| *** rcernin has joined #openstack-keystone | 00:11 | |
| *** rcernin_ has quit IRC | 00:12 | |
| *** rcernin has quit IRC | 00:13 | |
| *** rcernin has joined #openstack-keystone | 00:14 | |
| *** aojea has joined #openstack-keystone | 00:39 | |
| *** aojea has quit IRC | 00:44 | |
| *** dmellado has joined #openstack-keystone | 00:51 | |
| openstackgerrit | Merged openstack/keystone master: Add caching on trust role validation to improve performance https://review.openstack.org/608963 | 01:06 |
|---|---|---|
| *** imacdonn has quit IRC | 01:23 | |
| *** imacdonn has joined #openstack-keystone | 01:23 | |
| *** markvoelker has joined #openstack-keystone | 01:25 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:42 | |
| *** idlemind has joined #openstack-keystone | 01:53 | |
| *** Dinesh_Bhor has quit IRC | 01:59 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone master: Implement auth receipts spec https://review.openstack.org/611230 | 02:02 |
| openstackgerrit | Adrian Turjak proposed openstack/keystone master: Implement auth receipts spec https://review.openstack.org/611230 | 02:04 |
| vishakha | kmalloc: for https://review.openstack.org/#/c/610479/ , I have updated a document patch for it. Pl review | 02:31 |
| *** Dinesh_Bhor has joined #openstack-keystone | 02:35 | |
| *** dave-mccowan has quit IRC | 02:57 | |
| *** munimeha1 has quit IRC | 03:01 | |
| *** Dinesh_Bhor has quit IRC | 03:37 | |
| *** aojea has joined #openstack-keystone | 04:16 | |
| *** aojea has quit IRC | 04:20 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:42 | |
| kmalloc | vishakha: thnx! | 05:27 |
| vishakha | kmalloc: Aslo have some doubt for https://review.openstack.org/#/c/607897/, I posted the comment in it | 05:35 |
| *** spsurya has joined #openstack-keystone | 05:49 | |
| kmalloc | vishakha: commented | 06:13 |
| vishakha | kmalloc: working on it. Thanks for the quick review :) | 06:14 |
| *** ebukha has joined #openstack-keystone | 06:19 | |
| *** ayoung has quit IRC | 06:39 | |
| *** Dinesh_Bhor has quit IRC | 06:52 | |
| *** pcaruana has joined #openstack-keystone | 06:56 | |
| *** jaosorior has quit IRC | 07:02 | |
| *** felipemonteiro has joined #openstack-keystone | 07:04 | |
| *** jaosorior has joined #openstack-keystone | 07:05 | |
| *** rcernin has quit IRC | 07:06 | |
| *** rdopiera has joined #openstack-keystone | 07:09 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:16 | |
| *** felipemonteiro has quit IRC | 07:22 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: [WIP] Implement scope_type checking for grant api https://review.openstack.org/612615 | 07:33 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: [WIP] Implement scope_type checking for grant api https://review.openstack.org/612615 | 07:35 |
| openstackgerrit | Merged openstack/keystone master: Flask comment/docstring cleanup https://review.openstack.org/609837 | 07:39 |
| openstackgerrit | Merged openstack/keystone master: Cleanup test_wsgi https://review.openstack.org/609838 | 07:39 |
| *** ebukha has quit IRC | 07:52 | |
| *** xek has joined #openstack-keystone | 07:55 | |
| *** xek_ has joined #openstack-keystone | 08:01 | |
| *** xek has quit IRC | 08:03 | |
| openstackgerrit | Merged openstack/keystone master: Make collection_key and member_key raise if unset https://review.openstack.org/610129 | 08:05 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: nit: remove useless code https://review.openstack.org/612625 | 08:08 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: nit: remove useless code https://review.openstack.org/612625 | 08:09 |
| *** pvradu has joined #openstack-keystone | 08:16 | |
| *** mvkr has quit IRC | 08:26 | |
