| *** openstack has joined #openstack-dev | 13:37 | |
| *** openstackstatus has joined #openstack-dev | 13:37 | |
| *** FunnyLookinHat has joined #openstack-dev | 13:37 | |
| *** gordc has joined #openstack-dev | 13:39 | |
| *** ekhugen has joined #openstack-dev | 13:41 | |
| *** jay-lau-513 has joined #openstack-dev | 13:42 | |
| *** glenng has joined #openstack-dev | 13:42 | |
| *** nurla has joined #openstack-dev | 13:43 | |
| *** rcrit has quit IRC | 13:45 | |
| *** otherwiseguy has joined #openstack-dev | 13:47 | |
| *** salv-orlando has quit IRC | 13:47 | |
| *** rcrit has joined #openstack-dev | 13:47 | |
| *** doug_shelley66 has quit IRC | 13:47 | |
| *** aveiga has quit IRC | 13:48 | |
| *** jdob has joined #openstack-dev | 13:49 | |
| BobBall | yjiang5_1: Ping | 13:50 |
|---|---|---|
| *** eglynn has joined #openstack-dev | 13:50 | |
| *** aveiga has joined #openstack-dev | 13:51 | |
| *** prad_ has joined #openstack-dev | 13:51 | |
| *** jmckind has joined #openstack-dev | 13:52 | |
| *** dprince has joined #openstack-dev | 13:52 | |
| *** sthaha has joined #openstack-dev | 13:54 | |
| *** sthaha has quit IRC | 13:54 | |
| *** sthaha has joined #openstack-dev | 13:54 | |
| *** achampion has quit IRC | 13:54 | |
| *** L33 has joined #openstack-dev | 13:55 | |
| *** arozumenko1 has quit IRC | 13:56 | |
| *** rdas has quit IRC | 13:57 | |
| *** vartom1111111117 has quit IRC | 13:58 | |
| *** vkozhukalov has joined #openstack-dev | 13:58 | |
| *** salv-orlando has joined #openstack-dev | 13:58 | |
| *** rtheis has joined #openstack-dev | 13:59 | |
| *** radez_g0n3 is now known as radez | 13:59 | |
| *** otherwiseguy has quit IRC | 14:00 | |
| *** lbragstad has quit IRC | 14:00 | |
| *** salv-orlando has quit IRC | 14:00 | |
| *** glenng1 has joined #openstack-dev | 14:01 | |
| *** glenng has quit IRC | 14:01 | |
| *** jayg|g0n3 is now known as jayg | 14:01 | |
| *** jasondotstar has joined #openstack-dev | 14:02 | |
| *** glenng1 has quit IRC | 14:02 | |
| *** MaxV has quit IRC | 14:03 | |
| *** glenng has joined #openstack-dev | 14:03 | |
| *** thuc has joined #openstack-dev | 14:03 | |
| *** MaxV has joined #openstack-dev | 14:03 | |
| *** dbalog has joined #openstack-dev | 14:04 | |
| *** browne has joined #openstack-dev | 14:06 | |
| *** vijendar has joined #openstack-dev | 14:09 | |
| *** ewindisch is now known as zz_ewindisch | 14:09 | |
| *** markmc has quit IRC | 14:10 | |
| *** luisg has quit IRC | 14:11 | |
| *** luisg has joined #openstack-dev | 14:11 | |
| *** zz_ewindisch is now known as ewindisch | 14:11 | |
| *** Longgeek has quit IRC | 14:11 | |
| *** neelashah has quit IRC | 14:11 | |
| *** evgenyf has joined #openstack-dev | 14:13 | |
| *** neelashah has joined #openstack-dev | 14:13 | |
| *** markmc has joined #openstack-dev | 14:14 | |
| *** ewindisch is now known as zz_ewindisch | 14:15 | |
| *** xga has quit IRC | 14:15 | |
| *** xga has joined #openstack-dev | 14:16 | |
| *** xingchao_ has quit IRC | 14:16 | |
| *** zz_ewindisch is now known as ewindisch | 14:16 | |
| *** peristeri has joined #openstack-dev | 14:17 | |
| *** ewindisch is now known as zz_ewindisch | 14:17 | |
| *** e0ne has joined #openstack-dev | 14:21 | |
| *** e0ne_ has quit IRC | 14:21 | |
| *** eharney has joined #openstack-dev | 14:22 | |
| *** dims has quit IRC | 14:22 | |
| *** heyongli has quit IRC | 14:24 | |
| *** dims has joined #openstack-dev | 14:25 | |
| *** nkinder has quit IRC | 14:26 | |
| *** blamar has joined #openstack-dev | 14:28 | |
| *** thuc has quit IRC | 14:29 | |
| *** READ10 has joined #openstack-dev | 14:30 | |
| *** thuc has joined #openstack-dev | 14:30 | |
| *** b3nt_pin is now known as beagles | 14:30 | |
| *** damnsmith is now known as dansmith | 14:31 | |
| *** lbragstad has joined #openstack-dev | 14:32 | |
| *** doug_shelley66 has joined #openstack-dev | 14:32 | |
| *** xga has quit IRC | 14:33 | |
| *** mrunge has joined #openstack-dev | 14:34 | |
| *** thuc has quit IRC | 14:35 | |
| *** tdruiva has quit IRC | 14:35 | |
| *** tdruiva has joined #openstack-dev | 14:35 | |
| *** jecarey has quit IRC | 14:37 | |
| *** jnoller has joined #openstack-dev | 14:37 | |
| *** stevemar has joined #openstack-dev | 14:40 | |
| *** bknudson has joined #openstack-dev | 14:40 | |
| *** Longgeek has joined #openstack-dev | 14:42 | |
| *** burt has joined #openstack-dev | 14:42 | |
| *** ijw has joined #openstack-dev | 14:42 | |
| *** terrylhowe has joined #openstack-dev | 14:43 | |
| *** achampion has joined #openstack-dev | 14:48 | |
| *** avishayb has quit IRC | 14:49 | |
| *** FunnyLookinHat has quit IRC | 14:49 | |
| *** alop has joined #openstack-dev | 14:49 | |
| *** jobewan has joined #openstack-dev | 14:49 | |
| *** mordred has quit IRC | 14:50 | |
| *** mordred has joined #openstack-dev | 14:50 | |
| *** joesavak has joined #openstack-dev | 14:50 | |
| *** chandankumar has quit IRC | 14:52 | |
| *** CaptTofu has quit IRC | 14:52 | |
| *** pschaef has joined #openstack-dev | 14:52 | |
| *** hartsocks has joined #openstack-dev | 14:54 | |
| *** coolsvap has joined #openstack-dev | 14:54 | |
| *** Mandell has joined #openstack-dev | 14:54 | |
| *** avishayb has joined #openstack-dev | 14:56 | |
| *** mindpixel has quit IRC | 14:58 | |
| *** sthaha has quit IRC | 14:58 | |
| *** mindpixel has joined #openstack-dev | 14:59 | |
| *** irenab_ has quit IRC | 14:59 | |
| *** VenkatTS has joined #openstack-dev | 15:02 | |
| *** tsv has quit IRC | 15:02 | |
| *** ekhugen has quit IRC | 15:03 | |
| *** e0ne_ has joined #openstack-dev | 15:05 | |
| *** VenkatTS has quit IRC | 15:06 | |
| *** jecarey has joined #openstack-dev | 15:06 | |
| *** dave_tucker has joined #openstack-dev | 15:07 | |
| *** e0ne has quit IRC | 15:08 | |
| *** sandywalsh has joined #openstack-dev | 15:09 | |
| *** vladikr has joined #openstack-dev | 15:10 | |
| *** vkozhukalov has quit IRC | 15:10 | |
| *** mrunge has quit IRC | 15:11 | |
| *** mrodden has joined #openstack-dev | 15:11 | |
| *** wfoster_ is now known as wfoster | 15:11 | |
| fungi | i think python-keystoneclient==0.4.2 may have just broken horizon | 15:11 |
| *** nkinder has joined #openstack-dev | 15:12 | |
| fungi | looks like all python unit test runs for horizon are now failing on keystone-specific tests as of the last few minutes, and the only change in the pip freeze output for the tests is python-keystoneclient==0.4.2 instead of 0.4.1 | 15:13 |
| *** moijes12 has joined #openstack-dev | 15:13 | |
| *** jecarey has quit IRC | 15:15 | |
| *** rwsu has joined #openstack-dev | 15:16 | |
| jaypipes | sdague: oh, XML, why don't thou die. | 15:16 |
| *** CaptTofu has joined #openstack-dev | 15:16 | |
| *** AlanClark has joined #openstack-dev | 15:16 | |
| *** dstanek has joined #openstack-dev | 15:17 | |
| clarkb | need a bigger fire | 15:17 |
| *** mdenny has joined #openstack-dev | 15:17 | |
| noorul | lol @ jaypipes | 15:18 |
| jaypipes | noorul: I am deliberately going to NOT respond to that ML post. :) | 15:18 |
| *** tongli has joined #openstack-dev | 15:19 | |
| *** jecarey has joined #openstack-dev | 15:19 | |
| bknudson | fungi: "UnknownMethodCallError: Method called is not a member of the object: management_url" ? | 15:20 |
| fungi | bknudson: yup | 15:20 |
| *** carlp has joined #openstack-dev | 15:20 | |
| fungi | horizon will presumably need patching to work around that | 15:21 |
| *** rnirmal has joined #openstack-dev | 15:21 | |
| *** coolsvap has quit IRC | 15:21 | |
| *** Loquacity has quit IRC | 15:22 | |
| *** markmc has quit IRC | 15:22 | |
| bknudson | Looks like the horizon test is trying to create a mock keystoneclient and creating the mock fails for some reason. | 15:22 |
| *** aeperezt has joined #openstack-dev | 15:23 | |
| *** jecarey_ has joined #openstack-dev | 15:23 | |
| *** ekhugen has joined #openstack-dev | 15:23 | |
| jpich | fungi: Thanks for the heads-up | 15:25 |
| *** galstrom_zzz is now known as galstrom | 15:25 | |
| fungi | jpich: you're welcome | 15:25 |
| *** jecarey has quit IRC | 15:27 | |
| sdague | jaypipes: well, I figured I would bring it up one last time before we have to keep it for the next 3 years until nova v4 is out | 15:28 |
| jaypipes | sdague: LOL. You know full well where I stand on the issue. | 15:28 |
| sdague | but we hadn't really thought about validation bandwidth before | 15:28 |
| jaypipes | while (is_alive(xml)) { kill(xml);} | 15:29 |
| ttx | but but but | 15:30 |
| ttx | what about the enterprise? | 15:30 |
| *** salv-orlando has joined #openstack-dev | 15:30 | |
| *** gokrokve has joined #openstack-dev | 15:30 | |
| ttx | </trollbait> | 15:30 |
| jaypipes | ttx: oh, Thierry. | 15:32 |
| *** markmcclain has joined #openstack-dev | 15:32 | |
| *** mrodden has quit IRC | 15:32 | |
| * jaypipes emits long-winded sigh | 15:32 | |
| *** xqueralt has quit IRC | 15:34 | |
| sdague | jaypipes: you still planning to be in montreal later this week? | 15:34 |
| jaypipes | sdague: yup. be there around lunchtime on Wed. | 15:35 |
| sdague | cool, sounds great | 15:35 |
| jaypipes | jdob: there are way too many Jays on these mailing list threads :P | 15:36 |
| jaypipes | jdob: between you, me, and jay-lau-513, I am getting confused ;) | 15:36 |
| jdob | I know, I almost called you Other Jay joking around but it came off as condescenging :) | 15:36 |
| jaypipes | loL! | 15:36 |
| jdob | funny part is, I'm actually Jason | 15:36 |
| *** jruzicka_ has joined #openstack-dev | 15:37 | |
| jaypipes | and I'm actually James :) | 15:37 |
| jdob | I shortened to Jay on my last team when we hired two more Jasons | 15:37 |
| jdob | oh, I have way more claim to Jay than you do | 15:37 |
| *** mgagne has joined #openstack-dev | 15:37 | |
| *** jruzicka has quit IRC | 15:37 | |
| jaypipes | heh, an old (really old) girlfriend called me Jay because her brother was named James, and it just stuck about 20 years ago... | 15:37 |
| *** FunnyLookinHat has joined #openstack-dev | 15:37 | |
| jdob | ah yes, I've seen those situations, need to separate from family as much as possible | 15:37 |
| jaypipes | indeed :) | 15:37 |
| *** morazi has joined #openstack-dev | 15:38 | |
| jdob | Jay P and Jay D work in text (sound too close in voice), though everyone normally devolves to calling me jdob after a while anyway | 15:38 |
| jdob | that sounds find in voice too, so I ended up going by that | 15:38 |
| *** salv-orlando has quit IRC | 15:38 | |
| *** rpodolyaka has joined #openstack-dev | 15:38 | |
| jaypipes | jdob: but anyway, thx for entertaining my questions about the Tuskar domain model... coming from ops-world over the last couple years, I've felt the pain of trying to deal with "enterprise" DC inventory management practices, and it's something that interests me. | 15:38 |
| jdob | it was a great explanation. i still believe that tuskar needs to store way more in itself than we are currently aiming for; not duplication, but some form of inventory model, so your example gives me new ammo | 15:39 |
| *** Squid56 has joined #openstack-dev | 15:40 | |
| jaypipes | jdob: yeah. not a huge priority, but like I said, having it on the roadmap would be great. | 15:40 |
| jdob | given the time constraints for icehouse, I understand the evolution we're going down | 15:40 |
| *** markmcclain has quit IRC | 15:41 | |
| *** markmcclain has joined #openstack-dev | 15:42 | |
| *** coolsvap has joined #openstack-dev | 15:42 | |
| *** Longgeek_ has joined #openstack-dev | 15:42 | |
| *** markwash has joined #openstack-dev | 15:43 | |
| *** jdurgin1 has quit IRC | 15:44 | |
| *** Nikolay_1t has quit IRC | 15:44 | |
| *** Longgeek has quit IRC | 15:45 | |
| *** yeylon_ has quit IRC | 15:45 | |
| *** markwash has quit IRC | 15:46 | |
| *** jruzicka_ has quit IRC | 15:47 | |
| *** spzala has joined #openstack-dev | 15:48 | |
| *** jruzicka has joined #openstack-dev | 15:48 | |
| *** kpavel has quit IRC | 15:48 | |
| *** kevinconway has joined #openstack-dev | 15:48 | |
| *** tkammer has quit IRC | 15:49 | |
| *** aswadrangnekar has quit IRC | 15:49 | |
| *** xqueralt has joined #openstack-dev | 15:50 | |
| *** mohits has joined #openstack-dev | 15:51 | |
| *** nmagnezi has quit IRC | 15:51 | |
| *** NikitaKonovalov has quit IRC | 15:52 | |
| *** gokrokve has quit IRC | 15:53 | |
| *** gokrokve has joined #openstack-dev | 15:53 | |
| *** CaptTofu has quit IRC | 15:54 | |
| *** markmc has joined #openstack-dev | 15:55 | |
| *** jpomero has joined #openstack-dev | 15:55 | |
| *** cagrev has joined #openstack-dev | 15:55 | |
| *** markmcclain has left #openstack-dev | 15:56 | |
| *** mrodden has joined #openstack-dev | 15:56 | |
| *** jprovazn has quit IRC | 15:56 | |
| *** DinaBelova has quit IRC | 15:57 | |
| *** AlanClark has quit IRC | 15:57 | |
| *** SergeyLukjanov has quit IRC | 15:57 | |
