| *** chlong has joined #openstack-keystone | 00:05 | |
| *** chlong has quit IRC | 00:12 | |
| *** chlong has joined #openstack-keystone | 00:13 | |
| *** erlarese has joined #openstack-keystone | 00:24 | |
| *** mylu has quit IRC | 00:27 | |
| *** erlarese has quit IRC | 00:35 | |
| *** sdake has quit IRC | 00:42 | |
| *** gildub has joined #openstack-keystone | 00:45 | |
| *** mylu has joined #openstack-keystone | 00:51 | |
| *** markvoelker has joined #openstack-keystone | 00:55 | |
| *** shoutm_ has joined #openstack-keystone | 00:56 | |
| *** sdake has joined #openstack-keystone | 00:58 | |
| *** shoutm has quit IRC | 00:58 | |
| *** markvoelker has quit IRC | 01:00 | |
| *** chlong has quit IRC | 01:06 | |
| *** mylu has quit IRC | 01:07 | |
| *** mylu has joined #openstack-keystone | 01:09 | |
| *** mylu has quit IRC | 01:10 | |
| *** mylu has joined #openstack-keystone | 01:10 | |
| *** davechen has joined #openstack-keystone | 01:12 | |
| *** davechen1 has joined #openstack-keystone | 01:17 | |
| *** mylu has quit IRC | 01:19 | |
| *** mylu has joined #openstack-keystone | 01:19 | |
| *** davechen has quit IRC | 01:19 | |
| *** davechen has joined #openstack-keystone | 01:23 | |
| *** davechen1 has quit IRC | 01:25 | |
| *** sdake_ has joined #openstack-keystone | 01:34 | |
| *** sdake has quit IRC | 01:36 | |
| *** sdake_ has quit IRC | 01:53 | |
| *** shoutm_ has quit IRC | 01:53 | |
| *** shoutm has joined #openstack-keystone | 01:56 | |
| *** erlarese has joined #openstack-keystone | 02:05 | |
| *** chlong has joined #openstack-keystone | 02:09 | |
| *** erlarese has quit IRC | 02:10 | |
| *** mylu has quit IRC | 02:19 | |
| *** sdake has joined #openstack-keystone | 02:31 | |
| *** shoutm has quit IRC | 02:42 | |
| *** mylu has joined #openstack-keystone | 02:43 | |
| *** shoutm has joined #openstack-keystone | 02:44 | |
| *** su_zhang has quit IRC | 02:46 | |
| *** mylu has quit IRC | 02:47 | |
| *** markvoelker has joined #openstack-keystone | 02:56 | |
| *** markvoelker has quit IRC | 03:00 | |
| *** mylu has joined #openstack-keystone | 03:27 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Create V9 version of catalog driver interface https://review.openstack.org/269455 | 03:45 |
|---|---|---|
| openstackgerrit | Dave Chen proposed openstack/keystone: Service Providers and Projects associations https://review.openstack.org/264854 | 03:54 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Service Providers Group CRUD operations. https://review.openstack.org/273438 | 03:55 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Service providers groups associations https://review.openstack.org/275636 | 03:55 |
| *** dave-mccowan has quit IRC | 04:00 | |
| *** stevemar changes topic to "14 more days til mitaka-3 feature freeze - please prioritize reviews accordingly! | Mitaka-3: https://launchpad.net/keystone/+milestone/mitaka-3" | 04:21 | |
| *** dims has joined #openstack-keystone | 04:28 | |
| *** dims has quit IRC | 04:30 | |
| *** mdnadeem has joined #openstack-keystone | 04:34 | |
| *** markvoelker has joined #openstack-keystone | 04:56 | |
| *** sdake has quit IRC | 04:57 | |
| *** hideme has joined #openstack-keystone | 05:00 | |
| *** hideme has quit IRC | 05:00 | |
| *** markvoelker has quit IRC | 05:00 | |
| *** watch_the_log has joined #openstack-keystone | 05:04 | |
| *** watch_the_log has quit IRC | 05:05 | |
| *** spring has joined #openstack-keystone | 05:07 | |
| *** spring is now known as Guest78744 | 05:07 | |
| *** Nirupama has joined #openstack-keystone | 05:11 | |
| *** Guest78744 is now known as guest_monitor | 05:13 | |
| *** su_zhang has joined #openstack-keystone | 05:16 | |
| *** david-lyle has quit IRC | 05:21 | |
| *** jaosorior has joined #openstack-keystone | 06:07 | |
| *** mdnadeem has quit IRC | 06:10 | |
| *** sdake has joined #openstack-keystone | 06:25 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Service Providers and Projects associations https://review.openstack.org/264854 | 06:30 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Service Providers Group CRUD operations. https://review.openstack.org/273438 | 06:34 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Service providers groups associations https://review.openstack.org/275636 | 06:34 |
| *** aginwala has joined #openstack-keystone | 06:38 | |
| *** sdake has quit IRC | 06:39 | |
| *** aginwala has quit IRC | 06:43 | |
| *** jasonsb has quit IRC | 06:43 | |
| *** vgridnev has joined #openstack-keystone | 06:45 | |
| *** mylu has quit IRC | 06:52 | |
| *** markvoelker has joined #openstack-keystone | 06:57 | |
| *** markvoelker has quit IRC | 07:02 | |
| *** x58 has quit IRC | 07:03 | |
| *** rha has quit IRC | 07:03 | |
| *** mordred has quit IRC | 07:03 | |
| *** sileht has quit IRC | 07:03 | |
| *** dulek has quit IRC | 07:03 | |
| *** krotscheck has quit IRC | 07:03 | |
| *** ktychkova_ has quit IRC | 07:03 | |
| *** marekd has quit IRC | 07:03 | |
| *** andreaf has quit IRC | 07:03 | |
| *** tjcocozz has quit IRC | 07:03 | |
| *** mancdaz has quit IRC | 07:03 | |
| *** mordred has joined #openstack-keystone | 07:04 | |
| *** tjcocozz has joined #openstack-keystone | 07:04 | |
| *** andreaf has joined #openstack-keystone | 07:04 | |
| *** ktychkova has joined #openstack-keystone | 07:04 | |
| *** gildub has quit IRC | 07:04 | |
| *** rha has joined #openstack-keystone | 07:04 | |
| *** krotscheck has joined #openstack-keystone | 07:04 | |
| *** sileht has joined #openstack-keystone | 07:05 | |
| *** mhickey has joined #openstack-keystone | 07:05 | |
| *** x58 has joined #openstack-keystone | 07:14 | |
| *** chlong has quit IRC | 07:30 | |
| *** su_zhang has quit IRC | 07:38 | |
| *** mhickey has quit IRC | 07:44 | |
| *** henrynash has joined #openstack-keystone | 07:51 | |
| *** ChanServ sets mode: +v henrynash | 07:51 | |
| *** jaosorior has quit IRC | 08:09 | |
| *** subscope has joined #openstack-keystone | 08:13 | |
| *** pnavarro has joined #openstack-keystone | 08:15 | |
| *** pnavarro has quit IRC | 08:19 | |
| *** pnavarro has joined #openstack-keystone | 08:19 | |
| *** marekd has joined #openstack-keystone | 08:27 | |
| *** jaosorior has joined #openstack-keystone | 08:33 | |
| *** rcernin has joined #openstack-keystone | 08:34 | |
| *** shoutm has quit IRC | 08:35 | |
| *** k-ishii_ has joined #openstack-keystone | 08:51 | |
| *** k-ishii_ has quit IRC | 08:51 | |
| *** hoge has joined #openstack-keystone | 08:53 | |
| *** ChanServ sets mode: +v marekd | 08:54 | |
| *** hoge has quit IRC | 08:54 | |
| marekd | davechen: | 08:54 |
| marekd | hi | 08:54 |
| marekd | i see some code changes | 08:54 |
| marekd | it was a rebase? | 08:54 |
| marekd | davechen: yeah, looks like a rebase. | 08:55 |
| *** markvoelker has joined #openstack-keystone | 08:58 | |
| *** markvoelker has quit IRC | 09:03 | |
| *** fhubik has joined #openstack-keystone | 09:03 | |
| *** dulek has joined #openstack-keystone | 09:04 | |
| davechen | marekd: hi, | 09:04 |
| davechen | marekd: yeah, all code were rebased. | 09:05 |
| davechen | marekd: 1) address dstanek's comments and 2) due to some change in py34, we need tweak about the testcase a little. | 09:05 |
| *** fhubik has quit IRC | 09:06 | |
| *** fhubik has joined #openstack-keystone | 09:07 | |
| *** chlong has joined #openstack-keystone | 09:09 | |
| *** pnavarro has quit IRC | 09:17 | |
| *** pnavarro has joined #openstack-keystone | 09:17 | |
| *** rcernin has quit IRC | 09:17 | |
| *** rcernin has joined #openstack-keystone | 09:17 | |
| *** fhubik has quit IRC | 09:17 | |
| *** fhubik has joined #openstack-keystone | 09:17 | |
| *** fhubik is now known as fhubik_brb | 09:27 | |
| *** crinkle_ has joined #openstack-keystone | 09:27 | |
| *** Guest10807 has quit IRC | 09:28 | |
| *** crinkle has quit IRC | 09:28 | |
| *** wasmum has quit IRC | 09:28 | |
| *** bapalm has quit IRC | 09:28 | |
| *** Nakato has quit IRC | 09:28 | |
| *** mvk has quit IRC | 09:28 | |
| *** subscope has quit IRC | 09:29 | |
| *** mvk has joined #openstack-keystone | 09:29 | |
| *** Nakato has joined #openstack-keystone | 09:29 | |
| *** bapalm has joined #openstack-keystone | 09:29 | |
| *** tsymanczyk has joined #openstack-keystone | 09:30 | |
| *** wasmum has joined #openstack-keystone | 09:30 | |
| *** tsymanczyk is now known as Guest74058 | 09:31 | |
| *** subscope has joined #openstack-keystone | 09:37 | |
| *** fhubik_brb is now known as fhubik | 09:43 | |
| *** lhcheng has quit IRC | 09:52 | |
| *** davechen has left #openstack-keystone | 09:54 | |
| *** e0ne has joined #openstack-keystone | 09:59 | |
| *** bjornar has joined #openstack-keystone | 10:05 | |
| *** GB21 has joined #openstack-keystone | 10:10 | |
| *** shoutm has joined #openstack-keystone | 10:21 | |
| *** henrynash has quit IRC | 10:26 | |
| *** amakarov_away is now known as amakarov | 10:35 | |
| *** mhickey has joined #openstack-keystone | 10:41 | |
| openstackgerrit | Merged openstack/keystone: Expand implied roles in trust tokens https://review.openstack.org/279835 | 10:56 |
| *** chlong has quit IRC | 10:56 | |
| *** jsavak has joined #openstack-keystone | 10:57 | |
| *** markvoelker has joined #openstack-keystone | 10:59 | |
| *** jsavak has quit IRC | 11:02 | |
| *** subscope has quit IRC | 11:02 | |
| *** markvoelker has quit IRC | 11:04 | |
| *** fhubik is now known as fhubik_brb | 11:04 | |
| *** fhubik_brb is now known as fhubik | 11:12 | |
| openstackgerrit | Boris Bobrov proposed openstack/python-keystoneclient: Support `truncated` flag returned by keystone https://review.openstack.org/280162 | 11:16 |
| *** dgonzalez has joined #openstack-keystone | 11:26 | |
| *** subscope has joined #openstack-keystone | 11:30 | |
| *** clenimar has joined #openstack-keystone | 11:31 | |
| *** iurygregory has joined #openstack-keystone | 11:33 | |
| *** rodrigod` has quit IRC | 11:35 | |
| *** rodrigods has joined #openstack-keystone | 11:35 | |
| *** fhubik is now known as fhubik_brb | 11:42 | |
| *** fhubik_brb is now known as fhubik | 11:42 | |
| *** fhubik is now known as fhubik_brb | 11:42 | |
| *** GB21 has quit IRC | 11:47 | |
| *** shoutm has quit IRC | 11:52 | |
| openstackgerrit | Arun Kant proposed openstack/keystonemiddleware: Adding audit middleware specific notification driver conf https://review.openstack.org/279828 | 12:12 |
| *** GB21 has joined #openstack-keystone | 12:13 | |
| *** pauloewerton has joined #openstack-keystone | 12:15 | |
| openstackgerrit | Boris Bobrov proposed openstack/python-keystoneclient: Support `truncated` flag returned by keystone https://review.openstack.org/280162 | 12:16 |
| *** raildo-afk is now known as raildo | 12:17 | |
| *** raildo is now known as raildo-afk | 12:18 | |
| *** raildo-afk is now known as raildo | 12:18 | |
| *** chlong has joined #openstack-keystone | 12:20 | |
| *** sdake has joined #openstack-keystone | 12:21 | |
| *** fhubik_brb is now known as fhubik | 12:23 | |
| *** openstackgerrit_ has joined #openstack-keystone | 12:27 | |
| *** markvoelker has joined #openstack-keystone | 12:29 | |
| *** shoutm has joined #openstack-keystone | 12:32 | |
| *** markvoelker has quit IRC | 12:34 | |
| *** GB21 has quit IRC | 12:36 | |
| samueldmq | morning keystoners | 12:38 |
| marekd | hey | 12:38 |
| *** dims_ has joined #openstack-keystone | 12:42 | |
| *** daemontool has joined #openstack-keystone | 13:00 | |
| *** subscope has quit IRC | 13:10 | |
| *** dave-mccowan has joined #openstack-keystone | 13:14 | |
| *** subscope has joined #openstack-keystone | 13:17 | |
| *** markvoelker has joined #openstack-keystone | 13:30 | |
| *** edmondsw has joined #openstack-keystone | 13:31 | |
| *** dims_ has quit IRC | 13:33 | |
| *** dims has joined #openstack-keystone | 13:33 | |
| *** su_zhang has joined #openstack-keystone | 13:34 | |
| *** markvoelker has quit IRC | 13:35 | |
