| *** imacdonn has quit IRC | 00:00 | |
| *** imacdonn has joined #openstack-keystone | 00:00 | |
| kmalloc | i was thinking of just merging it into a config group | 00:24 |
|---|---|---|
| kmalloc | jwt and then call it jws_XXXX and jwe_XXX | 00:24 |
| kmalloc | so it would be in the [jwt_tokens] group | 00:24 |
| kmalloc | *shrug* | 00:24 |
| lbragstad | oh - not sharing keys though? | 00:24 |
| kmalloc | right | 00:24 |
| kmalloc | +2 as is fwiw | 00:24 |
| lbragstad | ok right | 00:24 |
| kmalloc | just mull over the single confg option group | 00:25 |
| lbragstad | will do | 00:25 |
| lbragstad | i can respin it tomorrow if needed | 00:25 |
| kmalloc | yeah no worries if you don't | 00:26 |
| kmalloc | mostly a think it over and decide if it makes sense in a single config group vs multipler | 00:26 |
| *** ileixe has joined #openstack-keystone | 00:58 | |
| adriant | Not sure if anyone here would have an opinion, but I'm proposing Adjutant's service type as 'operator-logic': https://review.openstack.org/#/c/633854/1 | 01:13 |
| adriant | knikolla: you've looked at it, thoughts on my choice of service-type? | 01:14 |
| *** markvoelker has joined #openstack-keystone | 01:36 | |
| *** sapd1_ has quit IRC | 01:40 | |
| *** markvoelker has quit IRC | 01:41 | |
| *** tkajinam_ has joined #openstack-keystone | 01:47 | |
| *** tkajinam has quit IRC | 01:50 | |
| gagehugo | lbragstad: sorry I was out yesterday and today | 01:58 |
| lbragstad | gagehugo no worries | 01:58 |
| lbragstad | glad you're back | 01:59 |
| gagehugo | :) | 02:00 |
| openstackgerrit | Merged openstack/keystone master: Adjust Indents to meet PEP8 E117 https://review.openstack.org/633800 | 02:18 |
| *** lbragstad has quit IRC | 02:19 | |
| *** erus1 has quit IRC | 02:27 | |
| *** markvoelker has joined #openstack-keystone | 02:37 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 02:43 | |
| *** Nel1x has quit IRC | 03:03 | |
| *** markvoelker has quit IRC | 03:08 | |
| *** Nel1x has joined #openstack-keystone | 03:20 | |
| *** sapd1_ has joined #openstack-keystone | 03:55 | |
| *** whoami-rajat has joined #openstack-keystone | 04:02 | |
| *** erus1 has joined #openstack-keystone | 04:09 | |
| *** ayoung has quit IRC | 04:24 | |
| *** Dinesh_Bhor has quit IRC | 04:33 | |
| *** Nel1x has quit IRC | 04:34 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:38 | |
| *** ileixe has quit IRC | 05:05 | |
| *** erus1 has quit IRC | 05:36 | |
| *** ileixe has joined #openstack-keystone | 05:38 | |
| *** aojea has joined #openstack-keystone | 06:23 | |
| *** aojea has quit IRC | 06:27 | |
| *** pcaruana has joined #openstack-keystone | 08:10 | |
| *** tkajinam_ has quit IRC | 08:15 | |
| *** markvoelker has joined #openstack-keystone | 08:16 | |
| *** awalende has joined #openstack-keystone | 08:24 | |
| *** bnemec has joined #openstack-keystone | 08:31 | |
| *** awalende has quit IRC | 08:35 | |
| *** awalende has joined #openstack-keystone | 08:35 | |
| *** xek has joined #openstack-keystone | 08:38 | |
| *** awalende has quit IRC | 08:39 | |
| *** awalende has joined #openstack-keystone | 08:40 | |
| *** markvoelker has quit IRC | 08:49 | |
| *** Dinesh_Bhor has quit IRC | 09:10 | |
| *** ileixe has quit IRC | 09:29 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 09:34 | |
| *** markvoelker has joined #openstack-keystone | 09:47 | |
| *** awalende has quit IRC | 09:48 | |
| *** awalende has joined #openstack-keystone | 09:55 | |
| *** shyamb has joined #openstack-keystone | 09:58 | |
| brtknr | are application credentials available in mitaka? | 10:08 |
| brtknr | e.g. for kubernetes cloud provider with limited subset of priviledges of the user that generated the credential | 10:09 |
| brtknr | not clear from this: https://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/application-credentials.html when it was introduced | 10:12 |
