58 |
| gyee | just use my latest patch | 00:58 |
| henrynash | gyee: ahh…I'm only synced up to version 12 | 00:58 |
| *** winston-d_ has joined #openstack-dev | 00:59 | |
| henrynash | gyee: I can't see where we have really tested the protection and policy engine calling before | 00:59 |
| gyee | damn that policy engine code is pretty hairy | 01:00 |
| *** alobbs has quit IRC | 01:00 | |
| *** alobbs has joined #openstack-dev | 01:00 | |
| *** gongysh has joined #openstack-dev | 01:02 | |
| henrynash | gyee: is your latest patch 16? | 01:04 |
| gyee | henrynash, yep | 01:04 |
| *** topol has joined #openstack-dev | 01:07 | |
| henrynash | gyee: does that patch really stop using "ADMIN'? won't is_admin allays be true in v3_request() ? | 01:08 |
| *** roampune has joined #openstack-dev | 01:08 | |
| gyee | henrynash, http://paste.openstack.org/raw/31993/ | 01:09 |
| gyee | apply dolphm's changes | 01:09 |
| *** kmartin_zz is now known as kmartin | 01:09 | |
| *** pabelanger has quit IRC | 01:10 | |
| *** roampune has quit IRC | 01:12 | |
| *** yidclare has quit IRC | 01:14 | |
| *** pabelanger has joined #openstack-dev | 01:15 | |
| gyee | henrynash, definitely something's wrong in the policy engine | 01:17 |
| gyee | none of the rules seem to be loaded | 01:17 |
| bodepd | I found that to get the folosm version of the tempest smoketests to run I had to remove a directory | 01:17 |
| bodepd | rm -Rvf ./tempest/openstack/ | 01:18 |
| bodepd | does anyone know why this is? | 01:18 |
| *** diogogmt has joined #openstack-dev | 01:19 | |
| *** mlavalle has left #openstack-dev | 01:19 | |
| *** colinmcnamara has quit IRC | 01:23 | |
| *** bodepd has left #openstack-dev | 01:24 | |
| gyee | henrynash, I found the problem | 01:25 |
| henrynash | gyee: great if you have... | 01:26 |
| gyee | it was using tests/policy.json | 01:26 |
| gyee | which has nothing in it | 01:26 |
| *** ctracey has quit IRC | 01:27 | |
| henrynash | gyee: ahh…in tests I am starting to write, I write a temp policy file…see end of test_v3_identity in my patch: https://review.openstack.org/#/c/22223/ | 01:27 |
| gyee | henrynash, I still see some test failures | 01:27 |
| gyee | I think our policy.json file is not currect | 01:28 |
| gyee | correct | 01:28 |
| gyee | anything that has {*_id} in the rules failed | 01:28 |
| henrynash | gyee: may be true….but of not, we should determine what the differences are…. | 01:28 |
| gyee | henrynash, I basically copied etc/policy.json over to tests | 01:29 |
| henrynash | gyee: but maybe that's because we are not loading the correct things into creeds/target etc.? | 01:29 |
| *** metral has quit IRC | 01:29 | |
| gyee | henrynash, yeah, no domain scoping | 01:29 |
| *** ctracey has joined #openstack-dev | 01:30 | |
| gyee | so far all the group_id tests failed | 01:30 |
| henrynash | gyee: so on that….what is it that is missing? looking at your code, you seem to be issuing the domain token? | 01:30 |
| henrynash | sure, I will update the protected decorator to pass in the domain_id if it's a domain token | 01:31 |
| *** ctracey has quit IRC | 01:31 | |
| gyee | henrynash, I didn't implement domain-scope token yet | 01:31 |
| *** ctracey has joined #openstack-dev | 01:31 | |
| openstackgerrit | A change was merged to openstack/oslo-incubator: Implement replay detection. https://review.openstack.org/21562 | 01:31 |
| openstackgerrit | A change was merged to openstack/oslo-incubator: Fast serialization of RPC envelopes for Kombu https://review.openstack.org/22345 | 01:31 |
| henrynash | gyee: but doesn't your formatting tken code already do that? | 01:32 |
| gyee | see http://paste.openstack.org/show/32011/ | 01:32 |
| gyee | group_id is not in the token | 01:33 |
| *** Nachi has joined #openstack-dev | 01:34 | |
| *** Nachi has quit IRC | 01:35 | |
| *** Nachi has joined #openstack-dev | 01:35 | |
| henrynash | gyee: OK, I gotta hit the sack…its 2:30am here….I'll check in tomorrow see where we are and pick up where what needs doing….send me a note on things that you think need looking at | 01:36 |
| gyee | henrynash, we're hitting code freeze | 01:36 |
| gyee | :) | 01:36 |
| *** nati_ueno has quit IRC | 01:37 | |
| henrynash | gyee: not till tomorrow night, we're not | 01:37 |
| openstackgerrit | A change was merged to openstack/oslo-incubator: Fix "DirectConsumer needs mirrored queue support" https://review.openstack.org/21880 | 01:38 |
| *** njoy1__ has quit IRC | 01:38 | |
| *** njoy_ has joined #openstack-dev | 01:38 | |
| openstackgerrit | A change was merged to openstack/nova: Fibre channel block storage support (nova changes) https://review.openstack.org/19992 | 01:39 |
| *** njoy has joined #openstack-dev | 01:40 | |
| *** njoy_ has quit IRC | 01:40 | |
| *** dims has quit IRC | 01:40 | |
| openstackgerrit | A change was merged to openstack/nova: Fix XML config tests for disk/net/cpu tuning https://review.openstack.org/22349 | 01:41 |
| openstackgerrit | A change was merged to openstack/nova: Fix XMLMatcher error reporting https://review.openstack.org/22350 | 01:41 |
| *** stevebaker has quit IRC | 01:41 | |
| *** sacharya has joined #openstack-dev | 01:43 | |
| *** jkyle has quit IRC | 01:45 | |
| *** novas0x2a|lapto1 has joined #openstack-dev | 01:45 | |
| dolphm | gyee: i think your password authentication is broken | 01:47 |
| gyee | really? | 01:47 |
| *** novas0x2a|laptop has quit IRC | 01:48 | |
| dolphm | gyee: either i'm getting auth_info confused with user_info, which would be easy to do because i'm not clear on what auth_info is (i thought it was just the contents of {'authentication': {'password': { ... } } but that doesn't appear to be the case? | 01:49 |
| dolphm | gyee: either that^ or i'm dumb. and in either case i'm probably dumb | 01:50 |
| *** sthaha has joined #openstack-dev | 01:50 | |
| dolphm | gyee: it looks like you're trying to follow the code path that my password follows | 01:50 |
| dolphm | gyee: and it seems to be discarded in the password driver | 01:50 |
| *** anniec has joined #openstack-dev | 01:50 | |
| gyee | auth_info is AuthInfo object | 01:50 |
| dolphm | gyee: err, i'm trying to follow the code path that my password follows* | 01:51 |
| dolphm | gyee: yeah, what is that and why are plugins expected to understand an arbitrary object? | 01:51 |
| gyee | it's not arbitrary object | 01:51 |
| *** techlife has quit IRC | 01:51 | |
| gyee | its auth.controllers.AuthInfo | 01:51 |
| dolphm | gyee: well it's not a dictionary copy of body['authentication'][auth_plugin] | 01:52 |
| gyee | no | 01:52 |
| dolphm | gyee: why are you passing scope and stuff into the auth driver? | 01:52 |
| *** devoid has quit IRC | 01:52 | |
| gyee | take a look at auth.controllers.py | 01:52 |
| *** nati_ueno_2 has quit IRC | 01:53 | |
| gyee | because auth driver needs complete information | 01:53 |
| gyee | information should be available to them | 01:53 |
| dolphm | gyee: define complete, and explain why their own namespace isn't sufficient? | 01:53 |
| *** nati_ueno has joined #openstack-dev | 01:53 | |
| gyee | it is up to the driver to make use if it, or not | 01:53 |
| *** dims has joined #openstack-dev | 01:53 | |
| *** AlanClark__ has quit IRC | 01:54 | |
| *** AlanClark__ has joined #openstack-dev | 01:54 | |
| *** nerd has quit IRC | 01:54 | |
| dolphm | gyee: you're absolutely demanding that the driver understand that object | 01:54 |
| dolphm | gyee: and therefore tightly coupling a proprietary driver with our arbitrary object | 01:55 |
| gyee | I am trying to make it easier for the drivers so they don't have to do other checks | 01:55 |
| dolphm | gyee: you're passing the driver WAY too much information | 01:55 |
| *** reed has quit IRC | 01:55 | |
| gyee | AuthInfo is used for encapsulate the auth body | 01:56 |
| dolphm | gyee: it encapsulates the entire request, not just auth, and especially not just the authentication method's namespace, which is all it needs | 01:56 |
| gyee | driver needs as much information to determine auth decision | 01:57 |
| *** megha has joined #openstack-dev | 01:57 | |
| gyee | I don't see any problem with making that information available | 01:57 |
| *** nati_ueno has quit IRC | 01:57 | |
| dolphm | gyee: because it's awful and completely out of scope and tightly coupled | 01:58 |
| dolphm | gyee: i'm staring at all the source code and i have absolutely no clue how the password authentication driver works -- absolutely no clue. | 01:58 |
| *** reed has joined #openstack-dev | 01:58 | |
| *** thingee is now known as thingee_zzz | 01:58 | |
| dolphm | gyee: that's how complicated it is | 01:58 |
| dolphm | gyee: i can't even tell where to look for the password in the method signature | 01:59 |
| dolphm | gyee: i really expected auth_info['password'] | 02:00 |
| dolphm | gyee: really really did | 02:00 |
| *** techlife has joined #openstack-dev | 02:01 | |
| dolphm | gyee: sorry, auth_info['user']['password'] is what i tried first | 02:04 |
| gyee | dolphm, I can change it to just pass the payload if it changes your world view :) | 02:04 |
| gyee | but I am sure somewhere down the line we need to to amend this to pass more information | 02:05 |
| dolphm | gyee: will that work? because it looks like you're also putting the burden of authorization on the password authentication driver as well by passing it scope, and utilizing it there | 02:05 |
| dolphm | gyee: certainly not scope | 02:05 |
| *** bing_bu has joined #openstack-dev | 02:05 | |
| dolphm | gyee: or trusts or any other crap that doesn't have to do with authentication | 02:06 |
| *** reed has quit IRC | 02:06 | |
| gyee | some driver may need the scope to make a more informed auth decision | 02:07 |
| gyee | that's all I am saying | 02:07 |
| *** heckj has quit IRC | 02:07 | |
| *** Nachi has quit IRC | 02:07 | |
| dolphm | gyee: scope is authz, i thought this was authn? | 02:07 |
| gyee | dolphm, who knows, authz and authz line is not very clear sometime | 02:10 |
| dolphm | gyee: which is indicative of completely awful design | 02:10 |
| gyee | all I am saying is lets have as much information available to the plugins now so we don't have to do it later | 02:10 |
| dolphm | gyee: as a plugin writer, i will write a plugin | 02:11 |
| *** kmartin is now known as kmartin_zz | 02:11 | |
| dolphm | *never* write a plugin. | 02:11 |
| dolphm | gyee: you will break my driver every time your change AuthInfo | 02:11 |
| dolphm | gyee: you will break my driver every time you rev the API | 02:11 |
| dolphm | gyee: i will not understand the interface i'm supposed to use from AuthInfo | 02:12 |
| gyee | dolphm, would it be helpful if I pass the entire request body? | 02:12 |
| gyee | instead of an object? | 02:12 |
| dolphm | gyee: no, it's really not | 02:12 |
| gyee | same argument right? | 02:12 |
| dolphm | gyee: i have a tiny little slice of the auth request i care about, and that's the namespace of my driver | 02:13 |
| dolphm | gyee: my job is to implement authenticate() in response to that namespace | 02:13 |
| *** digitalsanctum has quit IRC | 02:13 | |
| gyee | dolphm, what if I need to know what methods users has authenticated so far? | 02:13 |
| gyee | what if I have drivers which need to be coordinated? | 02:14 |
| dolphm | gyee: what's the use case? | 02:14 |
| dolphm | gyee: an rsa token driver would identify the user by ID and then provide an RSA token value... i don't need any other random contextual information | 02:15 |
| *** digitalsanctum has joined #openstack-dev | 02:15 | |
| *** digitalsanctum has quit IRC | 02:17 | |
| *** buzztroll_ has joined #openstack-dev | 02:17 | |
| dolphm | gyee: i'm struggling really hard to come up with a scenario where i'd need the ID of the project I want authorization on in order to determine * who i am * | 02:18 |
| *** nati_ueno has joined #openstack-dev | 02:19 | |
| gyee | dolphm, I can't think of one right now either | 02:20 |
| gyee | but then by brain is already numb from debugging all day :) | 02:20 |
| gyee | s/by/my | 02:20 |
| *** salv-orlando has quit IRC | 02:24 | |
| *** pabelanger has quit IRC | 02:24 | |
| *** diogogmt has quit IRC | 02:24 | |
| *** kagan has quit IRC | 02:24 | |
| *** bearovercloud has joined #openstack-dev | 02:26 | |
| *** tomoe_ has quit IRC | 02:29 | |
| *** tomoe_ has joined #openstack-dev | 02:30 | |
| *** tomoe_ has quit IRC | 02:34 | |
| *** mrodden has joined #openstack-dev | 02:36 | |
| *** bearovercloud has left #openstack-dev | 02:37 | |
| *** dolphm has quit IRC | 02:37 | |
| *** stevebaker has joined #openstack-dev | 02:37 | |
| *** datsun180b has quit IRC | 02:41 | |
| *** winston-d_ has quit IRC | 02:45 | |
| *** radez is now known as radez_g0n3 | 02:47 | |
| openstackgerrit | A change was merged to openstack/nova: libvirt: Fix LXC container creation https://review.openstack.org/22065 | 02:47 |
| *** dolphm has joined #openstack-dev | 02:48 | |
| openstackgerrit | A change was merged to openstack/nova: Allow fixed to float ping with external gateway. https://review.openstack.org/21689 | 02:48 |
| *** pabelanger has joined #openstack-dev | 02:48 | |
| *** digitalsanctum has joined #openstack-dev | 02:50 | |
| *** diogogmt has joined #openstack-dev | 02:51 | |
| *** kmartin has joined #openstack-dev | 02:52 | |
| *** buzztroll_ has quit IRC | 02:54 | |
| openstackgerrit | A change was merged to openstack/nova: Change all instances of the non-word "inteface" to "interface" https://review.openstack.org/22273 | 02:56 |
| openstackgerrit | A change was merged to openstack/nova: Added a service heartbeat driver using Memcached. https://review.openstack.org/21574 | 02:57 |
| openstackgerrit | A change was merged to openstack/glance: Use oslo-config-2013.1b3 https://review.openstack.org/22079 | 02:57 |
| *** megha is now known as bsd_freak | 02:57 | |
| openstackgerrit | A change was merged to openstack/nova: libvirt: Use uuid for instance directory name https://review.openstack.org/21287 | 02:57 |
| *** armaan has joined #openstack-dev | 02:57 | |
| openstackgerrit | A change was merged to openstack/keystone: merging in fix from oslo upstream https://review.openstack.org/22383 | 02:57 |
| *** armaan has left #openstack-dev | 02:57 | |
| openstackgerrit | A change was merged to openstack/nova: PowerVMDiskAdapter detach/cleanup refactoring https://review.openstack.org/22284 | 02:58 |
| *** bsd_freak is now known as BSD_freak | 02:58 | |
| openstackgerrit | A change was merged to openstack/ceilometer: Imported Translations from Transifex https://review.openstack.org/22259 | 02:59 |
| openstackgerrit | A change was merged to openstack-infra/devstack-gate: Recapture screen service logs; disable sysloging. https://review.openstack.org/21680 | 02:59 |
| *** yaguang has joined #openstack-dev | 02:59 | |
| *** rkukura has joined #openstack-dev | 02:59 | |
| *** winston-d_ has joined #openstack-dev | 03:00 | |
| *** slackguru has quit IRC | 03:01 | |
| *** anniec has quit IRC | 03:01 | |
| *** AlanClark__ has quit IRC | 03:02 | |
| *** AlanClark__ has joined #openstack-dev | 03:02 | |
| *** ayoung has joined #openstack-dev | 03:03 | |
| *** Mandell has quit IRC | 03:03 | |
| ayoung | dolphm, I'm back | 03:04 |
| dolphm | ayoung: o/ | 03:05 |
| ayoung | dolphm, saw your comments on the Auth plugins. Should I try to get Trusts in first? | 03:05 |
| *** buzztroll_ has joined #openstack-dev | 03:05 | |
| *** novas0x2a|lapto1 has quit IRC | 03:08 | |
| ayoung | dolphm, BTW, you've been going a marathon. I have to admit I';m impressed. | 03:10 |
| *** danwent has quit IRC | 03:11 | |
| *** buzztroll_ has quit IRC | 03:15 | |
| gyee | ayoung, dolphm, code free tonight or tomorrow? | 03:15 |
| *** sacharya1 has joined #openstack-dev | 03:19 | |
| *** jergerber has quit IRC | 03:20 | |
| *** sacharya has quit IRC | 03:22 | |
| ayoung | gyee, I think we have time. ttx is worried about slippage, but gave us the lee way to get your patch and my patch in. | 03:22 |
| gyee | ayoung, still working to get rid of dolphm's nightmare so he can sleep better :) | 03:23 |
| *** thingee_zzz is now known as thingee | 03:23 | |
| ayoung | gyee, need any help? | 03:23 |
| gyee | ayoung, I am good now, was struggling with the policy engine earlier | 03:24 |
| gyee | all the tests should be using the *real* token now | 03:24 |
| *** jog0 has quit IRC | 03:25 | |
| ayoung | gyee, nice. I did a siumliar thing with the test_v3_trust.py | 03:26 |
| ayoung | but that was V2 | 03:26 |
| ayoung | I'll probably need to update that to what you have | 03:26 |
| gyee | ayoung, I had to make some changes to policy.json | 03:26 |
| gyee | the one in tests is bogus | 03:26 |
| *** pixelbeat has quit IRC | 03:26 | |
| *** jkordish has quit IRC | 03:27 | |
| *** jkordish has joined #openstack-dev | 03:27 | |
| topol | gyee, Im around to +1 your authentication stuff but it looks like dolph is the blocker? | 03:27 |
| ayoung | Yeah, I bypassed that awhile back | 03:27 |
| gyee | topol, I am changing it to pass in the auth payload instead of the auth_info object | 03:28 |
| gyee | topol, also updated the doc to incorporate your comments, thanks for reviewing it | 03:28 |
| gyee | ayoung, if you have some cycle, I could use some help translating a v3 PKI token into a v2 PKI token and vice versa | 03:30 |
| *** hattwick has quit IRC | 03:31 | |
| *** danwent has joined #openstack-dev | 03:32 | |
| *** pixelbeat has joined #openstack-dev | 03:34 | |
| topol | ayoung so I had everything working and now I just tried with the latest keystone and now get this beauty: | 03:37 |
| topol | Unable to communicate with identity service: {"error": {"message": "An unexpected error prevented the server from fulfilling your request. {'info': 'domain_id: AttributeDescription contains inappropriate characters', 'desc': 'Undefined attribute type'}", "code": 500, "title": "Internal Server Error"}}. (HTTP 500) | 03:37 |
| topol | when trying to add tenants | 03:38 |
| *** tomoe_ has joined #openstack-dev | 03:38 | |
| *** Ryan_Lane has quit IRC | 03:39 | |
| *** hattwick has joined #openstack-dev | 03:40 | |
| *** martine has joined #openstack-dev | 03:43 | |
| *** JonnyNomad_ has joined #openstack-dev | 03:43 | |
| *** JonnyNomad has quit IRC | 03:44 | |
| openstackgerrit | A change was merged to openstack/quantum: Add Quantum support for NVP Layer-2 gateways https://review.openstack.org/21426 | 03:45 |
| *** buzztroll_ has joined #openstack-dev | 03:47 | |
| *** reed has joined #openstack-dev | 03:52 | |
| *** danwent has quit IRC | 03:53 | |
| topol | ayoung, any idea who put in self.attribute_mapping['domain_id'] = ( | 03:54 |
| topol | conf.ldap.tenant_domain_id_attribute) into /opt/stack/keystone/keystone/identity/backends/ldap/core.py:510 | 03:54 |
| bknudson | topol: you can look this up with blame... | 03:55 |
| *** adjohn has quit IRC | 03:55 | |
| bknudson | topol: https://github.com/openstack/keystone/blame/master/keystone/identity/backends/ldap/core.py#L510 | 03:55 |
| *** ctracey has quit IRC | 03:56 | |
| topol | bknudson: THANKS. It was Henry | 03:56 |
| topol | He went to bed 2:30am his time | 03:57 |
| *** adjohn has joined #openstack-dev | 03:57 | |
| *** sandywalsh has quit IRC | 03:57 | |
| *** tommy_SSU has joined #openstack-dev | 03:58 | |
| *** digitalsanctum has quit IRC | 03:58 | |
| openstackgerrit | A change was merged to openstack/oslo-incubator: Setup exception handler after configuring logging. https://review.openstack.org/22388 | 03:59 |
| *** ctracey has joined #openstack-dev | 04:00 | |
| *** bknudson has quit IRC | 04:00 | |
| *** yaguang has quit IRC | 04:01 | |
| *** yaguang has joined #openstack-dev | 04:01 | |
| *** adjohn has quit IRC | 04:02 | |
| *** henrynash_ has joined #openstack-dev | 04:02 | |
| *** markmcclain has joined #openstack-dev | 04:02 | |
| openstackgerrit | A change was merged to openstack/oslo-incubator: Fix IPC direct topic routing. https://review.openstack.org/21733 | 04:03 |
| *** adjohn has joined #openstack-dev | 04:04 | |
| *** henrynash has quit IRC | 04:05 | |
| *** henrynash_ is now known as henrynash | 04:05 | |
| *** pabelanger has quit IRC | 04:05 | |
| *** koolhead17 has joined #openstack-dev | 04:06 | |
| *** adjohn has quit IRC | 04:06 | |
| *** echohead has quit IRC | 04:07 | |
| ayoung | topol, hmmm | 04:08 |
| *** echohead has joined #openstack-dev | 04:09 | |
| ayoung | topol, this is when I run through the debugger. | 04:09 |
| ayoung | gyee, sure | 04:10 |
| ayoung | the V2 format is kindof ramshackle | 04:10 |
| ayoung | evolved, as it were | 04:10 |
| topol | aroung, is that a nice way of saying we are broken? | 04:11 |
| gyee | ayoung, yeah, this mix v2 and v3 env is dangerous | 04:11 |
| gyee | I can understand rolling upgrade use case | 04:11 |
| ayoung | gyee, I'm not sure that anything other than auth_token should try to deal with both | 04:11 |
| ayoung | and it should have two code paths. What areyou trying to do? | 04:12 |
| gyee | ayoung, I have two code paths | 04:12 |
| gyee | for UUID token, we're covered | 04:12 |
| ayoung | gyee, for keystone server, just do the hash and look up in the db | 04:14 |
| ayoung | gyee, what exactly are you trying to solve? Is this policy enforcement? | 04:16 |
| gyee | ayoung, with your patch, we should already do a token lookup instead of CMS | 04:16 |
| gyee | so we should be fine I think | 04:16 |
| gyee | has your security patch landed yet? | 04:17 |
| ayoung | gyee, hasn't landed yet. | 04:20 |
| ayoung | gyee, is that in your way? | 04:21 |
| gyee | ayoung, sort of | 04:21 |
| ayoung | gyee, code around it | 04:21 |
| gyee | k | 04:21 |
| ayoung | just code as if that patch were applied. | 04:22 |
| *** danwent has joined #openstack-dev | 04:22 | |
| *** bknudson has joined #openstack-dev | 04:23 | |
| *** bdpayne has quit IRC | 04:25 | |
| ayoung | gyee, is that all? | 04:25 |
| *** dims has quit IRC | 04:26 | |
| *** danwent has quit IRC | 04:26 | |
| *** sandywalsh has joined #openstack-dev | 04:30 | |
| *** dims has joined #openstack-dev | 04:30 | |
| *** boris-42 has joined #openstack-dev | 04:31 | |
| *** armaan1 has joined #openstack-dev | 04:32 | |
| *** rpedde_away is now known as rpedde | 04:34 | |
| *** morganfainberg has quit IRC | 04:39 | |
| topol | ayoung, I know you are swamped but one question to help me maintain my sanity and then I'll leave you alone. We can't just do things like the following in ProjectAPI: | 04:39 |
| topol | self.attribute_mapping['domain_id'] = ( | 04:39 |
| topol | conf.ldap.tenant_domain_id_attribute) | 04:39 |
| topol | without understanding that we either map domain_id to something valid in groupOfNames or we put it on the ignore list (which I think would be bad) or do some type of emulator trick like was done for enabled. Otherwise Im confused as heck :-) | 04:39 |
| ayoung | topol, hmmmm | 04:40 |
| ayoung | yeah, it needs to be a valida attribute, and group of names is short on that. | 04:41 |
| *** dims has quit IRC | 04:41 | |
| ayoung | It seems to me that each domain should b its own subtree | 04:41 |
| ayoung | And the domain ID would be part of the DN topol ? | 04:41 |
| topol | ayoung, dunno. we need to shove it somewhere. or find something friendlier than groupOfNames | 04:43 |
| ayoung | topol, agreed. Just had a moment of clarity. | 04:43 |
| topol | ayoung, you think they will let us fix all this stuff after code freeze via opening bugs??? | 04:43 |
| ayoung | Domain are organzational units. The grouping of projects , users, etc, is all subordinate to domains. To me, this says that each domain should be a sub tree. Then ,the domain ID becomes the subtree. | 04:44 |
| gyee | ayoung, we now have v2-v3 token backward compatibility for both uuid and pki tokens at the backend | 04:44 |
| ayoung | and you add it to the CN/DN path | 04:45 |
| gyee | can't do much for middleware though | 04:45 |
| gyee | that'll need to be a separate patch | 04:45 |
| ayoung | gyee, good enough for server side. midddle ware goes on a different schedule anyway | 04:45 |
| gyee | ayoung, pushing a patch soon | 04:45 |
| gyee | that should take care of dolphm's nightmare | 04:45 |
| ayoung | gyee, I'm going to turn in soon, and I'll tkae a look in the morning, I'm on Eastern time. | 04:46 |
| gyee | ayoung, I am tired as hell too | 04:46 |
| ayoung | I wonder why | 04:46 |
| gyee | need to get food | 04:46 |
| *** amotoki_ has joined #openstack-dev | 04:46 | |
| ayoung | topol, I don't know how hard it will be to fix domains for LDAP. | 04:47 |
| *** dolphm has quit IRC | 04:47 | |
| gyee | ayoung, I seem to be on Hawaii time even though I am not | 04:47 |
| ayoung | topol, can you send me a write up of the problem, and I'll use that as a launchboard for writing up the solution? | 04:48 |
| *** amotoki has quit IRC | 04:48 | |
| topol | ayoung, sure | 04:48 |
| topol | have a good night | 04:48 |
| *** sulrich has joined #openstack-dev | 04:50 | |
| *** dolphm has joined #openstack-dev | 04:50 | |
| *** pabelanger has joined #openstack-dev | 04:50 | |
| topol | gyee, Im gonna +1 your dolphm nightmare patch no matter what. youve definitely earned a "sympathy +1" :-) | 04:50 |
| gyee | haha | 04:50 |
