| *** dave-mccowan has joined #openstack-keystone | 00:20 | |
| *** markvoelker has joined #openstack-keystone | 00:24 | |
| *** markvoelker has quit IRC | 00:28 | |
| adriant | cmurphy_afk, kmalloc, ayoung: I'd like to take over https://review.opendev.org/#/c/618144/ and rewrite it to be API based because it's a topic that keeps coming up and I really would love and API to just do it. | 01:17 |
|---|---|---|
| adriant | I know there was strong opposition to it but I think even at one point during some discussions at Berlin kmalloc was slowly being convinced that an API approach was the only really sane solution. | 01:19 |
| adriant | a system scope only API that has clearly documented warnings | 01:19 |
| kmalloc | Again, I'm still a pretty firm -1 on that. So very many security issues (API driven). But I won't block it | 01:20 |
| kmalloc | At least we can make it system scope... Which is a little better. | 01:21 |
| *** markvoelker has joined #openstack-keystone | 01:24 | |
| *** markvoelker has quit IRC | 01:29 | |
| *** dave-mccowan has quit IRC | 01:45 | |
| adriant | kmalloc: I just increasingly have pressure to be able to reparent projects, because we have cases where some of our bigger customers manage the resources of others, and eventually the project ownership needs to move to another customer. We try and encourage them to always have that second customer signup on their own, so they always own the project | 01:53 |
| adriant | , but often it isn't know that this change of ownership will actually happen | 01:53 |
| adriant | so the worry is that once we start down the sub-tree path this will all be impossible. Currently changing ownership on a flat project is easy, but a project halfway down a tree will not be doable | 01:54 |
| adriant | kmalloc: I understand your security worries, but they are kind of unwarranted if you are an admin. If you are using trees you know about roles and role inheritance, you know that moving a project will change that. if you as an admin fuck up, it's your fault for using what is documented as a powerful tool. | 01:56 |
| adriant | there are so many other ways right now to pretty much kill a whole cluster as an admin, so this is really just a low level level of worry :P | 01:57 |
| kmalloc | So like I said. I won't block it, but if asked, I'm -1. | 02:22 |
| kmalloc | I am -2 if it's not system scope ;) | 02:22 |
| kmalloc | There is a lot of "here are Kevlar shoes, please no foot gunning" in keystone. | 02:23 |
| kmalloc | And we do need to cover that. | 02:23 |
| kmalloc | And by not blocking I wont score it negative outside of other wildly problematic things. | 02:25 |
| *** whoami-rajat has joined #openstack-keystone | 03:12 | |
| *** markvoelker has joined #openstack-keystone | 03:26 | |
| *** markvoelker has quit IRC | 03:31 | |
| *** awalende has joined #openstack-keystone | 04:23 | |
| *** awalende has quit IRC | 04:27 | |
| *** vishalmanchanda has joined #openstack-keystone | 05:18 | |
| *** markvoelker has joined #openstack-keystone | 05:28 | |
| *** markvoelker has quit IRC | 05:32 | |
| *** rcernin has quit IRC | 06:02 | |
| *** xek has joined #openstack-keystone | 06:58 | |
| *** rcernin has joined #openstack-keystone | 07:00 | |
| *** trident has quit IRC | 07:06 | |
| *** trident has joined #openstack-keystone | 07:08 | |
| *** tesseract has joined #openstack-keystone | 07:24 | |
| *** markvoelker has joined #openstack-keystone | 07:29 | |
| *** markvoelker has quit IRC | 07:34 | |
| *** Horrorcat has joined #openstack-keystone | 08:27 | |
| *** markvoelker has joined #openstack-keystone | 08:30 | |
| *** markvoelker has quit IRC | 08:35 | |
