| *** shakamunyi has quit IRC | 00:05 | |
| *** diegows has quit IRC | 00:17 | |
| *** sbfox has joined #openstack-keystone | 00:21 | |
| *** ayoung_exercise has quit IRC | 00:31 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Discovery URL querying functions https://review.openstack.org/81146 | 00:43 |
|---|---|---|
| *** richm has quit IRC | 00:44 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Unversioned endpoints in service catalog https://review.openstack.org/74599 | 00:44 |
| *** amcrn has quit IRC | 00:44 | |
| *** jamielennox is now known as jamielennox|away | 00:53 | |
| *** arborism has joined #openstack-keystone | 00:53 | |
| *** derek_c has quit IRC | 00:57 | |
| *** marcoemorais has quit IRC | 01:02 | |
| *** arborism has quit IRC | 01:03 | |
| *** arborism has joined #openstack-keystone | 01:09 | |
| *** derek_c has joined #openstack-keystone | 01:11 | |
| *** ayoung has joined #openstack-keystone | 01:12 | |
| *** stevemar has quit IRC | 01:13 | |
| *** arborism has quit IRC | 01:24 | |
| *** jamielennox|away is now known as jamielennox | 01:28 | |
| *** praneshp has quit IRC | 01:40 | |
| *** arborism has joined #openstack-keystone | 01:41 | |
| *** arborism has quit IRC | 01:42 | |
| *** arborism has joined #openstack-keystone | 01:42 | |
| *** arborism has quit IRC | 01:46 | |
| *** rishi_ has joined #openstack-keystone | 01:55 | |
| rishi_ | hi | 01:56 |
| rishi_ | do u kow the technique of open stack | 01:58 |
| *** openstackgerrit has quit IRC | 02:04 | |
| *** openstackgerrit has joined #openstack-keystone | 02:05 | |
| *** rishi_ has quit IRC | 02:08 | |
| *** mberlin has joined #openstack-keystone | 02:19 | |
| *** mberlin1 has quit IRC | 02:20 | |
| *** lnxnut has joined #openstack-keystone | 02:44 | |
| *** harlowja is now known as harlowja_away | 02:50 | |
| gyee | jamielennox, thinking it through a bit, I believe passing keystoneclient object into the service clients is a better way to go | 02:53 |
| jamielennox | gyee: why/ | 02:53 |
| gyee | reason is service may need additional functionalities besides authentication | 02:54 |
| gyee | 1. catalog lookup | 02:54 |
| gyee | 2. project/user lookup etc | 02:54 |
| gyee | take event notification for example, say a service receive an event with just the ID of the affected resource | 02:56 |
| gyee | service may need to lookup the resource for additional info | 02:56 |
| jamielennox | but why wouldn't they take the session they were given and create there own keystoneclient | 02:57 |
| jamielennox | the same can be said of any of the servcies | 02:57 |
| jamielennox | the point of all of this is that once you have the session you can pass it to whatever you like and it will use the authentication correctly | 02:58 |
| gyee | they could do it that way, but why make them do addition work instead of having everything in one go | 02:58 |
| jamielennox | two things: 1 how often do they really need to do that that it makes sense to pass keystoneclient object to everything | 02:59 |
| jamielennox | 2. then every client has a dependency on keystoneclient | 02:59 |
| gyee | but isn't session already a dependency on keystoneclient? | 02:59 |
| jamielennox | only because i don't have the power in OpenStack to go and make things like new base libraries | 03:00 |
| gyee | if we make them instantiate keystoneclient individually, we go back to the same mess | 03:00 |
| jamielennox | ideally session and the basic auth plugin, basic managers etc would be common and could come out into some framework library | 03:00 |
| gyee | what's the drawback of passing keystoneclient? | 03:01 |
| gyee | other than dependency concern | 03:01 |
| jamielennox | gyee: what's the point? | 03:01 |
| jamielennox | keystone is two very seperate components | 03:01 |
| jamielennox | auth and CRUD | 03:01 |
| gyee | not sure, is OAUTH just auth, or authz negotiation? | 03:02 |
| jamielennox | the CRUD stuff in keystone is no more important than any of the other services | 03:02 |
| gyee | jamielennox, where do you think session will live, oslo? | 03:08 |
| jamielennox | i don't think oslo makes sense in the client libraries | 03:08 |
| jamielennox | but an oslo type library | 03:08 |
| *** lnxnut has quit IRC | 03:09 | |
| gyee | you thinking a separate project just for the session? | 03:10 |
| *** stevemar has joined #openstack-keystone | 03:12 | |
| ayoung | jamielennox, I was thinking of how we should rework auth_token middleware. Basically: 2 steps: first, check the policy file for the called method. If it needs a token, unpack the token. Then call the policy. We are doing it backwards now. But to keep from breaking other servers we should probably do it as a new middleware class, although it can live in the same file as ATM does at present | 03:13 |
| *** lbragstad has joined #openstack-keystone | 03:14 | |
| jamielennox | gyee: ideally not just for session | 03:14 |
| jamielennox | the base manager class | 03:14 |
| jamielennox | the base resource class | 03:14 |
| jamielennox | basic exceptions | 03:14 |
| jamielennox | all that stuff should be the same the same between clients | 03:14 |
| gyee | I see what you mean | 03:15 |
| gyee | that seem to make sense | 03:15 |
| ayoung | jamielennox, also, the middleware can then fetch the policy based on the endpoint id. | 03:16 |
| gyee | ayoung, lets make our policy API useful :) | 03:17 |
| jamielennox | ayoung: i'm interested in just starting again | 03:17 |
| ayoung | jamielennox, lets design it right. | 03:17 |
| jamielennox | i don't know if it can/should be joined with policy | 03:17 |
| ayoung | gyee, yeah...we start with a Keystone API that fetches the appropriate policy file for an endpoint, and allow that to default to the policy file for a specific service | 03:18 |
| ayoung | jamielennox, well, how else are you going to allow thorugh non-protected services? Like you need for discovery? | 03:18 |
| ayoung | We need to know when to by pass unpacking the token | 03:18 |
| morganfainberg | jamielennox, ping https://review.openstack.org/#/c/81146 is it intended that the _discover.Discover statuses be globally changeable by one instance seeing a change? | 03:19 |
| jamielennox | ayoung: i had it solved for the current auth_token | 03:19 |
| morganfainberg | jamielennox, e.g. if i instantiate that object and change the statuses... all instantations of that class see the change | 03:19 |
| jamielennox | if you are talking a complete re-design i don't know | 03:20 |
| jamielennox | morganfainberg: you're talking about the EXPERIMENTAL and whatever? | 03:20 |
| ayoung | jamielennox, I see it as a cleanup of the current implementation, that goes as far as policy enforcement. | 03:20 |
| morganfainberg | jamielennox, yep | 03:20 |
| ayoung | the way Keystone does "flatten" for example, needs to be in middleware. And keystone itself should use the same middleware that the other services do | 03:21 |
| jamielennox | morganfainberg: i don't mind really, i though it could be useful to add other terms to the deprecated list | 03:21 |
| jamielennox | morganfainberg: but honestly if that's a blocker for people i'll change it | 03:21 |
| gyee | ayoung, ++ | 03:21 |
| morganfainberg | jamielennox, any changes are global for every instantiation | 03:21 |
| morganfainberg | eg. | 03:21 |
| morganfainberg | http://pasteraw.com/k8xx7tvpzwrjinyvlkinovvngywmx0a | 03:22 |
| jamielennox | ayoung: so i agree we need to figure out something for global policy | 03:22 |
| morganfainberg | jamielennox, my concern is someone will do class(), statuses = class.CURRENT_STATUSES, statuses.append('thing') | 03:22 |
| ayoung | we can let those ideas germinate for a week or two | 03:22 |
| jamielennox | but from the stuff i was doing with pecan i can tell you that the way we do it now doesn't work | 03:22 |
| morganfainberg | and then 'thing' is valid for every instantiation current and new. | 03:22 |
| jamielennox | at least not from an enforcement at middleware point of view | 03:23 |
| ayoung | jamielennox, then lets base it on the lessons learned from Pecan. I think that is a good starting point. | 03:23 |
| jamielennox | morganfainberg: yea - i know | 03:23 |
| morganfainberg | jamielennox, not security / locking out, just accidental changes being icky | 03:23 |
| ayoung | jamielennox, we can loop back 'round when you are not in such demand | 03:23 |
| jamielennox | ayoung: so the main takeaway from pecan is at middleware time you do not know the name of the controller, the name of the method or the resource that is actually being loaded | 03:23 |
| jamielennox | all you know is the URL and the data in the request | 03:24 |
