| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert endpoints api to flask native dispatching https://review.openstack.org/589642 | 00:37 |
|---|---|---|
| *** gyee has quit IRC | 00:38 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert regions API to flask native dispatching https://review.openstack.org/589640 | 00:38 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert services api to flask native dispatching https://review.openstack.org/589641 | 00:38 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert endpoints api to flask native dispatching https://review.openstack.org/589642 | 00:38 |
| *** wxy-xiyuan has quit IRC | 01:06 | |
| *** wxy-xiyuan has joined #openstack-keystone | 01:06 | |
| *** Emine has quit IRC | 02:00 | |
| openstackgerrit | Boxiang Zhu proposed openstack/python-keystoneclient master: refactor the getid method in keystoneclient/base.py https://review.openstack.org/589689 | 02:36 |
| *** dave-mccowan has quit IRC | 02:57 | |
| *** dklyle has quit IRC | 02:58 | |
| *** zhurong has joined #openstack-keystone | 03:01 | |
| *** jaosorior has joined #openstack-keystone | 03:59 | |
| *** zhurong has quit IRC | 04:20 | |
| *** jenglisch has quit IRC | 04:27 | |
| *** shyambiradar has joined #openstack-keystone | 05:01 | |
| *** shyambiradar has quit IRC | 05:04 | |
| *** shyambiradar has joined #openstack-keystone | 05:04 | |
| *** shyambiradar has quit IRC | 05:14 | |
| *** shyambiradar has joined #openstack-keystone | 05:24 | |
| *** jaosorior has quit IRC | 05:27 | |
| *** hoonetorg has quit IRC | 05:31 | |
| *** hoonetorg has joined #openstack-keystone | 05:52 | |
| *** shyam89 has joined #openstack-keystone | 05:56 | |
| *** zhurong has joined #openstack-keystone | 05:57 | |
| *** shyambiradar has quit IRC | 05:58 | |
| *** shyambiradar has joined #openstack-keystone | 05:59 | |
| *** nicolasbock has joined #openstack-keystone | 06:03 | |
| *** hoonetorg has quit IRC | 06:06 | |
| *** jdennis has quit IRC | 06:09 | |
| *** jdennis has joined #openstack-keystone | 06:26 | |
| *** pcaruana has joined #openstack-keystone | 06:27 | |
| *** shyam89 has quit IRC | 06:35 | |
| *** shyambiradar has quit IRC | 06:36 | |
| *** jaosorior has joined #openstack-keystone | 06:44 | |
| *** shyambiradar has joined #openstack-keystone | 06:58 | |
| *** s10 has joined #openstack-keystone | 06:58 | |
| *** s10 has quit IRC | 07:08 | |
| *** shyambiradar has quit IRC | 07:30 | |
| *** rcernin has quit IRC | 07:35 | |
| *** jaosorior has quit IRC | 07:38 | |
| *** jaosorior has joined #openstack-keystone | 07:38 | |
| *** jaosorior has quit IRC | 07:41 | |
| *** jaosorior has joined #openstack-keystone | 07:41 | |
| *** jaosorior has quit IRC | 07:42 | |
| *** jaosorior has joined #openstack-keystone | 07:43 | |
| *** chason has quit IRC | 07:49 | |
| *** shyambiradar has joined #openstack-keystone | 08:20 | |
| *** Emine has joined #openstack-keystone | 08:23 | |
| *** zhurong has quit IRC | 08:26 | |
| *** shyam89 has joined #openstack-keystone | 08:42 | |
| *** shyambiradar has quit IRC | 08:45 | |
| *** shyam89 has quit IRC | 08:45 | |
| *** shyambiradar has joined #openstack-keystone | 08:45 | |
| *** shyambiradar has quit IRC | 08:54 | |
| *** shyambiradar has joined #openstack-keystone | 08:54 | |
| openstackgerrit | OpenStack Release Bot proposed openstack/python-keystoneclient master: Update reno for stable/rocky https://review.openstack.org/589791 | 09:35 |
| *** edmondsw has joined #openstack-keystone | 09:45 | |
| *** edmondsw has quit IRC | 09:49 | |
| *** shyam89 has joined #openstack-keystone | 09:55 | |
