| *** tqtran has quit IRC | 00:06 | |
| *** shaleh|away has quit IRC | 00:06 | |
| *** adrian_otto has quit IRC | 00:07 | |
| *** adrian_otto has joined #openstack-keystone | 00:08 | |
| *** adrian_otto has quit IRC | 00:09 | |
| *** richm has joined #openstack-keystone | 00:09 | |
| *** esp has quit IRC | 00:10 | |
| *** fangxu has quit IRC | 00:11 | |
| *** ravelar has joined #openstack-keystone | 00:15 | |
| *** ravelar has quit IRC | 00:22 | |
| *** roxanaghe has joined #openstack-keystone | 00:24 | |
| *** ddieterly has quit IRC | 00:25 | |
| *** bigjools has quit IRC | 00:28 | |
| *** roxanaghe has quit IRC | 00:28 | |
| *** bigjools has joined #openstack-keystone | 00:29 | |
| *** esp has joined #openstack-keystone | 00:32 | |
| *** topol has joined #openstack-keystone | 00:36 | |
| *** ChanServ sets mode: +v topol | 00:36 | |
| *** ddieterly has joined #openstack-keystone | 00:37 | |
| *** javis has quit IRC | 00:50 | |
| *** spzala has joined #openstack-keystone | 00:57 | |
| ayoung | EmilienM, so I think we can run all of the setup scrupts for Fernet and for Credentials on the overcloud. When these are run, they assume a keystone.conf file in /etc/keystone/keystone.conf, but I think we can pass in an alternative. So we could make an "overcloud " directory and put all of the config files in there. | 00:57 |
|---|---|---|
| ayoung | mkdir -p /var/tmp/etc/keystone | 00:57 |
| ayoung | put a stub conf file in /var/tmp/etc/keystone/keystone.conf or where ever and then | 00:57 |
| ayoung | keystone_manage --config-dir /var/tmp/etc/keystone fernet-setup and | 00:58 |
| EmilienM | ayoung: that is too complicated tbh | 00:59 |
| ayoung | EmilienM, and then we sync that whole directory down, chopping off /var/tmp | 00:59 |
| ayoung | well, and not the conf file | 00:59 |
| ayoung | make sure the whole structure is in place for each of the nodes | 01:00 |
| ayoung | EmilienM, I don't want to have logic in puppet that might differ from what Keystone does to generate keyhs | 01:00 |
| ayoung | keys | 01:00 |
| EmilienM | ayoung: have you seen what I did? | 01:00 |
| EmilienM | it's all passing CI btw https://review.openstack.org/#/c/366400/ | 01:00 |
| ayoung | EmilienM, you are looking to run on one node and then sync to the others, rigjht? | 01:00 |
| ayoung | Wow | 01:00 |
| ayoung | Yeah, I saw that one passed on recheck | 01:01 |
| EmilienM | see the result http://logs.openstack.org/00/366400/1/check/gate-tripleo-ci-centos-7-nonha-multinode/2084b54/logs/subnode-2/etc/keystone/credential-keys/ | 01:01 |
| ayoung | and there was a recheck on the follow on | 01:01 |
| EmilienM | that's on the overcloud | 01:01 |
| EmilienM | we have the 2 keys and everything works. | 01:01 |
| ayoung | EmilienM, if you are cranking, I won't hold up progress | 01:02 |
| ayoung | I wouldn;t have tackled it that way, but this is your domain, drive on | 01:02 |
| EmilienM | the way I'm doing it 1) works 2) is secure 3) can easily be changed later in a different workflow | 01:03 |
| EmilienM | so i guess it's not a bad option | 01:03 |
| EmilienM | we need to take in account the release schedule and this thing is really blocking us | 01:03 |
| EmilienM | again, doing that at the end of the cycle makes me really sad | 01:03 |
| ayoung | EmilienM, those are really good points. | 01:04 |
| EmilienM | what concerns me is upgrade but I'm pretty sure my stuff will work in upgrade | 01:05 |
| EmilienM | or maybe not, I'll test it. | 01:05 |
| ayoung | EmilienM, it might be the wrong way to get stuff done, but Fernet will make many people happy | 01:07 |
| EmilienM | something we need to do in tripleo is implement a mechanism for key rotations | 01:07 |
| EmilienM | the mechanism to generate keys doesn't worry me at all | 01:07 |
| EmilienM | it can be done by puppet or keystone manage I don't care at all | 01:07 |
| EmilienM | what we want is security here and rotation will be my next iteration on this thing. | 01:08 |
| EmilienM | ayoung: I plan to add fernet keys to tripleo when my stuff is merged. | 01:08 |
| EmilienM | in the meantime find a way to do rotations | 01:08 |
| ayoung | +++++ | 01:08 |
| *** javis has joined #openstack-keystone | 01:12 | |
| *** wangqun has joined #openstack-keystone | 01:19 | |
| *** browne has quit IRC | 01:22 | |
| *** annp has joined #openstack-keystone | 01:23 | |
| *** Gorian has quit IRC | 01:26 | |
| *** Gorian has joined #openstack-keystone | 01:26 | |
| *** ddieterly has quit IRC | 01:36 | |
| *** davechen has joined #openstack-keystone | 01:36 | |
| *** roxanaghe has joined #openstack-keystone | 01:39 | |
| *** ddieterly has joined #openstack-keystone | 01:40 | |
| *** roxanaghe has quit IRC | 01:44 | |
| *** esp has quit IRC | 01:45 | |
| *** marekd2 has joined #openstack-keystone | 01:51 | |
| *** fangxu has joined #openstack-keystone | 01:55 | |
| *** EinstCrazy has joined #openstack-keystone | 01:55 | |
| *** marekd2 has quit IRC | 01:56 | |
| *** spzala has quit IRC | 01:57 | |
| *** spzala has joined #openstack-keystone | 01:57 | |
| openstackgerrit | Merged openstack/keystone: Emit log message for fernet tokens only https://review.openstack.org/364986 | 01:58 |
| openstackgerrit | Merged openstack/keystone: Set default value for [saml]/idp_contact_surname https://review.openstack.org/356160 | 01:58 |
| *** EinstCrazy has quit IRC | 01:58 | |
| *** fangxu has quit IRC | 02:01 | |
| *** spzala has quit IRC | 02:02 | |
| *** EinstCrazy has joined #openstack-keystone | 02:03 | |
| *** ddieterly has quit IRC | 02:06 | |
| *** esp has joined #openstack-keystone | 02:14 | |
| *** asettle has joined #openstack-keystone | 02:15 | |
| *** asettle has quit IRC | 02:20 | |
| *** spzala has joined #openstack-keystone | 02:35 | |
| *** spzala has quit IRC | 02:35 | |
| *** spzala has joined #openstack-keystone | 02:36 | |
| *** spzala has quit IRC | 02:36 | |
| *** spzala has joined #openstack-keystone | 02:36 | |
| *** spzala has quit IRC | 02:37 | |
| *** spzala has joined #openstack-keystone | 02:37 | |
| *** spzala has quit IRC | 02:37 | |
| *** spzala has joined #openstack-keystone | 02:38 | |
| *** esp has quit IRC | 02:41 | |
| *** spzala has quit IRC | 02:42 | |
| *** spzala has joined #openstack-keystone | 02:58 | |
| *** spzala has quit IRC | 03:13 | |
| *** akscram has quit IRC | 03:19 | |
| openstackgerrit | Ha Van Tu proposed openstack/keystone: [api-ref] Stop supporting os-api-ref 1.0.0 https://review.openstack.org/366459 | 03:20 |
| *** akscram has joined #openstack-keystone | 03:20 | |
| *** namnh has joined #openstack-keystone | 03:23 | |
| *** roxanaghe has joined #openstack-keystone | 03:28 | |
| *** akscram has quit IRC | 03:29 | |
| *** akscram has joined #openstack-keystone | 03:30 | |
| namnh | Hi everyone. Keystone in Mitaka still does not support online schema migration feature yet. Is that right? | 03:31 |
| stevemar | namnh: correct | 03:32 |
| namnh | I saw a patch set: https://review.openstack.org/#/c/245186/9/specs/mitaka/online-schema-migration.rst . But when I see Githup, I did not see: https://github.com/openstack/keystone-specs/tree/master/specs/keystone/mitaka | 03:32 |
| *** roxanaghe has quit IRC | 03:32 | |
| *** sdake_ has joined #openstack-keystone | 03:32 | |
| namnh | stevemar: thanks for your reply. It means Keystone does not support upgrading without downtime from Liberty to Mitaka yet. | 03:34 |
| stevemar | namnh: correct | 03:34 |
| *** sdake has quit IRC | 03:35 | |
| namnh | stevemar: Oh. I see. So Does Keystone has plan to do it? | 03:35 |
| stevemar | namnh: it should be supported when you go from mitaka to newton ;) | 03:36 |
| stevemar | lbragstad: dolphm credential_setup is now a required step in the install process correct? | 03:37 |
| stevemar | lbragstad: dolphm, or should be... | 03:37 |
| stevemar | lbragstad: dolphm we need to update the install guide | 03:38 |
| namnh | stevemar: :( So if I want to upgrade from L to M then there will be downtime as link: http://docs.openstack.org/developer/keystone/upgrading.html#upgrading-with-downtime . Is that right? | 03:39 |
| stevemar | namnh: correct, if it helps, the outage window can be measured in minutes | 03:40 |
| stevemar | namnh: see more notes here: https://review.openstack.org/#/c/360733/ | 03:41 |
| *** hoangcx has joined #openstack-keystone | 03:42 | |
| *** links has joined #openstack-keystone | 03:45 | |
| namnh | stevemar: I got it. I will read your link. I am researching about how to upgrade Keystone from L to M. Next time, could I ask you ? :) | 03:46 |
| stevemar | namnh: i don't really have much experience in actually running proper upgrades, your best bet would be posting the operator mailing list | 03:46 |
| stevemar | namnh: others have posted there before about keystone upgrades: http://lists.openstack.org/pipermail/openstack-operators/2016-August/011371.html | 03:47 |
| stevemar | and another: http://lists.openstack.org/pipermail/openstack-operators/2016-June/010822.html | 03:48 |
| namnh | stevemar: I see :) Anyway thank you so much for your time :) | 03:48 |
| stevemar | namnh: np! | 03:48 |
| openstackgerrit | Ha Van Tu proposed openstack/keystone: [api-ref] Stop supporting os-api-ref 1.0.0 https://review.openstack.org/366459 | 03:51 |
| openstackgerrit | Merged openstack/keystone: Correct link type https://review.openstack.org/365816 | 03:53 |
| *** markvoelker has quit IRC | 03:54 | |
| *** Marcellin__ has quit IRC | 03:57 | |
| *** esp has joined #openstack-keystone | 03:59 | |
| *** rdo_ has quit IRC | 04:07 | |
| *** roxanaghe has joined #openstack-keystone | 04:19 | |
| *** roxanaghe has quit IRC | 04:22 | |
| *** roxanaghe has joined #openstack-keystone | 04:25 | |
| *** stevemar has quit IRC | 04:28 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Fix up some doc nits https://review.openstack.org/366481 | 04:28 |
| *** esp has quit IRC | 04:33 | |
| *** namnh has quit IRC | 04:42 | |
| *** namnh has joined #openstack-keystone | 04:42 | |
| *** markvoelker has joined #openstack-keystone | 04:55 | |
| *** markvoelker has quit IRC | 04:59 | |
| *** tonytan_brb has quit IRC | 05:09 | |
| *** jaosorior has joined #openstack-keystone | 05:12 | |
| *** openstackgerrit has quit IRC | 05:18 | |
| *** openstackgerrit has joined #openstack-keystone | 05:18 | |
| *** hoangcx has quit IRC | 05:20 | |
| *** roxanaghe has quit IRC | 05:27 | |
| *** EinstCrazy has quit IRC | 05:30 | |
| *** EinstCrazy has joined #openstack-keystone | 05:31 | |
| *** richm has quit IRC | 05:41 | |
| *** sdake_ is now known as sdake | 05:46 | |
| *** hoangcx has joined #openstack-keystone | 05:49 | |
| *** adriant has quit IRC | 05:51 | |
| *** joerch has joined #openstack-keystone | 05:59 | |
| breton | morning, keystone | 06:00 |
| *** stevemar has joined #openstack-keystone | 06:06 | |
| *** ChanServ sets mode: +o stevemar | 06:06 | |
| *** EinstCrazy has quit IRC | 06:06 | |
| *** EinstCrazy has joined #openstack-keystone | 06:10 | |
| *** tonytan4ever has joined #openstack-keystone | 06:10 | |
| *** stevemar has quit IRC | 06:11 | |
| *** tonytan4ever has quit IRC | 06:15 | |
| *** sdake has quit IRC | 06:18 | |
| openstackgerrit | Merged openstack/keystone: [api-ref] Stop supporting os-api-ref 1.0.0 https://review.openstack.org/366459 | 06:20 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Make fetching all foreign keys in a join https://review.openstack.org/347972 | 06:29 |
| breton | someone, wontfix https://bugs.launchpad.net/keystonemiddleware/+bug/1620919 please | 06:34 |
| openstack | Launchpad bug 1620919 in keystonemiddleware "Missing options in keystonemiddleware.auth_token._opts:list_opts" [Undecided,New] - Assigned to qingzhou (qingzhhu) | 06:34 |
| *** pcaruana has joined #openstack-keystone | 06:34 | |
| *** topol_ has joined #openstack-keystone | 06:41 | |
| *** ChanServ sets mode: +v topol_ | 06:41 | |
| *** henrynash_ has joined #openstack-keystone | 06:42 | |
| *** stevemar has joined #openstack-keystone | 06:44 | |
| *** EinstCrazy has quit IRC | 06:54 | |
| *** markvoelker has joined #openstack-keystone | 06:56 | |
| *** topol has quit IRC | 06:57 | |
| *** asettle has joined #openstack-keystone | 07:00 | |
| *** markvoelker has quit IRC | 07:01 | |
| *** tesseract- has joined #openstack-keystone | 07:02 | |
| *** EinstCrazy has joined #openstack-keystone | 07:03 | |
| *** jpena|off is now known as jpena | 07:03 | |
| *** sdake has joined #openstack-keystone | 07:03 | |
| openstackgerrit | Nguyen Phuong An proposed openstack/keystone: [api-ref] Remove parameters unused in keystone v2 https://review.openstack.org/365947 | 07:16 |
| aloga | namnh: no, you can't update without a downtime | 07:17 |
| namnh | aloga: Hi aloga, yes you are right when we do this from L to M. But our expection is no downtime. | 07:22 |
| namnh | aloga: I think the deverlopers in Keystone are trying to do the "rolling-upgrade" feature. | 07:23 |
| namnh | aloga: :) | 07:24 |
| aloga | namnh: yes, indeed | 07:24 |
| aloga | namnh: I upgraded a couple of weeks ago, without significant problems | 07:25 |
| aloga | and just a short downtime window | 07:25 |
| *** EinstCrazy has quit IRC | 07:27 | |
| *** EinstCrazy has joined #openstack-keystone | 07:36 | |
| *** woodster_ has quit IRC | 07:39 | |
| namnh | aloga: Ohh. Good for you. What release did you upgrade? | 07:45 |
| aloga | L -> M | 07:45 |
| *** tonytan4ever has joined #openstack-keystone | 07:47 | |
| namnh | aloga: Thanks for your informatin. One more thing, Is your test in test enviroment or product? | 07:50 |
| aloga | production | 07:51 |
| aloga | although we have a test infrastructure, were we tested the upgrade first | 07:51 |
| *** tonytan4ever has quit IRC | 07:52 | |
| *** asettle has quit IRC | 07:56 | |
| namnh | aloga: wow. currently, we have a plan to upgrade Openstack from L to M. Next time, could I discuss this hot topic with you? and Congratulations :-) | 07:56 |
| aloga | yes, sure, I will be glad to help | 07:56 |
| *** topol_ is now known as topol | 07:57 | |
| namnh | aloga: Thank you :) | 07:59 |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| henrynash | namnh, aloga: yes, in Netwon we have rolling upgrade support, so M->N can be done that way | 08:01 |
| namnh | aloga: btw, Did you upgrade Glance project? | 08:01 |
| *** henrynash has quit IRC | 08:01 | |
| aloga | namnh: yes | 08:02 |
| aloga | we have upgraded everything since... ¿essex? | 08:02 |
| *** asettle has joined #openstack-keystone | 08:02 | |
| *** EinstCrazy has quit IRC | 08:03 | |
