| *** rk4n has quit IRC | 00:04 | |
| *** mylu has joined #openstack-keystone | 00:06 | |
| *** sdake has joined #openstack-keystone | 00:07 | |
| *** fangxu has quit IRC | 00:16 | |
| *** annasort has joined #openstack-keystone | 00:18 | |
| morgan | dstanek: so, not sure how to fix the DB fixture to not use the legacy engine facade | 00:23 |
|---|---|---|
| morgan | dolphm: but that fix will apply to the other tests and we can be free of the legacy facade | 00:23 |
| *** sdake has quit IRC | 00:23 | |
| morgan | dstanek: ^ cc ( dolphm ^ what i said to dstanek too) | 00:23 |
| ayoung | morgan, this line is from revoking a token with no audit info. Can you tell me why that is bad? | 00:23 |
| dstanek | morgan: i'd have to take a look at see what we're doing in there | 00:23 |
| ayoung | lbragstad, so the revoke tree looks like this {'trust_id=*': {'consumer_id=*': {'access_token_id=*': {'audit_id=*': {u'audit_chain_id=None': {'expires_at=*': {'domain_id=*': {'project_id=*': {'user_id=*': {'role_id=*': {'domain_scope_id=*': {'issued_before': datetime.datetime(2016, 2, 24, 23, 42, 57, 795165)}}}}}}}}}}}} | 00:23 |
| *** henrynash has quit IRC | 00:24 | |
| morgan | dstanek: it's the reflection model->schema create bit | 00:24 |
| ayoung | I'll give you a hint: * means match all | 00:24 |
| morgan | ayoung: that was compat | 00:24 |
| ayoung | morgan, it just revoked ALL tokens | 00:24 |
| morgan | ayoung: drop support for it now. we have been >2cycles with audit_info | 00:24 |
| morgan | oh. this isback to the tree being non-intuative :( | 00:25 |
| morgan | but yeah | 00:25 |
| morgan | don't do that :P | 00:25 |
| morgan | ayoung: you know that looks like something we could encode into a SQL query about as easily now :P | 00:25 |
| morgan | ayoung: if we index the revoke table | 00:25 |
| ayoung | morgan, 90% of the revoke stuff is bogus now | 00:26 |
| morgan | ayoung: yeah | 00:26 |
| ayoung | we need revoke by audit id and ... I think that is about it? | 00:26 |
| morgan | ayoung: prob. revoke by user | 00:26 |
| ayoung | nope | 00:26 |
| morgan | password change? | 00:26 |
| ayoung | ah for password | 00:26 |
| ayoung | yeah | 00:26 |
| morgan | yeah | 00:26 |
| ayoung | that is the one | 00:26 |
| morgan | and revoke by project/domain is useful but could be skipped for revoke by user if needed | 00:27 |
| morgan | but beyond that i think we're pretty much audit_id, user. | 00:27 |
| morgan | but we can def. drop role_id. and "expires_at" | 00:28 |
| morgan | and trust_id *shrug* i don't think we *need* | 00:28 |
| morgan | ayoung: fwiw, audit_chain_id would be the same as expires_at, but more restrictive/accurate | 00:29 |
| morgan | probably can also be dropped? | 00:30 |
| ayoung | audit chain stays | 00:30 |
| ayoung | that is pretty much the only one, as that is token specific | 00:30 |
| morgan | audit and audit_chain need to stay | 00:31 |
| morgan | audit_chain would revoke the entire chain/every token recoped or not | 00:32 |
| morgan | audit_id is just "this" token | 00:32 |
| *** bjornar__ has quit IRC | 00:32 | |
| morgan | but expires_at would net the same as audit_chain | 00:32 |
| morgan | for sure | 00:32 |
| ayoung | we should use audit chaing for a Horizon logout | 00:32 |
| morgan | ayoung: we tried that, it broke long-running tasks | 00:32 |
| morgan | for the same basic reason why token expiration does | 00:33 |
| morgan | ftr, i don't disagree with using audit_chain for horizon logout, but we have work to do before we can | 00:33 |
| morgan | s/don't disagree/agree | 00:34 |
| *** timcline_ has joined #openstack-keystone | 00:34 | |
| ayoung | next release | 00:34 |
| morgan | (i need to work on avoiding the idiomatic "double negative") | 00:34 |
| ayoung | for now can I get rid of the "with no audit info tests" | 00:35 |
| morgan | yep | 00:35 |
| morgan | that can go away | 00:35 |
| ayoung | is there some code change that goes with that | 00:35 |
| morgan | that was just for transition from audit_id -> no audit_id | 00:35 |
| ayoung | or just drop the test | 00:35 |
| morgan | at this point if a token doesn't have an audit id... fail the token | 00:35 |
| morgan | period | 00:35 |
| morgan | might get to remove an extra if conditional in the token provider validate call :) | 00:36 |
| morgan | and that test likely should just check that a 401 is issued. | 00:36 |
| ayoung | is it possible to make a token with no audit info somehow? | 00:36 |
| morgan | between i think juno and kilo? | 00:36 |
| ayoung | ah, OK...gonna just kill the test then | 00:37 |
| morgan | and likely should kill the provider logic around it too | 00:37 |
| morgan | i would say that is an internal server error w/o audit_ids now... bad internal data | 00:37 |
| morgan | so should be fine to raise up and out unexpected exception when it happens | 00:38 |
| morgan | s/when/if | 00:38 |
| morgan | (defaulkt for like KeyError etc when decoding a token) | 00:38 |
| *** timcline_ has quit IRC | 00:38 | |
| ayoung | testtools.matchers._impl.MismatchError: '2016-02-25T01:37:40Z' != '2016-02-25T01:37:40.000000Z' | 00:38 |
| ayoung | hmmm | 00:39 |
| morgan | yeah you might need to squash the resolution to non-subsecond | 00:39 |
| *** mylu has quit IRC | 00:42 | |
| *** fangxu has joined #openstack-keystone | 00:48 | |
| *** mylu has joined #openstack-keystone | 00:54 | |
| *** gyee has quit IRC | 01:04 | |
| *** diazjf has joined #openstack-keystone | 01:04 | |
| *** diazjf1 has joined #openstack-keystone | 01:06 | |
| *** diazjf has quit IRC | 01:06 | |
| *** mylu has quit IRC | 01:13 | |
| *** davechen has joined #openstack-keystone | 01:14 | |
| *** EinstCrazy has joined #openstack-keystone | 01:20 | |
| *** spandhe has quit IRC | 01:26 | |
| *** jasonsb has joined #openstack-keystone | 01:33 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 01:34 |
| *** timcline_ has joined #openstack-keystone | 01:35 | |
| *** lhcheng has quit IRC | 01:35 | |
| *** ninag has quit IRC | 01:38 | |
| *** timcline_ has quit IRC | 01:39 | |
| *** slberger has left #openstack-keystone | 01:39 | |
| openstackgerrit | Merged openstack/keystone: Remove migration_helpers.get_default_domain https://review.openstack.org/282049 | 01:41 |
| openstackgerrit | Merged openstack/keystone: Update default domain's description https://review.openstack.org/281381 | 01:42 |
| *** richm has quit IRC | 01:44 | |
| *** zzzeek has quit IRC | 01:45 | |
| *** zzzeek has joined #openstack-keystone | 01:45 | |
| *** zzzeek has quit IRC | 01:47 | |
| *** zzzeek has joined #openstack-keystone | 01:50 | |
| *** dims has quit IRC | 01:52 | |
| *** zzzeek has quit IRC | 01:52 | |
| *** dan_nguyen has quit IRC | 01:53 | |
| *** zzzeek has joined #openstack-keystone | 01:54 | |
| ayoung | so most of the failing tests are due to failure to find policy.json | 02:02 |
| *** csoukup has joined #openstack-keystone | 02:12 | |
| morgan | ayoung: don't run them in isolation | 02:15 |
| morgan | ayoung: there is a bug in our test suite that causes that to fail. if you run the whole thing again, it should work | 02:15 |
| ayoung | morgan, hmmm | 02:16 |
| ayoung | ok, let's see | 02:16 |
| *** csoukup has quit IRC | 02:16 | |
| morgan | ayoung: i think there is even a bug open on that | 02:16 |
| morgan | not sure why it fails when run in isolation tbh | 02:16 |
| morgan | i haven't looket at the setUp()s | 02:16 |
| ayoung | its the path it uses to search for the policy files | 02:17 |
| ayoung | its probably set up in some test and that is run early | 02:17 |
| davechen | ayoung, morgan: it has been fixed by this patch - https://review.openstack.org/#/c/278528/ | 02:17 |
| patchbot | davechen: patch 278528 - keystone - Moves policy setup into a fixture. (MERGED) | 02:17 |
| ayoung | so if you run the individual tests, the path is st wrong | 02:17 |
| davechen | ayoung: you might need a rebase. | 02:17 |
| ayoung | so I should not be seeing that in this bug, but maybe I need a rebase | 02:18 |
| *** fangxu has quit IRC | 02:21 | |
| *** vilobhmm11 has quit IRC | 02:24 | |
| *** vilobhmm11 has joined #openstack-keystone | 02:25 | |
| morgan | davechen: nice. | 02:28 |
| morgan | davechen: thnx for the heads up | 02:28 |
| davechen | morgan: np. :) | 02:30 |
| *** vilobhmm11 has quit IRC | 02:35 | |
| *** timcline_ has joined #openstack-keystone | 02:35 | |
