| *** nellysmitt has quit IRC | 00:00 | |
| kfox1111 | I was able to authenticate before being on a project but the dashboard kicks you out saying you have no projects. | 00:00 |
|---|---|---|
| morganfainberg | icehouse was a street iirc | 00:00 |
| morganfainberg | grizzly is the state animal | 00:00 |
| lhcheng | stevemar: thanks for the link | 00:00 |
| morganfainberg | kilo was kilogram near paris | 00:00 |
| lhcheng | morganfainberg: yeah, icehouse is a street with a lot of historical landmarks | 00:01 |
| morganfainberg | kfox1111, weird. | 00:01 |
| morganfainberg | so once you granted a role it go.. wait did you grant the role and then got kicked out? | 00:02 |
| morganfainberg | did you by chance re-auth after granting a role? | 00:02 |
| morganfainberg | or relogin | 00:02 |
| *** zz_avozza is now known as avozza | 00:02 | |
| morganfainberg | because there is some wierdness on token revocations when you add/remove roles | 00:02 |
| morganfainberg | not sure when we hammered out the most recent of those bugs | 00:02 |
| kfox1111 | I did relogin. | 00:04 |
| kfox1111 | ok. just created another domain. sql backed. created a project/user in it. user has _member_ role on the project. | 00:05 |
| kfox1111 | same error. | 00:05 |
| kfox1111 | little red box in dashboard on login on overview "Error: Unauthorized: Unable to retrieve usage information." | 00:06 |
| kfox1111 | so that rules out ldap. | 00:06 |
| morganfainberg | ok i'm still poking at it | 00:07 |
| morganfainberg | oh FFS | 00:12 |
| morganfainberg | centos pip does bad things | 00:13 |
| morganfainberg | *great* | 00:13 |
| kfox1111 | hmm... do I need to go update nova configs to point to v3? | 00:15 |
| kfox1111 | 2015-02-05 16:14:44.294 7155 INFO nova.osapi_compute.wsgi.server [-] 172.20.96.65 "GET /v2/498dc14329754911894125afda4f2730/servers/detail HTTP/1.1" status: 401 len: 259 time: 0.4377279 | 00:15 |
| kfox1111 | or is the v2 there nova's api? | 00:15 |
| amerine | Thats novas | 00:15 |
| morganfainberg | no thats nova's v2 api | 00:15 |
| *** abhirc has joined #openstack-keystone | 00:16 | |
| kfox1111 | ok. | 00:16 |
| *** samueldmq_ has joined #openstack-keystone | 00:16 | |
| kfox1111 | hmm... GET /v2.0/tokens/0fc453145fff46e3a6df6e93d748d60f HTTP/1.1" 401 | 00:16 |
| kfox1111 | in keystone's logs... | 00:16 |
| morganfainberg | 401 means a token is expired/invalie | 00:17 |
| morganfainberg | invalid | 00:17 |
| morganfainberg | not the token you're asking about | 00:17 |
| morganfainberg | the service token. | 00:17 |
| kfox1111 | k.... | 00:17 |
| morganfainberg | did you move your service users to non-default domain? | 00:17 |
| morganfainberg | e.g. nova's user? | 00:17 |
| kfox1111 | no. still in the default. | 00:17 |
| kfox1111 | didn't want to break things. | 00:17 |
| morganfainberg | yeah there is a bug about that | 00:17 |
| morganfainberg | where keystonemiddleware [it's fixed just not released iirc] can't talk v3 for service tokens | 00:18 |
| kfox1111 | a bug that I should move it, or I shouldnt? :) | 00:18 |
| morganfainberg | don't move it ;) | 00:18 |
| kfox1111 | ok. | 00:18 |
| morganfainberg | so can the nova user login to keystone? | 00:18 |
| morganfainberg | with the username/password defined for middleware? | 00:19 |
| morganfainberg | this is *sounding* like an issue with that user unable to validate the token[s] | 00:19 |
| kfox1111 | if I login as admin, I can see all the instances. | 00:19 |
| kfox1111 | in the default domain. | 00:19 |
| morganfainberg | try logging in with the nova user | 00:19 |
| morganfainberg | 's credentials | 00:20 |
| kfox1111 | k. | 00:20 |
| morganfainberg | like via keystonelcient? | 00:20 |
| morganfainberg | or just with curl | 00:20 |
| morganfainberg | and i want you to do get /v2.0/tokens/<token> using X-Auth-Token from nova's user | 00:20 |
| kfox1111 | hmm... auth_version=v2.0 is set in the config file explicitly... | 00:21 |
| kfox1111 | do I need to set that to 3? | 00:21 |
| morganfainberg | nah, that should be fine | 00:21 |
| kfox1111 | k.... | 00:21 |
| morganfainberg | nova should be able to auth with v3 tokens i think.. | 00:21 |
| morganfainberg | erm v2 | 00:21 |
| morganfainberg | i oh | 00:21 |
| morganfainberg | oh | 00:21 |
| morganfainberg | yeah that needs to be auth_version=3.0 | 00:21 |
| morganfainberg | if the token you're asking for information for is a v3 token on the v2 interface it wont work | 00:22 |
| morganfainberg | because v2 doesn't know about domains | 00:22 |
| kfox1111 | hmm... k. let me try that. | 00:22 |
| kfox1111 | the nova service user worked ok btw. | 00:22 |
| *** pnavarro has quit IRC | 00:23 | |
| kfox1111 | k. set v3, restarted just openstack-nova-api, | 00:24 |
| kfox1111 | the test user is still failing to talk to nova. | 00:24 |
| morganfainberg | do you have caching enabled? e.g. memcached for middleware? | 00:24 |
| morganfainberg | you might want to logout/login with that user | 00:25 |
| morganfainberg | new clean token | 00:25 |
| kfox1111 | for testing, I'm using the command line. should be fresh. | 00:25 |
| morganfainberg | nova cli? | 00:25 |
| kfox1111 | openstack server list and openstack image list. | 00:25 |
| kfox1111 | the former fails, the latter works. | 00:25 |
| morganfainberg | then something is wrong with either your policy.json or the roles for the user | 00:25 |
| morganfainberg | well maybe | 00:26 |
| morganfainberg | ok check ekystone's log | 00:26 |
| kfox1111 | possible. does nova's policy need updating? | 00:26 |
| morganfainberg | for your token | 00:26 |
| morganfainberg | see if keystone is still saying 401 | 00:26 |
| morganfainberg | and it should be asking on v3 now | 00:26 |
| morganfainberg | fwiw, keystone shouldn't be saying 401 afaik unless the nova service user is broken / unable to auth | 00:27 |
| kfox1111 | these are all the logs durring the openstack server list command in keystone.log | 00:27 |
| kfox1111 | http://pastebin.com/E3mxr6xV | 00:27 |
| morganfainberg | can you look in the DB and see which user token fc43d49a4d5d4698ae53f5ea54a18a47 is for? | 00:28 |
| morganfainberg | is that nova's user or your test user? | 00:28 |
| kfox1111 | hmmmm.. under the neutron section of nova's config, I see: | 00:28 |
| kfox1111 | admin_auth_url=http://172.20.96.65:35357/v2.0 | 00:28 |
| kfox1111 | k. | 00:28 |
| morganfainberg | oh yeah nova + neutron + v3 does not work right yet | 00:29 |
| morganfainberg | afaik | 00:29 |
| morganfainberg | jamielennox can speak a bit more to that | 00:29 |
| morganfainberg | it is a gap. | 00:29 |
| kfox1111 | what does that mean? :) | 00:29 |
| kfox1111 | how wide a gap? | 00:29 |
| morganfainberg | it means nova can't talk to neutron with v3 | 00:29 |
| morganfainberg | v3 keystone | 00:29 |
| morganfainberg | it doesn't work | 00:29 |
| kfox1111 | arg. | 00:29 |
| kfox1111 | is there a patch? | 00:30 |
| morganfainberg | there is a bug-fix somewhere to solve it | 00:30 |
| kfox1111 | would that affefct this? | 00:30 |
| *** markvoelker has quit IRC | 00:30 | |
| morganfainberg | if nova is meant to get info back and it's getting a 401 | 00:30 |
| morganfainberg | yeah. | 00:30 |
| *** markvoelker has joined #openstack-keystone | 00:31 | |
| kfox1111 | k. | 00:31 |
| kfox1111 | hmm.... | 00:31 |
| * kfox1111 searches around for the patch. | 00:31 | |
| morganfainberg | so the fix is somewere i think in this list: https://review.openstack.org/#/q/owner:%22Jamie+Lennox%22+status:open,n,z | 00:31 |
| * morganfainberg is trying to figure out which one it is | 00:31 | |
| morganfainberg | this might be it: https://review.openstack.org/#/c/136931/ | 00:31 |
| *** dims__ has quit IRC | 00:31 | |
| * morganfainberg did not claim this would be an easy fix | 00:32 | |
| morganfainberg | kfox1111, it was blocked on waiting for a new neutronclient | 00:33 |
| kfox1111 | the review makes it seem like they are working around a neutronclient bug in addition, and the comment makes it sound like they should not do the workaroud too? | 00:34 |
| kfox1111 | in the mean time, the patch might work as is? | 00:34 |
| morganfainberg | kfox1111, those comments are from before the fix. | 00:34 |
| morganfainberg | kfox1111, probably not, as that patch is against master nova | 00:34 |
| morganfainberg | not sure how diverged that is from juno | 00:35 |
| morganfainberg | kfox1111, before the fix / release of neutronclient | 00:35 |
| morganfainberg | new neutronclient means they don't have to patch around the bug | 00:35 |
| kfox1111 | can find out, if I can figure out how to get the patch out. :) | 00:35 |
| *** markvoelker has quit IRC | 00:35 | |
| kfox1111 | the comment was about a proxy around the client though, which I took to mean the proxy itself wasnt needed if they had a new client? | 00:36 |
| bknudson | jamielennox: I think v3 test_create is broken now. | 00:37 |
| morganfainberg | kfox1111, likely | 00:37 |
| morganfainberg | kfox1111, but jamielennox should know more about it | 00:37 |
| morganfainberg | kfox1111, sorry for the winding road to get hear >.< | 00:37 |
| kfox1111 | sokay. making progress though. :) | 00:37 |
| kfox1111 | lets see... I need to pull a nova git, and the patch... | 00:37 |
| * morganfainberg is going to need to go run for some errands | 00:37 | |
| kfox1111 | and the company's firewall is in the way. :/ | 00:38 |
| bknudson | maybe need to revert https://review.openstack.org/#/c/148499/ | 00:38 |
| kfox1111 | ok. thanks for all the help. | 00:38 |
| bknudson | test_create could really use a docstring! | 00:38 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Revert "make req_ref doesn't require id" https://review.openstack.org/153433 | 00:40 |
| bknudson | jamielennox: morganfainberg: ^ | 00:40 |
| morganfainberg | bknudson, looking | 00:41 |
| bknudson | jamielennox: morganfainberg: look at https://review.openstack.org/#/c/115770/29/keystoneclient/tests/v3/test_projects.py -- line 68 | 00:41 |
| morganfainberg | bknudson, hm. | 00:42 |
| bknudson | the simulated server response should have "id": "whatever", so the returned project should already have a .id field. | 00:42 |
| * morganfainberg comments about tracking API responses and reality in two separate repos | 00:43 | |
| bknudson | more fixtures would be nice. | 00:43 |
| morganfainberg | bknudson, +++++++++ | 00:43 |
| morganfainberg | and especially tests that confirm fixture looks like reality | 00:44 |
| morganfainberg | ok i need to make a phone call. will check that patch / revert whne i'm done | 00:44 |
| bknudson | I'll keep looking at it. | 00:44 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Revert "make req_ref doesn't require id" https://review.openstack.org/153433 | 00:46 |
| bknudson | hmm... maybe that's not right... turns out everything is just broken. | 00:49 |
| kfox1111 | ok... got the patch, got the juno version of the file, and got trunks.... | 00:49 |
| bknudson | morganfainberg: jamielennox: I'm thinking that commit wasn't the problem and that test_create is just plain broken all-around. | 00:50 |
| openstackgerrit | Merged openstack/keystonemiddleware: make audit event scoped to request session and not middleware https://review.openstack.org/149300 | 00:50 |
