| *** ladquin1 has joined #openstack-dev | 00:00 | |
| dolphm | ttx: https://review.openstack.org/#/c/24944/ | 00:01 |
|---|---|---|
| *** jaybuff has left #openstack-dev | 00:01 | |
| *** ladquin has quit IRC | 00:01 | |
| termie | dolphm: emailed you about trusts | 00:01 |
| dolphm | termie: rip it for grizzly? | 00:02 |
| *** alop has quit IRC | 00:02 | |
| *** ladquin2 has joined #openstack-dev | 00:02 | |
| *** amerine has joined #openstack-dev | 00:03 | |
| termie | dolphm: out of core, yeah | 00:04 |
| *** ladquin2 has quit IRC | 00:04 | |
| dolphm | termie: are you opposed to the api, impl, or both? | 00:04 |
| *** capnkooc has joined #openstack-dev | 00:04 | |
| termie | dolphm: both | 00:04 |
| termie | dolphm: the api i feel should not touch core because it doesn't need to | 00:04 |
| *** Nachi has joined #openstack-dev | 00:05 | |
| *** nati_ueno has quit IRC | 00:05 | |
| termie | dolphm: the impl would be better served by oauth IMO, i'm at this point willing to implement that as a counter example extension | 00:05 |
| *** ladquin1 has quit IRC | 00:05 | |
| *** markmcclain has joined #openstack-dev | 00:06 | |
| termie | dolphm: gotta go graba snack so i don't die | 00:07 |
| dolphm | termie: erm, grizzly version bump is gating at this moment -- should i stop it? do you already have a rip-it-out patch? | 00:07 |
| termie | dolphm: can paste you a bunch of scrollback after i get back | 00:07 |
| termie | dolphm: i do not, originally ayoung was going to do it but then he waffeld on his decision :p | 00:07 |
| *** zbitter has joined #openstack-dev | 00:07 | |
| dolphm | termie: yeah, that's a massive change very late in the game | 00:07 |
| termie | dolphm: it is going to be technical debt forever if it goes into core | 00:08 |
| dolphm | termie: it's certainly possible -- but wish we could have had this discussion like a month ago | 00:08 |
| *** ladquin has joined #openstack-dev | 00:08 | |
| *** colinmcnamara has joined #openstack-dev | 00:08 | |
| termie | dolphm: well it started a week or more ago | 00:08 |
| *** kikonio has joined #openstack-dev | 00:08 | |
| termie | dolphm: somebody is waiting on me for sandwich getting | 00:08 |
| *** colinmcnamara has quit IRC | 00:08 | |
| dolphm | termie: gate is stopped, i'll be around | 00:08 |
| termie | dolphm: i will return shortly however if that long can be waited | 00:08 |
| *** egallen has quit IRC | 00:09 | |
| *** zaneb has quit IRC | 00:10 | |
| *** sthaha has joined #openstack-dev | 00:11 | |
| *** mestery has quit IRC | 00:11 | |
| *** ladquin has quit IRC | 00:12 | |
| *** ladquin has joined #openstack-dev | 00:13 | |
| *** ladquin has quit IRC | 00:15 | |
| *** tomoe_ has joined #openstack-dev | 00:16 | |
| *** gyee has quit IRC | 00:16 | |
| *** matiu has joined #openstack-dev | 00:17 | |
| *** ladquin has joined #openstack-dev | 00:19 | |
| *** colinmcnamara has joined #openstack-dev | 00:19 | |
| *** kikonio has quit IRC | 00:21 | |
| *** yamahata_ has quit IRC | 00:21 | |
| *** Gordonz has quit IRC | 00:21 | |
| *** jhesketh has quit IRC | 00:22 | |
| *** colinmcnamara has quit IRC | 00:22 | |
| *** gyee has joined #openstack-dev | 00:22 | |
| dolphm | termie: https://review.openstack.org/#/c/24952/ | 00:22 |
| *** ladquin has quit IRC | 00:23 | |
| *** gyee has quit IRC | 00:23 | |
| *** kikonio has joined #openstack-dev | 00:23 | |
| *** ladquin has joined #openstack-dev | 00:23 | |
| *** kikonio has quit IRC | 00:25 | |
| *** kikonio has joined #openstack-dev | 00:25 | |
| *** ladquin has quit IRC | 00:27 | |
| *** ladquin has joined #openstack-dev | 00:29 | |
| *** lmatter has joined #openstack-dev | 00:30 | |
| *** AlanClark has quit IRC | 00:30 | |
| *** AlanClark has joined #openstack-dev | 00:30 | |
| *** kikonio has quit IRC | 00:30 | |
| *** jcmartin has quit IRC | 00:32 | |
| openstackgerrit | A change was merged to openstack/quantum: Fix typo in policy.json and checks in nicira plugin https://review.openstack.org/24494 | 00:33 |
| *** ladquin has left #openstack-dev | 00:33 | |
| *** jhesketh has joined #openstack-dev | 00:35 | |
| *** markwash has quit IRC | 00:36 | |
| openstackgerrit | A change was merged to openstack/keystone: Enable emulation for domains https://review.openstack.org/24936 | 00:38 |
| *** jcmartin has joined #openstack-dev | 00:39 | |
| *** vipul is now known as vipul|away | 00:40 | |
| *** anteaya has left #openstack-dev | 00:45 | |
| *** esp has quit IRC | 00:45 | |
| *** AlanClark has quit IRC | 00:45 | |
| *** dolphm has quit IRC | 00:46 | |
| *** dolphm has joined #openstack-dev | 00:51 | |
| dolphm | termie: o/ | 00:51 |
| ayoung | dolphm, termie I never waffled. I was waiting to be pursuaded | 00:53 |
| dolphm | ayoung: lol, i opened a patch to make trusts optional if we want to be noncommittal about it | 00:54 |
| ayoung | dolphm, we had a pretty full discussion here. | 00:54 |
| ayoung | dolphm, is it part of the V3 API or isn't it? Is it something we are going to support or not? | 00:55 |
| ayoung | Disabling it is probably fine, especially as it is a new feature, and that gives us a kill switch if there is a problem | 00:55 |
| termie | hola | 00:55 |
| ayoung | But that is not what he is saying. | 00:55 |
| *** soody has quit IRC | 00:56 | |
| termie | ayoung: the conversation we had before had seemed to end with "okay, i'll make it an extension after i submit this patch" | 00:56 |
| termie | ayoung: is where the "waffled" came in ;) | 00:56 |
| ayoung | termie, no, I never meant that, sorry if I gave that imporession. | 00:56 |
| ayoung | I said that I had to deal with the patch before I could even think clearly about it | 00:56 |
| *** maoy has joined #openstack-dev | 00:57 | |
| ayoung | So, three things | 00:57 |
| *** vipul|away is now known as vipul | 00:57 | |
| ayoung | 1. should Trust CRUD be in core or extensions. | 00:57 |
| *** mrodden has quit IRC | 00:57 | |
| termie | ayoung, dolphm: i think makign it disabled in the current code would be the minimal step so that people don't use it before it gets modified | 00:57 |
| termie | ayoung, dolphm: and would scare ttx significantly less | 00:57 |
| dolphm | ayoung: it should either all stay or go together | 00:57 |
| ayoung | 2. Should Creating a token from a trust be in /tokens or under extensions | 00:57 |
| ayoung | and 3 should the default delegation mechanism be oauth | 00:57 |
| dolphm | termie: +1 that's my goal | 00:58 |
| dolphm | never scare ttx | 00:58 |
| *** Nachi has quit IRC | 00:58 | |
| dolphm | disabling it out of the box means we can say its a tech preview type thing, and then we can pull the API out of identity-api and doc it separately, and revise it ground up if need be | 00:58 |
| termie | dolphm: that would be enough to keep me happy and from having to stay up for the next two days | 00:58 |
| dolphm | termie: awesome | 00:59 |
| termie | dolphm: i'll then be able to produce an oauth'd example and convince ayoung to help pull the trusts stuff out | 00:59 |
| ayoung | dolphm, so can people then use it? | 00:59 |
| *** lmatter has quit IRC | 00:59 | |
| ayoung | dolphm, oauth won' | 00:59 |
| dolphm | ayoung: sure, you just have to manually set keystone.conf [trust] enabled = True | 00:59 |
| ayoung | t be there until Havana | 00:59 |
| termie | if we want to decide to pull things out at this time (pulling them out after release or whatever, but decide to do it) i am okay with that htough | 00:59 |
| ayoung | dolphm, but we are telling them that we are planning on yanking it | 01:00 |
| ayoung | maybe | 01:00 |
| dolphm | ayoung: yes | 01:00 |
| ayoung | There are people counting on delegation | 01:00 |
| dolphm | ayoung: it's a "this is a beta feature and may significantly change before it's stable" type thing | 01:00 |
| dolphm | ayoung: they'll just have to understand that the api & behavior may change radically between grizzly and havana | 01:01 |
| *** ewindisch has quit IRC | 01:01 | |
| *** salv-orlando has quit IRC | 01:01 | |
| ayoung | dolphm, how about this | 01:01 |
| ayoung | we move the URL to /extensions for the CRUD | 01:01 |
| ayoung | indicating that the contract for that may change | 01:02 |
| dolphm | /extensions is for listing extensions | 01:02 |
| dolphm | ayoung: a proper extension is just as stable and supported as core | 01:02 |
| ayoung | dolphm, so isn't this what we have the API versioning for, then? | 01:03 |
| ayoung | If it changes in Havana. it is no longer /v3 | 01:03 |
| *** nati_ueno has joined #openstack-dev | 01:04 | |
| ayoung | dolphm, so termie makes some good points. However, either we are going to support it or we are not. I am OK with the Kill switch as a safety override, but I am not OK with saying no supported delegation mechanism | 01:04 |
| ayoung | I am OK with oauth support coming in Havana and deprecating trusts | 01:04 |
| ayoung | Although I don't know that it really is an improvement, I'll defer to people that have more vested in it, so long as we have the same functionality | 01:05 |
| *** CaptTofu has joined #openstack-dev | 01:06 | |
| *** roampune_ has quit IRC | 01:07 | |
| ayoung | dolphm, it is my understanding of oauth that it is a superset of the functionality of trusts. It would need a persistence layer, and thus the CRUD API would still apply | 01:07 |
| *** jamielennox has joined #openstack-dev | 01:08 | |
| *** stevemar has joined #openstack-dev | 01:08 | |
| ayoung | albeit, the normal approach to creating a delegation agreement in oauth seems to be initiated by the service requesting the trust as opposed to the user. Both approaches would fit in the same data model. | 01:08 |
| dolphm | ayoung: unless we find a huge problem with v3.0, havana should be v3.1, be backwards compatible with v3.0, and live on the same endpoint /v3/ | 01:08 |
| ayoung | dolphm, and the trusts mechanism would be deprecated | 01:09 |
| ayoung | if we decided to do so | 01:09 |
| dolphm | ayoung: i'm not sure we have precedence for deprecating a portion of an api -- that would require a major version bump as you're introducing a major backwards incompatibility | 01:09 |
| ayoung | Either we are going to support it in Grizzly or not. We can, of course, provide a mechnism for the users to discover if it is enabled. | 01:09 |
| ayoung | dolphm, It would get removed in 4, then | 01:10 |
| ayoung | Whenver we decide to to that | 01:10 |
| ayoung | deprecating in a minor version is OK, so long as it is not removed | 01:10 |
| *** sirushti has joined #openstack-dev | 01:11 | |
| dolphm | ayoung: i disagree completely, as the minor version is not exposed to the end user | 01:11 |
| ayoung | I suspect, though, the there would be no reason to do so, as the oauth API and the trust API would be complementary. Perhaps there would be some overlap, but I am not sure that is the case for the most part | 01:12 |
| ayoung | dolphm, deprecating is an indicator to the integrator that there is a different API they should be using | 01:12 |
| ayoung | It does not remove the function | 01:12 |
| ayoung | I'm OK with the kill switch, but it should default to 'On' | 01:13 |
| *** tomoe_ has quit IRC | 01:14 | |
| openstackgerrit | A change was merged to openstack/python-quantumclient: add 2.2.0 release note in index.rst file https://review.openstack.org/24633 | 01:14 |
| openstackgerrit | A change was merged to openstack/quantum: Imported Translations from Transifex https://review.openstack.org/24951 | 01:14 |
| *** lloydde has quit IRC | 01:14 | |
| *** networkstatic has quit IRC | 01:15 | |
| *** winston-d has joined #openstack-dev | 01:15 | |
| ayoung | termie, question for you. DOes oauth provide a standard way for a user to query the agreements they have set up with a remote service? | 01:15 |
| *** dsanders1 has quit IRC | 01:16 | |
| ayoung | http://tools.ietf.org/html/rfc5849 | 01:16 |
| termie | ayoung: nope, usually the service provides a list of outstanding authorizations, but that isn't part of the spec | 01:16 |
| ayoung | OK, so that is the CRUD API | 01:16 |
| ayoung | can we accept that, oauth or no, we will need something like that? | 01:17 |
| termie | ayoung: why? | 01:17 |
| ayoung | termie, so the user can see what they have set up, and potentially cancel it later? | 01:17 |
| termie | ayoung: i think we should have something like that but i don't like your arguments to keep things not in an extension | 01:17 |
| *** tomoe_ has joined #openstack-dev | 01:17 | |
| *** jamielennox has quit IRC | 01:18 | |
| ayoung | termie, extension or core for that is irrelevant. It is whether we support it or not. | 01:18 |
| ayoung | I'm OK with moving it to an extension, just not dropping it | 01:18 |
| termie | ayoung: i think you are arguing with the air at this point | 01:18 |
| ayoung | termie, as I said, there are 3 things. that was one of them | 01:19 |
| ayoung | the second isoauth, which is not happening in grizzly | 01:19 |
| ayoung | is oauth | 01:19 |
| termie | ayoung: there will be crud in the extension i would assume | 01:19 |
| termie | ayoung: i don't know what youa re getting at, i was never arguing abotu whether crud exists | 01:20 |
| termie | ayoung: and nobody else was either | 01:20 |
| ayoung | termie, so the next is whether we have oauth or the current mechanism for getting a delegated token | 01:20 |
| termie | ayoung: oauth | 01:20 |
| termie | ayoung: or your extension | 01:20 |
| termie | ayoung: i'll do my best to show that oauth is the better option | 01:21 |
| *** nati_ueno has quit IRC | 01:21 | |
| ayoung | termie, perhaps it is better in an absolute sense | 01:21 |
| ayoung | I don';t know it well enought | 01:21 |
| ayoung | but | 01:21 |
| *** mrodden has joined #openstack-dev | 01:21 | |
| ayoung | there is the question of doing an oath implementation now for Grizzly | 01:21 |
| termie | ayoung: when is grizzly? | 01:22 |
| ayoung | Feature freeze was about three weeks ago | 01:22 |
| *** terry7 has quit IRC | 01:22 | |
| termie | ayoung: so how is it an option to do an oauth impl tonight? | 01:22 |
| ayoung | termie, I don't think it is. THat is my point | 01:23 |
| ayoung | so if we rip out trusts | 01:23 |
| ayoung | we have no delegation | 01:23 |
| dolphm | termie: your two nits on spaces are actually just horrible rendering by gerrit :( it's not a monospace font when it tries to make things bold | 01:23 |
| termie | ayoung: we will have a delegation extension people can add | 01:23 |
| termie | dolphm: oh really, okies | 01:23 |
| dolphm | termie: regardless, tests were failing -- i posted another patch while i run the full suite again myself | 01:23 |
| termie | ayoung: extension != on the same schedule | 01:24 |
| ayoung | termie, I don't think that is for you or I to decide | 01:24 |
| *** amerine has quit IRC | 01:24 | |
| ayoung | you or me... | 01:24 |
| termie | ayoung: sure thing | 01:24 |
| * ayoung tired | 01:24 | |
| dolphm | termie: the implementation would have be to external to keystone to abide by it's own schedule, correct? | 01:24 |
| termie | dolphm: yup | 01:24 |
| termie | dolphm: or a separate package at least | 01:25 |
| termie | doesn't make it hard to do in the least | 01:25 |
| termie | in fact that is usually what an extension is | 01:25 |
| termie | they aren't all "contrib" | 01:25 |
| dolphm | termie: without monkey patching, we don't have a way for an external package to legitimately add it's own api | 01:26 |
| termie | dolphm: yeah we do, it is in the paste conf | 01:26 |
| dolphm | termie: to add its own router and everything? | 01:26 |
| termie | dolphm: it is a middleware, those route fine | 01:27 |
| dolphm | termie: ah, i assumed that wasn't what you meant | 01:27 |
| termie | dolphm: i mean, i don't know how much you ahve changed, but that was the whole point | 01:27 |
| termie | dolphm: https://github.com/openstack/keystone/blob/master/keystone/routers.py#L31 | 01:27 |
| termie | dolphm: erm that is not the right one | 01:28 |
| dolphm | termie: wsgi.Middleware or something | 01:28 |
| termie | dolphm: https://github.com/openstack/keystone/blob/master/keystone/common/wsgi.py#L499 | 01:28 |
| ayoung | So do oauth as an extension. But we've committed to delegation in Grizzly. | 01:29 |
| termie | ayoung: if it is an extension it is available whenever you'd like it | 01:29 |
| harlowja | has anyone been running the oslo-incubator tests successfully, like from nosetests? | 01:29 |
| harlowja | all sorts of odd errors when i run it, ha | 01:29 |
| ayoung | termie, I don't think so. Remember, this isn't just doing a web app for a single company. We are going to do a cut for Grizzly. That is going to start the grizzly-stable branch, and that is what people will be using. An extension would not be part of that no matter when it is cut. It would have to be ported, and I don't think a new extension would meet the criteria for being ported to stable. | 01:32 |
| ayoung | Which effectively bumps it to the next major release | 01:32 |
| *** anniec has quit IRC | 01:32 | |
| termie | ayoung: what? totally opposite | 01:32 |
| termie | ayoung: if grizzly is stable, you now have a perfect target to provide your extension for | 01:32 |
| ayoung | But it isn't in the release. Which means that people cannot plan on it being available. | 01:33 |
| termie | ayoung: they can plan on it being available if you write it right now | 01:33 |
| termie | ayoung: or just tell them when it will bne available, this is the whole point of extensions | 01:33 |
| ayoung | Which is why I spent this release writing it, getting it reviewed, and fixing it. So it would be ready on Day 1. | 01:34 |
| termie | ayoung: day 2 ain't bad and you'll have more freedom with an extension anyway | 01:34 |
| *** capnkooc has quit IRC | 01:35 | |
| ayoung | oauth may be a better standard, but then again, there are better standards for SSO than the bearer tokens in Keystone. Trusts is designed to work with the current auth mechanism in as simple a manner possible. Before I chose to go oauth, I would look at a range of options. I have yet to hear, on its technical merits, a reason that justifies delaying this feature. | 01:36 |
| ayoung | "It is wrong" is not a reason | 01:36 |
| ayoung | oauth is better is not a reason. It is a reason to do oauth in Havana, or as an extension | 01:37 |
| ayoung | If oauth is somehow compromised by Trusts, then we can choose to deprecate trusts | 01:37 |
| dolphm | ayoung: to be fair, you spent this release writing it, and a FFE having it reviewed | 01:38 |
| ayoung | dolphm, it was backed up behind V3 Auth.... | 01:38 |
| dolphm | absolutely | 01:39 |
| ayoung | I originally wrote it in October and first posted it for review in December | 01:39 |
| *** dims has quit IRC | 01:39 | |
| *** dolphm has quit IRC | 01:41 | |
| *** oubiwann has quit IRC | 01:41 | |
| *** dolphm has joined #openstack-dev | 01:42 | |
| termie | welcome back | 01:42 |
| dolphm | o/ | 01:43 |
| *** pabelanger has joined #openstack-dev | 01:43 | |
| *** jcmartin has quit IRC | 01:43 | |
| termie | for the record i do think "it is wrong" is a valid reaosn | 01:43 |
| *** yaguang has joined #openstack-dev | 01:43 | |
| termie | when you have established there is a better way to do it | 01:43 |
| dolphm | ayoung: i don't find it acceptable to release an api-level feature that you have no intention of supporting next release | 01:44 |
| *** markmcclain has quit IRC | 01:44 | |
| dolphm | ayoung: if our goal is to get it out there and have people try it out while we work out kinks and improve upon it, putting it out there and letting those users enable it is the right way to go | 01:46 |
| ayoung | dolphm, I am not the one claiming I have no intention of supporting it | 01:46 |
| ayoung | dolphm, I stated that I was willing to accept that oauth might supplant it | 01:46 |
| ayoung | but right now, I have no plans to implement oauth. termie states he is willing to implement it | 01:47 |
| crazed | if i could get some feedback on https://bugs.launchpad.net/keystone/+bug/1158077 i wouldn't mind taking a stab at implementing the fix | 01:47 |
| uvirtbot | Launchpad bug 1158077 in keystone "user crud in ldap backend breaks when changing user_name_attribute and user_id_attribute" [Undecided,New] | 01:47 |
| dolphm | ayoung: acknowledging that there may be a better solution is a huuuuuuge argument toward "this should be a non-core extension and be released as a beta" | 01:47 |
| termie | dolphm, ayoung: implementing oauth falls well into my "spite coding" sweet spot | 01:48 |
| termie | or at least "angry coding" | 01:48 |
| ayoung | dolphm, I would feel more comfortable saying tokens was wrong | 01:48 |
| dolphm | termie: you have 7 hours, go | 01:48 |
| termie | ayoung: tokens was wrong, we're on bored for that | 01:48 |
| ayoung | heh | 01:48 |
| termie | s/bored/board/ | 01:48 |
| *** yaguang has quit IRC | 01:49 | |
| *** gongysh has quit IRC | 01:49 | |
| ayoung | dolphm, so, until we have oauth, we use the implementation in the code base to use a token to get a token. I don't see anything wrong with that implementation | 01:49 |
| ayoung | david chadwich would be here arguing for mapping as you recall | 01:49 |
| dolphm | +1 i'd like to see tokens replaced but i don't know what the best solution is -- we have a summit talk on that though | 01:49 |
| ayoung | they actually submitted a patch for that, even | 01:49 |
| dolphm | yep, i'm not opposed to the concept, but the api and implementation both needed considerable work | 01:50 |
| termie | turns out oauth would probably handle most of that too ;) | 01:50 |
| ayoung | I'm all for being a purist during design. I am willing to include oauth as one, potential, standard for doing delegation. That is afar way from saying it is better for our needs thant what we have | 01:50 |
| ayoung | dolphm, agreed. | 01:50 |
| termie | ayoung: it is better for our needs than what we have | 01:51 |
| dolphm | lol | 01:51 |
| ayoung | dolphm, if you are going to do that with trusts, you should do it for the whole V3 api. | 01:52 |
