| *** ankita_wagh has quit IRC | 00:02 | |
| *** ankita_wagh has joined #openstack-keystone | 00:05 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystonemiddleware: Send the correct user-agent to Keystone https://review.openstack.org/180769 | 00:07 |
|---|---|---|
| *** amerine has quit IRC | 00:09 | |
| *** jaosorior has quit IRC | 00:12 | |
| *** jamielennox|away is now known as jamielennox | 00:29 | |
| *** ankita_wagh has quit IRC | 00:35 | |
| jamielennox | morganfainberg: so can i create a feature branch for keysonteclient for depending on ksa? | 00:35 |
| *** ankita_wagh has joined #openstack-keystone | 00:35 | |
| morganfainberg | You'll need to ask infra to make the branch. But yes. | 00:36 |
| morganfainberg | jamielennox: are we ready for a pre-release of ksa? | 00:36 |
| jamielennox | morganfainberg: i thought we could just push it? | 00:36 |
| morganfainberg | I don't think we can make branches in Gerrit n | 00:36 |
| jamielennox | morganfainberg: i know of a few small issues, i stared yesterday trying to depend ksc on ksa | 00:36 |
| morganfainberg | At least I wasn't able to on other projects. | 00:37 |
| jamielennox | you can depend on a git master in a pip requirements, but unless we add ksa support to devstack i'm not sure how we can test the whole thing | 00:38 |
| ayoung | samueldmq, I'm kindof in and out still, but where are we WRT V3 only? | 00:38 |
| samueldmq | ayoung, what is WRT ? | 00:39 |
| *** ankita_wagh has quit IRC | 00:40 | |
| morganfainberg | jamielennox: we just need to put it in requires. The test jobs should be all setup. | 00:40 |
| morganfainberg | samueldmq: with regard to | 00:40 |
| morganfainberg | jamielennox: it is setup the same way ksc and ksm are. | 00:41 |
| *** Raildo_ has quit IRC | 00:41 | |
| jamielennox | morganfainberg: so we need to ask dhellmann to set it up | 00:44 |
| morganfainberg | Or ttx | 00:44 |
| morganfainberg | So if we want to do the 0.x release of ksa we can now or wait until next couple fixes. | 00:45 |
| morganfainberg | I'd like to make the first real release 1.0.0 | 00:45 |
| morganfainberg | And g-r will be set to < 2.0.0 | 00:45 |
| samueldmq | morganfainberg, thx | 00:46 |
| morganfainberg | When we start using it. Or <= 1.0.0, <2.0.0 | 00:46 |
| samueldmq | ayoung, so ... I created the jobs to use v3 only (v2 disabled), let me find the link | 00:46 |
| *** blewis` has quit IRC | 00:46 | |
| samueldmq | ayoung, https://review.openstack.org/#/q/status:open+topic:identity-v3-only-jobs,n,z | 00:47 |
| *** ankita_wagh has joined #openstack-keystone | 00:59 | |
| *** ankita_wagh has quit IRC | 01:00 | |
| *** ankita_wagh has joined #openstack-keystone | 01:00 | |
| dstanek | jamielennox: my explanation on https://review.openstack.org/#/c/121667/5 is kinds of weak, but does it make sense? | 01:02 |
| jamielennox | dstanek: i have no idea what the policy is on this - i know for anything that is a requirement we need to bump the minimum but considering it's just doc generation on build i don't know if it applies | 01:03 |
| jamielennox | i put -1 on it just for a response - i always miss comments on my reviews unless it's actually -1ed | 01:03 |
| *** blewis has joined #openstack-keystone | 01:04 | |
| jamielennox | dstanek: what happens if they are using an older version - the doc generation just gets weird? | 01:05 |
| *** mkoderer has quit IRC | 01:05 | |
| ayoung | samueldmq, I saw the review, I was wondering if you had tested v3 only by hand first? Does it work? | 01:08 |
| samueldmq | ayoung, yes I did | 01:08 |
| samueldmq | ayoung, there is some work to be done in tempest (since it uses v2 in some cases, even if we set it to use v3) | 01:09 |
| ayoung | samueldmq, so if I follow the steps in the patch, I should be good. Cool. I think that my policy presentation is going to be based on that then | 01:09 |
| *** alexsyip has quit IRC | 01:09 | |
| ayoung | that is ok, this if for operators in live deployments | 01:09 |
| samueldmq | ayoung, also, devtack need to use v3 to setup its resources ( morganfainberg is taking this one ) | 01:09 |
| samueldmq | ayoung, after this, we will see failing tempest tests and submit bugs to services, until we get 100% | 01:09 |
| ayoung | samueldmq, again, not an issue for me. I'm assuming a set up cloud, and converting it over to V3 only | 01:09 |
| samueldmq | ayoung, k, services may still contain minor hard-coded issues | 01:10 |
| samueldmq | ayoung, let me know if you need anything | 01:11 |
| bknudson | dstanek: jamielennox: the change requires a newer version, so it should be in g-r first. | 01:11 |
| ayoung | samueldmq, what kind of hard coding do we anticipate? auth token is good to go, right? | 01:11 |
| ayoung | and we can do v3 only from Horizon, I've tested that | 01:11 |
| samueldmq | ayoung, yeah but tempest is more exhaustive | 01:11 |
| ayoung | Heat is V3 clean, I'm fairly certain. What else calls in to Keystone that will trip us? | 01:11 |
| samueldmq | ayoung, heat is now working with v3? | 01:12 |
| ayoung | samueldmq, assumption...I'll confirm | 01:12 |
| samueldmq | ayoung, I don't expect lots of failures, I didnt get a lot when I ran that | 01:12 |
| ayoung | but they need domains, so I think they must | 01:12 |
| dstanek | jamielennox: i can give it a try, but i think they get an error on the stderr, but the docs get generated | 01:12 |
| samueldmq | ayoung, we just need that job to make sure, and get what else we need working | 01:12 |
| ayoung | samueldmq, so the thing I want to do is avoid checking policy for V2 tokens | 01:13 |
| jamielennox | dstanek: is there likely to be a pbr bump in g-r any time soon | 01:13 |
| ayoung | cuz that only has the tenant_id in it... | 01:13 |
| samueldmq | ayoung, for example https://bugs.launchpad.net/tempest/+bug/1451987 | 01:13 |
| openstack | Launchpad bug 1451987 in tempest "Tempest against openstack deployed with keystone v3 only, fails to initialize" [Undecided,Confirmed] | 01:13 |
| ayoung | samueldmq, yeah, no surprise there | 01:13 |
| dstanek | jamielennox: good question. right now they release .11, but say .6 would work | 01:14 |
| ayoung | we m,ight need to segregate all the V2 isms out. Tempest probably needs to keep regression testing those | 01:14 |
| *** mkoderer has joined #openstack-keystone | 01:14 | |
| samueldmq | ayoung, in your deployment ? I imagine we only do this in master when we officially deprecate v2 | 01:14 |
| samueldmq | ayoung, yeah tempest have v2 specific tests, but I disabled them for now in my deploy :p | 01:14 |
| ayoung | samueldmq, I mean in Tempest....thanks, I think I have enough to go on. I might call you on the carpet during the policy presentation. Be prepared. | 01:15 |
| samueldmq | ayoung, oh | 01:15 |
| ayoung | :D | 01:15 |
| samueldmq | ayoung, share your presentation with me :) and let me know what you need me to talk , so then I can get prepared | 01:16 |
| samueldmq | :D | 01:16 |
| ayoung | samueldmq, I'm still writing it | 01:16 |
| ayoung | Nah I just might mention that policy is better off with V2 tokens only, and that you are working on making that a tested deployment option... | 01:17 |
| ayoung | well, I guess you are doiung other policy stuff, are you not... | 01:17 |
| samueldmq | ayoung, yeah if you mean dynamic policy stuff yes, it's one of my goals in L | 01:19 |
| samueldmq | ayoung, for now just working in the specs, and getting prepared to discussions at the summit :) | 01:19 |
| ayoung | ++ | 01:19 |
| samueldmq | ayoung, ' policy is better off with V2 tokens only,' | 01:19 |
| samueldmq | ayoung, v2 ? | 01:19 |
| ayoung | v3 | 01:19 |
| ayoung | meant to say that policy is better off with V3 tokens only, and that you are working on making that a tested deployment option... | 01:20 |
| samueldmq | phew | 01:20 |
| samueldmq | yeah v3 :) | 01:20 |
| samueldmq | ayoung, cool, remember the work for getting v3 in services was coordinated by jamielennox | 01:21 |
| samueldmq | ayoung, I am just on the final-lap testing with gate jobs :p | 01:21 |
| *** ncoghlan has joined #openstack-keystone | 01:23 | |
| *** rm_work|away is now known as rm_work | 01:23 | |
| jamielennox | morganfainberg: so this ksa is going to be harder than expected :( | 01:24 |
| morganfainberg | jamielennox: you kind of knew that right? | 01:25 |
| jamielennox | sure | 01:25 |
| morganfainberg | KSC will need to do the silly translation stuff to the old interfaces | 01:25 |
| jamielennox | compatibility sucks | 01:25 |
| morganfainberg | and honestly, I see a v2.0.0 of KSC dropping that compat | 01:25 |
| morganfainberg | among other things | 01:26 |
| jamielennox | returning AccessInfo from the plugins means we will need to translate from old to new object | 01:26 |
| jamielennox | like completely | 01:26 |
| bknudson | v3.0.0 of KSC | 01:26 |