| ayoung | jamielennox, that is actually true even of what we do now. Middleware might not be the right abstraction. | 03:24 |
| *** topol has joined #openstack-keystone | 03:24 | |
| jamielennox | morganfainberg: ok i'll change that - i'd like to get that one passed soon | 03:24 |
| morganfainberg | jamielennox, thats why i'm reviewing it :) | 03:24 |
| jamielennox | morganfainberg: i'll wait for you to finish then | 03:24 |
| gyee | dinner time | 03:25 |
| jamielennox | ayoung: i like the middleware idea - i just don't think it's possible | 03:25 |
| *** gyee has quit IRC | 03:25 | |
| morganfainberg | jamielennox, so far thats the only thing i've seen | 03:25 |
| morganfainberg | jamielennox, but i'm taking my time here. | 03:25 |
| jamielennox | ayoung: you should look at the other services to, they all do RBAC differently | 03:25 |
| ayoung | jamielennox, yeah, I figured. THe question is, which of them have the reusable ideas and which are in a state of sin? | 03:25 |
| ayoung | Need to do a survey, I guess | 03:26 |
| jamielennox | ayoung: none and all | 03:26 |
| jamielennox | actually it's not like that | 03:26 |
| ayoung | You sure there is nothing we would want to reuse from them. I admit, we are probably all in a state of sin | 03:26 |
| jamielennox | it's just that most services still do admin role checking and thats it | 03:26 |
| jamielennox | ayoung: so most of them tie into a context better than we do, but if we're going to embrace pecan then i'd prefer to just do that than do better at contexts | 03:27 |
| ayoung | Does pecan have an abstraction already that matches what we do with policy? | 03:27 |
| jamielennox | but the point is off the top of my head keystone is the only service that has configurable RBAC running | 03:28 |
| jamielennox | ayoung: no, it has a SecurityController that i tried to hack for ages - but essentially it's the same thing as middleweare | 03:28 |
| jamielennox | you don't know what you're going to be calling at the time you are doing routing | 03:28 |
| ayoung | Very static? | 03:28 |
| jamielennox | ayoung: well at routing all you should know is the URL you're using | 03:29 |
| jamielennox | possibly the headers etc | 03:29 |
| jamielennox | that would be sufficient for 99% of services cause you just want a header with a token to be valid before letting people access it | 03:29 |
| *** sbfox has quit IRC | 03:30 | |
| jamielennox | but in keystone we hit the database and retrieve things and pass that out to RBAC | 03:30 |
| jamielennox | it became easier to just do that with a decorator | 03:30 |
| ayoung | jamielennox, right, and other projects have asked for that | 03:30 |
| ayoung | the decorator can live in our code. | 03:30 |
| ayoung | from keystoneclient import policy | 03:30 |
| jamielennox | so Ryan Patrello (i'm sure i mispelt that) is the Pecan author, he works for rax and he wrote the pecan for barbican conversion | 03:31 |
| jamielennox | i learnt some stuff from that | 03:31 |
| ayoung | lets hit him up at the summit, then | 03:31 |
| jamielennox | techniques i didn't try with keystone | 03:31 |
| jamielennox | ++ that's my though | 03:31 |
| jamielennox | ++ that's my thought | 03:31 |
| jamielennox | that's why i haven't fixed that patch up - there feel's like there should be a 'good' solution there but i can't quite hit it | 03:32 |
| jamielennox | that and it's really not top of my list | 03:32 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Discovery URL querying functions https://review.openstack.org/81146 | 03:33 |
| jamielennox | morganfainberg: ^^ just [] -> () | 03:33 |
| dstanek | ayoung, jamielennox: if you guys do talk to Ryan let me know | 03:33 |
| morganfainberg | jamielennox, sure that works frozenset() would have also worked | 03:33 |
| ayoung | I would like to have a coherent vision for this by the time we have the policy discussion, that is near the end of the summit | 03:34 |
| dstanek | we were chatting the other day about pecan/tulip so i'm very interested | 03:34 |
| ayoung | dstanek, yeah. I need to understand pecan a touch better so I can have an intelligent conversation about it. | 03:34 |
| jamielennox | ayoung: it's not bad - i don't know what makes it better than any of the other frameworks | 03:35 |
| jamielennox | dstanek: will do, i'd like to see how it handled async as well | 03:35 |
| dstanek | jamielennox: it doesn't right now - that was what started the conversation | 03:36 |
| ayoung | jamielennox, I would be OK with a plan to rpelace auth token middleware with straight decorator calls that happen later. | 03:36 |
| dstanek | i see movement on both sides and right now they don't meet up | 03:36 |
| jamielennox | dstanek: yea, i meant more if there were plans, but i've heard wsgi in general will have some problems with async (though i don't understand the reasons) | 03:37 |
| jamielennox | dstanek: i know we should start a new one! | 03:37 |
| jamielennox | ayoung: it can't work completely that way | 03:37 |
| jamielennox | you still need to do token decompiling etc | 03:37 |
| jamielennox | but it should probably default to passing through if the token doesn't exist | 03:38 |
| dstanek | jamielennox: Python could always us another web framework! | 03:38 |
| jamielennox | there is a setting for that which i know swift uses | 03:38 |
| jamielennox | dstanek: but this one will be different! | 03:38 |
| ayoung | jamielennox, or even just a way of indicating that a suburl should or should not require a token unpack action | 03:39 |
| jamielennox | ayoung: if there is a token it should always be unpacked and expiration etc checked | 03:39 |
| jamielennox | that is right and that should be auth_tokens job | 03:39 |
| *** praneshp has joined #openstack-keystone | 03:40 | |
| jamielennox | it just shouldn't assume that no token is wrong | 03:40 |
| jamielennox | the thing that actually says this operation requires these roles can't happen at that level | 03:40 |
| jamielennox | the advantage i see of Pecan is that it's lightweight and configurable enough that we could work our own enforcement around it | 03:41 |
| jamielennox | the last time i tried that though i got bogged down in json validation layers | 03:42 |
| jamielennox | morganfainberg: i made a mistake in that last one, would you prefer i did frozenset? | 03:43 |
| morganfainberg | jamielennox, your call. | 03:43 |
| morganfainberg | jamielennox, i like frozenset for speedier lookup | 03:44 |
| morganfainberg | jamielennox, but the datasets are small | 03:44 |
| morganfainberg | and likely wont be hit that often | 03:44 |
| morganfainberg | jamielennox, what mistake? | 03:44 |
| *** praneshp_ has joined #openstack-keystone | 03:44 | |
| jamielennox | (deprecated) != (deprecated,) | 03:44 |
| morganfainberg | ah, doh missed that | 03:44 |
| *** ayoung is now known as ayoung_ZZzz__zz_ | 03:44 | |
| jamielennox | it works cause it does str in str, but it's wrong | 03:44 |
| morganfainberg | other than that +2 | 03:44 |
| morganfainberg | right | 03:44 |
| morganfainberg | that is the other reason i use frozensets :P | 03:45 |
| morganfainberg | frozenset([]) doesn't really have the ability to be screwed up as easily | 03:45 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Discovery URL querying functions https://review.openstack.org/81146 | 03:45 |
| jamielennox | meh, as you say they're one and 2 elements - uploaded with just tuples | 03:45 |
| morganfainberg | yep | 03:45 |
| morganfainberg | both work for me in this case | 03:45 |
| morganfainberg | ok +2 that looks good to me. | 03:46 |
| morganfainberg | jamielennox, wanted to make sure i looked over everything inc. tests. | 03:46 |
| jamielennox | morganfainberg: thanks | 03:46 |
| morganfainberg | jamielennox, yeah. | 03:46 |
| morganfainberg | jamielennox, unfortunately limited time to review the last couple... weeks | 03:47 |
| morganfainberg | :( | 03:47 |
| *** praneshp has quit IRC | 03:47 | |
| *** praneshp_ is now known as praneshp | 03:47 | |
| openstackgerrit | A change was merged to openstack/keystone: Allow 'description' in V3 Regions to be optional https://review.openstack.org/78658 | 03:50 |
| *** dstanek is now known as dstanekafk | 04:27 | |
| *** chandan_kumar has joined #openstack-keystone | 04:36 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Remove the configure portion of extension docs https://review.openstack.org/89882 | 05:16 |
| *** stevemar has quit IRC | 05:22 | |
| *** amcrn has joined #openstack-keystone | 05:37 | |
| *** chandan_kumar has quit IRC | 05:47 | |
| *** chandan_kumar has joined #openstack-keystone | 06:01 | |
| *** morganfainberg is now known as morganfainberg_Z | 06:03 | |
| *** lbragstad is now known as lbragstad_ | 06:09 | |
| *** topol has quit IRC | 06:10 | |
