| *** gyee has quit IRC | 00:32 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:37 | |
| *** masber has joined #openstack-keystone | 00:58 | |
| *** gagehugo has joined #openstack-keystone | 01:30 | |
| *** itlinux has joined #openstack-keystone | 01:43 | |
| *** liuzz has joined #openstack-keystone | 01:52 | |
| *** liuzz_ has quit IRC | 01:54 | |
| *** hoonetorg has quit IRC | 01:57 | |
| *** hoonetorg has joined #openstack-keystone | 01:57 | |
| *** tonytan4ever_brb has joined #openstack-keystone | 01:58 | |
| *** itlinux has quit IRC | 01:58 | |
| *** tonytan4ever has quit IRC | 02:01 | |
| gagehugo | kmalloc: ack | 02:22 |
|---|---|---|
| openstackgerrit | Neha Alhat proposed openstack/keystonemiddleware master: Register session conf options from keystoneauth https://review.openstack.org/578008 | 03:13 |
| *** liuzz_ has joined #openstack-keystone | 03:31 | |
| *** liuzz has quit IRC | 03:32 | |
| *** itlinux has joined #openstack-keystone | 03:32 | |
| *** itlinux has quit IRC | 03:37 | |
| *** sheel has joined #openstack-keystone | 03:39 | |
| *** alex_xu has quit IRC | 04:15 | |
| *** alex_xu has joined #openstack-keystone | 04:15 | |
| *** masber has quit IRC | 04:29 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 04:48 | |
| *** vishakha has quit IRC | 05:02 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone master: [WIP] Implement auth receipts spec https://review.openstack.org/572286 | 05:04 |
| openstackgerrit | Adrian Turjak proposed openstack/keystone master: [WIP] Implement auth receipts spec https://review.openstack.org/572286 | 05:13 |
| *** vishakha has joined #openstack-keystone | 05:16 | |
| *** pcaruana has joined #openstack-keystone | 05:20 | |
| adriant | cmurphy, lbragstad, kmalloc: auth receipt patch is up, still 'wip' because there are some small bits in the unit tests that I'm not entirely sure of, but it is mostly done with unit tests for the auth part as a whole in test_v3_auth and provider unit tests that are mostly a copy and paste from token provider tests | 05:23 |
| adriant | feedback appreciated, and I still haven't had the chance to manually test the damn thing in a devstack... so that's my Monday plan. | 05:24 |
| openstackgerrit | Merged openstack/keystone master: Add new "How Can I Help?" contributor guide https://review.openstack.org/578814 | 05:44 |
| openstackgerrit | Merged openstack/keystone master: Migrate all password hashes to the new location if needed https://review.openstack.org/576660 | 05:44 |
| *** sheel has quit IRC | 05:45 | |
| *** AlexeyAbashkin has quit IRC | 05:51 | |
| *** parthiban has joined #openstack-keystone | 05:54 | |
| parthiban | hello all. Can someone explain me key revocation system of OpenStack as given in https://wiki.openstack.org/wiki/Security/Guidelines#key_revocation? | 05:54 |
| *** AlexeyAbashkin has joined #openstack-keystone | 06:01 | |
| *** vishakha has quit IRC | 06:06 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add support for enforce_call to set value on flask.g https://review.openstack.org/578189 | 06:07 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Update Scaffolding (flask) for json home documents https://review.openstack.org/578190 | 06:07 |
| *** nicolasbock has joined #openstack-keystone | 06:10 | |
| *** Alexey_Abashkin has joined #openstack-keystone | 06:13 | |
| *** AlexeyAbashkin has quit IRC | 06:15 | |
| *** Alexey_Abashkin is now known as AlexeyAbashkin | 06:15 | |
| *** vishakha has joined #openstack-keystone | 06:19 | |
| *** sonuk has joined #openstack-keystone | 06:24 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone-tempest-plugin master: Clean up the auto generated domain https://review.openstack.org/579063 | 06:25 |
| *** sonuk_ has quit IRC | 06:27 | |
| *** AlexeyAbashkin has quit IRC | 06:33 | |
| *** martinus__ has joined #openstack-keystone | 06:35 | |
| cmurphy | adriant: awesome | 06:40 |
| *** sapd__ has joined #openstack-keystone | 06:42 | |
| *** sapd_ has quit IRC | 06:42 | |
| *** tonytan4ever_brb has quit IRC | 06:44 | |
| *** sapd__ has quit IRC | 06:44 | |
| *** sapd__ has joined #openstack-keystone | 06:45 | |
| cmurphy | parthiban: ask in #openstack-security or attend their meeting http://eavesdrop.openstack.org/#Security_SIG_meeting | 06:45 |
| parthiban | thanks cmurphy | 06:45 |
| *** annp has quit IRC | 06:51 | |
| *** sapd_ has joined #openstack-keystone | 06:52 | |
| *** annp has joined #openstack-keystone | 06:52 | |
| *** vrv_ has joined #openstack-keystone | 06:54 | |