| bknudson | v2 KSC drops middleware | 01:26 |
| jamielennox | bknudson: someone merged that already :) | 01:26 |
| morganfainberg | bknudson: fair enough need to rev to 2.0.0 for the next release then | 01:26 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:26 | |
| morganfainberg | bknudson: since we haven't released since that merge | 01:26 |
| morganfainberg | iirc | 01:26 |
| jamielennox | i was massively surprised given how much we try and maintain compat | 01:26 |
| morganfainberg | nah | 01:27 |
| bknudson | if we did release we'd already have a v2 | 01:27 |
| morganfainberg | middleware could die | 01:27 |
| morganfainberg | you can't use that version of ksc w/ most of the servers that would expect it | 01:27 |
| morganfainberg | dependencies would be impossible to resolve | 01:27 |
| bknudson | we're capping in the stable branches now | 01:27 |
| morganfainberg | bknudson: that too. | 01:27 |
| bknudson | otherwise we could never drop anything | 01:27 |
| morganfainberg | bknudson: we could drop the middleware | 01:27 |
| morganfainberg | bknudson: in either case | 01:27 |
| jamielennox | https://review.openstack.org/#/c/177694/ | 01:28 |
| bknudson | y, at some point the branches that needed it aren't supported anymore. | 01:28 |
| morganfainberg | bknudson: because it is highly unlikely the middleware from ksc would work with antyhing that needed it in ksc..and it might not even work in modern servers | 01:28 |
| morganfainberg | i'd say ksc.middleware was going to be dropped this cycle regardless of the stable caps | 01:28 |
| bknudson | middleware hasn't changed that much functionally | 01:28 |
| bknudson | +0, -4409 ! | 01:29 |
| morganfainberg | bknudson: but we haven't been testing it. bitrot does weird things sometimes | 01:29 |
| morganfainberg | :) | 01:29 |
| bknudson | doesn't get much better | 01:29 |
| morganfainberg | bknudson: i'm not complaining in the slightest | 01:29 |
| bknudson | I thought we'd drop more requirements? | 01:29 |
| morganfainberg | bknudson: memcache was the big one to drop | 01:29 |
| bknudson | (wasn't that kind of the point of splitting it out?) | 01:30 |
| morganfainberg | bknudson: yeah | 01:30 |
| bknudson | we already didn't have memcache | 01:30 |
| morganfainberg | in test-requires | 01:30 |
| morganfainberg | because people still ran tests at pacakge time. | 01:30 |
| morganfainberg | and it was causing issues | 01:30 |
| bknudson | https://review.openstack.org/#/c/177694/2/test-requirements.txt | 01:30 |
| morganfainberg | oh | 01:31 |
| *** aix has quit IRC | 01:31 | |
| morganfainberg | we did that before didn't we | 01:31 |
| bknudson | weird | 01:31 |
| morganfainberg | hm | 01:31 |
| morganfainberg | yeah | 01:31 |
| morganfainberg | we'd already dropped some requires then | 01:31 |
| morganfainberg | jamielennox: we really should move cms somewhere besides ksc. | 01:32 |
| bknudson | keystone-cms | 01:32 |
| morganfainberg | jamielennox: or just own up that we should maintain it in both server and ksm distinctly | 01:32 |
| morganfainberg | bknudson: it's a silly wrapper thing | 01:32 |
| morganfainberg | it doesn't really need it's own shared function. | 01:32 |
| jamielennox | morganfainberg: we might be able to keep it in kscm | 01:32 |
| jamielennox | ksm | 01:32 |
| bknudson | if we drop support for non-fernet then we can get rid of it. | 01:32 |
| morganfainberg | jamielennox: i think we can drop ksm from keystone. | 01:32 |
| morganfainberg | bknudson: or just drop support for pki(z) :P [we can | 01:33 |
| morganfainberg | 't do that] | 01:33 |
| bknudson | why not? | 01:33 |
| morganfainberg | bknudson: we can keep uuid :) | 01:33 |
| morganfainberg | bknudson: there are people who legitimately like the offload of PKI(z) | 01:33 |
| morganfainberg | and want to keep that going | 01:33 |
| bknudson | they can maintain it in stackforge | 01:33 |
| morganfainberg | we don't have to drop pki tokens. | 01:33 |
| morganfainberg | bknudson: well once we get stable driver interfaces - yes | 01:33 |
| morganfainberg | bknudson: until then... i'd say no. | 01:34 |
| morganfainberg | lbragstad: can i get you to make the right changes to devstack to support fernet tokens | 01:34 |
| jamielennox | morganfainberg: drop ksm from keystone? i'm trying to make it used | 01:35 |
| morganfainberg | jamielennox: the only reason ksm was a dep of keystone was for compat | 01:35 |
| morganfainberg | keystone.middleware.s3 | 01:35 |
| *** amerine has joined #openstack-keystone | 01:35 | |
| morganfainberg | that can probably go away now | 01:35 |
| jamielennox | morganfainberg: https://review.openstack.org/#/c/180818/ | 01:35 |
| morganfainberg | oh | 01:36 |
| morganfainberg | sure | 01:36 |
| morganfainberg | and we lose authcontext being separate logic | 01:36 |
| morganfainberg | sure | 01:36 |
| jamielennox | morganfainberg, bknudson: so part of what i was trying out with that branch is refactor auth_token so that we can have an abstract fetch_token method | 01:36 |
| jamielennox | and share the rest of the logic between keystone and auth_token | 01:36 |
| *** samleon has quit IRC | 01:36 | |
| bknudson | keystone is going to call ksm? | 01:37 |
| jamielennox | bknudson: i want to remove the keystone auth_context middleware in favour of something that subclasses AuthProtocol | 01:38 |
| jamielennox | well - not exactly that but conceptually the same | 01:38 |
| bknudson | I think the shared parts should go in a different library that they both use | 01:39 |
| bknudson | e.g., keystoneclient | 01:39 |
| morganfainberg | bknudson: *cough* ksa | 01:39 |
| morganfainberg | bknudson: :P | 01:39 |
| *** amerine has quit IRC | 01:40 | |
| jamielennox | so this is pretty much what i want from a session at summit | 01:40 |
| jamielennox | how auth flows through other projects, how it flows through keystone | 01:40 |
| morganfainberg | jamielennox: we have a spare fishbowl | 01:41 |
| morganfainberg | if you want to make it more than just a working session | 01:41 |
| jamielennox | whether we want a token model in client | 01:41 |
| bknudson | I think there's enough interest in a shared context for a fishbowl | 01:41 |
| bknudson | and we need to get in sync with oslo | 01:41 |
| morganfainberg | bknudson: sure. happy to publish this into the last fishbowl | 01:41 |
| jamielennox | there is still token validation stuff which i *think* means we should use ksm from keystone, but it might be just easier to move it all to ksa or ksc | 01:41 |
| jamielennox | morganfainberg: i'm not sure what a "working session" for client would involve | 01:42 |
| morganfainberg | jamielennox: approving code? assigning bugs to people? getting reviews done | 01:42 |
| bknudson | working session is you typing at the keyboard and we're all complaining | 01:42 |
| jamielennox | ooo | 01:42 |
| morganfainberg | jamielennox: working sessions are open. | 01:42 |
| bknudson | or cheering! | 01:42 |
| jamielennox | my open review list has got crazy long | 01:42 |
| morganfainberg | fishbowl is what the design sessions from previous summits are | 01:42 |
| dstanek | bknudson: best session ever | 01:43 |
| jamielennox | i don't need a hundred people there, | 01:43 |
| jamielennox | cores and actually interested people is good | 01:43 |
| bknudson | we need oslo folks too, so let's advertise it | 01:43 |
| jamielennox | though that's pretty much who we talked to in the other sessions so it really doesn't matter | 01:44 |
| bknudson | what you're proposing is a fundamental change that requires coordination | 01:44 |
| bknudson | otherwise everyone goes off in the weeds and we have to drag them back | 01:44 |
| *** zzzeek has quit IRC | 01:44 | |
| jamielennox | bknudson, morganfainberg: ok advertise the crap out of it | 01:46 |
| jamielennox | coordinating auth across services | 01:46 |
| dstanek | so i'm trying to follow the conversation here, but it's a little difficult - has any of this been written up as a spec? | 01:49 |
| jamielennox | dstanek: some | 01:51 |
| jamielennox | but there's more of a big picture how things tie together which still isn't fully developed and would be nice to hash out | 01:52 |
| dstanek | jamielennox: fair enough - i'm just looking to get as much background reading as i can find for the summit | 01:57 |
| jamielennox | dstanek: so there's nothing about using auth_token in keystone - that's something we've been slowly working towards for a couple of cycles now | 01:58 |
| *** dims_ has quit IRC | 02:00 | |
| *** dims has joined #openstack-keystone | 02:00 | |
| *** dims has quit IRC | 02:01 | |
| morganfainberg | I'll push that fishbowl update tonight. | 02:02 |
| morganfainberg | dstanek: the qa work session we might need to go camp in mtreinish 's work session too :P | 02:02 |
| morganfainberg | dstanek: but we got it cross listed. | 02:03 |
