Tuesday, 2017-01-31

« Monday, 2017-01-30 Index Wednesday, 2017-02-01 »
*** EricGonczer_ has joined #openstack-dns00:05
*** EricGonczer_ has quit IRC00:27
*** haplo37 has quit IRC00:32
*** haplo37 has joined #openstack-dns00:33
*** EricGonczer_ has joined #openstack-dns00:59
*** catintheroof has quit IRC01:02
*** ducttape_ has joined #openstack-dns01:22
*** mlavalle has quit IRC01:35
*** catintheroof has joined #openstack-dns01:37
*** catintheroof has quit IRC01:37
*** catintheroof has joined #openstack-dns01:37
*** ducttape_ has quit IRC02:06
*** EricGonczer_ has quit IRC02:10
*** ducttape_ has joined #openstack-dns02:33
openstackgerritTim Simmons proposed openstack/designate: Use exit code 1 for failed designate-manage pool commands  https://review.openstack.org/42697002:46
*** catintheroof has quit IRC03:09
*** catintheroof has joined #openstack-dns03:11
*** catintheroof has quit IRC03:15
*** cliles has quit IRC03:15
*** cliles has joined #openstack-dns03:22
*** ducttape_ has quit IRC03:23
*** EricGonczer_ has joined #openstack-dns03:48
*** EricGonczer_ has quit IRC03:55
*** ducttape_ has joined #openstack-dns04:13
*** ducttape_ has quit IRC04:33
*** cliles has quit IRC04:46
*** ducttape_ has joined #openstack-dns05:35
*** ducttape_ has quit IRC05:41
*** richm has joined #openstack-dns07:01
*** ducttape_ has joined #openstack-dns07:06
*** ducttape_ has quit IRC07:11
*** abalutoiu has quit IRC07:47
*** abalutoiu has joined #openstack-dns08:05
*** nkinder has joined #openstack-dns08:18
*** richm has quit IRC09:54
*** ducttape_ has joined #openstack-dns10:07
*** ducttape_ has quit IRC10:12
*** richm has joined #openstack-dns10:38
*** nkinder has quit IRC10:59
*** ducttape_ has joined #openstack-dns11:38
*** ducttape_ has quit IRC11:43
*** leitan has joined #openstack-dns12:01
*** catintheroof has joined #openstack-dns12:22
*** nkinder has joined #openstack-dns12:30
*** EricGonczer_ has joined #openstack-dns13:02
*** ducttape_ has joined #openstack-dns13:06
*** EricGonczer_ has quit IRC13:07
*** EricGonc_ has joined #openstack-dns13:07
*** ducttape_ has quit IRC13:28
*** nkinder has quit IRC13:35
*** catinthe_ has joined #openstack-dns13:36
*** catintheroof has quit IRC13:40
*** brensen has joined #openstack-dns13:43
brensenanyone here played with the designate policy file? I'm trying to create a role which can only change a record, but so far it looks like the user still has rights to do more than just that13:45
brensenrunning mitaka still :(13:45
brensenI've tried to create this rule: "admin_or_owner_or_easyssl" : "rule:admin or rule:owner or rule:easyssl",13:48
brensenand apply to: "update_record" : "rule:admin_or_owner_or_easyssl",13:48
*** EricGonc_ has quit IRC13:48
*** EricGonczer_ has joined #openstack-dns13:49
brensenbut the user with only the easyssl role in the project can still set ttl's on domains and create recordsets etc13:49
*** EricGonczer_ has quit IRC13:52
*** cleong has joined #openstack-dns13:56
mugsiebrensen: we used to have a quite detailed policy file in HP Cloud13:57
mugsiecan you link your file?13:57
*** nkinder has joined #openstack-dns13:58
brensenhttps://thepasteb.in/p/GZhpcQwA3RR7qCX14:00
brensenwe push this thing with puppet so the sorting is a bit weird :p14:00
brensenopenstack role assignment list --user easyssl_user --project easyssl_project --names14:04
brensen+---------+--------------+-----------------+14:04
brensen| Role    | User         | Project         |14:04
brensen+---------+--------------+-----------------+14:04
brensen| easyssl | easyssl_user | easyssl_project |14:04
brensen+---------+--------------+-----------------+14:04
mugsieah, the user is in the project?14:06
brensensee above14:07
mugsieso they are getting allowed as they are an "owner"14:07
mugsie"zone_primary_or_admin" : "('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)"14:07
mugsie"admin_or_owner" : "rule:admin or rule:owner",14:07
mugsie"owner" : "tenant:%(tenant_id)s",14:08
brensenI was trying to figure out this owner role14:08
brensenso anyone with any role in the project is considered an owner?14:08
mugsieit checks the tenant_id of the user, and sees if it matched the tenant id of the zone14:08
mugsieby default, yeah14:08
brensenhmmm14:08
mugsieso, you should create a second role14:08