| *** maoy has quit IRC | 01:52 | |
| ayoung | The arguments are the same. | 01:52 |
| ayoung | Should we disable V3 by default? | 01:53 |
| termie | that would be rad :) | 01:53 |
| *** Ryan_Lane has quit IRC | 01:53 | |
| termie | not changing things are the easiest things to support | 01:53 |
| termie | i suspect that will be too large a battle to win, however | 01:54 |
| ayoung | crazed, as you can see, we are in a bit of a discussion here, but looking at the bug... | 01:55 |
| *** xchu has joined #openstack-dev | 01:55 | |
| *** soody has joined #openstack-dev | 01:55 | |
| *** anniec has joined #openstack-dev | 01:59 | |
| *** ayoung has quit IRC | 02:02 | |
| *** ayoung has joined #openstack-dev | 02:02 | |
| dolphm | ayoung: "trusts need to be enabled by default" -- you haven't said anything to justify "need" other than suggesting that a proprietary product at red hat is crippled without trusts; if it's proprietary, red hat can ensure trusts are enabled in their own deployments | 02:02 |
| *** pabelanger has quit IRC | 02:03 | |
| ayoung | It is not a proprietary red hat product that is crippled | 02:03 |
| ayoung | This feature request came from another team on openstack. | 02:03 |
| termie | dolphm: i am kinda thinking 7 hours might be enough, will see how long it takes to duplicate the appropriate tests | 02:03 |
| dolphm | termie: i was sort of joking and was worried you take up the challenge | 02:04 |
| *** danwent has quit IRC | 02:04 | |
| ayoung | dolphm, plus, talk to gyee, as his company stated that they need the feature as well. | 02:05 |
| ayoung | We need a mechanism to allow us to get away from bearer tokens | 02:05 |
| ayoung | if trusts or a comparable other feature that we can count on is not there, we cannot make use of a better auth mechanism | 02:06 |
| crazed | ayoung: it's all good, it's an interesting discussion, i wouldn't be able to work on it until tomorrow anyway | 02:06 |
| termie | dolphm: i am strangely manipulable :p | 02:06 |
| *** jsindy has joined #openstack-dev | 02:06 | |
| ayoung | termie, where were you when this could have resulted in something productive? | 02:06 |
| dolphm | ayoung: yes, the community has use cases for delegation and impersonation, but not if we can't stand behind the implementation for 18 months | 02:06 |
| *** jaybuff has joined #openstack-dev | 02:07 | |
| *** mrodden has quit IRC | 02:07 | |
| ayoung | dolphm, I can stand behind trusts for 18 months. If it gets pulled, it will be because it was replaced by something superior that did everything trusts can do and more, but that something does not exist right now. | 02:07 |
| dolphm | termie: i'm still wondering what about breaking your face made you run_tests on keystone | 02:07 |
| ayoung | I would not bother implementing oauth. | 02:07 |
| termie | dolphm: new outlook on life? | 02:08 |
| ayoung | But termie is welcome to | 02:08 |
| ayoung | and if he does | 02:08 |
| ayoung | AND it is accepted and used | 02:08 |
| ayoung | then we mark trusts as deprecated | 02:08 |
| ayoung | until that exists, we have a mechanism. | 02:08 |
| ayoung | And, to be honest, there is no reason that trusts and oauth can't co-exist. | 02:09 |
| ayoung | So, yes, 18 months on trusts. | 02:09 |
| dolphm | ayoung: competing solutions for the same use case is what defines non-core | 02:11 |
| dolphm | termie: how familiar are you with the v3 spec? | 02:11 |
| *** darjeeling has joined #openstack-dev | 02:13 | |
| termie | dolphm: low familiarity, won't need much to write a spec | 02:13 |
| termie | s/spec/extension/ | 02:13 |
| termie | dolphm: did we change response formats to something more standardized? | 02:13 |
| dolphm | termie: a bit, yes | 02:13 |
| dolphm | termie: scroll down a bit from here https://github.com/openstack/identity-api/blob/master/openstack-identity-api/src/markdown/identity-api-v3.md#authenticate-post-authtokens | 02:14 |
| termie | dolphm: oh the famed "methods" | 02:15 |
| *** jaybuff has quit IRC | 02:15 | |
| termie | dolphm: most of what i have to return is a token | 02:15 |
| dolphm | termie: the token itself is returned in a header, not in the body | 02:16 |
| termie | dolphm: looking at this: https://github.com/openstack/identity-api/blob/master/openstack-identity-api/src/markdown/identity-api-v3.md#authentication-responses | 02:16 |
| termie | dolphm: the hard part i expect is that you guys probably normalized the tokens | 02:16 |
| *** jsindy has quit IRC | 02:17 | |
| termie | dolphm: which results in get-token mkaing a bunch of calls | 02:17 |
| termie | dolphm: instead of 1 | 02:17 |
| *** anniec has quit IRC | 02:17 | |
| termie | dolphm: (checking) | 02:17 |
| *** mohits has joined #openstack-dev | 02:17 | |
| *** mohits has joined #openstack-dev | 02:17 | |
| dolphm | termie: in the driver? | 02:17 |
| *** pixelbeat has quit IRC | 02:18 | |
| termie | dolphm: in validate_token i suppose | 02:18 |
| termie | dolphm: actually looks doable as is | 02:18 |
| dolphm | termie: are you looking at keystone.auth or keystone.token | 02:19 |
| termie | dolphm: roles are pulled from metadata | 02:19 |
| termie | oh right, two copies of the same code | 02:19 |
| termie | will check the other too | 02:19 |
| dolphm | yeah... | 02:19 |
| termie | currently .token | 02:19 |
| openstackgerrit | A change was merged to openstack/swift: Fix misspelled variable. https://review.openstack.org/24948 | 02:19 |
| *** yaguang has joined #openstack-dev | 02:20 | |
| ayoung | dolphm, I have to turn in, I'm on east coast time, and have two little boys whose internal alarm clocks are set way too early. Lets discuss this tomorrow? | 02:20 |
| dolphm | *sigh* validate_token is calling get_token at least twice | 02:20 |
| termie | dolphm: yeah, normalized in there | 02:20 |
| *** AlanClark has joined #openstack-dev | 02:21 | |
| termie | dolphm: it does a _populate_roles in the token_factory.TokenDataHelper | 02:21 |
| termie | i think this token_factory is pretty much altogether a bad idea | 02:21 |
| *** nunosantos has quit IRC | 02:21 | |
| termie | you should be building the token at creation time not fetch time | 02:21 |
| dolphm | termie: the only catch there is that the token structure is different on each api, and ideally a token from one api can be used and validated on the other | 02:23 |
| termie | dolphm: by "each api" do you just mean between v2 and v3? | 02:23 |
| dolphm | termie: yes | 02:23 |
| termie | dolphm: or do you mean different calls? | 02:23 |
| dolphm | termie: create token on v2 -> validate on v3, etc | 02:23 |
| termie | dolphm: i think that probably wasn't necessary | 02:24 |
| *** ewindisch has joined #openstack-dev | 02:24 | |
| termie | dolphm: these tokens barely even get cached anywhere as it is | 02:24 |
| termie | dolphm: they are going to use a library | 02:24 |
| termie | dolphm: and just get a new one | 02:24 |
| dolphm | ayoung: termie: was anyone else involved in ya'll conversation from earlier / this past week? | 02:25 |
| termie | dolphm: anyway, the stuff in token_factory doesn't let you give it the data it needs, it always looks up stuff | 02:26 |
| dolphm | termie: auth_token itself has the best caching probably, for it's own token | 02:26 |
| dolphm | notsomuch a factory | 02:26 |
| termie | https://github.com/openstack/keystone/blob/master/keystone/auth/token_factory.py#L130 | 02:26 |
| ayoung | dolphm, I don't think so. There might have been a fair number of lurkers, but no one contributed AFAICR | 02:26 |
| termie | dolphm: it calls all that stuff on validate_token :( | 02:27 |
| termie | dolphm: in effect "validate_token" the call that should be the fastest | 02:27 |
| termie | is actually the slowest | 02:27 |
| termie | it builds teh catalog in there too | 02:27 |
| *** aeperezt has joined #openstack-dev | 02:28 | |
| dolphm | :( | 02:29 |
| openstackgerrit | A change was merged to openstack/ceilometer: enable xml error message response https://review.openstack.org/24455 | 02:30 |
| dolphm | feature freeze needs to be like 12 weeks | 02:30 |
| *** SlickNik has joined #openstack-dev | 02:31 | |
| termie | or just review stuff beforei t goes in | 02:31 |
| termie | and be like, "holy shit this is making 30+ calls" | 02:31 |
| termie | token response should be "fetch token by key, is this still valid? return it" | 02:32 |
| dolphm | termie: the auth and trusts reviews both came really late in the v3 cycle; i basically wrote tests against them instead of reviewing as thoroughly | 02:33 |
| dolphm | termie: on the basis that performance and nits can be quickly improved, broken api behaviors can't :( | 02:33 |
| *** jog0 has quit IRC | 02:34 | |
| termie | dolphm: this token_factory makes a lot of api behavior assumptions, unfortunately | 02:34 |
| termie | dolphm: but i think it can be fixed | 02:34 |
| termie | dolphm: i'd of course just sshred it all :p | 02:34 |
| *** darjeeling has quit IRC | 02:34 | |
| termie | dolphm: but i think some checks for "is this data already in the returned token" | 02:34 |
| *** ayoung is now known as ayoung_zzz | 02:38 | |
| *** jamielennox has joined #openstack-dev | 02:39 | |
| *** vkmc has quit IRC | 02:40 | |
| dolphm | termie: ayoung_zzz: i think ayoung is gone for the night, but i'm going to split my patch up -- one to make trusts optional, which i think is valuable at least for security reasons (disable feature you're not using), and maintain the second patch as disabling them by default (which ayoung is currently blocking) | 02:42 |
| *** adjohn has quit IRC | 02:42 | |
| *** jsindy has joined #openstack-dev | 02:43 | |
| *** ayoung_zzz has quit IRC | 02:43 | |
| dolphm | termie: ayoung_zzz: asking ttx to let us change the default after rc1 will be a simple swap of booleans | 02:43 |
| *** jcmartin has joined #openstack-dev | 02:44 | |
| termie | sorry, makerbot emergency to deal with | 02:46 |
| termie | gah, so many things are already built into this big ugly piece of code | 02:46 |
| dolphm | lol | 02:48 |
| dolphm | termie: glad to have you back! | 02:48 |
| termie | ... | 02:48 |
| *** andrewbogott is now known as andrewbogott_afk | 02:49 | |
| termie | i think this calls for a run to the corner store | 02:49 |
| *** jaybuff has joined #openstack-dev | 02:49 | |
| termie | dolphm: did you ever move out to sf? | 02:49 |
| termie | dolphm: or was that even an option? | 02:49 |
| dolphm | termie: no, and it was a longshot | 02:49 |
| *** jaybuff has quit IRC | 02:49 | |
| *** jaybuff has joined #openstack-dev | 02:49 | |
| termie | dolphm: too bad, would be so much easier to do backroom dealings | 02:49 |
| termie | dolphm: in person | 02:49 |
| termie | ;) | 02:49 |
| dolphm | lol | 02:50 |
| openstackgerrit | A change was merged to openstack/cinder: Speedup solidfire unit tests https://review.openstack.org/24920 | 02:50 |
| *** jsindy has quit IRC | 02:52 | |
| *** ayoung has joined #openstack-dev | 02:53 | |
| *** jamielennox has quit IRC | 02:56 | |
| *** jamielennox has joined #openstack-dev | 02:56 | |
| ayoung | dolphm, on the kill switch, the if blocks are wrong, and actually dangerous as written. | 02:58 |
| ayoung | If a token comes in with a trust_id, but trusts are disabled, then we need to return exception.Forbidden | 02:59 |
| ayoung | As written, the processing will continue and the user will still get a valid token. | 02:59 |
| termie | ayoung: he'd never have given a trust in teh first place | 02:59 |
| dolphm | ayoung: it'll be an unscoped token, though -- as if the server doesn't understand trusts | 03:00 |
| ayoung | termie, what if it was enabled and then disabled? | 03:00 |
| termie | ayoung: you are making up stuff | 03:00 |
| dolphm | ayoung: i'm about to post a split review you'll like | 03:00 |
| termie | ayoung: go to sleep so we can talk behind your back | 03:00 |
| ayoung | dolphm, the check just needs to be in the first line: like this | 03:00 |
| ayoung | if 'trust_id' in auth: | 03:01 |
| ayoung | if !CONF.trust.enabled : | 03:01 |
| ayoung | raise exception.Forbidden() | 03:01 |
| *** jaybuff has left #openstack-dev | 03:01 | |
| ayoung | doesn't need to be in every block, just the first one. Depends on how paranoid you want to code it | 03:01 |
| *** dmner has joined #openstack-dev | 03:02 | |
| ayoung | dolphm, same is true for the delete tokens logic. If the trusts were disabled, we can't confirm that the admins know to delete all the tokens in the database | 03:03 |
| ayoung | there may still be outstand trust tokens | 03:03 |
| termie | did we get rid of the openssl check? | 03:04 |
| termie | 'cause i am on a different computer and just ran into that again :p | 03:04 |
| termie | would have worked juuuust fine in the run_tests.sh | 03:04 |
| *** stevemar has quit IRC | 03:05 | |
| dolphm | termie: isn't openssl in test-requires or pip-requires? | 03:05 |
| dolphm | or pyopenssl | 03:05 |
| dolphm | grr, it's not | 03:05 |
| termie | not that | 03:06 |
| termie | the version of openssal has to be abouve 1 | 03:07 |
| ayoung | termie, if you want to do some valuable angry coding, get a decent set of openssl bindings for eventlet | 03:07 |
| termie | os x ships with 0.9.8 or something | 03:07 |
| termie | ayoung: this is making me much happeier | 03:07 |
| ayoung | Or just adecent set of openssl bindings that don't run afowl of the GIL | 03:07 |
| dolphm | termie: i think i brew installed 1.0.1 | 03:08 |
| termie | yeah sames | 03:09 |
| termie | dolphm: it just dies with a ton of cryptic errors without that | 03:09 |
| termie | dolphm: so i wrote some stuff in run_tests.sh | 03:09 |
| dolphm | termie: i think you abandoned that review | 03:09 |
| termie | dolphm: then got asked ot move it to init.py, but that broke you all for some reason | 03:09 |
| termie | dolphm: so you reverted it | 03:09 |
| dolphm | termie: that broke everyone but me | 03:09 |
| termie | dolphm: didn't break me either | 03:10 |
| termie | hmmm | 03:10 |
| termie | maybe we have some secret powers | 03:10 |
| dolphm | termie: do you manage your own venv or let run_tests build it for you? | 03:10 |
| termie | manage my own | 03:10 |
| dolphm | same | 03:10 |
| termie | INTERESTING | 03:10 |
| termie | i bet something about how run_tests.sh does the venving | 03:10 |
| termie | makes with the hurty times for others | 03:10 |
| termie | oh weird i get a bunch of "too many open files" | 03:11 |
| dolphm | openssl says hi | 03:11 |
| termie | openssl also? | 03:11 |
| dolphm | i think so | 03:11 |
| termie | oh yeah, it didn't get moved iunto my path yet | 03:12 |
| dolphm | i had to increase my ulimit after we added openssl, and again after auth_token started caching stuff on disk in files | 03:12 |
| *** krtaylor has joined #openstack-dev | 03:12 | |
| termie | oh wait, still happening even after getting proper version | 03:13 |
| dolphm | granted os x defaults to something really low (256?) | 03:13 |
| termie | didn't seem to be a problem on my macbook air last week | 03:13 |
| termie | and this fucker is beefy | 03:13 |
| dolphm | new one? | 03:14 |
| termie | well, it is my work one but i brought it home | 03:14 |
| termie | i figured if i am going to be doing heavy lifting | 03:14 |
| termie | (actually i was working on docker earlier today, did you see that? | 03:14 |
| termie | dolphm: http://docker.io/ | 03:14 |
| termie | pretty rad | 03:14 |
| termie | dolphm: but i needed a bunch of vagrants to test my stuff | 03:15 |
| * dolphm reading | 03:15 | |
| *** jamielennox has quit IRC | 03:15 | |
| termie | it's a dotcloud project | 03:16 |
| termie | i have a poc i want to write with it / around it so i asked for early access so that i can get it done for their launch and ride their publicity :) | 03:16 |
| *** jamielennox has joined #openstack-dev | 03:16 | |
| dolphm | hmm this seems really cool | 03:17 |
| termie | dolphm: hmm, increased ulimit to 1000 and still get errors | 03:17 |
| termie | dolphm: it is basically an lxc for a process wiht the output piped back to you | 03:17 |
| dolphm | termie: mine has been at 1024 for at least a few months without issue | 03:17 |
| termie | oh, you know i think it was beause i have a "watch" running in the backgorund | 03:18 |
| termie | i guess it must be somehow keeping all the file descriptors that ack was using open | 03:18 |
| *** jsindy has joined #openstack-dev | 03:18 | |
| *** esp has joined #openstack-dev | 03:19 | |
| termie | (watch ack trrrt is a really good way to find and remove all teh references to trrrt) | 03:19 |
| dolphm | i use ack, but not watch | 03:20 |
| termie | it is like a countdown to no more mentions | 03:20 |
| termie | every time you delete some lines the stuff gets smaller | 03:21 |
| termie | still too many open files wtf world | 03:21 |
| termie | i'm at 1024s | 03:21 |
| dolphm | brew install watch? | 03:21 |
| termie | yeah | 03:22 |
| termie | the files open errors start once it gets to the checkouts | 03:22 |
| *** stevemar has joined #openstack-dev | 03:22 | |
| termie | erm the Kc11TestCase and such | 03:22 |
| ayoung | gnight, all | 03:23 |
| *** ayoung has quit IRC | 03:23 | |
| *** martine has quit IRC | 03:25 | |
| *** martine has joined #openstack-dev | 03:25 | |
| *** susanne-balle has quit IRC | 03:25 | |
| *** susanne-balle has joined #openstack-dev | 03:26 | |
| openstackgerrit | A change was merged to openstack/cinder: Add missing processutils for impl_zmq in oslo rpc https://review.openstack.org/24940 | 03:26 |
| openstackgerrit | A change was merged to openstack/cinder: Update Cinder's latest copy of OSLO grizzly stable https://review.openstack.org/24933 | 03:26 |
| termie | seems to do fine without running the integration tests except for an oslo test that dies | 03:27 |
| *** jasdeepH has quit IRC | 03:27 | |
| *** jsindy has quit IRC | 03:28 | |
| *** AlanClark has quit IRC | 03:28 | |
| *** AlanClark has joined #openstack-dev | 03:29 | |
| *** mohits has quit IRC | 03:31 | |
| *** jamielennox has quit IRC | 03:34 | |
| *** jamielennox has joined #openstack-dev | 03:34 | |
| *** danwent has joined #openstack-dev | 03:35 | |
| *** Ryan_Lane has joined #openstack-dev | 03:36 | |
| *** Mandell has quit IRC | 03:39 | |
| dolphm | termie: i resolved ayoung's comments, and he seemed to approve otherwise (and i'm not sure how thoroughly gyee reviewed?), but if you +1 i'll merge and cut rc1 | 03:40 |
| dolphm | https://review.openstack.org/#/c/24959/ | 03:40 |
| dolphm | it's enabled by default there, and there's a subsequent review that ayoung -2'd to make it disabled by default | 03:40 |
| *** ewindisch has quit IRC | 03:41 | |
| *** soody has quit IRC | 03:42 | |
| *** martine has quit IRC | 03:43 | |
| *** SergeyLukjanov has joined #openstack-dev | 03:44 | |
| *** AnilV4 has joined #openstack-dev | 03:48 | |
| *** jamielennox has quit IRC | 03:52 | |
| termie | hrm, seems like the trust sql migrations changed more than trust | 03:52 |
| *** jamielennox has joined #openstack-dev | 03:52 | |
| *** adjohn has joined #openstack-dev | 03:53 | |
| termie | or i am crazy or something | 03:53 |
| dolphm | termie: link? | 03:54 |
| *** alexxu has joined #openstack-dev | 03:54 | |
| *** mohits has joined #openstack-dev | 03:54 | |
| *** mohits has quit IRC | 03:54 | |
| *** mohits has joined #openstack-dev | 03:54 | |
| *** jsindy has joined #openstack-dev | 03:54 | |
| *** stevemar has quit IRC | 03:57 | |
| *** adjohn has quit IRC | 03:57 | |
| termie | dolphm: lookings | 03:57 |
| termie | dolphm: i already removed the line in my copy | 03:57 |
| dolphm | https://github.com/openstack/keystone/tree/master/keystone/common/sql/migrate_repo/versions | 03:58 |
| termie | dolphm: https://github.com/openstack/keystone/commit/eb4dd4afbffaa15be0af70a317da7034ae28dfd6#L3R68 | 03:59 |
| termie | was there no user_id table before? | 03:59 |
| termie | looks like no | 03:59 |
| termie | s/table/column | 03:59 |
| termie | i guess i'll add that part back to the mgiration | 04:00 |
| dolphm | no, there wasn't -- it was buried in json | 04:00 |
| termie | you don't get a weird oslo error, do you? | 04:03 |
| termie | it comes from the _test_auth_token_import.py | 04:03 |
| *** ayoung has joined #openstack-dev | 04:03 | |
| termie | can't sleep? | 04:03 |
| *** ewindisch has joined #openstack-dev | 04:03 | |
| ayoung | dolphm, let me give it a thourough test before you merge | 04:04 |
| ayoung | termie, nope. For some reason I am a little wired | 04:04 |
| dolphm | ayoung: thank you! | 04:04 |
| *** jsindy has quit IRC | 04:04 | |
| dolphm | ayoung: i have the version bump pre-approved behind it, so they'll merge together | 04:04 |
| ayoung | test_auth_with_scope_in_trust_403 is a good idea | 04:06 |
| *** esp has quit IRC | 04:06 | |
| *** novas0x2a|laptop has quit IRC | 04:06 | |
| termie | i forget what i have to do to make gerrit work on a new computer | 04:06 |
| termie | s/gerrit/git-review/ | 04:06 |
| termie | is my gerrit name termie or termie@openstack.org | 04:06 |
| termie | do i need keys somewhere? | 04:07 |
| termie | oh found it | 04:07 |
| ayoung | dolphm, this seems a little hard to parse: | 04:07 |
| ayoung | elif not CONF.trust.enabled and 'trust' in self.auth['scope']: | 04:07 |
| ayoung | 186 raise exception.Forbidden('Trusts are disabled.') | 04:07 |
| ayoung | 187 elif CONF.trust.enabled and 'trust' in self.auth['scope']: | 04:07 |
| ayoung | any reason you did the double if? | 04:08 |
| dolphm | ayoung: i thought it was more clear, actually | 04:08 |
| termie | +49,-1854 | 04:08 |
| termie | https://review.openstack.org/#/c/24963/ | 04:08 |
| dolphm | that was a fast -2 | 04:09 |
| ayoung | It needs to depend on a corresponding patch that implements an alternative | 04:09 |
| *** aditirav has joined #openstack-dev | 04:09 | |
| *** jamielennox has quit IRC | 04:10 | |
| termie | ayoung: easier to write that patch when there aren't 1850 extra lines of code ;) | 04:10 |
| dolphm | if the alternative is an extension, it would be in a different repo and we couldn't create a dependency anyway | 04:10 |