| *** ljfisher has quit IRC | 00:51 | |
| *** mgarza has quit IRC | 00:52 | |
| kfox1111 | hmm.. fairly different. :/ | 00:52 |
| *** andreaf has quit IRC | 00:52 | |
| *** andreaf has joined #openstack-keystone | 00:53 | |
| kfox1111 | yeah.... the patch is pretty different then what juno's got. :/ | 00:53 |
| kfox1111 | lame. :/ | 00:54 |
| kfox1111 | alright.... well, this cloud's going to have to stay v2 then, and once we get to kilo, we can reevaluate. :/ | 00:54 |
| kfox1111 | thanks again for all the help. | 00:55 |
| bknudson | kfox1111: you're disabling v3? | 00:59 |
| *** sld has quit IRC | 01:00 | |
| *** markvoelker has joined #openstack-keystone | 01:01 | |
| *** topol has joined #openstack-keystone | 01:04 | |
| *** ChanServ sets mode: +v topol | 01:04 | |
| *** dims__ has joined #openstack-keystone | 01:05 | |
| *** markvoelker has quit IRC | 01:06 | |
| *** abhirc has quit IRC | 01:13 | |
| *** raildo_ has quit IRC | 01:13 | |
| jamielennox | sorry - i'm timezone challenged for the next week or so - what's up | 01:14 |
| *** thedodd has quit IRC | 01:15 | |
| kfox1111 | bknudson: gota. no nova+neutron support. :/ | 01:15 |
| bknudson | kfox1111: so you're removing v3 from the keystone server pipeline? | 01:15 |
| kfox1111 | no. just disabling the test domains and removing multidomain from the dashboard. | 01:16 |
| jamielennox | kfox1111: i've no reason to believe that the nova to neutron patch wouldn't still work | 01:16 |
| kfox1111 | gota figure out how to get service accounts and ldap to play nice in the same domain now. :/ | 01:16 |
| bknudson | jamielennox: was looking at https://review.openstack.org/#/c/115770/29/keystoneclient/tests/v3/test_projects.py (line 68) and noticed that test_create() is incorrect all around... | 01:16 |
| bknudson | I thought it might be due to the recent change to test_create, but turns out it's always been broken. | 01:17 |
| kfox1111 | jamielennox: With pure juno? | 01:17 |
| kfox1111 | the files are pretty different. | 01:17 |
| jamielennox | bknudson: there was that change recently that i remember going through and thinking it was ugly | 01:17 |
| jamielennox | kfox1111: i don't know about pure juno, these service to service communication patches are the only ones i've done for nova so i don't really know where the changes are coming form | 01:18 |
| bknudson | jamielennox: yes... but it's always been broken. The server is expected to return objects with the "id" set, and test_create doesn't simulate it. | 01:18 |
| kfox1111 | the patch is against trunk. juno's api.py is quite a bit different then trunk's api.py. | 01:19 |
| kfox1111 | I could spend a few days and try and unwind it all, but it still might not work. | 01:19 |
| jamielennox | kfox1111: ok, it probably requires a more recent keystoneclient than was available at juno release timeframe as well if you're limited there too | 01:19 |
| bknudson | kfox1111: are you putting the service users in the 'default' domain? | 01:20 |
| kfox1111 | no other choice with v2 api. | 01:20 |
| bknudson | horizon doesn't support logging in with a user in a different domain? | 01:20 |
| kfox1111 | cant use v3 with nova+neutron. :/ | 01:20 |
| jamielennox | bknudson: i thought that was what new_ref did, it always had a 'id' field set and for the req_ref it was popping the id - so that the return value from the request was exactly the same plus id | 01:20 |
| kfox1111 | yeah, I think we're going to have to wait for kilo on this one. :/ | 01:21 |
| bknudson | jamielennox: http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/tests/v3/utils.py#n211 | 01:21 |
| kfox1111 | This particular cloud's a 6 month pilot, so its not the end of the world. | 01:22 |
| kfox1111 | After the pilots over, we can burn it, then stand up a kilo with domains. | 01:22 |
| bknudson | so with the latest change you can pass req_ref and you'll get an entity with .id.... | 01:23 |
| bknudson | but then it does self.assertEntityRequestBodyIs(req_ref) -- this is wrong... | 01:23 |
| bknudson | because the request doesn't have "id". | 01:23 |
| jamielennox | bknudson: that bit's ok because you're testing request body and it shouldn't have id | 01:23 |
| jamielennox | it's the response that should have it | 01:24 |
| *** lhcheng has quit IRC | 01:24 | |
| jamielennox | bknudson: so all that stub_url stuff made sense when i was trying to smooth over the warts of httpretty, i'd almost prefer to just do it directly with requests-mock now | 01:24 |
| *** tellesnobrega_ has joined #openstack-keystone | 01:25 | |
| jamielennox | i think it would be easier to understand | 01:25 |
| bknudson | jamielennox: but it's not right -- you want the server to return "id", but the request doesn't have "id"... so self.assertEntityRequestBodyIs(req_ref) would assert that the request has "id" | 01:25 |
| bknudson | the request shouldn't have "id" | 01:25 |
| jamielennox | req_ref shouldn't have id | 01:26 |
| jamielennox | req_ref is the request dictionary so RequestBodyIs(req_ref) makes sense | 01:26 |
| *** kfox1111 has quit IRC | 01:26 | |
| bknudson | self.stub_entity('POST', entity=req_ref, status_code=201) -- isn't req_ref going to be the server response? | 01:27 |
| jamielennox | the problem would appear to be passing entity=req_ref | 01:27 |
| jamielennox | i think that should be entity=ref | 01:27 |
| jamielennox | that's what | 01:28 |
| jamielennox | req_ref = ref.copy() | 01:28 |
| jamielennox | req_ref.pop('id') | 01:28 |
| bknudson | that makes more sense. | 01:28 |
| jamielennox | is doing | 01:28 |
| jamielennox | the request ref is the same as the returned ref minus the id field | 01:28 |
| bknudson | let me try that out. | 01:28 |
| bknudson | everything broke: NoMockAddress: No mock address: GET http://127.0.0.1:5000/v3/credentials/bd85178be8854d69aabe7cd74ae31369 | 01:30 |
| *** openstack has joined #openstack-keystone | 01:32 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 01:35 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Implements subtree_as_ids and parents_as_ids https://review.openstack.org/150078 | 01:35 |
| rodrigods | bknudson, ^ had to follow your refactoring suggestion :) | 01:35 |
| bknudson | rodrigods: great... let me see if I can figure out what the deal is with test_create. | 01:36 |
| rodrigods | bknudson, lots of pops and .copy() there | 01:37 |
| rodrigods | hard to follow sometimes | 01:37 |
| bknudson | rodrigods: it's wrong... the server is expected to return an object with "id" in it, so you shouldn't have had to set project.id. | 01:38 |
| rodrigods | bknudson, yeah... I thought that after a comment in our patch | 01:39 |
| rodrigods | your comment, actually | 01:39 |
| morganfainberg | bug 1260080 | 01:40 |
| openstack | bug 1260080 in OpenStack Security Advisory "[OSSA 2014-006] Trustee token revocations with memcache backend (CVE-2014-2237)" [High,Fix released] https://launchpad.net/bugs/1260080 - Assigned to Tristan Cacqueray (tristan-cacqueray) | 01:40 |
| TempLPBugBot | bug 1260080 in OpenStack Security Advisory "[OSSA 2014-006] Trustee token revocations with memcache backend (CVE-2014-2237)" (affected: 1, heat: 262) [High,Fix released] https://launchpad.net/bugs/1260080 - Assigned to Tristan Cacqueray (tristan-cacqueray) | 01:40 |
| morganfainberg | awesome temp bug bot gets to die | 01:40 |
| *** TempLPBugBot has quit IRC | 01:41 | |
| *** abhirc has joined #openstack-keystone | 01:44 | |
| *** markvoelker has joined #openstack-keystone | 01:44 | |
| *** alex_xu has quit IRC | 01:44 | |
| *** alex_xu has joined #openstack-keystone | 01:46 | |
| *** alex_xu has quit IRC | 01:48 | |
| *** r-daneel has quit IRC | 01:51 | |
| bknudson | well, I'm not going to be able to figure this out today... maybe tomorrow. | 01:51 |
| *** rwsu is now known as rwsu-afk | 01:53 | |
| *** nellysmitt has joined #openstack-keystone | 01:56 | |
| *** nellysmitt has quit IRC | 02:00 | |
| openstackgerrit | wanghong proposed openstack/keystone-specs: implement timestamp for Project, Domain, Role https://review.openstack.org/153114 | 02:01 |
| *** erkules_ has joined #openstack-keystone | 02:09 | |
| *** erkules has quit IRC | 02:12 | |
| *** davechen_ has joined #openstack-keystone | 02:18 | |
| *** _cjones_ has quit IRC | 02:25 | |
| *** _cjones_ has joined #openstack-keystone | 02:26 | |
| openstackgerrit | Merged openstack/oslo.policy: Add entry points for option discovery https://review.openstack.org/153090 | 02:26 |
| *** _cjones_ has quit IRC | 02:30 | |
| *** tqtran has quit IRC | 02:30 | |
| *** ajayaa has joined #openstack-keystone | 02:36 | |
| openstackgerrit | wanghong proposed openstack/keystone-specs: implement timestamp for Project, Role https://review.openstack.org/153114 | 02:40 |
| *** harlowja is now known as harlowja_away | 02:48 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Privatize parsing classes https://review.openstack.org/153149 | 02:50 |
| *** spandhe has quit IRC | 02:51 | |
| *** nellysmitt has joined #openstack-keystone | 03:02 | |
| *** ajayaa has quit IRC | 03:02 | |
| *** nellysmitt has quit IRC | 03:06 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Make use of private modules https://review.openstack.org/153310 | 03:14 |
| *** dims__ has quit IRC | 03:15 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Do not use global enforcer for tests https://review.openstack.org/153321 | 03:17 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Stop shouting test attribute names https://review.openstack.org/153322 | 03:18 |
| *** ljfisher has joined #openstack-keystone | 03:18 | |
| *** avozza is now known as zz_avozza | 03:29 | |
| *** r-daneel has joined #openstack-keystone | 03:31 | |
| *** r-daneel has quit IRC | 03:35 | |
| *** mattfarina has joined #openstack-keystone | 03:40 | |
| *** lhcheng has joined #openstack-keystone | 03:44 | |
| *** r-daneel has joined #openstack-keystone | 03:50 | |
| *** samueldmq_ has quit IRC | 03:52 | |
| *** richm has quit IRC | 03:52 | |
| *** dobson has quit IRC | 04:04 | |
| *** lvh has quit IRC | 04:04 | |
| *** tellesnobrega_ has quit IRC | 04:07 | |
| *** lvh has joined #openstack-keystone | 04:09 | |
| *** dobson has joined #openstack-keystone | 04:16 | |
| *** dobson has quit IRC | 04:22 | |
| *** lhcheng has quit IRC | 04:26 | |
| *** zz_avozza is now known as avozza | 04:27 | |
| *** topol has quit IRC | 04:32 | |
| *** avozza is now known as zz_avozza | 04:37 | |
| *** EmilienM|afk has quit IRC | 04:45 | |
| *** EmilienM has joined #openstack-keystone | 04:46 | |
| openstackgerrit | Merged openstack/keystone-specs: Provide option to disable storing of extra attributes in SQL https://review.openstack.org/151939 | 04:47 |
| *** mattfarina has quit IRC | 04:51 | |
| *** zzzeek has quit IRC | 04:58 | |
| *** spandhe has joined #openstack-keystone | 05:05 | |
| *** ChanServ changes topic to "Release Blockers: https://gist.github.com/dolph/651c6a1748f69637abd0 | Kilo Spec Proposal Freeze Has Passed | Client/Middleware Next release planned for Feb 9th, please review code." | 05:05 | |
| *** nellysmitt has joined #openstack-keystone | 05:06 | |