| *** ebukha has joined #openstack-keystone | 08:27 | |
| *** dmellado has quit IRC | 08:34 | |
| *** mvkr has joined #openstack-keystone | 08:51 | |
| *** Dinesh_Bhor has quit IRC | 08:54 | |
| *** ebukha has quit IRC | 08:56 | |
| *** adriant has quit IRC | 09:09 | |
| *** adriant has joined #openstack-keystone | 09:10 | |
| *** adriant has quit IRC | 09:13 | |
| *** adriant has joined #openstack-keystone | 09:14 | |
| *** adriant has quit IRC | 09:16 | |
| *** dmellado has joined #openstack-keystone | 09:18 | |
| *** bzhao__ has quit IRC | 09:20 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Fix spelling in explicit domain id specification https://review.openstack.org/612644 | 09:20 |
| *** Ebukha has joined #openstack-keystone | 09:22 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Update policy security roadmap https://review.openstack.org/602443 | 09:31 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: [WIP] Implement scope_type checking for grant api https://review.openstack.org/612615 | 09:31 |
| *** mvkr has quit IRC | 09:36 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Use request_body_json function https://review.openstack.org/612492 | 09:39 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Pass context objects to policy enforcement https://review.openstack.org/605539 | 09:41 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Adding 'date' for trust_flush https://review.openstack.org/607897 | 09:43 |
| *** mvkr has joined #openstack-keystone | 09:50 | |
| *** Ebukha has quit IRC | 09:50 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement scope_types for user API https://review.openstack.org/611179 | 09:51 |
| *** Ebukha has joined #openstack-keystone | 10:00 | |
| *** pvradu has quit IRC | 10:00 | |
| *** pvradu has joined #openstack-keystone | 10:00 | |
| *** xek_ has quit IRC | 10:03 | |
| *** pvradu_ has joined #openstack-keystone | 10:05 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 10:07 | |
| *** xek has joined #openstack-keystone | 10:07 | |
| *** pvradu has quit IRC | 10:09 | |
| *** Dinesh_Bhor has quit IRC | 10:15 | |
| openstackgerrit | Merged openstack/keystone-specs master: Fix spelling in explicit domain id specification https://review.openstack.org/612644 | 10:31 |
| *** Ebukha_ has joined #openstack-keystone | 11:01 | |
| *** Ebukha has quit IRC | 11:01 | |
| *** markvoelker has quit IRC | 11:45 | |
| *** Ebukha_ is now known as Ebukha | 11:55 | |
| *** dave-mccowan has joined #openstack-keystone | 12:07 | |
| odyssey4me | lbragstad: you around? I'd like to ask a question about https://bugs.launchpad.net/openstack-ansible/+bug/1793389 - I'm wondering whether keystone doesn't already have something built-in to flush the cache? | 12:10 |
| openstack | Launchpad bug 1793389 in openstack-ansible "Upgrade to Ocata: Keystone Intermittent Missing 'options' Key" [Medium,Fix released] - Assigned to Alex Redinger (rexredinger) | 12:10 |
| lbragstad | odyssey4me checking | 12:11 |
| odyssey4me | lbragstad: https://review.openstack.org/608066 has been added, rather than our previous strategy which was https://github.com/openstack/openstack-ansible/blob/master/scripts/upgrade-utilities/playbooks/memcached-flush.yml run just before the general upgrade - but that wasn't sufficient in this case... it seemed to fail the first time and needed to be redone | 12:12 |
| lbragstad | interesting | 12:13 |
| lbragstad | i suppose users are being cached and that breaks things | 12:13 |
| lbragstad | since it looks like that cached user doesn't have the options attribute | 12:14 |
| lbragstad | so are you asking if keystone has a better way to flush the cache? | 12:15 |
