| *** sdake has quit IRC | 00:22 | |
| *** spzala has joined #openstack-keystone | 00:24 | |
| *** roxanaghe has joined #openstack-keystone | 00:28 | |
| *** sdake has joined #openstack-keystone | 00:32 | |
| *** roxanaghe has quit IRC | 00:33 | |
| *** tqtran has joined #openstack-keystone | 00:58 | |
| *** davechen has joined #openstack-keystone | 00:58 | |
| *** tqtran has quit IRC | 01:02 | |
| *** ngupta has joined #openstack-keystone | 01:05 | |
| *** ngupta has quit IRC | 01:06 | |
| *** ngupta has joined #openstack-keystone | 01:07 | |
| *** ngupta_ has joined #openstack-keystone | 01:08 | |
| *** ngupta has quit IRC | 01:11 | |
| *** EinstCrazy has joined #openstack-keystone | 01:20 | |
| *** EinstCra_ has joined #openstack-keystone | 01:22 | |
| *** ngupta_ has quit IRC | 01:22 | |
| *** EinstCrazy has quit IRC | 01:25 | |
| *** ngupta has joined #openstack-keystone | 01:26 | |
| openstackgerrit | Ha Van Tu proposed openstack/keystone: Refactor Keystone admin-tokens and admin-users v2 https://review.openstack.org/369883 | 01:26 |
|---|---|---|
| *** roxanaghe has joined #openstack-keystone | 01:30 | |
| *** roxanaghe has quit IRC | 01:34 | |
| *** ngupta_ has joined #openstack-keystone | 01:45 | |
| *** ngupta has quit IRC | 01:47 | |
| *** ngupta has joined #openstack-keystone | 02:01 | |
| *** ngupta_ has quit IRC | 02:02 | |
| *** ngupta_ has joined #openstack-keystone | 02:17 | |
| *** ngupta has quit IRC | 02:17 | |
| *** ngupta_ has quit IRC | 02:22 | |
| *** stevemar has quit IRC | 02:30 | |
| *** stevemar has joined #openstack-keystone | 02:31 | |
| *** spzala has quit IRC | 02:32 | |
| *** lamt has joined #openstack-keystone | 02:33 | |
| *** ChanServ sets mode: +o stevemar | 02:35 | |
| *** sdake has quit IRC | 02:35 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Deprecate endpoint filter catalog and make it as default https://review.openstack.org/375931 | 02:39 |
| stevemar | davechen: thanks for that ^ :) | 02:45 |
| stevemar | samueldmq: thanks for the remarks, and thanks for running :) | 02:45 |
| *** GB21 has quit IRC | 02:56 | |
| *** david-lyle has quit IRC | 03:04 | |
| * davechen looking into the failure testcases... | 03:06 | |
| davechen | stevemar: happy to work on that. :) | 03:07 |
| *** roxanaghe has joined #openstack-keystone | 03:15 | |
| *** roxanaghe has quit IRC | 03:20 | |
| *** brad[]` has quit IRC | 03:38 | |
| *** markvoelker has joined #openstack-keystone | 03:48 | |
| *** markvoelker has quit IRC | 03:53 | |
| *** tonytan_brb has joined #openstack-keystone | 04:17 | |
| *** tonytan4ever has quit IRC | 04:19 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/376115 | 04:21 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/376116 | 04:21 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Extract token fetching into method https://review.openstack.org/376123 | 04:23 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/376129 | 04:26 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/376137 | 04:26 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/373686 | 04:26 |
| *** roxanaghe has joined #openstack-keystone | 04:31 | |
| *** spzala has joined #openstack-keystone | 04:32 | |
| *** roxanaghe has quit IRC | 04:35 | |
| *** spzala has quit IRC | 04:37 | |
| *** sdake has joined #openstack-keystone | 04:41 | |
| *** sdake has quit IRC | 04:45 | |
| *** markvoelker has joined #openstack-keystone | 04:49 | |
| *** markvoelker has quit IRC | 04:53 | |
| *** GB21 has joined #openstack-keystone | 04:53 | |
| *** tqtran has joined #openstack-keystone | 04:59 | |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Tweak api-ref doc for v3 roles status codes https://review.openstack.org/367794 | 05:00 |
| *** tqtran has quit IRC | 05:04 | |
| *** jidar_ has joined #openstack-keystone | 05:13 | |
| *** crinkle_ has joined #openstack-keystone | 05:13 | |
| *** ctracey_ has joined #openstack-keystone | 05:13 | |
| *** auggy_ has joined #openstack-keystone | 05:13 | |
| *** adriant has quit IRC | 05:14 | |
| *** DuncanT_ has joined #openstack-keystone | 05:15 | |
| *** ktychkova_ has joined #openstack-keystone | 05:15 | |
| *** serverascode_ has joined #openstack-keystone | 05:15 | |
| *** X-Istence has joined #openstack-keystone | 05:16 | |
| *** Guest66676 has joined #openstack-keystone | 05:16 | |
| *** woodburn1 has joined #openstack-keystone | 05:16 | |
| *** pleia2_ has joined #openstack-keystone | 05:16 | |
| *** chrome0_ has joined #openstack-keystone | 05:19 | |
| *** dgonzalez_ has joined #openstack-keystone | 05:19 | |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Tweak api-ref doc for v3 roles https://review.openstack.org/376169 | 05:19 |
| *** jlk` has joined #openstack-keystone | 05:19 | |
| *** jlvillal_ has joined #openstack-keystone | 05:19 | |
| *** amoralej_ has joined #openstack-keystone | 05:20 | |
| *** clayton_ has joined #openstack-keystone | 05:20 | |
| *** timburke_ has joined #openstack-keystone | 05:20 | |
| *** sileht has quit IRC | 05:20 | |
| *** woodburn has quit IRC | 05:21 | |
| *** serverascode has quit IRC | 05:21 | |
| *** tsufiev has quit IRC | 05:21 | |
| *** mrhillsman has quit IRC | 05:21 | |
| *** ctracey has quit IRC | 05:21 | |
| *** dmellado has quit IRC | 05:21 | |
| *** ayoung has quit IRC | 05:21 | |
| *** chrome0 has quit IRC | 05:21 | |
| *** jlvillal has quit IRC | 05:21 | |
| *** timburke has quit IRC | 05:21 | |
| *** jlk has quit IRC | 05:21 | |
| *** arunkant has quit IRC | 05:21 | |
| *** Guest29913 has quit IRC | 05:21 | |
| *** vkmc has quit IRC | 05:21 | |
| *** clayton has quit IRC | 05:21 | |
| *** auggy has quit IRC | 05:21 | |
| *** mnaser has quit IRC | 05:21 | |
| *** DuncanT has quit IRC | 05:21 | |
| *** amoralej has quit IRC | 05:21 | |
| *** iurygregory_ has quit IRC | 05:21 | |
| *** kragniz has quit IRC | 05:21 | |
| *** hogepodge has quit IRC | 05:21 | |
| *** jidar has quit IRC | 05:21 | |
| *** crinkle has quit IRC | 05:21 | |
| *** dgonzalez has quit IRC | 05:21 | |
| *** timss has quit IRC | 05:21 | |
| *** pleia2 has quit IRC | 05:21 | |
| *** ktychkova has quit IRC | 05:21 | |
| *** rha has quit IRC | 05:21 | |
| *** Guest66666 has quit IRC | 05:21 | |
| *** jamiec has quit IRC | 05:21 | |
| *** x58 has quit IRC | 05:21 | |
| *** SpamapS has quit IRC | 05:21 | |
| *** dgonzalez_ is now known as dgonzalez | 05:21 | |
| *** tonytan_brb has quit IRC | 05:21 | |
| *** clayton_ is now known as clayton | 05:21 | |
| *** rha_ has joined #openstack-keystone | 05:21 | |
| *** dmellado has joined #openstack-keystone | 05:22 | |
| *** tsufiev has joined #openstack-keystone | 05:22 | |
| *** jlvillal_ is now known as jlvillal | 05:23 | |
| *** vkmc has joined #openstack-keystone | 05:23 | |
| *** jlvillal is now known as Guest97128 | 05:23 | |
| *** ctracey_ is now known as ctracey | 05:25 | |
