| *** winston-d_ has joined #openstack-dev | 00:06 | |
| *** lucid- has quit IRC | 00:08 | |
| *** osphy has quit IRC | 00:12 | |
| *** lucid- has joined #openstack-dev | 00:16 | |
| *** markwash has joined #openstack-dev | 00:19 | |
| *** jeblair has quit IRC | 00:21 | |
| *** soody has quit IRC | 00:28 | |
| openstackgerrit | A change was merged to openstack/tempest: Add tests for server metadata https://review.openstack.org/22430 | 00:35 |
|---|---|---|
| *** markmcclain has joined #openstack-dev | 00:36 | |
| *** ilblackdragon has joined #openstack-dev | 00:44 | |
| *** anniec has joined #openstack-dev | 00:45 | |
| *** markwash has quit IRC | 00:45 | |
| *** ilblackdragon has quit IRC | 00:46 | |
| *** anniec has quit IRC | 00:46 | |
| *** anniec has joined #openstack-dev | 00:48 | |
| *** morganfainberg has joined #openstack-dev | 00:49 | |
| *** hoodow has quit IRC | 01:09 | |
| *** hoodow has joined #openstack-dev | 01:09 | |
| *** jcmartin has joined #openstack-dev | 01:10 | |
| *** buzztroll_ has joined #openstack-dev | 01:11 | |
| *** soody has joined #openstack-dev | 01:13 | |
| *** markmcclain has quit IRC | 01:14 | |
| *** stevebaker has quit IRC | 01:14 | |
| *** stevebaker has joined #openstack-dev | 01:16 | |
| *** markmcclain has joined #openstack-dev | 01:17 | |
| *** markwash has joined #openstack-dev | 01:26 | |
| *** soody has quit IRC | 01:26 | |
| *** buzztroll_ has quit IRC | 01:33 | |
| *** markwash has quit IRC | 01:35 | |
| *** adjohn has quit IRC | 01:38 | |
| *** adjohn has joined #openstack-dev | 01:40 | |
| *** soody has joined #openstack-dev | 01:40 | |
| *** soody has quit IRC | 01:47 | |
| *** gongysh has joined #openstack-dev | 01:47 | |
| *** gongysh has quit IRC | 01:47 | |
| *** gongysh has joined #openstack-dev | 01:48 | |
| *** yaguang has joined #openstack-dev | 01:51 | |
| *** soody has joined #openstack-dev | 01:51 | |
| *** morganfainberg has quit IRC | 01:54 | |
| *** danwent has joined #openstack-dev | 01:54 | |
| *** soody has quit IRC | 01:55 | |
| *** morganfainberg has joined #openstack-dev | 01:56 | |
| *** morganfainberg has quit IRC | 01:59 | |
| *** ladquin has quit IRC | 01:59 | |
| *** morganfainberg has joined #openstack-dev | 02:00 | |
| *** buzztroll_ has joined #openstack-dev | 02:00 | |
| *** morganfainberg1 has joined #openstack-dev | 02:02 | |
| *** morganfainberg has quit IRC | 02:02 | |
| *** amotoki has joined #openstack-dev | 02:03 | |
| *** bing_bu has joined #openstack-dev | 02:06 | |
| *** buzztroll_ has quit IRC | 02:06 | |
| *** aeperezt has quit IRC | 02:07 | |
| *** Tross has joined #openstack-dev | 02:07 | |
| *** gongysh has quit IRC | 02:09 | |
| *** aeperezt has joined #openstack-dev | 02:11 | |
| *** jeblair has joined #openstack-dev | 02:11 | |
| *** soody has joined #openstack-dev | 02:15 | |
| openstackgerrit | A change was merged to openstack/cinder: XenAPINFS: Fix Volume always uploaded as vhd/ovf https://review.openstack.org/22576 | 02:22 |
| *** soody has quit IRC | 02:35 | |
| *** markmcclain has quit IRC | 02:36 | |
| *** torandu has quit IRC | 02:38 | |
| lifeless | ttx: http://summit.openstack.org/cfp is missing a Quantum topic | 02:38 |
| lifeless | ttx: 'networking' suggests nova-network to me :/ | 02:38 |
| *** torandu has joined #openstack-dev | 02:40 | |
| *** Ryan_Lane has quit IRC | 02:40 | |
| *** Ryan_Lane has joined #openstack-dev | 02:43 | |
| *** alexxu has joined #openstack-dev | 02:44 | |
| *** markmcclain has joined #openstack-dev | 02:47 | |
| *** stevebaker2 has joined #openstack-dev | 02:48 | |
| *** stevebaker has quit IRC | 02:49 | |
| *** zodiak has joined #openstack-dev | 02:51 | |
| *** soody has joined #openstack-dev | 02:55 | |
| *** stevebaker2 has quit IRC | 02:56 | |
| *** stevebaker has joined #openstack-dev | 02:56 | |
| *** soody has quit IRC | 03:00 | |
| *** bing_bu has quit IRC | 03:04 | |
| *** soody has joined #openstack-dev | 03:12 | |
| *** gongysh has joined #openstack-dev | 03:13 | |
| *** bing_bu has joined #openstack-dev | 03:17 | |
| *** tomoe_ has joined #openstack-dev | 03:17 | |
| *** tomoe_ has quit IRC | 03:21 | |
| *** bing_bu has quit IRC | 03:23 | |
| *** tomoe_ has joined #openstack-dev | 03:27 | |
| *** shang_ has quit IRC | 03:27 | |
| *** shang has joined #openstack-dev | 03:31 | |
| openstackgerrit | A change was merged to openstack/quantum: Imported Translations from Transifex https://review.openstack.org/22809 | 03:34 |
| *** bing_bu has joined #openstack-dev | 03:36 | |
| BLZbubba | ok this is a weird one, i moved nova-api to its own machine and i can create & reboot vm's, but when I try to terminate one I get this: | 03:41 |
| BLZbubba | http://pastebin.ca/2317194 | 03:41 |
| BLZbubba | "This method may not be used." | 03:41 |
| *** ewindisch has joined #openstack-dev | 03:42 | |
| *** Tross has quit IRC | 03:44 | |
| *** ilblackdragon has joined #openstack-dev | 03:48 | |
| *** gongysh has quit IRC | 03:48 | |
| *** sacharya has joined #openstack-dev | 03:52 | |
| *** sacharya has quit IRC | 03:52 | |
| anniec | logger url | 03:58 |
| *** anniec has left #openstack-dev | 03:59 | |
| *** anniec has joined #openstack-dev | 03:59 | |
| *** ewindisch has quit IRC | 04:03 | |
| *** sthaha has joined #openstack-dev | 04:07 | |
| *** uvg has joined #openstack-dev | 04:11 | |
| *** Tross has joined #openstack-dev | 04:16 | |
| *** soody has quit IRC | 04:38 | |
| BLZbubba | ah, it was the proxy that was returning that error | 04:41 |
| *** Tross has quit IRC | 04:48 | |
| *** pixelbeat has quit IRC | 04:49 | |
| *** boris-42 has joined #openstack-dev | 04:52 | |
| *** nati_ueno has joined #openstack-dev | 04:54 | |
| *** Mandell has joined #openstack-dev | 04:59 | |
| *** Tross has joined #openstack-dev | 05:08 | |
| *** Tross has quit IRC | 05:08 | |
| *** Tross has joined #openstack-dev | 05:12 | |
| *** markwash has joined #openstack-dev | 05:13 | |
| *** aeperezt has quit IRC | 05:14 | |
| *** mohits has joined #openstack-dev | 05:17 | |
| *** markwash has quit IRC | 05:18 | |
| *** woodspa has quit IRC | 05:19 | |
| *** gongysh has joined #openstack-dev | 05:22 | |
| *** anniec has quit IRC | 05:25 | |
| *** davidha has joined #openstack-dev | 05:28 | |
| *** ritzcarltn has joined #openstack-dev | 05:29 | |
| *** navid has joined #openstack-dev | 05:32 | |
| *** jcmartin has quit IRC | 05:43 | |
| *** kagan has joined #openstack-dev | 05:45 | |
| *** almaisan-away is now known as al-maisan | 05:51 | |
| *** al-maisan is now known as almaisan-away | 05:52 | |
| *** armaan has joined #openstack-dev | 05:58 | |
| *** uvg has left #openstack-dev | 06:01 | |
| *** davidha has quit IRC | 06:06 | |
| *** morganfainberg1 has left #openstack-dev | 06:07 | |
| *** morganfainberg has joined #openstack-dev | 06:08 | |
| *** darjeeling has quit IRC | 06:08 | |
| *** koolhead17 has joined #openstack-dev | 06:10 | |
| *** kagan has quit IRC | 06:10 | |
| *** alunduil has joined #openstack-dev | 06:19 | |
| *** hattwick has quit IRC | 06:19 | |
| *** shang has quit IRC | 06:22 | |
| *** otherwiseguy has quit IRC | 06:26 | |
| *** afazekas has joined #openstack-dev | 06:31 | |
| *** adjohn has quit IRC | 06:32 | |
| *** flepied has quit IRC | 06:34 | |
| *** shang has joined #openstack-dev | 06:35 | |
| *** CaptTofu has joined #openstack-dev | 06:37 | |
| *** ritzcarltn has quit IRC | 06:38 | |
| *** CaptTofu has quit IRC | 06:43 | |
| *** adjohn has joined #openstack-dev | 06:44 | |
| *** CaptTofu has joined #openstack-dev | 06:44 | |
| *** adjohn has quit IRC | 06:45 | |
| *** adjohn has joined #openstack-dev | 06:45 | |
| *** fc__ has joined #openstack-dev | 06:54 | |
| *** CaptTofu has quit IRC | 07:01 | |
| *** CaptTofu has joined #openstack-dev | 07:01 | |
| *** adjohn has quit IRC | 07:03 | |
| *** garyk has joined #openstack-dev | 07:04 | |
| *** adjohn has joined #openstack-dev | 07:05 | |
| *** CaptTofu has quit IRC | 07:06 | |
| *** markmcclain has quit IRC | 07:13 | |
| *** AnilV4 has joined #openstack-dev | 07:19 | |
| *** yolanda has joined #openstack-dev | 07:30 | |
| *** darjeeling has joined #openstack-dev | 07:32 | |
| *** avishay has joined #openstack-dev | 07:33 | |
| *** henrynash has joined #openstack-dev | 07:37 | |
| *** hemna has quit IRC | 07:41 | |
| *** flepied has joined #openstack-dev | 07:46 | |
| *** corXi has joined #openstack-dev | 07:55 | |
| *** reidrac has joined #openstack-dev | 07:55 | |
| *** yuanz has joined #openstack-dev | 07:59 | |
| *** techlife has quit IRC | 08:00 | |
| *** mmagr has joined #openstack-dev | 08:01 | |
| *** flaper87 has joined #openstack-dev | 08:02 | |
| *** melwitt has joined #openstack-dev | 08:02 | |
| *** avishay has quit IRC | 08:03 | |
| *** rafaduran has joined #openstack-dev | 08:03 | |
| *** zoresvit has joined #openstack-dev | 08:04 | |
| *** adjohn has quit IRC | 08:04 | |
| *** reidrac has quit IRC | 08:07 | |
| *** psedlak has joined #openstack-dev | 08:07 | |
| *** nati_ueno has quit IRC | 08:07 | |
| *** nati_ueno has joined #openstack-dev | 08:08 | |
| *** reidrac has joined #openstack-dev | 08:09 | |
| *** techlife has joined #openstack-dev | 08:10 | |
| *** nati_ueno has quit IRC | 08:13 | |
| *** amerine has joined #openstack-dev | 08:16 | |
| *** koolhead17 has quit IRC | 08:17 | |
| *** jprovazn has joined #openstack-dev | 08:18 | |
| *** pasquier-s has joined #openstack-dev | 08:19 | |
| openstackgerrit | A change was merged to openstack/quantum: Add pagination parameters for extension extraroute https://review.openstack.org/22666 | 08:22 |
| *** thouveng has joined #openstack-dev | 08:22 | |
| *** avishay has joined #openstack-dev | 08:25 | |
| *** techlife has quit IRC | 08:27 | |
| *** flaper87 has quit IRC | 08:28 | |
| *** techlife has joined #openstack-dev | 08:28 | |
| *** flaper87 has joined #openstack-dev | 08:29 | |
| *** zoresvit has quit IRC | 08:33 | |
| *** adjohn has joined #openstack-dev | 08:35 | |
| *** avishay has quit IRC | 08:35 | |
| garyk | amotoki: ping | 08:35 |
| amotoki | garyk: pong | 08:35 |
| *** flepied has quit IRC | 08:35 | |
| *** almaisan-away is now known as al-maisan | 08:35 | |
| garyk | amotoki: hi, how are you? question regarding devstack and security groups - do i need to configure anyhthing special? | 08:35 |
| garyk | amotoki: for nova I have LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver | 08:36 |
| garyk | amotoki: anything else? | 08:36 |
| *** aloga has joined #openstack-dev | 08:36 | |
| *** flepied has joined #openstack-dev | 08:36 | |
| amotoki | garyk: which plugin do you use? ovs? | 08:36 |
| garyk | amotoki: ovs | 08:36 |
| amotoki | at the moment, the default value of quantum firewall_driver for OVS pluign is noop. | 08:37 |
| amotoki | garyk: so we need to configure plugin ini. | 08:37 |
| garyk | amotoki: what should i configure there? | 08:37 |
| amotoki | garyk: firewall_driver = quantum.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver in ovs_quantum_plugin.ini is comment out by default. | 08:38 |
| amotoki | garyk: please uncomment it. | 08:38 |
| garyk | amotoki: ok, thanks | 08:38 |
| gongysh | garyk: why do u need it? | 08:38 |
| *** melwitt has quit IRC | 08:39 | |
| garyk | gongysh: on fedora 18 the dhcp request is discarded by the iptables. | 08:39 |
| *** gael_ has joined #openstack-dev | 08:40 | |
| gongysh | ovs plugin should have no iptables by default. so it is not the quantum problem if fedora 18 does not like the dhcp package. | 08:40 |
| amotoki | garyk: the behavior is different from expected one. If firewall_driver both in nova and quantum are Noop, no one drop the packets.... | 08:40 |
| gongysh | garyk: dhcp package -> dhcp message. | 08:41 |
| *** Qten has joined #openstack-dev | 08:41 | |
| garyk | gongysh: amotoki: by default fedora has discard rules. | 08:42 |
| garyk | give me a few minutes and i'll post the tables | 08:44 |
| *** adjohn has quit IRC | 08:44 | |
| *** dosaboy has joined #openstack-dev | 08:45 | |
| garyk | amotoki: gongysh: with quantums security group rules it works! this is a great sign. by default nova's do not. | 08:48 |
| *** giulivo has joined #openstack-dev | 08:49 | |
| *** zoresvit has joined #openstack-dev | 08:50 | |