| ayoung | termie, it should be completely orthoganal. Your implementation of oauth should not care that there are trusts. | 04:10 |
| *** jamielennox has joined #openstack-dev | 04:10 | |
| *** zeriouz has joined #openstack-dev | 04:11 | |
| termie | ayoung: i'll let myself decide what i "should" do | 04:11 |
| ayoung | and I'll let myself decide what I should approve | 04:11 |
| termie | ayoung: yup, just laying groundwork | 04:11 |
| *** adjohn has joined #openstack-dev | 04:12 | |
| *** adjohn has quit IRC | 04:12 | |
| termie | ayoung: (makes it easier if you want to write an extension, too) | 04:15 |
| *** avishay has joined #openstack-dev | 04:17 | |
| openstackgerrit | A change was merged to openstack/cinder: Remove the log spam generated by the NetApp driver unit tests. https://review.openstack.org/24922 | 04:21 |
| openstackgerrit | A change was merged to openstack/quantum: NVP metadata access - create elevated context once https://review.openstack.org/24413 | 04:21 |
| termie | this token_factory stuff sure is a tangle | 04:21 |
| termie | it calls quite a lot of 6 parameter methods on itself | 04:22 |
| *** aditirav_ has joined #openstack-dev | 04:22 | |
| termie | then just dumps everything in extras anyway | 04:22 |
| termie | in fact, i wouldn't be surprised if the tokens somehow grew extra subtokens in themselves somehow | 04:23 |
| dolphm | ayoung: did you want me to change something in that patch? | 04:23 |
| ayoung | dolphm, still looking, but yes. Review in a minute. | 04:23 |
| dolphm | termie: thanks | 04:23 |
| termie | token_data = token_ref['token'] | 04:24 |
| termie | 'token' is sttored in the extras field | 04:24 |
| termie | so the token in the db looks like extras['token'] | 04:25 |
| dolphm | (i actually think you wrote that) | 04:25 |
| termie | THEN | 04:25 |
| termie | dolphm: not at all, watch ina we | 04:25 |
| termie | so it gets returned from the db, extras gets expanded to token.extra['token'] is now token['token'] | 04:26 |
| termie | so token_data = token_ref['token'] | 04:26 |
| *** aditirav has quit IRC | 04:26 | |
| *** aditirav_ is now known as aditirav | 04:26 | |
| termie | then token_data['extras'] = token_ref['extras'] is set | 04:26 |
| *** kagan has joined #openstack-dev | 04:26 | |
| termie | so in the db we actually have token.extras['token']['extras'] | 04:26 |
| termie | it should only be one extra level and there is probably nothing in it | 04:27 |
| *** amotoki has joined #openstack-dev | 04:27 | |
| termie | but yeah, not how that is supposed to work | 04:28 |
| termie | so everything is doing two unroll / rerolls | 04:28 |
| termie | and it makes it very hard to read | 04:28 |
| *** jamielennox has quit IRC | 04:28 | |
| termie | i'm just trying to optimize the call so it doesn't look up things it already know | 04:29 |
| termie | but damn if i can find where it even knows what it knows | 04:29 |
| *** jamielennox has joined #openstack-dev | 04:29 | |
| termie | (because it never looks for the data it has stored) | 04:29 |
| *** lloydde has joined #openstack-dev | 04:29 | |
| *** jsindy has joined #openstack-dev | 04:30 | |
| termie | luckily it still appears to be storing everything even if it ignores is | 04:30 |
| ayoung | termie, see, this is why I wanted you engaged.... | 04:30 |
| ayoung | just your timing sucks | 04:31 |
| *** melwitt1 has quit IRC | 04:31 | |
| *** ayoung is now known as ayoung_zzz | 04:32 | |
| harlowja | dolphm: yt | 04:32 |
| dolphm | harlowja: o/ | 04:32 |
| harlowja | yo, just some ideas if u have some time :-p | 04:33 |
| harlowja | run 'em by (not oveR) u | 04:33 |
| harlowja | ha | 04:33 |
| dolphm | harlowja: go for it | 04:33 |
| harlowja | some of the guys at y! were thinking that keystone could be split into a 'catalog' and the authentication and authorizon parts, the catalog especially seems like an odd duck in keystone | 04:34 |
| *** aeperezt has quit IRC | 04:34 | |
| termie | harlowja: HAH | 04:34 |
| harlowja | :) | 04:34 |
| harlowja | whatttt | 04:34 |
| termie | oh the lulz | 04:34 |
| termie | everything old is new again | 04:34 |
| harlowja | the circle of life | 04:34 |
| harlowja | akoona matta | 04:34 |
| harlowja | lol | 04:34 |
| termie | this project is one big i told ya so | 04:35 |
| harlowja | *hakuna matata | 04:35 |
| termie | harlowja: godspeed | 04:35 |
| harlowja | just wondering why its joined | 04:35 |
| *** esp has joined #openstack-dev | 04:36 | |
| harlowja | keystone redux3 | 04:36 |
| harlowja | :-p | 04:36 |
| harlowja | other things that might just be interesting questions, users can exist without roles, whats up with that :-p | 04:36 |
| termie | hah it's even worse, token.extras['token_data']['token']['extras'] | 04:38 |
| termie | harlowja: that is a feature | 04:38 |
| *** vipul is now known as vipul|away | 04:38 | |
| termie | harlowja: you don't need a role to be a user | 04:38 |
| harlowja | where is it useful? admin stuff? | 04:38 |
| termie | harlowja: you only need roles to do thing that require roles to do stuff (so probably in most cases, but read-only stuff in nova or whatnot might easily have no roles) | 04:39 |
| termie | anyway, i need to code | 04:39 |
| harlowja | no code allowed | 04:39 |
| harlowja | ha | 04:39 |
| termie | so i am not going to engage in discourse | 04:39 |
| *** jsindy has quit IRC | 04:39 | |
| harlowja | so there is almost a 'NoRole' (role) :-p | 04:40 |
| *** esp has quit IRC | 04:40 | |
| *** adjohn has joined #openstack-dev | 04:40 | |
| harlowja | which is interesting since then the lack of roles has semantics | 04:40 |
| harlowja | so meta | 04:40 |
| harlowja | ha | 04:40 |
| *** boris-42 has joined #openstack-dev | 04:42 | |
| *** dmner has quit IRC | 04:43 | |
| dolphm | harlowja: sorry, i was responding to ayoung_zzz's review comments -- did termie answer your question? lol | 04:44 |
| harlowja | :-p | 04:44 |
| harlowja | eh, its more of a discussion, rather than an answer | 04:44 |
| harlowja | the answer may not exist, idk | 04:44 |
| dolphm | i'm not sure i have a great answer, other than it seems like some decisions were made out of convenience, not ideals | 04:45 |
| harlowja | we were just fixing some issues here since we put users in tenants with no roles, and there was some bugs that happened there (fixed in grizzly), and it was odd that users could exist without roles | 04:45 |
| harlowja | dolphm: sure sure | 04:45 |
| dolphm | harlowja: users in tenants with no roles? | 04:45 |
| harlowja | right, or thats what i believe happened | 04:46 |
| harlowja | *running folsom* | 04:46 |
| dolphm | ah, that was sort of an unintended feature that we dropped during grizzly (thanks ayoung!) | 04:46 |
| *** jamielennox has quit IRC | 04:46 | |
| harlowja | ah, thats cool | 04:47 |
| harlowja | good to know | 04:47 |
| *** jamielennox has joined #openstack-dev | 04:47 | |
| dolphm | harlowja: if you migrate that data forward, we create a generic role and assign it to such user-tenant pairs, then go about enforcing the fact that you need a role to have a relationship with a tenant | 04:47 |
| *** kaushikc has joined #openstack-dev | 04:48 | |
| harlowja | awesome, i think our ops are cleaning up it anyway in the DB | 04:48 |
| dolphm | harlowja: so, users can exist by themselves, and tenants can exist by themselves, but you must use roles to create relationships between them | 04:48 |
| harlowja | righto | 04:48 |
| harlowja | thx | 04:48 |
| dolphm | harlowja: https://wiki.openstack.org/wiki/ReleaseNotes/Grizzly#Upgrade_Notes_6 see Member role | 04:48 |
| harlowja | woot, thx | 04:49 |
| harlowja | and the other thing, the odd duckling, is just a thought, but has there been any thoughts about moving said 'catalog' out of keystone, i'm not sure if it makes sense, or maybe it was done before, or …. | 04:50 |
| harlowja | *u've probably been asked this alot | 04:50 |
| harlowja | ha | 04:50 |
| *** vipul|away is now known as vipul | 04:50 | |
| dolphm | i think it was included with keystone for convenience -- it simply made sense to return the catalog in a response from keystone | 04:51 |
| *** olaph has quit IRC | 04:51 | |
| harlowja | understandable | 04:51 |
| harlowja | ohhhh, and the other one, i know in the v2 api, there wasn't a good way to say, get me all the roles a user is in, (without iterating over there tenant), does something like that seem useful, at least for something i am doing it could be, haha, but maybe v3 is better | 04:52 |
| *** olaph has joined #openstack-dev | 04:52 | |
| dolphm | harlowja: i'd be happy to see it split off if there was some complicated use case that warranted a division in labor/expertise | 04:53 |
| harlowja | sure | 04:53 |
| harlowja | i'm gonna get the guy who thinks it should be to describe it more :-p | 04:53 |
| dolphm | looking for similar calls... | 04:54 |
| dolphm | List users with a role: GET /v3/roles/{role_id}/users | 04:54 |
| harlowja | ah | 04:54 |
| dolphm | List user's roles on domain: GET /v3/domains/{domain_id}/users/{user_id}/roles | 04:54 |
| harlowja | basically the reason for that api, is that we have a sync process which goes and makes sure the users in our other system are synced with the ones in keystone, and extracting what keystone has for 'roles/tenants/roles' and what we want it to have for roles/tenants/users | 04:54 |
| dolphm | List user's roles on project: GET /v3/projects/{project_id}/users/{user_id}/roles | 04:54 |
| harlowja | cool, that might help | 04:55 |
| *** jamielennox has quit IRC | 04:55 | |
| harlowja | and yes i know we shouldn't have to do said sync in the first place (just the backend should be better, haha) | 04:55 |
| harlowja | *our backend* | 04:55 |
| *** jamielennox has joined #openstack-dev | 04:55 | |
| dolphm | i think both solutions make sense for different reasons | 04:56 |
| *** jbresnah has joined #openstack-dev | 04:56 | |
| *** jbresnah_ has joined #openstack-dev | 04:56 | |
| harlowja | yup | 04:57 |
| harlowja | i'll mess around with those apis, just the iterating part is the PITA part, ha | 04:58 |
| harlowja | basically to create a local view of what is in keystone, and then compare it against what the sync script belives should be the correct 'view' and then make keystone have that 'correct' view by applying various ws calls | 04:58 |
| harlowja | like say, we have a system to know if new y! employees come onboard, daily adding there users, deleting peopel who left, and such (and interacting with nova to automatically do stuff with there vms) | 04:59 |
| dolphm | harlowja: that should be relatively efficient on v3 because it's all PUT / HEAD / DELETE calls without request/response bodies | 04:59 |
| harlowja | all not so fun but needed stuff, ha | 04:59 |
| dolphm | definition of keystone ^ | 04:59 |
| harlowja | :) | 05:00 |
| termie | dolphm: i think i mapped out this object | 05:00 |
| termie | https://gist.github.com/termie/5210803 | 05:00 |
| *** noslzzp has joined #openstack-dev | 05:00 | |
| harlowja | ack, extras fields | 05:00 |
| harlowja | ackkk | 05:00 |
| harlowja | ahhh | 05:00 |
| harlowja | just say no to extras fields | 05:00 |
| harlowja | :-p | 05:01 |
| *** BalleS_ has joined #openstack-dev | 05:01 | |
| dolphm | termie: ... now do it again for keystone.token :( | 05:01 |
| dolphm | why is domain in there twice | 05:01 |
| dolphm | with no distinction | 05:01 |
| *** aditirav has quit IRC | 05:02 | |
| termie | sorry indented wrong | 05:02 |
| termie | there are many things there twice | 05:02 |
| termie | harlowja: the extras field should have been called the "data" field or something | 05:02 |
| dolphm | oh that lines a dupe then | 05:02 |
| *** aditirav has joined #openstack-dev | 05:02 | |
| termie | harlowja: obviously nobody understood it and just proceeded anyway | 05:02 |
| *** avishay has quit IRC | 05:02 | |
| harlowja | termie: the 'kitchen sink' field | 05:02 |
| harlowja | :-p | 05:02 |
| harlowja | or the 'cubbard' | 05:03 |
| termie | harlowja: not the "kitchen sink" field, the "really, the token is this blob" | 05:03 |
| harlowja | :) | 05:03 |
| termie | the other fields are only indexes for lookups | 05:03 |
| dolphm | are you saying the token is not a kitchen sink? | 05:03 |
| termie | _this_ token is | 05:03 |
| harlowja | ha | 05:03 |
| *** susanne-balle has quit IRC | 05:03 | |
| harlowja | termie: i think our ops people at y! have a dart board with the extras field on it | 05:04 |
| termie | now to figure out what whackjob security considerations were put in | 05:04 |
| termie | harlowja: worst idea ever letting anybody touch this without taking a test first | 05:04 |
| harlowja | what kind of test | 05:04 |
| termie | "what is your data model" | 05:05 |
| harlowja | ah, good test | 05:05 |
| termie | "explain to me how an index works" | 05:05 |
| *** winston-d has quit IRC | 05:05 | |
| termie | "what does the database have to do to answer this question?" | 05:05 |
| harlowja | :) | 05:05 |
| dolphm | start every code review with an interview | 05:05 |
| *** jsindy has joined #openstack-dev | 05:05 | |
| harlowja | u do know that nova also is similarily odd in lots of places :-p | 05:05 |
| termie | dolphm: i basically have to, which is why i stopped working on this | 05:05 |
| termie | harlowja: oh yes i do, that's why i stopped working on it first | 05:06 |
| harlowja | ha | 05:06 |
| termie | nova-light will come around eventually | 05:06 |
| termie | super-nova | 05:06 |
| harlowja | i'm hoping to get some traction around state-management for it | 05:06 |
| dolphm | sunlight | 05:06 |
| harlowja | its just so much is awkward | 05:06 |
| termie | whole thing needs to be switched to a task queue | 05:07 |
| harlowja | find a for loop in nova, say in run_instance, ask yourself what happens if the for loop breaks in the middle with an exception | 05:07 |
| termie | and people need to learn about idempotency | 05:07 |
| termie | ANYWAY | 05:07 |
| termie | back to writing code | 05:07 |
| harlowja | termie: yes, i'm gonna make it my mission in life to get there | 05:07 |
| harlowja | someday i tell u | 05:07 |
| termie | harlowja: you can have free beer from me as long as you keep trying | 05:08 |
| harlowja | ha | 05:08 |
| dolphm | termie: i'm going to bed so i can talk to ttx as early as possible, if need be | 05:08 |
| harlowja | termie: not just me, i've got peps involved | 05:08 |
| harlowja | more than 1 :-p | 05:08 |
| *** SergeyLukjanov has quit IRC | 05:08 | |
| harlowja | just its like a battle to the death | 05:08 |
| harlowja | ha | 05:08 |
| harlowja | beat nova with stick | 05:09 |
| harlowja | get beaten back by nova | 05:09 |
| termie | dolphm: aighty | 05:09 |
| dolphm | o/ | 05:09 |
| termie | dolphm: i'll probably submit some patches that change the security profile of tokens | 05:09 |
| *** BalleS_ has quit IRC | 05:09 | |
| *** dolphm has quit IRC | 05:09 | |
| *** garyk has quit IRC | 05:10 | |
| *** Mandell has joined #openstack-dev | 05:10 | |
| *** hattwick has quit IRC | 05:12 | |
| harlowja | termie: https://etherpad.openstack.org/the-future-of-orch if u get bored, ha | 05:13 |
| *** jsindy has quit IRC | 05:15 | |
| *** Mandell has quit IRC | 05:17 | |
| *** ewindisch has quit IRC | 05:18 | |
| *** winston-d has joined #openstack-dev | 05:22 | |
| *** reed has quit IRC | 05:24 | |
| termie | hrmph i'm getting all kinds of weird oslo errors :/ | 05:25 |
| termie | what's the deal with all these tests failing in weird ways | 05:26 |
| harlowja | i had the same issue | 05:26 |
| harlowja | hahah | 05:26 |
| harlowja | and the deeper question is how does CI pass :-p | 05:27 |
| *** dolphm has joined #openstack-dev | 05:27 | |
| *** dolphm has quit IRC | 05:27 | |
| termie | ya mang | 05:27 |
| harlowja | i've sent markmc some questions, not really sure i know how it passes anywhere, maybe its my fault though, haha | 05:27 |
| termie | there's got to be a leak in here | 05:28 |
| harlowja | KeyError: 'AvailabilityZoneFilter' happens alot | 05:28 |
| harlowja | and stuff like that | 05:28 |
| *** jamielennox has quit IRC | 05:28 | |
| termie | and i don't want to spend a week finding it | 05:28 |
| harlowja | similar errors for u? | 05:28 |
| termie | no | 05:28 |
| termie | i get too many files open | 05:28 |
| *** sirushti_ has joined #openstack-dev | 05:28 | |
| harlowja | odd | 05:28 |
| harlowja | lol | 05:28 |
| termie | dolphm said he had it too | 05:28 |
| termie | i've already raised my ulimit | 05:28 |
| harlowja | i didn't hit that one :-/ | 05:29 |
| termie | but obviously something is leaking file descriptors somewhere | 05:29 |
| *** jamielennox has joined #openstack-dev | 05:29 | |
| termie | restarting computer just in case | 05:29 |
| harlowja | scan /proc and see which pid is doing it? | 05:30 |
| harlowja | for example, for x in `ps -ef| awk '{ print $2 }'`;do ls /proc/$x/fd|wc -l;done | 05:32 |
| *** navid_ has joined #openstack-dev | 05:34 | |
| *** olaph_ has joined #openstack-dev | 05:34 | |
| *** nati_ueno has joined #openstack-dev | 05:35 | |
| termie | hrm rebooting didn't fix | 05:36 |
| *** sirushti_ has quit IRC | 05:37 | |
| *** sirushti_ has joined #openstack-dev | 05:37 | |
| *** olaph has quit IRC | 05:37 | |
| harlowja | kill all the processes, ha | 05:37 |
| *** sirushti_ has quit IRC | 05:38 | |
| *** sirushti_ has joined #openstack-dev | 05:38 | |
| *** boris-42 has quit IRC | 05:39 | |
| *** jsindy has joined #openstack-dev | 05:41 | |
| *** sandeepr has quit IRC | 05:42 | |
| *** sandeepr has joined #openstack-dev | 05:43 | |
| *** kaushikc has quit IRC | 05:43 | |
| *** rushiagr has joined #openstack-dev | 05:44 | |
| *** gongysh has joined #openstack-dev | 05:45 | |
| *** AlanClark has quit IRC | 05:45 | |
| *** AlanClark has joined #openstack-dev | 05:45 | |
| *** koolhead17 has joined #openstack-dev | 05:46 | |
| *** garyk has joined #openstack-dev | 05:46 | |
| *** jamielennox has quit IRC | 05:47 | |
| *** jamielennox has joined #openstack-dev | 05:48 | |
| termie | this is frustrating | 05:49 |
| openstackgerrit | A change was merged to openstack/keystone: Allow trusts to be optional https://review.openstack.org/24959 | 05:49 |
| *** nati_ueno has quit IRC | 05:49 | |
| termie | kind of making the rest of the coding diffficuly | 05:49 |
| *** xchu has quit IRC | 05:49 | |
| termie | updating oslo | 05:49 |
| termie | maybe that'll help | 05:49 |
| *** yamahata has quit IRC | 05:50 | |
| *** jsindy has quit IRC | 05:50 | |
| termie | fucking damnit | 05:52 |
| termie | i hate flaky tests | 05:52 |
| *** jcmartin has quit IRC | 05:53 | |
| *** jbresnah has quit IRC | 05:54 | |
| termie | seems to be some sort of failed cleanup when a test fails | 05:54 |
| *** jbresnah_ has left #openstack-dev | 05:54 | |
| *** jbresnah has joined #openstack-dev | 05:54 | |
| termie | or not | 05:55 |
| *** koolhead17 has quit IRC | 05:56 | |
| *** Mandell has joined #openstack-dev | 05:56 | |
| *** AlanClark has quit IRC | 06:00 | |
| *** zaitcev has quit IRC | 06:01 | |
| *** jamielennox has quit IRC | 06:05 | |
| *** jamielennox has joined #openstack-dev | 06:06 | |
| *** yamahata has joined #openstack-dev | 06:06 | |
| *** dolphm has joined #openstack-dev | 06:09 | |
| *** arosen1 has quit IRC | 06:09 | |
| termie | half of these errors are now "failed to read some config files" | 06:11 |
| termie | but i assume those are part of the too many files thing | 06:11 |
| *** dolphm has quit IRC | 06:14 | |
| termie | the tests run fine individually | 06:14 |
| termie | time to push it all and let jenkins sort it out | 06:16 |
| *** jsindy has joined #openstack-dev | 06:17 | |
| termie | since apparently it is the only thing that can run these tests | 06:19 |
| *** Mandell has quit IRC | 06:22 | |
| *** yaguang has left #openstack-dev | 06:25 | |
| *** aditirav has quit IRC | 06:26 | |
| *** lloydde has quit IRC | 06:26 | |
| *** jamielennox has quit IRC | 06:26 | |
| *** aditirav has joined #openstack-dev | 06:26 | |
| *** rohitk has joined #openstack-dev | 06:26 | |
| *** jamielennox has joined #openstack-dev | 06:27 | |
| *** jsindy has quit IRC | 06:28 | |
| *** winston-d has quit IRC | 06:29 | |
| *** jasdeepH has joined #openstack-dev | 06:30 | |
| *** tonyha has joined #openstack-dev | 06:30 | |
| *** kaushikc has joined #openstack-dev | 06:32 | |
| *** danwent has quit IRC | 06:32 | |
| *** nati_ueno has joined #openstack-dev | 06:33 | |
| *** markwash has joined #openstack-dev | 06:34 | |
| *** kaushikc has quit IRC | 06:35 | |
| *** baba has quit IRC | 06:36 | |
| *** nati_ueno has quit IRC | 06:38 | |
| *** Mandell has joined #openstack-dev | 06:44 | |
| *** winston-d has joined #openstack-dev | 06:44 | |
| *** jamielennox has quit IRC | 06:44 | |
| *** jamielennox has joined #openstack-dev | 06:45 | |
| *** noslzzp has quit IRC | 06:46 | |
| *** boris-42 has joined #openstack-dev | 06:49 | |
| *** baba has joined #openstack-dev | 06:52 | |
| *** jsindy has joined #openstack-dev | 06:54 | |
| *** AlanClark has joined #openstack-dev | 06:54 | |
| termie | i wonder what these random non-public methods on the V2 and V3 keystone controllers are there fore | 06:59 |
| termie | s/fore/for/ | 06:59 |
| *** jasdeepH has quit IRC | 07:00 | |
| *** AlanClark has quit IRC | 07:00 | |
| *** manas has joined #openstack-dev | 07:00 | |
| termie | wow, these have the weirdest call sigs | 07:01 |
| *** yaguang has joined #openstack-dev | 07:01 | |
| *** jamielennox has quit IRC | 07:02 | |
| *** jamielennox has joined #openstack-dev | 07:03 | |
| *** jsindy has quit IRC | 07:03 | |
| termie | lord almighty | 07:05 |
| termie | i suspect i would have done domains much differently as well | 07:06 |
| *** winston-d has quit IRC | 07:06 | |
| *** kpavel has joined #openstack-dev | 07:08 | |
| *** BobBall has quit IRC | 07:08 | |
| openstackgerrit | A change was merged to openstack/nova: nova-manage: remove redundant 'dest' args https://review.openstack.org/23906 | 07:13 |
