| *** devoid has joined #openstack-dev | 00:00 | |
| *** bknudson has joined #openstack-dev | 00:02 | |
| *** joesavak has joined #openstack-dev | 00:02 | |
| *** atiwari has quit IRC | 00:03 | |
| *** jsavak has joined #openstack-dev | 00:03 | |
| *** yamahata has quit IRC | 00:04 | |
| *** joesavak has quit IRC | 00:07 | |
| *** tjones has joined #openstack-dev | 00:08 | |
| *** ihrachyshka has quit IRC | 00:08 | |
| *** tjones has quit IRC | 00:09 | |
| *** praneshp has quit IRC | 00:11 | |
| *** jsavak has quit IRC | 00:17 | |
| *** buzztroll has quit IRC | 00:19 | |
| *** bauzas has quit IRC | 00:22 | |
| *** sarob has joined #openstack-dev | 00:24 | |
| *** tjones has joined #openstack-dev | 00:25 | |
| *** CaptTofu has joined #openstack-dev | 00:26 | |
| *** mikeoutland has joined #openstack-dev | 00:26 | |
| *** sarob has quit IRC | 00:28 | |
| *** mikeoutland has quit IRC | 00:33 | |
| *** alex_xu has quit IRC | 00:35 | |
| *** markmcclain has joined #openstack-dev | 00:38 | |
| *** markmcclain has quit IRC | 00:43 | |
| *** tjones has quit IRC | 00:43 | |
| *** tjones has joined #openstack-dev | 00:44 | |
| *** buzztroll has joined #openstack-dev | 00:50 | |
| *** gokrokve has joined #openstack-dev | 00:50 | |
| *** yamahata has joined #openstack-dev | 00:54 | |
| *** buzztroll has quit IRC | 00:54 | |
| *** yongli has joined #openstack-dev | 00:57 | |
| *** tjones has quit IRC | 00:58 | |
| *** buzztroll has joined #openstack-dev | 00:59 | |
| *** mwagner_lap has joined #openstack-dev | 00:59 | |
| *** sungju has quit IRC | 01:02 | |
| *** noslzzp has quit IRC | 01:02 | |
| *** nosnos has joined #openstack-dev | 01:12 | |
| *** Chaser has joined #openstack-dev | 01:15 | |
| *** e0ne has quit IRC | 01:17 | |
| *** buzztroll has quit IRC | 01:19 | |
| *** dims has joined #openstack-dev | 01:21 | |
| *** nosnos_ has joined #openstack-dev | 01:21 | |
| *** nosnos_ has quit IRC | 01:21 | |
| *** nosnos has quit IRC | 01:22 | |
| *** nosnos_ has joined #openstack-dev | 01:22 | |
| *** noslzzp has joined #openstack-dev | 01:23 | |
| *** CaptTofu has quit IRC | 01:24 | |
| *** dkehn__ has quit IRC | 01:24 | |
| *** locke105 has quit IRC | 01:24 | |
| *** sarob has joined #openstack-dev | 01:25 | |
| *** dkehn__ has joined #openstack-dev | 01:25 | |
| *** locke105 has joined #openstack-dev | 01:25 | |
| *** jasondotstar has joined #openstack-dev | 01:26 | |
| *** ytwu has quit IRC | 01:27 | |
| *** Chaser has quit IRC | 01:29 | |
| *** ytwu has joined #openstack-dev | 01:29 | |
| *** CaptTofu has joined #openstack-dev | 01:30 | |
| *** sarob has quit IRC | 01:30 | |
| *** xingchao has joined #openstack-dev | 01:31 | |
| *** yamahata has quit IRC | 01:33 | |
| *** ijw has quit IRC | 01:33 | |
| *** tserong has joined #openstack-dev | 01:33 | |
| *** Tross1 has quit IRC | 01:40 | |
| *** derekh has quit IRC | 01:41 | |
| *** yamahata has joined #openstack-dev | 01:48 | |
| *** Tross has joined #openstack-dev | 01:51 | |
| *** RajeshMohan has quit IRC | 01:51 | |
| *** kushal has joined #openstack-dev | 01:52 | |
| *** RajeshMohan has joined #openstack-dev | 01:53 | |
| *** dsirrine has joined #openstack-dev | 01:53 | |
| *** buzztroll has joined #openstack-dev | 01:53 | |
| *** yamahata has quit IRC | 01:53 | |
| *** morganfainberg_Z is now known as morganfainberg | 01:56 | |
| morganfainberg | flaper87|afk, you're afk | 01:56 |
|---|---|---|
| morganfainberg | flaper87|afk, when you see this, i need to know why you're aiming to make openstack.common.cache not hard-require oslo.config (or other oslo-isms) | 01:57 |
| morganfainberg | flaper87|afk, because ideally, I'd like to fall back onto some oslo-isms for convienence | 01:57 |
| *** buzztroll has quit IRC | 01:57 | |
| morganfainberg | flaper87|afk, but if there is a good reason not to, i can work around it. | 01:58 |
| *** yaguang has joined #openstack-dev | 02:02 | |
| *** dbalog has left #openstack-dev | 02:08 | |
| *** networkstatic has joined #openstack-dev | 02:08 | |
| *** e0ne has joined #openstack-dev | 02:10 | |
| *** dsirrine has quit IRC | 02:14 | |
| *** unicell1 is now known as unicell | 02:20 | |
| *** unicell has joined #openstack-dev | 02:20 | |
| *** tsekiyama has joined #openstack-dev | 02:20 | |
| *** qiuyu has left #openstack-dev | 02:26 | |
| *** BStokes has quit IRC | 02:28 | |
| *** erkules_ has joined #openstack-dev | 02:28 | |
| *** sarob has joined #openstack-dev | 02:28 | |
| *** BStokes has joined #openstack-dev | 02:28 | |
| *** erkules has quit IRC | 02:31 | |
| *** yongli has quit IRC | 02:31 | |
| *** sarob has quit IRC | 02:32 | |
| *** CaptTofu has quit IRC | 02:32 | |
| *** kushal has quit IRC | 02:33 | |
| *** yamahata has joined #openstack-dev | 02:36 | |
| *** MaxV has joined #openstack-dev | 02:37 | |
| *** MaxV has quit IRC | 02:42 | |
| *** dkehn__ is now known as dkehn_ | 02:45 | |
| *** iamben_tw has quit IRC | 02:49 | |
| *** iamben_tw has joined #openstack-dev | 02:50 | |
| *** buzztroll has joined #openstack-dev | 02:53 | |
| *** buzztroll has quit IRC | 02:58 | |
| *** dstanek has joined #openstack-dev | 02:59 | |
| *** ijw has joined #openstack-dev | 03:00 | |
| *** Tross has quit IRC | 03:01 | |
| *** tdruiva has joined #openstack-dev | 03:04 | |
| *** mikeoutland has joined #openstack-dev | 03:12 | |
| *** mikeoutl_ has joined #openstack-dev | 03:18 | |
| *** edmund1 has joined #openstack-dev | 03:18 | |
| *** morganfainberg is now known as morganfainberg_Z | 03:19 | |
| *** mikeoutland has quit IRC | 03:20 | |
| *** edmund has quit IRC | 03:20 | |
| *** benonsoftware has quit IRC | 03:20 | |
| *** morganfainberg_Z is now known as morganfainberg | 03:20 | |
| *** buzztroll has joined #openstack-dev | 03:23 | |
| *** benonsoftware has joined #openstack-dev | 03:23 | |
| *** buzztroll has quit IRC | 03:23 | |
| *** buzztrol_ has joined #openstack-dev | 03:23 | |
| *** dkranz has quit IRC | 03:25 | |
| *** Chaser has joined #openstack-dev | 03:25 | |
| *** buzztrol_ has quit IRC | 03:28 | |
| *** sarob has joined #openstack-dev | 03:28 | |
| *** bearhands is now known as comstud | 03:29 | |
| *** harlowja is now known as harlowja_away | 03:30 | |
| *** paragan has joined #openstack-dev | 03:31 | |
| *** markmcclain has joined #openstack-dev | 03:31 | |
| *** buzztroll has joined #openstack-dev | 03:34 | |
| *** sarob has quit IRC | 03:34 | |
| *** buzztroll has quit IRC | 03:35 | |
| *** kushal has joined #openstack-dev | 03:36 | |
| *** dsirrine has joined #openstack-dev | 03:37 | |
| *** sarob has joined #openstack-dev | 03:38 | |
| *** e0ne has quit IRC | 03:42 | |
| *** sarob has quit IRC | 03:43 | |
| *** irenab has joined #openstack-dev | 03:46 | |
| *** pradeep has joined #openstack-dev | 03:47 | |
| *** doug_shelley66 has quit IRC | 03:49 | |
| *** Tross has joined #openstack-dev | 03:50 | |
| *** dsirrine has quit IRC | 03:57 | |
| *** mikeoutl_ has quit IRC | 04:03 | |
| *** stevemar has joined #openstack-dev | 04:05 | |
| *** angdraug has joined #openstack-dev | 04:06 | |
| *** baoli has quit IRC | 04:06 | |
| *** mriedem has joined #openstack-dev | 04:10 | |
| *** e0ne has joined #openstack-dev | 04:10 | |
| *** Tross has quit IRC | 04:14 | |
| *** mikeoutland has joined #openstack-dev | 04:20 | |
| *** Tross has joined #openstack-dev | 04:20 | |
| *** jasondotstar has quit IRC | 04:21 | |
| *** aditirav has joined #openstack-dev | 04:25 | |
| *** stevemar has quit IRC | 04:25 | |
| *** tjones has joined #openstack-dev | 04:25 | |
| *** gongysh has joined #openstack-dev | 04:25 | |
| *** sarob has joined #openstack-dev | 04:32 | |
| *** CaptTofu has joined #openstack-dev | 04:33 | |
| *** tjones has quit IRC | 04:35 | |
| *** sarob has quit IRC | 04:36 | |
| *** CaptTofu has quit IRC | 04:38 | |
| *** irenab has quit IRC | 04:38 | |
| *** tsekiyama has quit IRC | 04:38 | |
| *** MaxV has joined #openstack-dev | 04:39 | |
| *** aditirav has quit IRC | 04:41 | |
| *** aditirav has joined #openstack-dev | 04:42 | |
| *** MaxV has quit IRC | 04:44 | |
| *** stevemar has joined #openstack-dev | 04:45 | |
| stevemar | morganfainberg, now you're the one lurking | 04:46 |
| *** buzztroll has joined #openstack-dev | 04:46 | |
| morganfainberg | stevemar, lies. | 04:46 |
| morganfainberg | stevemar, i am actually writing code. about to post WIP for cache in oslo-incubator | 04:46 |
| *** alex_xu has joined #openstack-dev | 04:47 | |
| stevemar | morganfainberg, i guess they have a later code cut off date? | 04:48 |
| morganfainberg | stevemar, oslo-incubator? | 04:48 |
| morganfainberg | stevemar, no real cut-off | 04:48 |
| morganfainberg | stevemar, it's on the projects to sync | 04:48 |
| stevemar | morganfainberg, good point | 04:48 |
| morganfainberg | stevemar, but i am trying to merge KVS in keystone w/ caching | 04:48 |
| stevemar | morganfainberg, so, this means you are all done your keystone stuff :) | 04:49 |
| morganfainberg | stevemar, nah, still have 1 BP i need to start | 04:49 |
| morganfainberg | stevemar, i'll start that tomorrow | 04:49 |
| *** dencaval has quit IRC | 04:49 | |
| morganfainberg | stevemar, ephemeral keys. | 04:49 |
| morganfainberg | erm tokens | 04:49 |
| stevemar | morganfainberg, 5 days or so, no biggie | 04:49 |
| morganfainberg | nah | 04:49 |
| *** aditirav_ has joined #openstack-dev | 04:49 | |
| morganfainberg | stevemar, i also have a load of things pending anyway :( | 04:49 |
| morganfainberg | and i need to get on reviews | 04:49 |
| morganfainberg | stevemar, plus i also have CMS work to do for my company :P | 04:50 |
| morganfainberg | stevemar, **eek* | 04:50 |
| *** buzztroll has quit IRC | 04:50 | |
| morganfainberg | stevemar, but i actually need at least a WIP of this posted because it's going to be a big changeset. | 04:50 |
| *** jvrbanac has quit IRC | 04:51 | |
| morganfainberg | stevemar, and i figure there will be a lot of back-and-forth on it | 04:51 |
| *** aditirav has quit IRC | 04:52 | |
| *** aditirav_ is now known as aditirav | 04:52 | |
| *** jasondotstar has joined #openstack-dev | 04:53 | |
| *** sushils has quit IRC | 04:54 | |
| *** buzztroll has joined #openstack-dev | 05:05 | |
| *** buzztroll has quit IRC | 05:08 | |
| *** sumanthns has joined #openstack-dev | 05:13 | |
| *** jvrbanac has joined #openstack-dev | 05:14 | |
| *** buzztroll has joined #openstack-dev | 05:15 | |
| *** buzztroll has quit IRC | 05:15 | |
| *** chandankumar_ has joined #openstack-dev | 05:17 | |
| *** stevemar has quit IRC | 05:19 | |
| *** david_lyle_ has joined #openstack-dev | 05:20 | |
| *** irenab has joined #openstack-dev | 05:20 | |
| *** david_lyle_ is now known as david_lyle | 05:22 | |
| *** devoid has quit IRC | 05:22 | |
| *** david-lyle has quit IRC | 05:23 | |
| *** e0ne has quit IRC | 05:24 | |
| *** kushal has quit IRC | 05:24 | |
| *** buzztroll has joined #openstack-dev | 05:28 | |
| *** fc__ has quit IRC | 05:29 | |
| *** tjones has joined #openstack-dev | 05:30 | |
| *** tjones has quit IRC | 05:30 | |
| *** sarob has joined #openstack-dev | 05:32 | |
| *** nshaikh has joined #openstack-dev | 05:34 | |
| *** YorikSar has quit IRC | 05:34 | |
| *** kushal has joined #openstack-dev | 05:36 | |
| *** coolsvap has joined #openstack-dev | 05:38 | |
| *** sarob has quit IRC | 05:39 | |
| *** mriedem has quit IRC | 05:42 | |
| *** sarob has joined #openstack-dev | 05:42 | |
| *** markwash has joined #openstack-dev | 05:44 | |
| *** mriedem has joined #openstack-dev | 05:45 | |
| *** mriedem has quit IRC | 05:47 | |
| *** AMike has joined #openstack-dev | 05:47 | |
| *** AMike has quit IRC | 05:47 | |
| *** AMike has joined #openstack-dev | 05:47 | |
| *** sarob has quit IRC | 05:47 | |
| *** markwash has quit IRC | 05:48 | |
| *** markwash has joined #openstack-dev | 05:49 | |
| *** tsekiyama has joined #openstack-dev | 05:49 | |
| *** tsekiyama has quit IRC | 05:50 | |
| *** rdas has joined #openstack-dev | 05:51 | |
| *** mohits has joined #openstack-dev | 05:52 | |
| *** mikeoutland has quit IRC | 05:55 | |
| *** nosnos has joined #openstack-dev | 05:56 | |
| *** e0ne has joined #openstack-dev | 05:56 | |
| *** noslzzp has quit IRC | 05:56 | |
| *** nosnos has quit IRC | 05:57 | |
| *** nosnos has joined #openstack-dev | 05:58 | |
| *** nosnos has quit IRC | 05:58 | |
| *** boris-42_ has quit IRC | 05:58 | |
| *** nosnos has joined #openstack-dev | 05:59 | |
| *** Ryan_Lane has quit IRC | 05:59 | |
| *** nosnos_ has quit IRC | 05:59 | |
| *** e0ne has quit IRC | 06:00 | |
| *** mikeoutland has joined #openstack-dev | 06:02 | |
| *** jasondotstar has quit IRC | 06:02 | |
| *** david_lyle_ has joined #openstack-dev | 06:04 | |
| *** amotoki has joined #openstack-dev | 06:05 | |
| *** david_lyle has quit IRC | 06:05 | |
| *** mikeoutland has quit IRC | 06:06 | |
| *** Ryan_Lane has joined #openstack-dev | 06:09 | |
| *** markmcclain has quit IRC | 06:13 | |
| *** kiwnix has joined #openstack-dev | 06:16 | |
| *** xazel has quit IRC | 06:16 | |
| *** markmcclain has joined #openstack-dev | 06:16 | |
| *** markmcclain1 has joined #openstack-dev | 06:18 | |
| *** doug_shelley66 has joined #openstack-dev | 06:18 | |
| *** rohitk has joined #openstack-dev | 06:20 | |
| *** markmcclain has quit IRC | 06:21 | |
| *** buzztroll has quit IRC | 06:28 | |
| *** avishay has joined #openstack-dev | 06:30 | |
| *** buzztroll has joined #openstack-dev | 06:34 | |
| *** CaptTofu has joined #openstack-dev | 06:34 | |
| *** sarob has joined #openstack-dev | 06:36 | |
| *** tkammer has joined #openstack-dev | 06:38 | |
| *** CaptTofu has quit IRC | 06:39 | |
| *** sarob has quit IRC | 06:40 | |
| *** MaxV has joined #openstack-dev | 06:41 | |
| *** markmcclain1 has quit IRC | 06:42 | |
| *** kiwnix has quit IRC | 06:43 | |
| *** MaxV has quit IRC | 06:45 | |
| *** zoresvit has quit IRC | 06:46 | |
| *** nosnos has quit IRC | 06:47 | |
| *** ihrachyshka has joined #openstack-dev | 06:47 | |
| *** nosnos_ has joined #openstack-dev | 06:48 | |
| *** zoresvit has joined #openstack-dev | 06:48 | |
| *** NikitaKonovalov_ is now known as NikitaKonovalov | 06:52 | |
| *** saju_m has joined #openstack-dev | 06:53 | |
| *** NikitaKonovalov is now known as NikitaKonovalov_ | 06:55 | |
| *** YorikSar has joined #openstack-dev | 06:58 | |
| *** saju_m has quit IRC | 07:00 | |
| *** YorikSar has quit IRC | 07:00 | |
| *** david_lyle_ has quit IRC | 07:02 | |
| *** YorikSar has joined #openstack-dev | 07:02 | |
| *** killer_prince has quit IRC | 07:03 | |
| *** chandankumar_ has quit IRC | 07:07 | |
| *** chandan_kumar has joined #openstack-dev | 07:07 | |
| jamielennox | who would be the best person to find to talk to about pecan problems? | 07:08 |
| *** uaberme has joined #openstack-dev | 07:08 | |
| *** Nikolay_St has joined #openstack-dev | 07:09 | |
| *** rohitk has quit IRC | 07:10 | |
| *** david-lyle has joined #openstack-dev | 07:12 | |
| *** praneshp has joined #openstack-dev | 07:13 | |
| *** igor has joined #openstack-dev | 07:16 | |
| *** saju_m has joined #openstack-dev | 07:17 | |
| *** dims has quit IRC | 07:18 | |
| *** dims has joined #openstack-dev | 07:19 | |
| *** igor has quit IRC | 07:20 | |
| *** igor has joined #openstack-dev | 07:21 | |
| *** ijw has quit IRC | 07:21 | |
| *** halfie has quit IRC | 07:26 | |
| *** retr0h has quit IRC | 07:26 | |
| *** rohitk has joined #openstack-dev | 07:27 | |
| *** halfie has joined #openstack-dev | 07:27 | |
| *** retr0h has joined #openstack-dev | 07:27 | |
| *** yolanda has joined #openstack-dev | 07:30 | |
| *** xqueralt has joined #openstack-dev | 07:31 | |
| *** tkammer has quit IRC | 07:32 | |
| *** belmoreira has joined #openstack-dev | 07:34 | |
| *** sarob has joined #openstack-dev | 07:36 | |
| *** buzztroll has quit IRC | 07:39 | |
| *** halfie has quit IRC | 07:42 | |
| *** jprovazn has joined #openstack-dev | 07:42 | |
| *** ppetit has joined #openstack-dev | 07:43 | |
| *** vartom1111111118 has joined #openstack-dev | 07:43 | |
| *** sarob has quit IRC | 07:43 | |
| *** MaxV has joined #openstack-dev | 07:44 | |
| *** halfie has joined #openstack-dev | 07:44 | |
| *** ifarkas has joined #openstack-dev | 07:44 | |
| *** praneshp has quit IRC | 07:45 | |
| *** ihrachyshka has quit IRC | 07:46 | |
| *** sarob has joined #openstack-dev | 07:46 | |
| *** mflobo has joined #openstack-dev | 07:46 | |
| *** HenryG has quit IRC | 07:47 | |
| *** sushil_ has joined #openstack-dev | 07:47 | |
| *** ihrachyshka has joined #openstack-dev | 07:47 | |
| *** tkammer has joined #openstack-dev | 07:47 | |
| *** HenryG has joined #openstack-dev | 07:48 | |
| *** gokrokve has quit IRC | 07:48 | |
| *** MaxV has quit IRC | 07:48 | |
| *** sarob has quit IRC | 07:51 | |
| *** ihrachyshka has quit IRC | 07:51 | |
| *** I159 has joined #openstack-dev | 07:52 | |
| *** xga has joined #openstack-dev | 07:52 | |
| *** nelsnelson has quit IRC | 07:55 | |
| *** nelsnelson has joined #openstack-dev | 07:55 | |
| *** sweston_ has joined #openstack-dev | 07:57 | |
| *** boris-42_ has joined #openstack-dev | 07:57 | |
| *** corXi has joined #openstack-dev | 07:57 | |
| *** Drankis has joined #openstack-dev | 07:58 | |
| *** evgenyf has joined #openstack-dev | 07:58 | |
| *** sweston has quit IRC | 07:58 | |
| *** cnesa has quit IRC | 07:59 | |
| *** salv-orlando has joined #openstack-dev | 07:59 | |
| *** markwash has quit IRC | 07:59 | |
| *** ijw has joined #openstack-dev | 08:00 | |
| *** giulivo has joined #openstack-dev | 08:00 | |
| *** nosnos_ has quit IRC | 08:02 | |
| *** nosnos has joined #openstack-dev | 08:02 | |
| *** ekarlso has quit IRC | 08:04 | |
| *** lsmola has joined #openstack-dev | 08:05 | |
| *** ekarlso has joined #openstack-dev | 08:05 | |
| *** bauzas has joined #openstack-dev | 08:08 | |
| *** ekarlso has quit IRC | 08:12 | |
| *** coolsvap1 has joined #openstack-dev | 08:13 | |
| *** sushils_ has joined #openstack-dev | 08:13 | |
| *** ekarlso has joined #openstack-dev | 08:13 | |
| *** pasquier-s has joined #openstack-dev | 08:14 | |
| *** NikitaKonovalov_ is now known as NikitaKonovalov | 08:16 | |
| *** thouveng has joined #openstack-dev | 08:16 | |
| *** coolsvap has quit IRC | 08:17 | |
| *** sushil_ has quit IRC | 08:17 | |
| *** jcoufal has joined #openstack-dev | 08:18 | |
| *** gokrokve has joined #openstack-dev | 08:18 | |
| *** e0ne has joined #openstack-dev | 08:19 | |
| *** MaxV has joined #openstack-dev | 08:20 | |
| *** MaxV has quit IRC | 08:20 | |
| *** marekd|away is now known as marekd | 08:20 | |
| *** yeylon__ has joined #openstack-dev | 08:20 | |
| *** gokrokve_ has joined #openstack-dev | 08:20 | |
| *** pleia2 has quit IRC | 08:21 | |
| *** rmk has quit IRC | 08:21 | |
| *** morganfainberg has quit IRC | 08:22 | |
| *** d0ugal has joined #openstack-dev | 08:22 | |
| *** d0ugal has quit IRC | 08:22 | |
| *** d0ugal has joined #openstack-dev | 08:22 | |
| *** romcheg1 has joined #openstack-dev | 08:22 | |
| *** MaxV has joined #openstack-dev | 08:22 | |
| *** rmk has joined #openstack-dev | 08:23 | |
| *** rmk has quit IRC | 08:23 | |
| *** rmk has joined #openstack-dev | 08:23 | |
| *** pleia2 has joined #openstack-dev | 08:23 | |
| *** morganfainberg has joined #openstack-dev | 08:23 | |
| *** gokrokve has quit IRC | 08:23 | |
| *** ihrachyshka has joined #openstack-dev | 08:25 | |
| *** cnesa has joined #openstack-dev | 08:25 | |
| *** gokrokve_ has quit IRC | 08:26 | |
| *** iartarisi has joined #openstack-dev | 08:27 | |
| *** e0ne has quit IRC | 08:28 | |
| *** zyluo has joined #openstack-dev | 08:30 | |
| *** Ryan_Lane has quit IRC | 08:30 | |
| *** nmagnezi has joined #openstack-dev | 08:31 | |
| *** dtantsur has joined #openstack-dev | 08:31 | |
| *** coolsvap1 has quit IRC | 08:33 | |
| *** CaptTofu has joined #openstack-dev | 08:35 | |
| *** CaptTofu has quit IRC | 08:39 | |
| *** jgallard has joined #openstack-dev | 08:41 | |
| *** sahid has joined #openstack-dev | 08:42 | |
| *** zyluo has quit IRC | 08:43 | |
| *** zoresvit has quit IRC | 08:45 | |
| *** dshulyak has joined #openstack-dev | 08:48 | |
| *** flaper87|afk is now known as flaper87 | 08:49 | |
| *** jistr has joined #openstack-dev | 08:49 | |
| flaper87 | morganfainberg: ping | 08:49 |
| flaper87 | morganfainberg: you around ? | 08:49 |
| morganfainberg | flaper87, was just about to go to bed | 08:50 |
| morganfainberg | it's late | 08:50 |
| *** buzztroll has joined #openstack-dev | 08:50 | |
| flaper87 | morganfainberg: ttyl, sleep well | 08:50 |
| morganfainberg | flaper87, first pass https://review.openstack.org/#/c/72291/ | 08:50 |
| *** ygbo has joined #openstack-dev | 08:50 | |
| *** feleouet has joined #openstack-dev | 08:50 | |
