| *** _cjones_ has quit IRC | 00:12 | |
| *** chlong has joined #openstack-keystone | 00:15 | |
| *** mestery has joined #openstack-keystone | 00:38 | |
| *** mestery has quit IRC | 00:41 | |
| *** mestery has joined #openstack-keystone | 00:43 | |
| *** tobe has joined #openstack-keystone | 00:44 | |
| breton | where is that? | 00:47 |
|---|---|---|
| *** marzif has quit IRC | 01:00 | |
| *** dimsum__ has joined #openstack-keystone | 01:12 | |
| *** dimsum__ has quit IRC | 01:15 | |
| *** dimsum__ has joined #openstack-keystone | 01:15 | |
| *** tellesnobrega has quit IRC | 01:16 | |
| *** ericksonsantos has quit IRC | 01:21 | |
| *** tellesnobrega has joined #openstack-keystone | 01:29 | |
| *** ericksonsantos has joined #openstack-keystone | 01:31 | |
| *** dimsum__ has quit IRC | 01:37 | |
| jamielennox | breton: the webob stuff? | 01:40 |
| morganfainberg | breton: great meeting you at the summit! | 01:40 |
| *** dguerri`away has quit IRC | 01:41 | |
| *** dimsum__ has joined #openstack-keystone | 01:43 | |
| *** dguerri`away has joined #openstack-keystone | 01:45 | |
| *** dguerri`away is now known as dguerri | 01:45 | |
| bigjools | anyone around at the moment who knows how to get SAML ECP working with the CLI? I seem to keep missing the right people :( | 01:54 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Remove custom header handling https://review.openstack.org/180385 | 02:00 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Fetch user token from request rather than env https://review.openstack.org/174202 | 02:00 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Remove the _msg_format function https://review.openstack.org/174201 | 02:00 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Base use webob https://review.openstack.org/174200 | 02:00 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't rely on token_info for header building https://review.openstack.org/174199 | 02:00 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Move project included validation https://review.openstack.org/174198 | 02:00 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Depend on keystoneclient for expiration checking https://review.openstack.org/174197 | 02:00 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't store expire into memcache https://review.openstack.org/174196 | 02:00 |
| jamielennox | bigjools: what are you trying to do | 02:01 |
| bigjools | jamielennox: just get it working against testshib | 02:02 |
| bigjools | have websso working | 02:03 |
| *** ayoung has joined #openstack-keystone | 02:03 | |
| *** ChanServ sets mode: +v ayoung | 02:03 | |
| *** zzzeek has quit IRC | 02:04 | |
| ayoung | jamielennox, you made it home safe and sound, I take it? | 02:04 |
| jamielennox | bigjools: i mean more what are you stuck with | 02:05 |
| jamielennox | and what cli | 02:05 |
| jamielennox | because each has special quirks | 02:05 |
| bigjools | ok | 02:05 |
| jamielennox | ayoung: all good | 02:05 |
| jamielennox | ayoung: i gave stevemar your jumper as you didn't seem that worried about it and i didn't have your card to charge it to | 02:06 |
| bigjools | using openstackclient. It sends a GET to the keystone v3 protected URL and the Shibboleth plugin redirects to the SSO endpoint rather than ECP | 02:06 |
| ayoung | jamielennox thanks, that is a good solution | 02:06 |
| ayoung | bigjools, jamielennox maybe we need to treat ECP as a separate protocol from SAML WebSSO? | 02:06 |
| breton | jamielennox: yep, that one | 02:07 |
| ayoung | Or, for each protocol, we need to distinguish between what to do between CLI and WebSOO paths, more likely | 02:07 |
| breton | morganfainberg: you too! | 02:07 |
| jamielennox | breton: https://github.com/Pylons/webob/issues/201 | 02:08 |
| breton | summit completely broke my inner clock | 02:08 |
| morganfainberg | jamielennox: bigjools: I need to get a chance to see what the current websso (SAML) state of affairs is. | 02:08 |
| bigjools | it is adding the paos header but perhaps testshib metadata or the local shibd isn't configured right | 02:08 |
| breton | 05:08 < breton> summit | 02:08 |
| jamielennox | i can't help with shib at all | 02:09 |
| jamielennox | but afaik iff shib is wokring the existing federation plugins will call it correctly | 02:09 |
| bigjools | right, websso is all good | 02:10 |
| morganfainberg | bigjools: jamielennox: specifically what the rough edges are / pitfalls (if any are more than the ones we found during the keynote ramp up) | 02:10 |
| bigjools | but there's a different binding for ecp, and I'm all out of ideas for that | 02:10 |
| bigjools | morganfainberg: some docs would be nice :) | 02:10 |
| morganfainberg | bigjools: that's part of it :) | 02:10 |
| jamielennox | bigjools: so it's set up and you're trying to figure out how to make OSC use it for auth | 02:10 |
| jamielennox | ? | 02:10 |
| morganfainberg | ayoung: ^ *cough* | 02:11 |
| bigjools | morganfainberg: also the CLI gives no indication of what opts to pass, I had to look in the code | 02:11 |
| morganfainberg | bigjools: we need to make the docs a real thug this cycle. | 02:11 |
| morganfainberg | I agree. | 02:11 |
| morganfainberg | Thing* | 02:11 |
| morganfainberg | Silly autocorrect. | 02:11 |
| bigjools | jamielennox: right - at least I think it's all set up, I don't know if anything else is needed for ECP | 02:11 |
| jamielennox | bigjools: yea, the way OSC does auth options is anoying | 02:12 |
| jamielennox | i've tried to fix that | 02:12 |
| bigjools | I'm happy to dive in and do some doc fixes once I understand how some more of these things work | 02:12 |
| jamielennox | somewhere i had a python function to show what you want | 02:13 |
| ayoung | jamielennox, so I had a thought on Keystone agent | 02:13 |
| ayoung | and I can't really take credit or blame for it | 02:13 |
| jamielennox | https://gist.github.com/jamielennox/7f5cfabd64a6922e643c#file-list-plugins-py | 02:13 |
| bigjools | all the examples I've seen talk directly to an ECP endpoint, but the v3unscopedsaml auth plugin does a GET to the /v3/OS-FEDERATION/identity_providers/{identity_providers}/... first | 02:14 |
| morganfainberg | jamielennox: btw had a nice chat w/ sdague. Seems like you worked out the things with him that was needed. | 02:14 |
| morganfainberg | Post conference. | 02:14 |
| jamielennox | bigjools: you don't want the unscoped one | 02:14 |
| ayoung | https://twitter.com/admiyoung/status/602531670793781250 lead to the response: systemd | 02:14 |
| ayoung | so, what if we made systemd responsible for handling Keystone events for the local system and cache? | 02:15 |
| bigjools | jamielennox: ah! which one then? | 02:15 |
| jamielennox | bigjools: good question, looking | 02:15 |
| bigjools | ayoung: systemd is going to read email soon... | 02:15 |
| ayoung | bigjools, email is just an async notification. Why not. | 02:16 |
| bigjools | :) | 02:16 |
| ayoung | bigjools, seriously, email is a reliable, scalable protocol. It lacks authentication, whicm means you need to do that out of band. But I've often thought about building systems based on email notificaitions. However, for the moment, I would like to figure out how to get systmed t o respond to Keystone notifications via rabbitmq and oslo messaging | 02:17 |
| breton | It'd be great to get a list of functionality that need docs | 02:18 |
| ayoung | then, if people don't want to run systemd, they can run their own daemon/agent like jamielennox origianlly suggested | 02:18 |
| breton | I'd participate too | 02:18 |
| jamielennox | ayoung: so it's not systemd | 02:18 |
| jamielennox | though part of my reasoning for using domain sockets is that you can do systemd socket activation | 02:19 |
| ayoung | jamielennox, I would argue that, for a systemd based install, it makes as much sense as any other option. It should not *have* to be systemd | 02:19 |
| jamielennox | which makes it really easy to deploy one agent/machine | 02:19 |
| ayoung | right...and the socket could also be dbus | 02:19 |
| *** lhcheng has quit IRC | 02:19 | |
| jamielennox | i thought dbus would be a harder sell - not particular reason why | 02:19 |
| ayoung | we are already headed that way for mo_lookup_identity and for certmonger | 02:19 |
| breton | I heard dbus is terribly slow | 02:20 |
| *** samueldmq has quit IRC | 02:20 | |
| ayoung | jamielennox, so we write a tool that should be able to work with systemd, and dbus, but does not require them. Provide options based on how people want to deploy | 02:20 |