| *** lmatter has joined #openstack-dev | 07:21 | |
| *** psedlak has joined #openstack-dev | 07:21 | |
| *** jamielennox has quit IRC | 07:22 | |
| *** jamielennox has joined #openstack-dev | 07:22 | |
| *** adjohn has quit IRC | 07:24 | |
| *** winston-d has joined #openstack-dev | 07:25 | |
| *** alobbs has joined #openstack-dev | 07:26 | |
| *** morganfainberg has quit IRC | 07:28 | |
| *** jsindy has joined #openstack-dev | 07:30 | |
| garyk | arosen: thanks | 07:30 |
| *** lmatter has quit IRC | 07:32 | |
| *** salv-orlando has joined #openstack-dev | 07:32 | |
| *** noslzzp has joined #openstack-dev | 07:34 | |
| *** sirushti_ has quit IRC | 07:36 | |
| *** adjohn has joined #openstack-dev | 07:36 | |
| *** avishay has joined #openstack-dev | 07:37 | |
| *** adjohn has quit IRC | 07:37 | |
| *** adjohn has joined #openstack-dev | 07:38 | |
| *** henrynash has joined #openstack-dev | 07:38 | |
| *** AnilV4 has quit IRC | 07:39 | |
| *** giulivo has joined #openstack-dev | 07:40 | |
| *** jsindy has quit IRC | 07:40 | |
| *** jamielennox has quit IRC | 07:40 | |
| *** kagan has quit IRC | 07:41 | |
| *** jamielennox has joined #openstack-dev | 07:41 | |
| *** alunduil has quit IRC | 07:44 | |
| matiu | anyone know about sqlite and adding / creating columns ? | 07:47 |
| matiu | specifically if this looks good or not: | 07:47 |
| matiu | https://review.openstack.org/#/c/24418/6/nova/db/sqlalchemy/migrate_repo/versions/162_add_compute_node_spare_flag.py | 07:47 |
| matiu | the two comments | 07:47 |
| openstackgerrit | A change was merged to openstack/python-quantumclient: Improve unit tests for python-quantumclient https://review.openstack.org/23277 | 07:49 |
| *** henrynash has quit IRC | 07:50 | |
| *** gongysh has quit IRC | 07:51 | |
| *** afazekas has joined #openstack-dev | 07:51 | |
| *** thouveng has joined #openstack-dev | 07:53 | |
| *** dolphm has joined #openstack-dev | 07:54 | |
| *** davidha has joined #openstack-dev | 07:54 | |
| *** rushiagr has quit IRC | 07:54 | |
| *** mohits has quit IRC | 07:55 | |
| *** alobbs has quit IRC | 07:57 | |
| *** dolphm has quit IRC | 07:58 | |
| *** AnilV4 has joined #openstack-dev | 08:00 | |
| *** flaper87 has joined #openstack-dev | 08:00 | |
| *** SergeyLukjanov has joined #openstack-dev | 08:02 | |
| *** jamielennox has quit IRC | 08:03 | |
| *** jamielennox has joined #openstack-dev | 08:03 | |
| ttx | dolphm, termie, ayoung: I'm not exactly thrilled to make a change of this magnitude one day before RC1 and two weeks before final release -- Keystone is a pretty central piece of code and I don't want to do another Diablo | 08:05 |
| *** rafaduran has joined #openstack-dev | 08:05 | |
| *** amerine has joined #openstack-dev | 08:06 | |
| ttx | I'm ok with making small changes to make sure the future looks good though. | 08:06 |
| *** jsindy has joined #openstack-dev | 08:06 | |
| *** shang has joined #openstack-dev | 08:07 | |
| *** egallen has joined #openstack-dev | 08:08 | |
| *** iartarisi has joined #openstack-dev | 08:08 | |
| *** reidrac has joined #openstack-dev | 08:11 | |
| *** jamielennox has quit IRC | 08:11 | |
| *** romcheg1 has joined #openstack-dev | 08:12 | |
| *** alobbs has joined #openstack-dev | 08:12 | |
| *** romcheg1 has quit IRC | 08:12 | |
| *** alobbs has quit IRC | 08:13 | |
| *** romcheg1 has joined #openstack-dev | 08:13 | |
| *** romcheg1 has left #openstack-dev | 08:13 | |
| *** egallen_ has joined #openstack-dev | 08:14 | |
| *** jamielennox has joined #openstack-dev | 08:14 | |
| *** mrunge has joined #openstack-dev | 08:14 | |
| *** egallen has quit IRC | 08:15 | |
| *** egallen_ is now known as egallen | 08:15 | |
| *** jsindy has quit IRC | 08:16 | |
| *** zyluo has quit IRC | 08:21 | |
| *** jamielennox has quit IRC | 08:21 | |
| *** eglynn has quit IRC | 08:22 | |
| *** zyluo has joined #openstack-dev | 08:22 | |
| *** gongysh has joined #openstack-dev | 08:25 | |
| *** Mandell has quit IRC | 08:25 | |
| *** johnthetubaguy has joined #openstack-dev | 08:26 | |
| *** markwash_ has joined #openstack-dev | 08:27 | |
| *** markwash has quit IRC | 08:28 | |
| *** markwash_ is now known as markwash | 08:28 | |
| *** zbitter is now known as zaneb | 08:29 | |
| *** pleia2 has quit IRC | 08:30 | |
| *** kagan has joined #openstack-dev | 08:31 | |
| *** fbo has joined #openstack-dev | 08:33 | |
| *** fbo_ has joined #openstack-dev | 08:33 | |
| *** fbo has quit IRC | 08:34 | |
| *** fbo has joined #openstack-dev | 08:34 | |
| *** corXi has joined #openstack-dev | 08:36 | |
| *** zeriouz has quit IRC | 08:38 | |
| *** jsindy has joined #openstack-dev | 08:42 | |
| *** koolhead17 has joined #openstack-dev | 08:44 | |
| *** Yada has joined #openstack-dev | 08:45 | |
| *** mindpixel has joined #openstack-dev | 08:46 | |
| *** marun has quit IRC | 08:46 | |
| *** salgado has quit IRC | 08:46 | |
| *** eglynn has joined #openstack-dev | 08:51 | |
| openstackgerrit | A change was merged to openstack-dev/devstack: Accept Quantums rootwrap.conf in etc/quantum/rootwrap.conf https://review.openstack.org/24659 | 08:51 |
| *** dosaboy has joined #openstack-dev | 08:52 | |
| eglynn | ttx: quick questoin about the summit proposal system ... | 08:52 |
| eglynn | ttx: is there any way to re-assign a proposed summit session from one track to another? | 08:52 |
| *** jsindy has quit IRC | 08:53 | |
| eglynn | ttx: (the topic field doesn't appear to be editable ...) | 08:53 |
| *** adjohn has quit IRC | 08:53 | |
| *** pixelbeat has joined #openstack-dev | 08:54 | |
| eglynn | ttx: context ... after discussion with markwash & russellb, we decided that http://summit.openstack.org/cfp/details/107 is more appropriate for the nova track than glance | 08:54 |
| eglynn | ttx: could just delete and re-propose I guess ... | 08:54 |
| *** dolphm has joined #openstack-dev | 08:54 | |
| ttx | eglynn: you can ask the topic lead for the one you selected, or I can do it for you | 08:55 |
| ttx | they have the power to reassign | 08:55 |
| ttx | For that one i'll dot it for you | 08:55 |
| eglynn | ttx: great, thanks! | 08:55 |
| *** zyluo has quit IRC | 08:56 | |
| ttx | eglynn: done, please doublecheck | 08:56 |
| *** jaypipes has quit IRC | 08:56 | |
| *** winston-d has quit IRC | 08:56 | |
| eglynn | ttx: that's perfect, thank you sir! | 08:56 |
| *** darraghb has joined #openstack-dev | 08:58 | |
| *** salgado has joined #openstack-dev | 08:58 | |
| *** dolphm has quit IRC | 08:59 | |
| *** markwash has quit IRC | 08:59 | |
| *** markwash has joined #openstack-dev | 08:59 | |
| *** ndipanov has joined #openstack-dev | 09:00 | |
| *** sulo_ has joined #openstack-dev | 09:01 | |
| *** ndipanov has quit IRC | 09:01 | |
| *** salv-orlando has quit IRC | 09:01 | |
| *** tomoe_ has quit IRC | 09:01 | |
| *** ndipanov has joined #openstack-dev | 09:01 | |
| *** henrynash has joined #openstack-dev | 09:02 | |
| *** eglynn has quit IRC | 09:03 | |
| *** jpich has joined #openstack-dev | 09:05 | |
| *** doude has joined #openstack-dev | 09:08 | |
| *** rushiagr has joined #openstack-dev | 09:08 | |
| *** AlanClark has joined #openstack-dev | 09:09 | |
| *** jpich has quit IRC | 09:11 | |
| *** markwash has quit IRC | 09:12 | |
| *** koert has joined #openstack-dev | 09:12 | |
| *** jpich has joined #openstack-dev | 09:13 | |
| *** tryggvil_ has quit IRC | 09:13 | |
| *** tomoe_ has joined #openstack-dev | 09:14 | |
| openstackgerrit | A change was merged to openstack/quantum: Ensure that lockfile are defined in a common place https://review.openstack.org/24968 | 09:15 |
| *** dosaboy has quit IRC | 09:16 | |
| *** jsindy has joined #openstack-dev | 09:19 | |
| *** romcheg1 has joined #openstack-dev | 09:20 | |
| *** alobbs has joined #openstack-dev | 09:20 | |
| *** henrynash has quit IRC | 09:21 | |
| *** derekh has joined #openstack-dev | 09:21 | |
| *** Guest60252 has joined #openstack-dev | 09:23 | |
| *** adjohn has joined #openstack-dev | 09:23 | |
| *** pleia2 has joined #openstack-dev | 09:27 | |
| *** eglynn has joined #openstack-dev | 09:29 | |
| *** sirushti has quit IRC | 09:29 | |
| *** jsindy has quit IRC | 09:30 | |
| *** dosaboy has joined #openstack-dev | 09:33 | |
| *** k4n0 has joined #openstack-dev | 09:33 | |
| *** adjohn has quit IRC | 09:33 | |
| *** hattwick has joined #openstack-dev | 09:35 | |
| *** tomoe_ has quit IRC | 09:35 | |
| *** henrynash has joined #openstack-dev | 09:39 | |
| *** amotoki has quit IRC | 09:40 | |
| termie | ayoung_zzz: about all i'm going to get to tonight, wrestled with failign tests far too long and still can't run them: https://github.com/termie/keystone/compare/termie:trust_no_one...termie:oauth | 09:41 |
| termie | ayoung_zzz: (and my 7 hours is up) | 09:42 |
| *** janisg has quit IRC | 09:43 | |
| *** sirushti has joined #openstack-dev | 09:43 | |
| *** markmc has joined #openstack-dev | 09:44 | |
| *** janisg has joined #openstack-dev | 09:48 | |
| *** kagan has quit IRC | 09:49 | |
| *** danpb has joined #openstack-dev | 09:50 | |
| *** trapni has joined #openstack-dev | 09:50 | |
| *** trapni has joined #openstack-dev | 09:50 | |
| *** trapnii has joined #openstack-dev | 09:51 | |
| *** trapni has quit IRC | 09:54 | |
| *** dolphm has joined #openstack-dev | 09:55 | |
| *** jsindy has joined #openstack-dev | 09:56 | |
| *** jbr_1 has joined #openstack-dev | 09:58 | |
| *** dolphm has quit IRC | 09:59 | |
| *** jsindy has quit IRC | 10:06 | |
| *** johndescs has joined #openstack-dev | 10:09 | |
| *** mikal has quit IRC | 10:11 | |
| johndescs | hi, there is a missing ':' in stack.sh from devstack that breaks networking from within the VMs for me, should I submit such a small patch (and where) or is there anyone with push rights here? | 10:12 |
| *** mikal has joined #openstack-dev | 10:13 | |
| *** Qten has joined #openstack-dev | 10:14 | |
| *** kmartin has quit IRC | 10:16 | |
| jpich | johndescs: You can report the bug here: https://bugs.launchpad.net/devstack and if you're interested in fixing it yourself, devstack follows the same patch submission and review process as the other projects (https://wiki.openstack.org/wiki/HowToContribute) | 10:16 |
| *** AlanClark has quit IRC | 10:17 | |
| *** AlanClark has joined #openstack-dev | 10:17 | |
| *** dosaboy has quit IRC | 10:21 | |
| johndescs | jpich: okay, will do even if it sounds too much for a colon to add ;) | 10:23 |
| *** dosaboy has joined #openstack-dev | 10:23 | |
| *** zoresvit has joined #openstack-dev | 10:25 | |
| *** egallen has quit IRC | 10:30 | |
| *** jsindy has joined #openstack-dev | 10:32 | |
| jpich | johndescs: I hear you :) | 10:32 |
| *** dims has joined #openstack-dev | 10:35 | |
| *** sirushti_ has joined #openstack-dev | 10:38 | |
| *** alobbs has quit IRC | 10:39 | |
| *** rkukura has quit IRC | 10:39 | |
| *** jsindy has quit IRC | 10:44 | |
| *** anniec has joined #openstack-dev | 10:44 | |
| *** anniec_ has joined #openstack-dev | 10:47 | |
| *** sulo_ has quit IRC | 10:48 | |
| *** beagles has quit IRC | 10:49 | |
| *** anniec has quit IRC | 10:49 | |
| *** anniec_ is now known as anniec | 10:49 | |
| *** beagles has joined #openstack-dev | 10:49 | |
| *** mindpixel has quit IRC | 10:50 | |
| *** sulo_ has joined #openstack-dev | 10:51 | |
| *** rkukura has joined #openstack-dev | 10:53 | |
| *** alobbs has joined #openstack-dev | 10:53 | |
| *** sulo__ has joined #openstack-dev | 10:54 | |
| *** adjohn has joined #openstack-dev | 10:54 | |
| *** dolphm has joined #openstack-dev | 10:55 | |
| *** sulo_ has quit IRC | 10:56 | |
| *** sulo__ is now known as sulo_ | 10:56 | |
| *** adjohn has quit IRC | 10:59 | |
| *** salv-orlando has joined #openstack-dev | 10:59 | |
| *** dolphm has quit IRC | 11:00 | |
| *** yamahata_ has joined #openstack-dev | 11:01 | |
| zykes- | markmc: / mordred you guys got any eta on oslo.package ? | 11:02 |
| *** susanne-balle has joined #openstack-dev | 11:03 | |
| *** dosaboy has quit IRC | 11:03 | |
| *** afazekas has quit IRC | 11:04 | |
| *** metral has quit IRC | 11:05 | |
| *** jsindy has joined #openstack-dev | 11:09 | |
| *** metral has joined #openstack-dev | 11:10 | |
| openstackgerrit | A change was merged to openstack/python-swiftclient: Allow user to specify headers at the command line. https://review.openstack.org/24474 | 11:11 |
| *** romcheg1 has left #openstack-dev | 11:14 | |
| *** zyluo has joined #openstack-dev | 11:15 | |
| *** jsindy has quit IRC | 11:20 | |
| *** adjohn has joined #openstack-dev | 11:25 | |
| *** trapnii has quit IRC | 11:33 | |
| *** kagan has joined #openstack-dev | 11:34 | |
| *** rkukura has quit IRC | 11:36 | |
| *** AnilV4 has quit IRC | 11:37 | |
| *** trapni has joined #openstack-dev | 11:38 | |
| *** trapni has joined #openstack-dev | 11:39 | |
| *** darjeeling has joined #openstack-dev | 11:40 | |
| *** BobBall has joined #openstack-dev | 11:42 | |
| *** sride has joined #openstack-dev | 11:43 | |
| *** darjeeling has quit IRC | 11:44 | |
| *** darjeeling has joined #openstack-dev | 11:44 | |
| *** Yada has quit IRC | 11:44 | |
| *** sirushti_ has quit IRC | 11:46 | |
| *** jsindy has joined #openstack-dev | 11:46 | |
| *** doude has quit IRC | 11:49 | |
| *** almaisan-away is now known as al-maisan | 11:52 | |
| *** ttx has quit IRC | 11:53 | |
| *** ttx has joined #openstack-dev | 11:53 | |
| *** ttx has quit IRC | 11:53 | |
| *** ttx has joined #openstack-dev | 11:53 | |
| *** kagan has quit IRC | 11:54 | |
| *** dolphm has joined #openstack-dev | 11:55 | |
| *** jsindy has quit IRC | 11:58 | |
| *** zyluo has quit IRC | 11:58 | |
| *** romcheg1 has joined #openstack-dev | 11:58 | |
| *** j303 has joined #openstack-dev | 11:58 | |
| *** dolphm has quit IRC | 12:00 | |
| *** yolanda has quit IRC | 12:00 | |
| *** zoresvit1 has joined #openstack-dev | 12:01 | |
| *** mkollaro has joined #openstack-dev | 12:01 | |
| *** lloydde has joined #openstack-dev | 12:02 | |
| *** yolanda has joined #openstack-dev | 12:03 | |
| *** doude has joined #openstack-dev | 12:04 | |
| *** zoresvit has quit IRC | 12:04 | |
| *** zoresvit1 has quit IRC | 12:05 | |
| *** stevemar has joined #openstack-dev | 12:12 | |
| *** AlanClark has quit IRC | 12:17 | |
| *** soody has joined #openstack-dev | 12:18 | |
| openstackgerrit | A change was merged to openstack/nova: Bring back sexy colorized test results. https://review.openstack.org/24260 | 12:22 |
| *** sulo_ has quit IRC | 12:23 | |
| *** sulo_ has joined #openstack-dev | 12:23 | |
| *** jsindy has joined #openstack-dev | 12:24 | |
| *** pabelanger has joined #openstack-dev | 12:25 | |
| *** manas has quit IRC | 12:27 | |
| *** adjohn has quit IRC | 12:27 | |
| *** zoresvit has joined #openstack-dev | 12:28 | |
| *** digitalsanctum has joined #openstack-dev | 12:32 | |
| *** sulo_ has quit IRC | 12:32 | |
| *** sulo_ has joined #openstack-dev | 12:32 | |
| *** AlanClark has joined #openstack-dev | 12:33 | |
| *** jsindy has quit IRC | 12:36 | |
| garyk | HenryG: ping | 12:37 |
| HenryG | garyk, hi! | 12:37 |
| garyk | HenryG: hi, thanks for the review. did you see my last comment | 12:37 |
| garyk | HenryG: i do not think that what you suggest will work - this is due to the fact the the lockutils internals will catch the exception | 12:38 |
| HenryG | garyk, looking now... | 12:38 |
| garyk | thanks | 12:38 |
| *** Kharec has quit IRC | 12:39 | |
| *** pabelanger has quit IRC | 12:39 | |
| HenryG | garyk, Ah, I looked for retries but did not find them. | 12:40 |
| HenryG | So the problem now is that the user won't know what's happening. | 12:40 |
| HenryG | if an agent blocks | 12:40 |
| *** soody has quit IRC | 12:41 | |
| garyk | HenryG: agreed. If they look in the log they will know. I do not think that this suffices. Maybe a patch to oslo with exit if used will sort it out | 12:41 |
| HenryG | How about augmenting InterprocessLock with a flag to not retry? | 12:43 |
| *** Kharec has joined #openstack-dev | 12:43 | |
| garyk | HenryG: that is what I was thinking | 12:44 |
| *** anteaya has joined #openstack-dev | 12:44 | |
| *** sgordon has quit IRC | 12:45 | |
| *** yaguang has quit IRC | 12:46 | |
| *** bogdando has quit IRC | 12:49 | |
| *** bogdando has joined #openstack-dev | 12:54 | |
| *** ewindisch has joined #openstack-dev | 12:56 | |
| *** dolphm has joined #openstack-dev | 12:56 | |
| *** mestery has joined #openstack-dev | 12:57 | |
| *** mestery has quit IRC | 12:57 | |
| *** mestery has joined #openstack-dev | 12:57 | |
| *** bogdando has quit IRC | 12:58 | |
| *** dolphm has quit IRC | 13:00 | |
| *** noslzzp has quit IRC | 13:00 | |
| openstackgerrit | A change was merged to openstack/nova: nova-manage: remove unused import https://review.openstack.org/23910 | 13:02 |
| *** jsindy has joined #openstack-dev | 13:02 | |
| *** noslzzp has joined #openstack-dev | 13:03 | |
| *** lloydde has quit IRC | 13:04 | |
| *** vkmc has joined #openstack-dev | 13:07 | |
| openstackgerrit | A change was merged to openstack/nova: Don't actually connect to libvirtd in unit tests. https://review.openstack.org/24946 | 13:08 |
| *** zyluo has joined #openstack-dev | 13:09 | |
| *** jruzicka has joined #openstack-dev | 13:09 | |
| *** yamahata_ has quit IRC | 13:10 | |
| *** mjfork has quit IRC | 13:10 | |
| *** zoresvit has quit IRC | 13:12 | |
| *** aditirav has quit IRC | 13:12 | |
| *** jsindy has quit IRC | 13:13 | |
| *** aditirav has joined #openstack-dev | 13:13 | |
| *** alobbs has quit IRC | 13:16 | |
| *** aditirav has quit IRC | 13:18 | |
| *** bogdando has joined #openstack-dev | 13:19 | |
| *** jergerber has joined #openstack-dev | 13:20 | |
| *** olaph_ has quit IRC | 13:22 | |
| *** egallen has joined #openstack-dev | 13:23 | |
| *** bogdando has quit IRC | 13:24 | |
| *** woodspa has joined #openstack-dev | 13:25 | |
| *** zoresvit has joined #openstack-dev | 13:27 | |
| *** tomoe_ has joined #openstack-dev | 13:28 | |
| *** kpavel has quit IRC | 13:29 | |
| *** bknudson has joined #openstack-dev | 13:30 | |
| *** rushiagr has left #openstack-dev | 13:30 | |
| *** kbringard has joined #openstack-dev | 13:30 | |
| *** olaph has joined #openstack-dev | 13:30 | |
| *** mikor has joined #openstack-dev | 13:31 | |
| *** mikor has left #openstack-dev | 13:32 | |
| *** k4n0 has left #openstack-dev | 13:32 | |
| *** negronjl has quit IRC | 13:36 | |
| *** bogdando has joined #openstack-dev | 13:37 | |
| johndescs | jpich: https://bugs.launchpad.net/devstack/+bug/1158308 | 13:38 |
| *** mestery has quit IRC | 13:38 | |
| uvirtbot | Launchpad bug 1158308 in devstack "FLAT_INTERFACE not working" [Undecided,New] | 13:38 |
| *** mestery has joined #openstack-dev | 13:39 | |
| johndescs | should I really join the foundation etc. for that ? or is it enough like that ? | 13:39 |
| johndescs | nice bot :) | 13:39 |
| *** jsindy has joined #openstack-dev | 13:39 | |
| *** olaph has quit IRC | 13:39 | |
| *** ewindisch has quit IRC | 13:41 | |
| *** ijw has quit IRC | 13:41 | |
| *** AlanClark has quit IRC | 13:41 | |
| *** ijw has joined #openstack-dev | 13:41 | |
| *** ewindisch has joined #openstack-dev | 13:41 | |
| *** AlanClark has joined #openstack-dev | 13:41 | |
| jpich | johndescs: I guess we'll see what the devstack people think, certainly thank you for reporting a bug + providing a patch/hint for resolution :) | 13:41 |
| *** ewindisch has quit IRC | 13:42 | |
| jpich | johndescs: Until a patch is up on http://review.openstack.org though, it can't get in | 13:42 |
| vkmc | Cool johndescs, I was having problems with that too, thanks! | 13:44 |
| *** ladquin1 has joined #openstack-dev | 13:44 | |
| *** berendt has joined #openstack-dev | 13:45 | |
| berendt | can somebody have a look at http://logs.openstack.org/24986/1/check/gate-quantum-python27/5567/console.html. the build failed with a OOM and a kernel stack trace. I already triggered a recheck with the same result. | 13:45 |
| *** kpavel has joined #openstack-dev | 13:48 | |
| crazed | bknudson: hey, about https://review.openstack.org/24139 are you okay with the way the default test scenario is handled? | 13:48 |
| *** mtreinish has joined #openstack-dev | 13:48 | |
| *** ladquin1 has quit IRC | 13:48 | |
| bknudson | crazed: yes, it looks ok to me. | 13:49 |
| bknudson | so just fix the order of the imports and I'll +1 it. | 13:49 |
| crazed | awesome, thanks i'll do that now | 13:49 |
| *** sride has quit IRC | 13:49 | |
| bknudson | crazed: obviously, I wasn't looking very closely at the code, just thinking about what might be wrong... it was getting late. | 13:50 |
| *** openstackgerrit has quit IRC | 13:50 | |
| *** openstackgerrit has joined #openstack-dev | 13:50 | |
| *** rcj has joined #openstack-dev | 13:51 | |
| *** jsindy has quit IRC | 13:51 | |
| *** jimfehlig has joined #openstack-dev | 13:51 | |
| *** mestery has quit IRC | 13:51 | |
| johndescs | okay let's wait a little :) | 13:51 |
| *** cloudchimp has joined #openstack-dev | 13:52 | |
| *** mestery has joined #openstack-dev | 13:52 | |
| *** AlanClark has quit IRC | 13:52 | |
| *** radez_g0n3 is now known as radez | 13:52 | |
| *** doude has quit IRC | 13:53 | |
| *** manas has joined #openstack-dev | 13:53 | |
| *** nunosantos has joined #openstack-dev | 13:53 | |
| *** al-maisan is now known as almaisan-away | 13:54 | |
| *** adjohn has joined #openstack-dev | 13:54 | |
| *** ladquin has joined #openstack-dev | 13:55 | |
| crazed | bknudson: it's all good, it was late for me too | 13:55 |
| *** mindpixel has joined #openstack-dev | 13:56 | |
| *** jhesketh has quit IRC | 13:58 | |
| *** adjohn has quit IRC | 13:59 | |
| crazed | i'm glad we have some tests on the actual ldap connection now though | 14:00 |
| *** markmcclain has joined #openstack-dev | 14:02 | |
| *** rnirmal has joined #openstack-dev | 14:03 | |
| *** sulo_ has quit IRC | 14:04 | |
| *** avishay has quit IRC | 14:05 | |
| *** sulo_ has joined #openstack-dev | 14:05 | |
| *** voliveirajr has joined #openstack-dev | 14:05 | |
| *** mjfork has joined #openstack-dev | 14:06 | |
| *** romcheg2 has joined #openstack-dev | 14:06 | |
