| *** vipul is now known as vipul-away | 00:00 | |
| *** sarob has joined #openstack-dev | 00:01 | |
| *** thingee is now known as thingee_zzz | 00:01 | |
| *** alop has quit IRC | 00:02 | |
| mrodden | bnemec: looks like the ceilometer one failed too | 00:02 |
|---|---|---|
| bnemec | Sigh | 00:02 |
| mrodden | similar issue actually | 00:03 |
| *** emagana has joined #openstack-dev | 00:03 | |
| bnemec | That one failed all kinds of tests. :-( | 00:03 |
| *** emagana has quit IRC | 00:03 | |
| mrodden | nova failed as well | 00:03 |
| mrodden | sadness | 00:03 |
| mrodden | same issue | 00:03 |
| bnemec | Oh, that's the test_stamp_pattern one that's like #1 on rechecks. | 00:03 |
| *** emagana has joined #openstack-dev | 00:04 | |
| bnemec | I think anyway. | 00:04 |
| *** joshuamckenty has joined #openstack-dev | 00:04 | |
| mrodden | o | 00:04 |
| *** DennyZhang has quit IRC | 00:04 | |
| *** vipul-away is now known as vipul | 00:04 | |
| bnemec | Okay, maybe it wasn't quite that high. Still a bunch of rechecks against it. | 00:05 |
| bnemec | LOL, there's a vacation message auto-reply on that bug. | 00:05 |
| mrodden | bnemec: yeah i just saw that... | 00:06 |
| dims | bnemec, there's a bunch from folks in china who are on vacation in various bugs | 00:07 |
| mrodden | they can set their notes to not send auto responses | 00:07 |
| mrodden | to internet mail | 00:07 |
| *** sarob has quit IRC | 00:07 | |
| *** jpipes has quit IRC | 00:08 | |
| *** sarob has joined #openstack-dev | 00:08 | |
| *** READ10 has joined #openstack-dev | 00:08 | |
| *** adjohn has quit IRC | 00:09 | |
| *** joshuamckenty has quit IRC | 00:09 | |
| *** sarob has quit IRC | 00:10 | |
| bnemec | Okay, Neutron passed and the others are rechecking. I'm out before any more fail. :-) | 00:10 |
| *** sarob has joined #openstack-dev | 00:10 | |
| mrodden | bnemec: lol cya | 00:10 |
| *** danwent has quit IRC | 00:12 | |
| *** AlexF has quit IRC | 00:15 | |
| *** samuelbercovici has joined #openstack-dev | 00:21 | |
| *** xqueralt has quit IRC | 00:23 | |
| *** cdub has quit IRC | 00:25 | |
| *** matsuhashi has joined #openstack-dev | 00:25 | |
| *** adjohn has joined #openstack-dev | 00:28 | |
| *** dperaza has quit IRC | 00:29 | |
| *** cjellick has quit IRC | 00:29 | |
| *** danwent has joined #openstack-dev | 00:29 | |
| *** adjohn has quit IRC | 00:35 | |
| *** Tross has quit IRC | 00:35 | |
| *** Tross has joined #openstack-dev | 00:38 | |
| *** emagana_ has joined #openstack-dev | 00:39 | |
| *** Tross has quit IRC | 00:41 | |
| *** egallen has quit IRC | 00:42 | |
| *** emagana has quit IRC | 00:43 | |
| *** adjohn has joined #openstack-dev | 00:44 | |
| *** Tross has joined #openstack-dev | 00:45 | |
| *** topol has joined #openstack-dev | 00:45 | |
| *** briancurtin has joined #openstack-dev | 00:47 | |
| *** nosnos has joined #openstack-dev | 00:49 | |
| *** Mandell has quit IRC | 00:49 | |
| *** aeperezt has quit IRC | 00:49 | |
| *** adjohn has quit IRC | 00:52 | |
| *** adjohn has joined #openstack-dev | 00:54 | |
| *** gabrielhurley has quit IRC | 00:57 | |
| *** jvrbanac has joined #openstack-dev | 00:57 | |
| *** adalbas has quit IRC | 00:58 | |
| *** giulivo has quit IRC | 00:58 | |
| *** schwicht has quit IRC | 01:03 | |
| *** angdraug has quit IRC | 01:03 | |
| *** anniec has quit IRC | 01:03 | |
| *** anniec has joined #openstack-dev | 01:04 | |
| *** melwitt has quit IRC | 01:05 | |
| *** f13o_ has quit IRC | 01:07 | |
| *** DennyZhang has joined #openstack-dev | 01:12 | |
| *** changbl has joined #openstack-dev | 01:14 | |
| *** samuelbercovici has quit IRC | 01:22 | |
| *** spzala has quit IRC | 01:25 | |
| *** comay has quit IRC | 01:27 | |
| *** sarob has quit IRC | 01:28 | |
| *** sarob has joined #openstack-dev | 01:29 | |
| *** erkules_ has joined #openstack-dev | 01:29 | |
| *** erkules has quit IRC | 01:32 | |
| *** FatDarrel_ has joined #openstack-dev | 01:32 | |
| *** sarob has quit IRC | 01:32 | |
| *** FatDarrel has quit IRC | 01:32 | |
| *** FatDarrel_ is now known as FatDarrel | 01:32 | |
| *** bknudson has joined #openstack-dev | 01:32 | |
| *** amcrn[a] has quit IRC | 01:33 | |
| *** gabrielhurley has joined #openstack-dev | 01:36 | |
| *** gabrielhurley has quit IRC | 01:37 | |
| *** jasondot_ has joined #openstack-dev | 01:37 | |
| *** shinylasers has joined #openstack-dev | 01:39 | |
| *** dims has quit IRC | 01:40 | |
| *** shinylasers has joined #openstack-dev | 01:41 | |
| mrodden | dhellmann: i'm still around if you have anything else | 01:42 |
| mrodden | but i think we have everything under control now | 01:42 |
| dhellmann | mrodden: yeah, I think things are looking good for the time being | 01:43 |
| mrodden | that patch for the logging adapter change was merged too | 01:43 |
| dhellmann | mrodden: I saw, nice work on that | 01:43 |
| mrodden | what do you think about pushing that up as a sync from oslo to other projects? | 01:44 |
| mrodden | luisg, jswarren and i can do that tomorrow pretty quick i think | 01:44 |
| dhellmann | I was talking with luisg about that earlier. I'm on the fence. I'd like to keep things stable, but it's a relatively small change. I was going to wait and let markmc weigh in. | 01:44 |
| mrodden | ok | 01:45 |
| mrodden | i'd be interested in his take on it as well | 01:45 |
| dhellmann | so maybe prepare the patches, but hold off on submitting them? | 01:45 |
| mrodden | sure | 01:45 |
| mrodden | sounds good | 01:45 |
| dhellmann | if they don't go into the havana rc, they'll go in very very early in icehouse | 01:45 |
| mrodden | yeah | 01:45 |
| *** danwent has quit IRC | 01:46 | |
| dhellmann | oh, and nice work finding those keystone changes that were needed, too -- I missed those | 01:46 |
| mrodden | np | 01:46 |
| mrodden | bknudson did the work on that, but i was familiar with it | 01:47 |
| bknudson | dhellmann: keystone has a couple of entry points :( | 01:47 |
| mrodden | keystone-all and uh | 01:47 |
| bknudson | also the tests? | 01:47 |
| mrodden | what was the other one | 01:47 |
| bknudson | there's one for running in http | 01:47 |
| mrodden | httpd/keystone | 01:48 |
| mrodden | yeah | 01:48 |
| mrodden | we left the test ones in | 01:48 |
| dhellmann | bknudson: we're leaving the tests alone | 01:48 |
| mrodden | to catch any failures | 01:48 |
| dhellmann | https://etherpad.openstack.org/disable-lazy-translation | 01:48 |
| dhellmann | and tracking our work on this ^^ | 01:48 |
| mrodden | do you know what time mark usually hops on? | 01:49 |
| *** dtyarnell has joined #openstack-dev | 01:51 | |
| dhellmann | I'm not sure; I think he's still traveling so he may not even be on at the usual time. | 01:51 |
| mrodden | ah | 01:51 |
| *** emagana_ has quit IRC | 01:52 | |
| dhellmann | well, things are calm, so I'm going to sign off for the evening | 01:52 |
| dhellmann | thanks again for your help today, mrodden! | 01:52 |
| *** sandywalsh has joined #openstack-dev | 01:53 | |
| mrodden | dhellmann: np, thank you for being around and providing feedback on the reviews | 01:54 |
| *** sarob has joined #openstack-dev | 01:55 | |
| *** jsgotangco has joined #openstack-dev | 01:56 | |
| *** FatDarrel has quit IRC | 01:56 | |
| *** ctracey has quit IRC | 02:00 | |
| *** zhiyan has joined #openstack-dev | 02:03 | |
| *** ctracey has joined #openstack-dev | 02:07 | |
| *** anniec has quit IRC | 02:10 | |
| *** DennyZhang has quit IRC | 02:10 | |
| *** jayg is now known as jayg|g0n3 | 02:11 | |
| *** jsgotangco has quit IRC | 02:13 | |
| *** otherwiseguy has joined #openstack-dev | 02:14 | |
| *** sarob_ has joined #openstack-dev | 02:15 | |
| *** sarob has quit IRC | 02:18 | |
| *** sarob_ has quit IRC | 02:20 | |
| *** arborism has joined #openstack-dev | 02:21 | |
| *** READ10 has quit IRC | 02:26 | |
| *** edmund has joined #openstack-dev | 02:29 | |
| *** asalkeld is now known as asalkeld_zombie | 02:36 | |
| *** asalkeld_zombie is now known as asalkeld | 02:36 | |
| *** AlexF has joined #openstack-dev | 02:36 | |
| *** dkehn_ has joined #openstack-dev | 02:37 | |
| *** arborism has quit IRC | 02:39 | |
| *** arborism has joined #openstack-dev | 02:39 | |
| *** dkehn has quit IRC | 02:41 | |
| *** markmcclain has joined #openstack-dev | 02:42 | |
| *** carl_baldwin has joined #openstack-dev | 02:42 | |
| *** Tross has quit IRC | 02:44 | |
| *** Tross has joined #openstack-dev | 02:47 | |
| *** Mandell has joined #openstack-dev | 02:49 | |
| *** gyee has quit IRC | 02:52 | |
| *** mjb_ has joined #openstack-dev | 02:54 | |
| *** AlexF has quit IRC | 02:59 | |
| *** metral_ has joined #openstack-dev | 03:03 | |
| *** prekarat has joined #openstack-dev | 03:05 | |
| *** metral has quit IRC | 03:05 | |
| *** metral_ is now known as metral | 03:05 | |
| *** prekarat has quit IRC | 03:05 | |
| *** prekarat has joined #openstack-dev | 03:05 | |
| *** eharney has quit IRC | 03:07 | |
| *** metral_ has joined #openstack-dev | 03:09 | |
| *** metral has quit IRC | 03:10 | |
| *** metral_ is now known as metral | 03:10 | |
| *** kbrierly has joined #openstack-dev | 03:12 | |
| *** jasondot_ has quit IRC | 03:14 | |
| *** kdbrierly has joined #openstack-dev | 03:20 | |
| *** adjohn has quit IRC | 03:21 | |
| *** arborism is now known as amcrn | 03:21 | |
| *** adjohn has joined #openstack-dev | 03:21 | |
| *** kdbrierly has quit IRC | 03:22 | |
| *** kbrierly has quit IRC | 03:22 | |
| *** neelashah has joined #openstack-dev | 03:23 | |
| *** adjohn_ has joined #openstack-dev | 03:24 | |
| *** adjohn has quit IRC | 03:24 | |
| *** shakayumi has joined #openstack-dev | 03:25 | |
| *** faramir has quit IRC | 03:26 | |
| *** briancurtin has quit IRC | 03:29 | |
| *** carl_baldwin has quit IRC | 03:39 | |
| *** faramir has joined #openstack-dev | 03:40 | |
| *** gmurphy has quit IRC | 03:40 | |
| *** gmurphy has joined #openstack-dev | 03:42 | |
| *** adjohn_ has quit IRC | 03:43 | |
| *** Ryan_Lane has joined #openstack-dev | 03:44 | |
| *** kbrierly has joined #openstack-dev | 03:45 | |
| *** Khaja has joined #openstack-dev | 03:46 | |
| *** Khaja has quit IRC | 03:50 | |
| *** Ryan_Lane has quit IRC | 03:50 | |
| *** markwash has joined #openstack-dev | 04:02 | |
| *** zhiyan has quit IRC | 04:03 | |
| *** tkammer has joined #openstack-dev | 04:04 | |
| *** jamespage has quit IRC | 04:06 | |
| *** jamespage has joined #openstack-dev | 04:06 | |
| *** danwent has joined #openstack-dev | 04:08 | |
| *** harlowja has quit IRC | 04:08 | |
| *** Shaan7 has quit IRC | 04:10 | |
| *** edmund has quit IRC | 04:11 | |
| *** neelashah has quit IRC | 04:13 | |
| *** adjohn has joined #openstack-dev | 04:13 | |
| *** markmcclain1 has joined #openstack-dev | 04:15 | |
| *** markmcclain has quit IRC | 04:15 | |
| *** Shaan7 has joined #openstack-dev | 04:16 | |
| *** faramir has quit IRC | 04:16 | |
| *** markmcclain1 has quit IRC | 04:19 | |
| *** Ryan_Lane has joined #openstack-dev | 04:19 | |
| *** markmcclain has joined #openstack-dev | 04:19 | |
| *** emagana has joined #openstack-dev | 04:20 | |
| *** adjohn has quit IRC | 04:21 | |
| *** Ryan_Lane has quit IRC | 04:23 | |
| *** tkammer has quit IRC | 04:28 | |
| *** tkammer has joined #openstack-dev | 04:29 | |
| *** adjohn has joined #openstack-dev | 04:32 | |
| *** vartom15 has joined #openstack-dev | 04:35 | |
| *** ArcTanSusan has joined #openstack-dev | 04:39 | |
| *** vartom16 has joined #openstack-dev | 04:40 | |
| *** vartom17 has joined #openstack-dev | 04:41 | |
| *** vartom15 has quit IRC | 04:42 | |
| *** vartom18 has joined #openstack-dev | 04:42 | |
| *** alunch has quit IRC | 04:42 | |
| *** enikanorov has quit IRC | 04:42 | |
| *** vartom16 has quit IRC | 04:44 | |
| *** vartom17 has quit IRC | 04:45 | |
| *** garyk has quit IRC | 04:45 | |
| *** adjohn has quit IRC | 04:46 | |
| *** Ryan_Lane has joined #openstack-dev | 04:49 | |
| *** Ruetobas has quit IRC | 04:52 | |
| *** hemna has quit IRC | 04:52 | |
| *** Ryan_Lane has quit IRC | 04:54 | |
| *** Ruetobas has joined #openstack-dev | 04:57 | |
| *** SergeyLukjanov has joined #openstack-dev | 04:58 | |
| *** boris-42 has joined #openstack-dev | 04:59 | |
| *** giroro_ has joined #openstack-dev | 05:00 | |
| *** Ruetobas has quit IRC | 05:01 | |
| *** erkules_ is now known as erkules | 05:06 | |
| *** AndreyGrebenniko has quit IRC | 05:07 | |
| *** AndreyGrebenniko has joined #openstack-dev | 05:07 | |
| *** hemna has joined #openstack-dev | 05:08 | |
| *** otherwiseguy has quit IRC | 05:18 | |
| *** shinylasers has quit IRC | 05:18 | |
| *** Ryan_Lane has joined #openstack-dev | 05:20 | |
| *** aditirav has joined #openstack-dev | 05:21 | |
| *** vartom18 has quit IRC | 05:22 | |
| *** markwash has quit IRC | 05:22 | |
| *** zaitcev has quit IRC | 05:23 | |
| *** Ryan_Lane has quit IRC | 05:24 | |
| *** tvb|afk has joined #openstack-dev | 05:25 | |
| *** salv-orlando has quit IRC | 05:29 | |
| *** tvb|afk has quit IRC | 05:30 | |
| *** bdpayne has quit IRC | 05:37 | |
| *** bdpayne has joined #openstack-dev | 05:38 | |
| *** topol has quit IRC | 05:40 | |
| *** amerine has joined #openstack-dev | 05:41 | |
| *** egallen has joined #openstack-dev | 05:41 | |
| *** egallen has quit IRC | 05:45 | |
| *** jaypipes has joined #openstack-dev | 05:46 | |
| *** adjohn has joined #openstack-dev | 05:46 | |
| *** prekarat has quit IRC | 05:49 | |
| *** Ryan_Lane has joined #openstack-dev | 05:50 | |
| *** odyssey4me has joined #openstack-dev | 05:50 | |
| *** faramir has joined #openstack-dev | 05:51 | |
| *** adjohn has quit IRC | 05:51 | |
| *** avishay has joined #openstack-dev | 05:53 | |
| *** tvb|afk has joined #openstack-dev | 05:54 | |
| *** Ryan_Lane has quit IRC | 05:54 | |
| *** egallen has joined #openstack-dev | 05:55 | |
| *** SergeyLukjanov has quit IRC | 05:55 | |
| *** vartom18 has joined #openstack-dev | 05:57 | |
| *** odyssey4me has quit IRC | 05:59 | |
| *** garyk has joined #openstack-dev | 05:59 | |
| *** eglynn has joined #openstack-dev | 06:00 | |
| *** Nikolay_1t has joined #openstack-dev | 06:01 | |
| *** bdpayne has quit IRC | 06:02 | |
| *** novas0x2a|laptop has quit IRC | 06:04 | |
| *** faramir has quit IRC | 06:07 | |
| *** egallen has quit IRC | 06:07 | |
| *** odyssey4me has joined #openstack-dev | 06:08 | |
| *** o_petit has joined #openstack-dev | 06:14 | |
| *** zbitter has joined #openstack-dev | 06:15 | |
| *** shakayumi has quit IRC | 06:15 | |
| *** tvb|afk_ has joined #openstack-dev | 06:16 | |
| *** zaneb has quit IRC | 06:18 | |
| *** adjohn has joined #openstack-dev | 06:20 | |
| *** shinylasers has joined #openstack-dev | 06:20 | |
| *** tvb|afk has quit IRC | 06:20 | |
| *** Ryan_Lane has joined #openstack-dev | 06:20 | |
| *** yolanda has joined #openstack-dev | 06:23 | |
| *** shardy_afk is now known as shardy | 06:23 | |
| *** MaxV has joined #openstack-dev | 06:23 | |
| *** odyssey4me2 has joined #openstack-dev | 06:25 | |
| *** kbrierly has quit IRC | 06:25 | |
| *** odyssey4me has quit IRC | 06:28 | |
| *** Ryan_Lane has quit IRC | 06:29 | |
| *** odyssey4me2 has quit IRC | 06:29 | |
| *** tvb|afk_ is now known as tvb | 06:31 | |
| *** tvb has quit IRC | 06:31 | |
| *** tvb has joined #openstack-dev | 06:31 | |
| *** mrunge has joined #openstack-dev | 06:33 | |
| *** martyntaylor has joined #openstack-dev | 06:34 | |
| mjb_ | I've posted a comment on https://bugs.launchpad.net/nova/+bug/1224453. Anyone concerned by nova quotas care to take a look to see if it makes sense? Thx | 06:34 |
| uvirtbot | Launchpad bug 1224453 in nova "min_count ignored for instance create" [Undecided,Incomplete] | 06:34 |
| *** adjohn has quit IRC | 06:35 | |
| *** MaxV has quit IRC | 06:35 | |
| *** neoXsys has joined #openstack-dev | 06:36 | |
| *** FatDarrel has joined #openstack-dev | 06:38 | |
| *** amuller has joined #openstack-dev | 06:38 | |
| *** danwent_ has joined #openstack-dev | 06:39 | |
| *** eglynn has quit IRC | 06:39 | |
| *** romcheg has joined #openstack-dev | 06:40 | |
| *** emagana has quit IRC | 06:40 | |
| *** danwent has quit IRC | 06:41 | |
| *** danwent_ is now known as danwent | 06:41 | |
| *** amuller has quit IRC | 06:47 | |
| *** xga has joined #openstack-dev | 06:49 | |
| *** henrynash has joined #openstack-dev | 06:54 | |
| *** afazekas_no_irq has joined #openstack-dev | 06:55 | |
| *** Ryan_Lane has joined #openstack-dev | 06:55 | |
| *** uvirtbot has quit IRC | 06:56 | |
| *** odyssey4me has joined #openstack-dev | 06:56 | |
| *** uvirtbot has joined #openstack-dev | 06:56 | |
| *** reidrac has joined #openstack-dev | 06:59 | |
| *** Ryan_Lane has quit IRC | 06:59 | |
| *** odyssey4me2 has joined #openstack-dev | 07:00 | |
| *** vipul is now known as vipul-away | 07:02 | |
| *** odyssey4me has quit IRC | 07:02 | |
| *** boris-42 has quit IRC | 07:06 | |
| *** eglynn has joined #openstack-dev | 07:07 | |
| *** jistr has joined #openstack-dev | 07:11 | |
| *** gargya has joined #openstack-dev | 07:12 | |
| *** egallen has joined #openstack-dev | 07:13 | |
| *** jprovazn has joined #openstack-dev | 07:15 | |
| *** alexxu has quit IRC | 07:19 | |
| *** SergeyLukjanov has joined #openstack-dev | 07:19 | |
| *** flaper87|afk is now known as flaper87 | 07:20 | |
| *** anteaya has quit IRC | 07:21 | |
| *** xga has quit IRC | 07:23 | |
| *** davidhadas has quit IRC | 07:23 | |
| *** romcheg has quit IRC | 07:23 | |
| *** Ryan_Lane has joined #openstack-dev | 07:26 | |
| *** AlexF has joined #openstack-dev | 07:29 | |
| *** Ryan_Lane has quit IRC | 07:30 | |
| *** vipul-away is now known as vipul | 07:30 | |
| *** mmagr has joined #openstack-dev | 07:31 | |
| *** faramir has joined #openstack-dev | 07:32 | |
| *** odyssey4me2 has quit IRC | 07:32 | |
| *** adjohn has joined #openstack-dev | 07:33 | |
| *** athomas has joined #openstack-dev | 07:33 | |
| *** JordanP has joined #openstack-dev | 07:34 | |
| *** MaxV has joined #openstack-dev | 07:34 | |
| *** jcoufal has joined #openstack-dev | 07:34 | |
| *** arezmerita has joined #openstack-dev | 07:36 | |
| *** amuller has joined #openstack-dev | 07:38 | |
| *** xqueralt has joined #openstack-dev | 07:40 | |
| *** DinaBelova has joined #openstack-dev | 07:41 | |
| *** danwent has quit IRC | 07:41 | |
| aloga | henrynash: ping? | 07:42 |
| *** adjohn has quit IRC | 07:42 | |
| *** adjohn has joined #openstack-dev | 07:42 | |
| *** flaper87 is now known as flaper87|afk | 07:43 | |
| *** ifarkas has joined #openstack-dev | 07:44 | |
| *** ArcTanSusan has quit IRC | 07:45 | |
| *** odyssey4me has joined #openstack-dev | 07:47 | |
| *** ifarkas has quit IRC | 07:48 | |
| *** danpb has joined #openstack-dev | 07:48 | |
| *** yassine has joined #openstack-dev | 07:48 | |
| *** aditirav has quit IRC | 07:49 | |
| *** ifarkas has joined #openstack-dev | 07:51 | |
| *** Ryan_Lane has joined #openstack-dev | 07:56 | |
| *** flaper87|afk is now known as flaper87 | 07:59 | |
| *** jcoufal_ has joined #openstack-dev | 07:59 | |
| *** Ryan_Lane has quit IRC | 08:01 | |
| *** jpich has joined #openstack-dev | 08:01 | |
| *** jcoufal has quit IRC | 08:02 | |
| *** davidhadas has joined #openstack-dev | 08:03 | |
| *** boden has joined #openstack-dev | 08:04 | |
| *** xga has joined #openstack-dev | 08:05 | |
| *** jtomasek has quit IRC | 08:05 | |
| *** pixelb has joined #openstack-dev | 08:06 | |
| henrynash | aloga: hi | 08:08 |
| *** safchain_ has joined #openstack-dev | 08:09 | |
| *** feleouet has quit IRC | 08:09 | |
| *** flaper87 is now known as flaper87|afk | 08:09 | |
| *** safchain_ has quit IRC | 08:09 | |
| *** amcrn has quit IRC | 08:10 | |
| *** safchain has joined #openstack-dev | 08:11 | |
