| morgan | and i know how that goes | 00:00 |
|---|---|---|
| morgan | i also know what a 10MM row keystone token table does to a cloud | 00:00 |
| morgan | first hand | 00:00 |
| adriant | not pretty :P | 00:00 |
| morgan | (~10MM/week) sorry | 00:00 |
| adriant | We haven't yet, but switching to Fernet is next. | 00:01 |
| morgan | fernet is much much better | 00:01 |
| adriant | Actually, that's a thought. Is anyone doing Multi-Master keystone? | 00:01 |
| adriant | Is it possible? | 00:01 |
| morgan | adriant: it is possible. | 00:01 |
| morgan | adriant: i've done it, i've seen it, i would still do a corosync/pacemaker master/passive/passive deployment | 00:01 |
| morgan | and for multi-DC/high-latency (read: WAN) setups, I would mostly be ok with a replication of keystone data with fernet, since it doesn't change much | 00:02 |
| morgan | high-latency is anything > 5ms imo | 00:02 |
| *** ngupta has joined #openstack-keystone | 00:02 | |
| stevemar | lbragstad: congrats! | 00:03 |
| adriant | morgan: We're looking at doing better DR for our keystone, and with fernet we were wondering if M-M was doable since it would also serve as a sort of load balancing to the nearest region. | 00:04 |
| stevemar | wow, some close election results this time around | 00:04 |
| *** thorst_ has joined #openstack-keystone | 00:08 | |
| *** stradling has quit IRC | 00:11 | |
| *** mvk has joined #openstack-keystone | 00:11 | |
| gagehugo | congrats lbragstad! | 00:14 |
| morgan | adriant: doable, some folks have done it | 00:18 |
| morgan | i just don't have enough solid data for modern deployments to know the success rate | 00:18 |
| morgan | adriant: the biggest concern is revocation events (probably can just turn them off) and fernet key replication/distribution | 00:19 |
| *** stradling has joined #openstack-keystone | 00:23 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone master: Readability/Typo Fixes in Release Notes https://review.openstack.org/429894 | 00:31 |
| *** ngupta has quit IRC | 00:31 | |
| *** stradling has quit IRC | 00:36 | |
| *** adrian_otto has joined #openstack-keystone | 00:38 | |
| adrian_otto | tx morgan | 00:39 |
| *** david-lyle has quit IRC | 00:42 | |
| *** ngupta has joined #openstack-keystone | 00:42 | |
| *** thorst_ has quit IRC | 00:45 | |
| *** tovin07 has joined #openstack-keystone | 00:49 | |
| adriant | morgan: fernet keys I was intended to generate outside of the keystone nodes, and then sync them to all node. That was the process always keeps them in sync and throws warning and refuses to sync unless all nodes can be done. | 00:50 |
| adriant | intending* | 00:50 |
| *** zhurong has joined #openstack-keystone | 00:50 | |
| adriant | wow I can't type tonight | 00:51 |
| *** tqtran has quit IRC | 00:51 | |
| morgan | adriant: and you're doing it right then | 00:52 |
| adriant | morgan: I'll be doing a test multi-region deployment at some stage with multi-master and seeing how we can handle duplicate events, and replication honoring. Probably just sticking with 'newest wins'. | 00:53 |
| lbragstad | gagehugo thanks! | 00:53 |
| morgan | hmm. | 00:53 |
| *** hoangcx has joined #openstack-keystone | 00:57 | |
| morgan | hmm dolphm, lbragstad any recommendations on a cast iron griddle? i need one that doesn't have cut-out handles - and it doesn't have to be reversible (I don't need it for grilling, I expect to get a different pan just for that) | 00:57 |
| morgan | or carbon steel. | 00:57 |
| *** ngupta has quit IRC | 00:58 | |
| *** browne has quit IRC | 01:01 | |
| *** david-lyle has joined #openstack-keystone | 01:04 | |
| *** ngupta has joined #openstack-keystone | 01:06 | |
| *** ravelar has quit IRC | 01:10 | |
| *** yarkot has quit IRC | 01:10 | |
| adriant | morgan: sql to change parent seems to work in devstack without breaking anything | 01:18 |
| *** thorst_ has joined #openstack-keystone | 01:19 | |
| adriant | I feel so dirty using raw sql though :P | 01:19 |
| *** adu has joined #openstack-keystone | 01:19 | |
| *** adu has quit IRC | 01:21 | |
| *** liujiong has joined #openstack-keystone | 01:25 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Fix multiple uuid warnings with pycadf https://review.openstack.org/426411 | 01:30 |
| openstackgerrit | vegezcj proposed openstack/keystone master: Keystone ldap tree_dn does not support Chinese https://review.openstack.org/430495 | 01:31 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone master: Fix multiple uuid warnings with pycadf https://review.openstack.org/426411 | 01:44 |
| *** guoshan has joined #openstack-keystone | 01:51 | |
| *** guoshan_ has joined #openstack-keystone | 01:52 | |
| *** guoshan has quit IRC | 01:52 | |
| *** ngupta has quit IRC | 01:52 | |
| *** MasterOfBugs has quit IRC | 01:57 | |
| *** adrian_otto has quit IRC | 02:04 | |
| *** thorst_ has joined #openstack-keystone | 02:19 | |
| *** thorst_ has quit IRC | 02:24 | |
| *** adrian_otto has joined #openstack-keystone | 02:27 | |
| lbragstad | morgan cast iron griddle? | 02:30 |
| lbragstad | morgan hmm | 02:30 |
| *** adu has joined #openstack-keystone | 02:30 | |
| *** lucas_ has joined #openstack-keystone | 02:34 | |
| morgan | lbragstad: yeah | 02:36 |
| morgan | lbragstad: lodge one is not sufficient for what i want | 02:36 |
| morgan | lbragstad: trying to find a good one, pref a double burner one. | 02:36 |
| morgan | i might need to find someone who'll do custom old-school cast iron in sand | 02:36 |
| lbragstad | morgan that'd be sweet | 02:37 |
| *** zhurong has quit IRC | 02:51 | |
| *** dikonoor has joined #openstack-keystone | 02:55 | |
| *** thorst_ has joined #openstack-keystone | 02:55 | |
| *** thorst_ has quit IRC | 02:55 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone master: Deprecate (and emit message) AdminTokenAuthMiddleware https://review.openstack.org/427878 | 03:04 |
| ayoung | lbragstad, congrats | 03:07 |
| ayoung | morgan, I don't think there is anything magic to cast iron frying pans. Just make sure you get handle covers, as they scald quickly | 03:09 |
| lbragstad | ayoung yes - exactly | 03:09 |
| lbragstad | ayoung morgan i typically sand mine down to give them an ultra smooth finish before seasoning them | 03:09 |
| ayoung | ziad, joe heck, dolphm, morgan, stevemar .... lbragstad you are in pretty good company. | 03:10 |
| lbragstad | ayoung ++ i have some good examples to learn from | 03:13 |
| *** zhurong has joined #openstack-keystone | 03:33 | |
| *** lucas_ has quit IRC | 03:37 | |
| *** adu has quit IRC | 03:41 | |
| *** ngupta has joined #openstack-keystone | 03:49 | |
| *** links has joined #openstack-keystone | 03:50 | |
| *** prashkre has joined #openstack-keystone | 03:51 | |
| morgan | ayoung: it is about getting a good griddle. | 03:54 |
| morgan | ayoung: beyond that.. its shape/construction/QA etc. not anything else. | 03:54 |
| *** thorst_ has joined #openstack-keystone | 03:56 | |
| *** guoshan_ has quit IRC | 04:00 | |
| *** prashkre has quit IRC | 04:01 | |
| *** thorst_ has quit IRC | 04:01 | |
| lbragstad | morgan what about https://goo.gl/oSWjLW | 04:01 |
| *** zhurong has quit IRC | 04:04 | |
| *** nicolasbock has quit IRC | 04:12 | |
| *** martinlopes has quit IRC | 04:20 | |
| *** lucas_ has joined #openstack-keystone | 04:20 | |
| *** martinlopes has joined #openstack-keystone | 04:21 | |
| *** martinlopes has quit IRC | 04:28 | |
| *** ngupta has quit IRC | 04:48 | |
| *** ngupta has joined #openstack-keystone | 04:49 | |
| *** ngupta has quit IRC | 04:53 | |
| *** thorst_ has joined #openstack-keystone | 04:57 | |
| *** guoshan has joined #openstack-keystone | 05:01 | |
| *** thorst_ has quit IRC | 05:02 | |
| *** martinlopes has joined #openstack-keystone | 05:03 | |
| openstackgerrit | Merged openstack/keystone master: Remove unused api parameters https://review.openstack.org/429790 | 05:10 |
| openstackgerrit | Merged openstack/keystone master: Readability/Typo Fixes in Release Notes https://review.openstack.org/429894 | 05:10 |
| *** guoshan has quit IRC | 05:15 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone master: use the correct bp link for shadow-mapping rel note https://review.openstack.org/430569 | 05:29 |
| *** lucas_ has quit IRC | 05:31 | |
| *** lucas_ has joined #openstack-keystone | 05:40 | |
| *** lucas_ has quit IRC | 05:40 | |
| *** thorst_ has joined #openstack-keystone | 05:58 | |
| *** thorst_ has quit IRC | 06:03 | |
| *** guoshan_ has joined #openstack-keystone | 06:08 | |
| *** adrian_otto has quit IRC | 06:13 | |
| *** prashkre has joined #openstack-keystone | 06:14 | |
| *** edmondsw has joined #openstack-keystone | 06:17 | |
| *** edmondsw has quit IRC | 06:21 | |
| *** zhurong has joined #openstack-keystone | 06:22 | |
| *** richm has quit IRC | 06:42 | |
| *** adrian_otto has joined #openstack-keystone | 06:42 | |
| *** zhurong has quit IRC | 06:43 | |