| amotoki | garyk: Sounds nice. In quantum security group, the bottom riquantum-*-sg-chain of iptables rules is ACCEPT. Thus if all security group rules are passed for the packet, the packet is accepted. | 08:50 |
| garyk | amotoki: :) | 08:50 |
| amotoki | garyk: The reason that quantum secgroup in OVS plugin is disabled by default is to pass gating. devstack and gating test have no support of quantum secgroup now. | 08:52 |
| garyk | amotoki: ok. thanks for the clarifications. | 08:53 |
| *** yaguang has quit IRC | 08:54 | |
| *** yaguang has joined #openstack-dev | 08:54 | |
| *** Ritz has joined #openstack-dev | 08:55 | |
| *** winston-d_ has quit IRC | 08:55 | |
| *** jgallard has joined #openstack-dev | 08:57 | |
| *** tomoe_ has quit IRC | 08:58 | |
| *** tomoe_ has joined #openstack-dev | 08:59 | |
| *** zoresvit has quit IRC | 08:59 | |
| *** jpich has joined #openstack-dev | 09:03 | |
| *** tomoe_ has quit IRC | 09:04 | |
| *** jgallard has quit IRC | 09:08 | |
| *** adjohn has joined #openstack-dev | 09:10 | |
| *** jdurgin has quit IRC | 09:12 | |
| *** zoresvit has joined #openstack-dev | 09:12 | |
| *** derekh has joined #openstack-dev | 09:13 | |
| *** negronjl` is now known as negronjl | 09:13 | |
| *** ndipanov has joined #openstack-dev | 09:14 | |
| *** adjohn has quit IRC | 09:15 | |
| *** darjeeling has quit IRC | 09:16 | |
| *** gongysh has quit IRC | 09:16 | |
| *** henrynash has quit IRC | 09:17 | |
| *** nsatterl_ has joined #openstack-dev | 09:24 | |
| *** jdurgin has joined #openstack-dev | 09:24 | |
| *** nsatterl_ has joined #openstack-dev | 09:25 | |
| *** johnthetubaguy has joined #openstack-dev | 09:25 | |
| *** navid has quit IRC | 09:26 | |
| *** amerine has quit IRC | 09:26 | |
| *** jgallard has joined #openstack-dev | 09:28 | |
| *** alexxu has quit IRC | 09:28 | |
| *** pixelbeat has joined #openstack-dev | 09:28 | |
| *** bing_bu has quit IRC | 09:30 | |
| *** darraghb has joined #openstack-dev | 09:30 | |
| *** afazekas has quit IRC | 09:33 | |
| *** psedlak has quit IRC | 09:33 | |
| *** romcheg has joined #openstack-dev | 09:33 | |
| *** psedlak has joined #openstack-dev | 09:36 | |
| *** giulivo has quit IRC | 09:38 | |
| *** dosaboy has quit IRC | 09:38 | |
| *** giulivo has joined #openstack-dev | 09:38 | |
| *** danwent has quit IRC | 09:38 | |
| *** dosaboy has joined #openstack-dev | 09:38 | |
| *** koolhead17 has joined #openstack-dev | 09:39 | |
| *** lucasagomes has joined #openstack-dev | 09:42 | |
| *** giulivo has quit IRC | 09:42 | |
| *** afazekas has joined #openstack-dev | 09:45 | |
| *** eglynn has joined #openstack-dev | 09:45 | |
| *** osphy has joined #openstack-dev | 09:46 | |
| *** vkmc has joined #openstack-dev | 09:51 | |
| *** psedlak has quit IRC | 09:52 | |
| *** psedlak has joined #openstack-dev | 09:52 | |
| *** yaguang has quit IRC | 09:53 | |
| *** giulivo has joined #openstack-dev | 09:53 | |
| *** buzztroll_ has joined #openstack-dev | 09:53 | |
| *** AnilV4 has quit IRC | 09:55 | |
| *** henrynash has joined #openstack-dev | 09:56 | |
| *** thickski_ has joined #openstack-dev | 10:00 | |
| *** psedlak_ has joined #openstack-dev | 10:02 | |
| thickski_ | hello all. | 10:02 |
| thickski_ | http://pastebin.com/8BM6PkMU | 10:02 |
| *** flepied has quit IRC | 10:02 | |
| *** flepied1 has joined #openstack-dev | 10:02 | |
| thickski_ | I can`t install quantum-l3-agent-g2 | 10:03 |
| *** buzztroll_ has quit IRC | 10:05 | |
| *** psedlak has quit IRC | 10:06 | |
| *** henrynash has quit IRC | 10:07 | |
| *** thickski_ has left #openstack-dev | 10:07 | |
| *** iartarisi has joined #openstack-dev | 10:09 | |
| *** danpb has joined #openstack-dev | 10:10 | |
| *** adjohn has joined #openstack-dev | 10:11 | |
| *** darjeeling has joined #openstack-dev | 10:11 | |
| *** darjeeli_ has joined #openstack-dev | 10:11 | |
| *** henrynash has joined #openstack-dev | 10:14 | |
| *** psedlak_ has quit IRC | 10:15 | |
| *** trapniii has quit IRC | 10:15 | |
| *** darjeeling has quit IRC | 10:15 | |
| *** adjohn has quit IRC | 10:15 | |
| *** henrynash has quit IRC | 10:16 | |
| *** afazekas has quit IRC | 10:18 | |
| *** afazekas has joined #openstack-dev | 10:24 | |
| *** psedlak has joined #openstack-dev | 10:28 | |
| *** psedlak has quit IRC | 10:29 | |
| *** psedlak has joined #openstack-dev | 10:29 | |
| *** doude has joined #openstack-dev | 10:29 | |
| *** trapni has joined #openstack-dev | 10:31 | |
| *** ondergetekende has joined #openstack-dev | 10:32 | |
| *** hattwick has joined #openstack-dev | 10:35 | |
| *** amerine has joined #openstack-dev | 10:36 | |
| *** zoresvit has quit IRC | 10:36 | |
| *** johnthetubaguy has quit IRC | 10:44 | |
| *** anniec has joined #openstack-dev | 10:45 | |
| *** bourke_ has joined #openstack-dev | 10:45 | |
| *** bourke has quit IRC | 10:46 | |
| ondergetekende | I submitted a change for review, just over a week ago, but my most recent patchset hasn't seen any reviews yet. | 10:47 |
| ondergetekende | Should I be patient, or is there something I forgot to do? | 10:47 |
| vkmc | ondergetekende, Hi! Link? | 10:48 |
| *** johnthetubaguy has joined #openstack-dev | 10:51 | |
| *** johnthetubaguy1 has joined #openstack-dev | 10:53 | |
| *** amerine has quit IRC | 10:54 | |
| *** zoresvit has joined #openstack-dev | 10:55 | |
| *** trapnii has joined #openstack-dev | 10:55 | |
| *** johnthetubaguy has quit IRC | 10:56 | |
| *** trapni has quit IRC | 10:58 | |
| *** adjohn has joined #openstack-dev | 11:11 | |
| ondergetekende | vkmc, https://review.openstack.org/#/c/21958/ | 11:15 |
| *** adjohn has quit IRC | 11:16 | |
| *** afazekas has quit IRC | 11:17 | |
| *** afazekas has joined #openstack-dev | 11:18 | |
| *** amerine has joined #openstack-dev | 11:21 | |
| vkmc | ondergetekende, It looks good! So I guess you should wait a little more | 11:21 |
| ondergetekende | Thanks. I'll do that. | 11:21 |
| vkmc | ondergetekende, I saw you had some issues with Jenkins pep8 tests | 11:22 |
| ondergetekende | Yeah, i did | 11:22 |
| vkmc | ondergetekende, Tox provides a way to test them before commit :) | 11:22 |
| vkmc | ondergetekende, tox -e pep8 | 11:22 |
| ondergetekende | Where would I find tox? | 11:23 |
| vkmc | ondergetekende, sudo pip install tox | 11:23 |
| ondergetekende | Will do. | 11:23 |
| vkmc | ondergetekende, Is used by Oslo folks to test their code, so it may be handy for you if you keep contributing to that project | 11:24 |
| vkmc | ondergetekende, https://github.com/openstack/oslo-incubator more info here | 11:24 |
| zykes- | vkmc: do you develop horizon stuffs ? | 11:24 |
| ondergetekende | There's no mention of tox in the general openstack 'how to contribute' wiki. | 11:24 |
| vkmc | zykes-, Yeap :) | 11:24 |
| vkmc | ondergetekende, Nope... testing is different in each project usually | 11:25 |
| ondergetekende | Good to know. | 11:26 |
| vkmc | ondergetekende, So it's always good to check project's code rep, channel and wiki to get more information | 11:26 |
| *** AnilV4 has joined #openstack-dev | 11:27 | |
| *** adalbas has joined #openstack-dev | 11:33 | |
| *** johnthetubaguy1 is now known as johnthetubaguy | 11:36 | |
| *** amerine has quit IRC | 11:40 | |
| *** afrittoli has quit IRC | 11:52 | |
| *** david2 has joined #openstack-dev | 11:52 | |
| *** andreaf has joined #openstack-dev | 11:52 | |
| *** mohits has quit IRC | 11:57 | |
| *** jruzicka has joined #openstack-dev | 11:59 | |
| *** eharney has joined #openstack-dev | 12:02 | |
| *** eharney has quit IRC | 12:02 | |
| *** eharney has joined #openstack-dev | 12:02 | |
| *** rkukura has left #openstack-dev | 12:03 | |
| *** nsatterl_ has quit IRC | 12:03 | |
| *** amerine has joined #openstack-dev | 12:07 | |
| *** cdub_ has quit IRC | 12:07 | |
| *** cdub_ has joined #openstack-dev | 12:08 | |
| *** timello has quit IRC | 12:16 | |
| *** timello has joined #openstack-dev | 12:16 | |
| *** alexxu has joined #openstack-dev | 12:16 | |
| *** ladquin has joined #openstack-dev | 12:18 | |
| *** markmc has joined #openstack-dev | 12:18 | |
| *** mindpixel has joined #openstack-dev | 12:19 | |
| *** amerine has quit IRC | 12:22 | |
| *** jbr_ has joined #openstack-dev | 12:26 | |
| *** Yada has joined #openstack-dev | 12:26 | |
| *** martine_ has joined #openstack-dev | 12:27 | |
| amotoki | garyk: ping | 12:29 |
| garyk | amotoki: hi | 12:30 |
| amotoki | garyk: have you tested router schduler of yong's patch? | 12:30 |
| garyk | amotoki: i am testing it at the moment. i have an all in one setup and in the process of adding another host. | 12:30 |
| amotoki | garyk: I am in a half way of testing. test for dhcp-agnet scheduler works well with multi nodes. | 12:31 |
| garyk | amotoki: i have just tested the basics at the moment | 12:31 |
| *** darjeeling has joined #openstack-dev | 12:31 | |
| amotoki | garyk: it is good we don't have duplicated tests so far :-) | 12:31 |
| garyk | amotoki: :). it is a big patch set | 12:32 |
| *** martine_ has quit IRC | 12:32 | |
| amotoki | I will test router scheduler with three nodes tommorow. | 12:32 |
| amotoki | garyk: it becomes good shape as far as I tested. | 12:33 |
| *** zoresvit has quit IRC | 12:33 | |
| garyk | amotoki: me too | 12:33 |
| amotoki | garyk: thanks. | 12:34 |
| garyk | amotoki: thank you | 12:34 |
| *** darjeeli_ has quit IRC | 12:35 | |
| *** jruzicka has quit IRC | 12:36 | |
| *** tomoe_ has joined #openstack-dev | 12:37 | |
| *** ewindisch has joined #openstack-dev | 12:40 | |
| *** adjohn has joined #openstack-dev | 12:42 | |
| *** zoresvit has joined #openstack-dev | 12:45 | |
| *** darjeeling has quit IRC | 12:46 | |
| *** ewindisch has quit IRC | 12:47 | |
| *** adjohn has quit IRC | 12:47 | |
| *** amerine has joined #openstack-dev | 12:51 | |
| *** jruzicka has joined #openstack-dev | 12:52 | |
| *** lucasagomes has quit IRC | 12:53 | |
| *** giulivo has quit IRC | 12:57 | |
| *** giulivo has joined #openstack-dev | 12:58 | |
| *** digitalsanctum has joined #openstack-dev | 13:01 | |
| *** amerine has quit IRC | 13:09 | |
| *** pcm_ has joined #openstack-dev | 13:10 | |
| *** martine_ has joined #openstack-dev | 13:11 | |
| *** sthaha has quit IRC | 13:11 | |
| *** adjohn has joined #openstack-dev | 13:13 | |
| maurosr | boris-42, good morning, are you boris pavlovic? | 13:13 |
| boris-42 | maurosr yes | 13:14 |
| maurosr | boris-42: do you have a momment to give me some help on db migrations? | 13:14 |
| *** adjohn has quit IRC | 13:17 | |
| *** anniec_ has joined #openstack-dev | 13:18 | |
| *** gargya has joined #openstack-dev | 13:21 | |
| *** anniec has quit IRC | 13:21 | |
| *** anniec_ is now known as anniec | 13:21 | |
| *** zoresvit has quit IRC | 13:23 | |
| *** amotoki has quit IRC | 13:28 | |
| *** johnthetubaguy has quit IRC | 13:30 | |
| *** READ10 has joined #openstack-dev | 13:34 | |
| *** flepied1 is now known as flepied | 13:35 | |
| *** CaptTofu has joined #openstack-dev | 13:37 | |
| *** amerine has joined #openstack-dev | 13:37 | |
| *** salv-orlando has quit IRC | 13:38 | |
| *** zoresvit has joined #openstack-dev | 13:38 | |
| *** salv-orlando has joined #openstack-dev | 13:39 | |
| *** afazekas has quit IRC | 13:40 | |
| *** yamahata has joined #openstack-dev | 13:41 | |
| *** nunosantos has joined #openstack-dev | 13:42 | |
| *** adjohn has joined #openstack-dev | 13:44 | |
| *** darjeeling has joined #openstack-dev | 13:45 | |
| *** adjohn has quit IRC | 13:48 | |
| *** mtreinish has joined #openstack-dev | 13:49 | |
| *** parthi has joined #openstack-dev | 13:50 | |
| *** terryh has joined #openstack-dev | 13:53 | |
| *** anteaya has joined #openstack-dev | 13:57 | |
| *** amerine has quit IRC | 13:57 | |
| *** parthi has quit IRC | 13:59 | |
| *** johnthetubaguy has joined #openstack-dev | 14:00 | |
| *** yamahata has quit IRC | 14:00 | |
| *** esheffield has joined #openstack-dev | 14:01 | |
| *** cabral has joined #openstack-dev | 14:02 | |
| *** arbrandes has joined #openstack-dev | 14:02 | |
| *** dprince has joined #openstack-dev | 14:03 | |
| *** alunduil has quit IRC | 14:04 | |
| *** henrynash has joined #openstack-dev | 14:04 | |
| *** CaptTofu has quit IRC | 14:04 | |
