| *** richm has joined #openstack-keystone | 00:00 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Move unit tests from test_backend_ldap https://review.openstack.org/119928 | 00:14 |
|---|---|---|
| *** bknudson has joined #openstack-keystone | 00:16 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Tests raise exception if logging problem https://review.openstack.org/119946 | 00:19 |
| *** alex_xu has joined #openstack-keystone | 00:22 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 00:23 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow retrying some failed requests https://review.openstack.org/118004 | 00:23 |
| jamielennox | bknudson: can you have a look at ^ so we can push it through before release | 00:25 |
| bknudson | jamielennox: ok | 00:25 |
| *** ncoghlan has joined #openstack-keystone | 00:29 | |
| *** rodrigods_ has joined #openstack-keystone | 00:33 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Versioned Endpoint hack for Sessions https://review.openstack.org/90632 | 00:42 |
| stevemar | bknudson, are you cool with "find . -name '*.pyc' -exec rm -f \{} +" to remove pyc files? | 00:42 |
| bknudson | stevemar: I don't understand why we're removing pyc files. | 00:43 |
| bknudson | The command is find and I run it all the time already. | 00:43 |
| stevemar | bknudson, i think I ran into issues once or twice | 00:43 |
| *** mitz_ has joined #openstack-keystone | 00:46 | |
| jamielennox | bknudson: any particular reason for mock.patch.object over mock.patch? | 00:52 |
| stevemar | jamielennox, for AccessInfoV2, we should make the is_federated property return None right? | 00:53 |
| stevemar | not NotImplemented | 00:53 |
| jamielennox | stevemar: for v2 return False, for base return NotImplemented | 00:53 |
| stevemar | oops, right false | 00:53 |
| jamielennox | or raise NotImplemented | 00:53 |
| jamielennox | stevemar: not a great fan of if is_federated: return None, can you catch the KeyError and then reraise if not federated? | 00:55 |
| stevemar | jamielennox, i can return true/false | 00:56 |
| jamielennox | stevemar: i mean for user_domain_name property | 00:56 |
| jamielennox | try: | 00:56 |
| jamielennox | return xxxxxxxx | 00:56 |
| jamielennox | except KeyError: | 00:56 |
| jamielennox | if federated: | 00:56 |
| jamielennox | return None | 00:56 |
| jamielennox | raise | 00:56 |
| jamielennox | doesn't exclude the case where we might put something in there later, but catches it otherwise | 00:57 |
| bknudson | jamielennox: object references work better than strings with the editor I use. I can click on it to go to the code, and if the import changes it'll show a problem. | 00:57 |
| stevemar | jamielennox, yeah, we could do that | 00:57 |
| *** cjellick has quit IRC | 00:58 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow retrying some failed requests https://review.openstack.org/118004 | 00:59 |
| jamielennox | bknudson: also i completely agree this is horrible, but it's used in a few places so better to just have it here | 01:00 |
| *** zzzeek has joined #openstack-keystone | 01:01 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 01:02 | |
| *** ncoghlan is now known as ncoghlan_afk | 01:05 | |
| *** zzzeek has quit IRC | 01:10 | |
| *** jasonsb has quit IRC | 01:11 | |
| *** amcrn has quit IRC | 01:16 | |
| stevemar | jamielennox, if we use fixtures for keystoneclient for federation tokens, i'm going to have to add quite a few new args to Token's constructor | 01:16 |
| stevemar | you okay with that? or just want to leave it as a token dump? | 01:16 |
| stevemar | alternatively i could get a regular token and fudge around with it a bit... | 01:17 |
| *** marcoemorais has quit IRC | 01:26 | |
| *** russo3999 has joined #openstack-keystone | 01:26 | |
| *** gyee has quit IRC | 01:27 | |
| *** miqui has quit IRC | 01:29 | |
| jamielennox | stevemar: the tokens that are created are just a dict | 01:32 |
| jamielennox | or an object that inherits from dict, create the basics with the fixture and then just add what else you need | 01:33 |
| jamielennox | also what else is required? | 01:33 |
| *** achampio1 has joined #openstack-keystone | 01:39 | |
| *** achampion has quit IRC | 01:42 | |
| jamielennox | bknudson: alright, a new: https://review.openstack.org/#/c/118004 i think if i get a +2 there i can leave the rest | 01:50 |
| jamielennox | oh and this horrible one: https://review.openstack.org/#/c/90632/ | 01:51 |
| *** rodrigods_ has quit IRC | 01:56 | |
| stevemar | jamielennox, alright, i thought you might have wanted helper methods like set_federation() stuff | 02:01 |
| stevemar | but yeah, I can just get a 'basic' token, and modify it | 02:01 |
| *** achampion has joined #openstack-keystone | 02:12 | |
| *** achampio1 has quit IRC | 02:14 | |
| *** dims has quit IRC | 02:29 | |
| *** ncoghlan_afk is now known as ncoghlan | 02:29 | |
| *** dims has joined #openstack-keystone | 02:29 | |
| *** dims has quit IRC | 02:30 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Handle federated tokens. https://review.openstack.org/121146 | 02:30 |
| *** dims has joined #openstack-keystone | 02:30 | |
| *** dims has quit IRC | 02:30 | |
| stevemar | jamielennox, ^ | 02:30 |
| morganfainberg | bknudson, i'm not sure how to test the cache poool | 02:31 |
| *** dims has joined #openstack-keystone | 02:31 | |
| morganfainberg | bknudson, been trying to figure out how to do it in a sane way considering it requires eventlet and multiple threads. | 02:31 |
| morganfainberg | bknudson, not something our test suite is particularly good at | 02:31 |
| *** diegows has quit IRC | 02:32 | |
| jamielennox | stevemar: replied - otherwise i'm good | 02:35 |
| *** dims has quit IRC | 02:35 | |
| stevemar | jamielennox, d'oh! | 02:36 |
| stevemar | good eye | 02:36 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 02:37 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Handle federated tokens. https://review.openstack.org/121146 | 02:37 |
| morganfainberg | bknudson, ^ this covers your comments but does not cover testing. | 02:37 |
| stevemar | thanks jamie | 02:38 |
| stevemar | morganfainberg, bknudson ^ if you care to review | 02:38 |
| *** alex_xu has quit IRC | 02:40 | |
| morganfainberg | hm | 02:41 |
| morganfainberg | ok fun | 02:41 |
| morganfainberg | that doesn't work... | 02:41 |
| stevemar | morganfainberg, who ya talkin to? | 02:42 |
| morganfainberg | myself. | 02:42 |
| jamielennox | thanks all! see you in a few weeks | 02:44 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 02:46 |
| morganfainberg | hmm. | 02:46 |
| morganfainberg | stevemar, ok so... suggestions | 02:46 |
| morganfainberg | stevemar, i need to figure out how to test that ^ | 02:46 |
| morganfainberg | maybe i can *shudder* spin up a threading.thread in a test case | 02:47 |
| morganfainberg | oh god i feel dirty just considering that | 02:47 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 02:48 |
| *** junhongl has quit IRC | 02:49 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 02:51 |
| morganfainberg | now with updated sample config... | 02:51 |
| morganfainberg | i swear i'll get this right one of these times. | 02:51 |
| *** jamielennox is now known as jamielennox|away | 02:52 | |
| *** ayoung has quit IRC | 02:53 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 03:00 |
| *** richm has quit IRC | 03:00 | |
| *** jasonsb has joined #openstack-keystone | 03:00 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 03:22 | |
| *** saipandi has quit IRC | 03:47 | |
| *** rushiagr_away is now known as rushiagr | 03:56 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:00 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:00 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:01 | |
| *** oomichi has joined #openstack-keystone | 04:16 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:25 | |
| *** Sanchit has joined #openstack-keystone | 04:34 | |
| *** Sanchit has quit IRC | 04:37 | |
| *** rushiagr is now known as rushiagr_away | 04:43 | |
| openstackgerrit | Peter Razumovsky proposed a change to openstack/keystone: Add a simple module to work with filters and DNs to LDAP backend https://review.openstack.org/117484 | 04:48 |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Set LDAP certificate trust options for LDAPS and TLS https://review.openstack.org/120954 | 04:54 |
| *** harlowja_ is now known as harlowja_away | 04:59 | |
| *** stevemar has quit IRC | 05:03 | |
| *** zhiyan_ is now known as zhiyan | 05:10 | |
| *** rushiagr_away is now known as rushiagr | 05:16 | |
| *** RockKuo_Office has joined #openstack-keystone | 05:46 | |
| *** ajayaa has joined #openstack-keystone | 05:47 | |
| *** achampion has quit IRC | 05:52 | |
| *** achampion has joined #openstack-keystone | 05:55 | |
| *** alex_xu has joined #openstack-keystone | 05:56 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/120695 | 06:04 |
| *** renlt has joined #openstack-keystone | 06:07 | |
| *** ncoghlan is now known as ncoghlan_afk | 06:10 | |
| *** renlt has quit IRC | 06:10 | |
| *** renlt has joined #openstack-keystone | 06:11 | |
| *** renlt has quit IRC | 06:12 | |
| *** gpanda has joined #openstack-keystone | 06:12 | |
| *** ukalifon1 has joined #openstack-keystone | 06:14 | |
| *** ncoghlan_afk is now known as ncoghlan | 06:18 | |
| *** lufix has joined #openstack-keystone | 06:37 | |
| *** KanagarajM has joined #openstack-keystone | 06:39 | |
| *** henrynash has joined #openstack-keystone | 06:44 | |
| *** henrynash has quit IRC | 06:45 | |
| *** Clabbe has joined #openstack-keystone | 06:48 | |
| Clabbe | Anyone know of any issues related to the token handling ? the keystone-manage token_flush have been working for 1.5 days now | 06:48 |
| Clabbe | :| | 06:48 |
| Clabbe | Is it possible to drop the table ? | 06:53 |
| *** KanagarajM2 has joined #openstack-keystone | 07:06 | |
| *** KanagarajM has quit IRC | 07:07 | |