| morganfainberg | flaper87, please take a look at it | 08:50 |
| morganfainberg | i know it'll fail pep8, have a typo (too few lines between function defs) | 08:50 |
| morganfainberg | but, it is a start and more in line with what keystone already has implemented | 08:51 |
| *** ijw has quit IRC | 08:51 | |
| morganfainberg | i also included the start for @memoize decorator | 08:51 |
| morganfainberg | flaper87, ^ | 08:51 |
| morganfainberg | flaper87, i look forward to comments/collaboration. and for information on the current dogpile backends: http://dogpilecache.readthedocs.org/en/latest/ | 08:52 |
| flaper87 | morganfainberg: ok, will do! Can't promisse I'll have a whole lot of time today but I'll try | 08:52 |
| morganfainberg | flaper87, i have a ton of otherthigns to work on, but i figured it was important to get something up to have you, dims, and anyone else look at | 08:53 |
| morganfainberg | flaper87, that was interested in a key-value-store / memoization system | 08:53 |
| flaper87 | morganfainberg: +1 thanks for working on that! | 08:53 |
| morganfainberg | flaper87, also, i will provide a couple example backends before it goes "live" (the in-memory one that comes with dogpile has some... *ahem* limitations, that make it less functional than it should be for even a "test" backend) | 08:54 |
| *** buzztroll has quit IRC | 08:54 | |
| morganfainberg | anyways... cheers:) have a good day | 08:54 |
| *** aditirav has quit IRC | 08:54 | |
| *** aditirav has joined #openstack-dev | 08:55 | |
| *** matrohon has joined #openstack-dev | 08:58 | |
| *** AnilV4 has joined #openstack-dev | 09:00 | |
| *** avishayb has joined #openstack-dev | 09:00 | |
| *** safchain has joined #openstack-dev | 09:00 | |
| *** fc__ has joined #openstack-dev | 09:01 | |
| *** tkammer has quit IRC | 09:02 | |
| *** yolanda has quit IRC | 09:04 | |
| *** jpich has joined #openstack-dev | 09:04 | |
| *** yolanda has joined #openstack-dev | 09:05 | |
| *** yolanda has quit IRC | 09:06 | |
| *** vartom1111111119 has joined #openstack-dev | 09:06 | |
| *** vartom1111111118 has quit IRC | 09:07 | |
| *** e0ne has joined #openstack-dev | 09:07 | |
| *** pradeep has quit IRC | 09:07 | |
| *** yolanda has joined #openstack-dev | 09:07 | |
| *** pradeep has joined #openstack-dev | 09:08 | |
| *** yolanda has quit IRC | 09:08 | |
| *** coolsvap has joined #openstack-dev | 09:08 | |
| *** derekh has joined #openstack-dev | 09:08 | |
| *** paragan has quit IRC | 09:11 | |
| *** jamieh has joined #openstack-dev | 09:11 | |
| *** yolanda has joined #openstack-dev | 09:12 | |
| *** yassine has joined #openstack-dev | 09:12 | |
| *** nacim has joined #openstack-dev | 09:12 | |
| *** yolanda has quit IRC | 09:14 | |
| *** tkammer has joined #openstack-dev | 09:15 | |
| *** yolanda has joined #openstack-dev | 09:16 | |
| *** yolanda has quit IRC | 09:16 | |
| *** yolanda has joined #openstack-dev | 09:17 | |
| *** yolanda has quit IRC | 09:17 | |
| *** yolanda has joined #openstack-dev | 09:18 | |
| *** yolanda has quit IRC | 09:19 | |
| *** florentflament has joined #openstack-dev | 09:19 | |
| *** yolanda has joined #openstack-dev | 09:19 | |
| *** athomas has joined #openstack-dev | 09:20 | |
| *** gokrokve has joined #openstack-dev | 09:21 | |
| *** mmagr has joined #openstack-dev | 09:22 | |
| *** lucasagomes has joined #openstack-dev | 09:22 | |
| *** mkerrin has joined #openstack-dev | 09:23 | |
| *** yolanda has quit IRC | 09:23 | |
| *** yolanda has joined #openstack-dev | 09:23 | |
| *** kushal has quit IRC | 09:24 | |
| *** sushils_ has quit IRC | 09:24 | |
| *** sushil_ has joined #openstack-dev | 09:25 | |
| *** yolanda has quit IRC | 09:25 | |
| *** gokrokve has quit IRC | 09:26 | |
| *** yolanda has joined #openstack-dev | 09:26 | |
| *** danpb has joined #openstack-dev | 09:28 | |
| *** morganfainberg is now known as morganfainberg_Z | 09:28 | |
| *** mjbot has joined #openstack-dev | 09:28 | |
| *** afazekas has joined #openstack-dev | 09:29 | |
| *** sushil_ has quit IRC | 09:29 | |
| *** eglynn has joined #openstack-dev | 09:29 | |
| *** coolsvap1 has joined #openstack-dev | 09:32 | |
| *** pradeep1 has joined #openstack-dev | 09:33 | |
| *** pradeep has quit IRC | 09:33 | |
| *** krtaylor has quit IRC | 09:33 | |
| *** krtaylor has joined #openstack-dev | 09:34 | |
| *** yolanda has quit IRC | 09:34 | |
| *** yolanda has joined #openstack-dev | 09:35 | |
| *** paragan has joined #openstack-dev | 09:35 | |
| *** paragan has quit IRC | 09:35 | |
| *** paragan has joined #openstack-dev | 09:35 | |
| *** coolsvap has quit IRC | 09:35 | |
| *** jcoufal has quit IRC | 09:36 | |
| *** jtomasek has joined #openstack-dev | 09:36 | |
| *** jcoufal has joined #openstack-dev | 09:36 | |
| *** kushal has joined #openstack-dev | 09:37 | |
| *** e0ne_ has joined #openstack-dev | 09:38 | |
| *** e0ne has quit IRC | 09:38 | |
| *** fc__ has quit IRC | 09:39 | |
| *** pschaef has joined #openstack-dev | 09:39 | |
| *** bvandenh has joined #openstack-dev | 09:39 | |
| *** sarob has joined #openstack-dev | 09:40 | |
| *** gszasz has joined #openstack-dev | 09:41 | |
| *** comay has quit IRC | 09:44 | |
| *** sarob has quit IRC | 09:47 | |
| *** xga has quit IRC | 09:47 | |
| *** xga has joined #openstack-dev | 09:47 | |
| *** sarob has joined #openstack-dev | 09:50 | |
| *** kolesovdv has joined #openstack-dev | 09:54 | |
| *** sarob has quit IRC | 09:55 | |
| *** gszasz has quit IRC | 09:56 | |
| *** networkstatic has quit IRC | 09:57 | |
| *** fc__ has joined #openstack-dev | 09:59 | |
| *** jasondotstar has joined #openstack-dev | 10:00 | |
| *** gcha has joined #openstack-dev | 10:00 | |
| *** jp_at_hp has joined #openstack-dev | 10:01 | |
| *** andreykurilin has quit IRC | 10:02 | |
| *** andreykurilin has joined #openstack-dev | 10:02 | |
| *** alex_xu has quit IRC | 10:05 | |
| *** capri has quit IRC | 10:06 | |
| *** capri has joined #openstack-dev | 10:08 | |
| *** ihrachyshka has quit IRC | 10:08 | |
| *** markmc has joined #openstack-dev | 10:10 | |
| *** avishayb has quit IRC | 10:16 | |
| *** gongysh has quit IRC | 10:20 | |
| *** networkstatic has joined #openstack-dev | 10:20 | |
| *** networkstatic has quit IRC | 10:20 | |
| *** sergmelikyan has joined #openstack-dev | 10:21 | |
| *** gokrokve has joined #openstack-dev | 10:21 | |
| *** DinaBelova_ is now known as DinaBelova | 10:21 | |
| *** pixelb has joined #openstack-dev | 10:23 | |
| *** gokrokve has quit IRC | 10:26 | |
| *** yatin has joined #openstack-dev | 10:26 | |
| *** paragan has quit IRC | 10:28 | |
| *** jcoufal has quit IRC | 10:32 | |
| *** RajeshMohan has quit IRC | 10:33 | |
| *** xgsa has joined #openstack-dev | 10:33 | |
| *** jtomasek has quit IRC | 10:33 | |
| *** ifarkas has quit IRC | 10:34 | |
| *** RajeshMohan has joined #openstack-dev | 10:34 | |
| *** ppetit has quit IRC | 10:34 | |
| *** ifarkas has joined #openstack-dev | 10:35 | |
| *** CaptTofu has joined #openstack-dev | 10:36 | |
| *** amotoki has quit IRC | 10:38 | |
| *** jcoufal has joined #openstack-dev | 10:39 | |
| *** CaptTofu has quit IRC | 10:41 | |
| *** yamahata has quit IRC | 10:41 | |
| *** aditirav has quit IRC | 10:42 | |
| *** coolsvap_ has joined #openstack-dev | 10:43 | |
| *** sarob has joined #openstack-dev | 10:44 | |
| *** yaguang has quit IRC | 10:45 | |
| *** jtomasek has joined #openstack-dev | 10:45 | |
| *** ppetit has joined #openstack-dev | 10:46 | |
| *** xga_ has joined #openstack-dev | 10:46 | |
| *** avishayb has joined #openstack-dev | 10:46 | |
| *** coolsvap1 has quit IRC | 10:46 | |
| *** xga has quit IRC | 10:46 | |
| *** sushil_ has joined #openstack-dev | 10:47 | |
| *** coolsvap1 has joined #openstack-dev | 10:48 | |
| *** sarob has quit IRC | 10:48 | |
| *** coolsvap_ has quit IRC | 10:51 | |
| *** CaptTofu has joined #openstack-dev | 10:52 | |
| *** coolsvap has joined #openstack-dev | 10:52 | |
| *** yassine has quit IRC | 10:53 | |
| *** coolsvap1 has quit IRC | 10:53 | |
| *** gcha has quit IRC | 10:54 | |
| *** Tingting has joined #openstack-dev | 10:59 | |
| *** jasondotstar has quit IRC | 11:00 | |
| *** ArxCruz has joined #openstack-dev | 11:01 | |
| *** erkules_ is now known as erkules | 11:04 | |
| *** jasondotstar has joined #openstack-dev | 11:06 | |
| *** xingchao has quit IRC | 11:07 | |
| *** irenab has quit IRC | 11:08 | |
| rushiagr | Something's broken with gerrit | 11:09 |
| rushiagr | Change ID links are not working, showing '$1' in the URL and not change ID | 11:09 |
| *** jgallard has quit IRC | 11:10 | |
| *** safchain has quit IRC | 11:11 | |
| *** safchain has joined #openstack-dev | 11:12 | |
| Tingting | Hey, we're conducting cloud research in London, and need to find Openstack experts. I'm wondering if anybody here would be interested in it or could advise on how to find them. Any advices would be appreciated! Thanks. | 11:16 |
| *** gokrokve has joined #openstack-dev | 11:21 | |
| *** vkmc has joined #openstack-dev | 11:21 | |
| *** jtomasek has quit IRC | 11:22 | |
| *** jamieh has quit IRC | 11:23 | |
| *** gszasz has joined #openstack-dev | 11:25 | |
| *** gokrokve has quit IRC | 11:25 | |
| *** pcm_ has joined #openstack-dev | 11:26 | |
| *** CaptTofu has quit IRC | 11:29 | |
| *** pcm_ has quit IRC | 11:29 | |
| *** pcm_ has joined #openstack-dev | 11:30 | |
| *** venkatesh has joined #openstack-dev | 11:30 | |
| *** venkatesh_ has joined #openstack-dev | 11:30 | |
| *** sweston_ has quit IRC | 11:31 | |
| *** jamieh has joined #openstack-dev | 11:31 | |
| *** MaxV has quit IRC | 11:32 | |
| sergmelikyan | Can someone share a link to example of handling notifications from oslo.messaging? | 11:33 |
| sergmelikyan | A lot of examples of emitting but could not find clean example of handling. | 11:33 |
| *** rgerganov has joined #openstack-dev | 11:34 | |
| *** xga_ has quit IRC | 11:34 | |
| *** xga has joined #openstack-dev | 11:35 | |
| *** jasondotstar has quit IRC | 11:35 | |
| *** DinaBelova is now known as DinaBelova_ | 11:39 | |
| *** RajeshMohan has quit IRC | 11:40 | |
| *** RajeshMohan has joined #openstack-dev | 11:41 | |
| *** sarob has joined #openstack-dev | 11:44 | |
| *** enykeev has joined #openstack-dev | 11:45 | |
| *** ifarkas_ has joined #openstack-dev | 11:47 | |
| *** tdruiva has quit IRC | 11:48 | |
| *** rodrigods has joined #openstack-dev | 11:49 | |
| *** rodrigods has joined #openstack-dev | 11:49 | |
| *** tonix__ has joined #openstack-dev | 11:49 | |
| *** ifarkas has quit IRC | 11:51 | |
| *** sarob has quit IRC | 11:51 | |
| *** tonix_ has quit IRC | 11:53 | |
| *** rfolco has joined #openstack-dev | 11:54 | |
| *** YorikSar has quit IRC | 11:57 | |
| *** HenryG has quit IRC | 11:58 | |
| *** CaptTofu has joined #openstack-dev | 11:59 | |
| *** rmk has quit IRC | 11:59 | |
| *** rodrigods has quit IRC | 12:00 | |
| *** CrackerJackMack has quit IRC | 12:00 | |
| *** nspmangalore has joined #openstack-dev | 12:00 | |
| *** sudorandom has quit IRC | 12:01 | |
| *** pleia2 has quit IRC | 12:01 | |
| *** pleia2 has joined #openstack-dev | 12:02 | |
| *** jtomasek has joined #openstack-dev | 12:02 | |
| *** MaxV has joined #openstack-dev | 12:03 | |
| *** cburgess has quit IRC | 12:04 | |
| *** CaptTofu has quit IRC | 12:04 | |
| *** nspmangalore has quit IRC | 12:04 | |
| *** xga_ has joined #openstack-dev | 12:05 | |
| *** DinaBelova_ is now known as DinaBelova | 12:05 | |
| *** sudorandom has joined #openstack-dev | 12:06 | |
| *** xga has quit IRC | 12:07 | |
| *** pleia2 has quit IRC | 12:07 | |
| *** MaxV has quit IRC | 12:07 | |
| *** MaxV_ has joined #openstack-dev | 12:07 | |
| *** pleia2 has joined #openstack-dev | 12:07 | |
| *** CrackerJackMack has joined #openstack-dev | 12:09 | |
| *** lbragstad has quit IRC | 12:09 | |
| *** cburgess has joined #openstack-dev | 12:11 | |
| *** rmk has joined #openstack-dev | 12:11 | |
| *** irenab has joined #openstack-dev | 12:14 | |
| *** HenryG has joined #openstack-dev | 12:14 | |
| *** venkatesh_ has quit IRC | 12:17 | |
| *** venkatesh has quit IRC | 12:17 | |
| *** viktors has joined #openstack-dev | 12:18 | |
| *** tdruiva has joined #openstack-dev | 12:19 | |
| *** FunnyLookinHat has joined #openstack-dev | 12:20 | |
| *** CaptTofu has joined #openstack-dev | 12:21 | |
| *** gokrokve has joined #openstack-dev | 12:21 | |
| *** yamahata has joined #openstack-dev | 12:22 | |
| *** gokrokve has quit IRC | 12:25 | |
| *** CaptTofu has quit IRC | 12:26 | |
| *** mkollaro has joined #openstack-dev | 12:26 | |
| *** jamieh has quit IRC | 12:30 | |
| *** tdruiva has quit IRC | 12:31 | |
| *** jamieh has joined #openstack-dev | 12:31 | |
| *** CaptTofu has joined #openstack-dev | 12:31 | |
| *** CaptTofu has quit IRC | 12:32 | |
| *** tmclaugh[work] has joined #openstack-dev | 12:32 | |
| *** CaptTofu has joined #openstack-dev | 12:32 | |
| *** IanGovett has joined #openstack-dev | 12:33 | |
| *** CaptTofu_ has joined #openstack-dev | 12:35 | |
| *** CaptTofu has quit IRC | 12:35 | |
| *** alex_xu has joined #openstack-dev | 12:37 | |
| *** athomas has quit IRC | 12:37 | |
| *** david_lyle_ has joined #openstack-dev | 12:38 | |
| *** bhuvan has joined #openstack-dev | 12:38 | |
| *** athomas has joined #openstack-dev | 12:39 | |
| *** kushal has quit IRC | 12:39 | |
| *** mohits has quit IRC | 12:41 | |
| *** david-lyle has quit IRC | 12:42 | |
| *** tdruiva has joined #openstack-dev | 12:43 | |
| *** epopt37 has quit IRC | 12:45 | |
| *** lbragstad has joined #openstack-dev | 12:46 | |
| *** sarob has joined #openstack-dev | 12:47 | |
| *** raildo has joined #openstack-dev | 12:49 | |
| *** coolsvap has quit IRC | 12:50 | |
| *** sarob has quit IRC | 12:52 | |
| *** dshulyak has quit IRC | 12:53 | |
| *** epopt37 has joined #openstack-dev | 12:55 | |
| *** baoli has joined #openstack-dev | 12:55 | |
| *** sumanthns has quit IRC | 12:56 | |
| *** kragniz has joined #openstack-dev | 12:57 | |
| *** nosnos_ has joined #openstack-dev | 12:58 | |
| *** thouveng has quit IRC | 12:59 | |
| *** killer_prince has joined #openstack-dev | 12:59 | |
| *** eglynn is now known as eglynn-lunch | 12:59 | |
| *** joesavak has joined #openstack-dev | 13:00 | |
| *** nosnos has quit IRC | 13:01 | |
| *** romcheg1 has quit IRC | 13:02 | |
| *** lucasagomes is now known as lucas-hungry | 13:02 | |
| *** max_lobur_afk is now known as max_lobur | 13:03 | |
| *** nosnos_ has quit IRC | 13:03 | |
| *** avishayb has quit IRC | 13:03 | |
| *** bauzas has quit IRC | 13:03 | |
| *** avishayb has joined #openstack-dev | 13:04 | |
| *** bauzas has joined #openstack-dev | 13:04 | |
| *** CaptTofu_ has quit IRC | 13:05 | |
| *** xga__ has joined #openstack-dev | 13:05 | |
| *** xga_ has quit IRC | 13:06 | |
| *** jsavak has joined #openstack-dev | 13:06 | |
| *** dshulyak has joined #openstack-dev | 13:07 | |
| *** nosnos has joined #openstack-dev | 13:07 | |
| *** joesavak has quit IRC | 13:10 | |
| *** vladikr has joined #openstack-dev | 13:10 | |
| *** esheffield has quit IRC | 13:11 | |
| *** esheffield has joined #openstack-dev | 13:11 | |
| *** ndipanov has joined #openstack-dev | 13:11 | |
| *** gcha has joined #openstack-dev | 13:11 | |
| *** jgallard has joined #openstack-dev | 13:11 | |
| *** rtheis has joined #openstack-dev | 13:12 | |
| *** esheffield has quit IRC | 13:12 | |
| *** saju_m has quit IRC | 13:12 | |
| *** esheffield has joined #openstack-dev | 13:13 | |
| *** tonix__ has quit IRC | 13:13 | |
| *** ilyashakhat has quit IRC | 13:14 | |
| *** rodrigods has joined #openstack-dev | 13:15 | |
| *** yassine has joined #openstack-dev | 13:16 | |
| *** dave_tucker is now known as dave_tucker_zzz | 13:17 | |
| *** jdob has joined #openstack-dev | 13:20 | |
| *** gokrokve has joined #openstack-dev | 13:21 | |
| *** rodrigods has quit IRC | 13:23 | |
| *** bhuvan has quit IRC | 13:24 | |
| *** Alexei_987 has joined #openstack-dev | 13:25 | |
| *** pschaef has quit IRC | 13:25 | |
| *** sergmelikyan has quit IRC | 13:27 | |
| *** gokrokve has quit IRC | 13:27 | |
| *** romcheg1 has joined #openstack-dev | 13:30 | |
| *** bhuvan has joined #openstack-dev | 13:31 | |
| *** bswartz has quit IRC | 13:31 | |
| *** ilyashakhat has joined #openstack-dev | 13:32 | |
| *** jsavak has quit IRC | 13:33 | |
| *** jruzicka has joined #openstack-dev | 13:34 | |
| *** mrodden1 has quit IRC | 13:35 | |
| *** jruzicka is now known as nenen | 13:37 | |
| *** rohitk has quit IRC | 13:37 | |
| *** tongli has joined #openstack-dev | 13:38 | |
| *** baoli_ has joined #openstack-dev | 13:38 | |
| *** julienvey has joined #openstack-dev | 13:38 | |
| *** venkatesh has joined #openstack-dev | 13:39 | |
| *** dbalog has joined #openstack-dev | 13:39 | |
| *** baoli has quit IRC | 13:40 | |
| *** eglynn-lunch is now known as eglynn | 13:42 | |
| *** nshaikh has quit IRC | 13:43 | |
| *** dsirrine has joined #openstack-dev | 13:44 | |
| *** alex_xu has quit IRC | 13:44 | |
| *** sgordon has joined #openstack-dev | 13:45 | |
| *** sgordon has joined #openstack-dev | 13:45 | |
| *** xingchao has joined #openstack-dev | 13:46 | |
| *** dave_tucker_zzz is now known as dave_tucker | 13:46 | |
| *** romcheg has quit IRC | 13:46 | |
| *** kolesovdv has quit IRC | 13:46 | |
| *** max_lobur is now known as max_lobur_afk | 13:47 | |
| *** dims has quit IRC | 13:47 | |
| *** romcheg has joined #openstack-dev | 13:48 | |
| *** sarob has joined #openstack-dev | 13:48 | |
| *** achampion has quit IRC | 13:49 | |
| *** mrodden has joined #openstack-dev | 13:49 | |
| *** giroro_ has quit IRC | 13:49 | |
| *** baoli_ is now known as baoli | 13:50 | |
| *** dims has joined #openstack-dev | 13:50 | |
| *** rohitk has joined #openstack-dev | 13:51 | |
| *** julienvey_ has joined #openstack-dev | 13:53 | |
| *** julienvey_ has quit IRC | 13:53 | |
| *** sarob has quit IRC | 13:54 | |
| *** Ruetobas has joined #openstack-dev | 13:55 | |
| *** achampion has joined #openstack-dev | 13:56 | |
| *** yamahata has quit IRC | 13:56 | |
| *** eharney has joined #openstack-dev | 13:56 | |
| *** dklyle has joined #openstack-dev | 13:58 | |
| *** sarob has joined #openstack-dev | 13:58 | |
| *** safchain has quit IRC | 13:58 | |
| *** cagrev has joined #openstack-dev | 13:59 | |
| *** thomasem has joined #openstack-dev | 13:59 | |
| *** yamahata has joined #openstack-dev | 13:59 | |
| *** browne has joined #openstack-dev | 13:59 | |
| *** rtheis has quit IRC | 14:00 | |
| *** safchain has joined #openstack-dev | 14:00 | |
| *** vartom1111111119 has quit IRC | 14:00 | |
| *** achampion has quit IRC | 14:01 | |
| *** omachace has joined #openstack-dev | 14:01 | |
| *** mfer has joined #openstack-dev | 14:01 | |
| *** david_lyle_ has quit IRC | 14:01 | |
| *** lucas-hungry is now known as lucasagomes | 14:01 | |
| sdague | lbragstad: where's the hangout for this? | 14:01 |
| lbragstad | sdague: just sent you an invite | 14:02 |
| *** sarob has quit IRC | 14:03 | |
| *** tdruiva has quit IRC | 14:05 | |
| *** tdruiva has joined #openstack-dev | 14:06 | |
| *** venkatesh has quit IRC | 14:07 | |
| *** romcheg1 has quit IRC | 14:07 | |
| *** pberis has joined #openstack-dev | 14:08 | |
| *** rohitk has quit IRC | 14:09 | |
| *** dprince has joined #openstack-dev | 14:09 | |
| *** sundjango has quit IRC | 14:09 | |
| *** pradeep1 has quit IRC | 14:10 | |
| *** jamieh has quit IRC | 14:10 | |
| *** e0ne has joined #openstack-dev | 14:10 | |
| *** morazi has joined #openstack-dev | 14:11 | |
| *** hartsocks has joined #openstack-dev | 14:11 | |
| *** bhuvan has quit IRC | 14:12 | |
| *** e0ne_ has quit IRC | 14:12 | |
| *** hartsocks has quit IRC | 14:13 | |
| *** jamieh has joined #openstack-dev | 14:16 | |
| *** rtheis has joined #openstack-dev | 14:17 | |
| *** jobewan has joined #openstack-dev | 14:17 | |
| *** haomaiwang has quit IRC | 14:17 | |
| *** haomaiwang has joined #openstack-dev | 14:17 | |
| *** stevemar has joined #openstack-dev | 14:18 | |
| *** e0ne_ has joined #openstack-dev | 14:20 | |
| *** henrique has quit IRC | 14:20 | |
| *** vijendar1 has quit IRC | 14:20 | |
| *** gokrokve has joined #openstack-dev | 14:21 | |
| *** bauzas has quit IRC | 14:23 | |
| *** cfriesen has joined #openstack-dev | 14:23 | |
| *** e0ne has quit IRC | 14:23 | |
| *** bauzas has joined #openstack-dev | 14:24 | |
| *** tdruiva has quit IRC | 14:24 | |
| *** tdruiva has joined #openstack-dev | 14:25 | |
| *** rossella_s has joined #openstack-dev | 14:25 | |
| *** gokrokve has quit IRC | 14:26 | |
| *** xga_ has joined #openstack-dev | 14:26 | |
| *** max_lobur_afk is now known as max_lobur | 14:27 | |
| *** xga__ has quit IRC | 14:27 | |
| *** jecarey has joined #openstack-dev | 14:28 | |