| ayoung | henrynash, how do you specify the parameters to setUp? | 14:07 |
| xxiao | is there a clean way to enable OFFLINE_COMPRESS=True in devstack for horizon? | 14:07 |
| henrynash | when you call the superclass setup in the child | 14:08 |
| xxiao | I did that and at run time I'm still asked to run 'python manage.py compress', but for my platform(powerpc), there is no node-less to do that | 14:08 |
| xxiao | i was thinking on run that on x86 to generate all static css/js etc then copy over, but still horizon refuses to run | 14:08 |
| *** CaptTofu has joined #openstack-dev | 14:09 | |
| *** woodspa has joined #openstack-dev | 14:09 | |
| xxiao | can horizon just pick all the pre-built css/js whenever I set OFFLINE_COMPRESS=True? | 14:10 |
| xxiao | the whole point of OFFLINE_COMPRESS=True is to avoid 'python manage.py compress' I thought... | 14:10 |
| henrynash | ayoung: when you call the superclass setup in the child (sorry, missed off your handle on first reply) | 14:11 |
| ayoung | henrynash, nope, I got it | 14:12 |
| ayoung | henrynash, are you good with my changes to the API doc for Trusts? I think i addressed all of your points. | 14:13 |
| *** adjohn has joined #openstack-dev | 14:14 | |
| henrynash | ayoung: yes, thanks,…although just not quite sure about your reply on impersonation…was your comment saying that we only change the user_id if impersonation is set, or maybe making a more general comment? | 14:15 |
| ayoung | we only change the userid if impersonation is set | 14:15 |
| ayoung | I was just explaining the rationale | 14:15 |
| *** radez_g0n3 is now known as radez | 14:16 | |
| henrynash | ayoung: Ok, agreed….(and although I know you want us to concentrate on the code), that text implies we always change the user_id | 14:17 |
| ayoung | henrynash, no, that is cool. Let me reread it... | 14:17 |
| henrynash | ayoung: other than that, +2 from me | 14:17 |
| ayoung | henrynash, yes, that needs to be fixed. I'll hit that right now | 14:18 |
| henrynash | ayoung: ok, great | 14:18 |
| *** beagles has quit IRC | 14:18 | |
| *** adjohn has quit IRC | 14:18 | |
| *** digitalsanctum has quit IRC | 14:20 | |
| ayoung | henrynash, Reposted | 14:20 |
| henrynash | ayoung: looking... | 14:21 |
| *** eharney has quit IRC | 14:21 | |
| henrynash | ayoung: ok, +2's | 14:23 |
| henrynash | +2'd | 14:23 |
| *** amerine has joined #openstack-dev | 14:23 | |
| ayoung | henrynash, now on to the code.... | 14:24 |
| henrynash | ayoung: yep….gone through some, will do more this afternoon | 14:24 |
| *** flepied has quit IRC | 14:24 | |
| henrynash | guang: you on? | 14:25 |
| ayoung | henrynash, please tell me that you are in Europe and "this afternoon" is not 3 hours away! | 14:25 |
| henrynash | ayoung: I'm in Europe! | 14:25 |
| *** eharney has joined #openstack-dev | 14:25 | |
| *** eharney has quit IRC | 14:25 | |
| *** eharney has joined #openstack-dev | 14:25 | |
| *** armaan has left #openstack-dev | 14:25 | |
| henrynash | ayoung: so already working through it…made a few comments | 14:26 |
| *** annegentle has joined #openstack-dev | 14:26 | |
| *** johnthetubaguy has quit IRC | 14:26 | |
| *** NobodyCam has joined #openstack-dev | 14:27 | |
| *** avishay has joined #openstack-dev | 14:29 | |
| *** bknudson has joined #openstack-dev | 14:29 | |
| *** cdub has quit IRC | 14:31 | |
| *** cdub has joined #openstack-dev | 14:32 | |
| *** trapnii has quit IRC | 14:32 | |
| *** ewindisch has joined #openstack-dev | 14:32 | |
| *** rkukura has joined #openstack-dev | 14:33 | |
| *** zing has joined #openstack-dev | 14:33 | |
| *** beagles has joined #openstack-dev | 14:34 | |
| *** dev_sa has joined #openstack-dev | 14:37 | |
| *** jimfehlig has joined #openstack-dev | 14:38 | |
| *** johnthetubaguy has joined #openstack-dev | 14:38 | |
| henrynash | ayoung: so are we really trying to allow authentication via the v2 api of a v3 token (the other way makes perfect sense)? | 14:39 |
| ayoung | henrynash, No, I don't think I added that in there. | 14:40 |
| *** arbrandes has quit IRC | 14:40 | |
| *** amerine has quit IRC | 14:41 | |
| henrynash | young; So in the v2 Auth controller…you are checking for trusts as part of the token being used to authenticate with…surely that can only be a v3 token? | 14:41 |
| henrynash | ..can only be from a v3 token | 14:41 |
| ayoung | henrynash, nope | 14:44 |
| ayoung | henrynash, we need trusts for v2 tokens, as people are asking for trusts now. | 14:44 |
| *** adjohn has joined #openstack-dev | 14:45 | |
| henrynash | ayoung: ah, so we are changing the v2 token api to allow you to include a trust in the auth? | 14:46 |
| ayoung | henrynash, what do you mean in your review by "Do we not also need to add in any project_id that is present (that would be in the v2 token as a tenant_id)?" | 14:46 |
| ayoung | henrynash, do you mean out of the payload? | 14:46 |
| ayoung | ah, out of the token, so policy can make an RBAC decision on it | 14:47 |
| henrynash | ayoung: well in the previous v2 code (before I messed with it), it put the tenant_id into the creds (presumably so you can match by default tenant) | 14:48 |
| ayoung | ok...yep missed that. cool | 14:48 |
| henrynash | ayoung: ok | 14:48 |
| *** adjohn has quit IRC | 14:50 | |
| ayoung | henrynash, thing is, none of our policy currently uses that | 14:50 |
| ayoung | but it should be there. | 14:50 |
| henrynash | ayoung: agreed | 14:51 |
| *** david2 has quit IRC | 14:51 | |
| flaper87 | is it possible to add a dependency to an existing review? | 14:51 |
| ayoung | flaper87, yes | 14:51 |
| *** avishay has quit IRC | 14:52 | |
| ayoung | flaper87, if you upload a new version that depends on another review, both with be uploaded/updated | 14:52 |
| ayoung | flaper87, if the dependency has not changed, then just your top level commit will be updated, and will show that it depends on the other | 14:52 |
| *** portante has quit IRC | 14:53 | |
| flaper87 | ayoung: cool, thanks | 14:54 |
| *** sandywalsh has joined #openstack-dev | 14:55 | |
| henrynash | ayoung: so on trusts & v2 tokens…are you saying we should be able to issue a v2 token based on trust from a v3 api call…or from either a v2 or v3 api call? | 14:56 |
| flaper87 | ayoung: mmh, what if the dependency was created after the review that depends on it ? | 14:59 |
| * flaper87 is missing somethign | 14:59 | |
| flaper87 | something* | 14:59 |
| ayoung | flaper87, doesn't matter. | 15:00 |
| *** arbrandes has joined #openstack-dev | 15:00 | |
| *** trapni has joined #openstack-dev | 15:00 | |
| *** trapni has joined #openstack-dev | 15:00 | |
| ayoung | henrynash, I think it is OK to create a trust with V3, and use that trust in V2. | 15:00 |
| openstackgerrit | A change was merged to openstack/ceilometer: Make sure that the period is returned as an int as the api expects an int. https://review.openstack.org/22817 | 15:00 |
| ayoung | henrynash, creating the trust and using it will happen at different times. | 15:00 |
| openstackgerrit | A change was merged to openstack/ceilometer: Imported Translations from Transifex https://review.openstack.org/22642 | 15:00 |
| henrynash | ayoung: but that means we are change the v2 auth rrequest format, no? | 15:00 |
| ayoung | henrynash, we are adding to it in a backwards compatbile way. That request is fairly well undocumented. | 15:01 |
| ayoung | henrynash, something else we need to rectify | 15:01 |
| *** alunduil has joined #openstack-dev | 15:02 | |
| openstackgerrit | A change was merged to openstack/ceilometer: Remove compat cfg wrapper https://review.openstack.org/22772 | 15:02 |
| henrynash | ayoung: Ok, hadn't twigged we were doing that. Can you point me at the spec for the v2 api? | 15:02 |
| ayoung | henrynash, there is an old one, but it has severly bit-rotted. | 15:02 |
| henrynash | ayoung: aahh, sorry, freudian slip you said undocumented! | 15:03 |
| ayoung | henrynash, so, for all intensive porposes, no | 15:03 |
| henrynash | ayoung: OK, btw, just looking again at the (new) spec for Trust API…is the auth request for the Trust authentication method right? It doesn't seem to match the format of the others | 15:04 |
| flaper87 | ayoung: perfect, thanks, worked like a charm | 15:04 |
| *** utlemming has joined #openstack-dev | 15:05 | |
| ayoung | henrynash, all it should have in it is the token id and trust id | 15:06 |
| ayoung | henrynash, line 1115? | 15:06 |
| ayoung | henrynash, it is pretty much identical to the version above it | 15:07 |
| *** annegentle has quit IRC | 15:07 | |
| henrynash | ayoung: section starting at 1006: the example uses "authentication" rather than, I assume "auth" | 15:07 |
| *** boris-42 has quit IRC | 15:07 | |
| ayoung | henrynash, BRB...got to take my wife to the train, back in 15 | 15:07 |
| *** david2 has joined #openstack-dev | 15:07 | |
| ayoung | henrynash, ah, yeah, that is true. I'll figrue oput which is right and repost | 15:08 |
| henrynash | ayoung: :-) | 15:08 |
| *** amerine has joined #openstack-dev | 15:09 | |
| *** johnthetubaguy1 has joined #openstack-dev | 15:10 | |
| *** yidclare has joined #openstack-dev | 15:12 | |
| *** maoy has joined #openstack-dev | 15:16 | |
| garyk | sdague: ping | 15:16 |
| *** nati_ueno has joined #openstack-dev | 15:18 | |
| *** eharney has quit IRC | 15:20 | |
| *** rustlebee is now known as russellb | 15:20 | |
| *** koolhead17 has quit IRC | 15:22 | |
| ayoung | henrynash, I tend to avoid abbreviations, but in this case, the abbreviation was deliberate, to avoid deciding between authentication and authorization | 15:23 |
| henrynash | ayoung: but compare the trust authentication format with the methods above (password & token)…is there a reason they don't look more similar? | 15:25 |
| ayoung | henrynash, "identity": { didn't work when I tried it. I think that the code and the api have diverged | 15:26 |
| *** sacharya has joined #openstack-dev | 15:26 | |
| ayoung | and I see no reason that 'identity' should be in there. Do you? | 15:26 |
| henrynash | ayoung: so dolph added that recently | 15:26 |
| *** nati_ueno has quit IRC | 15:27 | |
| henrynash | ayoung: it is so you can have identity and scope at that level | 15:27 |
| henrynash | with auth at the top level | 15:27 |
| henrynash | (and you can only have one thing at the top level) | 15:27 |
| *** aeperezt has joined #openstack-dev | 15:28 | |
| ayoung | henrynash, hm...the XML thing? | 15:28 |
| henrynash | ayoung: (yep)….so I'd have expected trusts to be "auth" : "methods" : "trust" | 15:28 |
| *** amerine has quit IRC | 15:29 | |
| henrynash | and have "token" and "trust" (with their respective data) at the same level as methods | 15:29 |
| *** dolphm has joined #openstack-dev | 15:29 | |
| *** diogogmt has joined #openstack-dev | 15:29 | |
| *** diogogmt has joined #openstack-dev | 15:30 | |
| ayoung | henrynash, except that a trust is not an auth method | 15:30 |
| henrynash | ayoung: ah | 15:30 |
| henrynash | ayoung: retreats | 15:30 |
| ayoung | henrynash, it might be hair-splitting, but a trust is more a modifier of a token. It doesn't provide any more confirmation of identity.... | 15:31 |
| henrynash | ayoung: about to say that…yes it's a form to token auth | 15:31 |
| henrynash | ayoung: so I guess the format should just look like the token one, with the "trust" added on? | 15:32 |
| ayoung | henrynash, that is my thought. | 15:32 |
| henrynash | ayoung: OK, yep. agreed. | 15:32 |
| ayoung | henrynash, The trust modifier could potentially be added to other auth methods in the future | 15:32 |
| *** cloudchimp has joined #openstack-dev | 15:32 | |
| *** jruzicka has quit IRC | 15:32 | |
| henrynash | ayoung: yes, true | 15:32 |
| sdague | garyk: pong | 15:33 |
| henrynash | ayoung: so, if you update the spec to that, I'm a happy bunny | 15:33 |
| *** alszar has joined #openstack-dev | 15:33 | |
| *** terryh has quit IRC | 15:33 | |
| *** alszar has quit IRC | 15:33 | |
| garyk | sdague: hi, any chance that you can look at https://review.openstack.org/#/c/22546/. i have addressed your comments. | 15:34 |
| *** alszar has joined #openstack-dev | 15:34 | |
| *** CaptTofu has quit IRC | 15:34 | |
