*** breton has joined #openstack-keystone | 00:00 | |
*** dims has quit IRC | 00:00 | |
*** markvoelker has joined #openstack-keystone | 00:02 | |
*** _cjones_ has quit IRC | 00:07 | |
openstackgerrit | henry-nash proposed openstack/keystone: Don't add unformatted project-specific endpoints to catalog https://review.openstack.org/167050 | 00:15 |
---|---|---|
jamielennox | morganfainberg: if you take session, adapter and the auth folder - then you'll quickly discover the dependencies | 00:15 |
morganfainberg | jamielennox, those are fairly encapsulated | 00:15 |
jamielennox | well, it'll require access which requires service, and require exceptions | 00:16 |
jamielennox | it'll require fixture - and i don't know which way you want to break that - probaby put in keystoneauth | 00:16 |
*** _cjones_ has joined #openstack-keystone | 00:17 | |
jamielennox | it'll require discovery | 00:17 |
jamielennox | (but take only _discover.py) | 00:17 |
*** hogepodge has quit IRC | 00:20 | |
morganfainberg | jamielennox, right | 00:22 |
jamielennox | that's most of keystoneclient that's not versioned | 00:23 |
openstackgerrit | Masaki Matsushita proposed openstack/keystone: Make max_header_line configurable https://review.openstack.org/166125 | 00:26 |
*** hogepodge has joined #openstack-keystone | 00:31 | |
*** _cjones_ has quit IRC | 00:31 | |
*** henrynash has quit IRC | 00:33 | |
*** ayoung has quit IRC | 00:43 | |
mfisch | morganfainberg: I'm going to do a first pass swag at the doc changes then you can edit and we can iterate | 00:48 |
morganfainberg | mfisch, sounds good | 00:48 |
openstackgerrit | Merged openstack/python-keystoneclient: Improve feedback message in SSL error https://review.openstack.org/129769 | 00:55 |
*** breton has quit IRC | 00:59 | |
*** breton has joined #openstack-keystone | 00:59 | |
*** breton has quit IRC | 01:04 | |
dstanek | bknudson: ping | 01:07 |
bknudson | dstanek: what's up? | 01:07 |
dstanek | the update_domain_config entries in https://review.openstack.org/#/c/155919/10/etc/policy.json - are all three of those patches gated by update_domain_config? | 01:09 |
*** x58 has quit IRC | 01:09 | |
bknudson | dstanek: yes. | 01:09 |
dstanek | at least one of them comes through as update_domain_config_group instead of update_domain_config | 01:09 |
dstanek | and i think _only | 01:10 |
bknudson | there is no identity:update_domain_config_group in policy.json | 01:10 |
*** x58 has joined #openstack-keystone | 01:10 | |
*** breton has joined #openstack-keystone | 01:10 | |
dstanek | bknudson: right, but how does the route for update_domain_config_group map to update_domain_config? i though policy was just mapped to the action | 01:11 |
bknudson | dstanek: it's the @protected method name, not the action. | 01:12 |
bknudson | usually the action is @protected, but not always | 01:12 |
dstanek | bknudson: ugg...ok, i see now. the resource controller doesn't protect each method, but they all end up calling the same protected method. so much for being able to script this | 01:14 |
mfisch | morganfainberg: The doc already doesn't reference downgrades that I can see. | 01:14 |
mfisch | morganfainberg: first swag: https://review.openstack.org/167067 | 01:14 |
mfisch | the backup stuff is pretty solid | 01:14 |
mfisch | we do it a bit differently but that way is ok | 01:14 |
bknudson | dstanek: it could be part of a unit test, since there should be a test calling through all these. | 01:15 |
bknudson | probably not worth it. | 01:15 |
dstanek | bknudson: yeah, i was hoping to do something like i did for keeping the policy and cloud policy files in sync, but ya, not worth it | 01:16 |
openstackgerrit | Brant Knudson proposed openstack/keystone: Tests use Database fixture https://review.openstack.org/164340 | 01:23 |
*** breton has quit IRC | 01:24 | |
*** lhcheng has quit IRC | 01:24 | |
*** junhongl has joined #openstack-keystone | 01:24 | |
*** davechen has joined #openstack-keystone | 01:26 | |
davechen | bknudson: hi Brant, | 01:27 |
bknudson | davechen: hi | 01:27 |
davechen | bknudson: just one question, regarding to your comment on this patch (https://review.openstack.org/#/c/164188/) | 01:27 |
davechen | bkundson: the command for extension is still useful? | 01:28 |
davechen | bkundson: or we can just remove them? | 01:28 |
davechen | bkundson: I have tried them, these command for previous extension still work, but it will be deprecated in the future? | 01:29 |
bknudson | davechen: I can't think of a use for migrating an extension anymore... it would be some weird situation where an extension migration failed. | 01:29 |
*** junhongl has quit IRC | 01:30 | |
bknudson | all of the "extension" migrations are run by default | 01:30 |
davechen | bkundon: so, we can remove them from the doc, right? | 01:30 |
davechen | bkundon: in order to make it more clear. | 01:31 |
bknudson | I'd have to see what the change is that you're planning to make, but if you were to remove any examples using keystone-manage db_sync --extension that would be fine with nme. | 01:31 |
bknudson | me | 01:31 |
bknudson | the doc now says "For extension, migrations must be explicitly run for each extension individually." -- this isn't true. | 01:31 |
davechen | bknudson: yeah, thanks very much, I will draft a new version for review. | 01:32 |
bknudson | there aren't any extensions that you have to run migrations for explicitly | 01:32 |
*** junhongl has joined #openstack-keystone | 01:32 | |
bknudson | unless for some reason you had some kind of migration issue that you need to recover from. | 01:33 |
davechen | bknudson: something more, what's kind of failure you methioned for extension migration failed? | 01:33 |
davechen | bknudson: is there any bug associated with the failure? | 01:34 |
bknudson | it would have to be something where the database contained invalid data or something... a bug in the code. | 01:34 |
bknudson | a bug that we don't know about | 01:34 |
davechen | bknudson: thanks, good to know. :) | 01:35 |
openstackgerrit | Brant Knudson proposed openstack/keystone: Fix up token provider help text https://review.openstack.org/167068 | 01:35 |
*** junhongl has quit IRC | 01:38 | |
openstackgerrit | Brant Knudson proposed openstack/keystone: Add fernet to test_supported_token_providers https://review.openstack.org/167069 | 01:41 |
*** dims has joined #openstack-keystone | 01:44 | |
openstackgerrit | Merged openstack/keystone: On creation default service name to empty string https://review.openstack.org/146962 | 01:45 |
*** dims_ has quit IRC | 01:46 | |
openstackgerrit | Brant Knudson proposed openstack/keystone: Mark some strings for translation https://review.openstack.org/167072 | 01:47 |
openstackgerrit | Merged openstack/keystone: make credential policy check ownership of credential https://review.openstack.org/152444 | 01:47 |
openstackgerrit | Merged openstack/keystone: Deal with PEP-0476 certificate chaining checking https://review.openstack.org/144988 | 01:48 |
*** browne1 has quit IRC | 01:48 | |
openstackgerrit | Merged openstack/keystone: Update ServiceProviderModel attributes https://review.openstack.org/166936 | 01:48 |
*** iamjarvo has joined #openstack-keystone | 01:49 | |
*** iamjarvo has quit IRC | 01:49 | |
*** iamjarvo has joined #openstack-keystone | 01:50 | |
openstackgerrit | Brant Knudson proposed openstack/keystone: Mark some strings for translation https://review.openstack.org/167072 | 01:53 |
openstackgerrit | Merged openstack/keystone: Add docstrings to keystone.notifications functions https://review.openstack.org/147313 | 01:57 |
openstackgerrit | Brant Knudson proposed openstack/keystone: Fix sample policy to allow user to check own token https://review.openstack.org/164848 | 02:02 |
openstackgerrit | Brant Knudson proposed openstack/keystone: Add unit tests for sample policy token operations https://review.openstack.org/160204 | 02:02 |
openstackgerrit | Brant Knudson proposed openstack/keystone: Fix sample policy to allow user to revoke own token https://review.openstack.org/155916 | 02:02 |
*** r-daneel has quit IRC | 02:02 | |
*** _cjones_ has joined #openstack-keystone | 02:04 | |
*** _cjones_ has quit IRC | 02:04 | |
*** _cjones_ has joined #openstack-keystone | 02:05 | |
stevemar | bknudson, doing some damage tonight eh | 02:08 |
