| *** nsquare has joined #openstack-keystone | 00:23 | |
| *** diegows has quit IRC | 00:23 | |
| *** bearhands is now known as comstud | 00:29 | |
| *** hrybacki has joined #openstack-keystone | 00:42 | |
| *** rodrigods has quit IRC | 00:44 | |
| *** diegows has joined #openstack-keystone | 00:56 | |
| *** xianghui has joined #openstack-keystone | 01:03 | |
| *** Chicago has joined #openstack-keystone | 01:05 | |
| *** Chicago has joined #openstack-keystone | 01:05 | |
| *** xianghui has quit IRC | 01:09 | |
| *** mberlin1 has joined #openstack-keystone | 01:12 | |
| *** xianghui has joined #openstack-keystone | 01:12 | |
| *** mberlin has quit IRC | 01:14 | |
| *** diegows has quit IRC | 01:26 | |
| openstackgerrit | A change was merged to openstack/keystone: Code which gets and deletes elements of tree was moved to one method https://review.openstack.org/86578 | 01:48 |
|---|---|---|
| *** sbfox has joined #openstack-keystone | 02:09 | |
| *** hrybacki has quit IRC | 02:18 | |
| *** stevemar has joined #openstack-keystone | 02:27 | |
| *** dstanek is now known as dstanek_zzz | 02:27 | |
| *** xianghui has quit IRC | 02:28 | |
| *** dstanek_zzz is now known as dstanek | 02:29 | |
| *** mgagne1 is now known as mgagne | 02:30 | |
| *** zhiyan_ is now known as zhiyan | 02:35 | |
| *** xianghui has joined #openstack-keystone | 02:41 | |
| *** dstanek is now known as dstanek_zzz | 02:54 | |
| *** gokrokve has joined #openstack-keystone | 02:59 | |
| *** lbragstad has joined #openstack-keystone | 03:07 | |
| *** Abhijeet has joined #openstack-keystone | 03:08 | |
| *** dstanek_zzz is now known as dstanek | 03:16 | |
| *** dstanek is now known as dstanek_zzz | 03:26 | |
| *** gokrokve has quit IRC | 03:38 | |
| *** gokrokve has joined #openstack-keystone | 03:39 | |
| *** gokrokve has quit IRC | 03:43 | |
| *** dstanek_zzz is now known as dstanek | 03:55 | |
| *** praneshp has quit IRC | 04:42 | |
| *** xianghui has quit IRC | 04:42 | |
| *** praneshp has joined #openstack-keystone | 04:42 | |
| *** sbfox has quit IRC | 04:45 | |
| *** xianghui has joined #openstack-keystone | 04:49 | |
| *** lbragstad has quit IRC | 05:01 | |
| *** sbfox has joined #openstack-keystone | 05:03 | |
| *** zhiyan is now known as zhiyan_ | 05:04 | |
| *** gokrokve has joined #openstack-keystone | 05:27 | |
| *** henrynash has joined #openstack-keystone | 05:30 | |
| *** gokrokve has quit IRC | 05:33 | |
| *** gokrokve has joined #openstack-keystone | 05:46 | |
| *** ajayaa has joined #openstack-keystone | 05:55 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/97005 | 06:00 |
| *** sbfox has quit IRC | 06:06 | |
| *** zhiyan_ is now known as zhiyan | 06:08 | |
| *** dstanek is now known as dstanek_zzz | 06:24 | |
| *** gokrokve has quit IRC | 06:24 | |
| *** gokrokve has joined #openstack-keystone | 06:25 | |
| *** gokrokve has quit IRC | 06:29 | |
| *** henrynash has quit IRC | 06:42 | |
| *** henrynash has joined #openstack-keystone | 06:44 | |
| *** dstanek_zzz is now known as dstanek | 06:46 | |
| *** ukalifon has joined #openstack-keystone | 06:53 | |
| *** gokrokve has joined #openstack-keystone | 06:57 | |
| *** gokrokve has quit IRC | 07:02 | |
| *** dstanek is now known as dstanek_zzz | 07:02 | |
| *** stevemar has quit IRC | 07:07 | |
| *** jaosorior has joined #openstack-keystone | 07:14 | |
| *** nsquare has quit IRC | 07:24 | |
| *** amerine has joined #openstack-keystone | 07:38 | |
| *** gokrokve has joined #openstack-keystone | 07:57 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: multi-backend support for identity https://review.openstack.org/74214 | 07:58 |
| *** gokrokve has quit IRC | 08:02 | |
| *** openstackgerrit has quit IRC | 08:02 | |
| *** openstackgerrit has joined #openstack-keystone | 08:06 | |
| *** praneshp has quit IRC | 08:09 | |
| *** anteaya has quit IRC | 08:10 | |
| *** andreaf has joined #openstack-keystone | 08:16 | |
| *** kun_huang has joined #openstack-keystone | 08:20 | |
| *** radez_g0n3 has quit IRC | 08:31 | |
| *** Chicago has quit IRC | 08:31 | |
| *** radez_g0n3 has joined #openstack-keystone | 08:32 | |
| *** Chicago has joined #openstack-keystone | 08:32 | |
| *** Chicago has joined #openstack-keystone | 08:32 | |
| *** Abhijeet has quit IRC | 08:50 | |
| *** marekd|away is now known as marekd | 08:53 | |
| *** dstanek_zzz is now known as dstanek | 08:54 | |
| *** Fredrik has joined #openstack-keystone | 09:00 | |
| *** Fredrik is now known as Guest36764 | 09:00 | |
| *** kun_huang has quit IRC | 09:04 | |
| *** henrynash has quit IRC | 09:04 | |
| *** dstanek is now known as dstanek_zzz | 09:04 | |
| *** Chicago has quit IRC | 09:21 | |
| *** gokrokve has joined #openstack-keystone | 09:27 | |
| *** gokrokve has quit IRC | 09:32 | |
| *** kun_huang has joined #openstack-keystone | 09:33 | |
| *** schofiel- has joined #openstack-keystone | 09:37 | |
| *** erecio has quit IRC | 09:42 | |
| *** schofield has quit IRC | 09:42 | |
| *** schofiel- is now known as schofield | 09:42 | |
| *** erecio has joined #openstack-keystone | 09:43 | |
| *** rodrigods has joined #openstack-keystone | 09:50 | |
| *** dstanek_zzz is now known as dstanek | 09:55 | |
| *** kun_huang has quit IRC | 09:58 | |
| Guest36764 | Hi, I've been following http://andymc-stack.co.uk/2013/06/apache2-mod_wsgi-openstack-pt1-keystone/ to try to run keystone via apache. I have a keystone that is up and running, shut it down and include wsgi config to apache (according to website, have removed SSL part of config) but I only get issue (ends with) "AttributeError: 'module' object has no attribute 'ismodule'" from the jsonutils.py. Anyone that can prov | 10:03 |
| *** dstanek is now known as dstanek_zzz | 10:05 | |
| openstackgerrit | A change was merged to openstack/keystone: Remove obsolete note from ldap https://review.openstack.org/95263 | 10:08 |
| *** kun_huang has joined #openstack-keystone | 10:09 | |
| *** anteaya has joined #openstack-keystone | 10:11 | |
| *** zhiyan is now known as zhiyan_ | 10:17 | |
| *** kun_huang has quit IRC | 10:22 | |
| *** gokrokve has joined #openstack-keystone | 10:27 | |
| *** gokrokve has quit IRC | 10:31 | |
| *** dstanek_zzz is now known as dstanek | 10:56 | |
| *** rodrigods has quit IRC | 10:57 | |
| *** kun_huang has joined #openstack-keystone | 11:03 | |
| *** dstanek is now known as dstanek_zzz | 11:06 | |
| *** rodrigods has joined #openstack-keystone | 11:17 | |
| *** diegows has joined #openstack-keystone | 11:20 | |
| *** kun_huang has quit IRC | 11:20 | |
| *** rodrigods has quit IRC | 11:27 | |
| *** gokrokve has joined #openstack-keystone | 11:27 | |
| *** gokrokve has quit IRC | 11:32 | |
| Guest36764 | Hi, I've been following http://andymc-stack.co.uk/2013/06/apache2-mod_wsgi-openstack-pt1-keystone/ to try to run keystone via apache. Seems to start OK but request towards it produces error (http://paste.openstack.org/show/83408/) anyone that can provide suggestion on how to solve? | 11:44 |
| *** dstanek_zzz is now known as dstanek | 11:57 | |
| *** henrynash has joined #openstack-keystone | 12:05 | |
| *** dstanek is now known as dstanek_zzz | 12:07 | |
| *** erecio has quit IRC | 12:08 | |
| *** topol has joined #openstack-keystone | 12:10 | |
| *** gokrokve has joined #openstack-keystone | 12:27 | |
| *** rodrigods has joined #openstack-keystone | 12:28 | |
| *** rodrigods has joined #openstack-keystone | 12:28 | |
| *** gokrokve has quit IRC | 12:31 | |
| *** erecio has joined #openstack-keystone | 12:35 | |