| *** shyambiradar has quit IRC | 09:57 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement Trust Flush via keystone-manage. https://review.openstack.org/589378 | 10:07 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement Trust Flush via keystone-manage. https://review.openstack.org/589378 | 10:25 |
| *** shyam89 has quit IRC | 10:53 | |
| *** shyam89 has joined #openstack-keystone | 10:53 | |
| *** jaosorior has quit IRC | 10:58 | |
| *** jaosorior has joined #openstack-keystone | 10:59 | |
| *** dave-mccowan has joined #openstack-keystone | 11:00 | |
| *** shyam89 has quit IRC | 11:35 | |
| *** shyambiradar has joined #openstack-keystone | 11:35 | |
| *** shyambiradar has quit IRC | 11:37 | |
| *** shyambiradar has joined #openstack-keystone | 11:38 | |
| *** shyambiradar has quit IRC | 11:50 | |
| *** shyambiradar has joined #openstack-keystone | 11:51 | |
| *** chason has joined #openstack-keystone | 11:52 | |
| *** raildo has joined #openstack-keystone | 12:02 | |
| *** shyam89 has joined #openstack-keystone | 12:05 | |
| *** shyambiradar has quit IRC | 12:09 | |
| *** shyambiradar has joined #openstack-keystone | 12:44 | |
| *** shyam89 has quit IRC | 12:48 | |
| *** edmondsw has joined #openstack-keystone | 13:05 | |
| *** shyambiradar has quit IRC | 13:08 | |
| lbragstad | knikolla: have you been following http://lists.openstack.org/pipermail/edge-computing/2018-August/000379.html at all? | 13:40 |
| lbragstad | just curious | 13:40 |
| cmurphy | that call is happening now fyi | 13:41 |
| cmurphy | or no it's the other edge group i guess | 13:42 |
| lbragstad | there hasn't been a time set for the keystone-specific one has there? | 13:44 |
| cmurphy | i don't know | 13:45 |
| lbragstad | i'll assume not since no one has replied to the thread yet | 13:46 |
| cmurphy | ildikov: ^ | 13:48 |
| ildikov | lbragstad: cmurphy: today's call is an OPNFV one | 13:48 |
| lbragstad | ack | 13:48 |
| cmurphy | yeah i got them confused | 13:48 |
| ildikov | lbragstad: cmurphy: I've just wanted to ping you and knikolla to ask whether anyone would be available tomorrow :) | 13:48 |
| ildikov | we would like to start evaluating options that we collected regarding how to use Keystone in edge scenarios | 13:49 |
| *** _ix has joined #openstack-keystone | 13:49 | |
| ildikov | and in addition we can plan for the PTG and follow up testing and demo activities | 13:49 |
| cmurphy | i think i have another meeting | 13:49 |
| lbragstad | i can sit in tomorrow, but i'm going to be traveling all day friday | 13:49 |
| ildikov | and as no one besides the keystone team is an expert of Keystone at this moment we need someone from this team ideally | 13:49 |
| ildikov | lbragstad: the most votes are for 1300 UTC tomorrow | 13:50 |
| ildikov | lbragstad: would be a Zoom call as that's what people seem to prefer these days, but we usually try to take notes on the edge IRC channel as well | 13:50 |
| cmurphy | oh i should be able to do 1300 | 13:50 |
| ildikov | cmurphy: basically the same time as the OPNFV call today | 13:50 |
| ildikov | it's probably a first of a series | 13:51 |
| lbragstad | i can make that work for tomorrow i think | 13:51 |
| lbragstad | ildikov: i've added a slot for edge related discussions to the federation section of our PTG etherpad https://etherpad.openstack.org/p/keystone-stein-ptg | 13:51 |
| lbragstad | (line 52 - 53) | 13:52 |
| ildikov | lbragstad: awesome, I wanted to ask you about that too :) | 13:53 |
| lbragstad | according to the PTG schedule, we have monday set aside for x-project related things | 13:53 |