| dstanek | morganfainberg: i have my eye on some of the QA things already | 02:04 |
| morganfainberg | Cool. | 02:05 |
| morganfainberg | jamielennox: give me a title for the new fishbowl. | 02:05 |
| jamielennox | umm | 02:06 |
| *** david-lyle has joined #openstack-keystone | 02:10 | |
| jamielennox | consuming auth across services - it's horribe but i don't know what else | 02:10 |
| jamielennox | i want to figure out how we coordinate driving all this new policy stuff, and essentially hooking into oslo.context etc | 02:11 |
| jamielennox | i have ideas | 02:11 |
| *** browne has quit IRC | 02:23 | |
| *** stevemar has joined #openstack-keystone | 02:23 | |
| *** ChanServ sets mode: +v stevemar | 02:23 | |
| *** r-daneel has quit IRC | 02:40 | |
| ayoung | morganfainberg, one thing that ties in with that: when enforcing policy, we sometimes need an object out of the database to be passed in to the policy engine. It would be wonderful if we found a way to standardize that such that we could do a policy middleware. | 02:42 |
| jamielennox | ayoung: yep - i've got that, though not the db, from the token | 02:43 |
| jamielennox | because i'm thinking of the other services first | 02:43 |
| ayoung | jamielennox, the issue we have is worst in Keystone, as we put the thing we want to scope on all over the place. project/tenant depending on v2 opr v3, but also domain on user, group, project for role assignments...but fot the other services, the same issue | 02:45 |
| ayoung | when an API call only specifies the id of the object, they need to fetch the object first, then figure out where the project_id is on it. Its all over nova for example | 02:46 |
| ayoung | and then ,tehre is the question of whether any of the other services try to extend the auth info | 02:46 |
| jamielennox | ayoung: i'm trying to reverse my thinking on the 'keystone is special' front. I know keystone is going to be different for all these policy problems, but keystone is also the place where we can most easily maintain those differences ourselves. | 02:46 |
| ayoung | jamielennox, agreed | 02:47 |
| jamielennox | I want any solution we come up with to be targetted first at making things easier for all the other services and then keystone can extend that where required | 02:47 |
| ayoung | jamielennox, its not that keystone is special in that it needs special treatment, more like it is is special in a "it is all over the place and needs to behave better"sort of way | 02:47 |
| jamielennox | right - we will need a way to enforce policy on a loaded object and that's fine | 02:48 |
| ayoung | just that Keystone shows the problem clearest with the v3 cloudsample | 02:48 |
| jamielennox | i just want to standardize the process | 02:48 |
| *** stevemar has quit IRC | 02:49 | |
| jamielennox | right - it's mostly just that the other services have not yet tried to tackle the problem | 02:50 |
| *** browne has joined #openstack-keystone | 02:55 | |
| *** Ephur has quit IRC | 02:56 | |
| *** richm has quit IRC | 02:57 | |
| *** smallbig has joined #openstack-keystone | 03:00 | |
| *** eglute has joined #openstack-keystone | 03:01 | |
| *** dims has joined #openstack-keystone | 03:01 | |
| *** dims has quit IRC | 03:06 | |
| bigjools | ayoung: thanks for the tweet :) | 03:08 |
| ayoung | bigjools, thank you for the effort | 03:11 |
| ayoung | bigjools, see you in Vancouver? | 03:11 |
| bigjools | ayoung: sadly no, I could have gone if it wasn't for a prior engagement that could not be moved | 03:11 |
| bigjools | see you in Tokyo? :) | 03:11 |
| ayoung | bigjools, getting married? | 03:11 |
| bigjools | hah | 03:11 |
| bigjools | no, medical | 03:11 |
| ayoung | Yeah, I think I'll be in Tokyo | 03:12 |
| bigjools | I owe beers to two people there now | 03:12 |
| ayoung | jamielennox, 10.10.10.40 - - [08/May/2015:03:10:23 +0000] "GET /v2.0 HTTP/1.1" 404 93 "-" "python-keystoneclient" << in tghe Nova logs | 03:12 |
| ayoung | its trying to use v2 to validate tokens. | 03:12 |
| ayoung | jamielennox, but there is no explicit V2 or v2.0 in the conf | 03:13 |
| ayoung | jamielennox, and I hacked the service catalog to only have /v3 in theere | 03:13 |
| ayoung | how is it getting V2? | 03:14 |
| ayoung | samueldmq, ^^ same question...how is it getting v2? | 03:15 |
| *** Qiming has joined #openstack-keystone | 03:18 | |
| *** lhcheng has joined #openstack-keystone | 03:20 | |
| *** ChanServ sets mode: +v lhcheng | 03:20 | |
| *** r-daneel has joined #openstack-keystone | 03:26 | |
| *** r-daneel has quit IRC | 03:31 | |
| *** yasu_ has joined #openstack-keystone | 03:36 | |
| *** ankita_w_ has joined #openstack-keystone | 03:45 | |
| *** r-daneel has joined #openstack-keystone | 03:46 | |
| *** ankita_wagh has quit IRC | 03:49 | |
| jamielennox | ayoung: i don't know - what's the config look like? | 03:50 |
| jamielennox | you using the generic password plugin? | 03:50 |
| ayoung | jamielennox, It looks all commented out. | 03:50 |
| samueldmq | ayoung, jamielennox hard-coded I guess | 03:50 |
| ayoung | hmmm... | 03:50 |
| ayoung | auth_uri=http://10.10.10.40:5000/ | 03:51 |
| ayoung | I even set auth_version=v3 | 03:51 |
| ayoung | although I should not have too | 03:51 |
| jamielennox | ayoung: the weird part is that it's GET /v2.0 because that means it's looking up the version list from /v2 and i don't know why | 03:52 |
| jamielennox | actually it shouldn't return a 404 from /v2.0 either | 03:52 |
| jamielennox | is this auth_token? | 03:52 |
| ayoung | jamielennox, that is my doing | 03:52 |
| ayoung | I disabled v2.0 | 03:52 |
| ayoung | jamielennox, yes, this is the authtoken seciotn of nova.conf | 03:53 |
| ayoung | although, to be fair, wI looked in the keystone log and it doesn ot say which component called it, just that it was keystoneclient | 03:53 |
| samueldmq | ayoung, and does ksclient know the service is using it ? | 03:54 |
| jamielennox | ayoung: auth_uri is not the one, it's auth_url | 03:55 |
| ayoung | samueldmq, what I pasted above was out of the log...let me see which log | 03:55 |
| jamielennox | these names are a problem | 03:55 |
| ayoung | jamielennox, that is commented out. Let me uncomment and try again | 03:55 |
| ayoung | #admin_auth_url=http://localhost:5000/v2.0 | 03:55 |
| jamielennox | just auth_url | 03:56 |
| jamielennox | http://www.jamielennox.net/blog/2015/02/23/v3-authentication-with-auth-token-middleware/ | 03:56 |
| ayoung | jamielennox, nope | 03:58 |
| jamielennox | ayoung: is it on a machine i can look at? | 03:59 |
| ayoung | sure | 03:59 |
| ayoung | kinit jlennox@YOUNGLOGIC.COM and then ssh to http://rdo.younglogic.net/ | 03:59 |
| ayoung | nothing quite like coding in production | 03:59 |
| ayoung | had it in the wrong section...trying again | 04:02 |
| jamielennox | ayoung: ok in | 04:02 |
| jamielennox | what am i looking at? | 04:02 |
| jamielennox | is it packstack? | 04:03 |
| ayoung | sudo vi /etc/nova/nova.conf | 04:03 |
| ayoung | yeah, packstack | 04:03 |
| ayoung | auth_url=http://10.10.10.40:5000/ | 04:03 |
| ayoung | sudo less /var/log/httpd/keystone_wsgi_admin_access.log | 04:03 |
| jamielennox | i don't have sudo | 04:03 |
| ayoung | no? | 04:03 |
| ayoung | ah, one sec | 04:03 |
| ayoung | jamielennox, I just added you to wheel, log out and back in and you should see it | 04:04 |
| ayoung | what I am doing is checking the dashboard, but using the cli works too. keystonerc info is in root | 04:05 |
| jamielennox | ayoung: auth_host etc? yea that's not going to work | 04:06 |
| ayoung | that was what was set up by default..should I comment those out? | 04:06 |
| ayoung | jamielennox, if you make changes, you can run the following to force a restart of all nova services | 04:06 |
| ayoung | for SVC in $( sudo systemctl | awk '/openstack-nova/ {print $1}' ) ; do echo $SVC ; sudo systemctl restart $SVC ; done | 04:06 |
| ayoung | runs fast enough | 04:06 |
| jamielennox | i'll change now | 04:07 |
| ayoung | jamielennox, I should have made a copy of the origianl file to see the diff... | 04:09 |
| samueldmq | ayoung, jamielennox a new version of the patch which defines the flag for v3 only in devstack | 04:09 |
| samueldmq | ayoung, jamielennox https://review.openstack.org/#/c/179663/ | 04:09 |
| samueldmq | I have to hit the sack ... talk to you tomorrow | 04:09 |
| jamielennox | ayou domain name = Default? | 04:09 |
| jamielennox | ayoung: ^ | 04:10 |
| ayoung | jamielennox, uh I think so... | 04:10 |
| ayoung | yes | 04:10 |
| *** samueldmq has quit IRC | 04:11 | |
| jamielennox | ayoung: ok, updated try again | 04:12 |
| jamielennox | also only the api servers use auth_token so you only need to restart nova-api (unless novas doing something naughty with auth options) | 04:12 |
| ayoung | jamielennox, that seems to work | 04:13 |