| namnh | aloga: Great! I does not still find a document about upgrading in Glance, and I don't see the rolling-upgrade feature in Glance. So do you have any information about how to do it? | 08:05 |
| *** mvk has quit IRC | 08:07 | |
| *** ChanServ sets mode: +o stevemar | 08:07 | |
| *** stevemar_ has joined #openstack-keystone | 08:07 | |
| *** ChanServ sets mode: +o stevemar_ | 08:07 | |
| *** mvk has joined #openstack-keystone | 08:08 | |
| aloga | namnh: http://docs.openstack.org/releasenotes/glance/mitaka.html | 08:09 |
| aloga | namnh: the release notes usually contain notes about the upgrade process | 08:09 |
| aloga | namnh: glance has been a smooth upgrade for us every time we did an upgrad | 08:09 |
| aloga | namnh: with minimal donwtime as well | 08:10 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| aloga | namnh: usually we don't care about minimal disruptions of the service, we're not a commercial provider | 08:10 |
| *** stevemar_ has quit IRC | 08:12 | |
| *** EinstCrazy has joined #openstack-keystone | 08:12 | |
| namnh | aloga: IMO, Glance has not still support rolling-upgrade yet. So the our work-follow is to stop Glance service -> upgrade Glance database -> upgrade source-code and install packages dependence -> start service. | 08:18 |
| *** namnh has quit IRC | 08:19 | |
| *** annp has quit IRC | 08:19 | |
| *** namnh has joined #openstack-keystone | 08:19 | |
| *** annp has joined #openstack-keystone | 08:19 | |
| namnh | aloga: Is that your work-follow during upgrading? | 08:19 |
| aloga | namnh: the one you described | 08:19 |
| namnh | aloga: I see. Do you use mutilple controllers? it means HA active-active for controller node. | 08:23 |
| *** rdo_ has joined #openstack-keystone | 08:25 | |
| *** marekd2 has joined #openstack-keystone | 08:26 | |
| *** openstackgerrit has quit IRC | 08:34 | |
| *** openstackgerrit has joined #openstack-keystone | 08:34 | |
| *** EinstCra_ has joined #openstack-keystone | 08:34 | |
| *** EinstCrazy has quit IRC | 08:37 | |
| *** pnavarro has joined #openstack-keystone | 08:46 | |
| *** links has quit IRC | 08:53 | |
| *** EinstCra_ has quit IRC | 08:55 | |
| *** links has joined #openstack-keystone | 08:55 | |
| *** EinstCrazy has joined #openstack-keystone | 08:56 | |
| *** markvoelker has joined #openstack-keystone | 08:57 | |
| *** markvoelker has quit IRC | 09:01 | |
| *** code-R has joined #openstack-keystone | 09:02 | |
| *** code-R_ has joined #openstack-keystone | 09:05 | |
| *** code-R has quit IRC | 09:08 | |
| *** stevemar_ has joined #openstack-keystone | 09:08 | |
| *** ChanServ sets mode: +o stevemar_ | 09:08 | |
| *** mvk has quit IRC | 09:12 | |
| *** stevemar_ has quit IRC | 09:13 | |
| breton | rderose: i think i figured out why https://review.openstack.org/347972 fails the test | 09:22 |
| *** amakarov_away is now known as amakarov | 09:25 | |
| breton | rderose: it happens because in test_user_can_change_password_after_min_age field created_at is set to the same value. This causes password_ref return the wrong password here: https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql_model.py#L80 | 09:28 |
| breton | rderose: it seems that the difference between `joined` and `subquery` is in order of equal objects | 09:28 |
| breton | and i think it's kind of luck that the tests works now fine :p | 09:30 |
| *** EinstCrazy has quit IRC | 09:37 | |
| *** EinstCrazy has joined #openstack-keystone | 09:39 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3) https://review.openstack.org/267456 | 09:40 |
| openstackgerrit | Harini proposed openstack/keystone: EndpointPolicy driver doesn't inherit interface https://review.openstack.org/352586 | 09:40 |
| *** mvk has joined #openstack-keystone | 09:41 | |
| *** sdake has quit IRC | 09:47 | |
| *** markvoelker has joined #openstack-keystone | 09:57 | |
| *** hoonetorg has quit IRC | 09:58 | |
| *** topol_ has joined #openstack-keystone | 09:59 | |
| *** ChanServ sets mode: +v topol_ | 09:59 | |
| *** markvoelker has quit IRC | 10:02 | |
| *** davechen has left #openstack-keystone | 10:02 | |
| *** topol_ has quit IRC | 10:04 | |
| *** richm has joined #openstack-keystone | 10:08 | |
| *** annp has quit IRC | 10:10 | |
| *** hoangcx has quit IRC | 10:13 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3/contrib) https://review.openstack.org/268003 | 10:20 |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add release notes for return-request-id-to-caller https://review.openstack.org/276644 | 10:27 |
| *** namnh has quit IRC | 10:29 | |
| *** swamireddy1 has joined #openstack-keystone | 10:37 | |
| swamireddy1 | Hi | 10:37 |
| swamireddy1 | what is default supported version in L release Keystone ? | 10:37 |
| swamireddy1 | is it V2 or V3? | 10:38 |
| *** dgonzalez has quit IRC | 10:45 | |
| breton | swamireddy1: both | 10:55 |
| *** dikonoor has joined #openstack-keystone | 10:55 | |
| breton | swamireddy1: in L both version are supported; there is no such thing as default API version. But we recommend using v3. | 10:55 |
| *** dgonzalez has joined #openstack-keystone | 10:57 | |
| *** GB21 has joined #openstack-keystone | 11:05 | |
| *** dikonoor has quit IRC | 11:05 | |
| *** ddieterly has joined #openstack-keystone | 11:06 | |
| *** wangqun has quit IRC | 11:08 | |
| *** stevemar_ has joined #openstack-keystone | 11:09 | |
| *** ChanServ sets mode: +o stevemar_ | 11:09 | |
| *** stevemar_ has quit IRC | 11:13 | |
| *** dikonoor has joined #openstack-keystone | 11:15 | |
| *** ddieterly has quit IRC | 11:28 | |
| *** swamireddy2 has joined #openstack-keystone | 11:34 | |
| *** swamireddy1 has quit IRC | 11:35 | |
| swamireddy2 | breton: Thanks...so with L release, is V3 fully supported as v2.0 | 11:35 |
| *** tonytan4ever has joined #openstack-keystone | 11:49 | |
| *** jpena is now known as jpena|lunch | 11:49 | |
| *** ddieterly has joined #openstack-keystone | 11:51 | |
| *** tonytan4ever has quit IRC | 11:53 | |
| breton | swamireddy2: yes | 11:54 |
| *** Marcellin__ has joined #openstack-keystone | 11:56 | |
| *** eandersson has joined #openstack-keystone | 11:57 | |
| *** markvoelker has joined #openstack-keystone | 11:58 | |
| *** zeus has quit IRC | 12:00 | |
| *** topol_ has joined #openstack-keystone | 12:01 | |
| *** ChanServ sets mode: +v topol_ | 12:01 | |
| *** markvoelker has quit IRC | 12:03 | |
| *** links has quit IRC | 12:04 | |
| *** marekd2 has quit IRC | 12:05 | |
| *** chlong has joined #openstack-keystone | 12:05 | |
| *** pauloewerton has joined #openstack-keystone | 12:06 | |
| *** topol_ has quit IRC | 12:06 | |
| *** stevemar_ has joined #openstack-keystone | 12:10 | |
| *** ChanServ sets mode: +o stevemar_ | 12:10 | |
| *** stevemar_ has quit IRC | 12:14 | |
| *** links has joined #openstack-keystone | 12:16 | |
| *** EinstCrazy has quit IRC | 12:21 | |
| *** ddieterly has quit IRC | 12:22 | |
| *** hoonetorg has joined #openstack-keystone | 12:23 | |
| dikonoor | dolphm: stevemar: hi..GM ..Can fernet tokens be revoked? | 12:23 |
| dolphm | dikonoor: yes | 12:23 |
| dikonoor | dolphm: how would that work ? Could you point me to the code that does that..Couldn't find under https://github.com/openstack/keystone/tree/master/keystone/token/providers/fernet | 12:24 |
| dolphm | dikonoor: revocation events | 12:24 |
| cnf | I keep getting things like " Invalid service catalog service: compute" in horizon | 12:25 |
| cnf | i'm guessing i did something wrong in keystone | 12:25 |
| dikonoor | dolphm: would you be able to point me to where I can check the code for revocation events. I don't see anything about revocation events in any of the fernet token related documentation or articles | 12:26 |
| breton | dikonoor: keystone/revoke/ | 12:29 |
| dolphm | dikonoor: they're implemented in the keystone.revoke package | 12:29 |
| *** dolphm sets mode: +v rderose | 12:30 | |
| dikonoor | thanks breton: dolphm: I will take a look | 12:30 |
| *** edmondsw has joined #openstack-keystone | 12:31 | |
| *** markvoelker has joined #openstack-keystone | 12:32 | |
| *** woodster_ has joined #openstack-keystone | 12:42 | |
| *** jpena|lunch is now known as jpena | 12:48 | |
| *** zeus has joined #openstack-keystone | 12:49 | |
| *** jaosorior has quit IRC | 12:49 | |
| *** zeus is now known as Guest49408 | 12:50 | |
| *** jaosorior has joined #openstack-keystone | 12:50 | |
| *** Guest49408 is now known as zeus` | 12:51 | |
| cnf | hmm, i don't understand where this is coming from :/ | 12:52 |
| *** ddieterly has joined #openstack-keystone | 12:52 | |
| *** zeus` is now known as zeus | 12:52 | |
| *** zeus has quit IRC | 12:52 | |
| *** zeus has joined #openstack-keystone | 12:52 | |
| *** swamireddy2 has quit IRC | 12:55 | |
| *** GB21 has quit IRC | 12:56 | |
| *** ddieterly has quit IRC | 12:57 | |
| dstanek | cnf: are you seeing errors in the keystone log? | 13:10 |
| *** stevemar_ has joined #openstack-keystone | 13:10 | |
| *** ChanServ sets mode: +o stevemar_ | 13:10 | |
| *** links has quit IRC | 13:12 | |
| cnf | dstanek i see 2016-09-07 13:12:16.295 26 INFO eventlet.wsgi.server [req-77656ff2-2b34-43ec-9b54-6c909611e6ab - - - - -] 192.168.13.153 - - [07/Sep/2016 13:12:16] "POST /v3/ tokens HTTP/1.1" 404 342 0.153065, | 13:12 |
| cnf | but i don;t know why i'd get a 404 on it | 13:12 |
| dstanek | there appears to be a space in there | 13:12 |
| *** asettle has quit IRC | 13:12 | |
| bknudson | there's no /v3/tokens. in v3 it's /v3/auth/tokens. | 13:12 |
| dstanek | should be /v3/tokens | 13:12 |
| bknudson | v2.0 has /v2.0/tokens | 13:12 |
| cnf | there isn't | 13:13 |
| dstanek | bknudson: oh, good call | 13:13 |
| cnf | that's a paste from a newline on my consokle | 13:13 |
| *** asettle has joined #openstack-keystone | 13:13 | |
| cnf | bknudson ok... where is this configured? | 13:13 |
| dstanek | cnf: bknudson is right. different urls between v2 and v3 for auth | 13:13 |
| bknudson | every user of keystone has to be told to use the right endpoint and version | 13:13 |
| cnf | and where do I do this? | 13:14 |
| bknudson | in the application. It depends on the application. | 13:14 |
| *** stevemar_ has quit IRC | 13:15 | |
| cnf | i'm guessing it's nova | 13:15 |
| *** topol_ has joined #openstack-keystone | 13:16 | |
| *** ChanServ sets mode: +v topol_ | 13:16 | |
| dstanek | cnf: do you get the useragent in the apache log? that may be a hint | 13:16 |
| cnf | no apache log, that's just keystone log | 13:16 |
| dstanek | cnf: you don't run behind a webserver at all? | 13:17 |
| cnf | atm, no | 13:17 |
| rderose | breton: is that the only test that fails? | 13:17 |
| *** su_zhang has joined #openstack-keystone | 13:21 | |
| breton | rderose: yes | 13:25 |
| breton | rderose: i am going to propose a patch soon | 13:25 |
| rderose | breton: okay, cool | 13:25 |
| rderose | breton: but I thought there were more tests failing, temptest | 13:26 |
| *** tonytan4ever has joined #openstack-keystone | 13:26 | |
| rderose | min password age was merged recently, before this patch | 13:26 |
| rderose | right? | 13:26 |
| breton | rderose: oh, those... yeah, i have not yet figured that out. | 13:27 |
| rderose | breton: okay | 13:27 |
| amakarov | rderose, o/ Thank you for picking up the CI issue 1620764. Have you looked into? | 13:27 |
| cnf | hmz, i have no idea how to fix this :/ | 13:27 |
| rderose | amakarov: not yet, got caught up in something yesterday. will do today though. | 13:28 |
| breton | rderose: tempest actually failed for unrelated reason | 13:28 |
| amakarov | rderose, cool! | 13:28 |
| *** javis has quit IRC | 13:29 | |
| rderose | breton: cool, I'll look for your new patch then | 13:29 |
| cnf | it's either nova, or horizon | 13:29 |
| cnf | it's the only thing i'm using, atm | 13:30 |
| dstanek | cnf: did you check their configs? | 13:30 |
| cnf | dstanek i did, but i don't quite know what to check | 13:30 |
| cnf | i just followed the | 13:31 |
| cnf | ubuntu install guide | 13:31 |
| dstanek | cnf: easiest thing to do is grep for the incorrect URL | 13:31 |
| cnf | grep for what? | 13:31 |
| *** wangqun has joined #openstack-keystone | 13:31 | |
| cnf | i just have things like auth_uri = http://keystone:5000 in nova.conf | 13:32 |
| cnf | just like the install document said | 13:32 |
| cnf | there is no version associated with that | 13:33 |
| dstanek | cnf: i was thinking you may have '/v3' somewhere | 13:34 |
| cnf | no, there is no /v3 anywhere, except in keystone endpoints | 13:34 |
| cnf | hmm, ok, maybe auth_version= works... | 13:36 |
| cnf | in nova.conf | 13:36 |
| cnf | dstanek ok, yeah, that seems to be the missing bit | 13:37 |
| cnf | found it on some blog | 13:37 |
| cnf | bknudson thanks for pointing out the api version discrepancy | 13:38 |
| cnf | dstanek and thanks for the help | 13:38 |
| bknudson | is this in the authtoken section of nova.conf? or somewhere else? | 13:38 |
| cnf | openstack isnt very good with debugging and error messages :/ | 13:38 |
| cnf | bknudson yes, in [keystone_authtoken] | 13:39 |
| bknudson | people need to open bugs when there are problems and maybe someone will pick it up | 13:39 |
| bknudson | I thought we enhanced authtoken middleware to do version discovery... not sure when that was. | 13:39 |
| bknudson | so you shouldn't have to set the version | 13:39 |
| cnf | bknudson i agree, but my problem atm is i'm figuratively drowning, i don't know what is a bug, and what is me doing weird stuff | 13:39 |
| cnf | bknudson yeah, i don't need to even set a value | 13:40 |
| cnf | just auth_version=, nothing after the = | 13:40 |
| bknudson | oh, so it was set to v2? | 13:40 |
| cnf | no, it wasn't set anywhere i can see | 13:40 |
| cnf | a grep in /etc/nova for auth_version only show the one I _added_ | 13:41 |
| cnf | it wasn't there a few minutes ago | 13:41 |
| dstanek | bknudson: yeah, at least in the modern lib it doesn't need an explicit version set | 13:42 |
| cnf | dstanek so following the install document on ubuntu doesn't give you the modern lib? | 13:43 |
| bknudson | you can compare your version of keystonemiddleware with the current version on pypi | 13:45 |
| bknudson | https://pypi.python.org/pypi/keystonemiddleware/4.9.0 | 13:45 |
| bknudson | pypi says we only get 69 downloads of keystonemiddleware per month! | 13:46 |
| bknudson | also, apparently the formatting of the README is off | 13:46 |
| dstanek | cnf: no idea. it depends on what it tells you to do. i've never used that install guide | 13:48 |
| cnf | keystonemiddleware-4.4.1.egg-info it seems | 13:49 |