| *** BAKfr has joined #openstack-keystone | 07:16 | |
| *** garnav has joined #openstack-keystone | 07:36 | |
| *** wanghong has quit IRC | 08:04 | |
| *** aix has joined #openstack-keystone | 08:19 | |
| *** wanghong has joined #openstack-keystone | 08:21 | |
| *** ncoghlan has quit IRC | 08:26 | |
| *** henrynash has joined #openstack-keystone | 08:27 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Ensure identity sql driver supports domain-specific configuration. https://review.openstack.org/121246 | 08:30 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Document Keystone2Keystone federation https://review.openstack.org/120584 | 08:51 |
| BAKfr | hi guys | 09:03 |
| BAKfr | I want to add a test in test_v3_identity | 09:03 |
| BAKfr | In my test method, I should use "self.user" and "self.project" in the IdentityTestCase class, or create new user and project ? | 09:05 |
| marekd | BAKfr: where this self.user comes from? Mind that setUp() is recreated prior to every test. | 09:06 |
| *** Gippa has joined #openstack-keystone | 09:11 | |
| *** f13o has quit IRC | 09:12 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Handle federated tokens. https://review.openstack.org/121146 | 09:13 |
| BAKfr | marekd, it is defined in load_fixtures, and which is called in setUp(). Thanks :) | 09:14 |
| marekd | BAKfr: so if you inherit from that class I think it's even advised to reuse such attributes :-) | 09:14 |
| *** KanagarajM2 has quit IRC | 09:23 | |
| *** RockKuo_Office has quit IRC | 09:27 | |
| *** Gippa has quit IRC | 09:32 | |
| *** KanagarajM has joined #openstack-keystone | 09:34 | |
| *** lufix has quit IRC | 09:41 | |
| *** lufix has joined #openstack-keystone | 09:41 | |
| *** jasondotstar has quit IRC | 09:44 | |
| *** henrynash has quit IRC | 09:49 | |
| *** Gippa has joined #openstack-keystone | 09:51 | |
| *** KanagarajM2 has joined #openstack-keystone | 10:00 | |
| *** KanagarajM has quit IRC | 10:02 | |
| *** afazekas has joined #openstack-keystone | 10:03 | |
| openstackgerrit | Qin Zhao proposed a change to openstack/python-keystoneclient: Fix the condition expression for ssl_insecure https://review.openstack.org/112232 | 10:05 |
| *** KanagarajM2 has quit IRC | 10:06 | |
| *** mflobo_ has quit IRC | 10:07 | |
| *** mflobo has joined #openstack-keystone | 10:08 | |
| *** rushiagr is now known as rushiagr_away | 10:09 | |
| *** amakarov_away is now known as amakarov | 10:10 | |
| *** gpanda has quit IRC | 10:11 | |
| marekd | what is the difference between requirements.txt and text-requirements.txt files? | 10:21 |
| marekd | s/text/test/ | 10:22 |
| *** bjornar_ has joined #openstack-keystone | 10:45 | |
| *** dims has joined #openstack-keystone | 10:56 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Change pysaml2 comment in test-requrements.txt. https://review.openstack.org/121807 | 11:02 |
| marekd | lbragstad: ^^ i never can add you as a reviewer (Gerrit complains) | 11:04 |
| *** henrynash has joined #openstack-keystone | 11:06 | |
| *** ukalifon1 has quit IRC | 11:22 | |
| *** henrynash has quit IRC | 11:23 | |
| *** rushiagr_away is now known as rushiagr | 11:23 | |
| *** henrynash has joined #openstack-keystone | 11:25 | |
| *** diegows has joined #openstack-keystone | 11:29 | |
| *** bjornar_ has quit IRC | 11:42 | |
| *** ukalifon has joined #openstack-keystone | 11:42 | |
| *** henrynash has quit IRC | 11:58 | |
| *** henrynash has joined #openstack-keystone | 12:08 | |
| BAKfr | If I want to test a method without the revoke API, can I do "self.assignment_api.revoke_api = None" ? | 12:11 |
| BAKfr | It seems to work (dependencies are reset between each test), but is it a good practice ? | 12:11 |
| rodrigods | BAKfr, why would you want to do that? | 12:16 |
| BAKfr | rodrigods, I've a bug which happen only when revoke API is not enabled | 12:17 |
| *** dims has quit IRC | 12:18 | |
| *** dims has joined #openstack-keystone | 12:19 | |
| rodrigods | BAKfr, hmm that's odd... | 12:20 |
| rodrigods | BAKfr, can you describe it? | 12:20 |
| *** richm has joined #openstack-keystone | 12:21 | |
| BAKfr | rodrigods, tokens are not revoked when we delete a group role to a project | 12:22 |
| BAKfr | rodrigods, I want to add a test for https://review.openstack.org/#/c/121628/ | 12:22 |
| *** henrynash has quit IRC | 12:25 | |
| *** henrynash has joined #openstack-keystone | 12:26 | |
| rodrigods | BAKfr, the bug is caused by user_id being None, right? | 12:32 |
| BAKfr | rodrigods, the bug is that we revokes the token for user_id instead of user['id'] | 12:34 |
| rodrigods | BAKfr, the _emit is using the wrong variable, but the revoke itself is using the correct one (user['id']) | 12:36 |
| rodrigods | I thought the issue was caused by the _emit receiving user_id | 12:36 |
| BAKfr | rodrigods, Yes. when revoke_api is enabled, tokens are revoked. The bug happen when revoke_api is not set. | 12:37 |
| *** vhoward has joined #openstack-keystone | 12:37 | |
| openstackgerrit | Kévin Bernard-Allies proposed a change to openstack/keystone: Revoke the tokens of group members when a group role is revoked https://review.openstack.org/121628 | 12:41 |
| rodrigods | BAKfr, hmm now I get it... =) yeah... seems legit to disable in a such way than | 12:43 |
| BAKfr | rodrigods, test sent ^ | 12:43 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 12:44 | |
| *** KanagarajM has joined #openstack-keystone | 12:58 | |
| *** achampion has quit IRC | 13:00 | |
| *** bjornar has quit IRC | 13:10 | |
| *** topol has joined #openstack-keystone | 13:11 | |
| *** tristanC has joined #openstack-keystone | 13:12 | |
| *** radez_g0n3 is now known as radez | 13:12 | |
| *** bjornar has joined #openstack-keystone | 13:12 | |
| *** bknudson has quit IRC | 13:16 | |
| *** nkinder has quit IRC | 13:16 | |
| *** htruta has joined #openstack-keystone | 13:21 | |
| *** gordc has joined #openstack-keystone | 13:21 | |
| *** joesavak has joined #openstack-keystone | 13:23 | |
| *** henrynash has quit IRC | 13:25 | |
| *** henrynash has joined #openstack-keystone | 13:32 | |
| *** rwsu has quit IRC | 13:33 | |
| ukalifon | andreaf: your fix https://review.openstack.org/121562 still doesn't solve the issue for me. Maybe I'm doing something wrong? If I don't set "auth_version = v3" in tempest.conf - I still get "unauthorized" errors and I see calls made to v2.0/tokens instead of /v3/auth/tokens. Actually I see calls to both: | 13:35 |
| ukalifon | 2014-09-16 16:24:32,592 1626 INFO [tempest.common.rest_client] Request (TestKeystoneSanity:test_v3_identity): 201 POST http://10.35.160.15:35357/v3/auth/tokens | 13:35 |
| ukalifon | 2014-09-16 16:24:32,608 1626 INFO [tempest.common.rest_client] Request (TestKeystoneSanity:test_v3_identity): 401 POST http://10.35.160.15:35357/v2.0/tokens | 13:35 |
| *** henrynash has quit IRC | 13:36 | |
| *** ayoung has joined #openstack-keystone | 13:36 | |
| *** ayoung has quit IRC | 13:45 | |
| *** r-daneel__ has joined #openstack-keystone | 13:48 | |
| *** cyeoh has joined #openstack-keystone | 13:53 | |
| *** garnav has quit IRC | 13:54 | |
| *** jasondotstar has joined #openstack-keystone | 13:55 | |
| *** vkmc has joined #openstack-keystone | 13:55 | |
| *** achampion has joined #openstack-keystone | 13:56 | |
| vkmc | dolphm, hi there, do have a sec? | 13:57 |
| *** oomichi has quit IRC | 13:59 | |
| *** nkinder has joined #openstack-keystone | 14:01 | |
| lbragstad | marekd: around? | 14:01 |
| lbragstad | marekd: use ldbragst | 14:01 |
| *** henrynash has joined #openstack-keystone | 14:04 | |
| vkmc | ok well, I wanted to ask you all if someone is interested to mentor an OPW applicant this round https://wiki.openstack.org/wiki/OutreachProgramForWomen | 14:06 |
| vkmc | it doesn't take much time and it's a really nice experience for both mentors and mentees | 14:07 |
| vkmc | currently there is an applicant interested in Keystone | 14:07 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 14:10 | |
| vkmc | she wanted to propose a change in Keystone access control model | 14:12 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:12 | |
| morganfainberg | vkmc, dolphm is likely unavailable at the moment | 14:13 |
| morganfainberg | vkmc, a couple of us are filling in for him. | 14:13 |
| vkmc | thanks morganfainberg | 14:13 |
| marekd | lbragstad: i am here. | 14:13 |
| *** Tahmina has joined #openstack-keystone | 14:13 | |
| marekd | lbragstad: ok | 14:13 |
| Tahmina | hi | 14:13 |
| morganfainberg | vkmc, though the best bet to get possible volunteers would be to join us for the Keystone IRC meeting at put it on the agenda | 14:14 |
| lbragstad | marekd: I added myself to it, but for future reference ldbragst is my username | 14:14 |
| vkmc | morganfainberg, good idea | 14:14 |
| morganfainberg | vkmc, https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting | 14:14 |
| morganfainberg | vkmc, it is later today :) | 14:14 |
| morganfainberg | Tahmina, hello | 14:14 |
| vkmc | morganfainberg, Tahmina is the applicant I was talking talking about :) | 14:14 |
| Tahmina | hi morganfainberg | 14:14 |
| Tahmina | thanks vkmc | 14:15 |
| morganfainberg | vkmc, Tahmina, welcome I'm sure we can find someone to volunteer. | 14:15 |
| vkmc | Tahmina, would you like to join the Keystone meeting today at 18.00UTC? | 14:15 |
| marekd | lbragstad: anyway, what's the procedure for updating requirements.txt ? (see: https://bugs.launchpad.net/keystone/+bug/1369986 ) | 14:15 |
| uvirtbot | Launchpad bug 1369986 in keystone "Federaton extension fails due to missing pysaml2 library" [Undecided,New] | 14:15 |
| morganfainberg | Tahmina, and we're always happy to have contributors join us! :) | 14:16 |
| vkmc | Tahmina, you can let Keystone folks know about your proposal during the open topic and hopefully somebody would be able to mentor you :) | 14:16 |
| *** andreaf_ has joined #openstack-keystone | 14:16 | |
| *** andreaf has quit IRC | 14:16 | |
| Tahmina | oh thanks vkmc | 14:16 |