| *** Dinesh_Bhor has quit IRC | 06:54 | |
| *** sapd__ has quit IRC | 06:54 | |
| *** annp has quit IRC | 06:57 | |
| *** amoralej|off is now known as amoralej | 07:07 | |
| *** tesseract has joined #openstack-keystone | 07:10 | |
| *** annp has joined #openstack-keystone | 07:11 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone-tempest-plugin master: Clean up the auto generated domain https://review.openstack.org/579063 | 07:14 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add auto increase primary key for unified limit https://review.openstack.org/576025 | 07:23 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add registered_limit_id column for limit https://review.openstack.org/577751 | 07:23 |
| *** tosky has joined #openstack-keystone | 07:32 | |
| *** ispp has joined #openstack-keystone | 07:37 | |
| *** ispp has quit IRC | 07:55 | |
| openstackgerrit | Merged openstack/keystone master: Fix keystone-manage mapping_purge with --type option https://review.openstack.org/554397 | 07:59 |
| openstackgerrit | Merged openstack/keystone master: Add Flask-RESTful and update flask minimum(s) https://review.openstack.org/574414 | 07:59 |
| openstackgerrit | Merged openstack/keystone master: Implement scaffolding for Flask-RESTful use https://review.openstack.org/574415 | 07:59 |
| *** d0ugal has joined #openstack-keystone | 08:02 | |
| *** ispp has joined #openstack-keystone | 08:14 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone-tempest-plugin master: Clean up the auto generated domain https://review.openstack.org/579063 | 08:18 |
| *** mvk has quit IRC | 09:20 | |
| *** neha_alhat has joined #openstack-keystone | 09:45 | |
| neha_alhat | cmurphy: The zuul check is not working on this patch https://review.openstack.org/#/c/578008/, is it because of circular dependency set? | 09:47 |
| cmurphy | neha_alhat: correct, zuul won't allow circular dependencies | 09:47 |
| neha_alhat | cmurphy: can you guide be what can be done in this case | 09:49 |
| cmurphy | neha_alhat: in the general case, there's usually a way to do a three or four-step patch series such that there are backwards compatible intermediate steps and finally cleanup steps | 10:01 |
| cmurphy | but in this case, I think the fact that glance is breaking is an indication that this is a breaking change, we can't just remove those options | 10:02 |
| cmurphy | other projects are likely to be in a similar position, not just glance | 10:02 |
| cmurphy | plus there is this: http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token/__init__.py#n919 | 10:02 |
| *** mvk has joined #openstack-keystone | 10:05 | |
| *** ispp has quit IRC | 10:07 | |
| neha_alhat | cmurphy: In such circular dependency case, what exact steps do I need to take to avoid failure? | 10:11 |
| neha_alhat | cmurphy: I am not clear about this: way to do a three or four-step patch series such that there are backwards compatible intermediate steps and finally cleanup steps | 10:12 |
| cmurphy | neha_alhat: it doesn't matter because I think this needs a different solution, I don't think working around the circular dependency is the answer | 10:18 |
| cmurphy | but I don't have a precise solution to give you right now, I'll need to dig into it | 10:18 |
| *** ispp has joined #openstack-keystone | 10:19 | |
| neha_alhat | cmurphy: there is an alternative solution to this that is mentioned in commit message of https://review.openstack.org/#/c/578008/ | 10:20 |
| neha_alhat | cmurphy: I can directly register spli_logger conf option like other options(insecuare, cafile) | 10:20 |
| cmurphy | neha_alhat: that might work better | 10:21 |
| neha_alhat | cmurphy: ok, thanks | 10:21 |
| *** ispp has quit IRC | 10:34 | |
| *** linkmark has joined #openstack-keystone | 10:50 | |
| *** mvk has quit IRC | 10:52 | |
| *** ispp has joined #openstack-keystone | 10:58 | |
| *** d0ugal_ has joined #openstack-keystone | 11:03 | |
| *** d0ugal has quit IRC | 11:05 | |
| *** edmondsw has joined #openstack-keystone | 11:32 | |
| *** tonytan4ever has joined #openstack-keystone | 11:36 | |
| *** annp has quit IRC | 11:39 | |
| *** ispp has quit IRC | 11:43 | |
| *** ispp has joined #openstack-keystone | 11:45 | |
| openstackgerrit | Merged openstack/keystone master: Keystone adheres to public_endpoint opt only https://review.openstack.org/574502 | 12:09 |
| *** d0ugal_ has quit IRC | 12:15 | |
| *** d0ugal_ has joined #openstack-keystone | 12:16 | |