| raildo | dolphm: ping | 14:28 |
| *** jecarey_ has joined #openstack-dev | 14:29 | |
| *** Sumeniac has joined #openstack-dev | 14:29 | |
| *** jistr has quit IRC | 14:29 | |
| *** morazi has quit IRC | 14:31 | |
| *** morazi has joined #openstack-dev | 14:32 | |
| *** stevemar has quit IRC | 14:32 | |
| *** jtomasek has quit IRC | 14:33 | |
| *** dtantsur has quit IRC | 14:33 | |
| *** aeperezt has joined #openstack-dev | 14:33 | |
| *** browne1 has joined #openstack-dev | 14:33 | |
| *** browne2 has joined #openstack-dev | 14:34 | |
| *** ramishra has joined #openstack-dev | 14:35 | |
| *** browne2 has quit IRC | 14:35 | |
| *** browne2 has joined #openstack-dev | 14:35 | |
| *** mdomsch has joined #openstack-dev | 14:35 | |
| *** sirushti has left #openstack-dev | 14:35 | |
| *** browne has quit IRC | 14:35 | |
| *** boris-42_ has quit IRC | 14:36 | |
| *** tdruiva has quit IRC | 14:36 | |
| *** READ10 has joined #openstack-dev | 14:37 | |
| *** ewindisch has joined #openstack-dev | 14:37 | |
| *** yatin has quit IRC | 14:38 | |
| *** browne1 has quit IRC | 14:38 | |
| *** prad has joined #openstack-dev | 14:38 | |
| *** chris_johnson has joined #openstack-dev | 14:39 | |
| *** dvarga has joined #openstack-dev | 14:39 | |
| *** jistr has joined #openstack-dev | 14:39 | |
| *** ayoung-ZzZz is now known as ayoung | 14:40 | |
| *** obondarev_ has joined #openstack-dev | 14:41 | |
| ayoung | dolphm, please remote the -2 https://review.openstack.org/#/c/71181/ | 14:41 |
| *** peristeri has joined #openstack-dev | 14:42 | |
| *** edmund1 has quit IRC | 14:43 | |
| *** gordc has joined #openstack-dev | 14:43 | |
| *** mriedem has joined #openstack-dev | 14:43 | |
| *** achampion has joined #openstack-dev | 14:44 | |
| *** burt1 has joined #openstack-dev | 14:45 | |
| *** nermina has joined #openstack-dev | 14:45 | |
| *** ndipanov has quit IRC | 14:47 | |
| *** browne2 has left #openstack-dev | 14:47 | |
| *** dtantsur has joined #openstack-dev | 14:47 | |
| *** edmund has joined #openstack-dev | 14:49 | |
| *** matsuhashi has joined #openstack-dev | 14:49 | |
| *** shortstop has joined #openstack-dev | 14:49 | |
| *** browne has joined #openstack-dev | 14:50 | |
| *** tdruiva has joined #openstack-dev | 14:50 | |
| *** vijendar has joined #openstack-dev | 14:50 | |
| *** gszasz has quit IRC | 14:50 | |
| *** tdruiva has quit IRC | 14:51 | |
| *** gszasz has joined #openstack-dev | 14:51 | |
| *** tdruiva has joined #openstack-dev | 14:51 | |
| *** sarob has joined #openstack-dev | 14:51 | |
| *** avishayb has quit IRC | 14:52 | |
| *** dperaza has joined #openstack-dev | 14:54 | |
| *** ramishra has quit IRC | 14:54 | |
| *** ramishra has joined #openstack-dev | 14:55 | |
| *** jordanP has joined #openstack-dev | 14:55 | |
| *** sarob has quit IRC | 14:56 | |
| *** byeager has joined #openstack-dev | 14:56 | |
| *** FunnyLookinHat has quit IRC | 14:56 | |
| *** dperaza1 has quit IRC | 14:57 | |
| jordanP | mriedem, regarding the tempest patch "Make endpoint type configurable" : I didn't get why you suggested to abondon your patch regarding s/config.images/config.image/. It looks just fine, I could make my patch depends on yours ? | 14:57 |
| mriedem | jordanP: feel free to rebase on mine | 14:58 |
| mriedem | mine is in a 2-patch series though | 14:58 |
| mriedem | but should be fine | 14:58 |
| jordanP | I'll try to use yours | 14:58 |
| *** yamahata has quit IRC | 14:59 | |
| *** noslzzp has joined #openstack-dev | 14:59 | |
| *** ramishra_ has joined #openstack-dev | 15:00 | |
| *** xqueralt has quit IRC | 15:00 | |
| *** xqueralt has joined #openstack-dev | 15:01 | |
| *** ramishra has quit IRC | 15:01 | |
| *** irenab has quit IRC | 15:01 | |
| *** saju_m has joined #openstack-dev | 15:02 | |
| *** bhuvan has joined #openstack-dev | 15:02 | |
| *** yamahata has joined #openstack-dev | 15:03 | |
| *** joesavak has joined #openstack-dev | 15:03 | |
| *** damnsmith is now known as dansmith | 15:03 | |
| *** saju_m has quit IRC | 15:03 | |
| *** xingchao has quit IRC | 15:04 | |
| *** kevinconway has joined #openstack-dev | 15:04 | |
| *** saju_m has joined #openstack-dev | 15:04 | |
| *** xingchao has joined #openstack-dev | 15:04 | |
| *** devoid has joined #openstack-dev | 15:05 | |
| *** CaptTofu has joined #openstack-dev | 15:05 | |
| *** AlanClark has joined #openstack-dev | 15:05 | |
| *** gordc has quit IRC | 15:07 | |
| *** max_lobur is now known as max_lobur_afk | 15:07 | |
| *** markwash has joined #openstack-dev | 15:07 | |
| *** nenen has quit IRC | 15:07 | |
| *** otherwiseguy has joined #openstack-dev | 15:08 | |
| *** jmckind has joined #openstack-dev | 15:08 | |
| *** pschaef has joined #openstack-dev | 15:09 | |
| *** radez_g0n3 is now known as radez | 15:09 | |
| *** rcleere has quit IRC | 15:10 | |
| *** CaptTofu has quit IRC | 15:10 | |
| *** spzala has joined #openstack-dev | 15:11 | |
| *** sdague has quit IRC | 15:12 | |
| *** waverider has joined #openstack-dev | 15:12 | |
| *** gordc has joined #openstack-dev | 15:13 | |
| *** vartom1111111119 has joined #openstack-dev | 15:13 | |
| *** mkollaro has quit IRC | 15:14 | |
| *** andreykurilin has quit IRC | 15:14 | |
| *** bhuvan has quit IRC | 15:14 | |
| *** xingchao has quit IRC | 15:14 | |
| *** dklyle is now known as david-lyle | 15:15 | |
| *** jgrimm has joined #openstack-dev | 15:16 | |
| openstackstatus | NOTICE: the gate is experiencing delays due to nodepool resource issues (fix in progress, eta 16:00 utc) | 15:16 |
| *** ChanServ changes topic to "the gate is experiencing delays due to nodepool resource issues (fix in progress, eta 16:00 utc)" | 15:16 | |
| *** rwsu has joined #openstack-dev | 15:17 | |
| *** max_lobur_afk is now known as max_lobur | 15:18 | |
| *** jdennis has joined #openstack-dev | 15:18 | |
| *** mrodden has quit IRC | 15:20 | |
| *** chandan_kumar has quit IRC | 15:20 | |
| *** gokrokve has joined #openstack-dev | 15:21 | |
| *** jruzicka has joined #openstack-dev | 15:22 | |
| *** tsekiyama has joined #openstack-dev | 15:23 | |
| *** stevemar has joined #openstack-dev | 15:23 | |
| *** tiamar has joined #openstack-dev | 15:24 | |
| *** gokrokve has quit IRC | 15:25 | |
| *** mrodden has joined #openstack-dev | 15:26 | |
| *** mbernacc has joined #openstack-dev | 15:27 | |
| *** gokrokve has joined #openstack-dev | 15:28 | |
| jgriffith | markmc: Thanks for filing that bug: https://bugs.launchpad.net/cinder/+bug/1278416 | 15:29 |
| uvirtbot | Launchpad bug 1278416 in cinder "remove_iscsi_target() fails with ENOENT trying to unlink file (dup-of: 1277362)" [High,New] | 15:29 |
| uvirtbot | Launchpad bug 1277362 in cinder "OSError: [Errno 2] No such file or directory: '/opt/stack/data/cinder/volumes/volume-" [High,In progress] | 15:29 |
| *** sdague has joined #openstack-dev | 15:29 | |
| jgriffith | markmc: I marked it as a dup, in progress patch now | 15:29 |
| *** waverider has left #openstack-dev | 15:30 | |
| markmc | jgriffith, cool, thanks | 15:30 |
| *** mriedem has quit IRC | 15:30 | |
| markmc | jgriffith, I tried searching for a dup based on the traceback | 15:31 |
| *** vartom1111111119 has quit IRC | 15:31 | |
| *** rdas has quit IRC | 15:32 | |
| *** markwash has quit IRC | 15:32 | |
| *** jnoller has joined #openstack-dev | 15:33 | |
| Alexei_987 | lifeless: ping | 15:33 |
| *** galstrom_zzz is now known as galstrom | 15:33 | |
| *** sweston has joined #openstack-dev | 15:33 | |
| *** armax has joined #openstack-dev | 15:34 | |
| *** bhuvan has joined #openstack-dev | 15:36 | |
| dhellmann | jamielennox: if you're still looking for help with pecan, try #pecanpy | 15:36 |
| *** bauzas has quit IRC | 15:36 | |
| *** matsuhashi has quit IRC | 15:37 | |
| *** nosnos has quit IRC | 15:37 | |
| *** yamahata has quit IRC | 15:37 | |
| *** nosnos has joined #openstack-dev | 15:37 | |
| *** dkranz has joined #openstack-dev | 15:37 | |
| *** matsuhashi has joined #openstack-dev | 15:37 | |
| *** saju_m has quit IRC | 15:37 | |
| *** sweston has quit IRC | 15:38 | |
| *** stevemar has quit IRC | 15:39 | |
| ayoung | dolphm, I need to test verification of the existing format and the new format, thus I need both sets of files. | 15:39 |
| *** CaptTofu has joined #openstack-dev | 15:39 | |
| *** stevemar has joined #openstack-dev | 15:39 | |
| *** saju_m has joined #openstack-dev | 15:40 | |
| *** boris-42_ has joined #openstack-dev | 15:40 | |
| *** dims has quit IRC | 15:41 | |
| *** rcleere has joined #openstack-dev | 15:41 | |
| dolphm | ayoung: then heavily document that one format is deprecated, and explain why support remains. those files are basically end-user documentation, and the presentation is confusing | 15:41 |
| *** markwash has joined #openstack-dev | 15:42 | |
| *** xga has joined #openstack-dev | 15:42 | |
| *** xarses has quit IRC | 15:42 | |
| *** xga_ has quit IRC | 15:42 | |
| *** tkammer has quit IRC | 15:43 | |
| *** dims has joined #openstack-dev | 15:45 | |
| *** FunnyLookinHat has joined #openstack-dev | 15:46 | |
| *** markwash has quit IRC | 15:46 | |
| *** tanisdl has joined #openstack-dev | 15:47 | |
| *** afazekas has quit IRC | 15:47 | |
| *** bhuvan has quit IRC | 15:50 | |
| jgriffith | markmc: yeah, I figured you looked and my description just wasn't good. | 15:50 |
| dolphm | raildo: o/ | 15:50 |
| jgriffith | markmc: I didn't put the traceback in there, should have | 15:51 |
| jgriffith | markmc: anyway, should link from yours now, thanks for the detailed report on it | 15:51 |
| *** sarob has joined #openstack-dev | 15:52 | |
| *** gcha has quit IRC | 15:52 | |
| *** NikitaKonovalov is now known as NikitaKonovalov_ | 15:53 | |
| *** nermina has quit IRC | 15:53 | |
| *** bauzas has joined #openstack-dev | 15:53 | |
| *** dvarga is now known as dvarga|away | 15:54 | |
| *** dvarga|away is now known as dvarga | 15:54 | |
| raildo | dolphm: I and tellesnobrega have a doubts about the implementation of the hierarchical project and we think you could help us.Is it possible there is a project with more than one father? | 15:56 |
| dolphm | raildo: how would that be useful? | 15:57 |
| *** haomai___ has joined #openstack-dev | 15:57 | |
| *** kgriffs_afk is now known as kgriffs | 15:57 | |
| *** dvarga has quit IRC | 15:57 | |
| *** DinaBelova is now known as DinaBelova_ | 15:57 | |
| *** sarob has quit IRC | 15:57 | |
| raildo | I thought about the possibility of two projects make a "partnership" to create another project. Not sure if this would be true. | 15:58 |
| *** AlexF has joined #openstack-dev | 15:59 | |
| *** carl_baldwin has joined #openstack-dev | 15:59 | |
| *** tkammer has joined #openstack-dev | 15:59 | |
| dolphm | raildo: i'd rather not complicate the model beyond what vishy prototyped, unless there's a strong use case we'd like to pursue separately | 16:00 |
| *** haomaiwang has quit IRC | 16:00 | |
| *** jprovazn has quit IRC | 16:00 | |
| *** jmontemayor has joined #openstack-dev | 16:00 | |
| *** comay has joined #openstack-dev | 16:00 | |
| *** devoid has quit IRC | 16:00 | |
| *** mikeoutland has joined #openstack-dev | 16:00 | |
| *** jpomero has joined #openstack-dev | 16:00 | |
| *** chris_johnson is now known as wchrisj|away | 16:01 | |
| *** Ruetobas has quit IRC | 16:01 | |
| *** jckasper has joined #openstack-dev | 16:01 | |
| raildo | dolphm: It was just a question that came up, but now it's clear. thank you =] | 16:01 |
| *** AlexF has quit IRC | 16:01 | |
| *** wchrisj|away is now known as chris_johnson | 16:02 | |
| *** radez is now known as radez_g0n3 | 16:02 | |
| *** atiwari has joined #openstack-dev | 16:02 | |
| *** Ruetobas has joined #openstack-dev | 16:03 | |
| *** dvarga has joined #openstack-dev | 16:05 | |
| *** zul has joined #openstack-dev | 16:05 | |
| *** dave_tucker is now known as dave_tucker_zzz | 16:05 | |
| *** mriedem has joined #openstack-dev | 16:06 | |
| *** bswartz has joined #openstack-dev | 16:06 | |
| *** nosnos has quit IRC | 16:06 | |
| *** hartsocks has joined #openstack-dev | 16:07 | |
| *** radez_g0n3 is now known as radez | 16:07 | |
| *** matsuhashi has quit IRC | 16:07 | |
| *** xqueralt has quit IRC | 16:08 | |
| *** Ruetobas has quit IRC | 16:08 | |
| *** AlexF has joined #openstack-dev | 16:08 | |
| *** sweston has joined #openstack-dev | 16:09 | |
| *** sweston is now known as sweston_ | 16:09 | |
| *** mgagne has joined #openstack-dev | 16:11 | |
| *** ifarkas_ has quit IRC | 16:12 | |
| *** terrylhowe has joined #openstack-dev | 16:12 | |
| *** Ruetobas has joined #openstack-dev | 16:13 | |
| *** mbernacc has quit IRC | 16:15 | |
| *** david_lyle_ has joined #openstack-dev | 16:16 | |
| *** networkstatic has joined #openstack-dev | 16:17 | |
| *** dave_tucker_zzz is now known as dave_tucker | 16:17 | |
| *** KurtMartin is now known as kmartin | 16:17 | |
| *** reed has joined #openstack-dev | 16:18 | |
| ayoung | dolphm, sounds good. I did a sync of versionutils from oslo to python-keystoneclient. I am ot certain, though, what we want to put in the deprecated message. obviosul as_off is not appropriate for a library that is not released on the ICEHOUSE etc schedule. I can use in_favor_of, though. does it make sense to say (in_favor_of="cmsz format") or remove_in...? | 16:19 |
| *** thedodd has joined #openstack-dev | 16:19 | |
| *** jotan has joined #openstack-dev | 16:19 | |
| *** david-lyle has quit IRC | 16:20 | |
| *** sdake has quit IRC | 16:20 | |
| *** tkammer has quit IRC | 16:21 | |
| *** sdake has joined #openstack-dev | 16:21 | |
| *** sdake has quit IRC | 16:21 | |
| *** sdake has joined #openstack-dev | 16:21 | |
| openstackstatus | NOTICE: jobs are running for changes again, but there's a bit of a backlog so it will still probably take a few hours for everything to catch up | 16:21 |
| *** ChanServ changes topic to "OpenStack development || Support is in #openstack" | 16:21 | |
| *** bvandenh has quit IRC | 16:21 | |
| *** mrda_away is now known as mrda | 16:22 | |
| *** xgsa has quit IRC | 16:22 | |
| *** xarses has joined #openstack-dev | 16:23 | |
| *** dtantsur has quit IRC | 16:23 | |
| *** ijw has joined #openstack-dev | 16:23 | |
| *** stevemar has quit IRC | 16:23 | |
| *** david_lyle_ has quit IRC | 16:24 | |
| *** FunnyLookinHat has quit IRC | 16:24 | |
| *** johnthetubaguy has joined #openstack-dev | 16:25 | |
| *** ramishra_ has quit IRC | 16:25 | |
| *** nermina has joined #openstack-dev | 16:25 | |
| *** Drankis has quit IRC | 16:26 | |
| *** jtomasek has joined #openstack-dev | 16:26 | |
| *** dprince_ has joined #openstack-dev | 16:28 | |
| *** utlemming has joined #openstack-dev | 16:29 | |
| *** FunnyLookinHat has joined #openstack-dev | 16:29 | |
| *** ramishra has joined #openstack-dev | 16:29 | |
| *** dprince has quit IRC | 16:29 | |
| *** tanisdl has quit IRC | 16:30 | |
| *** beekneemech is now known as bnemec | 16:30 | |
| *** reed has quit IRC | 16:31 | |
| *** reed_ has joined #openstack-dev | 16:31 | |
| *** arosen has joined #openstack-dev | 16:32 | |
| *** jdob has quit IRC | 16:32 | |
| *** jdob_ has joined #openstack-dev | 16:32 | |
| *** ndipanov has joined #openstack-dev | 16:33 | |
| *** jistr has quit IRC | 16:33 | |
| *** jistr has joined #openstack-dev | 16:34 | |
| *** CaptTofu has quit IRC | 16:35 | |
| *** fabiomorais has joined #openstack-dev | 16:35 | |
| *** fabiomorais has left #openstack-dev | 16:36 | |
| *** reed_ has quit IRC | 16:36 | |
| *** dtantsur has joined #openstack-dev | 16:36 | |
| *** bhuvan has joined #openstack-dev | 16:37 | |
| *** mlavalle has joined #openstack-dev | 16:37 | |
| *** corXi has quit IRC | 16:37 | |
| *** belmoreira has quit IRC | 16:37 | |
| *** ysk has quit IRC | 16:38 | |
| *** thuc has joined #openstack-dev | 16:38 | |
| *** thuc has quit IRC | 16:39 | |
| *** viktors has quit IRC | 16:39 | |
| *** thuc has joined #openstack-dev | 16:39 | |
| *** terrylhowe_ has joined #openstack-dev | 16:40 | |
| *** terrylhowe_ has left #openstack-dev | 16:41 | |
| *** hartsocks has quit IRC | 16:42 | |
| *** tjones has joined #openstack-dev | 16:43 | |
| *** markmcclain has joined #openstack-dev | 16:43 | |
| *** jgallard has quit IRC | 16:46 | |
| *** markmcclain1 has joined #openstack-dev | 16:46 | |
| *** igor has quit IRC | 16:47 | |
| *** xqueralt has joined #openstack-dev | 16:47 | |
| *** AlexF has quit IRC | 16:47 | |
| *** markmcclain has quit IRC | 16:47 | |
| *** igor has joined #openstack-dev | 16:47 | |
| *** evgenyf has quit IRC | 16:50 | |
| *** tanisdl has joined #openstack-dev | 16:50 | |
| marekd | https://github.com/openstack/keystone/blob/master/keystone/auth/controllers.py#L146 it looks like scoping the token is just limited to checking whether the porject exists and is enable. Then, when do we actually check if the user can access that project? | 16:50 |
| *** nmagnezi has quit IRC | 16:51 | |
| *** devoid has joined #openstack-dev | 16:51 | |
| *** igor has quit IRC | 16:52 | |
| *** pmathews has joined #openstack-dev | 16:52 | |
| *** gyee has joined #openstack-dev | 16:53 | |
| *** mmagr has quit IRC | 16:53 | |
| *** xga has quit IRC | 16:53 | |
| marekd | dolphm: around? | 16:54 |
| *** yeylon__ has quit IRC | 16:54 | |
| *** sarob has joined #openstack-dev | 16:55 | |
| *** ysk has joined #openstack-dev | 16:55 | |
| *** xga has joined #openstack-dev | 16:55 | |
| *** jdennis has quit IRC | 16:56 | |
| *** jsavak has joined #openstack-dev | 16:56 | |
| *** dvarga has quit IRC | 16:56 | |
| *** dvarga has joined #openstack-dev | 16:56 | |
| *** dprince_ has quit IRC | 16:57 | |
| tellesnobrega | ayoung: hi, i have some questions about the creation of the root project for hierarchical projects in keystone | 16:57 |
| *** gokrokve has quit IRC | 16:57 | |
| ayoung | tellesnobrega, OK, but be forewarned that you will only get *my* opinion, not the group consensus | 16:58 |
| tellesnobrega | ayoung: ok | 16:58 |
| dolphm | marekd: o/ | 16:58 |
| tellesnobrega | ayoung: from what i got, the root project should be hard coded, right? | 16:59 |
| *** spzala has quit IRC | 16:59 | |
| dolphm | tellesnobrega: correct | 16:59 |
| *** saju_m has quit IRC | 16:59 | |
| ayoung | tellesnobrega, Id or name? | 16:59 |
| dolphm | ayoung: it's just an id -- it's not an actual entity | 16:59 |
| *** joesavak has quit IRC | 17:00 | |
| tellesnobrega | just id | 17:00 |
| *** sarob has quit IRC | 17:00 | |
| ayoung | the id is probably going to be autogenerated default, but overridable in the config file | 17:00 |
| ayoung | the name is going to be "" | 17:00 |
| ayoung | or sometihing | 17:00 |
| tellesnobrega | i see | 17:00 |
| tellesnobrega | im going to start working on it now, i have no idea where to start with it | 17:00 |
| dolphm | ayoung: the id is a static 'openstack' according to previous discussions | 17:00 |
| *** sarob has joined #openstack-dev | 17:00 | |
| *** jdennis has joined #openstack-dev | 17:01 | |
| dolphm | ayoung: it doesn't need to be mutable in the config | 17:01 |
| *** dave_tucker is now known as dave_tucker_zzz | 17:01 | |
| *** tqtran has joined #openstack-dev | 17:01 | |
| dolphm | ayoung: it's just a concept, it doesn't need to be an actual record or anything | 17:01 |
| *** marcoemorais has joined #openstack-dev | 17:01 | |
| *** jcoufal has quit IRC | 17:02 | |
| *** cadenzajon has joined #openstack-dev | 17:02 | |
| *** xga_ has joined #openstack-dev | 17:03 | |
| *** gokrokve has joined #openstack-dev | 17:03 | |
| marekd | dolphm: need your opinion on scoping federation-tokens. Do you think it's enough just to use the unscoped token id, use auth method 'token' and send scope: {project_id: "idhere" } in a body, or rather write another auth plugin? So far I have seen that there is no direct check on role when the scope is being set (https://github.com/openstack/keystone/blob/master/keystone/auth/controllers.py#L146). | 17:03 |
| *** xga has quit IRC | 17:03 | |
| ayoung | dolphm, I wonder about that. THe origianal reason for uuid was to get things that were "cross cloud" and now we are saying it all is one be hierarchy? It means that something specifc to a root project in one deployment is the same as the root project on anohter one. | 17:03 |
| *** baoli has quit IRC | 17:04 | |
| *** CaptTofu has joined #openstack-dev | 17:04 | |
| tellesnobrega | dolphm, ayoung, can you guys point me where should i start coding this? I don't have a profound knowledge of keystone code, so i'm not sure what should go where | 17:04 |
| ayoung | when I was contemplating the distributed token signing, it became clear that such an approach would required "belongs to my keystone" or not | 17:04 |
