| samueldmq | lbragstad: approved https://review.openstack.org/#/c/491916 | 00:03 |
|---|---|---|
| samueldmq | lbragstad: anything we need to land today? | 00:03 |
| samueldmq | anything else* | 00:03 |
| *** itlinux has quit IRC | 00:06 | |
| *** dstepanenko has joined #openstack-keystone | 00:06 | |
| *** _apple_tree has quit IRC | 00:08 | |
| *** thorst has quit IRC | 00:09 | |
| *** thorst has joined #openstack-keystone | 00:10 | |
| *** ducttape_ has quit IRC | 00:10 | |
| *** thorst has quit IRC | 00:11 | |
| *** dstepanenko has quit IRC | 00:11 | |
| *** edmondsw has joined #openstack-keystone | 00:17 | |
| *** sbezverk has quit IRC | 00:21 | |
| *** edmondsw has quit IRC | 00:22 | |
| *** ducttape_ has joined #openstack-keystone | 00:25 | |
| *** aselius has quit IRC | 00:32 | |
| *** ducttape_ has quit IRC | 00:36 | |
| *** ducttape_ has joined #openstack-keystone | 00:37 | |
| lbragstad | samueldmq: no that should be good | 00:41 |
| lbragstad | samueldmq: i should be able to cut rc1 tomorrow | 00:41 |
| samueldmq | lbragstad: sweet | 00:41 |
| *** ducttape_ has quit IRC | 00:42 | |
| samueldmq | lbragstad: I had to go afk and was unable to proceed with that password update debug | 00:42 |
| samueldmq | the current plans are to make a bunch of logs around places that return 401 on token issue | 00:42 |
| samueldmq | and try to reproduce it again, and analyze the logs | 00:42 |
| otleimat | lbragstad: I ran pep8 on my machine locally and it passed but failed when I checked it in to Gerrit. I'll make sure to inspect/fix that tomorrow morning, sorry about that :/ | 00:48 |
| *** zhurong has joined #openstack-keystone | 00:51 | |
| *** markvoelker has joined #openstack-keystone | 01:03 | |
| *** itlinux has joined #openstack-keystone | 01:04 | |
| *** Shunli has joined #openstack-keystone | 01:04 | |
| *** thorst has joined #openstack-keystone | 01:11 | |
| *** gyee has quit IRC | 01:14 | |
| *** gyee has joined #openstack-keystone | 01:14 | |
| *** thorst has quit IRC | 01:17 | |
| *** mjax has joined #openstack-keystone | 01:25 | |
| *** mjax has quit IRC | 01:26 | |
| *** mjax has joined #openstack-keystone | 01:29 | |
| *** mjax has quit IRC | 01:31 | |
| *** PsionTheory has quit IRC | 01:35 | |
| *** mjax has joined #openstack-keystone | 01:48 | |
| *** mjax has quit IRC | 01:49 | |
| openstackgerrit | Merged openstack/keystone master: Unset project ids for all identity backends https://review.openstack.org/491916 | 01:52 |
| *** dstepanenko has joined #openstack-keystone | 01:54 | |
| *** dstepanenko has quit IRC | 01:59 | |
| *** edmondsw has joined #openstack-keystone | 02:06 | |
| *** edmondsw has quit IRC | 02:10 | |
| *** ppiela_ has joined #openstack-keystone | 02:10 | |
| *** zsli_ has joined #openstack-keystone | 02:11 | |
| *** thorst has joined #openstack-keystone | 02:12 | |
| *** gongysh has joined #openstack-keystone | 02:17 | |
| *** thorst has quit IRC | 02:17 | |
| *** Shunli has quit IRC | 02:18 | |
| *** ppiela has quit IRC | 02:18 | |
| *** jistr has quit IRC | 02:18 | |
| *** clayton has quit IRC | 02:18 | |
| *** aloga has quit IRC | 02:18 | |
| *** clayton has joined #openstack-keystone | 02:19 | |
| *** openstackgerrit has quit IRC | 02:21 | |
| *** lifeless_ has joined #openstack-keystone | 02:21 | |
| *** jistr has joined #openstack-keystone | 02:23 | |
| *** lifeless has quit IRC | 02:28 | |
| *** ducttape_ has joined #openstack-keystone | 02:38 | |
| *** ducttape_ has quit IRC | 02:43 | |
| *** openstackgerrit has joined #openstack-keystone | 02:50 | |
| openstackgerrit | OpenStack Release Bot proposed openstack/keystone master: Update reno for stable/pike https://review.openstack.org/492774 | 02:50 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Remove deprecation of domain_config_upload https://review.openstack.org/492694 | 02:58 |
| *** spzala has joined #openstack-keystone | 02:59 | |
| *** dave-mccowan has quit IRC | 03:06 | |
| *** thorst has joined #openstack-keystone | 03:13 | |
| *** mjax has joined #openstack-keystone | 03:17 | |
| *** mjax has quit IRC | 03:18 | |
| *** nicolasbock has joined #openstack-keystone | 03:21 | |
| *** thorst has quit IRC | 03:21 | |
| *** sbezverk has joined #openstack-keystone | 03:24 | |
| *** namnh has joined #openstack-keystone | 03:33 | |
| *** gongysh has quit IRC | 03:34 | |
| itlinux | hello keystone guys.. | 03:40 |
| *** aojea has joined #openstack-keystone | 03:41 | |
| itlinux | I have a question when I do openstack user list --domain mydomain I can see the users.. but I get this when I try to login You are not authorized for any projects or domains. | 03:41 |
| itlinux | any tips! TY | 03:41 |
| *** dstepanenko has joined #openstack-keystone | 03:42 | |
| *** aojea has quit IRC | 03:46 | |
| *** dstepanenko has quit IRC | 03:47 | |
| *** edmondsw has joined #openstack-keystone | 03:54 | |
| *** mvk has joined #openstack-keystone | 03:57 | |
| *** SamYaple has quit IRC | 03:57 | |
| *** edmondsw has quit IRC | 03:58 | |
| *** prashkre_ has joined #openstack-keystone | 04:00 | |
| *** sbezverk has quit IRC | 04:07 | |
| *** SamYaple has joined #openstack-keystone | 04:11 | |
| *** thorst has joined #openstack-keystone | 04:17 | |
| *** thorst has quit IRC | 04:22 | |
| openstackgerrit | Arundhati Surpur proposed openstack/keystone-tempest-plugin master: Removed the older version of python and added 3.5 https://review.openstack.org/485191 | 04:32 |
| *** dstepanenko has joined #openstack-keystone | 04:37 | |
| *** dstepanenko has quit IRC | 04:41 | |
| *** prashkre_ has quit IRC | 04:46 | |
| *** gyee has quit IRC | 04:50 | |
| *** thorst has joined #openstack-keystone | 05:17 | |
| *** thorst has quit IRC | 05:22 | |
| *** ducttape_ has joined #openstack-keystone | 05:30 | |
| *** ducttape_ has quit IRC | 05:34 | |
| *** tobberydberg has joined #openstack-keystone | 05:38 | |
| *** edmondsw has joined #openstack-keystone | 05:42 | |
| *** gongysh has joined #openstack-keystone | 05:43 | |
| *** prashkre_ has joined #openstack-keystone | 05:44 | |
| *** edmondsw has quit IRC | 05:46 | |
| *** otleimat has quit IRC | 05:48 | |
| *** itlinux has quit IRC | 05:55 | |
| *** itlinux has joined #openstack-keystone | 05:57 | |
| *** tesseract has joined #openstack-keystone | 06:16 | |
| *** thorst has joined #openstack-keystone | 06:18 | |
