| *** oikiki has joined #openstack-keystone | 00:06 | |
| *** oikiki has quit IRC | 00:07 | |
| *** sbezverk has joined #openstack-keystone | 00:16 | |
| *** edmondsw has joined #openstack-keystone | 00:16 | |
| *** edmondsw has quit IRC | 00:21 | |
| *** thorst has joined #openstack-keystone | 00:46 | |
| *** thorst has quit IRC | 00:46 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 00:49 | |
| *** AlexeyAbashkin has quit IRC | 00:53 | |
| *** sbezverk has quit IRC | 00:55 | |
| *** namnh has joined #openstack-keystone | 01:00 | |
| *** sbezverk has joined #openstack-keystone | 01:08 | |
| *** namnh has quit IRC | 01:09 | |
| *** swain has joined #openstack-keystone | 01:22 | |
| *** Shunli has joined #openstack-keystone | 01:38 | |
| *** ayoung has joined #openstack-keystone | 01:43 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 01:46 | |
| *** AlexeyAbashkin has quit IRC | 01:50 | |
| *** edmondsw has joined #openstack-keystone | 01:51 | |
| *** kukacz has quit IRC | 02:00 | |
| *** kukacz has joined #openstack-keystone | 02:01 | |
| *** thorst has joined #openstack-keystone | 02:02 | |
| openstackgerrit | zhengliuyang proposed openstack/keystone master: Improper handle about building list of token deletion https://review.openstack.org/475100 | 02:05 |
|---|---|---|
| *** thorst has quit IRC | 02:07 | |
| *** thorst has joined #openstack-keystone | 02:17 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Specification for system roles https://review.openstack.org/464763 | 02:19 |
| *** thorst has quit IRC | 02:19 | |
| *** oikiki has joined #openstack-keystone | 02:30 | |
| *** markvoelker has quit IRC | 02:39 | |
| *** junbo has quit IRC | 02:52 | |
| *** edmondsw has quit IRC | 02:53 | |
| *** nicolasbock has quit IRC | 02:53 | |
| *** mtreinish has quit IRC | 03:02 | |
| *** ayoung has quit IRC | 03:06 | |
| *** mtreinish has joined #openstack-keystone | 03:07 | |
| *** wes_dillingham has quit IRC | 03:11 | |
| *** wes_dillingham has joined #openstack-keystone | 03:12 | |
| *** wes_dillingham has quit IRC | 03:12 | |
| *** thorst has joined #openstack-keystone | 03:12 | |
| *** thorst has quit IRC | 03:12 | |
| *** wes_dillingham has joined #openstack-keystone | 03:13 | |
| *** wes_dillingham has quit IRC | 03:13 | |
| *** wes_dillingham has joined #openstack-keystone | 03:13 | |
| *** wes_dillingham has quit IRC | 03:14 | |
| *** wes_dillingham has joined #openstack-keystone | 03:14 | |
| *** wes_dillingham has quit IRC | 03:14 | |
| *** wes_dillingham has joined #openstack-keystone | 03:15 | |
| *** wes_dillingham has quit IRC | 03:15 | |
| *** wes_dillingham has joined #openstack-keystone | 03:16 | |
| *** wes_dillingham has quit IRC | 03:16 | |
| *** wes_dillingham has joined #openstack-keystone | 03:17 | |
| *** wes_dillingham has quit IRC | 03:17 | |
| *** wes_dillingham has joined #openstack-keystone | 03:17 | |
| *** wes_dillingham has quit IRC | 03:18 | |
| *** wes_dillingham has joined #openstack-keystone | 03:18 | |
| *** wes_dillingham has quit IRC | 03:18 | |
| *** wes_dillingham has joined #openstack-keystone | 03:20 | |
| *** wes_dillingham has quit IRC | 03:20 | |
| *** wes_dillingham has joined #openstack-keystone | 03:22 | |
| *** wes_dillingham has quit IRC | 03:22 | |
| *** wes_dillingham has joined #openstack-keystone | 03:22 | |
| *** wes_dillingham has quit IRC | 03:22 | |
| *** wes_dillingham has joined #openstack-keystone | 03:23 | |
| *** wes_dillingham has quit IRC | 03:23 | |
| *** wes_dillingham has joined #openstack-keystone | 03:24 | |
| *** wes_dillingham has quit IRC | 03:24 | |
