| *** lbragstad has joined #openstack-keystone | 00:14 | |
| *** ChanServ sets mode: +o lbragstad | 00:14 | |
| *** hemna has quit IRC | 00:55 | |
| *** hemna has joined #openstack-keystone | 01:01 | |
| *** gongysh has joined #openstack-keystone | 01:29 | |
| *** gongysh has quit IRC | 03:03 | |
| *** rcernin has quit IRC | 03:08 | |
| *** harlowja has joined #openstack-keystone | 03:11 | |
| *** harlowja has quit IRC | 03:18 | |
| *** dave-mccowan has quit IRC | 03:20 | |
| *** jgwentworth is now known as melwitt | 03:26 | |
| *** annp has joined #openstack-keystone | 03:40 | |
| *** rcernin has joined #openstack-keystone | 04:04 | |
| *** bhagyashris has quit IRC | 04:22 | |
| *** daidv has joined #openstack-keystone | 04:31 | |
| openstackgerrit | Merged openstack/oslo.policy master: Updated from global requirements https://review.openstack.org/537146 | 04:32 |
|---|---|---|
| *** bhagyashris has joined #openstack-keystone | 04:33 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 05:06 | |
| *** AlexeyAbashkin has quit IRC | 05:10 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 05:31 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Delete tokens from DB is not required in case of Fernet. https://review.openstack.org/537322 | 05:39 |
| *** AlexeyAbashkin has quit IRC | 05:46 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 06:17 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 06:37 | |
| Dinesh_Bhor | cmurphy: Hi, you there? | 06:40 |
| Dinesh_Bhor | cmurphy: I want to discuss about this: https://review.openstack.org/#/c/267456/ | 06:41 |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone master: Use native Zuul v3 tox job https://review.openstack.org/537787 | 06:50 |
| *** rarora has joined #openstack-keystone | 06:58 | |
| *** Dinesh_Bhor has quit IRC | 07:10 | |
| *** rcernin has quit IRC | 07:11 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:11 | |
| *** namnh has joined #openstack-keystone | 07:21 | |
| *** Dinesh_Bhor has quit IRC | 07:23 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:25 | |
| *** Dinesh_Bhor has quit IRC | 07:34 | |
| *** hoonetorg has quit IRC | 07:35 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:36 | |
| *** Dinesh_Bhor has quit IRC | 07:38 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:39 | |
| *** pcaruana has joined #openstack-keystone | 07:44 | |
| *** Supun has joined #openstack-keystone | 07:44 | |
| *** Dinesh_Bhor has quit IRC | 07:45 | |
| *** belmoreira has joined #openstack-keystone | 07:47 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:50 | |
| *** hoonetorg has joined #openstack-keystone | 07:52 | |
| *** AlexeyAbashkin has quit IRC | 07:55 | |
| *** gongysh has joined #openstack-keystone | 08:03 | |
| *** gongysh has quit IRC | 08:08 | |
| *** links has joined #openstack-keystone | 08:09 | |
| *** Supun has quit IRC | 08:22 | |
| *** d0ugal has quit IRC | 08:22 | |
| *** tesseract has joined #openstack-keystone | 08:26 | |
| *** d0ugal has joined #openstack-keystone | 08:27 | |
| *** Dinesh_Bhor has quit IRC | 08:29 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:35 | |
| *** AlexeyAbashkin has quit IRC | 08:40 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 08:41 | |
| *** masber has quit IRC | 08:41 | |
| *** masber has joined #openstack-keystone | 08:42 | |
| *** Dinesh_Bhor has quit IRC | 08:46 | |
| *** aloga has quit IRC | 08:49 | |
| *** aloga has joined #openstack-keystone | 08:49 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 08:50 | |
| *** belmorei_ has joined #openstack-keystone | 08:52 | |
| *** Dinesh_Bhor has quit IRC | 08:52 | |
| *** belmoreira has quit IRC | 08:53 | |
| *** d0ugal has quit IRC | 09:00 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 09:06 | |
| cmurphy | Dinesh_Bhor: I'm here now | 09:10 |
| Dinesh_Bhor | cmurphy: about this: https://review.openstack.org/#/c/267456/ | 09:11 |
| Dinesh_Bhor | cmurphy: do you want me to combine all three patches into one? That will be difficult for review. | 09:11 |