| *** hrybacki has joined #openstack-keystone | 12:38 | |
| *** gordc has joined #openstack-keystone | 12:48 | |
| *** dstanek_zzz is now known as dstanek | 12:54 | |
| ajayaa | Hi, what is a policy and what is its use? | 13:00 |
| *** hrybacki_ has joined #openstack-keystone | 13:00 | |
| ajayaa | for e.g. https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#policies | 13:00 |
| *** ericvw has joined #openstack-keystone | 13:03 | |
| *** dstanek is now known as dstanek_zzz | 13:05 | |
| hrybacki | Has anyone else been failing oauth tox tests for python-keystone tests? | 13:11 |
| *** nkinder has quit IRC | 13:11 | |
| marekd | hrybacki: probably everybody. | 13:11 |
| bknudson | https://bugs.launchpad.net/bugs/1327430 | 13:11 |
| uvirtbot | Launchpad bug 1327430 in python-keystoneclient "get_oauth_params() missing 1 required positional argument: 'request'" [Undecided,In progress] | 13:11 |
| *** vhoward has joined #openstack-keystone | 13:12 | |
| hrybacki | bknudson++ | 13:12 |
| marekd | thanks bknudson i didn't know the bugid. | 13:12 |
| hrybacki | So I thought if I downgraded to 0.6.0 (what's in the requirements file) they would run but it didn't work either. Any thoughts? Is there a way I can run all the tests and skip the oauth ones? | 13:13 |
| bknudson | it worked for me to downgrade to the prev release | 13:13 |
| hrybacki | hrm | 13:13 |
| bknudson | if it doesn't work with 0.6.0 then that would be a bug too | 13:14 |
| hrybacki | bknudson: nods, I'll try 0.6.1 | 13:14 |
| bknudson | .tox/py27/bin/pip install "oauthlib<0.6.2" | 13:14 |
| hrybacki | bknudson++ | 13:16 |
| hrybacki | tox uses it's own requirements file? | 13:16 |
| hrybacki | or I should say maintains its own set of dependencies and installs them in it's own venv | 13:17 |
| bknudson | there's a requirements.txt and test-requirements.txt | 13:17 |
| hrybacki | ah, oauthlib>=0.6 | 13:18 |
| hrybacki | thank you! | 13:19 |
| *** gokrokve has joined #openstack-keystone | 13:27 | |
| *** ukalifon has quit IRC | 13:27 | |
| *** ukalifon has joined #openstack-keystone | 13:29 | |
| *** gokrokve has quit IRC | 13:32 | |
| ajayaa | henrynash, ping! | 13:34 |
| henrynash | ajayya: hi | 13:34 |
| henrynash | ajayaa: hi | 13:36 |
| ajayaa | henrynash: hi. in https://bugs.launchpad.net/keystone/+bug/1271273, I don't understand why multiple calls to _set_policy doesn't work properly. | 13:37 |
| uvirtbot | Launchpad bug 1271273 in keystone "Policy testing checks could be simplified in test_v3_filters" [Wishlist,Triaged] | 13:37 |
| henrynash | ajayaa: good question, I’ll have to try and reload that backup tape to my brain to remember myself | 13:38 |
| ayoung | https://review.openstack.org/#/c/97492/ henrynash I'm going to suggest that we declare victory on this, and that we agree any future changes can be submitted as updates to the spec | 13:38 |
| ajayaa | henrynash, please restore the backup for a while. :) | 13:38 |
| ayoung | we need to be able to approve things in this team: we seem to be a bit trigger shy | 13:39 |
| henrynash | ayoung: ++ | 13:39 |
| ayoung | henrynash, have you tested your code against LDAP + something else? | 13:39 |
| ajayaa | henrynash, I could use a +1 from you in https://review.openstack.org/#/c/98072/ :) | 13:39 |
| henrynash | ajayaa: I don’t think I ever actually worked out why it failed when called repeatable…. | 13:39 |
| henrynash | ayoung: So there is a test case that uses some LDAP domains and some SQL domains | 13:40 |
| ayoung | henrynash, Live, or just FakeLDAP? | 13:40 |
| henrynash | ayoung: so that just uses fake | 13:40 |
| ayoung | henrynash, have you tested it live? Can w calim we have a solution for Read only LDAP with service users in SQL? | 13:41 |
| henrynash | ayoung: i think what we really want is a tempest test for this... | 13:41 |
| ayoung | ++ | 13:41 |
| henrynash | ayoung: I did test that earlier….I’ll run anotehr test and confirm the results | 13:41 |
| henrynash | ayoung: (Live LDAP + sql for default domain) | 13:42 |
| ayoung | henrynash, So long as it was run at some point | 13:42 |
| ayoung | hrybacki, send me what you got. | 13:42 |
| ayoung | henrynash, so your origianal plan was for service users to be in the default domain and LDAP in a specific one. But even if we reverse that, we are going to have to make sure V3 works somewhere that it is not currently used | 13:44 |
| ayoung | Horizon doesn't ask for domain yet, does it? | 13:44 |
| henrynash | ayoung: I’m not sure it does | 13:44 |
| hrybacki | ayoung++ | 13:45 |
| henrynash | ayoung: but to your earlier point, yes, I imagined the default domain contains service users, and a separate domain(s) point at LDAP…. | 13:46 |
| ayoung | henrynash, if we reverse that, it means the only place we need to fix to get things working is auth_token middleware | 13:47 |
| ayoung | henrynash, if we let AD handle the default domain, users can happily log in | 13:47 |
| henrynash | ayoung: OK, yes, I see the idea | 13:47 |
| ayoung | then the remote services just need to know Domain for revocation list fetch, etc | 13:47 |
| ayoung | henrynash, just a tactical move to get us up and running | 13:48 |
| henrynash | ayoung: no reason why we shouldn’t do that…. | 13:48 |
| henrynash | ayoung: interesting | 13:48 |
| *** nkinder has joined #openstack-keystone | 13:48 | |
| *** topol has quit IRC | 13:49 | |
| *** stevemar has joined #openstack-keystone | 13:53 | |
| *** jsavak has joined #openstack-keystone | 13:54 | |
| ajayaa | Hi. How do I modify the rule "identity: delete_user" so that a project_manager can delete users only in his project. | 13:58 |
| *** gokrokve has joined #openstack-keystone | 14:00 | |
| rodrigods | ajayaa, hey, one option is to use project_id:%(target.project.id)s | 14:04 |
| *** rwsu has joined #openstack-keystone | 14:04 | |
| rodrigods | ajayaa, you can check some of this rules here: https://github.com/rodrigods/keystone-policy-tests/blob/master/policy.json_example . There is rules for project_admin, domain_admin, etc | 14:05 |
| ajayaa | rodrigods: The api call looks like " DELETE /users/{userid}". What happens if a user is associated with multiple projects? | 14:08 |
| ajayaa | target.project.id == default_project_id? | 14:09 |
| ajayaa | rodrigods, I can try it out probably. Thanks. What type of test is recommended for testing custom policies? | 14:14 |
| ajayaa | unit, functional (change in tests/test_v3_protection.py) or tempest? | 14:15 |
| ajayaa | ayoung, | 14:15 |
| ayoung | ajayaa, good question. I don't think we have one...itwould be a very useful stand along tool, though... | 14:16 |
| *** hrybacki has quit IRC | 14:18 | |
| ajayaa | ayoung, How would you go about generating tests? Manually write a number of tests or some generic stuff which would read policy.json and generate tests from it. | 14:19 |
| ayoung | ajayaa, we have some tests...looking... | 14:20 |
| ajayaa | in test_v3_protection.py, I think. | 14:20 |
| *** CaioBrentano has joined #openstack-keystone | 14:23 | |
| ayoung | ajayaa, yep | 14:23 |
| ayoung | ajayaa, not sure, though, what happens if the policy dictates that something should be read from the database, which is the case with your policy rule | 14:24 |
| ayoung | ajayaa, if the user is associated with multiple projects, only the project associated with the token that they present is relevant | 14:25 |
| ajayaa | ayoung, https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#policies. Are you talking about this? From the api example I couldn't figure out what is it? | 14:26 |
