| dolphm | i just +A'd marekd|away's patch too | 00:00 |
|---|---|---|
| dolphm | which means... | 00:00 |
| morganfainberg | minor nits on white space, didn't even bother to comment | 00:00 |
| morganfainberg | we get to do the RC dance? | 00:00 |
| jamielennox | dolphm: this got missed for a little while: https://review.openstack.org/#/c/78068/ | 00:00 |
| jamielennox | the default version URLs - i take it that's way too late now | 00:00 |
| * dolphm IS NOW OFFICIALLY SCARED OF EMAILS THAT START WITH "Public Bug Reported..." | 00:00 | |
| morganfainberg | dolphm, let me move the dependency for https://review.openstack.org/#/c/82674/ we should get that in (sneak it in) if possible | 00:01 |
| morganfainberg | help cut down the volume of logging | 00:01 |
| dolphm | morganfainberg: sounds great | 00:01 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove extra cache layer debugging https://review.openstack.org/82674 | 00:01 |
| morganfainberg | dolphm, ^ jamielennox ^ | 00:02 |
| morganfainberg | provided it passes check and all | 00:02 |
| dolphm | morganfainberg: +2 | 00:02 |
| morganfainberg | it should remove all the CACHE_GET CACHE_SET lines from our logs | 00:02 |
| dolphm | i actually thought the discovery urls thing already merged | 00:03 |
| morganfainberg | this one might be worth getting in as well: https://review.openstack.org/#/c/79422/ so we see the slowest tests each run | 00:03 |
| jamielennox | morganfainberg: _2 | 00:03 |
| morganfainberg | but that one can wait till post RC | 00:03 |
| jamielennox | dolphm: it sat for a little while with a bknudson -1 that i hadn't seen | 00:03 |
| morganfainberg | ooh | 00:04 |
| morganfainberg | jamielennox, let me take a look, i thought that one went in as well | 00:04 |
| morganfainberg | jamielennox, it's going to merge conflict | 00:04 |
| jamielennox | damnit, i just fixed one of those | 00:05 |
| morganfainberg | jamielennox, test_wsgi | 00:05 |
| jamielennox | morganfainberg: has that merged? | 00:05 |
| morganfainberg | the babel one? | 00:05 |
| morganfainberg | jamielennox, i just tried to rebase it and it merge conflicted. so .. | 00:06 |
| dolphm | 78068? | 00:06 |
| morganfainberg | dolphm, yeah that one conflicts on test_wsgi looks like import line only | 00:06 |
| dolphm | ah yeah | 00:06 |
| dolphm | p.s. everyone should start using the latest version of hacking - from trunk | 00:07 |
| dolphm | they're long overdue for a release and we have a TON of violations against their master | 00:07 |
| dolphm | all good ones too | 00:07 |
| morganfainberg | dolphm, as soon as we have RC i'm going to aim to land a quick remove "deprecated" stuff from internal api calls. | 00:09 |
| morganfainberg | e.g. identity proxy, et al | 00:09 |
| jamielennox | morganfainberg: just running tests locally and then i'll update the review | 00:09 |
| jamielennox | but is it too late? | 00:09 |
| dolphm | morganfainberg: that's the only deprecatedness that we can remove in juno, right? | 00:09 |
| jamielennox | it's a sweeping change at this point | 00:09 |
| morganfainberg | dolphm, i think there are 2-3 others. | 00:09 |
| morganfainberg | jamielennox, hm... | 00:09 |
| dolphm | jamielennox: no, let's get it in -- it's well reviewed and will set us up da bomb | 00:09 |
| jamielennox | there is also strings in the config file that change | 00:10 |
| morganfainberg | jamielennox, i think we're sane to get it in | 00:10 |
| morganfainberg | are conf options string freeze violations? | 00:10 |
| jamielennox | morganfainberg: no idea | 00:10 |
| morganfainberg | jamielennox, are the new options change of behavior? | 00:10 |
| morganfainberg | e.g. change of default behavior? | 00:10 |
| dolphm | they're not translated, at least in keystone.common.config | 00:10 |
| morganfainberg | dolphm, lets not translate those :P | 00:10 |
| jamielennox | morganfainberg: ummm - kind of a change in default behaviour | 00:11 |
| jamielennox | essentially it's a better default | 00:11 |
| dolphm | morganfainberg: change of use of defaults? | 00:11 |
| morganfainberg | jamielennox, so if i don't change my config, something completely new happens? | 00:11 |
| *** stevemar has quit IRC | 00:11 | |
| jamielennox | morganfainberg: yes, but not in a way that's a problem | 00:11 |
| morganfainberg | jamielennox, that could break my use of keystone? | 00:11 |
| dolphm | morganfainberg: if you've set those options, then you continue using them with no effect | 00:11 |
| morganfainberg | dolphm, thats what i was looking for | 00:11 |
| morganfainberg | dolphm, cool. | 00:11 |
| dolphm | morganfainberg: if you haven't set them, then a more reasonable default is assumed by keystone | 00:12 |
| morganfainberg | dolphm, +_+ | 00:12 |
| morganfainberg | erm ++ | 00:12 |
| dolphm | jamielennox: fair statement? | 00:12 |
| jamielennox | dolphm: yep | 00:12 |
| dolphm | morganfainberg: i sort of prefer +_+ | 00:12 |
| morganfainberg | -_- | 00:12 |
| morganfainberg | i mean .. | 00:12 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone: Change the default version discovery URLs https://review.openstack.org/78068 | 00:13 |
| morganfainberg | jamielennox, i don't have an issue with that change. | 00:14 |
| morganfainberg | jamielennox, let me do a last once over on it though | 00:14 |
| jamielennox | huh, locally that told me that it failed to upload the review - but it seems to have pushed fine | 00:14 |
| morganfainberg | hah | 00:14 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone: Change the default version discovery URLs https://review.openstack.org/78068 | 00:15 |
| dolphm | jamielennox: wait, what was the difference in the last two? i just finished reviewing the first and then accidentally +2'd the second | 00:18 |
| jamielennox | dolphm: bad import ordering: https://review.openstack.org/#/c/78068/9/keystone/tests/test_wsgi.py | 00:18 |
| dolphm | there's more deletes in the older one | 00:19 |
| morganfainberg | jamielennox, heh | 00:19 |
| *** openstack has joined #openstack-keystone | 00:19 | |
| morganfainberg | openstack, phew, we missed you! | 00:19 |
| morganfainberg | lol | 00:19 |
| dolphm | jamielennox: ah, thanks | 00:20 |
| dolphm | i had the bot blocked for awhile lol | 00:20 |
| dolphm | too many notifications for "keystone" | 00:20 |
| morganfainberg | dolphm, lol | 00:20 |
| morganfainberg | dolphm, gerrit one or the eavesdrop one? | 00:21 |
| dolphm | gerrit | 00:21 |
| morganfainberg | openstack = eavesdrop | 00:21 |
| morganfainberg | dolphm, we can remove the gerrit one again if you want :P | 00:21 |
| morganfainberg | it's easy to remov | 00:21 |
| morganfainberg | e | 00:21 |
| morganfainberg | it's kinda nice ot see them as they occur...but meh | 00:21 |
| dolphm | no no, i think it's super useful, i just don't want growl notifications for every patch | 00:21 |
| morganfainberg | i don't remember who asked me to add it though. | 00:21 |
| morganfainberg | Oh! haha | 00:21 |
| jamielennox | morganfainberg: i did - i think it's useful | 00:22 |
| *** nkinder has quit IRC | 00:22 | |
| morganfainberg | dolphm, jamielennox, +2 | 00:26 |
| *** flaper87 is now known as flaper87|afk | 00:26 | |
| jamielennox | morganfainberg: cool | 00:26 |
| jamielennox | bring on pecan though i'm sick of our wsgi layer | 00:27 |
| morganfainberg | jamielennox, dolphm, meeting tomorrow - added the eventlet bit, basically eventlet is dead. | 00:28 |
| jamielennox | morganfainberg: for keystone or everyone? | 00:28 |
| morganfainberg | jamielennox, dolphm, based upon -infra convo | 00:28 |
| morganfainberg | jamielennox, py33 | 00:28 |
| dolphm | fun! | 00:28 |
| jamielennox | that's good | 00:29 |
| dolphm | morganfainberg: eventlet is not going to py33 or what? | 00:29 |
| morganfainberg | since we don't really use eventlet for anything | 00:29 |
| dolphm | what's the verdict | 00:29 |
| jamielennox | i imagine it will be harder for some projects but it will be good for us | 00:29 |
| morganfainberg | dolphm, the verdict is use trollius for it | 00:29 |
| morganfainberg | tulip is a py33 construct | 00:29 |
| morganfainberg | and afaict supplants eventlet | 00:29 |
| dolphm | whoa i didn't know that was in py2 | 00:29 |
| morganfainberg | trollius is py2.7 friendly | 00:29 |
| jamielennox | morganfainberg: there are some testing concerns with removing eventlet | 00:30 |
| dolphm | morganfainberg: and 2.6? | 00:30 |
| morganfainberg | dolphm, it's in the global reqs | 00:30 |
| jamielennox | there are still a couple of tests (i think the client ones) that rely on eventlet so that they can boot a server and communicate with it in the same thread | 00:30 |
| morganfainberg | dolphm, i can only assume, haven't tried | 00:30 |
| morganfainberg | jamielennox, we should be looking at using wsgiref and/or trollius for coroutine magic | 00:30 |
| dolphm | jamielennox: yeah, what's the story with asyncio there? | 00:31 |
| *** nkinder has joined #openstack-keystone | 00:31 | |
| dolphm | morganfainberg: +1 for wsgiref - eventlet is overkill for tests | 00:31 |
| *** bknudson has joined #openstack-keystone | 00:31 | |
| jamielennox | morganfainberg: sure that can be done, it just hasn't yet - webtest has a thing for handling it as well | 00:31 |
| jamielennox | dolphm: asyncio? | 00:31 |
| dolphm | jamielennox: trollius / tullip / asyncio | 00:32 |
| morganfainberg | jamielennox, trollius is asyncio | 00:32 |
| morganfainberg | asyncio is cool | 00:32 |
| jamielennox | the way i had heard trollius etc described in the passed was as a very low level handler and that we should start to see frameworks being built on it now | 00:32 |
| morganfainberg | it's a little more explicit than eventlet | 00:32 |
| morganfainberg | but it's def awesome | 00:32 |
| bknudson | does asyncio work with db apis? | 00:32 |
| jamielennox | they didn't seem to recommend most people using asyncio directly | 00:33 |
| morganfainberg | jamielennox, trollius is ~= tuliop | 00:33 |
| morganfainberg | asyncio is the underpinnings | 00:33 |
| jamielennox | also i heard somewhere that asyncio is not compatible with wsgi | 00:33 |
| morganfainberg | bknudson, good question. | 00:33 |
| morganfainberg | jamielennox, mod_wsgi? | 00:33 |
| jamielennox | morganfainberg: at this point i'm ussing the three terms interchangably but i'll stop | 00:33 |
| morganfainberg | jamielennox, because eventlet isn't exactly mod_wsgi safe | 00:33 |
| jamielennox | morganfainberg: not sure how far it stretches, but the wsgi protocol had issues with doing things asynchronously | 00:34 |
| jamielennox | i'd have to go looking for the details | 00:34 |
| morganfainberg | asyncio is coroutine, should be the same as eventlet. | 00:35 |
| morganfainberg | well roughly the same | 00:35 |
| morganfainberg | _should_ :P | 00:35 |
| jamielennox | yea but eventlet does all that nasty stuff to avoid looking like a coroutine | 00:35 |
| morganfainberg | and eventlet also monkeypatches stuff all over | 00:35 |
| morganfainberg | in icky ways | 00:35 |
| jamielennox | anyway i'm happy to have eventlet out - i don't think we need to be the first adopter of trollius/asyncio as it doesn't benefit us that much | 00:36 |
| bknudson | I don't think eventlet benefits us much | 00:36 |
| dolphm | morganfainberg: i've actually been asked "do you run on eventlet or python?" before | 00:36 |
| morganfainberg | dolphm, *blink* | 00:36 |
| morganfainberg | dolphm, i.. i guess thats a valid question... ish | 00:37 |
| jamielennox | dolphm: makes sense :) | 00:37 |
| morganfainberg | i almost have in-memory sqlite patch ready. | 00:37 |
| dolphm | morganfainberg: :D | 00:37 |
| dolphm | it's like christmas | 00:37 |
| jamielennox | dolphm, morganfainberg, bknudson: whist i've got people here is https://review.openstack.org/#/c/81695/ something we should allow in auth_token? | 00:38 |
| morganfainberg | jamielennox, interesting | 00:38 |