| cmurphy | Dinesh_Bhor: no I wouldn't combine them, I just wasn't sure if the other two were needed if the functionality existed in the base classes | 09:12 |
| cmurphy | Dinesh_Bhor: if they are needed then that's fine | 09:13 |
| Dinesh_Bhor | cmurphy: yes, those are required. | 09:13 |
| cmurphy | Dinesh_Bhor: okay then I can take a look | 09:14 |
| cmurphy | Dinesh_Bhor: part of my confusion was that the commit message listed a bunch of files that weren't being touched so i wasn't sure whether it was out of date | 09:15 |
| Dinesh_Bhor | cmurphy: yeah, actually. Some of the v3 API's are getting covered in base patch itself. But this patch is specifically for v3 so I have made changes to the remaining API's and added test cases for all v3 API's including the API's covered in base patch. | 09:17 |
| cmurphy | Dinesh_Bhor: maybe those test cases should go into the base patch then? | 09:18 |
| cmurphy | or at least that could be explained in the commit message | 09:18 |
| Dinesh_Bhor | cmurphy: okay. understood. I will update the commit message. | 09:19 |
| *** vish_18 has joined #openstack-keystone | 09:20 | |
| *** d0ugal has joined #openstack-keystone | 09:20 | |
| cmurphy | thanks! | 09:20 |
| Dinesh_Bhor | cmurphy: Thank you for your time. | 09:20 |
| cmurphy | no problem | 09:20 |
| *** AlexeyAbashkin has joined #openstack-keystone | 09:22 | |
| *** Dinesh_Bhor has quit IRC | 09:42 | |
| *** Supun has joined #openstack-keystone | 09:42 | |
| *** Supun has quit IRC | 09:47 | |
| *** aloga has quit IRC | 09:52 | |
| *** aloga has joined #openstack-keystone | 09:52 | |
| *** namnh has quit IRC | 10:09 | |
| *** namnh has joined #openstack-keystone | 10:09 | |
| *** AlexeyAbashkin has quit IRC | 10:13 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 10:13 | |
| *** threestrands_ has joined #openstack-keystone | 10:33 | |
| *** Supun has joined #openstack-keystone | 10:35 | |
| *** threestrands has quit IRC | 10:36 | |
| *** jappleii__ has joined #openstack-keystone | 10:37 | |
| *** jappleii__ has quit IRC | 10:38 | |
| *** jappleii__ has joined #openstack-keystone | 10:39 | |
| *** Neptu_ has joined #openstack-keystone | 10:39 | |
| *** threestrands_ has quit IRC | 10:41 | |
| *** belmorei_ has quit IRC | 10:46 | |
| *** jaosorior has joined #openstack-keystone | 10:52 | |
| *** namnh has quit IRC | 10:52 | |
| *** annp has quit IRC | 11:01 | |
| -openstackstatus- NOTICE: Zuul is currently under heavy load. Do not *recheck* or *approve* any changes. | 11:03 | |
| *** AlexeyAbashkin has quit IRC | 11:23 | |
| *** sambetts|afk is now known as sambetts| | 11:24 | |
| *** sambetts| is now known as sambetts | 11:24 | |
| *** bhagyashri_s has joined #openstack-keystone | 11:50 | |
| *** dklyle has quit IRC | 11:52 | |
| *** bhagyashris has quit IRC | 11:53 | |
| *** david-lyle has joined #openstack-keystone | 11:53 | |
| *** raildo has joined #openstack-keystone | 11:54 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 11:59 | |
| *** bhagyashri_s has quit IRC | 12:01 | |
| *** bhagyashris has joined #openstack-keystone | 12:02 | |
| *** mvk has quit IRC | 12:02 | |
| *** belmoreira has joined #openstack-keystone | 12:05 | |
| *** panbalag has joined #openstack-keystone | 12:06 | |
| *** panbalag has left #openstack-keystone | 12:07 | |
| *** mvenesio has joined #openstack-keystone | 12:57 | |
| *** mvk has joined #openstack-keystone | 13:17 | |
| -openstackstatus- NOTICE: Zuul is currently under heavy load. Do not *recheck* or *approve* any changes until we give the go ahead. | 13:32 | |
| *** ChanServ changes topic to "Zuul is currently under heavy load. Do not *recheck* or *approve* any changes until we give the go ahead." | 13:32 | |
| *** d0ugal has quit IRC | 13:38 | |
| *** d0ugal has joined #openstack-keystone | 13:38 | |
| *** edmondsw has joined #openstack-keystone | 13:41 | |
| *** ayoung has joined #openstack-keystone | 14:14 | |
| *** david-lyle has quit IRC | 14:15 | |
| *** r-daneel has joined #openstack-keystone | 14:20 | |
| *** edmondsw has quit IRC | 14:25 | |
| lbragstad | o/ | 14:28 |
| *** superdan is now known as dansmith | 14:28 | |
| *** dave-mccowan has joined #openstack-keystone | 14:28 | |