| *** rwsu is now known as rwsu-away | 06:14 | |
| *** bvandenh has joined #openstack-keystone | 06:36 | |
| *** amcrn has quit IRC | 06:42 | |
| *** chandan_kumar has quit IRC | 06:51 | |
| *** dstanekafk is now known as dstanekafk_zzz | 06:57 | |
| *** openstackgerrit has quit IRC | 06:57 | |
| *** chandan_kumar has joined #openstack-keystone | 07:05 | |
| *** waterkinfe has joined #openstack-keystone | 07:10 | |
| *** arborism has joined #openstack-keystone | 07:12 | |
| *** arborism is now known as amcrn | 07:12 | |
| *** jamielennox is now known as jamielennox|away | 07:14 | |
| *** leseb has joined #openstack-keystone | 07:20 | |
| *** dstanekafk_zzz is now known as dstanek | 07:48 | |
| *** waterkinfe has quit IRC | 08:02 | |
| *** dstanek is now known as dstanek_zzz | 08:03 | |
| *** Manishanker has joined #openstack-keystone | 08:06 | |
| *** Ju_ has joined #openstack-keystone | 08:25 | |
| *** KurtMartin has joined #openstack-keystone | 08:25 | |
| *** ayoung_ has joined #openstack-keystone | 08:32 | |
| *** Ju_ has quit IRC | 08:33 | |
| *** dhellmann_ has joined #openstack-keystone | 08:33 | |
| *** derek_c has quit IRC | 08:33 | |
| *** bknudson1 has quit IRC | 08:34 | |
| *** afaranha has quit IRC | 08:34 | |
| *** asselin__ has quit IRC | 08:34 | |
| *** d0ugal has quit IRC | 08:34 | |
| *** dhellmann has quit IRC | 08:34 | |
| *** larsks has quit IRC | 08:34 | |
| *** dhellmann_ is now known as dhellmann | 08:34 | |
| *** ayoung_ZZzz__zz_ has quit IRC | 08:34 | |
| *** Ju has quit IRC | 08:34 | |
| *** kmartin has quit IRC | 08:34 | |
| *** larsks has joined #openstack-keystone | 08:37 | |
| *** chandan_kumar has quit IRC | 08:40 | |
| *** bknudson has joined #openstack-keystone | 08:46 | |
| *** afaranha has joined #openstack-keystone | 08:46 | |
| *** asselin__ has joined #openstack-keystone | 08:53 | |
| *** d0ugal has joined #openstack-keystone | 08:53 | |
| *** chandan_kumar has joined #openstack-keystone | 08:53 | |
| *** dstanek_zzz is now known as dstanek | 08:55 | |
| *** rwsu-away has quit IRC | 08:56 | |
| *** praneshp has quit IRC | 08:58 | |
| *** dstanek is now known as dstanek_zzz | 09:05 | |
| marekd | Hi! Is there any way to build only one documentation file with tox -e docs? I don't want to rebuild all docs every time. Tried $ tox -e docs file.rst but no luck. | 09:11 |
| *** Ju has joined #openstack-keystone | 09:33 | |
| *** dstanek_zzz is now known as dstanek | 09:48 | |
| *** dstanek is now known as dstanek_zzz | 09:58 | |
| *** asselin__ has quit IRC | 10:15 | |
| *** leseb has quit IRC | 10:22 | |
| *** leseb has joined #openstack-keystone | 10:25 | |
| *** dstanek_zzz is now known as dstanek | 10:49 | |
| *** leseb has quit IRC | 10:54 | |
| *** topol has joined #openstack-keystone | 10:58 | |
| *** dstanek is now known as dstanek_zzz | 10:59 | |
| *** leseb has joined #openstack-keystone | 11:35 | |
| *** dstanek_zzz is now known as dstanek | 11:50 | |
| *** dstanek is now known as dstanek_zzz | 12:00 | |
| *** dstanek_zzz is now known as dstanek | 12:09 | |
| *** shakamunyi has joined #openstack-keystone | 12:36 | |
| *** shakamunyi has quit IRC | 12:41 | |
| *** topol has quit IRC | 12:45 | |
| *** dstanek is now known as dstanek_zzz | 13:04 | |
| *** joesavak has joined #openstack-keystone | 13:12 | |
| *** ayoung_ is now known as ayoung | 13:12 | |
| *** lbragstad_ is now known as lbragstad | 13:15 | |
| *** dstanek_zzz is now known as dstanek | 13:28 | |
| *** rodrigods has quit IRC | 13:31 | |
| *** rodrigods has joined #openstack-keystone | 13:33 | |
| *** rodrigods has quit IRC | 13:36 | |
| *** zhiyan_ is now known as zhiyan | 13:45 | |
| *** ukalifon has joined #openstack-keystone | 13:48 | |
| *** lnxnut has joined #openstack-keystone | 13:51 | |
| *** dstanek is now known as dstanek_zzz | 13:52 | |
| *** daneyon has joined #openstack-keystone | 13:59 | |
| *** packet has joined #openstack-keystone | 14:00 | |
| *** dstanek_zzz is now known as dstanek | 14:06 | |
| lbragstad | morganfainberg_Z: bknudson quick question on modifying some of the tempest Identity code, wondering if I could get your opinions? | 14:07 |
| *** openstackgerrit has joined #openstack-keystone | 14:09 | |
| *** stevemar has joined #openstack-keystone | 14:10 | |
| lbragstad | the addition to the jsonschema validator that I pushed up found that we aren't using valid UUID format for the domain_id and project_id in the tempest identity client. https://github.com/openstack/tempest/blob/master/tempest/services/identity/v3/json/identity_client.py#L104 and https://github.com/openstack/tempest/blob/master/tempest/services/identity/v3/json/identity_client.py#L256 and https://github.com/openstack/temp | 14:10 |
| bknudson | lbragstad: you mean the domain_id, 'default' ? | 14:11 |
| lbragstad | bknudson: yep | 14:11 |
| bknudson | lbragstad: I think that's how keystone is set up by default | 14:11 |
| lbragstad | since it's not a valid UUID format, compared to uuid.uuid4().hex | 14:12 |
| lbragstad | so I should add a case to the jsonschema validator for that specifically? | 14:12 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: fixed typos found by RETF rules https://review.openstack.org/91794 | 14:12 |
| bknudson | no, jsonschema shouldn't require IDs to be uuids | 14:13 |
| lbragstad | ok | 14:13 |
| *** zhiyan is now known as zhiyan_ | 14:13 | |
| *** topol has joined #openstack-keystone | 14:13 | |
| lbragstad | bknudson: i'll respin my validator patch accordingly, thanks! | 14:18 |
| *** richm has joined #openstack-keystone | 14:22 | |
| *** david-lyle has joined #openstack-keystone | 14:28 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add detailed federation configuration docs https://review.openstack.org/89220 | 14:30 |
| *** dims is now known as swip | 14:39 | |
| *** dstanek is now known as dstanek_zzz | 14:40 | |
| dolphm | side note- as we're starting to benefit from federated scenarios, and talking about finally having separate keystone deploys talking to each other - user-defined IDs are looking much less attractive as we need the global uniqueness that UUID's provide | 14:43 |
| openstackgerrit | Marcos FermÃn Lobo proposed a change to openstack/keystone: Unimplemented get roles by group for project list https://review.openstack.org/76470 | 14:47 |
| *** amcrn has quit IRC | 14:47 | |
| *** shakamunyi has joined #openstack-keystone | 14:54 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 14:55 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 14:55 |
| *** shakamunyi has quit IRC | 14:56 | |
| *** shakayumi has joined #openstack-keystone | 14:59 | |
| *** daneyon has quit IRC | 15:01 | |
| dolphm | topol: can you follow up on this? https://review.openstack.org/#/c/84053/ | 15:02 |
| topol | dolphm, sure | 15:02 |
| *** shakayumi has quit IRC | 15:03 | |
| *** shakamunyi has joined #openstack-keystone | 15:03 | |
| *** shakamunyi has quit IRC | 15:03 | |
| topol | dolphm, looks great +1! | 15:05 |
| *** thedodd has joined #openstack-keystone | 15:08 | |
| *** amcrn has joined #openstack-keystone | 15:10 | |
| *** shakamunyi has joined #openstack-keystone | 15:18 | |
| *** kfox1111 has joined #openstack-keystone | 15:19 | |
| dolphm | topol: thanks! | 15:19 |
| * dolphm protip, if you do all the code reviews before most people wake up, then you don't have to worry about revisions while you're reviewing :D | 15:20 | |
| kfox1111 | does ldap users + sql service users with multidomain stuff make it into icehouse? | 15:21 |
| dolphm | kfox1111: "multiple identity backends" didn't land in icehouse, but you *could* accomplish that with the federation extension in icehouse, if you can deploy keystone to apache and configure mod_shib to talk to your ldap infrastructure | 15:23 |
| *** amerine has joined #openstack-keystone | 15:23 | |
| kfox1111 | darn. :( | 15:23 |
| dolphm | kfox1111: docs are still in review, but http://docs-draft.openstack.org/20/89220/12/check/gate-keystone-docs/f94cc11/doc/build/html/configure_federation.html | 15:23 |
| kfox1111 | I was just hoping to avoid pushing all the serice accounts into ldap. I guess I'll have to. | 15:24 |
| dolphm | kfox1111: i understand that! | 15:24 |
| bknudson | kfox1111: alternatively you could write your own "mod_shib" (middleware) that goes to LDAP for users | 15:24 |
| bknudson | or middlware that gets user from LDAP and sets REMOTE_USER | 15:25 |
| bknudson | I posted a WIP that just backports the rally config from master to stable-icehouse -- looks like it works | 15:26 |
| bknudson | so should we run rally on stable/icehouse? | 15:26 |
| kfox1111 | bknudson: hmm.. interesting. thanks for the tip. | 15:27 |