| ayoung | ajayaa, nope | 14:27 |
| ayoung | ajayaa, look at the trust rules | 14:27 |
| *** ukalifon3 has joined #openstack-keystone | 14:29 | |
| *** hrybacki has joined #openstack-keystone | 14:30 | |
| *** ukalifon has quit IRC | 14:30 | |
| rodrigods | ayoung, ajayaa ++ | 14:31 |
| *** alanvitor has joined #openstack-keystone | 14:31 | |
| rodrigods | would be great to enforce by the projects where a user has a role | 14:32 |
| rodrigods | not just for the default_project_id | 14:33 |
| *** radez_g0n3 is now known as radez | 14:34 | |
| *** dims has joined #openstack-keystone | 14:36 | |
| ayoung | rodrigods, ajayaa please make it so. | 14:38 |
| *** nkinder has quit IRC | 14:40 | |
| *** topol has joined #openstack-keystone | 14:41 | |
| ajayaa | ayoung, Could you please tell me, how does someone specify that a rule be fetched from database? | 14:42 |
| *** daneyon has joined #openstack-keystone | 14:43 | |
| ajayaa | as far as I could understand, either attributes are fetched from api call and token and object being acted on. | 14:46 |
| ayoung | ajayaa, did you look at the trust rules? Also look at the decorator that activates them, in keystone/trusts/controllers.py | 14:47 |
| ajayaa | I will have a look. Thanks a lot. :) | 14:47 |
| *** erecio has quit IRC | 14:48 | |
| *** ajayaa has quit IRC | 14:48 | |
| *** erecio has joined #openstack-keystone | 14:49 | |
| *** erecio has quit IRC | 14:49 | |
| *** thedodd has joined #openstack-keystone | 14:50 | |
| *** gokrokve has quit IRC | 14:53 | |
| *** richm has joined #openstack-keystone | 14:53 | |
| *** gokrokve has joined #openstack-keystone | 14:53 | |
| *** lbragstad has joined #openstack-keystone | 14:54 | |
| *** nkinder has joined #openstack-keystone | 14:55 | |
| *** gokrokve has quit IRC | 14:57 | |
| *** sbfox has joined #openstack-keystone | 14:59 | |
| *** ukalifon3 has quit IRC | 15:03 | |
| *** ayoung has quit IRC | 15:05 | |
| *** jsavak has quit IRC | 15:09 | |
| *** jsavak has joined #openstack-keystone | 15:09 | |
| *** dstanek_zzz is now known as dstanek | 15:10 | |
| dstanek | i see the hackathon is at Geekdom. nice! | 15:11 |
| *** erecio has joined #openstack-keystone | 15:12 | |
| stevemar | dstanek, welcome back! | 15:15 |
| dstanek | stevemar: thanks | 15:16 |
| *** morganfainberg_Z is now known as morganfainberg | 15:18 | |
| morganfainberg | dstanek, you're back?! have a good vacation? | 15:19 |
| dstanek | morganfainberg: i think i took today off too, but it looks like i have a lot to catch up on | 15:20 |
| morganfainberg | dstanek, ah | 15:20 |
| dstanek | looks like the bug count is going down nicely | 15:23 |
| morganfainberg | dstanek, yeah. i spent 2 days smashing out bugs that were dupes / already closed / wtf? no / etc | 15:23 |
| morganfainberg | dolphm, dstanek, stevemar, bknudson, jamielennox|away, topol, ayoung, lbragstad - Quick question, for approving specs, what are we doing, 2x+2 then +A?, +2s and PTL approves? 3x+2, then +A | 15:26 |
| topol | dstanek, welcome back | 15:26 |
| topol | morganfainberg, good question | 15:27 |
| morganfainberg | i think we forgot to specify that when we spun up the -specs repo | 15:27 |
| *** gyee has joined #openstack-keystone | 15:27 | |
| *** ayoung has joined #openstack-keystone | 15:27 | |
| topol | morganfainberg, I suspect the PTL needs to approve if we are to be consistent with the previous provess | 15:27 |
| morganfainberg | but... we need to get these specs in ASAP, so..... it's time to get that decision in place | 15:27 |
| stevemar | morganfainberg, i think we need more than the usual 2x+2 | 15:28 |
| morganfainberg | stevemar, i agree, thats why i am asking. | 15:28 |
| bknudson | morganfainberg: different groups do it differently | 15:28 |
| lbragstad | I think whatever allows for the most eyes on a spec would be good... | 15:28 |
| bknudson | I would expect dolphm to do the honors | 15:28 |
| bknudson | but maybe that's more restrictive than we need to be | 15:28 |
| lbragstad | ++ | 15:28 |
| ayoung | the spec process is broken. Specs should not have to be "approaved" in that every t is dotted and i is crossed before we say "go ahead and do it." | 15:28 |
| lbragstad | I'd agree with htat | 15:28 |
| ayoung | We need to say "OK, this spec is good enough, lets do it | 15:28 |
| lbragstad | we currently have 11 specs up... https://review.openstack.org/#/q/status:open+project:openstack/keystone-specs,n,z | 15:28 |
| ayoung | and then have a follow on process to convert the spec into documentation for the project | 15:29 |
| morganfainberg | ayoung, which is why i'm asking the question of when do we approve it. | 15:29 |
| topol | we have a PTL who can do the good enough role | 15:29 |
| ayoung | morganfainberg, do you think I am arguing against you? | 15:29 |
| bknudson | you're not stopped from doing any work before the spec is approved | 15:29 |
| morganfainberg | ayoung, nope | 15:29 |
| lbragstad | bknudson: right | 15:29 |
| topol | you have to admit the specs look incredibly good compared to previous ones thanks to the new process | 15:29 |
| morganfainberg | bknudson, there is some legitimate concern that if a spec hasn't been (at least tenatively approved) the work is throw-away | 15:29 |
| ayoung | topol, but the code is not getting written | 15:30 |
| ayoung | We have very pretty wrppaing papaer, a bow, and an empty box | 15:30 |
| lbragstad | but by the time you really start iterating over the spec and no one has raised a serious red flag, I *think* it would be safe to start implement something? | 15:30 |
| dstanek | topol: thanks | 15:30 |
| morganfainberg | lbragstad, unless the spec gets mothballed and left. | 15:30 |
| bknudson | morganfainberg: sure, I think if another core has looked at it and didn't have any major objections then go ahead. | 15:31 |
| topol | so thats the same problem a newcomer has to a project where no one reviews their stuff. The answer I give them is the same. Go start writying a patch. code TALKS | 15:31 |
| ayoung | bknudson, so what if we have another termie incident? | 15:31 |
| bknudson | ayoung: what's a termie incident? | 15:31 |
| ayoung | Someone coming in months later and decideing "nope" and -2ing it and sitting on the code | 15:31 |
| ayoung | a core at that | 15:31 |
| lbragstad | the trust thing? | 15:31 |
| topol | whats stopping any of us from doing a WIP patch. We iterate on everything a ton anyway | 15:31 |
| ayoung | the approval means "this is the approach that we are going with" | 15:32 |
| bknudson | ayoung: I would hope that the spec process helps with that! | 15:32 |
| topol | again, we have a PTL to fix those issues. We need dolphm for this conversation | 15:32 |
| ayoung | not that every last detail is perfect...and I think a spec should be approvable even before it is ready for inclusion in the next O'Reilly book. | 15:32 |
| dstanek | it would be nice to somehow have the process be more agile - first phase is an approval "we like this and the approach looks good enough to explore" | 15:33 |
| dstanek | second phase - "API is solid and all the i's are crossed and t's are dotted!" | 15:33 |
| ayoung | topol, I'm just a little worried that we keep putting more and more restrictions in place, we are going to be paralyzed. Right now, we only have until J2 to get API changes in, and now we spin a lot of iterations on getting the Sepc right, which is, hopefully going to replace the API process.... | 15:33 |
