| *** masber has joined #openstack-keystone | 00:05 | |
| *** dave-mcc_ has joined #openstack-keystone | 00:05 | |
| *** dave-mccowan has quit IRC | 00:07 | |
| *** markvoelker has quit IRC | 00:10 | |
| *** phalmos has quit IRC | 00:18 | |
| *** phalmos has joined #openstack-keystone | 00:26 | |
| *** markvoelker has joined #openstack-keystone | 00:34 | |
| *** zhurong has joined #openstack-keystone | 00:44 | |
| *** Shunli has joined #openstack-keystone | 00:50 | |
| *** lwanderley has quit IRC | 00:52 | |
| *** deep-book-gk has joined #openstack-keystone | 00:58 | |
| *** phalmos has quit IRC | 00:59 | |
| *** deep-book-gk has left #openstack-keystone | 01:00 | |
| *** ducttape_ has joined #openstack-keystone | 01:04 | |
| *** phalmos has joined #openstack-keystone | 01:07 | |
| *** ducttape_ has quit IRC | 01:08 | |
| *** namnh has joined #openstack-keystone | 01:27 | |
| *** edmondsw has joined #openstack-keystone | 01:36 | |
| *** thorst has joined #openstack-keystone | 01:37 | |
| *** edmondsw has quit IRC | 01:40 | |
| *** thorst has quit IRC | 01:41 | |
| *** ducttape_ has joined #openstack-keystone | 01:51 | |
| *** ducttape_ has quit IRC | 01:56 | |
| *** thorst has joined #openstack-keystone | 02:42 | |
| *** thorst has quit IRC | 02:47 | |
| *** edmondsw has joined #openstack-keystone | 03:24 | |
| *** edmondsw has quit IRC | 03:28 | |
| *** aojea has joined #openstack-keystone | 03:34 | |
| *** aojea has quit IRC | 03:38 | |
| *** thorst has joined #openstack-keystone | 03:43 | |
| *** thorst has quit IRC | 03:48 | |
| *** ducttape_ has joined #openstack-keystone | 03:52 | |
| *** ducttape_ has quit IRC | 03:56 | |
| *** junbo has joined #openstack-keystone | 04:07 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:43 | |
| *** aojea has joined #openstack-keystone | 05:08 | |
| *** GK1wmSU has joined #openstack-keystone | 05:21 | |
| *** GK1wmSU has left #openstack-keystone | 05:23 | |
| *** zhurong has quit IRC | 05:29 | |
| *** kornicameister has joined #openstack-keystone | 05:32 | |
| *** _GK1wmSU has joined #openstack-keystone | 05:34 | |
| *** _GK1wmSU has left #openstack-keystone | 05:36 | |
| *** thorst has joined #openstack-keystone | 05:44 | |
| *** aojea has quit IRC | 05:47 | |
| *** aojea has joined #openstack-keystone | 05:48 | |
| *** thorst has quit IRC | 05:49 | |
| *** aojea has quit IRC | 05:52 | |
| *** aojea has joined #openstack-keystone | 05:52 | |
| *** ducttape_ has joined #openstack-keystone | 05:53 | |
| *** markvoelker has quit IRC | 05:54 | |
| *** ducttape_ has quit IRC | 05:58 | |
| *** rcernin has joined #openstack-keystone | 06:11 | |
| *** pcaruana has joined #openstack-keystone | 06:19 | |
| *** tobberydberg has joined #openstack-keystone | 06:26 | |
| *** zsli_ has joined #openstack-keystone | 06:40 | |
| *** Shunli has quit IRC | 06:43 | |
| *** zhurong has joined #openstack-keystone | 06:47 | |
| *** edmondsw has joined #openstack-keystone | 06:59 | |
| *** edmondsw has quit IRC | 07:04 | |
| *** jaosorior has joined #openstack-keystone | 07:04 | |
| *** phalmos has quit IRC | 07:37 | |
| *** thorst has joined #openstack-keystone | 07:45 | |
| *** thorst has quit IRC | 07:50 | |
| *** josecastroleon has joined #openstack-keystone | 07:54 | |
| *** markvoelker has joined #openstack-keystone | 07:55 | |
| *** ducttape_ has joined #openstack-keystone | 07:56 | |
| *** aloga has quit IRC | 07:57 | |
| *** aloga has joined #openstack-keystone | 07:57 | |
| *** josecastroleon has quit IRC | 08:00 | |
| *** josecastroleon has joined #openstack-keystone | 08:00 | |
| *** ducttape_ has quit IRC | 08:00 | |
| *** ioggstream has joined #openstack-keystone | 08:25 | |
| *** markvoelker has quit IRC | 08:28 | |
| *** zhurong has quit IRC | 08:41 | |
| *** edmondsw has joined #openstack-keystone | 08:48 | |
| *** edmondsw has quit IRC | 08:53 | |
| *** aloga_ has joined #openstack-keystone | 09:04 | |
| *** aloga_ has quit IRC | 09:05 | |
| *** aloga_ has joined #openstack-keystone | 09:06 | |
| *** bhagyashris has joined #openstack-keystone | 09:07 | |
| *** markvoelker has joined #openstack-keystone | 09:25 | |
| *** zsli_ has quit IRC | 09:31 | |
| *** nicolasbock has joined #openstack-keystone | 09:35 | |
| *** zhurong has joined #openstack-keystone | 09:37 | |
| *** thorst has joined #openstack-keystone | 09:46 | |
| *** aloga_ has quit IRC | 09:49 | |
