| gyee | stevemar, we are still verifying henrynash patches, but look promising so far | 00:01 |
|---|---|---|
| *** pumaranikar has quit IRC | 00:01 | |
| *** zqfan_AFK has joined #openstack-keystone | 00:10 | |
| *** EinstCrazy has joined #openstack-keystone | 00:23 | |
| *** EinstCrazy has quit IRC | 00:25 | |
| *** gildub has quit IRC | 00:25 | |
| *** topol has quit IRC | 00:29 | |
| *** pgbridge has quit IRC | 00:30 | |
| *** r-daneel has quit IRC | 00:47 | |
| openstackgerrit | ayoung proposed openstack/keystone: Add is_admin_project check to policy.json https://review.openstack.org/257636 | 00:55 |
| *** markvoelker has joined #openstack-keystone | 00:56 | |
| *** EinstCrazy has joined #openstack-keystone | 00:58 | |
| openstackgerrit | ayoung proposed openstack/keystone: Add is_admin_project check to policy.json https://review.openstack.org/257636 | 00:59 |
| *** markvoelker has quit IRC | 01:01 | |
| *** jasonsb has quit IRC | 01:01 | |
| *** andreykurilin__ has quit IRC | 01:02 | |
| *** openstack has joined #openstack-keystone | 01:06 | |
| openstackgerrit | ayoung proposed openstack/keystone: Updated Cloudsample https://review.openstack.org/240720 | 01:11 |
| *** gyee has quit IRC | 01:17 | |
| *** yangyapeng has joined #openstack-keystone | 01:25 | |
| *** yangyapeng has quit IRC | 01:30 | |
| notmorgan | huh no ayoung | 01:32 |
| notmorgan | stevemar, bknudson, almost have a fully working suburl cloud | 01:32 |
| notmorgan | gonna write up the configuration shortly, but this makes me happy | 01:33 |
| stevemar | notmorgan: noice | 01:33 |
| notmorgan | running into neutron issues | 01:33 |
| notmorgan | but meh | 01:33 |
| notmorgan | have some help from cburgess coming to get a basic neutron lined up | 01:33 |
| notmorgan | stevemar: then we can actually explore support of a proper cookie [with some inter-server changes] for auth to the API endpoint | 01:34 |
| notmorgan | i'd like to get devstack to support suburl deployments as well | 01:34 |
| notmorgan | krotscheck: ping ^ how does suburl (api.tempusfrangit.org/<service>) sound to you? | 01:35 |
| notmorgan | krotscheck: makes the cors stuff less important and we can do cooler things with auth :) | 01:35 |
| *** markvoelker has joined #openstack-keystone | 01:37 | |
| stevemar | bknudson: you thinking about making a "keystone-uwsgi-public.ini" file in keystone? | 02:09 |
| jamielennox | stevemar, bknudson: i don't think we should support this upstream | 02:09 |
| stevemar | jamielennox: using uwsgi? why no? | 02:10 |
| stevemar | not? | 02:10 |
| jamielennox | i just think it's too much we have to test against | 02:10 |
| *** aginwala has quit IRC | 02:10 | |
| jamielennox | i don't know if we should replicate all the testing | 02:11 |
| openstackgerrit | Thomas Hsiao proposed openstack/keystone: Validate domain for DB-based domain config. CRUD https://review.openstack.org/256889 | 02:11 |
| *** aginwala has joined #openstack-keystone | 02:14 | |
| *** gissi has quit IRC | 02:14 | |
| *** csoukup has joined #openstack-keystone | 02:15 | |
| *** gissi has joined #openstack-keystone | 02:15 | |
| *** jasonsb has joined #openstack-keystone | 02:16 | |
| *** browne has quit IRC | 02:16 | |
| stevemar | dstanek: more comments and questions here about stable interface docs: https://etherpad.openstack.org/p/keystone-stable-interface-guidelines | 02:18 |
| *** csoukup has quit IRC | 02:19 | |
| *** mtreinish has quit IRC | 02:20 | |
| *** mtreinish has joined #openstack-keystone | 02:20 | |
| stevemar | notmorgan: this might be of interest to you: https://review.openstack.org/#/c/193894/4 | 02:21 |
| *** jasonsb has quit IRC | 02:21 | |
| dstanek | stevemar: just updated with the answers | 02:21 |
| *** fangxu has quit IRC | 02:22 | |
| *** iurygregory has quit IRC | 02:27 | |
| *** ericksonsantos has quit IRC | 02:28 | |
| *** ericksonsantos has joined #openstack-keystone | 02:29 | |
| *** iurygregory has joined #openstack-keystone | 02:29 | |
| openstackgerrit | Merged openstack/keystone: Changed the key repo validation to allow read only https://review.openstack.org/256736 | 02:44 |
| notmorgan | stevemar: that is somewhat interesting | 02:45 |
| notmorgan | stevemar: and def. in line with the stuff i'm working on | 02:45 |
| notmorgan | stevemar: stupid neutron being hard to configure :P | 02:45 |
| *** Guest65915 has quit IRC | 02:45 | |
| stevemar | i hear it is a pain | 02:45 |
| notmorgan | jamielennox: uwsgi is a beast of config options | 02:45 |
| notmorgan | jamielennox: but it is super useful for isolated eventlet-like testing | 02:46 |
| notmorgan | jamielennox: i'd recommend supporting it, but honestly, I'm apathetic on the server side at the moment | 02:46 |
| *** richm has quit IRC | 02:47 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/256053 | 02:48 |
| jamielennox | notmorgan: i understand wanting something that launches a process to have a LB do the apache stuff | 02:48 |
| jamielennox | but uwsgi is not exactly easy | 02:49 |
| notmorgan | jamielennox: uwsgi is actually pretty easy if you boil off the cruft we don't care about and treat it like eventlet. | 02:49 |
| jamielennox | assuming we're still dumping eventlet | 02:49 |
| jamielennox | why would we pick uwsgi over ~10 otehrs | 02:49 |
| notmorgan | if we aren't dumping eventlet in keystone, i am done with the server | 02:50 |
| *** aginwala has quit IRC | 02:50 | |
| jamielennox | notmorgan: it's dumped | 02:50 |
| jamielennox | notmorgan: but getting rid of it means that anything wsgi should be able to serve it | 02:50 |
| notmorgan | so, uwsgi is nice because it provides a HTTP interface if needed | 02:50 |
| jamielennox | lets just not bother | 02:50 |
| *** aginwala has joined #openstack-keystone | 02:50 | |
| notmorgan | and can run on unix sockets | 02:50 |
| notmorgan | actually | 02:51 |
| notmorgan | hold up | 02:51 |
| notmorgan | i wouldn't make a custom uwsgi ini | 02:51 |
| jamielennox | http://wsgi.readthedocs.org/en/latest/servers.html | 02:51 |
| notmorgan | yeah no | 02:51 |
| notmorgan | lets document any keythings needed to run uwsgi in our docs | 02:52 |
| notmorgan | we can have devstack deploy uwsgi if we want | 02:52 |
| notmorgan | (not a bad idea) | 02:52 |
| notmorgan | but we don't need an ini in our tree | 02:52 |
| jamielennox | let's say *hand wave* wsgi | 02:52 |
| notmorgan | and our wsgi app.py should work with almost any wsgi (file a bug if it doesnt) container | 02:52 |
| jamielennox | i don't think we do anything that is mod_wsgi specific | 02:52 |
| notmorgan | we don't | 02:53 |
| jamielennox | i'm happy for people to use uwsgi, lets document things like the environment variables that go into the application, and not support a specific wsgi server | 02:54 |
| notmorgan | jamielennox: ++ that is good | 02:54 |
| notmorgan | yeah if someone is proposing we support a uwsgi.ini -- NO. | 02:54 |
| jamielennox | oo, another vital video to watch for onboarding | 02:54 |
| jamielennox | notmorgan: i think bknudson is proposing it to devstack, i don't think there is a keystone component to that | 02:54 |
| jamielennox | i'm just not sure what point there is to the devstack support, who's going to run it to test | 02:55 |
| notmorgan | sure and in devstack is fine | 02:55 |
| notmorgan | i think we should move to uwsgi in devstack | 02:55 |
| jamielennox | meh - apache is fine | 02:55 |
| jamielennox | devstack should be what we suggest | 02:55 |
| notmorgan | well there is another reason for uwsgi | 02:56 |
| jamielennox | and unless haproxy suddenly learnt how to do all the mod_auth_X then we still recommend apache as the container | 02:56 |
| notmorgan | actually i would still use apache | 02:56 |
| notmorgan | in all those cases | 02:56 |
| notmorgan | specifically for SSL offload | 02:56 |
| *** woodster_ has quit IRC | 02:56 | |
| *** gildub has joined #openstack-keystone | 02:57 | |
| jamielennox | me too, but people have lots of opinions on this stuf | 02:57 |
| *** fawadkhaliq has joined #openstack-keystone | 02:59 | |
| stevemar | notmorgan: btw https://review.openstack.org/#/c/257131/ | 02:59 |
| stevemar | notmorgan: and if you have a minute... https://review.openstack.org/#/c/256257/ | 03:00 |
| stevemar | i should really add tests for that though | 03:00 |
| notmorgan | jamielennox: so my ideal world: [Internet] -> [tls(HAProxy + Auth_Token)] -> [[tls(Apache)] -> [uwsgi(service]] [via unix socket] | 03:00 |
