| raildo | stevemar: that a lot of patches, I'll will need more time to see the whole implementation, but its a great feature :D | 00:03 |
|---|---|---|
| *** zzzeek has joined #openstack-keystone | 00:05 | |
| *** EmilienM is now known as EmilienM|afk | 00:11 | |
| *** markvoelker has quit IRC | 00:12 | |
| *** markvoelker has joined #openstack-keystone | 00:12 | |
| *** rm_work is now known as rm_work|away | 00:16 | |
| *** markvoelker has quit IRC | 00:17 | |
| *** ncoghlan has joined #openstack-keystone | 00:21 | |
| openstackgerrit | guang-yee proposed openstack/keystonemiddleware: Make v3 auth work for Swift https://review.openstack.org/152283 | 00:25 |
| *** dims has joined #openstack-keystone | 00:27 | |
| gyee | jamielennox, ^^^ | 00:27 |
| *** carlosmarin has quit IRC | 00:30 | |
| david-lyle | gyee: before I destroy all of django_openstack_auth, I'm correct in believing we support users with only domain role assignments and no project role assignments? | 00:32 |
| david-lyle | that is users that are members only of a domain and not a project | 00:32 |
| david-lyle | morganfainberg: ^^^ ? | 00:34 |
| gyee | that's correct | 00:35 |
| gyee | users are a memeber of a domain, they access to a project via role assignment | 00:35 |
| david-lyle | that's what I would hope, but also what I was afraid of | 00:35 |
| david-lyle | few assumptions in the code to rework | 00:35 |
| david-lyle | and by few, I mean a heaping pile | 00:36 |
| david-lyle | thanks for the sanity check, gyee | 00:36 |
| gyee | you can assign role to user for a project or domain, part of V3 api | 00:36 |
| david-lyle | right, that's what I though | 00:36 |
| david-lyle | *thought | 00:37 |
| david-lyle | but before I went and did open heart surgery I wanted to verify | 00:37 |
| gyee | hahaha | 00:37 |
| morganfainberg | david-lyle, what gyee said | 00:37 |
| david-lyle | guess i picked the wrong week to stop sniffing glue | 00:38 |
| david-lyle | alright, back at it. Thanks! | 00:38 |
| gyee | dude, you in Colorado, the shit's legal there | 00:38 |
| *** Ephur has quit IRC | 00:39 | |
| david-lyle | indeed, time to find a dispensary | 00:39 |
| *** chipmanc has joined #openstack-keystone | 00:41 | |
| morganfainberg | hah | 00:41 |
| *** Ephur has joined #openstack-keystone | 00:42 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Consistently use oslo_config.cfg.CONF https://review.openstack.org/147367 | 00:43 |
| *** oomichi has joined #openstack-keystone | 00:49 | |
| *** Ephur has quit IRC | 00:50 | |
| *** sumanth1991 has joined #openstack-keystone | 00:50 | |
| *** tsufiev is now known as tsufiev_ | 00:51 | |
| *** raildo has quit IRC | 00:52 | |
| *** markvoelker has joined #openstack-keystone | 00:52 | |
| *** nellysmitt has joined #openstack-keystone | 00:55 | |
| *** nellysmitt has quit IRC | 01:00 | |
| *** markvoelker has quit IRC | 01:00 | |
| *** xxj has quit IRC | 01:00 | |
| *** junhongl__ has quit IRC | 01:00 | |
| *** wpf1 has quit IRC | 01:00 | |
| *** xxj has joined #openstack-keystone | 01:01 | |
| gyee | morganfainberg, https://review.openstack.org/#/c/150134/ | 01:05 |
| gyee | can you please address bknudson's concern? | 01:05 |
| gyee | it's not a security patch, it will improve mankind | 01:06 |
| morganfainberg | we *can* submit code that is outside of the official support cycle | 01:07 |
| morganfainberg | bug. | 01:07 |
| morganfainberg | but* | 01:07 |
| morganfainberg | it would be better if we didn't | 01:07 |
| morganfainberg | this is not a security fix. i'm tending to agree with bknudson here. feel free to ask dolphm and other stable-maint types | 01:08 |
| *** serverascode has quit IRC | 01:08 | |
| morganfainberg | without icehouse receiving extended support [afaik that isn't happening or hasn't be decided] | 01:08 |
| morganfainberg | we shouldn't backport it | 01:08 |
| gyee | meh, I like to improve mankind | 01:08 |
| *** jraim has quit IRC | 01:09 | |
| bknudson | I'm not sure I agree with the stable maint rules but don't hate the player hate the game. | 01:09 |
| *** ctracey has quit IRC | 01:09 | |
| morganfainberg | bknudson, there was a wierd discussion on it at one point | 01:09 |
| gyee | ainners gonna ain't | 01:09 |
| bknudson | we should go off and make our own branch | 01:09 |
| tqtran | stevemar: ping, im ready for the setup if you have some time to spare | 01:09 |
| morganfainberg | so, just bug the stable-maint folks | 01:10 |
| morganfainberg | they may say "yes!!" | 01:10 |
| *** zhiyan has quit IRC | 01:10 | |
| bknudson | I don't know if there's a process for requesting an exception? | 01:10 |
| gyee | to me, support policy are for CYA | 01:11 |
| morganfainberg | bknudson, i *think* it's ask the PTL and stable-maint | 01:11 |
| gyee | open source, everybody wins :) | 01:11 |
| morganfainberg | and i say, ask stable maint so we have clarity on the policy | 01:11 |
| morganfainberg | there was a convo that seemed to counter-indicate that policy at some point | 01:11 |
| *** briancurtin has quit IRC | 01:11 | |
| bknudson | we really have very few bugs marked as critical... | 01:11 |
| bknudson | it would have to be gate-breaking. | 01:11 |
| morganfainberg | bknudson, i'm so very happy that is the case | 01:11 |
| morganfainberg | bknudson, you know that right? | 01:11 |
| morganfainberg | so very very very happy | 01:12 |
| bknudson | well, it means that essentially nothing is going to be backported after 6 months. | 01:12 |
| bknudson | other than a change to requirements or something... if we had a gate-breaking problem in icehouse that would be odd. | 01:12 |
| gyee | forget backport, I'll do it for a nominal charge | 01:13 |
| *** jraim has joined #openstack-keystone | 01:14 | |
| bknudson | so maybe "critical" in stable branch policy doesn't mean the bug priority | 01:14 |
| *** serverascode has joined #openstack-keystone | 01:15 | |
| gyee | but seriously, only braveheart runs main branch in product | 01:16 |
| gyee | so we don't fix anything after 6 months, we won't fix anything | 01:17 |
| *** wpf1 has joined #openstack-keystone | 01:17 | |
| wanghong | morganfainberg, I want to work on this bp: https://blueprints.launchpad.net/keystone/+spec/model-timestamps, could I? | 01:17 |
| *** junhongl__ has joined #openstack-keystone | 01:17 | |
| *** briancurtin has joined #openstack-keystone | 01:18 | |
| morganfainberg | wanghong, i think this is probably quick and easy to get lined up. - mostly because oslo.db gives us it for freee | 01:18 |
| morganfainberg | wanghong, please do! :) | 01:19 |
| wanghong | morganfainberg, and another thing. This review, https://review.openstack.org/#/c/130180/, what do you think about the last comment from David Stanek | 01:19 |
| morganfainberg | wanghong, some of it may already be done. | 01:19 |
| * morganfainberg looks | 01:19 | |
| morganfainberg | i'd like to remove it. | 01:19 |
| morganfainberg | this may be a case where we merge it, backport the fix to juno then remove the driver | 01:19 |
| morganfainberg | in fact... that is probably the right answer. | 01:20 |
| *** ctracey has joined #openstack-keystone | 01:20 | |
| *** zhiyan has joined #openstack-keystone | 01:21 | |
| *** zzzeek has quit IRC | 01:21 | |
| morganfainberg | wanghong, approved. with comment to the effect of this is to be merged backported and removed as we do cleanup in kilo | 01:21 |
| wanghong | morganfainberg, I think we don't remove it in this develop circle, right? | 01:21 |
| morganfainberg | wanghong, likely not | 01:22 |
| stevemar | morganfainberg, should wanghong create a spec for the timestamp work? | 01:22 |
| morganfainberg | wanghong, well perhaps. to be seen | 01:22 |
| wanghong | morganfainberg, OK | 01:22 |
| morganfainberg | stevemar, so i marked it as not needing a spec before. | 01:22 |
| wanghong | thanks | 01:22 |
| bknudson | if the api is changing we'll need a spec. | 01:22 |
| morganfainberg | stevemar, do you see a benefit to adding a spec for it? | 01:22 |
| wanghong | morganfainberg, I think it's better to create a spec | 01:22 |
| morganfainberg | i assume it would be backend-only not API impacting | 01:22 |
| morganfainberg | wanghong, please do then. | 01:22 |
| morganfainberg | wanghong, especially if impacting the API | 01:23 |
| stevemar | yeah, couldn't hurt | 01:23 |
| stevemar | i assume it will change the return value of certain API calls? | 01:23 |
| bknudson | wouldn't be able to or even really want to do it in ldap. | 01:23 |
| morganfainberg | bknudson, LDAP assignment is going away | 01:23 |
| morganfainberg | bknudson, ;) | 01:23 |
| wanghong | morganfainberg, stevemar, I think we should implement filters in this bp | 01:23 |
| morganfainberg | for users - yeah | 01:23 |
| bknudson | the spec was about users and groups, too. | 01:23 |
| morganfainberg | i don't think this goes to the wire | 01:24 |
| bknudson | personally I don't see much use in continuing to enhance the SQL identity backend. | 01:24 |
| morganfainberg | this is internal-data only | 01:24 |
| bknudson | we should move it off into a separate repo and deprecate it in keystone. | 01:24 |
| morganfainberg | bknudson, yes. we should | 01:24 |
| morganfainberg | bknudson, i want to propose that for next cycle for sure | 01:24 |
| bknudson | if I get some time I'll work on it... or someone else could. | 01:24 |
| morganfainberg | wanghong, can we narrow the scope to just SQL assignment ? | 01:25 |
| bknudson | shouldn't be too difficult since there's not much in identity anymore. | 01:25 |
| wanghong | morganfainberg, yes, I think too. | 01:25 |
| morganfainberg | wanghong, great! | 01:25 |
| wanghong | morganfainberg, do you mean that I just add timestamps for assignment? | 01:26 |
| *** _cjones_ has quit IRC | 01:26 | |
| morganfainberg | wanghong, yeah. don't worry about users/groups | 01:26 |
| *** _cjones_ has joined #openstack-keystone | 01:26 | |
| wanghong | morganfainberg, OK, I will create a spec. | 01:27 |
| morganfainberg | but changing the behavior to not nuke projects out of the DB might be a very good approach | 01:27 |
| morganfainberg | do the nova thing w/ the soft-delete flag | 01:27 |
| morganfainberg | better for auditability and resolving cleanup for orphaned objects in other servers | 01:27 |
| bknudson | I think nova is going away from soft-delete. | 01:30 |
| bknudson | we already have cadf for audit. | 01:31 |
| *** _cjones_ has quit IRC | 01:31 | |
| morganfainberg | bknudson, are they? | 01:31 |
| morganfainberg | hm | 01:31 |
| bknudson | morganfainberg: that's my understanding... there have been lots of complaints about it (similar to the complaints we get for having to clear the token table) | 01:32 |
| morganfainberg | ok so just the created_at/updated_at coliumns then | 01:32 |
| morganfainberg | wanghong, ^^ | 01:35 |
| wanghong | morganfainberg, Yes sir:) | 01:35 |
| * wanghong going to do reviews. | 01:37 | |
| *** gyee has quit IRC | 01:45 | |
| *** diegows has quit IRC | 01:47 | |
| *** dims has quit IRC | 01:48 | |
| stevemar | morganfainberg, bknudson i'd appreciate some eyes on the notification work :) | 01:49 |
| *** markvoelker has joined #openstack-keystone | 01:56 | |
| *** dims has joined #openstack-keystone | 01:58 | |
| bknudson | stevemar: review other changes then... it'll eventually get to the top of my list. | 01:59 |
| *** markvoelker has quit IRC | 02:01 | |
| *** tqtran has quit IRC | 02:11 | |
| lhcheng | jamielennox: when is the next keystoneclient release? | 02:13 |
| *** erkules_ has joined #openstack-keystone | 02:14 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 02:14 |
| lhcheng | jamielennox: our test are failing, would like to pickup your fix :) this one: https://review.openstack.org/#/c/145981/ | 02:14 |
| *** dims has quit IRC | 02:15 | |
| morganfainberg | lhcheng targeted for monday | 02:15 |
| lhcheng | morganfainberg: cool, thanks! | 02:15 |
| morganfainberg | lhcheng, we're waiting till post K2 to avoid breakign the gate unintentionally | 02:15 |
| morganfainberg | lhcheng, but otherwise it'd be today ;) | 02:15 |
| *** dims has joined #openstack-keystone | 02:15 | |
| *** erkules has quit IRC | 02:16 | |
| lhcheng | morganfainberg: sounds good, yeah I prefer also to do it after K2 :) | 02:16 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add context to manager classes that send notifications https://review.openstack.org/151866 | 02:20 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP - Add CADF notifications for trusts https://review.openstack.org/151867 | 02:23 |
| *** spandhe has quit IRC | 02:43 | |
| *** sumanth1991 has quit IRC | 02:44 | |
| jamielennox | ayoung: still here? | 02:55 |
| ayoung | Nope | 02:55 |
| ayoung | Damn | 02:55 |
| ayoung | Yep | 02:55 |
| *** nellysmitt has joined #openstack-keystone | 02:56 | |
| *** rushiagr_away is now known as rushiagr | 02:57 | |
| *** markvoelker has joined #openstack-keystone | 02:57 | |
| ayoung | jamielennox, what's up? | 02:58 |
| jamielennox | ayoung: still s4u2 - had to duck out for a bit | 02:58 |
| jamielennox | trying to follow: http://adam.younglogic.com/2014/05/s4u2proxy-horizon/ | 02:59 |