| brtknr | i can see here that it was implemented from queens onwards: https://blueprints.launchpad.net/keystone/+spec/application-credentials | 10:13 |
| *** shyamb has quit IRC | 10:13 | |
| *** shyamb has joined #openstack-keystone | 10:13 | |
| *** dr_gogeta86 has quit IRC | 10:15 | |
| *** markvoelker has quit IRC | 10:19 | |
| *** dr_gogeta86 has joined #openstack-keystone | 10:20 | |
| openstackgerrit | Merged openstack/keystone master: Add experimental job for CentOS https://review.openstack.org/633378 | 10:23 |
| openstackgerrit | Merged openstack/keystone master: Handle special cases with msgpack and python3 https://review.openstack.org/633288 | 10:28 |
| cmurphy | brtknr: it was implemented for queens https://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/application-credentials.html | 10:41 |
| cmurphy | brtknr: that's very strange that it appears in the backlog directory there, that seems like some apache htaccess issue | 10:42 |
| cmurphy | or just that the file was never removed from disk when we moved it out of the backlog | 10:44 |
| brtknr | strange! | 10:46 |
| brtknr | cmurphy: I'm looking at trust as a possible way to do this... | 10:46 |
| brtknr | Is a trust scoped to a particular project | 10:46 |
| brtknr | e.g. I have an admin user and I want to create a service account with trust delegated to a particular project, is this what its for? | 10:47 |
| brtknr | cmurphy: ^ | 10:47 |
| brtknr | I'm currenty failing at even this: | 10:49 |
| brtknr | ubuntu@devstack-queens:/opt/stack/devstack$ openstack --os-project-id=a5a518cb29be42b083c439125eb1a36d trust show 94c31d36983f4edca247895a7017092b | 10:49 |
| brtknr | No trust with a name or ID of '94c31d36983f4edca247895a7017092b' exists. | 10:49 |
| cmurphy | brtknr: yes that is essentially what trusts are for | 10:49 |
| brtknr | whereas, when I do `openstack trust list`, i can clearly see the same trust-id listed there | 10:49 |
| cmurphy | --os-project-id is the project you are authenticating with when you make the trust list request, it's not the project the trust was created for | 10:51 |
| cmurphy | so openstack trust show 94c31d36983f4edca247895a7017092b should work | 10:51 |
| brtknr | hmm, but its not | 10:54 |
| brtknr | this is on stable/queens | 10:54 |
| cmurphy | how did you create the trust? | 10:55 |
| cmurphy | this works for me on master http://paste.openstack.org/show/744245/ we haven't changed the trust code much between queens and now | 10:58 |
| brtknr | openstack trust show works fine on master branch | 11:01 |
| brtknr | on stable/queens, not so much | 11:02 |
| cmurphy | interesting! | 11:02 |
| brtknr | I didnt create it | 11:02 |
| brtknr | It was created by Magnum | 11:03 |
| brtknr | What does this mean? Authentication cannot be scoped to multiple targets. Pick one of: project, domain, trust or unscoped | 11:09 |
| *** shyamb has quit IRC | 11:15 | |
| *** Dinesh_Bhor has quit IRC | 11:16 | |
| *** markvoelker has joined #openstack-keystone | 11:16 | |
| *** mvkr has joined #openstack-keystone | 11:29 | |
| cmurphy | brtknr: it means you have too many scopes in your environment, for example maybe you set both OS_PROJECT_ID and OS_TRUST in your environment variables | 11:39 |
| *** Dinesh_Bhor has joined #openstack-keystone | 11:43 | |
| *** markvoelker has quit IRC | 11:50 | |
| *** Dinesh_Bhor has quit IRC | 11:51 | |
| *** shyamb has joined #openstack-keystone | 12:07 | |
| *** shyamb has quit IRC | 12:24 | |
| *** shyamb has joined #openstack-keystone | 12:25 | |
| *** shyamb has quit IRC | 12:30 | |
| *** erus1 has joined #openstack-keystone | 12:32 | |
| *** markvoelker has joined #openstack-keystone | 12:47 | |
| *** markvoelker has quit IRC | 13:13 | |