| jamielennox | auth_token in haproxy | 03:02 |
| jamielennox | interesting | 03:02 |
| jamielennox | but why apache -> uwsgi | 03:02 |
| openstackgerrit | Thomas Hsiao proposed openstack/keystone: Validate domain for DB-based domain config. CRUD https://review.openstack.org/256889 | 03:08 |
| *** jasonsb has joined #openstack-keystone | 03:11 | |
| notmorgan | because it allows fore restarting the services independant of apache | 03:17 |
| notmorgan | for* | 03:17 |
| notmorgan | and uwsgi talks sockets among other tunables that gunicorn and the like does not | 03:17 |
| notmorgan | (gunicorn might do sockets) | 03:17 |
| notmorgan | but apache and nginx talk uwsgi protocol (not HTTP) to the server. it's a bit better overall | 03:17 |
| notmorgan | and uwsgi plays MUCH better with venvs | 03:18 |
| jamielennox | notmorgan: i'm not convinced on the venv article | 03:19 |
| notmorgan | mod_wsgi does not play well with venvs | 03:19 |
| jamielennox | i mean i get it, and i don't like using docker as an answer to stuff, but docker | 03:19 |
| notmorgan | sure. | 03:19 |
| notmorgan | the venv bit is just a nice-to-have | 03:19 |
| *** topol has joined #openstack-keystone | 03:19 | |
| *** ChanServ sets mode: +v topol | 03:19 | |
| *** EinstCrazy has quit IRC | 03:20 | |
| * notmorgan is also not really sold on the whole docker running <keystone> for example | 03:20 | |
| notmorgan | i would like apache to talk unix socket uwsgi protocol | 03:20 |
| notmorgan | rather than TCP HTTP | 03:20 |
| *** browne has joined #openstack-keystone | 03:20 | |
| notmorgan | it also means we have clearer control over the data path - you can't circumvent as easily even on localhost the TLS / validating | 03:21 |
| notmorgan | validation | 03:21 |
| jamielennox | well containing keystone might be a good reason for the haproxy managing mod_aux_x | 03:21 |
| jamielennox | mod_wsgi daemon mode is a domain socket isn't it | 03:21 |
| *** EinstCrazy has joined #openstack-keystone | 03:21 | |
| jamielennox | unix socket | 03:21 |
| jamielennox | whatever | 03:21 |
| notmorgan | you know it might be | 03:21 |
| notmorgan | but i veyr much want mod_wsgi out of the picture | 03:21 |
| jamielennox | afaik you can't reboot it | 03:22 |
| notmorgan | being able to restart services separate from apache is a win | 03:22 |
| jamielennox | like independant of apache - but meh | 03:22 |
| notmorgan | or nginx | 03:22 |
| notmorgan | yeah | 03:22 |
| jamielennox | to my mind this is haproxy's problem | 03:22 |
| notmorgan | mod_wsgi owns the process | 03:22 |
| notmorgan | again, not sold on apache owning that | 03:22 |
| jamielennox | haproxy -> apache (mod_wsgi) -> process | 03:22 |
| notmorgan | but in docker model sure | 03:22 |
| jamielennox | restart apache is fine because haproxy is doing that same handoff | 03:22 |
| notmorgan | eh sortof | 03:23 |
| notmorgan | depends if you use docker or not | 03:23 |
| notmorgan | in non-containerized world | 03:23 |
| notmorgan | a restart of apache affects all SSL offloaded/TLS internal services on the box | 03:23 |
| notmorgan | and a lot (LOT) of deployments use combined controllers | 03:23 |
| jamielennox | what else are you running on the keystone box | 03:23 |
| notmorgan | if we containerize the APIs it's less of an issue | 03:23 |
| *** topol has quit IRC | 03:23 | |
| notmorgan | oh oh move keystone off? | 03:24 |
| notmorgan | sure | 03:24 |
| notmorgan | from a pure security standpoint that is nice | 03:24 |
| *** aginwala has quit IRC | 03:24 | |
| notmorgan | the way i'm running HA Proxy is 2 binds, internal and external | 03:24 |
| notmorgan | external will do ATM offload | 03:25 |
| notmorgan | internal will do "are you really X service? ok pass authz through" | 03:25 |
| *** yangyapeng has joined #openstack-keystone | 03:25 | |
| jamielennox | still think that should just be dns, but ok | 03:26 |
| notmorgan | for what it is worth, HAProxy seems to do much better talking to keystone than the services do | 03:26 |
| notmorgan | uhm. how does DNS provide validation ? | 03:26 |
| notmorgan | service -[client cert]->[HAproxy, so L7/non-port-based-access-works]->[other service] | 03:27 |
| notmorgan | was my thought | 03:27 |
| *** aginwala has joined #openstack-keystone | 03:28 | |
| notmorgan | and HAProxy would just do client cert auth before passing the request on. | 03:28 |
| notmorgan | prevents accidental traffic leaking (VLAN/VXLAN) from affecting changes | 03:28 |
| notmorgan | maybe i'm over thinking the internal security bit | 03:29 |
| * notmorgan shrugs. | 03:29 | |
| notmorgan | HAProxy can also just do the same L7 stuff to make the catalog consistent for internal urls | 03:29 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: fix up release notes, file deprecations under right title https://review.openstack.org/256235 | 03:29 |
| stevemar | notmorgan: ^ | 03:29 |
| notmorgan | that doesn't need to offload auth to keystone (vcan be done via ANYCAST if we wanted?) | 03:30 |
| notmorgan | stevemar: uhm sure? | 03:31 |
| stevemar | notmorgan: i just need someone to look at it :P | 03:31 |
| stevemar | and you're active atm | 03:31 |
| notmorgan | don't we have a reno job jenkins runs? | 03:31 |
| stevemar | notmorgan: we do! | 03:31 |
| *** pgbridge has joined #openstack-keystone | 03:33 | |
| *** ccard__ has quit IRC | 03:35 | |
| *** tsymanczyk has joined #openstack-keystone | 03:37 | |
| jamielennox | notmorgan: not validation, just internal/external distinction | 03:37 |
| *** tsymanczyk is now known as Guest11905 | 03:37 | |
| notmorgan | jamielennox: sure. | 03:37 |
| notmorgan | jamielennox: still needs L7 mangling | 03:38 |
| notmorgan | but sure, easy enough to DNS it up or use internal_url + dns | 03:38 |
| jamielennox | notmorgan: with auth plugins in the backends here we can do catalog however you setup the plugin | 03:40 |
| notmorgan | sure | 03:40 |
| notmorgan | i'd still use the catalog + L7 mangling to direct to <not-on-random-port> for service->service | 03:40 |
| *** ccard__ has joined #openstack-keystone | 03:47 | |
| *** flwang1 has quit IRC | 03:49 | |
| *** david-lyle has quit IRC | 03:50 | |
| *** Guest11905 has quit IRC | 03:51 | |
| *** markvoelker has quit IRC | 03:52 | |
| *** aginwala has quit IRC | 03:53 | |
| *** aginwala has joined #openstack-keystone | 03:54 | |
| *** aginwala has quit IRC | 03:56 | |
| *** david-lyle has joined #openstack-keystone | 03:58 | |
| krotscheck | notmorgan: Suburl is meh. I'm addressing the use case of N > 1 UI's hosted to meet different use cases. | 03:59 |
| krotscheck | Never assume there's only one UI. | 04:00 |
| *** krotscheck is now known as krotscheck_vaca | 04:00 | |
| notmorgan | krotscheck: hah i figured you'd respond when you got home | 04:00 |
| notmorgan | :P | 04:00 |
| notmorgan | krotscheck_vaca: i'll argue suburl with you at a different point. [this is not for dashboards] | 04:00 |
| *** david-lyle has quit IRC | 04:01 | |
| *** david-lyle has joined #openstack-keystone | 04:02 | |
| *** links has joined #openstack-keystone | 04:07 | |
| *** boris-42_ has quit IRC | 04:13 | |
| *** tsymanczyk has joined #openstack-keystone | 04:18 | |
| *** tsymanczyk is now known as Guest50291 | 04:18 | |
| *** openstackstatus has quit IRC | 04:24 | |
| *** openstack has joined #openstack-keystone | 04:24 | |
| *** openstackstatus has joined #openstack-keystone | 04:25 | |
| *** ChanServ sets mode: +v openstackstatus | 04:25 | |
| *** Guest50291 has quit IRC | 04:45 | |
| *** aginwala has joined #openstack-keystone | 04:49 | |
| *** markvoelker has joined #openstack-keystone | 04:53 | |
| *** markvoelker has quit IRC | 04:57 | |
| *** aginwala has quit IRC | 04:59 | |
| *** aginwala has joined #openstack-keystone | 05:24 | |
| *** Ephur has quit IRC | 05:33 | |
| *** dims has quit IRC | 05:41 | |
| openstackgerrit | guang-yee proposed openstack/keystone: Validate domain for DB-based domain config. CRUD https://review.openstack.org/256889 | 05:51 |
| *** pgbridge has quit IRC | 05:58 | |
| *** Nirupama has joined #openstack-keystone | 05:58 | |
| *** roxanagh_ has joined #openstack-keystone | 05:59 | |
| *** rm_work has quit IRC | 05:59 | |
| *** tsymanczyk has joined #openstack-keystone | 06:00 | |
| openstackgerrit | Merged openstack/keystone: Verify that user is trustee only on issuing token https://review.openstack.org/257478 | 06:00 |
| *** tsymanczyk is now known as Guest9837 | 06:01 | |
