| *** roxanaghe has joined #openstack-keystone | 00:22 | |
| *** roxanaghe has quit IRC | 00:27 | |
| *** markvoelker has joined #openstack-keystone | 00:53 | |
| *** davechen has joined #openstack-keystone | 01:23 | |
| *** roxanaghe has joined #openstack-keystone | 01:38 | |
| *** roxanaghe has quit IRC | 01:43 | |
| *** wangqun has joined #openstack-keystone | 01:43 | |
| *** raddaoui has quit IRC | 01:43 | |
| *** raddaoui has joined #openstack-keystone | 01:44 | |
| *** marekd2 has joined #openstack-keystone | 01:47 | |
| *** marekd2 has quit IRC | 01:52 | |
| *** code-R has joined #openstack-keystone | 02:00 | |
| *** EinstCrazy has joined #openstack-keystone | 02:01 | |
| *** code-R_ has joined #openstack-keystone | 02:03 | |
| *** wangqun has quit IRC | 02:03 | |
| *** wangqun_ has joined #openstack-keystone | 02:03 | |
| *** code-R has quit IRC | 02:06 | |
| openstackgerrit | Ha Van Tu proposed openstack/keystone: Correct link type https://review.openstack.org/365816 | 02:10 |
|---|---|---|
| *** code-R_ has quit IRC | 02:17 | |
| *** agireud has quit IRC | 02:18 | |
| *** agireud has joined #openstack-keystone | 02:25 | |
| openstackgerrit | Nguyen Phuong An proposed openstack/keystone: [api-ref] Correcting parameter's type https://review.openstack.org/365549 | 02:26 |
| *** agireud has quit IRC | 02:30 | |
| *** annp has joined #openstack-keystone | 02:35 | |
| *** agireud has joined #openstack-keystone | 02:40 | |
| *** markvoelker has quit IRC | 02:53 | |
| *** chrisshattuck has joined #openstack-keystone | 03:07 | |
| *** roxanaghe has joined #openstack-keystone | 03:09 | |
| *** roxanaghe has quit IRC | 03:13 | |
| *** zhugaoxiao has quit IRC | 03:14 | |
| *** zhugaoxiao has joined #openstack-keystone | 03:14 | |
| hugokuo | anyone knows what situation will Keystone response " HTTP Error: 429: 429 Too Many Requests" like this ? | 03:17 |
| hugokuo | any auth request rate limit could be configured in the keystone server ? | 03:18 |
| dstanek | hugokuo: i don't think keystone itself ever returns a 429 | 03:18 |
| stevemar | dstanek: hugokuo doesn't look like it: https://github.com/openstack/keystone/blob/master/keystone/exception.py | 03:19 |
| hugokuo | k. Perpas the front end http server does it | 03:19 |
| stevemar | hugokuo: likely | 03:19 |
| dstanek | hugokuo: you may be able to tell via the server header | 03:19 |
| dstanek | howdy stevemar! | 03:19 |
| stevemar | dstanek: o/ | 03:19 |
| hugokuo | thx. I'll try to get the response headers for checking. Appreciate | 03:20 |
| stevemar | np | 03:20 |
| stevemar | dstanek: whats up on your end? | 03:21 |
| stevemar | dstanek: you've been online all day, on and off | 03:21 |
| dstanek | stevemar: :-) i took off Friday and Tuesday as vacation days and today is a US holiday. i'm just hanging around | 03:22 |
| stevemar | dstanek: this thursday and friday? | 03:22 |
| stevemar | dstanek: we have the same holiday :P | 03:22 |
| dstanek | no, this past friday and tomorrow | 03:23 |
| stevemar | ah | 03:24 |
| stevemar | i can't read | 03:24 |
| dstanek | you may just be ready for your vacation already :-) | 03:25 |
| stevemar | dstanek: so ready for it | 03:25 |
| dstanek | got plans? | 03:26 |
| stevemar | dstanek: survive | 03:26 |
| stevemar | dstanek: my usual vacation plans don't really gel with a 3.5 month old :) | 03:26 |
| dstanek | lol, been there | 03:27 |
| *** chrisshattuck has quit IRC | 03:48 | |
| *** sdake has joined #openstack-keystone | 04:05 | |
| *** marekd2 has joined #openstack-keystone | 04:07 | |
| *** marekd2 has quit IRC | 04:12 | |
| openstackgerrit | Nguyen Phuong An proposed openstack/keystone: [api-ref] Correcting parameter's type https://review.openstack.org/365549 | 04:19 |
| *** roxanaghe has joined #openstack-keystone | 04:25 | |
| *** sdake has quit IRC | 04:25 | |
| *** roxanaghe has quit IRC | 04:30 | |
| *** links has joined #openstack-keystone | 04:39 | |
| *** sdake has joined #openstack-keystone | 04:50 | |
| *** dikonoor has joined #openstack-keystone | 04:55 | |
| *** su_zhang has joined #openstack-keystone | 04:57 | |
| *** adriant has quit IRC | 04:59 | |
| *** sdake has quit IRC | 05:01 | |
| *** dikonoor has quit IRC | 05:06 | |
| *** sdake has joined #openstack-keystone | 05:10 | |
| *** itisha has quit IRC | 05:11 | |
| *** wangqun_ has quit IRC | 05:11 | |
| *** wangqun_ has joined #openstack-keystone | 05:11 | |
| *** sdake has quit IRC | 05:17 | |
| *** su_zhang has quit IRC | 05:21 | |
| *** jaosorior has joined #openstack-keystone | 05:21 | |
| *** su_zhang has joined #openstack-keystone | 05:22 | |
| *** su_zhang has quit IRC | 05:26 | |
| *** zzzeek has quit IRC | 05:30 | |
| *** EinstCrazy has quit IRC | 05:40 | |
| *** hoonetorg has quit IRC | 05:48 | |
| *** EinstCrazy has joined #openstack-keystone | 05:52 | |
| *** hoonetorg has joined #openstack-keystone | 06:12 | |
| *** roxanaghe has joined #openstack-keystone | 06:13 | |
| *** roxanaghe has quit IRC | 06:18 | |
| *** EinstCrazy has quit IRC | 06:21 | |
| *** EinstCrazy has joined #openstack-keystone | 06:23 | |
| openstackgerrit | Cao ShuFeng proposed openstack/python-keystoneclient: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 06:41 |
| openstackgerrit | Cao ShuFeng proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 06:41 |
| *** pcaruana has joined #openstack-keystone | 06:48 | |
| *** markvoelker has joined #openstack-keystone | 06:54 | |
| *** markvoelker has quit IRC | 06:59 | |
| *** namnh has joined #openstack-keystone | 06:59 | |
| *** tesseract- has joined #openstack-keystone | 07:00 | |
| *** EinstCra_ has joined #openstack-keystone | 07:00 | |
| *** EinstCrazy has quit IRC | 07:00 | |
| *** wangqun has joined #openstack-keystone | 07:05 | |
| *** wangqun_ has quit IRC | 07:06 | |
| *** jpena|off is now known as jpena | 07:08 | |
| *** EinstCra_ has quit IRC | 07:09 | |