| *** doug-fish has joined #openstack-keystone | 13:45 | |
| dstanek | good morning | 13:49 |
| *** dims has quit IRC | 13:53 | |
| *** dims has joined #openstack-keystone | 13:57 | |
| lbragstad | o/ | 13:59 |
| *** dims has quit IRC | 14:00 | |
| *** vgridnev has quit IRC | 14:02 | |
| *** dims has joined #openstack-keystone | 14:02 | |
| *** henrynash has joined #openstack-keystone | 14:05 | |
| *** ChanServ sets mode: +v henrynash | 14:05 | |
| *** vgridnev has joined #openstack-keystone | 14:06 | |
| *** GB21 has joined #openstack-keystone | 14:08 | |
| *** Bl5-bl4d3 has joined #openstack-keystone | 14:09 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:10 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules in the v3 policy sample for domain specifc roles https://review.openstack.org/262078 | 14:11 |
| amakarov | dolphm, hi! Will you restore this backport: https://review.openstack.org/#/c/222729 ? | 14:11 |
| *** su_zhang has quit IRC | 14:13 | |
| amakarov | It's bug is marked as fix released for kilo: https://bugs.launchpad.net/keystone/+bug/1488208 and it doesn't seem so | 14:13 |
| openstack | Launchpad bug 1488208 in OpenStack Identity (keystone) kilo "Revoking a role assignment revokes unscoped tokens too" [Medium,Fix released] - Assigned to Dolph Mathews (dolph) | 14:13 |
| *** jaosorior has quit IRC | 14:14 | |
| *** Nirupama has quit IRC | 14:14 | |
| *** jaosorior has joined #openstack-keystone | 14:15 | |
| *** jaosorior has quit IRC | 14:15 | |
| *** jaosorior has joined #openstack-keystone | 14:17 | |
| *** doug-fish has quit IRC | 14:20 | |
| *** fawadk has joined #openstack-keystone | 14:21 | |
| *** henrynash_ has joined #openstack-keystone | 14:23 | |
| *** ChanServ sets mode: +v henrynash_ | 14:23 | |
| *** spring_ has joined #openstack-keystone | 14:23 | |
| *** rodrigod` has joined #openstack-keystone | 14:23 | |
| *** edmondsw_ has joined #openstack-keystone | 14:24 | |
| *** fawadk has quit IRC | 14:24 | |
| *** fawadkhaliq has quit IRC | 14:24 | |
| *** henrynash has quit IRC | 14:24 | |
| *** edmondsw has quit IRC | 14:24 | |
| *** dave-mccowan has quit IRC | 14:24 | |
| *** rodrigods has quit IRC | 14:24 | |
| *** wasmum has quit IRC | 14:24 | |
| *** guest_monitor has quit IRC | 14:24 | |
| *** henrynash_ is now known as henrynash | 14:24 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:24 | |
| *** dave-mccowan has joined #openstack-keystone | 14:24 | |
| *** Bl5-bl4d3 has quit IRC | 14:25 | |
| *** fawadkhaliq has quit IRC | 14:26 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:26 | |
| *** wasmum has joined #openstack-keystone | 14:27 | |
| *** dims has quit IRC | 14:28 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project cascade update https://review.openstack.org/243584 | 14:34 |
| htruta | samueldmq, henrynash: would you mind taking a look at this: https://review.openstack.org/#/c/207218/ ? | 14:35 |
| henrynash | htruta: sure | 14:35 |
| henrynash | htruta: just finishing off anyother path, then will take a look | 14:36 |
| *** doug-fish has joined #openstack-keystone | 14:36 | |
| htruta | henrynash: awesome | 14:36 |
| *** dims has joined #openstack-keystone | 14:36 | |
| *** doug-fish has quit IRC | 14:40 | |
| *** daemontool has quit IRC | 14:43 | |
| samueldmq | htruta: will look, finishing expense reports ... /( | 14:43 |
| samueldmq | :( | 14:43 |
| *** ninag has joined #openstack-keystone | 14:44 | |
| *** superdan is now known as dansmith | 14:46 | |
| bknudson_ | amakarov: restored https://review.openstack.org/#/c/222729/ ( dolphm ) | 14:48 |
| amakarov | bknudson_, thanks! What about bug? I can't set it to confirmed state | 14:49 |
| bknudson_ | https://bugs.launchpad.net/keystone/+bug/1488208 is fix released already | 14:50 |
| openstack | Launchpad bug 1488208 in OpenStack Identity (keystone) kilo "Revoking a role assignment revokes unscoped tokens too" [Medium,Fix released] - Assigned to Dolph Mathews (dolph) | 14:50 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: API support for project cascade update https://review.openstack.org/243585 | 14:50 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project cascade update https://review.openstack.org/243584 | 14:50 |
| bknudson_ | amakarov: I switched it to in progress | 14:50 |
| bknudson_ | for stable/kilo | 14:51 |
| amakarov | bknudson_, great! | 14:51 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:52 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project cascade update https://review.openstack.org/243584 | 14:54 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: API support for project cascade update https://review.openstack.org/243585 | 14:54 |
| *** dims has quit IRC | 14:59 | |
| *** sdake has quit IRC | 15:02 | |
| *** doug-fish has joined #openstack-keystone | 15:08 | |
| *** GB21 has quit IRC | 15:10 | |
| *** fawadkhaliq has quit IRC | 15:10 | |
| *** dims has joined #openstack-keystone | 15:10 | |
| *** fawadkhaliq has joined #openstack-keystone | 15:11 | |
| dims | stevemar : bknudson_ : i sent an email with details on the pycryptodome problem - http://markmail.org/message/hcytuqadscggayft | 15:12 |
| bknudson_ | dims: do we need to make a change in keystone code for this? | 15:13 |
| *** doug-fish has quit IRC | 15:13 | |
| bknudson_ | we have pysaml2 code in keystoneauth | 15:14 |
| dims | bknudson_ : i've tested keystoneauth/keystonemiddleware and those are fine AFAICT. barbican/kite/kiteclient are still problematic | 15:14 |
| *** GB21 has joined #openstack-keystone | 15:15 | |
| *** dmsimard has joined #openstack-keystone | 15:15 | |
| dmsimard | Hello Keystone-loving people | 15:16 |
| *** shoutm has quit IRC | 15:17 | |
| dmsimard | Recently the following merged: https://github.com/openstack/keystone/commit/ff8c5970123f7c0f924e4d434e39cb3ade18112f and as a result admin_token_auth was removed from the pipeline which is shipped untouched in RDO land | 15:17 |
| *** trown has joined #openstack-keystone | 15:18 | |
| dmsimard | admin_token_auth was used until now by, amongst other things, puppet-keystone so this broke every installer and CI using puppet modules. | 15:18 |
| trown | https://bugs.launchpad.net/keystone/+bug/1545761 for reference | 15:18 |
| openstack | Launchpad bug 1545761 in OpenStack Identity (keystone) "admin_token_auth 'deprecation' actually removes it from the pipelines" [Undecided,New] | 15:18 |
| dmsimard | Is this intended ? | 15:18 |
| trown | submitting a patch | 15:18 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Default caching to on for request-local caching. https://review.openstack.org/277198 | 15:19 |
| bknudson_ | I think it is intended to not have the admin_token_auth middleware in the default pipeline | 15:19 |
| trown | bknudson_: that is not a deprecation then | 15:19 |
| trown | why not just remove it | 15:20 |
| *** daemontool has joined #openstack-keystone | 15:20 | |
| bknudson_ | The admin_token_auth middleware is deprecated whether it's in the default pipeline or not. | 15:20 |
| trown | yep deprecated in M removed in O | 15:21 |
| trown | so if you remove it from the default pipelines and break all the users, why not just remove it | 15:21 |
| trown | also, the comment seems to indicate this is a mistake "# Use `keystone-manage bootstrap` and remove this from the pipelines below." | 15:21 |
| trown | that makes no sense if it is already removed | 15:22 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Allow project domain_id to be nullable at the manager level https://review.openstack.org/264533 | 15:23 |
| *** ngupta has quit IRC | 15:25 | |
| bknudson_ | you can add it to the pipeline. | 15:25 |
| *** doug-fish has joined #openstack-keystone | 15:25 | |
| *** ngupta has joined #openstack-keystone | 15:26 | |
| *** PsionTheory has joined #openstack-keystone | 15:26 | |
| openstackgerrit | John Trowbridge proposed openstack/keystone: Add admin_token_auth back to default pipelines https://review.openstack.org/280284 | 15:26 |
| trown | bknudson_: right, but it is a breaking change | 15:26 |
| trown | why have a deprecation at all if it is ok to break all the users | 15:27 |
| trown | ayoung: any thoughts on this? https://bugs.launchpad.net/keystone/+bug/1545761 | 15:30 |
| openstack | Launchpad bug 1545761 in OpenStack Identity (keystone) "admin_token_auth 'deprecation' actually removes it from the pipelines" [Undecided,In progress] - Assigned to John Trowbridge (trown) | 15:30 |
| *** doug-fish has quit IRC | 15:30 | |
| *** doug-fish has joined #openstack-keystone | 15:30 | |
| *** subscope has quit IRC | 15:30 | |
| *** jorge_munoz has joined #openstack-keystone | 15:31 | |
| *** GB21 has quit IRC | 15:32 | |
| bknudson_ | trown: I'm fine with adding it back to the default pipeline | 15:34 |
| trown | bknudson_: cool, thanks! | 15:34 |
| *** doug-fish has quit IRC | 15:35 | |
| trown | bknudson_: otherwise we (RDO) would have to fix it in packaging, and then other distros that use the puppet modules for install would also be broken | 15:35 |
| trown | which seems like a big mess that could just be avoided by removing it in O | 15:35 |
| *** notmorgan has joined #openstack-keystone | 15:36 | |
| *** ChanServ sets mode: +v notmorgan | 15:36 | |
| *** ChanServ sets mode: +o notmorgan | 15:37 | |
| bknudson_ | the puppet modules should be adding and removing the admin token middleware if they need it or not. | 15:38 |
| notmorgan | bknudson_: there was a proposed fix up for puppet to do that | 15:39 |
| notmorgan | bknudson_: fwiw | 15:39 |
| dmsimard | They do not currently manage the pipeline, the default is expected to work | 15:39 |
| dmsimard | notmorgan: there is ? | 15:39 |
| notmorgan | dmsimard: yes there was. or at least there was one to remove auth_token | 15:39 |
| notmorgan | dmsimard: by crinkle_ iirc | 15:39 |
| dmsimard | notmorgan: I actually went through to see if there was anything to manage the pipeline or efforts towards using bootstrap instead | 15:39 |
| notmorgan | dmsimard: admin_auth_token | 15:40 |
| *** jorge_munoz has quit IRC | 15:40 | |
| notmorgan | dmsimard: much better direction to go :) | 15:40 |
| notmorgan | dmsimard: use bootstrap | 15:40 |
| notmorgan | dmsimard: if it is available. | 15:40 |
| dmsimard | yeah, I know, I'm filing a bug against puppet-keystone right now to get it supported | 15:40 |
| trown | at the very least, this comment makes no sense if the admin_auth_token is removed in the pipelines already https://github.com/openstack/keystone/blob/master/etc/keystone-paste.ini#L17 | 15:40 |
| notmorgan | dmsimard: i believe there is an effort being working on, but i don't know where it stands. | 15:40 |
| trown | notmorgan: ya I agree that the puppet modules should move to bootstrap, my bug is around deprecation | 15:41 |
| notmorgan | trown: the comment is incorrect. that is needed for testing support | 15:41 |
| *** subscope has joined #openstack-keystone | 15:41 | |
| notmorgan | trown: since we dont have code to manage adding filters in keystone's tests | 15:41 |
| trown | deprecation != removal | 15:41 |
| bknudson_ | trown: existing deployments may or may not have admin token | 15:41 |
| bknudson_ | in the pipeline | 15:41 |
| *** diazjf has joined #openstack-keystone | 15:42 | |
| notmorgan | trown: was a lot more work to fix that. the paste-ini is config [as i've been told over and over], we have not removed admin_auth_token, we have just removed it from the efault pipeline | 15:42 |
| notmorgan | trown: you can add it back in and it will work. | 15:42 |
| notmorgan | trown: it wont be "removed" from the code base until at least O, if not later | 15:42 |
| trown | indeed, but I bet RDO is not the only distro to use that as is | 15:42 |
| trown | notmorgan: ok so you are saying "go fix it in packaging" and let other distros fend for themselves? | 15:43 |
| notmorgan | trown: frankly, i expect distros to change config files. paste-ini is config | 15:43 |
