| *** spzala has quit IRC | 00:03 | |
| *** markvoelker has joined #openstack-keystone | 00:29 | |
| *** adrian_otto has quit IRC | 00:29 | |
| *** markvoelker has quit IRC | 00:34 | |
| *** nkinder has quit IRC | 00:40 | |
| *** adu has quit IRC | 00:41 | |
| *** chris_hultin|AWA is now known as chris_hultin | 00:44 | |
| *** tqtran has quit IRC | 00:46 | |
| *** GB21 has joined #openstack-keystone | 00:46 | |
| *** adu has joined #openstack-keystone | 00:49 | |
| *** adrian_otto has joined #openstack-keystone | 00:49 | |
| *** adrian_otto has quit IRC | 00:52 | |
| *** nkinder has joined #openstack-keystone | 00:52 | |
| *** adrian_otto has joined #openstack-keystone | 00:53 | |
| *** markvoelker has joined #openstack-keystone | 00:54 | |
| *** chris_hultin is now known as chris_hultin|AWA | 00:54 | |
| *** chris_hultin|AWA is now known as chris_hultin | 00:55 | |
| *** adrian_otto has quit IRC | 00:56 | |
| *** adrian_otto has joined #openstack-keystone | 00:58 | |
| *** spzala has joined #openstack-keystone | 00:59 | |
| *** adrian_otto has quit IRC | 00:59 | |
| openstackgerrit | Merged openstack/keystone-specs: Mapping shadow users into projects and roles https://review.openstack.org/324055 | 01:00 |
|---|---|---|
| *** spzala has quit IRC | 01:04 | |
| *** prashanth has joined #openstack-keystone | 01:06 | |
| *** adrian_otto has joined #openstack-keystone | 01:13 | |
| *** adrian_otto has quit IRC | 01:16 | |
| *** adrian_otto has joined #openstack-keystone | 01:16 | |
| *** adrian_otto has quit IRC | 01:22 | |
| *** adrian_otto has joined #openstack-keystone | 01:26 | |
| *** adrian_otto has quit IRC | 01:27 | |
| *** adrian_otto has joined #openstack-keystone | 01:29 | |
| *** adrian_otto has quit IRC | 01:32 | |
| *** adu has quit IRC | 01:33 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone-specs: Allow retrieving an expired token https://review.openstack.org/381361 | 01:35 |
| jamielennox | stevemar: ^ | 01:36 |
| *** adu has joined #openstack-keystone | 01:37 | |
| *** chris_hultin is now known as chris_hultin|AWA | 01:40 | |
| *** namnh has joined #openstack-keystone | 01:40 | |
| *** adrian_otto has joined #openstack-keystone | 01:48 | |
| *** adrian_otto has quit IRC | 01:51 | |
| *** adrian_otto has joined #openstack-keystone | 01:52 | |
| *** spzala has joined #openstack-keystone | 01:54 | |
| *** adrian_otto has quit IRC | 01:55 | |
| *** spzala has quit IRC | 01:59 | |
| *** spzala has joined #openstack-keystone | 02:10 | |
| stevemar | thanks jamielennox, you're the best <3 | 02:10 |
| jamielennox | stevemar: i think i have usable code | 02:11 |
| jamielennox | though i haven't messed with the other services yet, just testing valdiation directly | 02:11 |
| jamielennox | i have a question | 02:11 |
| jamielennox | https://review.openstack.org/#/c/379034/ and https://review.openstack.org/#/c/379035/ - can i do that? | 02:12 |
| jamielennox | stevemar: for all reasonable cases i don't think anyone but keystone has overriden auth_token middleware | 02:12 |
| jamielennox | however it's technically a backwards incompatible change | 02:12 |
| jamielennox | and for example if a kyestone without that fix was using a keystonemiddleware with it there would be an error | 02:13 |
| *** prashanth has quit IRC | 02:16 | |
| *** david-lyle has joined #openstack-keystone | 02:25 | |
| EmilienM | stevemar: would you accept a patch like this for keystone CI ? https://review.openstack.org/#/c/381322/ | 02:33 |
| stevemar | EmilienM: "This job is non-voting" -- good with me | 02:35 |
| EmilienM | cool | 02:36 |
| *** ravelar has quit IRC | 02:37 | |
| *** david-lyle has quit IRC | 02:38 | |
| EmilienM | stevemar: i'm trying to retrospect in my brain what projects 'broke' the most for us in tripleo, and where we could run our CI jobs to give interesting feedback | 02:39 |
| stevemar | EmilienM: we definitely broke you enough to warrant the job :) | 02:40 |
| stevemar | EmilienM: osc too? | 02:40 |
| EmilienM | stevemar: oh yeah | 02:40 |
| EmilienM | stevemar: I'm not blaming any project, just trying to reduce feedback loop | 02:41 |
| stevemar | totally understand | 02:41 |
| EmilienM | i just think a combination of devstack + other things could be interesting | 02:41 |
| *** tqtran has joined #openstack-keystone | 02:43 | |
| *** adu has quit IRC | 02:45 | |
| *** tqtran has quit IRC | 02:48 | |
| *** david-lyle has joined #openstack-keystone | 02:49 | |
| *** david-lyle has quit IRC | 02:55 | |
| *** trananhkma has joined #openstack-keystone | 02:57 | |
| *** tqtran has joined #openstack-keystone | 03:02 | |
| *** dikonoor has joined #openstack-keystone | 03:03 | |
| *** tqtran has quit IRC | 03:06 | |
| *** links has joined #openstack-keystone | 03:10 | |
| stevemar | jamielennox: to answer your question, i don't know | 03:14 |
| stevemar | jamielennox: i'm weary about it | 03:14 |
| jamielennox | stevemar: yea, me too | 03:14 |
| jamielennox | stevemar: it just seems a lot of work for little gain to work around it | 03:14 |
| stevemar | jamielennox: you never got back to me -- whats the change for? | 03:15 |
| jamielennox | oh, yea, it's in service of fetching expired tokens | 03:15 |
| jamielennox | i need to pass allow_expired=True through to fetch_token | 03:15 |
| jamielennox | but if i do that without fixing the keystone override then its going to be a call error | 03:16 |
| stevemar | jamielennox: overriding foo(x, **kwargs) with just foo(x) causes an error right? | 03:18 |
| stevemar | hmm | 03:18 |
| jamielennox | stevemar: no | 03:18 |
| jamielennox | stevemar: having the base class call fetch_token(self, token_id, allow_expired=True) when keystone only has fetch_token(self, token_id) is going to be an error | 03:18 |
| stevemar | jamielennox: looks like "cloudcafe" overrides it: http://codesearch.openstack.org/?q=fetch_token&i=nope&files=&repos= | 03:20 |
| stevemar | eh, not really | 03:20 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Remove password history validation from admin password resets https://review.openstack.org/379030 | 03:21 |
| jamielennox | stevemar: yea, no they just use the same function name | 03:21 |
| stevemar | jamielennox: yeah, i realized that when i didn't see ksm in their reqs | 03:21 |
| jamielennox | so i mean it's still a problem because it'll cross keystone releases | 03:22 |
| stevemar | jamielennox: that's OK | 03:23 |