| *** Ryan_Lane has joined #openstack-dev | 04:52 | |
| gyee | dolphm, patch #17 should take care of your nightmare | 04:54 |
| *** danwent has joined #openstack-dev | 04:56 | |
| openstackgerrit | A change was merged to openstack-dev/devstack: Add Nova fibre channel support required packages https://review.openstack.org/20003 | 04:57 |
| openstackgerrit | A change was merged to openstack-dev/devstack: Baremetal should start using scheduler filters. https://review.openstack.org/21855 | 04:57 |
| openstackgerrit | A change was merged to openstack-dev/devstack: Correct syntax error in stack.sh https://review.openstack.org/22176 | 04:57 |
| clarkb | fungi: ^ | 04:57 |
| * fungi cheers | 04:59 | |
| *** gyee has quit IRC | 05:00 | |
| *** martine has quit IRC | 05:01 | |
| *** pabelanger has quit IRC | 05:01 | |
| *** sulrich has quit IRC | 05:04 | |
| *** sulrich has joined #openstack-dev | 05:04 | |
| *** aeperezt has quit IRC | 05:05 | |
| *** nunosantos has quit IRC | 05:09 | |
| *** Tross has joined #openstack-dev | 05:10 | |
| *** nati_ueno has quit IRC | 05:12 | |
| *** boris-42 has quit IRC | 05:12 | |
| *** nati_ueno has joined #openstack-dev | 05:13 | |
| *** pixelbeat has quit IRC | 05:13 | |
| *** Mandell has joined #openstack-dev | 05:15 | |
| *** nati_ueno has quit IRC | 05:17 | |
| *** AlanClark__ has quit IRC | 05:18 | |
| *** AlanClark__ has joined #openstack-dev | 05:18 | |
| *** BSD_freak has quit IRC | 05:19 | |
| *** megha has joined #openstack-dev | 05:19 | |
| *** diogogmt has quit IRC | 05:20 | |
| *** ayoung has quit IRC | 05:26 | |
| *** markmcclain has quit IRC | 05:28 | |
| *** avishay has joined #openstack-dev | 05:35 | |
| *** jgriffith has quit IRC | 05:36 | |
| *** topol has quit IRC | 05:37 | |
| *** jgriffith has joined #openstack-dev | 05:37 | |
| *** navid_ has joined #openstack-dev | 05:38 | |
| *** obondarev has quit IRC | 05:39 | |
| *** koolhead17 has quit IRC | 05:39 | |
| *** obondarev has joined #openstack-dev | 05:40 | |
| *** nati_ueno has joined #openstack-dev | 05:45 | |
| *** soody has quit IRC | 05:48 | |
| *** vipul is now known as vipul|away | 05:54 | |
| enikanorov | danwent: hi. here? | 05:56 |
| danwent | enikanorov: hi | 05:56 |
| *** armaan1 has quit IRC | 05:57 | |
| enikanorov | do you have few minutes to discuss the status of namespace haproxy agent? | 05:57 |
| danwent | enikanorov: sure | 06:00 |
| enikanorov | i'd like to go over key points of what we were agreed on: | 06:00 |
| enikanorov | 1) no device scheduling/management | 06:01 |
| enikanorov | 2) generic service agent that loads drivers becomes dedicated haproxy agent | 06:01 |
| enikanorov | 3) haproxy driver does stuff similar to dhcp regarding device creation: | 06:01 |
| enikanorov | it creates quantum port via quantum client, plugs the interface in the port | 06:02 |
| enikanorov | and startes haproxy within namespace that has that interface | 06:02 |
| enikanorov | that's the code we're going to give to Mark | 06:03 |
| danwent | ok | 06:03 |
| danwent | my impression from mark is that the agent wasn't necessarily haproxy specific | 06:03 |
| danwent | but would be load-balancing specific. similar to how there is a dhcp-agent, that could have different drivers (dnsmasq, isc-dhcp) that run in the namespace | 06:04 |
| danwent | but i doubt there's a significant difference in code there | 06:04 |
| enikanorov | yes. | 06:04 |
| danwent | i think you have all of the key points listed above | 06:04 |
| enikanorov | so one concern i have though | 06:04 |
| danwent | k | 06:04 |
| enikanorov | i saw mark's patch regarding VIP creation and port reservation | 06:05 |
| danwent | yes | 06:05 |
| enikanorov | that's kinda overlaps with what driver does | 06:05 |
| enikanorov | so currently the workflow is the next: | 06:05 |
| danwent | yeah.. i forget exactly how the dhcp stuff works now, whether the plugin creates the port that is used by the agent, or if the agent actually creates the port. sounds like the later based on your comments (I'm assuming you've read the code recently) | 06:06 |
| enikanorov | user creates a pool, that causes the driver to prepare infrastructure: port creation, initial config, etc | 06:06 |
| enikanorov | dhcp call plugin to create a port | 06:06 |
| danwent | in this case, we may want to do something closer to what the l3-agent does | 06:06 |
| *** adjohn has joined #openstack-dev | 06:06 | |
| danwent | in which case I think the port is allocated in the plugin (since a specific IP is desired) | 06:07 |
| danwent | it seems valuable to create the port at the plugin, so we can give the user an API error if there is a conflict | 06:07 |
| enikanorov | the problem in this case is that driver works with single objects | 06:07 |
| enikanorov | and pool goes first | 06:07 |
| danwent | rather than having the call succeed. | 06:07 |
| enikanorov | so once user creates a pool, it goes to the driver | 06:07 |
| *** yaguang has quit IRC | 06:07 | |
| enikanorov | driver has to do something with it | 06:08 |
| enikanorov | now it prepares a device (no VIP IP yet!) | 06:08 |
| enikanorov | which gets fixed ip | 06:08 |
| danwent | why does it need a device if it doesn't have a VIP yet? | 06:08 |
| enikanorov | seems like currently there's no way to pass it back to server / pool | 06:08 |
| danwent | sorry, don't follow | 06:09 |
| danwent | until we have a vip, there's really nothing the agent needs to do, is there? | 06:09 |
| *** ek6 has quit IRC | 06:09 | |
| danwent | I'd have to think through the workflow a bit more | 06:09 |
| enikanorov | I'm not sure about this, really | 06:10 |
| enikanorov | it looks like this, at first glance | 06:10 |
| enikanorov | but anyway | 06:10 |
| *** dolphm_ has joined #openstack-dev | 06:10 | |
| enikanorov | lets consider we create device with a VIP, not pool | 06:10 |
| enikanorov | but object model requires pool go first | 06:10 |
| enikanorov | so now we need to pass VIP+pool to the driver | 06:10 |
| enikanorov | at VIP creation | 06:10 |
| *** amotoki_ is now known as amotoki | 06:11 | |
| danwent | yes | 06:11 |
| enikanorov | i see this may complicate both plugin and driver | 06:11 |
| danwent | i actually dont' think you HAVE to wait until VIP creation. | 06:12 |
| enikanorov | what do you mean/ | 06:12 |
| danwent | in theory, you could create a namespace with no interfaces | 06:12 |
| *** dolphm has quit IRC | 06:12 | |
| danwent | when a pool is created. | 06:13 |
| danwent | is it correct to think of a pool and a namespace as one-to-one? | 06:13 |
| danwent | or can a namespace have multiple pools | 06:13 |
| danwent | as long as they are on the same subnet? | 06:13 |
| enikanorov | in fact, i'd say subnet defines a device | 06:13 |
| enikanorov | there may be several pools | 06:13 |
| enikanorov | but i see your point | 06:13 |
| enikanorov | it's a good point :) | 06:14 |
| danwent | seems possible either way | 06:14 |
| enikanorov | but still I see we don't have to reserve port on the plugin side | 06:14 |
| enikanorov | here's why: | 06:14 |
| enikanorov | driver may check if port exists and create another VIP with the same IP, different tcp port | 06:15 |
| enikanorov | and with port creation in the plugin, each new tcp port will cause new device and new process | 06:15 |
| openstackgerrit | A change was merged to openstack/nova: Add support for network adapter hotplug. https://review.openstack.org/21819 | 06:16 |
| clarkb | dansmith: ^ success | 06:16 |
| openstackgerrit | A change was merged to openstack/cinder: Set rootwrap_config in cinder.conf sample. https://review.openstack.org/22265 | 06:16 |
| enikanorov | in fact, i think we just move port creation to the VIP creation in the driver. that would allow to achieve the same as marks patch | 06:16 |
| danwent | not sure I follow. I agree that the IP logic on vip creation needs to handle the fact that it is OK to have multiple VIPs using the same port + IP pair. | 06:16 |
| danwent | (i guess that implies a per-subnet namespace, since these vips could be on different pools) | 06:17 |
| *** hattwick has quit IRC | 06:17 | |
| enikanorov | namespace is per subnet, correct | 06:17 |
| danwent | i think what mark wants to do is make sure that the IP isn't in use by something else (e.g., a nova VM) | 06:17 |
| danwent | perhaps now the patch does not properly handle the case that muliple VIPs may need to use the same port | 06:18 |
| danwent | i haven't had a chance to look at it…been to busy with other g-3 reviews :P | 06:18 |
| enikanorov | I see | 06:18 |
| enikanorov | mark was going to put it as limitation - single vip per device :) | 06:19 |
| danwent | would be good if you could ping him to get his thoughts on whether plugin or agent should do port allocation. | 06:19 |
| danwent | ok, sounds like maybe we can be smarter about it. i'm sure he'd be open to that. | 06:19 |
| danwent | single vip per device? | 06:20 |
| enikanorov | we discussed it a bit yesterday, but i'm not sure we had an agreement :) | 06:20 |
| danwent | where device = namespace? | 06:20 |
| enikanorov | device = port, i'd say | 06:20 |
| enikanorov | (and namespace, yes) | 06:20 |
| danwent | i'd be surprised if that is what mark was thiniking… as even dhcp + l3-namespace support multiple IPs per port. | 06:21 |
| danwent | but i think he was thinking that we might limit an IP address to a single VIP | 06:21 |
| danwent | but it sounds like we can make the "is this IP allocated?" check a bit smarter to get around that. | 06:21 |
| danwent | btw, do you guys have WIP code mark and I could take a look at? it sounds like we're 90% on the same page, but it woudl be good to make sure. | 06:22 |
| enikanorov | we're going to give it to you at the end of our day (since it's night for you anyway) | 06:23 |
| enikanorov | so you could continue the work or comment on it | 06:23 |
| danwent | haha, fair enough. i'm pretty tired of looking through code after reviewing all day anyway | 06:23 |
| enikanorov | i think the most convenient would be to put in on gerrit onder corresponding blueprint | 06:23 |
| enikanorov | draft review | 06:23 |
| danwent | yeah, having something where we could comment would be nice. | 06:24 |
| danwent | like i said, i don't care who writes the code, as long as we're on the same page that its a design we all support. | 06:24 |
| enikanorov | sure. ok, thanks | 06:24 |
| danwent | did mark ping you at all today after you email this morning? i'm worried that we're already duplicating efforts a bit. | 06:24 |
| *** bing_bu has quit IRC | 06:25 | |
| *** AlanClark__ has quit IRC | 06:26 | |
| *** aswadrangnekar has joined #openstack-dev | 06:26 | |
| *** bing_bu has joined #openstack-dev | 06:26 | |
| *** AlanClark__ has joined #openstack-dev | 06:26 | |
| henrynash | dolphm, gyee: henry back on after 4 hours kip, how can I help with stuff (its early morning here in Europe) | 06:26 |
| *** olaph has quit IRC | 06:27 | |
| *** rpedde is now known as rpedde_away | 06:27 | |
| *** olaph has joined #openstack-dev | 06:28 | |
| *** reed has quit IRC | 06:30 | |
| *** vipul|away is now known as vipul | 06:32 | |
| *** johnpur has joined #openstack-dev | 06:33 | |
| *** johnpur has quit IRC | 06:33 | |
| enikanorov | no he didn't yet | 06:35 |
| *** esp has quit IRC | 06:38 | |
| *** kmartin has quit IRC | 06:38 | |
| *** melwitt has quit IRC | 06:39 | |
| *** Ryan_Lane has quit IRC | 06:39 | |
| *** dolphm_ has quit IRC | 06:40 | |
| *** k4n0 has joined #openstack-dev | 06:41 | |
| *** Ryan_Lane has joined #openstack-dev | 06:42 | |
| *** danwent has quit IRC | 06:43 | |
| *** henrynash has quit IRC | 06:46 | |
| *** vipul is now known as vipul|away | 06:48 | |
| *** nati_ueno has quit IRC | 06:55 | |
| *** nati_ueno has joined #openstack-dev | 06:55 | |
| *** romcheg has joined #openstack-dev | 06:57 | |
| *** Nachi has joined #openstack-dev | 06:59 | |
| *** nati_ueno has quit IRC | 06:59 | |
| *** almaisan-away is now known as al-maisan | 07:02 | |
| *** al-maisan is now known as almaisan-away | 07:02 | |
| openstackgerrit | A change was merged to openstack/cinder: Use oslo-config-2013.1b3 https://review.openstack.org/22117 | 07:02 |
| openstackgerrit | A change was merged to openstack/nova: Add support for instance disk IO control. https://review.openstack.org/22105 | 07:02 |
| openstackgerrit | A change was merged to openstack/nova: Add support for instance CPU consumption control. https://review.openstack.org/22106 | 07:03 |
| *** garyk has quit IRC | 07:07 | |
| k4n0 | For my review https://review.openstack.org/#/c/21415/ , unit tests passed in one patchset, and now they are failing for a different patchset with no changes to the code | 07:07 |
| k4n0 | any help? | 07:07 |
| clarkb | k4n0: looks like another database migration with the same number snuck in | 07:08 |
| clarkb | you will need to increment your number up to the next free available number | 07:08 |
| *** esp has joined #openstack-dev | 07:09 | |
| clarkb | k4n0: I would rebase atop master to make sure you get the right number | 07:09 |
| *** b1rkh0ff has quit IRC | 07:09 | |
| *** flaper87 has joined #openstack-dev | 07:10 | |
| *** avishay has quit IRC | 07:10 | |
| *** andrewbogott is now known as andrewbogott_afk | 07:11 | |
| k4n0 | I have rebased with latest master and fixed the migration number issue then resubmitted another patchset, i was watching the jenkins gate logs , it is failing because mysql is unable to create an index too long | 07:12 |
| k4n0 | But the same tests passed yesterday on jenkins | 07:13 |
| *** koolhead17 has joined #openstack-dev | 07:13 | |
| k4n0 | https://jenkins.openstack.org/view/Gate/job/gate-nova-python27/17147/console | 07:14 |
| clarkb | k4n0: so yesterday a change snuck in that broke some of the unittests (they were not run) it is possible that you were affected by that | 07:14 |
| k4n0 | can you please link me to that change? | 07:14 |
| clarkb | k4n0: I don't have it available currently and it has been fixed | 07:15 |
| k4n0 | Anyways this issue is regarding mysql on the jenkins gate environment, (OperationalError: (OperationalError) (1071, 'Specified key was too long; max key length is 1000 bytes') 'CREATE INDEX key_pair_user_id_name_idx ON key_pairs_tmp (user_id, name)' () | 07:15 |
| k4n0 | ) | 07:15 |
| clarkb | http://logs.openstack.org/21415/7/check/gate-nova-python27/16922/console.html.gz notice that only ~4500 tests were run then | 07:15 |
| clarkb | and now you should be close to ~5100 | 07:15 |
| k4n0 | this issue doesnt come up on my local testing environment | 07:15 |
| clarkb | k4n0: that test only runs if you have a mysql server running locally with a special account and DB present | 07:16 |
| clarkb | it will not run at all if you don't have that configured in your test environment | 07:16 |
| k4n0 | Well this test "test_mysql_opportunistically" did run for my patch on jenkins | 07:16 |
| k4n0 | my patch is adding a migration for key_pairs table. | 07:16 |
| clarkb | yes jenkins is configured to run this test | 07:17 |
| clarkb | hwoever, your local test environment probably isnt | 07:17 |
| clarkb | which would explain why you don't have this failure testing in your local test env | 07:17 |
| k4n0 | I have ran this specific test on my local test env | 07:18 |
| k4n0 | And how is it possible that these tests passed for the earlier patchset? | 07:18 |
| clarkb | k4n0: because the earlier patchset was affected by the cahnge that broke testing | 07:18 |
| clarkb | the migration test was never run in taht case | 07:19 |
| clarkb | now that that problem has been corrected you are seeing the failure | 07:19 |
| k4n0 | ohh, i see | 07:19 |
| *** esp has quit IRC | 07:19 | |
| clarkb | k4n0: https://github.com/openstack/nova/blob/master/nova/tests/test_migrations.py#L260 may explain why it passes locally | 07:19 |
| clarkb | it should be counted as a skipped test | 07:20 |
| k4n0 | I just ran the test again on my local test env, (nova.tests.test_migrations.TestMigrations.test_mysql_opportunistically ... ok | 07:20 |
| k4n0 | ) , i have created all the required databases and user and password, the test was not skipped | 07:20 |
| clarkb | maybe it is a mysql config difference then? | 07:20 |
| k4n0 | I am aware that it is skipped if your dont create the "openstack_citest" db and username. | 07:20 |
| k4n0 | Do you know what mysql version does jenkins test on? | 07:21 |
| *** b1rkh0ff has joined #openstack-dev | 07:21 | |
| clarkb | k4n0: whatever is available in ubuntu precise | 07:21 |
| *** aswadrangnekar has quit IRC | 07:21 | |
| clarkb | python 27 runs on precise and python 26 on oneiric so whatever version is availabe on those two distros | 07:21 |
| *** aswadrangnekar has joined #openstack-dev | 07:21 | |
| k4n0 | i am running ubuntu precise, i have installed mysql from default packages | 07:23 |
| *** yolanda has joined #openstack-dev | 07:23 | |
| clarkb | k4n0: I think the jenkins DB is using utf8 as the charset | 07:25 |
| clarkb | if you are not using utf8 that may result in different lengths for the key depending on its types | 07:26 |
| *** shang has quit IRC | 07:26 | |
| k4n0 | I will confirm about utf8 on my local env | 07:26 |
| *** mindpixel has joined #openstack-dev | 07:26 | |
| *** shang has joined #openstack-dev | 07:27 | |
| *** rohitk has joined #openstack-dev | 07:27 | |
| k4n0 | Btw, this is mysql client version (mysql Ver 14.14 Distrib 5.5.24, for debian-linux-gnu (x86_64) using readline 6.2) , server (Server version: 5.5.24-0ubuntu0.12.04.1 (Ubuntu)) | 07:27 |
| *** garyk has joined #openstack-dev | 07:29 | |
| *** afazekas has joined #openstack-dev | 07:33 | |
| *** gray-- has joined #openstack-dev | 07:33 | |
| *** eglynn_ has joined #openstack-dev | 07:37 | |
| *** TerryH has quit IRC | 07:37 | |
| *** jprovazn has joined #openstack-dev | 07:42 | |
| *** esp has joined #openstack-dev | 07:45 | |
| *** stevebaker has quit IRC | 07:46 | |
| *** stevebaker has joined #openstack-dev | 07:47 | |
| *** eglynn_ has quit IRC | 07:48 | |
| *** nmagnezi has joined #openstack-dev | 07:51 | |
| k4n0 | @clarkb , i ran the test with utf8 as default charset for mysql client and server, created new db with utf8 as default charset. "nova.tests.test_migrations.TestMigrations.test_mysql_opportunistically" passed ok | 07:51 |
| *** ajia has quit IRC | 07:52 | |
| clarkb | I am all out of ideas then | 07:52 |
| k4n0 | what storage engine does jenkins mysql use? | 07:53 |
| *** esp has quit IRC | 07:54 | |
| clarkb | innodb | 07:54 |
| openstackgerrit | A change was merged to openstack/nova: support preallocated VM images https://review.openstack.org/22054 | 07:54 |
| openstackgerrit | A change was merged to openstack/quantum: Raising error if invalid attribute passed in. https://review.openstack.org/21849 | 07:55 |
| openstackgerrit | A change was merged to openstack/quantum: Routing table configuration support on L3 https://review.openstack.org/19882 | 07:55 |
| openstackgerrit | A change was merged to openstack/quantum: plugin/nec: Make sure resources on OFC is globally unique. https://review.openstack.org/21627 | 07:55 |
| openstackgerrit | A change was merged to openstack/quantum: Implement MidoNet Quantum Plugin https://review.openstack.org/21856 | 07:55 |
| clarkb | Nachi: ^ there we go :) | 07:55 |
| *** megha has quit IRC | 07:56 | |
| *** eglynn_ has joined #openstack-dev | 07:57 | |
| *** BalleS__ has quit IRC | 07:57 | |
| *** susanne-balle has joined #openstack-dev | 07:58 | |
| *** Nachi has quit IRC | 07:58 | |
| *** nati_ueno has joined #openstack-dev | 07:59 | |
| *** rafaduran has joined #openstack-dev | 08:01 | |
| openstackgerrit | A change was merged to openstack/oslo-config: Add deprecated_group Opt kwarg https://review.openstack.org/22076 | 08:03 |
| *** davidha has quit IRC | 08:04 | |
| *** AnilV4 has joined #openstack-dev | 08:05 | |
| *** mrunge has joined #openstack-dev | 08:07 | |
| *** reidrac has joined #openstack-dev | 08:09 | |
| rohitk | jaypipes: ping | 08:10 |
| *** ajia has joined #openstack-dev | 08:10 | |
| *** thouveng has quit IRC | 08:10 | |
| *** unix has joined #openstack-dev | 08:11 | |
| *** xga_ has joined #openstack-dev | 08:13 | |
| *** xgauvrit has joined #openstack-dev | 08:13 | |
| *** xga__ has joined #openstack-dev | 08:17 | |
| *** armaan has joined #openstack-dev | 08:17 | |
| *** xga_ has quit IRC | 08:17 | |
| *** xgauvrit has quit IRC | 08:18 | |
| *** Ryan_Lane has quit IRC | 08:18 | |
| *** xgauvrit has joined #openstack-dev | 08:19 | |
| *** pmyers has quit IRC | 08:19 | |
| *** mmagr has joined #openstack-dev | 08:19 | |
| *** buzztroll_ has quit IRC | 08:20 | |
| *** Ryan_Lane has joined #openstack-dev | 08:20 | |
| *** gargya has joined #openstack-dev | 08:21 | |
| *** dachary has quit IRC | 08:21 | |
| *** esp1 has joined #openstack-dev | 08:22 | |
| *** ajia has quit IRC | 08:22 | |
| *** Ryan_Lane has quit IRC | 08:22 | |
| *** ajia has joined #openstack-dev | 08:22 | |
| *** jgallard has joined #openstack-dev | 08:22 | |
| *** dachary has joined #openstack-dev | 08:24 | |
| zykes- | is ASI getting into Grizzly - @ quantum team | 08:24 |
| *** burris has quit IRC | 08:25 | |
| *** reed has joined #openstack-dev | 08:27 | |
| *** psedlak has joined #openstack-dev | 08:32 | |
| *** esp1 has quit IRC | 08:34 | |
| *** tommy_SSU has quit IRC | 08:35 | |
| *** aloga has quit IRC | 08:36 | |
| *** Nachi has joined #openstack-dev | 08:37 | |
| *** aloga has joined #openstack-dev | 08:37 | |
| *** shardy_afk is now known as shardy | 08:37 | |
| *** nati_ueno has quit IRC | 08:39 | |
| openstackgerrit | A change was merged to openstack/nova: Add basic infrastructure for compute driver async events https://review.openstack.org/21800 | 08:41 |
| openstackgerrit | A change was merged to openstack/nova: Add support for lifecycle events in the libvirt driver https://review.openstack.org/21801 | 08:42 |
| *** AlanClark__ has quit IRC | 08:42 | |
| *** AlanClark__ has joined #openstack-dev | 08:42 | |
| *** avishay has joined #openstack-dev | 08:42 | |
| *** zing has joined #openstack-dev | 08:42 | |
| openstackgerrit | A change was merged to openstack/nova: Handle lifecycle events in the compute manager https://review.openstack.org/21802 | 08:43 |
| openstackgerrit | A change was merged to openstack/nova: Multi-tenancy isolation with aggregates https://review.openstack.org/20565 | 08:43 |
| *** ajia has quit IRC | 08:44 | |
| openstackgerrit | A change was merged to openstack-infra/devstack-gate: turn off color logs https://review.openstack.org/22389 | 08:45 |
| *** tomoe_ has quit IRC | 08:47 | |
| *** davidha has joined #openstack-dev | 08:47 | |
| *** tomoe_ has joined #openstack-dev | 08:47 | |
| *** morganfainberg has joined #openstack-dev | 08:49 | |
| openstackgerrit | A change was merged to openstack/nova: Use oslo-config-2013.1b4 https://review.openstack.org/22078 | 08:50 |
| openstackgerrit | A change was merged to openstack/cinder: Handle maxclonepervolume/node limits in SF driver. https://review.openstack.org/22395 | 08:50 |
| *** darjeeling has quit IRC | 08:50 | |
| *** asalkeld has quit IRC | 08:51 | |
| *** stevebaker has quit IRC | 08:51 | |
| *** asalkeld has joined #openstack-dev | 08:51 | |
| *** ndipanov has joined #openstack-dev | 08:52 | |
| *** tomoe_ has quit IRC | 08:52 | |
| *** bing_bu has quit IRC | 08:54 | |
| *** giulivo has joined #openstack-dev | 08:55 | |
| *** winston-d_ has quit IRC | 08:55 | |
| openstackgerrit | A change was merged to openstack/horizon: Add support for both soft and hard reboot options https://review.openstack.org/22300 | 08:56 |
| *** ajia has joined #openstack-dev | 08:56 | |
| *** buzztroll_ has joined #openstack-dev | 08:57 | |
| openstackgerrit | A change was merged to openstack/cinder: Add a volume driver in Cinder for Scality SOFS https://review.openstack.org/19675 | 08:58 |
| *** shang has quit IRC | 08:59 | |
| *** esp has joined #openstack-dev | 09:00 | |
| *** shang has joined #openstack-dev | 09:01 | |
| *** dosaboy has joined #openstack-dev | 09:02 | |
| *** FlorianOtel has joined #openstack-dev | 09:03 | |
| *** esp has quit IRC | 09:04 | |
| *** esp has joined #openstack-dev | 09:04 | |
| *** yaguang has joined #openstack-dev | 09:06 | |
| *** adjohn has quit IRC | 09:08 | |
| *** nmagnezi has quit IRC | 09:08 | |
| *** dachary has quit IRC | 09:09 | |
| *** iartarisi has joined #openstack-dev | 09:10 | |
| *** henrynash has joined #openstack-dev | 09:11 | |
| *** esp has quit IRC | 09:11 | |
| *** salv-orlando has joined #openstack-dev | 09:13 | |
| *** romcheg has left #openstack-dev | 09:13 | |
| *** dachary has joined #openstack-dev | 09:14 | |
| *** trapni has joined #openstack-dev | 09:19 | |
| *** trapni has joined #openstack-dev | 09:19 | |
| *** derekh has joined #openstack-dev | 09:20 | |
| *** yolanda has quit IRC | 09:20 | |
| *** derekh has quit IRC | 09:20 | |
| openstackgerrit | A change was merged to openstack/quantum: Add support Quantum Security Groups for Ryu plugin https://review.openstack.org/21963 | 09:21 |
| *** derekh has joined #openstack-dev | 09:21 | |
| *** yolanda has joined #openstack-dev | 09:23 | |