| *** rcernin has joined #openstack-keystone | 06:22 | |
| *** thorst has quit IRC | 06:23 | |
| *** dstepanenko has joined #openstack-keystone | 06:25 | |
| *** itlinux has quit IRC | 06:28 | |
| *** dstepanenko has quit IRC | 06:30 | |
| *** ducttape_ has joined #openstack-keystone | 06:31 | |
| *** ducttape_ has quit IRC | 06:35 | |
| *** jaosorior has quit IRC | 07:03 | |
| *** jaosorior has joined #openstack-keystone | 07:15 | |
| *** ioggstream has joined #openstack-keystone | 07:17 | |
| *** aloga has joined #openstack-keystone | 07:19 | |
| *** thorst has joined #openstack-keystone | 07:19 | |
| *** thorst has quit IRC | 07:23 | |
| *** clenimar has joined #openstack-keystone | 07:35 | |
| *** aloga has quit IRC | 07:43 | |
| *** aloga has joined #openstack-keystone | 07:43 | |
| *** openstackgerrit has quit IRC | 08:02 | |
| *** openstackgerrit has joined #openstack-keystone | 08:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone master: Imported Translations from Zanata https://review.openstack.org/492844 | 08:03 |
| *** dstepanenko has joined #openstack-keystone | 08:13 | |
| *** mvk has quit IRC | 08:14 | |
| *** dstepanenko has quit IRC | 08:18 | |
| *** mvk has joined #openstack-keystone | 08:21 | |
| *** mvpnitesh has joined #openstack-keystone | 09:04 | |
| *** tobberyd_ has joined #openstack-keystone | 09:09 | |
| *** tobberydberg has quit IRC | 09:12 | |
| *** tobberyd_ has quit IRC | 09:15 | |
| *** markvoelker has quit IRC | 09:17 | |
| *** thorst has joined #openstack-keystone | 09:21 | |
| *** thorst has quit IRC | 09:25 | |
| *** zsli_ has quit IRC | 09:37 | |
| *** mvpnitesh has quit IRC | 09:47 | |
| *** dstepanenko has joined #openstack-keystone | 10:01 | |
| *** sapd has joined #openstack-keystone | 10:07 | |
| *** dstepanenko has quit IRC | 10:07 | |
| *** Drankis has joined #openstack-keystone | 10:16 | |
| *** Drankis has quit IRC | 10:16 | |
| *** Drankis has joined #openstack-keystone | 10:16 | |
| *** markvoelker has joined #openstack-keystone | 10:18 | |
| *** thorst has joined #openstack-keystone | 10:22 | |
| *** markvoelker has quit IRC | 10:23 | |
| *** thorst has quit IRC | 10:26 | |
| openstackgerrit | Merged openstack/keystoneauth master: Enable some off-by-default checks https://review.openstack.org/477775 | 10:26 |
| *** prashkre_ has quit IRC | 10:29 | |
| *** namnh has quit IRC | 10:36 | |
| *** ducttape_ has joined #openstack-keystone | 10:36 | |
| *** markvoelker has joined #openstack-keystone | 10:39 | |
| *** ducttape_ has quit IRC | 10:41 | |
| *** prashkre_ has joined #openstack-keystone | 10:42 | |
| *** markvoelker_ has joined #openstack-keystone | 10:44 | |
| *** markvoelker has quit IRC | 10:44 | |
| *** markvoelker_ has quit IRC | 10:44 | |
| *** markvoelker has joined #openstack-keystone | 10:45 | |
| *** mvpnitesh has joined #openstack-keystone | 10:52 | |
| *** zhurong has quit IRC | 11:00 | |
| *** edmondsw has joined #openstack-keystone | 11:10 | |
| *** sapd has quit IRC | 11:14 | |
| *** gongysh has quit IRC | 11:17 | |
| *** thorst has joined #openstack-keystone | 11:22 | |
| *** aloga has quit IRC | 11:24 | |
| *** thorst has quit IRC | 11:27 | |
| *** sapd has joined #openstack-keystone | 11:28 | |
| openstackgerrit | Aleksey Nakoryakov proposed openstack/python-keystoneclient master: Raise ClientError if url parameter is None. Added test for this. Closes-Bug: 1498693 https://review.openstack.org/492960 | 11:31 |
| openstack | bug 1498693 in python-keystoneclient "unfriendly error when keystone tries to parse a URL" [Medium,Triaged] https://launchpad.net/bugs/1498693 - Assigned to Aleksey Nakoryakov (alfnak) | 11:31 |
| *** aloga has joined #openstack-keystone | 11:34 | |
| *** ducttape_ has joined #openstack-keystone | 11:37 | |
| *** ducttape_ has quit IRC | 11:40 | |
| *** ducttape_ has joined #openstack-keystone | 11:40 | |
| *** ducttape_ has quit IRC | 11:42 | |
| *** sbezverk has joined #openstack-keystone | 11:42 | |
| *** ducttape_ has joined #openstack-keystone | 11:42 | |
| *** ducttape_ has quit IRC | 11:46 | |
| *** sapd has quit IRC | 11:48 | |
| *** dstepanenko has joined #openstack-keystone | 11:49 | |
| *** dikonoor has joined #openstack-keystone | 11:49 | |
| *** sbezverk has quit IRC | 11:50 | |
| *** dstepanenko has quit IRC | 11:54 | |
| *** raildo has joined #openstack-keystone | 11:59 | |
| *** sapd has joined #openstack-keystone | 12:01 | |
| openstackgerrit | Aleksey Nakoryakov proposed openstack/python-keystoneclient master: Raise ClientError if url parameter is None. https://review.openstack.org/492960 | 12:03 |
| *** mvpnitesh has quit IRC | 12:05 | |
| *** ioggstream has quit IRC | 12:07 | |
| *** thorst has joined #openstack-keystone | 12:08 | |
| *** markvoelker_ has joined #openstack-keystone | 12:10 | |
| *** markvoelker has quit IRC | 12:13 | |
| *** dikonoor has quit IRC | 12:15 | |
| *** dikonoor has joined #openstack-keystone | 12:16 | |
| *** clayton has quit IRC | 12:21 | |
| *** efried is now known as fried_rice | 12:23 | |
| *** clayton has joined #openstack-keystone | 12:24 | |
| *** dave-mccowan has joined #openstack-keystone | 12:24 | |
| knikolla | o/ | 12:27 |
| *** catintheroof has joined #openstack-keystone | 12:30 | |
| *** ducttape_ has joined #openstack-keystone | 12:43 | |
| *** dstepanenko has joined #openstack-keystone | 12:44 | |
| *** ayoung has quit IRC | 12:46 | |
| *** ducttape_ has quit IRC | 12:47 | |
| *** ioggstream has joined #openstack-keystone | 12:47 | |
| *** dstepanenko has quit IRC | 12:48 | |
| *** ayoung has joined #openstack-keystone | 12:50 | |
| *** ducttape_ has joined #openstack-keystone | 12:50 | |
| *** ioggstream has quit IRC | 12:52 | |
| *** ducttape_ has quit IRC | 12:54 | |
| *** prashkre_ has quit IRC | 12:55 | |
| *** ioggstream has joined #openstack-keystone | 12:57 | |
| *** dstepanenko has joined #openstack-keystone | 13:07 | |
| *** iogg has joined #openstack-keystone | 13:08 | |
| *** ioggstream has quit IRC | 13:08 | |
| *** sbezverk has joined #openstack-keystone | 13:09 | |
| *** dikonoo has joined #openstack-keystone | 13:11 | |
| *** josecastroleon has joined #openstack-keystone | 13:15 | |
| *** dikonoor has quit IRC | 13:15 | |
| lbragstad | o/ | 13:31 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update release notes for pike https://review.openstack.org/493018 | 13:35 |