| openstackgerrit | guang-yee proposed openstack/keystone: Validate domain for DB-based domain config. CRUD https://review.openstack.org/256889 | 06:01 |
| *** Guest95273 has quit IRC | 06:06 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 06:09 |
| *** btully has joined #openstack-keystone | 06:10 | |
| openstackgerrit | Ken'ichi Ohmichi proposed openstack/keystone: Enable os_inherit of Keystone v3 API https://review.openstack.org/257580 | 06:10 |
| openstackgerrit | Ken'ichi Ohmichi proposed openstack/keystone: Add inherited to ldap list_domain_ids_for_user() https://review.openstack.org/257682 | 06:10 |
| *** rm_work has joined #openstack-keystone | 06:22 | |
| *** aginwala has quit IRC | 06:27 | |
| *** Guest9837 has quit IRC | 06:28 | |
| *** aginwala has joined #openstack-keystone | 06:30 | |
| *** vgridnev has joined #openstack-keystone | 06:37 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/256053 | 06:50 |
| *** markvoelker has joined #openstack-keystone | 06:54 | |
| *** tsymanczyk has joined #openstack-keystone | 06:55 | |
| *** tsymanczyk is now known as Guest52066 | 06:55 | |
| *** dims has joined #openstack-keystone | 06:56 | |
| stevemar | jamielennox: you would know better than i... are the auth plugins and session code deprecated in KSC yet? | 06:57 |
| stevemar | or are we waiting for more KSA adoption | 06:57 |
| stevemar | probably that | 06:57 |
| jamielennox | stevemar: they're not marked as such | 06:57 |
| jamielennox | stevemar: we can probably do it now | 06:57 |
| jamielennox | i don't think there is anythin else we are waiting for | 06:58 |
| stevemar | hmm OK | 06:58 |
| stevemar | i'll add it to the meeting | 06:58 |
| *** markvoelker has quit IRC | 06:58 | |
| stevemar | maybe some sucker, i mean awesome person will do it | 06:58 |
| stevemar | jamielennox: if you're bored during orientation: https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:bp/deprecated-as-of-mitaka,n,z | 07:02 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/255553 | 07:25 |
| *** dims has quit IRC | 07:26 | |
| *** roxanagh_ has quit IRC | 07:26 | |
| openstackgerrit | Merged openstack/keystone: Add Trusts unique constraint to remove duplicates https://review.openstack.org/239114 | 07:26 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/256053 | 07:30 |
| *** Guest52066 has quit IRC | 07:32 | |
| *** fangxu has joined #openstack-keystone | 07:34 | |
| *** tsymanczyk has joined #openstack-keystone | 07:36 | |
| *** tsymanczyk is now known as Guest63828 | 07:37 | |
| *** Guest63828 has quit IRC | 07:43 | |
| *** dims_ has joined #openstack-keystone | 07:45 | |
| *** urulama has joined #openstack-keystone | 07:48 | |
| *** dims_ has quit IRC | 08:01 | |
| *** aginwala has quit IRC | 08:07 | |
| *** vgridnev has quit IRC | 08:07 | |
| *** dims_ has joined #openstack-keystone | 08:09 | |
| *** fangxu has quit IRC | 08:11 | |
| *** btully has quit IRC | 08:12 | |
| *** agireud has joined #openstack-keystone | 08:17 | |
| *** browne has quit IRC | 08:18 | |
| *** vgridnev has joined #openstack-keystone | 08:23 | |
| *** agireud has quit IRC | 08:24 | |
| *** roxanagh_ has joined #openstack-keystone | 08:27 | |
| *** roxanagh_ has quit IRC | 08:31 | |
| *** pnavarro has joined #openstack-keystone | 08:31 | |
| *** agireud has joined #openstack-keystone | 08:31 | |
| *** dims_ has quit IRC | 08:41 | |
| *** tsymanczyk has joined #openstack-keystone | 08:43 | |
| *** tsymanczyk is now known as Guest9664 | 08:43 | |
| openstackgerrit | Ken'ichi Ohmichi proposed openstack/keystone: Enable os_inherit of Keystone v3 API https://review.openstack.org/257580 | 08:50 |
| openstackgerrit | Ken'ichi Ohmichi proposed openstack/keystone: Enable os_inherit of Keystone v3 API https://review.openstack.org/257580 | 08:52 |
| *** oomichi has joined #openstack-keystone | 08:55 | |
| *** markvoelker has joined #openstack-keystone | 08:55 | |
| *** vgridnev has quit IRC | 08:55 | |
| *** jistr has joined #openstack-keystone | 08:56 | |
| *** markvoelker has quit IRC | 08:59 | |
| *** fhubik has joined #openstack-keystone | 08:59 | |
| *** Guest9664 has quit IRC | 09:03 | |
| *** tsymancz1k has joined #openstack-keystone | 09:04 | |
| *** dims has joined #openstack-keystone | 09:21 | |
| *** mhickey has joined #openstack-keystone | 09:25 | |
| *** roxanagh_ has joined #openstack-keystone | 09:28 | |
| *** roxanagh_ has quit IRC | 09:32 | |
| *** roxanaghe has quit IRC | 09:33 | |
| *** lhcheng has joined #openstack-keystone | 09:41 | |
| *** ChanServ sets mode: +v lhcheng | 09:41 | |
| *** openstackgerrit has quit IRC | 09:47 | |
| *** openstackgerrit has joined #openstack-keystone | 09:47 | |
| *** e0ne has joined #openstack-keystone | 09:48 | |
| *** agireud has quit IRC | 09:49 | |
| *** agireud has joined #openstack-keystone | 09:52 | |
| *** wanghua has quit IRC | 09:53 | |
| *** fhubik has quit IRC | 09:59 | |
| *** e0ne has quit IRC | 09:59 | |
| *** agireud has quit IRC | 09:59 | |
| *** roxanaghe has joined #openstack-keystone | 10:00 | |
| *** e0ne has joined #openstack-keystone | 10:00 | |
| openstackgerrit | Merged openstack/keystone: Add API route for list role assignments for tree https://review.openstack.org/220452 | 10:01 |
| *** aix has joined #openstack-keystone | 10:01 | |
| *** vgridnev has joined #openstack-keystone | 10:05 | |
| *** roxanaghe has quit IRC | 10:06 | |
| *** agireud has joined #openstack-keystone | 10:09 | |
| *** miguelgrinberg has quit IRC | 10:20 | |
| openstackgerrit | Shu Muto proposed openstack/python-keystoneclient-kerberos: Drop py33 support https://review.openstack.org/257807 | 10:22 |
| *** agireud has quit IRC | 10:22 | |
| *** aix has quit IRC | 10:26 | |
| *** wanghua has joined #openstack-keystone | 10:27 | |
| *** aix has joined #openstack-keystone | 10:28 | |
| *** agireud has joined #openstack-keystone | 10:28 | |
| *** zqfan_AFK has quit IRC | 10:31 | |
| *** openstackgerrit has quit IRC | 10:32 | |
| breton | Although it is already fixed, could someone triage https://bugs.launchpad.net/keystone/+bug/1525219 please? | 10:32 |
| openstack | Launchpad bug 1525219 in OpenStack Identity (keystone) "Trust-scoped user requests failed while using fernet tokens" [Undecided,Fix committed] - Assigned to Boris Bobrov (bbobrov) | 10:32 |
| *** openstackgerrit has joined #openstack-keystone | 10:32 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/256053 | 10:33 |
| *** agireud has quit IRC | 10:34 | |
| *** fhubik has joined #openstack-keystone | 10:34 | |
| *** fhubik is now known as fhubik_brb | 10:34 | |
| *** fhubik_brb is now known as fhubik | 10:35 | |
| *** gildub has quit IRC | 10:46 | |
| *** fhubik is now known as fhubik_brb | 10:48 | |
| *** agireud has joined #openstack-keystone | 10:48 | |
| *** yangyapeng has quit IRC | 10:52 | |
| *** EinstCrazy has quit IRC | 10:54 | |
| *** markvoelker has joined #openstack-keystone | 10:55 | |
| *** markvoelker has quit IRC | 11:00 | |
| *** fhubik_brb is now known as fhubik | 11:00 | |
| *** roxanaghe has joined #openstack-keystone | 11:03 | |
| *** tsymancz1k has quit IRC | 11:07 | |
| *** roxanaghe has quit IRC | 11:08 | |
| *** lhcheng_ has joined #openstack-keystone | 11:11 | |
| *** lhcheng has quit IRC | 11:13 | |
| *** dims has quit IRC | 11:15 | |
| *** EinstCrazy has joined #openstack-keystone | 11:18 | |
| *** ig0r_ has quit IRC | 11:20 | |
| *** lhcheng_ has quit IRC | 11:20 | |
| *** lhcheng_ has joined #openstack-keystone | 11:21 | |
| *** lhcheng has joined #openstack-keystone | 11:22 | |
| *** ChanServ sets mode: +v lhcheng | 11:22 | |
| *** lhcheng_ has quit IRC | 11:25 | |
| *** sborkows has joined #openstack-keystone | 11:31 | |
| *** fhubik has quit IRC | 11:47 | |
| *** fhubik has joined #openstack-keystone | 11:50 | |
| *** roxanaghe has joined #openstack-keystone | 12:05 | |
| *** roxanaghe has quit IRC | 12:09 | |
| *** fawadkhaliq has quit IRC | 12:13 | |
| *** fawadkhaliq has joined #openstack-keystone | 12:21 | |
| *** tsymanczyk has joined #openstack-keystone | 12:22 | |
| *** tsymanczyk is now known as Guest23397 | 12:23 | |
| *** fawadkhaliq has quit IRC | 12:23 | |
| *** fawadkhaliq has joined #openstack-keystone | 12:23 | |
| *** fhubik_ has joined #openstack-keystone | 12:25 | |
| *** fhubik_ is now known as fhubik_brb | 12:25 | |
| *** fhubik has quit IRC | 12:28 | |
| *** urulama has quit IRC | 12:34 | |
| *** urulama has joined #openstack-keystone | 12:34 | |