| cnf | so a bit behind | 13:49 |
| *** ddieterly has joined #openstack-keystone | 13:49 | |
| bknudson | released 2016-05-23, so it's not that old... authtoken shouldn't require the version to be set at all. | 13:50 |
| *** ezpz has joined #openstack-keystone | 13:50 | |
| bknudson | maybe there's something else in nova that's using those config options | 13:50 |
| *** ddieterly has quit IRC | 13:51 | |
| *** ddieterly has joined #openstack-keystone | 13:51 | |
| *** michauds has joined #openstack-keystone | 13:52 | |
| dstanek | cnf: are you able to narrow down if it's nova or horizon? horizon does have a setting for identity versino | 13:53 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Keep the order of passwords in tests https://review.openstack.org/366766 | 13:54 |
| breton | rderose: ^ the patch | 13:54 |
| rderose | breton: nice fix, that should work | 13:55 |
| rderose | breton: thanks | 13:55 |
| *** rcernin has joined #openstack-keystone | 13:57 | |
| *** wangqun has quit IRC | 14:01 | |
| *** spedione|AWAY is now known as spedione | 14:03 | |
| *** ayoung has quit IRC | 14:03 | |
| *** rodrigods has quit IRC | 14:06 | |
| *** rodrigods has joined #openstack-keystone | 14:06 | |
| samueldmq | morning keystone | 14:09 |
| *** adrian_otto has joined #openstack-keystone | 14:11 | |
| cnf | dstanek it was nova | 14:11 |
| cnf | dstanek horizon just does very freaky stuff if some stuff in the backend fails | 14:11 |
| cnf | such as kick you out, and not let you log back in, unless you edit the url | 14:12 |
| cnf | very confusing, that | 14:12 |
| cnf | bknudson i'm happy to help you find what, but my openstack / keystone knowledge is rather limited | 14:12 |
| *** javis has joined #openstack-keystone | 14:13 | |
| *** GB21 has joined #openstack-keystone | 14:14 | |
| *** SamYaple_ has joined #openstack-keystone | 14:15 | |
| dstanek | cnf: that is so strange. i have not seen that before | 14:15 |
| *** BjoernT has joined #openstack-keystone | 14:16 | |
| cnf | dstanek :P | 14:17 |
| *** adrian_otto has quit IRC | 14:20 | |
| *** asettle has quit IRC | 14:20 | |
| *** eandersson has quit IRC | 14:20 | |
| *** pnavarro has quit IRC | 14:20 | |
| *** Gorian has quit IRC | 14:20 | |
| *** SamYaple has quit IRC | 14:20 | |
| *** stian_ has quit IRC | 14:20 | |
| *** darrenc has quit IRC | 14:20 | |
| *** anteaya has quit IRC | 14:20 | |
| *** jidar has quit IRC | 14:20 | |
| *** su_zhang has quit IRC | 14:20 | |
| *** su_zhang has joined #openstack-keystone | 14:21 | |
| cnf | right, that one line has fixed a whole bunch of weird things in horizon | 14:22 |
| *** henrynash_ is now known as henrynash | 14:25 | |
| stevemar | o/ | 14:25 |
| *** su_zhang has quit IRC | 14:26 | |
| *** ravelar has joined #openstack-keystone | 14:30 | |
| *** chrisshattuck has joined #openstack-keystone | 14:30 | |
| *** EinstCrazy has joined #openstack-keystone | 14:30 | |
| *** chrisshattuck has quit IRC | 14:31 | |
| *** adrian_otto has joined #openstack-keystone | 14:33 | |
| *** woodburn has quit IRC | 14:34 | |
| *** dikonoor has quit IRC | 14:35 | |
| *** adrian_otto has quit IRC | 14:36 | |
| *** GB21 has quit IRC | 14:39 | |
| *** eandersson has joined #openstack-keystone | 14:39 | |
| *** asettle has joined #openstack-keystone | 14:42 | |
| *** pnavarro has joined #openstack-keystone | 14:42 | |
| *** Gorian has joined #openstack-keystone | 14:42 | |
| *** stian_ has joined #openstack-keystone | 14:42 | |
| *** darrenc has joined #openstack-keystone | 14:42 | |
| *** anteaya has joined #openstack-keystone | 14:42 | |
| *** jidar has joined #openstack-keystone | 14:42 | |
| *** hoonetorg has quit IRC | 14:43 | |
| *** woodburn has joined #openstack-keystone | 14:43 | |
| *** Gorian has quit IRC | 14:44 | |
| dstanek | cnf: getting closer | 14:45 |
| dstanek | stevemar! | 14:46 |
| *** ayoung has joined #openstack-keystone | 14:48 | |
| *** ChanServ sets mode: +v ayoung | 14:48 | |
| *** joerch has quit IRC | 14:48 | |
| *** adrian_otto has joined #openstack-keystone | 14:49 | |
| *** chrisshattuck has joined #openstack-keystone | 14:49 | |
| *** Gorian has joined #openstack-keystone | 14:50 | |
| *** adrian_otto1 has joined #openstack-keystone | 14:52 | |
| *** adrian_otto has quit IRC | 14:55 | |
| *** hoonetorg has joined #openstack-keystone | 14:57 | |
| *** spzala has joined #openstack-keystone | 14:58 | |
| *** EinstCrazy has quit IRC | 15:01 | |
| *** sdake has joined #openstack-keystone | 15:03 | |
| *** sdake has quit IRC | 15:08 | |
| *** topol_ has quit IRC | 15:08 | |
| stevemar | dstanek: ahoy matey | 15:13 |
| cnf | how do list role members? | 15:22 |
| *** sdake has joined #openstack-keystone | 15:24 | |
| dstanek | breton: where you running into problems for the password create_at date in tests? | 15:27 |
| *** EinstCrazy has joined #openstack-keystone | 15:27 | |
| dstanek | stevemar: last day before vacation right? | 15:27 |
| *** gagehugo has joined #openstack-keystone | 15:28 | |
| breton | dstanek: i ran into the problem while poking patch 347972 | 15:32 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Keep the order of passwords in tests https://review.openstack.org/366766 | 15:32 |
| *** stevemar_ has joined #openstack-keystone | 15:33 | |
| *** ChanServ sets mode: +o stevemar_ | 15:33 | |
| dstanek | breton: cool, thanks. that's all i was wondering | 15:34 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Keep the order of passwords in tests https://review.openstack.org/366766 | 15:34 |
| *** stevemar_ has quit IRC | 15:34 | |
| samueldmq | cnf: role members ? | 15:34 |
| samueldmq | cnf: you can list role assignments and see what users are assigned what roles | 15:34 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Make fetching all foreign keys in a join https://review.openstack.org/347972 | 15:34 |
| stevemar | dstanek: yeah, for you! | 15:35 |
| stevemar | dstanek: i'm not due for a vacation for a while | 15:35 |
| *** ddieterly is now known as ddieterly[away] | 15:35 | |
| breton | i hoped our bot to post a link to the review | 15:35 |
| breton | patch 347972 | 15:35 |
| samueldmq | cnf: try GET /v3/role_assignments. there are also a bunch of filters available, you may want to filter based on a role with ?role_id=<role_id> | 15:35 |
| breton | no? :( | 15:35 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Introduce null key for credential encryption https://review.openstack.org/366831 | 15:35 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Log warning if null key is used for encryption https://review.openstack.org/366832 | 15:35 |
| dstanek | stevemar: oh, i thought you said that you were off Thurs/Fri this week | 15:36 |
| lbragstad | dolphm ayoung ^ | 15:36 |
| lbragstad | EmilienM if you're around ^ | 15:36 |
| dolphm | lbragstad: awesome | 15:36 |
| EmilienM | lbragstad: I am | 15:36 |
| EmilienM | lbragstad: let me look | 15:36 |
| *** ravelar has quit IRC | 15:36 | |
| ayoung | lbragstad, nice. We'll keep that effort going, but probably should run past the TC whether this is the right call...and past Security group. I would think a mailing list posting is due. | 15:37 |
| lbragstad | dolphm still working though one piece and that is the doctor check to see if anything is encrypted with the null key | 15:37 |
| ayoung | EmilienM, I'd rather we got your changes in | 15:37 |
| breton | lbragstad: will the check be dropped right after stable/newton cut? | 15:37 |
| breton | lbragstad: *the null keys | 15:37 |
| breton | *will the null keys be dropped right after stable/newton cut? | 15:38 |
| *** david-lyle_ has joined #openstack-keystone | 15:38 | |
| *** ddieterly[away] is now known as ddieterly | 15:38 | |
| EmilienM | lbragstad: sounds good. My stuff in tripleo is about to merge in a few hours | 15:38 |
| *** david-lyle_ has quit IRC | 15:38 | |
| *** hoonetorg has quit IRC | 15:38 | |
| lbragstad | breton well - we could but we could also issue a deprecate warning | 15:38 |
| lbragstad | EmilienM cool - you guys should be good to go then? | 15:38 |
| lbragstad | deprecation warning* | 15:38 |
| EmilienM | lbragstad: probably | 15:38 |
| *** su_zhang has joined #openstack-keystone | 15:39 | |
| breton | wait, i don't understand it | 15:40 |
| breton | does the null key always get appended? | 15:40 |
| lbragstad | breton nope - it's only appended for the credential use key | 15:41 |
| lbragstad | usecase( | 15:41 |
| lbragstad | * | 15:41 |
| * lbragstad clearly can't type | 15:41 | |
| *** chlong has quit IRC | 15:41 | |
| breton | lbragstad: if i create real keys for the credentials, will the null key still work? | 15:41 |
| lbragstad | breton if you create real keys, the real keys will be used to encrypt and decrypt things | 15:42 |
| lbragstad | the null key will still be appended to the keys list, but never used for anything | 15:42 |
| *** hoonetorg has joined #openstack-keystone | 15:42 | |
| dolphm | lbragstad: except decryption, in the event there are any credentials still encrypted with it | 15:43 |
| dolphm | breton: ^ | 15:43 |
| *** adrian_otto1 has quit IRC | 15:43 | |
| lbragstad | dolphm breton yeah - that will allow operators to migrate *off* the null key | 15:43 |
| bknudson | why append the keys to the list if they're not going to be used? | 15:44 |
| breton | bknudson: that's the same thing i don't understand | 15:44 |
| *** adrian_otto has joined #openstack-keystone | 15:44 | |
| lbragstad | otherwise we will be inspecting all the credential key_hash values just to see if any of them need to use the null key | 15:46 |
| lbragstad | which doesn't seem very performant | 15:46 |
| lbragstad | just for populating a list of keys | 15:46 |
| breton | so... the credentials are ecnrypted with key = keys[0], right? | 15:48 |
| lbragstad | breton yes - https://github.com/pyca/cryptography/blob/master/src/cryptography/fernet.py#L135 | 15:48 |
| lbragstad | but that's an implementation detail of cryptography | 15:48 |
| breton | ok, i got it then. | 15:49 |
| bknudson | new credentials are encrypted with key[0]. The old ones might be any of the old keys. | 15:49 |
| lbragstad | up to one old key | 15:50 |
| lbragstad | with keystone-manage credential_rotate - we don't allow operators to do more than one rotation without a migration | 15:50 |
| bknudson | credential_rotate could re-encrypt creds using null keys | 15:51 |
| lbragstad | why's that? | 15:52 |
| bknudson | so that they wouldn't be used anymore | 15:52 |
| lbragstad | credential_migrate is the step that does the re-encryption | 15:52 |
| bknudson | ok. I'm not too worried about it. | 15:53 |
| breton | why are there 2 steps -- setup and migrate? | 15:56 |
| lbragstad | breton there are actually three steps - setup, migrate, and rotate | 15:58 |
| lbragstad | setup should only be used once to bootstrap a new repository | 15:59 |
| lbragstad | migrate is used to check all credentials in the backend and make sure they are all encrypted with the current primary key | 15:59 |
| lbragstad | and rotate verifies all the credentials are encrypted with the current primary key before introducing a new primary key | 16:00 |
| *** pcaruana has quit IRC | 16:01 | |
| *** su_zhang has quit IRC | 16:02 | |
| lbragstad | dolphm thoughts on pulling the credential_api into doctor? | 16:02 |
| *** su_zhang has joined #openstack-keystone | 16:02 | |
| *** EinstCrazy has quit IRC | 16:05 | |
| *** su_zhang_ has joined #openstack-keystone | 16:06 | |
| *** su_zhang has quit IRC | 16:07 | |
| *** EinstCrazy has joined #openstack-keystone | 16:07 | |
| *** su_zhang_ has quit IRC | 16:07 | |
| *** su_zhang has joined #openstack-keystone | 16:08 | |
| *** su_zhang has quit IRC | 16:08 | |
| *** su_zhang has joined #openstack-keystone | 16:08 | |
| *** su_zhang has quit IRC | 16:09 | |
| *** tesseract- has quit IRC | 16:09 | |
| *** su_zhang has joined #openstack-keystone | 16:09 | |
| *** su_zhang has quit IRC | 16:11 | |
| *** tqtran has joined #openstack-keystone | 16:11 | |
| *** chrisshattuck has quit IRC | 16:11 | |
| *** su_zhang has joined #openstack-keystone | 16:11 | |
| *** roxanaghe has joined #openstack-keystone | 16:12 | |
| *** chrisshattuck has joined #openstack-keystone | 16:14 | |
| *** su_zhang has quit IRC | 16:16 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add docs for the null key https://review.openstack.org/366854 | 16:16 |
| lbragstad | samueldmq responded - https://review.openstack.org/#/c/366831/1 | 16:16 |
| *** EinstCrazy has quit IRC | 16:16 | |
| *** gyee_ has joined #openstack-keystone | 16:17 | |
| *** ravelar has joined #openstack-keystone | 16:17 | |
| *** code-R_ has quit IRC | 16:19 | |
| *** tqtran has quit IRC | 16:20 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Log warning if null key is used for encryption https://review.openstack.org/366832 | 16:20 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add docs for the null key https://review.openstack.org/366854 | 16:20 |
| samueldmq | lbragstad: replied | 16:24 |
| lbragstad | samueldmq per your comment - make what valid | 16:26 |
| lbragstad | ? | 16:26 |
| samueldmq | lbragstad: are we planning to support another backend for the keys ? | 16:28 |
| lbragstad | there is a spec for it, yes | 16:29 |
| samueldmq | lbragstad: btw another comment in https://review.openstack.org/#/c/366832 (see if it makes sense) | 16:29 |
| samueldmq | lbragstad: ok, so I was just arguing that we put things inthe comment that will still be valid after we do it | 16:29 |
| breton | samueldmq: mnikolaenko works on it, i am going to discuss it with you at the summit. | 16:29 |
| samueldmq | lbragstad: so the implementer of the new backend won't need to find that doc and fix it | 16:29 |
| *** esp has joined #openstack-keystone | 16:30 | |
| samueldmq | lbragstad: I am talking about the python doc (first discussion there) | 16:31 |
| samueldmq | lbragstad: I am fine either way, not hard on that, just thought it would make more sense | 16:31 |
| *** ddieterly is now known as ddieterly[away] | 16:32 | |
| *** jaosorior has quit IRC | 16:33 | |
| *** gus has quit IRC | 16:33 | |
| lbragstad | samueldmq so is your concern that when we implement pluggable encryption backends this will be missed? | 16:33 |
| lbragstad | samueldmq responded - https://review.openstack.org/#/c/366832/2 | 16:34 |
| *** ayoung has quit IRC | 16:35 | |
| *** ddieterly[away] is now known as ddieterly | 16:35 | |
| samueldmq | lbragstad: ok, migrate from the null key to a proper key repo | 16:35 |