| *** giulivo has joined #openstack-dev | 08:11 | |
| *** flaper87|afk is now known as flaper87 | 08:12 | |
| *** FatDarrel has quit IRC | 08:12 | |
| *** corXi has joined #openstack-dev | 08:12 | |
| *** davidhadas has quit IRC | 08:13 | |
| *** boris-42 has joined #openstack-dev | 08:15 | |
| *** derekh has joined #openstack-dev | 08:16 | |
| *** djoreilly has joined #openstack-dev | 08:17 | |
| *** AlexF has quit IRC | 08:17 | |
| *** davidhadas has joined #openstack-dev | 08:19 | |
| *** jtomasek has joined #openstack-dev | 08:20 | |
| *** basha has joined #openstack-dev | 08:23 | |
| *** djoreilly has quit IRC | 08:24 | |
| *** djoreilly has joined #openstack-dev | 08:25 | |
| *** tvb has quit IRC | 08:26 | |
| *** aloga has quit IRC | 08:26 | |
| *** Ryan_Lane has joined #openstack-dev | 08:27 | |
| *** s2r2 has left #openstack-dev | 08:28 | |
| *** matsuhashi has quit IRC | 08:28 | |
| *** flaper87 is now known as flaper87|afk | 08:28 | |
| *** lucasagomes has joined #openstack-dev | 08:28 | |
| *** matsuhashi has joined #openstack-dev | 08:28 | |
| *** Ryan_Lane has quit IRC | 08:31 | |
| *** DeeJay1 has joined #openstack-dev | 08:32 | |
| *** AlexF has joined #openstack-dev | 08:32 | |
| *** djoreilly has quit IRC | 08:32 | |
| DeeJay1 | hi, quick question: how can I override rabbit_host and rabbit_password in my custom service (using rpc from openstack.common) | 08:32 |
| *** jprovazn has quit IRC | 08:32 | |
| *** sld has quit IRC | 08:33 | |
| *** aloga has joined #openstack-dev | 08:33 | |
| *** jistr has quit IRC | 08:33 | |
| *** jasondot_ has joined #openstack-dev | 08:35 | |
| *** jistr has joined #openstack-dev | 08:35 | |
| aloga | henrynash: sorry, lost connection | 08:38 |
| aloga | henrynash: I was having a look at https://bugs.launchpad.net/keystone/+bug/1211233 | 08:38 |
| uvirtbot | Launchpad bug 1211233 in keystone "REMOTE_USER support should be more flexible in how domain is specified" [Wishlist,New] | 08:38 |
| aloga | since heavily using the external authentication | 08:39 |
| aloga | s/since/since we're/ | 08:39 |
| *** bnemec has quit IRC | 08:39 | |
| *** flaper87|afk is now known as flaper87 | 08:39 | |
| *** Alexei_987 has joined #openstack-dev | 08:39 | |
| *** johnthetubaguy has joined #openstack-dev | 08:41 | |
| BobBall | bigmstone: What error message? | 08:42 |
| *** AlexF has quit IRC | 08:42 | |
| henrynash | aloga: yes | 08:43 |
| henrynash | aloga: we have made some improvements to that domain handling code anyway | 08:44 |
| *** DinaBelova has quit IRC | 08:44 | |
| henrynash | aloga: so not sure how important this one is now | 08:44 |
| aloga | for us it is a problem that keystone splits the username in the "@" | 08:44 |
| *** ndipanov_gone is now known as ndipanov | 08:44 | |
| henrynash | aloga: yes, that was my thought….for some that won't be good answer | 08:44 |
| aloga | for example, using X.509 auth some usernames (the DNs) can contain a "@" | 08:45 |
| aloga | so the final username is wrong :-( | 08:45 |
| henrynash | aloga: well that's OK, since won't the domain name ALWAYS be appended…..and we only take the right most @ ? | 08:45 |
| henrynash | aloga: or is it that you want the default domain to be used | 08:46 |
| *** ivoks_ is now known as ivoks | 08:46 | |
| *** basha has quit IRC | 08:46 | |
| *** sc68cal has quit IRC | 08:46 | |
| *** ivoks has quit IRC | 08:46 | |
| *** ivoks has joined #openstack-dev | 08:46 | |
| *** sc68cal has joined #openstack-dev | 08:46 | |
| aloga | henrynash: yeah, but what if there's no domain | 08:46 |
| *** rohitk has joined #openstack-dev | 08:47 | |
| *** qba73 has joined #openstack-dev | 08:47 | |
| aloga | if the external auth appends an "@" and the domain, it is OK (the rightmost @ will be used) | 08:47 |
| *** davidhadas_ has joined #openstack-dev | 08:47 | |
| henrynash | aloga: I agree, in the case where you don't want to specify the domain, that's an issue….although you could just tack on 'default' | 08:47 |
| aloga | but if there's no domain at all, the code still splits the username https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/external.py#L39 | 08:48 |
| henrynash | aloga: yep, I know | 08:48 |
| *** johnthetubaguy1 has joined #openstack-dev | 08:48 | |
| henrynash | aloga: what kind of external auth are u using? | 08:48 |
| *** faramir has quit IRC | 08:48 | |
| aloga | henrynash: we are using some WSGI middleware | 08:49 |
| aloga | i mean, for us it is not a real problem | 08:49 |
| henrynash | aloga: yep, me too | 08:49 |
| aloga | since we can set whatever we want :-] | 08:49 |
| *** johnthetubaguy has quit IRC | 08:50 | |
| henrynash | aloga: when I wrote the defect, I had imagined the case when a wsgi plugin would pass the fully formed auth structure to identify the user…. | 08:50 |
| *** davidhadas has quit IRC | 08:50 | |
| aloga | henrynash: you mean in the request body, right? | 08:50 |
| henrynash | aloga: something you can't really do with apache-http, but you can witha awsgi plugin | 08:51 |
| henrynash | aloga: right | 08:51 |
| aloga | henrynash: yeah, my concern was about using apache directly | 08:51 |
| aloga | henrynash: for example, somebody using X509 auth directly with apache | 08:51 |
| aloga | henrynash: like this example http://docs.openstack.org/developer/keystone/external-auth.html#x-509-example | 08:52 |
| henrynash | aloga: so I'm open to suggestions on how to improve…. | 08:52 |
| aloga | henrynash: I think that if we're using a wsgi middleware we can enforce to set the domain part in the request body | 08:53 |
| henrynash | aloga: agreed | 08:53 |
| aloga | henrynash: the problem for me is if we're not using a middleware at all | 08:53 |
| aloga | :-/ | 08:53 |
| aloga | henrynash: for example the x509 authentication using mod_ssl in Apache | 08:54 |
| *** vartom18 has quit IRC | 08:55 | |
| *** vartom19 has joined #openstack-dev | 08:55 | |
| henrynash | aloga: so aren't there two remote_user backends you can select - one that expects a domain and one that doesn't? | 08:55 |
| henrynash | aloga: item later will assume the default domain | 08:55 |
| henrynash | aloga: I think it's a config file option | 08:55 |
| aloga | henrynash: yeah, but what if we're mixing them? | 08:55 |
| aloga | lets say I have a WSGI middleware and x509 auth | 08:56 |
| aloga | how will the backend be selected? | 08:56 |
| henrynash | aloga: now you're just shooting for the moon :-) | 08:57 |
| henrynash | aloga: fair point, yep that won't work... | 08:57 |
| aloga | henrynash: hehe | 08:57 |
| *** Ryan_Lane has joined #openstack-dev | 08:57 | |
| aloga | henrynash: it seems a complicated scenario, I know | 08:58 |
| *** prekarat has joined #openstack-dev | 08:58 | |
| henrynash | aloga: you could define the domain separator in a config file? | 08:58 |
| *** DinaBelova has joined #openstack-dev | 08:59 | |
| *** davidhadas has joined #openstack-dev | 08:59 | |
| aloga | henrynash: that could do the trick, but I'm not sure | 08:59 |
| aloga | henrynash: for example, using x509 certs the DN can contain a lot of characters | 09:00 |
| *** Ryan_Lane has quit IRC | 09:01 | |
| *** davidhadas_ has quit IRC | 09:01 | |
| *** tkammer has quit IRC | 09:01 | |
| *** markmc has joined #openstack-dev | 09:01 | |
| *** Nikolay_1t has quit IRC | 09:03 | |
| aloga | henrynash: the only thing that comes to my mind is setting an env var that will be passed down | 09:06 |
| aloga | henrynash: so as to discriminate between domain and domainless | 09:06 |
| aloga | henrynash: I do not know if this is the best idea, though | 09:06 |
| aloga | henrynash: (and I guess it is not) | 09:06 |
| henrynash | aloga: could work…. | 09:06 |
| henrynash | aloga: but feels a bit of overkill…maybe..lety's mull on it for a bit | 09:07 |
| aloga | henrynash: what I am not sure is if we should split the username by an "@" in the ExternalDefault plugin | 09:08 |
| aloga | since we're using the default domain, shouldn't we use the username as it is provided? | 09:08 |
| *** DinaBelova has quit IRC | 09:08 | |
| aloga | henrynash: or at least behave the same way as the ExternalDomain (i.e. thake the rightmost one) | 09:09 |
| henrynash | aloga: hmm…i need to look at that…need to go off line for a bit, but I'll take a look later…. | 09:09 |
| aloga | henrynash: if you can I can have a look and submit a review and discuss things there | 09:10 |
| aloga | s/can/want/ | 09:10 |
| henrynash | aloga: good topic | 09:10 |
| henrynash | aloga: sure….that would be great | 09:10 |
| aloga | henrynash: then count on it during this morning ;-) | 09:10 |
| henrynash | aloga: excellent! :-) | 09:11 |
| aloga | great, I'll let you know | 09:12 |
| *** romcheg has joined #openstack-dev | 09:12 | |
| *** amerine has quit IRC | 09:13 | |
| *** henrynash has quit IRC | 09:14 | |
| ttx | markmc: last bug in oslo rc1 is fixcommitted. Let me know if we should cut stable/havana from there | 09:15 |
| markmc | ttx, yep, please do ... and thanks | 09:15 |
| ttx | markmc: shall we tag something ? | 09:16 |
| * ttx will look at how we did it for grizzly | 09:16 | |
| markmc | ttx, heh :) | 09:16 |
| markmc | ttx, whatever tags your using for rc1 would make sense to me | 09:16 |
| markmc | ttx, fwiw, I've found the tags useful ... even if they don't correspond to a tarball release | 09:17 |
| markmc | ttx, e.g. looking at we did in a milestone period | 09:17 |
| *** o_petit has quit IRC | 09:17 | |
| ttx | we did a 2013.1.rc1 back then. Trying to see how it related to stable/grizzly cut | 09:18 |
| ttx | ok, will tag 2013.2.rc1 and cut a stable/havana branch from HEAD | 09:20 |
| *** s2r2 has joined #openstack-dev | 09:25 | |
| *** jtomasek has quit IRC | 09:25 | |
| *** michchap_ has joined #openstack-dev | 09:26 | |
| *** tkammer has joined #openstack-dev | 09:27 | |
| *** tvb has joined #openstack-dev | 09:27 | |
| *** Ryan_Lane has joined #openstack-dev | 09:27 | |
| markmc | ttx, cool | 09:28 |
| *** adjohn has quit IRC | 09:29 | |
| markmc | ttx, since we've now disabled lazy translation, we should probably unmark the blueprints as translated e.g. https://blueprints.launchpad.net/nova/+spec/user-locale-api | 09:29 |
| markmc | ttx, I'll just go ahead and do that? | 09:29 |
| *** adjohn has joined #openstack-dev | 09:29 | |
| *** michchap has quit IRC | 09:29 | |
| ttx | stable/havana is up | 09:30 |
| ttx | (for oslo-incubator) | 09:30 |
| ttx | markmc: yes, I suppose we have to... | 09:30 |
| markmc | ttx, ok | 09:30 |
| *** ema has joined #openstack-dev | 09:30 | |
| *** ema has joined #openstack-dev | 09:30 | |
| *** flaper87 is now known as flaper87|afk | 09:31 | |
| *** tvb has quit IRC | 09:31 | |
| *** Ryan_Lane has quit IRC | 09:32 | |
| *** AlexF has joined #openstack-dev | 09:32 | |
| markmc | ttx, unset series and set milestone to next, right? | 09:32 |
| ttx | markmc: and probably mark unimplemented | 09:32 |
| markmc | ttx, yeah, moved it back to Good Progress | 09:33 |
| *** faramir has joined #openstack-dev | 09:33 | |
| *** xga has quit IRC | 09:35 | |
| *** xga has joined #openstack-dev | 09:35 | |
| *** jtomasek has joined #openstack-dev | 09:38 | |
| *** aspiers has joined #openstack-dev | 09:41 | |
| *** flaper87|afk is now known as flaper87 | 09:42 | |
| *** bashok has joined #openstack-dev | 09:42 | |
| *** egallen has quit IRC | 09:44 | |
| *** djoreilly has joined #openstack-dev | 09:45 | |
| openstackstatus | NOTICE: One of our Jenkins masters is failing to return results, so the gate is currently stuck. | 09:46 |
| *** rohitk has quit IRC | 09:46 | |
| *** egallen has joined #openstack-dev | 09:49 | |
| *** fandikurnia01 has joined #openstack-dev | 09:50 | |
| openstackstatus | NOTICE: Jenkins01 is not failing, it's just very slow at the moment... so the gate is not completely stuck. | 09:54 |
| *** jab416171 has quit IRC | 09:54 | |
| *** ygbo has joined #openstack-dev | 09:55 | |
| *** faramir has quit IRC | 09:57 | |
| *** Ryan_Lane has joined #openstack-dev | 09:58 | |
| *** bashok has quit IRC | 09:58 | |
| *** bashok has joined #openstack-dev | 09:58 | |
| *** DinaBelova has joined #openstack-dev | 10:00 | |
| *** Ryan_Lane has quit IRC | 10:02 | |
| *** avishay has quit IRC | 10:02 | |
| *** tkammer has quit IRC | 10:04 | |
| *** hugokuo has quit IRC | 10:04 | |
| *** hugokuo has joined #openstack-dev | 10:05 | |
| *** jasondot_ has quit IRC | 10:06 | |
| *** mrunge has quit IRC | 10:07 | |
| *** davidhadas_ has joined #openstack-dev | 10:09 | |
| *** davidhadas has quit IRC | 10:12 | |
| *** anniec has joined #openstack-dev | 10:12 | |
| *** anniec_ has joined #openstack-dev | 10:15 | |
| *** matsuhashi has quit IRC | 10:16 | |
| *** anniec has quit IRC | 10:16 | |
| *** anniec_ is now known as anniec | 10:17 | |
| *** tkammer has joined #openstack-dev | 10:17 | |
| *** xqueralt is now known as xqueralt-afk | 10:19 | |
| *** avishay has joined #openstack-dev | 10:21 | |
| *** SergeyLukjanov has quit IRC | 10:27 | |
| *** schwicht has joined #openstack-dev | 10:27 | |
| *** tvb has joined #openstack-dev | 10:28 | |
| *** henrynash has joined #openstack-dev | 10:28 | |
| *** Ryan_Lane has joined #openstack-dev | 10:28 | |
| *** corXi has quit IRC | 10:28 | |
| *** AlexF has quit IRC | 10:30 | |
| *** dims has joined #openstack-dev | 10:30 | |
| *** amuller_ has joined #openstack-dev | 10:31 | |
| *** amuller has quit IRC | 10:31 | |
| *** tvb has quit IRC | 10:32 | |
| *** Ryan_Lane has quit IRC | 10:32 | |
| *** jvrbanac has quit IRC | 10:33 | |
| *** SergeyLukjanov has joined #openstack-dev | 10:33 | |
| *** jvrbanac has joined #openstack-dev | 10:33 | |
| *** pcm_ has joined #openstack-dev | 10:33 | |
| *** Shaan7 has quit IRC | 10:33 | |
| *** Shaan7 has joined #openstack-dev | 10:33 | |
| *** pcm_ has quit IRC | 10:34 | |
| *** pcm_ has joined #openstack-dev | 10:34 | |
| *** yaguang has joined #openstack-dev | 10:35 | |
| *** AlexF has joined #openstack-dev | 10:37 | |
| *** faramir has joined #openstack-dev | 10:39 | |
| *** sdake_ has quit IRC | 10:40 | |
| *** sdake has quit IRC | 10:41 | |
| *** sdake_ has joined #openstack-dev | 10:41 | |
| *** sdake_ has quit IRC | 10:41 | |
| *** sdake_ has joined #openstack-dev | 10:41 | |
| *** sdake has joined #openstack-dev | 10:41 | |
| *** adjohn has quit IRC | 10:45 | |
| *** venkatesh has joined #openstack-dev | 10:46 | |
| *** jeblair has quit IRC | 10:47 | |
| *** jeblair has joined #openstack-dev | 10:48 | |
| *** adjohn has joined #openstack-dev | 10:49 | |
| *** AlexF has quit IRC | 10:50 | |
| *** adjohn has quit IRC | 10:53 | |
| *** adjohn has joined #openstack-dev | 10:54 | |
| *** AlexF has joined #openstack-dev | 10:55 | |
| *** amuller_ has quit IRC | 10:58 | |
| *** Ryan_Lane has joined #openstack-dev | 10:58 | |
| *** amuller__ has joined #openstack-dev | 10:59 | |
| *** fbo is now known as fbo_away | 10:59 | |
| *** amuller has joined #openstack-dev | 10:59 | |
| *** faramir has quit IRC | 11:00 | |
| *** johnthetubaguy1 is now known as johnthetubaguy | 11:01 | |
| *** alexpilotti has joined #openstack-dev | 11:02 | |
| *** Ryan_Lane has quit IRC | 11:03 | |
| *** sdake_ has quit IRC | 11:03 | |
| *** jtomasek has quit IRC | 11:03 | |
| *** sdake_ has joined #openstack-dev | 11:03 | |
| *** sdake_ has quit IRC | 11:03 | |
| *** sdake_ has joined #openstack-dev | 11:03 | |
| *** markmc has quit IRC | 11:04 | |
| *** adjohn has quit IRC | 11:05 | |
| *** raies has quit IRC | 11:06 | |
| *** adjohn has joined #openstack-dev | 11:07 | |
| *** avishay has quit IRC | 11:07 | |
| *** SergeyLukjanov has quit IRC | 11:08 | |
| *** jruzicka has joined #openstack-dev | 11:08 | |
| *** dims has quit IRC | 11:09 | |
| *** SergeyLukjanov has joined #openstack-dev | 11:10 | |
| *** yaguang has quit IRC | 11:12 | |
| *** morazi has quit IRC | 11:13 | |
| *** adalbas has joined #openstack-dev | 11:15 | |
| *** nosnos has quit IRC | 11:16 | |
| *** egallen has quit IRC | 11:17 | |
| *** jtomasek has joined #openstack-dev | 11:19 | |
| ttx | and the winner is.. keystone | 11:19 |
| *** afazekas_no_irq has quit IRC | 11:20 | |
| *** venkatesh has quit IRC | 11:20 | |
| *** egallen has joined #openstack-dev | 11:20 | |
| *** egallen has quit IRC | 11:20 | |
| *** exed has joined #openstack-dev | 11:21 | |
| *** tvb has joined #openstack-dev | 11:23 | |
| *** CaptTofu has quit IRC | 11:25 | |
| *** CaptTofu has joined #openstack-dev | 11:26 | |
| *** venkatesh has joined #openstack-dev | 11:28 | |
| *** Ryan_Lane has joined #openstack-dev | 11:29 | |
| sdague | first to RC? | 11:31 |
| *** corXi has joined #openstack-dev | 11:33 | |
| *** Ryan_Lane has quit IRC | 11:33 | |
| ttx | sdague: yes | 11:34 |
| ttx | sdague: it's been a fun retry race between Glance and keystone over the last two days | 11:34 |
| jd__ | :( | 11:36 |
| jd__ | that's the fault of gettext, otherwise Ceilometer would have win! :) | 11:36 |
| *** dims has joined #openstack-dev | 11:36 | |
| *** venkatesh has quit IRC | 11:38 | |
| *** FunnyLookinHat has joined #openstack-dev | 11:38 | |
| *** dims has quit IRC | 11:41 | |
| *** dims has joined #openstack-dev | 11:42 | |
| ttx | jd__: you could push the icehouse version bump as depending on 49278 and shove it on queue | 11:44 |
| jd__ | ttx: ack | 11:44 |
| ttx | jd__: model commit @ https://review.openstack.org/#/c/49029/ | 11:45 |
| *** zbitter is now known as zaneb | 11:46 | |
| *** jistr is now known as jistr|afk | 11:46 | |
| *** sandywalsh has quit IRC | 11:49 | |
| jd__ | ttx: https://review.openstack.org/#/c/49353 | 11:49 |
| *** dstanek has joined #openstack-dev | 11:50 | |
| *** tellesnobrega has joined #openstack-dev | 11:52 | |
| *** jistr|afk is now known as jistr|english | 11:52 | |
| *** adjohn has quit IRC | 11:52 | |
| *** flaper87 is now known as flaper87|afk | 11:53 | |
| tellesnobrega | hi, how can i print something while running the run_tests.sh, im trying to learn more about the code, but i cant see any output from print | 11:53 |
| ttx | jd__: feel free to self-approve it | 11:54 |
| *** CaptTofu has quit IRC | 11:54 | |
| jd__ | ttx: done :) | 11:54 |
| *** CaptTofu has joined #openstack-dev | 11:54 | |
| ttx | jd__: it might need a +2 too :) | 11:56 |
| ttx | not sure that's still necessary though | 11:56 |
| jd__ | not sure too but added anyway | 11:56 |
| *** o_petit has joined #openstack-dev | 11:57 | |
| *** sgordon has joined #openstack-dev | 11:57 | |
| *** sgordon has joined #openstack-dev | 11:57 | |
| *** Ryan_Lane has joined #openstack-dev | 11:59 | |
| *** derekh has quit IRC | 11:59 | |
| *** topol has joined #openstack-dev | 11:59 | |
| *** fbo_away is now known as fbo | 12:01 | |
| *** galstrom_zzz is now known as galstrom | 12:03 | |
| *** Ryan_Lane has quit IRC | 12:03 | |
| *** salv-orlando has joined #openstack-dev | 12:06 | |
| *** galstrom is now known as galstrom_zzz | 12:06 | |
| *** viraptor has joined #openstack-dev | 12:07 | |
| *** AlexF has quit IRC | 12:08 | |
| *** dprince has joined #openstack-dev | 12:09 | |
| *** DinaBelova has quit IRC | 12:09 | |
| *** mkollaro has joined #openstack-dev | 12:10 | |
| *** xyander has joined #openstack-dev | 12:10 | |
| *** djoreilly_ has joined #openstack-dev | 12:10 | |
| viraptor | hi all, could someone tell me if there's any relation between the rpc pool size and the possible concurrent handling of incoming messages in services? (scheduler specifically) or is the connection pool only used for specific channels / outgoing messages? | 12:11 |
| *** morazi has joined #openstack-dev | 12:11 | |
| *** kbringard has joined #openstack-dev | 12:12 | |