*** tqtran has quit IRC | 02:14 | |
*** erkules_ has joined #openstack-keystone | 02:14 | |
*** erkules has quit IRC | 02:16 | |
*** junhongl has joined #openstack-keystone | 02:21 | |
*** browne has joined #openstack-keystone | 02:21 | |
*** lhcheng has joined #openstack-keystone | 02:25 | |
*** richm has quit IRC | 02:26 | |
*** junhongl has quit IRC | 02:29 | |
*** lhcheng has quit IRC | 02:29 | |
*** spandhe has quit IRC | 02:32 | |
*** dims has quit IRC | 02:51 | |
*** gyee has quit IRC | 03:06 | |
*** junhongl has joined #openstack-keystone | 03:07 | |
*** junhongl has quit IRC | 03:11 | |
*** davechen1 has joined #openstack-keystone | 03:12 | |
*** alex_xu has quit IRC | 03:12 | |
*** davechen has quit IRC | 03:13 | |
dstanek | bknudson: | 03:14 |
stevemar | dstanek, better luck next time | 03:26 |
*** _cjones_ has quit IRC | 03:26 | |
dstanek | i need to little luck! | 03:27 |
*** lhcheng has joined #openstack-keystone | 03:30 | |
*** _cjones_ has joined #openstack-keystone | 03:30 | |
*** ccard_ has quit IRC | 03:34 | |
*** ccard_ has joined #openstack-keystone | 03:35 | |
*** _cjones_ has quit IRC | 03:44 | |
*** _cjones_ has joined #openstack-keystone | 03:45 | |
*** _cjones_ has quit IRC | 03:45 | |
*** omkarjoshi has quit IRC | 03:51 | |
*** spandhe has joined #openstack-keystone | 03:52 | |
*** _cjones_ has joined #openstack-keystone | 03:58 | |
*** samueldmq has quit IRC | 04:07 | |
*** spandhe_ has joined #openstack-keystone | 04:12 | |
*** dims has joined #openstack-keystone | 04:12 | |
*** spandhe has quit IRC | 04:14 | |
*** spandhe_ is now known as spandhe | 04:14 | |
*** dims has quit IRC | 04:19 | |
*** omkarjoshi has joined #openstack-keystone | 04:22 | |
openstackgerrit | David Stanek proposed openstack/keystone: Refactor: extract and rename unique_id method https://review.openstack.org/162766 | 04:27 |
*** lhcheng has quit IRC | 04:27 | |
*** omkarjoshi has quit IRC | 04:31 | |
*** hogepodge has quit IRC | 04:32 | |
*** lhcheng has joined #openstack-keystone | 04:34 | |
*** junhongl has joined #openstack-keystone | 04:39 | |
*** junhongl has quit IRC | 04:44 | |
*** ishant has joined #openstack-keystone | 04:48 | |
*** iamjarvo has quit IRC | 04:50 | |
*** lhcheng_ has joined #openstack-keystone | 04:54 | |
*** lhcheng has quit IRC | 04:57 | |
*** omkarjoshi has joined #openstack-keystone | 04:58 | |
*** hogepodge has joined #openstack-keystone | 05:01 | |
*** lhcheng_ has quit IRC | 05:14 | |
*** junhongl has joined #openstack-keystone | 05:18 | |
openstackgerrit | Merged openstack/keystone: Fix up token provider help text https://review.openstack.org/167068 | 05:22 |
*** harlowja is now known as harlowja_away | 05:22 | |
openstackgerrit | Merged openstack/keystone: Remove stevedore from test-requirements https://review.openstack.org/166541 | 05:23 |
*** junhongl has quit IRC | 05:23 | |
*** boris-42 has quit IRC | 05:28 | |
*** ajayaa has joined #openstack-keystone | 05:36 | |
*** junhongl has joined #openstack-keystone | 05:36 | |
*** junhongl has quit IRC | 05:41 | |
*** dims has joined #openstack-keystone | 06:04 | |
*** dims has quit IRC | 06:10 | |
*** _cjones_ has quit IRC | 06:20 | |
openstackgerrit | Dave Chen proposed openstack/keystone: More content in the guide for core components' migration https://review.openstack.org/164188 | 06:20 |
*** junhongl has joined #openstack-keystone | 06:33 | |
*** pcaruana has quit IRC | 06:41 | |
*** chlong has quit IRC | 06:42 | |
*** _cjones_ has joined #openstack-keystone | 06:47 | |
*** Bsony has joined #openstack-keystone | 06:57 | |
*** chlong has joined #openstack-keystone | 07:03 | |
*** browne has quit IRC | 07:07 | |
*** _cjones_ has quit IRC | 07:13 | |
*** _cjones_ has joined #openstack-keystone | 07:18 | |
*** henrynash has joined #openstack-keystone | 07:18 | |
*** ChanServ sets mode: +v henrynash | 07:18 | |
*** browne has joined #openstack-keystone | 07:45 | |
openstackgerrit | henry-nash proposed openstack/keystone: Use correct LOG translation indicator for warnings https://review.openstack.org/167124 | 07:47 |
*** breton has joined #openstack-keystone | 07:51 | |
*** dims has joined #openstack-keystone | 07:55 | |
*** stevemar has quit IRC | 07:58 | |
*** browne has quit IRC | 08:01 | |
*** dims has quit IRC | 08:02 | |
*** chlong has quit IRC | 08:12 | |
*** ccard__ has quit IRC | 08:13 | |
*** _cjones_ has quit IRC | 08:15 | |
*** erkules_ is now known as erkules | 08:21 | |
*** erkules has quit IRC | 08:21 | |
*** erkules has joined #openstack-keystone | 08:21 | |
*** tellesnobrega has quit IRC | 08:28 | |
*** ericksonfgds has quit IRC | 08:29 | |
*** pnavarro|off has joined #openstack-keystone | 08:29 | |
*** ParsectiX has joined #openstack-keystone | 08:36 | |
*** tellesnobrega has joined #openstack-keystone | 08:40 | |
*** Bsony has quit IRC | 08:41 | |
*** omkarjoshi has quit IRC | 08:42 | |
*** omkarjoshi has joined #openstack-keystone | 08:42 | |
*** omkarjoshi has quit IRC | 08:47 | |
*** pnavarro|off is now known as pnavarro | 08:48 | |
openstackgerrit | henry-nash proposed openstack/keystone: Use correct LOG translation indicator for errors https://review.openstack.org/167141 | 08:59 |
*** jistr has joined #openstack-keystone | 09:04 | |
*** krykowski has joined #openstack-keystone | 09:09 | |
*** ParsectiX has quit IRC | 09:12 | |
*** ParsectiX has joined #openstack-keystone | 09:14 | |
*** dims has joined #openstack-keystone | 09:15 | |
*** _cjones_ has joined #openstack-keystone | 09:16 | |
*** dims has quit IRC | 09:20 | |
*** _cjones_ has quit IRC | 09:20 | |
*** Bsony has joined #openstack-keystone | 09:38 | |
openstackgerrit | Dave Chen proposed openstack/keystone: Don't add unformatted project-specific endpoints to catalog https://review.openstack.org/144860 | 09:40 |
*** krykowski has quit IRC | 09:43 | |
*** lhcheng has joined #openstack-keystone | 09:44 | |
*** davechen1 has left #openstack-keystone | 09:50 | |
openstackgerrit | Matthieu Huin proposed openstack/keystone: Get method's class name in a python3-compatible way https://review.openstack.org/158777 | 09:57 |
*** amakarov_away is now known as amakarov | 10:01 | |
*** alex_xu has joined #openstack-keystone | 10:07 | |
*** _cjones_ has joined #openstack-keystone | 10:17 | |
*** dims has joined #openstack-keystone | 10:19 | |
*** henrynash has quit IRC | 10:21 | |
*** _cjones_ has quit IRC | 10:22 | |
*** markvoelker has quit IRC | 10:26 | |
*** spandhe has quit IRC | 10:26 | |
*** samueldmq-away is now known as samueldmq | 10:26 | |
*** ajayaa has quit IRC | 10:31 | |
openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Return None for missing trust_id in fixture https://review.openstack.org/167162 | 10:31 |
*** lhcheng has quit IRC | 10:32 | |
*** Bsony_ has joined #openstack-keystone | 10:34 | |
*** Bsony has quit IRC | 10:35 | |
openstackgerrit | Merged openstack/keystone: Add unit tests for sample policy token operations https://review.openstack.org/160204 | 10:36 |
*** Bsony has joined #openstack-keystone | 10:46 | |
*** jaosorior has joined #openstack-keystone | 10:46 | |
*** Bsony has quit IRC | 10:47 | |
*** Bsony_ has quit IRC | 10:48 | |
samueldmq | morning | 10:50 |
*** Bsony has joined #openstack-keystone | 10:52 | |
*** Bsony_ has joined #openstack-keystone | 10:57 | |
*** Bsony has quit IRC | 10:59 | |
*** Bsony_ has quit IRC | 11:02 | |
*** Bsony has joined #openstack-keystone | 11:05 | |
*** Bsony_ has joined #openstack-keystone | 11:13 | |
*** iamjarvo has joined #openstack-keystone | 11:14 | |
*** Bsony has quit IRC | 11:16 | |
*** ajayaa has joined #openstack-keystone | 11:17 | |
*** Bsony_ has quit IRC | 11:18 | |
*** _cjones_ has joined #openstack-keystone | 11:18 | |
*** _cjones_ has quit IRC | 11:23 | |
*** iamjarvo has quit IRC | 11:24 | |
*** markvoelker has joined #openstack-keystone | 11:26 | |
*** Bsony has joined #openstack-keystone | 11:31 | |
*** markvoelker has quit IRC | 11:31 | |
openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Simplify request making in auth_token tests https://review.openstack.org/167179 | 11:33 |
openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Create new user plugin tests https://review.openstack.org/167180 | 11:33 |
openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Serialize user auth plugin https://review.openstack.org/167181 | 11:33 |