| brtknr | cmurphy: okay i got it working but i still need to explicitly specify --os-user-domain-id 66e2326c9fb1467282edee13deec087e | 13:26 |
| brtknr | I would have thought this would be inferred automatically | 13:27 |
| *** abhishek has joined #openstack-keystone | 13:40 | |
| cmurphy | brtknr: os-user-domain-id means the domain of the user who is trying to authenticate, it is used as a namespace for the user so that you can refer to the user by username, it's not needed if you use --os-user-id/OS_USER_ID | 13:40 |
| brtknr | cmurphy: its slightly annoyign that you need to specify the username if you're already specifiying user-id | 13:43 |
| brtknr | but thanks for the tip! | 13:44 |
| cmurphy | brtknr: you don't | 13:44 |
| cmurphy | if you have user id then you don't need username or user-domain | 13:44 |
| brtknr | cmurphy: i do | 13:44 |
| cmurphy | brtknr: i'm quite sure you do not | 13:44 |
| brtknr | i am currently doing this: openstack --os-username b95eabac-cc33-457a-9005-29f8c435c4bf_5d8f687a7d5945689c728a3c947255d7 --os-password ymAADG7B28ftDTEtdf --os-trust-id 4582fdd6760b48169cce8871df188084 --os-auth-url http://10.60.253.29/identity/v3 --os-user-id aa55d38d6d3d429e87c0c5fd1e39c649 server list | 13:45 |
| brtknr | if i omit --os-username part, it doesnt work | 13:45 |
| cmurphy | what does it do? | 13:45 |
| brtknr | Missing parameter(s): | 13:47 |
| brtknr | Set a username with --os-username, OS_USERNAME, or auth.username | 13:47 |
| brtknr | this is on the master branch | 13:47 |
| cmurphy | master branch of keystone or of python-openstackclient? | 13:48 |
| brtknr | of keystone | 13:49 |
| *** erus1 has quit IRC | 13:49 | |
| *** erus1 has joined #openstack-keystone | 13:49 | |
| *** pcaruana has quit IRC | 13:50 | |
| brtknr | i just updated my python-openstackclient pip package, no luck | 13:51 |
| brtknr | strangely, if i use a placeholder username, it works | 13:52 |
| brtknr | eg. --os-username dummy | 13:52 |
| brtknr | it doesnt have to be a real username | 13:53 |
| cmurphy | brtknr: wow you are right | 13:54 |
| cmurphy | that seems really broken | 13:55 |
| brtknr | thanks for cross checking :) | 13:55 |
| *** pcaruana has joined #openstack-keystone | 13:57 | |
| openstackgerrit | erus proposed openstack/keystone master: Add OpenSUSE support in devstack federation plugin https://review.openstack.org/633949 | 14:00 |
| cmurphy | brtknr: filed a bug https://storyboard.openstack.org/#!/story/2004898 | 14:06 |
| brtknr | cmurphy: for a moment i thought it had something to do with trust-id but it seems to be broken regardless! thanks for filing the bug! | 14:08 |
| brtknr | cmurphy: do you suspect the python-openstackclient or keystone itself? | 14:11 |
| *** dave-mccowan has joined #openstack-keystone | 14:11 | |
| *** dave-mccowan has quit IRC | 14:16 | |
| cmurphy | brtknr: it's an issue with the validation on the client side | 14:17 |
| brtknr | python-keystoneclient? | 14:18 |
| cmurphy | no python-openstackclient | 14:18 |
| brtknr | is that resposible for validation? | 14:18 |
| brtknr | oh right | 14:18 |
| cmurphy | it does some client side validation | 14:18 |
| knikolla | o/ | 14:19 |
| cmurphy | hi knikolla | 14:19 |
| *** lbragstad has joined #openstack-keystone | 14:19 | |
| *** ChanServ sets mode: +o lbragstad | 14:19 | |
| erus1 | o/ | 14:24 |
| erus1 | hi hi | 14:24 |
| cmurphy | hey erus1 | 14:24 |
| erus1 | how are you? | 14:25 |
| cmurphy | I'm good, how are you erus1 ? | 14:25 |
| erus1 | i'm so-so, couldn't sleep again cmurphy :( | 14:26 |
| cmurphy | we need to get you some air conditioning | 14:26 |
| erus1 | yay | 14:27 |
| erus1 | hot it's really heavy these days | 14:27 |
| erus1 | btw, i'm with the experimental jobs for suse, should i to use py35 o just py3? | 14:28 |