| *** auggy_ is now known as auggy | 05:25 | |
| *** mnaser has joined #openstack-keystone | 05:26 | |
| *** ayoung has joined #openstack-keystone | 05:27 | |
| *** ChanServ sets mode: +v ayoung | 05:27 | |
| *** arunkant has joined #openstack-keystone | 05:27 | |
| *** mrhillsman has joined #openstack-keystone | 05:27 | |
| *** timss has joined #openstack-keystone | 05:27 | |
| *** kragniz has joined #openstack-keystone | 05:28 | |
| *** Guest29913 has joined #openstack-keystone | 05:28 | |
| *** X-Istence is now known as x58 | 05:28 | |
| *** iurygregory_ has joined #openstack-keystone | 05:28 | |
| *** SpamapS has joined #openstack-keystone | 05:28 | |
| *** sileht has joined #openstack-keystone | 05:29 | |
| *** rcernin has joined #openstack-keystone | 05:30 | |
| *** serverascode_ is now known as serverascode | 05:31 | |
| *** DuncanT_ is now known as DuncanT | 05:36 | |
| breton | morning, keystone | 05:36 |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/376137 | 05:50 |
| *** haplo37_ has quit IRC | 05:56 | |
| *** haplo37_ has joined #openstack-keystone | 05:58 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/376115 | 06:07 |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/376129 | 06:13 |
| openstackgerrit | Hieu LE proposed openstack/keystone: Remove default=None when set value in config https://review.openstack.org/376193 | 06:13 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/376116 | 06:23 |
| *** jidar_ is now known as jidar | 06:24 | |
| darrenc | any keystone gurus around? | 06:40 |
| *** pcaruana has joined #openstack-keystone | 06:45 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Raise NotImplementedError instead of NotImplemented https://review.openstack.org/365509 | 06:49 |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/keystonemiddleware: Use method constant_time_compare from oslo.utils https://review.openstack.org/376235 | 07:11 |
| *** rha_ is now known as rha | 07:16 | |
| *** rha has joined #openstack-keystone | 07:16 | |
| *** roxanaghe has joined #openstack-keystone | 07:19 | |
| *** roxanaghe has quit IRC | 07:24 | |
| *** jaosorior has joined #openstack-keystone | 07:29 | |
| *** amoralej_ is now known as amoralej | 07:43 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:01 | |
| *** Guest29913 is now known as amakarov | 08:08 | |
| *** tonytan4ever has joined #openstack-keystone | 08:22 | |
| *** tonytan4ever has quit IRC | 08:27 | |
| *** asettle has joined #openstack-keystone | 08:30 | |
| *** TonyXu has quit IRC | 08:32 | |
| *** TonyXu has joined #openstack-keystone | 08:33 | |
| *** jlwhite has quit IRC | 08:36 | |
| openstackgerrit | Cao Xuan Hoang proposed openstack/keystone: Using assertIsNone() instead of assertIs(None) https://review.openstack.org/376295 | 08:36 |
| *** jlwhite has joined #openstack-keystone | 08:36 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Verbose 401/403 debug responses https://review.openstack.org/372433 | 08:40 |
| *** ChanServ sets mode: +v henrynash | 08:50 | |
| openstackgerrit | Cao Xuan Hoang proposed openstack/keystone: Use assertEqual() instead of assertDictEqual() https://review.openstack.org/376307 | 08:54 |
| openstackgerrit | Merged openstack/keystonemiddleware: Raise NotImplementedError instead of NotImplemented https://review.openstack.org/365509 | 08:55 |
| *** acoles_ is now known as acoles | 09:01 | |
| *** acoles has left #openstack-keystone | 09:01 | |
| *** code-R has joined #openstack-keystone | 09:04 | |
| *** code-R_ has joined #openstack-keystone | 09:07 | |
| *** code-R has quit IRC | 09:10 | |
| *** jistr has quit IRC | 09:20 | |
| *** pjm6_ is now known as pjm6 | 09:36 | |
| *** andreykurilin_ has left #openstack-keystone | 09:36 | |
| *** flaper87 has joined #openstack-keystone | 09:39 | |
| *** flaper87 has quit IRC | 09:39 | |
| *** flaper87 has joined #openstack-keystone | 09:39 | |
| *** daemontool has joined #openstack-keystone | 09:54 | |
| *** haplo37_ has quit IRC | 09:55 | |
| *** haplo37_ has joined #openstack-keystone | 09:57 | |
| *** sdake has joined #openstack-keystone | 10:06 | |
| *** EinstCra_ has quit IRC | 10:16 | |
| *** code-R_ has quit IRC | 10:18 | |
| *** code-R has joined #openstack-keystone | 10:32 | |
| *** rodrigods has quit IRC | 10:43 | |
| *** rodrigods has joined #openstack-keystone | 10:43 | |
| *** dikonoor has joined #openstack-keystone | 10:45 | |
| dikonoor | henrynash:hi, are you around? | 10:46 |
| *** roxanaghe has joined #openstack-keystone | 10:48 | |
| *** nicolasbock has joined #openstack-keystone | 10:50 | |
| dikonoor | dolphm: bknudson: anyone around? | 10:50 |
| *** roxanaghe has quit IRC | 10:52 | |
| *** code-R has quit IRC | 10:54 | |
| *** code-R has joined #openstack-keystone | 10:54 | |
| *** haplo37_ has quit IRC | 10:56 | |
| breton | dikonoor: what stops you from just asking the question? maybe someone else will know the answer | 10:59 |
| *** haplo37_ has joined #openstack-keystone | 10:59 | |
| dikonoor | breton: Thanks for responding :) https://bugs.launchpad.net/keystone/+bug/1627696 | 11:00 |
| openstack | Launchpad bug 1627696 in OpenStack Identity (keystone) "keystonemiddleware throws OSError " [Undecided,New] | 11:00 |
| dikonoor | I keep running into the problem mentioned in that bug (which I just opened).. | 11:00 |
| *** tqtran has joined #openstack-keystone | 11:01 | |
| *** sdake_ has joined #openstack-keystone | 11:04 | |
| *** sdake has quit IRC | 11:04 | |
| *** nicolasbock has quit IRC | 11:04 | |
| *** tqtran has quit IRC | 11:05 | |
| *** davechen has quit IRC | 11:19 | |
| *** nicolasbock has joined #openstack-keystone | 11:27 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Correct output for Implied Roles https://review.openstack.org/368498 | 11:37 |
| *** amoralej is now known as amoralej|lunch | 11:43 | |
| *** sdake_ has quit IRC | 11:43 | |
| *** artmr has joined #openstack-keystone | 11:53 | |
| *** tonytan4ever has joined #openstack-keystone | 11:54 | |
| *** raildo has joined #openstack-keystone | 11:58 | |
| *** tonytan4ever has quit IRC | 11:58 | |
| *** asettle has quit IRC | 12:03 | |
| *** GB21 has quit IRC | 12:06 | |
| *** iurygregory_ is now known as iurygregory | 12:11 | |
| *** asettle has joined #openstack-keystone | 12:14 | |
| *** GB21 has joined #openstack-keystone | 12:19 | |
| *** markvoelker has joined #openstack-keystone | 12:20 | |
| *** code-R has quit IRC | 12:21 | |
| *** lamt has quit IRC | 12:27 | |
| *** asettle has quit IRC | 12:31 | |
| *** asettle has joined #openstack-keystone | 12:32 | |
| *** pnavarro has joined #openstack-keystone | 12:35 | |
| *** evrardjp has quit IRC | 12:36 | |
| *** evrardjp has joined #openstack-keystone | 12:36 | |
| *** roxanaghe has joined #openstack-keystone | 12:36 | |
| *** daemontool has quit IRC | 12:38 | |