| stevemar | jamielennox: we can have Newton capped at 4.9.z | 03:24 |
| stevemar | jamielennox: for O we can bump the minimum constraints to 4.10.0 | 03:24 |
| stevemar | Newton will just get cherry-picked changes | 03:24 |
| stevemar | (this is all keystonemiddleware i'm talking about) | 03:25 |
| stevemar | jamielennox: would inspecting the method signature help at all? | 03:25 |
| jamielennox | stevemar: there's a few ways we can do it, we can inspect from above | 03:25 |
| jamielennox | stevemar: we can put a bool on the class to say it accepts the new options | 03:26 |
| stevemar | try to use the newer sign but fall back if it's not there | 03:26 |
| stevemar | jamielennox: yeah, we did that in OSC | 03:26 |
| stevemar | not pretty | 03:26 |
| jamielennox | i think you're catching typeerror if you catch the args | 03:26 |
| jamielennox | really that's probably the best way | 03:27 |
| jamielennox | it's not pretty but safest and we'd only need to carry it a cycle or so | 03:27 |
| *** spzala has quit IRC | 03:27 | |
| stevemar | yep | 03:28 |
| jamielennox | bah, alright, i knew this i just didn't want to | 03:29 |
| stevemar | jamielennox: sorry bud, we can make it one cycle deprecation | 03:31 |
| *** nicolasbock has quit IRC | 03:38 | |
| *** GB21 has quit IRC | 03:39 | |
| openstackgerrit | Kanika Singh proposed openstack/keystone: Role Assignment was reporting incorrect Inheritance when --names was used. Reason: Dictionary was missing the inheritance key value pair. Hence added elif condition to check for inherited property and add it in the dictionary. Closes bug: #1625230 https://review.openstack.org/380973 | 03:42 |
| openstack | bug 1625230 in OpenStack Identity (keystone) "Role Assignment Incorrectly Reports Inheritance when --name is Used" [Medium,Confirmed] https://launchpad.net/bugs/1625230 - Assigned to Kanika Singh (kanikasingh-1490) | 03:42 |
| *** agireud has quit IRC | 03:44 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Don't validate token expiry in the persistence backend https://review.openstack.org/381380 | 03:46 |
| *** agireud has joined #openstack-keystone | 03:46 | |
| stevemar | jamielennox: create a bp for the work and start referencing it in commit messages and topics please | 03:58 |
| stevemar | jamielennox: not sure if you want to create a new one or re-use https://blueprints.launchpad.net/keystone/+spec/session-extendable-tokens or https://blueprints.launchpad.net/keystone/+spec/trusted-tokens | 03:59 |
| *** GB21 has joined #openstack-keystone | 04:23 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone-specs: Allow retrieving an expired token https://review.openstack.org/381361 | 04:25 |
| *** denismakogon__ has joined #openstack-keystone | 04:26 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Don't validate token expiry in the persistence backend https://review.openstack.org/381380 | 04:28 |
| *** lamt has quit IRC | 04:31 | |
| *** prashanth has joined #openstack-keystone | 04:34 | |
| *** adriant has quit IRC | 04:35 | |
| *** woodster_ has quit IRC | 04:40 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Specify that unknown arguments can be passed to fetch_token https://review.openstack.org/379034 | 04:48 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Specify that unknown arguments can be passed to fetch_token https://review.openstack.org/379034 | 04:49 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Ignore unknown arguments to fetch_token https://review.openstack.org/379035 | 04:53 |
| *** denismakogon__ has quit IRC | 04:56 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Implement caching for the generic plugins. https://review.openstack.org/359506 | 05:02 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone-specs: Allow retrieving an expired token https://review.openstack.org/381361 | 05:11 |
| *** denismakogon__ has joined #openstack-keystone | 05:18 | |
| *** vaishali has joined #openstack-keystone | 05:19 | |
| *** spzala has joined #openstack-keystone | 05:28 | |
| *** agireud has quit IRC | 05:31 | |
| *** spzala has quit IRC | 05:32 | |
| *** agireud has joined #openstack-keystone | 05:33 | |
| *** richm has quit IRC | 05:40 | |
| *** dikonoor has quit IRC | 05:42 | |
| *** GB21 has quit IRC | 05:46 | |
| *** vaishali has quit IRC | 05:46 | |
| *** jaosorior has joined #openstack-keystone | 05:46 | |
| *** flaper87 has joined #openstack-keystone | 05:49 | |
| *** flaper87 has quit IRC | 05:49 | |
| *** flaper87 has joined #openstack-keystone | 05:49 | |
| *** code-R has joined #openstack-keystone | 05:51 | |
| breton | morning, folks | 05:53 |
| *** adrian_otto has joined #openstack-keystone | 05:53 | |
| *** code-R_ has joined #openstack-keystone | 05:55 | |
| *** code-R has quit IRC | 05:58 | |
| *** GB21 has joined #openstack-keystone | 06:01 | |
| *** vaishali has joined #openstack-keystone | 06:02 | |
| trananhkma | Hi keystone-er :) | 06:03 |
| trananhkma | I tried to rolling upgrade Keystone from Mitaka to Newton. My model has 3 Controller nodes. | 06:03 |
| trananhkma | After upgrade Controller1 successfully, I have an issuse with keystone, it raise that "KeyError: 'is_domain'" everytime when request is handling by Controller1. Full log here: http://paste.openstack.org/show/584107/ | 06:03 |
| trananhkma | I think the problem is that V2 api conflicted with V3 api. | 06:04 |
| trananhkma | After I upgraded all 3 nodes to Newton, this error never occur again | 06:04 |
| trananhkma | How can I prevent this error during upgrade process? Does anyone have suggestion for me? Thanks | 06:04 |
| *** tqtran has joined #openstack-keystone | 06:05 | |
| *** annp has joined #openstack-keystone | 06:06 | |
| *** GB21 has quit IRC | 06:07 | |
| *** GB21 has joined #openstack-keystone | 06:08 | |
| *** vaishali_ has joined #openstack-keystone | 06:08 | |
| *** tqtran has quit IRC | 06:10 | |
| *** vaishali has quit IRC | 06:12 | |
| *** vaishali_ has quit IRC | 06:14 | |
| *** dikonoor has joined #openstack-keystone | 06:14 | |
| *** vaishali_ has joined #openstack-keystone | 06:27 | |
| *** tqtran has joined #openstack-keystone | 06:31 | |
| *** tqtran has quit IRC | 06:35 | |
| *** tqtran has joined #openstack-keystone | 06:38 | |
| *** code-R_ has quit IRC | 06:40 | |
| *** code-R has joined #openstack-keystone | 06:41 | |