| *** jsavak has quit IRC | 17:04 | |
| *** yamahata has joined #openstack-dev | 17:04 | |
| *** baoli has joined #openstack-dev | 17:04 | |
| ayoung | tellesnobrega, look at the identity-api documents. We need that before code | 17:04 |
| *** saju_m has joined #openstack-dev | 17:04 | |
| dolphm | marekd: let's switch to pm for just a second | 17:04 |
| marekd | dolphm: sure. | 17:05 |
| *** markwash has joined #openstack-dev | 17:05 | |
| *** dtantsur has quit IRC | 17:05 | |
| *** DinaBelova_ is now known as DinaBelova | 17:06 | |
| dolphm | ayoung: the full project ID can still be unique | 17:06 |
| dolphm | ayoung: slash, they will still be unique unless we start allowing user-defined project id's | 17:06 |
| *** hartsocks has joined #openstack-dev | 17:07 | |
| *** david-lyle has joined #openstack-dev | 17:08 | |
| *** yamahata has quit IRC | 17:08 | |
| *** arunkant has joined #openstack-dev | 17:08 | |
| ayoung | dolphm, agreed for the subprojects, just wondering if the root project needs the same disabiguation, or if we would treat root project things as inherantly non-exportable. IE, I would never be able to do someong on cloud-deployment-B based on a role I had in root projct on Cloud-deployment-. | 17:09 |
| *** alop has joined #openstack-dev | 17:09 | |
| *** dave_tucker_zzz is now known as dave_tucker | 17:09 | |
| *** yamahata has joined #openstack-dev | 17:09 | |
| *** andreaf has joined #openstack-dev | 17:09 | |
| *** markmcclain1 has quit IRC | 17:09 | |
| *** asselin has joined #openstack-dev | 17:09 | |
| ayoung | tellesnobrega, what feature of it are you going to work on first? I can guide you through the code | 17:09 |
| *** markmc has quit IRC | 17:09 | |
| *** networkstatic has quit IRC | 17:09 | |
| tellesnobrega | ayoung: first i want to create the root project | 17:10 |
| *** markmcclain has joined #openstack-dev | 17:10 | |
| *** e0ne_ has quit IRC | 17:10 | |
| *** dprince has joined #openstack-dev | 17:10 | |
| tellesnobrega | i think that should be the first thing to have hierarchical projects | 17:10 |
| dolphm | ayoung: bring it up at the meeting on friday? | 17:10 |
| dolphm | ayoung: sounds like a juno + 1 thing, at the earliest | 17:11 |
| *** buzztroll has joined #openstack-dev | 17:11 | |
| ayoung | tellesnobrega, a root project would be just a project. | 17:12 |
| ayoung | that would be a data migration | 17:12 |
| dolphm | tellesnobrega: i think you need to migrate away the domain table first, personally (make them projects); i think morganfainberg_Z might have had a different idea (can't recall exactly) | 17:12 |
| *** blentz has quit IRC | 17:12 | |
| ayoung | dolphm, ++ | 17:12 |
| dolphm | tellesnobrega: then refactor the sql identity driver to work with "domains" (where a "domain" is a project will a null parent_project_id) | 17:12 |
| dolphm | sql assignment* driver | 17:13 |
| *** rossella_s has quit IRC | 17:13 | |
| ayoung | so, instert into project values (...) where id = ... | 17:13 |
| dolphm | tellesnobrega: there's an outline of steps on the bp in keystone | 17:13 |
| *** relaxdiego has joined #openstack-dev | 17:13 | |
| tellesnobrega | ayoung, dolphm ok | 17:13 |
| ayoung | select id from domain; | 17:13 |
| *** iartarisi has quit IRC | 17:13 | |
| *** coolsvap has joined #openstack-dev | 17:14 | |
| ayoung | tellesnobrega, probably next step is to convert the fk domain_id to a local key, with "none" as an acceptable value | 17:14 |
| ayoung | and then drop the domain table | 17:14 |
| ayoung | 3 migrations, I would recommend, one for each step | 17:14 |
| ayoung | we need an API for "get project by name" that can hierarchical search to project table. THat is going to be multiple-round-trip sql | 17:15 |
| dolphm | marekd: o/ | 17:15 |
| *** ifarkas_ has joined #openstack-dev | 17:15 | |
| marekd | dolphm: still here | 17:15 |
| *** tqtran has quit IRC | 17:15 | |
| *** dave_tucker is now known as dave_tucker_zzz | 17:16 | |
| ayoung | dolphm, https://blueprints.launchpad.net/keystone/+spec/hierarchical-multitenancy is "hiogh" but we are not planning on accepting for Icehouse, right? | 17:16 |
| *** reed has joined #openstack-dev | 17:16 | |
| ayoung | dolphm, "- Manager methods for projects (list_projects, etc) rewrite all project ID's as "openstack.<self.parent_project_id>.<self.id>"" is wrong | 17:17 |
| dolphm | marekd: so, with an unscoped token id, you need to ensure that the user has access to the requested scope, and figure out what roles they have there, by getting the list of projects available to the user (either based on groups in the token in the case of PKI, which should come through gyee's auth context work), or from the assignments driver directly in the case of UUID (which is what do today anyway) | 17:17 |
| ayoung | ids remain single values | 17:17 |
| *** itzikb has quit IRC | 17:17 | |
| ayoung | for hierarchal queries, limit it to "name" | 17:17 |
| dolphm | marekd: you'll basically be returning a new token, with "scope": {"project": {"id": "...", "name": "...", ...}, and the same user object that came in originally | 17:18 |
| *** stevemar has joined #openstack-dev | 17:18 | |
| *** gokrokve has quit IRC | 17:18 | |
| dolphm | marekd: in terms of auth method, you don't need to do anything new (you'll be authenticating the request with the "token" method, i suppose) | 17:18 |
| *** praneshp has joined #openstack-dev | 17:19 | |
| *** saju_m has quit IRC | 17:19 | |
| *** I159 has quit IRC | 17:19 | |
| *** mikeoutland has quit IRC | 17:19 | |
| marekd | dolphm: i have submitted patchset where Keystone returns unscoped token with a list of groups a user is member of (based on Steve's mapping engine). Later, as we agreed the user will reuser that token to list all the available projects/domains, again basing on the list of the groups. | 17:20 |
| *** dave_tucker_zzz is now known as dave_tucker | 17:21 | |
| dolphm | marekd: we need to propose that in the identity api spec ASAP | 17:21 |
| marekd | dolphm: high time to scope the token and this | 17:22 |
| dolphm | marekd: (reuser?) | 17:22 |
| ayoung | marekd, that was unicode? | 17:22 |
| ayoung | 007f? | 17:22 |
| tellesnobrega | ayoung, dolphm, thanks. I will start working on this, and when i have questions i will ping you guys here | 17:22 |
| marekd | ayoung: sorry, some connectivity problems. | 17:23 |
| marekd | dolphm: reuse | 17:23 |
| marekd | dolphm: https://review.openstack.org/#/c/71353/4/keystone/assignment/routers.py you can take a look here. | 17:24 |
| *** Alexei_987 has quit IRC | 17:24 | |
| marekd | dolphm: not sure if the url's are legit... | 17:24 |
| *** sweston_ has quit IRC | 17:25 | |
| *** dave_tucker is now known as dave_tucker_zzz | 17:26 | |
| *** jtomasek has quit IRC | 17:26 | |
| *** AlanClark has quit IRC | 17:26 | |
| *** AlanClark has joined #openstack-dev | 17:26 | |
| *** jpich has quit IRC | 17:26 | |
| *** salv-orlando has quit IRC | 17:27 | |
| *** sarob has quit IRC | 17:28 | |
| *** bauzas has quit IRC | 17:29 | |
| *** yassine has quit IRC | 17:29 | |
| *** marcoemorais has quit IRC | 17:29 | |
| *** marcoemorais has joined #openstack-dev | 17:29 | |
| *** Gordonz has joined #openstack-dev | 17:29 | |
| *** sandywalsh has joined #openstack-dev | 17:30 | |
| dolphm | marekd: all sounds right then | 17:30 |
| ayoung | tellesnobrega, need to think this one through. In the past, we've been able to get away with global UUID for prjects, and also specifying the domain id. that API is going to be strange now. We can get any project vie parent UUID and project name | 17:30 |
| *** salv-orlando has joined #openstack-dev | 17:30 | |
| ayoung | but we need to be able to walk the path down from the root project to the project specified by name, which means something like url parsing | 17:30 |
| *** martyntaylor has joined #openstack-dev | 17:30 | |
| ayoung | currently we can do | 17:31 |
| *** sn6i23a has joined #openstack-dev | 17:31 | |
| dolphm | ayoung: i'm assuming we'll evolve /projects to return hierarchies (the requested parent, plus it's tree of children), just like /v3/regions | 17:31 |
| ayoung | GET /v3/project?name=pname | 17:31 |
| *** sn6i23a has quit IRC | 17:31 | |
| ayoung | dolphm, it would be cleanest if we did | 17:31 |
| ayoung | GET /v3/project/ to get root | 17:31 |
| tellesnobrega | we are also thinking about how the api should be | 17:31 |
| ayoung | GET /v3/project/p1/p32/pasdf/passthedeutchy/passadena | 17:32 |
| *** mdomsch has quit IRC | 17:32 | |
| marekd | dolphm: so you are +1 for reusing 'token' method just for scoping the token. | 17:32 |
| *** sn6i23a has joined #openstack-dev | 17:32 | |
| *** mst89 has joined #openstack-dev | 17:33 | |
| ayoung | marekd, "just" is the correct long term. It might break some things in the short. | 17:33 |
| *** Gordonz has quit IRC | 17:33 | |
| *** romcheg1 has joined #openstack-dev | 17:33 | |
| ayoung | Some services, I'm thinking horizon | 17:33 |
| ayoung | will cache the otken and use it to get another token | 17:33 |
| *** saju_m has joined #openstack-dev | 17:33 | |
| *** Gordonz has joined #openstack-dev | 17:33 | |
| ayoung | now...the right thing is, as you probably have figured out, only "decrease scope" is legal | 17:33 |
| tellesnobrega | we were thinking on GET /v3/project to list subprojects from the project in context | 17:33 |
| *** jaybuff has joined #openstack-dev | 17:34 | |
| ayoung | tellesnobrega, I'd like an explicit filter on that | 17:34 |
| tellesnobrega | for now anyways | 17:34 |
| ayoung | so ?all=true or something | 17:34 |
| tellesnobrega | ayoung: ok | 17:34 |
| *** jistr has quit IRC | 17:34 | |
| marekd | ayoung: how can you decrease the scope, since you are starting with unscoped token... | 17:34 |
| ayoung | heh | 17:35 |
| ayoung | unscoped is the most powerful! | 17:35 |
| *** jistr has joined #openstack-dev | 17:35 | |
| ayoung | so...I would agree, that unscoped should be useless for any non-keystone operations | 17:35 |
| marekd | okay, you mean ...so i agree you can only decrease the permissions level. | 17:36 |
| ayoung | and for a user, if they have an unscoped token they can use it only to get a scoped token, or to change password or something specific to keystone | 17:36 |
| *** dvarga is now known as dvarga|away | 17:36 | |
| *** dvarga|away is now known as dvarga | 17:36 | |
| ayoung | however, if I have a token for P1 and it has 10 roles on it, I should be able to use that to get a token on P1 with just one role | 17:37 |
| ayoung | or... | 17:37 |
| *** romcheg1 has quit IRC | 17:37 | |
| ayoung | in the case of hierarchical, which tellesnobrega is asking about, if I have a token for P1, and it would let me operate on p1/p2/p3 I should be able to trade it dow to a token on just p1/p2/p3 | 17:37 |
| *** hartsocks has quit IRC | 17:38 | |
| *** ekhugen has joined #openstack-dev | 17:38 | |
| *** gszasz has quit IRC | 17:38 | |
| *** hartsocks has joined #openstack-dev | 17:38 | |
| *** jaybuff has quit IRC | 17:38 | |
| tellesnobrega | ayoung: in the case of using just GET /v3/project what should the result be? | 17:38 |
| ayoung | root project | 17:39 |
| *** hartsocks has quit IRC | 17:39 | |
| ayoung | the thing that I'm wondering is...if I only have a role on p1/p2/p3 and I do a get on /v3/projects/p1 what do I get? | 17:39 |
| ayoung | 403? | 17:40 |
| *** AlexF has joined #openstack-dev | 17:40 | |
| *** xmltok has joined #openstack-dev | 17:40 | |
| *** relaxdiego has quit IRC | 17:40 | |
| tellesnobrega | i think so | 17:41 |
| *** mkoderer has quit IRC | 17:41 | |
| *** johnthetubaguy has quit IRC | 17:41 | |
| *** dave_tucker_zzz is now known as dave_tucker | 17:42 | |
| *** markmcclain has quit IRC | 17:42 | |
| tellesnobrega | if you are authenticated to a project in a level you can't go up | 17:42 |
| tellesnobrega | you can always go down | 17:42 |
| ayoung | tellesnobrega, makes it hard to navigate down a tree, though | 17:43 |
| ayoung | think what it would look like from a visual-web perspective | 17:43 |
| *** mkoderer has joined #openstack-dev | 17:43 | |
| ayoung | maye a 200 is more appropriate, and then a list of subordinate projects | 17:43 |
| ayoung | or only thos projects you would be able to see? | 17:44 |
| *** bdpayne has joined #openstack-dev | 17:44 | |
| marekd | ayoung: you have now switched to discussion with tellesnobrega or still referring to scoping the tokens? :-) | 17:44 |
| ayoung | marekd, the two are related topics. Keystone territory is crowded and dense | 17:45 |
| marekd | ayoung: understood. | 17:45 |
| *** moted has joined #openstack-dev | 17:45 | |
| ayoung | marekd, I've been carrying on parallel conversations that touched. kinda like coloring with a yellow marker that hits a spot of black, the yellow will nevermore be untainted | 17:46 |
| tellesnobrega | i think that a user with a admin role in p3 should not be able to do a get /v3/projects/p1 | 17:46 |
| *** ygbo has quit IRC | 17:46 | |
| marekd | ayoung: noticed that. | 17:47 |
| tellesnobrega | 403 should be the response here. the other way around should be possible, an user with admin role in p1 can do a get v3/projects/p2 or get v3/projects/p3 | 17:48 |
| *** noslzzp has quit IRC | 17:49 | |
| *** browne has quit IRC | 17:49 | |
| *** danpb has quit IRC | 17:49 | |
| *** tjones has left #openstack-dev | 17:49 | |
| *** jistr has quit IRC | 17:50 | |
| *** yjiang51 has joined #openstack-dev | 17:50 | |
| stevemar | dstanek, you win the award for strangest jenkins error: https://review.openstack.org/#/c/71932/ | 17:50 |
| *** safchain has quit IRC | 17:50 | |
| dolphm | marekd: i simplified (i hope) how the idp/protocol is identified vs the design from the hackathon (it's a bit more similar to a standard token with the same information) https://review.openstack.org/#/c/72431/1/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md | 17:51 |
| *** kbrierly has joined #openstack-dev | 17:51 | |
| dolphm | marekd: also, because this is too late to propose an impact on the core API for juno, i settled for OS-FEDERATION:groups in the user object | 17:51 |
| *** dave_tucker is now known as dave_tucker_zzz | 17:51 | |
| marekd | dolphm: ack. | 17:52 |
| dolphm | err, for icehouse* | 17:52 |
| dstanek | stevemar: it looks like it timed out doing nothing :-) | 17:52 |
| dstanek | stevemar: it is after all probably the most detailed and complicated changes every made in this project | 17:53 |
| stevemar | dstanek, that's why you win the award | 17:53 |
| *** vuil has joined #openstack-dev | 17:53 | |
| stevemar | dstanek, was going to look for a bug to recheck against, saw the console log ... decided to walk away for lunch | 17:53 |
| marekd | dolphm: in the example you just paster user doesn't have an id - did you skip this intentionally? | 17:54 |
| *** jotan has quit IRC | 17:54 | |
| marekd | dolphm: last time we agreed there would be something like user@idp | 17:54 |
| dolphm | marekd: ooh, i forgot about that | 17:54 |
| *** florentflament has quit IRC | 17:54 | |
| dolphm | marekd: come to think of it, that's not changing from an API perspective, so it doesn't need to be cited here? | 17:55 |
| dolphm | marekd: it's just the value that we're affecting | 17:55 |
| stevemar | bknudson, new patch for you review/destroy | 17:56 |
| *** nermina has quit IRC | 17:56 | |
| bknudson | stevemar: I think this will be the one. | 17:57 |
| *** alop has quit IRC | 17:57 | |
| marekd | dolphm: I don't get it...;/ | 17:57 |
| dolphm | marekd: the values of 'id' and 'name' are just implementation details | 17:57 |
| *** mikeoutland has joined #openstack-dev | 17:57 | |
| *** Tingting has quit IRC | 17:58 | |
| *** angdraug has quit IRC | 17:58 | |
| marekd | dolphm: yes. | 17:58 |
| dolphm | marekd: they don't need to be specified by the API contract | 17:58 |
| *** igor_ has joined #openstack-dev | 17:58 | |
| marekd | dolphm: ah, okay. | 17:58 |
| *** nermina has joined #openstack-dev | 17:58 | |
| *** harlowja_away is now known as harlowja | 17:58 | |
| *** alop has joined #openstack-dev | 17:58 | |
| * dolphm food time | 17:59 | |
| *** kbrierly has quit IRC | 17:59 | |
| *** martyntaylor has quit IRC | 17:59 | |
| *** browne has joined #openstack-dev | 18:00 | |
| *** MaxV_ has quit IRC | 18:01 | |
| *** amcrn has joined #openstack-dev | 18:01 | |
| *** joesavak has joined #openstack-dev | 18:01 | |
| *** carl_baldwin has quit IRC | 18:01 | |
| *** derekh has quit IRC | 18:02 | |
| *** omachace has quit IRC | 18:02 | |
| *** igor_ has quit IRC | 18:02 | |
| *** carl_baldwin has joined #openstack-dev | 18:04 | |
| *** capri has quit IRC | 18:04 | |
| *** doug_shelley66 has quit IRC | 18:04 | |
| *** hartsocks has joined #openstack-dev | 18:04 | |
| *** markmcclain has joined #openstack-dev | 18:04 | |
| *** neelashah has quit IRC | 18:04 | |
| *** johnthetubaguy has joined #openstack-dev | 18:05 | |
| *** arnaud has joined #openstack-dev | 18:05 | |
| *** arnaud__ has joined #openstack-dev | 18:05 | |
| *** neelashah has joined #openstack-dev | 18:05 | |
| *** ijw has quit IRC | 18:05 | |
| *** jamieh has quit IRC | 18:05 | |
| *** omachace has joined #openstack-dev | 18:06 | |
| tellesnobrega | dolphm: i was thinking here, im not sure that we should remove domains. I think we can work with domains and make hierarchical projects starting with domains | 18:06 |
| *** capri has joined #openstack-dev | 18:06 | |
| *** kbrierly has joined #openstack-dev | 18:07 | |
| *** omachace has quit IRC | 18:07 | |
| *** tqtran has joined #openstack-dev | 18:08 | |
| *** omachace has joined #openstack-dev | 18:08 | |
| *** eglynn has quit IRC | 18:08 | |
| *** tqtran1 has joined #openstack-dev | 18:08 | |
| *** relaxdiego has joined #openstack-dev | 18:09 | |
| *** romcheg1 has joined #openstack-dev | 18:10 | |
| *** ifarkas_ has quit IRC | 18:10 | |
| *** ijw has joined #openstack-dev | 18:10 | |
| *** neelashah has quit IRC | 18:10 | |
| *** jaybuff has joined #openstack-dev | 18:11 | |
| *** e0ne has joined #openstack-dev | 18:11 | |
| *** kris_h has joined #openstack-dev | 18:11 | |
| *** tqtran has quit IRC | 18:12 | |
| *** saju_m has quit IRC | 18:12 | |
| *** martyntaylor has joined #openstack-dev | 18:13 | |
| *** noslzzp has joined #openstack-dev | 18:13 | |
| *** doug_shelley66 has joined #openstack-dev | 18:14 | |
| *** Mandell has quit IRC | 18:14 | |
| harlowja | kashyap https://github.com/harlowja/gerrit_view/tree/details if u want to try | 18:16 |
| *** jp_at_hp has quit IRC | 18:16 | |
| harlowja | it will do the git download and such required to get the summaries | 18:16 |
| harlowja | https://github.com/harlowja/gerrit_view/commit/a40d1af4f6 | 18:16 |
| *** athomas has quit IRC | 18:16 | |
| *** e0ne_ has joined #openstack-dev | 18:21 | |
| *** e0ne has quit IRC | 18:21 | |
| *** CaptTofu has quit IRC | 18:22 | |
| *** angdraug has joined #openstack-dev | 18:22 | |
| *** max_lobur is now known as max_lobur_afk | 18:23 | |
| *** jsavak has joined #openstack-dev | 18:23 | |
| *** joesavak has quit IRC | 18:23 | |
| *** neelashah has joined #openstack-dev | 18:26 | |
| ayoung | tellesnobrega, that was my thought. | 18:26 |
| *** lucasagomes is now known as lucas-afk | 18:26 | |
| ayoung | I hate the idea of trying to convince people that they should stop talking about domains. We've been o-so-successful at removing the term tenant from peoples vocab | 18:27 |
| *** gokrokve has joined #openstack-dev | 18:27 | |
| *** saju_m has joined #openstack-dev | 18:29 | |
| *** zzelle has joined #openstack-dev | 18:30 | |
| tellesnobrega | ayoung: our concept would be something like this http://postimg.org/image/7ds2fqfa5/ | 18:30 |
| tellesnobrega | raildo: | 18:30 |
| raildo | I strongly believe that to have hierarchical projects, we need not remove domains, are two different things | 18:31 |
| *** e0ne_ has quit IRC | 18:31 | |
| ayoung | tellesnobrega, um...the link you just sent me had some interesting adverts at the bottom. | 18:31 |
| *** e0ne has joined #openstack-dev | 18:31 | |
| *** alexpilotti has joined #openstack-dev | 18:31 | |
| *** yjiang51 has quit IRC | 18:32 | |
| *** bdpayne has quit IRC | 18:32 | |
| tellesnobrega | ayoung: sorry about that, adblock worked good for me here | 18:32 |
| tellesnobrega | http://s30.postimg.org/akmlzczq9/desing_2.png | 18:32 |
| *** galstrom is now known as galstrom_zzz | 18:33 | |
| ayoung | tellesnobrega, but having the root be something implicit, with domains underneath and then projects would work fine by me. I'm not the one you need to convince | 18:34 |
| *** CaptTofu has joined #openstack-dev | 18:34 | |