*** Bsony has quit IRC | 11:36 | |
*** jdennis has quit IRC | 11:39 | |
*** jamielennox is now known as jamielennox|away | 11:45 | |
*** iamjarvo has joined #openstack-keystone | 11:47 | |
*** markvoelker has joined #openstack-keystone | 11:58 | |
*** boris-42 has joined #openstack-keystone | 12:07 | |
*** Bsony has joined #openstack-keystone | 12:09 | |
*** chlong has joined #openstack-keystone | 12:12 | |
*** chlong has quit IRC | 12:15 | |
*** dims has quit IRC | 12:15 | |
*** dims has joined #openstack-keystone | 12:16 | |
openstackgerrit | Kamil Rykowski proposed openstack/keystone-specs: Use oslo-versioned-objects to deal with upgrades https://review.openstack.org/167195 | 12:18 |
*** _cjones_ has joined #openstack-keystone | 12:19 | |
*** Bsony has quit IRC | 12:20 | |
*** henrynash_ has joined #openstack-keystone | 12:22 | |
*** ChanServ sets mode: +v henrynash_ | 12:22 | |
*** _cjones_ has quit IRC | 12:23 | |
*** henrynash_ has quit IRC | 12:28 | |
openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 12:30 |
*** jistr is now known as jistr|class | 12:30 | |
*** gordc has joined #openstack-keystone | 12:32 | |
*** chlong has joined #openstack-keystone | 12:32 | |
*** chlong has quit IRC | 12:35 | |
*** ishant has quit IRC | 12:36 | |
*** chlong has joined #openstack-keystone | 12:36 | |
*** rushiagr_away is now known as rushiagr | 12:37 | |
*** ericksonfgds has joined #openstack-keystone | 12:39 | |
*** chlong has quit IRC | 12:39 | |
*** iamjarvo has quit IRC | 12:48 | |
openstackgerrit | Lance Bragstad proposed openstack/keystone: create _member_ role as specified in CONF https://review.openstack.org/142897 | 12:49 |
*** bknudson has quit IRC | 12:51 | |
*** chlong has joined #openstack-keystone | 12:56 | |
*** henrynash has joined #openstack-keystone | 12:59 | |
*** ChanServ sets mode: +v henrynash | 12:59 | |
*** rushiagr is now known as rushiagr_away | 13:00 | |
*** richm has joined #openstack-keystone | 13:08 | |
*** diegows has joined #openstack-keystone | 13:13 | |
openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 13:13 |
openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 13:14 |
openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 13:14 |
openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 13:14 |
openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Creating domain and filtering by parent_id https://review.openstack.org/161378 | 13:14 |
openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Restrict inherited role assignments to subdomains https://review.openstack.org/164180 | 13:14 |
openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Stop calling domain drivers https://review.openstack.org/165936 | 13:14 |
openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change domain_id FK in project table https://review.openstack.org/166354 | 13:15 |
*** bknudson has joined #openstack-keystone | 13:15 | |
*** ChanServ sets mode: +v bknudson | 13:15 | |
openstackgerrit | Lance Bragstad proposed openstack/keystone: Allow for periods in id_strings on validation https://review.openstack.org/145024 | 13:17 |
*** iamjarvo has joined #openstack-keystone | 13:17 | |
*** iamjarvo has quit IRC | 13:17 | |
*** iamjarvo has joined #openstack-keystone | 13:18 | |
*** iamjarvo has quit IRC | 13:18 | |
*** iamjarvo has joined #openstack-keystone | 13:19 | |
*** _cjones_ has joined #openstack-keystone | 13:20 | |
*** zzzeek has joined #openstack-keystone | 13:21 | |
*** _cjones_ has quit IRC | 13:25 | |
*** iamjarvo has quit IRC | 13:30 | |
*** rushiagr_away is now known as rushiagr | 13:33 | |
*** Bsony has joined #openstack-keystone | 13:35 | |
*** henrynash has quit IRC | 13:35 | |
*** henrynash has joined #openstack-keystone | 13:35 | |
*** ChanServ sets mode: +v henrynash | 13:35 | |
*** ayoung has joined #openstack-keystone | 13:38 | |
*** ChanServ sets mode: +v ayoung | 13:38 | |
*** mattfarina has joined #openstack-keystone | 13:43 | |
*** r-daneel has joined #openstack-keystone | 13:44 | |
openstackgerrit | Merged openstack/keystone: Remove unused metadata parameter from get_catalog methods https://review.openstack.org/166837 | 13:51 |
*** jistr|class is now known as jistr | 13:53 | |
*** samueldmq is now known as samueldmq-away | 13:55 | |
openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Exposes bug when getting hierarchy on Project API https://review.openstack.org/167230 | 13:57 |
openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fixes bug when getting hierarchy on Project API https://review.openstack.org/167231 | 13:58 |
samueldmq-away | raildo ^ | 13:58 |
*** obutenko has quit IRC | 13:59 | |
raildo|away | samueldmq-away, :) thanks | 14:00 |
*** obutenko has joined #openstack-keystone | 14:02 | |
*** obutenko has quit IRC | 14:05 | |
*** carlosmarin has joined #openstack-keystone | 14:11 | |
*** sigmavirus24_awa is now known as sigmavirus24 | 14:15 | |
*** iamjarvo has joined #openstack-keystone | 14:16 | |
*** _cjones_ has joined #openstack-keystone | 14:21 | |
*** timcline has joined #openstack-keystone | 14:21 | |
*** _cjones_ has quit IRC | 14:25 | |
*** timcline has quit IRC | 14:29 | |
*** timcline has joined #openstack-keystone | 14:30 | |
*** browne has joined #openstack-keystone | 14:30 | |
*** ajayaa has quit IRC | 14:34 | |
*** ajayaa has joined #openstack-keystone | 14:35 | |
openstackgerrit | David Stanek proposed openstack/keystone: Refactor: extract and rename unique_id method https://review.openstack.org/162766 | 14:39 |
*** timcline_ has joined #openstack-keystone | 14:47 | |
*** stevemar has joined #openstack-keystone | 14:48 | |
*** ChanServ sets mode: +v stevemar | 14:48 | |
dstanek | bknudson: did you still have questions on ^ | 14:49 |
*** browne has quit IRC | 14:49 | |
openstackgerrit | David Stanek proposed openstack/keystone: Simplify injection testcase setup https://review.openstack.org/162767 | 14:50 |
*** thedodd has joined #openstack-keystone | 14:50 | |
openstackgerrit | David Stanek proposed openstack/keystone: Isolate injection tests https://review.openstack.org/162768 | 14:50 |
*** timcline has quit IRC | 14:50 | |
openstackgerrit | David Stanek proposed openstack/keystone: Decouple notifications from DI https://review.openstack.org/162769 | 14:50 |
stevemar | dstanek, yes please, decouple those guys | 14:51 |
*** EmilienM|PTO is now known as EmilienM | 14:51 | |
dstanek | stevemar: done! | 14:51 |
openstackgerrit | Dave Chen proposed openstack/keystone: Don't add unformatted project-specific endpoints to catalog https://review.openstack.org/144860 | 14:56 |
raildo|away | dstanek, do you have some time to talk about my problem in drop domain table? | 15:00 |
ayoung | rodrigods, it makes sense to merge https://review.openstack.org/#/c/167230 and https://review.openstack.org/#/c/167231 as the broken test will never pass, right? | 15:00 |
dstanek | raildo|away: i will in a little bit | 15:01 |
*** raildo|away is now known as raildo | 15:01 | |
raildo | dstanek, ok :) | 15:01 |
openstackgerrit | Dave Chen proposed openstack/keystone: Don't add unformatted project-specific endpoints to catalog https://review.openstack.org/144860 | 15:04 |
openstackgerrit | Brant Knudson proposed openstack/keystone: Tox env for Bandit https://review.openstack.org/157930 | 15:08 |
*** Tahmina has joined #openstack-keystone | 15:10 | |
*** ParsectiX has quit IRC | 15:10 | |
rodrigods | ayoung, I thought the test that should be failing in the first patch would be fixed in the second... you can refer to raildo :) thanks for reviewing this | 15:10 |
*** Tahmina_ has joined #openstack-keystone | 15:19 | |
*** browne has joined #openstack-keystone | 15:21 | |
openstackgerrit | Brant Knudson proposed openstack/keystone: Tox env for Bandit https://review.openstack.org/157930 | 15:22 |
*** HenryG has joined #openstack-keystone | 15:27 | |
openstackgerrit | Brant Knudson proposed openstack/keystone: Tox env for Bandit https://review.openstack.org/157930 | 15:30 |
*** bernardo-silva has joined #openstack-keystone | 15:31 | |
*** bernardo-silva has quit IRC | 15:32 | |
bknudson | ^ seems to work now. | 15:32 |
breton | bknudson: what's Bandit? | 15:32 |
marekd | breton: https://wiki.openstack.org/wiki/Security/Projects/Bandit | 15:33 |
breton | google says it's something about C++11 | 15:33 |
bknudson | breton: https://pypi.python.org/pypi/bandit/ | 15:33 |
bknudson | breton: we stole the name on pypi | 15:33 |
bknudson | google needs to update. | 15:33 |
breton | oh cool | 15:33 |
ayoung | rodrigods, if the test fails, it will never pass the checks. Merge the two patches into one, and keep the commit ID of whichever has more reviews | 15:34 |