| henrynash | ayoung: as an aside, I think I have another v2/v3 token issue | 15:34 |
| *** jaypipes has joined #openstack-dev | 15:35 | |
| ayoung | henrynash, will do....but I think that the code might be broken on the v3 token side | 15:35 |
| *** sacharya has quit IRC | 15:35 | |
| garyk | sdague: thanks! | 15:36 |
| henrynash | ayoung: updating the auth token middleware….as when I get a token from the caller, how do I know whether to validate it via a v2 or a v3 api…since the v3 api I think, assumes that any token it has stored is a v3 one | 15:36 |
| ayoung | henrynash, that is a good question. A question that needs to be asked. I am not going to answer that question. | 15:37 |
| ayoung | henrynash, but... | 15:37 |
| henrynash | ayoung: ha! :-) | 15:37 |
| ayoung | I can suggest that we do the same thing that policy does | 15:37 |
| ayoung | if 'token_data' in token_ref: | 15:37 |
| *** al-maisan is now known as almaisan-away | 15:37 | |
| henrynash | ayoung: but in the auth token middleware I only had the token Id I think? | 15:38 |
| *** zbitter is now known as zaneb | 15:38 | |
| henrynash | ayoung: I fear that the v3 token validation might need to look at the store token and then pass back that data in either v2 or v3 format | 15:39 |
| henrynash | ayoung: in the keystone server i=I mean | 15:39 |
| *** rnirmal has joined #openstack-dev | 15:39 | |
| ayoung | henrynash, no, a PKI token will have all it needs to validate without calling the server | 15:40 |
| ayoung | that is whythe darn things are so long | 15:40 |
| henrynash | ayoung: true for PKI | 15:40 |
| ayoung | henrynash, but... | 15:40 |
| ayoung | an interesting question about on line validation | 15:40 |
| henrynash | ayoung: not for regular UUID tokens…. | 15:40 |
| ayoung | the v2 API will pass iback in v2 format, the 3 in v3 format | 15:41 |
| ayoung | the data is the same. | 15:41 |
| *** digitalsanctum has joined #openstack-dev | 15:41 | |
| ayoung | But v2 knows nothing about domains.... | 15:41 |
| *** dolphm has quit IRC | 15:41 | |
| ayoung | henrynash, quesions for gyee and dolphm | 15:41 |
| henrynash | ayoungL yep, agreed…you get back to coding trusts.... | 15:41 |
| henrynash | ayoung: afk for a bit, back in 30 mins or so... | 15:43 |
| *** terryh has joined #openstack-dev | 15:43 | |
| *** zbitter has joined #openstack-dev | 15:45 | |
| *** ondergetekende has quit IRC | 15:46 | |
| *** adjohn has joined #openstack-dev | 15:46 | |
| *** bourke_ has quit IRC | 15:47 | |
| *** bourke has joined #openstack-dev | 15:48 | |
| *** kbringard has joined #openstack-dev | 15:48 | |
| *** dolphm has joined #openstack-dev | 15:48 | |
| *** CaptTofu has joined #openstack-dev | 15:48 | |
| *** jrodom has joined #openstack-dev | 15:48 | |
| *** zaneb has quit IRC | 15:49 | |
| *** dachary has joined #openstack-dev | 15:49 | |
| dachary | Hi, is there a chan devoted to the next openstack summit ? | 15:49 |
| *** mestery has quit IRC | 15:49 | |
| openstackgerrit | A change was merged to openstack/oslo-incubator: Clean up sqlalchemy exception code https://review.openstack.org/22704 | 15:50 |
| *** topol has joined #openstack-dev | 15:50 | |
| *** adjohn has quit IRC | 15:51 | |
| *** wowdd1 has joined #openstack-dev | 15:52 | |
| *** amerine has joined #openstack-dev | 15:55 | |
| *** jrodom has quit IRC | 15:55 | |
| *** eharney has joined #openstack-dev | 15:55 | |
| *** yamahata has joined #openstack-dev | 15:56 | |
| topol | henrynash, regarding my bug fix. I need to recommit the patch and swap the two comment lines, correct? | 15:56 |
| *** pcm_ has quit IRC | 15:57 | |
| *** amerine has quit IRC | 15:59 | |
| *** zoresvit has quit IRC | 16:00 | |
| *** reidrac has quit IRC | 16:01 | |
| *** david2 has quit IRC | 16:01 | |
| *** adjohn has joined #openstack-dev | 16:02 | |
| *** dachary has quit IRC | 16:02 | |
| *** Mandell has quit IRC | 16:02 | |
| *** davidha has joined #openstack-dev | 16:02 | |
| *** zoresvit has joined #openstack-dev | 16:02 | |
| *** gargya has quit IRC | 16:03 | |
| *** amerine has joined #openstack-dev | 16:03 | |
| *** koolhead17 has joined #openstack-dev | 16:03 | |
| *** wowdd1 has quit IRC | 16:04 | |
| *** crandquist has joined #openstack-dev | 16:04 | |
| *** buzztroll_ has joined #openstack-dev | 16:05 | |
| *** amerine has quit IRC | 16:07 | |
| *** zeriouz has joined #openstack-dev | 16:07 | |
| *** markmcclain has joined #openstack-dev | 16:08 | |
| openstackgerrit | A change was merged to openstack/nova: Clean unused kernels and ramdisks from image cache https://review.openstack.org/22777 | 16:09 |
| *** giroro_ has quit IRC | 16:10 | |
| *** imsplitbit has joined #openstack-dev | 16:12 | |
| *** cp16net is now known as cp16net|away | 16:12 | |
| *** zaitcev has joined #openstack-dev | 16:12 | |
| *** pcm__ has joined #openstack-dev | 16:13 | |
| ayoung | dolphm, henrynash noticed a couple things that needed to be fixed in the V3 Trust API doc. Posted the new changes. Can you take a look? I'm starting to feel the ticks of the clock.... | 16:13 |
| *** jprovazn has quit IRC | 16:14 | |
| *** zoresvit has quit IRC | 16:15 | |
| *** Ruetobas has joined #openstack-dev | 16:15 | |
| *** boris-42 has joined #openstack-dev | 16:15 | |
| *** Gordonz has joined #openstack-dev | 16:15 | |
| *** datsun180b has joined #openstack-dev | 16:16 | |
| *** cloudchimp has quit IRC | 16:17 | |
| *** Gordonz has quit IRC | 16:17 | |
| *** Gordonz has joined #openstack-dev | 16:17 | |
| *** alexxu has quit IRC | 16:19 | |
| dolphm | ayoung: i'm making changes for you and will post a diff | 16:19 |
| ayoung | dolphm, thanks | 16:20 |
| *** Ruetobas has quit IRC | 16:20 | |
| *** pabelanger has joined #openstack-dev | 16:20 | |
| dolphm | ayoung: how do you plan on enforcing the subset of endpoints? we have no infrastructure for that | 16:20 |
| ayoung | dolphm, enforcement is not on the token side anyway. | 16:21 |
| dolphm | ayoung: that's my question | 16:21 |
| ayoung | dolphm, so that is probably going to be part of an auth_token middleware patch | 16:21 |
| dolphm | ayoung: it seems like a feature that needs to be on the token first | 16:21 |
| ayoung | dolphm, agreed. | 16:21 |
| dolphm | ayoung: then what's the point of putting it in trusts now? | 16:21 |
| *** brianr_ has quit IRC | 16:21 | |
| ayoung | dolphm, I wrote it thinking we would get it in this round...back in October or so | 16:22 |
| *** otherwiseguy has joined #openstack-dev | 16:22 | |
| *** brianr_ has joined #openstack-dev | 16:22 | |
| henrynash | topol: yes, just to a git commit --amend (or equivalent) and change the comments | 16:22 |
| dolphm | ayoung: can we pull endpoints for the moment then, and then repropose in a couple weeks as v3.1? | 16:22 |
| ayoung | dolphm, definitely | 16:22 |
| dolphm | ayoung: mind if i make that change in my diff? | 16:22 |
| ayoung | dolphm, not at all | 16:22 |
| *** Ruetobas has joined #openstack-dev | 16:22 | |
| *** thouveng has quit IRC | 16:23 | |
| *** sacharya has joined #openstack-dev | 16:23 | |
| *** johnthetubaguy2 has joined #openstack-dev | 16:24 | |
| *** yidclare has quit IRC | 16:27 | |
| *** johnthetubaguy1 has quit IRC | 16:27 | |
| *** negronjl has quit IRC | 16:27 | |
| *** negronjl has joined #openstack-dev | 16:28 | |
| ayoung | dolphm, I'll go ahead and excise the endpoints stuff from the Trusts patch. | 16:28 |
| *** danwent has joined #openstack-dev | 16:28 | |
| *** mestery has joined #openstack-dev | 16:29 | |
| *** jsindy has joined #openstack-dev | 16:29 | |
| *** Ruetobas has quit IRC | 16:31 | |
| *** johnthetubaguy2 has quit IRC | 16:31 | |
| *** Ruetobas has joined #openstack-dev | 16:31 | |
| *** zoresvit has joined #openstack-dev | 16:32 | |
| *** johnthetubaguy1 has joined #openstack-dev | 16:33 | |
| ayoung | dolphm, I actually really like yanking the enpoints code. I am running the tests now. I'll post a new Trusts patch in a few minutes | 16:34 |
| *** alszar has quit IRC | 16:34 | |
| *** trapni has quit IRC | 16:35 | |
| *** dolphm has quit IRC | 16:35 | |
| *** mrodden has quit IRC | 16:36 | |
| ayoung | henrynash, removed all endpoint code from trusts. dolphm, suggested it, since we don't enforce yet. | 16:36 |
| henrynash | ayoung: ok…is is there an api update and a code update ready to look at ? | 16:37 |
| *** bdpayne has joined #openstack-dev | 16:37 | |
| *** jcmartin has joined #openstack-dev | 16:38 | |
| *** dolphm has joined #openstack-dev | 16:38 | |
| *** amerine has joined #openstack-dev | 16:40 | |
| *** mohits has joined #openstack-dev | 16:42 | |
| *** gyee has joined #openstack-dev | 16:43 | |
| *** stevemar has joined #openstack-dev | 16:43 | |
| *** splitbit has joined #openstack-dev | 16:45 | |
| ayoung | henrynash, dolphm was reworking the API. I already posted the code | 16:45 |
| henrynash | ayoung: ok | 16:46 |
| ayoung | henrynash, patch 22 should have not references to endpoints in the trust code. | 16:46 |
| ayoung | make that 23 | 16:46 |
| henrynash | ayoung: 0k :-) | 16:46 |
| dolphm | ayoung: henrynash: gyee and i also discussed "trust" becoming an attribute of "scope" during auth, as "trust" effectively changes the scope of authz that the token will receive | 16:47 |
| *** salgado is now known as salgado-lunch | 16:47 | |
| dolphm | ayoung: henrynash: it wouldn't make sense to provide a "trust" attribute (which contains a project_id) and then attempt to specify some other scope (a project or domain) in the same request | 16:47 |
| dolphm | ayoung: mind if i include that change as well? | 16:47 |
| dolphm | ayoung: henrynash: thoughts/concerns? | 16:48 |
| henrynash | dolphm: yes, I can see that argument | 16:48 |
| dolphm | gyee: ^ | 16:48 |
| dolphm | gyee: didn't realize you were on | 16:48 |
| *** doude has left #openstack-dev | 16:48 | |
| ayoung | dolphm, no, that makes perfect sense | 16:48 |
| ayoung | I like it | 16:49 |
| dolphm | ayoung: cool | 16:49 |
| *** david2 has joined #openstack-dev | 16:49 | |
| *** imsplitbit has quit IRC | 16:49 | |
| *** burris has quit IRC | 16:50 | |
| *** burris has joined #openstack-dev | 16:50 | |
| henrynash | dolphm: btw, when you have a moment, got a question on in-line validation of tokens in the v2/v3 world we our middleware will be living in….(but finish what your doing on trusts first) | 16:50 |
| *** ilblackdragon has quit IRC | 16:50 | |
| ayoung | henrynash, BTW, I was wrong | 16:50 |
| *** dontalton has joined #openstack-dev | 16:51 | |
| *** flepied has joined #openstack-dev | 16:51 | |
| ayoung | the validate API should be pulling the token out of the backend. So V2 will need to be able to look at the serialized version of a V3 token and V3 will need to look at the serialized version of a v2 token | 16:51 |
| dolphm | henrynash: inline or online? | 16:52 |
| * ayoung thinks that is a good reason to normalize the backend storage | 16:52 | |
| henrynash | ayoung: well I was looking at auth_token and what we have to do to makeit hanlde v2 and v3 tokens | 16:52 |
| dolphm | ayoung: ideally both controllers should be writing the same token format to the backend, which should be a v3 token | 16:53 |
| dolphm | ayoung: that's not the case though | 16:53 |
| *** mrodden has joined #openstack-dev | 16:53 | |
| *** beagles is now known as beagles|brb | 16:53 | |
| ayoung | dolphm, I'll have to think through that, but on first blush, it will break things. | 16:53 |
| ayoung | dolphm, it is comparable to changing the return format from the validate API call | 16:54 |
| *** jcmartin has quit IRC | 16:54 | |
| *** nati_ueno has joined #openstack-dev | 16:54 | |
| henrynash | dolphm: and came to the point if I have a token id handed to me to validate (I don't know if its a v2 or v3 token I believe), then to I call v2/token or the v3 equivalent? | 16:54 |
| ayoung | dolphm, ugh, the more I think about this...Ok, let me mull on that for a while. | 16:54 |
| henrynash | dolphm: and if I call v3 and its a v2 token, I do't think our code handles that | 16:55 |
| ayoung | If I pass a v3 token to a remote server, and it expects a v2 token, then it calls the v2 validate API, it is going to blow up right now. Best case it gets an invalid token response. | 16:55 |
