| openstackgerrit | Merged openstack/keystonemiddleware master: fix tox python3 overrides https://review.openstack.org/572907 | 00:00 |
|---|---|---|
| *** bigdogstl has joined #openstack-keystone | 00:15 | |
| *** bigdogstl has quit IRC | 00:23 | |
| *** threestrands has quit IRC | 00:25 | |
| *** jmlowe has quit IRC | 00:26 | |
| *** jmlowe has joined #openstack-keystone | 00:27 | |
| *** threestrands has joined #openstack-keystone | 00:28 | |
| *** liuzz has joined #openstack-keystone | 01:00 | |
| *** itlinux has joined #openstack-keystone | 01:00 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:04 | |
| *** eEbx has quit IRC | 01:08 | |
| *** eEbx has joined #openstack-keystone | 01:08 | |
| *** felipemonteiro has joined #openstack-keystone | 01:12 | |
| sapd | lbragstad: I have same result, But when use `time` command I get real time. http://paste.openstack.org/show/722844/ | 01:14 |
| *** felipemonteiro_ has joined #openstack-keystone | 01:14 | |
| *** felipemonteiro has quit IRC | 01:18 | |
| *** felipemonteiro_ has quit IRC | 01:24 | |
| *** threestrands has quit IRC | 01:35 | |
| *** threestrands has joined #openstack-keystone | 01:35 | |
| *** threestrands has quit IRC | 01:36 | |
| *** threestrands has joined #openstack-keystone | 01:37 | |
| *** threestrands has quit IRC | 01:37 | |
| *** threestrands has joined #openstack-keystone | 01:37 | |
| *** threestrands has quit IRC | 01:38 | |
| *** threestrands has joined #openstack-keystone | 01:38 | |
| *** threestrands has quit IRC | 01:38 | |
| *** threestrands has joined #openstack-keystone | 01:38 | |
| *** threestrands has quit IRC | 01:39 | |
| *** threestrands has joined #openstack-keystone | 01:40 | |
| *** threestrands has quit IRC | 01:40 | |
| *** threestrands has joined #openstack-keystone | 01:40 | |
| *** threestrands has quit IRC | 01:41 | |
| *** edmondsw has joined #openstack-keystone | 01:42 | |
| *** edmondsw has quit IRC | 01:47 | |
| *** blake has quit IRC | 01:56 | |
| *** r-daneel has joined #openstack-keystone | 01:56 | |
| openstackgerrit | Merged openstack/oslo.policy master: fix tox python3 overrides https://review.openstack.org/572879 | 02:09 |
| *** threestrands has joined #openstack-keystone | 02:11 | |
| *** threestrands has quit IRC | 02:11 | |
| *** threestrands has joined #openstack-keystone | 02:11 | |
| *** d0ugal_ has joined #openstack-keystone | 02:49 | |
| *** d0ugal has quit IRC | 02:51 | |
| *** lifeless_ has joined #openstack-keystone | 03:03 | |
| *** lifeless has quit IRC | 03:03 | |
| *** boris_42_ has quit IRC | 03:05 | |
| *** threestrands has quit IRC | 03:13 | |
| *** edmondsw has joined #openstack-keystone | 03:30 | |
| *** sonuk has joined #openstack-keystone | 03:34 | |
| *** edmondsw has quit IRC | 03:35 | |
| *** germs has quit IRC | 03:37 | |
| *** germs has joined #openstack-keystone | 03:38 | |
| *** blake has joined #openstack-keystone | 03:57 | |
| *** blake has quit IRC | 04:02 | |
| *** blake has joined #openstack-keystone | 04:09 | |
| *** blake has quit IRC | 04:14 | |
| *** germs has quit IRC | 04:16 | |
| *** links has joined #openstack-keystone | 04:28 | |
| *** annp has joined #openstack-keystone | 04:29 | |
| *** blake has joined #openstack-keystone | 04:45 | |
| *** blake has quit IRC | 04:50 | |
| *** mvk has joined #openstack-keystone | 04:54 | |
| *** Dinesh_Bhor has quit IRC | 05:00 | |
| openstackgerrit | Merged openstack/keystone master: fix tox python3 overrides https://review.openstack.org/572963 | 05:12 |
| *** edmondsw has joined #openstack-keystone | 05:19 | |
| *** edmondsw has quit IRC | 05:23 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 05:30 | |
| *** Dinesh__Bhor has joined #openstack-keystone | 05:52 | |
| *** Dinesh_Bhor has quit IRC | 05:53 | |
| *** gyee has quit IRC | 05:53 | |
| *** pcichy has quit IRC | 05:54 | |
| *** pcichy has joined #openstack-keystone | 06:00 | |
| *** Dinesh__Bhor has quit IRC | 06:23 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 06:26 | |
| *** bigdogstl has joined #openstack-keystone | 06:29 | |
| *** dklyle has quit IRC | 06:29 | |
| *** namnh has joined #openstack-keystone | 06:31 | |
| *** bigdogstl has quit IRC | 06:33 | |
| *** pcaruana has joined #openstack-keystone | 06:35 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:04 | |
| *** edmondsw has joined #openstack-keystone | 07:07 | |
| openstackgerrit | melissaml proposed openstack/python-keystoneclient master: fix a typo in docstring https://review.openstack.org/573108 | 07:09 |
| *** edmondsw has quit IRC | 07:11 | |
| *** jistr|mtgs is now known as jistr | 07:22 | |
| *** Dinesh_Bhor has quit IRC | 07:26 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:31 | |
| *** dklyle has joined #openstack-keystone | 07:32 | |
| *** Alexey_Abashkin has joined #openstack-keystone | 07:34 | |
| *** AlexeyAbashkin has quit IRC | 07:35 | |
| *** Alexey_Abashkin is now known as AlexeyAbashkin | 07:35 | |
| *** AlexeyAbashkin has quit IRC | 07:46 | |
| *** jaosorior has joined #openstack-keystone | 07:52 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:56 | |
| *** jaosorior has quit IRC | 08:10 | |
| *** akovi has joined #openstack-keystone | 08:15 | |
| *** AlexeyAbashkin has quit IRC | 08:23 | |