breton | I like ast-related stuff | 15:34 |
*** krykowski has joined #openstack-keystone | 15:38 | |
*** browne has quit IRC | 15:39 | |
*** gyee has joined #openstack-keystone | 15:39 | |
*** ChanServ sets mode: +v gyee | 15:39 | |
*** jdennis has joined #openstack-keystone | 15:40 | |
*** _cjones_ has joined #openstack-keystone | 15:42 | |
HenryG | Hi there. While trying to run Neutron functional tests on ubuntu desktop I hit an error which someone suggested may be keystone related. | 15:43 |
HenryG | http://paste.openstack.org/show/196017/ | 15:43 |
*** _cjones_ has quit IRC | 15:44 | |
*** _cjones_ has joined #openstack-keystone | 15:44 | |
openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add API to create ecp wrapped saml assertion https://review.openstack.org/162866 | 15:54 |
openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add relay_state_prefix to Service Provider https://review.openstack.org/166078 | 15:54 |
rodrigods | marekd, stevemar ^ rebased with master changes, they lost the reviews :( | 15:55 |
stevemar | rebased! | 15:55 |
stevemar | rodrigods, i wanted to schedule a google hangout for our presentation, what times work for you next week | 15:56 |
stevemar | marekd, ^ morganfainberg same q? | 15:56 |
morganfainberg | Monday is best for me. | 15:57 |
morganfainberg | Tuesday would have to be really late for marekd due to meetings all day. | 15:57 |
*** rushiagr is now known as rushiagr_away | 15:58 | |
rodrigods | stevemar, marekd, morganfainberg any day, usually from 12 AM UTC to 9 PM UTC is best for me | 15:59 |
stevemar | morganfainberg, you on east coast time now? | 15:59 |
morganfainberg | No. | 15:59 |
rodrigods | 12 PM UTC* | 15:59 |
morganfainberg | Still pacific | 15:59 |
stevemar | gah, with the diff between you and marekd, it's going to be hard to find a time | 16:00 |
* morganfainberg looks out at 80 degree weather today | 16:00 | |
htruta | ayoung, bknudson, lhcheng: could you please take a look at https://review.openstack.org/#/c/116081/ ? | 16:01 |
morganfainberg | 26c | 16:01 |
*** EmilienM is now known as EmilienM|PTO | 16:02 | |
*** jistr has quit IRC | 16:05 | |
*** timcline_ has quit IRC | 16:08 | |
*** timcline has joined #openstack-keystone | 16:09 | |
ayoung | htruta, looking | 16:10 |
htruta | ayoung: cool | 16:13 |
*** iamjarvo has quit IRC | 16:13 | |
*** htruta has left #openstack-keystone | 16:13 | |
*** htruta has joined #openstack-keystone | 16:14 | |
ayoung | htruta, I see a check mark on the first file in the patch, so I had already started looking at it somewhen.... | 16:14 |
ayoung | htruta, and now reading the comments...I remember this patch | 16:15 |
*** atiwari has quit IRC | 16:15 | |
* ayoung doesen't scale very well | 16:15 | |
htruta | you had +2'd it | 16:15 |
htruta | lol | 16:15 |
htruta | thought you would remember at first | 16:16 |
*** chlong has quit IRC | 16:16 | |
ayoung | htruta, look at the commit message. THe first two urls are identical | 16:17 |
ayoung | GET /OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/inherited_to_projects | 16:17 |
ayoung | GET /OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/inherited_to_projects | 16:17 |
ayoung | Should that first one be a PUT? | 16:18 |
*** thedodd has quit IRC | 16:19 | |
ayoung | htruta, looks like you mean the put done on line 141 of roles.py? | 16:19 |
*** junhongl has quit IRC | 16:20 | |
*** wpf has quit IRC | 16:21 | |
*** samueldmq-away is now known as samueldmq | 16:25 | |
*** browne has joined #openstack-keystone | 16:25 | |
*** mestery has quit IRC | 16:26 | |
*** mestery has joined #openstack-keystone | 16:26 | |
*** Bsony has quit IRC | 16:30 | |
openstackgerrit | Victor Sergeyev proposed openstack/keystone: Minor tune DB query in Assignment._get_metadata() https://review.openstack.org/167305 | 16:31 |
*** thedodd has joined #openstack-keystone | 16:32 | |
stevemar | marekd, you developed your SP code for OSC on a suuuuper old branch | 16:37 |
*** wpf has joined #openstack-keystone | 16:42 | |
*** junhongl has joined #openstack-keystone | 16:42 | |
openstackgerrit | ayoung proposed openstack/python-keystoneclient: Inherited role domain calls on keystoneclient v3 https://review.openstack.org/116081 | 16:42 |
*** tqtran has joined #openstack-keystone | 16:43 | |
samueldmq | ayoung, regarding https://review.openstack.org/#/c/167230 | 16:43 |
samueldmq | ayoung, yes, failing tests cannot pass, but when they fail, they're skipped with the annotation @test_utils.wip | 16:44 |
samueldmq | ayoung, something created by dstanek | 16:44 |
ayoung | samueldmq, ah, true....I guess it would show up in the skips, too, but really not that useful. If the test changes betwee nversions of the path (other than removing WIP) it is also not useful. | 16:45 |
samueldmq | ayoung, see https://github.com/openstack/keystone/blob/master/keystone/tests/unit/utils.py#L55-L89 | 16:46 |
samueldmq | ayoung, yes :) | 16:46 |
samueldmq | ayoung, if any change fixes the bug, the wip test fails | 16:46 |
samueldmq | ayoung, wip skips if fail, and fail if passes | 16:47 |
ayoung | samueldmq, Heh | 16:47 |
samueldmq | ayoung, I think it's useful, have used many times ... :p | 16:48 |
ayoung | samueldmq, so...what I would like to see is that if we are going to use that, all of the tests are changed in the earlier patch, and the later patch only removes the WIP annotation. If we are using this, then it would be OK to add WIP to an existing test that we are modifying. Make sense? It means that the tests don't change when the feature is implemented\ | 16:49 |
samueldmq | ayoung, we cannot fix the bug and mark as wip | 16:49 |
ayoung | I know | 16:49 |
samueldmq | ayoung, if you fix the bug, the test passes, and wip fails :/ | 16:49 |
*** spandhe has joined #openstack-keystone | 16:49 | |
ayoung | first patch has all of the test changes | 16:49 |
ayoung | second one actually fixes the bug | 16:49 |
ayoung | you can put some soert of comment in the git message that it partially addresses a bug | 16:50 |
samueldmq | ayoung, got it | 16:50 |
samueldmq | ayoung, got it | 16:50 |
samueldmq | ayoung, gonna fix | 16:50 |
ayoung | samueldmq, I actually really like that approach. It what dolphm and I were shooting for back when he wrote the tests for trusts. | 16:50 |
samueldmq | ayoung, I fixed other tests in the second patch, that should be in the first | 16:50 |
dstanek | ayoung: samueldmq: tests in one patch and code in next (+ remove wip) is my preferred flow as a reviewer | 16:51 |
samueldmq | dstanek, yes, that's what ayoung is arguing for :) | 16:51 |
dstanek | one of the first things i do is run the tests against the old code anyway. this just makes it easier | 16:51 |
ayoung | dstanek, that one has earned you a beer. Or better | 16:51 |
samueldmq | and I wasnt undertanding ;/ | 16:51 |
dstanek | ayoung: what is better than a beer? | 16:52 |
raildo | dstanek, two beers :) | 16:52 |
dstanek | raildo: ++ | 16:52 |
dstanek | raildo: are you still having that issue? | 16:52 |
raildo | dstanek, yes :( | 16:53 |
*** krykowski has quit IRC | 16:54 | |
raildo | dstanek, I put my code in a devstack and make a sql select, to see if the domain table are FK for other table, and I got this: http://paste.openstack.org/raw/196064/ | 16:54 |
htruta | ayoung: yes, the first one should be a PUT | 16:55 |
raildo | so, the Fk migration works good and we don't have anything pointed for the domain table | 16:55 |
htruta | that's it | 16:55 |
dstanek | i think the problem is that sqlalchemy remembers the schema to that when we rebuild the database it think the FK still needs to be created | 16:55 |
htruta | ayoung: any other concerns beside the commit message? | 16:56 |
dstanek | raildo: maybe morganfainberg or zzzeek would know more | 16:57 |
* morganfainberg is in meeting. | 16:57 | |
raildo | morganfainberg, np | 16:58 |
raildo | dstanek, we remove the domain driver here: https://review.openstack.org/#/c/165936/, maybe we forgot some call... | 16:58 |
raildo | dstanek, i'll investigate more but thanks for the help :) | 16:59 |
dstanek | raildo: i don't think that is it - i think that since we start with a database that has the foreign keys it still thinks we need them at reflection time | 17:00 |
raildo | dstanek, hum.. i got it | 17:01 |