| *** zhurong has joined #openstack-keystone | 06:49 | |
| *** tqtran has joined #openstack-keystone | 06:50 | |
| *** tqtran has quit IRC | 06:54 | |
| *** abqkawi1000 has quit IRC | 06:57 | |
| *** rcernin has joined #openstack-keystone | 06:59 | |
| *** martinlopes has quit IRC | 06:59 | |
| *** zhurong has quit IRC | 07:05 | |
| openstackgerrit | gengchc2 proposed openstack/keystoneauth master: Remove support for py34 https://review.openstack.org/430595 | 07:07 |
| *** pcaruana has joined #openstack-keystone | 07:29 | |
| *** adriant has quit IRC | 07:32 | |
| openstackgerrit | gengchc2 proposed openstack/oslo.policy master: Remove support for py34 https://review.openstack.org/430611 | 07:32 |
| *** adrian_otto has quit IRC | 07:33 | |
| *** tesseract has joined #openstack-keystone | 07:35 | |
| *** david-lyle_ has joined #openstack-keystone | 07:37 | |
| *** thorst_ has joined #openstack-keystone | 07:59 | |
| *** thorst_ has quit IRC | 08:04 | |
| *** prashkre has quit IRC | 08:05 | |
| *** liujiong_66 has joined #openstack-keystone | 08:13 | |
| *** liujiong has quit IRC | 08:13 | |
| *** david-lyle_ has quit IRC | 08:28 | |
| *** chlong has quit IRC | 08:30 | |
| *** chlong has joined #openstack-keystone | 08:31 | |
| *** stevemar has quit IRC | 08:33 | |
| *** stevemar has joined #openstack-keystone | 08:35 | |
| *** prashkre has joined #openstack-keystone | 08:36 | |
| *** liujiong_66 is now known as liujiong | 08:46 | |
| *** ngupta has joined #openstack-keystone | 08:51 | |
| *** tqtran has joined #openstack-keystone | 08:52 | |
| *** ngupta has quit IRC | 08:56 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add --check to keystone-manage db_sync command https://review.openstack.org/416383 | 08:56 |
| *** tqtran has quit IRC | 08:56 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:02 | |
| *** ChanServ sets mode: +o stevemar | 09:06 | |
| *** slunkad has quit IRC | 09:30 | |
| *** slunkad has joined #openstack-keystone | 09:33 | |
| *** openstackgerrit has quit IRC | 09:34 | |
| *** links has quit IRC | 09:35 | |
| *** kukacz_ has joined #openstack-keystone | 09:39 | |
| *** nishaYadav has joined #openstack-keystone | 09:40 | |
| nishaYadav | o/ | 09:40 |
| *** rdo_ has joined #openstack-keystone | 09:40 | |
| *** Guest66676 has joined #openstack-keystone | 09:41 | |
| *** hoangcx_ has joined #openstack-keystone | 09:41 | |
| *** med_` has joined #openstack-keystone | 09:43 | |
| *** lbragstad_ has joined #openstack-keystone | 09:43 | |
| *** topol_ has joined #openstack-keystone | 09:44 | |
| *** dolphm_ has joined #openstack-keystone | 09:44 | |
| *** ChanServ sets mode: +o dolphm_ | 09:44 | |
| *** nonameentername has joined #openstack-keystone | 09:44 | |
| *** dims_ has joined #openstack-keystone | 09:44 | |
| *** hugokuo_ has joined #openstack-keystone | 09:45 | |
| *** Krenair_ has joined #openstack-keystone | 09:45 | |
| *** hoangcx has quit IRC | 09:45 | |
| *** masterjcool has quit IRC | 09:45 | |
| *** dims has quit IRC | 09:45 | |
| *** topol has quit IRC | 09:45 | |
| *** hoonetorg has quit IRC | 09:45 | |
| *** timss has quit IRC | 09:45 | |
| *** aloga has quit IRC | 09:45 | |
| *** rdo has quit IRC | 09:45 | |
| *** kukacz has quit IRC | 09:45 | |
| *** dolphm has quit IRC | 09:45 | |
| *** med_ has quit IRC | 09:45 | |
| *** Krenair has quit IRC | 09:45 | |
| *** lbragstad has quit IRC | 09:45 | |
| *** hugokuo has quit IRC | 09:45 | |
| *** _nonameentername has quit IRC | 09:45 | |
| *** Guest66666 has quit IRC | 09:45 | |
| *** dolphm_ is now known as dolphm | 09:45 | |
| *** hugokuo_ is now known as hugokuo | 09:45 | |
| *** Krenair_ is now known as Krenair | 09:46 | |
| *** Krenair has quit IRC | 09:46 | |
| *** Krenair has joined #openstack-keystone | 09:46 | |
| *** aloga_ has joined #openstack-keystone | 09:47 | |
| *** links has joined #openstack-keystone | 09:51 | |
| *** masterjcool has joined #openstack-keystone | 09:52 | |
| *** timss has joined #openstack-keystone | 09:52 | |
| *** aloga has joined #openstack-keystone | 09:53 | |
| *** hoonetorg has joined #openstack-keystone | 09:54 | |
| *** hoangcx_ has quit IRC | 09:57 | |
| *** thorst_ has joined #openstack-keystone | 10:00 | |
| *** nishaYadav has quit IRC | 10:02 | |
| *** thorst_ has quit IRC | 10:04 | |
| *** nishaYadav has joined #openstack-keystone | 10:05 | |
| *** liujiong has quit IRC | 10:08 | |
| *** aloga_ has quit IRC | 10:19 | |
| *** guoshan_ has quit IRC | 10:26 | |
| nishaYadav | dolphm, hey, you around? | 10:29 |
| *** aloga_ has joined #openstack-keystone | 10:41 | |
| Adobeman | ummm I'm looking at this blog | 10:41 |
| Adobeman | https://keithtenzer.com/2016/03/08/openstack-keystone-integrating-ldap-with-ipa/ | 10:41 |
| Adobeman | so at the keystone section, export... openstack-config => openstack config | 10:42 |
| Adobeman | not entirely sure about the v2 with the url | 10:43 |
| Adobeman | I think morgan sort of mentioned I should be doing with additional following lines.. | 10:43 |
| Adobeman | I am assuming "keystone user-role-add --user-id ospadmin --role admin --tenant admin" ==(in newton)===> openstack role add -user ospadmin --role admin --tenant admin | 10:44 |
| Adobeman | but appears to be wrong | 10:45 |
| Adobeman | if I recall correctly, --tenant is v2, but does it work differently in newton ? | 10:45 |
| Adobeman | then there is the "keystone user-role-add --user-id ospuser --role _member_ --tenant Project1" | 10:46 |
| Adobeman | there is no Project1 yet | 10:46 |
| *** links has quit IRC | 10:50 | |
| *** ngupta has joined #openstack-keystone | 10:53 | |
| *** ngupta has quit IRC | 10:57 | |
| *** nicolasbock has joined #openstack-keystone | 11:05 | |
| *** links has joined #openstack-keystone | 11:06 | |
| *** richm has joined #openstack-keystone | 11:12 | |
| Adobeman | agh.. re-IP is not very fun in openstack.. | 11:16 |
| Adobeman | ok, I think I updated all the configuration file. Something somewhere still think I'm on the old IP.. | 11:20 |
| *** aloga_ has quit IRC | 11:27 | |
| *** openstackgerrit has joined #openstack-keystone | 11:34 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone master: Enable trusts for federated users https://review.openstack.org/415545 | 11:34 |
| Adobeman | does openstack put IP address in database somewhere..? | 11:40 |
| nishaYadav | stevemar, o/ | 11:44 |
| nishaYadav | I tried setting up LDAP back end with DevStack and got an error, in particular this line no. 140 here https://github.com/openstack-dev/devstack/blob/master/lib/ldap | 11:46 |
| *** aloga_ has joined #openstack-keystone | 11:48 | |
| nishaYadav | I am getting no such object error, as one can't modify the hdb database because there isn't one already present. I asked for help on #openladap and they said adapt the manager.ldif to work with your existing setup. Can anyone please help me, any idea how to go about this? | 11:49 |
| rodrigods | stevemar, ayoung, if you have a moment to review the implied roles tests in tempest: https://review.openstack.org/#/c/425927/12 | 11:51 |
| ayoung | rodrigods, happy to do so | 11:51 |
| rodrigods | thanks ayoung | 11:51 |
| *** mvk has quit IRC | 11:53 | |
| samueldmq | morning keystone | 11:56 |
| stevemar | morning samueldmq ayoung and rodrigods o/ | 11:58 |
| stevemar | oh hi nishaYadav :) | 11:58 |
| rodrigods | stevemar, samueldmq, morning o/ | 11:58 |
| ayoung | stevemar, feel as if the weight of the world has been lifted from your shoulders? | 11:58 |
| stevemar | ayoung: not yet, but almost :) | 11:59 |
| nishaYadav | stevemar, hi | 11:59 |
| nishaYadav | ayoung, rodrigods samueldmq o/ | 11:59 |
| rodrigods | nishaYadav, o/ | 11:59 |
| *** thorst_ has joined #openstack-keystone | 12:00 | |
| * samueldmq waves to everyone :) | 12:01 | |
| ayoung | When did Keystone become such an early morning project? | 12:03 |
| *** thorst_ has quit IRC | 12:05 | |
| nishaYadav | stevemar, Regarding the keystonemiddleware: allow_expires docs. The new feature is documented at a high level here, http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ocata/allow-expired.html and you said the new docs should describe how various services can use the new feature. So where can I find more details regarding this? Can you please suggest little more :) | 12:06 |
| nishaYadav | ayoung, I am glad, had to stay up late otherwise :P | 12:07 |
| *** dave-mccowan has joined #openstack-keystone | 12:07 | |
| *** raildo has joined #openstack-keystone | 12:12 | |
| *** edmondsw has joined #openstack-keystone | 12:13 | |
| *** mvk has joined #openstack-keystone | 12:21 | |
| *** david-lyle has quit IRC | 12:24 | |
| *** thorst_ has joined #openstack-keystone | 12:41 | |
| dstanek | morning | 12:48 |
| stevemar | o/ dstanek | 12:51 |
| *** ayoung has quit IRC | 12:59 | |
| *** ayoung has joined #openstack-keystone | 13:00 | |
| *** ChanServ sets mode: +v ayoung | 13:00 | |