| ayoung | breton, I suspect that there are anecdotals on that either way | 02:21 |
| jamielennox | ayoung: right | 02:21 |
| bigjools | morganfainberg: fwiw, a really nice fix would be to make OSC respond with an error about what cli opt is missing instead of a stacktrace :/ | 02:21 |
| jamielennox | i don't know if there is an advantage for systemd | 02:21 |
| jamielennox | ahh dbus | 02:21 |
| jamielennox | because the protocol will be easy | 02:21 |
| ayoung | Heh | 02:21 |
| jamielennox | why can i not find this federatoin plugin | 02:22 |
| jamielennox | i rewrote large chunks of it and it doesn't look like i remember | 02:23 |
| ayoung | jamielennox, anyway, I am going to drive on with getting an example of python code actually responding to Keystone events, and we can work together on the actual design for the agent based on that. | 02:23 |
| jamielennox | ayoung: i think message bus events is a seperate process/daemon/whatever to notifications that auth_token consumes | 02:24 |
| ayoung | jamielennox, probably. Right now, I would be happy with just being able to read them first | 02:24 |
| jamielennox | bigjools: i have a feeling that we are mid way through a refactor of the plugin i am thinking fo | 02:24 |
| bigjools | jamielennox: keystoneclient/contrib/auth/v3/saml2.py ? | 02:25 |
| jamielennox | bigjools: it should work it's just old | 02:25 |
| bigjools | there's v3scopedsaml too but I'm just figuring out what opts it wants | 02:26 |
| jamielennox | and you'd have to ask marekd how he uses it i think | 02:26 |
| bigjools | yeah, he said he'd talk to me about it | 02:28 |
| bigjools | oh weird, the v3scopedsaml path takes it into v2_0 territory | 02:29 |
| *** _cjones_ has joined #openstack-keystone | 02:30 | |
| jamielennox | so from memory the scoped parts in there are just because you have to provide a token created with SAML to a different URL that normal | 02:30 |
| jamielennox | so i think the scoped saml plugins actually take an existing token | 02:30 |
| jamielennox | there's a base class i did in ksc that handles scoping for you, and i thought we had the plugin based on that | 02:30 |
| jamielennox | at least in the ksc-saml2 repo, but it doesn't appear to be there either | 02:31 |
| morganfainberg | ayoung: unrelated to federation, https://www.percona.com/live/mysql-conference-2013/sessions/extensible-data-modeling-mysql <-- this is leading into how we kill extra attrs in a clean way | 02:31 |
| *** tobe has quit IRC | 02:31 | |
| ayoung | Class Table Inheritance and Serialized BLOB I know. Let me see about the third | 02:32 |
| morganfainberg | ayoung: yah | 02:32 |
| morganfainberg | i just was reading it, figured i'd toss the link in | 02:32 |
| morganfainberg | hadn't gotten through all the slides yet | 02:32 |
| ayoung | morganfainberg, ah, that is a way to mitigate BLOBs | 02:33 |
| ayoung | "Create a new table for each field of the LOB that you want to address individually: " | 02:33 |
| morganfainberg | ah | 02:33 |
| ayoung | feh. not having any of it. | 02:33 |
| morganfainberg | yeah | 02:33 |
| morganfainberg | we already have serialized blob | 02:33 |
| morganfainberg | *ick* | 02:33 |
| morganfainberg | EAV is closer to what we probably want. | 02:34 |
| morganfainberg | but still far from optimial | 02:34 |
| ayoung | morganfainberg, I think the short of it is that if some other service needs per user data, they are responsible for their own "user table" | 02:34 |
| ayoung | and we should excise everything from Keystone but what we are contractually required to support | 02:34 |
| morganfainberg | ayoung: this is related to your concept of DNSSEC lookup | 02:34 |
| ayoung | you mean for domain name? | 02:35 |
| morganfainberg | ayoung: and a way we can make extra definitions clear not "oh i shoved things into the table" | 02:35 |
| ayoung | or is that just how you got interested in it? | 02:35 |
| ayoung | if we do the DNSSEC thing, we do it right. Haven't thought through it deeply enough yet. | 02:35 |
| morganfainberg | ayoung: looking for a proper generic way to solve your need for that and to move away from extra data being just a "whatever else we stick in there" | 02:35 |
| ayoung | I thin that if we do DNSSEC on the domain level, it has to be a core part of the contract, and not just a "neat feature" type thing | 02:36 |
| morganfainberg | ayoung: a way to define a business-logic-use-case specific field w/o needing to be "top level" in the table | 02:36 |
| ayoung | It does mean that the information is public, and the might be the deal breaker | 02:36 |
| morganfainberg | ayoung: i disagree. not everyone wants that. it should use a formalized way of extending the schema in a sane way w/o alters | 02:36 |
| morganfainberg | ayoung: it also solves arvind's case and gives us a story for how extra attrs are validated vs. just "oops i added something else in here" | 02:37 |
| ayoung | I thought we were not doing extensions anymore? | 02:37 |
| ayoung | maybe...but that slide show doesn't give us anything new, just enumerates the pros-and-cons of what we've already evaluated | 02:37 |
| morganfainberg | ayoung: this isn't extension. this is how we make extra attrs a validated part of the entity w/o taking away the feature that a lot of people/deployers use | 02:37 |
| ayoung | mayyyyyybe. | 02:38 |
| morganfainberg | ayoung: this was just a slide deck i saw that highlighted a couple interesting takes | 02:38 |
| morganfainberg | ayoung: i ran across it somehow from looking into existing standards for federating all the things | 02:38 |
| morganfainberg | not just identity | 02:38 |
| ayoung | ++ | 02:38 |
| morganfainberg | i think we could EAV it tbh. | 02:39 |
| morganfainberg | but i am looking to see if we have more options - and i'm going to get back to federated-stuff-not-identity soon | 02:39 |
| morganfainberg | FSNI "fiz-ni"? | 02:40 |
| *** tobe has joined #openstack-keystone | 02:41 | |
| *** dimsum__ has quit IRC | 02:45 | |
| *** dimsum__ has joined #openstack-keystone | 02:46 | |
| morganfainberg | ayoung: so looking at this, inverted index plus maybe a requirement to define each attr (for jsonschema fun) might do what we're looking for re: making extra less sucky. | 02:50 |
| jamielennox | morganfainberg: i haven't read everything above but yuk - just kill extra | 02:51 |
| morganfainberg | jamielennox: we *cant*. | 02:51 |
| ayoung | morganfainberg, not something that keeps me up nights. I think extra is strange, but...one of the manyh things I inherited. Would not continue the pattern myself | 02:51 |
| *** dimsum__ has quit IRC | 02:51 | |
| morganfainberg | jamielennox: it's used. | 02:51 |
| jamielennox | morganfainberg: i know, but i'd prefer to put us on the path to removing it than to add extra stuff that will help it live longer | 02:51 |
| morganfainberg | ayoung: it bothers me a lot that we have essentially non-validated things going into the DB. | 02:52 |
| ayoung | morganfainberg, much more interested in solving the "auto provisioning and cleanup" issues that Tim Bell was concerned about | 02:52 |
| morganfainberg | ayoung: especially things that people use/want to lookup against. which leads to very very very icky "load everything and examine the blob" patterns | 02:52 |
| ayoung | morganfainberg, we sell chainsaws. We don't encourage people to juggle | 02:53 |
| morganfainberg | ayoung: mostly i am looking for a clean/easy way to ensure we don't end up with accidental things in the extra fields (it's happened before). maybe just the defined attr/value-type so we can reject requests that dont conform is enough. | 02:54 |
| morganfainberg | ayoung: anyway, time to keep looking at existing ways to federate other stuff. now. | 02:55 |
| * morganfainberg goes back to tyring to refine google-fu for odd rfcs. | 02:55 | |
| ayoung | morganfainberg, what if we said "extra in the user table etc is going away" and instead forced people to use a second table to actually model their data correctly. | 02:55 |
| morganfainberg | ayoung: that's moving towards EAV but it was some stuff that crossed my mind a while back. | 02:56 |
| morganfainberg | ayoung: something to mull over i guess. | 02:56 |