| *** andreaf_ is now known as andreaf | 14:16 | |
| Tahmina | yes I will join | 14:16 |
| lbragstad | marekd: we need to check if pysaml2 is available in global requirements | 14:17 |
| *** andreaf_ has joined #openstack-keystone | 14:17 | |
| vkmc | cool | 14:17 |
| vkmc | morganfainberg, thanks :) | 14:17 |
| morganfainberg | vkmc, sure thing. | 14:17 |
| Tahmina | but I don't know where to join | 14:17 |
| lbragstad | marekd: it looks like it is https://github.com/openstack/requirements/blob/master/global-requirements.txt#L94 | 14:17 |
| lbragstad | so we should be able to update our requirements to use it | 14:17 |
| Tahmina | thanks morganfainberg | 14:17 |
| marekd | lbragstad: on my way | 14:17 |
| vkmc | Tahmina, #openstack-meeting at 18.00UTC | 14:18 |
| lbragstad | marekd: sweet, | 14:18 |
| Tahmina | vkmc: ok thanks | 14:18 |
| vkmc | nice :) | 14:18 |
| vkmc | np | 14:18 |
| lbragstad | marekd: could you ping me the review when you push? | 14:18 |
| lbragstad | marekd: I want to add it to the RC1 review list | 14:18 |
| Tahmina | \join #openstack-meeting | 14:19 |
| rodrigods | morganfainberg, Tahmina, vkmc, in previous experiences like in GSoC and so on, I think that is worthed to find a nice topic in the project roadmap | 14:19 |
| marekd | lbragstad: yes. | 14:19 |
| lbragstad | marekd: thanks! | 14:20 |
| vkmc | rodrigods, yeah is usually the best idea... tasks that fit the project's plans | 14:20 |
| marekd | lbragstad: do we need pysaml in both test-requirements and requirements? | 14:20 |
| marekd | lbragstad: or maybe requirements is enough | 14:20 |
| lbragstad | marekd: is it used in the federation tests? | 14:20 |
| marekd | it is. | 14:20 |
| lbragstad | or just in the driver? | 14:20 |
| marekd | it's used in controller | 14:21 |
| marekd | lbragstad: and in tests as well. | 14:21 |
| morganfainberg | Tahmina, vkmc, added the topic to the agenda https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting#Agenda_for_next_meeting | 14:21 |
| *** henrynash has quit IRC | 14:22 | |
| *** vhoward has left #openstack-keystone | 14:22 | |
| vkmc | morganfainberg, awesome! :) we will be there | 14:22 |
| vkmc | thanks! | 14:23 |
| Tahmina | vkmc, morganfainberg: thanks a lot | 14:23 |
| *** stevemar has joined #openstack-keystone | 14:23 | |
| lbragstad | marekd: https://github.com/openstack/keystone/blob/master/test-requirements.txt#L23 | 14:24 |
| lbragstad | that's already in test-requirements.txt | 14:24 |
| lbragstad | marekd: just add to requirements.txt for now | 14:24 |
| *** andreaf has quit IRC | 14:26 | |
| morganfainberg | YorikSar_, we can't have the cleaner thread | 14:28 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add pysaml2 to requirements.txt. https://review.openstack.org/121878 | 14:29 |
| marekd | lbragstad: for you^^ | 14:29 |
| lbragstad | marekd: thanks! | 14:29 |
| *** YorikSar_ is now known as YorikSar | 14:29 | |
| YorikSar | morganfainberg: Why? | 14:29 |
| morganfainberg | YorikSar, it's a pattern that we really shouldn't be doing within keystone | 14:30 |
| *** f13o has joined #openstack-keystone | 14:30 | |
| *** f13o has quit IRC | 14:30 | |
| morganfainberg | YorikSar, it is the biggest part of your patchset that was a concern, also my change was mostly to see what it would take to remove it. | 14:30 |
| YorikSar | morganfainberg: It removed good chunk of functionality as well. | 14:31 |
| *** rwsu has joined #openstack-keystone | 14:31 | |
| morganfainberg | YorikSar, in short we don't want that pattern in keystone. - also my changesets were mostly an experiment to see if i could remove the cleaner thread not a final "has to go this way" | 14:31 |
| morganfainberg | YorikSar i unfortunately meant to convert it to a new change id but missed (sorry) | 14:31 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add pysaml2 to requirements.txt. https://review.openstack.org/121878 | 14:31 |
| marekd | lbragstad: np | 14:31 |
| YorikSar | morganfainberg: I don't quite see why this thread is so bad from your pov. | 14:32 |
| morganfainberg | YorikSar, because it spins up another thread that must be managed for each pool | 14:32 |
| YorikSar | morganfainberg: Well, there's no point in having 2 CRs around the same code. | 14:32 |
| *** david-lyle has joined #openstack-keystone | 14:32 | |
| YorikSar | morganfainberg: It's managed by weakref. | 14:32 |
| YorikSar | morganfainberg: Thread exists as long as there's at least one reference to the pool. | 14:33 |
| morganfainberg | YorikSar, having 2 CRs is fine, if one is meant to explor an option | 14:33 |
| morganfainberg | YorikSar, we primarily run under apache | 14:33 |
| morganfainberg | YorikSar, which is *single* thread | 14:33 |
| morganfainberg | YorikSar, and we're adding extra overhead for each service that runs auth_token as well. | 14:33 |
| morganfainberg | YorikSar, it's the wrong pattern in this case. | 14:34 |
| YorikSar | morganfainberg: Really?.. I thought Apache usualy runs multi-process multi-threaded. | 14:34 |
| morganfainberg | YorikSar, keystone under apache is run in mod_wsgi, which ends up being a single thread / process | 14:34 |
| morganfainberg | YorikSar, erm, multiple processes, single thread per | 14:35 |
| YorikSar | morganfainberg: From mod_wsgi docs: If this option is not defined then the default will be to create 15 threads in each daemon process within the process group. | 14:36 |
| YorikSar | morganfainberg: It's about threads= option for process group. | 14:36 |
| YorikSar | morganfainberg: So by default it has multiple threads per process. | 14:36 |
| morganfainberg | YorikSar, oh wait a sec, sorry it's a thread.local works fine in mod_wsgi (sorry i just woke up) | 14:37 |
| morganfainberg | YorikSar, i am *very* concerned about adding in a lot of threading overhead / management / communications. | 14:37 |
| YorikSar | morganfainberg: There's not much overhead with cleaner thread. | 14:37 |
| morganfainberg | YorikSar, and generally speaking that has been the view when this was discussed in IRC by all involved | 14:37 |
| YorikSar | morganfainberg: All threading overhead is already there with thread-safety of pool itself. Cleaner just uses existing primitives to create mostly sleeping thread. | 14:38 |
| YorikSar | morganfainberg: Unfortunatelly I didn't take part in that discussion... | 14:39 |
| morganfainberg | YorikSar, i've tried to ping you on a few occasions about it | 14:39 |
| morganfainberg | YorikSar, :( i wish time differences were such an issue | 14:40 |
| YorikSar | morganfainberg: Is there any way I can convince people that cleaner thread don't present any significant overhead? | 14:41 |
| morganfainberg | YorikSar, it is mostly a pattern we don't want in Keystone. we don't want extra threads started to "manage" resources | 14:42 |
| morganfainberg | YorikSar, i don't want to have to come back through and rip that out in K or explain to someone why we can't just keep adding threads for things. it adds a lot of complexity for not a lot of benefit | 14:43 |
| morganfainberg | YorikSar, and it makes it a lot harder to understand what is going on in the pool. | 14:43 |
| *** andreaf has joined #openstack-keystone | 14:43 | |
| YorikSar | morganfainberg: Well, not having tons of unused connections is a benefit... | 14:43 |
| morganfainberg | YorikSar, if it wasn't so late in the cycle (past dep. freeze) we'd convert to pymemcache instead. | 14:43 |
| morganfainberg | YorikSar, we can prevent the explosion of connections without needing a cleaner thread. | 14:44 |
| YorikSar | morganfainberg: I didn't dig into pymemcache. Does it do connection pooling by itself? | 14:44 |
| morganfainberg | YorikSar, no, but it avoids the thread.local issue completly | 14:45 |
| morganfainberg | our issue is specifically thread.local + eventlet in this case | 14:45 |
| YorikSar | morganfainberg: It doesn't... dogpile.cache does threadlocal as well. | 14:45 |
| morganfainberg | YorikSar, i've already talked to Mike about that, the plan is to make dogpile use pymemcache instead | 14:45 |
| morganfainberg | YorikSar, but again we're talking about dep-freeze issues. | 14:46 |
| YorikSar | morganfainberg: ok, back to how to fix this now. | 14:46 |
| YorikSar | morganfainberg: How do you propose to handle old connections? | 14:46 |
| morganfainberg | YorikSar, we will need to perform the clean up either on accquire or release. | 14:47 |
| YorikSar | morganfainberg: The approach in you latest patchset won't work... | 14:47 |
| morganfainberg | YorikSar, if i inverted the list for cleanup or separate cleanup it would. | 14:47 |
| YorikSar | morganfainberg: And if we kill connections only on acquire/release we'll still have lots of connections around when there's no activity.. | 14:48 |
| morganfainberg | YorikSar, lets step back, why are we cleaning up connections ever (except when they are legitimately dead) | 14:48 |
| morganfainberg | ? | 14:48 |
| YorikSar | morganfainberg: But I guess that's not the case for us since there's always some activity. | 14:49 |
| YorikSar | morganfainberg: To save system resources basicaly. | 14:49 |
| morganfainberg | YorikSar, even if we had no activity, there isn't a big win to cleanup the connections unless we have GC issues. | 14:49 |
| morganfainberg | YorikSar, we're setting a max limit on connections anyway | 14:49 |
| *** jorge_munoz has joined #openstack-keystone | 14:49 | |
| morganfainberg | YorikSar gc/mem leak in the client (aka, using .cas) | 14:50 |
| YorikSar | morganfainberg: We can't have every Keystone process have hundreds of connections open. | 14:50 |
| openstackgerrit | Kévin Bernard-Allies proposed a change to openstack/keystone: Revoke the tokens of group members when a group role is revoked https://review.openstack.org/121628 | 14:50 |
| morganfainberg | YorikSar, no, but you'd likely tune the pool for a given keystone install. | 14:50 |