| jamielennox | can review later but in principal | 00:38 |
| dolphm | jamielennox: yes, i think so | 00:38 |
| dolphm | jamielennox: the hard part is how to configure the whitelist, i suppose | 00:38 |
| morganfainberg | jamielennox, i like it | 00:38 |
| jamielennox | dolphm: yea, i think it would have to go in a paste file | 00:38 |
| bknudson | jamielennox: who's going to use it? | 00:39 |
| dolphm | bknudson: everyone? | 00:39 |
| bknudson | oh, the discover urls | 00:39 |
| morganfainberg | bknudson, ++ | 00:39 |
| jamielennox | bknudson: well i saw for example that barbican had to split up there whole paste pipeline so that they could have / unprotected | 00:39 |
| dolphm | jamielennox: why are you using ignore case? | 00:39 |
| morganfainberg | jamielennox, that isn't exactly a bad idea though. | 00:39 |
| jamielennox | dolphm: it's a URL path | 00:39 |
| morganfainberg | jamielennox, it isolates secure vs insecure | 00:40 |
| *** marcoemorais has quit IRC | 00:40 | |
| bknudson | splitting up the paste pipeline doesn't sound that bad to me either | 00:40 |
| jamielennox | /v1 ~= /V1 | 00:40 |
| morganfainberg | jamielennox, URLs are case sensitive (well... depending on the web server, IIS is dumb) | 00:40 |
| bknudson | on windows /v1 = /V1 | 00:40 |
| dolphm | bknudson: the internet runs on !windows | 00:40 |
| morganfainberg | bknudson, yay case insensitive filesystems! | 00:40 |
| jamielennox | bknudson: it only make sense to split the pipeline when you want things to have different middleware on different versions | 00:40 |
| * morganfainberg hides in the corner w/ hpfs+ | 00:41 | |
| morganfainberg | and no i don't reimage my computer w/ case sensitive | 00:41 |
| bknudson | seems like you would want your insecure resources would have a simpler middleware | 00:41 |
| morganfainberg | bknudson, ++ | 00:41 |
| morganfainberg | i mean, i am not opposed to having an exclude function | 00:41 |
| jamielennox | bknudson: not always, largely middleware are things like json encode etc that all still apply | 00:42 |
| morganfainberg | but... it seems like the paste pipeline should be split. | 00:42 |
| morganfainberg | especially for things like URL discovery. | 00:42 |
| jamielennox | also we do recommend that /v1 should be publicly accessible | 00:42 |
| bknudson | should we split up keystone paste pipeline? | 00:42 |
| openstackgerrit | Richard Megginson proposed a change to openstack/keystone: better handling for empty/None ldap values https://review.openstack.org/76002 | 00:42 |
| morganfainberg | bknudson, i wouldn't be opposed to it | 00:42 |
| jamielennox | not /v1/{resource} but /v1 for version discovery | 00:43 |
| morganfainberg | might be easier to document than "oh and now write a regex" | 00:43 |
| jamielennox | bknudson: keystone doesn't use auth_token so it doesn't apply here | 00:43 |
| dolphm | jamielennox: does PATH_INFO include fragments or query strings? | 00:44 |
| dolphm | i feel like one of those env vars is surprising in that way.. | 00:44 |
| jamielennox | dolphm: i would assume so | 00:44 |
| jamielennox | i didn't test it on that | 00:44 |
| jamielennox | but i can't see that would matter? | 00:45 |
| *** wchrisj has quit IRC | 00:45 | |
| jamielennox | unless you're thinking about really complex regex's where you exclude on the query string | 00:45 |
| bknudson | does it work if I do /%76%42 instead of /v2 ? | 00:46 |
| bknudson | oops %72%32 | 00:46 |
| jamielennox | ah... | 00:47 |
| morganfainberg | bknudson, LOL | 00:47 |
| jamielennox | i'm guessing no but let me check | 00:47 |
| ayoung | jamielennox, wasn't through jenkins yet. +A now | 00:47 |
| jamielennox | it would depend on when PATH_INFO is resolved | 00:47 |
| ayoung | dstanek, default outform should be PEM | 00:47 |
| jamielennox | bknudson: does our whole current routes system work if you do /%72%32 ? | 00:48 |
| bknudson | jamielennox: that is a good question. | 00:48 |
| *** derek_c has joined #openstack-keystone | 00:48 | |
| jamielennox | 72 = r | 00:49 |
| bknudson | I've totally forgotten my ascii codes | 00:49 |
| morganfainberg | 'Some people, when confronted with a problem, think “I know, I'll use regular expressions.” Now they have two problems.' -- Jamie Zawinski | 00:49 |
| bknudson | still know ebcdic. | 00:49 |
| jamielennox | yep it works | 00:49 |
| jamielennox | well it works for keystone | 00:50 |
| jamielennox | haven't tested the exclude yet | 00:50 |
| jamielennox | morganfainberg: yep, i know that one - that's why you make it a user problem | 00:50 |
| jamielennox | :) | 00:50 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Add a method for changing a user's password in V3 https://review.openstack.org/59914 | 00:50 |
| morganfainberg | jamielennox, i think a regex here is going to open the door for security woes the more i think about it | 00:51 |
| morganfainberg | jamielennox, but it is.. a config issue then | 00:51 |
| jamielennox | morganfainberg: this is why i ask | 00:52 |
| jamielennox | in reality it shouldn't be touched by an administrator | 00:52 |
| jamielennox | it should be set by the project and left alone but you can never guarantee that | 00:52 |
| morganfainberg | jamielennox, but it will be | 00:52 |
| morganfainberg | jamielennox, i just get the strong sense that splitting the pipeline introduces less security risk | 00:53 |
| jamielennox | the main case i would see is "^/(v1|v2)?/?$" | 00:53 |
| jamielennox | morganfainberg: but that doesn't let us do /v1/ as a seperate app to /v1/{resource} | 00:53 |
| morganfainberg | jamielennox, maybe a non-regex explicit whitelist | 00:54 |
| jamielennox | actually i guess it could but that would be an unusual deployment | 00:54 |
| morganfainberg | jamielennox, anything else would be paste splitting. | 00:54 |
| jamielennox | morganfainberg: i was thinking about that - but at somepoint the regex is actually easier | 00:54 |
| morganfainberg | jamielennox, sure, but how many items are you white listing? | 00:55 |
| jamielennox | i would expect it to be just the version disccovery URLs | 00:55 |
| morganfainberg | then why make it a regex | 00:55 |
| morganfainberg | 1 or 2 items are a bad usecase for the regex | 00:56 |
| jamielennox | because otherwise you need a configurable way to say things like do you include a trailing / | 00:56 |
| *** wchrisj has joined #openstack-keystone | 00:56 | |
| jamielennox | i also don't see that we have to limit the other services to that | 00:56 |
| morganfainberg | make a design choice on that. | 00:56 |
| morganfainberg | jamielennox, it's just that using a regex to govern security is making my skin crawl | 00:57 |
| morganfainberg | jamielennox, i'm going to abstain from reviewing this. if other more security minded folks want to jump in, i'll not block it. | 00:57 |
| jamielennox | morganfainberg: oh - i completely understand | 00:57 |
| morganfainberg | but i don't feel comfortable with this approach. | 00:57 |
| morganfainberg | and keystone can't use auth_token middleware right now. | 00:58 |
| morganfainberg | in fact, likely it'll use some other subset of auth_token for the forseeable future because auth_token needs to talk to keystone in some cases | 00:58 |
| morganfainberg | so our usecase is a little bit more specialized | 00:59 |
| jamielennox | morganfainberg: right - i'm not doing this for keystone | 00:59 |
| ayoung | A=65, the rest can be calculated from that | 01:00 |
| morganfainberg | jamielennox, then i'm even more on board with just saying "split the paste pipeline" anyway. | 01:00 |
| morganfainberg | but again, i'll just abstain at this point unless there is a need to step in and toss in my $0.02 | 01:00 |
| jamielennox | morganfainberg: why make for example ceilometer have seperate paste pipelines so that it can do version discovery on / and /v1? | 01:00 |
| morganfainberg | jamielennox, separation of concerns. insecure vs secure | 01:01 |
| morganfainberg | jamielennox, easier to audit, easier to validate, easier to ensure things aren't leaking between them (if you don't want the api insecure, it doesn't go in the insecure pipeline) | 01:01 |
| bknudson | keystone could have separate paste pipelines for discovery, and /auth/tokens (just the POST??) | 01:01 |
| bknudson | and then for the rest | 01:02 |
| jamielennox | bknudson: i think we will end up with something like that to do token pipelines | 01:02 |
| openstackgerrit | A change was merged to openstack/keystone: Add dedicated URL for issuing unscoped federation tokens. https://review.openstack.org/82375 | 01:02 |
| openstackgerrit | A change was merged to openstack/keystone: Always include 'enabled' field in service response https://review.openstack.org/82205 | 01:02 |
| jamielennox | morganfainberg: ok - so ditch it? | 01:02 |
| jamielennox | because a service can always use delay_auth_decision and then enforce that at the policy level | 01:02 |
| morganfainberg | jamielennox, if there is enough momentum behind this approach, i can't say it's the "wrong" one. but i don't feel like it's the right approach | 01:03 |
| bknudson | does any service use delay_auth_decition? | 01:03 |
| jamielennox | bknudson: i've seen it but i can't remember whree | 01:03 |
| bknudson | probably swift! | 01:03 |
| jamielennox | glance has it as default | 01:03 |
| jamielennox | i guess it depends on the authentication style - it makes sense if you hvae good policy enforcement that auth_token just decode the actual token data | 01:06 |
| morganfainberg | dolphm, +Aing the log review | 01:08 |
| morganfainberg | cache log | 01:08 |
| morganfainberg | that is | 01:08 |
| morganfainberg | since 2+2 plus jenkins | 01:09 |
| *** stevemar has joined #openstack-keystone | 01:09 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Rename keystone.tests.fixtures https://review.openstack.org/81721 | 01:10 |
| dolphm | crap i just realized i didn't do the second half of bug 1273867 | 01:14 |
| uvirtbot | Launchpad bug 1273867 in keystone "Keystone API v3 lists disabled endpoints and services in catalog" [High,In progress] https://launchpad.net/bugs/1273867 | 01:14 |
| morganfainberg | dolphm, oopse! | 01:14 |
| bknudson | the service catalog? | 01:14 |
| dolphm | yeah | 01:15 |
| dolphm | the patch merged, and i was wondering why it wasn't Fix Committed on LP... | 01:15 |
| lbragstad | stevemar: hey! quick question on this guy here... https://review.openstack.org/#/c/80193/ | 01:17 |
| lbragstad | will it still work if the IP addresses for AUTH_URL and MANAGEMENT_URL are hardcoded? | 01:17 |
| *** richm has quit IRC | 01:24 | |
| *** rwsu has quit IRC | 01:26 | |
| dstanek | bknudson: thx for getting that pep8 issue | 01:28 |
| bknudson | dstanek: this is something I'm good at. | 01:28 |
| *** wchrisj has quit IRC | 01:31 | |
| *** zhiyan_ is now known as zhiyan | 01:32 | |
| stevemar | lbragstad, you are correct re: the comment / docstring, must have happened when i rebased | 01:36 |
| stevemar | lbragstad, or i just plain ol started it one way, and did it as another *shrugs* | 01:37 |
| lbragstad | stevemar: that happens :) thanks for the update | 01:37 |
| stevemar | lbragstad, got any suggestions for the ip address configuration | 01:37 |
| lbragstad | stevemar: hmmm | 01:37 |
| lbragstad | that's tough, since it's script | 01:38 |
| lbragstad | what is auth_url and management_url intended to point to? | 01:38 |
| lbragstad | s/is/are/ | 01:38 |
| *** wchrisj has joined #openstack-keystone | 01:39 | |
| stevemar | lbragstad, i was copying what ayoung was doing here: https://review.openstack.org/#/c/79096/5/examples/scripts/exercise_v3_regions.py | 01:41 |
| stevemar | looks like he changed it to just endpoint/token, i can do that | 01:41 |
| ayoung | Oh sure blame it on me | 01:41 |
