| *** diazjf has joined #openstack-barbican | 00:33 | |
| *** dimtruck is now known as zz_dimtruck | 01:00 | |
| *** diazjf1 has joined #openstack-barbican | 01:12 | |
| *** diazjf has quit IRC | 01:15 | |
| *** zz_dimtruck is now known as dimtruck | 01:28 | |
| agrebennikov | jamielennox, hey, I have a question for you regarding potential issue in barbican, and it is probably connected to how you resolved it in keystone https://github.com/openstack/keystone/commit/7a760caa5d26e87879fe7e0276a5603c697cc717 | 01:42 |
|---|---|---|
| -openstackstatus- NOTICE: Gerrit is about to be restarted to help with page timeouts | 01:45 | |
| jamielennox | agrebennikov: still here? how can i help? | 02:21 |
| agrebennikov | yep, thanks jamielennox | 02:21 |
| agrebennikov | so barbican uses pecan | 02:22 |
| agrebennikov | and when I make a call just to the port of the api, it constructs the url automatically | 02:22 |
| agrebennikov | like curl http://1.1.1.1:9311 gives the response with {v1: {href: http://1.1.1.1:9311}}, and if I call to another endpoint - IP will be different while the prefix and the port-the same | 02:23 |
| jamielennox | yep, the request object should have in it the url you used to call it | 02:23 |
| agrebennikov | so what I should do if I have haproxy with https in the frontend? | 02:24 |
| agrebennikov | api still returns http | 02:24 |
| jamielennox | ah, ok | 02:24 |
| agrebennikov | with keystone we strictry specify public_endpoint | 02:24 |
| jamielennox | so typically there are two headers set with haproxy | 02:24 |
| agrebennikov | right? | 02:24 |
| jamielennox | HTTP_X_FORWARDED_FOR | 02:25 |
| jamielennox | and HTTP_X_FORWARDED_PROTO | 02:25 |
| jamielennox | (top of my head, i might be slightly off) | 02:25 |
| agrebennikov | ok | 02:25 |
| jamielennox | forwarded-proto is set to https by haproxy if the incoming request was a https call | 02:25 |
| jamielennox | so i'm not sure if pecan supports checking that env directly or not, some of the wsgi frameworks know | 02:26 |
| agrebennikov | hm... you mean pecan receives already http instead of https, right? | 02:26 |
| agrebennikov | this is why it returns http | 02:26 |
| jamielennox | there was also an oslo middleware that would do some hackery | 02:27 |
| jamielennox | https://github.com/openstack/oslo.middleware/blob/master/oslo_middleware/ssl.py | 02:27 |
| jamielennox | though that middleware says deprecated_for_removal so i don't know what you're supposed to do there | 02:27 |
| agrebennikov | but then.... I have to set barbican server so that it can work out ssl itself | 02:28 |
| agrebennikov | crap | 02:28 |
| jamielennox | right, well pecan was called with a http call so it thinks it's doing the right thing, you should look to see if forwarded-proto is set and if so replace the http | 02:28 |
| agrebennikov | but then | 02:28 |
| agrebennikov | what was the main reason for introducing public_endpoint setting in keystone? | 02:29 |
| agrebennikov | I thought it was somehow connected to this usecase | 02:29 |
| jamielennox | so public_endpoint predated all of this, originally you had to set public endpoint to make keystone work | 02:29 |
| agrebennikov | set where? | 02:30 |
| jamielennox | now if you set public endpoint that will always be used, but if you don't set it we figure out an appropriate url from the request | 02:30 |
| jamielennox | in config | 02:30 |