| lbragstad | or has a way to flush the cache natively? | 12:15 |
| odyssey4me | lbragstad: I'm wondering whether keystone either understands these changes and will flush/invalidate cache automatically... or yes, whether it has a native capability. | 12:16 |
| odyssey4me | This might be a good thing for keystone-doctor, or something similar. | 12:16 |
| odyssey4me | Invliadating the entire cache obviously has some performance implications. | 12:17 |
| lbragstad | right | 12:17 |
| cmurphy | i don't think our sqlalchemy migrations understand about invalidating relevant caches | 12:17 |
| lbragstad | well - it is going to be hard to write something in process that understand when deployers are going to upgrade | 12:17 |
| lbragstad | not sure if this is a good option but... | 12:17 |
| cmurphy | yeah | 12:17 |
| odyssey4me | Right, but in-process may be able to understand that the object it's looking at is an old version? | 12:18 |
| lbragstad | we could handle that exception and manually invalidate the region | 12:18 |
| odyssey4me | or that | 12:18 |
| lbragstad | since we've seen this specific exception crop up a couple times for the same exact reason | 12:18 |
| lbragstad | and after a certain amount of time, we can remove that try/except | 12:18 |
| odyssey4me | I guess this is the sort of thing versioned objects was designed to handle, but I don't think keystone is using that? | 12:19 |
| lbragstad | yeah - we don't use versioned objects | 12:19 |
| lbragstad | ok - so this affects upgrades to ocata | 12:20 |
| lbragstad | which is the oldest supported release | 12:20 |
| lbragstad | we'd have to write the patch, apply it to stein, rocky, queens, pike, and finally ocata | 12:20 |
| lbragstad | and then remove it from master, since it wouldn't be applicable anymore? | 12:21 |
| lbragstad | and possibly remove it from other branches, too? | 12:21 |
| cmurphy | you can submit it directly to ocata if it only affects ocata | 12:21 |
| cmurphy | the stable policy isn't so strict that you need to apply patches where it doesn't make sense | 12:21 |
| lbragstad | cool - so maybe it's easier than i thought | 12:22 |
| cmurphy | but a related question is about ffu | 12:22 |
| odyssey4me | well, that's an option of course - but would this not perhaps happen again some time in the future? | 12:22 |
| cmurphy | odyssey4me: right this would only be a bandaid on the one problem | 12:22 |
| lbragstad | well - are ffu an online thing? | 12:23 |
| lbragstad | better question - do ffu operate under the assumption there will be service downtime? | 12:23 |
| odyssey4me | The ideal would be that any patch that changes things will not have an exception if the object is missing the new stuff, but that's pretty hard to enferce because it requires reviewers to think about it. Although I suppose that's a testable thing. | 12:24 |
| lbragstad | the last time we had to deal with something like that was with password hashing | 12:25 |
| cmurphy | yeah so it's bound to come up again | 12:25 |
| lbragstad | iirc - we had to think pretty hard about the upgrade path | 12:25 |
| lbragstad | s/path/paths/ | 12:25 |
| odyssey4me | I suppose handling the exception with flushing the cache is the ultimate back-stop. If somehow the triggering of that in gates could see it happening and raise a warning/error, prompting the patch author to handle things more gracefully for the new patch, that'd be better. The backstop is still there though. | 12:26 |
| lbragstad | technically - we would have caught this with online migration testing | 12:28 |
| lbragstad | depending on the test, i think | 12:28 |
| lbragstad | but since this is technically in the authentication path, it would be pretty common | 12:29 |