| ayoung | let me see what you did, and I can reproduce for cinder glance and neutron | 04:13 |
| ayoung | jamielennox, auth_url is set twice | 04:14 |
| jamielennox | one is auth_uri | 04:14 |
| ayoung | auth_url = http://10.10.10.40:35357 | 04:14 |
| ayoung | and | 04:14 |
| jamielennox | bad naming | 04:14 |
| ayoung | auth_url=http://10.10.10.40:5000/ | 04:14 |
| jamielennox | it's unfortunate | 04:14 |
| ayoung | nah, this was me | 04:14 |
| jamielennox | oh - ok, yea well with v3 it doesn't matter | 04:14 |
| ayoung | jamielennox, should I comment out all but the block you did at the top? | 04:15 |
| ayoung | just to be clear what is actually working? | 04:15 |
| ayoung | OK, I broke it again | 04:16 |
| jamielennox | i just changed that block, i thought i commented out the rest of it but if i didn't the auth plugin options should be read in priority | 04:17 |
| ayoung | jamielennox, I think it needs a couple of the other values to work. | 04:19 |
| ayoung | I'm going to move them all together... one sec | 04:19 |
| *** rm_work is now known as rm_work|away | 04:19 | |
| ayoung | ok it works now. commenting out the second auth_url (with 5000) | 04:21 |
| ayoung | OPK...taht is not needed | 04:21 |
| ayoung | it needs the version string | 04:22 |
| ayoung | #auth_version=v3 breaks it | 04:22 |
| ayoung | and it needs the port for some reason | 04:23 |
| ayoung | trying commenting out auth_host as welll | 04:23 |
| ayoung | ok, if you set one, you need to set the other. removing both of those works again | 04:24 |
| jamielennox | auth_version=v3 shouldn't be required | 04:24 |
| jamielennox | there was that bug remember where auth_version was being set in the nova-dist.conf files | 04:24 |
| jamielennox | so maybe that's still set | 04:24 |
| ayoung | ah...I et | 04:25 |
| ayoung | bet | 04:25 |
| ayoung | # Workaround for https://bugs.launchpad.net/nova/+bug/1154809 | 04:25 |
| ayoung | auth_version = v2.0 | 04:25 |
| openstack | Launchpad bug 1154809 in python-keystoneclient "Volume detach fails via OSAPI: AmbiguousEndpoints" [Wishlist,Confirmed] | 04:25 |
| jamielennox | yea, it's been dead for ages, we had a RHOS bug for it and i think it was fixed | 04:26 |
| ayoung | but even if I comment that out it still fails | 04:26 |
| ayoung | gonna comment out all that secion | 04:26 |
| ayoung | those dist files are just confusing as all get out. THey need to die | 04:27 |
| *** rushiagr_away is now known as rushiagr | 04:27 | |
| ayoung | yep...once I kill all those values, tjhe block you set works. | 04:27 |
| ayoung | ok, let me fix the other services | 04:28 |
| ayoung | jamielennox, glance was easy, but cinder does not have an authtoken section | 04:39 |
| ayoung | there is one in the /usr./share/cinder/*dist file | 04:40 |
| ayoung | but I don't know where to find the service pasword | 04:41 |
| jamielennox | oh god | 04:41 |
| jamielennox | there is an authtoken section in the cinder dist file? | 04:41 |
| jamielennox | file that as a bug | 04:42 |
| *** rm_work|away is now known as rm_work | 04:44 | |
| ayoung | yeah, but I killed that. the actual thing I was looking for was in paste | 04:44 |
| ayoung | l[filter:authtoken] | 04:44 |
| jamielennox | oh yea, that's pretty normal, would like to kill that too | 04:44 |
| ayoung | jamielennox, got it | 04:46 |
| ayoung | OK, all services reporting in normal | 04:46 |
| ayoung | I don't think I have neutron on this | 04:46 |
| ayoung | jamielennox, now that we have that, we can enforce policy on all the fields of the v3 token, and only those fields... | 04:48 |
| ayoung | but tommorrowwwww | 04:48 |
| jamielennox | ayoung: i'm super surprised that it works this effectively | 04:48 |
| ayoung | jamielennox, I'm not. You built a good mechanism, we just need to clear out the old cruft | 04:49 |
| jamielennox | there are plenty of places that still require v2 auth | 04:49 |
| ayoung | yeah. I think I'll just lie and say they don't exist | 04:49 |
| ayoung | do you know where? | 04:49 |
| jamielennox | umm, a lot of glance | 04:50 |
| jamielennox | anything that talks to swift | 04:50 |
| jamielennox | it's all the services that have there own admin auth credentials | 04:50 |
| jamielennox | there was a bunch of ironic that i don't know if it ever got fixed | 04:51 |
| jamielennox | you find them when you try and put service users in the non-default domain - though i would expect disabling v2 would have done the same thing | 04:51 |
| ayoung | jamielennox, I have not done a slew of glance stuff here | 04:52 |
| ayoung | it might be that glance does v2 if it needs to talk to swift? | 04:52 |
| jamielennox | um, i think when it talks to cinder it is v2 only | 04:53 |
| ayoung | joy | 04:53 |
| jamielennox | but then a lot of these things are old options that may not be required any more | 04:53 |
| ayoung | jamielennox, I have a unified policy file for glance, cinder and nova | 04:54 |
| ayoung | I wanted to push keystone in there too, but I think it would only work v3 pure | 04:54 |
| ayoung | meaning that any v2 tokens would be not-allowed...but that might be ok | 04:54 |
| ayoung | question is if Horizon does V3, will that work for the Glance V2 isms... | 04:55 |
| ayoung | I'm guessing yes | 04:55 |
| jamielennox | i don't follow | 04:55 |
| jamielennox | it will work for glance it just doesn't necessarily yet | 04:57 |
| *** gokrokve has joined #openstack-keystone | 04:58 | |
| *** emagana has joined #openstack-keystone | 05:07 | |
| *** gokrokve has quit IRC | 05:09 | |
| *** gokrokve has joined #openstack-keystone | 05:10 | |
| *** gokrokve has quit IRC | 05:13 | |
| *** gokrokve has joined #openstack-keystone | 05:13 | |
| *** gokrokve has quit IRC | 05:18 | |
| *** Qiming has quit IRC | 05:21 | |
| *** Qiming has joined #openstack-keystone | 05:22 | |
| *** lhcheng has quit IRC | 05:31 | |
| *** gokrokve has joined #openstack-keystone | 05:40 | |
| *** gokrokve has quit IRC | 05:42 | |
| *** gokrokve has joined #openstack-keystone | 05:42 | |
| *** emagana has quit IRC | 05:44 | |
| *** emagana has joined #openstack-keystone | 05:45 | |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Enable service role to list/get users https://review.openstack.org/181298 | 05:49 |
| *** emagana has quit IRC | 05:49 | |
| *** kiran-r has joined #openstack-keystone | 05:51 | |
| *** belmoreira has joined #openstack-keystone | 06:04 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/179331 | 06:07 |
| *** r-daneel has quit IRC | 06:15 | |
| *** lhcheng has joined #openstack-keystone | 06:21 | |
| *** ChanServ sets mode: +v lhcheng | 06:21 | |
| *** pnavarro has joined #openstack-keystone | 06:28 | |
| *** markvoelker has quit IRC | 06:33 | |
| *** ajayaa has joined #openstack-keystone | 06:34 | |
| *** kiran-r has quit IRC | 06:37 | |
| *** ccard has quit IRC | 06:46 | |
| *** Qiming_ has joined #openstack-keystone | 06:48 | |
| *** Qiming has quit IRC | 06:48 | |
| *** rushiagr is now known as rushiagr_away | 07:04 | |
| *** ankita_w_ has quit IRC | 07:04 | |
| *** ankita_wagh has joined #openstack-keystone | 07:05 | |
| *** e0ne has joined #openstack-keystone | 07:09 | |
| *** ankita_wagh has quit IRC | 07:10 | |
| *** krykowski has joined #openstack-keystone | 07:17 | |
| *** junhongl has quit IRC | 07:21 | |
| *** junhongl has joined #openstack-keystone | 07:21 | |
| *** e0ne has quit IRC | 07:29 | |
| *** e0ne has joined #openstack-keystone | 07:33 | |
| *** jamielennox is now known as jamielennox|away | 07:36 | |
| *** lhcheng has quit IRC | 07:37 | |
| *** ajayaa has quit IRC | 07:40 | |
| *** rushiagr_away is now known as rushiagr | 07:40 | |
| *** kiran-r has joined #openstack-keystone | 07:41 | |
| *** ccard has joined #openstack-keystone | 07:54 | |
| *** browne has quit IRC | 08:02 | |
| *** ajayaa has joined #openstack-keystone | 08:03 | |
| *** markvoelker has joined #openstack-keystone | 08:07 | |
| *** Qiming_ is now known as Qiming | 08:09 | |
| *** kiranr has joined #openstack-keystone | 08:10 | |
| *** kiran-r has quit IRC | 08:10 | |
| *** ncoghlan has quit IRC | 08:18 | |
| *** jaosorior has joined #openstack-keystone | 08:19 | |
| *** chlong has quit IRC | 08:20 | |
| *** e0ne has quit IRC | 08:23 | |
| kiranr | Hi! Can anybody explain me, if we can have 2 endpoints say IP1:5000 for get token and IP2:35357 for other keystone apiś? | 08:25 |
| *** lhcheng has joined #openstack-keystone | 08:38 | |
| *** ChanServ sets mode: +v lhcheng | 08:38 | |
| *** markvoelker has quit IRC | 08:38 | |
| *** lhcheng has quit IRC | 08:42 | |
| *** e0ne has joined #openstack-keystone | 08:58 | |
| *** e0ne is now known as e0ne_ | 08:58 | |
| *** e0ne_ is now known as e0ne | 09:07 | |
| *** e0ne is now known as e0ne_ | 09:21 | |
| *** kiranr is now known as kiran-r | 09:26 | |
| *** krykowski has quit IRC | 09:29 | |
| *** krykowski has joined #openstack-keystone | 09:29 | |
