| *** carlosmarin has joined #openstack-keystone | 00:02 | |
| *** nkinder has joined #openstack-keystone | 00:09 | |
| *** samueldmq has quit IRC | 00:10 | |
| *** samueldmq has joined #openstack-keystone | 00:10 | |
| *** zzzeek has quit IRC | 00:22 | |
| *** carlosmarin has quit IRC | 00:23 | |
| *** alexsyip has quit IRC | 00:30 | |
| *** darrenc is now known as darrenc_Afk | 00:40 | |
| *** markvoelker has joined #openstack-keystone | 00:50 | |
| *** lhcheng has quit IRC | 00:50 | |
| *** stevemar has quit IRC | 00:53 | |
| *** markvoelker has quit IRC | 00:55 | |
| openstackgerrit | ayoung proposed openstack/oslo.policy: CLI Policy Check tool https://review.openstack.org/170978 | 00:55 |
|---|---|---|
| *** Ephur has joined #openstack-keystone | 01:04 | |
| *** ThoamsHsiao has joined #openstack-keystone | 01:04 | |
| *** krtaylor has quit IRC | 01:10 | |
| *** _cjones_ has quit IRC | 01:14 | |
| *** Ephur has quit IRC | 01:14 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Adds inherited column to RoleAssignment PK https://review.openstack.org/142472 | 01:15 |
| *** spandhe has quit IRC | 01:23 | |
| *** darrenc_Afk is now known as darrenc | 01:25 | |
| *** samueldmq has quit IRC | 01:25 | |
| *** wanghong has joined #openstack-keystone | 01:26 | |
| *** ThoamsHsiao has quit IRC | 01:29 | |
| *** sluo_wfh has joined #openstack-keystone | 01:39 | |
| *** sluo_wfh has quit IRC | 01:40 | |
| *** Ephur has joined #openstack-keystone | 01:40 | |
| *** erkules_ has joined #openstack-keystone | 01:41 | |
| *** erkules has quit IRC | 01:43 | |
| *** krtaylor has joined #openstack-keystone | 01:46 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: pep8 fix for CMS https://review.openstack.org/160132 | 01:48 |
| *** markvoelker has joined #openstack-keystone | 01:51 | |
| *** markvoelker has quit IRC | 01:56 | |
| *** samueldmq has joined #openstack-keystone | 01:57 | |
| openstackgerrit | guang-yee proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 02:09 |
| *** topol has joined #openstack-keystone | 02:28 | |
| *** ChanServ sets mode: +v topol | 02:28 | |
| *** stevemar has joined #openstack-keystone | 02:29 | |
| *** ChanServ sets mode: +v stevemar | 02:29 | |
| *** richm has quit IRC | 02:37 | |
| *** iamjarvo has joined #openstack-keystone | 02:42 | |
| *** chlong has quit IRC | 02:42 | |
| *** chlong has joined #openstack-keystone | 02:44 | |
| *** markvoelker has joined #openstack-keystone | 02:52 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Use Model for access_info https://review.openstack.org/160134 | 02:53 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: pep8 fix for CMS https://review.openstack.org/160132 | 02:53 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Test updates to prep for unified access info https://review.openstack.org/160133 | 02:53 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 02:53 |
| *** markvoelker has quit IRC | 02:56 | |
| *** dims has quit IRC | 02:58 | |
| *** dims has joined #openstack-keystone | 03:07 | |
| *** dims_ has joined #openstack-keystone | 03:08 | |
| *** dims has quit IRC | 03:12 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Update sample data with audit ids https://review.openstack.org/171028 | 03:15 |
| *** topol has quit IRC | 03:16 | |
| *** dims_ has quit IRC | 03:20 | |
| *** lhcheng has joined #openstack-keystone | 03:21 | |
| *** samueldmq has quit IRC | 03:33 | |
| *** iamjarvo has quit IRC | 03:37 | |
| *** iamjarvo has joined #openstack-keystone | 03:41 | |
| *** iamjarvo has quit IRC | 03:41 | |
| *** iamjarvo has joined #openstack-keystone | 03:42 | |
| *** iamjarvo has quit IRC | 03:42 | |
| *** iamjarvo has joined #openstack-keystone | 03:42 | |
| *** iamjarvo has quit IRC | 03:43 | |
| *** iamjarvo has joined #openstack-keystone | 03:44 | |
| *** iamjarvo has quit IRC | 03:44 | |
| *** iamjarvo has joined #openstack-keystone | 03:44 | |
| *** iamjarvo has quit IRC | 03:44 | |
| *** iamjarvo has joined #openstack-keystone | 03:45 | |
| *** wanghong has quit IRC | 03:46 | |
| ayoung | jamielennox, so...continueing your thought from the other day; we could, in thery, pass the policy rule to Keystone during the token validation, and keystone could hand bak a yes/no answer. If could even generate the answer for all possible API calls for a given server if we really wanted | 03:47 |
| *** jamielennox is now known as jamielennox|away | 03:47 | |
| ayoung | Boo | 03:47 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Update sample data with audit ids https://review.openstack.org/171028 | 03:48 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 03:48 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Test updates to prep for unified access info https://review.openstack.org/160133 | 03:49 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Use Model for access_info https://review.openstack.org/160134 | 03:49 |
| *** gyee has quit IRC | 03:50 | |
| *** markvoelker has joined #openstack-keystone | 03:53 | |
| *** harlowja is now known as harlowja_away | 03:55 | |
| *** markvoelker has quit IRC | 03:57 | |
| *** iamjarvo has quit IRC | 04:00 | |
| *** tqtran has quit IRC | 04:03 | |
| *** ajayaa has joined #openstack-keystone | 04:05 | |
| *** alexsyip has joined #openstack-keystone | 04:08 | |
| *** _cjones_ has joined #openstack-keystone | 04:15 | |
| *** Administrator has joined #openstack-keystone | 04:18 | |
| *** Administrator is now known as Guest5301 | 04:18 | |
| *** _cjones_ has quit IRC | 04:19 | |
| *** Guest5301 has quit IRC | 04:20 | |
| *** ayoung has quit IRC | 04:25 | |
| *** pnavarro|off has joined #openstack-keystone | 04:28 | |
| *** pnavarro|off has quit IRC | 04:34 | |
| *** topol has joined #openstack-keystone | 04:46 | |
| *** ChanServ sets mode: +v topol | 04:46 | |
| *** markvoelker has joined #openstack-keystone | 04:53 | |
| *** markvoelker has quit IRC | 04:58 | |
| *** ajayaa has quit IRC | 05:17 | |
| *** topol has quit IRC | 05:27 | |
| *** ajayaa has joined #openstack-keystone | 05:30 | |
| *** markvoelker has joined #openstack-keystone | 05:54 | |
| *** markvoelker has quit IRC | 05:58 | |
| *** Bsony has joined #openstack-keystone | 06:14 | |
| *** Bsony has quit IRC | 06:22 | |
| *** ishant has joined #openstack-keystone | 06:23 | |
| *** mflobo has quit IRC | 06:25 | |
| *** mflobo has joined #openstack-keystone | 06:29 | |
| *** pnavarro has joined #openstack-keystone | 06:29 | |
| *** spandhe has joined #openstack-keystone | 06:32 | |
| *** jistr has joined #openstack-keystone | 06:47 | |
| *** pnavarro has quit IRC | 06:48 | |
| *** afazekas has joined #openstack-keystone | 06:54 | |
| *** markvoelker has joined #openstack-keystone | 06:55 | |
| *** markvoelker has quit IRC | 06:59 | |
| *** spandhe has quit IRC | 07:07 | |
| *** Bsony has joined #openstack-keystone | 07:07 | |
| *** Bsony has quit IRC | 07:18 | |
| *** alexsyip has quit IRC | 07:21 | |
| *** fhubik has joined #openstack-keystone | 07:27 | |
| *** spandhe has joined #openstack-keystone | 07:27 | |
| *** chlong has quit IRC | 07:34 | |
| *** ParsectiX has joined #openstack-keystone | 07:41 | |
| *** jistr has quit IRC | 07:50 | |
| *** stevemar has quit IRC | 07:54 | |
| *** markvoelker has joined #openstack-keystone | 07:56 | |
| *** markvoelker has quit IRC | 08:00 | |
| *** jaosorior has joined #openstack-keystone | 08:05 | |
| *** jistr has joined #openstack-keystone | 08:09 | |
| *** spandhe has quit IRC | 08:18 | |
| *** ParsectiX has quit IRC | 08:19 | |
| viktors | hi folks! Can someone approve patch, which already got two +2 ? See https://review.openstack.org/#/c/137639/ | 08:22 |
| *** ParsectiX has joined #openstack-keystone | 08:23 | |
| *** ParsectiX has quit IRC | 08:28 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 08:37 |
| *** lhcheng has quit IRC | 08:56 | |
| *** markvoelker has joined #openstack-keystone | 08:56 | |
| *** markvoelker has quit IRC | 09:01 | |
| *** lhcheng has joined #openstack-keystone | 09:06 | |
| *** rushiagr_away is now known as rushiagr | 09:06 | |
| *** davidckennedy has joined #openstack-keystone | 09:10 | |
| *** lhcheng has quit IRC | 09:17 | |
| *** fhubik is now known as fhubik_afk | 09:22 | |
| *** spandhe has joined #openstack-keystone | 09:25 | |
| *** dims has joined #openstack-keystone | 09:29 | |
| *** dims has quit IRC | 09:35 | |
| *** aix has joined #openstack-keystone | 09:45 | |
| *** fhubik_afk is now known as fhubik | 09:55 | |
| *** markvoelker has joined #openstack-keystone | 09:57 | |
| *** markvoelker has quit IRC | 10:02 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Add subjectAltName to generated ssl cert https://review.openstack.org/154074 | 10:04 |
| *** chlong has joined #openstack-keystone | 10:07 | |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: POC: Run SQL migration tests on PostgreSQL and MySQL https://review.openstack.org/171115 | 10:25 |
| viktors | dstanek: please look at ^ , when you'll have a time | 10:25 |
| *** viktors is now known as viktors|lunch | 10:27 | |
| *** jistr has quit IRC | 10:30 | |
| *** samueldmq has joined #openstack-keystone | 10:38 | |
| samueldmq | morning | 10:39 |
| *** fhubik is now known as fhubik_afk | 10:42 | |
| *** tobberydberg has joined #openstack-keystone | 10:43 | |
| *** jistr has joined #openstack-keystone | 10:51 | |
| *** jistr is now known as jistr|biab | 10:52 | |
| *** ParsectiX has joined #openstack-keystone | 10:52 | |
| *** markvoelker has joined #openstack-keystone | 10:58 | |
| openstackgerrit | Dolph Mathews proposed openstack/python-keystoneclient: Drop explicit requirement for argparse https://review.openstack.org/171124 | 11:02 |
| *** markvoelker has quit IRC | 11:03 | |
| *** fhubik_afk is now known as fhubik | 11:17 | |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: POC: Run SQL migration tests on PostgreSQL and MySQL https://review.openstack.org/171115 | 11:28 |
| *** henrynash has joined #openstack-keystone | 11:33 | |
| *** ChanServ sets mode: +v henrynash | 11:33 | |
| *** viktors|lunch is now known as viktors | 11:33 | |
| *** chlong has quit IRC | 11:49 | |
| *** jistr|biab is now known as jistr | 11:49 | |
| *** chlong has joined #openstack-keystone | 11:51 | |
| samueldmq | dolphm, ping - since we've dropped python 2.6 support, why do we still have gate-python-keystoneclient-python26 ? | 11:58 |
| samueldmq | dolphm, any thought on this? | 11:58 |
| *** markvoelker has joined #openstack-keystone | 11:59 | |
| dolphm | samueldmq: oh, then my patch is wrong. iirc, that job was dropped at some point, but it makes sense that we'd continue to support 2.6 in the clients | 11:59 |
| samueldmq | dolphm, yeah, but I can't understand why your patch passed on it ( gate-python-keystoneclient-python26 ) | 12:01 |
| dolphm | samueldmq: the client depends on oslo.config, which explicitly requires argparse as well | 12:02 |
| samueldmq | dolphm, k, makes sense to be passing then .. thanks | 12:02 |
| *** fhubik has quit IRC | 12:03 | |
| *** fhubik_lunch has quit IRC | 12:03 | |
| *** markvoelker has quit IRC | 12:03 | |
| *** fhubik has joined #openstack-keystone | 12:05 | |
| *** fhubik_afk has joined #openstack-keystone | 12:05 | |
| *** samueldmq-mob has joined #openstack-keystone | 12:07 | |
| *** hogepodge has quit IRC | 12:08 | |
| *** ParsectiX has quit IRC | 12:12 | |
| samueldmq | henrynash, hi, good morning | 12:12 |
| samueldmq | henrynash, could you please take a look at 'Adds inherited column to RoleAssignment PK' - https://review.openstack.org/#/c/142472/ | 12:13 |
| samueldmq | henrynash, looks like now it is just the gate jobs failing (this code is not the cause) | 12:13 |
| openstackgerrit | Dolph Mathews proposed openstack/python-keystoneclient: Specify that argparse is only required for Python < 2.7 https://review.openstack.org/171124 | 12:14 |
| *** lhcheng has joined #openstack-keystone | 12:18 | |
| henrynash | samueldmq: will do | 12:18 |
| *** hogepodge has joined #openstack-keystone | 12:20 | |
| *** lhcheng has quit IRC | 12:22 | |
| samueldmq | henrynash, nice thanks | 12:22 |
| henrynash | samueldmq: so have we tested the non-sqlite upgrade scenario? Our unit test won't do this in Jenkins, right? | 12:23 |
| *** gordc has joined #openstack-keystone | 12:28 | |
| *** erkules_ is now known as erkules | 12:28 | |
| *** erkules has quit IRC | 12:28 | |
| *** erkules has joined #openstack-keystone | 12:28 | |
| *** dims has joined #openstack-keystone | 12:34 | |
| *** iamjarvo has joined #openstack-keystone | 12:36 | |
| *** dims has quit IRC | 12:39 | |
| *** stevemar has joined #openstack-keystone | 12:39 | |
| *** ChanServ sets mode: +v stevemar | 12:39 | |
| *** iamjarvo has quit IRC | 12:41 | |
| *** topol has joined #openstack-keystone | 12:43 | |
| *** ChanServ sets mode: +v topol | 12:43 | |
| *** topol_ has joined #openstack-keystone | 12:44 | |
| *** ChanServ sets mode: +v topol_ | 12:44 | |
| *** topol has quit IRC | 12:48 | |
| *** topol_ is now known as topol | 12:48 | |
| *** topol has quit IRC | 12:52 | |
| *** markvoelker has joined #openstack-keystone | 12:59 | |
| *** fifieldt has joined #openstack-keystone | 13:00 | |
| *** krykowski has joined #openstack-keystone | 13:01 | |
| samueldmq | henrynash, I think check-tempest-dsvm-fulland check-tempest-dsvm-postgres-full run the tests against devstack with mysql and postgresql respectively | 13:03 |