| jamielennox | i also set up a sample phpinfo script that is under the same kerberos enforcement as horizon so i can look at the env headers | 02:59 |
| jamielennox | turning on constraineddelegation seems to have done nothing noticable | 02:59 |
| jamielennox | ayoung: i assume that ldap constrained delegation that is mentioned is set up somewhere else? because it's not registered on my server | 03:00 |
| ayoung | I had to set it up following Alexander's blog post | 03:00 |
| *** nellysmitt has quit IRC | 03:01 | |
| jamielennox | http://www.freeipa.org/page/Howto/Setting_up_S4U2Proxy_with_FreeIPA | 03:02 |
| jamielennox | :( | 03:02 |
| ayoung | jamielennox, its is one of the reasons why I thought we were going to punt on it | 03:02 |
| ayoung | but getting it set up is not really that bad | 03:02 |
| *** markvoelker has quit IRC | 03:02 | |
| ayoung | I'm just not comfortable with the "complete impersonation" type of proxy it performs | 03:03 |
| jamielennox | ayoung: i'm guessing if i just followed the steps it would work - i was just hoping to understand it | 03:03 |
| ayoung | read ab's post. It is pretty informatice | 03:03 |
| ayoung | tive | 03:03 |
| jamielennox | ayoung: i was under the impression we really don't have any choice here | 03:03 |
| ayoung | well, the SAML approach is flawed too, just in different ways | 03:04 |
| ayoung | it all sucks at some point | 03:04 |
| ayoung | but I thought that was what we were going for | 03:04 |
| *** chipmanc has quit IRC | 03:04 | |
| ayoung | use Kerberos to get a SAML assertion and hand that to Keystone is, I think, a little better. But S4U2 approach will work for current IPA users, and there is a comparable AD set up | 03:05 |
| jamielennox | i'm just trying to get the next step through the DOA plugins patch | 03:05 |
| ayoung | yeah. | 03:05 |
| ayoung | I wrote a simple wsgi server to confirm that S4U2 worked. It just requestsed a token and dumped it to the response | 03:05 |
| jamielennox | i expect that to be better longer term, but i haven't even tried to look at ipsilom yet | 03:06 |
| ayoung | yeah. | 03:06 |
| ayoung | so...all of this is wrong wrong wrong. SAML is just another bearer token, and really what we should be doing is having the user authenticate directly with the services. | 03:07 |
| ayoung | it was why I was all over CORS back around the time of the summit | 03:07 |
| jamielennox | the straight kerberos vs ipsilom kerb for saml is going to be a big difference in workflow | 03:07 |
| ayoung | the user should be authenticating directly to the thing he needs to do work for him | 03:07 |
| jamielennox | as in the ksc-kerberos plugin won't handle that | 03:07 |
| jamielennox | and so it seems stupid to try and make DOA work with it if ipsilom is the long term plan | 03:08 |
| ayoung | ipsilon has other hurdles to clear | 03:08 |
| jamielennox | (not speaking for RH, just keystone) | 03:08 |
| ayoung | differnt use cases I think | 03:08 |
| ayoung | for the in house cloud, I think S4U2 is probably the right way to go | 03:08 |
| *** chipmanc has joined #openstack-keystone | 03:09 | |
| ayoung | I mean, the horizon server really can only get a ticket for Keystone, so its not horrible | 03:09 |
| ayoung | there are other issues, but I am willing to turn a blind eye to them today | 03:09 |
| jamielennox | if we make horizon accept an existing token as auth - which it's supposed to have to do for federation anyway | 03:10 |
| ayoung | this is one of those topics where "all the alternatives suck" and makes me want to turn to alcohol | 03:10 |
| ayoung | Need to go to do more snow removal. Back in a few minutes. | 03:11 |
| *** ayoung is now known as ayoung-snowjob | 03:11 | |
| jamielennox | i was going to say that handles negotiation directly and then redirects to horizon - but we've discussed that and it's still got mostly the same limitation | 03:12 |
| *** rushiagr is now known as rushiagr_away | 03:13 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve creation of expected assignments in tests https://review.openstack.org/144544 | 03:19 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Refactor check of targets and actors on RoleV3 https://review.openstack.org/144702 | 03:19 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Check for invalid filtering on v3/role_assignments https://review.openstack.org/144703 | 03:20 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignment Tests https://review.openstack.org/137021 | 03:20 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 03:20 |
| *** samueldmq has quit IRC | 03:26 | |
| *** tellesnobrega_ has joined #openstack-keystone | 03:31 | |
| *** markvoelker has joined #openstack-keystone | 03:33 | |
| *** lhcheng has quit IRC | 03:39 | |
| *** jbonjean has quit IRC | 03:45 | |
| openstackgerrit | Merged openstack/keystone: fix the wrong update logic of catalog kvs driver https://review.openstack.org/130180 | 03:46 |
| *** jbonjean has joined #openstack-keystone | 03:46 | |
| *** davechen_ has joined #openstack-keystone | 03:48 | |
| *** davechen_ has quit IRC | 03:53 | |
| *** rushiagr_away is now known as rushiagr | 03:53 | |
| *** ayoung-snowjob is now known as ayoung | 03:56 | |
| *** richm has quit IRC | 03:59 | |
| *** cchipman has joined #openstack-keystone | 04:00 | |
| *** chipmanc has quit IRC | 04:01 | |
| ayoung | Gah..just realized I really don't want a "token" object in the access info. a token is a pointer to an access info. | 04:06 |
| * ayoung throws up hands and heads to bed | 04:06 | |
| *** ayoung is now known as ayoung-gnight | 04:06 | |
| *** harlowja has quit IRC | 04:08 | |
| *** dims has quit IRC | 04:13 | |
| *** _cjones_ has joined #openstack-keystone | 04:28 | |
| *** lhcheng has joined #openstack-keystone | 04:30 | |
| *** lhcheng_ has joined #openstack-keystone | 04:31 | |
| *** _cjones_ has quit IRC | 04:34 | |
| *** lhcheng has quit IRC | 04:34 | |
| *** cchipman has quit IRC | 04:41 | |
| *** nellysmitt has joined #openstack-keystone | 04:57 | |
| *** nellysmitt has quit IRC | 05:02 | |
| *** ajayaa has joined #openstack-keystone | 05:12 | |
| *** MasterPiece has joined #openstack-keystone | 05:18 | |
| *** dougwig has quit IRC | 05:38 | |
| *** dougwig has joined #openstack-keystone | 05:38 | |
| *** sumanth1991 has joined #openstack-keystone | 05:45 | |
| *** sumanth1991 has quit IRC | 05:47 | |
| *** rwsu is now known as rwsu-afk | 05:51 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/151856 | 06:04 |
| *** oomichi has quit IRC | 06:09 | |
| *** jaosorior has joined #openstack-keystone | 06:09 | |
| *** MasterPiece has quit IRC | 06:11 | |
| stevemar | yay for websso tests | 06:19 |
| *** abhirc_ has quit IRC | 06:25 | |
| *** abhirc has joined #openstack-keystone | 06:26 | |
| *** rushiagr is now known as rushiagr_away | 06:32 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add WebSSO support for federation https://review.openstack.org/136177 | 06:44 |
| morganfainberg | stevemar, just pushed through a bunch of work for the k2 milestone | 06:45 |
| stevemar | morganfainberg, i saw that | 06:45 |
| morganfainberg | stevemar, also https://review.openstack.org/#/c/152337/4/specs/no-downward-sql-migration.rst | 06:45 |
| morganfainberg | :) | 06:45 |
| stevemar | i always wondered wtf was downgrading | 06:46 |
| *** avozza is now known as zz_avozza | 06:52 | |
| openstackgerrit | Merged openstack/keystone-specs: Address federated domain comments from 149071 https://review.openstack.org/152281 | 06:52 |
| morganfainberg | stevemar, so i have a request from -infra [hard core users of keystone and openstack] | 06:56 |
| morganfainberg | make it possible to know for a user what information is valid to authenticate with | 06:56 |
| morganfainberg | e.g. "password", "x509", etcx | 06:56 |
| morganfainberg | it relates to the work RAX has been working on for MFA | 06:56 |
| morganfainberg | but it's only a subset. | 06:57 |
| stevemar | morganfainberg, yeah i caught some of that earlier in the day | 06:57 |
| morganfainberg | they initially were thinking it's be global, i think that is incorrect and should be global or-user-by-user/group-by-group | 06:57 |
| morganfainberg | thoughts? | 06:57 |
| stevemar | clark is concerned that we chicken and egged ourself | 06:57 |
| morganfainberg | but the idea seems sount | 06:57 |
| morganfainberg | sound* | 06:57 |
| stevemar | their claims are not unsubstantiated | 06:57 |
| morganfainberg | eh. kindof. i mean we didn't really | 06:57 |
| morganfainberg | because you are told what to auth with when you get your account | 06:58 |
| morganfainberg | when we support various types of auth (real auth, not just "you could use X") | 06:58 |
| morganfainberg | then it becomes more chicken-egg (not to be confused with hand-egg) | 06:58 |
| stevemar | i immediately thought that a URL that says the supported auth types is really nice | 06:58 |
| *** nellysmitt has joined #openstack-keystone | 06:58 | |
| morganfainberg | so we should know 2 things: 1) what auth-types does the cloud support | 06:58 |
| stevemar | why do you say user-by-user or group-by-group | 06:59 |
| morganfainberg | this should be totally discoverable | 06:59 |
| morganfainberg | think the SP model | 06:59 |
| morganfainberg | my support team must login with X restrictions (aka x509) | 06:59 |
| morganfainberg | but i don't require all my customers to do so | 06:59 |
| morganfainberg | in many cases it'll be toggled globally. | 06:59 |
| morganfainberg | however we can't ignore SP-type models | 06:59 |
| morganfainberg | omg look at the keystone team: http://status.openstack.org/zuul/ consuming all the gate pipeline at the moment... | 07:00 |
| morganfainberg | WHO DO THEY THINK THEY ARE!? | 07:00 |
| stevemar | morganfainberg, those handsome devils | 07:01 |
| stevemar | maybe i'm not seeing the difference between the SP-types and the global auths, when would they be different? wouldn't one always be a super set of the other | 07:01 |
| morganfainberg | the difference is what happens when i try and login | 07:02 |
| morganfainberg | i try and login with support user | 07:02 |
| stevemar | also, i did that thing you voluntold me for: https://review.openstack.org/#/c/152018/ :) | 07:02 |
| morganfainberg | but i use a password/and username | 07:02 |
| stevemar | morganfainberg, hmm, i can see how that is confusing | 07:02 |
| morganfainberg | i'm not a customer so - i need to be told "NO go use XXX auth" or "only supporting XXX auth" or even "xxx auth is not allowed for user x" | 07:02 |
| morganfainberg | depending on security concerns | 07:02 |
| * morganfainberg isn't concerned with the data returned this early in the convo | 07:03 | |
| morganfainberg | stevemar, yay nice! | 07:03 |
| *** nellysmitt has quit IRC | 07:03 | |
| *** zz_avozza is now known as avozza | 07:04 | |
| stevemar | morganfainberg, so how do you plan on figuring out what auth mechanisms are valid on a per-user basis? | 07:07 |
| morganfainberg | stevemar, it'd have to be a user-level (or group level?) authentication thing | 07:07 |
| morganfainberg | some kind of administrative toggle | 07:07 |
| stevemar | morganfainberg, we could default it to whatever is in cfg.CONF.auth, but ... | 07:08 |
| morganfainberg | stevemar, that would be my choice, you default and then allow reducing it to a smaller list | 07:09 |
| stevemar | if the admin updated the [auth] section, then those changes have to propagate (or you add to the list) | 07:09 |
| *** avozza is now known as zz_avozza | 07:10 | |
| openstackgerrit | guang-yee proposed openstack/keystonemiddleware: Make v3 auth work for Swift https://review.openstack.org/152283 | 07:14 |
| *** abhirc has quit IRC | 07:18 | |
| *** nkinder has joined #openstack-keystone | 07:22 | |
| *** mzbik has joined #openstack-keystone | 07:23 | |
| openstackgerrit | Merged openstack/keystone: Service Providers API for OS-FEDERATION https://review.openstack.org/104623 | 07:23 |
| openstackgerrit | Merged openstack/keystone: Create K2K SAML assertion from Service Provider https://review.openstack.org/152046 | 07:23 |
| openstackgerrit | Merged openstack/keystone: Drop URL field from region table https://review.openstack.org/150122 | 07:23 |
| openstackgerrit | Merged openstack/keystone: Update federation config to use Service Providers https://review.openstack.org/152260 | 07:28 |
| openstackgerrit | Merged openstack/keystone: add circular check when updating region https://review.openstack.org/130474 | 07:28 |
| openstackgerrit | Merged openstack/keystone: Implements subtree_as_ids query param https://review.openstack.org/148618 | 07:28 |
| openstackgerrit | Merged openstack/keystone: Remove local conf information from paste-ini https://review.openstack.org/134125 | 07:28 |
| stevemar | yay merges!!!!!!!! | 07:29 |
| *** pnavarro has joined #openstack-keystone | 07:33 | |
| Qlawy | 5th of february is comming ;) | 07:41 |
| openstackgerrit | Merged openstack/keystone: Add positive test case for content types https://review.openstack.org/130591 | 07:42 |