| openstackgerrit | Dmitry Tantsur proposed openstack/keystoneauth master: Make new-style single endpoint version discovery actually work for ironic https://review.openstack.org/612680 | 12:29 |
| *** tobberydberg has quit IRC | 12:30 | |
| *** markvoelker has joined #openstack-keystone | 12:36 | |
| odyssey4me | lbragstad cmurphy is that bug sufficient - should I add keystone to it? | 12:36 |
| *** markvoelker has quit IRC | 12:37 | |
| lbragstad | sure - we can at least document the approach | 12:37 |
| cmurphy | maybe we could have a special RFE bug for keystone? would be good to have a proper consistent approach in keystone eventually | 12:40 |
| *** aojea_ has joined #openstack-keystone | 12:42 | |
| *** aojea_ has quit IRC | 12:55 | |
| *** aojea_ has joined #openstack-keystone | 12:56 | |
| lbragstad | yeah - agreed | 12:57 |
| lbragstad | would the RFE before finding ways to deal with this then? | 12:58 |
| lbragstad | and we can track 1793389 for this specific fix? | 12:58 |
| cmurphy | sure | 12:58 |
| lbragstad | cmurphy odyssey4me https://review.openstack.org/#/c/612686/1 | 12:58 |
| odyssey4me | lbragstad: thanks - I'll watch it, and notify our folks to see if they have any feedback and can test it when it's ready for that | 13:00 |
| lbragstad | sounds good | 13:01 |
| lbragstad | cc kmalloc ^ | 13:01 |
| *** bnemec has joined #openstack-keystone | 13:08 | |
| *** aojea_ has quit IRC | 13:17 | |
| *** aojea_ has joined #openstack-keystone | 13:18 | |
| *** aojea_ has quit IRC | 13:22 | |
| *** ayoung has joined #openstack-keystone | 13:28 | |
| *** aojea_ has joined #openstack-keystone | 13:45 | |
| *** aojea_ has quit IRC | 13:48 | |
| *** aojea_ has joined #openstack-keystone | 13:52 | |
| *** aojea_ has quit IRC | 13:55 | |
| *** aojea_ has joined #openstack-keystone | 13:56 | |
| *** Ebukha has quit IRC | 13:57 | |
| *** edmondsw has joined #openstack-keystone | 14:00 | |
| *** aojea_ has quit IRC | 14:00 | |
| knikolla | o/ | 14:16 |
| lbragstad | in case folks didn't see this yesterday - https://github.com/yahoo/openstack-collab/tree/master/keystone-federation-ocata | 14:31 |
| *** felipemonteiro has joined #openstack-keystone | 14:38 | |
| ayoung | lbragstad, OK...I think I have a plan to roll in the system-roles changes for an existing site: | 14:39 |
| ayoung | we make use of is_admin_project as a way to turn off admin later on | 14:39 |
| ayoung | basically, the same plan as I had for using is_admin_project, but instead of migrating people from admin-on-anywhere to admin-on-admin, we migrate the from admin-on-anywhere to system scope | 14:40 |
| ayoung | the enforcement of is_admin_project will let people with admin-anywhere continue to function | 14:40 |
| ayoung | but we start training people to request admin scoped tokens, make sure horizon works with them, etc | 14:40 |
| ayoung | once an org is ready to go full service scoped tokens, we enable an admin_project: it can be a bogus one | 14:41 |
| ayoung | that will disable is_admin_project rule in policy. Then we can start removing them from the policy files. | 14:41 |
| ayoung | Make sense? | 14:41 |
| lbragstad | not really - but i'm in the middle of parsing something else at the moment | 14:41 |
| ayoung | Not, perhaps, as intuitive as I would have liked. | 14:41 |
| ayoung | Its ok. GO back and read this later whne you have the bandwith free | 14:42 |
| lbragstad | sounds good - thanks ayoung | 14:42 |
| ayoung | lbragstad, I like uuid.uuid3(uuid.NAMESPACE_OID, str(string)).hex | 14:43 |
| ayoung | gah...but it is python2 specific | 14:44 |
| ayoung | nope...I'm just in the dumbs this morning | 14:47 |