| cmurphy | erus1: just py3 | 14:28 |
| erus1 | heat* xD | 14:28 |
| erus1 | okay | 14:28 |
| erus1 | o/ | 14:28 |
| lbragstad | o/ | 14:28 |
| lbragstad | i'm wondering if people have thoughts about the jws key rotation utility | 14:29 |
| *** erus1 has quit IRC | 14:29 | |
| lbragstad | the more i think about it, the more i'm not sure if having a jws_setup and jws_rotate makes sense | 14:30 |
| *** erus1 has joined #openstack-keystone | 14:30 | |
| cmurphy | lbragstad: explain? | 14:30 |
| lbragstad | so - fernet uses symmetric encryption, right? | 14:30 |
| cmurphy | ya | 14:31 |
| brtknr | cmurphy: Ive fixed it! It had to be done in osc_lib | 14:31 |
| brtknr | I'll push it upstream | 14:31 |
| cmurphy | brtknr: awesome! | 14:31 |
| lbragstad | and we need to have a staged key to make sure we can gracefully rotate keys without experiencing false positives with token validation | 14:31 |
| *** aojea_ has joined #openstack-keystone | 14:32 | |
| lbragstad | so - rotation appears to fill an important role in that sense (for symmetric keys and management of that repository) | 14:32 |
| lbragstad | for jws - we're using asymmetric | 14:32 |
| lbragstad | and keystone can only use a single private key to sign tokens | 14:33 |
| lbragstad | the public keys are in a separate repository | 14:33 |
| openstackgerrit | erus proposed openstack/keystone master: Add experimental job for OpenSUSE https://review.openstack.org/633963 | 14:34 |
| lbragstad | but if you have to rotate a key pair on a host, having a staged key doesn't really help you? | 14:34 |
| * cmurphy ponders | 14:35 | |
| brtknr | https://review.openstack.org/#/c/633964/ | 14:35 |
| brtknr | cmurphy: ^ | 14:35 |
| lbragstad | this is what i have written down - which is probably easier to read than my irc chicken scratch http://logs.openstack.org/31/633831/1/check/openstack-tox-docs/f584268/html/admin/jws-key-rotation.html#continued-operations | 14:35 |
| cmurphy | lbragstad: I guess as long as this is only about signature validation and not about decryption then I can't think of a reason to rotate the private key | 14:38 |
| *** awalende has quit IRC | 14:39 | |
| *** awalende has joined #openstack-keystone | 14:40 | |
| *** mchlumsky has joined #openstack-keystone | 14:43 | |
| *** erus1 has quit IRC | 14:43 | |
| *** erus1 has joined #openstack-keystone | 14:43 | |
| *** awalende has quit IRC | 14:44 | |
| lbragstad | cmurphy yeah - i expect rotation to be a less frequent operations | 14:45 |
| lbragstad | but i was thinking, what would be reasonable behavior when you perform jws_rotate twice? | 14:45 |
| *** Dinesh_Bhor has joined #openstack-keystone | 14:46 | |
| lbragstad | write a private key to ``keystone.conf [jws_tokens] private_key_repository`` and put the public in the other repository? | 14:46 |
| lbragstad | also - we might run into naming issues since we don't have a convention for the public/private key pair names | 14:47 |
| cmurphy | i'm not sure what you mean, why should jws_rotate twice be different than once? | 14:47 |
| lbragstad | i'm assuming jws_rotate would create a new key pair | 14:48 |
| cmurphy | sure | 14:49 |
| lbragstad | if we already have a private.pem in the private key repository, would we just do privaten.pem? | 14:50 |
| *** erus1 has quit IRC | 14:50 | |
| lbragstad | same with the public keys... | 14:50 |
| *** erus1 has joined #openstack-keystone | 14:51 | |
| cmurphy | ah | 14:51 |
| lbragstad | that might be weird for operators planning on using something like rsync to key the entire public key directory in sync across all nodes in their deployment | 14:51 |
| brtknr | cmurphy: I've added a unit test | 14:52 |
| brtknr | for user_id | 14:52 |
| cmurphy | lbragstad: for the private key if we don't need the same staging process as we have for fernet then i think it would just overwrite private.pem | 14:52 |