| *** wes_dillingham has joined #openstack-keystone | 03:25 | |
| *** links has joined #openstack-keystone | 03:25 | |
| *** wes_dillingham has quit IRC | 03:25 | |
| *** oikiki has quit IRC | 03:31 | |
| *** swain has quit IRC | 03:41 | |
| *** dave-mccowan has quit IRC | 03:54 | |
| *** Shunli has quit IRC | 04:07 | |
| *** oikiki has joined #openstack-keystone | 04:20 | |
| *** hoonetorg has quit IRC | 04:37 | |
| *** markvoelker has joined #openstack-keystone | 04:39 | |
| *** edmondsw has joined #openstack-keystone | 04:39 | |
| *** edmondsw has quit IRC | 04:44 | |
| *** hoonetorg has joined #openstack-keystone | 04:50 | |
| *** thorst has joined #openstack-keystone | 04:56 | |
| *** thorst has quit IRC | 05:00 | |
| *** markvoelker has quit IRC | 05:14 | |
| *** markvoelker has joined #openstack-keystone | 06:11 | |
| *** brad[] has quit IRC | 06:20 | |
| *** josecastroleon has quit IRC | 06:21 | |
| *** josecastroleon has joined #openstack-keystone | 06:22 | |
| *** edmondsw has joined #openstack-keystone | 06:28 | |
| *** brad[] has joined #openstack-keystone | 06:32 | |
| *** edmondsw has quit IRC | 06:32 | |
| *** rcernin has joined #openstack-keystone | 06:35 | |
| *** aselius has quit IRC | 06:36 | |
| *** markvoelker has quit IRC | 06:44 | |
| *** thorst has joined #openstack-keystone | 06:57 | |
| *** thorst_ has joined #openstack-keystone | 07:00 | |
| *** Dinesh_Bhor has quit IRC | 07:01 | |
| *** thorst has quit IRC | 07:01 | |
| *** thorst_ has quit IRC | 07:05 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:07 | |
| *** ioggstream has joined #openstack-keystone | 07:15 | |
| *** oikiki has quit IRC | 07:15 | |
| *** pcaruana has joined #openstack-keystone | 07:17 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:32 | |
| *** tesseract has joined #openstack-keystone | 07:32 | |
| *** markvoelker has joined #openstack-keystone | 07:41 | |
| *** d0ugal has joined #openstack-keystone | 07:59 | |
| *** markvoelker has quit IRC | 08:14 | |
| *** edmondsw has joined #openstack-keystone | 08:15 | |
| *** edmondsw has quit IRC | 08:20 | |
| *** spectr has quit IRC | 08:49 | |
| openstackgerrit | Mateusz Kowalski proposed openstack/oslo.policy master: Make policy syntax checks optional https://review.openstack.org/511426 | 08:53 |
| *** thorst has joined #openstack-keystone | 09:02 | |
| *** thorst has quit IRC | 09:05 | |
| *** spectr has joined #openstack-keystone | 09:19 | |
| *** mvk has quit IRC | 09:37 | |
| *** thorst has joined #openstack-keystone | 10:02 | |
| *** edmondsw has joined #openstack-keystone | 10:04 | |
| openstackgerrit | Mateusz Kowalski proposed openstack/oslo.policy master: Make policy syntax checks optional https://review.openstack.org/511426 | 10:06 |
| *** edmondsw has quit IRC | 10:08 | |
| *** thorst has quit IRC | 10:08 | |
| *** spectr has quit IRC | 10:12 | |
| *** markvoelker has joined #openstack-keystone | 10:12 | |
| *** sbezverk has quit IRC | 10:21 | |
| *** spectr has joined #openstack-keystone | 10:25 | |
| *** markvoelker has quit IRC | 10:45 | |
| *** clayton has quit IRC | 10:49 | |
| *** clayton has joined #openstack-keystone | 10:51 | |
| *** edmondsw has joined #openstack-keystone | 10:53 | |
| *** edmondsw has quit IRC | 10:56 | |
| *** AlexeyAbashkin has quit IRC | 11:01 | |
| *** dave-mccowan has joined #openstack-keystone | 11:03 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 11:05 | |
| *** mvk has joined #openstack-keystone | 11:08 | |
| *** nicolasbock has joined #openstack-keystone | 11:39 | |
| *** markvoelker has joined #openstack-keystone | 11:43 | |