| *** trapnii has joined #openstack-dev | 09:24 | |
| *** Mandell has quit IRC | 09:24 | |
| *** nati_ueno has joined #openstack-dev | 09:25 | |
| *** trapni has quit IRC | 09:26 | |
| *** Nachi has quit IRC | 09:28 | |
| *** dosaboy has quit IRC | 09:30 | |
| *** jruzicka has joined #openstack-dev | 09:33 | |
| *** dosaboy has joined #openstack-dev | 09:34 | |
| *** zoresvit has joined #openstack-dev | 09:35 | |
| *** jgallard has quit IRC | 09:35 | |
| *** nati_ueno has quit IRC | 09:37 | |
| *** nati_ueno has joined #openstack-dev | 09:37 | |
| *** esp has joined #openstack-dev | 09:38 | |
| *** adjohn has joined #openstack-dev | 09:38 | |
| *** amotoki has quit IRC | 09:39 | |
| *** sthaha has quit IRC | 09:41 | |
| *** nati_ueno has quit IRC | 09:42 | |
| *** CaptTofu_ has joined #openstack-dev | 09:44 | |
| *** zoresvit has quit IRC | 09:46 | |
| *** BobBall has joined #openstack-dev | 09:46 | |
| *** CaptTofu has quit IRC | 09:47 | |
| *** adjohn has quit IRC | 09:48 | |
| *** davidh_ has joined #openstack-dev | 09:48 | |
| *** davidha has quit IRC | 09:48 | |
| *** johnthetubaguy has joined #openstack-dev | 09:49 | |
| *** milez has quit IRC | 09:50 | |
| *** AlanClark__ has quit IRC | 09:50 | |
| *** AlanClark__ has joined #openstack-dev | 09:50 | |
| *** esp has quit IRC | 09:50 | |
| *** nati_ueno has joined #openstack-dev | 09:51 | |
| *** shang has quit IRC | 09:52 | |
| *** pixelbeat has joined #openstack-dev | 09:53 | |
| *** trapnii has quit IRC | 09:57 | |
| *** mohits has quit IRC | 09:58 | |
| *** armaan has quit IRC | 09:59 | |
| *** jgallard has joined #openstack-dev | 10:00 | |
| *** zoresvit has joined #openstack-dev | 10:00 | |
| *** markwash has quit IRC | 10:01 | |
| *** dachary has joined #openstack-dev | 10:03 | |
| *** davidha has joined #openstack-dev | 10:03 | |
| *** avishay has quit IRC | 10:04 | |
| *** danpb has joined #openstack-dev | 10:04 | |
| *** shang has joined #openstack-dev | 10:05 | |
| *** davidh_ has quit IRC | 10:06 | |
| *** nati_ueno has quit IRC | 10:06 | |
| *** nati_ueno has joined #openstack-dev | 10:06 | |
| openstackgerrit | A change was merged to openstack/quantum: Resolve branches in db migration scripts to G-3 release https://review.openstack.org/22405 | 10:10 |
| *** nati_ueno has quit IRC | 10:11 | |
| *** ondergetekende has joined #openstack-dev | 10:14 | |
| *** adjohn has joined #openstack-dev | 10:15 | |
| *** thingee is now known as thingee_zzz | 10:15 | |
| *** mohits has joined #openstack-dev | 10:16 | |
| *** esp has joined #openstack-dev | 10:17 | |
| *** adjohn has quit IRC | 10:19 | |
| *** avishay has joined #openstack-dev | 10:21 | |
| *** markwash has joined #openstack-dev | 10:23 | |
| *** tommy_SSU has joined #openstack-dev | 10:24 | |
| *** tommy_SSU has quit IRC | 10:25 | |
| openstackgerrit | A change was merged to openstack/keystone: Disable XML entity parsing https://review.openstack.org/22315 | 10:26 |
| *** mohits1 has joined #openstack-dev | 10:26 | |
| *** mohits has quit IRC | 10:27 | |
| openstackgerrit | A change was merged to openstack/keystone: make LDAP query scope configurable https://review.openstack.org/21664 | 10:28 |
| *** esp has quit IRC | 10:29 | |
| roz | hi all, nova unit tests are broken? I can see errors about cfg and precisely from oslo.config import cfg | 10:33 |
| *** hattwick has joined #openstack-dev | 10:35 | |
| openstackgerrit | A change was merged to openstack/cinder: Update cinder-manage to use FLAGS.log_dir. https://review.openstack.org/22332 | 10:36 |
| ttx | roz: hmm, it's a side-effect of using the oslo-config library... don't know what's the workaround though | 10:38 |
| ttx | roz: markmc should be up any moment and be able to help you | 10:38 |
| roz | ttx: thanks I am waiting for markmc | 10:39 |
| *** darjeeli_ has joined #openstack-dev | 10:39 | |
| benner | it seems that Firefox 19 can't parse some horizon javascript and get error: SyntaxError: invalid increment operand (function(){this.id||(this.id="ui-id-"+++n)})},removeUniqueId:function()). Chrome 24 is OK | 10:40 |
| *** darjeel__ has joined #openstack-dev | 10:40 | |
| *** mindpixel has quit IRC | 10:40 | |
| ttx | benner: could you file a bug about that ? https://bugs.launchpad.net/horizon/+filebug | 10:40 |
| *** darjee___ has joined #openstack-dev | 10:40 | |
| *** romcheg has joined #openstack-dev | 10:41 | |
| *** romcheg has quit IRC | 10:42 | |
| *** romcheg has joined #openstack-dev | 10:43 | |
| *** darjeeli_ has quit IRC | 10:44 | |
| *** darjeel__ has quit IRC | 10:44 | |
| zing | roz: there was some stuff on mailing list a few days ago about it | 10:51 |
| zing | http://lists.openstack.org/pipermail/openstack-dev/2013-February/005822.html | 10:51 |
| zing | and http://lists.openstack.org/pipermail/openstack-dev/2013-February/005777.html | 10:51 |
| zing | might help | 10:51 |
| *** esp has joined #openstack-dev | 10:55 | |
| roz | zing: thanks for that | 10:56 |
| mordred | ttx: are you talking about the install-venv-uses-cfg thing? | 10:57 |
| mordred | ttx: I just started hacking on that code on the plane and noticed that it was doing that ... want to talk to markmc myself | 10:57 |
| *** davidh_ has joined #openstack-dev | 10:57 | |
| ttx | mordred: yeô | 10:58 |
| mordred | ttx: and then I'd REALLY like to schedule a summit session to talk about the seventy-bazillion different ways we think about venvs around here and if perhaps all of them could do with scaling back | 10:58 |
| ttx | yes | 10:58 |
| benner | ttx: i did litle more investigation. after JS compression "(this.id="ui-id-"+ ++n)})" becames "(this.id="ui-id-"+++n)})". Maybe it's not realy dashboard bug but django? | 10:58 |
| *** johnthetubaguy has quit IRC | 10:59 | |
| ttx | benner: they should be able to sort out responsibility on the bug | 10:59 |
| *** johnthetubaguy has joined #openstack-dev | 10:59 | |
| *** davidha has quit IRC | 11:00 | |
| *** darjeeling has joined #openstack-dev | 11:03 | |
| koolhead17 | GheRivero: hey there | 11:05 |
| *** yamahata has joined #openstack-dev | 11:07 | |
| *** darjee___ has quit IRC | 11:07 | |
| *** esp has quit IRC | 11:07 | |
| benner | ok, filed bug: https://bugs.launchpad.net/horizon/+bug/1130610 | 11:09 |
| uvirtbot | Launchpad bug 1130610 in horizon ""SyntaxError: invalid increment operand" when parsing JavaScript using Firefox" [Undecided,New] | 11:09 |
| *** tomoe_ has joined #openstack-dev | 11:10 | |
| *** darjeeling has quit IRC | 11:13 | |
| *** tommy_SSU has joined #openstack-dev | 11:19 | |
| *** armaan has joined #openstack-dev | 11:20 | |
| *** xgauvrit has quit IRC | 11:21 | |
| *** xga__ has quit IRC | 11:22 | |
| *** gargya has quit IRC | 11:22 | |
| alexxu | salv-orlando, ping | 11:26 |
| *** morganfainberg has quit IRC | 11:27 | |
| *** jprovazn has quit IRC | 11:28 | |
| *** darjeeling has joined #openstack-dev | 11:31 | |
| *** yamahata has quit IRC | 11:31 | |
| salv-orlando | hi alexxu | 11:33 |
| *** amerine has quit IRC | 11:33 | |
| alexxu | salv-orlando, Hi! thanks for your review for pagination! There is pagination client side code waiting for review. Would you help review it if you have time? | 11:33 |
| *** esp has joined #openstack-dev | 11:34 | |
| alexxu | salv-orlando, but I asked gongyh, It needn't merged before feature freeze, I also can file bug for it, and review it at RC | 11:34 |
| *** vkmc has joined #openstack-dev | 11:35 | |
| *** arbrandes has joined #openstack-dev | 11:35 | |
| salv-orlando | alexxu: indeed. I am spending my time now on gongysh and zyluo patches | 11:36 |
| salv-orlando | We should be able to merge your client side (and XML support) patches soon | 11:36 |
| *** mohits1 is now known as mohits | 11:37 | |
| *** mohits has quit IRC | 11:37 | |
| *** mohits has joined #openstack-dev | 11:37 | |
| alexxu | salv-orlando, I think xml support and client side code isn't big, we can review it at RC. We can spend more time for help gongysh and zyluo. | 11:37 |
| salv-orlando | yes - actually I wanted to ask you if can kindly file a lp bug for the XML support patch, target to RC-1, and then change the commit message? | 11:38 |
| alexxu | salv-orlando, sure, I will file bug and change the log | 11:39 |
| *** yaguang has left #openstack-dev | 11:41 | |
| *** yaguang has joined #openstack-dev | 11:41 | |
| *** armaan1 has joined #openstack-dev | 11:43 | |
| k4n0 | @sdague , please review https://review.openstack.org/#/c/21415/ | 11:43 |
| k4n0 | and any other core reviewers too | 11:43 |
| *** zyluo has quit IRC | 11:44 | |
| *** armaan has quit IRC | 11:45 | |
| *** darjeeli_ has joined #openstack-dev | 11:46 | |
| *** esp has quit IRC | 11:47 | |
| *** darjeeling has quit IRC | 11:49 | |
| *** darjeeling has joined #openstack-dev | 11:49 | |
| *** darjeeli_ has quit IRC | 11:50 | |
| *** maurosr has joined #openstack-dev | 11:51 | |
| *** zeriouz has joined #openstack-dev | 11:52 | |
| *** gargya has joined #openstack-dev | 11:55 | |
| *** sulrich_ has joined #openstack-dev | 11:58 | |
| *** salv-orlando has quit IRC | 11:59 | |
| *** sulrich_ has quit IRC | 12:00 | |
| *** sulrich has quit IRC | 12:02 | |
| *** avishay has quit IRC | 12:05 | |
| *** AlanClark__ has quit IRC | 12:06 | |
| *** AlanClark__ has joined #openstack-dev | 12:06 | |
| *** adalbas has joined #openstack-dev | 12:10 | |
| *** salv-orlando has joined #openstack-dev | 12:11 | |
| *** boris-42 has joined #openstack-dev | 12:11 | |
| boris-42 | sdague: Hi | 12:11 |
| *** pcm_ has joined #openstack-dev | 12:12 | |
| *** esp has joined #openstack-dev | 12:13 | |
| *** adjohn has joined #openstack-dev | 12:16 | |
| *** salv-orlando has quit IRC | 12:16 | |
| *** corrigac has quit IRC | 12:18 | |
| *** salv-orlando has joined #openstack-dev | 12:19 | |
| *** yamahata has joined #openstack-dev | 12:19 | |
| *** pmyers has joined #openstack-dev | 12:22 | |
| *** esp has quit IRC | 12:25 | |
| *** xgauvrit has joined #openstack-dev | 12:26 | |
| *** xga_ has joined #openstack-dev | 12:26 | |
| *** koolhead17 has quit IRC | 12:27 | |
| *** pmyers has quit IRC | 12:27 | |
| *** darraghb has joined #openstack-dev | 12:28 | |
| sdague | boris-42: hey | 12:28 |
| *** pmyers has joined #openstack-dev | 12:29 | |
| *** pmyers has quit IRC | 12:31 | |
| *** mohits1 has joined #openstack-dev | 12:31 | |
| *** pmyers has joined #openstack-dev | 12:31 | |
| *** mohits has quit IRC | 12:33 | |
| *** johnthetubaguy has quit IRC | 12:35 | |
| boris-42 | sdague: probably we should use in 21415 patch set common code for dropping non unique rows? | 12:41 |
| *** dims has joined #openstack-dev | 12:44 | |
| *** soody has joined #openstack-dev | 12:49 | |
| *** ayoung has joined #openstack-dev | 12:50 | |
| k4n0 | Hi @boris-42 we are renaming duplicate keypairs , not dropping them. | 12:50 |
| k4n0 | this was suggested by @sdague | 12:50 |
| *** tommy_SSU has quit IRC | 12:51 | |
| *** markvoelker has joined #openstack-dev | 12:52 | |
| *** esp has joined #openstack-dev | 12:52 | |
| sdague | boris-42: feel free to put that on the comments | 12:53 |
| sdague | I'm ok either way | 12:53 |
| boris-42 | k4no, sdague I am not sure that this is good approach, because DBA will have a lot of work after this migration.. to remove all keys... | 12:53 |
| boris-42 | all rows* | 12:53 |
| *** soody has quit IRC | 12:53 | |
| k4n0 | i think dropping key_pairs will cause more inconvience to the user who is using them to access vm's, renaming them doesnt disrupt their access to vm's using those keypairs | 12:54 |
| boris-42 | In both cases could wait a little bit, I want to take a look at migration script.. but currently I am busy.. | 12:54 |
| boris-42 | k4no: Ok | 12:55 |
| sdague | boris-42: ok, so flag the review with a -1 for now saying you want to look | 12:55 |
| sdague | then remove the -1 later if you are ok with it | 12:55 |
| boris-42 | I have already flag it=) but there is bug typo=) | 12:55 |
| *** markmc has joined #openstack-dev | 12:55 | |
| sdague | ok | 12:55 |
| k4n0 | pushing fixes for the typo | 12:55 |
| boris-42 | k4no: Ok so I am also for this approach | 12:55 |
| boris-42 | k4n0 just wait my review pls=) | 12:56 |
| k4n0 | @boris-42 your review ? | 12:56 |
| *** martine_ has joined #openstack-dev | 12:59 | |
| boris-42 | k4n0 yes | 13:00 |
| *** fesp has joined #openstack-dev | 13:01 | |
| *** adjohn has quit IRC | 13:01 | |
| k4n0 | I pushed new patch with fixes for typo and added comments suggested by sean | 13:01 |
| *** flaper87 has quit IRC | 13:01 | |
| *** henrynash has quit IRC | 13:02 | |
| *** henrynash has joined #openstack-dev | 13:03 | |
| *** esp has quit IRC | 13:05 | |
| *** xga_ has quit IRC | 13:06 | |
| *** henrynash has quit IRC | 13:06 | |
| *** xgauvrit has quit IRC | 13:06 | |
| *** zeriouz has quit IRC | 13:07 | |
| *** afazekas has quit IRC | 13:07 | |
| *** zeriouz has joined #openstack-dev | 13:07 | |
| *** Yada has joined #openstack-dev | 13:07 | |
| mordred | markmc: ola! | 13:09 |
| markmc | mordred, yo | 13:09 |
| mordred | markmc: I'm in your timezone - so I can terrorize you more soundly | 13:11 |
| *** corXi has joined #openstack-dev | 13:11 | |
| markmc | mordred, that sounds like a terrible idea | 13:11 |
| mordred | markmc: such a good idea | 13:11 |
| markmc | mordred, what's up? | 13:12 |
| mordred | markmc: anywhoo... I started poking at the idea of taking the various python stuff we have in tools/ from nova and oslo-incubator and making an actual installable project with it | 13:12 |
| mordred | markmc: (needed plane hacking) | 13:12 |
| mordred | markmc: which caused me to actually look at install_venv.py | 13:13 |
| mordred | before I get too far down that road - I wanted to touch base with you on the idea at all | 13:13 |
| *** anniec has joined #openstack-dev | 13:13 | |
| *** johnthetubaguy has joined #openstack-dev | 13:13 | |
| *** dhellmann is now known as dhellmann-afk | 13:13 | |
| markmc | mordred, sounds good, with the usual caveat about compat | 13:13 |
| *** anniec has quit IRC | 13:13 | |
| mordred | totally | 13:14 |
| *** anniec has joined #openstack-dev | 13:14 | |
| markmc | mordred, once it's an installable thing that projects depend on, you can't break things anymore :) | 13:14 |
| markmc | mordred, wrt install_venv.py ... why does it even exist anymore ? | 13:14 |
| *** AlanClark__ has quit IRC | 13:14 | |
| mordred | I have no idea | 13:14 |
| markmc | mordred, doesn't tox do the same thing? | 13:14 |
| mordred | it does | 13:14 |
| *** AlanClark__ has joined #openstack-dev | 13:14 | |
| markmc | ok :) | 13:14 |
| mordred | I plan on doing a summit session on virtualenv management stuff | 13:14 |
| sdague | markmc: so.... python update.py ../nova no longer works? | 13:14 |
| sdague | ImportError: No module named oslo.config | 13:15 |
| markmc | sdague, yeah, you need oslo-config installed | 13:15 |
| *** mrunge has quit IRC | 13:15 | |
| *** johnthetubaguy1 has joined #openstack-dev | 13:15 | |
| markmc | sdague, maybe re-instate update.sh and have it install oslo-config in a venv ? | 13:15 |
| sdague | markmc: so I have to install to my global env? | 13:15 |
| markmc | sdague, right | 13:15 |
| sdague | markmc: yeh, it would be nice if we could do it in a venv | 13:15 |
| sdague | given that the rest of our tooling seems to do that | 13:16 |
| markmc | sdague, well, look at the update.sh I deleted | 13:16 |
| markmc | sdague, would be trivial to stick a 'pip install' of the oslo-config tarball in there | 13:17 |
| markmc | sdague, in place of the 'python setup.py install' | 13:17 |
| sdague | markmc: right, and because oslo-config isn't on pypi, you can't just install it right now | 13:17 |
| *** dprince has joined #openstack-dev | 13:17 | |
| markmc | sdague, 'yum install python-oslo-config' works fine on Fedora :) | 13:17 |
| sdague | markmc: yeh, well :P | 13:18 |
| sdague | seems like we are in a lot of dark magic here | 13:18 |
| *** johnthetubaguy has quit IRC | 13:18 | |
| sdague | ok, let me look at restoring the .sh | 13:18 |
| *** fesp is now known as flaper87 | 13:18 | |
| markmc | sdague, dark magic? | 13:18 |
| mordred | have I mentioned that the bootstrap-working-environment task is actually really hard? | 13:18 |
| sdague | just that no one that doesn't deeply understand oslo can run the update script right now | 13:19 |
| * mordred says this continually facing wanting a self-sufficient setup.py without copying stuff | 13:19 | |
| markmc | sdague, it's hardly rocket science :) | 13:19 |
| *** zeriouz has quit IRC | 13:19 | |
| *** susanne-balle has quit IRC | 13:19 | |
| sdague | markmc: not saying it's rocket science, just not documented :) | 13:19 |
| *** baba has joined #openstack-dev | 13:19 | |
| mordred | markmc: wait - isn't all of openstack technically rockscience because of the nasa background? | 13:19 |
| *** unix has quit IRC | 13:19 | |
| markmc | sdague, bah, who reads docs :) | 13:19 |
| sdague | well, usually not me.... but even when I fell back to the README it wasn't helpful :) | 13:20 |
| markmc | sdague, patches for update.sh, https://wiki.openstack.org/wiki/Oslo, the docstring in update.py ... all welcome :) | 13:22 |
| sdague | markmc: yep, working on it | 13:22 |
| markmc | sdague, thanks for pointing it out, hadn't thought of the update.sh thing until you said it | 13:22 |
| *** radez_g0n3 is now known as radez | 13:22 | |
| openstackgerrit | A change was merged to openstack/nova: Fix hacking test to handle namespace packages. https://review.openstack.org/22385 | 13:24 |
| openstackgerrit | A change was merged to openstack/nova: Documentation cleanups for nova devref https://review.openstack.org/22299 | 13:24 |
| *** eglynn_ has quit IRC | 13:24 | |
| openstackgerrit | A change was merged to openstack/nova: Fix network list and show with quantum. https://review.openstack.org/22264 | 13:24 |
| *** eglynn_ has joined #openstack-dev | 13:25 | |
| *** afazekas has joined #openstack-dev | 13:26 | |
| dims | sdague, one more victim of oslo-config - https://bugs.launchpad.net/cinder/+bug/1130669 | 13:26 |
| openstackgerrit | A change was merged to openstack/nova: Fix inaccuracies in the development environment doc. https://review.openstack.org/21571 | 13:26 |
| uvirtbot | Launchpad bug 1130669 in cinder "./run_tests.sh returns immediately without error" [Undecided,New] | 13:26 |
| sdague | hmmm... now I'm confused | 13:26 |
| sdague | markmc: so oslo has no equiv with_venv.sh script? | 13:27 |
| *** alunduil has quit IRC | 13:27 | |
| *** adjohn has joined #openstack-dev | 13:27 | |
| openstackgerrit | A change was merged to openstack/nova: Make ComputeTestCase.test_state_revert faster https://review.openstack.org/22384 | 13:28 |
| pcm_ | [devstack] Dumb question… if I create a user and give them member role for a project, shouldn't I then be able to log in as said user? | 13:31 |
| markmc | sdague, what's with_venv.sh? I use tox | 13:31 |
| sdague | markmc: it's just an activate wrapper | 13:32 |
| *** Tross has quit IRC | 13:32 | |
| markmc | sdague, yeah, but what's the issue? | 13:32 |
| sdague | https://review.openstack.org/#/c/22423/ - that doesn't work, but I'm out of my depth on venv | 13:32 |
| *** esp has joined #openstack-dev | 13:32 | |
| sdague | markmc: the venv still isn't found | 13:32 |
| *** adjohn has quit IRC | 13:32 | |
| markmc | sdague, you want to use the tools/pip-requires venv for running update.py ? | 13:32 |
| sdague | markmc: that seems like the thing to do, no? | 13:32 |
| *** mtreinish has joined #openstack-dev | 13:33 | |
| markmc | sdague, commented in the review | 13:34 |
| mordred | markmc, sdague: the tl;dr on my summit "let's talk about venv stuff" session is - we've built up wrappers for standard python things, and I think some of the wrappers are themselves getting too complex | 13:34 |
| markmc | sdague, the update.sh idea is that update.py would have its own tiny venv with just oslo-config installed | 13:34 |
| mordred | (have been, but let's be generous) | 13:34 |
| *** xgauvrit has joined #openstack-dev | 13:35 | |
| *** xga_ has joined #openstack-dev | 13:35 | |
| *** afazekas has quit IRC | 13:36 | |
| *** romcheg1 has joined #openstack-dev | 13:36 | |
| *** romcheg has quit IRC | 13:37 | |
| openstackgerrit | A change was merged to openstack/nova: Fix leak of loop/nbd devices in injection using localfs https://review.openstack.org/22291 | 13:38 |
| *** bknudson has quit IRC | 13:38 | |
| *** dolphm has joined #openstack-dev | 13:41 | |
| sdague | markmc: there, that should work | 13:41 |
| *** johnthetubaguy1 has left #openstack-dev | 13:42 | |
| *** johnthetubaguy has joined #openstack-dev | 13:43 | |
| sdague | markmc: oh, there is a spelling error in a comment on that, let me fix | 13:44 |
| *** esp has quit IRC | 13:45 | |
| *** mohits1 has quit IRC | 13:46 | |
| *** topol has joined #openstack-dev | 13:46 | |
| *** mohits has joined #openstack-dev | 13:47 | |
| k4n0 | @sdague, @boris-42, Nova-core , please review https://review.openstack.org/#/c/21415/ | 13:49 |
| *** bknudson has joined #openstack-dev | 13:53 | |
| ttx | dolphm: good morning. https://review.openstack.org/#/c/21487/ awaits your review pleasure. | 13:53 |
| mordred | markmc: https://github.com/emonty/oslo-hacking | 13:57 |
| mordred | markmc: there's a first stab | 13:57 |
| markmc | mordred, cool, looks good | 13:57 |
| mordred | markmc: I'm going to go back and do a git history split so it doesn't look like I wrote everything | 13:58 |
| markmc | mordred, yeah, I used git filter-branch to do that | 13:58 |
| *** adjohn has joined #openstack-dev | 13:58 | |
| *** henrynash has joined #openstack-dev | 13:58 | |
| markmc | mordred, each of the cmd modules should probably only publicly expose the main() function | 13:58 |
| markmc | mordred, everything else private | 13:58 |
| *** bknudson has quit IRC | 13:59 | |
| *** anteaya has joined #openstack-dev | 13:59 | |
| mordred | also - there were a bunch of nova-isms that were still lurking in install_venv that I removed - I'll send those in as a patch to oslo-incubator so that we can get review on that | 13:59 |
| mordred | markmc: you mean via __all__ - or just via _ prefixes? | 13:59 |
| markmc | cool | 13:59 |
| markmc | mordred, either is fine by me | 13:59 |
| mordred | kk | 13:59 |
| mordred | good call | 13:59 |
| *** Tross has joined #openstack-dev | 14:01 | |
| * ttx would like a few more patches in before relaxing the review rules, but we are on a good slope | 14:02 | |
| *** adjohn has quit IRC | 14:03 | |
| *** surya has joined #openstack-dev | 14:03 | |
| *** surya is now known as Guest33662 | 14:03 | |
| *** afazekas has joined #openstack-dev | 14:04 | |
| *** Dr_Who has joined #openstack-dev | 14:04 | |
| *** Dr_Who has joined #openstack-dev | 14:04 | |
| *** Dr_Who is now known as tgall | 14:05 | |
| *** dhellmann-afk is now known as dhellmann | 14:07 | |
| *** dosaboy has quit IRC | 14:08 | |
| *** darjeeli_ has joined #openstack-dev | 14:08 | |
| *** dosaboy has joined #openstack-dev | 14:08 | |
| *** esp has joined #openstack-dev | 14:10 | |
| *** darjeeling has quit IRC | 14:11 | |
| *** eharney has joined #openstack-dev | 14:11 | |
| *** eharney has quit IRC | 14:11 | |
| *** eharney has joined #openstack-dev | 14:11 | |
| *** bknudson has joined #openstack-dev | 14:12 | |
| *** darjeeli_ has quit IRC | 14:13 | |
| *** k4n0 has left #openstack-dev | 14:14 | |
| *** almaisan-away is now known as al-maisan | 14:15 | |
| *** digitalsanctum has joined #openstack-dev | 14:15 | |
| *** Guest33662 has quit IRC | 14:16 | |
| *** kbringard has joined #openstack-dev | 14:20 | |
| iccha | jk0: around? if you got time can you look at https://review.openstack.org/#/c/21606/ | 14:20 |
| *** mohits1 has joined #openstack-dev | 14:22 | |
| *** esp has quit IRC | 14:23 | |
| *** mohits has quit IRC | 14:24 | |
| *** giulivo has quit IRC | 14:24 | |
| ayoung | dolphm, looking at your comments on the password plugin "i still find conditionally modifying the user context to be incredibly confusing. don't pass in user_context and instead expect the plugin to return a user_id as a string" | 14:24 |
| mordred | markmc: is there a way to use filter-branch to graft the history of a file into oslo-incubator? | 14:24 |
| mordred | markmc: I know how to use it to split a repo | 14:24 |
| *** woodspa has joined #openstack-dev | 14:25 | |
| ayoung | how would you expect this to work? It looks like the plugins need to make additional context avaialble. | 14:25 |
| *** mohits1 is now known as mohits | 14:25 | |
| *** mohits has joined #openstack-dev | 14:25 | |
| ayoung | but it cannot be definitive | 14:25 |
| ayoung | dolphm, so I think it has to be conditional. What would you prefer | 14:26 |
| dolphm | ayoung: all an authentication plugin needs to do is identify the user? i don't understand the condition at all -- either the plugin identifies the user, or it fails for some reason, and raises an exception explaining why | 14:26 |
| *** kashyap has joined #openstack-dev | 14:27 | |
| ayoung | dolphm, maybe. I'm not sure about the exception part. I see it as a chain-of-responsibility pattern: | 14:28 |