| *** rcernin has joined #openstack-keystone | 06:43 | |
| *** adrian_otto has quit IRC | 06:45 | |
| *** dikonoor has quit IRC | 06:45 | |
| *** adrian_otto has joined #openstack-keystone | 06:48 | |
| *** agireud has quit IRC | 06:50 | |
| *** agireud has joined #openstack-keystone | 06:51 | |
| *** tesseract- has joined #openstack-keystone | 06:52 | |
| *** vaishali_ has quit IRC | 06:52 | |
| *** agireud has quit IRC | 06:56 | |
| *** pnavarro has joined #openstack-keystone | 06:58 | |
| *** dikonoor has joined #openstack-keystone | 06:58 | |
| *** agireud has joined #openstack-keystone | 06:59 | |
| *** agireud has quit IRC | 07:02 | |
| *** denismakogon__ has quit IRC | 07:03 | |
| *** denismakogon__ has joined #openstack-keystone | 07:04 | |
| *** agireud has joined #openstack-keystone | 07:08 | |
| *** code-R_ has joined #openstack-keystone | 07:15 | |
| *** adrian_otto1 has joined #openstack-keystone | 07:16 | |
| *** code-R has quit IRC | 07:18 | |
| *** adrian_otto has quit IRC | 07:19 | |
| *** markvoelker has quit IRC | 07:24 | |
| *** adrian_otto1 has quit IRC | 07:37 | |
| *** adrian_otto has joined #openstack-keystone | 07:38 | |
| *** adrian_otto has quit IRC | 07:46 | |
| *** adrian_otto has joined #openstack-keystone | 07:49 | |
| *** adrian_otto has quit IRC | 07:50 | |
| *** jistr has joined #openstack-keystone | 07:57 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** jed56 has joined #openstack-keystone | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:01 | |
| *** amoralej|off is now known as amoralej | 08:03 | |
| *** tqtran has quit IRC | 08:09 | |
| *** code-R_ has quit IRC | 08:15 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Don't validate token expiry in the persistence backend https://review.openstack.org/381380 | 08:15 |
| *** asettle has joined #openstack-keystone | 08:16 | |
| *** asettle has quit IRC | 08:16 | |
| *** asettle has joined #openstack-keystone | 08:17 | |
| *** markvoelker has joined #openstack-keystone | 08:24 | |
| *** markvoelker has quit IRC | 08:29 | |
| openstackgerrit | melissaml proposed openstack/keystone: Fix a typo in _init_.py https://review.openstack.org/381526 | 08:33 |
| *** denismakogon__ has quit IRC | 08:41 | |
| *** denismakogon has joined #openstack-keystone | 08:41 | |
| *** vaishali_ has joined #openstack-keystone | 08:59 | |
| *** dikonoor has quit IRC | 09:19 | |
| *** code-R has joined #openstack-keystone | 09:20 | |
| *** code-R_ has joined #openstack-keystone | 09:36 | |
| *** code-R has quit IRC | 09:39 | |
| *** ma9 has joined #openstack-keystone | 09:41 | |
| ma9 | is there a way to resolve users,projects,roles,domains when using the command "openstack role assignment list" | 09:41 |
| ma9 | ? | 09:41 |
| *** code-R_ has quit IRC | 09:48 | |
| *** code-R has joined #openstack-keystone | 09:48 | |
| *** GB21 has quit IRC | 09:53 | |
| *** vaishali_ has quit IRC | 09:53 | |
| *** annp has quit IRC | 09:53 | |
| *** jistr is now known as jistr|mtg | 09:59 | |
| *** zigo has quit IRC | 10:01 | |
| *** code-R has quit IRC | 10:03 | |
| *** code-R has joined #openstack-keystone | 10:04 | |
| *** zigo has joined #openstack-keystone | 10:04 | |
| *** zigo is now known as Guest84780 | 10:05 | |
| breton | ma9: yes. Use parameter --names | 10:09 |
| *** richm has joined #openstack-keystone | 10:10 | |
| *** GB21 has joined #openstack-keystone | 10:11 | |
| *** vaishali_ has joined #openstack-keystone | 10:12 | |
| ma9 | breton: I'm running Kilo and it does not work | 10:12 |
| *** Guest84780 has quit IRC | 10:14 | |
| *** zigo_ has joined #openstack-keystone | 10:16 | |
| breton | ma9: then i am afraid there is no way. Afaik we discussed and fixed it only in Liberty or Mitaka. | 10:17 |
| breton | probably in Liberty | 10:18 |
| *** code-R has quit IRC | 10:18 | |
| *** code-R has joined #openstack-keystone | 10:19 | |
| *** dikonoor has joined #openstack-keystone | 10:25 | |
| *** markvoelker has joined #openstack-keystone | 10:26 | |
| *** gb21_ has joined #openstack-keystone | 10:27 | |
| *** vaishali__ has joined #openstack-keystone | 10:27 | |
| *** vaishali has joined #openstack-keystone | 10:29 | |
| *** vaishali_ has quit IRC | 10:31 | |
| *** GB21 has quit IRC | 10:31 | |
| *** markvoelker has quit IRC | 10:31 | |
| *** vaishali__ has quit IRC | 10:32 | |
| *** code-R has quit IRC | 10:34 | |
| *** code-R has joined #openstack-keystone | 10:34 | |
| *** nicolasbock has joined #openstack-keystone | 10:40 | |
| *** spzala has joined #openstack-keystone | 10:44 | |
| *** code-R has quit IRC | 10:49 | |
| *** spzala has quit IRC | 10:49 | |
| *** code-R has joined #openstack-keystone | 10:50 | |
| *** pnavarro has quit IRC | 10:51 | |
| *** gb21_ is now known as GB21 | 10:54 | |
| *** code-R_ has joined #openstack-keystone | 10:56 | |
| *** code-R has quit IRC | 10:56 | |
| *** rcernin has quit IRC | 10:57 | |
| *** rcernin has joined #openstack-keystone | 10:58 | |
| *** jistr|mtg is now known as jistr | 11:00 | |
| *** dikonoor has quit IRC | 11:01 | |
| *** bjolo_ is now known as bjolo | 11:10 | |
| *** amoralej is now known as amoralej|lunch | 11:13 | |
| breton | lp seems to be down :( | 11:22 |
| *** zigo_ is now known as zigo | 11:23 | |
| *** markvoelker has joined #openstack-keystone | 11:27 | |
| *** dikonoor has joined #openstack-keystone | 11:30 | |
| *** markvoelker has quit IRC | 11:32 | |
| *** haplo37_ has quit IRC | 11:33 | |
| *** haplo37_ has joined #openstack-keystone | 11:35 | |
| *** vaishali has quit IRC | 11:41 | |
| *** pnavarro has joined #openstack-keystone | 11:43 | |
| *** vaishali has joined #openstack-keystone | 11:46 | |
| *** namnh_ has joined #openstack-keystone | 12:09 | |
| *** raildo has joined #openstack-keystone | 12:09 | |
| *** namnh has quit IRC | 12:12 | |
| *** code-R has joined #openstack-keystone | 12:12 | |
| *** jlwhite has quit IRC | 12:14 | |
| *** kevinbenton has quit IRC | 12:15 | |
| *** GB21 has quit IRC | 12:15 | |
| *** denismakogon has quit IRC | 12:15 | |
| *** code-R_ has quit IRC | 12:15 | |
| *** jlwhite has joined #openstack-keystone | 12:15 | |
| *** denismakogon has joined #openstack-keystone | 12:15 | |
| *** kevinbenton has joined #openstack-keystone | 12:17 | |
| *** edmondsw has joined #openstack-keystone | 12:18 | |
| *** vaishali_ has joined #openstack-keystone | 12:23 | |
| *** code-R has quit IRC | 12:24 | |