| *** mvk has quit IRC | 13:04 | |
| *** catintheroof has joined #openstack-keystone | 13:08 | |
| *** mvk has joined #openstack-keystone | 13:17 | |
| *** lbragstad_ is now known as lbragstad | 13:29 | |
| *** ChanServ sets mode: +v lbragstad | 13:29 | |
| *** iurygregory has joined #openstack-keystone | 13:29 | |
| lbragstad | o/ | 13:35 |
| jmccarthy | Hiya samueldmq :) You still about ? | 13:38 |
| jmccarthy | Follow up question re: grant http://docs.openstack.org/developer/python-keystoneclient/api/keystoneclient.v3.html#keystoneclient.v3.roles.RoleManager.grant | 13:39 |
| samueldmq | jmccarthy: hi | 13:39 |
| *** links has quit IRC | 13:39 | |
| jmccarthy | I have a v3 client working like this at the moment for example: | 13:39 |
| jmccarthy | keystone type: <class 'keystoneclient.v3.client.Client'> | 13:39 |
| jmccarthy | keystone.auth_token: 66b2344091b14be7b471f5be70705a79 | 13:39 |
| jmccarthy | I'm not sure how to try grant ? | 13:40 |
| samueldmq | jmccarthy: to get to that grant operation you should be able to do | 13:40 |
| samueldmq | keystone.roles.grant(...) | 13:40 |
| jmccarthy | Ah ok lemme see | 13:41 |
| samueldmq | and pass the parameters as needed, all the params are specified in that doc | 13:41 |
| samueldmq | ^ | 13:41 |
| openstackgerrit | Merged openstack/oslo.policy master: Remove support for py34 https://review.openstack.org/430611 | 13:41 |
| *** AlexeyAbashkin has joined #openstack-keystone | 13:42 | |
| *** AlexeyAbashkin has quit IRC | 13:42 | |
| jmccarthy | Hmm what would be equivalent to this ? openstack role add --user test --project proj _member_ | 13:43 |
| *** prashkre has quit IRC | 13:44 | |
| jmccarthy | I guess this is wrong ? | 13:48 |
| jmccarthy | keystone.roles.grant(_member_, user=test, group=_member_, domain=admin, project=default, os_inherit_extension_inherited=False, **kwargs) | 13:48 |
| jmccarthy | NameError: name '_member_' is not defined | 13:48 |
| jmccarthy | samueldmq: Any suggestions on what params I have messed up ? I think role is first but says not defined (openstack role list shows it there) | 13:55 |
| *** zhurong has joined #openstack-keystone | 13:56 | |
| *** lucas_ has joined #openstack-keystone | 13:58 | |
| *** stradling has joined #openstack-keystone | 14:02 | |
| *** prashkre has joined #openstack-keystone | 14:03 | |
| openstackgerrit | David Stanek proposed openstack/keystone master: Removed the deprecated pki_setup command https://review.openstack.org/430938 | 14:04 |
| samueldmq | jmccarthy: that's a python error, try something like keystone.roles.grant("_member_", user="test") | 14:06 |
| jmccarthy | Hmm interesting, ok aside from 'Using keystoneclient sessions has been deprecated. Please update your software to use keystoneauth1' it complains: keystoneauth1.exceptions.http.NotFound: Could not find role: _member_ | 14:08 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone master: Enable trusts for federated users https://review.openstack.org/415545 | 14:09 |
| jmccarthy | samueldmq Oh ah ok - it requires role id (not the friendly name) | 14:10 |
| *** nishaYadav_ has joined #openstack-keystone | 14:10 | |
| jmccarthy | Now I get user test not found ;) | 14:10 |
| jmccarthy | Ok that is great - let me go and try that out some more - thanks again ! | 14:10 |
| *** nishaYadav has quit IRC | 14:12 | |
| samueldmq | jmccarthy: yeah, try keystone.users.list() and get a valid one for the role assignment | 14:12 |
| odyssey4me | congrats lbragstad | 14:12 |
| odyssey4me | and commiserations :p | 14:12 |
| samueldmq | jmccarthy: sure, np | 14:12 |
| lbragstad | odyssey4me thank you! | 14:13 |
| *** AlexeyAbashkin has joined #openstack-keystone | 14:13 | |
| jmccarthy | samueldmq Hmm the users list squawks: UserWarning: Using keystoneclient sessions has been deprecated. Please update your software to use keystoneauth1. | 14:15 |
| jmccarthy | warnings.warn('Using keystoneclient sessions has been deprecated. ' and no results :/ | 14:15 |
| samueldmq | jmccarthy: that's odd, a warning should not suppress the results | 14:16 |
| *** lucas_ has quit IRC | 14:18 | |
| *** nishaYadav_ has quit IRC | 14:20 | |
| jmccarthy | samueldmq it's ok I'm just using openstack client to get other info, seems to be working | 14:22 |
| jmccarthy | Need to check a bit more | 14:22 |
| samueldmq | jmccarthy: nice | 14:24 |
| *** lamt has joined #openstack-keystone | 14:26 | |
| *** ngupta has joined #openstack-keystone | 14:33 | |
| *** spilla has joined #openstack-keystone | 14:38 | |
| jmccarthy | samueldmq Oh hmm looks like I may have added this user previously with openstack client, new ones don't seem to be added :/ | 14:42 |
| samueldmq | jmccarthy: creating new users is not working ? | 14:42 |
| samueldmq | jmccarthy: the method to create a new user is described at http://docs.openstack.org/developer/python-keystoneclient/api/keystoneclient.v3.html#keystoneclient.v3.users.UserManager.create | 14:43 |
| jmccarthy | I'm creating them ok using openstack client, I mean assigning role isn't working looks like | 14:43 |
| samueldmq | jmccarthy: are you getting an error ? | 14:44 |
| openstackgerrit | David Stanek proposed openstack/keystone master: Deprecate the AdminTokenAuthMiddleware https://review.openstack.org/305287 | 14:44 |
| jmccarthy | No other output aside from same depr warn | 14:44 |
| samueldmq | jmccarthy: you should also be able to use openstackclient to assign roles too. | 14:44 |
| samueldmq | jmccarthy: so that means it was successfully added | 14:44 |
| jmccarthy | Yea, the client works, but the api is wanted for the role bit | 14:44 |
| samueldmq | jmccarthy: there is no output when a role assignment is successful, because the rest api returns 204 no content | 14:45 |
| samueldmq | so the client doesn't show anything | 14:45 |
| jmccarthy | Yes ! | 14:45 |
| jmccarthy | Ok you were right, my bad - typo | 14:45 |
| jmccarthy | :) | 14:45 |
| jmccarthy | It is working :) | 14:45 |
| jmccarthy | Ok I'll stop going on about it now, thank you once again for the help :) ! | 14:46 |
| samueldmq | jmccarthy: anytime | 14:46 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Move federated attributes spec to Pike https://review.openstack.org/430974 | 14:49 |
| jmccarthy | samueldmq: Out of curiousity, is https://github.com/openstack/python-openstacksdk keeping up with parity of other/older clients do you know ? | 14:50 |
| samueldmq | jmccarthy: sorry I don't know the current status of that effort. stevemar lbragstad may have a better idea ? ^ | 14:51 |
| lbragstad | jmccarthy that'd be something stevemar can probably answer better than I can | 14:52 |
| jmccarthy | Ok just curious, no probs | 14:54 |
| *** chris_hultin|AWA is now known as chris_hultin | 14:55 | |
| stevemar | jmccarthy: the SDK is a best-effort project, ideally there is partity with all projects and API versions, but unless someone puts up the patches for a specific item, you may be waiting | 14:58 |
| stevemar | jmccarthy: drop by #openstack-sdks and ping briancurtin (oh actually he's here) | 14:58 |
| briancurtin | we don’t care about other clients. the goal is always to have 100% parity with what the REST APIs provide, but as steve says, it sometimes depends on someone to just write the support for certain APIs. when we kicked off some of the libraries, it was just a matter of writing code for parts of a service we understood, rather than trying to get 100% coverage | 15:00 |
| *** lamt has quit IRC | 15:01 | |
| briancurtin | we’re working back through the services to complete them, and can add new services relatively easily, but there’s no consideration for how other python-*client libs have done things | 15:01 |
| samueldmq | briancurtin: doesn't that make adoption harder? in the case people already use the python-*client libs? | 15:02 |
| *** AlexeyAbashkin has quit IRC | 15:05 | |
| briancurtin | samueldmq: yep, and that’s fine. there’s no possible way to make a new library that caters to the vast differences each of those libraries has. if you look at the original three: novaclient, glanceclient, and swiftclient, they use (or at least used) three naming formats, three return formats, three ways to get started, etc. this is one view to openstack, | 15:05 |
| briancurtin | not a continuation of ‘everything is different just because' | 15:05 |
| *** adrian_otto1 has joined #openstack-keystone | 15:05 | |
| samueldmq | briancurtin: interesting, and that's challenging to get to a point to say: "okay you can migrate to -sdk, we support x% of APIs and we'll prioritize it as a team, openstack team" | 15:07 |
| samueldmq | the openstack cross-project community will need to have that in mind if we want that to be the main client someday | 15:07 |
| samueldmq | imh | 15:07 |
| samueldmq | imho | 15:07 |
| *** prashkre has quit IRC | 15:09 | |
| *** lamt has joined #openstack-keystone | 15:12 | |