| openstackgerrit | Merged openstack/keystone: Refactor role assignment assertions https://review.openstack.org/144543 | 07:42 |
| stevemar | launchpad died | 07:43 |
| stevemar | that means i sleep now | 07:43 |
| *** afazekas has joined #openstack-keystone | 07:52 | |
| *** stevemar has quit IRC | 07:53 | |
| *** chlong has quit IRC | 07:56 | |
| *** erkules_ is now known as erkules | 08:01 | |
| *** ncoghlan has quit IRC | 08:01 | |
| *** lhcheng_ has quit IRC | 08:08 | |
| *** pnavarro has quit IRC | 08:12 | |
| *** zz_avozza is now known as avozza | 08:15 | |
| *** nellysmitt has joined #openstack-keystone | 08:24 | |
| *** wpf1 has quit IRC | 08:25 | |
| *** wpf1 has joined #openstack-keystone | 08:26 | |
| *** MasterPiece has joined #openstack-keystone | 08:28 | |
| *** andreaf has joined #openstack-keystone | 08:33 | |
| morganfainberg | marekd, re: x-service-url | 08:33 |
| morganfainberg | marekd, headers: https://tools.ietf.org/html/rfc6648 | 08:33 |
| morganfainberg | marekd, we might want to rename those before we start relying on them to something that conforms to ^^ | 08:33 |
| marekd | morganfainberg: looking. | 08:33 |
| *** henrynash has joined #openstack-keystone | 08:34 | |
| *** ChanServ sets mode: +v henrynash | 08:34 | |
| marekd | morganfainberg: so, SP-URL and SP-AUTH-URL ? | 08:34 |
| morganfainberg | marekd, well probably OPENSTACK-SP-URL and OPENSTACK-AUTH-URL or KEYSTONE-SP-URL and KEYSTONE-AUTH-URL ? | 08:34 |
| morganfainberg | if i'm reading this correctly | 08:35 |
| marekd | morganfainberg: ok, i will take a closer look at the doc, just managed to see 'dropping X- preffix in HTTP headers' | 08:35 |
| marekd | actually, I will re-think if we can avoid it. | 08:35 |
| morganfainberg | marekd, to adhere to that doc, it would be a rename not a drop the headers | 08:36 |
| morganfainberg | and i'm fine with the headers (it merged ;) | 08:36 |
| marekd | as my understading is you prefer to have as little headers as possible. | 08:36 |
| morganfainberg | we do | 08:36 |
| morganfainberg | if we can avoid it great, but this is a case where it feels like the right kind of break that convention | 08:36 |
| marekd | morganfainberg: the whole k2k seems to be openstacky (not super general) in the end, so maybe we can rely on service catalog. Let me go through this today again. | 08:38 |
| morganfainberg | marekd, ++ | 08:39 |
| * morganfainberg goes to bed. | 08:39 | |
| marekd | morganfainberg: in fact, maybe we could store SP-URL, SP-AUTH-URL when reading data from service catalog. | 08:39 |
| marekd | morganfainberg: yep, it's after midnight in SoCal, right? | 08:39 |
| morganfainberg | almost 1 | 08:40 |
| *** bjornar has joined #openstack-keystone | 08:42 | |
| marekd | so, good night | 08:42 |
| *** henrynash has quit IRC | 08:46 | |
| *** henrynash has joined #openstack-keystone | 08:49 | |
| *** ChanServ sets mode: +v henrynash | 08:49 | |
| *** spandhe has joined #openstack-keystone | 08:50 | |
| *** henrynash has quit IRC | 08:51 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/keystone: Use dict comprehensions instead of dict constructor https://review.openstack.org/143842 | 08:57 |
| *** jistr has joined #openstack-keystone | 08:58 | |
| *** spandhe has quit IRC | 09:03 | |
| *** spandhe has joined #openstack-keystone | 09:03 | |
| *** _tziOm has joined #openstack-keystone | 09:05 | |
| *** _tziOm has quit IRC | 09:05 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/151856 | 09:08 |
| *** spandhe has quit IRC | 09:09 | |
| *** junhongl__ is now known as junhongl | 09:18 | |
| *** krykowski has joined #openstack-keystone | 09:26 | |
| *** henrynash has joined #openstack-keystone | 09:29 | |
| *** ChanServ sets mode: +v henrynash | 09:29 | |
| openstackgerrit | wanghong proposed openstack/keystone: fix another normal user can get other user's ec2 credential https://review.openstack.org/152444 | 09:48 |
| *** krykowski has quit IRC | 09:48 | |
| *** MasterPiece has quit IRC | 09:49 | |
| *** henrynash has quit IRC | 10:05 | |
| *** krykowski has joined #openstack-keystone | 10:16 | |
| *** MasterPiece has joined #openstack-keystone | 10:30 | |
| *** samueldmq-away is now known as samueldmq | 10:31 | |
| *** MasterPiece has quit IRC | 10:43 | |
| *** nellysmitt has quit IRC | 10:50 | |
| *** krykowski has quit IRC | 10:50 | |
| *** aix has joined #openstack-keystone | 10:51 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve creation of expected assignments in tests https://review.openstack.org/144544 | 10:56 |
| *** MasterPiece has joined #openstack-keystone | 10:56 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Refactor check of targets and actors on RoleV3 https://review.openstack.org/144702 | 10:57 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Check for invalid filtering on v3/role_assignments https://review.openstack.org/144703 | 10:58 |
| *** krykowski has joined #openstack-keystone | 10:58 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignment Tests https://review.openstack.org/137021 | 10:59 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 11:00 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve creation of expected assignments in tests https://review.openstack.org/144544 | 11:06 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Refactor check of targets and actors on RoleV3 https://review.openstack.org/144702 | 11:06 |
| *** krykowski has quit IRC | 11:06 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Check for invalid filtering on v3/role_assignments https://review.openstack.org/144703 | 11:07 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignment Tests https://review.openstack.org/137021 | 11:14 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 11:15 |
| *** jistr has quit IRC | 11:21 | |
| *** aix has quit IRC | 11:27 | |
| openstackgerrit | wanghong proposed openstack/keystone: fix normal user can delete other user's ec2 credential https://review.openstack.org/152477 | 11:27 |
| *** jistr has joined #openstack-keystone | 11:27 | |
| *** aix has joined #openstack-keystone | 11:28 | |
| *** amakarov_away is now known as amakarov | 11:33 | |
| samueldmq | dolphm, I'm writing a spec for HMT on horizon... I'll use a few sentences from http://dolphm.com/hierarchical-multitenancy/ as motivation, ok? | 11:35 |
| *** diegows has joined #openstack-keystone | 11:44 | |
| *** pnavarro has joined #openstack-keystone | 11:44 | |
| *** pnavarro has quit IRC | 11:45 | |
| *** pnavarro has joined #openstack-keystone | 11:45 | |
| *** pnavarro has quit IRC | 11:49 | |
| *** pnavarro has joined #openstack-keystone | 11:49 | |
| *** pnavarro has quit IRC | 11:58 | |
| *** chlong has joined #openstack-keystone | 12:06 | |
| samueldmq | amakarov, thanks for your comment on review #144702, just replied | 12:06 |
| *** EmilienM|afk is now known as EmilienM | 12:08 | |
| *** avozza is now known as zz_avozza | 12:15 | |
| amakarov | samueldmq, please use six.iteritems - in it will save us a bug in py3 :) | 12:17 |
| amakarov | s/in// | 12:17 |
| samueldmq | amakarov, six.iteritems(kwargs) works as well, will use it thanks | 12:20 |
| *** boris-42 has quit IRC | 12:22 | |
| *** boris-42 has joined #openstack-keystone | 12:22 | |
| *** aix has quit IRC | 12:24 | |
| *** mflobo has quit IRC | 12:26 | |
| *** mflobo has joined #openstack-keystone | 12:29 | |
| *** mflobo has quit IRC | 12:29 | |
| *** mflobo has joined #openstack-keystone | 12:29 | |
| *** MasterPiece has quit IRC | 12:31 | |
| *** tellesnobrega__ has joined #openstack-keystone | 12:31 | |
| *** tellesnobrega_ has quit IRC | 12:32 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 12:36 |
| *** aix has joined #openstack-keystone | 12:37 | |
| *** zz_avozza is now known as avozza | 12:39 | |
| *** markvoelker has quit IRC | 12:45 | |
| *** markvoelker has joined #openstack-keystone | 12:46 | |
| *** markvoelker has quit IRC | 12:50 | |
| *** diegows has quit IRC | 12:50 | |
| *** josecastroleon__ has quit IRC | 12:52 | |
| *** Qlawy_ has joined #openstack-keystone | 12:53 | |
| *** alex_xu_ has joined #openstack-keystone | 12:53 | |
| *** Qlawy has quit IRC | 12:54 | |
| *** Qlawy_ is now known as Qlawy | 12:54 | |
| *** Qlawy has quit IRC | 12:55 | |
| *** Qlawy has joined #openstack-keystone | 12:55 | |
| *** markvoelker has joined #openstack-keystone | 12:56 | |
| *** g4rg4m3|_ has joined #openstack-keystone | 12:57 | |
| *** jasondotstar has quit IRC | 12:57 | |
| *** alex_xu has quit IRC | 12:57 | |
| *** wanghong has quit IRC | 12:57 | |
| *** htruta has quit IRC | 12:57 | |
| *** htruta has joined #openstack-keystone | 12:57 | |
| *** wanghong has joined #openstack-keystone | 12:58 | |
| *** diegows has joined #openstack-keystone | 13:08 | |
| *** avozza is now known as zz_avozza | 13:14 | |
| *** gtt116__ has joined #openstack-keystone | 13:20 | |
| *** gtt116_ has quit IRC | 13:23 | |
| *** jasondotstar has joined #openstack-keystone | 13:28 | |
| *** gtt116_ has joined #openstack-keystone | 13:31 | |
| *** gtt116__ has quit IRC | 13:35 | |
| *** bknudson has quit IRC | 13:38 | |
| *** gordc has joined #openstack-keystone | 13:39 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Refactor check of targets and actors on RoleV3 https://review.openstack.org/144702 | 13:40 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Check for invalid filtering on v3/role_assignments https://review.openstack.org/144703 | 13:40 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignment Tests https://review.openstack.org/137021 | 13:40 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 13:41 |
| samueldmq | amakarov, ^addressed | 13:44 |
| *** wanghong has quit IRC | 13:45 | |
| *** wanghong has joined #openstack-keystone | 13:46 | |
| *** raildo_away is now known as raildo | 13:50 | |
| *** obutenko has quit IRC | 13:57 | |
| *** raildo has quit IRC | 14:01 | |
| *** htruta has quit IRC | 14:01 | |
| *** tellesnobrega has quit IRC | 14:01 | |
| *** samueldmq has quit IRC | 14:01 | |
| *** bknudson has joined #openstack-keystone | 14:02 | |
| *** ChanServ sets mode: +v bknudson | 14:02 | |
| *** zz_avozza is now known as avozza | 14:03 | |
| *** ajayaa has quit IRC | 14:04 | |
| *** avozza is now known as zz_avozza | 14:05 | |
| *** jasondotstar has quit IRC | 14:08 | |
| *** mzbik has quit IRC | 14:15 | |
| *** markvoelker has quit IRC | 14:16 | |
| *** josecastroleon has joined #openstack-keystone | 14:16 | |
| *** markvoelker has joined #openstack-keystone | 14:16 | |
| *** samueldmq has joined #openstack-keystone | 14:18 | |
| *** jasondotstar has joined #openstack-keystone | 14:20 | |
| *** markvoelker has quit IRC | 14:21 | |
| *** timcline has joined #openstack-keystone | 14:26 | |
| *** richm has joined #openstack-keystone | 14:28 | |
| *** boris-42 has quit IRC | 14:32 | |
| *** dims has joined #openstack-keystone | 14:36 | |
| *** obutenko has joined #openstack-keystone | 14:38 | |
| *** afazekas has quit IRC | 14:45 | |
| *** rushiagr_away is now known as rushiagr | 14:49 | |
| *** zz_avozza is now known as avozza | 14:50 | |
| *** abhirc has joined #openstack-keystone | 14:54 | |
| *** mattfarina has joined #openstack-keystone | 14:55 | |
| breton | dstanek started a patch-hunt on sample config changes | 14:58 |
| *** mattfarina has quit IRC | 14:58 | |
| dstanek | breton: i created and little script that is searching for them :-) | 14:58 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move eventlet server options to a config section https://review.openstack.org/130962 | 15:00 |
| *** markvoelker has joined #openstack-keystone | 15:01 | |
| *** mattfarina has joined #openstack-keystone | 15:01 | |
| *** ajayaa has joined #openstack-keystone | 15:02 | |
| openstackgerrit | Andrey Pavlov proposed openstack/keystone: Handle SSL termination proxies for version list https://review.openstack.org/132235 | 15:02 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Regenerate sample config file https://review.openstack.org/152563 | 15:05 |
| *** krykowski has joined #openstack-keystone | 15:05 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Regenerate sample config file https://review.openstack.org/152563 | 15:05 |
| bknudson | https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+file:etc/keystone.conf.sample,n,z | 15:08 |
| bknudson | gerrit can query on file names. | 15:08 |
| dstanek | bknudson: exactly | 15:08 |
| dstanek | i'm actually doing something more like https://review.openstack.org/changes/?q=status:open+project:openstack/keystone+branch:master+file:etc/keystone.conf.sample | 15:10 |
| *** rm_work|away is now known as rm_work | 15:10 | |
| *** mattfarina has quit IRC | 15:11 | |
| *** carlosmarin has joined #openstack-keystone | 15:12 | |
| *** topol has joined #openstack-keystone | 15:12 | |
| *** ChanServ sets mode: +v topol | 15:12 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: LDAP additional attribute mappings description https://review.openstack.org/118590 | 15:14 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: LDAP additional attribute mappings description https://review.openstack.org/118590 | 15:15 |
| *** dims has quit IRC | 15:15 | |