| *** imacdonn has quit IRC | 08:40 | |
| *** imacdonn has joined #openstack-keystone | 08:40 | |
| *** pcaruana has joined #openstack-keystone | 08:52 | |
| *** tkajinam has quit IRC | 09:00 | |
| openstackgerrit | James Page proposed openstack/keystone master: token: consistently decode binary types https://review.opendev.org/665617 | 09:13 |
| *** josecastroleon has joined #openstack-keystone | 09:20 | |
| *** jamespage has joined #openstack-keystone | 09:25 | |
| *** rcernin has quit IRC | 09:36 | |
| *** markvoelker has joined #openstack-keystone | 10:32 | |
| *** markvoelker has quit IRC | 10:36 | |
| *** sri-cah has joined #openstack-keystone | 11:43 | |
| *** jaosorior has joined #openstack-keystone | 11:47 | |
| *** starborn has joined #openstack-keystone | 11:56 | |
| *** jaosorior has quit IRC | 12:02 | |
| *** jdennis has joined #openstack-keystone | 12:24 | |
| *** josecastroleon has quit IRC | 12:26 | |
| sri-cah | hi all, I ran into an issue with the zero-downtime upgrade path between queens and rocky when caching is enabled and was directed here from #openstack | 12:28 |
| sri-cah | the problem occurs during the phase when the two versions run alongside and both cache token validity information | 12:28 |
| sri-cah | queens simply uses a dict, while rocky uses a dedicated class for this, and since things that are put into the cache are simply pickled there is trouble | 12:29 |
| sri-cah | (if now one keystone instance loads the token validity from the cache, that was written by a node running the other version a token will spuriously fail to validate) | 12:31 |
| sri-cah | our current workaround is to disable the cache during the upgrade, but that may not be feasible all production environments due to the additional load | 12:32 |
| *** markvoelker has joined #openstack-keystone | 12:33 | |
| *** markvoelker has quit IRC | 12:38 | |
| *** dave-mccowan has joined #openstack-keystone | 12:42 | |
| *** vishalmanchanda has quit IRC | 12:57 | |
| *** lbragstad has joined #openstack-keystone | 13:12 | |
| *** raildo has joined #openstack-keystone | 13:15 | |
| *** beekneemech is now known as bnemec | 13:18 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update unified limit documentation https://review.opendev.org/664933 | 13:24 |
| *** pcaruana|afk| has joined #openstack-keystone | 13:26 | |
| *** pcaruana has quit IRC | 13:26 | |
| *** markvoelker has joined #openstack-keystone | 13:34 | |
| *** markvoelker has quit IRC | 13:39 | |
| *** pcaruana has joined #openstack-keystone | 13:48 | |
| *** mchlumsky has joined #openstack-keystone | 13:48 | |
| *** pcaruana|afk| has quit IRC | 13:51 | |
| kmalloc | sri-cah: interesting, I think we can make a minor change to force a cache-key difference. Can you open a bug on this please | 13:58 |
| sri-cah | yes | 14:01 |
| sri-cah | is a cache key difference safe though? | 14:01 |
| sri-cah | if I am right, then calling DELETE on a token will update the revocation_events in the database and invalidate the cache | 14:02 |
| sri-cah | so if two instances already have the validity cached, and the token is then revoked, will both caches be invalidated correctly | 14:02 |
| sri-cah | (if so, another possible workaround would be to seperate the caches during the upgrade run, which may have less of a performance impact than disabling caching altogether) | 14:03 |
| *** jaosorior has joined #openstack-keystone | 14:23 | |
| kmalloc | sri-cah: i.am not sure a delete on an invalid token (already deleted) would work. A separate cache would be the easiest upgrade path | 14:25 |