*** bdossant has joined #openstack-keystone | 17:01 | |
*** timcline_ has joined #openstack-keystone | 17:03 | |
*** lhcheng has joined #openstack-keystone | 17:04 | |
*** timcline has quit IRC | 17:07 | |
openstackgerrit | Brant Knudson proposed openstack/keystone: Tox env for Bandit https://review.openstack.org/157930 | 17:09 |
morganfainberg | so i have good news and bad news... | 17:14 |
morganfainberg | and i'll re-iterate this in the meeting | 17:14 |
morganfainberg | stevemar, https://blueprints.launchpad.net/keystone/+spec/ecp-wrapped-saml-assertions please update your commits to reference that BP as well. FFE has been accepted | 17:14 |
morganfainberg | henrynash, domain-SQL FFE is accepted. | 17:15 |
henrynash | morganfainberg: excellent! | 17:15 |
morganfainberg | marekd, stevemar, ECP wrap FFE is accepted | 17:15 |
stevemar | \o/ | 17:15 |
morganfainberg | raildo, rodrigods, samueldmq, henrynash, unfortunately, reseller - due to scope and associated risk [changing how domains work] will need to land in Liberty | 17:15 |
rodrigods | morganfainberg, ok, fair enough | 17:16 |
raildo | :'( | 17:16 |
morganfainberg | IDP registreation also accepted | 17:16 |
raildo | morganfainberg, ok.. I understand | 17:16 |
morganfainberg | IDP registration, and domain-SQL need to land by EOW | 17:16 |
morganfainberg | ECP can land by tuesday | 17:17 |
morganfainberg | fwiw, we have more FFEs than neutron, cinder, and nova combined | 17:17 |
morganfainberg | lets not do that again :P | 17:18 |
*** harlowja_away is now known as harlowja | 17:18 | |
morganfainberg | raildo, rodrigods, i think we can revisit jogo's idea for the topic branch and topic core for reseller now, if you want. | 17:18 |
morganfainberg | will discuss that later on. | 17:19 |
raildo | morganfainberg, sure.. I agree | 17:19 |
rodrigods | morganfainberg, ++ I support this idea | 17:19 |
rodrigods | morganfainberg, thanks for the help btw | 17:19 |
morganfainberg | lbragstad, henrynash, stevemar, dstanek, gyee, jamielennox|away, ayoung, bknudson, dolphm, marekd, when triaging bugs for RC unless you *know* [e.g. security bug] it needs to be RC, please use the 'kilo-rc-potential' tag, do not assign them to RC milestone | 17:20 |
morganfainberg | ^^ this goes for everyone doing bug triage | 17:20 |
henrynash | morganfainberg: ok | 17:21 |
dstanek | morganfainberg: k | 17:21 |
stevemar | gotcha | 17:23 |
* morganfainberg is going to be evicting most bugs off the rc1 milestone | 17:24 | |
gyee | morganfainberg, ack | 17:24 |
morganfainberg | full meeting today | 17:25 |
morganfainberg | anyway i'm going to go grab coffee. | 17:25 |
*** Tahmina_ has quit IRC | 17:27 | |
ayoung | in order to avoid FFEs, we need to start earlier. We need to be working *NOW* on stuff for Liberty. What was clear to me aabout in the Grizzly time frame has now been made clear to you guys: there is not enough time beween summit and Code freeze to get critizl features done. | 17:33 |
morganfainberg | ayoung, spec proposals are open for L | 17:34 |
morganfainberg | ayoung, now. with the end goal of having what we normally do at the mid cycle available for us to do at the summit | 17:34 |
ayoung | morganfainberg, that is why I was pushing to get everything in to backlog | 17:34 |
gyee | Give me Liberty or give me FFE! | 17:34 |
ayoung | we should not have to wait for "L" specs to be open to work on them | 17:34 |
ayoung | that should be an administrative call. | 17:35 |
morganfainberg | ayoung, no we shouldn't, but we were quite backlogged. | 17:35 |
ayoung | I'm trying to make it easier for you to do the PTL stuff, and let coders code and spec-ers spec | 17:35 |
ayoung | morganfainberg, yep | 17:35 |
ayoung | not being critical | 17:35 |
ayoung | and I think you really knew this already | 17:35 |
morganfainberg | so, now we can make the calls now :) or backlog it | 17:35 |
morganfainberg | :) | 17:35 |
morganfainberg | yep | 17:35 |
rodrigods | ayoung, our experience with HMT and Reseller proves that | 17:35 |
ayoung | I was talking more to our Brazil team...henrynash has the time on the project to know this as well | 17:35 |
ayoung | rodrigods, its why I take the Long view | 17:36 |
morganfainberg | i'd like official FF to be L2 next cycle, leaving L3 for any features that are a priority like reseller to slip | 17:36 |
*** Bsony has joined #openstack-keystone | 17:36 | |
morganfainberg | (though reseller itself should land in l1) | 17:36 |
ayoung | HIghest priority are knocking out things that are going to get in the way. For me, that is access info, and other client/common type things | 17:36 |
rodrigods | morganfainberg, ++ L2 | 17:37 |
morganfainberg | ayoung, i have most of the steps done to split out keystoneauth [which is where session, adapter, _discovery, service_catalog, plugins] will move to. | 17:37 |
dstanek | what caused reseller to slip? the fact that they started late because of spec dates or that it took more time than expected? | 17:38 |
morganfainberg | dstanek, both | 17:38 |
ayoung | morganfainberg, separate repo? | 17:38 |
morganfainberg | ayoung, yep | 17:38 |
morganfainberg | ayoung, that clients can use w/o needing to fork-lift in keystoneclient | 17:38 |
ayoung | morganfainberg, so that is "common" | 17:38 |
raildo | morganfainberg, and Feature Proposal Freeze L1? | 17:38 |
morganfainberg | unless you're interacting with keystone apis, ksc shouldn't be needed | 17:38 |
morganfainberg | raildo, that is my hope | 17:38 |
morganfainberg | ayoung, it's specific to auth-things, but that is "common" parts of ksc | 17:39 |
ayoung | morganfainberg, where does access_info go? | 17:39 |
morganfainberg | ayoung, accessinfo is auth-related | 17:39 |
dstanek | morganfainberg: i'm not against changing dates, but would that have helped? | 17:39 |
raildo | dstanek, both... we start implement after K2, and we find some difficult points. | 17:39 |
morganfainberg | dstanek, if we had the midcycle talks at the summit, with an extra few weeks for spec discussion prior ot summit, yes | 17:39 |
*** bdossant has quit IRC | 17:40 | |
ayoung | session and auth info are two different domains. Do they really belong in the same repo? | 17:40 |
morganfainberg | ayoung, session is what the clients use for auth | 17:40 |
dstanek | it seems to me that the FFEs are not because they waited too late for a date, but that the work was more than what could be done in a cycle | 17:40 |
morganfainberg | ayoung, keystoneclient session *is* an auth thing (this isn't httpclient) | 17:40 |
ayoung | access_info is ....different... | 17:40 |
morganfainberg | oh FFS | 17:41 |
ayoung | morganfainberg, session assumes a remote keystone. access_info does not | 17:41 |
morganfainberg | i'm going to miss my breakfast and coffee now | 17:41 |
*** Bsony has quit IRC | 17:41 | |
ayoung | heh | 17:41 |
morganfainberg | 15 min is not enough time. | 17:41 |
morganfainberg | i tried. | 17:41 |
morganfainberg | i really did | 17:41 |
* morganfainberg is grumpy now. | 17:42 | |
ayoung | morganfainberg, I explicitly did not ping you on my original message to let you go eat. It was you who responded | 17:42 |
ayoung | Go get food. | 17:42 |
morganfainberg | i need to go to a coffee shop | 17:42 |
morganfainberg | they are testing firealarms here | 17:42 |
ayoung | You need a chemex | 17:42 |
morganfainberg | hence why 15 mins isn't enough time | 17:42 |
ayoung | ah...go to coffee shop anyway | 17:43 |
david8hu | Large McCoffee is still $0.99 | 17:43 |
ayoung | david8hu, it fails the "Coffee" test | 17:44 |
david8hu | They call it the premium coffee. It got to mean something :) | 17:44 |
ayoung | david8hu, if it were real coffee, they would be raising the price, not lowering it | 17:45 |
david8hu | LOL | 17:45 |
dstanek | premium sludge | 17:48 |
openstackgerrit | Merged openstack/keystone: Fix sample policy to allow user to revoke own token https://review.openstack.org/155916 | 17:54 |
*** timcline_ has quit IRC | 17:56 | |
morganfainberg | Meeting will start a minute or two late. | 17:57 |
*** timcline has joined #openstack-keystone | 17:57 | |
samueldmq | morganfainberg, ack (reseller) | 17:58 |
samueldmq | morganfainberg, how much time do we have till kilo (final release) ? | 17:59 |
*** Tahmina has quit IRC | 17:59 | |
samueldmq | morganfainberg, 1 month? | 17:59 |
dstanek | samueldmq: until it ships? | 18:01 |
samueldmq | dstanek, yep | 18:01 |
dstanek | samueldmq: https://wiki.openstack.org/wiki/Kilo_Release_Schedule | 18:01 |