| *** rvba has joined #openstack-keystone | 07:14 | |
| *** rvba has quit IRC | 07:14 | |
| *** rvba has joined #openstack-keystone | 07:14 | |
| *** EinstCrazy has joined #openstack-keystone | 07:17 | |
| *** jdennis1 has joined #openstack-keystone | 07:24 | |
| *** chrichip has quit IRC | 07:25 | |
| *** jdennis has quit IRC | 07:25 | |
| *** joerch has joined #openstack-keystone | 07:32 | |
| *** daemontool has joined #openstack-keystone | 07:54 | |
| *** roxanaghe has joined #openstack-keystone | 08:01 | |
| *** roxanaghe has quit IRC | 08:05 | |
| *** jistr is now known as jistr|dentist | 08:07 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** asettle has joined #openstack-keystone | 08:11 | |
| *** EinstCrazy has quit IRC | 08:11 | |
| openstackgerrit | Cao ShuFeng proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 08:12 |
| *** tsufiev_ is now known as tsufiev | 08:13 | |
| *** markvoelker has joined #openstack-keystone | 08:19 | |
| *** code-R has joined #openstack-keystone | 08:20 | |
| *** mvk has quit IRC | 08:22 | |
| *** code-R_ has joined #openstack-keystone | 08:22 | |
| *** markvoelker has quit IRC | 08:24 | |
| *** code-R has quit IRC | 08:25 | |
| *** EinstCrazy has joined #openstack-keystone | 08:27 | |
| *** EinstCrazy has quit IRC | 08:28 | |
| *** EinstCrazy has joined #openstack-keystone | 08:28 | |
| *** pnavarro has joined #openstack-keystone | 08:40 | |
| *** evrardjp has quit IRC | 08:42 | |
| *** evrardjp has joined #openstack-keystone | 08:42 | |
| openstackgerrit | Nguyen Phuong An proposed openstack/keystone: [api-ref] Remove parameters unused in keystone v2 https://review.openstack.org/365947 | 08:44 |
| *** mvk has joined #openstack-keystone | 08:51 | |
| *** EinstCrazy has quit IRC | 08:59 | |
| *** EinstCrazy has joined #openstack-keystone | 09:01 | |
| *** jistr|dentist is now known as jistr | 09:23 | |
| *** daemontool has quit IRC | 09:29 | |
| openstackgerrit | Nguyen Phuong An proposed openstack/keystone: [api-ref] Remove parameters unused in keystone v3 https://review.openstack.org/366006 | 09:29 |
| *** mvk has quit IRC | 09:38 | |
| *** sdake has joined #openstack-keystone | 09:45 | |
| *** roxanaghe has joined #openstack-keystone | 09:49 | |
| *** roxanaghe has quit IRC | 09:54 | |
| *** namnh has quit IRC | 09:54 | |
| *** annp has quit IRC | 09:57 | |
| *** mvk has joined #openstack-keystone | 09:58 | |
| *** amrith has joined #openstack-keystone | 10:03 | |
| amrith | yowza! anybody home? stevemar topol ayoung g'morning | 10:04 |
| *** asettle has quit IRC | 10:26 | |
| *** ntpttr has quit IRC | 10:30 | |
| *** ntpttr has joined #openstack-keystone | 10:31 | |
| *** sdake has quit IRC | 10:33 | |
| *** wangqun has quit IRC | 10:38 | |
| *** code-R_ has quit IRC | 10:39 | |
| *** davechen has left #openstack-keystone | 10:42 | |
| *** HenryG_ is now known as HenryG | 10:46 | |
| *** zzzeek has joined #openstack-keystone | 10:51 | |
| *** EinstCrazy has quit IRC | 10:54 | |
| samueldmq | morning keystone | 10:56 |
| *** zzzeek has quit IRC | 10:56 | |
| *** zzzeek has joined #openstack-keystone | 10:57 | |
| *** marekd2 has joined #openstack-keystone | 11:16 | |
| *** amrith has left #openstack-keystone | 11:17 | |
| *** amakarov_away is now known as amakarov | 11:34 | |
| amakarov | rderose_, hi! Do you plan to backport PCI-DSS patches? | 11:35 |
| *** asettle has joined #openstack-keystone | 11:37 | |
| *** roxanaghe has joined #openstack-keystone | 11:37 | |
| rodrigods | amakarov, afaik we don't backport features | 11:39 |
| amakarov | rodrigods, point taken, thank you | 11:39 |
| *** roxanaghe has quit IRC | 11:42 | |
| *** jpena is now known as jpena|lunch | 11:48 | |
| *** asettle has quit IRC | 11:52 | |
| *** code-R has joined #openstack-keystone | 11:54 | |
| *** asettle has joined #openstack-keystone | 11:58 | |
| *** code-R_ has joined #openstack-keystone | 11:58 | |
| *** code-R has quit IRC | 12:01 | |
| *** daemontool has joined #openstack-keystone | 12:04 | |
| *** daemontool_ has joined #openstack-keystone | 12:10 | |
| *** daemontool has quit IRC | 12:12 | |
| *** edmondsw has joined #openstack-keystone | 12:13 | |
| *** __zouyee has joined #openstack-keystone | 12:17 | |
| *** __zouyee has quit IRC | 12:17 | |
| *** woodster_ has joined #openstack-keystone | 12:26 | |
| *** clenimar has quit IRC | 12:26 | |
| *** clenimar has joined #openstack-keystone | 12:31 | |
| *** jdennis1 has quit IRC | 12:37 | |
| *** EinstCrazy has joined #openstack-keystone | 12:43 | |
| *** jpena|lunch is now known as jpena | 12:48 | |
| *** jaosorior has quit IRC | 12:48 | |
| *** jaosorior has joined #openstack-keystone | 12:49 | |
| *** jaosorior has quit IRC | 12:49 | |
| *** pcaruana has quit IRC | 12:50 | |
| *** jaosorior has joined #openstack-keystone | 12:51 | |
| *** Marcellin__ has joined #openstack-keystone | 12:59 | |
| *** javis has quit IRC | 13:02 | |
| rderose_ | amakarov: hi | 13:05 |
| rderose_ | amakarov: yeah, wasn't planning to backport | 13:05 |
| amakarov | rderose_, thank you for update - I'm doing some paperwork right now and since I've worked on the matter I need to understand the status ) | 13:07 |
| rderose_ | amakarov: got it | 13:12 |
| *** Guest36215 has quit IRC | 13:15 | |
| *** jpena is now known as jpena|off | 13:19 | |
| *** roxanaghe has joined #openstack-keystone | 13:25 | |
| *** ddieterly has joined #openstack-keystone | 13:27 | |
| *** roxanaghe has quit IRC | 13:30 | |
| *** jpena|off is now known as jpena | 13:36 | |
| *** markvoelker has joined #openstack-keystone | 13:36 | |
| *** woodburn has joined #openstack-keystone | 13:37 | |
| *** browne has joined #openstack-keystone | 13:57 | |
| *** javis has joined #openstack-keystone | 13:58 | |
| *** ashyoung has joined #openstack-keystone | 14:02 | |
| *** ametts has joined #openstack-keystone | 14:06 | |
| *** ravelar has joined #openstack-keystone | 14:15 | |