| *** jimbaker has quit IRC | 05:10 | |
| *** nellysmitt has quit IRC | 05:11 | |
| *** jimbaker has joined #openstack-keystone | 05:14 | |
| *** jimbaker has quit IRC | 05:14 | |
| *** jimbaker has joined #openstack-keystone | 05:14 | |
| *** _cjones_ has joined #openstack-keystone | 05:26 | |
| *** _cjones_ has quit IRC | 05:32 | |
| *** ajayaa has joined #openstack-keystone | 05:33 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Make use of private modules https://review.openstack.org/153310 | 05:38 |
| *** harlowja_away has quit IRC | 05:38 | |
| *** ljfisher has quit IRC | 05:38 | |
| *** ljfisher has joined #openstack-keystone | 05:40 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Do not use global enforcer for tests https://review.openstack.org/153321 | 05:41 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Stop shouting test attribute names https://review.openstack.org/153322 | 05:43 |
| *** jasondotstar has quit IRC | 05:43 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/152795 | 06:04 |
| morganfainberg | stevemar, dstanek, bknudson, https://review.openstack.org/#/c/153114/4/specs/kilo/model-timestamps.rst this should be something we support [it's been on the "nice to haves" for a looong time] | 06:16 |
| morganfainberg | and is a relatively small changeset. | 06:16 |
| morganfainberg | code wise. | 06:16 |
| morganfainberg | since oslo.db already supports it. | 06:16 |
| *** spandhe has quit IRC | 06:17 | |
| *** gsilvis has quit IRC | 06:18 | |
| *** gsilvis has joined #openstack-keystone | 06:19 | |
| *** dobson has joined #openstack-keystone | 06:23 | |
| *** ljfisher has quit IRC | 06:23 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Stop shouting test attribute names https://review.openstack.org/153322 | 06:27 |
| *** rushiagr_away is now known as rushiagr | 06:29 | |
| *** xxj has quit IRC | 06:29 | |
| *** xxj has joined #openstack-keystone | 06:30 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Remove oslo.concurrency from requirements https://review.openstack.org/153480 | 06:31 |
| *** dobson has quit IRC | 06:33 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Sync test-requirements with global requirements https://review.openstack.org/153481 | 06:34 |
| *** openstackgerrit has quit IRC | 06:35 | |
| *** openstackgerrit has joined #openstack-keystone | 06:35 | |
| *** tsufiev_ is now known as tsufiev | 06:37 | |
| *** dobson has joined #openstack-keystone | 06:38 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Upgrade hacking to >=0.10.0 https://review.openstack.org/153482 | 06:43 |
| *** dobson has quit IRC | 06:45 | |
| *** dobson has joined #openstack-keystone | 06:48 | |
| stevemar | morganfainberg, yeah that one looks fine, though i don't like the fact that we are apparently losing domains :) | 06:49 |
| morganfainberg | stevemar, we're not "losing domains" | 06:49 |
| morganfainberg | or you mean in that spec? | 06:49 |
| stevemar | i mean | 06:50 |
| *** pnavarro has joined #openstack-keystone | 06:50 | |
| stevemar | According to the reseller spec[2], the Domain model will be removed, so this25 | 06:50 |
| stevemar | spec only implements timestamp for Project and Role. | 06:50 |
| morganfainberg | so lets fixed that verbiage | 06:51 |
| morganfainberg | lets fix* | 06:51 |
| ajayaa | morganfainberg, I saw your -2 on https://review.openstack.org/#/c/148521/. The reason for this is clear. I was hoping to get some comments on the spec itself. | 06:51 |
| stevemar | whats the difference between `python setup.py test` vs `python setup.py testr` | 06:52 |
| morganfainberg | dunno | 06:52 |
| ajayaa | morganfainberg, We are working on a POC of this idea. | 06:52 |
| morganfainberg | ajayaa, sure! if it doesn't land in kilo it might be ready for L. but i am open to any of the specs that got the SPF -2 to request an exception for inclusion into kilo | 06:53 |
| morganfainberg | ajayaa, just send a message to the dev list with that request (include [keystone] in the subject) | 06:53 |
| morganfainberg | ajayaa, but the idea is to limit the scope of kilo to what we can accomplish and at this point we have limited time until feature freeze (m3) | 06:53 |
| ajayaa | morganfainberg, I don't think it will lend on kilo because it is dependent on something which is not ready yet. | 06:54 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Remove oslo.concurrency from requirements https://review.openstack.org/153480 | 06:54 |
| morganfainberg | ajayaa, sounds good then i'll look for it in L :) and i'm interested to the POC as you get it done | 06:54 |
| ajayaa | Just few comments on the spec would be helpful. | 06:54 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Sync test-requirements with global requirements https://review.openstack.org/153481 | 06:54 |
| ajayaa | morganfainberg, thanks. | 06:54 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Upgrade hacking to >=0.10.0 https://review.openstack.org/153482 | 06:54 |
| morganfainberg | most of my comments are around NoSQL doesn't eliminate the single-point-of-failure | 06:55 |
| morganfainberg | but i am open to a NoSQL driver | 06:55 |
| morganfainberg | i only caution you that mongodb (if that is your choice) has licensing oddities that makes it hard to use in some cases | 06:56 |
| ajayaa | Thanks. We are hoping that we will push for NoSql driver in all the components. That's the long term plan. | 06:56 |
| ajayaa | nope. Dynamodb like api on top of cassandra. | 06:56 |
| morganfainberg | apache2? | 06:56 |
| ajayaa | There is stackforge project MagnetoDB. | 06:56 |
| ajayaa | Yes. | 06:56 |
| morganfainberg | that's an easy license to know is compatible | 06:56 |
| morganfainberg | awesome | 06:56 |
| *** afazekas has joined #openstack-keystone | 06:57 | |
| ajayaa | https://github.com/stackforge/magnetodb | 06:57 |
| ajayaa | morganfainberg ^^ | 06:57 |
| morganfainberg | when people say NoSQL often they mean mongo which is why called it out specifically | 06:57 |
| morganfainberg | yeah i'm familiar with magnetodb :) | 06:57 |
| morganfainberg | its definitely interesting | 06:57 |
| *** r-daneel has quit IRC | 06:57 | |
| ajayaa | The idea is to have a generic api layer which colud be backed by any NoSql driver. | 06:57 |
| ajayaa | Thanks for the encouraging words. | 06:58 |
| ajayaa | *NoSql database | 06:58 |
| morganfainberg | stevemar, if we fix that minor verbiage thing for that model thing mind +2ing it tonight? | 06:59 |
| morganfainberg | stevemar, like if i push the sentence change in a minute or two? | 06:59 |
| stevemar | morganfainberg, i'd be fine with that | 06:59 |
| morganfainberg | i think that is a relatively uncontroversial spec to add for kilo (but i want to get it in before the deadline) | 06:59 |
| stevemar | i wanted to also fix up some links, but that can be an add-on spec | 07:00 |
| stevemar | err add-on patch | 07:00 |
| morganfainberg | if you have fixes reeady | 07:00 |
| stevemar | i dont | 07:00 |
| stevemar | otherwise, i like the spec, and i trust wanghong to get it all in | 07:00 |
| morganfainberg | ok will fix that in a couple minutes | 07:01 |
| stevemar | morganfainberg, i'm adding a few last nits if you want to fix them | 07:01 |
| *** josecastroleon has joined #openstack-keystone | 07:01 | |
| morganfainberg | k | 07:01 |
| morganfainberg | git review -d 153114 | 07:06 |
| morganfainberg | whoopose wrong window | 07:06 |
| *** henrynash has joined #openstack-keystone | 07:06 | |
| *** ChanServ sets mode: +v henrynash | 07:06 | |
| *** nellysmitt has joined #openstack-keystone | 07:07 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: implement timestamp for Project, Role https://review.openstack.org/153114 | 07:09 |
| morganfainberg | stevemar, ^^ | 07:10 |
| stevemar | i'll git review you! | 07:10 |
| *** chlong has quit IRC | 07:12 | |
| *** nellysmitt has quit IRC | 07:12 | |
| *** chlong has joined #openstack-keystone | 07:13 | |
| *** afazekas has quit IRC | 07:20 | |
| openstackgerrit | Merged openstack/keystone-specs: implement timestamp for Project, Role https://review.openstack.org/153114 | 07:21 |
| openstackgerrit | Merged openstack/keystone-specs: API changes for explicit unscoped https://review.openstack.org/143515 | 07:22 |
| *** mzbik has joined #openstack-keystone | 07:26 | |
| *** lufix has joined #openstack-keystone | 07:32 | |
| *** pnavarro has quit IRC | 07:33 | |
| *** ncoghlan has quit IRC | 07:43 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/152795 | 07:47 |
| *** nkinder has joined #openstack-keystone | 07:56 | |
| *** henrynash has quit IRC | 07:57 | |
| wanghong | morganfainberg, stevemar, I was in a meeting... Thanks!:) | 08:02 |
| morganfainberg | wanghong, no worries :) | 08:02 |
| stevemar | wanghong, np | 08:02 |
| morganfainberg | it was minor changes, happy to get that in for ya | 08:03 |
| wanghong | yeah. My first bp, although it is easy. :) | 08:06 |
| *** jaosorior has joined #openstack-keystone | 08:06 | |
| *** markvoelker has quit IRC | 08:12 | |
| *** markvoelker has joined #openstack-keystone | 08:13 | |
| *** nellysmitt has joined #openstack-keystone | 08:15 | |
| *** markvoelker has quit IRC | 08:18 | |
| *** andreaf has quit IRC | 08:20 | |
| *** andreaf has joined #openstack-keystone | 08:20 | |
| *** lufix has quit IRC | 08:22 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Address style and formatting comments from 153114 https://review.openstack.org/153488 | 08:26 |
| stevemar | morganfainberg, ^ | 08:26 |
| stevemar | fastest review ever | 08:27 |
| *** erkules_ is now known as erkules | 08:29 | |
| *** karimb has joined #openstack-keystone | 08:31 | |
| stevemar | morganfainberg, last request https://review.openstack.org/#/c/152018/ | 08:32 |
| stevemar | now i'm off to sleep | 08:32 |
| morganfainberg | stevemar, see clark's comment? | 08:32 |
| stevemar | morganfainberg, yeah, i was hoping you had a better descrip | 08:32 |
| morganfainberg | ahaha | 08:33 |
| morganfainberg | ok | 08:33 |
| stevemar | i've been thinking about it for a day or two | 08:33 |
| stevemar | i'm coming up short | 08:33 |
| *** henrynash has joined #openstack-keystone | 08:36 | |
| *** ChanServ sets mode: +v henrynash | 08:36 | |
| *** stevemar has quit IRC | 08:39 | |
| *** markvoelker has joined #openstack-keystone | 08:44 | |
| *** zz_avozza is now known as avozza | 08:44 | |
| *** markvoelker has quit IRC | 08:51 | |
| *** nkinder has quit IRC | 08:52 | |
| *** chlong has quit IRC | 08:53 | |
| *** nkinder has joined #openstack-keystone | 08:55 | |
| *** amerine_ has joined #openstack-keystone | 08:59 | |
| *** amerine has quit IRC | 09:00 | |
| *** henrynash has quit IRC | 09:19 | |
| *** andreaf has quit IRC | 09:28 | |
| *** andreaf has joined #openstack-keystone | 09:29 | |
| *** davechen_ has quit IRC | 09:29 | |
| *** nkinder has quit IRC | 09:33 | |
| openstackgerrit | wanghong proposed openstack/keystone: use tokens returned by delete_tokens to invalidate cache https://review.openstack.org/153501 | 09:33 |
| *** henrynash has joined #openstack-keystone | 09:37 | |
| *** ChanServ sets mode: +v henrynash | 09:37 | |