| *** doude has joined #openstack-dev | 14:07 | |
| *** rohitk has quit IRC | 14:08 | |
| *** mestery has quit IRC | 14:08 | |
| *** romcheg1 has quit IRC | 14:09 | |
| *** ladquin has quit IRC | 14:11 | |
| *** ladquin has joined #openstack-dev | 14:11 | |
| openstackgerrit | A change was merged to openstack/cinder: Switch all uses of 422 response code to 400. https://review.openstack.org/24125 | 14:11 |
| *** Guest60252 has quit IRC | 14:13 | |
| *** alobbs has joined #openstack-dev | 14:13 | |
| *** ewindisch has joined #openstack-dev | 14:15 | |
| johndescs | has any dev from devstack here an idea why I can find no info about DNS? it's not working out of the box for me, but I may setup a server in the dashboard afterwards | 14:16 |
| *** maksimov has joined #openstack-dev | 14:16 | |
| *** ladquin has quit IRC | 14:16 | |
| johndescs | would be nice to get it/them from resolv.conf | 14:16 |
| *** ladquin has joined #openstack-dev | 14:16 | |
| *** jsindy has joined #openstack-dev | 14:17 | |
| *** sthaha has quit IRC | 14:18 | |
| *** negronjl has joined #openstack-dev | 14:18 | |
| *** ladquin1 has joined #openstack-dev | 14:18 | |
| *** ladquin has quit IRC | 14:18 | |
| *** ladquin1 is now known as ladquin | 14:20 | |
| *** egallen has quit IRC | 14:20 | |
| *** datsun180b has joined #openstack-dev | 14:20 | |
| *** aeperezt has joined #openstack-dev | 14:22 | |
| *** dolphm has joined #openstack-dev | 14:22 | |
| *** jsindy has quit IRC | 14:23 | |
| *** jsindy has joined #openstack-dev | 14:23 | |
| *** martine has joined #openstack-dev | 14:23 | |
| *** chuck_ has joined #openstack-dev | 14:24 | |
| *** egallen has joined #openstack-dev | 14:24 | |
| *** chuck_ has quit IRC | 14:24 | |
| kenperkins | hello from rackspace via Seattle :P | 14:25 |
| *** adjohn has joined #openstack-dev | 14:25 | |
| *** chuck_ has joined #openstack-dev | 14:26 | |
| *** jbresnah has quit IRC | 14:26 | |
| *** zul has quit IRC | 14:26 | |
| *** yidclare has joined #openstack-dev | 14:26 | |
| *** jbresnah has joined #openstack-dev | 14:27 | |
| *** adjohn has quit IRC | 14:30 | |
| *** alexxu has quit IRC | 14:31 | |
| *** chuck_ is now known as zul | 14:31 | |
| *** mestery has joined #openstack-dev | 14:32 | |
| *** sagar_nikam has joined #openstack-dev | 14:34 | |
| *** rcj has quit IRC | 14:34 | |
| *** david-lyle has joined #openstack-dev | 14:37 | |
| *** megha has joined #openstack-dev | 14:37 | |
| *** baba has quit IRC | 14:37 | |
| *** primeministerp has joined #openstack-dev | 14:38 | |
| *** john5223 has joined #openstack-dev | 14:39 | |
| *** eharney has joined #openstack-dev | 14:42 | |
| *** mestery has quit IRC | 14:42 | |
| *** rkukura has joined #openstack-dev | 14:45 | |
| *** romcheg1 has joined #openstack-dev | 14:51 | |
| *** zyluo has quit IRC | 14:51 | |
| *** topol has joined #openstack-dev | 14:52 | |
| *** annegentle has joined #openstack-dev | 14:52 | |
| *** romcheg2 has quit IRC | 14:53 | |
| *** jab416171 has quit IRC | 14:55 | |
| *** adjohn has joined #openstack-dev | 14:56 | |
| *** sgordon has joined #openstack-dev | 14:57 | |
| *** devoid has joined #openstack-dev | 14:58 | |
| openstackgerrit | A change was merged to openstack/keystone: Version bump to 2013.2 https://review.openstack.org/24944 | 14:58 |
| dolphm | ayoung_zzz: henrynash: ttx: ^ | 14:59 |
| *** Yada has joined #openstack-dev | 14:59 | |
| *** ayoung has joined #openstack-dev | 14:59 | |
| *** boris-42 has quit IRC | 14:59 | |
| *** ayoung has quit IRC | 14:59 | |
| *** ayoung_zzz is now known as ayoung | 14:59 | |
| *** marun has joined #openstack-dev | 15:00 | |
| *** gargya has joined #openstack-dev | 15:00 | |
| ayoung | dolphm, and with that, rc1 is complete | 15:00 |
| dolphm | WOO | 15:00 |
| ttx | dolphm: hmm, what about the trustocalypse ? | 15:00 |
| dolphm | ayoung: thanks for approving that change last night | 15:00 |
| *** adjohn has quit IRC | 15:01 | |
| dolphm | ttx: we merged a patch to let us disable trusts with a config variable (it's enabled by default) | 15:01 |
| openstackgerrit | A change was merged to openstack/swift: Fix for attempted COPY of objects gt MAX_FILE_SIZE https://review.openstack.org/24990 | 15:01 |
| ayoung | dolphm, NP. I was thinking that a kill switch would be a decent feature even before that discussion. | 15:01 |
| ttx | dolphm: but still make it part of the v3 main api ? | 15:01 |
| ayoung | dolphm, I am writing up a comparison of auth and trusts. I'll do it as a blog post. Let me check splelling and the like and I'll send you the link when I'm done. | 15:02 |
| *** ndipanov has quit IRC | 15:02 | |
| ayoung | ttx, yes | 15:02 |
| ayoung | ttx, the kill switch is a panic button | 15:02 |
| ttx | dolphm: is termie on board with that solution for grizzly ? I don't really want him to come back today and talk you into dropping it to an extension after all, post-rc1. | 15:02 |
| ayoung | ttx, doesn't matter | 15:02 |
| ayoung | the rest of the core are aligned in the approach | 15:03 |
| ttx | i'm fine with a number of changes pre-rc1, not so much post-rc1 | 15:03 |
| dolphm | ttx: at the moment yes, termie implemented oauth last night as an alternative to consider | 15:03 |
| *** zoresvit has quit IRC | 15:03 | |
| henrynash | dolphm: ..and given we want to have a much larger discussion on Oauth etc. at the summit, I don't think pushing it now quickly is right | 15:04 |
| ttx | dolphm: so if oauth comes in havana as a replacement for the current impl for trusts, that would make a 3.1 or 4.0 api, right ? | 15:04 |
| dolphm | ttx: pretty sure he's not on board with trusts at all; if we changed trusts in grizzly at this point, i'd only want to change the URL to indicate it's an extension, and nothing more | 15:04 |
| ayoung | ttx, probably not | 15:04 |
| *** spzala has joined #openstack-dev | 15:04 | |
| ayoung | er | 15:04 |
| ayoung | probably not 4 | 15:04 |
| dolphm | ttx: that's my thinking, yes | 15:04 |
| dolphm | ttx: i expect at least 3.1 in havana, but on the same endpoint /v3/ | 15:05 |
| dolphm | henrynash: +1 | 15:05 |
| *** megha has quit IRC | 15:06 | |
| ttx | dolphm: my point is... dropping it to an extension post-rc1 would be bad. So the call you're making now should be the call for Grizzly release | 15:06 |
| ttx | i'm totally fine with your decision -- that was really too late to come up with an objection. Just making sure you understand the consequences :) | 15:06 |
| *** cp16net is now known as cp16net|away | 15:06 | |
| *** ndipanov has joined #openstack-dev | 15:06 | |
| ayoung | ttx thanks | 15:07 |
| *** gongysh has quit IRC | 15:07 | |
| dolphm | ttx: agree & understand -- it's not something i want to do | 15:07 |
| ayoung | ttx, the thing is, delegation, regardless of implementation, cannot help but touch core. | 15:07 |
| dolphm | ttx: i want to understand termie's perspective at this point | 15:07 |
| *** cp16net|away is now known as cp16net | 15:07 | |
| dolphm | ayoung: i'd disagree on that point | 15:07 |
| ayoung | dolphm, no, you wouldn't | 15:08 |
| ladquin | maurosr, around? | 15:08 |
| *** jasdeepH has joined #openstack-dev | 15:08 | |
| ayoung | because some of the change we made were at your request | 15:08 |
| ayoung | and those were changes for example | 15:08 |
| ayoung | to revoking tokens from trusts | 15:08 |
| ayoung | that logic, the ability to chain tokens, and revoke on those chains had to happen in the core controller code | 15:09 |
| ayoung | it was even refactored out of the identity controller and into the common code | 15:09 |
| *** cp16net is now known as cp16net|away | 15:10 | |
| *** cp16net|away is now known as cp16net | 15:10 | |
| *** egallen has quit IRC | 15:10 | |
| *** kmartin has joined #openstack-dev | 15:10 | |
| *** mindpixel has quit IRC | 15:11 | |
| *** megha has joined #openstack-dev | 15:11 | |
| jamespage | nijaba, hey - has ceilometer been tested with mongodb 2.4 (just released)? just pondering a late upgrade for raring. | 15:12 |
| *** gyee has joined #openstack-dev | 15:12 | |
| chmouel | jd__: ^ | 15:15 |
| *** fesp has joined #openstack-dev | 15:15 | |
| chmouel | jamespage: nijaba is traveling today i believe | 15:15 |
| jd__ | jamespage: I don't think so | 15:15 |
| *** edmund1 has joined #openstack-dev | 15:15 | |
| ttx | dolphm: cutting grizzly release branch from 4b8cab7b3753ba3de9f93175636858555d575be6 | 15:16 |
| dolphm | ttx: +1 | 15:16 |
| *** flaper87 has quit IRC | 15:16 | |
| *** fesp is now known as flaper87 | 15:16 | |
| *** flaper87 has joined #openstack-dev | 15:17 | |
| *** cp16net is now known as cp16net|away | 15:18 | |
| *** cp16net|away is now known as cp16net | 15:19 | |
| *** andrewbogott_afk is now known as andrewbogott | 15:20 | |
| jamespage | jd__, OK - thanks - I think we will defer until next release | 15:22 |
| jamespage | tbh the python driver upgrade is not even release yet :-) | 15:22 |
| *** zoresvit has joined #openstack-dev | 15:22 | |
| *** annegentle has quit IRC | 15:23 | |
| ttx | dolphm: keystone master now opened for havana development | 15:23 |
| *** koolhead17 has quit IRC | 15:24 | |
| dolphm | ttx: woot, thanks! | 15:24 |
| ttx | dolphm: will tag rc1 in a few if you don't waive any red flag | 15:24 |
| *** diogogmt has joined #openstack-dev | 15:24 | |
| *** annegentle has joined #openstack-dev | 15:24 | |
| crazed | ttx: dolphm, any chance we could get https://review.openstack.org/#/c/24139/ in there | 15:25 |
| *** n0ano has quit IRC | 15:27 | |
| *** adjohn has joined #openstack-dev | 15:27 | |
| *** agentle_ has joined #openstack-dev | 15:27 | |
| *** utlemming has quit IRC | 15:27 | |
| dolphm | crazed: i'm good with the patch if bknudson's concers are resolved, which looks to be the case | 15:28 |
| *** imsplitbit has joined #openstack-dev | 15:28 | |
| bknudson | dolphm: I looked at it and am happy with it. | 15:28 |
| *** hemna has joined #openstack-dev | 15:29 | |
| *** annegentle has quit IRC | 15:30 | |
| *** agentle_ is now known as annegentle | 15:30 | |
| *** mkerrin has joined #openstack-dev | 15:30 | |
| ttx | dolphm: if you want it in grizzly you should backport it to MP once it hits master | 15:30 |
| dolphm | ttx: will do | 15:31 |
| *** adjohn has quit IRC | 15:31 | |
| jgriffith | sdague: sadly at this point it seems the prudent thing to do is just remove support altogether | 15:31 |
| *** sacharya has joined #openstack-dev | 15:31 | |
| ttx | dolphm: adding bug 1153786 to rc1 to track that | 15:32 |
| uvirtbot | Launchpad bug 1153786 in keystone "ldap dereferencing is broken in the ldap backend" [Medium,In progress] https://launchpad.net/bugs/1153786 | 15:32 |
| sdague | jgriffith: yeh, let's see what Bradley says first (give him till the end of the day) | 15:32 |
| jgriffith | sdague: sure | 15:32 |
| *** reed has joined #openstack-dev | 15:33 | |
| *** kaushikc has joined #openstack-dev | 15:34 | |
| crazed | ttx: dolphm, sorry if i'm late/new to the development cycle, but any chance https://bugs.launchpad.net/keystone/+bug/1158077 can be handled in grizzly as well? the ability to change ldap name/id attributes is sort of broken without a way to ensure all necessary attributes are defined for say inetOrgPerson | 15:34 |
| uvirtbot | Launchpad bug 1158077 in keystone "user crud in ldap backend breaks when changing user_name_attribute and user_id_attribute" [Undecided,New] | 15:34 |
| bknudson | dolphm: keystone master now open for H development means that anything checked in now will go into H release and not G unless backported? | 15:34 |
| ttx | bknudson: yes | 15:35 |
| dolphm | crazed: i'd need to see a patch and assess it's impact | 15:35 |
| *** adjohn has joined #openstack-dev | 15:35 | |
| crazed | dolphm: okay, i wanted to get feedback on the proposed config option before attempting a patch | 15:35 |
| SpamapS | heh.. does this make any sense at all: # Log all queries (any query taking longer than 0 seconds) | 15:37 |
| *** digitalsanctum has quit IRC | 15:38 | |
| *** flaper87 has quit IRC | 15:38 | |
| *** utlemming has joined #openstack-dev | 15:39 | |
| *** digitalsanctum has joined #openstack-dev | 15:40 | |
| *** flaper87 has joined #openstack-dev | 15:42 | |
| maurosr | ladquin: hey, hi! | 15:43 |
| *** fbo has quit IRC | 15:44 | |
| *** danwent has joined #openstack-dev | 15:44 | |
| dolphm | crazed: reviewing the bug, it seems like a valuable feature, but i think it would need to stay in havana due to complexity/impact | 15:44 |
| ladquin | hi, maurosr! sorry to bother so much | 15:45 |
| dolphm | crazed: but again, can be hard to tell without a patch | 15:46 |
| maurosr | ladquin: you are not =)... so what's up? | 15:46 |
| ladquin | maurosr, yesterday I was working on documenting the os-services ext api, and I got a few doubts, perhaps you can help me with that | 15:46 |
| maurosr | sure | 15:46 |
| *** jcmartin has joined #openstack-dev | 15:47 | |
| *** doude has quit IRC | 15:47 | |
| ladquin | maurosr, as I could see, there were some patches around to fix it, as it had some inconsistencies | 15:47 |
| maurosr | indeed, few days agora | 15:48 |
| maurosr | *ago | 15:48 |
| *** alexisT has joined #openstack-dev | 15:48 | |
| ladquin | maurosr, I was testing it on my devstack and couldn't really make it work the enable/disable requests | 15:48 |
| ladquin | let me get a pastebin | 15:48 |
| vishy | jgriffith: fyi policy.py had a couple of important changes regarding getting is_admin via policy | 15:49 |
| vishy | jgriffith: you might want to grab those if you don't have them | 15:49 |
| *** devoid1 has joined #openstack-dev | 15:50 | |
| *** devoid has quit IRC | 15:50 | |
| crazed | dolphm: okay, i'll work on a patch, seems the oslo.config stuff doens't have a good way to parse the values currently though | 15:50 |
| crazed | dolphm: worse case scenario i live hack the changes i need when i upgrade to grizzly | 15:50 |
| *** iartarisi has quit IRC | 15:50 | |
| dolphm | crazed: register_list() and .split(':') each result? | 15:52 |
| dims | crazed, i'd appreciate if you could open a bug against oslo for the problem you see parsing values | 15:52 |
| dims | (pretty please) | 15:52 |
| openstackgerrit | A change was merged to openstack/nova: Change type of ssh_port option from Str to Int https://review.openstack.org/24913 | 15:52 |
| *** gargya has quit IRC | 15:52 | |
| *** gargya_ has joined #openstack-dev | 15:52 | |
| *** gargya_ is now known as gargya | 15:52 | |
| ladquin | maurosr, http://paste.openstack.org/show/34228/ tried that and many other combinations, but I always get a 404 (it works ok with the nova client) | 15:53 |
| *** adam_g has quit IRC | 15:53 | |
| maurosr | let me see | 15:53 |
| *** adam_g has joined #openstack-dev | 15:53 | |
| jgriffith | vishy: Yeah, but policy borked all the unit tests so we passed on it | 15:53 |
| crazed | dolphm: yeah i could do the split, but would be kind of cool if that was in oslo.config | 15:53 |
| dolphm | markmc: when are dicts coming to oslo.config? :D | 15:54 |
| jgriffith | vishy: That's the only one that was really significant | 15:54 |
| jgriffith | vishy: I'll take another look | 15:54 |
| markmc | dolphm, what's that mean? | 15:54 |
| maurosr | ladquin: I'll try here first... will ping you back in minutes | 15:54 |
| jgriffith | vishy: thanks for the heads up | 15:54 |
| markmc | dolphm, CONF['debug'] ? | 15:54 |
| dolphm | markmc: see the proposed config syntax in this bug https://bugs.launchpad.net/keystone/+bug/1158077 | 15:54 |
| uvirtbot | Launchpad bug 1158077 in keystone "user crud in ldap backend breaks when changing user_name_attribute and user_id_attribute" [Medium,Triaged] | 15:54 |
| dolphm | markmc: user_additional_attribute_mappings = sn:name, description:email | 15:54 |
| markmc | dolphm, when someone sends a patch :) | 15:55 |
| dims | crazed, i can fix oslo.config | 15:55 |
| dims | or at least help markmc fix it :) | 15:55 |
| ladquin | maurosr, sure, thank you! | 15:55 |
| dolphm | i wouldn't mind writing that as well, if the proposed syntax is agreeable | 15:56 |
| crazed | dims: cool, yeah i think if we supported something like option = key1:value, key2:value, etc which turned into a dict | 15:56 |
| crazed | i think the quantum ovs plugin uses a syntax similar to that | 15:56 |
| markmc | doesn't seem crazy | 15:56 |
| markmc | consider doing it as multistropt variant tho | 15:57 |
| markmc | i.e. | 15:57 |
| markmc | option = key1:value | 15:57 |
| markmc | option = key2:value | 15:57 |
| *** navid_ has quit IRC | 15:57 | |
| markmc | giving the same result | 15:57 |
| *** AlanClark has joined #openstack-dev | 15:57 | |
| crazed | ah yeah that would be nice | 15:57 |
| markmc | maybe you want both variants | 15:57 |
| dims | agree, both would be good | 15:57 |
| *** mrodden has joined #openstack-dev | 15:58 | |
| crazed | how should we proceed | 15:58 |
| dims | crazed, bug against oslo, will take a stab when i get a chance | 15:59 |
| crazed | sure | 15:59 |
| *** jdurgin1 has joined #openstack-dev | 15:59 | |
| *** Ryan_Lane has quit IRC | 15:59 | |
| *** jaybuff has joined #openstack-dev | 15:59 | |
| *** beagles is now known as beagles|lunch | 16:01 | |
| *** salgado is now known as salgado-lunch | 16:04 | |
| *** yidclare has quit IRC | 16:04 | |
| *** rohara has quit IRC | 16:05 | |
| *** blamar has joined #openstack-dev | 16:06 | |
| *** rcj has joined #openstack-dev | 16:07 | |
| *** colinmcnamara has joined #openstack-dev | 16:07 | |
| *** jcmartin_ has joined #openstack-dev | 16:08 | |
| *** jcmartin has quit IRC | 16:08 | |
| *** jcmartin_ is now known as jcmartin | 16:08 | |
| *** jaybuff has quit IRC | 16:09 | |
| *** lloydde has joined #openstack-dev | 16:10 | |
| *** roampune has joined #openstack-dev | 16:10 | |
| *** rushiagr has joined #openstack-dev | 16:10 | |
| *** reidrac has quit IRC | 16:10 | |
| *** mestery has joined #openstack-dev | 16:11 | |
| jgriffith | vishy: booo... our policy file is VERY old, we're still using enforce everywehre | 16:11 |
| *** yamahata has quit IRC | 16:11 | |
| *** koolhead17 has joined #openstack-dev | 16:12 | |
| *** colinmcnamara has quit IRC | 16:13 | |
| crazed | dims: https://bugs.launchpad.net/oslo/+bug/1158380 | 16:13 |
| uvirtbot | Launchpad bug 1158380 in oslo "oslo.config should support a means of doing options that result in dicts" [Undecided,New] | 16:13 |
| dims | crazed, thanks | 16:13 |
| *** devoid1 has quit IRC | 16:14 | |
| crazed | for the keystone changes i'd like, i'll go with a list + spit until oslo.config is ready | 16:15 |
| *** devoid has joined #openstack-dev | 16:16 | |
| *** jaybuff has joined #openstack-dev | 16:16 | |
| *** colinmcnamara has joined #openstack-dev | 16:17 | |
| *** heckj has joined #openstack-dev | 16:18 | |
| heckj | ttx, dolphm : morning - sorry, bad bus day getting into work today | 16:19 |
| *** noslzzp has quit IRC | 16:19 | |
| heckj | I heard I was "requested"? | 16:19 |
| ttx | heckj: about to cut rc1 | 16:19 |
| *** boris-42 has joined #openstack-dev | 16:20 | |
| *** anniec has quit IRC | 16:21 | |
| dolphm | heckj: o/ | 16:21 |
| dolphm | crazed: +1 | 16:21 |
| *** AlanClark has quit IRC | 16:21 | |
| ayoung | crazed, I meant to ask you on https://bugs.launchpad.net/keystone/+bug/1158077 if changing user_id actually makes sense | 16:21 |
| uvirtbot | Launchpad bug 1158077 in keystone "user crud in ldap backend breaks when changing user_name_attribute and user_id_attribute" [Medium,Triaged] | 16:21 |
| dolphm | crazed: when you've proposed a patch, open a bug that the config syntax needs to be revised | 16:22 |
| crazed | ayoung: what do you mean? | 16:22 |
| crazed | dolphm: sure thing | 16:22 |
| ayoung | crazed, typically user_id can't be changed after the user is created. At least, that is the Keystone approach | 16:23 |
| ayoung | I'll link you to the code | 16:23 |
| *** koert has quit IRC | 16:23 | |
| dolphm | crazed: ah yeah, you shouldn't be able to change user id -- name is mutable though | 16:23 |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/identity/controllers.py#L213 | 16:24 |
| crazed | ah yeah, i agree, which is why my dn for users is uid=blah,ou=users,dc=example,dc=net, | 16:24 |
| ayoung | and then enforced in the backend | 16:24 |
| *** jab416171 has joined #openstack-dev | 16:24 | |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql.py#L686 | 16:25 |
| ayoung | crazed, so what is the problem that you are seeing? | 16:25 |
| ttx | dolphm: could you summarize your call on trusts to heckj, so that we are all on the same page ? | 16:25 |
| crazed | i'm not trying to allow user id changes, just telling keystone to check a different attribute in ldap | 16:25 |
| *** alop has joined #openstack-dev | 16:25 | |
| *** trapni has quit IRC | 16:25 | |
| crazed | the problem is when searching for a user by id, it does something like %(user_id_attribute)s=%(user_id),%(user_tree_dn) | 16:26 |
| dolphm | ttx: sure... | 16:26 |
| crazed | so to work with existing schemas you need to be able to change the user_id_attribute | 16:27 |
| dolphm | termie isn't a fan of the trusts api or implementation, and wants to see them moved to an extension so that he can propose an alternative extension based on oauth | 16:27 |
| *** yamahata has joined #openstack-dev | 16:27 | |
| ayoung | heckj, it was an interesting night.... | 16:27 |
| heckj | sounds like it | 16:27 |
| ttx | a loong one. | 16:27 |
| dolphm | i proposed (and ayoung merged) a patch to add a feature flag for trusts | 16:28 |
| heckj | I caught some of termie's "feedback" when I was in mountainview last week before PyCon | 16:28 |
| dolphm | we discussed defaulting that feature flag to 'off' so that we could say the feature was beta, and would either be reworked in v3.1 or moved to an extension | 16:28 |
| dolphm | ayoung is quite opposed to that, and i'll certainly admit it's VERY late to have that discussion | 16:29 |
| *** jaybuff has quit IRC | 16:29 | |