| *** code-R has joined #openstack-keystone | 12:25 | |
| *** GB21 has joined #openstack-keystone | 12:27 | |
| *** vaishali has quit IRC | 12:27 | |
| stevemar | o/ | 12:28 |
| *** vaishali_ has quit IRC | 12:29 | |
| *** markvoelker has joined #openstack-keystone | 12:33 | |
| *** amoralej|lunch is now known as amoralej | 12:37 | |
| *** vaishali_ has joined #openstack-keystone | 12:41 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Minor fix in role_assignments api-ref https://review.openstack.org/381777 | 12:43 |
| *** ma9 has left #openstack-keystone | 12:44 | |
| *** code-R has quit IRC | 12:45 | |
| *** code-R has joined #openstack-keystone | 12:45 | |
| *** GB21 has quit IRC | 12:48 | |
| *** vaishali_ has quit IRC | 12:49 | |
| *** code-R has quit IRC | 12:53 | |
| *** namnh_ has quit IRC | 12:53 | |
| *** namnh has joined #openstack-keystone | 12:54 | |
| trananhkma | stevemar, hello, are you free? can you give some minutes? | 12:56 |
| stevemar | trananhkma: sure, i'll try to help | 12:56 |
| trananhkma | stevemar, thanks, I all ready asked about it, could you take a look: http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2016-10-04.log.html#t2016-10-04T06:03:18 | 12:59 |
| trananhkma | already @@ | 12:59 |
| *** spzala has joined #openstack-keystone | 13:07 | |
| stevemar | trananhkma: i was going to say it looks like https://bugs.launchpad.net/keystone/+bug/1592169 -- but your issue is "is_domain" not "domain_id" | 13:10 |
| openstack | Launchpad bug 1592169 in OpenStack Identity (keystone) mitaka "cached tokens break Liberty to Mitaka upgrade" [High,Fix committed] - Assigned to Colleen Murphy (krinkle) | 13:10 |
| *** dave-mccowan has joined #openstack-keystone | 13:10 | |
| stevemar | trananhkma: i think we added the is_domain attribute to projects in Newton, so if you are replicating data between controllers it may not be able to write to the table until all controllers are upgraded | 13:11 |
| stevemar | trananhkma: the problem is normally seen when retrieving cached values, are you using caching? | 13:13 |
| stevemar | trananhkma: can you please file a bug with keystone with any applicable logs | 13:14 |
| trananhkma | stevemar, I am thinking about that, I just used devstack to try the rolling upgrade feature, I'm not sure about the caching. | 13:15 |
| trananhkma | stevemar, sure, if you confirmed it's a bug | 13:16 |
| trananhkma | stevemar, I follow the step in this: http://docs.openstack.org/developer/keystone/upgrading.html#upgrading-without-downtime | 13:27 |
| trananhkma | but, IMO, at step 9: 'Upgrade all keystone nodes to the next release, and restart them one at a time'. I think we cannot upgrade without downtime with this. | 13:27 |
| trananhkma | I tried to upgrade Controller1 first, then start it to handle the quest, I mean it make system no downtime. But I have the issues here, as I mentioned above | 13:27 |
| trananhkma | May I do something wrong? | 13:31 |
| *** daemontool has joined #openstack-keystone | 13:33 | |
| *** jaosorior has quit IRC | 13:34 | |
| *** jaosorior has joined #openstack-keystone | 13:34 | |
| dstanek | trananhkma: that makes me think that rolling upgrades don't quite work for this release | 13:38 |
| *** rodrigods has quit IRC | 13:40 | |
| *** rodrigods has joined #openstack-keystone | 13:40 | |
| trananhkma | dstanek, im not sure about that, I just want to make confirmation to do next step | 13:42 |
| lbragstad | rderose did you have a patch somewhere for https://bugs.launchpad.net/keystone/+bug/1630092 ? | 13:43 |
| openstack | Launchpad bug 1630092 in OpenStack Identity (keystone) "Admin password reset should be exempt from password history validation" [Medium,In progress] - Assigned to Ron De Rose (ronald-de-rose) | 13:43 |
| dstanek | trananhkma: to me your traceback indicates that's we expect new data that is doing going to be returned by the old version. seems like a bug. | 13:43 |
| dstanek | trananhkma: did you file a bug? | 13:43 |
| dstanek | trananhkma: rolling upgrades is experimental and it wouldn't surprise me if it had some issues | 13:43 |
| lbragstad | stevemar is anyone allowed to *create* tags for our project in launchpad? | 13:44 |
| trananhkma | dstanek, no I didn't. I trying to understand that, I afraid I do something wrong | 13:46 |
| dstanek | trananhkma: the best thing to do it create a bug so that more people can take a look. since you have a traceback there is definitely something wrong. | 13:46 |
| dstanek | trananhkma: even if technically you did something to cause that traceback it is our bad for letting it happen | 13:47 |
| *** mah has joined #openstack-keystone | 13:48 | |
| mah | Hi all, How to let openstack use Nova Compute v2.0 instead of v2.1 ? | 13:48 |
| trananhkma | dstanek, ok, I'll report this bug now :) | 13:49 |
| mah | without messing up anything | 13:49 |
| *** links has quit IRC | 13:49 | |
| dstanek | mah: the client or nova itself? | 13:50 |
| mah | nova it self | 13:51 |
| mah | I already have both of them exist | 13:52 |
| *** vkramskikh has left #openstack-keystone | 13:52 | |
| mah | but v2.1 is the used one | 13:52 |
| -openstackstatus- NOTICE: The Gerrit service on review.openstack.org is being restarted to address performance degradation and should return momentarily | 14:00 | |
| *** phalmos has joined #openstack-keystone | 14:04 | |
| *** daemontool_ has joined #openstack-keystone | 14:06 | |
| dstanek | mah: you might be better off asking that in #openstack-dev | 14:08 |
| mah | ok thanks | 14:08 |
| *** daemontool has quit IRC | 14:10 | |
| *** ravelar has joined #openstack-keystone | 14:13 | |
| stevemar | lbragstad: i can create them if you need to, but i think the people under "keystone-drivers" can | 14:20 |
| lbragstad | stevemar cool - looking how to do that now | 14:20 |
| stevemar | trananhkma: its probably a bug then :( | 14:20 |
| stevemar | lbragstad: http://imgur.com/a/rEEfY link at the bottom | 14:21 |
| lbragstad | stevemar sweet - done | 14:23 |
| lbragstad | cc rderose - i've created a 'pci' tag | 14:23 |
| stevemar | trananhkma: let us know when you've filed the bug, we'll get someone to reproduce it | 14:24 |
| trananhkma | stevemar, thanks so much for your time, I already filed the bug here: https://bugs.launchpad.net/keystone/+bug/1630259 | 14:24 |
| openstack | Launchpad bug 1630259 in OpenStack Identity (keystone) "Rolling upgrade does not work well in Newton release" [Undecided,New] | 14:24 |