| cmurphy | lbragstad: for the public key i guess we'd need some kind of naming convention with incrementing values | 14:52 |
| lbragstad | cmurphy in the jws_rotate script? | 14:53 |
| lbragstad | if jws_rotate is going to be creating a new key pair, we need to make sure operators sync the new public key to the other nodes before we replace the current private.pem | 14:53 |
| lbragstad | otherwise tokens will only be validatable on the node they are issued from | 14:54 |
| cmurphy | oh good point | 14:54 |
| lbragstad | and yeah - the naming convention for public keys seems a little strange to me... | 14:54 |
| lbragstad | i thought about using a system identifier | 14:55 |
| lbragstad | or a uuid, but neither of those feel like great solutions? | 14:55 |
| lbragstad | i can also imagine operators wanting to have a specific convention and that would make generalizing the implementation in keystone-manage tough | 14:56 |
| lbragstad | all in all, i wonder if we should just have a ``keystone-manage jws_create_keypair`` that just generates a key pair and writes the corresponding keys to public.pem and private.pem in the working director | 14:58 |
| lbragstad | directory* | 14:58 |
| lbragstad | then let operators use config management tools to push the new public.pem to other nodes, copy the new private.pem to the private key repository, etc.. | 14:59 |
| brtknr | cmurphy: please take a look at the unit test I uploaded | 15:03 |
| brtknr | It seems to be passing | 15:03 |
| brtknr | Dont think osc_lib afaics | 15:03 |
| cmurphy | brtknr: commented | 15:06 |
| cmurphy | lbragstad: that doesn't sound bad to me, they have to do something similar for managing their regular ssl certs anyways | 15:07 |
| lbragstad | ++ | 15:07 |
| lbragstad | cool - i'll update the series | 15:07 |
| *** aojea_ has quit IRC | 15:09 | |
| *** aojea_ has joined #openstack-keystone | 15:09 | |
| cmurphy | another possibility could be to do it in stages, like 1. keystone-manage jws_keypair_start -> generates public key and staged private key, 2. (go rsync the public key yourself), 3. keystone-manage jws_keypair_ready -> promotes the staged private key to real private key | 15:10 |
| cmurphy | that third part is basically just a mv so that would be a little silly | 15:10 |
| lbragstad | that's an option | 15:10 |
| *** aojea_ has quit IRC | 15:13 | |
| brtknr | cmurphy: I am not sure how to test for this! | 15:34 |
| *** Dinesh_Bhor has quit IRC | 15:37 | |
| cmurphy | brtknr: try this http://paste.openstack.org/show/744263/ | 15:48 |
| brtknr | done | 16:00 |
| brtknr | thanks :0 | 16:00 |
| brtknr | :) | 16:00 |
| brtknr | I tried the test before the patch and it fails as expected | 16:00 |
| *** pcaruana has quit IRC | 16:01 | |
| brtknr | cmurphy: ^ | 16:01 |
| *** pcaruana has joined #openstack-keystone | 16:17 | |
| brtknr | cmurphy: the thing with not being able to do `openstack trust show trust-id` on stable/queens is still an issue | 16:38 |
| *** gyee has joined #openstack-keystone | 16:42 | |
| *** abhishek has quit IRC | 16:42 | |
| *** pcaruana has quit IRC | 16:45 | |
| gagehugo | o/ | 16:46 |
| cmurphy | brtknr: can you report it as a keystone bug https://bugs.launchpad.net/keystone | 16:57 |
| brtknr | cmurphy: wait, I think I figured it out | 16:57 |
| brtknr | I can only run `openstack trust list` as admin user | 16:58 |
| brtknr | but in order to invoke `trust show` i need to be the `trustor`, even the admin cannot show a trust | 16:58 |
| brtknr | this is the case in both queens and master branch | 16:59 |