| *** markvoelker has quit IRC | 13:04 | |
| henrynash | samuledmq: ah, ok…..that’s possible | 13:04 |
| *** bknudson has joined #openstack-keystone | 13:06 | |
| *** ChanServ sets mode: +v bknudson | 13:06 | |
| *** openstackgerrit has quit IRC | 13:07 | |
| stevemar | maybe we should fix the bug found here for kilo... https://review.openstack.org/#/c/171115/2/keystone/common/sql/migrate_repo/versions/066_fixup_service_name_value.py | 13:07 |
| *** openstackgerrit has joined #openstack-keystone | 13:07 | |
| samueldmq | stevemar, ping - just to confirm | 13:08 |
| samueldmq | stevemar, we run keystone tests against the devstack env in check-tempest-dsvm-full and check-tempest-dsvm-postgres-full | 13:08 |
| samueldmq | stevemar, thus, mysql and postgresql, respectively, right? | 13:08 |
| samueldmq | stevemar, for migrations, etc | 13:08 |
| breton | I wouldn't be so sure about that | 13:09 |
| stevemar | samueldmq, that's the idea | 13:09 |
| breton | we had some bugs in migrations on mysql and postgresql that were not caught by these checks | 13:09 |
| breton | and I -1'd 'Adds inherited column to RoleAssignment PK' only after a manual check -- tempest tests were successful | 13:10 |
| samueldmq | hmm, henrynash's concern is about whether our migration code at https://review.openstack.org/#/c/142472 is being tested agains mysql/postgresql | 13:11 |
| *** dims has joined #openstack-keystone | 13:11 | |
| samueldmq | yeah we have a new patchset there ... maybe I need to confirm this by myself, since we need this for today :/ | 13:12 |
| breton | I don't know. Even if it does, the coverage is not full. | 13:12 |
| samueldmq | any of you already have a postgres setup? | 13:12 |
| breton | yes, I do | 13:12 |
| samueldmq | breton, yeah I agree, we need to evolve in that front | 13:12 |
| breton | samueldmq: ping me when you upload a new patchset | 13:12 |
| samueldmq | breton, could you please test that agains your env :-) | 13:12 |
| samueldmq | breton, it's already there | 13:12 |
| breton | ok. And it has -1 from tempest because of that devstack bug? | 13:13 |
| samueldmq | breton, I think the failing tempest is jenkins that is kinda unstable | 13:13 |
| samueldmq | breton, yeah, afaik | 13:13 |
| *** Ephur_ has joined #openstack-keystone | 13:15 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 13:19 |
| *** Ephur has quit IRC | 13:19 | |
| *** richm has joined #openstack-keystone | 13:20 | |
| breton | well | 13:21 |
| breton | samueldmq: http://paste.openstack.org/show/199424/ | 13:21 |
| *** henrynash has quit IRC | 13:22 | |
| samueldmq | breton, arrg, I am going to setup my own env and test this | 13:22 |
| breton | samueldmq: good luck with that :) | 13:22 |
| samueldmq | breton, also, if you have time and want to post a patch, please fell free :p | 13:22 |
| samueldmq | we need this for today afaik :p | 13:23 |
| samueldmq | gonna run! | 13:23 |
| breton | I can't promise, but I'll try to. | 13:23 |
| *** trey has quit IRC | 13:23 | |
| *** trey has joined #openstack-keystone | 13:25 | |
| samueldmq | breton, nice thanks | 13:25 |
| *** ayoung has joined #openstack-keystone | 13:28 | |
| *** ChanServ sets mode: +v ayoung | 13:28 | |
| samueldmq | breton, tbh, I have no idea why that error is happening, I just instantiated the session object as we already do on other tests :/ | 13:29 |
| *** fhubik_afk has quit IRC | 13:31 | |
| *** ajayaa has quit IRC | 13:31 | |
| breton | samueldmq: I think it is just an issue with tests. db_sync with postgres runs good, only test is failing | 13:33 |
| *** zzzeek has joined #openstack-keystone | 13:34 | |
| samueldmq | breton, hmm maybe I need to re-instantiate the session after applying the migration | 13:35 |
| samueldmq | breton, after self.upgrade(68) in my test | 13:35 |
| *** dims has quit IRC | 13:36 | |
| *** markvoelker has joined #openstack-keystone | 13:37 | |
| *** dims has joined #openstack-keystone | 13:37 | |
| *** raildo|away is now known as raildo | 13:39 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 13:39 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 13:39 |
| *** rushiagr is now known as rushiagr_away | 13:39 | |
| samueldmq | breton, yeah we need to | 13:40 |
| samueldmq | breton, https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_sql_upgrade.py#L381-L383 | 13:40 |
| *** zzzeek has quit IRC | 13:40 | |
| *** ParsectiX has joined #openstack-keystone | 13:41 | |
| *** topol has joined #openstack-keystone | 13:43 | |
| *** ChanServ sets mode: +v topol | 13:44 | |
| *** ajayaa has joined #openstack-keystone | 13:48 | |
| *** zzzeek has joined #openstack-keystone | 13:49 | |
| openstackgerrit | Kamil Rykowski proposed openstack/keystone-specs: Use oslo-versioned-objects to deal with upgrades https://review.openstack.org/167195 | 13:49 |
| *** chlong has quit IRC | 13:51 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Adds inherited column to RoleAssignment PK https://review.openstack.org/142472 | 13:52 |
| samueldmq | breton, ^ I think everything will be ok now :-) | 13:53 |
| samueldmq | breton, I tested agains mysql, please test it agains postgresql if you have time, thanks | 13:53 |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Handle NULL value for service.extra in migration 066 https://review.openstack.org/171204 | 13:53 |
| breton | samueldmq: will test in 20 minutes | 13:54 |
| samueldmq | breton, great! I gotta go afk for a bit, will be back soon | 13:57 |
| *** ParsectiX has quit IRC | 14:00 | |
| *** samueldmq-mob has quit IRC | 14:01 | |
| openstackgerrit | Merged openstack/keystone: Skip SSL tests because some platforms do not enable SSLv3 https://review.openstack.org/171001 | 14:05 |
| *** boris-42 has joined #openstack-keystone | 14:07 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:16 | |
| *** mattfarina has joined #openstack-keystone | 14:17 | |
| *** rushiagr_away is now known as rushiagr | 14:17 | |
| *** samueldmq_ has joined #openstack-keystone | 14:20 | |
| *** carlosmarin has joined #openstack-keystone | 14:21 | |
| *** davidckennedy has quit IRC | 14:27 | |
| *** amirosh has joined #openstack-keystone | 14:28 | |
| *** davidckennedy has joined #openstack-keystone | 14:31 | |
| *** amakarov_away is now known as amakarov | 14:32 | |
| amirosh | Hello, could somebody check https://review.openstack.org/#/c/156597/ it has two +2, just need workflow | 14:34 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Simplified template for backlog items. https://review.openstack.org/171226 | 14:36 |
| ayoung | amirosh, looking | 14:36 |
| amirosh | Thanks, Adam! | 14:36 |
| openstackgerrit | ayoung proposed openstack/keystone: Improved policy setting in the 'v3 filter' tests https://review.openstack.org/156597 | 14:37 |
| *** devlaps has quit IRC | 14:38 | |
| ayoung | amirosh, done | 14:38 |
| *** davidckennedy has quit IRC | 14:40 | |
| amirosh | ayoung, thanks! | 14:40 |
| *** amirosh has quit IRC | 14:45 | |
| *** davidckennedy has joined #openstack-keystone | 14:47 | |
| *** edmondsw has joined #openstack-keystone | 14:47 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 14:56 |
| *** atiwari has joined #openstack-keystone | 14:56 | |
| viktors | ayoung: hi! Can you please restore your approve on https://review.openstack.org/#/c/137639/ | 15:00 |
| viktors | it was lost during rebase | 15:00 |
| *** bdossant has joined #openstack-keystone | 15:00 | |
| ayoung | viktors, looking | 15:02 |
| ayoung | viktors, that was just a rebase, right? | 15:04 |
| viktors | ayoung: yes, rebase on master | 15:04 |
| ayoung | viktors, done | 15:04 |
| viktors | ayoung: thanks! | 15:04 |
| ayoung | viktors, thanks for keeping on it | 15:04 |
| *** ajayaa has quit IRC | 15:05 | |
| bknudson | this review fixes a bug and has had a +2 on it for a while: https://review.openstack.org/#/c/166934/ | 15:11 |
| morganfainberg | For the record: I hate "extras" | 15:12 |
| *** ishant has quit IRC | 15:13 | |
| *** henrynash has joined #openstack-keystone | 15:20 | |
| *** ChanServ sets mode: +v henrynash | 15:20 | |
| morganfainberg | bknudson: dolphm dstanek ayoung breton henrynash stevemar https://review.openstack.org/#/c/142472/ could use eyes. It's the last rc1 bug I'm really pushing for. | 15:22 |
| henrynash | morgangainberg: looking | 15:23 |
| bknudson | I'll take a look | 15:23 |
| bknudson | henrynash: is the bug valid? | 15:24 |
| bknudson | oh, you already said in the bug that it is. | 15:24 |
| stevemar | it's valid, but mehhh | 15:24 |
| bknudson | why have a primary key if it's every column. | 15:25 |
| * bknudson wishes devstack worked today. | 15:26 | |
| henrynash | bknduson: having to go back and read the bug… | 15:26 |
| morganfainberg | stevemar: sadly with HMT this is more important than "basic" ehhhhh old behavior | 15:27 |
| morganfainberg | And with the increased focus on domain ux | 15:27 |
| stevemar | morganfainberg, yeah, i suppose | 15:27 |
| morganfainberg | stevemar: if HMT had not landed I'd punt this. | 15:27 |
| *** krtaylor has quit IRC | 15:28 | |
| morganfainberg | It just is medium because you can live without it. It was originally k3 but *something something underwater review wise* | 15:28 |
| henrynash | bknudson: so yes, the bug is valid…we can debate the best way of solving it….it’s one of those thinsg where there is no obvious PK (at least not one we woul dlook up by…..other than the whole row, in which case we are just using the PK as a uniquness constraint with index) | 15:29 |
| morganfainberg | the catalog one, unfortunately, is being pushed due to scope/size. | 15:29 |
| stevemar | are we adding https://bugs.launchpad.net/keystone/+bug/1410543 | 15:29 |
| openstack | Launchpad bug 1410543 in Keystone "Include service name in filtered catalog" [Medium,In progress] - Assigned to David Charles Kennedy (dkennedy-p) | 15:29 |
| stevemar | oh nvm | 15:29 |
| morganfainberg | stevemar: I would like that one. But I think it's grown too much. :( | 15:29 |
| bknudson | I'd prefer the code was refactored to remove duplication first. | 15:29 |
| bknudson | which I mentioned in an earlier review. | 15:30 |
| stevemar | we should look at https://review.openstack.org/#/c/171204/ too | 15:30 |
| ayoung | henrynash, you going to +A that? | 15:37 |
| henrynash | ayoung: two IBMers…so not good for one of us to +A | 15:37 |
| ayoung | henrynash, um...but the code was written by an external...however, I will look at it | 15:38 |
| * ayoung ignoreintg allthe sqlite as "don't care" | 15:38 | |
| ayoung | um...does not make sense to me that inherited would be in the primary key. | 15:39 |
| ayoung | it is a boolean, right? | 15:39 |
| henrynash | ayoung: it is a boolean | 15:40 |
| *** devlaps has joined #openstack-keystone | 15:40 | |
| ayoung | morganfainberg, would it be really obnoxious of me to -2 it now? | 15:41 |
| ayoung | cuz...I don't think I want this | 15:41 |
| henrynash | ayoung: I think we either need to continue with the current approach (namely since there is no natual PK, all the fields combined are the PK), or we change it more fundamentally to use a different schema altogther | 15:41 |
| bknudson | my comments on https://review.openstack.org/#/c/142472/ should be easy to fix. | 15:42 |
| morganfainberg | ayoung: you don't want a role able to exist on a domain and be inherited below it for a user? | 15:42 |
| ayoung | henrynash, but does it make sense for one user to have both inherited and uninherited where everything else matches? | 15:42 |
| ayoung | I think this is going to mess things up | 15:42 |
| ayoung | lets defer to Liberty, I think think this is going break things | 15:42 |
| morganfainberg | ayoung: the way this works now I can either be a domain admin or a inherited admin. | 15:42 |
| henrynash | ayoung: really? why….I think NOT being able to have this messes this up | 15:43 |
| morganfainberg | ayoung: I can't be both. | 15:43 |
| ayoung | henrynash, it means that I can have two role assignements for the same role. How is the CLI going to know which to add/remove? I mean, buy default | 15:43 |
| ayoung | It can't be both | 15:43 |
| henrynash | ayoung: you can have that (many times over) today anyway | 15:43 |
| morganfainberg | ayoung: that is a broken design. :( | 15:43 |
| ayoung | admin on demo inherited and admin on demo uninherited | 15:44 |
| henrynash | ayong: e.g. group role + direct user role + inherited from a project in the hierachy above me etc. | 15:44 |
| ayoung | inherited implies uninherited | 15:44 |
| ayoung | different target | 15:44 |
| ayoung | one is user, one is group | 15:44 |
| ayoung | this is the explicit assignment | 15:44 |
| morganfainberg | ayoung: domain admin, and I want to have admin on all projects. Today I have to create grants for all of them | 15:44 |
| ayoung | I'm going to -1 and we can review at the meeting today | 15:44 |
| morganfainberg | ayoung: and it's broken by design only in sql | 15:45 |
| ayoung | I'll remove if over ruled | 15:45 |
| morganfainberg | Because the way sql enforces constraints. | 15:45 |
| henrynash | morganfainberg: agreed, my bug when I wrote it | 15:45 |
| morganfainberg | Honestly I'd like to do the inverse. Inherited is not only subordinate, it is domain and subordinate | 15:46 |