| *** EinstCrazy has quit IRC | 12:35 | |
| *** doug-fish has joined #openstack-keystone | 12:35 | |
| *** EinstCrazy has joined #openstack-keystone | 12:36 | |
| *** dims has joined #openstack-keystone | 12:39 | |
| *** markvoelker has joined #openstack-keystone | 12:41 | |
| *** pnavarro has quit IRC | 12:45 | |
| *** gordc has joined #openstack-keystone | 12:45 | |
| *** markvoelker has quit IRC | 12:46 | |
| *** dims has quit IRC | 12:51 | |
| *** fawadkhaliq has quit IRC | 13:03 | |
| *** oomichi has quit IRC | 13:03 | |
| *** markvoelker has joined #openstack-keystone | 13:04 | |
| *** roxanaghe has joined #openstack-keystone | 13:06 | |
| *** links has quit IRC | 13:09 | |
| *** mkoderer_ has quit IRC | 13:11 | |
| *** roxanaghe has quit IRC | 13:12 | |
| *** mkoderer has joined #openstack-keystone | 13:13 | |
| openstackgerrit | nandal proposed openstack/keystone: Removed Unused variable request https://review.openstack.org/257887 | 13:15 |
| *** Nirupama has quit IRC | 13:17 | |
| *** henrynash_ has quit IRC | 13:21 | |
| *** raildo-afk is now known as raildo | 13:22 | |
| *** petertr7_away has quit IRC | 13:23 | |
| *** petertr7_away has joined #openstack-keystone | 13:24 | |
| *** petertr7_away is now known as petertr7 | 13:24 | |
| *** breitz has quit IRC | 13:31 | |
| *** breitz has joined #openstack-keystone | 13:32 | |
| *** e0ne has quit IRC | 13:34 | |
| *** e0ne has joined #openstack-keystone | 13:35 | |
| *** petertr7 has quit IRC | 13:38 | |
| *** petertr7_away has joined #openstack-keystone | 13:43 | |
| *** petertr7_away is now known as petertr7 | 13:43 | |
| *** martinus__ has quit IRC | 13:45 | |
| *** martinus__ has joined #openstack-keystone | 13:49 | |
| *** opilotte_ has quit IRC | 13:50 | |
| *** links has joined #openstack-keystone | 13:51 | |
| *** aix has quit IRC | 13:52 | |
| *** opilotte_ has joined #openstack-keystone | 13:57 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:00 | |
| openstackgerrit | Merged openstack/keystone: Updated Cloudsample https://review.openstack.org/240720 | 14:01 |
| *** rcernin has joined #openstack-keystone | 14:02 | |
| *** aix has joined #openstack-keystone | 14:05 | |
| *** roxanaghe has joined #openstack-keystone | 14:07 | |
| *** richm has joined #openstack-keystone | 14:09 | |
| *** e0ne has quit IRC | 14:12 | |
| *** roxanaghe has quit IRC | 14:14 | |
| *** csoukup has joined #openstack-keystone | 14:16 | |
| *** fhubik_brb is now known as fhubik_ | 14:19 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/256053 | 14:19 |
| *** pnavarro has joined #openstack-keystone | 14:21 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: List assignments with names https://review.openstack.org/249958 | 14:24 |
| *** edmondsw has joined #openstack-keystone | 14:24 | |
| *** edmondsw has quit IRC | 14:28 | |
| *** topol has joined #openstack-keystone | 14:29 | |
| *** ChanServ sets mode: +v topol | 14:29 | |
| *** topol has quit IRC | 14:30 | |
| *** dims has joined #openstack-keystone | 14:34 | |
| breton | so | 14:36 |
| breton | Adam gets the 968696 t-shirt? | 14:36 |
| amakarov | breton, this time it can be a scarf across the neck :) | 14:37 |
| breton | bug 968696 | 14:38 |
| openstack | bug 968696 in neutron ""admin"-ness not properly scoped" [Undecided,Triaged] https://launchpad.net/bugs/968696 | 14:38 |
| breton | oh, ok, only for keystone. | 14:38 |
| *** fawadkhaliq has quit IRC | 14:39 | |
| amakarov | breton, maybe a baseball bat with the inscription then | 14:39 |
| *** dslevin_ has quit IRC | 14:42 | |
| *** pumaranikar has joined #openstack-keystone | 14:57 | |
| *** links has quit IRC | 14:58 | |
| *** alex_xu has quit IRC | 14:58 | |
| *** links has joined #openstack-keystone | 14:59 | |
| *** pumaranikar has quit IRC | 14:59 | |
| *** pumaranikar has joined #openstack-keystone | 15:00 | |
| *** dims has quit IRC | 15:00 | |
| *** inc0 has quit IRC | 15:00 | |
| *** alex_xu has joined #openstack-keystone | 15:04 | |
| *** aix has quit IRC | 15:09 | |
| *** aix has joined #openstack-keystone | 15:09 | |
| *** topol has joined #openstack-keystone | 15:10 | |
| *** ChanServ sets mode: +v topol | 15:10 | |
| *** roxanaghe has joined #openstack-keystone | 15:10 | |
| *** boris-42_ has joined #openstack-keystone | 15:12 | |
| *** e0ne has joined #openstack-keystone | 15:12 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:14 | |
| *** roxanaghe has quit IRC | 15:15 | |
| *** davechen has joined #openstack-keystone | 15:19 | |
| *** timcline has joined #openstack-keystone | 15:20 | |
| *** vgridnev has quit IRC | 15:26 | |
| *** btully has joined #openstack-keystone | 15:28 | |
| *** slberger has joined #openstack-keystone | 15:29 | |
| *** doug-fish has quit IRC | 15:30 | |
| *** tonytan4ever has joined #openstack-keystone | 15:51 | |
| *** fhubik_ is now known as fhubik_brb | 15:51 | |
| *** kairat has joined #openstack-keystone | 15:55 | |
| *** fhubik_brb is now known as fhubik_ | 15:58 | |
| *** rcernin has quit IRC | 15:58 | |
| *** mfedosin has joined #openstack-keystone | 15:59 | |
| *** raorn has joined #openstack-keystone | 15:59 | |
| kairat | stevemar, ping | 16:00 |
| *** sborkows has quit IRC | 16:02 | |
| kairat | stevemar, if you have some time could you please help us (glance) with questions regarding keystoneauth module (https://review.openstack.org/#/c/241986/15/glance/common/trust_auth.py) | 16:02 |
| *** jaosorior has joined #openstack-keystone | 16:03 | |
| kairat | it seems that there is no way to load trust-scoped auth_plugin when using this module | 16:03 |
| *** diazjf has joined #openstack-keystone | 16:07 | |
| stevemar | kairat: sure, i saw that request yesterday and forgot about it | 16:10 |
| stevemar | kairat: i was working with mfedosin on it earlier | 16:10 |
| *** roxanaghe has joined #openstack-keystone | 16:11 | |
| stevemar | if any other keystoners wants to take a look, they are welcome to: https://review.openstack.org/#/c/241986/ cc jamielennox dstanek bknudson lhcheng dolphm | 16:11 |
| stevemar | we can help our glance peers :) | 16:11 |
| bknudson | why does glance need to use trusts? | 16:14 |
| kairat | because glance has registry | 16:14 |
| kairat | it requires authorization | 16:14 |
| bknudson | the user sends you a token, use that. | 16:15 |
| bknudson | or get your own token | 16:15 |
| *** roxanaghe has quit IRC | 16:15 | |
| mfedosin | bknudson: after image upload user token may expire | 16:15 |
| bknudson | I don't think this was the reason that trusts were added. | 16:16 |
| bknudson | we discussed some other possible solutions at the summit ... | 16:16 |
| bknudson | not sure what happened to the implementation. I guess people got busy with other things. | 16:16 |
| mfedosin | I know about service tokens | 16:16 |
| mfedosin | but it's not a solution in current implementation | 16:17 |
| bknudson | the solutions that were discussed were to allow extending the token lifetime, or allowing use of an expired token (given a service token) | 16:17 |
| mfedosin | because we can't get original user info with expired token | 16:18 |
| bknudson | right, using the service token is going to require changes in keystone | 16:19 |
| mfedosin | and trusts considered to be the only one solution until service tokens will be improved | 16:19 |
| mfedosin | we mentioned this in our spec | 16:19 |
| bknudson | ok, but now you're having problems with trusts, so apparently that requires improvements, too. | 16:20 |
| *** topol has quit IRC | 16:21 | |
| *** pnavarro has quit IRC | 16:21 | |
| mfedosin | the improvements are obvious | 16:21 |
| mfedosin | we just need an ability to load a session with trust | 16:22 |
| *** pgbridge has joined #openstack-keystone | 16:22 | |
| mfedosin | we can implement a workaround in glance for it, but it's better to do in keystoneauth, I think | 16:22 |
| bknudson | I agree keystoneauth is the right place for it. | 16:23 |
| stevemar | mfedosin: bknudson what's the trouble with using trusts? | 16:32 |
| mfedosin | stevemar: it's in keystoneauth loading module | 16:33 |
| mfedosin | we can't load a session from config and provide a trust_id there | 16:34 |
| *** fhubik_ is now known as fhubik_brb | 16:36 | |
| *** browne has joined #openstack-keystone | 16:37 | |
| stevemar | mfedosin: uh oh - did you submit a patch to ksa? or not sure what to fix there? | 16:37 |
| mfedosin | stevemar: not yet | 16:38 |