| stevemar | o/ | 14:17 |
| stevemar | amakarov: howdy | 14:17 |
| amakarov | stevemar, hi! | 14:17 |
| stevemar | amakarov: howdy | 14:17 |
| *** michauds has joined #openstack-keystone | 14:17 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 14:20 |
| *** links has quit IRC | 14:21 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Revert spec change for Microversions https://review.openstack.org/366163 | 14:23 |
| *** ametts has quit IRC | 14:24 | |
| *** BjoernT has joined #openstack-keystone | 14:25 | |
| *** zigo has quit IRC | 14:25 | |
| *** roxanaghe has joined #openstack-keystone | 14:26 | |
| *** ametts has joined #openstack-keystone | 14:29 | |
| breton | stevemar: what is attic in keystone-specs for? | 14:31 |
| *** roxanaghe has quit IRC | 14:31 | |
| henrynash | breton: it is where old specs go to die | 14:31 |
| breton | got it, thanks | 14:31 |
| stevemar | breton: when we were moving the APIs from specs.o.org to the new place | 14:32 |
| *** zigo has joined #openstack-keystone | 14:32 | |
| stevemar | breton: i wanted to move them to a spot for people to stop updating, rather than delete, just move for now, we can delete later (or never) | 14:32 |
| *** zigo is now known as Guest39147 | 14:33 | |
| *** gagehugo_ has joined #openstack-keystone | 14:33 | |
| *** gagehugo has quit IRC | 14:33 | |
| *** gagehugo_ has quit IRC | 14:33 | |
| *** gagehugo has joined #openstack-keystone | 14:33 | |
| *** jaugustine_ is now known as jaugustine | 14:37 | |
| *** Guest39147 has quit IRC | 14:39 | |
| *** zigo_ has joined #openstack-keystone | 14:42 | |
| *** sdake has joined #openstack-keystone | 14:44 | |
| *** joerch has quit IRC | 14:45 | |
| *** richm has joined #openstack-keystone | 14:46 | |
| *** daemontool_ has quit IRC | 14:47 | |
| *** zigo_ has quit IRC | 14:47 | |
| *** daemontool has joined #openstack-keystone | 14:48 | |
| *** zigo_ has joined #openstack-keystone | 14:48 | |
| lbragstad | stevemar do you know the original reason for use making all federated users a part of the Federated domain? | 14:50 |
| lbragstad | us* | 14:50 |
| stevemar | lbragstad: they needed a domain in their token, but they didn't live anywhere | 14:50 |
| *** gagehugo has quit IRC | 14:51 | |
| stevemar | if they didn't have one, they would be living in nowheresville | 14:51 |
| stevemar | lbragstad: but as ayoung says, we should have made idps domains a long time ago | 14:52 |
| dolphm | stevemar: ++ | 14:52 |
| lbragstad | stevemar ah - so it was simply a way to get a domain in their token since all we really cared about was what group they mapped into... | 14:52 |
| ayoung | and a way to not put them in the default domain | 14:52 |
| stevemar | lbragstad: righto | 14:52 |
| lbragstad | ah - ha | 14:52 |
| dolphm | i think our original thought was that it would be a 1:1 relationship -- a domain *may* be federated, in which case it would have an IdP | 14:52 |
| lbragstad | stevemar and I suppose there is no was to work around that now? | 14:52 |
| stevemar | lbragstad: not really | 14:53 |
| dolphm | lbragstad: i think we should introduce a domain_id attribute to idps | 14:53 |
| *** scarlisle has joined #openstack-keystone | 14:53 | |
| stevemar | lbragstad: that's why i'm really pumped for that mapping spec we approved, where you can specify a domain in the mapping | 14:53 |
| lbragstad | or at least until the smarter mapping tool comes along | 14:53 |
| lbragstad | scarlisle o/ | 14:53 |
| scarlisle | o/ | 14:53 |
| *** gagehugo has joined #openstack-keystone | 14:54 | |
| lbragstad | stevemar do you remember if we merged that spec? | 14:54 |
| stevemar | lbragstad: https://review.openstack.org/#/c/324055/ | 14:54 |
| EmilienM | stevemar: hey, I need a reminder about credential-keys | 14:54 |
| stevemar | lbragstad: we did not | 14:54 |
| stevemar | EmilienM: certainly sir | 14:54 |
| lbragstad | cc scarlisle ^ | 14:54 |
| EmilienM | stevemar: I need to run the keystone credential setup on one node right? | 14:54 |
| EmilienM | stevemar: in a cluster environment | 14:55 |
| EmilienM | stevemar: and then, scp credentials on other keystone nodes? | 14:55 |
| lbragstad | scarlisle that spec (written by dolphm) will help you a lot once it is merged | 14:55 |
| lbragstad | and implemented | 14:55 |
| lbragstad | scarlisle you were kind of describing it earlier - it was a discussion we had in Austin | 14:56 |
| dolphm | lbragstad: are you going to implement it? :D | 14:56 |
| stevemar | dolphm & lbragstad can you answer EmilienM's question about the cluster environment for credential setup? | 14:56 |
| lbragstad | dolphm lol you tell me :) | 14:56 |
| dolphm | lbragstad: i would +1 | 14:57 |
| EmilienM | or is it a problem if I run it on all keystone nodes? | 14:57 |
| lbragstad | EmilienM you should only run keystone-manage credential_setup on a single node and then scp your credential keys to the other nodes in the deployment (it's a very similar flow to the fernet key rotation) | 14:57 |
| EmilienM | lbragstad: ok I see | 14:57 |
| EmilienM | lbragstad: thanks | 14:58 |
| lbragstad | EmilienM yep | 14:58 |
| ayoung | dolphm, what was that you were saying about the approach to defaulting Credentials? | 14:58 |
| *** diltram_ is now known as diltram | 14:58 | |
| lbragstad | EmilienM i documented a rolling upgrade from Mitaka to Newton that migrates credentials here - https://gist.github.com/lbragstad/ddfb10f9f9048414d1f781ba006e95d1#file-migration-md | 14:58 |
| dolphm | ayoung: defaulting credentials? | 14:58 |
| ayoung | "that is what the staged key handles for you" | 14:59 |
| EmilienM | lbragstad: thanks | 14:59 |
| lbragstad | EmilienM no problem | 14:59 |
| ayoung | dolphm, your response ^^ to my griping | 14:59 |
| lbragstad | scarlisle so it sounds like there currently isn't a way to have multiple domains for federation | 15:00 |