| morganfainberg | But I think I already lost that argument. | 15:46 |
| ayoung | morganfainberg, wouldn't that just be inherited = true? | 15:46 |
| henrynash | that was indeed a long discussion :-) | 15:46 |
| morganfainberg | ayoung: it isn't how it works. | 15:46 |
| morganfainberg | ayoung: inherited is only child projects. | 15:46 |
| ayoung | guh | 15:46 |
| morganfainberg | ayoung: and you can never have the same role on the parent of it is inherited in sql due to constraints in the schema. | 15:47 |
| ayoung | (╯°□°）╯︵ ┻━┻) | 15:47 |
| rodrigods | ayoung, ^ to keep the same behavior as the domain inheritance | 15:47 |
| henrynash | ayoung: it’s an artifact of (a design of) domains and projects…..I.e. if you want only the projects to get a role, then you must place it on the demain, and inherite means only the children get it | 15:47 |
| ayoung | ┌∩┐(◣_◢)┌∩┐ | 15:47 |
| * ayoung going to go get lunch | 15:47 | |
| morganfainberg | The lowest impact is PK change. But I still personally think inherited should grant on the domain as well. | 15:48 |
| henrynash | (not to self….go brush up on 3-fingered keyboard sequeces) | 15:48 |
| morganfainberg | But that becomes api incompat | 15:48 |
| morganfainberg | Whatever well punt this to liberty | 15:49 |
| *** konstantin-maxim has joined #openstack-keystone | 15:51 | |
| *** konstantin-maxim has left #openstack-keystone | 15:51 | |
| openstackgerrit | Thierry Carrez proposed openstack/keystone: Open Liberty development https://review.openstack.org/171260 | 15:52 |
| bknudson | morganfainberg: speaking of liberty! | 15:53 |
| bknudson | ^ | 15:53 |
| morganfainberg | Yep. | 15:53 |
| stevemar | yay liberte! | 15:54 |
| *** gyee has joined #openstack-keystone | 15:54 | |
| *** ChanServ sets mode: +v gyee | 15:54 | |
| * morganfainberg might have been talking to ttx about this. | 15:54 | |
| *** _cjones_ has joined #openstack-keystone | 15:54 | |
| stevemar | morganfainberg, always up to something | 15:54 |
| *** lhcheng has joined #openstack-keystone | 15:56 | |
| stevemar | y'all missed the fun last night with the pip failures | 15:59 |
| *** spandhe has quit IRC | 16:01 | |
| *** davidckennedy has quit IRC | 16:03 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient-federation: Remove unused private class on tests https://review.openstack.org/171263 | 16:03 |
| openstackgerrit | Steve McLellan proposed openstack/keystonemiddleware: Correct memcached parameters in TokenCache https://review.openstack.org/171264 | 16:05 |
| *** krykowski has quit IRC | 16:06 | |
| *** bdossant has quit IRC | 16:06 | |
| *** ChanServ changes topic to "Do not approve any more changes for Keystone (server) without checking with morganfainberg. We are looking to cut RC today." | 16:13 | |
| *** afazekas has quit IRC | 16:16 | |
| ayoung | morganfainberg, and why is this not an enumerated value, or two different booleans on the same row? | 16:17 |
| samueldmq | ayoung, ping - I am back, and saw your comment at 'Adds inherited column to RoleAssignment PK' | 16:17 |
| viktors | dstanek: around? | 16:17 |
| morganfainberg | ayoung, doesn't matter for today can discuss more once the liberty open thing merged. | 16:18 |
| ayoung | samueldmq, yeah...does not make sense to have multiple rows for the same assignment. | 16:18 |
| samueldmq | bknudson, thanks for your review there too, I will be sending a new patch set (Adds inherited column to RoleAssignment PK) | 16:18 |
| morganfainberg | ayoung, merges* | 16:18 |
| samueldmq | ayoung, it is not the same assignment | 16:18 |
| ayoung | morganfainberg, we going to bump it for Kilo? | 16:18 |
| morganfainberg | ayoung, already pushed to L | 16:18 |
| samueldmq | ayoung, from our design, inherited role assignments are only applied to the subtree/project in the domain | 16:18 |
| samueldmq | henrynash, right ^ | 16:18 |
| morganfainberg | samueldmq, correct | 16:18 |
| ayoung | samueldmq, it is a modifier on the relationship: parent only, children only, both. | 16:19 |
| morganfainberg | ayoung, this is SQL being bad at representing this relationship | 16:19 |
| morganfainberg | with the schema design | 16:19 |
| samueldmq | ayoung, yes, this is our design, I know we could have a better name than 'inherited' for something that only goes to children | 16:19 |
| samueldmq | ayoung, but this is a design question ... and what I am doing there is to fix the implementation vs design | 16:20 |
| samueldmq | ayoung, changing the way we call/represent this should be in a separate design discussion (in which I would be interested to be part of) | 16:20 |
| samueldmq | :) | 16:20 |
| ayoung | samueldmq, so, with the current design, if I wanted to add "parent" to an inherited, I would create a new role assignment. | 16:22 |
| ayoung | Whereas, what I am proposing would require an API change? | 16:22 |
| samueldmq | ayoung, if I understand correct, you are proposing that 'inherited' represent parent + children, right? | 16:23 |
| ayoung | because our API either says inherited or says not inherited, and those are supposed to be mutually exclusive? | 16:23 |
| ayoung | samueldmq, that was how I understood it, and it is a ding on me that I did not catch it during the design discussion | 16:23 |
| samueldmq | ayoung, which honors the naming 'inherited' more correctly | 16:23 |
| samueldmq | ayoung, yes this changes the api | 16:23 |
| ayoung | I'm trying to think now which will mess people up the least | 16:24 |
| *** samueldmq_ has quit IRC | 16:24 | |
| samueldmq | ayoung, the api now says inherited -> only children, not inherited -> only the entity itself | 16:24 |
| ayoung | We might just need this as is, if it is the only way to get it into Kilo. | 16:24 |
| morganfainberg | ayoung, not landing in kilo | 16:24 |
| samueldmq | ayoung, yes, and this is how it is defined on the api | 16:24 |
| samueldmq | morganfainberg, no? that fix? oO | 16:25 |
| ayoung | morganfainberg, oh, come on, I needed 10 minutes to think about it. Just due to my objection? | 16:25 |
| morganfainberg | samueldmq, nope. | 16:25 |
| * ayoung goes to look at the API | 16:25 | |
| morganfainberg | ayoung, more because your object raises a more sailient point | 16:25 |
| morganfainberg | ayoung, clients | 16:25 |
| samueldmq | morganfainberg, why? we are fixing our api | 16:25 |
| morganfainberg | ayoung, lets spend more time and not break clients | 16:25 |
| ayoung | morganfainberg lets talk at the meeting. This might be a really broken impl as is | 16:25 |
| morganfainberg | ayoung, we've had a really broken impl for a while | 16:25 |
| samueldmq | morganfainberg, I already had a discussion with henrynash some days ago, and we talked the same we are doing now | 16:25 |
| morganfainberg | ayoung, we can make this fix part of reseller and work on not breaking people | 16:26 |
| samueldmq | morganfainberg, we could change the name, or anything else, but this is just ot make the api vs code conssistent | 16:26 |
| samueldmq | ayoung, ++ | 16:26 |
| morganfainberg | ayoung, so prove the client(s) aren't impacted | 16:27 |
| ayoung | samueldmq, I think it is going to break client to have two assignements that are identical except for this value | 16:27 |
| samueldmq | morganfainberg, maybe discuss at the meeting (as suggested by adam) ? and then see what other cores cthink? | 16:27 |
| morganfainberg | ayoung, and we can land it | 16:27 |
| *** jistr has quit IRC | 16:27 | |
| ayoung | morganfainberg, might I propose a solution...and ugly one...is that we instead split the boolean for inherited, and make the current behavioer....nah too intrusive | 16:27 |
| morganfainberg | ayoung, and that is worth deferring [we can make an idempotent sql migraiton backport if it doesn't break people] | 16:27 |
| samueldmq | we are landing inherited role assignments support on the clients now in kilo as well | 16:27 |
| morganfainberg | we can also RC2 it | 16:27 |
| morganfainberg | it's not landing in RC1. | 16:27 |
| samueldmq | python clients I mean | 16:27 |
| morganfainberg | we likely have an RC2 anyway | 16:28 |
| morganfainberg | so we can bundle this in if it doesn't break anything | 16:28 |
| ayoung | parent should be one boolean, inherited a second, and then you could always do "both" by direct SQL until we fizx the API | 16:28 |
| samueldmq | ayoung, parent may confuse ppl when you have a domain inherited assingment | 16:29 |
| ayoung | samueldmq, yeah, no calling it parent... | 16:29 |
| ayoung | but a boolean that indicates that the assignment applies to the node and a second that indicates it the children | 16:29 |
| samueldmq | well, the idea was to have a boolean to indicate whether it only goes to the children | 16:30 |
| samueldmq | if this boolean is False, it 's only to the parent | 16:30 |
| samueldmq | but this boolean's name is 'inherited', which may be confusing | 16:31 |
| ayoung | samueldmq, and now we havea third state: both | 16:31 |
| ayoung | samueldmq, alternatively, make it an enumerated value | 16:31 |
| samueldmq | yeah, we need a trhoolean | 16:31 |
| samueldmq | :/ | 16:31 |
| morganfainberg | ayoung, ++ enum would be the right approach here | 16:31 |
| morganfainberg | ayoung, there is a bunch of extra logic needed to migrate the DB, change how we lookup/edit that role based upon add/delete/etc for the various models | 16:32 |
| samueldmq | hmm, I think henry has other ideas as well.. | 16:32 |
| morganfainberg | of roles | 16:32 |
| ayoung | morganfainberg, and we can approxiamte an enumerated value with a series of booleans....I was just wondering if that would be a simple enough approach to sneak through for K | 16:32 |
| samueldmq | I remember we talked about the possibility of inheriting to a single branch, etc ... | 16:32 |
| morganfainberg | *and* you're right the client is going to be somewhat lost | 16:32 |
| samueldmq | anyway we need to discuss how to evolve this, this would be at midcycle, but you didnt get time to | 16:32 |
| ayoung | morganfainberg, it should be one role assignemnt, no question | 16:32 |
| morganfainberg | samueldmq, we're aiming to have our typical midcycle at the summit this time ;) | 16:33 |
| ayoung | can we migrate to an integer value and keep the rest of the logic the same for now? | 16:33 |
| morganfainberg | ayoung, no reason to push a migration into K for that. but yes. | 16:33 |
| samueldmq | morganfainberg, yeah and I heard samuel will be there :-) | 16:33 |
| ayoung | morganfainberg, this and the unified delegation discussion should happen together | 16:34 |
| morganfainberg | ayoung, sounds good. | 16:34 |
| ayoung | morganfainberg, I think I want to take is_admin, put it in a basket, tie a rock to it, and drop it down a well. | 16:34 |
| morganfainberg | ayoung, uhm. can we encase it's feet in cement instead? | 16:35 |
| morganfainberg | i don't trust rope not to rot and let it float back to the surface | 16:35 |
| ayoung | morganfainberg, not willing to waste the money on the concrete | 16:35 |
| samueldmq | ayoung, morganfainberg basically this wasn't a great issue before, since we only had domain inherited assignments | 16:35 |
| morganfainberg | i think this is worth the single bag of cement :P | 16:35 |
| samueldmq | and one would call the inherited role 'project_admin', for ex | 16:35 |
| samueldmq | but now with hierarchical projects this became more interesting | 16:36 |
| morganfainberg | ayoung, now, i'd not be willing to bury it under hoover dam | 16:36 |
| morganfainberg | ayoung, that would be too much $ | 16:36 |
| ayoung | Who is building a new stadium these days? | 16:36 |
| morganfainberg | ayoung i also like droping is_admin down in the marianas trench | 16:37 |
| morganfainberg | s/marianas trench/mariana trench | 16:37 |
| ayoung | "NO, is_admin, I expect you to DIE!" | 16:37 |
| samueldmq | ++ | 16:37 |
| ayoung | samueldmq, so here is how it relates, and all ties back to policy | 16:37 |
| samueldmq | ayoung, yeah, policy is one of the best things to get involved in L | 16:38 |
| ayoung | lets start with a fresh install. We use the ADMIN_TOKEN (or comparable mechanism TBD) to create a new user and a new god-like admin role | 16:38 |
| ayoung | let's call this role....ALL | 16:38 |
| ayoung | Cuz ALL powers descend from this role assignement...if you have ALL, you are ALL Powerful...on whatever the scope is | 16:39 |
| *** devlaps has quit IRC | 16:39 | |
| morganfainberg | ayoung, admin_token needs to die as well | 16:39 |
| ayoung | now, we make this deity ALL on the Root domain | 16:39 |
| ayoung | morganfainberg, yeah...I know | 16:39 |
| morganfainberg | ayoung, i think the bag of cement can be used for more than one thing | 16:39 |
| ayoung | we call it the root domain because nothing NOTHING no single thing is going to be called admin | 16:40 |
| amakarov | morganfainberg, king-size bag | 16:40 |
| ayoung | morganfainberg, I grew up in a construction family. I learned a very important lesson about that from my dad. | 16:40 |
| ayoung | You encase people and thing in concerete, not in cement | 16:40 |
| ayoung | cement is just one component of concrete. He took this very seriously | 16:40 |
| morganfainberg | ayoung, sure. ok | 16:40 |
| samueldmq | haha lol | 16:41 |
| ayoung | morganfainberg, trust me, if you ever meet my dad, you will understand. | 16:41 |