| dolphm | bknudson: i'm definitely not opposed; i'd be curious if the rally folks have an opinion though | 15:27 |
| kfox1111 | hmm.. so, if there is only one identity provider, how does the heat multidomain stuff actually work? | 15:27 |
| bknudson | kfox1111: I would guess the heat multidomain doesn't work with the LDAP backend. | 15:28 |
| kfox1111 | ugg. | 15:29 |
| bknudson | kfox1111: I tried starting up devstack with keystone configured for LDAP with heat yesterday and it failed... | 15:29 |
| bknudson | created a domain but then failed to list domain | 15:29 |
| dolphm | bknudson: because it didn't actually create the domain, right? | 15:31 |
| dolphm | (if so, why didn't it fail there?) | 15:32 |
| kfox1111 | my co workers are going to have a cow when I tell them we're going to have to keep using my hack to enable heat+ldap to work rather then the new multidomain stuff. :( | 15:32 |
| dolphm | heat should work with federated IdP's, as the users heat creates would be local | 15:32 |
| dolphm | (and the domains are local) | 15:33 |
| bknudson | dolphm: I thought it was odd that I was able to create a domain and the list failed... I didn't have time to look into it. | 15:34 |
| openstackgerrit | A change was merged to openstack/identity-api: Fix typos, capitalization and remove duplicated words https://review.openstack.org/91539 | 15:36 |
| *** shakayumi has joined #openstack-keystone | 15:37 | |
| *** shakamunyi has quit IRC | 15:38 | |
| kfox1111 | hmmm... so does shibboleth federation work with the dashboard/cli commands? | 15:44 |
| *** amerine_ has joined #openstack-keystone | 15:44 | |
| *** amerine has quit IRC | 15:46 | |
| *** packet has quit IRC | 15:47 | |
| *** gyee has joined #openstack-keystone | 15:48 | |
| dolphm | kfox1111: neither, yet! | 15:49 |
| dolphm | kfox1111: client work is in progress | 15:49 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: auth_token middleware hashes tokens with configurable algorithm https://review.openstack.org/80398 | 15:50 |
| *** bvandenh has quit IRC | 15:51 | |
| kfox1111 | ok. thanks. I guess for our end users then, I can't use any of it until juno then. But good to know progress is being made. | 15:51 |
| *** chandan_kumar has quit IRC | 15:55 | |
| *** bvandenh has joined #openstack-keystone | 15:56 | |
| gyee | dolphm, https://review.openstack.org/#/c/80124 | 16:00 |
| gyee | dolphm, I plan on doing the same for the other clients soon, just want to make sure we are good with the approach | 16:01 |
| *** amcrn has quit IRC | 16:02 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 16:02 |
| *** joesavak has quit IRC | 16:03 | |
| openstackgerrit | A change was merged to openstack/keystone: Check that all po/pot files are valid https://review.openstack.org/84211 | 16:03 |
| *** joesavak has joined #openstack-keystone | 16:04 | |
| *** sbfox has joined #openstack-keystone | 16:04 | |
| dolphm | gyee: nice! i'll add it to my queue for today | 16:06 |
| gyee | dolphm, thanks! | 16:10 |
| *** sbfox has quit IRC | 16:11 | |
| *** joesavak has quit IRC | 16:11 | |
| *** Manishanker has quit IRC | 16:13 | |
| *** marcoemorais has joined #openstack-keystone | 16:15 | |
| *** sbfox has joined #openstack-keystone | 16:18 | |
| *** dstanek_zzz is now known as dstanek | 16:19 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: fixed typos found by RETF rules https://review.openstack.org/91794 | 16:23 |
| *** devkulkarni has joined #openstack-keystone | 16:25 | |
| devkulkarni | Hey there — I am part of the Solum team. Recently asalkeld added trust capability in solum https://review.openstack.org/#/c/91260/6 I was wondering if someone from here can take a look at this patch? Your help in this regard would be much appreciated :) | 16:31 |
| *** rodrigods has joined #openstack-keystone | 16:38 | |
| *** rodrigods has quit IRC | 16:38 | |
| *** rodrigods has joined #openstack-keystone | 16:38 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Cleanup of openstack-common.conf and sync https://review.openstack.org/91825 | 16:42 |
| *** marekd is now known as marekd|away | 16:44 | |
| *** rodrigods has quit IRC | 16:49 | |
| *** amcrn has joined #openstack-keystone | 16:51 | |
| dolphm | on https://review.openstack.org/#/c/81980/12/keystoneclient/v3/contrib/oauth1/access_tokens.py ... | 16:52 |
| *** amcrn has quit IRC | 16:52 | |
| dolphm | stevemar: ^ shouldn't the consumer key/secret be optional if you already have a request key/secret? | 16:52 |
| *** amcrn has joined #openstack-keystone | 16:53 | |
| *** devkulkarni has quit IRC | 16:54 | |
| stevemar | dolphm, the user should still send them | 16:56 |
| *** sbfox has quit IRC | 16:56 | |
| stevemar | dolphm, we could get the from the backend, but i think, in most client libraries, it's best to make the user present those credentials? | 16:57 |
| dolphm | stevemar: does oauthlib *require* both to create a client? | 16:57 |
| dolphm | both sets | 16:57 |
| dolphm | er, pairs | 16:57 |
| stevemar | http://oauthlib.readthedocs.org/en/latest/oauth1/client.html | 16:58 |
| stevemar | dolphm, ^ | 16:58 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 16:59 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 16:59 |
| *** marcoemorais has quit IRC | 17:03 | |
| *** leseb has quit IRC | 17:04 | |
| *** marcoemorais has joined #openstack-keystone | 17:05 | |
| *** harlowja_away is now known as harlowja | 17:06 | |
| *** dims has joined #openstack-keystone | 17:13 | |
| *** dims has quit IRC | 17:13 | |
| *** swip has quit IRC | 17:15 | |
| *** dims has joined #openstack-keystone | 17:16 | |
| *** dims has quit IRC | 17:20 | |
| *** dims has joined #openstack-keystone | 17:20 | |
| openstackgerrit | A change was merged to openstack/keystone: Remove the configure portion of extension docs https://review.openstack.org/89882 | 17:21 |
| *** KurtMartin has quit IRC | 17:28 | |
| *** sbfox has joined #openstack-keystone | 17:29 | |
| *** devkulkarni has joined #openstack-keystone | 17:30 | |
| *** dims has quit IRC | 17:36 | |
| *** dims has joined #openstack-keystone | 17:36 | |
| *** morganfainberg_Z is now known as morganfainberg | 17:37 | |
| morganfainberg | dolphm, almost have everything in place to handle mod_wsgi deployment (on the way to makeing this default) checks on each patch keystone and keystoneclient | 17:45 |
| morganfainberg | wheeeee | 17:45 |
| *** ayoung has quit IRC | 17:46 | |
| *** ayoung has joined #openstack-keystone | 17:47 | |
| dolphm | morganfainberg: +++ | 17:48 |
| *** shakayumi has quit IRC | 17:52 | |
| *** praneshp has joined #openstack-keystone | 17:57 | |
| *** leseb has joined #openstack-keystone | 18:05 | |
| *** marcoemorais has quit IRC | 18:06 | |
| *** marcoemorais has joined #openstack-keystone | 18:08 | |
| *** leseb has quit IRC | 18:09 | |
| stevemar | dtroyer, responsible for magic code in keystoneclient | 18:15 |
| dolphm | dtroyer: this is from 2012, but if you can remember any fun facts, they'd be appreciated! https://review.openstack.org/#/c/3933/9/keystoneclient/v2_0/tenants.py | 18:17 |
| *** ericvw has joined #openstack-keystone | 18:19 | |
| *** amcrn has quit IRC | 18:21 | |
| dtroyer | dolphm: I have no memory of that and I suppose | 18:22 |
| dtroyer | I'm the one who commitedd it, right? | 18:22 |
| dolphm | dtroyer: fair enough! | 18:22 |
| dolphm | dtroyer: in keystoneclient afaict, you may have gotten it from another client? | 18:22 |
| *** sbfox has quit IRC | 18:23 | |
| dtroyer | my guess is though that the comment is the key, it was a defensive move against keystone-original | 18:23 |
| dtroyer | but then why is in the v2 tree? | 18:23 |
| ericvw | dolphm: I wanted to follow up on https://bugs.launchpad.net/keystone/+bug/1231488 - I am guessing I should start here: http://docs.openstack.org/developer/keystone/setup.html to get my environment setup. | 18:23 |
| dtroyer | argh... | 18:23 |
| uvirtbot | Launchpad bug 1231488 in python-keystoneclient "ldap config "user_id_attribute" is ignored" [High,Invalid] | 18:23 |
| dolphm | dtroyer: oh, i was referring to self = retval, and the reasoning behind except Exception | 18:24 |
| dolphm | dtroyer: identity v1 was rackspace's own auth, pre-openstack | 18:24 |
| dolphm | dtroyer: ensuring every attribute is set is definitely a v2-ism, where we didn't have partial updates | 18:24 |
| dtroyer | I'm not sure what exception is expected there | 18:25 |
| ayoung | dstanek, on theimports https://review.openstack.org/#/c/71181/33/keystoneclient/common/cms.py,cm is six supposed to be below zlib? | 18:25 |
| dolphm | ayoung: yes, six is a 3rd party library | 18:27 |
| dstanek | ayoung: yes, six is third party and zlib is Python stdlib | 18:27 |