samueldmq | dstanek, 1 month then | 18:02 |
dstanek | samueldmq: if you are talking about code then i would guess much less | 18:02 |
samueldmq | dstanek, makes sense, then 2 or 3 weeks .. | 18:03 |
samueldmq | dstanek, so yeah, that maybe risky to land reseller, you guys have more xp on this :) | 18:03 |
samueldmq | dstanek, then I just agree | 18:03 |
samueldmq | dstanek, I was just tring to figure out how we were in time, thanks | 18:03 |
dstanek | well, you have to get the code completed and then through review | 18:03 |
*** jamielennox|away is now known as jamielennox | 18:04 | |
marekd | morganfainberg: rodrigods stevemar: Actually I wanted to say this during the meeting: I will be unavailable for next two weeks (starting from Friday), so maybe we could organize some hangout this Thursday? | 18:05 |
stevemar | marekd, sure, topol is away this week so it looks like we might have 2 then | 18:05 |
stevemar | but we can do thursday | 18:05 |
rodrigods | stevemar, marekd works for me too | 18:06 |
stevemar | marekd, does around this time work for you? | 18:07 |
marekd | yeah | 18:07 |
stevemar | k | 18:07 |
marekd | later is fine too. | 18:07 |
*** Akshik has joined #openstack-keystone | 18:10 | |
openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Exposes bug when getting hierarchy on Project API https://review.openstack.org/167230 | 18:20 |
*** omkarjoshi has joined #openstack-keystone | 18:21 | |
openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fixes bug when getting hierarchy on Project API https://review.openstack.org/167231 | 18:23 |
samueldmq | ayoung, raildo ^ | 18:23 |
marekd | stevemar: speaking osc - let me then fix what I had broken. | 18:27 |
marekd | (re super old branch) | 18:27 |
stevemar | marekd, just hit the rebase button | 18:27 |
marekd | now you know my secret. | 18:28 |
*** bdossant has joined #openstack-keystone | 18:34 | |
*** bdossant has quit IRC | 18:35 | |
morganfainberg | ok ayoung have coffee | 18:58 |
ayoung | morganfainberg, yay | 18:58 |
morganfainberg | ayoung, so my thought is FreeIPA should be setup in the local node w/ explicit data | 18:58 |
amakarov | morganfainberg, tbh I'd like to do some changes to revocation engine itself | 18:58 |
morganfainberg | that way if we have a *ton* of requests/gate jobs we can't overload a limited resource | 18:58 |
ayoung | ok, so Is the issue with FreeIPA sepcifically, or just having a shared host for LDAP testing | 18:58 |
morganfainberg | ayoung, any "shared" resource | 18:59 |
morganfainberg | it should be something that is setup in devstack / local node so that i can download it and work locally | 18:59 |
morganfainberg | w/o needing access to infra resources | 18:59 |
ayoung | morganfainberg, OK, so we have the Devstack work to setup an OpenLDAP instance | 18:59 |
morganfainberg | ayoung, yep. that was my only concern with what you want to do | 18:59 |
ayoung | but...freeipa needs Horizon set up, and will conflict on SSL...it really is a bad set up to put them on the same host | 19:00 |
morganfainberg | ayoung, and this should be in the functional testing wheelhouse | 19:00 |
morganfainberg | ayoung, there is some work to do multi-node gate checks | 19:00 |
gyee | ayoung, morganfainberg, where are we with the out-of-tree work for LDAP driver rewrite? | 19:01 |
ayoung | Why no shared resource? Its not like we are going to oveload the IPA server with queries | 19:01 |
ayoung | gyee, SSSD. | 19:01 |
ayoung | Was testing it recently, works fine | 19:01 |
jamielennox | morganfainberg, bknudson: things i would want for next KSC release are: https://review.openstack.org/162529 https://review.openstack.org/163271 | 19:01 |
morganfainberg | ayoung, alternatively, can FreeIPA live behind a proxy? so /FreeIPA and i know horizon is working on using non-root as well so it could be /dashboard | 19:01 |
*** jistr has joined #openstack-keystone | 19:02 | |
morganfainberg | ayoung, because a single server on the internet for testing is a risk factor. and if *everyone* wants to test it they don't have a clear means to run their tests locally | 19:02 |
ayoung | morganfainberg, we could, in theory put them on the same instance, but...yuck | 19:02 |
henrynash | jamielennox, morganfainberg, bknudson: …and I’ll be posting the client libs for domain config soon too | 19:02 |
ayoung | gyee, coming in a moment.... | 19:02 |
morganfainberg | ayoung, just keep in mind we want to run this *anywhere*. Not just from RAX | 19:03 |
morganfainberg | or HP | 19:03 |
morganfainberg | or Infra cloud | 19:03 |
ayoung | morganfainberg, OK, I was talking explicitly "check" though | 19:03 |
jamielennox | henrynash: i think morganfainberg's planning it for tomorrow, but we're getting fairly frequent now | 19:03 |
morganfainberg | saying all gating relies on a node [ignore the zuul, nodepool things atm], in a cloud is kind of bad | 19:03 |
ayoung | we can always make it so that you can run against a pre-setup server | 19:03 |
henrynash | jamielennox: as long as there is another before rc, i can wait for that | 19:03 |
ayoung | gyee, http://adam.younglogic.com/2015/03/key-fed-lookup-redux/ | 19:03 |
bknudson | there's always something we want in the next ksc release... no need to hold up since we can release every couple minutes if we want. | 19:03 |
gyee | ayoung, but sssd is not per-domain right? | 19:03 |
morganfainberg | ayoung, i also think -infra will not be happy about having to run a special snowflake node | 19:04 |
morganfainberg | ayoung, ignoring again zuul and nodepool | 19:04 |
morganfainberg | i know they want to eventually HA those things. | 19:04 |
ayoung | gyee, sssd can handle multi-domain itself | 19:04 |
ayoung | morganfainberg, I'm just worried that devstack will mess up the IPA install. IPA is very locked down | 19:04 |
morganfainberg | ayoung, does it handle things sanely when the DN is identical, just different actual servers? | 19:04 |
morganfainberg | ayoung, talk w/ clarkb about a multi-node job | 19:05 |
morganfainberg | ayoung, i think this is also where we could do k2k testing | 19:05 |
morganfainberg | if we do it right | 19:05 |
ayoung | morganfainberg, ok...let's punt on the full IPA until I can get somethign working with devtack. LDAP... | 19:05 |
ayoung | Let's do this: | 19:05 |
ayoung | use the devstack ldap work to bring up an OpenLDAP instance, and then after the run, mount the domain there. | 19:05 |
morganfainberg | LDAP is much easier as we already have some of the work done for us [just needs some updates] and being placed into a functional setup scenario | 19:05 |
morganfainberg | ayoung, yep. that sounds about right to me | 19:06 |
ayoung | morganfainberg, did you see the testing spec review I posted? | 19:06 |
gyee | ayoung, do I need to setup a different auth url per domain? | 19:06 |
morganfainberg | yah i saw it. | 19:06 |
morganfainberg | haven't read it in depth | 19:06 |
ayoung | gyee, hmmm....no clue. | 19:06 |
gyee | ok I need to give it a try | 19:07 |
ayoung | gyee, do we have a way to map to domain in the mapping layer? | 19:07 |
ayoung | gyee, ...if you can replicate what I did with your LDAP...that wouldbe fantsinominal! | 19:07 |
gyee | yes if domain is a separatte attribute | 19:07 |
ayoung | morganfainberg, https://review.openstack.org/#/c/163882/ | 19:08 |
*** edmondsw has joined #openstack-keystone | 19:10 | |
* morganfainberg goes to unblock reviews now | 19:10 | |
morganfainberg | stevemar, make sure to update the ECP reviews to also point at the BP | 19:11 |
*** ajayaa has quit IRC | 19:12 | |
openstackgerrit | Brant Knudson proposed openstack/keystone: Tox env for Bandit https://review.openstack.org/157930 | 19:12 |
morganfainberg | stevemar, marekd, there is an API change for https://review.openstack.org/#/c/152156/ or did it already land? | 19:14 |
*** sigmavirus24 is now known as sigmavirus24_awa | 19:17 | |
*** sigmavirus24_awa is now known as sigmavirus24 | 19:17 | |
*** ChanServ changes topic to "High Priority Reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 | Review RC Blocking Reviews. | RC Milestone: https://launchpad.net/keystone/+milestone/kilo-rc1" | 19:18 | |
morganfainberg | henrynash, marekd, stevemar, FFE BPs should be all unblocked | 19:18 |
morganfainberg | henrynash, marekd, stevemar, i'll send the i18n email later today for string freeze exception notifications | 19:19 |
stevemar | morganfainberg, thx | 19:19 |