| *** Ephur has quit IRC | 02:36 | |
| *** vilobhmm11 has joined #openstack-keystone | 02:36 | |
| *** vilobhmm11 has quit IRC | 02:37 | |
| *** timcline_ has quit IRC | 02:40 | |
| *** links has joined #openstack-keystone | 02:47 | |
| ayoung | 20 failed tests | 02:51 |
| *** diazjf1 has quit IRC | 02:58 | |
| openstackgerrit | ayoung proposed openstack/keystone: [WIP]Make fernet default token provider https://review.openstack.org/258650 | 02:58 |
| *** boris-42 has quit IRC | 03:04 | |
| *** edmondsw has quit IRC | 03:07 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 03:09 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Switch to use `new_domain_ref` for testcases https://review.openstack.org/284510 | 03:17 |
| morgan | stevemar, dstanek: i think i have most of the enginefacade warnings smashed. | 03:18 |
| morgan | stevemar, dstanek: proposing the fix in a moment | 03:19 |
| ayoung | are trust tokens even working with Fernet? | 03:20 |
| morgan | ayoung: v2 or v3? | 03:20 |
| morgan | ayoung: cause v3 should be working, v2? i don't think so | 03:20 |
| ayoung | ah...test_auth is all V2 isn't it | 03:20 |
| morgan | aye | 03:20 |
| ayoung | OK...so that is... | 03:21 |
| ayoung | 3 fails: | 03:21 |
| morgan | thats not too bad | 03:21 |
| morgan | @skip_if_fernet('we do not care about v2... or your v2 trust tokens l2v3authonly') | 03:22 |
| morgan | :P | 03:22 |
| ayoung | morgan, ugh...nah, it is a security hole | 03:24 |
| ayoung | def test_delete_trust_revokes_token(self): | 03:24 |
| ayoung | def test_token_from_trust_cant_get_another_token(self): | 03:24 |
| ayoung | keystone.tests.unit.test_auth.AuthWithTrust.test_delete_tokens_for_user_invalidates_tokens_from_trust | 03:24 |
| ayoung | We need to proactively prevent V2 TOkens from trusts if we are going to do this | 03:24 |
| morgan | crap ... just smashed my face and scratched the hell out of my glasses :( | 03:27 |
| *** timcline has quit IRC | 03:28 | |
| morgan | funny the glasses with the heavier frames keep scratching, the ones with no frames hjave not been scratched... wtf. | 03:29 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: No more legacy engine facade in tests https://review.openstack.org/284516 | 03:31 |
| morgan | stevemar, davechen, dstanek: ^ | 03:31 |
| morgan | dolphm: ^ | 03:31 |
| morgan | hmm | 03:31 |
| morgan | i should probably have run pep8 on that before pushing it | 03:31 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: No more legacy engine facade in tests https://review.openstack.org/284516 | 03:33 |
| *** links has quit IRC | 03:34 | |
| *** timcline has joined #openstack-keystone | 03:36 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Switch to use `new_domain_ref` for testcases https://review.openstack.org/284510 | 03:38 |
| *** timcline has quit IRC | 03:40 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: No more legacy engine facade in tests https://review.openstack.org/284516 | 03:47 |
| *** timcline has joined #openstack-keystone | 03:47 | |
| *** chlong_ has quit IRC | 03:47 | |
| *** davechen is now known as davechen_afk | 03:49 | |
| *** chlong_ has joined #openstack-keystone | 03:49 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove get_session and get_engine https://review.openstack.org/284521 | 03:50 |
| morgan | davechen_afk, dstanek, stevemar: ^ remove the .get_session and .get_engine so that people do not re-introduce the use of LegacyEngineFacade | 03:50 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove get_session and get_engine https://review.openstack.org/284521 | 03:52 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Followup for LDAP removal https://review.openstack.org/277196 | 03:54 |
| *** woodster_ has quit IRC | 03:56 | |
| *** lhcheng has joined #openstack-keystone | 04:13 | |
| *** ChanServ sets mode: +v lhcheng | 04:13 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Default caching to on for request-local caching. https://review.openstack.org/277198 | 04:24 |
| *** links has joined #openstack-keystone | 04:29 | |
| *** timcline_ has joined #openstack-keystone | 04:37 | |
| *** timcline_ has quit IRC | 04:42 | |
| *** davechen_afk is now known as davechen | 04:48 | |
| *** Nirupama has joined #openstack-keystone | 04:53 | |
| *** lhcheng has quit IRC | 04:53 | |
| morgan | stevemar: uhm... not sure why devstack failed the enginefacade things... actually ... hmm | 04:55 |
| morgan | ayoung: do you need/want me to take a crack at the caching issues with fernet? | 05:07 |
| morgan | probably is some silly assumption | 05:07 |
| morgan | ayoung: oh . i know what is up w/ the cache invalidation tests >.> | 05:09 |
| morgan | :P oi | 05:09 |
| *** diazjf has joined #openstack-keystone | 05:12 | |
| *** belmoreira has joined #openstack-keystone | 05:12 | |
| *** sdake has joined #openstack-keystone | 05:17 | |
| davechen | morgan: the failed CI has nothing to do with your change, so push it through. :) | 05:20 |
| *** sdake has quit IRC | 05:22 | |
| stevemar | morgan: everything is le failing | 05:31 |
| *** fpatwa_ has joined #openstack-keystone | 05:31 | |
| morgan | stevemar: FIX IT OMG :P | 05:31 |
| *** timcline_ has joined #openstack-keystone | 05:38 | |
| *** timcline_ has quit IRC | 05:42 | |
| jamielennox | so there's no default domain anymore unless you keystone-manage bootstrap? | 05:50 |
| stevemar | jamielennox: i think that's the idea that bknudson was thinking.. | 05:51 |
| jamielennox | stevemar: more i was surprised that it broken my automation and i'm probably not the only one | 05:51 |
| stevemar | jamielennox: did it break keystone-manage db_sync? | 05:51 |
| jamielennox | stevemar: no, but i'm doing initial automation | 05:52 |
| stevemar | jamielennox: i was worried about that part... | 05:52 |
| jamielennox | stevemar: so install, run db_sync | 05:52 |
| *** dims has joined #openstack-keystone | 05:52 | |
| jamielennox | then using the ADMIN_TOKEN the first thing you do is try to create users | 05:52 |
| jamielennox | you get | 05:52 |
| jamielennox | Could not find domain: default (HTTP 404) (Request-ID: req-18507ed5-a3ef-44af-a3c2-1cb48090154f) | 05:52 |
| jamielennox | i can obviously get around it (though i'm going to check how idempotent the bootstrap is), but i think we'll get some pushback | 05:53 |
| *** afred312 has quit IRC | 05:55 | |
| stevemar | https://review.openstack.org/#/c/282042/ | 05:57 |
| patchbot | stevemar: patch 282042 - keystone - db_sync doesn't create default domain (MERGED) | 05:57 |
| stevemar | jamielennox: ^ | 05:57 |
| jamielennox | stevemar: i don't know if we have the option to not support v2 | 05:58 |
| stevemar | jamielennox: we're not supporting *new* v2s | 05:59 |
| stevemar | jamielennox: only folks installing keystone for the first time are going to hit this issue | 05:59 |
| *** doug-fish has joined #openstack-keystone | 06:00 | |
| *** fpatwa_ has quit IRC | 06:00 | |
| stevemar | jamielennox: hit that revert button | 06:00 |
| jamielennox | stevemar: that includes any of the automation projects that rely on this | 06:00 |
| jamielennox | stevemar: you should ensure that puppet etc are all ready | 06:00 |
| stevemar | jamielennox: i asked early on "won't we be forcing folks to a) must use the bootstrap command or b) if they go the ADMIN_TOKEN route, they must now create a domain before migrating?" | 06:00 |
| jamielennox | especially because we are telling people to run bootstrap anyway | 06:01 |
| stevemar | jamielennox: if bootstrap is run, things should be fine | 06:01 |
| jamielennox | right, because all the ansible < 2 stuff uses API v2 | 06:01 |
| jamielennox | so it was working now doesn't | 06:01 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revert "db_sync doesn't create default domain" https://review.openstack.org/284548 | 06:01 |
| jamielennox | it appears running bootstrap multiple times is fine | 06:02 |
| jamielennox | just something we should discuss | 06:02 |
| *** v1k0d3n has quit IRC | 06:05 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: [WIP]Make fernet default token provider https://review.openstack.org/258650 | 06:15 |
| morgan | ayoung: ^ that should resolve all but the Trust and the weird error you're seeing | 06:18 |
| morgan | stevemar, jamielennox: default domain should be created on demand iirc. maybe we're missing that step. | 06:19 |