| *** dims has joined #openstack-keystone | 15:17 | |
| *** dims has quit IRC | 15:20 | |
| *** baffle_ is now known as baffle | 15:20 | |
| *** mattfarina has joined #openstack-keystone | 15:20 | |
| *** gabriel-bezerra has quit IRC | 15:21 | |
| *** zzzeek has joined #openstack-keystone | 15:22 | |
| *** gabriel-bezerra has joined #openstack-keystone | 15:23 | |
| *** nellysmitt has joined #openstack-keystone | 15:27 | |
| *** samueldmq_ has joined #openstack-keystone | 15:28 | |
| *** htruta has joined #openstack-keystone | 15:28 | |
| *** raildo has joined #openstack-keystone | 15:28 | |
| *** tellesnobrega has joined #openstack-keystone | 15:28 | |
| *** mattfarina has quit IRC | 15:28 | |
| *** abhirc has quit IRC | 15:34 | |
| *** tellesnobrega__ has quit IRC | 15:40 | |
| *** joesavak has joined #openstack-keystone | 15:41 | |
| *** krykowski has quit IRC | 15:44 | |
| *** krykowski_ has joined #openstack-keystone | 15:44 | |
| *** stevemar has joined #openstack-keystone | 15:44 | |
| *** ChanServ sets mode: +v stevemar | 15:44 | |
| breton | how do you do -Code-Review? | 15:46 |
| *** avozza is now known as zz_avozza | 15:48 | |
| samueldmq | breton, I think it is when you had a -1 and you remove it with a 0 | 15:49 |
| *** zz_avozza is now known as avozza | 15:49 | |
| *** diegows_ has joined #openstack-keystone | 15:53 | |
| stevemar | samueldmq, you are correct | 15:55 |
| *** diegows has quit IRC | 15:57 | |
| *** thedodd has joined #openstack-keystone | 16:00 | |
| *** atiwari has quit IRC | 16:01 | |
| *** abhirc has joined #openstack-keystone | 16:01 | |
| *** samueldmq has quit IRC | 16:03 | |
| *** avozza is now known as zz_avozza | 16:04 | |
| breton | ok, thank you | 16:06 |
| *** ayoung-gnight has quit IRC | 16:09 | |
| *** samueldmq_ is now known as samueldmq | 16:10 | |
| samueldmq | stevemar, :-) | 16:10 |
| samueldmq | breton, np | 16:10 |
| *** dkingshott has joined #openstack-keystone | 16:11 | |
| *** diegows has joined #openstack-keystone | 16:14 | |
| *** remote_morgan_ has joined #openstack-keystone | 16:16 | |
| *** zz_avozza is now known as avozza | 16:18 | |
| bknudson | I'm using keystone in devstack -- how do I disable debug mode? | 16:20 |
| *** abhirc_ has joined #openstack-keystone | 16:24 | |
| *** abhirc has quit IRC | 16:26 | |
| stevemar | bknudson, asking the hard questions | 16:28 |
| stevemar | bknudson, isn't there a setting in the apache config | 16:33 |
| htruta | bknudson: I guess it's /etc/keystone/keystone.conf | 16:34 |
| htruta | there should be some 'debug' or 'log_level' property | 16:34 |
| htruta | I used it in ubuntu, btw | 16:35 |
| bknudson | I set the debug option to false and it still says debug mode is on. | 16:36 |
| htruta | did you restart keystone after it? | 16:36 |
| bknudson | yes. | 16:38 |
| bknudson | 2015-02-03 10:38:54.278 DEBUG keystone.openstack.common.service [-] debug = True from (pid=30872) log_opt_values /usr/local/lib/python2.7/dist-packages/oslo_config/cfg.py:2065 | 16:39 |
| bknudson | that should be false... how to configure... | 16:39 |
| bknudson | setting debug=False in config file doesn't do it. | 16:41 |
| dstanek | bknudson: what about the logging configuration? | 16:45 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 16:46 |
| rodrigods | bknudson, thanks for the reviews. There were some comments that I didn't get, so I replied in patchset 20 ^ | 16:47 |
| marekd | anybody knows what is 'maneta' in openstack world? | 16:48 |
| marekd | i know there is monasca | 16:48 |
| marekd | moneta | 16:48 |
| *** diegows_ has quit IRC | 16:48 | |
| *** diegows has quit IRC | 16:49 | |
| *** krykowski_ has quit IRC | 16:49 | |
| rodrigods | marekd, never heard of (but in portuguese has a really fun meaning) heh | 16:49 |
| raildo | hahaha | 16:50 |
| marekd | i don't even wanna know. | 16:50 |
| rodrigods | lol | 16:50 |
| htruta | marekd: Moneta is an application to make some types of conversions to financial metrics | 16:51 |
| marekd | htruta: in openstack, right? Do you have any links? Google seems to be silent about that. | 16:51 |
| htruta | last time I've heard (in paris Summit), it wasn't in stackforge yet | 16:51 |
| marekd | htruta: Moneta has something to do with Monasca, right? | 16:52 |
| htruta | marekd: I watched a talk about it in summit... let me see if I find it | 16:52 |
| marekd | htruta: thanks. | 16:52 |
| *** abhirc_ has quit IRC | 16:52 | |
| htruta | marekd: not really... it was at the moment integrated with ceilometer | 16:52 |
| marekd | uh | 16:52 |
| htruta | monasca would be something in the future | 16:52 |
| marekd | htruta: monasca is easy to find and there is some rading, but one can find nothing about Moneta. | 16:53 |
| marekd | that's why i am asking here. | 16:53 |
| htruta | let me see | 16:53 |
| htruta | found it! | 16:56 |
| htruta | https://www.openstack.org/summit/openstack-paris-summit-2014/session-videos/presentation/billing-integration-enablement-for-ceilometer | 16:56 |
| marekd | thanks! | 16:56 |
| *** lhcheng has joined #openstack-keystone | 17:00 | |
| *** abhirc has joined #openstack-keystone | 17:00 | |
| *** dims has joined #openstack-keystone | 17:01 | |
| *** boris-42 has joined #openstack-keystone | 17:02 | |
| *** abhirc has quit IRC | 17:03 | |
| *** mattfarina has joined #openstack-keystone | 17:07 | |
| openstackgerrit | Merged openstack/keystone: Remove TODO comment which has been addressed https://review.openstack.org/148053 | 17:13 |
| *** diegows has joined #openstack-keystone | 17:14 | |
| *** rwsu-afk is now known as rwsu | 17:15 | |
| *** _cjones_ has joined #openstack-keystone | 17:21 | |
| *** nkinder has quit IRC | 17:25 | |
| *** topol has quit IRC | 17:30 | |
| *** abrito has joined #openstack-keystone | 17:31 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add WebSSO support for federation https://review.openstack.org/136177 | 17:33 |
| *** mattfarina has quit IRC | 17:34 | |
| *** diegows has quit IRC | 17:37 | |
| *** jistr has quit IRC | 17:38 | |
| *** atiwari has joined #openstack-keystone | 17:45 | |
| *** krtaylor has quit IRC | 17:48 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 17:51 |
| morganfainberg | marekd, https://blueprints.launchpad.net/keystone/+spec/k2k-service-providers is complete right? except what we discussed earlier today? / late laste night? | 17:53 |
| *** krtaylor has joined #openstack-keystone | 17:54 | |
| marekd | morganfainberg: apart from the headers i need to toss a patch extending service catalog with service_providers object. | 17:54 |
| morganfainberg | marekd, if that patch isn't in flight today i need to move this to k3 | 17:54 |
| morganfainberg | marekd, should i move this bp to k3? | 17:55 |
| openstackgerrit | Merged openstack/keystone-specs: Update doc for generating SAML2 assertion https://review.openstack.org/152083 | 17:55 |
| *** gyee has joined #openstack-keystone | 17:55 | |
| *** ChanServ sets mode: +v gyee | 17:55 | |
| marekd | wait please | 17:55 |
| marekd | if i don't manage to do it in few hours we can move to k3. | 17:56 |
| *** nellysmitt has quit IRC | 17:58 | |
| *** henrynash has joined #openstack-keystone | 18:01 | |
| *** ChanServ sets mode: +v henrynash | 18:01 | |
| *** spandhe has joined #openstack-keystone | 18:03 | |
| *** krykowski has joined #openstack-keystone | 18:05 | |
| *** topol has joined #openstack-keystone | 18:07 | |
| *** ChanServ sets mode: +v topol | 18:07 | |
| *** abhirc has joined #openstack-keystone | 18:10 | |
| *** harlowja has joined #openstack-keystone | 18:15 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 18:21 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 18:26 |
| *** cburgess has joined #openstack-keystone | 18:29 | |
| *** jsavak has joined #openstack-keystone | 18:32 | |
| *** joesavak has quit IRC | 18:33 | |
| *** thedodd has quit IRC | 18:42 | |
| *** andreaf has quit IRC | 18:43 | |
| *** andreaf has joined #openstack-keystone | 18:44 | |
| *** joesavak has joined #openstack-keystone | 18:50 | |
| *** tqtran has joined #openstack-keystone | 18:52 | |
| *** tqtran is now known as tqtran_afk | 18:52 | |
| *** jsavak has quit IRC | 18:53 | |
| openstackgerrit | Merged openstack/keystone: Explicit Unscoped https://review.openstack.org/142521 | 18:55 |
| *** rushiagr is now known as rushiagr_away | 18:57 | |
| *** aix has quit IRC | 18:59 | |
| *** krykowski has quit IRC | 19:00 | |
| lbragstad | o/ | 19:00 |
| dolphm | krtaylor: i assume that was the wrong review link? | 19:00 |
| stevemar | o/ | 19:00 |
| stevemar | dolphm, i think so | 19:00 |
| morganfainberg | krtaylor, yeah looks like the wrong review link | 19:00 |
| dolphm | relevant link, but not as advertised :P | 19:00 |
| jamielennox | kragniz: i'm pretty sure what you're testing there is the python interpretter | 19:01 |
| krtaylor | oops | 19:01 |
| lbragstad | so, if something fails on powerkvm due to a keystone patch (we add a new dep thats unsupported by powerkvm for example). How do we go about fixing? | 19:01 |
| jamielennox | that's not right | 19:01 |
| jamielennox | kragniz: ignore - sorry | 19:01 |
| samueldmq | henrynash, hi, you still around? | 19:01 |
| lbragstad | or is it more a tool for internal teams? | 19:01 |
| krtaylor | morganfainberg, https://review.openstack.org/#/c/148567/ | 19:02 |
| henrynash | samueldmq: yes, although I’m actually on vacation today….just popped in for keystone IRC meeting | 19:02 |
| jamielennox | I would like to request everyone to have a look at the keystoneclient and middleware reviews - particularly those mentioned in the gist in topic so we can release on monday | 19:02 |
| rodrigods | jamielennox, I'd appreciate if you could review the HMT changes as well | 19:02 |
| samueldmq | henrynash, np, we can talk tomorrow (or whenever you get back) | 19:03 |
| krtaylor | dolphm, morganfainberg, the former was a patch to make this a requirment for all CI systems :) | 19:03 |
| samueldmq | henrynash, :-) | 19:03 |
| dolphm | krtaylor: is there something interesting about the deployment configuration you're using for keystone? | 19:03 |
| jamielennox | rodrigods: ok - i haven't been looking at those because i wasn't sure we had it ready from a server perspective | 19:03 |
| henrynash | samueldmq: back in tomorrow... | 19:03 |
| rodrigods | jamielennox, they are... https://review.openstack.org/#/c/115770/ and the follow up one | 19:03 |
| dolphm | henrynash: vacation harderer | 19:04 |
| samueldmq | henrynash, ack | 19:04 |
| rodrigods | jamielennox, both changes are already merged in server. thanks in advance :) | 19:04 |
| *** ajayaa has quit IRC | 19:04 | |
| krtaylor | lbragstad, it would be good for us to document a process for that, I don't have an exact answer, but it will prob come up again | 19:04 |
| morganfainberg | krtaylor, ^ dolphm's question is really what i'm looking for an answer to | 19:04 |
| krtaylor | dolphm, deployment configuration, I guess I need to understand what you mean by that | 19:05 |
| krtaylor | we do a default deployment, devstack, just what upstream infra does for their CI testing | 19:05 |
| dolphm | krtaylor: can we see the keystone.conf, keystone-paste.ini and policy.json that you're using? | 19:06 |
| lbragstad | so there should be anything different | 19:06 |
| krtaylor | except test on non-x86 architecture | 19:06 |
| dolphm | krtaylor: then i have no interest at all in test results from powerkvm | 19:06 |
| morganfainberg | this sounds like you're testing python then? | 19:06 |
| morganfainberg | and python libs | 19:06 |
| morganfainberg | not keystone | 19:06 |
| krtaylor | dolphm, sure, but it will be exactly the same as infra CI | 19:06 |
| dolphm | krtaylor: right, so i have no interest in the extra noise | 19:06 |
| dolphm | krtaylor: so please don't leave comments | 19:06 |
| morganfainberg | if it is the same as infra. we're adding extra noise vs signal something is broken. | 19:07 |
| krtaylor | morganfainberg, like I said in email, it is really a matter of quality, to assure that someone wanting to run keystone on a different platform knows that some set of tests have been run | 19:07 |
| jamielennox | rodrigods: with https://review.openstack.org/#/c/115770/25/keystoneclient/v3/projects.py if i set subtree_as_list that will change the return type of the function to a list rather than a single project? | 19:07 |
| morganfainberg | as stated by stevemar if this is using db2 or something that is different than infra it has interesting aspects we might want to be aware of | 19:07 |
| dolphm | krtaylor: you can show your test results elsewhere then - they provide no value to keystone reviewers | 19:08 |
| morganfainberg | krtaylor, this sounds like a marketing thing - "we tested keystone on our platform lookat the results" | 19:08 |
| morganfainberg | krtaylor, i mean, not trying to say it is, but that is what i'm feeling from it here. | 19:08 |
| krtaylor | dolphm, except like lbragstad mentioned, the developer woul dget to see that the code they pushed failed on our platform | 19:08 |
| dolphm | krtaylor: the odds of that happening and providing distinguishing value appears to be zero | 19:09 |