| akovi | Hi keystone team! | 08:23 |
| akovi | I'm trying to solve this bug in Mistral https://bugs.launchpad.net/keystone/+bug/1775140 | 08:23 |
| openstack | Launchpad bug 1775140 in Mistral "Keystoneauth does not consistently add the collect-timing parameter" [Medium,Confirmed] - Assigned to Brad P. Crochet (brad-9) | 08:23 |
| akovi | Tried to follow the comment from @wangxiyuan but ran into issues | 08:24 |
| akovi | I tried to use register_session_conf_options, like this: | 08:25 |
| akovi | loading.register_session_conf_options(cfg.CONF, _base.AUTHTOKEN_GROUP) | 08:25 |
| akovi | The issue is that it tries to re-register the cafile option which fails as the access_control.py module uses keystonemiddleware that already initialized the options with `loading.register_auth_conf_options(cfg.CONF, _base.AUTHTOKEN_GROUP)`. What can I do here? | 08:25 |
| wxy | akovi: Hi I think you should register these options in a new section. Not keystone_authtoken | 08:26 |
| akovi | ah, ok | 08:26 |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:26 | |
| akovi | wxy: but this will imply configfile changes and code changes, right? | 08:27 |
| *** d0ugal_ has quit IRC | 08:29 | |
| *** d0ugal has joined #openstack-keystone | 08:29 | |
| *** d0ugal has quit IRC | 08:29 | |
| *** d0ugal has joined #openstack-keystone | 08:29 | |
| wxy | akovi: I think so. it means that these options will be separated from [keystone_authtoken] section. | 08:29 |
| *** AlexeyAbashkin has quit IRC | 08:33 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:38 | |
| *** AlexeyAbashkin has quit IRC | 08:45 | |
| *** jaosorior has joined #openstack-keystone | 08:54 | |
| *** edmondsw has joined #openstack-keystone | 08:55 | |
| *** edmondsw has quit IRC | 09:00 | |
| *** pooja-jadhav is now known as pooja_jadhav | 09:14 | |
| *** lifeless_ has quit IRC | 09:17 | |
| *** lifeless has joined #openstack-keystone | 09:18 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 09:31 | |
| yankcrime | ping knikolla, want to talk to you about https://github.com/CCI-MOC/ksproj as we're thinking about using it.... | 09:35 |
| *** links has quit IRC | 09:48 | |
| *** dklyle has quit IRC | 09:50 | |
| *** david-lyle has joined #openstack-keystone | 09:50 | |
| *** AlexeyAbashkin has quit IRC | 09:50 | |
| *** david-lyle has quit IRC | 09:52 | |
| *** dklyle has joined #openstack-keystone | 09:52 | |
| *** dklyle has quit IRC | 09:53 | |
| *** david-lyle has joined #openstack-keystone | 09:53 | |
| *** david-lyle has quit IRC | 09:53 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 10:02 | |
| *** dklyle has joined #openstack-keystone | 10:04 | |
| *** links has joined #openstack-keystone | 10:05 | |
| *** pcichy has quit IRC | 10:06 | |
| *** AlexeyAbashkin has quit IRC | 10:13 | |
| *** Alexey_Abashkin has joined #openstack-keystone | 10:13 | |
| *** namnh has quit IRC | 10:15 | |
| *** Alexey_Abashkin is now known as AlexeyAbashkin | 10:16 | |
| *** akovi has left #openstack-keystone | 10:16 | |
| *** Dinesh_Bhor has quit IRC | 10:17 | |
| d0ugal | wxy: Hey - if you have a moment can you let me know if this is a better fix? https://review.openstack.org/#/c/572300/ (You commented on the alternative: https://review.openstack.org/#/c/572788/ ) | 10:21 |
| d0ugal | oh, I see you spoke with akovi in here about it | 10:22 |
| * d0ugal reads the backlog | 10:22 | |
| d0ugal | It isn't clear to me which is the best direction - is seems like 572788 might be the safer fix. | 10:23 |
| *** AlexeyAbashkin has quit IRC | 10:23 | |
| breton | how is policy.v3cloudsample.json edited today - manually or it fetches policies from some python code? | 10:24 |
| *** AlexeyAbashkin has joined #openstack-keystone | 10:25 | |
| breton | i mean when i want so create a new review on gerrit | 10:26 |
| *** bigdogstl has joined #openstack-keystone | 10:29 | |
| *** bigdogstl has quit IRC | 10:34 | |
| wxy | d0ugal: yeah, 572788 is safer. Because the backwards compatibility should be considered in 572300 | 10:37 |
| *** Alexey_Abashkin has joined #openstack-keystone | 10:38 | |
| *** AlexeyAbashkin has quit IRC | 10:39 | |
| *** Alexey_Abashkin is now known as AlexeyAbashkin | 10:39 | |
| *** links has quit IRC | 10:39 | |
| d0ugal | wxy: Thanks for confirming. | 10:40 |
| *** edmondsw has joined #openstack-keystone | 10:43 | |
| *** edmondsw has quit IRC | 10:47 | |
| *** Anurag has joined #openstack-keystone | 10:54 | |
| *** Anurag has quit IRC | 10:54 | |
| *** Anurag has joined #openstack-keystone | 10:55 | |
| *** Anurag has quit IRC | 10:55 | |
| *** Anurag has joined #openstack-keystone | 10:56 | |
| *** Anurag has quit IRC | 10:56 | |
| *** links has joined #openstack-keystone | 10:56 | |
| *** Anurag has joined #openstack-keystone | 11:00 | |
| *** AlexeyAbashkin has quit IRC | 11:01 | |
| *** anurag has joined #openstack-keystone | 11:05 | |
| *** anurag has quit IRC | 11:13 | |
| knikolla | yankcrime: o/ | 11:18 |
| yankcrime | hi knikolla! | 11:19 |
| yankcrime | so johnthetubaguy came back from the vancouver summit having discovered ksproj, and it seems like an ideal fit for a project we're involved in | 11:20 |
| * johnthetubaguy nods | 11:20 | |