| *** ravelar has quit IRC | 14:28 | |
| *** chris_hultin|AWA is now known as chris_hultin | 14:32 | |
| *** pnavarro has quit IRC | 14:32 | |
| *** jorge_munoz has joined #openstack-keystone | 14:32 | |
| *** denismakogon has quit IRC | 14:32 | |
| *** denismakogon has joined #openstack-keystone | 14:33 | |
| *** jorge_munoz_ has joined #openstack-keystone | 14:35 | |
| *** spzala has quit IRC | 14:35 | |
| *** vaishali_ has joined #openstack-keystone | 14:35 | |
| *** dikonoor has quit IRC | 14:36 | |
| *** jorge_munoz has quit IRC | 14:38 | |
| *** jorge_munoz_ is now known as jorge_munoz | 14:38 | |
| *** chris_hultin is now known as chris_hultin|AWA | 14:41 | |
| *** ravelar has joined #openstack-keystone | 14:42 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Minor fix in role_assignments api-ref https://review.openstack.org/381777 | 14:47 |
| stevemar | trananhkma: thanks, hoping we can check it out and backport as necessary | 14:50 |
| *** chris_hultin|AWA is now known as chris_hultin | 14:50 | |
| stevemar | i added the bug to the agenda | 14:53 |
| *** spzala has joined #openstack-keystone | 15:05 | |
| dolphm | trananhkma: thanks for the bug report! | 15:06 |
| stevemar | dolphm: ++ | 15:07 |
| *** rcernin has quit IRC | 15:10 | |
| *** dave-mccowan has quit IRC | 15:13 | |
| *** daemontool_ has quit IRC | 15:19 | |
| *** phalmos has quit IRC | 15:21 | |
| *** daemontool has joined #openstack-keystone | 15:27 | |
| *** namnh has quit IRC | 15:28 | |
| *** dave-mccowan has joined #openstack-keystone | 15:30 | |
| *** adrian_otto has joined #openstack-keystone | 15:31 | |
| *** spilla has joined #openstack-keystone | 15:37 | |
| bknudson | I wonder if there couldn't be some kind of version on the cached data | 15:39 |
| bknudson | might be as easy to implement as just putting the version in the key | 15:40 |
| bknudson | the would put different versions of objects in different namespaces | 15:40 |
| *** prashanth has quit IRC | 15:41 | |
| *** pnavarro has joined #openstack-keystone | 15:42 | |
| *** nicolasbock has quit IRC | 15:47 | |
| *** adrian_otto has quit IRC | 15:48 | |
| mah | Hi all, How to let openstack use Nova access API v2.0 instead of v2.1 ? | 15:51 |
| *** nicolasbock has joined #openstack-keystone | 15:53 | |
| *** adrian_otto has joined #openstack-keystone | 15:58 | |
| *** lamt has joined #openstack-keystone | 16:01 | |
| *** jaosorior has quit IRC | 16:02 | |
| *** vaishali_ has quit IRC | 16:08 | |
| *** dikonoor has joined #openstack-keystone | 16:14 | |
| *** vaishali_ has joined #openstack-keystone | 16:15 | |
| *** gagehugo has joined #openstack-keystone | 16:17 | |
| *** links has joined #openstack-keystone | 16:17 | |
| *** links has quit IRC | 16:18 | |
| *** david-lyle has joined #openstack-keystone | 16:21 | |
| *** dikonoor has quit IRC | 16:24 | |
| *** openstackgerrit has quit IRC | 16:26 | |
| *** openstackgerrit has joined #openstack-keystone | 16:27 | |
| *** openstackgerrit has quit IRC | 16:28 | |
| *** openstackgerrit has joined #openstack-keystone | 16:28 | |
| *** tesseract- has quit IRC | 16:29 | |
| *** openstackgerrit has quit IRC | 16:30 | |
| *** openstackgerrit has joined #openstack-keystone | 16:30 | |
| *** pnavarro has quit IRC | 16:34 | |
| amakarov | zzzeek, dogpile.cache has redis backend, but uses it as mere KVS. Meanwhile Redis has hashes that fits into cache region model perfectly - why didn't you use it? | 16:35 |
| *** daemontool has quit IRC | 16:35 | |
| zzzeek | amakarov: feel free to build another backend, it seems natural the default dogpile appoach for any given backend is to store "keys" and "values" in the server | 16:37 |
| zzzeek | amakarov: or an option to the exisitng backend to use a specific hash | 16:37 |
| amakarov | zzzeek, it won't be limited by a backend - the one is already there | 16:39 |
| amakarov | zzzeek, alternative CacheRegion is required | 16:39 |
| amakarov | So I wanted to ask about your reasoning for current solution | 16:40 |
| amakarov | focused on memcached? | 16:40 |
| zzzeek | amakarov: CacheRegion knows nothing about the backend | 16:40 |
| zzzeek | amakarov: focused on "thing that stores keys and values" | 16:41 |
| amakarov | zzzeek, well, thank you for clarification | 16:41 |
| zzzeek | amakarov: if by "hashes" you mean, "store the keys and valeus inside of a redis hash", how woudl you choose this "hash" other than a fixed path ? | 16:43 |
| amakarov | zzzeek, I mean this: http://redis.io/commands/hset | 16:46 |
| amakarov | and yes - current CacheRegion cannot use it | 16:46 |
| zzzeek | amakarov: right, by "how would you choose" I mean: HSET --> this part --> myhash <-- <-- field1 "Hello" | 16:47 |
| amakarov | right now CacheRegion prefixes keys with, well, hash name (in terms of Redis) | 16:49 |
| amakarov | zzzeek, so region invalidation becomes just hash deletion operation rather than prefix regeneration | 16:50 |
| amakarov | so prefix can be hard-coded again | 16:50 |
| *** dikonoor has joined #openstack-keystone | 16:51 | |
| zzzeek | amakarov: "prefixes keys with, well, hash name", i dont understand | 16:51 |
| amakarov | zzzeek, oh, sorry - I mismatched it with invalidation strategy | 16:52 |
| amakarov | hmm... I'll think about using it then - I can try to use existing region logic with some specific strategy for redis... | 16:53 |
| *** vaishali_ has quit IRC | 16:54 | |
| *** asettle__ has joined #openstack-keystone | 16:54 | |
| zzzeek | amakarov: POC: http://paste.openstack.org/show/584259/ | 16:55 |
| amakarov | zzzeek, yes! something like that | 16:56 |
| amakarov | zzzeek, and invalidate() just calls backend.hdel() | 16:57 |
| zzzeek | amakarov: oh i should test the actual backend there... | 16:57 |
| amakarov | zzzeek, you see: we faced a performance degradation with distributed region invalidation as there is significant overhead in memcached calls (x3 to be more specific) | 16:58 |
| zzzeek | amakarov: here we are: http://paste.openstack.org/show/584261/ | 16:58 |
| zzzeek | amakarov: invalidation is a crapshow, sure. was not an original use case. | 16:59 |
| *** asettle has quit IRC | 16:59 | |
| *** asettle__ has quit IRC | 16:59 | |
| zzzeek | amakarov: well, time based invalidation was, of course. | 17:00 |
| zzzeek | but "go and delete the keys", not so much | 17:00 |