| dolphm | krtaylor: further, you're not asking the community to support your platform, so it's just useless noise and will degrade the review process | 19:09 |
| krtaylor | dolphm, I agree that it is less likely to happen with keystone | 19:09 |
| krtaylor | dolphm, there is this concept of supported hypervisors, with nova | 19:10 |
| morganfainberg | krtaylor, if the deployment is materially different than -infra's i think your case has more merit (especially since keystone is very unlikely to run into something we can benfit from) | 19:10 |
| rodrigods | jamielennox, no.. it will be project object with an attribute that will be a list of projects | 19:10 |
| krtaylor | band it will come again, with ARM, maybe Hyper-V | 19:10 |
| morganfainberg | krtaylor, the key difference here is we are compltely hypervisor agnostic | 19:10 |
| morganfainberg | we don't need to support kvm, or xen, or hyper-v. | 19:10 |
| dolphm | or os x ;) | 19:11 |
| morganfainberg | we're actually service agnostic | 19:11 |
| lbragstad | I guess something I meant by that was, as a developer and reviewer I would find value in the comments iff I had the ability to supply a fix. But if its a black box then it hard to say it useful because can't do anything to help you fix the problem. | 19:11 |
| morganfainberg | dolphm, shhhh i'm bitter about that | 19:11 |
| krtaylor | morganfainberg, but isnt it useful to know if it works or not on those platforms? | 19:11 |
| dolphm | krtaylor: no? | 19:11 |
| dolphm | krtaylor: if there's a failure, it's a downstream issue | 19:11 |
| morganfainberg | krtaylor, does python work on that platform? openssl? i think we're talking testing a few layers down in the stack. | 19:11 |
| *** pnavarro has joined #openstack-keystone | 19:12 | |
| krtaylor | it is just easier to fix before the merge | 19:12 |
| krtaylor | as you all know | 19:12 |
| morganfainberg | krtaylor, i don't know what we'd be fixing. | 19:12 |
| krtaylor | but I agree, less likely to find a problem in keystone | 19:12 |
| lbragstad | but we can't fix powerkvm code | 19:12 |
| morganfainberg | krtaylor, what would we be fixing? a python interpreter issue? | 19:12 |
| dolphm | krtaylor: the odds of a patch to keystone breaking your CI is unrealistically low when compared to the odds of your system producing transient failures | 19:13 |
| krtaylor | dolphm, we certainly have transient failures :) | 19:13 |
| amakarov | morganfainberg, Is it OK for Keystone to use LUA scripts to implement Redis lock? | 19:13 |
| morganfainberg | amakarov, i. uh.. wait what? | 19:13 |
| dolphm | krtaylor: we have enough of those already with a single CI | 19:14 |
| krtaylor | lbragstad, agreed, but we can help get it fixed | 19:14 |
| amakarov | morganfainberg, I'm working on redis cache backend | 19:14 |
| morganfainberg | krtaylor, so here is my stance - if you're doing a deployment that differs from -infra base deployment materially | 19:14 |
| amakarov | our kvs is incompatible with redis locks | 19:14 |
| morganfainberg | in a way that could provide value to deployers | 19:14 |
| morganfainberg | amakarov, look at how dogpile does it | 19:14 |
| dolphm | amakarov: using dogpile or no? | 19:15 |
| amakarov | dogpile uses redis locks | 19:15 |
| krtaylor | dolphm, morganfainberg, we want to test all Level 1 projects, and some maybe all Level 2 | 19:15 |
| morganfainberg | amakarov hook into dogpile for it if needed. | 19:15 |
| morganfainberg | krtaylor, but right now i'm not seeing anything besides duplicating -infra. | 19:15 |
| dolphm | krtaylor: go for it - but the results are your business | 19:15 |
| dolphm | amakarov: have a patch or a failure or something to share? i'm curious | 19:16 |
| amakarov | morganfainberg, I've read both dogpile and redis-py code - there is a strait-forward locks with polling | 19:16 |
| krtaylor | morganfainberg, infra runs on x86, not ppc64 or ARM, etc | 19:16 |
| stevemar | krtaylor, yeah, as dolphm says, any failures are your own, and the results should be non-voting | 19:16 |
| morganfainberg | krtaylor, please do not comment (add noise) unless we have something that is likely to have something we can fix. | 19:16 |
| amakarov | morganfainberg, yes, I have a failure. moment... | 19:16 |
| stevemar | krtaylor, yeah, but there is no arch-specific code in keystone :( | 19:16 |
| krtaylor | stevemar, agreed, non-voting, not asking for that | 19:17 |
| morganfainberg | krtaylor, your results are your own, test away | 19:17 |
| lbragstad | doesn't infra also have a requirement that ci can't be voting unless it's open? | 19:17 |
| dolphm | krtaylor: your test results do not sound valuable to keystone developers or reviewers, period | 19:17 |
| morganfainberg | krtaylor, please do not comment unless there is a material (testing the python interpreter is working doens't classify for me) - we have no arch depended code in keystone | 19:18 |
| amakarov | morganfainberg, https://review.openstack.org/#/c/150844 | 19:18 |
| morganfainberg | dependent* | 19:18 |
| krtaylor | morganfainberg, dolphm - ok, thanks everyone, I appreciate the time | 19:18 |
| jamielennox | rodrigods: so subtree_as_ids will be {'id': Project, 'anoter_id': Project} ? | 19:19 |
| amakarov | dogpile actually uses lock implemented by lua | 19:19 |
| morganfainberg | amakarov, we rely on dogpile | 19:19 |
| morganfainberg | amakarov, so if there is an issue there we either a) fix what we can or b) get dogpile fixed | 19:19 |
| morganfainberg | zzzeek is the maintainer of dogpile | 19:19 |
| rodrigods | jamielennox, something like that... (I'm currently updating both patches, small refactoring) | 19:19 |
| jamielennox | rodrigods: it's more just i haven't played with it from the server side | 19:19 |
| *** edmondsw has joined #openstack-keystone | 19:19 | |
| morganfainberg | krtaylor, if you start doing a varied deployment (e.g. db2, some custom webserver/wsgi container) etc, it becomes more valuable to have external comments | 19:20 |
| amakarov | morganfainberg, problem is on our side :) | 19:20 |
| amakarov | if self.mutex.lock_timeout == 0: | 19:20 |
| morganfainberg | krtaylor, this isn't a locked door. | 19:20 |
| morganfainberg | amakarov, there are ways to override how that all works. | 19:20 |
| amakarov | redis LuaLock has no lock_timeout | 19:20 |
| rodrigods | jamielennox, we have some nice docstrings: https://github.com/openstack/keystone/blob/master/keystone/resource/core.py#L248 | 19:20 |
| dolphm | amakarov: is the problem that we're assuming there's a lock_timeout when it's actually optional? | 19:20 |
| morganfainberg | krtaylor, so if things change please come back and let us know and we will re-evaluate | 19:21 |
| krtaylor | morganfainberg, I appreciate that, we have talked about incorporating more | 19:21 |
| morganfainberg | dolphm, probably | 19:21 |
| morganfainberg | so we likely need to be smarter on redis locking iirc i implemented a way to do that within the crazy driver stuff in there | 19:22 |
| amakarov | dolphm, the problem occurs when we try to discover whether it specified | 19:22 |
| dolphm | morganfainberg: amakarov: http://dogpilecache.readthedocs.org/en/latest/api.html#dogpile.cache.backends.redis.RedisBackend.params.lock_timeout | 19:22 |
| amakarov | so it can be easily fixed with 'if hasattr(...' | 19:22 |
| morganfainberg | dolphm, but i think this is hitting the mutex | 19:22 |
| morganfainberg | dolphm, directly | 19:22 |
| morganfainberg | which is the issue | 19:22 |
| marekd | A question: Can class inheriting from manager.Manager be decorated with @dependency.optional() ? | 19:23 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 19:23 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Implements subtree_as_ids and parents_as_ids https://review.openstack.org/150078 | 19:23 |
| dolphm | amakarov: what version of dogpile is running in tempest? | 19:23 |
| rodrigods | bknudson, jamielennox ^ there :) | 19:23 |
| morganfainberg | dolphm, yeah we're hitting the mutex directly | 19:23 |
| dolphm | amakarov: (i assume 0.5.6) | 19:24 |
| *** thedodd has joined #openstack-keystone | 19:25 | |
| raildo | morganfainberg, hey, I just change a few part following a gyee's comment, if you can review :) https://review.openstack.org/#/c/139824/ | 19:25 |
| *** Farhan_ has joined #openstack-keystone | 19:25 | |
| amakarov | dstanek, dogpile.cache==0.5.3 | 19:25 |
| jamielennox | rodrigods: reading parents_as_ids, that dict is going to always have one element and keep getting more deeply nested right? | 19:25 |
| dstanek | amakarov: ? | 19:26 |
| jamielennox | you can only have one parent | 19:26 |
| amakarov | dstanek, it's from pip freeze | 19:26 |
| morganfainberg | amakarov, dolphm, so https://bitbucket.org/zzzeek/dogpile.cache/src/a75835875b9c94bcc018f38d4fc829ec673c9371/dogpile/cache/backends/redis.py?at=master#cl-136 this is where we're running into issues | 19:26 |
| morganfainberg | we're hitting the redis lock and looking for the timeout there | 19:26 |
| amakarov | dstanek, sorry, my mistake ) | 19:27 |
| morganfainberg | in memcache it works like that | 19:27 |
| amakarov | dolphm, dogpile.cache==0.5.3 | 19:27 |
| rodrigods | jamielennox, yes | 19:27 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Add ``service_providers`` in Service Catalog. https://review.openstack.org/152659 | 19:27 |
| morganfainberg | amakarov, so the answer is what does the lua lockobject thing look like? | 19:28 |
| stevemar | marekd, nice | 19:28 |
| morganfainberg | amakarov, is there a way to grab the lock info directly? | 19:28 |
| marekd | stevemar: sadly, wip :( | 19:28 |
| jamielennox | rodrigods: i know i'm way too late to be coming up with this now, but why not just use a list? | 19:28 |
| stevemar | marekd, oh noes | 19:28 |
| amakarov | morganfainberg, I'll find a link to the source | 19:28 |
| morganfainberg | amakarov, i think its: https://github.com/andymccurdy/redis-py/blob/master/redis/lock.py#L9 | 19:29 |
| rodrigods | jamielennox, we wanted the clients (not necessarily openstack services) to handle both in the same way | 19:29 |
| amakarov | morganfainberg, https://github.com/andymccurdy/redis-py/blob/master/redis/lock.py#L186 | 19:29 |
| marekd | stevemar: got minute? | 19:29 |
| stevemar | marekd, for you, i have 3 | 19:29 |
| marekd | :-) | 19:29 |
| morganfainberg | amakarov, it looks like we need to not ask the mutex for the timeout | 19:30 |
| marekd | https://review.openstack.org/#/c/152659/1/keystone/catalog/core.py,cm so i want to do something like that | 19:30 |
| jamielennox | rodrigods: i don't follow - list is a json structure | 19:30 |
| marekd | stevemar: ^^ | 19:30 |
| morganfainberg | amakarov, and it's Lock() not LuaLock() lualock is a subclass that layers in the lua magic | 19:30 |
| jamielennox | rodrigods: oh, you mean child and parent | 19:30 |
| marekd | stevemar: but eventually tox complains there is no attribute like federation_api | 19:30 |
| *** kfox1111 has joined #openstack-keystone | 19:30 | |
| *** jasondotstar has quit IRC | 19:30 | |
| marekd | stevemar: i am wondering if such construction is even possible. | 19:30 |
| amakarov | morganfainberg, ++ | 19:30 |
| rodrigods | jamielennox, yep :) | 19:30 |
| marekd | bknudson: you are Keystone internals master too, https://review.openstack.org/#/c/152659/1/keystone/catalog/core.py,cm | 19:31 |
| marekd | bknudson: line 83 is possible? | 19:31 |
| morganfainberg | amakarov, so this is an issue where we need to extract (capture) the timeout above the mutex and use that to calculate timedout | 19:31 |
| bknudson | marekd: y, that should work. | 19:31 |
| amakarov | morganfainberg, I want 2 things: 1) get it working; 2) try to use blpoprpush to avoid polling we suffer in memcache lock | 19:31 |
| morganfainberg | amakarov, a lot of this code should be simplified down to just using dogpile-isms with a thin wrapper over the top | 19:31 |
| morganfainberg | amakarov, rather than carrying the heavy cache/kvs overlay | 19:32 |
| morganfainberg | amakarov, right now it needs a lot of work (and should also be done pushing to oslo.cache) | 19:32 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Implements subtree_as_ids and parents_as_ids https://review.openstack.org/150078 | 19:32 |
| amakarov | morganfainberg, me too, I'm lazy :P | 19:32 |
| jamielennox | rodrigods: is list_project_parents sorted? | 19:32 |
| morganfainberg | amakarov, more than anything i don't have time :( | 19:33 |
| morganfainberg | i am not lazy/uninterested here | 19:33 |
| jamielennox | rodrigods: like is my immediate parent parents[0] then its parent parents[1] etc | 19:33 |
| stevemar | marekd, thats weird, it should work | 19:33 |
| jamielennox | oh, that's a dict... | 19:33 |
| marekd | stevemar: bknudson maybe there is some race condition... | 19:34 |
| marekd | or my stupid mistake. | 19:34 |
| amakarov | morganfainberg, either way I'm intended to run it in our scale-test lab, so it will be some sort of research - so I want to stay in touch with community somehow... | 19:34 |
| morganfainberg | amakarov, of course | 19:34 |