| mfedosin | this exception is raised in this case https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/v3/base.py#L158-L161 | 16:38 |
| mfedosin | sorry, this one https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/identity/v3/base.py#L134-L137 | 16:39 |
| mfedosin | I will try to fix it tomorrow | 16:40 |
| *** flwang1 has joined #openstack-keystone | 16:41 | |
| stevemar | mfedosin: what's the issue with that? | 16:46 |
| stevemar | it should be either domain or project or trust | 16:46 |
| mfedosin | when we load a session from config, project_id it there. if we additionally provide trust_id, then keystoneauth loads both and after any call we get this exception | 16:48 |
| mfedosin | stevemar: there should be a way not to load project_id if trust_id is provided | 16:49 |
| stevemar | mfedosin: no sir | 16:50 |
| stevemar | mfedosin: i thought i mentioned this in an earlier review | 16:50 |
| stevemar | where you were re-using the client with the same args | 16:50 |
| *** roxanaghe has joined #openstack-keystone | 16:50 | |
| *** fhubik_brb is now known as fhubik_ | 16:50 | |
| *** rderose has joined #openstack-keystone | 16:52 | |
| mfedosin | stevemar: please look here: https://review.openstack.org/#/c/241986/17/glance/common/trust_auth.py lines #46-53 | 16:55 |
| mfedosin | is there any way to do thing like on the line 36? | 16:56 |
| stevemar | mfedosin: hmm, you're not passing in the project id | 16:56 |
| stevemar | i wonder why it's complaining | 16:56 |
| mfedosin | no, there it works | 16:57 |
| mfedosin | but if but if we do trustee_auth = conf.load_from_conf_options(CONF, 'keystone_authtoken', trust_id=trust_id) it fails with the exception | 16:59 |
| *** david-lyle has quit IRC | 17:02 | |
| *** gyee has joined #openstack-keystone | 17:03 | |
| *** ChanServ sets mode: +v gyee | 17:03 | |
| *** tonytan4ever has quit IRC | 17:04 | |
| *** HoloIRCUser2 has joined #openstack-keystone | 17:06 | |
| *** HoloIRCUser2 has quit IRC | 17:11 | |
| *** HoloIRCUser2 has joined #openstack-keystone | 17:12 | |
| *** david-lyle has joined #openstack-keystone | 17:12 | |
| *** raies has joined #openstack-keystone | 17:14 | |
| *** rderose has quit IRC | 17:15 | |
| *** HoloIRCUser2 has quit IRC | 17:15 | |
| *** fhubik_ is now known as fhubik_brb | 17:18 | |
| stevemar | mfedosin: yep, that i expect, since you are passing in project stuff in that line | 17:18 |
| *** e0ne has quit IRC | 17:19 | |
| raies | hi | 17:21 |
| raies | I wanted to make keystone identity backend as ldap | 17:22 |
| raies | This is single node setup | 17:22 |
| *** vgridnev has joined #openstack-keystone | 17:25 | |
| raies | I created a file - openstack.ldif | 17:25 |
| raies | openstack.ldif dn: ou=Groups,dc=domain,dc=tld objectClass: top objectClass: organizationalUnit ou: groups dn: ou=Users,dc=domain,dc=tld objectClass: top objectClass: organizationalUnit ou: users dn: ou=Roles,dc=domain,dc=tld objectClass: top objectClass: organizationalUnit ou: roles dn: ou=Projects,dc=domain,dc=tld objectClass: top objectClass: organizationalUnit ou: projects | 17:26 |
| raies | In keystone.conf - | 17:26 |
| raies | [identity] driver=keystone.identity.backends.ldap.Identity [assignment] driver=keystone.assignment.backends.sql.Assignment [ldap] ### Flags with "###" are not required in case only identity in ldap url=ldaps://locahost user='cn=admin,dc=domain,dc=tld' password=admin suffix='dc=domain,dc=tld' ###use_dumb_member=true ###dumb_member='cn=dumb,dc=domain,dc=tld' user_tree_dn='ou=Users,dc=domain,dc=tld' user_mail_attribute= | 17:27 |
| raies | under default section of keystone.conf - | 17:27 |
| raies | [DEFAULT] admin_token=password admin_workers = 2 max_token_size = 16384 debug = True admin_bind_host = 192.168.1.3 member_role_name = _member_ member_role_id = 9fe2ff9ee4384b1894a90878d3e92bab | 17:27 |
| raies | After these settings when I run keystone user-list | 17:28 |
| *** lhcheng_ has joined #openstack-keystone | 17:28 | |
| raies | I can not see any service user | 17:28 |
| raies | user list is empty | 17:28 |
| *** topol has joined #openstack-keystone | 17:29 | |
| *** ChanServ sets mode: +v topol | 17:29 | |
| *** petertr7 is now known as petertr7_away | 17:30 | |
| raies | Also when I tried to create new user using keystone client, following error comes - | 17:30 |
| raies | "An unexpected error prevented the server from fulfilling your request. {'desc': 'No such object', 'matched': 'dc=openstack,dc=org'} (HTTP 500)" | 17:30 |
| raies | any help on this ? | 17:30 |
| raies | how to correctly configure ldap with keystone ? and how to ensure service users using ldap ? | 17:31 |
| *** lhcheng has quit IRC | 17:31 | |
| stevemar | raies: you really don't want to use a single LDAP backend for all identities | 17:31 |
| stevemar | we won't be supporting write operations to LDAP in the future (create/update/delete) | 17:31 |
| stevemar | raies: check out how to enable multi domain support | 17:32 |
| raies | stevemar: ok fine | 17:33 |
| raies | stevemar: I will check it out | 17:33 |
| stevemar | raies: there's a lot of into online: http://docs.openstack.org/developer/keystone/configuration.html#domain-specific-drivers - http://richmegginson.livejournal.com/25846.html and https://developer.ibm.com/opentech/2015/08/14/configuring-keystone-with-ibms-bluepages-ldap/ | 17:34 |
| *** topol has quit IRC | 17:34 | |
| raies | stevemar: But I am playing with icehouse and wanted to set single domain ldap backend for iceouse | 17:34 |
| *** pnavarro has joined #openstack-keystone | 17:35 | |
| raies | stevemar: As per my understanding, keystone user-list must reflect atleast service users, after setting backend as ldap | 17:37 |
| raies | But I am not sure of it | 17:37 |
| *** doug-fish has joined #openstack-keystone | 17:37 | |
| *** doug-fish has quit IRC | 17:37 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:38 | |
| raies | In my case I have set assignment as sql and identity as ldap | 17:38 |
| *** doug-fish has joined #openstack-keystone | 17:38 | |
| raies | Although service users are already there in cloud but keystone user-list does not reflect it. Output of user-list is blank | 17:39 |
| *** david8hu has joined #openstack-keystone | 17:39 | |
| *** markvoelker_ has joined #openstack-keystone | 17:40 | |
| *** markvoelker has quit IRC | 17:41 | |
| *** fhubik_brb is now known as fhubik_ | 17:42 | |
| *** RichardRaseley has joined #openstack-keystone | 17:42 | |
| *** tonytan4ever has joined #openstack-keystone | 17:45 | |
| stevemar | raies: why are you using icehouse? we don't even support it any longer :( | 17:45 |
| raies | I am working with a project where I need to make real like env | 17:46 |
| raies | and real env is icehouse | 17:46 |
| raies | icehouse + ldap backend | 17:46 |
| raies | So I wanted to make a real like env. Thus I can work on this | 17:46 |
| *** markvoelker_ has quit IRC | 17:47 | |
| raildo | stevemar: ping, I'm wondering, how the API v2.0 deprecation will impact other services, like any service that can't autenticate with API v3... | 17:48 |
| raildo | stevemar: someting like https://bugs.launchpad.net/ironic/+bug/1494776 | 17:48 |
| openstack | Launchpad bug 1494776 in Ironic "Ironic API fails when keystone /v2.0 pipeline is disabled" [High,Confirmed] - Assigned to Pavlo Shchelokovskyy (pshchelo) | 17:48 |
| raildo | stevemar: or https://bugs.launchpad.net/openstack-ansible/+bug/1509272 | 17:48 |
| openstack | Launchpad bug 1509272 in openstack-ansible " Set Keystone endpoints to be v3 by default" [Low,Confirmed] - Assigned to RPC Documentation (rpcdocs) | 17:48 |
| stevemar | raildo: they need to get on board :) | 17:49 |
| stevemar | raildo: they'll receive deprecation warnings for 2 years before they are broken | 17:49 |
| raildo | stevemar: sure.. and I want to help it :) | 17:49 |
| *** markvoelker has joined #openstack-keystone | 17:49 | |
| stevemar | raildo: i'm sure they will appreciate the help! | 17:50 |
| raildo | on keystone side, we don't need to do anything more, right? | 17:50 |
| *** links has quit IRC | 17:50 | |
| stevemar | raildo: dont think so | 17:50 |
| odyssey4me | stevemar raies heat, glance, nova, cinder, horizon, neutron, swift are all ok as at Liberty release | 17:50 |
| *** browne has quit IRC | 17:51 | |
| raildo | stevemar: great :) | 17:51 |
| odyssey4me | sorry, meant to include raildo | 17:51 |
| raildo | odyssey4me: np | 17:51 |
| odyssey4me | we (OpenStack-Ansible) gate test on Keystone v3 API only from Liberty onward | 17:51 |