| *** roxanaghe has quit IRC | 12:41 | |
| *** markvoelker has quit IRC | 12:41 | |
| *** edmondsw has joined #openstack-keystone | 12:43 | |
| *** asettle has quit IRC | 12:43 | |
| *** asettle has joined #openstack-keystone | 12:43 | |
| *** daemontool has joined #openstack-keystone | 12:44 | |
| *** david-lyle has joined #openstack-keystone | 12:56 | |
| *** markvoelker has joined #openstack-keystone | 12:57 | |
| *** sdake has joined #openstack-keystone | 12:57 | |
| *** amoralej|lunch is now known as amoralej | 12:58 | |
| *** andrewbogott has quit IRC | 13:01 | |
| *** andrewbogott has joined #openstack-keystone | 13:01 | |
| *** daemontool has quit IRC | 13:01 | |
| *** sdake_ has joined #openstack-keystone | 13:03 | |
| openstackgerrit | Merged openstack/oslo.policy: Doc: declare YAML/JSON support https://review.openstack.org/374632 | 13:03 |
| *** daemontool has joined #openstack-keystone | 13:03 | |
| *** sdake has quit IRC | 13:06 | |
| openstackgerrit | Merged openstack/keystone: Add domain check in domain-specific role implication https://review.openstack.org/374463 | 13:13 |
| *** GB21 has quit IRC | 13:14 | |
| *** ngupta has joined #openstack-keystone | 13:14 | |
| *** code-R has joined #openstack-keystone | 13:16 | |
| *** code-R_ has joined #openstack-keystone | 13:18 | |
| *** jaosorior has quit IRC | 13:19 | |
| *** jaosorior has joined #openstack-keystone | 13:19 | |
| *** code-R has quit IRC | 13:21 | |
| *** LamT_ has joined #openstack-keystone | 13:23 | |
| *** lamt has joined #openstack-keystone | 13:26 | |
| dikonoor | anyone has any clue on why https://bugs.launchpad.net/keystone/+bug/1627696 could be happening ? | 13:26 |
| openstack | Launchpad bug 1627696 in OpenStack Identity (keystone) "keystonemiddleware throws OSError " [Undecided,New] | 13:26 |
| *** GB21 has joined #openstack-keystone | 13:27 | |
| *** Guest97128 is now known as jlvillal | 13:36 | |
| *** BrAsS_mOnKeY is now known as g2` | 13:38 | |
| *** GB21 has quit IRC | 13:44 | |
| *** jlk` is now known as jlk | 13:44 | |
| *** jlk has quit IRC | 13:44 | |
| *** jlk has joined #openstack-keystone | 13:44 | |
| *** code-R_ has quit IRC | 13:45 | |
| *** code-R has joined #openstack-keystone | 13:46 | |
| dstanek_ | dikonoor: just looking at the stack trace it appears there is something wrong with creating/using the temp signing directory | 13:46 |
| *** brad[] has joined #openstack-keystone | 13:47 | |
| *** sdake has joined #openstack-keystone | 13:47 | |
| *** woodster_ has joined #openstack-keystone | 13:48 | |
| openstackgerrit | Merged openstack/keystone: Remove default=None when set value in config https://review.openstack.org/376193 | 13:49 |
| dikonoor | dstanek_: yeah.. we get into this flow of verify_signing_dir() only when there's an exception inside https://github.com/openstack/keystonemiddleware/blob/stable/newton/keystonemiddleware/auth_token/_signing_dir.py#L45 | 13:49 |
| *** sdake_ has quit IRC | 13:50 | |
| dikonoor | dstanek_:but when I put a debugger on, it never gets into ththe except flow: | 13:50 |
| dikonoor | https://github.com/openstack/keystonemiddleware/blob/stable/newton/keystonemiddleware/auth_token/_signing_dir.py#L53 | 13:50 |
| *** sdake_ has joined #openstack-keystone | 13:51 | |
| dikonoor | dstanek_: I also find it strange that the /tmp/ directory does not have any keystone-signing-* created by neutron and glance even in cases where everything works | 13:52 |
| *** sdake has quit IRC | 13:54 | |
| *** tonytan4ever has joined #openstack-keystone | 13:55 | |
| *** ravelar has joined #openstack-keystone | 13:55 | |
| dstanek_ | dikonoor: does the user running keystone have the ability to create directories there? | 13:56 |
| dikonoor | dstanek_: The file permissions of the /tmp/ directory is such that anyone can create directories inside it..I see keystone-signing-* directories inside temp for nova, swift, cinder, ceilometer but not for neutron and glance.. | 13:58 |
| *** tonytan4ever has quit IRC | 13:59 | |
| *** tonytan4ever has joined #openstack-keystone | 13:59 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add indexes to the revocation_event table https://review.openstack.org/376523 | 14:00 |
| ayoung | dikonoor, _verify_signing_dir you using PKI tokens? | 14:01 |
| ayoung | PLease don't. | 14:01 |
| *** GB21 has joined #openstack-keystone | 14:01 | |
| *** ravelar has quit IRC | 14:02 | |
| *** ravelar has joined #openstack-keystone | 14:02 | |
| dikonoor | ayoung: No, using fernet tokens | 14:04 |
| ayoung | dikonoor, hmmm, we need to kill the signing-directory code. Is it triggered by a config option? Maybe not... | 14:04 |
| dikonoor | ayoung: I am using the default config ..no specific changes made | 14:05 |
| ayoung | dikonoor, well here is what is happening | 14:05 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add release note for fernet tokens https://review.openstack.org/376526 | 14:05 |
| ayoung | dikonoor, bacjk in the days of PKI tokens, we needed a way to distributed certificates | 14:05 |
| *** GB21 has quit IRC | 14:06 | |
| dikonoor | ayoung: ok | 14:06 |
| ayoung | at start up, middleware creates a temp dir, and fetches the certs on demand, puts them in the temp dir | 14:06 |
| ayoung | at startupi, you system is throwing an exception trying to create the temp dir | 14:06 |
| dikonoor | ayoung : and these certificates are applicable only if the token provider is pki..Then why does the keystonemiddleware even get into this flow for fernet? | 14:07 |
| ayoung | dikonoor, because middleware does not know what kind of tokens it is going to receive | 14:08 |
| ayoung | dikonoor, this has not come up in a long time, not sure why you are seeing it. What did you do differently? | 14:08 |
| lbragstad | stevemar i added a release note for making fernet default and made the grenade change dependent on it | 14:08 |
| lbragstad | stevemar otherwise - everything in that series to make fernet the default should be good to go | 14:09 |
| lbragstad | stevemar across all impacting projects | 14:09 |
| dikonoor | ayoung: I don't seem to have done anything differently.. | 14:09 |
| ayoung | dikonoor, I can't seem to get to launchpad right now to look further at the stacktrace | 14:10 |
| dikonoor | ayoung: This is the first time I am hitting this..and I can't reproduce this on any other setup | 14:10 |
| ayoung | dikonoor, its a permissions or SELinux type issue, I guess | 14:10 |
| dikonoor | ayoung : Well..I kind of feel that too..but I couldn't find any selinux errors | 14:10 |
| dikonoor | ayoung: I have selinux in enforcing..So, next time I hit it I will put it in the permissive mode and check if that helps | 14:11 |
| dikonoor | ayoung: But when this is hit, if I restart the neutron serivce, the problem disappears | 14:11 |