| *** ducttape_ has joined #openstack-keystone | 09:57 | |
| kairat | lbragstad, may i ask you about fernet rotation? | 09:58 |
|---|---|---|
| *** thorst has quit IRC | 09:58 | |
| *** markvoelker has quit IRC | 09:59 | |
| kairat | but i am suprised how that could not have been detected before, so maybe i miss something | 10:00 |
| *** ducttape_ has quit IRC | 10:01 | |
| kairat | do we have fernet experienced dev here? | 10:13 |
| *** namnh has quit IRC | 10:17 | |
| cmurphy | kairat: best to ask your question and then wait, it's hard to volunteer to help when we don't know the context | 10:29 |
| cmurphy | kairat: also most of the people who know fernet are in americas timezones so you might have to wait a bit | 10:29 |
| kairat | cmurphy, ok, got it | 10:29 |
| kairat | thanks! | 10:29 |
| kairat | so i have stable/ocata and i have got file not found error when rotated fernet tokens | 10:30 |
| kairat | http://paste.openstack.org/show/616990/ | 10:31 |
| kairat | i noticed keystone must create new fernet token with name 0.tmp | 10:31 |
| kairat | https://github.com/openstack/keystone/blob/master/keystone/common/fernet_utils.py#L133 | 10:33 |
| kairat | and i noticed keystone is trying to find key 0 when doint rotate https://github.com/openstack/keystone/blob/master/keystone/common/fernet_utils.py#L237 | 10:35 |
| kairat | i suspect there might be the bug | 10:35 |
| kairat | the thing confuses me is that my env worked several weeks without any troubles | 10:36 |
| kairat | with expiration =3600 | 10:36 |
| *** edmondsw has joined #openstack-keystone | 10:36 | |
| *** jaosorior has quit IRC | 10:39 | |
| *** zhurong has quit IRC | 10:40 | |
| *** edmondsw has quit IRC | 10:41 | |
| cmurphy | kairat: did you delete key 0? the staged key is always named 0 | 10:46 |
| cmurphy | kairat: you can recreate it with `keystone-manage fernet_setup` | 10:46 |
| kairat | cmurphy, i suspect 0 key was deleted during rotation | 10:47 |
| kairat | if i understand the code correctly first rotation should be successfull | 10:48 |
| cmurphy | kairat: it will get promoted to the new primary key and then another staged key named 0 is created https://github.com/openstack/keystone/blob/master/keystone/common/fernet_utils.py#L248 | 10:49 |
| kairat | because 0 file exist in fernet key folder | 10:49 |
| *** jaosorior has joined #openstack-keystone | 10:50 | |
| *** zhurong has joined #openstack-keystone | 10:52 | |
| kairat | cmurphy, ah, it seems I got this, thanks for clarification! | 10:53 |
| *** markvoelker has joined #openstack-keystone | 10:56 | |
| *** aojea has quit IRC | 11:05 | |
| *** jistr is now known as jistr|mtg | 11:12 | |
| *** raildo has joined #openstack-keystone | 11:12 | |
| *** thorst has joined #openstack-keystone | 11:13 | |
| *** lwanderley has joined #openstack-keystone | 11:23 | |
| *** markvoelker has quit IRC | 11:28 | |
| *** jistr|mtg is now known as jistr | 11:39 | |
| *** aloga_ has joined #openstack-keystone | 11:41 | |
| *** thorst has quit IRC | 11:43 | |
| *** lwanderley has quit IRC | 11:54 | |
| *** lwanderley has joined #openstack-keystone | 11:54 | |
| *** ducttape_ has joined #openstack-keystone | 11:58 | |
| *** ducttape_ has quit IRC | 12:02 | |
| *** ducttape_ has joined #openstack-keystone | 12:02 | |
| *** edmondsw has joined #openstack-keystone | 12:06 | |
| *** edmondsw has quit IRC | 12:13 | |
| *** phalmos has joined #openstack-keystone | 12:14 | |
| *** ducttape_ has quit IRC | 12:15 | |
| *** ducttape_ has joined #openstack-keystone | 12:15 | |
| *** cristicalin has joined #openstack-keystone | 12:16 | |
| bhagyashris | mordred: Hi, | 12:19 |
| *** lwanderley has quit IRC | 12:20 | |
| *** ducttape_ has quit IRC | 12:25 | |
| *** markvoelker has joined #openstack-keystone | 12:26 | |
| *** catintheroof has joined #openstack-keystone | 12:29 | |
| *** markvoelker has quit IRC | 12:30 | |
| *** markvoelker has joined #openstack-keystone | 12:30 | |
| *** lwanderley has joined #openstack-keystone | 12:32 | |
| *** lwanderley has quit IRC | 12:34 | |
| *** lwanderley has joined #openstack-keystone | 12:36 | |
| *** phalmos has quit IRC | 12:38 | |
| *** lwanderley has quit IRC | 12:47 | |
| *** ducttape_ has joined #openstack-keystone | 12:50 | |
| *** ducttape_ has quit IRC | 12:52 | |
| *** thorst has joined #openstack-keystone | 13:00 | |
