| *** hoangcx has joined #openstack-keystone | 00:41 | |
| *** rcernin has quit IRC | 00:42 | |
| *** guoshan has joined #openstack-keystone | 00:45 | |
| *** guoshan has quit IRC | 01:05 | |
| *** gus has quit IRC | 01:07 | |
| *** gus has joined #openstack-keystone | 01:11 | |
| *** davechen_afk has joined #openstack-keystone | 01:15 | |
| *** davechen_afk has joined #openstack-keystone | 01:16 | |
| *** catinthe_ has quit IRC | 01:16 | |
| *** davechen_afk is now known as davechen | 01:16 | |
| *** gus has quit IRC | 01:16 | |
| *** gus has joined #openstack-keystone | 01:17 | |
| *** catintheroof has joined #openstack-keystone | 01:17 | |
| *** catintheroof has quit IRC | 01:21 | |
| *** jamielennox is now known as jamielennox|away | 01:26 | |
| *** liujiong has joined #openstack-keystone | 01:29 | |
| *** guoshan has joined #openstack-keystone | 01:30 | |
| *** brad[] has quit IRC | 01:40 | |
| *** brad[] has joined #openstack-keystone | 01:42 | |
| *** jamielennox|away is now known as jamielennox | 02:15 | |
| *** jperry has quit IRC | 02:25 | |
| *** markvoelker has joined #openstack-keystone | 02:31 | |
| openstackgerrit | zhangyanxian proposed openstack/keystone: Fix typo in Hacking.py https://review.openstack.org/403482 | 02:34 |
|---|---|---|
| openstackgerrit | zhangyanxian proposed openstack/keystone: Fix typo in Hacking.py https://review.openstack.org/403482 | 02:35 |
| openstackgerrit | zhangyanxian proposed openstack/keystone: Fix typo in Hacking.py https://review.openstack.org/403482 | 02:36 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Allow fetching an expired token https://review.openstack.org/382098 | 02:53 |
| openstackgerrit | Merged openstack/python-keystoneclient: Show team and repo badges on README https://review.openstack.org/402867 | 02:59 |
| openstackgerrit | Merged openstack/keystonemiddleware: Show team and repo badges on README https://review.openstack.org/402873 | 02:59 |
| openstackgerrit | Merged openstack/keystoneauth: Drop MANIFEST.in - it's not needed by pbr https://review.openstack.org/402367 | 03:10 |
| openstackgerrit | Merged openstack/keystoneauth: Show team and repo badges on README https://review.openstack.org/402875 | 03:13 |
| jamielennox | breton, stevemar, lbragstad: we need to pass https://review.openstack.org/382098 reasonably soon to have a chance of getting it done this cycle, can you look and if it's a small change let it be a follow up patch | 03:27 |
| stevemar | hmm? | 03:28 |
| stevemar | oh yeah | 03:28 |
| openstackgerrit | ayoung proposed openstack/keystone: URL pattern based RBAC Management Interface https://review.openstack.org/401808 | 03:33 |
| *** ayoung has joined #openstack-keystone | 03:38 | |
| *** ChanServ sets mode: +v ayoung | 03:38 | |
| *** nkinder has joined #openstack-keystone | 03:56 | |
| stevemar | jamielennox: tweaking your release note | 04:06 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Allow fetching an expired token https://review.openstack.org/382098 | 04:07 |
| stevemar | jamielennox: oh looks like https://review.openstack.org/#/c/382100/1 needs love | 04:08 |
| *** code-R has quit IRC | 04:09 | |
| *** code-R has joined #openstack-keystone | 04:09 | |
| jamielennox | stevemar: thanks - yea, the client one has to merge and be released before we can use that anyway | 04:09 |
| stevemar | rgr | 04:10 |
| stevemar | jamielennox: thoughts on the whole request id thing in client | 04:10 |
| stevemar | i think we need to merge that chain that has been languishing... | 04:10 |
| stevemar | cut a major version | 04:11 |
| stevemar | or are we sure it works now without breaking things | 04:11 |
| *** links has joined #openstack-keystone | 04:13 | |
| jamielennox | stevemar: i haven't looked in a while, it's ugly | 04:15 |
| jamielennox | last i saw they were wrapping it with wrapt which i think won't break anything | 04:15 |
| jamielennox | but dstanek was having a look at an alternative | 04:16 |
| *** code-R has quit IRC | 04:21 | |
| *** code-R has joined #openstack-keystone | 04:21 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Show team and repo badges on README https://review.openstack.org/402878 | 04:28 |
| stevemar | jamielennox: i'm bumping the priority on that one | 04:29 |
| stevemar | jamielennox: almost all core projects have it merged but us | 04:29 |
| stevemar | we're lookin like chumps out there! | 04:30 |
| *** code-R has quit IRC | 04:41 | |
| breton | o/ | 04:43 |
| *** udesale has joined #openstack-keystone | 04:57 | |
| *** zhangjl has joined #openstack-keystone | 05:09 | |
| *** guoshan has quit IRC | 05:20 | |
| stevemar | breton: jamielennox either of you around? | 05:31 |
| stevemar | can one of you verify my plan on action on https://review.openstack.org/#/c/401328/ ? | 05:32 |
| stevemar | 3rd last comment | 05:32 |
| *** jrist has quit IRC | 05:39 | |
| *** jaosorior has joined #openstack-keystone | 05:57 | |
| *** code-R has joined #openstack-keystone | 06:00 | |
| *** guoshan has joined #openstack-keystone | 06:07 | |
| breton | stevemar: yes | 06:07 |
| breton | stevemar: looks good | 06:07 |
| stevemar | breton: okay, i'll make the change | 06:10 |
| stevemar | breton: looks like the requirements patch will land soon and i don't want us broken | 06:10 |
| stevemar | breton: also, thoughts on https://review.openstack.org/#/c/390948/ | 06:11 |
| breton | stevemar: not really. Is Colleen on IRC? I would like her to +1 it too | 06:17 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Send the identity.deleted.role_assignment after the deletion https://review.openstack.org/401332 | 06:18 |
| stevemar | breton: yes, she is crinkle | 06:18 |
| stevemar | breton: ok, i will chat with her, she is west coast time, or actually... i think shes in EU now? | 06:19 |
| stevemar | breton: maybe you can chat with her sooner than i can :P | 06:19 |
| openstackgerrit | zhangyanxian proposed openstack/keystone: Fix typo in Hacking.py https://review.openstack.org/403482 | 06:21 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: ignore deprecation warning for .encrypt() https://review.openstack.org/401328 | 06:21 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use sha512.hash() instead of .encrypt() https://review.openstack.org/403514 | 06:23 |
| stevemar | breton: i set up the patches, if they should fail for a silly typo, feel free to fix and reapprove, i really don't want a broken gate | 06:25 |
| masuberu | hi | 06:26 |
| masuberu | I see this on my openstack host --> openstack-keystone.service | not-found | inactive | dead | openstack-keystone.service | 06:27 |
| masuberu | however I can login using horizon, is this normal? | 06:28 |
| stevemar | breton: signing off sir o\ | 06:33 |
| breton | stevemar: пщщв тшпре | 06:34 |
| breton | :( | 06:34 |
| breton | stevemar: good night | 06:34 |
| stevemar | secret code, i like it | 06:34 |
| stevemar | breton: google knew what you meant :) | 06:35 |
| *** code-R_ has joined #openstack-keystone | 06:49 | |
| *** code-R has quit IRC | 06:52 | |
| *** jaosorior has quit IRC | 07:04 | |
| *** jaosorior has joined #openstack-keystone | 07:05 | |
| *** adriant has quit IRC | 07:20 | |
| *** code-R_ has quit IRC | 07:20 | |
| *** code-R has joined #openstack-keystone | 07:35 | |
| openstackgerrit | Merged openstack/keystone: Allow fetching an expired token https://review.openstack.org/382098 | 07:40 |