| *** aspiers has quit IRC | 15:59 | |
| *** alex_klimov has quit IRC | 16:00 | |
| *** markmcclain has joined #openstack-dev | 16:00 | |
| *** arozumenko has joined #openstack-dev | 16:00 | |
| *** browne has quit IRC | 16:00 | |
| dolphm | fungi: skimming back... anything i can do to help with the impact of keystoneclient 0.4.2? | 16:00 |
| *** aspiers has joined #openstack-dev | 16:00 | |
| *** Ruetobas has quit IRC | 16:01 | |
| *** ruhe is now known as ruhe_ | 16:01 | |
| *** ruhe_ is now known as ruhe | 16:01 | |
| *** Ruetobas has joined #openstack-dev | 16:03 | |
| *** mindpixel has quit IRC | 16:03 | |
| *** carl_baldwin has joined #openstack-dev | 16:03 | |
| fungi | dolphm: no idea... i assume the horizon devs have it in hand | 16:03 |
| *** angdraug has joined #openstack-dev | 16:04 | |
| *** rcleere has joined #openstack-dev | 16:04 | |
| jpich | fungi, dolphm: A patch is on the way, thanks! https://bugs.launchpad.net/horizon/+bug/1268631 | 16:04 |
| uvirtbot | Launchpad bug 1268631 in horizon "Unit tests failing with raise UnknownMethodCallError('management_url')" [Critical,In progress] | 16:04 |
| *** fifieldt has quit IRC | 16:04 | |
| *** dstanek has quit IRC | 16:05 | |
| dolphm | jpich: looking | 16:05 |
| dolphm | jamielennox: ping | 16:06 |
| *** bvandenh has quit IRC | 16:06 | |
| *** pmathews has quit IRC | 16:06 | |
| *** mancdaz is now known as mancdaz_away | 16:07 | |
| *** Tross has quit IRC | 16:07 | |
| bknudson | https://review.openstack.org/#/c/60435/ | 16:07 |
| *** mohits is now known as mohits|away | 16:07 | |
| *** Tross has joined #openstack-dev | 16:07 | |
| *** Ruetobas has quit IRC | 16:08 | |
| bknudson | ? | 16:08 |
| *** SumitNaiksatam has quit IRC | 16:08 | |
| *** jmontemayor has joined #openstack-dev | 16:09 | |
| *** Tross has left #openstack-dev | 16:09 | |
| *** Drankis has quit IRC | 16:09 | |
| *** thedodd has joined #openstack-dev | 16:10 | |
| *** bswartz has joined #openstack-dev | 16:10 | |
| *** ifarkas has quit IRC | 16:13 | |
| *** Underbyte has quit IRC | 16:13 | |
| *** Ruetobas has joined #openstack-dev | 16:13 | |
| dolphm | bknudson: management_url is now a @property from keystoneclient.httpclient | 16:14 |
| *** paragan has quit IRC | 16:14 | |
| dolphm | bknudson: is has a setter though, with an interesting comment from jamielennox https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/httpclient.py#L491-L500 | 16:15 |
| bknudson | dolphm: I don't know if this is a backwards-incompatible change or if the horizon tests monkeypatching is causing things to not work for them | 16:17 |
| *** mfer has joined #openstack-dev | 16:17 | |
| dolphm | bknudson: i'm leaning towards monkeypatching | 16:17 |
| dolphm | bknudson: although i haven't read through all the mocking code on horizon's side | 16:17 |
| dolphm | bknudson: i'm guessing we broke some expectation over there | 16:17 |
| bknudson | dolphm: they have a 1-line fix where they just mock management_url -- https://review.openstack.org/#/c/66361/1/openstack_dashboard/test/helpers.py | 16:18 |
| *** zz_ewindisch is now known as ewindisch | 16:18 | |
| *** xgsa has quit IRC | 16:19 | |
| *** afazekas has quit IRC | 16:19 | |
| *** AlanClark has joined #openstack-dev | 16:19 | |
| *** browne has joined #openstack-dev | 16:20 | |
| *** gyee_ has joined #openstack-dev | 16:20 | |
| *** belmoreira has quit IRC | 16:21 | |
| *** bvandenh has joined #openstack-dev | 16:21 | |
| *** diogogmt has joined #openstack-dev | 16:21 | |
| jpich | dolphm, bknudson: I think we've seen funky issues with mox and mocked properties before, I'd lean toward something similar happening here | 16:21 |
| *** utlemming has joined #openstack-dev | 16:22 | |
| david-lyle | dolphm, bknudson: this type of fix has been required several times with or mocked client implementation. | 16:23 |
| *** pmathews has joined #openstack-dev | 16:24 | |
| *** ekhugen has quit IRC | 16:25 | |
| *** Mandell has quit IRC | 16:25 | |
| david-lyle | I think our underlying mock is just incomplete, and as the keystoneclient code base explicitly requires certain fields, we have to add them | 16:25 |
| *** jruzicka has quit IRC | 16:25 | |
| david-lyle | ultimately there's probably a better way, but his will work for now | 16:26 |
| *** willingc has joined #openstack-dev | 16:27 | |
| bknudson | jpich david-lyle dolphm: from the error message, I'm willing to believe that there's something funky with properties | 16:30 |
| *** irenab_ has joined #openstack-dev | 16:30 | |
| bknudson | but it's not something I've seen before... not that I use mock much. | 16:30 |
| *** devoid has joined #openstack-dev | 16:31 | |
| *** e0ne_ has quit IRC | 16:32 | |
| *** anderstj has quit IRC | 16:32 | |
| *** devoid has left #openstack-dev | 16:32 | |
| *** ayoung_ has joined #openstack-dev | 16:32 | |
| *** danielbruno has quit IRC | 16:32 | |
| *** SumitNaiksatam has joined #openstack-dev | 16:33 | |
| *** jruzicka has joined #openstack-dev | 16:34 | |
| *** anderstj has joined #openstack-dev | 16:35 | |
| *** ekhugen has joined #openstack-dev | 16:35 | |
| *** danielbruno has joined #openstack-dev | 16:36 | |
| *** sandywalsh has quit IRC | 16:39 | |
| *** DinaBelova has joined #openstack-dev | 16:39 | |
| *** sandywalsh has joined #openstack-dev | 16:39 | |
| *** yamahata has joined #openstack-dev | 16:40 | |
| *** thuc has joined #openstack-dev | 16:40 | |
| *** Sumeniac has quit IRC | 16:41 | |
| *** ruhe is now known as ruhe_ | 16:42 | |
| *** ayoung_ is now known as ayoung | 16:43 | |
| *** dkuffner has quit IRC | 16:43 | |
| *** pberis has joined #openstack-dev | 16:44 | |
| *** avishayb has quit IRC | 16:45 | |
| *** Sumeniac has joined #openstack-dev | 16:45 | |
| *** jnoller has quit IRC | 16:46 | |
| *** rods has joined #openstack-dev | 16:47 | |
| *** pmcg has quit IRC | 16:47 | |
| *** ruhe_ has quit IRC | 16:47 | |
| *** irenab_ has quit IRC | 16:49 | |
| *** andreaf has quit IRC | 16:49 | |
| *** gordc1 has joined #openstack-dev | 16:50 | |
| *** SergeyLukjanov has joined #openstack-dev | 16:50 | |
| *** gordc has quit IRC | 16:51 | |
| *** xarses has quit IRC | 16:53 | |
| *** rods has quit IRC | 16:53 | |
| *** AlanClark has quit IRC | 16:55 | |
| *** jay-lau-513 has quit IRC | 16:55 | |
| *** mlavalle has joined #openstack-dev | 16:56 | |
| *** iartarisi has quit IRC | 16:58 | |
| *** markmcclain has quit IRC | 16:58 | |
| bknudson | another issue with the new version of keystoneclient -- if add new config options to auth_token middleware then nova pep8 check fails. | 16:58 |
| *** martyntaylor has left #openstack-dev | 16:59 | |
| *** _cjones_ has joined #openstack-dev | 17:00 | |
| *** markmcclain has joined #openstack-dev | 17:00 | |
| *** angdraug has quit IRC | 17:01 | |
| *** sarob has joined #openstack-dev | 17:01 | |
| *** colinmcnamara has joined #openstack-dev | 17:01 | |
| *** colinmcn_ has joined #openstack-dev | 17:01 | |
| *** dstanek_afk has joined #openstack-dev | 17:01 | |
| *** jmontemayor has quit IRC | 17:01 | |
| *** corXi has quit IRC | 17:02 | |
| *** galstrom is now known as galstrom_zzz | 17:02 | |
| *** mmagr has quit IRC | 17:03 | |
| *** teran has quit IRC | 17:03 | |
| *** digambar_ has joined #openstack-dev | 17:03 | |
| *** vkozhukalov has joined #openstack-dev | 17:04 | |
| *** akrivoka has joined #openstack-dev | 17:04 | |
| *** exed_ has quit IRC | 17:04 | |
| dolphm | bknudson: i don't follow? | 17:04 |
| *** kbrierly has joined #openstack-dev | 17:04 | |
| *** jistr has quit IRC | 17:04 | |
| bknudson | https://bugs.launchpad.net/nova/+bug/1268614 | 17:05 |
| uvirtbot | Launchpad bug 1268614 in nova "pep8 gating fails due to tools/config/check_uptodate.sh" [Undecided,Confirmed] | 17:05 |
| *** xmltok_ has joined #openstack-dev | 17:05 | |
| bknudson | not keystoneclient's problem, but something to watch out for | 17:06 |
| *** marekd is now known as marekd|away | 17:06 | |
| *** danielbruno has quit IRC | 17:06 | |
| *** evgenyf has quit IRC | 17:06 | |
| *** MaxV has quit IRC | 17:07 | |
| *** neelashah has quit IRC | 17:07 | |
| *** jmontemayor has joined #openstack-dev | 17:08 | |
| *** ifarkas has joined #openstack-dev | 17:09 | |
| *** herndon_ has joined #openstack-dev | 17:09 | |
| *** moijes12 has left #openstack-dev | 17:10 | |
| *** newell has joined #openstack-dev | 17:10 | |
| *** kdbrierly has joined #openstack-dev | 17:10 | |
| *** kbrierly has quit IRC | 17:12 | |
| *** Ryan_Lane has quit IRC | 17:12 | |
| dolphm | bknudson: ah cool. that's a nifty gate job | 17:12 |
| *** exed_ has joined #openstack-dev | 17:13 | |
| *** jpomero has quit IRC | 17:14 | |
| *** alop has quit IRC | 17:15 | |
| *** kwss has quit IRC | 17:17 | |
| *** kgriffs_afk is now known as kgriffs | 17:17 | |
| *** max_lobur is now known as max_lobur_afk | 17:17 | |
| _cjones_ | Morning keystone team. I have a question regarding authentication. I'm looking at creating a cloud admin user. | 17:17 |
| *** galstrom_zzz is now known as galstrom | 17:17 | |
| *** bvandenh has quit IRC | 17:17 | |
| _cjones_ | How do I satisfy the second part of this statement in my policy.json file? : "cloud_admin": "rule:admin_required and domain_id:admin_domain_id", | 17:17 |
| *** danielbruno has joined #openstack-dev | 17:18 | |
| *** danielbruno has quit IRC | 17:18 | |
| *** romcheg has quit IRC | 17:19 | |
| dolphm | _cjones_: you can't, exactly. the "admin_domain_id" is intended to be a placeholder for a "special" domain ID that you designate as "for admins" | 17:19 |
| *** angdraug has joined #openstack-dev | 17:19 | |
| *** gokrokve has quit IRC | 17:19 | |
| _cjones_ | So, replace the entry in the .json with the UID from my database? Would that solve this? | 17:19 |
| morganfainberg | morning | 17:19 |
| *** kbrierly has joined #openstack-dev | 17:20 | |
| *** gokrokve has joined #openstack-dev | 17:20 | |
| _cjones_ | dolphm, sorry, that last response was a question for you. | 17:20 |
| dolphm | _cjones_: yes, that's it | 17:21 |
| *** martyntaylor has joined #openstack-dev | 17:21 | |
| *** arozumenko has quit IRC | 17:21 | |
| *** kdbrierly has quit IRC | 17:21 | |
| _cjones_ | dolphm, I then get the following error: (keystone.auth.plugins.password): 2014-01-13 09:21:41,165 ERROR password _validate_and_normalize_auth_data Could not find user, admin. | 17:22 |
| *** buzztroll has joined #openstack-dev | 17:22 | |
| *** xqueralt has quit IRC | 17:23 | |
| *** neelashah has joined #openstack-dev | 17:23 | |
| *** gokrokve has quit IRC | 17:24 | |
| *** hemnafk is now known as hemna_ | 17:24 | |
| *** xarses has joined #openstack-dev | 17:25 | |
| *** omachace has left #openstack-dev | 17:25 | |
| *** tongli has quit IRC | 17:26 | |
| *** Longgeek_ has quit IRC | 17:26 | |
| *** alexpilotti has quit IRC | 17:26 | |
| *** herndon_ has quit IRC | 17:27 | |
| *** reed has joined #openstack-dev | 17:28 | |
| _cjones_ | dolphm, I'll do some more debugging here and get back to you guys. Thanks. | 17:28 |
| *** markmc has quit IRC | 17:29 | |
| *** teran has joined #openstack-dev | 17:29 | |
| *** herndon_ has joined #openstack-dev | 17:29 | |
| *** bdpayne has joined #openstack-dev | 17:30 | |
| *** kbrierly has quit IRC | 17:31 | |
| *** romcheg has joined #openstack-dev | 17:32 | |
| *** Drankis has joined #openstack-dev | 17:32 | |
| *** krotscheck has joined #openstack-dev | 17:33 | |
| *** comay has joined #openstack-dev | 17:35 | |
| *** danielbruno has joined #openstack-dev | 17:35 | |
| *** danielbruno has joined #openstack-dev | 17:35 | |
| *** kbrierly has joined #openstack-dev | 17:35 | |
| *** armax has joined #openstack-dev | 17:36 | |
| *** fbo is now known as fbo_away | 17:37 | |
| *** BobBall is now known as BobBallAway | 17:37 | |
| *** Underbyte has joined #openstack-dev | 17:38 | |
| *** rods has joined #openstack-dev | 17:38 | |
| *** zaitcev has joined #openstack-dev | 17:38 | |
| *** mohits|away has quit IRC | 17:39 | |
| *** e0ne has joined #openstack-dev | 17:39 | |
| *** Longgeek has joined #openstack-dev | 17:39 | |
| *** danpb has quit IRC | 17:40 | |
| *** csaba is now known as csaba|afk | 17:41 | |
| *** amuller has quit IRC | 17:41 | |
| *** mnaser has quit IRC | 17:42 | |
| *** Doug2 has joined #openstack-dev | 17:42 | |
| *** thuc has quit IRC | 17:42 | |
| *** alexpilotti has joined #openstack-dev | 17:43 | |
| *** thuc has joined #openstack-dev | 17:43 | |
| morganfainberg | dolphm, fyi i likely will be missing the meeting tomorrow | 17:43 |
| morganfainberg | being on a plane and all that | 17:44 |
| *** florentflament has quit IRC | 17:44 | |
| dolphm | morganfainberg: ack | 17:44 |
| dolphm | morganfainberg: i suspect you're not the only one | 17:44 |
| morganfainberg | hehe | 17:44 |
| *** ygbo has quit IRC | 17:44 | |
| *** Longgeek has quit IRC | 17:45 | |
