| *** rainya has quit IRC | 00:27 | |
| *** david-lyle_ is now known as david-lyle | 00:35 | |
| *** mdorman has quit IRC | 00:57 | |
| *** mdorman has joined #craton | 00:59 | |
| *** Dusty has joined #craton | 01:23 | |
| *** Dusty has quit IRC | 03:04 | |
| *** rainya has joined #craton | 03:50 | |
| *** rainya has quit IRC | 04:25 | |
| *** rainya has joined #craton | 04:32 | |
| *** rainya has quit IRC | 04:41 | |
| *** tojuvone has joined #craton | 04:42 | |
| *** tojuvone_ has joined #craton | 04:42 | |
| *** valw has joined #craton | 05:00 | |
| *** valw has quit IRC | 06:52 | |
| *** jovon has quit IRC | 06:57 | |
| *** mhayden has quit IRC | 13:24 | |
| *** mhayden has joined #craton | 13:37 | |
| *** Dusty has joined #craton | 13:38 | |
| *** Mudpuppy has joined #craton | 14:21 | |
| *** Dusty has quit IRC | 14:35 | |
| *** valw has joined #craton | 14:46 | |
| *** valw has quit IRC | 14:48 | |
| *** valw has joined #craton | 14:49 | |
| *** syed__ has joined #craton | 14:50 | |
| *** Dusty has joined #craton | 14:51 | |
| *** Dusty has quit IRC | 14:57 | |
| *** Dusty has joined #craton | 15:01 | |
| *** Dusty has quit IRC | 15:01 | |
| *** Dusty has joined #craton | 15:36 | |
| *** valw has quit IRC | 15:53 | |
| *** valw has joined #craton | 15:57 | |
| *** valw has quit IRC | 16:00 | |
| *** valw has joined #craton | 16:05 | |
| *** Dusty has quit IRC | 16:05 | |
| *** Dusty has joined #craton | 16:09 | |
| *** jovon has joined #craton | 16:10 | |
| *** valw has quit IRC | 16:44 | |
| *** valw has joined #craton | 16:47 | |
| *** valw has quit IRC | 16:47 | |
| *** rainya has joined #craton | 16:50 | |
| jimbaker | git-harry, jovon, sulo, syed__, and others interested - meeting on craton core in 2 min | 16:57 |
|---|---|---|
| palendae | jimbaker: RPC meeting going on | 16:58 |
| *** valw has joined #craton | 17:00 | |
| syed__ | Joining | 17:03 |
| syed__ | Having some connection issues, restarting laptop jimbaker | 17:03 |
| *** valw has quit IRC | 17:04 | |
| syed__ | jimbaker: that vidyo has already a conference going for some other team | 17:11 |
| syed__ | Do you have the link jimbaker | 17:11 |
| *** rainya has quit IRC | 17:14 | |
| *** rainya has joined #craton | 17:17 | |
| *** valw has joined #craton | 17:28 | |
| *** valw has quit IRC | 17:32 | |
| sigmavirus | jimbaker: you're flapping | 17:41 |
| *** valw has joined #craton | 17:42 | |
| *** valw has quit IRC | 17:43 | |
| Mudpuppy | http://womenof1920s.wikispaces.com/file/view/flappers.gif/202602686/flappers.gif | 17:46 |
| *** valw has joined #craton | 17:48 | |
| sigmavirus | Mudpuppy: that's what usually jumps in my head too | 17:49 |
| sigmavirus | syed__: stick around for tox trouble-shooting? | 18:03 |
| *** Mudpuppy_ has joined #craton | 18:03 | |
| *** valw_ has joined #craton | 18:03 | |
| *** Mudpuppy has quit IRC | 18:05 | |
| *** valw has quit IRC | 18:06 | |
| sigmavirus | syed__: hop back onto vidyo? | 18:06 |
| syed__ | sigmavirus: brb | 18:09 |
| *** rainya has quit IRC | 18:16 | |
| syed__ | sigmavirus: you around | 18:22 |
| syed__ | should i come to the same vidyo | 18:22 |
| sigmavirus | Yes and yes | 18:22 |
| *** rainya has joined #craton | 18:25 | |
| syed__ | An error occurred while trying to log in (28). | 18:26 |
| syed__ | sigmavirus: its not connecting | 18:26 |
| sigmavirus | that's weird | 18:26 |
| *** rainya has quit IRC | 18:29 | |
| *** rainya has joined #craton | 18:32 | |
| *** valw_ has quit IRC | 18:54 | |
| *** Mudpuppy_ has quit IRC | 18:54 | |