| *** nicolasbock has quit IRC | 11:45 | |
| *** nicolasbock has joined #openstack-keystone | 11:58 | |
| *** thorst has joined #openstack-keystone | 12:06 | |
| *** edmondsw has joined #openstack-keystone | 12:10 | |
| *** edmondsw_ has joined #openstack-keystone | 12:10 | |
| *** wes_dillingham has joined #openstack-keystone | 12:14 | |
| *** edmondsw has quit IRC | 12:14 | |
| *** markvoelker has quit IRC | 12:16 | |
| *** lifeless has quit IRC | 12:24 | |
| *** hrybacki|trainin is now known as hrybacki | 12:26 | |
| *** lifeless has joined #openstack-keystone | 12:31 | |
| *** markvoelker has joined #openstack-keystone | 12:33 | |
| *** links has quit IRC | 12:41 | |
| *** MaxPC has joined #openstack-keystone | 12:50 | |
| *** panbalag has joined #openstack-keystone | 12:50 | |
| *** panbalag has left #openstack-keystone | 12:51 | |
| *** ppiela has joined #openstack-keystone | 12:57 | |
| *** catintheroof has joined #openstack-keystone | 13:06 | |
| *** catintheroof has quit IRC | 13:06 | |
| *** catintheroof has joined #openstack-keystone | 13:06 | |
| *** catintheroof has quit IRC | 13:13 | |
| *** catintheroof has joined #openstack-keystone | 13:14 | |
| *** edmondsw_ is now known as edmondsw | 13:19 | |
| *** ayoung has joined #openstack-keystone | 13:21 | |
| *** chlong has joined #openstack-keystone | 13:25 | |
| lbragstad | o/ | 13:26 |
| *** jaosorior has quit IRC | 13:27 | |
| lbragstad | ayoung: i want to make sure you see this - http://lists.openstack.org/pipermail/openstack-dev/2017-October/123472.html | 13:27 |
| lbragstad | we've set a bunch of times for next week and the week after, hoping a couple of those work for your schedule | 13:28 |
| *** ayoung has quit IRC | 13:38 | |
| *** sbezverk has joined #openstack-keystone | 13:39 | |
| *** itlinux has joined #openstack-keystone | 13:58 | |
| *** jaosorior has joined #openstack-keystone | 14:09 | |
| *** itlinux has quit IRC | 14:12 | |
| *** chlong has quit IRC | 14:13 | |
| lbragstad | edmondsw: around? | 14:16 |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.policy master: WIP: Add functionality to deprecate policies https://review.openstack.org/509909 | 14:17 |
| lbragstad | edmondsw: ^ that's not done yet, but i added a new class with some documentation that attempts to clarify what we talked about yesterday | 14:18 |
| lbragstad | cc kmalloc ^ | 14:18 |
| *** chlong has joined #openstack-keystone | 14:19 | |
| * lbragstad goes to make more coffee | 14:19 | |
| edmondsw | lbragstad here, but about to go into a meeting | 14:22 |
| *** itlinux has joined #openstack-keystone | 14:24 | |
| lbragstad | that's fine - just giving you a heads up | 14:29 |
| edmondsw | ++ | 14:32 |
| edmondsw | started looking | 14:32 |
| *** itlinux has quit IRC | 14:32 | |
| *** itlinux has joined #openstack-keystone | 14:36 | |
| *** links has joined #openstack-keystone | 14:39 | |
| openstackgerrit | Merged openstack/keystoneauth master: Add EndpointData.__str__ for debugging https://review.openstack.org/489413 | 14:40 |
| *** ayoung has joined #openstack-keystone | 14:42 | |
| -openstackstatus- NOTICE: Job log uploads are failing due to lack of inodes. Jobs also fail due to mismatches in gnutls packages. Workarounds for both in progress with proper fixes to follow. | 14:54 | |
| *** ChanServ changes topic to "Job log uploads are failing due to lack of inodes. Jobs also fail due to mismatches in gnutls packages. Workarounds for both in progress with proper fixes to follow." | 14:54 | |
| *** rcernin has quit IRC | 14:55 | |
| gagehugo | o/ | 14:55 |
| *** chlong has quit IRC | 15:02 | |