| openstackgerrit | Pavlo Shchelokovskyy proposed openstack/keystoneauth master: Fix exception message in adapter loading https://review.openstack.org/489210 | 13:00 |
| *** zhurong has quit IRC | 13:00 | |
| *** lucasxu has joined #openstack-keystone | 13:02 | |
| *** edmondsw has joined #openstack-keystone | 13:13 | |
| *** rmascena has joined #openstack-keystone | 13:13 | |
| *** raildo has quit IRC | 13:16 | |
| *** ducttape_ has joined #openstack-keystone | 13:16 | |
| *** aloga_ has quit IRC | 13:18 | |
| *** edmondsw has quit IRC | 13:22 | |
| *** edmondsw has joined #openstack-keystone | 13:22 | |
| *** tobberyd_ has joined #openstack-keystone | 13:28 | |
| *** josecastroleon has quit IRC | 13:29 | |
| *** tobberydberg has quit IRC | 13:32 | |
| *** ducttape_ has quit IRC | 13:32 | |
| *** tobberyd_ has quit IRC | 13:32 | |
| *** Adri2000 has quit IRC | 13:35 | |
| *** josecastroleon has joined #openstack-keystone | 13:38 | |
| lbragstad | o/ | 13:42 |
| cmurphy | \o | 13:42 |
| *** Adri2000 has joined #openstack-keystone | 13:44 | |
| *** kbaegis has joined #openstack-keystone | 13:50 | |
| kbaegis | Hey guys. How do I export a keystone v3 token for later use in curl commands? | 13:51 |
| kbaegis | using it specifically for heat::softwaredeploy | 13:51 |
| lbragstad | kbaegis: in v3 - the token is in the header | 13:51 |
| kbaegis | lbragstad: Is there an example? I keep finding examples for v2 | 13:52 |
| lbragstad | if you're using curl - make sure you tell it to print out the headers of the response | 13:52 |
| lbragstad | curl -si | 13:52 |
| lbragstad | actually - curl -i | 13:52 |
| lbragstad | should print out the headers for you | 13:52 |
| kbaegis | lbragstad: What I really need is to request a token, output it to file or environment, and then make a call against heat | 13:54 |
| lbragstad | oh - i thought you were only asking about how to get the token out of the headers | 13:54 |
| kbaegis | All of heats example files are outdated using v2 for keystone | 13:54 |
| kbaegis | (and clearly not maintained) | 13:55 |
| lbragstad | you can start by using the v3 endpoint (v3/auth/tokens) | 13:55 |
| lbragstad | to authenticate and validate tokens | 13:55 |
| lbragstad | i'll grab an example request | 13:55 |
| lbragstad | https://developer.openstack.org/api-ref/identity/v3/index.html#authentication-and-token-management | 13:55 |
| kbaegis | tyvm | 13:55 |
| lbragstad | that link has a few different examples of how to get a token (via username/password or another token) | 13:56 |
| kbaegis | Yeah, I wish heat had a good tool for doing notifications, but if they exist then they're not documented | 13:56 |
| kbaegis | I just need to do a curl to a url to let it know that swdeploy is done | 13:56 |
| *** cristicalin has quit IRC | 13:57 | |
| *** ducttape_ has joined #openstack-keystone | 13:58 | |
| *** ducttap__ has joined #openstack-keystone | 14:02 | |
| *** ducttape_ has quit IRC | 14:06 | |
| kbaegis | lbragstad: So I've got the json portion of the request typed up with username, password, etc. Is there a convenient way to pass this to curl? | 14:09 |
| lbragstad | kbaegis: use -d | 14:10 |
| lbragstad | kbaegis: let me grab you another example | 14:10 |
| lbragstad | kbaegis: https://docs.openstack.org/keystone/latest/api_curl_examples.html#v3-api-examples-using-curl | 14:11 |
| lbragstad | you can also put the request body in a .json file | 14:11 |
| lbragstad | and reference is using `-d @authenticate-request-body.json` | 14:11 |
| lbragstad | which cuts down on having to write json across multiple lines | 14:12 |
| lbragstad | in a single command | 14:12 |
| kbaegis | nice. That's working | 14:15 |
| samueldmq | morning keystone | 14:17 |
| gagehugo | samueldmq o/ | 14:21 |
| kbaegis | What's the v3 equivalent of {access{token{id}}}? | 14:25 |
| kbaegis | The heat script here is horribly outdated. This is what I'm trying to use though: https://github.com/openstack/heat-templates/blob/master/hot/software-config/example-templates/cirros-example/init.d/heat-deploy-hook#L8 | 14:27 |
| *** openstackgerrit has quit IRC | 14:33 | |
| lbragstad | kbaegis: the token will be in the X-Subject-Token header of the response | 14:37 |
| kbaegis | lbragstad: I'm looking at the token. I can't parse the appropriate ID field though | 14:38 |
| kbaegis | I don't know what it is | 14:38 |
| kbaegis | lbragstad: Or- wait, is the giant json blob with the roles, project ids, etc not the token? | 14:39 |