| *** stradling has quit IRC | 15:12 | |
| *** jmccarthy has quit IRC | 15:12 | |
| *** jose-phillips has joined #openstack-keystone | 15:13 | |
| *** mvk has quit IRC | 15:14 | |
| *** jdennis1 has joined #openstack-keystone | 15:15 | |
| *** lucas_ has joined #openstack-keystone | 15:16 | |
| *** jdennis has quit IRC | 15:16 | |
| *** dikonoor has quit IRC | 15:18 | |
| *** dave-mccowan has quit IRC | 15:20 | |
| *** adrian_otto1 is now known as adrian_otto | 15:21 | |
| *** jose-phillips has quit IRC | 15:22 | |
| knikolla | o/ moning | 15:25 |
| knikolla | morning* | 15:25 |
| *** jmccarthy has joined #openstack-keystone | 15:29 | |
| knikolla | lbragstad: congrats! | 15:33 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add --check to keystone-manage db_sync command https://review.openstack.org/416383 | 15:33 |
| *** dave-mccowan has joined #openstack-keystone | 15:38 | |
| *** stradling has joined #openstack-keystone | 15:39 | |
| *** mvk has joined #openstack-keystone | 15:42 | |
| *** ravelar has joined #openstack-keystone | 15:51 | |
| *** adrian_otto has quit IRC | 15:57 | |
| lbragstad | friendly reminder that we have the policy meeting starting in #openstack-meeting-cp! | 16:01 |
| odyssey4me | stevemar ravelar lbragstad I added some comments to https://review.openstack.org/#/c/416383/ in both the latest and previous PS | 16:07 |
| odyssey4me | I'm happy to discuss further and will do daily reviews of the patch from here on. | 16:08 |
| ravelar | lbragstad, odyssey4me, stevemar sure, I would like to discuss the use of return codes for the purpose of checking up to date versions in the db_sync commands after the meeting | 16:09 |
| odyssey4me | ravelar ping me when you're ready | 16:09 |
| *** jaugustine has joined #openstack-keystone | 16:10 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add --check to keystone-manage db_sync command https://review.openstack.org/416383 | 16:14 |
| *** adrian_otto has joined #openstack-keystone | 16:16 | |
| *** david-lyle has joined #openstack-keystone | 16:23 | |
| *** zhurong has quit IRC | 16:25 | |
| *** rcernin has quit IRC | 16:39 | |
| *** david-lyle has quit IRC | 16:52 | |
| *** Guest66676 is now known as Guest6666 | 16:53 | |
| *** stradling has quit IRC | 16:55 | |
| *** prashkre has joined #openstack-keystone | 16:57 | |
| *** oomichi has left #openstack-keystone | 16:57 | |
| *** stradling has joined #openstack-keystone | 16:59 | |
| lbragstad | johnthetubaguy sorry - totally didn't mean to cut you off | 17:01 |
| *** stradling has quit IRC | 17:05 | |
| *** tesseract has quit IRC | 17:05 | |
| *** dikonoor has joined #openstack-keystone | 17:05 | |
| *** tqtran has joined #openstack-keystone | 17:06 | |
| *** jdennis1 is now known as jdennis | 17:08 | |
| lbragstad | ravelar odyssey4me stevemar still available to discuss https://review.openstack.org/#/c/416383/ ? | 17:10 |
| *** tqtran has quit IRC | 17:10 | |
| odyssey4me | o/ | 17:11 |
| ravelar | lbragstad o/ | 17:11 |
| lbragstad | odyssey4me o/ | 17:11 |
| *** david-lyle has joined #openstack-keystone | 17:12 | |
| lbragstad | do we want this check to perform the check against the migration scripts or the various versions of the migration repos stored in the db? | 17:12 |
| openstackgerrit | Ron De Rose proposed openstack/keystone master: Ensure migration file names are unique to avoid caching errors https://review.openstack.org/429912 | 17:12 |
| lbragstad | i.e. these migration numbers https://github.com/openstack/keystone/tree/master/keystone/common/sql/expand_repo/versions or the actual repository version stored in the database? | 17:13 |
| odyssey4me | hmm, I'm not sure I understand the difference in approach | 17:14 |
| lbragstad | odyssey4me you expect to use the tool in automated fashion with osa, right? | 17:14 |
| lbragstad | odyssey4me you'd run the check during the upgrade process? | 17:14 |
| odyssey4me | yes | 17:14 |
| odyssey4me | the check would run during both a greenfleld deployment and an upgrade (both minor and major) | 17:15 |
| lbragstad | ok | 17:16 |
| lbragstad | sqlalchemy keeps track of the repository state in the database - http://cdn.pasteraw.com/l47gkky5df2awt8g9y9yl29ux6dk7sq | 17:16 |
| lbragstad | and the current approach is checking those values | 17:16 |
| lbragstad | (there could be another approach to check the available migrations installed) | 17:17 |
| odyssey4me | which is the best source of truth? | 17:18 |
| lbragstad | where keystone-manage db_sync --check could check the version of the repositories from the database, but also check to see if there were any migrations installed that haven't run | 17:18 |
| lbragstad | personally, i think the state in the database would be better | 17:18 |
| lbragstad | installations can be rolled back | 17:18 |
| lbragstad | or swapped out with virtualenvs | 17:18 |
| lbragstad | so - you could get different check results depending on the code you have installed | 17:19 |
| ravelar | lbragstad odyssey4me you mean checking for up-to-date versions by checking what the version is in the database against what is installed/available in the repos right? | 17:20 |
| odyssey4me | ravelar yes, that's pretty much part of what I hope to achieve | 17:21 |
| odyssey4me | one part if to check whether all available migrations have run | 17:21 |
| *** jaosorior has joined #openstack-keystone | 17:21 | |
| lbragstad | odyssey4me so after you install a new venv on a keystone node that has new migration scripts available, you'd expect keystone-manage db_sync --check to say something like "hey, you have migrations you need to run!" | 17:22 |
| odyssey4me | another is to identify at what stage of migration an upgrade may be at | 17:22 |
| odyssey4me | lbragstad yes | 17:22 |
| lbragstad | odyssey4me aha | 17:22 |
| lbragstad | ravelar so i was wrong | 17:22 |
| lbragstad | ravelar sorry about that | 17:22 |
| odyssey4me | you have migrations to run would be one state | 17:23 |
| lbragstad | I was under the assumption that all the decisions about db state would be driven by the versions in the db | 17:23 |
| lbragstad | odyssey4me another state would be that your expand repository is up to date but the others aren't | 17:24 |
| odyssey4me | yep | 17:24 |
| lbragstad | and you'd expect each of these states to emit a different return code | 17:24 |
| odyssey4me | yes, ideally | 17:24 |
| lbragstad | and each return code should be documented | 17:24 |
| odyssey4me | yes | 17:25 |
| lbragstad | (preferably in the upgrade docs?) | 17:25 |
| odyssey4me | in the upgrade docs would make sense | 17:25 |
| lbragstad | ++ | 17:25 |
| lbragstad | ravelar does that make sense? | 17:25 |
| odyssey4me | it's ideal to refer to a single point where explanations are, instead of scattering them all over the place | 17:25 |
| ravelar | odyssey4me so basically "identify at what stage of migration an upgrade may be at" (currently done by notifying the user of the next step that is needed to be taken) | 17:26 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Fixed warning when building keystone docs https://review.openstack.org/431077 | 17:26 |
| odyssey4me | ravelar yes | 17:26 |
| ravelar | odyssey4me as for the error code, I see how this is commented to be added under some of the if statements. What I don't understand is what additional information you wanted to add that isnt there in the log? | 17:26 |
| odyssey4me | the information about the next step is for humans though - machines just want an error code | 17:26 |
| ravelar | odyssey4me ah, so just add a corresponding error code | 17:27 |
| lbragstad | ravelar so original output you had would be nice | 17:27 |
| lbragstad | where you just listed the various versions of each repo | 17:27 |
| ravelar | lbragstad yes, I have added this back on at the end | 17:27 |
| ravelar | :) | 17:27 |
| odyssey4me | the info output as it is now is fine, I haven't checked back very far | 17:28 |
| lbragstad | but the return code would be different | 17:28 |
| lbragstad | ok | 17:28 |
| odyssey4me | ravelar the error code is a return code, not a number in the output | 17:28 |
| lbragstad | ravelar aha - line 479 here https://review.openstack.org/#/c/416383/20/keystone/cmd/cli.py | 17:28 |
| ravelar | odyssey4me right returned as a systemexit | 17:29 |
| odyssey4me | ravelar yep | 17:29 |
| edmondsw | stevemar lbragstad isn't https://bugs.launchpad.net/keystone/+bug/1662911 just working as designed? | 17:29 |
| openstack | Launchpad bug 1662911 in OpenStack Identity (keystone) "v3 API create_user does not use default_project_id" [Undecided,New] | 17:29 |
| ravelar | odyssey4me sweet, will get on that. Just needed clarification :) | 17:29 |
| edmondsw | I don't think we want to use default_project_id with v3 | 17:29 |
| ravelar | lbragstad yse :) | 17:29 |
| ravelar | yes* | 17:29 |
| odyssey4me | thanks all - love your work :) | 17:30 |