| agrebennikov | right, so now we must do that because when for example heat calls for versions, it receives url with http | 02:31 |
| agrebennikov | but when we specify pub_endpoint - it works like a charm | 02:31 |
| agrebennikov | specify with https I mean | 02:31 |
| agrebennikov | (I may lie with heat though, meybe some other) | 02:32 |
| agrebennikov | oh, yes, so we do this http-request set-header X-Forwarded-Proto https if { ssl_fc } | 02:32 |
| agrebennikov | and now we just need to teach barbican to recognize it | 02:32 |
| jamielennox | agrebennikov: so try putting that oslo_middleware ssl in your pipeline and see if it "just works" | 02:33 |
| jamielennox | pecan relies on webob and webob will read the wsgi.url_scheme that the middleware sets | 02:33 |
| agrebennikov | ok, let me go ahead and try it out. I can ask dims to help me with that..... Thanks a lot! | 02:34 |
| jamielennox | no problem | 02:34 |
| agrebennikov | so you suggest to not go with the hardcoded urls in config, right? | 02:34 |
| jamielennox | agrebennikov: it really depends on your deployment, if you always know the url and it's the same for public and internal use sometimes it's just easier to force the url | 02:36 |
| jamielennox | but you should make sure that the default when it's not set is correct | 02:36 |
| jamielennox | agrebennikov: looks like https://github.com/openstack/oslo.middleware/blob/master/oslo_middleware/http_proxy_to_wsgi.py is why they deprecated the ssl middleware | 02:37 |
| agrebennikov | jamielennox, right, but in this case I have to redo the same exercise as you did with keystone | 02:37 |
| jamielennox | agrebennikov: so probably easier to not add the public_endpoint stuff to config | 02:37 |
| jamielennox | that's actually a super cool little piece of middleware i haven't seen before | 02:38 |
| agrebennikov | jamielennox, I'm actually not a developer, so I cannot immediately figure out its coolness)) | 02:38 |
| agrebennikov | but I'll ask | 02:38 |
| jamielennox | agrebennikov: well the good thing about this one is you can add it to your paste.ini file without having to add it to code | 02:39 |
| agrebennikov | yeah, I kind of "watch through the fog" - just tell it in the config how I want to forward the requests | 02:40 |
| jamielennox | basically if it sees the forwarded headers in a request then it replaces the host and protocol values on the request with the original ones so the code does the right thing | 02:40 |
| *** diazjf1 has quit IRC | 02:40 | |
| agrebennikov | yeah, and it was probably added to heat already, because I don't see specific headers in its config | 02:41 |
| agrebennikov | like before | 02:41 |
| jamielennox | yep, you can see http_proxy_to_wsgi at https://github.com/openstack/heat/blob/master/etc/heat/api-paste.ini#L4 | 02:43 |
| jamielennox | n | 02:43 |
| jamielennox | but you will need to set enable_proxy_headers_parsing=True in your config file | 02:44 |
| jamielennox | https://github.com/openstack/oslo.middleware/blob/master/oslo_middleware/http_proxy_to_wsgi.py#L20 | 02:44 |
| agrebennikov | ah, but it will only make sense if the service is running under wsgi, which we don't have currently | 02:44 |
| agrebennikov | it will only applicable for barbican | 02:45 |
| jamielennox | agrebennikov: wsgi is a protocol for python web requests, pecan will use it | 02:45 |
| agrebennikov | I mean the rest of the services are still eventlets | 02:45 |
| jamielennox | uwsgi is an app that service wsgi stuff | 02:45 |