| YorikSar | morganfainberg: Actually, I think I see that doing cleanup in acquire/release should be good enough... | 14:51 |
| morganfainberg | YorikSar, and i see your point of initial intent though now, sorry about msising it :) | 14:51 |
| YorikSar | morganfainberg: I thought we shouldn't have maxsize connections always open, but we should be able to open maxsize connections during usage peaks. | 14:52 |
| morganfainberg | YorikSar, so what if we did a .cleanup method that was invoked on a modulus of the time.time() (aka add a delay so we don't cleanup every time) | 14:52 |
| YorikSar | morganfainberg: I think we can just check if we have anything to cleanup - just as in cleaner thread. | 14:53 |
| *** ajayaa has quit IRC | 14:53 | |
| morganfainberg | YorikSar, oh right should be low enough cost. | 14:53 |
| *** jsavak has joined #openstack-keystone | 14:53 | |
| YorikSar | morganfainberg: I can implement that later today... | 14:54 |
| morganfainberg | YorikSar, the other question i have is the "always false one" | 14:54 |
| morganfainberg | YorikSar, that is the same logic you used. | 14:54 |
| YorikSar | morganfainberg: But I'd like to keep separation of logic between abstract pool and specialized memcached pool. | 14:54 |
| morganfainberg | the only difference is i wrapped it in a () | 14:55 |
| morganfainberg | for line wrap | 14:55 |
| YorikSar | while not self._free_pool and self._acquired >= self._maxsize: | 14:55 |
| YorikSar | self._no_free.wait() | 14:55 |
| YorikSar | morganfainberg: That's my code | 14:55 |
| morganfainberg | YorikSar look the line below it | 14:55 |
| YorikSar | _free_pool != _no_free | 14:55 |
| morganfainberg | self._condition.wait() | 14:55 |
| morganfainberg | oh | 14:55 |
| morganfainberg | oh wait | 14:56 |
| morganfainberg | ah | 14:56 |
| morganfainberg | typo. | 14:56 |
| morganfainberg | stupid auto-fill :P | 14:56 |
| *** lufix has quit IRC | 14:56 | |
| *** joesavak has quit IRC | 14:56 | |
| YorikSar | morganfainberg: Yeah. I think the problem is that it's too smart ;) | 14:57 |
| morganfainberg | YorikSar, i'm not opposed to the abstract pool, but it was a lot harder to read when we were dealing with the cleaner | 14:57 |
| YorikSar | morganfainberg: I use Vim's built-in one :) | 14:57 |
| morganfainberg | YorikSar, let me revert some of this and i'll get it posted up, then you can cleanup/fix as needed and we can move on to the hard part, unit tests | 14:58 |
| YorikSar | morganfainberg: At least we had all concurrency/threading/scary stuff in one class and all memcached-related stuff in another one. | 14:58 |
| morganfainberg | YorikSar, ++ can't argue there | 14:58 |
| morganfainberg | YorikSar, the hard part is still going to be unit tests. | 14:59 |
| YorikSar | morganfainberg: I actually think it'd be easier to modify original code to move cleaning logic than do the split in new code... | 15:00 |
| openstackgerrit | Tristan Cacqueray proposed a change to openstack/keystone: Adds a whitelist for endpoint catalog substitution https://review.openstack.org/121889 | 15:00 |
| morganfainberg | YorikSar, sure. there are some minor stuff i'll pull back | 15:00 |
| morganfainberg | YorikSar, the logger can be a method (for example) instead of a function. | 15:00 |
| YorikSar | morganfainberg: unittests, yes... Unittests for concurrency code. That's a very funny way to spend a lot of time :) | 15:00 |
| morganfainberg | YorikSar, yeah, but we need them so we don't accidently break it / regress | 15:01 |
| YorikSar | morganfainberg: Yeah, w/o background thread we don't need it to be external. | 15:01 |
| morganfainberg | YorikSar, ok cool, i'll get this posted up quickly and then we circle back later today? | 15:01 |
| YorikSar | morganfainberg: Oh, let's just say "never touch this module! it works!" :) | 15:01 |
| morganfainberg | YorikSar, haha i wish. | 15:01 |
| YorikSar | morganfainberg: Yes, I'll be online in couple hours or so. | 15:02 |
| morganfainberg | YorikSar, and sorry didn't mean to scare you with the changes, i did mean to make it a separate CR for exploration reasons. | 15:02 |
| morganfainberg | YorikSar, just totally missed on it. | 15:02 |
| morganfainberg | YorikSar would have been easier to side-by-side compare | 15:03 |
| *** ayoung has joined #openstack-keystone | 15:03 | |
| YorikSar | morganfainberg: Yeah.. It felt really bad. Like "Thanks for your code, let's cut it to pieces" | 15:03 |
| morganfainberg | YorikSar, yeah that was *not* my intention | 15:03 |
| morganfainberg | YorikSar, it really was intended to just explore the option(s) | 15:03 |
| YorikSar | morganfainberg: Yes, I undestand that now. :) | 15:04 |
| morganfainberg | YorikSar, ok good, cause don't want you running off and not continuing with keystone | 15:04 |
| tristanC | Hello folks, so https://bugs.launchpad.net/ossa/+bug/1354208 have just been disclosed, I submitted patches there: https://review.openstack.org/#/q/If02327d70d0143d805969fe927898f08eb84c4c2,n,z . Cores please have a look and approve them! | 15:04 |
| uvirtbot | Launchpad bug 1354208 in keystone "[OSSA 2014-029] Catalog replacement allows reading config (CVE-2014-3621)" [Medium,In progress] | 15:04 |
| YorikSar | morganfainberg: I guess I should've found some time to address at least some of comments yesterday. | 15:04 |
| morganfainberg | YorikSar, eh, we're just up againsts a very short window otherwise it would be less of an issue (RC) | 15:05 |
| morganfainberg | YorikSar, things get a little wonky in RC period | 15:05 |
| YorikSar | morganfainberg: Well... I guess I once again will be disapearing from Keystone after couple patches. I've just moved to another department and will have to pay way more attention to our internal stuff, and will have way less time to give to community... | 15:06 |
| *** ukalifon has quit IRC | 15:07 | |
| morganfainberg | YorikSar, ah well that is a valid reason to disappear | 15:07 |
| YorikSar | morganfainberg: That was my third-ish attempt to get involved in Keystone. | 15:07 |
| morganfainberg | YorikSar, when you have time come and visit us though :) | 15:07 |
| YorikSar | morganfainberg: First was LDAP driver that I thought we'll use for internal cloud (which we started to use ~2 years later), 2nd - some more work on LDAP driver, this is a third one :) | 15:08 |
| YorikSar | morganfainberg: It's like some fate that follows me around: whenever I start doing smth for Keystone, I barely have time to finish one thing and have to runaway; whenever I have intern working on Keystone, someone takes him/her away from me :) | 15:10 |
| morganfainberg | YorikSar, ah well, one of these times you'll get to stick around! | 15:10 |
| YorikSar | morganfainberg: Unfortunately as Mirantis grows bigger, it becomes harder to find time for comunity in areas I really like... | 15:11 |
| morganfainberg | YorikSar, ah growing organisations | 15:12 |
| YorikSar | morganfainberg: I remember OpenStack department in Mirantis as 5 guys laughing all day long and trying to make Diablo work as expected :) | 15:13 |
| *** cjellick has joined #openstack-keystone | 15:14 | |
| morganfainberg | YorikSar, how things change | 15:15 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 15:17 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:19 | |
| *** ayoung has quit IRC | 15:23 | |
| *** afazekas has quit IRC | 15:28 | |
| openstackgerrit | A change was merged to openstack/keystone: Document Keystone2Keystone federation https://review.openstack.org/120584 | 15:42 |
| *** marcoemorais has joined #openstack-keystone | 15:42 | |
| *** zzzeek has joined #openstack-keystone | 15:43 | |
| *** rushiagr is now known as rushiagr_away | 15:43 | |
| *** ayoung has joined #openstack-keystone | 15:44 | |
| *** wwriverrat has joined #openstack-keystone | 15:52 | |
| *** BAKfr has quit IRC | 15:55 | |
| *** lsmola_ is now known as lsmola | 15:57 | |
| *** lsmola is now known as lsmola______ | 15:58 | |
| *** bknudson has joined #openstack-keystone | 16:00 | |
| *** raildo has joined #openstack-keystone | 16:01 | |
| dstanek | morganfainberg: you around? | 16:02 |
| morganfainberg | dstanek, here | 16:02 |
| dstanek | morganfainberg: quick question about the logic here: https://review.openstack.org/#/c/121628/3/keystone/assignment/core.py | 16:02 |
| morganfainberg | dstanek, sture | 16:02 |
| dstanek | morganfainberg: why compare user['id'] to user_id? what is the user_id representing in a call to delete grant | 16:03 |
| morganfainberg | dstanek, it's just to save the emitting of an event since user_id already has an event emitted at the end at line 584 | 16:04 |
| morganfainberg | dstanek, otherwise in theory we could emit for user_id in each and every item in the list | 16:04 |
| dstanek | morganfainberg: ah, ok | 16:04 |
| *** _cjones_ has joined #openstack-keystone | 16:07 | |
| _cjones_ | morgainfainberg: I was talking with ayoung a few months back. He pointed me to a document regarding keystone terminology tenant vs. project in the like for Openstack > Icehouse. I've searched the google machine but can't find it. Do you know the page I'm talking about? | 16:08 |
| *** joesavak has joined #openstack-keystone | 16:08 | |
| dstanek | _cjones_: a doc talking about why it changed? | 16:08 |
| _cjones_ | morganfainberg: Sorry mistyped your name. | 16:09 |
| _cjones_ | dstanek: No, just a doc detailing what the new meanings were. IIRC. | 16:09 |
| * _cjones_ is trying to settle an internal corp. dispute. | 16:09 | |
| dstanek | _cjones_: i though they basically mean the same thing - the old things was to call them tenants and the new thing is to call them projects | 16:10 |
| _cjones_ | dstanek: | 16:10 |
| *** jsavak has quit IRC | 16:10 | |
| _cjones_ | dstanek: Correct. But there was documenation to that effect. versions > Icehouse the proper thing to do is use "projects"> | 16:10 |
| _cjones_ | I thought this was keystone specific documentation, but I could be wrong and just in the O/S general manual. | 16:11 |