| trown | zigo: do you guys ship the keystone pipelines as is, or change them? | 15:43 |
| notmorgan | trown: i disagree with it being config, also leaving admin_auth_token in is a huge security hole. | 15:43 |
| trown | huge? | 15:44 |
| notmorgan | a static string that requires a restart of keystone that conveys full admin access | 15:44 |
| notmorgan | yes | 15:44 |
| trown | seems like at least 90% of current openstack deployments would have that "huge" security hole, so maybe it deserves a CVE then | 15:44 |
| zigo | trown: I don't change anything provided by upstream, except stuff like lock_path and such for which the default is obviously wrong. | 15:45 |
| notmorgan | it's documented as being insecure | 15:45 |
| notmorgan | and sure, issue a CVE, but it'd be informational. iirc it's already been an OSSN/OSSA | 15:45 |
| trown | zigo: cool I didnt think so, you will be interested in https://bugs.launchpad.net/keystone/+bug/1545761 for mitaka | 15:45 |
| openstack | Launchpad bug 1545761 in OpenStack Identity (keystone) "admin_token_auth 'deprecation' actually removes it from the pipelines" [Undecided,In progress] - Assigned to John Trowbridge (trown) | 15:45 |
| trown | zigo: since we are being told to "fix it in packaging" | 15:46 |
| notmorgan | trown: or use bootstrap. | 15:46 |
| trown | notmorgan: right, use the thing that was just created in december... that is not how deprecation is supposed to work | 15:47 |
| notmorgan | trown: so like i said, paste-ini is config. | 15:47 |
| *** su_zhang has joined #openstack-keystone | 15:47 | |
| zigo | How to bootstrap auth without the admin_ath_token then???? | 15:47 |
| notmorgan | zigo: keystone-manage bootstrap | 15:48 |
| zigo | Not good !!! :( | 15:48 |
| notmorgan | zigo: it injects the data needed/creates the basic project/role/user in the DB | 15:48 |
| notmorgan | zigo: it does NOT use the rest api | 15:48 |
| notmorgan | zigo: same basic mechanism as db_syc | 15:48 |
| trown | ya, I am pretty annoyed by this response I must say... the point of deprecation is to not break users | 15:48 |
| notmorgan | db_sync | 15:48 |
| zigo | :/ | 15:48 |
| trown | why not just remove it | 15:48 |
| zigo | Please remove it in newton, not for Mitaka then. | 15:49 |
| notmorgan | zigo: the code is still there, | 15:49 |
| *** slberger has joined #openstack-keystone | 15:49 | |
| notmorgan | zigo: it still works. | 15:49 |
| zigo | This will break lots of things for me. | 15:49 |
| dmsimard | zigo: do you happen to know if UCA also ships these as-is ? | 15:49 |
| *** phalmos_ has joined #openstack-keystone | 15:50 | |
| zigo | I *DO NOT* work for Canonical, and they have their own packages, so I can't tell what they do. | 15:50 |
| zigo | They didn't even ship Mitaka b2 yet ... | 15:50 |
| trown | notmorgan: why not have the defaults actually work for the majority of users, and do deprecation properly? | 15:50 |
| dmsimard | yup, I knew that :) | 15:50 |
| zigo | So, if I change the pipleline, then the admin_auth_token will continue working? | 15:50 |
| notmorgan | trown: specifically because warning "OMG DEPRECATED" out of the door is not sane defaults for config | 15:50 |
| notmorgan | trown: so if we revert this back we revert the deprecation and fight this next cycle | 15:51 |
| zigo | What's the deal? | 15:51 |
| notmorgan | zigo: yep, just add it back in | 15:51 |
| zigo | Ok, easy enough then. | 15:51 |
| notmorgan | zigo: it works exactly as today, it just throws a deprection warning | 15:51 |
| trown | zigo: ya the filter is there, I actually tested that just adding it works, but then that is a packaging fix | 15:51 |
| bknudson_ | do you typically ship the sample config file in /etc/, or is it copied there? | 15:51 |
| notmorgan | zigo: we wont remove the filter itself from the code base until O or later | 15:51 |
| zigo | Where's that located? | 15:52 |
| zigo | In keystone.conf ? | 15:52 |
| trown | bknudson_: for RDO we actually ship the paste.ini in /usr/share, and the service is configured to use it from there | 15:52 |
| notmorgan | zigo: paste-ini | 15:52 |
| *** mylu has joined #openstack-keystone | 15:52 | |
| zigo | Got it. | 15:52 |
| zigo | admin_token_auth there. | 15:52 |
| bknudson_ | trown: so RDO doesn't really "support" modifying paste.ini? | 15:52 |
| notmorgan | zigo: the pipeline needs "admin_token_auth" added back in to mirror today's functionality | 15:52 |
| trown | bknudson_: exactly... | 15:53 |
| zigo | notmorgan: Yup, got it. | 15:53 |
| zigo | Thanks a lot guys for letting me know. | 15:53 |
| notmorgan | zigo: :) we aren't trying to "break" you. | 15:53 |
| zigo | This saves LOTS of my time. | 15:53 |
| trown | zigo: no problem :) | 15:53 |
| zigo | FYI, I usually try to ship config files as close as possible from what upstream provides. | 15:53 |
| notmorgan | zigo: we're trying to ship the best possible default as an example. anything that is in keystone/etc is effectively example | 15:53 |
| trown | zigo: thought of you when it became evident this will be a packaging fix... which I disagree with | 15:53 |
| bknudson_ | you definitely want to allow deployers to remove the admin token middleware. | 15:53 |
| zigo | Though sometimes (like in this case), I have to add-in a few pathches or fixes. | 15:53 |
| zigo | Typically, lock_path, and such... | 15:54 |
| zigo | The only big exception is Neutron, where the default config really doesn't work by default. | 15:54 |
| bknudson_ | zigo: do you modify the file when you copy it from sample to /etc/? | 15:54 |
| notmorgan | zigo: and please do for Newton move to bootstrap. | 15:54 |
| zigo | Will do. | 15:54 |
| zigo | Though the issue isn't Keystone itself here. | 15:54 |
| notmorgan | zigo: but if you miss newton, like i said, wont be removed until O. | 15:54 |
| bknudson_ | I assume if the file already exists in /etc it asks if you want to overwrite | 15:55 |
| notmorgan | bknudson_: that is typical "deb" packaging behavior afaik. | 15:55 |
| zigo | The thing is, for every API servers on all OpenStack services, I have an automatic keystone catalogue registration system which uses the admin_token. | 15:55 |
| zigo | I'll have to switch that to use the admin credentials instead. | 15:55 |
| notmorgan | zigo: so the way this will change is you'll bootstrap and then use admin creds. | 15:55 |
| zigo | That's using debconf, and it's totally optional. | 15:55 |
| notmorgan | zigo: not a giant shift. | 15:55 |
| zigo | Though I use it heavily for my packaging CI. | 15:55 |
| zigo | Not a huge deal... | 15:55 |
| bknudson_ | we could support a keystone-manage command for catalog update | 15:56 |
| zigo | Just I will prefer to take my time and do it not in a hurry for Newton, rather than for Mitaka. | 15:56 |
| notmorgan | bknudson_: we probably should make bootstrap able to do that | 15:56 |
| notmorgan | bknudson_: catalog basics are almost a bootstrap-thing | 15:56 |
| bknudson_ | zigo: did you generate a unique string for the admin token? | 15:56 |
| bknudson_ | hopefully you're not using DEFAULT | 15:57 |
| notmorgan | bknudson_: or "ADMIN" :P | 15:57 |
| notmorgan | trown: ^ cc | 15:57 |
| notmorgan | trown: i hope you'e generating a unique token as well. | 15:57 |
| trown | notmorgan: ya tripleo generates a unique string, and that is what I deploy with in RDO | 15:57 |
| notmorgan | ok. | 15:58 |
| zigo | If the user doesn't enter anything, I use this to generate the password: | 15:58 |
| zigo | dd if=/dev/random bs=64 count=1 2>|/dev/null | md5sum | 15:58 |
| notmorgan | zigo: cool | 15:58 |
| zigo | That's IMO strong enough! :) | 15:58 |
| notmorgan | yeah thats fine | 15:58 |
| notmorgan | you could also do python -muuid 'uuid.uuid4().hex' | 15:58 |
| notmorgan | or similar | 15:58 |
| notmorgan | whatevet the syntax is. | 15:59 |
| zigo | I can't, I only have shell scripts available in Debian maintainer scripts. | 15:59 |
| zigo | If only python-minimal was set as an essential package, that would help me so much ... | 15:59 |
| bknudson_ | switch to sha512sum | 15:59 |
| notmorgan | zigo: hehe | 15:59 |
| notmorgan | bknudson_: evil | 15:59 |
| notmorgan | bknudson_: :P | 15:59 |
| notmorgan | bknudson_: at least bootstrap should inject the keystone catalog entry (optionally) | 16:00 |
| zigo | Yup, I could use a different hash, but that wouldn't be any better. | 16:00 |
| notmorgan | bknudson_: would make bootstrapping even easier | 16:00 |
| zigo | What counts is what gets out of /dev/random, and if that is wrong, then we're fucked anyway! :) | 16:00 |
| notmorgan | zigo: hmm. you might want to use urandom, /dev/random has weird entropy/blocking issues at times | 16:01 |
| notmorgan | zigo: but this is a small enough data set it shouldbe ok | 16:01 |
| zigo | Using /dev/urandom *IS* a source of huge issues. | 16:01 |
| zigo | Don't use it. | 16:01 |
| *** trown is now known as trown|meeting | 16:02 | |
| zigo | Blocking is fine when doing apt-get install, it just gets stuck until the system gathers entropy. | 16:02 |
| *** mrhillsman has quit IRC | 16:02 | |
| bknudson_ | VMs can have a hard time getting entropy | 16:02 |
| zigo | And 64 bytes, that's nothing ... | 16:02 |
| notmorgan | zigo: i've seen systems hang on package install specifically VMs ike that | 16:02 |
| notmorgan | but like i said 64 bytes is prob. not going to be an issue | 16:02 |
| zigo | To my experience, it's not indeed. | 16:03 |
| zigo | My CI runs on a Xen VM without even the necessary stuff to get entropy from the host OS, and it never gets stuck there. | 16:04 |
| zigo | It usually gets stuck when trying to generate PGP keys ! :) | 16:04 |
| notmorgan | zigo: it it was more than 64bytes or so i'd be worried. i've had someone require a lot more random data on package install [custom software needed a random seed] and it hung for a loooooong time on install | 16:04 |
| notmorgan | moving to urandom got the software installed, then CMS would deploy a sane seed - but for testing urandom was sufficient | 16:05 |
| notmorgan | zigo: long ago, in a galacy far far away... | 16:05 |
| *** henrynash has quit IRC | 16:05 | |
| zigo | If only computer makers didn't care about spending 2$ more for a random generator ... :/ | 16:05 |
| notmorgan | zigo: they care about spending $0.15 on quality capacitors | 16:06 |
| notmorgan | zigo: so $2 is a big added cost :P | 16:06 |
| stevemar | dolphm: notmorgan: bknudson_ ayoung dstanek today is a holiday up north, so i won't be online much | 16:07 |
| notmorgan | stevemar: slacker | 16:07 |
| notmorgan | stevemar: :P | 16:07 |
| notmorgan | stevemar: PTLs don't get holidays (j/k) - enjoy the day man | 16:07 |
| bknudson_ | stevemar: president's day? | 16:08 |
| *** mylu has quit IRC | 16:08 | |
| stevemar | notmorgan: i need a day, i dreamt that i missed the keystone meeting and folks were upset | 16:08 |
| notmorgan | bknudson_: See i KNEW canada was really just part of the US | 16:08 |
| zigo | notmorgan: Eventually, will we get the admin_token_auth feature completely removed from keystone? | 16:08 |
| stevemar | bknudson_: "family day" | 16:08 |
| notmorgan | zigo: yes in O or later | 16:08 |
| zigo | Ok, fine to me. | 16:08 |
| dstanek | stevemar: enjoy | 16:08 |
| notmorgan | stevemar: sleep through the meeting a couple times. | 16:08 |
| notmorgan | stevemar: it's good for your mental health | 16:08 |
| stevemar | notmorgan: that'll be tough to do at 1pm, but i think i can do it! | 16:09 |
| *** phalmos_ has quit IRC | 16:09 | |
| notmorgan | stevemar: i have faith in you! | 16:09 |
| dstanek | stevemar: sounds like a challenge to me | 16:10 |
| notmorgan | dstanek: god. OS X gets worse each time i use it | 16:11 |
| *** doug-fish has joined #openstack-keystone | 16:11 | |
| zigo | How does "keystone-manage boostrap" work? | 16:11 |
| dstanek | notmorgan: yep | 16:11 |