| openstackgerrit | A change was merged to openstack/keystone: Fixed some typos throughout the codebase https://review.openstack.org/91575 | 18:27 |
| ayoung | Ah, thought six was considered std...good to know | 18:27 |
| dolphm | ayoung: dstanek: i didn't want to comment on it, but i'm fine with seeing that fixed in a single patch, specifically because you have to touch those lines of code anyway | 18:28 |
| dolphm | ayoung: dstanek: if it's code you don't have to touch, then it might as well be a separate patch since it'll get quick +A and can be on it's way | 18:28 |
| dolphm | (without resulting in a merge conflict with your own patch) | 18:30 |
| dstanek | dolphm: i'm OK with either - just wanted to note it in the patch so that it will eventually happen | 18:30 |
| ayoung | the double check of the revoke list? Yeah, I like his approach | 18:30 |
| ayoung | I'm actually touching that code in the comporessed patch, too, and I'll make sure I apply the same semantics. | 18:31 |
| ayoung | I'll rebase on his | 18:31 |
| bknudson | you never know what gerrit is going to look like these days | 18:33 |
| *** d0ugal has quit IRC | 18:34 | |
| *** d0ugal has joined #openstack-keystone | 18:34 | |
| *** d0ugal has quit IRC | 18:34 | |
| *** d0ugal has joined #openstack-keystone | 18:34 | |
| *** sbfox has joined #openstack-keystone | 18:34 | |
| openstackgerrit | A change was merged to openstack/keystone: Sync with oslo-incubator 28fba9c https://review.openstack.org/90604 | 18:39 |
| dolphm | dstanek: sucks that we have to explicitly flatten out all the dependencies in openstack-common.conf now :-/ | 18:44 |
| *** sbfox has quit IRC | 18:45 | |
| *** devkulkarni has left #openstack-keystone | 18:45 | |
| dstanek | dolphm: we don't have to, but there would be warnings if we don't | 18:46 |
| dolphm | dstanek: just seems unnecessary on oslo's part - but your inline comments are probably the best we can do on our side | 18:47 |
| dstanek | dolphm: but maybe that patch wont' be accepted | 18:47 |
| *** rodrigods has joined #openstack-keystone | 18:50 | |
| bknudson | if oslo is going to print out warnings for not listing their dependencies then that seems like a bug to me | 18:50 |
| dstanek | i think i mentioned it in one of my comments on the patch, but i think that every project will start getting warnings because of the change | 18:52 |
| openstackgerrit | A change was merged to openstack/keystone: Set proper DB_INIT_VERSION on db_version command https://review.openstack.org/91123 | 18:52 |
| bknudson | dstanek: I guess it would be easy enough to remove all the lines with a comment when we remove a library, then re-add the ones with warnings | 18:53 |
| dstanek | dolphm, morganfainberg: how long after those Py3 patches merging do we make the py3 job voting? | 18:53 |
| ayoung | dolphm, in the examples https://review.openstack.org/#/c/71181/33/keystoneclient/tests/client_fixtures.py,cm I have a bunch of things wiht _Z. Instead of spelling out COMPRESSED, would _PKIZ be acceptable? | 18:53 |
| bknudson | immediately | 18:53 |
| morganfainberg | dstanek, i'd agree with brant here. | 18:54 |
| dstanek | bknudson, morganfainberg: sounds good to me | 18:54 |
| morganfainberg | means we wont see regressions in the tests we're checking already | 18:54 |
| ayoung | Do we have a Py3 Eventlet? | 18:55 |
| dstanek | ayoung: nope, i don't think we ever will | 18:56 |
| ayoung | then...what Py3 patches are we discussing? | 18:56 |
| bknudson | that will make it easier to drop eventlet | 18:56 |
| bknudson | can we run keystone in apache with py3? | 18:56 |
| bknudson | or some other wsgi server | 18:57 |
| ayoung | bknudson, I think we can. I have not tested it, though | 18:57 |
| dstanek | bknudson: not yet, but that's what i was working toward | 18:58 |
| morganfainberg | dstanek, https://review.openstack.org/#/c/84052/ there is a lingering comment in there. | 18:58 |
| morganfainberg | dstanek, that isn't needed anymore. | 18:58 |
| dstanek | ayoung: my py3 patches start here: https://review.openstack.org/#/c/83565/ | 18:58 |
| morganfainberg | dstanek, +2/+A when it's removed. | 18:58 |
| *** marcoemorais has quit IRC | 18:59 | |
| dolphm | dstanek: unless there's some exceptional circumstance, i'd +2 a move to a voting job ASAP | 18:59 |
| ayoung | dstanek, so, for unit tests, we'll run paste? | 18:59 |
| morganfainberg | dolphm, my plan is similar for the mod_wsgi check, non-vote to make sure we get it working then voting as soon as it's working. | 18:59 |
| dstanek | ayoung: i haven't gotten that far yet; i was going through all the code a few modules at a time | 19:00 |
| ayoung | Youse guys are da BEST! | 19:00 |
| * ayoung goes back to compression | 19:00 | |
| dolphm | morganfainberg: what's the likelihood of something breaking the py33 job really soon, that we need to land? | 19:00 |
| dstanek | morganfainberg: fixing now | 19:00 |
| *** marcoemorais has joined #openstack-keystone | 19:00 | |
| morganfainberg | dolphm, unlikely. but it's a minor change to make it voting (we should also add to gate at the same time) | 19:01 |
| dstanek | dolphm: just got a clone of the infra config to make the change | 19:01 |
| dstanek | morganfainberg: add what to the gate? | 19:01 |
| morganfainberg | now... we are potentially adding in another layer of py33 dep changes we can't get things through gate. | 19:01 |
| dolphm | dstanek: make sure your py33 happiness patch has landed before you propose it :P | 19:02 |
| morganfainberg | dstanek, py33, if it's voting, it probably should be both gate and check | 19:02 |
| dstanek | dolphm: yep :-) | 19:02 |
| dolphm | morganfainberg: ++ one and the same | 19:02 |
| *** rodrigods has quit IRC | 19:02 | |
| dolphm | this is the lowest number of open reviews we've had in like 5 months | 19:03 |
| *** derek_c has joined #openstack-keystone | 19:03 | |
| dstanek | so if i 'git review -d' the py3 patchset will i mess with the ones already approved? as i understand it since nothing is changed they won't be updated in gerrit | 19:03 |
| morganfainberg | dstanek, use -R | 19:03 |
| dolphm | dstanek: yes, use -x | 19:03 |
| morganfainberg | doesn't rebase. | 19:03 |
| morganfainberg | or -X | 19:04 |
| morganfainberg | erm -x | 19:04 |
| dolphm | -X and -x are nearly identical | 19:04 |
| dolphm | what's -R? | 19:04 |
| bknudson | dstanek: git-review -d checks out | 19:04 |
| bknudson | -R means don't rebase | 19:04 |
| morganfainberg | oh oh was thinking submission | 19:04 |
| morganfainberg | -R is no-rebase | 19:04 |
| bknudson | -F means rebase | 19:04 |
| dolphm | oooh, i'm confused too | 19:04 |
| dolphm | dstanek: -d won't rebase anything, and won't break things that are gating, that's safe | 19:05 |
| morganfainberg | dolphm, yeah i think i'm conviused. | 19:05 |
| morganfainberg | dolphm, i also can't type atm. | 19:05 |
| dolphm | dstanek: but when you go to submit a revision to gerrit, use -R / --no-rebase to avoid rebasing what's gating | 19:05 |
| *** leseb has joined #openstack-keystone | 19:05 | |
| morganfainberg | dstanek, https://review.openstack.org/#/c/84053/9/keystone/middleware/core.py so what happens if ! req.body.is_readable ? | 19:05 |
| morganfainberg | dstanek, sorry to pull you in a ton of different directions, doing lots of reviewing today and amazingly, your patches are on the list! | 19:06 |
| dolphm | morganfainberg: return self.application | 19:06 |
| dolphm | same as before? | 19:06 |
| morganfainberg | dolphm, right, so we don't limit? | 19:06 |
| dolphm | morganfainberg: correct | 19:06 |
| dolphm | morganfainberg: i don't know what would cause an unreadable body though | 19:06 |
| morganfainberg | dolphm, is that intended. | 19:06 |
| morganfainberg | dolphm, thats why i'm wondering if this is intended | 19:07 |
| bknudson | there might not be a request body | 19:07 |
| dolphm | bknudson: wouldn't that be an empty string then? | 19:07 |
| morganfainberg | bknudson, that makes it non-readable? | 19:07 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 19:08 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 19:08 |
| dolphm | is_body_readable: http://docs.webob.org/en/1.1/modules/webob.html | 19:08 |
| morganfainberg | dolphm, was looking for that actually | 19:08 |
| morganfainberg | oh | 19:09 |
| morganfainberg | yick. | 19:09 |
| morganfainberg | https://bitbucket.org/ianb/webob/issue/6 | 19:09 |
| *** leseb has quit IRC | 19:10 | |
| morganfainberg | do we ... need a test for this? | 19:10 |
| dstanek | so i was trying to keep the logic the same and just get around the None issue | 19:12 |
| bknudson | morganfainberg: is it not covered by tests? | 19:12 |
| dstanek | i think there is a test for it already - that's how i knew it was broken | 19:12 |