| *** Mudpuppy has joined #craton | 18:55 | |
| *** Mudpuppy has quit IRC | 18:59 | |
| *** valw has joined #craton | 19:01 | |
| *** Mudpuppy has joined #craton | 19:01 | |
| *** valw has quit IRC | 19:05 | |
| *** Mudpuppy has quit IRC | 19:05 | |
| *** valw has joined #craton | 19:14 | |
| *** Mudpuppy has joined #craton | 19:15 | |
| *** Mudpuppy has quit IRC | 19:19 | |
| *** valw has quit IRC | 19:19 | |
| *** Mudpuppy has joined #craton | 19:30 | |
| *** Mudpuppy has quit IRC | 19:32 | |
| *** Mudpuppy has joined #craton | 19:32 | |
| sulo | whats the best way to fake a sqlalchemy response object ? Is there anything that does that already. | 19:36 |
| sulo | I basically want to construct the same object thats equivalent to the response from say query.one() | 19:36 |
| sulo | anyone know before i go searching on the interwebs | 19:37 |
| palendae | Not familiar enough to know if it provides fake/doubles in tree, sorry | 19:52 |
| *** valw has joined #craton | 20:01 | |
| jimbaker | sulo, in the simplest case, isn't this just a python object? how much fakery do you need here? example: if you are testing notifications, i think we need full sqlalchemy | 20:07 |
| sigmavirus | sulo: mock.create_autospec(model)? | 20:08 |
| sulo | jimbaker: yes, in general its just a object, which is how we do our unit test ..fakes are all just some object | 20:08 |
| sigmavirus | https://docs.python.org/3/library/unittest.mock.html#unittest.mock.create_autospec | 20:08 |
| sulo | iam looking for pure sqlalchemy impl | 20:08 |
| sulo | sigmavirus: looking | 20:09 |
| sigmavirus | ah | 20:09 |
| sigmavirus | create_autospec will make it behave as much like the model as mock can determine | 20:09 |
| sigmavirus | which can be a bit limited at times | 20:09 |
| jimbaker | sulo, sqlite seems to make sense then for such things | 20:09 |
| jimbaker | as we already do in our testing of course | 20:09 |
| sigmavirus | jimbaker: that's not really unit testing though and then you're constrained by the limitations of sqlite | 20:10 |
| jimbaker | sigmavirus, i'm aware it's a slippery slope :) | 20:11 |
| sigmavirus | jimbaker: I think we also need to talk about the scope of RBAC in Craton | 20:23 |
| sigmavirus | Because everything I heard today exists in Keystone already | 20:23 |
| sigmavirus | I have to wonder if we're not better off trying to rely on LDAP for this stuff because it's not easy or fun to do | 20:24 |
| sigmavirus | Also implementing anything even remotely robust might take us quite a bit of time | 20:26 |
| jimbaker | sigmavirus, agreed with keystone has an important integration point for craton rbac; i'm not aware of keystone providing sufficient support for this purpose | 20:27 |
| jimbaker | on its own | 20:27 |
| jimbaker | i could be mistaken | 20:27 |
| jimbaker | and it would be awesome if we could just push this functionality into a project that has already done all of the hard work | 20:28 |
| sigmavirus | jimbaker: so keystone has implemented hierarchical rbac via domains, projects, and roles | 20:29 |
| sigmavirus | the keystonemiddleware request object throws all of this into the request context | 20:29 |
| jimbaker | sigmavirus, exactly | 20:30 |
| sigmavirus | we can expose it to oslo.policy, have specific roles for different actions (host_create, etc.) | 20:30 |
| sigmavirus | and allow users to use what they're already familiar with | 20:30 |
| sigmavirus | But as I understand it, relying on Keystone for this would probably not work well | 20:30 |