| morgan | jamielennox: running bootstrap many times should be 100% ok. it's designed to be idempotent if the arguments are the same | 06:19 |
| jamielennox | morgan: yep, i can change my stuff to use bootstrap, but it's not creating the domain on deman | 06:19 |
| morgan | jamielennox: we might need to make it do the "on demand" bit or move the "on demand" bit. it shouldn't be baked into the SQL migrations for sure | 06:20 |
| morgan | if we can avoid that | 06:20 |
| morgan | throw a big fat warning "OMG DEFAUT DOMAIN NOT FOUND...CREATING...USE KEYSTONE-MANAGE BOOTSTRAP NEXT TIME FFS | 06:21 |
| morgan | " | 06:21 |
| morgan | :P | 06:21 |
| morgan | or whatever. | 06:21 |
| *** miguelgrinberg has quit IRC | 06:25 | |
| *** miguelgrinberg has joined #openstack-keystone | 06:27 | |
| *** timcline_ has joined #openstack-keystone | 06:38 | |
| *** lhcheng has joined #openstack-keystone | 06:42 | |
| *** ChanServ sets mode: +v lhcheng | 06:42 | |
| *** timcline_ has quit IRC | 06:43 | |
| *** dims has quit IRC | 06:43 | |
| *** dave-mccowan has quit IRC | 06:45 | |
| *** lhcheng has quit IRC | 06:46 | |
| *** josecastroleon has joined #openstack-keystone | 06:49 | |
| *** fawadkhaliq has joined #openstack-keystone | 06:50 | |
| *** belmoreira has quit IRC | 06:53 | |
| *** fangxu has joined #openstack-keystone | 06:54 | |
| *** doug-fish has quit IRC | 06:54 | |
| *** zzzeek has quit IRC | 06:56 | |
| *** zzzeek has joined #openstack-keystone | 06:59 | |
| *** jasonsb has quit IRC | 07:02 | |
| *** zzzeek has quit IRC | 07:10 | |
| *** henrynash has joined #openstack-keystone | 07:11 | |
| *** ChanServ sets mode: +v henrynash | 07:11 | |
| *** henrynash has quit IRC | 07:12 | |
| *** diazjf has quit IRC | 07:12 | |
| *** tomoiaga has joined #openstack-keystone | 07:16 | |
| *** tomoiaga has quit IRC | 07:21 | |
| *** timcline_ has joined #openstack-keystone | 07:39 | |
| *** timcline_ has quit IRC | 07:44 | |
| *** belmoreira has joined #openstack-keystone | 07:51 | |
| *** fawadkhaliq has quit IRC | 07:51 | |
| *** belmoreira has quit IRC | 07:58 | |
| *** belmoreira has joined #openstack-keystone | 08:00 | |
| *** belmoreira has quit IRC | 08:06 | |
| *** rk4n has joined #openstack-keystone | 08:11 | |
| *** Oku_OS has quit IRC | 08:18 | |
| *** browne has quit IRC | 08:19 | |
| *** rk4n has quit IRC | 08:20 | |
| *** rk4n has joined #openstack-keystone | 08:22 | |
| *** vinm213 has joined #openstack-keystone | 08:29 | |
| vinm213 | Good morning all | 08:29 |
| vinm213 | Have u ever faced issue with keystone while installing devstack on ubuntu 14.04 | 08:38 |
| *** timcline_ has joined #openstack-keystone | 08:40 | |
| vinm213 | particularly the error http://paste.openstack.org/show/487834/ | 08:41 |
| *** timcline_ has quit IRC | 08:42 | |
| *** timclin__ has joined #openstack-keystone | 08:42 | |
| *** timclin__ has quit IRC | 08:46 | |
| *** rk4n has quit IRC | 08:47 | |
| *** boris-42 has joined #openstack-keystone | 08:52 | |
| *** tomoiaga has joined #openstack-keystone | 08:53 | |
| *** jistr has joined #openstack-keystone | 09:01 | |
| *** mvk has joined #openstack-keystone | 09:09 | |
| *** esp has joined #openstack-keystone | 09:10 | |
| *** Oku_OS has joined #openstack-keystone | 09:10 | |
| *** samueldmq1 has joined #openstack-keystone | 09:11 | |
| *** esp has quit IRC | 09:14 | |
| *** samueldmq1 has quit IRC | 09:15 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:17 | |
| *** fawadkhaliq has quit IRC | 09:29 | |
| *** pnavarro has joined #openstack-keystone | 09:36 | |
| *** timcline_ has joined #openstack-keystone | 09:43 | |
| *** timcline_ has quit IRC | 09:47 | |
| *** davechen has left #openstack-keystone | 09:53 | |
| *** grassy is now known as davechen_afk | 09:53 | |
| *** mvk has quit IRC | 10:01 | |
| *** EinstCrazy has quit IRC | 10:07 | |
| *** daemontool has joined #openstack-keystone | 10:07 | |
| *** EinstCrazy has joined #openstack-keystone | 10:07 | |
| *** EinstCrazy has quit IRC | 10:12 | |
| *** rk4n has joined #openstack-keystone | 10:16 | |
| *** lhcheng has joined #openstack-keystone | 10:20 | |
| *** ChanServ sets mode: +v lhcheng | 10:20 | |
| *** daemontool has quit IRC | 10:21 | |
| *** daemontool has joined #openstack-keystone | 10:24 | |
| *** pcaruana has joined #openstack-keystone | 10:42 | |
| breton | lol, https://bugs.launchpad.net/bugs/1549726 | 10:42 |
| openstack | Launchpad bug 1549726 in OpenStack Identity (keystone) "Race condition in keystone domain config" [Undecided,New] - Assigned to Divya K Konoor (dikonoor) | 10:42 |
| breton | very nice find | 10:43 |
| *** timcline_ has joined #openstack-keystone | 10:44 | |
| *** timcline_ has quit IRC | 10:48 | |
| *** belmoreira has joined #openstack-keystone | 10:49 | |
| samueldmq | morning all | 10:51 |
| *** sdake has joined #openstack-keystone | 10:58 | |
| *** lhcheng has quit IRC | 11:16 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:27 | |
| *** sdake_ has joined #openstack-keystone | 11:29 | |
| *** sdake has quit IRC | 11:30 | |
| openstackgerrit | Boris Bobrov proposed openstack/python-keystoneclient: Support `truncated` flag returned by keystone https://review.openstack.org/280162 | 11:34 |
| *** sdake_ has quit IRC | 11:37 | |
| openstackgerrit | Boris Bobrov proposed openstack/python-keystoneclient: Support `truncated` flag returned by identity service https://review.openstack.org/280162 | 11:38 |
| *** EinstCrazy has joined #openstack-keystone | 11:43 | |
| *** timcline_ has joined #openstack-keystone | 11:44 | |
| *** josecastroleon has quit IRC | 11:45 | |
| *** timcline_ has quit IRC | 11:48 | |
| *** fpatwa_ has joined #openstack-keystone | 11:49 | |
| *** fpatwa_ has quit IRC | 12:13 | |
| *** raildo-afk is now known as raildo | 12:37 | |
| *** fawadkhaliq has quit IRC | 12:42 | |
| *** daemontool_ has joined #openstack-keystone | 12:43 | |
| *** fawadkhaliq has joined #openstack-keystone | 12:43 | |
| *** timcline_ has joined #openstack-keystone | 12:45 | |
| *** daemontool has quit IRC | 12:46 | |
| *** fawadkhaliq has quit IRC | 12:47 | |
| *** daemontool_ has quit IRC | 12:47 | |
| *** timcline_ has quit IRC | 12:49 | |
| *** woodster_ has joined #openstack-keystone | 12:52 | |
| *** gordc has joined #openstack-keystone | 12:54 | |
| *** ninag has joined #openstack-keystone | 12:54 | |
| *** pcaruana has quit IRC | 12:55 | |
| *** dave-mccowan has joined #openstack-keystone | 12:56 | |
| *** daemontool has joined #openstack-keystone | 13:01 | |
| *** edmondsw has joined #openstack-keystone | 13:04 | |
| *** lhcheng has joined #openstack-keystone | 13:05 | |
| *** ChanServ sets mode: +v lhcheng | 13:05 | |
| *** pcaruana has joined #openstack-keystone | 13:09 | |
| *** lhcheng has quit IRC | 13:10 | |
| *** links has quit IRC | 13:26 | |
| *** josecastroleon has joined #openstack-keystone | 13:31 | |
| *** Nirupama has quit IRC | 13:44 | |
| dstanek | morgan: we have now made the simplest webapp i've ever worked on use database in the most complicated way i've ever seen :-( | 13:45 |
| *** timcline_ has joined #openstack-keystone | 13:46 | |
| *** dims has joined #openstack-keystone | 13:47 | |
| *** henrynash has joined #openstack-keystone | 13:48 | |
| *** ChanServ sets mode: +v henrynash | 13:48 | |
| *** timcline_ has quit IRC | 13:50 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:53 | |
| *** zzzeek has joined #openstack-keystone | 13:57 | |
| *** zzzeek has quit IRC | 13:57 | |
| *** zzzeek has joined #openstack-keystone | 13:58 | |
| *** daemontool_ has joined #openstack-keystone | 13:59 | |
| amakarov | henrynash, good day! what's the difference between resource.backends and resource.V8_backends? | 14:00 |
| henrynash | amakarov: the V8 one is a copy of our old V8 driver, used only for testing purposes to ensure we can support legacy drivers | 14:01 |
| henrynash | amakarov: resource.backends contain the latest (currently V9) version | 14:01 |
| amakarov | henrynash, thank you! I'll make my changes there | 14:02 |
| *** daemontool has quit IRC | 14:02 | |
| vinm213 | Hello all | 14:06 |
| vinm213 | i just trying to install devstack | 14:06 |
| vinm213 | and facing issues | 14:06 |
| *** links has joined #openstack-keystone | 14:07 | |
| vinm213 | hope thiwith keystone | 14:07 |
| *** petertr7_away is now known as petertr7 | 14:15 | |