| dolphm | ayoung: in IRC? | 15:00 |
| ayoung | dolphm, Twitter, actually | 15:00 |
| ayoung | https://twitter.com/dolphm/status/772132048765005824 | 15:01 |
| *** ashyoung has quit IRC | 15:01 | |
| dolphm | ayoung: ah, the staged key negates the need to keep fernet repositories in a multi-node deployment exactly in sync | 15:01 |
| dolphm | ayoung: the staged key does not have to exist everywhere at once; it just has to exist everywhere eventually | 15:02 |
| *** rodrigods has quit IRC | 15:02 | |
| scarlisle | lbragstad that's what I was afraid of. Thank you very much for your help! | 15:02 |
| *** rodrigods has joined #openstack-keystone | 15:02 | |
| *** jpena is now known as jpena|away | 15:03 | |
| ayoung | dolphm, OK, so this does not, I think, help us out. On Friday, the Keystone change broke Tripleo, which runs Tempest. Tempest assumes that Credentials are encryptable, due to having a Key...I just realize that this is not the same as the Fernet key repo, just using the same mechanism? | 15:03 |
| dolphm | ayoung: correct | 15:03 |
| lbragstad | scarlisle anytime - i'll keep you posted if we end up moving forward with that spec or going with a different approach | 15:04 |
| stevemar | lbragstad: scarlisle oh i hope we go forward with that spec :O | 15:04 |
| *** spedione|AWAY is now known as spedione | 15:05 | |
| ayoung | dolphm, so we have to have some way to do the "eventually" with credentials, and I think that needs to be done up front. | 15:05 |
| ayoung | dolphm, I wrote this in haste: | 15:05 |
| ayoung | https://review.openstack.org/#/c/365087/ | 15:06 |
| ayoung | dolphm, that would at least keep from breaking people, and give an approach to work around forcing a key sync | 15:06 |
| ayoung | dolphm, I would even be OK with not making it the default, as asking people to set a config option is probabl OK at this point | 15:07 |
| dolphm | ayoung: we had a similar discussion in code review; my opinion is that we shouldn't support insecure defaults, and we certainly shouldn't default keystone.conf to be non-production friendly. i understand the need to develop a bit of new orchestration, but it shouldn't be a huge burden. you don't need a fancy rotation strategy for this or anything | 15:08 |
| dolphm | ayoung: literally just drop a couple keys on disk and you're done | 15:09 |
| ayoung | dolphm, hehehehehehehehehehe | 15:09 |
| ayoung | dolphm, there is LITERALY niothing simple about Tripleo | 15:10 |
| *** spzala has joined #openstack-keystone | 15:13 | |
| dolphm | ayoung: does it support fernet tokens? | 15:13 |
| ayoung | dolphm, not yet. No key distribution and rotation | 15:15 |
| *** zigo_ is now known as zigo | 15:20 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone-specs: [wip] Quota limits https://review.openstack.org/363765 | 15:21 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Docs for quota limits in keystone https://review.openstack.org/366202 | 15:22 |
| *** spzala has quit IRC | 15:26 | |
| *** EinstCrazy has quit IRC | 15:26 | |
| *** gokrokve has joined #openstack-keystone | 15:27 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: POC sql query revoked tokens https://review.openstack.org/359371 | 15:31 |
| *** spzala has joined #openstack-keystone | 15:35 | |
| stevemar | dolphm: some token formats have microsecond precision and some don't? | 15:36 |
| *** tonytan4ever has joined #openstack-keystone | 15:38 | |
| *** tonytan_brb has joined #openstack-keystone | 15:39 | |
| *** pcaruana has joined #openstack-keystone | 15:42 | |
| *** roxanaghe has joined #openstack-keystone | 15:42 | |
| *** tonytan4ever has quit IRC | 15:42 | |
| *** sdake has quit IRC | 15:44 | |
| lbragstad | ayoung you're noop patch might need to modify the data migration for credential encryption | 15:47 |
| lbragstad | cc dolphm | 15:47 |
| *** roxanaghe has quit IRC | 15:47 | |
| lbragstad | ayoung right now the data migration for encrypted credentials will expect a credential key repository | 15:48 |
| lbragstad | in order to do a proper migration from the `blob` column to the `encrypted_blob` column | 15:48 |
| ayoung | lbragstad, that should be done, I think. | 15:48 |
| lbragstad | once that is done - the noop driver won't be able to return whatever is passed into it because i think it would be returning the cipher text from the backend (assuming the database upgrade was complete | 15:49 |
| lbragstad | ) | 15:49 |
| *** tonytan_brb has quit IRC | 15:51 | |
| *** tonytan4ever has joined #openstack-keystone | 15:53 | |
| *** gyee has joined #openstack-keystone | 15:55 | |
| *** spzala has quit IRC | 15:57 | |
| *** adrian_otto has joined #openstack-keystone | 16:00 | |
| *** spzala has joined #openstack-keystone | 16:03 | |
| *** javis has quit IRC | 16:04 | |
| *** gokrokve has quit IRC | 16:05 | |
| *** david-lyle_ has joined #openstack-keystone | 16:05 | |
| *** david-lyle_ has quit IRC | 16:05 | |
| *** spzala has quit IRC | 16:08 | |
| *** daemontool has quit IRC | 16:21 | |
| *** daemontool has joined #openstack-keystone | 16:25 | |
| *** ninag has joined #openstack-keystone | 16:26 | |
| *** spedione is now known as chris_hultin | 16:26 | |
| *** tonytan_brb has joined #openstack-keystone | 16:29 | |
| *** daemontool has quit IRC | 16:29 | |
| *** SamYaple has quit IRC | 16:29 | |
| *** SamYaple has joined #openstack-keystone | 16:30 | |
| *** sto has quit IRC | 16:31 | |
| *** stevemar has quit IRC | 16:31 | |
| *** tonytan4ever has quit IRC | 16:32 | |
| *** NishaYadav has joined #openstack-keystone | 16:33 | |
| NishaYadav | o/ | 16:34 |
| *** topol has quit IRC | 16:34 | |
| *** tonytan_brb is now known as tonytan4ever | 16:37 | |
| *** sto has joined #openstack-keystone | 16:38 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Only cache callables in the base manager https://review.openstack.org/364562 | 16:42 |
| *** roxanaghe has joined #openstack-keystone | 16:43 | |