mugsiedns_writer or something14:08
mugsieand create a admin_or_writer rule14:09
mugsieand then replace the references to admin_or_owner with admin_or_writer14:10
brensenI think I get it, thanks... I was really confused about the "owner" thing because it was pointing to tenant_id14:10
mugsieyeah14:10
mugsiethe policy engine is weird14:11
brensenthanks for your help!14:11
mugsieno problem14:11
mugsietimsim: https://review.openstack.org/#/c/408262/ frees up the newton gate14:26
*** ducttape_ has joined #openstack-dns14:27
*** mlavalle has joined #openstack-dns14:29
*** ducttape_ has quit IRC14:31
openstackgerritGraham Hayes proposed openstack/designate: RRTYPE list in API  https://review.openstack.org/33774414:54
*** tdink has joined #openstack-dns15:00
carthaca_Hi, designate worker target setup stopped working and I don't have a clue why - in dev everything is fine http://paste.openstack.org/show/597038/, but I simply see no error or configuration differences in our prod. Maybe anyone here can point me where to look please? We are on newton15:00
*** EricGonczer_ has joined #openstack-dns15:03
*** richm has quit IRC15:04
mugsiecarthaca_: is the config in kolla the same as the hand edited one?15:07
carthaca_the worker section is the same15:08
mugsieis the pool setup the same?15:10
mugsiethat is what is failing I think15:10
*** nkinder has quit IRC15:13
carthaca_order naming etc are mixed up, but in general it should be the same15:14
carthaca_I will check in detail once more :slightly_smiling_face:15:14
timsimYeah check the backend type names, and maybe peek at your pools table.15:17
timsimNeed some more logging in there.15:17
mugsie++15:18
carthaca_yeah, I'm already directly comparing on db level - but after a while one is getting blind15:19
timsimTrust me, it's still better than how the configuration used to be :x15:19
mugsieyeah15:19
mugsieoh, the bad old days15:19
mugsieI blame Kiall :D15:20
timsimYeah, he's not here to defend himself, all Kiall's fault.15:20
openstackgerritMerged openstack/designate-specs: Update documentation url  https://review.openstack.org/40839315:20
mugsiewriting nested, related ini files like http://replygif.net/i/1136.gif15:21
*** richm has joined #openstack-dns15:21
*** nkinder has joined #openstack-dns15:21
*** richm has quit IRC15:39
*** richm has joined #openstack-dns15:41
*** catinthe_ has quit IRC15:45
timsimmugsie: can you get Kiall to +A this: https://review.openstack.org/#/c/426970/15:48
brensenI still can't get it to work.... :( I'm trying to simplify it a bit now by only allowing designate calls for 3 roles but it still allows my easyssl user to update a zone15:48
brensen   "tenant" : "tenant:%(tenant_id)s",15:48
brensen   "member" : "role:_member_",15:48
brensen   "designate" : "role:designate",15:48
brensen   "cloud_admin" : "role:admin",15:48
brensen   "admin": "rule:designate or rule:member or rule:cloud_admin",15:48
brensen   "zone_primary_or_admin" : "('PRIMARY':%(zone_type)s and rule:admin) OR ('SECONDARY':%(zone_type)s and rule:cloud_admin)",15:48
brensen   "default" : "rule:admin",15:48
brensen   "target" : "tenant:%(target_tenant_id)s",15:48
brensen   "update_zone" : "rule:admin",15:48
brensen   "find_zones" : "rule:admin",15:49
brensen   "get_zones" : "rule:admin",15:49
brensenhead of the policy file15:49
mugsietimsim: he did already :D15:49
mugsiebrensen: humm :/15:50
brensendoes this look good?15:50
mugsieok, I am standing up a new stack anyway right now15:50
mugsieyeah15:50
mugsielet do a bit of tweaking15:50
brensenok, glad I'm not stupid15:50
mugsie:)15:51
timsimwoah, read my mind from like 7000 miles awawy15:51
brensenfull file: https://thepasteb.in/p/r0h0cy9p15XJXCZ15:51
brensenstill on mitaka btw15:52
brensennot sure if that matters15:52
mugsiebrensen: you restarted designate-api and designate-central right?15:52
brensenoh damn, does central also need a kick?15:52
mugsieit should be the same - we havent made changes to the policy engine in years15:52
mugsieyeah15:52
brensendoh!15:52
brensenlet me try15:52
brensenkicking15:53
brensenopenstack zone list15:53
brensenforbidden15:53
brensenyay!15:53
brensenwell now I DO feel stupid :facepalm"15:53
mugsieheh - don't15:54
brensenI thought the api would take care of the policies15:54
mugsieno, api is a thin shim that just does light validation15:54