| *** rcernin has joined #openstack-keystone | 07:44 | |
| *** pcaruana has joined #openstack-keystone | 07:45 | |
| *** code-R_ has joined #openstack-keystone | 07:57 | |
| *** code-R has quit IRC | 07:59 | |
| *** jpich has joined #openstack-keystone | 08:03 | |
| *** pnavarro has joined #openstack-keystone | 08:29 | |
| *** code-R_ has quit IRC | 08:30 | |
| *** code-R has joined #openstack-keystone | 08:34 | |
| crinkle | breton: stevemar I still think 390948 doesn't really work properly in certain cases so can't really +1, but I took away my -1 since other reviewers think it's good enough | 08:48 |
| breton | crinkle: are there things that worked before the patch and won't work with the patch? | 08:52 |
| *** amoralej|off is now known as amoralej | 08:52 | |
| crinkle | breton: no, it doesn't break anything | 08:53 |
| *** aloga_ has joined #openstack-keystone | 08:58 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** code-R has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:01 | |
| openstackgerrit | Kseniya Tychkova proposed openstack/python-keystoneclient: [WIP] Quota limits https://review.openstack.org/403578 | 09:23 |
| openstackgerrit | Kseniya Tychkova proposed openstack/keystonemiddleware: [WIP] Quota limits https://review.openstack.org/403586 | 09:26 |
| openstackgerrit | Kseniya Tychkova proposed openstack/keystone: [WIP] Quota limits spec: https://review.openstack.org/#/c/363765 https://review.openstack.org/403588 | 09:29 |
| *** davechen is now known as davechen_afk | 09:41 | |
| *** jperry has joined #openstack-keystone | 09:50 | |
| *** code-R has joined #openstack-keystone | 09:55 | |
| *** asettle has joined #openstack-keystone | 09:56 | |
| *** code-R_ has joined #openstack-keystone | 09:57 | |
| *** code-R has quit IRC | 10:00 | |
| *** aloga_ has quit IRC | 10:02 | |
| *** guoshan has quit IRC | 10:10 | |
| *** guoshan has joined #openstack-keystone | 10:11 | |
| openstackgerrit | Ha Van Tu proposed openstack/keystone: Refactor Keystone admin-tokens and admin-users v2 https://review.openstack.org/369883 | 10:13 |
| *** topol has quit IRC | 10:18 | |
| *** stevemar has quit IRC | 10:19 | |
| *** liujiong has quit IRC | 10:29 | |
| *** hoangcx has quit IRC | 10:37 | |
| *** guoshan has quit IRC | 10:37 | |
| *** zhangjl has quit IRC | 10:44 | |
| *** kragniz has quit IRC | 10:54 | |
| *** kragniz has joined #openstack-keystone | 10:54 | |
| *** udesale has quit IRC | 10:59 | |
| *** guoshan has joined #openstack-keystone | 11:02 | |
| *** guoshan has quit IRC | 11:16 | |
| *** jaosorior has quit IRC | 11:30 | |
| *** guoshan has joined #openstack-keystone | 11:44 | |
| *** nicolasbock has joined #openstack-keystone | 11:45 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Document token header in federation auth response https://review.openstack.org/403645 | 11:50 |
| *** jperry has quit IRC | 11:54 | |
| *** guoshan has quit IRC | 11:54 | |
| *** code-R_ has quit IRC | 11:59 | |
| *** code-R has joined #openstack-keystone | 12:04 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Document token header in federation auth response https://review.openstack.org/403645 | 12:06 |
| *** rodrigods has quit IRC | 12:17 | |
| *** rodrigods has joined #openstack-keystone | 12:17 | |
| *** dave-mccowan has joined #openstack-keystone | 12:19 | |
| *** jaosorior has joined #openstack-keystone | 12:29 | |
| *** iurygregory has joined #openstack-keystone | 12:42 | |
| *** amoralej is now known as amoralej|off | 12:46 | |
| *** amoralej|off is now known as amoralej|lunch | 12:46 | |
| *** lamt has quit IRC | 12:58 | |
| *** jaosorior is now known as jaosorior_brb | 13:16 | |
| *** code-R_ has joined #openstack-keystone | 13:20 | |
| *** code-R has quit IRC | 13:23 | |
| *** dims has quit IRC | 13:33 | |
| *** guoshan has joined #openstack-keystone | 13:33 | |
| *** mrsoul has quit IRC | 13:41 | |
| *** dims has joined #openstack-keystone | 13:44 | |
| *** stevemar__ has joined #openstack-keystone | 13:47 | |
| *** mrsoul has joined #openstack-keystone | 13:47 | |
| *** amoralej|lunch is now known as amoralej | 13:50 | |
| *** lamt has joined #openstack-keystone | 14:00 | |
| *** links has quit IRC | 14:04 | |
| *** richm has joined #openstack-keystone | 14:05 | |
| *** henrynash_ has quit IRC | 14:10 | |
| *** jperry has joined #openstack-keystone | 14:16 | |
| *** clenimar has joined #openstack-keystone | 14:18 | |
| *** agrebennikov has joined #openstack-keystone | 14:22 | |
| *** rszmigie has joined #openstack-keystone | 14:22 | |
| lbragstad | stevemar__ ayoung o/ | 14:23 |
| lbragstad | saw i had a couple pings from you two | 14:23 |
| stevemar__ | lbragstad: yo | 14:23 |
| lbragstad | i'm back from my food induced coma | 14:23 |
| ayoung | heh | 14:23 |
| ayoung | lbragstad, so, do you have any fundamental problems with the RBAC approach, or are you just trying to get the spec perfect before getting it in? | 14:24 |
| stevemar__ | ayoung: i feel you are trying to ramrod things through | 14:24 |
| lbragstad | ayoung my biggest concern was the performance perspective | 14:24 |
| lbragstad | since keystone is responsible for another data point that policy needs | 14:25 |
| ayoung | lbragstad, OK, so if we go for in middleware as opposed to along with the token validation the only overhead is the call to get the RBAC data | 14:25 |
| ayoung | and that can be cached | 14:25 |
| stevemar__ | ayoung: you've been on a death march for this one, more so than your other work | 14:25 |
| ayoung | stevemar__, it has been my experience that this is the only way to get things into Keystone | 14:25 |
| ayoung | lbragstad, so, assuming the RBAC data gets cached, lets say for 5 minutes | 14:26 |
| lbragstad | well - *should* that be something that is cached? | 14:26 |
| stevemar__ | i disagree with that. | 14:26 |
| ayoung | lbragstad, yes it should...it will rarely change | 14:26 |
| lbragstad | but when it does it is something that needs to be reflected immediately, no? | 14:27 |
| ayoung | and...we could always find a way to trigger a cache invalidation if we need to as well... I have a though on that | 14:27 |
| *** rcernin has quit IRC | 14:27 | |
| ayoung | RBAC changes? Probably not. My assumption is that most changes are going to be "loosening up" not "tightening up" | 14:27 |
| lbragstad | that's part of why i want to avoid it... the whole cache and revocation thing is complicated - especially after trying to fix all the issues we had with revocation events and caching last release | 14:27 |
| ayoung | but, lets talk cache invalidation | 14:27 |
| *** openstackstatus has quit IRC | 14:28 | |
| ayoung | say we want to change the RBAC rules for Nova | 14:28 |
| ayoung | and we want those changes in effect fast | 14:28 |
| ayoung | so, right now, we have 0 ability to do that anyway, this is new... | 14:28 |
| ayoung | but we want it, so lets add an additional cache control header to a call to Nova, that is only honored for an admin roled token | 14:28 |
| lbragstad | that change requires an operator to lay down the specific rule they want to over ride in a policy file | 14:29 |
| *** openstackstatus has joined #openstack-keystone | 14:29 | |
| *** ChanServ sets mode: +v openstackstatus | 14:29 | |
| ayoung | Cache-Control: rbac-fresh | 14:29 |