| *** e0ne_ is now known as e0ne | 09:55 | |
| *** krykowski has quit IRC | 09:59 | |
| *** krykowski has joined #openstack-keystone | 10:24 | |
| *** lhcheng has joined #openstack-keystone | 10:27 | |
| *** ChanServ sets mode: +v lhcheng | 10:27 | |
| *** lhcheng has quit IRC | 10:31 | |
| *** gsagie_ has joined #openstack-keystone | 10:33 | |
| gsagie_ | Hello, i am running a 2 nodes setup with devstack, when the controller is up everything works fine, when i start the compute node ./stach.sh after it goes up i suddenly can't access the API in the controller, for example when i try to do "neutron port-list" i get a message like this "Couldn't find Networking in Region One..." (something like that) | 10:35 |
| gsagie_ | anyone familiar with that problem? | 10:35 |
| *** markvoelker has joined #openstack-keystone | 10:35 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone-specs: Updated endpoint enforcement spec https://review.openstack.org/174799 | 10:39 |
| *** markvoelker has quit IRC | 10:40 | |
| lbragstad | morganfainberg: sure thing, I'll look into it | 10:44 |
| *** krykowski has quit IRC | 10:47 | |
| *** samueldmq has joined #openstack-keystone | 10:49 | |
| *** Qiming has quit IRC | 10:49 | |
| samueldmq | morning | 10:49 |
| *** krykowski has joined #openstack-keystone | 10:53 | |
| *** e0ne is now known as e0ne_ | 10:56 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Handles Python3 builtin changes https://review.openstack.org/177411 | 11:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes use of dict methods for Python3 https://review.openstack.org/177410 | 11:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes deprecations test for Python3 https://review.openstack.org/177415 | 11:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: Add mocking for ldappool for Python3 tests https://review.openstack.org/177414 | 11:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes a whitespace issue https://review.openstack.org/177413 | 11:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: Handles modules that moved in Python3 https://review.openstack.org/177412 | 11:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: basestring no longer exists in Python3 https://review.openstack.org/177418 | 11:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: Add mocking for memcache for Python3 tests https://review.openstack.org/177417 | 11:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactor deprecations tests https://review.openstack.org/177416 | 11:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes broken federation test https://review.openstack.org/181360 | 11:01 |
| samueldmq | dstanek, oh that patch chain :) | 11:05 |
| *** ajayaa has quit IRC | 11:05 | |
| samueldmq | dstanek, although you updated patches, gerrit still is showing 'patch in merge conflict' and the previous votes :/ | 11:06 |
| samueldmq | maybe that's broken | 11:06 |
| *** davidckennedy has joined #openstack-keystone | 11:06 | |
| samueldmq | (gerrit) | 11:06 |
| *** gsagie_ has quit IRC | 11:10 | |
| dstanek | wow, that's weird | 11:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Handles Python3 builtin changes https://review.openstack.org/177411 | 11:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes use of dict methods for Python3 https://review.openstack.org/177410 | 11:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes deprecations test for Python3 https://review.openstack.org/177415 | 11:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Add mocking for ldappool for Python3 tests https://review.openstack.org/177414 | 11:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes a whitespace issue https://review.openstack.org/177413 | 11:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Handles modules that moved in Python3 https://review.openstack.org/177412 | 11:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: basestring no longer exists in Python3 https://review.openstack.org/177418 | 11:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Add mocking for memcache for Python3 tests https://review.openstack.org/177417 | 11:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactor deprecations tests https://review.openstack.org/177416 | 11:11 |
| dstanek | no, conflict. so i don't know what happened | 11:11 |
| *** dims has joined #openstack-keystone | 11:13 | |
| *** e0ne_ is now known as e0ne | 11:14 | |
| *** ajayaa has joined #openstack-keystone | 11:22 | |
| *** dims has quit IRC | 11:28 | |
| *** e0ne is now known as e0ne_ | 11:28 | |
| *** dims has joined #openstack-keystone | 11:29 | |
| *** e0ne_ is now known as e0ne | 11:30 | |
| *** jsheeren has joined #openstack-keystone | 11:30 | |
| *** markvoelker has joined #openstack-keystone | 11:36 | |
| *** yasu_ has quit IRC | 11:49 | |
| *** r-daneel has joined #openstack-keystone | 11:50 | |
| *** Qiming has joined #openstack-keystone | 11:54 | |
| *** r-daneel has quit IRC | 11:56 | |
| *** kiranr has joined #openstack-keystone | 12:02 | |
| *** kiran-r has quit IRC | 12:02 | |
| baffle | I have a domain-level role called "domain_admin". I want this role to be able to grant roles, but not the magic "admin" role. How can I stop that from happening in policy.json? | 12:05 |
| baffle | Also, isn't identity:create_credential basically the same as identity:ec2_create_credential? Shouldn't the policy be the same? | 12:06 |
| *** markvoelker has quit IRC | 12:07 | |
| *** markvoelker has joined #openstack-keystone | 12:07 | |
| *** e0ne is now known as e0ne_ | 12:10 | |
| *** amakarov_away is now known as amakarov | 12:10 | |
| *** e0ne_ is now known as e0ne | 12:13 | |
| *** kiranr is now known as kiran-r | 12:16 | |
| *** lmtaylor has joined #openstack-keystone | 12:27 | |
| *** gordc has joined #openstack-keystone | 12:29 | |
| *** topol has joined #openstack-keystone | 12:35 | |
| *** ChanServ sets mode: +v topol | 12:35 | |
| *** rushiagr is now known as rushiagr_away | 12:37 | |
| *** Qiming_ has joined #openstack-keystone | 12:42 | |
| *** bknudson has quit IRC | 12:43 | |
| *** raildo has quit IRC | 12:43 | |
| ekarlso | Hi guys, what ports does authtoken use to communicate towards ks with ? | 12:44 |
| ekarlso | 5000, 35357 or both ? | 12:45 |
| *** Qiming has quit IRC | 12:46 | |
| *** chlong has joined #openstack-keystone | 12:46 | |
| *** joesavak has joined #openstack-keystone | 12:49 | |
| *** raildo has joined #openstack-keystone | 12:51 | |
| lbragstad | raildo: samueldmq ping | 12:53 |
| raildo | lbragstad, hi | 12:56 |
| *** e0ne is now known as e0ne_ | 12:56 | |
| lbragstad | the 'is_domain' functionality is accessible to the end-user, right? So does that mean we should add it to the current jsonschema checking for domains? http://cdn.pasteraw.com/5z1vhufy7vw8skpc678gm1xtb7bubzy for example? | 12:56 |
| lbragstad | this is the patch I'm referencing https://review.openstack.org/#/c/158372/51 | 12:56 |
| ekarlso | noone knows ? :p | 12:56 |
| lbragstad | ekarlso: are you using v3? | 12:56 |
| lbragstad | ekarlso: I don't think it matters if you're using v3? | 12:57 |
| *** e0ne_ is now known as e0ne | 12:57 | |
| ekarlso | lbragstad: THANK you so much ! | 12:57 |
| raildo | lbragstad, yes... is_domain functionality is accessible to the end-user, as a project property. | 12:59 |
| lbragstad | ekarlso: you set the URI for auth_token to talk to keystone https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L241 | 12:59 |
| raildo | lbragstad, as we have added here: https://review.openstack.org/#/c/157427/56/keystone/resource/schema.py | 12:59 |
| lbragstad | http://cdn.pasteraw.com/nm0s0jbijwqknyslwtd8zm1fchbanbh | 12:59 |
| lbragstad | ah.. gotcha | 13:00 |
| lbragstad | raildo: ok | 13:00 |
| raildo | lbragstad, :) | 13:00 |
| *** blewis has quit IRC | 13:08 | |
| *** rushiagr_away is now known as rushiagr | 13:09 | |
| *** jsheeren has quit IRC | 13:11 | |
| *** bknudson has joined #openstack-keystone | 13:11 | |
| *** ChanServ sets mode: +v bknudson | 13:11 | |
| samueldmq | lbragstad, hi , sorry I was afk, reading up | 13:12 |
| *** richm has joined #openstack-keystone | 13:13 | |
| samueldmq | lbragstad, yeah, I do agree it should be included in the json schema, as it affects the representation given to the end-user | 13:13 |
| lbragstad | samueldmq: cool, I was just curious if it was going to be in that patch but it looks like you guys addressed it in a different one, so that's good. | 13:14 |
| samueldmq | lbragstad, ++ | 13:14 |
| samueldmq | raildo, we addressed this json schmea change for the is_domain attribute ? ^ | 13:14 |
| raildo | samueldmq, yes... in the project schema, but we don't have to add this in the domain schema. | 13:15 |
| *** EmilienM|afk is now known as EmilienM | 13:15 | |
| samueldmq | raildo, k since we are not changing the domain representation | 13:16 |