| ayoung | Getting ready for knee surgery, he got his weight Down to 240 | 16:41 |
| morganfainberg | https://www.youtube.com/watch?v=VAgLhr6sHtc | 16:41 |
| ayoung | He's like, two of me | 16:41 |
| ayoung | But, more important, when it comes to building things, he knows how to do it right. | 16:42 |
| *** spandhe has joined #openstack-keystone | 16:42 | |
| ayoung | Anyways...now you know where some of my pedantry comes from | 16:42 |
| ayoung | back to the ALL thing | 16:42 |
| morganfainberg | ayoung, why for you approve more changes? | 16:43 |
| samueldmq | morganfainberg, so I put a topic on our today's meeting ? to decide whether we fix this or *stop* everything and lets then discuss at the summit ? | 16:44 |
| ayoung | morganfainberg, cuz he also instilled in me a real drive to actually get projects completed | 16:44 |
| ayoung | an ee way | 16:44 |
| morganfainberg | annnd gate reset... | 16:45 |
| ayoung | so, we make assign this person the ALL role on the ROOT domain | 16:45 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change domain_id FK in project table https://review.openstack.org/166354 | 16:45 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 16:45 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 16:45 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Stop calling domain drivers https://review.openstack.org/165936 | 16:45 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 16:45 |
| ayoung | so, we make assign this person the ALL role on the ROOT domain | 16:45 |
| samueldmq | haha, | 16:45 |
| samueldmq | ayoung, k go ahead | 16:45 |
| ayoung | and then any role assignment comes from that person's role assignemnt...delegated | 16:45 |
| morganfainberg | ayoung, please do not approve more changes until we open for liberty | 16:45 |
| ayoung | morganfainberg, did I? | 16:45 |
| morganfainberg | yeah i think you caught another test one | 16:46 |
| morganfainberg | ayoung or zuul was massively backloged | 16:46 |
| ayoung | Sorry. | 16:46 |
| morganfainberg | ayoung, don't worry about it | 16:46 |
| morganfainberg | ayoung, i'm just tying to make sure a couple things that were in flight land [indexes etc] | 16:46 |
| samueldmq | ayoung, did we decide something for the 'inherited' thing? add a topic for today's meeting? | 16:47 |
| ayoung | morganfainberg, understood, wasn't aware we were at (self censored metaphore involving Zuul) | 16:47 |
| samueldmq | ayoung, I think we switched context without have an action point | 16:47 |
| morganfainberg | ayoung, i could just approve the liberty opening patch but figure the rev. event index and the v2 grant notifications was worth holding for ;) | 16:48 |
| samueldmq | morganfainberg, ha this is interesting: 'Open Liberty development' | 16:49 |
| samueldmq | morganfainberg, didnt follow how it happens in the previous cycle, since I was not involved in keystone that much :-) | 16:50 |
| samueldmq | can I +1 that ? :p | 16:50 |
| morganfainberg | samueldmq, doesn't matter if you do or not | 16:50 |
| samueldmq | morganfainberg, yeah I know | 16:50 |
| morganfainberg | samueldmq, it's the formal opening of Liberty. if you want to feel free to ;) | 16:50 |
| samueldmq | morganfainberg, yeah, L is going to be great, just want to get it on the right foot :p | 16:51 |
| *** samueldmq_ has joined #openstack-keystone | 16:52 | |
| *** ajayaa has joined #openstack-keystone | 16:52 | |
| *** krtaylor has joined #openstack-keystone | 16:54 | |
| *** aix has quit IRC | 16:55 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient-federation: Add Saml2KeystoneUnscoped for K2K federation https://review.openstack.org/161751 | 17:05 |
| rodrigods | stevemar, ^ a first version, it has the potential to change a lot depending on the reviewers opinions | 17:09 |
| *** _cjones_ has quit IRC | 17:13 | |
| *** tqtran has joined #openstack-keystone | 17:17 | |
| *** _cjones_ has joined #openstack-keystone | 17:18 | |
| henrynash | morganfainberg: we’re gonna discuss the inherited PK patch at tonights meeting? | 17:18 |
| henrynash | morganfainberg, ayoung, samueldmq: I added it to the agends | 17:21 |
| morganfainberg | henrynash, it's on the agenda | 17:21 |
| henrynash | morganainberg: great, thx | 17:22 |
| morganfainberg | henrynash, i think. samueldmq said it was | 17:22 |
| morganfainberg | :P | 17:22 |
| ayoung | samueldmq, sorry, I took a real world interrupt | 17:24 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Redundant events on group grant revocation https://review.openstack.org/171305 | 17:24 |
| * morganfainberg tries to go get food before meeting. | 17:24 | |
| * samueldmq gets confused since it asked morganfainberg and ayoung if I would put a topic or not and didnt get response :p | 17:24 | |
| morganfainberg | samueldmq, put it as a topic | 17:25 |
| morganfainberg | samueldmq, ;) | 17:25 |
| morganfainberg | samueldmq, there. a clear answer | 17:25 |
| ayoung | samueldmq, unified delegation is a topic for the summit. | 17:25 |
| samueldmq | morganfainberg, yeah, I think | 17:25 |
| ayoung | I need to write it up. | 17:25 |
| samueldmq | morganfainberg, I think henry did, thanks | 17:25 |
| gyee | rodrigods, stevemar, I am debating whether we should make the saml2 token expiration configuration as well. https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/idp.py#L47 | 17:25 |
| gyee | configurable | 17:25 |
| samueldmq | ayoung, k, talk in the meeting the general idea we want to carry to the summit | 17:26 |
| ayoung | gyee, would it be on a per IDP basis? | 17:26 |
| samueldmq | ayoung, and what we solve for now | 17:26 |
| gyee | ayoung, I would think so, but right now its not be utilized | 17:26 |
| rodrigods | gyee, ayoung currently it can't be by IdP | 17:26 |
| gyee | also, it doesn't seem to have an affect with shibolleth regardless of its value | 17:26 |
| samueldmq | henrynash, hello | 17:26 |
| gyee | as shibboleth session overrides that value | 17:27 |
| samueldmq | henrynash, are you adding the topic to the meeting? | 17:27 |
| rodrigods | gyee, hmm | 17:27 |
| gyee | rodrigods, why not? it should be per IdP right | 17:27 |
| rodrigods | gyee, isn't keystone the idp? | 17:28 |
| gyee | rodrigods, yes | 17:28 |
| rodrigods | gyee, so we have the configuration for that specific keystone, right? | 17:28 |
| rodrigods | gyee, https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/idp.py#L87 | 17:28 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Group role revocation invalidates all user tokens https://review.openstack.org/141854 | 17:29 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:29 | |
| gyee | rodrigods, nice! | 17:30 |
| *** harlowja_away is now known as harlowja | 17:31 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 17:31 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 17:31 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 17:31 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Restrict inherited role assignments to subdomains https://review.openstack.org/164180 | 17:31 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 17:31 |
| gyee | rodrigods, shibboleth doesn't seem to honor that value | 17:32 |
| rodrigods | gyee, if we pass an expired assertion it still accepts? | 17:32 |
| gyee | rodrigods, shibboleth also seem to cut off at its own session expiration | 17:32 |
| gyee | maybe there's a way to extend the session | 17:33 |
| rodrigods | gyee, are you using the ECP assertion? | 17:34 |
| * rodrigods wonders if we are losing this info in the ECP wrapping | 17:34 | |
| rodrigods | before considering shibboleth doesn't care about it | 17:34 |
| gyee | yes, ECP wrapped | 17:34 |
| gyee | ECP shouldn't change it, its part of AuthnStatement in the ECP body | 17:36 |
| rodrigods | gyee, does it contain something like " NotOnOrAfter="...""? | 17:37 |
| gyee | yes | 17:37 |
| gyee | so I set that value to don't expire in a month | 17:38 |
| gyee | but shibboleth doesn't seem to take it | 17:38 |
| rodrigods | gyee, strange... check this mail thread http://shibboleth.net/pipermail/users/2011-October/001332.html | 17:39 |
| rodrigods | >2. "NotBefore" and "NotOnOrAfter" | 17:39 |
| rodrigods | >Does Shibboleth SP verify "NotBefore" and "NotOnOrAfter" attributes if | 17:39 |
| rodrigods | >SAML assertion issued by IdP have the attributes? | 17:39 |
| rodrigods | Anywhere the SP accepts an assertion as valid, it checks them. | 17:39 |
| gyee | yes, it checks them | 17:40 |
| gyee | but it don't honor a long expiration | 17:41 |
| rodrigods | gyee, by don't honor, you mean you are passing an assertion generated some time ago (that still should be valid) and shibboleth is not accepting? | 17:42 |
| gyee | right, since it hasn't expired yet | 17:43 |
| rodrigods | gyee, now I get it, is should have a config telling the max age of an assertion | 17:44 |
| morganfainberg | Liberty open patch is gating | 17:44 |
| morganfainberg | we're about 3h for the gate queue at the moment | 17:45 |
| gyee | yeah Liberty! | 17:45 |
| samueldmq | o/ | 17:45 |
| *** pnavarro has joined #openstack-keystone | 17:49 | |
| henrynash | samuledmq: yes…and done. | 17:49 |
| samueldmq | henrynash, nice, was adding as well.. thanks :) | 17:50 |
| samueldmq | henrynash, did you save the page? I can't see anything related on https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting | 17:50 |
| henrynash | samueldmq: look under RC1 | 17:51 |
| samueldmq | henrynash, yeah, I need coffee | 17:52 |
| samueldmq | henrynash, thanks | 17:52 |
| morganfainberg | so do i | 17:52 |
| morganfainberg | :( | 17:52 |
| morganfainberg | but 8min isn't enough | 17:52 |
| morganfainberg | to go get some and back for meeting | 17:52 |
| samueldmq | morganfainberg, ahah .. is that far away from you :/ | 17:52 |
| samueldmq | ? | 17:52 |
| morganfainberg | 3 min walk each way | 17:52 |
| morganfainberg | plus the line to get coffee | 17:52 |
| morganfainberg | oh eff it. we might start the meeting a minute or two late i neeeeeeeeeeeeeeeeed caffination | 17:53 |
| samueldmq | someone may start the meeting | 17:53 |
| samueldmq | :p | 17:53 |
| samueldmq | morganfainberg, go! | 17:53 |
| stevemar | not yet :P | 17:54 |
| *** ThoamsHsiao has joined #openstack-keystone | 17:56 | |
| stevemar | rodrigods, that code is sooo much cleaner now | 17:57 |
| *** Farhan has joined #openstack-keystone | 17:58 | |
| rodrigods | stevemar, ++ | 17:58 |
| * rodrigods wonders if we could receive the client as parameter and get the ecp_assertion in the plugin | 17:58 | |
| rodrigods | inside the plugin* | 17:58 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient-federation: Add Saml2KeystoneUnscoped for K2K federation https://review.openstack.org/161751 | 18:00 |
| *** afazekas has joined #openstack-keystone | 18:00 | |
| rodrigods | removed unused attributes in the test ^ | 18:00 |
| *** jamielennox|away is now known as jamielennox | 18:01 | |
| dolphm | lhcheng: congrats! | 18:11 |
| *** mattfarina has quit IRC | 18:13 | |
| *** mattfarina has joined #openstack-keystone | 18:16 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:17 | |
| *** atiwari has quit IRC | 18:19 | |
| *** afazekas has quit IRC | 18:24 | |
| *** jdandrea has quit IRC | 18:25 | |
| rodrigods | lhcheng needs voice status :) | 18:26 |
| lhcheng | dolphm: thanks! | 18:26 |
| *** dolphm sets mode: +v lhcheng | 18:28 | |
| *** dolphm sets mode: +v lbragstad | 18:28 | |
| *** lhcheng_ has joined #openstack-keystone | 18:32 | |
| openstackgerrit | Merged openstack/keystone: Add index to the revocation_event.revoked_at. https://review.openstack.org/137639 | 18:32 |
| *** lhcheng has quit IRC | 18:34 | |
| *** lhcheng_ is now known as lhcheng | 18:34 | |
| *** mattfarina has quit IRC | 18:36 | |
| *** topol has quit IRC | 18:38 | |
| openstackgerrit | Merged openstack/keystone: Fix for notifications for v2 role grant/delete https://review.openstack.org/166934 | 18:38 |
| *** topol has joined #openstack-keystone | 18:40 | |
| *** ChanServ sets mode: +v topol | 18:40 | |
| morganfainberg | jamielennox, ping - when you have a bit of time let me know want to discuss some stuff with ya | 18:40 |
| morganfainberg | jamielennox, re: releases etc for KSC/KSM | 18:40 |
| morganfainberg | post meeting | 18:40 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Update man pages https://review.openstack.org/171327 | 18:48 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add placeholders for reserved migrations https://review.openstack.org/171329 | 18:51 |
| ekarlso | did keystone switch to alembic yet ? | 18:51 |
| lbragstad | ekarlso: not yet | 18:53 |
| *** gokrokve has joined #openstack-keystone | 18:58 | |
| samueldmq | so .... | 19:01 |
| morganfainberg | ok | 19:01 |
| morganfainberg | so. | 19:01 |
| samueldmq | the list_role_assignment refactoring was going to fix most of inherited assignment issues | 19:01 |
| samueldmq | :/ | 19:01 |
| samueldmq | because we have the inheritance logic duplicated | 19:01 |
| samueldmq | at a lot of places | 19:01 |
| ayoung | henrynash, I think a faster way to get to where you need is to make inherited either be yes or no, and that means a role assignment is always effective for the project it is on | 19:01 |
| morganfainberg | it looks like we have lots of issues here | 19:01 |