| openstackgerrit | Merged openstack/keystone master: pycrypto is not used by keystone https://review.openstack.org/578833 | 12:17 |
| *** liuzz_ has quit IRC | 12:19 | |
| *** raildo has joined #openstack-keystone | 12:22 | |
| *** rcernin has quit IRC | 12:29 | |
| *** tonytan4ever has quit IRC | 12:36 | |
| *** mvenesio has joined #openstack-keystone | 12:45 | |
| *** peereb has joined #openstack-keystone | 12:46 | |
| *** openstackgerrit has quit IRC | 12:49 | |
| *** mvenesio has quit IRC | 12:51 | |
| *** jmlowe has quit IRC | 12:58 | |
| cwright | Hi, I noticed in the comment above the `notification_opt_out` setting there is a message that says: | 13:04 |
| cwright | -- "By default, all notifications related to authentication are automatically suppressed." | 13:04 |
| cwright | How do I unsuppress these notifications related to authentication? | 13:04 |
| *** openstackgerrit has joined #openstack-keystone | 13:05 | |
| openstackgerrit | Merged openstack/keystone master: Refactor trust roles check https://review.openstack.org/578509 | 13:05 |
| *** d0ugal_ has quit IRC | 13:12 | |
| *** amoralej is now known as amoralej|lunch | 13:13 | |
| *** d0ugal has joined #openstack-keystone | 13:13 | |
| *** d0ugal has quit IRC | 13:13 | |
| *** d0ugal has joined #openstack-keystone | 13:13 | |
| openstackgerrit | Merged openstack/keystone master: Simple usage docs for implied roles https://review.openstack.org/575911 | 13:17 |
| cmurphy | cwright: the default value for notifications to out out of is the list [identity.authenticate.success, identity.authenticate.pending, identity.authenticate.failed], so if you do want to opt in to those notifications you'd set notification_opt_out explicitly to empty | 13:20 |
| *** bhagyashris_ is now known as bhagyashris | 13:21 | |
| cwright | cmurphy: thank you. I have a followup question: | 13:21 |
| cwright | https://docs.openstack.org/ceilometer/queens/admin/telemetry-measurements.html#openstack-identity | 13:21 |
| cwright | am i correct in understanding that these are the only 3 meters emitted via notifications? | 13:22 |
| cmurphy | cwright: hrm no i don't think so, I think we emit notifications for every API action | 13:25 |
| cmurphy | https://docs.openstack.org/keystone/latest/advanced-topics/event_notifications.html | 13:25 |
| cmurphy | https://docs.openstack.org/keystone/latest/advanced-topics/event_notifications.html#supported-events | 13:25 |
| cwright | cmurphy: thanks. this has been quite confusing because it seems that by default keystone suppresses the only 3 metrics that ceilometer tracks for identity. | 13:27 |
| cmurphy | that is confusing | 13:28 |
| cmurphy | I'm not sure why that is | 13:28 |
| cmurphy | lbragstad: knikolla I wasn't at any of the edge meetings this week, did anything happen in them worth mentioning in https://etherpad.openstack.org/p/keystone-team-newsletter ? | 13:34 |
| lbragstad | cmurphy: we just stepped through how federation works | 13:36 |
| lbragstad | specifically the authentication path because people wanted to know how it would be affected by site connectivity issues (e.g. a deployment losing contact with the identity provider) | 13:37 |
| *** mvk has joined #openstack-keystone | 13:37 | |
| lbragstad | pretty much what was recapped in http://lists.openstack.org/pipermail/edge-computing/2018-June/000304.html | 13:38 |
| cmurphy | okay cool | 13:39 |
| cmurphy | your end_date is in my past | 13:54 |
| lbragstad | oh - good call | 13:54 |
| cmurphy | i was using start_date = 'June 23, 2018 12:00 AM CST' end_date = 'June 29, 2018 11:59 PM CST' but i've never been sure if i was off by one on either end | 13:54 |
| *** jistr is now known as jistr|mtg | 13:54 | |
| cmurphy | also i didn't have the oslo libs | 13:54 |
| lbragstad | http://paste.openstack.org/show/724598/ | 13:56 |
| cmurphy | lgtm | 13:57 |
| *** ispp has quit IRC | 13:57 | |
| * cmurphy runs away for a bit | 14:00 | |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.policy master: Bump sphinx to match lower requirements https://review.openstack.org/579169 | 14:08 |
| *** jistr|mtg is now known as jistr | 14:09 | |
| *** d0ugal has quit IRC | 14:15 | |
| *** d0ugal has joined #openstack-keystone | 14:16 | |
| *** amoralej|lunch is now known as amoralej | 14:22 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Address minor comments to 404 error detection https://review.openstack.org/578216 | 14:24 |
| *** ispp has joined #openstack-keystone | 14:29 | |
| *** spilla has joined #openstack-keystone | 14:33 | |
| gagehugo | o/ | 14:36 |