| samueldmq | raildo, lbragstad makes sense thanks | 13:16 |
| raildo | samueldmq, yes, is_domain attribute is only visible in a project, since for domains it always true, so, doesn't make sense include this there. | 13:17 |
| samueldmq | raildo, ++ sure :) | 13:18 |
| *** dims has quit IRC | 13:19 | |
| *** dims has joined #openstack-keystone | 13:20 | |
| *** jsavak has joined #openstack-keystone | 13:25 | |
| kiran-r | Hi! I have a problem here, I am using keystone v2 auth. Here I have different adminURL and publicURL and the adminURL is not accessible externally. I am able to use other clients but not keystone CLI´s since they are unable to reach the adminURL. http://paste.openstack.org/show/217090/ | 13:25 |
| kiran-r | Please help me understand. =) | 13:26 |
| kiran-r | and solve the problem | 13:26 |
| *** joesavak has quit IRC | 13:27 | |
| *** lmtaylor has quit IRC | 13:36 | |
| openstackgerrit | Doug Hellmann proposed openstack/python-keystoneclient: Drop use of 'oslo' namespace package https://review.openstack.org/180688 | 13:37 |
| *** jsavak has quit IRC | 13:48 | |
| *** openstackgerrit has quit IRC | 13:51 | |
| *** dims is now known as dimsum__ | 13:51 | |
| *** openstackgerrit has joined #openstack-keystone | 13:51 | |
| *** samueldmq has quit IRC | 13:57 | |
| *** blewis has joined #openstack-keystone | 13:58 | |
| *** blewis has quit IRC | 13:59 | |
| *** htruta has joined #openstack-keystone | 14:04 | |
| *** lhcheng has joined #openstack-keystone | 14:04 | |
| *** ChanServ sets mode: +v lhcheng | 14:04 | |
| *** lmtaylor has joined #openstack-keystone | 14:08 | |
| *** lhcheng has quit IRC | 14:09 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:13 | |
| *** kiran-r has quit IRC | 14:16 | |
| *** kiran-r has joined #openstack-keystone | 14:17 | |
| *** gokrokve_ has joined #openstack-keystone | 14:21 | |
| *** kiran-r has quit IRC | 14:22 | |
| *** gokrokve has quit IRC | 14:25 | |
| breton | folks | 14:30 |
| breton | what is X-SERVICE-TOKEN? | 14:30 |
| breton | it is in the "implemented" directory of keystone-specs | 14:30 |
| breton | but grep shows that ks knows nothing about it | 14:31 |
| *** gokrokve_ has quit IRC | 14:31 | |
| *** gokrokve has joined #openstack-keystone | 14:31 | |
| *** emagana has joined #openstack-keystone | 14:32 | |
| morganfainberg | breton: it's all in keystone middleware. | 14:37 |
| morganfainberg | breton: it allows a service to have separate authorization (eg make it so nova/glance/etc) can add an extra layer in so glance can control data it puts into swift (for example) but still have it "owned" by the user. | 14:38 |
| morganfainberg | The user couldn't circumvent glance and change the data in swift. | 14:39 |
| morganfainberg | Just as an example. | 14:39 |
| morganfainberg | jamielennox|away: ^^ see the spec from annegentle | 14:39 |
| morganfainberg | mordred: fwiw I'm looking forward to the x-project session on service catalog. | 14:40 |
| *** browne has joined #openstack-keystone | 14:44 | |
| *** packet has joined #openstack-keystone | 14:45 | |
| mordred | morganfainberg: yes. I am to | 14:49 |
| *** stevemar has joined #openstack-keystone | 14:54 | |
| *** ChanServ sets mode: +v stevemar | 14:54 | |
| *** e0ne is now known as e0ne_ | 14:55 | |
| *** mtecer has joined #openstack-keystone | 14:58 | |
| stevemar | nkinder, o/ | 15:00 |
| nkinder | stevemar: hey! | 15:01 |
| *** ajayaa has quit IRC | 15:02 | |
| morganfainberg | mordred: lots of concerns and potential API contract issues there. I think we can resolve most of them in the session. | 15:02 |
| *** e0ne_ is now known as e0ne | 15:07 | |
| *** mflobo has quit IRC | 15:07 | |
| *** josecastroleon has quit IRC | 15:08 | |
| mordred | morganfainberg: I'll be standing by the door with a bat to make sure we do | 15:15 |
| *** ajayaa has joined #openstack-keystone | 15:16 | |
| morganfainberg | Haha. Nice! | 15:17 |
| morganfainberg | I tossed most of my concerns on the spec already. | 15:17 |
| *** belmoreira has quit IRC | 15:18 | |
| *** henrynash has joined #openstack-keystone | 15:19 | |
| *** ChanServ sets mode: +v henrynash | 15:19 | |
| *** henrynash has quit IRC | 15:20 | |
| amakarov | morganfainberg, hi! | 15:22 |
| amakarov | I have a spec here: https://review.openstack.org/#/c/173424 about HMT optimization | 15:23 |
| amakarov | Can you please look at it? | 15:24 |
| *** rm_work is now known as rm_work|away | 15:32 | |
| *** mtecer has quit IRC | 15:35 | |
| *** blewis` has joined #openstack-keystone | 15:37 | |
| *** henrynash has joined #openstack-keystone | 15:38 | |
| *** ChanServ sets mode: +v henrynash | 15:38 | |
| *** Qiming_ has quit IRC | 15:39 | |
| *** henrynash has quit IRC | 15:47 | |
| *** zzzeek has joined #openstack-keystone | 15:48 | |
| *** krykowski has quit IRC | 15:48 | |
| *** gyee has joined #openstack-keystone | 15:52 | |
| *** ChanServ sets mode: +v gyee | 15:52 | |
| *** openstackstatus has quit IRC | 15:56 | |
| *** esp has joined #openstack-keystone | 15:56 | |
| *** henrynash has joined #openstack-keystone | 15:57 | |
| *** ChanServ sets mode: +v henrynash | 15:57 | |
| *** openstackstatus has joined #openstack-keystone | 15:57 | |
| *** ChanServ sets mode: +v openstackstatus | 15:57 | |
| *** henrynash has quit IRC | 16:01 | |
| *** e0ne is now known as e0ne_ | 16:04 | |
| *** davidckennedy has quit IRC | 16:07 | |
| *** lhcheng has joined #openstack-keystone | 16:10 | |
| *** ChanServ sets mode: +v lhcheng | 16:10 | |
| *** kiran-r has joined #openstack-keystone | 16:15 | |
| *** dan_ has joined #openstack-keystone | 16:15 | |
| *** dan_ is now known as Guest64787 | 16:15 | |
| *** gyee has quit IRC | 16:16 | |
| *** browne has quit IRC | 16:21 | |
| *** gyee has joined #openstack-keystone | 16:22 | |
| *** ChanServ sets mode: +v gyee | 16:22 | |
| *** gokrokve has quit IRC | 16:40 | |
| *** harlowja has quit IRC | 16:44 | |
| *** harlowja has joined #openstack-keystone | 16:44 | |
| *** packet has quit IRC | 16:46 | |
| *** rushiagr is now known as rushiagr_away | 16:53 | |
| *** gokrokve has joined #openstack-keystone | 16:57 | |
| *** gokrokve has quit IRC | 16:58 | |
| *** gokrokve has joined #openstack-keystone | 16:58 | |
| *** ankita_wagh has joined #openstack-keystone | 17:00 | |
| *** lhcheng_ has joined #openstack-keystone | 17:06 | |
| *** browne has joined #openstack-keystone | 17:07 | |
| *** lhcheng has quit IRC | 17:08 | |
| *** wasmum has quit IRC | 17:09 | |
| morganfainberg | amakarov: just finished an appointment | 17:23 |
| morganfainberg | amakarov: so looking at stuff now. | 17:23 |
| amakarov | morganfainberg, and I think I've addressed your consern here: https://review.openstack.org/#/c/141854/ | 17:25 |
| morganfainberg | yeah i've been swamped with some pre-summit stuff | 17:25 |
| morganfainberg | but we should start accelerating merging things here soon | 17:25 |
| morganfainberg | i hope | 17:25 |
| morganfainberg | :) | 17:25 |
| amakarov | morganfainberg, me too :) | 17:26 |
| amakarov | a question: what shall we do to TRL? There is no spec or active bp... | 17:26 |
| amakarov | There is a request to drag it to v3 :) | 17:27 |
| morganfainberg | amakarov: since it doesn't exist for V3... we can probably make it die with the death of V2 | 17:27 |
| morganfainberg | amakarov: and make v3 revocation events only | 17:28 |
| morganfainberg | amakarov: and that is the direction i'd like to see things go if at all possible | 17:28 |
| amakarov | morganfainberg, so bp/spec will be necessary? | 17:28 |
| morganfainberg | amakarov: well we have revocation events | 17:29 |
| morganfainberg | we can turn off the TRL | 17:29 |
| morganfainberg | we need to make rev. events parsable in keystone middleware | 17:29 |
| morganfainberg | and distributed to ksm (from keystone server) | 17:29 |
| morganfainberg | and i think we can document that rev. events is the preferred way forward | 17:29 |
| morganfainberg | and then when v2 is removed, TRL is also removed. | 17:29 |
| morganfainberg | we should have some specs for that already | 17:29 |
| *** lhcheng_ has quit IRC | 17:30 | |
| amakarov | morganfainberg, for ksm: https://blueprints.launchpad.net/keystone/+spec/middleware-revocation-events | 17:30 |
| amakarov | while for keystone it's konsidered implemented: https://blueprints.launchpad.net/keystone/+spec/revocation-events | 17:31 |
| amakarov | s/konsidered/considered/ | 17:31 |
| morganfainberg | amakarov: correct rev. events for keystone are implemneted | 17:31 |
| morganfainberg | ksm needs to grow support for it | 17:31 |
| amakarov | "As a consequence of this blueprint, GET /v3/auth/tokens/OS-PKI/revoked should be deprecated." | 17:32 |
| morganfainberg | amakarov: ayoung is working on some stuff related to that. and i think it's depending on new keystoneauth and accessinfo | 17:32 |