| ayoung | just that in might or might not be inherited | 19:01 |
| ayoung | I realize that is not what was decided way back when...sorry if I missed that discussion | 19:02 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Update man pages for the Kilo release https://review.openstack.org/171327 | 19:02 |
| ayoung | but anything is is just too surprising. No one would expect it to work the way it is specified | 19:02 |
| rodrigods | we just imitated the behavior for domains, it was the main reason | 19:02 |
| henrynash | ayoung: not really if you are used to domains and projects… | 19:03 |
| henrynash | ayoung: then you almost certinly don’t want the role active on the domain | 19:03 |
| rodrigods | initially we implemented following what you are proposing | 19:03 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Stop calling domain drivers https://review.openstack.org/165936 | 19:03 |
| ayoung | henrynash, with the existing setup, you can not add new projects to a domain, even if you want to make it so someone can only manage projects and not users | 19:03 |
| ayoung | its a workaround for our limited policy | 19:03 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change domain_id FK in project table https://review.openstack.org/166354 | 19:03 |
| ayoung | and let's address it there ,not in the inheritance | 19:03 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 19:03 |
| rodrigods | ayoung, addressing the global admin doesn't fix the issue | 19:04 |
| rodrigods | for hmt at least | 19:04 |
| morganfainberg | lhcheng, what is your LP username? | 19:05 |
| ayoung | rodrigods, if you want to split the operations that somone can do, you do that via separate role assignments and policy based on it | 19:05 |
| samueldmq | morganfainberg, I'd propose: i) lets have the fix (migration) for api consistency in rc2, and backportable | 19:05 |
| ajayaa | morganfainberg, Given that this discussion is going on like forever, I think it's best to discuss the NoSql backend. | 19:05 |
| ajayaa | later* | 19:05 |
| morganfainberg | ajayaa, sorry to have deferred that | 19:05 |
| ajayaa | morganfainberg, np. | 19:05 |
| ayoung | nosql for what? | 19:05 |
| lhcheng | morganfainberg: lin-hua-cheng | 19:05 |
| ajayaa | We can have that discussion in the next meeting. | 19:06 |
| morganfainberg | ajayaa, either next meeting or.. propose a spec | 19:06 |
| ajayaa | ayoung, for Keystone. | 19:06 |
| samueldmq | morganfainberg, ii) lets have the list_role_assignment refactoring early in L (and backport it as well, to fix remaining issues when applying inheritance, if any) | 19:06 |
| ayoung | ajayaa, my answer is almost certainly going to be "does not make sense" | 19:06 |
| ayoung | ajayaa, for what subset of Keystone? | 19:06 |
| ajayaa | morganfainberg, okay will do so. | 19:06 |
| henrynash | ayoung: i’m all for a re-examination of the spec on this in L….night now teh only thing we can do is fix the bug……i’m really struggling with understanding the pushback……..since I haven’t heard (except for we don’t like the spec) what’s wroung with fiing this | 19:06 |
| ajayaa | ayoung, for all the backends. We have POC running already. | 19:06 |
| henrynash | ayoung: sorry…..I gotta go off line for while….food is calling…will be back on later…. | 19:07 |
| ayoung | henrynash, having two role assignments with the same name, one for the node, one for the childre is confusing, and not something we should have designed | 19:07 |
| ajayaa | We haven't included HMT in that given that it is still experimental. | 19:07 |
| *** jistr has joined #openstack-keystone | 19:07 | |
| samueldmq | ayoung, yes I agree | 19:07 |
| rodrigods | ayoung, it happens for group and users | 19:07 |
| samueldmq | ayoung, but we did | 19:07 |
| ajayaa | ayoung, Why do you think it does not make sense? | 19:07 |
| samueldmq | ayoung, so lets fix what we say we do | 19:07 |
| samueldmq | ayoung, and change the api after, early in liberty | 19:07 |
| rodrigods | its exactly the same design | 19:07 |
| ayoung | ajayaa, actually, for most of Keystone, it should just be a matter of adding new dogpile implementations | 19:08 |
| morganfainberg | so sadly we don't specify in OS-Inherit docs how this is supposed to work | 19:08 |
| ayoung | ajayaa, but for most things, you want transactional integrity | 19:09 |
| morganfainberg | or wait | 19:09 |
| morganfainberg | in one place we do | 19:09 |
| ayoung | ajayaa, I really want the token backend to die | 19:09 |
| morganfainberg | The inherited role is only applied to the owned projects (both existing and future projects), and will not appear as a role in a domain scoped token. | 19:09 |
| morganfainberg | sigh | 19:09 |
| ayoung | and that is where the biggest pain is | 19:09 |
| ayoung | for identity; meh | 19:09 |
| samueldmq | morganfainberg, yeah | 19:09 |
| ayoung | I want identity to die too | 19:09 |
| morganfainberg | ayoung, ok we can't make the stupid api choice non-stupid | 19:09 |
| samueldmq | morganfainberg, and btw, needs to be updated to include hierarchical projects | 19:09 |
| ayoung | really, all Keystone I care about is assignment and policy...well, now resources | 19:10 |
| morganfainberg | samueldmq, show me how much this will break horizon and/or what the exposure to someone consuming roles via OSC (setting etc) | 19:10 |
| rushiagr | ayoung: I'm curious. Why identity should die too? Are you intending that it can all be in-memory in some way? | 19:10 |
| morganfainberg | samueldmq, just show me what it all looks like | 19:10 |
| ayoung | rushiagr, nope | 19:10 |
| ayoung | rushiagr, Federations | 19:10 |
| morganfainberg | and that we haven't broken anything in subtle ways | 19:10 |
| morganfainberg | samueldmq, then we can propose against RC2 | 19:10 |
| morganfainberg | samueldmq, sound ok? | 19:10 |
| rushiagr | ayoung: ah | 19:10 |
| morganfainberg | ayoung, ^ | 19:10 |
| ayoung | rushiagr, so, yeah, add federation to the parts of keystone I care about | 19:10 |
| samueldmq | morganfainberg, yeah | 19:10 |
| morganfainberg | samueldmq, my hesitation is a sudden change in percieved behavior | 19:11 |
| morganfainberg | If an API's behavior isn't adequately documented, then developers using the API have no choice but to go by what they observe the behavior to be. | 19:11 |
| rushiagr | ayoung: okay | 19:11 |
| *** topol has quit IRC | 19:11 | |
| morganfainberg | we don't say anything about if you can apply a role to both the domain and it's children as inherited | 19:11 |
| rodrigods | morganfainberg, https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-inherit-ext.rst#assign-role-to-user-on-projects-in-a-subtree it is | 19:11 |
| morganfainberg | so. | 19:11 |
| ayoung | morganfainberg, we don't do "domain is a project" today, right? | 19:11 |
| morganfainberg | ... | 19:11 |
| morganfainberg | ayoung, no we don't | 19:11 |
| rushiagr | ayoung: but the question remains: why nosql makes no sense? | 19:12 |
| samueldmq | morganfainberg, so someone who reads the docs and want to have a role assingment on both parents + children will do: | 19:12 |
| rodrigods | morganfainberg, look at: Note: It is possible for a user to have both a regular (non-inherited) and an inherited role assignment on the same project. | 19:12 |
| ayoung | So if a role is assigned on a domain, and that role assignment is marked as inherited, it is only on the projects under it? | 19:12 |
| samueldmq | i) role X + project Y + user K | 19:12 |
| samueldmq | ii) role X + project Y + user K + inherited | 19:12 |
| morganfainberg | rodrigods, we have the worst designed api i've seen in a long time here | 19:12 |
| rushiagr | (sorry for not introducing myself, I'm Rushi, ajayaa's colleague) | 19:12 |
| bknudson | if you do a revoke does it make sure that it's revoking the inherited one? http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-inherit-ext.html#revoke-an-inherited-project-role-from-user-on-domain | 19:12 |
| morganfainberg | rodrigods, because of silly work arounds to "admin is god" | 19:12 |
| morganfainberg | s/god/root | 19:12 |
| rodrigods | :( | 19:12 |
| ayoung | But if a role is assigned on a project, and that role assignment is marked as inherited, it should be on that project and all the projects under it" | 19:12 |
| morganfainberg | mordred, ^ | 19:12 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Creation of subdomains and filtering by parent_id https://review.openstack.org/161378 | 19:13 |
| samueldmq | morganfainberg, keystone gives 200 ok in both, so the user assume everything is working, but no | 19:13 |
| morganfainberg | mordred, you'll appreciate that. | 19:13 |
| ayoung | that is how I read the API doc | 19:13 |
| mordred | morganfainberg: what did I do? | 19:13 |
| * mordred reads | 19:13 | |
| morganfainberg | mordred, "rodrigods, we have the worst designed api i've seen in a long time here" | 19:13 |
| morganfainberg | mordred, (what i said) | 19:13 |
| morganfainberg | <+morganfainberg>rodrigods, because of silly work arounds to "admin is god" | 19:13 |
| morganfainberg | [04/07/2015 -:- 12:12:54] <+morganfainberg>s/god/root | 19:13 |
| mordred | morganfainberg: ++ | 19:13 |
| mordred | morganfainberg: although I still think glancev2 is winning | 19:14 |
| morganfainberg | mordred, oh glance v2 is all sorts of special | 19:14 |
| morganfainberg | mordred, almost as good as the eventlet + sslv3 rabbit hole i chased yesterday | 19:14 |
| morganfainberg | mordred, *almost* | 19:14 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Creation of subdomains and filtering by parent_id https://review.openstack.org/161378 | 19:14 |
| samueldmq | morganfainberg, glance is where everyone can do almost everything when using the defautl policy ? | 19:15 |
| samueldmq | morganfainberg, https://github.com/openstack/glance/blob/master/etc/policy.json | 19:15 |
| ayoung | I take object to the statement "we have the worst designed api" as am sure our API was not designed | 19:15 |
| morganfainberg | mordred, anyway, just thought you'd be happy to see the admission of "omg silly" API | 19:15 |
| morganfainberg | ayoung, oh i'm sure OS-INHERIT was designed | 19:15 |
| morganfainberg | ayoung, the whole of keystone's api, not so much | 19:15 |
| bknudson | looks like delete_grant handles it correctly, where create_grant treated both inherited and not inherited the same. | 19:15 |
| ayoung | morganfainberg, how does the algebra of "dsigned API on top of morphed from ooze API" work? | 19:15 |
| bknudson | idetity v4 will fix all this. | 19:16 |
| morganfainberg | ayoung, like a naturally occuring fractal | 19:16 |
| morganfainberg | ayoung, except with a lot less elegance | 19:16 |
| morganfainberg | ayoung, more like designed on quicksand | 19:16 |
| samueldmq | bknudson, yeah I knew we need to revisit this api :/ | 19:16 |
| samueldmq | bknudson, the main reason we have found a lot of bugs around inherited assingments is that we duplicate the logic | 19:17 |
| samueldmq | bknudson, and the code in a lot of places | 19:17 |
| morganfainberg | ayoung, https://youtu.be/aNaXdLWt17A?t=21 | 19:17 |
| samueldmq | bknudson, this https://review.openstack.org/#/c/155733 will be fixing that | 19:17 |
| samueldmq | bknudson, early in the next cycle I hopep | 19:17 |
| samueldmq | hope* | 19:17 |
| *** amakarov is now known as amakarov_away | 19:18 | |
| ayoung | rushiagr, so...why nosql? | 19:19 |
| bknudson | it's webscale | 19:20 |
| ayoung | bknudson with the deadpan | 19:20 |
| rushiagr | ayoung: truly distributed, fault-tolerant, and linearly scalable, with DC-awareness | 19:21 |
| morganfainberg | samueldmq, also fix the silent failure with the same fix | 19:21 |
| *** samueldmq_ has quit IRC | 19:22 | |
| *** openstackgerrit has quit IRC | 19:22 | |
| *** openstackgerrit has joined #openstack-keystone | 19:22 | |
| samueldmq | morganfainberg, all in the same patch ? | 19:23 |
| morganfainberg | samueldmq, it's part of the fix | 19:23 |
| morganfainberg | right? | 19:23 |
| morganfainberg | not silently failing to apply a non-inherited role with an inherited role? | 19:23 |
| samueldmq | morganfainberg, well it makes UX still worst, | 19:23 |
| rushiagr | ayoung: maybe we'll write the spec, and let's discuss from there? | 19:23 |
| morganfainberg | that sounds like the same bug... it has a schema change *and* silent failure | 19:23 |
| samueldmq | morganfainberg, it's related | 19:23 |
| morganfainberg | step back | 19:24 |
| morganfainberg | the issue is we can't create the two types of assignments | 19:24 |
| morganfainberg | that is the bug | 19:24 |
| samueldmq | morganfainberg, yeah | 19:24 |
| samueldmq | exactly | 19:24 |
| morganfainberg | so, silently failing is part of this. | 19:24 |
| morganfainberg | you don't know you can't create it | 19:24 |
| samueldmq | being silent on duplicates was making this still worst | 19:24 |
| morganfainberg | so | 19:24 |
| *** raildo has left #openstack-keystone | 19:24 | |
| bknudson | a PUT operation should be 200 OK if the resource already exists. | 19:24 |
| morganfainberg | if the resource is 100% the same: it is 200 ok | 19:25 |
| morganfainberg | if the resource is not the same, (inherit) then it's not the same. | 19:25 |
| samueldmq | morganfainberg, but just the migration itself fixes this | 19:25 |