| dstanek | _cjones_: hmmm, no idea. i just never call them tenants. some of our APIs expect the tenant name in a few places though | 16:12 |
| *** henrynash has joined #openstack-keystone | 16:12 | |
| raildo | henrynash, can you answer me a question? | 16:16 |
| *** DavidHu_ has joined #openstack-keystone | 16:17 | |
| raildo | Now that hirarchical projects is on a branch and is being reviewed, it still come into Juno, ie, it must be approved until the release of juno-3? | 16:17 |
| raildo | I believe that another keystone-core can also answer :) | 16:17 |
| henrynash | raildo: I think that’s a dolphm question.... | 16:23 |
| *** palendae has quit IRC | 16:23 | |
| raildo | dolphm, ping? | 16:23 |
| *** palendae has joined #openstack-keystone | 16:24 | |
| *** gordc has quit IRC | 16:24 | |
| *** palendae has quit IRC | 16:25 | |
| *** palendae has joined #openstack-keystone | 16:25 | |
| henrynash | bknudson, lbragstad: I think I have addressed all your collective concerns on https://review.openstack.org/#/c/121246/ | 16:26 |
| lbragstad | henrynash: I was just about to start looking at the latest version | 16:27 |
| henrynash | lbragstad: thx :-) | 16:27 |
| lbragstad | henrynash: looks good to me so far, I wanted to go through the tests one more time | 16:27 |
| henrynash | lbragstad: sure, good idea | 16:27 |
| *** amakarov is now known as amakarov_away | 16:27 | |
| *** _cjones_ has quit IRC | 16:28 | |
| *** palendae has quit IRC | 16:30 | |
| *** gordc has joined #openstack-keystone | 16:30 | |
| *** palendae has joined #openstack-keystone | 16:30 | |
| *** marcoemorais has quit IRC | 16:32 | |
| *** marcoemorais has joined #openstack-keystone | 16:32 | |
| ayoung | dolphm, can we kill this old-obsolete BP https://blueprints.launchpad.net/keystone/+spec/revert-multiple-ldap-servers even though it is set to "Priority: Not" I've had a couple people ask me if we are reverting the multi-backend code due to seeing that BP. | 16:45 |
| *** wwriverrat has left #openstack-keystone | 16:47 | |
| henrynash | dstanek: quick one…as per your comment in https://review.openstack.org/#/c/121246/12/keystone/identity/backends/sql.py - is it a standard to have 2 lines between the end of imports and any code? 2 lines before a class for sure….? | 16:53 |
| dstanek | henrynash: yes, http://docs.openstack.org/developer/hacking/#import-order-template | 16:54 |
| henrynash | dstanek: you’re so right.... | 16:55 |
| henrynash | dstanek :-) | 16:55 |
| ayoung | henrynash, dumb idea | 16:55 |
| ayoung | I mean, I have a dumb idea | 16:55 |
| dstanek | henrynash: i didn't -1 because i didn't think it was a huge deal - did you see my question in there? | 16:55 |
| ayoung | and I want to run it past you | 16:55 |
| ayoung | what if.... | 16:56 |
| henrynash | dtsanek: yes…let me post the answr | 16:56 |
| ayoung | and this is for gyee, really\ | 16:56 |
| ayoung | we allowed any keystone operation to add in the "scope" section of the token request | 16:56 |
| ayoung | and possibly even the password section if we want to be thorought | 16:56 |
| ayoung | and that means: don' | 16:56 |
| ayoung | t issue me a new token, just perform the whole operation as if I was asking for a token | 16:57 |
| henrynash | ayoung: so…a one off token for that operation | 16:57 |
| ayoung | this makes a lot more sense when using basic/auth or kerberos or something | 16:57 |
| ayoung | yep, a one off non-persisted token | 16:57 |
| dstanek | henrynash: that's what i thought - the commit message made it sound like there was a behavioral change | 16:57 |
| henrynash | dstanek: ah, ok…I’ll make the limiation a bit clearer... | 16:58 |
| morganfainberg | ayoung, marked that BP as superseded | 16:58 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:59 | |
| henrynash | dstanek: all this chaneg really does is allow you to give you’re one and only sql backend to a specific domain, rather than have it as a catchall for all domains without a specific config | 16:59 |
| henrynash | dtsanek: but in an “all LDAP’ configuration, that’s exactly what you might want | 17:00 |
| henrynash | ayoung: so, yes, if you were using LDAP or something than authenticating each time might make transcations somewhat slow | 17:02 |
| henrynash | ayoung: as an aside, haev we given up on service tokens….or are they on the docket for Kilo? | 17:03 |
| *** harlowja_away is now known as harlowja_ | 17:04 | |
| *** antonio__ has joined #openstack-keystone | 17:16 | |
| ayoung | henrynash, LDAP can be cached. I think optimizing LDAP should be its own effort regardless | 17:19 |
| antonio__ | Hello, I'm studying keystone for a reliable and scalable deployment of an OpenStack infrastructure. I would like to know if there is something configurable on the Keystone module to scale it up so it does not represent a single point of failure for the whole structure, since every other service uses it as an auth system. Thank you very much! | 17:19 |
| henrynash | ayoung: fair comment | 17:19 |
| *** bjornar_ has joined #openstack-keystone | 17:19 | |
| ayoung | antonio__, use Gallerian and multile keystone instances | 17:19 |
| morganfainberg | ayoung, antonio__, Galera | 17:19 |
| ayoung | ewhat he said | 17:20 |
| morganfainberg | percona is also viable (based on galera) | 17:20 |
| ayoung | right...make the DB scale, and then run multiple keystone servers pointing at the same DB | 17:20 |
| morganfainberg | though, don't use limited use trusts on galera / percona | 17:21 |
| morganfainberg | on icehouse that is. | 17:21 |
| ayoung | morganfainberg, yeah, the whole reference counting thing | 17:23 |
| ayoung | henrynash, so, you think it makes sense? Adding in the auth block to other requests? | 17:23 |
| henrynash | ayoung: and what’s the key thing this solves…that perhaps a service token would not solve? | 17:24 |
| ayoung | henrynash, it is a service token | 17:24 |
| ayoung | henrynash, it would let an endpoint use X509 or kerberos to auth, and perform everthing it needed in one request | 17:25 |
| ayoung | henrynash, add in a trust.... | 17:25 |
| antonio__ | ayoung, morgangainberg: thank you for your replies, it'is really very useful | 17:25 |
| ayoung | antonio__, YW | 17:25 |
| henrynash | ayoung: so whaat makes it a one-shot “service” token, as opposed to a one-shot regular token? | 17:26 |
| ayoung | henrynash, there is no token | 17:26 |
| ayoung | it is a one-shot-all-in-one request | 17:26 |
| henrynash | ayoung: ha! a subtle plan! | 17:26 |
| ayoung | henrynash, why would we need service tokens? | 17:26 |
| *** antonio__ has left #openstack-keystone | 17:26 | |
| *** kevinbenton has quit IRC | 17:27 | |
| *** DavidHu has quit IRC | 17:27 | |
| ayoung | henrynash, so, service tokens, as I understand them, are dumb | 17:27 |
| ayoung | which probably means I don't understand them | 17:28 |
| ayoung | but if they are being proposed as a proxy for authentication, then they are dangerous | 17:28 |
| *** richm has quit IRC | 17:28 | |
| ayoung | henrynash, I' | 17:28 |
| ayoung | d rather make X509 and Kerberos the default way services authenticate to keystone, then let keystone make the authentication decisions at the point of request | 17:29 |
| ayoung | a token is really a cache of that data, and, while we could always cache, we already do cache with dogpile, so lets let a cache be a cache and not cache out cache. Capiche? | 17:29 |
| ayoung | henrynash, we could make a separate middleware that does this: | 17:30 |
| ayoung | look for the auth data, call the token-provider with a flag that says do not persist the token. The token data gets added to the request, and then that is what is used for the policy check | 17:31 |
| ayoung | then only run that middleware on internal interfaces | 17:32 |
| *** kevinbenton has joined #openstack-keystone | 17:32 | |
| henrynash | ayoung: yes, you could use middleware to fairly easily add support…. | 17:33 |
| *** richm has joined #openstack-keystone | 17:33 | |
| henrynash | ayoung: in general, this seems like a good idea | 17:33 |
| ayoung | henrynash, let me cook up a sample request for, say, validate token | 17:33 |
| ayoung | henrynash, heh, it would just a be a token request body and a Header with X-Subject-Token: c67580 | 17:36 |
| ayoung | let me find something less trivial | 17:36 |
| ayoung | giving a user a role in a project: | 17:36 |
| ayoung | Nope | 17:37 |
| ayoung | that is just | 17:37 |
| ayoung | PUT /projects/{project_id}/users/{user_id}/roles/{role_id} | 17:37 |
| ayoung | Damn this well designed REST API. | 17:37 |
| ayoung | Ok, create role | 17:38 |
| ayoung | henrynash, morganfainberg http://paste.openstack.org/show/112246/ | 17:39 |
| *** soulxu_ has joined #openstack-keystone | 17:40 | |
| ayoung | henrynash, morganfainberg and for kerberos it would be the more straightforward http://paste.openstack.org/show/112248/ | 17:42 |
| *** alex_xu has quit IRC | 17:43 | |
| ayoung | we could actually do it in the existing auth context middleware: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/middleware/core.py#n243 | 17:44 |
| ayoung | there is code in the auth controller that should be moved into the token provider, but that is no surprise | 17:45 |
| henrynash | ayoung: not sure why you would change the api other than include the authentication info….(rather than try and deduce the api paramters from the auth data) | 17:46 |
| morganfainberg | dstanek, henrynash, ayoung, a second +2 / +A on this would be great https://review.openstack.org/#/c/121889/ | 17:46 |
| ayoung | henrynash, reall all I need is {scope} | 17:46 |
| henrynash | ayoung: which is what I think you are doing in that example | 17:46 |
| morganfainberg | this has been pre-approved in the bug fwiw. | 17:46 |
| henrynash | ayoung: but the role you are adding might not be for you…. (for example) | 17:46 |
| ayoung | henrynash, but you need to convert from, say the kerberos credentials to the user id etc, | 17:46 |