| *** edmondsw has joined #openstack-keystone | 14:28 | |
| *** belmorei_ has joined #openstack-keystone | 14:29 | |
| -openstackstatus- NOTICE: we've been able to restart zuul, and re-enqueue changes for gate. Please hold off on recheck or approves, we are still recovering. More info shortly. | 14:29 | |
| cmurphy | \o see notice ^ don't recheck things yet | 14:30 |
| *** belmoreira has quit IRC | 14:32 | |
| *** dave-mccowan has quit IRC | 14:33 | |
| *** dave-mccowan has joined #openstack-keystone | 14:34 | |
| lbragstad | nice | 14:36 |
| lbragstad | i was just checking the queue and it looked like the application credential stuff was just about start gate jobs | 14:36 |
| cmurphy | it was just reenqueued | 14:40 |
| cmurphy | it's been trying to run gate jobs for a long time now :( | 14:40 |
| *** daidv has quit IRC | 14:49 | |
| *** daidv has joined #openstack-keystone | 14:49 | |
| lbragstad | yeah... i saw that over the weekend | 14:50 |
| lbragstad | that patch series just can't seem to catch a break :) | 14:50 |
| *** mvenesio has quit IRC | 14:55 | |
| *** spilla has joined #openstack-keystone | 14:59 | |
| *** r-daneel_ has joined #openstack-keystone | 15:02 | |
| *** r-daneel has quit IRC | 15:04 | |
| *** r-daneel_ is now known as r-daneel | 15:04 | |
| knikolla | o/ | 15:06 |
| *** r-daneel has quit IRC | 15:11 | |
| *** r-daneel has joined #openstack-keystone | 15:11 | |
| *** gus has quit IRC | 15:13 | |
| *** gus has joined #openstack-keystone | 15:14 | |
| gagehugo | o/ | 15:17 |
| *** bhagyashris has quit IRC | 15:21 | |
| *** bhagyashris has joined #openstack-keystone | 15:21 | |
| *** Supun has quit IRC | 15:22 | |
| *** Supun has joined #openstack-keystone | 15:25 | |
| *** mylu has joined #openstack-keystone | 15:33 | |
| *** r-daneel_ has joined #openstack-keystone | 15:39 | |
| *** r-daneel has quit IRC | 15:40 | |
| *** r-daneel_ is now known as r-daneel | 15:40 | |
| *** bhagyashris has quit IRC | 15:40 | |
| *** bhagyashris has joined #openstack-keystone | 15:50 | |
| *** mylu has quit IRC | 15:53 | |
| *** mylu has joined #openstack-keystone | 15:55 | |
| *** david-lyle has joined #openstack-keystone | 15:56 | |
| *** phalmos has joined #openstack-keystone | 15:57 | |
| *** spilla has quit IRC | 15:59 | |
| *** spilla has joined #openstack-keystone | 15:59 | |
| *** belmorei_ has quit IRC | 15:59 | |
| *** tesseract has quit IRC | 16:03 | |
| *** jappleii__ has quit IRC | 16:05 | |
| *** jmlowe_ has quit IRC | 16:07 | |
| *** jmlowe has joined #openstack-keystone | 16:07 | |
| *** phalmos has quit IRC | 16:11 | |
| *** mylu has quit IRC | 16:17 | |
| *** links has quit IRC | 16:20 | |
| *** ChanServ changes topic to "Queens release schedule: https://releases.openstack.org/queens/schedule.html | Meeting agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h | Trello: https://trello.com/b/5F0h9Hoe/keystone" | 16:21 | |
| -openstackstatus- NOTICE: zuul.o.o is back online, feel free to recheck / approve patches. | 16:21 | |
| lbragstad | cc gagehugo cmurphy knikolla ^ | 16:25 |
| gagehugo | woo | 16:25 |
| cmurphy | i think there's nothing in dire need of rechecking | 16:25 |
| *** pcaruana has quit IRC | 16:25 | |
| *** phalmos has joined #openstack-keystone | 16:30 | |
| *** rmcall has joined #openstack-keystone | 16:31 | |
| knikolla | cmurphy: do you know if the trusted_dashboard option allows a hostname or a wildcard instead of a very specific url? | 16:42 |
| *** phalmos has quit IRC | 16:42 | |
| cmurphy | knikolla: i don't think so | 16:43 |
| *** jose-phillips has quit IRC | 16:43 | |
| knikolla | cmurphy: argh... i wanted to use https://hostname/invitations/<uuid_of_invitation>. guess i'll have to use sessions. | 16:44 |
| *** jose-phillips has joined #openstack-keystone | 16:45 | |
| *** tesseract has joined #openstack-keystone | 16:47 | |
| cmurphy | knikolla: yeah i'm not 100% sure but in my experience it was pretty picky and stupid | 16:48 |
| cmurphy | you could try it, it'll be pretty obvious if it's not working | 16:48 |
| *** ayoung has quit IRC | 16:57 | |