| ayoung | but my guess is we'll get a 500, as the token will be pulled out of the backend, but will be missing the v2 fields that the validate code expects | 16:56 |
| *** john5223 has joined #openstack-dev | 16:57 | |
| *** pcm__ has quit IRC | 16:57 | |
| gyee | ayoung, v2 and v3 can be used interchangeably unless non default domain is involved | 16:58 |
| gyee | v2 and v3 tokens | 16:58 |
| ayoung | gyee, OK, glad to hear it. | 16:58 |
| *** amerine has quit IRC | 16:59 | |
| *** garyTh has joined #openstack-dev | 16:59 | |
| henrynash | gyee: so can I call v3.validate_token with a token id that was created as a v2 token? | 16:59 |
| ayoung | gyee, I realize I need to add the check that a token does not have "trust" in it before issuing another token for it. Is there any reason to avoid doing that in the "authenticate" method of the auth controller? | 16:59 |
| gyee | henrynash, yes | 17:00 |
| *** pcm_ has joined #openstack-dev | 17:00 | |
| henrynash | gyee:…and I'll get back the token data in v3 format, I assume? | 17:00 |
| *** dev_sa has quit IRC | 17:00 | |
| gyee | ayoung, you can do it in token factory | 17:00 |
| gyee | you get the old token data in recreate_token | 17:01 |
| gyee | henrynash, yes | 17:01 |
| *** john5223 has quit IRC | 17:02 | |
| henrynash | gyee: ok, excellent…. | 17:02 |
| *** zoresvit has quit IRC | 17:02 | |
| *** mindpixel has quit IRC | 17:02 | |
| henrynash | gyee: btw, I started working on auth_token middleware to make sure it would handle domain scoped tokens, but then of course realised there was much more to it than that? I don't want to step on your toes….where you planning to update the middleware for v3 tokens? If not, I'm happy to continue | 17:03 |
| *** dolphm has quit IRC | 17:03 | |
| *** tiamar has quit IRC | 17:03 | |
| *** garyTh has quit IRC | 17:03 | |
| *** tiamar has joined #openstack-dev | 17:04 | |
| gyee | henrynash, I am not working on middleware at the moment | 17:04 |
| *** garyTh has joined #openstack-dev | 17:04 | |
| *** boris-42 has quit IRC | 17:05 | |
| *** john5223 has joined #openstack-dev | 17:06 | |
| *** salgado-lunch is now known as salgado | 17:07 | |
| *** edmund has joined #openstack-dev | 17:09 | |
| *** nati_ueno has quit IRC | 17:10 | |
| *** jsindy has quit IRC | 17:11 | |
| henrynash | ayoung, dolphm, gyee: I just want to validate a conversation that adam and I had earlier, that we are OK with changing the auth functionality of the v2 api to include the option of trusts…..I hadn't expected that…(not saying that there aren't customers that want that…) | 17:11 |
| *** CaptTofu has quit IRC | 17:12 | |
| *** romcheg1 has joined #openstack-dev | 17:13 | |
| *** dachary has joined #openstack-dev | 17:13 | |
| *** splitbit has quit IRC | 17:14 | |
| *** dolphm has joined #openstack-dev | 17:14 | |
| henrynash | topol: if you have merged the two bug fixes into one change (nothing wrong with that)..then you should list both bug fixes in the comment. For example, see my: https://review.openstack.org/#/c/22789/ | 17:14 |
| *** splitbit has joined #openstack-dev | 17:15 | |
| dolphm | henrynash: ideally you send it to the latest api you understand -- so v3 should be able to validate v2 tokens... | 17:15 |
| *** nikhil has quit IRC | 17:15 | |
| *** romcheg1 has left #openstack-dev | 17:16 | |
| henrynash | dolphm: Ok, yes, agrre | 17:16 |
| *** markmc has quit IRC | 17:16 | |
| dolphm | henrynash: gyee wrote some v3/v2 "intermix" tests you should read in test_v3_auth | 17:16 |
| henrynash | dolphm: ok, thx | 17:16 |
| *** nikhil has joined #openstack-dev | 17:17 | |
| *** jsindy has joined #openstack-dev | 17:17 | |
| *** koolhead17 has quit IRC | 17:21 | |
| topol | Henrynash, will do | 17:23 |
| *** adjohn has quit IRC | 17:23 | |
| *** jcmartin has joined #openstack-dev | 17:25 | |
| *** amerine has joined #openstack-dev | 17:25 | |
| topol | henrynash, done. Thanks! | 17:27 |
| *** zeriouz has quit IRC | 17:27 | |
| *** ilblackdragon has joined #openstack-dev | 17:27 | |
| henrynash | topol: +2'd | 17:28 |
| *** Ryan_Lane has quit IRC | 17:28 | |
| *** Ryan_Lane has joined #openstack-dev | 17:29 | |
| *** anniec has quit IRC | 17:29 | |
| *** tomoe_ has quit IRC | 17:30 | |
| *** tomoe_ has joined #openstack-dev | 17:30 | |
| *** Ryan_Lane has quit IRC | 17:32 | |
| *** tomoe_ has quit IRC | 17:35 | |
| *** gargya has joined #openstack-dev | 17:37 | |
| henrynash | dolphm: see my earlier question on trust extensions to v2 auth api... | 17:37 |
| *** CaptTofu has joined #openstack-dev | 17:38 | |
| dolphm | henrynash: can you resend it? my wifi is going in and out | 17:38 |
| *** cp16net|away is now known as cp16net | 17:38 | |
| ayoung | gyee, If I understand correctly, the test for a trust in the token authenticate method needs to be in auth/methdos/token | 17:39 |
| henrynash | dolphm: I just want to validate a conversation that adam and I had earlier, that we are OK with changing the auth functionality of the v2 api to include the option of trusts…..I hadn't expected that…(not saying that there aren't customers that want that…) | 17:39 |
| *** esp1 has joined #openstack-dev | 17:39 | |
| gyee | ayoung, no, "trust" is outside of methods | 17:40 |
| gyee | auth/methods/token is just for validating the token | 17:40 |
| dolphm | henrynash: i'd really, really, really rather avoid it, but if we're going to do it -- it needs to be documented in identity-api and should ideally be both implemented and documented as an extension | 17:41 |
| ayoung | gyee, hmmm | 17:42 |
| gyee | ayoung, you can check for it in authenticate_for_token() | 17:43 |
| ayoung | gyee, only the methods get accessto the actual token | 17:43 |
| *** amerine has quit IRC | 17:43 | |
| ayoung | gyee, but it is an attribute of the token that is getting passed in | 17:44 |
| *** beagles|brb is now known as beagles | 17:44 | |
| ayoung | if 'trust' in token_ref['token_data']: | 17:44 |
| ayoung | raise exception.Unauthorized(msg) | 17:44 |
| gyee | if method is "token" and "scope" is "trust", then check to make sure "trust" is not already there in the requesting token | 17:44 |
| *** psedlak has quit IRC | 17:44 | |
| *** amerine has joined #openstack-dev | 17:44 | |
| *** openstackjenkins has quit IRC | 17:44 | |
| *** corXi has quit IRC | 17:45 | |
| *** openstackjenkins has joined #openstack-dev | 17:45 | |
| henrynash | dolphm, ayoung, gyee: …Adam, do you want to make the case for the extension to the v2 auth api to allow for trusts…since I think we need general agreement on that (and time is short!!)…and if it isn't agreed, there's less code for you to write! | 17:46 |
| *** john5223 has quit IRC | 17:46 | |
| *** john5223 has joined #openstack-dev | 17:46 | |
| *** gael_ has quit IRC | 17:46 | |
| *** jog0 has joined #openstack-dev | 17:47 | |
| openstackgerrit | A change was merged to openstack/nova: Imported Translations from Transifex https://review.openstack.org/22783 | 17:47 |
| ayoung | henrynash, I think we do. The code is already written, and the rest of the consumers out there are going to be consuming v2 tokens, not v3 | 17:47 |
| *** david2 has quit IRC | 17:47 | |
| gyee | are you going to rename tenant to project in v2 as well? | 17:47 |
| *** jog0 has quit IRC | 17:48 | |
| *** jog0 has joined #openstack-dev | 17:48 | |
| ayoung | gyee, I wish I could, but it breaks too much | 17:48 |
| *** Tross has quit IRC | 17:48 | |
| dolphm | ayoung: erm, i'm at the point where not much is left from your last trust api patch -- should i just take over the review so you can focus on impl, or would you rather i send you a diff? | 17:48 |
| ayoung | dolphm, take over the review. | 17:49 |
| dolphm | ayoung: definitely want you to thoroughly review the changes either way | 17:49 |
| ayoung | dolphm, will do | 17:49 |
| ayoung | dolphm, just as easy for me to use gerrit as it is for you to. | 17:49 |
| dolphm | ayoung: it wouldn't be in the spirit of gerrit for me to send you a giant diff, and then +2 it myself lol | 17:50 |
| ayoung | gyee, the thing is, only the methods call has access to the token data. ONce we are back in authenticate_for_token | 17:50 |
| ayoung | dolphm, that is OK, I can +2 the doc if you send in the patch. Distributed pair programming. | 17:50 |
| *** mohits has quit IRC | 17:51 | |
| ayoung | dolphm, and we have henrynash and gyee here. They can look at it too, | 17:51 |
| *** mohits has joined #openstack-dev | 17:51 | |
| gyee | ayoung, you uploaded a new patch already? | 17:51 |
| *** markwash has joined #openstack-dev | 17:51 | |
| ayoung | gyee, not with the test for trust in the old token I haven;'t | 17:51 |
| dolphm | ayoung: if the trustee already has a role on a project, and the trust delegates an additional role on the same project, does the trustee receive both roles in a token created based on the trust? | 17:52 |
| ayoung | dolphm, no | 17:52 |
| *** morganfainberg has quit IRC | 17:52 | |
| ayoung | only what they get from the trust | 17:52 |
| *** yidclare has joined #openstack-dev | 17:53 | |
| *** Tross has joined #openstack-dev | 17:54 | |
| *** rkukura has quit IRC | 17:54 | |
| *** fc__ has quit IRC | 17:55 | |
| *** romcheg1 has joined #openstack-dev | 17:57 | |
| *** rkukura has joined #openstack-dev | 17:57 | |
| henrynash | ayoung: on the extensions to v2…it seems a bit odd to be have different servers speaking v2.0 to have different functionality (other than bug fixes)….but if we are all Ok with adding this extension, then I can be persuaded! I guess the questions is how do we document it etc. outside of the v3 context….i.e. it is really an extension to the v2 api you get with grizzly in addition to the v3 api | 17:57 |
| *** roampune has joined #openstack-dev | 17:57 | |
| ayoung | henrynash, good question. I think the right answer is to update all of the V2 docs. | 17:57 |
| ayoung | henrynash, but that is beyond the scope of just trusts | 17:58 |
| *** anniec has joined #openstack-dev | 17:59 | |
| *** yidclare has quit IRC | 17:59 | |
| ayoung | henrynash, You won't be able to get a trust out of a Keystone server that doesn;t support the v3 api. | 17:59 |
| *** kagan has joined #openstack-dev | 17:59 | |
| ayoung | I think that should make it clear to consumers whether or not they can expect the trust attribute to work on a token | 18:00 |
| *** fc__ has joined #openstack-dev | 18:00 | |
| henrynash | ayoung: agreed | 18:00 |
| *** jgallard has quit IRC | 18:01 | |
| *** crandquist has quit IRC | 18:01 | |
| *** yidclare has joined #openstack-dev | 18:02 | |
| *** Tross has quit IRC | 18:05 | |
| *** gargya has quit IRC | 18:06 | |
| ayoung | gyee, once the Token method has returned, is the token that was fetched from the backend just discarded? | 18:08 |
| gyee | ayoung, yes | 18:08 |
| gyee | ayoung, good news is there's a auth_context dict | 18:09 |
| gyee | feel free to stash it there | 18:09 |
| ayoung | gyee, would it be OK for the method to set the 'trust ' value, but then to check for its presense outside the method? | 18:09 |
| gyee | ayoung, absolutely, add whatever information you need into the auth_context dict | 18:09 |
| ayoung | gyee, OK, I've got it. | 18:12 |
| henrynash | heading out to grab something eat…back on later | 18:12 |
| *** henrynash has quit IRC | 18:13 | |
| *** Ryan_Lane has joined #openstack-dev | 18:13 | |
| *** romcheg1 has quit IRC | 18:14 | |
| *** darraghb has quit IRC | 18:14 | |
| *** gasbakid_ has joined #openstack-dev | 18:15 | |
| *** derekh has left #openstack-dev | 18:15 | |
| *** derekh has quit IRC | 18:15 | |
| *** ek6 has quit IRC | 18:16 | |
| *** Tross has joined #openstack-dev | 18:17 | |
| *** epim has joined #openstack-dev | 18:18 | |
| *** romcheg1 has joined #openstack-dev | 18:18 | |
| *** ek6 has joined #openstack-dev | 18:19 | |
| *** jpich has quit IRC | 18:23 | |
| *** iartarisi has quit IRC | 18:23 | |
| *** dolphm has quit IRC | 18:25 | |
| *** dolphm has joined #openstack-dev | 18:27 | |
| ayoung | gyee, updated the patch with the check for trust in the token, and another unit tests to confirm | 18:27 |
| gyee | ayoung, k, I'll take a look | 18:28 |
| ayoung | gyee, just saw your comment on the V3 API | 18:29 |