| dikonoor | ayoung: very strangely.. and even when I hit this, I can't reproduce it from a python prompt if I try to use the same tempfil and os.makedirs api | 14:12 |
| ayoung | dikonoor, using the keystone user that the wsgi script runs as? | 14:13 |
| dikonoor | ayoung : I hit this when I make a neutron rest api call for eg. v2.0/ports ..so it would be neutron user..or I did not follow your question | 14:14 |
| dikonoor | ayoung : neutron user running neutron service invoking keystonemiddleware trying to create a tmp directory ? | 14:15 |
| ayoung | no, you are right...neutron | 14:15 |
| ayoung | but the bug is filed against Keystone.... | 14:15 |
| ayoung | should be against keystonemiddleware | 14:15 |
| dikonoor | ayoung:I can fix that :) | 14:16 |
| *** spedione|AWAY is now known as spedione | 14:17 | |
| dikonoor | ayoung: Can't access LP now | 14:17 |
| *** ngupta has quit IRC | 14:21 | |
| *** ngupta has joined #openstack-keystone | 14:21 | |
| *** roxanaghe has joined #openstack-keystone | 14:24 | |
| *** Guest92615 is now known as zeus | 14:26 | |
| *** zeus has quit IRC | 14:26 | |
| *** zeus has joined #openstack-keystone | 14:26 | |
| *** ngupta has quit IRC | 14:26 | |
| *** roxanaghe has quit IRC | 14:29 | |
| *** artmr has quit IRC | 14:36 | |
| openstackgerrit | Stephen Finucane proposed openstack/oslo.policy: Add sphinx extension to build sample policy https://review.openstack.org/376544 | 14:38 |
| *** dikonoor has quit IRC | 14:39 | |
| *** code-R has quit IRC | 14:40 | |
| ayoung | dstanek_, doing a Keystone server build of tag 8.1.2 gets an error building cryptography (something with openssl). It even happend when I used requirements.txt and test-requirements.txt from master. So the binaries are not in the venv...they are the same. But the python buld fails. Puzzled... | 14:40 |
| rderose | bknudon: you around? | 14:42 |
| ravelar | bknudson: is there any additional changes you would like me to address for https://review.openstack.org/#/c/359371/ | 14:42 |
| rderose | :) | 14:42 |
| bknudson | rderose: I'm around. | 14:42 |
| rderose | bknudson: was going to ask you about 359371 | 14:42 |
| bknudson | I haven't had a chance to look at it again. | 14:43 |
| rderose | saw your comments, were they in regards to clint's? | 14:43 |
| bknudson | yes, they were mostly in regards to SpamapS feedback. | 14:43 |
| rderose | bknudson: okay, cool | 14:44 |
| bknudson | the point is that validation is taking way too long | 14:44 |
| bknudson | and scaling keystone isn't going to help it. even with 1 system it takes too long | 14:44 |
| bknudson | so we need this or something else that improves single-system validation performance | 14:45 |
| rderose | bknudson: right | 14:45 |
| bknudson | ravelar: I would like to see unit tests similar to how http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/identity/test_backend_sql.py does it | 14:46 |
| dstanek_ | ayoung: what's the failure? | 14:46 |
| bknudson | ravelar: actually, more like http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/identity/backends/test_sql.py | 14:46 |
| rderose | bknudson: good point, doesn't matter if we add 10 servers, it still takes too long | 14:46 |
| ravelar | bknudson: will look into those to see if I need to add anything else. In the meantime, I have added 10 additional tests that call the new is_revoke directly by removing the old is_revoke and matches and then replacing the calls in the test with the new one | 14:47 |
| bknudson | rderose: if there was some idea to speed things up via some other method then we can go with that. | 14:47 |
| *** spzala has joined #openstack-keystone | 14:48 | |
| bknudson | but I can't think of anything. | 14:48 |
| rderose | me neither :) | 14:48 |
| bknudson | I don't know how much it would help to have a simpler structure stored in memcache | 14:48 |
| *** gagehugo has joined #openstack-keystone | 14:49 | |
| *** woodburn1 has quit IRC | 14:50 | |
| bknudson | or if there's some way to leverage last_fetch so that there isn't so much work done by the server | 14:50 |
| *** edtubill has joined #openstack-keystone | 14:51 | |
| rderose | bknudson: well, the sql approach should solve it, right? at least your and ravelar's numbers looks pretty good | 14:51 |
| bknudson | rderose: I'm happy with the numbers I've seen on a dev system, but I'm still wary about scaling. | 14:51 |
| bknudson | At the scales I'm thinking we'll be running at, I think the sql approach will work. | 14:52 |
| rderose | bknudson: maybe "solve" it is not the right words :) but definitely improves it. | 14:52 |
| rderose | bknudson: yeah, I would think it would scale | 14:53 |
| bknudson | at high enough scales there's going to be way too much going to the database, I think; and no way to reduce it. | 14:53 |
| rderose | bknudson: other than indexing, we could also flush the revocation_events table more often if need be | 14:54 |
| bknudson | maybe database does a good job of caching, too. | 14:54 |
| bknudson | I doubt that indexing will give us anything. Would have to measure that. | 14:54 |
| rderose | bknudson: I'm thinking that as well, indexing has only helped me when we're talking millions of rows | 14:54 |
| bknudson | index would have to give us better results than just scanning the table. | 14:55 |
| rderose | writes would be slower | 14:55 |
| dstanek_ | rderose: with that many rows is where i would usually turn off indexing | 14:55 |
| bknudson | the table isn't very wide, so lots of rows fit on a page. | 14:55 |
| rderose | dstanek: that would be where I re-index :) | 14:55 |
| *** tonytan_brb has joined #openstack-keystone | 14:56 | |
| rderose | bknudson dstanek: how often to we write compared to read on this table? | 14:56 |
| rderose | is it like 1:10 read:write? | 14:57 |
| bknudson | I would guess the ratio is around 20:1 ? | 14:57 |
| *** daemontool_ has joined #openstack-keystone | 14:57 | |
| rderose | okay | 14:57 |
| bknudson | 1:10 to 1:20 I would expect. I haven't measured it. | 14:57 |
| bknudson | there's caching in auth_token middleware. | 14:57 |
| *** richm has joined #openstack-keystone | 14:57 | |
| bknudson | and tokens don't get re-used as much as we'd like. | 14:57 |
| rderose | I see | 14:57 |
| dstanek_ | bknudson: that's an understatement :-) | 14:57 |
| *** hogepodge has joined #openstack-keystone | 14:58 | |
| bknudson | depending on applications in the cloud you could see 1:1000 or 1:2 . | 14:58 |
| bknudson | you might run applications that never revoke tokens. | 14:59 |
| *** tonytan4ever has quit IRC | 14:59 | |
| bknudson | or you run applications that think it's better to revoke every token they get. | 14:59 |
| *** daemontool has quit IRC | 14:59 | |
| *** sdake_ has quit IRC | 14:59 | |
| rderose | bknudson: so it could be dramatically different between operators, hmm... | 14:59 |