| *** pauloewerton has joined #openstack-keystone | 14:17 | |
| *** fawadkhaliq has quit IRC | 14:20 | |
| lbragstad | ayoung reviewing you fernet patch today | 14:21 |
| *** spzala has joined #openstack-keystone | 14:22 | |
| raildo | lbragstad: I'm working on it too :) right now we only have 8 faled tests | 14:27 |
| raildo | failed* | 14:27 |
| *** vinm213 has quit IRC | 14:28 | |
| *** rk4n has quit IRC | 14:36 | |
| *** rk4n has joined #openstack-keystone | 14:36 | |
| *** rk4n has quit IRC | 14:38 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 14:42 |
| *** petertr7 is now known as petertr7_away | 14:45 | |
| henrynash | dstanek: if you are above, take a look at the new patch I posted for https://review.openstack.org/231289 - it has the code in to map projects acting as a domain back onto the underlying legacy driver domain methods | 14:50 |
| *** woodster_ has quit IRC | 14:56 | |
| lbragstad | raildo that's awesome! | 14:58 |
| lbragstad | raildo ayoung trying to wrap a couple things up but I want to get around to reviewing that today | 14:59 |
| *** petertr7_away is now known as petertr7 | 15:01 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 15:01 |
| *** pushkaru has joined #openstack-keystone | 15:02 | |
| *** PsionTheory has joined #openstack-keystone | 15:04 | |
| *** daemontool__ has joined #openstack-keystone | 15:10 | |
| *** roxanaghe has joined #openstack-keystone | 15:12 | |
| *** links has quit IRC | 15:12 | |
| *** e0ne has joined #openstack-keystone | 15:14 | |
| *** daemontool_ has quit IRC | 15:14 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:15 | |
| *** knikolla has joined #openstack-keystone | 15:16 | |
| *** roxanaghe has quit IRC | 15:16 | |
| *** roxanaghe has joined #openstack-keystone | 15:18 | |
| dstanek | henrynash: awesome! i'll take another look | 15:18 |
| *** rk4n has joined #openstack-keystone | 15:19 | |
| *** rk4n has quit IRC | 15:20 | |
| *** rk4n has joined #openstack-keystone | 15:20 | |
| *** su_zhang has joined #openstack-keystone | 15:22 | |
| *** roxanaghe has quit IRC | 15:23 | |
| henrynash | dstanek: thx | 15:25 |
| *** woodster_ has joined #openstack-keystone | 15:25 | |
| *** henrynash has quit IRC | 15:25 | |
| *** PsionTheory has quit IRC | 15:26 | |
| *** timcline_ has joined #openstack-keystone | 15:26 | |
| *** csoukup has joined #openstack-keystone | 15:27 | |
| *** jsavak has joined #openstack-keystone | 15:29 | |
| *** sdake has joined #openstack-keystone | 15:37 | |
| *** petertr7 is now known as petertr7_away | 15:39 | |
| *** e0ne has quit IRC | 15:40 | |
| *** e0ne_ has joined #openstack-keystone | 15:41 | |
| morgan | dstanek: heh | 15:41 |
| *** sdake_ has joined #openstack-keystone | 15:41 | |
| *** jsavak has quit IRC | 15:42 | |
| *** sdake has quit IRC | 15:42 | |
| morgan | ayoung: hopefully my additions to the fernet patch help get you closer | 15:42 |
| *** jsavak has joined #openstack-keystone | 15:43 | |
| *** dan_nguyen has joined #openstack-keystone | 15:43 | |
| *** knikolla has quit IRC | 15:43 | |
| *** tomoiaga has quit IRC | 15:46 | |
| ayoung | morgan, that is what I hoped would happen here: people that know each of these things tackling them. THanks so mucjh | 15:49 |
| ayoung | lbragstad, I might be able to focus a few things for you to look at; | 15:50 |
| morgan | NP. I probably could have resolved the other tests but it was late :( | 15:50 |
| ayoung | in b/keystone/token/providers/fernet/core.py | 15:50 |
| ayoung | around line 150: - audit_ids = provider.audit_info(parent_audit_id) | 15:50 |
| ayoung | if parent_audit_id: | 15:50 |
| ayoung | + audit_ids = provider.audit_info(parent_audit_id) | 15:50 |
| ayoung | I had that as a stand alone change, but it was not testabel without rewriting the tests: | 15:51 |
| ayoung | that gets the entire audit chain into the Fernet token | 15:51 |
| dolphm | ayoung: "entire"? there should only be two IDs, max, right? | 15:51 |
| *** e0ne_ has quit IRC | 15:52 | |
| dolphm | ayoung: the original parent and the current ID | 15:52 |
| morgan | ayoung: the chain id is shared with all tokens | 15:52 |
| ayoung | dolphm, right | 15:52 |
| ayoung | "both" would be more correct | 15:52 |
| * dolphm wipes sweat from brow. | 15:52 | |
| morgan | dolphm: ++ | 15:52 |
| ayoung | it was actually getting garbage in there due to a None Value | 15:52 |
| ayoung | I think the logic I modified could actually be cleaned up even more. | 15:53 |
| morgan | An original non rescoped token only had its id | 15:53 |
| morgan | And a rescoped token would then have a chain ID. That was the original design | 15:53 |
| ayoung | lbragstad, dolphm the other change had to do with the exception returned duriong token validation. Since we are depending on code that was used in other paths, we ened to convert some exceptions | 15:53 |
| ayoung | for example | 15:54 |
| ayoung | keystone/token/provider.py line 244 | 15:54 |
| samueldmq | dstanek: hi, I'd like to see your view on something | 15:54 |
| ayoung | wrapped it in a try block, raise exception.TokenNotFound(_('Failed to validate token')) | 15:54 |
| samueldmq | dstanek: cascade operations on a project hierarchy, specifically how authz would work | 15:54 |
| ayoung | I think those we the only changes I made in the production code | 15:54 |
| morgan | So the chain id needs to be the audit ID of the original non-rescoped token | 15:55 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: V2 operations create default domain on demand https://review.openstack.org/284778 | 15:55 |
| bknudson | morgan: https://review.openstack.org/#/c/284778/1 is work in progress but what do you think? | 15:55 |
| patchbot | bknudson: patch 284778 - keystone - V2 operations create default domain on demand | 15:55 |
| ayoung | morgan, right and we had the data, we were just over writing it with garbage. | 15:55 |
| bknudson | still needs to handle create project, etc. | 15:55 |
| morgan | bknudson: +1 on the idea | 15:56 |
| ayoung | bknudson, Oooh....I like that idea! | 15:56 |
| morgan | Better than the revert and relying on the SQL migration | 15:56 |
| * ayoung thinks bknudson is wicked smaht | 15:56 | |
| morgan | I put a +1 on it already ;) | 15:56 |
| bknudson | ayoung: great! | 15:56 |
| *** jorge_munoz has joined #openstack-keystone | 15:57 | |
| *** sdake has joined #openstack-keystone | 15:57 | |
| *** sdake_ has quit IRC | 15:58 | |
| *** knikolla has joined #openstack-keystone | 15:59 | |
| *** jasonsb has joined #openstack-keystone | 15:59 | |
| bknudson | ayoung: morgan: I'll keep working on it, thanks! | 15:59 |
| *** dims has quit IRC | 16:06 | |
| *** mylu has joined #openstack-keystone | 16:08 | |
| ayoung | lbragstad, so the most concerning test failures are the Trust ones. We have two choices | 16:11 |
| *** sdake_ has joined #openstack-keystone | 16:11 | |
| *** sdake has quit IRC | 16:11 | |
| *** sdake_ has joined #openstack-keystone | 16:12 | |
| ayoung | either explicitly prevent all trust tokens on V2 or make sure trust tokens work for V2. Since we are headed toward the first alternative, I am going to give that a quick try. It means that the V2 trust tests will be replaced with a test that ensures they are always rejected | 16:12 |
| ayoung | I'm still worried that this is going to break people | 16:12 |
| raildo | lbragstad: great, let me know if there is anything I can help you | 16:14 |
| lbragstad | ayoung right | 16:14 |
| *** pnavarro has quit IRC | 16:15 | |
| lbragstad | ayoung i have a patch https://review.openstack.org/#/c/278802/ | 16:15 |
| patchbot | lbragstad: patch 278802 - keystone - Remove support for trust scoped tokens in v2.0 | 16:15 |
| ayoung | lbragstad, it seems to me that a V2.0 Fernet based trust token would not be hard. Why are we making such an effort to get rid of them? | 16:15 |
| ayoung | lbragstad, is the problem that we don't want to record the token version in the payload? | 16:16 |
| *** daemontool__ has quit IRC | 16:16 | |
| ayoung | but...we already do, no? Wouldn't it be the same payload as a v3 trust, but a different version number indicating it was originally a v2 token? | 16:16 |
| lbragstad | ayoung I did it both ways - I have a patch for both https://review.openstack.org/#/c/278693/ | 16:18 |