morganfainberg | amakarov, i'm open to seeing enhncements to the revocation engine | 19:29 |
*** Akshik has quit IRC | 19:29 | |
*** tellesnobrega has quit IRC | 19:29 | |
*** gyee has quit IRC | 19:30 | |
amakarov | morganfainberg, the idea is to move that fancy tree-logic to backend driver level so we can use advantages of SQL to search events for token: now we extract entire revocation tree, build it and then and only then - match the token against it | 19:31 |
*** jistr has quit IRC | 19:31 | |
morganfainberg | amakarov, so realize the same search logic needs to be ported into middleware | 19:32 |
morganfainberg | since ksm needs to be able to handle the revocations as well | 19:32 |
morganfainberg | i'd rather not have 2 different ways that can diverge to check revocations | 19:32 |
amakarov | morganfainberg, oh, thanks for pointing | 19:32 |
morganfainberg | strictly from a maintainability standpoint | 19:32 |
*** tellesnobrega has joined #openstack-keystone | 19:33 | |
morganfainberg | amakarov, but i'm sure we can improve the logic / make it more readable | 19:33 |
morganfainberg | probably with some recursion. | 19:33 |
morganfainberg | instead of the very terse looping we have now | 19:33 |
amakarov | morganfainberg, ok, I'll work on algorithm modification | 19:34 |
morganfainberg | amakarov, only if you want to ;) | 19:34 |
morganfainberg | amakarov, getting support in KSM is more important | 19:35 |
amakarov | 1 more thing: what about Redis backend? I realize it leads to a dead-end of sorts? ) | 19:35 |
morganfainberg | amakarov, we can add it in liberty. unless we deprecate PKI and UUID tokens, we can't eliminate these persistence backends | 19:36 |
morganfainberg | amakarov, it doesn't hurt us to have it as a first-order backend. | 19:36 |
morganfainberg | but we should make a functional testing scenario that will actually test redis | 19:36 |
morganfainberg | not just some mocked thing that might/mightnot be redis | 19:36 |
morganfainberg | zzzeek, i'm planning on circling up on the lock thing for dogpile | 19:36 |
morganfainberg | zzzeek, i forgot to ask you directly for feedback on it. i just wanted to check to see if it was something you'd like in memcache to bring it up to par with redis before writing tests | 19:37 |
amakarov | morganfainberg, understood: postponed to liberty, add functional tests, think about the lock (default is just the polling) | 19:37 |
zzzeek | morganfainberg: no hurry here :) my only issue is forgetting about old PRs | 19:37 |
morganfainberg | zzzeek, well i know where you lurk ! | 19:37 |
zzzeek | morganfainberg: i might have commented on memcache API compat ? | 19:37 |
morganfainberg | i can poke you ;) | 19:37 |
morganfainberg | zzzeek, i think it was just "hey tests" | 19:38 |
morganfainberg | zzzeek, but i'm under rc-things | 19:38 |
morganfainberg | :P | 19:38 |
morganfainberg | zzzeek, heck i promised that PR...uhhh.. 6 months ago to you | 19:38 |
morganfainberg | :P | 19:38 |
*** spandhe has quit IRC | 19:38 | |
morganfainberg | but if that lands i can rip out all the custom log logic from keystone's kvs/cache stuff | 19:38 |
morganfainberg | s/log/lock | 19:38 |
morganfainberg | in liberty | 19:39 |
morganfainberg | will simplify a lot of things. | 19:39 |
morganfainberg | ayoung, soooooo i never thought i'd say this but... | 19:39 |
*** morganfainberg is now known as needslesscoffee | 19:39 | |
needslesscoffee | ayoung, ... | 19:39 |
ayoung | I have what that gentleman was having.... | 19:40 |
ayoung | I'll... | 19:40 |
needslesscoffee | i think i'm up to 7 shots of espresso... | 19:40 |
needslesscoffee | >.< | 19:40 |
*** spandhe has joined #openstack-keystone | 19:40 | |
dstanek | needslesscoffee: rough day? | 19:41 |
needslesscoffee | dstanek, yeah | 19:42 |
needslesscoffee | dstanek, day 2 of 3 of fire alarm testing in my apt. complex | 19:42 |
dstanek | needslesscoffee: haha, they either work or they don't - they may just be trying to torture you | 19:43 |
*** henrynash has quit IRC | 19:43 | |
needslesscoffee | dstanek, need to test every apartment individually | 19:43 |
ayoung | needslesscoffee, More like (O‿O) | 19:43 |
needslesscoffee | dstanek, unfortunately, it's by zone. | 19:43 |
*** henrynash has joined #openstack-keystone | 19:43 | |
*** ChanServ sets mode: +v henrynash | 19:43 | |
needslesscoffee | dstanek, i'm just in the middle so i hear *all* the zones | 19:43 |
needslesscoffee | actually it's 4 days of testing | 19:43 |
ayoung | キタ━━━(゜∀゜)━━━!!!!! | 19:43 |
*** ccard_ has quit IRC | 19:43 | |
needslesscoffee | (ノಠ益ಠ)ノ ┻━┻ | 19:44 |
ayoung | (屮゚Д゚)屮 ┻━┻ | 19:45 |
stevemar | needslesscoffee, KSC being released tomorrow? or soon? | 19:45 |
needslesscoffee | ┬─┬ ︵ /(.□. \) | 19:45 |
needslesscoffee | stevemar, today or tomorrow | 19:45 |
needslesscoffee | stevemar, have not decided | 19:45 |
needslesscoffee | stevemar, a reason i should pick one over the other? | 19:45 |
stevemar | okay, i have an OSC patch that depends on a new KSC release, just double checking | 19:45 |
ayoung | I wonder what we are actually saying in Japanese when we write that. | 19:45 |
*** _cjones_ has quit IRC | 19:45 | |
needslesscoffee | stevemar, you can't rely on the KSC stuff unless g-r updates | 19:46 |
*** _cjones_ has joined #openstack-keystone | 19:46 | |
needslesscoffee | stevemar, wont happen in kilo | 19:46 |
needslesscoffee | iirc g-r is frozen | 19:46 |
stevemar | needslesscoffee, that's unfortunate | 19:46 |
stevemar | i guess g-r won't be updated until after rc1? | 19:47 |
needslesscoffee | stevemar, yes. but don't do a "what keystone did with cryptography" | 19:47 |
needslesscoffee | and make choices about code paths that are 0.7+ and the minimum is 0.4 | 19:47 |
stevemar | needslesscoffee, yeah, trying to avoid that | 19:47 |
*** ccard_ has joined #openstack-keystone | 19:48 | |
*** needslesscoffee is now known as morganfainberg | 19:50 | |
*** omkarjoshi has quit IRC | 19:50 | |
*** _cjones_ has quit IRC | 19:50 | |
*** _cjones_ has joined #openstack-keystone | 19:52 | |
dstanek | morganfainberg: how did the tests not catch the cryptography version issues? | 19:59 |
morganfainberg | dstanek, because nothing tests minimum versions installed | 19:59 |
morganfainberg | dstanek, cryptography>=0.4 | 19:59 |
morganfainberg | well that installs 0.8 right now | 20:00 |
*** ccard__ has joined #openstack-keystone | 20:00 | |
morganfainberg | nothing says "we should try this with 0.4" | 20:00 |
dstanek | morganfainberg: i thought the code was using something that only appeared in 0.7 | 20:00 |
morganfainberg | yep | 20:00 |
morganfainberg | so if all our tests install 0.8 | 20:00 |
morganfainberg | how did we miss that this doesn't work with the minimum in requirements? pretty easy | 20:01 |
bknudson | morganfainberg: didn't you know that MultiFernet was only added in cryptography 0.7? | 20:01 |
morganfainberg | bknudson, not until someone pointed it out to me. | 20:02 |
*** ccard_ has quit IRC | 20:02 | |
morganfainberg | i think it was zigo | 20:02 |
dstanek | morganfainberg: the check tests would have installed the version from requirements right? or did we have a newer version in our requirements that what was in g-r? | 20:02 |
morganfainberg | dstanek, the check installs the maximum available that is in compliance with requirements | 20:03 |
morganfainberg | dstanek, what happens when you tell pip to install package>=1.0 | 20:03 |
morganfainberg | and 2.0 is available | 20:03 |
dstanek | morganfainberg: that's all kinds of mess | 20:04 |
morganfainberg | welcome to pip | 20:04 |
dstanek | it's not a pip thing, it's that we don't pin to a version | 20:04 |
morganfainberg | dstanek, well the issue is tracking every change, including transient changes | 20:05 |
morganfainberg | dstanek, pip is a very poor packaging system | 20:05 |
morganfainberg | with bad dep resolution | 20:05 |
morganfainberg | so pinning = breaking things often | 20:05 |
morganfainberg | wow... my battery life has crashed on this laptop | 20:05 |
morganfainberg | back down to ~3h | 20:05 |
morganfainberg | from full charge | 20:06 |
morganfainberg | :( | 20:06 |
morganfainberg | less | 20:06 |
morganfainberg | 2.5h | 20:06 |
dstanek | same thing happened to my air | 20:06 |
morganfainberg | was like within 1 week | 20:06 |
morganfainberg | maybe a yosemite update broke things | 20:06 |
morganfainberg | it went from 2hr -> 5-6hr when going mavericks -> yosemite | 20:06 |