| stevemar | and he tries to get env. variable | 01:41 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: refactor AuthCatalog tests https://review.openstack.org/82686 | 01:41 |
| ayoung | stevemar, OK, lets get first things first | 01:41 |
| stevemar | ayoung, of course | 01:41 |
| lbragstad | lol | 01:41 |
| ayoung | I need to split out the "set things up from scratch" script... | 01:41 |
| stevemar | ayoung, yes, i think that should be it's own :\ | 01:42 |
| lbragstad | is there a way we can add some verification? | 01:42 |
| stevemar | ayoung, cause i want to do the same thing | 01:42 |
| ayoung | https://review.openstack.org/#/c/81166/3/examples/scripts/initialize_keystone.py | 01:42 |
| ayoung | and the tear down | 01:42 |
| ayoung | I can do that right now... | 01:42 |
| stevemar | ayoung, instead I just added a comment saying "assume the env. is set up in a v3 friendly way" | 01:42 |
| *** rwsu has joined #openstack-keystone | 01:42 | |
| stevemar | ayoung, that needs more comments, but otherwise i think it's okay-ish | 01:43 |
| morganfainberg | oooh i found a bug in our models | 01:43 |
| morganfainberg | sql models. | 01:44 |
| morganfainberg | i think. | 01:44 |
| *** wchrisj has quit IRC | 01:44 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Initialization scripts https://review.openstack.org/82687 | 01:45 |
| ayoung | stevemar, ^^ look better? | 01:45 |
| ayoung | stevemar, you can rebase on that... | 01:46 |
| lbragstad | dstanek: qq on https://review.openstack.org/#/c/78117/7/keystone/tests/test_wsgi.py | 01:46 |
| ayoung | meaniwhile I'll clean that one up for commit | 01:46 |
| morganfainberg | role name is meant to be unique, right? role table column name | 01:48 |
| ayoung | morganfainberg, nope | 01:48 |
| stevemar | ayoung, i'll poke around and comment, technically still on vacation until tomorrow :P | 01:48 |
| *** wchrisj has joined #openstack-keystone | 01:49 | |
| morganfainberg | ayoung, where did we drop the unique constraint? | 01:49 |
| ayoung | morganfainberg, atiwari's approach will certainly require multiple entries with the same role name | 01:49 |
| morganfainberg | ayoung, in migration001 we set the constraint to unique, but i'm not seeing it dropped. | 01:49 |
| morganfainberg | ayoung, i am looking at current setup. | 01:50 |
| * morganfainberg runs migrate on a clean db | 01:51 | |
| *** wchrisj_ has joined #openstack-keystone | 01:53 | |
| *** wchrisj has quit IRC | 01:53 | |
| ayoung | morganfainberg, nah, its probably unique now. If we reduce that, it will become a multi column constraint | 01:59 |
| ayoung | morganfainberg, you should know by now that my answers are about how its supposed to work, not how it actually works. | 01:59 |
| morganfainberg | ayoung, i'm trying to make it so we use in-memory sql for testing | 01:59 |
| ayoung | ah. | 01:59 |
| ayoung | that would be very nice | 01:59 |
| *** wchrisj_ has quit IRC | 02:00 | |
| morganfainberg | ayoung, and i'm getting some odd errors with reflection because of constraints not matching the models | 02:00 |
| morganfainberg | ayoung, yeah i expect to land that as soon as RC cuts | 02:00 |
| dstanek | i need an rss feed from gerrit instead of email | 02:01 |
| dstanek | this should be a relatively easy review: https://review.openstack.org/#/c/59914 | 02:03 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: revoke events https://review.openstack.org/81166 | 02:04 |
| dstanek | lbragstad: shoot. just saw your message | 02:06 |
| lbragstad | dstanek: hey, so I was just wondering about https://review.openstack.org/#/c/78117/7/keystone/tests/test_wsgi.py | 02:07 |
| lbragstad | lines 242 and 251, if we should pass all_locales=['it'] as is since all_locales is no longer optional? | 02:08 |
| bknudson | another attempt at getting a keystone.conf file that tempest can use -- https://review.openstack.org/#/c/82358/ | 02:09 |
| dstanek | lbragstad: you are correct. i could have to the default to None and then use the same (all_locals or []) trick i probably used elsewhere in that patch. | 02:10 |
| dstanek | lbragstad: i decided not to since there were only a few places calling that method and the parameter was always being passed in | 02:10 |
| lbragstad | dstanek: ok, cool | 02:11 |
| dstanek | lbragstad: i wanted to remove the other param because is isn't being used, but i did that in a different patch | 02:12 |
| lbragstad | dstanek: ok, I was just curious if that should be refactored since the method signature was changing slightly. | 02:13 |
| *** bknudson has quit IRC | 02:16 | |
| *** nkinder has quit IRC | 02:16 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Enforce scope mutual exclusion for trusts https://review.openstack.org/78489 | 02:19 |
| openstackgerrit | A change was merged to openstack/keystone: Remove extra cache layer debugging https://review.openstack.org/82674 | 02:19 |
| *** amcrn has quit IRC | 02:26 | |
| jamielennox | lbragstad: you still here? | 02:33 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: exclude disabled services from the catalog https://review.openstack.org/82698 | 02:45 |
| dolphm | morganfainberg: bkhudson: final fix is fairly straightforward, but it depends on a bit of a refactor https://review.openstack.org/#/c/82698/ | 02:46 |
| jamielennox | lbragstad: https://bugs.launchpad.net/keystone/+bug/1297059 | 02:48 |
| uvirtbot | Launchpad bug 1297059 in keystone "Migrate 43 fails on old sqlalchemy" [Undecided,New] | 02:48 |
| *** mberlin1 has joined #openstack-keystone | 02:50 | |
| jamielennox | dolphm: you never use the disabled endpoint? | 02:52 |
| dolphm | jamielennox: i'm ensuring it's not returned | 02:52 |
| dolphm | jamielennox: same for a disabled service | 02:52 |
| dolphm | jamielennox: oh you mean from the dict return? | 02:52 |
| jamielennox | yea | 02:52 |
| jamielennox | looking at the refactor | 02:52 |
| *** mberlin has quit IRC | 02:53 | |
| jamielennox | the original is the same | 02:53 |
| dolphm | jamielennox: refresh | 02:53 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: refactor AuthCatalog tests https://review.openstack.org/82686 | 02:53 |
| jamielennox | dummy_disabled_endpoint_ref appears unused | 02:53 |
| jamielennox | oh, ok - i am running tests so haven't checked it out yet - i just hadn't seen what the other was being used for | 02:54 |
| dolphm | jamielennox: i think they were used to illustrate the bug, and then not removed | 02:55 |
| openstackgerrit | David Stanek proposed a change to openstack/python-keystoneclient: Compressed Signature and Validation https://review.openstack.org/71181 | 02:57 |
| jamielennox | dolphm: shoud you be checking the length of the catalog there? | 02:57 |
| jamielennox | i know the original doesn't | 02:57 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: exclude disabled services from the catalog https://review.openstack.org/82698 | 02:57 |
| jamielennox | but it appears you just take the first service from the catalog and check it against the enabled | 02:57 |
| jamielennox | that doesn't mean the disabled isn't there as the second entry | 02:58 |
| dolphm | jamielennox: like this? https://review.openstack.org/#/c/82698/2/keystone/tests/test_auth.py | 02:58 |
| jamielennox | dolphm: lol, right - hadn't looked at the follow up yet | 02:58 |
| dolphm | jamielennox: i tried to keep the first patch as just a refactor :) | 02:58 |
| dolphm | alright, i'm off to bed. i'll cross my fingers for some a couple +A's while i'm asleep :P and an empty rc1 blocklist :D | 03:01 |
| *** wchrisj has joined #openstack-keystone | 03:02 | |
| dolphm | jamielennox: i have no idea how to filter by service.enabled in the v2 catalog query... i tried using subqueryload with an additional filter(), but sqlalchemy didn't like whatever i was doing :-/ | 03:03 |
| dolphm | (here https://review.openstack.org/#/c/82698/2/keystone/catalog/backends/sql.py ) | 03:03 |
| jamielennox | filter_by=Endpoint.service.enabled==True or filter_by=Service.enabled==True doesn't work? | 03:05 |
| jamielennox | (what you've got isn't a terrible solution given it's v2) | 03:06 |
| *** wchrisj has quit IRC | 03:06 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone: Isolate backend loading https://review.openstack.org/74293 | 03:07 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone: Make Pecan the root routing framework https://review.openstack.org/65428 | 03:07 |
| *** wchrisj has joined #openstack-keystone | 03:07 | |
| *** zhiyan is now known as zhiyan_ | 03:10 | |
| *** zhiyan_ is now known as zhiyan | 03:11 | |
| *** wchrisj has quit IRC | 03:14 | |
| *** wchrisj has joined #openstack-keystone | 03:15 | |
| jamielennox | dolphm: yea - it appears you just need to add .filter(Service.enabled == True) to the query | 03:17 |
| *** david-lyle has joined #openstack-keystone | 03:17 | |
| morganfainberg | dolphm, hmm. | 03:18 |
| morganfainberg | jamielennox, oooh! | 03:18 |
| morganfainberg | backend loading isolation! | 03:18 |
| jamielennox | morganfainberg: it's not as exciting as it sounds | 03:19 |
| jamielennox | it just gets it out of the bin/keystone-all path | 03:19 |
| *** devlaps has quit IRC | 03:19 | |
| *** wchrisj_ has joined #openstack-keystone | 03:19 | |
| morganfainberg | jamielennox, still good! | 03:20 |
| jamielennox | dolphm: so obviously i'm wrong regarding the filter... | 03:20 |
| morganfainberg | i'm lookin at dolph's reviews. | 03:20 |
| *** wchrisj has quit IRC | 03:20 | |
| *** wchrisj has joined #openstack-keystone | 03:24 | |
| *** wchrisj_ has quit IRC | 03:25 | |
| morganfainberg | dolphm, still here? | 03:26 |
| morganfainberg | jamielennox, dolphm, not sure about https://review.openstack.org/#/c/82698/2/keystone/catalog/backends/sql.py line 260, shouldn't the query on 253 be updated to cover this service being disabled? | 03:27 |
| *** gokrokve has joined #openstack-keystone | 03:27 | |
| jamielennox | morganfainberg: that's what i'm trying to figure out | 03:28 |
| *** wchrisj_ has joined #openstack-keystone | 03:28 | |
| jamielennox | i can't seem to construct the query thoguh | 03:29 |
| *** wchrisj has quit IRC | 03:29 | |
| morganfainberg | jamielennox, ah | 03:30 |
| morganfainberg | jamielennox, look at the part below in green http://docs.sqlalchemy.org/en/rel_0_9/orm/tutorial.html#joined-load | 03:31 |
| morganfainberg | it would require an eagerload + explicit join | 03:31 |
| morganfainberg | jamielennox, doable with a standard join | 03:31 |
| *** wchrisj has joined #openstack-keystone | 03:32 | |
| morganfainberg | jamielennox, http://docs.sqlalchemy.org/en/rel_0_9/orm/tutorial.html#explicit-join-eagerload not sure i want to see that kind of refactor this late in the game | 03:32 |
| *** wchrisj_ has quit IRC | 03:32 | |
| jamielennox | i do like sqlalchemy but it can be harder to make it do what you want than just writing the sql | 03:32 |
| morganfainberg | jamielennox, or in the case of most people in OpenStack, they try really hard to NOT use SQLAlchemy | 03:32 |
| *** chandankumar_ has joined #openstack-keystone | 03:33 | |
| morganfainberg | that reminds me, i need to do some research on supporting partition tables. | 03:33 |
| morganfainberg | i could see some benefits | 03:33 |
| jamielennox | morganfainberg: looking at that joined+eager query i'm just as happy to let the current review pass | 03:34 |
| morganfainberg | jamielennox, yerah | 03:34 |
| jamielennox | non-enabled services aren't common enough to figure that out right now | 03:34 |
| morganfainberg | jamielennox, i don't want to see that level of change atm | 03:34 |
| jamielennox | morganfainberg: removing cache logging from tests makes the world a better place | 03:34 |
| morganfainberg | jamielennox, :) | 03:35 |
| morganfainberg | jamielennox, it was good to have when we initially launched caching | 03:35 |
| morganfainberg | now... not as much | 03:35 |
| jamielennox | it will make gate issues so much easier to find | 03:35 |