| openstackgerrit | Bob Thyne proposed openstack/keystonemiddleware: Add Endpoint Enforcement to Keystonemiddleware https://review.openstack.org/153296 | 09:43 |
| *** markvoelker has joined #openstack-keystone | 09:46 | |
| openstackgerrit | Bob Thyne proposed openstack/keystonemiddleware: Add Endpoint Enforcement to Keystonemiddleware https://review.openstack.org/153296 | 09:47 |
| *** nkinder has joined #openstack-keystone | 09:50 | |
| *** markvoelker has quit IRC | 09:51 | |
| *** henrynash has quit IRC | 09:51 | |
| *** henrynash has joined #openstack-keystone | 09:51 | |
| *** ChanServ sets mode: +v henrynash | 09:51 | |
| *** raildo has quit IRC | 09:53 | |
| *** henrynash has quit IRC | 09:59 | |
| *** dobson has quit IRC | 10:04 | |
| *** raildo has joined #openstack-keystone | 10:06 | |
| *** chlong has joined #openstack-keystone | 10:08 | |
| *** kibutzz has joined #openstack-keystone | 10:09 | |
| *** avozza is now known as zz_avozza | 10:13 | |
| *** aix has joined #openstack-keystone | 10:16 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:18 | |
| *** tellesnobrega_ has quit IRC | 10:28 | |
| *** zz_avozza is now known as avozza | 10:31 | |
| *** avozza is now known as zz_avozza | 10:34 | |
| *** nkinder has quit IRC | 10:36 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:37 | |
| *** tellesnobrega_ has quit IRC | 10:45 | |
| *** markvoelker has joined #openstack-keystone | 10:47 | |
| *** markvoelker has quit IRC | 10:52 | |
| *** dims__ has joined #openstack-keystone | 10:54 | |
| *** Tahmina has joined #openstack-keystone | 11:18 | |
| *** henrynash has joined #openstack-keystone | 11:32 | |
| *** ChanServ sets mode: +v henrynash | 11:32 | |
| *** zigo has quit IRC | 11:42 | |
| *** markvoelker has joined #openstack-keystone | 11:48 | |
| *** henrynash has quit IRC | 11:53 | |
| *** henrynash has joined #openstack-keystone | 11:54 | |
| *** ChanServ sets mode: +v henrynash | 11:54 | |
| *** markvoelker has quit IRC | 11:54 | |
| *** mzbik_ has joined #openstack-keystone | 11:54 | |
| *** nkinder has joined #openstack-keystone | 11:55 | |
| *** mzbik has quit IRC | 11:57 | |
| openstackgerrit | henry-nash proposed openstack/keystone: My First ABAC: An example alternative assignment engine https://review.openstack.org/143557 | 11:58 |
| *** henrynash has quit IRC | 12:00 | |
| *** henrynash has joined #openstack-keystone | 12:01 | |
| *** ChanServ sets mode: +v henrynash | 12:01 | |
| *** nellysmi_ has joined #openstack-keystone | 12:04 | |
| *** nellysmitt has quit IRC | 12:06 | |
| *** d34dh0r53 has quit IRC | 12:06 | |
| *** d34dh0r53 has joined #openstack-keystone | 12:08 | |
| *** xxj has quit IRC | 12:09 | |
| *** junhongl has quit IRC | 12:09 | |
| *** wpf1 has quit IRC | 12:09 | |
| *** alex_xu has joined #openstack-keystone | 12:09 | |
| *** breton__ has joined #openstack-keystone | 12:13 | |
| *** karimb has quit IRC | 12:19 | |
| *** esmute has quit IRC | 12:19 | |
| *** therve has quit IRC | 12:19 | |
| *** dougwig has quit IRC | 12:19 | |
| *** breton has quit IRC | 12:19 | |
| *** comstud has quit IRC | 12:19 | |
| *** dtroyer has quit IRC | 12:19 | |
| *** cyeoh has quit IRC | 12:19 | |
| *** mgagne has quit IRC | 12:19 | |
| *** aslaen has quit IRC | 12:19 | |
| *** esmute has joined #openstack-keystone | 12:20 | |
| *** therve has joined #openstack-keystone | 12:20 | |
| *** dougwig has joined #openstack-keystone | 12:20 | |
| *** comstud has joined #openstack-keystone | 12:20 | |
| *** dtroyer has joined #openstack-keystone | 12:20 | |
| *** cyeoh has joined #openstack-keystone | 12:20 | |
| *** mgagne has joined #openstack-keystone | 12:20 | |
| *** aslaen has joined #openstack-keystone | 12:20 | |
| *** karimb has joined #openstack-keystone | 12:21 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Allow use of our test fixtures with alternate assignment models https://review.openstack.org/153535 | 12:27 |
| *** henrynash has quit IRC | 12:28 | |
| *** kromanenko has joined #openstack-keystone | 12:29 | |
| *** breton__ is now known as breton | 12:44 | |
| *** MasterPiece has joined #openstack-keystone | 12:47 | |
| *** markvoelker has joined #openstack-keystone | 12:50 | |
| *** markvoelker has quit IRC | 12:54 | |
| *** markvoelker has joined #openstack-keystone | 13:04 | |
| *** topol has joined #openstack-keystone | 13:05 | |
| *** ChanServ sets mode: +v topol | 13:05 | |
| *** pnavarro has joined #openstack-keystone | 13:06 | |
| *** rushiagr is now known as rushiagr_away | 13:10 | |
| *** dims__ has quit IRC | 13:17 | |
| *** dims_ has joined #openstack-keystone | 13:25 | |
| *** bknudson has quit IRC | 13:28 | |
| *** karimb has quit IRC | 13:33 | |
| *** henrynash has joined #openstack-keystone | 13:37 | |
| *** ChanServ sets mode: +v henrynash | 13:37 | |
| *** MasterPiece has quit IRC | 13:38 | |
| *** gordc has joined #openstack-keystone | 13:40 | |
| *** pnavarro has quit IRC | 13:44 | |
| samueldmq | morning | 13:48 |
| samueldmq | henrynash, hi | 13:48 |
| henrynash | samueldmq: hi | 13:48 |
| samueldmq | henrynash, so the rest of the work on assignment backend will stay for k3 (list assignments refctoring, metadata removal, etc ) .. | 13:49 |
| henrynash | samueldmq: yes | 13:49 |
| samueldmq | henrynash, I was wondering something about grants vs role_assignmetns apis | 13:49 |
| samueldmq | henrynash, do you have a minute (or two ) ? | 13:49 |
| *** rushiagr_away is now known as rushiagr | 13:50 | |
| henrynash | samueldmq: actually…not right now….but if you have some ideas….you feel free to email me and I’ll respond... | 13:50 |
| henrynash | samueldmq:…and am reviewing the list_role_assignemtns change to data as well | 13:51 |
| samueldmq | henrynash, great! will do, thanks | 13:51 |
| *** nkinder has quit IRC | 13:51 | |
| *** henrynash has quit IRC | 13:52 | |
| *** mzbik_ has quit IRC | 13:54 | |
| *** andreaf has quit IRC | 13:56 | |
| *** andreaf has joined #openstack-keystone | 13:57 | |
| *** nkinder has joined #openstack-keystone | 14:02 | |
| *** richm has joined #openstack-keystone | 14:03 | |
| *** jaosorior has quit IRC | 14:06 | |
| *** bjornar has quit IRC | 14:07 | |
| *** ajayaa has quit IRC | 14:10 | |
| *** radez_g0n3 is now known as radez | 14:11 | |
| *** topol has quit IRC | 14:11 | |
| *** henrynash has joined #openstack-keystone | 14:14 | |
| *** ChanServ sets mode: +v henrynash | 14:14 | |
| *** rm_work|away is now known as rm_work | 14:17 | |
| *** joesavak has joined #openstack-keystone | 14:20 | |
| *** obutenko has joined #openstack-keystone | 14:25 | |
| *** bjornar has joined #openstack-keystone | 14:29 | |
| *** amakarov_away is now known as amakarov | 14:29 | |
| *** Ctina_ has joined #openstack-keystone | 14:31 | |
| *** mattfarina has joined #openstack-keystone | 14:32 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Fix places where role API calls still called assignment_api https://review.openstack.org/153580 | 14:34 |
| *** bknudson has joined #openstack-keystone | 14:39 | |
| *** ChanServ sets mode: +v bknudson | 14:39 | |
| *** Tahmina has quit IRC | 14:49 | |
| *** henrynash has quit IRC | 14:52 | |
| *** alex_xu has quit IRC | 14:52 | |
| *** xu_alex has joined #openstack-keystone | 14:53 | |
| *** r-daneel has joined #openstack-keystone | 15:03 | |
| *** ajayaa has joined #openstack-keystone | 15:05 | |
| *** rushiagr is now known as rushiagr_away | 15:15 | |
| openstackgerrit | Alistair Coles proposed openstack/keystonemiddleware: Delay denial when service token is invalid https://review.openstack.org/153247 | 15:16 |
| *** stevemar has joined #openstack-keystone | 15:17 | |
| *** ChanServ sets mode: +v stevemar | 15:17 | |
| *** timcline has joined #openstack-keystone | 15:20 | |
| *** topol has joined #openstack-keystone | 15:28 | |
| *** ChanServ sets mode: +v topol | 15:28 | |
| *** kromanenko has quit IRC | 15:29 | |
| *** jaosorior has joined #openstack-keystone | 15:31 | |
| *** nkinder has quit IRC | 15:34 | |
| *** nkinder has joined #openstack-keystone | 15:36 | |
| *** davidckennedy has joined #openstack-keystone | 15:40 | |
| davidckennedy | Hello, I've run into an issue setting up ssl for my dev machine. I run keystone-manage ssl_setup and so forth, then making requests via the keystone client I can set up projects etc. | 15:42 |
| davidckennedy | But sample_data.sh won't succeed because of subjectAltName warnings in the keystone responses. | 15:42 |
| davidckennedy | It seems that the subjectAltName is not present in the certs and python doesn't like it - see something along these lines in https://github.com/shazow/urllib3/issues/523 | 15:44 |
| davidckennedy | anybody encountered this? | 15:44 |
| *** lnxnut has joined #openstack-keystone | 15:54 | |
| *** ljfisher has joined #openstack-keystone | 16:01 | |
| *** jorge_munoz has quit IRC | 16:04 | |
| *** kfox1111 has joined #openstack-keystone | 16:06 | |
| *** jorge_munoz has joined #openstack-keystone | 16:06 | |
| kfox1111 | question. If your primarily using the v2 api everywhere but you use v3 to add a group to a user and a role to a project on the group, does loging in and using nova via the v2 api honor the group permission? | 16:07 |
| *** david-lyle_afk is now known as david-lyle | 16:07 | |
| bknudson | kfox1111: it should. | 16:21 |
| *** openstackgerrit has quit IRC | 16:21 | |
| *** openstackgerrit has joined #openstack-keystone | 16:21 | |
| bknudson | if it didn't then that would be a bug. | 16:22 |
| *** thedodd has joined #openstack-keystone | 16:25 | |
| *** MasterPieceF has joined #openstack-keystone | 16:26 | |
| *** nkinder has quit IRC | 16:31 | |
| morganfainberg | Unless the user is v3 | 16:32 |
| morganfainberg | And not in the default domain. | 16:33 |
| morganfainberg | Since v3 | 16:33 |
| morganfainberg | Erm v2 cannot work outside the default domain. | 16:33 |
| *** nkinder has joined #openstack-keystone | 16:33 | |
| *** dims_ is now known as dimsum__ | 16:39 | |
| * stevemar forgot to log into vpn until now | 16:40 | |
| stevemar | it's weird when making sure your irc client is up and running is higher priority | 16:40 |
| *** zzzeek has joined #openstack-keystone | 16:42 | |
| morganfainberg | stevemar: hahaha | 16:42 |
| raildo | stevemar, can you help me to make this API calls as experimental? https://review.openstack.org/#/c/153007/ what I have to do? | 16:45 |
| stevemar | raildo, commenting now | 16:46 |
| raildo | stevemar, thanks :) | 16:47 |
| stevemar | raildo, i think it's fine for now, we can update https://review.openstack.org/#/c/146793/ when that is merged | 16:48 |
| stevemar | we still don't have a set way of marking things experimental yet | 16:49 |
| *** dhellmann_ has quit IRC | 16:53 | |
| *** dhellmann_ has joined #openstack-keystone | 16:54 | |
| raildo | stevemar, ok, I'll follow this patch, just to stay attention with this. thanks | 16:54 |
| *** dhellmann_ has quit IRC | 16:56 | |
| *** josecastroleon has quit IRC | 16:57 | |
| *** dhellmann_ has joined #openstack-keystone | 16:57 | |
| *** BAKfr has quit IRC | 16:58 | |
| *** dhellmann_ has quit IRC | 16:59 | |
| *** dhellmann_ has joined #openstack-keystone | 16:59 | |
| *** BAKfr has joined #openstack-keystone | 17:01 | |