| amakarov | morganfainberg, is it a part of the blueprint or just a wish? )) | 17:32 |
| *** e0ne_ is now known as e0ne | 17:32 | |
| ayoung | morganfainberg, and for that we need to take Jamie to the interrogation room and make him see the light | 17:32 |
| morganfainberg | ayoung: we have summit for that. | 17:33 |
| morganfainberg | ayoung: now... i need to figure out what to title this last fishbowl | 17:33 |
| morganfainberg | ayoung: it's going to be related to KSA, new access info, etc | 17:33 |
| morganfainberg | ayoung: iirc, i need to reread the scrollback | 17:33 |
| ayoung | morganfainberg, consuming Keystone Artefacts | 17:33 |
| *** e0ne has quit IRC | 17:34 | |
| ayoung | morganfainberg, call it "improving Keystone AuthN" | 17:37 |
| *** vhoward has left #openstack-keystone | 17:37 | |
| morganfainberg | hah | 17:37 |
| ayoung | KSA is the core of that | 17:37 |
| ayoung | we dynamic policy dirves towards that | 17:37 |
| ayoung | and this is the mechanisms that will allow us to do both | 17:37 |
| ayoung | morganfainberg, so, I have V3 only on rdo.younglogic.net | 17:39 |
| ayoung | seems to be working | 17:39 |
| morganfainberg | cool | 17:39 |
| ayoung | if we go V3 only...poicy gets much easier to enforce | 17:39 |
| ayoung | we can do something like: | 17:39 |
| morganfainberg | ayoung: The Alchemy of AuthN in Keystone and turning it to Gold | 17:39 |
| morganfainberg | ayoung: :P | 17:40 |
| ayoung | token.project.domainid == target.project.domain id type mathces | 17:40 |
| ayoung | matches | 17:40 |
| morganfainberg | ayoung: i seriously think we will be able to deprecate v2 this cycle. | 17:40 |
| morganfainberg | ayoung: which case we can start making moves like that | 17:40 |
| ayoung | morganfainberg, I think the mission of keystone is "To Enable secure delegation of workloads in a cloud environmnet" | 17:41 |
| ayoung | we ened top deprecate it. We want to stop people from coding against it | 17:41 |
| morganfainberg | ayoung: To provide a robust solution for IAM across cloud environments. | 17:41 |
| ayoung | IAM? | 17:41 |
| ayoung | isn't that a dog food? | 17:41 |
| morganfainberg | Identity and Access Management | 17:41 |
| morganfainberg | it's the technical industry term for what we do. | 17:42 |
| morganfainberg | we're more on the AM side | 17:42 |
| morganfainberg | than the I side | 17:42 |
| ayoung | yes | 17:42 |
| morganfainberg | but we still are closely related to the identity side | 17:43 |
| ayoung | we consume it, but it should not be our core mission | 17:43 |
| ayoung | our mission is the AuthZ piece | 17:43 |
| ayoung | which is what I meant to type above, not AuthN | 17:43 |
| morganfainberg | we still help manage where identity comes from for what OpenStack services consume | 17:43 |
| ayoung | (AuthN should be AuthC dagnabit) | 17:43 |
| morganfainberg | so, i'd say we're firmly IAM across the board. | 17:43 |
| morganfainberg | just more focused on access management | 17:43 |
| ayoung | yep. I is the primary input to AuthZ | 17:44 |
| morganfainberg | yep yep | 17:44 |
| * morganfainberg is debating tossing a governacne change to get "IAM" in the keystone description | 17:44 | |
| morganfainberg | well "Identity and Access Management" | 17:44 |
| ayoung | morganfainberg, I think that would be prudent | 17:44 |
| morganfainberg | yeah | 17:44 |
| morganfainberg | i'll probably do that next week or @ summit | 17:44 |
| *** browne has quit IRC | 17:45 | |
| ayoung | "Keystone is a service which allows the operator to consume multiple forms of Identity Management in order to perform secure authorization in OpenStack" | 17:45 |
| ayoung | make that | 17:45 |
| ayoung | "Keystone is a service which allows the operator to consume multiple forms of Identity Management in order to manage access in OpenStack services" | 17:46 |
| ayoung | ideally, we will repalce OpenStack with CLoud | 17:46 |
| morganfainberg | ayoung: also at the summit going to open the door for us to adopt a real mascot - an animal that we can do cool things w/ vs needing to be an "arch" logo | 17:46 |
| morganfainberg | ayoung: the requirement is it must be classified as a "keystone species" | 17:46 |
| morganfainberg | ;) | 17:46 |
| ayoung | morganfainberg, I can work with that | 17:46 |
| morganfainberg | ayoung: yeah. examples i've seen: sea otters, grey wolf, jaguar, etc | 17:47 |
| ayoung | Jaguars are cool | 17:47 |
| morganfainberg | yeah | 17:47 |
| ayoung | grey wolves are even cooler | 17:47 |
| breton | corgi | 17:47 |
| breton | let's have a corgi | 17:47 |
| morganfainberg | breton: not a keystone species, sorry :P | 17:47 |
| morganfainberg | breton: also... no corgis | 17:47 |
| ayoung | http://www.google.com/imgres?imgurl=http://kids.nationalgeographic.com/content/dam/kids/photos/animals/Mammals/A-G/gray-wolf-closeup.jpg&imgrefurl=http://kids.nationalgeographic.com/animals/gray-wolf&h=900&w=1600&tbnid=tUhfZrd2jwDTWM:&zoom=1&tbnh=112&tbnw=199&usg=__70cRDCIhL3adkrO_zzFIQRzWFow=&docid=2chx2HGzA2nbyM&itg=1 | 17:48 |
| morganfainberg | ayoung: we will need an awesome line-art | 17:48 |
| blewis` | prarie dogs are keystone species | 17:48 |
| blewis` | so are sea stars | 17:48 |
| morganfainberg | blewis`: yes they are | 17:48 |
| breton | oh. | 17:48 |
| ayoung | #action ayoung to get awesome line art of a gray wolf | 17:48 |
| morganfainberg | ayoung: before you do that, lets open up for suggestions then we will do a open call for art for the suggestions | 17:49 |
| breton | gray wolfs are boring and for 12 years old girls | 17:49 |
| morganfainberg | ayoung: you may see another suggestion you like better :) | 17:49 |
| blewis` | Sugar maple: This tree is a keystone species of the hardwood forest. It brings water from lower levels in the ground that helps other plants. It is also home to many insects, birds, and small animals. | 17:49 |
| ayoung | morganfainberg, I had a Husky when I was a kid. She still shows up in my dreams. I am not going to see something I like better | 17:49 |
| morganfainberg | blewis`: there are many many options. | 17:49 |
| morganfainberg | ayoung: as soon as I move to a place i can have a dog, i'm getting either a husky or a malamute | 17:50 |
| morganfainberg | both are such awesome dog breeds | 17:50 |
| morganfainberg | ayoung: actually, i just like all of the spitz breeds | 17:50 |
| ayoung | morganfainberg, yes they are. | 17:50 |
| blewis` | how about a miniature husky | 17:50 |
| morganfainberg | ayoung: even the silly shiba inus | 17:50 |
| morganfainberg | blewis`: on the officially banned list at my current apt. | 17:50 |
| morganfainberg | blewis`: or i'd consider it | 17:50 |
| blewis` | mini ones are?! | 17:50 |
| blewis` | they're like the size of chihuahuas~ | 17:50 |
| morganfainberg | blewis`: all things named husky or husky like | 17:51 |
| blewis` | mutiny! | 17:51 |
| morganfainberg | they had stupid rules | 17:51 |
| morganfainberg | blewis`: i even looked at the klee kai | 17:51 |
| morganfainberg | blewis`: banned | 17:51 |
| morganfainberg | blewis`: stupid. | 17:51 |
| blewis` | sounds like its time to move :P | 17:51 |
| morganfainberg | blewis`: yep | 17:52 |
| morganfainberg | i've had 2 malamutes. | 17:52 |
| morganfainberg | love those dogs. | 17:52 |
| morganfainberg | they're just so awesome... | 17:52 |
| *** amakarov is now known as amakarov_away | 17:52 | |
| blewis` | see, i just don't form attachments to animals at all. like i like dogs and think they'er awesome, but i never want to take care of one. | 17:53 |
| morganfainberg | blewis`: but funny they don't ban shiba inus | 17:53 |
| morganfainberg | blewis`: ijt's a weird company that runs the complex | 17:53 |
| blewis` | im licensed for foster care and i have a foster kiddo in my house... anyway, the agency i am licensed through has a breed restriction list. no pitbulls, husky's, etc | 17:53 |
| blewis` | great danes are not on the list tho | 17:54 |
| morganfainberg | blewis`: i bet malamutes are on the list of banned too | 17:56 |
| morganfainberg | blewis`: as awesome as they are... people consider them a "risk" above other dogs. | 17:57 |
| blewis` | probably | 17:57 |
| stevemar | well this channel went on a heck of a tangent :) | 17:57 |
| blewis` | malamutes look like spirt animals | 17:58 |
| blewis` | like if that were a real thing and you had to have one, you'd probably want to have a malamute as your spirit animal vs some other lame animal | 17:58 |
| blewis` | like a goat. | 17:58 |
| *** gokrokve has quit IRC | 17:58 | |
| *** browne has joined #openstack-keystone | 17:59 | |
| *** lhcheng has joined #openstack-keystone | 18:03 | |
| *** ChanServ sets mode: +v lhcheng | 18:03 | |
| *** samleon has joined #openstack-keystone | 18:04 | |
| *** ajayaa has quit IRC | 18:09 | |