| notmorgan | zigo: you pass it a couple arguments --username, --role-name, etc | 16:11 |
| zigo | notmorgan: Is there a doc about it somewhere? | 16:11 |
| notmorgan | zigo: and it populates the database with a project, role, user, and the user with that role on the project | 16:11 |
| notmorgan | zigo: yep. let me find it. | 16:11 |
| dstanek | notmorgan: if i have the time to do some research i'm going to get a new laptop this month | 16:11 |
| ayoung | notmorgan, BTW, deprecation of admin_token does not mean removing from the pipeline. We broke at least 2 differnt projects with that | 16:12 |
| zigo | In Debian, the package (optionally) prompts the user about what admin user/email/password/tenant should be. | 16:12 |
| *** sdake has joined #openstack-keystone | 16:12 | |
| zigo | I'll have to rewrite that part. | 16:13 |
| notmorgan | ayoung: paste-ini is config. if we're going to argue it's code fine, but shipping a default that screams "OMG DEPRECATED" is wrong. | 16:13 |
| notmorgan | ayoung: so we need to pick which one it is. | 16:13 |
| zigo | I always wonder, by the way: the only thing that maters is that the role is called "admin" to get admin rights, right? | 16:13 |
| notmorgan | zigo: just default in the policy.json, with v2 it's a bit more hard-coded | 16:14 |
| notmorgan | ayoung: and if it's code. it isn't something we support changing. | 16:14 |
| zigo | Got it. | 16:15 |
| ayoung | notmorgan, notmorgan Deprecation should have preceded the change, though | 16:15 |
| notmorgan | ayoung: except shipping a default that says "THIS IS DEPRECATED" is not correct. | 16:15 |
| notmorgan | ayoung: it's a config file | 16:15 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: Avoid "non-Pythonic" method names https://review.openstack.org/280309 | 16:15 |
| notmorgan | ayoung: it can be added back in. | 16:15 |
| ayoung | notmorgan, add it back in. People have had the shake up | 16:15 |
| notmorgan | ayoung: just like anything else packaging does. we did not remove the filter and we didn't remove the code | 16:16 |
| zigo | So if I change, in policy.json: "admin_required": "role:admin or is_admin:1" by "admin_required": "role:foobar or is_admin:1", then I'll need to have role foobar to be admin? | 16:16 |
| notmorgan | ayoung: then un-do the deprecation | 16:16 |
| ayoung | notmorgan, unh uh | 16:16 |
| ayoung | this was a change made without warning | 16:16 |
| notmorgan | ayoung: do not ship something by default that says it is deprecated | 16:16 |
| ayoung | and paste is way too core to be treated as pure config | 16:16 |
| notmorgan | ayoung: then we undo the deprecation and hit this newton 1 | 16:16 |
| *** vgridnev has quit IRC | 16:17 | |
| *** SamYaple has joined #openstack-keystone | 16:17 | |
| zigo | Oh also, I wanted to ask: could we please keep the keystoneclient auth fragment in? | 16:17 |
| notmorgan | zigo: huh? | 16:17 |
| notmorgan | zigo: which keystoneclient auth fragment? | 16:18 |
| ayoung | notmorgan, paste is not a config file. We might like to believe that, and I wish it were ,but it is not. Without it being tightly managed, all of Keystone goes kablooey | 16:18 |
| notmorgan | ayoung: so i made that argument and was told it was config | 16:18 |
| zigo | It's a way easier to just read or write hostname / port / etc, in separate fields than it is to use auth_uri= and parse the content in / out. | 16:18 |
| edmondsw_ | zigo, you can leave policy.json as is, or if you're going to edit that line wait until you no longer use admin_auth_token and then remove the "or is_admin:1" | 16:18 |
| ayoung | notmorgan, by whom>? | 16:18 |
| bknudson_ | if you mess up your keystone.conf file keystone won't start, too | 16:18 |
| notmorgan | ayoung: a number of people | 16:18 |
| notmorgan | bknudson_: ++ | 16:18 |
| notmorgan | ayoung: there is a cettain point where we need to say "seriously this is a config file". | 16:19 |
| zigo | edmondsw_: I was just trying to know where the role "admin" was hard-coded... | 16:19 |
| notmorgan | zigo: it's i think in v2 based on the is_admin rule | 16:19 |
| notmorgan | zigo: but i'd need to check, i haven't looked recently | 16:19 |
| edmondsw_ | zigo, ah, ok | 16:19 |
| notmorgan | zigo: but it's hard coded to use a specific rule iirc in v2 | 16:19 |
| *** Ephur has joined #openstack-keystone | 16:19 | |
| notmorgan | zigo: an icky-behavior :( | 16:19 |
| edmondsw_ | notmorgan, simple answer there... don't use v2! ;) | 16:19 |
| notmorgan | edmondsw_: tell your friends! | 16:20 |
| ayoung | notmorgan, look, this just was not something that the other projects would expect or know to look at. Making a change to the initial system configuration for all the tool out there is going to break them. I'm usually a purist, but on this one, I have to admit that there approach we did here was not fair | 16:20 |
| notmorgan | edmondsw_: :) | 16:20 |
| edmondsw_ | I do! | 16:20 |
| notmorgan | ayoung: so, like i said, i am in support of your stance, undo the deprecation warning | 16:20 |
| notmorgan | ayoung: or leave it out of the pipeline | 16:20 |
| notmorgan | ayoung: i'm not blocking what you're asking for. i'm saying i wont let us ship something by default that screams deprecated if i can stop it | 16:21 |
| notmorgan | which, in this case i can | 16:21 |
| * notmorgan is not trying to be obstructionist here. | 16:21 | |
| notmorgan | really | 16:21 |
| edmondsw_ | ayoung, folks should not be relying on paste or conf defaults for things to work. That's their bug. If they need something to be in the paste, they should make sure it's there | 16:21 |
| notmorgan | i'm trying to be clear on what would put it back in the pipeline | 16:21 |
| notmorgan | edmondsw_: i agreee with you. but i wont hold up if this is a real issue ayoung is willing to undeprecate the filter for | 16:22 |
| zigo | notmorgan: Did you find that doc around keystone-manage bootstrap ? | 16:22 |
| ayoung | notmorgan, so, the Kolla folks re-added it to the pipeliene, and then were working on getting the -bootstrap to work. THat is the pattern we are going to see, and across projects both inside and outside the big tent | 16:22 |
| edmondsw_ | notmorgan, if we undo the deprecation, we just delay this discussion... it doesn't solve anything | 16:22 |
| notmorgan | zigo: looking. we have it in our docs, i have the manpage | 16:22 |
| dmsimard | zigo: I guess it would be here http://docs.openstack.org/developer/keystone/configuringservices.html | 16:22 |
| zigo | dmsimard: Thanks a lot ! | 16:23 |
| notmorgan | zigo: http://docs.openstack.org/developer/keystone/man/keystone-manage.html and that dmsimard pasted | 16:23 |
| notmorgan | dmsimard: thanks, sorry hard to search the web and type in IRC at the same time | 16:23 |
| edmondsw_ | unless we're going to go find and address as many places as we can and then redo the deprecation... that what you mean? | 16:23 |
| zigo | This will be on my plate for next week then. | 16:23 |
| notmorgan | edmondsw_: oh i was figuring we'd just call paste-ini code and never change it. :P or actually just drop the config option, mark it as deprecated and default it to None and make it so if it is None it doesn't work | 16:24 |
| notmorgan | edmondsw_: i don't care how we slice it actually, just as long as we don't throw deprecation warnings with what we ship by default if at all possible | 16:24 |
| *** daemontool_ has joined #openstack-keystone | 16:25 | |
| notmorgan | ayoung: so - i've given you the choice on what i'll support. I am simply saying if we have it in by default, we don't thrown deprecation warnings. | 16:25 |
| zigo | IMO, for security reasons, a big warning should be printed when using --bootstrap-password (ie: it shows in /proc or using ps). | 16:25 |
| notmorgan | ayoung: so undeprecate it, find a new way to deprecate it. | 16:25 |
| edmondsw_ | I agree with not throwing dep warnings with defaults, and with not having admin_auth_token work by default | 16:25 |
| zigo | I'd be even for not allowing it at all. | 16:26 |
| notmorgan | zigo: we added OS_PASSWORD and env options for that reason | 16:26 |
| zigo | (or have it prompted) | 16:26 |
| zigo | Yup, I saw it. | 16:26 |
| ayoung | notmorgan, so, Kolla is adding back in the pipeline. Tripleo/RDO is asking if they can do the same | 16:26 |
| notmorgan | zigo: but we have ksc and other CLI things support password on the CLI | 16:26 |
| notmorgan | zigo: and those don't really warn | 16:26 |
| zigo | Ok. | 16:26 |
| ayoung | iour stance is "its dprecated, so if you want to add it back in temporarily, go dfor it, its deprecated and bewer?" | 16:26 |
| *** daemontool has quit IRC | 16:26 | |
| ayoung | bewre | 16:26 |
| ayoung | gah | 16:26 |
| SamYaple | if I can weigh in from the Kolla side, I agree with the deprecation. In fact I was on board with this a while ago | 16:26 |
| ayoung | beware | 16:27 |
| *** daemontool_ has quit IRC | 16:27 | |
| notmorgan | i bet we could muck with the execline to hide the password. | 16:27 |
| zigo | notmorgan: Oh, so in ksc, I can use OS_PASSWORD env var to change password? | 16:27 |
| notmorgan | zigo: ^ other things do it | 16:27 |
| notmorgan | zigo: use openstackclient :P | 16:27 |
| zigo | I didn't know. | 16:27 |
| zigo | Yup, I do ! :) | 16:27 |
| notmorgan | zigo: but i think it can use OS_PASSWORD | 16:27 |
| notmorgan | zigo: iirc that is how the openrc files work | 16:27 |
| zigo | I've switched ALL of the OpenStack services to use openstackclient and v3 ! :) | 16:27 |
| notmorgan | SamYaple: thanks for weighing in. | 16:27 |
| bknudson_ | zigo: you are the greatest. | 16:28 |
| notmorgan | ayoung: pretty much. | 16:28 |
| notmorgan | zigo: also thanks for pushing on v3! much appreciated | 16:28 |
| zigo | But I still use passwords on the command line, which really, is bad. | 16:28 |
| SamYaple | notmorgan: if you need more "weighing in" here is a snippet from back when shade was starting and Kolla started using it http://paste.openstack.org/show/487012/ | 16:28 |
| zigo | I'll try to fix that too. | 16:28 |
| notmorgan | SamYaple: ++ i can't agree more | 16:28 |
| notmorgan | SamYaple: this was the whole reason i finally did bootstrap | 16:29 |
| SamYaple | glad to see it too | 16:29 |
| ayoung | notmorgan, So...I don't think that any of the other projects I'm looking at treat paste as a config file, per se. The RPM approach is to put it in /usr/share | 16:29 |
| notmorgan | SamYaple: it's something we've talked about for... uhhhhh... 3 cycles? 4? | 16:29 |
| SamYaple | while i understand both sides here, I am firmly landing in the `keystone-manage bootstrap` camp | 16:29 |
| ayoung | I think you can reset the config file option to pouibnt to /etc/keystone, but that is not thedefault | 16:29 |
| notmorgan | SamYaple: yay! | 16:29 |
| *** Ephur has quit IRC | 16:29 | |
| ayoung | so, this does end up being a bigger deal than just a change of a config file option | 16:29 |
| ayoung | dmsimard, EmilienM please chime in in here | 16:30 |
| notmorgan | ayoung: so i'll 100% support un-deprecating it and finding another way to meet the same goal(s) | 16:30 |
| ayoung | the conversaiont in #rdo is not reaching the people that it needs to | 16:30 |
| bknudson_ | I thought ayoung ran things | 16:30 |
| dmsimard | I can sort of re-iterate what I was saying over there | 16:30 |
| ayoung | dmsimard, so, once the various RDO installers are up and running, do you remove ADMIN_TOKEN from the pipeline? | 16:31 |
| * notmorgan views paste-ini as config because there are things that absolutely should be removed (admin_token_auth) when bootstrap is complete | 16:31 | |
| * zigo goes to sleep, it's past midnight over here, bye everyone! | 16:31 | |
| notmorgan | ayoung: ddoubtful, as the CMS tools avoids doing that. | 16:31 |
| dmsimard | I'm sort of torn about the statements that were said here saying nothing should be shipped that screams deprecation, deprecation should indeed scream so that users/consumers/installers have time to transition | 16:32 |