| *** roxanaghe has quit IRC | 16:47 | |
| *** javis has joined #openstack-keystone | 16:51 | |
| NishaYadav | samueldmq, hey! | 16:56 |
| *** chrisshattuck has joined #openstack-keystone | 16:57 | |
| *** sdake has joined #openstack-keystone | 16:57 | |
| *** asettle has quit IRC | 16:57 | |
| *** hogepodge has quit IRC | 16:58 | |
| *** hogepodge has joined #openstack-keystone | 17:03 | |
| *** evrardjp has quit IRC | 17:05 | |
| *** bradjones has quit IRC | 17:06 | |
| *** code-R_ has quit IRC | 17:07 | |
| *** Gorian has joined #openstack-keystone | 17:08 | |
| *** su_zhang has joined #openstack-keystone | 17:09 | |
| *** henrynash has quit IRC | 17:10 | |
| *** evrardjp has joined #openstack-keystone | 17:11 | |
| *** bradjones has joined #openstack-keystone | 17:11 | |
| *** bradjones has quit IRC | 17:11 | |
| *** bradjones has joined #openstack-keystone | 17:11 | |
| *** sdake_ has joined #openstack-keystone | 17:12 | |
| *** chrisshattuck has quit IRC | 17:12 | |
| *** chrisshattuck has joined #openstack-keystone | 17:14 | |
| *** sdake has quit IRC | 17:15 | |
| *** ddieterly is now known as ddieterly[away] | 17:19 | |
| *** chrisshattuck has quit IRC | 17:20 | |
| *** stevemar has joined #openstack-keystone | 17:26 | |
| *** ChanServ sets mode: +o stevemar | 17:26 | |
| *** michauds has quit IRC | 17:28 | |
| *** sdake_ has quit IRC | 17:28 | |
| *** sdake has joined #openstack-keystone | 17:29 | |
| *** su_zhang has quit IRC | 17:30 | |
| *** su_zhang has joined #openstack-keystone | 17:30 | |
| *** tqtran has joined #openstack-keystone | 17:31 | |
| *** tonytan4ever has quit IRC | 17:33 | |
| *** jaosorior has quit IRC | 17:36 | |
| *** LamT_ has joined #openstack-keystone | 17:37 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: clean up the spec repo for newton https://review.openstack.org/366268 | 17:38 |
| *** harlowja has joined #openstack-keystone | 17:38 | |
| *** thiagolib has joined #openstack-keystone | 17:40 | |
| *** esp has joined #openstack-keystone | 17:41 | |
| *** richm has quit IRC | 17:43 | |
| *** spzala has joined #openstack-keystone | 17:43 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: prime the ocata release https://review.openstack.org/366270 | 17:43 |
| *** tonytan4ever has joined #openstack-keystone | 17:44 | |
| *** roxanaghe has joined #openstack-keystone | 17:45 | |
| *** michauds has joined #openstack-keystone | 17:45 | |
| *** lamt has joined #openstack-keystone | 17:45 | |
| *** marekd2 has quit IRC | 17:46 | |
| *** marekd2 has joined #openstack-keystone | 17:46 | |
| *** sdake has quit IRC | 17:49 | |
| *** fangxu has joined #openstack-keystone | 17:53 | |
| *** fangxu has quit IRC | 17:54 | |
| *** marekd2 has quit IRC | 17:55 | |
| *** shaleh has joined #openstack-keystone | 17:56 | |
| *** sdake has joined #openstack-keystone | 17:56 | |
| *** rderose_ is now known as rderose | 17:56 | |
| *** spzala has quit IRC | 17:57 | |
| stevemar | meeting time! | 17:58 |
| stevemar | ping for meeting ajayaa, amakarov, ayoung, breton, browne, crinkle, claudiub, davechen, david8hu, dolphm, dstanek, edmondsw, gagehugo, gyee, henrynash, hogepodge, htruta, jamielennox, jaugustine, joesavak, jorge_munoz, knikolla, lbragstad, MaxPC, morgan, nkinder, notmorgan, raildo, rodrigods, rderose, roxanaghe, samleon, samueldmq, shaleh, stevemar, tsymanczyk, topol, vivekd, wanghong, xek, nishaYadav | 17:58 |
| samueldmq | NishaYadav: hi | 18:00 |
| NishaYadav | samueldmq, o/ | 18:00 |
| *** bknudson has joined #openstack-keystone | 18:00 | |
| *** ChanServ sets mode: +v bknudson | 18:00 | |
| stevemar | #agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | 18:00 |
| *** spzala has joined #openstack-keystone | 18:00 | |
| *** thiagolib has quit IRC | 18:00 | |
| stevemar | o/ | 18:00 |
| stevemar | fail | 18:01 |
| *** thiagolib has joined #openstack-keystone | 18:01 | |
| *** henrynash has joined #openstack-keystone | 18:01 | |
| *** ChanServ sets mode: +v henrynash | 18:01 | |
| openstackgerrit | ayoung proposed openstack/keystone: No Op provider for credential encryption https://review.openstack.org/365087 | 18:01 |
| *** topol has joined #openstack-keystone | 18:01 | |
| *** ChanServ sets mode: +v topol | 18:01 | |
| *** spzala has quit IRC | 18:04 | |
| *** chrisshattuck has joined #openstack-keystone | 18:06 | |
| *** crinkle_ is now known as crinkle | 18:07 | |
| *** ddieterly[away] has quit IRC | 18:19 | |
| Anticimex | is keystone still sort of in ownership of openstackclient? | 18:24 |
| Anticimex | oh meeting ongoing | 18:24 |
| *** antipsychiatry has joined #openstack-keystone | 18:25 | |
| *** spzala has joined #openstack-keystone | 18:25 | |
| antipsychiatry | Destroy " Israel" !!!!!!! They are antichrist !!!!!!!!!!!!!!!!!!! They are synagogue of Satan!!!!!!!!!! | 18:25 |
| *** antipsychiatry has quit IRC | 18:27 | |
| stevemar | Anticimex: nope, OSC is its own project | 18:27 |
| stevemar | Anticimex: check openstack-sdks | 18:27 |
| Anticimex | it grew up, cool | 18:27 |
| Anticimex | ack will do | 18:27 |
| Anticimex | channels++ | 18:28 |
| *** spzala has quit IRC | 18:28 | |
| *** spzala has joined #openstack-keystone | 18:28 | |
| *** roxanagh_ has joined #openstack-keystone | 18:31 | |
| *** roxanagh_ has quit IRC | 18:35 | |
| *** chrisshattuck has quit IRC | 18:36 | |
| *** asettle has joined #openstack-keystone | 18:37 | |
| *** chrisshattuck has joined #openstack-keystone | 18:37 | |
| *** lamt has quit IRC | 18:40 | |
| *** asettle has quit IRC | 18:42 | |
| *** lamt has joined #openstack-keystone | 18:44 | |
| *** asettle has joined #openstack-keystone | 18:45 | |
| *** chrisshattuck has quit IRC | 18:46 | |
| *** asettle has quit IRC | 18:46 | |
| *** chrisshattuck has joined #openstack-keystone | 18:46 | |
| *** michauds has quit IRC | 18:56 | |
| *** ddieterly has joined #openstack-keystone | 18:58 | |