| *** jaosorior has quit IRC | 15:05 | |
| *** AlexeyAbashkin has quit IRC | 15:07 | |
| *** chlong has joined #openstack-keystone | 15:16 | |
| *** itlinux has quit IRC | 15:17 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Refactor test_backend_ldap tests https://review.openstack.org/507694 | 15:38 |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.policy master: Add functionality to deprecate policies https://review.openstack.org/509909 | 15:41 |
| *** itlinux has joined #openstack-keystone | 15:42 | |
| *** links has quit IRC | 15:47 | |
| lbragstad | grabbing lunch quick - biab | 15:51 |
| *** links has joined #openstack-keystone | 16:00 | |
| *** chlong has quit IRC | 16:03 | |
| *** edmondsw has quit IRC | 16:05 | |
| *** erlon has quit IRC | 16:07 | |
| *** masber has quit IRC | 16:09 | |
| *** edmondsw has joined #openstack-keystone | 16:12 | |
| *** edmondsw has quit IRC | 16:16 | |
| kmalloc | coooooffffeeeeeee | 16:17 |
| *** itlinux has quit IRC | 16:32 | |
| *** jmlowe has joined #openstack-keystone | 16:39 | |
| *** gyee has joined #openstack-keystone | 16:41 | |
| lbragstad | kmalloc: first cup of the day? | 16:44 |
| kmalloc | lbragstad: 3rd | 16:44 |
| *** gyee has quit IRC | 16:44 | |
| lbragstad | oh - well caffeinated then | 16:44 |
| *** jmlowe has quit IRC | 16:46 | |
| *** aselius has joined #openstack-keystone | 16:55 | |
| *** oikiki has joined #openstack-keystone | 16:57 | |
| *** mvk has quit IRC | 17:07 | |
| lbragstad | kmalloc: you know how deprecated_opts can take a list of DeprecatedOpt instances? | 17:09 |
| kmalloc | uh. | 17:09 |
| lbragstad | when you register a new Opt (or subclass of opt)? | 17:09 |
| kmalloc | yea? | 17:09 |
| kmalloc | oh how does it work? | 17:09 |
| kmalloc | i'd have to go poke at it. | 17:09 |
| kmalloc | not sure | 17:09 |
| lbragstad | https://github.com/openstack/oslo.config/blob/master/oslo_config/cfg.py#L825 | 17:09 |
| lbragstad | just theoretically speaking here | 17:10 |
| kmalloc | yeah | 17:10 |
| kmalloc | that should be right | 17:10 |
| lbragstad | that makes it so that you can supply multiple deprecated opts for a single new options | 17:10 |
| lbragstad | option* | 17:10 |
| kmalloc | yeah | 17:10 |
| kmalloc | that is the idea | 17:10 |
| lbragstad | makes sense, right? | 17:10 |
| lbragstad | do we ever need that for policies or rules? or will policy/rule deprecations always be one-to-one? | 17:11 |
| lbragstad | because which one would you use at enforcement time? | 17:11 |
| *** tesseract has quit IRC | 17:11 | |
| lbragstad | kmalloc: for example - http://paste.openstack.org/show/623479/ | 17:19 |
| lbragstad | should ^ that ever be allowed? | 17:19 |
| kmalloc | yes i would say it should be | 17:20 |
| lbragstad | (e.g. should we ever support the ability to pass a list of DeprecatedRules to a RuleDefault instance? | 17:20 |
| lbragstad | ) | 17:20 |
| kmalloc | there is a good chance you want to combine rules into a default | 17:20 |
| lbragstad | so - when the project starts enforcing on foo:bar, but both policies contract each other, what do you do? | 17:21 |
| lbragstad | contradict* | 17:21 |
| lbragstad | scenarios 3 and 4 | 17:21 |
| kmalloc | default rule wins in lieu of old defaults, but if overridden each individual one wins for it's specific enfocement point, i think | 17:22 |
| lbragstad | (this is all being done within oslo_policy.policy.Enforcer.enforce() fwiw) | 17:22 |
| lbragstad | that last bit is tricky, because it's consolidating them | 17:22 |
| lbragstad | oslo_policy doesn't know if it's evaluating foo:get_bar or foo:create_bar | 17:22 |