| jamielennox | morganfainberg: +A https://review.openstack.org/#/c/78068/ ? | 03:38 |
| morganfainberg | oh yeah | 03:38 |
| jamielennox | thanks | 03:39 |
| *** wchrisj_ has joined #openstack-keystone | 03:39 | |
| *** wchrisj has quit IRC | 03:40 | |
| *** chandankumar_ has quit IRC | 03:40 | |
| jamielennox | morganfainberg: you like the @positional decorator as well didn't you: https://review.openstack.org/#/c/77026 | 03:40 |
| jamielennox | it's a 0.7 blocker and if i can get it cleaned up now it doesn't have to be at the meeting tomorrow | 03:41 |
| morganfainberg | yeah | 03:41 |
| jamielennox | i've got bknudson's +2 so rolling through now | 03:41 |
| *** wchrisj has joined #openstack-keystone | 03:43 | |
| *** wchrisj_ has quit IRC | 03:43 | |
| openstackgerrit | Richard Megginson proposed a change to openstack/keystone: better handling for empty/None ldap values https://review.openstack.org/76002 | 03:45 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Fix passing get_token kwargs to get_access https://review.openstack.org/76733 | 03:46 |
| *** wchrisj has quit IRC | 03:47 | |
| dstanek | morganfainberg: looking at https://review.openstack.org/#/c/80368/7/keystone/assignment/core.py and i disagree with the renaming | 03:48 |
| morganfainberg | dstanek, i disagree with more than just the renaming | 03:48 |
| dstanek | morganfainberg: i think that the event handler methods can be called handle_*, but the driver methods really have nothing to do with the event | 03:49 |
| morganfainberg | dstanek, ah sure | 03:49 |
| morganfainberg | dstanek, works for me | 03:49 |
| *** harlowja_ is now known as harlowja_away | 03:49 | |
| jamielennox | dstanek: can you have a look at your -1 on https://review.openstack.org/#/c/77055/8 | 03:49 |
| dstanek | jamielennox: sure | 03:50 |
| *** gokrokve has quit IRC | 03:50 | |
| jamielennox | morganfainberg: ^ is also a release block for client and really easy to review | 03:50 |
| morganfainberg | jamielennox, lol going to have to wait on that one, winding down for a bit :) | 03:50 |
| morganfainberg | but before i slepp i'll look at it | 03:50 |
| jamielennox | morganfainberg: no worries | 03:51 |
| *** gokrokve has joined #openstack-keystone | 03:52 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Start using positional decorator https://review.openstack.org/77055 | 03:53 |
| *** chandankumar_ has joined #openstack-keystone | 03:55 | |
| *** gokrokve has quit IRC | 03:57 | |
| dstanek | jamielennox: looking at https://review.openstack.org/#/c/77055/9/keystoneclient/v3/policies.py - what criteria are you using to determine which methods should all be kwargs and which ones not? | 03:58 |
| jamielennox | dstanek: basically personal taste - but are you referring to anything in particular? | 03:58 |
| jamielennox | update() should always take as the first argument the resource so that i think should be an *arg | 03:59 |
| jamielennox | but for create and the others anything that is an attribute of a resource i think should be a kwargs even if it is a required attribute | 03:59 |
| jamielennox | so possibly blob= should have been a kwarg | 04:00 |
| jamielennox | though in that case because you are most likely only passing one argument to the create it is probably ok to leave as an arg | 04:00 |
| jamielennox | ignore those last two lines, blob=None - so it is a kwargs anyway | 04:01 |
| jamielennox | lol - damnit ignore the ignore - i was looking at resource.update | 04:01 |
| dstanek | jamielennox: GroupManager.update also looks me like it should also be all kwargs | 04:04 |
| dstanek | in general the pattern seems to be that all of the args should be kwargs except self, but there are exceptions in your patch | 04:05 |
| jamielennox | dstanek: no because .update expects the resource to be passed first | 04:05 |
| jamielennox | g = client.groups.get(42) | 04:06 |
| jamielennox | client.groups.update(g, name='new name') | 04:06 |
| jamielennox | if you can g.update(name='new name') it will route internally to call client.groups.update(g, **kwargs) as well | 04:06 |
| dstanek | ah, so this is a routes thing? | 04:07 |
| jamielennox | dstanek: no routes is a server side term, but the managers control the logic and the resources are fairly dumb | 04:08 |
| jamielennox | routes as a library is a server side thing | 04:08 |
| jamielennox | so functions called on a resource will get sent to the manager with the resource as the first argument | 04:08 |
| dstanek | so in general the .update methods allow the non-kwarg arg | 04:11 |
| jamielennox | yea, update, and delete etc should take a single non-kwarg - update should then also take the kwargs you want to change | 04:12 |
| dstanek | jamielennox: credentials seems to have a different pattern | 04:15 |
| jamielennox | so yea credentials.create allows blob as an arg - i'm not sure whether that's right or not | 04:15 |
| dstanek | jamielennox: CredentialManager.create has two required args that don't have to be kwargs. most the the other managers force everything to be specified as kwargs for create | 04:17 |
| jamielennox | huh, yep - that's wrong | 04:18 |
| dstanek | jamielennox: i would also expect PolicyManager.create to specify positional(1, ...) | 04:21 |
| *** devlaps has joined #openstack-keystone | 04:21 | |
| jamielennox | yep | 04:23 |
| *** chandankumar_ has quit IRC | 04:23 | |
| jamielennox | dstanek: let me know when you finish and i'll upload a fix with those 3 | 04:27 |
| dstanek | jamielennox: all done :-) once you upload i'll quickly skim and +2 it | 04:28 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Start using positional decorator https://review.openstack.org/77055 | 04:28 |
| jamielennox | dstanek: ^ | 04:28 |
| openstackgerrit | A change was merged to openstack/keystone: Change the default version discovery URLs https://review.openstack.org/78068 | 04:31 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone: Make Pecan the root routing framework https://review.openstack.org/65428 | 04:31 |
| dstanek | jamielennox: thx | 04:35 |
| jamielennox | lol, another URL discovery format for nova: http://docs.openstack.org/api/openstack-compute/2/content/Versions-d1e1193.html | 04:35 |
| jamielennox | i love the open source thing but sometimes consistency is better than the perfect response | 04:36 |
| jamielennox | dstanek: and thank you | 04:36 |
| *** derek_c has quit IRC | 04:48 | |
| openstackgerrit | A change was merged to openstack/keystone: Rename keystone.tests.fixtures https://review.openstack.org/81721 | 04:49 |
| *** stevemar has quit IRC | 05:05 | |
| *** derek_c has joined #openstack-keystone | 05:10 | |
| openstackgerrit | guang-yee proposed a change to openstack/python-keystoneclient: Implement endpoint filtering functionality on the client side. https://review.openstack.org/82713 | 05:18 |
| *** gokrokve has joined #openstack-keystone | 05:21 | |
| *** gokrokve has quit IRC | 05:25 | |
| *** YorikSar has quit IRC | 05:37 | |
| *** chandan_kumar has quit IRC | 05:48 | |
| openstackgerrit | Jenkins proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/78525 | 06:05 |
| *** andreaf has joined #openstack-keystone | 06:14 | |
| *** dstanek has quit IRC | 06:15 | |
| *** dstanek has joined #openstack-keystone | 06:22 | |
| *** YorikSar has joined #openstack-keystone | 06:32 | |
| *** jaosorior has joined #openstack-keystone | 06:51 | |
| *** dstanek has quit IRC | 07:04 | |
| *** andreaf has quit IRC | 07:08 | |
| *** devlaps has quit IRC | 07:17 | |
| *** gokrokve has joined #openstack-keystone | 07:21 | |
| *** gokrokve has quit IRC | 07:26 | |
| *** saju_m has joined #openstack-keystone | 07:30 | |
| *** derek_c has quit IRC | 07:41 | |
| *** flaper87|afk is now known as flaper87 | 07:51 | |
| *** Gippa has joined #openstack-keystone | 08:20 | |
| *** leseb has joined #openstack-keystone | 08:40 | |
| *** saju_m has quit IRC | 08:50 | |
| *** saju_m has joined #openstack-keystone | 08:52 | |
| *** andreaf has joined #openstack-keystone | 08:53 | |
| *** YorikSar has quit IRC | 08:55 | |
| *** YorikSar has joined #openstack-keystone | 08:56 | |
| *** gokrokve has joined #openstack-keystone | 09:05 | |
| *** gokrokve has quit IRC | 09:05 | |
| *** gokrokve has joined #openstack-keystone | 09:05 | |
| *** chandan_kumar has joined #openstack-keystone | 09:13 | |
| *** Gippa has quit IRC | 09:22 | |
| *** saju_m has quit IRC | 09:38 | |
| *** bvandenh has quit IRC | 09:47 | |
| *** henrynash has joined #openstack-keystone | 09:47 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Add a positional decorator https://review.openstack.org/77026 | 09:49 |
| *** andreaf has quit IRC | 09:49 | |
| *** Gippa has joined #openstack-keystone | 09:56 | |
| *** saju_m has joined #openstack-keystone | 09:57 | |
| *** morganfainberg is now known as morganfainberg_Z | 10:05 | |
| *** Gippa has quit IRC | 10:10 | |
| *** bvandenh has joined #openstack-keystone | 10:10 | |
| *** andreaf has joined #openstack-keystone | 10:47 | |
| *** saju_m has quit IRC | 11:07 | |
| *** saju_m has joined #openstack-keystone | 11:08 | |
| lbragstad | jamielennox: sorry, checking now. | 11:09 |
| *** saju_m has quit IRC | 11:09 | |
| lbragstad | jamielennox: adding morganfainberg_Z to the bug report since he helped with the migrations quite a bit. | 11:12 |
| *** saju_m has joined #openstack-keystone | 11:15 | |
| *** leseb has quit IRC | 11:19 | |
| *** leseb has joined #openstack-keystone | 11:20 | |
| *** gokrokve has quit IRC | 11:23 | |
| *** leseb has quit IRC | 11:24 | |
| *** gokrokve has joined #openstack-keystone | 11:34 | |
| *** gokrokve_ has joined #openstack-keystone | 11:38 | |
| *** saju_m has quit IRC | 11:38 | |
| *** saju_m has joined #openstack-keystone | 11:38 | |
| *** gokrokve has quit IRC | 11:39 | |
| *** gokrokve_ has quit IRC | 11:42 | |
| dolphm | jamielennox: that's not new afaict | 11:47 |
| *** leseb has joined #openstack-keystone | 11:50 | |
| lbragstad | I tried it in virtualenv and I can't seem to reproduce with 0.7.10 | 11:55 |
| *** leseb has quit IRC | 11:55 | |
| *** harlowja_away has quit IRC | 12:03 | |
| *** gokrokve has joined #openstack-keystone | 12:10 | |
| dolphm | lbragstad: jamielennox: repro'd and i think this fixes it https://review.openstack.org/#/c/82793/ | 12:15 |
| lbragstad | dolphm: how did you recreate? sqlalchemy version 0.7.10? | 12:17 |
| dolphm | lbragstad: yeah, i didn't have any trouble reproducing -- copy/pasted shell output into the bug https://bugs.launchpad.net/keystone/+bug/1297059/comments/4 | 12:17 |
| uvirtbot | Launchpad bug 1297059 in keystone "Migrate 43 fails on old sqlalchemy" [Medium,In progress] | 12:17 |
| *** gokrokve has quit IRC | 12:19 | |
| *** gokrokve has joined #openstack-keystone | 12:22 | |
| *** david-lyle has quit IRC | 12:23 | |
| *** gokrokve has quit IRC | 12:28 | |
| *** gokrokve has joined #openstack-keystone | 12:32 | |
| *** saju_m has quit IRC | 12:41 | |
| *** gokrokve has quit IRC | 12:43 | |
| *** gokrokve has joined #openstack-keystone | 12:43 | |
| *** leseb has joined #openstack-keystone | 12:43 | |
| *** gokrokve has quit IRC | 12:47 | |
| *** marekd|away is now known as marekd | 12:52 | |
| *** dims_ has quit IRC | 12:52 | |
| *** gokrokve has joined #openstack-keystone | 12:53 | |
| *** saju_m has joined #openstack-keystone | 12:55 | |
| *** YorikSar has quit IRC | 12:56 | |
| *** YorikSar has joined #openstack-keystone | 12:58 | |
| *** saju_m has quit IRC | 12:59 | |
| *** joesavak has joined #openstack-keystone | 13:00 | |
| *** saju_m has joined #openstack-keystone | 13:01 | |
| *** dims_ has joined #openstack-keystone | 13:02 | |
| *** saju_m has quit IRC | 13:04 | |
| *** saju_m has joined #openstack-keystone | 13:06 | |
| *** bknudson has joined #openstack-keystone | 13:09 | |
| *** saju_m has quit IRC | 13:09 | |
| *** saju_m has joined #openstack-keystone | 13:11 | |