| lbragstad | i didn't think about this yesterday, but ^ should have gone in before we cut RC1 | 13:36 |
| lbragstad | when that merges we'll do an rc2 | 13:36 |
| *** otleimat has joined #openstack-keystone | 13:46 | |
| *** jmlowe_ has joined #openstack-keystone | 13:47 | |
| samueldmq | lbragstad: approved that, no need to hold it then | 13:48 |
| *** jmlowe has quit IRC | 13:49 | |
| lbragstad | samueldmq: there is a list of doc patches we need to land, too | 13:51 |
| lbragstad | knikolla: is https://review.openstack.org/#/c/448773/ a patch we want to land for pike/ | 13:52 |
| *** markvoelker_ has quit IRC | 13:52 | |
| samueldmq | lbragstad: cool, is that list up somewhere? same topic? | 13:52 |
| lbragstad | samueldmq: http://logs.openstack.org/67/492767/2/check/gate-releases-tox-list-changes-ubuntu-xenial/0d2ac66/console.html#_2017-08-11_02_13_59_846806 | 13:53 |
| lbragstad | dims: pointed me to that just a bit ago | 13:53 |
| lbragstad | ^ | 13:53 |
| lbragstad | it compiles a list of all open patches that have changes to docs or release notes | 13:53 |
| samueldmq | oO | 13:54 |
| lbragstad | which is handy, i didn't know about that | 13:54 |
| samueldmq | yes it really is | 13:54 |
| *** lucasxu has joined #openstack-keystone | 13:54 | |
| samueldmq | thanks dims | 13:54 |
| lbragstad | so - if there is anything in that list that needs to be in pike documentation, then we need to merge it soon | 13:54 |
| lbragstad | some aren't relevant, but a couple are | 13:55 |
| lbragstad | https://review.openstack.org/#/c/479998/ | 13:55 |
| lbragstad | https://review.openstack.org/#/c/490649/ | 13:55 |
| lbragstad | https://review.openstack.org/#/c/486608/ | 13:55 |
| samueldmq | lbragstad: nice, will look | 13:56 |
| samueldmq | btw for that user update error I have a new approach, I am adding logs to here https://github.com/openstack/keystone/blob/master/keystone/common/wsgi.py#L229-L236 | 13:57 |
| lbragstad | samueldmq: https://etherpad.openstack.org/p/keystone-pike-rc2-patches | 13:57 |
| samueldmq | I will log the stacktrace and find the root of the unauthorized | 13:57 |
| samueldmq | lbragstad: cool, rc2 to be out today as well, correct? | 13:57 |
| lbragstad | samueldmq: yes - we can cut rc2 whenever | 14:03 |
| lbragstad | samueldmq: but we have to release another candidate by th 25th | 14:03 |
| lbragstad | the 25th* | 14:03 |
| lbragstad | https://releases.openstack.org/pike/schedule.html | 14:03 |
| lbragstad | ideally - the sooner we get an rc2 out, the better | 14:03 |
| samueldmq | lbragstad: nice. we can get that update passwd issue fixed by then | 14:04 |
| lbragstad | and that should give us more time in the event a reason for rc3 pops up | 14:04 |
| *** mvk_ has joined #openstack-keystone | 14:06 | |
| dims | samueldmq : lbragstad : the kudos and foresight go to dhellmann :) | 14:06 |
| *** mvk has quit IRC | 14:08 | |
| *** prashkre_ has joined #openstack-keystone | 14:10 | |
| lbragstad | samueldmq: looks like we're only waiting on 3 patches then | 14:12 |
| lbragstad | https://review.openstack.org/486608 | 14:12 |
| lbragstad | https://review.openstack.org/490649 | 14:12 |
| lbragstad | https://review.openstack.org/479998 | 14:13 |
| samueldmq | lbragstad: yes, they're all gating right now | 14:13 |
| cmurphy | \o/ | 14:13 |
| lbragstad | sweet | 14:13 |
| lbragstad | i'll babysit those and propose rc2 as soon as they merge | 14:14 |
| samueldmq | lbragstad: nice. I looked at each of the patches in https://etherpad.openstack.org/p/keystone-pike-rc2-patches | 14:16 |
| samueldmq | and I agree with your comments | 14:16 |
| samueldmq | cmurphy: o/ | 14:17 |
| lbragstad | samueldmq: good deal - thanks for double checking | 14:17 |
| cmurphy | samueldmq: \o | 14:17 |
| lbragstad | cmurphy: its about quitin' time where you're at | 14:17 |
| cmurphy | lbragstad: nah most of my team works on the west coast now so i have to stick around a few more hours | 14:18 |
| lbragstad | aha | 14:19 |
| *** mdavidson has quit IRC | 14:26 | |
| *** Drankis has quit IRC | 14:30 | |
| lbragstad | samueldmq: when you recreated that issue with devstack - were you just running the identity tests? | 14:30 |
| *** itlinux has joined #openstack-keystone | 14:34 | |
| lbragstad | whew - running devstack locally is making my laptop scream | 14:35 |
| *** mdavidson has joined #openstack-keystone | 14:35 | |
| *** SamYaple has quit IRC | 14:35 | |
| *** SamYaple has joined #openstack-keystone | 14:35 | |
| cmurphy | the x1 loves devstack :) | 14:36 |
| lbragstad | not bad... http://paste.openstack.org/show/618191/ | 14:41 |
| lbragstad | i'll take it | 14:41 |
| samueldmq | lbragstad: I am running just that very specific test | 14:43 |
| samueldmq | I can share the command in a bit (rebuilding devstack right now) | 14:44 |
| samueldmq | lbragstad: tempest run --regex tempest.api.identity.admin.v3.test_users.UsersV3TestJSON.test_password_history_not_enforced_in_admin_reset | 14:53 |
| lbragstad | samueldmq: awesome - let me see if i can recreate | 14:53 |
| *** sbezverk has quit IRC | 14:54 | |
| samueldmq | lbragstad: ++ | 14:55 |
| samueldmq | I am doing "for i in {1..100}; do tempest.... ; done" | 14:55 |
| *** sbezverk has joined #openstack-keystone | 14:55 | |
| samueldmq | a go grab some coffee | 14:56 |
| samueldmq | :) | 14:56 |
| *** rcernin has quit IRC | 14:57 | |
| lbragstad | samueldmq: http://paste.openstack.org/show/618192/ | 14:58 |
| lbragstad | `fail tempest run --regex tempest.api.identity.admin.v3.test_users.UsersV3TestJSON.test_password_history_not_enforced_in_admin_reset` | 14:58 |
| cmurphy | lbragstad: nice | 15:00 |
| lbragstad | 72 attempts so far without a failure | 15:01 |
| *** dikonoo has quit IRC | 15:02 | |
| lbragstad | woo - attempt 84 failed! | 15:02 |
| kmalloc | fun =/ | 15:05 |
| gagehugo | "fun" | 15:05 |
| *** dstepanenko has quit IRC | 15:07 | |
| *** dstepanenko has joined #openstack-keystone | 15:07 | |
| *** dstepanenko has quit IRC | 15:07 | |
| kmalloc | lbragstad: paste the exception/error for me? | 15:10 |
| lbragstad | kmalloc: ack | 15:13 |
| lbragstad | http://paste.openstack.org/show/618198/ | 15:13 |
| lbragstad | this is the failing test - https://github.com/openstack/tempest/blob/master/tempest/api/identity/admin/v3/test_users.py#L144-L166 | 15:14 |