| dmsimard | What was done here was to deprecate something but also remove it from the pipeline so that the deprecation notices don't show -- except in the config file comments and the release notes | 16:32 |
| notmorgan | dmsimard: i'm a fan of telling users it's deprecated when it's used. but if it's the default - it should not be deprecated | 16:32 |
| ayoung | notmorgan, I think a deprecation warning at startup of ADMIN_TOKEN in the pipeline is wise. Then again, I think that any time ADMIN_TOKEN is in the auth path, we should scream anyway | 16:32 |
| *** jasonsb has joined #openstack-keystone | 16:33 | |
| *** jed56 has quit IRC | 16:33 | |
| bknudson_ | keystone should warn if admin_token is in the pipeline. | 16:33 |
| ayoung | it should not be left in place by default, and I will take the blame for not being vigorous enough in pushing for us to get it out of the normal path | 16:33 |
| notmorgan | ayoung: i am going to just disagree with you if we ship our paste with it by default. | 16:33 |
| ayoung | bknudson_, exactly | 16:33 |
| ayoung | deprecation or not, it is for bootstrap only | 16:33 |
| notmorgan | i'm not a fan of deprecation warnings | 16:33 |
| notmorgan | by default | 16:33 |
| notmorgan | it's the wrong message | 16:33 |
| notmorgan | if we don't deprecate admin_auth_token and just say "HEY THIS IS NOT FOR PRODUCTION USE" | 16:34 |
| notmorgan | that is not a deprecation warning. | 16:34 |
| ayoung | notmorgan, how about a fan of "ADMIN_TOKEN in PIPELINE! THIS IS A SEC VIOATION" | 16:34 |
| ayoung | or seomthing like that | 16:34 |
| notmorgan | it's a "don't use this warning" | 16:34 |
| *** jorge_munoz has joined #openstack-keystone | 16:34 | |
| ayoung | regardless of whether it is a deprecation warning or not | 16:34 |
| notmorgan | and we completely un-do the deprecation | 16:34 |
| ayoung | I want to avoid them putting it back in the pipeline and leaving it there | 16:34 |
| notmorgan | ok, so how about this: | 16:34 |
| dstanek | notmorgan: ayoung: way late in the discussion, but the only reason you could reasonably say paste.ini is not a config is because we use it incorrectly by putting non-optional things into it | 16:35 |
| notmorgan | 1) undeprecate [revert the deprecation warning and reno, don't change the test changes] | 16:35 |
| ayoung | dstanek, let good point, but let him finish this thought | 16:35 |
| notmorgan | 2) change the default option to be NONE not "ADMIN" and make it short circut if option is unset | 16:35 |
| notmorgan | 3) WARN if it is in the pipeline [not deprecation] that it is there at all and should only be use for bootstrapping and keystone-manage bootstrap is more correct | 16:36 |
| ayoung | notmorgan, that feels right in my first read | 16:36 |
| notmorgan | 4) add it back into the pipeline | 16:36 |
| notmorgan | by default | 16:36 |
| notmorgan | 5) make devstack rip it out | 16:36 |
| notmorgan | or not #5 | 16:37 |
| notmorgan | but whatever. | 16:37 |
| ayoung | I think #5 is a good one | 16:37 |
| ayoung | showing people how to make it work in Devstack covers the "disseminate how" | 16:37 |
| notmorgan | but something like that. i'll support that, and even +2 all of it except devstack (i can't +2 that) | 16:37 |
| notmorgan | devstack already uses bootstrap | 16:37 |
| notmorgan | so, yay | 16:38 |
| ayoung | dmsimard, will that plan work for you? | 16:38 |
| notmorgan | dstanek: and i don't disagree, but lets just not go down that path | 16:38 |
| notmorgan | dstanek: today :P | 16:38 |
| ayoung | I think the only risky one is "change the default option to be NONE not "ADMIN" and make it short circut if option is unset" but I can't help but think that it must be explicitly set today anyway | 16:39 |
| notmorgan | ayoung: we could OSSA that one easily | 16:39 |
| *** daemontool has joined #openstack-keystone | 16:39 | |
| notmorgan | ayoung: "THIS WAS A BAD THING OMG INSECurE Out THE DOOR" and have VMT issue a warning/we fix | 16:39 |
| dstanek | notmorgan: i have no dog in this fight :-) i was just pointing out that it is a config and we are doing it wrong | 16:39 |
| *** mylu has joined #openstack-keystone | 16:39 | |
| dmsimard | ayoung: It honestly does not make much difference one way or the other either packaging or installers will have to adapt | 16:39 |
| ayoung | dmsimard, should not have to adapt | 16:40 |
| ayoung | not to a first round | 16:40 |
| ayoung | admin_token = fe1e36dbcac7028b619e0c6b9994e161049778dd | 16:40 |
| notmorgan | dstanek: and i totally agree. i'm just only willing to fight for "don't emit deprecation warnings by default" | 16:40 |
| ayoung | if that gets removed, it will be | 16:40 |
| notmorgan | dstanek: on this front | 16:40 |
| ayoung | admin_token = None | 16:40 |
| ayoung | and thus disabled | 16:40 |
| ayoung | I think that is proper behavior anyway | 16:40 |
| dmsimard | ayoung: so I probably misunderstood then .. let me read again | 16:40 |
| notmorgan | ayoung: ok i'm going to go open a public security bug on this so we can have VMT team issue OSSA on the config option | 16:40 |
| ayoung | and the fact that tripleo is not doing that (at least for the undercloud) is wrong regardless | 16:41 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: Avoid `None` as a redundant argument to dict.get() https://review.openstack.org/280319 | 16:41 |
| ayoung | notmorgan, ++ | 16:41 |
| dmsimard | ayoung: yes, I think everyone can agree that admin_auth_token should be removed once bootstrap is done anyway | 16:41 |
| dmsimard | ayoung: and installers are wrong for not doing it | 16:41 |
| *** PsionTheory has quit IRC | 16:41 | |
| dolphm | marekd: ping me if you have time to discuss a pysaml sp in keystone, i.e. picking up https://review.openstack.org/#/c/244694/ | 16:41 |
| ayoung | notmorgan, to make #2 more explicit: "if ADMIN_TOKEN is set to None, it will never be accepted, but normal tokens will work just fine" right? | 16:42 |
| *** subscope has quit IRC | 16:42 | |
| ayoung | and we make the default None | 16:42 |
| notmorgan | ayoung: ++ | 16:42 |
| ayoung | notmorgan, ok, you going to drive this? I'd like to rever the ADMIN_TOKEN in paste thing now | 16:43 |
| ayoung | as it break RDO, and I will help shepherd through all the changes necessary to do this right. | 16:43 |
| edmondsw_ | notmorgan, so we if go through those 5 steps, how/when would admin_auth_token ever be deprecated? Because certainly long term that needs to die, right? | 16:44 |
| *** jsavak has joined #openstack-keystone | 16:45 | |
| edmondsw_ | and didn't we already have an OSSA for admin_auth_token? | 16:45 |
| notmorgan | ayoung: https://bugs.launchpad.net/keystone/+bug/1545789 | 16:46 |
| openstack | Launchpad bug 1545789 in OpenStack Identity (keystone) "keystone ADMIN_TOKEN set by default can lead to default insecure deployment" [Medium,Triaged] | 16:46 |
| edmondsw_ | hmm... not seeing an OSSA in a quick search | 16:46 |
| *** subscope has joined #openstack-keystone | 16:46 | |
| ayoung | notmorgan, I'll grab the assignment | 16:46 |
| notmorgan | ayoung: sounds good | 16:46 |
| notmorgan | edmondsw_: i don't think we did | 16:47 |
| notmorgan | edmondsw_: i looked :( | 16:47 |
| edmondsw_ | yeah, can't find one either | 16:47 |
| *** rcernin has quit IRC | 16:48 | |
| notmorgan | edmondsw_: the admin token would never really get deprecated in those 5 steps | 16:48 |
| notmorgan | edmondsw_: though we could make it yell if you set the option | 16:48 |
| notmorgan | that using it is deprecated | 16:48 |
| edmondsw_ | notmorgan then I don't think that's good enough. It needs to die | 16:48 |
| notmorgan | edmondsw_: i agree, but i'm willing to defer as long as the default is "secure" | 16:48 |
| edmondsw_ | it can be a 6th step (or 7th...) but eventually | 16:49 |
| openstackgerrit | Merged openstack/keystonemiddleware: Split oslo_config and list all opts https://review.openstack.org/267277 | 16:49 |
| *** jsavak has quit IRC | 16:49 | |
| edmondsw_ | maybe we put out that OSSA now, and then put back your change to deprecate and remove from paste in newton... in the meantime reaching out to folks we know are using it to stop | 16:50 |
| notmorgan | edmondsw_: /me shrugs | 16:50 |
| edmondsw_ | ayoung, what do you think? | 16:51 |
| ayoung | edmondsw_, yeah. notmorgan to start can you remove your -2 from https://review.openstack.org/#/c/280284/ | 16:51 |
| ayoung | We'll use that to track the revert | 16:52 |
| notmorgan | ayoung: and def. don't undo the fixes to the tests - the tests don't rely on admin_auth_token, so it's going to be a hand-revert (sorry) | 16:52 |
| notmorgan | ayoung: after the fix. | 16:52 |
| ayoung | OK, so let's see... | 16:53 |
| ayoung | 1) undeprecate [revert the deprecation warning and reno, don't change the test changes] that is in the Middleware right? | 16:53 |
| notmorgan | ayoung: deprecation warning is in keystone.middleware.core | 16:53 |
| notmorgan | and reno in releasenotes | 16:53 |
| notmorgan | annnnd pipeline in pipeline-ini | 16:53 |
| *** mylu has quit IRC | 16:54 | |
| ayoung | Wow. I think this is my only single revision merge evar! https://review.openstack.org/#/c/279835/ | 16:54 |
| *** mylu has joined #openstack-keystone | 16:54 | |
| *** daemontool has quit IRC | 16:54 | |
| ayoung | Did not expect that. | 16:55 |
| notmorgan | ayoung: crap, i meant to -1 that JUST to make sure you had another revision :P | 16:55 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Allow project_id in catalog substitutions https://review.openstack.org/279576 | 16:55 |
| notmorgan | ayoung: :P | 16:55 |
| ayoung | Heh | 16:55 |
| rodrigod` | ayoung, lol i don't remember having one | 16:56 |
| ayoung | notmorgan, I actually don't love the code in that revision, but its all internal and can be refactored. Suspect it will when amakarov 's unified delegation reviews start hitting | 16:56 |
| notmorgan | ayoung: probably | 16:56 |
| ayoung | anyway...back to admin-token | 16:56 |
| *** pushkaru has joined #openstack-keystone | 16:56 | |
| *** pushkaru has quit IRC | 16:57 | |
| *** pnavarro has quit IRC | 16:57 | |
| ayoung | notmorgan, so you want to remove the deprecation warning in the init method there: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/middleware/core.py#n64 any thing else? | 16:57 |
| notmorgan | that shiould be it | 16:58 |
| notmorgan | you can remove the init method | 16:58 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Enable support for posixGroups in LDAP https://review.openstack.org/258528 | 16:58 |
| notmorgan | and make sure to remove the addition of oslo_log.version_utils | 16:58 |
| notmorgan | in import | 16:58 |
| notmorgan | iirc that was added | 16:58 |
| notmorgan | ayoung: and likely i18n import was also added | 16:59 |
| ayoung | notmorgan, ++ I'll get pep8 to pass | 16:59 |
| notmorgan | but -epep8 should notify you of that | 16:59 |
| notmorgan | yeah | 16:59 |
| ayoung | notmorgan, would you be OK, instead of a revert, to just put the warning in place right there? | 17:00 |
| amakarov | dolphm, Jenkins is ok with your cherry-pick https://review.openstack.org/#/c/222729 | 17:00 |
| notmorgan | uhmm......... | 17:00 |
| ayoung | Just chane the langue from "Deprecated" to "remove after the system is initialized" | 17:00 |
| notmorgan | don't use version_utils | 17:00 |
| ayoung | OK | 17:00 |
| notmorgan | it's not a deprecation | 17:00 |
| notmorgan | also | 17:00 |
| notmorgan | do we want to warn that it is in the pipeline or that it is enabled [option set] and in the pipeline? | 17:01 |
| *** vgridnev has joined #openstack-keystone | 17:01 | |
| * notmorgan prefers the "this is in the pipeline" but thinks warning on default shipped things is again "not the best choice" | 17:01 | |