mugsieand passes it to central, where the business logic is15:54
brensennice to at least end the day with success! ty all15:55
mugsiethat is what I call a good day :)15:55
*** richm has quit IRC15:58
*** ducttape_ has joined #openstack-dns16:03
*** richm has joined #openstack-dns16:10
*** richm has quit IRC16:10
openstackgerritGraham Hayes proposed openstack/designate: Allow for zones / pools with no attributes  https://review.openstack.org/42727216:12
*** richm has joined #openstack-dns16:13
*** richm has quit IRC16:14
*** tdink has quit IRC16:14
*** tdink has joined #openstack-dns16:14
*** ducttape_ has quit IRC16:19
*** nkinder has quit IRC16:19
*** ducttape_ has joined #openstack-dns16:19
*** richm has joined #openstack-dns16:20
*** tdink_ has joined #openstack-dns16:24
*** tdink has quit IRC16:24
*** nkinder has joined #openstack-dns16:25
*** _ducttape_ has joined #openstack-dns16:29
*** richm has left #openstack-dns16:31
*** richm has joined #openstack-dns16:31
*** ducttape_ has quit IRC16:32
*** _ducttape_ has quit IRC16:40
*** ducttape_ has joined #openstack-dns16:41
openstackgerritMerged openstack/designate: Use exit code 1 for failed designate-manage pool commands  https://review.openstack.org/42697016:44
*** _ducttape_ has joined #openstack-dns16:44
*** ratoder has joined #openstack-dns16:45
*** ducttape_ has quit IRC16:47
openstackgerritGraham Hayes proposed openstack/designate: Validate NS records on a pool during an update  https://review.openstack.org/42731717:23
mugsietimsim: there is a few patches up there now for review17:32
mugsieworking my way through things slowly17:32
* timsim looks17:32
timsim!m mugsie17:32
openstacktimsim: Error: "m" is not a valid command.17:32
*** richm has quit IRC17:42
*** _ducttape_ has quit IRC17:42
elarsonI'm convinced the openstack bot will never implement !m ;)17:44
*** nkinder has quit IRC17:46
mugsie:D17:46
* timsim wonders if pull requests are accepted17:46
timsimhttps://github.com/openstack-infra/gerritbot17:47
timsimmugsie: did you see this failed again? https://review.openstack.org/#/c/408262/17:48
mugsieah, crap, how did that job get into newtoen17:50
*** catintheroof has joined #openstack-dns17:55
mugsietimsim: https://review.openstack.org/427334 fixes that17:55
*** richm has joined #openstack-dns17:56
timsimmugsie: Should we turn worker on by default now?18:06
timsimhttps://github.com/openstack/designate/blob/master/designate/worker/__init__.py#L29-L3018:06
mugsietimsim: damn18:06
mugsieyes18:06
timsimBut we can't kill pool-manager for another cycle after that right?18:07
mugsienope18:08
mugsieoh18:08
mugsiedid we ever introduce periodic-* to worker model?18:09
timsimhttps://github.com/openstack/designate/blob/master/designate/cmd/pool_manager.py#L54-L56 lol18:09
timsimUm, not sync. Recovery, yes.18:09
timsimIt'd be pretty easy to put sync in though.18:09
mugsiewe would need sync in for the deafault switch18:10
timsimhm. I guess we could do that next cycle, and kill pool-manager, already past feature freeze now aren't we18:11
mugsielittle bit18:12
timsimmeh. Would be nice to get it done.18:13
mugsiewe can put it in, as its not a feature18:13
mugsieand ultimatly, its up to me18:13
timsimYeah really it's just a thing to send notifies to every zone.18:14
timsimShouldn't we just be setting all those to pending notify and then let that happen?18:14
timsimBecause we don't want it to do what it did in pool manager.18:14
mugsiethat could work18:14
mugsieand yeah, dropping that code would eb good18:15
*** richm has quit IRC18:18
*** ducttape_ has joined #openstack-dns18:28
*** ducttape_ has quit IRC18:33
*** ducttape_ has joined #openstack-dns18:43
openstackgerritMerged openstack/designate: change from domain to zone at configfile  https://review.openstack.org/41886118:47
*** ducttape_ has quit IRC18:49
*** ducttape_ has joined #openstack-dns19:00
*** ducttape_ has quit IRC19:00
openstackgerritGraham Hayes proposed openstack/python-designateclient: Show proper error on over quota commands  https://review.openstack.org/42735719:00