| *** danpb has quit IRC | 12:13 | |
| *** jab416171 has joined #openstack-dev | 12:13 | |
| *** gordc has joined #openstack-dev | 12:16 | |
| *** flaper87|afk is now known as flaper87 | 12:17 | |
| *** sthaha has quit IRC | 12:17 | |
| *** lucasagomes is now known as lucas-hungry | 12:20 | |
| *** bashok has quit IRC | 12:20 | |
| *** bashok has joined #openstack-dev | 12:21 | |
| *** jvrbanac has quit IRC | 12:24 | |
| *** shakayumi has joined #openstack-dev | 12:25 | |
| *** imsurit has joined #openstack-dev | 12:25 | |
| bigmstone | BobBall: Exact virtlib error as before. I can rearrange the statements to get rid of that error but others just pop up. Once I get to work I can give you the trace of the latest one. | 12:25 |
| *** xyander has quit IRC | 12:26 | |
| BobBall | bigmstone: that'd be great, thanks :) | 12:27 |
| bigmstone | BobBall: Is the master github branch the latest working havana repo? | 12:27 |
| BobBall | bigmstone: yup - that's right. We have a number of Citrix fixes too that aren't in master yet, but they don't affect aggregates AFAIK | 12:28 |
| bigmstone | Because I'm working off the havana ubuntu archive. Which I think is 2013.2.b3? | 12:28 |
| BobBall | b3 is recent enough | 12:28 |
| BobBall | I'm also trying to set up a test for aggregates | 12:28 |
| BobBall | but it'll take a bit of time cuz I'm doing it automated | 12:29 |
| clouded_tux | I am able to make it run with yesterdays havana repo | 12:29 |
| bigmstone | Okay. I'll get you that trace. I fixed as much as I could up to the point I'm currently at. Then moved to havana with same results. Haven't done much past that. | 12:29 |
| BobBall | clouded_tux: aggregates with Xen? | 12:29 |
| clouded_tux | no.. | 12:29 |
| BobBall | okay :) | 12:29 |
| BobBall | shame :) | 12:29 |
| bigmstone | clouded_tux: everything works great with xen?..except pooling. :( | 12:29 |
| bigmstone | once pooled things break. | 12:30 |
| *** thomasm has joined #openstack-dev | 12:30 | |
| *** Ryan_Lane has joined #openstack-dev | 12:30 | |
| tellesnobrega | hi, how can i print something while running the run_tests.sh, im trying to learn more about the code, but i cant see any output from print | 12:30 |
| clouded_tux | oh.. sorry | 12:30 |
| bigmstone | not your fault. I'm willing to do what I can in the area as it directly affects my business. :) | 12:30 |
| *** jtomasek has quit IRC | 12:30 | |
| *** exed has quit IRC | 12:31 | |
| *** lucas-hungry is now known as lucasagomes | 12:32 | |
| *** danpb has joined #openstack-dev | 12:33 | |
| *** gargya has quit IRC | 12:33 | |
| *** xqueralt-afk is now known as xqueralt | 12:34 | |
| *** Ryan_Lane has quit IRC | 12:34 | |
| *** markmcclain1 has joined #openstack-dev | 12:38 | |
| *** markmcclain has quit IRC | 12:38 | |
| *** egallen has joined #openstack-dev | 12:40 | |
| *** tellesnobrega has quit IRC | 12:41 | |
| *** dkranz has joined #openstack-dev | 12:42 | |
| *** dtyarnell has quit IRC | 12:43 | |
| *** vladikr has joined #openstack-dev | 12:43 | |
| *** bashok has quit IRC | 12:44 | |
| *** bashok has joined #openstack-dev | 12:45 | |
| *** dolphm has joined #openstack-dev | 12:48 | |
| *** samuelbercovici has joined #openstack-dev | 12:49 | |
| *** bpokorny has joined #openstack-dev | 12:50 | |
| *** dnoll has joined #openstack-dev | 12:50 | |
| *** aditirav has joined #openstack-dev | 12:50 | |
| *** lucasagomes is now known as lucas-hungry | 12:51 | |
| *** salv-orlando_ has joined #openstack-dev | 12:52 | |
| *** bvandenh has joined #openstack-dev | 12:52 | |
| *** salv-orlando_ has quit IRC | 12:54 | |
| *** salv-orlando has quit IRC | 12:54 | |
| *** mjfork has joined #openstack-dev | 12:55 | |
| *** vartom19 has quit IRC | 12:55 | |
| *** jruzicka has quit IRC | 12:56 | |
| *** shakayumi has quit IRC | 12:59 | |
| *** spzala has joined #openstack-dev | 13:00 | |
| *** Ryan_Lane has joined #openstack-dev | 13:00 | |
| *** jayg|g0n3 is now known as jayg | 13:01 | |
| soren | Does this look familiar to anyone? (Neutron unit test failure) http://paste.openstack.org/show/47830/ | 13:02 |
| *** xqueralt has quit IRC | 13:02 | |
| ttx | soren: not really in the "familiar" category: http://logstash.openstack.org/#eyJzZWFyY2giOiJcIkZBSUw6IG5ldXRyb24udGVzdHMudW5pdC5jaXNjby50ZXN0X25leHVzX3BsdWdpbi5UZXN0Q2lzY29OZXh1c1BsdWdpbi50ZXN0X25leHVzX2FkZF9yZW1vdmVfcm91dGVyX2ludGVyZmFjZVwiIiwiZmllbGRzIjpbXSwib2Zmc2V0IjowLCJ0aW1lZnJhbWUiOiI2MDQ4MDAiLCJncmFwaG1vZGUiOiJjb3VudCIsInRpbWUiOnsidXNlcl9pbnRlcnZhbCI6MH0sInN0YW1wIjoxMzgwNzE5MDIyNzAzfQ== | 13:04 |
| *** radez_g0n3 is now known as radez | 13:05 | |
| *** Ryan_Lane has quit IRC | 13:05 | |
| *** iartarisi has joined #openstack-dev | 13:06 | |
| dims | ttx, there are hits for "is not JSON serializable" | 13:06 |
| *** xga_ has joined #openstack-dev | 13:06 | |
| *** venkatesh has joined #openstack-dev | 13:07 | |
| *** jtomasek has joined #openstack-dev | 13:07 | |
| soren | https://bugs.launchpad.net/neutron/+bug/1234012 looks related, too. | 13:08 |
| uvirtbot | Launchpad bug 1234012 in neutron "test_nexus_plugin.py duplicate values causes tests to fail." [Undecided,In progress] | 13:08 |
| soren | Ok, so it's not just me. | 13:08 |
| soren | Cool. | 13:08 |
| *** jcoufal_ is now known as jcoufal | 13:08 | |
| soren | I wonder how it passed through CI, though. | 13:08 |
| *** xga has quit IRC | 13:09 | |
| *** bashok has quit IRC | 13:10 | |
| *** bashok has joined #openstack-dev | 13:11 | |
| *** markmcclain1 has quit IRC | 13:11 | |
| *** markmcclain has joined #openstack-dev | 13:12 | |
| *** jruzicka has joined #openstack-dev | 13:12 | |
| *** dtyarnell has joined #openstack-dev | 13:13 | |
| *** sandywalsh has joined #openstack-dev | 13:14 | |
| *** eharney has joined #openstack-dev | 13:15 | |
| *** o_petit has quit IRC | 13:15 | |
| *** ayoung has joined #openstack-dev | 13:16 | |
| *** xqueralt has joined #openstack-dev | 13:17 | |
| *** Medha_B has joined #openstack-dev | 13:18 | |
| *** dolphm has quit IRC | 13:19 | |
| *** dperaza has joined #openstack-dev | 13:19 | |
| *** nermina has joined #openstack-dev | 13:20 | |
| *** giroro_ has quit IRC | 13:20 | |
| Medha_B | hi all.. | 13:20 |
| Medha_B | I am looking to contribute to OpenStack as a part of my application for OPW | 13:20 |
| Medha_B | Could anyone help me!? | 13:20 |
| Medha_B | thanks! :) | 13:20 |
| ayoung | Medha_B, OPW? | 13:20 |
| timello | Medha_B: http://www.openstack.org/community/ is a good start. | 13:22 |
| *** xga_ has quit IRC | 13:22 | |
| *** changbl has quit IRC | 13:22 | |
| *** xga_ has joined #openstack-dev | 13:22 | |
| *** Ruetobas has joined #openstack-dev | 13:23 | |
| *** bswartz has quit IRC | 13:24 | |
| Medha_B | opw- outreach program for women :) | 13:24 |
| Medha_B | @timello: yeah, going through the link.. | 13:25 |
| *** edmund has joined #openstack-dev | 13:25 | |
| *** dkehn_ is now known as dkehn | 13:26 | |
| ayoung | Medha_B, Are you a coder? | 13:26 |
| *** michchap_ has quit IRC | 13:27 | |
| Medha_B | yes.. | 13:28 |
| *** bnemec has joined #openstack-dev | 13:28 | |
| Medha_B | c/c++/java mainly.. | 13:29 |
| Medha_B | @ayoung: any help? :) | 13:30 |
| *** Ryan_Lane has joined #openstack-dev | 13:31 | |
| bnemec | DeeJay1: They're conf opts, so you would override them in the conf object. | 13:31 |
| bnemec | See here: https://github.com/openstack/oslo-incubator/blob/master/openstack/common/rpc/impl_kombu.py#L56 | 13:31 |
| *** lucas-hungry is now known as lucasagomes | 13:32 | |
| *** jistr|english is now known as jistr | 13:32 | |
| *** neelashah has joined #openstack-dev | 13:34 | |
| *** michchap has joined #openstack-dev | 13:34 | |
| *** yassine has quit IRC | 13:34 | |
| *** yassine has joined #openstack-dev | 13:35 | |
| *** Ryan_Lane has quit IRC | 13:35 | |
| *** Ruetobas has quit IRC | 13:35 | |
| *** rfolco has joined #openstack-dev | 13:35 | |
| *** READ10 has joined #openstack-dev | 13:38 | |
| *** rosmaita_ is now known as rosmaita | 13:39 | |
| *** tboerger has joined #openstack-dev | 13:41 | |
| *** DinaBelova has joined #openstack-dev | 13:41 | |
| *** Ruetobas has joined #openstack-dev | 13:41 | |
| *** Medha_B has left #openstack-dev | 13:41 | |
| *** burt has joined #openstack-dev | 13:41 | |
| *** dvarga_ has joined #openstack-dev | 13:44 | |
| *** tboerger has left #openstack-dev | 13:45 | |
| *** otherwiseguy has joined #openstack-dev | 13:46 | |
| *** marios has quit IRC | 13:48 | |
| *** dvarga_ is now known as dvarga | 13:49 | |
| *** salv-orlando has joined #openstack-dev | 13:51 | |
| *** marios has joined #openstack-dev | 13:52 | |
| *** jecarey has joined #openstack-dev | 13:54 | |
| *** imsurit has quit IRC | 13:54 | |
| *** thedodd has joined #openstack-dev | 13:59 | |
| *** bswartz has joined #openstack-dev | 13:59 | |
| *** DennyZhang has joined #openstack-dev | 13:59 | |
| *** yassine has quit IRC | 14:00 | |
| *** troytoman-away is now known as troytoman | 14:00 | |
| *** gimps_ has joined #openstack-dev | 14:01 | |
| *** yassine has joined #openstack-dev | 14:01 | |
| *** Ryan_Lane has joined #openstack-dev | 14:01 | |
| *** xqueralt has quit IRC | 14:01 | |
| DeeJay1 | bnemec: thx, although I ended up doing a config file anyway | 14:01 |
| *** DeeJay1 has quit IRC | 14:01 | |
| *** avishay has joined #openstack-dev | 14:02 | |
| bnemec | Sounds good. | 14:02 |
| *** bashok has quit IRC | 14:02 | |
| *** bashok has joined #openstack-dev | 14:02 | |
| *** egallen has quit IRC | 14:03 | |
| *** markwash has joined #openstack-dev | 14:04 | |
| bigmstone | BobBall: http://pastebin.com/qcNF4pYQ is the latest trace. I'm trying to run down the problem on my end as well, but you know more about this code than I. https://www.github.com/bigmstone/nova is all the changes I've made to get it this far (total of two line changes.) | 14:04 |
| *** dstanek has quit IRC | 14:06 | |
| *** Ryan_Lane has quit IRC | 14:06 | |
| *** AlexF has joined #openstack-dev | 14:07 | |
| *** demontiesantos has joined #openstack-dev | 14:07 | |
| *** dsantos_ has joined #openstack-dev | 14:08 | |
| *** topol has quit IRC | 14:08 | |
| *** dsantos_ has quit IRC | 14:08 | |
| *** zaitcev has joined #openstack-dev | 14:08 | |
| *** demontiesantos has joined #openstack-dev | 14:09 | |
| *** Dr_Who has joined #openstack-dev | 14:09 | |
| *** Dr_Who has joined #openstack-dev | 14:09 | |
| *** egallen has joined #openstack-dev | 14:10 | |
| *** FunnyLookinHat has quit IRC | 14:11 | |
| BobBall | bigmstone: So that sounds like the problem we've seen at https://bugs.launchpad.net/nova/+bug/1232179 | 14:12 |
| uvirtbot | Launchpad bug 1232179 in nova "Aggregate metadata is not correctly handled by compute" [Medium,Triaged] | 14:12 |
| BobBall | bigmstone: the aggregate should have this metadata but it's not there for some reason | 14:13 |
| *** bashok has quit IRC | 14:13 | |
| BobBall | Should be a simple fix | 14:13 |
| BobBall | replace "metadetails" with "metadata" | 14:13 |
| BobBall | in both places | 14:13 |
| *** bashok has joined #openstack-dev | 14:14 | |
| *** xqueralt has joined #openstack-dev | 14:14 | |
| *** imsurit has joined #openstack-dev | 14:16 | |
| *** Ruetobas has quit IRC | 14:17 | |
| *** dolphm has joined #openstack-dev | 14:18 | |
| *** tmclaugh[work] has joined #openstack-dev | 14:18 | |
| *** jimfehlig has joined #openstack-dev | 14:18 | |
| bigmstone | BobBall: so aggr is populated by running _virtapi.aggregate_get_by_host() | 14:19 |
| bknudson | having a problem running tox on ubuntu -- ERROR: tox version is 1.4.3, required is at least 1.6 | 14:20 |
| bigmstone | and aggregate_get_by_host is a function that includes "raise NotImplementedError()" | 14:20 |
| bigmstone | heh | 14:20 |
| *** dtyarnell has quit IRC | 14:20 | |
| *** venkatesh has quit IRC | 14:20 | |
| bknudson | never mind. sudo pip install tox --upgrade | 14:20 |
| *** Ruetobas has joined #openstack-dev | 14:20 | |
| *** tvb has quit IRC | 14:22 | |
| *** edmund has quit IRC | 14:23 | |
| *** lbragstad has quit IRC | 14:23 | |
| *** dtyarnell has joined #openstack-dev | 14:23 | |
| *** markmc has joined #openstack-dev | 14:24 | |
| *** venkatesh has joined #openstack-dev | 14:25 | |
| *** aeperezt has joined #openstack-dev | 14:25 | |
| *** briancurtin has joined #openstack-dev | 14:26 | |
| *** markwash has quit IRC | 14:28 | |
| *** litong has joined #openstack-dev | 14:29 | |
| *** jistr has quit IRC | 14:30 | |
| *** jistr has joined #openstack-dev | 14:30 | |
| *** jmontemayor has joined #openstack-dev | 14:30 | |
| *** avishay has quit IRC | 14:30 | |
| *** Ryan_Lane has joined #openstack-dev | 14:32 | |
| *** Guest49600 is now known as oubiwann_ | 14:32 | |
| *** Ruetobas has quit IRC | 14:33 | |
| *** ruhe has joined #openstack-dev | 14:33 | |
| *** exed has joined #openstack-dev | 14:34 | |
| *** dtyarnell has quit IRC | 14:35 | |
| *** Ryan_Lane has quit IRC | 14:36 | |
| *** o_petit has joined #openstack-dev | 14:37 | |
| *** rcleere has joined #openstack-dev | 14:37 | |
| *** topol has joined #openstack-dev | 14:38 | |
| *** matiu has joined #openstack-dev | 14:38 | |
| *** Ruetobas has joined #openstack-dev | 14:40 | |
| *** DinaBelova has quit IRC | 14:41 | |
| *** salv-orlando has quit IRC | 14:42 | |
| *** salv-orlando has joined #openstack-dev | 14:42 | |
| *** dkehn_ has joined #openstack-dev | 14:42 | |
| *** xga has joined #openstack-dev | 14:43 | |
| *** anteaya has joined #openstack-dev | 14:43 | |
| *** dtyarnell has joined #openstack-dev | 14:43 | |
| *** changbl has joined #openstack-dev | 14:44 | |
| *** prekarat1 has joined #openstack-dev | 14:44 | |
| *** Ruetobas has quit IRC | 14:45 | |
| *** prekarat has quit IRC | 14:45 | |
| *** dkehn has quit IRC | 14:45 | |
| *** avishay has joined #openstack-dev | 14:45 | |
| *** xga_ has quit IRC | 14:46 | |
| *** lbragstad has joined #openstack-dev | 14:47 | |
| *** changbl has quit IRC | 14:48 | |
| *** Ruetobas has joined #openstack-dev | 14:49 | |
| *** JordanP has quit IRC | 14:50 | |
| *** rnirmal has joined #openstack-dev | 14:50 | |
| *** dolphm has quit IRC | 14:51 | |
| *** datsun180b has joined #openstack-dev | 14:51 | |
| *** AlexF has quit IRC | 14:51 | |
| *** FunnyLookinHat has joined #openstack-dev | 14:53 | |
| *** dolphm has joined #openstack-dev | 14:54 | |
| *** dolphm has quit IRC | 14:54 | |
| *** bashok has quit IRC | 14:55 | |
| *** toabctl has quit IRC | 14:55 | |
| *** odyssey4me has quit IRC | 14:56 | |
| *** bashok has joined #openstack-dev | 14:56 | |
| *** xga_ has joined #openstack-dev | 14:56 | |
| *** Ruetobas has quit IRC | 14:58 | |
| BobBall | bigmstone: I think the impl is in sqlalchemy/api.py | 14:59 |
| *** xga has quit IRC | 15:00 | |
| *** reidrac has quit IRC | 15:00 | |
| *** tkammer has quit IRC | 15:00 | |
| *** changbl has joined #openstack-dev | 15:00 | |
| *** dnoll has quit IRC | 15:01 | |
| *** dolphm has joined #openstack-dev | 15:01 | |
| *** changbl has quit IRC | 15:01 | |
| BobBall | bigmstone: but I'm not sure about the proposed-fix... it looks like it should still be metadetails according to sqlalchemy/models.py | 15:01 |
| *** JordanP has joined #openstack-dev | 15:01 | |
| *** Ryan_Lane has joined #openstack-dev | 15:02 | |
| *** jvrbanac has joined #openstack-dev | 15:02 | |
| *** lyncos has joined #openstack-dev | 15:03 | |
| bigmstone | BobBall: out of curiosity and based on that bug report it seems like xen support is falling off? Would I be better suited running KVM? | 15:04 |
| BobBall | no! :) | 15:04 |
| BobBall | Xen support is definitely not falling off | 15:05 |
| bigmstone | Okay, just got that vibe from the comments. | 15:05 |
| BobBall | John's view is that we should continue with XenAPI support but possibly pull the aggregate support (i.e. individual hosts can be put in the cloud, but not as a XenServer pool) | 15:05 |
| BobBall | that'd work fine for everything except shared storage | 15:05 |
| BobBall | now that we've got xen storage motion, the reasons for shared storage are reduced in any case | 15:06 |
| BobBall | AFAIK KVM doesn't have an equivalent to the XenServer pool support? so it'd just be dropping a feature that KVM doesn't have anyway | 15:06 |
| BobBall | but no, Xen support is not going anywhere | 15:06 |
| *** Ryan_Lane has quit IRC | 15:06 | |
| bigmstone | Okay, that makes sense. It's just for my use case I /need/ pool support >:X | 15:07 |
| BobBall | I mean it is not decreasing - we are actively working on improving it | 15:07 |
| *** adalbas has quit IRC | 15:07 | |
| BobBall | Could you explain a little more on why? | 15:07 |
| *** egallen has quit IRC | 15:07 | |
| BobBall | just so that I've got more details to counter John's suggestion | 15:07 |
| *** briancurtin has quit IRC | 15:07 | |
| *** Mandell has quit IRC | 15:07 | |
| bigmstone | Sure. We're offer VDI to customers as well as hosted services. VDI is conducted with XenDesktop which interacts with the pools. | 15:07 |
| BobBall | Good reason ;) | 15:08 |
| *** changbl has joined #openstack-dev | 15:08 | |
| *** sushils has joined #openstack-dev | 15:08 | |
| *** Mandell has joined #openstack-dev | 15:08 | |
| *** garyk has quit IRC | 15:08 | |
| bigmstone | The hosted servers are done through OpenStack, or would be. | 15:08 |
| bigmstone | To give customers their own pane through which to manage resources. | 15:08 |
| *** Ryan_Lane has joined #openstack-dev | 15:09 | |
| BobBall | understood | 15:09 |
| BobBall | I'm planning to increase the support for pools btw | 15:09 |
| BobBall | rather than deprecate them | 15:09 |
| BobBall | :) | 15:09 |
| bigmstone | That would be awesome. And I would like to contribute as much as I can. Just will take time for me to get used to how things are done in OS. | 15:10 |
| BobBall | that's why I want to help you fix things here | 15:10 |
| *** Ruetobas has joined #openstack-dev | 15:10 | |
| *** egallen has joined #openstack-dev | 15:10 | |
| bigmstone | Hopefully as my team grows I can add more developers and support it and test it. | 15:11 |
| bigmstone | I am just trying to find a happy stable ground for a new arch. launch in December. | 15:11 |
| *** bashok has quit IRC | 15:11 | |
| BobBall | Sounds good | 15:12 |
| BobBall | I'm/we're more than happy to help you work through the aggregate stuff and get fixes committed - feel free to email openstack@citrix.com too with questions | 15:12 |
| *** Mandell has quit IRC | 15:12 | |
| *** bashok has joined #openstack-dev | 15:12 | |
| ekarlso | dtroyer: here mate ? | 15:12 |
| *** sandywalsh has quit IRC | 15:12 | |
| bigmstone | BobBall: do you work with Citrix? | 15:13 |
| bigmstone | or for them rather. | 15:13 |
| BobBall | I do | 15:13 |
| BobBall | I'm on the XenAPI OpenStack integration team ;) | 15:13 |
| ekarlso | BobBall: does citrix actually have folks working on openstack still ? :p | 15:13 |
| *** wink_ is now known as wink | 15:13 | |
| bigmstone | Ah. Well this all makes more sense then. | 15:13 |
| ekarlso | thought they all left or where put to other tasks :o | 15:13 |
| *** wink has quit IRC | 15:13 | |
| *** wink has joined #openstack-dev | 15:13 | |
| BobBall | *grin* ekarlso | 15:13 |
| BobBall | nah - I've been doing OpenStack for over a year myself | 15:14 |
| ekarlso | BobBall: one man army or ? :p | 15:14 |
| BobBall | and no chance I'm stopping! | 15:14 |
| *** sandywalsh has joined #openstack-dev | 15:14 | |
| bigmstone | BobBall: do you work with cloudstack too or that other teams? | 15:14 |
| BobBall | Actually i'm the OpenStack/XenServer integration team lead | 15:14 |
| BobBall | I don't touch cloudstack | 15:14 |