| * kmalloc dozes more. | 14:37 | |
| *** ispp has quit IRC | 14:40 | |
| *** ninag has joined #openstack-keystone | 14:43 | |
| *** ninag has quit IRC | 14:43 | |
| knikolla | o/ | 14:46 |
| *** d0ugal has quit IRC | 14:55 | |
| *** josecastroleon has quit IRC | 14:56 | |
| *** josecastroleon has joined #openstack-keystone | 14:56 | |
| hrybacki | o/ | 15:00 |
| *** d0ugal has joined #openstack-keystone | 15:01 | |
| *** josecastroleon has quit IRC | 15:01 | |
| *** alex_xu has quit IRC | 15:06 | |
| *** alex_xu has joined #openstack-keystone | 15:09 | |
| *** openstack has quit IRC | 15:22 | |
| *** openstack has joined #openstack-keystone | 15:23 | |
| *** ChanServ sets mode: +o openstack | 15:23 | |
| *** d0ugal has quit IRC | 15:23 | |
| *** gyee has joined #openstack-keystone | 15:24 | |
| *** afazekas is now known as afazekas|pto | 15:29 | |
| *** felipemonteiro has joined #openstack-keystone | 15:29 | |
| *** kashyap has joined #openstack-keystone | 15:30 | |
| kashyap | Hi folks, what is the default expiry time of a Keystone token? | 15:30 |
| * kashyap goes in search of docs meanwhile | 15:30 | |
| gagehugo | kashyap one hour I think | 15:31 |
| kashyap | gagehugo: I see, thanks. Wonder where in the source I can look at it? | 15:31 |
| gagehugo | https://github.com/openstack/keystone/blob/master/keystone/conf/token.py#L47 | 15:31 |
| *** d0ugal__ has joined #openstack-keystone | 15:32 | |
| * kashyap clicks | 15:32 | |
| kashyap | gagehugo: Most excellent; thanks | 15:32 |
| *** d0ugal_ has quit IRC | 15:32 | |
| *** fiddletwix has quit IRC | 15:42 | |
| *** tesseract has quit IRC | 15:42 | |
| *** d0ugal__ has quit IRC | 15:42 | |
| *** parthiban has quit IRC | 15:46 | |
| *** edmondsw has quit IRC | 15:48 | |
| *** fried_rice has joined #openstack-keystone | 15:51 | |
| kmalloc | gagehugo: o/ | 15:51 |
| fried_rice | Howdy folks. This bug https://bugs.launchpad.net/nova/+bug/1778498 is currently assigned to nova, but I think y'all would be better qualified to have a first look at it. Would you mind? | 15:51 |
| openstack | Launchpad bug 1778498 in OpenStack Compute (nova) "cannot launch instance" [Undecided,New] | 15:51 |
| *** edmondsw has joined #openstack-keystone | 15:52 | |
| knikolla | fried_rice: no adapters for htpp:// | 15:54 |
| knikolla | there's a typo in the url | 15:54 |
| fried_rice | oh, dang, nice spot knikolla, thanks. | 15:54 |
| fried_rice | knikolla: Forgive my ignorance - does that URL come from a service catalog entry? | 15:55 |
| fried_rice | i.e. a user error, not a code bug? | 15:55 |
| knikolla | fried_rice: catalog entry or nova.conf | 15:55 |
| fried_rice | beaut, thank you. | 15:55 |
| *** kashyap has left #openstack-keystone | 15:59 | |
| *** jenglisch_ has joined #openstack-keystone | 16:02 | |
| *** rledisez has quit IRC | 16:09 | |
| *** szaher has quit IRC | 16:09 | |
| *** mugsie has quit IRC | 16:09 | |
| *** adriant has quit IRC | 16:09 | |
| *** yuxin_ has quit IRC | 16:09 | |
| *** zigo has quit IRC | 16:09 | |
| *** baffle has quit IRC | 16:09 | |
| *** jenglisch has quit IRC | 16:09 | |
| *** lbragstad is now known as elbragstad | 16:11 | |
| *** toddnni has quit IRC | 16:12 | |
| *** fiddletwix has joined #openstack-keystone | 16:13 | |
| *** rledisez has joined #openstack-keystone | 16:14 | |
| *** szaher has joined #openstack-keystone | 16:14 | |
| *** mugsie has joined #openstack-keystone | 16:14 | |
| *** adriant has joined #openstack-keystone | 16:14 | |
| *** yuxin_ has joined #openstack-keystone | 16:14 | |
| *** zigo has joined #openstack-keystone | 16:14 | |
| *** baffle has joined #openstack-keystone | 16:14 | |
| *** toddnni has joined #openstack-keystone | 16:14 | |
| *** knikolla[m] has quit IRC | 16:18 | |
| *** lbragstad[m] has quit IRC | 16:18 | |
| *** ayoung has quit IRC | 16:22 | |
| *** spilla has quit IRC | 16:38 | |
| *** pcaruana has quit IRC | 16:40 | |
| *** fried_rice is now known as fried_rolls | 16:51 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove token bind capabilities https://review.openstack.org/577524 | 16:54 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Introduce new TokenModel object https://review.openstack.org/559129 | 16:54 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add serialization for TokenModel object https://review.openstack.org/578434 | 16:54 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Simplify the token provider API https://review.openstack.org/545450 | 16:54 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove remnants of token bind https://review.openstack.org/578435 | 16:54 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Cleanup keystone.token.providers.common https://review.openstack.org/577507 | 16:54 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove KeystoneToken object https://review.openstack.org/577567 | 16:54 |