| *** aojea_ has joined #openstack-keystone | 17:07 | |
| *** aojea__ has joined #openstack-keystone | 17:13 | |
| *** phalmos has joined #openstack-keystone | 17:15 | |
| *** aojea_ has quit IRC | 17:16 | |
| *** aojea has joined #openstack-keystone | 17:18 | |
| *** Supun has quit IRC | 17:20 | |
| *** aojea__ has quit IRC | 17:21 | |
| *** Supun has joined #openstack-keystone | 17:21 | |
| *** r-daneel_ has joined #openstack-keystone | 17:21 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add scope_types for user policies https://review.openstack.org/526203 | 17:23 |
| *** r-daneel has quit IRC | 17:23 | |
| *** r-daneel_ is now known as r-daneel | 17:23 | |
| *** aojea_ has joined #openstack-keystone | 17:23 | |
| *** aojea has quit IRC | 17:26 | |
| *** phalmos has quit IRC | 17:26 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add functional testing gate https://review.openstack.org/531014 | 17:27 |
| *** aojea has joined #openstack-keystone | 17:28 | |
| *** gyee has joined #openstack-keystone | 17:29 | |
| *** aojea_ has quit IRC | 17:30 | |
| *** aojea_ has joined #openstack-keystone | 17:33 | |
| *** AlexeyAbashkin has quit IRC | 17:34 | |
| *** aojea has quit IRC | 17:36 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 17:37 | |
| *** aojea has joined #openstack-keystone | 17:38 | |
| *** aojea_ has quit IRC | 17:40 | |
| *** AlexeyAbashkin has quit IRC | 17:41 | |
| *** Supun has quit IRC | 17:41 | |
| *** mvenesio has joined #openstack-keystone | 17:42 | |
| *** Supun has joined #openstack-keystone | 17:42 | |
| *** aojea_ has joined #openstack-keystone | 17:43 | |
| *** aojea has quit IRC | 17:46 | |
| *** aojea has joined #openstack-keystone | 17:49 | |
| lbragstad | breaking for lunch quick | 17:50 |
| *** aojea_ has quit IRC | 17:52 | |
| *** aojea_ has joined #openstack-keystone | 17:53 | |
| *** mvk has quit IRC | 17:56 | |
| *** aojea has quit IRC | 17:56 | |
| *** aojea__ has joined #openstack-keystone | 18:01 | |
| *** sambetts is now known as sambetts|afk | 18:01 | |
| *** aojea_ has quit IRC | 18:02 | |
| *** phalmos has joined #openstack-keystone | 18:03 | |
| *** aojea_ has joined #openstack-keystone | 18:06 | |
| *** phalmos has quit IRC | 18:09 | |
| *** aojea__ has quit IRC | 18:09 | |
| *** david-lyle has quit IRC | 18:09 | |
| *** aojea has joined #openstack-keystone | 18:12 | |
| *** aojea_ has quit IRC | 18:14 | |
| *** aojea_ has joined #openstack-keystone | 18:16 | |
| *** rmcall has quit IRC | 18:17 | |
| *** rmcall has joined #openstack-keystone | 18:18 | |
| *** aojea has quit IRC | 18:19 | |
| *** aojea has joined #openstack-keystone | 18:22 | |
| *** AJaeger has joined #openstack-keystone | 18:24 | |
| AJaeger | keystone cores, a simple Zuul jobs change for you - could I get a second core review, please? https://review.openstack.org/#/c/538397 | 18:25 |
| *** aojea_ has quit IRC | 18:25 | |
| AJaeger | Sorry, I meant https://review.openstack.org/#/c/537787 | 18:25 |
| *** aojea_ has joined #openstack-keystone | 18:27 | |
| lbragstad | AJaeger: dome | 18:27 |
| lbragstad | done* | 18:27 |
| AJaeger | thanks, lbragstad | 18:27 |
| lbragstad | AJaeger: no problem - thanks for the ping | 18:28 |
| *** efried is now known as efried_hexchat | 18:29 | |
| *** aojea has quit IRC | 18:29 | |
| *** aojea__ has joined #openstack-keystone | 18:32 | |
| *** r-daneel_ has joined #openstack-keystone | 18:33 | |
| *** henrynash has joined #openstack-keystone | 18:34 | |
| *** r-daneel has quit IRC | 18:34 | |
| *** mvk has joined #openstack-keystone | 18:35 | |
| *** aojea_ has quit IRC | 18:35 | |
| *** r-daneel has joined #openstack-keystone | 18:37 | |
| *** spzala has joined #openstack-keystone | 18:37 | |
| *** spzala has quit IRC | 18:37 | |
| *** aojea_ has joined #openstack-keystone | 18:37 | |
| *** r-daneel_ has quit IRC | 18:38 | |
| *** jose-phillips has quit IRC | 18:40 | |
| *** aojea__ has quit IRC | 18:40 | |
| *** aojea__ has joined #openstack-keystone | 18:42 | |
| *** AJaeger has left #openstack-keystone | 18:44 | |