| kmalloc | But with a separate cache, you do run the risk of old cache being valid while new cache is not. I don't have a good solution off the top of my head short of encapsulation of the cache data. Really, this is a case where, again, rolling upgrades are poorly thought out | 14:28 |
| kmalloc | I would probably just isloate the cache to a new cache instance and take the hit for short term validity leaking on the old system during upgrade. | 14:29 |
| *** ayoung has quit IRC | 14:35 | |
| *** markvoelker has joined #openstack-keystone | 14:35 | |
| sri-cah | yes, this workaround sounds like a good solution, the bug report will be there soon – I have sadly lost the logs showing the problem to log rotation, but I can point to the offending code (or recreate the failing state and generate new logs) | 14:37 |
| *** markvoelker has quit IRC | 14:40 | |
| kmalloc | ah, if you have another round or can find the logs/duplicate that would be great. but i think i can see what you're seeing. | 14:40 |
| kmalloc | we just need to update the docs to say "spin up new cache" and solve the issue | 14:40 |
| *** jamesmcarthur has joined #openstack-keystone | 14:44 | |
| sri-cah | I finished the bug report: <https://bugs.launchpad.net/keystone/+bug/1833085> let me know, if you need any more details | 14:45 |
| openstack | Launchpad bug 1833085 in OpenStack Identity (keystone) "Zero-downtime upgrades lead to spurious token validation failures when caching is enabled" [Undecided,New] | 14:45 |
| gagehugo | o/ | 14:46 |
| *** pcaruana has quit IRC | 14:47 | |
| *** jaosorior has quit IRC | 14:49 | |
| kmalloc | sri-cah: thanks! | 14:52 |
| sri-cah | kmalloc: thanks for helping me | 14:54 |
| *** dklyle has joined #openstack-keystone | 14:55 | |
| *** sri-cah has quit IRC | 15:05 | |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.limit master: Remove ProjectClaim object from oslo.limit https://review.opendev.org/665708 | 15:18 |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.limit master: Remove verification functionality https://review.opendev.org/665709 | 15:18 |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.limit master: Remove __enter__ and __exit__ methods from Enforcer https://review.opendev.org/665710 | 15:18 |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.limit master: Add skeleton enforce() method to Enforcer https://review.opendev.org/665711 | 15:18 |
| lbragstad | cc johnthetubaguy ^ | 15:18 |
| lbragstad | i started ripping thing apart based on our discussion last week | 15:18 |
| lbragstad | figure we can build up from the last patch | 15:19 |
| *** jamesmcarthur_ has joined #openstack-keystone | 15:21 | |
| *** jamesmcarthur has quit IRC | 15:25 | |
| *** joshualyle has joined #openstack-keystone | 15:25 | |
| *** jdennis has quit IRC | 15:28 | |
| *** tesseract has quit IRC | 15:38 | |
| *** pcaruana has joined #openstack-keystone | 15:40 | |
| *** jdennis has joined #openstack-keystone | 15:47 | |
| *** gyee has joined #openstack-keystone | 15:49 | |
| *** gyee has quit IRC | 15:49 | |
| *** awalende has joined #openstack-keystone | 15:50 | |
| *** awalende has quit IRC | 15:52 | |
| *** awalende has joined #openstack-keystone | 15:53 | |
| *** trident has quit IRC | 15:56 | |
| *** awalende has quit IRC | 15:57 | |
| *** trident has joined #openstack-keystone | 15:58 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system scope and default roles for token API https://review.opendev.org/665231 | 15:58 |
| *** awalende has joined #openstack-keystone | 16:04 | |
| lbragstad | johnthetubaguy i also gave the unified limit documentation in keystone a facelift - you should be able to use that instead of referencing the spect (i tried to pull all the important information over) | 16:05 |