| lbragstad | specifically this assertion - https://github.com/openstack/tempest/blob/master/tempest/api/identity/admin/v3/test_users.py#L166 | 15:14 |
| *** Dinesh_Bhor has quit IRC | 15:15 | |
| *** dklyle has joined #openstack-keystone | 15:15 | |
| *** david-lyle has quit IRC | 15:15 | |
| *** ducttape_ has joined #openstack-keystone | 15:17 | |
| kmalloc | cache race | 15:17 |
| gagehugo | that time.sleep seems sketchy | 15:18 |
| kmalloc | is it possible something else is touching that user at the same time? | 15:18 |
| kmalloc | because... | 15:18 |
| kmalloc | self.get_user.invalidate(self, old_user_ref['id']) | 15:18 |
| kmalloc | self.get_user_by_name.invalidate(self, old_user_ref['name'], | 15:18 |
| kmalloc | old_user_ref['domain_id']) | 15:18 |
| kmalloc | ref = driver.update_user(entity_id, user) | 15:18 |
| kmalloc | we invalidate then update | 15:19 |
| kmalloc | ... we must update before we invalidate the cache | 15:19 |
| kmalloc | always | 15:19 |
| knikolla | kmalloc: sounds very plausible. | 15:19 |
| kmalloc | i don't know if i reviewd that cache patch, but caching and invalidation is hard(tm) | 15:20 |
| kmalloc | https://review.openstack.org/#/c/110575/ | 15:20 |
| knikolla | kmalloc: that's a pretty old patch. why would it start causing issues now? | 15:21 |
| kmalloc | it's *very* narrow and racy | 15:21 |
| kmalloc | and/or something is touching the user (doing a get) at the same time now | 15:22 |
| kmalloc | so, lbragstad: swap the update until after the update | 15:22 |
| gagehugo | I think that issue started up around the end of June if I remember correctly | 15:22 |
| kmalloc | lbragstad: run again? | 15:22 |
| kmalloc | there are a ton of things that change across the board | 15:23 |
| kmalloc | i don't know all of them | 15:23 |
| kmalloc | for all i know, tempest changed some detail of how it does an update | 15:23 |
| kmalloc | to the user | 15:23 |
| lbragstad | i can try and turn off identity caching specifically | 15:24 |
| *** mvk has joined #openstack-keystone | 15:24 | |
| kmalloc | that would be worth it too | 15:24 |
| kmalloc | but i would invert that first | 15:24 |
| kmalloc | and do a test | 15:24 |
| *** clenimar has quit IRC | 15:24 | |
| openstackgerrit | Merged openstack/keystone-tempest-plugin master: Removed the older version of python and added 3.5 https://review.openstack.org/485191 | 15:24 |
| knikolla | ++ | 15:24 |
| knikolla | given the time it takes to get it to fail | 15:24 |
| *** mvk_ has quit IRC | 15:25 | |
| *** jaosorior has quit IRC | 15:27 | |
| knikolla | kmalloc: so, let me see if i got this right. cache is invalidated first. something causes the user to get cached before password is updated, so user is cached with old password. user is updated, cached version has old password. user tries to auth, cached version is picked up and new password fails. | 15:27 |
| kmalloc | that is at a glance a real possibility | 15:29 |
| *** prashkre_ has quit IRC | 15:29 | |
| *** prashkre__ has joined #openstack-keystone | 15:29 | |
| kmalloc | especially with multiple keystone processes running | 15:29 |
| *** dikonoo has joined #openstack-keystone | 15:29 | |
| *** mvk has quit IRC | 15:29 | |
| *** mvk has joined #openstack-keystone | 15:29 | |
| knikolla | and would fit the 1/100 chance. | 15:30 |
| *** gyee has joined #openstack-keystone | 15:30 | |
| lbragstad | hmm | 15:31 |
| lbragstad | i wonder if the switch to uwsgi did anything with the keystone logs | 15:31 |
| cmurphy | it might have http://lists.openstack.org/pipermail/openstack-dev/2017-July/119877.html | 15:33 |
| *** dikonoo has quit IRC | 15:33 | |
| lbragstad | cmurphy: oh - sure | 15:34 |
| *** sjain has joined #openstack-keystone | 15:34 | |
| lbragstad | hmm | 15:34 |
| lbragstad | knikolla: kmalloc would that case still be possible if devstack creates a new user and project for each test | 15:37 |
| lbragstad | ? | 15:37 |
| knikolla | lbragstad: it makes all calls during that test as that user. so plausible | 15:38 |
| lbragstad | and it would be handled by separate keystone processes | 15:39 |
| knikolla | yes. | 15:39 |
| *** dstepanenko has joined #openstack-keystone | 15:40 | |
| openstackgerrit | Merged openstack/keystone master: Update docs: fernet is the default provider https://review.openstack.org/486608 | 15:41 |
| *** dikonoo has joined #openstack-keystone | 15:42 | |
| lbragstad | knikolla: cmurphy samueldmq kmalloc well - disabling caching for identity seems to get us farther | 15:43 |
| lbragstad | up to 110 consecutive runs without a failure | 15:43 |
| knikolla | lbragstad: and still going? | 15:44 |
| cmurphy | lbragstad: meaning you saw a failure at 110 or it's still going without a failure? | 15:44 |
| lbragstad | no failure yet - up to 123 attempts | 15:44 |
| *** dstepanenko has quit IRC | 15:45 | |
| lbragstad | it appears caching certainly has something to do with it | 15:45 |
| cmurphy | i'll believe it around 200 | 15:45 |
| knikolla | i think we just closed 2 bugs. | 15:45 |
| lbragstad | damn | 15:45 |
| lbragstad | attempt 128 failed | 15:45 |
| cmurphy | ha | 15:46 |
| gagehugo | :( | 15:46 |
| knikolla | spoke too soon. | 15:46 |
| lbragstad | i just *had* to say something | 15:46 |
| *** itlinux has quit IRC | 15:46 | |
| openstackgerrit | Merged openstack/keystone master: Updated URLs in docs https://review.openstack.org/490649 | 15:49 |
| *** aselius has joined #openstack-keystone | 15:51 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update release notes for pike https://review.openstack.org/493018 | 15:52 |
| lbragstad | samueldmq: ^ | 15:52 |
| lbragstad | samueldmq: fixed the failure | 15:52 |
| kmalloc | it could have happened. | 15:53 |
| kmalloc | but without cache... | 15:54 |
| kmalloc | then the answer might be more subtle, let me look at the pass... oh sec | 15:54 |
| kmalloc | i might know | 15:54 |
| kmalloc | yep | 15:54 |
| kmalloc | lbragstad: i think i see the bg | 15:55 |
| kmalloc | bug | 15:55 |
| * lbragstad waits anxiously | 15:55 | |
| kmalloc | order_by='Password.created_at') | 15:57 |
| kmalloc | mysql loses resolution below 1 second | 15:57 |
| kmalloc | in many versions | 15:57 |
| kmalloc | so. | 15:57 |
| kmalloc | we are changing the password twice within a second | 15:58 |