| dstanek | looks like i just got bounced - did my messages get through? | 15:34 |
| ayoung | dstanek, so I think that is what I want here too | 15:34 |
| ayoung | dstanek, yes | 15:34 |
| ayoung | dstanek, " first phase is an approval..." | 15:34 |
| bknudson | we're paralyzed already because it takes time to review and we don't always have time to do reviews | 15:35 |
| dstanek | i think part of the issue will always be that certain parts of APIs (etc) will need to be coded before being stamped in stone as a spec | 15:35 |
| bknudson | e.g., I need to make presentations and look at bugs and stuff | 15:35 |
| ayoung | bknudson, yeah | 15:35 |
| bknudson | hopefully the spec process will make the code reviews go faster | 15:35 |
| ayoung | bknudson, and Red Hat waits until Icehouse goes out the door to do its big QA push, which means right now everyone is demanding my time. | 15:36 |
| bknudson | ayoung: we have the same thing here | 15:36 |
| ayoung | dstanek, maybe the first thing someone should submit is a proof-of-concept. Out of tree? | 15:36 |
| openstackgerrit | Stuart McLaren proposed a change to openstack/keystone: enable multiple keystone-all worker processes https://review.openstack.org/42967 | 15:37 |
| * ayoung is going to +A ^^ just so people stop submitting it | 15:38 | |
| dstanek | ayoung: if i were doing this from scratch and had the power to make the decision i would say yes | 15:38 |
| topol | so this is a new process and clearly some kinks need to be worked out. Perhaps we all relax and not nit pick everything | 15:38 |
| dstanek | similar to how vish created a POC for the work he wanted to do | 15:38 |
| ayoung | dstanek, ++ | 15:38 |
| dstanek | but i realize that in a corporate setting that may not work because of the "throw away factor" | 15:38 |
| ayoung | dstanek, the code review process should feed into the documentation, too | 15:39 |
| ayoung | IE: when I explain to you how something I wrote works, we should capture that as part of the docs | 15:39 |
| lbragstad | part of that does get captured in the spec review, I would say | 15:40 |
| topol | so we still have a blueprint entry in launchpad for each spec. Cant the PTL just approve it there and then you know to proceed with coding? | 15:40 |
| ayoung | dstanek, I like the SPEC process. And some of the Proof-of-concpet things, like what Kent did for Federation, needed som serious reworking before it fit in with the rest of Keystone | 15:40 |
| ayoung | topol, why PTL only | 15:40 |
| ayoung | that is too much on dolphm 's shoulders, as broad as they are | 15:41 |
| dstanek | how does the whole flow work end-to-end? if i submit a spec when do i create a blueprint and how do i link them? | 15:41 |
| ayoung | how about a vote at the tuesday meeting | 15:41 |
| topol | I thought thats how it used to work. Didnt the PTL use to approve which blueprints when each relase? | 15:41 |
| morganfainberg | topol, not really | 15:41 |
| ayoung | thumbs up or down, PTL gets a Veto? | 15:41 |
| morganfainberg | topol, any drivers could/can | 15:41 |
| morganfainberg | drivers = core | 15:41 |
| topol | Oh, OK, so then why can't you guys just do a single +2 and we have the same model? | 15:42 |
| ayoung | topol, what I think we all want, and have no way of collecting is : THis approach is OK. No serious objections | 15:43 |
| topol | i.e. single +2 gets the spec merged | 15:43 |
| topol | how did you have that beofre? | 15:43 |
| ayoung | can we all just go through and +1 all the specs that we think are OK, with +2 meaning "read in depth, and willing to approve?" | 15:43 |
| ayoung | topol, nothing formatl | 15:44 |
| bknudson | I guess my concern is, how do you raise an objection after the spec has been +A? | 15:44 |
| bknudson | maybe you think the database schema is messed up | 15:44 |
| lbragstad | have a vote and amend the spec with some sort of label? | 15:45 |
| morganfainberg | bknudson, are we putting the DDL information into the spec? | 15:45 |
| morganfainberg | bknudson, if so, then that is a reason to -1 the spec. | 15:45 |
| ayoung | bknudson, there is still Code review, there is still bugs | 15:45 |
| topol | and we have seen things come down to the wire based on the content/quality of the code regarding whether something gets in or not | 15:45 |
| bknudson | this is kind of the "termie" issue | 15:45 |
| morganfainberg | bknudson, if we're not, we do that in the code review that has the db schema in it | 15:45 |
| bknudson | right, maybe something comes up during code review where the design is just broken | 15:45 |
| topol | do folks really feel that previously when they had a blueprint approved that that guaranteed their code would get in? | 15:45 |
| morganfainberg | i think we need to clarify an approved spec is not set in stone. you can propose changes to it. | 15:46 |
| bknudson | do we go back and fix the spec | 15:46 |
| morganfainberg | bknudson, if it's a legitimate issue, fix the spec :) | 15:46 |
| bknudson | that works for me | 15:46 |
| morganfainberg | it's a guideline of what we're aiming for | 15:46 |
| ayoung | bknudson, we need to be willing to iterate | 15:46 |
| ayoung | I try to make it a point that if I ever block someone's approach, at a minimum I give them an alternative that I think will still suit their needs and be more in line with the project | 15:47 |
| morganfainberg | that is why i don't think the DDL needs to be in the spec unless it's massively complex (for example) | 15:47 |
| morganfainberg | i think that can be handled in the code review. | 15:47 |
| bknudson | my concern is that it can be difficult to go back and update the spec | 15:47 |
| bknudson | but if people are willing to iterate then i'm fine with that | 15:47 |
| morganfainberg | bknudson, i think that the spec should really be a guideline on what we're aiming for, to limit scope of a bp and keep us all on track | 15:47 |
| topol | morganfainberg+++ | 15:48 |
| morganfainberg | bknudson, "i propose changing X and Y, but in code I do Z, Q, and R' that is a nogo. | 15:48 |
| topol | just some of them were so well written they were great design docs. It was intoxicating.. | 15:48 |
| morganfainberg | as far as i am concerned, the specs are looking very good. | 15:49 |
| lbragstad | ok so.. | 15:49 |
| lbragstad | I have a question | 15:49 |
| topol | I have to travel and wont be at the Tuesday meeting. Ideally whatever solution you can come up with that doesnt stall progress works for me | 15:49 |
| dstanek | at what point do we say the spec is stable and will only change for bugs in the spec? after all code is merged? after released? | 15:49 |
| ayoung | BTW: don't start your spec with "add spec" Lets try to keep the one liners matching the blueprints. so instead of "Add spec for using JSON Home" call it "JSON Home" just to pcik on bknudson. Then we can say approaval of the spec doc that matches the blueprint implies approval of the blue print on https://blueprints.launchpad.net/keystone or comparable | 15:50 |
| topol | red tape slowing us down is not what anyone wants | 15:50 |
| lbragstad | lets say I have a spec up that needs to be updated, with I do in commit A... and then I modify my implementation to follow the spec in commit B. Should we *always* approve and merge A before B? | 15:50 |
| lbragstad | Always make sure the spec is updated before the implementation? | 15:51 |
| lbragstad | to avoid getting the two out of sync? | 15:51 |
| bknudson | lbragstad: aren't reviewers going to see that the code doesn't match the approved spec? | 15:51 |