| lbragstad | thursday and friday are supposed to be project specific | 13:53 |
| ildikov | lbragstad: I will try to get the StarlingX people and the Edge Computing Group people in sync about this | 13:53 |
| lbragstad | but if there is a time that works better for other, let me know or just jot it down in the etherpad | 13:53 |
| lbragstad | (i don't plan on formatting it into an actual schedule until the end of this month) | 13:54 |
| ildikov | lbragstad: those groups meet one on Tuesday the other one on Wednesday so if we cannot make Monday work we still have one room each following day to figure it out | 13:54 |
| ildikov | lbragstad: sounds great, I will let both groups know about this so that we can plan | 13:55 |
| lbragstad | without getting ahead of myself, i was going to try and keep tuesday open to deal with fallout of monday cross-project work | 13:55 |
| lbragstad | but maybe i can tag along in the edge discussions with folks on wednesday | 13:55 |
| lbragstad | and if keystone comes up, it comes up | 13:55 |
| ildikov | we can try to position this for Monday and then figure it out when to follow up if we need to | 13:56 |
| ildikov | would that sound good? | 13:56 |
| lbragstad | sure | 13:59 |
| ildikov | cool, I will write up a mail about it to the ML's and will keep you posted about how things go | 14:01 |
| ildikov | did you have any time estimation for the topic or we have some flexibility on that? | 14:01 |
| lbragstad | i expect we'll have some flexibility - i imagine the major x-project discussions to be unified limits and policy stuff | 14:05 |
| *** elibrokeit has quit IRC | 14:05 | |
| kmalloc | ildikov: If it wasn't a zoom call, I still can't get dialed into those at all, I'd be able to join | 14:06 |
| kmalloc | Basically, zoom doesn't work at all for me. :( | 14:07 |
| kmalloc | I've tried everything short of running a windows VM at this point. | 14:07 |
| kmalloc | I guess I need to do that if I were to want to join. | 14:08 |
| cmurphy | it works surprisingly well for me | 14:08 |
| kmalloc | It plain doesn't run/work on my 18.04 laptop, can't install on my RHEL one, fedora it crashes on. | 14:09 |
| lbragstad | i think i just had to download a plugin when i clicked on the meeting link | 14:09 |
| kmalloc | The plug-in is terrible. | 14:09 |
| kmalloc | And that is my problem. | 14:09 |
| kmalloc | They really need to ditch the plug-in and go with a browser-pluginless solution. | 14:10 |
| cmurphy | it made me download a full on desktop client | 14:12 |
| cmurphy | which annoyed me but it works so ¯\_(ツ)_/¯ | 14:12 |
| lbragstad | huh - maybe that's what i did (version 2.0.115900.1201) | 14:13 |
| kmalloc | Apparently they have a browser only option as of August 2018 | 14:13 |
| *** _ix has quit IRC | 14:13 | |
| cmurphy | heh | 14:13 |
| kmalloc | I'll try again tomorrow. | 14:13 |
| kmalloc | What time was it? | 14:13 |
| cmurphy | 1300 utc i think | 14:13 |
| kmalloc | Oh, nope, I won't make it | 14:14 |
| kmalloc | 6am calls are not in the plan for me | 14:14 |
| kmalloc | Hazards of West coast living when apparently everyone else in the community is not in a compatible time zone. | 14:15 |
| kmalloc | Oh well, I can weigh in on ML and/or after the fact as needed :) | 14:17 |
| kmalloc | ildikov: sorry, I can't make 6am video calls, but trust lbragstad, cmurphy, and knikolla to be good representation for keystone :) | 14:17 |
| *** elibrokeit has joined #openstack-keystone | 14:20 | |
| ildikov | kmalloc: we have people from China, which kills using Hangouts and I only have Zoom account besides that | 14:21 |