| morganfainberg | amakarov, so yes lets fix that - get smarter about figuring out how to know if a mutex is timed out | 19:35 |
| morganfainberg | bknudson, dstanek, henrynash, ayoung, jamielennox, topol, dolphm, gyee, https://launchpad.net/keystone/+milestone/kilo-2 any spec that has not had all code reviewed/in flight to the gate by tonight will be bumped to k3 | 19:35 |
| amakarov | morganfainberg, ok, I'll get my CR up-to-date, WIP, and tell when finish | 19:36 |
| morganfainberg | stevemar, ^ | 19:36 |
| morganfainberg | amakarov, this is def. a bug | 19:36 |
| rodrigods | jamielennox, it is... but we do not guarantee that the full list of projects will be returned | 19:36 |
| morganfainberg | amakarov, please split the bug fix for this into it's own review / file the bug | 19:36 |
| rodrigods | jamielennox, we filter them with the projects the user has access to (list_projects_for_user()) | 19:36 |
| morganfainberg | adding the redis backend as the dependant change. | 19:36 |
| *** lhcheng has quit IRC | 19:36 | |
| stevemar | morganfainberg, fwiw, the 'cadf-everywhere' work is all up, just waiting on reviews | 19:36 |
| jamielennox | rodrigods: i posted what i had on patch 25, let me think about what the api should look like from the client | 19:36 |
| *** lhcheng has joined #openstack-keystone | 19:36 | |
| morganfainberg | stevemar, i moved that one to k3, if the code lands we can re-target | 19:36 |
| amakarov | morganfainberg, fix compatibility bug first - got it | 19:36 |
| stevemar | morganfainberg, yup, figured | 19:37 |
| * morganfainberg needs to go get food / coffee pre x-project | 19:37 | |
| jamielennox | ideally i'd like to be a bit smarter than just passing through the raw API | 19:37 |
| samueldmq | morganfainberg, we still need to have list-role-assignments-performance bp approved, spec is already merged | 19:37 |
| samueldmq | morganfainberg, :-) | 19:37 |
| jamielennox | i'm not sure if a consumer is really ever going to want to work with the parents_as_ids dict or we should handle that in client | 19:37 |
| rodrigods | jamielennox, thanks | 19:38 |
| morganfainberg | samueldmq, done, target k3 | 19:38 |
| samueldmq | morganfainberg, so quick :) thanks | 19:39 |
| morganfainberg | marekd, let me know on https://blueprints.launchpad.net/keystone/+spec/k2k-service-providers | 19:39 |
| morganfainberg | marekd, so i can retarget if needed. | 19:40 |
| marekd | morganfainberg: let's move to k3. I pefer to move it now rather than push piece of sh** | 19:40 |
| morganfainberg | k | 19:40 |
| morganfainberg | done | 19:40 |
| marekd | thanks | 19:40 |
| rodrigods | jamielennox, regarding urllib comment, I've tried some combinations here and googled about key only query params without success... =( | 19:40 |
| *** kfox1111 has quit IRC | 19:40 | |
| marekd | stevemar: bknudson re: https://review.openstack.org/#/c/152659/1 this is what tox -epy27 complains about: http://pasteraw.com/27m0jyi2pp9vqlktr8n2py9pdvofl52 | 19:41 |
| morganfainberg | henrynash, https://review.openstack.org/#/c/149178/15 this needs a rebase | 19:41 |
| jamielennox | rodrigods: oh, right | 19:41 |
| jamielennox | rodrigods: does key only matter, parents_as_id=1 is generally the more correct way to do it anyway | 19:42 |
| morganfainberg | henrynash, https://bugs.launchpad.net/keystone/+bug/1415268 is moved to k3 because the whole chain it depends on is k3 | 19:42 |
| TempLPBugBot` | Launchpad bug 1415268 in Keystone "Testing of backend list_role_assignments needs to be improved" (affected: 1, heat: 6) [Medium,In progress] - Assigned to Henry Nash (henry-nash) | 19:42 |
| rodrigods | jamielennox, yes, but bknudson was worried about not following the API spec :( | 19:42 |
| rodrigods | jamielennox, we were using subtree_as_ids=True (which keystone accepts), but in the spec we state that it is key only, so... | 19:43 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Basic AccessInfo plugin https://review.openstack.org/143338 | 19:43 |
| stevemar | marekd, oh... which test is it running? | 19:43 |
| stevemar | any test? | 19:43 |
| morganfainberg | henrynash, this needs rebase: https://review.openstack.org/#/c/148995/ | 19:43 |
| morganfainberg | henrynash, so it can land in k2 | 19:43 |
| marekd | stevemar: eg. keystone.tests.test_v3_catalog.TestCatalogAPISQLRegions.test_get_catalog_returns_proper_endpoints_with_region | 19:43 |
| jamielennox | rodrigods: from memory query strings are supposed to be key value pairs, just having key is the anomaly - but so long as the server side works with both i don't really mind | 19:44 |
| stevemar | marekd, try using `if hasattr(self, 'federation_api'):` instead | 19:44 |
| jamielennox | because ?parents_as_ids=False should really do what you expect | 19:44 |
| morganfainberg | dolphm, bknudson, stevemar, henrynash, jamielennox, gyee, dstanek, topol: https://review.openstack.org/#/c/131516/ https://review.openstack.org/#/c/62275/ needs eyes for review (today) | 19:45 |
| stevemar | the dependency guy might not have loaded things yet | 19:45 |
| rodrigods | jamielennox, ++ maybe we need to do a cleanup in the API someday... | 19:45 |
| marekd | stevemar: i was also thinking there may be some race condition. | 19:45 |
| topol | morganfainberg, OK will do | 19:46 |
| dstanek | morganfainberg: i'm still fine with https://review.openstack.org/#/c/62275/ | 19:47 |
| dstanek | morganfainberg: i'll go ahead and A+1 | 19:48 |
| *** nellysmitt has joined #openstack-keystone | 19:48 | |
| morganfainberg | lbragstad, https://review.openstack.org/#/c/142440/ | 19:48 |
| morganfainberg | lbragstad, needs love | 19:48 |
| lbragstad | morganfainberg: yep | 19:49 |
| morganfainberg | moving the removed-as-of-kilo spec to k3 | 19:49 |
| *** raildo has left #openstack-keystone | 19:49 | |
| morganfainberg | there is a lot of love still needed there | 19:49 |
| *** raildo has joined #openstack-keystone | 19:49 | |
| morganfainberg | so the only spec really needing love to land is https://blueprints.launchpad.net/keystone/+spec/remove-role-metadata | 19:50 |
| morganfainberg | someone needs to rebase/fix the second review there | 19:50 |
| samueldmq | morganfainberg, will do | 19:50 |
| morganfainberg | samueldmq, https://review.openstack.org/#/c/148995/ | 19:50 |
| morganfainberg | it was WIP'd because of a bug the underlying patch exposed | 19:51 |
| topol | bknudson, https://review.openstack.org/#/c/62275/ is absolute craftmanship! You took something god awful an broke it up into readable chunks! | 19:51 |
| morganfainberg | it *should* be fixed | 19:51 |
| morganfainberg | check with henrynash | 19:51 |
| morganfainberg | but that is the last outstanding "to be fixed" i want to land this milestone | 19:51 |
| samueldmq | morganfainberg, yep, but the underlying patch already works correctly (it's mine) :p | 19:51 |
| rodrigods | jamielennox, replied your comment regarding the subtree and parents attributes (patchset 25) | 19:51 |
| *** mattfarina has joined #openstack-keystone | 19:51 | |
| morganfainberg | unless other things magically work land like cadf everywhere | 19:51 |
| samueldmq | morganfainberg, but this one depends on the list role assignments refactoring ... at least as henry put | 19:52 |
| morganfainberg | samueldmq, ah so that pushed this spec to k3 | 19:52 |
| morganfainberg | ok | 19:52 |
| *** amakarov is now known as amakarov_away | 19:52 | |
| samueldmq | morganfainberg, from what I heard from him, he would like to have this asap | 19:53 |
| stevemar | morganfainberg, i really want gordc to give the a-okay to cadf everywhere first | 19:53 |
| morganfainberg | stevemar, that's fine, it's k3 for now | 19:53 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Add ``service_providers`` in Service Catalog. https://review.openstack.org/152659 | 19:53 |
| samueldmq | morganfainberg, I think that chain is mature enough, but we can revisit this tomorrow maybe | 19:53 |
| samueldmq | henrynash, ^ | 19:53 |
| *** mattfarina has quit IRC | 19:53 | |
| stevemar | gordc, meet the underside of the bus, bus meet gordc | 19:53 |
| morganfainberg | samueldmq, well i moved the spec to k3 if we can land the stuff needed for it so it can land by tonight | 19:53 |
| morganfainberg | i'll move it back to k2 | 19:53 |
| morganfainberg | but if it's not gating by 23:59 tonight (pacific) | 19:53 |
| morganfainberg | it's next milestone | 19:53 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Add ``service_providers`` in Service Catalog. https://review.openstack.org/152659 | 19:54 |
| morganfainberg | s/gating/ready to gate/ | 19:54 |
| marekd | eh, will investigate it later. | 19:54 |
| samueldmq | morganfainberg, ok so it will stay for k3, I dont think we'll get enough reviews, since henrynash is on vacancy | 19:54 |
| topol | dstanek, https://review.openstack.org/#/c/131516/8 was pretty good too :-). I mean its not brant-like like https://review.openstack.org/#/c/62275/ but certainly deserves an honorable mention :-) | 19:55 |
| morganfainberg | topol, stevemar, bknudson, dstanek, jamielennox, gyee, dolphm, henrynash, https://bugs.launchpad.net/keystone/+bugs?search=Search&field.status=New any bugs there we need to hit before m2? please take a quick look. | 19:57 |
| morganfainberg | anything hyper critical should be bubbled up as "do today" | 19:57 |
| morganfainberg | i don't see any right this second. | 19:57 |
| samueldmq | morganfainberg, what about a @expected(exception.Foo) annotation for those skipped methods we need to move away from? | 19:58 |
| morganfainberg | samueldmq, something we should do. not required for today | 19:58 |
| samueldmq | morganfainberg, ++ | 19:58 |
| * gordc drops | 19:59 | |
| dstanek | samueldmq: that already exists in a different way - with self.assertRaises(exception.Foo) | 19:59 |
| morganfainberg | stevemar, marekd: https://bugs.launchpad.net/keystone/+bug/1405726 | 19:59 |
| TempLPBugBot` | Launchpad bug 1405726 in Keystone "Federation, getting scoped token results in error. " (affected: 1, heat: 6) [Undecided,New] | 19:59 |
| morganfainberg | gordc, the scary thing is steve parked that bus on quicksand | 20:00 |
| morganfainberg | gordc, hurry before you sink too far! | 20:00 |
| morganfainberg | ;) | 20:00 |
| morganfainberg | gyee, is this the DIT bug you were tyring to backport to icehouse: https://bugs.launchpad.net/keystone/+bug/1409635 ? | 20:00 |
| dstanek | samueldmq: see the code here: https://docs.python.org/2/library/unittest.html#basic-example | 20:00 |
| TempLPBugBot` | Launchpad bug 1409635 in Keystone "keystone fails to authenticate users when LDAP project_id_attribute is not CN" (affected: 3, heat: 14) [Undecided,New] - Assigned to Adam Young (ayoung) | 20:00 |
| gordc | morganfainberg: i've been told to stay still on quicksand... and that it's fake. | 20:01 |
| gordc | stevemar: what you want me to look at? | 20:01 |
| stevemar | gordc, just wanted you to revisit that CADF patch, you raised a concern about using the same event_types with different payloads | 20:02 |
| *** shakamunyi has joined #openstack-keystone | 20:02 | |
| stevemar | gordc, but i believe morganfainberg wants to go completely CADF, as soon as possible... and drop the other format | 20:02 |
| stevemar | given the usual 2 cycle period | 20:02 |
| samueldmq | dstanek, hmm, yes I knew that .. just was wondering if with an annotation it wouldnt be simpler | 20:03 |
| samueldmq | dstanek, maybe not... looking deeper on the @wip annotation, I think it should be really used for exposing a bug | 20:04 |
| dstanek | samueldmq: same #lines of code without having to support something new | 20:04 |
| samueldmq | dstanek, before fixing it, am I right? | 20:04 |
| samueldmq | dstanek, yes, I agree | 20:04 |
| gordc | stevemar: i see... i mean it's not the end of the world if they both send on same event_type... it'd really only be an issue from consumer pov if they sent both (dup or alternating) | 20:04 |
| gordc | stevemar: if it's just one or the other consistently i guess it's fine. | 20:04 |
| dstanek | samueldmq: yes, it's for annotating a test as work in progress | 20:04 |
| samueldmq | dstanek, like tdd | 20:04 |
| samueldmq | dstanek, k | 20:05 |
| stevemar | gordc, yep, which is why i wanted to ensure that the config option was there, and still defaults to the old format too | 20:05 |
| dstanek | samueldmq: i've used something like this in a past life to write tests i know won't pass (but should) to pass off the code development to someone else | 20:05 |
| *** dims has quit IRC | 20:05 | |
| *** chlong has quit IRC | 20:05 | |
| samueldmq | dstanek, hmm, looks great | 20:06 |
| samueldmq | dstanek, need to try it by myself :) | 20:06 |
| gordc | stevemar: cool cool. i'll take a quick look agagin | 20:06 |
| gordc | again* | 20:06 |
| *** vhoward has left #openstack-keystone | 20:07 | |
| *** dims has joined #openstack-keystone | 20:08 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 20:08 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Implements subtree_as_ids and parents_as_ids https://review.openstack.org/150078 | 20:08 |