| agrebennikov | except keystone | 02:45 |
| jamielennox | they all use wsgi internally | 02:45 |
| agrebennikov | I heard about it... | 02:45 |
| agrebennikov | which will be much more painful to debug | 02:46 |
| agrebennikov | oh, you mean they Already do? | 02:46 |
| jamielennox | barbican has a paste file so you can add the middleware there in the same way heat does | 02:46 |
| jamielennox | https://github.com/openstack/barbican/blob/master/etc/barbican/barbican-api-paste.ini | 02:46 |
| jamielennox | this is not related to eventlet/apache/uwsgi/pecan | 02:46 |
| jamielennox | which i can see it horribly confusing if you don't spend a lot of time around them :) | 02:47 |
| agrebennikov | so we seems do not use it yet in out deployments (which is liberty), that is why I didn't see any traces of it..... | 02:49 |
| agrebennikov | ok | 02:49 |
| jamielennox | yea. it looks like that wasn't in liberty - but the ssl one was and that should work for what you need | 02:50 |
| agrebennikov | so there is a number of pipelines in barbican - barbican_version and barbican_api. I guess I have to fix the first one, right? | 02:51 |
| jamielennox | i'd add it to both | 02:52 |
| agrebennikov | ahh... so it seems requires its own section then..... all this api-paste stuff is superconfusing... | 02:53 |
| agrebennikov | is it an app or a filter? | 02:54 |
| agrebennikov | jamielennox, | 02:55 |
| jamielennox | trying to find an example of it from liberty | 02:56 |
| agrebennikov | ah, nevermind, found already... sorry for my stupidity - it is 8pm already)) | 02:56 |
| agrebennikov | it is all in that heat-api-paste | 02:56 |
| agrebennikov | [filter:http_proxy_to_wsgi] | 02:56 |
| agrebennikov | paste.filter_factory = oslo_middleware:HTTPProxyToWSGI.factory | 02:56 |
| jamielennox | yea, but that won't work in liberty because the middleware isn't there yet | 02:57 |
| jamielennox | the factory will be | 02:57 |
| agrebennikov | yeah, already broken.... | 02:57 |
| jamielennox | paste.filter_factory = oslo_middleware:SSLMiddleware.factory | 02:57 |
| *** dimtruck is now known as zz_dimtruck | 02:58 | |
| agrebennikov | yay!!!!!! this works! | 02:58 |
| jamielennox | looks like they called it just filter:ssl by convention, but so long as you are using the same name within your paste file it doesn't really matter | 02:58 |
| agrebennikov | meaning I can continue using the same oslo_middleware:SSLMiddleware.factory in the next releases? | 02:59 |
| jamielennox | it'll still work up to master, it's just deprecated in favour of the http_proxy_to_wsgi one | 03:00 |
| jamielennox | probably removal in Otaca at a guess | 03:00 |
| agrebennikov | all right jamielennox, you actually resolved the issue I was struggled with for almost 6 hours, trying to dig into pecan and find out how it transform the protocol)) | 03:03 |
| agrebennikov | I Really appreciate it! | 03:03 |
| jamielennox | agrebennikov: heh, everyone has those days - any time | 03:03 |
| agrebennikov | so let me go ahead and change the automation so that it can set it up properly.... Thnaks a lot! | 03:04 |
| agrebennikov | have a great day jamielennox :) | 03:06 |
| jamielennox | agrebennikov: thanks - you too | 03:06 |
| *** agrebennikov has quit IRC | 03:12 | |
| *** zz_dimtruck is now known as dimtruck | 03:14 | |
| *** agrebennikov has joined #openstack-barbican | 03:15 | |
| *** dimtruck is now known as zz_dimtruck | 03:16 | |
| *** zz_dimtruck is now known as dimtruck | 03:18 | |