| ekarlso | BobBall: how many guys are you ? | 15:15 |
| BobBall | http://www.stackalytics.com/?release=havana&metric=commits&project_type=openstack&module=&company=citrix&user_id= | 15:15 |
| BobBall | All open | 15:15 |
| danpb | ekarlso: stackalytics can answer that kind of contribution question .... http://stackalytics.com/?release=havana&metric=commits&project_type=openstack&module=&company=citrix&user_id= | 15:15 |
| BobBall | just three have committed code to OpenStack | 15:15 |
| danpb | BobBall: snap ! | 15:15 |
| BobBall | haha | 15:15 |
| *** jtomasek has quit IRC | 15:15 | |
| *** mrodden has quit IRC | 15:15 | |
| BobBall | but Euan's been working on something that I think is very important to OpenStack too | 15:15 |
| BobBall | xenserver-core - the ability to run xenserver-like system from a base CentOS or Ubuntu install rather than needing to install XenServer on a raw system | 15:16 |
| *** otherwiseguy has quit IRC | 15:16 | |
| BobBall | He'll be making more contributions for IceHouse that's for sure | 15:16 |
| *** o_petit has quit IRC | 15:16 | |
| ekarlso | BobBall: like running stuff directly on dom0 | 15:16 |
| ekarlso | would be mega cool | 15:16 |
| ekarlso | instead of having vm's ... | 15:16 |
| BobBall | that's right ekarlso | 15:17 |
| ekarlso | which makes it suck :p | 15:17 |
| BobBall | in fact we're only one devstack patch away from that working fully | 15:17 |
| BobBall | it works for nova but devstack tries to remove python-lxml which in turn removes Xen which puts a bit of a dampner on running VMs... | 15:17 |
| *** devoid has joined #openstack-dev | 15:17 | |
| BobBall | unfortunately the fix for devstack is to put _everything_ in a global venv so we don't get conflicts between python-lxml and the pip installed version, so it's a big change | 15:18 |
| *** viraptor has quit IRC | 15:18 | |
| ekarlso | BobBall: so, you can do xenserver on ubuntu basically or ? | 15:18 |
| BobBall | yup ekarlso | 15:18 |
| *** corXi has quit IRC | 15:18 | |
| *** devoid has quit IRC | 15:18 | |
| ekarlso | BobBall: and how will that be in terms of support etc? :p | 15:18 |
| *** devoid has joined #openstack-dev | 15:18 | |
| BobBall | ekarlso: http://www.xenserver.org/discuss-virtualization/virtualization-blog/entry/building-xenserver-core.html | 15:18 |
| *** danwent has joined #openstack-dev | 15:19 | |
| BobBall | I know it says ubuntu might "surprise you" but unofficially it works - just some minor niggles being ironed out at the moment | 15:19 |
| *** devoid has quit IRC | 15:19 | |
| BobBall | we've had demos of VMs being live migrated under openstack from a CentOS xenserver-core host to a Ubuntu xenserver-core host | 15:19 |
| ekarlso | BobBall: eta ? :p | 15:19 |
| *** venkatesh has quit IRC | 15:19 | |
| BobBall | weeks I imagine | 15:19 |
| ekarlso | oooh | 15:19 |
| *** briancurtin has joined #openstack-dev | 15:19 | |
| ekarlso | I know some people here locally that would be interested in that :p | 15:20 |
| BobBall | well - weeks before we have RPMs/debs hosted that you can install and play with | 15:20 |
| BobBall | you can already play with xenserver-core on centos - but the released version doesn't quite work with openstack | 15:20 |
| BobBall | you need some extra hacks | 15:20 |
| *** diogogmt has joined #openstack-dev | 15:20 | |
| ekarlso | :/ | 15:20 |
| ekarlso | but BobBall how's the support with that ? | 15:21 |
| BobBall | That's what I'm working on removing :) | 15:21 |
| BobBall | This is all preview stuff - it doesn't have an official Citrix support story yet | 15:21 |
| BobBall | but it will all be built from the same code | 15:21 |
| BobBall | so it goes through the same QA etc | 15:21 |
| *** dstanek has joined #openstack-dev | 15:22 | |
| BobBall | in fact, we're targeting the next release of XenServer to fully include the xenserver-core binaries rather than building the two seperately from the same sources | 15:22 |
| BobBall | (they aren't currently the same sources - working through some merging efforts ATM too) | 15:22 |
| dtroyer | ekarlso: yo | 15:23 |
| BobBall | http://xenserver.org/blog/entry/tech-preview-of-xenserver-libvirt-ceph.html is the preview that I mentioned - but instead of the 0.3 packages use "latest" from http://xenbits.xen.org/djs/xenserver-core-latest-snapshot.x86_64.rpm (referenced from the mailing list message https://lists.xenserver.org/sympa/arc/xs-devel/2013-08/msg00027.html) | 15:23 |
| *** tvb has joined #openstack-dev | 15:23 | |
| *** tvb has quit IRC | 15:23 | |
| *** tvb has joined #openstack-dev | 15:23 | |
| ekarlso | dammit BobBall | 15:24 |
| *** cjellick has joined #openstack-dev | 15:24 | |
| BobBall | I've got some even newer code internally - with one annoying bug which means I can't start VMs - but when that's fixed I'll be trying to get some more RPMs published at which point it'll be way more complete and I'll be putting a blog post | 15:24 |
| ekarlso | you cause me to use more time on stuff I shouldn't :p | 15:24 |
| BobBall | *grin* I would apologise, but I'm not sorry! | 15:24 |
| BobBall | I know I have to say it cuz I work for Citrix but I think the xenserver-core stuff is a very cool development for us | 15:25 |
| *** oubiwann_ is now known as oubiwann | 15:26 | |
| *** ifarkas has quit IRC | 15:26 | |
| *** jmontemayor has quit IRC | 15:28 | |
| ekarlso | BobBall: does it include all the "xe" utility niceness as well ? | 15:28 |
| *** pmathews has joined #openstack-dev | 15:29 | |
| BobBall | yup | 15:29 |
| BobBall | Don't think it could be xenserver without xe! | 15:30 |
| *** aditirav has quit IRC | 15:30 | |
| BobBall | anyway - gotta brb | 15:30 |
| *** bashok has quit IRC | 15:30 | |
| BobBall | meeting to go to! | 15:30 |
| *** tvb has quit IRC | 15:30 | |
| ekarlso | dtroyer: wondering | 15:30 |
| *** bashok has joined #openstack-dev | 15:30 | |
| *** Ryan_Lane has quit IRC | 15:31 | |
| ekarlso | i'm wanting to setup docker as a HV for nova | 15:31 |
| ekarlso | would one then setup the docker registry running inside of docker or o nthe outside for production ? | 15:31 |
| dstanek | dolphm: i was reading the deprecate-v2-api blueprint this morning - is it really to just log deprecation warnings? | 15:32 |
| *** xga_ has quit IRC | 15:33 | |
| *** flaper87 is now known as flaper87|afk | 15:33 | |
| *** xga has joined #openstack-dev | 15:33 | |
| dolphm | dstanek: for now, i think | 15:33 |
| *** ruhe has quit IRC | 15:33 | |
| dtroyer | ekarlso: samalba is the one to ask there ^^^^^ my only experience with it is what we did in DevStack and Sam guided most of that | 15:34 |
| ayoung | dstanek, it is to tell people to stop coding the V2 api..I get questions about that all the time "is V3 ready?" | 15:34 |
| dolphm | dstanek: i'd like to have a v2<->v3 auth translation middleware soon, as that's the call we'll likely have to support for the longest time | 15:34 |
| lyncos | Hi, Here we have a real big unique domain .. and when I instruct keystone to connect to one of my local DC .. keystone try to get the list of DC for my whole domain and take a random one in that list .. the problem is we have Dc all around the world and not all the firewall are open ... My question is there any way to make keystone aware of Active Directory Sites ? | 15:34 |
| ekarlso | samalba: ping :D | 15:34 |
| dolphm | ayoung: bknudson: ^ ? | 15:34 |
| *** ruhe has joined #openstack-dev | 15:34 | |
| *** jvrbanac has quit IRC | 15:35 | |
| ayoung | dolphm, write up a spec. Sounds reasonable, but the devil is in the details | 15:35 |
| dstanek | dolphm: that sounds interesting - so that would keep the v2 auth calls, but just route them though v3? | 15:36 |
| bknudson | dolphm: we'd deprecate large part of v2 api, but leave auth part? | 15:37 |
| *** edmund has joined #openstack-dev | 15:37 | |
| dolphm | dstanek: yes | 15:37 |
| *** msmedved has quit IRC | 15:37 | |
| dolphm | dstanek: the v2 auth interface is a subset of v3's functionality, so it should be do-able | 15:38 |
| dolphm | bknudson: deprecate and kill the current code | 15:38 |
| dstanek | dolphm: why do you think that has to be around longer? | 15:38 |
| dolphm | dstanek: we have more clients that want to authenticate in the wild speaking v2 than we do administrative tools that need to use the rest of the v2 api | 15:38 |
| *** jmontemayor has joined #openstack-dev | 15:38 | |
| dolphm | dstanek: the core v2 api is tiny | 15:39 |
| *** msmedved has joined #openstack-dev | 15:39 | |
| bknudson | dolphm: it's the core v2 api that should not be deprecated and would be handled with middleware? | 15:39 |
| *** egallen has quit IRC | 15:39 | |
| *** wink has left #openstack-dev | 15:39 | |
| dstanek | dolphm: so first step is to deprecate and leave functional - then would we need a separate blueprint to actually remove the code? | 15:40 |
| bknudson | the calls would be translated to v3 calls | 15:40 |
| dolphm | bknudson: it would still be deprecated, i just think we'll need to have a longer deprecation cycle for the three calls on the public api | 15:40 |
| lyncos | Anyone can confirm my question about LDAP/AD | 15:40 |
| lyncos | ? | 15:40 |
| *** venkatesh has joined #openstack-dev | 15:40 | |
| dolphm | dstanek: yes | 15:40 |
| *** flaper87|afk is now known as flaper87 | 15:41 | |
| bknudson | lyncos: the only thing in keystone LDAP behavior that I know of that's AD specific is the handling of user enabled mask. | 15:41 |
| *** bdpayne has joined #openstack-dev | 15:41 | |
| dolphm | dstanek: we have to release it as deprecated for two releases, so that'll be 7 months from now | 15:41 |
| dolphm | before we can delete it | 15:41 |
| *** otherwiseguy has joined #openstack-dev | 15:41 | |
| bknudson | we should refactor so that the v3 controllers aren't derived from v2 controllers | 15:42 |
| lyncos | bknudson hmm ok it find it wierd that when I connect to our proxy it's not getting the list of all DC and connect directly | 15:42 |
| dolphm | dstanek: err, that's a lie... i was thinking if we deprecated it at the end of a release cycle. it'll be 12 months from now | 15:42 |
| bknudson | it's not an is-a relationship | 15:42 |
| lyncos | it's little strange | 15:42 |
| dolphm | bknudson: ++ | 15:42 |
| dstanek | bknudson: absolutely | 15:42 |
| dstanek | bknudson: i'll probably have to do that anyway to deprecate the v2 controller methods | 15:43 |
| bknudson | dstanek: right, that's why I was thinking of it. | 15:44 |
| *** athomas has quit IRC | 15:44 | |
| * dolphm p.s. if ya'll didn't notice... KEYSTONE IS OPEN FOR ICEHOUSE! w00t | 15:44 | |
| *** shinylasers has joined #openstack-dev | 15:44 | |
| *** iartarisi has quit IRC | 15:46 | |
| dims | dolphm, congrats! :) | 15:47 |
| *** AlexF has joined #openstack-dev | 15:48 | |
| *** imsurit has quit IRC | 15:48 | |
| ttx | dolphm: Glance too now. Publishing RC1 as we speak | 15:48 |
| *** egallen has joined #openstack-dev | 15:48 | |
| lbragstad | dolphm: ++ | 15:48 |
| *** oubiwann has quit IRC | 15:49 | |
| *** zhiyan has joined #openstack-dev | 15:49 | |
| bknudson | dolphm: there's no stable/icehouse? | 15:49 |
| *** jcoufal has quit IRC | 15:49 | |
| *** AlexF has quit IRC | 15:50 | |
| *** marun has quit IRC | 15:50 | |
| dolphm | bknudson: not yet, we don't have anything to backport yet anyway :P | 15:50 |
| bknudson | trying to figure out how to track backport of https://review.openstack.org/#/c/49272/ | 15:50 |
| *** Ryan_Lane has joined #openstack-dev | 15:50 | |
| dolphm | bknudson: stable/havana will be branched from here https://github.com/openstack/keystone/commit/b6b1e30d3b8d8d89ddb6d26b201a2f767ef83663 | 15:50 |
| *** Javin has joined #openstack-dev | 15:50 | |
| *** ruhe has quit IRC | 15:50 | |
| *** thingee_zzz is now known as thingee | 15:51 | |
| *** jvrbanac has joined #openstack-dev | 15:51 | |
| *** bashok has quit IRC | 15:51 | |
| *** bashok has joined #openstack-dev | 15:52 | |
| dolphm | bknudson: isn't some of this already in oslo.db? | 15:52 |
| *** yassine has quit IRC | 15:52 | |
| bknudson | dolphm: looks like oslo.db has a similar part. | 15:52 |
| *** boris-42 has quit IRC | 15:54 | |
| *** mrodden has joined #openstack-dev | 15:55 | |
| *** jistr has quit IRC | 15:55 | |
| *** prad has joined #openstack-dev | 15:56 | |
| *** ema has quit IRC | 15:56 | |
| *** bashok has quit IRC | 15:56 | |
| *** bashok has joined #openstack-dev | 15:56 | |
| jaypipes | here comes the ttx email storm :) | 15:57 |
| ttx | jaypipes: still following glance bugs I see | 15:57 |
| bknudson | https://github.com/openstack/oslo-incubator/blob/master/openstack/common/db/sqlalchemy/session.py#L604 vs https://github.com/openstack/keystone/blob/master/keystone/common/sql/core.py#L188 | 15:57 |
| jaypipes | ttx: yup :) | 15:57 |
| *** martyntaylor has quit IRC | 15:58 | |
| BobBall | bigmstone: Did you try replacing "metadetails" with "metadata"? Inspection suggests it should work and https://github.com/openstack/nova/blob/master/nova/tests/objects/test_aggregate.py#L34 suggests that this translation is being performed elsewhere as well, vlaidating it. I haven't tracked down _why_ the translation was added yet though... | 15:58 |
| *** Ryan_Lane has quit IRC | 15:59 | |
| BobBall | dansmith: ping! | 15:59 |
| *** anniec has quit IRC | 15:59 | |
| bigmstone | BobBall: Will check and let you know what happens. | 15:59 |
| bknudson | dolphm: maybe could change keystone/common/sql/core.py into more of a wrapper around oslo.db until can get rid of it. | 15:59 |
| dansmith | BobBall: ack | 16:00 |
| dolphm | bknudson: git blame the author that brought in oslo.db during havana-3... there was more WIP around that already | 16:00 |
| dolphm | bknudson: probably something i held for icehouse | 16:00 |
| *** jmontemayor has quit IRC | 16:00 | |
| BobBall | dansmith: https://review.openstack.org/#/c/44966/ added some tests for aggregates which included a translation between "metadetails" and "metadata" - do you know why that translation was needed? | 16:00 |
| dolphm | bknudson: i'm poking through oslo for the mysql keep alive | 16:00 |
| *** Ruetobas has quit IRC | 16:01 | |
| *** venkatesh has quit IRC | 16:01 | |
| *** jvrbanac has quit IRC | 16:01 | |
| dolphm | bknudson: https://github.com/openstack/oslo-incubator/blob/master/openstack/common/db/sqlalchemy/session.py#L604-L617 | 16:01 |
| dansmith | BobBall: because the sqlalchemy object uses metadetails, but we expose it as metadata in the new object | 16:01 |
| BobBall | I found the sqlalchemy bit - but where is the translation to the object? | 16:02 |
| BobBall | I'm clearly being blind because metadetails doesn't show up many times | 16:02 |
| BobBall | :D | 16:02 |
| bknudson | dolphm: the same fix I have in Keystone is proposed to oslo.db, but it uses oslo.db's _ENGINE rather than our GLOBAL_ENGINE. | 16:02 |
| BobBall | oh | 16:02 |
| BobBall | yes, I saw that bit, but I got confused | 16:02 |
| BobBall | in nova/objects/instance_group ? | 16:02 |
| *** gyee has joined #openstack-dev | 16:03 | |
| *** Ruetobas has joined #openstack-dev | 16:03 | |
| bknudson | dolphm: here's the fix in oslo-incubator | 16:03 |
| bknudson | https://review.openstack.org/#/c/48733/4/openstack/common/db/sqlalchemy/session.py | 16:03 |
| dansmith | BobBall: that's where it's done for instance_group, but nova/objects/aggregate.py should be it | 16:03 |
| * dansmith looks | 16:03 | |
| *** devoid has joined #openstack-dev | 16:04 | |
| dansmith | https://github.com/openstack/nova/blob/master/nova/objects/aggregate.py | 16:04 |
| dansmith | BobBall: ^ | 16:04 |
| *** hemnafk is now known as hemna_ | 16:04 | |
| BobBall | how the heck did I miss metadetails in that file?!?! | 16:04 |
| BobBall | thanks | 16:04 |
| BobBall | clearly my grep skills are rusty | 16:04 |
| bknudson | we could change keystone GLOBAL_ENGINE to be a ref to common.db.sqlalchemy.session._ENGINE | 16:04 |
| dansmith | BobBall: :) | 16:05 |
| *** jasdeepH has joined #openstack-dev | 16:05 | |
| BobBall | *shakes his head in dismay* | 16:05 |
| *** portante is now known as portante|afk | 16:06 | |
| exed | hi, i know it is not a 100% related dev question, but i think i could get the best answer here ;) I'm trying to debug the ovs network, because it is currently really slow 20mbs. how do you debug the network layer in openstack especially ovs? i have checked all ports/interfaces for any kind of rate limiting and it is not set. also I'm sure that it is not related to the network setup at all(switches, bare metal, …). any idea | 16:07 |
| exed | please :) | 16:07 |
| *** AlexF has joined #openstack-dev | 16:07 | |
| *** Ruetobas has quit IRC | 16:07 | |
| BobBall | bigmstone: dansmith just pointed me to the evidence as to why renaming metadetails to metadata in the xenapi driver is the right fix: https://review.openstack.org/#/c/43157/ | 16:07 |
| lyncos | exed we only got 2gbit/sec on OVS with virtio drivers | 16:08 |
| lyncos | On a 20Gbit/s network | 16:08 |
| lyncos | that number is per VM | 16:08 |
| bigmstone | BobBall: Cool. Here's hoping it doesn't just uncover a new trace. | 16:08 |
| * bigmstone is not hopeful. | 16:08 | |
| lyncos | If you not using virtio you it's will probably be slow | 16:08 |
| *** cjellick has quit IRC | 16:09 | |
| *** prad has left #openstack-dev | 16:09 | |
| exed | lyncos: i will double check this but I'm pretty sure, that the images we use make use of virtio drivers. | 16:09 |
| *** prekarat1 has quit IRC | 16:10 | |
| *** markmc has quit IRC | 16:10 | |
| lyncos | that's the only thing I see right now... you can also check in the kvm command line if you see it's using virtio | 16:12 |
| *** prekarat has joined #openstack-dev | 16:12 | |
| lyncos | I mean on your compute node | 16:12 |
| *** colinmcnamara has joined #openstack-dev | 16:12 | |
| *** jpich has quit IRC | 16:12 | |
| exed | lyncos: sure. | 16:12 |
| *** bashok_ has joined #openstack-dev | 16:12 | |
| *** changbl has quit IRC | 16:12 | |
| *** jvrbanac has joined #openstack-dev | 16:13 | |
| *** egallen has quit IRC | 16:13 | |
| *** AlexF has quit IRC | 16:13 | |
| *** Ruetobas has joined #openstack-dev | 16:13 | |
| *** Dr_Who has quit IRC | 16:13 | |
| *** Dr_Who has joined #openstack-dev | 16:16 | |
| *** nermina has quit IRC | 16:16 | |
| exed | lyncos: you really made me think to fucked up the virtio part but i double checked that, it works fine. thanks for your help i tried another compute node and can now say it is only one compute node. thanks a los | 16:16 |
| *** bashok has quit IRC | 16:16 | |
| exed | s/los/lot/ | 16:16 |
| *** cjellick has joined #openstack-dev | 16:16 | |
| *** salv-orlando has quit IRC | 16:17 | |
| *** salv-orlando has joined #openstack-dev | 16:17 | |
| *** xqueralt has quit IRC | 16:17 | |
| *** Ruetobas has quit IRC | 16:18 | |
| *** jvrbanac has quit IRC | 16:19 | |
| *** SergeyLukjanov has quit IRC | 16:20 | |
| *** egallen has joined #openstack-dev | 16:20 | |
| *** bashok_ has quit IRC | 16:21 | |
| *** bashok_ has joined #openstack-dev | 16:21 | |
| lyncos | :-) | 16:21 |
| lyncos | I'm glad this helps | 16:21 |
| *** ArcTanSusan has joined #openstack-dev | 16:22 | |
| *** alunduil has joined #openstack-dev | 16:22 | |
| *** safchain has quit IRC | 16:23 | |
| *** Ruetobas has joined #openstack-dev | 16:23 | |
| *** galstrom_zzz is now known as galstrom | 16:23 | |
| *** Dr_Who has quit IRC | 16:25 | |
| *** prekarat has quit IRC | 16:25 | |
| *** angdraug has joined #openstack-dev | 16:25 | |