| ayoung | morganfainberg deal. Mull away. | 02:56 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Remove custom header handling https://review.openstack.org/180385 | 02:57 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Fetch user token from request rather than env https://review.openstack.org/174202 | 02:57 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Remove the _msg_format function https://review.openstack.org/174201 | 02:57 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Base use webob https://review.openstack.org/174200 | 02:57 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't rely on token_info for header building https://review.openstack.org/174199 | 02:57 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Move project included validation https://review.openstack.org/174198 | 02:57 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Depend on keystoneclient for expiration checking https://review.openstack.org/174197 | 02:57 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't store expire into memcache https://review.openstack.org/174196 | 02:57 |
| *** _cjones_ has quit IRC | 02:57 | |
| morganfainberg | ayoung: i think we need to re-think how we reference a given resource in openstack to achieve anything-federated | 03:00 |
| morganfainberg | ayoung: moving to a full link reference model is looking like the correct approach, not the uuid. | 03:00 |
| ayoung | morganfainberg, Heh...you just catching up to that now? | 03:01 |
| ayoung | with you 100% | 03:01 |
| morganfainberg | ayoung: no. re-asserting it based on previous conversations | 03:01 |
| * morganfainberg is formulating the argument to make in a x-project spec | 03:01 | |
| ayoung | morganfainberg, ok, next step beyond that...I know where the thing is...now how do I get a token for it? | 03:01 |
| morganfainberg | ayoung: can we make trusts an oauth-thing and use that as a x-cloud authorization? | 03:02 |
| ayoung | morganfainberg, so, yes, trusts and oauth get unified first off | 03:03 |
| morganfainberg | ayoung: yes. | 03:03 |
| morganfainberg | ayoung: if trusts *are* oauth | 03:03 |
| ayoung | and we go to a resource and get a "you need to give me this priv" response to get at it | 03:03 |
| morganfainberg | we could inter-deployment them | 03:03 |
| ayoung | yep | 03:03 |
| morganfainberg | and for the non-exposed cloud, we say "sorry you need to copy things" e.g. (my cloud is behind a firewall, and i can't get at the resource from the remote cloud) | 03:04 |
| ayoung | or redirect to a proxy | 03:05 |
| ayoung | but, yes | 03:05 |
| * morganfainberg is thinking how to model this in Keystone [since we still would need to house the oauth info, i don't want nova to try and hold onto it, and glance, etc] | 03:05 | |
| morganfainberg | or at least keystone<->barbican/something similar | 03:05 |
| ayoung | morganfainberg, we need to push to the remote services some of the oauth capabilities, but we might be able to do that behind ATM | 03:05 |
| ayoung | so long as we can query policy to get the answer | 03:06 |
| morganfainberg | ayoung: sure. I'm actually thinking we go a step further. ATM gets smart enough to handle the oauth directly for *specific* resources. | 03:06 |
| ayoung | it can be a fake policy call: We don't admit to having the object, but if we did ...here is what you would need to look at it | 03:06 |
| morganfainberg | let ATM round-trip to keystone behind the scenes to validate, but the Oauth is less RBAC and more resource-specific | 03:07 |
| morganfainberg | or do we need it to be RBAC tied? | 03:07 |
| morganfainberg | ayoung: and sure on the fake-y policy thing | 03:08 |
| ayoung | rbac is what defuines the response | 03:08 |
| ayoung | it is what tells the user what they need to request in the token to delegate | 03:08 |
| ayoung | "you need a token with Role R on project P" | 03:08 |
| morganfainberg | oh wait derp, resource + role, oauth is the combination authorization that ATM can validate with | 03:08 |
| ayoung | wiht P maybe being something that the user needs to figure out themselves as we dopn;'t admit to having the resource in the frist place | 03:09 |
| morganfainberg | aure | 03:09 |
| morganfainberg | sure* | 03:09 |
| ayoung | so...something esle to build on dynamic policy | 03:09 |
| ayoung | morganfainberg, on last thing before I turn in....on the autoprovisioning, we should state something like this: | 03:12 |
| ayoung | "Autoprovisioning is a multi project problemt, and will not be solved by keystone alone. INstad, the range of solutions should be covered by the big tent...." | 03:13 |
| *** notmyname has joined #openstack-keystone | 03:13 | |
| ayoung | I think the right answer is "Ceilometer listens to events and kicks off workflows, but does not define them | 03:13 |
| ayoung | Mistral defines workflows, but does not listen to events | 03:14 |
| morganfainberg | not sure if ceilometer is up for that as of yet | 03:14 |
| ayoung | the big tent approach is to use those two, although either can be replaced | 03:14 |
| morganfainberg | we should corner gordc and see what ceilo can do. | 03:14 |
| ayoung | morganfainberg see this: | 03:15 |
| morganfainberg | it may simply not be there. | 03:15 |
| morganfainberg | but it could be an excuse for it to get the ability to do so | 03:15 |
| ayoung | https://twitter.com/admiyoung/status/602531670793781250 | 03:15 |
| ayoung | Julians response.... | 03:16 |
| ayoung | and Yuriy's | 03:16 |
| ayoung | I suspect both projects would be better off if they agreed to work together on this, and clearly delineated responsibility | 03:17 |
| ayoung | mistral already has a scheduler for the cron type things | 03:17 |
| ayoung | and...bed. | 03:19 |
| *** ayoung is now known as ayoung_ZZZZzzzz_ | 03:19 | |
| *** darrenc is now known as darrenc_afk | 03:22 | |
| *** tobe has quit IRC | 03:34 | |
| *** tobe has joined #openstack-keystone | 03:47 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint filter into keystone core https://review.openstack.org/183377 | 03:58 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove old request method https://review.openstack.org/185492 | 04:00 |
| *** links has joined #openstack-keystone | 04:27 | |
| *** ncoghlan has joined #openstack-keystone | 04:38 | |
| *** darrenc_afk is now known as darrenc | 04:42 | |
| *** User17 has joined #openstack-keystone | 04:52 | |
| *** tobe has quit IRC | 04:56 | |
| *** lhcheng has joined #openstack-keystone | 05:01 | |
| *** ChanServ sets mode: +v lhcheng | 05:01 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint filter into keystone core https://review.openstack.org/183377 | 05:04 |
| *** tobe has joined #openstack-keystone | 05:13 | |
| *** rdo has quit IRC | 05:14 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove oslo serialization dependency https://review.openstack.org/185497 | 05:14 |
| *** rdo has joined #openstack-keystone | 05:15 | |
| *** blewis` has joined #openstack-keystone | 05:18 | |
| *** blewis has quit IRC | 05:21 | |
| *** kiran-r has joined #openstack-keystone | 05:26 | |
| *** kiran-r has quit IRC | 05:33 | |
| User17 | hi all,Installed glance from git source in ubuntu machine by following the steps in http://docs.openstack.org/developer/glance/installing.html. Edited two files glance-registry.conf and glance-api.conf to include keystone authentication and image path etc.. and I started the server. but when I try to sync the db using glance-manage db sync, It ended with an import error “ImportError: No module named wsme.rest” | 05:34 |
| *** kiran-r has joined #openstack-keystone | 05:35 | |
| User17 | pls guide | 05:35 |
| *** dimsum__ has joined #openstack-keystone | 05:36 | |
| *** mabrams has joined #openstack-keystone | 05:37 | |
| *** lhcheng has quit IRC | 05:41 | |
| *** dimsum__ has quit IRC | 05:41 | |
| *** krykowski has joined #openstack-keystone | 05:43 | |
| *** lhcheng has joined #openstack-keystone | 05:45 | |
| *** ChanServ sets mode: +v lhcheng | 05:45 | |
| *** lhcheng has quit IRC | 05:46 | |
| *** e0ne has joined #openstack-keystone | 05:46 | |
| *** lhcheng has joined #openstack-keystone | 05:46 | |
| *** ChanServ sets mode: +v lhcheng | 05:46 | |
| *** kiran-r has quit IRC | 05:53 | |
| *** e0ne has quit IRC | 05:53 | |
| *** tobe has quit IRC | 06:04 | |
| *** lhcheng has quit IRC | 06:07 | |
| *** mflobo has joined #openstack-keystone | 06:10 | |
| *** rdo has quit IRC | 06:19 | |
| *** rdo has joined #openstack-keystone | 06:21 | |
| *** tobe has joined #openstack-keystone | 06:23 | |
| *** ncoghlan has quit IRC | 06:28 | |
| *** chlong has quit IRC | 06:30 | |
| *** jaosorior has joined #openstack-keystone | 06:33 | |
| openstackgerrit | liusheng proposed openstack/keystone: Remove the deprecated ec2 token middleware https://review.openstack.org/185509 | 06:45 |
| *** kiran-r has joined #openstack-keystone | 06:50 | |