| lbragstad | ravelar odyssey4me so a very basic idea would be http://cdn.pasteraw.com/aks00vy015d29jshc4n3f38n0f4l21o | 17:30 |
| odyssey4me | lbragstad RC one is reserved for a failure | 17:30 |
| odyssey4me | RC = 1 | 17:30 |
| ravelar | right so use 2 & 3 instead | 17:31 |
| odyssey4me | but yes, that's the general idea | 17:31 |
| lbragstad | updated - http://cdn.pasteraw.com/230kik24j4adzna20e162jjhw2y19kg | 17:32 |
| odyssey4me | yeah, that's better | 17:32 |
| odyssey4me | it may be good to get mfisch's thoughts too? | 17:32 |
| odyssey4me | or EmilienM ? | 17:32 |
| lbragstad | odyssey4me ++ | 17:33 |
| *** ChanServ sets mode: +v topol_ | 17:33 | |
| *** topol_ is now known as topol | 17:33 | |
| andrewbogott | Hello, all! I'm running keystone/liberty with uwsgi, and I'm getting periodic 'Connection reset by peer' issues. | 17:36 |
| andrewbogott | I've been assuming that this was some screwup in my uwsgi config, but having googled a bit it looks like maybe a known issue with keystone itself… is this a familiar issue to others? | 17:36 |
| andrewbogott | (The failure is intermittent, and transient, and I can't find anything in the logs to acknowledge that it's happening.) | 17:37 |
| EmilienM | odyssey4me: what's up? | 17:37 |
| odyssey4me | EmilienM we're discussing an addition to keystone-manage which allows the migration state to be checked, with unique return codes based on the state | 17:38 |
| odyssey4me | the general idea is that automation tooling (puppet, ansible, etc) can react based on the RC instead of having to guess | 17:38 |
| odyssey4me | and instead of having to parse output meant for humans | 17:38 |
| odyssey4me | for example: http://cdn.pasteraw.com/230kik24j4adzna20e162jjhw2y19kg | 17:39 |
| *** adrian_otto1 has joined #openstack-keystone | 17:39 | |
| odyssey4me | the patch state is currently https://review.openstack.org/416383 but does not yet include return codes | 17:39 |
| lbragstad | ravelar I added that paste to the bug reoprt | 17:40 |
| lbragstad | report* | 17:40 |
| ravelar | lbragstad sweet, thanks! | 17:40 |
| odyssey4me | EmilienM based on that very brief conceptual overview, are there any issues/concerns/comments? | 17:40 |
| odyssey4me | lbragstad ravelar Are you hoping to squeeze this one into Ocata? | 17:41 |
| lbragstad | odyssey4me not that I am aware of | 17:42 |
| odyssey4me | ok, so this is for pike | 17:42 |
| odyssey4me | 'tis all good - that gives us some time to try it out :) | 17:42 |
| lbragstad | odyssey4me but I'm totally willing to be convinced | 17:42 |
| *** adrian_otto has quit IRC | 17:42 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add --check to keystone-manage db_sync command https://review.openstack.org/416383 | 17:42 |
| odyssey4me | lbragstad my concern would be is that the RC's are essentially an interface - like an API | 17:43 |
| EmilienM | odyssey4me: oh I see. Yeah in Puppet we can tell "don't fail if RC is 1", etc | 17:43 |
| lbragstad | odyssey4me yeah - true | 17:43 |
| ravelar | lbragstad, odyssey4me let me know if that is what you are looking for :) | 17:43 |
| EmilienM | we can even tell "fail if code is XX" | 17:43 |
| odyssey4me | so it'd be better to try and get the automation projects to consume the tooling and give feedback | 17:43 |
| lbragstad | odyssey4me ++ | 17:43 |
| odyssey4me | EmilienM same here, but we ideally don't want RC 1 as that's typically the 'fail'code which everyone knows | 17:44 |
| odyssey4me | so basically here you'd be able to say 'if RC 2, then run migrate' | 17:44 |
| odyssey4me | if RC 2, then run contract | 17:44 |
| odyssey4me | oops | 17:44 |
| odyssey4me | if RC 0, everything is good | 17:45 |
| odyssey4me | if RC 1, something is broken | 17:45 |
| odyssey4me | if RC 2, execute the expand | 17:45 |
| odyssey4me | if RC 3, execute the migrate | 17:45 |
| odyssey4me | if RC 4, execute the contract | 17:45 |
| odyssey4me | no guessing | 17:45 |
| odyssey4me | and major upgrades can be effectively orchestrated | 17:46 |
| lbragstad | right | 17:46 |
| EmilienM | oh wow, that's complex | 17:46 |
| lbragstad | RC = 0 would mean the latest migration script version would match all the repository versions in the database | 17:46 |
| EmilienM | we'll have to write a provider to do that | 17:46 |
| odyssey4me | EmilienM upgrades are complex, and the idea here is to prvide the right information in a machine-readable way to be able to orchestrate them | 17:47 |
| ravelar | lbragstad what do you mean "available by inspecting the return code" are you talking about in main? | 17:49 |
| lbragstad | the return code can be checked using `echo $?` for example | 17:50 |
| ravelar | lbragstad ah | 17:50 |
| ravelar | lbragstad and back to comparing max repo version as well? | 17:51 |
| ravelar | lbragstad just to clarify | 17:51 |
| lbragstad | ravelar correct | 17:51 |
| ravelar | lbragstad alrighty! | 17:51 |
| *** adrian_otto1 has quit IRC | 17:51 | |
| lbragstad | ravelar make sense? | 17:51 |
| *** lucas_ has quit IRC | 17:52 | |
| ravelar | lbragstad yes perfect sense now, thanks all | 17:52 |
| lbragstad | ravelar example - http://cdn.pasteraw.com/uukzhx01zsntq4rppucmxqd4f82lqw | 17:53 |
| *** adrian_otto has joined #openstack-keystone | 17:53 | |
| ravelar | lbragstad ah, so manually checked return codes | 17:54 |
| lbragstad | ravelar yeah - that was just an example... but you can tell automation tooling, like ansible, to do things based on return codes of a command | 17:55 |
| lbragstad | ravelar like this - http://stackoverflow.com/questions/34340562/evaluating-return-code-in-ansible-conditional | 17:56 |
| lbragstad | ravelar http://docs.ansible.com/ansible/common_return_values.html#rc | 17:56 |
| *** jamielennox is now known as jamielennox|away | 18:00 | |
| *** tqtran has joined #openstack-keystone | 18:04 | |
| EmilienM | odyssey4me, lbragstad: is this migration thing is designed somewhere in a spec or documented somewhere? | 18:18 |
| EmilienM | lbragstad: I want to start planning puppet work | 18:18 |
| EmilienM | lbragstad: though in the case of tripleo, we use ansible to do upgrades | 18:19 |
| lbragstad | EmilienM we have a bug? https://bugs.launchpad.net/keystone/+bug/1642212 | 18:19 |
| openstack | Launchpad bug 1642212 in OpenStack Identity (keystone) "RFE: keystone-manage db_sync --check" [Wishlist,In progress] - Assigned to Richard (csravelar) | 18:19 |
| *** aloga_ has quit IRC | 18:25 | |
| *** dikonoor has quit IRC | 18:30 | |
| *** stradling has joined #openstack-keystone | 18:35 | |
| *** portdirect has quit IRC | 18:35 | |
| *** robcresswell has quit IRC | 18:35 | |
| *** waj334 has quit IRC | 18:35 | |
| *** pkoraca has quit IRC | 18:35 | |
| *** erlon has quit IRC | 18:35 | |
| *** wolsen has quit IRC | 18:35 | |
| *** nikhil has quit IRC | 18:35 | |
| *** DuncanT has quit IRC | 18:37 | |
| *** cargonza has quit IRC | 18:37 | |
| *** AndyWojo has quit IRC | 18:37 | |
| *** kamal___ has quit IRC | 18:37 | |
| *** raddaoui has quit IRC | 18:37 | |
| *** morgan has quit IRC | 18:45 | |
| *** jraim has quit IRC | 18:45 | |
| *** ctracey has quit IRC | 18:45 | |
| *** serverascode has quit IRC | 18:45 | |
| *** lucas_ has joined #openstack-keystone | 18:50 | |
| antwash | Has anyone every had this traceback error with sqlalchemy? http://paste.openstack.org/show/598127/ -- I'm updating a column value for (one or more) rows depending on number returned from query. For the changes to execute I have 'session.commit()', but it's giving me the traceback error. | 18:50 |
| lbragstad | antwash yeah - i was getting that same error yesterday when I was playing with your patch locally | 18:52 |
| *** stradling has quit IRC | 18:52 | |
| lbragstad | antwash these are the changes I was making locally - http://cdn.pasteraw.com/ins0fam7p8i86khn4zda2dhftuf2w0l | 18:53 |
| *** stradling has joined #openstack-keystone | 18:53 | |
| antwash | lbradstad : yeah I was reading some docs, and I seen that was another approach to update the values, instead of the way I'm currently doing | 18:55 |
| lbragstad | antwash also - most of the session_for_write() stuff just uses the attributes defined in the model | 18:55 |
| lbragstad | https://github.com/openstack/keystone/blob/029476272fb869c6413aa4e70f4cae6f890e598f/keystone/common/sql/core.py#L220 | 18:56 |
| lbragstad | the session_for_write() method is wrapped so I assume it handles the context manager accordingly | 18:56 |
| knikolla | sorry for not being much around this week, i'm not feeling well. | 19:06 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add --check to keystone-manage db_sync command https://review.openstack.org/416383 | 19:07 |
| lbragstad | knikolla no worries - hopefully you start feeling better | 19:12 |
| *** MasterOfBugs has joined #openstack-keystone | 19:22 | |
| *** jraim has joined #openstack-keystone | 19:23 | |
| dstanek | antwash: are you not in a session | 19:24 |