| kmalloc | and the old password sorts above the new one | 15:58 |
| kmalloc | we have had the same issue wtih the revocation table(s) for a looong time | 15:58 |
| lbragstad | yeah | 15:58 |
| kmalloc | basically... we need something more reliable than a datetime field | 15:58 |
| lbragstad | we need an int with microsecond precison | 15:59 |
| kmalloc | we shouldn't store datetime in the db we should convert to int... yes | 15:59 |
| lbragstad | precision* | 15:59 |
| kmalloc | now... | 15:59 |
| kmalloc | with multiple keystones, you *may* have the same issue | 15:59 |
| lbragstad | but on a much smaller scale | 15:59 |
| kmalloc | depends on clock skew | 15:59 |
| *** dikonoo has quit IRC | 15:59 | |
| kmalloc | that will never happen in tempest | 16:01 |
| lbragstad | https://review.openstack.org/#/c/243742/9 | 16:02 |
| kmalloc | yep | 16:02 |
| kmalloc | same exact thing | 16:02 |
| kmalloc | we should stop trying to store datetime fields in the db if we are keying off them for anything besides audit | 16:02 |
| lbragstad | we've hit enough use cases to justify doing that work i think | 16:02 |
| kmalloc | this should be keystone wide. | 16:03 |
| kmalloc | ftr | 16:03 |
| lbragstad | yeah | 16:03 |
| lbragstad | completely agree | 16:03 |
| lbragstad | some things will still require rounding to the second - but we can handle that in keystone | 16:03 |
| lbragstad | which is a better approach anyway because you're controlling it in the application | 16:03 |
| lbragstad | instead of leaving it up to the database | 16:03 |
| kmalloc | we should create a custom SQL-Column-Type that does the int->datetime conversion for us | 16:04 |
| lbragstad | which can change approaches to rounding across versions | 16:04 |
| kmalloc | and we just do the second-trim-rounding with the normal datetime object | 16:04 |
| kmalloc | so we store datetime and it writes int, and vice versa for reading | 16:04 |
| lbragstad | it pulls out an integer from the backend and automatically converts it to a datetime object | 16:05 |
| kmalloc | yep | 16:05 |
| *** sbezverk has quit IRC | 16:05 | |
| kmalloc | pretty easy to do | 16:05 |
| kmalloc | also... that cache race is real | 16:05 |
| kmalloc | it just wasn't the culprit here | 16:05 |
| lbragstad | and you should have the same conversion at the front of the application | 16:05 |
| lbragstad | and all business logic should center around a single datetime format | 16:06 |
| kmalloc | so, i would (initially) write everything to just convert on the backend | 16:06 |
| kmalloc | internally we can look at lifting that upwards once we fix the actual bug | 16:07 |
| lbragstad | which would fix the bug at hand | 16:07 |
| kmalloc | exactly | 16:07 |
| kmalloc | do you need me to spin up the change? | 16:07 |
| *** lucasxu has quit IRC | 16:07 | |
| lbragstad | but it would all be moving towards a better story for datetime consistency | 16:07 |
| lbragstad | kmalloc: go for it | 16:07 |
| kmalloc | it's going to take a pretty significant chunk of time. | 16:07 |
| lbragstad | kmalloc: does this need to be in pike | 16:07 |
| lbragstad | ? | 16:07 |
| kmalloc | so, if we want this RC2, expect that we wont RC until tomorrow/next day | 16:07 |
| lbragstad | it will require a db migration | 16:07 |
| kmalloc | ideally, it should be if it's critical enough to cause problems | 16:08 |
| kmalloc | if we rate this as high/crit bug | 16:08 |
| kmalloc | yes it goes in pike | 16:08 |
| kmalloc | if we live with it (meh) | 16:08 |
| kmalloc | it goes in Queens | 16:08 |
| kmalloc | (medium/low/wish) | 16:08 |
| lbragstad | kmalloc: ack - i'll update the bug report with the findings | 16:09 |
| kmalloc | not only does it require a migration, it requires writing to multiple columns since old keystones have to still get "datetime" | 16:09 |
| kmalloc | for rolling-upgrades | 16:09 |
| lbragstad | i assume https://bugs.launchpad.net/keystone/+bug/1703917 is caused by the same bug | 16:10 |
| openstack | Launchpad bug 1703917 in OpenStack Identity (keystone) "Sometimes test_update_user_password fails with Unauthorized" [Medium,Triaged] | 16:10 |
| kmalloc | and this is not something easily done in a trigger | 16:10 |
| kmalloc | yeah i'm sure thats the same bug | 16:10 |
| *** dstepanenko has joined #openstack-keystone | 16:10 | |
| kmalloc | this is the same kind of problem we had with password hashing, we'll need to write to both locations for pike and in queens we can write the contract | 16:10 |
| lbragstad | i'm going to mark https://bugs.launchpad.net/keystone/+bug/1703917 as a dupe | 16:10 |
| kmalloc | unless we use something like https://dev.mysql.com/doc/refman/5.7/en/date-and-time-functions.html#function_from-unixtime but i worry when trying to be multi-db aware | 16:11 |
| * kmalloc is inclined to just make it like password hashing. | 16:11 | |
| lbragstad | kmalloc: yeah - that seems risky depending on the db | 16:11 |
| lbragstad | i don't expect all dbs to support that | 16:12 |
| *** dstepanenko has quit IRC | 16:12 | |
| kmalloc | but we wont need a special option to enable the migrations we'll just write both for pike | 16:12 |
| kmalloc | and in queens contract + drop the second write | 16:12 |
| kmalloc | ok so, fix revocation events and password | 16:12 |
| lbragstad | yeah - and we'll have to do the same approach for other db fields i think | 16:12 |
| kmalloc | anything else that should be converted? | 16:12 |
| kmalloc | should i aim to hit everything for pike? | 16:12 |
| kmalloc | it'd be a big big RC change | 16:13 |
| kmalloc | but i could. | 16:13 |
| lbragstad | kmalloc: i would be good with that so long as it isn't a huge change | 16:13 |
| kmalloc | it will be a lot of change (lots of migration code) | 16:13 |
| lbragstad | if it's huge - then we can rescope to only fix what is needed for the bug | 16:13 |
| kmalloc | well, the big change will be a bit of code to any/all models | 16:13 |
| lbragstad | then make the rest of the change in queens and remove old stuff in rocky | 16:13 |
| kmalloc | i'd prefer to land it all in pike if possible | 16:13 |
| kmalloc | it'll be a few hundred lines of code | 16:14 |
| kmalloc | and a significant migration | 16:14 |
| lbragstad | kmalloc: if you're confident in it - i trust your judgement | 16:14 |
| kmalloc | i'll aim for passwords first | 16:14 |