| *** HW-Peter has joined #openstack-keystone | 14:21 | |
| *** _ix has joined #openstack-keystone | 14:22 | |
| ildikov | kmalloc: I'm open to any suggestion for any other time when the time slot is more convenient for you as Zoom works pretty well for those who can access it and I didn't heard other complaints about client issues, etc | 14:22 |
| ildikov | kmalloc: so I'm happy to adopt, but I haven't tested too many open tools to be able to come up with alternative that I trust to be stable enough | 14:22 |
| ildikov | s/adopt/adapt/ | 14:22 |
| lbragstad | i used mumble for a while | 14:25 |
| lbragstad | but that's audio only | 14:25 |
| ildikov | cool, I'll keep that in mind just in case | 14:39 |
| orange_julius | So I can't seem to replicate the keystone+ldap issue with a single keystone instance configured. I am starting to wonder if the issue is with the HA or with how the dashboard passing the authentication to keystone. I am going to try to install the dashboard and see if I can get it to replicate in the test environment | 14:45 |
| orange_julius | The ldappool connector is created using the designated bind user in the domain configuration is it not? Not the user information that would be passed via the Horizon dashboard | 14:53 |
| lbragstad | when i was reading the code, it looked like it was the user that was attempting to authenticate | 14:54 |
| lbragstad | but i could be wrong | 14:54 |
| kmalloc | ildikov: zoom is less of an issue ATM, I'll run a VM if needed, but timing is a bigger issue, I really can't do before about 1530 utc | 15:02 |
| ildikov | kmalloc: fair enough, as we have people from APAC that wasn't really an option | 15:03 |
| ildikov | kmalloc: I will try to look into alternating slots and also making sure that the info makes its way out to the ML's | 15:03 |
| ildikov | kmalloc: we just don't have a big group of people so I'm trying my best to keep them on one call to quick things off at least | 15:04 |
| *** chason has quit IRC | 15:06 | |
| *** chason has joined #openstack-keystone | 15:07 | |
| *** chason has quit IRC | 15:07 | |
| *** chason has joined #openstack-keystone | 15:08 | |
| kmalloc | ildikov: yep, and you have knikolla lbragstad and cmurphy, so changing for.me.isnt important | 15:23 |
| ildikov | kmalloc: I don't think you're less important than others, would be better if you could make it too! | 15:25 |
| ildikov | kmalloc: I blame time zones :) | 15:25 |
| *** pcaruana has quit IRC | 15:34 | |
| *** Emine has quit IRC | 15:40 | |
| *** jlvillal is now known as jlv-sick | 15:40 | |
| *** aojea has joined #openstack-keystone | 15:51 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Convert policy API to flask https://review.openstack.org/589950 | 15:54 |
| lbragstad | kmalloc: ^ that's going to fail 18 tests, but wanted to make sure i was doing things right | 15:54 |
| lbragstad | that just moves the /policy api and doesn't touch the endpoint policy API, yet | 15:54 |
| *** dklyle has joined #openstack-keystone | 15:55 | |
| *** david-lyle has joined #openstack-keystone | 15:59 | |
| *** dklyle has quit IRC | 16:01 | |
| *** david-lyle is now known as dklyle | 16:02 | |
| *** raildo has quit IRC | 16:07 | |
| *** elibrokeit has quit IRC | 16:21 | |
| *** elibrokeit has joined #openstack-keystone | 16:22 | |
| *** raildo has joined #openstack-keystone | 16:28 | |
| *** dklyle has quit IRC | 16:43 | |
| *** gyee has joined #openstack-keystone | 16:52 | |
| orange_julius | Is there anything I should be aware of with Keystone + RabbitMQ that might cause wierdness? How does keystone use rabbitmq? | 17:21 |