| jamielennox | User17: this is the keystone channel, try #openstack-glance for glance problems | 06:54 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add get_communication_params interface to plugins https://review.openstack.org/141267 | 07:05 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Fix auth required message translation https://review.openstack.org/185513 | 07:05 |
| *** lufix has joined #openstack-keystone | 07:14 | |
| *** krykowski has quit IRC | 07:25 | |
| *** jistr has joined #openstack-keystone | 07:39 | |
| *** e0ne has joined #openstack-keystone | 07:39 | |
| *** e0ne is now known as e0ne_ | 07:40 | |
| *** belmoreira has joined #openstack-keystone | 07:49 | |
| *** e0ne_ is now known as e0ne | 07:49 | |
| *** pnavarro has joined #openstack-keystone | 07:55 | |
| *** tobe has quit IRC | 08:10 | |
| *** bdossant has joined #openstack-keystone | 08:15 | |
| *** davechen has joined #openstack-keystone | 08:27 | |
| *** davechen1 has joined #openstack-keystone | 08:30 | |
| *** davechen has quit IRC | 08:33 | |
| *** davechen has joined #openstack-keystone | 08:35 | |
| *** fhubik has joined #openstack-keystone | 08:35 | |
| *** davechen1 has quit IRC | 08:36 | |
| *** kiran-r has quit IRC | 08:39 | |
| *** kiran-r has joined #openstack-keystone | 08:39 | |
| *** davechen has left #openstack-keystone | 08:39 | |
| *** davechen has joined #openstack-keystone | 08:40 | |
| *** e0ne is now known as e0ne_ | 08:42 | |
| *** e0ne_ is now known as e0ne | 08:43 | |
| *** turul has joined #openstack-keystone | 08:56 | |
| *** turul is now known as afazekas | 08:56 | |
| *** aix has joined #openstack-keystone | 09:08 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove the deprecated external authentication methods https://review.openstack.org/185541 | 09:12 |
| *** fhubik is now known as fhubik_afk | 09:17 | |
| *** fhubik_afk is now known as fhubik | 09:17 | |
| *** rdo has quit IRC | 09:20 | |
| *** rdo has joined #openstack-keystone | 09:22 | |
| *** fhubik is now known as fhubik_afk | 09:49 | |
| *** davechen has left #openstack-keystone | 09:51 | |
| *** e0ne is now known as e0ne_ | 10:08 | |
| User17 | how to install the dependency packages for keystone is in requiremnt.txt | 10:13 |
| *** fhubik_afk is now known as fhubik | 10:16 | |
| *** e0ne_ has quit IRC | 10:19 | |
| *** afazekas_ has joined #openstack-keystone | 10:21 | |
| *** e0ne has joined #openstack-keystone | 10:28 | |
| *** samueldmq has joined #openstack-keystone | 10:35 | |
| samueldmq | morning | 10:35 |
| *** e0ne is now known as e0ne_ | 10:39 | |
| *** marzif has joined #openstack-keystone | 10:39 | |
| *** e0ne_ has quit IRC | 10:49 | |
| *** boris-42 has joined #openstack-keystone | 10:49 | |
| *** henrynash has joined #openstack-keystone | 11:00 | |
| *** ChanServ sets mode: +v henrynash | 11:00 | |
| samueldmq | henrynash, hey o/ | 11:04 |
| *** lufix has quit IRC | 11:04 | |
| samueldmq | henrynash, missed you at the summit :) | 11:05 |
| *** lufix has joined #openstack-keystone | 11:10 | |
| *** aix has quit IRC | 11:14 | |
| *** kiranr has joined #openstack-keystone | 11:15 | |
| henrynash | samueldmq: hi…I missed you all as well! | 11:15 |
| *** aix has joined #openstack-keystone | 11:15 | |
| *** kiran-r has quit IRC | 11:16 | |
| *** kiranr is now known as kiran-r | 11:19 | |
| samueldmq | henrynash, I hope you everything has gone well with you moving home last week | 11:24 |
| samueldmq | henrynash, and now I am happy because we have a lot of interesting things to work for L :) | 11:24 |
| henrynash | samueldmq: yes, now in new pad….have the essentials (light, heat, wifi) | 11:24 |
| samueldmq | henrynash, great | 11:24 |
| henrynash | samueldmq: yes, L should be good! | 11:25 |
| samueldmq | henrynash, btw .. what is that repo where common code live before the graduation process ? | 11:26 |
| henrynash | samueldmq: teh backlog specs? | 11:28 |
| samueldmq | henrynash, no .. for example, oslo.policy code was in such repo before being oslo.policy | 11:29 |
| henrynash | oh, you mena teh incubator? | 11:29 |
| samueldmq | henrynash, yeah | 11:29 |
| henrynash | actually, I’m not sure if it was a single repo for incuabtion….or they just were in random places | 11:30 |
| samueldmq | henrynash, yeah I think oslo-incubator is the place I am looking for | 11:32 |
| samueldmq | henrynash, that has the code synchronized with https://github.com/openstack/keystone/tree/master/keystone/openstack/common | 11:32 |
| samueldmq | henrynash, thanks :) | 11:32 |
| samueldmq | henrynash, I still feel very young in the openstack ecosystem :/ | 11:32 |
| *** jistr is now known as jistr|class | 11:33 | |
| samueldmq | I am working now on having oslo.policy adopted on other services | 11:42 |
| samueldmq | does anyone know if this requires a cross-project spec ? for adoption ? | 11:43 |
| *** ctina__ has joined #openstack-keystone | 11:43 | |
| *** fhubik is now known as fhubik_afk | 11:44 | |
| *** e0ne has joined #openstack-keystone | 12:00 | |
| *** henrynash has quit IRC | 12:07 | |
| *** dguerri is now known as dguerri`away | 12:10 | |
| zigo | morganfainberg: Could you review this? https://review.openstack.org/#/c/185187/3 | 12:11 |
| zigo | It's a bit annoying for me at the distribution level, I'd love to get this out of the way.... :) | 12:11 |
| *** ekarlso has quit IRC | 12:16 | |
| *** ekarlso has joined #openstack-keystone | 12:16 | |
| *** fhubik_afk is now known as fhubik | 12:17 | |
| *** gordc has joined #openstack-keystone | 12:31 | |
| *** htruta has joined #openstack-keystone | 12:31 | |
| *** henrynash has joined #openstack-keystone | 12:43 | |
| *** ChanServ sets mode: +v henrynash | 12:43 | |
| *** blewis` has quit IRC | 12:46 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 12:48 | |
| *** dimsum__ has joined #openstack-keystone | 12:49 | |
| *** bknudson has joined #openstack-keystone | 12:49 | |
| *** ChanServ sets mode: +v bknudson | 12:49 | |
| *** dguerri`away is now known as dguerri | 12:50 | |
| *** dimsum__ is now known as dims | 12:56 | |
| *** jistr|class is now known as jistr | 13:00 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 13:02 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:02 | |
| *** e0ne is now known as e0ne_ | 13:10 | |
| *** rushiagr_away is now known as rushiagr | 13:13 | |
| *** stevemar has joined #openstack-keystone | 13:14 | |
| *** ChanServ sets mode: +v stevemar | 13:14 | |
| *** e0ne_ has quit IRC | 13:21 | |
| *** mabrams1 has joined #openstack-keystone | 13:23 | |
| *** e0ne has joined #openstack-keystone | 13:26 | |
| *** links has quit IRC | 13:29 | |
| *** Ephur has joined #openstack-keystone | 13:35 | |
| *** blewis has joined #openstack-keystone | 13:39 | |
| *** Ephur has quit IRC | 13:40 | |
| *** dims has quit IRC | 13:45 | |
| *** kiran-r has quit IRC | 13:49 | |
| *** blewis has quit IRC | 13:50 | |
| *** ayoung has joined #openstack-keystone | 13:52 | |
| *** ChanServ sets mode: +v ayoung | 13:52 | |
| *** blewis has joined #openstack-keystone | 13:53 | |
| *** zzzeek has joined #openstack-keystone | 13:55 | |
| *** edmondsw has joined #openstack-keystone | 13:55 | |
| *** blewis` has joined #openstack-keystone | 13:57 | |
| *** blewis has quit IRC | 13:58 | |
| *** radez_g0n3 is now known as radez | 14:01 | |
| *** bdossant_ has joined #openstack-keystone | 14:01 | |
| *** ayoung has quit IRC | 14:02 | |
| *** bdossant has quit IRC | 14:04 | |
| *** bdossant_ has quit IRC | 14:08 | |
| *** mattfarina has joined #openstack-keystone | 14:10 | |
| *** bdossant has joined #openstack-keystone | 14:15 | |
| *** gokrokve has joined #openstack-keystone | 14:15 | |
| *** bdossant has quit IRC | 14:15 | |
| *** bdossant has joined #openstack-keystone | 14:16 | |
| *** ayoung has joined #openstack-keystone | 14:18 | |
| *** ChanServ sets mode: +v ayoung | 14:18 | |
| *** rushiagr is now known as rushiagr_away | 14:19 | |
| *** bdossant_ has joined #openstack-keystone | 14:22 | |
| *** bdossant_ has quit IRC | 14:22 | |
| *** bdossant_ has joined #openstack-keystone | 14:22 | |
| *** bdossant has quit IRC | 14:23 | |
| *** Bjoern__ has joined #openstack-keystone | 14:24 | |
| *** timcline has joined #openstack-keystone | 14:26 | |
| *** dims has joined #openstack-keystone | 14:35 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes deprecated revoke KVS backend https://review.openstack.org/185627 | 14:40 |
| *** emagana has joined #openstack-keystone | 14:41 | |
| *** e0ne is now known as e0ne_ | 14:41 | |
| *** e0ne_ has quit IRC | 14:41 | |
| *** dguerri is now known as dguerri`away | 14:44 | |
| stevemar | ayoung, this is what i learned from the policy talk: you hate bug 968696 | 14:45 |