| kbaegis | <— not using fernet *hangs head in shame* | 14:39 |
| lbragstad | kb | 14:40 |
| lbragstad | kbaegis: when you authenticate to keystone - you're going to get back a token authentcation response | 14:40 |
| lbragstad | which contains stuff about the deployment (like the service catalog), the project you've scoped to, the roles you have on the project, information about your user, etc.. | 14:41 |
| lbragstad | all of that stuff is in the response body | 14:41 |
| lbragstad | which is probably what you're looking at | 14:41 |
| lbragstad | in v2.0 - the token ID was also relaying in the response body | 14:41 |
| lbragstad | in v3 - the token ID was moved to the headers of the request and the response to improve security | 14:42 |
| lbragstad | so - when you authenticate for a v3 token - you're going to get all the information in the response body - but for the token ID itself, you need to look in the X-Subject-Token header | 14:43 |
| lbragstad | which is where the `curl -i` part comes in because that tells curl to print the headers of the response | 14:43 |
| kbaegis | Oh! | 14:44 |
| kbaegis | I need the X-Subject-Token: | 14:44 |
| kbaegis | got it. tyvm | 14:44 |
| lbragstad | if you're using a library, like python requests, you can check the headers directly like you would a dictionary | 14:44 |
| *** aojea has joined #openstack-keystone | 14:44 | |
| lbragstad | token = response.headers.get('X-Subject-Token') | 14:44 |
| *** ducttape_ has joined #openstack-keystone | 14:44 | |
| lbragstad | if `response` is a response object from the request library | 14:45 |
| *** ducttap__ has quit IRC | 14:48 | |
| *** ducttap__ has joined #openstack-keystone | 14:49 | |
| *** ducttape_ has quit IRC | 14:53 | |
| *** zeus has joined #openstack-keystone | 14:53 | |
| *** zeus is now known as Guest75507 | 14:54 | |
| *** Guest75507 is now known as zeus` | 14:55 | |
| *** zeus` is now known as zeus | 14:57 | |
| *** zeus has quit IRC | 14:57 | |
| *** zeus has joined #openstack-keystone | 14:57 | |
| *** josecastroleon has quit IRC | 15:00 | |
| *** rcernin has quit IRC | 15:03 | |
| *** pcaruana has quit IRC | 15:04 | |
| *** _d34dh0r53_ has quit IRC | 15:14 | |
| *** eglute has quit IRC | 15:14 | |
| *** cloudnull has quit IRC | 15:14 | |
| *** cloudnull has joined #openstack-keystone | 15:15 | |
| *** d34dh0r53 has joined #openstack-keystone | 15:16 | |
| *** eglute has joined #openstack-keystone | 15:16 | |
| *** otleimat has joined #openstack-keystone | 15:25 | |
| *** lucasxu has quit IRC | 15:26 | |
| *** aselius has joined #openstack-keystone | 15:30 | |
| *** jmlowe has quit IRC | 15:37 | |
| *** ducttape_ has joined #openstack-keystone | 15:50 | |
| *** ducttap__ has quit IRC | 15:54 | |
| *** gyee has joined #openstack-keystone | 15:54 | |
| *** ducttap__ has joined #openstack-keystone | 16:01 | |
| kbaegis | lbragstad: How do I reference the token in another curl? | 16:04 |
| *** ducttape_ has quit IRC | 16:04 | |
| kbaegis | nevermind I think I know :) | 16:05 |
| lbragstad | kbaegis: if you're just using the command line - you can save it off into an env | 16:07 |
| lbragstad | and then reference it later | 16:07 |
| *** lucasxu has joined #openstack-keystone | 16:10 | |
| kbaegis | lbragstad: I have the output from my successful token request | 16:12 |
| kbaegis | But this is failing: https://hastebin.com/uzadejinis.scala | 16:13 |
| kbaegis | probably about 10 things wrong with it from the heat side. | 16:14 |
| kbaegis | What's happening with keystone though? | 16:14 |
| lbragstad | kbaegis: it could be that the token is expired (which you can check by validating the token directly against keystone use GET /v3/auth/tokens and passing the token as the X-Auth-Token and X-Subject-Token) | 16:15 |
| lbragstad | or it could be that the user doesn't have the required role to perform that operation you want to do it heat | 16:15 |
| *** gyee has quit IRC | 16:21 | |
| *** gyee_ has joined #openstack-keystone | 16:21 | |
| *** openstackgerrit has joined #openstack-keystone | 16:25 | |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.policy master: throw an exception when sphinxext cannot find the config file https://review.openstack.org/488547 | 16:25 |
| *** lwanderley has joined #openstack-keystone | 16:35 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove duplicate sample files https://review.openstack.org/488609 | 16:36 |