| *** david-lyle has joined #openstack-keystone | 15:51 | |
| morganfainberg | bknudson, the hope is that reviewers will look at the spec | 15:51 |
| lbragstad | right, I'm just trying to think of cases where they would get out of sync | 15:52 |
| topol | Perhaps the problem is the template, not the spec-repo. It requires a ton of details. Perhaps making that lighter fixes this issue? | 15:52 |
| morganfainberg | the way i see the spec is it's an enhancement to the API repo we have | 15:52 |
| morganfainberg | it documents what the API repo couldn't | 15:53 |
| morganfainberg | it shouldn't be "every detail of everything captured in prose" | 15:53 |
| bknudson | part of the problem is we just haven't been doing things right | 15:53 |
| morganfainberg | it's a framework for the implementation. it really is more to cover what the workload is. - and to keep scope in check | 15:53 |
| bknudson | e.g., we don't have tempest tests for common scenarios | 15:53 |
| bknudson | so we either have to fix that first | 15:54 |
| morganfainberg | bknudson, that is part of what the spec is meant to cover "hey, guys, we need to do this too" | 15:54 |
| bknudson | or fix it while we're trying to implement features | 15:54 |
| morganfainberg | i think we need to go with the latter, perhaps work on the comon scenarios once we're past the J2 limit | 15:55 |
| morganfainberg | bknudson, a more concerted effort focusing on the common scenarios | 15:55 |
| morganfainberg | bknudson, vs more ad-hoc up front | 15:55 |
| bknudson | and maybe this is part of what topol is talking about -- do we want to slow down and do it right? or keep up the speed doing it wrong? | 15:55 |
| ayoung | topol, Or just making it clearer : this is a superset of the spec data, include only that which is relevant to your design | 15:55 |
| bknudson | I would expect a feature like federation would take much longer if tempest tests were a requirements | 15:56 |
| ayoung | can we start by all agreeing to approve https://blueprints.launchpad.net/keystone/+spec/multi-backend-uuids | 15:56 |
| bknudson | but now it's in and there's no tempest | 15:56 |
| ayoung | with the undertanding that it is the code that counts? | 15:56 |
| bknudson | so can changes to federation require tempest tests? | 15:56 |
| morganfainberg | bknudson, we have debt to payback. | 15:58 |
| morganfainberg | we can require future looking changes to implement tempest, but more likely, we wont be able to do the full run on some of those things yet (we can't run in apache, we can't do tempest for federation) | 15:58 |
| topol | ayoung+++ you know you have my vote | 15:59 |
| topol | thats a tony award winning spec :-) | 15:59 |
| morganfainberg | bknudson, we've got gaps on testing that are bigger issues than not having a tempest scenario for a feature :( | 15:59 |
| *** gokrokve has joined #openstack-keystone | 15:59 | |
| *** andreaf has quit IRC | 16:00 | |
| morganfainberg | bknudson, i expect to have a lot of those gaps closed this cycle | 16:00 |
| morganfainberg | bknudson, but until they are... | 16:00 |
| bknudson | morganfainberg: closing tempest testing gaps would be impressive. | 16:00 |
| morganfainberg | bknudson, well, i'll be closing the gaps on things like LDAP backed tempest runs, and apache deployments | 16:01 |
| morganfainberg | bknudson, once we're there, we can say "ok federation needs tempest" | 16:01 |
| bknudson | that would be significant | 16:01 |
| morganfainberg | bknudson, that is one of my goals this cycle. | 16:01 |
| morganfainberg | bknudson, but it might be right up until J3 before it's really done | 16:02 |
| morganfainberg | bknudson, so i don't want to prevent all forward motion on things we _cant_ tempest test | 16:02 |
| *** jsavak has quit IRC | 16:02 | |
| *** ayoung has quit IRC | 16:02 | |
| bknudson | the concern is that we're kind of flying blind | 16:03 |
| *** jsavak has joined #openstack-keystone | 16:03 | |
| morganfainberg | bknudson, we are. we're getting closer. | 16:03 |
| morganfainberg | bknudson, but once we have a LDAP target, a apache target, the other basic things in gate | 16:03 |
| morganfainberg | bknudson, we will need to pay back debt. | 16:03 |
| morganfainberg | bknudson, and likely with that debt will come some bug smashing | 16:04 |
| *** thedodd has quit IRC | 16:04 | |
| morganfainberg | bknudson, so - for things we can test, lets make sure there is tempest for them - to the best of our abilities | 16:05 |
| morganfainberg | bknudson, at least isolated for the new functionality | 16:05 |
| morganfainberg | bknudson, as part of the spec. | 16:05 |
| morganfainberg | specs can be iterated on, please propose a change if there is a major issue with them during plementation. | 16:06 |
| *** david-lyle has quit IRC | 16:06 | |
| bknudson | I don't think we answered what's required for spec approval? Maybe add it to the meeting agenda | 16:06 |
| morganfainberg | specs should provide enough justification for the work and targets to be useful in determining if we're on the right path with implementation. | 16:06 |
| morganfainberg | bknudson, ++ and we need to say "XYZ is needed for approval" | 16:07 |
| bknudson | I would hope that a spec could also anticipate issues that you're going to have... | 16:07 |
| bknudson | e.g., maybe there's some issue with identity & assignment being separate backends | 16:07 |
| morganfainberg | bknudson, sure, but doesn't mean you wont run into some crazy edge case that blind sided you and requires a modification to the spec. | 16:08 |
| bknudson | morganfainberg: I agree, we need to be able to iterate after approval | 16:09 |
| morganfainberg | bknudson, ok i'll toss this on the agenda | 16:09 |
| *** clu_ has joined #openstack-keystone | 16:10 | |
| dstanek | i would love to see a spec for the spec process :-) | 16:12 |
| topol | What on a spec the PTL (or other folks that have blueprint approval rights) leave a comment that says I approve patch xx of the spec as able to go in? | 16:15 |
| topol | Why doesnt that fix this? | 16:15 |
| topol | comment says approved and we have a version that was approved and then folks can go work on stuff knowing its approved | 16:16 |
| topol | thank goodness for comments | 16:16 |
| *** sbfox has quit IRC | 16:20 | |
| *** ayoung has joined #openstack-keystone | 16:25 | |
| *** dstanek is now known as dstanek_zzz | 16:25 | |
| *** ayoung has quit IRC | 16:25 | |
| *** dstanek_zzz is now known as dstanek | 16:26 | |
| *** praneshp has joined #openstack-keystone | 16:26 | |
| *** david-lyle has joined #openstack-keystone | 16:28 | |
| topol | dstanek, is there a metadata model for the spec for the spec process? :-) | 16:29 |
| *** ayoung has joined #openstack-keystone | 16:29 | |
| ayoung | bknudson, morganfainberg how about we put "thumbs up down vote on Spec X,Y,Z" on each weeks agenda | 16:35 |
| bknudson | ayoung: I have no problem with that. | 16:36 |
| ayoung | ++ | 16:36 |
| bknudson | then I'd expect 2 +2 to +A | 16:36 |
| bknudson | thumbs up/down would just be an agreement on whether this is good for keystone | 16:37 |
| bknudson | or a no-go | 16:37 |
| morganfainberg | bknudson, ++ | 16:37 |
| ayoung | bknudson, unless anyone strenuously objects, I say we approve the spec, and allow future revisions for nits | 16:38 |
| ayoung | bknudson, I think we don't want 2 +2 | 16:39 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove `with_lockmode` use from Trust SQL backend. https://review.openstack.org/97059 | 16:39 |