| *** spilla has joined #openstack-keystone | 16:57 | |
| *** lbragstad[m] has joined #openstack-keystone | 17:01 | |
| *** openstack has quit IRC | 17:11 | |
| *** openstack has joined #openstack-keystone | 17:12 | |
| *** ChanServ sets mode: +o openstack | 17:12 | |
| *** knikolla[m] has joined #openstack-keystone | 17:13 | |
| *** felipemonteiro has quit IRC | 17:19 | |
| *** david-lyle has joined #openstack-keystone | 17:53 | |
| *** dklyle has quit IRC | 17:56 | |
| *** dklyle has joined #openstack-keystone | 17:57 | |
| *** david-lyle has quit IRC | 17:58 | |
| kmalloc | lbragstad[m], knikolla, this ugly stack to get flask support in place is starting to wind down :) | 17:59 |
| kmalloc | yay. | 17:59 |
| elbragstad | kmalloc: ++ | 18:01 |
| elbragstad | i might need some input on testing the TokenHandler cache bit | 18:01 |
| elbragstad | i'm also going to review the unified limit migrations today | 18:01 |
| kmalloc | sure thing. | 18:02 |
| kmalloc | the cache testing is hard(tm) to do right | 18:02 |
| elbragstad | yeah | 18:02 |
| kmalloc | but basically, always test cache, cached value, backend, invalidated, and pre-invalidated | 18:02 |
| elbragstad | but all patches in that series should be ready for review up to that point and even after that | 18:02 |
| *** jmlowe has joined #openstack-keystone | 18:02 | |
| kmalloc | i'll get some eyes on them in a short bit. | 18:02 |
| kmalloc | my hope is we can get the RBAC Enforcer landed before the token bits [sorry] | 18:03 |
| elbragstad | meh - that's fine.. | 18:03 |
| kmalloc | i think adding a couple lines to your code is going to be a bit more straightforward. | 18:03 |
| elbragstad | it gets the policy stuff that hrybacki wants to do going, too | 18:03 |
| kmalloc | yep | 18:04 |
| elbragstad | brb | 18:04 |
| hrybacki | eyyy irccloud let me know I was mentioned :') | 18:05 |
| *** kmalloc is now known as vmalloc | 18:06 | |
| hrybacki | kmalloc: elbragstad I'm in the Canadian mountains Sunday->Thursday next week. Anything y'all need my eyes on today/tomorrow? | 18:06 |
| *** vmalloc is now known as kmalloc | 18:06 | |
| *** raildo has quit IRC | 18:06 | |
| *** raildo has joined #openstack-keystone | 18:07 | |
| kmalloc | hm | 18:08 |
| kmalloc | well technically i am on vacation tomorrow->week from Sunday. | 18:08 |
| kmalloc | soooo | 18:08 |
| kmalloc | hrybacki: eyes on the "json_home" to Flask review would be nice. | 18:10 |
| kmalloc | hrybacki: https://review.openstack.org/#/c/574736/13 | 18:10 |
| kmalloc | elbragstad: do you mind if i rename keystone.tests.unit.token to keystone.tests.unit.token_subsystem or keystone_tokens | 18:12 |
| kmalloc | elbragstad: it means i can run debug within pycharm (somehow "import token" is catching keystone.tests.unit.token =/) | 18:12 |
| kmalloc | so the debugger fails. | 18:12 |
| kmalloc | i would love to debug things directly in the IDE. | 18:12 |
| kmalloc | and "token" is a python module for tokinzation | 18:13 |
| kmalloc | tokenization* | 18:13 |
| *** josecastroleon has joined #openstack-keystone | 18:15 | |
| hrybacki | added to my list kmalloc ! And enjoy your holiday :) | 18:16 |
| elbragstad | kmalloc: i hit something like that recently, but you can get around it with a flag in stestr i think | 18:35 |
| *** idlemind has joined #openstack-keystone | 18:37 | |
| *** felipemonteiro has joined #openstack-keystone | 18:38 | |
| *** josecastroleon has quit IRC | 18:40 | |
| *** felipemonteiro_ has joined #openstack-keystone | 18:40 | |
| *** felipemonteiro has quit IRC | 18:44 | |
| kmalloc | elbragstad: except i can't do "debug" test because i am not using stestr when debugging | 18:45 |
| elbragstad | i thought you could pass arguments directly to stestr (e.g. tox -e py27 -- $ARGUMENTS) | 18:47 |
| kmalloc | elbragstad: this isn't stestr | 18:52 |
| kmalloc | it runs the test outside of "tox" and "stestr" | 18:52 |
| kmalloc | i am using interactive debugging. | 18:53 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Rename keystone.tests.unit.token https://review.openstack.org/579250 | 18:53 |
| kmalloc | and it imports "token" behind the scenens and fails. | 18:53 |
| elbragstad | ahhh | 18:53 |