| *** dklyle has joined #openstack-keystone | 17:21 | |
| lbragstad | orange_julius: keystone only uses rabbit for outgoing notifications | 17:49 |
| orange_julius | Hmm ok thanks | 17:50 |
| lbragstad | for example, when certain events happen in keystone, it can place a notification on the message bus for other things to consume | 17:50 |
| lbragstad | (e.g. you want to know when project resources are updated) | 17:50 |
| lbragstad | otherwise - keystone doesn't consume anything off the message bus.. | 17:51 |
| lbragstad | in fact, message queues are entirely optional for keystone from a deployment perspective | 17:52 |
| *** raildo has quit IRC | 17:54 | |
| *** raildo has joined #openstack-keystone | 17:54 | |
| orange_julius | Ok just making sure. Thanks | 17:55 |
| lbragstad | yep - are you able to recreate the bug using your test env? | 17:56 |
| orange_julius | Not yet. I'm trying to find out what is different. A simple test of vanilla keystone with LDAP doesn't appear to show the same symptoms.. Although actually... I havn't tried it from the cmdline on the prod env yet.. | 17:57 |
| *** dklyle has quit IRC | 17:57 | |
| lbragstad | so - you've backed your test keystone to the same AD but you're not locked out when you try and login to horizon using a bad password? | 17:58 |
| orange_julius | I don't have horizon set up yet. I've been testing with the openstack cmdline tools. 'source rc_file; openstack project list' | 17:59 |
| orange_julius | but yes. it is not locking me out | 17:59 |
| lbragstad | interesting | 17:59 |
| orange_julius | Also interesting tidbit. On the test environment I am receiving a "bad password" while doing the cmdline tool test. In prod I receive a "The request you have made requires authentication" message. | 18:00 |
| orange_julius | That may be what it is returning when keystone finds a locked user in AD though | 18:01 |
| * lbragstad spins up a new instances to test with openldap | 18:06 | |
| *** elibrokeit has quit IRC | 18:07 | |
| orange_julius | After looking more a tldappool and ldap/common.py it really seems like this should be the issue.... | 18:08 |
| *** Emine has joined #openstack-keystone | 18:09 | |
| *** elibrokeit has joined #openstack-keystone | 18:09 | |
| *** dklyle has joined #openstack-keystone | 18:09 | |
| *** itlinux has joined #openstack-keystone | 18:12 | |
| lbragstad | i'm curious if i can recreate this using openldap | 18:12 |
| lbragstad | http://www.openldap.org/doc/admin24/overlays.html#Password%20Policies | 18:13 |
| orange_julius | Should work in theory | 18:14 |
| *** dklyle has quit IRC | 18:31 | |
| *** dklyle has joined #openstack-keystone | 18:34 | |
| orange_julius | Cannot replicate with x3 keystones + haproxy either | 18:37 |
| orange_julius | Have not tried Galera replication yet. Would that effect it in some way? I wouldn't think so.. | 18:38 |
| *** fiddletwix has quit IRC | 18:41 | |
| *** sapd has quit IRC | 18:49 | |
| kmalloc | lbragstad: commented, minor nits mostly | 18:51 |
| kmalloc | lbragstad: one thing that warrants a -1, and it's about needing to refactor the deprecated decorator | 18:51 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert endpoints api to flask native dispatching https://review.openstack.org/589642 | 18:58 |
| *** dklyle has quit IRC | 18:59 | |
| lbragstad | orange_julius: no - i wouldn't either | 19:01 |
| lbragstad | kmalloc: ack - thanks for the review | 19:03 |
| kmalloc | lbragstad: i found a minor data leak bug in our role API | 19:14 |
| kmalloc | lbragstad: i think. | 19:14 |