| *** edmondsw has quit IRC | 16:37 | |
| morgan | zzzzzz | 16:38 |
| *** mjax has joined #openstack-keystone | 16:43 | |
| *** efried_zzz is now known as efried | 16:44 | |
| lbragstad | yeah - it's quiet today | 16:44 |
| lbragstad | but - it's also monday | 16:44 |
| *** david-lyle has joined #openstack-keystone | 16:47 | |
| *** markvoelker has quit IRC | 16:52 | |
| *** markvoelker has joined #openstack-keystone | 16:53 | |
| *** esp has joined #openstack-keystone | 16:59 | |
| *** ducttap__ has quit IRC | 17:00 | |
| lbragstad | these two oslo.policy patches would be good to get merged - https://review.openstack.org/#/q/topic:fix-sphinxext-empty-defaults | 17:02 |
| lbragstad | they are required in order for us to render configuration docs | 17:02 |
| lbragstad | properly | 17:02 |
| *** ducttape_ has joined #openstack-keystone | 17:02 | |
| *** lwanderley has quit IRC | 17:05 | |
| *** kbaegis has quit IRC | 17:06 | |
| *** ducttape_ has quit IRC | 17:07 | |
| *** david-lyle has quit IRC | 17:11 | |
| *** david-lyle has joined #openstack-keystone | 17:13 | |
| *** ducttape_ has joined #openstack-keystone | 17:13 | |
| *** kbaegis has joined #openstack-keystone | 17:23 | |
| *** kbaegis has quit IRC | 17:24 | |
| *** kbaegis has joined #openstack-keystone | 17:26 | |
| knikolla | o. | 17:26 |
| knikolla | o/ | 17:26 |
| knikolla | monday is hard-to-get-off-bed-day | 17:26 |
| gagehugo | knikolla ++ | 17:33 |
| *** jmlowe has joined #openstack-keystone | 17:34 | |
| *** jmlowe has quit IRC | 17:39 | |
| *** jmlowe has joined #openstack-keystone | 17:39 | |
| efried | mordred yt? | 17:42 |
| samueldmq | lbragstad: for https://review.openstack.org/#/c/488546 | 17:43 |
| samueldmq | lbragstad: I assume it is not possible at all to the default rule to be None | 17:43 |
| *** kbaegis has quit IRC | 17:43 | |
| samueldmq | thus it is okay to do "if rule.check_str" | 17:44 |
| lbragstad | samueldmq: yeah - the issue we were hitting is that it was an empty string | 17:45 |
| lbragstad | and the oslo.policy show-policy directive attemps to wrap whatever the default rule is in literals | 17:45 |
| samueldmq | lbragstad: cool. approved both patches | 17:45 |
| lbragstad | so `` and `` | 17:45 |
| * samueldmq nods | 17:45 | |
| lbragstad | which ended up being ```` which the rst parser things is a underline or overline section | 17:45 |
| samueldmq | lbragstad: we've released Pike last Friday, correct? | 17:58 |
| lbragstad | yes - pike-3 | 17:58 |
| *** kbaegis has joined #openstack-keystone | 18:01 | |
| samueldmq | lbragstad: https://review.openstack.org/#/q/status:open+(project:openstack/python-keystoneclient+OR+project:openstack/keystoneauth+OR+project:openstack/keystonemiddleware)+branch:stable/pike | 18:02 |
| samueldmq | lbragstad: not sure what happened to ksc which got a -1 | 18:03 |
| samueldmq | I was investigating to see if the stable/pike hadn't been created for that project, but it does https://github.com/openstack/python-keystoneclient/tree/stable/pike | 18:04 |
| lbragstad | http://logs.openstack.org/81/488781/1/check/gate-keystoneclient-dsvm-functional-ubuntu-xenial/1c40558/console.html.gz#_2017-07-28_21_41_10_106125 | 18:05 |
| lbragstad | yeah - we released that already | 18:05 |
| lbragstad | https://review.openstack.org/#/c/488413/ | 18:05 |
| *** kbaegis has quit IRC | 18:06 | |
| *** kbaegis has joined #openstack-keystone | 18:07 | |
| samueldmq | lbragstad: yeah, that is weird, like it was trying to fetch the URL with the branch specified and got an unexpected http response | 18:10 |
| samueldmq | I left a recheck to see what happens | 18:10 |
| *** harlowja has joined #openstack-keystone | 18:11 | |
| morgan | efried: i am going to guess that is a resounding "no" (probably a sleep-deprived/not-in-our-timezone one at that) | 18:12 |
| efried | morgan Yuh. Trying to figure out how the service catalog gets populated. | 18:13 |
| morgan | in shade | 18:13 |
| morgan | or in keystone | 18:13 |
| morgan | or in ksa? | 18:13 |
| efried | ksa. | 18:14 |
| efried | morgan More specifically: In nova, I'm trying to get the glance endpoint from the service catalog rather than the [glance]api_servers conf var. | 18:14 |
| efried | rather, trying to get the glance endpoint via Adapter.get_endpoint_data, which I gather ought to be going to the service catalog, or to some discovery URL. | 18:16 |