| ayoung | kmalloc, if we go with the oath approach, do we then want to specify the UUIDs for the namespaces in the config files? So, instead of uuid.uuid5(uuid.NAMESPACE_OID, 'admin').hex we'd have uuid.uuid5(CONF.roles.namespace, 'admin').hex | 14:52 |
| ayoung | Was there an edge call today? I called in but no-one was there | 14:54 |
| lbragstad | we ended early | 14:57 |
| knikolla | where are people staying in berlin? looks like all the hotels recommended by the foundation are pretty far from the venue | 15:01 |
| ayoung | knikolla, we have an Air BnB | 15:04 |
| ayoung | Its actually closer than some of the hotels, I think | 15:06 |
| knikolla | interesting, i didn't look into airbnbs | 15:08 |
| mordred | lbragstad, cmurphy, kmalloc: https://review.openstack.org/#/c/612680/ <-- should fix issues in the bifrost gate ... ironic updated to have proper version discovery docs, but one of our workarounds was unhappy :) | 15:10 |
| kmalloc | Ahhh | 15:14 |
| kmalloc | Ok | 15:14 |
| mordred | kmalloc: I think we'll need a bugfix release with that patch in it once it lands | 15:23 |
| *** wxy| has joined #openstack-keystone | 15:34 | |
| kmalloc | ++ | 15:36 |
| kmalloc | +2/+a | 15:37 |
| *** mvkr has quit IRC | 15:39 | |
| ayoung | Are we meeting today? Anyone have anything for the Agenda? | 15:46 |
| ayoung | https://etherpad.openstack.org/p/keystone-weekly-meeting | 15:46 |
| *** felipemonteiro has quit IRC | 16:09 | |
| *** rdopiera has quit IRC | 16:15 | |
| *** gyee has joined #openstack-keystone | 16:16 | |
| *** ayoung has quit IRC | 16:21 | |
| *** pvradu_ has quit IRC | 16:37 | |
| *** raildo has joined #openstack-keystone | 16:55 | |
| *** Ebukha has joined #openstack-keystone | 16:57 | |
| *** ayoung has joined #openstack-keystone | 17:03 | |
| * kmalloc goes back to lurk mode. | 17:03 | |
| *** pvradu has joined #openstack-keystone | 17:04 | |
| *** wxy| has quit IRC | 17:05 | |
| openstackgerrit | Merged openstack/keystoneauth master: Make new-style single endpoint version discovery actually work for ironic https://review.openstack.org/612680 | 17:06 |
| *** dnguyen has joined #openstack-keystone | 17:07 | |
| *** pvradu has quit IRC | 17:09 | |
| kmalloc | mordred: ^ | 17:12 |
| *** lbragstad is now known as lbragstad_f00d | 17:17 | |
| openstackgerrit | Merged openstack/keystone master: Adding 'date' for trust_flush https://review.openstack.org/607897 | 17:23 |
| *** dnguyen has quit IRC | 17:33 | |
| *** dnguyen has joined #openstack-keystone | 17:34 | |
| *** pvradu has joined #openstack-keystone | 17:42 | |
| *** lbragstad_f00d is now known as lbragstad | 17:45 | |
| *** felipemonteiro has joined #openstack-keystone | 17:45 | |
| *** aojea has joined #openstack-keystone | 17:46 | |
| *** pvradu has quit IRC | 17:53 | |
| lbragstad | ayoung OH! | 17:55 |
| lbragstad | https://github.com/yahoo/openstack-collab/blob/master/keystone-federation-ocata/plugin/keystone/auth/plugins/athenz.py#L123 | 17:55 |
| lbragstad | https://github.com/yahoo/openstack-collab/blob/master/keystone-federation-ocata/plugin/keystone/auth/plugins/athenz.py#L80 | 17:55 |
| lbragstad | i'm apparently under-caffeinated | 17:55 |
| lbragstad | i glossed over that | 17:56 |
| lbragstad | when you were talking about that earlier | 17:56 |
| kmalloc | hehe | 18:14 |
| *** Ebukha has quit IRC | 18:26 | |
| *** felipemonteiro has quit IRC | 18:34 | |
| *** dnguyen has quit IRC | 18:35 | |
| *** irclogbot_3 has joined #openstack-keystone | 18:35 | |
| hrybacki | is memcached the norm cache backend for folks in production? | 18:35 |
| *** dnguyen has joined #openstack-keystone | 18:37 | |
| ayoung | hrybacki, yep | 18:57 |
| ayoung | kmalloc, ^^ can you tell hrybacki whether or not I am a liar? | 18:58 |