| lbragstad | samueldmq yep | 16:35 |
| samueldmq | lbragstad: I was associating that with the db migraiton | 16:35 |
| lbragstad | samueldmq makes sense | 16:36 |
| *** ayoung has joined #openstack-keystone | 16:36 | |
| *** ChanServ sets mode: +v ayoung | 16:36 | |
| samueldmq | lbragstad: the original migration adding columns etc, I mean | 16:36 |
| samueldmq | lbragstad: because the data will still be migrated (re-encrypted with new creds), right? | 16:36 |
| lbragstad | samueldmq the data migration during `keystone-manage db_sync --migrate` will encrypt all the credentials, yes | 16:37 |
| samueldmq | lbragstad: KK | 16:38 |
| samueldmq | thanks | 16:38 |
| ayoung | lbragstad, essentially, you have forced Tripleo to support Fernet, which, while painful, is a major accomplishment. | 16:38 |
| lbragstad | ... | 16:38 |
| lbragstad | you're welcome? | 16:38 |
| ayoung | lbragstad, thank you | 16:39 |
| ayoung | lbragstad, that said, I think the null key approach will be kind to all of the other distros out there | 16:39 |
| *** LamT_ has joined #openstack-keystone | 16:40 | |
| *** sigmavirus is now known as irvirus | 16:40 | |
| ayoung | as I said, we should ask the world at large (operators) whether this is something they will or won't want. Having a Null key might be a compliance liability, so lets confirm before we commit | 16:40 |
| *** irvirus is now known as sigmavirus | 16:40 | |
| lbragstad | well - it's sole purpose is to easy upgrades... if deployers want to make sure they are in compliance with whatever security requirements they need, they should be reading release notes and upgrading with a proper key_repository | 16:41 |
| lbragstad | ease* | 16:41 |
| *** gus has joined #openstack-keystone | 16:42 | |
| lbragstad | dstanek ping | 16:47 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Log warning if null key is used for encryption https://review.openstack.org/366832 | 16:51 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add docs for the null key https://review.openstack.org/366854 | 16:51 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Introduce null key for credential encryption https://review.openstack.org/366831 | 16:51 |
| dstanek | lbragstad: hiya | 16:51 |
| lbragstad | dstanek quick python 3 question | 16:52 |
| lbragstad | i think i figured it out - but curious if you would look at what I came up with | 16:52 |
| lbragstad | line 34 here - https://review.openstack.org/#/c/366831/1..2/keystone/common/fernet_utils.py,unified | 16:53 |
| lbragstad | was failing python34 tests without the encode() | 16:53 |
| lbragstad | i tested it locally on python27 and python34 - does it make sense? | 16:53 |
| *** ddieterly is now known as ddieterly[away] | 16:53 | |
| *** GB21 has joined #openstack-keystone | 16:54 | |
| *** ravelar has quit IRC | 16:55 | |
| dstanek | lbragstad: yeah i think so. b64 requires bytes and chr(0) returns text | 16:56 |
| *** topol_ has joined #openstack-keystone | 16:56 | |
| *** ChanServ sets mode: +v topol_ | 16:56 | |
| lbragstad | dstanek yeah - that's what it looked like it was failing on | 16:56 |
| dstanek | lbragstad: you could have just done b'\x00' * 32 | 16:56 |
| lbragstad | dstanek oh - true | 16:56 |
| *** slberger has joined #openstack-keystone | 16:58 | |
| *** pnavarro has quit IRC | 16:59 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Log warning if null key is used for encryption https://review.openstack.org/366832 | 17:02 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add docs for the null key https://review.openstack.org/366854 | 17:02 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Introduce null key for credential encryption https://review.openstack.org/366831 | 17:02 |
| *** ddieterly[away] is now known as ddieterly | 17:02 | |
| *** gyee_ has quit IRC | 17:03 | |
| openstackgerrit | Merged openstack/keystone: [api-ref] Correcting parameter's type https://review.openstack.org/365549 | 17:04 |
| lbragstad | dolphm does this still make sense to do now that we should never hit MultiFernet errors? https://bugs.launchpad.net/keystone/+bug/1619758/comments/4 | 17:05 |
| openstack | Launchpad bug 1619758 in OpenStack Identity (keystone) "Credential Encryption breaks deployments without Fernet" [Undecided,In progress] - Assigned to Lance Bragstad (lbragstad) | 17:05 |
| *** ddieterly is now known as ddieterly[away] | 17:06 | |
| breton | how do i run a test from MySQLOpportunisticIdentityDriverTestCase? | 17:07 |
| lbragstad | breton you have to bootstrap your mysql database with a specific openstack user | 17:07 |
| lbragstad | breton something like - GRANT ALL PRIVILEGES ON *.* TO 'openstack_citest' @'%' identified by 'openstack_citest' WITH GRANT OPTION; | 17:08 |
| lbragstad | the tests somehow hook into that and if that user is present, the mysql tests will be run... | 17:09 |
| lbragstad | same thing with postgres | 17:09 |
| breton | lbragstad: awesome, thank you | 17:12 |
| dstanek | lbragstad: breton: yes. the project config has a good example | 17:12 |
| lbragstad | breton no problem | 17:12 |
| *** gyee_ has joined #openstack-keystone | 17:12 | |
| *** gyee_ has joined #openstack-keystone | 17:13 | |
| breton | could you please run keystone.tests.unit.identity.backends.test_sql.MySQLOpportunisticIdentityDriverTestCase.test_change_password on your localhosts? | 17:13 |
| dstanek | breton: http://git.openstack.org/cgit/openstack-infra/project-config/tree/jenkins/jobs/macros.yaml#n871 | 17:13 |
| *** links has joined #openstack-keystone | 17:15 | |
| breton | it fails for me on master | 17:17 |
| *** jpena is now known as jpena|away | 17:19 | |
| *** mvk has quit IRC | 17:21 | |
| openstackgerrit | Merged openstack/keystone: Fix up some doc nits https://review.openstack.org/366481 | 17:22 |
| *** fangxu has joined #openstack-keystone | 17:23 | |
| *** ayoung has quit IRC | 17:27 | |
| *** asettle has quit IRC | 17:28 | |
| *** links has quit IRC | 17:29 | |
| breton | soooo, it fails on my localhost, but succeeds in a virtual machine | 17:31 |
| *** Marcellin__ has quit IRC | 17:37 | |
| dstanek | lbragstad: should the releasenote in support_encrypted_credentials_at_rest-93dcb67b3508e91a.yaml be update to say a credential repo *should* be created and mention the null key? | 17:37 |
| dstanek | lbragstad: also do we need to reach out to install guides and let them know about this change? | 17:38 |
| lbragstad | dstanek yeah - we do | 17:38 |
| lbragstad | dstanek we documented that stuff here - https://etherpad.openstack.org/p/keystone-credential-encryption-null-key | 17:38 |
| lbragstad | it's essentially a list of todos | 17:38 |
| dstanek | lbragstad: kk, let me know if you need any help | 17:39 |
| lbragstad | dstanek thanks for the reviews - did you see my last comment on https://review.openstack.org/#/c/366832/4 | 17:39 |
| *** harlowja has quit IRC | 17:46 | |
| dstanek | lbragstad: way ahead of you. trying to catch up on reviews a bit today | 17:47 |
| *** harlowja has joined #openstack-keystone | 17:49 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: New notes on advanced upgrade/fallback for cluster https://review.openstack.org/360733 | 17:49 |
| *** su_zhang has joined #openstack-keystone | 17:51 | |
| *** code-R has joined #openstack-keystone | 17:55 | |
| dstanek | lbragstad: also your commit messages are always too wide | 17:55 |
| *** code-R_ has joined #openstack-keystone | 17:56 | |
| lbragstad | dstanek do you have a vim trick that does that for you? | 17:57 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Log warning if null key is used for encryption https://review.openstack.org/366832 | 17:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add docs for the null key https://review.openstack.org/366854 | 17:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Introduce null key for credential encryption https://review.openstack.org/366831 | 17:58 |
| dstanek | lbragstad: yes, let me find it | 17:59 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Log warning if null key is used for encryption https://review.openstack.org/366832 | 17:59 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add docs for the null key https://review.openstack.org/366854 | 17:59 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Introduce null key for credential encryption https://review.openstack.org/366831 | 17:59 |
| *** code-R has quit IRC | 18:00 | |
| lbragstad | dstanek samueldmq all comments addressed ^ | 18:00 |
| *** code-R_ has quit IRC | 18:02 | |
| dstanek | lbragstad: actually i think it's all in fugitive. i used to have a simple ftplugin that i wrote, but it looks like i got rid of it | 18:06 |
| *** gagehugo has quit IRC | 18:12 | |
| *** code-R has joined #openstack-keystone | 18:14 | |
| *** code-R has quit IRC | 18:14 | |
| *** code-R has joined #openstack-keystone | 18:15 | |
| amakarov | colleagues, looks like we have some weird timezone issue | 18:15 |
| breton | yep, with passwords' created_at | 18:15 |
| *** chrisshattuck has quit IRC | 18:16 | |
| stevemar | rderose: amakarov whats up with https://bugs.launchpad.net/keystone/+bug/1620764 ? | 18:17 |
| openstack | Launchpad bug 1620764 in OpenStack Identity (keystone) "migration test fails on table addition" [Undecided,New] - Assigned to Ron De Rose (ronald-de-rose) | 18:17 |
| openstackgerrit | Sean Perry proposed openstack/keystone: Project domain must match role domain for assignment https://review.openstack.org/365177 | 18:17 |
| rderose | stevemar: not sure yet, been stuck in meetings all morning. planning to dig into this, this afternoon. | 18:18 |
| stevemar | rderose: coolio | 18:18 |
| amakarov | stevemar, either I'm doing something wrong or table don't gets created in migration tests | 18:18 |
| samueldmq | lbragstad: just an import to be removed there | 18:19 |
| samueldmq | lbragstad: other than that the chain looks good to me | 18:19 |
| amakarov | stevemar, I've just moved delegation model table creation to new migration repo and adjusted tests accordingly | 18:19 |
| *** ddieterly[away] is now known as ddieterly | 18:26 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: More nit doc fixes https://review.openstack.org/366900 | 18:28 |
| *** ravelar has joined #openstack-keystone | 18:29 | |
| *** code-R_ has joined #openstack-keystone | 18:32 | |
| *** ravelar has quit IRC | 18:34 | |
| *** code-R has quit IRC | 18:35 | |
| *** ddieterly is now known as ddieterly[away] | 18:35 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Log warning if null key is used for encryption https://review.openstack.org/366832 | 18:39 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add docs for the null key https://review.openstack.org/366854 | 18:39 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Introduce null key for credential encryption https://review.openstack.org/366831 | 18:39 |
| breton | https://bugs.launchpad.net/keystone/+bug/1621200 here is a fun bug | 18:39 |
| openstack | Launchpad bug 1621200 in OpenStack Identity (keystone) "MySQLOpportunisticIdentityDriverTestCase.test_change_password fails in UTC+N timezone" [Undecided,New] | 18:39 |
| *** ayoung has joined #openstack-keystone | 18:39 | |
| *** ChanServ sets mode: +v ayoung | 18:39 | |
| *** ddieterly[away] is now known as ddieterly | 18:41 | |
| *** su_zhang has quit IRC | 18:42 | |
| lbragstad | dstanek samueldmq addressed - thanks for all the reviews ^ | 18:42 |
| openstackgerrit | Sean Perry proposed openstack/keystone: Project domain must match role domain for assignment https://review.openstack.org/365177 | 18:44 |
| dstanek | lbragstad: np | 18:47 |
| lbragstad | dstanek do you recall if your caching work had an impact on https://review.openstack.org/#/c/314854/ ? | 18:48 |
| *** code-R_ has quit IRC | 18:48 | |
| *** tonytan4ever has quit IRC | 18:56 | |
| *** amakarov is now known as amakarov_away | 18:57 | |
| *** sdake has quit IRC | 19:02 | |
| *** javis has quit IRC | 19:04 | |
| *** clenimar has quit IRC | 19:10 | |
| *** sdake has joined #openstack-keystone | 19:10 | |
| breton | lbragstad: probably yes | 19:12 |
| breton | lbragstad: catalog was affected | 19:12 |
| breton | lbragstad: and now is fixed | 19:12 |
| *** su_zhang has joined #openstack-keystone | 19:13 | |
| *** joerch has joined #openstack-keystone | 19:14 | |
| harlowja | ayoung yt | 19:16 |
| harlowja | come in adam | 19:16 |
| harlowja | lol | 19:16 |
| ayoung | the number you have reached is no longer in service | 19:16 |
| *** su_zhang has quit IRC | 19:18 | |
| harlowja | ha | 19:18 |
| harlowja | soooooo | 19:18 |
| harlowja | can i volunteer u for a k8s + keystone-free-for-all kind of intro/questions and ... | 19:18 |
| harlowja | wink wink | 19:18 |
| harlowja | https://docs.google.com/document/d/1woLGRoONE3EBVx-wTb4pvp4CI7tmLZ6lS26VTbosLKM/ | 19:18 |
| harlowja | just was in that meeting | 19:18 |
| harlowja | and it basically boils down to (woah u guys are starting to make things like what keystone has, but well not enough people that know keystone, woah, let's talk about what we maybe think keystone does) | 19:19 |
| harlowja | then its like 'woah' maybe we should do this in a different meeting | 19:19 |
| harlowja | and woah maybe someone can get a keystone expert to do a q&a and such | 19:19 |
| harlowja | (and here we are) | 19:19 |
| harlowja | lol | 19:19 |
| openstackgerrit | Merged openstack/keystone: Keep the order of passwords in tests https://review.openstack.org/366766 | 19:20 |
| *** rcernin has quit IRC | 19:21 | |
| *** ddieterly is now known as ddieterly[away] | 19:21 | |
| *** ravelar has joined #openstack-keystone | 19:21 | |
| breton | > The Zoom Client for Linux allows you to start or join Zoom meetings on Ubuntu, Fedora, and many other Linux distributions. | 19:29 |
| *** mvk has joined #openstack-keystone | 19:29 | |
| breton | why couldn't they use something usual? | 19:30 |
| breton | harlowja: i'd love to participate there | 19:30 |
| breton | and i am actually hoping to contribute to k8s a little later | 19:31 |
| *** tqtran has joined #openstack-keystone | 19:32 | |
| *** fangxu has quit IRC | 19:37 | |
| harlowja | breton lol | 19:37 |
| harlowja | if someone wants to (adam or other) do a little intro, deep-dive, q&a i'd be very grateful to that person | 19:37 |
| harlowja | if that someone is interested in k8s thats cool to | 19:38 |
| harlowja | (answer not needed immediatly btw) | 19:39 |
| notmorgan | ayoung: If you think you have reached this recording in error, hang up and try your call again | 19:41 |