| *** aojea_ has quit IRC | 18:44 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Document flat limit enforcement model https://review.openstack.org/538322 | 18:45 |
| *** aojea_ has joined #openstack-keystone | 18:47 | |
| *** jaosorior has quit IRC | 18:48 | |
| *** aojea__ has quit IRC | 18:50 | |
| *** aojea_ has quit IRC | 18:50 | |
| *** rmcall has quit IRC | 19:08 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 19:11 | |
| *** phalmos has joined #openstack-keystone | 19:12 | |
| *** rmcall has joined #openstack-keystone | 19:13 | |
| lbragstad | cmurphy: are you actively investigating https://bugs.launchpad.net/keystone/+bug/1746016 ? | 19:14 |
| openstack | Launchpad bug 1746016 in OpenStack Identity (keystone) "unit test jobs sometimes time out" [High,New] | 19:14 |
| cmurphy | lbragstad: yes and no, I've been looking at it but i have no idea what's going on | 19:15 |
| cmurphy | need to try to rope in some QA people to help | 19:15 |
| lbragstad | oh - interesting... | 19:15 |
| lbragstad | is this what you were referencing in the bug - http://logs.openstack.org/33/530133/13/check/openstack-tox-py27/d6560ad/job-output.txt.gz#_2018-01-27_14_26_31_625384 ? | 19:16 |
| cmurphy | lbragstad: yeah | 19:16 |
| cmurphy | it seems like everything's going great and then it just halts for no reason and then dies | 19:16 |
| lbragstad | that's a good 35 minutes... | 19:16 |
| cmurphy | it's not helping us get things merged faster | 19:16 |
| lbragstad | right | 19:17 |
| *** edmondsw has quit IRC | 19:23 | |
| *** harlowja has joined #openstack-keystone | 19:25 | |
| *** david-lyle has joined #openstack-keystone | 19:27 | |
| *** tesseract has quit IRC | 19:31 | |
| *** cfriesen has joined #openstack-keystone | 19:31 | |
| *** henrynash has quit IRC | 19:31 | |
| lbragstad | cfriesen: o/ | 19:32 |
| cfriesen | o/ | 19:32 |
| lbragstad | yeah - so jamielennox was the one driving a bunch of the service token work | 19:32 |
| lbragstad | cmurphy: hrybacki do we know if anyone was trying to pick up those efforts (or if there was anything to pick up?) | 19:33 |
| cmurphy | lbragstad: i recall lamt was going to pick up some ksm work but i don't recall whether that included service token stuff | 19:33 |
| lbragstad | cmurphy: ok - yeah, that's what i remember, too | 19:34 |
| lbragstad | cmurphy: cfriesen has an interesting service token case.. but i'm not sure anyone outside of jamielennox would have thought that far ahead? | 19:34 |
| lbragstad | cfriesen: do you wanna describe what you're trying to do? | 19:34 |
| hrybacki | lbragstad: no I wasn't tracking that -- I assumed he'd removed all his commitments awhile back | 19:35 |
| cfriesen | Sure...the scenario I'm trying to solve is that the glance v2 API doesn't allow users to modify the location of an image by default. (You can turn on a setting to allow it, but it's got security warnings around it.) | 19:35 |
| cfriesen | What I'd like to do is figure out a way for glance to allow this operation if the request comes from nova, but to disallow it for normal users. | 19:36 |
| lbragstad | cfriesen: do you know how glance makes that check? | 19:36 |
| cfriesen | One of the glance folks suggested it might be possible to use service tokens for this, in order to ensure that the request came from an openstack service. | 19:36 |
| cfriesen | lbragstad: Right now glance just checks a config option to decide whether it's allowed or not. | 19:37 |
| * lbragstad grabs a copy of glance's code | 19:37 | |
| *** phalmos has quit IRC | 19:37 | |
| cfriesen | api/v2/images.py, _do_add_locations() | 19:38 |
| *** phalmos has joined #openstack-keystone | 19:39 | |
| lbragstad | show_multiple_locations ? | 19:39 |
| cfriesen | yes, it's kind of overloaded. | 19:40 |
| cfriesen | there's a separate conf option to determine whether a single location is visible to the user. | 19:41 |
| lbragstad | got it | 19:41 |
| lbragstad | i'm trying to find out where in the API that is wired up.. | 19:42 |
| cfriesen | The current code path on the nova side is to create the image with no location, do some ceph stuff directly, then update the image with the location within ceph. This worked with glance v1 API, but fails with v2. | 19:42 |