| *** bdpayne has joined #openstack-dev | 18:34 | |
| *** sarob has joined #openstack-dev | 18:34 | |
| *** jordanP has quit IRC | 18:35 | |
| tellesnobrega | ayoung: i'm counting on you as a good support to convince others | 18:35 |
| raildo | +1 | 18:35 |
| *** sweston has joined #openstack-dev | 18:35 | |
| *** rwsu has quit IRC | 18:36 | |
| ayoung | Heh | 18:37 |
| ayoung | I think you greatly overestimate my influence. | 18:37 |
| *** jdob_ has quit IRC | 18:37 | |
| *** jdob has joined #openstack-dev | 18:37 | |
| tellesnobrega | the deadline for the summit is really up and we need to define it quickly, and i believe that this way is more doable and may be accepted for juno still | 18:38 |
| *** spzala has joined #openstack-dev | 18:38 | |
| *** yjiang51 has joined #openstack-dev | 18:39 | |
| *** pschaef has quit IRC | 18:39 | |
| *** gokrokve has quit IRC | 18:40 | |
| *** ijw_ has joined #openstack-dev | 18:41 | |
| raildo | dolphm: you could analyze this proposed solution? http://s30.postimg.org/akmlzczq9/desing_2.png | 18:42 |
| *** Gordonz has quit IRC | 18:43 | |
| *** Gordonz_ has joined #openstack-dev | 18:43 | |
| *** Sukhdev has joined #openstack-dev | 18:43 | |
| *** eglynn has joined #openstack-dev | 18:44 | |
| *** ijw has quit IRC | 18:44 | |
| *** MaxV has joined #openstack-dev | 18:45 | |
| *** zigo has quit IRC | 18:45 | |
| *** nermina has quit IRC | 18:46 | |
| *** sushil_ has quit IRC | 18:46 | |
| *** haleyb has quit IRC | 18:46 | |
| *** nermina has joined #openstack-dev | 18:47 | |
| *** dvarga is now known as dvarga|away | 18:48 | |
| *** dvarga|away is now known as dvarga | 18:48 | |
| *** sushils has joined #openstack-dev | 18:48 | |
| *** capri has quit IRC | 18:49 | |
| *** gokrokve has joined #openstack-dev | 18:49 | |
| *** zigo has joined #openstack-dev | 18:49 | |
| *** eglynn has quit IRC | 18:50 | |
| *** ijw_ has quit IRC | 18:51 | |
| *** rwsu has joined #openstack-dev | 18:51 | |
| *** saju_m has quit IRC | 18:51 | |
| *** capri has joined #openstack-dev | 18:52 | |
| *** saju_m has joined #openstack-dev | 18:53 | |
| *** taps has joined #openstack-dev | 18:53 | |
| *** jamieh has joined #openstack-dev | 18:53 | |
| *** morganfainberg_Z is now known as morganfainberg | 18:53 | |
| *** capri has quit IRC | 18:53 | |
| *** bashok has joined #openstack-dev | 18:53 | |
| *** burt1 has quit IRC | 18:53 | |
| morganfainberg | dolphm, o/ | 18:54 |
| morganfainberg | dolphm, i don't remember my other idea :( | 18:54 |
| morganfainberg | tellesnobrega, ^ | 18:54 |
| morganfainberg | so... | 18:54 |
| morganfainberg | go for making them projects! | 18:54 |
| morganfainberg | :) | 18:54 |
| *** MaxV has quit IRC | 18:54 | |
| *** capri has joined #openstack-dev | 18:55 | |
| *** jruzicka has quit IRC | 18:55 | |
| *** sweston has quit IRC | 18:56 | |
| *** pmathews has quit IRC | 18:56 | |
| tellesnobrega | we don't think that is the best approach | 18:56 |
| tellesnobrega | what about all other implementations that use domains | 18:57 |
| *** troytoman-away is now known as troytoman | 18:57 | |
| tellesnobrega | and making them projects will bring a huge change in keystone checking if its a project with or without a parent_id | 18:57 |
| *** saju_m has quit IRC | 18:58 | |
| tellesnobrega | and probably would only be accepted for k which is pretty far away | 18:58 |
| morganfainberg | tellesnobrega, sure. - like i said, i dont... really remember what my other idea was | 18:58 |
| tellesnobrega | keeping domains we can change a little and may yet be accepted for juno | 18:58 |
| ayoung | morganfainberg, dstanek dolphm, if I import versionutils from oslo (to get deprecation) I need to pull in logging as well. Is there any drawback to pulling oslo logging into our client? | 18:58 |
| *** lucas-afk is now known as lucasagomes | 18:59 | |
| morganfainberg | tellesnobrega, Juno is pretty wide open. i don't know if you'd have an issue | 18:59 |
| *** otherwiseguy has quit IRC | 18:59 | |
| ayoung | tellesnobrega, the deadline for the summit is not up | 18:59 |
| morganfainberg | ayoung, hm.. shouldn't be. | 18:59 |
| tellesnobrega | by up i meant close | 18:59 |
| ayoung | only for "talks" which is the non-deveoper-we-do-not-care-about-you side | 18:59 |
| ayoung | for the dev side...we haven;t even begun to submit sessions | 18:59 |
| morganfainberg | tellesnobrega, you have untile ~J2 milestone | 19:00 |
| *** sushils has quit IRC | 19:00 | |
| ayoung | that will happen ... in about two months | 19:00 |
| morganfainberg | tellesnobrega, i do it the "right way" even if its a lot of restructure | 19:00 |
| *** hartsocks has quit IRC | 19:00 | |
| morganfainberg | tellesnobrega, unless it is a API breaking change | 19:00 |
| ayoung | morganfainberg, you hate the word domains | 19:00 |
| ayoung | you are not to be trusted | 19:00 |
| *** yjiang51 has quit IRC | 19:00 | |
| *** johnthetubaguy has quit IRC | 19:00 | |
| *** kenperkins_ has quit IRC | 19:00 | |
| tellesnobrega | ayoung: ++ | 19:00 |
| ayoung | domains are part of the verbiage | 19:00 |
| *** sahid has quit IRC | 19:00 | |
| ayoung | and we've done that to ourselves | 19:01 |
| morganfainberg | ayoung, i do not hate the word domains, i hate our usage of it in multiple contexts | 19:01 |
| ayoung | blame gyee as he is the one that forced it through | 19:01 |
| morganfainberg | ayoung, and we (someday) need to dig ourselves out of this hole | 19:01 |
| ayoung | morganfainberg, and you are esposing removing it from both identity and now assignments | 19:01 |
| *** Svedrin has quit IRC | 19:01 | |
| *** kenperkins has joined #openstack-dev | 19:01 | |
| *** sarob has quit IRC | 19:01 | |
| morganfainberg | ayoung, but i already gave up on the identity one | 19:01 |
| ayoung | morganfainberg, the only hole is in your mind | 19:01 |
| *** ssurana has quit IRC | 19:01 | |
| *** jaybuff has quit IRC | 19:01 | |
| ayoung | wait, that sounded worse than I...ah I'll just run with it | 19:01 |
| morganfainberg | ayoung, phsaw, | 19:01 |
| morganfainberg | ayoung, :P | 19:01 |
| *** markmcclain has quit IRC | 19:01 | |
| *** ssurana1 has joined #openstack-dev | 19:02 | |
| *** kgriffs is now known as kgriffs_afk | 19:02 | |
| ayoung | morganfainberg, seriously, though, I don't think there is anything wrong with saying that, in OpenStack, things are owned by domains | 19:02 |
| *** markmcclain has joined #openstack-dev | 19:02 | |
| morganfainberg | and if we are restructuring things in assignment to where projects are nested, are domains "relevant"... or is a domain just a root-less project | 19:02 |
| ayoung | projects or users | 19:02 |
| morganfainberg | ayoung, i'm not advocating removing the terminology atm. | 19:02 |
| *** haleyb has joined #openstack-dev | 19:02 | |
| ayoung | morganfainberg, I see a domain as like a ... mountpoint? Nah, supermount? Something out of vfs | 19:03 |
| morganfainberg | ayoung, but we suck at communicating domains | 19:03 |
| *** MaxV has joined #openstack-dev | 19:03 | |
| *** Svedrin has joined #openstack-dev | 19:03 | |
| morganfainberg | ayoung, so either we need to get much much better at that, clarify how domains work, or remove some of the scope | 19:03 |
| *** ijw has joined #openstack-dev | 19:03 | |
| ayoung | something with the "inator suffix" --Dr. Heinz Doofenshmirtz | 19:04 |
| ayoung | We just suck. | 19:04 |
| *** ssurana has joined #openstack-dev | 19:04 | |
| gyee | ayoung, say what? | 19:04 |
| *** AlexF has quit IRC | 19:04 | |
| *** johnthetubaguy has joined #openstack-dev | 19:04 | |
| morganfainberg | ayoung, i think my biggest issue is that a single domain contains differing types of data and that becomes harder with the identity / assignment split | 19:04 |
| gyee | morganfainberg, domains give order to chaos | 19:05 |
| morganfainberg | gyee, not really. | 19:05 |
| morganfainberg | gyee, they give different chaos ;) | 19:05 |
| gyee | I am all ears | 19:05 |
| ayoung | morganfainberg, and the mistake there was that we didn;t specify what domain we were talking about on APIs that referereed to multiple objects | 19:05 |
| morganfainberg | ayoung, ++ | 19:05 |
| ayoung | morganfainberg, not that we have a concept of a root for the tree. | 19:05 |
| gyee | conceptually, they are the same froggin thing | 19:05 |
| gyee | containers | 19:06 |
| ayoung | or a namespace | 19:06 |
| ayoung | gyee, I am actually in your camp, just want to redirect the ire toward you that I am fielding | 19:06 |
| gyee | ayoung, you smart man :) | 19:06 |
| * gyee takes one for the team | 19:06 | |
| raildo | hahahahaha | 19:07 |
| *** noslzzp has quit IRC | 19:07 | |
| tellesnobrega | lol | 19:07 |
| morganfainberg | gyee, sorry, no ire for you *sends more ire to ayoung* | 19:07 |
| ayoung | "Curse you perry the platypus!" | 19:07 |
| morganfainberg | ayoung, i can tell you have kids | 19:08 |
| morganfainberg | ayoung, ;) | 19:08 |
| morganfainberg | ayoung, you often sound very similar (when referencing cartoons) to my friends with kids... | 19:08 |
| *** kgriffs_afk is now known as kgriffs | 19:08 | |
| gyee | I tell my kids I often give people the "brother finger" for things I don't like | 19:08 |
| ayoung | Phineas and Ferb is one of the more interesting cartoons to come out. | 19:08 |
| ayoung | recently | 19:08 |
| *** yjiang51 has joined #openstack-dev | 19:09 | |
| *** praneshp_ has joined #openstack-dev | 19:09 | |
| morganfainberg | ayoung, some programming is good, some is terrible... most of it is in the latter camp (unfortunately) | 19:09 |
| morganfainberg | doesn't matter what age-group youre targeting | 19:09 |
| *** blentz has joined #openstack-dev | 19:09 | |
| *** jruzicka has joined #openstack-dev | 19:09 | |
| ayoung | "That is why I invented the Keystoninator, so I could control all of the identities in the TRI STATE AREA!": | 19:09 |
| *** jaybuff has joined #openstack-dev | 19:09 | |
| morganfainberg | ayoung, lol | 19:10 |
| morganfainberg | aaaaaanannyyy way | 19:10 |
| *** jaybuff has left #openstack-dev | 19:10 | |
| morganfainberg | so, are domains just parentless projects in assingmnet? do they belong in the "domains" table? [no i am not saying remove the domain concept... just possibly change the structure based upon the hiearchy proposal] | 19:10 |
| *** carl_baldwin has quit IRC | 19:11 | |
| ayoung | morganfainberg, we are the container store. Keystone provides containers. Domains are containers that hold other containers, and keep your containers contained. | 19:11 |
| morganfainberg | ayoung, still didn't answer my quesiton | 19:11 |
| morganfainberg | ayoung, and no we're not the container store. | 19:12 |
| *** praneshp has quit IRC | 19:12 | |
| *** praneshp_ is now known as praneshp | 19:12 | |
| ayoung | morganfainberg, sorry, I read "parentless" as "pointless" | 19:12 |
| morganfainberg | ayoung, hehe | 19:12 |
| ayoung | I think we want to have a domain table, and use it to point to both the projects in the domain and the backing store for the identites for the domain | 19:12 |
| ayoung | projects don't own users, but domain od | 19:13 |
| ayoung | do | 19:13 |
| *** eglynn has joined #openstack-dev | 19:13 | |
| ayoung | so they are something more than "just" projects | 19:13 |
| morganfainberg | ayoung, and a single domain can own users and projects? | 19:13 |
| ayoung | morganfainberg, perhaps clearer to say | 19:13 |
| morganfainberg | ayoung, or .. can they only contain one type of "thing" | 19:13 |
| ayoung | a domain has a set of users and a set of projects | 19:13 |
| *** sarob has joined #openstack-dev | 19:13 | |
| ayoung | morganfainberg, one thing else | 19:14 |
| *** jaybuff has joined #openstack-dev | 19:14 | |
| ayoung | we might want to say that domains can contain roles | 19:14 |
| *** ramishra has quit IRC | 19:14 | |
| ayoung | not role assignments, roles. | 19:14 |
| morganfainberg | ayoung, that i can be behind actually | 19:14 |
| ayoung | cue atiwari | 19:14 |
| morganfainberg | ayoung, and if it doesn't contain role assignments... | 19:14 |
| *** ramishra has joined #openstack-dev | 19:14 | |
| morganfainberg | ayoung, i think that helps some. | 19:14 |
| atiwari | ayoung, yes | 19:15 |
| morganfainberg | ayoung, though, i think domains should be moved out of assignment (not logically, code wise - i don't care) but documentation/concept wise in that case. make them really the container | 19:15 |
| morganfainberg | ayoung, based on that last set of possibilities | 19:15 |
| *** pablosan has joined #openstack-dev | 19:16 | |
| morganfainberg | ayoung, but i think we can circle back on that when we get to J | 19:16 |
| morganfainberg | ayoung, or K | 19:16 |
| morganfainberg | or...whenever | 19:16 |
| *** pablosan has quit IRC | 19:17 | |
| *** ssurana has quit IRC | 19:17 | |
| ayoung | morganfainberg, so, I am kindof in agreement, except that I like the idea of there being integrity constraints on project->domain but I could see a case where, say for LDAP, even some assignment data was kept in LDAP | 19:17 |
| *** pablosan has joined #openstack-dev | 19:17 | |
| ayoung | so..yeah, domain table could be split | 19:17 |
| morganfainberg | ayoung, LDAP is a special case - there are exceptions to the rule | 19:18 |
| morganfainberg | ayoung, LDAP != RDBMS | 19:18 |
| morganfainberg | ayoung, so i think we can bend those rules | 19:18 |
| morganfainberg | ayoung, where appropriate. | 19:18 |
| ayoung | morganfainberg, domain is the point where we link in disjoint datastores | 19:18 |
| morganfainberg | ayoung, ++ | 19:18 |
| gyee | morganfainberg, you'd be surprise how many IdPs use LDAP backend! | 19:18 |
| morganfainberg | ayoung, i like that description WAY more than what we have | 19:18 |
| morganfainberg | gyee, nope | 19:18 |
| ayoung | I'd be OK with splitting domains off of assignments, | 19:18 |
| morganfainberg | gyee, i'd assume most of them | 19:18 |
| *** johnthetubaguy has quit IRC | 19:19 | |
| gyee | morganfainberg, exactly | 19:19 |
| ayoung | and then...roles stay with assignments | 19:19 |
| gyee | lets shiop OpenLDAP for Identity Management :) | 19:19 |
| morganfainberg | gyee, doesn't mean we don't have a logical structure in keystone that makes domain (as ayoung put it) "domain is the point where we link in disjoint datastores" | 19:19 |
| *** mikeoutland has quit IRC | 19:20 | |
| ayoung | so for atiwari's use case of "service defined role" it is a case of "one service = one domain" and thus we maintain domain as the top level container | 19:20 |
| *** yeylon__ has joined #openstack-dev | 19:20 | |
| gyee | morganfainberg, I am concerned with administrative and authorization boundaries | 19:21 |
| morganfainberg | ayoung, sure. that makes sense to me. | 19:21 |
| morganfainberg | gyee, we have those lines massively blurred at the moment | 19:21 |
| ayoung | so...role definitions would be per domain....with a common set precreated? | 19:21 |
| ayoung | hmmmm | 19:21 |
| ayoung | need to chew on that | 19:21 |
| morganfainberg | gyee, i think this helps define those. | 19:21 |
| morganfainberg | ayoung, i think that might be a lot of administrative overhead. | 19:21 |
| ayoung | morganfainberg, yeah, it doens't feel right | 19:22 |
| morganfainberg | ayoung, i'm not opposed to it conceptually.. | 19:22 |
| morganfainberg | ayoung, but - i feel like it's lacking something | 19:22 |
| ayoung | morganfainberg, role-defs should be default global | 19:22 |
| morganfainberg | ayoung, i wonder if there is a middle ground. | 19:22 |
| ayoung | I would think that a domain inherits the global list of role defs, but allows its own as well | 19:22 |
| morganfainberg | ayoung, hrmmm. | 19:22 |
| gyee | ayoung, how does it solved the problem with service role clash? | 19:23 |
| morganfainberg | ayoung, perhaps. - but i think we need to get into per-domain policy then -- | 19:23 |
| atiwari | ayoung, I was not proposing service linking with domain | 19:23 |
| atiwari | just service and role definition | 19:23 |
| morganfainberg | ayoung, i don't see how domains defining their own roles will make a big difference in usability atm | 19:23 |
| *** bhuvan has quit IRC | 19:23 | |
| *** jaybuff has quit IRC | 19:23 | |
| *** martyntaylor has quit IRC | 19:24 | |
| morganfainberg | ayoung, or are you saying nova would define it's set of roles in this setup? atiwari ^ | 19:24 |
| ayoung | atiwari so you are proposing that the service has its own namespace for roles. And I am trying to generalize that solution. Domains are our current "top level namespace" and I am plying around with the cleanest implementation | 19:24 |
| ayoung | morganfainberg, so he wants to be able to define a new service, and then define a role that only applies to that servcie | 19:24 |
| morganfainberg | ohhh | 19:25 |
| gyee | morganfainberg, not just nova, the non-infra services such as *aaS | 19:25 |
| morganfainberg | OH! | 19:25 |
| ayoung | so instead of having nova_admin, keystone_admin | 19:25 |
| *** Sumeniac has quit IRC | 19:25 | |
| morganfainberg | ayoung, ok ok that makes sense | 19:25 |
| ayoung | there would be an admin role, but it would only apply to nova calls | 19:25 |
| *** epim has joined #openstack-dev | 19:25 | |
| atiwari | correct, generic name space will work for service and domain/project scoped roles | 19:25 |
| *** jckasper has quit IRC | 19:25 | |
| ayoung | my complaint is that it was too focused | 19:25 |
| morganfainberg | so, cloud-specific roles are deployer "global" and extra services would be self-defined? | 19:25 |
| ayoung | the same could be said to apply to a subset of a given service | 19:25 |
| *** melwitt has joined #openstack-dev | 19:25 | |
| ayoung | or to a set of related services | 19:25 |
| *** Gordonz has joined #openstack-dev | 19:25 | |
| *** Gordonz has quit IRC | 19:25 | |
| atiwari | like https://review.openstack.org/#/c/61897/4/openstack-identity-api/v3/src/markdown/identity-api-v3-os-ns-roles-ext.md | 19:26 |
| *** Sumeniac has joined #openstack-dev | 19:26 | |
| *** Gordonz has joined #openstack-dev | 19:26 | |
| morganfainberg | ayoung, ok yes, i agree | 19:26 |
| ayoung | I like the idea, but am not in favor of treating "service" as special, and atiwari and I have not yet come to an agreement. | 19:26 |
| *** beagles is now known as beagles_brb | 19:26 | |
| morganfainberg | ayoung, there should be common roles for a group of services | 19:26 |
| *** capri has quit IRC | 19:27 | |
| ayoung | and that is orthoganal to "this set of projects" or "this set of users" | 19:27 |
| morganfainberg | ayoung, having to define roles for nova, keystone, etc all separately is way way deployer-unfriendly | 19:27 |
| morganfainberg | atiwari, gyee ^ | 19:27 |
| morganfainberg | and what if you are deploying a new service that you want to just use the same roles as a previous one | 19:27 |
| ayoung | morganfainberg, right...we want to be able to support his use case but not force it on the world | 19:27 |
| morganfainberg | ayoung, ++ | 19:28 |
| ayoung | ++ | 19:28 |
| ayoung | that is it exactly | 19:28 |
| ayoung | or, what if you have a specialized version of a service and you want to define a new role just for that endpoint | 19:28 |
| ayoung | or even a subset of endpoints | 19:28 |
| *** NikitaKonovalov_ is now known as NikitaKonovalov | 19:28 | |
| *** NikitaKonovalov is now known as NikitaKonovalov_ | 19:28 | |
| ayoung | say you have a specialized glance service that is for HPC. You could make an HPC namespace and add the roles to that | 19:28 |
| *** capri has joined #openstack-dev | 19:29 | |
| atiwari | http://paste.openstack.org/show/63974/ is what I was proposing for generic name space roles | 19:29 |
| *** Gordonz_ has quit IRC | 19:29 | |
| ayoung | looking | 19:29 |
| * morganfainberg looking too | 19:29 | |
| atiwari | ayoung and morganfainberg ^^^ | 19:29 |
| ayoung | too hard coded. | 19:29 |
| ayoung | atiwari, but... | 19:29 |
| atiwari | qname can be remove if name can handle the namespaceing | 19:30 |
| ayoung | Henrynash is working on the normalization of the role assignments, and maybe we could do something comparable .... "type" with a known set of types | 19:30 |
| *** Alexei_987 has joined #openstack-dev | 19:30 | |
| *** thedodd has quit IRC | 19:30 | |
| ayoung | atiwari, qname menas qualified name? | 19:30 |
| atiwari | correct | 19:31 |
| atiwari | one can define policy with qname or name | 19:31 |
| gyee | morganfainberg, here are the glory details of the role overlap problem https://bugs.launchpad.net/keystone/+bug/890411 | 19:31 |
| ayoung | atiwari, so...I was thinking instead something like this | 19:31 |