| ayoung | so... | 18:29 |
| ayoung | trust goes in scope. | 18:30 |
| ayoung | OK... | 18:30 |
| *** AlanClark has joined #openstack-dev | 18:30 | |
| ayoung | Need to change that | 18:30 |
| openstackgerrit | A change was merged to openstack/nova: Readd run_tests.sh --debug option. https://review.openstack.org/22761 | 18:30 |
| *** epim has quit IRC | 18:30 | |
| YorikSar | ayoung: Hi. I'm looking at that Trusts change now. I think, there's some code that should land separately that's is not dependent on trusts. | 18:30 |
| *** garyk has quit IRC | 18:30 | |
| ayoung | YorikSar, quite likely | 18:31 |
| YorikSar | ayoung: Should I mark it there or you prefer to land it all together? | 18:31 |
| *** danpb has quit IRC | 18:31 | |
| ayoung | YorikSar, what are you thinking | 18:31 |
| *** epim has joined #openstack-dev | 18:32 | |
| YorikSar | ayoung: Code like improving policy checks or purging project membership remains. | 18:33 |
| *** romcheg1 has left #openstack-dev | 18:33 | |
| *** rafaduran has quit IRC | 18:34 | |
| ayoung | YorikSar, yeah...Ideally that would become yet another separate patch, but I am getting a little worried about getting Trusts in on time | 18:34 |
| openstackgerrit | A change was merged to openstack/oslo-incubator: Support qpid unit tests. https://review.openstack.org/22803 | 18:34 |
| ayoung | I think it is safe to go in here. | 18:34 |
| ayoung | YorikSar, the thing is, we are going to have to figure out policy in Keystone | 18:34 |
| *** anniec has quit IRC | 18:35 | |
| ayoung | and then we will need to extract that over to openstack-common anyway | 18:35 |
| *** anniec has joined #openstack-dev | 18:35 | |
| *** cloudchimp has joined #openstack-dev | 18:35 | |
| *** AlanClark has quit IRC | 18:36 | |
| *** adjohn has joined #openstack-dev | 18:36 | |
| *** AlanClark has joined #openstack-dev | 18:36 | |
| *** Mandell has joined #openstack-dev | 18:37 | |
| YorikSar | ayoung: Ok, but that's only policy. Let me stamp every change I suggest to separate. | 18:38 |
| ayoung | YorikSar, sure. I am ok with getting chunks of it carved off...Just don't want to delay the overall process. And we can't really test that policy change without the changes to what it protects without writing more unit test. | 18:39 |
| openstackgerrit | A change was merged to openstack/oslo-incubator: Update flakes.py to match 0.6.1. https://review.openstack.org/21738 | 18:40 |
| *** andrewbogott_afk is now known as andrewbogott | 18:41 | |
| *** adjohn has quit IRC | 18:41 | |
| YorikSar | ayoung: Done. | 18:44 |
| ayoung | YorikSar, looking | 18:45 |
| YorikSar | ayoung: I find it really scary to look for one small change in git blame and to find some thousand-lines commit including it. | 18:45 |
| *** adjohn has joined #openstack-dev | 18:45 | |
| *** vishious is now known as vishy | 18:46 | |
| YorikSar | ayoung: Oh, you've already pushed another patchset. | 18:46 |
| *** dolphm has quit IRC | 18:46 | |
| ayoung | YorikSar, think how scary it is when you find yourself writing that patch | 18:48 |
| *** dolphm has joined #openstack-dev | 18:48 | |
| YorikSar | ayoung: The more reason to keep it's impact on existing code at minimum | 18:49 |
| *** flepied has quit IRC | 18:49 | |
| *** cp16net is now known as cp16net|away | 18:49 | |
| *** nati_ueno has joined #openstack-dev | 18:49 | |
| ayoung | YorikSar, This one feature of mine has triggered more reworking and cleanup of the Keystone codebase than I would have thought possible | 18:50 |
| ayoung | YorikSar, I didn't even plan on getting into policy stuff. That happened last week. | 18:50 |
| YorikSar | ayoung: I can separate some parts by myself, for example SQL stuff _handle_conflict stuff. | 18:50 |
| YorikSar | ayoung: I guess, ideas tend to multiply closer the release... | 18:51 |
| ayoung | YorikSar, I'd rather deal with it myself. Let me finish up on wha | 18:51 |
| *** splitbit has quit IRC | 18:51 | |
| ayoung | t I am doing for moving trust into the scope thing, then I will look at implementing the splits you recommend | 18:51 |
| YorikSar | ayoung: Ok, I'll wait for it. | 18:52 |
| *** mrodden1 has joined #openstack-dev | 18:53 | |
| *** vyper63 has joined #openstack-dev | 18:53 | |
| *** mrodden has quit IRC | 18:54 | |
| *** armaan has joined #openstack-dev | 18:54 | |
| *** splitbit has joined #openstack-dev | 18:56 | |
| *** gasbakid_ has quit IRC | 18:58 | |
| *** mmagr has quit IRC | 18:58 | |
| *** vyper63 has quit IRC | 18:58 | |
| *** gasbakid_ has joined #openstack-dev | 18:58 | |
| *** gasbakid__ has joined #openstack-dev | 18:58 | |
| *** gasbakid_ has quit IRC | 18:59 | |
| *** gasbakid__ has quit IRC | 18:59 | |
| *** gasbakid_ has joined #openstack-dev | 19:00 | |
| *** gasbakid_ has joined #openstack-dev | 19:02 | |
| *** gyee has quit IRC | 19:03 | |
| *** morganfainberg has joined #openstack-dev | 19:05 | |
| *** andrewbogott is now known as andrewbogott_afk | 19:06 | |
| *** andrewbogott_afk is now known as andrewbogott | 19:06 | |
| *** mestery has quit IRC | 19:06 | |
| *** almaisan-away has quit IRC | 19:07 | |
| *** mrodden1 has quit IRC | 19:08 | |
| *** Tross has quit IRC | 19:09 | |
| *** mrodden has joined #openstack-dev | 19:10 | |
| *** Tross has joined #openstack-dev | 19:10 | |
| *** john5223 has quit IRC | 19:13 | |
| openstackgerrit | A change was merged to openstack/glance: Pin jsonschema version below 1.0.0. https://review.openstack.org/22862 | 19:14 |
| openstackgerrit | A change was merged to openstack/quantum: Add midonet to setup.py https://review.openstack.org/22877 | 19:14 |
| openstackgerrit | A change was merged to openstack-infra/devstack-gate: Updates for current Grenade configuration https://review.openstack.org/22448 | 19:15 |
| *** armaan has left #openstack-dev | 19:16 | |
| *** arbrandes has quit IRC | 19:16 | |
| *** melwitt has joined #openstack-dev | 19:18 | |
| *** flaper87 has quit IRC | 19:21 | |
| *** diogogmt has quit IRC | 19:22 | |
| *** diogogmt has joined #openstack-dev | 19:23 | |
| *** markmcclain has quit IRC | 19:24 | |
| *** Yada has quit IRC | 19:25 | |
| *** almaisan-away has joined #openstack-dev | 19:25 | |
| *** almaisan-away is now known as al-maisan | 19:25 | |
| dolphm | ayoung: all other authorization-changing actions in the api result in relevant tokens being revoked -- but somehow that doesn't cascade through trusts? | 19:26 |
| ayoung | dolphm, no, that happens, too | 19:26 |
| ayoung | dolphm, we revoke all trust where the user is the trustee | 19:26 |
| dolphm | ayoung: so if a trustor loses a role, the trust becomes invalid and tokens generated based on that trust should be revoked as well, correct? | 19:26 |
| ayoung | dolphm, let me check if I catch that one. | 19:27 |
| ayoung | dolphm, but I think so | 19:27 |
| *** nikhil has quit IRC | 19:27 | |
| ayoung | dolphm, that is the correct behavior | 19:27 |
| dolphm | ayoung: i'll revise the spec then -- it's not worded that way | 19:27 |
| dolphm | ayoung: thanks | 19:27 |
| ayoung | so if a user loses a role | 19:27 |
| *** nikhil has joined #openstack-dev | 19:28 | |
| ayoung | dolphm, ok, I missed that one | 19:28 |
| *** Tross has quit IRC | 19:30 | |
| dolphm | ayoung: no worries | 19:30 |
| *** AlanClark__ has joined #openstack-dev | 19:30 | |
| *** Tross has joined #openstack-dev | 19:30 | |
| *** AlanClark has quit IRC | 19:30 | |
| *** AlanClark has joined #openstack-dev | 19:31 | |
| *** kbringard has quit IRC | 19:31 | |
| *** AlanClark__ has quit IRC | 19:31 | |
| *** AlanClark has quit IRC | 19:31 | |
| openstackgerrit | A change was merged to openstack/oslo-incubator: Decode / Encode string utils for openstack https://review.openstack.org/20393 | 19:32 |
| *** AlanClark has joined #openstack-dev | 19:32 | |
| *** john5223 has joined #openstack-dev | 19:33 | |
| *** tiamar has quit IRC | 19:33 | |
| *** tiamar has joined #openstack-dev | 19:33 | |
| *** johnthetubaguy1 has quit IRC | 19:34 | |
| *** johnthetubaguy1 has joined #openstack-dev | 19:35 | |
| *** kmartin has quit IRC | 19:36 | |
| *** johnthetubaguy1 has quit IRC | 19:36 | |
| *** maroh has joined #openstack-dev | 19:38 | |
| *** vipul is now known as vipul|away | 19:40 | |
| *** vipul|away is now known as vipul | 19:40 | |
| *** eharney has quit IRC | 19:44 | |
| *** AlanClark has quit IRC | 19:44 | |
| *** eharney has joined #openstack-dev | 19:44 | |
| *** AlanClark has joined #openstack-dev | 19:44 | |
| *** yidclare has quit IRC | 19:46 | |
| openstackgerrit | A change was merged to openstack/quantum: Add password secret to brocade plugin https://review.openstack.org/22867 | 19:47 |
| *** alunduil has quit IRC | 19:47 | |
| zaitcev | chmouel: Do you know anything about Keystone hard-requiring a specific version of sqlalchemy? Sounds like a dumb fail to me. Is anyone working on fixing that? | 19:48 |
| *** kbringard has joined #openstack-dev | 19:49 | |
| *** mdomsch has joined #openstack-dev | 19:51 | |
| *** al-maisan is now known as almaisan-away | 19:51 | |
| *** aeperezt has quit IRC | 19:51 | |
| *** cloudchimp has quit IRC | 19:52 | |
| ayoung | YorikSar, dolphm split off the first piece of the Trusts review . https://review.openstack.org/22889 | 19:54 |
| *** Tross has quit IRC | 19:54 | |
| *** vipul is now known as vipul|away | 19:55 | |
| *** aeperezt has joined #openstack-dev | 19:55 | |
| *** kbrierly has joined #openstack-dev | 19:56 | |
| *** diogogmt has quit IRC | 19:58 | |
| dolphm | ayoung: can you abandon https://review.openstack.org/#/c/22063/ ? i'm writing the commit msg for the replacement | 19:58 |
| *** diogogmt has joined #openstack-dev | 19:59 | |
| *** radez is now known as radez_g0n3 | 20:00 | |
| ayoung | dolphm, hmmm...while I appreciate the editing job, shouldn't it all go into the same change ID? | 20:00 |
| *** yidclare has joined #openstack-dev | 20:00 | |
| *** mrodden has quit IRC | 20:01 | |
| dolphm | ayoung: i was going to crosslink them and give you permanent credit in the commit message :) | 20:01 |
| ayoung | dolphm, I think it is safe to use the origianal commit message. Leaves the history in one piece | 20:01 |
| ayoung | I mean, change ID | 20:02 |
| dolphm | hmm, i'll try | 20:02 |
| *** kmartin has joined #openstack-dev | 20:02 | |
| *** mrodden has joined #openstack-dev | 20:02 | |
| ayoung | dolphm, BTW, something I noticed in identity-api is that you only get a change ID once you amend a commit, for some reason | 20:03 |
| *** olaph_ has joined #openstack-dev | 20:04 | |
| dolphm | ayoung: you might not have git-review setup correctly in that project? | 20:04 |
| ayoung | YorikSar, https://review.openstack.org/#/c/22890/ | 20:04 |
| ayoung | dolphm, possible. Quite possible | 20:04 |
| dolphm | ayoung: that worked https://review.openstack.org/#/c/22063/ | 20:05 |
| ayoung | dolphm, cool. Reading now | 20:06 |
| *** vipul|away is now known as vipul | 20:06 | |
| *** mestery has joined #openstack-dev | 20:06 | |
| *** nati_ueno has quit IRC | 20:06 | |
| ayoung | dolphm, I just posted two patches which should be non-controvesial, but which are chipped off the Trusts code | 20:06 |
| *** olaph has quit IRC | 20:06 | |
| *** markmcclain has joined #openstack-dev | 20:07 | |
| ayoung | I think I have a few more to do that way, and then I'll rebase and repost the trusts code | 20:07 |
| dolphm | ayoung: lots of little changes since your last patch, but the highlights beyond what i've asked you about today: added the three calls at the very bottom of the doc, made "impersonation" attributes JSON booleans, and removed "endpoints" and "roles" from the trust entity responses | 20:07 |
| *** nati_ueno has joined #openstack-dev | 20:07 | |
| *** Gordonz has quit IRC | 20:07 | |
| dolphm | ayoung: reviewing your patches now | 20:08 |
| *** adjohn has quit IRC | 20:09 | |
| *** john5223 has quit IRC | 20:09 | |
| *** rkukura has quit IRC | 20:09 | |
| dolphm | ayoung: I +2'd the sql.Conflict change -- can you link me to the other one you split out? | 20:10 |
| ayoung | dolphm, you have a lot of places where the value true is shown in the examples. It is not quoted. Is that intentional? | 20:10 |
| ayoung | https://review.openstack.org/#/c/22889/ | 20:10 |