| ayoung | and if a user with an admin token passes that cache control header on any call to Nova, Nova will refetch the rbac data | 14:30 |
| ayoung | lbragstad, so, no revocation | 14:30 |
| ayoung | if you don't tell nova to flush, the ordinary cache time out for the rbac rules takes effect. Same time frame as the tokens | 14:30 |
| lbragstad | so - keystone performance will fluctuate depending on how nova is called? | 14:31 |
| ayoung | revocation was always a bad idea for tokens. I should have fought it when I was first pressed on it, but I had just spend 6 months getting the PKI stuff working, and, as most things, it was getting held up right at freeze time by someone that had not been paying attention until that point | 14:31 |
| stevemar__ | ayoung: adam, you really need to get more than just lance to look (and approve) at the spec. overhauling policy was not identified as a priority for ocata we have a very short runway. (ocata 2 is less than 2 weeks from now) | 14:31 |
| ayoung | stevemar__, he's not the only one looking at it, just the most active reviewer, and has the most concerns | 14:32 |
| ayoung | stevemar__, the goal here is to get the bones in to Ocata as experimental | 14:32 |
| stevemar__ | ayoung: henry has 1 review and rodrigo has 2 | 14:32 |
| ayoung | stevemar__, Henry +2ed it already. I know he gets it. | 14:33 |
| ayoung | and I've talked it ove with Jamie on IRC, which is whjere the caching concerns came out | 14:33 |
| ayoung | stevemar__, and I know that the people that worked on Dynamic Policy in the past get the general idea. AFAICT this is the only way to solve the majority of the access control problems we have in OpenStack. | 14:34 |
| ayoung | 1. It lets people customize roles without breaking existing policy | 14:35 |
| stevemar__ | ayoung: i agree policy is in a shit state and needs overhaul | 14:35 |
| ayoung | 2. I lets someone know what role they need to perform an action without compromising security | 14:35 |
| ayoung | stevemar__, but not an overhaul | 14:35 |
| stevemar__ | i do not agree with the fact that we need to do it *now* | 14:35 |
| ayoung | stevemar__, overhauls break everything | 14:35 |
| stevemar__ | (in ocata) | 14:35 |
| ayoung | stevemar__, I am not willing to work on policy for another year. Its been 3 so far | 14:36 |
| ayoung | not without at least making progress | 14:36 |
| stevemar__ | this is coming off as very rushed, and that gets me on edge | 14:36 |
| ayoung | stevemar__, it should not | 14:36 |
| *** rcernin has joined #openstack-keystone | 14:36 | |
| ayoung | stevemar__, this is the result of a couple years iterations, finely tuned to the problem at hand | 14:36 |
| ayoung | reduced in scope so as to not break anything existing. | 14:36 |
| ayoung | it is an additional layer | 14:36 |
| ayoung | not breaking, not replacing, adding to | 14:37 |
| ayoung | and that has been shown to be essential | 14:37 |
| ayoung | it is completly within Keystone managed code | 14:37 |
| ayoung | and, no, it is not rushed. It is just the primary thing I am working on. | 14:38 |
| stevemar__ | i feel it's being rammed through cause we want a fix | 14:38 |
| stevemar__ | we don't all focus on what adam is working on | 14:38 |
| stevemar__ | look, i owe you a review of the spec, but i'm going to review what was discussed as a priority of the summit first | 14:39 |
| ayoung | stevemar__, I don't track every last thing going on in Keystone eiother | 14:39 |
| ayoung | stevemar__, you do realize that this A) came out of discussions at the summit and B) was posted as soon after the summit as I could? We had summit sessions about policy, but no clear approach until this. | 14:40 |
| ayoung | We did the dynamic policy code over a year ago, and there were issues that were raised that we didn't know how to solve | 14:42 |
| ayoung | we could not do this approach until we had implied roles, which I worked on 2 releases ago | 14:42 |
| ayoung | So, I've been working on this very steadily for years, and I have made an effort to get the information out in an understandable manner as soon as I can. | 14:43 |
| ayoung | This addresses a lot of the issues that jamielennox and dolphm butted up against trying to get the standard set of roles definied, remember? | 14:43 |
| ayoung | stevemar__, and the mechanisms are ones we've talked about for years: splitting rbac from the scope check , doing RBAC in middleware | 14:44 |
| stevemar__ | i do not remember those issues, no. | 14:44 |
| ayoung | stevemar__, that is because there are many people working on Keystone, and even you cannot track EVERYTHING that goes on. | 14:44 |
| ayoung | stevemar__, let me see if I can find the review. | 14:44 |
| stevemar__ | ayoung: if you get enough people to OK it, then that's fine with me. i am just sharing my thoughts and why i haven't reviewed it yet | 14:45 |
| ayoung | stevemar__, you should review it. I think you will like it, and it will scare you less | 14:46 |
| ayoung | I do owe lbragstad a split of the spec | 14:46 |
| ayoung | I am going to pull off the parts where it does the rbac check as part of the token validation, as that can happen 2nd, if at all | 14:46 |
| stevemar__ | ayoung: a split would be great | 14:46 |
| lbragstad | as an action item from the summit - we do have the policy meeting | 14:46 |
| ayoung | its on my task list for today | 14:46 |
| stevemar__ | i also didn't want lbragstad's policy initiative to get trampled on, in case he had another approach and is too nice to say otherwise | 14:47 |
| openstackgerrit | Merged openstack/oslo.policy: Remove wrong parameter type for class NotCheck from docstring https://review.openstack.org/388656 | 14:48 |
| ayoung | lbragstad, yes, and we also have people attempting to force through a compete ABAC solution in policy which we've already evaluated. We've shown A) that it can be done and B) it is not practical for most deployments and C) it still does not solve the problem of how to tell a user what roles/attributes they need to perform an action. The new people on the project were not here when we went through those iterations. | 14:50 |
| ayoung | We've seen that people doing RBAC with Fortress do not understand the issues with Keystone project scoping. Keystone started with GLobal roles, and we made a decision to go with scoped roles. | 14:51 |
| ayoung | I think it is a huge step forward, beyond what most places do with RBAC, so I am happy to help educate people on that./ | 14:52 |
| ayoung | But we've been working on this since ... Paris? | 14:52 |
| ayoung | http://adam.younglogic.com/2013/11/policy-enforcement-openstack/ | 14:53 |
| openstackgerrit | Merged openstack/keystone: ignore deprecation warning for .encrypt() https://review.openstack.org/401328 | 14:54 |
| ayoung | lbragstad, stevemar__ BTW, I did find a way to automate the creation of the RBAC rules from existing resources: | 14:55 |
| *** phalmos has joined #openstack-keystone | 14:55 | |
| ayoung | lbragstad, stevemar__ for example, for NOVA | 14:55 |
| ayoung | find ./api-ref/source/ -name \*inc | xargs awk '/rest_method/ {print "{ verbs=[\"" $3"\"], url_pattern=\""$4"\" role=\"Member\" },"} | 14:55 |
| ayoung | that works for the projects that have their APIs in the api-ref dir. Keystone Nova Glance and Cinder | 14:56 |
| ayoung | neutron does not | 14:57 |