| morganfainberg | i am also rebasing and once jenkins +1s i'll do the reapprove dance on https://review.openstack.org/#/c/60742/ simple rebase issue (the log patch went in, and i had "fixed" the import in my patchset >.< | 17:45 |
| *** doug_shelley66 has quit IRC | 17:46 | |
| morganfainberg | that should resolve bug 1251123 for icehouse, provided you don't issue more than 1 token per ~10s for a given user (all day long) | 17:46 |
| uvirtbot | Launchpad bug 1251123 in keystone/havana "_update_user_list_with_cas causes significant overhead (when using memcached as token store backend)" [High,In progress] https://launchpad.net/bugs/1251123 | 17:46 |
| morganfainberg | wel, almost fix it... still 2 more changes, but very close. | 17:46 |
| *** doug_shelley66 has joined #openstack-dev | 17:46 | |
| morganfainberg | and it looks like the fix i proposed to stable/havana might need a quick additional test, but otherwise should be pretty solid. | 17:47 |
| *** willingc has quit IRC | 17:47 | |
| *** thuc has quit IRC | 17:47 | |
| *** danielbruno has quit IRC | 17:48 | |
| *** willingc has joined #openstack-dev | 17:49 | |
| *** akrivoka has quit IRC | 17:50 | |
| *** aswadrangnekar has joined #openstack-dev | 17:50 | |
| stevemar | dolphm, ping | 17:51 |
| dolphm | stevemar: pong | 17:51 |
| stevemar | dolphm, did you chat with marekd? | 17:52 |
| dolphm | stevemar: briefly | 17:52 |
| stevemar | dolphm, i think he's wondering if he should proceed with his auth via apache modules? | 17:52 |
| dolphm | stevemar: has there been any progress on the alternative approach in code review? i haven't kept up | 17:52 |
| stevemar | dolphm, no, just the 1 patch set | 17:53 |
| *** nati_ueno has joined #openstack-dev | 17:53 | |
| dolphm | any reviews? | 17:53 |
| *** tongli has joined #openstack-dev | 17:53 | |
| stevemar | dolphm, a few from ayoung and arvind | 17:54 |
| *** tong_ has joined #openstack-dev | 17:54 | |
| *** tongli has quit IRC | 17:54 | |
| *** aswadrangnekar has quit IRC | 17:55 | |
| *** tong_ has quit IRC | 17:55 | |
| *** tong_ has joined #openstack-dev | 17:55 | |
| *** markwash has joined #openstack-dev | 17:55 | |
| *** exed_ has quit IRC | 17:55 | |
| *** buzztroll has quit IRC | 17:55 | |
| *** krotscheck has quit IRC | 17:55 | |
| *** buzztroll has joined #openstack-dev | 17:56 | |
| *** edmund has joined #openstack-dev | 17:59 | |
| *** harlowja_away is now known as harlowja | 17:59 | |
| *** buzztroll has quit IRC | 17:59 | |
| Apsu | vishy: ping | 18:00 |
| *** buzztroll has joined #openstack-dev | 18:00 | |
| mfer | folks, I've got a naming question for projects. for blindings/sdks we call the clients. Is there a reason for this? | 18:00 |
| *** athomas has quit IRC | 18:00 | |
| mfer | I ask because I've taken on the golang client. But, a golang binding or sdk might be a more common name. I'm wondering where the client name came from | 18:00 |
| *** derekh has quit IRC | 18:01 | |
| *** krotscheck has joined #openstack-dev | 18:01 | |
| *** amotoki_ has joined #openstack-dev | 18:01 | |
| *** CaptTofu has joined #openstack-dev | 18:02 | |
| *** moijes12 has joined #openstack-dev | 18:02 | |
| *** amotoki has quit IRC | 18:03 | |
| *** Ryan_Lane has joined #openstack-dev | 18:03 | |
| *** nkinder has quit IRC | 18:03 | |
| *** moijes12 has left #openstack-dev | 18:04 | |
| *** bauzas has quit IRC | 18:05 | |
| *** thuc has joined #openstack-dev | 18:08 | |
| gyee_ | stevemar, for federation, are we going with the apache approach or both? I am trying to prioritize code review | 18:09 |
| gyee_ | for IceHouse I mean | 18:09 |
| *** thuc has quit IRC | 18:10 | |
| *** thuc_ has joined #openstack-dev | 18:10 | |
| Apsu | vishy: If you can checkout https://review.openstack.org/#/c/56381/ when you're around, that'd be swell. | 18:10 |
| *** buzztroll has quit IRC | 18:11 | |
| *** thuc_ has quit IRC | 18:11 | |
| *** xarses has quit IRC | 18:11 | |
| *** tqtran has joined #openstack-dev | 18:11 | |
| *** lcheng has joined #openstack-dev | 18:11 | |
| *** thuc has joined #openstack-dev | 18:11 | |
| *** colinmc__ has joined #openstack-dev | 18:12 | |
| stevemar | gyee, i'm not sure what was decided on tuesday (if anything was) | 18:12 |
| *** rossella_s has quit IRC | 18:13 | |
| gyee_ | stevemar, do we even have time for the other? :) | 18:13 |
| *** exed_ has joined #openstack-dev | 18:16 | |
| *** gszasz has quit IRC | 18:18 | |
| *** jasondotstar has quit IRC | 18:18 | |
| *** jasondotstar has joined #openstack-dev | 18:20 | |
| *** nkinder has joined #openstack-dev | 18:20 | |
| *** boris-42 has quit IRC | 18:20 | |
| *** eglynn has quit IRC | 18:24 | |
| *** antigluk_ has quit IRC | 18:24 | |
| *** alexpilotti has quit IRC | 18:25 | |
| *** Mandell has joined #openstack-dev | 18:25 | |
| stevemar | gyee: i like the way you think ;) | 18:25 |
| *** jpich has quit IRC | 18:26 | |
| *** amcrn has joined #openstack-dev | 18:27 | |
| *** romcheg1 has joined #openstack-dev | 18:28 | |
| *** vkozhukalov has quit IRC | 18:29 | |
| yjiang5_1 | BobBallAway: pong | 18:29 |
| *** romcheg has quit IRC | 18:29 | |
| *** ruhe has joined #openstack-dev | 18:30 | |
| *** colinmc__ has quit IRC | 18:31 | |
| *** colinmcn_ has quit IRC | 18:31 | |
| *** colinmcnamara has quit IRC | 18:31 | |
| *** zzelle has joined #openstack-dev | 18:31 | |
| morganfainberg | gyee_, I think we have time for the other implementation... but..... | 18:31 |
| morganfainberg | gyee_, it may be cutting it close | 18:31 |
| morganfainberg | and require a lot of effort above and beyond to squeeze it in | 18:32 |
| *** ecarlin has joined #openstack-dev | 18:32 | |
| morganfainberg | i might be overly optimistic though | 18:32 |
| *** gokrokve has joined #openstack-dev | 18:35 | |
| *** JordanP has quit IRC | 18:36 | |
| *** alop has joined #openstack-dev | 18:37 | |
| morganfainberg | ayoung, i was actually waiting for jenkins to not complain before re-appoving that patchset :P | 18:37 |
| *** AlanClark has joined #openstack-dev | 18:37 | |
| morganfainberg | not that i think it would have | 18:38 |
| ayoung | ah, yeah, you are right. Figure you were just holding off to have a second opinion | 18:38 |
| morganfainberg | ayoung, i don't think this will be an issue though | 18:38 |
| morganfainberg | ayoung, the more i'm digging around in the token code, the more i look forward to revocation events | 18:40 |
| morganfainberg | ayoung, >.> | 18:40 |
| *** s2r2 has quit IRC | 18:40 | |
| ayoung | morganfainberg, working on it now | 18:40 |
| *** s2r2 has joined #openstack-dev | 18:40 | |
| ayoung | morganfainberg, I need a config switch in order to test thenm | 18:40 |
| *** digambar_ has quit IRC | 18:40 | |
| *** dripton has quit IRC | 18:40 | |
| morganfainberg | ayoung, cool! i'm going to bring the rest of the kvs stuff back from abandoned so we are all on dogpile for non-sql token stuffs | 18:41 |
| ayoung | I need to shut down the existing delete-upon-revoke code | 18:41 |
| morganfainberg | ayoung, ah yes. | 18:41 |
| ayoung | trying to figure out what to call it | 18:41 |
| morganfainberg | ayoung, i _think_ you can also circumvent the user-token-index stuff | 18:41 |
| morganfainberg | in kvs | 18:41 |
| ayoung | that is the idea | 18:41 |
| ayoung | a switch to shut all that down | 18:41 |
| *** buzztroll has joined #openstack-dev | 18:41 | |
| morganfainberg | ayoung, possibly something like "legacy_revocation_list" ? | 18:42 |
| morganfainberg | or.. | 18:42 |
| morganfainberg | "support_revocation_list" | 18:42 |
| morganfainberg | something like that | 18:42 |
| morganfainberg | since revocation events supplant that. | 18:42 |
| ayoung | nope | 18:43 |
| ayoung | revcoation list is going on in parallel | 18:43 |
| ayoung | something more like v2_revocations | 18:43 |
| *** galstrom is now known as galstrom_zzz | 18:43 | |
| ayoung | or | 18:43 |
| ayoung | "enumerate_user_tokens" | 18:43 |
| morganfainberg | hm. | 18:43 |
| *** dripton has joined #openstack-dev | 18:44 | |
| *** herndon_ has quit IRC | 18:44 | |
| dolphm | morganfainberg: ayoung: persist_tokens = true ? | 18:44 |
| morganfainberg | i'd tie it to something that enables the revocation_list, since w/o the enumeration, you can't _really_ support the revocation list as is in non-sql backends | 18:44 |
| ayoung | I need them in parallel, since the A-T-Middleware change is going to happen second | 18:44 |
| ayoung | dolphm, does quite work for me | 18:45 |
| morganfainberg | ayoung, it's not a turn on events vs list | 18:45 |
| *** ndipanov has quit IRC | 18:45 | |
| *** dhellmann is now known as dhellmann_ | 18:45 | |
| morganfainberg | it's a enable the revocation list / disable | 18:45 |
| morganfainberg | regardless of if events are "live" | 18:45 |
| ayoung | its rally more about the modification of the token backend in support of v2 token revocations | 18:45 |
| morganfainberg | old_style_revocations | 18:45 |
| morganfainberg | :P | 18:46 |
| ayoung | so the new revocation events will go in parallel | 18:46 |
| ayoung | I was thinking v2, but we have them in v3 right now as well | 18:46 |
| ayoung | revoke_ by_id? | 18:46 |
| morganfainberg | ayoung, hm. that seems like a good name | 18:46 |
| ayoung | I'll run with it for now | 18:46 |
| *** xarses has joined #openstack-dev | 18:46 | |
| morganfainberg | dolphm, we're still persisting tokens, w/ events, we're just not enumerating them (if events is your revocation mechanism) | 18:47 |
| morganfainberg | dolphm, my guess is for Juno we should be able to work towards ephemeral tokens | 18:47 |
| dolphm | morganfainberg: ++ but the core behavior we can change is not persisting tokens, for which a side effect is the revocation list is empty/broken/not available | 18:48 |
| *** xarses has quit IRC | 18:48 | |
| morganfainberg | dolphm, aye. | 18:48 |
| *** xarses has joined #openstack-dev | 18:49 | |
| *** romcheg1 has quit IRC | 18:49 | |
| morganfainberg | dolphm, maybe we'll tie that to the revoke_by_id option. i'm thinkign that is more descriptive in either case. | 18:49 |
| *** romcheg has joined #openstack-dev | 18:49 | |
| *** arnaud__ has joined #openstack-dev | 18:51 | |
| *** arnaud has joined #openstack-dev | 18:51 | |
| *** jmckind has quit IRC | 18:53 | |
| *** sarob has quit IRC | 18:53 | |
| *** sarob has joined #openstack-dev | 18:54 | |
| *** tong_ has quit IRC | 18:54 | |
| *** xarses has quit IRC | 18:54 | |
| *** galstrom_zzz is now known as galstrom | 18:56 | |
| *** herndon_ has joined #openstack-dev | 18:56 | |
| *** tongli has joined #openstack-dev | 18:57 | |
| *** pschaef has quit IRC | 18:57 | |
| *** jruzicka has quit IRC | 18:58 | |
| *** sarob has quit IRC | 18:58 | |
| *** rods has quit IRC | 18:58 | |
| *** aveiga has quit IRC | 18:59 | |
| *** ecarlin has quit IRC | 19:00 | |
| *** sahid has quit IRC | 19:00 | |
| *** pschaef has joined #openstack-dev | 19:01 | |
| *** asselin has joined #openstack-dev | 19:01 | |
| *** neelashah has quit IRC | 19:01 | |
| *** cagrev has quit IRC | 19:02 | |
| *** hub_cap has quit IRC | 19:04 | |
| *** neelashah1 has joined #openstack-dev | 19:04 | |
| *** cagrev has joined #openstack-dev | 19:05 | |
| *** exed_ has quit IRC | 19:06 | |
| *** yassine has quit IRC | 19:08 | |
| *** yassine has joined #openstack-dev | 19:08 | |
| *** moted has quit IRC | 19:09 | |
| *** yassine has quit IRC | 19:09 | |
| *** moted has joined #openstack-dev | 19:09 | |
| *** yassine has joined #openstack-dev | 19:09 | |
| *** yassine has quit IRC | 19:10 | |
| *** ecarlin has joined #openstack-dev | 19:11 | |
| *** colinmcnamara has joined #openstack-dev | 19:11 | |
| *** colinmcn_ has joined #openstack-dev | 19:11 | |
| *** chrispeters has joined #openstack-dev | 19:12 | |
| *** yassine has joined #openstack-dev | 19:12 | |
| *** yassine has quit IRC | 19:12 | |
| *** yassine has joined #openstack-dev | 19:13 | |
| *** yassine has quit IRC | 19:13 | |
| *** DennyZhang has joined #openstack-dev | 19:13 | |
| *** hartsocks has quit IRC | 19:13 | |
| *** dstanek_afk has quit IRC | 19:14 | |
| *** gokrokve has quit IRC | 19:15 | |
| *** gokrokve has joined #openstack-dev | 19:15 | |
| *** buzztroll has quit IRC | 19:16 | |
| *** colinmcn_ has quit IRC | 19:16 | |
| *** colinmcnamara has quit IRC | 19:16 | |
| *** amcrn is now known as arborism | 19:17 | |
| *** arborism is now known as amcrn | 19:17 | |
| *** pschaef has quit IRC | 19:17 | |
| markwash | russellb: looks like the "openreviews.txt" parts of reviewstats have stopped updating on your site, not sure what's up (reviewstats is still running fine on my laptop) | 19:18 |
| *** jtomasek has quit IRC | 19:18 | |
| *** kgriffs is now known as kgriffs_afk | 19:19 | |
| *** gokrokve has quit IRC | 19:20 | |
| *** sushils has quit IRC | 19:22 | |
| *** mnaser has joined #openstack-dev | 19:22 | |