| dstanek | ? | 19:24 |
| *** erlon has joined #openstack-keystone | 19:25 | |
| antwash | dstanek: yeah I am, that's why it's weird | 19:26 |
| *** ctracey has joined #openstack-keystone | 19:28 | |
| *** DuncanT has joined #openstack-keystone | 19:31 | |
| *** serverascode has joined #openstack-keystone | 19:31 | |
| *** DuncanT has quit IRC | 19:35 | |
| dstanek | antwash: are you in a writable session? | 19:38 |
| lbragstad | dstanek i think it was because we wanted to update any default_project_ids to NOne | 19:39 |
| dstanek | lbragstad: that's a weird message. | 19:41 |
| lbragstad | dstanek it is | 19:41 |
| lbragstad | dstanek antwash it might be worth asking zzzeek, too | 19:42 |
| dstanek | lbragstad: i've only seen messages like that when i didn't actually have a connection or seesion. i don't remember that specific message though | 19:43 |
| lbragstad | dstanek yeah - that sounds about right | 19:43 |
| dstanek | lbragstad: antwash: is this a unit test that's failing? | 19:43 |
| lbragstad | dstanek but most of the time (at least from what i can tell) we use the session_for_read and session_for_write context managers to handle all that stuff for us | 19:44 |
| antwash | dstanek: awe, yep it's a unit test that's failing | 19:44 |
| dstanek | antwash: do you have the latest in gerrit? | 19:44 |
| antwash | dstanek : not yet I could push it up if needed -- didn't change much, but this 'with sql.session_for_write() as session:' | 19:45 |
| antwash | I've been reading docs and stackoverflow for hours | 19:45 |
| *** haplo37 has quit IRC | 19:46 | |
| dstanek | antwash: push up the latest and i can give it a try | 19:46 |
| antwash | dstanek : give me a minute or two | 19:46 |
| dstanek | antwash: np. i have to run and get my kids from school. i'll be back in 20 | 19:47 |
| *** lucas_ has quit IRC | 19:49 | |
| *** browne has joined #openstack-keystone | 19:49 | |
| *** DuncanT has joined #openstack-keystone | 19:51 | |
| *** pkoraca has joined #openstack-keystone | 19:53 | |
| *** waj334 has joined #openstack-keystone | 19:53 | |
| *** robcresswell has joined #openstack-keystone | 19:55 | |
| *** portdirect has joined #openstack-keystone | 19:57 | |
| *** haplo37_ has joined #openstack-keystone | 19:57 | |
| *** david-lyle has quit IRC | 19:57 | |
| *** spzala has joined #openstack-keystone | 19:59 | |
| *** spzala has quit IRC | 19:59 | |
| *** jaosorior has quit IRC | 20:02 | |
| *** nikhil has joined #openstack-keystone | 20:03 | |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Clear the project ID from user information https://review.openstack.org/429047 | 20:03 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Clear the project ID from user information https://review.openstack.org/429047 | 20:05 |
| *** edtubill has joined #openstack-keystone | 20:05 | |
| antwash | dstanek : cool, I just pushed it up for you https://review.openstack.org/#/c/429047/ | 20:06 |
| *** stradling has quit IRC | 20:07 | |
| *** wolsen has joined #openstack-keystone | 20:08 | |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Clear the project ID from user information https://review.openstack.org/429047 | 20:10 |
| *** cargonza has joined #openstack-keystone | 20:10 | |
| dstanek | antwash: sweet. back now. | 20:11 |
| *** raddaoui has joined #openstack-keystone | 20:11 | |
| *** morgan has joined #openstack-keystone | 20:12 | |
| *** AndyWojo has joined #openstack-keystone | 20:13 | |
| *** david-lyle has joined #openstack-keystone | 20:15 | |
| morgan | wow... openstack is so unusable | 20:16 |
| *** kamal___ has joined #openstack-keystone | 20:16 | |
| morgan | sorry openstackclient -- i can't get it even to work with basic examples | 20:16 |
| * morgan goes and hunts down mordred | 20:16 | |
| lbragstad | morgan hey - we've had some discussions about default_project_id and options, right? | 20:17 |
| lbragstad | morgan is there anything we could do to make this easier using your route? https://bugs.launchpad.net/keystone/+bug/1662911 | 20:18 |
| openstack | Launchpad bug 1662911 in OpenStack Identity (keystone) "v3 API create_user does not use default_project_id" [Undecided,New] | 20:18 |
| morgan | not really | 20:18 |
| zzzeek | antwash: the error means you are calling session.commit() on a Session that has autocommit=True and the begin() method has not been called | 20:19 |
| antwash | zzzeek, awe so the it's no need to even call session.commit() since autocommit is true. | 20:20 |
| *** david-lyle has quit IRC | 20:20 | |
| zzzeek | antwash: i wouldn't say that. if using the session w/ autocommit, begin() should always be called. autocommit is a legacy mode of operation. keystone should move to enginefacade in any case which takes care of the correct patterns | 20:20 |
| morgan | anyone here able to look at a clouds.yaml and tell me what i'm doing wrong? | 20:21 |
| *** spzala has joined #openstack-keystone | 20:21 | |
| *** spzala has quit IRC | 20:21 | |
| morgan | ... this is ... wow. | 20:21 |
| morgan | https://www.irccloud.com/pastebin/939qFOcZ/ | 20:21 |
| morgan | ^This does not work, with auth-url, without, with api-version, without, looks like os-client-config also cannot work with user_idand project_id. basically i don't know how anyone uses this successfully atm | 20:22 |
| *** lucas_ has joined #openstack-keystone | 20:23 | |
| morgan | stevemar, mordred, lbragstad, ^ | 20:24 |
| * morgan is trying to get back to work and needs to get access via API to vexxhost and doing it via curl is just... wlel no. | 20:25 | |
| morgan | just no | 20:25 |
| lbragstad | morgan I know dstanek uses it alot | 20:25 |
| morgan | lbragstad: the bad part is there is zero usable documentation on this crap | 20:26 |
| morgan | lbragstad: i've now spent an hour trying to figure out what i did wrong here. | 20:26 |
| dstanek | antwash: left you some comments on the review | 20:26 |
| morgan | and nothing is making sense, curl to the keystone API works, but occ and openstackclient... afaict just don't work | 20:26 |
| morgan | at all | 20:27 |
| dstanek | morgan: do you have an auth url specified somewhere else? | 20:27 |
| morgan | dstanek: it should be part of the vexxhost profile | 20:27 |
| morgan | it is talking to auth.vexxhost.net | 20:27 |
| morgan | which is correct | 20:28 |
| morgan | Using auth plugin: password | 20:28 |
| morgan | Using parameters {'username': 'aecf76e9-15ea-46e0-b982-446f32d1e150', 'project_name': 'aecf76e9-15ea-46e0-b982-446f32d1e150', 'user_domain_name': 'Default', 'auth_url': u'https://auth.vexxhost.net', 'password': '***', 'project_domain_name': 'Default'} | 20:28 |
| dstanek | hmmm... i don't use user_id and project_id together. just username and project_id | 20:28 |
| morgan | dstanek: when i try and user user_id I get errors like must supply usename with --os-username | 20:29 |
| dstanek | morgan: you paste looks correct to me | 20:29 |
| morgan | afaict occ and osc are broken. | 20:29 |
| morgan | and just don't work | 20:29 |
| dstanek | does occ support user_id? | 20:29 |
| morgan | sure doesn't seem like it | 20:30 |
| *** martinlopes has joined #openstack-keystone | 20:31 | |
| dstanek | morgan: not sure it it actually works, but the code appears to be doing something with it | 20:31 |
| morgan | yeah i tried to use user_id or "id" or variations | 20:31 |
| morgan | i ended up being told i have to supply a username on the cli | 20:31 |
| * morgan tries again withoout using clouds.yaml | 20:32 | |
| morgan | but ... i think osc just doesn't work atm | 20:32 |
| *** stradling has joined #openstack-keystone | 20:36 | |
| morgan | ftr: this is the latest "pip install python-openstackclient" | 20:39 |
| *** jaosorior has joined #openstack-keystone | 20:42 | |
| *** pcaruana has quit IRC | 20:43 | |
| mordred | morgan: occ supports user-id and username and if you provide both it should just pass both to keystoneauth | 20:43 |
| mordred | morgan: so - I just reinstalled osc with pip install -U python-openstackclient | 20:47 |
| mordred | morgan: and it's working for me ... can you paste your most recent (redacted) clouds.yaml again (and I'm sorry this is breaking for you) | 20:47 |
| dstanek | mordred: it is broken for me too | 20:50 |
| *** aastha has joined #openstack-keystone | 20:50 | |
| dstanek | mordred: this check fails http://git.openstack.org/cgit/openstack/osc-lib/tree/osc_lib/api/auth.py#n109 | 20:50 |
| dstanek | openstack --os-cloud devstack-admin user list -- works fine, but replace username: admin with user_id: XXXX and it starts to fail | 20:52 |
| mordred | dstanek: ah- that's one of those places where osc and occ do things different ... so I agree, it seems osc does not support user_id | 20:54 |
| dstanek | mordred: i'm planning on filing a bug and patch after this meeting unless someone gets to it first | 20:54 |