| ayoung | and need to know which mapping to use | 17:47 |
| ayoung | no, in this case, the role is for "you" | 17:47 |
| ayoung | heh, the "role" example is also potentially confusing, but the alternative is create user, which would probablty be just as confusing | 17:47 |
| *** aix has quit IRC | 17:48 | |
| ayoung | henrynash, the short would be "anthing we can add to a token request we can layer on to any other request and get authentication and authorization for just that request" | 17:48 |
| dstanek | morganfainberg: i didn't want to +2 because i wrote it | 17:48 |
| morganfainberg | dstanek, ah | 17:48 |
| henrynash | ayoung: agreed | 17:48 |
| morganfainberg | dstanek, thanks. | 17:48 |
| ayoung | create token would then be "persist this token you just created" | 17:48 |
| *** samuelmz has quit IRC | 17:48 | |
| ayoung | dstanek, is that a bug fix? | 17:49 |
| ayoung | it smells like a feature to me | 17:49 |
| ayoung | ah...now I read the bug | 17:49 |
| ayoung | I see | 17:49 |
| ayoung | morganfainberg, go ahead and +2 if you like, but let me review it as well | 17:50 |
| dstanek | ayoung: yeah. a security bug that got disclosed today | 17:50 |
| ayoung | morganfainberg, I'll +A if I am done after you | 17:50 |
| ayoung | dstanek, '(Deprecated) right up front? | 17:51 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 17:55 |
| morganfainberg | YorikSar, ^ tested that to work as expected in devstack, still needs tests | 17:55 |
| YorikSar | morganfainberg: Ok, will take a look | 17:56 |
| morganfainberg | YorikSar, oh i'll post a new one in a sec. i need to fix the documentation thing i did before | 17:56 |
| morganfainberg | YorikSar, will post in ~2mins | 17:56 |
| morganfainberg | YorikSar it should be much closer to your original code now but just minus the cleaner thread | 17:56 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Ensure identity sql driver supports domain-specific configuration. https://review.openstack.org/121246 | 17:59 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 18:00 |
| morganfainberg | YorikSar, ok there. added doc stuff back in | 18:00 |
| *** jsavak has joined #openstack-keystone | 18:00 | |
| morganfainberg | meeting time! | 18:01 |
| *** joesavak has quit IRC | 18:03 | |
| *** samuelmz has joined #openstack-keystone | 18:07 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:07 | |
| *** palendae has quit IRC | 18:08 | |
| *** palendae has joined #openstack-keystone | 18:08 | |
| *** joesavak has joined #openstack-keystone | 18:16 | |
| bknudson | morganfainberg: https://bugs.launchpad.net/python-keystoneclient/+bug/1370192 | 18:16 |
| uvirtbot | Launchpad bug 1370192 in python-keystoneclient "Update oslo requirements to final release" [Undecided,New] | 18:17 |
| morganfainberg | bknudson, thanks | 18:17 |
| *** jsavak has quit IRC | 18:19 | |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Use oslo_debug_helper and remove our own version https://review.openstack.org/120105 | 18:20 |
| marekd | bknudson: morganfainberg dstanek ayoung lbragstad : I would appreciate some eyes on this: https://review.openstack.org/#/c/111771/ | 18:26 |
| *** KanagarajM has quit IRC | 18:26 | |
| YorikSar | morganfainberg: Indeed, diff looks way shorter. Fixing bugs... | 18:31 |
| morganfainberg | YorikSar, ++ thanks! | 18:31 |
| nkinder | where are the API docs for fetching the token revocation list? | 18:31 |
| nkinder | it doesn't look like it's documented | 18:31 |
| morganfainberg | YorikSar, the _cleaner method i'm not sure about tbh, it feels clunky | 18:31 |
| morganfainberg | nkinder, uhm.. | 18:32 |
| morganfainberg | nkinder, i don't think it is documented *wince* | 18:32 |
| morganfainberg | tough i think it shoudl be in identity-api | 18:32 |
| morganfainberg | repo | 18:32 |
| nkinder | the blueprint says GET /tokens/revoked/ on the admin port, but I get a 404 with that | 18:33 |
| morganfainberg | nkinder, try on port 5000? | 18:34 |
| nkinder | morganfainberg: tried on both with v3. 404 either way | 18:34 |
| morganfainberg | or.. wait, try w/o the trailing / maybe? | 18:34 |
| morganfainberg | oh v3, v3 is /auth/revoked i think | 18:34 |
| YorikSar | morganfainberg: It was broken a bit ;) | 18:34 |
| bknudson | nkinder: there's a v3 extension to get the revoked tokens | 18:34 |
| YorikSar | morganfainberg: btw, how about calling it in release as well? | 18:34 |
| morganfainberg | YorikSar, i tested it and it worked, but i wasn't sure about it being the right answer | 18:34 |
| nkinder | ah, it's v2.0 only | 18:34 |
| morganfainberg | YorikSar, talk about that post meeting | 18:35 |
| nkinder | let me try auth/revoked with v3 | 18:35 |
| YorikSar | morganfainberg: Oh, sure. | 18:35 |
| bknudson | nkinder: oh, that's events, not the list... | 18:35 |
| nkinder | morganfainberg: no dice with /auth/revoked | 18:36 |
| rodrigods | when I want to authenticate a v3 token, where is done the actual checking of user/role/project? | 18:36 |
| morganfainberg | nkinder, let me look at the code there is a router for it, just don't know where it is | 18:36 |
| morganfainberg | nkinder, post meeting i'll find it unless someone beats me to it | 18:36 |
| nkinder | morganfainberg: I can look myself. :) | 18:36 |
| bknudson | nkinder: the auth_token middleware fetches it, so see what it does | 18:36 |
| morganfainberg | nkinder, of course. | 18:37 |
| morganfainberg | nkinder, :P | 18:37 |
| *** ukalifon1 has joined #openstack-keystone | 18:40 | |
| rodrigods | where in the code, I mean =) | 18:41 |
| ukalifon1 | nkinder: does the objectSid attribute exist for every record in AD, or how do I add it? | 18:41 |
| nkinder | ukalifon1: I think it exists for every record | 18:42 |
| nkinder | ukalifon1: I tore down my AD vm, so I'd need about 20 minutes to spin up a new rhos->AD setup to check | 18:42 |
| ukalifon1 | nkinder: so how is it that this bug ever existed? | 18:42 |
| nkinder | ukalifon1: well, the utf8 code that blows up on it is newer | 18:42 |
| nkinder | ukalifon1: newer == icehouse IIRC | 18:43 |
| nkinder | ukalifon1: as I mentioned before though, my AD with Icehouse was working | 18:43 |
| nkinder | ukalifon1: it might be dependent on what exactly is in the ObjectSID value | 18:43 |
| ukalifon1 | nkinder: OK, I still haven't been able to connect keystone to the AD with the IPA trust. Did Rich look at what's failing in his script? | 18:44 |
| nkinder | ukalifon1: I'm not sure where you two left off. I have working scripts that set up AD | 18:46 |
| nkinder | with RHOS | 18:46 |
| *** henrynash has quit IRC | 18:55 | |
| *** henrynash has joined #openstack-keystone | 18:56 | |
| morganfainberg | YorikSar, ok my only concern about running cleaner on both acquire and release is it could add a lot of extra looping | 18:57 |
| morganfainberg | YorikSar, i'd prefer to only call it in either acquire or release rather than in both | 18:58 |
| morganfainberg | YorikSar in most environments we wont need to reap connections that often. | 18:58 |
| YorikSar | morganfainberg: I think we should call it only in release then. | 18:58 |
| morganfainberg | YorikSar, works for me | 18:58 |
| YorikSar | morganfainberg: The later we call it the more connections we catch. | 18:58 |
| morganfainberg | YorikSar, i was thinking about it and i agree, in release makes more sense | 18:59 |
| YorikSar | morganfainberg: I'm testing my new version, will upload it soon. | 18:59 |
| morganfainberg | YorikSar, cool thanks | 18:59 |
| *** henrynash has quit IRC | 19:01 | |
| topol | henrynash: This at least enables the (often requested) scenario of service users | 19:02 |
| topol | to be stored in SQL in a predominantly LDAP installation. <-- THATS AWESOME | 19:02 |
| YorikSar | morganfainberg: btw, I've removed comments about 'this is for memcached KVS backend' from [memcache] section. | 19:02 |
| marekd | anybody knows what's up with guang? he's been around recently? | 19:02 |
| YorikSar | morganfainberg: If we are in [memcache] section then we use memcache backedn | 19:02 |
| morganfainberg | YorikSar, sounds good | 19:03 |
| morganfainberg | YorikSar, if you removed that in the config.py file make sure you regenerate the sample config: tox -esample_config | 19:03 |
| morganfainberg | before submitting | 19:03 |
| YorikSar | morganfainberg: Oh, will do. | 19:03 |
| morganfainberg | oh actually. hm | 19:04 |
| nkinder | morganfainberg, bknudson: v3 is /auth/tokens/OS-PKI/revoked | 19:04 |
| morganfainberg | no we might need those comments, or need to add documentation to configuration.rst for the memcache token backend (probably the right answer) | 19:04 |
| morganfainberg | nkinder, ahah | 19:04 |
| morganfainberg | YorikSar, i'll look at adding to the documentation itself instead of in the config file help | 19:05 |
| bknudson | nkinder: ah. There's a bug out there to document that extension. | 19:05 |
| nkinder | bknudson: yes, writing it on my list | 19:05 |
| nkinder | I'm working on fixing a bug where we blow up calling openssl when we attempt to fetch the revocation list and the configured provider is uuid | 19:05 |
| nkinder | no cert/key == ENOENT | 19:06 |
| *** gabriel-bezerra has joined #openstack-keystone | 19:06 | |
| bknudson | nkinder: I think I might have a bug for it already? | 19:07 |
| bknudson | I haven't been working on it | 19:07 |
| nkinder | bknudson: oh, I haven't searched. I can whip up a fix for it | 19:07 |
| nkinder | bknudson: I'll search LP | 19:07 |
| bknudson | nkinder: I don't have an external bug for it... just someone complained to me internally | 19:08 |
| nkinder | bknudson: ok, I'll file one then | 19:08 |
| bknudson | nkinder: and as I was working on it it seemed to require extension discovery so then I worked on JSON Home support | 19:08 |
| nkinder | bknudson: for OS-PKI? | 19:09 |
| bknudson | nkinder: I've got this change: https://review.openstack.org/#/c/92727/ | 19:09 |
| *** ukalifon1 has quit IRC | 19:09 | |