| *** ruhe is now known as ruhe_ | 19:23 | |
| *** willingc has quit IRC | 19:24 | |
| *** jnoller has joined #openstack-dev | 19:25 | |
| *** Mandell has quit IRC | 19:26 | |
| *** gokrokve has joined #openstack-dev | 19:26 | |
| *** tdruiva has quit IRC | 19:28 | |
| *** tdruiva has joined #openstack-dev | 19:29 | |
| *** boris-42 has joined #openstack-dev | 19:30 | |
| *** buzztroll has joined #openstack-dev | 19:31 | |
| gyee_ | ayoung, I still think we need to provide an option to sign the revocation event | 19:32 |
| *** pmathews has quit IRC | 19:32 | |
| ayoung | gyee_, I think we need an option to sign anything | 19:32 |
| gyee_ | at least have an optional field in there | 19:33 |
| gyee_ | to hold the signature | 19:33 |
| chrispeters | hey guys; I'm authenticating against a keystone service but when I try to GET all users I run into a 503; any ideas why? is this a role issue? | 19:33 |
| gyee_ | 503? | 19:34 |
| chrispeters | gyee, yes | 19:34 |
| gyee_ | sound like misconfiguration somewhere | 19:34 |
| chrispeters | gyee, hmm ok; let me ping my sysadmin | 19:34 |
| *** giulivo has quit IRC | 19:34 | |
| chrispeters | I get a 503 Service Unavailable | 19:34 |
| *** ruhe_ is now known as ruhe | 19:36 | |
| *** ruhe has quit IRC | 19:36 | |
| *** kgriffs_afk is now known as kgriffs | 19:36 | |
| *** ecarlin has quit IRC | 19:37 | |
| *** spzala has quit IRC | 19:37 | |
| *** beagles has quit IRC | 19:38 | |
| *** CaptTofu has quit IRC | 19:39 | |
| *** CaptTofu has joined #openstack-dev | 19:40 | |
| _cjones_ | ayoung, or other keystone guys. Know why I would get this error?: (keystone.openstack.common.policy): 2014-01-13 11:34:22,067 ERROR policy _parse_check Failed to understand rule admin_on_project_filter | 19:40 |
| ayoung | _cjones_, did you edit that file by hand? | 19:40 |
| dolphm | chrispeters: dttocs just had and fixed the same issue in #openstack | 19:41 |
| chrispeters | dolphm, is there a url to the fix? | 19:41 |
| *** Mandell has joined #openstack-dev | 19:42 | |
| dolphm | chrispeters: i'm referring to the usage/support IRC channel | 19:42 |
| _cjones_ | ayoung, only one field in policy.json: "cloud_admin": "rule:admin_required and domain_id:31bdbda615a14da88ec8285ad476ce6e", | 19:42 |
| dolphm | chrispeters: and i mean 'just' as in 5 minutes ago... he's still online | 19:42 |
| chrispeters | dolphm, oh let me join that channel | 19:42 |
| ayoung | _cjones_, hmmm | 19:43 |
| jaypipes | dolphm: heyo... fresh checkout of keystone on a new VM (ubuntu 13.10), getting this when running ./run_tests.sh -V: | 19:43 |
| jaypipes | No distributions at all found for netifaces>=0.5 (from -r /home/jaypipes/repos/openstack/keystone/test-requirements.txt (line 41)) | 19:43 |
| jaypipes | known issue? | 19:43 |
| _cjones_ | ayoung, I'm trying now to use a newly created user in a newly created domain, to create a new user in that new domain. | 19:43 |
| *** jgrimm has joined #openstack-dev | 19:43 | |
| ayoung | _cjones_, was that based on the origianl policy,json or the cloud one? | 19:44 |
| *** b3nt_pin has joined #openstack-dev | 19:44 | |
| *** CaptTofu has quit IRC | 19:44 | |
| _cjones_ | ayoung, Other than having this user an admin user.... Is there anything i need to do to make him a "domain_admin"? | 19:44 |
| *** b3nt_pin is now known as beagles | 19:44 | |
| *** CaptTofu has joined #openstack-dev | 19:44 | |
| _cjones_ | ayoung, cloud one. Original has no concept of cloud_admin. ;) | 19:44 |
| ayoung | OK...one sec | 19:44 |
| ayoung | _cjones_, typo | 19:44 |
| ayoung | admin_on_project_filter | 19:45 |
| dolphm | jaypipes: no, but i'm poking around... maybe --allow-external netifaces :-/ | 19:45 |
| ayoung | should that be "or" | 19:45 |
| chrispeters | dolphm, not getting a response :( | 19:45 |
| _cjones_ | ayoung, sweet. Will change and test out. I have to take off for a bit, so I'll TTYL. | 19:45 |
| ayoung | nevefmind | 19:45 |
| ayoung | _cjones_, nope | 19:45 |
| ayoung | that is not it | 19:45 |
| _cjones_ | ayoung, crap. | 19:45 |
| _cjones_ | ayoung, k. Still have to take off. If you find something, can you PM me as I'll be AFK. | 19:46 |
| ayoung | _cjones_ I think your edit was wrong | 19:46 |
| _cjones_ | ayoung, ok? | 19:46 |
| russellb | markwash: thanks, will take a look | 19:46 |
| ayoung | domain_id:admin_domain_id ... | 19:46 |
| *** ativelkov has left #openstack-dev | 19:47 | |
| ayoung | _cjones_, no idea | 19:47 |
| ayoung | _cjones_, except that it looks like it is barfing on that rule, | 19:47 |
| *** tong_ has joined #openstack-dev | 19:47 | |
| browne | jaypipes: i ran into the same netifaces when running tox. but i'm new, so i figured its somehow my environment | 19:48 |
| ayoung | _cjones_, check to see if another API that also inherits that rule gives you the same error | 19:48 |
| *** tongli has quit IRC | 19:50 | |
| *** novas0x2a|laptop has joined #openstack-dev | 19:50 | |
| *** Longgeek has joined #openstack-dev | 19:55 | |
| *** BLZbubba has quit IRC | 19:59 | |
| *** ArxCruz has quit IRC | 19:59 | |
| *** dhellmann_ is now known as dhellmann | 20:00 | |
| *** evgenyf has joined #openstack-dev | 20:00 | |
| *** lcheng has quit IRC | 20:01 | |
| *** teran has quit IRC | 20:02 | |
| *** Longgeek has quit IRC | 20:02 | |
| *** sergmelikyan has quit IRC | 20:02 | |
| *** nati_uen_ has joined #openstack-dev | 20:03 | |
| *** nati_ueno has quit IRC | 20:04 | |
| *** pmathews has joined #openstack-dev | 20:04 | |
| *** boris-42 has quit IRC | 20:05 | |
| *** dstanek_afk has joined #openstack-dev | 20:06 | |
| *** markmcclain has quit IRC | 20:06 | |
| *** nati_uen_ has quit IRC | 20:07 | |
| *** dspano has joined #openstack-dev | 20:07 | |
| *** nati_ueno has joined #openstack-dev | 20:07 | |
| *** boris-42 has joined #openstack-dev | 20:08 | |
| ayoung | _cjones_, argh! | 20:08 |
| *** jmckind has joined #openstack-dev | 20:09 | |
| *** DennyZhang has quit IRC | 20:09 | |
| *** DennyZhang has joined #openstack-dev | 20:09 | |
| *** ecarlin has joined #openstack-dev | 20:11 | |
| *** denis_makogon has joined #openstack-dev | 20:11 | |
| *** ecarlin has quit IRC | 20:11 | |
| *** markmcclain has joined #openstack-dev | 20:12 | |
| *** ecarlin has joined #openstack-dev | 20:12 | |
| *** colinmcnamara has joined #openstack-dev | 20:13 | |
| *** colinmcn_ has joined #openstack-dev | 20:13 | |
| *** exed_ has joined #openstack-dev | 20:13 | |
| browne | jaypipes: this resolved the netifaces issue for me: | 20:13 |
| *** csd has joined #openstack-dev | 20:13 | |
| browne | export PIP_ALLOW_EXTERNAL=netiface | 20:13 |
| jaypipes | browne: cheers! ty! | 20:13 |
| browne | export PIP_ALLOW_UNVERIFIED=netifaces | 20:13 |
| browne | oops, first should be: export PIP_ALLOW_EXTERNAL=netifaces | 20:14 |
| *** galstrom is now known as galstrom_zzz | 20:14 | |
| bknudson | jaypipes: netifaces is a known issue -- https://review.openstack.org/#/c/65835/ | 20:14 |
| *** exed_ has quit IRC | 20:14 | |
| dstufft | browne: in 1.5.1 (not released yet) you'll only need export PIP_ALLOW_UNVERIFIED=netifaces since we changed it so allow unverified implies allow external | 20:14 |
| bknudson | jaypipes: and check the bug -- https://bugs.launchpad.net/openstack-ci/+bug/1266513 | 20:14 |
| uvirtbot | Launchpad bug 1266513 in tripleo "Some Python requirements are not hosted on PyPI" [Critical,In progress] | 20:14 |
| *** ifarkas has quit IRC | 20:15 | |
| jaypipes | bknudson: ty sir :) | 20:15 |
| bknudson | jaypipes: so I thought I removed the requirement on netifaces? | 20:16 |
| ayoung | chrispeters, yeah.lets discuss your 503 here | 20:17 |
| chrispeters | ayoung, ack | 20:18 |
| ayoung | http://fpaste.org/68063/ chrispeters that seems like a successful call | 20:18 |
| *** colinmcn_ has quit IRC | 20:18 | |
| *** colinmcnamara has quit IRC | 20:18 | |
| ayoung | chrispeters, 503 ... you sure that is from Keystone? | 20:18 |
| bknudson | chrispeters: are you running keystone under apache httpd? | 20:18 |
| ayoung | chrispeters, AND not something trying to talk to keystone and failing? | 20:18 |
| jaypipes | bknudson: you may have... just rebased my regions patch to master and am rebuilding venv now... will let you know. | 20:19 |
| chrispeters | ayoung, so I'm using a library that is returning the 503 | 20:19 |
| ayoung | eventlet.wsgi.server bknudson looks like eventlet. If it is Apache, its misconfigured | 20:19 |
| *** neelashah1 has quit IRC | 20:19 | |
| *** neelashah has joined #openstack-dev | 20:20 | |
| ayoung | chrispeters, my debugging usually follows these steps: | 20:20 |
| ayoung | 1. try it from curl | 20:20 |
| ayoung | 2. try it using the CL | 20:20 |
| ayoung | 3. If both of those succeed, look at the client ap | 20:21 |
| ayoung | you are getting back a 200, which means success, someone is lying to you and blaming Keystone. Keystone doens't mind being being slnadered, though, it has broad shoulders | 20:21 |
| ayoung | plus it gets to laugh at you later | 20:22 |
| joesavak | ayoung - lol | 20:22 |
| * ayoung anthropomorphisizes his software | 20:22 | |
| chrispeters | ayoung, ok; let me see if I can turn debugging on in the client library | 20:23 |
| dspano | ayoung: Lol. | 20:23 |
| chrispeters | ayoung, blame https://github.com/fog/fog | 20:23 |
| ayoung | The role of Keystone is being played by Andy Serkis | 20:24 |
| *** neelashah has quit IRC | 20:24 | |
| *** dstanek_afk is now known as dstanek | 20:24 | |
| chrispeters | anyone else have issues with ruby Fog library and keystone? | 20:25 |
| bknudson | does OSSA 2014-001 say it affects "Grizzly and later" only because Folsom isn't supported anymore? | 20:28 |
| ayoung | chrispeters, so my guess is that it isn't the get users call that is failing | 20:29 |
| chrispeters | ayoung, oh yeah?? | 20:29 |
| ayoung | my guess Fog is trying something afterwards, based on the service catalog, and that is the call that is failing | 20:29 |
| chrispeters | hmm | 20:30 |
| chrispeters | that would be shitty | 20:30 |
| *** doug_shelley66 has quit IRC | 20:30 | |
| chrispeters | ayoung, let me dive into this code and trace the call stack | 20:30 |
| *** doug_shelley66 has joined #openstack-dev | 20:31 | |
| *** DennyZhang has quit IRC | 20:31 | |
| bknudson | ok, looks like the code for OSSA 2014-001 isn't in folsom. | 20:31 |
| terrylhowe | I haven't had a problem with Fog and keystone | 20:31 |
| chrispeters | terrylhowe, oh yeah!? | 20:32 |
| chrispeters | terrylhowe, my test code fails as soon as I try to get all users | 20:32 |
| terrylhowe | you using openstack as the provider I take it | 20:32 |
| chrispeters | terrylhowe, yeah | 20:33 |
| chrispeters | terrylhowe, http://fpaste.org/68074/45228138/ | 20:33 |
| chrispeters | oh man; is it a jruby problem? | 20:34 |
| terrylhowe | Simple project I worked on was https://github.com/TerryHowe/kitchen-fog/blob/master/lib/kitchen/driver/fog.rb | 20:34 |
| *** amotoki has joined #openstack-dev | 20:34 | |
| mutex | belliott: pingveno | 20:35 |
| mutex | belliott: ping | 20:35 |
| *** amotoki_ has quit IRC | 20:36 | |
| chrispeters | ayoung, btw I haven't filed that bug about tenantName vs tenantname; where do I submit? | 20:36 |
| *** bvandenh has joined #openstack-dev | 20:36 | |
| ayoung | chrispeters, no bug there | 20:37 |
| chrispeters | ayoung, user error | 20:37 |
| chrispeters | heh | 20:37 |
| ayoung | chrispeters, I misunderstood what you were telling me | 20:37 |
| chrispeters | ayoung, ah ok | 20:37 |
| ayoung | you weren't passing in the tenantName at all , and thus got an unscoped token with not roles in it | 20:37 |
| chrispeters | right | 20:38 |
| chrispeters | ok cool | 20:38 |
| *** jnoller has quit IRC | 20:38 | |
| *** buzztroll has quit IRC | 20:39 | |
| chrispeters | ayoung, sent you pastebin | 20:39 |
| chrispeters | in pm because it might have sensitive data | 20:39 |
| *** buzztroll has joined #openstack-dev | 20:39 | |
| ayoung | chrispeters, yeah, and I'm going googlieyed reading it | 20:39 |
| chrispeters | ayoung, welcome to the club :) | 20:39 |
| *** buzztroll has quit IRC | 20:39 | |
| *** buzztroll has joined #openstack-dev | 20:40 | |
| *** radix_ has left #openstack-dev | 20:40 | |
| jaypipes | bknudson: yup, after rebasing, no more issue with netifaces. cheers. | 20:41 |
| * chrispeters ponders how to pretty print excon output | 20:41 | |
| terrylhowe | chrispeters everything looks on the up and up to me | 20:41 |
| ayoung | chrispeters, you are certain that comes from the get users call, and not something afterwards? | 20:41 |
| *** kenperkins has quit IRC | 20:41 | |
| bknudson | jaypipes: great, thanks... nice to know the change worked as expected. | 20:41 |
| chrispeters | ayoung, that I don't know; if I just inspect the connection I don't get an error | 20:41 |