| lbragstad | https://review.opendev.org/#/c/664933/ | 16:05 |
| *** awalende has quit IRC | 16:05 | |
| *** awalende has joined #openstack-keystone | 16:05 | |
| *** awalende has quit IRC | 16:08 | |
| *** awalende has joined #openstack-keystone | 16:08 | |
| *** gyee has joined #openstack-keystone | 16:11 | |
| *** lbragstad has quit IRC | 16:26 | |
| *** cmurphy_afk is now known as cmurphy | 16:28 | |
| *** lbragstad has joined #openstack-keystone | 16:28 | |
| *** whoami-rajat has quit IRC | 16:29 | |
| lbragstad | cmurphy is https://trello.com/c/KGGkNijR/55-oslolimit-interface supposed to have links to cards in the Tasks To Do column? | 16:31 |
| * lbragstad knows he's asked this before | 16:31 | |
| *** markvoelker has joined #openstack-keystone | 16:37 | |
| cmurphy | lbragstad: yes it should, i think i meant to do that last week... | 16:38 |
| lbragstad | cmurphy ok, cool | 16:40 |
| lbragstad | just checking | 16:40 |
| lbragstad | i wasn't sure if i should move that card out of the list | 16:40 |
| *** markvoelker has quit IRC | 16:42 | |
| cmurphy | lbragstad: fixed it | 16:42 |
| lbragstad | thanks cmurphy | 16:44 |
| lbragstad | moved one of those into "in progress" | 16:45 |
| *** whoami-rajat has joined #openstack-keystone | 16:48 | |
| *** awalende has quit IRC | 16:52 | |
| *** awalende has joined #openstack-keystone | 16:53 | |
| *** awalende has quit IRC | 16:57 | |
| *** keerthigd__ has joined #openstack-keystone | 17:17 | |
| *** trident has quit IRC | 17:27 | |
| *** trident has joined #openstack-keystone | 17:29 | |
| *** markvoelker has joined #openstack-keystone | 17:37 | |
| *** markvoelker has quit IRC | 17:43 | |
| *** jamesmcarthur_ has quit IRC | 17:57 | |
| *** freerunner has quit IRC | 17:57 | |
| *** freerunner has joined #openstack-keystone | 18:00 | |
| *** awalende has joined #openstack-keystone | 18:01 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update the meaning of low-hanging-fruit https://review.opendev.org/659141 | 18:13 |
| *** awalende has quit IRC | 18:23 | |
| *** awalende has joined #openstack-keystone | 18:23 | |
| *** keerthigd__ has quit IRC | 18:25 | |
| *** niceplace has quit IRC | 18:30 | |
| *** niceplace has joined #openstack-keystone | 18:31 | |
| *** awalende_ has joined #openstack-keystone | 18:35 | |
| *** markvoelker has joined #openstack-keystone | 18:38 | |
| *** awalende has quit IRC | 18:39 | |
| *** pcaruana has quit IRC | 18:44 | |
| *** markvoelker has quit IRC | 18:45 | |
| *** jamesmcarthur has joined #openstack-keystone | 18:51 | |
| *** dave-mccowan has quit IRC | 18:54 | |
| *** awalende_ has quit IRC | 19:03 | |
| *** awalende has joined #openstack-keystone | 19:04 | |
| *** dave-mccowan has joined #openstack-keystone | 19:06 | |
| *** awalende has quit IRC | 19:07 | |
| *** dave-mccowan has quit IRC | 19:14 | |
| *** pcaruana has joined #openstack-keystone | 19:17 | |
| *** starborn has quit IRC | 19:24 | |
| *** pcaruana has quit IRC | 19:27 | |
| *** ayoung has joined #openstack-keystone | 19:30 | |
| *** trident has quit IRC | 19:37 | |
| *** trident has joined #openstack-keystone | 19:39 | |
| *** markvoelker has joined #openstack-keystone | 19:40 | |
| *** jamesmcarthur has quit IRC | 19:42 | |
| *** markvoelker has quit IRC | 19:45 | |
| *** awalende has joined #openstack-keystone | 19:55 | |
| ayoung | kmalloc, what do I need to do to add the explicit_project0id param to JSON home? | 20:02 |
| ayoung | It changed with the flask stuff and I'm not sure where it goes now | 20:02 |
| kmalloc | in the schema bits same as before | 20:08 |
| kmalloc | https://github.com/openstack/keystone/blob/master/keystone/resource/schema.py | 20:09 |