| cfriesen | lbragstad: it's part of the image update call | 19:42 |
| lbragstad | aha | 19:43 |
| lbragstad | i was thinking if it was a somewhat specific/isolated API, you could create a specific role and map that to the glance policy that protects that API | 19:43 |
| lbragstad | then you'd give that role to the nova service user | 19:44 |
| lbragstad | but if users use that same glance API to do other image update operations that might be a bit tough... | 19:45 |
| lbragstad | that's neither here nor there with service tokens, i gues | 19:45 |
| lbragstad | otherwise, it looks like glance might have to incorporate some code to check token specific to see if it actually came from a service, or nova) | 19:52 |
| *** phalmos has quit IRC | 19:53 | |
| cfriesen | interestingly, glance does have a "set image location" policy, but it applies to any time the location is set, including on initial creation. | 19:54 |
| cfriesen | as far as checking the context for service token information, is there enough information currently guaranteed by the keystone APIs to check the service token even if it wasn't needed to deal with user token expiry? | 19:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Document flat limit enforcement model https://review.openstack.org/538322 | 19:55 |
| lbragstad | cfriesen: well - the token expiry case is handled mostly on the client side and only had a couple changes to keystone server | 19:57 |
| *** phalmos has joined #openstack-keystone | 19:57 | |
| lbragstad | technically, a service token is the same as a token used by non-service users | 19:57 |
| lbragstad | the tricky bit with that specific case was that we extended keystone validate_token API so that service tokens could be used to validate other tokens in the deployment (and even expired tokens0 | 19:58 |
| *** jose-phillips has joined #openstack-keystone | 19:59 | |
| lbragstad | https://github.com/openstack/keystone/blob/7921249ed7b5fc3d9b43a05055dcd20793b831d2/keystone/common/policies/token.py#L26 | 20:00 |
| lbragstad | and https://github.com/openstack/keystone/blob/7921249ed7b5fc3d9b43a05055dcd20793b831d2/keystone/common/policies/base.py#L56 | 20:00 |
| lbragstad | keystone detects if a user is a "service user" based on the role assignment - https://github.com/openstack/keystone/blob/7921249ed7b5fc3d9b43a05055dcd20793b831d2/keystone/common/policies/base.py#L38-L40 | 20:01 |
| cfriesen | presumably glance could extract the service token from the context, validate it with keystone, and check the role assignment? | 20:02 |
| *** pramodrj07 has joined #openstack-keystone | 20:04 | |
| lbragstad | yeah... that would be one way to do it | 20:07 |
| lbragstad | the values of the context might have some information | 20:07 |
| lbragstad | regarding role assignments | 20:07 |
| lbragstad | that part that gets muddy is that both glance and keystone would be duplicating the mapping of what a service user is | 20:08 |
| cfriesen | I suppose we might be able to tighten it down so only a glance-configured username (ie "nova") is allowed to set image locations. seems a bit special-case-y though. | 20:09 |
| lbragstad | yeah - i agree | 20:09 |
| lbragstad | we're working on building out the system scope stuff in keystone, and I feel like that might help this case | 20:09 |
| lbragstad | something glance might consider doing is create a new policy for that specific API | 20:10 |
| lbragstad | and make a system-scoped operation | 20:10 |
| lbragstad | and make it a * | 20:11 |
| lbragstad | then, in order for nova to execute it, the operator would have to give nova a role on the system | 20:11 |
| lbragstad | and we'd have to teach nova to get a system scoped token when making that call to glance | 20:11 |
| lbragstad | so - the API would be exposed via glance, but it would be locked down so only system users can actually call it | 20:12 |
| lbragstad | (people using project-scoped tokens wouldn't be able to actually invoke the API directly through glance) | 20:12 |