morganfainberg | now it just got real bad again | 20:07 |
*** amakarov is now known as amakarov_away | 20:07 | |
marekd | morganfainberg: https://review.openstack.org/#/c/152156/ does change API | 20:12 |
morganfainberg | marekd, did we reflect that change in the -specs repo for the API doc? | 20:12 |
morganfainberg | marekd, was my question | 20:12 |
marekd | morganfainberg: ah, sorry | 20:13 |
marekd | morganfainberg: yes, we did: https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#api-resources | 20:13 |
*** omkarjoshi has joined #openstack-keystone | 20:17 | |
*** timcline_ has joined #openstack-keystone | 20:19 | |
*** timcline has quit IRC | 20:19 | |
morganfainberg | marekd, great | 20:21 |
*** _cjones_ has quit IRC | 20:23 | |
*** _cjones_ has joined #openstack-keystone | 20:23 | |
openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add relay_state_prefix to Service Provider https://review.openstack.org/166078 | 20:23 |
openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add API to create ecp wrapped saml assertion https://review.openstack.org/162866 | 20:23 |
openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add API to create ecp wrapped saml assertion https://review.openstack.org/162866 | 20:23 |
openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Add a relay_state_prefix to the service provider resource https://review.openstack.org/166086 | 20:24 |
henrynash | ayoung, stevemar: would one of you like to do the honors on https://review.openstack.org/#/c/166010/2 now that the FFE has been granted? | 20:29 |
ayoung | henrynash, "FIRE IN THE HOLE!" | 20:31 |
* morganfainberg glares at the laptop... | 20:32 | |
morganfainberg | why does your battery life suck so suddenly | 20:32 |
bknudson | morganfainberg: ever see those ads about your computer slowing down? | 20:32 |
morganfainberg | bknudson, ads? | 20:32 |
morganfainberg | bknudson, what are these things you speak of? | 20:33 |
bknudson | morganfainberg: for the virus checkers | 20:33 |
bknudson | they're everywhere | 20:33 |
morganfainberg | bknudson, /me looks at adblock and ghostery | 20:33 |
morganfainberg | bknudson, yep don't see them | 20:33 |
stevemar | ayoung, i was literally going to say that when i approved it | 20:33 |
stevemar | morganfainberg, bknudson is referring to this kinda junk: https://www.youtube.com/watch?v=PujDMHFBgXU | 20:35 |
henrynash | ayoung. stevemar: ah, captains! | 20:36 |
morganfainberg | stevemar, woooooosh ^^ adblock, ghostery reference above | 20:36 |
bknudson | morganfainberg: all you have to do is give them your password. | 20:36 |
bknudson | or install an application for them. | 20:37 |
morganfainberg | bknudson, all good. totally sending my password now: 12345 | 20:37 |
henrynash | stevemar: you didn’t signed up right away? | 20:38 |
stevemar | henrynash, i bought 3 licences just to be sure | 20:39 |
henrynash | stevemar: Im sure it will fix everything and, after all, they said you PC would be “100% faster” (what the hell does that mean!) | 20:40 |
*** nellysmitt has joined #openstack-keystone | 20:47 | |
*** nellysmitt has quit IRC | 20:47 | |
*** __TheDodd__ has joined #openstack-keystone | 20:50 | |
marekd | hey, in that adv, there were real people for whom it worked...! :-) | 20:50 |
*** jaosorior has quit IRC | 20:52 | |
*** thedodd has quit IRC | 20:53 | |
*** timcline_ has quit IRC | 20:55 | |
*** samueldmq is now known as samueldmq-away | 20:55 | |
stevemar | marekd, sound like youre gonna buy it | 20:58 |
stevemar | henrynash, would you hate me if i scheduled something for friday at 1800 UTC? | 20:58 |
stevemar | i shouldn't do that, i would hate it if someone did that to me | 20:59 |
* morganfainberg watches 0% battery left. | 20:59 | |
morganfainberg | this ought to be interesting to see how far it actually goes. | 20:59 |
marekd | stevemar: i will buy for my every VM, current and the future one. | 21:02 |
stevemar | that'll make the news, CERN just purchased 100,000 licenses of mycleanpc | 21:03 |
marekd | :D | 21:03 |
stevemar | to make their *VMs* faster | 21:03 |
stevemar | they will make a special server edition | 21:03 |
*** spandhe has quit IRC | 21:04 | |
marekd | stevemar: imagine saying noggin143 saying in the adv: "mycleanpc really helped discover Higgs boson" :D | 21:04 |
stevemar | lol | 21:04 |
stevemar | well the vms would be 100% faster | 21:04 |
stevemar | "it'll be 100% faster, guaranteed*!" -- * not a guarantee | 21:05 |
*** lhcheng has quit IRC | 21:05 | |
*** lhcheng has joined #openstack-keystone | 21:05 | |
*** spandhe has joined #openstack-keystone | 21:06 | |
marekd | i wonder what happens it I buy 2 licences, run it once (100% faster) and once again (100% faster again). Will it actually speed up 4x ? | 21:06 |
*** openstackgerrit has quit IRC | 21:07 | |
*** openstackgerrit has joined #openstack-keystone | 21:07 | |
* marekd magic | 21:07 | |
*** gokrokve has joined #openstack-keystone | 21:13 | |
*** omkarjoshi has quit IRC | 21:25 | |
openstackgerrit | Merged openstack/keystone: Remove unused domain config method paramters https://review.openstack.org/166010 | 21:27 |
*** harlowja is now known as harlowja_away | 21:32 | |
stevemar | marekd, you cool with waiting for a while for SPs in OSC? | 21:33 |
stevemar | i dont want to depend on a version of KSC that we don't pre-req | 21:34 |
*** edmondsw has quit IRC | 21:39 | |
*** redrobot has quit IRC | 21:42 | |
openstackgerrit | Merged openstack/python-keystoneclient: Add a FederatedBase v3 plugin https://review.openstack.org/163271 | 21:46 |
*** redrobot has joined #openstack-keystone | 21:47 | |
*** redrobot is now known as Guest9385 | 21:47 | |
*** wolsen has quit IRC | 21:48 | |
*** tristanC has quit IRC | 21:48 | |
*** wolsen has joined #openstack-keystone | 21:49 | |
*** tristanC has joined #openstack-keystone | 21:49 | |
morganfainberg | . | 21:50 |
*** mattfarina has quit IRC | 21:53 | |
*** Guest9385 is now known as redrobot | 22:00 | |
morganfainberg | stevemar: this sounds like a case of "should be able to check if ksc has support and enable feature if it does" esp for osc | 22:00 |
morganfainberg | So your capabilities become more dynamic. *shrug* might not be worth the effort | 22:00 |
*** dstanek has quit IRC | 22:01 | |
*** nonameentername has quit IRC | 22:01 | |
openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add get_communication_params interface to plugins https://review.openstack.org/141267 | 22:03 |
*** bknudson has quit IRC | 22:04 | |
*** lhcheng has quit IRC | 22:04 | |
*** spandhe has quit IRC | 22:05 | |
*** nonameentername has joined #openstack-keystone | 22:05 | |
*** harlowja_away is now known as harlowja | 22:05 | |
*** lhcheng has joined #openstack-keystone | 22:06 | |
*** spandhe has joined #openstack-keystone | 22:08 | |
*** carlosmarin has quit IRC | 22:13 | |
*** dstanek has joined #openstack-keystone | 22:14 | |
*** ChanServ sets mode: +v dstanek | 22:14 | |
*** carlosmarin has joined #openstack-keystone | 22:14 | |
*** pnavarro has quit IRC | 22:17 | |
*** gordc has quit IRC | 22:18 | |
*** henrynash has quit IRC | 22:20 | |
*** __TheDodd__ has quit IRC | 22:35 | |
*** lhcheng_ has joined #openstack-keystone | 22:39 | |
*** lhcheng has quit IRC | 22:39 | |
*** joesavak has joined #openstack-keystone | 22:40 | |
*** carlosmarin has quit IRC | 22:50 | |
*** mattfarina has joined #openstack-keystone | 22:54 | |
*** ayoung has quit IRC | 23:01 | |
*** markvoelker has quit IRC | 23:06 | |
*** dims has quit IRC | 23:14 | |
*** dims has joined #openstack-keystone | 23:16 | |
*** dims has quit IRC | 23:17 | |
*** dstanek has quit IRC | 23:17 | |
*** dims has joined #openstack-keystone | 23:17 | |
*** dstanek has joined #openstack-keystone | 23:18 | |
*** ChanServ sets mode: +v dstanek | 23:18 | |
*** chlong has joined #openstack-keystone | 23:20 | |
*** joesavak has quit IRC | 23:24 | |
*** stevemar has quit IRC | 23:34 | |
*** chlong has quit IRC | 23:35 | |
*** stevemar has joined #openstack-keystone | 23:35 | |
*** ChanServ sets mode: +v stevemar | 23:35 | |
*** chlong has joined #openstack-keystone | 23:35 | |
*** markvoelker has joined #openstack-keystone | 23:47 | |
*** markvoelker has quit IRC | 23:52 | |
*** gyee has joined #openstack-keystone | 23:54 | |
*** ChanServ sets mode: +v gyee | 23:54 | |
*** lhcheng_ is now known as lhcheng | 23:57 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!