| ayoung | that is a different standard | 16:39 |
| ayoung | and is good for code, but not for specs | 16:39 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove `with_lockmode` use from Trust SQL backend. https://review.openstack.org/97059 | 16:39 |
| bknudson | ok, I'm just wondering how much work we expect to put into the spec | 16:39 |
| ayoung | for specs it should be "I have no objections to this approach" | 16:39 |
| ayoung | or | 16:39 |
| morganfainberg | topol, ^ if i addressed your concerns please remove the -1. | 16:39 |
| ayoung | "you have not thought about this enought" | 16:39 |
| bknudson | we could thumbs up just with a description | 16:39 |
| ayoung | bknudson, lets battle through the unique ID spec tomorrow, and see what we learn from that | 16:40 |
| *** dstanek is now known as dstanek_zzz | 16:40 | |
| bknudson | I don't think there's a battle to be had over the unique ID spec | 16:40 |
| bknudson | ayoung: maybe session tokens? I don't know much about it. | 16:42 |
| bknudson | https://review.openstack.org/#/c/96648/2/specs/juno/session-tokens.rst | 16:42 |
| bknudson | ayoung: there's several proposals, we could try to thumbs up/down | 16:43 |
| bknudson | https://review.openstack.org/#/q/project:openstack/keystone-specs+status:open,n,z | 16:43 |
| ayoung | bknudson, lets list all of them, and go through them | 16:43 |
| *** david-lyle has quit IRC | 16:43 | |
| bknudson | maybe someone doesn't want the server to do v3 extension advertisement? | 16:43 |
| bknudson | I got good feedback on the code that I posted before there was a spec | 16:44 |
| topol | morganfainberg, yes you did and the -1 is gone. | 16:45 |
| *** raildo has quit IRC | 16:50 | |
| ayoung | bknudson, they are on the agenda. We can vote: "Yes", "No", or "Come back with more details." | 16:51 |
| *** tellesnobrega has quit IRC | 16:51 | |
| *** htruta has quit IRC | 16:51 | |
| *** rodrigods has quit IRC | 16:52 | |
| openstackgerrit | Boris Pavlovic proposed a change to openstack/keystone: Add rally plugins support https://review.openstack.org/98836 | 16:55 |
| boris-42 | bknudson morganfainberg ^ | 16:59 |
| boris-42 | bknudson morganfainberg hi there | 16:59 |
| morganfainberg | boris-42, saw! that'll make using rally even better | 16:59 |
| boris-42 | morganfainberg there will be one more important feature soon | 17:00 |
| boris-42 | morganfainberg criteria of benchmark success | 17:00 |
| *** nkinder has quit IRC | 17:00 | |
| boris-42 | morganfainberg there will be one more field args, runner, context and new one will be criteria | 17:00 |
| boris-42 | morganfainberg where you can specify max failure rate, avg, max duration and probably other interesting arguments | 17:01 |
| *** gordc has quit IRC | 17:01 | |
| *** gordc has joined #openstack-keystone | 17:03 | |
| *** dstanek_zzz is now known as dstanek | 17:03 | |
| *** _bluev has joined #openstack-keystone | 17:07 | |
| *** jsavak has quit IRC | 17:07 | |
| *** jsavak has joined #openstack-keystone | 17:08 | |
| _bluev | is it possible with v2 or v3 to give out a specific service catalog for a tenant ? The catch-all service catalog would be given unless the user matches, something like that. | 17:09 |
| *** amcrn has joined #openstack-keystone | 17:09 | |
| *** harlowja_away is now known as harlowja | 17:09 | |
| *** tellesnobrega has joined #openstack-keystone | 17:10 | |
| _bluev | IM *tenant* matches | 17:10 |
| *** thedodd has joined #openstack-keystone | 17:12 | |
| openstackgerrit | Stuart McLaren proposed a change to openstack/keystone: enable multiple keystone-all worker processes https://review.openstack.org/42967 | 17:13 |
| openstackgerrit | Stuart McLaren proposed a change to openstack/keystone: Sync service module from oslo-incubator https://review.openstack.org/98839 | 17:13 |
| stevemar | was there a patch going around for devstack to rename the keystone apache site file to keystone.conf | 17:16 |
| stevemar | to account for apache 2.4 default behaviour | 17:16 |
| *** nkinder has joined #openstack-keystone | 17:17 | |
| *** thedodd has quit IRC | 17:21 | |
| morganfainberg | stevemar, not sure. | 17:28 |
| *** nsquare has joined #openstack-keystone | 17:29 | |
| *** rodrigods has joined #openstack-keystone | 17:34 | |
| *** rodrigods has joined #openstack-keystone | 17:34 | |
| *** amcrn has quit IRC | 17:36 | |
| *** raildo has joined #openstack-keystone | 17:39 | |
| *** amcrn has joined #openstack-keystone | 17:40 | |
| *** dolphm has quit IRC | 17:41 | |
| *** raildo has quit IRC | 17:44 | |
| *** dolphm has joined #openstack-keystone | 17:44 | |
| *** daneyon has quit IRC | 17:44 | |
| *** tellesnobrega has quit IRC | 17:44 | |
| *** rodrigods has quit IRC | 17:46 | |
| *** dolphm has quit IRC | 17:48 | |
| *** _bluev has quit IRC | 17:49 | |
| *** dolphm has joined #openstack-keystone | 17:49 | |
| *** marcoemorais has joined #openstack-keystone | 17:50 | |
| *** stevemar has quit IRC | 17:50 | |
| *** marcoemorais has quit IRC | 17:50 | |
| *** marcoemorais has joined #openstack-keystone | 17:51 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Allow for multiple PKI Style Providers https://review.openstack.org/98845 | 17:51 |
| *** stevemar has joined #openstack-keystone | 17:51 | |
| *** htruta has joined #openstack-keystone | 17:52 | |
| *** rodrigods has joined #openstack-keystone | 17:52 | |
| morganfainberg | stevemar, we should document the changes for making apache 2.4 work | 17:55 |
| morganfainberg | stevemar, at the very least | 17:55 |
| stevemar | morganfainberg, agreed | 17:55 |
| *** ajayaa has joined #openstack-keystone | 17:56 | |
| *** dstanek is now known as dstanek_zzz | 17:57 | |
| *** jsavak has quit IRC | 17:58 | |
| *** jsavak has joined #openstack-keystone | 17:59 | |
| *** tellesnobrega has joined #openstack-keystone | 18:00 | |
| htruta | stevemar: ping | 18:01 |
| *** afaranha has joined #openstack-keystone | 18:06 | |
| *** afaranha has left #openstack-keystone | 18:06 | |
| *** daneyon has joined #openstack-keystone | 18:07 | |
| morganfainberg | ayoung, re ^ the multiple PKI providers, should there be a PKI base class or an attribute? or do we not care about the simple cert stuff in the case of the UUID provider? | 18:10 |
| gabriel-bezerra | stevemar: I sent a patch renaming the apache site configuration files | 18:14 |
| gabriel-bezerra | https://review.openstack.org/#/c/95977/ | 18:17 |
| *** erecio has quit IRC | 18:19 | |
| *** erecio has joined #openstack-keystone | 18:19 | |
| ayoung | morganfainberg, that check can go away. Lets not force a base class for no real benefit. | 18:20 |
| ayoung | morganfainberg, the simple-cert extension might be useful in the absence of the token provider | 18:20 |
| ayoung | for example, if it were used with Oslo messaging | 18:21 |
| morganfainberg | ayoung, works for me. | 18:21 |
| morganfainberg | gabriel-bezerra, there is some odd issue going on with the new apache-services test. claiming apache2ctl isn't available | 18:22 |
| morganfainberg | gabriel-bezerra, http://logs.openstack.org/59/97059/6/check/check-tempest-dsvm-full-apache-services/323e72e/console.html i expect to look at that a little more in depth here shortly | 18:23 |
| morganfainberg | gabriel-bezerra, unless you hpapen to knoww of the top of your head | 18:23 |
| *** dims has quit IRC | 18:25 | |
| *** dims has joined #openstack-keystone | 18:25 | |
| *** ajayaa has quit IRC | 18:30 | |
| *** ChanServ sets mode: +o dolphm | 18:31 | |