| kmalloc | and expand/replicate from there | 16:14 |
| lbragstad | works for me | 16:14 |
| kmalloc | going to call the new fields "<Xxxxx>-int" | 16:14 |
| kmalloc | or? | 16:14 |
| lbragstad | kmalloc: yeah | 16:15 |
| kmalloc | ok | 16:15 |
| kmalloc | and i'll write a data migration to move all the data as well to the int-field | 16:15 |
| lbragstad | i'd perfer to keep it as explicit as possible | 16:15 |
| kmalloc | (i need to do the same thing for password-hashes anyway in Queens) | 16:15 |
| openstackgerrit | Omar Tleimat proposed openstack/keystone master: Fix mapping_purge failure https://review.openstack.org/408304 | 16:15 |
| * kmalloc sighs. | 16:15 | |
| kmalloc | this has been a long time coming | 16:15 |
| lbragstad | yeah... | 16:15 |
| kmalloc | also... in rocky, you get to delete all persistent token stuff ;) | 16:16 |
| kmalloc | btw | 16:16 |
| kmalloc | collapse everything down to fernet | 16:16 |
| kmalloc | since uuid is deprecated and slated for removal (yay) | 16:16 |
| lbragstad | that will be nice | 16:16 |
| kmalloc | i would actually drop the token driver being configurable at the same time | 16:16 |
| lbragstad | so we don't want to keep uuid around in case of a security issue with fernet? | 16:16 |
| kmalloc | nah, fix fernet | 16:17 |
| *** dikonoo has joined #openstack-keystone | 16:17 | |
| kmalloc | and merge most of that code down into sane modules that build the token. the only thing the fernet driver should do is the encrypt/hash | 16:17 |
| lbragstad | right | 16:18 |
| kmalloc | and unpack | 16:18 |
| kmalloc | everything else should be baseline code for tokens. not optional/configurable/driverable | 16:18 |
| lbragstad | that means we can pull the v3 token data stuff up to the controller where it should be | 16:18 |
| kmalloc | exactly | 16:18 |
| lbragstad | and use token models consistently | 16:18 |
| kmalloc | *yep* | 16:18 |
| kmalloc | anyway. | 16:18 |
| kmalloc | off to write a ton of icky code for datetime->int | 16:18 |
| lbragstad | sweet - updating the bug | 16:19 |
| kmalloc | there is a smaller fix, now that i think of it | 16:19 |
| kmalloc | we could just mark the old password expired when a new one is issued... | 16:19 |
| kmalloc | and do: AND not expired | 16:19 |
| kmalloc | but... that makes the update multiple updates and transactions | 16:19 |
| kmalloc | potentially scary | 16:20 |
| lbragstad | less atomic i assume | 16:20 |
| kmalloc | it can be atomic | 16:20 |
| kmalloc | but more risky | 16:20 |
| kmalloc | the real fix is stop relying on datetime data type in mysql | 16:20 |
| kmalloc | in either case | 16:20 |
| *** aselius has quit IRC | 16:21 | |
| *** aselius has joined #openstack-keystone | 16:21 | |
| *** markvoelker has joined #openstack-keystone | 16:25 | |
| kmalloc | lbragstad: /me just told people to stop doing endpoint filtering. | 16:27 |
| kmalloc | again | 16:27 |
| kmalloc | but this time on the ML | 16:27 |
| lbragstad | kmalloc: updated https://bugs.launchpad.net/keystone/+bug/1702211 | 16:30 |
| openstack | Launchpad bug 1702211 in OpenStack Identity (keystone) "test_password_history_not_enforced_in_admin_reset failed in tempest test" [Medium,Confirmed] | 16:30 |
| kmalloc | ayoung: i'm a bit sad. but this fix is a loooong time coming. | 16:30 |
| kmalloc | lbragstad: ok give me a sec, need to check on the bird. he's making odd sounds. | 16:30 |
| kmalloc | then i'm on to the code. | 16:30 |
| *** itlinux has joined #openstack-keystone | 16:34 | |
| *** jmlowe_ has quit IRC | 16:34 | |
| *** iogg has quit IRC | 16:38 | |
| *** tesseract has quit IRC | 16:41 | |
| *** dklyle has quit IRC | 16:44 | |
| *** dklyle has joined #openstack-keystone | 16:45 | |
| *** prashkre__ has quit IRC | 16:47 | |
| *** jmlowe has joined #openstack-keystone | 16:56 | |
| *** markvoelker has quit IRC | 16:59 | |
| *** mjax has joined #openstack-keystone | 17:03 | |
| *** dstepanenko has joined #openstack-keystone | 17:04 | |
| knikolla | lbragstad: let's sync up on monday about global roles. have some work to do today. | 17:06 |
| *** dstepanenko has quit IRC | 17:09 | |
| lbragstad | knikolla: sounds good - i was just about to ping you about that | 17:14 |
| lbragstad | knikolla: what time on monday? | 17:15 |
| knikolla | lbragstad: morning would be good. | 17:15 |
| lbragstad | 10:00 AM your time work? | 17:16 |
| knikolla | lbragstad: sounds good. | 17:16 |
| *** mvk has quit IRC | 17:17 | |
| lbragstad | knikolla: sent | 17:18 |
| *** dikonoor has joined #openstack-keystone | 17:21 | |
| lbragstad | kmalloc: i'll watch for a patch when you have one ready - or ping me, i have the environment setup locally so i should be able to test with devstack | 17:21 |
| kmalloc | Okie | 17:22 |
| knikolla | lbragstad: any homework reading before that? | 17:23 |
| lbragstad | knikolla: https://review.openstack.org/#/c/462733/ ? | 17:23 |
| lbragstad | knikolla: https://review.openstack.org/#/c/460344/ | 17:23 |
| lbragstad | https://review.openstack.org/#/c/464763/ | 17:24 |
| knikolla | lbragstad: ack | 17:24 |
| lbragstad | i think those are the big ones | 17:24 |
| lbragstad | otherwise i think we'll just be digging into the implementation | 17:24 |
| *** dikonoo has quit IRC | 17:24 | |
| *** prashkre__ has joined #openstack-keystone | 17:27 | |
| *** simondodsley has joined #openstack-keystone | 17:33 | |
| *** ducttape_ has quit IRC | 17:39 | |
| *** ducttape_ has joined #openstack-keystone | 17:42 | |
| samueldmq | lbragstad: kmalloc did you find anything on the passwd update bug? | 17:42 |
| samueldmq | nvm saw the update in the bug. nice find! | 17:43 |
| *** ducttape_ has quit IRC | 17:46 | |
| *** ducttape_ has joined #openstack-keystone | 17:50 | |
| *** markvoelker has joined #openstack-keystone | 17:55 | |
| *** sjain has quit IRC | 18:11 | |
| *** markvoelker has quit IRC | 18:29 | |
| openstackgerrit | Merged openstack/keystone master: Update reno for stable/pike https://review.openstack.org/492774 | 18:29 |
| *** tobberydberg has joined #openstack-keystone | 18:31 | |
| *** tobberydberg has quit IRC | 18:36 | |
| *** nicolasbock has quit IRC | 18:43 | |
| *** tobberydberg has joined #openstack-keystone | 18:58 | |
| *** tobberydberg has quit IRC | 19:03 | |
| *** swain has joined #openstack-keystone | 19:03 | |
| *** ducttape_ has quit IRC | 19:03 | |