| chrispeters | ayoung, so it's highly likely there is a call happening after the get all users call | 20:41 |
| chrispeters | terrylhowe, ack | 20:42 |
| chrispeters | ayoung, http://fpaste.org/68074/45228138/ | 20:42 |
| ayoung | that talks to 35357 | 20:42 |
| ayoung | but your squid is on some other port | 20:42 |
| ayoung | 8080 | 20:43 |
| ayoung | can it even forward over to 35357? | 20:43 |
| *** pmathews1 has joined #openstack-dev | 20:43 | |
| *** jergerber has joined #openstack-dev | 20:44 | |
| *** pmathews has quit IRC | 20:44 | |
| *** jergerber has quit IRC | 20:44 | |
| *** yeylon_ has joined #openstack-dev | 20:45 | |
| chrispeters | ayoung, I don't know; I didn't even see that | 20:46 |
| ayoung | chrispeters, blame the proxy. It is always the proxies faulyt | 20:46 |
| ayoung | fault | 20:46 |
| ayoung | unlike Keystone | 20:46 |
| chrispeters | ayoung, :) | 20:47 |
| *** buzztroll has quit IRC | 20:47 | |
| chrispeters | ayoung, ok I'm going to beg, borrow, and trade for Dan to look at the proxy | 20:48 |
| ayoung | chrispeters, try running it from inside the VPN or somehow remove the Proxy from the equation | 20:49 |
| ayoung | chrispeters, but this is yet another reason I don't want to run Keystone on a non-standard port | 20:49 |
| ayoung | Its the web, it should be on 443 | 20:49 |
| chrispeters | ayoung, I agree; I'm just caught up in the middle | 20:50 |
| ayoung | Jokers to the left, clowns to the right | 20:50 |
| chrispeters | oh noes; where am I? | 20:50 |
| chrispeters | both sound bad | 20:50 |
| chrispeters | middle; I chose middle | 20:50 |
| *** melwitt has joined #openstack-dev | 20:51 | |
| *** fbo_away is now known as fbo | 20:53 | |
| *** mkollaro has quit IRC | 20:54 | |
| *** fbo is now known as fbo_away | 20:54 | |
| *** READ10 has quit IRC | 20:54 | |
| *** DinaBelova has quit IRC | 20:55 | |
| *** nati_uen_ has joined #openstack-dev | 20:55 | |
| *** amotoki is now known as amotoki_ | 20:56 | |
| *** amotoki has joined #openstack-dev | 20:56 | |
| *** dkuffner has joined #openstack-dev | 20:56 | |
| *** jaypipes has quit IRC | 20:58 | |
| *** yamahata has quit IRC | 20:58 | |
| *** yamahata has joined #openstack-dev | 20:58 | |
| *** nati_ueno has quit IRC | 20:59 | |
| *** beagles is now known as b3nt_pin | 20:59 | |
| *** gongysh has joined #openstack-dev | 20:59 | |
| *** b3nt_pin is now known as beagles | 21:00 | |
| *** Longgeek has joined #openstack-dev | 21:00 | |
| *** mfink has joined #openstack-dev | 21:01 | |
| *** emagana has joined #openstack-dev | 21:01 | |
| *** csd has quit IRC | 21:02 | |
| dstanek | process question...why would I +2 something and not approve if there is already a +2? | 21:03 |
| *** fbo_away is now known as fbo | 21:04 | |
| *** rods has joined #openstack-dev | 21:05 | |
| *** Longgeek has quit IRC | 21:05 | |
| morganfainberg | dstanek, i can think of a few reasons | 21:05 |
| morganfainberg | 1) you want someone else opportunity to review/look at (but usually a +1 is better at that point | 21:05 |
| morganfainberg | 2) waiting for jenkins "check" to complete | 21:05 |
| *** ecarlin has quit IRC | 21:06 | |
| *** NikitaKonovalov has joined #openstack-dev | 21:06 | |
| *** yolanda has quit IRC | 21:06 | |
| morganfainberg | 3) Thinks like identity-api where we tend to let lots of people +2+1+whatever-somethign it before we merge | 21:06 |
| morganfainberg | dstanek, (#3 is really #1, just in disguise, and not really anything beside an observation vs. a hard-fast-rule) | 21:07 |
| morganfainberg | afaict | 21:07 |
| *** jtomasek has joined #openstack-dev | 21:07 | |
| *** uaberme has joined #openstack-dev | 21:07 | |
| dstanek | morganfainberg: thx, that makes sense - #2 is what i was missing | 21:07 |
| morganfainberg | dstanek, yeah that happens a lot on things like rebases | 21:07 |
| *** evgenyf has quit IRC | 21:08 | |
| morganfainberg | dstanek, so, i am about to propose some test fixes (likely tonight) to support the parallel testing, notably i think we need to cleanup the load_backends calls (make it so it can only occur once in a test setup) | 21:09 |
| morganfainberg | dstanek, the only issue i'm running across is where a test does an explicit change to the config that needs a load_backends | 21:09 |
| morganfainberg | dstanek, those, likely, should be broken out into their own class, or am i missing some decorator magic etc that can be called prior to setUp in those cases? | 21:10 |
| morganfainberg | oooooor | 21:10 |
| morganfainberg | is this a "solve with testresources and fixtures... stop messing with it" answer? | 21:10 |
| *** ecarlin has joined #openstack-dev | 21:11 | |
| dstanek | morganfainberg: so certain test methods modify the configs and call load_backends? | 21:11 |
| morganfainberg | dstanek, currently right now they do | 21:11 |
| morganfainberg | dstanek, i am thinking that is "broken" heck, i think that for the most part we rely too much on "configs" in the tests dir | 21:11 |
| morganfainberg | i'd like to see a reduction in configuration files | 21:11 |
| dstanek | morganfainberg: my first thought is that those should be in a different class so that the setUp can deal with modifying the config before load_backends is called | 21:12 |
| morganfainberg | dstanek, ok tyhat is my thought as well | 21:12 |
| morganfainberg | dstanek, cool, making sure i wasn't off in the weeds with that line of throught | 21:12 |
| morganfainberg | thought* | 21:12 |
| morganfainberg | dstanek, once i get these proposed i'm going to make load_backends raise an exception if it's called more than once. | 21:13 |
| morganfainberg | it shouldn't be. | 21:13 |
| morganfainberg | ever. | 21:13 |
| morganfainberg | and we should always do a full tear down (addCleanup) to remove the properties, which i'll also add. | 21:13 |
| morganfainberg | e.g. token_api, etc | 21:13 |
| belliott | mutex: not sure what you're missing | 21:14 |
| belliott | mutex: the logging config seems reasonable | 21:14 |
| *** colinmcnamara has joined #openstack-dev | 21:15 | |
| *** colinmcn_ has joined #openstack-dev | 21:15 | |
| mutex | belliott: well at least you are validating that my methods are sane ;-) | 21:15 |
| *** READ10 has joined #openstack-dev | 21:15 | |
| dstanek | morganfainberg: did you ever chase down the jenkins failure? | 21:15 |
| *** galstrom_zzz is now known as galstrom | 21:15 | |
| *** bvandenh has quit IRC | 21:15 | |
| *** cagrev has quit IRC | 21:15 | |
| belliott | mutex: basically as soon as the nova.compute.api module gets imported you should see 'found extension' messages from stevedore | 21:16 |
| belliott | mutex: perhaps the import doesn't occur until after you go to create an instance (i.e. not at nova-api startup) | 21:16 |
| *** evgenyf has joined #openstack-dev | 21:16 | |
| belliott | mutex: make sure you're using the same python and your hook code is on sys.path :) (double check the obvious) | 21:18 |
| mutex | belliott: heh, ok | 21:18 |
| belliott | mutex: you can always do the ghetto thing and put a 'raise' into _load_plugins in stevedore.extension to make sure it's being called | 21:19 |
| *** tong_ has quit IRC | 21:19 | |
| *** colinmcn_ has quit IRC | 21:19 | |
| *** colinmcnamara has quit IRC | 21:19 | |
| mutex | belliott: and if it is not being called ? | 21:20 |
| *** radez is now known as radez_g0n3 | 21:21 | |
| belliott | mutex: that probably means you're not running the python you think you are, heh | 21:21 |
| morganfainberg | dstanek, i think it's because kvs backend is called sometimes | 21:21 |
| morganfainberg | dstanek, vs. sql. | 21:21 |
| *** ecarlin has quit IRC | 21:21 | |
| morganfainberg | dstanek, it means we are not properly ensuring the right backend is loaded | 21:21 |
| morganfainberg | dstanek, so, thats why i am thinking we should never ever call load_backends more than once in a test | 21:22 |
| dstanek | morganfainberg: i absolutely agree. that's really a setup step so we should treat it like one. | 21:23 |
| morganfainberg | dstanek, so i'll be dropping like 3-5 patches to get that cleaned up | 21:23 |
| morganfainberg | one has to change how we do configuration options for the BaseLDAP object | 21:23 |
| morganfainberg | but i think i see all the bits that need to be done | 21:24 |
| *** Drankis has quit IRC | 21:24 | |
| morganfainberg | and... one of them is limiting the number of configuration files (we should allow overrides via a conf, but if we expect the config options, we should set it, not load it externally) | 21:24 |
| morganfainberg | harder to see "what" is being done if you keep needing to reference outside configuration files. | 21:25 |
| *** bauzas has joined #openstack-dev | 21:25 | |
| morganfainberg | dstanek, i'm also not convinced loading the "sample" config is the right choice. | 21:25 |
| morganfainberg | dstanek, it seems... silly to load keystone.conf.sample | 21:25 |
| morganfainberg | any opinion (since i'm already mucking with config stuff in tests) | 21:25 |
| morganfainberg | ? | 21:25 |
| *** hartsocks has joined #openstack-dev | 21:26 | |
| *** sarob has joined #openstack-dev | 21:28 | |
| dstanek | morganfainberg: i'd rather now read configs and wire stuff up in the tests...not sure how easy that is for us to do right now | 21:29 |
| morganfainberg | dstanek, s/now/not? | 21:29 |
| morganfainberg | the first now that is | 21:29 |
| morganfainberg | i am thinking we provide a couple of files we can supply overrides in (e.g. live tests) | 21:30 |
| *** mrodden has quit IRC | 21:30 | |
| morganfainberg | and a basic "load this file if you want to check things" | 21:30 |
| morganfainberg | w/o needing to wire up an option change | 21:30 |
| *** RajeshMohan has quit IRC | 21:30 | |
| *** evgenyf has quit IRC | 21:30 | |
| morganfainberg | so maybe 1-3 files that are empty to begin with, but are loaded in. | 21:30 |
| *** RajeshMohan has joined #openstack-dev | 21:31 | |
| morganfainberg | but otherwise all options wired up in the tests | 21:31 |
| mutex | belliott: well... so far as I can tell the paths are in sys.path, only difference between environments I can see is /usr/lib64 and /usr/lib seem to be done interchangably in nova | 21:31 |
| mutex | belliott: vs what I run in /usr/bin/python | 21:31 |
| ayoung | morganfainberg, might have just hit a show stopper. Check me on this. We want to revoke all tokens for a group. But we don't put user groups into a token. | 21:31 |
| mutex | plugins doesn't seem to trigger... so I am lost now | 21:32 |
| ayoung | current logic is to revoke all tokens for identity-lookup user is member of group. But that seems wrong, too | 21:32 |
| morganfainberg | ayoung, there is a way to get around that, can you inspect the user's groups? | 21:32 |
| morganfainberg | ayoung, oh wait... auth_token_middleware | 21:32 |
| morganfainberg | no. | 21:32 |
| morganfainberg | ayoung, uhm, this is a case where adding the groups makes sense? | 21:33 |
| *** cagrev has joined #openstack-dev | 21:33 | |
| morganfainberg | i know it's token bloat, but this is a valid reason to add data i think | 21:33 |
| ayoung | Um...but what does it mean to delete a group? | 21:33 |
| dstanek | morganfainberg: right - rather not :-) | 21:33 |
| ayoung | We shouldn't revoke all tokens for all users in that group, which is what we do now | 21:33 |
| ayoung | and is overkill | 21:33 |
| morganfainberg | ayoung, well, groups can impart role membership | 21:34 |
| * ayoung acks that you can never have too much overkill | 21:34 | |
| morganfainberg | ayoung, if you delete a group, that role membership is no longer valid | 21:34 |
| ayoung | right, so we should revoke all tokens that would have been created based on that group | 21:34 |
| morganfainberg | ayoung, s/membership/mapping | 21:34 |
| morganfainberg | ayoung, i'm fine if we can be more surgical about it | 21:34 |
| ayoung | which might be impossible to calculate | 21:34 |
| *** irenab_ has joined #openstack-dev | 21:34 | |
| morganfainberg | ayoung, exactly | 21:34 |
| *** csd has joined #openstack-dev | 21:35 | |
| morganfainberg | ayoung, i don't think we have really tried. | 21:35 |
| ayoung | so...huh | 21:35 |
| morganfainberg | ayoung, but it is theoretically possible, just may be very inefficient | 21:35 |
| ayoung | I add you to a group, then I remove you from a group...and all your tokens go away | 21:35 |
| morganfainberg | (i mean, it has to be possible... just how hard is it)_ | 21:35 |
| ayoung | just so as to mess with you | 21:35 |
| *** dprince has quit IRC | 21:35 | |
| morganfainberg | i think... think you can do role memberships for group... | 21:36 |
| ayoung | no, I think it is not theoritically possible unless we annotate in the token that the group somehow played a part in the decision | 21:36 |