| ayoung | implementation | 14:28 |
| ayoung | so each plugin gets a swipe, and either says "yes" or "punt" | 14:28 |
| ayoung | but what does it mean to say "yes"? | 14:28 |
| dolphm | ayoung: well, either identify the user or not -- i prefer raising exceptions because it provides better feedback to the user | 14:28 |
| *** surya has joined #openstack-dev | 14:29 | |
| *** adjohn has joined #openstack-dev | 14:29 | |
| kashyap | ayoung, continuing the conversation: changing the port to 5000 doesn't bring me any new info: | 14:29 |
| ayoung | dolphm, so, think of it like an old SCSI cable. You need a terminator cap. IN this case, it would be aplugin that says "nothing found, exception" | 14:29 |
| *** surya is now known as Guest56835 | 14:29 | |
| ayoung | kashyap, does keystone_admin have access to that tenent? | 14:29 |
| kashyap | ayoung, I still get the same info, when I run keystone tenant-list | 14:30 |
| kashyap | ayoung, how do I figure that ? | 14:30 |
| ayoung | kashyap, run with --debug to make sure you are going to 5000 | 14:30 |
| dolphm | ayoung: there's not a "yes" so much as a "the user in the request is X" | 14:30 |
| ayoung | dolphm, right. By"yes" I meant that the plugin found the user and provides an authoritative answer | 14:31 |
| iccha | eglynn_: https://review.openstack.org/#/c/21606/ can you take quick look at this if you have got time, thanks | 14:31 |
| ayoung | dolphm, lets say there are two plugins, and ldap one and a database one, in that order. | 14:31 |
| *** dhellmann is now known as dhellmann-afk | 14:31 | |
| ayoung | So a request comes in, and the LDAP one looks for the user, but doesn't find it | 14:31 |
| ayoung | so it passes the request on to the database one, | 14:32 |
| ayoung | say, for a service user | 14:32 |
| dolphm | ayoung: and that answer should simply be the identity of the user? i don't understand what you're advocating | 14:32 |
| kashyap | ayoung, there we go: the request/response with --debug : http://www.fpaste.org/OLej/ | 14:32 |
| dolphm | ayoung: sure, i'd love to support this example so far | 14:32 |
| *** yidclare has joined #openstack-dev | 14:32 | |
| ayoung | dolphm, well, we need to determine if it is just user, or user and roles, but lets say just user for now | 14:32 |
| dolphm | ayoung: it's not an authentication plugin's responsibility to determine authorization | 14:33 |
| ayoung | dolphm, so, the question is whether the password plugin as written should look to see if the ID is in the context already. I suspect the answer is no | 14:33 |
| *** adjohn has quit IRC | 14:34 | |
| ayoung | dolphm, understood. Just a question of efficienty, making one remote request instead of two, to get the subjects along with the principal | 14:34 |
| ayoung | but it probably needs to be two requests anyway, so the question is moot | 14:34 |
| ayoung | so I would argue that the plugin should lookup the user and return it or return None. THen we iterate through the plugins to find one that doesn't return None. If we come to the end of the list, Unauthorized. | 14:36 |
| *** giulivo has joined #openstack-dev | 14:36 | |
| *** Guest56835 has quit IRC | 14:37 | |
| *** arbrandes has quit IRC | 14:37 | |
| *** Thor^^ has joined #openstack-dev | 14:37 | |
| *** aabes has joined #openstack-dev | 14:38 | |
| danpb | ttx: any idea who is in charge of Swift Team blog postings ? | 14:38 |
| danpb | someone published a posting dated December 2013 | 14:38 |
| danpb | which is going to get stuck on top of planet.openstack.org for a whole year unless someone fixes the date | 14:39 |
| *** maoy has joined #openstack-dev | 14:39 | |
| danpb | http://planet.openstack.org/ | 14:39 |
| *** tommy_SSU has joined #openstack-dev | 14:39 | |
| dolphm | ayoung: "should lookup the user and return it" the user will *always* have to be looked up, so i'd rather not put that burden on the driver (remember, we have to filter the user ref and all that)... yes, it's easy when the auth driver is already talking to SQL, but if the auth driver wants to talk to a completely different system, it shouldn't *also* have to go look up a user ref in SQL if it doesn't need to | 14:39 |
| * ttx looks | 14:39 | |
| *** Thor^^ is now known as Thor | 14:39 | |
| ttx | danpb: "SwiftStack Team". That would be notmyname | 14:39 |
| ttx | danjared: He always thinks forward. | 14:39 |
| danpb | notmyname: ping ^^ | 14:39 |
| dolphm | ayoung: totally agree with the rest, and i was toying with implementing that last night before feature freeze -- i'd like to see multiple auth drivers providing a single authentication method just like you described | 14:40 |
| dolphm | ayoung: and that's how i ran into all these issues with the yesterday's design | 14:40 |
| joearnold | danpb: hey, sorry about that. | 14:40 |
| joearnold | danpb: we use octopress, so it's easy to mess up. fixing. | 14:40 |
| eglynn_ | iccha: looking ... | 14:41 |
| dolphm | ayoung: it was really difficult to write a trivial auth plugin that just said "yes, here's the user" no matter what the request was. that sucks. | 14:41 |
| eglynn_ | iccha: looking ... | 14:41 |
| danpb | joearnold: no problem - someone pointed me at it and asked if i could tell the right people | 14:41 |
| *** zeriouz has joined #openstack-dev | 14:42 | |
| dolphm | ayoung: all i wanted to do was check for a specific hardcoded password and return whatever user ID was in the request... i expected that to be like 2 lines... if req['user']['password'] = 'secret': return req['user']['id'] | 14:43 |
| *** dims has quit IRC | 14:44 | |
| *** rohitk has quit IRC | 14:45 | |
| *** eglynn__ has joined #openstack-dev | 14:46 | |
| *** markmcclain has joined #openstack-dev | 14:46 | |
| *** eglynn_ has quit IRC | 14:47 | |
| joearnold | danpb: oh right, he mentioned this to me.... He thought he fixed it with an alias as his initial post had the wrong date. Removing. Apologies. | 14:47 |
| *** dims has joined #openstack-dev | 14:47 | |
| kashyap | ayoung, this listed it: nova list --all-tenants | 14:48 |
| *** esp1 has joined #openstack-dev | 14:49 | |
| kashyap | ayoung, so, it looks like: as tuser1 & admin are on different tenants. I must use --all-tenants to list images from both the tenants | 14:49 |
| iccha | eglynn__: thanks | 14:49 |
| ayoung | kashyap, sounds right. | 14:49 |
| *** dontalton has joined #openstack-dev | 14:49 | |
| kashyap | ayoung, thanks for the info | 14:50 |
| *** tgall has quit IRC | 14:50 | |
| ayoung | kashyap, now pass it on | 14:50 |
| *** ndipanov has quit IRC | 14:51 | |
| kashyap | yep | 14:51 |
| *** zeriouz has quit IRC | 14:52 | |
| *** zeriouz has joined #openstack-dev | 14:52 | |
| *** tommy_SSU has quit IRC | 14:53 | |
| *** ndipanov has joined #openstack-dev | 14:53 | |
| *** zaneb has joined #openstack-dev | 14:53 | |
| *** arbrandes has joined #openstack-dev | 14:54 | |
| *** dt has joined #openstack-dev | 14:54 | |
| *** dontalton has quit IRC | 14:54 | |
| *** dt is now known as dwt | 14:54 | |
| *** dwt is now known as dont | 14:54 | |
| *** dont is now known as dontalton | 14:55 | |
| *** sacharya has joined #openstack-dev | 14:56 | |
| *** sacharya1 has quit IRC | 14:57 | |
| *** adjohn has joined #openstack-dev | 15:00 | |
| *** esp1 has quit IRC | 15:00 | |
| *** zul has quit IRC | 15:00 | |
| *** jimfehlig has joined #openstack-dev | 15:01 | |
| *** zeriouz has quit IRC | 15:01 | |
| *** zul has joined #openstack-dev | 15:02 | |
| *** zeriouz has joined #openstack-dev | 15:02 | |
| *** xgauvrit has quit IRC | 15:02 | |
| *** adjohn has quit IRC | 15:04 | |
| *** xga_ has quit IRC | 15:04 | |
| *** navid_ has quit IRC | 15:04 | |
| *** mmagr has quit IRC | 15:06 | |
| *** ondergetekende has quit IRC | 15:07 | |
| *** gongysh has quit IRC | 15:08 | |
| *** darjeeling has joined #openstack-dev | 15:08 | |
| *** cloudchimp has joined #openstack-dev | 15:08 | |
| openstackgerrit | A change was merged to openstack/nova: Enhance IPAdresses migration tests https://review.openstack.org/21300 | 15:09 |
| *** aeperezt has joined #openstack-dev | 15:09 | |
| openstackgerrit | A change was merged to openstack/nova: Log lifecycle events to log INFO (not ERROR) https://review.openstack.org/22429 | 15:10 |
| *** tommy_SSU has joined #openstack-dev | 15:10 | |
| *** zeriouz has quit IRC | 15:11 | |
| *** renner has quit IRC | 15:12 | |
| *** romcheg1 has left #openstack-dev | 15:12 | |
| *** renner has joined #openstack-dev | 15:12 | |
| *** fc__ has quit IRC | 15:13 | |
| *** ondergetekende has joined #openstack-dev | 15:15 | |
| openstackgerrit | A change was merged to openstack/nova: Fix broken logging imports. https://review.openstack.org/22386 | 15:15 |
| garyk | arosen: ping | 15:15 |
| *** fc__ has joined #openstack-dev | 15:16 | |
| *** boris-42 has quit IRC | 15:17 | |
| *** danwent has joined #openstack-dev | 15:18 | |
| *** romcheg has joined #openstack-dev | 15:21 | |
| openstackgerrit | A change was merged to openstack/nova: Sync latest install_venv_common.py https://review.openstack.org/22422 | 15:22 |
| *** al-maisan is now known as almaisan-away | 15:22 | |
| *** TerryH has joined #openstack-dev | 15:22 | |
| *** TerryH has quit IRC | 15:23 | |
| *** terryh has joined #openstack-dev | 15:23 | |
| *** rnirmal has joined #openstack-dev | 15:24 | |
| *** annegentle has joined #openstack-dev | 15:25 | |
| *** surya_ has joined #openstack-dev | 15:25 | |
| *** nir has joined #openstack-dev | 15:25 | |
| ayoung | henrynash, topol, can you please take a swipe at the trust patches: | 15:26 |
| ayoung | https://review.openstack.org/#/c/22063/ | 15:26 |
| *** Dr_Who has joined #openstack-dev | 15:26 | |
| henrynash | ayoung: yep | 15:26 |
| ayoung | and | 15:26 |
| ayoung | https://review.openstack.org/#/c/20289/ | 15:26 |
| dolphm | topol: henrynash: ayoung: if you happen to see gyee get on, have him ping me | 15:27 |
| *** sandywalsh has quit IRC | 15:27 | |
| *** esp1 has joined #openstack-dev | 15:27 | |
| *** nir has left #openstack-dev | 15:27 | |
| ayoung | dolphm, he was active yesterday, but sayed of IRC. I'll see if I can find him some oither way | 15:27 |
| dolphm | ayoung: no worries, i'll just email him then | 15:28 |
| dolphm | ayoung: thanks for the heads up | 15:28 |
| openstackgerrit | A change was merged to openstack/python-novaclient: Add support for os-attach-interfaces https://review.openstack.org/22225 | 15:28 |
| *** surya_ has quit IRC | 15:28 | |
| ayoung | dolphm, on Trusts, I can rebase it off of the current HEAD on master and resubmit. I assumed that V3 would be going in first, but there is no reason for that. | 15:29 |
| *** dontalton has quit IRC | 15:29 | |
| dolphm | ayoung: don't you need v3 auth to implement trusts? | 15:30 |
| ayoung | dolphm, I realize you've been battling the auth API, and so I assume you havn't had time to look at the Actual trust patch | 15:30 |
| ayoung | dolphm, no | 15:30 |
| *** AlanClark__ has quit IRC | 15:30 | |
| ayoung | dolphm, trusts is doing v2 tokens | 15:30 |
| ayoung | I'll do v3 tokens and trusts afterwards | 15:30 |
| *** AlanClark__ has joined #openstack-dev | 15:30 | |
| ayoung | I didn't have enough to work with before | 15:30 |
| *** adjohn has joined #openstack-dev | 15:30 | |
| dolphm | ayoung: so, your working on a deprecated API? | 15:30 |
| ayoung | I'm OK with a partial implementation | 15:30 |
| ayoung | dolphm, only for authenticate. | 15:31 |
| ayoung | dolphm, I wrote it in December. | 15:31 |
| *** Dr_Who has quit IRC | 15:31 | |
| ayoung | dolphm, but the services are not going to be ready to consumer V3 tokens until we update the client code anyway\ | 15:31 |
| dolphm | ayoung: and i assume you haven't documented your api changes there either? | 15:31 |
| ayoung | consume | 15:31 |
| dolphm | ayoung: v3 client code is up as WIP | 15:32 |
| ayoung | dolphm, the documentation currently only lives in V3, that is correct, but it is the same in V2 | 15:32 |
| *** annegentle has quit IRC | 15:32 | |
| ayoung | namely, the location of the trustId in the request, and the location of the trust data in the token | 15:32 |
| *** sacharya has quit IRC | 15:32 | |
| dolphm | ayoung: v2 is a different API, it's not "the same" at all | 15:33 |
| dolphm | ayoung: it's currently documented with openstack/identity-api right next to v3 | 15:33 |
| ayoung | dolphm, creating and managing the trusts is a V3 api. authenticate in v2 and v3 differ in the format of the token and the name of the url | 15:33 |
| *** gargya has quit IRC | 15:33 | |
| dolphm | ayoung: yes, you're impacting the v2 public and admin API's in a significant way that must be documented | 15:34 |
| *** adjohn has quit IRC | 15:35 | |
| ayoung | dolphm, that is fine. Take a look at the patch regardless | 15:36 |
| dolphm | ayoung: i'd suggest going v3 only, personally as i don't see it being worth the effort | 15:36 |
| ayoung | dolphm, no, the need is for V2 | 15:36 |
| ayoung | dolphm, until we get v3 support across the board, people will be consuming v2 | 15:37 |
| ayoung | dolphm, you cna change a service to know about trusts and create tokens based on them, and then all of the things that consume v2 tokens work as previously documented. That was the plan from the get-go | 15:38 |
| *** Tross has quit IRC | 15:38 | |
| *** martine_ has quit IRC | 15:39 | |
| dolphm | ayoung: yes, you're impacting the v2 public and admin API's in a significant way that must be documented | 15:39 |
| *** esp1 has quit IRC | 15:39 | |
| ayoung | dolphm, well, I did write the spec back in October, according to what was the work flow at the time. | 15:40 |
| zykes- | how goes v3 stuffs dolphm ? | 15:40 |
| ayoung | so, yes, it is not in the repo, but it has been on the wiki for months | 15:40 |
| dolphm | ayoung: really? because i've never seen it up for review | 15:40 |
| *** sandywalsh has joined #openstack-dev | 15:40 | |
| ayoung | dolphm, been on the blueprint | 15:40 |
| ayoung | https://blueprints.launchpad.net/keystone/+spec/trusts | 15:40 |
| dolphm | ayoung: great you should put it up for review on the actual documentation | 15:41 |
| *** sulrich has joined #openstack-dev | 15:41 | |
| ayoung | dolphm, and I will, but it is code freeze yesterday/today, not doc freeze. Please look at the patch. | 15:41 |
| *** aabes has left #openstack-dev | 15:41 | |
| dolphm | ayoung: no, i REALLY doubt you ever will -- i asked you do document your api changes 6 months ago related to PKI and just found out yesterday you never did that either | 15:42 |
| *** devoid has joined #openstack-dev | 15:43 | |
| *** gary_th has joined #openstack-dev | 15:43 | |
| *** hemna_ has quit IRC | 15:43 | |
| ayoung | the token revocation list? Yeah, it has been on my todo list prior to Grizzly going out the door, just hadn't made it top priority | 15:44 |
| ayoung | I really, really was hoping to get rid of it with trusts and short term tokens, but that is a diffferent story | 15:44 |
| dolphm | ayoung: token revocation list, 'expired_at', who knows what else | 15:44 |
| ayoung | expired_at? | 15:44 |
| dolphm | ayoung: you added an undocumented field to the token | 15:45 |
| *** alexxu has quit IRC | 15:45 | |
| ayoung | ah, you mean the issued_at? | 15:45 |
| dolphm | ayoung: yes | 15:45 |
| *** edmund has joined #openstack-dev | 15:45 | |
| *** ondergetekende has quit IRC | 15:46 | |
| ayoung | dolphm, It was my understanding on that one that we didn;t want people counting on it, as it was bascially a technical tool to make sure that each token was unique. | 15:46 |
| *** markwash has quit IRC | 15:46 | |
| ayoung | So, unless the docs said "don't count on this being there" ...but point taken | 15:47 |
| dolphm | ayoung: you changed the api, i asked you to document it under exactly these conditions, and trusted you to do so, and you didn't | 15:47 |
| *** davidha has joined #openstack-dev | 15:47 | |
| ayoung | dolphm, OK, I'm willing to eat crow on that. | 15:48 |
| ayoung | I'll go and resubmit the trust API with the changes to the V3 tokens in it, and I'll post a WIP for the other API changes today | 15:48 |
| *** rnirmal has quit IRC | 15:48 | |
| *** rnirmal has joined #openstack-dev | 15:49 | |
| ayoung | but...I'm more concerned with what you will find on the trust review, and so far it hasn;t had any in depth review. | 15:50 |
| *** davidh_ has quit IRC | 15:50 | |
| *** ctracey has quit IRC | 15:51 | |
| *** gray-- has quit IRC | 15:52 | |
| *** ctracey has joined #openstack-dev | 15:53 | |
| *** gyee has joined #openstack-dev | 15:53 | |
| garyk | salv-orlando: ping | 15:53 |
| *** boden has joined #openstack-dev | 15:53 | |
| *** arbrandes has quit IRC | 15:54 | |
| *** nati_ueno has joined #openstack-dev | 15:54 | |
| *** arbrandes has joined #openstack-dev | 15:54 | |
| *** martine_ has joined #openstack-dev | 15:54 | |
| *** nunosantos has joined #openstack-dev | 15:55 | |
| dolphm | ayoung: how close is the implementation to the current identity-api review for trusts? | 15:55 |
| *** nati_ueno_2 has joined #openstack-dev | 15:55 | |
| dolphm | ayoung: it's generally difficult to review an api implementation without first reviewing and understanding the api | 15:56 |
| ayoung | dolphm, if there are deviations it is unintentional. | 15:56 |
| *** ondergetekende has joined #openstack-dev | 15:56 | |
| *** ondergetekende has quit IRC | 15:57 | |
| ayoung | dolphm, the one detail that someone pointed out to me out of band and that I included on the last review (and I will update on the API review now) is that the expiry fo the token should not be longer than the expiry on the trust. | 15:57 |
| *** aswadrangnekar has quit IRC | 15:57 | |
| dolphm | ayoung: cool | 15:58 |
| *** anniec has quit IRC | 15:58 | |
| *** winston-d_ has joined #openstack-dev | 15:58 | |
| *** datsun180b has joined #openstack-dev | 15:58 | |
| *** annegentle has joined #openstack-dev | 15:59 | |
| gyee | dolphm, ayoung, are you guys working on the token APIs patch? | 15:59 |
| gyee | do I need to wait on anything? | 15:59 |
| jgriffith | markmc: ping | 15:59 |
| *** rnirmal has quit IRC | 15:59 | |
| *** cmagina has quit IRC | 16:00 | |
| *** rnirmal has joined #openstack-dev | 16:00 | |
| ayoung | gyee, V3 auth has been reviewed | 16:00 |
| *** thingee_zzz is now known as thingee | 16:00 | |
| *** cmagina has joined #openstack-dev | 16:00 | |
| ayoung | gyee, question for yo | 16:00 |
| ayoung | u | 16:00 |
| ayoung | why were you checking if the userId was already in the context? | 16:01 |
| ayoung | shouldn't the password plugin be authoritative on putting it in there? | 16:01 |
| *** Tross has joined #openstack-dev | 16:01 | |
| *** adjohn has joined #openstack-dev | 16:01 | |
| gyee | ayoung, because user_id has to come from the plugins | 16:01 |
| gyee | I need to check if other plugin has already set it | 16:01 |
| ayoung | gyee, yeah, but if it did, why would you ever call the password plugin in then? | 16:02 |
| ayoung | gyee, for example, if REMOTE_USER set it, wouldn't that be enough? | 16:02 |
| gyee | in case there's a chain of plugins specify in the methods | 16:02 |
| gyee | REMOTE_USER doesn't involve plugins | 16:02 |
| ayoung | gyee, so you always execute all plugins in the chain? | 16:02 |
| gyee | if REMOTE_USER is set, no plugin will be involed | 16:03 |
| gyee | invoked | 16:03 |
| *** kmartin_zz is now known as kmartin | 16:03 | |
| ayoung | gyee, I would think we would want a REMOTE_USER plugin | 16:03 |
| gyee | ayoung, yes, all plugins are invoked in the order specified in methods | 16:03 |
| dolphm | gyee: why not be done with a plugin identifies the user?? | 16:03 |
| dolphm | s/with/when/ | 16:03 |
| ayoung | gyee, OK, so I agree with dolph on this | 16:04 |
| *** pabelanger has joined #openstack-dev | 16:04 | |
| ayoung | it is chain of responsibility design pattern | 16:04 |
| gyee | dolphm, uh multi-factor? | 16:04 |
| ayoung | gyee, multi facter won't say "yes" | 16:04 |
| roz | I am writing missed XML samples for documenting an existing API extensions. It's not clear to me if in the template for the requests I have to use attributes or elements? is there a way to understand which one is correct looking at the code? | 16:04 |
| gyee | but it should also check to make sure the user_id is the same as everyone's had authenticated | 16:05 |
| ayoung | gyee, I see your point, but MF should say "I've taken my swipe, but I can't say yes, pass it on" | 16:05 |
| ayoung | gyee, that is a different rule | 16:05 |
| dolphm | gyee: oh, adam and i have been talking about mutliple plugins supporting the same method (say, 2 password plugins) -- i was thinking about that scenario (you wouldn't ask the second plugin to auth if the first one already did) | 16:05 |
| gyee | ayoung, correct, but if the user_id is different then the one you are expecting, you should error out | 16:05 |
| *** esp1 has joined #openstack-dev | 16:06 | |
| *** adjohn has quit IRC | 16:06 | |
| gyee | dolphm, for MFA, all the plugins at to arrive at the same conclusion | 16:06 |
| gyee | s/at/had/ | 16:06 |
| *** sacharya has joined #openstack-dev | 16:07 | |
| gyee | otherwise, there's no point of allowing more than one method at a time | 16:07 |
| ayoung | gyee, ok, I think MFA should be possible, but that logic should be encapsulated in the MFA plugins themselves. | 16:07 |
| ayoung | Lets do it straight CofR | 16:07 |
| gyee | I think the current design is adequate | 16:07 |
| ayoung | each plugin can either end the chain successfully (yes, ID is set) or pass it on to the next level of the chain, or end the chain (definitely no) | 16:08 |
| *** trapni has joined #openstack-dev | 16:08 | |
| *** trapni has joined #openstack-dev | 16:08 | |
| gyee | ayoung, plugin should not end an authentication chain | 16:08 |
| gyee | for Havanah, we can enhanced to allow user to configure the plugin as either "required" or "sufficient", just like PAM | 16:09 |
| *** reidrac has quit IRC | 16:09 | |
| gyee | but we have to start somewhere :) | 16:09 |
| *** alunduil has joined #openstack-dev | 16:10 | |
| alaski | roz: I've typically seen attributes over elements except when it requires it. If the json has a dict that would translate to an element, otherwise key:value pairs are typically attributes. | 16:10 |
| *** koolhead17 has joined #openstack-dev | 16:11 | |
| ayoung | gyee, ok I see where you are going. | 16:12 |
| alaski | roz: /win 17 | 16:12 |
| alaski | woops | 16:12 |
| roz | alaski: thanks for your response, I am working on the change you reviewed. it's not clear to me if both versions work or if depends on how the API has been designed | 16:13 |
| alaski | roz: that's a good question, and I've never tried two different ways. I always go for attributes first, and from what I've seen that's how a lot of other samples do it. | 16:14 |
| *** mkollaro has quit IRC | 16:15 | |
| *** mkollaro has joined #openstack-dev | 16:15 | |
| *** gargya has joined #openstack-dev | 16:15 | |
| ttx | ayoung/gyee/dolphm: would be great to nail https://review.openstack.org/21487 over the next couple of hours. This was supposed to go in yesterday :) | 16:16 |
| roz | alaski: ok I'll do the same and maybe I'll try to do some additional tests | 16:16 |
| *** bdpayne has joined #openstack-dev | 16:16 | |
| ttx | ayoung/gyee/dolphm: any blocker ? | 16:16 |
| gyee | ttx, no blocker, just nitpickings | 16:16 |
| ayoung | ttx, read up | 16:16 |
| gyee | :) | 16:16 |
| ayoung | we were just discussing, trying to get it clear | 16:16 |
| ayoung | ttx, and even dolphm needs to sleep at least 45 minutes a night | 16:17 |
| *** esp1 has quit IRC | 16:17 | |
| *** burris has joined #openstack-dev | 16:17 | |
| ttx | nah. That's a bad habit | 16:17 |
| *** john5223 has joined #openstack-dev | 16:18 | |
| *** lglenden has joined #openstack-dev | 16:18 | |
| *** yamahata has quit IRC | 16:19 | |
| *** sacharya has quit IRC | 16:19 | |
| gyee | ayoung, pop a few cans of those red cows and we only need 45 mins of sleep :) | 16:19 |
| dolphm | gyee: i swear there's something wrong with the password plugin's password checking :( | 16:19 |
| *** adjohn has joined #openstack-dev | 16:20 | |
| gyee | dolphm, what are you finding this time? | 16:20 |
| *** alunduil has quit IRC | 16:20 | |
| *** rpedde_away is now known as rpedde | 16:20 | |
| *** alunduil has joined #openstack-dev | 16:21 | |
| dolphm | gyee: i'm trying to drop default_fixtures from the v3 tests, which means creating an admin user to use for the test | 16:21 |
| dolphm | gyee: essentially just changing the role that's created to be called 'admin' | 16:22 |
| gyee | k | 16:22 |
| dolphm | gyee: anyway, sql.authenticate fails when called by the password plugin | 16:22 |
| gyee | dolphm, did you clear the plugins in your tearDown? | 16:23 |
| dolphm | gyee: http://paste.openstack.org/raw/32086/ | 16:23 |
| dolphm | gyee: i didn't change any tear downs, but the comment also doesn't explain why they need to be discarded? | 16:24 |
| gyee | dolphm, see the tearDown from test_v3_auth | 16:24 |
| ayoung | dolphm, agreed on the fixture cleanup. I think we should do that across the board, V2 as well as V3 tests. | 16:24 |
| *** BLZbubba has joined #openstack-dev | 16:24 | |