| notmorgan | ayoung: i'll leave to your discresion there, but less scary warnings with what we ship by default = better imo | 17:02 |
| *** EinstCra_ has joined #openstack-keystone | 17:03 | |
| *** dims_ has joined #openstack-keystone | 17:03 | |
| *** phalmos has joined #openstack-keystone | 17:03 | |
| *** EinstCrazy has quit IRC | 17:03 | |
| *** dims has quit IRC | 17:04 | |
| *** baffle has quit IRC | 17:05 | |
| notmorgan | edmondsw_ (cc dstanek): maybe we revisit the roll all of the middleware into a single element in our paste-ini, including auth_admin_token | 17:07 |
| SamYaple | ayoung: the "remove after the system is initialized" affects deployments tools (and theyll probably just ignore it and leave a big security hole) like theyve been doing | 17:07 |
| notmorgan | and then we deprecate the admin_token stuff | 17:07 |
| SamYaple | i think whenever this change happens people will get up in arms | 17:07 |
| notmorgan | SamYaple: this is why we'll at least make the default "sane" | 17:07 |
| notmorgan | SamYaple: and secure compared to today | 17:07 |
| notmorgan | SamYaple: but yeah =/ | 17:08 |
| ayoung | SamYaple, we'll start by at least trying to do it right | 17:08 |
| SamYaple | i like what we have in master right this second. but ive said that once already :) | 17:08 |
| notmorgan | ayoung: ^ cc the thing i said to dstanek and edmondsw_ | 17:08 |
| notmorgan | SamYaple: i'm 100% in your camp... fwiw. | 17:08 |
| ayoung | SamYaple, its going to break catch a lot of people unaware | 17:08 |
| SamYaple | ayoung: it already caught kolla unaware | 17:08 |
| edmondsw_ | notmorgan, not following | 17:09 |
| SamYaple | 5 minutes it was fixed | 17:09 |
| SamYaple | but i get your point | 17:09 |
| notmorgan | edmondsw_: instead of "json_body, build_auth_context, admin_auth_token", etc | 17:09 |
| SamYaple | notmorgan: oh no! this is your camp. i wont be a fall guy! | 17:09 |
| notmorgan | edmondsw_: we make it one entry | 17:09 |
| notmorgan | SamYaple: HAHA | 17:09 |
| *** doug-fish has quit IRC | 17:09 | |
| dstanek | notmorgan: all that manager tracing make debugging much harder | 17:09 |
| edmondsw_ | notmorgan but why? | 17:09 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Restricting domain_id update https://review.openstack.org/207218 | 17:09 |
| notmorgan | dstanek: hmm? oh, feel free to yank that code out if it sucks too much | 17:10 |
| dstanek | notmorgan: i have to think about it for a bit, but it adds like 5 or 6 frames to the stack | 17:10 |
| notmorgan | dstanek: yep it would and the change to local request caching would add another 2-3 frames | 17:11 |
| dstanek | edmondsw_: everything in the paste.ini should be optional exception for the application. using middleware like we do isn't correct | 17:11 |
| ayoung | lbragstad, this is the same kind of firedrill I am expecting with trusts/v2.0 but at least we are warning people as best we can there | 17:11 |
| dstanek | notmorgan: yeah, dogpile also makes it suck | 17:11 |
| notmorgan | dstanek: so dogpile, no good answer for [in fact, it probably wont change] | 17:12 |
| notmorgan | dstanek: maybe revisit the hooks for the debug trace thing we talked about | 17:12 |
| notmorgan | dstanek: where it's an extrenal entrypoint | 17:12 |
| notmorgan | dstanek: sucks to be weird AST stuff, but would make it truely optional | 17:12 |
| notmorgan | or even in-tree but something that needs to be enabled with the special hook thing like your dashboard | 17:13 |
| dstanek | notmorgan: i don't want to make any changes yet until i have a change to think about it. i suspect there are not too many others routinely using pdb | 17:13 |
| edmondsw_ | dstanek, I agree with that. I'm not sure that equates to dumping admin_auth_token (which should be optional) in with other things that shouldn't be. Or did I misunderstand what is proposed? | 17:13 |
| notmorgan | dstanek: except we have backed ourselves into a corner-ish thing with the middleware doing work that hits the DB before the app hits the db | 17:13 |
| bknudson_ | who needs pdb when you have unit tests? | 17:13 |
| notmorgan | dstanek: and that people add "custom routers" and "filters" in that rely on what auth_context does | 17:14 |
| openstackgerrit | ayoung proposed openstack/keystone: Re-enable and undepreate admin-token https://review.openstack.org/280329 | 17:14 |
| notmorgan | dstanek: soooo yay paste... :( [i want it to die] | 17:14 |
| dstanek | notmorgan: yet, we did it wrong :-) | 17:14 |
| dstanek | s/yet/yep/ | 17:14 |
| ayoung | dmsimard, notmorgan ^^ | 17:14 |
| *** trown|meeting is now known as trown | 17:14 | |
| ayoung | and now I am in a meeint. Will monitor | 17:14 |
| notmorgan | ayoung: i think it's LOG.warn() | 17:15 |
| notmorgan | ayoung: .WARN i think is the WARN level value | 17:15 |
| * notmorgan thinks | 17:15 | |
| *** doug-fish has joined #openstack-keystone | 17:15 | |
| notmorgan | ayoung: and consider if we really want scary warning in what we default ship. | 17:15 |
| *** e0ne has quit IRC | 17:16 | |
| notmorgan | ayoung: -1 for not fixing reno, but otherwise code is good. commented as such | 17:17 |
| openstackgerrit | Merged openstack/keystonemiddleware: Use load_from_options_getter for auth plugins https://review.openstack.org/255661 | 17:18 |
| *** csoukup has joined #openstack-keystone | 17:19 | |
| *** doug-fish has quit IRC | 17:19 | |
| *** phalmos has quit IRC | 17:21 | |
| *** phalmos_ has joined #openstack-keystone | 17:21 | |
| *** alejandrito has joined #openstack-keystone | 17:22 | |
| *** rcernin has joined #openstack-keystone | 17:24 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone-specs: oslo.policy file in YAML https://review.openstack.org/279748 | 17:24 |
| notmorgan | bknudson_: you going to also do json-shcema in yaml for kjeystone cause... +++ loved it | 17:25 |
| edmondsw_ | ayoung, in addition to notmorgan's comments, several typos and I think we can improve the warning. Commented accordingly | 17:26 |
| notmorgan | edmondsw_: ++ | 17:26 |
| ayoung | edmondsw_, notmorgan thanks | 17:26 |
| bknudson_ | notmorgan: I started on it but ran into some questions... https://review.openstack.org/#/c/277608/ | 17:26 |
| dmsimard | notmorgan, bknudson_, ayoung & al, thanks for your open-mindedness on this whole topic | 17:26 |
| notmorgan | looking | 17:26 |
| notmorgan | bknudson_: cause i'm a HUGE fan of the yaml json schema | 17:26 |
| bknudson_ | not sure how to document the schema for a whole API in 1 file (if that's even possible) | 17:27 |
| bknudson_ | we should be able to share a bunch of the defintions across schemas (if we have separate schema for each operation) | 17:27 |
| bknudson_ | I guess you can reference an external file | 17:28 |
| bknudson_ | also, not sure how to ship "resource"-type files in python | 17:28 |
| bknudson_ | I think it's do-able and would be pretty handy to have the schema described in yaml | 17:28 |
| *** fhubik has quit IRC | 17:28 | |
| bknudson_ | might be able to use it as part of swagger api docs | 17:28 |
| notmorgan | ah fair enough | 17:29 |
| notmorgan | and ++ swagger if that can be leveraged | 17:29 |
| notmorgan | YAML can include external files iirc | 17:30 |
| notmorgan | so we should use that | 17:30 |
| notmorgan | and resource files in python land --- hmm --- we might need to summon mordred, lifeless, and/or dhellmann for input on that | 17:30 |
| notmorgan | though at least a couple of them of offset by significant tz shifts atm | 17:31 |
| *** aginwala has joined #openstack-keystone | 17:32 | |
| notmorgan | dmsimard: i may have very strong opinions about things in keystone, but it usually revolves around things that are just poor practice vs "lets break the world" | 17:32 |
| *** markvoelker has joined #openstack-keystone | 17:32 | |
| *** subscope has quit IRC | 17:33 | |
| dmsimard | notmorgan: fwiw there has been a lot of backwards-compat breaking changes recently across several projects in the mitaka cycle, sometimes they are downright shovelled in our yard (or installers'). We pick our battles when we feel things could be done differently. | 17:34 |
| notmorgan | dstanek: fwiw, i try and use pdb fairly often, but i find it pretty unwieldly (and i am a fan of gdb). | 17:34 |
| notmorgan | dmsimard: part of the issue is paste-ini for at least keystone is terrible | 17:34 |
| notmorgan | dmsimard: we did it so very wrong. | 17:35 |
| dmsimard | notmorgan: I'll let you be the judge of that :p | 17:35 |
| notmorgan | dmsimard: it's been a lot of digging us out of the hole we put ourselves in. I made it one of my missions to do when i took over as PTL. thakfully some things imo are btter | 17:35 |
| notmorgan | dmsimard: but now not being PTL i can just throw code at the wall and see what sticks ;) | 17:36 |
| *** _cjones_ has joined #openstack-keystone | 17:36 | |
| notmorgan | dmsimard: but basically we made paste-ini somewhere between deployer configurable and not | 17:36 |
| *** markvoelker has quit IRC | 17:37 | |
| notmorgan | dmsimard: and it is both poor architecture and lead to deployers relying on it in strange ways. | 17:37 |
| notmorgan | dmsimard: in a perfect world, i'd delete paste-ini from keystone. | 17:37 |
| *** doug-fish has joined #openstack-keystone | 17:38 | |
| notmorgan | stevemar: are you running the meeting or deciding to sleep today? | 17:39 |
| notmorgan | stevemar: cause i support the latter ;) | 17:40 |
| *** crinkle_ is now known as crinkle | 17:40 | |
| stevemar | notmorgan: it's monday today? | 17:40 |
| notmorgan | stevemar: oh is it? | 17:41 |
| notmorgan | stevemar: i can't keep track of days | 17:41 |
| notmorgan | :P | 17:41 |
| stevemar | notmorgan: yup | 17:41 |
| stevemar | :) | 17:41 |
| notmorgan | stevemar: you should sleep in tomorrow to like 2pm then | 17:41 |
| stevemar | hmm, hard but doable | 17:43 |
| *** trown is now known as trown|afk | 17:44 | |
| *** openstackgerrit has quit IRC | 17:45 | |
| *** openstackgerrit has joined #openstack-keystone | 17:46 | |
| *** neophy has joined #openstack-keystone | 17:46 | |
| *** mylu has quit IRC | 17:47 | |
| *** aginwala has quit IRC | 17:47 | |
| *** mylu has joined #openstack-keystone | 17:49 | |
| *** henrynash has joined #openstack-keystone | 17:55 | |
| *** ChanServ sets mode: +v henrynash | 17:55 | |
| *** jaosorior has quit IRC | 18:01 | |
| arunkant | stevemar: Can you look into audit middleware review: https://review.openstack.org/#/c/279828/ ..the issue we talked about last week. | 18:01 |
| samueldmq | hmm, py27 job is said to be UNSTABLE in https://review.openstack.org/#/c/207218/ | 18:06 |
| samueldmq | I didn't know about that new status | 18:06 |
| dstanek | arunkant: stevemar likely won't be on much today | 18:07 |
| dstanek | samueldmq: it's not new. it just doesn't happen very often | 18:09 |
| arunkant | dstanek: okay..thanks for the update. Will appreciate if keystone folks can look into the change and provide review comments. | 18:09 |
| dstanek | samueldmq: it basically means that the tests ran OK, but i think it couldn't publish the results | 18:09 |
| dstanek | arunkant: i can take a look in a little bit | 18:09 |
| *** mhickey has quit IRC | 18:10 | |
| dstanek | samueldmq: yep, that's it https://wiki.jenkins-ci.org/display/JENKINS/Terminology | 18:11 |
| *** daemontool has joined #openstack-keystone | 18:11 | |
| samueldmq | dstanek: yes, just checked in -infra | 18:11 |
| samueldmq | dstanek: jenkins couldn't finish post tasks, but the job has passed (as you said) | 18:11 |
| samueldmq | dstanek: :) | 18:11 |
| *** su_zhang has quit IRC | 18:12 | |
| *** dan_nguyen has joined #openstack-keystone | 18:13 | |
| *** e0ne has joined #openstack-keystone | 18:13 | |
| *** trown|afk has left #openstack-keystone | 18:13 | |
| *** BAKfr has quit IRC | 18:13 | |
| *** mylu has quit IRC | 18:15 | |
| samueldmq | henrynash: hi | 18:16 |
| henrynash | samueldmq: hi | 18:17 |