| amakarov | zzzeek, yep - it's a common case when architecture just reflects current state of how things are done and slightly behind the actual need :) | 17:02 |
| *** adrian_otto has quit IRC | 17:03 | |
| amakarov | zzzeek, ah, we can't just go with a new backend: a strategy is required too - backends do not invalidate | 17:04 |
| zzzeek | amakarov: yup, but those are pluggable of course | 17:04 |
| amakarov | zzzeek, thank you for your help - I'm off to feed that to our QA :) | 17:05 |
| *** browne has joined #openstack-keystone | 17:29 | |
| *** nicolasbock has quit IRC | 17:42 | |
| *** jorge_munoz has quit IRC | 17:42 | |
| *** nicolasbock has joined #openstack-keystone | 17:46 | |
| *** gagehugo has quit IRC | 17:50 | |
| *** gagehugo_ has joined #openstack-keystone | 17:50 | |
| *** gagehugo has joined #openstack-keystone | 17:50 | |
| *** bjolo_ has joined #openstack-keystone | 17:53 | |
| *** tqtran has joined #openstack-keystone | 17:55 | |
| *** sdake has quit IRC | 17:58 | |
| *** rcernin has joined #openstack-keystone | 17:58 | |
| *** ayoung has joined #openstack-keystone | 18:01 | |
| *** ChanServ sets mode: +v ayoung | 18:01 | |
| *** jaugustine has joined #openstack-keystone | 18:02 | |
| *** harlowja has quit IRC | 18:03 | |
| *** adrian_otto has joined #openstack-keystone | 18:06 | |
| *** adrian_otto has quit IRC | 18:08 | |
| *** agireud has quit IRC | 18:10 | |
| *** LamT__ has quit IRC | 18:11 | |
| *** agireud has joined #openstack-keystone | 18:12 | |
| *** phalmos has joined #openstack-keystone | 18:19 | |
| dolphm | lbragstad: assigned you https://bugs.launchpad.net/keystone/+bug/1630259 | 18:19 |
| openstack | Launchpad bug 1630259 in OpenStack Identity (keystone) "KeyError: 'is_domain' during mitaka -> newton rolling upgrade" [High,Triaged] - Assigned to Lance Bragstad (lbragstad) | 18:19 |
| lbragstad | dolphm thanks | 18:20 |
| lbragstad | raildo https://github.com/openstack/keystone/commit/c1d0959da9a5e70cc16636bab1581ae154be27e5 looks suspicious in ^ | 18:20 |
| dolphm | lbragstad: i would say so | 18:20 |
| lbragstad | i think the problem is that is_domain is assuming the 'is_domain' key to be in the token if the token version is v3 | 18:23 |
| lbragstad | https://github.com/openstack/keystone/blob/stable/newton/keystone/models/token_model.py#L213 | 18:23 |
| *** phalmos has quit IRC | 18:23 | |
| lbragstad | but we only populate the token_data with 'is_domain' if the token is actually project scoped - https://github.com/openstack/keystone/blob/stable/newton/keystone/token/providers/common.py#L304 | 18:24 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make returning is_domain conditional https://review.openstack.org/382032 | 18:26 |
| lbragstad | raildo ^ | 18:26 |
| *** amoralej is now known as amoralej|off | 18:29 | |
| *** phalmos has joined #openstack-keystone | 18:30 | |
| *** adrian_otto has joined #openstack-keystone | 18:31 | |
| *** jorge_munoz has joined #openstack-keystone | 18:31 | |
| jamielennox | lbragstad: can i get you to have a look at https://review.openstack.org/#/c/381380/ | 18:42 |
| jamielennox | lbragstad: it's going to conflict with your one validation method, but you're about the only person ATM who would know this area well enough to see if i missed something | 18:43 |
| lbragstad | jamielennox sure thing | 18:43 |
| *** ruoyu has joined #openstack-keystone | 18:43 | |
| dstanek | stevemar: i plan on prepping dolph with anything i want discussed...i'll give you a heads up before the summit too | 18:49 |
| stevemar | dstanek: appreciated | 18:50 |
| *** spzala has quit IRC | 18:51 | |
| *** gagehugo has quit IRC | 18:51 | |
| *** spzala has joined #openstack-keystone | 18:52 | |
| lbragstad | stevemar same - i plan to proxy through dolphm | 18:53 |
| *** hrybacki has joined #openstack-keystone | 18:53 | |
| hrybacki | o/ | 18:53 |
| stevemar | dolphm will need to install a load balancer with all the proxying hes gonna do | 18:53 |
| * stevemar walks away for coffee after a terrible joke | 18:54 | |
| lbragstad | ba-dum-pshh | 18:54 |
| kfox1111 | ok, seeing something weird... | 18:54 |
| kfox1111 | http://logs.openstack.org/68/380868/22/experimental/gate-kolla-kubernetes-deploy-ubuntu-binary-ceph-nv/588148b/logs/openstack-catalog.txt | 18:54 |
| kfox1111 | split endpoitns in the list. | 18:54 |
| kfox1111 | I thought this may have been a race when they were put in the db, and the client wasn't merging right. | 18:55 |
| kfox1111 | but: | 18:55 |
| *** adrian_otto has quit IRC | 18:55 | |
| kfox1111 | http://pastebin.com/XZTYdSrf | 18:57 |
| *** spzala has quit IRC | 18:57 | |
| kfox1111 | I see they actually have different .service_id's. | 18:57 |
| hrybacki | wrt knocking out a low-hanging-fruit bug with TripleO-Quickstart it appears most are assigned to Annapoornima Koppad(annakoppad) but I am not seeing them on internal or freenode -- anyone know their timezone? | 18:59 |
| *** spzala has joined #openstack-keystone | 19:01 | |
| jamielennox | dstanek: you have a -1 on https://review.openstack.org/#/c/371856/ - anything i can explain there ? | 19:01 |
| hrybacki | specifically looking at https://bugs.launchpad.net/keystone/+bug/1570463 and https://bugs.launchpad.net/keystone/+bug/1410029 as candidates | 19:01 |
| openstack | Launchpad bug 1570463 in OpenStack Identity (keystone) "RFE: keystone-manage CLI to allow using syslog & specific log files" [Medium,Triaged] - Assigned to Annapoornima Koppad (annakoppad) | 19:01 |
| openstack | Launchpad bug 1410029 in OpenStack Identity (keystone) "Unnecessary conflict wrapper on assignment driver delete_project() method" [Low,Triaged] - Assigned to Annapoornima Koppad (annakoppad) | 19:01 |
| kfox1111 | oh.. I wonder if this is because they are being created in parallel. | 19:02 |
| *** spzala has quit IRC | 19:05 | |
| *** code-R has joined #openstack-keystone | 19:06 | |
| openstackgerrit | Merged openstack/keystone: Fix a typo in _init_.py https://review.openstack.org/381526 | 19:07 |
| hrybacki | ayoung ^^ | 19:11 |
| ayoung | hrybacki, gonna test workflow with that? | 19:12 |
| hrybacki | maybe. think either would be a good candidate? Not sure how much additional setup / testing is necessary to replicate either though | 19:13 |
| * hrybacki leans on your experience | 19:13 | |
| ayoung | delete_project is more real hrybacki | 19:14 |