| lbragstad | o/ | 19:00 |
| ayoung | I don't have a solution. We canFix things in Tripleo, and point others at our fixes, but we've caused a firedrill in the other projects, and that is not the way we should do things | 19:00 |
| dolphm | breton: you were asking about the null key -- the AAA...= thing is the result of: base64.urlsafe_b64encode(chr(0)* 32) | 19:01 |
| shaleh | stevemar: hey, I just replied to your -1 on my review 365177. When you have a moment I would like to clear it up. | 19:01 |
| dolphm | breton: where chr(0)*32 is a known value instead of the usual os.urandom(32) that fernet uses | 19:01 |
| ayoung | Anticimex, the way things work is that a feature goes into keystone server ,then keystone client, then we enable a plugin for it in OSC | 19:01 |
| Anticimex | i may have overloaded stevemars history of releasing openstackclient with him also chairing keystone, or something changed | 19:02 |
| Anticimex | anyway, irssi room 341 (#openstack-sdks) appeared tonight in my client | 19:02 |
| stevemar | Anticimex: i wear many hats, OSC and keystone are 2 of them :) | 19:03 |
| Anticimex | i see :) | 19:03 |
| breton | dolphm: yep. Implementation detail-ish | 19:04 |
| *** amakarov is now known as amakarov_away | 19:05 | |
| *** javis has quit IRC | 19:07 | |
| scarlisle | Is anyone around who can speak to henry-nash's comments here? https://github.com/openstack/keystone/blob/b47f10290ed83415149f3d2ab6b0dc64646e578a/keystone/tests/unit/test_v3_federation.py#L2008-L2025 | 19:07 |
| *** michauds has joined #openstack-keystone | 19:08 | |
| bknudson | inherited roles only apply to the projects in the domain not to the domain itself. | 19:08 |
| lbragstad | henrynash ^ | 19:11 |
| *** pcaruana has quit IRC | 19:11 | |
| *** fangxu has joined #openstack-keystone | 19:12 | |
| scarlisle | bknudson If you need a user to have a role for both the projects as well as the domain, do you need to define the role assignment twice (once with inherited=true and once with inherited=false)? | 19:13 |
| bknudson | scarlisle: yes, that's my understanding | 19:14 |
| *** Guest78236 is now known as melwitt | 19:14 | |
| scarlisle | Interesting. Alright, thanks for clarifying. I may have follow-up questions once I do some more poking. | 19:18 |
| mfisch | bknudson: were you asking me before about running keystone under wsgi? | 19:18 |
| stevemar | mfisch: we have all sorts of questions for you | 19:19 |
| mfisch | lol | 19:19 |
| bknudson | mfisch: probably related to the caching issue(s)? I think we figured it out. | 19:19 |
| mfisch | bknudson: was wondering if you had someone else running it that way, I had a question on the config | 19:19 |
| bknudson | we figured it out for the uwsgi case, not sure what apache wsgi does. | 19:20 |
| *** fangxu has quit IRC | 19:20 | |
| lbragstad | stevemar so - what about the FFE | 19:20 |
| lbragstad | stevemar are we holding off on that discussion? | 19:20 |
| bknudson | mfisch: we're running keystone under uwsgi. | 19:20 |
| mfisch | bknudson: do you change the buffer-size setting in your config? | 19:21 |
| bknudson | mfisch: yes. | 19:21 |
| *** shaleh is now known as shaleh|away | 19:21 | |
| mfisch | bknudson: can you share your uwsgi config with me | 19:21 |
| bknudson | mfisch: sure, gimme a sec | 19:22 |
| * mfisch tries to remember where bknudson works | 19:22 | |
| mfisch | somewhere cold I remember that ;) | 19:22 |
| bknudson | mfisch: IBM | 19:22 |
| mfisch | ah yes they have a prescense there | 19:22 |
| bknudson | mfisch: http://paste.openstack.org/show/567258/ -- there's been no tuning of any of this. | 19:23 |
| *** lamt has quit IRC | 19:24 | |
| mfisch | bknudson: what made you tune buffer-size? | 19:24 |
| bknudson | the important ones are lazy-apps , and you were asking about buffer-size | 19:24 |
| bknudson | well, you're going to need it for PKI tokens, and maybe this was set when PKI tokens were all the rage | 19:24 |
| *** tesseract- has quit IRC | 19:25 | |
| bknudson | http://uwsgi-docs.readthedocs.io/en/latest/ThingsToKnow.html says to adjust buffer-size | 19:25 |
| bknudson | probably set it to the max just to avoid failures due to not big enough | 19:25 |
| *** pnavarro has quit IRC | 19:26 | |
| mfisch | I'm occassionally getting connection reset by peer that I thought might be relaed | 19:26 |
| mfisch | related | 19:26 |
| mfisch | since I'm out of other things to tweak | 19:26 |
| mfisch | do you see those? | 19:26 |
| bknudson | we've seen that error in another deployment but haven't had a chance to look into it much | 19:27 |
| bknudson | would have to figure out where it's coming from since there's a few different connections involved (HAProxy -> Apache -> UWSGI) | 19:27 |
| mfisch | yah | 19:28 |
| mfisch | its pretty rarte | 19:28 |
| stevemar | lbragstad: can we have that discussion in 30 minutes? :) | 19:28 |
| mfisch | rare enough that I can't use tracing in haproxy to figure it out | 19:28 |
| lbragstad | stevemar sure | 19:28 |
| mfisch | bknudson: we see it in every service running uwsgi | 19:28 |
| stevemar | lbragstad: it's pretty much a formality at this point, since it's umm... merged :) | 19:29 |
| stevemar | lbragstad: it's just whether or not we pull it out | 19:29 |
| bknudson | mfisch: any way you could do some profiling to set the # connections allowed through haproxy to the different servers? | 19:29 |
| bknudson | this is something on our to-do list | 19:29 |
| lbragstad | stevemar right | 19:30 |
| mfisch | bknudson: not sure what you mean? | 19:30 |
| bknudson | mfisch: you can tell haproxy how many connections to allow to each backend. | 19:31 |
| bknudson | to ensure that a server doesn't get overloaded | 19:31 |
| *** roxanagh_ has joined #openstack-keystone | 19:32 | |
| mfisch | bknudson: I dont think its load related, it might be keep alive related | 19:32 |