| *** browne has joined #openstack-keystone | 13:17 | |
| *** dstanek has joined #openstack-keystone | 13:19 | |
| *** wchrisj has joined #openstack-keystone | 13:20 | |
| *** ChanServ changes topic to "the gerrit event stream is currently hung, blocking all testing. troubleshooting is in progress (next update at 14:00 utc)" | 13:21 | |
| dstanek | ayoung: https://review.openstack.org/#/c/71181/ is still having problems | 13:21 |
| dstanek | ayoung: i fixed a bug that i found in the error log, but not the error seems to be invalid credentials | 13:22 |
| dstanek | ayoung: i wonder if this change somehow breaks existing encoded tokens | 13:22 |
| *** wchrisj has quit IRC | 13:26 | |
| *** ChanServ changes topic to "[ Icehouse RC blockers https://launchpad.net/keystone/+milestone/icehouse-rc1 ][ Icehouse RC Target Date: March 27th, 2014 ][ No new strings during string freeze (dolphm was wrong!) - ping dolphm concerning exceptions ]" | 13:29 | |
| ayoung | dstanek, it might be | 13:35 |
| *** wchrisj has joined #openstack-keystone | 13:35 | |
| *** lbragstad has quit IRC | 13:35 | |
| ayoung | dstanek, link? | 13:35 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Example Initialization scripts https://review.openstack.org/82687 | 13:39 |
| dstanek | ayoung: https://review.openstack.org/#/c/71181/ | 13:45 |
| ayoung | dstanek, yeah, but which failure? Or is it in the devstack setup? | 13:46 |
| dstanek | ayoung: "Invalid OpenStack Identity credentials." in grenade | 13:46 |
| ayoung | dstanek, OK, so one thing we've needed to do ever since the "use the client libraray for signing" is figure out how to use a git checkout from /opt/stack/python-keystoneclient in a keystone run out of /opt/stack/keystone | 13:47 |
| ayoung | manually, I'm guessing the process is something like: | 13:48 |
| ayoung | run setup.py -- something in python-kc | 13:48 |
| ayoung | get a package, | 13:48 |
| ayoung | activate the venv in server | 13:48 |
| ayoung | and install the package | 13:48 |
| ayoung | that sound right? | 13:48 |
| dstanek | ayoung: if you are already activated you can just 'python setup.py install' in python-kc | 13:49 |
| ayoung | right... | 13:49 |
| dstanek | if you can't install you can adjus the path | 13:49 |
| dstanek | adjust | 13:49 |
| *** wchrisj has quit IRC | 13:57 | |
| *** wchrisj_ has joined #openstack-keystone | 13:59 | |
| dolphm | dstanek: ayoung: small, nice-to-have for RC1 https://review.openstack.org/#/c/82793/ | 14:01 |
| ayoung | dolphm, seems like it is changing the meaning. | 14:02 |
| ayoung | columns.vales is different from columns. You sure it means the same thing? | 14:03 |
| dstanek | ayoung: the len should be the same if columns is a dictionary | 14:03 |
| ayoung | dstanek, I see that, but then why the error? | 14:03 |
| dstanek | ayoung: error? | 14:04 |
| ayoung | util/_collections.py", line 106, in __getattr__ | 14:04 |
| ayoung | raise AttributeError(key) | 14:04 |
| ayoung | AttributeError: values | 14:04 |
| ayoung | if there are no values in a collection, shouldn't you get back something of len() == 1? | 14:05 |
| dstanek | how are you getting that exception? | 14:06 |
| *** lbragstad has joined #openstack-keystone | 14:06 | |
| dstanek | i would expect an empty collection to have a 0 length | 14:06 |
| *** stevemar has joined #openstack-keystone | 14:06 | |
| ayoung | dstanek, and it might be that idx.columns is not a dictionary in some version of SQLA | 14:07 |
| dstanek | ayoung: that's what i'm looking to confirm now | 14:07 |
| ayoung | OK...I can get behind that one | 14:07 |
| dolphm | ayoung: see the first comment on the review for an example | 14:12 |
| ayoung | dolphm, yep, that is why I +2ed | 14:12 |
| dolphm | ayoung: ah, i'm behind -- thanks! | 14:13 |
| * dolphm our 24 hour countdown to RC1 has started -- unless we can find new release blockers, we'll have an RC1 tomorrow morning | 14:13 | |
| dstanek | dolphm: after this meeting i just want to take a quick peek at the sqlalchemy api before i +2 | 14:19 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Remember the DN https://review.openstack.org/47441 | 14:29 |
| *** nkinder has joined #openstack-keystone | 14:30 | |
| *** david-lyle has joined #openstack-keystone | 14:31 | |
| *** zoresvit has joined #openstack-keystone | 14:32 | |
| *** leseb has quit IRC | 14:38 | |
| ayoung | dolphm, I wouldn't consider it a blocker, but would like to get https://review.openstack.org/47441 in if possible. Its a nice performance tune | 14:39 |
| *** YorikSar has quit IRC | 14:43 | |
| dolphm | dstanek: cool | 14:46 |
| dstanek | dolphm: all done, just need jenkins | 14:46 |
| openstackgerrit | Matthieu Huin proposed a change to openstack/python-keystoneclient: Limited use trusts https://review.openstack.org/57492 | 14:51 |
| *** thedodd has joined #openstack-keystone | 14:54 | |
| bknudson | dolphm: do we need to have keystone requirements up to date for rc1 ? https://review.openstack.org/#/c/82372/ and https://review.openstack.org/#/c/82231/ | 14:55 |
| dolphm | bknudson: i'd like to | 14:56 |
| dolphm | ayoung: i'm looking at that patch again -- it's not the easiest review! | 14:56 |
| ayoung | dolphm, heh | 14:56 |
| ayoung | dolphm, the idea is that the lookup by DN is expensive, and if we already have done it once, we record the DN in the object to avoid a round trip to the LDAP servier | 14:57 |
| ayoung | then we remove the DN from the object before reporting to the outside world | 14:57 |
| dolphm | ayoung: i like the concept of the patch, it's the number of method that have the word "filter" in them that makes it a mind fuck | 14:58 |
| ayoung | https://review.openstack.org/#/c/47441/11/keystone/common/ldap/core.py is there so that it can be used by assignments eventually. | 14:58 |
| ayoung | nkinder treid to extend it to assignments, but it was too much for one patch, and since I am more concerned with Identity for LDAP, we figured we would scale it back | 14:58 |
| ayoung | but I was glad to have someone with such in depth LDAP know how back me up on it | 14:59 |
| *** zoresvit has quit IRC | 15:03 | |
| *** devlaps has joined #openstack-keystone | 15:04 | |
| *** leseb has joined #openstack-keystone | 15:05 | |
| *** jsavak has joined #openstack-keystone | 15:07 | |
| *** joesavak has quit IRC | 15:08 | |
| *** saju_m has quit IRC | 15:13 | |
| *** packet has joined #openstack-keystone | 15:14 | |
| *** wchrisj_ has quit IRC | 15:15 | |
| dolphm | ayoung: this looks risky- https://review.openstack.org/#/c/47441/ | 15:22 |
| *** YorikSar has joined #openstack-keystone | 15:23 | |
| ayoung | dolphm, I think so, too. I think that you are right: there should not be two filter_functions. | 15:29 |
| ayoung | lets hold off on that one for now | 15:29 |
| dolphm | ayoung: happy to take the risk once we're open for juno | 15:29 |
| ayoung | dolphm, I'll redo it then to cover identity and assignment | 15:30 |
| ayoung | I think the code would actually be clearer | 15:30 |
| nkinder | ayoung: I may have some old patches that cover part of assignment | 15:31 |
| nkinder | ayoung: they likely don't apply cleanly anymore though... | 15:32 |
| ayoung | nkinder, I think that the split of the filter function broke some assumptions on that patch | 15:32 |
| nkinder | yeah | 15:32 |
| ayoung | nkinder, we'll have an LDAP huddle at the summit and figure out the most pressing topics to address, I think | 15:33 |
| nkinder | ayoung: yeah, that would be good | 15:33 |
| *** wchrisj has joined #openstack-keystone | 15:35 | |
| *** wchrisj has quit IRC | 15:35 | |
| *** wchrisj has joined #openstack-keystone | 15:36 | |
| *** ayoung has quit IRC | 15:37 | |
| stevemar | dstanek, OS_LOG_CAPTURE=0 -> discard data even if test fails, but 1 would discard data only if test fails? | 15:39 |
| dstanek | 0 discards, but 1 will print it out for a failing test | 15:40 |
| dstanek | let me check how i worded that | 15:41 |
| dstanek | stevemar: it looks like my comment in developing.rst is slightly incorrect, but the commit message is accurate - does it make sense? | 15:46 |
| stevemar | dstanek, looking at commit message | 15:48 |
| *** ayoung has joined #openstack-keystone | 15:48 | |
| dstanek | stevemar: the difference is that as implemented all three stream are printed for failing tests | 15:49 |
| dstanek | i default all of those vars to 1 | 15:49 |
| stevemar | dstanek, silly question, but in testr.conf, it shows as defaulted to -1? whats going on there? | 15:50 |
| dstanek | that's bash there is a :- operator that says if you don't have a value use this one - sorta like Python's dict.setdefault | 15:51 |
| dolphm | jamielennox: the patch for this was only Partial-Bug ... is that still accurate? https://bugs.launchpad.net/python-keystoneclient/+bug/1295881 | 15:53 |
| uvirtbot | Launchpad bug 1295881 in python-keystoneclient "*args vs **kwargs is unmanagable for future compatibility" [Medium,In progress] | 15:53 |
| *** packet has quit IRC | 15:57 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Allows override of stdout/stderr/log capturing https://review.openstack.org/79069 | 15:58 |
| *** packet has joined #openstack-keystone | 15:59 | |
| *** jaosorior has quit IRC | 16:00 | |
| openstackgerrit | A change was merged to openstack/keystone: Sync oslo-incubator db.sqlalchemy b9e2499 https://review.openstack.org/82594 | 16:02 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Use CMS to generate sample tokens https://review.openstack.org/73772 | 16:09 |
| *** marcoemorais has joined #openstack-keystone | 16:09 | |
| ayoung | dstanek, ^^ might have been why devstack was failing, although I doubt it. | 16:09 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/python-keystoneclient: sanity check memcached availability before running tests against it https://review.openstack.org/82527 | 16:13 |
| dolphm | jamielennox: ^ | 16:14 |
| openstackgerrit | A change was merged to openstack/keystone: Fix doc build errors with SQLAlchemy 0.9 https://review.openstack.org/82367 | 16:14 |
| openstackgerrit | A change was merged to openstack/keystone: Updated from global requirements https://review.openstack.org/82372 | 16:15 |
| dstanek | ayoung: from the lack output i assumed tempest was trying set things up with keystone and that failed | 16:16 |
| ayoung | dstanek, yeah. I need to get a devstack up and running, but having VM issues ATM... | 16:16 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Sync test_migrations https://review.openstack.org/80618 | 16:18 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 16:18 |
| *** joesavak has joined #openstack-keystone | 16:21 | |
| *** jsavak has quit IRC | 16:23 | |
| *** zoresvit has joined #openstack-keystone | 16:24 | |
| dstanek | dolphm: so you're not worried about backward compatibility for the kc middleware? | 16:27 |
| dolphm | dstanek: i'm not sure what we'd be trying to maintain compatibility with? extended implementations? | 16:27 |
| *** andreaf has quit IRC | 16:27 | |
| dstanek | dolphm: anyone that subclassed and modified behavior | 16:28 |
| dstanek | dolphm: i'm ok if we don't have those guarantees, but right now i don't have a good handle on this in kc | 16:29 |
| dolphm | dstanek: A) i'm simply not aware of anyone doing so B) this will be in 0.7.0 rather than a minor version bump | 16:29 |
| *** zoresvit has quit IRC | 16:34 | |
| dstanek | dolphm: fair enough, is there a rule of thumb for what we consider the public part of the API and how to let people know a change is coming? | 16:34 |
| dstanek | dolphm: like we do on the server side with deprecated | 16:34 |
| dolphm | dstanek: i'd consider all of the public Client() interface (and all manager methods) to be public / stable of course | 16:39 |
| dolphm | dstanek: second most important would be the headers passed down from auth_token to consuming services | 16:39 |