| ttx | i'm fine with whatever option as long as the call is made before rc1 and sticks (and does not involve completely ripping the work that was done out) | 16:29 |
| heckj | since I'm blessed (or cursed myself with) a fairly external perspective on this work, here's what I'm seeing: | 16:29 |
| dolphm | ttx: i'm definitely opposed to ripping out the work, if only because of the massive code change and impact on stability | 16:29 |
| *** alobbs has quit IRC | 16:30 | |
| heckj | We rushed an API that didn't get a lot of review into the release, requesting a FFE for it. We got it in, and it's tentacles reach fairly deep. We have a lot of competing opinions on how we could do this, and while trusts was on the books for months, we didn't see anything concrete on it until the few weeks prior to RC freeze. We don't have much feedback or idea on how this API will work in practice, only in tests and bare documentation. | 16:31 |
| dolphm | this is beside the point, but i'll share anyway: my opinion on the trust api is that it could be simplified drastically, but that would also mean cutting the fact that trusts automatically expire, and the fact that trusts have unique identifiers -- ayoung argued against both awhile back and i gave up | 16:31 |
| dolphm | heckj: that's an accurate perspective, imo | 16:32 |
| heckj | At any other time, I'd say we should switch and make it an extension, but it's not clear that doing so will A) be easy and B) no introduce a bunch of instability issies. Dolph's added the feature_flag mechanism to enable/disable- which means I fucked up asking for a FFE earlier in the process, and we should have deferred this work entirely since it was so late | 16:32 |
| heckj | My primary goal is not to screw up the stability of the current release, | 16:33 |
| dolphm | heckj: the patch to make it an extension could be as simply as changing the url it operates on ... the rest is docs | 16:33 |
| ttx | agree that the FFE was borderline and is biting us now | 16:34 |
| heckj | It's pretty clear we're going to want to rev the v3 API as well - at least tweak here and there - and we want to make sure we have teh core totally forwards compatible | 16:34 |
| kbringard | would someone on the stable core team mind taking a peek at: https://review.openstack.org/#/c/24170/ ? | 16:34 |
| heckj | ttx: my bad on the FFE | 16:35 |
| ayoung | Would it make sense to mark the V3 API as Beta? | 16:35 |
| *** shang has quit IRC | 16:35 | |
| *** jcmartin has quit IRC | 16:35 | |
| heckj | ayoung: marking it as such wouldn't help or hurt this - it's just a label, and I think we're all considering it beta until it's well proven as a default in the system | 16:35 |
| kbringard | for favor :-) | 16:35 |
| kbringard | markmc: ^^ :-D | 16:35 |
| *** jcmartin has joined #openstack-dev | 16:35 | |
| ayoung | The reason we got the FFE in the first place was due to the late submission of the V3 api. V3 is pretty new. | 16:35 |
| *** alobbs has joined #openstack-dev | 16:36 | |
| dolphm | v3 auth specifically | 16:36 |
| heckj | ayoung: yeah, and we piled a lot into that very late in the game. Bad game plan | 16:36 |
| heckj | ayoung: I think we'd be better shifting this URL (if that's really that easy) and calling this an extension, with the knowledge that we'll likely want to rev all of V3 to a V3.1 based on all the feedback we've seen recently. | 16:37 |
| *** sagar_nikam has quit IRC | 16:37 | |
| ayoung | V3 across the board has not been deeply adopted | 16:37 |
| dolphm | adopted, no | 16:37 |
| ttx | better move it to an extension before it's actually used by anybody. | 16:37 |
| heckj | My perception is that it was because we delayed in defining V3 Auth and getting that out the door | 16:37 |
| dolphm | heckj: on a v3.1 rev -- it should be backwards compatible with v3, else it's v4 | 16:38 |
| ayoung | We saw what happened in auth_token middleware when we tried to switch over to it | 16:38 |
| heckj | dolphm: yes, 100% | 16:38 |
| dolphm | heckj: that's accurate | 16:38 |
| *** mrodden has quit IRC | 16:38 | |
| ayoung | I don't know if things are using V3 policy or Catalog yet or not | 16:39 |
| *** mrodden has joined #openstack-dev | 16:39 | |
| heckj | ayoung: I'm not 100% sure what you mean with the "we saw what happened", but my perception is that these changes are nessecarily slow - and having trusts as core, seems unnescarily risky when we could get the 100% benefit from that code and system the same as an extension | 16:39 |
| ayoung | I'm OK with the trust implementation changing in the future. What I don't think we want to do is leave ourselves without any delegation mechanism at all. | 16:39 |
| heckj | nothing is using the policy mechanims yet - that requires changes to all the other projects to both register and retrieve policy (although they do have autoloading in most of the projects) | 16:40 |
| heckj | ayoung: I agree - which is why I don't want to rip out the code, but I do want to see it as an "extension" | 16:40 |
| ayoung | To be honest, it would have been better to have written it as an extension back in October. I still think it would have required changes to the core token API, but those would have been limited. | 16:40 |
| heckj | sounds like we're on the same page | 16:40 |
| ayoung | People could have begun developing against trusts in parallel, and then it would have gotten promoted. | 16:41 |
| ayoung | Not quite | 16:41 |
| maurosr | ladquin: I'm still trying, so far one problem is the url is /os-services not /services | 16:41 |
| *** sandeepr has quit IRC | 16:41 | |
| ayoung | we have to state that the feature is there. People need to be able to reliably build on it | 16:41 |
| *** shang has joined #openstack-dev | 16:41 | |
| *** sandeepr has joined #openstack-dev | 16:42 | |
| ladquin | maurosr, yeah, sorry that was one of my tries, os-services did not work neither | 16:42 |
| ayoung | if we state is an extension, are we stating merely that the API might change, or that we reserve the right to remove the feature all together? | 16:42 |
| maurosr | ok.. let me try few more things | 16:42 |
| ayoung | We have a kill switch if the feature proves to be horribly broken | 16:42 |
| *** zoresvit has quit IRC | 16:42 | |
| ttx | ayoung: not really. We can't pass a default change in a stable release update | 16:43 |
| ayoung | I actually was wondering if we needed that before dolph proposed it | 16:43 |
| ttx | so the default (disabled or enabled) will stick | 16:43 |
| ayoung | ttx, so is there really any difference to saying it is part of V3 versus /extensions? | 16:43 |
| ttx | it's just giving us a workaround | 16:43 |
| heckj | ayoung: extension doesn't mean we'll be ripping it out entirely, extension effectively means that as we rev the API we can potentially make significant (non-backwards compatible) changes to the extnesion APIs. In practice, that's rarely i ever done (see Nova's almost-critically-needed extensions) as an example | 16:43 |
| *** devoid has quit IRC | 16:44 | |
| *** jaybuff has joined #openstack-dev | 16:44 | |
| ttx | "it's broken! please all settrusts_enable=False now ! | 16:44 |
| *** hemna has quit IRC | 16:44 | |
| *** hemna has joined #openstack-dev | 16:44 | |
| ayoung | ttx, understood. | 16:45 |
| ttx | extension is giving us lower API compatibility constraints | 16:45 |
| dolphm | heckj: ayoung: ttx: haven't tested this at all, but something like https://review.openstack.org/#/c/25019/ | 16:45 |
| heckj | ttx: yes, exactly | 16:45 |
| ttx | i.e. leaves more options open for havana | 16:45 |
| *** imsplitbit has quit IRC | 16:45 | |
| heckj | dolphm: yeah - with appropriate trusts updated and such | 16:46 |
| heckj | er, tests - that was fruedian, wasn't it | 16:46 |
| dolphm | probably | 16:46 |
| ayoung | Ha | 16:46 |
| dolphm | there's some test changes included, i'm not sure what else would be required | 16:46 |
| ayoung | dolphm, the API doc | 16:46 |
| dolphm | ayoung: i'll tackle that as well | 16:46 |
| ttx | ayoung: I feel a bit bad given how much work you poured into this... the later your work goes in, the more vulnerable you are to this kind of... last-minute change | 16:46 |
| ayoung | ttx, so, here 's why I think that this is so important | 16:47 |
| ayoung | and I am ok with having some wiggle room | 16:47 |
| ayoung | we need to commit to getting rid of bearer tokens | 16:47 |
| ayoung | right now, there is no way around that | 16:47 |
| ttx | (if it had been in at an early milestone we wouldn't even have that discussion) | 16:47 |
| ayoung | we need some delegation mechanism to do that | 16:47 |
| ayoung | but the work to get rid of them is Havana stuff | 16:48 |
| dolphm | my philosophy is that i write disposable code; it will inevitably be refactored, deprecated or fixed :) | 16:48 |
| ayoung | that is beyond the HEAT use case | 16:48 |
| ayoung | and the other people that need it now | 16:48 |
| ttx | dolphm: rarely two weeks after you write it, though ;) | 16:48 |
| dolphm | ttx: i'd argue that it's most likely within two weeks :P | 16:48 |
| ayoung | that was why I wanted it for V2 tokens, because I want people to be able to use it in existing systems unchanged | 16:48 |
| ayoung | If the API changes in Havana, that will have minimal impact | 16:49 |
| ayoung | If the base concepts change (like the unique ID thing) that probably will have more impact | 16:49 |
| ayoung | using Oauth as the mechanism should be deployable along side | 16:49 |
| ayoung | So, changing the URL, no big deal at all. Personally, I want more discoverability in how we organize URLs anywya | 16:50 |
| * ayoung tired...it was later for me than the people on the West Coast when this was discussed | 16:50 | |
| ayoung | but not committing to the base concept now hamstrings us | 16:50 |
| *** shang has quit IRC | 16:51 | |
| *** swaT30 has quit IRC | 16:52 | |
| ayoung | ttx, probably the biggest follow on to this work will be adding support for delegation into the Python Keystone client | 16:52 |
| ayoung | THat has not even started. | 16:52 |
| *** beagles|lunch is now known as beagles | 16:52 | |
| *** rushiagr has quit IRC | 16:52 | |
| *** Mandell has joined #openstack-dev | 16:53 | |
| ayoung | The unfortunate side effect of that is that we don;'t have control over what the consumers of delegation will do, they will have to consume it directly from the Web API for now | 16:53 |
| ttx | ayoung: I don't think anyone doesn't agree that the base concept is worth it | 16:53 |
| heckj | ayoung: you're absolutely right, we should have put this in as an extension way back in october to get the new concepts available for immediate use. We didn't, that was poor on our end. Let's keep this in as an extension, enabling the ability to move beyond bearer tokens in fact as well as concept, and get some more implementations in that can leverage and use it forward | 16:53 |
| *** alobbs has quit IRC | 16:53 | |
| *** tomoe_ has quit IRC | 16:53 | |
| *** tomoe_ has joined #openstack-dev | 16:53 | |
| ayoung | heckj, lesson learned. | 16:54 |
| *** alobbs has joined #openstack-dev | 16:54 | |
| ttx | heckj: Given our current time constraints it sounds like a good trade-off | 16:54 |
| *** yidclare has joined #openstack-dev | 16:54 | |
| *** andreaf has joined #openstack-dev | 16:55 | |
| ayoung | ttx, that said, we should rethink our versioning strategy. There are other approaches that putting /v3 in the URL, and I think that this feature here shows exactly why. | 16:55 |
| zul | ttx: it would make people nag you less ;) | 16:55 |
| heckj | dolphm: you've got one patch in flight, ayoung would you review and see if that's missing anything? I'll lurk and try and stay available today to help usher it through so we don't keep ttx up until his 2am | 16:55 |
| ayoung | That would be a good summit session | 16:55 |
| *** swaT30 has joined #openstack-dev | 16:55 | |
| ayoung | heckj, link? | 16:55 |
| heckj | ayoung: yeah, it would | 16:56 |
| heckj | ayoung: https://review.openstack.org/#/c/25019/ | 16:56 |
| heckj | dolphm: you can to run through and update the API docs as well? | 16:56 |
| openstackgerrit | A change was merged to openstack/oslo.config: Improve test cases for boolean values https://review.openstack.org/24851 | 16:56 |
| *** shang has joined #openstack-dev | 16:56 | |
| *** cp16net is now known as cp16net|away | 16:56 | |
| dolphm | heckj: almost doen with that | 16:57 |
| henrynash | dolphm: RH-TRUSTS..what does the RH stand for? | 16:57 |
| heckj | ttx: so it sounds like we'll shift the URL on this, update the docs, and then I think we'll be ready for an RC1 cut | 16:57 |
| ayoung | dolphm, gonna see if Jenkins likes it. No surprise in the coding. Not sure if I should object to the RH- or consider it a marketing ploy. | 16:57 |
| ayoung | REaly Handy | 16:57 |
| heckj | heh | 16:58 |
| ayoung | Round Here | 16:58 |
| henrynash | ayoung: ha! | 16:58 |
| ayoung | Radical Harmony! | 16:58 |
| ttx | heckj: I'll be back in ~4 hours to check if you're ready by then, otherwise we can cut early tomorrow | 16:58 |
| henrynash | ayoung: Roughly Harmonious | 16:58 |
| dolphm | ayoung: the convention is to use your company, especially when there could be competing impls | 16:58 |
| *** xga has joined #openstack-dev | 16:58 | |
| ayoung | dolphm, advertising it ! | 16:58 |
| ttx | heckj, dolphm: note that since the grizzly branch was cut you'll need to backport everything to milestone-proposed | 16:58 |
| ttx | bad timing | 16:58 |
| henrynash | dolphm: ah, didn't know that | 16:59 |
| heckj | henrynash: started w/ the RAX- extensions... | 16:59 |
| dolphm | heckj: ayoung: ttx: identity-api WIP https://review.openstack.org/25022 | 16:59 |
| *** sandeepr has quit IRC | 17:00 | |
| gyee | dolphm, you may want to move the trust scoping to RH as well | 17:00 |
| ttx | dolphm: i don't care that much about identity-api, can land post-rc1 | 17:00 |
| ayoung | You know, if this had just been done earlier, I would actually be thrilled with it. | 17:00 |
| dolphm | gyee: i was going to ask about that | 17:00 |
| dolphm | gyee: i think changing the request body is *really* ugly but i see the value | 17:00 |
| *** mlavalle has joined #openstack-dev | 17:01 | |
| *** terry7 has joined #openstack-dev | 17:01 | |
| adam_g | vishy, ping | 17:01 |
| gyee | dolphm, unless you want a RH auth api | 17:01 |
| vishy | adam_g: sup? | 17:01 |
| *** markmc has quit IRC | 17:01 | |
| *** yidclare has quit IRC | 17:01 | |
| dolphm | gyee: i'd rather not lol | 17:01 |
| adam_g | vishy, just stumbled on this, https://review.openstack.org/#/c/15791/ do you know if there were any similar changes in nova that would have triggered https://bugs.launchpad.net/python-glanceclient/+bug/1157864 ? | 17:02 |
| uvirtbot | Launchpad bug 1157864 in python-glanceclient "Requests to https server can yield WantReadError" [Undecided,In progress] | 17:02 |
| *** cp16net|away is now known as cp16net | 17:02 | |
| *** esp has joined #openstack-dev | 17:02 | |
| *** adjohn has quit IRC | 17:03 | |
| vishy | adam_g: no that one is new to me | 17:03 |
| *** yidclare has joined #openstack-dev | 17:03 | |
| *** annegentle has quit IRC | 17:04 | |
| vishy | it should have been monkeypatched form the beginning | 17:04 |
| *** yidclare has quit IRC | 17:04 | |
| vishy | I think the ssl support was added recently so that might be what triggered it | 17:04 |
| *** adjohn has joined #openstack-dev | 17:04 | |
| *** thouveng has quit IRC | 17:05 | |
| adam_g | vishy, ah | 17:05 |
| *** yidclare has joined #openstack-dev | 17:05 | |
| ayoung | dolphm, gyee would it be possible to do what gyee suggested? | 17:05 |
| ayoung | IE | 17:05 |
| ayoung | something like /RH-TRUSTS/auth | 17:05 |
| *** jsindy has quit IRC | 17:06 | |
| dolphm | ayoung: that would require way more than just adding to a few paths | 17:07 |
| ayoung | and then reuse the auth controller, but add a parameter in init that allows trusts for /RH-TRUST and does not for /v3/auth? | 17:07 |
| *** romcheg1 has left #openstack-dev | 17:07 | |
| gyee | ayoung, I know you wanted that, PKI token? wink wink | 17:07 |
| *** mestery has quit IRC | 17:07 | |
| ayoung | heh | 17:07 |
| ayoung | dolphm, yeah...but even if we just duplicated it with no change | 17:08 |
| dolphm | ayoung: a copy/paste of the entire code path? | 17:08 |
| ayoung | but in the documentation stated "use RH-TRUST" for getting a trust token | 17:08 |
| *** jog0 has joined #openstack-dev | 17:08 | |
| ayoung | dolphm, just add the auth router entries to the trust router | 17:08 |
| *** gargya has quit IRC | 17:09 | |
| dolphm | gyee: diff patchset 3 and 2 https://review.openstack.org/#/c/25022/ | 17:09 |
| *** SergeyLukjanov has quit IRC | 17:09 | |
| *** colinmcnamara has quit IRC | 17:10 | |
| ayoung | dolphm, since this really is a "what we are committing to" issue, we can state that , while getting a trust based token from /auth will work, it is not expected to be supported in the future. We can even open a bug for it. | 17:10 |
| *** jruzicka has quit IRC | 17:10 | |
| ayoung | perhaps disabling between RC1 and RC2 if permitted? | 17:11 |
| *** lmatter has joined #openstack-dev | 17:11 | |
| ayoung | henrynash, heckj, gyee does ^^ agree with you guys? duplicate /auth into /RH-TRUSTS and document only the second URL is supported for getting tokens from trusts? | 17:12 |
| gyee | ayoung, sure | 17:13 |
| *** garyk has quit IRC | 17:14 | |
| maurosr | ladquin: hey take a look http://paste.openstack.org/show/34236/ | 17:14 |
| maurosr | ladquin: it's a PUT method =) | 17:14 |
| *** Yada has quit IRC | 17:14 | |
| *** mkerrin has quit IRC | 17:15 | |
| ladquin | maurosr, right! | 17:15 |
| ladquin | maurosr, never thought of specifying that... ! | 17:15 |
| *** jruzicka has joined #openstack-dev | 17:16 | |
| maurosr | ladquin: yeah.. I was trying it using post... just realized when I checked the api_samples.py. and couldn't find it lokking for _post('os-services') | 17:16 |
| *** jaybuff has left #openstack-dev | 17:16 | |
| *** mkerrin has joined #openstack-dev | 17:16 | |
| ladquin | maurosr, sorry for wasting your time on this, I thank you a ton | 17:17 |
| ladquin | the doc patch is ok then | 17:17 |
| maurosr | ladquin: np.. I'm glad to help =) | 17:18 |
| ladquin | obrigada! | 17:19 |
| ayoung | dolphm, you must be tired, too. you are spilling our dev conversation over to #openstack | 17:20 |
| ayoung | dolphm, so, do you want to duplicate the auth urls? I defer to you on that one | 17:21 |
| *** cp16net is now known as cp16net|away | 17:21 | |
| *** markmcclain has quit IRC | 17:22 | |
| *** jdurgin1 has quit IRC | 17:22 | |
| *** cp16net|away is now known as cp16net | 17:23 | |
| *** mestery has joined #openstack-dev | 17:24 | |
| *** salgado-lunch is now known as salgado | 17:24 | |
| *** colinmcnamara has joined #openstack-dev | 17:25 | |
| *** yidclare has quit IRC | 17:27 | |
| dolphm | and ideally in middleware | 17:27 |
| *** dolphm has quit IRC | 17:27 | |
| *** yidclare has joined #openstack-dev | 17:29 | |
| *** bdpayne has quit IRC | 17:30 | |
| *** Ryan_Lane has joined #openstack-dev | 17:31 | |
| *** mohits has joined #openstack-dev | 17:31 | |
| *** bdpayne has joined #openstack-dev | 17:31 | |
| gyee | dolphm, ayoung, I missed most of the conversation about trust is broken | 17:31 |
| gyee | what's actually broken? its not solving the use cases we have? it have a security hole or what? | 17:31 |
| *** rmohan has quit IRC | 17:31 | |
| *** rmohan has joined #openstack-dev | 17:33 | |
| *** rmohan has quit IRC | 17:34 | |
| *** rmohan has joined #openstack-dev | 17:35 | |
| *** rmohan has quit IRC | 17:35 | |
| *** rmohan has joined #openstack-dev | 17:35 | |
| *** rushiagr has joined #openstack-dev | 17:36 | |
| *** andrewbogott is now known as andrewbogott_afk | 17:36 | |
| ayoung | gyee, nothing is broken. The concern is that is a very new feature, and it might need some more trial and error to get 100% correct, so they want to move the API out of /v3 and into /RH-TRUSTS. | 17:37 |
| *** olaph has joined #openstack-dev | 17:37 | |
| *** retr0h has quit IRC | 17:38 | |
| ayoung | The good news there is that it means trusts can change without breaking the V3 contract. The bad news is that Trusts itself has no versioning yet. But it is a trade off | 17:38 |
| *** retr0h has joined #openstack-dev | 17:38 | |
| *** retr0h has joined #openstack-dev | 17:38 | |
| *** romcheg1 has joined #openstack-dev | 17:39 | |
| ayoung | gyee, so I'll just have to do something like this: http://stackoverflow.com/questions/12037476/versioning-a-restful-api-with-both-xml-and-json-content-type | 17:39 |
| *** rmohan has quit IRC | 17:40 | |
| *** rmohan has joined #openstack-dev | 17:40 | |
| gyee | ayoung, yeah, sounds good | 17:40 |
| *** torandu has quit IRC | 17:40 | |
| *** rmohan has quit IRC | 17:40 | |
| *** rmohan has joined #openstack-dev | 17:41 | |
| *** torandu has joined #openstack-dev | 17:41 | |
| *** berendt has quit IRC | 17:41 | |
| gyee | ayoung, or you can version the trust itself | 17:42 |
| ayoung | gyee, heh...I guess I can always add a version field on there, but I think that might be a bit overkill | 17:42 |
| *** dontalton has joined #openstack-dev | 17:42 | |
| gyee | ayoung, actually not overkill | 17:43 |
| ayoung | I'd be more likely to do a migration for trusts and then to either remove old ones or upgrade them | 17:43 |
| ayoung | right now they are all in a single system | 17:43 |
| gyee | if you version the trust, you are free to make major changes | 17:43 |
| *** mrunge has quit IRC | 17:43 | |
| ayoung | Until we do trusts with crypto signatures, they won't be usable outside a single keystone system | 17:43 |
| dims | ayoung, adding version to Accept or new content-type? | 17:44 |
| gyee | {"trust": {"id":"blah", "version":"1", "data":"whatever"}} | 17:44 |
| ayoung | dims, I don't know. I'll burn that particual barn when I decide I've freed all the livestock over the bridge? | 17:44 |
| dims | lol | 17:45 |