| morgan | ahhh | 18:18 |
| morgan | hmmm. | 18:19 |
| morgan | it should, i think | 18:19 |
| morgan | i'd need to look at how nova does that | 18:19 |
| morgan | and what you're doing. | 18:19 |
| morgan | so, we can match it up | 18:19 |
| morgan | but... in theory, you're right. | 18:20 |
| morgan | it should be .get_endpoint_data iirc | 18:20 |
| efried | morgan Well, I'm writing the nova code right now (https://review.openstack.org/488137). Heretofore, [glance]api_servers was required. | 18:24 |
| efried | So yeah, not sure if nova is actually populating the service catalog, or if there's a discovery URL available for glance - cause I don't know how that would happen normally. | 18:25 |
| openstackgerrit | prashkre proposed openstack/keystone master: Filter users and groups in ldap https://review.openstack.org/485302 | 18:26 |
| morgan | api_servers.append(utils.get_endpoint_data('glance').url) | 18:28 |
| morgan | shouldn't that be "image" | 18:28 |
| morgan | not "glance" | 18:28 |
| morgan | ? | 18:28 |
| morgan | efried: ^ | 18:28 |
| morgan | since iirc service_type != name. | 18:29 |
| morgan | e.g. nova would be compute | 18:29 |
| morgan | efried: i can dig a bit further when i'm not on the phone. | 18:30 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: WIP add version data to the controllers https://review.openstack.org/489297 | 18:35 |
| lbragstad | gagehugo: ^ more tinkering with the version header stuff | 18:36 |
| lbragstad | gagehugo: that's a little more evolved than the first time i took a stab at it | 18:36 |
| lbragstad | instead - we should try and tack the version information on to the controllers instead of having to run into possible circular import issues | 18:37 |
| *** aojea has quit IRC | 18:42 | |
| *** aojea has joined #openstack-keystone | 18:42 | |
| *** aojea has quit IRC | 18:47 | |
| efried | morgan Yeah, sdague had a similar comment. But nova.utils.get_endpoint_data != keystoneauth1.adapter.Adapter.get_endpoint_data. The former accepts a conf group name and looks up the service type based on that. | 18:53 |
| *** ioggstream has quit IRC | 18:54 | |
| efried | And the reason it's important that it be a conf group name is because that conf group is how we set up the Adapter (via ksa loading - load_adapter_from_conf_options). | 18:54 |
| efried | And it's only if that conf group doesn't specify service_type (or endpoint_override) that we try to figure out a reasonable value for the service type. We do that by assuming the conf group name corresponds to a project name, and looking up that project in service-types-authority (via os-service-types). | 18:55 |
| *** prashkre has joined #openstack-keystone | 18:56 | |
| *** catintheroof has quit IRC | 18:59 | |
| *** catintheroof has joined #openstack-keystone | 19:00 | |
| *** catintheroof has quit IRC | 19:00 | |
| *** catintheroof has joined #openstack-keystone | 19:01 | |
| gagehugo | lbragstad cool! I'll ping rarora | 19:02 |
| openstackgerrit | Merged openstack/keystonemiddleware master: Update reno for stable/pike https://review.openstack.org/488644 | 19:08 |
| morgan | efried: that sounds... awful | 19:09 |
| openstackgerrit | Merged openstack/python-keystoneclient master: Update reno for stable/pike https://review.openstack.org/488782 | 19:10 |
| openstackgerrit | Merged openstack/oslo.policy master: fix formatting for empty defaults https://review.openstack.org/488546 | 19:10 |
| openstackgerrit | Merged openstack/oslo.policy master: throw an exception when sphinxext cannot find the config file https://review.openstack.org/488547 | 19:11 |
| openstackgerrit | Merged openstack/keystone master: A simple fix about explicit unscoped string https://review.openstack.org/471557 | 19:11 |
| efried | morgan I'm open to suggestions if you can think of a better way. | 19:17 |
| efried | mordred signed off on the concept | 19:17 |
| efried | Other consumers are going to be doing similar things. Most of them will know the service type for sure, but that's really the small part of this. | 19:18 |
| morgan | efried: i would honestly double-down on the service type, if you need to map the service-type to the "project" name (for conf reading purposes) that would be something i'd do behind the scenes in the utils code | 19:23 |
| morgan | but thats just me | 19:23 |
| efried | morgan service-types-authority already provides that capability. | 19:23 |