| uvirtbot | Launchpad bug 890411 in keystone "Tenant role conflicts/overlaps can be a security issue" [Medium,Confirmed] | 19:31 |
| ayoung | namespace_id = | 19:31 |
| *** galstrom_zzz is now known as galstrom | 19:31 | |
| morganfainberg | gyee, oh this discussion? | 19:31 |
| ayoung | and that goes on the role def | 19:31 |
| gyee | morgainfainberg, ayoung, atiwari, I am fine with namespacing | 19:31 |
| morganfainberg | gyee, yeah. | 19:31 |
| ayoung | then namespace is a top level object | 19:31 |
| morganfainberg | ayoung, ++ | 19:31 |
| ayoung | so you would look from role-def to namespace. | 19:32 |
| *** yjiang51 has quit IRC | 19:32 | |
| ayoung | but we already have a namespace in domain, so before we add a new concept...lets se if that fits better | 19:32 |
| *** mikeoutland has joined #openstack-dev | 19:32 | |
| atiwari | ayoung , you are proposing new resource call namesapce | 19:32 |
| atiwari | ? | 19:32 |
| morganfainberg | ayoung, i am sure domains can fit this bill. but conceptually is it the right place to put it (no strong feelings yet one-way-or-another) | 19:32 |
| *** ruhe_ has joined #openstack-dev | 19:32 | |
| ayoung | morganfainberg, what if we thought about it this way | 19:33 |
| morganfainberg | atiwari, domains are effectively that now....and more so with the previous discussion | 19:33 |
| gyee | morganfainber, so there are essentially two problems we are trying to solve: 1) mitigating the role conflicts, and 2) enable the services to define their roles | 19:33 |
| ayoung | existing role-defs belong to the default domain | 19:33 |
| morganfainberg | erm, in scope of the earlier discussion | 19:33 |
| morganfainberg | gyee, right. | 19:33 |
| ayoung | any new role defs we create can belong to smaller scoped domains | 19:33 |
| ayoung | gyee, so I have a problem with defining the argument in terms of "the services" as I see that as only a subset of the usecases | 19:34 |
| gyee | I know ayoung hates metadata, but this is like adding metadata to role defs | 19:34 |
| ayoung | endpoints, services, or a set of services should have the flexibility as well | 19:34 |
| morganfainberg | ayoung, and roles are scoped to the domain they exisit in (default being the exceptional case since they cascade out)? | 19:34 |
| ayoung | gyee, so, what if we put all these things into a domain | 19:34 |
| gyee | ayoung, services = infra services and *aaS | 19:35 |
| ayoung | a specific endpoint, a specific service, or even a set of either one | 19:35 |
| ayoung | the existing set of services and endpoints also go into the default domain | 19:35 |
| *** chris_johnson is now known as wchrisj|away | 19:35 | |
| ayoung | but to support atiwari 's use case, if I want a service specific role name, I create a domain for just that service, as well as all of the endpoints of that service | 19:36 |
| gyee | one drawback with namespacing is that policy enforcement will become complex | 19:36 |
| ayoung | gyee, so...policy files for an endpoint also go into the domain | 19:37 |
| ayoung | everything has a domain id! | 19:37 |
| gyee | ayoung, if I understand you correctly, domain = separatable service? | 19:38 |
| atiwari | ayoung, can all service falls under one domain? | 19:38 |
| ayoung | gyee, I would not say " | 19:38 |
| ayoung | atiwari, *can* yes, but not *have to* | 19:38 |
| *** markmcclain has quit IRC | 19:38 | |
| ayoung | gyee I would not say = | 19:38 |
| *** saju_m has joined #openstack-dev | 19:38 | |
| ayoung | I would say that "to do a separatable service put it into its own domain" | 19:39 |
| ayoung | which is, I think, what you were really asking gyee | 19:39 |
| *** hartsocks has joined #openstack-dev | 19:39 | |
| *** MaxV has quit IRC | 19:39 | |
| *** sweston has joined #openstack-dev | 19:40 | |
| *** ssurana has joined #openstack-dev | 19:40 | |
| *** schwicht has joined #openstack-dev | 19:40 | |
| *** zaitcev has joined #openstack-dev | 19:41 | |
| *** ijw has quit IRC | 19:41 | |
| gyee | ayoung, separate domain for a service won't work as services are global | 19:41 |
| gyee | services are shared resource | 19:41 |
| atiwari | gyee ++ | 19:41 |
| ayoung | gyee, they don;t have to be | 19:41 |
| *** godara has joined #openstack-dev | 19:41 | |
| atiwari | that where I can not able to link | 19:41 |
| *** ijw has joined #openstack-dev | 19:41 | |
| ayoung | atiwari, wha> | 19:42 |
| gyee | can't isolate nova in a domain, for example | 19:42 |
| morganfainberg | gyee, you're asking for services to be shared but roles to not be? or am i totally missing the discussion? | 19:42 |
| ayoung | wath was that? | 19:42 |
| *** wchrisj|away is now known as chris_johnson | 19:42 | |
| * morganfainberg is lost now. | 19:42 | |
| *** otherwiseguy has joined #openstack-dev | 19:42 | |
| atiwari | ayoung, in an OS deployment services are global resource | 19:42 |
| gyee | morganfainberg, who consume the roles? | 19:42 |
| ayoung | atiwari, in an OS deployment roles are global | 19:43 |
| gyee | services middleware/policy.json correct? | 19:43 |
| morganfainberg | gyee, sure. | 19:43 |
| atiwari | and I am lost when you say domain per service | 19:43 |
| ayoung | lets not be beholden to the sins of the past | 19:43 |
| gyee | morganfainberg, roles are for the services really | 19:43 |
| morganfainberg | gyee, so, what is wrong with namspacing the roles? you are still validating against an assignment for that service - a mapping of user/group to role, whether the role is global, isolated, inherited, etc | 19:44 |
| ayoung | QOTD " Brace yourself... systemd based Debian is coming" | 19:44 |
| *** Mandell has joined #openstack-dev | 19:44 | |
| morganfainberg | ayoung, because i was so unhappy w/ sysv init | 19:44 |
| morganfainberg | ayoung, *rolls eyes* though, i do like systemd more than upstart personally | 19:44 |
| ayoung | atiwari, OK...so you have the use case where someone says "I have a new service and to manage it, I need to give someone the 'admin' role but I want it to be a separate 'admin' role than the rest of Open Stack uses." | 19:45 |
| *** ijw has quit IRC | 19:46 | |
| ayoung | morganfainberg, I think it was a change that was painful due to how long the old system stayed around, but probably necessary. Socket activation is probably the compelling argument...but systemd aside.... | 19:46 |
| *** thuc has quit IRC | 19:46 | |
| atiwari | ayoung, correct and all roles for that service should be scoped to that only | 19:46 |
| *** ramishra has quit IRC | 19:46 | |
| *** thuc has joined #openstack-dev | 19:46 | |
| atiwari | so that no other service useses it for role assignments | 19:47 |
| gyee | morganfainberg, we need the granularity of assigning a role to a user/group for a project to use a given service or endpoint | 19:47 |
| *** DinaBelova is now known as DinaBelova_ | 19:47 | |
| morganfainberg | ayoung, sure | 19:48 |
| gyee | namspacing should get us there, but need more thought | 19:48 |
| ayoung | atiwari, so I think that you have fixated on "service" there and that is too narrow an approach. We wrat the service with a namespace and get the same effect, but now with a way to both grow or shrink the scope of that decision | 19:48 |
| *** zigo has quit IRC | 19:48 | |
| ayoung | atiwari, let me make it concrete | 19:48 |
| ayoung | you havea user come and add a new...photo services | 19:49 |
| ayoung | and they get the role admin for that | 19:49 |
| ayoung | now they realize they also want to have a music service | 19:49 |
| ayoung | and all the same roles apply | 19:49 |
| ayoung | either you duplicate, or you expand | 19:49 |
| gyee | ayoung, we need assignment as (user, role, project, service) or (user, role, project, service, endpoint) | 19:49 |
| atiwari | let me resd | 19:50 |
| atiwari | read | 19:50 |
| morganfainberg | gyee, ok, i see what you're going for, but i think you're going to make this very hard to managed and ultimately. | 19:50 |
| morganfainberg | not as usable* | 19:50 |
| ayoung | so..if you started by putting the photo service in a domain it would be "add the music service to that domain" | 19:50 |
| *** tjones has joined #openstack-dev | 19:50 | |
| ayoung | gyee, so, no | 19:50 |
| gyee | morganfainberg, that's the challenge, make it work and simple | 19:50 |
| ayoung | assignment is role, user, project. or role, user, domain | 19:50 |
| *** thuc has quit IRC | 19:50 | |
| ayoung | and applies to the objects inside that domain | 19:51 |
| atiwari | ayoung, problem start when music and picture service want to rename their roles | 19:51 |
| morganfainberg | gyee, but wouldn't it just make more sense to make an assignment user/group - role - service? | 19:51 |
| *** tkay has joined #openstack-dev | 19:51 | |
| morganfainberg | gyee, rather than user in project -> service? | 19:51 |
| atiwari | admin = madmin/padmin | 19:51 |
| morganfainberg | gyee, again, i feel like i'm missing some context. | 19:51 |
| ayoung | morganfainberg, the role needs to get resolved at the endpoint, but that should not be how it is assigned | 19:52 |
| bknudson | I don't even see what the point of domains is if you've got federation | 19:52 |
| atiwari | second there is no way we can solve admin-ness with same role name for both | 19:52 |
| ayoung | it get assigned to the user/project, with project being a cross cutting concern | 19:52 |
| morganfainberg | bknudson, i tried to make that argument at one point. - i'm fine with leaving domain concept in. | 19:52 |
| ayoung | bknudson, Federation just calls them IdPs but the same problem exisits, | 19:52 |
| gyee | bknudson, public clouds link domain to IdP | 19:53 |
| *** johnthetubaguy has joined #openstack-dev | 19:53 | |
| bknudson | multiple idps in a domain? | 19:54 |
| bknudson | or multiple domains in an idp? | 19:54 |
| gyee | bknudson, highly unlikely | 19:54 |
| *** kenperkins_ has joined #openstack-dev | 19:54 | |
| *** DinaBelova_ is now known as DinaBelova | 19:54 | |
| ayoung | multiple domains in an IdP | 19:54 |
| ayoung | potential, but unlikely | 19:54 |
| ayoung | and no multiple IdPs per domain | 19:54 |
| ayoung | domain is a Keystone concept to knit together things | 19:55 |
| morganfainberg | bknudson, unrelated, good catch on the RBAC for v3 ec2 stuff. thanks! :) | 19:55 |
| ayoung | like IdPs and projects and roles and whiskers on kittens, bright copper kettles... | 19:55 |
| bknudson | morganfainberg: it was when you said that we needed policy_api to require admin. | 19:55 |
| morganfainberg | bknudson, yeah totally missed it. :) | 19:55 |
| *** eglynn has quit IRC | 19:56 | |
| morganfainberg | bknudson, this is why we have code reviews! | 19:56 |
| gyee | morganfainberg, I think atiwari's wiki documented the role use cases | 19:56 |
| morganfainberg | bknudson, you think the same RBAC constructs as credential are sufficient, or does it need it's own? | 19:56 |
| gyee | atiwari, you have the link handy? | 19:56 |
| atiwari | 1 sec | 19:57 |
| morganfainberg | gyee, i've read it. i still feel like i'm missing some context. | 19:57 |
| ayoung | Heh, the guy that voices Ferb has green hair | 19:57 |
| morganfainberg | gyee, it seems like the use case is ultra-narrow | 19:57 |
| atiwari | link: https://blueprints.launchpad.net/keystone/+spec/name-spaced-roles | 19:57 |
| bknudson | morganfainberg: I didn't think about it much so don't know what the details are... I assume we have new lines in policy.json for each of the operations | 19:57 |
| morganfainberg | gyee, and will make working with roles in general onerous for OS and a deployer | 19:57 |
| *** kenperkins has quit IRC | 19:57 | |
| * ayoung fears the word credentials | 19:57 | |
| atiwari | gyee ^^^ | 19:57 |
| morganfainberg | bknudson, ah fair point. new lines in policy = new RBAC entries | 19:58 |
| morganfainberg | bknudson, thanks :) | 19:58 |
| ayoung | http://en.wikipedia.org/wiki/Credential | 19:58 |
| *** markmcclain has joined #openstack-dev | 19:58 | |
| morganfainberg | bknudson, even if they just leverage an already existing rule e.g. is_admin_or_owner | 19:58 |
| atiwari | RFE bug https://bugs.launchpad.net/keystone/+bug/1270926 | 19:58 |
| morganfainberg | or whathavetyou | 19:58 |
| uvirtbot | Launchpad bug 1270926 in keystone "[RFE] Enhancement needed on role data model to support name-spaced roles" [Wishlist,Confirmed] | 19:58 |
| *** eglynn has joined #openstack-dev | 19:58 | |
| ayoung | RBAC is authorization attributes but not authentication, and we use the two terms way too interchangeably. | 19:58 |
| bknudson | morganfainberg: I'm not sure that we really have another way to do it... and yes I'd expect some existing rules would be used. | 19:59 |
| morganfainberg | bknudson, yep. it's been a while since i poked at the enforce stuff | 19:59 |
| bknudson | I'm not sure that we can have separate operations use the same rule in policy.json. | 19:59 |
| morganfainberg | bknudson, trying to get abck to it :) | 19:59 |
| *** jaybuff has joined #openstack-dev | 19:59 | |
| bknudson | morganfainberg: I'm guessing there will be less common code... it was kind of nice the way it was. | 19:59 |
| morganfainberg | bknudson, yeah it'll break things up some unfortunately :( | 20:00 |
| ayoung | http://en.wikipedia.org/wiki/Credential#Cryptography Keystone token should not be considered is a credential by this definition. | 20:00 |
| gyee | morganfainberg, unless we are introducing Keystone as a Service, I don't know how to separate OS and deployers | 20:00 |
| ayoung | But we treat them as such | 20:00 |
| *** glenng has joined #openstack-dev | 20:00 | |
| morganfainberg | bknudson, i might be able to do a little magic wrapper that does the work (like the deprecate __getattribute__ thing) | 20:01 |
| morganfainberg | bknudson, looking into what it's going to take | 20:01 |
| *** pmathews has joined #openstack-dev | 20:01 | |
| *** saju_m has quit IRC | 20:01 | |
| gyee | ayoung, why are we linking ec2 key with trust? | 20:01 |
| *** openstack has joined #openstack-dev | 21:33 | |
| -dickson.freenode.net- [freenode-info] channel trolls and no channel staff around to help? please check with freenode support: http://freenode.net/faq.shtml#gettinghelp | 21:33 | |
| *** hartsocks has joined #openstack-dev | 21:33 | |
| stevemar | dolphm ++ | 21:34 |
| stevemar | ayoung, he's probably sleeping, euro time | 21:34 |
| marekd | stevemar: i am here. | 21:34 |
| stevemar | marekd :O | 21:34 |
| stevemar | dolphm, so just user name with domain, and user id -- really? | 21:35 |
| marekd | stevemar: doing the same thing when I see your patches added at 6am my time which means it's...midnight or 1am your time? :P | 21:35 |
| *** tanisdl has quit IRC | 21:35 | |
| stevemar | marekd, who needs sleep right | 21:36 |
| marekd | stevemar: i do :( | 21:36 |
| dolphm | stevemar: if you can just do user_id, i'd just stick with that | 21:36 |
| *** cnesa has quit IRC | 21:36 | |
| stevemar | dolphm, fair enough | 21:36 |
| ayoung | marekd, so...why a new controller? | 21:36 |
| dolphm | stevemar: pick the easy one: (user_name + domain_id) || (user_name + domain_name) || (user_id) | 21:37 |
| stevemar | user_id it is! | 21:37 |
| stevemar | dolphm, and gyee's request? me think it's out of scope | 21:37 |
| *** martyntaylor has joined #openstack-dev | 21:37 | |
| *** omachace has left #openstack-dev | 21:38 | |
| marekd | ayoung: because it's functionalities didn't fit (IMHO) to any other already existing controller in the federation... | 21:38 |
| ayoung | marekd, what about the auth controller | 21:38 |
| carl_baldwin | arosen: Nothing strikes me from looking at the bug report except that the hosts file is correct and the code hasn't changed around sending a kill -HUP is just as it was before. It is odd that they report a SIGHUP to dnsmasq does not fix the problem. | 21:38 |
| dolphm | morganfainberg: any chance you can have something in review tomorrow for: https://blueprints.launchpad.net/keystone/+spec/ephemeral-pki-tokens | 21:38 |
| *** galstrom_zzz is now known as galstrom | 21:38 | |
| marekd | ayoung: keystone.auth.*? | 21:39 |
| ayoung | marekd, yes, | 21:39 |
| ayoung | as an auth plugin | 21:39 |
| ayoung | specifically look at the remote user stuff | 21:39 |
| marekd | ayoung: hmmm, just a reminder I cannot write 'just another' plugin, as user initially cannot access POST /auth/tokens | 21:40 |
| ayoung | of course they can | 21:40 |
| ayoung | that is how they create tokens normally | 21:41 |
| marekd | ayoung: right. but remember it will be that lovely mod_shib protected url | 21:41 |
| stevemar | dolphm, i added comments and such to the patch | 21:41 |
| marekd | so if you configure apache to protect /auth/tokens you will not be able to authn with other methods. | 21:42 |
| *** martyntaylor has left #openstack-dev | 21:42 | |
| morganfainberg | dolphm, hopefully i will | 21:42 |
| ayoung | marekd, that is OK | 21:42 |
| ayoung | that is a deployment choice | 21:42 |
| marekd | ayoung: OK. | 21:42 |
| ayoung | and the same suburl can be mounted multiple locations in Apache if so desired | 21:43 |
| ayoung | marekd, I thought you prime problem would be that to do so would require reworking the token provider code. | 21:43 |
| ekarlso | anyone know if there's any java thing lying around for keystone ? | 21:43 |
| *** BLZbubba_ has quit IRC | 21:43 | |
| ayoung | that is, I think, the real issue: we need to fetch the user object outside the provider and pass it in | 21:43 |
| ekarlso | as in a middleware or similar | 21:44 |
| ayoung | ekarlso, not a one | 21:44 |
| hdd | belliott, you around? | 21:44 |
| *** amcrn_ has joined #openstack-dev | 21:44 | |
| *** BLZbubba has joined #openstack-dev | 21:44 | |
| ekarlso | ayoung: so sad :( | 21:44 |
| ayoung | ekarlso, let me know if you find one | 21:44 |
| *** BLZbubba has quit IRC | 21:44 | |
| *** BLZbubba has joined #openstack-dev | 21:44 | |
| marun | samalba: ping | 21:44 |
| carl_baldwin | arosen: Looks like release is not being called as it should be in the patch. Not sure why yet. You mentioned you might see a bug in the review? | 21:44 |
| arosen | Testing till | 21:45 |
| arosen | seems like there is a new behavior that was added that it doesnt' recycle the ips right away. | 21:45 |
| marekd | ayoung: i am not creating any user, at least not in the backend. It's token that identifies the user. And yes, there were few workarounds needed as in few places an assumption was made that the token would be issued for existing user. | 21:45 |
| ayoung | marekd, I'm talkking about the user object that is used by the pipeline, In this case it will be populated by info out of the SAML assertion | 21:45 |
| *** amcrn has quit IRC | 21:45 | |
| *** gokrokve has quit IRC | 21:46 | |
| *** tqtran1 has joined #openstack-dev | 21:46 | |
| arosen | carl_baldwin: yea i can confirm the bug reproduce the behavior on my end | 21:46 |
| gyee | stevemar, which request, the making environ var configurable part? | 21:46 |
| stevemar | gyee, yep, that one | 21:46 |
| *** gokrokve has joined #openstack-dev | 21:46 | |
| gyee | stevemar, it can go into a separate patch if you want, but if Keystone is HAed and fronted by VIP, the REMOTE_ADDR is likely the IP of the VIP | 21:47 |
| gyee | instead of the real client IP | 21:47 |
| *** tqtran has quit IRC | 21:47 | |
| *** joesavak has quit IRC | 21:47 | |
| carl_baldwin | arosen: If anything, not recycling the ip right away should improve this situation rather than compound it, right? | 21:48 |
| *** ramishra has joined #openstack-dev | 21:48 | |
| *** amcrn_ is now known as amcrn | 21:48 | |
| *** eharney has quit IRC | 21:49 | |
| ayoung | marekd, so you understand my comment on the review. Let me know if you need help on reworking the provider stuff. | 21:49 |
| *** chris_johnson is now known as wchrisj|away | 21:50 | |
| marekd | ayoung: cannot see any comment on a review :( | 21:50 |
| *** gokrokve has quit IRC | 21:50 | |
| ayoung | marekd, of course not, I am still writing them | 21:51 |
| marekd | ayoung: oh, good. | 21:51 |
| *** baoli has quit IRC | 21:51 | |
| ayoung | marekd, it should simplify the "external facing" aspect of your code, though. No hcanges to policy or routers | 21:52 |
| *** ramishra has quit IRC | 21:52 | |
| marekd | personally i don't see any option to use /auth/tokens and SAML protect it, but I don't consider myself Apache master... | 21:53 |
| marekd | ayoung: if that waas your point about NOT changing routers. | 21:53 |
| morganfainberg | huh | 21:53 |
| morganfainberg | uhm... | 21:53 |
| morganfainberg | so... i think we have an issue | 21:54 |