| bknudson | that problem is fixed by expanding the primary key | 19:25 |
| samueldmq | morganfainberg, no need to touch that fail silently if duplicate thing | 19:25 |
| samueldmq | bknudson, ++ | 19:25 |
| bknudson | you could add some tests that show the problem and that it's fixed. | 19:25 |
| morganfainberg | so make sure we test it explisitly | 19:26 |
| morganfainberg | that is fine to show that is the correct behavior | 19:26 |
| samueldmq | yes we have a good test case on that patfch | 19:26 |
| morganfainberg | but right now it's all silent / unknown / wierd | 19:26 |
| samueldmq | i) try to add both and fail in the second ii) migrate iii) add the second | 19:26 |
| *** raildo has joined #openstack-keystone | 19:26 | |
| morganfainberg | so just make sure we are clear on expected behavior, we test expected behavior, and fix the problem | 19:27 |
| stevemar | pffft dolphm, trying to be reasonable | 19:27 |
| samueldmq | morganfainberg, ok I will revisit the tests I wrote, to make sure we cover all we need | 19:27 |
| ayoung | rushiagr, CAP theorem | 19:27 |
| samueldmq | and apply bknudson's comments, and then send a new patchset | 19:28 |
| morganfainberg | samueldmq, re: the barbican thing? | 19:28 |
| morganfainberg | stevemar ^ not samueldmq | 19:28 |
| bknudson | does barbican use the mailing list as its bug tracker? | 19:28 |
| samueldmq | morganfainberg, second time today :p | 19:29 |
| raildo | henrynash, ping, Do you have some time to see this patch? https://review.openstack.org/#/c/158720/ since we already have completed the previous discussion | 19:29 |
| rm_work | bknudson: pretty sure we use launchpad as the barbican bug tracker :P | 19:29 |
| * rm_work jumps in with no context | 19:29 | |
| rushiagr | ayoung: We'll write spec, and let's discuss all the pros and cons of nosql and effects to CAP theorem there.. | 19:30 |
| rushiagr | ayoung: sorry, it's late here, and I need to sleep.. | 19:30 |
| bknudson | rushiagr: implement a nosql-based identity provider and keystone can use it. | 19:31 |
| morganfainberg | bknudson: ++ especially if it talks SAML ;) or OIDC ;) | 19:31 |
| *** harlowja is now known as harlowja_away | 19:31 | |
| ajayaa | bknudson, morganfainberg, We have a working Keystone with Cassandra already and it works nicely in our test setup. | 19:32 |
| bknudson | ajayaa: saml? | 19:32 |
| morganfainberg | ajayaa, i assume as a directly connected/managed identity store | 19:33 |
| morganfainberg | vs. an IdP (like FreeIPA/Ipsilon/Active Directory) correct? | 19:33 |
| ayoung | We had a Dogpile backend for Identity. That sill around? | 19:34 |
| ayoung | still | 19:35 |
| morganfainberg | nope | 19:35 |
| morganfainberg | ripped out when we dropped KVS | 19:35 |
| ayoung | so they reimplemented it | 19:35 |
| ayoung | rapture | 19:36 |
| *** ajayaa_ has joined #openstack-keystone | 19:37 | |
| *** ajayaa has quit IRC | 19:37 | |
| stevemar | i'm lost | 19:37 |
| *** harlowja_away is now known as harlowja | 19:37 | |
| ajayaa_ | stevemar, Are you following the NoSql discussion? | 19:38 |
| bknudson | stevemar: are you on fire? | 19:38 |
| stevemar | bknudson, nah, i survived that | 19:39 |
| bknudson | good. | 19:39 |
| stevemar | glad to know you're concerned <3 | 19:39 |
| ajayaa_ | morganfainberg, yes. No federation. | 19:40 |
| stevemar | ajayaa_, i am not following the nosql discussion. i was dropped in cause of federation | 19:40 |
| ajayaa_ | sorry, I missed your Q as I got discussion. | 19:40 |
| bknudson | ajayaa_: how hard would it be to have it support SAML? | 19:40 |
| stevemar | oh, no federation, then i'm not interested | 19:40 |
| * stevemar walks away for coffee | 19:40 | |
| ajayaa_ | bknudson, I don't know. I would have to read about SAML. | 19:41 |
| ajayaa_ | What benefits do you get by using SAML? sorry I have not been following the federation stuff. | 19:42 |
| ajayaa_ | going on in Keystone. | 19:42 |
| gyee | what's the issue with SAML? | 19:45 |
| *** topol has joined #openstack-keystone | 19:45 | |
| *** ChanServ sets mode: +v topol | 19:45 | |
| ajayaa_ | I think we all have many questions and expectations in our mind when it comes to NoSql backend for Keystone. Let us(ajaya, rushiagr) write a spec and we can discuss it there. | 19:49 |
| *** mattamizer has joined #openstack-keystone | 19:49 | |
| samueldmq | dstanek, ping - you around ? | 19:49 |
| samueldmq | dstanek, what about somehting like http://paste.openstack.org/show/199776/ for migration tests | 19:49 |
| samueldmq | dstanek, it is just about the structuration and how we deal with tests for each migration | 19:50 |
| samueldmq | dstanek, in this ^approach we would have a class for each migration, inheriting from MigrationTest ... | 19:50 |
| samueldmq | dstanek, that's just an initial example to show the idea :) | 19:50 |
| samueldmq | dstanek, let me know what you think | 19:50 |
| samueldmq | breton, bknudson ^ you may also be interested on this | 19:51 |
| bknudson | samueldmq: look at what nova does. | 19:51 |
| bknudson | samueldmq: there might be an abandoned review by christopher yeoh. | 19:51 |
| samueldmq | bknudson, going to look | 19:52 |
| samueldmq | bknudson, still looking .. but at a glance I can see they organize their tests in directories | 19:54 |
| samueldmq | bknudson, that's good :) | 19:54 |
| *** jistr has quit IRC | 19:55 | |
| *** _cjones_ has quit IRC | 19:55 | |
| *** _cjones_ has joined #openstack-keystone | 19:55 | |
| bknudson | samueldmq: https://review.openstack.org/#/c/23660/ | 19:55 |
| bknudson | we don't need to do a snake walk anymore since there's no downgrades. | 19:56 |
| bknudson | the migration tests seem fine the way there are... we shouldn't have that many migrations anyways. | 19:57 |
| samueldmq | bknudson, yeah, the idea was interesting | 20:00 |
| samueldmq | bknudson, but yes, we dont need that walk anymore | 20:00 |
| samueldmq | bknudson, my idea was to have a better structure on migration tests ... since they are all in the same file | 20:01 |
| samueldmq | bknudson, but we dont have a* lot* of migrations .. it is not bad as it's today, but could be better :) | 20:02 |
| *** topol has quit IRC | 20:05 | |
| *** samueldmq has quit IRC | 20:07 | |
| *** ayoung has quit IRC | 20:08 | |
| *** patrickeast has joined #openstack-keystone | 20:11 | |
| openstackgerrit | Merged openstack/keystone: Handle NULL value for service.extra in migration 066 https://review.openstack.org/171204 | 20:11 |
| *** ajayaa_ has quit IRC | 20:12 | |
| *** samueldmq_ has joined #openstack-keystone | 20:14 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 20:14 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change domain_id FK in project table https://review.openstack.org/166354 | 20:14 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 20:14 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 20:14 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Stop calling domain drivers https://review.openstack.org/165936 | 20:14 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 20:14 |
| *** samueldmq has joined #openstack-keystone | 20:15 | |
| *** tqtran_ has joined #openstack-keystone | 20:15 | |
| *** tqtran has quit IRC | 20:17 | |
| stevemar | morganfainberg, whats the deal with backporting to juno? | 20:18 |
| stevemar | juno is closed out now right? | 20:18 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: DO NOT MERGE https://review.openstack.org/171355 | 20:19 |
| stevemar | bump: https://review.openstack.org/#/c/171329/ | 20:20 |
| morganfainberg | stevemar, backports to Juno? | 20:22 |
| morganfainberg | stevemar, we can do those if the stable team accepts them | 20:22 |
| stevemar | morganfainberg, yeah, someone in a bug report was asking about if it could be ported to juno | 20:22 |
| morganfainberg | depends on the fix | 20:23 |
| stevemar | this one: https://bugs.launchpad.net/keystone/+bug/1407661 | 20:23 |
| openstack | Launchpad bug 1407661 in Keystone "keystone with LDAP identity complains about invalid input for trustor_user_id" [High,Fix committed] - Assigned to Steve Martinelli (stevemar) | 20:23 |
| *** ayoung has joined #openstack-keystone | 20:24 | |
| *** ChanServ sets mode: +v ayoung | 20:24 | |
| morganfainberg | neato. | 20:25 |
| morganfainberg | git commit -S <key-id> -a | 20:25 |
| morganfainberg | signed git commits | 20:25 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Validate user exist when assigning roles in V2 https://review.openstack.org/93982 | 20:26 |
| stevemar | whats the benefit of it? | 20:27 |
| morganfainberg | stevemar, gpg signed commit | 20:28 |
| morganfainberg | if you know my key you know it was actually me | 20:28 |
| morganfainberg | i might start doing it for the lulz | 20:28 |
| bknudson | does gerrit support it? | 20:28 |
| morganfainberg | bknudson, gerrit supports it, but you'd lose it when a merge commit happens | 20:29 |
| morganfainberg | it's directly tied to the SHA | 20:29 |
| * morganfainberg just realized it's pointless with gerrit | 20:29 | |
| bknudson | do you need to pass the option or can you set it in your config and forget it? | 20:30 |
| morganfainberg | bknudson, not sure if you can make it an option | 20:30 |
| morganfainberg | probably | 20:30 |
| morganfainberg | it's not shown in my man page, so its new | 20:30 |
| * morganfainberg hasn't played with it | 20:32 | |
| morganfainberg | we'll see how bad it explodes things as I use it more | 20:32 |
| openstackgerrit | Merged openstack/keystone: Improved policy setting in the 'v3 filter' tests https://review.openstack.org/156597 | 20:32 |
| morganfainberg | i plan on making it my default mode of committing until i find a reason not to | 20:32 |
| morganfainberg | aka: breaks gerrit in weird ways | 20:33 |
| morganfainberg | which case... i wont do it anymore | 20:33 |
| morganfainberg | jamielennox, you around? | 20:33 |
| bknudson | good, gives me more plaintext so I can calculate your key. | 20:33 |
| morganfainberg | bknudson, sure thing! | 20:33 |
| morganfainberg | bknudson, let me check how many bits my key is. | 20:34 |
| *** alex_xu has quit IRC | 20:34 | |
| jamielennox | morganfainberg: yea, but i've got a meeting for the next half hour - can i ping you then? | 20:36 |
| morganfainberg | sure | 20:36 |
| *** pnavarro has quit IRC | 20:37 | |
| morganfainberg | bknudson, ah 4096 only | 20:37 |
| mtreinish | morganfainberg: well it doesn't break gerrit at least: https://review.openstack.org/#/c/170270/ | 20:38 |
| bknudson | doesn't the submitter need your ssh key to impersonate you? | 20:38 |
| morganfainberg | mtreinish, haha yeah | 20:38 |
| morganfainberg | bknudson, yes. | 20:38 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient-federation: Add Saml2KeystoneUnscoped for K2K federation https://review.openstack.org/161751 | 20:38 |
| bknudson | I might be fooled if someone registered M0rgan Fainberg. | 20:38 |
| bknudson | or 0penStack Bot | 20:38 |
| mtreinish | bknudson: you can generate a gerrit password too, I'm not sure whether you can use that for submissions or just the rest api | 20:39 |
| bknudson | next time one of my changes gets reverted I'll just claim it was an impersonator. | 20:39 |
| gyee | git blame don't lie | 20:40 |
| rodrigods | lol | 20:40 |
| morganfainberg | my ssh key is like 8192 bits :( | 20:41 |
| morganfainberg | it sometimes takes a long time to login to slow embeded devices | 20:42 |
| *** rushiagr is now known as rushiagr_away | 20:42 | |
| *** mattamizer has quit IRC | 20:45 | |
| *** topol has joined #openstack-keystone | 20:52 | |
| *** ChanServ sets mode: +v topol | 20:53 | |
| *** _cjones_ has quit IRC | 20:58 | |
| *** raildo is now known as raildo|away | 20:59 | |
| * morganfainberg wonders which is more painful | 21:03 | |
| morganfainberg | a gate reset or a rc2 | 21:04 |
| jamielennox | morganfainberg: alright, done - what's up? | 21:06 |
| jamielennox | ksc releases? | 21:06 |
| morganfainberg | jamielennox, was thinking i was going to add you to the release group for keystone | 21:06 |
| jamielennox | morganfainberg: that's dangerous | 21:06 |
| morganfainberg | so you can help with the ksc/ksm releases | 21:06 |
| jamielennox | i could just release whenever i want | 21:06 |
| morganfainberg | you could | 21:06 |
| morganfainberg | it's a question of if this makes sense to do. | 21:07 |
| *** gokrokve has quit IRC | 21:07 | |
| morganfainberg | hell i could release daily right now :P | 21:07 |
| jamielennox | i'm not too worried, we've increased the rate fairly significantly and i'd still coordinate it with you | 21:07 |
| *** mattfarina has joined #openstack-keystone | 21:08 | |
| *** fifieldt has quit IRC | 21:08 | |
| morganfainberg | it's a lot of mucking with LP and making sure things line up | 21:08 |
| jamielennox | it would take some of the management stuff of your plate, the launchpad stuff | 21:08 |
| morganfainberg | i'm happy to let you jump in on these | 21:08 |
| morganfainberg | but i understand if you'd rather not fight with LP | 21:08 |
| morganfainberg | ;) | 21:08 |
| morganfainberg | i don't know if you're allowed to create milestones etc actually in LP | 21:09 |
| morganfainberg | should probably check that first. sometimes LP just gets in the way | 21:09 |