| *** bnemec has quit IRC | 17:14 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add configuration options for JWS provider https://review.openstack.org/628676 | 17:20 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add keystone-manage create_jws_keypair functionality https://review.openstack.org/615315 | 17:20 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add test fixture for the JWS key repository https://review.openstack.org/614547 | 17:20 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add PyJWT as a requirement https://review.openstack.org/614548 | 17:20 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement JWS token provider https://review.openstack.org/614549 | 17:20 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add JWS token provider documentation https://review.openstack.org/633831 | 17:20 |
| *** xek_ has joined #openstack-keystone | 18:08 | |
| *** xek has quit IRC | 18:10 | |
| *** pcaruana has joined #openstack-keystone | 18:17 | |
| cmurphy | brtknr: okay yes i think that is expected, especially if it didn't change between branches | 18:33 |
| *** awalende has joined #openstack-keystone | 18:40 | |
| *** awalende has quit IRC | 18:45 | |
| *** aojea has joined #openstack-keystone | 19:04 | |
| *** aojea has quit IRC | 19:09 | |
| hrybacki | kmalloc: is dogpile.cache.memcached only good for a single server? E.g., use oslo_cache.memcache_pool when you want to have multiple daemons? | 19:57 |
| hrybacki | single instance of memcached* | 19:58 |
| kmalloc | Both work for multiple servers. | 19:59 |
| kmalloc | Pool limits the number of connections to memcache. | 19:59 |
| kmalloc | So you don't spin too many up. | 19:59 |
| hrybacki | ack /me reads more | 20:00 |
| *** aojea has joined #openstack-keystone | 20:07 | |
| *** erus1 has quit IRC | 20:07 | |
| *** erus1 has joined #openstack-keystone | 20:08 | |
| *** xek_ has quit IRC | 20:45 | |
| *** xek_ has joined #openstack-keystone | 20:46 | |
| *** xek_ has quit IRC | 21:03 | |
| *** aojea has quit IRC | 21:08 | |
| *** aojea has joined #openstack-keystone | 21:08 | |
| kmalloc | Eventlet tends to spin up a connection per greenlet and that can overload the memcache server. | 21:26 |
| *** erus1 has quit IRC | 21:26 | |
| *** erus1 has joined #openstack-keystone | 21:26 | |
| *** aojea has quit IRC | 21:31 | |
| *** aojea has joined #openstack-keystone | 21:32 | |
| lbragstad | kmalloc i respun the entire jwt stack | 21:35 |
| lbragstad | addressed the configuration group naming | 21:35 |
| kmalloc | Cook | 21:35 |
| kmalloc | Cool | 21:35 |
| lbragstad | and clarified the keystone-manage utility bits | 21:35 |
| kmalloc | Kk | 21:36 |
| kmalloc | Will review after shower, had to do emergency last minute painting of my old place before carpet was installed >.< | 21:36 |
| lbragstad | ouch | 21:36 |
| kmalloc | Turns out someone (sigh, me) got the wrong touch up paint. | 21:36 |
| kmalloc | Sooooo... There were white streaks all over the walls. | 21:37 |
| lbragstad | i've been there - that sucks | 21:37 |
| lbragstad | i have painting to do tonight, too | 21:37 |
| kmalloc | Yup. | 21:37 |
| lbragstad | not really looking forward to it.. i feel your pain | 21:37 |
| kmalloc | I just wish I owned the place.. at least that way I wouldn't be painting this awful flat white that of you look wrong at it, it smudges and then needs to be repainted | 21:38 |
| kmalloc | Eggshell people eggshell... You can use magic eraser on it. | 21:38 |
| kmalloc | And even wash it. | 21:38 |
| lbragstad | heh | 21:38 |
| lbragstad | true | 21:38 |
| *** aojea has quit IRC | 21:39 | |
| hrybacki | quality paint is key to flat white (granted you may need to put on more coats than you like initially) | 21:50 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add API for /v3/access_rules https://review.openstack.org/628524 | 21:50 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add SQL migrations for app cred capabilities https://review.openstack.org/631936 | 21:50 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add driver support for app cred capabilities https://review.openstack.org/631937 | 21:50 |