| yankcrime | i was just wondering what your plans are for it really, i can see it's being actively worked on still but there's a fair bit of stuff in there that's specific to the mass open cloud | 11:21 |
| yankcrime | is there anything we can do to help? | 11:21 |
| knikolla | yankcrime: plans are to make it a self-service project management tool for "project admins" | 11:21 |
| knikolla | currently it only has the invite feature | 11:21 |
| *** edmondsw has joined #openstack-keystone | 11:22 | |
| knikolla | i used it january-ish to invite a class of about 100 students to 10 or so projects | 11:22 |
| knikolla | but hasn't received a lot of love since then due to time constraints and other priorities | 11:23 |
| knikolla | i'd be happy if you could use it and we could beat it to shape together with both our use cases | 11:24 |
| yankcrime | knikolla: sounds good, should i start off with the 'devel' branch? | 11:25 |
| yankcrime | it looks like that might be partway through a bit of a refactor... | 11:25 |
| knikolla | yankcrime: true, midway refactor and burnout. | 11:26 |
| knikolla | give me a day or two, as i have a few local commits i haven't pushed. | 11:27 |
| yankcrime | knikolla: no worries, that's great | 11:29 |
| * knikolla opens pycharm | 11:30 | |
| knikolla | seems last time i touched it i almost finished the refactor | 11:30 |
| cmurphy | sounds a bit like adjutant https://adjutant.readthedocs.io/en/latest/features.html | 11:30 |
| knikolla | i just need to test it before i push it | 11:30 |
| knikolla | cmurphy: true | 11:30 |
| knikolla | i was planning on investigating that as well. though adjutant felt very general purpose | 11:31 |
| yankcrime | yeah i've come across adjutant as well | 11:31 |
| yankcrime | its scope is much more broad | 11:32 |
| breton | b"oslo_db.exception.DBError: (pymysql.err.InternalError) (1071, 'Specified key was too long; max key length is 767 bytes') | 11:40 |
| breton | has anybody seen this issue in tests? | 11:40 |
| * knikolla starts heading to the office after finishing morning coffee. | 11:41 | |
| cmurphy | breton: sounds familiar, i think that's a charset issue https://ask.openstack.org/en/question/91592/mitaka-on-1604-xenial-and-mysqls-new-default-utf8mb4-charset/ | 11:45 |
| *** raildo has joined #openstack-keystone | 11:48 | |
| breton | cmurphy: yes, i've found that too, thanks. But it all feels so wrong | 11:50 |
| *** AlexeyAbashkin has joined #openstack-keystone | 11:51 | |
| cmurphy | i could have sworn it was documented | 11:53 |
| *** nicolasbock has joined #openstack-keystone | 12:11 | |
| *** dave-mccowan has joined #openstack-keystone | 12:14 | |
| *** dave-mcc_ has joined #openstack-keystone | 12:16 | |
| *** dave-mccowan has quit IRC | 12:18 | |
| *** rcernin has quit IRC | 12:56 | |
| johnthetubaguy | in other news yankcrime is working on that federation blog post I said was on its way, that should help with the spec for the federation mapping changes, with any luck | 13:06 |
| *** AlexeyAbashkin has quit IRC | 13:08 | |
| *** Alexey_Abashkin has joined #openstack-keystone | 13:08 | |
| *** Alexey_Abashkin is now known as AlexeyAbashkin | 13:10 | |
| knikolla | cool | 13:11 |
| yankcrime | there's an introductory one in review now which outlines the work we're doing (and with who), and a part-two which is in draft and which will elaborate on the AAI specifics | 13:13 |
| kmalloc | o/ | 13:27 |
| lbragstad | o/ | 13:30 |
| lbragstad | sapd: so it looks like you're getting half a second response times when you authenticate | 13:32 |
| *** openstackgerrit has quit IRC | 13:34 | |
| lbragstad | curious if folks want to take a final peak at https://review.openstack.org/#/c/540803/15 | 13:35 |
| * cmurphy about to | 13:36 | |
| lbragstad | thanks - i appreciate people putting up with my persistent pesting | 13:38 |
| lbragstad | pestering* | 13:38 |
| *** dave-mcc_ has quit IRC | 13:41 | |
| *** dave-mccowan has joined #openstack-keystone | 13:42 | |
| *** AlexeyAbashkin has quit IRC | 13:43 | |
| lbragstad | evrardjp: o/ did you have some questions about secret storage and keystone? | 13:43 |
| evrardjp | not real questions from OSA to keystone, but I'd like to hear what could be going on | 13:44 |
| lbragstad | yeah - it's a topic that's been brought up several times | 13:44 |
| evrardjp | I think keystone, more than some other projects, require the generation of secrets, and their handling (like fernet tokens on the filesystem) | 13:45 |
| lbragstad | and the most recent use case that we gravitate towards is using something like castellan/barbican for storing fernet keys | 13:45 |
| evrardjp | if there is a change happening, I guess we need to know | 13:45 |
| lbragstad | right | 13:45 |
| evrardjp | understand what the best practices will be | 13:45 |
| lbragstad | as of right now, we're not doing anything to put secrets into a proper secret storage utility - yet... | 13:45 |
| evrardjp | is there something else on that castellan level than fernet tokens? | 13:46 |
| lbragstad | like- something else we could use it for? | 13:46 |
| evrardjp | yes, what do you expect in the near future | 13:46 |
| *** dave-mccowan has quit IRC | 13:46 | |
| evrardjp | if anything else | 13:47 |