| dolphm | dstanek: beyond that, we haven't had a good story for introducing deprecations (or much reason to before now) | 16:40 |
| dolphm | dstanek: on that note, thoughts on the deprecation approach in https://review.openstack.org/#/c/77491/2/keystoneclient/middleware/auth_token.py ? | 16:43 |
| dolphm | dstanek: (see my comment on L224) | 16:43 |
| dstanek | dolphm: looking now | 16:45 |
| dstanek | i'm watching all about Google's cloud! | 16:46 |
| dolphm | dstanek: i thought google *was* "the cloud" | 16:48 |
| dstanek | well i was anyway, but the Google is experiencing technical difficulties | 16:49 |
| dolphm | must be bad weather | 16:49 |
| dstanek | s/the cloud/big brother/ | 16:49 |
| dstanek | dolphm: good observation on line 224 | 16:53 |
| *** topol has joined #openstack-keystone | 16:56 | |
| *** jsavak has joined #openstack-keystone | 16:58 | |
| dolphm | dstanek: thoughts on https://review.openstack.org/#/c/59914/ with a method signature change to http://pasteraw.com/9labq7tnhsfnp9rgono179d5vlqf7l8 ? | 16:58 |
| dolphm | - def update_own_password(self, origpasswd, passwd): | 16:58 |
| dolphm | + def update_password(self, old_password, new_password): | 16:58 |
| dstanek | dolphm: that would be fine with me | 17:00 |
| *** joesavak has quit IRC | 17:01 | |
| *** harlowja has joined #openstack-keystone | 17:03 | |
| *** morganfainberg_Z is now known as morganfainberg | 17:04 | |
| topol | are we meeting today? | 17:07 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/python-keystoneclient: Add a method for changing a user's password in v3 https://review.openstack.org/82870 | 17:07 |
| morganfainberg | topol, hour later since DST. | 17:07 |
| topol | crap!! | 17:07 |
| morganfainberg | dolphm, so old sqlalchemy is broken /w that migrate? | 17:07 |
| morganfainberg | lbragstad, ^ | 17:08 |
| morganfainberg | what is the window of support needed for SQLA? | 17:08 |
| dolphm | dstanek: proposed an alternative review with the diff included, along with slightly stronger validation and tests https://review.openstack.org/#/c/82870/ | 17:08 |
| dolphm | morganfainberg: the .values() thing? | 17:08 |
| dolphm | morganfainberg: i think the argument was just that we should support what's in our requirements file | 17:09 |
| dolphm | morganfainberg: and it wasn't unreasonable to fix support for the minimum required version | 17:09 |
| morganfainberg | dolphm, sqlalchemy-migrate>=0.8.2,!=0.8.4 | 17:09 |
| dolphm | morganfainberg: it was sqlalchemy itself, not migrate | 17:09 |
| morganfainberg | oh wait sec | 17:09 |
| morganfainberg | yeah | 17:09 |
| morganfainberg | i thought we were past 0.7 as a minimum | 17:10 |
| morganfainberg | *facepalm* | 17:10 |
| morganfainberg | i can fix that. | 17:10 |
| dolphm | morganfainberg: https://github.com/openstack/requirements/blob/master/global-requirements.txt#L112 | 17:10 |
| morganfainberg | yeah i see it: SQLAlchemy>=0.7.8,<=0.9.99 | 17:11 |
| dolphm | morganfainberg: there's a comment there about < 0.8 | 17:11 |
| morganfainberg | yep i see it | 17:11 |
| morganfainberg | ah there was a fix already? | 17:12 |
| morganfainberg | cool. | 17:12 |
| morganfainberg | this is what happens being on the west coast :P | 17:12 |
| morganfainberg | i miss the morning stuff | 17:12 |
| morganfainberg | :P | 17:12 |
| *** lbragstad has quit IRC | 17:12 | |
| dolphm | morganfainberg: oh, yeah lol | 17:13 |
| dolphm | morganfainberg: if you'd like to push buttons though, i have reviews for you | 17:14 |
| morganfainberg | dolphm, lol sure. | 17:17 |
| morganfainberg | dolphm, just got in so sitting down to look at the state of things | 17:18 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/identity-api: clarify user & project namespacing https://review.openstack.org/82876 | 17:20 |
| morganfainberg | dolphm, https://launchpad.net/keystone/+milestone/icehouse-rc1 i like the look of that page atm | 17:20 |
| dolphm | morganfainberg: ++ | 17:20 |
| dolphm | morganfainberg: there's two client reviews that need some love https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting | 17:21 |
| *** leseb has quit IRC | 17:21 | |
| dolphm | morganfainberg: hoping to cut keystoneclient 0.7.0 along with RC1 | 17:21 |
| morganfainberg | dolphm, cool | 17:21 |
| dolphm | morganfainberg: (both targeting tomorrow morning) | 17:21 |
| dolphm | morganfainberg: that was jamie's wishlist for client changes, plus the password self-service thing, which i think has been blocking a corresponding change in horizon :( | 17:22 |
| morganfainberg | dolphm, so the 76733 and 77748? | 17:22 |
| morganfainberg | dolphm, oooh password one | 17:23 |
| dolphm | morganfainberg: and https://review.openstack.org/#/c/82870/ | 17:23 |
| morganfainberg | dolphm, yeah ok. | 17:23 |
| dolphm | (or the original if you prefer the v2 client method signature) | 17:24 |
| *** lbragstad has joined #openstack-keystone | 17:24 | |
| *** pcargnel has joined #openstack-keystone | 17:25 | |
| *** andreaf has joined #openstack-keystone | 17:25 | |
| dolphm | i also added https://review.openstack.org/#/c/82527/ but it's really low priority | 17:27 |
| *** gyee has joined #openstack-keystone | 17:32 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/python-keystoneclient: Handle URLs via the session and auth_plugins https://review.openstack.org/60752 | 17:32 |
| dolphm | fixed the merge conflict here ^ | 17:33 |
| dolphm | jamielennox: bknudson: gyee: ^ | 17:33 |
| gyee | dolphm, k | 17:34 |
| *** flaper87 is now known as flaper87|afk | 17:41 | |
| dolphm | morganfainberg: gyee: thanks! | 17:42 |
| dolphm | morganfainberg: gyee: dstanek: the last one i'd like to see land is this one, as it was reported on the mailing list recently https://review.openstack.org/#/c/82527/ | 17:43 |
| gyee | dolphm, sure, I am reviewing it | 17:44 |
| gyee | dolphm, are you thinking of a new keystoneclient release soon? | 17:45 |
| dolphm | gyee: aiming for tomorrow morning | 17:45 |
| gyee | dolphm, awesome! | 17:45 |
| dolphm | gyee: which means if it's not gating today, then it probably won't make it | 17:45 |
| gyee | I am helping to get other clients to support V3 so I could use the new features | 17:45 |
| dolphm | gyee: that'll give us a bit of time to have a 0.7.1 before icehouse is properly released if need be | 17:45 |
| dolphm | gyee: AWESOME | 17:46 |
| dolphm | gyee: would you mind giving an update on the state that work in today's keystone meeting? it's not something everyone has enough visibility on | 17:46 |
| dolphm | gyee: especially given that the effort is so distributed -- it's not easy to track | 17:46 |
| *** zuqiang has joined #openstack-keystone | 17:46 | |
| gyee | dolphm, sure, I've started with barbicanclient | 17:46 |
| gyee | https://review.openstack.org/#/c/80124/ | 17:47 |
| gyee | would love to have the Session and auth plugins available so saved me a bunch of boilerplate code | 17:48 |
| *** amcrn has joined #openstack-keystone | 17:49 | |
| *** dstanek has quit IRC | 17:49 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/python-keystoneclient: Improve language in update_password() validation error https://review.openstack.org/82886 | 17:55 |
| dolphm | morganfainberg: https://review.openstack.org/#/c/82886/1/keystoneclient/v3/users.py | 17:56 |
| *** thedodd has quit IRC | 18:00 | |
| *** dstanek has joined #openstack-keystone | 18:01 | |
| dstanek | dolphm: i think it's fine, but i wish we could have the function run only once | 18:02 |
| dolphm | dstanek: it sort of only runs once | 18:03 |
| dolphm | dstanek: but you mean at the setUp level? | 18:04 |
| dstanek | dolphm: yeah, not a big deal though | 18:04 |
| *** packet has quit IRC | 18:07 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Start using positional decorator https://review.openstack.org/77055 | 18:10 |
| *** packet has joined #openstack-keystone | 18:11 | |
| dstanek | dolphm: with memcached disabled and without your patch i don't get test failures; and i just verified that the tests that should fail are running | 18:12 |
| dolphm | dstanek: i'm confused - are you saying you can't reproduce the problem *with* or *without* my patch? | 18:13 |
| *** vhoward has left #openstack-keystone | 18:14 | |
| dstanek | dolphm: i can't reproduce it without | 18:14 |
| dolphm | dstanek: are you sure memcached isn't running? | 18:14 |
| dolphm | dstanek: and that you have python-memcached installed? | 18:14 |
| dstanek | yes connection refused when telneting to localhost 11211 | 18:15 |
| dstanek | ah, it may be that i don't have the lib | 18:15 |
| *** shakamunyi has joined #openstack-keystone | 18:25 | |
| *** shakamunyi has quit IRC | 18:25 | |
| *** shakamunyi has joined #openstack-keystone | 18:26 | |
| *** shakamunyi has quit IRC | 18:26 | |
| *** zoresvit has joined #openstack-keystone | 18:33 | |
| *** jaosorior has joined #openstack-keystone | 18:36 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Fix passing get_token kwargs to get_access https://review.openstack.org/76733 | 18:42 |
| *** devlaps1 has joined #openstack-keystone | 18:44 | |
| *** devlaps has quit IRC | 18:46 | |
| *** pcargnel has quit IRC | 18:48 | |
| *** zhiyan is now known as zhiyan_ | 18:58 | |
| *** thedodd has joined #openstack-keystone | 18:59 | |
| morganfainberg | jamielennox, the hope is you don't call subprocess | 19:00 |
| dstanek | morganfainberg: i'm pretty sure pycrypto is dead | 19:00 |
| jamielennox | right - i dislike that to | 19:00 |
| morganfainberg | dstanek, ok sure other crypto lib | 19:01 |
| jamielennox | what do we back to - openssl still? | 19:01 |
| morganfainberg | jamielennox, calling subprocess is well and fine until it isn't | 19:01 |
| jamielennox | right but it depends how long we have to wait for other people to support the CMS | 19:01 |
| morganfainberg | jamielennox, probably. but it means we can't use pypy. | 19:01 |
| dstanek | how often does it get called in a real deployment? it seems like you would peg your CPU pretty quickly | 19:01 |
| jamielennox | morganfainberg: cFFI gets around pypy | 19:02 |
| morganfainberg | jamielennox, ah true | 19:02 |
| morganfainberg | dstanek, hm.. | 19:03 |
| *** zhiyan_ is now known as zhiyan | 19:03 | |
| dolphm | morganfainberg: what's the issue with pypy? | 19:03 |
| jamielennox | morganfainberg: if we go down the cffi route can we keep that within keysotne? | 19:03 |
| morganfainberg | dolphm, C vs native python stuffs. | 19:03 |
| jamielennox | dolphm: cpython bindings don't work in pypy | 19:03 |
| morganfainberg | jamielennox, perhaps. | 19:03 |
| morganfainberg | afaik at least one OpenStack project (non-client) is pypy friendly | 19:04 |
| morganfainberg | i don't remember where i saw it | 19:04 |
| morganfainberg | but i saw it | 19:04 |
| dstanek | this seems like something that should be in pyopenssl anyway | 19:04 |
| morganfainberg | dstanek, probably | 19:04 |
| dstanek | morganfainberg: i know alex gaynor want to make everything pypy friendly | 19:04 |
| jamielennox | pyopenssl now depends upon the cryptography library - so i don't think that they will be wanting to take new things there | 19:05 |
| morganfainberg | dstanek, yeah there is a long way to go to get there | 19:05 |
| dstanek | since we are calling out to the openssl library for the functionality i assume they have C APIs for it too | 19:05 |
| morganfainberg | dstanek, i think this is a case where we can implement a lib (more quickly) to do s-mime and then work on finding the real home for it | 19:05 |
| morganfainberg | dstanek, wherever that is. | 19:06 |
| jamielennox | let's just keep it keystone for now - but how do you communicate that keystone has a dependency on the openssl c lib via ffi in requirements? | 19:06 |
| morganfainberg | dstanek, but since there isn't a good home atm (or unclear) if no place is willing tot ake it now, we should get a python-smime lib written up | 19:06 |