| *** stevebaker has quit IRC | 20:10 | |
| ayoung | dolphm, henrynash and I thrashed that one out. | 20:11 |
| *** maoy has quit IRC | 20:11 | |
| ayoung | It actually fixes v2 token used for policy as well, now that I look at it. | 20:11 |
| *** novas0x2a|laptop has quit IRC | 20:12 | |
| *** aeperezt has quit IRC | 20:12 | |
| dolphm | ayoung: "impersonation"? yes -- booleans in json are just true and false | 20:12 |
| dolphm | ayoung: unquoted and lowercase | 20:12 |
| *** notmyname has quit IRC | 20:12 | |
| *** garyk has joined #openstack-dev | 20:13 | |
| *** notmyname has joined #openstack-dev | 20:14 | |
| * ayoung needs a refresher | 20:14 | |
| ayoung | dolphm, I'm going to repost the sql one. The only other backedn that uses it is policy. Easier to fix now | 20:15 |
| *** stevebaker has joined #openstack-dev | 20:15 | |
| ayoung | dolphm, can you go back over your commit for trust-api and replace impersontation with impersonation? | 20:18 |
| ayoung | its the only thing that I've caught | 20:18 |
| dolphm | ayoung: cool | 20:19 |
| dolphm | ayoung: ha, sure | 20:19 |
| dolphm | ayoung: holy crap i made that typo a lot | 20:19 |
| ayoung | dolphm, so you are cool with using the role { name } way of creating a trust. Should I support both that and role {id} ? | 20:19 |
| dolphm | ayoung: ... and i just typed it again on accident ... | 20:20 |
| ayoung | heh\ | 20:20 |
| dolphm | ayoung: both id and name should be capable of identifying a trust | 20:20 |
| ayoung | dolphm, I mean for the role | 20:20 |
| dolphm | ayoung: err yeah, my bad | 20:21 |
| ayoung | dolphm, ok, so either role.id or role.name. if both are specified, query by id, and make sure the name matches. If it does not, error out.? | 20:21 |
| dolphm | ayoung: since we haven't done this in the api before, i'd be fine with either `role_ids` (list of strings) or `role_names` (list of strings) or `roles` (list of objects identified by id or name) ... the last one is obviously the most future-proof | 20:22 |
| dolphm | ayoung: sets us up for domain-owned roles and whatnot | 20:22 |
| *** gyee has joined #openstack-dev | 20:22 | |
| ayoung | dolphm, I had origianlly gone with role_names | 20:22 |
| dolphm | ayoung: that just presents a blocker for domain-owned roles, when we get there | 20:22 |
| *** splitbit has quit IRC | 20:23 | |
| dolphm | ayoung: and also identifying objects by url instead of id or name | 20:23 |
| ayoung | dolphm, OK. That will probably affect how I store them in the backend | 20:23 |
| ayoung | dolphm, https://review.openstack.org/#/c/22890/2 covers policy backend now, too. I assume your +2 still stands | 20:24 |
| ayoung | gyee, simple refactoring for you, prereq for trusts https://review.openstack.org/#/c/22890/2 | 20:24 |
| dolphm | ayoung: in sql.... trust_roles table: trust_id, role_id | 20:25 |
| *** eglynn has quit IRC | 20:25 | |
| dolphm | ayoung: re+2'd | 20:25 |
| gyee | ayoung, looks good | 20:26 |
| dolphm | ayoung: also fixed my speeling https://review.openstack.org/#/c/22063/ | 20:26 |
| dolphm | gyee: not sure if you were on earlier -- but we pulled endpoint-restrictions from trusts ^ | 20:26 |
| gyee | dolphm, that's fine | 20:27 |
| dolphm | gyee: we need to support that in the token first | 20:27 |
| dolphm | v3.1! | 20:27 |
| gyee | we have no endpoint scoping right now anyway | 20:27 |
| gyee | onto v3.1 | 20:27 |
| *** cp16net|away is now known as cp16net | 20:28 | |
| dolphm | gyee: ayoung: side note -- i'd like to only maintain a single api doc, so continue using the same one past today, but mark new features as like *New in version 3.1* and then we'll start a new changelog at the top of the doc | 20:28 |
| *** epim has quit IRC | 20:29 | |
| *** epim has joined #openstack-dev | 20:29 | |
| gyee | dolphm, good idea | 20:29 |
| ayoung | dolphm, Would be nice to be able to split things up into multiple docs. It will lead to fewer merge conflicts in the future, especially now that we are emphasizing API changes have to happen first. | 20:30 |
| *** jaypipes has quit IRC | 20:30 | |
| gyee | ayoung, dolphm, you guys pull our the roles too? | 20:31 |
| gyee | pull out | 20:31 |
| gyee | the examples is a bit confusing, roles are there on create trust | 20:33 |
| gyee | but missing from list trusts | 20:33 |
| *** pcm_ has quit IRC | 20:34 | |
| openstackgerrit | A change was merged to openstack/keystone: Ensure keystone unittests do not leave CONF.policyfile in bad state https://review.openstack.org/22705 | 20:34 |
| openstackgerrit | A change was merged to openstack/quantum: Limit chain name to 28 characters https://review.openstack.org/22876 | 20:34 |
| openstackgerrit | A change was merged to openstack/quantum: Latest common updates https://review.openstack.org/22883 | 20:34 |
| ayoung | dolphm, I just approved the API changes. Anything else from here out will be an additional change on top of that, and I think it is good to have a checkpoint commited | 20:35 |
| ayoung | gyee, that is intentional | 20:35 |
| ayoung | list trusts will only show the minimal amount. Roughly what you would expect if you did a list: a summary of each one | 20:36 |
| *** markmcclain has quit IRC | 20:36 | |
| ayoung | inthis case, we decided to limit it to data that is in the header record in the database, so impersonation is OK, but roles and, in the future, endpoints will not show up in the list | 20:36 |
| *** dachary has quit IRC | 20:37 | |
| *** dachary has joined #openstack-dev | 20:37 | |
| gyee | ayoung, ok, make sense | 20:38 |
| *** henrynash has joined #openstack-dev | 20:38 | |
| *** rpedde_away is now known as rpedde | 20:38 | |
| *** sandywalsh has quit IRC | 20:39 | |
| *** alunduil has joined #openstack-dev | 20:42 | |
| YorikSar | ayoung: How could handle_conflicts change appear in both 'check' and 'gate' queues in Zuul? | 20:44 |
| mdomsch | good day. Process question for folks familiar with using gerritt for blueprint patch review. Our developers are working with a 3rd party contractor to develop some code towards an openstack blueprint. Per protocol, the contractor's name will be the commit Author. They will then send the patch to one of our developers for review, who adds the non-standard (to openstack, but common elsewhere) Signed-off-by: tag in the commit | 20:46 |
| mdomsch | . The question is, can the signed-off-by person then submit the patch for review into gerritt, or must the original author do so? | 20:46 |
| *** Tross has joined #openstack-dev | 20:48 | |
| *** john5223 has joined #openstack-dev | 20:48 | |
| *** eharney has quit IRC | 20:50 | |
| *** eharney has joined #openstack-dev | 20:50 | |
| YorikSar | ayoung: Looking at https://review.openstack.org/22892 now. What exception can be expected there? | 20:51 |
| *** eglynn has joined #openstack-dev | 20:52 | |
| ayoung | YorikSar, I think, If I remember the original case, it was where the body was supposed to be JSON, but came in Empty | 20:52 |
| *** AlanClark has quit IRC | 20:52 | |
| *** AlanClark has joined #openstack-dev | 20:53 | |
| ayoung | YorikSar, but it will handle most parsing errors now with an appropriate message, so more than just JSON | 20:53 |
| YorikSar | ayoung: Isn't that already handled in previous try: block? | 20:53 |
| *** novas0x2a|laptop has joined #openstack-dev | 20:53 | |
| ayoung | params_parsed.iteritems(): | 20:53 |
| *** dhellmann has joined #openstack-dev | 20:54 | |
| ayoung | must have been in the command line parameters... | 20:54 |
| YorikSar | ayoung: I see only one possible error there - non-string key. | 20:54 |
| ayoung | YorikSar, I have to admin, I hacked around this problem so long ago, I don't remember what I did to cause it | 20:54 |
| *** jaypipes has joined #openstack-dev | 20:54 | |
| *** sandywalsh has joined #openstack-dev | 20:54 | |
| ayoung | YorikSar, that rings a bell. | 20:55 |
| YorikSar | ayoung: Oh, wait... If we pass a list in JSON, we'll get failure on .iteritems | 20:55 |
| *** nati_ueno has quit IRC | 20:55 | |
| *** edmund has quit IRC | 20:55 | |
| *** nati_ueno has joined #openstack-dev | 20:56 | |
| *** markmcclain has joined #openstack-dev | 20:56 | |
| ayoung | YorikSar, It may not be common, but I was certainly triggering it doing something like that. | 20:57 |
| YorikSar | ayoung: I think, all these cases should be explicitely handled there. 'except Exception' without plain 'raise' makes me nervous. | 20:57 |
| openstackgerrit | A change was merged to openstack/tempest: Move the console tests to the other server actions tests https://review.openstack.org/22797 | 20:57 |
| *** amotoki has joined #openstack-dev | 20:57 | |
| *** rkukura has joined #openstack-dev | 20:57 | |
| ayoung | YorikSar, yes, except that doing that at an entry point into an API server is erring on the side of caution | 20:57 |
| ayoung | better a 400 than a 500 | 20:58 |
| *** tomoe_ has joined #openstack-dev | 20:58 | |
| YorikSar | ayoung: Well, we can pass 400 to client, but we should log unexpected errors. | 20:58 |
| ayoung | YorikSar, not always | 20:58 |
| *** mlavalle has joined #openstack-dev | 20:58 | |
| ayoung | if those errors come from bad input, logging can lead to DOS attacks | 20:58 |
| ayoung | better just to drop them | 20:59 |
| *** sandywalsh has quit IRC | 20:59 | |
| gyee | dolphm, ayoung, henrynash, https://review.openstack.org/#/c/22893 | 20:59 |
| *** gasbakid_ has quit IRC | 21:00 | |
| *** alexpilotti has joined #openstack-dev | 21:00 | |
| ayoung | gyee, cool | 21:00 |
| YorikSar | ayoung: Makes sense, yes. | 21:00 |
| *** zzs has joined #openstack-dev | 21:02 | |
| *** dachary has left #openstack-dev | 21:02 | |
| YorikSar | ayoung: btw, if you ever have some time and want to watch another one fifth of LDAP backend code disappear: https://review.openstack.org/#/q/topic:ldap-cleanup,n,z | 21:04 |
| ayoung | YorikSar, those are on my radar. After trusts goes in, we can clean house | 21:04 |
| *** dprince has quit IRC | 21:05 | |
| *** woodspa has quit IRC | 21:05 | |
| *** spzala has joined #openstack-dev | 21:06 | |
| *** numero8 has joined #openstack-dev | 21:08 | |
| ayoung | henrynash, I think you might have broken policy again. | 21:12 |
| *** ek6 has quit IRC | 21:12 | |
| ayoung | henrynash, either that, or I somehow managed to undo your change when rebasing | 21:13 |
| *** mohits has quit IRC | 21:13 | |
| *** kgriffs has joined #openstack-dev | 21:14 | |
| *** sandywalsh has joined #openstack-dev | 21:14 | |
| kgriffs | guys, I'm trying to get a feel for the "preferred" way of doing configuration for OpenStack projects. Is the answer "INI files all the way down" even for configuring more complex stuff like logging? | 21:16 |
| dolphm | gyee: downvoted, largely based on the subset of test coverage -- i'm not sure my comment there makes sense, so poke me if it's confusing | 21:17 |
| kgriffs | Is anyone using JSON or even code files (.py) | 21:17 |
| ayoung | kgriffs, nope. | 21:17 |
| *** arbrandes has joined #openstack-dev | 21:17 | |
| kgriffs | ayoung: I came across this, but it uses YAML (yuck). http://www.python.org/dev/peps/pep-0391/ | 21:19 |
| kgriffs | (btw, this is for Marconi) | 21:19 |
| kgriffs | (this question) | 21:19 |
| *** adjohn has joined #openstack-dev | 21:19 | |
| *** bryansd has joined #openstack-dev | 21:22 | |
| *** arbrandes has quit IRC | 21:22 | |
| gyee | dolphm, excellent points! | 21:23 |
| gyee | dolphm, so for policies, I am thinking about special-case it for now, any objection? | 21:23 |
| dolphm | gyee: zero | 21:24 |
| dolphm | gyee: xml is a special case ;) | 21:24 |
| *** adjohn has quit IRC | 21:24 | |
| gyee | dolphm, good one! | 21:24 |
| *** melwitt has quit IRC | 21:25 | |
| *** yolanda has quit IRC | 21:27 | |
| *** johnthetubaguy1 has joined #openstack-dev | 21:28 | |
| *** Ritz has quit IRC | 21:29 | |
| ayoung | dolphm, so, the original check was: if 'is_admin' in context and not context['is_admin']: | 21:29 |
| ayoung | I threw in the part: 'is_admin' in context | 21:30 |
| *** epim_ has joined #openstack-dev | 21:30 | |
| ayoung | as it was blowing up on non-is_admin checks | 21:30 |
| ayoung | when I changed it to | 21:30 |