| ayoung | more worth checking | 19:14 |
| ayoung | but both are pretty simple. Give it a go | 19:14 |
| hrybacki | what about the assignee? don't want just bump them | 19:14 |
| dstanek | jamielennox: i'm just worried that this can be used incorrectly in the future. i can take off my -1 | 19:18 |
| jamielennox | dstanek: you don't need to take it off from prodding, i just wanted to discuss any concerns | 19:20 |
| jamielennox | dstanek: unfortunately we have no choice but to default it to True because that was the old behaviour | 19:21 |
| *** david-lyle has quit IRC | 19:22 | |
| dstanek | jamielennox: i'd really just like to see the admin project go away | 19:23 |
| lbragstad | stevemar raildo dolphm do you know anh irc nick? | 19:24 |
| lbragstad | trananhkma o/ | 19:24 |
| lbragstad | i think i figured out what happened with that upgrade bug... | 19:25 |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1630259/comments/2 | 19:25 |
| openstack | Launchpad bug 1630259 in OpenStack Identity (keystone) "KeyError: 'is_domain' during mitaka -> newton rolling upgrade" [High,Triaged] - Assigned to Lance Bragstad (lbragstad) | 19:25 |
| jamielennox | dstanek: the admin_project go away? it's only been there for about a cycle | 19:25 |
| dstanek | jamielennox: beyond cloud admin is there a usecase for it? | 19:27 |
| jamielennox | dstanek: it was basically a hack to specify one project that could do cross project things | 19:27 |
| jamielennox | dstanek: so you can give someone admin on a project and not have them listing hypervisors and stuff that is not project specific | 19:28 |
| *** spzala has joined #openstack-keystone | 19:28 | |
| *** dikonoor has quit IRC | 19:37 | |
| dolphm | lbragstad: i do not, but i'd like to know | 19:38 |
| lbragstad | dolphm trananhkma filed the bug early - according to IRC | 19:39 |
| lbragstad | s/early/earlier/ | 19:39 |
| dolphm | lbragstad: so that's probably only a bug for uuid & pki? | 19:39 |
| lbragstad | dolphm i believe so | 19:39 |
| lbragstad | non-persistent formats wouldn't be affected | 19:39 |
| dolphm | lbragstad: oh, i hadn't read the paragraph where you talked about fernet yet :P | 19:40 |
| lbragstad | dolphm i think part of the reason is because we rely on stale data in uuid validation | 19:40 |
| dolphm | lbragstad: ++ | 19:41 |
| dolphm | lbragstad: if the value isn't there though, you can't just assume always-false, can you? | 19:41 |
| dolphm | i.e. .get('is_domain', False) | 19:41 |
| lbragstad | dolphm that i'm not sure on - that'd be a better question for raildo maybe | 19:41 |
| lbragstad | dolphm fwiw - this chain makes it so that all token formats valid online, every time https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:cleanup-token-provider | 19:42 |
| dolphm | i think you'd have to look up the project to know for sure, because that attribute was added to the token API long after it was an attribute on the actual project | 19:42 |
| *** woodster_ has joined #openstack-keystone | 19:45 | |
| *** ruoyu has quit IRC | 19:46 | |
| *** code-R_ has joined #openstack-keystone | 19:48 | |
| *** bjolo_ has quit IRC | 19:49 | |
| *** bjolo_ has joined #openstack-keystone | 19:49 | |
| *** code-R_ has quit IRC | 19:49 | |
| *** code-R has quit IRC | 19:49 | |
| *** code-R has joined #openstack-keystone | 19:50 | |
| *** jdennis1 has quit IRC | 19:55 | |
| *** bjolo_ has quit IRC | 20:01 | |
| stevemar | dolphm: ++, lbragstad you can probably safely assume is_domain is false | 20:04 |
| *** asettle has joined #openstack-keystone | 20:07 | |
| *** david-lyle has joined #openstack-keystone | 20:07 | |
| *** jdennis has joined #openstack-keystone | 20:09 | |
| *** adrian_otto has joined #openstack-keystone | 20:09 | |
| *** lamt has quit IRC | 20:12 | |
| *** harlowja has joined #openstack-keystone | 20:15 | |
| *** jorge_munoz has quit IRC | 20:18 | |
| *** david-lyle has quit IRC | 20:19 | |
| *** david-lyle has joined #openstack-keystone | 20:19 | |
| *** code-R has quit IRC | 20:22 | |
| raildo | lbragstad, sorry, i was afk, looking into the patch right now | 20:22 |
| *** code-R has joined #openstack-keystone | 20:22 | |
| lbragstad | raildo cool - thanks | 20:23 |
| *** mordred has quit IRC | 20:23 | |
| raildo | lbragstad, we made is_domain==False by default, even if the used didn't set it, so that's the reason why we assume is_domain will be in the project field | 20:26 |
| lbragstad | raildo that makes sense - but I think the upgrade fails because it's assuming it to be there for the token reference, too | 20:27 |
| *** code-R has quit IRC | 20:28 | |
| *** lamt has joined #openstack-keystone | 20:29 | |
| raildo | lbragstad, during the migration we already have this value, following the script: https://github.com/openstack/keystone/blob/master/keystone/common/sql/migrate_repo/versions/074_add_is_domain_project.py#L25-L26, don't we? | 20:29 |
| lbragstad | raildo right - but not for the token reference | 20:30 |
| lbragstad | raildo that's the project | 20:30 |
| lbragstad | raildo the problem is that token validation fails here - https://github.com/openstack/keystone/blob/stable/newton/keystone/models/token_model.py#L213 | 20:31 |
| *** roxanaghe has joined #openstack-keystone | 20:32 | |
| raildo | lbragstad, right, I'm looking to your change, it's weird since we follow similar changes for other properties, but makes sense for me. | 20:33 |
| raildo | lbragstad, looking to your description on the launchpad, totally makes sense to me. | 20:38 |
| lbragstad | raildo sweet | 20:40 |
| lbragstad | raildo thanks for giving it a once over | 20:40 |
| *** asettle has quit IRC | 20:43 | |
| raildo | lbragstad, np, if want I can add some test on your patch, or just help with some reviews | 20:45 |
| lbragstad | raildo yeah - that would be awesome! | 20:45 |
| raildo | lbragstad, great :) | 20:46 |
| *** mordred has joined #openstack-keystone | 20:53 | |
| *** gyee has joined #openstack-keystone | 20:55 | |
| *** ChanServ sets mode: +v gyee | 20:55 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add tests for validating expired tokens https://review.openstack.org/382069 | 20:57 |
| lbragstad | jamielennox ping | 20:57 |
| *** adriant has joined #openstack-keystone | 20:57 | |
| lbragstad | jamielennox feel free to steal that and work it into your commit ^ | 20:57 |