| *** vhoward has joined #openstack-keystone | 20:08 | |
| gordc | stevemar: what's the notify_event_callbacks? that has to be called no matter what? | 20:08 |
| stevemar | gordc, right, that's what handles the token revocation if a user is deleted, all internal callbacks | 20:10 |
| stevemar | gordc, we totally over-used the concept of notifications, and as a result the notifications.py file is super messy | 20:11 |
| stevemar | i plan on refactoring it a bit when this is all in | 20:11 |
| gordc | stevemar: yeah i just read the note... the code is super easy to read.lol | 20:11 |
| stevemar | gordc, yeah i tried to break things up into logical components to make it easier to read | 20:11 |
| *** boris-42 has quit IRC | 20:12 | |
| gordc | stevemar: cool cool. i'm ok with how it is (factoring in the existings reviews) | 20:12 |
| gordc | it might make sense to append the resource_id to both backward compat resource_info and to a proper location (ie. in target?) | 20:14 |
| gordc | you'll be duplicating for a bit but i think the resource_id is more related to target (correct me if i'm wrong) | 20:15 |
| stevemar | gordc, i like that suggestion | 20:15 |
| stevemar | any suggestion on what the 'key' should be the target? | 20:15 |
| *** tellesnobrega_ has joined #openstack-keystone | 20:15 | |
| stevemar | resource_id? resource_info? project/user/etc_id? | 20:16 |
| gordc | stevemar: uhh... what's 'key' in your question? | 20:17 |
| *** timcline_ has joined #openstack-keystone | 20:17 | |
| stevemar | gordc, currently target is: "target": { | 20:19 |
| stevemar | "typeURI": "service/security/account/user", "id": "openstack:1c2fc591-facb-4479-a327-520dade1ea15" | 20:19 |
| stevemar | }, | 20:19 |
| *** joesavak has quit IRC | 20:19 | |
| *** jsavak has joined #openstack-keystone | 20:19 | |
| stevemar | and we can extend it with our our keys/properties | 20:20 |
| *** afazekas has joined #openstack-keystone | 20:21 | |
| stevemar | i think target has a "name" property we can use | 20:21 |
| *** afazekas is now known as afazekas_drunk | 20:21 | |
| *** timcline has quit IRC | 20:22 | |
| gordc | stevemar: right. i would think you would want to put id=resource_id (assuming resource_id is the id of target) | 20:22 |
| *** shakamunyi has quit IRC | 20:23 | |
| stevemar | gordc, hmm, doesn't pycadf do something funky with the id? | 20:23 |
| gordc | stevemar: it prepends a namespace to it... if you don't put one in (it just auto generates a uuid with the namespace) | 20:24 |
| stevemar | hmm okay, cause i thought we were doing that with users, anyway... another discussion | 20:25 |
| gordc | name is an optional attribute but you could throw the resource_id there if you wanted. | 20:25 |
| *** jasondotstar has joined #openstack-keystone | 20:25 | |
| gordc | yeah, basically when you define resource (target, observer, initiator) you just need typeuri and id. it's best that the id is not autogenerated so you can actually group by a common id when querying | 20:26 |
| gordc | that's assuming you have a stable id you can reference. ie. the primary key from db | 20:27 |
| *** jorge_munoz has joined #openstack-keystone | 20:28 | |
| *** anteaya has quit IRC | 20:34 | |
| stevemar | gordc, we definitely have a key to use, maybe i'm getting mixed up with the namespaced uuid auto-gen thing | 20:36 |
| *** samueldmq_ has joined #openstack-keystone | 20:37 | |
| gordc | stevemar: i see. yeah. put your key as id. you really shouldn't be using the autoget id. | 20:37 |
| stevemar | gordc, ughhh https://github.com/openstack/keystone/blob/master/keystone/notifications.py#L266-L267 | 20:38 |
| stevemar | thats a defect | 20:38 |
| *** afazekas_drunk has quit IRC | 20:44 | |
| *** timcline_ has quit IRC | 20:44 | |
| gordc | stevemar: yep | 20:44 |
| *** timcline has joined #openstack-keystone | 20:44 | |
| *** timcline has quit IRC | 20:47 | |
| *** timcline has joined #openstack-keystone | 20:48 | |
| *** timcline has quit IRC | 20:48 | |
| *** timcline has joined #openstack-keystone | 20:48 | |
| *** openstackgerrit has quit IRC | 20:50 | |
| *** jasondotstar has quit IRC | 20:50 | |
| *** openstackgerrit has joined #openstack-keystone | 20:50 | |
| *** afazekas has joined #openstack-keystone | 20:53 | |
| *** anteaya has joined #openstack-keystone | 20:53 | |
| *** tellesnobrega_ has quit IRC | 20:54 | |
| openstackgerrit | Merged openstack/keystone: Refactor keystone-all and http/keystone https://review.openstack.org/62275 | 20:56 |
| openstackgerrit | Merged openstack/keystone: Adds a wip decorator for tests https://review.openstack.org/131516 | 20:56 |
| *** afazekas is now known as fazekas_drunk | 20:57 | |
| *** fazekas_drunk is now known as afazekas_drunk | 20:57 | |
| *** tellesnobrega_ has joined #openstack-keystone | 20:59 | |
| *** tellesnobrega_ has quit IRC | 20:59 | |
| *** timcline has quit IRC | 21:02 | |
| *** diegows has joined #openstack-keystone | 21:02 | |
| *** timcline has joined #openstack-keystone | 21:03 | |
| *** raildo is now known as raildo_away | 21:06 | |
| *** abhirc has quit IRC | 21:07 | |
| *** timcline_ has joined #openstack-keystone | 21:09 | |
| *** nellysmitt has quit IRC | 21:09 | |
| *** timcline has quit IRC | 21:10 | |
| *** abhirc has joined #openstack-keystone | 21:10 | |
| *** timcline_ has quit IRC | 21:13 | |
| gyee | morganfainberg, back to my desk, yes, that was the bug | 21:14 |
| *** timcline has joined #openstack-keystone | 21:14 | |
| *** topol has quit IRC | 21:15 | |
| *** ayoung has joined #openstack-keystone | 21:16 | |
| *** ChanServ sets mode: +v ayoung | 21:16 | |
| *** josecastroleon has quit IRC | 21:18 | |
| *** kfox1111 has joined #openstack-keystone | 21:20 | |
| morganfainberg | gyee ok | 21:30 |
| bknudson | marekd: you might need to define an __init__ method in order for the DI injecting to work at all... others have run into this. | 21:30 |
| *** joesavak has joined #openstack-keystone | 21:31 | |
| gyee | morganfainberg, also, about the credential API, say if we store the ec2 keys in barbican, don't we still need to change the ec2 code to use barbican rest API instead? | 21:31 |
| gyee | ec2 or shared secrets | 21:31 |
| *** jsavak has quit IRC | 21:32 | |
| *** obutenko has quit IRC | 21:39 | |
| *** obutenko has joined #openstack-keystone | 21:41 | |
| *** obutenko has quit IRC | 21:42 | |
| *** jsavak has joined #openstack-keystone | 21:43 | |
| *** joesavak has quit IRC | 21:46 | |
| *** samueldmq_ has quit IRC | 21:47 | |
| *** avozza is now known as zz_avozza | 21:48 | |
| jamielennox | gyee: in which case i think barbican should own the ec2 code | 21:57 |
| jamielennox | .. or maybe i should have thought about that a bit more before typing | 21:57 |
| gyee | jamielennox, my understanding is that they are key management, not crypto operations | 22:00 |
| *** afazekas_drunk is now known as afeakas|oyua | 22:00 | |
| *** zz_avozza is now known as avozza | 22:02 | |
| jamielennox | ec2 middleware is just taking a local key and making an auth request with it right/ | 22:03 |
| *** jsavak has quit IRC | 22:03 | |
| *** jsavak has joined #openstack-keystone | 22:04 | |
| *** pnavarro has quit IRC | 22:04 | |
| *** nkinder has joined #openstack-keystone | 22:04 | |
| gyee | jamielennox, no, the shared secret/key never transfer over the wire | 22:06 |
| gyee | so we essentially have a chicken-n-egg problem | 22:07 |
| *** avozza is now known as zz_avozza | 22:07 | |
| gyee | we can't talk to barbican to retrieve the key without a token | 22:07 |
| gyee | there's where trust come in handy I suppose | 22:07 |
| gyee | unless we store all the keys under one account | 22:08 |
| jamielennox | gyee: i really needed to look over how ec2 works again before getting into this :p | 22:10 |
| *** lhcheng has quit IRC | 22:10 | |
| gyee | jamielennox, I heard heat also have its own implementation of ec2 | 22:10 |
| gyee | the stuff is all over the place it seem | 22:10 |
| jamielennox | i know they rely on ec2 for some things, i hvaen't seen a custom implementation of it | 22:11 |
| gyee | me neither, I was hearing rumors :) | 22:12 |
| *** nkinder has quit IRC | 22:12 | |
| gyee | unconfirmed | 22:12 |
| bknudson | nova has an ec2 api | 22:14 |
| gyee | bknudson, right, but it uses keystone ec2 middleware I think | 22:15 |
| *** edmondsw has quit IRC | 22:17 | |
| gyee | bknudson, my bad, I mean it calls keystone ec2 api, https://github.com/openstack/nova/blob/master/nova/api/ec2/__init__.py#L279 | 22:18 |
| *** rm_work is now known as rm_work|away | 22:19 | |
| bknudson | gyee: you probably need an ec2 token to use it? | 22:20 |
| gyee | bknudson, ec2 token is keystone token | 22:20 |
| gyee | keystone ec2 api results in a token being issued | 22:20 |
| *** jasondotstar has joined #openstack-keystone | 22:20 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Change oslo.serialization to oslo_serialization https://review.openstack.org/148025 | 22:20 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Change oslo.i18n to oslo_i18n https://review.openstack.org/151880 | 22:20 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Change oslo.config to oslo_config https://review.openstack.org/145250 | 22:20 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Change oslo.db to oslo_db https://review.openstack.org/148029 | 22:20 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Change oslo.messaging to oslo_messaging https://review.openstack.org/148028 | 22:20 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use oslo_log instead of incubator https://review.openstack.org/152699 | 22:21 |
| gyee | jamielennox, thanks for chiming in https://review.openstack.org/#/c/152283/ | 22:21 |
| gyee | jamielennox, my understanding is that without this patch, Swift can't use v3 | 22:21 |
| jamielennox | gyee: i've been playing with it myself | 22:21 |
| jamielennox | in conjunction with flapper's problem for glance | 22:21 |
| gyee | or least not in a backward compatible way | 22:21 |
| jamielennox | right | 22:22 |
| jamielennox | gyee: these patches will get us some support in oslo.config: https://review.openstack.org/#/c/143423/ | 22:23 |
| jamielennox | that's how i was going to deal with glance | 22:23 |
| jamielennox | i don't know if that's an option for swift or not | 22:23 |
| gyee | I am not sure either, we can ask them | 22:24 |
| gyee | I don't know how easier for them to upgrade | 22:24 |
| jamielennox | gyee: i talked to swift - essentially they don't want to start using oslo.config | 22:25 |
| jamielennox | they configure the whole swift system via paste | 22:25 |
| gyee | oh | 22:25 |
| gyee | I see | 22:25 |
| *** lhcheng has joined #openstack-keystone | 22:25 | |
| jamielennox | however as oslo.config is a dependency of keystonemiddleware they are getting it whether they like it or not | 22:25 |
| gyee | jamielennox, what was the reason they don't want to go with oslo.config | 22:26 |
| gyee | stability? | 22:26 |
| jamielennox | so possibly we could do a wrapper for them | 22:26 |
| jamielennox | gyee: more like history i think | 22:26 |
| jamielennox | and they don't see the benefit in having everyone figure out all the deprecations they would have to do to transition | 22:26 |
| gyee | if the are getting oslo.config regardless then wrapper make sense | 22:27 |
| gyee | so as long as it is seamless to them | 22:27 |
| *** harlowja is now known as harlowja_away | 22:28 | |
| jamielennox | so glance has the problem that it doesn't use the global CONF object, but makes it's own | 22:29 |
| jamielennox | so i was wondering if we could rewrite the middleware to accept a CONF object rather than use the global | 22:29 |
| jamielennox | i guess from there we could handle swift by having a function that takes all the **kwargs, construct a CONF object from it and then pass it into the middleware | 22:30 |
| jamielennox | that's where my thought process has been heading anyway | 22:30 |
| *** amerine has joined #openstack-keystone | 22:31 | |
| jamielennox | i tried to rewrite it so AuthProtocol or whatever took only the CONF as a parameter, it's harder than i thought - but mostly just requires some fiddling | 22:31 |
| *** abhirc has quit IRC | 22:31 | |
| gyee | how does that work? we can't change the paste interface right? | 22:32 |
| jamielennox | no, but we can essentially extract a base class from it | 22:32 |
| jamielennox | where the superclass would take all the options that it used to take and construct the CONF object for it | 22:32 |
| jamielennox | I was also wondering about going the other way, like have the AuthProtocol object take the kwargs and have a load_from_conf() method that handles that | 22:33 |
| jamielennox | there are a lot of options though..... | 22:34 |
| gyee | you mean load_from_conf take both local and global conf? | 22:34 |
| jamielennox | well local and global conf are from the paste factory | 22:34 |
| jamielennox | which is just a function that combines them and constructs the object | 22:34 |
| gyee | righ | 22:34 |
| gyee | right | 22:34 |