| bknudson | dstanek_: at least with fernet the token table doesn't grow with every new token. | 15:00 |
| bknudson | rderose: another way to have a shorter revocation event list would be to change keystone to validate project status vs the project table rather than have an event for it. | 15:01 |
| *** Marcellin__ has joined #openstack-keystone | 15:01 | |
| rderose | ravelar: does your other patch do this ^ | 15:02 |
| *** asettle has quit IRC | 15:02 | |
| bknudson | That should be a separate patch | 15:02 |
| bknudson | we need to figure out how to handle the event API if we make that change. | 15:03 |
| bknudson | I doubt anyone is using the event api. | 15:03 |
| rderose | I see | 15:03 |
| bknudson | but we can't just change it. Maybe have a config option or something. | 15:03 |
| dstanek_ | bknudson: do we have to support all of the existing events to deal with pki tokens? | 15:03 |
| ravelar | rderose yes for domains and projects but lbragstads patch is looking into doing away with projects and domains altogether | 15:04 |
| bknudson | dstanek_: what do you mean to deal with pki tokens? | 15:04 |
| bknudson | pki tokens can go to the token table for revocations, don't need events | 15:04 |
| dstanek_ | bknudson: do events like project changes need to still be captured? | 15:04 |
| ravelar | rderose in revocation events that is | 15:04 |
| rderose | ravelar: I see, thanks | 15:05 |
| bknudson | dstanek_: I think events like project changes need to be captured to support the revocation events API. | 15:05 |
| bknudson | Maybe they could be in a separate table? | 15:05 |
| *** ngupta has joined #openstack-keystone | 15:06 | |
| bknudson | dstanek_: the only problem I see with getting rid of project events is that something might be using the revocation event API. Nothing we've written (auth_token) uses the event API. | 15:06 |
| *** jlvillal has quit IRC | 15:07 | |
| ayoung | dstanek_, : error: command 'gcc' failed with exit status 1 | 15:07 |
| ayoung | start of the trace is here | 15:07 |
| ayoung | build/temp.linux-x86_64-2.7/_openssl.c:697:6: error: conflicting types for ‘BIO_new_mem_buf’ | 15:07 |
| *** mvk has quit IRC | 15:07 | |
| dstanek_ | ayoung: have you tried checking out bindep to see if you have all the correct system deps? | 15:08 |
| ayoung | dstanek_, nope. Never heard of it before | 15:09 |
| ayoung | dstanek_, I'm running Fedora 24. I wouldn't be surprised if they were off, but the master branch builds | 15:10 |
| dstanek_ | ayoung: http://docs.openstack.org/infra/bindep/readme.html | 15:10 |
| ayoung | its just the old one that fails...even with the master's requirements. What else could affect the build process this way? | 15:10 |
| dstanek_ | ayoung: i don't think that looks at strange verison issues though | 15:10 |
| dstanek_ | ayoung: hmm... have you tried to delete any temporary build dirs and make sure there is no lingering object files? | 15:11 |
| ayoung | tox -r | 15:12 |
| *** twouters_ has joined #openstack-keystone | 15:14 | |
| *** roxanaghe has joined #openstack-keystone | 15:15 | |
| *** sdake has joined #openstack-keystone | 15:15 | |
| ayoung | dstanek_, is there anything other than .tox? | 15:17 |
| *** woodburn has joined #openstack-keystone | 15:18 | |
| ayoung | and it build when I switch to master, and did n't buld when I switch back. weeeeeird. | 15:18 |
| dstanek_ | ayoung: maybe ~/.pip? not really sure anymore. i thought everything has been moved to .tox thought | 15:20 |
| ayoung | dstanek_, just killed .tox and reran, same thing? | 15:20 |
| dstanek_ | s/t$// | 15:20 |
| ayoung | let me see | 15:20 |
| ayoung | dstanek_, only thing there was ~/.tox/distshare/oslo.context-2.9.1.dev3.zip | 15:21 |
| ayoung | dstanek_, can you build off that tag? | 15:22 |
| dstanek_ | ayoung: sure. i think i alredy have a f24 cloud node | 15:25 |
| ayoung | dstanek_, so, it is from build/temp.linux-x86_64-2.7/_openssl.c | 15:26 |
| ayoung | In file included from /usr/include/openssl/asn1.h:65:0, | 15:26 |
| *** openstackstatus has joined #openstack-keystone | 15:27 | |
| *** ChanServ sets mode: +v openstackstatus | 15:27 | |
| ayoung | /usr/include/openssl/bio.h:692:6: note: previous declaration of ‘BIO_new_mem_buf’ was here | 15:27 |
| ayoung | those both look like system libraries | 15:27 |
| ayoung | the asn one is this line: # include <openssl/bio.h> | 15:28 |
| ayoung | must be getting it from a different location, or with a different flag | 15:29 |
| ayoung | /usr/include/openssl/bio.h seems to be the only one on the system, though | 15:29 |
| *** akrzos has quit IRC | 15:30 | |
| ayoung | dstanek_, there are other error in the traceback, too. SSLv2_method SSLv2_client_method SSLv2_server_method redeclared | 15:31 |
| *** akrzos has joined #openstack-keystone | 15:32 | |
| dstanek_ | bindep doesn't seem to work on f24 | 15:37 |
| *** spilla has joined #openstack-keystone | 15:39 | |
| breton | hm | 15:40 |
| breton | is something wrong with gerrit and lp integration? I am getting "Provider is not supported, or was incorrectly entered." | 15:41 |
| spilla | breton launchpad is currently down, i know people have been running into some issues with gerrit, most likely because of that | 15:42 |
| -openstackstatus- NOTICE: Earlier job failures for "zuul-cloner: error: too few arguments" should now be solved, and can safely be rechecked | 15:42 | |
| breton | yeah, things are broken | 15:43 |
| -openstackstatus- NOTICE: Launchpad SSO is offline, preventing login to https://review.openstack.org/, https://wiki.openstack.org/ and many other sites; no ETA has been provided by the LP admin team | 15:47 | |
| *** adrian_otto has joined #openstack-keystone | 15:47 | |
| *** ChanServ changes topic to "Launchpad SSO is offline, preventing login to https://review.openstack.org/, https://wiki.openstack.org/ and many other sites; no ETA has been provided by the LP admin team" | 15:47 | |
| *** rcernin has quit IRC | 15:52 | |
| *** browne has joined #openstack-keystone | 15:55 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Remove support for PKI and PKIz tokens https://review.openstack.org/374479 | 16:01 |
| dstanek_ | ayoung: so i'm seeing the same thing as you | 16:02 |
| ayoung | dstanek_, I thought pip freeze showed the set of package/versions, | 16:05 |
| ayoung | but | 16:05 |
| ayoung | Installing collected packages: cffi, cryptography | 16:05 |
| ayoung | Found existing installation: cffi 1.3.1 | 16:05 |
| ayoung | Uninstalling cffi-1.3.1: | 16:05 |
| ayoung | Successfully uninstalled cffi-1.3.1 | 16:05 |
| ayoung | Successfully installed cffi-1.8.3 cryptography-1.5.1 | 16:05 |
| ayoung | but then not seeing crypto in pip freeze | 16:05 |
| openstackgerrit | Alexey Yelistratov proposed openstack/keystone: Add DB operations tracing https://review.openstack.org/294535 | 16:08 |