| lbragstad | fernet tokens are the main things that jump out at me... in the future, if we have another token provider implementation based on authenticated encryption, that would be another candidate | 13:47 |
| evrardjp | yeah but that's an if :) | 13:47 |
| evrardjp | for the moment I guess we are good | 13:47 |
| lbragstad | ideally, it would be nice to offer support for more secure key storage | 13:47 |
| lbragstad | iirc | 13:47 |
| lbragstad | we tripped trying to generalize the key rotation logic | 13:48 |
| evrardjp | yeah, I guess that's the hardest for many | 13:48 |
| *** dave-mccowan has joined #openstack-keystone | 13:48 | |
| lbragstad | the current key rotation stuff is pretty specific to fernet, which is fine... but i suppose we'd need it to behave the same regardless of keys living on local disk or in a secret storage container | 13:49 |
| evrardjp | I am completely unaware of how things work with castellan/barbican, would keystone request the rotation of secrets directly? | 13:49 |
| evrardjp | well I guess that's my question | 13:49 |
| lbragstad | i'm inclined to say that keystone should provide a facade that handles the rotation regardless of the backend | 13:49 |
| evrardjp | it looks like it would be simpler to just have the deployer handle it | 13:49 |
| evrardjp | haha | 13:50 |
| evrardjp | yes, but that's more work | 13:50 |
| evrardjp | :) | 13:50 |
| lbragstad | agree to disagree :) | 13:50 |
| *** dave-mcc_ has joined #openstack-keystone | 13:50 | |
| evrardjp | well I am fine with that | 13:50 |
| *** AlexeyAbashkin has joined #openstack-keystone | 13:50 | |
| lbragstad | iirc - that's where discussions tipped over | 13:50 |
| lbragstad | when we were looking at a specification to make the fernet key backend pluggable | 13:51 |
| evrardjp | it brings a reference implementation code vs documentation | 13:51 |
| evrardjp | I see | 13:51 |
| johnthetubaguy | lbragstad: slight nit on the spec, it doesn't cover A using any resources, its not a big deal, just a Nit, otherwise looks good. | 13:51 |
| lbragstad | johnthetubaguy: in the new examples? | 13:51 |
| johnthetubaguy | it only covers the error case I think | 13:52 |
| lbragstad | johnthetubaguy: oh - you mean sum(A.limit, B.limit, C.limit) needs to be represented on line 66? | 13:53 |
| *** dave-mccowan has quit IRC | 13:53 | |
| lbragstad | instead of just sum(B.limit, C.limit) ? | 13:53 |
| lbragstad | wait - maybe i'm not parsing that properly | 13:54 |
| johnthetubaguy | lbragstad: I think so, I added comments, having said that, I don't think its a blocker, more something we could clarify later in a follow up, if needed | 13:54 |
| lbragstad | i can spin up a follow-on, but i'm not sure i completely understand the comment after reading it again | 13:54 |
| lbragstad | lines 66 - 70 are specific to validating limits in the API in keystone | 13:55 |
| *** Alexey_Abashkin has joined #openstack-keystone | 14:02 | |
| *** AlexeyAbashkin has quit IRC | 14:02 | |
| *** Alexey_Abashkin is now known as AlexeyAbashkin | 14:02 | |
| *** anurag has joined #openstack-keystone | 14:08 | |
| *** anurag has quit IRC | 14:13 | |
| johnthetubaguy | lbragstad: so that was probably a miss-read on my part, looking at it again | 14:14 |
| *** felipemonteiro has joined #openstack-keystone | 14:15 | |
| *** felipemonteiro_ has joined #openstack-keystone | 14:15 | |
| hrybacki | o/ | 14:16 |
| *** openstackgerrit has joined #openstack-keystone | 14:18 | |
| openstackgerrit | Merged openstack/pycadf master: fix tox python3 overrides https://review.openstack.org/572925 | 14:18 |
| openstackgerrit | Merged openstack/pycadf master: Remove moxstubout usage https://review.openstack.org/569299 | 14:18 |
| *** felipemonteiro has quit IRC | 14:20 | |
| *** links has quit IRC | 14:23 | |
| *** itlinux has quit IRC | 14:26 | |
| ayoung | lbragstad, kmalloc on the spec for quota (I'm fine with it going in) do we want to name things a little better so we can find them in the future? | 14:32 |
| ayoung | Instead of the commit being | 14:32 |
| ayoung | Hierarchical Unified Limits | 14:32 |
| ayoung | it should be | 14:32 |
| ayoung | Two Level Hierarchical Unified Limits | 14:32 |
| lbragstad | i'm working on addressing follow ups now | 14:32 |
| ayoung | and the file name itself should match | 14:32 |
| lbragstad | ++ | 14:33 |
| lbragstad | i can fix taht | 14:33 |
| ayoung | didn't want to mess things up if the spec freeze is today or something | 14:33 |
| lbragstad | yeah - it's the end of the week | 14:33 |
| ayoung | lbragstad, we really should have a placeholder for the multi-level Hierarchical limits. | 14:34 |
| hrybacki | lbragstad: are those freeze dates up to the services to determine? I know M2 is June4-8, but I thought the actual freeze date was today | 14:34 |
| ayoung | I'd hate to be stuck with 2 level forever | 14:34 |
| lbragstad | hrybacki: projects can pick their own deadlines, so long as they are reasonable i think | 14:35 |
| hrybacki | ack ack | 14:35 |
| lbragstad | ayoung: i have a section detailing future work in the current specification that should serve as a base for a new spec if we need it to | 14:35 |
| lbragstad | which includes details from your post | 14:36 |