| hrybacki | ayoung++ -- im collating best practices | 18:58 |
| hrybacki | ayoung: have you ever had issues w/ memcached logs? | 19:13 |
| ayoung | hrybacki, not enough first hand experience to say. | 19:22 |
| *** pcaruana has quit IRC | 19:23 | |
| hrybacki | ayoung: ack | 19:23 |
| *** david-lyle has joined #openstack-keystone | 19:27 | |
| *** dklyle has quit IRC | 19:28 | |
| *** lbragstad has quit IRC | 19:50 | |
| *** lbragstad has joined #openstack-keystone | 19:53 | |
| *** ChanServ sets mode: +o lbragstad | 19:53 | |
| *** david-lyle is now known as dklyle | 19:53 | |
| kmalloc | lbragstad: i think you have a problem with https://review.openstack.org/#/c/605539/18/keystone/common/rbac_enforcer/enforcer.py | 20:03 |
| kmalloc | can we remove the token rendered version from the target dict? | 20:04 |
| kmalloc | i.. i don't think we can | 20:04 |
| kmalloc | without breaking people's custom polcies | 20:04 |
| kmalloc | since we have historically populated that | 20:04 |
| kmalloc | memcached logs? | 20:05 |
| kmalloc | hrybacki: ^ | 20:05 |
| kmalloc | hrybacki: oh, memcache is afaik almost the only backend for cache people use | 20:05 |
| kmalloc | redis is almost never used, hp uses mongo (hah) | 20:05 |
| kmalloc | used* | 20:06 |
| *** openstackgerrit has quit IRC | 20:06 | |
| kmalloc | for the most part i don't think anyone has used non-memcache cache layer in openstack | 20:06 |
| *** mvkr has joined #openstack-keystone | 20:12 | |
| hrybacki | kmalloc: at least we have one standard :) | 20:13 |
| lbragstad | wut... | 20:23 |
| kmalloc | lbragstad: sorry in the credential dict | 20:24 |
| kmalloc | not in the target dict | 20:24 |
| kmalloc | if we remove the rendered token from the cred dict (policy), and lookups for token.x.y will fail | 20:25 |
| kmalloc | and it has historically been there | 20:25 |
| kmalloc | can we realistically reemove the render? | 20:25 |
| kmalloc | if we can, cool. | 20:25 |
| kmalloc | but... | 20:25 |
| * lbragstad is confused | 20:31 | |
| *** xek has quit IRC | 20:41 | |
| lbragstad | stepping away for a bit | 20:45 |
| *** openstackgerrit has joined #openstack-keystone | 20:55 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: [WIP] Add functional testing gate https://review.openstack.org/531014 | 20:55 |
| *** mchlumsky has quit IRC | 21:01 | |
| *** felipemonteiro has joined #openstack-keystone | 21:13 | |
| *** xek has joined #openstack-keystone | 21:14 | |
| *** xek has quit IRC | 21:17 | |
| *** dklyle has quit IRC | 21:19 | |
| *** dklyle has joined #openstack-keystone | 21:20 | |
| *** raildo has quit IRC | 21:23 | |
| *** spsurya has quit IRC | 21:38 | |
| *** Ebukha has joined #openstack-keystone | 21:40 | |
| *** Ebukha has quit IRC | 21:44 | |
| *** felipemonteiro has quit IRC | 21:52 | |
| *** felipemonteiro has joined #openstack-keystone | 21:54 | |
| *** dnguyen has quit IRC | 22:01 | |
| *** aojea has quit IRC | 22:02 | |
| *** dnguyen has joined #openstack-keystone | 22:02 | |
| *** felipemonteiro has quit IRC | 22:12 | |
| *** rcernin has joined #openstack-keystone | 22:24 | |
| *** bnemec has quit IRC | 22:25 | |
| *** dnguyen has quit IRC | 22:55 | |
| *** dnguyen has joined #openstack-keystone | 22:57 | |
| *** threestrands has joined #openstack-keystone | 23:02 | |
| *** adriant has joined #openstack-keystone | 23:08 | |
| kmalloc | lbragstad: sorry i needed a nap after this last weekend. | 23:20 |
| kmalloc | lbragstad: i'm back now, we should chat more about that render_token bit now that i'm awake | 23:20 |
| kmalloc | when you're back | 23:20 |
| *** idlemind has quit IRC | 23:38 | |
| *** gyee has quit IRC | 23:46 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!