| openstackgerrit | Merged openstack/keystone: Document token header in federation auth response https://review.openstack.org/403645 | 14:59 |
| *** phalmos_ has joined #openstack-keystone | 15:00 | |
| *** phalmos has quit IRC | 15:02 | |
| *** iurygregory has quit IRC | 15:05 | |
| *** jaosorior_brb has quit IRC | 15:05 | |
| *** clenimar has quit IRC | 15:05 | |
| *** jaosorior_brb has joined #openstack-keystone | 15:05 | |
| *** iurygregory has joined #openstack-keystone | 15:07 | |
| *** clenimar has joined #openstack-keystone | 15:07 | |
| *** daemontool has joined #openstack-keystone | 15:10 | |
| *** chris_hultin|AWA is now known as chris_hultin | 15:15 | |
| *** guoshan has quit IRC | 15:23 | |
| *** bknudson has joined #openstack-keystone | 15:23 | |
| *** ChanServ sets mode: +v bknudson | 15:23 | |
| *** ravelar has joined #openstack-keystone | 15:29 | |
| *** rszmigie has quit IRC | 15:31 | |
| *** ravelar has quit IRC | 15:32 | |
| *** dims has quit IRC | 15:36 | |
| *** jaosorior_brb is now known as jaosorior | 15:37 | |
| *** dims has joined #openstack-keystone | 15:41 | |
| *** ravelar has joined #openstack-keystone | 15:41 | |
| *** phalmos_ has quit IRC | 15:46 | |
| knikolla | o/ | 15:46 |
| *** ravelar has quit IRC | 15:46 | |
| *** ravelar has joined #openstack-keystone | 15:47 | |
| *** phalmos has joined #openstack-keystone | 15:47 | |
| *** code-R_ has quit IRC | 15:51 | |
| zzzeek | so re: https://review.openstack.org/#/c/401328/ these still seem to be running against passlib==1.6.5 in the gate, has anyone tested against 1.7? I'm getting new failures now | 15:52 |
| *** mvk has quit IRC | 16:01 | |
| *** david-lyle has quit IRC | 16:01 | |
| *** HenryG has quit IRC | 16:01 | |
| *** andreaf has quit IRC | 16:01 | |
| *** Kimmo__ has quit IRC | 16:01 | |
| *** jefrite has quit IRC | 16:01 | |
| *** zigo has quit IRC | 16:01 | |
| *** rm_work has quit IRC | 16:01 | |
| *** ccard_ has quit IRC | 16:01 | |
| *** charz_ has quit IRC | 16:01 | |
| *** freerunner has quit IRC | 16:01 | |
| *** zigo has joined #openstack-keystone | 16:01 | |
| *** Kimmo__ has joined #openstack-keystone | 16:02 | |
| *** mvk has joined #openstack-keystone | 16:02 | |
| *** ccard_ has joined #openstack-keystone | 16:02 | |
| *** david-lyle has joined #openstack-keystone | 16:02 | |
| *** vryzhenkin has joined #openstack-keystone | 16:02 | |
| *** rm_work has joined #openstack-keystone | 16:02 | |
| *** vryzhenkin is now known as freerunner | 16:02 | |
| *** charz has joined #openstack-keystone | 16:02 | |
| *** HenryG has joined #openstack-keystone | 16:02 | |
| *** jefrite has joined #openstack-keystone | 16:05 | |
| *** andreaf has joined #openstack-keystone | 16:12 | |
| *** raildo has joined #openstack-keystone | 16:15 | |
| *** edtubill has joined #openstack-keystone | 16:17 | |
| *** mvk has quit IRC | 16:17 | |
| *** code-R has joined #openstack-keystone | 16:25 | |
| *** rcernin has quit IRC | 16:27 | |
| *** arunkant__ has joined #openstack-keystone | 16:29 | |
| *** code-R_ has joined #openstack-keystone | 16:31 | |
| *** phalmos has quit IRC | 16:33 | |
| *** code-R has quit IRC | 16:34 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add reason to CADF notifications in docs https://review.openstack.org/400882 | 16:36 |
| *** josecastroleon has quit IRC | 16:40 | |
| lbragstad | zzzeek what other errors are you seeing? | 16:45 |
| lbragstad | zzzeek are you seeing them locally? | 16:45 |
| zzzeek | lbragstad: so far on my CI | 16:45 |
| zzzeek | lbragstad: i only run a subset of the tests | 16:46 |
| lbragstad | zzzeek do you have a paste? | 16:46 |
| zzzeek | lbragstad: i pasted them in the launchpad bug, I can reprodcue a more localized test | 16:46 |
| *** phalmos has joined #openstack-keystone | 16:46 | |
| lbragstad | zzzeek hmmm - that looks similar to http://logs.openstack.org/69/401369/5/check/gate-cross-keystone-python27-db-ubuntu-xenial/af32672/console.html#_2016-11-28_15_34_38_543818 | 16:47 |
| zzzeek | lbragstad: check which passlib is there | 16:48 |
| lbragstad | zzzeek passlib==1.7.0 | 16:49 |
| lbragstad | zzzeek we attempted to update requirements - https://review.openstack.org/#/c/401369/5 | 16:49 |
| lbragstad | zzzeek is that what you have locally, too? | 16:50 |
| zzzeek | lbragstad: hmmmm | 16:50 |
| rodrigods | stevemar__, looks like mapped isn' t put by default after all... shouldn' t we consider adding it? | 16:51 |
| stevemar__ | rodrigods: totally | 16:51 |
| rodrigods | stevemar__, ++ sending a quick patch here | 16:52 |
| zzzeek | lbragstad: im not exactly sure why my CI has passlib 1.7, I do play around w/ requirements. but failures are w/ passlib 1.7 yes, you need to manually override requirements | 16:52 |
| *** arunkant__ has quit IRC | 16:53 | |
| *** amrith has joined #openstack-keystone | 16:53 | |
| amrith | stevemar__, ping. check out https://ask.openstack.org/en/question/99700/how-to-get-identity-api-endpoint/ | 16:53 |
| stevemar__ | amrith: there you are! | 16:54 |
| zzzeek | lbragstad: http://paste.openstack.org/show/590690/ | 16:54 |
| lbragstad | zzzeek let me see if I can recreate locally with master... keystone did merge https://review.openstack.org/#/c/401328/7 | 16:54 |
| stevemar__ | amrith: i haven't checked our twitter convo all morning, been busy like a chicken with no head | 16:54 |
| zzzeek | lbragstad: it reproduces, just install passlib 1.7 after you tox -e py27 --notest to install deps | 16:54 |
| amrith | stevemar__, np. just confirmed that the link does in fact render. ta ta | 16:54 |
| lbragstad | zzzeek cool - let me check | 16:54 |
| stevemar__ | amrith: :) | 16:54 |
| *** anush has joined #openstack-keystone | 16:57 | |
| *** tqtran has joined #openstack-keystone | 16:59 | |
| lbragstad | zzzeek hummm... | 17:00 |
| lbragstad | stevemar__ i think we need to amend https://review.openstack.org/#/c/401328/7 ? | 17:01 |
| morgan_ | o/ | 17:01 |
| morgan_ | morning keystone | 17:01 |
| zzzeek | lbragstad: looks like we're waiting for https://review.openstack.org/#/c/403514/ | 17:01 |
| lbragstad | stevemar__ i think the except case needs to deal with the case where 1.6.5 is installed | 17:01 |
| lbragstad | zzzeek aha | 17:02 |
| lbragstad | yeah - that's exactly what i did and it passed locally | 17:02 |
| *** diazjf has joined #openstack-keystone | 17:04 | |
| *** daemontool has quit IRC | 17:04 | |
| lbragstad | zzzeek stevemar__ well - i'm not sure why that patch is failing the cross jobs but - I've rebased it | 17:04 |
| lbragstad | https://review.openstack.org/#/c/401369/ | 17:04 |
| *** hrybacki is now known as hrybacki|moving | 17:14 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make try/except work for passlib 1.6 and 1.7 https://review.openstack.org/403815 | 17:15 |
| lbragstad | stevemar__ zzzeek i proposed ^ and made the requirements change dependent on it | 17:17 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Include mapped in the default auth methods https://review.openstack.org/403816 | 17:17 |
| lbragstad | i tested it locally with passlib 1.6.5 and 1.7 | 17:17 |
| lbragstad | and both pass, where-as before I was getting an invalid username/password error | 17:18 |
| lbragstad | with passlib 1.7 | 17:18 |
| lbragstad | which i have a feeling is why we are getting the failures with the cross job on the requirements patch | 17:18 |
| *** pcaruana has quit IRC | 17:19 | |