| kmalloc | so the stack is [new overidden] > [deprecated specific overidden] > [new default] > [old deprecated default] | 17:23 |
| kmalloc | it has to be stacked before being passed to enforce | 17:23 |
| kmalloc | and selected | 17:23 |
| kmalloc | basically the deprecated default is *never* used. | 17:23 |
| lbragstad | sure - that bit makes sense | 17:23 |
| lbragstad | i'm wondering what we do when they contradict each other | 17:23 |
| kmalloc | let the project determine | 17:23 |
| kmalloc | they're defining it, let them select the behavior. | 17:24 |
| kmalloc | we, oslo.policy/keystone, cannot know the expected behavior | 17:24 |
| kmalloc | we have to defer to the folks doing that implementation | 17:25 |
| lbragstad | what should oslo.policy do if one of the two deprecated rules passes and the other doesn't? | 17:25 |
| kmalloc | so, if you have an explicit override of the deprecated rule, you use that | 17:25 |
| lbragstad | i don't know how we can accept multiple rules in policy enforcement | 17:25 |
| lbragstad | sure | 17:25 |
| kmalloc | when you build the enforcement context | 17:25 |
| kmalloc | never ever ever use more than one rule. | 17:25 |
| lbragstad | so we shouldn't support a list of DeprecatedRules then | 17:25 |
| kmalloc | so, if you override a deprecated rule, but have the default new, you use the deprecated override | 17:26 |
| kmalloc | ah, no, we need to telegraph that the new rule (if overridden) replaces the deprecated ones | 17:26 |
| kmalloc | so, again. | 17:26 |
| kmalloc | new rule override is 1st choice | 17:26 |
| kmalloc | deprecated override is 2nd | 17:26 |
| kmalloc | new rule default is 3rd | 17:26 |
| lbragstad | yes - that totally makes sense | 17:27 |
| *** links has quit IRC | 17:27 | |
| kmalloc | the "deprecated bit" is more to telegraph what it replaces | 17:27 |
| kmalloc | not actually to consume | 17:27 |
| lbragstad | but.. if we support a list of DeprecatedRules, which rule do we use if we get to step 2? | 17:27 |
| kmalloc | don't pull the actual rule in the same way options work | 17:28 |
| kmalloc | build the context specifically from the json overrides/defaults | 17:28 |
| kmalloc | you don't try and stack a rule together, it's a "we select the highest priority rule and use it" | 17:28 |
| lbragstad | agree - but if we have multiple DeprecatedRules defined in a RuleDefault object, which one do you use/ | 17:29 |
| kmalloc | you don't | 17:29 |
| lbragstad | so, don't use a list of DeprecatedRules/ | 17:29 |
| kmalloc | ok lets rephrase the terms | 17:30 |
| kmalloc | the new rule does not pull in the old rules. | 17:31 |
| kmalloc | ever | 17:31 |
| kmalloc | the new rule default replaces the old rules, the list is telling people what the new rule replaces | 17:31 |
| kmalloc | so if you override the new rule, it overrides for *all* deprecated rules | 17:32 |
| lbragstad | ok - so what happens if you don't override the new rule | 17:32 |
| kmalloc | regardless if the deprecated rule is explicitly overriden elsewhere | 17:32 |
| lbragstad | but you have an old rule defined in policy.yaml | 17:32 |
| kmalloc | the old rule must apply to it's original place... | 17:33 |
| kmalloc | or | 17:33 |
| kmalloc | we just make the list a priority thing. | 17:33 |
| kmalloc | *shrug* | 17:33 |
| kmalloc | i really don't know | 17:33 |
| lbragstad | ..yeah | 17:33 |
| lbragstad | me either | 17:33 |
| lbragstad | example - http://paste.openstack.org/show/623488/ | 17:34 |
| kmalloc | honestly, i would just make new rule replace old one -- and give each policy enforcement point a priority list | 17:34 |