| kfox1111 | bknudson: cool. thanks. | 17:02 |
| *** davidckennedy has quit IRC | 17:05 | |
| *** lhcheng has joined #openstack-keystone | 17:06 | |
| *** thedodd has quit IRC | 17:06 | |
| *** thedodd has joined #openstack-keystone | 17:09 | |
| *** rwsu-afk is now known as rwsu | 17:09 | |
| morganfainberg | stevemar, bknudson, topol, dstanek , ayoung , jamielennox: http://logs.openstack.org/26/153426/2/gate/gate-tempest-dsvm-nova-v21-full/c80cf2c//logs/apache/keystone.txt.gz#_2015-02-06_15_27_17_988 we have a bug | 17:11 |
| morganfainberg | on creation of the default role | 17:11 |
| morganfainberg | it can race | 17:11 |
| bknudson | I think the way we handle this in other places is to catch the conflict exception and ignore it. | 17:12 |
| morganfainberg | bknudson, yeah simple bug | 17:12 |
| morganfainberg | just we're missing the try/except | 17:12 |
| bknudson | this isn't new code is it? | 17:12 |
| bknudson | I think dolphm had a similar change in review... | 17:12 |
| morganfainberg | i think dolphm fixed it to create the role based on the config | 17:13 |
| morganfainberg | or that review was up | 17:13 |
| morganfainberg | bknudson, yes | 17:13 |
| morganfainberg | bewfore it was *always* creating a randome uuid not a fixed uuid | 17:13 |
| morganfainberg | for the default role | 17:13 |
| morganfainberg | also turns out we weren't indexing keystone logs from apache :( | 17:14 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Recursive deletion and project disabling https://review.openstack.org/148730 | 17:14 |
| kfox1111 | is the neutron + nova thing considered a bug and thus immune from feature freeze? | 17:16 |
| morganfainberg | kfox1111, i'll argue it is not a feature where needed | 17:16 |
| morganfainberg | kfox1111, and a bug fix | 17:17 |
| morganfainberg | but it might need that argument to happen | 17:17 |
| *** abhirc has quit IRC | 17:17 | |
| kfox1111 | should someone request a feature freeze exception just to be on the safe side? | 17:17 |
| morganfainberg | jamielennox, what is the status of Nova + Neutron and Keystone V3? | 17:17 |
| morganfainberg | jamielennox, ^ CC [and are we going to need to push a FFE?] | 17:18 |
| *** ajayaa has quit IRC | 17:19 | |
| *** nkinder has quit IRC | 17:19 | |
| openstackgerrit | Merged openstack/oslo.policy: Privatize parsing classes https://review.openstack.org/153149 | 17:19 |
| morganfainberg | bknudson, https://github.com/openstack/keystone/blob/master/keystone/assignment/core.py#L256-L261 | 17:19 |
| morganfainberg | bknudson, yep just need another try/except around it | 17:20 |
| morganfainberg | we can race w/ many processes running | 17:20 |
| morganfainberg | it's causing some gate failures | 17:20 |
| *** raildo has quit IRC | 17:20 | |
| *** rwsu has quit IRC | 17:20 | |
| bknudson | morganfainberg: here's dolphm's change https://review.openstack.org/#/c/142897/ (not merged) | 17:21 |
| morganfainberg | bknudson, that doesnt' solve the issue | 17:21 |
| morganfainberg | but it does mean the config is honored | 17:22 |
| *** nicodemos has joined #openstack-keystone | 17:23 | |
| *** nkinder has joined #openstack-keystone | 17:23 | |
| *** dobson has joined #openstack-keystone | 17:24 | |
| *** raildo has joined #openstack-keystone | 17:24 | |
| *** _cjones_ has joined #openstack-keystone | 17:30 | |
| *** thedodd has quit IRC | 17:31 | |
| *** thedodd has joined #openstack-keystone | 17:31 | |
| *** ccard has joined #openstack-keystone | 17:33 | |
| ccard | I'm investigating how to use our existing LDAP directory as the identity backend for keystone | 17:34 |
| *** obutenko has quit IRC | 17:34 | |
| ccard | I assume that I will have to add the internal openstack users (e.g. admin, cinder etc. which are currently returned by the keystone user-list command) to the directory for openstack to continue working - is that assumption correct? | 17:36 |
| *** _cjones_ has quit IRC | 17:39 | |
| kfox1111 | if you don't use domains. | 17:39 |
| kfox1111 | otherwise, you can have a domain for the services, and a domain for ldap users. | 17:39 |
| *** _cjones_ has joined #openstack-keystone | 17:39 | |
| kfox1111 | though it doesnt work if your using neutron+nova at the moment. :/ | 17:39 |
| *** _cjones_ has quit IRC | 17:40 | |
| *** _cjones_ has joined #openstack-keystone | 17:41 | |
| morganfainberg | bknudson, any reason this is not https://review.openstack.org/#/c/115770/30 going through yet? | 17:41 |
| ccard | kfox1111 I'll take a look at domains, thanks. But assuming I'm not using domains, can I make the [ldap] parameter user_objectclass blank and simply use the user_filter to ensure that the correct users are returned from LDAP? | 17:42 |
| *** radez is now known as radez_g0n3 | 17:43 | |
| kfox1111 | I think I had to set user_objectclass. I haven't figured out exactly how user_filter works, but all examples I've found it was static. | 17:44 |
| ccard | kfox1111 The problem is that my existing LDAP users are in objectClass posixAccount which I can't see a way to make compatible with the service users | 17:44 |
| kfox1111 | its just an initial filter to reduce the search space to a subset, and then it uses user_objectclass and... user_name_attribute I think to filter to the exact user. | 17:44 |
| ccard | so it doesn't include the objectclass and the username in the filter sent to LDAP then? | 17:45 |
| kfox1111 | I think that should still work... let me thing... | 17:45 |
| kfox1111 | it does sometimes I think... | 17:45 |
| ccard | I understand LDAP pretty well, but I'm new to openstack / keystone | 17:46 |
| kfox1111 | hmm... can you use person instead? | 17:47 |
| *** spandhe has joined #openstack-keystone | 17:47 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: On creation default service name to empty string https://review.openstack.org/146962 | 17:47 |
| kfox1111 | you can use uid for user_name_attribute then. | 17:47 |
| ccard | I can't change the objectclass used for the existing users, and I want to have them included in the keystone user-list output | 17:47 |
| *** amakarov is now known as amakarov_away | 17:48 | |
| *** nkinder has quit IRC | 17:48 | |
| kfox1111 | posixaccount doens't have usernames though... just uid/gid stuff. | 17:48 |
| kfox1111 | what all object classes do the existing users have? | 17:49 |
| *** rwsu has joined #openstack-keystone | 17:49 | |
| ccard | I could make the service users have posixAccount and (say) person, but then I'd have to add the compulsory posixAccount attributes (uidNumber, gidNumber, homeDirectory) | 17:49 |
| ccard | the existing users are in posixAccount, account, ldapPublicKey and shadowAccount | 17:50 |
| kfox1111 | yeah. that would work I think. | 17:50 |
| kfox1111 | hmm... havent seen account before... | 17:50 |
| ccard | it would probably work, but I've no idea what values to give to those compulsory attributes. Maybe it doesn't matter though | 17:50 |
| ccard | cosine.ldif:olcObjectClasses: ( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCT | 17:51 |
| ccard | cosine.ldif- URAL MUST userid MAY ( description $ seeAlso $ localityName $ organizationNam | 17:51 |
| ccard | cosine.ldif- e $ organizationalUnitName $ host ) ) | 17:51 |
| ccard | (sorry, a bit garbled) | 17:52 |
| kfox1111 | keystone's not going to use uid/gid/home. so probably doesn't matter. | 17:52 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 17:52 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Recursive deletion and project disabling https://review.openstack.org/148730 | 17:52 |
| kfox1111 | ah. so http://www.zytrax.com/books/ldap/ape/cosine.html#account | 17:52 |
| ccard | it might confuse other things though | 17:53 |
| kfox1111 | so account userid is the string used as the login name to the system? | 17:53 |
| ccard | I'm not sure why it's there to be honest, but I can't change it. We only use the userid attribute, which is an alias for uid anyway | 17:54 |
| ccard | as far as I can see | 17:54 |
| kfox1111 | hmm... I thought uid was a person property. guess not. | 17:55 |
| ccard | I'll try going with posixAccount for now, though it seems a bit messy | 17:55 |
| kfox1111 | k. | 17:55 |
| rodrigods | morganfainberg, think that client change hasn't received +A because both henrynash and bknudson are from the same company, otherwise I believe it is ready | 17:56 |
| kfox1111 | I think you might be able to use account, and set | 17:56 |
| morganfainberg | rodrigods, figured it looks good to me | 17:56 |
| morganfainberg | but i wanted to check before +A | 17:56 |
| kfox1111 | user_name_attribute to userid | 17:57 |
| rodrigods | morganfainberg, cool | 17:57 |
| kfox1111 | and user_id_attribute to cn | 17:57 |
| ccard | and set user_objectclass to account, yes that might work | 17:57 |
| kfox1111 | yeah. | 17:58 |
| ccard | except account doesn't have cn :( | 18:00 |
| *** dobson has quit IRC | 18:00 | |
| ekarlso | jamielennox: did you ever come up with a solution for the experimental stuff ? | 18:01 |
| kfox1111 | hmm... | 18:01 |
| ccard | back to posixAccount ... | 18:02 |
| kfox1111 | how about commonName? | 18:02 |
| kfox1111 | does that map back to cn? | 18:02 |
| kfox1111 | says its a may contain. | 18:02 |
| kfox1111 | really, you might just be able to use userid for both fields. | 18:03 |
| *** gyee has joined #openstack-keystone | 18:03 | |
| *** ChanServ sets mode: +v gyee | 18:03 | |
| kfox1111 | so long as your using a recent enough keystone to do id mapping. | 18:03 |
| ccard | we're on juno at the moment | 18:05 |
| *** thedodd has quit IRC | 18:06 | |
| kfox1111 | that should work. | 18:07 |
| kfox1111 | I think. | 18:07 |
| kfox1111 | it uses a sha of the id property as the uuid. | 18:08 |
| kfox1111 | so, so long as the id property is unique, I think its ok. | 18:08 |
| rodrigods | morganfainberg, thinking about the API changes for reseller, are we going to return project objects in list_domains? Or we wrap the project fields in the domain object? | 18:11 |
| *** dobson has joined #openstack-keystone | 18:12 | |
| *** harlowja has joined #openstack-keystone | 18:15 | |
| *** dobson has quit IRC | 18:27 | |
| *** _cjones_ has quit IRC | 18:32 | |
| *** _cjones_ has joined #openstack-keystone | 18:33 | |
| *** _cjones_ has quit IRC | 18:37 | |
| bknudson | morganfainberg: I didn't approve it because I was the only +2. | 18:38 |
| bknudson | I don't know why henrynash didn't approve it... maybe because jamielennox had comments on a previous patch set? | 18:38 |
| *** dobson has joined #openstack-keystone | 18:39 | |
| openstackgerrit | Endre Karlson proposed openstack/python-keystoneclient: Allow for other then STABLE api version https://review.openstack.org/130159 | 18:44 |
| *** _cjones_ has joined #openstack-keystone | 18:44 | |
| *** _cjones_ has quit IRC | 18:46 | |
| *** _cjones_ has joined #openstack-keystone | 18:46 | |
| dolphm | protip: if you recompile ApacheBench, it can handle PKI/Z tokens! sound familiar, morganfainberg ? | 18:47 |
| *** mtreinish has joined #openstack-keystone | 18:51 | |
| *** abhirc has joined #openstack-keystone | 18:52 | |
| *** _cjones_ has quit IRC | 18:52 | |