| *** marcoemorais has quit IRC | 18:36 | |
| *** marcoemorais has joined #openstack-keystone | 18:37 | |
| *** thedodd has joined #openstack-keystone | 18:37 | |
| *** marcoemorais has quit IRC | 18:37 | |
| *** marcoemorais has joined #openstack-keystone | 18:37 | |
| *** sballe has joined #openstack-keystone | 18:39 | |
| *** ajayaa has joined #openstack-keystone | 18:41 | |
| morganfainberg | gabriel-bezerra, ah nvm, things look happier | 18:41 |
| morganfainberg | gabriel-bezerra, or not... | 18:41 |
| sballe | Hi, rkukura mentioned in the Neutron IRC that that there is some work in keystone around hierarchical tenants. is that true? I am looking for a feature that would allow me to "not share" a neutron network but still allow a group of tenant to access it. Currently "shared" means that all tenants can acess that Neutron network and of course not shared means that only one tenant can access it. | 18:43 |
| sballe | gyee, Do you know ? ^^^^ | 18:45 |
| *** afazekas has joined #openstack-keystone | 18:45 | |
| *** sbfox has joined #openstack-keystone | 18:48 | |
| *** dstanek_zzz is now known as dstanek | 18:49 | |
| gabriel-bezerra | morganfainberg: it is called on Ubuntu.. | 18:53 |
| morganfainberg | right. | 18:53 |
| gyee | sballe, domain should work for you, if we are talking about resource isolation | 18:53 |
| morganfainberg | gabriel-bezerra, it doesn't exist in the location specified. | 18:54 |
| gabriel-bezerra | function apache_site_config_for .. if is_ubuntu; then 107 | 18:54 |
| gabriel-bezerra | local apache_version=$(sudo /usr/sbin/apache2ctl -v | awk '/Server version/ {print $3}' | cu | 18:54 |
| gabriel-bezerra | t -f2 -d/) | 18:54 |
| gabriel-bezerra | lib/apache, line 108 | 18:54 |
| morganfainberg | gabriel-bezerra, right and http://logs.openstack.org/02/98302/3/check/check-tempest-dsvm-full-apache-services/dd25a5a/console.html.gz#_2014-06-06_19_44_44_810 | 18:54 |
| gabriel-bezerra | it should be called only if apache has been installed | 18:55 |
| morganfainberg | apache should installed in any/all cases for gate (tempest) because horizon uses it | 18:55 |
| morganfainberg | the link above is failing - i think ... because it doesn't exist in the right place? | 18:55 |
| sballe | gyee, the use case if that we have trusted VMs that belong to specific tenants e.g DBaaS, DNS, etc. and they need to get access to a Neutron shared Network unfortunatly shared means that everybody can get access to it. So we want to mark it as non shared for a given tenant which would emcompass the DBaaS, DNS tenant. Does this make sense? otherwise we can chat about it on the side | 18:55 |
| morganfainberg | i'm downloading a recent version of 12.04 to look into this | 18:56 |
| gabriel-bezerra | morganfainberg: I tried on both 12.04 and 14.04 and it worked. Maybbe that's something with some new version? | 18:56 |
| morganfainberg | gabriel-bezerra, or apache isn't installed at the time you're calling it | 18:56 |
| morganfainberg | gabriel-bezerra, actually... | 18:56 |
| morganfainberg | gabriel-bezerra, yep. | 18:58 |
| morganfainberg | gabriel-bezerra, you're calling it at source time of lib/keystone | 18:58 |
| morganfainberg | can't do it there. | 18:58 |
| morganfainberg | that will be run wayy too early in the stack.sh setup | 18:58 |
| morganfainberg | gabriel-bezerra, see how horizon is in a function https://github.com/openstack-dev/devstack/blob/master/lib/horizon#L125 'init_horizon' | 18:59 |
| morganfainberg | gabriel-bezerra, i'll propose a quick fix for this. | 19:00 |
| *** dstanek is now known as dstanek_zzz | 19:02 | |
| gabriel-bezerra | morganfainberg: ok, thanks, I can review if you wish | 19:02 |
| gabriel-bezerra | morganfainberg: keystone also has a init_keystone function | 19:02 |
| *** Chicago has joined #openstack-keystone | 19:02 | |
| morganfainberg | gabriel-bezerra, sounds good, i'll tag you on the review | 19:02 |
| *** Chicago has quit IRC | 19:02 | |
| *** Chicago has joined #openstack-keystone | 19:02 | |
| morganfainberg | gabriel-bezerra, right, but we use the config in a number of places, so it's a little different than horizon's use case. | 19:03 |
| *** erecio has quit IRC | 19:04 | |
| *** erecio has joined #openstack-keystone | 19:04 | |
| *** nsquare has quit IRC | 19:07 | |
| *** praneshp has quit IRC | 19:08 | |
| morganfainberg | gabriel-bezerra, https://review.openstack.org/#/c/98859 should do it | 19:11 |
| morganfainberg | gabriel-bezerra, setting up env locally to be 100% sure. | 19:12 |
| boris-42 | morganfainberg oh plugins works http://logs.openstack.org/36/98836/1/check/check-rally-dsvm-keystone/61ec97e/rally-plot/results.html.gz =) | 19:13 |
| morganfainberg | boris-42, nice | 19:13 |
| *** marekd has quit IRC | 19:15 | |
| gabriel-bezerra | morganfainberg: lgtm | 19:17 |
| *** marekd_ has joined #openstack-keystone | 19:22 | |
| *** praneshp has joined #openstack-keystone | 19:31 | |
| *** thedodd has quit IRC | 19:40 | |
| *** yfujioka has joined #openstack-keystone | 19:40 | |
| *** raildo has joined #openstack-keystone | 19:42 | |
| *** yfujioka has quit IRC | 19:51 | |
| *** dstanek_zzz is now known as dstanek | 19:54 | |
| *** dstanek is now known as dstanek_zzz | 20:05 | |
| *** amcrn has quit IRC | 20:05 | |
| *** morganfainberg is now known as morganfainberg_Z | 20:06 | |
| *** radez is now known as radez_g0n3 | 20:06 | |
| *** boris-42 has quit IRC | 20:08 | |
| *** ajayaa has quit IRC | 20:10 | |
| *** boris-42 has joined #openstack-keystone | 20:12 | |
| jaosorior | When are the keystone dates for the mid-cycle meetup? | 20:22 |
| *** nsquare has joined #openstack-keystone | 20:24 | |
| *** jsavak has quit IRC | 20:31 | |
| *** jsavak has joined #openstack-keystone | 20:31 | |
| *** dstanek_zzz is now known as dstanek | 20:33 | |
| bknudson | jaosorior: http://dolphm.com/openstack-keystone-hackathon-for-juno/ | 20:40 |
| jaosorior | Thanks | 20:40 |
| *** topol has quit IRC | 20:41 | |
| *** hrybacki has quit IRC | 20:45 | |
| *** gyee has quit IRC | 20:46 | |
| *** dstanek is now known as dstanek_zzz | 20:49 | |
| *** hrybacki_ has quit IRC | 20:50 | |
| *** stevemar has quit IRC | 20:57 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Default to PKIZ tokens https://review.openstack.org/98897 | 21:00 |
| *** marcoemorais has quit IRC | 21:00 | |
| *** marcoemorais has joined #openstack-keystone | 21:01 | |
| *** marcoemorais has quit IRC | 21:08 | |
| *** gyee has joined #openstack-keystone | 21:08 | |
| *** marcoemorais has joined #openstack-keystone | 21:08 | |
| *** NM has joined #openstack-keystone | 21:09 | |
| *** morganfainberg_Z is now known as morganfainberg | 21:10 | |
| *** praneshp has quit IRC | 21:11 | |
| *** jsavak has quit IRC | 21:15 | |
| *** jsavak has joined #openstack-keystone | 21:16 | |
| *** gordc1 has joined #openstack-keystone | 21:18 | |
| *** gordc has quit IRC | 21:18 | |
| *** gordc1 is now known as gordc | 21:18 | |
| *** gyee has quit IRC | 21:31 | |
| *** jsavak has quit IRC | 21:32 | |
| *** hrybacki has joined #openstack-keystone | 21:37 | |
| *** NM has quit IRC | 21:39 | |
| morganfainberg | hmmm | 21:40 |
| morganfainberg | ayoung, am i correct in assuming there is nothing preventing a delegation of trust to myself? [trustor and trustee are the same user_id]? | 21:40 |
| morganfainberg | i'm not seeing any check in the code that explicitly prohibits it... | 21:41 |
| *** dstanek_zzz is now known as dstanek | 21:41 | |
| *** NM has joined #openstack-keystone | 21:43 | |