| morganfainberg | and that should give you domain / project info | 21:36 |
| *** henrynash has joined #openstack-dev | 21:36 | |
| morganfainberg | then do a for user in group revoke <domain> <user> and <project> <user> tokens | 21:36 |
| ayoung | the group connection is used to create the role assignement, but then is dropped | 21:36 |
| morganfainberg | but since we can do a forward resolition to make the role assignment, we could re-do that | 21:36 |
| ayoung | morganfainberg, we can't do "for user in group" | 21:37 |
| morganfainberg | oh right, external IdP | 21:37 |
| morganfainberg | thanks. | 21:37 |
| *** SergeyLukjanov has quit IRC | 21:37 | |
| morganfainberg | brain is in "tests and kvs" mode | 21:37 |
| ayoung | that and also Auth Token Middleware would end up spamming the Keystone server | 21:37 |
| morganfainberg | oh no i was thinking it was a mechanism in keystone | 21:37 |
| *** neelashah has joined #openstack-dev | 21:37 | |
| morganfainberg | that would generate extra revocations | 21:37 |
| morganfainberg | middleware would still consume it | 21:37 |
| ayoung | it would be more correct to lok at all role assignments created from that group and to revoke tokens with those role assignments | 21:38 |
| *** herndon_ has quit IRC | 21:38 | |
| morganfainberg | wait, so if we delete a group, do role assignments get removed now? | 21:39 |
| *** corXi has joined #openstack-dev | 21:39 | |
| ayoung | morganfainberg, well, I don't think we do the cleanup | 21:39 |
| morganfainberg | ayoung, hm. | 21:39 |
| ayoung | and I'm not certain we need to, but effectively that is what we want to enforce | 21:39 |
| morganfainberg | if we use groups to impart roles | 21:39 |
| morganfainberg | we should enforce that | 21:40 |
| ayoung | we need to record it | 21:40 |
| morganfainberg | yeah | 21:40 |
| ayoung | the token needs to know that the role assignment came via the token | 21:40 |
| morganfainberg | and make sure another group doesn't impart the same assignment | 21:40 |
| morganfainberg | hmmm. | 21:40 |
| ayoung | morganfainberg, well, that should be an edge case | 21:41 |
| ayoung | strictly speaking you are correct | 21:41 |
| *** vartom1111111117 has joined #openstack-dev | 21:41 | |
| morganfainberg | ayoung, i think it's not as much of an edge case as you think | 21:41 |
| *** RajeshMohan has quit IRC | 21:41 | |
| morganfainberg | group A has read-write to <project>, group B has stats/read to <project> | 21:41 |
| morganfainberg | you remove the group B | 21:41 |
| morganfainberg | all tokens are invalid for users in the overlap? | 21:41 |
| *** cagrev has quit IRC | 21:41 | |
| morganfainberg | or if someone is in a read-write and read-only group overlap | 21:42 |
| morganfainberg | or... readonly domain, read-write project, etc | 21:42 |
| ayoung | the current nasty logic is if I remove group B all tokens for users that were members of group B are revoked | 21:42 |
| ayoung | which is broken in its own right | 21:43 |
| morganfainberg | ayoung, it's admitedly a hammer | 21:43 |
| morganfainberg | sledgehammer that is | 21:43 |
| dstanek | bknudson: does https://review.openstack.org/#/c/60983/ need to be reapproved? | 21:44 |
| bknudson | dstanek: it's not going to merge if it's not approved. | 21:44 |
| morganfainberg | ok, so maybe logic looks like this: we know what roles a group _can_ impart. look at users with those roles. look at the groups for the user, calculate if another group matches that role assignment, and revoke if not? | 21:45 |
| morganfainberg | ayoung, ^ might be overkill still / sloooowww | 21:45 |
| morganfainberg | unless we had a quick-lookup of group -> role assignment | 21:45 |
| *** BLZbubba has joined #openstack-dev | 21:45 | |
| *** colinmcnamara has joined #openstack-dev | 21:45 | |
| *** colinmcn_ has joined #openstack-dev | 21:46 | |
| *** colinmc__ has joined #openstack-dev | 21:46 | |
| *** herndon_ has joined #openstack-dev | 21:46 | |
| *** RajeshMohan has joined #openstack-dev | 21:46 | |
| *** vartom1111111118 has joined #openstack-dev | 21:47 | |
| *** joesavak has quit IRC | 21:47 | |
| dstanek | bknudson: i put in my 2 cents then | 21:47 |
| mutex | /window 6 | 21:47 |
| ayoung | morganfainberg I'll think on this, but I thik the right solution is to add group info to the token, and then to revoke all tokens where that group was used in token creation. Period | 21:48 |
| ayoung | dolphm, read up on my conversation with morganfainberg , if you would, and tell me if you agree with my assessment | 21:49 |
| morganfainberg | ayoung, that is the slightly smaller hammer method, not as surgical as i could argue it should be, but i'm not opposed to it | 21:49 |
| *** vartom1111111119 has joined #openstack-dev | 21:49 | |
| morganfainberg | ayoung, at the very least, it's a good starting spot | 21:49 |
| *** vartom1111111117 has quit IRC | 21:50 | |
| *** vartom1111111118 has quit IRC | 21:52 | |
| *** irenab_ has quit IRC | 21:53 | |
| dolphm | ayoung: morganfainberg: reading back.. | 21:53 |
| *** buzztroll has joined #openstack-dev | 21:53 | |
| *** irenab_ has joined #openstack-dev | 21:53 | |
| dolphm | ayoung: regarding revoke all tokens for a group? | 21:53 |
| ayoung | dolphm, for the revocation events, I think we will want to add the group info into the token | 21:55 |
| ayoung | dolphm, then the logic would be group_delete->revoke all tokens that contain groups[group_id] | 21:57 |
| *** colinmcnamara has quit IRC | 21:59 | |
| *** chrispeters has quit IRC | 21:59 | |
| *** colinmcnamara has joined #openstack-dev | 21:59 | |
| *** Mandell has quit IRC | 22:00 | |
| dolphm | ayoung: morganfainberg: so, i think there's a middleground between overkill and surgical that's maybe been overlooked... | 22:00 |
| *** evgenyf has joined #openstack-dev | 22:00 | |
| * ayoung is hoping for *easy* | 22:00 | |
| *** yeylon_ has quit IRC | 22:01 | |
| *** tqtran1 has joined #openstack-dev | 22:01 | |
| dolphm | ayoung: morganfainberg: groups effectively map users->projects or users->domains; given a set of group assignments + group membership, you can compute a fairly fine-grained list of user+project pairs or user+domain pairs to issue revocation events for | 22:01 |
| *** xmltok_ has quit IRC | 22:01 | |
| dolphm | ayoung: morganfainberg: there would be zero unaffected projects/domains or users | 22:01 |
| dolphm | and you don't have to include group data in the token | 22:02 |
| *** tqtran has quit IRC | 22:02 | |
| ayoung | dolphm, so upon group delete revoke all tokens for affected projects? | 22:02 |
| dolphm | ayoung: user+project pairs, but yes | 22:02 |
| *** jdob has quit IRC | 22:02 | |
| *** colinmc__ has quit IRC | 22:02 | |
| *** colinmcn_ has quit IRC | 22:02 | |
| ayoung | dolphm, not certain we have user+project pairs available | 22:03 |
| ayoung | we don't know the user list | 22:03 |
| ayoung | thinking Federated | 22:03 |
| dolphm | ayoung: this has to be implemented somewhere https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#list-users-who-are-members-of-a-group-get-groupsgroup_idusers | 22:03 |
| *** Longgeek has joined #openstack-dev | 22:04 | |
| *** pcm_ has quit IRC | 22:04 | |
| *** Mandell has joined #openstack-dev | 22:04 | |
| ayoung | dolphm, we can only keep that if we do ephemeral usersid, and then it will only be for users that have logged in to keystone. It would solve the group issue, but at a very high cost | 22:04 |
| ayoung | ephemeral user records are really akin to ephemeral token records | 22:05 |
| ayoung | something I'd like to avoid if possible | 22:05 |
| dolphm | ayoung: ++++++ | 22:05 |
| dolphm | ayoung: didn't consider that | 22:05 |
| dolphm | ayoung: then i vote for adding groups to tokens :-/ | 22:05 |
| dolphm | i think. | 22:05 |
| *** jasondotstar has quit IRC | 22:05 | |
| dolphm | it's messy in that no one else would care, but they are technically user attributes that express authorization... so it's intuitive | 22:06 |
| ayoung | yeah, I think it makes sense. We can let that one bake on the slow cooker for a few days before we choose to consume it | 22:06 |
| ayoung | dolphm, OTOH, maybe we just say "you can't delete a group" | 22:06 |
| dolphm | ayoung: a group with members? | 22:06 |
| ayoung | all you can do is remove the role assignments so they can't be used in the future | 22:06 |
| ayoung | I mean you don't revoke tokens based on group delete | 22:07 |
| morganfainberg | ayoung, we could add a notification callback for that mechanism for the internal IdP | 22:07 |
| *** ekhugen has quit IRC | 22:07 | |
| morganfainberg | if the "Extensions" notification stuff works | 22:07 |
| ayoung | its is unlikely that, in the Federated case, we would ever get a group delete event | 22:07 |
| dolphm | morganfainberg: did that merge? | 22:07 |
| morganfainberg | and assume non-SQL specific identity backends can't do that resolution | 22:07 |
| morganfainberg | dolphm, it was in process | 22:07 |
| morganfainberg | dolphm, let me check | 22:07 |
| ayoung | but the same problem is there, I think for role assignments based on group memebership | 22:07 |
| *** mfer has quit IRC | 22:07 | |
| *** amotoki has quit IRC | 22:07 | |
| ayoung | and that is the one we will see. | 22:07 |
| morganfainberg | looks like it's up for review again | 22:07 |
| morganfainberg | https://review.openstack.org/#/c/57811/ | 22:07 |
| ayoung | Notifications are not the solution | 22:08 |
| *** sushils has joined #openstack-dev | 22:08 | |
| *** Longgeek has quit IRC | 22:08 | |
| morganfainberg | ayoung, i think to start we go w/ apply groups into the tokens | 22:08 |
| ayoung | morganfainberg, MorganStanley is not going to send out a "group deleted" event when their internal LDAP changes | 22:08 |
| ayoung | yeah | 22:08 |
| morganfainberg | ayoung, dolphm, we can refine it more once we play with it. | 22:09 |
| *** buzztroll has quit IRC | 22:09 | |
| morganfainberg | that kind of refinement can come post I-2 if we aren't changing API affecting stuff | 22:09 |
| dolphm | ayoung: i'm always lead back to short-lived tokens as the solution to these issues.. | 22:09 |
| ayoung | morganfainberg, but... we onl;y need that for non-ephemeral tokens | 22:09 |
| ayoung | dolphm, heh | 22:09 |
| ayoung | Jinks! | 22:09 |
| *** buzztroll has joined #openstack-dev | 22:10 | |
| morganfainberg | ayoung, aye, which ... hopefully we get there? | 22:10 |
| morganfainberg | ;) | 22:10 |
| *** rods has quit IRC | 22:10 | |
| morganfainberg | oh, right reminds me i want to propose a patch that reduces default TTL from 86400 (or resurrect that one from havana) to something a bit more sane | 22:10 |
| ayoung | OK...I'll take this as a todo...time to go into Dad mode. | 22:10 |
| *** jobewan has quit IRC | 22:10 | |
| ayoung | morganfainberg, that will break things...we can discuss at the hackfest | 22:10 |
| morganfainberg | ayoung, that was the plan | 22:11 |
| *** lcheng has joined #openstack-dev | 22:11 | |
| *** ayoung is now known as ayoung_dadmode | 22:11 | |
| dolphm | morganfainberg: i proposed an hour a while back | 22:11 |
| morganfainberg | dolphm, that was the one i was referencinfg | 22:12 |
| *** bswartz has quit IRC | 22:12 | |
| *** hartsocks has quit IRC | 22:12 | |
| dolphm | morganfainberg: i think bknudson blocked it? | 22:12 |
| dolphm | maybe we should cut it in half every release :P | 22:12 |
| morganfainberg | dolphm, iirc it was too late to change it | 22:12 |
| bknudson | what did I block? | 22:12 |
| morganfainberg | this time we're pre-I2 so worth considering | 22:13 |
| morganfainberg | might have been ayoung who blocked it | 22:13 |
| dolphm | bknudson: reducing default token lifespan from 24 hours to 1 | 22:13 |
| dolphm | bknudson: i think you had a concern with devstack specifically? | 22:13 |
| bknudson | I don't think I would have a problem with that now. | 22:13 |
| bknudson | if I did before. | 22:13 |
| *** yamahata has quit IRC | 22:13 | |
| *** peristeri has quit IRC | 22:13 | |
| *** corXi has quit IRC | 22:14 | |
| *** buzztroll has quit IRC | 22:14 | |
| *** jtomasek has quit IRC | 22:15 | |
| morganfainberg | dolphm, do you think that 10k tokens active for a given user is a sane amount to set the upper limit at? | 22:15 |
| *** cagrev has joined #openstack-dev | 22:15 | |
| morganfainberg | dolphm, the logic i proposed for havana's memcache backend sets the upper limit around 10k based on bad-back-of-the-napkin math | 22:15 |
| morganfainberg | bknudson, ^ | 22:15 |
| bknudson | I think 2 tokens should be enough. | 22:16 |
| morganfainberg | with default expiry, thats 1 token issued every 10 seconds all day long being the upper limit | 22:16 |
| bknudson | morganfainberg: where do you get 10k from? | 22:16 |
| *** vijendar has quit IRC | 22:16 | |