| *** david-lyle has joined #openstack-dev | 16:24 | |
| *** adjohn_ has joined #openstack-dev | 16:24 | |
| *** adjohn has quit IRC | 16:24 | |
| *** sacharya has joined #openstack-dev | 16:25 | |
| openstackgerrit | A change was merged to openstack/nova: Allow exit code 21 for 'iscsiadm -m session'. https://review.openstack.org/22431 | 16:26 |
| *** mlavalle has joined #openstack-dev | 16:27 | |
| *** romcheg has quit IRC | 16:28 | |
| *** danwent has joined #openstack-dev | 16:28 | |
| dolphm | gyee: why are auth plugins reset? | 16:33 |
| gyee | dolphm, python __import__ black magic I guess | 16:33 |
| gyee | tests are run in a single process | 16:33 |
| davidkranz | dolphm: Is v3 fully enabled in the current devstack gate configuration? | 16:33 |
| gyee | when we clear the db, the __import_ modules ended up with an identity_reference which has no data | 16:34 |
| gyee | identity_api reference | 16:34 |
| davidkranz | dolphm: We want to get some new v3 tests in Tempest online. | 16:34 |
| dolphm | davidkranz: the api is available, but not utilized at all | 16:34 |
| dolphm | davidkranz: except for v3 auth, which we're trying to merge right now | 16:34 |
| dolphm | davidkranz: which is obviously important | 16:34 |
| davidkranz | dolphm: Well, some tempest tests want to utilize it :) | 16:35 |
| *** colinmcnamara has joined #openstack-dev | 16:35 | |
| dolphm | davidkranz: i'm looking forward to that :) | 16:35 |
| davidkranz | dolphm: Can you ping me when auth is merged? I think that is part of our problem. | 16:35 |
| dolphm | gyee: the roles attribute in the auth response doesn't match spec | 16:35 |
| dolphm | davidkranz: sure | 16:36 |
| openstackgerrit | A change was merged to openstack/oslo-incubator: readd update.sh to address bootstrapping issue https://review.openstack.org/22423 | 16:36 |
| gyee | dolphm, what's missing? | 16:36 |
| *** olaph has quit IRC | 16:37 | |
| dolphm | gyee: it's not what's missing, its that there's too many attributes | 16:37 |
| dolphm | gyee: actually links are missing, but that can be a bug | 16:37 |
| dolphm | gyee: http://paste.openstack.org/raw/32089/ | 16:37 |
| *** trapni has quit IRC | 16:37 | |
| *** AlanClark__ has quit IRC | 16:38 | |
| dolphm | gyee: i would manually build the list of roles and only include the id and name attribute [{'id': r['id'], 'name': r['name']} for r in role_refs] | 16:38 |
| *** AlanClark__ has joined #openstack-dev | 16:38 | |
| *** olaph has joined #openstack-dev | 16:38 | |
| gyee | dolphm, ok | 16:38 |
| *** maoy_ has joined #openstack-dev | 16:39 | |
| gyee | dolphm, for the roles, I just grep the list from identity_api | 16:39 |
| dolphm | gyee: same goes for some other elements -- you don't need to provide enabled=true for anything, because it would have raised 401 if disabled | 16:39 |
| gyee | I just get them straight out of identity_api | 16:40 |
| gyee | maybe we need to add a filter? | 16:40 |
| dolphm | gyee: there's also an "extra": {} that's slipping into the response somehow | 16:40 |
| *** markvoelker1 has joined #openstack-dev | 16:40 | |
| gyee | extra is there in the spec | 16:40 |
| gyee | did you remove it? | 16:40 |
| dolphm | gyee: well, the filters blacklist certain attributes -- i'd prefer whitelisting ones | 16:40 |
| *** lglenden has left #openstack-dev | 16:41 | |
| dolphm | gyee: uhh, if i saw an "extra" i definitely assumed it was an accident | 16:41 |
| *** markvoelker2 has joined #openstack-dev | 16:41 | |
| dolphm | gyee: also "services" should be "catalog" | 16:41 |
| *** markvoelker has quit IRC | 16:41 | |
| *** dhellmann-afk is now known as dhellmann | 16:41 | |
| dolphm | gyee: "issued_at" doesn't match "expires", and including "issued_at" was downvoted by heckj in the follow up review | 16:42 |
| *** lglenden has joined #openstack-dev | 16:42 | |
| dolphm | gyee: all these random attributes will just cause additional bloat for pki tokens | 16:42 |
| gyee | issued_at are not supposed to match expires | 16:43 |
| *** cp16net is now known as cp16net|away | 16:43 | |
| *** cp16net|away is now known as cp16net | 16:43 | |
| *** Nachi has joined #openstack-dev | 16:43 | |
| gyee | I took the same code from tokens | 16:43 |
| dolphm | gyee: "issued_at" should either be renamed to "issued" or "expires" should be renamed to "expires_at" | 16:43 |
| *** maoy has quit IRC | 16:43 | |
| gyee | dolphm, did you change the spec? | 16:44 |
| *** maoy has joined #openstack-dev | 16:44 | |
| *** nati_ueno has quit IRC | 16:44 | |
| dolphm | gyee: "issued_at" is not in the spec | 16:44 |
| dolphm | gyee: and i did not change "expires" | 16:44 |
| *** markvoelker1 has quit IRC | 16:44 | |
| *** esp1 has joined #openstack-dev | 16:45 | |
| *** davidha has quit IRC | 16:45 | |
| *** superman has joined #openstack-dev | 16:45 | |
| *** superman has quit IRC | 16:46 | |
| *** tommy_SSU has quit IRC | 16:46 | |
| *** maoy_ has quit IRC | 16:47 | |
| gyee | dolphm, so what should I do, change issued_at to issue? | 16:47 |
| *** tomoe_ has quit IRC | 16:48 | |
| *** dosaboy has quit IRC | 16:48 | |
| *** dosaboy has joined #openstack-dev | 16:48 | |
| dolphm | gyee: that's a minor issue compared to the massive discrepancies between what you're returning and what the spec illustrates | 16:48 |
| *** tomoe_ has joined #openstack-dev | 16:48 | |
| dolphm | gyee: you're returning this: http://paste.openstack.org/raw/32092/ | 16:50 |
| dolphm | gyee: the spec illustrates this: http://paste.openstack.org/raw/32093/ | 16:50 |
| *** avishay has joined #openstack-dev | 16:50 | |
| dolphm | gyee: i used null where the attribute totally isn't included in the current response | 16:50 |
| *** vipul|away is now known as vipul | 16:51 | |
| ayoung | davidkranz, as far as examples of how to consume the v3-auth API, see this review https://review.openstack.org/#/c/21487/17/tests/test_v3_auth.py | 16:52 |
| arosen | hi garyk pong | 16:52 |
| *** vipul is now known as vipul|away | 16:52 | |
| *** jrodom has joined #openstack-dev | 16:52 | |
| ayoung | for identity and the otherssee the corresponding files in github.... | 16:52 |
| ayoung | https://github.com/openstack/keystone/blob/master/tests/test_v3_catalog.py | 16:52 |
| ayoung | https://github.com/openstack/keystone/blob/master/tests/test_v3_identity.py | 16:53 |
| ayoung | davidkranz, those are really getting onto the line between Keystone and Tempest responsibility. | 16:53 |
| ayoung | the basic set up for the tests is in tests/text_v3.py | 16:53 |
| *** voliveirajr has joined #openstack-dev | 16:54 | |
| davidkranz | ayoung: Yes, it is getting to be an issue as Tempest wants to be an acceptance test and projects have functional testing as part of their unit tests. | 16:54 |
| davidkranz | ayoung: We don't want duplication of effort. | 16:54 |
| ayoung | dolphm, I went the path of only inlcuding role names. I was worried that the role IDs and role assignment IDs might get confused | 16:54 |
| davidkranz | ayoung: The issue at the moment though is that Tempest is not yet set up to test v2 and v3 in the same run, partly due to v3 auth not yet being available. | 16:55 |
| *** Nachi has quit IRC | 16:56 | |
| ayoung | davidkranz, understood. What I think we need as Keystone devs is a clearer path to run the tempest test specific to Keystone as part of ongoing development. We can probably migrate the tests I listed above over to tempest once we get v3 auth merged, but we'll need to have a pow-wow about how Keystone devs and tempest devs split htings up. | 16:56 |
| dolphm | davidkranz: you can authenticate against v2 and use that token to work with v3 | 16:56 |
| *** dprince has quit IRC | 16:56 | |
| openstackgerrit | A change was merged to openstack/nova: Sync rpc from oslo-incubator. https://review.openstack.org/22308 | 16:57 |
| *** nati_ueno has joined #openstack-dev | 16:57 | |
| ayoung | davidkranz, for example, what would be fantastic is if, pon a bug report, someone had to submit a failing test to tempest | 16:57 |
| openstackgerrit | A change was merged to openstack/cinder: Ensure volume exists before deleting. https://review.openstack.org/22443 | 16:57 |
| ayoung | it should not gate block keystone commits | 16:57 |
| *** esp1 has quit IRC | 16:57 | |
| ayoung | but the keystone commit should assert : tes_x now passes | 16:57 |
| dolphm | ayoung: tempest shouldn't gate keystone? | 16:57 |
| ayoung | dolphm, of course it should, that isn't what I was saying | 16:57 |
| ayoung | I was saying that tempest should have tests that are known to fail | 16:58 |
| dolphm | ayoung: "it should not gate block keystone commits" it? | 16:58 |
| ayoung | and thosetests shouldn't gate keystone | 16:58 |
| dolphm | ayoung: we do that today with skiptest | 16:58 |
| ayoung | dolphm, sort of | 16:58 |
| dolphm | ayoung: you can write a failing test, file a bug on it, and raise a skiptest citing the bug | 16:58 |
| ayoung | dolphm, so what I was saying is that we state "fixes Bug X" in the commite message | 16:59 |
| ayoung | if there is a test for Bug X in tempest | 16:59 |
| ayoung | it can say "no you didn't test still fails" | 16:59 |
| dolphm | ayoung: going to grab lunch, brb | 16:59 |
| *** dontalton has joined #openstack-dev | 17:01 | |
| *** nati_ueno has quit IRC | 17:01 | |
| ayoung | henrynash, what role would a user have to have in order for RBAC to kick in for trusts? | 17:02 |
| ayoung | henrynash, any user can create a trust | 17:02 |
| henrynash | ayoung: well, RBAC will kick in IF we protect the calls (which I assume we would). Then it is up to the policy file creator | 17:03 |
| *** morganfainberg has joined #openstack-dev | 17:03 | |
| *** rafaduran has left #openstack-dev | 17:03 | |
| ayoung | henrynash, I guess it can't hurt. | 17:03 |
| dolphm | gyee: if it's too difficult to produce the nested objects user -> domain in the token response, i'm open to changing the spec on that, but attributes like enabled and description need to be cut | 17:03 |
| *** maroh has quit IRC | 17:04 | |
| henrynash | ayoung: Like everyone else, default is set to admin, but one might image a liberal policy of allowing the truster to always create trusts (i.e. proected by user_id) ? | 17:04 |
| gyee | dolphm, ok, lets have domain_id in the user then | 17:04 |
| gyee | I can filter the enabled attribute | 17:04 |
| dolphm | ayoung: wrap the trust call with @protected and then have an empty rule in policy.json for it | 17:04 |
| winston-d_ | markmc: ping | 17:04 |
| dolphm | gyee: create_token should actually be done the same way ^ in case someone wants to protect it for whatever reason | 17:04 |
| *** romcheg has joined #openstack-dev | 17:04 | |
| ayoung | dolphm, OK, | 17:04 |
| gyee | dolphm, create_token is an internal call | 17:05 |
| winston-d_ | markmc: do you know how to deal with oslo-config issue with cinder unit tests? | 17:05 |
| markmc | winston-d_, what issue? | 17:06 |
| markmc | jgriffith, yep? | 17:06 |
| *** Tross has quit IRC | 17:06 | |
| *** dontalton has quit IRC | 17:07 | |
| winston-d_ | markmc: we are seeing ''ImportError: No module named oslo.config' | 17:07 |
| markmc | winston-d_, is this with a newly installed venv? | 17:08 |
| jgriffith | markmc: can't get unit tests to run with your latest oslo lib change in cinder | 17:08 |
| winston-d_ | markmc: yup | 17:08 |
| markmc | sorry, otp | 17:08 |
| markmc | does 'pip freeze' show it? | 17:08 |
| *** hugokuo has left #openstack-dev | 17:09 | |
| *** amerine has joined #openstack-dev | 17:09 | |
| avishay | markmc: yes it does (oslo-config==2013.1b3) | 17:09 |
| markmc | it should just work | 17:10 |
| tiamar | hi! where in tempest is specified the flavor that is created? | 17:10 |
| markmc | try 'pip install http://tarballs.openstack.org/oslo-config/oslo-config-2013.1b4.tar.gz' | 17:10 |
| markmc | see if b4 is better | 17:10 |
| winston-d_ | markmc: b4 works! | 17:12 |
| *** radez is now known as radez_g0n3 | 17:13 | |
| jgriffith | sweet.. thanks markmc | 17:13 |
| jgriffith | markmc: I'll push an update to pip requires unless that's not "ready" or you have another version you plan to submit? | 17:13 |
| winston-d_ | jgriffith: avishay could you verify b4 on your env as well? it works for me. | 17:14 |
| jgriffith | winston-d_: yeah, that's what I just did... works for me | 17:14 |
| *** zaitcev has joined #openstack-dev | 17:14 | |
| markmc | jgriffith, go ahead with b4 | 17:14 |
| jgriffith | markmc: k.. thanks for the help | 17:14 |
| winston-d_ | markmc: thx! | 17:15 |
| avishay | markmc: thanks | 17:15 |
| markmc | thank jkoelker | 17:15 |
| *** kagan has joined #openstack-dev | 17:15 | |
| ayoung | dolphm, looking at the policy file, I realize each of the rules are like: identity:delete_roles. I assume identity is the service, and is not really meaningful to us, but instead the :delete_roles call is going to match the function name. Does that imply that all of the function names need to be unique within keystoine if they are going to show up in policy? Do I need to convert TrustController.create to TrustController.creat | 17:16 |
| ayoung | e_trust? | 17:16 |
| *** vipul|away is now known as vipul | 17:17 | |
| *** iartarisi has quit IRC | 17:18 | |
| *** koolhead17 has quit IRC | 17:19 | |
| *** dolphm has quit IRC | 17:19 | |
| *** esp1 has joined #openstack-dev | 17:23 | |
| *** yolanda has quit IRC | 17:24 | |
| *** jgallard has quit IRC | 17:25 | |
| *** derekh has quit IRC | 17:26 | |
| vishy | danpb: don't think my last message made it. if you have some time could you take a look at https://review.openstack.org/#/c/21382/ ? | 17:27 |
| henrynash | gyee, dolphm: odd thing happening….I tried to submitted a new patch for my: http://review.openstack.org/#/c/22223/.…and it didn't appear as part of that review…but a trivial rebase appeared on Guang's patch that I am dependant on (i.e. I think, HOPE, that's all that happened) | 17:28 |
| ayoung | henrynash, TypeError: wrapper() takes exactly 2 arguments (3 give | 17:29 |
| henrynash | ayoung: for which? | 17:29 |
| gyee | henrynash, I need to submit another patch | 17:29 |
| gyee | dolphm didn't like the 'enabled' attribute in token data | 17:29 |
| ayoung | henrynash, I added @protected on to create(now create_trust) and delete | 17:29 |
| *** dolphm has joined #openstack-dev | 17:29 | |
| ayoung | def the wrapper | 17:30 |
| dolphm | ayoung: yes, create -> create_trust | 17:30 |
| ayoung | Is it due to the KW args? | 17:30 |
| ayoung | let me see if doing kw fixes it | 17:30 |
| henrynash | gyee: that's fine…..but concerned my patch is somehow not set up right | 17:30 |
| danpb | vishy: yikes, i thought that had merged already | 17:30 |
| danpb | will review it again now | 17:30 |
| ayoung | henrynash, yeah, needs kw args when called. OK | 17:31 |
| vishy | danpb: just discussing it in -nova I don't think we are going to take it for G | 17:31 |
| vishy | danpb: so no rush :) | 17:31 |
| *** markmc has quit IRC | 17:31 | |
| henrynash | ayoung: ok, I can review if you pint me at t | 17:31 |
| henrynash | point me, even | 17:31 |
| *** jruzicka has quit IRC | 17:31 | |
| ayoung | henrynash, still coding | 17:31 |
| ayoung | henrynash, I need to fix the tests now | 17:31 |
| danpb | vishy: oh, what is "-nova" - another mailing list I'm not on :-/ | 17:32 |
| *** corXi has quit IRC | 17:33 | |
| ayoung | dolphm, if not context['is_admin'] is failing on a key error in policy. THis might be the first non-admin api we've wrapped this way. Are you ok with scope creeping this to handle fixing the policy stuff as well? | 17:33 |
| dolphm | ayoung: ah, we haven | 17:34 |
| ayoung | dolphm, it is a minor change, I'll add it in in | 17:34 |
| dolphm | 't exposed v2 *anything* with real policy | 17:34 |
| ayoung | if 'is_admin' in context and not context['is_admin']: | 17:34 |
| dolphm | ayoung: you're in uncharted waters | 17:34 |
| ayoung | dolphm, but I know the name of the wind | 17:34 |
| *** esp1 has quit IRC | 17:34 | |
| * ayoung a little Earthsea alittle Qvothe | 17:35 | |
| *** BobBall is now known as Bobba_away | 17:35 | |
| openstackgerrit | A change was merged to openstack/nova: Add API Sample tests for Hypervisors extension. https://review.openstack.org/22022 | 17:37 |
| *** dachary has quit IRC | 17:37 | |
| *** nati_ueno_2 has quit IRC | 17:37 | |
| *** cp16net is now known as cp16net|away | 17:38 | |
| openstackgerrit | A change was merged to openstack/cinder: Add LIO configuration for iSCSI initiators https://review.openstack.org/21266 | 17:38 |
| openstackgerrit | A change was merged to openstack/python-cinderclient: Fix typo breaking --debug option to cinder client https://review.openstack.org/22434 | 17:38 |
| *** nati_ueno has joined #openstack-dev | 17:38 | |
| *** njoy_ has joined #openstack-dev | 17:38 | |
| henrynash | gyee, dolphm, ayoung: just going to grab a bite to eat then be back on | 17:40 |
| *** davidha has joined #openstack-dev | 17:41 | |
| *** adjohn_ has quit IRC | 17:42 | |
| *** njoy has quit IRC | 17:42 | |
| *** nati_ueno has quit IRC | 17:43 | |
| *** andrewbogott_afk is now known as andrewbogott | 17:43 | |
| ayoung | dolphm, how do I shut up loggers during the unit test run? | 17:45 |
| ayoung | OI'm getting so much debug output I can't see what failed | 17:45 |
| *** romcheg has quit IRC | 17:45 | |
| dolphm | ayoung: turn off debug in test overrides? | 17:46 |
| *** dhellmann is now known as dhellmann-afk | 17:46 | |
| gyee | dolphm, about to push another patch with the stuff filtered | 17:46 |
| openstackgerrit | A change was merged to openstack/cinder: rbd: implement get_volume_stats() https://review.openstack.org/22400 | 17:50 |
| *** Yada has quit IRC | 17:50 | |
| *** Mandell has joined #openstack-dev | 17:50 | |
| *** danpb has quit IRC | 17:53 | |
| gyee | dolphm, ayoung, henrynash, #19 | 17:53 |
| dolphm | gyee: thanks, looking | 17:53 |
| ayoung | gyee, looking | 17:53 |
| *** arbrandes has quit IRC | 17:54 | |
| dolphm | henrynash: the reason you updated gyee's patch is because git-review rebases your branch, including underlying patches | 17:54 |
| *** radez_g0n3 is now known as radez | 17:55 | |
| dolphm | henrynash: so all you did was change the parent patch to something more recent | 17:55 |
| *** jog0 has joined #openstack-dev | 17:55 | |
| *** roampune has joined #openstack-dev | 17:55 | |
| *** morganfainberg has quit IRC | 17:56 | |
| dolphm | henrynash: and incidentally make it so we can compare patchset 19 vs patchset 18 cleanly :) | 17:56 |
| *** susanne-balle has joined #openstack-dev | 17:56 | |
| *** Tross has joined #openstack-dev | 17:56 | |
| *** avishay has quit IRC | 17:57 | |
| gyee | dolphm, #20, sorry I just found a pep8 issue | 17:57 |
| dolphm | gyee: no worries | 17:57 |
| *** adjohn has joined #openstack-dev | 17:57 | |
| dolphm | gyee: so this matches current spec at first glance? i don't need to revise the api? | 17:58 |
| *** dontalton has joined #openstack-dev | 17:58 | |
| gyee | dolphm no need to | 17:58 |
| gyee | I filtered it exactly | 17:58 |
| *** roampune is now known as roampune_ | 17:59 | |
| *** lloydde has joined #openstack-dev | 17:59 | |
| *** aswadrangnekar has joined #openstack-dev | 17:59 | |
| ayoung | gyee, looks pretty good to me at first blush. | 18:00 |
| gyee | ayoung, sounds good | 18:00 |
| *** dprince has joined #openstack-dev | 18:00 | |
| ayoung | the password plugin shows how we need to clean up our logic there, but beyond the scope of this patch, I think | 18:01 |
| dolphm | gyee: oh cool, didn't realize you got the fixtures removed and working | 18:01 |
| dolphm | gyee: i was still poking at that | 18:01 |
| gyee | dolphm, I pretty incorporated everything from the last review | 18:01 |
| gyee | pretty much | 18:01 |
| *** roampune_ has quit IRC | 18:01 | |
| *** gray-- has joined #openstack-dev | 18:02 | |
| dolphm | gyee: awesome | 18:02 |
| *** gray-- has quit IRC | 18:02 | |
| gyee | had to change a couple of tests because they are no longer valid | 18:02 |
| dolphm | gyee: i was doing so as well | 18:02 |
| *** shardy is now known as shardy_afk | 18:02 | |
| *** roampune has joined #openstack-dev | 18:02 | |
| dolphm | gyee: made a comment on #18 that i think needs to be fixed | 18:02 |
| *** darraghb has quit IRC | 18:03 | |
| *** vipul is now known as vipul|away | 18:03 | |
| gyee | dolphm, which comment? | 18:03 |
| gyee | the 'user_id' thing? | 18:03 |
| dolphm | gyee: you're filering roles properly and then discarding the filtered list | 18:03 |
| *** otherwiseguy has quit IRC | 18:03 | |
| *** aswadrangnekar has quit IRC | 18:04 | |
| gyee | dolphm, :) | 18:04 |
| gyee | patch #21 | 18:04 |
| gyee | good catch! | 18:04 |
| *** markwash has joined #openstack-dev | 18:05 | |
| topol | ayoung, dolphm, I am making an executive decision to map domain_id to businessCategory. businessCategory exists in groupOfNames and inetOrgPerson and seems to work | 18:06 |
| dolphm | topol: cool | 18:06 |
| gyee | in LDAP, domain is usually domain controller object | 18:07 |
| gyee | dc | 18:07 |
| ayoung | dolphm, what does an empty policy rule look like? | 18:07 |
| *** vipul|away is now known as vipul | 18:07 | |
| dolphm | [] | 18:08 |
| dolphm | ayoung: or "" in the new policy engine? | 18:08 |
| topol | gyee, I don't see dc in inetOrgPerson or its parents. Let me try and see if it breaks | 18:09 |
| gyee | topol, dc is usually part of the user DN and a higher level container than organization | 18:10 |
| gyee | or organization unit | 18:11 |
| gyee | topol, with the auth plugin, you should be able to translate apache mod_ldap into python :) | 18:12 |
| *** esp1 has joined #openstack-dev | 18:12 | |
| topol | gyee, dc is a no go | 18:12 |
| topol | gyee, let me try ou | 18:13 |
| *** dachary has joined #openstack-dev | 18:13 | |
| gyee | we don't use dc? | 18:13 |
| *** nati_ueno has joined #openstack-dev | 18:13 | |
| *** adjohn has quit IRC | 18:14 | |
| ayoung | dolphm, our policy should be in keysteon/etc/policy.json, and it is using the "new policy engiuner" right? | 18:14 |
| gyee | ayoung, I think henrynash did moved the latest policy engine code to openstack/common | 18:14 |
| dolphm | ayoung: etc/policy.json in the repo, and i think henry updated us to oslo's policy engine impl | 18:15 |
| gyee | ayoung, try debugging them in your debugger and see how it goes :) | 18:15 |
| gyee | that code is pretty hairy | 18:15 |
| topol | gyee, ou blows chunks as well. I think we are stuck with businessCategory given our choice of default objectClasses | 18:15 |
| *** winston-d_ has quit IRC | 18:16 | |
| gyee | topol, I thought objectClass is configurable, no? | 18:16 |
| *** jaypipes has quit IRC | 18:17 | |
| topol | gyee, yes, but out of the box current defaults are groupOfNames for ProjectApi and inetOrgPerson for UserApi. Im assuming we picked those as best practice choices. Yes we can change them. But again this is just show people that it can work out of the box from devstack | 18:18 |
| *** kagan has quit IRC | 18:20 | |
| *** bencherian has quit IRC | 18:20 | |
| topol | gyee, given code freeze was today, I felt bad about opening up a discussion of the default ObjectClasses at such a late time. I was in put lipstick on the piggy and shove it out the door. | 18:20 |
| *** zing has quit IRC | 18:20 | |
| topol | mode | 18:20 |
| dolphm | gyee: question inline | 18:20 |
| *** Ryan_Lane has joined #openstack-dev | 18:22 | |
| *** shardy_afk is now known as shardy | 18:25 | |
| *** doude has joined #openstack-dev | 18:26 | |
| gyee | dolphm, responded | 18:26 |
| *** nati_ueno has quit IRC | 18:26 | |
| *** nati_ueno has joined #openstack-dev | 18:27 | |
| gyee | topol, we probably need to revisit our LDAP design in H | 18:27 |
| topol | gyee, I agree 1000% | 18:28 |
| gyee | rarely an enterprise will let an application write to their LDAP directory | 18:28 |
| ayoung | russellb, what would a policy rule that always passes look like? | 18:28 |
| ayoung | "rule:True"? | 18:28 |
| gyee | from my past experience, we practically have to murder somebody in IT in order to get them to open up LDAP :) | 18:28 |
| topol | gyee, +1000 | 18:29 |
| dolphm | gyee: still confused | 18:29 |
| ayoung | gyee, I think that LDAP is going to benefit most from the auth chain, and there will be several flavors of LDAP plugins for auth | 18:29 |
| *** shardy is now known as shardy_afk | 18:29 | |
| openstackgerrit | A change was merged to openstack/nova: Prevent the unexpected with nova-manage network modify. https://review.openstack.org/21447 | 18:30 |
| gyee | dolphm, what's the confusion? | 18:30 |
| ayoung | but most common will be, look in LDAP for user info, if it exists and meets some criteria, make sure there is an entry in the local database. Local database wil be used for roles etc | 18:30 |
| topol | gyee, goal here is to get something basic working so that we can add more automated testing, provide a real ldap development environment etc | 18:30 |
| dolphm | gyee: if an auth plugin succeeds, you append it, auth_response['methods'].append(method_name) | 18:31 |