| bknudson | nkinder: oh, here's the bug: https://bugs.launchpad.net/keystone/+bug/1317302 | 19:09 |
| uvirtbot | Launchpad bug 1317302 in keystone "pki_setup shouldn't be required to check revocations" [Wishlist,In progress] | 19:09 |
| bknudson | nkinder: is this what you think the problem is? | 19:09 |
| bknudson | that's the only time auth_token would fetch the revocation list with UUID tokens, is if you've configured auth_token to check the revocation list for uuid tokens. | 19:10 |
| nkinder | bknudson: I thought that UUID simply deletes tokens from the database when revocation happens. Is that not the case? | 19:10 |
| openstackgerrit | Yuriy Taraday proposed a change to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 19:10 |
| YorikSar | morganfainberg: Here it is ^ | 19:11 |
| bknudson | nkinder: no, it marks them as invalid | 19:11 |
| YorikSar | morganfainberg: I'll add comments on what I've changed | 19:11 |
| nkinder | bknudson: ok, then the token-flush cleans them up? | 19:11 |
| morganfainberg | YorikSar ty | 19:11 |
| bknudson | nkinder: token-flush will delete them eventually once the expiration time has passed. | 19:11 |
| morganfainberg | YorikSar, ah thanks for using the namedtuple much better! | 19:12 |
| bknudson | nkinder: the expiration list is a database query: expiration_time > now and invalid | 19:12 |
| nkinder | bknudson: yeah, that makes sense | 19:13 |
| nkinder | bknudson: so you could sign the revocation list even with UUID (and I don't see why you wouldn't want to) | 19:13 |
| nkinder | bknudson: if we have an unsigned revocation list, the client needs to be able to handle that too | 19:14 |
| bknudson | nkinder: y, it's just when you use UUID tokens you typically don't have to do pki_setup. | 19:14 |
| bknudson | nkinder: and yes, there's work to do on both sides. | 19:14 |
| nkinder | bknudson: we need to determine if unsigned revocation lists are even a good idea honestly | 19:15 |
| bknudson | nkinder: also, we've got the audit_id in the tokens now. So rather than have a list of token IDs we can have a list of audit_ids. No need to encrypt in that case. | 19:15 |
| nkinder | bknudson: but signing is valuable | 19:15 |
| nkinder | bknudson: it's something to think on some more | 19:16 |
| bknudson | nkinder: sure... if you're getting the cert from the server you're not gaining much... if the cert was provided by a more secure transport then signing would provide more security. | 19:17 |
| bknudson | maybe the certs should be distributed via your chef or puppet or whatever | 19:18 |
| openstackgerrit | Yuriy Taraday proposed a change to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 19:21 |
| *** harlowja_ has quit IRC | 19:22 | |
| *** harlowja has joined #openstack-keystone | 19:22 | |
| YorikSar | morganfainberg: Forgot to remove cleanip from acquire() | 19:23 |
| morganfainberg | YorikSar, ah. i see | 19:23 |
| morganfainberg | all good | 19:23 |
| morganfainberg | YorikSar, thanks! | 19:23 |
| morganfainberg | now... we need to figure out unit tests *ugh* | 19:23 |
| morganfainberg | i'll start trying to come up with those post lunch | 19:24 |
| YorikSar | morganfainberg: Post new patchset if you come up with smth. I'll look at it tomorrow. I also have some ideas, but it's too late... | 19:25 |
| morganfainberg | YorikSar, sounds good | 19:26 |
| rodrigods | morganfainberg, quick question: when I want to authenticate via v3 token, where the user/role/project checking is done? (in the code) | 19:33 |
| dstanek | Can we got one more +2 on https://review.openstack.org/#/c/121889/ ? | 19:52 |
| *** Gippa has joined #openstack-keystone | 19:53 | |
| *** _nonameentername has quit IRC | 19:53 | |
| *** nonameentername has joined #openstack-keystone | 19:54 | |
| *** Gippa has quit IRC | 19:56 | |
| *** topol has quit IRC | 19:57 | |
| *** afaranha has quit IRC | 20:01 | |
| *** jsavak has joined #openstack-keystone | 20:02 | |
| *** afaranha has joined #openstack-keystone | 20:03 | |
| *** topol has joined #openstack-keystone | 20:03 | |
| *** joesavak has quit IRC | 20:04 | |
| dstanek | morganfainberg: YorikSar: would devstack use the keystone default for max pool size or should that be set higher for a running deployment? | 20:08 |
| ayoung | marekd, on https://review.openstack.org/#/c/111771/ . did you mean to remove the kwargs from the functions like _get_unscoped_token or was that a rebase thing? | 20:08 |
| *** andreaf has quit IRC | 20:08 | |
| *** andreaf has joined #openstack-keystone | 20:09 | |
| *** Tahmina has quit IRC | 20:10 | |
| *** soulxu__ has joined #openstack-keystone | 20:15 | |
| YorikSar | dstanek: default should be enough for devstack. It might even be enough for rally runs. | 20:18 |
| *** soulxu_ has quit IRC | 20:19 | |
| *** jasondotstar has quit IRC | 20:21 | |
| morganfainberg | dstanek, probably for a real deployment that needs to be tuned. | 20:22 |
| dstanek | YorikSar: really only 10 concurrent requests using the cache? | 20:23 |
| dstanek | morganfainberg: yeah, for a real deployment i would expect it to be much, much higher to avoid contention, but i was thinking for devstack deployments. do gate tests run in paralllel or are they mostly serialized? | 20:25 |
| YorikSar | dstanek: Yep. I think that can be enough. We don't have hard data about that. | 20:25 |
| morganfainberg | dstanek, we don't test memcache in devstack | 20:25 |
| dstanek | morganfainberg: ah, ok. | 20:25 |
| *** wwriverrat has joined #openstack-keystone | 20:25 | |
| YorikSar | dstanek: For real deployments we're going to use 100 iirc. | 20:25 |
| morganfainberg | dstanek, gate tests run in parallel (i think tempest runs multi-worker) | 20:25 |
| morganfainberg | dstanek, which is why it's important we get unit tests for this. we don't get functional nor integration testing atm | 20:26 |
| morganfainberg | (I'm honestly surprised we haven't had more weird memcache issues) | 20:26 |
| morganfainberg | but for typical devstack, i *think* we're ok with 10 being the default | 20:27 |
| morganfainberg | we could move to 100 default and tell people "tune it down if that is too hight" | 20:27 |
| morganfainberg | not sure which default is more sane in this case | 20:27 |
| *** radez is now known as radez_g0n3 | 20:27 | |
| *** htruta has left #openstack-keystone | 20:28 | |
| dstanek | morganfainberg: also is the __getattr__ issue a non-issue? | 20:30 |
| morganfainberg | dstanek, in this case it should be a non-issue. i guess we could add an 'is_callable' check in there somehow | 20:30 |
| * morganfainberg 2x checks | 20:31 | |
| morganfainberg | dstanek, crud. no we need to handle properties | 20:32 |
| morganfainberg | not just callables | 20:32 |
| dstanek | morganfainberg: right now dogpile.cache backends are documented to have one property | 20:33 |
| morganfainberg | and in kvs we use more | 20:33 |
| morganfainberg | i've layered a couple extras on | 20:33 |
| *** rodrigods has quit IRC | 20:33 | |
| morganfainberg | ok so we need some docs, fix for properties and tests | 20:34 |
| dstanek | morganfainberg: actually YorikSar answered here: https://review.openstack.org/#/c/119452/5/keystone/common/cache/backends/memcache_pool.py | 20:34 |
| morganfainberg | oh | 20:34 |
| morganfainberg | derp just client | 20:34 |
| morganfainberg | oh yeah that should be fine then | 20:34 |
| dstanek | hmmm....what does dogpile use as the backend? | 20:34 |
| morganfainberg | dogpile's backends are the dopile cache backend object | 20:35 |
| morganfainberg | so class PooledMemcachedBackend(memcached_backend.MemcachedBackend) is a dogpile backend | 20:35 |
| morganfainberg | .client is referencing the memcache lib | 20:35 |
| dstanek | morganfainberg: sorry, i know next to nothing about the dogpile architecture :-( | 20:36 |
| morganfainberg | dstanek, dogpile has 3 layers (really, ignore the decorators) | 20:36 |
| dstanek | so we pass in an instance of PooledMemcachedBackend for dogpile - then it will call .client when it needs one? | 20:36 |
| morganfainberg | dstanek, Region: This is the base configuration and has the locking, etc, holds the decorators etc | 20:36 |
| morganfainberg | dstanek, Backend: what the region references | 20:36 |
| morganfainberg | dstanek, Storage (e.g. dict, memcached, etc) which is the .client in this case | 20:37 |
| bknudson | dstanek: were you going to work on a change to remove endpoint_substitution_whitelist after https://review.openstack.org/#/c/121889/1/keystone/common/config.py is merged? | 20:37 |
| morganfainberg | dstanek, so yeah the region will say "backend do a 'get' on this key" and the backend grabs a client object then uses that (in this case the proxy'd client object) | 20:38 |
| morganfainberg | in reality when you do a .get / .set you're doing the .get/.set on the dogpile region, which does keymangling, and other logic | 20:39 |
| dstanek | bknudson: yes | 20:39 |
| *** gabriel-bezerra has quit IRC | 20:40 | |
| dstanek | so it looks like there any several properties on the memcache.Client, but I don't think dogpile would be using any of them | 20:49 |
| dstanek | morganfainberg: do you know dogpile's backend implements all of the memcache client interface? https://bitbucket.org/zzzeek/dogpile.cache/src/1c753914b335b4391bc5847a87b7c52ca81c2bc6/dogpile/cache/backends/memcached.py?at=master | 20:51 |
| morganfainberg | dstanek, it does not support CAS | 20:51 |
| morganfainberg | dstanek, it only supports get/set/delete and the muli variants | 20:52 |
| morganfainberg | dstanek, so it isn't a complete memcache impl. | 20:52 |
| *** marcoemorais has quit IRC | 20:52 | |
| *** marcoemorais has joined #openstack-keystone | 20:52 | |
| morganfainberg | dstanek, and dogpile should only care about the get/set/delete/multi stuff | 20:53 |
| morganfainberg | (for now) | 20:53 |
| dstanek | morganfainberg: but their backend impl implements those and .client - ours just implements .client | 20:54 |