| *** ChanServ changes topic to "Summit Brainstorm: https://etherpad.openstack.org/p/keystone-ocata-summit-brainstorm | Meeting Agenda https://etherpad.openstack.org/p/keystone-weekly-meeting | Newton retrospective: https://etherpad.openstack.org/p/keystone-newton-retrospective" | 16:09 | |
| -openstackstatus- NOTICE: Launchpad SSO logins are confirmed working correctly again | 16:09 | |
| dstanek_ | ayoung: pip freeze should show all of the python packages installed in that environment | 16:10 |
| ayoung | dstanek_, is it lying, or is the pip install lying? | 16:11 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: OAuth1 driver for unified delegation https://review.openstack.org/370965 | 16:12 |
| dstanek_ | ayoung: i'm not sure... i see it OK in my environment; are you using the same pip for installing and freezing? | 16:13 |
| *** david-lyle has quit IRC | 16:13 | |
| *** david-lyle has joined #openstack-keystone | 16:14 | |
| stevemar | o/ | 16:15 |
| stevemar | semi-online today in case someone is looking | 16:15 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 16:15 |
| *** daemontool_ has quit IRC | 16:17 | |
| *** dikonoor has joined #openstack-keystone | 16:17 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Remove support for PKI and PKIz tokens https://review.openstack.org/374479 | 16:22 |
| *** slberger has joined #openstack-keystone | 16:23 | |
| ayoung | dstanek_, I thought I was | 16:24 |
| ayoung | dstanek_, but you are seeing it too>? | 16:24 |
| *** lamt has quit IRC | 16:25 | |
| dstanek_ | ayoung: yes, works on master, but fails on 8.1.2 | 16:26 |
| ayoung | dstanek_, and we are still supporting 8.1.2, so that means any commit there would fail, right? | 16:27 |
| *** lamt has joined #openstack-keystone | 16:27 | |
| dstanek_ | ayoung: unless the devstack magic installs the right things. i'm not sure what this issue would be | 16:27 |
| ayoung | dstanek_, ah true, that should install things via packages for the most part | 16:28 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add indexes to the revocation_event table https://review.openstack.org/376523 | 16:28 |
| ayoung | does not appear to install cryptography that way, though | 16:29 |
| *** pcaruana has quit IRC | 16:29 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add indexes to the revocation_event table https://review.openstack.org/376523 | 16:31 |
| dstanek_ | ayoung: it's not installed on master for yoU? | 16:31 |
| *** ezpz_ has joined #openstack-keystone | 16:36 | |
| *** ezpz_ is now known as ezpz | 16:36 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Domain included for role in list_role_assignment https://review.openstack.org/373516 | 16:36 |
| *** ravelar has quit IRC | 16:36 | |
| stevemar | ayoung: dstanek_ that's liberty right? it's only supported for a few more days/weeks | 16:37 |
| ayoung | stevemar, yeah, well, its supported now, and I need to backport to it | 16:38 |
| stevemar | ayoung: what are you backporting? | 16:38 |
| ayoung | stevemar, LDAP AD fixes | 16:39 |
| breton | ayoung: link to review? | 16:39 |
| stevemar | ayoung: critical and security fixes only for upstream, but let's see the reviews anyway | 16:39 |
| ayoung | breton, I don't have it yet, as I was trying to run a unit test first | 16:39 |
| breton | stevemar: btw was mitaka cut? Patch https://review.openstack.org/374245 is still not merged :( | 16:40 |
| ayoung | https://review.openstack.org/376627 Enable support for posixGroups in LDAP is one of 2 | 16:40 |
| ayoung | don't have the second backported yet | 16:40 |
| stevemar | breton: it was already cut :( | 16:41 |
| ayoung | stevemar, we have a policy in RDO to not ship patches that have not been at least posted upstream fro | 16:41 |
| breton | stevemar: that's bad. Should i abandon the change? | 16:41 |
| stevemar | breton: no, i think we'll cut one more release eventually | 16:41 |
| *** slberger has quit IRC | 16:42 | |
| stevemar | breton: you can argue that it's a security fix since it relates to auth | 16:42 |
| ayoung | anything in keystone is a security fix | 16:43 |
| breton | sold! | 16:43 |
| stevemar | ayoung: the posixGroup fix is rather feature-ish | 16:44 |
| stevemar | i'll get slapped from the stable team | 16:44 |
| ayoung | stevemar, almost certainly | 16:44 |
| ayoung | stevemar, that was my response internally, too. | 16:44 |
| stevemar | ah okay, as long as we're on the same page :( | 16:44 |
| ayoung | But since we only just got a Newton based build shipped, and we have people doing long burnin process on Mitaka, telling them to start over now will not fly | 16:45 |
| ayoung | Downstream mitaka based distro took a lot longer than expected | 16:45 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Verbose 401/403 debug responses https://review.openstack.org/372433 | 16:45 |
| *** ravelar has joined #openstack-keystone | 16:47 | |
| *** pleia2_ is now known as pleia2 | 16:53 | |
| *** lamt has quit IRC | 16:54 | |
| *** ngupta has quit IRC | 16:54 | |
| *** ngupta has joined #openstack-keystone | 16:55 | |
| *** ngupta has quit IRC | 16:55 | |
| *** ngupta has joined #openstack-keystone | 16:55 | |
| *** esp has joined #openstack-keystone | 16:56 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add indexes to the revocation_event table https://review.openstack.org/376523 | 16:59 |
| *** slberger has joined #openstack-keystone | 17:00 | |
| *** mah has joined #openstack-keystone | 17:02 | |
| *** electrichead is now known as redrobot | 17:03 | |
| *** gyee has joined #openstack-keystone | 17:05 | |
| *** slberger has quit IRC | 17:06 | |
| *** jaosorior has quit IRC | 17:07 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: create release notes for removed functionality https://review.openstack.org/375914 | 17:07 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add docs for PCI-DSS https://review.openstack.org/374422 | 17:07 |
| *** tqtran has joined #openstack-keystone | 17:11 | |
| *** LamT_ has quit IRC | 17:11 | |
| *** Guest68174 is now known as med_ | 17:14 | |
| *** med_ has quit IRC | 17:14 | |
| *** med_ has joined #openstack-keystone | 17:14 | |
| *** morgan has joined #openstack-keystone | 17:18 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Change python code revocation search to sql https://review.openstack.org/359371 | 17:21 |
| *** harlowja has joined #openstack-keystone | 17:30 | |
| *** slberger has joined #openstack-keystone | 17:30 | |
| *** dikonoor has quit IRC | 17:32 | |
| * morgan sighs. | 17:34 | |
| morgan | o/ | 17:34 |
| *** tonytan_brb is now known as tonytan4ever | 17:45 | |
| stevemar | whats up morgan | 17:50 |
| stevemar | morgan: why the sigh, guy | 17:51 |
| *** ravelar has quit IRC | 17:55 | |
| *** ravelar has joined #openstack-keystone | 17:56 | |