| dolphm | gyee: and then you check if any auth methods succeeded, and raise an exception if so if len(auth_response["methods"]) > 0: | 18:31 |
| topol | ayoung, I will be showing up in Portland with lots of use cases similar to what you mention | 18:31 |
| dolphm | gyee: at least that's how i read it, i suspect i'm wrong | 18:31 |
| ayoung | topol, we can override in the config file, so if we need to publish a workaround figure out what it is. I doubt people will tend to use ldap with the defaults | 18:31 |
| topol | ayoung, I agree. but for folks trying to do development its nice to have | 18:32 |
| *** stevebaker has joined #openstack-dev | 18:32 | |
| gyee | dolphm, we need to give all the method a chance for continuation | 18:32 |
| dolphm | gyee: i understand what the exception being raised is intended to convey to the end user | 18:33 |
| gyee | if one raise a continuation exception, others down the chain have no chance | 18:33 |
| topol | so I am going to push a fix to devstack then check on sahdev who is trying to do the group ldap stuff | 18:33 |
| gyee | dolphm, the purpose is to aggregate all the responses and do it at once | 18:33 |
| dolphm | gyee: what i don't understand is how the conditional is possibly capable of detecting the proper condition under which to raise the exception | 18:33 |
| dolphm | gyee: so please explain WHY the condition is accurate, not WHAT the exception is for | 18:34 |
| gyee | plugin should only raise an exception on failure | 18:34 |
| gyee | it should return the payload for the next auth step if continuation is needed | 18:34 |
| *** jaypipes has joined #openstack-dev | 18:35 | |
| gyee | dolphm, I documented the expected behavior in both the interface and configuration.rst | 18:35 |
| ayoung | henrynash, I need a policy rule that will pass for all authed users. What does that look like? | 18:36 |
| *** Thor has quit IRC | 18:36 | |
| *** Tross has quit IRC | 18:36 | |
| *** Thor has joined #openstack-dev | 18:37 | |
| gyee | also, we did agreed on having the "extras" attribute in the token and that comes from the plugins to carry any deploment-spcific data | 18:37 |
| *** gargya has quit IRC | 18:37 | |
| *** dolphm has quit IRC | 18:38 | |
| *** dolphm has joined #openstack-dev | 18:39 | |
| *** romcheg has joined #openstack-dev | 18:39 | |
| *** FlorianOtel has quit IRC | 18:40 | |
| *** kagan has joined #openstack-dev | 18:42 | |
| *** garyk has quit IRC | 18:42 | |
| *** digitalsanctum has quit IRC | 18:46 | |
| *** bdpayne has quit IRC | 18:47 | |
| *** bdpayne has joined #openstack-dev | 18:48 | |
| ayoung | gyee, | 18:49 |
| ayoung | I think there is some bleed over inpolicy | 18:49 |
| gyee | ayoung, yeah? | 18:50 |
| *** locke105 has quit IRC | 18:50 | |
| ayoung | gyee, still investigating. Not sure if it is your changes or mine, but the failure changed after rebase | 18:50 |
| ayoung | its v2, so it shouldnt matter | 18:51 |
| *** baba has quit IRC | 18:51 | |
| gyee | ayoung, no, v2 doesn't use policy engine AFAIK | 18:51 |
| *** lglenden has quit IRC | 18:51 | |
| ayoung | gyee, I'm getting an auth error when getting a scoped token | 18:51 |
| *** mrodden has quit IRC | 18:51 | |
| *** zoresvit has quit IRC | 18:51 | |
| ayoung | from an unscoped. /tokens/controller.... | 18:52 |
| ayoung | gyee, did your last patch remove all the domains check etc? | 18:53 |
| gyee | ayoung, the only thing I changed in token/controler is the token validation logic | 18:54 |
| gyee | pretty much applied the same security patch you had | 18:54 |
| ayoung | hehehehehehehe | 18:54 |
| ayoung | gyee, nope | 18:54 |
| *** AlanClark__ has quit IRC | 18:54 | |
| ayoung | you also remove a large block right before that | 18:54 |
| *** AlanClark__ has joined #openstack-dev | 18:54 | |
| ayoung | https://review.openstack.org/#/c/21487/16..21/keystone/token/controllers.py | 18:54 |
| ayoung | line 89? | 18:54 |
| ayoung | gyee, it might be innocuous....I'll tell you in a sec | 18:55 |
| gyee | ayoung, that was dolphm's change | 18:55 |
| gyee | I happened to rebased to it | 18:55 |
| dolphm | ayoung: gyee: it was mostly written by mathrock and committed by me | 18:55 |
| gyee | dolphm, patch uploaded | 18:55 |
| dolphm | ayoung: gyee: we reviewed the patch in the bug, domains enable/disable is currently not validated and i have a bug filed and WIP to fix that | 18:56 |
| *** FlorianOtel has joined #openstack-dev | 18:56 | |
| gyee | dolphm, I am check for domain enabled/disabled in the auth logic | 18:56 |
| gyee | checking | 18:56 |
| dolphm | gyee: this only affects v2 because for whatever reason you didn't extend the same code | 18:57 |
| *** alszar has joined #openstack-dev | 18:57 | |
| ayoung | dolphm, something broke when I rebased to patch 21....probably due to my code. Too many moving parts, but hold off on committing gyee's until I am sure it is my fault and not his | 18:57 |
| gyee | dolphm, that's the reason I didn't extend it :) | 18:57 |
| gyee | don't want to get into rebase hell | 18:57 |
| dolphm | gyee: to create a more divergent codebase? | 18:57 |
| *** garyk has joined #openstack-dev | 18:57 | |
| gyee | v2 and v3 tokens are different | 18:58 |
| dolphm | gyee: superficially | 18:58 |
| ayoung | get_user_by_name now failing.... | 18:58 |
| gyee | ayoung, you need the domain ID | 18:58 |
| ayoung | gyee, Ha!~ | 18:59 |
| ayoung | probably that is it, I had removed that in the past....due to it being borked | 18:59 |
| ayoung | gyee, still...this was default domain and v2...shouldn't have broken.... | 19:00 |
| *** mjfork has joined #openstack-dev | 19:01 | |
| gyee | ayoung, you are using identity.Manager or identity.Controller? | 19:01 |
| gyee | I think identity controller fill in the default domain ID | 19:01 |
| ayoung | gyee I see in the debugger that domain_id = default | 19:02 |
| gyee | so what's failing? | 19:02 |
| *** stevebaker has quit IRC | 19:03 | |
| *** digitalsanctum has joined #openstack-dev | 19:03 | |
| ayoung | gyee, it isn't finding the user I create in my setup | 19:03 |
| ayoung | of coure, DB is not persisted, so I can't query what is in there for reas | 19:03 |
| ayoung | reals | 19:03 |
| *** danwent has quit IRC | 19:03 | |
| *** torandu has quit IRC | 19:04 | |
| *** danwent has joined #openstack-dev | 19:04 | |
| *** jrodom has quit IRC | 19:05 | |
| ayoung | gyee, I suspect I am picking up a function from your unit test instead of mine...which is actually good. | 19:05 |
| gyee | ayoung, which test is this? | 19:05 |
| ayoung | I have a bunch of test functions that need to go away, but were there due to the V3 auth not being done yet | 19:05 |
| ayoung | gyee, it is in my patch, test_v3_trust | 19:06 |
| *** torandu has joined #openstack-dev | 19:06 | |
| gyee | ayoung, if you extend from test_v3, you should be OK | 19:06 |
| ayoung | in setUp | 19:06 |
| ayoung | gyee, yeah...except I rewrote a bunch of crap. | 19:06 |
| ayoung | which I can, I hope, get rid of now. | 19:06 |
| gyee | test_v3 setUp did all the heavy lifting for you already | 19:06 |
| *** mrodden has joined #openstack-dev | 19:06 | |
| *** stevebaker has joined #openstack-dev | 19:07 | |
| ayoung | aha! | 19:07 |
| ayoung | OK, so I am getting your domain ID, not the one I thought I was creating. I can start removing my functions. | 19:07 |
| gyee | :) | 19:07 |
| *** fc__ has quit IRC | 19:07 | |
| ayoung | gyee, v2 supports domain, right | 19:07 |
| gyee | ayoung, nope | 19:07 |
| gyee | v2 is not domain-aware | 19:07 |
| ayoung | gyee, grumple | 19:08 |
| *** jrodom has joined #openstack-dev | 19:08 | |
| *** Tross has joined #openstack-dev | 19:08 | |
| *** fc__ has joined #openstack-dev | 19:09 | |
| ayoung | gyee, you're OK | 19:10 |
| *** danwent has joined #openstack-dev | 19:11 | |
| ayoung | gyee, I was testing for the presence of a domain attribute in the test self. which you added n, and tripped up my use of default. I'll need to stick with default for a short while | 19:11 |
| *** JonnyNomad_ is now known as JonnyNomad | 19:12 | |
| openstackgerrit | A change was merged to openstack/cinder: Bump the oslo-config version to address issues. https://review.openstack.org/22450 | 19:13 |
| *** dosaboy has quit IRC | 19:13 | |
| openstackgerrit | A change was merged to openstack/nova: Fix handling of source_groups with no-db-compute. https://review.openstack.org/21679 | 19:14 |
| *** jrodom has quit IRC | 19:14 | |
| *** cp16net|away is now known as cp16net | 19:15 | |
| *** jrodom has joined #openstack-dev | 19:16 | |
| ayoung | dolphm, being asked if the V2 API is going to stay as "beta" | 19:16 |
| *** njoy_ has quit IRC | 19:16 | |
| dolphm | "deprecated" | 19:16 |
| dolphm | ideally | 19:16 |
| *** njoy_ has joined #openstack-dev | 19:16 | |
| dolphm | ayoung: v2 was actually marked as "stable" sometime in essex, i'm not sure what happened | 19:17 |
| ayoung | dolphm, Ok. So we think it should be tagged stable. I'll note that. | 19:17 |
| ayoung | dolphm, and V3 in grizzly will be stable as well, right? | 19:17 |
| dolphm | ayoung: if it has auth, i suppose | 19:18 |
| ayoung | dolphm, fair enough | 19:18 |
| ayoung | dolphm, I'm going to add "default": [["rule:admin_required"]], to policy.json, so that any API that we addd, if we don't put a rule in, will be is_admin only | 19:20 |
| dolphm | ayoung: i think you also need to revise keystone.conf to have a default_policy_rule=default or something | 19:20 |
| ayoung | dolphm, hmmmm, OK I'll look | 19:21 |
| *** adjohn has joined #openstack-dev | 19:22 | |
| *** afazekas has quit IRC | 19:23 | |
| * ayoung starting to like this policy thing | 19:25 | |
| *** colinmcnamara has quit IRC | 19:29 | |
| *** datsun180b_ has joined #openstack-dev | 19:29 | |
| *** bencherian has joined #openstack-dev | 19:31 | |
| *** maurosr_ has joined #openstack-dev | 19:32 | |
| *** datsun180b has quit IRC | 19:32 | |
| *** datsun180b_ is now known as datsun180b | 19:32 | |
| ayoung | henrynash, ok, you got me into this mess | 19:33 |
| ayoung | here's the deal | 19:33 |
| *** cp16net is now known as cp16net|away | 19:33 | |
| ayoung | I the policy rule is looking at the request coming in | 19:33 |
| ayoung | and it looks partially like this | 19:33 |
| ayoung | dict: {trust :{trustee_user_id:'blah'} | 19:33 |
| ayoung | I need to write a rule that will match that | 19:34 |
| *** colinmcnamara has joined #openstack-dev | 19:34 | |
| dolphm | ayoung: that's generally done in the controllers, which understand the api | 19:34 |
| ayoung | dolphm, I know, I have that | 19:35 |
| *** maurosr has quit IRC | 19:35 | |
| ayoung | dolphm, but...I want to understand the policy stuff, and the rule that the token API uses doesn't work for me | 19:35 |
| ayoung | I figured I'd try to see if I can get that to work here, too. | 19:35 |
| ayoung | dolphm, something needs to match/ | 19:36 |
| ayoung | dolphm, it looks for something in the creds....and matches it to something in the request body. | 19:37 |
| *** jrodom has quit IRC | 19:37 | |
| ayoung | # TODO(termie): do dict inspection via dot syntax | 19:37 |
| *** jrodom has joined #openstack-dev | 19:37 | |
| *** johnthetubaguy has quit IRC | 19:37 | |
| *** novas0x2a|laptop has joined #openstack-dev | 19:39 | |
| *** esp1 has quit IRC | 19:40 | |
| ayoung | dolphm, is it a mistake in the trust API to have a top level trust :{} in the creat request? | 19:41 |
| *** esp1 has joined #openstack-dev | 19:41 | |
| *** maurosr_ is now known as maurosr | 19:41 | |
| dolphm | ayoung: like POST /v3/trusts {"trust": { /* actual data? */ }} | 19:42 |
| ayoung | dolphm, yeah | 19:42 |
| dolphm | ayoung: i think keystone.common.wsgi.Application expects you to do that | 19:42 |
| *** adjohn has quit IRC | 19:42 | |
| dolphm | ayoung: because it'll unpack the request into create_trust(context, trust={ /* actual data */ }) | 19:43 |
| *** adjohn has joined #openstack-dev | 19:43 | |
| ayoung | dolphm, yeah...policy doesn't seem to like it, though...still learning | 19:43 |
| dims | dprince, got minute? | 19:45 |
| dprince | dims: hi. | 19:45 |
| dprince | dims: 1 minute... I have to run out for a bit. | 19:46 |
| dims | dprince, if forbid_dtd is true, then EntityDeclHandler/UnparsedEntityDeclHandler is never called. if forbid_dtd is false, then ExternalEntityRefHandler *is* called and the tests hangs | 19:47 |
| dims | do we allow forbid_dtd to false ever? if not then we can even take out the code for EntityDeclHandler/UnparsedEntityDeclHandler | 19:47 |
| dprince | dims: Okay. Well... as for our code in Nova we only use forbid_dtd=True. | 19:48 |
| dims | right, so i am adding defensive code so that folks who may pick up will be safe | 19:48 |
| dims | i'll make that clearer | 19:48 |
| dims | ok? | 19:48 |
| dprince | dims: I left that in there for some odd case... so if that is the case then I think you'll need to change your tests to actually use that flag then too. | 19:48 |
| dims | cool, will update code and tests | 19:49 |
| *** afazekas has joined #openstack-dev | 19:49 | |
| *** cschwede has joined #openstack-dev | 19:49 | |
| dprince | dims: making it clearer is good too though I think... but the important think is the initial security patch works as-is. (as it in already guarded against those attacks because we always set forbid_dtd=True) | 19:49 |
| *** vipul is now known as vipul|away | 19:50 | |
| dims | correct | 19:50 |
| dims | agree | 19:50 |
| dprince | dims: cool. thanks for adding this. gotta run. | 19:50 |
| *** dprince has quit IRC | 19:50 | |
| *** david2 has joined #openstack-dev | 19:51 | |
| ayoung | gyee, did you test ["user_id:%(user_id)s"] | 19:53 |
| *** morganfainberg has joined #openstack-dev | 19:55 | |
| *** rnirmal has quit IRC | 19:58 | |
| *** doude has quit IRC | 19:58 | |
| *** bknudson has quit IRC | 19:59 | |
| iccha | hey is there a way to run tests by circumventing the oslo config for glance | 20:00 |
| *** adjohn has quit IRC | 20:01 | |
| *** bknudson has joined #openstack-dev | 20:01 | |
| *** AlanClark__ has quit IRC | 20:02 | |
| *** danwent has quit IRC | 20:02 | |
| *** AlanClark__ has joined #openstack-dev | 20:02 | |
| dolphm | gyee: here's another diff for you http://paste.openstack.org/raw/32112/ | 20:03 |
| openstackgerrit | A change was merged to openstack/glance: Adding new common image properties https://review.openstack.org/21547 | 20:03 |
| openstackgerrit | A change was merged to openstack/nova: Add better status to baremetal deployments. https://review.openstack.org/21481 | 20:03 |
| clarkb | iccha: I don't think so. oslo config is used to manage glance's configuration | 20:03 |
| clarkb | iccha: what are you trying to accomplish? | 20:03 |
| *** bknudson1 has joined #openstack-dev | 20:03 | |
| iccha | clarkb: https://bugs.launchpad.net/glance/+bug/1130853 | 20:04 |
| uvirtbot | Launchpad bug 1130853 in glance "Installing virtual environment depends on oslo.config" [High,In progress] | 20:04 |
| *** romcheg has quit IRC | 20:05 | |
| *** bknudson has quit IRC | 20:05 | |
| iccha | clarkb: i am not able to run tests becauyse of this, was wondering if there is a work around | 20:05 |
| clarkb | iccha: does tox -epy27 do any better? | 20:06 |
| clarkb | that is what jenkins would use to gate glance so presumably that worked | 20:06 |
| clarkb | tox doesn't use install_venv_common so should work | 20:06 |
| iccha | clarkb: nope ImportError: No module named oslo.config | 20:07 |
| clarkb | with tox? | 20:07 |
| *** romcheg has joined #openstack-dev | 20:07 | |
| iccha | clarkb: yes | 20:07 |
| clarkb | iccha: are you building a new tox env? | 20:07 |
| ayoung | dolphm, am I correct in understanding that with string replacement in python, using a dictionary, you can only go one level deep? | 20:07 |
| ayoung | IE | 20:07 |
| clarkb | iccha: tox -repy27 | 20:07 |
| clarkb | -r means recreate the venv | 20:08 |
| ayoung | t = {"a":{"b":"1"}} | 20:08 |
| ayoung | print "%(a)s" % t is ok | 20:08 |
| ayoung | but there is not way to get at t["a"]["b"] by just passing in t | 20:08 |
| iccha | that helps clarkb , thanks | 20:08 |
| *** cschwede has quit IRC | 20:09 | |
| *** diogogmt has joined #openstack-dev | 20:09 | |
| dolphm | ayoung: i'm not aware of a way to do that in py2 | 20:09 |
| *** kagan has quit IRC | 20:09 | |
| ayoung | dolphm, OK...somehow thay manage it in Nova, and I'm tryng to figure out what they are doing | 20:10 |
| ayoung | they have a rule | 20:10 |
| ayoung | "admin_or_owner": "is_admin:True or project_id:%(project_id)s", | 20:10 |
| dolphm | ayoung: maybe flatten the dictionary? | 20:10 |
| openstackgerrit | A change was merged to openstack/ceilometer: Disable notifier tests https://review.openstack.org/22449 | 20:10 |
| ayoung | dolphm, ah... | 20:10 |
| ayoung | you mean trust.id = trust { id: ...} | 20:10 |
| ayoung | dolphm, is there a standard way to do that in python? | 20:11 |
| dolphm | ayoung: i mean produce a new dictionary... {"a":{"b":"1"}} -> {"a_b": "1"} | 20:11 |
| ayoung | dolphm, yeah | 20:11 |
| ayoung | I was going with dotr notation, but yeah | 20:12 |
| *** crandquist has joined #openstack-dev | 20:12 | |
| ayoung | so a.b instead of a_b, | 20:12 |
| dolphm | '%(a_b)s' % flatten({"a":{"b":"1"}}) | 20:12 |
| *** Tross has quit IRC | 20:12 | |
| dolphm | you could also override the __getitem__ method on the dict to do it dynamically | 20:13 |
| dolphm | or __getattr__ if you want to go with the dot notation | 20:13 |
| gyee | dolphm, for the tests, I simply remove the assertions for "description" and "enabled" field as they are applicable to all entities | 20:14 |
| gyee | role does not have "enabled" field | 20:14 |
| gyee | and user does not have "description" | 20:14 |
| *** bdpayne has quit IRC | 20:15 | |
| gyee | they are not applicable to all entities | 20:15 |
| dolphm | gyee: users can have a description | 20:15 |
| gyee | but those assertions are used on all entities | 20:15 |
| dolphm | gyee: but anyway, pass in ignore_attributes or something to explicitly ignore 'enabled' on a role, for example | 20:15 |
| *** bdpayne has joined #openstack-dev | 20:16 | |
| dolphm | gyee: instead of ignoring the convention, make exceptions to it | 20:16 |
| gyee | k | 20:16 |
| dolphm | gyee: did you see the diff i posted? | 20:16 |
| gyee | dolphm, I am about to apply those diffs, just came back from lunch | 20:17 |
| *** jrodom has quit IRC | 20:17 | |
| gyee | thanks for the diffs | 20:17 |
| dolphm | gyee: np, trying to help | 20:17 |
| *** devoid has quit IRC | 20:18 | |
| *** devoid has joined #openstack-dev | 20:18 | |
| *** bknudson1 has quit IRC | 20:22 | |
| *** bknudson has joined #openstack-dev | 20:22 | |
| *** romcheg has left #openstack-dev | 20:25 | |
| *** bknudson has quit IRC | 20:26 | |
| *** FlorianOtel has quit IRC | 20:27 | |
| YorikSar | dolphm: Hi. Any chance for my 'enabled emulation' change to land today? | 20:30 |
| *** otherwiseguy has joined #openstack-dev | 20:30 | |
| YorikSar | Can anyone but ayoung approve it? | 20:31 |
| ayoung | YorikSar, link | 20:31 |
| YorikSar | https://review.openstack.org/20928 | 20:31 |
| YorikSar | ayoung: Never though you'll have time for this. | 20:32 |
| *** bearovercloud has joined #openstack-dev | 20:32 | |
| *** alexpilotti has joined #openstack-dev | 20:32 | |
| dolphm | gyee: this will fix your issue with validating error responses on HEAD calls http://paste.openstack.org/raw/32113/ | 20:32 |
| ayoung | topol, can you give ^^ a look over s well? Your LDAP kung fu is stronger than mine | 20:33 |
| dolphm | gyee: i imagine it'll conflict if applied on top of the last one because i deleted the override with 'pass' | 20:33 |
| *** amerine has quit IRC | 20:33 | |
| *** jcmartin has joined #openstack-dev | 20:34 | |
| topol | ayoung, sure. which one? https://review.openstack.org/20928 ? | 20:34 |
| ayoung | topol, yeah | 20:34 |
| topol | ayoung, k | 20:34 |
| gyee | dolphm, I simply want to check for 401 instead of base class bail on me | 20:34 |
| YorikSar | dolphm: Thanks... I hope it still cleanly merges with master. | 20:34 |
| dolphm | topol: the reason we don't answer your questions about ldap is because you're the go-to guy for ldap now | 20:35 |
| *** david2 has quit IRC | 20:35 | |
| *** doude has joined #openstack-dev | 20:35 | |
| dolphm | gyee: expected_status=401 isn't working? | 20:35 |
| ayoung | YorikSar, I assume you've tsted this against a live LDAP server? I don;t really trust FakeLDAP | 20:35 |
| topol | dolphm, I have thrown many a person in to force them to swim. Karma dictates that it should happen to me sooner or later :-) | 20:36 |
| gyee | dolphm, it was working with the override | 20:36 |
| YorikSar | I can help with LDAP stuff if someone can fill me in. | 20:36 |
| *** amerine has joined #openstack-dev | 20:36 | |
| gyee | I got a 401 back as expected | 20:36 |
| *** bearovercloud has left #openstack-dev | 20:36 | |
| dolphm | gyee: but you also weren't validating the auth body on failures | 20:36 |
| *** japage has joined #openstack-dev | 20:37 | |
| YorikSar | ayoung: Yes, we ran tempest with OpenLDAP behind Keystone. | 20:37 |
| *** bearovercloud has joined #openstack-dev | 20:37 | |
| ayoung | dolphm, so for policy is . notation OK? I have the following rule working with a flatten: | 20:37 |
| ayoung | ["user_id:%(trust.trustor_user_id)s"] | 20:37 |
| dolphm | ayoung: where are you writing the implementation, in oslo? | 20:38 |
| *** Gordonz has quit IRC | 20:38 | |
| ayoung | dolphm, no in Keystone controller | 20:38 |
| *** Gordonz has joined #openstack-dev | 20:38 | |
| *** danwent has joined #openstack-dev | 20:38 | |
| *** mkollaro has quit IRC | 20:38 | |
| ayoung | keystone common controller decorator | 20:38 |
| *** datsun180b has quit IRC | 20:38 | |
| *** stevebaker has quit IRC | 20:38 | |
| *** datsun180b has joined #openstack-dev | 20:38 | |
| YorikSar | ayoung: So 'enabled' support was missing totally, other fixes are filed separatelly: https://review.openstack.org/22352 and https://review.openstack.org/22348. But they can be considered bugfixes since nothing new is introduced, only fixed. | 20:38 |
| ayoung | code shamelessly stolen from Stackoverflow of course | 20:38 |
| ayoung | YorikSar, I remember vaguley acking https://review.openstack.org/#/c/22352/1 | 20:39 |
| ayoung | you sure that that fix isn't already in elsewhere? | 20:39 |
| ayoung | YorikSar, I can ack the enabled one, though | 20:40 |
| ayoung | I'll let topol chime in first though | 20:40 |
| YorikSar | ayoung: I don't know about description stuff, I'll check open change requests now. | 20:40 |
| henrynash | ayoung: that policy is on create trust, i assume | 20:41 |
| ayoung | henrynash, yes | 20:41 |
| ayoung | henrynash, I'm trying to get this working | 20:41 |
| ayoung | ["rule:admin_required"], ["user_id:%(trust.trustor_user_id)s"],["user_id:%(trust.trustee_user_id)s"] | 20:41 |
| ayoung | for the lists etc. | 20:41 |
| henrynash | I think that should work, since the protector will out the trust_id and they trust object into the policy engine | 20:41 |
| ayoung | delete will be same as create, but not sure I have the same context to work with. | 20:42 |
| henrynash | no, you won't since the object isn't pass to the api call | 20:42 |
| ayoung | henrynash, crud | 20:42 |
| ayoung | henrynash, how can I write a rule that just says "alway pass"? | 20:43 |
| henrynash | [] | 20:43 |
| henrynash | (I think) | 20:43 |
| *** FlorianOtel has joined #openstack-dev | 20:43 | |
| *** colinmcnamara has quit IRC | 20:44 | |
| henrynash | ayoungL: pretty sure we'll be doing a pass of all the protection settings spit freze | 20:44 |
| dolphm | henrynash: did you upgrade keystone to use oslo's policy impl? | 20:44 |
| henrynash | dolphm: yes | 20:44 |
| openstackgerrit | A change was merged to openstack/cinder: Better error handling around volume delete. https://review.openstack.org/22462 | 20:45 |
| *** stevebaker has joined #openstack-dev | 20:45 | |
| dolphm | ayoung: i'm pretty sure what you're doing should go into oslo | 20:45 |
| henrynash | dolphm: well, to be exact, it is the openstack.common one | 20:45 |
| *** pcm_ has quit IRC | 20:45 | |
| dolphm | henrynash: yeah, i guess it's not packaged under 'oslo' quite yet | 20:45 |
| henrynash | dolphm: so we don't get it from the oslo librayr | 20:45 |
| dolphm | gyee: ETA on next rev? | 20:46 |
| gyee | dolphm, in a few mins | 20:47 |
| dolphm | gyee: cool | 20:47 |
| gyee | I have both patches applied | 20:47 |
| *** imsplitbit has joined #openstack-dev | 20:47 | |
| gyee | reruning the tests right now | 20:47 |
| *** jsindy has joined #openstack-dev | 20:47 | |
| topol | ayoung, 22352 looks correct to me and does not appear in my code which I refreshed earlier today I believe. Im doing some testing and may be running into issues because I dont have 22352. will keep verifying | 20:47 |
| *** adjohn has joined #openstack-dev | 20:48 | |
| YorikSar | ayoung: btw, if you ever want to remove more unused lines from LDAP backend: https://review.openstack.org/22362 | 20:48 |
| openstackgerrit | A change was merged to openstack/nova: Add a volume driver in Nova for Scality SOFS https://review.openstack.org/19676 | 20:51 |