| morganfainberg | dstanek, our backend is a subclass of that backend | 20:54 |
| *** marcoemorais1 has joined #openstack-keystone | 20:54 | |
| morganfainberg | dstanek, and .get/set/delete call self.client | 20:54 |
| dstanek | morganfainberg: oh, nm. you're right. i'm getting confused between memcached_pool and _memcached_pool | 20:55 |
| morganfainberg | dstanek, thats why i moved _memcache_pool out of the backends directory | 20:55 |
| *** jsavak has quit IRC | 20:56 | |
| *** marcoemorais has quit IRC | 20:58 | |
| *** gokrokve has joined #openstack-keystone | 20:58 | |
| *** marcoemorais1 has quit IRC | 21:02 | |
| *** marcoemorais has joined #openstack-keystone | 21:02 | |
| *** amerine has quit IRC | 21:02 | |
| *** marcoemorais has quit IRC | 21:02 | |
| *** amerine has joined #openstack-keystone | 21:02 | |
| *** marcoemorais has joined #openstack-keystone | 21:03 | |
| dstanek | morganfainberg, YorikSar: added a few more comments to https://review.openstack.org/#/c/119452/ not that i understand the dogpile side a little better | 21:03 |
| morganfainberg | dstanek, cool | 21:03 |
| morganfainberg | dstanek, i think the leaking over max is an issue | 21:06 |
| morganfainberg | i can come up with a high load scenario that could in theory continue to leak upwards | 21:06 |
| morganfainberg | and the self._acquired increment/decrement are not protected and could race in some cases. | 21:06 |
| * morganfainberg hates threading code | 21:07 | |
| *** gabriel-bezerra has joined #openstack-keystone | 21:07 | |
| morganfainberg | oh wait hm, += might be ok | 21:07 |
| morganfainberg | dstanek, unless eventlet yeild points wont be hit in that logic, which case the coroutine would be enough of a gate. | 21:08 |
| morganfainberg | ayoung, i vote eventlet off the island | 21:09 |
| morganfainberg | dstanek, responded to your comments. | 21:13 |
| morganfainberg | dstanek, either i or YorikSar can address most in the next patch | 21:13 |
| *** soulxu_ has joined #openstack-keystone | 21:14 | |
| *** rodrigods has joined #openstack-keystone | 21:16 | |
| *** rodrigods has quit IRC | 21:16 | |
| *** rodrigods has joined #openstack-keystone | 21:16 | |
| *** soulxu__ has quit IRC | 21:17 | |
| dstanek | morganfainberg: ok, i'll take a look - the += should be ok, but there is a gap between the check against maxclients and where the client is created | 21:22 |
| dstanek | morganfainberg: do you know how locks are handled in eventlet? | 21:22 |
| morganfainberg | dstanek, unfortunately no. | 21:23 |
| dstanek | morganfainberg: i'm going to do some experimenting :-) | 21:23 |
| morganfainberg | but i don't think a .pop is a yeild point | 21:23 |
| morganfainberg | dstanek, now we might need to increment before we do the create then try/except around the create with a decrement if the create fails | 21:24 |
| morganfainberg | since the create could have a yeild point deep in it | 21:24 |
| dstanek | does creating a connection object introduce an opportunity to yield, especially if it actually does networking stuff to establish a connection | 21:25 |
| morganfainberg | dstanek, looking at that now actually | 21:25 |
| *** gokrokve has quit IRC | 21:26 | |
| *** gokrokve has joined #openstack-keystone | 21:27 | |
| *** wwriverrat has quit IRC | 21:27 | |
| *** vkmc has quit IRC | 21:28 | |
| *** wwriverrat has joined #openstack-keystone | 21:28 | |
| morganfainberg | dstanek, it looks like the actual socket.connect isn't called until a call that actually talks to memcache occurs | 21:28 |
| morganfainberg | dstanek, so there is likely no yield in the create connection method. | 21:29 |
| dstanek | ok, my fear is that there is something i don't understand here | 21:36 |
| *** mflobo has quit IRC | 21:38 | |
| morganfainberg | i know eventlet locking is meant to work like normal threading just yeilding for coroutines | 21:39 |
| *** morganfainberg is now known as CaptainMorgan | 21:39 | |
| *** CaptainMorgan is now known as morganfainberg | 21:39 | |
| *** wwriverrat has left #openstack-keystone | 21:41 | |
| *** rkofman has quit IRC | 21:44 | |
| *** rkofman has joined #openstack-keystone | 21:45 | |
| ayoung | morganfainberg, if by "meant to" you mean "acts nothing like but pretends it does" then, sure. | 21:46 |
| *** zzzeek has quit IRC | 21:47 | |
| *** topol has quit IRC | 21:48 | |
| *** stevemar has quit IRC | 21:49 | |
| *** bjornar_ has quit IRC | 21:54 | |
| *** achampion has quit IRC | 21:55 | |
| *** bknudson has quit IRC | 21:56 | |
| openstackgerrit | A change was merged to openstack/keystone: Change pysaml2 comment in test-requrements.txt. https://review.openstack.org/121807 | 21:59 |
| openstackgerrit | A change was merged to openstack/keystone: Revoke the tokens of group members when a group role is revoked https://review.openstack.org/121628 | 21:59 |
| openstackgerrit | A change was merged to openstack/keystone: Adds a whitelist for endpoint catalog substitution https://review.openstack.org/121889 | 21:59 |
| morganfainberg | ayoung, like i said, i vote it off the island | 22:00 |
| ayoung | morganfainberg, its been off the island for years, with a book deal and its own reality program | 22:00 |
| ayoung | maybe a lawsuit for back taxes, too | 22:00 |
| *** Tahmina has joined #openstack-keystone | 22:01 | |
| ayoung | morganfainberg, I'm having an issue with mox and keystoneclient calls in Django OpenStack Auth. I'm trying to figure out what I really should be testing here | 22:02 |
| ayoung | https://review.openstack.org/#/c/121281/1/openstack_auth/backend.py,cm is the code I changed | 22:03 |
| ayoung | you can see it is replacing client.Client(big long param list) calls with ones that just accept sessions | 22:04 |
| morganfainberg | ayoung, first off sorry, mox, my condolences | 22:04 |
| ayoung | morganfainberg, meh, it all sucks, just a matter of degree | 22:04 |
| ayoung | but does it make sense to mox out the session and auth plugin calls? | 22:04 |
| *** marcoemorais has quit IRC | 22:05 | |
| morganfainberg | uhmm. | 22:05 |
| morganfainberg | not really sure there. it might be the only way to get it done | 22:05 |
| morganfainberg | but ... honestly, don't know | 22:05 |
| ayoung | I guess we don't really want to run KC code, right? We just care about running the Django Code | 22:05 |
| ayoung | DOA | 22:05 |
| *** marcoemorais has joined #openstack-keystone | 22:06 | |
| ayoung | OK...I think I'm going to do this "ugly but passes" and see what Horizon says | 22:06 |
| *** marcoemorais has quit IRC | 22:06 | |
| *** marcoemorais has joined #openstack-keystone | 22:06 | |
| ayoung | morganfainberg, I don't know either. To hell with this. Let's go bowling. | 22:07 |
| *** nkinder has quit IRC | 22:09 | |
| *** r-daneel__ has quit IRC | 22:09 | |
| *** soulxu_ has quit IRC | 22:11 | |
| *** soulxu_ has joined #openstack-keystone | 22:13 | |
| *** amerine_ has joined #openstack-keystone | 22:22 | |
| *** amerine has quit IRC | 22:24 | |
| ayoung | morganfainberg, dstanek can you guys shepherd this on through https://review.openstack.org/#/c/106838/ jamielennox|away is out getting all married and stuff and he's basically blessed off on it anyway | 22:25 |
| *** david-lyle has quit IRC | 22:26 | |
| *** henrynash has joined #openstack-keystone | 22:37 | |
| *** henrynash has quit IRC | 22:37 | |
| *** r-daneel__ has joined #openstack-keystone | 22:39 | |
| *** cjellick has quit IRC | 22:43 | |
| *** r-daneel__ has quit IRC | 22:44 | |
| *** morgan_remote_ has joined #openstack-keystone | 22:44 | |
| morgan_remote_ | Ayoung: I'll look over that lac change when I'm back from food / coffee | 22:44 |
| ayoung | morgan_remote_, thanks | 22:44 |
| morgan_remote_ | S/iac/ksc | 22:44 |
| ayoung | morgan_remote_, its pretty straight forward: it deals with the case where there is no service catalog, since the user has no default project, and did not request a project. This is the standard Horizon LDAP login case | 22:45 |
| morgan_remote_ | I remember the discussion about it and I do like the concept. | 22:45 |
| *** cjellick has joined #openstack-keystone | 22:50 | |
| *** r1chardj0n3s has joined #openstack-keystone | 22:52 | |
| *** r-daneel__ has joined #openstack-keystone | 22:56 | |
| *** nkinder has joined #openstack-keystone | 23:01 | |
| *** marcoemorais has quit IRC | 23:05 | |
| *** marcoemorais has joined #openstack-keystone | 23:05 | |
| *** dims has quit IRC | 23:06 | |
| *** dims has joined #openstack-keystone | 23:06 | |
| *** marcoemorais has quit IRC | 23:08 | |
| *** marcoemorais has joined #openstack-keystone | 23:08 | |
| *** marcoemorais has quit IRC | 23:08 | |
| *** marcoemorais has joined #openstack-keystone | 23:09 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 23:09 | |
| *** dims has quit IRC | 23:11 | |
| *** richm has quit IRC | 23:13 | |
| *** cjellick_ has joined #openstack-keystone | 23:16 | |
| *** cjellick has quit IRC | 23:18 | |
| *** diegows has quit IRC | 23:19 | |
| *** achampion has joined #openstack-keystone | 23:21 | |
| *** ayoung has quit IRC | 23:21 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:22 | |
| *** gordc has quit IRC | 23:26 | |
| *** Tahmina has quit IRC | 23:31 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 23:32 | |
| *** henrynash has joined #openstack-keystone | 23:34 | |
| *** henrynash has quit IRC | 23:35 | |
| *** marcoemorais has quit IRC | 23:36 | |
| *** marcoemorais has joined #openstack-keystone | 23:36 | |
| *** amerine_ has quit IRC | 23:37 | |
| *** amerine has joined #openstack-keystone | 23:38 | |
| *** Guest72739 is now known as mgagne | 23:42 | |
| *** mgagne has joined #openstack-keystone | 23:42 | |
| *** diegows has joined #openstack-keystone | 23:45 | |
| *** ekarlso has quit IRC | 23:48 | |
| *** ekarlso has joined #openstack-keystone | 23:48 | |
| *** rodrigods_ has joined #openstack-keystone | 23:50 | |
| *** cjellick_ has quit IRC | 23:50 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!