| jimbaker | so all good. but this would only only get to the detail of a project, with corresponding roles; i believe we have been looking at finer grained control | 20:31 |
| jimbaker | so the answer seems to "both" | 20:32 |
| jimbaker | to be "both" | 20:32 |
| sigmavirus | jimbaker: yeah, if you could write up what exactly we're looking for, that would be helpful | 20:32 |
| jimbaker | sigmavirus, very much agreed | 20:33 |
| sigmavirus | people are doing some rather fine-grained control of things with Keystone (like having project-scoped admins, etc.) | 20:33 |
| jimbaker | sigmavirus, my expectation is that we can join together keystone roles, with the specific scope; with any level of grain we want inside a project | 20:34 |
| jimbaker | so we can do rbac at the level of a cell for example | 20:34 |
| jimbaker | maybe overkill? | 20:34 |
| jimbaker | or for configuring workflows, and specific config variables; vs running them | 20:35 |
| sigmavirus | so you want, say, a cell to have its own set of roles? | 20:35 |
| jimbaker | the combination will be specified through the oslo policy | 20:35 |
| sulo | sigmavirus: mock.create_autospec although not what i was looking for is totally what we should be doing now ..instead of creating fakes like we do now .. ill try to see if i can chage that | 20:36 |
| sigmavirus | sulo: glad to have accidentally convinced you of that without even trying | 20:36 |
| sigmavirus | :D | 20:36 |
| sigmavirus | jimbaker: so, oslo.policy reads a file that contains rules | 20:37 |
| sigmavirus | the rules map to a little DSL it invented | 20:37 |
| sigmavirus | the DSL is evaluated by the policy enforce that looks to a dictionary passed in by the service | 20:37 |
| sigmavirus | so it resolves the variables in that dictionary context | 20:37 |
| jimbaker | sigmavirus, correct | 20:37 |
| sigmavirus | Okay, just making sure we're on the same page | 20:38 |
| jimbaker | sigmavirus, iirc, oslo.policy gives us the ability to construct our own checks. these checks can take in account additional info we store in the db | 20:39 |
| jimbaker | they should be similar to the remote (http) check that oslo.policy has by default | 20:39 |
| sigmavirus | jimbaker: sure | 20:40 |
| * sigmavirus wonders if anyone uses the remote check in oslo.policy | 20:40 | |
| jimbaker | no idea | 20:40 |
| sigmavirus | It's tested, but I've never seen bugs around it, and that seems impossible to me (that a bit of oslo code has no bugs) | 20:40 |
| jimbaker | but this means we can have a project that includes a very large cloud (say 10K physical hosts), and still subdivide responsibility | 20:41 |
| jimbaker | maybe overkill? but if we can do it readily in the context of oslo.policy, seems to make sense | 20:41 |
| sigmavirus | So we could still do that with Keystone and what you're talking about | 20:41 |
| jimbaker | also we do want to provide some basic rbac to people not using keystone | 20:41 |
| sigmavirus | But you don't need full on RBAC system implemented in craton | 20:41 |
| sigmavirus | Just fields to determine what domains/projects/roles can access that resource | 20:42 |
| sigmavirus | And then you can look at a request context and what comes from cell and see if they match | 20:42 |
| jimbaker | sigmavirus, we are probably discussing the same thing :) | 20:42 |
| sigmavirus | jimbaker: I suspect so :) | 20:42 |
| jimbaker | let me finalize my rbac proposal. i had put it aside end of summer for the very good reason i was busy, and it's now time to truly revisit | 20:43 |