| ayoung | dansmith, so..yesterday you pointed me at nova.compute.manager as the place to inject some logic done on host create. I assume that is run in the nova-compute server. The methods on it are called via the RPC from the scheduler? | 16:27 |
| *** o_petit has joined #openstack-dev | 16:27 | |
| dansmith | ayoung: yeah | 16:27 |
| ayoung | dansmith is "host" in there the VM? | 16:27 |
| mrodden | instance == VM | 16:28 |
| *** sandywalsh has quit IRC | 16:28 | |
| dansmith | ayoung: no, that's referring to the compute host | 16:28 |
| ayoung | dansmith, and lifecycle_events? | 16:28 |
| ayoung | ah..so init_host starts up the compuet instance, and then calls _init_instance on each instance it knows about. | 16:29 |
| dansmith | ayoung: no, init_host and init_instance are only called during compute startup (like when you boot the physical host) | 16:29 |
| *** qba73 has quit IRC | 16:30 | |
| ayoung | dansmith, right...so I wonder if this is not the right place to do work that needs to be done on initializing a new VM. | 16:30 |
| *** dtyarnell has quit IRC | 16:30 | |
| ayoung | Seems like it is more start or stop existing definitions, but does not build one from the image. | 16:31 |
| *** ausxxh has joined #openstack-dev | 16:31 | |
| *** o_petit has quit IRC | 16:31 | |
| ayoung | oh..wait... | 16:31 |
| * ayoung still learning this code base | 16:31 | |
| *** exed has quit IRC | 16:32 | |
| *** dmakogon_ipod has joined #openstack-dev | 16:32 | |
| ayoung | _run_instance | 16:32 |
| *** mmagr has quit IRC | 16:33 | |
| dansmith | ayoung: yeah, something in/around run_instance is what you're looking for | 16:33 |
| ayoung | dansmith, so what happens here in manager, is it handles a long running task on one (green)thread? | 16:34 |
| ayoung | and then sends back "ok, what's next?" | 16:35 |
| *** bvandenh has quit IRC | 16:36 | |
| *** dmakogon_ has joined #openstack-dev | 16:36 | |
| *** JordanP has quit IRC | 16:36 | |
| dansmith | ayoung: yes, manager is a bunch of greenthreads | 16:36 |
| *** alop has joined #openstack-dev | 16:36 | |
| ayoung | dansmith, so build_and_run_instance is tagged as syncronized. I assume that means all of that is in one new greenthread? | 16:37 |
| *** prekarat has joined #openstack-dev | 16:37 | |
| *** bashok_ has quit IRC | 16:37 | |
| *** bashok_ has joined #openstack-dev | 16:38 | |
| *** dmakogon_ipod has quit IRC | 16:38 | |
| dansmith | ayoung: AFAIK, the threads are created by the RPC layer, so every incoming request over RPC is a new thread | 16:38 |
| *** marun has joined #openstack-dev | 16:39 | |
| *** decede has quit IRC | 16:39 | |
| *** emagana has joined #openstack-dev | 16:39 | |
| mrodden | syncronized is a decorator that acquires a lock name before the function can run | 16:39 |
| ayoung | mrodden, thanks. | 16:39 |
| mrodden | build_and_run_instance should be a lock per instance name | 16:39 |
| mrodden | and i believe they run in python threads... but that is all controlled at the RPC level as dansmith pointed out | 16:40 |
| ayoung | mrodden, I'm bascially trying to register a new VM with LDAP/enroll it in Kerberos as part of the spawn process | 16:40 |
| ayoung | so I need to make an additional RPC type call to create the entry in LDAP | 16:40 |
| mrodden | sorry | 16:40 |
| mrodden | greenthreads | 16:40 |
| ayoung | mrodden, so I am trying to figure out if I should be doing this in the compute manager, or external to is | 16:41 |
| ayoung | to is | 16:41 |
| ayoung | ah | 16:41 |
| mrodden | uh | 16:41 |
| ayoung | to *it* | 16:41 |
| *** tvb has joined #openstack-dev | 16:41 | |
| mrodden | can't you just poll at the API level until its spawned and then do the logic externally to nova? | 16:41 |
| dansmith | mrodden: +1 | 16:42 |
| *** dmakogon_ has quit IRC | 16:42 | |
| mrodden | seems easier... | 16:42 |
| ayoung | mrodden, I need to inject instance specific data into the VM and I don't want the user doing that...want it managed by the system | 16:42 |
| *** MaxV has quit IRC | 16:42 | |
| *** dmakogon_ipod has joined #openstack-dev | 16:42 | |
| *** exed has joined #openstack-dev | 16:42 | |
| ayoung | mrodden, it seems easier to you, but the devil is in the details. | 16:42 |
| mrodden | if your application is doing the spawn, you can control the user-data input with teh spawn request | 16:43 |
| ayoung | my "application" is Horizon | 16:43 |
| mrodden | ok | 16:43 |
| ayoung | mrodden, I want to syncronize the VM name with DNS | 16:44 |
| ayoung | so when I create a new VM, I need custom user-data. Very ugly | 16:44 |
| *** adalbas has joined #openstack-dev | 16:45 | |
| ayoung | instead, I want to generate an event that converts the VM name to the host name, registers it with LDAP, and generates a One Time password to register the host once it is up and running | 16:45 |
| *** dtyarnell has joined #openstack-dev | 16:45 | |
| ayoung | I need the hook | 16:45 |
| *** xga has quit IRC | 16:45 | |
| lyncos | Hey guys .. I wan to change keystone code .. the ldap part .. where I should start (i'm not a great coder) | 16:45 |
| ayoung | I suspect that custom workflow upon VM creation is pretty common | 16:45 |
| mrodden | yeah its not meant to be "user" facing TBH, its just the name of the data that gets handed to the VM | 16:45 |
| *** Ryan_Lane has joined #openstack-dev | 16:45 | |
| ayoung | lyncos, you start by telling me what you want to do... | 16:45 |
| *** tvb has quit IRC | 16:46 | |
| lyncos | ayoung .. keystone with Activedirectory seems to ask to DNS server the liste of all DC available on my domain.. even if I specify ldap://someserver it's using server from the DNS list... | 16:46 |
| ayoung | mrodden, understood, but the horizon UI and the CLI need to be unified in their approach. I'd rather not tell people "no web ui, and you have to use a custom UI tool" | 16:46 |
| lyncos | the problem is .. It's binding to one server and do the ldapsearch on another server | 16:46 |
| *** bashok_ has quit IRC | 16:46 | |
| lyncos | so the ldapsearch fail because it see no binding | 16:46 |
| lyncos | I want to get rid of that 'dns' lookup function | 16:46 |
| mrodden | ayoung: but you could write a horizon plugin that generates the user-data part | 16:47 |
| ayoung | lyncos, DNS server? That is not Keystone... | 16:47 |
| lyncos | and always connect to the server specified in ldap:// line | 16:47 |
| *** FatDarrel has joined #openstack-dev | 16:47 | |
| *** bashok_ has joined #openstack-dev | 16:47 | |
| lyncos | Keysone do a DNS request | 16:47 |
| ayoung | mrodden, nope, cuz I need it from the CLI too | 16:47 |
| dansmith | ayoung: the CLI and horizon are completely different layers in the stack | 16:47 |
| mrodden | they both operate through the REST API and accept user-data | 16:47 |
| ayoung | dansmith, yes, which is why I am trying to unify the approach | 16:47 |
| dansmith | ayoung: and this belongs in horizon or whatever your high-level application is, IMHO | 16:47 |
| lyncos | it ask DomainDnsZones.my.domain | 16:47 |
| *** alop_ has joined #openstack-dev | 16:47 | |
| ayoung | dansmith, no. This is more fundamental than that | 16:47 |
| lyncos | then it use an ip from that list | 16:48 |
| *** SumitNaiksatam has quit IRC | 16:48 | |
| lyncos | I did strace + tcpdump to figure this out | 16:48 |
| *** afazekas_no_irq has joined #openstack-dev | 16:48 | |
| *** egallen has quit IRC | 16:48 | |
| ayoung | lyncos, wierd | 16:49 |
| *** SergeyLukjanov has joined #openstack-dev | 16:49 | |
| *** ArcTanSusan has quit IRC | 16:49 | |
| mrodden | yeah i dont really understand why you would want to bind all this stuff into the compute manager | 16:49 |
| ayoung | the ldap server is specified in the config file and passed through verbatium to keystone/common/ldap/core.py | 16:49 |
| lyncos | ayoung it's doing it for user-list but not for role-list or tenant-list | 16:49 |
| mrodden | nova just spins up VMs and injects the data you pass on the API to it | 16:49 |
| *** alop has quit IRC | 16:50 | |
| *** alop_ is now known as alop | 16:50 | |
| ayoung | mrodden, I want it done whenever a vm is kicked off, anywhere in a cloud deployment. DNSaaS and Single sign on | 16:50 |
| ayoung | lyncos, hmmm...what version of Keystone are you running? | 16:50 |
| lyncos | ii python-keystone 1:2013.1.3-0ubuntu1~cloud0 OpenStack identity service - Python library | 16:51 |
| ayoung | mrodden, and injects ssh keys into them, doesn't it? THat is SSO, just hardcoded to a very specific scheme | 16:51 |
| lyncos | I used the deb pack | 16:51 |
| mrodden | yeah thats kind of legacy stuff, used for compat. with the way amazon does stuff | 16:51 |
| mrodden | hmm | 16:51 |
| ayoung | lyncos, hmmm...role-list and tenant-list are all handled by the same code | 16:52 |
| lyncos | So this is strange | 16:52 |
| ayoung | lyncos, it sounds like DNS might be screwy for your set up | 16:52 |
| lyncos | when i'm using an ldap proxy ... it dosen't do that DNS request | 16:52 |
| lyncos | I really don't know why | 16:52 |
| *** tmclaugh[work] has quit IRC | 16:53 | |
| *** sarob has joined #openstack-dev | 16:53 | |
| lyncos | and now.. I really don't know how to do it.. we have a pretty big AD (6000 users) | 16:53 |
| lyncos | and many sites | 16:53 |
| *** sandywalsh has joined #openstack-dev | 16:54 | |
| ayoung | lyncos, so you are saying it is the code running in the Keystone server that does the DNS lookup and gets the wrong server. YOu are sure it is not happening from the proxy instead? | 16:54 |
| *** Mandell has joined #openstack-dev | 16:54 | |
| lyncos | I'm sure of nothing ... but when I do a user-list connected to an windows DC .. I see a DNS request from my 'keystone' server only keystone running on that server | 16:54 |
| *** tstevenson has joined #openstack-dev | 16:55 | |
| *** alexrudenko has joined #openstack-dev | 16:55 | |
| lyncos | I'm also not a windows guy at all | 16:55 |
| *** bashok_ has quit IRC | 16:55 | |
| *** emagana has quit IRC | 16:55 | |
| *** vkmc has joined #openstack-dev | 16:55 | |
| *** vkmc has quit IRC | 16:55 | |
| *** vkmc has joined #openstack-dev | 16:55 | |
| lbragstad | dolphm: updated the description for unified logging in the keystone release notes. Let me know if you want anything changed... https://wiki.openstack.org/wiki/ReleaseNotes/Havana#Key_New_Features_5 | 16:55 |
| ayoung | mrodden, yeah, so instead of depending on SSH keys, I want the machine in the LDAP server. There is a registration handshake. If I need a Horizon plugin to do it, fine, but I would also need a comparable CLI plugin. And, it means I have to take over the User-data for this. I'd rather leave the server data alone or just add the OTP into it. | 16:56 |
| lyncos | ayoung maybe it's the ldap lib that does that ? | 16:56 |
| ayoung | lyncos, well, the keystone server needs to resolve the ldap hostname | 16:56 |
| ayoung | the url is ldap://hostname/ | 16:56 |
| ayoung | you could probably put an IP address in there | 16:57 |
| lyncos | I did try that | 16:57 |
| lyncos | I did put the logging here | 16:57 |
| lyncos | http://paste.openstack.org/show/47844/ | 16:57 |
| ayoung | but it looks like your DNS server is set up to respond maybe round robin or something, with one of the IP addesses being bogus? | 16:57 |
| ayoung | lyncos, so, lets take Keystone out of the equasion. Try an LDAP search from the command line instead | 16:57 |
| lyncos | ok will try let me figure out how to do it | 16:58 |
| mrodden | ayoung: yeah thinking about it, not sure what the best solution would be, although i think something like a python-novaclient plugin would work | 16:58 |
| ayoung | lyncos, OPERATIONS_ERROR: {'info': '00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece', 'desc': 'Operations error'} | 16:58 |
| *** Alexei_987 has quit IRC | 16:59 | |
| lyncos | Yeah | 16:59 |
| ayoung | mrodden, but then that needs to be distributed to everyone | 16:59 |
| ayoung | mrodden, I want it server side | 16:59 |
| lyncos | bit seems to be successfuly binded to another server .. let me test the ldapsearch | 16:59 |
| ayoung | lyncos, are you doing anonymous? | 16:59 |
| *** vuil has joined #openstack-dev | 16:59 | |
| lyncos | What you mean anonymous ? | 16:59 |
| lyncos | without a user ? | 16:59 |
| lyncos | to bind | 17:00 |
| ayoung | lyncos there is a manager DN used to talk to the server | 17:00 |
| ayoung | the LDAP config options are... | 17:00 |
| lyncos | you mean that line ? user = | 17:00 |
| ayoung | https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L320 | 17:00 |
| ayoung | user = ... | 17:00 |
| ayoung | password = ... | 17:01 |
| lyncos | yeah i'm using a specific user . . that works on the ldap proxy | 17:01 |
| *** danwent has quit IRC | 17:01 | |
| *** fbo is now known as fbo_away | 17:01 | |
| ayoung | you can leave the password off, and then it will attempt to do everything without a bind. LDAP is usally usable that way | 17:01 |
| ayoung | lyncos, do you have Read/Write privs on the AD server? I'd be surprised if you did | 17:01 |
| lyncos | I won't be able to write ? | 17:01 |
| lyncos | I have write privs to my 'cloud' OU | 17:02 |
| lyncos | and should be able to get the user list | 17:02 |
| ayoung | lyncos ok, you should be good | 17:02 |
| lyncos | it works on the proxy | 17:02 |
| ayoung | lyncos, the LDAP user that executes the commands get validated by a bind based on the [LDAP] values there | 17:02 |
| *** carl_baldwin has joined #openstack-dev | 17:03 | |
| ayoung | if you left off password, it is anonymous | 17:03 |
| *** amerine has joined #openstack-dev | 17:03 | |
| lyncos | but anonymous I'll be unable to write to ldap right ? | 17:03 |
| ayoung | lyncos, https://github.com/openstack/keystone/blob/master/keystone/common/ldap/core.py#L232 | 17:03 |
| *** davidhadas_ has quit IRC | 17:04 | |
| ayoung | lyncos, I should hope so. Anonymous writes to LDAP are a frightening thought | 17:04 |
| *** tstevenson has quit IRC | 17:04 | |
| lyncos | yeah | 17:04 |
| lyncos | ok let me try anoymus reads | 17:04 |
| *** kmartin has quit IRC | 17:05 | |
| *** yjiang5 has quit IRC | 17:05 | |
| lyncos | I got same error | 17:05 |
| lyncos | In order to perform this operation a successful bind must be completed on the connection. | 17:05 |
| lyncos | with user and password lines commented out in keystone.conf | 17:05 |
| lyncos | strange it's not trying the 23 other dc now | 17:06 |
| lyncos | only when I uncomment user and password line | 17:06 |
| *** sarob has quit IRC | 17:07 | |
| *** sarob has joined #openstack-dev | 17:07 | |
| ayoung | lyncos, if user and password are both set, it attempts to bind when creating the connection. I think you need to use a valid DC for the user and a valid password in order to connect. What you have had so far has been anonymous, which is failing when you try to write | 17:08 |
| lyncos | I didn't try to write yet | 17:08 |
| *** tmclaugh[work] has joined #openstack-dev | 17:08 | |
| *** DinaBelova has joined #openstack-dev | 17:09 | |
| lyncos | When I'm doing role-list .. it's also doing the 'DNS' Request | 17:10 |
| *** harlowja has joined #openstack-dev | 17:10 | |
| lyncos | but I get different stuff | 17:10 |
| lyncos | I get error | 17:10 |
| lyncos | woah it's fucked up | 17:10 |
| *** Qu310 has quit IRC | 17:10 | |
| lyncos | it's asking for dc01.mydomain.com.mydomain.com | 17:10 |
| *** Qu310 has joined #openstack-dev | 17:11 | |
| lyncos | but it try mydomain.org after | 17:12 |
| lyncos | then I get the full list | 17:12 |
| lyncos | of my dc | 17:12 |
| *** dkranz has quit IRC | 17:12 | |
| *** sarob has quit IRC | 17:12 | |
| *** xqueralt has joined #openstack-dev | 17:13 | |
| *** venkatesh has joined #openstack-dev | 17:16 | |
| *** exed has quit IRC | 17:16 | |
| *** ygbo has quit IRC | 17:17 | |
| *** SumitNaiksatam has joined #openstack-dev | 17:18 | |
| *** bashok has joined #openstack-dev | 17:18 | |
| *** diogogmt has quit IRC | 17:20 | |
| *** emagana has joined #openstack-dev | 17:22 | |
| *** AlanClark has joined #openstack-dev | 17:23 | |
| *** yjiang5 has joined #openstack-dev | 17:27 | |
| *** diogogmt has joined #openstack-dev | 17:28 | |
| *** dkranz has joined #openstack-dev | 17:29 | |
| *** kmartin has joined #openstack-dev | 17:29 | |
| *** tvb has joined #openstack-dev | 17:30 | |
| *** nermina has joined #openstack-dev | 17:31 | |
| lyncos | ayoung: OK i did the ldapsearch command .. and it works with it | 17:32 |
| lyncos | with same credentials | 17:32 |
| *** emagana has quit IRC | 17:32 | |
| *** sarob has joined #openstack-dev | 17:32 | |
| lyncos | and I don't see that DNS request | 17:32 |
| *** exed has joined #openstack-dev | 17:32 | |
| lyncos | Ok let's try to do the ldapsearch to another DC | 17:33 |
| *** DennyZhang has quit IRC | 17:34 | |
| *** dkehn_ is now known as dkehn | 17:35 | |
| *** kbrierly has joined #openstack-dev | 17:35 | |
| *** sarob has quit IRC | 17:36 | |
| *** fbo_away is now known as fbo | 17:37 | |
| *** comay has joined #openstack-dev | 17:38 | |
| *** Javin has quit IRC | 17:39 | |
| *** melwitt has joined #openstack-dev | 17:39 | |
| lyncos | ayoung : do you think this could be related: https://projects.xivo.fr/issues/3795 | 17:41 |
| *** venkatesh has quit IRC | 17:41 | |
| ayoung | lyncos, looking | 17:41 |
| lyncos | not for keystone but seems to be with python-ldap | 17:41 |
| ayoung | lyncos, quite possible. Can you open a bug to track this issue? | 17:42 |
| lyncos | at keystone level ? | 17:42 |
| *** davidhadas has joined #openstack-dev | 17:42 | |
| ayoung | even if it proves to be a config problem, having it in the system of record will help people diagnose | 17:43 |
| ayoung | lyncos, yes, please | 17:43 |
| lyncos | Ok will do it | 17:43 |
| *** Dr_Who has joined #openstack-dev | 17:44 | |
| *** yolanda has quit IRC | 17:44 | |
| *** DennyZhang has joined #openstack-dev | 17:44 | |
| *** cdub has joined #openstack-dev | 17:45 | |
| ayoung | lyncos, so you can try his approach listed in the patches there. If the first patch does the trcik, we can add that as a config option in keystone/common/config.py | 17:45 |
| ayoung | I'm not quite certain where we would apply his second patch, but somewhere in keystone/common/ldap/core.py ...probably the get function on the BaseLdap object I'm guessing | 17:46 |
| *** lucasagomes has quit IRC | 17:47 | |
| *** flaper87 is now known as flaper87|afk | 17:48 | |
| *** cjellick has quit IRC | 17:52 | |
| *** boris-42 has joined #openstack-dev | 17:52 | |
| *** trey_h has joined #openstack-dev | 17:52 | |
| lyncos | https://bugs.launchpad.net/keystone/+bug/1234319 | 17:55 |
| uvirtbot | Launchpad bug 1234319 in keystone "Keystone with LDAP/AD backend problem" [Undecided,New] | 17:55 |
| *** carl_baldwin has quit IRC | 17:55 | |
| lyncos | ayoung are you willing to help me test that patch ? as I'm a really poor coder | 17:57 |
| ayoung | lyncos, well, I don't have AD | 17:58 |
| ayoung | so I can't reprodcue, but I can help you out | 17:58 |
| *** danpb has quit IRC | 17:58 | |
| *** changbl has joined #openstack-dev | 17:58 | |
| ayoung | lyncos, my advice to you would be to spin up a VM and run devstack in it | 17:59 |
| ayoung | you can disable all services but keystone and mysql, and add in ldap | 17:59 |
| *** danwent has joined #openstack-dev | 17:59 | |
| lyncos | devstack and then connect to my AD ? | 17:59 |
| ayoung | then change the ldap config to match what you have on your live server | 17:59 |
| ayoung | yep | 17:59 |
| lyncos | would you need access to that devstack vm ? (sorry I don't know how this works) | 18:00 |
| ayoung | lyncos, when you run devstack, if you tell it to do ldap, it will spin up openldap bey defualt | 18:00 |