| harlowja | lol | 19:41 |
| notmorgan | harlowja: oh hai | 19:41 |
| harlowja | hey yo | 19:41 |
| notmorgan | when do you want someone to Q&A? | 19:42 |
| notmorgan | if it can be next week I can volunteer | 19:42 |
| notmorgan | this week i am sans laptop (lost power cable) and ~1000mi from home | 19:42 |
| harlowja | i think that can be fine/work | 19:42 |
| notmorgan | driving back to PDX on friday | 19:42 |
| harlowja | wth, u only allowed to bike back | 19:42 |
| harlowja | lol | 19:42 |
| notmorgan | harlowja: are you in the bay area? or you in CO? or some other location? | 19:43 |
| harlowja | i am all around u | 19:43 |
| harlowja | lol | 19:43 |
| ayoung | harlowja, Keystone sucks. Avoid it at all costs. | 19:43 |
| harlowja | i am in the sky, in the earth | 19:43 |
| notmorgan | eh, socal -> PDX = long bike ride | 19:43 |
| ayoung | The problem, of course, is that you cannot avoid it. | 19:43 |
| notmorgan | but it's actually a nice drive if you avoid I5 | 19:43 |
| harlowja | i'm in bay area | 19:43 |
| harlowja | :-P | 19:43 |
| ayoung | harlowja, I had a slew of specs that were designed just to solve this problem. They all died in committee | 19:44 |
| notmorgan | harlowja: i'll ping you, maybe grab a drink or some such saturday when I'm there. | 19:44 |
| notmorgan | ayoung: you can blame me for all of the fails :P | 19:44 |
| harlowja | hmmmm, might be outside climbing on saturday :-/ | 19:44 |
| harlowja | move that to sunday, lol | 19:44 |
| notmorgan | harlowja: damn and I don't have my gear with me. | 19:44 |
| *** ddieterly[away] is now known as ddieterly | 19:44 | |
| ayoung | notmorgan, I think it was jamielennox|away that killed them, actually | 19:44 |
| notmorgan | actually... i just need to get new climbing gear (hey ayoung, that "just" was "just" for you ;) | 19:45 |
| ayoung | the idea of externalizing the mapping, getting rid of the need to got to keystone to get a token first, but still doing the mapping and rolle look up | 19:45 |
| ayoung | notmorgan, always happy to talk about climbing gear | 19:45 |
| notmorgan | ayoung: i think i killed part of it but not permanently, more of a "fix X first" | 19:45 |
| notmorgan | i am almost tempted to swing up to yosemite on my way back north | 19:45 |
| ayoung | notmorgan, you might have wounded it, but working on Tripleo and getting priorities from elsewhere really killed it | 19:45 |
| notmorgan | except how croweded it will be | 19:46 |
| ayoung | notmorgan, got to Yose | 19:46 |
| ayoung | that just means yhou are more likely to find a climbing party | 19:46 |
| notmorgan | and that i don;t have a camp ground and gear. | 19:46 |
| harlowja | u can do some hiking i guess | 19:46 |
| ayoung | perfect time of year to climb | 19:46 |
| ayoung | harness and shoes are all you need | 19:46 |
| notmorgan | yeah i need to buyt new ones | 19:46 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: POC sql query revoked tokens https://review.openstack.org/359371 | 19:46 |
| ayoung | there is a rock shop in Yose | 19:46 |
| notmorgan | my shoes stiching and rubber came apart. | 19:46 |
| ayoung | prices are not too jacked up | 19:46 |
| notmorgan | eh, i think i want to get back out and in shape again | 19:47 |
| harlowja | ya, come on guys | 19:47 |
| notmorgan | i'll prob just hit a climbing gym in PDX when i get home | 19:47 |
| harlowja | stop being bums with kids and stuff | 19:47 |
| harlowja | lol | 19:47 |
| * notmorgan has no kids | 19:47 | |
| harlowja | planet granite is in PDX now | 19:47 |
| ayoung | you don't need to be in climbing shape to do the ROyal Arches. Just cardio | 19:47 |
| * notmorgan has medical issues that *finally* are getting dealt with today. | 19:47 | |
| harlowja | (planet granite == bay area gym) | 19:47 |
| ayoung | harlowja, I got up Moby Grape this summer, at least | 19:47 |
| harlowja | cools | 19:48 |
| notmorgan | ayoung: i want to go do snake dike | 19:48 |
| notmorgan | ayoung: http://www.supertopo.com/rock-climbing/Yosemite-Valley-Half-Dome-Snake-Dike | 19:48 |
| ayoung | notmorgan, also do not need to be in shape for that. Nor do you need much gear | 19:48 |
| harlowja | ya, i'll do that with u if can get a solid time :-P | 19:48 |
| ayoung | 5 quickdraws IIRC | 19:48 |
| harlowja | i got more than 5 | 19:48 |
| harlowja | lol | 19:48 |
| ayoung | 2 for each anchor, and one for the bolt in the middle | 19:48 |
| notmorgan | ayoung: i think it was 7 quick draws last time my buddy went but he over-did the protection | 19:48 |
| notmorgan | but basically yeah | 19:49 |
| *** chrisshattuck has joined #openstack-keystone | 19:49 | |
| *** kfox1111 has joined #openstack-keystone | 19:49 | |
| harlowja | ya, i'll do it | 19:49 |
| ayoung | speaking of Crowded....count the nuimber of parties http://younglogic.com/jessandadam/Pictures/2001-2002/halfdome/tn/p1010007.jpg.html | 19:49 |
| harlowja | can drag some others along probably to | 19:49 |
| notmorgan | ayoung: my goal is to go do SE Butress on Cathedral Peak one day, Snake Dike the next, then some hiking up mist trail | 19:50 |
| ayoung | All good climbs | 19:50 |
| ayoung | SE Butt significantly harder | 19:50 |
| notmorgan | up and back + summit of cathedral peak, camp in Tuolumne | 19:50 |
| notmorgan | yeah. | 19:50 |
| harlowja | so perhaps breton notmorgan next wed, like 11am PST? | 19:50 |
| notmorgan | 5.9 ish iirc | 19:50 |
| ayoung | oh...that one | 19:50 |
| ayoung | I was thinkg East Butt of Higher Cathedral | 19:50 |
| notmorgan | well, you can continue up | 19:51 |
| ayoung | SE of Catherdral Peak is a highway | 19:51 |
| ayoung | lots of people, soloists | 19:51 |
| ayoung | onkly issue therei s the altitude | 19:51 |
| notmorgan | oh wait | 19:51 |
| notmorgan | no, the 5.9 one not SE | 19:51 |
| ayoung | Eichorn, on the other end, much more fun climb | 19:51 |
| kfox1111 | harlowja: I've been trying to kind of educate the k8s folks on keystone for a while now. | 19:51 |
| notmorgan | SE is 5.6 | 19:51 |
| harlowja | ayoung if u intersted also, u more than welcome to join ;) | 19:51 |
| harlowja | kfox1111 no doubt | 19:51 |
| notmorgan | harlowja: yeah wednesday works for me | 19:51 |
| harlowja | i applaud your efforts kfox1111 | 19:51 |
| ayoung | http://younglogic.com/jessandadam/Pictures/2003/EichornPinnacle/ | 19:51 |
| harlowja | and give u a hug | 19:51 |
| harlowja | ha | 19:51 |
| ayoung | harlowja, I want the Nose. | 19:51 |
| harlowja | ya, me to | 19:52 |
| kfox1111 | thx. :) | 19:52 |
| ayoung | http://adam.younglogic.com/2011/06/fear/ | 19:52 |
| harlowja | ayoung maybe if we actually plan far enough ahead, we could do it | 19:52 |
| notmorgan | ayoung: South Face - thats the one | 19:52 |
| notmorgan | ayoung: 5.8 | 19:52 |
| harlowja | i don't currently know enough people that could do the nose :-P | 19:52 |
| harlowja | (or try to do the nose) | 19:52 |
| notmorgan | harlowja: i wish i was in shape for the nose | 19:52 |
| harlowja | (or have the gear to try to do the nose) | 19:52 |
| notmorgan | or ... ANY route on el cap | 19:52 |
| kfox1111 | notmorgan: some back story... | 19:52 |
| harlowja | ya, kfox1111 is the k8s historian for this stuff :) | 19:53 |
| ayoung | harlowja, Just logisitics | 19:53 |
| *** tonytan4ever has joined #openstack-keystone | 19:53 | |
| harlowja | ya, logistics also | 19:53 |
| kfox1111 | they don't have multitenancy really yet and they are starting to push ahead to get there. | 19:53 |
| ayoung | you really don't have to climb that hard, just know that you are going to aid the tough stuff | 19:53 |
| ayoung | hauling the pig | 19:53 |
| harlowja | man, aiding | 19:53 |
| harlowja | jeez, killing me man, lol | 19:53 |
| ayoung | ok...back the K8s | 19:53 |
| kfox1111 | but not having done it before, they are still really thinking in terms of one authentication plugin that's as simple as 'username/password' and dabling a bit with 'groups'. | 19:53 |
| notmorgan | kfox1111: ah | 19:53 |
| ayoung | had someone internally bugging me about K8s and Keystone yesterday | 19:53 |
| notmorgan | kfox1111: oh yeah don't back yourself into that corner to start :P | 19:54 |
| notmorgan | a little bit more rich of a architecture opening future development is a must | 19:54 |
| kfox1111 | then implemented an rbac system on top of that, maping group to api roles, so kind of like the oslo policy stuff. | 19:54 |
| notmorgan | ouch. so basically didn't look at keystone history :( | 19:54 |
| ayoung | kfox1111, Keystone can give you the roles. | 19:54 |
| kfox1111 | notmorgan: yeah. they are making all the same mistakes again as they don't have experience with it yet. I was hoping to head that off. | 19:54 |
| ayoung | Need the policy engine, but K8s got that already | 19:54 |
| notmorgan | yeah lets help them not do that | 19:55 |
| kfox1111 | yup. what I kind of want is, | 19:55 |
| kfox1111 | kube to accept keystone tokens, | 19:55 |
| kfox1111 | (scoped) | 19:55 |
| ayoung | kfox1111, nah | 19:55 |
| ayoung | just auth right to K8s | 19:55 |
| ayoung | do the mapping and role lookup from k8s | 19:55 |
| kfox1111 | and then use their rbac system as a oslo policy replacement mapping keystone roles to api calls. | 19:55 |
| ayoung | exactly | 19:55 |
| notmorgan | kfox1111: that sounds like 100% the right approach | 19:56 |
| kfox1111 | then the kubernetes system can be integrated with the openstack dashboard and heat easily. | 19:56 |
| notmorgan | clearly needs some details filled in | 19:56 |
| notmorgan | but solid | 19:56 |
| ayoung | kfox1111, if you want, the user can pass userid/p[assword to k8s, k8s gets a token, ignores it, and just uses the token request response | 19:56 |
| notmorgan | and avoids the ick of openstack AuthZ. | 19:56 |
| harlowja | ya, it gets more complicated cause there are things idk about k8s and there visions for RBAC also | 19:56 |
| notmorgan | without being incompat | 19:56 |
| notmorgan | i like it | 19:56 |
| ayoung | need to get the roles into Keystone. Use implied roles to map K8s roles to Admin/member | 19:57 |
| kfox1111 | ayoung: thats what they did. | 19:57 |
| kfox1111 | but on a multitenant cloud like ours, that lets everyone in the whole organization do anything. :/ | 19:57 |
| kfox1111 | We already have projects/roles in keystone and just want to reuse them. | 19:57 |
| notmorgan | kfox1111: thats a reasonable expectation | 19:58 |
| notmorgan | and should be doable | 19:58 |
| kfox1111 | I want to basically do an OS_TOKEN=$(openstack token get); | 19:58 |
| kfox1111 | then# kubectl get pod | 19:58 |
| notmorgan | ayoung: expect some code drops from me next week. | 19:58 |
| kfox1111 | for my users. | 19:59 |
| notmorgan | ayoung: i was going to do it this week but lacking a power cable for mylaptop and unable to just "buy" one at like bestbuy... | 19:59 |
| kfox1111 | or better, kubectl does thet token get if ones not there. | 19:59 |
| kfox1111 | so kubectl would work like any other openstack command. | 19:59 |
| kfox1111 | notmorgan: so, the moral of the story, they are thinking totally from the k8s is an island kind of thing, | 20:00 |
| notmorgan | kfox1111: i would be inclined to start with a simple wrapper POC that grabs the token | 20:00 |
| ayoung | kfox1111, so the thing keystone gives you is a link between the k8s and openstack view of auth. Not sure that makes sense for most users. There are a couple use cases where it makes sense to integrate them, but even there I would be less than thrilled | 20:00 |
| kfox1111 | and we're looking for a k8s is a proper openstack service thing. | 20:00 |
| notmorgan | kfox1111: before baking in any other magic that should be based on OCC | 20:00 |
| lbragstad | sweet - I'll dig for those bug numbers | 20:00 |
| ayoung | didn't they have a project for that? | 20:00 |
| ayoung | kuryr or soemthing? | 20:00 |
| notmorgan | kfox1111: but do it in stages and build it up | 20:00 |
| notmorgan | lbragstad: oh hai | 20:00 |
| ayoung | No, not that... | 20:00 |
| notmorgan | ayoung: yeah it isn;t that | 20:01 |
| kfox1111 | occ? | 20:01 |
| notmorgan | kfox1111: os-client-config? | 20:01 |
| ayoung | Magnum | 20:01 |
| kfox1111 | oh. yeah. | 20:01 |
| ayoung | its Beautiful! | 20:01 |
| notmorgan | kfox1111: it has all the shade logic in it. | 20:01 |
| notmorgan | kfox1111: which if you're doing "get me a token"... use it if in python | 20:01 |
| notmorgan | oh please use it | 20:01 |
| ayoung | http://cdn.quotesgram.com/small/98/10/1625414547-Zoolander-Magnum.png | 20:01 |
| lbragstad | notmorgan o/ | 20:01 |
| kfox1111 | notmorgan: fyi: https://github.com/kubernetes/kubernetes/pull/25391 | 20:01 |
| kfox1111 | I actually got all the server bits working. but its kind of stuck deciding how to map openstack constructs to k8s ones. | 20:02 |
| kfox1111 | part of the problem is the two projets use similar terms very differently. | 20:02 |
| kfox1111 | for us, role is just a string. | 20:02 |
| kfox1111 | for them, its a complicated rbac construct. | 20:02 |
| ayoung | kfox1111, so, in most cases, k8s is separate from OpenStack | 20:02 |
| notmorgan | ayoung: The man has only one look for Christ's sake! Blue Steel, Ferrari, Le Tigre? They're the same face! Doesn't anyone notice this?! I feel like I'm taking crazy pills. | 20:03 |
| ayoung | it is an app that runs on top of it | 20:03 |
| kfox1111 | ayoung: only so far. ;) | 20:03 |
| kfox1111 | not the way I want to deplyu it. ;) | 20:03 |
| kfox1111 | I want to replace nova with it. ;) | 20:03 |
| notmorgan | kfox1111: oh interesting | 20:03 |
| ayoung | kfox1111, are you going to use a container to deploy a virtual machine? | 20:03 |
| lbragstad | dstanek samueldmq mind doing follow ups on https://review.openstack.org/#/c/366831/ ? | 20:03 |
| kfox1111 | or at least have a seperate nova pool and k8s pool for my users. | 20:03 |
| lbragstad | since that's the first patch in the chain | 20:03 |
| notmorgan | kfox1111: if you don't need multi-tenancy, raw k8s is ok | 20:03 |
| kfox1111 | ayoung: kolla-kubernetes. :) | 20:03 |
| *** gyee_ has quit IRC | 20:04 | |
| notmorgan | otheriwse you might need the bay (magnum parlance) model | 20:04 |
| dstanek | lbragstad: nope, it's on my list. just going through things in gertty order | 20:04 |
| *** openstackgerrit has quit IRC | 20:04 | |
| lbragstad | dstanek thanks | 20:04 |
| *** openstackgerrit has joined #openstack-keystone | 20:04 | |
| kfox1111 | yeah, a bay is a heavy handed way to provide simulated multitenancy. | 20:04 |
| * lbragstad cranks 'The Chain' by fleetwood mac | 20:04 | |