| *** wasmum has joined #openstack-keystone | 18:11 | |
| morganfainberg | blewis`: hahah | 18:11 |
| morganfainberg | blewis`: http://www.dogwallpapers.net/wallpapers/nice-adult-alaskan-malamute-dog-wallpaper.jpg | 18:12 |
| morganfainberg | stevemar: dude the Keystone "spirit" animal ;) | 18:15 |
| morganfainberg | stevemar: that was the discussion. | 18:15 |
| *** samleon has quit IRC | 18:15 | |
| *** kiran-r has quit IRC | 18:17 | |
| morganfainberg | stevemar: ping - summit slide review things | 18:23 |
| morganfainberg | stevemar: that planned for next week? | 18:24 |
| *** rwsu_ has quit IRC | 18:24 | |
| *** wasmum has quit IRC | 18:33 | |
| *** jaosorior has quit IRC | 18:42 | |
| stevemar | morganfainberg, you have editor permission on the deck | 18:43 |
| stevemar | i did a whole bunch of tweaks today | 18:43 |
| morganfainberg | stevemar: sure. was just curious when/if we were spending time to focus on it | 18:43 |
| morganfainberg | or if it was ad-hoc | 18:43 |
| stevemar | morganfainberg, next week for suuuuureee | 18:49 |
| morganfainberg | raildo, rodrigods, ping - need to ask you a question re: summit stuff | 18:52 |
| rodrigods | morganfainberg, hi | 18:52 |
| raildo | morganfainberg, hi | 18:52 |
| *** browne has quit IRC | 19:03 | |
| *** browne has joined #openstack-keystone | 19:04 | |
| *** wasmum has joined #openstack-keystone | 19:07 | |
| rodrigods | morganfainberg, stevemar, topol, marekd ping... "Your Onsite Phone Number in Vancouver: *" in the speaker confirmation form | 19:07 |
| rodrigods | my mobile won't work there | 19:08 |
| rodrigods | should I put the hotel phone number? | 19:08 |
| stevemar | rodrigods, sure | 19:08 |
| rodrigods | stevemar, thanks | 19:09 |
| stevemar | who uses phones anymore (for calling anyway) | 19:09 |
| topol | as long as we can find you thats all that matters :-) | 19:11 |
| rodrigods | topol, heh | 19:13 |
| *** esp has left #openstack-keystone | 19:25 | |
| *** ankita_wagh has quit IRC | 19:26 | |
| *** ankita_w_ has joined #openstack-keystone | 19:28 | |
| *** atiwari1 has joined #openstack-keystone | 19:56 | |
| baffle | I have a domain-level role called "domain_admin". I want this role to be able to grant roles, but not the "admin" role, as nova & friends still live in V2 and think it means r00t. How can I stop that from happening in policy.json? | 19:58 |
| baffle | Also, is identity:create_credential basically the same as identity:ec2_create_credential? Shouldn't the policy be the same? So that users using the v3 api can create ec2/s3 tokens? | 19:58 |
| *** atiwari has quit IRC | 19:59 | |
| bknudson | I don't think the policy code is expressive enough to disallow assigning a single role | 19:59 |
| *** blewis` has quit IRC | 19:59 | |
| baffle | So, basically, the usecase of having "domain admins" where they can create groups, users, projects and do RBAC is basically broken then? Or, one could ofcourse debate that nova & friends is broken. :) | 20:02 |
| bknudson | y, it makes total sense. | 20:02 |
| bknudson | I mean it makes sense to need to do that. | 20:03 |
| bknudson | having nova & friends living in v2 is broken... but I thought we'd made better progress on that. | 20:04 |
| baffle | To be able to restrict that, since other projects policies are broken you mean? | 20:04 |
| baffle | Maybe we have. My nova+neutron is still Icehouse. | 20:04 |
| baffle | Keystone is Kilo, tho'. \o/ | 20:04 |
| bknudson | in icehouse nova and friends were not able to use v3. | 20:05 |
| baffle | Maybe my concerns are unfounded then. | 20:05 |
| *** packet has joined #openstack-keystone | 20:06 | |
| *** atiwari2 has joined #openstack-keystone | 20:06 | |
| baffle | bknudson: I see you had this review wich seemingly was abandoned: https://review.openstack.org/#/c/103617/ .. Was the work done elsewhere? | 20:07 |
| baffle | Uh. That was a spec. Nevermind. | 20:08 |
| bknudson | baffle: it was implemented without the spec. | 20:08 |
| bknudson | the spec was only written because nova didn't understand what all needed to change (how big or small the change was) | 20:09 |
| bknudson | they kept -1ing changes for v3 support because they weren't comprehensive. | 20:09 |
| baffle | bknudson: Ah, right. But if it has actually been implemented, that's really great. | 20:10 |
| *** atiwari1 has quit IRC | 20:10 | |
| bknudson | y, it's all there in nova as far as I know. | 20:10 |
| bknudson | samuelds is working on a test to see if we can run without v2. | 20:11 |
| baffle | Now I just wish all the SDKs and tools using them would actually get V3 support. Finally Gophercloud has it.. But jcloud and lots of other still is missing it. :) | 20:11 |
| baffle | bknudson: Unrealted, but since I stole some attention... Is identity:*_credential the same as identity:ec2_*_credential? Just the v2.0 vs v3 policies? Because right now (according to the policy) it seems as if only an admin can create ec2 credentials if authed with v3. And I assume that a user should be able to do that. | 20:14 |
| bknudson | baffle: I've got some docs for policy targets: https://review.openstack.org/#/c/168521/ | 20:15 |
| bknudson | not merged yet | 20:15 |
| bknudson | the ec2_* has the user in the path, whereas *_credentials doensn't have the user... so makes sense for *_credential to require admin | 20:17 |
| *** samleon has joined #openstack-keystone | 20:25 | |
| baffle | bknudson: Hmm, in OSC "ec2 credentials create" magically disappears if OS_IDENTITY_API_VERSION="3" it seems. So that was why I tought identity:credential was the new thing. Where is the API docs for OS-EC2 for v3 anyway? It's not in "Identity API v3 extensions (CURRENT)" or "Identity API v3 (CURRENT)" it seems. | 20:25 |
| bknudson | baffle: I don't know if any docs exist for it... I think it's the same as the v2 version of the API. | 20:26 |
| baffle | bknudson: I assumed that one would use something like target.user_id in the policy to limit a user to only create credentials using /v3/credentials/ | 20:27 |
| bknudson | baffle: that's a great question ... should have docs for this stuff but nobody wants to write them. | 20:28 |
| baffle | Hmm, I'm even more confused right now. 1 sec, I'll just look at --debug output of something.. That's the best doc I've found till now. :) | 20:31 |
| *** e0ne has joined #openstack-keystone | 20:33 | |
| *** ankita_w_ has quit IRC | 20:34 | |
| *** ankita_wagh has joined #openstack-keystone | 20:36 | |
| baffle | I'm more confused now. Better go read the code some more. | 20:39 |
| openstackgerrit | Merged openstack/keystone: Fixes use of dict methods for Python3 https://review.openstack.org/177410 | 20:40 |
| *** htruta has quit IRC | 20:51 | |
| ankita_wagh | Hi , Can someone please do a +2 for this https://review.openstack.org/#/c/179624/ ? | 20:57 |
| *** rm_work|away is now known as rm_work | 21:00 | |
| *** raildo has quit IRC | 21:00 | |
| *** e0ne has quit IRC | 21:02 | |
| *** emagana has quit IRC | 21:14 | |
| *** rwsu has joined #openstack-keystone | 21:30 | |
| *** rwsu has quit IRC | 21:30 | |
| *** rwsu has joined #openstack-keystone | 21:31 | |
| *** pnavarro has quit IRC | 21:34 | |
| *** gordc has quit IRC | 21:36 | |
| *** rwsu has quit IRC | 21:39 | |
| *** lmtaylor has left #openstack-keystone | 21:43 | |
| *** doug-fish has left #openstack-keystone | 21:49 | |
| *** rwsu has joined #openstack-keystone | 21:58 | |
| *** stevemar has quit IRC | 22:05 | |
| *** browne1 has joined #openstack-keystone | 22:06 | |
| *** browne has quit IRC | 22:07 | |
| *** EmilienM is now known as EmilienM|afk | 22:08 | |
| *** ankita_w_ has joined #openstack-keystone | 22:08 | |
| *** ankita_wagh has quit IRC | 22:09 | |
| *** dimsum__ has quit IRC | 22:21 | |
| *** bknudson has quit IRC | 22:21 | |
| *** Ephur has joined #openstack-keystone | 22:27 | |
| *** ankita_w_ has quit IRC | 22:31 | |
| *** ankita_wagh has joined #openstack-keystone | 22:44 | |
| *** rwsu has quit IRC | 22:56 | |
| *** amerine has joined #openstack-keystone | 22:59 | |
| morganfainberg | ankita_wagh: on my list to look at but won't happen until later tonight. | 23:04 |
| *** ankita_wagh has quit IRC | 23:04 | |
| *** atiwari1 has joined #openstack-keystone | 23:04 | |
| *** ankita_wagh has joined #openstack-keystone | 23:05 | |
| *** atiwari2 has quit IRC | 23:07 | |
| *** topol has quit IRC | 23:08 | |
| *** packet has quit IRC | 23:15 | |
| *** rwsu has joined #openstack-keystone | 23:22 | |
| *** mestery has quit IRC | 23:34 | |
| *** samueldmq has joined #openstack-keystone | 23:51 | |
| *** drjones has quit IRC | 23:52 | |
| *** _cjones_ has joined #openstack-keystone | 23:53 | |
| *** atiwari2 has joined #openstack-keystone | 23:55 | |
| *** rwsu has quit IRC | 23:56 | |
| *** _cjones_ has quit IRC | 23:58 | |
| *** atiwari1 has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