| ayoung | lbragstad, yeah, but we really should get the spec going | 14:36 |
| lbragstad | and the concept the tracking aggregates | 14:36 |
| ayoung | I'm just afraid we are going to get to two level and stop | 14:36 |
| *** Alexey_Abashkin has joined #openstack-keystone | 14:38 | |
| *** spilla has joined #openstack-keystone | 14:39 | |
| *** AlexeyAbashkin has quit IRC | 14:41 | |
| *** Alexey_Abashkin is now known as AlexeyAbashkin | 14:41 | |
| ayoung | http://jaormx.github.io/2018/rewriting-openstack-policy-files-in-open-policy-agent-rego-language/ jaosorior you flippin rock | 14:51 |
| cmurphy | wow that's cool | 14:53 |
| *** lifeless_ has joined #openstack-keystone | 14:53 | |
| *** lifeless has quit IRC | 14:53 | |
| lbragstad | kmalloc: there are a couple comments on the strict two level spec that you might be better suited to answer than i am | 14:58 |
| *** Kumar has joined #openstack-keystone | 14:59 | |
| ayoung | https://vignette.wikia.nocookie.net/expanse/images/4/49/OPA_logo-black_on_white-square-585x440.jpg | 15:02 |
| *** d0ugal has quit IRC | 15:07 | |
| *** itlinux has joined #openstack-keystone | 15:13 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Address follow-on comments in strict-two-level spec https://review.openstack.org/573292 | 15:16 |
| lbragstad | kmalloc: cmurphy johnthetubaguy attempted to clarify bits in a follow on | 15:16 |
| lbragstad | ayoung: ^ | 15:16 |
| johnthetubaguy | lbragstad: I am fine with that, narrows down the conversion nicely | 15:17 |
| lbragstad | yeah - makes it a little easier to see what the controversial points are :) | 15:17 |
| *** Alexey_Abashkin has joined #openstack-keystone | 15:20 | |
| *** AlexeyAbashkin has quit IRC | 15:22 | |
| *** Alexey_Abashkin is now known as AlexeyAbashkin | 15:22 | |
| *** AlexeyAbashkin has quit IRC | 15:22 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 15:23 | |
| *** Kumar has quit IRC | 15:24 | |
| *** Kumar has joined #openstack-keystone | 15:25 | |
| -openstackstatus- NOTICE: Zuul update for Ansible 2.5 in progress. Scheduler crashed as unexpected side effect of pip upgrade. Will be back and running shortly. | 15:30 | |
| *** Alexey_Abashkin has joined #openstack-keystone | 15:37 | |
| *** AlexeyAbashkin has quit IRC | 15:37 | |
| *** Alexey_Abashkin is now known as AlexeyAbashkin | 15:37 | |
| *** gyee has joined #openstack-keystone | 15:46 | |
| *** Kumar has quit IRC | 15:48 | |
| *** AlexeyAbashkin has quit IRC | 15:53 | |
| kmalloc | lbragstad: nice | 15:59 |
| -openstackstatus- NOTICE: The zuul upgrade to ansible 2.5 is complete and zuul is running again. Changes uploaded or approved between 15:25 and 15:45 will need to be rechecked. Please report any problems in #openstack-infra | 16:10 | |
| *** lifeless has joined #openstack-keystone | 16:16 | |
| *** lifeless_ has quit IRC | 16:16 | |
| *** bigdogstl has joined #openstack-keystone | 16:20 | |
| *** ckonstanski has quit IRC | 16:31 | |
| *** lifeless_ has joined #openstack-keystone | 16:35 | |
| *** lifeless has quit IRC | 16:36 | |
| *** dklyle has quit IRC | 16:36 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Clarify scope responses in authentication api ref https://review.openstack.org/571309 | 16:37 |
| *** Kumar has joined #openstack-keystone | 16:40 | |
| cmurphy | lbragstad: did you mean to change a bunch of error code lists in ^ ? | 16:42 |
| *** felipemonteiro_ has quit IRC | 16:42 | |
| lbragstad | i did - but i can make that a separate change if needed | 16:42 |
| *** felipemonteiro_ has joined #openstack-keystone | 16:42 | |
| lbragstad | or if that's more appropriate | 16:42 |
| cmurphy | oh you did mention it in the commit message | 16:43 |
| cmurphy | sorry to nitpick but i would rather it be separate, the error codes don't really have anything to do with the bug imo | 16:44 |
| lbragstad | that's fair | 16:44 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone master: Allow domain admin listing their domain https://review.openstack.org/573365 | 16:52 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Clarify scope responses in authentication api ref https://review.openstack.org/571309 | 16:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update response codes for authentication API reference https://review.openstack.org/573367 | 16:55 |
| *** Kumar has quit IRC | 17:05 | |
| *** Kumar has joined #openstack-keystone | 17:05 | |
| kmalloc | cmurphy: ++ | 17:08 |
| *** r-daneel has quit IRC | 17:10 | |
| *** raildo has quit IRC | 17:12 | |
| *** itlinux has quit IRC | 17:30 | |
| *** boris_42_ has joined #openstack-keystone | 17:32 | |
| *** openstackgerrit has quit IRC | 17:34 | |
| *** spilla has quit IRC | 17:35 | |
| *** raildo has joined #openstack-keystone | 17:37 | |
| *** bigdogstl has quit IRC | 17:37 | |
| *** spilla has joined #openstack-keystone | 17:43 | |
| *** Kumar has quit IRC | 17:47 | |
| *** felipemonteiro__ has joined #openstack-keystone | 17:48 | |
| *** felipemonteiro_ has quit IRC | 17:52 | |
| *** r-daneel has joined #openstack-keystone | 18:09 | |
| kmalloc | lbragstad: ok looking at token model then going to write some code to move version to flask (and maybe app cred? or ... maybe i should do auth) | 18:27 |