| openstackgerrit | A change was merged to openstack/nova: cfg should be imported from oslo.config https://review.openstack.org/22466 | 20:51 |
| *** boris-42 has joined #openstack-dev | 20:52 | |
| openstackgerrit | A change was merged to openstack/glance: Sync latest install_venv_common.py https://review.openstack.org/22463 | 20:52 |
| gyee | dolphm, patch uploaded | 20:52 |
| *** doude has left #openstack-dev | 20:54 | |
| ayoung | dolphm, yes, it should go into oslo, but I think that it can go here safely for now. I can't run withou it and do policy. Should I just punt on policy? | 20:54 |
| dolphm | gyee: so, here's my opinion... it's complete but full of bugs that can be filed & fixed over the next couple weeks, all of them minor afaik | 20:54 |
| *** pcm_ has joined #openstack-dev | 20:55 | |
| gyee | bugs? | 20:55 |
| dolphm | gyee: spec inconsistencies, mostly | 20:55 |
| gyee | k | 20:55 |
| gyee | works for me | 20:55 |
| dolphm | gyee: i'd also refrain from telling anyone we support pluggable authentication, because i can't write a plugin myself | 20:56 |
| gyee | dolphm, what you have in mind, I can write one for ya :) | 20:56 |
| *** jcmartin has quit IRC | 20:57 | |
| dolphm | gyee: i'm just talking about the ability to understand the api i'm expected to fulfill as a plugin | 20:57 |
| dolphm | gyee: conditionally populating some dict that's handed to me is way out of bounds, imo | 20:57 |
| gyee | doc not clear? | 20:57 |
| YorikSar | ayoung: Looked through all open changes. Can't see anyone changing default mapping for description. | 20:57 |
| dolphm | gyee: it's not a doc issue, it's where the burden of responsibilities lies -- too many are placed on the plugin | 20:58 |
| ayoung | YorikSar, OK, I'll give those all a look over in a bit. They mostly look fine. | 20:59 |
| dolphm | gyee: so, i'd like to make the plugin API a bit simpler (providing just a small part of the auth request to the plugin was a HUUUUGE step in that direction) and i'd also like to allow multiple plugins per authentication method... which i think is the use case most people have in mind (mixing sql and ldap auth, for example) | 20:59 |
| gyee | dolphm, not really, all we require is plugin resolve the user_id | 20:59 |
| dolphm | gyee: i agree, but that's not the reality | 20:59 |
| dolphm | YorikSar: the freeze doesn't apply to bug fixes, btw | 21:00 |
| *** almaisan-away is now known as al-maisan | 21:00 | |
| *** EmilienM has quit IRC | 21:00 | |
| *** EmilienM has joined #openstack-dev | 21:01 | |
| gyee | dolphm, I suspect we're going to have a session (or more) over this in the summit | 21:01 |
| *** jsindy is now known as monst_ | 21:01 | |
| *** afazekas has quit IRC | 21:01 | |
| YorikSar | dolphm: Yes, I understand. The one I want to make sure to land today is 'enabled emulation'. | 21:01 |
| dolphm | gyee: that's a good idea | 21:01 |
| dolphm | YorikSar: is that the one ayoung wants topol to review? | 21:02 |
| *** Tross has joined #openstack-dev | 21:02 | |
| YorikSar | dolphm: Yes. | 21:02 |
| ayoung | dolphm, yeah | 21:03 |
| *** rnirmal has joined #openstack-dev | 21:03 | |
| *** hub_cap has joined #openstack-dev | 21:03 | |
| henrynash | dims, dophm, gyee, young: I need some hand holding to get my query filter patch (which is dependant on Guang's patch) in….I think I have a screwed by commit history, so trying to push the review is not behaving | 21:03 |
| hub_cap | hi all, im trying to code some changes to edit metadata (changes to our ovz driver w/ imsplitbit) and im wondering, since tehre is a metadata svc, is there some example that someone can point me to so i can start hacking? | 21:04 |
| gyee | henrynash, yeah, I don't see your latest changes | 21:04 |
| topol | dolphm, I have on my list | 21:04 |
| topol | https://review.openstack.org/#/c/22352/1 | 21:04 |
| topol | https://review.openstack.org/20928 | 21:04 |
| dolphm | henrynash: can you push to github or something? | 21:05 |
| dolphm | henrynash: the whole repo | 21:05 |
| gyee | topol, you use openldap for your tests? | 21:07 |
| henrynash | dolphm: want to be careful here, what cmd would you suggest I use for that? | 21:07 |
| topol | gyee, yes I am | 21:08 |
| *** ewindisch has quit IRC | 21:08 | |
| *** melwitt has joined #openstack-dev | 21:09 | |
| dolphm | henrynash: git checkout -b broken_branch | 21:09 |
| *** ewindisch has joined #openstack-dev | 21:09 | |
| dolphm | henrynash: and then git push origin broken_branch to an empty github repo | 21:09 |
| dolphm | assuming origin is github | 21:09 |
| *** mohits has quit IRC | 21:09 | |
| henrynash | dolphm: so I have a branch that has correctly (in terms of the end result) merged up to a recent (but not the latest) version of Guang's patch | 21:10 |
| dolphm | henrynash: git reflog may also be useful to show your previous states | 21:10 |
| vishy | boris-42: ping | 21:10 |
| boris-42 | fishy hi | 21:11 |
| dolphm | henrynash: are you using the Rebase button on gerrit or doing this offline? | 21:11 |
| boris-42 | vishy hi* | 21:11 |
| henrynash | diolphm: but looking at the log, it shows I 3 or 4 merges with earlier versions of the Guang's patch….and the review says I need to squash them | 21:11 |
| vishy | boris-42: I notice you are sticking up some more unique keys patches today | 21:11 |
| vishy | any idea how many there are? | 21:11 |
| *** mohits has joined #openstack-dev | 21:11 | |
| boris-42 | vishy there is a lot of… =( | 21:11 |
| vishy | boris-42: any that don't make it today will we need to discuss whether to FFE them / take them as fixes / or push them to havanna | 21:12 |
| *** cp16net|away is now known as cp16net | 21:12 | |
| dolphm | henrynash: have you made changes that aren't in your latest review, other than resolving merge conflicts? | 21:13 |
| vishy | boris-42: are you planning on working on them over the next few days or will it just be here and there when you have time? | 21:13 |
| henrynash | dolphm: yes, to fix up various problems | 21:13 |
| dolphm | and you've committed those? | 21:13 |
| henrynash | dolphm: yes | 21:14 |
| henrynash | dolphm: but git review fails | 21:14 |
| dolphm | henrynash: git log -n 1 <-- shows your last commit id, worth making a note of | 21:14 |
| clarkb | henrynash: can you paste the git review failure too? | 21:14 |
| dolphm | henrynash: git reflog will show you previous commits you were on, in case you want to go back | 21:14 |
| dolphm | henrynash: so don't worry to much about getting into a nasty state because you can always go back... what's the git review error say? | 21:15 |
| *** colinmcnamara has joined #openstack-dev | 21:15 | |
| henrynash | so here's what my git log says: | 21:16 |
| boris-42 | vishy: I was going to sleep=), here is about 1am (UTC+3) =). I was planing to finish bp in 2-3 weeks.. | 21:16 |
| henrynash | 11060f02fb9e10a904b3921e70476e05fbb9a58b Pass query filter attributes to policy engine | 21:16 |
| henrynash | 5aaa22100baf1e53680a062f2b841cfa323b4a10 blueprint pluggable-identity-authentication-handlers blueprint stop-ids-in-uris blueprint multi-factor-authn (just the plumbing) v3 authentication and token APIs | 21:16 |
| henrynash | 69352fa99cf82ee78d980972bc4881ba9d7fe162 blueprint pluggable-identity-authentication-handlers blueprint stop-ids-in-uris blueprint multi-factor-authn (just the plumbing) v3 authentication and token APIs | 21:16 |
| henrynash | ca2b0cd1d58d8d74e4e7920b8b8c6a7fa52490ec blueprint pluggable-identity-authentication-handlers blueprint stop-ids-in-uris blueprint multi-factor-authn (just the plumbing) v3 authentication and token APIs | 21:16 |
| henrynash | 7e456cf2a9f85e4f45395c17d61d02043c69ab6b v3 token API | 21:16 |
| henrynash | d036db145d51f8b134ffa36165065a8986e4f8a1 Merge "make LDAP query scope configurable" | 21:16 |
| openstackgerrit | A change was merged to openstack/oslo-incubator: Move DB thread pooling to DB API loader https://review.openstack.org/22158 | 21:17 |
| *** donaldh has joined #openstack-dev | 21:17 | |
| boris-42 | There is a lot of work around, for example in security groups (There is no tests for db api at all) + there is also session in public parameters… | 21:17 |
| vishy | boris-42: ok so it will be for h then | 21:18 |
| vishy | I will bring it up in the nova meeting to see if we want to include any in the rc period | 21:18 |
| dolphm | henrynash: do you have changes across multiple commits, or is everything in 11060? | 21:19 |
| henrynash | dolphm: and the actual review error is: | 21:19 |
| henrynash | remote: (W) ca2b0cd: commit subject >65 characters; use shorter first paragraph[K | 21:19 |
| henrynash | To ssh://henry-nash@review.openstack.org:29418/openstack/keystone.git | 21:19 |
| henrynash | ! [remote rejected] HEAD -> refs/for/master/bug/1126048 (squash commits first) | 21:19 |
| henrynash | error: failed to push some refs to 'ssh://henry-nash@review.openstack.org:29418/openstack/keystone.git' | 21:19 |
| dolphm | henrynash: git fetch ssh://dolph@review.openstack.org:29418/openstack/keystone refs/changes/87/21487/21 && git checkout FETCH_HEAD && git cherry-pick 11060f02fb9e10a904b3921e70476e05fbb9a58b | 21:19 |
| dolphm | henrynash: my normal workflow ^ checkout someone else's change, and cherry pick yours on top of it to create a dependency on their latest patch | 21:19 |
| boris-42 | boris-42: ok thanks. I think that it is better to do slow and without bugs that could produce nasty things then fast=) | 21:20 |
| henrynash | all though isn't it version 23 now? | 21:20 |
| dolphm | henrynash: actually 24 lol | 21:20 |
| *** al-maisan is now known as almaisan-away | 21:20 | |
| dolphm | gyee: pep8 fix? | 21:20 |
| henrynash | dolphm: so I do that in my branch | 21:21 |
| boris-42 | vish ok thanks. I think that it is better to do slow and without bugs that could produce nasty things then fast=) | 21:21 |
| dolphm | henrynash: that will leave your branch behind | 21:21 |
| vishy | boris-42: great! | 21:21 |
| henrynash | dolphm: opk, sounds good! | 21:21 |
| boris-42 | fishy Also I implemented BP pci passthrough... | 21:21 |
| *** cschwede has joined #openstack-dev | 21:22 | |
| gyee | dolphm, yeah, just did | 21:24 |
| *** mohits has quit IRC | 21:25 | |
| henrynash | dophm: I get permission denied (publickey) | 21:25 |
| *** hub_cap has left #openstack-dev | 21:25 | |
| clarkb | yeah because the string dolphm gave you has dolphm as the username | 21:26 |
| clarkb | you can ust https anonymously | 21:26 |
| *** kagan has joined #openstack-dev | 21:26 | |
| clarkb | if you look at the change you awnt under the latest patchset will be text you can copy and paste | 21:26 |
| dolphm | henrynash: oh sorry, either your use username, or copy the checkout command from gerrit, and then do a cherry-pick | 21:27 |
| henrynash | dolphm: duh, yes sorry me being dumb | 21:27 |
| *** boris-42 has quit IRC | 21:29 | |
| *** b1rkh0ff has quit IRC | 21:30 | |
| *** dwilson has left #openstack-dev | 21:30 | |
| ewindisch | I'd still like to get the (oslo) advanced-matchmaker blueprint merged today, if I can get reviewers on it. https://review.openstack.org/#/c/20434/ | 21:31 |
| dolphm | henrynash: i imagine you didn't mean to approve https://review.openstack.org/#/c/22063/ | 21:32 |
| henrynash | dolphm: eeK! how did that happen? | 21:33 |
| ewindisch | russellb: I didn't realize that 'oslo.message' was NOT supposed to have s/oslo/$BASE/ ? Update.py will continue to break this, won't it? | 21:33 |
| dolphm | henrynash: i don't think it matters because there's no positive votes anyway | 21:33 |
| dolphm | henrynash: you can undo | 21:33 |
| *** dwilson has joined #openstack-dev | 21:33 | |
| russellb | ewindisch: need to fix update.py now, yes | 21:33 |
| ayoung | henrynash, so it looks like "@" is a TrueCheck | 21:34 |
| ttx | dolphm: hola! how is it going ? | 21:35 |
| *** adjohn has quit IRC | 21:35 | |
| ayoung | topol, if you are OK with https://review.openstack.org/#/c/20928/5 let me know | 21:36 |
| *** esp1 has quit IRC | 21:36 | |
| dolphm | ttx: you said we had like 10 more minutes | 21:36 |
| ttx | dolphm: oh, sure, I'm just being a PITA :) | 21:37 |
| dolphm | ttx: ;) | 21:37 |
| *** vipul|away is now known as vipul | 21:37 | |
| ttx | I'll give you 23 more minutes :) | 21:37 |
| dolphm | ttx: haha | 21:37 |
| dolphm | henrynash: can you take a minute to review https://review.openstack.org/#/c/21487/ as-is? | 21:38 |
| openstackgerrit | A change was merged to openstack/nova: Refactor nwfilter parameters https://review.openstack.org/22369 | 21:38 |
| henrynash | dolphm: yep…just cleaning up my git... | 21:38 |
| *** radez is now known as radez_g0n3 | 21:38 | |
| topol | ayoung, looks good. just +1 it | 21:39 |
| YorikSar | topol: Yay! | 21:39 |
| dolphm | henrynash: i can't stomach the approve button, so i'll leave that up to you | 21:39 |
| *** dprince has joined #openstack-dev | 21:39 | |
| *** esp1 has joined #openstack-dev | 21:39 | |
| henrynash | dolphm :-) | 21:40 |
| *** adjohn has joined #openstack-dev | 21:40 | |
| topol | YorikSar, so I am tracking down another issue maybe you can help me with | 21:40 |
| YorikSar | topol: Sure, just tell me what it is. | 21:41 |
| topol | YorikSar, so the basic devstack setup commands all run fine | 21:41 |
| topol | YorikSar, I then tried to add a user to a particular tenantID | 21:42 |
| *** pabelanger has quit IRC | 21:42 | |
| *** Ryan_Lane has quit IRC | 21:42 | |
| *** eharney has quit IRC | 21:42 | |
| *** voliveirajr has quit IRC | 21:42 | |
| YorikSar | topol: iirc, we had no problems there. | 21:45 |
| topol | YorikSar, and then ldap complained about not being able to store the tenantID attribute. Which looks similar to the tenant_ id so I added it to the filter list: | 21:45 |
| topol | iniset $KEYSTONE_CONF ldap user_attribute_ignore "enabled,email,tenant_id,tenants,tenantId" | 21:45 |
| YorikSar | eh.... | 21:46 |
| topol | YorikSar that got me through the add user to tenant but then when it tries to update the role it cant find the role | 21:46 |
| ttx | dolphm: once 21487 merges... i can close "Implement authn Identity API v3", replace-tenant-user-membership, domain-name-spaces, domain-scoping ? | 21:47 |
| *** Ryan_Lane has joined #openstack-dev | 21:47 | |
| ttx | dolphm: and leave pluggable-identity-authentication-handlers open ? | 21:47 |
| YorikSar | I don't get it how these tenant_id and tenantId coexist. | 21:47 |
| gyee | pluggable should be done | 21:47 |
| dolphm | ttx: tenant-user-membership is merged | 21:47 |
| dolphm | gyee: that's debatable ;) | 21:47 |
| gyee | and stop-ids-in-url | 21:48 |
| dolphm | ttx: ^ | 21:48 |
| gyee | and mfa | 21:48 |
| ttx | dolphm: ok, marking tenant-user-membership completed | 21:48 |
| gyee | though mfa is just the plumbing | 21:48 |
| dolphm | ttx: not domain-scoping | 21:48 |
| dolphm | gyee: i think it's enough to satisfy the mfa bp, no? | 21:48 |
| gyee | dolphm, I think so | 21:49 |
| dolphm | gyee: mfa was mostly asking for a spec | 21:49 |
| YorikSar | topol: That's strange. Can you paste Keystone log of relevant request? | 21:49 |
| gyee | unless you guys want me to hookup google authenticator :) | 21:49 |
| *** imsplitbit has quit IRC | 21:49 | |
| ttx | dolphm: mfa is not in the list, so i don't really care :) | 21:49 |
| dolphm | gyee: i think it'd be cool to example an example, in docs if not in contrib | 21:49 |
| dolphm | SOMEONE BROKE THE LIST | 21:49 |
| ttx | dolphm: what needs to be done to complete domain-scoping ? Looks like that will be deferred in H at this point | 21:49 |
| ttx | dolphm: blame heckj | 21:50 |
| dolphm | ttx: we've written the API but haven't implemented due to lack of immediate use cases | 21:50 |
| dolphm | ttx: definitely defer to H | 21:50 |
| gyee | +1 | 21:50 |
| ttx | dolphm: deferring domain-scoping to h1 | 21:51 |
| ttx | dolphm: should I add mfa back to the list ? | 21:52 |
| gyee | we should as the plumbing is there to impl mfa | 21:52 |
| ttx | gyee: ok | 21:53 |
| dolphm | ttx: only add it back if you want to mark it as completed? | 21:53 |
| henrynash | ttx: hold, on- domain scopingto h? | 21:53 |
| ttx | henrynash: that's what dolphm said just a minute ago | 21:53 |
| dolphm | ttx: domain scoping to H | 21:54 |
| dolphm | ttx: https://blueprints.launchpad.net/keystone/+spec/multi-factor-authn is implemented with gyee's patch today | 21:54 |
| *** rnirmal_ has joined #openstack-dev | 21:54 | |
| ttx | this is all very confusing :) | 21:54 |
| dolphm | ttx: +1! | 21:54 |
| henrynash | guang: I still can't see what is missing for domain scoping | 21:54 |
| gyee | ha | 21:54 |
| *** rnirmal_ has quit IRC | 21:54 | |
| gyee | henrynash, domain-scoped token current have no domain roles | 21:55 |
| gyee | currently | 21:55 |
| ttx | dolphm: when 21487 ,lands I mark stop-ids-in-url, mfa, domain-name-spaces completed. | 21:55 |
| dolphm | henrynash: the API is done, but gyee left a bunch of TODO's for actually creating domain scoped tokens | 21:55 |
| zykes- | sad to see a cool feature not going in :( | 21:55 |
| topol | YorikSar, http://fpaste.org/rcnt/ | 21:55 |
| dolphm | henrynash: didn't domain-name-spaces already merge too? | 21:55 |
| henrynash | gyee: I've been looking at the code…and maybe you guys need to point me at the right bit..but there can't be much to do…and I wrote a helper function for that already | 21:55 |
| gyee | and (debatable) pluggable auth :) | 21:55 |
| ttx | dolphm: and i'll move pluggable-auth to rc1, granted an FFe | 21:56 |
| topol | YorkiSar, let me know if you need more | 21:56 |
| henrynash | dolphm: yes (on name spaces) | 21:56 |
| gyee | ttx ^ | 21:56 |
| dolphm | ttx: domain name spaces is merged | 21:56 |
| ttx | ok | 21:56 |
| *** digitalsanctum has quit IRC | 21:56 | |
| dolphm | ttx: and agree on everything else | 21:56 |
| henrynash | gyee, dolphm: let me finish up the domain scoping roles…we have done so much of it..I'll get that done asap tonight | 21:56 |
| gyee | henrynash, take a look at auth/token_factory.py | 21:57 |
| dolphm | gyee: how much work is left there ^ | 21:57 |
| * ttx fixes mfa | 21:57 | |
| gyee | I have a TODO for you | 21:57 |
| zykes- | ttx: mfa? | 21:57 |
| *** rnirmal_ has joined #openstack-dev | 21:57 | |
| dolphm | zykes-: multi-factor authentication | 21:57 |
| *** rnirmal has quit IRC | 21:57 | |
| *** rnirmal_ is now known as rnirmal | 21:57 | |
| zykes- | ah | 21:57 |
| *** Ryan_Lane has quit IRC | 21:57 | |
| dolphm | zykes-: https://blueprints.launchpad.net/keystone/+spec/multi-factor-authn | 21:57 |
| gyee | dolphm, henrynash, should be just populate the domain roles | 21:58 |
| gyee | and we're done | 21:58 |
| dolphm | gyee: oh. | 21:58 |
| gyee | if henrynash have the helper func, should be a two-liner fix, plus tests of course | 21:58 |
| dolphm | gyee: even tests should be a copy/paste of your tests | 21:58 |
| gyee | right | 21:59 |
| dolphm | gyee: s/project/domain | 21:59 |
| henrynash | gyee: so if that's all that needs doing, then we can get this in tonight | 21:59 |
| gyee | henrynahs, I have faith in you | 21:59 |
| dolphm | i'll volunteer to write tests | 21:59 |
| henrynash | gyee: :-) | 21:59 |
| gyee | count me in too | 21:59 |
| henrynash | gyee, let me just get the query filter in | 21:59 |
| dolphm | is there a bp for domain scoping? | 21:59 |
| ayoung | dolphm, should I pull the trigger on V3 Auth? | 21:59 |
| ttx | dolphm: ok, so now just get me another +2 on 21487 and I'll be off your back ;) | 21:59 |
| topol | YorikSar, maybe the problem is that for that user I did explicitly give it a role. Do I have to? | 21:59 |
| gyee | ayoung, pleeeease | 22:00 |
| dolphm | ayoung: you or henrynash should take another gander at it -- it's changed quite a bit in 24 hours | 22:00 |
| henrynash | dolphm: ok I have the query filter re-merged now, thanks | 22:00 |
| topol | YorikSar , errr I did not explicitly give it a role | 22:00 |
| ayoung | dolphm, 've been keeping up | 22:00 |
| dolphm | henrynash: awesome, does your own review look good to you? | 22:00 |
| YorikSar | topol: What change do you work on now? | 22:00 |
| dolphm | ayoung: well it's 4:01pm so we're past our deadline officially | 22:01 |
| ttx | ayoung: go for it :) | 22:01 |
| dolphm | or bedtime ttx-time | 22:01 |
| ayoung | ttx, one last look... | 22:01 |
| gyee | hold the horses :) | 22:01 |
| topol | YorikSar, Im not changing any keystone code. Just running devstack with a new capability to install and configure LDAP and set keystone to use the LDAP identity driver | 22:01 |
| *** lloydde has quit IRC | 22:01 | |
| ttx | dolphm: you won't get rid of me that easily | 22:01 |
| henrynash | dolphm: for the commit, I assume it will be a new commit , so should I do a git commit -a …and paste in the old commit id so it gets hooked to the same gift review (or will the cherry pick have a carried that with t) | 22:01 |
| YorikSar | topol: My wild guess is about the recent switch towards role-based project membership has something to do with this. | 22:02 |
| ayoung | FIRE IN THE HOLE! | 22:02 |
| dims | ayoung, LOL | 22:02 |
| ttx | the queue has been pretty aggressively stuffed anyway, so it won't land just now | 22:02 |
| gyee | w00t! | 22:02 |
| dolphm | henrynash: cherry-pick will carry the Change-Id around, but that would work too | 22:02 |
| ttx | dolphm, gyee, ayoung, henrynash: congrats guys, you made it | 22:03 |
| dolphm | ttx: i've been doing my part in not reviewing anything | 22:03 |
| ttx | dolphm: same here | 22:03 |
| ayoung | ttx, not yet I have't my change was queued up behind it | 22:03 |
| *** martine_ has quit IRC | 22:03 | |
| YorikSar | topol: Yes. Looks like the member_role has never been created in LDAP. | 22:03 |
| * dolphm falls asleep | 22:03 | |
| ttx | ayoung: your change ? | 22:03 |
| ayoung | ttx, Trusts | 22:03 |
| *** Ryan_Lane has joined #openstack-dev | 22:03 | |
| ttx | ayoung: oh, that's been granted an exception, so can wait a few days | 22:04 |
| ayoung | ttx, Trusts has gotten trampled by a heard of Yaks which are all now properly shaven | 22:04 |
| ttx | ayoung: was mostly concerned about what was NOT granted an exception yet | 22:04 |
| ayoung | ttx, yes, but that was my finish line | 22:04 |
| topol | YorikSar, I dont know where it got the role value anyway. I did not declare a role for that user that I know of. I just created a user and tried to add it to a tenant (project) | 22:04 |
| ayoung | topol, that was me | 22:04 |
| ayoung | members are gone! | 22:04 |
| *** shardy_afk is now known as shardy | 22:04 | |
| gyee | ttx, how come ayoung gets an exception? | 22:05 |
| dolphm | topol: yay! ayoung's patch worked | 22:05 |
| topol | ayoung, pottery barn rules: you break it, you bought it! | 22:05 |
| gyee | what's the address to send money? | 22:05 |
| *** Ryan_Lane has quit IRC | 22:05 | |
| ayoung | gyee, I have a bank account in the Caymens, I'll PM yoiu in tbox number | 22:05 |
| YorikSar | topol: New logic is instead of adding user's DN to tenant's groupOfNames, user is granted with role in this project. | 22:05 |
| dolphm | gyee: heckj begged ttx on ayoung's behalf | 22:06 |
| YorikSar | topol: You should look and member_role_id config value in Keystone and probably create this role before running tests... | 22:06 |
| dolphm | YorikSar: a data migration will create it automatically? (ayoung- but only if it's needed?) | 22:07 |
| YorikSar | ayoung: That's pretty strange, by the way. Before this change we never required user to create any objects in LDAP, only subtrees. | 22:07 |
| dolphm | s/automatically?/automatically/ | 22:07 |
| topol | YorikSar, so we can fix this without changing keystone code, correct? | 22:07 |
| YorikSar | topol: Yes, just add appropriate role. | 22:08 |
| *** Ryan_Lane has joined #openstack-dev | 22:08 | |
| YorikSar | topol: With id 9fe2ff9ee4384b1894a90878d3e92bab and name '_mamber_' | 22:08 |
| YorikSar | topol: *'_member_' | 22:09 |
| YorikSar | dolphm: Mb we should create this role automatically as well? | 22:09 |
| topol | YorikSar, ugh, so you are saying in the devstack keystone code we need to add this magic role? | 22:09 |
| dolphm | YorikSar: in ldap? | 22:09 |
| ayoung | henrynash, posted a new trusts patch with policy engaged. I larned me summat today. | 22:10 |
| YorikSar | topol, dolphm: yes, yes | 22:10 |
| topol | YorikSar, in LDAP? | 22:10 |
| henrynash | ayoung: ok | 22:10 |
| YorikSar | (packing/unpacking works in IRC as well as in Python, right?) | 22:10 |
| *** alexpilotti has quit IRC | 22:10 | |
| topol | YorikSar, just curiously how did we decide it would ALWAYS be 9fe2ff9ee4384b1894a90878d3e92bab | 22:10 |
| YorikSar | topol: Yes... Well, I guess, you can do it with API. | 22:11 |
| YorikSar | topol: Mb, it's the name of ayoung's cat ;) | 22:11 |
| YorikSar | topol: It's the default value for member_role_id config | 22:12 |
| topol | YorikSar, no wonder the cat never comes when he calls him | 22:12 |
| YorikSar | topol: What if it's encoded in some base42-ish encoding? | 22:12 |
| zykes- | is trusts landing for v3 ? | 22:12 |
| dolphm | zykes-: grizzly or v3? | 22:13 |