| *** asettle has joined #openstack-keystone | 20:57 | |
| *** denismakogon has quit IRC | 20:59 | |
| *** david-lyle has quit IRC | 21:04 | |
| jamielennox | lbragstad: meeting for the next half hour or so, but i can rebase on that | 21:05 |
| jamielennox | lbragstad: more tests are good there, i think i'm safe but you never know | 21:05 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Don't validate token expiry in the persistence backend https://review.openstack.org/381380 | 21:05 |
| lbragstad | jamielennox done ^ | 21:06 |
| lbragstad | jamielennox so far - i think your patch looks good | 21:06 |
| jamielennox | lbragstad: i think it's safe, if it wasn't then all the fernet token expiry would fail, but it's so messy it's hard to tell | 21:06 |
| lbragstad | the only thing I wanted to verify was the fact we're maintaining those keystone/tests/unit/token/test_backend.py behaviors | 21:06 |
| jamielennox | well they're persistence behaviours which is not necessarily the same | 21:07 |
| lbragstad | across token providers an expired token should return the same response | 21:08 |
| lbragstad | regardless of being persistent or non-persistent I would think | 21:08 |
| jamielennox | oh yea, it's crazy in there | 21:09 |
| lbragstad | jamielennox very - once https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:cleanup-token-provider merges hopefully it's easier to understand from a validation perspective | 21:09 |
| lbragstad | jamielennox after that - we can start working on cleaning up the issue_token path | 21:10 |
| lbragstad | ideally - once that's done all the token formatting logic should be in the controllers | 21:11 |
| lbragstad | and not in the providers | 21:11 |
| * lbragstad crosses fingers | 21:11 | |
| jamielennox | lbragstad: yea, i considered basing it on that but it had a WIP prefix | 21:13 |
| lbragstad | jamielennox yeah - you could.. it all works, i just wanted get some opinions before they merged | 21:14 |
| *** raildo has quit IRC | 21:15 | |
| jamielennox | lbragstad: merge it! | 21:16 |
| lbragstad | jamielennox +2 it! :) | 21:18 |
| jamielennox | damnit | 21:18 |
| *** r-daneel has joined #openstack-keystone | 21:20 | |
| *** jaugustine has quit IRC | 21:22 | |
| *** gagehugo has joined #openstack-keystone | 21:25 | |
| *** adam_g` is now known as adam_g | 21:25 | |
| *** spilla has quit IRC | 21:26 | |
| *** gagehugo_ has joined #openstack-keystone | 21:27 | |
| bknudson | dolphm: this looks like something that could be used by doctor - https://review.openstack.org/#/c/381968/ | 21:31 |
| bknudson | and others ^ | 21:31 |
| bknudson | spec for an oslo config validator | 21:32 |
| *** david-lyle has joined #openstack-keystone | 21:33 | |
| *** david-lyle has quit IRC | 21:42 | |
| *** david-lyle has joined #openstack-keystone | 21:47 | |
| *** david-lyle has quit IRC | 21:48 | |
| *** david-lyle has joined #openstack-keystone | 21:48 | |
| *** asettle has quit IRC | 21:52 | |
| *** spzala has quit IRC | 21:59 | |
| *** adrian_otto has quit IRC | 21:59 | |
| *** adrian_otto has joined #openstack-keystone | 21:59 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add revocation event indexes https://review.openstack.org/376523 | 22:01 |
| *** asettle has joined #openstack-keystone | 22:04 | |
| *** adrian_otto has quit IRC | 22:06 | |
| *** lamt has quit IRC | 22:08 | |
| *** asettle has quit IRC | 22:10 | |
| *** edmondsw has quit IRC | 22:10 | |
| *** dave-mccowan has quit IRC | 22:11 | |
| *** gagehugo has quit IRC | 22:20 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Allow fetching an expired token https://review.openstack.org/382098 | 22:46 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Pass allow_expired to token validate https://review.openstack.org/382099 | 22:46 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Specify that unknown arguments can be passed to fetch_token https://review.openstack.org/379034 | 22:48 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Pass ?allow_expired https://review.openstack.org/382100 | 22:48 |
| *** rcernin has quit IRC | 22:50 | |
| jamielennox | stevemar: can you remove your W-1 from https://review.openstack.org/#/c/359653/ | 22:51 |
| jamielennox | possibly change to a W+1 | 22:52 |
| *** r-daneel has quit IRC | 22:52 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Implement Views and convert credentials https://review.openstack.org/335423 | 22:56 |
| *** sdake has joined #openstack-keystone | 22:58 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Improve keystone validation performance https://review.openstack.org/382107 | 23:01 |
| *** sdake_ has joined #openstack-keystone | 23:05 | |
| *** ravelar has quit IRC | 23:08 | |
| *** ravelar has joined #openstack-keystone | 23:08 | |
| *** sdake has quit IRC | 23:09 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add revocation event indexes https://review.openstack.org/376523 | 23:12 |
| *** jamielennox is now known as jamielennox|away | 23:12 | |
| *** jamielennox|away is now known as jamielennox | 23:13 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add revocation event indexes https://review.openstack.org/376523 | 23:13 |
| *** ravelar has quit IRC | 23:19 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add revocation event indexes https://review.openstack.org/376523 | 23:21 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add revocation event index https://review.openstack.org/376523 | 23:24 |
| *** iurygregory_ has joined #openstack-keystone | 23:26 | |
| *** roxanaghe has quit IRC | 23:27 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Improve check_token validation performance https://review.openstack.org/382107 | 23:31 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Improve check_token validation performance https://review.openstack.org/382107 | 23:32 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone-specs: Allow retrieving an expired token https://review.openstack.org/381361 | 23:39 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone-specs: Allow retrieving an expired token https://review.openstack.org/381361 | 23:41 |
| *** chris_hultin is now known as chris_hultin|AWA | 23:47 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Pass allow_expired to token validate https://review.openstack.org/382099 | 23:56 |
| *** haplo37_ has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!