| *** _cjones_ has joined #openstack-keystone | 18:53 | |
| morganfainberg | dolphm: hmmmmmmm | 18:54 |
| *** dobson has quit IRC | 18:54 | |
| lbragstad | morganfainberg: did you use apachebench with PKI tokens before? | 18:55 |
| breton | gyee: nice catch with the bug, left a comment there | 18:55 |
| morganfainberg | lbragstad: maybe. | 18:55 |
| gyee | breton, that's morganfainberg's catch | 18:55 |
| morganfainberg | I *think* I might have. | 18:55 |
| gyee | I am just helping out :) | 18:55 |
| *** _cjones_ has quit IRC | 18:57 | |
| openstackgerrit | guang-yee proposed openstack/keystone: fix a potential race condition with member role creation and assignment https://review.openstack.org/153654 | 18:57 |
| breton | oh, ok ;) | 18:58 |
| openstackgerrit | Matthew Treinish proposed openstack/keystone: Fix race on default role creation https://review.openstack.org/153656 | 18:58 |
| *** _cjones_ has joined #openstack-keystone | 18:58 | |
| gyee | morganfainberg, breton, https://review.openstack.org/153654 | 18:58 |
| breton | and 153656 | 18:58 |
| *** dhellmann has quit IRC | 18:58 | |
| *** dhellmann_ is now known as dhellmann | 18:58 | |
| *** zz_avozza is now known as avozza | 18:59 | |
| gyee | breton, we need to handle both cases | 18:59 |
| gyee | both creation and assignment | 18:59 |
| *** dhellmann_ has joined #openstack-keystone | 18:59 | |
| breton | I like gyee's patch and Matthew's description ;) | 19:00 |
| gyee | lemme combine :) | 19:00 |
| *** dhellmann_ has quit IRC | 19:01 | |
| *** dhellmann_ has joined #openstack-keystone | 19:01 | |
| *** ljfisher has quit IRC | 19:02 | |
| bknudson | https://review.openstack.org/#/c/153656/ and https://review.openstack.org/#/c/153654/ are essentially the same change | 19:03 |
| openstackgerrit | Matthew Treinish proposed openstack/keystone: Fix race on default role creation https://review.openstack.org/153656 | 19:03 |
| *** mattfarina has quit IRC | 19:04 | |
| *** mattfarina has joined #openstack-keystone | 19:04 | |
| gyee | bknudson, yeah, let me abandon mine | 19:04 |
| samueldmq | bknudson, and one is older than other by 1 minute | 19:04 |
| gyee | just use Mathew's | 19:04 |
| samueldmq | gyee, great :) | 19:05 |
| *** Ctina_ is now known as Ctina | 19:05 | |
| *** ljfisher has joined #openstack-keystone | 19:05 | |
| stevemar | morganfainberg, hey, what do you advise on this one: https://review.openstack.org/#/c/152659/ | 19:07 |
| stevemar | bknudson, i could use your expertise on that one too, ^^^ for handling dependencies | 19:08 |
| gyee | bknudson, samueldmq, morganfainberg, breton, I am not sure that's the *right* fix as I think creating the __member__ role should be part of bootstrap | 19:09 |
| *** _cjones_ has quit IRC | 19:09 | |
| *** dhellmann has quit IRC | 19:09 | |
| *** dhellmann_ is now known as dhellmann | 19:09 | |
| gyee | doing it as part of assignment seem inefficient | 19:09 |
| *** _cjones_ has joined #openstack-keystone | 19:09 | |
| bknudson | it's a little late for bootstrapping now? | 19:10 |
| bknudson | or are you saying add a migration? | 19:10 |
| gyee | I mean create it once, at startup | 19:10 |
| *** ajayaa has joined #openstack-keystone | 19:10 | |
| gyee | right, or migration | 19:10 |
| *** thedodd has joined #openstack-keystone | 19:12 | |
| *** _cjones_ has quit IRC | 19:14 | |
| *** jaosorior has quit IRC | 19:16 | |
| *** nicodemos has quit IRC | 19:29 | |
| morganfainberg | Not sure why it isn't a migration like default domain is. | 19:30 |
| *** tqtran has joined #openstack-keystone | 19:31 | |
| *** avozza is now known as zz_avozza | 19:34 | |
| *** thedodd has quit IRC | 19:34 | |
| *** henrynash has joined #openstack-keystone | 19:38 | |
| *** ChanServ sets mode: +v henrynash | 19:38 | |
| *** _cjones_ has joined #openstack-keystone | 19:39 | |
| openstackgerrit | Merged openstack/pycadf: Use oslo namespaces https://review.openstack.org/152802 | 19:45 |
| *** _cjones_ has quit IRC | 19:47 | |
| *** _cjones_ has joined #openstack-keystone | 19:48 | |
| openstackgerrit | Matthew Treinish proposed openstack/keystone: Fix race on default role creation https://review.openstack.org/153656 | 19:48 |
| *** Ctina has quit IRC | 19:50 | |
| *** radez_g0n3 is now known as radez | 19:50 | |
| *** dobson has joined #openstack-keystone | 19:51 | |
| *** _cjones_ has quit IRC | 19:52 | |
| *** ctina has joined #openstack-keystone | 19:53 | |
| *** dobson has quit IRC | 19:55 | |
| *** ajayaa has quit IRC | 19:55 | |
| *** _cjones_ has joined #openstack-keystone | 19:57 | |
| *** ctina has left #openstack-keystone | 19:59 | |
| *** ctina has joined #openstack-keystone | 19:59 | |
| dolphm | congratulations to everyone at HP on that cloud thing http://www.theonion.com/video/hp-on-that-cloud-thing-that-everyone-else-is-talki,28789/ | 20:00 |
| *** thedodd has joined #openstack-keystone | 20:02 | |
| raildo | lol | 20:02 |
| *** dobson has joined #openstack-keystone | 20:03 | |
| *** ctina has quit IRC | 20:05 | |
| morganfainberg | haha | 20:06 |
| *** rhbear has joined #openstack-keystone | 20:06 | |
| *** raildo has quit IRC | 20:07 | |
| ayoung | morganfainberg, do we have code for normalizing the service catalog, and converting between a V2 and V3 version? | 20:18 |
| morganfainberg | ayoung, in middleware jamie does some of this | 20:18 |
| morganfainberg | v3 -> v2 | 20:18 |
| morganfainberg | specifically | 20:18 |
| *** dobson has quit IRC | 20:20 | |
| ayoung | Ah..but not the reverse | 20:24 |
| bknudson | I think there's some v2 -> v3 token code in the server | 20:24 |
| ayoung | morganfainberg, trying to treat both V2 and V3 the same...yukness | 20:24 |
| ayoung | bknudson, in the server they have access to the original service catalog | 20:24 |
| ayoung | I think we cheat there | 20:24 |
| morganfainberg | ayoung most services assumed v2 catalog extraction | 20:25 |
| rodrigods | morganfainberg, bknudson, seems like it can be approved https://review.openstack.org/#/c/115770/ ? | 20:25 |
| morganfainberg | so jamielennox opted for v3 -> v2 | 20:25 |
| ayoung | BTW, you guys reserved hotels for Vancouver yet? | 20:25 |
| morganfainberg | rodrigods, yes. | 20:25 |
| morganfainberg | ayoung, nope. not yet | 20:25 |
| lbragstad | not yet | 20:25 |
| rodrigods | ayoung, already? | 20:25 |
| rodrigods | :O | 20:25 |
| morganfainberg | ayoung, but its on the list to do this weekend. | 20:25 |
| ayoung | rodrigods, hotel list came out | 20:25 |
| ayoung | https://www.openstack.org/summit/vancouver-2015/hotels/ | 20:25 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/catalog/core.py#n431 | 20:25 |
| rodrigods | ayoung, great! | 20:26 |
| *** nellysmi_ has quit IRC | 20:27 | |
| *** dobson has joined #openstack-keystone | 20:27 | |
| rodrigods | morganfainberg, thx! | 20:28 |
| boris-42 | morganfainberg: lol | 20:36 |
| boris-42 | morganfainberg: hi there | 20:36 |
| morganfainberg | boris-42, hey | 20:36 |
| boris-42 | morganfainberg: did you see my latest comment? | 20:36 |
| boris-42 | morganfainberg: I am not sure where things start being unclear=) | 20:37 |
| boris-42 | morganfainberg: maybe that "trace-id" is unique per point not per request? | 20:37 |
| *** stevemar has quit IRC | 20:37 | |
| morganfainberg | boris-42, that is not clear in the spec at all | 20:37 |
| morganfainberg | boris-42, i'm not the only one who missed that intention | 20:37 |
| *** stevemar has joined #openstack-keystone | 20:38 | |
| *** ChanServ sets mode: +v stevemar | 20:38 | |
| boris-42 | morganfainberg: ah so if I say that it will be a bit more clear?) | 20:38 |
| stevemar | ayoung, i think most ibmers will be at the delta vancouver suites | 20:38 |
| ayoung | stevemar, good to know | 20:38 |
| morganfainberg | boris-42, i think you could unified a single request id and utilize the file/lineno as the info of where the trace was called from | 20:38 |
| ayoung | you in that group stevemar topol bknudson ? | 20:38 |
| morganfainberg | boris-42, that has the added benefit that you *could* avoid needing to capture everything such as the whole SQL query [which is part of the security issues that will prevent osprofiler from landing in keystone] | 20:39 |
| boris-42 | morganfainberg: I don't need to capture whole SQL query | 20:40 |
| morganfainberg | boris-42, but you do at the moment | 20:40 |
| morganfainberg | as well as a lot of other info | 20:40 |
| boris-42 | morganfainberg: because I think it's usefull information=) | 20:40 |
| morganfainberg | you shouldn't be capturing the context, the sql query, etc | 20:40 |
| boris-42 | morganfainberg: it depend on purpose | 20:40 |
| morganfainberg | we shouldn't need to filter in every place someone is hooking into to prevent sensitive info from leaking | 20:40 |
| boris-42 | morganfainberg: if you are man that is tuning SQL request | 20:40 |
| boris-42 | morganfainberg: it help a lot | 20:41 |
| morganfainberg | you can look at the SQL-A debug for that | 20:41 |
| stevemar | dolphm, oh man that was great | 20:41 |
| morganfainberg | you don't need it in the profiler capture | 20:41 |
| morganfainberg | or you can look at the SQL-A lines called | 20:41 |
| boris-42 | morganfainberg: okay let me expalin full pictutrue | 20:41 |
| morganfainberg | boris-42, but let me be blunt, as long as you're capturing sensitive info explicitly, i'm -1 on osprofiler | 20:41 |
| boris-42 | morganfainberg: I can just remove 1 line | 20:41 |
| bknudson | ayoung: yes, I'm at the delta ... it was in the tool we use. | 20:41 |
| boris-42 | morganfainberg: that is doing that* | 20:42 |
| *** dobson has quit IRC | 20:42 | |
| bknudson | and looked close enough | 20:42 |
| boris-42 | morganfainberg: and it won't caputre sensitive data | 20:42 |
| boris-42 | morganfainberg: or we can make it turned of by default and allow developer to turn it ON if they need that | 20:42 |
| morganfainberg | boris-42, as it stands osprofiler is a security hole | 20:42 |
| boris-42 | morganfainberg: everything is security hole | 20:42 |
| boris-42 | morganfainberg: getting access on only one compute node | 20:42 |
| boris-42 | morganfainberg: and it's all | 20:43 |
| morganfainberg | this one is leaking sensitive information outside by design | 20:43 |
| boris-42 | morganfainberg: nope if you don't add point* | 20:43 |
| boris-42 | morganfainberg: that leaks* | 20:43 |
| boris-42 | morganfainberg: we can put only SQL request data without actually values | 20:43 |
| boris-42 | morganfainberg: for example | 20:43 |
| morganfainberg | the query often has information that is sensitive in it currently. | 20:43 |
| boris-42 | morganfainberg: or at all remove that part | 20:44 |
| morganfainberg | e.g. token ids. | 20:44 |
| boris-42 | morganfainberg: nope it hasn't that | 20:44 |
| boris-42 | morganfainberg: it has SQL token = %s | 20:44 |
| boris-42 | morganfainberg: %s is not leaking | 20:44 |
| boris-42 | anything imho | 20:44 |
| boris-42 | until it is render | 20:44 |
| morganfainberg | boris-42, you're not capturing the actual query to the backend, it looks like you are | 20:44 |
| morganfainberg | anyway | 20:44 |
| boris-42 | morganfainberg: anyway what about request-id unfification? | 20:44 |