| *** gyee has quit IRC | 03:20 | |
| *** dave-mccowan has quit IRC | 03:32 | |
| *** agrebennikov1 has joined #openstack-barbican | 03:33 | |
| *** agrebennikov has quit IRC | 03:33 | |
| *** agrebennikov1 has quit IRC | 03:57 | |
| *** agrebennikov has joined #openstack-barbican | 03:58 | |
| *** alee has joined #openstack-barbican | 04:25 | |
| *** edtubill has joined #openstack-barbican | 04:27 | |
| *** dimtruck is now known as zz_dimtruck | 04:29 | |
| *** agrebennikov has quit IRC | 04:39 | |
| *** alpha_ori has quit IRC | 04:42 | |
| *** alpha_ori has joined #openstack-barbican | 04:44 | |
| *** agrebennikov has joined #openstack-barbican | 04:45 | |
| *** fawadkhaliq has joined #openstack-barbican | 04:57 | |
| *** edtubill has quit IRC | 05:02 | |
| *** stupidni` has joined #openstack-barbican | 05:11 | |
| *** stupidnic has quit IRC | 05:12 | |
| *** alpha_ori has quit IRC | 05:13 | |
| *** agrebennikov has quit IRC | 05:16 | |
| *** agrebennikov has joined #openstack-barbican | 05:16 | |
| *** edtubill has joined #openstack-barbican | 05:17 | |
| *** agrebennikov has quit IRC | 05:17 | |
| *** alpha_ori has joined #openstack-barbican | 05:17 | |
| *** edtubill has quit IRC | 05:21 | |
| *** edtubill has joined #openstack-barbican | 05:22 | |
| *** david-lyle has quit IRC | 06:05 | |
| *** edtubill has quit IRC | 06:22 | |
| *** edtubill has joined #openstack-barbican | 06:25 | |
| *** edtubill has quit IRC | 06:30 | |
| *** andreas_s has joined #openstack-barbican | 06:50 | |
| *** ozialien10 has quit IRC | 06:50 | |
| *** mixos has quit IRC | 07:11 | |
| *** fawadkhaliq has quit IRC | 07:52 | |
| *** fawadkhaliq has joined #openstack-barbican | 07:52 | |
| *** david-lyle has joined #openstack-barbican | 07:57 | |
| *** fawadkhaliq has quit IRC | 07:58 | |
| *** fawadkhaliq has joined #openstack-barbican | 07:58 | |
| *** fawadkhaliq has quit IRC | 07:58 | |
| *** fawadkhaliq has joined #openstack-barbican | 07:59 | |
| *** fawadkhaliq has quit IRC | 07:59 | |
| *** fawadkhaliq has joined #openstack-barbican | 08:00 | |
| *** fawadkhaliq has quit IRC | 08:00 | |
| *** fawadkhaliq has joined #openstack-barbican | 08:01 | |
| *** fawadkhaliq has quit IRC | 08:01 | |
| *** fawadkhaliq has joined #openstack-barbican | 08:01 | |
| *** fawadkhaliq has quit IRC | 08:02 | |
| *** fawadkhaliq has joined #openstack-barbican | 08:02 | |
| *** shohel has joined #openstack-barbican | 08:02 | |
| *** fawadkhaliq has quit IRC | 08:02 | |
| *** fawadkhaliq has joined #openstack-barbican | 08:03 | |
| *** fawadkhaliq has quit IRC | 08:03 | |
| *** fawadkhaliq has joined #openstack-barbican | 08:04 | |
| *** fawadkhaliq has quit IRC | 08:04 | |
| *** fawadkhaliq has joined #openstack-barbican | 08:05 | |
| *** fawadkhaliq has quit IRC | 08:05 | |
| *** fawadkhaliq has joined #openstack-barbican | 08:06 | |
| *** fawadkhaliq has quit IRC | 08:06 | |
| *** fawadkhaliq has joined #openstack-barbican | 08:06 | |
| *** fawadkhaliq has quit IRC | 08:07 | |
| *** fawadkhaliq has joined #openstack-barbican | 08:08 | |
| *** andreas_s has quit IRC | 08:12 | |
| *** vipuls has joined #openstack-barbican | 08:42 | |
| *** Kevin_Zheng_ has joined #openstack-barbican | 08:42 | |
| *** jraim_ has joined #openstack-barbican | 08:44 | |
| *** eglute_s has joined #openstack-barbican | 08:44 | |
| *** hockeynut_afk has joined #openstack-barbican | 08:45 | |
| *** mathiasb_ has joined #openstack-barbican | 08:45 | |