| patchbot | lbragstad: patch 278693 - keystone - Make fernet support trust auth against v2.0 | 16:18 |
| ayoung | lbragstad, ah...so that is the lower risk option. Any reason not to go with that? | 16:18 |
| lbragstad | ayoung depends on what the rest of the team wants to do, I think I'm fine with either | 16:19 |
| lbragstad | ayoung we just have to get either of those passing and merge | 16:19 |
| lbragstad | but I wanted to get both up so that we could see what it looked like | 16:19 |
| ayoung | lbragstad, ok. I'm going to state quite strongly that we should still support v2 trust tokens. Until v2 goes away, we don't know who we will break | 16:19 |
| lbragstad | I didn't mind the "remove trust support from v2.0" path because it was more explicit | 16:19 |
| ayoung | looking at that review... | 16:19 |
| ayoung | test_delete_trust_revokes_token is the same kind of failure we are seeing in the "default fernet" patch | 16:20 |
| ayoung | and the next one,...FernetAuthWithTrust.test_trust_get_token_fails_if_trustee_disabled | 16:20 |
| ayoung | ah | 16:20 |
| *** jsavak has quit IRC | 16:21 | |
| ayoung | that one is an exception wrapping | 16:21 |
| ayoung | lbragstad, when you see keystone.exception.Forbidden: You are not authorized to perform the requested action. | 16:21 |
| ayoung | that means that the wrong exception was thrown, I think | 16:21 |
| ayoung | or...maybe it means that the timer was not fixed? | 16:22 |
| ayoung | Let me look at that ...it smells like the other issues I was seeing last night. There is something wonkly with revoke-by-token in the tree/fernet case. And I suspect an error in the tree.. | 16:22 |
| ayoung | that tree needs to die | 16:22 |
| lbragstad | ayoung ++ | 16:22 |
| lbragstad | ayoung make it die | 16:22 |
| ayoung | lbragstad, is uuid using the stame path as fernet now? | 16:23 |
| ayoung | and..if it is not, do we care? | 16:23 |
| *** jsavak has joined #openstack-keystone | 16:23 | |
| bknudson | I like this comment -- https://github.com/openstack/keystone/blob/master/keystone/identity/controllers.py#L44 | 16:26 |
| lbragstad | ayoung I think we do because it might help us in killing uuid later? | 16:26 |
| bknudson | # NOTE(termie): i can't imagine that this really wants all the data about every single user in the system... | 16:26 |
| lbragstad | ayoung I have a patch up for that too | 16:26 |
| lbragstad | ayoung the last piece we have to complete is consolidating validate_v2_token() for the fernet and uuid paths | 16:27 |
| ayoung | lbragstad, OK....I think I had a version of the patch for killing all of the tree but the simplest cases...might be invasive | 16:27 |
| ayoung | cool | 16:27 |
| ayoung | One sec | 16:27 |
| lbragstad | ayoung and that is dependent on figuring out what we need to do with trusts | 16:27 |
| *** belmoreira has quit IRC | 16:27 | |
| *** jsavak has quit IRC | 16:28 | |
| *** mylu has quit IRC | 16:30 | |
| lbragstad | ayoung here is the *last* token provider consolidation patch - https://review.openstack.org/#/c/197706/ | 16:31 |
| patchbot | lbragstad: patch 197706 - keystone - Consolidate the fernet provider validate_v2_token() | 16:31 |
| lbragstad | ayoung and it's dependent on the decision we have to make with trusts | 16:31 |
| *** mylu has joined #openstack-keystone | 16:31 | |
| lbragstad | and v2.0 | 16:31 |
| ayoung | lbragstad, OK. I'll look in a bit. We have our work cut out for us. Might be tight, and we might be asking for an extension. | 16:31 |
| ayoung | need to think how to prioritize this to minimize what we need for Mitaka | 16:31 |
| *** jsavak has joined #openstack-keystone | 16:33 | |
| *** sdake_ is now known as sdake | 16:36 | |
| morgan | If the v2 fernet trust patch works and doesn't impact other things, just merge it instead. Less question on breaking people | 16:36 |
| morgan | Then charge forward on the other things. | 16:36 |
| ayoung | morgan, for password changes, do we still need to revoke trust tokens? On both trustor and trustee, or just trustee? | 16:38 |
| morgan | I think so, unfortunately. | 16:38 |
| morgan | But, not 100% sure | 16:39 |
| ayoung | morgan, but just trustee, right? | 16:39 |
| morgan | Wait... No we don't for trustor | 16:39 |
| ayoung | If I create a trust to you, and then you execute it, then I change my password, the trust is still good, so don't revoke trust tokens | 16:39 |
| bjornar | What could be causing: _list_services() missing 1 required positional argument: 'hints' | 16:39 |
| ayoung | there has been no violation | 16:39 |
| morgan | ayoung: right | 16:39 |
| bjornar | this is v3 when doing openstack service list | 16:39 |
| *** silos has joined #openstack-keystone | 16:39 | |
| morgan | If the trustee changes password, only trustee tokens are jnvalid | 16:39 |
| *** jsavak has quit IRC | 16:39 | |
| morgan | And same logic applies to trustor password change | 16:40 |
| *** jsavak has joined #openstack-keystone | 16:40 | |
| morgan | Only the user changing password's token is affected | 16:41 |
| *** gyee has joined #openstack-keystone | 16:41 | |
| *** ChanServ sets mode: +v gyee | 16:41 | |
| dstanek | samueldmq: what's up? | 16:42 |
| stevemar | gerrit is slooooowwww | 16:44 |
| *** EinstCrazy has quit IRC | 16:46 | |
| morgan | stevemar: a watched gerrit never loads :p | 16:47 |
| openstackgerrit | Merged openstack/keystone: Switch to configless bandit https://review.openstack.org/278136 | 16:48 |
| *** josecastroleon has quit IRC | 16:49 | |
| *** diazjf has joined #openstack-keystone | 16:51 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/284804 | 16:53 |
| *** mylu has quit IRC | 16:53 | |
| *** dims has joined #openstack-keystone | 16:54 | |
| *** mylu has joined #openstack-keystone | 16:54 | |
| *** browne has joined #openstack-keystone | 16:55 | |
| *** petertr7_away is now known as petertr7 | 17:01 | |
| *** richm has joined #openstack-keystone | 17:01 | |
| krotscheck | morgan: Hey, that oslo-config default override update that was mentioned on the list - do you happen to have a patch that uses that already put together? | 17:07 |
| morgan | Sortof | 17:07 |
| morgan | Mine does it the wrong way because oslo,.cache doesn't support it elegantly | 17:08 |
| krotscheck | I see. | 17:08 |
| morgan | But I can show you the basic mechanism | 17:08 |
| krotscheck | That'd be super helpful :) | 17:08 |
| morgan | https://review.openstack.org/#/c/277198/ | 17:08 |
| patchbot | morgan: patch 277198 - keystone - Default caching to on for request-local caching. | 17:08 |
| *** jistr has quit IRC | 17:08 | |
| krotscheck | morgan: ok, lemme dig through that and see if I can apply that to ironic. | 17:10 |
| openstackgerrit | Boris Bobrov proposed openstack/python-keystoneclient: Support `truncated` flag returned by identity service https://review.openstack.org/280162 | 17:12 |
| krotscheck | morgan: Actually, let me do this on keystone first. | 17:12 |
| *** mylu has quit IRC | 17:22 | |
| *** su_zhang has quit IRC | 17:26 | |
| *** su_zhang has joined #openstack-keystone | 17:26 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 17:27 |
| krotscheck | morgan: did you already update global requirements? | 17:30 |
| morgan | For? | 17:30 |
| krotscheck | morgan: The config generation thing | 17:30 |
| morgan | Uhm.. No | 17:30 |
| morgan | New config gen will do it, old config gen won't but you can still override the default | 17:30 |
| *** su_zhang has quit IRC | 17:30 | |
| morgan | Overriding the default is independent of the generator consuming the entry point | 17:31 |
| *** david-lyle has joined #openstack-keystone | 17:31 | |
| morgan | So didn't bother updating g-r | 17:31 |
| krotscheck | Gotcha. I need new configgen | 17:31 |
| morgan | Yah. Should just be an updated Oslo.config in your venv | 17:32 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 17:34 |
| *** sdake_ has joined #openstack-keystone | 17:34 | |
| krotscheck | Well, first I have to figure out which version it's in. | 17:36 |
| *** henrynash has joined #openstack-keystone | 17:36 | |
| *** ChanServ sets mode: +v henrynash | 17:36 | |
| *** sdake has quit IRC | 17:36 | |
| *** jasonsb has quit IRC | 17:41 | |
| *** arunkant_ has joined #openstack-keystone | 17:42 | |
| *** mylu has joined #openstack-keystone | 17:43 | |
| *** gordc has quit IRC | 17:44 | |
| *** sdake_ is now known as sdake | 17:46 | |