| kmalloc | rather than on __init__ of the rule default | 17:34 |
| kmalloc | register default for X (new default, old rule) | 17:35 |
| kmalloc | register default for y (same new default as X, old rule for Y) | 17:35 |
| lbragstad | so far - i can't think of a case where you'd actually want to consolidate multiple policies into a single one | 17:35 |
| kmalloc | then maybe don't | 17:35 |
| kmalloc | i can think of a case, but it's suspect at best | 17:36 |
| lbragstad | what is it? | 17:36 |
| kmalloc | defining imposed groupings | 17:37 |
| kmalloc | aka: if you can boot a VM you can delete a VM | 17:37 |
| kmalloc | (for example) | 17:37 |
| kmalloc | there are some cases that always makes sense. | 17:37 |
| kmalloc | but they're pretty limited | 17:37 |
| lbragstad | oh - so you'd collapse compute:create_instance and compute:delete_instance into compute:create_delete_instance? | 17:39 |
| kmalloc | in my example, it might make sense to support that | 17:39 |
| kmalloc | i'm not advocating making that change, but you might see a service want to do that | 17:39 |
| kmalloc | with policy-in-code. | 17:39 |
| lbragstad | yeah - maybe | 17:40 |
| lbragstad | that's essentially the same example as http://paste.openstack.org/show/623479/ | 17:40 |
| lbragstad | ok - i'm going to rework the implementation to not accept a list, just to see where it gets me | 17:44 |
| *** edmondsw has joined #openstack-keystone | 17:46 | |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.policy master: Add functionality to deprecate policies https://review.openstack.org/509909 | 18:10 |
| *** ioggstream has quit IRC | 18:19 | |
| lbragstad | kmalloc: edmondsw updated - http://paste.openstack.org/show/623493/ | 18:34 |
| edmondsw | lbragstad for the results on that, I would say "identity:list_users has been deprecated since Queens" instead of "This policy has been deprecated since Queens" | 18:40 |
| edmondsw | otherwise I like the results | 18:40 |
| kmalloc | ++ | 18:40 |
| edmondsw | lbragstad, oh, you could probably also remove the :"rule:admin_or_owner" part of the "deprecated since Queens" line for identity:user | 18:41 |
| lbragstad | i was intending to keep there there for the check_str change case | 18:43 |
| lbragstad | example: http://paste.openstack.org/show/623494/ | 18:44 |
| lbragstad | so we can also do something like this: | 18:44 |
| lbragstad | http://paste.openstack.org/show/623495/ | 18:47 |
| lbragstad | where the actual name of the policy isn't changing, but the default check string is | 18:48 |
| hogepodge | mnaser: you around? | 18:49 |
| mnaser | o/ hogepodge | 18:49 |
| edmondsw | lbragstad I thought you might be thinking that, but I'm not sure I buy it... More and more I'm thinking we have no true way to deprecate value changes, so all we can do is advertise them which is not actually deprecation at all | 18:53 |
| lbragstad | well - based on the discussion yesterday, we do have a way to deprecate them | 18:54 |
| edmondsw | lbragstad how? I can't see how we possibly could | 18:54 |
| lbragstad | look at http://paste.openstack.org/show/623495/ | 18:55 |
| lbragstad | if i'm a deployer | 18:55 |
| edmondsw | unless we mean different things when we say "deprecate" :) | 18:55 |
| ayoung | lbragstad, I'll make it work....I'll dig once I'm done with training | 18:55 |
| lbragstad | and i set "identity:create_user": "role:super_admin" | 18:55 |
| lbragstad | because that's what i need for my deployment | 18:56 |
| lbragstad | and then i upgrade | 18:56 |