| morgan | instead of the other way. | 19:23 |
| morgan | you're asking for "Glance" now | 19:23 |
| morgan | i'd ask for "image" | 19:23 |
| efried | morgan You're saying I should accept 'image' and map it to 'glance' to find the conf group?? | 19:23 |
| morgan | yes. | 19:23 |
| morgan | that is what I would do | 19:24 |
| openstackgerrit | Merged openstack/keystoneauth master: Update reno for stable/pike https://review.openstack.org/488641 | 19:24 |
| morgan | but i don' | 19:24 |
| morgan | t know how doable that is | 19:24 |
| morgan | i don't like encoding "project" name anywhere that isn't historical at this point | 19:24 |
| morgan | i'd really lean on service types in all code that can support it | 19:24 |
| morgan | it means that you're not guessing that image service is always "glance" in the catalog, image (might be glare and 100% glance compatible), which means it might fall through in your lookup to map glance -> something useful | 19:25 |
| efried | morgan Doable for glance, because there's only one service type. | 19:25 |
| *** ducttap__ has joined #openstack-keystone | 19:25 | |
| morgan | ** glare isn't glance compat atm | 19:25 |
| morgan | but i was using it as an example | 19:25 |
| efried | Mm, I get it. | 19:25 |
| morgan | the concept of what you're doing is right. | 19:25 |
| morgan | i think it should be inverted and always lean on stype vs pname | 19:26 |
| efried | morgan Thanks for the suggestion. Got to consider how it would work for e.g. cinder where there's multiple stype aliases. | 19:26 |
| morgan | i would probably just do a "look for preferred, then non-preferred" | 19:27 |
| morgan | cinder is an example of "special handling" for the most part | 19:27 |
| efried | morgan However, the question at hand is still: How does nova populate the service catalog and/or where does the version-data URL come from? | 19:27 |
| morgan | most everyone else is not doing the multiple stype case | 19:28 |
| morgan | version-data is a round-trip to the endpoint itself | 19:28 |
| morgan | or apriori knowledge (unlikely in most cases) | 19:28 |
| *** ducttape_ has quit IRC | 19:28 | |
| morgan | you can only get "where is image service" from the catalog (for the most part) | 19:29 |
| morgan | you can't get "where is glance api v 1234 | 19:29 |
| efried | morgan That makes sense. In a devstack situation, is it e.g. glance itself that sets up its endpoint in the service catalog? | 19:30 |
| morgan | no. devstack scripts do | 19:30 |
| morgan | glance just runs. | 19:30 |
| morgan | it is not a lot different than an operator defining a new endpoint in a real cloud(tm) | 19:30 |
| *** edmondsw has joined #openstack-keystone | 19:30 | |
| efried | morgan Okay, that must be what I'm missing then. Need to find where devstack is doing that. | 19:30 |
| efried | atm, I'm trying to put up some DNM patches that will validate this setup works end to end when [glance]api_servers is omitted from nova.conf. I would have expected devstack is setting up the glance endpoint in the service catalog, but maybe it's really not. | 19:31 |
| *** edmondsw has quit IRC | 19:32 | |
| *** rarora has joined #openstack-keystone | 19:32 | |
| *** edmondsw has joined #openstack-keystone | 19:32 | |
| *** nicolasbock has quit IRC | 19:33 | |
| morgan | devstack is setting the endpoint up in the SC | 19:36 |
| morgan | but glance itself is not | 19:36 |
| openstackgerrit | Merged openstack/keystone master: Add the step to install apache2 libapache2-mod-wsgi https://review.openstack.org/488386 | 19:37 |
| openstackgerrit | Merged openstack/keystone master: Fix the documentation sample for OS-EP-FILTER https://review.openstack.org/487676 | 19:37 |
| openstackgerrit | prashkre proposed openstack/keystone master: Filter users and groups in ldap https://review.openstack.org/485302 | 19:49 |
| *** spilla_ has joined #openstack-keystone | 19:55 | |
| *** ducttape_ has joined #openstack-keystone | 19:57 | |
| *** spilla_ has quit IRC | 20:00 | |
| *** ducttap__ has quit IRC | 20:00 | |
| *** aojea has joined #openstack-keystone | 20:07 | |
| prashkre | samueldmq: Hi. could you please review https://review.openstack.org/#/c/485302/ when you get sometime today. | 20:10 |
| *** jmlowe has quit IRC | 20:16 | |
| openstackgerrit | Matthew Edmonds proposed openstack/keystonemiddleware master: strip whitespace from token https://review.openstack.org/482971 | 20:16 |