| ayoung | if context.get('is_admin', False): | 21:30 |
| ayoung | it fails because the token_id is 'Admin' and not something out of the database | 21:30 |
| ayoung | I am not clear on the logic myself | 21:30 |
| ayoung | Let me try it with defaulting to True instead? | 21:31 |
| ayoung | problem is I can't test it with that patch, I need the trusts patch to catch the case | 21:32 |
| *** epim has quit IRC | 21:32 | |
| *** epim_ is now known as epim | 21:32 | |
| ayoung | Nope | 21:34 |
| *** dolphm has quit IRC | 21:34 | |
| kgriffs | re logging configuration, I found this for anyone who is interested. | 21:34 |
| kgriffs | https://github.com/openstack/keystone/blob/master/etc/logging.conf.sample | 21:34 |
| kgriffs | Looks like INI+inline python snippets | 21:35 |
| *** dolphm has joined #openstack-dev | 21:36 | |
| *** yidclare has quit IRC | 21:37 | |
| iccha | anyone getting this in glance? - ImportError: No module named oslo.config | 21:38 |
| matiu | russellb, if you get a free mo' today, could you please re-hit up: https://review.openstack.org/#/c/21185/ | 21:39 |
| ayoung | iccha, you probably need to either update your .venv or your packags | 21:40 |
| ayoung | dolphm, OK, so on is_admin...that gets set on the admin APIs. See keystone/routers.py line 34 ish | 21:40 |
| openstackgerrit | A change was merged to openstack/keystone: Move handle_conflicts decorator into sql https://review.openstack.org/22890 | 21:41 |
| dolphm | ayoung: routers? that gets set in middlware | 21:41 |
| *** diogogmt has quit IRC | 21:41 | |
| ayoung | dolphm, ah.... | 21:41 |
| ayoung | still trying to see the root cause | 21:41 |
| dolphm | ayoung: admin_token middleware or something, forgot what it's called, but it only has 1 job | 21:41 |
| ayoung | ok | 21:41 |
| dolphm | ayoung: you also have to expect that middleware not being in the pipeline at all | 21:41 |
| ayoung | middleware/core.py:60: Sets 'is_admin' to true in the context, expected to be checked by | 21:42 |
| *** yidclare has joined #openstack-dev | 21:43 | |
| zykes- | Daviey: or zul ping | 21:44 |
| ayoung | dolphm, So, if is_admin is not set in the context... | 21:44 |
| ayoung | LOG.warning(_('RBAC: Bypassing authorization')) | 21:44 |
| dolphm | ayoung: that warning should apply if is_admin = True | 21:45 |
| ayoung | context['is_admin'] = (token == CONF.admin_token) | 21:45 |
| ayoung | dolphm, I don't understand what is happening. | 21:45 |
| ayoung | It is failing using the admin token | 21:46 |
| dolphm | ayoung: if the static admin token is in used, there's no user to trace back to, and therefore no roles, no rbac, so authz is essentially being bypassed | 21:46 |
| ayoung | dolphm, I get that | 21:46 |
| ayoung | I don;'t understand the logic being executed, though | 21:46 |
| dolphm | context['is_admin'] is true if the X-Auth-Token matches CONF.admin_token | 21:46 |
| ayoung | if I use an admin token, or I don't use an admin token, I should get 'is_admin' set | 21:46 |
| dolphm | ayoung: is that middleware missing in some pipelines your testing? | 21:47 |
| ayoung | dolphm, Perhpas what is going on is that this is happening on the admin port and it should be the non-admin? | 21:47 |
| ayoung | dolphm, perhaps | 21:47 |
| ayoung | dolphm, v3_tests | 21:47 |
| iccha | ayoung: its happening when i do glance-api restart | 21:48 |
| openstackgerrit | A change was merged to openstack/ceilometer: Fix count type in MongoDB https://review.openstack.org/22868 | 21:49 |
| ayoung | dolphm, so, if is_admin is not set, we need to go into the gate as well, Ok, I think my patch is wrong, and I know how to make it right.... | 21:49 |
| *** Ryan_Lane has quit IRC | 21:50 | |
| dolphm | ayoung: if is_admin is not set, normal rbac should kick in | 21:51 |
| dolphm | ayoung: it should be the same as is_admin == False | 21:51 |
| ayoung | dolphm, yeah. I can fix it by reversing the order of the blocks. | 21:51 |
| ayoung | I need to do a daycare pickup here shortly. I'll try to squeeze the patch out again before I leave. | 21:51 |
| russellb | matiu: still in feature freeze, it'll have to wait until april or so | 21:51 |
| *** Ryan_Lane has joined #openstack-dev | 21:51 | |
| matiu | ah ok | 21:52 |
| *** arbrandes has joined #openstack-dev | 21:52 | |
| matiu | I guessed that was the reason :) | 21:52 |
| matiu | thanks russellb :) | 21:52 |
| russellb | yep np | 21:52 |
| ayoung | dolphm, so if 'is_admin' in context and context['is_admin']: | 21:53 |
| ayoung | #bypass | 21:54 |
| *** vipul is now known as vipul|away | 21:54 | |
| ayoung | otherwis/ RBAC | 21:54 |
| *** adjohn has joined #openstack-dev | 21:54 | |
| *** pcm_ has joined #openstack-dev | 21:55 | |
| *** amotoki has quit IRC | 21:55 | |
| *** giulivo has quit IRC | 21:55 | |
| *** vipul|away is now known as vipul | 21:56 | |
| openstackgerrit | A change was merged to openstack/nova: Fix broken baremetal migration tests https://review.openstack.org/22894 | 21:56 |
| *** vipul is now known as vipul|away | 21:57 | |
| *** vipul|away is now known as vipul | 21:57 | |
| *** cabral has quit IRC | 21:58 | |
| *** andrewbogott is now known as andrewbogott_afk | 21:58 | |
| *** andrewbogott_afk is now known as andrewbogott | 21:59 | |
| *** maroh has quit IRC | 22:04 | |
| *** olaph_ has quit IRC | 22:04 | |
| *** numero8 has quit IRC | 22:04 | |
| *** martine_ has quit IRC | 22:05 | |
| *** olaph has joined #openstack-dev | 22:05 | |
| *** giulivo has joined #openstack-dev | 22:08 | |
| *** cdub has quit IRC | 22:08 | |
| *** cdub_ has quit IRC | 22:08 | |
| dolphm | ayoung: that sounds good | 22:09 |
| *** cdub has joined #openstack-dev | 22:09 | |
| *** cdub_ has joined #openstack-dev | 22:09 | |
| spzala | ayoung: Hi! Can I please ask a LDAP code specific question? I am trying to create query to search a 'group' to list member 'users' it has and seems like I am lost. I could query 'groups' a 'user' is member of but not other way around. | 22:10 |
| *** stevemar has quit IRC | 22:11 | |
| spzala | I have uploaded some code with current progress, so it's available for a quick look | 22:12 |
| *** vipul is now known as vipul|away | 22:12 | |
| *** eharney has quit IRC | 22:13 | |
| *** andrewbogott is now known as andrewbogott_afk | 22:14 | |
| *** torandu has quit IRC | 22:15 | |
| *** andrewbogott_afk is now known as andrewbogott | 22:15 | |
| *** torandu has joined #openstack-dev | 22:15 | |
| *** markvoelker has quit IRC | 22:16 | |
| *** alexpilotti has quit IRC | 22:16 | |
| *** bknudson has left #openstack-dev | 22:19 | |
| *** melwitt has joined #openstack-dev | 22:21 | |
| chmouel | zaitcev: about keystone and sqlalchemy i don't know, you maybe want to check with the keystone devs | 22:21 |
| zaitcev | chmouel: Do they have their own channel? | 22:22 |
| chmouel | you can ping dolphm ayoung they usually pretty responsive | 22:22 |
| dolphm | o/ | 22:22 |
| zaitcev | dolphm: do you know if anyone is working on relaxing the dependency on sqlalchemy? We ship 0.8.0 in Fedora development and Keystone blows up with it. | 22:24 |
| dolphm | zaitcev: is there a bug on the issue? | 22:24 |
| openstackgerrit | A change was merged to openstack/oslo-incubator: openstack.common.setup: fails to get version from git https://review.openstack.org/22534 | 22:25 |
| dolphm | zaitcev: i haven't tried 0.8 myself since it's still marked as a beta | 22:26 |
| zaitcev | dolphm: No bug that I know. | 22:27 |
| *** esheffield has quit IRC | 22:30 | |
| *** nati_ueno has quit IRC | 22:30 | |
| *** nati_ueno has joined #openstack-dev | 22:31 | |
| *** zing has quit IRC | 22:37 | |
| *** topol has quit IRC | 22:40 | |
| *** soody has joined #openstack-dev | 22:40 | |
| *** Tross has quit IRC | 22:43 | |
| sdague | zaitcev: the issue is that it also broke out some of the libraries separate, so I think we're frozen for grizzly on that | 22:46 |
| openstackgerrit | A change was merged to openstack/ceilometer: Allow empty dict as metaquery param for sqlalchemy. https://review.openstack.org/22669 | 22:46 |
| *** pabelanger has quit IRC | 22:48 | |
| ayoung | dolphm, OK, so I split out a couple of patches off the trusts patch, and now they are listed as dependencies. This will allow me to continue to update them, and keep the trust patch current. | 22:48 |
| dolphm | ayoung: cool | 22:48 |
| ayoung | dolphm, I would really appreciate it if you would do your ripping apart of the trusts patch now | 22:48 |
| dolphm | ayoung: i've made a couple comments | 22:49 |
| ayoung | Ok. I'll take a look | 22:49 |
| dolphm | ayoung: i'm planning on writing my own tests against it tonight to exercise it | 22:49 |
| dolphm | ayoung: make sure i understand it, etc | 22:49 |
| *** aeperezt has joined #openstack-dev | 22:50 | |
| ayoung | dolphm, sounds good. Feel free to hack on the test_v3_trusts | 22:50 |
| ayoung | Those do a lot of hand jammed JSON that could and should be cleaned up to be based on the v3_auth code. | 22:50 |
| *** soody has quit IRC | 22:50 | |
| ayoung | So lets incorporate your changes into the patch. | 22:50 |
| *** dolphm has quit IRC | 22:51 | |
| *** tomoe_ has quit IRC | 22:53 | |
| *** tomoe_ has joined #openstack-dev | 22:54 | |
| *** digitalsanctum has quit IRC | 22:55 | |
| *** brianr_ has quit IRC | 22:56 | |
| *** brianr_ has joined #openstack-dev | 22:57 | |
| *** brianr_ is now known as brianr-gone | 22:57 | |
| *** reed has joined #openstack-dev | 22:59 | |
| *** cloudchimp has joined #openstack-dev | 23:00 | |
| *** vipul|away is now known as vipul | 23:00 | |
| *** renner_ has joined #openstack-dev | 23:00 | |
| *** kbringard has quit IRC | 23:02 | |
| *** john5223 has quit IRC | 23:02 | |
| *** renner has quit IRC | 23:03 | |
| *** renner_ is now known as renner | 23:03 | |
| *** anniec has quit IRC | 23:03 | |
| *** anniec_ has joined #openstack-dev | 23:03 | |
| *** AlanClark has quit IRC | 23:04 | |
| henrynash | dolphm: your comments on https://review.openstack.org/#/c/22789/ , you really think we should support a query string which references an attribute that is not part of the object (i.e. "disabled") | 23:09 |
| *** AlanClark has joined #openstack-dev | 23:09 | |
| *** mlavalle has quit IRC | 23:09 | |
| *** digitalsanctum has joined #openstack-dev | 23:09 | |
| *** sacharya has quit IRC | 23:10 | |
| *** tomoe_ has quit IRC | 23:10 | |
| *** tomoe_ has joined #openstack-dev | 23:10 | |
| *** soody has joined #openstack-dev | 23:10 | |
| *** openstack_ has joined #openstack-dev | 23:13 | |
| *** openstack_ is now known as gordc | 23:13 | |
| *** tomoe_ has quit IRC | 23:14 | |
| *** datsun180b has quit IRC | 23:14 | |
| ayoung | Wonderful. PEP is now not letting me do the only way SqlAlchemy tests a column is NULL. | 23:14 |
| *** utlemming has quit IRC | 23:15 | |
| *** tomoe_ has joined #openstack-dev | 23:16 | |
| *** yamahata has quit IRC | 23:18 | |
| *** aeperezt has quit IRC | 23:18 | |
| *** bknudson has joined #openstack-dev | 23:18 | |
| *** utlemming has joined #openstack-dev | 23:19 | |
| *** jbr_ is now known as jbr_zzz | 23:20 | |
| *** aeperezt has joined #openstack-dev | 23:20 | |
| *** mtreinish has quit IRC | 23:20 | |
| *** gordc has quit IRC | 23:21 | |
| *** gongysh has joined #openstack-dev | 23:27 | |
| *** rnirmal has quit IRC | 23:28 | |
| *** digitalsanctum has quit IRC | 23:36 | |
| openstackgerrit | A change was merged to openstack-infra/devstack-gate: Allow external calling context to inject values. https://review.openstack.org/22673 | 23:37 |
| openstackgerrit | A change was merged to openstack/python-novaclient: Update the docstring of cloudpipe-configure command https://review.openstack.org/22775 | 23:39 |
| *** jsindy has quit IRC | 23:45 | |
| *** johnthetubaguy1 has quit IRC | 23:48 | |
| *** kgriffs has quit IRC | 23:48 | |
| *** johnthetubaguy1 has joined #openstack-dev | 23:49 | |
| *** johnthetubaguy1 has quit IRC | 23:49 | |
| *** vipul is now known as vipul|away | 23:49 | |
| *** digitalsanctum has joined #openstack-dev | 23:52 | |
| *** gyee has quit IRC | 23:52 | |
| *** nati_ueno has quit IRC | 23:57 | |
| *** nati_ueno has joined #openstack-dev | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!