| cfriesen | would it make sense to make all service tokens be system scope? | 20:13 |
| lbragstad | good question... it really depends on what the service needs | 20:13 |
| lbragstad | or what the service needs to do with other services | 20:13 |
| lbragstad | if nova needs a list of all volumes in a specific project from cinder, then a project-scoped token for the project in question seems to make sense | 20:14 |
| lbragstad | but if nova wants to update an image location (which seems like a system level thing) it would use a system scoped token | 20:14 |
| cfriesen | sounds reasonable. okay, this gives me some good info for my immediate issue. thanks a bunch. | 20:15 |
| *** rmascena has joined #openstack-keystone | 20:15 | |
| lbragstad | cfriesen: yep - anytime, i'm hoping to get more involved, especially with nova and trying to get some of this making sense from a service level | 20:16 |
| lbragstad | certainly open to more feedback/options if you come up with any | 20:16 |
| *** raildo has quit IRC | 20:18 | |
| *** ayoung has joined #openstack-keystone | 20:21 | |
| *** AlexeyAbashkin has quit IRC | 20:25 | |
| *** jose-phillips has quit IRC | 20:25 | |
| *** edmondsw has joined #openstack-keystone | 20:30 | |
| *** edmondsw has quit IRC | 20:32 | |
| *** edmondsw_ has joined #openstack-keystone | 20:32 | |
| cfriesen | lbragstad: just blue-skying here, but I wonder if a "does this context have a valid system-scoped token" operation might be useful. | 20:32 |
| *** jose-phillips has joined #openstack-keystone | 20:38 | |
| *** jose-phillips has quit IRC | 20:50 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Move fernet specific doctor checks into tokens https://review.openstack.org/527527 | 20:57 |
| *** mvenesio has quit IRC | 21:11 | |
| *** rmascena has quit IRC | 21:12 | |
| *** mvenesio has joined #openstack-keystone | 21:12 | |
| *** mvenesio has quit IRC | 21:16 | |
| *** Supun has quit IRC | 21:18 | |
| *** aojea_ has joined #openstack-keystone | 21:22 | |
| *** aojea__ has joined #openstack-keystone | 21:27 | |
| *** aojea_ has quit IRC | 21:29 | |
| *** spilla has quit IRC | 21:31 | |
| *** aojea has joined #openstack-keystone | 21:33 | |
| *** r-daneel has quit IRC | 21:33 | |
| *** r-daneel has joined #openstack-keystone | 21:33 | |
| *** aojea__ has quit IRC | 21:35 | |
| *** aojea_ has joined #openstack-keystone | 21:37 | |
| lbragstad | cfriesen: would that be something keystone determines or oslo.context? | 21:39 |
| lbragstad | or oslo.context just relays that information from keystone somehow | 21:39 |
| lbragstad | hrybacki: i threw us down on the agenda for tomorrows meeting to go through the trello updates as a team | 21:40 |
| *** aojea has quit IRC | 21:40 | |
| hrybacki | perfect, thanks lbragstad | 21:40 |
| *** spilla has joined #openstack-keystone | 21:41 | |
| *** aojea has joined #openstack-keystone | 21:43 | |
| *** aojea_ has quit IRC | 21:45 | |
| *** aojea_ has joined #openstack-keystone | 21:48 | |
| *** aojea has quit IRC | 21:50 | |
| cfriesen | lbragstad: I'm not opinionated. :) I'm just thinking of what the services might ultimately care about. | 21:52 |
| *** aojea has joined #openstack-keystone | 21:52 | |
| lbragstad | cfriesen: yeah - i think this is all eluding to the need for a service to service communication session | 21:54 |
| lbragstad | added it to our planning etherpad - https://etherpad.openstack.org/p/keystone-rocky-ptg | 21:54 |
| lbragstad | we'll start shaping up the schedule for that week soon, but likely monday or tuesday we can all sit down and go through some of that | 21:54 |
| *** aojea_ has quit IRC | 21:55 | |
| *** aojea_ has joined #openstack-keystone | 21:58 | |
| *** aojea has quit IRC | 22:01 | |
| *** aojea_ has quit IRC | 22:04 | |
| cfriesen | cool | 22:04 |
| *** threestrands has joined #openstack-keystone | 22:05 | |
| *** threestrands has quit IRC | 22:05 | |
| *** threestrands has joined #openstack-keystone | 22:05 | |
| lbragstad | we might be about an hour away from merging the application credential chain | 22:06 |
| * lbragstad cross fingers | 22:06 | |