| edmondsw | changing default values would never affect someone who customizes policy, so I'm not sure where you're going with this | 18:56 |
| edmondsw | it can only affect those who do not customize policy | 18:56 |
| lbragstad | i'll start seeing deprecation warnings, saying "identity:create_user": "rule:admin_required" is deprecated in favor of "role:manager" | 18:56 |
| edmondsw | they shouldn't... | 18:57 |
| edmondsw | the only person who should see warnings is someone who is using something that is deprectated... if they're customizing policy, they're not using the default value that we're supposedly deprecating | 18:57 |
| lbragstad | if i want to assume the new default, i can, but my original policy will still work | 18:57 |
| lbragstad | edmondsw: sure - that's one if statement | 18:57 |
| edmondsw | we can't bug everyone with deprecation warnings when they are doing something that's perfectly valid... customizing policy | 18:58 |
| lbragstad | sure - i'm jsut walking through and example | 18:58 |
| edmondsw | sure, and I'm commenting along the way :) | 18:58 |
| lbragstad | how do we not have a true way to deprecate things? | 19:00 |
| *** harlowja has quit IRC | 19:03 | |
| edmondsw | lbragstad in my mind at least, deprecate implies that you have some way to allow the old value to work for a period of time while the new value also works. But you can't have two defaults, so that's not possible | 19:03 |
| edmondsw | we could say that deprecate just means that the old value still works, and not that the new value must also work in this case... | 19:03 |
| edmondsw | that what you're thinking? | 19:04 |
| lbragstad | in order for the first statement to work - the operator needs to take action | 19:05 |
| *** masber has joined #openstack-keystone | 19:05 | |
| lbragstad | (e.g. create the new role or whatever) | 19:05 |
| lbragstad | i agree about there not being two defaults | 19:06 |
| lbragstad | you either use the new default because you haven't overridden it, or use something else | 19:07 |
| lbragstad | but i would think oslo.config is faced with the same thing | 19:07 |
| edmondsw | yeah, and they haven't solved it | 19:07 |
| lbragstad | if the new option isn't present, and the old option isn't present - then use the new default | 19:07 |
| lbragstad | what's left to solve there? | 19:07 |
| edmondsw | whatever we do to solve this for policy should also be done in oslo.config | 19:08 |
| edmondsw | oslo.config has solved the problem of deprecating option keys, but not option values | 19:08 |
| lbragstad | in most cases, we do that in code | 19:09 |
| *** aojea has joined #openstack-keystone | 19:10 | |
| *** masber has quit IRC | 19:10 | |
| edmondsw | the only way that I can think to handle deprecating policy or config option default *values* is to log a warning if (and only if) the operator is relying on defaults (i.e., hasn't customized that), and then give at least one release before actually changing the default value | 19:10 |
| edmondsw | during which time an operator can see the log warnings and go customize the value for that rule to get ready for the default actually changing | 19:10 |
| edmondsw | if the operator is already customizing that rule/option, then we don't need to log anything... our changing the default doesn't affect them because they aren't using the default | 19:11 |
| lbragstad | sure | 19:14 |
| *** mvk has joined #openstack-keystone | 19:28 | |
| *** harlowja has joined #openstack-keystone | 19:57 | |
| *** pcaruana has quit IRC | 19:58 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 20:05 | |