| ayoung | me? nah, you can do this yourself | 18:00 |
| ayoung | just ask me questions | 18:00 |
| *** devoid has quit IRC | 18:00 | |
| lyncos | ok devstack uses openldap instead of python-ldap right ? | 18:00 |
| ayoung | get the vm up, clone devstack and then ping me | 18:00 |
| *** devoid has joined #openstack-dev | 18:00 | |
| ayoung | no, it uses openldap as the server | 18:01 |
| dolphm | lyncos: python-ldap is a client lib | 18:01 |
| *** flaper87|afk is now known as flaper87 | 18:01 | |
| ayoung | python-ldap is still the client lib | 18:01 |
| lyncos | ok instead of connecting to openldap I would put my ldap config for ad | 18:01 |
| lyncos | right ? | 18:01 |
| ayoung | lyncos, yeah | 18:01 |
| lyncos | ok got it | 18:01 |
| ayoung | you can copy the values over from your live server | 18:01 |
| lyncos | Ok will grab food then I'll star that process | 18:02 |
| ayoung | lyncos, devstack has a filethat you can modify the install: localrc | 18:02 |
| ayoung | you want to have the following line in there | 18:02 |
| *** cjellick has joined #openstack-dev | 18:02 | |
| ayoung | ENABLED_SERVICES=key,mysql,qpid | 18:02 |
| ayoung | well, you don't *need* qpid but that surpresses an errormessage | 18:03 |
| ayoung | ENABLED_SERVICES=key,mysql,ldap | 18:03 |
| ayoung | and also | 18:03 |
| ayoung | LDAP_PASSWORD=test | 18:03 |
| ayoung | KEYSTONE_IDENTITY_BACKEND=ldap | 18:03 |
| ayoung | lyncos, with those values, if you run devstack, you will be able to test LDAP capabilities first off. TO include running the unit tests against a live server | 18:04 |
| *** sarob has joined #openstack-dev | 18:05 | |
| *** venkatesh has joined #openstack-dev | 18:05 | |
| lyncos | Do I really need devstack .. the thing is that my live server is not 'prod' yet so we can do the changes directly on it.. but if you need stuff included in devstack I will do it | 18:06 |
| ayoung | lyncos, you need a git repo and the keystone source. | 18:09 |
| ayoung | You can do it without devstack if you want. devstack just makes it a little easier. | 18:09 |
| ayoung | I'd leave the live server there to compare against | 18:09 |
| *** sarob has quit IRC | 18:09 | |
| ayoung | devstack will do all sorts of pip installs which might conflict with other stuff you are doing on your laptop. | 18:10 |
| ayoung | typically not a great idea....I should know, I do it all the time | 18:10 |
| lyncos | ok np installing devstack in virtualbox right now | 18:10 |
| lyncos | at the same time it will give me an introduction into reporting bugs and testing stuff ... (I told you I'm not a good coder) | 18:11 |
| ayoung | lyncos, <yoda>you will be...you will be</yoda> | 18:15 |
| *** nermina has quit IRC | 18:16 | |
| lyncos | ;-) | 18:17 |
| lyncos | by the way thanks for helping with that issue.. I'm on it for 2 days right now | 18:17 |
| lyncos | And the windows team here is not that helpful | 18:17 |
| lyncos | If there is no checkbox they cannot help :-) | 18:18 |
| *** venkatesh has quit IRC | 18:18 | |
| ayoung | lyncos, this is where I look down at the T-Shirt I am wearing, which is a simulated BSD and the text "The fatal exception 0E has occurred (again!) at 0000:0110 in Windows MAIN(01), it may be possible (however unlikely) to continue." | 18:19 |
| *** chenxu has joined #openstack-dev | 18:21 | |
| lyncos | I'm almost done with my vm.. will just need to install devstack... | 18:21 |
| *** Mandell has quit IRC | 18:21 | |
| *** Mandell has joined #openstack-dev | 18:22 | |
| *** alexrudenko has quit IRC | 18:22 | |
| *** armax has joined #openstack-dev | 18:23 | |
| *** martine has joined #openstack-dev | 18:23 | |
| *** martine is now known as Guest52628 | 18:23 | |
| *** RajeshMohan has quit IRC | 18:24 | |
| ayoung | mrodden, so, it seems to me that there is a need for custom operations in the VM creation pipeline. Something that can be done at the deployment site that is done out of tree, but that gets all of the context send to Nova. Something like we have in the paste config pipelines: here is a list of components that get a swing at the VM creation, call each one in turn. | 18:24 |
| ayoung | with the default being the computer manager | 18:25 |
| mrodden | the problem is that isn't really a VM config problem | 18:25 |
| mrodden | its an application (where the application is the OS on the VM) configuration problem | 18:25 |
| *** ekolve has joined #openstack-dev | 18:25 | |
| *** tmclaugh[work] has quit IRC | 18:25 | |
| mrodden | for example the savana(sp?) project is a horizon plugin that allows one to spin up a hadoop cluster | 18:26 |
| ayoung | mrodden, well, sort of. It really is a trust problem, and the system needs to be managed by trusted components | 18:26 |
| mrodden | they don't have any changes to nova | 18:26 |
| *** Mandell has quit IRC | 18:27 | |
| ayoung | mrodden, that is because they are not doing general purpose VMs | 18:27 |
| ayoung | they are usering Nova | 18:27 |
| mrodden | if its a trust problem i dont think a modifiable pipeline will help the issue | 18:27 |
| *** ekolve has left #openstack-dev | 18:27 | |
| ayoung | mrodden, really, I need a notification that a new VM creation event has come in. | 18:28 |
| *** Mandell has joined #openstack-dev | 18:28 | |
| ayoung | and then I need to inject a custom file based on that event | 18:28 |
| mrodden | on every VM? | 18:28 |
| ayoung | mrodden, I would probably scope it to projects, but yes | 18:29 |
| ayoung | mrodden, I would want to know the vm name and the project for that vm for any vms created in my cloud | 18:29 |
| *** mlavalle has joined #openstack-dev | 18:29 | |
| ayoung | mrodden, I'm setting up Single Sign On. | 18:29 |
| mrodden | yes i get that | 18:29 |
| ayoung | So, I might do different logic based on, say windows versus linux | 18:30 |
| *** carl_baldwin has joined #openstack-dev | 18:30 | |
| ayoung | but Nova doesn't need to know that | 18:30 |
| *** johnthetubaguy has quit IRC | 18:30 | |
| *** sdake has quit IRC | 18:30 | |
| mrodden | if i had to do it i would have an image i would deploy with a chef-client that could check the user-data for private validation info and handshake with LDAP | 18:30 |
| mrodden | then do all the other necessary setup | 18:30 |
| *** sdake has joined #openstack-dev | 18:30 | |
| ayoung | mrodden, I would need one image per vm then | 18:31 |
| ayoung | cuz each has a different OTP | 18:31 |
| ayoung | and chef / puppet is just kicking the problem down the raod | 18:31 |
| ayoung | road | 18:31 |
| lyncos | ok im ready to deploy devstack :-) | 18:31 |
| *** Guest52628 has quit IRC | 18:31 | |
| mrodden | shouldn't that be passed in the user data | 18:31 |
| mrodden | the OTP | 18:31 |
| lyncos | localrc file should be in the devstack folder right ? | 18:31 |
| ayoung | lyncos, See my above comment | 18:31 |
| ayoung | mrodden, but then there is no link between the host name and the OTP | 18:32 |
| ayoung | mrodden, when I create the LDAP entry for the host, I generate the OTP and link it to the hostname | 18:32 |
| *** jmontemayor has joined #openstack-dev | 18:33 | |
| mrodden | yes... the VM has control over its own hostname does it not? | 18:33 |
| lyncos | ayoung which comment sorry I missed one | 18:33 |
| ayoung | mrodden, yes, but in order for it to be able to update DNS, the LDAP server needs to trust that VM | 18:33 |
| ayoung | lyncos, one sec... | 18:33 |
| mrodden | the OTP is your private info that the VM has to auth to the LDAP | 18:33 |
| ayoung | lyncos, devstack has a file that you can modify the install: localrc | 18:33 |
| *** alunduil has quit IRC | 18:33 | |
| ayoung | ENABLED_SERVICES=key,mysql,ldap | 18:34 |
| ayoung | KEYSTONE_IDENTITY_BACKEND=ldap | 18:34 |
| lyncos | yeah I did move it from samples to devstack root and added these lines | 18:34 |
| *** chenxu has quit IRC | 18:34 | |
| ayoung | lyncos, cool | 18:34 |
| ayoung | ./stack.sh | 18:34 |
| lyncos | doing it right now | 18:34 |
| *** nermina has joined #openstack-dev | 18:34 | |
| *** devoid has quit IRC | 18:34 | |
| *** tmclaugh[work] has joined #openstack-dev | 18:35 | |
| ayoung | mrodden, yeah. it is really One Time Password: if a second host attempts to use it, it is invalid | 18:35 |
| lyncos | by the way it's ubuntu server 12.04 | 18:35 |
| ayoung | lyncos, should be good. I think | 18:35 |
| *** colinmcnamara has quit IRC | 18:35 | |
| lbragstad | lyncos: might have issues with using qpid versus rabbit | 18:35 |
| *** devoid1 has joined #openstack-dev | 18:35 | |
| lyncos | I did not enable qpid | 18:35 |
| lbragstad | ok | 18:35 |
| ayoung | lbragstad, yeah, he can leave that line off. devstack complains, but continues | 18:36 |
| lyncos | I guess no queue involved in my tests as I test keystone only | 18:36 |
| *** dkranz has quit IRC | 18:36 | |
| ayoung | lyncos, that is correct | 18:36 |
| *** zhiyan has quit IRC | 18:36 | |
| mrodden | so 1) generate OTP/hostname pair in ldap 2) spin up nova VM with OTP/hostname in the user-data 3) agent on VM checks for user-data info and auths to LDAP | 18:36 |
| lyncos | brb will leave stack.sh do it's job | 18:36 |
| ayoung | mrodden, that is basically the workflow. What I want to do is automate it so that I don't need to distribute custom Horizon or Nova CLI applications to use it | 18:37 |
| ayoung | mrodden, I mean, I have it working from the command line. | 18:37 |
| mrodden | yes you could bypass the python-novaclient and use the REST API directly | 18:37 |
| ayoung | http://adam.younglogic.com/2013/09/register-vm-freeipa/ | 18:37 |
| mrodden | or extend novaclient | 18:38 |
| ayoung | mrodden, or extend nova server | 18:38 |
| ayoung | which is the right thing to do for policy that you want applied to all machines | 18:38 |
| mrodden | yes thats possible | 18:38 |
| ayoung | so I am trying to figure out A) how and B) can this be abstracted | 18:38 |
| mrodden | but i think that when it comes to separation of concerns this is more at the application level | 18:38 |
| mrodden | its not applied to all machines | 18:38 |
| ayoung | yes, all vms | 18:39 |
| mrodden | i dont care about LDAP auth for any of my VMs | 18:39 |
| ayoung | mrodden, all VMs in a single cloud deployment | 18:39 |
| mrodden | yes | 18:39 |
| ayoung | mrodden, you should, but that is neither here nor there :) | 18:39 |
| mrodden | exactly how one might consider a hadoop cluster a single cloud deployment | 18:39 |
| *** cfriesen has joined #openstack-dev | 18:39 | |
| ayoung | a hadoop cluster is a subset of a single cloud deployment | 18:40 |
| ayoung | but ... semantics | 18:40 |
| *** briancurtin has quit IRC | 18:40 | |
| ayoung | hadoop needs to be able to log in to the VMs after they are spun up. It can use the SSH key from nova, or it could use something else | 18:41 |
| cfriesen | looking at the "evacuate" command, does it really make sense to have the admin be forced to specify whether instance files are located on shared storage? This seems like something that should be represented within the instance itself so that the system can just do the right thing automatically. | 18:41 |
| ayoung | so, I see this as parallel to the "keypair" mechanism | 18:41 |
| mrodden | thats possible | 18:41 |
| *** portante|afk is now known as portante | 18:41 | |
| mrodden | SSH is less setup and more or less the simplest way to do secure auth to a VM | 18:41 |
| mrodden | the "least common denominator" in a way | 18:42 |
| bknudson | keep your vms simple and just provide a web admin interface. | 18:43 |
| *** DinaBelova has quit IRC | 18:44 | |
| *** sarob has joined #openstack-dev | 18:46 | |
| mrodden | i'm not really the person that you would have to convince that its a good idea anyways :) | 18:46 |
| ayoung | bknudson, um...no. Webadmin...not simple | 18:46 |
| ayoung | mrodden, I'm just trying to figure out where it would logically fit into the nova architecture | 18:46 |
| bknudson | don't provide an admin interface, just respin the vm when need to reconfigure | 18:47 |
| ayoung | I would not want to couple Nova to FreeIPA, but I should be able to deploy the two together securely | 18:47 |
| mrodden | you could ask more nova people, but i think that they will likely have the same response | 18:47 |
| mrodden | nova is pretty complex already | 18:47 |
| ayoung | mrodden, I don't want to increase that complexity. I suspect that some of it could be simplified into a pipeline, but I am not working heads down in Nova to really say | 18:48 |
| *** dolphm has quit IRC | 18:48 | |
| *** pmcg_ is now known as pmcg | 18:48 | |
| ayoung | mrodden, but it is the same kind of eventing as we are being asked for in Keystone: tell me when a new VM is created is a lot like tell me when a new user is created | 18:49 |
| ayoung | can I register for events? | 18:49 |
| mrodden | nova does notifications | 18:49 |
| lbragstad | the keystone notification I wrote is based off the same framework provided in nova | 18:49 |
| mrodden | but you don't have any ability to alter the deployment process of the VM | 18:49 |
| mrodden | thats correct its essentially the same thing | 18:50 |
| ekarlso | BobBall: here rstill ? | 18:50 |
| ayoung | mrodden, becasue by the time the event is fired, the user-data would have already been written....that may be OK | 18:50 |
| mrodden | lifecycle events for VMs are fed through the notifications | 18:50 |
| mrodden | which can be plugged into with a custom driver, or just fed out into an AMQP topic | 18:51 |
| *** dkranz has joined #openstack-dev | 18:51 | |
| *** mjfork has quit IRC | 18:53 | |
| ayoung | mrodden, so, really it comes down to the OTP. If I get the notification that a new VM is generated, I need a way to get the OTP to that VM forthe general use case | 18:55 |
| ekarlso | samalba: here ? | 18:56 |
| lyncos | Ok devstack installed :-) | 18:57 |
| lyncos | I just don't know how to start up everything | 18:57 |
| lyncos | what are my credentials etc | 18:57 |
| ayoung | lyncos, it is started | 18:57 |
| ayoung | . openrc | 18:57 |
| ayoung | keystone token-get | 18:57 |
| *** vipul is now known as vipul-away | 18:57 | |
| lyncos | ok works | 18:58 |
| lyncos | but user-list dosen't | 18:58 |
| ayoung | nope | 18:58 |
| ayoung | lyncos, echo $OS_USERNAME | 18:58 |
| ayoung | dem right? | 18:58 |
| ayoung | demo | 18:58 |
| lyncos | oright | 18:58 |
| lyncos | right | 18:58 |
| ayoung | export OS_USERNAME=admin | 18:58 |
| ayoung | keystone user-list should now work | 18:58 |
| lyncos | works ! | 18:59 |
| lyncos | ok cool now configuring ldap stuff | 18:59 |
| ayoung | those values are set based on what you have in localrc | 18:59 |
| lyncos | ah ok so if I want to know I can check that file | 18:59 |
| ayoung | lyncos, you can start and stop keystone withoug redoing all of devstack | 18:59 |
| ayoung | screen -x | 18:59 |
| ayoung | keystone is usually screen 1 or 2 | 18:59 |
| lyncos | ok cool | 19:00 |
| ayoung | https://www.gnu.org/software/screen/manual/screen.html#Default-Key-Bindings | 19:00 |
| *** sarob has quit IRC | 19:00 | |
| lyncos | yeah I know how screen works :-) | 19:00 |
| ayoung | http://aperiodic.net/screen/quick_reference | 19:00 |
| ayoung | I didn't | 19:00 |
| lyncos | :-) | 19:00 |
| *** sarob has joined #openstack-dev | 19:00 | |
| ayoung | I have to look at those every time | 19:00 |
| lyncos | yeah it's not easy | 19:00 |
| ayoung | anyway, ctrl-C in the keystone screen will kill the server | 19:00 |
| ayoung | the command used to kick it off is in history | 19:01 |
| ayoung | keystone-all .... | 19:01 |
| lyncos | Should I thrash all the [ldap] section and replace it with mine ? | 19:01 |
| *** danwent has quit IRC | 19:01 | |
| ayoung | well, back up the old one, but yes | 19:01 |
| ayoung | lyncos, now, you might not have an admin user | 19:01 |
| *** sarob has quit IRC | 19:01 | |
| *** venkatesh has joined #openstack-dev | 19:01 | |
| lyncos | my admin user will be in ldap right ? | 19:02 |
| ayoung | if you don't you can use the ADMIN_TOKEN value in the config file | 19:02 |
| ayoung | yep | 19:02 |
| ayoung | if you re-enable ADMIN_TOKEN you have to set a couple envvars to talk to keystone | 19:02 |
| samalba | ekarlso: here but going to leave in 2 minutes | 19:03 |
| ayoung | lyncos, see https://fedoraproject.org/wiki/Getting_started_with_OpenStack_on_Fedora_17#Initial_Keystone_setup | 19:03 |
| ayoung | use SERVICE_ENDPOINT and SERVICE_TOKEN | 19:03 |
| ayoung | lyncos, that will bypass the ldap authorization, which might simplify troubleshooting for you | 19:04 |
| lyncos | right now ... I get the same error | 19:04 |
| lyncos | with ldap .. which is good It hink | 19:04 |
| ayoung | yes | 19:04 |
| lyncos | I keep in mind the SERVICE_? thing | 19:04 |
| ayoung | sounds good | 19:04 |
| ayoung | lyncos, you know git? | 19:05 |
| lyncos | not a lot | 19:05 |
| lyncos | im more used to svn | 19:05 |
| ayoung | lyncos, well, your code is all in /opt/stack/keystone if you kept the defaults | 19:05 |
| ekarlso | samalba: darn! | 19:05 |
| lyncos | ok cool | 19:05 |
| lyncos | I see it nopw | 19:05 |
| ayoung | lyncos, have you signed the CLA and all that? | 19:05 |
| ekarlso | question: does one run docker-registry inside docker when doing nova and docker in production ? | 19:05 |
| lyncos | ayoung I guess not | 19:06 |
| lyncos | CLA ? | 19:06 |
| *** romcheg1 has joined #openstack-dev | 19:06 | |
| dkranz | ayoung: Can you give a +1, or not, to https://review.openstack.org/#/c/49017/1 ? | 19:06 |
| ayoung | lyncos, you'll need to do that in order ofr us to accept any patches you write | 19:06 |
| *** venkatesh has quit IRC | 19:06 | |
| ayoung | dkranz, looking | 19:06 |
| lyncos | ayoung any url I should start with ? | 19:06 |
| ayoung | lyncos, yeah...one sec | 19:07 |
| ayoung | dkranz, is that true? There is no ID? | 19:07 |
| *** cjellick has quit IRC | 19:08 | |
| dkranz | ayoung: I was hoping you could tell me that :) | 19:08 |
| dkranz | ayoung: Because I was suspicious | 19:08 |
| *** troytoman is now known as troytoman-away | 19:08 | |
| *** DinaBelova has joined #openstack-dev | 19:08 | |
| ayoung | dkranz, well, the tempest checks that are in patch are good additions. | 19:08 |
| ayoung | id seems to be silly to check | 19:09 |
| *** alunduil has joined #openstack-dev | 19:09 | |
| dkranz | ayoung: Yes, but they are also a subtraction | 19:09 |
| dkranz | ayoung: OK, if that is your opinion I will +2 it | 19:09 |
| ayoung | dkranz, hold on | 19:09 |
| ayoung | dkranz, "everything " uses Ids...this is suspect | 19:10 |
| *** changbl has quit IRC | 19:10 | |
| *** novas0x2a|laptop has joined #openstack-dev | 19:10 | |
| dkranz | ayoung: No need to investigate right now. I will add you as a reviewer | 19:10 |
| ayoung | dkranz, please do. Probably more correct to open a bug about missing Ids on the catalog backends than to remove it from the unit tests | 19:11 |
| ayoung | er, functional tests | 19:11 |
| ekarlso | samalba: ? | 19:11 |
| ekarlso | darn it | 19:11 |
| *** mlavalle has left #openstack-dev | 19:11 | |
| ayoung | lyncos, https://wiki.openstack.org/wiki/HowToContribute#If_you.27re_a_developer | 19:12 |
| gyee | ayoung, jamielennox, see if this make sense? https://review.openstack.org/#/c/47661/ | 19:12 |
| ayoung | gyee, no. I told you that yesterday. Heh | 19:12 |
| ayoung | gyee, it is probably fine if you did what we said | 19:13 |
| ayoung | but the commit message would need to change | 19:13 |
| ayoung | gyee, looking at the details of the patch now | 19:13 |
| lyncos | I joined OS foundation + II have my launchpad account | 19:13 |