| dims | :) | 17:45 |
| * dims is just being curious and nosy | 17:45 | |
| ayoung | dims, want to see something that should pique your curiostiy even more? | 17:45 |
| dims | ayoung, sure | 17:46 |
| *** SergeyLukjanov has joined #openstack-dev | 17:46 | |
| *** manas has quit IRC | 17:46 | |
| ayoung | dims, https://review.openstack.org/#/c/24443/ | 17:46 |
| *** garyk has joined #openstack-dev | 17:46 | |
| openstackgerrit | A change was merged to openstack/swift: instruction command was not documented in right format. https://review.openstack.org/24996 | 17:46 |
| *** jbresnah has quit IRC | 17:47 | |
| dims | ayoung, what no use of xsl? :) | 17:48 |
| *** jbresnah has joined #openstack-dev | 17:48 | |
| ayoung | dims, oh no | 17:48 |
| ayoung | not for baseline | 17:48 |
| dims | ayoung, kidding :) | 17:48 |
| ayoung | that is a deployment decision | 17:48 |
| *** hemna has quit IRC | 17:48 | |
| *** jpich has quit IRC | 17:48 | |
| *** hemna has joined #openstack-dev | 17:48 | |
| ayoung | dims, the idea is that we provide a place holder for CSS and Javascript files, and then it is up to the deployer how to render it | 17:48 |
| dims | ayoung, this would be very handy | 17:49 |
| ayoung | I know | 17:49 |
| ayoung | dims, I've walked down this road a time or two before | 17:49 |
| ayoung | Add in CORS support and bam | 17:49 |
| dims | what i like is the auto-discovery aspects of it | 17:49 |
| ayoung | dims, yeah, I think this whole REST HATEOAS thing might just have some legs to it | 17:50 |
| *** lglenden has joined #openstack-dev | 17:50 | |
| *** romcheg1 has left #openstack-dev | 17:51 | |
| sdague | dtroyer: you about? was hoping you'd submit a Grenade session into the QA track at summit, as would really like to figure out how to get that into the QA normal workflow | 17:52 |
| *** Brad_K has joined #openstack-dev | 17:52 | |
| *** Brad_K has joined #openstack-dev | 17:52 | |
| *** Brad_K has quit IRC | 17:52 | |
| *** eglynn has quit IRC | 17:53 | |
| *** Brad_K has joined #openstack-dev | 17:53 | |
| *** Brad_K has joined #openstack-dev | 17:53 | |
| *** andrewbogott_afk is now known as andrewbogott | 17:54 | |
| dims | ayoung, we had a system where the inital GET would throw a WWW-Authenticate challenge and would respond back with a list of available services and you could then turn around and call each service to poke around (all json, no html rendering) | 17:54 |
| *** lmatter has quit IRC | 17:55 | |
| *** zzs has joined #openstack-dev | 17:56 | |
| *** Ryan_Lane has quit IRC | 17:56 | |
| ayoung | dims, I think that technically that is the letter of the HTTP spec | 17:56 |
| dims | ayoung, thanks for sharing | 17:56 |
| ayoung | dims, feel free to contribute. Input, code, snide comments, beer.... | 17:57 |
| *** mrodden1 has joined #openstack-dev | 17:57 | |
| * gyee love to do beer review | 17:58 | |
| dims | well, i can promise the last one :) at portland | 17:58 |
| *** derekh has quit IRC | 17:58 | |
| *** mrodden has quit IRC | 17:59 | |
| dims | gyee, sounds good :) will find you too | 17:59 |
| *** sulo_ has quit IRC | 17:59 | |
| *** rushiagr has quit IRC | 18:00 | |
| davidkranz | ttx: Any chance we could beg another slot for QA? | 18:00 |
| ayoung | heckj, you still around? | 18:01 |
| *** woodspa_ has joined #openstack-dev | 18:01 | |
| heckj | yep - lurking while I'm in meetings at the office | 18:02 |
| *** edmund2 has joined #openstack-dev | 18:02 | |
| *** morganfainberg has joined #openstack-dev | 18:02 | |
| ayoung | heckj, do you think we should duplicate the /auth URLS under /RH-TRUSTS? I wasn't clear on doph's response, and don't want to pull the trigger on his patch yet | 18:02 |
| *** shardy is now known as shardy_afk | 18:03 | |
| *** mrodden1 has quit IRC | 18:03 | |
| *** mrodden has joined #openstack-dev | 18:03 | |
| heckj | I need to read deeper to have a sense | 18:03 |
| *** lmatter has joined #openstack-dev | 18:03 | |
| *** Mandell has quit IRC | 18:04 | |
| ayoung | heckj, basically, to use trusts, even with the CRUD moving to /RH-TRUSTS means a change to POST /auth/tokens | 18:04 |
| ayoung | As an interim change we can | 18:04 |
| *** andreaf has quit IRC | 18:04 | |
| ayoung | duplciate all of /v3/auth urls into /RH-TRUSTS | 18:04 |
| ayoung | and state only those will be supported for creating tokens from trusts | 18:04 |
| *** woodspa has quit IRC | 18:05 | |
| *** kpavel has quit IRC | 18:05 | |
| ayoung | Then, in RC2 if allowed, we can explicitly disallow using /auth/tokens to create a token from a trust | 18:05 |
| *** danwent_ has joined #openstack-dev | 18:05 | |
| *** devoid has joined #openstack-dev | 18:06 | |
| *** edmund1 has quit IRC | 18:06 | |
| *** danwent has quit IRC | 18:06 | |
| *** danwent_ is now known as danwent | 18:06 | |
| openstackgerrit | A change was merged to openstack/oslo-incubator: Remove detailed-errors from setup.cfg. https://review.openstack.org/25015 | 18:07 |
| *** dolphm has joined #openstack-dev | 18:08 | |
| *** jbresnah has quit IRC | 18:08 | |
| gyee | ayoung, its a conspiracy, you actually want trust tokens to be kerberos :) | 18:08 |
| *** mestery has quit IRC | 18:08 | |
| ayoung | gyee, yeah, right, sure. | 18:09 |
| ayoung | I just want bearer tokens to go away | 18:09 |
| ayoung | the rest is commentary | 18:09 |
| *** rushiagr has joined #openstack-dev | 18:09 | |
| *** xga_ has joined #openstack-dev | 18:10 | |
| *** imsplitbit has joined #openstack-dev | 18:10 | |
| *** mestery has joined #openstack-dev | 18:10 | |
| heckj | ayoung: sorry for the delays - running a meeting elsewhere at the same time, hard to split attention | 18:11 |
| *** eglynn has joined #openstack-dev | 18:11 | |
| *** xga has quit IRC | 18:11 | |
| heckj | ayoung: seems reasonable to move them, but I get all itchy/scratchy about just replicating the code, and I haven't read through /auth and what happens under it right now | 18:11 |
| ayoung | heckj, so it wouldn't be replicating code, just dding additional entries into the routers | 18:12 |
| ayoung | heckj, I'll just add it to the patch...easy enough to rip out again later | 18:12 |
| heckj | ayoung: cool | 18:12 |
| *** branen has quit IRC | 18:13 | |
| *** alobbs has quit IRC | 18:13 | |
| dolphm | ayoung: updated patch -- don't know how i missed those failures | 18:13 |
| ayoung | dolphm, do you want the /auth routes duplicated? Wasn't clear from your last if you agree | 18:14 |
| *** alobbs has joined #openstack-dev | 18:14 | |
| dolphm | ayoung: i wrapped the scope request and response in RH-TRUST instead which is a bit more low impact and simpler to implement at this point | 18:15 |
| ayoung | dolphm, looking | 18:15 |
| *** rushiagr has quit IRC | 18:16 | |
| ayoung | dolphm, OK, I see. did termie really get an oauth impl completed last night? | 18:16 |
| dolphm | ayoung: havent tested but yes lol | 18:17 |
| ayoung | dolphm, posted? | 18:17 |
| dolphm | on his github | 18:17 |
| ayoung | cool. I'll take a look | 18:17 |
| *** Mandell has joined #openstack-dev | 18:17 | |
| *** digitalsanctum has quit IRC | 18:18 | |
| *** rmohan has quit IRC | 18:19 | |
| heckj | wouldn't surprise me | 18:20 |
| ayoung | dolphm, so the body of tests pass. Ran them locally | 18:20 |
| dolphm | same | 18:20 |
| ayoung | dolphm, for your patch... | 18:20 |
| *** rmohan has joined #openstack-dev | 18:21 | |
| crazed | dolphm: ayoung, https://review.openstack.org/25038 i set up a basic patch that allows arbitrary ldap attribute mapping | 18:22 |
| *** eglynn has quit IRC | 18:22 | |
| ayoung | crazed, the whole LDAP config is becoming its own domain specific language. But nice work | 18:23 |
| *** mrodden has quit IRC | 18:23 | |
| ayoung | crazed, any reason you only test user in the live tests? Any reason that test can't be in the bas LDAP tests? | 18:24 |
| ayoung | base | 18:24 |
| *** mrodden has joined #openstack-dev | 18:24 | |
| crazed | ayoung: they could possibly be in ldap base, didn't check if it worked with fakeldap though | 18:25 |
| *** jbresnah has joined #openstack-dev | 18:25 | |
| crazed | ayoung: i just wanted to get something basic, i can add more tests for more than just user | 18:25 |
| ayoung | crazed, please do so. If now, It should be annotated | 18:25 |
| ayoung | yeah, user is the most important | 18:26 |
| ayoung | just asking... | 18:26 |
| *** johnthetubaguy has quit IRC | 18:26 | |
| *** heckj has quit IRC | 18:26 | |
| *** heckj has joined #openstack-dev | 18:26 | |
| crazed | it is funny that the config is becoming a dsl, but ldap is complicated | 18:27 |
| *** digitalsanctum has joined #openstack-dev | 18:28 | |
| ayoung | crazed, yeah, and this even supports only a subset of what people want from it. | 18:28 |
| *** psedlak has quit IRC | 18:29 | |
| crazed | there isn't tls support yet right? | 18:29 |
| crazed | i think that's the last piece that would be necessary for full integration for my personal use case at least | 18:29 |
| topol | crazed not yet | 18:29 |
| crazed | i can use ldaps in the meantime though | 18:29 |
| dolphm | heckj: ayoung: approve? https://review.openstack.org/#/c/25019/ | 18:30 |
| topol | crazed Im starting it today but if I am too slow you can take the work item | 18:30 |
| ayoung | dolphm, lets let jenkins confirm first | 18:30 |
| ayoung | I mean, I ran the unit tests. | 18:31 |
| dolphm | ayoung: jenkins will still gate | 18:31 |
| ayoung | true | 18:31 |
| *** dims has quit IRC | 18:31 | |
| ayoung | I'm ok with it. Pull the trigger if you feel comfortable | 18:32 |
| *** mrodden has quit IRC | 18:32 | |
| crazed | topol: cool yeah, if you need some help i can probably find some time, but have some other things i need to take care of | 18:32 |
| *** anniec has joined #openstack-dev | 18:32 | |
| *** mrodden has joined #openstack-dev | 18:33 | |
| dolphm | +1 from smokestack | 18:33 |
| *** esp has quit IRC | 18:33 | |
| *** gyee has quit IRC | 18:33 | |
| *** mestery has quit IRC | 18:33 | |
| *** dims has joined #openstack-dev | 18:34 | |
| openstackgerrit | A change was merged to openstack/keystone: Add a dereference option for ldap https://review.openstack.org/24139 | 18:34 |
| *** lmatter has quit IRC | 18:35 | |
| crazed | woot | 18:35 |
| *** mestery has joined #openstack-dev | 18:36 | |
| *** kpavel has joined #openstack-dev | 18:36 | |
| *** yidclare has quit IRC | 18:36 | |
| *** spzala has quit IRC | 18:40 | |
| *** danwent has quit IRC | 18:40 | |
| *** lglenden has quit IRC | 18:41 | |
| *** mestery has quit IRC | 18:42 | |
| *** kmartin has quit IRC | 18:43 | |
| *** dspano has joined #openstack-dev | 18:43 | |
| *** ruhe has joined #openstack-dev | 18:44 | |
| russellb | ttx: will there be a BoF room or something at the design summit? I've got a proposal to discuss an unofficial project, probably because he wasn't sure where to propose it. | 18:45 |
| dolphm | ayoung: grr, accidentally rebased the patch on master instead of uploading the backport ... you can review now, but don't approve until master is merged https://review.openstack.org/#/c/25040/ | 18:45 |
| *** roampune has quit IRC | 18:46 | |
| ayoung | dolphm, ha! Why new change ID? | 18:46 |
| *** cp16net is now known as cp16net|away | 18:46 | |
| *** adjohn has quit IRC | 18:46 | |
| dolphm | ayoung: they're both on the same change id https://review.openstack.org/#/q/I32b32fc5df8d8483ae8e99067f0655c13c6f520b,n,z | 18:46 |
| dolphm | different branches | 18:47 |
| ayoung | ah | 18:47 |
| ayoung | OK...be nice to be able to diff them, and confirm they are the same....let me do that | 18:47 |
| *** danpb has quit IRC | 18:47 | |
| *** melwitt has joined #openstack-dev | 18:48 | |
| *** Ryan_Lane has joined #openstack-dev | 18:49 | |
| *** krtaylor has quit IRC | 18:49 | |
| *** corXi has quit IRC | 18:49 | |
| *** yidclare has joined #openstack-dev | 18:49 | |
| ayoung | dolphm, +2ed | 18:50 |
| topol | crazed, I will give you daily status updates. I got swamped this week and feeling guily about being the bottleneck on this | 18:50 |
| *** markmcclain has joined #openstack-dev | 18:50 | |
| dolphm | ayoung: agree | 18:51 |
| openstackgerrit | A change was merged to openstack/horizon: Tiny Mistake in Document https://review.openstack.org/24779 | 18:51 |
| *** sulo_ has joined #openstack-dev | 18:51 | |
| openstackgerrit | A change was merged to openstack/swift: Fix bugs in bulk and slo and small doc change. https://review.openstack.org/25004 | 18:53 |
| *** alobbs has quit IRC | 18:53 | |
| *** mohits_ has joined #openstack-dev | 18:53 | |
| *** ruhe has left #openstack-dev | 18:53 | |
| *** mohits has quit IRC | 18:54 | |
| *** bdpayne has quit IRC | 18:55 | |
| *** Yada has joined #openstack-dev | 18:56 | |
| *** bdpayne has joined #openstack-dev | 18:56 | |
| *** annegentle has joined #openstack-dev | 18:57 | |
| *** n0ano has joined #openstack-dev | 18:57 | |
| ayoung | crazed, something I just realized. Before you post a new version of a patch, rebase the old version, so that you can do "diff to previous version" and seee only your changes. It would be nice if Gerrit did that for you. If you don't then the diffebetween Patch sets 1 and 2 show all of the difference pulled in by the rebase. Rebasing is done with a button on the gerrit panel at the bottom of the PAtchset. It is only visible | 18:57 |
| ayoung | when something has been committed on top of the parent. | 18:57 |
| *** vipul is now known as vipul|away | 18:58 | |
| *** rmohan has quit IRC | 18:59 | |
| henrynash | ayoung, heck, dolphm: so we are good for the trust move to extensions…looks ok to me? | 18:59 |
| dolphm | henrynash: the change is gating now i think | 18:59 |
| dolphm | henrynash: https://review.openstack.org/#/c/25019/ | 19:00 |
| dolphm | ayoung: how did you confirm that it was identical by the way? i've cherry-picked on top of the patch to master, but that doesn't always work lol | 19:00 |
| henrynash | dolphm: ah, looking at the wrong one! ok | 19:00 |
| *** xga_ has quit IRC | 19:01 | |
| crazed | ayoung: ah! okay, thanks for the pointer, i'll be sure to run that in the future | 19:01 |
| ayoung | dolphm, I checked both out into my tree and ran git diff | 19:01 |
| dolphm | henrynash: waiting to approve the backport until the change to master goes through | 19:01 |
| *** lloydde has quit IRC | 19:01 | |
| ayoung | git diff trusts-to-extension-master trusts-to-extension-milestone | 19:01 |
| *** rmohan has joined #openstack-dev | 19:01 | |
| ayoung | maybe I flubbed the checkout calls and they are identical...let me look | 19:02 |
| *** cp16net|away is now known as cp16net | 19:02 | |
| *** cp16net is now known as cp16net|away | 19:02 | |
| *** mrodden1 has joined #openstack-dev | 19:03 | |
| ayoung | nope, different commits | 19:03 |
| *** cp16net|away is now known as cp16net | 19:03 | |
| *** datsun180b_ has joined #openstack-dev | 19:04 | |
| *** datsun180b has quit IRC | 19:04 | |
| *** datsun180b_ is now known as datsun180b | 19:04 | |
| *** darraghb has quit IRC | 19:05 | |
| *** mrodden has quit IRC | 19:05 | |
| *** dolphm has quit IRC | 19:05 | |
| *** alobbs has joined #openstack-dev | 19:08 | |
| *** rnirmal has quit IRC | 19:08 | |
| *** dolphm has joined #openstack-dev | 19:08 | |
| *** rmohan has quit IRC | 19:09 | |
| *** digitals_ has joined #openstack-dev | 19:09 | |
| *** rmohan has joined #openstack-dev | 19:09 | |
| *** dolphm has quit IRC | 19:10 | |
| *** colinmcnamara has quit IRC | 19:10 | |
| *** colinmcnamara has joined #openstack-dev | 19:11 | |
| *** digitalsanctum has quit IRC | 19:12 | |
| *** dolphm has joined #openstack-dev | 19:12 | |
| *** adjohn has joined #openstack-dev | 19:15 | |
| *** colinmcnamara has quit IRC | 19:15 | |
| *** danwent has joined #openstack-dev | 19:16 | |
| *** rushiagr has joined #openstack-dev | 19:18 | |
| openstackgerrit | A change was merged to openstack/keystone: Move trusts to extension https://review.openstack.org/25019 | 19:20 |
| *** rushiagr1 has joined #openstack-dev | 19:21 | |
| *** eglynn has joined #openstack-dev | 19:22 | |
| *** annegentle has quit IRC | 19:23 | |
| *** alobbs has quit IRC | 19:23 | |
| *** rushiagr has quit IRC | 19:25 | |
| *** Brad_K has quit IRC | 19:25 | |
| *** lloydde has joined #openstack-dev | 19:26 | |
| *** soody has joined #openstack-dev | 19:26 | |
| *** olaph has quit IRC | 19:27 | |
| *** adjohn has quit IRC | 19:29 | |
| *** annegentle has joined #openstack-dev | 19:29 | |
| *** olaph has joined #openstack-dev | 19:29 | |
| *** olaph_ has joined #openstack-dev | 19:33 | |
| *** edmund2 has quit IRC | 19:33 | |
| *** alop has quit IRC | 19:34 | |
| *** lmatter has joined #openstack-dev | 19:35 | |
| *** olaph has quit IRC | 19:36 | |
| *** olaph__ has joined #openstack-dev | 19:36 | |
| *** olaph_ has quit IRC | 19:38 | |
| *** roampune has joined #openstack-dev | 19:39 | |
| *** rushiagr1 has quit IRC | 19:39 | |
| openstackgerrit | A change was merged to openstack-infra/devstack-gate: Rename SCREEN_DEV to USE_SCREEN https://review.openstack.org/24925 | 19:39 |
| *** vipul|away is now known as vipul | 19:42 | |
| *** hemna has quit IRC | 19:42 | |
| *** olaph has joined #openstack-dev | 19:44 | |
| *** olaph__ has quit IRC | 19:45 | |
| *** burris has quit IRC | 19:45 | |
| *** hemna has joined #openstack-dev | 19:52 | |
| *** mrodden1 has quit IRC | 19:55 | |
| *** ametts-atl has joined #openstack-dev | 19:55 | |
| ametts-atl | ttx: ping | 19:57 |
| *** gyee has joined #openstack-dev | 19:57 | |
| *** zaitcev has joined #openstack-dev | 19:57 | |
| *** jbresnah has quit IRC | 19:58 | |
| *** woodspa__ has joined #openstack-dev | 19:58 | |
| *** edmund1 has joined #openstack-dev | 19:58 | |
| *** dolphm has quit IRC | 19:58 | |
| *** rkukura has quit IRC | 19:59 | |
| ametts-atl | Want to propose Maconi sessions at summit.openstack.org, but there doesn't seem to be a suitable option in the "Topics" drop-down. (https://wiki.openstack.org/wiki/Marconi) | 19:59 |
| *** dolphm has joined #openstack-dev | 20:00 | |
| *** datsun180b_ has joined #openstack-dev | 20:01 | |
| *** woodspa_ has quit IRC | 20:02 | |
| *** jbresnah has joined #openstack-dev | 20:04 | |
| *** Guest60252 has joined #openstack-dev | 20:04 | |
| *** Yada has quit IRC | 20:04 | |
| *** datsun180b has quit IRC | 20:04 | |
| *** datsun180b_ is now known as datsun180b | 20:04 | |
| *** pmyers has quit IRC | 20:04 | |
| *** noslzzp has joined #openstack-dev | 20:04 | |
| *** primeministerp has quit IRC | 20:07 | |
| *** tonyha has quit IRC | 20:07 | |
| *** vipul is now known as vipul|away | 20:09 | |
| *** lmatter has quit IRC | 20:09 | |
| openstackgerrit | A change was merged to openstack/tempest: Remove skips in volume types tests. https://review.openstack.org/24917 | 20:10 |
| openstackgerrit | A change was merged to openstack/tempest: Updating the try/except blocks to assertRaises. https://review.openstack.org/24503 | 20:10 |
| *** vipul|away is now known as vipul | 20:11 | |
| openstackgerrit | A change was merged to openstack/tempest: Add service cleanup handler for test_list_services. https://review.openstack.org/24642 | 20:15 |
| *** cp16net is now known as cp16net|away | 20:15 | |
| *** digitals_ has quit IRC | 20:16 | |
| *** lmatter has joined #openstack-dev | 20:16 | |
| *** stevemar has quit IRC | 20:17 | |
| *** dolphm has quit IRC | 20:17 | |
| *** kmartin has joined #openstack-dev | 20:17 | |
| *** dolphm has joined #openstack-dev | 20:18 | |
| *** manas has joined #openstack-dev | 20:19 | |
| *** cp16net|away is now known as cp16net | 20:20 | |
| *** stackKick has joined #openstack-dev | 20:20 | |
| *** noslzzp has quit IRC | 20:21 | |
| *** ametts-atl1 has joined #openstack-dev | 20:21 | |
| *** lmatter has quit IRC | 20:22 | |
| *** ametts-atl has quit IRC | 20:23 | |
| *** noslzzp has joined #openstack-dev | 20:25 | |
| *** jruzicka has quit IRC | 20:25 | |
| *** eglynn has quit IRC | 20:26 | |
| *** janisg has quit IRC | 20:27 | |
| termie | .... and awake again | 20:28 |
| *** mrodden has joined #openstack-dev | 20:29 | |
| dolphm | termie: good morning | 20:29 |
| *** manas has quit IRC | 20:29 | |
| termie | ayoung: not a full implementation, no, just all the groundwork (with working oauth), needs a bunch of cleanup and database access calls | 20:29 |
| kbringard | termie lives | 20:29 |
| *** pixelbeat has quit IRC | 20:29 | |
| dolphm | heckj: ayoung: gyee: henrynash: i believe we wanted to backport this ldap fix? https://review.openstack.org/#/c/25050/ | 20:30 |
| ayoung | termie, I';ve already cherry-picked | 20:30 |
| ayoung | termie, I plan on using this to fill in my gaps on oauth among other things | 20:30 |
| ayoung | dolphm, chatted a bit about it with crazed thought he was still working on it. | 20:31 |
| *** cloudchimp has quit IRC | 20:31 | |
| dolphm | ayoung: about the dereference option? he's working on a different fix i thought | 20:31 |
| ayoung | ah...right, yeah this is the one for backport...please! | 20:32 |
| termie | ayoung: cherry-picked as in you are looking at the code? | 20:32 |
| termie | did anybody have any info on how i stop not being able ot run any tests | 20:32 |
| termie | i think it is a fairly bad sign that we are leaking file descriptors | 20:32 |
| ayoung | termie, meaning I have your git repo as one of my remotes and I cherry-picked the two patches and viewed a diff of them together to see the net state. | 20:33 |
| ayoung | termie, to be honest, the last I had heard about leaked file descriptors was last night...are you running on a Mac? | 20:33 |
| *** jog0 has quit IRC | 20:33 | |
| ayoung | I've not seen that on Fedora or RHEL | 20:33 |
| dolphm | ayoung: what's their ulimit? | 20:34 |
| dolphm | by default | 20:34 |
| ayoung | dolphm, one sec | 20:34 |
| termie | ayoung: i am running on a mac, yea | 20:34 |
| termie | ayoung: but things don't generally run into the ulimit | 20:34 |
| ayoung | open files (-n) 1024 | 20:34 |
| dolphm | no, they shouldn't | 20:34 |
| termie | ayoung: as in, nothing else ever | 20:34 |