| morganfainberg | dstanek, hm. | 19:12 |
| morganfainberg | dstanek, oh i see you're not checking content_length anymore. | 19:13 |
| morganfainberg | aha | 19:13 |
| morganfainberg | bknudson, it is, just didn't see it, i was looking for the wrong thing. | 19:13 |
| morganfainberg | dstanek, ok all the patches in the py33 chain look good except that one comment bit. | 19:16 |
| morganfainberg | dstanek, if you'd rather submit that comment fix as a separate patch that works for me as well | 19:16 |
| dolphm | it's one of the last in the series, right? | 19:17 |
| dstanek | dolphm: no HEAD~4 | 19:17 |
| morganfainberg | dolphm, about middle | 19:17 |
| dolphm | oh | 19:17 |
| morganfainberg | dolphm, which is why i'm ok with it as a separate patch to fix comment | 19:17 |
| dstanek | i just made the change - so i can 'git review -R' it or i can just add another patch on top | 19:17 |
| dolphm | dstanek: your call - i'm here to re-review | 19:18 |
| morganfainberg | dstanek, ^ that | 19:18 |
| morganfainberg | i mean dolphm ++ | 19:18 |
| dstanek | i'll just add another commit so that i don't disturb what is already ready to go | 19:18 |
| morganfainberg | i'll change my -1 then | 19:18 |
| morganfainberg | dstanek, ooh lots of unhappy in the gate on these. | 19:20 |
| morganfainberg | dstanek, well.. possibly transient failure | 19:20 |
| dstanek | morganfainberg: really? | 19:20 |
| morganfainberg | https://jenkins07.openstack.org/job/gate-grenade-dsvm/3093/console | 19:20 |
| *** ukalifon has quit IRC | 19:21 | |
| morganfainberg | prob just a transient. | 19:21 |
| morganfainberg | considering the failure was a tox.ini change :P | 19:21 |
| morganfainberg | dstanek, but gate is red :( boo. | 19:22 |
| *** a_hacker has joined #openstack-keystone | 19:23 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add request/access token and consumer support for keystoneclient https://review.openstack.org/81980 | 19:25 |
| dstanek | morganfainberg: the failures i've look at so are seem unrelated; things like not being able to detach volumes and timeouts | 19:27 |
| morganfainberg | dstanek, yeah. looks like transient/unrelated | 19:27 |
| a_hacker | Hey Guys, I'm getting the following error when I try to run keystone endpoint-list/user-list, etc.... | 19:28 |
| a_hacker | The resource could not be found. (HTTP 404) | 19:28 |
| a_hacker | It works with endpoint/token auth, but not username/pw | 19:28 |
| a_hacker | Here's the log output: https://gist.github.com/bmac423/71decdfc919395a0c65a | 19:29 |
| dolphm | a_hacker: does your user have the 'admin' role? | 19:29 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Compressed Signature and Validation https://review.openstack.org/71181 | 19:30 |
| morganfainberg | ayoung, that is on my list to review today. i think most my concerns were already covered by other comments though | 19:31 |
| morganfainberg | ayoung, any nits we can address separate from that main-patch | 19:31 |
| ayoung | morganfainberg, in compression? | 19:32 |
| morganfainberg | ayoung, yeah | 19:32 |
| morganfainberg | ayoung, i mean if i see any nits, i'll tag em and we can fix after that merges | 19:32 |
| ayoung | ah, ok. | 19:32 |
| morganfainberg | ayoung, don't want to block because of something trivial | 19:32 |
| a_hacker | keystone --insecure user-role-list Unknown Attribute: auth_tenant_id | 19:33 |
| ayoung | morganfainberg, we were down to nits on that one already | 19:33 |
| *** derek_c has quit IRC | 19:33 | |
| morganfainberg | ayoung, yeah like i said, i think most everything i was concerned about already got tagged by others | 19:33 |
| ayoung | morganfainberg, I might need to rebase it once the fix for the revocation list goes through. | 19:33 |
| morganfainberg | ayoung, ack | 19:33 |
| dolphm | morganfainberg: ayoung: one of ya'll could review that https://review.openstack.org/#/c/90472/ | 19:34 |
| ayoung | pretty sure I will, actually. Just wanted to get the fixes up there. | 19:34 |
| *** david-lyle has quit IRC | 19:34 | |
| ayoung | dolphm, sure. on it | 19:34 |
| dolphm | although bknudson put up another patch today that sort of addresses it as well ( bknudson- link? ) | 19:34 |
| morganfainberg | dolphm, on it | 19:34 |
| *** david-lyle has joined #openstack-keystone | 19:34 | |
| bknudson | dolphm: addresses what? | 19:35 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add request/access token and consumer support for keystoneclient https://review.openstack.org/81980 | 19:35 |
| bknudson | all these changes to auth_token are going to conflict | 19:35 |
| ayoung | dolphm, +2 | 19:35 |
| ayoung | dolphm, this one does the same logic | 19:35 |
| dolphm | bknudson: yeah, i know :( | 19:35 |
| a_hacker | dolphm : got this error: keystone --insecure --os-tenant-name=admin user-role-list Unknown Attribute: auth_tenant_id | 19:35 |
| dolphm | dstanek: is there a way we can safely test a package not being installed? munge sys.modules with a mock or something? | 19:36 |
| bknudson | there's also configurable hash algorithms -- https://review.openstack.org/#/c/80398/ | 19:36 |
| morganfainberg | ayoung, see a +2 from you, any reason not to apporve? | 19:37 |
| ayoung | PKC is going to rock. Hard | 19:37 |
| morganfainberg | the one dolph just pointed us at. | 19:37 |
| ayoung | morganfainberg, on config hash? Don't think so, was just rechecking | 19:37 |
| morganfainberg | nod. | 19:38 |
| dolphm | ayoung: i think he's referring to the uuid + revocation list check | 19:38 |
| dolphm | ayoung: pkc? | 19:38 |
| ayoung | +A on uuid | 19:38 |
| morganfainberg | dolphm, i am | 19:38 |
| ayoung | python keystone client | 19:38 |
| dolphm | ah | 19:38 |
| dolphm | gyee put up a patch for barbicanclient to utilize auth plugins... a reality check on my -1 there would be appreciated https://review.openstack.org/#/c/80124/ | 19:39 |
| dolphm | jamielennox|away: ^ | 19:39 |
| *** amerine has joined #openstack-keystone | 19:43 | |
| *** leseb has joined #openstack-keystone | 19:44 | |
| morganfainberg | dolphm, bknudson, ayoung, jamielennox|away, gyee, stevemar, dstanek, https://www.surveymonkey.com/results/SM-PLBYBKM/ <--- use of backends survey | 19:45 |
| morganfainberg | plus jaypipes who says he uses SQL | 19:45 |
| dolphm | morganfainberg: you don't think he voted too? lol | 19:46 |
| dolphm | morganfainberg: i thought pipes used templated? | 19:46 |
| morganfainberg | dolphm, he might have. | 19:46 |
| bknudson | somebody's using LDAP | 19:46 |
| morganfainberg | dolphm, hm. | 19:46 |
| *** amerine_ has quit IRC | 19:46 | |
| dolphm | bknudson: not for the service catalog! | 19:46 |
| stevemar | morganfainberg, so far no surprises | 19:47 |
| morganfainberg | dolphm, oh right, templated by his email | 19:47 |
| dolphm | 3 responses for templated out of 15 is actually surprising | 19:47 |
| dolphm | so 4 out of 16 ish | 19:47 |
| morganfainberg | dolphm, and one custom that uses templated for some and SQL for others | 19:47 |
| morganfainberg | dolphm, someone uses LDAP for catalog (custom) it looks like? | 19:48 |
| morganfainberg | dolphm, thats... interesting | 19:48 |
| dolphm | really? | 19:48 |
| dolphm | maybe they didn't read the question | 19:48 |
| morganfainberg | dolphm, i think someone is confused about identity, assignment, and catalog | 19:48 |
| morganfainberg | dolphm, yeah | 19:48 |
| bknudson | how do you even use kvs? | 19:48 |
| dolphm | "my keystone services are provided by ldap!" | 19:48 |
| dolphm | bknudson: luck? | 19:48 |
| stevemar | hope | 19:49 |
| *** leseb has quit IRC | 19:49 | |
| morganfainberg | i'll add that i didn't vote on this, but thats because we plan on going SQL but are grizzly atm | 19:49 |
| bknudson | I think this was trying to find out if we can drop the templated backend but seems it's in use. | 19:51 |
| bknudson | we still don't have the best support for it | 19:51 |
| bknudson | should probably change it to allow a v3-style format | 19:51 |
| morganfainberg | bknudson, yep | 19:51 |
| morganfainberg | bknudson, ++ | 19:51 |
| bknudson | and we've got the filtering code that I'm not sure if it supports the templated backend | 19:52 |
| morganfainberg | bknudson, my answer is it shouldn't | 19:52 |
| morganfainberg | advanced features need SQL imo | 19:52 |
| *** arborism has joined #openstack-keystone | 19:53 | |
| morganfainberg | bknudson, but template looks like it's needed for simpler deployments | 19:53 |
| *** arborism has quit IRC | 20:00 | |
| *** a_hacker has quit IRC | 20:00 | |
| *** sbfox has joined #openstack-keystone | 20:06 | |
| *** daneyon has joined #openstack-keystone | 20:07 | |
| openstackgerrit | A change was merged to openstack/keystone: Refactor service readiness notification https://review.openstack.org/90079 | 20:07 |