| odyssey4me | only Aodh and Ceilometer are still a little funky | 17:52 |
| *** urulama has quit IRC | 17:52 | |
| *** pnavarro has quit IRC | 17:52 | |
| *** urulama has joined #openstack-keystone | 17:52 | |
| odyssey4me | Ceilometer merged https://review.openstack.org/237537 recently, getting on board the the v3 API | 17:53 |
| raildo | odyssey4me: awesome :) | 17:53 |
| samueldmq | odyssey4me: raildo: in addition, devstack has a v3 only gate | 17:55 |
| samueldmq | see gate-tempest-dsvm-neutron-identity-v3-only-full in any devstack change | 17:55 |
| samueldmq | e.g https://review.openstack.org/#/c/255898/ | 17:56 |
| *** rderose has joined #openstack-keystone | 17:56 | |
| *** vgridnev has quit IRC | 17:58 | |
| *** HoloIRCUser1 has joined #openstack-keystone | 17:59 | |
| stevemar | poke for meeting: ajayaa, amakarov, ayoung, breton, browne, davechen, david8hu, dolphm, dstanek, ericksonsantos, geoffarnold, gyee, henrynash, hogepodge, htruta, jamielennox, joesavak, lbragstad, lhcheng, marekd, morganfainberg, nkinder, raildo, rodrigods, roxanaghe, samueldmq, shaleh, stevemar, tsymanczyk, topol, vivekd, wanghong, claudiub, rderose, samleon, xek, MaxPC, tjcocozz | 17:59 |
| dolphm | \o/ | 17:59 |
| *** lhcheng_ is now known as lhcheng | 17:59 | |
| *** ChanServ sets mode: +v lhcheng | 17:59 | |
| *** mhickey has quit IRC | 18:00 | |
| roxanaghe | o/ | 18:00 |
| *** HoloIRCUser1 is now known as TomCocozz | 18:00 | |
| navidp | o/ | 18:00 |
| *** henrynash has joined #openstack-keystone | 18:02 | |
| *** ChanServ sets mode: +v henrynash | 18:02 | |
| *** fhubik_ is now known as fhubik_brb | 18:02 | |
| *** e0ne has joined #openstack-keystone | 18:04 | |
| *** tonytan4ever has quit IRC | 18:08 | |
| *** fhubik_brb is now known as fhubik_ | 18:10 | |
| navidp | join #openstack-meeting | 18:11 |
| *** flwang1 has quit IRC | 18:11 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/256486 | 18:12 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/258040 | 18:13 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/258041 | 18:13 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/258052 | 18:16 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/258059 | 18:16 |
| *** diazjf has quit IRC | 18:17 | |
| *** Alexander has joined #openstack-keystone | 18:18 | |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: WIP Refactor use of oslo.db.sqlalchemy.session.EngineFacade https://review.openstack.org/257458 | 18:18 |
| *** Alexander is now known as amakarov_ | 18:19 | |
| *** jistr has quit IRC | 18:22 | |
| *** TomCocozz has quit IRC | 18:23 | |
| *** aginwala has joined #openstack-keystone | 18:23 | |
| *** mfedosin has quit IRC | 18:27 | |
| *** topol has joined #openstack-keystone | 18:27 | |
| *** ChanServ sets mode: +v topol | 18:27 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:31 | |
| openstackgerrit | Merged openstack/keystone: Validate domain for DB-based domain config. CRUD https://review.openstack.org/256889 | 18:34 |
| *** iurygregory has quit IRC | 18:36 | |
| *** ericksonsantos has quit IRC | 18:36 | |
| *** browne has joined #openstack-keystone | 18:39 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/256486 | 18:39 |
| *** aginwala has quit IRC | 18:40 | |
| *** aginwala has joined #openstack-keystone | 18:40 | |
| *** fhubik_ is now known as fhubik_brb | 18:42 | |
| *** Guest73233 is now known as mgagne | 18:42 | |
| *** fhubik_brb is now known as fhubik_ | 18:42 | |
| *** mgagne is now known as Guest76434 | 18:42 | |
| *** browne has quit IRC | 18:43 | |
| *** browne has joined #openstack-keystone | 18:43 | |
| *** dims has joined #openstack-keystone | 18:45 | |
| *** raildo is now known as raildo-afk | 18:48 | |
| *** harlowja_ has quit IRC | 18:49 | |
| *** harlowja has joined #openstack-keystone | 18:50 | |
| *** aginwala has quit IRC | 18:50 | |
| *** browne has quit IRC | 18:50 | |
| *** aginwala has joined #openstack-keystone | 18:52 | |
| gyee | bknudson, https://review.openstack.org/226464, devstack is broken even without this patch | 18:59 |
| *** aix has quit IRC | 18:59 | |
| *** rderose has quit IRC | 18:59 | |
| gyee | if you set you public_endpoint to http://host:5000/identity | 19:00 |
| gyee | I just verified it in devstack even without that patch | 19:00 |
| bknudson | I don't set public_endpoint to http://host:5000/identity , I'd set it to http://host/identity | 19:00 |
| *** raies has quit IRC | 19:01 | |
| bknudson | and I agree devstack is broken since it's not setting public_endpoint when it should be... I've got a patch up for that. | 19:01 |
| gyee | bknudson, same thing | 19:01 |
| gyee | I set it to http://host/identity | 19:02 |
| gyee | same result, got /identity/identity | 19:02 |
| gyee | so it's already broken without that patch | 19:02 |
| bknudson | oh, let met try it. | 19:02 |
| henrynash | dstanek: if you do look at https://review.openstack.org/#/c/242513/ feel free to +2/A it if you think it is OK | 19:02 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/256053 | 19:03 |
| bknudson | gyee: that's not what happens for me, I get "href": "http://192.168.122.239/identity/v3/" | 19:03 |
| gyee | bkudson, that's latest devstack? | 19:04 |
| dstanek | henrynash: you're next on my board - https://trello.com/b/kAcLdBiq/openstack | 19:04 |
| bknudson | gyee: yes, devstack is up to date | 19:04 |
| bknudson | and keystone | 19:04 |
| gyee | that's weird, let me do a fresh clone | 19:05 |
| bknudson | I set public_endpoint = http://192.168.122.239/identity and admin_endpoint = http://192.168.122.239/identity_admin in keystone.conf | 19:06 |
| bknudson | gyee: here's the devstack patch (it worked earlier) | 19:06 |
| bknudson | https://review.openstack.org/#/c/193894/ | 19:06 |
| gyee | bknudson, ah, ok, I can reproduce it now | 19:07 |
| gyee | bknudson, I was using a special branch :) | 19:08 |
| bknudson | good to know keystone isn't totally broken | 19:08 |
| gyee | let me pull that patch and try again | 19:10 |
| stevemar | gyee: "special" | 19:10 |
| stevemar | gyee: everything about you is special | 19:10 |
| gyee | stevemar, I was doing some experimentation | 19:11 |
| gyee | stevemar, lol | 19:11 |
| henrynash | dstaneK; that’s nice | 19:12 |
| stevemar | also btw, there are some blueprints targeted to mitaka-2 that have not yet been started! :) https://launchpad.net/keystone/+milestone/mitaka-2 - looking at you dolphm (shadow users), henrynash (DSR and domain config defaults) and rodrigods (filtering SPs) | 19:12 |
| henrynash | dstanek: trello, taht is | 19:12 |
| stevemar | henrynash: i'll cut you some slack since you have like 18 blueprints | 19:13 |
| dstanek | henrynash: it's a work in progress | 19:13 |
| henrynash | stevemar: under control (ish) | 19:13 |
| stevemar | but as a heads up - have code up for review before mitaka-2 ends, or it's gonna get the boot! | 19:13 |
| stevemar | it can land in mitaka-3, but have something up! | 19:14 |
| gyee | and demo it in mid-cycle :) | 19:15 |
| *** fangxu has joined #openstack-keystone | 19:19 | |
| *** browne has joined #openstack-keystone | 19:20 | |
| stevemar | gyee: now we're talking | 19:22 |
| stevemar | yay new keystone patches should have a job for legacy drivers | 19:22 |
| *** jaosorior has quit IRC | 19:23 | |
| *** henrynash has quit IRC | 19:24 | |
| *** vgridnev has joined #openstack-keystone | 19:24 | |
| rodrigods | stevemar: :( maybe marekd and/or iurygregory can take care of it (filtering SPs)? | 19:26 |
| bknudson | stevemar: I proposed a couple of changes to -infra for keystone testing. | 19:26 |
| bknudson | which I guess they have to work before anyone's going to merge them. | 19:27 |
| openstackgerrit | Fangzhou Xu proposed openstack/keystone: Make getting token revocation list 9x faster on Mysql https://review.openstack.org/239608 | 19:28 |
| *** browne has quit IRC | 19:29 | |
| *** browne has joined #openstack-keystone | 19:30 | |
| *** browne has quit IRC | 19:32 | |
| *** openstackgerrit has quit IRC | 19:32 | |
| *** browne has joined #openstack-keystone | 19:32 | |
| *** openstackgerrit has joined #openstack-keystone | 19:32 | |
| *** browne has quit IRC | 19:33 | |
| *** browne has joined #openstack-keystone | 19:33 | |
| *** e0ne has quit IRC | 19:34 | |
| *** e0ne_ has joined #openstack-keystone | 19:35 | |
| *** browne has quit IRC | 19:35 | |
| *** browne has joined #openstack-keystone | 19:36 | |