| elbragstad | nevermind | 18:53 |
| kmalloc | yeah. | 18:53 |
| kmalloc | it also shouldn't requiring "know this one crazy invocation, just click here" to debug easily ;) | 18:54 |
| kmalloc | even with stestr | 18:54 |
| kmalloc | debugging should be made as easy as possible : | 18:55 |
| kmalloc | :) | 18:55 |
| *** spilla has quit IRC | 18:57 | |
| *** spilla has joined #openstack-keystone | 18:58 | |
| *** josecastroleon has joined #openstack-keystone | 18:59 | |
| *** felipemonteiro_ has quit IRC | 19:00 | |
| *** vrv_ has quit IRC | 19:03 | |
| *** peereb has quit IRC | 19:07 | |
| kmalloc | elbragstad: hrm, bah, this isn't really working. | 19:08 |
| kmalloc | still more work to do to enable proper debugging | 19:08 |
| * knikolla needs more coffee before i wrap up reviewing rbac enforcer | 19:09 | |
| *** d0ugal__ has joined #openstack-keystone | 19:18 | |
| kmalloc | knikolla: yeah. i know... | 19:27 |
| kmalloc | elbragstad: started reviews for tokenmodel | 19:27 |
| kmalloc | elbragstad: most is the same as before, so was easy, some suggestions | 19:28 |
| kmalloc | elbragstad: i'm at the "simplify" one and taking a break then will hit it again | 19:28 |
| *** d0ugal__ has quit IRC | 19:28 | |
| elbragstad | sweet | 19:29 |
| *** ayoung has joined #openstack-keystone | 19:30 | |
| kmalloc | elbragstad: i think you're missing a test case. | 19:38 |
| kmalloc | or two or three | 19:38 |
| kmalloc | but adding comments. | 19:38 |
| kmalloc | elbragstad: uh. | 19:41 |
| kmalloc | elbragstad: DeprecationWarning: Policy enforcement is depending on the value of trustor_id. This key is deprecated. Please update your policy file to use the standard policy values. | 19:41 |
| kmalloc | DeprecationWarning) is this something wonky with our tests? | 19:41 |
| kmalloc | or something inherent to keystone? | 19:41 |
| elbragstad | that's oslo.context stuff... | 19:41 |
| elbragstad | i think | 19:41 |
| kmalloc | right | 19:42 |
| elbragstad | https://github.com/openstack/oslo.context/blob/master/oslo_context/context.py#L81 looks familiar | 19:42 |
| * kmalloc is rooting out deprecation warnings in our tests so we don't have them | 19:42 | |
| kmalloc | well at least i have my IDE running unit tests now, sadly it's through tox because it doesn't understand stestr or subunit. | 19:49 |
| *** spilla has quit IRC | 19:49 | |
| kmalloc | and running "unittests" is going to take an hour because singlethreaded. | 19:50 |
| *** josecastroleon has quit IRC | 19:50 | |
| *** edmondsw has quit IRC | 20:02 | |
| *** edmondsw has joined #openstack-keystone | 20:09 | |
| *** fried_rolls is now known as fried_rice | 20:09 | |
| *** edmondsw has quit IRC | 20:14 | |
| kmalloc | elbragstad: interesting. some of our tests are not as reliable as we'd home. | 20:17 |
| kmalloc | hope* | 20:17 |
| kmalloc | notably the callback thing(notification registration stuff) | 20:17 |
| kmalloc | elbragstad: moving to blinker in flask will be much better | 20:17 |
| elbragstad | good deal | 20:17 |
| kmalloc | knikolla: responded to https://review.openstack.org/#/c/577627/7 | 20:21 |
| kmalloc | knikolla: basically your understanding is correct *and* in a future patch we can update. http_client doesn't implement a 418 or I'd use that (http_client.HTTP_TEAPOT no such attribute) :P | 20:21 |
| knikolla | kmalloc: updated to +2. | 20:25 |
| *** raildo has quit IRC | 20:26 | |
| *** edmondsw has joined #openstack-keystone | 20:31 | |
| *** ayoung has quit IRC | 21:14 | |
| *** martinus__ has quit IRC | 21:15 | |
| *** nicolasbock has quit IRC | 21:18 | |
| elbragstad | https://review.openstack.org/#/c/576025/12 is pretty solid | 21:24 |
| elbragstad | i tested it a bit locally | 21:25 |
| *** ayoung has joined #openstack-keystone | 21:39 | |
| elbragstad | kmalloc: https://review.openstack.org/#/c/577751/4 looks pretty good to me, too | 21:41 |
| kmalloc | +2 on the pk change | 21:54 |
| kmalloc | looking at the registered_limit code | 21:55 |
| elbragstad | looks like we'll have to deal with the registered_limit_id being nullable for a release, but that should be ok? | 21:55 |
| elbragstad | we'll need to make sure we carry logic to handle both cases | 21:55 |
| kmalloc | as long as the business logic in code doesn't allow it to be null | 21:56 |
| kmalloc | it *can* be null until migrate is rnu | 21:56 |
| kmalloc | run* | 21:56 |
| kmalloc | but it should not be allowed to be null on saves/updates | 21:56 |
| elbragstad | right | 21:56 |