| morganfainberg | jamielennox, no not internal to keystone please. | 19:07 |
| morganfainberg | jamielennox, i don't want keystone to have C in it, this should be separate to begin with | 19:07 |
| jamielennox | morganfainberg: ok - i was thinking about doing this for the cryptography library anyway so i'm interested in that | 19:08 |
| dstanek | morganfainberg: i agree with that; may be worth reachin out to pyopenssl to see if they are interested - they seem very active https://github.com/pyca/pyopenssl/commits/master | 19:08 |
| morganfainberg | the right answer is chat w/ the best places crypto lib? then if not there do our own and continue to work with them | 19:08 |
| morganfainberg | dstanek, ++ yeah lets reach out first, if not there to begin with we can make this happen on stackforge. | 19:08 |
| morganfainberg | dstanek, but if they want it and are willing, even better, they are already established | 19:09 |
| dstanek | did i read that right in the meeting? openstack may be getting rid of py26 support? | 19:17 |
| morganfainberg | dstanek, eventually. | 19:17 |
| morganfainberg | dstanek, we support it because RHEL6 doesn't do software collections iirc | 19:17 |
| dstanek | morganfainberg: i know that :-), but how soon? | 19:17 |
| morganfainberg | dstanek, once that ship has sailed, py26 can die. | 19:17 |
| morganfainberg | dstanek, my guess... k? | 19:18 |
| *** openstackgerrit has quit IRC | 19:18 | |
| *** openstackgerrit has joined #openstack-keystone | 19:18 | |
| morganfainberg | dstanek, that is a guess pulled out of thin air | 19:18 |
| morganfainberg | dstanek, so... dumb question. | 19:18 |
| morganfainberg | dstanek, maybe i;'m just not seeing it | 19:18 |
| morganfainberg | dstanek, in the RESTFul test cases, how does the default domain get populated? | 19:19 |
| dolphm | morganfainberg: populated in the db? | 19:20 |
| morganfainberg | dolphm, yes | 19:20 |
| dolphm | morganfainberg: there's a data migration | 19:20 |
| morganfainberg | dolphm, ok so we have pristine.db | 19:21 |
| dstanek | morganfainberg: no idea | 19:21 |
| dolphm | morganfainberg: 008 | 19:21 |
| dolphm | keystone/common/sql/migrate_repo/versions/008_create_default_domain.py | 19:21 |
| morganfainberg | oh gah. | 19:21 |
| morganfainberg | dolphm, *grumbles* | 19:21 |
| morganfainberg | ok thanks | 19:21 |
| morganfainberg | dolphm, that was what i was missing | 19:22 |
| dolphm | morganfainberg: git blame keystone/common/sql/migrate_repo/versions/008_create_default_domain.py | 19:22 |
| dstanek | dolphm: wow, i would have never looked there | 19:22 |
| morganfainberg | dolphm, I BLAME YOU! | 19:22 |
| morganfainberg | dstanek, ++ exactly | 19:22 |
| morganfainberg | dolphm, :) thanks | 19:22 |
| dolphm | morganfainberg: $ git config --global alias.shame blame | 19:22 |
| morganfainberg | dolphm, I've been fighting tring to find that for an hour or so. | 19:22 |
| dolphm | morganfainberg: $ git shame keystone/common/sql/migrate_repo/versions/008_create_default_domain.py | 19:22 |
| dolphm | the new word of the day is "side-effectly" | 19:31 |
| dstanek | morganfainberg: why are you worried about deployments if we make a change to not install eventlet on py3? | 19:34 |
| *** zhiyan is now known as zhiyan_ | 19:36 | |
| *** vhoward has joined #openstack-keystone | 19:37 | |
| dolphm | dstanek: what would you risk breaking? | 19:38 |
| morganfainberg | dstanek, if you remove eventlet from the requirements, it may not be installed in py2X | 19:39 |
| morganfainberg | dstanek, was the point | 19:39 |
| dstanek | dolphm: nothing; you can't use keystone on py3 - i'm only making changes for py3 | 19:39 |
| dstanek | morganfainberg: i'm not changing anything about the way we do py2 | 19:39 |
| morganfainberg | dstanek, so if it's in requirements.txt it gets built? | 19:40 |
| morganfainberg | dstanek, or are you talking about mucking with how we setup? | 19:40 |
| dstanek | morganfainberg, dolphm: yesterday bknudson found this http://git.openstack.org/cgit/openstack/oslo-incubator/tree/tox.ini#n58 | 19:40 |
| morganfainberg | dstanek, because if it's built, used or not - it would break | 19:40 |
| dolphm | dstanek: oh interesting | 19:40 |
| morganfainberg | dstanek, not a fan | 19:40 |
| dstanek | i've been working on a patch in between reviews to get as much stuff working in py3 as possible | 19:40 |
| morganfainberg | dstanek, does jenkins task understand that? | 19:41 |
| morganfainberg | dstanek, and jenkins checks. | 19:41 |
| dolphm | dstanek: is it intended to totally replace [test-]requirements.txt | 19:41 |
| dolphm | dstanek: or supplement, somehow | 19:41 |
| dstanek | morganfainberg: i don't see an alternative other than waiting a few months (or years) for projects to implement py3 support | 19:41 |
| dstanek | morganfainberg: yes, i believe they are using tox in the jenkins tests | 19:42 |
| morganfainberg | dstanek, no i mean the global requirements tasks | 19:42 |
| dstanek | dolphm: they are replacement files | 19:42 |
| morganfainberg | dstanek, and requirements checks | 19:42 |
| morganfainberg | dstanek, because that would be the #1 reason i am not a fan. i don't want to maintain a separate requirements file. | 19:42 |
| morganfainberg | if that makes sense | 19:42 |
| dstanek | morganfainberg: there isn't really another way right now | 19:42 |
| morganfainberg | the old style by hand was horrible | 19:43 |
| dstanek | i'll see what oslo has rigged up, but all-in-all this is better than waiting | 19:43 |
| dstanek | i had to take our a bunch of deps to get py3 to work; much more than just eventlet | 19:44 |
| dstanek | s/our/out/ | 19:44 |
| morganfainberg | dstanek, can we possibly work with infra to get a py3 deps thing in place? | 19:45 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Add a method for changing a user's password in v3 https://review.openstack.org/82870 | 19:45 |
| morganfainberg | dstanek, i really am concerned about manually maintaining a requirements file. | 19:45 |
| morganfainberg | it's super sucky :P | 19:45 |
| morganfainberg | but if it's the only way............... | 19:46 |
| dstanek | i'll see what oslo is doing - their change is from quite a while ago | 19:46 |
| morganfainberg | k | 19:46 |
| jamielennox | this is a fairly easy client review for anyone in the mood: https://review.openstack.org/#/c/72878/ | 19:48 |
| jamielennox | i'll post a few more as well | 19:48 |
| morganfainberg | dolphm, about to post patch to move to SQLIte in-memory | 19:51 |
| morganfainberg | dolphm, for default testing. | 19:51 |
| dolphm | morganfainberg: woot! | 19:51 |
| morganfainberg | dolphm, this wont cover the SQL migrate tests yet. | 19:52 |
| dolphm | morganfainberg: damn :P | 19:52 |
| morganfainberg | dolphm, 2 patches :P | 19:52 |
| morganfainberg | trying to keep this easy to review. | 19:52 |
| *** shakayumi has joined #openstack-keystone | 19:54 | |
| morganfainberg | dolphm, so if you want to use a disk-based sqlite for tests (why? no really why?) should i provide a {workdir} substitution that can occur? | 19:55 |
| *** shakamunyi has joined #openstack-keystone | 19:56 | |
| dolphm | morganfainberg: any value in poking into a db that failed? | 19:56 |
| morganfainberg | dolphm, or just "sorry we don't support multi-worker-testr with a sqlite db on disk for tests" | 19:56 |
| dolphm | i've never, ever done it... but that's all i can think of | 19:56 |
| morganfainberg | dolphm, i've never ever ever done it | 19:56 |
| morganfainberg | dolphm, and we explicitly delete files on disk on atexit | 19:57 |
| morganfainberg | dolphm, so you'd need to change code anyway | 19:57 |
| dolphm | morganfainberg: i wouldn't bother providing a workaround | 19:57 |
| *** shakayumi has quit IRC | 19:58 | |
| *** leseb has joined #openstack-keystone | 19:58 | |
| *** dstanek is now known as dstanekafk | 19:58 | |
| morganfainberg | dolphm, ok | 19:59 |
| *** leseb has quit IRC | 20:03 | |
| *** shakamunyi has quit IRC | 20:03 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Handle URLs via the session and auth_plugins https://review.openstack.org/60752 | 20:03 |
| dolphm | anymore love for either https://review.openstack.org/#/c/82527/ or https://review.openstack.org/#/c/82886/ before i cut 0.7.0 without them? | 20:05 |
| * lbragstad is reviewing https://review.openstack.org/#/c/82527/ but dolphm can cut | 20:06 | |
| *** shakamunyi has joined #openstack-keystone | 20:06 | |
| jamielennox | cool, i've got both of those done - neither are really 'required' but they are simple | 20:07 |
| jamielennox | another easy client review (not for 0.7) https://review.openstack.org/#/c/74955/ | 20:09 |
| bknudson | https://review.openstack.org/#/c/82527/ or https://review.openstack.org/#/c/82886/ look good to me. | 20:10 |
| *** esmute has joined #openstack-keystone | 20:11 | |
| dolphm | lbragstad: bknudson: thanks! | 20:13 |
| dolphm | jamielennox: you too! | 20:13 |
| lbragstad | np, thanks for checking | 20:14 |
| *** dstanekafk is now known as dstanek | 20:17 | |
| openstackgerrit | Pablo Fernando Cargnelutti proposed a change to openstack/keystone: Moving delete_user and delete_group calls to IdentityManager https://review.openstack.org/80368 | 20:17 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert auth_token to use session https://review.openstack.org/74908 | 20:19 |
| jamielennox | dstanek, gyee: are you happy to remove the -1 on https://review.openstack.org/#/c/77748/ based on the meeting? | 20:20 |
| jamielennox | or do you still want a request_uri property? | 20:21 |
| dstanek | jamielennox: just switched to a +2 | 20:24 |
| jamielennox | dstanek: thanks - there is still the underlying patch to get through but i'm just cleaning up my list when i'm in vaguely the same hours as most people | 20:25 |
| jamielennox | also before the mad rush when juno opens | 20:26 |
| *** esmute has left #openstack-keystone | 20:27 | |
| *** lbragstad has quit IRC | 20:34 | |
| morganfainberg | dolphm, just running one last pass on tests for the test_sql_upgrade and test_sql_migrate_extensions and i'll have these reviews posted (in-mem sqlite ftw!) | 20:35 |
| morganfainberg | dolphm, much much faster. | 20:35 |
| morganfainberg | and no more need to specify the TMP dir to get reasonable performance | 20:36 |
| gyee | jamielennox, I am not happy, but I don't have a strong reason to block it | 20:37 |
| jamielennox | gyee: oh? | 20:38 |
| jamielennox | gyee: just because of the api compat difference | 20:38 |
| gyee | jamielennox, I'll have to make a small change at my local repo | 20:38 |
| gyee | but that's fine, a small change anyway | 20:38 |
| gyee | just a name change | 20:39 |
| *** vhoward has left #openstack-keystone | 20:39 | |
| jamielennox | gyee: do you need it RO or RW? | 20:40 |
| jamielennox | also dont subclass auth token | 20:40 |
| gyee | jamielennox, I don't really want to if I don't have to | 20:41 |
| gyee | in a perfect world, I would love to not having to maintain any local code | 20:41 |
| jamielennox | do you have that subclass somewhere public? | 20:41 |
| gyee | jamielennox, no, in my local internal repo | 20:42 |
| gyee | I basically override the get admin token part | 20:42 |
| jamielennox | is it something i can see (even email me it) i just want to see what it doesn't support and how | 20:42 |
| jamielennox | gyee: also ge_admin toen is going away: https://review.openstack.org/#/c/74908/ | 20:44 |
| jamielennox | that was approved but failed on rebase | 20:44 |
| gyee | jamielennox, sweet! | 20:45 |
| gyee | I didn't know that one | 20:45 |
| jamielennox | gyee: didnt you approve it? | 20:45 |
| jamielennox | no but you +2ed | 20:45 |
| gyee | wtf? | 20:46 |
| gyee | hangon | 20:46 |
| gyee | jamielennox, not really, that patch still not solving my problem | 20:50 |