| *** amoralej is now known as amoralej|off | 17:58 | |
| *** spzala has quit IRC | 18:01 | |
| *** spzala has joined #openstack-keystone | 18:02 | |
| *** spzala_ has joined #openstack-keystone | 18:03 | |
| *** spzala has quit IRC | 18:07 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add indexes to the revocation_event table https://review.openstack.org/376523 | 18:07 |
| *** spzala_ has quit IRC | 18:08 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Change python code revocation search to sql https://review.openstack.org/359371 | 18:09 |
| *** spzala has joined #openstack-keystone | 18:11 | |
| *** browne has quit IRC | 18:15 | |
| openstackgerrit | Merged openstack/keystone: Using assertIsNone() instead of assertIs(None) https://review.openstack.org/376295 | 18:17 |
| *** markvoelker_ has joined #openstack-keystone | 18:18 | |
| *** markvoelker has quit IRC | 18:19 | |
| *** spedione is now known as spedione|AWAY | 18:20 | |
| *** markvoelker has joined #openstack-keystone | 18:21 | |
| *** markvoelker_ has quit IRC | 18:24 | |
| *** thumpba has joined #openstack-keystone | 18:30 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: PCI-DSS functional tests https://review.openstack.org/377010 | 18:36 |
| *** ngupta has quit IRC | 18:36 | |
| *** ngupta has joined #openstack-keystone | 18:36 | |
| rodrigods | stevemar, rderose ^ | 18:36 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation assignment driver https://review.openstack.org/291318 | 18:37 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move dependency-related trust logic to manager https://review.openstack.org/360735 | 18:37 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation trust driver https://review.openstack.org/291871 | 18:37 |
| rderose | rodrigods: cool and thanks! will take a looks here shortly. | 18:37 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: OAuth1 driver for unified delegation https://review.openstack.org/370965 | 18:37 |
| *** ngupta has quit IRC | 18:41 | |
| *** ngupta has joined #openstack-keystone | 18:41 | |
| *** browne has joined #openstack-keystone | 18:45 | |
| morgan | stevemar: my bouncer is dead. | 18:48 |
| stevemar | morgan: womp womp | 18:48 |
| morgan | stevemar: like... the whole server is dead | 18:48 |
| morgan | looking at options and considering ditching the server | 18:48 |
| *** adrian_otto has quit IRC | 18:50 | |
| openstackgerrit | Tony Xu proposed openstack/pycadf: Clean oslo.i18n https://review.openstack.org/374522 | 18:51 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: PCI-DSS functional tests https://review.openstack.org/377010 | 18:57 |
| *** adrian_otto has joined #openstack-keystone | 19:07 | |
| *** spedione|AWAY is now known as spedione | 19:14 | |
| *** slberger has left #openstack-keystone | 19:19 | |
| *** jamielennox|away has quit IRC | 19:26 | |
| *** jamielennox|away has joined #openstack-keystone | 19:29 | |
| *** jamielennox|away is now known as jamielennox | 19:30 | |
| *** ChanServ sets mode: +v jamielennox | 19:30 | |
| *** sdake has quit IRC | 19:33 | |
| *** TonyXu has quit IRC | 19:41 | |
| *** haplo37_ has quit IRC | 19:45 | |
| *** crinkle_ is now known as crinkle | 19:45 | |
| *** sdake has joined #openstack-keystone | 19:46 | |
| *** haplo37_ has joined #openstack-keystone | 19:48 | |
| *** thiagolib has joined #openstack-keystone | 19:48 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Update man page for Ocata release version and date https://review.openstack.org/377068 | 20:04 |
| *** spedione is now known as spedione|AWAY | 20:05 | |
| *** Kimmo_ has quit IRC | 20:24 | |
| *** code-R has joined #openstack-keystone | 20:32 | |
| *** adriant has joined #openstack-keystone | 20:35 | |
| *** code-R_ has joined #openstack-keystone | 20:35 | |
| *** spzala has quit IRC | 20:35 | |
| *** spzala has joined #openstack-keystone | 20:36 | |
| *** code-R has quit IRC | 20:38 | |
| bknudson | rderose: ravelar: the index on user_id sped things up significantly! | 20:38 |
| bknudson | Token validated in 0:00:00.031574. -- used to be 0.1 | 20:38 |
| bknudson | and it's more like 0.4 with the original code (not doing sql filtering) | 20:39 |
| *** spzala has quit IRC | 20:40 | |
| bknudson | here's docs on explain output: https://dev.mysql.com/doc/refman/5.7/en/explain-output.html | 20:41 |
| rderose | bknudson: sweet! | 20:41 |
| bknudson | here's docs on using explain: https://dev.mysql.com/doc/refman/5.7/en/using-explain.html | 20:41 |
| bknudson | I don't know how we would find what indexes we need... not sure if mysql can use multiple indexes on a table. | 20:42 |
| rderose | bknudson: nice. adding a couple indexes here:https://review.openstack.org/#/c/376523/ | 20:42 |
| rderose | but leery about adding more | 20:42 |
| rderose | bknudson: in can, but with too many we can confuse the optimizer and slow down writes | 20:43 |
| bknudson | rderose: based on the docs looks like it's not useful to have multiple indexes if 1 works. | 20:43 |
| ravelar | bknudson that's good news! | 20:43 |
| rderose | so have to be careful | 20:43 |
| *** ngupta has quit IRC | 20:43 | |
| bknudson | https://dev.mysql.com/doc/refman/5.7/en/explain-output.html looks like it picks one index for a table. | 20:43 |
| *** code-R_ has quit IRC | 20:43 | |
| bknudson | possible_keys == "The possible indexes to choose" -> key == "The index actually chosen" | 20:44 |
| rderose | bknudson: but if you do have multiple indexes, you can give HINTS on which to use: http://dev.mysql.com/doc/refman/5.7/en/index-hints.html | 20:44 |
| bknudson | rderose: how should mysql choose which index to use in this case? | 20:45 |
| bknudson | I chose user_id because every query is going to have user_id | 20:46 |
| bknudson | and potentially multiple times. | 20:46 |
| rderose | yeah, so user_id is a good one | 20:46 |
| bknudson | what's the point of having an index on user_id and an index on issued_before ? | 20:47 |
| rderose | I'm adding that with issued_before (composite) because issued_before is always included | 20:47 |
| bknudson | the query is always going to have both those fields | 20:47 |
| rderose | not always, right | 20:47 |
| bknudson | every token has a user_id | 20:47 |
| rderose | hmm... | 20:47 |
| ravelar | but not every revocation | 20:48 |
| *** mah has quit IRC | 20:48 | |
| bknudson | yes, in my case none of the revocation events had a user_id | 20:49 |
| bknudson | probably why the index was so successful | 20:49 |
| bknudson | I mean the event had a user_id but it's NULL | 20:49 |
| rderose | ravelar bknudson: right, so the revocation event may not match a user_id, but will always check issued_before | 20:49 |
| bknudson | rderose: what does that have to do with use of an index or not? | 20:50 |
| bknudson | the query always looks the same | 20:50 |