| termie | mine is at 1024 too | 20:34 |
| ayoung | termie, my guess is it is popen | 20:34 |
| ayoung | specifcially the monkeypatch thing | 20:34 |
| *** radez is now known as radez_g0n3 | 20:34 | |
| ayoung | I think that openssl is not being run correctly via popen from the mac. The question is, why? | 20:36 |
| ayoung | termie, does lsof show you anything? | 20:36 |
| dolphm | ayoung: too many open tcp ports ... | 20:38 |
| dolphm | from python | 20:38 |
| ayoung | that isn't ssl | 20:38 |
| ayoung | dolphm, pythonkeystone client tests? | 20:38 |
| dolphm | test_v3_* | 20:38 |
| *** adjohn has joined #openstack-dev | 20:39 | |
| openstackgerrit | A change was merged to openstack/python-openstackclient: Add extra-specs support for volume-type https://review.openstack.org/23981 | 20:39 |
| dolphm | ayoung: termie: from test_v3_auth running for a few seconds http://paste.openstack.org/raw/34249/ | 20:40 |
| termie | yeah | 20:41 |
| termie | getting that also | 20:41 |
| *** colinmcnamara has joined #openstack-dev | 20:41 | |
| ayoung | something is not closing database connections | 20:42 |
| termie | ayoung: the tests ;) | 20:42 |
| dolphm | see keystone.common.sql.util | 20:42 |
| ayoung | only in v3? | 20:42 |
| dolphm | ayoung: that just happened to be where the suite failed for me when i set the limit to 64 | 20:42 |
| ayoung | Ah, ok, probably all sql based tests | 20:43 |
| termie | yay morning when the brain starts working again | 20:43 |
| *** adjohn has quit IRC | 20:44 | |
| ayoung | Morning? Last I checked, even SF was on DST so unless you are in Hawaii... | 20:44 |
| termie | ayoung: morning == 8 - 12 hours after i go to sleep | 20:44 |
| dolphm | +1 | 20:44 |
| ayoung | termie, after I went to bed last night I had a 3yo with a nightmare and then a 6 year old that likes to get up at 5. 8-10 hours is a thing of the past for me | 20:45 |
| ayoung | Actually, 5 is exagerating | 20:45 |
| ayoung | MOre like 6:30 | 20:45 |
| *** alobbs has joined #openstack-dev | 20:46 | |
| *** beagles is now known as beagles|kids_mus | 20:47 | |
| *** KurtMartin has joined #openstack-dev | 20:47 | |
| *** colinmcnamara has quit IRC | 20:48 | |
| dolphm | 630 is sleeping in | 20:48 |
| termie | dayumn dolphm bringing the hammer | 20:48 |
| termie | "i get up two days ahead of time, every day" | 20:49 |
| *** digitalsanctum has joined #openstack-dev | 20:50 | |
| mikal | Hand up if you understand moniker... | 20:50 |
| ayoung | dolphm, yeah, he has started sleeping later on school days. But he's up with the sun on weekends. | 20:53 |
| ayoung | dolphm, we have two different things doing DB connectson. The migrations and the tests themselves. | 20:53 |
| *** voliveirajr has quit IRC | 20:54 | |
| ayoung | dolphm, what was the way that we set up the tests to run prior to using the migrations? The SQL alchemy thing that uses the code to establish the schema? | 20:54 |
| termie | it sort of seems like these tests should be a lot faster to begin with :p | 20:54 |
| dolphm | ayoung: and the application itself | 20:54 |
| dolphm | termie: they've gotten a lot slower since december or so | 20:54 |
| termie | i added some code to clean up the connection in the teardown, no effect yet | 20:55 |
| dolphm | termie: i made a bunch of test performance improvements and had the entire suite running in < 1 min on my air | 20:55 |
| ayoung | termie, yeah. Part of the problem is that we are running through the whole migration process for each one. With sqlite that isn;t necessary but it is for mysql/postgres. | 20:55 |
| termie | ayoung: are youd oing it for sqlite as well? | 20:55 |
| *** kmartin has quit IRC | 20:55 | |
| termie | ayoung: even though it isn't necessary | 20:55 |
| termie | because as far as i know i am not running mysql on this machine? | 20:56 |
| termie | i wouldn't be surprised if migrations never expected to be run in process and as such don't close properly | 20:56 |
| ayoung | termie, we had logic to bypass it at one point, but we were running the unit tests against a different layout than the migrations, and we unified them...it means the tests run slower. I'd like to find a better middle ground | 20:57 |
| termie | because to hit 1024 descriptors in just a few tests it has to do a lot of connections | 20:57 |
| ayoung | let me pull up the commit, should be easy to bypass | 20:57 |
| *** hemna has quit IRC | 20:57 | |
| dolphm | OOH ya'll just reminded me of a patch i've been waiting until havana to write | 20:57 |
| *** hemna has joined #openstack-dev | 20:58 | |
| *** ametts-atl has joined #openstack-dev | 20:58 | |
| *** lmatter has joined #openstack-dev | 20:58 | |
| termie | hmm, i dropped the removal of the pristine db, seemed like a slight speedup but still too many filesing | 20:59 |
| *** Ryan_Lane has quit IRC | 20:59 | |
| *** rkukura has joined #openstack-dev | 21:00 | |
| *** rafaduran has left #openstack-dev | 21:01 | |
| *** ametts-atl1 has quit IRC | 21:01 | |
| *** esp has joined #openstack-dev | 21:01 | |
| ayoung | termie, so one hack I do is mount the /tests directory on a ramdisk | 21:02 |
| ayoung | sudo mount -t tmpfs -o size=256M tmpfs /opt/stack/keystone/tests | 21:02 |
| ayoung | sqlite to memory much faster | 21:02 |
| ayoung | termie, dolphm git show ed252e0f | 21:03 |
| ayoung | argh | 21:04 |
| ayoung | wrong highlight...1 sec | 21:04 |
| termie | is this not happening for anybody else? | 21:04 |
| dolphm | ayoung: https://review.openstack.org/#/c/25055/ | 21:04 |
| *** mestery has joined #openstack-dev | 21:06 | |
| termie | dolphm: (running with those changes) | 21:06 |
| *** gasbakid has joined #openstack-dev | 21:06 | |
| termie | dolphm: (or rather, testing) | 21:06 |
| termie | dolphm: still too many files | 21:06 |
| dolphm | termie: that shouldn't affect file limits | 21:06 |
| dolphm | termie: this is just fixing a pet peeve that has propogated | 21:06 |
| *** gasbakid has quit IRC | 21:07 | |
| termie | ah | 21:07 |
| *** Ryan_Lane has joined #openstack-dev | 21:07 | |
| *** jog0 has joined #openstack-dev | 21:08 | |
| ayoung | dolphm, have you run that against mysql or just sqlite? | 21:09 |
| *** giulivo has quit IRC | 21:09 | |
| *** rcj has quit IRC | 21:09 | |
| *** flaper87 has quit IRC | 21:10 | |
| dolphm | ayoung: just sqlite, was hoping you'd do sql | 21:10 |
| *** mestery has quit IRC | 21:11 | |
| dolphm | ayoung: i figure now is a good time to make this fix since no one is writing migrations (hopefully) | 21:11 |
| *** adjohn has joined #openstack-dev | 21:13 | |
| termie | so | 21:13 |
| *** BLZbubba has quit IRC | 21:13 | |
| termie | i switched the sqlite pool to "NullPool" | 21:13 |
| gyee | dolphm, sure, backporting dereferencing sound good | 21:13 |
| *** BLZbubba has joined #openstack-dev | 21:13 | |
| termie | which will open and close a connection every time it is accessed | 21:13 |
| termie | and the problem goes away | 21:13 |
| termie | seems like the problem is that we must be leaking the pools, we're using a static pool by default | 21:14 |
| termie | which means 1 connection and it gets re-used | 21:14 |
| termie | but somehow it must not be getting fully cleaned up after tests | 21:14 |
| termie | at the moment we are making a new engine something like 20 times per call | 21:15 |
| *** dolphm has quit IRC | 21:16 | |
| *** janisg has joined #openstack-dev | 21:20 | |
| *** CaptTofu has quit IRC | 21:20 | |
| *** CaptTofu_ has joined #openstack-dev | 21:20 | |
| *** topol has quit IRC | 21:20 | |
| termie | ah, found the culprit | 21:23 |
| termie | we're never setting a global engine | 21:23 |
| *** john5223 has quit IRC | 21:24 | |
| ttx | davidkranz: depends on your neighbors on the schedule | 21:24 |
| ayoung | termie, if I remember correctly, that was due to trying to get this to run with in memory sqlite. | 21:24 |
| ayoung | termie, where'd you find that...I am too tired-stupid to remember | 21:24 |
| ttx | russellb: we have an "unconference room" | 21:25 |
| termie | ayoung: yeah, that is the reason given in the code, i'll just have to check how to enable it for more use cases | 21:25 |
| ttx | all 4 days | 21:25 |
| termie | ayoung: keysone.conmmon.sql.core:Base | 21:25 |
| ayoung | termie, there is something in the migrate code, outside of Keystone that destroys the engine | 21:25 |
| ttx | ametts-atl: yes, htat's by design. Summit is limited to official projects. There is an unconference room for everything else | 21:25 |
| ayoung | with in memory sqlite, it means the whole DB goes away. Very unfriendly | 21:26 |
| ayoung | termie, BTW, did you get the status from what was decided about trusts? It is an extension, although part of the grizzly release. | 21:27 |
| termie | yeah, heckj fileld me in | 21:27 |
| *** aeperezt has quit IRC | 21:27 | |
| *** CaptTofu_ has quit IRC | 21:27 | |
| heckj | fileld? I think you meant "filed" | 21:27 |
| *** CaptTofu has joined #openstack-dev | 21:28 | |
| termie | well, there is still _something_ wrong, even after switching to the start a new connection per call thing, domains just stop being created | 21:28 |
| *** zbitter has joined #openstack-dev | 21:28 | |
| termie | so it seems we're doing migrations in some cases and not in others | 21:28 |
| termie | heckj: i meant flied | 21:28 |
| heckj | buzzzz | 21:29 |
| termie | heckj: defile | 21:29 |
| openstackgerrit | A change was merged to openstack/keystone: Make versions aware of enabled pipelines. https://review.openstack.org/25045 | 21:29 |
| ayoung | OK, I'm out. termie I assume you are more than capable of straightening out the sql mess. | 21:29 |
| *** ayoung is now known as ayoung-afk | 21:29 | |
| termie | i'm out too, thanks for taking care of this all henrynash | 21:29 |
| *** CaptTofu has quit IRC | 21:30 | |
| *** zaneb has quit IRC | 21:31 | |
| *** yidclare has quit IRC | 21:31 | |
| *** CaptTofu has joined #openstack-dev | 21:31 | |
| russellb | ttx: thanks | 21:31 |
| *** kaushikc has quit IRC | 21:32 | |
| *** yidclare has joined #openstack-dev | 21:33 | |
| ttx | heckj: approved the backport, anything else we need in rc1 ? | 21:33 |
| heckj | ttx: there's a LDAP dereference/bugfix that was also queue'd | 21:34 |
| ttx | heckj: I think that's what I just approved | 21:34 |
| heckj | ah | 21:34 |
| ttx | "Add a dereference option for ldap" | 21:34 |
| * heckj looks | 21:34 | |
| heckj | that's it | 21:34 |
| ttx | is the extension-ization in ? | 21:34 |
| *** Guest60252 has quit IRC | 21:35 | |
| ttx | looks like it is | 21:35 |
| heckj | looking - thought we'd pushed it through, but not seeing that in the search yet | 21:35 |
| ttx | OK, so when the ldap thing lands, i can cut rc1 | 21:35 |
| heckj | yep | 21:35 |
| ttx | probably tomorrow morning | 21:35 |
| heckj | sounds good, thank you | 21:35 |
| *** jcmartin has quit IRC | 21:36 | |
| *** CaptTofu_ has joined #openstack-dev | 21:36 | |
| ttx | just waive a red flag if I shouldn't | 21:36 |
| *** CaptTofu has quit IRC | 21:37 | |
| *** mestery has joined #openstack-dev | 21:37 | |
| *** techlife has quit IRC | 21:38 | |
| *** eharney has quit IRC | 21:38 | |
| *** j303 has quit IRC | 21:42 | |
| *** jbresnah has quit IRC | 21:42 | |
| *** jbresnah has joined #openstack-dev | 21:43 | |
| *** olaph has quit IRC | 21:44 | |
| *** techlife has joined #openstack-dev | 21:44 | |
| *** olaph has joined #openstack-dev | 21:45 | |
| *** mestery has quit IRC | 21:47 | |
| *** list has joined #openstack-dev | 21:47 | |
| *** alop has joined #openstack-dev | 21:47 | |
| list | Hi | 21:47 |
| ayoung-afk | heckj, ttx, https://review.openstack.org/#/c/25040/ | 21:48 |
| ayoung-afk | its in | 21:48 |
| heckj | yep, ttx found it - I was slow | 21:48 |
| heckj | ayoung-afk: thnks | 21:48 |
| ttx | heckj: want me to cut now, or give you a chance to backport something else in the next hours ? | 21:49 |
| ayoung-afk | Cut now please. | 21:49 |
| heckj | ttx: if you're game to cut now, go ahead and do it | 21:49 |
| ttx | ok let's do this | 21:49 |
| *** burris has joined #openstack-dev | 21:51 | |
| ttx | heckj, ayoung: still waiting on https://review.openstack.org/#/c/25050/ | 21:52 |
| *** jcmartin has joined #openstack-dev | 21:53 | |
| heckj | not long now - top of the list | 21:53 |
| heckj | (http://status.openstack.org/zuul/) | 21:54 |
| ttx | yep, I'm waiting | 21:54 |
| *** annegentle has quit IRC | 21:57 | |
| *** noslzzp has quit IRC | 21:58 | |
| *** koolhead17 has quit IRC | 22:00 | |
| *** anniec has quit IRC | 22:02 | |
| *** diogogmt has quit IRC | 22:02 | |
| *** jergerber has quit IRC | 22:02 | |
| *** alop has quit IRC | 22:03 | |
| *** kbringard has quit IRC | 22:03 | |
| *** hemna has quit IRC | 22:03 | |
| *** spn has quit IRC | 22:03 | |
| *** hemna has joined #openstack-dev | 22:03 | |
| *** spn has joined #openstack-dev | 22:04 | |
| *** harlowja has quit IRC | 22:04 | |
| *** list has left #openstack-dev | 22:06 | |
| *** boris-42 has quit IRC | 22:06 | |
| *** mtreinish has quit IRC | 22:07 | |
| *** ivoks has quit IRC | 22:08 | |
| heckj | ttx: looks like it just finished through zuul | 22:08 |
| ttx | yep, onit | 22:10 |
| ttx | heckj: err. fail | 22:10 |
| heckj | :-( | 22:10 |
| ttx | looks like it needs a reverify | 22:11 |
| *** markmcclain has quit IRC | 22:11 | |
| ttx | I'll let you push it and go to bed | 22:11 |
| *** alobbs has quit IRC | 22:12 | |
| ttx | heckj: ^ | 22:12 |
| *** eglynn has joined #openstack-dev | 22:12 | |
| heckj | ttx: thanks | 22:12 |
| *** alobbs has joined #openstack-dev | 22:12 | |
| *** anniec has joined #openstack-dev | 22:14 | |
| *** mkollaro has quit IRC | 22:14 | |
| heckj | dolphm: https://review.openstack.org/#/c/25050/ is failing out jenkins | 22:16 |
| *** ametts-atl has left #openstack-dev | 22:18 | |
| *** digitalsanctum has quit IRC | 22:18 | |
| *** hattwick has quit IRC | 22:19 | |
| *** heckj has quit IRC | 22:19 | |
| *** soody has quit IRC | 22:21 | |
| *** hattwick has joined #openstack-dev | 22:22 | |
| *** lloydde has quit IRC | 22:23 | |
| *** kaushikc has joined #openstack-dev | 22:23 | |
| *** novas0x2a|laptop has joined #openstack-dev | 22:24 | |
| *** eglynn has quit IRC | 22:26 | |
| *** lloydde has joined #openstack-dev | 22:26 | |
| *** colinmcnamara has joined #openstack-dev | 22:28 | |
| *** dspano has quit IRC | 22:29 | |
| *** soody has joined #openstack-dev | 22:29 | |
| *** colinmcnamara1 has joined #openstack-dev | 22:29 | |
| *** colinmcnamara has quit IRC | 22:29 | |
| *** alunduil has joined #openstack-dev | 22:32 | |
| *** henrynash_ has joined #openstack-dev | 22:32 | |
| *** sacharya has quit IRC | 22:34 | |
| *** sulo__ has joined #openstack-dev | 22:34 | |
| *** colinmcnamara1 has quit IRC | 22:34 | |
| *** bknudson has quit IRC | 22:34 | |
| *** gongysh has joined #openstack-dev | 22:35 | |
| *** henrynash_ has quit IRC | 22:35 | |
| *** henrynash has quit IRC | 22:35 | |
| *** cloudchimp has joined #openstack-dev | 22:36 | |
| *** sulo_ has quit IRC | 22:37 | |
| *** sulo__ is now known as sulo_ | 22:37 | |
| *** eglynn has joined #openstack-dev | 22:38 | |
| *** kaushikc has quit IRC | 22:39 | |
| *** andrewbogott is now known as andrewbogott_afk | 22:39 | |
| *** danjared has quit IRC | 22:40 | |
| *** olaph_ has joined #openstack-dev | 22:40 | |
| *** olaph has quit IRC | 22:41 | |
| *** jcmartin has quit IRC | 22:43 | |
| *** yidclare has quit IRC | 22:44 | |
| *** blamar has quit IRC | 22:44 | |
| *** olaph has joined #openstack-dev | 22:45 | |
| openstackgerrit | A change was merged to openstack/nova: nova-manage vm list fails looking 'instance_type' https://review.openstack.org/25010 | 22:48 |
| openstackgerrit | A change was merged to openstack/swift: Fix for unicode issues in staticweb https://review.openstack.org/24960 | 22:48 |
| *** olaph_ has quit IRC | 22:48 | |
| openstackgerrit | A change was merged to openstack/python-glanceclient: Trapping KeyboardInterrupt sooner. https://review.openstack.org/24923 | 22:48 |
| openstackgerrit | A change was merged to openstack/python-glanceclient: Allow for prettytable 0.7.x as well https://review.openstack.org/22691 | 22:48 |
| *** yidclare has joined #openstack-dev | 22:48 | |
| *** olaph has joined #openstack-dev | 22:48 | |
| *** SergeyLukjanov has quit IRC | 22:49 | |
| *** lloydde has quit IRC | 22:50 | |
| *** datsun180b has quit IRC | 22:50 | |
| *** lloydde has joined #openstack-dev | 22:50 | |
| *** Ryan_Lane has quit IRC | 22:50 | |
| *** anniec has quit IRC | 22:51 | |
| *** dolphm has joined #openstack-dev | 22:52 | |
| *** dolphm has quit IRC | 22:52 | |
| jog0 | sdague: ping | 22:53 |
| *** dolphm has joined #openstack-dev | 22:53 | |
| *** lloydde has quit IRC | 22:56 | |
| *** annegentle_ has joined #openstack-dev | 22:58 | |
| *** lloydde has joined #openstack-dev | 22:58 | |
| *** lloydde has quit IRC | 22:59 | |
| *** 31NAC00I3 has joined #openstack-dev | 23:00 | |
| *** lloydde_ has joined #openstack-dev | 23:00 | |
| *** Tross has quit IRC | 23:00 | |
| *** digitalsanctum has joined #openstack-dev | 23:04 | |
| *** edmund1 has quit IRC | 23:04 | |
| *** lloydde has joined #openstack-dev | 23:05 | |
| *** hemna has quit IRC | 23:06 | |
| *** lloydde has quit IRC | 23:06 | |
| *** hemna has joined #openstack-dev | 23:06 | |
| *** danjared has joined #openstack-dev | 23:06 | |
| *** lloydde has joined #openstack-dev | 23:06 | |
| *** susanne-balle has quit IRC | 23:06 | |
| *** cloudchimp has quit IRC | 23:07 | |
| *** torgomatic has quit IRC | 23:08 | |
| *** lloydde_ has quit IRC | 23:08 | |
| *** harlowja has joined #openstack-dev | 23:09 | |
| *** eglynn has quit IRC | 23:10 | |
| *** torgomatic has joined #openstack-dev | 23:11 | |
| *** security has joined #openstack-dev | 23:11 | |
| *** megha has quit IRC | 23:12 | |
| *** jog0 has quit IRC | 23:16 | |
| cyeoh | dolphm: hi | 23:16 |
| dolphm | cyeoh: what's up? | 23:17 |
| cyeoh | hey just wondering if you have a moment to talk about https://review.openstack.org/#/c/25065/ | 23:17 |
| *** tomoe_ has quit IRC | 23:17 | |
| *** zzs has left #openstack-dev | 23:19 | |
| cyeoh | dolphm: this is the test which picked up the issue with session.close() https://review.openstack.org/#/c/23660/ (it started failing after 022 was added) | 23:20 |
| *** 31NAC00I3 is now known as jhesketh | 23:20 | |
| *** zzs has joined #openstack-dev | 23:20 | |
| *** woodspa__ has quit IRC | 23:21 | |
| dolphm | cyeoh: what's special about 22? | 23:21 |
| cyeoh | 022 was the first db migration to not either close or commit a session | 23:21 |
| cyeoh | test_migrations.py attempts to drop the database on tearDown, which fails because there is still a user of the db around | 23:22 |
| cyeoh | if the session is closed its fine (I'm guessing its ok if the process with the session just exits as well which would be why it hasn't been picked up before) | 23:23 |
| dolphm | cyeoh: i don't believe that's true; most migrations don't commit or close anything | 23:23 |
| dolphm | cyeoh: random example from nova- https://github.com/openstack/nova/blob/master/nova/db/sqlalchemy/migrate_repo/versions/146_aggregate_zones.py | 23:23 |
| *** zzs has quit IRC | 23:23 | |
| cyeoh | dolphm: hrm I think they do for keystone. I'm not sure what the difference between keystone and nova could be... | 23:24 |
| *** zzs has joined #openstack-dev | 23:24 | |
| dolphm | cyeoh: this commit removes every .commit() and .close() in every migration -- the migrations that did so were in the minority https://review.openstack.org/#/c/25055/ | 23:24 |
| cyeoh | dolphm: oh 146 doesn't create the orm.sessionmaker | 23:24 |
| *** zzs has left #openstack-dev | 23:25 | |
| cyeoh | dolphm: yea I saw 25055 - it also creates causes users of the db to hang around for postgres. The session.close is only requied where there is a session = orm.sessionmaker(...) line | 23:26 |
| dolphm | cyeoh: so if migration 20 was the last migration, then it would fail? | 23:27 |
| cyeoh | dolphm: with 25055 applied, yes | 23:29 |
| dolphm | how do i reproduce this with db_sync on a real postgres server -- what do i look for to verify? | 23:29 |
| *** anniec has joined #openstack-dev | 23:31 | |
| *** lloydde has quit IRC | 23:31 | |
| cyeoh | dolphm: hrm well test_migrations.py does use a real postgres server (https://review.openstack.org/#/c/23660/) | 23:32 |
| dolphm | cyeoh: yes, but users are using db_sync, not test_migrations or test_sql_upgrade | 23:32 |
| dolphm | cyeoh: i've got to run, but i'll keep your review open -- if you find a way to reproduce, will you leave a comment? | 23:33 |
| cyeoh | dolphm: sure, will do | 23:33 |
| dolphm | cyeoh: thanks! | 23:33 |
| *** alobbs has quit IRC | 23:33 | |
| *** dolphm is now known as dolphm_food | 23:34 | |
| *** kaushikc has joined #openstack-dev | 23:34 | |
| *** yidclare has quit IRC | 23:35 | |
| *** zb has joined #openstack-dev | 23:39 | |
| *** utlemming has quit IRC | 23:40 | |
| *** dims has quit IRC | 23:40 | |
| *** utlemming has joined #openstack-dev | 23:41 | |
| *** utlemming has quit IRC | 23:41 | |
| *** zbitter has quit IRC | 23:41 | |
| openstackgerrit | A change was merged to openstack/nova: Add caching for ec2 mapping ids. https://review.openstack.org/24863 | 23:42 |
| *** hemna has quit IRC | 23:43 | |
| *** utlemming has joined #openstack-dev | 23:46 | |
| *** sulo__ has joined #openstack-dev | 23:52 | |
| *** sulo_ has quit IRC | 23:52 | |
| *** sulo__ is now known as sulo_ | 23:52 | |
| openstackgerrit | A change was merged to openstack/nova: Make nova.virt.fake.FakeDriver useable in integration testing https://review.openstack.org/24938 | 23:53 |
| *** jcmartin has joined #openstack-dev | 23:53 | |
| *** jcmartin__ has joined #openstack-dev | 23:54 | |
| *** kaushikc has quit IRC | 23:55 | |
| *** dims has joined #openstack-dev | 23:55 | |
| *** burris has quit IRC | 23:56 | |
| *** digitalsanctum has quit IRC | 23:57 | |
| *** jcmartin has quit IRC | 23:57 | |
| *** jcmartin__ is now known as jcmartin | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!