| openstack | bug 968696 in Keystone ""admin"-ness not properly scoped" [High,Confirmed] https://launchpad.net/bugs/968696 - Assigned to Adam Young (ayoung) | 14:45 |
| *** Ephur has joined #openstack-keystone | 14:49 | |
| dstanek | i now dream of 968696, 968696, 968696 ... | 14:52 |
| *** bdossant has joined #openstack-keystone | 14:52 | |
| *** bdossant_ has quit IRC | 14:56 | |
| *** e0ne has joined #openstack-keystone | 14:58 | |
| *** mabrams has quit IRC | 15:00 | |
| *** ayoung has quit IRC | 15:01 | |
| *** hemnafk is now known as hemna | 15:01 | |
| *** ayoung has joined #openstack-keystone | 15:08 | |
| *** ChanServ sets mode: +v ayoung | 15:08 | |
| *** kiran-r has joined #openstack-keystone | 15:09 | |
| *** mattfarina has quit IRC | 15:13 | |
| *** fhubik is now known as fhubik_afk | 15:14 | |
| *** alejandrito has joined #openstack-keystone | 15:14 | |
| *** mabrams1 has quit IRC | 15:28 | |
| *** lhcheng has joined #openstack-keystone | 15:32 | |
| *** ChanServ sets mode: +v lhcheng | 15:32 | |
| *** mattfarina has joined #openstack-keystone | 15:33 | |
| *** markvoelker has joined #openstack-keystone | 15:34 | |
| *** henrynash has quit IRC | 15:35 | |
| *** mattfarina has quit IRC | 15:36 | |
| *** mattfarina has joined #openstack-keystone | 15:37 | |
| *** lhcheng has quit IRC | 15:37 | |
| *** fhubik_afk is now known as fhubik | 15:38 | |
| *** jistr has quit IRC | 15:40 | |
| *** gyee has joined #openstack-keystone | 15:42 | |
| *** ChanServ sets mode: +v gyee | 15:42 | |
| *** e0ne is now known as e0ne_ | 15:43 | |
| *** kiran-r has quit IRC | 15:44 | |
| *** kiranr has joined #openstack-keystone | 15:44 | |
| *** kiranr is now known as kiran-r | 15:45 | |
| *** nkinder has joined #openstack-keystone | 15:46 | |
| *** e0ne_ is now known as e0ne | 15:46 | |
| *** winggundamth has joined #openstack-keystone | 15:48 | |
| *** henrynash has joined #openstack-keystone | 15:49 | |
| *** ChanServ sets mode: +v henrynash | 15:49 | |
| winggundamth | hi all. I having problem with keystone authen with s3. I did as here http://docs.openstack.org/kilo/config-reference/content/configuring-openstack-object-storage-with-s3_api.html | 15:49 |
| winggundamth | after I created access and secret and try to list with s3cmd. it shown 403 forbidden error. When I check the log on keystone. it shows "could not find token" every time | 15:50 |
| winggundamth | I'm not sure that I have to config anything on keystone? I think those doc refer to swauth but not keystoneauth | 15:51 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Enable retrieval of default values of domain config options https://review.openstack.org/185650 | 15:51 |
| *** afazekas_ has quit IRC | 15:54 | |
| *** iamjarvo has joined #openstack-keystone | 15:58 | |
| bknudson | henrynash: missed you at the summit | 15:58 |
| *** belmoreira has quit IRC | 15:59 | |
| henrynash | bknudson: ths….yep, really missed being there…. | 15:59 |
| *** g2` has quit IRC | 15:59 | |
| *** rwsu has joined #openstack-keystone | 16:02 | |
| *** Bjoern__ is now known as BjoernT | 16:02 | |
| *** e0ne is now known as e0ne_ | 16:04 | |
| *** fhubik has quit IRC | 16:04 | |
| *** e0ne_ is now known as e0ne | 16:06 | |
| *** henrynash has quit IRC | 16:07 | |
| *** g2` has joined #openstack-keystone | 16:08 | |
| *** henrynash has joined #openstack-keystone | 16:08 | |
| *** ChanServ sets mode: +v henrynash | 16:08 | |
| *** ctina__ has quit IRC | 16:12 | |
| dstanek | winggundamth: did you get your issue figured out? | 16:19 |
| winggundamth | not yet | 16:20 |
| stevemar | henrynash, the whole summit is online on youtube and twitter anyway :P | 16:21 |
| *** ayoung has quit IRC | 16:22 | |
| dstanek | winggundamth: i've never done what you are trying to do. are you using the s3_token middleware? | 16:22 |
| *** lhcheng has joined #openstack-keystone | 16:22 | |
| *** ChanServ sets mode: +v lhcheng | 16:22 | |
| winggundamth | dstanek: yes | 16:23 |
| winggundamth | I installed it with apt-get install swift-plugin-s3 because swift-python-s3 not found | 16:23 |
| dstanek | winggundamth: no, i mean the keystone middleware? | 16:25 |
| winggundamth | dstanek: I'm not sure what do you mean | 16:25 |
| *** _cjones_ has joined #openstack-keystone | 16:26 | |
| *** bdossant has quit IRC | 16:27 | |
| lbragstad | hey all, quick question on the summit. Not sure if I missed this session or if it was rolled into a different time, but did we want to discuss the state of the upstream database migrations and the possibility of moving to something like what Nova is doing (http://specs.openstack.org/openstack/nova-specs/specs/kilo/approved/online-schema-changes.html) ? | 16:27 |
| winggundamth | dstanek: I didn't config anything on keystone that related to s3. | 16:28 |
| *** miguelgrinberg has joined #openstack-keystone | 16:28 | |
| *** _cjones_ has quit IRC | 16:28 | |
| *** _cjones_ has joined #openstack-keystone | 16:29 | |
| *** henrynash has quit IRC | 16:29 | |
| dstanek | winggundamth: i can't find any docs right now using Google, but i think there is middleware needed for this to work in keystone. also did you setup the credentials you are using in keystone? | 16:30 |
| winggundamth | dstanek: yes. swift command working fine with it | 16:31 |
| *** henrynash has joined #openstack-keystone | 16:31 | |
| *** ChanServ sets mode: +v henrynash | 16:31 | |
| gyee | winggundamth, when using s3, make sure you have delay_auth_decision set to False for auth_token middleware | 16:33 |
| winggundamth | let me check it | 16:33 |
| dstanek | gyee: this is also needed http://docs.openstack.org/developer/keystonemiddleware/api/keystonemiddleware.html#module-keystonemiddleware.s3_token right? | 16:34 |
| gyee | yes | 16:34 |
| *** ayoung has joined #openstack-keystone | 16:35 | |
| *** ChanServ sets mode: +v ayoung | 16:35 | |
| morganfainberg | lbragstad: it is on the radar, but not really slated for a specific release. | 16:35 |
| morganfainberg | lbragstad: I think the stable interfaces would be a better move (personally) before we try and move to versioned objects. | 16:36 |
| lbragstad | morganfainberg: do you think that it something we can hash out in a meeting? | 16:36 |
| morganfainberg | Sure. But it is not a small task to do fwiw. | 16:36 |
| morganfainberg | Just keep that in mind. | 16:37 |
| lbragstad | morganfainberg: yeah, that's kinda why I wanted to visit about it | 16:37 |
| morganfainberg | I think it took nova at least 2 full cycles to do it. | 16:37 |
| lbragstad | ok | 16:37 |
| morganfainberg | And my concern is it will cause an entire cycle of rebase hell. Also we have to support ldap | 16:38 |
| lbragstad | morganfainberg: but this would just be for the sql upgrade schemas | 16:38 |
| morganfainberg | lbragstad: we want to have the same object coming out of all backends, right? | 16:38 |
| morganfainberg | lbragstad: object-type. It doesn't work if sql gives us thing x And ldap something totally different. So we'd be translating anyway. | 16:40 |
| lbragstad | morganfainberg: I was in a discussion with dstanek about this before the summit and the idea driving it was that it would be nice to make our sql migrations easier for operators to run without incurring downtime. | 16:40 |
| *** alanf-mc has joined #openstack-keystone | 16:41 | |
| morganfainberg | lbragstad: zero downtime upgrades are a nice idea. I am worried it will be awful to do until we have some other debt cleaned up. | 16:42 |
| morganfainberg | lbragstad: merging the extension migrations into the main repo, etc | 16:43 |
| lbragstad | morganfainberg: ok | 16:43 |
| morganfainberg | And I'd like to see stable driver interfaces so we can version the interface and have a clear expected object - not "welp, now you need to pass another object type back" | 16:43 |
| morganfainberg | But that second part is personal view. | 16:44 |
| lbragstad | makes sense | 16:44 |
| *** e0ne has quit IRC | 16:45 | |
| samueldmq | what's the advantage of versioned objects ? do you have any link to resources (I saw you said nova uses that) | 16:46 |
| samueldmq | morganfainberg, lbragstad ^ | 16:46 |
| morganfainberg | I'm not opposed to it. I just want to make sure we are careful to not make zero downtime schema upgrades consume all time instead of smoothing up the ux on very important things deployers are using. | 16:46 |
| dstanek | morganfainberg: versioned objects sound heavy handed | 16:50 |
| *** henrynash has quit IRC | 16:52 | |