| henrynash | dolphm, gyee: sigh…so the query filter patch is re-posted….but while it is correct, it unfortunately appears to cinlude all Guang's changes…so you can't tell which are my updates. Damn. | 22:13 |
| topol | YorikSar, so I can add this but what about folks who run in production who dont use devstack. How are they expected to handle this? Always add the special role??? | 22:13 |
| henrynash | https://review.openstack.org/#/c/22223/ | 22:13 |
| zykes- | dolphm: ehm, G | 22:13 |
| YorikSar | topol: I don't know, btw, how is it handled in SQL backend | 22:13 |
| dolphm | henrynash: how'd you do that? lol | 22:13 |
| YorikSar | topol: I guess, we should do smth like that. | 22:14 |
| gyee | henrynash, you have a diff somewhere? | 22:14 |
| topol | YorikSar, dunno about SQL. Im the ldap guy | 22:14 |
| *** mdomsch has joined #openstack-dev | 22:14 | |
| YorikSar | topol: LDAP backend was created to mimic SQL backend behaviour at first, so we might continue do it and noone will notice :) | 22:15 |
| dolphm | henrynash: how close is your patchset 5 to where you want to be? | 22:15 |
| *** Tross has quit IRC | 22:15 | |
| YorikSar | topol: Crap... SQL has a migration for this. | 22:16 |
| henrynash | dolphm: so, I could certainly re-apply my changes to a "clean" patch set 5 | 22:16 |
| dolphm | henrynash: let me get you to that point then | 22:16 |
| henrynash | dolphm: ok | 22:16 |
| dolphm | henrynash: i'm going to push a review *with* a merge conflict included, and let you resolve | 22:16 |
| *** boden has quit IRC | 22:16 | |
| henrynash | dolphm: and the v3 auth is on it's way to be merged anyway, yes? | 22:17 |
| henrynash | dolphm: fine by me | 22:17 |
| YorikSar | topol: We have smth around two or three options here: | 22:17 |
| dolphm | henrynash: https://review.openstack.org/#/c/22223/ | 22:17 |
| ayoung | YorikSar, I have not Cat. I am a dog person, but for now, I have two kids under 7 and that is enough work for me, | 22:17 |
| dolphm | henrynash: copy/paste the checkout command provided by gerrit | 22:17 |
| dolphm | henrynash: v3 auth is gating now | 22:17 |
| ayoung | topol, uuid-gen | 22:18 |
| *** openstackjenkins has quit IRC | 22:18 | |
| YorikSar | topol: * let deployers add this role (the'll be sad) | 22:18 |
| YorikSar | topol: * let backends deal with this (just like SQL does) | 22:18 |
| *** AlanClark__ has quit IRC | 22:18 | |
| YorikSar | topol: * deal with this on the higher level | 22:18 |
| *** openstackjenkins has joined #openstack-dev | 22:18 | |
| *** AlanClark__ has joined #openstack-dev | 22:18 | |
| *** Ryan_Lane has quit IRC | 22:18 | |
| gyee | dolphm, henrynash, 22223 doesn't seem to have any overlap with the token API patch | 22:18 |
| *** vuntz has quit IRC | 22:19 | |
| YorikSar | ayoung: So which one of them do you call 9fe2ff9ee4384b1894a90878d3e92bab? :) | 22:19 |
| *** openstackjenkins has quit IRC | 22:19 | |
| dolphm | gyee: conflict in keystone/common/controller.py -- may or may not be against your patch | 22:19 |
| YorikSar | ayoung: j/k | 22:19 |
| YorikSar | ayoung: Can you help us with our options? | 22:19 |
| dolphm | ayoung: should just rename the ID to 'member' lol | 22:19 |
| *** openstackjenkins has joined #openstack-dev | 22:20 | |
| gyee | dolphm, common/controller.py conflicts doesn't appear to coming from mine | 22:20 |
| topol | ayoung, the backend ldap driver code is still shoving users in under tenants. Is that now a bug. The new role patch I must admit I dont fully understand yet | 22:21 |
| *** amerine has quit IRC | 22:22 | |
| henrynash | dolphm: ok, got myself the patch 7 in detached head state (and just to make sure I do this right), i should git checkout -b mybranchname, and then make my changes, and then I can commit and git review of that branch? | 22:22 |
| topol | K, in 10 mins I drop my daughter off for a sleepover. And with my wife and son on a trip in FL I get to spend all night with this crowd :-) | 22:23 |
| dolphm | gyee: crap, either i sent you a bad diff you made a bad merge | 22:23 |
| *** vuntz has joined #openstack-dev | 22:23 | |
| *** cschwede has quit IRC | 22:23 | |
| YorikSar | topol: Have a nice one! :) | 22:24 |
| dolphm | gyee: https://review.openstack.org/#/c/22491/ | 22:24 |
| dolphm | henrynash: you don't *need* to make a branch if you don't want to (personally i wouldn't unless you need to stop and go do something else, or you're writing several patches in sequence) | 22:25 |
| dolphm | henrynash: all you really need to do is make changes and then git commit --amend | 22:25 |
| henrynash | ok, can do | 22:25 |
| *** amerine has joined #openstack-dev | 22:25 | |
| *** ladquin1 has joined #openstack-dev | 22:26 | |
| *** epim has quit IRC | 22:26 | |
| topol | YorikSar, so in devstack I will need to read member_role_id and member_role_name out of keystone.conf.sample and then use those values since they are configurable and then create the role | 22:26 |
| henrynash | dolphm: although actually I need to switch to other branches to cope and paste some code out, so might have to create a branch (since I can't checkout any other branch in this state) | 22:27 |
| topol | YorikSar, or I can just hard code them and update keystone.conf since I update values in it anyway | 22:27 |
| YorikSar | topol: I guess, you can use the default once for now... | 22:28 |
| *** hemnafk is now known as hemna | 22:28 | |
| BLZbubba | is there a way to have the horizon instances page not DDOS my api server? | 22:29 |
| *** epim has joined #openstack-dev | 22:29 | |
| *** ladquin has quit IRC | 22:29 | |
| BLZbubba | i.e. if i have 150 nodes, it is updating their status with ajax way way too often | 22:29 |
| *** ladquin1 is now known as ladquin | 22:30 | |
| gyee | dolphm, nice catch | 22:30 |
| BLZbubba | i am improving the hardware and such too, but slowing down the update frequency would help quite a bit too | 22:30 |
| topol | YorikSar, I'll be back in 25 mins. But I think I can proceed. Thanks for helping me figure out the mystery role | 22:30 |
| YorikSar | topol: I'll create draft change request with my proposal for this. | 22:31 |
| *** eharney has joined #openstack-dev | 22:31 | |
| *** eharney has quit IRC | 22:31 | |
| *** eharney has joined #openstack-dev | 22:31 | |
| topol | YorikSar, you mean for how folks in production should address this? | 22:31 |
| *** Ryan_Lane has joined #openstack-dev | 22:32 | |
| YorikSar | topol: No, I suggest we handle this in core. | 22:32 |
| topol | YorikSar, you saying I wont have to add this to devstack? | 22:32 |
| *** annegentle has quit IRC | 22:33 | |
| topol | YorikSar, if its fixed in core then no changes to devstack | 22:33 |
| topol | YorikSar, basically where it throws the no role exception in core just have the code add the default role? | 22:34 |
| YorikSar | topol: https://review.openstack.org/22493 | 22:34 |
| dolphm | gyee: i just got a domain scoped token back without having a role on the domain | 22:35 |
| YorikSar | ayoung, dolphm: what do you think about this? | 22:35 |
| gyee | dolphm, that's the missing part | 22:35 |
| dolphm | gyee: i don't have a role grant on the domain | 22:35 |
| gyee | henrynash will hook that up later today | 22:35 |
| topol | YorikSar, getting a page not found on that URL. Ill be back soon | 22:36 |
| henrynash | gyee: sure thing | 22:36 |
| dolphm | gyee: i'm saying it's returning me a token that i should not be allowed to get | 22:36 |
| gyee | dolphm, correct, right now I don't check for domain roles | 22:36 |
| dolphm | gyee: okay, so this isn't just a bug it'd a security vulnerability if we let it go | 22:37 |
| dolphm | (and were using domain scoped tokens for something) | 22:37 |
| gyee | not a security vul if user have no roles | 22:37 |
| YorikSar | topol: Oh.. Looks like drafts are hidden. | 22:37 |
| *** buzztroll_ has quit IRC | 22:37 | |
| YorikSar | fixed that. | 22:37 |
| dolphm | gyee: this is the real police badge with no badge number example | 22:37 |
| gyee | dolphm, what can one do without any roles? | 22:38 |
| dolphm | gyee: why can i get a domain-scoped token without authz on the domain? | 22:38 |
| dolphm | gyee: it doesn't do this for projects does it? | 22:38 |
| gyee | dolphm, it doesn't, once henrynash hookup the domain roles, we should be good to go | 22:39 |
| *** hugokuo has joined #openstack-dev | 22:39 | |
| gyee | our policy engine should act on roles or we have a real problem | 22:40 |
| *** rj___ has joined #openstack-dev | 22:40 | |
| gyee | henrynash, is your helper func in master already | 22:41 |
| *** nsatterl_ has joined #openstack-dev | 22:41 | |
| gyee | I might as well finish it up for you | 22:41 |
| henrynash | gyee: have to go look... | 22:41 |
| vishy | danwent: ping | 22:43 |
| gyee | henrynash, I don't see get_roles_for_user_and_domain() in identity controller | 22:43 |
| danwent | vishy: hey | 22:44 |
| dolphm | gyee: wrote a test to request a token for a project i don't have any roles on ... raised a 401 as expected | 22:44 |
| henrynash | gyee: let me find what I wrote! | 22:44 |
| vishy | danwent: was wondering about how important https://bugs.launchpad.net/nova/+bug/1039665 is | 22:44 |
| uvirtbot | Launchpad bug 1039665 in nova "Creating quantum L2 networks (without subnets) doesn't work as expected" [High,In progress] | 22:44 |
| danwent | vishy: looking | 22:45 |
| gyee | dolphm, I am going to hookup domain roles | 22:45 |
| dolphm | gyee: i've got tests 80% done, so i'll just attach those to your patch, unless you want to do tdd | 22:45 |
| *** jaypipes has quit IRC | 22:45 | |
| gyee | dolphm, we can add the changes to your review | 22:46 |
| gyee | probably easier | 22:46 |
| gyee | gimme a few minutes | 22:46 |
| *** datsun180b has quit IRC | 22:46 | |
| danwent | vishy: its certainly not a core use can that I see. I think it was that the libvirt xml generation code always assumed a vif had an IP. | 22:47 |
| vishy | danwent: so there is a a patch in review that will probably fix it | 22:48 |
| vishy | but | 22:48 |
| vishy | it is kind of risky since it refactors a bunch | 22:48 |
| *** pcm_ has quit IRC | 22:48 | |
| openstackgerrit | A change was merged to openstack/cinder: Add HUAWEI volume driver in Cinder https://review.openstack.org/21100 | 22:48 |
| vishy | so we are planning on punting it to H | 22:48 |
| danwent | vishy: i'm ok with with that. | 22:48 |
| vishy | danwent: do you think that will cause problems? | 22:48 |
| vishy | danwent: I mean you can't do l2-only networks | 22:49 |
| henrynash | gyee: hmm, I can see the low level support funcs, not the higher ones | 22:49 |
| danwent | vishy: i don't really know what the use case ian was going to as to why they were booting VMs that didn't get IPs. | 22:49 |
| henrynash | gyee: here's what we need to do: | 22:49 |
| zykes- | won't be L2 needed danwent ? | 22:49 |
| danwent | vishy: I think it is also only applies to using linux bridge, and I think the cisco folks have moved on to using OVS, though perhaps not all | 22:50 |
| ayoung | YorikSar, I originally had code that did just that. I think I am ok with it. | 22:50 |
| vishy | danwent: ok cool, going to punt it to H then | 22:50 |
| *** alexpilotti has joined #openstack-dev | 22:50 | |
| ayoung | YorikSar, the thing is, add_user_to_project should be deprecated any way | 22:50 |
| danwent | vishy: the mere fact that it went all the way from the end of folsom to now without being fixed is a pretty good indicator that it can't be that important | 22:50 |
| henrynash | gyee: 3 funds in the backend; get_roles_for_user_and_project, _get_user_project_roles, _get_user_group_project_roles…we just create domain versions of them…the underlying funds they call all can take domain_id in place of project_id | 22:51 |
| ayoung | YorikSar, 9fe2ff9ee4384b1894a90878d3e92bab is my older son. The younger guy is 6b4a8c88-8510-4636-ba13-1c54b92342d7 | 22:51 |
| gyee | henrynash, that's what I am about to do | 22:52 |
| *** CaptTofu_ has quit IRC | 22:52 | |
| gyee | a bit more work than I thought | 22:52 |
| *** maoy has quit IRC | 22:52 | |
| henrynash | gyee: i.e. the calls to get_metadata all toake domain id in place of project id | 22:52 |
| dolphm | gyee: authenticating with user_domain_name instead of user_domain_id doesn't work | 22:53 |
| YorikSar | ayoung: I guess, we can inline it where it's used then. And this check can be added to create_user only, update_user should not need it. | 22:54 |
| ayoung | YorikSar, sar, no I think it is Ok. THe thing is, SQL has the migration path, but LDAP does not | 22:54 |
| YorikSar | ayoung: So the younger one already follows fashion trends and has dashes in his name. | 22:54 |
| ayoung | so with LDAP, we kindof need to lazy add it. | 22:55 |
| YorikSar | ayoung: Well, we either have to add smth like this migration to all backends or remove this from SQL migration and let core deal with it. | 22:55 |
| ayoung | YorikSar, this is so a user can have membership in a default project? | 22:55 |
| ayoung | YorikSar, I'm almost thinking it should got into add_role_to_user | 22:56 |
| *** alexpilotti has quit IRC | 22:56 | |
| ayoung | add_role_to_user_and_project( | 22:57 |
| YorikSar | ayoung: I'm not sure if this 'default tenant' thing is still useful... | 22:57 |
| ayoung | YorikSar, vestige | 22:57 |
| YorikSar | ayoung: It was used in diablo, I guess. | 22:58 |
| *** davidkranz has quit IRC | 22:58 | |
| YorikSar | ayoung: Mb we should get rid of it then? | 22:58 |
| *** alunduil has quit IRC | 22:59 | |
| ayoung | YorikSar, yeah, but not 24 hours after code freeze. | 22:59 |
| *** davidkranz has joined #openstack-dev | 22:59 | |
| YorikSar | ayoung: Right. | 22:59 |
| ayoung | YorikSar, We don't even have a way to automate setting up LDAP as part of core Keystone. I am almost tempted to punt this one off to LDAP admins. | 22:59 |
| ayoung | YorikSar, cuz migration is going to be broken there, too | 23:00 |
| *** jcmartin has joined #openstack-dev | 23:00 | |
| YorikSar | ayoung: And what about KVS backend? It doesn't have migrations too. | 23:00 |
| ayoung | we are going to need a LDAP migrate tool that does the same thing as the SQL one | 23:00 |
| ayoung | KVS is for testing only | 23:00 |
| ayoung | It doesn't survive a reboot, hardly enterprise ready | 23:00 |
| YorikSar | ayoung: Oh, ok. I never actually looked into what it actually is. | 23:01 |
| ayoung | YorikSar, OK, I think we need a migrate tool for LDAP. It will have to take the members elements of each tenant and create a roleAssignment for them | 23:02 |
| *** alexpilotti has joined #openstack-dev | 23:02 | |
| *** alexpilotti has quit IRC | 23:02 | |
| YorikSar | ayoung: The problem with LDAP is... It can be mostly read-only sometimes. | 23:02 |
| ayoung | Care to take a first hack at it? | 23:02 |
| ayoung | YorikSar, that is a different conversation | 23:02 |
| ayoung | this is for the LDAP backend that we manage | 23:02 |
| *** timello_ has quit IRC | 23:03 | |
| *** fc___ has joined #openstack-dev | 23:03 | |
| *** timello has joined #openstack-dev | 23:03 | |
| *** fc__ has quit IRC | 23:03 | |
| *** fc___ is now known as fc__ | 23:03 | |
| YorikSar | ayoung: I mean, we deployed several projects with LDAP backend and almost all of them required r/o access to LDAP. | 23:03 |
| ayoung | YorikSar, so, lets hold off on https://review.openstack.org/#/c/22493/ | 23:03 |
| henrynash | dolphm, young, gyee: OK, query filter patch finally back in shape and ready for review: https://review.openstack.org/#/c/22223/ | 23:03 |
| *** sandywalsh has quit IRC | 23:03 | |
| ayoung | YorikSar, I know, I know. Different bridge to burn | 23:04 |
| YorikSar | ayoung: Yes, sure, that change is just a draft to show my proposal. | 23:04 |
| ayoung | henrynash, wow, I understand that so much better than I did before today | 23:04 |
| *** bencherian has quit IRC | 23:05 | |
| ayoung | YorikSar, can you code up the migration script? It needs to read the appropriate values out of the config file | 23:05 |
| henrynash | ayoung: :-) life's a learning curve…just worry when it flattens out | 23:05 |
| YorikSar | ayoung: Yes. I guess, it can run at db_sync. | 23:05 |
| ayoung | YorikSar, yep | 23:06 |
| *** kbringard has quit IRC | 23:06 | |
| ayoung | henrynash, is it possible to do that without a separate @ttribute? | 23:06 |
| YorikSar | ayoung: But I'll do it some time in the morning. 3am here, bad time to start something new. | 23:06 |
| henrynash | young; you mean, onlyhave one @protection wrapper that can optionally take a list of filter attributes? | 23:07 |
| gyee | henrynash, no add_role_to_user_and_domain? | 23:07 |
| ayoung | Heh. YorikSar that is fine. We can always do it as a stand along script if needs be | 23:07 |
| *** bencherian has joined #openstack-dev | 23:07 | |
| ayoung | get some rest. | 23:07 |
| ayoung | henrynash, yeah. Look at this.... | 23:07 |
| henrynash | gyee: they're all create_grant | 23:07 |
| ayoung | https://review.openstack.org/#/c/20289/18/keystone/common/controller.py | 23:08 |
| henrynash | gyee: all the v3 roles should really be using create/delete/check grnat | 23:08 |
| ayoung | henrynash, see how I flatten the dictionary? Could we do something similar? | 23:08 |
| *** openstackjenkins has quit IRC | 23:09 | |
| *** openstackjenkins has joined #openstack-dev | 23:09 | |
| *** armaan1 has quit IRC | 23:09 | |
| ayoung | henrynash, I'd like to keep an eye toward pushing our policy changes to common, and the more consistent we are, the easier t is going to be to do that. | 23:10 |
| *** flaper87 has quit IRC | 23:10 | |
| henrynash | gyee: which in itself might be an issue in the policy file (dolphm and I discussed before) as to whether having a common policy file enter for creating both domain and project is desirable | 23:10 |
| henrynash | ayoung: +1 to that | 23:10 |
| *** tomoe_ has quit IRC | 23:13 | |
| *** tomoe_ has joined #openstack-dev | 23:13 | |
| *** jergerber has joined #openstack-dev | 23:15 | |
| *** cloudchimp has quit IRC | 23:15 | |
| *** rj___ has quit IRC | 23:18 | |
| henrynash | ayoung: so do you think it is safe to flatten every object…just wondering if we might get odd clashes, like if someone had user_id in their object and we also bout the user_id of the caller in the target already | 23:19 |
| *** john5223 has quit IRC | 23:19 | |
| *** jog0 has quit IRC | 23:21 | |
| *** jog0 has joined #openstack-dev | 23:22 | |
| *** sacharya has quit IRC | 23:23 | |
| *** jergerber has quit IRC | 23:23 | |
| *** mjfork has quit IRC | 23:25 | |
| *** crandquist has quit IRC | 23:26 | |
| *** AlanClark__ has quit IRC | 23:26 | |
| *** AlanClark__ has joined #openstack-dev | 23:26 | |
| *** dachary has quit IRC | 23:27 | |
| *** asalkeld has quit IRC | 23:29 | |
| *** yamahata has joined #openstack-dev | 23:31 | |
| *** soody has joined #openstack-dev | 23:32 | |
| topol | im back | 23:33 |
| henrynash | ayoung: Ok, I think I take it back, I don;t think they would clash…oe set is in the creds, one in the target (unsurprisingly) | 23:34 |
| *** sthaha has joined #openstack-dev | 23:35 | |
| *** dims has quit IRC | 23:36 | |
| *** monst_ has quit IRC | 23:36 | |
| topol | YorikSar, draft looks good. But if an LDAP is read-only and was some how mapping to existing roles (not sure if this is a real use case) we break, correct | 23:36 |
| *** mtreinish has quit IRC | 23:37 | |
| topol | But in any case can we get your draft in still? | 23:37 |
| YorikSar | topol: I'll write a migration for LDAP backend tomorrow that'll create this role and move all members of all tenants to it. | 23:38 |
| dolphm | gyee: henrynash: is there a bug number or something for domain-scoped tokens? | 23:38 |
| YorikSar | topol: So keystone-migrate db_sync will solve this. | 23:38 |
| gyee | dolphm, no, I am almost done with my changes | 23:39 |
| topol | YorikSar, for the ldap backend as well? | 23:39 |
| dolphm | gyee: i have 6 failing tests for you :) | 23:39 |
| henrynash | there was blueprint: bp/domain-scoping | 23:39 |
| YorikSar | topol: Yes. | 23:39 |
| topol | YorikSar, just curiously how does it help the ldap case. keystone-migrate db_syn is not just for the sql backend? | 23:40 |
| gyee | brb | 23:40 |
| *** gyee has quit IRC | 23:40 | |
| *** pabelanger has joined #openstack-dev | 23:40 | |
| topol | YorikSar, but I trust you. you found the role named after ayoungs dog. That was quite find :-) | 23:41 |
| dolphm | henrynash: gyee: https://review.openstack.org/#/c/22497/ | 23:41 |
| YorikSar | topol: It calls db_sync if every backend for all Keystone parts if it supports it. | 23:41 |
| topol | YorikSar, wonderful. do I need to +1 your draft or not necessary? | 23:42 |
| *** dwalleck has joined #openstack-dev | 23:42 | |
| YorikSar | topol: No, it was just to show what I meant here. I'll abandon it | 23:43 |
| *** asalkeld has joined #openstack-dev | 23:43 | |
| *** rnirmal has quit IRC | 23:43 | |
| *** woodspa has quit IRC | 23:43 | |
| topol | YorikSar, k thanks! I'm going to manually add the magic role and continue testing | 23:43 |
| YorikSar | topol: Have fun! I'll be going to bed, so will be able to help tomorrow. | 23:44 |
| henrynash | dolphm: nice | 23:44 |
| *** mrodden has quit IRC | 23:45 | |
| topol | YorikSar. good night. Thanks again for the help! | 23:45 |
| henrynash | dolphm: the query filter patch is (finally!) up: https://review.openstack.org/#/c/22223/ | 23:45 |
| henrynash | dolphm: thx for your help on that. btw | 23:45 |
| *** shardy is now known as shardy_afk | 23:46 | |
| henrynash | ayoung: what do we need to do to get the Trusts complete….. | 23:46 |
| *** dontalton has quit IRC | 23:46 | |
| *** eharney has quit IRC | 23:47 | |
| henrynash | as an aside, the zuul check queue looks in an odd (and static) state | 23:47 |
| *** gyee has joined #openstack-dev | 23:48 | |
| *** crandquist has joined #openstack-dev | 23:48 | |
| *** jimfehlig has quit IRC | 23:48 | |
| ayoung | henrynash, zuul is slow, but probably not staic | 23:49 |
| *** markvoelker has joined #openstack-dev | 23:49 | |
| *** pabelanger has quit IRC | 23:49 | |
| ayoung | henrynash, I was planning on trusts being v2 only, but with v3 auth going in...it might be worth it to make it work for both. The API doc has been fairly combed over and, if therer are content issues there, I'll have to re check the comments to find out exactly what they are. I think we are good, but dolphm is much more thorough and excting than I am on that front | 23:50 |
| *** NobodyCam has joined #openstack-dev | 23:51 | |
| ayoung | YorikSar, note also that the id and name for the member role are configurable, and, for LDAP, you might want to use an existing role. | 23:51 |
| gyee | dolphm, henrynash, http://paste.openstack.org/show/32136/ | 23:52 |
| ayoung | henrynash, when I flattened, I chose to go with the dot notation, which should be clean. the underscore approach would certainly clash. | 23:52 |
| *** markvoelker2 has quit IRC | 23:52 | |
| *** dims has joined #openstack-dev | 23:52 | |
| henrynash | ayoung: ah, right, nice | 23:53 |
| ayoung | henrynash, the thing is, the Trusts patch hasn't gotten raked over the coals yet. THe focus has been on the API docs patch. I think that is mature enough that it can be used to review the code, though | 23:53 |
| henrynash | ayoung: are we trying got Grizzly on it, still? | 23:54 |
| ayoung | henrynash, I'm going to do a separate doc patch for the V2 changes, unless dolphm comes back and says that trusts should absolutely be V2 only. | 23:54 |
| henrynash | ayoung: (wasn't meant to suggest we weren't !) | 23:55 |
| ayoung | henrynash, for trusts? Yes, I got permission for a slight late submission. | 23:55 |
| henrynash | ayoung: excellemt! | 23:55 |
| ayoung | but obviously, energy has been focuses on V3 auth API first, | 23:55 |
| *** dolphm has quit IRC | 23:56 | |
| gyee | ayoung, we'll help you to get the trust API in, we have real use cases out there | 23:56 |
| ayoung | henrynash, I'm going to have dsinner etc, and then go back through the doc comments and see which still need to be addressed. Aside from V2 API, which will be in a different doc, I thought I had hit everything | 23:56 |
| henrynash | ayoung: ok | 23:56 |
| ayoung | gyee, ok, so I think that the unit tests need to be cleaned up. | 23:57 |
| ayoung | THat is not make or break on the patch, as they are just doing things custom that should be using the v3_test code instead | 23:57 |
| topol | ayoung, before you go is it possible to use the keystone client to create a role and to be able to specify what the roleId should be | 23:57 |
| gyee | sure, we can line them up | 23:57 |
| ayoung | topol, I don't think so | 23:58 |
| ayoung | topol, let me look | 23:58 |
| ayoung | topol, the very first thing it does is creates a unique id, | 23:58 |
| topol | ayoung, so how would one add the special role if it doesnt exist? | 23:58 |
| ayoung | topol, look in keystone/identity/controllers.py | 23:59 |
| ayoung | topol, it would have to be direct to LDAP | 23:59 |
| topol | ayoung, Oh, OK | 23:59 |
| ayoung | topol, also, if the migrate code were executed it could bypass the controller | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!