| bknudson | we use uwsgi protocol to go from apache -> uwsgi | 19:32 |
| mfisch | or it might be excessively large requests, although I can't repro it that way | 19:32 |
| mfisch | we're just haproxy -> uwsgi | 19:33 |
| bknudson | not sure if there's any keep-alive on that | 19:33 |
| mfisch | bknudson: lets stay in touch about this since you see it too, I spoke briefly to jlk about it | 19:33 |
| bknudson | For devstack I had "Connection-Close" since it didn't seem to work with persistent connections at all | 19:34 |
| mfisch | I have somethnig like that set in haproxy | 19:34 |
| mfisch | http-server-close | 19:34 |
| bknudson | that's a backend config and not front-end? | 19:34 |
| bknudson | http://git.openstack.org/cgit/openstack-dev/devstack/tree/lib/keystone#n340 | 19:35 |
| mfisch | yeah thats on haproxy | 19:36 |
| mfisch | I'll look at this stuff that devstack does | 19:36 |
| *** roxanagh_ has quit IRC | 19:36 | |
| bknudson | there's a few options related to http-server-close: http://www.haproxy.org/download/1.4/doc/configuration.txt | 19:37 |
| bknudson | it's not obvious what they all do. | 19:38 |
| *** rcernin has joined #openstack-keystone | 19:41 | |
| *** sdake has quit IRC | 19:46 | |
| *** rcernin has quit IRC | 19:48 | |
| *** chrisshattuck has quit IRC | 19:51 | |
| *** LamT_ has quit IRC | 19:51 | |
| *** chrisshattuck has joined #openstack-keystone | 19:54 | |
| *** tqtran has quit IRC | 19:55 | |
| *** NishaYadav has quit IRC | 19:57 | |
| *** asettle has joined #openstack-keystone | 19:58 | |
| *** mvk has quit IRC | 20:01 | |
| *** gyee has quit IRC | 20:01 | |
| *** fangxu has joined #openstack-keystone | 20:02 | |
| *** sdake has joined #openstack-keystone | 20:03 | |
| dolphm | ayoung: if we hard code an encryption key into keystone https://etherpad.openstack.org/p/keystone-credential-encryption-null-key | 20:11 |
| ayoung | dolphm, disable with a config option, too? | 20:12 |
| ayoung | deprecate it right out the gate? | 20:12 |
| dolphm | ayoung: i don't *think* we would need to... by simply populating the credential repository and performing a credential migration (credential_setup + credential_migrate), the null key would never be used again | 20:12 |
| dolphm | ayoung: but we'd always have to load it: if there are no keys on disk, then we need the null key to encrypt credentials. if there are keys on disk, then we need the null key in case any credentials are encrypted with it. | 20:13 |
| *** edmondsw has quit IRC | 20:13 | |
| dolphm | ayoung: so, it would just need to be last in the list of fernet keys that we load for credentials | 20:14 |
| ayoung | dolphm, ah, right | 20:14 |
| ayoung | dolphm, so only the first is used to encrypt, but any could be useed to decryp, right? | 20:15 |
| *** jpena|away is now known as jpena|off | 20:15 | |
| dolphm | ayoung: yes | 20:15 |
| jlk | mfisch: bknudson: you rang? | 20:21 |
| SamYaple | mfisch: can haproxy talk uwsgi? or are you using http mode? | 20:22 |
| ayoung | dolphm, you OK with this approach? | 20:27 |
| openstackgerrit | Merged openstack/keystone: Only cache callables in the base manager https://review.openstack.org/364562 | 20:29 |
| mfisch | SamYaple: yep | 20:29 |
| dolphm | ayoung: it sucks that we have to support something with scary security implications for a long time (forever?), but i see the need | 20:29 |
| ayoung | dolphm, with a credentials rotate, we don't reencrypt the existing credentials? | 20:30 |
| dolphm | ayoung: you call credential_rotate first, sync up the keys across all your nodes, then run credential_migrate to use the latest key | 20:30 |
| bknudson | ayoung: see https://gist.github.com/lbragstad/ddfb10f9f9048414d1f781ba006e95d1#encrypted-credential-key-management | 20:30 |
| dolphm | ^^ | 20:30 |
| bknudson | apparently credential_rotate will fail if your credentials would become unusable. | 20:31 |
| bknudson | so whereas I could do fernet_rotate on a non-keystone system I'd have to do credential_rotate on a keystone system?? | 20:32 |
| SamYaple | mfisch: heh. i asked two questions. youre saying haproxy can talk uwsgi directly right? | 20:33 |
| dolphm | bknudson: not sure i understand what you're distinguishing | 20:33 |
| mfisch | yes | 20:33 |
| SamYaple | mfisch: ok thanks :) | 20:33 |
| dolphm | bknudson: it's part of keystone-manage, yes | 20:34 |
| bknudson | dolphm: fernet_rotate doesn't need access to the database | 20:34 |
| dolphm | bknudson: right, because we don't persist tokens | 20:34 |
| bknudson | so I could install the keystone code somewhere and just run it | 20:34 |
| SamYaple | mfisch: im thinking about doing that for a new deploy. any tips/config things I should be aware of? | 20:34 |
| *** tqtran has joined #openstack-keystone | 20:34 | |
| mfisch | SamYaple: let me finish this call im on and get back to you | 20:35 |
| SamYaple | mfisch: cool thanks | 20:35 |
| dolphm | bknudson: "somewhere" being somewhere in your deployment, with access to your current credential keys, but without access to read the database? | 20:35 |
| *** akscram has quit IRC | 20:36 | |
| *** ddieterly is now known as ddieterly[away] | 20:37 | |
| bknudson | dolphm: right, before if I had a system that I was using for rotating keys it didn't need access to the database | 20:37 |
| *** akscram has joined #openstack-keystone | 20:37 | |
| dolphm | bknudson: didn't need or didn't have? | 20:38 |
| bknudson | dolphm: I probably wouldn't have bothered setting up the system to access the db given it didn't need it. | 20:39 |
| dolphm | bknudson: why did you bother using keystone at all? | 20:39 |
| *** javis has joined #openstack-keystone | 20:40 | |
| bknudson | dolphm: for the service catalog and the tokens. | 20:40 |
| *** ayoung has quit IRC | 20:41 | |
| bknudson | role assignments, that kind of stuff | 20:41 |
| dolphm | bknudson: you need access to the database for the service catalog, no? | 20:41 |