| jamielennox | morganfainberg: i'll take it if you want to offload some stuff, but i don't see it would change the speed of releases or how we'd organize them | 21:09 |
| morganfainberg | jamielennox, yeah was more of an offload since out active hours are different | 21:10 |
| morganfainberg | e.g. if we're waiting for a specific thing to merge or such | 21:10 |
| jamielennox | morganfainberg: ok, well see what permissions you can assign and we can at least coordinate and share it | 21:10 |
| morganfainberg | https://launchpad.net/python-keystoneclient/1.x.x | 21:11 |
| morganfainberg | do you have a "Create milestone" button | 21:11 |
| morganfainberg | above: Latest bugs reported | 21:11 |
| jamielennox | morganfainberg: yep | 21:11 |
| morganfainberg | cool | 21:11 |
| morganfainberg | create 1.4.0 | 21:12 |
| morganfainberg | 1.4.0 is the name | 21:12 |
| morganfainberg | the rest can all be left blank | 21:12 |
| jamielennox | done | 21:14 |
| morganfainberg | if you look https://launchpad.net/python-keystoneclient/+milestone/1.4.0 | 21:15 |
| morganfainberg | you should have a | 21:15 |
| morganfainberg | "create release" button | 21:15 |
| morganfainberg | right? | 21:15 |
| jamielennox | LP is a horrible interface, i've done this for other projects and i always have to search for buttons | 21:15 |
| jamielennox | yep | 21:15 |
| morganfainberg | ok cool | 21:15 |
| morganfainberg | then you can do the LP side | 21:15 |
| morganfainberg | the gerrit side is me adding you to a group | 21:15 |
| *** ayoung has quit IRC | 21:16 | |
| morganfainberg | jamielennox, ok i'm going to add you to the release group | 21:16 |
| *** _cjones_ has joined #openstack-keystone | 21:16 | |
| *** tobberydberg has quit IRC | 21:17 | |
| morganfainberg | jamielennox, the rules i'd like to keep: no releases after Wednesday (US) | 21:17 |
| morganfainberg | jamielennox, and we coordinate when the releases are planned to go out | 21:17 |
| morganfainberg | jamielennox, so we have up to 2 days to catch regressions before the weekends :) | 21:17 |
| jamielennox | morganfainberg: sure, i don't see much changing other than shifting some of the workload | 21:17 |
| morganfainberg | jamielennox, yep | 21:17 |
| morganfainberg | jamielennox, you can now push signed tags to gerrit | 21:18 |
| morganfainberg | for keystoneclient, middleware, and ksc-kerberos | 21:18 |
| morganfainberg | jamielennox, dolph has some scripts i use to assign bugs to the milestones etc. | 21:19 |
| *** fifieldt has joined #openstack-keystone | 21:21 | |
| morganfainberg | lhcheng, you are signed into freenode/registered an account, right? | 21:21 |
| *** ThoamsHsiao has quit IRC | 21:21 | |
| *** topol has quit IRC | 21:22 | |
| lhcheng | morganfainberg: I haven't registered | 21:22 |
| lhcheng | let me do that | 21:23 |
| morganfainberg | lhcheng, please do | 21:23 |
| morganfainberg | so i can add you to the list of people who can change the topic of the channel as needed | 21:23 |
| morganfainberg | being core and all that | 21:24 |
| *** chlong has joined #openstack-keystone | 21:25 | |
| *** alexsyip has joined #openstack-keystone | 21:27 | |
| *** ayoung has joined #openstack-keystone | 21:29 | |
| *** ChanServ sets mode: +v ayoung | 21:29 | |
| morganfainberg | lhcheng, make sure to identify w/ nickserv once you're registered | 21:31 |
| morganfainberg | lhcheng, should make you +V in the channel like the rest of the core | 21:31 |
| * lhcheng waiting for activation email | 21:32 | |
| morganfainberg | ah | 21:32 |
| lhcheng | morganfainberg: cool, will do that | 21:32 |
| lhcheng | morganfainberg: I just need to run this command: " /msg NickServ REGISTER <pwd> <email>" right? | 21:33 |
| morganfainberg | yeah | 21:34 |
| lhcheng | okay, waiting for the email to arrive | 21:34 |
| * morganfainberg doesn't remember email thing | 21:34 | |
| openstackgerrit | Merged openstack/keystone: Open Liberty development https://review.openstack.org/171260 | 21:34 |
| stevemar | \o/ | 21:34 |
| bknudson | open the floodgates! | 21:35 |
| stevemar | starting with https://review.openstack.org/#/c/171329/ ? | 21:35 |
| *** lhcheng has quit IRC | 21:36 | |
| *** lhcheng has joined #openstack-keystone | 21:36 | |
| *** lhcheng has quit IRC | 21:37 | |
| *** openstackgerrit has quit IRC | 21:37 | |
| *** lhcheng has joined #openstack-keystone | 21:37 | |
| *** openstackgerrit has joined #openstack-keystone | 21:37 | |
| bknudson | lhcheng and openstackgerrit might be the same. | 21:37 |
| bknudson | stevemar: seems like we should resolve https://review.openstack.org/#/c/142472/ before adding the placeholders. | 21:38 |
| stevemar | bknudson, ah yeah | 21:41 |
| *** ThoamsHsiao has joined #openstack-keystone | 21:41 | |
| *** ThoamsHsiao has quit IRC | 21:41 | |
| *** lhcheng has quit IRC | 21:41 | |
| *** lhcheng has joined #openstack-keystone | 21:42 | |
| *** ChanServ sets mode: +v lhcheng | 21:42 | |
| lhcheng | morganfainberg: \o/ | 21:43 |
| lhcheng | bknudson: what do I need to do for openstackgerrit? | 21:43 |
| *** ThoamsHsiao has joined #openstack-keystone | 21:44 | |
| *** ThoamsHsiao has quit IRC | 21:48 | |
| *** ThoamsHsiao has joined #openstack-keystone | 21:49 | |
| *** ChanServ changes topic to "Liberty Development Open | Look for RC-critical bugs | Review KeystoneClient and KeystoneMiddleware code | Review Liberty Keystone Specs" | 21:49 | |
| *** samueldmq has quit IRC | 21:49 | |
| *** samueldmq_ has quit IRC | 21:49 | |
| morganfainberg | jamielennox, we should formalize VersionList as a thing in the catalog | 21:50 |
| morganfainberg | http://paste.openstack.org/show/199865/ | 21:50 |
| morganfainberg | example | 21:50 |
| morganfainberg | let the URL be the default for the deployer but let people lookup versionlist if it exists for a service | 21:50 |
| morganfainberg | this should also become a x-project spec | 21:50 |
| morganfainberg | so we can get TC and a standard for what the versionlist needs to provide | 21:51 |
| *** alexsyip has quit IRC | 21:51 | |
| *** stevemar has quit IRC | 21:58 | |
| *** carlosmarin has quit IRC | 21:58 | |
| *** carlosmarin has joined #openstack-keystone | 22:00 | |
| *** henrynash has quit IRC | 22:02 | |
| *** edmondsw has quit IRC | 22:02 | |
| *** mestery has quit IRC | 22:11 | |
| *** gyee has quit IRC | 22:11 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add placeholders for reserved migrations for Kilo backports. https://review.openstack.org/171408 | 22:12 |
| *** mestery has joined #openstack-keystone | 22:12 | |
| morganfainberg | breton, not sure if you want to do the collapse again for liberty, but it should be safe to do so any time now. Or we can shift it around to other people :) | 22:13 |
| morganfainberg | breton, figure i'd give ya first crack at it though | 22:13 |
| *** gyee has joined #openstack-keystone | 22:14 | |
| *** ChanServ sets mode: +v gyee | 22:14 | |
| breton | morganfainberg: I suggest not to do it now because new migrations might land | 22:14 |
| breton | lets wait at least until release | 22:14 |
| morganfainberg | ah until icehouse drops off you mean? | 22:15 |
| morganfainberg | EOL* that is | 22:15 |
| breton | no, until K release | 22:15 |
| morganfainberg | RC was cut | 22:15 |
| morganfainberg | we're clear | 22:15 |
| morganfainberg | liberty development is now open on master | 22:15 |
| breton | so, no migrations in kilo under any circumstances? | 22:16 |
| morganfainberg | no we'd only be collapsing icehouse -> juno | 22:16 |
| morganfainberg | kilo might get new migrations | 22:16 |
| breton | oh. | 22:16 |
| morganfainberg | but that doesn't impact collapsing | 22:16 |
| breton | right | 22:16 |
| morganfainberg | :) | 22:16 |
| morganfainberg | it's also why we do 2 cycle upgrades, then grenade doens't explode us at the start of the cycle | 22:17 |
| breton | ok, will do | 22:17 |
| morganfainberg | please register a BP and target to L1 | 22:18 |
| morganfainberg | i'll set priority to low | 22:18 |
| *** alexsyip has joined #openstack-keystone | 22:19 | |
| *** gordc has quit IRC | 22:20 | |
| breton | morganfainberg: https://blueprints.launchpad.net/keystone/+spec/liberty-sql-squash | 22:21 |
| morganfainberg | there we go | 22:22 |
| morganfainberg | all approved and official and stuff | 22:22 |
| *** samueldmq has joined #openstack-keystone | 22:26 | |
| *** dims_ has joined #openstack-keystone | 22:30 | |
| *** dims_ has quit IRC | 22:30 | |
| *** dims_ has joined #openstack-keystone | 22:31 | |
| *** bknudson has quit IRC | 22:33 | |
| *** dims has quit IRC | 22:34 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:36 | |
| breton | lhcheng: congrats | 22:36 |
| lhcheng | breton: thanks | 22:37 |
| *** boris-42 has quit IRC | 22:38 | |
| jamielennox | morganfainberg: i want to just push url to be version list | 22:41 |
| jamielennox | it's just a difficult transition | 22:41 |
| morganfainberg | jamielennox, thats a hard sell | 22:41 |
| morganfainberg | jamielennox, maybe versionlist is the right way to pivot | 22:41 |
| jamielennox | i was hoping by liberty release that everything would work with an unversioned url in the catalog and then we could get people to change as available | 22:41 |
| jamielennox | i know we're not pushing PKI tokens as hard any more, but i still would prefer to be removing things from the catalog | 22:42 |
| morganfainberg | we've learned the "change this" tends to be bad and resistant, but if we offer better alternative | 22:42 |
| morganfainberg | jamielennox, s/bad and resistant/subject to resistence/ | 22:42 |
| *** carlosmarin has quit IRC | 22:42 | |
| jamielennox | i have a lot of the discovery code in ksc that is designed to push that way, i'm not saying we can't just change it over but there is the start of this for a while now | 22:43 |
| jamielennox | cinderclient is trying to transition to an unversioned url in the catalog now | 22:43 |
| jamielennox | (ironic as they still have a project id in the url in v2 api) | 22:43 |
| morganfainberg | again just a thought | 22:43 |
| morganfainberg | we might be able to help as a transitional | 22:43 |
| jamielennox | the problem i have from a client perspective is having to support the lowest common denominator | 22:44 |
| jamielennox | so for v3 i have to assume v3.0 unless more information is provided | 22:44 |
| jamielennox | it's why i haven't pushed the catalog in the unscoped token for a while - i still think that's the right thing to do | 22:44 |
| jamielennox | but from a client perspective i'm always going to have to support the old way as well, so i've been more interested in making what we have work than adding new things even where useful | 22:45 |
| morganfainberg | that is kindof my thought behind a pivot like this... but... *shrug* | 22:46 |
| morganfainberg | was a thought | 22:46 |
| morganfainberg | let url be the <versioned> until they can move off | 22:46 |
| morganfainberg | if VersionList is there | 22:46 |
| morganfainberg | the user can query | 22:47 |
| morganfainberg | and we can have some commonality on what versionlist provides | 22:47 |
| morganfainberg | and then eventually once everyone is off versioned endpoints... | 22:47 |
| jamielennox | morganfainberg: v4 auth | 22:47 |
| morganfainberg | versionlist (optional) might go away | 22:47 |
| morganfainberg | i also want to move auth endpoints for keystone out of /v3/auth | 22:47 |
| morganfainberg | something like /auth/version | 22:48 |
| jamielennox | right | 22:48 |
| jamielennox | i agree | 22:48 |
| jamielennox | and all this OS-FEDERATION nonsense can get dropped into the /auth namespace | 22:48 |
| morganfainberg | yes. | 22:48 |
| morganfainberg | or even just dropped all together | 22:48 |
| morganfainberg | we *could* make it just /auth and have the version be part of the request | 22:49 |
| jamielennox | right, drop the federation term completely | 22:49 |
| jamielennox | just be auth | 22:49 |
| morganfainberg | {auth_ver: 4.0} | 22:49 |
| morganfainberg | if we need to version things it opens doors for us to be compatible | 22:49 |
| morganfainberg | but we don't have to make it a straight-up url | 22:49 |
| jamielennox | yep, no default_project_ids, no automatic scoping, you always request unscoped and rescope etc | 22:49 |
| morganfainberg | +++++++ | 22:49 |
| jamielennox | federation and other auth will be almost identical | 22:50 |
| jamielennox | completely agree with all of it | 22:50 |
| morganfainberg | and we just add a shim in /v2.0/auth that redirects over to the new auth stuff same with /v3/auth | 22:50 |
| morganfainberg | -- /v2.0/tokens that is | 22:50 |
| morganfainberg | so we don't maintain 15 different ways to auth. | 22:51 |
| jamielennox | morganfainberg: hmm, ok - i wasn't going to worry so much about moving the old stuff | 22:51 |
| morganfainberg | jamielennox, don't "move" just collect information and shuffle over to the new controller | 22:51 |
| morganfainberg | keep the code paths coherant | 22:51 |
| *** jaosorior has quit IRC | 22:52 | |
| morganfainberg | and not have many places to fix problems | 22:52 |
| morganfainberg | you can still auth in the normal places in my mind, just internally we use the new mechanisms. | 22:53 |
| morganfainberg | [i'd love a 301 but i know that isn't realistic | 22:53 |