| mordred | dstanek: woot! I'm 12 things deep in my stack, so you'll certainly get to it before me | 20:55 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add --check to keystone-manage db_sync command https://review.openstack.org/416383 | 20:56 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add --check to keystone-manage db_sync command https://review.openstack.org/416383 | 20:57 |
| *** lucas_ has quit IRC | 21:00 | |
| dstanek | mordred: lol | 21:02 |
| *** stradling has quit IRC | 21:02 | |
| *** jamielennox|away is now known as jamielennox | 21:03 | |
| *** stradling has joined #openstack-keystone | 21:05 | |
| *** lucas_ has joined #openstack-keystone | 21:09 | |
| *** lucas_ has quit IRC | 21:16 | |
| *** lucas_ has joined #openstack-keystone | 21:16 | |
| *** adriant has joined #openstack-keystone | 21:20 | |
| *** lucas_ has quit IRC | 21:20 | |
| *** lucas_ has joined #openstack-keystone | 21:20 | |
| *** prashkre has quit IRC | 21:21 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone master: Add 'token' to the methods in the federated scoped token response https://review.openstack.org/431181 | 21:24 |
| morgan | rderose: ^ is that intended? | 21:26 |
| *** dave-mccowan has quit IRC | 21:26 | |
| morgan | rderose: you're adding "token" in all cases? | 21:26 |
| morgan | rderose: in theory you should only use token if you're explicitly using a token for rescoping | 21:26 |
| morgan | hence the "token" plugin | 21:27 |
| morgan | this feels like it should still not be "token" | 21:27 |
| rderose | morgan: hmm... for federation you use token to authenticate to get a scoped token | 21:27 |
| morgan | rderose: then you should be hitting the Token plugin | 21:28 |
| morgan | since you're already using a keystone token | 21:28 |
| morgan | adding it in the federated plugin doesn't make sense | 21:28 |
| rderose | morgan: this is federation, has it's own path | 21:28 |
| * morgan facepalms. | 21:28 | |
| rderose | morgan: I agree though, totally needs to be refactored | 21:28 |
| rderose | morgan: federation has it's own API for tokens | 21:29 |
| morgan | add "federated_scoped" then or some such | 21:29 |
| morgan | call it something not "token" if it doesn't explicitly hit the auth method named "token" | 21:29 |
| rderose | morgan: http://developer.openstack.org/api-ref/identity/v3-ext/#os-federation-api | 21:29 |
| *** adrian_otto has quit IRC | 21:29 | |
| rderose | morgan: /v3/auth/tokens | 21:30 |
| morgan | so you *have* to use the os-federation path to rescope to a scoped token? | 21:30 |
| * morgan is confused. | 21:30 | |
| rderose | me too | 21:30 |
| rderose | yes | 21:30 |
| openstackgerrit | Gage Hugo proposed openstack/keystoneauth master: Fixed multiple target Auth warning in docstring https://review.openstack.org/431184 | 21:30 |
| morgan | still not correct to use mapped in that case. | 21:31 |
| morgan | ferm | 21:31 |
| morgan | erm* | 21:31 |
| morgan | token | 21:31 |
| jamielennox | you shouldn't | 21:31 |
| jamielennox | we deprecated that | 21:31 |
| morgan | ok so, you *can* use the standard token auht path? | 21:31 |
| jamielennox | you should be able to use the standard /auth/tokens role and if it's a federated token it just goes down a slightly different code path | 21:31 |
| jamielennox | s/role/route | 21:31 |
| morgan | ok, yeah then don't muck with adding "token" auth to mapped like that | 21:31 |
| morgan | that is incorrect | 21:31 |
| morgan | in the auth methods that is | 21:32 |
| *** lucas_ has quit IRC | 21:32 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone master: Include 'token' in the method list for federated scoped tokens https://review.openstack.org/431181 | 21:32 |
| jamielennox | regarding the federated token there shouldn't be anything left that doesn't treat it jsut like a normal token | 21:32 |
| rderose | morgan: https://bugs.launchpad.net/keystone/+bug/1501032 | 21:32 |
| openstack | Launchpad bug 1501032 in OpenStack Identity (keystone) "incorrect method list is returned when scoping tokens with federation" [Low,Triaged] - Assigned to Ron De Rose (ronald-de-rose) | 21:32 |
| *** lucas_ has joined #openstack-keystone | 21:32 | |
| morgan | arguably we shoiuld redirect that into the token plugin in that case | 21:33 |
| morgan | mapped should *not* ever add "token" as a method itself | 21:33 |
| openstackgerrit | Ron De Rose proposed openstack/keystone master: Include 'token' in the method list for federated scoped tokens https://review.openstack.org/431181 | 21:33 |
| rderose | morgan: let see where I can add that then | 21:33 |
| *** lucas_ has quit IRC | 21:34 | |
| morgan | rderose: it means we're calling that incorrectly if the token plugin isn't doing the lifting | 21:34 |
| morgan | thats all. | 21:34 |
| rderose | morgan: yeah, just so hard to trace this freakin code | 21:35 |
| rderose | :) | 21:35 |
| morgan | well it's worth doing it right in this case | 21:35 |
| morgan | i'm guessing we need to make the Token method handler smarter | 21:35 |
| morgan | so it can handle the mapped magic | 21:35 |
| lbragstad | ravelar reviewed - https://review.openstack.org/#/c/416383/24 | 21:36 |
| jamielennox | lbragstad: congrats on the job! | 21:36 |
| lbragstad | jamielennox thanks! | 21:36 |
| morgan | lbragstad: https://review.openstack.org/#/c/428472/ should be quick/easy and should prevent future ick from sneaking into the sql models | 21:37 |
| morgan | lbragstad: and https://review.openstack.org/#/c/427878/ just so it's early on and we can prevent weirdness down the line. | 21:37 |
| lbragstad | ravelar also - i just responded to the comments you had on patch set 22 - https://review.openstack.org/#/c/416383/22 | 21:41 |
| lbragstad | morgan checking | 21:41 |
| lbragstad | morgan was https://review.openstack.org/#/c/428472/ fixing a developer problem? | 21:42 |
| *** lucas_ has joined #openstack-keystone | 21:42 | |
| morgan | lbragstad: it is fixing a "people keep using the "extras"-included base even when they shouldnt and when they don't include an extras column" | 21:43 |
| morgan | we should not ever add "Extras" going forward | 21:43 |
| morgan | and we shouldn't expect it to magically work if someone added the column | 21:44 |
| lbragstad | morgan ah | 21:44 |
| *** dave-mccowan has joined #openstack-keystone | 21:46 | |
| *** adrian_otto has joined #openstack-keystone | 21:47 | |
| lbragstad | morgan so what happens if someone is already using extras in any of these models? | 21:48 |
| lbragstad | morgan nevermind that last question | 21:48 |
| morgan | hehe | 21:49 |
| morgan | no model that supplied extras was changed | 21:49 |
| morgan | anything that didn't use it was | 21:49 |
| lbragstad | morgan so just to double check - extras had to be defined in the model attributes in order to be used in the table | 21:49 |
| morgan | yep | 21:50 |
| morgan | it didn't break because *magic* we checked some extra stuff | 21:50 |
| morgan | but reality, we were lucky | 21:50 |
| lbragstad | so if the model doesn't have extras in it's attributes, we should be able to switch it to ModelDictBase cleanly | 21:50 |
| morgan | yep. | 21:50 |
| morgan | as shown by that patch, which does that | 21:50 |
| morgan | if it has extras defined, it is assumed that we need the "extras" processing and do the weird mapping of things into a json blob | 21:51 |
| *** raildo has quit IRC | 21:51 | |
| lbragstad | so this would have been much worse if people were actually defining the model with extras | 21:51 |
| lbragstad | because then we wouldn't be able to remove it | 21:51 |
| morgan | yes | 21:52 |
| morgan | this is an effort to make sure someone doesn't go and define "extras" everywhere | 21:52 |
| morgan | we can't get rid of it (atm) | 21:52 |
| morgan | but we sure can not use it going forward | 21:52 |
| morgan | for new things | 21:52 |
| lbragstad | the User model doesn't have extras in the attributes? | 21:52 |
| morgan | you have to look at how to_dict and from_dict work | 21:52 |
| morgan | it's not a column that is directly populated | 21:53 |
| morgan | it's... ugh, just icky | 21:53 |
| *** thorst_ has quit IRC | 21:53 | |
| morgan | but basically anything that isn't in the attributes, gets stashed in exteas | 21:53 |
| morgan | extras* | 21:53 |
| morgan | it's super ugly | 21:53 |
| *** thorst_ has joined #openstack-keystone | 21:53 | |
| lbragstad | morgan oh - i thought you were only talking about the attribute list | 21:54 |
| lbragstad | not extra = sql.Column(sql.JsonBlob(), nullable=False) for example | 21:54 |
| morgan | yes. this is the column itself | 21:54 |
| lbragstad | looking at line 38 here - https://review.openstack.org/#/c/428472/4/keystone/oauth1/backends/sql.py,unified | 21:54 |
| morgan | and the mixin does the lifting magic for that serialization | 21:54 |
| morgan | ok so | 21:55 |
| morgan | i also renamed it to ModelDictMixinWithExtras | 21:55 |
| morgan | see that one has extras | 21:55 |