| *** tdink_afk has joined #openstack-barbican | 08:45 | |
| *** sigmavirus24_awa has quit IRC | 08:45 | |
| *** hockeynut has quit IRC | 08:45 | |
| *** tdink has quit IRC | 08:45 | |
| *** shohel has quit IRC | 08:45 | |
| *** jillysciarilly has quit IRC | 08:45 | |
| *** jraim has quit IRC | 08:45 | |
| *** zz_dimtruck has quit IRC | 08:45 | |
| *** vipul- has quit IRC | 08:45 | |
| *** hyakuhei has quit IRC | 08:45 | |
| *** Kevin_Zheng has quit IRC | 08:45 | |
| *** briancurtin has quit IRC | 08:45 | |
| *** mathiasb has quit IRC | 08:45 | |
| *** rbradfor has quit IRC | 08:45 | |
| *** eglute has quit IRC | 08:45 | |
| *** jamielennox has quit IRC | 08:45 | |
| *** jillysciarilly has joined #openstack-barbican | 08:45 | |
| *** dimtruckl has joined #openstack-barbican | 08:45 | |
| *** Kevin_Zheng_ is now known as Kevin_Zheng | 08:46 | |
| *** dimtruckl is now known as dimtruck | 08:46 | |
| *** shohel has joined #openstack-barbican | 08:46 | |
| *** rbradfor has joined #openstack-barbican | 08:46 | |
| *** jraim_ is now known as jraim | 08:47 | |
| *** sigmavirus24_awa has joined #openstack-barbican | 08:48 | |
| *** hyakuhei has joined #openstack-barbican | 08:48 | |
| *** hyakuhei has quit IRC | 08:49 | |
| *** hyakuhei has joined #openstack-barbican | 08:49 | |
| *** hyakuhei has quit IRC | 08:49 | |
| *** hyakuhei has joined #openstack-barbican | 08:49 | |
| *** jaosorior has joined #openstack-barbican | 08:51 | |
| *** rm_work has quit IRC | 08:53 | |
| *** rm_work has joined #openstack-barbican | 08:54 | |
| *** jamielennox has joined #openstack-barbican | 08:55 | |
| *** briancurtin has joined #openstack-barbican | 09:05 | |
| *** Kevin_Zheng has quit IRC | 09:16 | |
| *** Kevin_Zheng has joined #openstack-barbican | 09:21 | |
| *** fawadkhaliq has quit IRC | 09:49 | |
| *** fawadkhaliq has joined #openstack-barbican | 09:50 | |
| *** dimtruck is now known as zz_dimtruck | 10:36 | |
| *** Kevin_Zheng has quit IRC | 11:11 | |
| *** andreas_s has joined #openstack-barbican | 11:12 | |
| *** andreas_s_ has joined #openstack-barbican | 11:57 | |
| *** andreas_s_ has quit IRC | 11:57 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 12:12 | |
| *** fawadkhaliq has quit IRC | 12:17 | |
| *** fawadkhaliq has joined #openstack-barbican | 12:18 | |
| *** zz_dimtruck is now known as dimtruck | 12:33 | |
| *** Kevin_Zheng has joined #openstack-barbican | 12:46 | |
| *** dimtruck is now known as zz_dimtruck | 13:42 | |
| *** elo1 has joined #openstack-barbican | 13:43 | |
| *** elo1 has quit IRC | 13:45 | |
| *** elo1 has joined #openstack-barbican | 13:48 | |
| *** jmckind has joined #openstack-barbican | 13:57 | |
| *** elo1 has quit IRC | 13:58 | |
| *** dave-mccowan has joined #openstack-barbican | 13:59 | |
| *** spotz_zzz is now known as spotz | 14:23 | |
| *** edtubill has joined #openstack-barbican | 14:32 | |
| *** elo1 has joined #openstack-barbican | 14:36 | |
| *** jmckind has quit IRC | 14:37 | |
| *** jmckind has joined #openstack-barbican | 14:38 | |
| *** kfarr has joined #openstack-barbican | 14:52 | |
| *** elo1 has quit IRC | 14:56 | |
| *** hockeynut_afk is now known as hockeynut | 14:56 | |
| *** shohel has quit IRC | 14:57 | |
| *** jaosorior has quit IRC | 14:59 | |
| *** jaosorior has joined #openstack-barbican | 14:59 | |
| *** Kevin_Zheng has quit IRC | 15:01 | |
| *** fawadkhaliq has quit IRC | 15:04 | |
| *** elo1 has joined #openstack-barbican | 15:04 | |