| *** AlexeyAbashkin has quit IRC | 20:09 | |
| *** wes_dillingham has quit IRC | 20:12 | |
| *** aojea has quit IRC | 20:29 | |
| *** aojea has joined #openstack-keystone | 20:31 | |
| openstackgerrit | Gage Hugo proposed openstack/python-keystoneclient master: WIP Remove keystoneclient.session usage https://review.openstack.org/511571 | 20:40 |
| *** AlexeyAbashkin has joined #openstack-keystone | 20:44 | |
| *** AlexeyAbashkin has quit IRC | 20:48 | |
| *** MaxPC has quit IRC | 20:49 | |
| *** ayoung has quit IRC | 20:50 | |
| *** edmondsw has quit IRC | 21:05 | |
| *** thorst has quit IRC | 21:08 | |
| *** aojea has quit IRC | 21:32 | |
| *** thorst has joined #openstack-keystone | 21:33 | |
| *** wes_dillingham has joined #openstack-keystone | 21:34 | |
| *** thorst has quit IRC | 21:36 | |
| *** lifeless has quit IRC | 21:37 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 21:43 | |
| *** AlexeyAbashkin has quit IRC | 21:47 | |
| *** catintheroof has quit IRC | 21:53 | |
| *** catintheroof has joined #openstack-keystone | 21:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone master: Updated from global requirements https://review.openstack.org/511015 | 21:54 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 21:54 |
| *** catintheroof has quit IRC | 21:55 | |
| *** jamiec has quit IRC | 21:56 | |
| *** lifeless has joined #openstack-keystone | 22:00 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 22:03 |
| *** jamiec has joined #openstack-keystone | 22:05 | |
| lbragstad | bah! yes! | 22:07 |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.policy master: Add functionality to deprecate policies https://review.openstack.org/509909 | 22:12 |
| *** mvk has quit IRC | 22:30 | |
| *** jmlowe has joined #openstack-keystone | 22:38 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 22:43 | |
| *** mvk has joined #openstack-keystone | 22:47 | |
| *** AlexeyAbashkin has quit IRC | 22:47 | |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.policy master: Add functionality to deprecate policies https://review.openstack.org/509909 | 23:00 |
| SamYaple | in keystone v3, roles can exist in only a single domain. is this widely used? | 23:00 |
| SamYaple | i can see it being useful for the 'admin' role to only live in an 'admin' domain so it could only be assigned to users in that domain | 23:01 |
| SamYaple | but im unclear if that was the original purpose for it | 23:01 |
| *** ChanServ changes topic to "Queens release schedule: https://releases.openstack.org/queens/schedule.html | Meeting agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h | Trello: https://trello.com/b/5F0h9Hoe/keystone" | 23:03 | |
| -openstackstatus- NOTICE: Workarounds are in place for libcurl and similar dependency errors due to stale ubuntu mirroring, and for POST_FAILURE results stemming from runaway inode utilization on the logs site; feel free to recheck failing changes for either of these problems now | 23:03 | |
| *** panbalag has joined #openstack-keystone | 23:13 | |
| *** panbalag has quit IRC | 23:21 | |
| *** wes_dillingham has quit IRC | 23:29 | |
| *** mvk has quit IRC | 23:36 | |
| *** thorst has joined #openstack-keystone | 23:37 | |
| *** wes_dillingham has joined #openstack-keystone | 23:37 | |
| *** aojea has joined #openstack-keystone | 23:39 | |
| *** thorst has quit IRC | 23:42 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 23:42 | |
| *** aojea has quit IRC | 23:44 | |
| *** markvoelker has quit IRC | 23:46 | |
| *** AlexeyAbashkin has quit IRC | 23:46 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!