| *** code-R_ has quit IRC | 17:35 | |
| *** code-R has joined #openstack-keystone | 17:35 | |
| *** jpich has quit IRC | 17:37 | |
| *** diazjf has quit IRC | 17:54 | |
| *** pnavarro has quit IRC | 17:55 | |
| *** diazjf has joined #openstack-keystone | 17:58 | |
| *** diazjf has quit IRC | 17:59 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Don't invalidate all user tokens of roleless group https://review.openstack.org/399728 | 18:00 |
| *** catintheroof has joined #openstack-keystone | 18:04 | |
| openstackgerrit | Merged openstack/keystone: Remove unused statements in matches https://review.openstack.org/393399 | 18:04 |
| stevemar__ | lbragstad: thanks | 18:04 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add reason to notifications for PCI-DSS https://review.openstack.org/396752 | 18:06 |
| *** jperry has quit IRC | 18:07 | |
| *** jaosorior has quit IRC | 18:08 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add reason to notifications for PCI-DSS https://review.openstack.org/396752 | 18:08 |
| *** hrybacki|moving is now known as hrybacki | 18:17 | |
| *** chris_hultin is now known as chris_hultin|AWA | 18:18 | |
| *** jperry has joined #openstack-keystone | 18:21 | |
| *** anush has quit IRC | 18:23 | |
| *** jperry has quit IRC | 18:26 | |
| *** jperry has joined #openstack-keystone | 18:26 | |
| *** browne has joined #openstack-keystone | 18:28 | |
| *** code-R has quit IRC | 18:38 | |
| *** code-R has joined #openstack-keystone | 18:38 | |
| *** chlong has joined #openstack-keystone | 18:42 | |
| *** phalmos has quit IRC | 18:44 | |
| *** diazjf has joined #openstack-keystone | 19:09 | |
| *** amoralej is now known as amoralej|off | 19:11 | |
| *** diazjf has quit IRC | 19:13 | |
| lbragstad | stevemar__ zzzeek https://review.openstack.org/#/c/401369/7 is passing now | 19:15 |
| stevemar__ | lbragstad: i'm confused why it works, but it's a stop-gap, it'll be out in a few patches | 19:15 |
| lbragstad | stevemar__ the reason why it was failing was because of the cross job | 19:16 |
| lbragstad | it must do testing with multiple versions? | 19:16 |
| stevemar__ | ah | 19:16 |
| stevemar__ | lbragstad: i fast approved | 19:17 |
| lbragstad | tusen takk! | 19:19 |
| *** phalmos has joined #openstack-keystone | 19:19 | |
| openstackgerrit | Andrey Grebennikov proposed openstack/keystone: Allow to specify ID on project creation https://review.openstack.org/403866 | 19:22 |
| *** phalmos has quit IRC | 19:23 | |
| *** diazjf has joined #openstack-keystone | 19:26 | |
| openstackgerrit | Merged openstack/keystone: Refactor Keystone admin-tokens and admin-users v2 https://review.openstack.org/369883 | 19:32 |
| *** diazjf has quit IRC | 19:32 | |
| *** chris_hultin|AWA is now known as chris_hultin | 19:33 | |
| *** gyee has joined #openstack-keystone | 19:34 | |
| agrebennikov | hey folks, remember at austin summit we talked about potential multi-site solutions. And I proposed to implement custom project ID functionality in order to allow users to switch between regions | 19:36 |
| agrebennikov | stevemar__, | 19:36 |
| *** spzala has joined #openstack-keystone | 19:37 | |
| *** diazjf has joined #openstack-keystone | 19:38 | |
| *** josecastroleon has joined #openstack-keystone | 19:41 | |
| *** josecastroleon has quit IRC | 19:46 | |
| *** amrith has left #openstack-keystone | 19:48 | |
| ayoung | rodrigods, you mentioned before something about Federation and LDAP CI, and Outreachy. What is happening there? | 19:56 |
| stevemar__ | aw fail: http://docs.openstack.org/developer/keystone/configuration.html#bootstrapping-keystone-with-admin-token | 19:56 |
| stevemar__ | agrebennikov: i remember some of that | 19:57 |
| *** gyee has quit IRC | 20:00 | |
| agrebennikov | stevemar__, I just submitted the patch for it, please take a look. And before I come to the weekly meeting tomorrow just wanted to let you know that I'm going to try to push you guys once again - another really big customer needs the sae feature to be implemented | 20:01 |
| agrebennikov | please forgive me, the patch is very preliminary and doesn't contain any tests | 20:02 |
| agrebennikov | I just need an opinion | 20:02 |
| agrebennikov | and actually I'd like to discuss it with you guys tomorrow | 20:02 |
| *** chlong has quit IRC | 20:02 | |
| agrebennikov | (if it makes sense) | 20:02 |
| *** woodster_ has joined #openstack-keystone | 20:05 | |
| *** browne has quit IRC | 20:08 | |
| *** browne has joined #openstack-keystone | 20:10 | |
| *** gyee has joined #openstack-keystone | 20:11 | |
| *** chlong has joined #openstack-keystone | 20:18 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Import TaskManager from shade/nodepool https://review.openstack.org/362473 | 20:23 |
| *** adriant has joined #openstack-keystone | 20:25 | |
| morgan_ | stevemar__: the tail keeps getting longer | 20:25 |
| morgan_ | stevemar__, ayoung, https://review.openstack.org/#/c/362473/2 eyes would be welcome. this is code imported from shade and nodepool to suppor their cases. This makes sense to be available via session as the shade use-case is not isolated only to shade | 20:26 |
| morgan_ | lbragstad: ^ cc | 20:26 |
| *** anush has joined #openstack-keystone | 20:31 | |
| lbragstad | morgan_ cool - added it to the queue | 20:32 |
| morgan_ | it needs a pep8 fix | 20:33 |
| morgan_ | but that'll be shortly | 20:33 |
| lbragstad | morgan_ for the test doc string? | 20:33 |
| morgan_ | yeah i think that's it | 20:33 |
| lbragstad | not being on a single title line? | 20:33 |
| morgan_ | i'm confirming now, but fixing the dependant patch at the same time | 20:33 |
| lbragstad | cool | 20:33 |
| morgan_ | so will take care of that shortly | 20:33 |
| morgan_ | oy, some of our pep8 things are icky | 20:34 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Import TaskManager from shade/nodepool https://review.openstack.org/362473 | 20:36 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Use TaskManager for all request interactions https://review.openstack.org/362474 | 20:37 |
| morgan_ | lbragstad: ^ fixed. dependant change is also rebased | 20:37 |
| *** spligak has quit IRC | 20:37 | |
| lbragstad | morgan_ sweet | 20:37 |
| morgan_ | i'll be honest, i didn't test py27, just 35 and pep8 | 20:38 |
| morgan_ | hopefully there isn't some silly py27 thing I missed | 20:38 |
| morgan_ | lbragstad: ok all tests but the src-dsvm tests have passed | 20:44 |
| ayoung | morgan_, it is not "Importing" python code from shade/nodepool is it? | 20:44 |
| morgan_ | ayoung: no it is forklifting it in | 20:45 |
| morgan_ | so it is closer to the session oobejct and it will be removed form shade/nodepool after ksa has a release | 20:45 |
| morgan_ | the task manager interface (and shade's use of it) is not uncommon | 20:45 |
| morgan_ | it could enable the clients to be smarter about polling / updates / etc | 20:45 |
| ayoung | morgan_, but usually in conjunction with some threading model | 20:46 |
| morgan_ | it allow for built-in rate limiting by creating a task | 20:46 |
| morgan_ | etc | 20:46 |
| morgan_ | for the moment it is effectively a no-op unless someone adds task-specific-data to the session when instantiating it | 20:46 |
| ayoung | morgan_, as a construct it is harmless | 20:47 |
| morgan_ | yep | 20:47 |
| morgan_ | the task manager could be thread aware directly | 20:47 |