| rderose | bknudson: you mean we're always querying the same data? | 20:51 |
| bknudson | rderose: the query is always the same. The data can be different. | 20:51 |
| bknudson | Might have a lot of user revocations. In my case I only had token revocations. | 20:51 |
| *** ebalduf has joined #openstack-keystone | 20:52 | |
| rderose | bknudson: but I think the where clause should be different based on data in the event. in other words, if we are checking if user_id = '123456', we shouldn't check if user_id also null | 20:53 |
| rderose | bknudson: if we only have values for user_id, shouldn't it just check for user_id = that value | 20:54 |
| rderose | ? | 20:54 |
| *** mvk has joined #openstack-keystone | 20:54 | |
| bknudson | rderose: if that's the case then the code in the review is completely wrong. | 20:54 |
| bknudson | rderose: the token always has a user_id | 20:54 |
| rderose | bknudson: true, I think ravelar is working on that | 20:55 |
| rderose | bknudson: but logically, it will still work. just the index is not so useful | 20:55 |
| rderose | :) | 20:55 |
| rderose | bknudson: so we should index all columns? | 20:58 |
| bknudson | rderose: experiment to see what indexes help. | 20:58 |
| bknudson | we shouldn't have to guess about this. | 20:58 |
| rderose | bknudson: true | 20:59 |
| bknudson | maybe we can add a token validation / revocation events test to lbragstad's perf tester? | 21:00 |
| *** gyee has quit IRC | 21:00 | |
| *** esp has left #openstack-keystone | 21:03 | |
| *** raildo has quit IRC | 21:09 | |
| *** ebalduf has quit IRC | 21:13 | |
| *** catintheroof has joined #openstack-keystone | 21:15 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: PCI-DSS functional tests https://review.openstack.org/377010 | 21:19 |
| *** spilla has quit IRC | 21:22 | |
| ravelar | bknudson the query you are seeing is checking for null when it cannot find a value for token['trustor_id'] or trustee_id | 21:22 |
| ravelar | otherwise itll show the full check for null or comparison if token[key] is not None | 21:22 |
| *** ngupta has joined #openstack-keystone | 21:25 | |
| ravelar | but the reason the is None is there is because, like in matches, the purpose is to ignore the comparison if the event column is None. But if it is not then a rev event column with a non None value and a token value with none should give back False. | 21:25 |
| *** ayoung has quit IRC | 21:26 | |
| *** pnavarro has quit IRC | 21:32 | |
| *** sdake has quit IRC | 21:33 | |
| *** lamt has joined #openstack-keystone | 21:35 | |
| *** Kimmo_ has joined #openstack-keystone | 21:37 | |
| *** adrian_otto has quit IRC | 21:38 | |
| *** Aiduehb has joined #openstack-keystone | 21:43 | |
| *** Aiduehb_ has joined #openstack-keystone | 21:44 | |
| *** Aiduehb has quit IRC | 21:47 | |
| *** nicolasbock has quit IRC | 21:51 | |
| *** Aiduehb_ has quit IRC | 21:52 | |
| *** ezpz has quit IRC | 21:55 | |
| bknudson | ravelar: I'm not complaining about the query. That was rderose. | 21:57 |
| rderose | :) | 21:57 |
| rderose | yeah, I'm finally understanding the query now | 21:58 |
| ravelar | bknudson haha oh okay whoops, just trying to clarify | 21:58 |
| bknudson | there only needs to be one check for if the value is null. The other checks are redundant | 21:59 |
| *** edtubill has quit IRC | 21:59 | |
| bknudson | query optimizer should take care of it. | 21:59 |
| bknudson | but people reading the code and trying to figure out what it's doing are going to wonder why it's written the way it is. | 22:00 |
| *** iurygregory_ has joined #openstack-keystone | 22:00 | |
| *** nicolasbock has joined #openstack-keystone | 22:00 | |
| rderose | bknudson: yeah, this is hard, because we're trying to search for project_id or (project_id and domain_id) or (project_id and domain_id and user_id) based on what's in the token data | 22:03 |
| rderose | bknudson: so we always need to OR if null | 22:03 |
| rderose | complicated... | 22:04 |
| bknudson | the code doesn't have to obfuscate things. | 22:04 |
| rderose | right | 22:04 |
| bknudson | also we can have unit tests that show that the code is correct given different inputs. | 22:04 |
| rderose | bknudson: I know, it's just trying to make sense of a query that is doing all of these different combinations | 22:06 |
| *** ravelar has quit IRC | 22:06 | |
| rderose | bknudson: anyway, playing with this now to see if we can eliminate the extra null checks | 22:07 |
| *** dstanek_ is now known as dstanek | 22:08 | |
| *** ChanServ sets mode: +v dstanek | 22:08 | |
| *** ravelar has joined #openstack-keystone | 22:10 | |
| *** iurygregory_ has quit IRC | 22:12 | |
| *** ayoung has joined #openstack-keystone | 22:14 | |
| *** ChanServ sets mode: +v ayoung | 22:14 | |
| bknudson | actually, in my testing looks like the indexes didn't help much. Couldn't tell just by looking at the numbers. | 22:23 |
| *** iurygregory_ has joined #openstack-keystone | 22:25 | |
| *** ngupta has quit IRC | 22:26 | |
| *** ngupta has joined #openstack-keystone | 22:27 | |
| *** lamt has quit IRC | 22:31 | |
| *** ngupta has quit IRC | 22:31 | |
| morgan | bknudson: how large of a table? | 22:34 |
| *** spzala has joined #openstack-keystone | 22:34 | |
| morgan | bknudson: because at small row counts indexews will have no real value | 22:34 |
| bknudson | morgan: I usually get a couple thousand rows in there. | 22:34 |
| *** ngupta has joined #openstack-keystone | 22:34 | |
| morgan | hm | 22:34 |
| bknudson | although it's faster now so might have been more. | 22:34 |
| * morgan nods | 22:34 | |
| *** spzala has quit IRC | 22:36 | |
| *** spzala has joined #openstack-keystone | 22:37 | |
| *** thumpba has quit IRC | 22:40 | |
| *** thumpba has joined #openstack-keystone | 22:40 | |
| *** spzala has quit IRC | 22:41 | |
| *** thumpba has quit IRC | 22:42 | |
| *** ngupta has quit IRC | 22:56 | |
| *** ngupta has joined #openstack-keystone | 22:57 | |
| *** ngupta has quit IRC | 22:57 | |
| *** ngupta has joined #openstack-keystone | 22:58 | |
| *** edmondsw has quit IRC | 23:01 | |
| *** catintheroof has quit IRC | 23:04 | |
| *** adrian_otto has joined #openstack-keystone | 23:06 | |
| *** ngupta has quit IRC | 23:13 | |
| *** ngupta has joined #openstack-keystone | 23:13 | |
| *** ngupta has quit IRC | 23:17 | |
| *** adu has joined #openstack-keystone | 23:27 | |
| *** lamt has joined #openstack-keystone | 23:28 | |
| *** adrian_otto has quit IRC | 23:38 | |
| *** adrian_otto has joined #openstack-keystone | 23:40 | |
| *** adrian_otto has quit IRC | 23:41 | |
| *** sdake has joined #openstack-keystone | 23:44 | |
| *** timburke_ is now known as timburke | 23:46 | |
| *** haplo37_ has quit IRC | 23:51 | |
| *** haplo37_ has joined #openstack-keystone | 23:53 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!