| kmalloc | in https://github.com/openstack/keystone/blob/master/keystone/resource/schema.py#L59 | 20:09 |
| *** jamesmcarthur has joined #openstack-keystone | 20:15 | |
| *** xek has quit IRC | 20:17 | |
| *** whoami-rajat has quit IRC | 20:19 | |
| ayoung | kmalloc, what about an optional param | 20:28 |
| *** jamesmcarthur has quit IRC | 20:28 | |
| kmalloc | shoud be able to use the validation.nullable | 20:30 |
| kmalloc | to make it optional | 20:30 |
| ayoung | kmalloc, so this https://paste.fedoraproject.org/paste/CfsAFIZppxHPt9Sf4SQ31Q | 20:34 |
| kmalloc | yeah that should be good. we'll need to filter it on update, but that is fine | 20:35 |
| kmalloc | if possible i would make it a create-time-only element | 20:35 |
| kmalloc | but since project has "Extras" it will always need to be filtered out | 20:36 |
| *** jamesmcarthur has joined #openstack-keystone | 20:37 | |
| ayoung | How do I do that? | 20:39 |
| kmalloc | addd it to the schema | 20:40 |
| kmalloc | and in .update_project, pop it off the dict, check if it exists and raise an exception saying it can't be set on update | 20:40 |
| kmalloc | so, if project.pop('explicit_id', none): raise exception.blah(somethingsomething) | 20:41 |
| *** jamesmcarthur has quit IRC | 20:41 | |
| *** markvoelker has joined #openstack-keystone | 20:41 | |
| kmalloc | that exception should be raised in the keystone.api flask method(s) [patch] for the project handler. | 20:42 |
| *** jamesmcarthur has joined #openstack-keystone | 20:42 | |
| kmalloc | https://github.com/openstack/keystone/blob/master/keystone/api/projects.py#L184 | 20:42 |
| ayoung | kmalloc, what avout this https://paste.fedoraproject.org/paste/NgE~fxVvp2oKv4YuedFXAQ | 20:42 |
| kmalloc | you can do that too | 20:43 |
| kmalloc | but because extras are allowed you still need to filter | 20:43 |
| kmalloc | because extras allow *any* key to be stored. | 20:43 |
| *** markvoelker has quit IRC | 20:46 | |
| *** jamesmcarthur has quit IRC | 21:01 | |
| *** jamesmcarthur has joined #openstack-keystone | 21:15 | |
| *** awalende has quit IRC | 21:28 | |
| *** awalende has joined #openstack-keystone | 21:29 | |
| *** awalende has quit IRC | 21:34 | |
| *** markvoelker has joined #openstack-keystone | 21:42 | |
| *** rcernin has joined #openstack-keystone | 21:43 | |
| *** mchlumsky has quit IRC | 21:43 | |
| *** markvoelker has quit IRC | 21:47 | |
| *** raildo has quit IRC | 21:50 | |
| *** awalende has joined #openstack-keystone | 21:58 | |
| *** awalende has quit IRC | 22:01 | |
| *** ChanServ has quit IRC | 22:09 | |
| *** ChanServ has joined #openstack-keystone | 22:14 | |
| *** niven.freenode.net sets mode: +o ChanServ | 22:14 | |
| *** jamesmcarthur has quit IRC | 22:22 | |
| *** jamesmcarthur has joined #openstack-keystone | 22:22 | |
| *** blake has joined #openstack-keystone | 22:22 | |
| *** awalende has joined #openstack-keystone | 22:34 | |
| *** awalende has quit IRC | 22:38 | |
| *** blake has quit IRC | 22:40 | |
| *** markvoelker has joined #openstack-keystone | 22:43 | |
| *** vishwanathj has joined #openstack-keystone | 22:44 | |
| *** markvoelker has quit IRC | 22:48 | |
| *** tkajinam has joined #openstack-keystone | 22:55 | |
| *** awalende has joined #openstack-keystone | 23:13 | |
| *** vishwanathj has quit IRC | 23:23 | |
| *** vishwanathj has joined #openstack-keystone | 23:24 | |
| *** gyee has quit IRC | 23:28 | |
| *** vishwanathj has quit IRC | 23:28 | |
| *** markvoelker has joined #openstack-keystone | 23:44 | |
| *** awalende has quit IRC | 23:46 | |
| *** markvoelker has quit IRC | 23:48 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!