| *** praneshp has joined #openstack-keystone | 21:50 | |
| *** dstanek is now known as dstanek_zzz | 21:51 | |
| *** NM has quit IRC | 21:52 | |
| *** NM has joined #openstack-keystone | 21:54 | |
| *** andreaf has joined #openstack-keystone | 21:57 | |
| *** dims_ has joined #openstack-keystone | 22:00 | |
| *** gyee has joined #openstack-keystone | 22:02 | |
| *** dims has quit IRC | 22:02 | |
| *** henrynash has quit IRC | 22:07 | |
| *** daneyon has quit IRC | 22:08 | |
| *** sbfox has quit IRC | 22:08 | |
| *** marcoemorais has quit IRC | 22:09 | |
| *** marcoemorais has joined #openstack-keystone | 22:10 | |
| *** marcoemorais has quit IRC | 22:11 | |
| *** marcoemorais has joined #openstack-keystone | 22:11 | |
| ayoung | morganfainberg, I can see that being a very powerful abstraction actually | 22:12 |
| morganfainberg | ayoung, i have a use case right now for it | 22:12 |
| *** marcoemorais has quit IRC | 22:12 | |
| *** marcoemorais has joined #openstack-keystone | 22:13 | |
| ayoung | morganfainberg, its the only way you can get a token with a reduced set of roles: | 22:13 |
| morganfainberg | ayoung, not through the traditional trust auth model, (initially through ec2) but i also think it would be great to support as a 1st order delegation method | 22:13 |
| morganfainberg | ayoung, ++ exactly | 22:13 |
| *** nkinder has quit IRC | 22:13 | |
| morganfainberg | ayoung, i don't see anything that prevents it, but i'm setting up a test env right now to confirm it works | 22:14 |
| morganfainberg | if so, i'm going to add a test to make sure it keeps working | 22:14 |
| ayoung | morganfainberg, pretty sure I've used it before, but, sure, go ahead...would be a good thing to have made explicit | 22:14 |
| morganfainberg | exactly. | 22:15 |
| morganfainberg | cool, was making sure i wasn't missing some design bit that says "we should never do this ever" | 22:15 |
| *** CaioBrentano1 has joined #openstack-keystone | 22:23 | |
| *** CaioBrentano has quit IRC | 22:25 | |
| *** gordc has quit IRC | 22:25 | |
| *** marcoemorais has quit IRC | 22:26 | |
| *** marcoemorais has joined #openstack-keystone | 22:26 | |
| *** marcoemorais has quit IRC | 22:27 | |
| *** marcoemorais has joined #openstack-keystone | 22:27 | |
| *** NM has quit IRC | 22:28 | |
| *** NM has joined #openstack-keystone | 22:36 | |
| openstackgerrit | ChangBo Guo(gcb) proposed a change to openstack/python-keystoneclient: Don't use mock non-exist method assert_called_once https://review.openstack.org/93839 | 22:37 |
| *** NM has quit IRC | 22:38 | |
| *** dstanek_zzz is now known as dstanek | 22:42 | |
| *** sballe_ has joined #openstack-keystone | 22:46 | |
| *** jamielennox|away is now known as jamielennox | 22:47 | |
| *** sballe has quit IRC | 22:47 | |
| *** hrybacki has quit IRC | 22:47 | |
| *** dstanek is now known as dstanek_zzz | 22:52 | |
| *** alanvitor has quit IRC | 22:59 | |
| *** hrybacki has joined #openstack-keystone | 23:10 | |
| *** sbfox has joined #openstack-keystone | 23:11 | |
| *** sbfox has quit IRC | 23:11 | |
| *** sbfox1 has joined #openstack-keystone | 23:11 | |
| *** amcrn has joined #openstack-keystone | 23:13 | |
| *** nkinder has joined #openstack-keystone | 23:24 | |
| *** morganfainberg is now known as morganfainberg_Z | 23:25 | |
| openstackgerrit | Richard Megginson proposed a change to openstack/keystone: test_user_mixed_case_attribute fails - mail, not email https://review.openstack.org/94668 | 23:31 |
| *** jaosorior has quit IRC | 23:32 | |
| jamielennox | gyee: ping | 23:33 |
| *** morganfainberg_Z is now known as morganfainberg | 23:42 | |
| *** dstanek_zzz is now known as dstanek | 23:43 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Remove _factory methods from auth plugins https://review.openstack.org/81985 | 23:43 |
| gyee | jamielennox, here | 23:43 |
| gyee | patch looks good, lemme do the needful | 23:44 |
| jamielennox | hey gyee, i just wanted to see if you'd had a go at converting barbican shell to those keystoneclient patches | 23:44 |
| *** rodrigods_ has joined #openstack-keystone | 23:44 | |
| jamielennox | no, that one looks like it's failing for an oauth issue | 23:44 |
| jamielennox | TypeError: get_oauth_params() takes exactly 2 arguments (1 given) | 23:45 |
| jamielennox | hmm, get_oauth_params is an oauthlib thing though, not a problem of ours, stevemar isn't here... | 23:45 |
| gyee | jamielennox, I haven't been able to work on the barbican client patch the last couple of days | 23:47 |
| jamielennox | ok, i want to pull some of these patches out of WIP soon, i think the from_config stuff is good, but i want to make sure the CLI stuff and the auth_params stuff makes sense | 23:48 |
| gyee | jamielennox, I think we need the auth_params stuff, but I think we may run into some backward compatibility issues though | 23:49 |
| jamielennox | oh? | 23:49 |
| gyee | for example, --os-cert versus os-cert-file | 23:49 |
| gyee | I've see quite a few of these | 23:49 |
| gyee | seen | 23:50 |
| gyee | and the underscores, like --os-tenant-id versus --os_tenant_id | 23:50 |
| jamielennox | gyee: oh, i have a slightly newer patch than is up | 23:50 |
| gyee | --os-auth-version | 23:50 |
| hrybacki | hey all, does anyone have any pointers to docs explaining the structure of keystone extensions? | 23:52 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Plugin loading from config objects https://review.openstack.org/79542 | 23:53 |
| morganfainberg | hrybacki, in what manner? we have an example extension in keystone/contrib/example that is a startingplace that can be used to develop an extension | 23:53 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Session loading from conf https://review.openstack.org/95015 | 23:53 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Session loading from CLI options https://review.openstack.org/95678 | 23:53 |
| *** dstanek is now known as dstanek_zzz | 23:53 | |
| hrybacki | morganfainberg++ I'll look at that thanks. I'm working with ayoung on the revocation events extension -- first time working on keystone really -- still figuring out how everything is pieced together | 23:53 |
| jamielennox | gyee: so if you look at that first one: https://review.openstack.org/79542 i added a deprecated_opts param | 23:53 |
| morganfainberg | hrybacki, cool! | 23:54 |
| jamielennox | that will help with the transition for config, it should be relatively easy to do the same thing for CLI | 23:54 |
| jamielennox | actually from memory CLI is easier because you can create the parser and then add all the deprecated stuff you need afterwards | 23:56 |
| jamielennox | gyee: plugin loading from conf is completely new so i don't think i need to worry about that one | 23:56 |
| gyee | jamielennox, this one? https://review.openstack.org/#/c/95678/2/keystoneclient/session.py | 23:57 |
| gyee | we still ned --cert-file | 23:57 |
| gyee | --key-file | 23:57 |
| jamielennox | you should be able to add that afterwards | 23:57 |
| gyee | right, I agree | 23:58 |
| gyee | we just need to get the framework straighten out at this point | 23:58 |
| jamielennox | yep, so when you add a CLI param you can specify supress=True so that it doesn't show up in --help and target='XXX' as to what variable the result is | 23:59 |
| jamielennox | so i was expecting that you would load all the good ones from the session object and then add whatever you need to maintain compatability in addition | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!