| *** mixos has joined #openstack-barbican | 15:06 | |
| *** woodster_ has joined #openstack-barbican | 15:08 | |
| *** diazjf has joined #openstack-barbican | 15:10 | |
| *** andreas_s has quit IRC | 15:13 | |
| *** fawadkhaliq has joined #openstack-barbican | 15:23 | |
| *** fawadkhaliq has quit IRC | 15:23 | |
| *** fawadkhaliq has joined #openstack-barbican | 15:34 | |
| *** jmckind_ has joined #openstack-barbican | 15:44 | |
| *** jmckind has quit IRC | 15:48 | |
| *** zz_dimtruck is now known as dimtruck | 15:51 | |
| *** agrebennikov has joined #openstack-barbican | 16:00 | |
| *** edtubill has quit IRC | 16:02 | |
| *** edtubill has joined #openstack-barbican | 16:15 | |
| *** elo1 has quit IRC | 16:21 | |
| *** elo1 has joined #openstack-barbican | 16:22 | |
| *** jmckind_ has quit IRC | 16:23 | |
| *** gyee has joined #openstack-barbican | 16:25 | |
| *** dimtruck is now known as zz_dimtruck | 16:27 | |
| *** zz_dimtruck is now known as dimtruck | 16:29 | |
| *** jmckind has joined #openstack-barbican | 16:37 | |
| *** fawadkhaliq has quit IRC | 16:50 | |
| *** fawadkhaliq has joined #openstack-barbican | 16:51 | |
| *** fawadkhaliq has quit IRC | 16:55 | |
| *** diazjf has quit IRC | 16:58 | |
| *** elo1 has quit IRC | 17:33 | |
| *** dimtruck is now known as zz_dimtruck | 17:50 | |
| *** zz_dimtruck is now known as dimtruck | 17:52 | |
| *** dimtruck is now known as zz_dimtruck | 18:19 | |
| *** elo1 has joined #openstack-barbican | 18:20 | |
| *** jhfeng has joined #openstack-barbican | 18:23 | |
| *** diazjf has joined #openstack-barbican | 18:28 | |
| *** jhfeng has quit IRC | 18:44 | |
| *** kfarr has quit IRC | 19:13 | |
| *** jhfeng has joined #openstack-barbican | 19:29 | |
| *** jmckind has quit IRC | 19:31 | |
| *** jmckind has joined #openstack-barbican | 19:35 | |
| *** jmckind has quit IRC | 19:40 | |
| *** diazjf has quit IRC | 19:46 | |
| *** diazjf has joined #openstack-barbican | 19:47 | |
| *** fawadkhaliq has joined #openstack-barbican | 19:54 | |
| *** fawadkhaliq has quit IRC | 19:54 | |
| *** fawadkhaliq has joined #openstack-barbican | 19:55 | |
| *** zz_dimtruck is now known as dimtruck | 20:06 | |
| *** jhfeng has quit IRC | 20:09 | |
| *** diazjf has quit IRC | 20:13 | |
| *** fawadkhaliq has quit IRC | 20:15 | |
| *** diazjf has joined #openstack-barbican | 20:20 | |
| *** kfarr has joined #openstack-barbican | 20:25 | |
| *** elo1 has quit IRC | 20:35 | |
| *** elo1 has joined #openstack-barbican | 20:41 | |
| *** mathiasb_ is now known as mathiasb | 21:01 | |
| *** kfarr has quit IRC | 21:15 | |
| *** elo1 has quit IRC | 21:16 | |
| *** dave-mccowan has quit IRC | 21:23 | |
| *** edtubill has quit IRC | 21:33 | |
| *** elo1 has joined #openstack-barbican | 21:38 | |
| openstackgerrit | Douglas Mendizábal proposed openstack/python-barbicanclient: Update mailmap for Douglas Mendizábal https://review.openstack.org/318346 | 21:41 |
| *** mixos has quit IRC | 21:46 | |
| *** diazjf has quit IRC | 21:50 | |
| *** ozialien10 has joined #openstack-barbican | 22:03 | |
| *** spotz is now known as spotz_zzz | 22:31 | |
| *** jaosorior has quit IRC | 22:58 | |
| *** jaosorior has joined #openstack-barbican | 22:59 | |
| *** jamielennox is now known as jamielennox|away | 23:04 | |
| *** agrebennikov has quit IRC | 23:14 | |
| *** jamielennox|away is now known as jamielennox | 23:51 | |
| *** diazjf has joined #openstack-barbican | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!