| ayoung | I'm just not certain this is the place for it. I'm not saying no, just that this is a huge context switch for me | 20:47 |
| openstackgerrit | Matt Fischer proposed openstack/keystone: cache_on_issue default to true https://review.openstack.org/383333 | 20:47 |
| morgan_ | it could also lean on threading on the wrapping client/user | 20:47 |
| *** ravelar has quit IRC | 20:47 | |
| morgan_ | ayoung: the way i see it is that shade and nodepool absolutely use this and it's proven to be useful there. | 20:48 |
| morgan_ | i could see this expanding the functionality of ksa without harming the core use. and not in a "feature creep" kind of way | 20:48 |
| ayoung | morgan_, this is a "base client" type behavior, isn't it? | 20:48 |
| ayoung | Not auth specific | 20:48 |
| morgan_ | coreect | 20:48 |
| ayoung | and we have no base client | 20:48 |
| morgan_ | core to interacting wiht requests for example | 20:48 |
| morgan_ | and session should be the "base client" object | 20:48 |
| morgan_ | in the openstack world | 20:49 |
| ayoung | ksa asession is the closest we have... | 20:49 |
| morgan_ | correct and i don't want a "base client" becuase session is meant to handle that. | 20:49 |
| ayoung | what would be the end relationship between the TaskManager and the session, then? | 20:50 |
| morgan_ | TaskManager is an option that allows for added logic beyond the base "send things as fast as you can to the API" | 20:50 |
| morgan_ | for example, shade knows it needs to rate limit some requests | 20:50 |
| morgan_ | so it doesn't over load the APIs for clouds | 20:50 |
| morgan_ | it can implement the taskmanager which allows it to set this rate limiting client side | 20:51 |
| morgan_ | s/implement/use+implement the rate limit functionality/ | 20:51 |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: [WIP] Add password expiration queries for PCI-DSS https://review.openstack.org/403898 | 20:53 |
| morgan_ | ayoung: it is an abstraction that allows for more logic that is client-determined when interacting with an API through session. | 20:53 |
| morgan_ | ayoung: but unless explicitly used, is no different that today's workflow | 20:54 |
| ayoung | morgan_, is it something a session would use or soemthing that would use a session? | 20:55 |
| morgan_ | it is something that is used by <code> using session | 20:55 |
| ayoung | say I want to do...create user | 20:55 |
| ayoung | and use a specific task manager, how would I do it? | 20:56 |
| morgan_ | you pass the task manager to the sesson on creation | 20:56 |
| morgan_ | you cna either pass explicit tasks with logic added to it, or make the taks manager always perform the action (such as wait 10s between user-creates) | 20:57 |
| morgan_ | most tasks are automatically generated and the added logic would be in the task manager | 20:57 |
| ayoung | so session takes an optional task manager upon creation? | 20:58 |
| morgan_ | yep | 20:58 |
| ayoung | if it is passed, all tasks go through the task manager? | 20:58 |
| morgan_ | yes. if it is not passed, a default (don't change any logic) manager is created and used | 20:58 |
| morgan_ | https://review.openstack.org/#/c/362474/2/keystoneauth1/session.py line 233 | 20:59 |
| ayoung | morgan_, so, besides rate-limiter what task mangers have been used thus far? | 21:00 |
| morgan_ | let me go look through nodepool | 21:00 |
| morgan_ | and shade | 21:00 |
| *** spzala has quit IRC | 21:01 | |
| morgan_ | ayoung: for example, nodepool does caching with a provider manager for the flavour list | 21:02 |
| morgan_ | right now it's directly implemented on the nodepool task manager, since it isn't down into the session object | 21:03 |
| morgan_ | mordred: ^ see ayoung's question on task maangers that have been implemented | 21:04 |
| morgan_ | ayoung: mordred can probably answer more directly. | 21:04 |
| morgan_ | since i'm digging through code to find the managers | 21:04 |
| ayoung | morgan_, could this be a general purpose utility, chain of responsiblity style, for adding new behaviour? | 21:04 |
| morgan_ | ayoung: possibly. | 21:04 |
| ayoung | morgan_, a couple things that seem like this is near: | 21:04 |
| ayoung | Kerberos, where you want to specify --negotiate on ALL URLs, not just to Keystone, | 21:05 |
| ayoung | getting a token from a common store, like we did with Keyring | 21:05 |
| morgan_ | that should be 100% possible to do | 21:05 |
| morgan_ | based upon my understanding | 21:06 |
| ayoung | morgan_, any workflow with tokens, where we want to maybe get something specific for a call.... | 21:06 |
| morgan_ | it might need a little massaging to get there | 21:06 |
| morgan_ | but afaict yes. | 21:06 |
| mordred | ayoung: rate limiting - also making sure only one thread and only one thread executes - also we stick logging/stats collection there | 21:06 |
| ayoung | it is, essentially, a decorator for "do this on all calls" | 21:06 |
| mordred | yah. it can certainly be that | 21:07 |
| morgan_ | it is something we're lacking in KSA, but we don't want it to be default behavior (not all interactions/clouds/generic uses need the additional logic) | 21:07 |
| ayoung | mordred, so, what if you are doing multiple things, like both rate limiting and logging? | 21:07 |
| morgan_ | ayoung: smarter task manager. | 21:08 |
| mordred | ayoung: here's the nodepool one: http://git.openstack.org/cgit/openstack-infra/nodepool/tree/nodepool/task_manager.py#n64 fwiw | 21:08 |
| ayoung | that seems like decorator | 21:08 |
| morgan_ | mordred: replied to the logging comment. | 21:08 |
| morgan_ | mordred: in short ++, either in a followup or depending on comments next patchset | 21:08 |
| mordred | morgan_: woot | 21:08 |
| ayoung | seems like a wonky interface, though | 21:09 |
| ayoung | the interface seems tuned to threading | 21:09 |
| mordred | that's what it was written for - its primary purpose in life is enabling advanced things related to threading/rate-limiting | 21:09 |
| ayoung | seems like the start/stop should be the lifespan of the session itself. How would that work if it were buried under the session object? | 21:09 |
| mordred | it can _also_ do other things | 21:09 |
| mordred | why would start/stop be the lifespan of the session? we make one session and use it for thousands of calls | 21:10 |
| ayoung | mordred, mordred I hear ya, I am just trying to wrap my head around it//// | 21:10 |
| mordred | totes | 21:10 |
| * morgan_ is glad mordred lurks in this channel too | 21:10 | |
| mordred | not meaning to be argumentative - mostly just poking/helping to poke so that I can try to help with the head wrapping | 21:10 |
| ayoung | mordred, but would you stop and start the task maanager from the session object on each call? | 21:10 |
| ayoung | what would call "start" | 21:10 |
| mordred | ayoung: duh. sorry, brain not fully firing | 21:12 |
| ayoung | mordred, see, that is normal brain operation for me. | 21:13 |
| mordred | ayoung: that's an excellent question - in the case you have a TaskManager (like the nodepool ones) I'd imagine you'd be passing the TaskManager to the session constructor - so you would have the handle to call start and stop as needed | 21:13 |
| * morgan_ is sans coffee... sooooo brain is firing at .. 205% | 21:13 | |
| *** anush has quit IRC | 21:13 | |
| morgan_ | 20%* | 21:13 |