| *** BjoernT has quit IRC | 20:04 | |
| notmorgan | kfox1111: it's not that heavy | 20:04 |
| kfox1111 | k8s is working on native multitenancy. | 20:04 |
| ayoung | lbragstad, listening to the Billy Joel discography in chronologic order myself | 20:05 |
| kfox1111 | notmorgan: heavy in that two tenants don't share vm's with kube on them. | 20:05 |
| lbragstad | ayoung +2 | 20:05 |
| notmorgan | kfox1111: it's about 2% overhead ftr. but it fills the gap until native multitenancy | 20:05 |
| kfox1111 | multitenancy across a single bare metal cloud would be much more efficient. | 20:05 |
| ayoung | Rootbeer Rag just came on | 20:05 |
| *** spzala has quit IRC | 20:05 | |
| kfox1111 | notmorgan: not talking about cpu overhead, more memory utilizatoin. | 20:05 |
| notmorgan | kfox1111: even less overhead there with a minimal OS. | 20:06 |
| *** spzala has joined #openstack-keystone | 20:06 | |
| kfox1111 | the extra vm layers tend to consume lots of extra memory, meaning you cant pack as much. | 20:06 |
| notmorgan | kfox1111: but it takes some careful crafting | 20:06 |
| kfox1111 | yeah. | 20:06 |
| notmorgan | kfox1111: i've seen ~1% overhead on memory | 20:06 |
| notmorgan | but it needs to be a good image | 20:06 |
| notmorgan | not "stock centos" | 20:06 |
| notmorgan | or some such | 20:06 |
| kfox1111 | anyway, the k8s folks are working on proper multitenancy, and this is part of it. | 20:06 |
| * kfox1111 nods | 20:06 | |
| notmorgan | fair enough | 20:06 |
| kfox1111 | plus, magnum integration. | 20:07 |
| notmorgan | i'm curious how it's going to play at the kernel level bvecause that isthe big concern in containers and multitenancy | 20:07 |
| notmorgan | less about the API | 20:07 |
| kfox1111 | the deployed by magnum k8s cluster should be able to use the existing keystone and restrict access to just the tenant that deployed it. | 20:07 |
| * notmorgan nods. | 20:07 | |
| kfox1111 | then the user doesn't have to deal with a whole nother authz/authn system. | 20:07 |
| notmorgan | i think we can come up with a way to bridge them | 20:07 |
| bknudson | when we were in boston for the meetup billy joel was having a concert at fenway | 20:07 |
| kfox1111 | notmorgan: part of that is how much you trust your tenants. :) | 20:07 |
| notmorgan | the key is really coming down to unpacking the token. | 20:07 |
| kfox1111 | public cloud, not so much. | 20:08 |
| notmorgan | kfox1111: zero trust of any user of any api | 20:08 |
| notmorgan | kfox1111: even in private clouds. | 20:08 |
| kfox1111 | when you can fire users that do something horible, thats a different level of isolation. | 20:08 |
| notmorgan | kfox1111: architect for security, saves headaches down the line | 20:08 |
| kfox1111 | agreed. | 20:08 |
| notmorgan | but i also *might* be in the minority overall | 20:08 |
| kfox1111 | but the risks with containers are, it *should* be safe, but there may be bugs... | 20:08 |
| kfox1111 | same was true of vm's, but *should* be a little more isolated, so maybe safer.... | 20:09 |
| *** scarlisle has quit IRC | 20:09 | |
| kfox1111 | Its not for me to decide if container multitenancy is right for a given org over vm isolation. | 20:09 |
| kfox1111 | its probably ok for some and not others. | 20:09 |
| kfox1111 | I know they are also working on node level isolation. | 20:10 |
| *** spzala has quit IRC | 20:10 | |
| kfox1111 | sharing a single kube control plane, but land different tenants on different pools of nodes. | 20:10 |
| kfox1111 | that might be a good middleground. | 20:10 |
| kfox1111 | oh. meeting time. gtg. bbiab | 20:11 |
| ayoung | kfox1111, can you throw me the link for the k8s review? | 20:19 |
| ayoung | https://github.com/kubernetes/kubernetes/pull/25391 | 20:20 |
| ayoung | FOUND IT | 20:20 |
| ayoung | kfox1111, liggett grabbed me yesterday to talk it through | 20:20 |
| ayoung | lets see if we can get him here... | 20:21 |
| ayoung | kfox1111, I assured him you and harlowja actually knew enough about Keystone to be dangerous | 20:23 |
| *** su_zhang has joined #openstack-keystone | 20:23 | |
| harlowja | lol | 20:23 |
| ayoung | so, there were 3 use cases | 20:23 |
| ayoung | 1 was "kubernetes inside a project" | 20:23 |
| * harlowja reading backlog | 20:23 | |
| ayoung | 2 was "kerbernetes across multiple related projects" | 20:24 |
| ayoung | and 3 was "kubernetes as a service" | 20:24 |
| ayoung | and by that last, I mean that a kube instance could talk to VMs in multiple projects, where there was no relationship between the projects | 20:24 |
| ayoung | kubernetes inisde a proejct can be, I hope, completely divided from Keystone for most people | 20:25 |
| harlowja | i may or may not have put to much commentary on that PR, lol | 20:25 |
| harlowja | ayoung i hope so also | 20:25 |
| ayoung | it as 2 that is interesting...using Hierarchical multitenancy in Keystone to deal with a Kube instance that spanned multiple porjects | 20:25 |
| ayoung | harlowja, so...I tend to look at things from an Enterprise perspective, as opposed to the RAXers here who look at hosted or puiblic cloud. From my customer cases, it is almost all users in AD or LDAP | 20:26 |
| harlowja | right, that's my use-case currently | 20:26 |
| ayoung | so, if Kubernetes can do LDAP, and maintain the equivalent of role assignments itself | 20:26 |
| ayoung | you don't link Kube and Keystone | 20:27 |
| ayoung | the real need to link is where workflow needs a common view of things | 20:27 |
| harlowja | thats an option, yes, perhaps the best one (though it sucks in that u have roles in some place, roles in another, disjoint views on RBAC) | 20:27 |
| ayoung | but even then, you can have Kube talk direct to LDAP for Auth | 20:27 |
| harlowja | right | 20:28 |
| ayoung | but then Kube roles and Keystone roles have no relationship | 20:28 |
| ayoung | so, assuming you use Keystone to manage roles, what you need to do is to be able to get an LDAP user, and figure out what Keystojne calls her, and then get her role assignments | 20:28 |
| ayoung | fetching a token implies that the user passed the PW to Kube | 20:28 |
| *** pauloewerton has quit IRC | 20:29 | |
| ayoung | which is normal, and also horribly wrong | 20:29 |
| ayoung | so, let's say the you run Kube behind mod_auth_gssapi and use Kerberos to auth to it | 20:29 |
| harlowja | k | 20:30 |
| harlowja | i'm with u | 20:30 |
| harlowja | then that solves the auth is different, but uses a similar/same backend as keystone | 20:32 |
| harlowja | so likely a unified thing say providing a view on both would just have 2 tokens then | 20:32 |
| ayoung | so if you do Kerberos, the thing you want is to get the mapping | 20:33 |
| ayoung | then you could use Keystone to manage the role assignments for both OPenstack and Kube | 20:33 |
| ayoung | you could also to S4U2 proxy and have Kuber request a token for the user | 20:33 |
| harlowja | woah | 20:34 |
| harlowja | is that a new U2 song? | 20:34 |
| harlowja | lol | 20:34 |
| harlowja | so in theory it seems ok, this is where it gets into details though that i can't quite figure out | 20:35 |
| harlowja | like where is k8s trying to go in terms of RBAC | 20:35 |
| harlowja | are they dead-set on (make ours?) | 20:35 |
| ayoung | when you get a token, use that to set roles. | 20:36 |
| kfox1111 | back. | 20:36 |
| ayoung | Otherwise, let Kubernetes dictate roles | 20:37 |
| *** BjoernT has joined #openstack-keystone | 20:37 | |
| kfox1111 | I think kube roles should be treated like oslo.policy rules. | 20:37 |
| openstackgerrit | Merged openstack/keystone: More nit doc fixes https://review.openstack.org/366900 | 20:37 |
| kfox1111 | then I can use keystone roles on my users/projects and map those roles to api permissions. | 20:37 |
| ayoung | kfox1111, please keep a civil tongue in your mouth | 20:37 |
| kfox1111 | ayoung: sorry. :) | 20:38 |
| ayoung | Heh | 20:38 |
| ayoung | nah, I think I agree with what you are saying | 20:38 |
| harlowja | oslo.policy is the best | 20:38 |
| harlowja | haha | 20:38 |
| ayoung | Kube should use the Keystone roles as the input. Using Im,plied roles, you could convert "_member_" to "kubernetes_editor" or whatever it isi | 20:39 |
| harlowja | (i have to say that) | 20:39 |
| kfox1111 | exactly. :) | 20:39 |
| ayoung | kfox1111, I just would not push for some sort of mapping engine...Keystone already has one, and just use it | 20:40 |
| *** asettle has joined #openstack-keystone | 20:40 | |
| breton | harlowja: next wed 11am PST sounds good | 20:40 |
| ayoung | harlowja, I havea blog post on s4u2, but I think I know a better one to send to you if you care. It lets one kerberized service get a service ticket for another one on behalf of a user | 20:41 |
| harlowja | ayoung sure will read if u send it :) | 20:41 |
| ayoung | so if a user goes to Kuber, and Kube needs to talk to keystone, Kube can (automatically) get a ticket to do so | 20:41 |
| *** BjoernT has quit IRC | 20:41 | |
| ayoung | harlowja, is this from the Architect in our group https://ssimo.org/blog/id_011.html | 20:41 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Update sample keystone.conf for Newton https://review.openstack.org/366958 | 20:41 |
| kfox1111 | ayoung: agreed. what I mean by mapping is, | 20:42 |
| stevemar | dolphm: +++ | 20:42 |
| kfox1111 | how do we expose the keystone project/role information in a way the k8s rbac system can use it. | 20:42 |
| kfox1111 | thats all. | 20:42 |
| kfox1111 | their current belief is to expose it through a k8s group. | 20:42 |
| harlowja | ayoung u the architect man | 20:42 |
| kfox1111 | I'm not sure that fits well. | 20:42 |
| harlowja | lol | 20:42 |
| ayoung | harlowja, hardly. That would be simo | 20:43 |
| harlowja | :-P | 20:43 |
| *** michauds has quit IRC | 20:43 | |
| lbragstad | samueldmq you were really familiar with the caching stuff | 20:45 |
| harlowja | kfox1111 so for my own knowledge, whats a k8s group | 20:45 |
| harlowja | could probably ask some internal folks | 20:45 |
| lbragstad | samueldmq do you remember what the impact of those patches on making fernet default? | 20:45 |
| harlowja | namespace, group, user | 20:45 |
| ayoung | harlowja, I wanted external APIs to be able to lookup mappings and roles without actually handing out tokens. That is what notmorgan and I were bantering about earlier | 20:45 |
| harlowja | is a group like a project, lol | 20:45 |
| *** GB21 has quit IRC | 20:46 | |
| samueldmq | lbragstad: you refering to dstanek's cache fix? | 20:46 |
| lbragstad | samueldmq yeah - i thought that would have had an impact on making fernet default (?) | 20:46 |
| kfox1111 | harlowja: their vision of auth is very basic. | 20:46 |
| kfox1111 | so username = something like an ldap username. group = something like an ldap group. | 20:47 |
| kfox1111 | just a string that is tagged onto some number of users. | 20:47 |
| harlowja | k | 20:47 |
| samueldmq | lbragstad: well, I was hoping that was going to fix the issues with caching thete | 20:47 |
| samueldmq | There | 20:47 |
| lbragstad | samueldmq now that the credential encryption work is wrapping up i'm revisiting make fernet default things | 20:47 |
| samueldmq | But from my tests it doesn't lok to be the case | 20:47 |
| kfox1111 | user='kfox', groups=['pnnl_employees', 'admin'] | 20:47 |
| lbragstad | samueldmq oh - really? | 20:47 |
| harlowja | kfox1111 right tag like | 20:48 |
| samueldmq | Tempest keeps failing unless you disable revocation cache | 20:48 |
| lbragstad | huh | 20:48 |
| kfox1111 | thats all they currently have to work with. :/ | 20:48 |
| samueldmq | lbragstad: yeah your change to make it default should've be passing on masted | 20:48 |
| samueldmq | Master | 20:48 |
| lbragstad | samueldmq that was being worked with https://review.openstack.org/#/c/345688/ ? | 20:48 |
| samueldmq | If that had fixed the issue | 20:48 |
| samueldmq | lbragstad: Yes, that'd pass on máster if the issue was only the cache invalidation across processes | 20:49 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: WIP: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 20:50 |
| kfox1111 | btw, can the openstack cli and horizon do federated logins yet? | 20:52 |
| kfox1111 | last I heard, it still was a show stopper. :/ | 20:52 |
| *** jaugustine has left #openstack-keystone | 20:52 | |
| david-lyle | kfox1111: Horizon had federated login since Liberty or Mitaka? unless you're talking about k2k, then no | 20:53 |
| kfox1111 | yeah. k2k. | 20:53 |
| kfox1111 | :/ | 20:53 |
| david-lyle | there's a patch that hasn't landed | 20:54 |
| kfox1111 | I really want to use k2k for scaling reasons. each region would get its own keystone, and then have a master keystone. | 20:54 |
| * david-lyle recites the famous openstack verse | 20:54 | |
| harlowja | kfox1111 interseting (sorry in and out of this conversation as i multitask) | 20:54 |
| kfox1111 | :/ | 20:54 |
| lbragstad | samueldmq do you know if we have a bug open for documenting the issues with revocation event caching. | 20:54 |
| lbragstad | ? | 20:54 |
| kfox1111 | david-lyle: yeah. I've been watching it but haven't seen movement in a long long time. :/ | 20:54 |
| kfox1111 | was hoping I missed it somehow. | 20:54 |
| samueldmq | lbragstad: not site. I thoughts you had open one at that time | 20:55 |
| *** shaleh has joined #openstack-keystone | 20:55 | |
| ayoung | kfox1111, no you don't | 20:55 |
| ayoung | you don't want K2K | 20:55 |
| samueldmq | lbragstad: I will check once I get to my PC, talking from mobile phone right now | 20:55 |
| kfox1111 | why not? | 20:55 |
| ayoung | what you want is an external IdP and keystone only doing role assignments | 20:56 |
| lbragstad | samueldmq cool, thanks... i'm digging right now, too | 20:56 |
| ayoung | and probably Fernet so the Keystones don't have to talk to each other | 20:56 |
| kfox1111 | ayoung: kind of... a keystone being the idp though is something easier for me to deal with then setting up/managing another idp. | 20:56 |
| ayoung | kfox1111, AHAHAHAHAHAHA | 20:56 |
| ayoung | No | 20:56 |
| ayoung | Keystone is not an IdP | 20:57 |
| ayoung | it is a delegation server | 20:57 |
| samueldmq | lbragstad: nice | 20:57 |
| kfox1111 | ayoung: potato patato. doesn't change what I really want to use it for. :) | 20:57 |
| ayoung | kfox1111, that should not be laughter | 20:57 |
| ayoung | that should be read as me screaming | 20:57 |
| kfox1111 | I want ad to provide the authen. I want a central keystone for managing tenants, | 20:57 |