| * kmalloc reads this one more time | 19:14 | |
| kmalloc | it is possible to determine if a role exists [by id] unauthenticated or even if you're authenticated but not allowed to get roles. | 19:15 |
| kmalloc | lbragstad: in support of the "domain roles" we call "get_role_wrapper" which does the provider lookup and then passes down to .get_role or .get_domain_role (on the RoleV3 controller) | 19:16 |
| kmalloc | get_role and get_domain_role are @protected | 19:16 |
| kmalloc | get_role_wrapper is not | 19:17 |
| kmalloc | so you can get a RoleNotFound even if you have no token. | 19:17 |
| kmalloc | this is a pretty minor data leak | 19:17 |
| kmalloc | but it is a data leak none-the-less | 19:17 |
| kmalloc | and i just relalized this wasn't in a direct messagee... and is in a logged channgel. | 19:18 |
| kmalloc | ugh | 19:18 |
| * kmalloc goes and opens a security bug. | 19:18 | |
| orange_julius | So here is something potentially interesting.. running a TCPDUMP in production shows the authentication request (/v3/auth/tokens) coming through multiple times while a tcpdump in test shows just one request come through | 19:19 |
| orange_julius | I swear to god if this is a network issue... | 19:19 |
| kmalloc | orange_julius: i would be shocked if a network issue caused it since it should require TCP handshake for the post. | 19:20 |
| orange_julius | At this point I'm ready to entertain all possibilities. Not being able to replicate this is super frustrating =P | 19:21 |
| kmalloc | orange_julius: i could totally buy openstack-django-auth re-sending the post becuase it doesn't get a response it knows is "your username/password is wrong" and instead thinks it is a "token is invalid, reauth" | 19:21 |
| kmalloc | but i would be shocked if a network issue over TCP could cause multiple posts at the network layer itself [application stupidity aside] | 19:22 |
| orange_julius | Is that the theory that we have been talking about before? openstack-django-auth would only be the horizon dashboard, no? | 19:22 |
| kmalloc | yeah it would be. | 19:23 |
| kmalloc | if you're using CLI and seeing the issue it coudl point to an issue in keystoneauth mis-raising an exception that could affect more than just horizon, it could impact horizon, cli, etc | 19:24 |
| orange_julius | Yup so the issue happens in the CLI and horizon | 19:24 |
| kmalloc | if you use raw CURL to do a post and get the same issue [no python code] | 19:24 |
| kmalloc | and the user still gets locked out, then i could see network/keystone/haproxy | 19:24 |
| kmalloc | this might also be the retry logic in ksa. | 19:24 |
| kmalloc | ksa = keystoneauth library | 19:25 |
| kmalloc | or heck just plain requests, but in short don't use keystoneauth, make a direct post to the keystone endpoint to get a token and see if you lock out the user. | 19:25 |
| orange_julius | Alrighty I'll try that. | 19:26 |
| kmalloc | orange_julius: :) i hope it shows that we have a bug in keystoneauth only because it means you did nothing wrong and we can work to get a fix for you/everyone quickly | 19:28 |
| orange_julius | direct curl to a keystone endpoint locks out the user | 19:29 |
| orange_julius | I shouldn't be happy about that, but I am. I think that eliminates a bunch of things that were tumbling around my brain | 19:30 |
| orange_julius | The question becomes.... why can't I replicate this | 19:31 |
| kmalloc | lbragstad: ah nvm, no security issue, but ick, this code is ... awful | 19:32 |
| kmalloc | orange_julius: the curl locked out the user and the TCPdump showed multiple posts? | 19:32 |