| *** henrynash has joined #openstack-keystone | 19:37 | |
| *** ChanServ sets mode: +v henrynash | 19:37 | |
| *** flwang1 has joined #openstack-keystone | 19:40 | |
| stevemar | bknudson: those are the ones you cc'ed me on for eventlet and such? i haven't had a chance to look at them yet | 19:41 |
| *** aginwala has quit IRC | 19:41 | |
| stevemar | but they are on my list | 19:41 |
| bknudson | stevemar: yes | 19:41 |
| *** jaosorior has joined #openstack-keystone | 19:41 | |
| stevemar | bknudson: cool, i'll look at them soon | 19:42 |
| *** e0ne_ has quit IRC | 19:42 | |
| *** aginwala has joined #openstack-keystone | 19:44 | |
| *** tonytan4ever has joined #openstack-keystone | 19:52 | |
| *** gyee has quit IRC | 19:54 | |
| *** vgridnev has quit IRC | 19:55 | |
| *** roxanaghe has quit IRC | 19:59 | |
| dolphm | stevemar: what's the mitaka 2 deadline? | 20:10 |
| *** fhubik has joined #openstack-keystone | 20:11 | |
| stevemar | dolphm: http://docs.openstack.org/releases/schedules/mitaka.html | 20:11 |
| stevemar | dolphm: the last day to propose code for a spec that is landing in mitaka is jan16-22 | 20:12 |
| *** urulama has quit IRC | 20:12 | |
| stevemar | dolphm: *before* the midcycle ;) | 20:12 |
| *** fhubik has quit IRC | 20:12 | |
| *** jaosorior has quit IRC | 20:12 | |
| *** urulama has joined #openstack-keystone | 20:12 | |
| *** e0ne has joined #openstack-keystone | 20:13 | |
| *** e0ne_ has joined #openstack-keystone | 20:15 | |
| *** e0ne has quit IRC | 20:16 | |
| *** fangxu has quit IRC | 20:17 | |
| *** mfedosin has joined #openstack-keystone | 20:23 | |
| *** Ephur has joined #openstack-keystone | 20:23 | |
| *** aginwala has quit IRC | 20:35 | |
| *** pumarani- has joined #openstack-keystone | 20:38 | |
| *** aginwala has joined #openstack-keystone | 20:38 | |
| *** lhcheng has quit IRC | 20:39 | |
| *** rm_you has quit IRC | 20:43 | |
| *** lhcheng has joined #openstack-keystone | 20:45 | |
| *** ChanServ sets mode: +v lhcheng | 20:45 | |
| *** lhcheng has quit IRC | 20:46 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add audit IDs to revocation events https://review.openstack.org/258141 | 20:48 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add audit IDs to revocation events https://review.openstack.org/258141 | 20:48 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Verify audit_id when available https://review.openstack.org/258143 | 20:49 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Verify audit_id when available https://review.openstack.org/258143 | 20:49 |
| *** phalmos has joined #openstack-keystone | 20:53 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: WORK IN PROGRESS!!!!! List assignments with names https://review.openstack.org/249958 | 20:53 |
| *** dslev has joined #openstack-keystone | 20:57 | |
| notmorgan | stevemar: i wasn't aware we ever wanted PBR to be a runtime requirement for libraries... | 20:58 |
| *** doug-fish has quit IRC | 20:58 | |
| *** e0ne_ has quit IRC | 20:59 | |
| *** fangxu has joined #openstack-keystone | 20:59 | |
| *** gyee has joined #openstack-keystone | 21:01 | |
| *** ChanServ sets mode: +v gyee | 21:01 | |
| *** timcline has quit IRC | 21:04 | |
| *** jaosorior has joined #openstack-keystone | 21:11 | |
| *** jaosorior has quit IRC | 21:11 | |
| *** jaosorior has joined #openstack-keystone | 21:11 | |
| *** topol has quit IRC | 21:13 | |
| *** flwang1 has quit IRC | 21:16 | |
| stevemar | notmorgan: link? | 21:17 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:17 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 21:17 | |
| stevemar | tjcocozz: so you're saying its a work in progress? | 21:18 |
| *** timcline has joined #openstack-keystone | 21:21 | |
| *** doug-fish has joined #openstack-keystone | 21:25 | |
| *** doug-fish has quit IRC | 21:29 | |
| *** e0ne has joined #openstack-keystone | 21:30 | |
| *** amakarov_ has quit IRC | 21:31 | |
| *** flwang1 has joined #openstack-keystone | 21:31 | |
| *** aginwala has quit IRC | 21:31 | |
| *** Guest76434 is now known as mgagne | 21:33 | |
| *** mgagne is now known as Guest160 | 21:34 | |
| *** Guest160 has quit IRC | 21:34 | |
| *** Guest160 has joined #openstack-keystone | 21:34 | |
| *** Guest160 is now known as mgagne | 21:35 | |
| *** jaosorior has quit IRC | 21:41 | |
| *** timcline has quit IRC | 21:44 | |
| *** mfedosin has quit IRC | 21:49 | |
| *** lhcheng has joined #openstack-keystone | 21:50 | |
| *** ChanServ sets mode: +v lhcheng | 21:50 | |
| notmorgan | stevemar: uhmm keystoneauth RFC agent string | 21:51 |
| notmorgan | stevemar: need to find the review again, sorry it got lost in a tab | 21:51 |
| notmorgan | https://review.openstack.org/#/c/256002/ | 21:52 |
| notmorgan | stevemar: ^ | 21:52 |
| *** petertr7_away is now known as petertr7 | 21:56 | |
| *** andreykurilin__ has joined #openstack-keystone | 21:57 | |
| *** david-lyle has quit IRC | 21:58 | |
| *** doug-fish has joined #openstack-keystone | 21:58 | |
| *** david-lyle has joined #openstack-keystone | 22:00 | |
| stevemar | notmorgan: -1 it! | 22:08 |
| notmorgan | stevemar: i don't know if it's something we want/not-want | 22:09 |
| notmorgan | stevemar: it was more of a "is this correct?" | 22:09 |
| stevemar | either way, pbr isn't listed in requirements | 22:09 |
| notmorgan | ah | 22:09 |
| stevemar | i wasn't sure either :\ | 22:09 |
| stevemar | thanks notmorgan | 22:10 |
| stevemar | you're the best | 22:10 |
| *** rcernin has joined #openstack-keystone | 22:16 | |
| *** aginwala has joined #openstack-keystone | 22:19 | |
| openstackgerrit | Dan Nguyen proposed openstack/python-keystoneclient: Add include_subtree to role_list_assignments call https://review.openstack.org/188184 | 22:19 |
| briancurtin | stevemar: so should i put it in the requirements file, or is there a different way to get the version? | 22:21 |
| *** doug-fish has quit IRC | 22:22 | |
| stevemar | briancurtin: i legitimately don't know if :) | 22:23 |
| briancurtin | fwiw, a quick look around shows o-c-c and swiftclient do the same pbr thing, though swiftclient makes a first attempt to use pkg_resources | 22:25 |
| briancurtin | oh, so does keystoneclient | 22:27 |
| stevemar | briancurtin: whats the sdk do? | 22:27 |
| stevemar | you guys just use pbr | 22:27 |
| stevemar | hmm | 22:27 |
| briancurtin | the same as what those + the ksa review. what i entered in that ksa review was pulled straight from SDK | 22:28 |
| stevemar | gotcha | 22:28 |
| stevemar | i just wanted to step back and pause/question before going forward | 22:28 |
| briancurtin | makes sense | 22:28 |
| stevemar | but we do need pbr in requirements.txt at a minimum | 22:28 |
| *** timcline has joined #openstack-keystone | 22:29 | |
| *** timcline has quit IRC | 22:29 | |
| stevemar | i'll let jamielennox and mordred chime in too: https://review.openstack.org/#/c/256002/ maybe they have another opinion | 22:29 |
| briancurtin | if the others on the review are ok with that approach solving the problem, i’ll add it to requirements | 22:29 |
| *** timcline has joined #openstack-keystone | 22:29 | |
| stevemar | do it up | 22:30 |
| *** gildub has joined #openstack-keystone | 22:32 | |
| *** e0ne has quit IRC | 22:32 | |
| stevemar | anyone want to push through an easy review? https://review.openstack.org/#/c/257131/ | 22:35 |
| openstackgerrit | Brian Curtin proposed openstack/keystoneauth: Provide a RFC 7231 compliant user agent string https://review.openstack.org/256002 | 22:38 |
| *** dslev has quit IRC | 22:39 | |
| *** ericksonsantos has joined #openstack-keystone | 22:42 | |
| *** iurygregory has joined #openstack-keystone | 22:42 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: remove venv bits from tools https://review.openstack.org/258175 | 22:42 |
| *** timcline has quit IRC | 22:44 | |
| openstackgerrit | Brian Curtin proposed openstack/keystoneauth: Provide a RFC 7231 compliant user agent string https://review.openstack.org/256002 | 22:45 |
| *** dslev_ has joined #openstack-keystone | 22:47 | |
| jamielennox | stevemar, briancurtin: i'm happy with the concept | 22:49 |
| jamielennox | lifeless: regarding https://review.openstack.org/#/c/256002/ - do we need the pbr dependency there? | 22:49 |
| *** phalmos has quit IRC | 22:51 | |
| jamielennox | stevemar: i'd like to get https://review.openstack.org/#/c/253972/ through if you can have a look | 22:52 |
| *** iurygregory has quit IRC | 22:53 | |