| *** ducttape_ has joined #openstack-keystone | 19:09 | |
| lbragstad | looks like keystone-manage bootstrap is currently incompatible with devstack and ldap configuration | 19:10 |
| *** ducttap__ has joined #openstack-keystone | 19:15 | |
| *** ducttape_ has quit IRC | 19:16 | |
| *** prashkre__ has quit IRC | 19:20 | |
| *** ducttap__ has quit IRC | 19:20 | |
| *** aselius has quit IRC | 19:21 | |
| *** markvoelker has joined #openstack-keystone | 19:27 | |
| *** ducttape_ has joined #openstack-keystone | 19:29 | |
| kmalloc | ldap in general | 19:31 |
| kmalloc | or ldap as default domain | 19:31 |
| kmalloc | because i'd expect as much | 19:32 |
| kmalloc | lbragstad: hmm | 19:39 |
| kmalloc | lbragstad: do we store *any* data that is not UTC/No-TZ in the db? | 19:40 |
| kmalloc | or should it always be TZ'd to UTC? | 19:40 |
| lbragstad | kmalloc: actually - it was this https://bugs.launchpad.net/keystone/+bug/1643301 | 19:41 |
| openstack | Launchpad bug 1643301 in OpenStack Identity (keystone) "bootstrapping keystone failed when LDAP backend is in use" [Wishlist,Triaged] | 19:41 |
| lbragstad | kmalloc: that's a good question | 19:41 |
| *** fried_rice has quit IRC | 19:41 | |
| openstackgerrit | Omar Tleimat proposed openstack/keystone master: Fix mapping_purge failure https://review.openstack.org/408304 | 19:46 |
| lbragstad | kmalloc: i would think they'd all be utc | 19:51 |
| lbragstad | kmalloc: but maybe i'm being hopeful? | 19:52 |
| *** fried_rice has joined #openstack-keystone | 19:53 | |
| *** markvoelker has quit IRC | 19:59 | |
| kmalloc | i'm going to call normalize in the object | 20:04 |
| kmalloc | lbragstad: so... i am leaning towards using a decimal type | 20:05 |
| kmalloc | instead of a float. | 20:06 |
| kmalloc | or double | 20:06 |
| *** tobberydberg has joined #openstack-keystone | 20:06 | |
| *** tobberydberg has quit IRC | 20:11 | |
| lbragstad | kmalloc: ok - major differences there? | 20:14 |
| lbragstad | kmalloc: shouldn't any of those cover our use cases? | 20:14 |
| kmalloc | decimal doesn't round | 20:14 |
| lbragstad | ohh | 20:14 |
| lbragstad | yes | 20:14 |
| kmalloc | trying to see how to build it. | 20:14 |
| openstackgerrit | Merged openstack/keystone master: Fix typo in index documentation https://review.openstack.org/479998 | 20:14 |
| lbragstad | make mysql accept what we give it :) | 20:14 |
| lbragstad | without asking questions | 20:14 |
| kmalloc | lol | 20:14 |
| lbragstad | kmalloc: sanity check - configuring ldap for keystone should be done through domain specific ldap configuration, right? | 20:15 |
| kmalloc | yeah | 20:15 |
| lbragstad | cc knikolla cmurphy | 20:15 |
| kmalloc | should be though domain specific | 20:15 |
| *** catintheroof has quit IRC | 20:15 | |
| lbragstad | is there *ever* a reason to set https://github.com/openstack/keystone/blob/99b3641fa0eb99d903488b2f04f9b69b79b3ff16/keystone/conf/identity.py#L69 to `ldap`? | 20:16 |
| kmalloc | yes.... sadly | 20:16 |
| kmalloc | because someone does it | 20:16 |
| kmalloc | not because it's a good idea | 20:16 |
| lbragstad | so we have to continue to support it? | 20:16 |
| kmalloc | mostly historical | 20:16 |
| kmalloc | yep | 20:16 |
| lbragstad | ok | 20:16 |
| kmalloc | ah better solution | 20:21 |
| kmalloc | going to just make sure we have microseconds and then do *1000000 | 20:22 |
| kmalloc | and then cast to float() and / 1000000 on load | 20:22 |
| kmalloc | way easier to ensure consistent data | 20:22 |
| *** tobberydberg has joined #openstack-keystone | 20:26 | |
| *** raildo has quit IRC | 20:29 | |
| lbragstad | that'll work | 20:37 |
| *** tobberydberg has quit IRC | 20:38 | |
| *** spzala has quit IRC | 20:42 | |
| *** jmlowe has quit IRC | 20:45 | |
| cmurphy | lbragstad: yeah if people want to have their admin user and service users come from ldap | 20:45 |
| cmurphy | or if they want their ldap users in the default domain and the service users in the other domain | 20:45 |
| cmurphy | but it's hard to do that now that the admin token isn't a thing | 20:46 |
| lbragstad | cmurphy: yeah - that seems to be what i'm hitting with https://bugs.launchpad.net/keystone/+bug/1643301 | 20:46 |
| openstack | Launchpad bug 1643301 in OpenStack Identity (keystone) "bootstrapping keystone failed when LDAP backend is in use" [Wishlist,Triaged] | 20:46 |
| *** itlinux has quit IRC | 20:46 | |
| lbragstad | but - i'm wondering if in the typical ldap case if we can just use sql as the default and then have ldap for domain specific stuff | 20:47 |
| lbragstad | or if we want to test all those permutations (service and admin users in ldap in the default case0 | 20:47 |
| lbragstad | ) | 20:47 |
| *** jmlowe has joined #openstack-keystone | 20:47 | |
| cmurphy | lbragstad: ldap in the separate domain should be typical | 20:48 |
| lbragstad | cmurphy: this issue now is that the KEYSTONE_IDENTITY_BACKEND var is used for both the default and ldap domain config if set to `ldap` | 20:49 |
| lbragstad | so `keystone.conf [identity] driver = ldap` and `/etc/keystone/domains/keystone.Users.conf [identity] driver = ldap` | 20:50 |
| lbragstad | so - i guess we have two options | 20:50 |
| lbragstad | make bootstrap bypass user writes when ldap is configured | 20:51 |
| lbragstad | or add another case to devstack where we always setup sql as the default identity driver backend | 20:51 |
| *** dikonoor has quit IRC | 20:51 | |
| *** thorst has quit IRC | 20:52 | |
| cmurphy | bootstrap would also have to detect an admin user in ldap and assign the admin role to it | 20:53 |
| lbragstad | yeah | 20:55 |
| lbragstad | which slope is less slippery | 20:56 |
| *** jmlowe has quit IRC | 20:56 | |
| *** markvoelker has joined #openstack-keystone | 20:56 | |
| cmurphy | ¯\_(ツ)_/¯ | 20:57 |
| *** edmondsw has quit IRC | 21:01 | |
| *** jistr is now known as jistr|off | 21:02 | |
| *** gyee has quit IRC | 21:02 | |
| lbragstad | Por que no los dos? | 21:04 |
| lbragstad | cmurphy: the manager.ldif is the one that's applied when installing ldap, right? | 21:04 |
| lbragstad | https://github.com/openstack-dev/devstack/blob/master/files/ldap/manager.ldif.in | 21:04 |
| *** dave-mccowan has quit IRC | 21:12 | |
| *** swain has quit IRC | 21:23 | |
| *** gyee has joined #openstack-keystone | 21:29 | |