| *** daneyon has quit IRC | 20:09 | |
| *** daneyon has joined #openstack-keystone | 20:10 | |
| openstackgerrit | A change was merged to openstack/keystone: fixed typos found by RETF rules in RST files https://review.openstack.org/91786 | 20:13 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Regions Management https://review.openstack.org/79096 | 20:19 |
| *** amerine has quit IRC | 20:21 | |
| *** sbfox has quit IRC | 20:26 | |
| *** dims has quit IRC | 20:27 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 20:31 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: auth_token configurable check of revocations for cached https://review.openstack.org/90472 | 20:33 |
| *** harlowja is now known as harlowja_away | 20:33 | |
| *** harlowja_away is now known as harlowja | 20:37 | |
| *** derek_c has joined #openstack-keystone | 20:38 | |
| *** sbfox has joined #openstack-keystone | 20:38 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Fix docstrings in keystoneclient https://review.openstack.org/91893 | 20:40 |
| *** joesavak has joined #openstack-keystone | 20:41 | |
| *** leseb has joined #openstack-keystone | 20:42 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Example Initialization scripts https://review.openstack.org/82687 | 20:44 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: regions sample script https://review.openstack.org/91894 | 20:44 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: revocation_events script https://review.openstack.org/91895 | 20:44 |
| *** richm has quit IRC | 20:45 | |
| ayoung | stevemar, "fix docstrings" you are just submitting that to get your ATC pass to Paris, admit it. | 20:50 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 20:50 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 20:50 |
| stevemar | ayoung, nah, that's when i resort to spelling mistakes | 20:50 |
| * lbragstad punctuation for the win | 20:50 | |
| morganfainberg | ayoung, ++ | 20:58 |
| *** diegows has joined #openstack-keystone | 21:01 | |
| *** richm has joined #openstack-keystone | 21:09 | |
| *** david-lyle has quit IRC | 21:12 | |
| *** bach has joined #openstack-keystone | 21:16 | |
| *** kfox1111 has quit IRC | 21:19 | |
| *** kfox1111 has joined #openstack-keystone | 21:20 | |
| *** bach has quit IRC | 21:21 | |
| ayoung | dolphm, I take it I need to rebase 71181 again by hand....will do so later on. | 21:21 |
| stevemar | sometimes i wonder why i do things, clearly bknudson must have done them already (i'll mark https://review.openstack.org/#/c/91906/ abandoned) | 21:22 |
| bknudson | stevemar: you wouldn't have to do it if it had been merged back in Feb. | 21:23 |
| stevemar | bknudson, true true | 21:23 |
| stevemar | bknudson, did this build correctly? https://review.openstack.org/#/c/73879/3/openstack/common/apiclient/client.py | 21:23 |
| stevemar | i thought lists had to be *'ed | 21:24 |
| stevemar | a la - https://review.openstack.org/#/c/91906/1/openstack/common/apiclient/client.py | 21:24 |
| *** dims has joined #openstack-keystone | 21:24 | |
| bknudson | stevemar: uhh... I think I tried it until it built cleanly... this was back in feb. | 21:24 |
| bknudson | I'm not sure I checked if it actually looked good. | 21:25 |
| stevemar | i think it will build cleanly, but won't render as a list in a browser | 21:25 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Compressed Signature and Validation https://review.openstack.org/71181 | 21:27 |
| *** leseb has quit IRC | 21:32 | |
| *** stevemar has quit IRC | 21:32 | |
| *** d0ugal has quit IRC | 21:33 | |
| *** topol has quit IRC | 21:41 | |
| *** leseb has joined #openstack-keystone | 21:41 | |
| gyee | morganfainberg, sorry I was afk, we use sql for the endpoint templates too | 21:49 |
| morganfainberg | gyee, yeah. figured as much | 21:49 |
| morganfainberg | gyee, it seems most do. | 21:49 |
| gyee | morganfainberg, we support service self-service | 21:50 |
| gyee | but that's our own internal stuff | 21:50 |
| *** dims has quit IRC | 21:51 | |
| morganfainberg | gyee, sure that makes sense | 21:51 |
| *** joesavak has quit IRC | 21:57 | |
| -openstackstatus- NOTICE: Zuul is being restarted with some dependency upgrades and configuration changes; ETA 2215 | 21:59 | |
| *** leseb has quit IRC | 21:59 | |
| *** bach has joined #openstack-keystone | 22:04 | |
| *** packet has joined #openstack-keystone | 22:08 | |
| *** bach has quit IRC | 22:09 | |
| *** bach has joined #openstack-keystone | 22:10 | |
| *** bach has quit IRC | 22:12 | |
| gyee | bknudson, https://bugs.launchpad.net/keystone/+bug/1315556 | 22:24 |
| uvirtbot | Launchpad bug 1315556 in keystone "Disabling a domain does not disable the projects in that domain" [Undecided,New] | 22:24 |
| gyee | not sure if this is a regression, I thought you fixed something like that earlier | 22:24 |
| bknudson | gyee: that sounds bad... I don't remember fixing something like that... | 22:25 |
| bknudson | there was an issue fixed with enabled/disabled endpoints in the catalog | 22:25 |
| gyee | bknudson, I can reproduce it in my dev env, if you guys can confirm that we may need to tag it as security bug | 22:26 |
| bknudson | gyee: at least we won't have to mark it as a private security bug. | 22:26 |
| bknudson | gyee: what about users in a disabled domain? | 22:27 |
| gyee | bknudson, users in disabled domain works as expected | 22:27 |
| gyee | they can't get tokens | 22:28 |
| *** browne has joined #openstack-keystone | 22:31 | |
| *** lnxnut has quit IRC | 22:33 | |
| *** sbfox has quit IRC | 22:35 | |
| *** sbfox has joined #openstack-keystone | 22:41 | |
| morganfainberg | gyee, bknudson, i'm sure disable wasn't ever disabling projects | 22:42 |
| morganfainberg | gyee, bknudson, disabling domains that is | 22:42 |
| bknudson | morganfainberg: on purpose? | 22:43 |
| bknudson | sorry, meant porpoise | 22:43 |
| morganfainberg | bknudson, probably as an oversight | 22:43 |
| morganfainberg | bknudson, lol | 22:43 |
| gyee | morganfainberg, but disabling a domain should effectively disable all the resources in it | 22:43 |
| gyee | we don't need explicit cascade disable, but user should not be able to anything with that domain | 22:44 |
| morganfainberg | gyee, sure, we should probably disable the projects at that point. | 22:44 |
| morganfainberg | gyee, probably do, otherwise tokens issued for a user not a member of that domain, but with an assignment on a project in that domain could still launch instances etc | 22:44 |
| morganfainberg | gyee, and i don't think we validate for new tokens issued for users not in that domain *should check* | 22:45 |
| *** thedodd has quit IRC | 22:45 | |
| gyee | morganfainberg, we should, or our revocation logic is broken | 22:45 |
| gyee | revocation check that is | 22:46 |
| morganfainberg | gyee, yeah. let me look really quckly here if we check on project's domain being disabled | 22:46 |
| morganfainberg | gyee, i'm not seeing anywhere where we check project domain for being enabled... | 22:49 |
| morganfainberg | gyee, i might be missing it though. | 22:50 |
| gyee | morganfainberg, you looking at the revocation tree logic? | 22:51 |
| morganfainberg | gyee, no i'm looking at issuance of new tokens not even revocations. | 22:51 |
| gyee | morganfainberg, good, you just confirmed that bug then | 22:52 |
| morganfainberg | gyee, haven't even gotten to revoking valid tokens yet :P | 22:52 |
| *** ericvw has quit IRC | 22:52 | |
| morganfainberg | gyee yeah. let me standup a devstack and be 100% sure. | 22:52 |
| morganfainberg | gyee, but i don't see code checking things. | 22:52 |
| gyee | morganfainberg, let me work on it fix, just want someone to tell me I was smoking something :) | 22:52 |
| gyee | s/was/wasn't/ | 22:52 |
| morganfainberg | gyee, nah, don't think you're on anything here | 22:53 |
| morganfainberg | gyee, i'll 2x verify with a real keystone here in a sec. | 22:53 |
| gyee | morganfainberg, thanks! | 22:53 |
| morganfainberg | gyee, and i'm pretty sure we need to cascade disable the projects. | 22:53 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: auth_token middleware hashes tokens with configurable algorithm https://review.openstack.org/80398 | 22:53 |
| *** derek_c has quit IRC | 22:55 | |
| gyee | morgainfainberg, I am struggling with this | 22:56 |
| gyee | on one hand, cascading status update may have significant performance impact | 22:57 |
| gyee | especially if we are moving to hierarchical tree model | 22:57 |
| morganfainberg | gyee, well the reason we might need to cascade is because we need to revoke outstanding tokens scoped to those projects | 22:57 |