| *** petertr7 is now known as petertr7_away | 17:47 | |
| *** timcline_ has quit IRC | 17:47 | |
| *** browne has quit IRC | 17:54 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 18:00 |
| *** henrynash has quit IRC | 18:01 | |
| *** sdake_ has joined #openstack-keystone | 18:01 | |
| *** mylu has quit IRC | 18:02 | |
| *** bjornar__ has joined #openstack-keystone | 18:02 | |
| *** sdake has quit IRC | 18:03 | |
| *** spzala has quit IRC | 18:05 | |
| *** spzala has joined #openstack-keystone | 18:06 | |
| morgan | krotscheck: latest version | 18:09 |
| krotscheck | morgan: 3.7.0 | 18:10 |
| morgan | Was just released not too long ago ( week or so ) | 18:10 |
| krotscheck | morgan: Latest is 3.9 | 18:10 |
| krotscheck | There have been things. | 18:10 |
| krotscheck | *hand wavey* | 18:10 |
| morgan | Oh did we have bug fixes? | 18:10 |
| * morgan shrugs | 18:10 | |
| *** spzala has quit IRC | 18:11 | |
| krotscheck | morgan: https://review.openstack.org/#/c/284837/ | 18:11 |
| patchbot | krotscheck: patch 284837 - requirements - Updated oslo.config to 3.7.0 | 18:11 |
| *** gyee has quit IRC | 18:11 | |
| krotscheck | Hi there, patchbot! | 18:11 |
| morgan | Hehe | 18:11 |
| morgan | I like the patchbot | 18:11 |
| *** jsavak has quit IRC | 18:12 | |
| *** spandhe has joined #openstack-keystone | 18:15 | |
| *** su_zhang has joined #openstack-keystone | 18:15 | |
| *** Ephur has joined #openstack-keystone | 18:16 | |
| *** silos has quit IRC | 18:16 | |
| *** annasort has quit IRC | 18:19 | |
| *** rk4n has quit IRC | 18:20 | |
| *** Ephur has quit IRC | 18:20 | |
| *** spzala has joined #openstack-keystone | 18:25 | |
| *** gyee has joined #openstack-keystone | 18:33 | |
| *** roxanaghe has joined #openstack-keystone | 18:33 | |
| *** ChanServ sets mode: +v gyee | 18:33 | |
| *** jsavak has joined #openstack-keystone | 18:34 | |
| *** gyee has quit IRC | 18:37 | |
| *** rodrigods has quit IRC | 18:40 | |
| *** rodrigods has joined #openstack-keystone | 18:40 | |
| *** gordc has joined #openstack-keystone | 18:47 | |
| *** nllrte has joined #openstack-keystone | 18:48 | |
| *** lhcheng has joined #openstack-keystone | 18:48 | |
| *** ChanServ sets mode: +v lhcheng | 18:48 | |
| stevemar | morgan: oslo.log was released too, one less deprecation warning for everyone with my latest patch | 18:51 |
| dims | stevemar : yay thanks :) | 18:52 |
| stevemar | dolphm: have a minute to look at: https://bugs.launchpad.net/keystone/+bug/1549705 | 18:52 |
| openstack | Launchpad bug 1549705 in OpenStack Identity (keystone) "migrate DB failed due to password cannot be null" [Undecided,New] - Assigned to Dave Chen (wei-d-chen) | 18:52 |
| stevemar | dims: np :) | 18:52 |
| *** mvk has joined #openstack-keystone | 18:54 | |
| dstanek | htruta: you around? | 19:02 |
| htruta | dstanek: yep | 19:02 |
| dstanek | htruta: i'm trying to wrap my head around something in the 'Projects as Domain' review | 19:03 |
| dstanek | htruta: there is a new method `list_projects_acting_as_domain`, but why isn't `list_domains` doing that? | 19:03 |
| htruta | dstanek: I'd say that it returns project refs instead of domain refs | 19:04 |
| htruta | dstanek: but I'll take a look at the code to be sure | 19:05 |
| *** D4RKS1D3 has joined #openstack-keystone | 19:05 | |
| D4RKS1D3 | Hi, someone can helpme? How can I create tenants via API? Thanks | 19:05 |
| dstanek | htruta: i would have expected `list_domains` to pull from project and return entities that look like domains | 19:05 |
| *** josecastroleon has joined #openstack-keystone | 19:06 | |
| dstanek | D4RKS1D3: v2 or v3? | 19:06 |
| htruta | dstanek: that's what it does. It pulls from project and convert it to the domain ref structure | 19:06 |
| *** vilobhmm11 has joined #openstack-keystone | 19:06 | |
| *** jsavak has quit IRC | 19:06 | |
| htruta | dstanek: and the list_projects_acting_as_comain returns at the project ref struct | 19:06 |
| dstanek | htruta: where do you see that? i'm looking at line 235 here: https://review.openstack.org/#/c/231289/59/keystone/resource/backends/sql.py | 19:07 |
| patchbot | dstanek: patch 231289 - keystone - Projects acting as domains | 19:07 |
| *** silos has joined #openstack-keystone | 19:08 | |
| htruta | dstanek: sorry! my bad. we stopped using every domain call in this patch, and we're just using the project ones | 19:08 |
| htruta | dstanek: And in the next patch, we'll remove the domain methods from the backends, including the list_domains | 19:09 |
| *** silos has left #openstack-keystone | 19:09 | |
| dstanek | htruta: ok, so the patch i'm looking at is very limited | 19:11 |
| htruta | dstanek: why do you think so? | 19:11 |
| openstackgerrit | Merged openstack/keystone: No more legacy engine facade in tests https://review.openstack.org/284516 | 19:11 |
| dstanek | htruta: so i really don't think we can delete all those methods | 19:12 |
| dstanek | htruta: why are we not just reimplementing the driver to put the data into the project table? | 19:13 |
| *** jsavak has joined #openstack-keystone | 19:13 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove support for trust scoped tokens in v2.0 https://review.openstack.org/278802 | 19:13 |
| lbragstad | ayoung ^ | 19:13 |
| htruta | dstanek: that would be to much redundant. We already do this reimplementation in manager | 19:14 |
| dstanek | htruta: that's what i don't like. it's not backward compatible | 19:14 |
| htruta | dstanek: and we're only removing it from the V9 driver | 19:14 |
| D4RKS1D3 | dstanek, I will prefer V2 | 19:17 |
| *** jsavak has quit IRC | 19:18 | |
| dstanek | D4RKS1D3: have you see http://developer.openstack.org/api-ref-identity-admin-v2.html#admin-tenants ? | 19:18 |
| *** phalmos has joined #openstack-keystone | 19:18 | |
| D4RKS1D3 | but only I can list tenants | 19:19 |
| D4RKS1D3 | and show details | 19:19 |
| dstanek | D4RKS1D3: because of a policy? | 19:19 |
| D4RKS1D3 | http://docs.openstack.org/developer/python-keystoneclient/using-api-v2.html#creating-tenants | 19:20 |
| D4RKS1D3 | I need this, but not in python, via api | 19:20 |
| *** fangxu has quit IRC | 19:21 | |
| *** fawadkhaliq has joined #openstack-keystone | 19:22 | |
| *** phalmos has quit IRC | 19:23 | |
| dstanek | htruta: i'm struggling to figure out what happens when a domain is created. | 19:24 |
| dstanek | htruta: i don't see the wrapper in there anymore | 19:26 |
| htruta | dstanek: in manager? | 19:26 |
| dstanek | in keystone.resource.core | 19:26 |
| ayoung | lbragstad, I'm in the midst of doing unspeakable things to revocations...I think you will like. Net reduction of lines in the high numbers. | 19:27 |
| htruta | dstanek: a wrapper to the create_domain driver call, you mean? | 19:27 |
| ayoung | D4RKS1D3, I can help but V3 which is better anyway | 19:28 |
| lbragstad | ayoung nice | 19:28 |
| *** timcline has quit IRC | 19:28 | |
| D4RKS1D3 | ayoung, v3 has this option? | 19:29 |
| dstanek | htruta: ok, so if a user POSTs to /domains in the future that will make a project record with is_domain = true? | 19:29 |
| ayoung | D4RKS1D3, http://adam.younglogic.com/2013/09/keystone-v3-api-examples/ http://adam.younglogic.com/2013/11/more-keystone-v3-api-examples/ | 19:29 |
| htruta | dstanek: yes | 19:29 |
| htruta | dstanek: see L97 https://review.openstack.org/#/c/231289/59/keystone/tests/unit/test_v3_resource.py | 19:29 |
| patchbot | htruta: patch 231289 - keystone - Projects acting as domains | 19:29 |
| D4RKS1D3 | thanks ayoung | 19:29 |
| ayoung | D4RKS1D3, please say No to V2. | 19:30 |
| dstanek | htruta: ok, so /domain maps to controller.create_domain which calls manager.create_domain which calls driver._create_project? | 19:30 |
| D4RKS1D3 | hahahahahaha | 19:30 |
| D4RKS1D3 | No to V2 :P jajajaja | 19:30 |
| htruta | dstanek: exactly | 19:30 |
| ayoung | It is old and tired and just is waiting for acceptance to Valhalla | 19:30 |
| dstanek | htruta: that's not backward compatible | 19:30 |
| ayoung | The Valkyrie is on its way even as we speak | 19:30 |
| dstanek | htruta: existing drivers expect their create_domain method to be called to create a domain - that's why i think the work really belongs in the driver | 19:31 |
| morgan | ayoung, lbragstad: it would be easier to just support trust in v2 fernet and we wont break anyone that way | 19:31 |