| lbragstad | right | 21:55 |
| morgan | where requesttoken (below) doesn't have "extras" | 21:55 |
| morgan | but was using dictbase | 21:55 |
| lbragstad | right | 21:56 |
| morgan | so someone could define extras on it and we'd be stuf with it | 21:56 |
| *** jaosorior has quit IRC | 21:56 | |
| morgan | stuck* | 21:56 |
| morgan | not that the code supported it | 21:56 |
| morgan | but you see. | 21:56 |
| lbragstad | morgan how come we don't put extras in the attribute list on line 34? | 21:56 |
| morgan | because we don't support <dict>['extras'] | 21:56 |
| openstackgerrit | Gage Hugo proposed openstack/keystonemiddleware master: Fixed man_pages no value warning when making docs https://review.openstack.org/431196 | 21:56 |
| morgan | anything in extras becomes <dict>[<key>] | 21:56 |
| morgan | in to_dict | 21:56 |
| morgan | and from_dict takes things not in attributes and does self.extras[<key>] = value | 21:57 |
| lbragstad | oh | 21:57 |
| lbragstad | ..... oh!@ | 21:57 |
| morgan | i told you. ugly | 21:57 |
| lbragstad | it's like a nice little anit-pattern | 21:57 |
| morgan | "nice" | 21:57 |
| morgan | not the word i'd use | 21:58 |
| lbragstad | cute? | 21:58 |
| *** thorst_ has quit IRC | 21:58 | |
| morgan | "omg who thought this was a good idea" | 21:58 |
| morgan | ; | 21:58 |
| morgan | ;) | 21:58 |
| morgan | i wish we could kill extras | 21:58 |
| morgan | but we wont ever be able to | 21:58 |
| morgan | even with microversions | 21:58 |
| morgan | but we can eliminate it from future things | 21:58 |
| morgan | just user, project, etc has it forevers | 21:59 |
| *** stradling has quit IRC | 21:59 | |
| adriant | morgan: metadata table! | 22:03 |
| adriant | then extras can die and go away | 22:03 |
| morgan | adriant: don't even get me started on that | 22:05 |
| morgan | adriant: :P | 22:05 |
| adriant | In my case, i 'need' something like extras :( | 22:05 |
| adriant | but a proper metadata table for projects/users would solve my problem much better | 22:05 |
| *** ngupta has quit IRC | 22:06 | |
| adriant | can't be secretly replace 'extra' with a metadata table and write a migration from 'dict' to key=value row? :P | 22:06 |
| adriant | can't we* | 22:06 |
| adriant | no one has to know! | 22:07 |
| *** jaugustine has quit IRC | 22:13 | |
| morgan | adriant: i tried to pitch that | 22:17 |
| morgan | but... i was told no | 22:17 |
| morgan | also, extras itself is terrible | 22:17 |
| morgan | most everything someone is doing with extras should be stored in a CRM tool external to openstack | 22:17 |
| morgan | or similar thing | 22:17 |
| *** gyee has joined #openstack-keystone | 22:17 | |
| morgan | storing the data in openstack is 99.9% of the time incorrect | 22:18 |
| morgan | aka, billing information per project, add the project_id in your salesforce type thing and correlate there. | 22:18 |
| morgan | etc. | 22:18 |
| morgan | the issue with extras is it is not validatable at the API layer | 22:18 |
| morgan | and therefore we also can't provide indexing/searching/limiting on it | 22:19 |
| morgan | you have to inspect every single element in the backend to know if an option is set | 22:19 |
| adriant | we do that, but some basic metadata for projects and such we store in keystone since it's not worth talking to an external system for it. | 22:19 |
| * morgan has considered a config for vendor data that works like options | 22:19 | |
| morgan | and i'd argue you're putting it in the wrong place | 22:19 |
| adriant | Although! What about user.email :P | 22:20 |
| morgan | i mean, i might be wrong, but almost every single case is better served externally | 22:20 |
| adriant | email is stored in extras! | 22:20 |
| morgan | email shouldn't be stored on the user object | 22:20 |
| morgan | period | 22:20 |
| morgan | we shouldn't be storing any PII in keystone | 22:20 |
| morgan | but that is a legacy thing we are stuck with... much like "extras" itself | 22:20 |
| morgan | ideally keystone should be as far out of scope of PII data as possible | 22:21 |
| morgan | because if keystone is in scope, your entire cloud is in scope | 22:21 |
| morgan | since that data can leak from keystone into other services if you're not careful (someone adds a silly line of code) | 22:21 |
| morgan | s/you're/we-the-devs-or-you-the-operator-changing-a-line-of-code/ | 22:22 |
| morgan | also ftr, email is used by nothing inside keystone or openstack. it's just random data shoved into the user object. | 22:23 |
| adriant | We're kind of stuck with it thought since we're using an unfederated keystone backed by sql. | 22:23 |
| morgan | we can't even search a user based upon it | 22:23 |
| morgan | email should likewise be outside keystone. | 22:23 |
| adriant | although, in our case we are doing username = email | 22:23 |
| lbragstad | dstanek since you proposed https://review.openstack.org/#/c/305287/ would you be interested in reviewing https://review.openstack.org/#/c/427878/ ? | 22:23 |
| morgan | if i had won the argument, extras would have gone away w/ no replacement | 22:23 |
| morgan | a few cycles ago | 22:23 |
| morgan | when email == username, the scope is a little different | 22:24 |
| morgan | but that is one of the edge-cases | 22:24 |
| morgan | remember usernames are not relaly considered PII. | 22:24 |
| morgan | (they can't be) | 22:24 |
| adriant | we don't actually use the email field (extras field), but we set it for legacy purposes | 22:24 |
| adriant | although I'm going to stop doing that... | 22:25 |
| adriant | username==email was our way to avoid namespace conflicts since we are running a single domain public cloud... | 22:25 |
| adriant | I'm trying, trying very hard so we can one day move to giving all new customers their own domain. | 22:26 |
| adriant | but we will be left with quite a few in the default domain we can't do anything about expect tell them to slowly migrate to their own domain. | 22:26 |
| adriant | this is one usecase where reparenting and moving a project/user to a new domain would be useful :P | 22:27 |
| *** dave-mccowan has quit IRC | 22:31 | |
| *** ngupta has joined #openstack-keystone | 22:32 | |
| *** spilla has quit IRC | 22:34 | |
| *** erlon has quit IRC | 22:35 | |
| morgan | adriant: the way i'd probably do it is sunset the product that isn't a per-customer domain and then provide inscentives to migrate. | 22:35 |
| morgan | adriant: i get it would be useful, but it's just not something we can really support. it was examined and we came up with a huge slew of edge cases and massive security concerns | 22:36 |
| *** ngupta has quit IRC | 22:36 | |
| *** lucas_ has quit IRC | 22:36 | |
| morgan | i think we discussed it over multiple cycles (reparenting and domain changes for resources) | 22:36 |
| morgan | it's a massive headache. | 22:37 |
| adriant | morgan: I know, I'm just teasing | 22:39 |
| adriant | I'm hoping to get us offering per customer domains as we upgrade and are happy with the offering, plus I'm working on shoehorning some HMT-lite features into single domain. | 22:40 |
| *** edmondsw has quit IRC | 22:41 | |
| adriant | partly because I doubt we'll move to using multiple domains any time soon unless something very drastic changes :( | 22:41 |
| lbragstad | morgan can i trade you a review? https://review.openstack.org/#/c/428543/ | 22:43 |
| *** browne has quit IRC | 22:48 | |
| *** edtubill has quit IRC | 22:52 | |
| *** edtubill has joined #openstack-keystone | 22:54 | |
| *** chris_hultin is now known as chris_hultin|AWA | 23:03 | |
| lbragstad | ravelar https://review.openstack.org/#/c/429113/1 looks good, just one minor suggestion on the commit message :) | 23:05 |
| *** edtubill has quit IRC | 23:05 | |
| *** ngupta has joined #openstack-keystone | 23:06 | |
| openstackgerrit | Merged openstack/keystone master: Fixed warning when building keystone docs https://review.openstack.org/431077 | 23:09 |
| *** catintheroof has quit IRC | 23:25 | |
| *** zhurong has joined #openstack-keystone | 23:30 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add --check to keystone-manage db_sync command https://review.openstack.org/416383 | 23:33 |
| *** zhurong has quit IRC | 23:36 | |
| *** browne has joined #openstack-keystone | 23:37 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add unit test for db_sync run out of order https://review.openstack.org/429113 | 23:41 |
| openstackgerrit | Octave Orgeron proposed openstack/keystone master: Closes-bug: 1662624 https://review.openstack.org/431229 | 23:47 |
| openstack | bug 1662624 in OpenStack Identity (keystone) "MySQL Cluster support for Keystone" [Wishlist,In progress] https://launchpad.net/bugs/1662624 - Assigned to Octave Orgeron (octave-orgeron) | 23:47 |
| *** phalmos has joined #openstack-keystone | 23:48 | |
| *** ngupta has quit IRC | 23:49 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!