| samueldmq | henrynash: need to talk to you about at we want with versioned drivers :) | 18:17 |
| samueldmq | henrynash: so we can approve that hmt patch | 18:17 |
| henrynash | samuedlmq: ah yes.... | 18:17 |
| samueldmq | henrynash: this https://review.openstack.org/#/c/264533/ | 18:17 |
| *** BAKfr has joined #openstack-keystone | 18:17 | |
| samueldmq | henrynash: so, in terms of upgrade, what's the goal of versioned drivers ? | 18:17 |
| *** alejandrito has quit IRC | 18:18 | |
| samueldmq | henrynash: does it mean we want to allow someone to upgrade the code and keep using old driver ? | 18:18 |
| *** dmsimard has left #openstack-keystone | 18:18 | |
| henrynash | samueldmq: so the goal is to allow people to keep using a driver that is written to the previous manager->driver API | 18:19 |
| *** dan_nguyen has quit IRC | 18:19 | |
| henrynash | samueldmq: but the support for daat upgrading is on their heads, not ours | 18:19 |
| samueldmq | henrynash: okay, so you may upgrade the keystone and keep using the old driver | 18:20 |
| henrynash | samueldmq: yes, but we will no longer support any data migration from that old driver | 18:21 |
| henrynash | samueldmq: we do NOT support our onw V8 driver anymore | 18:21 |
| samueldmq | henrynash: what I was arguing for was: 'keystone mitaka does support projects pointing to NULL domain, but to use it you also need Mitaka version of the driver' | 18:21 |
| henrynash | samueldmq: so it’s as if you have written your own | 18:22 |
| samueldmq | henrynash: yes, someone that has written his own driver | 18:22 |
| henrynash | samueldmq: I’d love to do that, but I don’t see how we can | 18:22 |
| samueldmq | henrynash: simply don't support projects having null domain_id in the v9wrapper | 18:22 |
| henrynash | samueldmq: the manager at Mitaka won’t know how to create “old style domains” | 18:22 |
| *** ninag has quit IRC | 18:22 | |
| henrynash | samueldmq: how will the manager create a domain? | 18:23 |
| samueldmq | henrynash: if a project with null domain_id comes, say no, you can't do that, I do not work around that, upgrade your driver | 18:23 |
| *** ninag has joined #openstack-keystone | 18:23 | |
| samueldmq | henrynash: the newest driver (v9) implement the funcitonality we want (projects with domainid=SPECIAL_NULL) | 18:23 |
| samueldmq | henrynash: the wrapper don't | 18:23 |
| samueldmq | henrynash: manager doesn't know about tht | 18:24 |
| henrynash | samueldmq: I dont know how to ask the quetsion any other way….”HOW DOES THE MANAGER CREATE A DOMAIN?" | 18:24 |
| openstackgerrit | ayoung proposed openstack/keystone: Re-enable and undepreate admin-token https://review.openstack.org/280329 | 18:25 |
| samueldmq | henrynash: okay, so, manager asks the driver: create_project(domain_id=NULL) | 18:25 |
| samueldmq | with is_domain=True | 18:25 |
| henrynash | samueldmq: ok | 18:25 |
| ayoung | EmilienM, I think ^^ will work for you | 18:25 |
| samueldmq | henrynash: if the driver supports the v9 interface, it will honor that operation | 18:25 |
| samueldmq | henrynash: if not, it won't | 18:25 |
| henrynash | samueldmq: so what does the manager do then | 18:26 |
| *** su_zhang has joined #openstack-keystone | 18:27 | |
| henrynash | samueldmq: it’s been asked to create a domain…it tried to create a project acting as a domain…was told that’s not supproted….what does it do now? | 18:27 |
| samueldmq | henrynash: what if you go to https://review.openstack.org/#/c/264533/27/keystone/resource/core.py | 18:27 |
| *** daemontool_ has joined #openstack-keystone | 18:27 | |
| samueldmq | henrynash: ah, you mean when it catches an exception | 18:27 |
| EmilienM | ayoung: thanks | 18:27 |
| *** ninag has quit IRC | 18:28 | |
| samueldmq | henrynash: it does the same when we add a new function to a new driver version | 18:28 |
| ayoung | notmorgan, ah...you wanted a release not change, didn't you? | 18:28 |
| samueldmq | henrynash: and the wrapper can't do anything about it for old driver | 18:28 |
| notmorgan | ayoung: yep | 18:28 |
| notmorgan | ayoung: needs to fix the reno if we're not deprecating | 18:28 |
| henrynash | samueldmq: but we can’t stop domain creation just becaues you have a v8 driver (which used to supprot domain crreation in Liberty) | 18:28 |
| *** daemontool_ has quit IRC | 18:29 | |
| *** daemontool has quit IRC | 18:29 | |
| ayoung | notmorgan, is there a tox test to run for those? | 18:29 |
| samueldmq | henrynash: I'm thinking ... | 18:30 |
| notmorgan | tox -ereleasenotes ? | 18:30 |
| *** BAKfr has quit IRC | 18:30 | |
| ayoung | yes theres is | 18:30 |
| henrynash | samueldmq: if we really want to go that route, then teh wrapper has to reflect projects as a domain back onto teh domain table | 18:31 |
| *** BAKfr has joined #openstack-keystone | 18:32 | |
| *** mylu has joined #openstack-keystone | 18:32 | |
| samueldmq | henrynash: in my head, if you want to use an old version of a driver, you are taking the risks of something not being able to operate the same | 18:32 |
| samueldmq | henrynash: does the database remains the old too ? | 18:33 |
| henrynash | samueldmq: ageed - NEW fucntionaliy many not be availble, but existing fucntionality should not be removed | 18:33 |
| henrynash | samueldmq: we do not support teh v8 database scheme | 18:33 |
| henrynash | (at Mitaka) | 18:33 |
| openstackgerrit | ayoung proposed openstack/keystone: Re-enable and undepreate admin-token https://review.openstack.org/280329 | 18:34 |
| henrynash | samueldmq: i.e. it is not a requirement for us to support a modified version of our V8 driver that acustomer is using in terms of the database scheme and migration…..they should be using their own tables that we know nothing about | 18:34 |
| *** BAKfr has quit IRC | 18:36 | |
| henrynash | samueldmq: so I started with exactyly the thoughts you have…and we had a big IRC meeting debate about it a few months a back…and it was explicitely stated that it NOT a goal to support some custoemrs modifed version or our old SQL driver, any more than if they had their own cassandra driver | 18:37 |
| samueldmq | henrynash: okay, I think I got it | 18:38 |
| samueldmq | henrynash: just confused about your comment here: https://review.openstack.org/#/c/264533/24/keystone/resource/core.py | 18:38 |
| samueldmq | henrynash: L1068 you said "I think these are all OK, since a V8 driver will not have the hidden rows." | 18:38 |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Time-based One-time Password https://review.openstack.org/274901 | 18:39 |
| *** BAKfr has joined #openstack-keystone | 18:39 | |
| henrynash | samueldmq: so becuase the comment is in the manager (since it is shared by the wrapper driver), i was trying to general….and I meant our own SQL/LDAP drivers | 18:40 |
| samueldmq | henrynash: however, if I pass a project: {'domain_id': None} to the wrapper of create_project (L1086), it will ad the hidden value for NULL | 18:40 |
| samueldmq | henrynash: so that new project, when returned, will contain the hidden row | 18:40 |
| samueldmq | henrynash: makes sense? | 18:40 |
| henrynash | samueldmq: I don’t think the hidden row will be there (unless I goofed), but we do swap the hidden null value back and forth | 18:41 |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Time-based One-time Password https://review.openstack.org/274901 | 18:41 |
| samueldmq | henrynash: for example list_project_ids_from_domain_ids(['list_project_ids_from_domain_ids']) | 18:42 |
| *** baffle has joined #openstack-keystone | 18:42 | |
| henrynash | samueldmq: since I was concerned that otherwise we were changing the definition of one of the column attributes (it used be be non-nullable, and unless I add in the speciial value, it would now be nullable) | 18:42 |
| samueldmq | henrynash: list_project_ids_from_domain_ids is not wrapped | 18:42 |
| henrynash | samueldmq: so there are no hidden rows in teh data set of a V8 driver…so I don;t think it needs to be wrapped | 18:44 |
| *** ninag has joined #openstack-keystone | 18:44 | |
| samueldmq | henrynash: if I call list_project_ids_from_domain_ids(['list_project_ids_from_domain_ids']) | 18:44 |
| samueldmq | henrynash: the project I created with the wrapped version of create_project will be returned | 18:45 |
| samueldmq | henrynash: won't it ? | 18:45 |
| notmorgan | henrynash: removed the paragraph from the commit message that wasn't super relevant | 18:45 |
| henrynash | samueldmq: so doesn’t call just return a lsit of IDs? | 18:45 |
| henrynash | notmorgan: yep, saw that, thanks….. | 18:46 |
| samueldmq | henrynash: I don't know :/ let me look | 18:46 |
| samueldmq | henrynash: how are we in terms of tests for driver signatures ? | 18:46 |
| notmorgan | henrynash: you can see why that was such a wonky commit message, it basically said "we store a null" and "we really don't store a null" | 18:46 |
| notmorgan | :P | 18:46 |
| henrynash | notmorgan: that first para was taking at the manager level…but understand why you thought it a bit confusing | 18:46 |
| notmorgan | yeah | 18:46 |
| henrynash | notmorgan: thx | 18:47 |
| notmorgan | and it wasn't clear it was manager level, it was superfluous | 18:47 |
| henrynash | notmorgan: I’m good with taht change | 18:47 |
| notmorgan | yep | 18:47 |
| henrynash | samueldmq: how do you mean? | 18:47 |
| samueldmq | henrynash: do we have a set of tests that say: 'yes, your driver comply with v9' | 18:49 |
| samueldmq | ? | 18:49 |
| henrynash | samueldmq: yes, we run the full test_backend_sql against teh V8 driver….see tests/backend/leagcy_driver | 18:50 |
| openstackgerrit | David Moreau Simard proposed openstack/keystone: Re-enable and undeprecate admin-token https://review.openstack.org/280329 | 18:51 |
| samueldmq | henrynash: so the same tests of a v9 version of the driver in a v8-wrapped one | 18:51 |
| henrynash | samueldmq: yes, with a few overridden ones where they are testing new functionality that is nt available with V8 | 18:52 |
| ayoung | edmondsw_, if you have changes you want in the commit, feel free to make them directly. Let's get it moving. | 18:52 |
| edmondsw_ | ayoung, sure, give me a minute | 18:52 |
| samueldmq | henrynash: okay, so we should be really carreful to only override the ones that have NEW functionality | 18:53 |
| henrynash | samueldmq: indeed | 18:53 |
| samueldmq | henrynash: cool, I am more confident now since we have the same tests for them :) | 18:53 |
| *** Ephur has joined #openstack-keystone | 18:54 | |
| samueldmq | :) | 18:54 |
| henrynash | samueldmq: good conversation | 18:54 |
| samueldmq | henrynash: yep, thanks for clarifying | 18:55 |
| *** subscope has joined #openstack-keystone | 18:55 | |
| openstackgerrit | Brant Knudson proposed openstack/oslo.policy: Support policy file in YAML https://review.openstack.org/278513 | 18:56 |
| *** doug-fis_ has joined #openstack-keystone | 18:58 | |
| samueldmq | henrynash: you were right, just looked again at that wrapper and it makes sense to me now :) | 18:58 |
| *** doug-fi__ has joined #openstack-keystone | 18:59 | |
| *** doug-f___ has joined #openstack-keystone | 19:00 | |
| *** ninag has quit IRC | 19:00 | |
| *** doug-fish has quit IRC | 19:00 | |
| *** ninag has joined #openstack-keystone | 19:01 | |
| *** fawadkhaliq has quit IRC | 19:02 | |
| *** lhcheng has joined #openstack-keystone | 19:02 | |
| *** ChanServ sets mode: +v lhcheng | 19:02 | |
| *** doug-fis_ has quit IRC | 19:03 | |
| henrynash | samueldmq: no worries! | 19:03 |
| *** doug-fi__ has quit IRC | 19:04 | |
| *** vgridnev has quit IRC | 19:04 | |
| *** su_zhang has quit IRC | 19:04 | |
| *** ninag has quit IRC | 19:05 | |
| *** vgridnev has joined #openstack-keystone | 19:06 | |
| *** spzala has joined #openstack-keystone | 19:12 | |
| *** annasort has joined #openstack-keystone | 19:15 | |
| *** doug-f___ has quit IRC | 19:16 | |