| boris-42 | morganfainberg: I think it's not what I should work on imho | 20:44 |
| boris-42 | agree disagree? | 20:45 |
| morganfainberg | boris-42, i think you have very little support for the profiler in the current state [based on the review] | 20:45 |
| boris-42 | morganfainberg: it is already merged in few projects* | 20:45 |
| morganfainberg | boris-42, i can't tell you what you should work on/not work on though. | 20:45 |
| boris-42 | morganfainberg: some not important project=) | 20:46 |
| morganfainberg | boris-42, and i think you're going to have a hard time getting it into the other projects. | 20:46 |
| boris-42 | morganfainberg: I have hard time since the beggign lon | 20:46 |
| boris-42 | lol | 20:46 |
| morganfainberg | boris-42, it's because it has a lot of questions about it. i'd boil it down to bare-minimum | 20:46 |
| morganfainberg | and you can talk about the performance issues here | 20:47 |
| morganfainberg | we're not taking this to a private channel | 20:47 |
| morganfainberg | it is well known there are performance issues in keystone and we are happy to talk about it. | 20:47 |
| boris-42 | morganfainberg: what if some big cloud managers are reading this?) | 20:48 |
| morganfainberg | then they know we're aware of it | 20:48 |
| morganfainberg | this is the nature of opensource | 20:48 |
| boris-42 | morganfainberg: ok | 20:48 |
| morganfainberg | most of the big cloud managers *do* know there are performance issues in keystone | 20:48 |
| boris-42 | morganfainberg: so do you remember I show some bad graphs to you in rally jobs in gates? | 20:49 |
| morganfainberg | most of them are interested in seeing it solved. | 20:49 |
| boris-42 | morganfainberg: https://review.openstack.org/#/c/136485/ | 20:49 |
| morganfainberg | lets be open about the issues [unless it's a direct security concern, today it is not] | 20:49 |
| boris-42 | morganfainberg: ? | 20:49 |
| boris-42 | morganfainberg: not sure that I get the last one=) | 20:49 |
| boris-42 | morganfainberg: if it is not secure not interesting?) | 20:50 |
| morganfainberg | it was the reasoning behind why i want it in this channel | 20:50 |
| morganfainberg | not private | 20:50 |
| boris-42 | morganfainberg: ah ok | 20:50 |
| morganfainberg | open and transparent | 20:50 |
| boris-42 | morganfainberg: so it's not secure | 20:50 |
| morganfainberg | if it's security related we can rtake it private (e.g. exploits etc) | 20:50 |
| morganfainberg | thats all | 20:50 |
| boris-42 | morganfainberg: just performance and DDOS by authenticate | 20:50 |
| boris-42 | morganfainberg: http://logs.openstack.org/85/136485/3/check/gate-rally-dsvm-keystone/93012ee/rally-plot/results.html.gz | 20:50 |
| boris-42 | morganfainberg: so for some reason this stuff is happening even with memcahced driver under load | 20:50 |
| morganfainberg | so let me explain what i see as helping osprofiler land | 20:50 |
| morganfainberg | regardless of keystone's point | 20:51 |
| boris-42 | morganfainberg: that will be super usefull | 20:51 |
| morganfainberg | and the memcache driver has a *ton* of housekeeping in it | 20:51 |
| morganfainberg | that can be eliminated this cycle [i hope] | 20:51 |
| *** andreaf has quit IRC | 20:51 | |
| morganfainberg | also look at the AEToken work lbragstad has been working on | 20:51 |
| morganfainberg | much much much much better performance | 20:51 |
| morganfainberg | ~400% before caching | 20:51 |
| morganfainberg | and no token table bloat. we're working on those peices. they are a real concern | 20:52 |
| morganfainberg | so here is how i'd approach osprofiler | 20:52 |
| morganfainberg | this is likely to help things land: | 20:52 |
| morganfainberg | make osprofiler really do *very* basic profiling to start. seriously "started at place X, took time x" don't capture the extra data - quantify the overhead with profiling enabled or disabled. | 20:53 |
| morganfainberg | if you go with the babysteps it's easier to add more information in | 20:53 |
| morganfainberg | i'd look at the unique id generation - maybe it's a requestid + tracepoint ID | 20:53 |
| boris-42 | morganfainberg: SO first point (not caputre too much) is super simple | 20:54 |
| morganfainberg | but the goal is to make it easy to digest what it is capturing, what it is sending to the wire, and what the performance impact is per-tracepoint (roughly) | 20:54 |
| morganfainberg | boris-42, that will help you sell it imo | 20:54 |
| boris-42 | morganfainberg: okay I will do that | 20:55 |
| morganfainberg | right now you're trying to do everything at once and 1) it's overwhelming | 20:55 |
| boris-42 | morganfainberg: it's really simple (I mean whey you are speicfing point) you can send any info* | 20:55 |
| morganfainberg | and 2) there are questions on implementation because the impacts are unknown | 20:55 |
| *** _cjones_ has quit IRC | 20:55 | |
| boris-42 | morganfainberg: okay let me rework the spec | 20:55 |
| *** pnavarro has joined #openstack-keystone | 20:55 | |
| morganfainberg | and specifcying specific tracepoints that should be starting should help | 20:55 |
| *** htruta has quit IRC | 20:55 | |
| boris-42 | morganfainberg: in the baby step | 20:55 |
| boris-42 | way | 20:55 |
| morganfainberg | so i'd pick 1 or 2 specific tracepoints (ignore oslo.db) and say thats where you want to start | 20:55 |
| morganfainberg | e.g. controller / request layer | 20:56 |
| morganfainberg | and if you land the code / have landed in oslo.db that is another point | 20:56 |
| boris-42 | morganfainberg: we shouldn't land in oslo.db tracing code* | 20:56 |
| morganfainberg | as you go further in you can get more tracepoints added, but people will be more comfortable | 20:56 |
| boris-42 | morganfainberg: it creates dependency hells=) | 20:57 |
| morganfainberg | boris-42, maybe there should be a hook-point in oslo.db [optionally used?] | 20:57 |
| boris-42 | morganfainberg: so it should be in the place where I added it | 20:57 |
| boris-42 | morganfainberg: I spoke with oslo.db guys | 20:57 |
| boris-42 | morganfainberg: they suggested that | 20:57 |
| morganfainberg | but anyway, pick a specific starting point you want to profile from | 20:57 |
| boris-42 | morganfainberg: so when we are getting engine | 20:57 |
| morganfainberg | the biggest bang, which is probably the controller / wsgi layer | 20:57 |
| boris-42 | morganfainberg: add one more handler | 20:57 |
| morganfainberg | so each request can be profiled | 20:57 |
| boris-42 | morganfainberg: only if you know HMAC key | 20:58 |
| morganfainberg | then you can work to add sub-parts of those requests | 20:58 |
| morganfainberg | boris-42, i'm talking about approach, i don't care about implementation | 20:58 |
| boris-42 | morganfainberg: sure I will do it in very baby steps | 20:58 |
| morganfainberg | boris-42, i think that will make it much easier to sell the whole spec to the community | 20:58 |
| boris-42 | morganfainberg: let me just update stuff & patches | 20:58 |
| morganfainberg | and it has the added bonus that you have a clear target to hit everywhere not just "where we stick tracepoints" | 20:59 |
| morganfainberg | the unclear nature and general unease with knowing how many tracepoints / impact each tracepoint has is what led to the monkeypatch vs explicit traces vs other implementation options | 21:00 |
| boris-42 | morganfainberg: ok I will rework that part, hope my new version of spec will address all comments | 21:01 |
| morganfainberg | boris-42, does that help you some? smaller steps are easier to argue merits/flaws with, and build upon it rather than trying to dump in a "fix everything at once" deal | 21:01 |
| boris-42 | morganfainberg: heh actually I think that whole osprofiler is small tiny and very simple feature=) | 21:02 |
| morganfainberg | and realize it may prove that at scale the implementation eneds to change to monkeypatch or something else due to overhead - it might end up being the long view | 21:02 |
| boris-42 | morganfainberg: maybe because I wrote it.. | 21:02 |
| morganfainberg | boris-42, profiling is never a "small feature" | 21:02 |
| morganfainberg | ;) | 21:02 |
| boris-42 | =) | 21:02 |
| boris-42 | morganfainberg: I hope some day I will get this done+) | 21:02 |
| morganfainberg | it has a lot of implications and can do things in bad ways e.g. capturing sensitive info, performance impacts that weren't seen | 21:02 |
| morganfainberg | and those two things scare folks | 21:03 |
| morganfainberg | and the only other comment, off by default | 21:03 |
| morganfainberg | opt-in | 21:03 |
| morganfainberg | devstack can enable it by default but all projects should not be "on" by default. | 21:03 |
| morganfainberg | once it's proven, that may warrant a change. | 21:04 |
| boris-42 | morganfainberg: I am thinking about another stuff | 21:05 |
| boris-42 | morganfainberg: making it disabled by default even in DevStack | 21:05 |
| openstackgerrit | Merged openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 21:05 |
| boris-42 | morganfainberg: adding argument PROFILING_ENABLED=TRUE/FALSE | 21:05 |
| boris-42 | morganfainberg: if it is TRUE it sets all services | 21:05 |
| openstackgerrit | Sean Dague proposed openstack/keystone: wip: log wsgi requests at INFO level https://review.openstack.org/153692 | 21:06 |
| morganfainberg | boris-42, sure. | 21:10 |
| *** pnavarro has quit IRC | 21:20 | |
| *** topol has quit IRC | 21:27 | |
| morganfainberg | mtreinish, i bug bknudson, topol, or stevemar when it comes to db2 ci | 21:27 |
| morganfainberg | mtreinish, they know the right people | 21:28 |
| mtreinish | morganfainberg: cool thanks | 21:28 |
| morganfainberg | mtreinish, it *should* also be on the 3rd party ci wiki | 21:28 |
| mtreinish | oh, yeah that's a thing | 21:29 |
| mtreinish | I always forget about that | 21:29 |
| morganfainberg | gyee, tagging that fix from mtreinish for backport to Juno and Icehouse | 21:31 |
| *** radez is now known as radez_g0n3 | 21:31 | |
| gyee | nice | 21:32 |
| morganfainberg | it should be a clean cherry-pick | 21:33 |
| morganfainberg | as soon as it merges to master backports will be spun up | 21:33 |
| gyee | sounds good, you guys need help out on backporting? | 21:34 |
| morganfainberg | gyee, if you do the back port i can +2 | 21:40 |
| openstackgerrit | Sean Dague proposed openstack/keystone: log wsgi requests at INFO level https://review.openstack.org/153692 | 21:41 |
| *** henrynash has quit IRC | 21:41 | |
| gyee | you got it man | 21:43 |
| openstackgerrit | Sean Dague proposed openstack/keystone: log wsgi requests at INFO level https://review.openstack.org/153692 | 21:48 |
| morganfainberg | hey marekd, is the temperature from iron ions in the LHC accurate in this graph: http://i.imgur.com/iHW7Dwh.png ;) | 21:54 |
| morganfainberg | marekd, 5,500,000,000,000C | 21:55 |
| morganfainberg | ;) | 21:55 |
| *** _cjones_ has joined #openstack-keystone | 21:55 | |
| *** spandhe has quit IRC | 21:58 | |
| *** _cjones_ has quit IRC | 21:59 | |
| *** _cjones_ has joined #openstack-keystone | 21:59 | |
| *** rhbear has quit IRC | 22:01 | |