| gyee | ayoung, I did exactly :) | 19:13 |
| lyncos | now need to know how to sign that CLA | 19:13 |
| gyee | down to the 'n' | 19:13 |
| lyncos | ok found it | 19:14 |
| *** otherwiseguy has quit IRC | 19:15 | |
| *** mlavalle_ has joined #openstack-dev | 19:15 | |
| *** Dr_Who has quit IRC | 19:15 | |
| *** bvandenh has joined #openstack-dev | 19:15 | |
| ayoung | gyee, you are still coding for your own organization/. "external" means use X509 or other auth to fetch a token, not to skip fetching a token | 19:16 |
| ayoung | without your middleware, this won't fly | 19:16 |
| *** amohn9 has joined #openstack-dev | 19:16 | |
| ayoung | gyee, so... | 19:16 |
| gyee | ayoung, that's my next move | 19:17 |
| ayoung | gyee, if set to external, it should still request a token. | 19:17 |
| gyee | contribute the keystone ssl token token filter | 19:17 |
| lyncos | ayoung ICLA signed | 19:17 |
| gyee | no, external will not request token | 19:17 |
| lyncos | any other step needed ? | 19:17 |
| ayoung | gyee, yes, external will stil request token...what you want is out of scope | 19:17 |
| ayoung | lyncos, once you have your patch ready, you will need to set up git review | 19:18 |
| ayoung | all that is linked in the wiki page | 19:18 |
| lyncos | Ok let's try to patch this up no :-) | 19:18 |
| lyncos | s/no/now | 19:18 |
| ayoung | gyee, so fetch a token and bind it to the X509 | 19:18 |
| ayoung | we are not making changes to auth_token middleware that are specific to code built outside of the tree. | 19:19 |
| *** thingee is now known as thingee_zzz | 19:19 | |
| *** dtyarnell has quit IRC | 19:20 | |
| gyee | ayoung, no need to fetch the token if you are using x.509 | 19:20 |
| ayoung | gyee, ...why didn't you bring this up way back when? | 19:20 |
| ayoung | gyee, BECAUSE YOU HAVE CUSTOME MIDDLEWARE | 19:20 |
| ayoung | grrr | 19:20 |
| gyee | I mentioned it in the bug | 19:20 |
| ayoung | gyee, you is dooin stuff backwards like | 19:21 |
| gyee | bug 1228309 | 19:21 |
| uvirtbot | Launchpad bug 1228309 in python-keystoneclient "Admin token request should be optional in auth_token middleware" [Wishlist,New] https://launchpad.net/bugs/1228309 | 19:21 |
| ayoung | gyee, sooo I am willing to meet you in the middle. MOdify auth_token middleware so it can get atoken using X509 and use that | 19:21 |
| ayoung | becasue that will work for everyone | 19:21 |
| gyee | ayoung, a bit of history, way back when Liem made the change to tied 2-way SSL with the ADMIN token | 19:21 |
| gyee | that change got lost in translation when we switched over to KSL | 19:22 |
| ayoung | gyee, I totally understand. | 19:22 |
| *** nermina has quit IRC | 19:22 | |
| *** demontiesantos has quit IRC | 19:22 | |
| ayoung | gyee, and I think this is a good approach. But without the corresponding Keystone change, it is a no-go | 19:22 |
| ayoung | gyee, but...you can still get what you need | 19:22 |
| gyee | ayoung, we don't need to fetch the token | 19:23 |
| ayoung | use X509 to fetch the admin token. You can even use the binding mechanism | 19:23 |
| gyee | x.509 IS the token, when we do the mapping at the server side | 19:23 |
| gyee | no need for another round-trip | 19:23 |
| ayoung | gyee, *you* don't need to. But that only works for *you*. | 19:23 |
| ayoung | gyee, I get it....and we should have built keystone that way from the get go | 19:24 |
| gyee | ayoung, I am more than happy to put up the keystone middleware | 19:24 |
| ayoung | userid and password should not be in the token request, and admin operatiojns on keystone should not need to have a token passed in | 19:24 |
| ayoung | I get all of that | 19:24 |
| gyee | for the x.509 to token translation | 19:24 |
| *** sushils has quit IRC | 19:24 | |
| ayoung | If I log in to keystone with a valid X509, I should be authenticated. | 19:25 |
| ayoung | And, once you submit your middleware to do jut that, the whole world can benefit | 19:25 |
| gyee | ayoung, yes | 19:25 |
| gyee | ayoung, no disagreement here | 19:25 |
| gyee | now I need to figure I need a bp or just a bug to get that done | 19:26 |
| gyee | figure out | 19:26 |
| ayoung | but until then we are not putting the change into the keystoneclient specific to code that is not in keystone proper. I won't approve it | 19:26 |
| *** troytoman-away is now known as troytoman | 19:26 | |
| ayoung | gyee, so...the middleware could probably live in keystone client | 19:26 |
| gyee | ayoung, but that's server-side middleware | 19:26 |
| ayoung | and...if you did that, you could then deploy that middleware with your keystone server | 19:26 |
| ayoung | so what | 19:26 |
| gyee | dude | 19:26 |
| ayoung | gyee, Keystone is RC1 | 19:27 |
| gyee | server-side middleware lives with the server | 19:27 |
| ayoung | gyee, I'm giving you a path forward. | 19:27 |
| ayoung | if you could make the middleware general enough to be used by other servers as well.... | 19:27 |
| gyee | you mean x.509 to token translation? | 19:28 |
| ayoung | :) | 19:28 |
| *** shinylasers has quit IRC | 19:28 | |
| lyncos | ayoung .. i'm trying to disable the refferal system in ldap.. | 19:28 |
| lyncos | I found that variable LDAP_DEREF is it related ? | 19:28 |
| gyee | well I will have to make it configurable, like which header/environ have the SSL properties | 19:28 |
| ayoung | gyee, think about it...I'm not certain it is do-able, but it could be really really cool | 19:29 |
| ayoung | lyncos, I have no idea | 19:29 |
| ayoung | that was what he did in patch 1 lyncos right? | 19:29 |
| *** jmontemayor has quit IRC | 19:30 | |
| gyee | ayoung, problem is if I park this middleware in keystoneclient, I can't really test it without the server | 19:30 |
| lyncos | I will try set_option(ldap.OPT_REFERRALS,0) | 19:30 |
| lyncos | argh .. I lost the command line to re-start keystone | 19:30 |
| ayoung | lyncos, you probably want to do a setopt in the get_connection code | 19:31 |
| ayoung | lyncos, cd /opt/stack/keystone | 19:31 |
| *** shinylasers has joined #openstack-dev | 19:31 | |
| ayoung | bin/keystone-all | 19:31 |
| ayoung | that should do it | 19:31 |
| gyee | I suppose I can just put a "Trust me, it works" disclaimer in there :) | 19:31 |
| *** sarob has joined #openstack-dev | 19:31 | |
| lyncos | I did add self.conn.set_option(ldap.OPT_REFERALS,0) to line 525 | 19:31 |
| *** nermina has joined #openstack-dev | 19:31 | |
| ayoung | lyncos, it should pick up the config file in /etc/keystone | 19:31 |
| ayoung | lyncos, so, something else to try. | 19:32 |
| ayoung | cd /opt/stack/keystone | 19:32 |
| ayoung | ./run_tests keystone.tests._ldap_livetests | 19:32 |
| *** bashok_ has joined #openstack-dev | 19:32 | |
| *** sarob has quit IRC | 19:32 | |
| ayoung | I should have had you try that before doing any coding or config file changes | 19:32 |
| *** sarob has joined #openstack-dev | 19:33 | |
| lyncos | ok doing it | 19:33 |
| lyncos | lyncos@devstack:/opt/stack/keystone$ ./run_tests.sh keystone.tests._ldap_livetests | 19:34 |
| lyncos | No virtual environment found...create one? (Y/n) | 19:34 |
| *** tanisdl has joined #openstack-dev | 19:34 | |
| lyncos | it's ok I guess ? | 19:34 |
| lyncos | sorry Im totally new at python coding :-) | 19:35 |
| *** bashok has quit IRC | 19:35 | |
| lyncos | fail | 19:36 |
| *** sarob has quit IRC | 19:37 | |
| lyncos | libxml-dev was missing | 19:37 |
| lyncos | :-) | 19:37 |
| *** danwent has joined #openstack-dev | 19:37 | |
| lyncos | same prob | 19:38 |
| gyee | lyncos, yes, you'll have to install a bunch of -dev | 19:38 |
| *** alexrudenko has joined #openstack-dev | 19:38 | |
| *** sarob has joined #openstack-dev | 19:39 | |
| lyncos | ok will try to figure out | 19:39 |
| lyncos | error: /opt/stack/keystone/.venv/build/lxml/src/lxml/includes/etree_defs.h:9:31: fatal error: libxml/xmlversion.h: No such file or directory | 19:40 |
| ayoung | lyncos, ah | 19:40 |
| lyncos | I installed python-libxml2 and libxml2-dev | 19:40 |
| ayoung | probably need to update the venv | 19:40 |
| lyncos | I got that error in the update process | 19:40 |
| ayoung | libxml2-dev doesn't have the header in it? | 19:40 |
| *** ekolve has joined #openstack-dev | 19:41 | |
| ayoung | lyncos, on Fedora it is libxml2-devel-2.9.1-1.fc19.x86_64 | 19:41 |
| lyncos | libxml2-dev 2.7.8.dfsg-5.1ubuntu4.6 | 19:41 |
| lyncos | file exist | 19:42 |
| lyncos | : /usr/include/libxml2/libxml/xmlversion.h | 19:42 |
| ekolve | I am trying to run keystone within apache/HTTPD - the docs mention two script aliases /keystone/main and /keystone/admin, by default the auth url endpoint is something like http://127.0.0.1:5000/v2.0, when you request a token with the command: keystone token-get, it POSTs to the auth url + '/tokens', which doesn't exist when running under HTTPD | 19:43 |
| ekolve | am i missing a path? | 19:43 |
| *** DinaBelova has quit IRC | 19:43 | |
| ayoung | ekolve, they should be there | 19:43 |
| ayoung | v2.0 shoud be under /main and /admin | 19:44 |
| *** dkranz has quit IRC | 19:44 | |
| ayoung | you need to change the auth url to drop the port and pick up main | 19:44 |
| *** chenxu has joined #openstack-dev | 19:44 | |
| ayoung | http://127.0.0.1/main/v2.0, | 19:44 |
| ekolve | y, that seems to be working better, thank you | 19:45 |
| ayoung | ekarlso, I should hope so. I wrote that doc you were reading | 19:45 |
| lyncos | I think something failed badly.. when I do run_test... I get : tools/with_venv.sh: line 7: nosetests: command not found | 19:45 |
| lbragstad | lyncos: I think you might be missing a couple dependencies | 19:46 |
| bknudson | ekolve: you can configure httpd to use whatever path to keystone you want, so could tell it to point :5000 to admin | 19:46 |
| ayoung | lyncos, hrm...you should get that in the venv | 19:46 |
| ayoung | ./run_tests.sh -U | 19:46 |
| ayoung | er -u | 19:46 |
| lyncos | ok thanks | 19:46 |
| ayoung | bknudson, shhh | 19:46 |
| *** jasdeepH has quit IRC | 19:46 | |
| lyncos | still fail at the same place | 19:47 |
| ayoung | bknudson, that is crazy talk. We all know that web is supposed to be over 80 for clear text and 443 for ssl | 19:47 |
| ayoung | lyncos, you might need to install the deb outside your venv | 19:47 |
| ayoung | that seems strange | 19:47 |
| lyncos | http://paste.openstack.org/show/47861/ | 19:47 |
| morganfainberg | ayoung, phsaw, I run secure traffic on 80 and plaintext on 443, i'm a rebel | 19:47 |
| ayoung | morganfainberg, that brought forth a cackle that would scare anyone in my house if they heard it | 19:48 |
| *** Birk_ has joined #openstack-dev | 19:48 | |
| lbragstad | lyncos: missing xmlversion.h | 19:48 |
| morganfainberg | ayoung, my work here is done. | 19:48 |
| bknudson | ayoung: need to run everything over 80/443 to subvert firewall rules | 19:48 |
| ayoung | lbragstad, yeah, but he has that file | 19:48 |
| ayoung | it is in libxml-dev | 19:48 |
| lyncos | yeah the file is here | 19:49 |
| Birk_ | The server can support keystone v2 and v3 ath the same time? | 19:49 |
| ayoung | bknudson, and to be SELinux compliant. | 19:49 |
| ayoung | Birk_, yep | 19:49 |
| morganfainberg | Birk_, yes it can. | 19:49 |
| bknudson | ayoung: ok, you can subvert selinux, too. can't block 80/443. | 19:49 |
| ayoung | Birk_, those are just versions of the API. Served out of different routes | 19:49 |
| morganfainberg | Birk_, what ayoung said. | 19:49 |
| ayoung | bknudson, actually, I meant that running on 80/443 was supported by standard SELinux policy already. No subversion necessary | 19:50 |
| lyncos | file exist at that location: /usr/include/libxml2/libxml/xmlversion.h | 19:50 |
| lyncos | and the error is libxml/xmlversion.h I guess it's looking in the wrong path | 19:50 |
| morganfainberg | ayoung, out of curiosity how complete is the SELinux policy for openstack? (if at all) I haven't actually looked, but figured you might have some insight. I'm building a case for use of differing distros. | 19:51 |
| lyncos | does it should be libxml2/libxml/xmlversion instead ? | 19:51 |
| *** mjb_ has quit IRC | 19:52 | |
| *** dtyarnell has joined #openstack-dev | 19:52 | |
| *** radez is now known as radez_g0n3 | 19:53 | |
| *** amohn9 has quit IRC | 19:54 | |
| *** dolphm has joined #openstack-dev | 19:55 | |
| *** vipul-away is now known as vipul | 19:55 | |
| lyncos | Now I understand why I'm not a code | 19:56 |
| lyncos | s/code/coder | 19:56 |
| *** chenxu has quit IRC | 19:56 | |
| *** bashok_ has quit IRC | 19:57 | |
| *** MaxV has joined #openstack-dev | 19:57 | |
| lyncos | seems to works better with libxslt1-dev | 19:58 |
| lyncos | :-) | 19:58 |
| Birk_ | ayoung: so I must have both endpoints registered for keystone. V2 and V3 ? | 19:58 |
| *** adalbas has quit IRC | 19:58 | |
| *** dolphm has quit IRC | 19:59 | |
| *** djoreilly has quit IRC | 19:59 | |
| *** exed has quit IRC | 20:00 | |
| ekarlso | samalba: ? | 20:00 |
| *** dolphm has joined #openstack-dev | 20:00 | |
| ayoung | Birk_, in order to do what? | 20:00 |
| ayoung | lyncos, I think, just maybe, there is a coder inside struggling to come out | 20:01 |
| *** dmakogon_ipod has left #openstack-dev | 20:04 | |
| *** tvb has quit IRC | 20:06 | |
| lyncos | lol | 20:06 |
| lyncos | ok now running run_tests -u | 20:06 |
| *** dprince has quit IRC | 20:07 | |
| *** chenxu has joined #openstack-dev | 20:08 | |
| *** briancurtin has joined #openstack-dev | 20:08 | |
| *** shinylasers has quit IRC | 20:09 | |
| Birk_ | ayoung: I'm trying to run some cinder commands. When I run the commands the authentication is being made using v3 (--os-auth-url http://localhost:35357/v3) but the auth_token.py (keystoneclient) is trying to use the v2 url to validate the token | 20:09 |
| ayoung | Birk_, yep | 20:10 |
| Birk_ | because when he executes http://localhost:35357/ bothe versions are supported. Then he chooses v2 because is the first option | 20:10 |
| ayoung | Birk_, but Keystone should support both, | 20:10 |
| lyncos | ayoung looks better now .. I see a bunch of OK and SKIP in the tests | 20:11 |
| ayoung | Birk_, well, you would think so, but actuyally, the client always goes V2...I think | 20:11 |
| ayoung | lyncos, schweet! | 20:11 |
| ayoung | lyncos, is that against the AD server? | 20:11 |
| lyncos | no no it's the run_server.sh -u | 20:11 |
| lyncos | test_move_project_between_domains SKIP | 20:11 |
| lyncos | things like that .. its' going on | 20:12 |
| Birk_ | actually the client asks the server the supported versions and then compare them with the LIST_OF_VERSIONS_TO_ATTEMPT = ['v2.0', 'v3.0'] | 20:12 |
| Birk_ | so even if I'm using v3 the client will assume always v2 | 20:13 |
| *** xqueralt has quit IRC | 20:13 | |
| *** xqueralt has joined #openstack-dev | 20:13 | |
| lyncos | ayoung what would be the next step after run_server -u ? | 20:14 |
| Birk_ | unless I declare the auth_version option in the conf file :) | 20:14 |
| ayoung | Birk_, I was thinking auth_token middleware...but we've flip flopped on a few things, I might be out of date | 20:15 |
| ayoung | lyncos, the tests run? | 20:15 |
| ayoung | aside from the skips? | 20:15 |
| Birk_ | ayoung: it's auth_token middleware :) | 20:15 |
| lyncos | the tests run is going on .. with couple of skips .. it seems to take some time to run | 20:15 |
| lyncos | ok done now but it failed because of the line I changed... removed it and starting over | 20:18 |
| lyncos | ayoung In the mean time is there any way to change ldap version .. I think V2 doesn't support recursion at all.. I would like to try | 20:19 |
| *** topol has quit IRC | 20:19 | |
| *** otherwiseguy has joined #openstack-dev | 20:21 | |
| *** shinylasers has joined #openstack-dev | 20:22 | |
| ayoung | lyncos, you can set up subtree searches yes | 20:22 |
| *** shinylasers has quit IRC | 20:22 | |
| lyncos | It's already set to sub | 20:23 |
| *** cjellick has joined #openstack-dev | 20:23 | |
| cburgess | anyone know how to configure the number of parralel tests that tox will run? | 20:23 |
| ayoung | lyncos, then what do you mean by recursion> | 20:24 |
| *** chenxu has quit IRC | 20:24 | |
| ayoung | ? | 20:24 |
| lyncos | ayoung the problem I have that recurse on different DC | 20:24 |
| bknudson | looking at oslo.db sqlalchemy/session.py, what's a slave database? | 20:24 |
| bknudson | https://github.com/openstack/oslo-incubator/blob/master/openstack/common/db/sqlalchemy/session.py#L283 | 20:24 |
| ayoung | lyncos, DC? | 20:24 |
| lyncos | DC = domain controller | 20:25 |
| ayoung | lyncos, do you mean forests? | 20:25 |
| ayoung | so that users are in one LDAP server and Projects are in another? | 20:25 |
| lyncos | ayoung I mean the Windows Domain controller server.. the one where ldap is running | 20:25 |
| lyncos | no everything is on all servers at same time | 20:25 |
| lyncos | but the code is still fetching the list of DC and connecting to a random one | 20:25 |
| ayoung | ah...ok, so same issue we've been fighting. | 20:26 |
| lyncos | yeah | 20:26 |
| *** briancurtin_ has joined #openstack-dev | 20:26 | |
| lyncos | Theses test are so long | 20:26 |
| *** chenxu has joined #openstack-dev | 20:26 | |
| ayoung | yeah...live ldap is slow | 20:26 |
| lyncos | ok run_server -u done | 20:26 |
| ayoung | you should run the tests against the fake server first for most things | 20:26 |
| *** briancurtin has quit IRC | 20:27 | |
| *** briancurtin_ is now known as briancurtin | 20:27 | |
| ayoung | and you don't need -u every time | 20:27 |
| lyncos | what I need to do ? | 20:27 |
| ayoung | but fakeserver will do you no good | 20:27 |
| *** dvarga has quit IRC | 20:27 | |
| ayoung | you can run just a single test if you know it exercises your line of code | 20:27 |
| lyncos | can I only run the ldap tests ? | 20:27 |
| lyncos | ok did it | 20:28 |
| lyncos | ./run_tests.sh keystone.tests._ldap_livetests | 20:28 |
| lyncos | keystone.common.environment: INFO: Environment configured as: eventlet | 20:29 |
| *** alunduil has quit IRC | 20:29 | |
| ayoung | ./run_test.sh keystone.tests._ldap_livetests:LiveLDAPIdentity.test_ | 20:29 |
| ayoung | so for example | 20:29 |
| ayoung | ./run_test.sh keystone.tests._ldap_livetests:LiveLDAPIdentity.test_list_groups_for_user_filtered | 20:29 |
| *** jbresnah has quit IRC | 20:29 | |
| lyncos | I always get AttributeError: 'module' object has no attribute '_ldap_livetests' | 20:29 |
| ayoung | ah... no s | 20:30 |
| ayoung | ./run_test.sh keystone.tests._ldap_livetest:LiveLDAPIdentity.test_list_groups_for_user_filtered | 20:30 |
| ayoung | lyncos, it is the file under keystone/tests/ | 20:30 |
| ayoung | _ldap_livetest.py | 20:30 |
| lyncos | ok lets'try to run full ldap tests | 20:30 |
| ayoung | and do -x | 20:30 |
| ayoung | ./run_test.sh -x keystone.tests._ldap_livetest:LiveLDAPIdentity.test_list_groups_for_user_filtered | 20:31 |
| ayoung | that will stop after the first err | 20:31 |
| ayoung | or | 20:31 |
| *** jbresnah has joined #openstack-dev | 20:31 | |
| lyncos | ok cool | 20:31 |
| lyncos | How can I be sure it's actually using my ldap server? | 20:31 |
| lyncos | is it hitting ldap at that time ? | 20:32 |
| lyncos | or it's just tests against the code ? | 20:32 |
| *** cjellick has quit IRC | 20:32 | |
| *** gimps_ has quit IRC | 20:32 | |
| lyncos | all the tests did run correctly .. (33 skips) | 20:33 |
| *** cjellick has joined #openstack-dev | 20:33 | |
| *** DennyZhang has quit IRC | 20:34 | |
| *** FunnyLookinHat has quit IRC | 20:34 | |
| *** boden has quit IRC | 20:34 | |