| hrybacki | flat white walls with semi-gloss trim can really make a room pop with the right accents | 21:50 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add manager support for app cred capabilities https://review.openstack.org/628193 | 21:50 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add API changes for app cred capabilities https://review.openstack.org/628168 | 21:50 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add capabilities to token validation https://review.openstack.org/631993 | 21:50 |
| *** openstackgerrit has quit IRC | 21:50 | |
| eandersson | Is there a reason why the catalog shouldn't render properly if a project name/id isn't provided? | 21:57 |
| eandersson | Referring to this code path | 21:58 |
| eandersson | https://github.com/openstack/keystone/blob/master/keystone/catalog/backends/templated.py#L214 | 21:58 |
| eandersson | If project_id is None, all urls with e.g. $(project_id) will fail to render and not show up when you do something like openstack catalog list | 21:59 |
| *** ianw_pto is now known as ianw | 21:59 | |
| eandersson | Not sure if it is just a template issue, or WAI | 22:00 |
| *** openstackgerrit has joined #openstack-keystone | 22:03 | |
| openstackgerrit | Islam Musleh proposed openstack/keystone master: Converting the API tests to use flask's test_client https://review.openstack.org/630301 | 22:03 |
| *** whoami-rajat has quit IRC | 22:20 | |
| kmalloc | hrybacki: not "flat" but the flatest paint that was made by the manufacturer... usually it's used where it can't be touched. | 22:22 |
| kmalloc | hrybacki: also it was one of those stupid custom colors that can only be made at the corporate stores. | 22:23 |
| openstackgerrit | Merged openstack/keystone master: Expose receipt_setup and receipt_rotate command https://review.openstack.org/630574 | 22:33 |
| kmalloc | lbragstad: did we want to make JWSKeyPair work like fernetsetup? | 22:40 |
| lbragstad | well - that's something cmurphy and i were talking about a little bit earlier | 22:41 |
| kmalloc | i'm happy with it as is. | 22:42 |
| lbragstad | http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2019-01-30.log.html#t2019-01-30T14:29:39 | 22:42 |
| kmalloc | but just asking before +2ing | 22:42 |
| lbragstad | in case you want to understand the context | 22:42 |
| lbragstad | the tl;dr is that asymmetric keys don't really have the same rotation flow that symmetric keys do | 22:42 |
| kmalloc | yeah. | 22:43 |
| kmalloc | wfm. | 22:43 |
| openstackgerrit | Merged openstack/keystone master: PY3: switch to using unicode text values https://review.openstack.org/611190 | 22:43 |
| *** lbragstad has quit IRC | 22:48 | |
| *** lbragstad has joined #openstack-keystone | 22:54 | |
| *** ChanServ sets mode: +o lbragstad | 22:54 | |
| *** tkajinam has joined #openstack-keystone | 23:01 | |
| kmalloc | lbragstad: the cleanup_instance is very specific to instantiated classes and how things are run | 23:39 |
| kmalloc | it can lead to bleeding through. | 23:39 |
| kmalloc | lbragstad: it's simply safer to do an explicit cleanup. | 23:39 |
| lbragstad | kmalloc yeah - i was just trying to recreate it | 23:42 |
| lbragstad | so i could understand how it actually works | 23:42 |
| kmalloc | it doesn't happen often | 23:42 |
| kmalloc | or consistently. | 23:43 |
| kmalloc | it's hard to test for because test classes swap between runners as needed | 23:44 |
| kmalloc | so you may or may not see the attribute on a further test because of where it is scheduled | 23:44 |
| kmalloc | s/often|consistently/directly | 23:45 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!