| jimbaker | seems reasonable to discuss tues, which should discuss both ecosystem + core, given thanksgiving next week | 20:44 |
| syed__ | +1 jimbaker | 20:44 |
| *** valw has quit IRC | 20:50 | |
| *** valw has joined #craton | 20:55 | |
| *** jovon has quit IRC | 21:47 | |
| *** valw has quit IRC | 21:49 | |
| *** valw has joined #craton | 21:57 | |
| *** valw has quit IRC | 22:01 | |
| sulo | https://review.openstack.org/#/c/399267 | 22:17 |
| *** Mudpuppy_ has joined #craton | 22:41 | |
| *** Mudpuppy has quit IRC | 22:44 | |
| *** Mudpuppy_ has quit IRC | 22:46 | |
| jimbaker | sigmavirus, ^^^ we will want to coordinate on this change we agreed upon on tues | 22:49 |
| jimbaker | re /data -> /variables | 22:50 |
| jimbaker | in the client | 22:50 |
| *** rainya has quit IRC | 22:53 | |
| *** rainya has joined #craton | 23:00 | |
| jimbaker | sulo, for me the current Dockerfile is not building. changing to FROM ubuntu:16.10 works. also some other possible updates, although this diff takes forever to build | 23:03 |
| jimbaker | https://gist.github.com/jimbaker/636ca00740493e976c660698502aab93 | 23:05 |
| sulo | huh | 23:05 |
| sulo | i didnt make any dockerfile change ?!! | 23:05 |
| sulo | jimbaker: that is very weird .. how did you get that chage .. i havent comitted that | 23:07 |
| jimbaker | no, it's a Dockerfile change i made to work around missing archives | 23:07 |
| jimbaker | using 16.10 also works around | 23:07 |
| jimbaker | sulo, first observation on https://review.openstack.org/#/c/399267 - we need to update tools/generate_fake_data.py | 23:08 |
| jimbaker | still trying to use /data | 23:08 |
| sulo | jimbaker: what problem are you seeing with the dockerfile ? ... seems to work fine for me | 23:14 |
| jimbaker | sulo, hmmm, interesting. it's just failing on getting the archives | 23:15 |
| jimbaker | for mariadb | 23:15 |
| jimbaker | and it has nothing to do with this specific change - i'm just seeing it as i attempt to test it | 23:15 |
| *** rainya has quit IRC | 23:17 | |
| jimbaker | may still be worthwhile going to 16.10 for this testing - seems to speed up builds. but need to robustly verify | 23:18 |
| jimbaker | sulo, in any event, doing the rename of /data -> /variables in generate_fake_data.py seems to be the only missing piece in that change | 23:21 |
| sulo | so it looks like they f'ed the image .. and probably fixing/release new one soon ... we shouldnt use 16.10 atleast not officially thought the file 16.04->latest-lts | 23:21 |
| sulo | but the 16.04 image was updated yesterday and probably got jacked | 23:22 |
| jimbaker | sulo, makes sense | 23:22 |
| sulo | ill fix the data generation | 23:22 |
| jimbaker | i don't see why not 16.10 for testing in the Dockerfile, we really don't care about LTS i think for this aspect | 23:23 |
| jimbaker | so right now, i cannot try 16.10 against 16.04 (because failures), but from what i recall, the docker build for 16.10 seems much faster. do try out | 23:24 |
| jimbaker | yourself | 23:24 |
| sulo | yeah maybe, i guess if its just testing, its probalby no big deal | 23:24 |
| sulo | yeah, if its faster then it might make sense to do it anyway | 23:25 |
| sulo | ill try it tomorrow .... afk for now ... laters | 23:26 |
| jimbaker | sulo, have a great rest of your day! | 23:26 |
| *** Mudpuppy has joined #craton | 23:39 | |
| *** Dusty has quit IRC | 23:49 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