| morganfainberg | bknudson, 1MB memcache page size, 32 byte token uuid hex, 27 byte iso-timestampe string, overhead for tuple, overhead for list | 22:16 |
| morganfainberg | ~100bytes per token in the index. | 22:17 |
| bknudson | morganfainberg: you can't go over 1 page? | 22:17 |
| morganfainberg | there is also some implicit pickle overhead. | 22:17 |
| morganfainberg | bknudson, no, there is no logic to bridge pages atm | 22:17 |
| bknudson | how about if you add a link from one page to the next page when gets too big/ | 22:17 |
| dstanek | bknudson: not for a single key you can't | 22:17 |
| morganfainberg | bknudson, i was thinkig about that, doing an index page of pages | 22:17 |
| _cjones_ | ayoung, Okay... mysteriously my previous issue went away. (I didn't change anything. I just attempted again) | 22:18 |
| dstanek | morganfainberg: do we have a problem with eviction? | 22:18 |
| morganfainberg | dstanek, no, just if all tokens are active we don't pull them out of the index | 22:18 |
| morganfainberg | e.g. non-expired, non-revoked | 22:18 |
| dstanek | morganfainberg: but memcache can evict data for you | 22:18 |
| morganfainberg | dstanek, that is a separate issue | 22:18 |
| morganfainberg | dstanek, memcache is a poor choice for stable storage of data | 22:19 |
| bknudson | morganfainberg: you'd probably have to ask an operator if there's any problems with limiting # of active tokens to 10k. | 22:19 |
| morganfainberg | but doesn't mean people don't use it for tokens | 22:19 |
| bknudson | or whatever the limit is. | 22:19 |
| dstanek | morganfainberg: that's putting it lightly | 22:19 |
| *** uaberme has quit IRC | 22:19 | |
| morganfainberg | bknudson, i have one operator that doesn't see it as an issue | 22:19 |
| morganfainberg | https://review.openstack.org/#/c/66149/ | 22:19 |
| morganfainberg | it's the same logic as we have coming for icehouse (just not through dogpile) | 22:19 |
| bknudson | morganfainberg: how did they find out? a database query? | 22:19 |
| dstanek | morganfainberg: interesting because even with a ton of memory there will be a limited number of 1M slabs | 22:20 |
| morganfainberg | bknudson, if you can issue tokens, you haven't hit the page limit | 22:20 |
| morganfainberg | bknudson, it's ... an issue i ran across in essex | 22:20 |
| dolphm | bknudson: ... in that case https://review.openstack.org/#/c/66449/ (cc- ayoung_dadmode morganfainberg) | 22:20 |
| morganfainberg | with a customer that had 60k tokens | 22:20 |
| *** loquacities has joined #openstack-dev | 22:20 | |
| dolphm | morganfainberg: 10k seems really high | 22:20 |
| *** mrodden has joined #openstack-dev | 22:21 | |
| morganfainberg | dolphm, it only would affect things like memcache w/ a fixed page size | 22:21 |
| morganfainberg | sql suffers from other issues but not that one | 22:21 |
| morganfainberg | anyways. bbib | 22:21 |
| morganfainberg | meeting time | 22:21 |
| *** csaba|afk is now known as csaba | 22:21 | |
| dolphm | bknudson: 2 is closer in magnitude to my intuition lol | 22:21 |
| *** mikeoutland has joined #openstack-dev | 22:21 | |
| morganfainberg | dolphm, i could see a case of one token per domain, and one per project, and one unscoped | 22:21 |
| morganfainberg | being the absolute upper limit | 22:22 |
| *** loquacities has quit IRC | 22:22 | |
| morganfainberg | assuming domain scoped tokens are kept | 22:22 |
| *** Loquacity has joined #openstack-dev | 22:22 | |
| *** yamahata has joined #openstack-dev | 22:22 | |
| morganfainberg | absolute upper limit = generally "required" tokens | 22:22 |
| *** gongysh has quit IRC | 22:23 | |
| *** doug_shelley66 has quit IRC | 22:23 | |
| bknudson | morganfainberg: I guess I was assuming per auth domain or whatever you would call it... you'd want 2 in the case where 1 was about to expire. | 22:23 |
| *** hartsocks has joined #openstack-dev | 22:23 | |
| *** salv-orlando has joined #openstack-dev | 22:23 | |
| *** buzztroll has joined #openstack-dev | 22:23 | |
| dolphm | morganfainberg: yeah-- so what does that look like as a static number in the default case? | 22:23 |
| dolphm | morganfainberg: ... and what happens when you exceed it? | 22:24 |
| dolphm | 403 on auth? | 22:24 |
| dolphm | :-/ | 22:24 |
| bknudson | what if you have 5000 domains? then you'd need more than 10k tokens. | 22:24 |
| dolphm | bknudson: i'd say you need to manually raise the limit, if we had one | 22:24 |
| dolphm | and you had a legit use case to need tokens for all of them at once | 22:24 |
| bknudson | the limit is imposed by memcache | 22:24 |
| bknudson | morganfainberg: right? | 22:24 |
| *** glenng has quit IRC | 22:25 | |
| _cjones_ | ayoung, It seems to fail for this reason on first attempt of create_user: ERROR policy _parse_check Failed to understand rule admin_on_project_filter | 22:25 |
| mutex | belliott: also, i am running these hooks on the compute node side... are these designed to be run on the controller ? | 22:25 |
| _cjones_ | ayoung, On second attempt, I get this failure: WARNING wsgi __call__ You are not authorized to perform the requested action, identity:create_user. | 22:26 |
| dolphm | bknudson: yes | 22:28 |
| dolphm | bknudson: the final upper limit | 22:28 |
| dolphm | _cjones_: are you specifying a tenant/project id/name on the CLI? | 22:29 |
| *** Loquacity has quit IRC | 22:29 | |
| dolphm | _cjones_: or for whatever token you're generating? | 22:29 |
| *** Loquacity has joined #openstack-dev | 22:29 | |
| *** Loquacity has quit IRC | 22:30 | |
| _cjones_ | ayoung, I'm using json/curl. And no project for token. Just domain. | 22:30 |
| *** Loquacity has joined #openstack-dev | 22:30 | |
| _cjones_ | ayoung, correction. Project & Domain specified in token req. | 22:30 |
| *** Squid56 has left #openstack-dev | 22:31 | |
| *** ArxCruz has joined #openstack-dev | 22:31 | |
| *** morazi has quit IRC | 22:32 | |
| _cjones_ | ayoung, As per your blog entry, I specify "scope": { "project": { "domain": { "name": "foo"}, "name": "demo"}}} | 22:32 |
| _cjones_ | ayoung, and I have created a domain named "foo" and a project named "demo" bound to domain "foo". | 22:33 |
| _cjones_ | ayoung, Must I specify additional "methods" in the token request? Currently I only have "password"? | 22:34 |
| belliott | mutex: the create_instance only fires on the nova-api node :) | 22:36 |
| *** buzztroll has quit IRC | 22:36 | |
| *** salv-orlando_ has joined #openstack-dev | 22:37 | |
| *** dkranz has quit IRC | 22:37 | |
| *** mkollaro has joined #openstack-dev | 22:37 | |
| *** chrispeters has joined #openstack-dev | 22:37 | |
| *** salv-orlando has quit IRC | 22:38 | |
| *** salv-orlando_ is now known as salv-orlando | 22:39 | |
| * mutex scratches his head | 22:39 | |
| mutex | belliott: alright man, I don't know what to tell you the stevedore code doesn't seem to run at all | 22:39 |
| *** jmckind has quit IRC | 22:40 | |
| *** thomasem has quit IRC | 22:41 | |
| belliott | mutex: you can't run the hooks on the compute node side | 22:41 |
| belliott | mutex: or let me rephrase, you can't use the create_instance hook | 22:41 |
| *** sgordon has quit IRC | 22:41 | |
| *** vladikr has quit IRC | 22:42 | |
| *** cagrev has quit IRC | 22:43 | |
| _cjones_ | dolphm, I'll do some more detailed debugging on my end and see if I can't get a better reason for the failure. | 22:45 |
| dolphm | _cjones_: your scope is for a project, not a domain | 22:45 |
| dolphm | _cjones_: if you're trying to consume domain-level role authz, that won't do it | 22:45 |
| *** tqtran has joined #openstack-dev | 22:46 | |
| mutex | belliott: well.... that sounds like my problem then! | 22:46 |
| _cjones_ | dolphm, I thought that would be okay because I was part of both the domain and the porject. | 22:46 |
| *** yamahata has quit IRC | 22:46 | |
| mutex | belliott: do I need to use the extension framework to run something on the compute node ? | 22:46 |
| dolphm | _cjones_: the domain you're providing is only namespacing the project | 22:46 |
| dolphm | _cjones_: "scope": { "domain": { "name": "foo" }}} | 22:46 |
| _cjones_ | dolphm, So the correct syntax should be... exactly.... thanks. | 22:46 |
| belliott | mutex: you can modify the code and add hooks there if you want. otherwise you can only hook the create_instance on your api node(s) | 22:47 |
| _cjones_ | dolphm, I'll give that a whirl. brb. | 22:47 |
| belliott | mutex: it's a 1 liner to add arbitrary hooks wherever you want | 22:47 |
| *** _cjones_ has quit IRC | 22:47 | |
| *** _cjones_ has joined #openstack-dev | 22:48 | |
| mutex | ah, yeah I'll just create one in my hypervisor driver | 22:48 |
| *** jayg is now known as jayg|g0n3 | 22:48 | |
| dolphm | _cjones_: i'm reading the docs to point you to an example... but they fall short of providing an example for domain level scope :( | 22:48 |
| *** vladikr has joined #openstack-dev | 22:48 | |
| *** tqtran1 has quit IRC | 22:49 | |
| *** eharney has quit IRC | 22:51 | |
| *** rwsu has quit IRC | 22:52 | |
| *** bauzas has quit IRC | 22:52 | |
| *** dkuffner has quit IRC | 22:52 | |
| *** safchain has quit IRC | 22:53 | |
| *** salv-orlando has quit IRC | 22:53 | |
| *** mattymo has quit IRC | 22:54 | |
| *** mattymo has joined #openstack-dev | 22:55 | |
| *** doug_shelley66 has joined #openstack-dev | 22:55 | |
| *** Ryan_Lane has quit IRC | 22:55 | |
| *** CaptTofu has quit IRC | 22:56 | |
| *** colinmcnamara has quit IRC | 22:56 | |
| *** jgrimm has quit IRC | 22:56 | |
| dhellmann | mutex: you're having a problem with stevedore? | 22:56 |
| *** mikeoutland has quit IRC | 22:57 | |
| _cjones_ | dolphm, I'd go off on how the docs fall short in many areas, but I need friends here. :P | 22:58 |
| dolphm | _cjones_: no, PLEASE file bugs with criticisms! | 22:59 |
| *** vartom1111111111 has joined #openstack-dev | 22:59 | |
| _cjones_ | dolphm, Already filed one. When I'm done experimenting around, I'll review my notes and file where necessary. Okay? :) | 22:59 |
| *** achampion has quit IRC | 23:00 | |
| *** vartom1111111112 has joined #openstack-dev | 23:00 | |
| _cjones_ | dolphm, Can you point me to the current URL that is lacking. I'll add to my notes and remember to file against. | 23:00 |
| _cjones_ | ? | 23:00 |
| *** kevinconway has quit IRC | 23:00 | |
| *** vartom1111111119 has quit IRC | 23:01 | |
| *** vartom1111111113 has joined #openstack-dev | 23:02 | |
| dolphm | _cjones_: i was looking at this https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md | 23:02 |
| *** dims has quit IRC | 23:03 | |
| dolphm | _cjones_: specifically the section on scope https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#scope-scope | 23:03 |
| *** vartom1111111111 has quit IRC | 23:04 | |
| bknudson | almost all the identity-api-v3.md winds up being duplicated in http://api.openstack.org/api-ref-identity.html | 23:04 |
| *** jecarey_ has quit IRC | 23:04 | |
| *** vartom1111111112 has quit IRC | 23:04 | |
| _cjones_ | dolphm, Thanks. I'll capture that. I see where domain only is misssing. Unfortuantely. That doesn't seem to solve my problem. | 23:05 |
| *** lbragstad has quit IRC | 23:05 | |
| *** dspano has quit IRC | 23:05 | |
| *** burt has quit IRC | 23:05 | |
| *** irenab_ has quit IRC | 23:06 | |
| *** aeperezt has quit IRC | 23:06 | |
| *** radsy has joined #openstack-dev | 23:06 | |
| *** Longgeek has joined #openstack-dev | 23:07 | |
| *** asselin has quit IRC | 23:07 | |
| morganfainberg | ok, reading up now | 23:07 |
| morganfainberg | dolphm, bknudson, the erorr is a 401 if you can't issue more tokens iirc. | 23:08 |
| *** rwsu has joined #openstack-dev | 23:08 | |
| *** kgriffs is now known as kgriffs_afk | 23:08 | |
| *** thuc has quit IRC | 23:08 | |
| bknudson | might be better to pick an old one and revoke it. | 23:08 |
| morganfainberg | dolphm, bknudson, and this limit is an imposed limit by memcache because it can hold X data per key | 23:08 |
| bknudson | 401 is not the correct return code for this situation | 23:08 |
| *** thuc has joined #openstack-dev | 23:08 | |
| morganfainberg | X is configurable bit it's a slab | 23:08 |
| morganfainberg | and so. fixed allocation | 23:08 |
| morganfainberg | bknudson, if we are really concerned about it, i'll write code that does an index page as the user index and overflows as much or as little as needed. | 23:09 |
| *** fbo is now known as fbo_away | 23:09 | |
| morganfainberg | all other options are bad, randomly evicting a non-expired-non-revoked token is really non-deterministic | 23:10 |
| morganfainberg | and we don't track "when was this token last used" (we can't effectively) | 23:10 |
| bknudson | creating a bunch of tokens is also bad. | 23:10 |
| bknudson | we know which is going to expire next | 23:10 |
| morganfainberg | bknudson, it is | 23:10 |