| jamielennox | so we could handle that in the factory function | 22:34 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Change oslo.i18n to oslo_i18n https://review.openstack.org/151880 | 22:35 |
| openstackgerrit | Tom Cameron proposed openstack/keystone: Add docstrings to remaining functions https://review.openstack.org/147313 | 22:36 |
| gyee | jamielennox, but it is already that way right? https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token.py#L1974 | 22:36 |
| jamielennox | gyee: ok - so my feeling is that AuthProtocol should take either a CONF object or a kwargs but not both, then we can have helper functions to handle the conversion from one to the other | 22:37 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Change oslo.db to oslo_db https://review.openstack.org/148029 | 22:37 |
| jamielennox | i just don't know which yet | 22:38 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Change oslo.config to oslo_config https://review.openstack.org/145250 | 22:38 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Change oslo.i18n to oslo_i18n https://review.openstack.org/151880 | 22:38 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use oslo_log instead of incubator https://review.openstack.org/152699 | 22:38 |
| jamielennox | i kind of like that we could do a keystonemiddleware that didn't have a direct dependency on oslo.config - however it's a fair bit of work for not much gain, and i wrote a whole bunch of auth.load_from_conf helpers with keystonemiddleware in mind that i could no longer use | 22:39 |
| gyee | man that global CONF voodoo | 22:40 |
| gyee | is voodoo | 22:40 |
| bknudson | so there could be a config option in auth_token which is the name of a function to call to get the conf object? | 22:40 |
| gyee | bknudson, actually that's not a bad option | 22:40 |
| bknudson | similar to how there's a conf option for the swift cache | 22:40 |
| gyee | let the projects to decide themselves | 22:41 |
| jamielennox | bknudson: so i was thinking classmethods | 22:41 |
| jamielennox | AuthProtocol.load_from_conf() and if you don't provide a param it takes global | 22:41 |
| jamielennox | because the main thing we want to support is the paste factory | 22:42 |
| bknudson | then the application would need to import AuthProtocol. | 22:42 |
| jamielennox | bknudson: many do | 22:42 |
| gyee | bknudson's idea is to make it completely independent from keystonemiddleware or oslo.config | 22:42 |
| jamielennox | bknudson: i want the existing paste etc to work as they do, however the new projects like sahara that don't use paste generally call AuthProtocol directly | 22:42 |
| gyee | bknudson, so the service will have to write extra code, which may not be completely seamless | 22:43 |
| bknudson | nasty! | 22:43 |
| gyee | business | 22:44 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Cleanup tests to not set multiple workers. https://review.openstack.org/151511 | 22:45 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move eventlet server options to a config section https://review.openstack.org/130962 | 22:45 |
| *** jasondotstar has quit IRC | 22:46 | |
| *** andreaf has quit IRC | 22:46 | |
| *** tellesnobrega has quit IRC | 22:47 | |
| *** samueldmq has quit IRC | 22:47 | |
| *** abrito has quit IRC | 22:47 | |
| *** gabriel-bezerra has quit IRC | 22:47 | |
| *** htruta has quit IRC | 22:47 | |
| *** raildo_away has quit IRC | 22:47 | |
| dolphm | public service announcement: creating AE tokens just benchmarked as 433% faster than creating UUID tokens when deployed against a global galera cluster | 22:48 |
| lbragstad | ... wut | 22:48 |
| gyee | sweeeeet! | 22:48 |
| bknudson | I thought AE tokens were -2? | 22:48 |
| lbragstad | I did a poc of it locally | 22:49 |
| lbragstad | just to see what performance would be | 22:49 |
| *** abrito has joined #openstack-keystone | 22:49 | |
| *** samueldmq has joined #openstack-keystone | 22:49 | |
| *** tellesnobrega has joined #openstack-keystone | 22:49 | |
| gyee | bknudson, the only concern there is the potential variable size | 22:49 |
| bknudson | it doesn't support federation tokens. | 22:50 |
| *** gabriel-bezerra has joined #openstack-keystone | 22:50 | |
| gyee | but even for federation, we have at most 1 group right now | 22:50 |
| *** htruta has joined #openstack-keystone | 22:50 | |
| dolphm | and they're 48% faster under heavy load, in terms of request per second | 22:50 |
| bknudson | how about authenticating AE tokens? | 22:51 |
| bknudson | are you using rally? | 22:51 |
| *** raildo_away has joined #openstack-keystone | 22:51 | |
| lbragstad | bknudson: you mean validating AE tokens? | 22:51 |
| bknudson | lbragstad: yes, on the auth_token side | 22:51 |
| dolphm | even token validations are noticably faster (~6%) | 22:51 |
| gyee | lbragstad, I think he mean both sign and encrypt | 22:51 |
| dolphm | bknudson: using apachebench to create load and measure client side performance metrics https://gist.github.com/dolph/02c6d37f49596b3f4298/revisions | 22:52 |
| dolphm | the latest revision shows the diff between UUID and AE tokens | 22:52 |
| dolphm | this is also an apache + mariadb deployment as tuned by an idiot | 22:54 |
| gyee | faster on validation is a bit of pleasant surprise to me | 22:54 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use oslo_log instead of incubator https://review.openstack.org/152699 | 22:54 |
| bknudson | dolphm: revocation events? | 22:54 |
| dolphm | bknudson: not doing anything to produce revocation events | 22:55 |
| gyee | I would expect validation is on par with uuid if not a bit worst | 22:55 |
| lbragstad | bknudson: only did auth and validate | 22:55 |
| dolphm | gyee: that's what we expected too | 22:55 |
| bknudson | it needs to rebuild the catalog... what do you use for catalog backend? | 22:55 |
| dolphm | bknudson: sql | 22:55 |
| lbragstad | everything is backed by sql | 22:55 |
| lbragstad | we're just not storing the token | 22:55 |
| *** wanghong has quit IRC | 22:55 | |
| bknudson | I bet the templated backend would be super fast | 22:55 |
| dolphm | bknudson: https://github.com/dolph/keystone-deploy/blob/galera/playbooks/roles/http/templates/keystone.conf | 22:56 |
| gyee | dolphm, are you using the same user for all your tests? faster could be the result of caching the lookups | 22:56 |
| dolphm | bknudson: but that probably wouldn't represent a realistic deployment for our customers | 22:56 |
| *** wanghong has joined #openstack-keystone | 22:56 | |
| dolphm | gyee: yes - trying to avoid too many variables | 22:56 |
| *** wanghong has quit IRC | 22:56 | |
| gyee | k, that may explain it | 22:56 |
| dolphm | gyee: it's just taking the same code path over and over | 22:56 |
| gyee | cache is on by default right? | 22:57 |
| dolphm | gyee: no, see the keystone.conf above (it's enabled) | 22:57 |
| *** wanghong has joined #openstack-keystone | 22:57 | |
| gyee | looks pretty good | 22:57 |
| gyee | lgtm! :) | 22:57 |
| *** wanghong has quit IRC | 22:58 | |
| bknudson | dolphm: where's the config to use AE tokens? | 22:58 |
| dolphm | gyee: if we were going to introduce cache misses into the benchmark scenario, we'd need to create hundreds of thousands of users before starting the test lol | 22:58 |
| dolphm | bknudson: oh, that's a separate playbook. lbragstad ? | 22:58 |
| lbragstad | bknudson: same playbook, different branch | 22:59 |
| *** wanghong has joined #openstack-keystone | 22:59 | |
| dolphm | bknudson: this is the base deployment for UUID, then lbragstad ran a playbook to convert it to AE | 22:59 |
| lbragstad | https://github.com/dolph/keystone-deploy/tree/ae-tokens | 22:59 |
| *** leseb- has joined #openstack-keystone | 22:59 | |
| lbragstad | the only real change is provider = keystone.tokens.providers.ae.Provider | 23:00 |
| lbragstad | and some keyczar stuff | 23:00 |
| dolphm | bknudson: it's sort of arbitrary because it's deploying keystone from lbragstad/keystone instead of openstack/keystone, etc | 23:00 |
| dolphm | with ae support "merged" | 23:00 |
| *** wanghong has quit IRC | 23:00 | |
| gyee | looks pretty simple | 23:01 |
| *** wanghong has joined #openstack-keystone | 23:01 | |
| lbragstad | it's POC... | 23:01 |
| *** wanghong has quit IRC | 23:01 | |
| *** bknudson has quit IRC | 23:02 | |
| dolphm | lbragstad: ship it | 23:02 |
| gyee | ++ | 23:03 |
| *** EmilienM is now known as EmilienM|afk | 23:03 | |
| gyee | mark it experimental | 23:03 |
| * gyee hides | 23:03 | |
| * lbragstad ducks | 23:03 | |
| *** wanghong has joined #openstack-keystone | 23:03 | |
| dolphm | the BEST part of AE tokens: | 23:04 |
| dolphm | > select * from token; | 23:04 |
| dolphm | Empty set (0.00 sec) | 23:04 |
| dolphm | LOOK AT THAT RESPONSE TIME | 23:05 |
| gyee | heh | 23:05 |
| lbragstad | lol | 23:05 |
| *** rm_work|away is now known as rm_work | 23:06 | |
| *** jsavak has quit IRC | 23:07 | |
| *** briancurtin has quit IRC | 23:08 | |
| *** zhiyan has quit IRC | 23:08 | |
| *** kfox1111 has quit IRC | 23:08 | |
| *** ctracey has quit IRC | 23:09 | |
| *** nellysmitt has joined #openstack-keystone | 23:10 | |
| *** jraim has quit IRC | 23:10 | |
| *** serverascode has quit IRC | 23:12 | |
| *** Ephur has joined #openstack-keystone | 23:14 | |
| *** nellysmitt has quit IRC | 23:14 | |
| *** jasondotstar has joined #openstack-keystone | 23:15 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/152714 | 23:16 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/152715 | 23:16 |
| *** jaosorior has quit IRC | 23:16 | |
| *** kfox1111 has joined #openstack-keystone | 23:16 | |
| *** ctracey has joined #openstack-keystone | 23:17 | |
| *** dims has quit IRC | 23:17 | |
| *** timcline has quit IRC | 23:18 | |
| *** timcline has joined #openstack-keystone | 23:18 | |
| *** dims has joined #openstack-keystone | 23:19 | |
| *** ctracey has quit IRC | 23:20 | |
| *** ctracey has joined #openstack-keystone | 23:20 | |
| *** gordc has quit IRC | 23:20 | |
| *** kfox1111 has quit IRC | 23:21 | |
| *** jraim has joined #openstack-keystone | 23:21 | |
| *** zhiyan has joined #openstack-keystone | 23:21 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf: Updated from global requirements https://review.openstack.org/152722 | 23:22 |
| *** timcline has quit IRC | 23:22 | |
| jamielennox | ayoung: do you want to unabandon https://review.openstack.org/#/c/115463/ or should i start again | 23:24 |
| jamielennox | it's completely different now anyway | 23:24 |
| *** carlosmarin has quit IRC | 23:25 | |
| leseb- | hey all, I'm getting a lot of "DBConnectionError: (OperationalError) (2006, 'MySQL server has gone away')" error logs | 23:26 |
| leseb- | this happens quite randomly | 23:27 |
| leseb- | i'm using haproxy but even while pointing at a specific keystone server I'm regularly getting this message | 23:27 |
| leseb- | any idea will be highly appreciated :) | 23:27 |
| morganfainberg | leseb-: there is a version of oslo.db that had an issue. What version of Oslo.db (and what version of keystone) are you using. | 23:28 |
| leseb- | morganfainberg: hum I'm running ubuntu cloud archive juno | 23:29 |
| *** serverascode has joined #openstack-keystone | 23:30 | |
| morganfainberg | dolphm: yes. Non persistent tokens. Yesssss | 23:30 |
| leseb- | morganfainberg: not sure if this helps but dpkg says python-oslo.db 1.0.0-0ubuntu1~cloud0.... | 23:30 |
| dolphm | morganfainberg: https://twitter.com/dolphm/status/562750437309550592 | 23:30 |
| leseb- | morganfainberg: how can I precisely check the version? | 23:31 |
| *** harlowja_away is now known as harlowja | 23:32 | |
| *** briancurtin has joined #openstack-keystone | 23:33 | |
| morganfainberg | If you're installing from apt. There is a dpkg cmd to do it. But I need to get back to my desk to type it / look it up | 23:35 |
| leseb- | morganfainberg: thanks | 23:36 |
| morganfainberg | dolphm: hehe. | 23:39 |
| morganfainberg | leseb-: that version of Oslo.db is your issue. You need (iirc 1.0.2 or later) | 23:40 |
| *** thedodd has quit IRC | 23:41 | |
| *** jasondotstar has quit IRC | 23:45 | |
| leseb- | morganfainberg: upgrading to 1.0.2 breaks keystone... | 23:46 |
| morganfainberg | really? shouldn't | 23:46 |
| morganfainberg | oh. crud, it might | 23:46 |
| morganfainberg | because juno | 23:46 |
| morganfainberg | but still it shouldn't | 23:47 |
| leseb- | now I'm getting: ImportError: cannot import name i18n when I try to start keystone | 23:47 |
| morganfainberg | that is wierd | 23:47 |
| leseb- | not sure, maybe pip broke something | 23:47 |
| morganfainberg | yeah this sounds like pip doing something weird | 23:47 |
| *** henrynash has quit IRC | 23:48 | |
| *** timcline has joined #openstack-keystone | 23:49 | |
| leseb- | morganfainberg: arf it broke everything | 23:50 |
| morganfainberg | :( | 23:50 |
| leseb- | pip... | 23:50 |
| morganfainberg | sorry :( | 23:50 |
| morganfainberg | pip ! bad pip! no cookie! | 23:51 |
| leseb- | enough for today, thanks for your time morganfainberg ;) | 23:52 |
| *** timcline has quit IRC | 23:54 | |
| *** rm_work is now known as rm_work|away | 23:54 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!