| kmalloc | orange_julius: just to be sure the user wasn't about to be locked out on a single failed attempt | 19:33 |
| orange_julius | Checking again now. One sec. | 19:33 |
| kmalloc | sure thing :) | 19:33 |
| lbragstad | are you sure you're using the same ldap config as what's in production? | 19:36 |
| orange_julius | Well I didn't get the tcpdump, but I did just have the account unlocked so I know it didn't have a latent password attempts | 19:38 |
| orange_julius | and yes I am pretty sure but I will double check. I copied everything over from production | 19:38 |
| *** Emine has quit IRC | 19:53 | |
| lbragstad | kmalloc: TBH i'm liking the self.request_body_json/self.auth_context properties | 20:00 |
| lbragstad | that's going to be really nice i think | 20:00 |
| *** Emine has joined #openstack-keystone | 20:00 | |
| *** dklyle has joined #openstack-keystone | 20:05 | |
| kmalloc | lbragstad: :) | 20:08 |
| kmalloc | lbragstad: advantages to having everything in a clear location | 20:09 |
| kmalloc | lbragstad: and having direct access to the request context | 20:09 |
| kmalloc | lbragstad: i've almost finished [running tests] for /v3/roles, then will work on OS-INHERIT and /role_inference | 20:10 |
| kmalloc | i hope i'll have the bulk of assignment (not the cross-api bits) done shortly | 20:10 |
| *** itlinux has quit IRC | 20:12 | |
| lbragstad | cool - i'm still wading through policy | 20:16 |
| lbragstad | working on OS-ENDPOINT-POLICY now though | 20:16 |
| kmalloc | OS-ENDPOINT-POLICY shouldn't be too bad. | 20:17 |
| kmalloc | your change will conflict with my endpoints change, but that is not a big deal | 20:17 |
| kmalloc | we can race to rebase :) | 20:17 |
| kmalloc | whomever's lands last will need to update to remove routers. | 20:17 |
| lbragstad | so - the OS-ENDPOINT-POLICY api deals with a bunch of different resources | 20:19 |
| lbragstad | like policies, endpoints, and services | 20:19 |
| lbragstad | if those resource classes are defined in other modules within keystone/api, can i just import them and re-use them ' | 20:20 |
| lbragstad | ? | 20:20 |
| *** raildo has quit IRC | 20:20 | |
| kmalloc | if you look at https://review.openstack.org/#/c/589288/ you'll see how to wrap members from other apis | 20:21 |
| kmalloc | i've already fixed that :) | 20:21 |
| kmalloc | and you'll want to move the notification callbacks to the manager | 20:24 |
| kmalloc | lbragstad: fwiw, most of what you're seeing is just weirdness in the url | 20:26 |
| kmalloc | and line wrapping | 20:26 |
| kmalloc | /policies/{policy_id}' + self.PATH_PREFIX + | 20:26 |
| kmalloc | '/services/{service_id}'), | 20:26 |
| kmalloc | that is really /policies/{policy_id}/OS-ENDPOINT_POLICY/services/{service_id}'), | 20:26 |
| lbragstad | right | 20:26 |
| kmalloc | which in flask becomes: /policies/<string:policy_id>/OS-ENDPOINT_POLICY/services/<string:service_id>' | 20:27 |
| kmalloc | and the controller doesn't actually emit anything | 20:27 |
| kmalloc | it's almost all NO_CONTENT | 20:27 |
| kmalloc | list_endpoints_for_policy is the only thing you have to return a value for | 20:28 |
| lbragstad | oh - i suppose | 20:28 |
| kmalloc | yep | 20:28 |
| lbragstad | the write operations are put | 20:28 |
| lbragstad | and delete | 20:28 |
| kmalloc | exactly | 20:28 |
| lbragstad | and check policy associations don't return bodies despite being a GET? | 20:28 |
| kmalloc | not according to the code. | 20:29 |
| kmalloc | they don't have return | 20:29 |
| kmalloc | so it's an explicit None | 20:29 |
| lbragstad | hmm | 20:29 |
| kmalloc | s/explicit/implicit | 20:29 |