| gyee | but if we don't cascade, notification may failed miserably | 22:57 |
| morganfainberg | yeah | 22:58 |
| morganfainberg | gyee, ok issuance of new tokens doesn't work | 23:05 |
| morganfainberg | gyee, on v3 | 23:05 |
| morganfainberg | gyee, http://pasteraw.com/hpib87ooviohxzahm2pazlz569txo4u | 23:05 |
| morganfainberg | gyee, aha | 23:06 |
| morganfainberg | gyee, https://github.com/openstack/keystone/blob/master/keystone/token/core.py#L94 it's deep in the token code. | 23:08 |
| gyee | morganfainberg, what about v3? | 23:11 |
| morganfainberg | gyee, covers both cases | 23:11 |
| morganfainberg | gyee, v3 still calls the token.core code. | 23:11 |
| *** rupsky has joined #openstack-keystone | 23:12 | |
| morganfainberg | gyee, the reason why it wasn't aparant is because we do all the work to get to the "token.create_token" method before we error out. | 23:12 |
| gyee | where does that method get invoked? | 23:12 |
| *** rupsky has left #openstack-keystone | 23:12 | |
| morganfainberg | gyee, https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L402 | 23:13 |
| morganfainberg | erm.. | 23:13 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L402 | 23:13 |
| morganfainberg | hrm. | 23:14 |
| morganfainberg | ok wait a moment. | 23:14 |
| morganfainberg | gyee, v3: https://github.com/openstack/keystone/blob/master/keystone/auth/controllers.py#L156 | 23:18 |
| morganfainberg | which calls _lookup_domain, which calls _assert_domain_is_enabled | 23:19 |
| gyee | morganfainberg, yeah, but if we have have "scope": {"project": {"id": "project_id"}}}" it will fail | 23:22 |
| gyee | that case is only for "scope": {"project": {"name": "project_name": "domain": {}}} | 23:23 |
| morganfainberg | gyee, looks like we call _lookup_project in all cases | 23:23 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/auth/controllers.py#L189 | 23:24 |
| morganfainberg | gyee, oh | 23:24 |
| morganfainberg | gyee, i see now. | 23:25 |
| gyee | morganfainberg, yes we do, but the domain checking logic is only exercise if "domain" is in "project" | 23:25 |
| gyee | if one specifies project ID, then we don't check project domain | 23:25 |
| morganfainberg | gyee we need to do a _lookup_domain in the else case still | 23:25 |
| morganfainberg | ok let me try that really quickly | 23:25 |
| gyee | morganfainberg, precisely | 23:25 |
| morganfainberg | since i have a live keystone | 23:25 |
| *** sbfox has quit IRC | 23:25 | |
| -openstackstatus- NOTICE: paste.openstack.org is going down for a short database upgrade | 23:26 | |
| morganfainberg | gyee, confirmed | 23:26 |
| morganfainberg | gyee, http://pasteraw.com/pz0g7mzqv971jibyebior72t3mp3gjf | 23:27 |
| gyee | morganfainberg, thanks, should be a trivial fix | 23:27 |
| gyee | we will tackle the cascade issue some other day | 23:27 |
| gyee | that one needs some deep thinking | 23:27 |
| morganfainberg | gyee yeah should be easy to move the _lookup_domain bit outside of the if/else block | 23:27 |
| morganfainberg | gyee, should file the cascade issue as a separate bug | 23:28 |
| morganfainberg | gyee, or this one as a separate bug from that one | 23:28 |
| ayoung | bknudson, what is your logic on https://review.openstack.org/#/c/80398/26 and checking all hashes? | 23:28 |
| gyee | morganfainberg, agree, that issue is much broader implications | 23:28 |
| gyee | s/is/has/ | 23:28 |
| morganfainberg | gyee, ... and unfortunately, this probably needs a backport to ICehouse and Havana | 23:28 |
| morganfainberg | let me confirm if this affects icehouse and/or Havana | 23:29 |
| morganfainberg | gyee, affects I: https://github.com/openstack/keystone/blob/stable/icehouse/keystone/auth/controllers.py#L160 | 23:30 |
| gyee | bloody | 23:30 |
| morganfainberg | gyee same for H | 23:30 |
| morganfainberg | https://github.com/openstack/keystone/blob/stable/havana/keystone/auth/controllers.py#L121 | 23:30 |
| morganfainberg | gyee, this code hasn't changed much | 23:31 |
| gyee | morganfainberg, yeah, we need backport then | 23:31 |
| *** dims has joined #openstack-keystone | 23:32 | |
| ayoung | gyee, I don't think we can. Revoke-all-tokens-for-domain is going to be painful | 23:34 |
| ayoung | We don't have any way of enumerating that | 23:34 |
| morganfainberg | ayoung, domain -> projects -> token | 23:35 |
| ayoung | morganfainberg, do we have that data? | 23:35 |
| morganfainberg | ayoung, if we don't this is one i think we can get. | 23:36 |
| morganfainberg | ayoung, fairly easily | 23:36 |
| ayoung | morganfainberg, revocation_events | 23:36 |
| morganfainberg | ayoung, ++ solves this going forward | 23:36 |
| morganfainberg | much more elegantly | 23:36 |
| gyee | ayoung, but in theory the revocation tree should cover that right? | 23:37 |
| ayoung | I think it might already be implemented. | 23:37 |
| ayoung | In fact, I'm pretty sure it is. | 23:37 |
| gyee | meaning, you check for the scoped token's domain has not been revoked right? | 23:37 |
| ayoung | yep | 23:37 |
| gyee | sorry scoped project | 23:37 |
| morganfainberg | ayoung, hm. | 23:38 |
| ayoung | one sec, I'll show you | 23:38 |
| morganfainberg | ayoung, trying to think if there are gaps in it -- i think you cover most of these. | 23:38 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/revoke/model.py#n178 | 23:38 |
| ayoung | if a domain is disabled, we revoke all tokens that have those alternatives | 23:39 |
| ayoung | 'identity_domain_id', 'assignment_domain_id' | 23:39 |
| ayoung | those are pulled from the tokens...(it is cleaner in the client code) | 23:39 |
| morganfainberg | ayoung, ++ good. means we only need to fix pre-events. | 23:40 |
| ayoung | morganfainberg, known issue, document, fix moving forward. Don't fix pre-events | 23:40 |
| gyee | ayoung, don't fix pre-events? | 23:42 |
| ayoung | gyee, nope....its going to be a nightmare to fix | 23:42 |
| ayoung | lets drive on to getting the events working instead | 23:42 |
| ayoung | it will be easier long term, and better, too | 23:42 |
| gyee | but the fix is trivial, we just make sure user can't get the token to begin with | 23:42 |
| ayoung | gyee, oh...not revoking? | 23:43 |
| morganfainberg | ayoung we have 2 issues 1 is revoking | 23:43 |
| gyee | ayoung, I mean not issue a new token | 23:43 |
| ayoung | def fix that | 23:43 |
| morganfainberg | yep | 23:43 |
| gyee | ayoung, you mean the cascade update? | 23:43 |
| morganfainberg | ayoung, yeah that was the lesser of the two concerns | 23:43 |
| ayoung | gyee, I meant disable domain should revoke tokens | 23:43 |
| ayoung | not issue new token++ | 23:43 |
| gyee | ayoung, no, I agree with you on that one | 23:44 |
| ayoung | cool | 23:44 |
| morganfainberg | ayoung, yeah we're on the same page | 23:44 |
| *** dims has quit IRC | 23:44 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Example Initialization scripts https://review.openstack.org/82687 | 23:46 |
| ayoung | where is the rebase button on the new UI? | 23:47 |
| morganfainberg | ayoung, uhm... hiding | 23:47 |
| morganfainberg | ayoung, top left | 23:48 |
| morganfainberg | ayoung, under the "strategy" | 23:48 |
| morganfainberg | "cherry-pick", "rebase", "abandon" | 23:48 |
| ayoung | hmmm, not seeing a rebase there, even though I updated the parent. | 23:49 |
| ayoung | Maybe it does it automatically? | 23:49 |
| morganfainberg | ayoung, do you own the patchset? | 23:49 |
| ayoung | yep | 23:49 |
| morganfainberg | ayoung, don't think it' | 23:49 |
| morganfainberg | s automatic | 23:49 |
| ayoung | morganfainberg, I see cherry-pick and abandon | 23:50 |
| morganfainberg | ayoung, i stopped using the "new screen" when i kept losing the change sets. | 23:50 |
| morganfainberg | erm, losing button locatiion | 23:50 |
| gyee | ayoung, I don't see the rebase button either | 23:50 |
| morganfainberg | ayoung, did you somehow endup uploading both? | 23:50 |
| ayoung | gonna look at the old one | 23:50 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: regions sample script https://review.openstack.org/91894 | 23:51 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: revocation_events script https://review.openstack.org/91895 | 23:51 |
| ayoung | well, that answered that question | 23:51 |
| morganfainberg | lol | 23:51 |
| morganfainberg | ok | 23:51 |
| *** dims has joined #openstack-keystone | 23:55 | |
| *** dims has quit IRC | 23:55 | |
| *** dims has joined #openstack-keystone | 23:56 | |
| dstanek | i think the gate hates me | 23:57 |
| gyee | dstanek, at least it is consistent :) | 23:59 |
| morganfainberg | dstanek, /unset _break_patches_from_dstanek | 23:59 |
| gyee | heh | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!