| samueldmq | ayoung, ping - do we need a cross-project spec (should be a really simple one) to make services adopt oslo.policy ? | 16:53 |
| *** gokrokve has quit IRC | 16:53 | |
| samueldmq | morganfainberg, cc ^ | 16:54 |
| dstanek | samueldmq: are some projects not using it? | 16:54 |
| morganfainberg | dstanek: most are not using the library. | 16:54 |
| samueldmq | dstanek, afaik only keystone was using it (just discovered today glance is) | 16:55 |
| samueldmq | morganfainberg, yes | 16:55 |
| dstanek | so they're all still using the old incubated module? ouch | 16:56 |
| ayoung | samueldmq, not sure...we can probably just execute, but a spec might be worthwhile. Or just a bug. | 16:56 |
| samueldmq | dstanek, yeah | 16:56 |
| ayoung | I think a bug and indicate which project it effects is the right level, as it will be a means to deploy a fix is a serious issuer comes up. | 16:57 |
| ayoung | issue | 16:57 |
| samueldmq | ayoung, conceptually it would not be a bug, but something nice to have, then a blueprint .. but I think a bug fits well with our lp workflows .. | 16:58 |
| samueldmq | ayoung, does anyone want to express an opinion on this ? ^ | 16:59 |
| samueldmq | morganfainberg, dstanek cc ^ | 16:59 |
| dstanek | samueldmq: i think a bug is probably fine - i wouldn't ask for a spec/bp it this was a request of keystone | 17:00 |
| morganfainberg | dstanek: ++ | 17:02 |
| samueldmq | dstanek, morganfainberg nice .. thanks | 17:02 |
| morganfainberg | dstanek: Oslo.policy didn't land for g-r in kilo iirc. | 17:02 |
| morganfainberg | stevemar: slide deck. | 17:04 |
| morganfainberg | stevemar: let me | 17:04 |
| *** kiran-r has quit IRC | 17:04 | |
| morganfainberg | Know when you have time. | 17:04 |
| *** arunkant has joined #openstack-keystone | 17:06 | |
| *** harlowja has joined #openstack-keystone | 17:07 | |
| *** blewis` has quit IRC | 17:08 | |
| stevemar | morganfainberg, any time, we have the same conflict at 2pm :P | 17:08 |
| stevemar | (keystone meeting) | 17:08 |
| *** blewis has joined #openstack-keystone | 17:08 | |
| dstanek | stevemar: cancelled! | 17:08 |
| stevemar | dstanek, oh yay | 17:09 |
| stevemar | morganfainberg, any time then | 17:10 |
| *** blewis has quit IRC | 17:13 | |
| *** browne has joined #openstack-keystone | 17:15 | |
| *** arunkant has quit IRC | 17:15 | |
| *** arunkant has joined #openstack-keystone | 17:18 | |
| *** jsavak has joined #openstack-keystone | 17:19 | |
| samueldmq | ayoung, bug #1458945 | 17:23 |
| openstack | bug 1458945 in OpenStack Compute (nova) "Use graduated oslo.policy instead of oslo-incubator code" [Undecided,New] https://launchpad.net/bugs/1458945 | 17:23 |
| samueldmq | ayoung, nova, heat, cinder and neutron (since glance is already using it) | 17:23 |
| ayoung | samueldmq, good. Swift? | 17:24 |
| ayoung | I think they can use policy, so if they are doing anything, it should be the library version, too | 17:24 |
| samueldmq | ayoung, I think swift is the one that does not even use rbac | 17:24 |
| *** arunkant is now known as arunkant_ | 17:25 | |
| ayoung | samueldmq, look into the *aaS ones as well. Don't feel the need to drive on with all of them yourself, but get them tagged on the bug. Let the projects remove if it is not relevant.... | 17:25 |
| david8hu | ya, last i checked swift was not using policy. | 17:25 |
| *** ctina__ has joined #openstack-keystone | 17:25 | |
| samueldmq | david8hu, ++ | 17:25 |
| *** arunkant_ is now known as arunkant | 17:26 | |
| ayoung | included them on the bug anyway | 17:26 |
| samueldmq | ayoung, hmm, yeah makes sense .. I had assigned myself to the keystone one (I removed it later ... since keystone already supports it) | 17:26 |
| samueldmq | ayoung, so all of them are now as assigned .. ok I will include swift as well | 17:26 |
| samueldmq | ayoung, and the others **aaS, sir | 17:27 |
| *** arunkant has quit IRC | 17:27 | |
| ayoung | rock on, compatriota | 17:29 |
| *** arunkant has joined #openstack-keystone | 17:29 | |
| *** arunkant has quit IRC | 17:29 | |
| *** arunkant has joined #openstack-keystone | 17:29 | |
| samueldmq | ayoung, o/ | 17:30 |
| ayoung | samueldmq, aside from that, which specs are you planning on attacking? | 17:30 |
| samueldmq | ayoung, ceilometer is weird ... they have a policy.json, but do not include the policy.py from oslo-incubator | 17:30 |
| *** winggundamth has quit IRC | 17:30 | |
| *** spandhe has joined #openstack-keystone | 17:30 | |
| ayoung | samueldmq, tag them on the bug anyway | 17:30 |
| samueldmq | ayoung, I am not sure yet, do you need me on anything specific ? | 17:31 |
| ayoung | we'll get it straightened out | 17:31 |
| samueldmq | ayoung, ++ | 17:31 |
| ayoung | samueldmq, the tasks are designed to be incrementatl, so the earlier in the task list the better | 17:31 |
| ayoung | let's see... | 17:31 |
| ayoung | you were updating the global spec....let me make sure I have that tracked | 17:31 |
| stevemar | morganfainberg, please tell me i have 8 days to make a slide deck and not 1 | 17:32 |
| samueldmq | ayoung, yeah I am .. we have a review from david tough .. I need to update that I think | 17:32 |
| ayoung | samueldmq, but I assume you want to write code, too | 17:32 |
| ayoung | since you are on the oslo side, do you want to work on "fetch policy from keystone?" | 17:33 |
| ayoung | We need to front load the API changes. | 17:33 |
| morganfainberg | stevemar: hehe 1 for a draft. And no meeting today. | 17:33 |
| morganfainberg | This is why I was pinging you. | 17:33 |
| morganfainberg | 28th should be fine for the draft btw. So 2 days. | 17:34 |
| stevemar | morganfainberg, umm, do you have *anything* i can re-use? partially or otherwise | 17:34 |
| morganfainberg | stevemar: let me setup at the coffee shop and we can start. I have some material. | 17:34 |
| stevemar | morganfainberg, alright | 17:35 |
| samueldmq | ayoung, yeah I do want to write code as well .. I will be discussing with my manager today and I ping you later about "fetch policy from keystone?" | 17:35 |
| stevemar | i will be busy with submitting travel requests | 17:35 |
| ayoung | samueldmq, so the API changes we need are for hierarchical roles and for default policy (I think) | 17:35 |
| morganfainberg | stevemar: I did a chunk of that last night. | 17:35 |
| samueldmq | ayoung, but ... what can we do by now in that front ? make the keystone policy api more granular ? implement support on ksclient ? | 17:35 |
| ayoung | although Default is not an API change, just a server side change | 17:35 |
| samueldmq | ayoung, yeah .. I agree let's have hierarchical roles/domain-roles agreed with henrynash and then get it done | 17:36 |
| samueldmq | and others as well ... :) | 17:36 |
| *** lhcheng_ has joined #openstack-keystone | 17:37 | |
| ayoung | samueldmq, wh6y don't you take the fetch? That needs to be done before anything else can work, aside from the "single poicy file" | 17:38 |
| ayoung | the thing about the fetch is it needs to be a plugin. | 17:38 |
| ayoung | and it needs to be enabled/disabled from the conf file that auth_token middleware reads] | 17:38 |
| ayoung | hmmm...let me take that one, and you can review | 17:38 |
| samueldmq | ayoung, what's the fetch ? is it the implementation on ksmiddleware (using ksclinet ) ? | 17:39 |
| ayoung | you also started on unified policy... | 17:39 |
| ayoung | gah...too much | 17:39 |
| *** lhcheng has quit IRC | 17:39 | |
| samueldmq | ayoung, to fetch and then cache it ? | 17:39 |
| ayoung | samueldmq, sort of... | 17:39 |
| ayoung | samueldmq, here is how it needs to work, as best I can tell | 17:39 |
| samueldmq | ayoung, yeah .. I need to have a very clear vision on it | 17:40 |
| ayoung | we need to leave the default as it is now: read from a flat file | 17:40 |
| samueldmq | ayoung, please go ahead .. I am listening | 17:40 |
| ayoung | if, however, the auth_token middelware gets a value from the conf file, we swap the "fetcher" to code that calls into keystoneclient to fetch the policy file and stick it into a file in the filesystem | 17:40 |
| ayoung | this shouild (for now) looks like the file used for storing the certificates for PKI tokens | 17:41 |
| ayoung | so we need a way to define a class that oslo loads to fetch the file. I think this is a stevedore entry point | 17:41 |
| ayoung | we don't want a hard depednecy from oslo.policy to keystoneclient | 17:42 |
| *** HenryG has quit IRC | 17:42 | |
| ayoung | we do entrypoint type stuff in the keystoneclient to load the auth plugins. So the config file should say "policy fetcher entrypoint" | 17:42 |