| lbragstad | kmalloc: nice - thanks! | 18:28 |
| kmalloc | lbragstad: i also want to explore merging some bits together, e.g. Token really is part of auth (tree structure wise) | 18:28 |
| lbragstad | hmm | 18:28 |
| kmalloc | lbragstad: so we can do auth/<resulting_auth_type> [k2k, fed, token, OIDC] | 18:28 |
| lbragstad | oh - sure | 18:29 |
| kmalloc | looking at future plans for IDP->SP[IDP Proxy]->[SP, SP, SP, SP] | 18:29 |
| kmalloc | just code structure wise. | 18:29 |
| kmalloc | for the output auth result. | 18:29 |
| kmalloc | the validate paths and "are you who you say you are" are closely tied already | 18:30 |
| lbragstad | yeah | 18:30 |
| lbragstad | i need to mull it over, but so long as the objects are clearly separated then i think that sounds reasonable | 18:31 |
| kmalloc | yeah i'm not sold on it yet, just thinking through if we're restructuring code | 18:31 |
| lbragstad | let's explore it | 18:31 |
| lbragstad | er - i'm open to exploring it | 18:32 |
| kmalloc | yeah, just floating ideas to make our code tree make more sense. | 18:36 |
| lbragstad | yeah - i can get behind that | 18:37 |
| kmalloc | lbragstad: i'm also going to start with Flask-RestFUL, but i'm going to make a case to go to RestPLUS and do some hacking so we get swagger ui/docs | 18:37 |
| kmalloc | but it'll need some work so we don't break our JSON_HOME | 18:37 |
| kmalloc | and the fact that it is used for disc. | 18:37 |
| *** spotz has quit IRC | 18:45 | |
| *** spotz has joined #openstack-keystone | 18:46 | |
| kmalloc | lbragstad, cmurphy: the explicit call out to say we don't address per-endpoint data/limits (just per-region) was needed to get past the -2 from ayoung, specifically calling out that we aren't solving the per-endpoint problem but we are aware that there has been requests for it [future development] | 18:48 |
| kmalloc | and it's reasonable to be explicit that the per-endpoint-limit isn't in scope of the current spec/proposal | 18:48 |
| lbragstad | so - what's the per-endpoint problem? | 18:48 |
| kmalloc | i have 2 compute endpoints | 18:48 |
| kmalloc | same region | 18:48 |
| kmalloc | i can consume the entire quota on each of them | 18:49 |
| kmalloc | endpoints do not share consumption/claim data | 18:49 |
| lbragstad | shouldn't the endpoint be calculating usage based on project? | 18:49 |
| kmalloc | right, but lets say we have Nova A and Nova B | 18:50 |
| kmalloc | with different dbs. | 18:50 |
| kmalloc | because... $reasons$ (think MOC type use case) | 18:50 |
| lbragstad | oh | 18:50 |
| kmalloc | the quota could be consumed, say 100vms on each endpoint evne though you want to say limit the total usage in a region to 100 | 18:50 |
| lbragstad | yeah - that seems out of scope | 18:50 |
| kmalloc | so the addition was explicitly saying we aren't addressing that | 18:51 |
| kmalloc | but we need to ensure that the model can consume data from *any* data source, not just local | 18:51 |
| kmalloc | so if we address it, you can say back to etcd and share the data | 18:51 |
| lbragstad | model? as in oslo.limit? | 18:51 |
| kmalloc | the limit model (enforcement) | 18:51 |
| lbragstad | because right now that's technically coming from a callback supplied to oslo.limit | 18:52 |
| kmalloc | the "get current usage" is a callback? | 18:52 |
| lbragstad | correct | 18:52 |
| lbragstad | based on the session we had in YVR | 18:52 |
| *** ayoung has quit IRC | 18:52 | |
| kmalloc | bleh. i would like that to be wrapped. | 18:52 |
| kmalloc | oh it is | 18:52 |
| lbragstad | yeah - it's a context manager | 18:52 |
| lbragstad | and it accepts a callback function | 18:53 |
| kmalloc | we can address it and store usagage via the context manager centrally then | 18:53 |
| kmalloc | yeah, we're in a good place for future iteration | 18:53 |
| kmalloc | don't mind me. | 18:53 |
| kmalloc | i know how to implement shared claim/usage with sync [future] | 18:53 |
| kmalloc | we're in a good place for that. | 18:54 |
| lbragstad | cool | 18:54 |
| kmalloc | i was worried we just wrote ourselves into a corner | 18:54 |
| kmalloc | we didn't | 18:54 |
| kmalloc | it most likely will be a "watch" and issue an "update me now" request to the shared node. | 18:54 |
| kmalloc | which should keep us mostly in line, and can be 100% implemented through the context manager. | 18:55 |
| kmalloc | wrapping the callback | 18:55 |
| kmalloc | lbragstad: anyway.. yes it is a feature request/future looking. | 18:55 |
| kmalloc | lbragstad: and the spec just says we don't plan to solve it right now. :) | 18:55 |
| lbragstad | good deal | 18:55 |
| kmalloc | also, i'll review the token_model for a tradesies on reviewing the rest of the flaskification stuff [current] | 18:56 |
| lbragstad | deal | 18:57 |
| *** ayoung has joined #openstack-keystone | 19:01 | |
| *** martinus__ has joined #openstack-keystone | 19:10 | |
| kmalloc | lbragstad: -1, but because you have a lot of cases where you're assigning a UUID/ID (like user_id) into a dict-returning @property | 19:10 |
| lbragstad | yeah - i'm wondering if there is a better way to handle that | 19:11 |