| *** iurygregory has joined #openstack-keystone | 22:53 | |
| notmorgan | mordred: https://review.openstack.org/256002 not sure if this is right. again, thinking PBR isn't really meant to be runtime like this | 22:54 |
| stevemar | jamielennox: o/ | 22:54 |
| *** dstanek has quit IRC | 22:56 | |
| stevemar | jamielennox: done | 22:56 |
| *** dstanek has joined #openstack-keystone | 22:56 | |
| *** ChanServ sets mode: +v dstanek | 22:56 | |
| stevemar | jamielennox: swap for review: https://review.openstack.org/#/c/258175/ | 22:56 |
| notmorgan | briancurtin: i'm wondering if we can do a 1-time on setup thing instead of calling to PBR for version each time | 22:56 |
| jamielennox | easy | 22:57 |
| jamielennox | stevemar: also https://review.openstack.org/#/c/255691/ | 22:58 |
| jamielennox | need that to make the auth_token in middleware bits public | 22:58 |
| *** petertr7 is now known as petertr7_away | 22:59 | |
| *** tonytan4ever has quit IRC | 23:00 | |
| lifeless | jamielennox: yes | 23:00 |
| lifeless | jamielennox: (why is that even a question) | 23:00 |
| *** david-lyle has quit IRC | 23:01 | |
| jamielennox | lifeless: right - if we do it via pbr we need that, this came up a while ago and i thought pbr wasn't supposed to be a runtime dep | 23:01 |
| jamielennox | that we should do that sort of veresion discovery via setuptools | 23:01 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: remove CLI from keystoneclient https://review.openstack.org/258181 | 23:01 |
| lifeless | pbr is totally a runtime dep | 23:01 |
| *** david-lyle has joined #openstack-keystone | 23:01 | |
| lifeless | its also a build time dep - the only one we allow | 23:01 |
| lifeless | if you do it via pkg_resources, be sure to add in the calls to git to handle uninstalled trees | 23:02 |
| lifeless | (oh, and dep on pkg_resources, since you'll be using that) - glwt :) | 23:02 |
| lifeless | sorry for the snark... this keeps coming up and I don't know how to kill the meme | 23:02 |
| lifeless | I mean - we document it, its in g-r, its in cookiecutter. | 23:03 |
| jamielennox | ok, i don't remember where it came up that we shouldn't be using it at runtime but that's ok with me | 23:03 |
| lifeless | the redhat distro folk | 23:04 |
| lifeless | who have repeated said 'its a problem' on the -dev list, but have not to the best of my knowledge yet filed a bug or detailed description of the problem | 23:04 |
| lifeless | have pushed that concept | 23:04 |
| jamielennox | they used to hack it out in rpm - but last i looked they'd stopped doing that | 23:04 |
| kfox1111 | do you have to do anything in liberty keystone to get ec2 compatability? | 23:04 |
| lifeless | separately there was a performance thing where it was implicated in slow CLI startup | 23:04 |
| kfox1111 | We recently switched our keystone to liberty version, and just now realized heat cfn service isn't working. | 23:05 |
| *** fangxu_ has joined #openstack-keystone | 23:05 | |
| *** fangxu has quit IRC | 23:05 | |
| *** fangxu_ is now known as fangxu | 23:05 | |
| lifeless | but we couldn't reproduce and that's gone quiet - but it shouldn't ever be slow (unless you're running from-git-without-installing), which is not a common case! [and even then, it should only read history to the last tag, so not much work) | 23:05 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: move hacking to tests folder https://review.openstack.org/258183 | 23:06 |
| *** dstanek has quit IRC | 23:06 | |
| *** aginwala has quit IRC | 23:07 | |
| jamielennox | lifeless: ok, well that's an easy dependency to add then, thanks | 23:07 |
| *** dstanek has joined #openstack-keystone | 23:07 | |
| *** ChanServ sets mode: +v dstanek | 23:07 | |
| *** aginwala has joined #openstack-keystone | 23:07 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: move hacking to tests folder https://review.openstack.org/258183 | 23:08 |
| stevemar | jamielennox: got another one for you ^ | 23:08 |
| jamielennox | stevemar: that works? | 23:09 |
| jamielennox | stevemar: ok, works for me then | 23:09 |
| stevemar | jamielennox: why do you sound surprised? | 23:10 |
| davechen | stevemar: do you know what's client or what's service currntly using full auth flow? | 23:10 |
| jamielennox | stevemar: hacking has been in the base folder for everything - i thought there must be a reason | 23:10 |
| stevemar | nope https://github.com/openstack/keystone/tree/master/keystone/tests/hacking | 23:10 |
| stevemar | davechen: not clear one whay you mean? | 23:10 |
| davechen | stevemar: i was thinking it using this router to get all of the projects. - https://github.com/openstack/keystone/blob/master/keystone/resource/routers.py#L28-L31 | 23:10 |
| stevemar | davechen: do i have an example? | 23:11 |
| davechen | stevemar: the decorator you are using "v2_auth_deprecated" for this method "get_projects_for_token" | 23:11 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Bootstrap https://review.openstack.org/256634 | 23:11 |
| *** urulama has quit IRC | 23:12 | |
| davechen | stevemar: i am just want to see if there any service or client still using full auth flow | 23:12 |
| lifeless | jamielennox: EPARSE: pbr is an easy dep to add? <- is what you meant? | 23:12 |
| stevemar | davechen: ohhh, there wouldn't be one in an openstack repo | 23:12 |
| *** urulama has joined #openstack-keystone | 23:12 | |
| davechen | looks like all of them combined into one step | 23:12 |
| davechen | and it's not using this one - https://github.com/openstack/keystone/blob/master/keystone/resource/routers.py#L28-L31? | 23:12 |
| jamielennox | lifeless: right, we've been trying to keep keystoneauth really light weight, absolutely minimal dependencies and argue about if we need them at all | 23:13 |
| stevemar | davechen: i'm just thinking in case a user has their own home-made CLI/script that just uses rest calls | 23:13 |
| kfox1111 | any known problems with kilo heat-api-cfn and liberty keystone? | 23:13 |
| jamielennox | lifeless: PBR should cause too many problems getting through | 23:13 |
| stevemar | kfox1111: not to my knowledge :( | 23:13 |
| jamielennox | lifeless: s/should/shouldn't | 23:13 |
| davechen | stevemar: okay, that's not surprise i didn't see it anywhere, thanks! | 23:14 |
| kfox1111 | k. I'll keep digging. thanks. | 23:14 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:15 | |
| lifeless | jamielennox: cool | 23:15 |
| notmorgan | lifeless: ftr, i'm fine with PBR being runtime but it's the endless cycle of remembering complaints about it | 23:17 |
| lifeless | notmorgan: yah | 23:17 |
| notmorgan | lifeless: last time i stared at it, it was just a build-time thing that caused no complaints. so rather be sure before landing a dep on it at runtime especially in keystoneauth :) | 23:17 |
| lifeless | notmorgan: I blame mordred for sucking me into it | 23:18 |
| *** rcernin has quit IRC | 23:20 | |
| *** flwang1 has quit IRC | 23:21 | |
| openstackgerrit | John Dewey proposed openstack/keystone: Correct developer documentation on venv creation https://review.openstack.org/258188 | 23:21 |
| *** e0ne has joined #openstack-keystone | 23:21 | |
| *** gordc has quit IRC | 23:23 | |
| *** shaleh has joined #openstack-keystone | 23:29 | |
| *** errr has quit IRC | 23:30 | |
| *** csoukup has quit IRC | 23:30 | |
| jamielennox | stevemar: so if i stick a debtcollector.remove on Session am i going to break tests for everyone | 23:30 |
| jamielennox | stevemar: do you know if it's somehow limited to only throwing errors within it's own test cases? | 23:30 |
| *** errr has joined #openstack-keystone | 23:31 | |
| *** david-lyle_ has joined #openstack-keystone | 23:33 | |
| *** david-lyle has quit IRC | 23:36 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/258040 | 23:44 |
| jamielennox | stevemar, notmorgan: what do we think about passing https://review.openstack.org/#/c/117089/ before doing the session deprecation | 23:44 |
| jamielennox | it would isolate things a bit better | 23:44 |
| jamielennox | (it's also my oldest open review) | 23:46 |
| *** oomichi has joined #openstack-keystone | 23:47 | |
| *** errr has quit IRC | 23:49 | |
| *** gildub has quit IRC | 23:49 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/258059 | 23:50 |
| *** jasonsb has quit IRC | 23:55 | |
| *** jasonsb has joined #openstack-keystone | 23:58 | |
| *** chlong has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!