| samueldmq | ayoung, k, so the first step is to have ksmiddleware updating the file that will be read and used for enforcement at the service level (still there) | 17:43 |
| ayoung | and the default would be "static-fetcher" or something | 17:43 |
| ayoung | samueldmq, I think the "directory" but yes | 17:43 |
| samueldmq | ayoung, great, I still need to get familiar to ksmiddleware code to make such change, but ok, I got it | 17:44 |
| ayoung | samueldmq, I would start with a proof of concept that dynamically loads an entrypoint from code in keystonemiddleware (the fetcher) into oslo policy | 17:44 |
| samueldmq | ayoung, that would be great | 17:44 |
| ayoung | don't actually try to fetch anything, just make sure you can swap it out via config file options | 17:45 |
| samueldmq | ayoung, meanwhile, I will start making services use the oslo.policy | 17:45 |
| ayoung | let me see if I can point you at an example | 17:45 |
| samueldmq | ayoung, and keep updating the overview spec | 17:45 |
| *** HenryG has joined #openstack-keystone | 17:46 | |
| ayoung | samueldmq, I think the overview spec would be less confusing if you indicate on each of the paragraphs whcih of the subordinate specs are referenced. "see below spec for default policy" | 17:46 |
| *** blewis has joined #openstack-keystone | 17:46 | |
| ayoung | so we don't have more people like David coming in and getting confused by the "overview" aspect of this spec | 17:47 |
| ayoung | I'm less concerned with getting the overview approved than the individual specs themselves, though | 17:47 |
| ayoung | samueldmq, in this spec, I showed how to load drivers from stevedore: https://review.openstack.org/#/c/115463/7/openstack_auth/utils.py,cm | 17:48 |
| ayoung | so we would need a good namespace\ | 17:48 |
| ayoung | something like oslo.policy.fetcher | 17:49 |
| ayoung | and then the config option would give the last link in the chain: | 17:49 |
| samueldmq | ayoung, hmm.. looking | 17:49 |
| samueldmq | ayoung, regarding the spec, I agree, I will change that as well | 17:49 |
| ayoung | fetcher = fetcher_manager.driver(CONF.policy_fetcher) | 17:50 |
| morganfainberg | stevemar: ok at the coffee shop | 17:50 |
| morganfainberg | stevemar: going to spin up a google docs slide deck | 17:50 |
| ayoung | and I don't love the weord fetcher, I am just using it too much | 17:50 |
| ayoung | morganfainberg, LATEX! | 17:50 |
| morganfainberg | stevemar: unless you already have one | 17:50 |
| morganfainberg | ayoung: terrible for collaboration | 17:50 |
| ayoung | :) | 17:50 |
| ayoung | github! | 17:50 |
| morganfainberg | ayoung: also not really good for collaboration | 17:50 |
| ayoung | Gerrit! | 17:50 |
| ayoung | morganfainberg, what are you presenting on? | 17:51 |
| ayoung | morganfainberg, I'll lurk at 2PM and tell people there is no Keystone meeting this week | 17:51 |
| *** cloudm2 has joined #openstack-keystone | 17:52 | |
| stevemar | morganfainberg, i don't have anything setup yet on gdocs | 17:52 |
| morganfainberg | ayoung: http://paste.openstack.org/show/238226/ | 17:54 |
| ayoung | morganfainberg, talk to nkinder , as he has a slew of slides for just that | 17:55 |
| *** BjoernT has left #openstack-keystone | 17:57 | |
| morganfainberg | stevemar: empty gdoc created | 17:57 |
| morganfainberg | and shared. | 17:57 |
| stevemar | \o/ | 17:58 |
| samueldmq | ayoung, bug #1458945 | 18:00 |
| openstack | bug 1458945 in Trove "Use graduated oslo.policy instead of oslo-incubator code" [Undecided,New] https://launchpad.net/bugs/1458945 | 18:00 |
| lhcheng_ | ayoung: can you add me to trello for dynamic-policy: os.lcheng@gmail.com | 18:00 |
| samueldmq | ayoung, I added almost every *aaS, except for tripleo I guess, and oslo, documentation, etc | 18:00 |
| ayoung | morganfainberg, stevemar please amke sure you mention that Kerberos/SSSD also works with Federation and WebSSO | 18:00 |
| ayoung | samueldmq, sounds good | 18:00 |
| ayoung | lhcheng_, doing so now... | 18:01 |
| samueldmq | ayoung, there are some projects that are not affected by that bug | 18:01 |
| *** HenryG has quit IRC | 18:01 | |
| samueldmq | ayoung, let people come and say hey, this does not affect me | 18:01 |
| stevemar | ayoung, mention it where? | 18:01 |
| samueldmq | ayoung, so we can keep track of everything | 18:01 |
| ayoung | stevemar, when you talk about the various forms of Federation\ | 18:01 |
| *** HenryG has joined #openstack-keystone | 18:01 | |
| stevemar | ayoung, mokay dokay | 18:02 |
| *** jaosorior has quit IRC | 18:02 | |
| ayoung | stevemar, I assume you will have a slide that talks about Federation, and pulling in remote IdPs. I would add a line like: | 18:02 |
| ayoung | Federation can be used to integrate Keystone with existing Kerberos deployments backed with LDAP via SSSD | 18:03 |
| stevemar | for the cloud identity summit? | 18:03 |
| ayoung | yes | 18:03 |
| ayoung | stevemar, and X509 | 18:03 |
| stevemar | ayoung, ah okay | 18:03 |
| ayoung | jkust make sure they understand that SAML is not the only thing we addressed, just the one getting the most press | 18:04 |
| stevemar | i am literally at creating a title page, and have no idea what i will talk about :P | 18:04 |
| stevemar | gotcha | 18:04 |
| ayoung | better than propgating the lie that I had the slightest clue about what I was doing when I did the LDAP support | 18:04 |
| *** harlowja_ has joined #openstack-keystone | 18:06 | |
| *** harlowja has quit IRC | 18:06 | |
| david8hu | ayoung, samueldmq, for the dyanamic policy overview spec, a paragraph that summarize what it is trying to achieve would be helpful for reviewers. Something that ties everything together. | 18:07 |
| ayoung | david8hu, yeah. I thought I had that, but it seems to have been lost in the rewrites...let me see what I put on the blog... | 18:08 |
| *** dguerri`away is now known as dguerri | 18:08 | |
| ayoung | 968696 | 18:08 |
| david8hu | ayoung, ATM card password? | 18:09 |
| ayoung | My luggage | 18:09 |
| *** alanf-mc has quit IRC | 18:09 | |
| ayoung | david8hu, "Establish an iterative process solve the long-standing bug that a user with admin on any scope has admin on all scoped." | 18:09 |
| ayoung | OK, that is part of it...let's see if I can do better | 18:10 |
| david8hu | ayoung, By having unified policy or db backend for policy does not solve that :) | 18:11 |
| lhcheng_ | ayoung: got the invite, thanks! | 18:11 |
| david8hu | ayoung, a better default policy will do. | 18:11 |
| ayoung | david8hu, both are necessary steps, but not sufficient | 18:11 |
| david8hu | ayoung, I agreed. | 18:11 |
| *** blewis has quit IRC | 18:11 | |
| *** alanf-mc has joined #openstack-keystone | 18:12 | |
| ayoung | OPK...so, yeah, bug 968696 is just the impetus | 18:12 |
| openstack | bug 968696 in Keystone ""admin"-ness not properly scoped" [High,Confirmed] https://launchpad.net/bugs/968696 - Assigned to Adam Young (ayoung) | 18:12 |
| ayoung | Blucher! | 18:12 |
| *** haneef has joined #openstack-keystone | 18:13 | |
| ayoung | samueldmq, can you bug the other members of team Brazil to sign up for specific tasks? | 18:13 |
| ayoung | OK, so one goal: build a mechanism to allow a deployment to customize the access control policy for their organization. | 18:14 |
| ayoung | also: | 18:14 |
| ayoung | reduce the risk of token compromise by minimizing the access provided by individual tokens | 18:16 |
| david8hu | ayoung, yes, I think dynamic policy does provide the machanism. Operator needs a better policy than what is currently the default. Else, things will remain pretty much the same from user perspective unless there is a better policy. | 18:19 |
| ayoung | david8hu, idally, we would be able to even provide this as a service to applications running in the cloud as well as the Undercloud management | 18:21 |
| david8hu | ayoung, We do not want to break operators who do enjoy the current super admin does it all policy. Perhaps, a sample functional policy file that sperates all service admins. | 18:23 |
| *** pnavarro has quit IRC | 18:25 | |
| *** gokrokve has joined #openstack-keystone | 18:25 | |
| *** aix has quit IRC | 18:25 | |
| *** alanf-mc has quit IRC | 18:28 | |
| *** alanf-mc has joined #openstack-keystone | 18:31 | |
| *** erhudy has joined #openstack-keystone | 18:34 | |
| gsilvis | ayoung: bug NINE SIX EIGHT SIX NINE SIX | 18:34 |
| ayoung | gsilvis, would that work as the time signature for a song? | 18:35 |
| gsilvis | ayoung: I don't think that's how time signatures work | 18:35 |
| gsilvis | ayoung: if you just want a measure subdivided that way, then, sure, why not | 18:35 |