| morganfainberg | but neutron does consume a very high number | 23:11 |
| morganfainberg | bknudson, we do, that data is now in the list. | 23:11 |
| *** thedodd has quit IRC | 23:11 | |
| morganfainberg | bknudson, (with my proposed patch) | 23:11 |
| morganfainberg | bknudson, though what if the next token would expire in 5 hours | 23:11 |
| morganfainberg | and if the next 200 tokens after it expire within minutes of that one | 23:11 |
| morganfainberg | could they still be in use? sure. | 23:11 |
| bknudson | morganfainberg: clients have to be able to handle tokens becoming invalid... it could happen for any number of reasons... change password, etc. | 23:12 |
| morganfainberg | this is absolutely an edge case, but it is real for larger-scale deployments that don't reuse tokens (heck horizon generates a bunch of tokens per click) | 23:12 |
| *** Longgeek has quit IRC | 23:12 | |
| morganfainberg | bknudson, there is another concern... if someone with 10k tokens revokes all of them | 23:12 |
| morganfainberg | ... the revocation list would explode | 23:12 |
| *** thuc has quit IRC | 23:12 | |
| morganfainberg | since it has very similar limitations | 23:13 |
| bknudson | morganfainberg: I thought you were discussing this earlier... | 23:13 |
| bknudson | use notification rather than revocation list | 23:13 |
| morganfainberg | bknudson, revocation events will help with this | 23:13 |
| *** denis_makogon has quit IRC | 23:13 | |
| morganfainberg | but we need to support the old-style list for X release time | 23:13 |
| *** jmckind has joined #openstack-dev | 23:14 | |
| morganfainberg | make it configurable, if it isn't needed, don't track/enumerate it | 23:14 |
| morganfainberg | but we can't make that functionality disappear until... k? | 23:14 |
| *** jmckind has quit IRC | 23:14 | |
| *** jaypipes has joined #openstack-dev | 23:14 | |
| *** nkinder has quit IRC | 23:15 | |
| *** dbalog has left #openstack-dev | 23:16 | |
| *** pmathews1 has quit IRC | 23:17 | |
| *** pmathews has joined #openstack-dev | 23:17 | |
| *** colinmcnamara has joined #openstack-dev | 23:17 | |
| *** dims has joined #openstack-dev | 23:18 | |
| morganfainberg | yeah K i think. | 23:18 |
| *** FunnyLookinHat has quit IRC | 23:19 | |
| *** henrynash has quit IRC | 23:19 | |
| *** buzztroll has joined #openstack-dev | 23:19 | |
| *** prad_ has left #openstack-dev | 23:20 | |
| *** aeperezt has joined #openstack-dev | 23:22 | |
| *** aeperezt has quit IRC | 23:22 | |
| *** aeperezt has joined #openstack-dev | 23:22 | |
| *** Doug2 has quit IRC | 23:22 | |
| *** n0ano has joined #openstack-dev | 23:23 | |
| dolphm | _cjones_: do you have a role assignment on the domain itself? | 23:23 |
| *** flaper87 is now known as flaper87|afk | 23:25 | |
| *** pmathews1 has joined #openstack-dev | 23:25 | |
| *** evgenyf has quit IRC | 23:25 | |
| *** pmathews2 has joined #openstack-dev | 23:26 | |
| gyee_ | dolphm, why not default the token expiration to 10 mins? Why 1 hour? | 23:28 |
| _cjones_ | dolphm, yes. It seems that the authentication is not working with only just the domain in place. | 23:28 |
| dolphm | gyee_: just a first step IMO | 23:28 |
| *** martyntaylor has quit IRC | 23:28 | |
| _cjones_ | dolphm, I'll double check. Maybe I don't have a role assgn. against the domain itself. | 23:28 |
| gyee_ | dolphm, if we reduce it down to say 10 mins, we may not need revocation API at all | 23:28 |
| dolphm | gyee_: an hour seems long enough to not affect *any* long running processes, but short enough to avoid a lot of the problems we see with 24 hours | 23:29 |
| *** julienvey_ has joined #openstack-dev | 23:29 | |
| gyee_ | we'll see, if nobody screams, we'll keep reducing it :D | 23:29 |
| *** pmathews has quit IRC | 23:30 | |
| _cjones_ | dolphm, I assume this is what is to go into the "user_domain_metadata" table? (mine is empty) | 23:30 |
| dolphm | _cjones_: that sounds correct | 23:30 |
| *** pmathews1 has quit IRC | 23:30 | |
| _cjones_ | dolphm, I'll add and retry. Thanks - standby. | 23:31 |
| *** bknudson has quit IRC | 23:31 | |
| *** markmcclain has quit IRC | 23:31 | |
| *** e0ne has quit IRC | 23:31 | |
| *** e0ne_ has joined #openstack-dev | 23:31 | |
| *** vartom1111111113 has quit IRC | 23:31 | |
| *** novas0x2a|laptop has quit IRC | 23:31 | |
| *** neelashah has quit IRC | 23:31 | |
| *** novas0x2a|laptop has joined #openstack-dev | 23:32 | |
| dolphm | gyee_: ++ | 23:32 |
| dolphm | gyee_: i suggested cutting it in half every release earlier :P | 23:32 |
| gyee_ | dolphm, only concern I have is Horizon | 23:33 |
| gyee_ | ppl may see the session expired faster then bank websites | 23:33 |
| dolphm | gyee_: an hour seems reasonable for horizon, no? | 23:33 |
| dolphm | david-lyle: what's a reasonable session length for horizon? | 23:33 |
| gyee_ | dolphm, probably, worth the experiment though | 23:33 |
| *** Ryan_Lane has joined #openstack-dev | 23:33 | |
| dolphm | gyee_: horizon throws away creds post-auth, right? | 23:33 |
| gyee_ | dolphm, not sure, I need to read the code | 23:34 |
| jamielennox | dolphm: did you figure out the management_url problem? I've no idea why horizon should all of a sudden need to mock it | 23:35 |
| *** mfink has quit IRC | 23:35 | |
| _cjones_ | dolphm, That seemed to be the issue. No roles specified against the domain. (le sigh) | 23:35 |
| dolphm | _cjones_: PUT /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} | 23:35 |
| dolphm | jamielennox: i'm not clear on the mocking problem, but david-lyle seemed confident it was a trivial issue with their mocking code | 23:36 |
| _cjones_ | dolphm, Thanks. I manually did that via SQL. | 23:36 |
| dolphm | jamielennox: (i'm not sure why it suddenly needed to be mocked vs v0.4.1) | 23:36 |
| jamielennox | dolphm: ok - it's weird that it should come up now but i don't see a problem with it | 23:36 |
| jamielennox | vs 0.4.1? did we do a release? | 23:37 |
| *** admiyo has joined #openstack-dev | 23:37 | |
| *** admiyo has quit IRC | 23:37 | |
| dolphm | jamielennox: i did 0.4.2 this morning -- it was requested on list | 23:37 |
| jamielennox | dolphm: shit | 23:37 |
| dolphm | jamielennox: https://launchpad.net/python-keystoneclient/+milestone/0.4.2 | 23:37 |
| jamielennox | dolphm: i really wanted https://review.openstack.org/#/c/65015/ | 23:37 |
| dolphm | jamielennox: 0.4.3 end of week? :) | 23:38 |
| dolphm | (reviewing) | 23:38 |
| dolphm | jamielennox: underlying patch needs a reverify | 23:38 |
| jamielennox | dolphm: it's backward incompatible - it had to go in before a release | 23:38 |
| dolphm | jamielennox: ? | 23:38 |
| *** grapsus__ has quit IRC | 23:39 | |
| dolphm | jamielennox: so 0.4.2 is backwards incompatible with 0.4.1? | 23:39 |
| *** rfolco has quit IRC | 23:39 | |
| jamielennox | dolphm: no | 23:39 |
| dolphm | oh i see what you mean .. looking at the patch | 23:39 |
| jamielennox | dolphm: that patch privatized some stuff | 23:39 |
| jamielennox | if it's out in 0.4.2 then we have to keep supporting it :( | 23:40 |
| *** e0ne has joined #openstack-dev | 23:40 | |
| *** carl_baldwin has quit IRC | 23:40 | |
| *** e0ne_ has quit IRC | 23:40 | |
| jamielennox | hmm, can't use reverify no bug any more - i just thought they weren't getting picked up | 23:41 |
| jamielennox | a jenkins comment that it's not suppoted any more would be useful there | 23:41 |
| *** galstrom is now known as galstrom_zzz | 23:41 | |
| *** sweston has joined #openstack-dev | 23:42 | |
| *** rcj has quit IRC | 23:42 | |
| *** mfink has joined #openstack-dev | 23:42 | |
| *** buzztroll has quit IRC | 23:43 | |
| jamielennox | dolphm: so i had talked to ayoung a while ago regarding how to deal with multiple versions and having each service do it's own discovery. That's annoying when we are trying to centralize stuff to a session. I was going to change discovery around so that it was no longer a keystone specific version discovery and try to support all the project discovery formats | 23:43 |
| *** rnirmal has quit IRC | 23:43 | |
| *** buzztroll has joined #openstack-dev | 23:43 | |
| _cjones_ | dolphm: Okay. Now that I think I have all the auth/create working across domains. How do I specify a "list" on a specific domain. This isn't really documented either. I know this is a get, but I can't just do a get on /projects for example. What json structure do I need to pass to indicate my domain? | 23:43 |
| dolphm | jamielennox: that last bit sounds ambitious for keystone alone | 23:43 |
| *** mrda has joined #openstack-dev | 23:44 | |
| *** rcleere has quit IRC | 23:44 | |
| *** bswartz has joined #openstack-dev | 23:44 | |
| *** CaptTofu has joined #openstack-dev | 23:44 | |
| jamielennox | I don't know exactly how that will change the public functions in discovery so as no one else will be using it anyway i just wanted to remove the public part until it got worked out | 23:44 |
| dolphm | jamielennox: i should have pinged you before making a release, but i wanted to get it out as early in the week as possible :-/ | 23:44 |
| jamielennox | dolphm: i don't think it would be that hard as there are a couple of basic formats and most of them are fairly distinguishable | 23:45 |
| jamielennox | eg nova and keystone differ mainly by just having a 'values' root element | 23:45 |
| jamielennox | and i think (and the little i've checked) that would cover most projects | 23:45 |
| jamielennox | the jsonhome stuff is then also sufficiently different that it's just a matter of looking for the right keys | 23:45 |
| *** AlanClark has quit IRC | 23:46 | |
| jamielennox | dolphm: the eventual thought is that you would just have any client ask session if there is an available endpoint for it | 23:46 |
| dolphm | jamielennox: we support with and without values i believe | 23:46 |
| dolphm | jamielennox: i proposed a refactor around that yesterday i think | 23:47 |
| jamielennox | so ask session.endpoint_available(service='identity', version='v3') | 23:47 |
| *** buzztroll has quit IRC | 23:47 | |
| jamielennox | which because they will be using service and version for sending requests can easily be novaclient.v3.Client.supported(session) | 23:47 |
| *** colinmcnamara has quit IRC | 23:47 | |
| jamielennox | it means that regardless of what we decided to do about migrating versions we can handle it all from the one place in a keystone authplugin and the session | 23:48 |
| dolphm | jamielennox: version=3 :P | 23:48 |
| jamielennox | dolphm: i think (3, 0) is what i actually document | 23:49 |
| dolphm | jamielennox: regarding the privatized methods... revise that patch to support the "deprecated" methods as proxies for a bit? | 23:49 |
| dolphm | and get that out ASAP | 23:49 |
| dolphm | jamielennox: tuple sounds even better | 23:49 |
| *** melwitt has quit IRC | 23:49 | |
| jamielennox | dolphm: most of it is not that much of a problem to support long term - it's just changing the usage around a bit | 23:50 |
| *** rrader has joined #openstack-dev | 23:51 | |
| jamielennox | dolphm: i was hoping to discuss this change to service_catalog and discovery at summit f they'll send me this time | 23:51 |
| *** herndon_ has quit IRC | 23:51 | |
| *** asselin has joined #openstack-dev | 23:51 | |
| *** jmontemayor has quit IRC | 23:51 | |
| jamielennox | ayoung_dadmode: *cough* | 23:52 |
| jamielennox | dolphm: because we need a proper solution to juggling mutliple version APIs | 23:52 |
| *** rrader has quit IRC | 23:53 | |
| *** rrader has joined #openstack-dev | 23:54 | |
| *** lexano has joined #openstack-dev | 23:54 | |
| *** mrodden has quit IRC | 23:56 | |
| *** rrader is now known as rrader_ | 23:56 | |
| *** romcheg has quit IRC | 23:56 | |
| dolphm | jamielennox: *they* better! | 23:57 |
| *** harlowja has quit IRC | 23:57 | |
| *** Loquacity is now known as loquacity | 23:57 | |
| jamielennox | dolphm: crap - that change i just reverified had API changes as well | 23:58 |
| *** loq_mac has joined #openstack-dev | 23:58 | |
| dolphm | jamielennox: ? | 23:58 |
| _cjones_ | dolphm, forgot that domain was a property of each user. I'm good to go. I think I know where documentation is lacking. Likely two bug reports which I will post missing pieces to as well as proposed changes based on my experience. | 23:58 |
| jamielennox | dolphm: https://review.openstack.org/#/c/61247/5 | 23:58 |
| jamielennox | the dependant one | 23:58 |
| dolphm | jamielennox: if you -2 it won't merge | 23:58 |
| *** loquacity has quit IRC | 23:58 | |
| *** rrader_ is now known as rrader | 23:58 | |
| dolphm | _cjones_: the domain_id user attribute doesn't affect authorization though (?) | 23:59 |
| jamielennox | well i know what i'm doing today :) | 23:59 |
| dolphm | _cjones_: how does that impact your use case? | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!