| *** threestrands_ has joined #openstack-keystone | 22:07 | |
| cmurphy | you're optimistic | 22:08 |
| *** threestrands has quit IRC | 22:08 | |
| *** threestrands_ has quit IRC | 22:08 | |
| * lbragstad crosses toes, too | 22:08 | |
| cmurphy | :) | 22:08 |
| *** threestrands has joined #openstack-keystone | 22:08 | |
| *** threestrands has quit IRC | 22:08 | |
| *** threestrands has joined #openstack-keystone | 22:08 | |
| lbragstad | cmurphy: for being one of the first features done this release, its been a long road for that series | 22:09 |
| cmurphy | yeah :( | 22:09 |
| lbragstad | sorry cmurphy | 22:09 |
| cmurphy | heh no worries | 22:09 |
| *** dtruong has quit IRC | 22:13 | |
| *** henrynash has joined #openstack-keystone | 22:15 | |
| lbragstad | whoa - we have a henrynash! | 22:20 |
| lbragstad | good evening, sir :) | 22:20 |
| henrynash | …delurking... | 22:20 |
| henrynash | hi there | 22:20 |
| lbragstad | how goes it? | 22:20 |
| *** threestrands_ has joined #openstack-keystone | 22:21 | |
| henrynash | good…just got back from a long vacation, so renewed, reinvigorated, etc. etc. | 22:21 |
| lbragstad | that sounds nice | 22:21 |
| lbragstad | are we going to be lucky enough to see you in dublin? | 22:21 |
| henrynash | not sure yet…do we haeva. schedule for whcih days the keystone sessions are on? | 22:22 |
| lbragstad | we have a list of topics that we'll probably start shaping into a schedule later this week | 22:22 |
| lbragstad | but it will be the usual format | 22:22 |
| lbragstad | cross-project stuff monday and tuesday | 22:23 |
| lbragstad | project specific things wednesday - friday | 22:23 |
| lbragstad | https://etherpad.openstack.org/p/keystone-rocky-ptg | 22:23 |
| *** threestrands has quit IRC | 22:23 | |
| henrynash | ah, that sounds good…that mught work since I need to be in the UK on Tuesday, so could make it out for, say, Wednesday and Thursday (Or something like that) | 22:23 |
| lbragstad | that'd be cool | 22:24 |
| lbragstad | it'd be great to have you there | 22:24 |
| henrynash | ok, I’ll work on that | 22:24 |
| henrynash | meanwhile, I’ll try and be a review-bot for the coming weeks | 22:24 |
| lbragstad | thanks for all the reviews btw | 22:25 |
| henrynash | np | 22:25 |
| *** edmondsw_ is now known as edmondsw | 22:26 | |
| *** dave-mccowan has quit IRC | 22:31 | |
| *** rmcall has quit IRC | 22:31 | |
| *** jappleii__ has joined #openstack-keystone | 22:35 | |
| *** jappleii__ has quit IRC | 22:36 | |
| *** jappleii__ has joined #openstack-keystone | 22:37 | |
| *** threestrands_ has quit IRC | 22:37 | |
| *** jose-phillips has joined #openstack-keystone | 22:41 | |
| *** mylu has joined #openstack-keystone | 22:42 | |
| *** mylu has quit IRC | 22:46 | |
| *** rcernin has joined #openstack-keystone | 22:46 | |
| *** mylu has joined #openstack-keystone | 22:46 | |
| *** mylu has quit IRC | 22:50 | |
| *** spilla has quit IRC | 22:56 | |
| *** phalmos_ has joined #openstack-keystone | 22:56 | |
| *** phalmos has quit IRC | 22:59 | |
| *** dtruong has joined #openstack-keystone | 23:04 | |
| *** edmondsw has quit IRC | 23:06 | |
| *** edmondsw has joined #openstack-keystone | 23:20 | |
| *** logan- has quit IRC | 23:45 | |
| *** errr has quit IRC | 23:45 | |
| *** jlvillal has quit IRC | 23:45 | |
| *** zeus has quit IRC | 23:45 | |
| *** jistr has quit IRC | 23:45 | |
| *** r-daneel has quit IRC | 23:45 | |
| *** edmondsw has quit IRC | 23:46 | |
| *** edmondsw has joined #openstack-keystone | 23:47 | |
| *** freerunner has quit IRC | 23:48 | |
| *** freerunner has joined #openstack-keystone | 23:51 | |
| *** logan- has joined #openstack-keystone | 23:51 | |
| *** errr has joined #openstack-keystone | 23:51 | |
| *** jlvillal has joined #openstack-keystone | 23:51 | |
| *** zeus has joined #openstack-keystone | 23:51 | |
| *** jistr has joined #openstack-keystone | 23:51 | |
| *** mylu has joined #openstack-keystone | 23:51 | |
| *** edmondsw has quit IRC | 23:51 | |
| *** dave-mccowan has joined #openstack-keystone | 23:52 | |
| *** sapd_ has quit IRC | 23:57 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!