*** ducttape_ has joined #openstack-dns19:01
*** _ducttape_ has joined #openstack-dns19:02
*** ducttape_ has quit IRC19:05
*** _ducttape_ has quit IRC19:14
*** mlavalle has quit IRC19:17
*** abalutoiu has quit IRC19:29
*** pcaruana has quit IRC19:31
*** tdink has joined #openstack-dns19:34
*** tdink_ has quit IRC19:36
*** f13o_ has joined #openstack-dns19:42
*** f13o_ has quit IRC19:43
*** ducttape_ has joined #openstack-dns19:56
*** ducttape_ has quit IRC20:01
*** abalutoiu has joined #openstack-dns20:06
*** ducttape_ has joined #openstack-dns20:21
timsimmugsie: If we were going to mass set `delayed_notify` that'd be one query per zone in the system wouldn't it? Which is probably not a good idea to do on a timer every so often?20:28
mugsiein most systems - every 24 hours *should* be OK20:28
mugsiebut20:29
mugsieyeah20:29
mugsiewhat does the current one do?20:29
timsimlol. Tries to get all the zones via one big query over RPC from pool_mgr -> central (which times out when that gets big), and then blasts through them one at a time.20:31
timsimWe can make that process better, but still not ideal by instructing the worker to send notifies to a whole shard, so it'd just blast the queue with notify events for every zone in the shard, but it'd just be one database query per shard. If you're sharding nicely, it wouldn't be so bad, but I'm sure most people won't.20:34
mugsieyeah20:34
mugsiewell, depending on how many workers, it should shard itself OK20:35
mugsiebut we would need to tell people to have multiple workers20:35
*** mlavalle has joined #openstack-dns20:37
timsimI think that actually happens based on how you shard the producers.20:37
mugsieoh, thats right20:37
mugsiewe don thave any repeat tasks on workers - they are dumb20:37
timsimyeah20:37
timsimIt sucks we can't just do a `update zones set delayed_notify=1 where status!='DELETED';`20:39
timsimI guess that could tie things up if there were a lot of zones anyway maybe.20:39
timsimI guess I could have the worker do something gross like divide the number of zones by the sync interval/100 with a min step size of 500 zones and issue the notifies in bunches. I'm not a huge fan of a task that could sit there and run for 24 hours though20:45
*** tdink has quit IRC20:48
*** tdink has joined #openstack-dns20:49
*** leitan has quit IRC20:53
*** _ducttape_ has joined #openstack-dns20:54
*** leitan has joined #openstack-dns20:54
*** ducttape_ has quit IRC20:57
*** leitan has quit IRC21:00
*** kentb1 has joined #openstack-dns21:04
*** tdink has quit IRC21:30
*** tdink has joined #openstack-dns21:30
*** catintheroof has quit IRC21:38
*** catintheroof has joined #openstack-dns21:38
*** catintheroof has quit IRC21:39
*** cleong has quit IRC21:44
*** _ducttape_ has quit IRC21:46
*** ducttape_ has joined #openstack-dns21:46
*** richm has joined #openstack-dns21:55
*** tdink has quit IRC22:02
*** catintheroof has joined #openstack-dns22:05
*** catintheroof has quit IRC22:05
*** catintheroof has joined #openstack-dns22:06
*** catintheroof has quit IRC22:11
*** ducttape_ has quit IRC22:14
*** kentb1 has quit IRC22:15
*** f13o has joined #openstack-dns22:17
*** nkinder has joined #openstack-dns22:23
*** richm has quit IRC22:25
*** ducttape_ has joined #openstack-dns22:31
*** f13o has quit IRC22:33
*** tdink has joined #openstack-dns22:34
*** tdink has quit IRC22:36
*** tdink has joined #openstack-dns22:36
openstackgerritGraham Hayes proposed openstack/designate-dashboard: Actually show attribute on zone info page  https://review.openstack.org/42749022:41
*** EricGonczer_ has quit IRC22:53
openstackgerritGraham Hayes proposed openstack/python-designateclient: Add attribute support to create zone cli  https://review.openstack.org/42749723:01
*** _ducttape_ has joined #openstack-dns23:03
openstackgerritGraham Hayes proposed openstack/python-designateclient: Show proper error on over quota commands  https://review.openstack.org/42735723:03
mugsietimsim: Kiall ^^^ can I get a review ?23:04
openstackgerritGraham Hayes proposed openstack/python-designateclient: Add attribute support to create zone cli  https://review.openstack.org/42749723:05
*** ducttape_ has quit IRC23:06
*** _ducttape_ has quit IRC23:29
*** ducttape_ has joined #openstack-dns23:30
*** ducttape_ has quit IRC23:35
openstackgerritGraham Hayes proposed openstack/designate: RRTYPE list in API  https://review.openstack.org/33774423:58
« Monday, 2017-01-30 Index Wednesday, 2017-02-01 »

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!