| elbragstad | technically the user can't specify a registered limit id on those API | 21:57 |
| elbragstad | APIs( | 21:57 |
| elbragstad | they have to specify openstack limit create demo nova cores 40 | 21:57 |
| elbragstad | and the `nova cores 40` bit gets resolved to a registered limit | 21:57 |
| kmalloc | right | 21:58 |
| kmalloc | i think i see a bug in the registered limits code | 21:58 |
| kmalloc | help me step through. | 21:58 |
| kmalloc | 1) db_sync expand | 21:58 |
| kmalloc | no migration done | 21:58 |
| kmalloc | oh wait self.__ blah got it | 21:59 |
| * elbragstad loves being a rubber duck | 21:59 | |
| kmalloc | ok this is fine. | 21:59 |
| kmalloc | we probably should write to the old locations as well for now | 22:00 |
| kmalloc | and the data migrate should find the right registered limit | 22:00 |
| elbragstad | yeah | 22:00 |
| kmalloc | oh wait no, migrate is done before everything is on <new> | 22:00 |
| kmalloc | sigh | 22:00 |
| ayoung | what are we using for a MySQL library? I don't see it in requirements | 22:00 |
| kmalloc | pymysql | 22:00 |
| elbragstad | yeah | 22:00 |
| kmalloc | elbragstad: ok so migrate is in Stien. | 22:00 |
| elbragstad | correct | 22:00 |
| elbragstad | this migration is just creating the new column | 22:00 |
| kmalloc | but stien can also skip the 4-phase thing we have now | 22:01 |
| kmalloc | i think... | 22:01 |
| kmalloc | can't it? | 22:01 |
| kmalloc | can we Rocky-> New column and everything is run in both places | 22:01 |
| elbragstad | i'm not sure what the 4-phase thing is | 22:01 |
| ayoung | does /opt/stack/keystone/lower-constraints.txt work like requirements? It has to be in one or the other? | 22:01 |
| kmalloc | Stien -> Migrate Data and only reference new location | 22:01 |
| kmalloc | ayoung: lower-constraints is communicating the minimum, in the g-r repo, upper-constraints communicates the "current/max" | 22:02 |
| ayoung | kmalloc, and requirements is going away? | 22:02 |
| kmalloc | so keystone's minimum might be different than <project> but everything has the same maximum | 22:02 |
| kmalloc | no. | 22:02 |
| kmalloc | requirements is still needed. | 22:02 |
| kmalloc | elbragstad: so, back to what i was typing | 22:03 |
| kmalloc | elbragstad: Rocky -> write to both locations. | 22:03 |
| kmalloc | elbragstad: Stien -> write to new only, migrate any data that hasn't been, constract the table | 22:03 |
| elbragstad | mmmk | 22:03 |
| kmalloc | elbragstad: vs Rocky -> write to both, stien migrante, T -> contract | 22:03 |
| kmalloc | i think we can just do the wrap up 100% in stien | 22:04 |
| kmalloc | ayoung: requirements.txt is just less complex, and we do test with the lower-constraints in a job (explicitly). | 22:04 |
| elbragstad | the only reason we can't do the migrate in Rocky is because we could miss a limit being created by a Queens node during the migration, right? | 22:04 |
| kmalloc | right. | 22:04 |
| elbragstad | so we want until we're all the way on Rocky.. | 22:05 |
| elbragstad | before doing the migrate | 22:05 |
| kmalloc | and that is because our steps don't involve "make sure everything is on rocky before running db_sync migrate" | 22:05 |
| elbragstad | ok | 22:05 |
| elbragstad | that seems fine | 22:05 |
| ayoung | kmalloc, elbragstad Hey, I'm writing a policy editing tool as a Flask service. Do you think Keystone will host it once I get it functional? Probably going to get to POC level then turn over to hrybacki and Ozz | 22:05 |
| kmalloc | where rocky could read from both but only write to <new>, contract would still be in stien | 22:06 |
| kmalloc | ayoung: depends on usefulness (generallly speaking) and where it fits in to things | 22:06 |
| ayoung | Idea is that it will not be expected to be running after deployment is up | 22:06 |
| elbragstad | then when Stein opens for development we'll migrate any remaining entries, then drop the old columsn | 22:06 |
| kmalloc | elbragstad: right. | 22:06 |
| elbragstad | ok - yeah, that makes sense | 22:06 |
| elbragstad | ayoung: i'd be interested in playing with it a bit | 22:06 |
| kmalloc | elbragstad: stien will only ever look at the new place, and the "migrate" will catch anything missed. | 22:06 |
| ayoung | kmalloc, I'm writing it as an aid to deployers. So, I plan on tying it in with Tripleo undercloud maybe | 22:07 |
| kmalloc | ayoung: i can't say for sure one way or another until it's more than "i have an idea" | 22:07 |
| kmalloc | :) | 22:07 |
| ayoung | OK...I'll keep hacking | 22:07 |