| ekolve | has anyone set kerberos authentication with keystone and horizon? Should horizon delegate its Negotiate token to keystone when a user authenticates to the KPN for horizon? | 20:35 |
| *** sandywalsh_ has joined #openstack-dev | 20:39 | |
| *** sandywalsh has quit IRC | 20:39 | |
| *** Birk_ has quit IRC | 20:40 | |
| *** FunnyLookinHat has joined #openstack-dev | 20:40 | |
| *** dkranz has joined #openstack-dev | 20:41 | |
| *** galstrom is now known as galstrom_zzz | 20:41 | |
| ayoung | ekolve, oh...I like how you are thinking | 20:41 |
| ayoung | ekolve, ideally, no, you would use S4U2Proxy | 20:41 |
| ayoung | but you can probably prototype with delegation to start | 20:42 |
| *** AlexF has joined #openstack-dev | 20:42 | |
| ayoung | lyncos, ah...um,,,so | 20:42 |
| *** chenxu has quit IRC | 20:42 | |
| ayoung | it was probably running against the openldap server | 20:42 |
| ayoung | but...that is goo | 20:42 |
| ayoung | d | 20:42 |
| ayoung | you have a positive thread test to go against | 20:43 |
| ayoung | the _ldap_livetests have their own config file...I guess to really test this you need to modify that | 20:43 |
| lyncos | The request you have made requires authentication. (HTTP 401) | 20:43 |
| *** zul has quit IRC | 20:44 | |
| *** mlavalle_ has quit IRC | 20:44 | |
| *** sandywalsh_ has quit IRC | 20:44 | |
| ayoung | you can probably do so by copying /etc/keystone/keystone.conf to keystone/tests/backend_liveldap.conf | 20:44 |
| lyncos | ok did it | 20:44 |
| *** bvandenh has quit IRC | 20:45 | |
| lyncos | test_add_duplicate_role_grant ERROR | 20:45 |
| ekolve | what about just authenticating to using an external authenticator in keystone from horizon? Throwing out the kerberos part, if keystone uses an external authenticator, how can horizon authenticate a user, is the pattern to pass credentials it receives on? | 20:45 |
| ayoung | rcrit, can you talk with ekolve ? He's doing all of the Kerberos Horizon type stuff we talked about | 20:45 |
| *** jecarey has quit IRC | 20:45 | |
| lyncos | nice it fail right away | 20:45 |
| ayoung | ekolve, if you do REMOTE_USER in Horizon, you don't have credentials to pass on to Keystone and you can do nothing | 20:45 |
| *** SergeyLukjanov has quit IRC | 20:48 | |
| lyncos | ayoung any idea why it's failing ? | 20:48 |
| ayoung | lyncos, did you get a stack trace? | 20:48 |
| lyncos | yeah | 20:48 |
| lyncos | http://paste.openstack.org/show/47869/ | 20:49 |
| *** jmontemayor has joined #openstack-dev | 20:49 | |
| *** sarob has quit IRC | 20:50 | |
| ayoung | lyncos, you probably needto change the attribute from desc to whatever you have on your server...tis an AD specific thing I think | 20:50 |
| lyncos | ah description | 20:50 |
| *** sarob has joined #openstack-dev | 20:50 | |
| lyncos | instead of desc | 20:51 |
| lyncos | but where ? | 20:51 |
| ayoung | https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L381 | 20:51 |
| ayoung | lyncos, that is mapped in the role object...link in a moment | 20:52 |
| *** buzztroll has joined #openstack-dev | 20:52 | |
| lyncos | it's the same config file that is working on live server | 20:52 |
| *** jbresnah has quit IRC | 20:52 | |
| ayoung | hrm... | 20:53 |
| ayoung | lyncos, becasue it is actually trying to create objects | 20:53 |
| lyncos | ahhh I may have no rights | 20:53 |
| lyncos | let me check | 20:53 |
| ayoung | https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L381 | 20:53 |
| lyncos | I should be able to write.. | 20:53 |
| ayoung | https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L381 | 20:54 |
| ayoung | argh | 20:54 |
| ayoung | File "/opt/stack/keystone/keystone/tests/_ldap_livetest.py", line 37, in create_object | 20:54 |
| *** chenxu has joined #openstack-dev | 20:54 | |
| *** sarob has quit IRC | 20:55 | |
| ayoung | File "/opt/stack/keystone/keystone/tests/_ldap_livetest.py", line 60, in clear_database | 20:55 |
| lyncos | For now Can I skip the 'writes' to ldap ? | 20:55 |
| ayoung | lyncos, hmmm.this might be a bad idea to run against a live LDAP server | 20:55 |
| ayoung | nah, it needs sample data. No sample data, no unit tests | 20:55 |
| lyncos | my user only has access to a specific OU that I don't care to loose everything | 20:56 |
| *** chenxu has quit IRC | 20:56 | |
| lyncos | is there any way to log what the tests are doing ? | 20:56 |
| *** buzztroll has quit IRC | 20:56 | |
| lyncos | like .. see ldap requests | 20:56 |
| lyncos | So i can test with command line tools | 20:57 |
| ayoung | lyncos, I suspect that the tree_dn_attrs must have a desc field for your db | 20:57 |
| lyncos | Ok another way around... Can I only use ldap for authentication and DB for managing the roles/tenants etc? | 20:58 |
| *** vuil has quit IRC | 20:58 | |
| ayoung | lyncos, https://github.com/openstack/keystone/blob/master/keystone/tests/_ldap_livetest.py#L60 | 20:58 |
| ayoung | lyncos, you can in Havana....its at RC1 at the moment | 20:58 |
| *** FatDarrel has quit IRC | 20:59 | |
| lyncos | I think this will be easier | 20:59 |
| *** alexpilotti has quit IRC | 20:59 | |
| *** Farooque has joined #openstack-dev | 20:59 | |
| lyncos | sorry I don't understand the tree_dn_attrs | 21:00 |
| *** datsun180b has quit IRC | 21:01 | |
| *** alexrudenko has quit IRC | 21:01 | |
| *** tmclaugh[work] has quit IRC | 21:01 | |
| lyncos | I did not configure groups .. maybe that's the problem | 21:03 |
| *** bvandenh has joined #openstack-dev | 21:03 | |
| lyncos | nop same thing | 21:04 |
| *** fandikurnia01 has quit IRC | 21:06 | |
| *** jruzicka has quit IRC | 21:06 | |
| *** alexpilotti has joined #openstack-dev | 21:07 | |
| *** buzztroll has joined #openstack-dev | 21:07 | |
| BobBall | dansmith: ping if you're still here? | 21:08 |
| *** burt has quit IRC | 21:08 | |
| dansmith | BobBall: yeah | 21:08 |
| BobBall | w00t. | 21:08 |
| BobBall | I'm struggling trying to get my head round metadata / metadetails... | 21:08 |
| BobBall | I figured since there is a rename in the instance object from metadetails to metadata then getting it would give me my dict back | 21:09 |
| lbragstad | bknudson: ping https://review.openstack.org/#/c/49273/ https://review.openstack.org/#/c/49272/ | 21:09 |
| BobBall | but noooo... I get an sqlalchemy.MetaData back | 21:09 |
| BobBall | which appears to be a table definition? | 21:09 |
| *** litong has quit IRC | 21:09 | |
| lyncos | ayoung .. I will have to leave soon .. I'll take a decision tomorrow as if I'm trying to fix or .. wait for havana to use the 'dual' backend thing | 21:09 |
| BobBall | and I really have no clue how to work with that or what I should be expecting from there | 21:09 |
| BobBall | does the change mean that things stored in metadetails now get translated into a "table" with rows ratherthan a python dict? | 21:09 |
| dansmith | BobBall: well, it depends on where you're calling from and what you're doing exactly.. is there some code I can look up? | 21:10 |
| bknudson | lbragstad: pong | 21:10 |
| ayoung | lyncos, lets see if this change works with devstack. THat is using git master, which maps to Havan right now anyway | 21:10 |
| lyncos | how | 21:10 |
| BobBall | Sure - this is XenAPI pools which is trying to access the metadetails - see https://github.com/openstack/nova/blob/2013.1.3/nova/virt/xenapi/pool.py#L76 | 21:10 |
| ayoung | lyncos, we can pick this up tomorrow. I need to run now, too | 21:11 |
| lyncos | ok let see tomorrow | 21:11 |
| lbragstad | bknudson: quick question on those two, since you're fixing the case for db2 and then redoing that work for postgres, would it make sense to do it all in the same patch? | 21:11 |
| BobBall | dansmith: we get the metadetails then check for a key - assuming that it's a dict - but metadetails doesn't exist and metadata is a MetaData :) | 21:11 |
| lyncos | have a good evening | 21:11 |
| lyncos | thanks for your help ayoung | 21:11 |
| *** bvandenh has quit IRC | 21:12 | |
| BobBall | dansmith: the real problem I have is that I'm trying to fix up the tests - renaming to metadata rather than metadetails makes the unit tests fail showing I clearly do not understand what's going on here :) | 21:12 |
| dansmith | BobBall: so, something is calling this method and passing you what? a new-world object or a sqlalchemy Aggregate model? | 21:12 |
| *** burt has joined #openstack-dev | 21:12 | |
| *** FatDarrel has joined #openstack-dev | 21:12 | |
| bknudson | lbragstad: not redoing anything. Supporting postgres is a new feature and it wasn't mentioned in the bug being fixed. | 21:12 |
| *** sarob has joined #openstack-dev | 21:12 | |
| dansmith | BobBall: well, the unit tests are probably not in sync with something else :) | 21:12 |
| BobBall | the tests are definitely using the Aggregate model | 21:12 |
| *** changbl has joined #openstack-dev | 21:12 | |
| bknudson | lbragstad: the bug was for db2 | 21:12 |
| BobBall | perhaps that's the problem and they need a new-world object... | 21:13 |
| dansmith | BobBall: if the real caller is passing you an object, then yeah | 21:13 |
| *** vladikr has quit IRC | 21:14 | |
| BobBall | hmmmm... | 21:14 |
| lbragstad | bknudson: ok, the renaming of mysql_db2_on_checkout threw me off. But the check remains the same | 21:14 |
| bknudson | lbragstad: the function was renamed to match what it does. | 21:15 |
| bknudson | lbragstad: well, not what it does but how it's used. | 21:15 |
| lbragstad | right, since it fits cases for mysql, db2, and postgres | 21:15 |
| *** noslzzp has quit IRC | 21:15 | |
| cfriesen | hi guys, I'm running into issues when testing out the "evacuate" behaviour. If I start with an instance on compute1, then kill compute1 and evacuate to compute2, then kill compute2 and evacuate back to compute1 it seems to be failing a check in rebuild_instance() because it finds the old instance file on the disk at/var/lib/nova/instances/. Is this a bug? If not, what's the intended behaviour in this case? Surely the admin isn't supposed to | 21:15 |
| cfriesen | manually wipe a compute node before reconnecting it to the network... | 21:15 |
| *** galstrom_zzz is now known as galstrom | 21:16 | |
| *** dolphm has quit IRC | 21:16 | |
| *** prad has joined #openstack-dev | 21:17 | |
| lbragstad | bknudson: so you're keeping those two commits separate since adding db2 fixes a bug and adding postgres is a function? | 21:17 |
| bknudson | lbragstad: yes | 21:17 |
| lbragstad | gotcha.. | 21:17 |
| lbragstad | bknudson: thanks | 21:17 |
| bknudson | lbragstad: this all might go away if I can use the oslo-incubator db stuff. | 21:18 |
| lbragstad | bknudson: ++ | 21:18 |
| *** devoid1 has quit IRC | 21:19 | |
| *** devoid has joined #openstack-dev | 21:19 | |
| *** devoid has left #openstack-dev | 21:19 | |
| rcrit | ekolve, still around to talk about Kerberos? | 21:20 |
| *** jecarey has joined #openstack-dev | 21:20 | |
| *** sgordon has quit IRC | 21:21 | |
| BobBall | dansmith:perhaps a generic question- what's the recommended way to get an instance from the db object? using the _from_db_object class method? | 21:22 |
| BobBall | dansmith: or to create one to use in a test perhaps... since that's what I care about tonight :) | 21:22 |
| dansmith | BobBall: yeah, you can _from_db_object() it | 21:22 |
| dansmith | BobBall: eventually, nobody will have raw db objects anywhere and we won't be using that method directly, but for now it's a stopgap | 21:23 |
| *** shinylasers has joined #openstack-dev | 21:31 | |
| *** thomasm has quit IRC | 21:34 | |
| *** nermina has quit IRC | 21:38 | |
| *** bswartz has quit IRC | 21:39 | |
| *** thingee_zzz is now known as thingee | 21:39 | |
| *** donaldh has joined #openstack-dev | 21:41 | |
| *** mlavalle has joined #openstack-dev | 21:42 | |
| *** pcm_ has quit IRC | 21:45 | |
| *** CaptTofu has quit IRC | 21:46 | |
| *** CaptTofu has joined #openstack-dev | 21:47 | |
| *** zul has joined #openstack-dev | 21:49 | |
| *** rfolco has quit IRC | 21:49 | |
| *** zul has quit IRC | 21:49 | |
| *** amerine has quit IRC | 21:49 | |
| *** zul has joined #openstack-dev | 21:50 | |
| *** dtyarnell has quit IRC | 21:51 | |
| *** nati_ueno has joined #openstack-dev | 21:53 | |
| *** danwent has quit IRC | 21:54 | |
| *** amerine has joined #openstack-dev | 21:55 | |
| *** CaptTofu has quit IRC | 21:57 | |
| *** afazekas_no_irq has quit IRC | 21:57 | |
| *** ekolve has left #openstack-dev | 21:57 | |
| *** CaptTofu has joined #openstack-dev | 21:58 | |
| *** kbringard has quit IRC | 21:58 | |
| *** eglynn has quit IRC | 21:59 | |
| *** burt has quit IRC | 22:03 | |
| *** burt has joined #openstack-dev | 22:04 | |
| *** neelashah has quit IRC | 22:10 | |
| *** lbragstad has quit IRC | 22:11 | |
| *** bpokorny has quit IRC | 22:12 | |
| *** diogogmt has quit IRC | 22:12 | |
| *** eglynn has joined #openstack-dev | 22:16 | |
| *** mrodden has quit IRC | 22:17 | |
| *** galstrom is now known as galstrom_zzz | 22:18 | |
| *** briancurtin has quit IRC | 22:18 | |
| *** FunnyLookinHat has quit IRC | 22:20 | |
| *** morazi has quit IRC | 22:22 | |
| *** xqueralt has quit IRC | 22:23 | |
| *** flaper87 is now known as flaper87|afk | 22:24 | |
| *** READ10 has quit IRC | 22:28 | |
| *** vuil has joined #openstack-dev | 22:29 | |
| *** henrynash has quit IRC | 22:30 | |
| *** jvrbanac has joined #openstack-dev | 22:33 | |
| *** radsy has joined #openstack-dev | 22:34 | |
| *** prad has quit IRC | 22:35 | |
| *** dropped has joined #openstack-dev | 22:37 | |
| *** eharney has quit IRC | 22:37 | |
| *** dperaza has quit IRC | 22:37 | |
| *** MaxV has quit IRC | 22:38 | |
| *** Max_ has joined #openstack-dev | 22:38 | |
| *** dperaza has joined #openstack-dev | 22:38 | |
| *** rnirmal has quit IRC | 22:40 | |
| *** lbragstad has joined #openstack-dev | 22:40 | |
| *** thedodd has quit IRC | 22:47 | |
| *** anteaya has quit IRC | 22:47 | |
| *** diogogmt has joined #openstack-dev | 22:51 | |
| *** thingee is now known as thingee_zzz | 22:51 | |
| *** alexpilotti has quit IRC | 22:52 | |
| *** Mandell has quit IRC | 22:52 | |
| jamielennox | gyee: still here? | 22:53 |
| *** Mandell has joined #openstack-dev | 22:53 | |
| *** lsmola has quit IRC | 22:57 | |
| *** eglynn has quit IRC | 22:57 | |
| *** Mandell has quit IRC | 22:57 | |
| *** fbo is now known as fbo_away | 22:58 | |
| *** pmathews has quit IRC | 22:58 | |
| *** Max_ has quit IRC | 22:59 | |
| *** dstanek has quit IRC | 23:00 | |
| *** anteaya has joined #openstack-dev | 23:01 | |
| *** dstanek has joined #openstack-dev | 23:01 | |
| *** MaxV has joined #openstack-dev | 23:01 | |
| gyee | jamielennox, yes | 23:03 |
| gyee | working on a BP to contribute the X.509 to token middleware | 23:03 |
| *** jvrbanac has quit IRC | 23:03 | |
| *** sarob_ has joined #openstack-dev | 23:03 | |
| *** donaldh has quit IRC | 23:05 | |
| *** sarob_ has quit IRC | 23:05 | |
| *** sarob_ has joined #openstack-dev | 23:05 | |
| *** sheeprine has quit IRC | 23:06 | |
| jamielennox | gyee: i was just going to talk about the auth_method review, i ended up just putting it in as comments | 23:06 |
| *** grapsus has joined #openstack-dev | 23:06 | |
| *** sarob has quit IRC | 23:06 | |
| gyee | jamielennox, thanks, I'll take a look | 23:06 |
| gyee | ayoung also wants x.509 to token middleware before giving his blessing | 23:07 |
| gyee | so I am working on a BP to do just that | 23:07 |
| jamielennox | it's a good thing to have supported i guess | 23:07 |
| gyee | may take awhile though | 23:07 |
| *** cdub has quit IRC | 23:07 | |
| *** romcheg1 has quit IRC | 23:08 | |
| gyee | side-effect of working for a for-profit corporation :) | 23:08 |
| *** sarob_ has quit IRC | 23:08 | |
| jamielennox | well, we've all got those | 23:08 |
| *** sheeprine has joined #openstack-dev | 23:10 | |
| *** lsmola has joined #openstack-dev | 23:13 | |
| gyee | jamielennox, I like the second suggestion of passing the headers into get_admin_token() | 23:13 |
| gyee | but if we are going to this, lets do this all the way by supporting pluggable auth | 23:13 |
| jamielennox | gyee: yea, a lot of this will go away when we can do proper pluggable auth | 23:14 |
| *** jecarey has quit IRC | 23:14 | |
| *** AlexF has quit IRC | 23:14 | |
| jamielennox | i guess given the current state of auth_token it isn't a problem to check for external it's just not ideal | 23:15 |
| *** carl_baldwin has quit IRC | 23:15 | |
| gyee | jamielennox, well for external auth, we can do this in two ways | 23:16 |
| gyee | 1) request a bind token using 2-way SSL | 23:16 |
| gyee | 2) trade in x.509 client cert for a token at the server side | 23:16 |
| *** mlavalle has quit IRC | 23:17 | |
| gyee | the second option gain us performance as we will be saving a roundtrip | 23:17 |
| jamielennox | gyee: i don't think that they are seperate options | 23:18 |
| gyee | they are | 23:18 |
| jamielennox | gyee: or at least on a scale bigger than keystone | 23:18 |
| gyee | one is done at the client side and the other is on the server side | 23:18 |
| *** boris-42 has quit IRC | 23:19 | |
| jamielennox | so for keystone i guess it's ok because it's going to know your permissions/roles anyway - but it's not going to help with connecting to nova with just client certs | 23:19 |
| jamielennox | ah, although we are talking about auth_token not the user, so it's only talking to keystone anyway | 23:20 |
| gyee | jamielennox, that's correct | 23:20 |
| jamielennox | don't mind me | 23:20 |
| jamielennox | i'm just confusing concepts | 23:20 |
| *** mdenny has quit IRC | 23:20 | |
| gyee | well, technically it can be done at Nova | 23:20 |
| gyee | just have a middleware to convert the X.509 cert into user context | 23:21 |
| gyee | bypassing keystone :) | 23:21 |
| gyee | but that's not cool | 23:21 |
| jamielennox | lol, don't say that out loud around here | 23:21 |
| *** rcleere has quit IRC | 23:22 | |
| jamielennox | so how do you handle roles etc, for client certs in keystone | 23:23 |
| jamielennox | i'm hoping we get an x509 auth soon anyway, but that would still be expected to issue tokens | 23:23 |
| gyee | jamielennox, use mappings and persona approach | 23:24 |
| *** jmontemayor has quit IRC | 23:24 | |
| jamielennox | gyee: that's held in middleware then | 23:24 |
| *** MaxV has quit IRC | 23:25 | |
| *** MaxV has joined #openstack-dev | 23:25 | |
| *** mkollaro has quit IRC | 23:26 | |
| gyee | jamielennox, combination of middleware, auth plugin, and token provider plugin | 23:26 |
| gyee | same way to are going to enable federation | 23:26 |
| *** jimfehlig has quit IRC | 23:27 | |
| jamielennox | ok, makes sense - i was trying to think if there was a simple way it could be shimmed in, but you've done it 'properly' | 23:28 |
| *** kbrierly has left #openstack-dev | 23:28 | |
| *** MaxV has quit IRC | 23:30 | |
| *** rfolco has joined #openstack-dev | 23:30 | |
| *** giulivo has quit IRC | 23:31 | |
| *** jergerber has quit IRC | 23:31 | |
| *** gordc has quit IRC | 23:31 | |
| *** sheeprine has quit IRC | 23:32 | |
| *** yjiang5 has quit IRC | 23:34 | |
| *** dstanek has quit IRC | 23:37 | |
| *** chenxu has joined #openstack-dev | 23:41 | |
| *** sheeprine has joined #openstack-dev | 23:43 | |
| *** Ryan_Lane has quit IRC | 23:44 | |
| *** diogogmt has quit IRC | 23:45 | |
| *** diogogmt has joined #openstack-dev | 23:46 | |
| *** gyee has quit IRC | 23:46 | |
| *** MaxV has joined #openstack-dev | 23:56 | |
| *** dstanek has joined #openstack-dev | 23:56 | |
| *** rfolco has quit IRC | 23:58 | |
| *** sheeprine has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!