| morgan | ayoung, lbragstad: and we could just merge it and move on | 19:31 |
| ayoung | morgan, yep | 19:31 |
| lbragstad | morgan working on rebasing that patch now | 19:32 |
| ayoung | morgan, he has a patch for that, too..link higher up | 19:32 |
| morgan | looks like the patch is an easy rebase. | 19:32 |
| lbragstad | ayoung ^ | 19:32 |
| ayoung | thanks | 19:32 |
| morgan | lbragstad: lets just squash the "remove trust from v2" and run with "add trust to v2 fernet" | 19:32 |
| morgan | as much as i would prefer the inverse | 19:32 |
| dstanek | htruta: this doesn't break the interface from a pure method standpoint, but it breaks the semantics on how the drivers work | 19:34 |
| ayoung | getting rid of all these revocation events is very therapeutic. | 19:34 |
| *** petertr7_away is now known as petertr7 | 19:35 | |
| *** su_zhang has quit IRC | 19:35 | |
| *** jsavak has joined #openstack-keystone | 19:35 | |
| *** josecastroleon has quit IRC | 19:35 | |
| *** su_zhang has joined #openstack-keystone | 19:36 | |
| htruta | dstanek: but if we'll get rid of the domain table, shouldn't the driver go away too? | 19:36 |
| morgan | htruta: still has projects in the resource backend. | 19:36 |
| morgan | htruta: and the .get_domain method will still do the same thing | 19:36 |
| htruta | morgan: the domain driver, I mean | 19:36 |
| morgan | htruta: as it did before. the "domain table going away" is an implementation detail in the driver | 19:36 |
| dstanek | htruta: my customer resource driver is now broken | 19:36 |
| morgan | does not affect the manager interfaces | 19:37 |
| dstanek | htruta: the domain table should be in our sql driver and not anywhere else | 19:37 |
| dstanek | htruta: you're not getting rid of the concept of domains, you are just changing how they are stored in our database | 19:37 |
| htruta | dstanek, morgan: so, the domain driver should work as a wrapper, in the same way as the manager is wrapping domains to projects? | 19:38 |
| morgan | htruta: no the driver is the same | 19:38 |
| morgan | htruta: ok [manager] -. | 19:38 |
| morgan | [manage].get_domain -> [driver].get_domain | 19:38 |
| morgan | driver .get_domain does the lookup in wherever the domain is stored | 19:38 |
| morgan | manager.get_domain wont change even if the DB schema does | 19:39 |
| morgan | because the manager doesn't care how the driver stores it | 19:39 |
| morgan | anyone who wants to get a domain will still use .get_domain | 19:39 |
| morgan | not .get_project | 19:39 |
| morgan | it's not a wrapper, it's an unchanged interface | 19:39 |
| morgan | if the driver changes where things are stored, the manager doesn't care, it's still asking for the return of .get_domain | 19:40 |
| *** su_zhang has quit IRC | 19:40 | |
| htruta | morgan: I see | 19:40 |
| morgan | domains could be stored in a text file on disk, as long as the value returned from .get_domain is what is expected. | 19:40 |
| morgan | so we've just changed some implementation details in the driver itself, but the public interfaces remain unchanged. | 19:40 |
| htruta | morgan, dstanek: I get it. I'll put this in my todo list here. Please leave a comment in the patch | 19:41 |
| *** timcline has joined #openstack-keystone | 19:41 | |
| dstanek | htruta: i'll put a note on the projects as domains patch | 19:42 |
| *** su_zhang has joined #openstack-keystone | 19:42 | |
| morgan | lbragstad: +2 on https://review.openstack.org/#/c/278693/1 when it's rebased. | 19:42 |
| patchbot | morgan: patch 278693 - keystone - Make fernet support trust auth against v2.0 | 19:42 |
| lbragstad | morgan cool - working on the last test failure now | 19:43 |
| morgan | lbragstad: and i -2'd the remove v2 trust fyi | 19:44 |
| lbragstad | morgan cool | 19:44 |
| *** nllrte has quit IRC | 19:46 | |
| *** krotscheck is now known as krotscheck_dcm | 19:50 | |
| *** ayoung has quit IRC | 19:51 | |
| *** fangxu has joined #openstack-keystone | 20:01 | |
| *** rk4n has joined #openstack-keystone | 20:01 | |
| *** fangxu has quit IRC | 20:03 | |
| *** petertr7 is now known as petertr7_away | 20:04 | |
| *** fangxu has joined #openstack-keystone | 20:05 | |
| *** su_zhang has quit IRC | 20:12 | |
| *** su_zhang has joined #openstack-keystone | 20:13 | |
| *** fawadkhaliq has quit IRC | 20:13 | |
| *** fawadkhaliq has joined #openstack-keystone | 20:13 | |
| *** su_zhang has quit IRC | 20:15 | |
| *** su_zhang has joined #openstack-keystone | 20:15 | |
| *** annasort has joined #openstack-keystone | 20:15 | |
| lbragstad | morgan I think i figured out the issue with the fernet + v2.0 support patch | 20:19 |
| morgan | cool | 20:19 |
| lbragstad | morgan let me push what I have | 20:19 |
| morgan | sounds good | 20:19 |
| lbragstad | I need some extra eyes | 20:19 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 20:21 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet support trust auth against v2.0 https://review.openstack.org/278693 | 20:24 |
| lbragstad | morgan ^ | 20:24 |
| lbragstad | morgan see my comment https://review.openstack.org/#/c/278693/2/keystone/tests/unit/test_auth.py,unified on line 1300 | 20:25 |
| patchbot | lbragstad: patch 278693 - keystone - Make fernet support trust auth against v2.0 | 20:25 |
| morgan | looks about right actually | 20:25 |
| morgan | revoke the token cache? nah | 20:26 |
| lbragstad | morgan so - do we have a way to reach in and invalidate the v2 token cache from the trust_api's delete_trust() method? | 20:26 |
| morgan | just insert a revocation event. isn't rev event handled outside o fhte cache? | 20:26 |
| lbragstad | morgan yes - it should be | 20:27 |
| morgan | iirc we don't cache below revocation events, so we don't need to pop the cache we need to either issue an appropriate event | 20:27 |
| morgan | or | 20:27 |
| morgan | let it ride. | 20:27 |
| morgan | new tokens can't be issued | 20:27 |
| morgan | current trust tokens remain outstanding | 20:27 |
| * morgan is ok in either | 20:28 | |
| morgan | case | 20:28 |
| morgan | short of invalidating all tokens for <trustee> | 20:28 |
| morgan | so, eh | 20:28 |
| morgan | i'd go with either. | 20:28 |
| *** su_zhang has quit IRC | 20:30 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: V2 operations create default domain on demand https://review.openstack.org/284778 | 20:30 |
| *** su_zhang has joined #openstack-keystone | 20:30 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet support trust auth against v2.0 https://review.openstack.org/278693 | 20:33 |
| lbragstad | morgan ok - that gets the test passing | 20:33 |
| *** su_zhang has quit IRC | 20:35 | |
| *** petertr7_away is now known as petertr7 | 20:35 | |
| *** fpatwa_ has joined #openstack-keystone | 20:38 | |
| *** phalmos has joined #openstack-keystone | 20:44 | |
| *** phalmos has quit IRC | 20:45 | |
| *** phalmos has joined #openstack-keystone | 20:46 | |
| *** Ephur has joined #openstack-keystone | 20:47 | |
| *** porunov has joined #openstack-keystone | 20:48 | |
| *** browne has joined #openstack-keystone | 20:49 | |
| *** rk4n has quit IRC | 20:50 | |
| *** fpatwa_ has quit IRC | 20:51 | |
| *** mylu has joined #openstack-keystone | 20:57 | |
| *** fpatwa_ has joined #openstack-keystone | 20:57 | |
| *** fpatwa_ has quit IRC | 20:58 | |
| *** gyee has joined #openstack-keystone | 21:00 | |
| *** ChanServ sets mode: +v gyee | 21:00 | |
| *** raildo is now known as raildo-afk | 21:04 | |
| *** daemontool has joined #openstack-keystone | 21:05 | |
| *** pauloewerton has quit IRC | 21:09 | |
| *** fawadkhaliq has quit IRC | 21:20 | |
| *** su_zhang has joined #openstack-keystone | 21:23 | |
| *** annasort has quit IRC | 21:25 | |
| *** browne has quit IRC | 21:27 | |
| *** silos has joined #openstack-keystone | 21:27 | |
| *** phalmos has quit IRC | 21:27 | |
| *** su_zhang has quit IRC | 21:28 | |
| *** annasort has joined #openstack-keystone | 21:28 | |
| *** phalmos has joined #openstack-keystone | 21:30 | |
| *** rk4n has joined #openstack-keystone | 21:32 | |
| *** sdake_ is now known as sdake | 21:35 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move resource manager tests out of test_backend https://review.openstack.org/283822 | 21:37 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Allow concrete role assignments for federated users https://review.openstack.org/284943 | 21:41 |