| kmalloc | but i don't see why it couldn't be part of keystone if it is generally useful | 22:07 |
| elbragstad | kmalloc: and because migrate is run before standing up the next release, we should be good | 22:07 |
| kmalloc | and you know, meets other critiera. | 22:07 |
| ayoung | kmalloc, well I do have this, too: http://adam.younglogic.com/2018/06/requirements-for-an-openstack-access-control-policy-management-tool/ | 22:07 |
| kmalloc | elbragstad: exactly | 22:07 |
| elbragstad | ok | 22:07 |
| kmalloc | ayoung: i know, i've seen that :) | 22:07 |
| ayoung | ++ | 22:07 |
| kmalloc | ayoung: i'm just being cautious. if i say "YES!" and it's bad, i don't want to have to reverse my decision | 22:08 |
| kmalloc | i don't expect it to be bad ;) | 22:08 |
| ayoung | OK, anyway, that is what I am asking for help on, in case it was not clear. I'm also hacking in a RHEL system as my dev worksation, and it makes things a little different | 22:08 |
| ayoung | Goal is to have a demo by Berni | 22:08 |
| kmalloc | i will add that i'll want to force a threat analysis on it (up front) before we move it into keystone | 22:08 |
| ayoung | Berlin | 22:08 |
| kmalloc | so we can get VMT coverage up-front | 22:08 |
| kmalloc | rather than way way way late | 22:09 |
| ayoung | I like that | 22:09 |
| kmalloc | but with it being new, it should be easy(ier) to do things like that | 22:09 |
| *** ckonstanski has joined #openstack-keystone | 22:10 | |
| kmalloc | ayoung: i expect to have a RHEL box to hack on [sortof] sometime... whenever my new laptop (hahah "end of june, riiiiiight") shows up | 22:10 |
| kmalloc | i think they just updated to "end of july" *facepalm* | 22:10 |
| kmalloc | that would be corp-issued | 22:10 |
| ayoung | kmalloc, I just got mine, but I was pretty pro-active about it | 22:10 |
| ayoung | this is your 3 year refresh>? | 22:10 |
| kmalloc | i submitted everything, they keep pushing the dates out | 22:10 |
| kmalloc | yes. but i was given a >1yr old laptop when i joined | 22:11 |
| kmalloc | so, technically it is before 3yrs | 22:11 |
| ayoung | THis thing is a brick...P50. | 22:11 |
| kmalloc | i tried to get a P50. | 22:11 |
| kmalloc | it was denied. | 22:11 |
| ayoung | WTAF | 22:11 |
| kmalloc | automatically even though my manager approved it | 22:11 |
| kmalloc | yeah. so i went X1C6th | 22:11 |
| kmalloc | and i'm going to use it as a RHEL target to check things on | 22:11 |
| ayoung | kmalloc, I'm gobsmacked | 22:12 |
| kmalloc | nah, i was also informed it was going to be 2-3months lead to get a p50 | 22:12 |
| kmalloc | so, i might get a p52, but they haven't certified those. | 22:12 |
| kmalloc | sooooooooo | 22:12 |
| ayoung | Wow, I must have snuck in under the wire | 22:12 |
| kmalloc | i think this is one of those "bad timing" | 22:12 |
| ayoung | I was just barely inside the refresh window, but old machine was acting up | 22:13 |
| kmalloc | it's ok, i want to see how RH deals with C0s3 sleep state | 22:13 |
| kmalloc | my guess is the X1C6 is going to be a 4-10W sleep state | 22:13 |
| kmalloc | [absurd] | 22:13 |
| kmalloc | i got a bunch of "REFRESH OR ELSE" emails :P | 22:14 |
| ayoung | what is the protocol for the SQL url? I left my working keystone.conf on my old laptop | 22:14 |
| ayoung | sqlalchemy.url = mysql://posse:posse@172.17.0.2/posse | 22:14 |
| kmalloc | py+mysql i think. | 22:14 |
| ayoung | I feel like there was something else there | 22:14 |
| kmalloc | mysql+pymysql | 22:14 |
| kmalloc | there we go | 22:15 |
| kmalloc | that | 22:15 |
| kmalloc | it says "talk MySQL" and use "pymysql" as the lib | 22:15 |
| kmalloc | vs mysqldb | 22:15 |
| kmalloc | i knew it had a + in there :) | 22:15 |
| ayoung | kmalloc, TYVM that worked | 22:18 |
| ayoung | and I have an alembic migration now! | 22:18 |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.policy master: Convert oslo.policy to using stestr https://review.openstack.org/579295 | 22:20 |
| elbragstad | that should unblock the oslo.policy gates | 22:20 |
| kmalloc | ayoung: gratz! | 22:21 |
| kmalloc | ayoung: also alembic is awesome. | 22:21 |
| *** ckonstanski has quit IRC | 22:24 | |
| openstackgerrit | Merged openstack/keystone master: Remove unclear wording in parameters https://review.openstack.org/577235 | 23:13 |
| *** linkmark has quit IRC | 23:15 | |
| ayoung | kmalloc, https://github.com/admiyo/posse | 23:28 |
| ayoung | It is nothing but a placeholder thus far | 23:28 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!