| mordred | 205% is really good braining | 21:14 |
| morgan_ | right?! | 21:14 |
| morgan_ | fingers are smarter than brain atm | 21:14 |
| ayoung | I think it wraps around | 21:14 |
| ayoung | 101% == 1% | 21:14 |
| morgan_ | lol | 21:14 |
| mordred | oh. then that's less good braining | 21:14 |
| morgan_ | my brain is so fast, it's slow. | 21:15 |
| ayoung | OK, so... mordred say I am using a rate limiting task manager. THat would just limite the rate on all calls, no need to call start or stop, right? | 21:16 |
| *** chlong has quit IRC | 21:16 | |
| morgan_ | ooh i think this needs a reno as well. will poke at that | 21:17 |
| mordred | yah. that's how we use it in nodepool - the TaskManager is started at instantiation (when we give it the rate) and then it applies that rate to all calls | 21:17 |
| mordred | EXCEPT... | 21:17 |
| mordred | for 'fancy' things like glanceclient where the call to glanceclient is actually a generator - so we have no way of knowing when it's going to make a remote call | 21:18 |
| mordred | (which will be fixed by pushing the rate limiting directly into the session itself) | 21:18 |
| ayoung | So, it seems to me the TaskManager was designed external to the session, and maybe does not need to be more than a "decorate" call when added to the session? | 21:19 |
| ayoung | And... | 21:19 |
| ayoung | ok, so lets say you are making calls via a bunch of processes, and you want them, all to go through some central session hub (wack idea) | 21:19 |
| morgan_ | ayoung: wack idea indeed | 21:19 |
| mordred | then you should be using oaktree ;) | 21:20 |
| ayoung | the decorator would be the code that connects to the hub, say to serialize multple requests from different processes | 21:20 |
| ayoung | but the start and stop would be called on the session hub, not on the decorator | 21:20 |
| ayoung | seems like the abstraction you want is really two different things? | 21:20 |
| ayoung | no idea what Oaktree is, so I cannot say | 21:21 |
| morgan_ | ayoung: i'd say the "session hub" is likely going to end up being a proxy, the normal session would pass the info on to the session hub | 21:21 |
| morgan_ | since a session is an actual request-generating-object | 21:21 |
| mordred | I'm not following the decorate construct | 21:21 |
| morgan_ | mordred: task manager works like a decorator, execute/do things; execute actual function; execute/dothings/return | 21:22 |
| ayoung | mordred, an interface like the python @decorator approach, but that you dynamically add to a session | 21:22 |
| ayoung | 2 functions | 21:22 |
| morgan_ | mordred: it is an apt comparison to python code itself | 21:22 |
| ayoung | do this before calling the remote API | 21:22 |
| ayoung | do this after calling the remote API | 21:22 |
| ayoung | yeah, what morgan_ said | 21:22 |
| ayoung | decorator as a Design pattern thiough, not talking about necessarilty using the Python impl | 21:23 |
| mordred | yah | 21:23 |
| mordred | becuase the python impl is a whole other thing | 21:23 |
| morgan_ | it functionally is designed like a decorator works. | 21:23 |
| ayoung | so, instead of saying, create this session with this task manager, you would say : here are the set of decorators to include on this session object | 21:25 |
| mordred | yes - one could do that - however, because the original intent of TaskManager is about queue running / rate limiting, I believe it would be hard to reason about if it was a generic "here are the request wrappers I want you to run, one of them will serialize in a queue all calls" | 21:26 |
| mordred | I could be wrong about that, of course | 21:26 |
| morgan_ | also.. that would require metaclass magic | 21:26 |
| morgan_ | if you're actually using decorators. | 21:27 |
| morgan_ | i could see an interface like dogpile does with the proxy->proxy->proxy->backend | 21:28 |
| morgan_ | but it feels like that could get wibbly-wobbly | 21:28 |
| morgan_ | (proxy is an object fwiw) | 21:28 |
| morgan_ | i like the added logic encapsulated in the task manager. | 21:29 |
| *** anush has joined #openstack-keystone | 21:29 | |
| *** chlong has joined #openstack-keystone | 21:30 | |
| ayoung | I still don't understand what would call start/stop | 21:30 |
| morgan_ | ayoung: in the case of nodepool, which is heavily threaded. nodepool would manage start/stops | 21:30 |
| mordred | whoever creates the TaskManager object is responsible for calling start/stop | 21:31 |
| mordred | it's also worth pointing out that a single TaskManager can be used for more than just the requests Session | 21:31 |
| mordred | or could be passed to more than one Session | 21:31 |
| mordred | so in the simple case, there is only one TaskManager and it's hidden from the user so nobody calls those because they don't matter | 21:32 |
| morgan_ | in the case where it's not thread-magic the start/stop isn't needed (as seen in the default impl) | 21:32 |
| mordred | in the more complex case where the user knows they want a TaskManager that does other things, it's their job to start/stop if needed | 21:32 |
| morgan_ | mordred: ++ | 21:32 |
| morgan_ | ayoung: in short, start/stop is for exceptionally complex uses such as nodepool or your "session hub" kind of concept | 21:32 |
| morgan_ | but in most cases not a hard-set requirement | 21:33 |
| morgan_ | erm.. used extensively in the simple cases that is | 21:33 |
| mordred | morgan_: perhaps we should remove the run/stop methods from teh ksa.TaskManager | 21:33 |
| morgan_ | s/extensively// | 21:33 |
| ayoung | morgan_, could that be on a specific subclass, then, and not on the interface submitted to gerrit on this review? | 21:33 |
| mordred | it's not actually a part of the interface here | 21:33 |
| morgan_ | mordred: possibly? | 21:33 |
| morgan_ | i'm not opposed to that | 21:34 |
| mordred | yah. I think that might be the confusion | 21:34 |
| ayoung | now, how about a "before and after call?" | 21:34 |
| mordred | they aren't methods intended to be called by things that aren't the nodepool TaskManager | 21:34 |
| morgan_ | if the task manager needs to be smarter it can be, but it's not nodepool specific | 21:34 |
| morgan_ | or oaktree for that matter | 21:34 |
| morgan_ | just supporting the base taskmanager interface is all ksa needs to do | 21:34 |
| mordred | yah. just saying - if someone made a QueueTaskManager and that neededa start/stop, those are new methods for that | 21:35 |
| morgan_ | yah | 21:35 |
| morgan_ | and that is a sane approach | 21:35 |
| mordred | and ksa calling those methods would not be a thing | 21:35 |
| morgan_ | ++ | 21:35 |
| *** diazjf has quit IRC | 21:35 | |
| mordred | because how could ksa know when to call them - to ayoung's point :) | 21:35 |
| morgan_ | ok i'll yank those methods off the ksa one. | 21:35 |
| morgan_ | in the next patchset | 21:35 |
| ayoung | it kindof looks like the existing calls are before and after...if you squint and look out of the corner of your eye | 21:36 |
| morgan_ | mordred: stop/run methods actually here, right? | 21:37 |
| mordred | yah | 21:37 |
| mordred | the ones that say "this doens't do anything" | 21:37 |
| *** anush has quit IRC | 21:37 | |
| morgan_ | mordred: hmm. i think the logger needs to not be a class property here. | 21:40 |
| mordred | morgan_: nod | 21:40 |