| *** annasort has quit IRC | 21:44 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Allow concrete role assignments for federated users https://review.openstack.org/284943 | 21:45 |
| bknudson | the eventlet gate is pretty unhappy now. the uwsgi one is working. | 21:45 |
| bknudson | sql transaction errors... I wonder if it has to do with the recent oslo.db changes? | 21:46 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Concrete role assignments for federated users https://review.openstack.org/284943 | 21:46 |
| bknudson | maybe we're not monkeypatching correctly | 21:46 |
| *** daemontool has quit IRC | 21:48 | |
| *** annasort has joined #openstack-keystone | 21:50 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone-specs: Credential Encryption https://review.openstack.org/284950 | 21:55 |
| *** spzala has quit IRC | 21:59 | |
| *** porunov has quit IRC | 22:01 | |
| *** browne has joined #openstack-keystone | 22:01 | |
| *** phalmos has quit IRC | 22:02 | |
| *** mylu has quit IRC | 22:10 | |
| *** jorge_munoz has quit IRC | 22:12 | |
| *** knikolla has quit IRC | 22:13 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet support trust auth against v2.0 https://review.openstack.org/278693 | 22:15 |
| lbragstad | morgan done ^ | 22:15 |
| *** mylu has joined #openstack-keystone | 22:17 | |
| *** daemontool has joined #openstack-keystone | 22:17 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:19 | |
| *** petertr7 is now known as petertr7_away | 22:22 | |
| *** su_zhang has joined #openstack-keystone | 22:23 | |
| lbragstad | raildo-afk let a few comments on https://review.openstack.org/#/c/277436/4 - do you want me to address them? | 22:24 |
| patchbot | lbragstad: patch 277436 - keystone - Return 404 instead of 401 for tokens w/o roles | 22:24 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Delay using threading.local() https://review.openstack.org/284965 | 22:28 |
| *** silos has left #openstack-keystone | 22:28 | |
| *** jsavak has quit IRC | 22:32 | |
| *** mylu has quit IRC | 22:35 | |
| *** jsavak has joined #openstack-keystone | 22:37 | |
| *** mylu has joined #openstack-keystone | 22:42 | |
| *** annasort has quit IRC | 22:43 | |
| *** mylu has quit IRC | 22:44 | |
| *** mylu has joined #openstack-keystone | 22:44 | |
| *** jsavak has quit IRC | 22:46 | |
| morgan | lbragstad: commented | 22:47 |
| morgan | dims, stevemar ^ commented on that patch | 22:48 |
| morgan | dims, stevemar: I really would rather push on removing eventlet since uwsgi is passing [and make uwsgi voting] than carry more "eventlet-specific" code. | 22:50 |
| *** fpatwa_ has joined #openstack-keystone | 22:59 | |
| *** vilobhmm11 has quit IRC | 23:01 | |
| *** jsavak has joined #openstack-keystone | 23:02 | |
| *** vilobhmm11 has joined #openstack-keystone | 23:02 | |
| *** vilobhmm11 has quit IRC | 23:03 | |
| *** fpatwa_ has quit IRC | 23:03 | |
| *** ayoung has joined #openstack-keystone | 23:03 | |
| *** ChanServ sets mode: +v ayoung | 23:03 | |
| *** vilobhmm11 has joined #openstack-keystone | 23:05 | |
| *** diazjf has quit IRC | 23:08 | |
| *** csoukup has quit IRC | 23:09 | |
| *** edmondsw has quit IRC | 23:11 | |
| *** xek_ has joined #openstack-keystone | 23:18 | |
| *** xek has quit IRC | 23:19 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:23 | |
| *** jsavak has quit IRC | 23:24 | |
| *** bjornar__ has quit IRC | 23:26 | |
| *** gordc has quit IRC | 23:29 | |
| stevemar | morgan: ugh | 23:29 |
| *** timcline has quit IRC | 23:30 | |
| jamielennox | morgan: so i think that keystone-manage bootstrap should be able to create a identity catalog entry | 23:30 |
| morgan | jamielennox: i agree | 23:30 |
| morgan | jamielennox: would be easy to add | 23:31 |
| jamielennox | morgan: i bootstrapped and changed all my other calls to use user/pass and they fail because they don't have a catalog entry point | 23:31 |
| jamielennox | i think you can fix this ansible>=2, but not <2 | 23:31 |
| morgan | jamielennox: you still need a token to start. | 23:31 |
| morgan | so you do username/pass -> token, token -> endpoint create like the amdin token | 23:31 |
| morgan | so.. add an argument to create the endpoint entries for keystone :) | 23:32 |
| jamielennox | right, but all calls for keystone like that still go via catalog | 23:32 |
| morgan | i'm sure devstack and other folks will appreciate it | 23:32 |
| morgan | openstack token issue works w/o a catalog | 23:32 |
| morgan | and you can use openstack with the endpoint override | 23:32 |
| jamielennox | morgan: ergh, thats kinda hard to work into ansible, not impossible but a pain | 23:32 |
| morgan | just like you do today with an admin token | 23:32 |
| jamielennox | ok, i can have a look at that | 23:33 |
| morgan | so seriously, add the argument to bootstrap identity and the endpoint for identity :) | 23:33 |
| morgan | i'll +2 | 23:33 |
| morgan | it totally should do that | 23:33 |
| morgan | then you should make devstack do that as well. much cleaner | 23:33 |
| * jamielennox misses when you could give ideas to morgan and he'd have them done before you could come up with a plan :p | 23:34 | |
| morgan | jamielennox: hey i already did a bunch of that! :P | 23:35 |
| morgan | i can't write all the code in keystone :P | 23:35 |
| jamielennox | morgan: server side *shudder* | 23:35 |
| morgan | bah, bootstrap is easy | 23:35 |
| morgan | compared ot most server things | 23:35 |
| jamielennox | morgan: i'm on it | 23:35 |
| jamielennox | well sometime today | 23:35 |
| morgan | it's mor elike writing ksc | 23:35 |
| morgan | but seriously, since bootstrap hasn't landed in a release it would be good to expand it now. and fix devstack to do it right too :) | 23:36 |
| jamielennox | yep | 23:38 |
| *** RichardRaseley has joined #openstack-keystone | 23:39 | |
| *** timcline has joined #openstack-keystone | 23:43 | |
| *** fawadkhaliq has quit IRC | 23:47 | |
| stevemar | jamielennox: create just the identity service, we can't create the endpoints | 23:53 |
| jamielennox | stevemar: why | 23:53 |
| stevemar | don't know what the urls will be? | 23:53 |
| jamielennox | stevemar: take them from input | 23:53 |
| jamielennox | i was going to do it optionally | 23:53 |
| jamielennox | so if opts.public_url: etc | 23:54 |
| stevemar | jamielennox: bootstrap --admin-url, --public-url, --internal-url,... | 23:54 |
| morgan | stevemar: ugh | 23:54 |
| stevemar | hmm | 23:54 |
| jamielennox | yup | 23:54 |
| morgan | :( | 23:54 |
| stevemar | that'll get long | 23:54 |
| morgan | but yeah | 23:54 |
| *** shoutm has joined #openstack-keystone | 23:54 | |
| jamielennox | morgan: what's the other choice? | 23:54 |
| morgan | jamielennox: there isn't one | 23:54 |
| jamielennox | stevemar: in my thing i'm doing it via env, but yea | 23:54 |
| morgan | just make sure they are optional and have ENV vars that can be used instead too | 23:54 |
| stevemar | zomg check queue is over 300 | 23:55 |
| morgan | stevemar: MILESTONE 3! | 23:55 |
| morgan | GO | 23:56 |
| stevemar | get everything in NOW!!! | 23:56 |
| morgan | stevemar: OMG LAST MINUTE! | 23:56 |
| morgan | stevemar: so.. can we make uwsgi voting and just drop eventlet? | 23:56 |
| morgan | stevemar: cause.... | 23:56 |
| morgan | otherwise we really do need to accept dims patch and carry more eventlet code | 23:57 |
| *** su_zhang has quit IRC | 23:57 | |
| stevemar | morgan: i don't feel comfortable doing that | 23:57 |
| stevemar | we can certainly make uwsgi voting | 23:57 |
| morgan | we should drop the eventlet job :P | 23:57 |
| morgan | in either case | 23:57 |
| *** su_zhang has joined #openstack-keystone | 23:57 | |
| morgan | >.> | 23:57 |
| stevemar | meh, doesn't buy us much, except a shorter job time | 23:57 |
| morgan | but if we aren't dropping eventlet support, we need dims patch | 23:57 |
| morgan | =/ | 23:57 |
| stevemar | yes | 23:57 |
| stevemar | morgan: i promise that by the summit, in the master branch we'll have N removed :) | 23:58 |
| stevemar | errr eventlet removed!! | 23:58 |
| morgan | rm -rf /keystone | 23:58 |
| morgan | perfect | 23:58 |
| stevemar | watching the news and RC = brain fart | 23:58 |
| stevemar | IRC* | 23:58 |
| stevemar | zomg | 23:58 |
| *** shoutm_ has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!