| kmalloc | lbragstad: basically we should never assign a non-dict into a dict-returning @property especially if it's just being called from the self.user_id settr, which could do the work. | 19:11 |
| kmalloc | just hook it into the id-settrs | 19:11 |
| kmalloc | and the dict setters are removed, id-settr does the lookup | 19:11 |
| kmalloc | or you do the lookup in the @property on demand (lazy) | 19:11 |
| kmalloc | so self.user_id = id | 19:12 |
| kmalloc | and self.user does the lookup on demand | 19:12 |
| lbragstad | yeah... | 19:12 |
| kmalloc | there is also the concern of cached/stale data | 19:12 |
| lbragstad | i was wondering if that was going to back a regression | 19:12 |
| kmalloc | but i think that is minimal and not any worse than today | 19:12 |
| lbragstad | today we load things into token_data and leave it there | 19:13 |
| kmalloc | right | 19:13 |
| lbragstad | then use conditionals everywhere to short circuit if it's already populated | 19:13 |
| lbragstad | so - in a sense it's already cached? | 19:13 |
| kmalloc | yeah and already stale | 19:13 |
| kmalloc | so, ignore the cached/stale comment i just said here | 19:13 |
| kmalloc | we just need to not set differing data types into an @property | 19:13 |
| kmalloc | if we expect a dict, we should only set a dict | 19:14 |
| lbragstad | not sure i fully understand ^ | 19:14 |
| kmalloc | if user returns a dict | 19:14 |
| kmalloc | self.user = user_id should be an error condition | 19:14 |
| kmalloc | self.user_id = user_id is fine | 19:14 |
| lbragstad | the second one is what happens today i thin | 19:15 |
| kmalloc | but you're setting a value into something that returns a dict, and it's not a dict | 19:15 |
| lbragstad | think | 19:15 |
| lbragstad | self.user is a dict | 19:15 |
| lbragstad | self.user_id is a string | 19:15 |
| kmalloc | your code does self.user_id = id -> self._user_id = id, self._user = id | 19:15 |
| kmalloc | s/self._user/self.user | 19:15 |
| kmalloc | and self.user = id -> self._user = providers.lookup_user(user_id) | 19:16 |
| lbragstad | right - but the setting for self.user uses the id to populate the self.user attribute with the reference from the identity backend | 19:16 |
| lbragstad | yeah | 19:16 |
| kmalloc | so you're assigning a string into the public setter and expecting a dict out | 19:16 |
| kmalloc | self.user_id = id could populate self.user | 19:16 |
| lbragstad | yeah | 19:16 |
| lbragstad | i was trying to avoid this: | 19:16 |
| lbragstad | token.user_id = id | 19:17 |
| lbragstad | user_ref = PROVIDERS.identity_api.get_user(id) | 19:17 |
| lbragstad | token.user = user_ref | 19:17 |
| kmalloc | you can be super smart about populating related fields | 19:17 |
| kmalloc | also lean on context_cache | 19:18 |
| kmalloc | it's there for this very reason | 19:18 |
| *** mvk has quit IRC | 19:18 | |
| lbragstad | ? | 19:18 |
| lbragstad | is that the thread local thing? | 19:18 |
| kmalloc | if you lookup user in the request, it's stored thread_local | 19:18 |
| kmalloc | yeah | 19:18 |
| lbragstad | ahh | 19:18 |
| lbragstad | sure | 19:18 |
| lbragstad | so - you're saying lean on thread local caching and ditch the weird setter/caching of the token object | 19:18 |
| kmalloc | but token.user_id = id could populate behind the scenes | 19:18 |
| kmalloc | OR you could load when token.user is called | 19:19 |
| kmalloc | so you save the lookup unless it's used | 19:19 |
| *** mugsie has quit IRC | 19:19 | |
| kmalloc | but right now you're doing token.user_id = id, which sets the id in token.user and populates it | 19:19 |
| lbragstad | right | 19:19 |
| kmalloc | so you're doing: token.user_id = id; user_ref = _get_user(id), token.user = user_ref | 19:19 |
| lbragstad | essentially | 19:20 |
| kmalloc | just short circut and don't push it through the @property.settr | 19:20 |
| kmalloc | for token.user | 19:20 |
| kmalloc | OR when you read token.user the first time if it isn't populated, load based upon token.user_id | 19:20 |
| lbragstad | right | 19:20 |
| kmalloc | if you want to limit db lookups for unrelated data | 19:20 |
| lbragstad | that was something i was trying to do | 19:21 |
| *** mugsie has joined #openstack-keystone | 19:21 | |
| *** mugsie has quit IRC | 19:21 | |
| *** mugsie has joined #openstack-keystone | 19:21 | |
| kmalloc | context cache is good, but lazy load/lookup might be best. | 19:21 |
| *** mugsie has quit IRC | 19:21 | |
| *** mugsie has joined #openstack-keystone | 19:21 | |
| lbragstad | so - in the @property of user | 19:21 |
| lbragstad | check if self.user_id | 19:21 |
| lbragstad | is populated | 19:21 |
| kmalloc | raise exception if it isn't | 19:21 |
| lbragstad | if so, fetch it from the identity backend | 19:22 |
| kmalloc | well hold on | 19:22 |
| *** mugsie has quit IRC | 19:22 | |
| kmalloc | https://www.irccloud.com/pastebin/InNinVzd/ | 19:23 |
| kmalloc | load on demand, and only load the first time | 19:23 |
| *** Guest68045 has joined #openstack-keystone | 19:24 | |
| kmalloc | you could eliminate the local cache if you want to just lean on the context_cache for data | 19:24 |
| lbragstad | so - why raise the exception? | 19:24 |
| kmalloc | because user_id hasn't been set | 19:24 |
| *** Guest68045 has quit IRC | 19:24 | |