| lbragstad | interesting | 20:29 |
| kmalloc | the biggest change is moving the callbacks to the manager | 20:29 |
| lbragstad | get_policy_for_endpoint seems to | 20:29 |
| kmalloc | get policy for endpoint is /endpoints | 20:30 |
| kmalloc | https://git.openstack.org/cgit/openstack/keystone/tree/keystone/api/endpoints.py?h=refs/changes/42/589642/4#n124 | 20:30 |
| lbragstad | isn't it /policy ? | 20:30 |
| kmalloc | addressed in my migration of /endpoints | 20:31 |
| kmalloc | nope, policy for endpoints goes in /endpoints, list_endpoints_for_policy is in /policy | 20:31 |
| kmalloc | https://github.com/openstack/keystone/blob/master/keystone/endpoint_policy/routers.py#L38 | 20:31 |
| kmalloc | this is why moving to keystone.api where all code for a given path prefix lives in one place is so much better | 20:32 |
| lbragstad | ah - so i just need to include list_endpoints_for_policy since that's the one under /policies | 20:32 |
| kmalloc | i didn't even know endpoint-policy hooked into /endpoints until i failed some tests | 20:32 |
| kmalloc | yep. | 20:32 |
| lbragstad | ok | 20:33 |
| kmalloc | this whole cross-api extension from random places in the codebase has made the move to flask much harder | 20:35 |
| lbragstad | i'm going to need new resource clases for endpoint policies and service policies | 20:36 |
| *** dklyle has quit IRC | 20:58 | |
| *** dklyle has joined #openstack-keystone | 21:02 | |
| *** dklyle has quit IRC | 21:07 | |
| *** pcaruana has joined #openstack-keystone | 21:07 | |
| openstackgerrit | Merged openstack/keystone master: Allow for more robust config checking with keystone-manage https://review.openstack.org/589308 | 21:37 |
| lbragstad | kmalloc: have you seen exceptions like this? http://paste.openstack.org/show/727678/ | 21:49 |
| *** aojea has quit IRC | 21:55 | |
| openstackgerrit | Merged openstack/keystone master: Convert limits and registered limits to flask dispatching https://review.openstack.org/588080 | 21:56 |
| *** pcaruana has quit IRC | 22:02 | |
| lbragstad | i think it's because i'm defining multiple resource mappings... | 22:04 |
| *** nicolasbock has quit IRC | 22:06 | |
| *** aojea has joined #openstack-keystone | 22:08 | |
| *** aojea has quit IRC | 22:09 | |
| *** edmondsw has quit IRC | 22:10 | |
| *** aojea has joined #openstack-keystone | 22:11 | |
| *** rcernin has joined #openstack-keystone | 22:19 | |
| *** Emine has quit IRC | 22:23 | |
| *** aojea has quit IRC | 22:30 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Convert policy API to flask https://review.openstack.org/589950 | 22:50 |
| *** zioproto_ has joined #openstack-keystone | 22:55 | |
| *** gmann_ has joined #openstack-keystone | 22:55 | |
| *** gagehugo_ has joined #openstack-keystone | 22:59 | |
| *** r-daneel has joined #openstack-keystone | 22:59 | |
| *** lbragstad has quit IRC | 23:01 | |
| *** evrardjp has quit IRC | 23:02 | |
| *** SamYaple has quit IRC | 23:02 | |
| *** Tahvok has quit IRC | 23:02 | |
| *** NikitaKonovalov has quit IRC | 23:02 | |
| *** weezhard has quit IRC | 23:02 | |
| *** mtreinish has quit IRC | 23:02 | |
| *** timss has quit IRC | 23:02 | |
| *** gagehugo has quit IRC | 23:02 | |
| *** gmann has quit IRC | 23:02 | |
| *** zioproto has quit IRC | 23:02 | |
| *** gmann_ is now known as gmann | 23:02 | |
| *** zioproto_ is now known as zioproto | 23:02 | |
| *** Tahvok has joined #openstack-keystone | 23:03 | |
| *** mtreinish has joined #openstack-keystone | 23:04 | |
| *** timss has joined #openstack-keystone | 23:10 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!