| gyee | it still require either a token or admin user/password/tenant_name | 20:50 |
| gyee | jamielennox, https://review.openstack.org/#/c/74908/6/keystoneclient/middleware/auth_token.py | 20:50 |
| gyee | line 437-444 | 20:51 |
| jamielennox | gyee: yea, i'm aware | 20:51 |
| gyee | that patch get us a step closer, but no cigar yet | 20:51 |
| jamielennox | when the from_conf stuff comes in i can convert from that to from_conf | 20:51 |
| gyee | right, when we truly utilizing the auth plugins | 20:52 |
| jamielennox | then you can use whatever plugin you like | 20:52 |
| gyee | then we're in business | 20:52 |
| gyee | jamielennox, once all your patches landed, I'll buy you a beer next time I see you | 20:52 |
| gyee | at least :-) | 20:52 |
| gyee | that's for sure | 20:52 |
| jamielennox | deal | 20:52 |
| jamielennox | the one thing i know we're missing is having auth plugins set connection params | 20:53 |
| jamielennox | so SSL client certs for authentication and kerberos needs the ability to set requests params from the plugin which is not currently doable | 20:53 |
| gyee | jamielennox, but that's more of a document thing than code thing right? | 20:54 |
| jamielennox | gyee: no - but it just needs a new hook for the plugin | 20:54 |
| jamielennox | i know it's missing and it can be added later | 20:55 |
| gyee | but SSL client certs is itself a auth plugin | 20:55 |
| gyee | maybe a no-op in terms of headers and request because we are using the underlaying connection mechanism for auth | 20:56 |
| jamielennox | gyee: well SSL is funny | 20:56 |
| gyee | right, a special case | 20:56 |
| jamielennox | because it can be a session parameter or it can be an auth parameter | 20:56 |
| jamielennox | jose's kerberos patch is my main target because that's just auth | 20:57 |
| *** lbragstad has joined #openstack-keystone | 21:00 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Use in-memory SQLite for testing https://review.openstack.org/82917 | 21:01 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Use in-memory SQLite for sql migration tests https://review.openstack.org/82918 | 21:01 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove extraenous instantiations of managers https://review.openstack.org/81720 | 21:01 |
| jamielennox | gyee or ayoung: if you have a minute can you look at and possibly +A https://review.openstack.org/#/c/72878 | 21:02 |
| ayoung | jamielennox, looking | 21:02 |
| dstanek | jamielennox: do you have any more client stuff that you'd like me to take a look at? i have a little free time before i have to do kid stuff | 21:03 |
| morganfainberg | dstanek, dolphm, ^ in-mem sqlite | 21:03 |
| ayoung | jamielennox, +A | 21:03 |
| morganfainberg | dstanek, it can wait until post RC though. | 21:03 |
| *** topol has quit IRC | 21:04 | |
| jamielennox | ayoung: thanks | 21:04 |
| dstanek | morganfainberg: cool, i'll go through all three | 21:05 |
| morganfainberg | dstanek, the first one is the same manager one from before, just no more instantiation of credential_api in test_sql_upgrade | 21:05 |
| *** leseb has joined #openstack-keystone | 21:08 | |
| *** shakayumi has joined #openstack-keystone | 21:08 | |
| *** shakayumi has quit IRC | 21:09 | |
| *** shakamunyi has quit IRC | 21:11 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add example script for oauth1 functions https://review.openstack.org/80193 | 21:20 |
| *** gokrokve has quit IRC | 21:32 | |
| *** jsavak has quit IRC | 21:32 | |
| openstackgerrit | Pablo Fernando Cargnelutti proposed a change to openstack/keystone: Moving delete_user and delete_group calls to IdentityManager https://review.openstack.org/80368 | 21:42 |
| *** marcoemorais1 has joined #openstack-keystone | 21:45 | |
| *** zigo has quit IRC | 21:47 | |
| *** mfisch has quit IRC | 21:47 | |
| *** marcoemorais has quit IRC | 21:47 | |
| *** dolphm has quit IRC | 21:47 | |
| *** mfisch has joined #openstack-keystone | 21:48 | |
| *** mfisch has joined #openstack-keystone | 21:48 | |
| *** zigo has joined #openstack-keystone | 21:49 | |
| *** dolphm has joined #openstack-keystone | 21:50 | |
| *** ChanServ sets mode: +o dolphm | 21:50 | |
| ayoung | https://pypi.python.org/pypi/pysmime | 21:56 |
| *** topol has joined #openstack-keystone | 21:58 | |
| morganfainberg | ayoung, m2crypto ick | 21:59 |
| *** stevemar has quit IRC | 22:00 | |
| ayoung | morganfainberg, doesnt have to stay that way | 22:00 |
| morganfainberg | ayoung, i would hope it doesn't stay that way :) | 22:01 |
| ayoung | morganfainberg, gyee what is the future of crypto in python? | 22:01 |
| ayoung | which library should we target? | 22:01 |
| morganfainberg | ayoung, pyopenssl? i think that is the one dstanek identified | 22:01 |
| morganfainberg | ayoung, but tbh, i don't know. it seems like we go through crypto libraries fast in the python world (since m2crypto died) | 22:02 |
| *** leseb has quit IRC | 22:02 | |
| ayoung | morganfainberg, cuz even with the popen approach we could, in theory use the same library | 22:02 |
| dstanek | pyopenssl, i believe, is a wrapper around the openssl C APIs | 22:02 |
| dstanek | other crypto libs like m2crypto actually implement their own crypto in many cases | 22:03 |
| *** bknudson has quit IRC | 22:03 | |
| ayoung | https://pythonhosted.org/pyOpenSSL/ | 22:03 |
| dstanek | i though pyopenssl because i think we can just get a small wrapper around the CMS API calls if they exist | 22:03 |
| ayoung | needs proper pkcs7 support | 22:03 |
| ayoung | I'm ok with contributing to an upstream project for crypto, just so as I know which one | 22:04 |
| morganfainberg | ayoung, https://pythonhosted.org/pyOpenSSL/api/crypto.html#pkcs7-objects FIXME | 22:04 |
| morganfainberg | ayoung, yeah =/ | 22:04 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: sanity check memcached availability before running tests against it https://review.openstack.org/82527 | 22:04 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Improve language in update_password() validation error https://review.openstack.org/82886 | 22:04 |
| morganfainberg | ayoung, i think pyopenssl looks like the best bet since it's doing what we all kindof assume, call openssl c objects | 22:04 |
| morganfainberg | ayoung, and that can be used by something a bit more specific (e.g. layering in anything else needed) | 22:05 |
| morganfainberg | and i like that it's not trying to be too clever. | 22:05 |
| *** stevemar has joined #openstack-keystone | 22:06 | |
| jamielennox | ayoung: the cryptography library which isrelated to barbican is the new one | 22:11 |
| jamielennox | it has the advantage of having some of the pyopenssl guys working on it | 22:12 |
| jamielennox | also pyopenssl now depends on it | 22:12 |
| *** derek_c has joined #openstack-keystone | 22:12 | |
| jamielennox | though it will be a while as they dont have certs eve yet | 22:13 |
| *** devlaps1 has quit IRC | 22:17 | |
| *** devlaps has joined #openstack-keystone | 22:17 | |
| *** dims_ has quit IRC | 22:18 | |
| *** dstanek has quit IRC | 22:22 | |
| *** dims_ has joined #openstack-keystone | 22:34 | |
| *** dstanek has joined #openstack-keystone | 22:37 | |
| *** nkinder has quit IRC | 22:43 | |
| gyee | ayoung, pycrypto is stable, m2crypto not sure | 22:50 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone: Remove unnecessary test setUps https://review.openstack.org/82938 | 22:51 |
| gyee | stable support I mean | 22:51 |
| morganfainberg | jamielennox, yay! remove useless use of setUp! | 22:53 |
| morganfainberg | jamielennox, i think there are more of those around tbh | 22:53 |
| jamielennox | morganfainberg: i'm sure there are heaps | 22:53 |
| jamielennox | but that was the file i was looking at | 22:53 |
| *** henrynash has quit IRC | 22:53 | |
| morganfainberg | jamielennox, lol | 22:53 |
| jamielennox | what is the policy on our testing controllers directly? | 22:54 |
| jamielennox | i mean i know the policy should be: don't do it | 22:54 |
| jamielennox | but are there situations where it makes sense to test the driver? | 22:55 |
| *** nkinder has joined #openstack-keystone | 22:55 | |
| jamielennox | i guess it doesn't matter - if you're testing the driver that's different | 22:56 |
| morganfainberg | jamielennox, eh, i mean there is a time and place to test the controller, that seems like the whole point of the restful tests | 22:58 |
| jamielennox | morganfainberg: no - if you want to test the controller you should be calling app.get() etc | 22:59 |
| jamielennox | you should never test token.controllers.Auth | 22:59 |
| *** zoresvit has quit IRC | 23:00 | |
| morganfainberg | uh. | 23:00 |
| morganfainberg | *shrug* | 23:00 |
| morganfainberg | i mean, the restful test cases seem to do that kind of stuff. | 23:00 |
| jamielennox | morganfainberg: yes but it means that you hand create the context object | 23:01 |
| jamielennox | morganfainberg: they do - it's a real pain | 23:01 |
| jamielennox | crap, there's no way i can fix all those places | 23:04 |
| *** david-lyle has quit IRC | 23:08 | |
| openstackgerrit | John Dennis proposed a change to openstack/keystone: Expand the use of non-ascii values in ldap test https://review.openstack.org/82399 | 23:12 |
| openstackgerrit | John Dennis proposed a change to openstack/keystone: Properly handle unicode & utf-8 in LDAP https://review.openstack.org/82398 | 23:12 |
| openstackgerrit | John Dennis proposed a change to openstack/keystone: Refactor LDAP API https://review.openstack.org/82397 | 23:12 |
| openstackgerrit | John Dennis proposed a change to openstack/keystone: code hygiene; use six.text_type, escape regexp's, use key function https://review.openstack.org/82396 | 23:12 |
| *** thedodd has quit IRC | 23:17 | |
| *** dstanek has quit IRC | 23:21 | |
| *** andreaf has quit IRC | 23:22 | |
| *** henrynash has joined #openstack-keystone | 23:24 | |
| *** jaosorior has quit IRC | 23:30 | |
| openstackgerrit | guang-yee proposed a change to openstack/python-keystoneclient: Implement endpoint filtering functionality on the client side. https://review.openstack.org/82713 | 23:38 |
| *** dstanek has joined #openstack-keystone | 23:38 | |
| derek_c | how do you customize the keystone.conf that gets installed? | 23:39 |
| derek_c | I mean, is there some code in keystone that's responsible for generating the default conf? | 23:39 |
| morganfainberg | derek_c, the sample config? or you mean like when you install a package in ubuntu? | 23:40 |
| derek_c | morganfainberg: yeah, like when you install a package | 23:40 |
| morganfainberg | that is often controlled by the packager | 23:41 |
| derek_c | I see. so keystone doesn't have a "default config"? | 23:41 |
| morganfainberg | derek_c, we have a default configuration in our repo that shows all of the default config options. But it doesn't change any values | 23:42 |
| derek_c | morganfainberg: I see. is it keystone/common/config.py? | 23:43 |
| derek_c | I think it is. thanks! | 23:45 |
| dstanek | dolphm: so we have to un-deprecate v2? | 23:46 |
| morganfainberg | derek_c, that is the place options are registered | 23:49 |
| morganfainberg | dstanek, that is the general sentiment of the conversation. | 23:50 |
| *** devlaps1 has joined #openstack-keystone | 23:50 | |
| dstanek | morganfainberg: that's unfortunate | 23:50 |
| morganfainberg | dstanek, well the point is don't notify the deployers/operators there is something to do if OpenStack doesn't fully support it. but, eh | 23:51 |
| morganfainberg | dstanek, differing opinions | 23:51 |
| morganfainberg | dstanek, i don't want to undeprecate it personally, but i understand the argument | 23:51 |
| *** devlaps has quit IRC | 23:53 | |
| dstanek | morganfainberg: maybe we should just make it log in debug mode so deployers don't see it :-) | 23:56 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!