| lbragstad | as opposed to just returning NOne? | 19:24 |
| kmalloc | sure, None | 19:24 |
| *** mugsie_ has joined #openstack-keystone | 19:24 | |
| kmalloc | doesn't matter | 19:24 |
| lbragstad | ok | 19:24 |
| lbragstad | just checking | 19:24 |
| kmalloc | i was thinking from more assured data. | 19:24 |
| kmalloc | which an exception makes a lot of sense | 19:25 |
| lbragstad | technically we'll be validating that when we mint the token | 19:25 |
| kmalloc | "hey, uh, i don't have a user_id, so, uh i don't have a user to give you" | 19:25 |
| kmalloc | right you can make the model smart on that front | 19:25 |
| kmalloc | and just catch general errors in mint | 19:25 |
| kmalloc | rather than have mint need all that logic | 19:25 |
| lbragstad | right... | 19:25 |
| lbragstad | hmm | 19:25 |
| kmalloc | but i don't care where the logic goes. | 19:26 |
| kmalloc | i care that the tokne_model makes sense from any consumer | 19:26 |
| *** felipemonteiro__ has quit IRC | 19:26 | |
| *** mugsie_ has quit IRC | 19:27 | |
| *** mugsie_ has joined #openstack-keystone | 19:27 | |
| *** mugsie_ is now known as _mugsie | 19:27 | |
| lbragstad | i'll respin it to do the lazy load bit | 19:27 |
| kmalloc | sure. | 19:27 |
| kmalloc | trying to make it easier for you too, less settr and less other code. | 19:27 |
| kmalloc | :) | 19:27 |
| lbragstad | right | 19:28 |
| lbragstad | that was getting pretty dense | 19:28 |
| kmalloc | exactly | 19:28 |
| *** _mugsie is now known as mugsie_ | 19:28 | |
| *** d0ugal has joined #openstack-keystone | 19:29 | |
| *** d0ugal has quit IRC | 19:29 | |
| *** d0ugal has joined #openstack-keystone | 19:29 | |
| kmalloc | otherwise the model makes sense to me | 19:31 |
| lbragstad | cool | 19:35 |
| *** boris_42_ has quit IRC | 19:36 | |
| *** ckonstanski has joined #openstack-keystone | 19:54 | |
| *** felipemonteiro has joined #openstack-keystone | 20:09 | |
| *** scarlisle has joined #openstack-keystone | 20:13 | |
| *** itlinux has joined #openstack-keystone | 20:14 | |
| *** d0ugal has quit IRC | 20:21 | |
| *** felipemonteiro_ has joined #openstack-keystone | 20:22 | |
| *** felipemonteiro has quit IRC | 20:25 | |
| *** openstackgerrit has joined #openstack-keystone | 20:25 | |
| openstackgerrit | Raildo Mascena proposed openstack/keystone master: Exposing bug/1754677 https://review.openstack.org/570438 | 20:25 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone master: Exposing bug/1754677 https://review.openstack.org/570438 | 20:27 |
| *** raildo has quit IRC | 20:37 | |
| *** pcaruana has quit IRC | 20:39 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Introduce new TokenModel object https://review.openstack.org/559129 | 20:43 |
| *** spilla has quit IRC | 20:57 | |
| *** germs has joined #openstack-keystone | 20:59 | |
| *** martinus__ has quit IRC | 21:00 | |
| *** germs has quit IRC | 21:01 | |
| *** germs has joined #openstack-keystone | 21:03 | |
| *** germs has quit IRC | 21:04 | |
| *** itlinux has quit IRC | 21:15 | |
| *** bigdogstl has joined #openstack-keystone | 21:16 | |
| *** nicolasbock has quit IRC | 21:22 | |
| *** felipemonteiro_ has quit IRC | 21:28 | |
| *** felipemonteiro_ has joined #openstack-keystone | 21:29 | |
| *** bigdogstl has quit IRC | 21:38 | |
| *** edmondsw has quit IRC | 21:38 | |
| *** bigdogstl has joined #openstack-keystone | 21:57 | |
| openstackgerrit | Merged openstack/oslo.policy master: Clarify CLI documentation https://review.openstack.org/571892 | 21:59 |
| openstackgerrit | Merged openstack/oslo.policy master: Add CLI usage documentation https://review.openstack.org/571893 | 22:01 |
| *** bigdogstl has quit IRC | 22:03 | |
| *** lifeless_ has quit IRC | 22:03 | |
| *** lifeless has joined #openstack-keystone | 22:04 | |
| *** bigdogstl has joined #openstack-keystone | 22:14 | |
| *** bigdogstl has quit IRC | 22:19 | |
| *** rcernin has joined #openstack-keystone | 22:24 | |
| *** mchlumsky has quit IRC | 22:34 | |
| *** edmondsw has joined #openstack-keystone | 22:36 | |
| *** edmondsw has quit IRC | 22:41 | |
| *** bigdogstl has joined #openstack-keystone | 22:47 | |
| *** felipemonteiro_ has quit IRC | 22:48 | |
| *** felipemonteiro has joined #openstack-keystone | 22:49 | |
| *** bigdogstl has quit IRC | 22:52 | |
| *** dklyle has joined #openstack-keystone | 22:56 | |
| *** bigdogstl has joined #openstack-keystone | 23:01 | |
| *** bigdogstl has quit IRC | 23:09 | |
| *** bigdogstl has joined #openstack-keystone | 23:10 | |
| *** scarlisle has quit IRC | 23:14 | |
| *** bigdogstl has quit IRC | 23:14 | |
| *** felipemonteiro_ has joined #openstack-keystone | 23:21 | |
| *** felipemonteiro has quit IRC | 23:22 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Expand on debug_middleware option https://review.openstack.org/573461 | 23:25 |
| *** bigdogstl has joined #openstack-keystone | 23:30 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Expand on debug_middleware option https://review.openstack.org/573461 | 23:31 |
| kmalloc | lbragstad: ^ to address the comment on DEBUG middleware patch | 23:32 |
| *** bigdogstl has quit IRC | 23:35 | |
| *** bigdogstl has joined #openstack-keystone | 23:49 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!