| morgan_ | is it sane to make the logger instance property? because we're not expecting every task to us ethe same logger object | 21:41 |
| morgan_ | same with taskmanager? | 21:42 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Force users to immediate change their password upon first use https://review.openstack.org/403916 | 21:45 |
| ayoung | morgan_, mordred I am not sure how to capture this in the code review. | 21:45 |
| morgan_ | ayoung: well ignore the start/run methods. if you want a before/after type method submitTask and submitFunction can be defined on the new subclassed taskmanager | 21:47 |
| openstackgerrit | David Stanek proposed openstack/keystone: Move redelegated_trust_id out of extras https://review.openstack.org/276474 | 21:48 |
| stevemar__ | rderose: ohh that sounds like a change of behaviour | 21:49 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Import TaskManager from shade/nodepool https://review.openstack.org/362473 | 21:49 |
| *** diazjf has joined #openstack-keystone | 21:49 | |
| morgan_ | mordred: ^ fixed things based upon discussion here | 21:50 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Force users to immediately change their password upon first use https://review.openstack.org/403916 | 21:50 |
| morgan_ | mordred: also loggers are now instance properties. | 21:50 |
| morgan_ | mordred: unless I am breaking something specifically... maybe we should allow passing of a logger in? in case you want to use a shared logger. | 21:50 |
| *** masuberu has quit IRC | 21:51 | |
| stevemar__ | dstanek: thanks :) | 21:51 |
| ayoung | morgan_, mordred responded. Hope this discussion was helpful | 21:51 |
| rderose | stevemar__: need a spec? | 21:51 |
| morgan_ | ayoung: thnx | 21:52 |
| rderose | stevemar__: it is a change in behavior, but was missed in the original PCI-DSS spec | 21:53 |
| stevemar__ | rderose: oh | 21:53 |
| stevemar__ | rderose: is there a bug? i missed that in the commit message i think | 21:53 |
| stevemar__ | i thought you were changing things up completely | 21:53 |
| rderose | stevemar__: no, not changing things up completely | 21:54 |
| morgan_ | ayoung: responded, patchset 4 removes stop/run methods from the task manager | 21:54 |
| rderose | stevemar__: planning to add a bug | 21:54 |
| stevemar__ | ++ | 21:54 |
| ayoung | morgan_, I know it is more work, but what about splitting it into before and after as I suggested | 21:56 |
| morgan_ | mordred: do we need threading.event and wait in the baseTask? | 21:56 |
| ayoung | And then showing how the decorators would be called from the session object | 21:56 |
| ayoung | At a minimum, show how it is going to be called from the session | 21:57 |
| morgan_ | ayoung: the followup patch implements that | 21:57 |
| morgan_ | https://review.openstack.org/#/c/362474/3 | 21:57 |
| ayoung | morgan_, yeah, but the no-op impl and the call from session is the important part and should be a single patch | 21:57 |
| ayoung | the follow on does too much IIRC | 21:58 |
| ayoung | Ah, it just logs | 21:58 |
| ayoung | drop that | 21:58 |
| morgan_ | yep | 21:58 |
| *** chris_hultin is now known as chris_hultin|AWA | 21:58 | |
| morgan_ | drop the logging from the base implementation? | 21:59 |
| morgan_ | oh i see the logger thing | 21:59 |
| morgan_ | in https://review.openstack.org/#/c/362474/3/keystoneauth1/task_manager.py | 21:59 |
| ayoung | I really don't like the run approach. You need to do kwargs to call an existing method...I won't hold it up, but, please think of the maintainers. | 21:59 |
| morgan_ | i'll roll the log bit back into the previous patch, that is where it should have been. | 22:00 |
| ayoung | the other thing I don't like is that it makes the client async doesn't it? | 22:00 |
| morgan_ | not explictly | 22:00 |
| morgan_ | it could be async. | 22:00 |
| ayoung | messes with return code meaning then | 22:00 |
| morgan_ | the threading bits will be dropped from the main basetask in the next patch | 22:01 |
| * ayoung has to get kids | 22:01 | |
| morgan_ | mordred: i think i found a small gap in the code as well | 22:02 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Role Check Check from Middleware https://review.openstack.org/391624 | 22:02 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Force users to immediately change their password upon first use https://review.openstack.org/403916 | 22:03 |
| morgan_ | ayoung: it shouldn't be messing with the return code meaning. it should pass back up to the session in the same way | 22:03 |
| ayoung | lbragstad, stevemar__ there is the version with RBAC in middelware only | 22:03 |
| ayoung | morgan_, then it needs to be sync... | 22:03 |
| ayoung | or the task manager abstraction needs to be outside the call somehow...too much for me to think through right now. | 22:04 |
| morgan_ | ayoung: it is a sync call unless the task manager implements async. | 22:04 |
| morgan_ | ayoung: which case, that is on the implementor to manage/maintain (such as nodepool) | 22:04 |
| ayoung | right but the caller might not know that | 22:05 |
| morgan_ | if you're overriding the task manager... your caller needs to know what is expected. | 22:05 |
| *** lamt has quit IRC | 22:05 | |
| morgan_ | nodepool does know that and is what is conusming/using the session | 22:06 |
| morgan_ | ayoung: go get kids | 22:07 |
| *** chlong has quit IRC | 22:09 | |
| *** lamt has joined #openstack-keystone | 22:10 | |
| *** jrist has joined #openstack-keystone | 22:20 | |
| *** mvk has joined #openstack-keystone | 22:25 | |
| *** catintheroof has quit IRC | 22:28 | |
| *** zigo has quit IRC | 22:29 | |
| openstackgerrit | Andrey Grebennikov proposed openstack/keystone: Allow to specify ID on project creation https://review.openstack.org/403866 | 22:31 |
| *** zigo has joined #openstack-keystone | 22:36 | |
| *** spligak has joined #openstack-keystone | 22:37 | |
| *** chris_hultin|AWA is now known as chris_hultin | 22:41 | |
| *** edtubill has quit IRC | 22:42 | |
| lbragstad | mfisch did you ever figure out what was up with https://review.openstack.org/#/c/383333/10 ? | 22:52 |
| lbragstad | and why it was failing? | 22:52 |
| lbragstad | mfisch I saw that you rebased it, did another patch land that fixed it? | 22:52 |
| *** diazjf has quit IRC | 22:59 | |
| *** spzala has joined #openstack-keystone | 23:01 | |
| *** jperry has quit IRC | 23:02 | |
| *** spzala has quit IRC | 23:06 | |
| *** chris_hultin is now known as chris_hultin|AWA | 23:10 | |
| *** lamt has quit IRC | 23:18 | |
| rodrigods | ayoung, hey... was afk | 23:31 |
| openstackgerrit | Merged openstack/keystone: Make try/except work for passlib 1.6 and 1.7 https://review.openstack.org/403815 | 23:43 |
| ayoung | rodrigods, me too | 23:44 |
| ayoung | rodrigods, what is going on with the upstream Federation CI effort? | 23:45 |
| rodrigods | ayoung, so... we have a devstack plugin being set up: https://review.openstack.org/#/c/400747/ | 23:45 |
| rodrigods | ayoung, and we have functional tests: https://review.openstack.org/#/c/324769/ | 23:46 |
| ayoung | rodrigods, do we currently have a check job to run the Functional tests? | 23:47 |
| *** gyee has quit IRC | 23:49 | |
| *** agrebennikov has quit IRC | 23:50 | |
| ayoung | rodrigods, like, are there any tests that ran with that review that actually show it was working? | 23:53 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!