| kfox1111 | and federated keystones per region for scaling. | 20:58 |
| ayoung | Yep | 20:58 |
| kfox1111 | I don't care what you call that. :) | 20:58 |
| ayoung | but you don't need K2K for that | 20:58 |
| *** javis has joined #openstack-keystone | 20:58 | |
| kfox1111 | hmm.. then how would you do that? | 20:58 |
| ayoung | Just either have independent Keystones for each region | 20:58 |
| kfox1111 | how do you maintain tenancy across independent keystones then? | 20:59 |
| *** iurygregory_ has joined #openstack-keystone | 20:59 | |
| ayoung | Mapping from the AD groups | 20:59 |
| ayoung | and if you need a tighter sync than that, use DB replication instead | 20:59 |
| kfox1111 | I want to be able to login once, and have that unscoped token work for all the regions. | 20:59 |
| kfox1111 | and I don't nessisarily trust the admins on each of the regions. | 21:00 |
| kfox1111 | so federation covers that case. | 21:00 |
| ayoung | bug 968696 | 21:00 |
| openstack | bug 968696 in Glance ""admin"-ness not properly scoped" [High,In progress] https://launchpad.net/bugs/968696 - Assigned to Sharat Sharma (sharat-sharma) | 21:00 |
| kfox1111 | ayoung: exactly. | 21:00 |
| kfox1111 | adminness would be per region, per keystone. | 21:00 |
| kfox1111 | but tenantness can be maintaned at the root keystone in the tree. | 21:01 |
| ayoung | kfox1111, I'm thinking what you want is more like this: | 21:01 |
| kfox1111 | that one I trust. it can be hardened more then the other keystones. | 21:01 |
| ayoung | central Keystone that takes all writes. Distributed Keystones for reads | 21:01 |
| ayoung | replicate from central to remote | 21:01 |
| ayoung | and... | 21:01 |
| ayoung | something more | 21:02 |
| ayoung | the central keystone should not honor tokens from the remote | 21:02 |
| kfox1111 | you'd need some way to ensure the read only keystones couldn't issue tokens that had privs you didn't want them to have. | 21:02 |
| ayoung | maybe the central one uses a different set of Fernet keys? | 21:02 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: [WIP] POC Validate adding new table doesn't break tests (do not review) https://review.openstack.org/366974 | 21:02 |
| kfox1111 | could work, but I don't think the code is there today. :/ | 21:02 |
| ayoung | kfox1111, actually, that would work today | 21:03 |
| kfox1111 | you'd have to create some kind of cross keystone fernet key trusts. | 21:03 |
| ayoung | each of the remote keystones gets a different MySQL user, one that has read only access | 21:03 |
| ayoung | or, read write access to their replicated DB, but no backflow | 21:03 |
| ayoung | don't sync the keys between the keystones | 21:03 |
| kfox1111 | how would stuff like heat trusts work then? | 21:04 |
| ayoung | none of the keystones honor keys issued by the others | 21:04 |
| kfox1111 | yeah, maybe read write local might cover it... | 21:04 |
| ayoung | trust need to be made in the central Database | 21:04 |
| kfox1111 | though you could get into weird sync issues... | 21:04 |
| ayoung | or... | 21:04 |
| kfox1111 | heat would need an admin cred. | 21:04 |
| *** fangxu has joined #openstack-keystone | 21:04 | |
| kfox1111 | which breaks the whole reason to split. :/ | 21:04 |
| ayoung | since trusts is its own table space, you could have each keystone have their own set of tables for those | 21:04 |
| ayoung | its ok, admin would only be good on its own keystone | 21:05 |
| kfox1111 | hmm... could be.. | 21:05 |
| kfox1111 | but would have a problem if you tried to use one trust in another region... but that may be ok. | 21:05 |
| lbragstad | samueldmq you tested https://review.openstack.org/#/c/345688/ by turning off revocation caching and it worked - right? | 21:05 |
| kfox1111 | it may be possible to pull it apart and order it that way. it really feels like its relying on some delicate internals to make work though. | 21:06 |
| kfox1111 | it would be ok if keystone provided that as a feature. | 21:06 |
| ayoung | kfox1111, you would have to either do trusts only centralized, or only per region. | 21:06 |
| kfox1111 | but I'd be reluctant to try it myself without that kind of garantee. | 21:06 |
| ayoung | Well.... | 21:06 |
| samueldmq | lbragstad: Yes sir | 21:06 |
| ayoung | or you could do centralized, and then replicate out to the regions, | 21:06 |
| lbragstad | humm | 21:06 |
| ayoung | so anytjhing centralized would be good cluster wide, but anything written in the regions would only be valid in that region | 21:07 |
| kfox1111 | yeah, that might work better. but again, trusts may be a problem. | 21:07 |
| ayoung | this could actually be quite cool | 21:07 |
| kfox1111 | ah. yeah. | 21:07 |
| kfox1111 | k2k_lite? :) | 21:07 |
| ayoung | each region "inherits" the keystone from central, and then layers its own data on top | 21:07 |
| ayoung | nah | 21:07 |
| kfox1111 | yeah. that would be cool. | 21:07 |
| openstackgerrit | Doug Hellmann proposed openstack/python-keystoneclient: standardize release note page ordering https://review.openstack.org/366982 | 21:08 |
| ayoung | kfox1111, so, one shortcoming of Fernet is that the central Keystone could not issue tokens that would be valid across the regions, but that is, I think, OK | 21:08 |
| kfox1111 | it may be easy to write a check that if it fails the local keystone check, pushes back to the central keystone. | 21:09 |
| *** marst has joined #openstack-keystone | 21:09 | |
| kfox1111 | though one of my hopes for the k2k thing was it would convert to a local keystone token, and then all the api requests never would have to go all the way back to the central keystone, | 21:10 |
| lbragstad | samueldmq so far i'm not seeing a bug for the revocation caching stuff... i wonder if ravelar knows? | 21:10 |
| kfox1111 | impoving central keystone performance. | 21:10 |
| marst | Hello. How do I start keystone service after devstack system reboot? There's no more /opt/stack/keystone/bin/keystone-all. Found this: http://openstack.10931.n7.nabble.com/devstack-How-to-start-all-OpenStack-services-after-restarting-system-td117156.html but it doesn't start keystone. | 21:13 |
| marst | Sorry if this is wrong place to ask. Appreciate any help. | 21:13 |
| *** BjoernT has joined #openstack-keystone | 21:19 | |
| *** edmondsw has quit IRC | 21:19 | |
| *** adrian_otto has quit IRC | 21:21 | |
| breton | marst: it should be started | 21:21 |
| breton | marst: if not, you probably need to restart apache2 and uwsgi | 21:21 |
| breton | (not sure if it's uwsgi though by default) | 21:22 |
| marst | breton: I rebooted devstack system and run "screen -c stack-screen". I can see nova services up and running, but not keystone. | 21:23 |
| breton | marst: why do you think that keystone is not running? | 21:23 |
| breton | marst: try saying "curl localhost:5000" | 21:24 |
| marst | curl http://10.11.12.2:35357/v3/auth/tokens | 21:25 |
| marst | curl: (7) Failed connect to 10.11.12.2:35357; Connection refused | 21:25 |
| marst | [stack@controller devstack]$ ps -ef | grep keys | 21:26 |
| marst | root 3128 2916 0 Sep06 pts/2 00:00:00 sudo tail -f /var/log/httpd/keystone.log | 21:26 |
| marst | root 3157 2923 0 Sep06 pts/3 00:00:00 sudo tail -f /var/log/httpd/keystone_access.log | 21:26 |
| marst | root 3199 3128 0 Sep06 pts/2 00:00:00 tail -f /var/log/httpd/keystone.log | 21:26 |
| marst | root 3201 3157 0 Sep06 pts/3 00:00:00 tail -f /var/log/httpd/keystone_access.log | 21:26 |
| marst | stack 14054 2915 0 17:26 pts/1 00:00:00 grep --color=auto keys | 21:26 |
| *** gyee_ has joined #openstack-keystone | 21:29 | |
| marst | breton: shall I just run "uwsgi --http 127.0.0.1:35357 --wsgi-file $(which keystone-wsgi-admin)"? | 21:32 |
| breton | marst: no idea. I know that some time ago restarting apache2 was enough. | 21:36 |
| *** su_zhang has quit IRC | 21:37 | |
| *** su_zhang has joined #openstack-keystone | 21:38 | |
| *** su_zhang has quit IRC | 21:38 | |
| *** su_zhang has joined #openstack-keystone | 21:38 | |
| marst | breton: Yay! Finally found the reason: | 21:39 |
| marst | Sep 07 17:38:50 controller httpd[17954]: (13)Permission denied: AH00072: make_sock: could not bind to address [::]:5000 | 21:39 |
| marst | Sep 07 17:38:50 controller httpd[17954]: (13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:5000 | 21:39 |
| marst | Sep 07 17:38:50 controller httpd[17954]: no listening sockets available, shutting down | 21:39 |
| marst | Sep 07 17:38:50 controller httpd[17954]: AH00015: Unable to open logs | 21:39 |
| marst | that's from systemctl status httpd.service | 21:40 |
| marst | thank you! | 21:40 |
| *** LamT_ has quit IRC | 21:41 | |
| *** asettle has quit IRC | 21:43 | |
| *** jmccrory has quit IRC | 21:53 | |
| *** jmccrory has joined #openstack-keystone | 21:53 | |
| *** spzala has joined #openstack-keystone | 21:54 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: WIP: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 21:54 |
| *** jmccrory has quit IRC | 21:55 | |
| *** adrian_otto has joined #openstack-keystone | 21:55 | |
| *** jmccrory has joined #openstack-keystone | 21:55 | |
| *** jmccrory has quit IRC | 21:57 | |
| *** jmccrory has joined #openstack-keystone | 21:57 | |
| lbragstad | samueldmq ^ new version that works with the KeyRepository fixture stuff that was refactored | 21:58 |
| *** chrisshattuck has quit IRC | 21:58 | |
| *** chrisshattuck has joined #openstack-keystone | 22:00 | |
| samueldmq | lbragstad: nice, let's see what Jenkins says | 22:01 |
| *** javis has quit IRC | 22:01 | |
| *** su_zhang has quit IRC | 22:01 | |
| *** BjoernT has quit IRC | 22:02 | |
| *** su_zhang has joined #openstack-keystone | 22:05 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Return password_expires_at during auth https://review.openstack.org/367008 | 22:09 |
| *** tonytan4ever has quit IRC | 22:10 | |
| *** chlong has joined #openstack-keystone | 22:12 | |
| breton | rderose: got any ideas about https://bugs.launchpad.net/keystone/+bug/1621200 ? | 22:13 |
| openstack | Launchpad bug 1621200 in OpenStack Identity (keystone) "MySQLOpportunisticIdentityDriverTestCase.test_change_password fails in UTC+N timezone" [Undecided,New] | 22:13 |
| *** roxanaghe has quit IRC | 22:13 | |
| rderose | breton: is this related to the eager loading patch? | 22:13 |
| breton | rderose: no | 22:14 |
| breton | rderose: happens on master | 22:14 |
| marst | breton: selinux was enabled by default in the system. reboot made selinux active again and stopped apache from running. disabled selinux, restarted httpd and now everything works. thank you so much for help and support! :) | 22:14 |
| breton | rderose: eager loading runs into it once in a while, maybe the same rootcause | 22:14 |
| rderose | breton: hmm... | 22:15 |
| breton | marst: awesome, glad you figured it out. | 22:15 |
| *** slberger has left #openstack-keystone | 22:15 | |
| *** joerch has quit IRC | 22:15 | |
| breton | rderose: i debugged and for some reason created_at for the old password becomed datetime.datetime.now(), but doesn't get changed in the database | 22:16 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: WIP: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 22:16 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use freezegun for change password tests https://review.openstack.org/367017 | 22:16 |
| rderose | breton: the old password is getting reset? | 22:17 |
| breton | rderose: because created_at becomes now(), it becomes the most recent password | 22:17 |
| breton | rderose: don't know that yet | 22:17 |
| breton | rderose: i think you don't see the issue in UTC-N because old password gets now() too, but your now() is earlier than utcnow() | 22:18 |
| *** marst has left #openstack-keystone | 22:18 | |
| rderose | breton: ah... | 22:18 |
| breton | rderose: but for me now() > utcnow() | 22:18 |
| *** roxanaghe has joined #openstack-keystone | 22:19 | |
| breton | the question is why it doesn't happen on sqlite. | 22:19 |
| rderose | breton: I think this would be why: | 22:19 |
| rderose | https://github.com/openstack/keystone/blob/master/keystone/common/sql/contract_repo/versions/002_password_created_at_not_nullable.py#L38 | 22:19 |
| rderose | breton: defaults to now(); not necessarily utcnow | 22:20 |
| breton | rderose: ok. But what the value from the db is not used? | 22:21 |
| breton | *why | 22:21 |
| breton | > server_default=sql.func.now() | 22:22 |
| breton | shouldn't it be | 22:22 |
| breton | server_default=sql.func.now | 22:22 |
| breton | without () | 22:22 |
| breton | ? | 22:22 |
| *** su_zhang has quit IRC | 22:23 | |
| rderose | breton: I don't think so, but let me verify this | 22:23 |
| *** sdake has quit IRC | 22:24 | |
| rderose | breton: from the examples I've seen, it shows it with the () | 22:25 |
| rderose | http://docs.sqlalchemy.org/en/latest/core/defaults.html | 22:25 |
| breton | yes, looks like it | 22:26 |
| *** BjoernT has joined #openstack-keystone | 22:26 | |
| *** BjoernT has quit IRC | 22:26 | |
| *** spedione is now known as spedione|AWAY | 22:27 | |
| rderose | breton: the database should be configured to utc, right? | 22:29 |
| breton | rderose: no idea. I use debian defaults. | 22:30 |
| breton | i just know that it needs to be restarted after tz change | 22:30 |
| breton | worked on ubuntu defaults too btw, on amakarov_away localhost | 22:33 |
| breton | *worked == was reproducible | 22:33 |
| rderose | breton: okay, let me dig into this one | 22:35 |
| rderose | amakarov_away: you around? | 22:36 |
| *** asettle has joined #openstack-keystone | 22:44 | |
| *** adriant has joined #openstack-keystone | 22:44 | |
| *** spzala has quit IRC | 22:45 | |
| *** spzala has joined #openstack-keystone | 22:46 | |
| *** spzala has quit IRC | 22:46 | |
| *** spzala has joined #openstack-keystone | 22:47 | |
| *** spzala has quit IRC | 22:47 | |
| *** spzala has joined #openstack-keystone | 22:47 | |
| *** spzala has quit IRC | 22:47 | |
| *** spzala has joined #openstack-keystone | 22:48 | |
| *** spzala has quit IRC | 22:48 | |
| *** spzala has joined #openstack-keystone | 22:48 | |
| *** spzala has quit IRC | 22:48 | |
| *** asettle has quit IRC | 22:49 | |
| *** spzala has joined #openstack-keystone | 22:49 | |
| *** spzala has quit IRC | 22:49 | |
| *** spzala has joined #openstack-keystone | 22:49 | |
| *** spzala has quit IRC | 22:50 | |
| *** ddieterly is now known as ddieterly[away] | 22:50 | |
| breton | rderose: ok, the value gets changed in the database too | 22:50 |