| *** doug-fish has joined #openstack-keystone | 19:16 | |
| *** doug-fish has quit IRC | 19:16 | |
| *** doug-fish has joined #openstack-keystone | 19:17 | |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: Re-enable and undeprecate admin_token_auth https://review.openstack.org/280329 | 19:17 |
| samueldmq | henrynash: one more question | 19:17 |
| samueldmq | henrynash: in https://review.openstack.org/#/c/264533/27/keystone/common/sql/migrate_repo/versions/089_add_root_of_all_domains.py | 19:17 |
| samueldmq | henrynash: project's domain_id has a foreign key to domain.id | 19:18 |
| samueldmq | henrynash: https://github.com/openstack/keystone/blob/master/keystone/resource/backends/sql.py#L266-L267 | 19:18 |
| samueldmq | henrynash: so you needed to create a domain entity right ? besides the is_domain project ? | 19:19 |
| *** ninag has joined #openstack-keystone | 19:19 | |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: Re-enable and undeprecate admin_token_auth https://review.openstack.org/280329 | 19:19 |
| *** ninag has quit IRC | 19:22 | |
| *** ninag has joined #openstack-keystone | 19:22 | |
| *** doug-fish has quit IRC | 19:26 | |
| *** doug-fish has joined #openstack-keystone | 19:26 | |
| *** ninag has quit IRC | 19:27 | |
| *** markvoelker has joined #openstack-keystone | 19:32 | |
| samueldmq | henrynash: oh wait, then how are tests currently passing ? | 19:36 |
| *** ninag has joined #openstack-keystone | 19:36 | |
| openstackgerrit | Brant Knudson proposed openstack/oslo.policy: Deprecate load_json() in favor of load() https://review.openstack.org/280373 | 19:36 |
| *** _cjones_ has quit IRC | 19:37 | |
| samueldmq | henrynash: you add both root domain and is_domain project | 19:37 |
| samueldmq | henrynash: nevermind | 19:37 |
| *** _cjones_ has joined #openstack-keystone | 19:37 | |
| *** markvoelker has quit IRC | 19:37 | |
| *** alejandrito has joined #openstack-keystone | 19:41 | |
| *** alejandrito has quit IRC | 19:42 | |
| *** alejandrito has joined #openstack-keystone | 19:42 | |
| *** alejandrito has quit IRC | 19:42 | |
| *** alejandrito has joined #openstack-keystone | 19:42 | |
| *** raildo is now known as raildo-afk | 19:49 | |
| *** daemontool has joined #openstack-keystone | 19:55 | |
| *** raildo-afk is now known as raildo | 19:56 | |
| *** e0ne has quit IRC | 19:56 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 19:58 | |
| *** e0ne has joined #openstack-keystone | 19:59 | |
| *** ninag has quit IRC | 20:04 | |
| *** ninag has joined #openstack-keystone | 20:05 | |
| *** ninag has quit IRC | 20:10 | |
| *** daemontool_ has joined #openstack-keystone | 20:11 | |
| *** raildo is now known as raildo-afk | 20:11 | |
| *** daemontool has quit IRC | 20:13 | |
| openstackgerrit | Brant Knudson proposed openstack/oslo.policy: Change default behavior for YAML https://review.openstack.org/280384 | 20:15 |
| *** mhickey has joined #openstack-keystone | 20:16 | |
| *** openstackgerrit has quit IRC | 20:17 | |
| *** openstackgerrit_ is now known as openstackgerrit | 20:17 | |
| *** openstackgerrit has quit IRC | 20:17 | |
| *** openstackgerrit_ has joined #openstack-keystone | 20:17 | |
| *** openstackgerrit_ is now known as openstackgerrit | 20:18 | |
| *** openstackgerrit_ has joined #openstack-keystone | 20:18 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Fix trust chain/redelegation tests https://review.openstack.org/278163 | 20:21 |
| *** rodrigod` is now known as rodrigods | 20:22 | |
| *** pauloewerton has quit IRC | 20:24 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 20:25 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Fix trust chain tests https://review.openstack.org/278163 | 20:28 |
| *** e0ne has quit IRC | 20:29 | |
| *** ninag has joined #openstack-keystone | 20:40 | |
| *** mhickey has quit IRC | 20:41 | |
| lifeless | notmorgan: hai? | 20:44 |
| notmorgan | lifeless: i... had a reson to summon you to our lovely corner of irc... | 20:44 |
| notmorgan | now lets see if i remember | 20:44 |
| notmorgan | lifeless: shipping resource files in python packages | 20:45 |
| notmorgan | lifeless: for example: https://review.openstack.org/#/c/277608/ having a yaml file define the json schema | 20:46 |
| notmorgan | lifeless: what is the correct way to do such a thing? | 20:46 |
| notmorgan | if there is a defined way | 20:46 |
| notmorgan | bknudson_: ^ cc | 20:46 |
| notmorgan | and feel free to say "OMG DONT" too ;) | 20:46 |
| *** vgridnev has quit IRC | 20:47 | |
| notmorgan | if there is a good reasons not to. | 20:47 |
| *** agireud has quit IRC | 20:50 | |
| *** agireud has joined #openstack-keystone | 20:51 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Re-enable and undeprecate admin_token_auth https://review.openstack.org/280329 | 20:55 |
| htruta | guys, is there anyway I can see the real uuid of a token when doing openstack --debug <cmd> ? | 20:58 |
| htruta | seems like the uuids shown in the requests are encrypted | 20:58 |
| *** clenimar has quit IRC | 21:01 | |
| *** timcline has joined #openstack-keystone | 21:01 | |
| lbragstad | jorge_munoz timcline https://github.com/dhellmann/ansible-znc-on-znc | 21:02 |
| ayoung | notmorgan, revied your addtions, +1. https://review.openstack.org/#/c/280329/7 If you are OK with the patch, please add a +2 on it. | 21:03 |
| *** mylu has quit IRC | 21:03 | |
| ayoung | notmorgan, is the _LW the reason for the pep8 failure? | 21:04 |
| ayoung | htruta, that might be deliberate. | 21:05 |
| notmorgan | ayoung: yep. it's a warning not an exception | 21:05 |
| htruta | ayoung: it is. It's just a devstack | 21:05 |
| dolphm | nonameentername: ping me if you have a minute to discuss https://review.openstack.org/#/c/274901/ | 21:06 |
| ayoung | htruta, look in the client code, then...you might have to modify the client. Is this something ytou want long term | 21:06 |
| notmorgan | ayoung: also i'll +1 for now until we have the config option followup. but will comment that you can consisder it a +2 once the followup is posted | 21:06 |
| notmorgan | commented as such | 21:07 |
| ayoung | notmorgan, ok...let's see what that should look like: default == None and ... | 21:07 |
| htruta | ayoung: cool. Will see. Just thought that there could be some kind of 'insecure' option for this. thanks | 21:07 |
| ayoung | if ADMIN_TOKEN==None return False logic in the middleware? | 21:07 |
| notmorgan | and if the option itsn't set, short-circut out so it doesn't set admin | 21:07 |
| notmorgan | yep | 21:07 |
| notmorgan | false/return without doing anything | 21:07 |
| notmorgan | something like that | 21:07 |
| *** hockeynut_afk is now known as hockeynut | 21:07 | |
| ayoung | notmorgan, do you think that should all be in one patch? WOuldmn | 21:09 |
| ayoung | Wouldn't argue with you if you did | 21:09 |
| notmorgan | i wouldn't say no to it in one patch | 21:09 |
| notmorgan | but i would separate them | 21:09 |
| notmorgan | just so it's clear we are un-deprecating then fixing the bug | 21:09 |
| ayoung | OK...follow on it is...testing now | 21:13 |
| bknudson_ | lifeless: y, the question is how to you have "resource" files in a python app... essentially how could I look up a .yaml file that we ship with the product somehow | 21:15 |
| bknudson_ | ship with the python code | 21:15 |
| *** daemontool_ has quit IRC | 21:18 | |
| *** lhcheng has quit IRC | 21:18 | |
| samueldmq | henrynash: you still around ? | 21:28 |
| samueldmq | henrynash: please take a look at my comment in https://review.openstack.org/#/c/264533/27/keystone/resource/core.py whenever you have a chance | 21:29 |
| openstackgerrit | Brant Knudson proposed openstack/oslo.policy: Deprecate load_json() in favor of load() https://review.openstack.org/280373 | 21:31 |
| openstackgerrit | Brant Knudson proposed openstack/oslo.policy: Change default behavior for YAML https://review.openstack.org/280384 | 21:31 |
| *** jsavak has joined #openstack-keystone | 21:32 | |
| samueldmq | henrynash: I am refering to comment in L1164-1165 | 21:33 |
| *** markvoelker has joined #openstack-keystone | 21:33 | |
| *** aginwala has joined #openstack-keystone | 21:34 | |
| *** jsavak has quit IRC | 21:37 | |
| *** markvoelker has quit IRC | 21:38 | |
| *** ninag has quit IRC | 21:39 | |
| openstackgerrit | ayoung proposed openstack/keystone: Re-enable and undeprecate admin_token_auth https://review.openstack.org/280329 | 21:42 |
| *** aginwala has quit IRC | 21:46 | |
| *** subscope has quit IRC | 21:48 | |
| *** aginwala has joined #openstack-keystone | 21:48 | |
| *** esp has joined #openstack-keystone | 21:49 | |
| *** alejandrito has quit IRC | 21:49 | |
| *** esp has quit IRC | 21:56 | |
| *** esp has joined #openstack-keystone | 21:59 | |
| *** phalmos_ has quit IRC | 22:00 | |
| *** esp has quit IRC | 22:04 | |
| *** timcline has quit IRC | 22:06 | |
| *** neophy has quit IRC | 22:14 | |
| *** mhickey has joined #openstack-keystone | 22:21 | |
| *** Ephur has quit IRC | 22:28 | |
| *** mhickey has quit IRC | 22:31 | |
| *** doug-fish has quit IRC | 22:42 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: sensible default for secure_proxy_ssl_header https://review.openstack.org/280435 | 22:45 |
| *** doug-fish has joined #openstack-keystone | 22:48 | |
| *** doug-fish has quit IRC | 22:51 | |
| *** doug-fish has joined #openstack-keystone | 22:52 | |
| *** clenimar has joined #openstack-keystone | 22:53 | |
| *** daemontool has joined #openstack-keystone | 22:54 | |
| *** doug-fish has quit IRC | 22:54 | |
| *** doug-fish has joined #openstack-keystone | 22:55 | |
| *** aginwala has quit IRC | 22:56 | |
| *** lbragstad_ has joined #openstack-keystone | 22:56 | |
| *** daemontool_ has joined #openstack-keystone | 22:58 | |
| *** daemontool has quit IRC | 22:58 | |
| *** aginwala has joined #openstack-keystone | 22:58 | |
| *** arif-ali has left #openstack-keystone | 22:59 | |
| *** doug-fish has quit IRC | 23:00 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Fix terms from patch 275706 https://review.openstack.org/280436 | 23:01 |
| *** diazjf has quit IRC | 23:01 | |
| *** rcernin has quit IRC | 23:05 | |
| *** daemontool has joined #openstack-keystone | 23:05 | |
| *** daemontool_ has quit IRC | 23:06 | |
| *** clenimar has quit IRC | 23:07 | |
| *** slberger has left #openstack-keystone | 23:19 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Create policy.yaml sample files https://review.openstack.org/278542 | 23:19 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Create policy.yaml sample files https://review.openstack.org/278542 | 23:22 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:25 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Consolidate TestTrustRedelegation and TestTrustAuth tests https://review.openstack.org/280442 | 23:25 |
| *** mylu has joined #openstack-keystone | 23:28 | |
| *** markvoelker has joined #openstack-keystone | 23:34 | |
| *** csoukup has quit IRC | 23:35 | |
| *** markvoelker has quit IRC | 23:38 | |
| *** dims_ has quit IRC | 23:41 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add docstring to delete_project https://review.openstack.org/280446 | 23:43 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Consolidate TestTrustRedelegation and TestTrustAuth tests https://review.openstack.org/280447 | 23:44 |
| *** _cjones_ has quit IRC | 23:44 | |
| *** henrynash has quit IRC | 23:46 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add docstring to delete_project https://review.openstack.org/280446 | 23:52 |
| *** jorge_munoz has left #openstack-keystone | 23:53 | |
| *** shoutm has joined #openstack-keystone | 23:54 | |
| *** dims has joined #openstack-keystone | 23:57 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Fixes parameter in duplicate project name creation https://review.openstack.org/280448 | 23:57 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!