| openstackgerrit | Merged openstack/keystone: Fix race on default role creation https://review.openstack.org/153656 | 22:02 |
| *** mattfarina has quit IRC | 22:02 | |
| morganfainberg | gyee, ^^ | 22:03 |
| *** abhirc has quit IRC | 22:05 | |
| *** spandhe has joined #openstack-keystone | 22:05 | |
| stevemar | morganfainberg, tis but a hot day | 22:09 |
| *** mattfarina has joined #openstack-keystone | 22:10 | |
| *** mattfarina has quit IRC | 22:10 | |
| *** zigo has joined #openstack-keystone | 22:11 | |
| *** joesavak has quit IRC | 22:13 | |
| *** bknudson has quit IRC | 22:13 | |
| *** gordc has quit IRC | 22:18 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Remove globals that were introduced for compatibility https://review.openstack.org/153714 | 22:18 |
| *** MasterPieceF has quit IRC | 22:19 | |
| kfox1111 | is keystone ldap just too slow to throw a few hundred users at? | 22:19 |
| gyee | morganfainberg, looks like juno does not do auto member role creation | 22:20 |
| stevemar | kfox1111, what do you mean by 'throw'? | 22:20 |
| stevemar | kfox1111, normally the issue is retrieving users from ldap, unless you have special paging permission then you are out of luck retrieving 1000s of users, it'll timeout | 22:21 |
| kfox1111 | hmm.. stil tryingto get all services switched over, but things seem kind of slow. | 22:22 |
| kfox1111 | just wondering if having so many users will cause problems. | 22:22 |
| gyee | or return you the famous "Server is unwilling perform" error :) | 22:22 |
| kfox1111 | I enabled paging and it seems to work. | 22:22 |
| stevemar | kfox1111, now that you mention it, i do recall it being a bit slower when i was backed by ldap | 22:23 |
| kfox1111 | time cinder list took 20 seconds. | 22:23 |
| stevemar | kfox1111, try `keystone token-get` | 22:24 |
| kfox1111 | I'm not sure if thats ldap related, or the fact I had services down for a while while switching ldap backend on, and maybe rabbits backed up or something. | 22:24 |
| stevemar | cinder list will basically do a token-get, then pass the token to cinder and perform the list, so you'll at least get a better picture of where the slow down is happening | 22:25 |
| kfox1111 | ok. token-get only took like 1 second. | 22:25 |
| stevemar | weird | 22:25 |
| kfox1111 | ok. maybe I try restarting rabbit.... | 22:26 |
| *** stevemar has quit IRC | 22:26 | |
| kfox1111 | cinder list 1 second after rabbit restart. | 22:27 |
| kfox1111 | that must have been it. | 22:27 |
| *** stevemar has joined #openstack-keystone | 22:27 | |
| *** ChanServ sets mode: +v stevemar | 22:27 | |
| *** nellysmitt has joined #openstack-keystone | 22:27 | |
| morganfainberg | gyee you sure | 22:28 |
| morganfainberg | looked like it did to me | 22:28 |
| mtreinish | morganfainberg: I did a git blame before I wrote the patch, I think some of that was fairly recent | 22:29 |
| morganfainberg | gyee, https://github.com/openstack/keystone/blob/stable/juno/keystone/assignment/core.py#L262-L273 | 22:29 |
| mtreinish | oh, but that was something else, ignore me | 22:29 |
| morganfainberg | gyee, and https://github.com/openstack/keystone/blob/stable/icehouse/keystone/assignment/core.py#L243-L253 | 22:29 |
| morganfainberg | mtreinish, yeah henrynash did some massive restructuring in the code | 22:30 |
| *** nellysmitt has quit IRC | 22:32 | |
| gyee | morganfainberg, oh, maybe I was staring at the wrong code | 22:33 |
| gyee | second round :) | 22:34 |
| *** henrynash has joined #openstack-keystone | 22:34 | |
| *** ChanServ sets mode: +v henrynash | 22:34 | |
| *** lnxnut has quit IRC | 22:35 | |
| stevemar | kfox1111, any luck? | 22:35 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for data-driven backend assignment testing https://review.openstack.org/149178 | 22:38 |
| kfox1111 | yeah. I think i finally got it working. missed a username in nova's conf. | 22:38 |
| *** abhirc has joined #openstack-keystone | 22:39 | |
| stevemar | kfox1111, ah good, whats the time now, something sane? | 22:40 |
| kfox1111 | another error... trying to add user a role on project UnicodeEncodeError: 'ascii' codec can't encode character u'\xe9' in position 19: ordinal not in range(128) | 22:41 |
| kfox1111 | nova list is still failing.... ERROR (CommandError): Invalid OpenStack Nova credentials. | 22:44 |
| kfox1111 | I think that role thing may be a bug? | 22:46 |
| openstackgerrit | Steve Martinelli proposed openstack/pycadf: Do not depend on endpoint id existing in the service catalog https://review.openstack.org/109060 | 22:46 |
| kfox1111 | File "/usr/lib/python2.7/site-packages/keystone/identity/id_generators/sha256.py", line 27, in generate_public_ID | 22:46 |
| openstackgerrit | Priti Desai proposed openstack/keystone: Fix for listing role assignments by project admin https://review.openstack.org/153723 | 22:46 |
| *** joesavak has joined #openstack-keystone | 22:47 | |
| openstackgerrit | Priti Desai proposed openstack/keystone: Fix for listing role assignments by project admin https://review.openstack.org/153723 | 22:49 |
| *** jsavak has joined #openstack-keystone | 22:49 | |
| kfox1111 | hmm... keystone user-list has the same exception. | 22:52 |
| stevemar | ruh roh | 22:52 |
| *** joesavak has quit IRC | 22:53 | |
| stevemar | kfox1111, can you get any other info about the exception | 22:53 |
| kfox1111 | sure. just a sec... | 22:53 |
| kfox1111 | http://pastebin.com/XMkF5NPW | 22:54 |
| kfox1111 | I'm guessing one of the ldap users has a funny character in its cn. | 22:54 |
| *** tellesnobrega_ has joined #openstack-keystone | 22:54 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for effective & inherited mode in data driven tests https://review.openstack.org/151623 | 22:54 |
| *** wanghong has quit IRC | 22:54 | |
| *** wanghong has joined #openstack-keystone | 22:55 | |
| kfox1111 | ah... yeah... there's a group with 'Communiqué' in the name. | 22:57 |
| stevemar | that'll do it | 22:58 |
| kfox1111 | so.. thats a valid thing I guess. how do we fix that? | 23:00 |
| stevemar | good question :) | 23:00 |
| kfox1111 | I was afraid of that. :) | 23:01 |
| morganfainberg | utf8 handling in python is a nightmare | 23:02 |
| morganfainberg | not even utf8 | 23:02 |
| morganfainberg | multi-byte characters | 23:03 |
| stevemar | we need to figure out what exactly 'local_entity' is here: https://github.com/openstack/keystone/blob/c4c8d0b99a0404f4dcdb2f87c48fe15ee1526197/keystone/identity/mapping_backends/sql.py#L66 | 23:03 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for group membership to data driven assignment tests https://review.openstack.org/151962 | 23:04 |
| *** jsavak has quit IRC | 23:09 | |
| kfox1111 | its: {'local_id': u'^PNNL T&Q Communiqu\xe9', 'domain_id': 'default', 'entity_type': 'user'} | 23:12 |
| *** abhirc has quit IRC | 23:15 | |
| *** bknudson has joined #openstack-keystone | 23:25 | |
| *** ChanServ sets mode: +v bknudson | 23:25 | |
| *** thedodd has quit IRC | 23:25 | |
| *** hichtakk has joined #openstack-keystone | 23:30 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for data-driven backend assignment testing https://review.openstack.org/149178 | 23:31 |
| stevemar | kfox1111, oh nice, that looks super messed up | 23:31 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for effective & inherited mode in data driven tests https://review.openstack.org/151623 | 23:32 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for group membership to data driven assignment tests https://review.openstack.org/151962 | 23:32 |
| kfox1111 | yeah... | 23:34 |
| stevemar | morganfainberg, keystone default role is _member_ or Member? | 23:37 |
| stevemar | gyee, bknudson ^ ? | 23:37 |
| *** abhirc has joined #openstack-keystone | 23:37 | |
| mgagne | stevemar: I wanna know the answer to that one, has been bothering me for months | 23:38 |
| stevemar | i want to say _member_, since it's here in keystone.conf :) https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L72-L80 | 23:38 |
| mgagne | stevemar: what about the one found in local_settings.py in Horizon? =) | 23:39 |
| stevemar | mgagne, it seems to match: https://github.com/openstack/horizon/blob/f112869e8b18d3c0835e75c9776b084a2fd2ca1b/openstack_dashboard/settings.py#L213 | 23:40 |
| kfox1111 | ok, filed bug: https://bugs.launchpad.net/keystone/+bug/1419187 | 23:42 |
| openstack | Launchpad bug 1419187 in Keystone "ldap unicode issue" [Undecided,New] | 23:42 |
| mgagne | stevemar: hehe https://github.com/openstack/horizon/commit/0faeb80a26b484f8fb09ed95f749c2f627c1b0d1 | 23:42 |
| *** nkinder has joined #openstack-keystone | 23:44 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Remove globals that were introduced for compatibility https://review.openstack.org/153714 | 23:46 |
| *** hichtakk has quit IRC | 23:46 | |
| stevemar | mgagne, looks like it should have been _member_ for a while | 23:47 |
| *** timcline has quit IRC | 23:48 | |
| mgagne | stevemar: looks like it, unfortunately I didn't take the time to check and only had the POV of puppet modules which had the wrong value for too long | 23:48 |
| gyee | stevemar, __member__ role is designed for migration | 23:48 |
| gyee | from V2 to V3 | 23:49 |
| gyee | in V2, you can add user to a project without role assignment, that's no longer the case in V3, therefore, we have to use the __member__ role to bridge the gap | 23:49 |
| mgagne | gyee: so it's gonna add the _member_ role during the migration. If you start from V3, you could use whatever role you wish right? And I guess you can already do once the migration done. | 23:51 |
| gyee | right, with V3, you can have any role | 23:51 |
| mgagne | _member_ isn't pretty in a UI tbh | 23:51 |
| gyee | its not designed to be pretty :) | 23:52 |
| gyee | but its configurable though | 23:52 |
| gyee | so I suppose deployers can beautify it | 23:52 |
| mgagne | hehe, I'll for sure, gonna be an ascii art =) | 23:53 |
| gyee | mgagne, ++! | 23:54 |
| richm | in fact, you have to do that when using an ldap identity backend | 23:55 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: On creation default service name to empty string https://review.openstack.org/146962 | 23:55 |
| morganfainberg | kfox1111, i want to say we had a fix land in kilo about that issue | 23:55 |
| morganfainberg | kfox1111, LDAP unicode that is | 23:55 |
| morganfainberg | kfox1111, now that i'm reading more into it... | 23:55 |
| kfox1111 | do I just need to .encode('utf8') in the right place? | 23:56 |
| *** stevemar has quit IRC | 23:56 | |
| morganfainberg | kfox1111, it was not that easy of a fix iirc. let me find it. | 23:56 |
| *** nkinder has quit IRC | 23:56 | |
| morganfainberg | dang it, nkinder isn't here | 23:56 |
| morganfainberg | he did a bunch of work on that stuff | 23:56 |
| *** abhirc has quit IRC | 23:56 | |
| gyee | what was the issue? | 23:56 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/1419187 | 23:57 |
| openstack | Launchpad bug 1419187 in Keystone "ldap unicode issue" [Undecided,New] | 23:57 |
| morganfainberg | gyee, ^ | 23:57 |
| morganfainberg | gyee, and kfox1111 is on juno | 23:57 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