| *** ddieterly[away] has quit IRC | 22:50 | |
| *** topol_ has quit IRC | 22:50 | |
| *** spzala has joined #openstack-keystone | 22:50 | |
| *** spzala has quit IRC | 22:50 | |
| *** spzala has joined #openstack-keystone | 22:51 | |
| *** spzala has quit IRC | 22:51 | |
| breton | rderose: http://paste.openstack.org/show/568254/ before user_ref.password = utils.hash_password(new_password) | 22:51 |
| *** spzala has joined #openstack-keystone | 22:52 | |
| breton | rderose: http://paste.openstack.org/show/568255/ after user_ref.password = utils.hash_password(new_password) | 22:52 |
| *** spzala has quit IRC | 22:52 | |
| breton | rderose: note how the password ending with 5VfP1 gets a new created_at. | 22:52 |
| *** spzala_ has joined #openstack-keystone | 22:53 | |
| *** spzala has joined #openstack-keystone | 22:53 | |
| *** spzala has quit IRC | 22:53 | |
| *** spzala_ has quit IRC | 22:53 | |
| rderose | breton: yeah, the it gets a default (non-UTC) from func.now() | 22:53 |
| *** spzala has joined #openstack-keystone | 22:53 | |
| rderose | breton: and then when changed, gets UTC | 22:53 |
| *** spzala has quit IRC | 22:53 | |
| rderose | breton: expired gets set, so I think I will use that to fix this | 22:54 |
| *** spzala has joined #openstack-keystone | 22:54 | |
| *** spzala has quit IRC | 22:54 | |
| *** spzala has joined #openstack-keystone | 22:55 | |
| *** roxanaghe has quit IRC | 22:55 | |
| *** spzala has quit IRC | 22:55 | |
| *** spzala has joined #openstack-keystone | 22:56 | |
| *** spzala has quit IRC | 22:56 | |
| rderose | breton: in other words: | 22:56 |
| rderose | http://paste.openstack.org/show/568256/ | 22:56 |
| rderose | breton: instead of: return self.local_user.passwords[-1] | 22:56 |
| *** spzala_ has joined #openstack-keystone | 22:56 | |
| *** spzala has joined #openstack-keystone | 22:56 | |
| *** spzala has quit IRC | 22:56 | |
| *** spzala_ has quit IRC | 22:56 | |
| rderose | breton: maybe... | 22:57 |
| *** spzala has joined #openstack-keystone | 22:57 | |
| *** spzala has quit IRC | 22:57 | |
| *** spzala has joined #openstack-keystone | 22:57 | |
| *** spzala has quit IRC | 22:58 | |
| rderose | zzzeek: can func.now() return utc timestamp? | 22:58 |
| *** spzala has joined #openstack-keystone | 22:58 | |
| *** spzala has quit IRC | 22:58 | |
| *** spzala has joined #openstack-keystone | 22:59 | |
| *** spzala has quit IRC | 22:59 | |
| *** spzala has joined #openstack-keystone | 23:00 | |
| *** spzala has quit IRC | 23:00 | |
| breton | rderose: i still don't understand why func.now() gets applied | 23:00 |
| *** spzala has joined #openstack-keystone | 23:01 | |
| *** roxanaghe has joined #openstack-keystone | 23:01 | |
| *** spzala has quit IRC | 23:01 | |
| breton | rderose: https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql_model.py#L115 only expires_at gets changed here | 23:01 |
| openstackgerrit | Sean Perry proposed openstack/keystone: Add domain check in domain-specific role implication https://review.openstack.org/351264 | 23:01 |
| *** spzala has joined #openstack-keystone | 23:02 | |
| *** spzala has quit IRC | 23:02 | |
| *** spzala has joined #openstack-keystone | 23:03 | |
| breton | rderose: http://paste.openstack.org/show/568369/ this is what is being sent to mysql at the moment | 23:03 |
| *** spzala has quit IRC | 23:03 | |
| *** javis has joined #openstack-keystone | 23:03 | |
| *** harlowja has quit IRC | 23:03 | |
| *** chrisshattuck has quit IRC | 23:03 | |
| *** spzala has joined #openstack-keystone | 23:04 | |
| *** spzala has quit IRC | 23:04 | |
| *** spzala has joined #openstack-keystone | 23:04 | |
| *** spzala has quit IRC | 23:05 | |
| *** ravelar has quit IRC | 23:05 | |
| *** spzala has joined #openstack-keystone | 23:05 | |
| *** spzala has quit IRC | 23:05 | |
| *** spzala has joined #openstack-keystone | 23:06 | |
| *** spzala has quit IRC | 23:06 | |
| rderose | breton: it gets applied so that I can make the created_at column nullable | 23:07 |
| *** spzala has joined #openstack-keystone | 23:07 | |
| *** spzala has quit IRC | 23:07 | |
| *** spzala has joined #openstack-keystone | 23:08 | |
| *** spzala has quit IRC | 23:08 | |
| breton | rderose: i don't understand how that's connected | 23:08 |
| *** spzala has joined #openstack-keystone | 23:08 | |
| *** spzala has quit IRC | 23:08 | |
| rderose | breton: I think what's happening is func.now() is setting the created_at date for the old password | 23:09 |
| *** spzala has joined #openstack-keystone | 23:09 | |
| rderose | breton: when you change it, the created_at date is getting set from the application layer (utc) | 23:09 |
| *** spzala has quit IRC | 23:09 | |
| rderose | breton: does that make sense? | 23:10 |
| *** spzala has joined #openstack-keystone | 23:10 | |
| *** spzala has quit IRC | 23:10 | |
| breton | rderose: probably yes. But why default=datetime.datetime.utcnow is not enough? | 23:10 |
| *** tonytan4ever has joined #openstack-keystone | 23:10 | |
| breton | rderose: and why it gets set on UPDATE password SET expires_at=... ? | 23:10 |
| *** spzala has joined #openstack-keystone | 23:11 | |
| *** spzala has quit IRC | 23:11 | |
| rderose | breton: default=datetime.datetime.utcnow doesn't work for server_default | 23:11 |
| breton | rderose: lets drop server_default then at all | 23:11 |
| *** spzala has joined #openstack-keystone | 23:11 | |
| *** spzala has quit IRC | 23:12 | |
| *** spzala has joined #openstack-keystone | 23:12 | |
| rderose | breton: then I cannot make the column not nullable because the created_at would not automatically get updated | 23:12 |
| *** spzala has quit IRC | 23:12 | |
| rderose | breton: we need the server_default in order to make this column not nullable | 23:13 |
| *** spzala has joined #openstack-keystone | 23:13 | |
| *** spzala has quit IRC | 23:13 | |
| breton | rderose: so... setting default=datetime.datetime.utcnow alone isn't enough? | 23:13 |
| rderose | breton: correct | 23:14 |
| *** spzala has joined #openstack-keystone | 23:14 | |
| rderose | breton: and setting a datetime default is way more complicated than I ever thought would be | 23:14 |
| *** spzala has quit IRC | 23:14 | |
| *** spzala has joined #openstack-keystone | 23:15 | |
| *** spzala has quit IRC | 23:15 | |
| breton | rderose: ok. But i still think that server_default behaves not as we would want it to | 23:15 |
| *** tonytan4ever has quit IRC | 23:15 | |
| *** spzala has joined #openstack-keystone | 23:15 | |
| rderose | breton: correct, if it's not utc | 23:15 |
| rderose | breton: right? | 23:15 |
| *** spzala has quit IRC | 23:15 | |
| breton | rderose: even if it is utc | 23:15 |
| rderose | breton: if it is utc, then there isn't a problem | 23:16 |
| breton | rderose: it gets executes even on unrelated UPDATE | 23:16 |
| breton | rderose: it will be. It executes on UPDATE of unrelated column | 23:16 |
| *** spzala has joined #openstack-keystone | 23:16 | |
| breton | rderose: even if there is already something in created_at | 23:16 |
| *** spzala has quit IRC | 23:16 | |
| rderose | breton: oh, I missed that part | 23:17 |
| rderose | breton: it shouldn't... | 23:17 |
| *** spzala has joined #openstack-keystone | 23:17 | |
| *** spzala has quit IRC | 23:17 | |
| breton | rderose: and it DOES NOT execute on create. The datetime on create is correct. | 23:18 |
| *** spzala has joined #openstack-keystone | 23:18 | |
| rderose | hmm... | 23:18 |
| *** spzala has quit IRC | 23:18 | |
| rderose | breton: yeah, that totally doesn't make sense | 23:18 |
| *** spzala has joined #openstack-keystone | 23:19 | |
| *** spzala has quit IRC | 23:19 | |
| *** spzala has joined #openstack-keystone | 23:20 | |
| *** spzala has quit IRC | 23:20 | |
| breton | also, my english terrible degrades at night. Good night, will poke the issue tomorrow again. | 23:20 |
| *** spzala has joined #openstack-keystone | 23:20 | |
| *** spzala has quit IRC | 23:20 | |
| *** spzala_ has joined #openstack-keystone | 23:20 | |
| *** spzala_ has quit IRC | 23:21 | |
| rderose | breton: okay, thanks for finding this btw | 23:21 |
| rderose | goodnight | 23:21 |
| *** spzala has joined #openstack-keystone | 23:21 | |
| *** spzala has quit IRC | 23:21 | |
| *** spzala has joined #openstack-keystone | 23:22 | |
| *** spzala has quit IRC | 23:22 | |
| *** spzala has joined #openstack-keystone | 23:23 | |
| *** spzala has quit IRC | 23:23 | |
| *** spzala has joined #openstack-keystone | 23:24 | |
| *** spzala has quit IRC | 23:24 | |
| *** spzala has joined #openstack-keystone | 23:24 | |
| *** spzala has quit IRC | 23:24 | |
| *** spzala has joined #openstack-keystone | 23:25 | |
| *** spzala has quit IRC | 23:25 | |
| *** spzala has joined #openstack-keystone | 23:26 | |
| *** spzala has quit IRC | 23:26 | |
| *** spzala has joined #openstack-keystone | 23:26 | |
| *** spzala has quit IRC | 23:27 | |
| *** spzala has joined #openstack-keystone | 23:27 | |
| *** spzala has quit IRC | 23:27 | |
| *** spzala has joined #openstack-keystone | 23:28 | |
| *** spzala has quit IRC | 23:28 | |
| *** spzala has joined #openstack-keystone | 23:29 | |
| *** spzala has quit IRC | 23:29 | |
| *** spzala has joined #openstack-keystone | 23:30 | |
| *** spzala has quit IRC | 23:30 | |
| *** spzala has joined #openstack-keystone | 23:30 | |
| *** spzala has quit IRC | 23:30 | |
| *** spzala has joined #openstack-keystone | 23:31 | |
| *** spzala has quit IRC | 23:31 | |
| *** spzala has joined #openstack-keystone | 23:32 | |
| *** spzala has quit IRC | 23:32 | |
| *** spzala has joined #openstack-keystone | 23:32 | |
| *** spzala has quit IRC | 23:33 | |
| *** spzala has joined #openstack-keystone | 23:33 | |
| *** spzala has quit IRC | 23:33 | |
| *** spzala has joined #openstack-keystone | 23:34 | |
| *** fangxu has quit IRC | 23:34 | |
| *** spzala has quit IRC | 23:34 | |
| *** spzala has joined #openstack-keystone | 23:35 | |
| *** spzala has quit IRC | 23:35 | |
| *** spzala has joined #openstack-keystone | 23:36 | |
| *** spzala has quit IRC | 23:36 | |
| *** spzala has joined #openstack-keystone | 23:36 | |
| *** spzala has quit IRC | 23:37 | |
| *** spzala has joined #openstack-keystone | 23:37 | |
| *** spzala has quit IRC | 23:37 | |
| *** fangxu has joined #openstack-keystone | 23:38 | |
| *** spzala has joined #openstack-keystone | 23:38 | |
| *** spzala has quit IRC | 23:38 | |
| *** spzala has joined #openstack-keystone | 23:39 | |
| *** spzala has quit IRC | 23:39 | |
| *** spzala has joined #openstack-keystone | 23:40 | |
| *** spzala has quit IRC | 23:40 | |
| *** spzala has joined #openstack-keystone | 23:41 | |
| *** spzala has quit IRC | 23:41 | |
| *** spzala has joined #openstack-keystone | 23:41 | |
| *** spzala has quit IRC | 23:41 | |
| *** spzala has joined #openstack-keystone | 23:42 | |
| *** spzala has quit IRC | 23:42 | |
| *** spzala has joined #openstack-keystone | 23:43 | |
| *** spzala has quit IRC | 23:43 | |
| *** spzala has joined #openstack-keystone | 23:44 | |
| *** spzala has quit IRC | 23:44 | |
| *** spzala has joined #openstack-keystone | 23:44 | |
| *** spzala has quit IRC | 23:44 | |
| *** spzala has joined #openstack-keystone | 23:45 | |
| *** asettle has joined #openstack-keystone | 23:45 | |
| *** spzala has quit IRC | 23:45 | |
| *** spzala has joined #openstack-keystone | 23:45 | |
| *** tonytan4ever has joined #openstack-keystone | 23:45 | |
| *** spzala has quit IRC | 23:46 | |
| *** edmondsw has joined #openstack-keystone | 23:46 | |
| *** spzala has joined #openstack-keystone | 23:46 | |
| *** spzala has quit IRC | 23:46 | |
| *** spzala has joined #openstack-keystone | 23:47 | |
| *** spzala has quit IRC | 23:47 | |
| *** spzala has joined #openstack-keystone | 23:48 | |
| *** spzala has quit IRC | 23:48 | |
| *** spzala has joined #openstack-keystone | 23:49 | |
| *** spzala has quit IRC | 23:49 | |
| *** edmondsw has quit IRC | 23:49 | |
| *** spzala has joined #openstack-keystone | 23:50 | |
| *** spzala has quit IRC | 23:50 | |
| *** spzala_ has joined #openstack-keystone | 23:50 | |
| *** spzala_ has quit IRC | 23:50 | |
| *** spzala has joined #openstack-keystone | 23:50 | |
| *** spzala has quit IRC | 23:50 | |
| *** asettle has quit IRC | 23:51 | |
| *** spzala has joined #openstack-keystone | 23:51 | |
| *** spzala has quit IRC | 23:51 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to server_default https://review.openstack.org/367025 | 23:51 |
| *** spzala has joined #openstack-keystone | 23:52 | |
| *** spzala has quit IRC | 23:52 | |
| *** spzala has joined #openstack-keystone | 23:53 | |
| *** spzala has quit IRC | 23:53 | |
| *** spzala has joined #openstack-keystone | 23:53 | |
| *** spzala has quit IRC | 23:53 | |
| *** spzala has joined #openstack-keystone | 23:55 | |
| *** spzala has quit IRC | 23:55 | |
| *** spzala has joined #openstack-keystone | 23:55 | |
| *** spzala has quit IRC | 23:56 | |
| *** spzala has joined #openstack-keystone | 23:56 | |
| *** spzala has quit IRC | 23:57 | |
| *** spzala has joined #openstack-keystone | 23:57 | |
| *** spzala has quit IRC | 23:57 | |
| breton | rderose: i lied, i didn't go to sleep | 23:57 |
| rderose | breton: :) | 23:58 |
| breton | rderose: and i was wrong about server_default | 23:58 |
| breton | rderose: http://dev.mysql.com/doc/refman/5.7/en/timestamp-initialization.html | 23:58 |
| rderose | breton: you were? | 23:58 |
| *** spzala has joined #openstack-keystone | 23:58 | |
| *** spzala has quit IRC | 23:58 | |
| breton | rderose: TIMESTAMP and DATETIME columns have no automatic properties unless they are specified explicitly, with this exception: By default, the first TIMESTAMP column has both DEFAULT CURRENT_TIMESTAMP and ON UPDATE CURRENT_TIMESTAMP if neither is specified explicitly. | 23:58 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 23:58 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 23:59 |
| *** spzala has joined #openstack-keystone | 23:59 | |
| *** spzala has quit IRC | 23:59 | |
| breton | By default, the first TIMESTAMP column has both DEFAULT CURRENT_TIMESTAMP and ON UPDATE CURRENT_TIMESTAMP if neither is specified explicitly. | 23:59 |
| rderose | breton: yeah, saw that as well | 23:59 |
| breton | this | 23:59 |
| breton | created_at is our first TIMESTAMP column | 23:59 |
| rderose | breton: so it's updating the timestamp if any column is updated | 23:59 |
| rderose | I hate this!! | 23:59 |
| *** spzala has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