| jamielennox | oh, sure, that's juts wiring controllers to the backend | 22:54 |
| jamielennox | speaking of which | 22:54 |
| morganfainberg | yes | 22:54 |
| jamielennox | i got https://review.openstack.org/#/c/65428 to pass | 22:54 |
| jamielennox | (look at that review number) | 22:54 |
| morganfainberg | holy crap | 22:54 |
| *** mattfarina has quit IRC | 22:54 | |
| jamielennox | however the next step is really difficult as things stand | 22:55 |
| jamielennox | firstly, having extensions in paste rather than in pecan means we can't actually change any of the existing routing code | 22:56 |
| *** bknudson has joined #openstack-keystone | 22:56 | |
| *** ChanServ sets mode: +v bknudson | 22:56 | |
| jamielennox | because any extension code exists outside of pecan control | 22:56 |
| morganfainberg | lets just say that was an intentional part of the "get rid of extensions" bp | 22:56 |
| morganfainberg | we can start moving things out of paste | 22:56 |
| jamielennox | ok, is there any practical progress on that? otherwise i might take a swing at it | 22:57 |
| morganfainberg | everything is on by default | 22:57 |
| morganfainberg | no more "optionality" | 22:57 |
| morganfainberg | thats where we landed in Kilo | 22:57 |
| morganfainberg | i think the next step is restructuring so /contrib dies | 22:58 |
| morganfainberg | however that happens | 22:58 |
| jamielennox | yep, but anything actually started there? | 22:58 |
| morganfainberg | nope | 22:58 |
| jamielennox | ok | 22:58 |
| *** bknudson1 has joined #openstack-keystone | 22:58 | |
| morganfainberg | and we need to find a way to merge the "extension" migrations into our main repo. | 22:58 |
| jamielennox | second thing, dependency resolution - i understand we finally decided to kill that off as well | 22:58 |
| morganfainberg | jamielennox, yes. that needs to die | 22:58 |
| jamielennox | morganfainberg: oh - right, i did look at that and decided i had no idea how to merge migrations | 22:58 |
| jamielennox | that alembic could probably do it better and that just opened up a new can of worms | 22:59 |
| morganfainberg | jamielennox, the way you merge migrations is we need to do some work to make any migration idempotent. | 22:59 |
| morganfainberg | oooor | 22:59 |
| morganfainberg | the really evil thing | 22:59 |
| morganfainberg | make a temp table, remove dbcontroll for the extension and migrate things back in | 22:59 |
| morganfainberg | but i like the idempotent idea better | 23:00 |
| *** bknudson has quit IRC | 23:00 | |
| morganfainberg | stack in a ton of migrations that say "if we are at state X do Y, else, nothing" | 23:00 |
| jamielennox | is if not table exists enough? | 23:00 |
| morganfainberg | nope. | 23:00 |
| morganfainberg | because extensions have their own migration states. | 23:00 |
| morganfainberg | we could collapse all of them down for liberty though | 23:00 |
| morganfainberg | i guess. | 23:00 |
| jamielennox | most extensions have only 1 or 2 migrations | 23:01 |
| morganfainberg | so lets think this through | 23:02 |
| morganfainberg | we support 2 cycles of upgrades for schemas | 23:02 |
| morganfainberg | we need smart migrations :( | 23:03 |
| morganfainberg | damn it | 23:03 |
| morganfainberg | i don't think alembic solves it | 23:03 |
| jamielennox | alembic solves for the fact that we can branch AFAIK | 23:04 |
| gyee | morganfainberg, with per-domain backend store in sql, caching is not mandatory isn't it? | 23:04 |
| morganfainberg | no. | 23:04 |
| jamielennox | so you don't have a sequential list, you could say that this change depends on this change whereever that may have happened | 23:04 |
| morganfainberg | it isn't | 23:04 |
| morganfainberg | but woe to you who tries to use the domain-sql stuff w/o caching | 23:04 |
| morganfainberg | annnnnd potentially wierd ½ loaded configs | 23:04 |
| morganfainberg | gyee, that code is not production ready imo | 23:05 |
| gyee | came across this error when trying to import the conf files into sql | 23:05 |
| morganfainberg | jamielennox, right there was a reason we couldn't move to alembic yet | 23:05 |
| gyee | 2015-04-07 00:36:09.918 6563 TRACE keystone File "/home/thsiao/work/openstack/keystone_new/keystone/.venv/local/lib/python2.7/site-packages/dogpile/cache/region.py", line 278, in _mutex | 23:05 |
| gyee | 2015-04-07 00:36:09.918 6563 TRACE keystone return self._lock_registry.get(key) | 23:05 |
| gyee | 2015-04-07 00:36:09.918 6563 TRACE keystone AttributeError: 'CacheRegion' object has no attribute '_lock_registry' | 23:05 |
| morganfainberg | gyee, file a bug, tag it as rc-potential | 23:05 |
| gyee | sure | 23:05 |
| morganfainberg | kilo-rc-potential | 23:05 |
| morganfainberg | * | 23:05 |
| jamielennox | morganfainberg: i thought it was going to be solved by another project and we could just inherit there solution | 23:06 |
| jamielennox | instead they started maintaining sqlalchemy-migrate | 23:06 |
| morganfainberg | gyee, i think anyone who uses domain-sql code is going to be realllllly unhappy in kilo | 23:06 |
| morganfainberg | jamielennox, no we had a specific reason alembic wasn't possible for us yet | 23:06 |
| morganfainberg | jamielennox, and it doesn't change that our migrations are going to have to be "smart" | 23:06 |
| morganfainberg | gyee, it's a nice place to start but it has some very rough edges | 23:07 |
| jamielennox | well switching to alembic is a much different task which may or may not solve this extension issue anyway | 23:07 |
| morganfainberg | jamielennox, it wont | 23:07 |
| morganfainberg | jamielennox, but we *could* make all new migrations alembic | 23:07 |
| gyee | morganfainberg, well, somebody need to clear the minefield :D | 23:07 |
| jamielennox | morganfainberg: wasn't that attempted and failed? | 23:07 |
| morganfainberg | jamielennox, there was i think a specific oslo.db bug | 23:08 |
| morganfainberg | jamielennox, that needed addressing to make it all work | 23:08 |
| morganfainberg | breton, cc^ re moving to alembic | 23:08 |
| morganfainberg | jamielennox, but iirc we should be golden this cycle | 23:08 |
| jamielennox | ok, well if it doesn't solve the extension issue then i'm not all that worried | 23:09 |
| morganfainberg | jamielennox and we still need "smart" migrations. | 23:09 |
| jamielennox | morganfainberg: ok, well - i'll try and move one or two of the easy ones and see what happends | 23:11 |
| jamielennox | because we will need to change how policy is enforced very soon in the pecan model and it is very wrapped up together | 23:12 |
| morganfainberg | jamielennox, sounds good. | 23:12 |
| morganfainberg | jamielennox, and don't worry about the extension migrations | 23:13 |
| morganfainberg | jamielennox, that we can handle the same way we do today | 23:13 |
| jamielennox | ? | 23:13 |
| morganfainberg | separate concern/bit of debt to cleanup | 23:13 |
| morganfainberg | jamielennox, migrate them independant of the main sql migrate repo | 23:13 |
| morganfainberg | thats how we handle it today | 23:13 |
| *** alexsyip has quit IRC | 23:13 | |
| jamielennox | ok | 23:13 |
| jamielennox | that would make it easier | 23:13 |
| morganfainberg | so you move things around, just don't worry about collapsing the sql schema migrations | 23:14 |
| morganfainberg | into the main repo | 23:14 |
| jamielennox | ok | 23:14 |
| jamielennox | i think it was dstanek looking at removing dependency resolution, do you know how far that got? | 23:14 |
| jamielennox | (or dstanek if here) | 23:14 |
| morganfainberg | there are a couple reviews up | 23:15 |
| morganfainberg | that need rebasing | 23:15 |
| jamielennox | ok, so there is progress there at least - i haven't been watching for a while | 23:16 |
| jamielennox | morganfainberg: oh - i have another one, i want to kill specifying /v2.0 and /v3 from paste, honestly if you changed those values even keystone would fail in certain places | 23:18 |
| morganfainberg | well one of the big goals i see for liberty is a mode where V2 disappears. | 23:18 |
| morganfainberg | or can be disabled | 23:18 |
| morganfainberg | and everythign still runs | 23:19 |
| morganfainberg | jamielennox, keep in mind moving to pecan, we have people with custom code that runs via paste, we need to clearly explain how to make sure that stuff still works | 23:19 |
| jamielennox | sure, we wouldn't remove paste just move stuff | 23:20 |
| *** raildo has joined #openstack-keystone | 23:20 | |
| jamielennox | so i guess that's a concern though about what i can change from common/wsgi and controllers | 23:21 |
| morganfainberg | jamielennox, but that means in paste we would really break things for people if their extension is only v2 pipeline | 23:21 |
| morganfainberg | was my point | 23:21 |
| jamielennox | morganfainberg: yea, that's easy, even with our pipeline we would need to support that | 23:22 |
| morganfainberg | jamielennox, so the TL;DR lets not horribly break people :) | 23:22 |
| *** ayoung has quit IRC | 23:22 | |
| morganfainberg | anything we move to pecan we need to just leave a stubby router thing that says "hey this is going away" etc | 23:22 |
| morganfainberg | that goes into paste | 23:23 |
| morganfainberg | otherwise.. i think you're safe to make changes like not having separate v2/v3 etc | 23:23 |
| jamielennox | morganfainberg: is there a point in maintaining the concept of disabling things that were extensions? | 23:25 |
| jamielennox | like via config? | 23:25 |
| morganfainberg | well. we need to have a way to do so. my thought is policy | 23:25 |
| morganfainberg | make it so you can't ever pass the policy check for that whole set of APIs | 23:26 |
| jamielennox | but not like CONF.endpoint_policy.enabled | 23:26 |
| morganfainberg | but this is something i'd like more views on | 23:26 |
| morganfainberg | uh, not really. | 23:26 |
| jamielennox | because trusts still has CONF.trusts.enabled | 23:26 |
| morganfainberg | we could do that | 23:27 |
| morganfainberg | for experimental stuff [with the understanding that the "enabled flag" is removed when it graduates to stable] | 23:27 |
| morganfainberg | this is a convo we need more folks involved in | 23:27 |
| morganfainberg | i think mfisch would also be a good person to ask [as someone running an openstack cloud] and marekd | 23:28 |
| gyee | morganfainberg, https://bugs.launchpad.net/keystone/+bug/1441386 | 23:40 |
| openstack | Launchpad bug 1441386 in Keystone "keystone-manage domain_config_upload command yield "'CacheRegion' object has no attribute 'expiration_time'"" [Undecided,New] | 23:40 |
| morganfainberg | thanks | 23:40 |
| gyee | I'll do some troubleshooting, would love some help from henrynash though | 23:40 |
| morganfainberg | yeah | 23:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient-federation: Add Saml2KeystoneUnscoped for K2K federation https://review.openstack.org/161751 | 23:45 |
| jamielennox | rodrigods: that repo is largely abandoned | 23:46 |
| breton | regarding alembic and migrations | 23:46 |
| rodrigods | jamielennox, really? thought new federation plugins should be implemented there | 23:46 |
| jamielennox | rodrigods: that was the plan, we decided that we wanted to be more specific that just -federation and that we'll do a -saml repo | 23:46 |
| breton | the feature will let use old migrations along with new ones | 23:47 |
| morganfainberg | breton, the reason for not having it was a bug we were waiting for a release in oslo.db iirc | 23:47 |
| morganfainberg | breton, and this cycle should be able to move to alembic, right? | 23:48 |
| breton | morganfainberg: yes, we were waiting for a release | 23:48 |
| breton | yep | 23:48 |
| rodrigods | jamielennox, but that change can land in -federation and than go to -saml? | 23:48 |
| breton | now when L is open, I'll do it by summit I think | 23:48 |
| jamielennox | rodrigods: sure, but we'll never release -federation | 23:49 |
| *** alexsyip has joined #openstack-keystone | 23:49 | |
| rodrigods | jamielennox, ok, good to know. thanks for the info | 23:49 |
| morganfainberg | breton feel free to -1 this then https://review.openstack.org/#/c/171408/ - or we can abandon this one once we start with alembic. | 23:49 |
| jamielennox | rodrigods: also https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/v3/federated.py#L25 is the base class you'll want | 23:49 |
| rodrigods | jamielennox, hmm... I'm also open to implement this plugin in ksc (without -*)... | 23:50 |
| rodrigods | jamielennox, what do you suggest? | 23:50 |
| jamielennox | rodrigods: it's generally a problem of dependencies | 23:50 |
| breton | morganfainberg: lets do the latter | 23:51 |
| jamielennox | for k2k it may be ok to put it in ksc | 23:51 |
| morganfainberg | breton, sounds good | 23:51 |
| rodrigods | jamielennox, cool, will reimplement in ksc | 23:51 |
| jamielennox | rodrigods: there's no xml parsing to be done? | 23:52 |
| rodrigods | jamielennox, no... we get the assertion from keystone server | 23:53 |
| jamielennox | rodrigods: that's what i thought, yea, so in ksc probably makes sense - i don't know where yet but propose it and we'll figure it out | 23:53 |
| rodrigods | jamielennox, nice | 23:54 |
| *** boris-42 has joined #openstack-keystone | 23:54 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!