| morgan | lbragstad: ping. | 20:17 |
| lbragstad | morgan: pong | 20:17 |
| morgan | lbragstad: looking into something and need a sanity check | 20:17 |
| lbragstad | morgan: sure | 20:17 |
| morgan | if you create an EP in the catalog (v2) with no region... | 20:17 |
| morgan | what does the catalog look like? | 20:17 |
| *** prashkre has quit IRC | 20:17 | |
| lbragstad | that's a good question | 20:17 |
| lbragstad | apparently region isn't required for v2 endpoints | 20:20 |
| morgan | right | 20:20 |
| morgan | but... i am not seeing how the catalog is rendered in this case | 20:20 |
| morgan | is it catalog[None] = [ep, ep, ep, ep] ? | 20:21 |
| morgan | erm, catalog[None] = {epid: ep, epid: ep ...} | 20:21 |
| lbragstad | region isn't required for v3 either - so would that behavior exist with the sql backend, too? | 20:21 |
| lbragstad | how come the endpoints are encapsulated in a service? | 20:21 |
| morgan | yeah. that is what i'm trying to determine... | 20:21 |
| morgan | this is ... so terrible | 20:22 |
| *** thorst is now known as thorst_afk | 20:25 | |
| *** gyee_ has quit IRC | 20:26 | |
| *** gyee has joined #openstack-keystone | 20:29 | |
| *** gyee has quit IRC | 20:29 | |
| *** gyee has joined #openstack-keystone | 20:30 | |
| efried | morgan Butbutbut... then what do I do with service_type if it's supplied in the conf? | 20:42 |
| *** gyee has quit IRC | 20:53 | |
| *** otleimat has quit IRC | 20:57 | |
| *** lucasxu has quit IRC | 21:02 | |
| *** gyee has joined #openstack-keystone | 21:10 | |
| *** catintheroof has quit IRC | 21:17 | |
| morgan | lbragstad: it looks like region is None in the v2 catalog then? | 21:20 |
| lbragstad | morgan: looks like it isn't required but shouldn't the endpoint still be associated to a service? | 21:20 |
| morgan | right. | 21:21 |
| morgan | i think that is required | 21:21 |
| morgan | so it looks like https://github.com/openstack/keystone/blob/master/keystone/catalog/backends/sql.py#L322 | 21:22 |
| morgan | it would be catalog[None][<s_type>] => [interface, interface, interface] | 21:23 |
| morgan | ? | 21:23 |
| morgan | that looks ... broken | 21:23 |
| *** ducttap__ has joined #openstack-keystone | 21:35 | |
| *** ducttape_ has quit IRC | 21:38 | |
| *** phalmos has joined #openstack-keystone | 21:43 | |
| *** otleimat has joined #openstack-keystone | 21:46 | |
| openstackgerrit | Eric Fried proposed openstack/keystoneauth master: Add EndpointData.__str__ for debugging https://review.openstack.org/489413 | 21:54 |
| *** ducttape_ has joined #openstack-keystone | 22:00 | |
| *** ducttap__ has quit IRC | 22:03 | |
| *** ducttap__ has joined #openstack-keystone | 22:15 | |
| *** aojea has quit IRC | 22:18 | |
| *** ducttape_ has quit IRC | 22:18 | |
| *** aojea has joined #openstack-keystone | 22:19 | |
| *** aojea has quit IRC | 22:24 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add yaml-loaded filesystem catalog backend https://review.openstack.org/483514 | 22:26 |
| morgan | lbragstad: ^ some corrections. | 22:27 |
| morgan | lbragstad: needs testing still | 22:27 |
| *** phalmos has quit IRC | 22:31 | |
| *** phalmos has joined #openstack-keystone | 22:32 | |
| *** ducttape_ has joined #openstack-keystone | 22:32 | |
| *** ducttap__ has quit IRC | 22:35 | |
| *** thorst_afk has quit IRC | 22:38 | |
| *** jessegler has joined #openstack-keystone | 22:46 | |
| *** kbaegis has quit IRC | 22:48 | |
| *** kbaegis has joined #openstack-keystone | 22:49 | |
| *** edmondsw has quit IRC | 22:52 | |
| *** esp has quit IRC | 23:03 | |
| *** esp has joined #openstack-keystone | 23:06 | |
| *** gyee has quit IRC | 23:17 | |
| *** https_GK1wmSU has joined #openstack-keystone | 23:20 | |
| *** aojea has joined #openstack-keystone | 23:20 | |
| *** https_GK1wmSU has left #openstack-keystone | 23:22 | |
| *** catintheroof has joined #openstack-keystone | 23:24 | |
| *** aojea has quit IRC | 23:27 | |
| *** esp has quit IRC | 23:27 | |
| *** ducttape_ has quit IRC | 23:27 | |
| *** ducttape_ has joined #openstack-keystone | 23:32 | |
| *** ducttap__ has joined #openstack-keystone | 23:35 | |
| *** ducttape_ has quit IRC | 23:37 | |
| *** ducttap__ has quit IRC | 23:37 | |
| *** jessegler has quit IRC | 23:38 | |
| *** catintheroof has quit IRC | 23:43 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!