| *** markvoelker has quit IRC | 21:30 | |
| cmurphy | lbragstad: i've actually never touched our devstack plugin, maybe knikolla knows? | 21:40 |
| cmurphy | lbragstad: looks like it though | 21:40 |
| lbragstad | cmurphy: yeah - it was | 21:41 |
| lbragstad | it looks like it bootstraps the Manager as the ldap admin | 21:41 |
| knikolla | o/ | 21:41 |
| knikolla | gotta love train wifi | 21:41 |
| lbragstad | then populates a demo user | 21:41 |
| knikolla | should i read back? | 21:41 |
| cmurphy | we should really put https://wiki.openstack.org/wiki/OpenLDAP into the contributor docs | 21:41 |
| lbragstad | baha! | 21:42 |
| lbragstad | i didn't even know that was a thing | 21:42 |
| cmurphy | that's why it needs a better home :P | 21:42 |
| lbragstad | exactly | 21:42 |
| lbragstad | i just tripped over about every mistake | 21:43 |
| lbragstad | `The setup on Ubuntu is somewhat different. This was done on Ubuntu 11.10` | 21:43 |
| lbragstad | lol | 21:44 |
| *** thorst has joined #openstack-keystone | 21:44 | |
| cmurphy | lol | 21:44 |
| kmalloc | lbragstad: i might have a working patch sans tests | 21:44 |
| lbragstad | kmalloc: sweet | 21:44 |
| kmalloc | lbragstad: running tests locally and then i'll write an upgrade test | 21:44 |
| kmalloc | oh nope | 21:45 |
| kmalloc | i screwed up | 21:45 |
| kmalloc | somewhere | 21:45 |
| * lbragstad hands kmalloc the semi-colon he's missing | 21:45 | |
| knikolla | please don't make bootstrap do more smart stuff. | 21:48 |
| *** thorst has quit IRC | 21:48 | |
| knikolla | if we make it support ldap even a little bit, people will use it for ldap. | 21:48 |
| lbragstad | knikolla: https://bugs.launchpad.net/keystone/+bug/1643301 | 21:49 |
| openstack | Launchpad bug 1643301 in OpenStack Identity (keystone) "bootstrapping keystone failed when LDAP backend is in use" [Wishlist,Triaged] | 21:49 |
| lbragstad | *just* updated that | 21:49 |
| knikolla | lbragstad: yes! domain specific drivers! | 21:50 |
| lbragstad | knikolla: so - maybe what we do is add devstack to the bug - confirm the approach to always configure the default identity driver as ldap | 21:51 |
| lbragstad | and put up a patch to split that patch into two | 21:51 |
| lbragstad | (in devstack) | 21:51 |
| lbragstad | then document in devstack that the preferred way to deploy ldap with devstack is in that config | 21:52 |
| knikolla | lbragstad: and make bootstrap fail verbosely when identity driver = ldap | 21:52 |
| lbragstad | we could also add a section to our own bootstrapping docs that say bootstrapping is only required when sql is used | 21:52 |
| lbragstad | yeah | 21:53 |
| lbragstad | we can tack that onto the same report if we want to | 21:53 |
| knikolla | \s\verbosely\gracefully | 21:53 |
| knikolla | +1 | 21:53 |
| *** spzala has joined #openstack-keystone | 22:00 | |
| *** ayoung has quit IRC | 22:01 | |
| lbragstad | kmalloc: i gotta run for a couple hours - but i'll be available tonight to test a patch if you have one by then | 22:06 |
| lbragstad | if not we'll hit it monday | 22:06 |
| *** markvoelker has joined #openstack-keystone | 22:10 | |
| kmalloc | kmalloc: ok i have the tests running | 22:11 |
| kmalloc | i need to write the upgrade test | 22:11 |
| kmalloc | lbragstad: it is fair to require a data migrate run, right? | 22:11 |
| breton | i had to implement limiting admins by ip recently | 22:11 |
| kmalloc | lbragstad: for rolling upgrades? | 22:11 |
| kmalloc | lbragstad: expand, migrate *required* to run the new code? | 22:11 |
| breton | due to company's policy to forbid any admin actions outside of VPN | 22:11 |
| breton | and one of the requirements was not to change keystone code | 22:11 |
| breton | it was fun! | 22:11 |
| kmalloc | proxy? l7 inspection? | 22:12 |
| lbragstad | kmalloc: require a datamigration run? | 22:12 |
| kmalloc | lbragstad: must migrate data | 22:12 |
| kmalloc | db_sync migrate | 22:12 |
| kmalloc | or whatever | 22:12 |
| kmalloc | not require a contract | 22:12 |
| kmalloc | but so, expand, migrate required | 22:13 |
| breton | it turns out it is not easy to do it in keystone with auth plugins or even custom token providers | 22:13 |
| kmalloc | ha-proxy, l7 inspection | 22:14 |
| lbragstad | kmalloc: yeah - you aren't required to have a contract, just pass though it | 22:14 |
| kmalloc | lbragstad: no, i mean... require data migration to be run | 22:14 |
| kmalloc | to use pike code in this case | 22:14 |
| breton | kmalloc: how would they help me? | 22:14 |
| kmalloc | expand is required. | 22:14 |
| kmalloc | breton: look at the url and just 401/404/whatever the request if it is to an admin function | 22:15 |
| kmalloc | and not coming via VPN | 22:15 |
| lbragstad | kmalloc: oh - then you'd need to lock tables to make sure old nodes aren't writing to it when your doing the data migration | 22:15 |
| kmalloc | right. | 22:15 |
| kmalloc | it's the password table. | 22:16 |
| kmalloc | i can handle it in code, but it's kinda icky | 22:16 |
| lbragstad | that would mean no password updates or user creations during the upgrade | 22:16 |
| lbragstad | so a partial outage | 22:16 |
| kmalloc | yes | 22:16 |
| kmalloc | is running data migrate after expand optional? | 22:17 |
| kmalloc | oh wait nvm | 22:17 |
| lbragstad | kmalloc: yes | 22:17 |
| kmalloc | i'll do it in code then | 22:17 |
| lbragstad | migrating data isn't a requirement | 22:17 |
| kmalloc | sigh | 22:17 |
| lbragstad | because of the additive only case | 22:17 |
| * lbragstad shuts laptop | 22:17 | |
| *** lbragstad has quit IRC | 22:17 | |
| kmalloc | the no-downtime upgrade is a silly request in the way we deal with data | 22:17 |
| *** ducttape_ has quit IRC | 22:18 | |
| *** ducttape_ has joined #openstack-keystone | 22:21 | |
| *** markvoelker has quit IRC | 22:33 | |
| *** spzala has quit IRC | 22:41 | |
| *** spzala has joined #openstack-keystone | 23:04 | |
| *** clayton has quit IRC | 23:18 | |
| *** clayton has joined #openstack-keystone | 23:18 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add int storage of datetime for password created/expires https://review.openstack.org/493259 | 23:23 |
| kmalloc | cmurphy, knikolla: ^ | 23:24 |
| *** zzzeek has quit IRC | 23:43 | |
| *** zzzeek has joined #openstack-keystone | 23:44 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!