| ayoung | marekd, it would be the same as the REMOTE_USERcode in the external auth plugin | 21:54 |
| ayoung | morganfainberg, define "we" | 21:54 |
| morganfainberg | dolphm, bknudson, policy - you can't have multiple API methods protected with the same name | 21:54 |
| dolphm | morganfainberg: why not? | 21:55 |
| morganfainberg | dolphm, bknudson, so it looks like for enforcement the same policy will be used for EC2 and credential as implemented for V3 | 21:55 |
| ayoung | morganfainberg, nope | 21:55 |
| ayoung | yup | 21:55 |
| dstanek | jamielennox: i'll take back my -1 | 21:55 |
| ayoung | but there is a way around that....dolphm? | 21:55 |
| morganfainberg | dolphm, identity:create_credential | 21:55 |
| ayoung | right | 21:55 |
| morganfainberg | dolphm, what method does that map to if you have EC2.create_credential or credential.create_credential | 21:55 |
| morganfainberg | i guess i could renamed all the methods to "ec2_<name>" | 21:56 |
| ayoung | bofe | 21:56 |
| bknudson | morganfainberg: rename them | 21:56 |
| dolphm | morganfainberg: it seems that you *should* need to pass two policy checks to use /credentials for ec2, no? | 21:56 |
| dolphm | identity:create_credential and maybe ec2:create_credential ? | 21:56 |
| morganfainberg | the only one that differs from the policy file is delete_credential, in V2 it's the equivalent to admin_or_owner | 21:56 |
| morganfainberg | in v3 policy we set it to "admin_required" | 21:56 |
| *** tmclaugh[work] has quit IRC | 21:56 | |
| gyee | morganfainberg, ayoung, we should retire the ec2 API and use signature auth plugin instead | 21:56 |
| morganfainberg | dolphm, don't think it works like that | 21:56 |
| dolphm | oh i forgot someone added policy to the v2 ec2 stuff | 21:56 |
| gyee | same goes with s3 | 21:57 |
| morganfainberg | dolphm, i need to add policy for the V3 pipeline | 21:57 |
| dolphm | morganfainberg: all i'm saying is that a single code path might have multiple checks along the way | 21:57 |
| morganfainberg | dolphm, rather than the dumb assert_admin | 21:57 |
| dolphm | morganfainberg: ++ | 21:57 |
| morganfainberg | dolphm, we don't really call controller -> controller | 21:57 |
| *** oro has joined #openstack-dev | 21:57 | |
| morganfainberg | dolphm, it is the exception to the rule we have multiple enforcement points | 21:57 |
| morganfainberg | if at all | 21:58 |
| morganfainberg | i might have removed that when i restructured the manager stuff | 21:58 |
| morganfainberg | s/that/all of them/ | 21:58 |
| morganfainberg | so, best bet is rename? identity:ec2<blah> ? | 21:58 |
| morganfainberg | or do we want the same policy for ec2 credentials as the credential api | 21:58 |
| *** mfer has quit IRC | 21:59 | |
| morganfainberg | gyee, yes, but that wont fit the bill for current usecase / timeline | 21:59 |
| bknudson | policy is up to the deployer | 21:59 |
| marekd | ayoung: http://docs.openstack.org/developer/keystone/external-auth.html looking at this for instance and X.509 example. If I apply that config, will I be able to authn myself without a x.509 certificate? | 21:59 |
| *** hartsocks has quit IRC | 21:59 | |
| morganfainberg | bknudson, right, should they be the same enforcement because they... are performing effectively the same action or are they really different enforcement rules? | 21:59 |
| *** dmsimard has left #openstack-dev | 21:59 | |
| morganfainberg | bknudson, before i renamed everything i wanted ot be sure :) | 21:59 |
| bknudson | morganfainberg: if you re-use the same rules then it's not up to the deployer. | 22:00 |
| *** edmund has quit IRC | 22:00 | |
| morganfainberg | bknudson, that is a fair enough argument for me. | 22:00 |
| *** edmund has joined #openstack-dev | 22:00 | |
| morganfainberg | let me rename these (v3) ones | 22:01 |
| dolphm | morganfainberg: to? | 22:01 |
| morganfainberg | dolphm, ec2_createcredential | 22:01 |
| morganfainberg | it only matters what the method on the controller is, decorated with controller.protected() | 22:01 |
| morganfainberg | wont change the REST api, since the routers to that work for uyou | 22:01 |
| *** RajeshMohan has quit IRC | 22:02 | |
| *** oro has quit IRC | 22:02 | |
| *** pmathews has joined #openstack-dev | 22:02 | |
| *** carl_baldwin has quit IRC | 22:02 | |
| gyee | morganfainberg, not sure if I understand, why are we still using EC2 CRUD now that we have the credential API | 22:02 |
| morganfainberg | gyee, yes, heat is using it in some cases. it presents different than the credential api does | 22:03 |
| dolphm | morganfainberg: fwiw, the left side of the colon was originally intended to reflect core vs extensions, but i think we've broken that quite a bit already | 22:03 |
| dolphm | morganfainberg: so "os-ec2:create_credential" or something would be most correct | 22:03 |
| morganfainberg | dolphm, oh it is? | 22:03 |
| dolphm | yeah.. | 22:03 |
| morganfainberg | dolphm, *goes and looks* | 22:03 |
| dolphm | "identity" == "core identity api" | 22:03 |
| *** yjiang51 has joined #openstack-dev | 22:04 | |
| dolphm | or, was supposed to | 22:04 |
| morganfainberg | dolphm, we only ever use "identity:<thing>" | 22:04 |
| *** RajeshMohan has joined #openstack-dev | 22:04 | |
| dolphm | i know | 22:04 |
| morganfainberg | gyee, the issue is we placed the V2 EC2 api in the V3 pipeline | 22:04 |
| *** carl_baldwin has joined #openstack-dev | 22:04 | |
| morganfainberg | and the v2 one issues a v2 token | 22:04 |
| gyee | morganfainberg, but in the V3 world, there's no need for them anymore | 22:04 |
| morganfainberg | gyee, so to solve it for "ominous deadline" of feb 18, just splitting out V3 version properly | 22:05 |
| morganfainberg | gyee, it offers an authenticate api, and a different presentation | 22:05 |
| ayoung | marekd, yes | 22:05 |
| morganfainberg | gyee, in J we can deprecate Ec2 completely if we have full credential support, but for now, path of least resistance since we are under tight schedules | 22:05 |
| morganfainberg | if that makes sense | 22:06 |
| gyee | morganfainberg, looking at the code, ec2 CRUD difference only slightly and both can be done at the client side | 22:06 |
| *** jecarey_ has quit IRC | 22:06 | |
| dolphm | easy review- https://review.openstack.org/#/c/71690/ | 22:06 |
| gyee | 1) pack the cred into the blob, and 2) don't link the cred to trust | 22:06 |
| *** jhesketh has joined #openstack-dev | 22:06 | |
| morganfainberg | gyee, i think the trust bit is the important peice | 22:06 |
| ayoung | marekd, it depends on Apache, but that is not a concern here. For example, you can specify multple authentication mechanisms. Not that it is guaranteed to work, but in theory | 22:06 |
| *** nermina has quit IRC | 22:06 | |
| *** jecarey_ has joined #openstack-dev | 22:06 | |
| ayoung | marekd, howerver...you could also do this: | 22:07 |
| morganfainberg | dolphm, i'll defer to you on the decision. | 22:07 |
| marekd | ayoung: i still need to pack IdP and protocol in the URL as I cannot POST anything.. | 22:07 |
| dolphm | morganfainberg: on which conern? | 22:07 |
| dolphm | concern* | 22:07 |
| *** gokrokve has joined #openstack-dev | 22:07 | |
| morganfainberg | dolphm, restructure and hit real credential api use...or just split for v3 ec2 and fix in J? | 22:07 |
| morganfainberg | dolphm, ^ gyee's | 22:07 |
| morganfainberg | credential is close to ec2 for crud etc | 22:07 |
| ayoung | marekd, huh? | 22:07 |
| *** johnthetubaguy has joined #openstack-dev | 22:07 | |
| gyee | dolphm, I don't think we want to maintain ec2 CRUD | 22:07 |
| gyee | in the v3 land | 22:07 |
| dolphm | morganfainberg: i'd like to fix it for icehouse, and look at quickly deprecating if that's definitely an option | 22:08 |
| *** ekhugen has quit IRC | 22:08 | |
| ayoung | marekd, that seems wrong | 22:08 |
| *** bswartz has quit IRC | 22:08 | |
| *** dvarga_ has joined #openstack-dev | 22:08 | |
| ayoung | marekd, wouldn't those values come through from mod_shib? | 22:08 |
| morganfainberg | dolphm, my thought is V3 ec2 icehouse, proper full credential stuff J | 22:08 |
| morganfainberg | dolphm, just due to timelines | 22:08 |
| *** ramishra has joined #openstack-dev | 22:08 | |
| dolphm | morganfainberg: ++ | 22:08 |
| morganfainberg | dolphm, if it wasn't (basically) end of the week targets for stuff, i'd be inverted in opinion | 22:08 |
| marekd | ayoung: which values? our own {auth: {} } object? | 22:08 |
| ayoung | IdP and protocol | 22:09 |
| *** eglynn has quit IRC | 22:09 | |
| *** nmagnezi has quit IRC | 22:09 | |
| morganfainberg | gyee, ^ that work for you. Ec2 crud deprecated early in J, and we fix it properly | 22:09 |
| *** eglynn has joined #openstack-dev | 22:09 | |
| morganfainberg | gyee, full on credential auth - plugin etc | 22:09 |
| marekd | ayoung: i would not rely on that assumption. I must confess I ONLY check it on a websso and there..no, i was literally redirected from the IdP and even my initial data sent as a body to the SP was lost.. | 22:09 |
| *** dvarga has quit IRC | 22:10 | |
| gyee | morganfainberg, well, if they make it into stable release, we'll have to maintain them, that's all I am saying | 22:10 |
| ayoung | marekd, where is the body of the SAML assertion? | 22:10 |
| *** salv-orlando_ has joined #openstack-dev | 22:10 | |
| marekd | cookie or something. | 22:10 |
| morganfainberg | gyee, we already provided V3 support for this by putting the V2 ec2 crud in the v3 pipeline | 22:10 |
| ayoung | marekd, something is out of whack here... | 22:10 |
| morganfainberg | gyee, so i would equate that to already being in a stable release (havana) | 22:10 |
| *** yjiang51 has quit IRC | 22:10 | |
| *** dmsimard has joined #openstack-dev | 22:10 | |
| marekd | ayoung: i once make a small test with websso. tried to send some data from a html form to a saml protected url. | 22:11 |
| dmsimard | Hey guys, is it possible to have your opinion on https://bugs.launchpad.net/python-keystoneclient/+bug/1231339 ? We switched it from swift to keystone and want to make sure it's in the right place. | 22:11 |
| uvirtbot | Launchpad bug 1231339 in swift "keystone s3_token middleware not usable" [Undecided,Confirmed] | 22:11 |
| *** ssurana1 has quit IRC | 22:11 | |
| marekd | ayoung: i was redirected to the IdP, auth'ed, redirected to the SP again but my initial body was lost. | 22:11 |
| morganfainberg | dolphm, looks like we don't get to specify anything but "identity:" in policy the way .protected() works. should file a BP to fix that. i would like to make policy more ... distinct (assignment:<thing> identity:<thing> if we want to) | 22:12 |
| *** vuil has quit IRC | 22:12 | |
| gyee | morganfainberg, I know, so two wrongs make it right type of thing huh? :) | 22:12 |
| ayoung | marekd, ah | 22:12 |
| ayoung | marekd, since it is redirects, it is no longer POST verbs? | 22:12 |
| *** giulivo has quit IRC | 22:12 | |
| *** arnaud has quit IRC | 22:12 | |
| marekd | ayoung: hah, in my case the method even changed to GET! | 22:12 |
| morganfainberg | gyee, i think we need to issue a correct token... and then worry about fixing it. we can't rip the rug out of people who expect/use the ec2 extension in v3 (as broken as it may be...it still provides a semblance of working) | 22:12 |
| *** dvarga_ has quit IRC | 22:12 | |
| *** arnaud__ has quit IRC | 22:13 | |
| *** ramishra has quit IRC | 22:13 | |
| morganfainberg | and if they only had the default domain, it really wouldn't be a huge issue to use it as is. | 22:13 |
| marekd | ayoung: i later spoke with our federation achitect, and he said changing POST->GET was weird, but the body loss was pretty standard. | 22:13 |
| *** xga has joined #openstack-dev | 22:13 | |
| gyee | morganfainberg, I hear ya, go with your plan then | 22:13 |
| *** cnesa has joined #openstack-dev | 22:13 | |
| *** salv-orlando has quit IRC | 22:14 | |
| *** salv-orlando_ is now known as salv-orlando | 22:14 | |
| *** shakayumi has joined #openstack-dev | 22:15 | |
| marekd | ayoung: that's why i proposed another url, something i wrote to the ml and was discussed during one of the tuesday meetings. | 22:15 |
| marekd | ayoung: i do agree that maybe the controller should not be located under keystone/federation but for now I would go with that dedicated url. | 22:16 |
| dolphm | morganfainberg: @protected(extension='os-ec2') --> "os-ec2:whatever_method" ? | 22:16 |
| morganfainberg | dolph, controller.protected only takes a callback as an argument https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L68 | 22:17 |
| sandywalsh | hdd: sorry, missed your ping ... here now | 22:18 |
| *** jdob has quit IRC | 22:18 | |
| morganfainberg | dolphm, but yes, that would be my choice syntax (or similar) | 22:18 |
| marekd | ayoung: The only workaround I could recognize at the moment was: a) fetching available projects/domains based on the group ids. | 22:18 |
| *** xga has quit IRC | 22:18 | |
| *** vladikr has quit IRC | 22:18 | |
| dolphm | morganfainberg: yeah, it was just a suggestion | 22:18 |
| hdd | sandywalsh, jog0 asked me to update the description for https://blueprints.launchpad.net/nova/+spec/cross-service-request-id , but I don't have permission to edit that section | 22:18 |
| hdd | do you? | 22:19 |
| sandywalsh | lemme see | 22:19 |
| ayoung | marekd, so...I don't think that is necessary. | 22:19 |
| *** jamieh has quit IRC | 22:19 | |
| sandywalsh | hdd, yep ... lemme see if I can add you (or you can send me a new paste) | 22:20 |
| morganfainberg | dolphm, https://blueprints.launchpad.net/keystone/+spec/policy-enforce-alternate-prefix juno perhaps | 22:20 |
| marekd | ayoung: what exactly is not necessary? | 22:20 |
| ayoung | marekd, part of the problem is that we are treating the token as a resource, and only allowed it to be created on POST, but that is out of line with how auth is typically done | 22:20 |
| * ayoung thinking | 22:20 | |
| marekd | ayoung: i know. | 22:20 |
| ayoung | marekd, I mean, if it were just basic-auth, then the equiv of a token could be put in a cookie | 22:21 |
| *** shakayumi has quit IRC | 22:21 | |
| ayoung | it should not be outside of /auth | 22:21 |
| sandywalsh | hdd: assigned you to the bp ... you should have full control now | 22:22 |
| ayoung | marekd, let me chew it over tonight. | 22:22 |
| ayoung | I'll have something by tomorrows meeting. | 22:22 |
| hdd | sandywalsh, cool. Thanks a lot. | 22:22 |
| *** jaybuff has left #openstack-dev | 22:23 | |
| marekd | ayoung: OK | 22:24 |
| *** glenng has quit IRC | 22:24 | |
| marekd | what exactly was your point with token_providers reworking? | 22:25 |
| *** peristeri has quit IRC | 22:25 | |
| marekd | ayoung: ^^ | 22:25 |
| ayoung | marekd, you see how you tacked on the "issue_federation_token" there? That needs to be merged in with the other things that create tokens | 22:26 |
| ayoung | marekd, this is not your fault, you are uncovering all our cruft | 22:26 |
| *** jmckind has quit IRC | 22:27 | |
| *** thomasem has quit IRC | 22:27 | |
| *** jergerber has joined #openstack-dev | 22:28 | |
| marekd | ayoung: by saying merged you mean in terms of arguments passed or something else? Because I think I did spend some time thinking how to reuse some methods like issue_v3_token and AFAIR it was not so easy. | 22:29 |
| ayoung | marekd, yep | 22:29 |
| ayoung | marekd, I took at stab at it a few months back and concluded the same thing | 22:29 |
| ayoung | I want the same parameter list for issue v2 and issue v3 | 22:30 |
| ayoung | and you should be calling oissue v3 | 22:30 |
| ayoung | marekd, the whole thing needs to be a pipelie | 22:30 |
| ayoung | pipeline | 22:30 |
| *** ysk has quit IRC | 22:30 | |
| marekd | this means refactoring issue_v3_token - OK then. | 22:30 |
| ayoung | marekd, yep, and the really nasty thing is this is a public API | 22:31 |
| *** rtheis has quit IRC | 22:31 | |
| *** dkranz has quit IRC | 22:32 | |
| ayoung | marekd, OK....I knew this was coming. I need to sit down in a quite room with a notebook, a pencil, and a glass of good scotch and think this through. Ideally with no computer near me. | 22:32 |
| *** gokrokve has quit IRC | 22:32 | |
| ayoung | but...this code helps | 22:32 |
| *** gokrokve has joined #openstack-dev | 22:32 | |
| ayoung | cux it makes real what the interface to the token provider really needs to look like | 22:32 |
| ayoung | marekd, let me see if I can find the snap we took of the whiteboard | 22:33 |
| *** achampion has quit IRC | 22:33 | |
| ayoung | https://twitter.com/admiyoung/status/429060448462577664/photo/1 marekd sorry that is not more legible | 22:33 |
| *** tongli has quit IRC | 22:34 | |
| *** arosen has quit IRC | 22:35 | |
| *** arosen has joined #openstack-dev | 22:35 | |
| marekd | ayoung: why is scope just after authenticate? | 22:36 |
| *** gokrokve has quit IRC | 22:36 | |
| marekd | ayoung: we are starting with SAML assertion. | 22:37 |
| stevemar | dolphm, any way I can test this out locally? https://review.openstack.org/#/c/72492/ | 22:38 |
| *** yeylon__ has joined #openstack-dev | 22:38 | |
| dolphm | dstanek: ^ i assume not "tox -e docs" | 22:39 |
| *** salv-orlando_ has joined #openstack-dev | 22:39 | |
| stevemar | dolphm, and we would need to resolve the oslo warnings first right? | 22:39 |
| *** lucas-dinner has quit IRC | 22:40 | |
| dstanek | dolphm: stevemar: yeah, tox -e docs should do it | 22:40 |
| *** jab416171_ has quit IRC | 22:40 | |
| morganfainberg | bknudson, dolphm, v3 ec2 stuff w/ policy.json enforcement almost ready to post (waiting on unit tests) | 22:41 |
| morganfainberg | will be up shortly | 22:41 |
| dstanek | that just calls the sphinx stuff under the hood | 22:41 |
| *** jab416171_ has joined #openstack-dev | 22:41 | |
| morganfainberg | bknudson, dstanek, i should have the last comments for the Limit calls to memcache review done shortly | 22:41 |
| morganfainberg | (and posted) | 22:41 |
| stevemar | bknudson, take a quick 2nd look? https://review.openstack.org/#/c/67645/ I just changed your 1 inline comment | 22:42 |
| marekd | ayoung: still here? | 22:42 |
| marekd | ayoung: otherwise i am going to bed for now. | 22:42 |
| stevemar | dolphm, dstanek want to review: https://review.openstack.org/#/c/67645/ - it's already gone throug brant, so good luck finding anything wrong, buahaha | 22:43 |
| *** salv-orlando has quit IRC | 22:43 | |
| *** salv-orlando_ is now known as salv-orlando | 22:43 | |
| dstanek | stevemar: sure | 22:44 |
| stevemar | dstanek, don't take this as a challenge, and i apologize for -1'ing your fix for misspellings :) | 22:44 |
| dolphm | stevemar: rofl | 22:45 |
| dstanek | stevemar: :) | 22:45 |
| dolphm | stevemar: i'm skimming it, but dstanek would be a more valuable +2 at this point | 22:45 |
| *** armax has quit IRC | 22:47 | |
| dstanek | dolphm, bknudson: can i assume that the client version works the same as the server version in https://review.openstack.org/#/c/71690? | 22:47 |
| *** kgriffs is now known as kgriffs_afk | 22:47 | |
| bknudson | dstanek: I wouldn't make any assumptions | 22:47 |
| *** wchrisj|away is now known as chris_johnson | 22:47 | |
| *** kevinconway has quit IRC | 22:47 | |
| dolphm | bknudson: it's a copy/paste, no? | 22:48 |
| *** hartsocks has joined #openstack-dev | 22:48 | |
| *** hartsocks has quit IRC | 22:48 | |
| bknudson | it was mostly a copy/paste but there are minor differences... in logging and translations. | 22:48 |
| dolphm | bknudson: but from an API perspective, it provides the same behavior on the things imported into keystone | 22:48 |
| bknudson | dstanek: https://review.openstack.org/#/c/52702/ | 22:48 |
| bknudson | dolphm: right there's no change to the API. | 22:50 |
| dolphm | dstanek: ^ | 22:50 |
| *** jecarey_ has quit IRC | 22:50 | |
| dolphm | stevemar: i thought i found a problem and then i was wrong i apologize to bkhudson | 22:51 |
| dolphm | turns out i just misread a new docstr | 22:51 |
| morganfainberg | dolphm, bknudson, https://review.openstack.org/#/c/70631/ update posted. | 22:52 |
| stevemar | dolphm, you should have known bettter | 22:52 |
| morganfainberg | V3EC2 | 22:52 |
| *** arnaud has joined #openstack-dev | 22:53 | |
| *** arnaud__ has joined #openstack-dev | 22:53 | |
| *** Sukhdev has quit IRC | 22:54 | |
| dolphm | morganfainberg: why is ec2_delete_credential the only admin_or_owner? | 22:54 |
| morganfainberg | dolphm, that is the same as the V2 functionality | 22:54 |
| morganfainberg | dolphm, delete was the one that checked admin, secondarily checked owner | 22:54 |
| dolphm | emulating "log out" ? | 22:54 |
| morganfainberg | hm. i think so | 22:54 |