| bknudson | keystone needs access to the db, but rotating the fernet keys doesn't. | 20:42 |
| dolphm | bknudson: okay, then i'm not sure what point you're trying to make | 20:42 |
| bknudson | when rotating token keys I don't need access to the db whereas when rotating credential keys I need access to the db | 20:43 |
| dolphm | bknudson: your system has access to the database, and credential rotate uses the database to ensure that you don't shoot yourself in the foot. is there a problem, or are you just making an observation? | 20:43 |
| bknudson | that's the only point | 20:43 |
| mfisch | SamYaple: nothing major really to report, we do set http-server-close | 20:43 |
| SamYaple | it does seem the way to go when the plan would just be haproxy -> apache2/nginx -> uwsgi anyway | 20:44 |
| SamYaple | cut out the middleman | 20:44 |
| *** roxanagh_ has joined #openstack-keystone | 20:47 | |
| jlk | sadly I can't cut out the middle of apache2, due to federation. | 20:50 |
| SamYaple | jlk: oh right. | 20:50 |
| SamYaple | right :( | 20:50 |
| bknudson | jlk: dstanek is working on that | 20:51 |
| *** agireud has quit IRC | 20:52 | |
| *** roxanagh_ has quit IRC | 20:52 | |
| *** ddieterly[away] is now known as ddieterly | 20:59 | |
| *** agireud has joined #openstack-keystone | 20:59 | |
| *** raildo has quit IRC | 21:01 | |
| *** chrisshattuck has quit IRC | 21:01 | |
| *** sdake has quit IRC | 21:02 | |
| *** chris_hultin is now known as spedione|AWAY | 21:07 | |
| *** pauloewerton has quit IRC | 21:10 | |
| *** mvk has joined #openstack-keystone | 21:13 | |
| *** tonytan_brb has joined #openstack-keystone | 21:17 | |
| *** topol has quit IRC | 21:19 | |
| *** tonytan4ever has quit IRC | 21:19 | |
| *** ametts has quit IRC | 21:30 | |
| *** ddieterly is now known as ddieterly[away] | 21:30 | |
| *** ddieterly[away] is now known as ddieterly | 21:36 | |
| *** gagehugo has quit IRC | 21:38 | |
| *** adrian_otto has quit IRC | 21:38 | |
| *** chrisshattuck has joined #openstack-keystone | 21:39 | |
| *** adriant has joined #openstack-keystone | 21:44 | |
| *** stevemar has quit IRC | 21:52 | |
| *** spedione|AWAY is now known as spedione | 21:53 | |
| lbragstad | dolphm sweet - so our plan forward is essentially just implementing the proposed solution in the etherpad | 21:59 |
| *** ddieterly is now known as ddieterly[away] | 22:00 | |
| *** asettle has joined #openstack-keystone | 22:05 | |
| *** gyee has joined #openstack-keystone | 22:05 | |
| *** ChanServ sets mode: +v gyee | 22:05 | |
| dolphm | lbragstad: i'd say that up to ayoung | 22:05 |
| *** BjoernT has quit IRC | 22:05 | |
| *** asettle has quit IRC | 22:06 | |
| *** asettle has joined #openstack-keystone | 22:07 | |
| lbragstad | awww - he left | 22:07 |
| dolphm | lbragstad: last thing he said on the topic: <ayoung> dolphm, you OK with this approach? | 22:08 |
| *** swatson has joined #openstack-keystone | 22:08 | |
| *** swatson has left #openstack-keystone | 22:08 | |
| lbragstad | dolphm and he was referring to the proposed solution in the etherpad? | 22:09 |
| dolphm | lbragstad: yes | 22:09 |
| lbragstad | dolphm cool | 22:09 |
| lbragstad | wfm | 22:09 |
| lbragstad | i'll get started on it | 22:09 |
| dolphm | lbragstad: sweet | 22:09 |
| *** ddieterly[away] is now known as ddieterly | 22:12 | |
| *** su_zhang has quit IRC | 22:14 | |
| dolphm | lbragstad: left a -1 on https://review.openstack.org/#/c/365087/ with an explanation of the upgrade problem | 22:14 |
| *** ravelar has quit IRC | 22:15 | |
| *** topol has joined #openstack-keystone | 22:17 | |
| *** ChanServ sets mode: +v topol | 22:17 | |
| *** ddieterly is now known as ddieterly[away] | 22:17 | |
| *** ninag has quit IRC | 22:18 | |
| *** javis has quit IRC | 22:18 | |
| *** topol has quit IRC | 22:21 | |
| lbragstad | dolphm awesome | 22:22 |
| *** stevemar has joined #openstack-keystone | 22:24 | |
| *** ChanServ sets mode: +o stevemar | 22:24 | |
| *** ddieterly[away] is now known as ddieterly | 22:24 | |
| *** stevemar has quit IRC | 22:26 | |
| *** stevemar has joined #openstack-keystone | 22:26 | |
| *** ChanServ sets mode: +o stevemar | 22:26 | |
| *** ravelar has joined #openstack-keystone | 22:28 | |
| *** stevemar has quit IRC | 22:31 | |
| *** roxanagh_ has joined #openstack-keystone | 22:35 | |
| *** roxanagh_ has quit IRC | 22:40 | |
| *** michauds has quit IRC | 22:42 | |
| *** ddieterly has quit IRC | 22:43 | |
| *** asettle has quit IRC | 22:54 | |
| *** asettle has joined #openstack-keystone | 22:57 | |
| *** asettle has quit IRC | 22:57 | |
| *** thiagolib has quit IRC | 22:58 | |
| *** spzala has quit IRC | 23:05 | |
| *** chrisshattuck has quit IRC | 23:05 | |
| *** stevemar has joined #openstack-keystone | 23:07 | |
| *** ChanServ sets mode: +o stevemar | 23:07 | |
| *** asettle has joined #openstack-keystone | 23:09 | |
| *** ayoung has joined #openstack-keystone | 23:10 | |
| *** ChanServ sets mode: +v ayoung | 23:10 | |
| *** sdake has joined #openstack-keystone | 23:10 | |
| *** spedione is now known as spedione|AWAY | 23:13 | |
| *** adrian_otto has joined #openstack-keystone | 23:15 | |
| *** markvoelker has quit IRC | 23:19 | |
| *** ravelar has quit IRC | 23:19 | |
| *** fangxu has quit IRC | 23:20 | |
| *** javis has joined #openstack-keystone | 23:22 | |
| *** ravelar has joined #openstack-keystone | 23:30 | |
| EmilienM | ayoung: fyi https://review.openstack.org/#/q/topic:keystone/credentials | 23:30 |
| *** bapalm has quit IRC | 23:35 | |
| *** fangxu has joined #openstack-keystone | 23:38 | |
| *** bapalm has joined #openstack-keystone | 23:41 | |
| *** ravelar has quit IRC | 23:41 | |
| *** roxanaghe has quit IRC | 23:52 | |
| *** ddieterly has joined #openstack-keystone | 23:56 | |
| *** markvoelker has joined #openstack-keystone | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!