| *** armax has joined #openstack-dev | 22:54 | |
| dstanek | bknudson: yeah they are basically the same - the client version just wasn't converted to using six | 22:55 |
| dolphm | morganfainberg: anything else new in this patch i should pay attention to? | 22:55 |
| morganfainberg | dolphm, actually | 22:55 |
| morganfainberg | these might all need to be admin or owner | 22:55 |
| *** galstrom is now known as galstrom_zzz | 22:55 | |
| bknudson | dstanek: probably because I submitted it before anyone was posting changes to use six... | 22:55 |
| morganfainberg | *checking* | 22:55 |
| ayoung | marekd, go to bed...I've been invaded by kids | 22:56 |
| *** ytwu1 has joined #openstack-dev | 22:56 | |
| *** jobewan has quit IRC | 22:56 | |
| dolphm | marekd: isn't it like 5am there? | 22:56 |
| marekd | midnight. | 22:56 |
| *** ytwu has quit IRC | 22:56 | |
| morganfainberg | dolphm, oooh | 22:56 |
| stevemar | dedication | 22:56 |
| morganfainberg | dolphm, how do i .. check to make sure a user is the user in the credential in policy? | 22:56 |
| *** zzelle has quit IRC | 22:57 | |
| dstanek | bknudson: lgtm - looks like it deserves to be approved | 22:57 |
| *** cagrev has quit IRC | 22:57 | |
| morganfainberg | the rest should be admin_or_owner | 22:57 |
| morganfainberg | i.. uhm think | 22:57 |
| dolphm | morganfainberg: umm, not user_id= | 22:57 |
| *** eharney has joined #openstack-dev | 22:58 | |
| morganfainberg | dolphm, huh. | 22:58 |
| *** marekd is now known as marekd|away | 22:58 | |
| morganfainberg | not sure how this gets modelled in policy enforcement | 22:58 |
| morganfainberg | dolphm, trying to say "if user_id != cred_ref['user_id']:" is | 22:59 |
| *** ssurana1 has joined #openstack-dev | 22:59 | |
| morganfainberg | dolphm, not clear to me | 22:59 |
| ekarlso | what happened to the "congress" thing vmware did for policies ? | 22:59 |
| morganfainberg | dolphm, oh, i need to write this as a callback | 23:00 |
| dolphm | user_id:%(credential.user_id)s ? | 23:00 |
| *** tkay has quit IRC | 23:00 | |
| dolphm | morganfainberg: what's the operation you're protecting? | 23:00 |
| dolphm | morganfainberg: update? | 23:00 |
| morganfainberg | dolphm, no because you don't have access to that information (credential) at the point | 23:00 |
| morganfainberg | dolphm, delete | 23:00 |
| dolphm | then callback sounds right | 23:00 |
| morganfainberg | dolphm, yeah. | 23:00 |
| *** nati_uen_ has quit IRC | 23:01 | |
| *** shardy is now known as shardy_afk | 23:01 | |
| bknudson | dstanek: thanks. I think that closes a bug. | 23:01 |
| dstanek | stevemar: nice docstrings! | 23:01 |
| *** tkay has joined #openstack-dev | 23:02 | |
| *** sweston has quit IRC | 23:02 | |
| dstanek | stevemar: you almost make me with i wrote docstrings like that | 23:02 |
| *** packet has quit IRC | 23:02 | |
| *** JoshNang has joined #openstack-dev | 23:03 | |
| *** gokrokve has joined #openstack-dev | 23:04 | |
| dolphm | dstanek: is there a way to have apidoc ignore keystone.openstack.common ? | 23:04 |
| *** romcheg1 has quit IRC | 23:04 | |
| *** galstrom_zzz is now known as galstrom | 23:04 | |
| *** mdomsch has quit IRC | 23:04 | |
| dolphm | stevemar: to avoid/ignore warnings /errors there ^ | 23:04 |
| *** kgriffs_afk has quit IRC | 23:05 | |
| dstanek | dolphm: not that i know of | 23:06 |
| *** stevemar has quit IRC | 23:06 | |
| jamielennox | gyee (and interested others): new auth plugins - have a look when you get a minute and make sure they still work for you: https://review.openstack.org/#/c/68006/ and https://review.openstack.org/#/c/68007/ | 23:06 |
| ayoung | ok...so bascially a token is a signed subset of the data that keystone knows about a user....so, if we add on ?signed or an accepts header of "application/cmsz" we could turn and keystone response into a token. I think I might have finally cracked.... | 23:06 |
| jamielennox | ayoung: s/and/any ? | 23:07 |
| ayoung | jamielennox, yes | 23:07 |
| *** kgriffs_afk has joined #openstack-dev | 23:07 | |
| dolphm | ayoung: s/think I might have// | 23:07 |
| *** kgriffs_afk is now known as kgriffs | 23:07 | |
| ayoung | dolphm, almost certainly | 23:08 |
| *** vijendar has quit IRC | 23:08 | |
| jamielennox | ayoung: so i put in an email that i think you are right about sign/compress and that we just take ID from the uncompressed token | 23:08 |
| ayoung | dolphm, I was thinking, though, that a user might like to create a token with just enough role-assignment data to get a job done. It would be nice to just be on the role_assignement url and say "convert this to token" | 23:08 |
| jamielennox | it means though that you could actually implement token compression as middleware | 23:08 |
| dstanek | dolphm: https://bitbucket.org/birkenfeld/sphinx/issue/944/sphinx-apidoc-add-ability-to-exclude | 23:09 |
| ayoung | jamielennox, ahhh | 23:09 |
| jamielennox | :) | 23:09 |
| ayoung | jamielennox, cool.... | 23:09 |
| *** ramishra has joined #openstack-dev | 23:09 | |
| ayoung | I think I was hovering around that idea | 23:09 |
| bknudson | dolphm: the warnings in openstack/common should be fixed with https://review.openstack.org/#/c/71311/ | 23:09 |
| dolphm | jamielennox: rather than affecting the signature? | 23:09 |
| dolphm | dstanek: ooh | 23:09 |
| jamielennox | dolphm: right, so on issue a token you take X-Auth-Token and the zip it, on receiving a zipped token you unzip it - nothing else changes | 23:10 |
| *** dave_tucker_zzz is now known as dave_tucker | 23:10 | |
| jamielennox | just insert that before auth_token middleware | 23:10 |
| *** jecarey has joined #openstack-dev | 23:11 | |
| morganfainberg | dolphm, does.. this look right? "rule:admin or rule:owner and user_id:%(target.user_id)s" | 23:11 |
| *** prad has quit IRC | 23:11 | |
| ayoung | dolphm, but I was also thinking of the Federation issue that marekd|away was hitting. Namely, that the resource he is trying to request is only avaialble via post, and the redirect breaks that. What if a user had an URL that represented "here is my current token data" | 23:11 |
| morganfainberg | or is there like parens and such that should be added? | 23:11 |
| jamielennox | note to self: should never say 'this could be middleware' around dolphm | 23:11 |
| dolphm | jamielennox: my only complaint with that, which isn't entirely valid, is that people have to opt-in to that, and i'd rather they not have to :P | 23:11 |
| ayoung | then to get a token, you go to that URL with a content-type that indicates "give it to me signed and compressed" | 23:12 |
| dolphm | jamielennox: ;) | 23:12 |
| bknudson | the doc warnings I get with master + https://review.openstack.org/#/c/71311/ are keystone.contrib.kds.db.connection.Connection.get_key:18 | 23:12 |
| bknudson | and keystone.tests.contrib.kds.fixture.rst:7 | 23:12 |
| ayoung | dolphm, and...if we did it that way, it would provide Keystone a clean way to sign (and compress )other data like the revocation events | 23:12 |
| dolphm | bknudson: are you excluding keystone.openstack.common, or actually not seeing any errors there? | 23:13 |
| jamielennox | dolphm: right it can be inline but just a very simple if it's compressed then uncompress and do regular token processing so that token_id is not affected by the compression | 23:13 |
| morganfainberg | dolphm, actually i think... http://pastebin.com/iyrZrAf5 is right? | 23:13 |
| bknudson | dolphm: https://review.openstack.org/#/c/71311/ fixes the warnings in keystone.openstack.common, so there are no errors there. | 23:13 |
| *** thedodd has quit IRC | 23:13 | |
| *** ramishra has quit IRC | 23:13 | |
| jamielennox | also we have a lot of stuff in our pipeline that you can't really opt out of | 23:13 |
| *** alexpilotti has quit IRC | 23:13 | |
| *** dvarga has joined #openstack-dev | 23:14 | |
| dolphm | jamielennox: we trimmed down the default after grizzly | 23:14 |
| jamielennox | i'd be interested to know how many deployments actually mess with that | 23:14 |
| dolphm | too few | 23:15 |
| jamielennox | anyway i was thinking that was interesting as the same middleware could be used on the client and the server | 23:15 |
| jamielennox | but maybe it's just better to build it into auth_token and then have keystone use that - again | 23:15 |
| *** dstanek is now known as dstanek_afk | 23:16 | |
| *** dmsimard has quit IRC | 23:16 | |
| *** henrynash has joined #openstack-dev | 23:17 | |
| dolphm | jamielennox: works for me, but i wouldn't mind if that was a refactor in juno | 23:17 |
| *** nati_ueno has joined #openstack-dev | 23:17 | |
| jamielennox | dolphm: lol, it's not going to happen in the next couple of weeks | 23:17 |
| *** vartom1111111119 has quit IRC | 23:18 | |
| *** yjiang51 has joined #openstack-dev | 23:18 | |
| *** byeager has quit IRC | 23:19 | |
| *** jgrimm has quit IRC | 23:19 | |
| *** pixelb has quit IRC | 23:19 | |
| morganfainberg | dstanek_afk, bknudson, https://review.openstack.org/#/c/71683/ - Memcache (master) fix for the token backend limiting calls to memcache | 23:20 |
| *** galstrom is now known as galstrom_zzz | 23:22 | |
| ayoung | jamielennox, I like what you are thinking. But the middleware could go in the client, and be consumed by the server | 23:22 |
| ayoung | I'll play around with it.... | 23:22 |
| *** ayoung is now known as ayoung-Dad | 23:22 | |
| jamielennox | ayoung: i'm not sure i'm advocating it, it was just a it's possible | 23:22 |
| jamielennox | ayoung-Dad: also that i'm reverting my old position to compress then sign | 23:22 |
| Alexei_987 | lifeless: ping | 23:22 |
| *** nati_ueno has quit IRC | 23:23 | |
| *** dperaza has quit IRC | 23:23 | |
| *** lbragstad has quit IRC | 23:23 | |
| lifeless | Alexei_987: hi | 23:23 |
| Alexei_987 | lifeless: could you please take a look at this issue https://bugs.launchpad.net/testrepository/+bug/1271133 ? | 23:24 |
| uvirtbot | Launchpad bug 1271133 in testrepository "Cryptic error from subunit when an import fails" [Undecided,In progress] | 23:24 |
| *** schwicht has quit IRC | 23:24 | |
| dolphm | jamielennox: that i would like a firm direction on (compress -> sign) or (sign -> compress); i haven't seen reasoning either way, but it greatly affects the viability of the middleware approach | 23:24 |
| dolphm | in which case i vote for sign -> compress | 23:24 |
| dolphm | which i think ayoung was doing last i checked? | 23:24 |
| jamielennox | dolphm: my case for compress -> sign was that the token we would produce is always the same and because we currently rely on the md5sum of the token for our token id | 23:25 |
| *** sgordon has quit IRC | 23:25 | |
| jamielennox | any form of decompress -> recompress would create a new token_id that would still validate but not be retrievable by keysotne | 23:26 |
| jamielennox | dolphm: however it becomes really simple by just saying that the token id is only computed on the uncompressed data (which is why middelware make sense) | 23:26 |
| dolphm | jamielennox: then you're forcing clients to decompress tokens before validating them | 23:27 |
| jamielennox | dolphm: yes | 23:27 |
| dolphm | jamielennox: which makes this API-breaking and a no-go | 23:27 |
| Alexei_987 | lifeless: it was quite a quest to debug this thing | 23:27 |
| jamielennox | dolphm: it's going to be somewhat breaking anyway | 23:27 |
| jamielennox | at some point the client is going to need to decrypt the data to retrieve token information | 23:28 |
| dolphm | jamielennox: yes, but only auth_token - right? | 23:28 |
| dolphm | it's also not "encrypted" | 23:28 |
| jamielennox | right, i used encrypted wrongly in a number of places | 23:28 |
| jamielennox | what do you mean only auth_token | 23:29 |
| dolphm | jamielennox: careful! | 23:29 |
| *** armax has quit IRC | 23:29 | |
| dolphm | jamielennox: what other clients have to read PKI tokens, other than keystoneclient? | 23:29 |
| jamielennox | auth token is going to need to do a decrypt regardless | 23:29 |
| dolphm | decompress* | 23:29 |
| jamielennox | dolphm: keep doing that | 23:29 |
| jamielennox | auth_token will need to decompress regardless | 23:29 |
| dolphm | jamielennox: that'll send the wrong message in our community and we'll get very confusing security vulnerabilities reported lol | 23:30 |
| jamielennox | keystoneclient does not *open* the token | 23:30 |
| *** ramishra has joined #openstack-dev | 23:30 | |
| *** sarob has quit IRC | 23:30 | |
| *** jaybuff has joined #openstack-dev | 23:30 | |
| jamielennox | it reads the json from the response and saves that but it always treats the token as a blob | 23:30 |
| dolphm | nor does it need to - excluding auth_token, correct? | 23:30 |
| jamielennox | correct | 23:30 |
| *** sarob has joined #openstack-dev | 23:31 | |
| dolphm | right, clients should be allowed to be dumb there | 23:31 |
| jamielennox | (though i would like to eventually move that functionallity towards the client) | 23:31 |
| dolphm | +++ | 23:31 |
| dolphm | i've always wanted a c.tokens.validate() | 23:31 |
| dolphm | haven't gotten around it it myself | 23:31 |
| lifeless | Alexei_987: I think you have the wrong end of it; its a single patch to testr to fix. | 23:31 |
| jamielennox | dolphm: i'm hoping to get all this discover and auth plugin stuff figured out before i go back to looking at auth_token | 23:31 |
| lifeless | Alexei_987: I'm glad you want to hack on it, I will give direction in the bug | 23:31 |
| Alexei_987 | lifeless: not sure it will work | 23:32 |
| *** slagle has quit IRC | 23:32 | |
| *** jergerber has quit IRC | 23:32 | |
| morganfainberg | dolphm, ok i think... the policy is correct for this: https://review.openstack.org/#/c/70631/ | 23:32 |
| Alexei_987 | lifeless: testr doesn't have any info about the failure to show it | 23:32 |
| dolphm | morganfainberg: test it! | 23:33 |
| morganfainberg | dolphm, LOL i am trying to stand up a devstack for it. | 23:33 |
| *** sarob has quit IRC | 23:33 | |
| morganfainberg | dolphm, but figured i'd post it up so tempest could get chewing on it | 23:33 |
| dolphm | morganfainberg: cool -- what tests does tempest have against that api? | 23:34 |
| morganfainberg | dolphm, if heat is covered possibly heat things | 23:34 |
| dolphm | might be easier to write that test there | 23:34 |
| morganfainberg | dolphm, honestly, not sure. | 23:34 |
| *** mtreinish has quit IRC | 23:34 | |
| dolphm | morganfainberg: poke shardy | 23:34 |
| morganfainberg | dolphm, but going to test this for now locally in devstack and possibly need to add a unit test for the immidiate usecase | 23:35 |
| morganfainberg | shardy_afk, ping | 23:35 |
| morganfainberg | dolphm, but in either case you can look to see if the code has anything outstanding that is wrong while i do the more functional tests. | 23:36 |
| *** denis_makogon has quit IRC | 23:36 | |
| dolphm | morganfainberg: i looked though the last patchset -- don't see anything | 23:36 |
| morganfainberg | dolphm, ok | 23:36 |
| morganfainberg | dolphm, there is now the callback for policy magic, but that wont be fully tested until i get this devstack up and see if i need a new test | 23:37 |
| *** asalkeld has joined #openstack-dev | 23:37 | |
| *** achampion has joined #openstack-dev | 23:38 | |
| *** Gordonz has quit IRC | 23:38 | |
| *** dkranz has joined #openstack-dev | 23:38 | |
| *** chris_johnson is now known as wchrisj|away | 23:38 | |
| bknudson | am I supposed to be able to do a file search on gerrit using file: ? | 23:39 |
| bknudson | it says "operator not permitted here" | 23:39 |
| *** mtreinish has joined #openstack-dev | 23:39 | |
| sdague | bknudson: it's not supported in the web ui | 23:39 |
| sdague | that's in the docs | 23:39 |
| sdague | until gerrit 2.8 with secondary indexes | 23:39 |
| bknudson | so I can put it on a watched project or something. | 23:40 |
| *** cadenzajon has quit IRC | 23:40 | |
| morganfainberg | sdague, does it work in the "watched" projects settings? i am trying to figure out the syntax so i can see some oslo bits | 23:40 |
| morganfainberg | but ... i don't think they are working as expected | 23:40 |
| sdague | morganfainberg: it's supposed to work for the emails | 23:40 |
| sdague | but I've not actually tested it | 23:40 |
| morganfainberg | hmmm. | 23:40 |
| morganfainberg | sdague, ok i'll keep poking at it | 23:41 |
| sdague | it definitively will not work in the web UI | 23:41 |
| morganfainberg | sdague, okie. | 23:41 |
| morganfainberg | sdague, thanks | 23:41 |
| *** CaptTofu has quit IRC | 23:41 | |
| sdague | and that was supposed to autocomplete to bknudson, I have no idea how I screwed that up :) | 23:41 |
| *** jnoller has quit IRC | 23:42 | |
| *** e0ne has quit IRC | 23:42 | |
| *** praneshp has joined #openstack-dev | 23:43 | |
| lifeless | Alexei_987: oh, I see | 23:44 |
| lifeless | Alexei_987: I mis read | 23:44 |
| *** abhirc has quit IRC | 23:44 | |
| *** e0ne has joined #openstack-dev | 23:44 | |
| *** mlavalle has quit IRC | 23:46 | |
| *** henrynash has quit IRC | 23:46 | |
| *** cadenzajon has joined #openstack-dev | 23:47 | |
| *** mgagne has quit IRC | 23:47 | |
| *** AlanClark has quit IRC | 23:48 | |
| *** begin has joined #openstack-dev | 23:49 | |
| *** tjones has quit IRC | 23:49 | |
| *** yjiang51 has quit IRC | 23:49 | |
| *** dstanek_afk is now known as dstanek | 23:49 | |
| *** johnthetubaguy has quit IRC | 23:49 | |
| *** johnthetubaguy has joined #openstack-dev | 23:50 | |
| *** mrda is now known as mrda_away | 23:50 | |
| *** morazi has quit IRC | 23:50 | |
| *** johnthetubaguy has quit IRC | 23:50 | |
| *** ijw_ has joined #openstack-dev | 23:50 | |
| begin | Guys can you help with a basic question? | 23:51 |
| *** markwash has quit IRC | 23:51 | |
| *** jaybuff has quit IRC | 23:52 | |
| *** sarob has joined #openstack-dev | 23:52 | |
| *** neelashah has quit IRC | 23:52 | |
| *** mriedem has quit IRC | 23:52 | |
| begin | why is it needed to put in the code something like: self.conn_timeout = float(conf.get('conn_timeout', 0.5)) if this information could be provided in a conf file: conn_timeout = 0.5? | 23:52 |
| Alexei_987 | lifeless: do not agree with you on subunit patch | 23:53 |
| *** ssurana has quit IRC | 23:53 | |
| *** markmcclain has quit IRC | 23:53 | |
| StevenK | Because then it's a string, and not a float | 23:53 |
| *** bauzas has quit IRC | 23:53 | |
| *** ijw has quit IRC | 23:53 | |
| *** sandywalsh has quit IRC | 23:53 | |
| Alexei_987 | lifeless: it is available to subunit but I don't like that valid and invalid testcases are streamed through the same pipe | 23:53 |
| *** henrynash has joined #openstack-dev | 23:53 | |
| *** jaybuff has joined #openstack-dev | 23:53 | |
| *** jaybuff has quit IRC | 23:54 | |
| *** zul has quit IRC | 23:54 | |
| Alexei_987 | lifeless: I think we should use 2 separate pipes | 23:54 |
| StevenK | begin: Basically, it's defensive coding. | 23:54 |
| *** arosen has quit IRC | 23:54 | |
| *** slagle has joined #openstack-dev | 23:54 | |
| lifeless | Alexei_987: subunit is a multiplexing protocol, there's no need for two pipes | 23:55 |
| StevenK | begin: We want to coerce the value to a float, but if it's not specified in the config, we have a default. Not certain if rubbish values get replaced by the default. | 23:55 |
| lifeless | Alexei_987: the data is already attached in the right place, testr just isn't showing it cleanly. | 23:55 |
| Alexei_987 | lifeless: how you are going to separate it to show it cleanly? | 23:55 |
| lifeless | Alexei_987: see my review on the testr patch | 23:55 |
| *** iamben_tw has quit IRC | 23:56 | |
| lifeless | Alexei_987: but - subunit.v2.ByteStreamToStreamResult(BytesIO(out)).run(gatherer) | 23:56 |
| Alexei_987 | lifeless: I don't really like your binary parser magic :( | 23:56 |
| Alexei_987 | binary - evil | 23:56 |
| lifeless | Alexei_987: we have lots of corruption issues with the plain text version of subunit, waaay more flaky. | 23:57 |
| *** iamben_tw has joined #openstack-dev | 23:57 | |
| *** ndipanov has quit IRC | 23:57 | |
| lifeless | Alexei_987: but there is no magic here, pipes are pipes | 23:57 |
| Alexei_987 | lifeless: well ok we can do it without stderr :(, however I don't think that we should dig down to unittest to fix this issue | 23:57 |
| *** sweston has joined #openstack-dev | 23:57 | |
| *** bdpayne has quit IRC | 23:58 | |
| lifeless | Alexei_987: we can do the work around, but unittest should be fixed | 23:59 |
| lifeless | Alexei_987: otherwise we end up with code that is just an unmaintainable mess of workarounds | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