| ayoung | That is not what Dave Brubeck taught us | 18:36 |
| ayoung | david8hu, that is what the "uinified policy" spec is supposed to provide | 18:37 |
| *** gyee has quit IRC | 18:37 | |
| ayoung | a good default that at least would provide a static alternative to 968696ness | 18:37 |
| *** alejandrito has quit IRC | 18:38 | |
| *** vilobhmm1 has joined #openstack-keystone | 18:39 | |
| *** csoukup has joined #openstack-keystone | 18:40 | |
| *** iamjarvo has quit IRC | 18:40 | |
| *** vilobhmm1 has quit IRC | 18:42 | |
| morganfainberg | bknudson: going to do a ksc release (liberty) today | 18:46 |
| bknudson | morganfainberg: this is the last 1.x release? | 18:47 |
| morganfainberg | bknudson: that is the idea | 18:47 |
| bknudson | let's pile on the cleanups for 2.0 | 18:47 |
| david8hu | ayoung, brings all the policy files together | 18:48 |
| morganfainberg | bknudson: 2.0 milestone is already there and ready for targeting | 18:48 |
| morganfainberg | bknudson: and yes, CLI removal (cc dolphm) is planned for that | 18:48 |
| david8hu | ayoung, into 1 file | 18:48 |
| *** vilobhmm has joined #openstack-keystone | 18:50 | |
| *** e0ne has joined #openstack-keystone | 18:53 | |
| dolphm | morganfainberg: do i need to propose a patch? | 18:53 |
| morganfainberg | dolphm: you said you wanted the honor of it ;) | 18:54 |
| dolphm | morganfainberg: i mean, like ASAP? | 18:54 |
| bknudson | we should look at anything else that's deprecated | 18:55 |
| bknudson | unfortunately there's a lot of things that weren't deprecated correctly | 18:55 |
| dolphm | bknudson: right... i can't think of anything else off the top of my head that could be gracefully removed | 18:55 |
| morganfainberg | dolphm: no not ASAP | 18:56 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 18:56 | |
| morganfainberg | but sooner vs. later (please post it *after* 1.4.x ships/tags | 18:56 |
| morganfainberg | dolphm: jamielennox also wants to make 2.0.0 consume KSA | 18:56 |
| bknudson | we're going to need a branch so that we can backport fixes to the 1.x branch | 18:57 |
| bknudson | but we've already got stable/kilo, so not sure what you call it | 18:57 |
| morganfainberg | bknudson: 2.x will be part of liberty | 18:58 |
| morganfainberg | bknudson: stable/kilo preceeds 1.4.x | 18:58 |
| morganfainberg | bknudson: the 1.4 release is mostly to tie up before we do mass deprecation for sanity reasons. | 18:59 |
| morganfainberg | the way i see it | 18:59 |
| ayoung | amakarov_away, let me know if I misundertood your patch on https://review.openstack.org/#/c/141854/23 fully willing to accept if I am wrong | 18:59 |
| bknudson | it might be 1.5 ? didn't we updated requirements? | 18:59 |
| bknudson | I think this is going to be 1.5.0 | 19:00 |
| morganfainberg | bknudson: oh 1.5, sure i thought 1.4 was next | 19:01 |
| * morganfainberg will need to 2x check | 19:01 | |
| morganfainberg | i'll do that before tagging | 19:01 |
| *** _cjones_ has quit IRC | 19:01 | |
| bknudson | I wonder why we cap pbr? pbr>=0.11,<2.0 | 19:02 |
| bknudson | requirements were updated: http://git.openstack.org/cgit/openstack/python-keystoneclient/commit/?id=9f630bc178915f27df5dec7e570ef11fe4aee948 | 19:02 |
| ayoung | I wonder if we can kneecap PBR | 19:03 |
| *** _cjones_ has joined #openstack-keystone | 19:14 | |
| *** iamjarvo has joined #openstack-keystone | 19:15 | |
| *** henrynash has joined #openstack-keystone | 19:16 | |
| *** ChanServ sets mode: +v henrynash | 19:16 | |
| *** HT_sergio has joined #openstack-keystone | 19:23 | |
| HT_sergio | Hey all! I've been having an issue where restarting keystone and memcache causes other services (nova, glance, etc) to fail on all user requests. Apparently the services were caching their tokens, so their attempts to verify the user's token were being rejected | 19:27 |
| HT_sergio | Debugging this was really difficult until I made a little change to keystone. Instead logging "RBAC: invalid token" I made it include the reason (ie. not found in token store) which made the issue far more obvious | 19:28 |
| HT_sergio | do you think this is something I should open a bug for, or otherwise contribute a patch ? | 19:28 |
| HT_sergio | looking in launchpad doesn't show any related issue | 19:29 |
| HT_sergio | *any similar issue | 19:29 |
| *** lufix_ has joined #openstack-keystone | 19:32 | |
| openstackgerrit | Dolph Mathews proposed openstack/python-keystoneclient: Remove the entire CLI https://review.openstack.org/185716 | 19:43 |
| *** e0ne has quit IRC | 19:55 | |
| *** e0ne has joined #openstack-keystone | 20:00 | |
| *** alanf-mc has quit IRC | 20:01 | |
| *** alanf-mc_ has joined #openstack-keystone | 20:02 | |
| gsilvis | rodrigods, jamielennox: Do you want to talk about https://review.openstack.org/#/c/172155/ at some point? We talked about it a bit at the summit on Friday, but we didn't write much down | 20:03 |
| *** radez is now known as radez_g0n3 | 20:04 | |
| *** ayoung has quit IRC | 20:05 | |
| *** ctina__ has quit IRC | 20:05 | |
| *** timcline has quit IRC | 20:08 | |
| bknudson | we need a keystoneclient functional test that doesn't use the cli | 20:08 |
| rodrigods | gsilvis, I think we came to a final design (look jamielennox's comment) | 20:08 |
| rodrigods | gsilvis, the paste one | 20:08 |
| jamielennox | bknudson: i think there is 1 | 20:08 |
| bknudson | good. I was worried we'd have no functional tests left. | 20:09 |
| rodrigods | ping morganfainberg and dolphm: are you in favor of backporting this patch chain? https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:stable/kilo+topic:bug/1442787,n,z | 20:10 |
| *** iamjarvo has quit IRC | 20:11 | |
| gsilvis | rodrigods: ah, I didn't look at the paste there | 20:11 |
| gsilvis | rodrigods: that plan looks good to me | 20:11 |
| rodrigods | gsilvis, great | 20:12 |
| *** iamjarvo has joined #openstack-keystone | 20:12 | |
| *** samueldmq has quit IRC | 20:15 | |
| *** ayoung has joined #openstack-keystone | 20:18 | |
| *** ChanServ sets mode: +v ayoung | 20:18 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 20:18 | |
| *** sbasam has joined #openstack-keystone | 20:20 | |
| *** pnavarro has joined #openstack-keystone | 20:25 | |
| *** radez_g0n3 is now known as radez | 20:26 | |
| *** timcline has joined #openstack-keystone | 20:26 | |
| *** ayoung has quit IRC | 20:27 | |
| *** gyee has joined #openstack-keystone | 20:28 | |
| *** ChanServ sets mode: +v gyee | 20:28 | |
| david8hu | ayoung, can you please add me to the dynamic policy group? Maybe I missed the invite? | 20:30 |
| *** setmason has joined #openstack-keystone | 20:32 | |
| setmason | Is there a way to have keystone return a unique swift endpoint (Public URL) per Project/tenant? | 20:32 |
| *** samueldmq has joined #openstack-keystone | 20:33 | |
| bknudson | setmason: the service catalog allows you to put $(tenant_id)s which gets replaced with the token's project... you can see http://git.openstack.org/cgit/openstack/keystone/tree/etc/default_catalog.templates for an example | 20:35 |
| morganfainberg | stevemar: back | 20:38 |
| morganfainberg | stevemar: from lunch | 20:38 |
| *** alanf-mc has joined #openstack-keystone | 20:39 | |
| *** alanf-mc_ has quit IRC | 20:39 | |
| *** alanf-mc has quit IRC | 20:41 | |
| *** alanf-mc has joined #openstack-keystone | 20:42 | |
| *** ayoung has joined #openstack-keystone | 20:42 | |
| *** ChanServ sets mode: +v ayoung | 20:42 | |
| morganfainberg | ayoung: having a chat with thingee, i think we're going to run into bigger issues with the MOC model. | 20:44 |
| morganfainberg | ayoung: i'll catch you later this week for a bit more in depth.. | 20:44 |
| morganfainberg | ayoung: but it's not going to be "just a token" | 20:44 |
| gsilvis | morganfainberg: can I drop in on that conversation too? | 20:45 |
| gyee | morganfainberg, do I understand correctly that only security bugs can be backported? | 20:45 |
| morganfainberg | gsilvis: sure. | 20:45 |
| morganfainberg | gyee: uhm. for which thing? | 20:45 |
| gyee | morganfainberg, bug 1398347 | 20:46 |
| openstack | bug 1398347 in Keystone "LDAP backend should do filtered query instead of getting all data and then filtering" [Wishlist,Fix released] https://launchpad.net/bugs/1398347 - Assigned to Henry Nash (henry-nash) | 20:46 |
| gyee | ldap performance | 20:46 |
| morganfainberg | gyee: depending on the impact / size of the backport, this could be considered singnificant UX improvement and worth backporting | 20:47 |
| gyee | morganfainberg, definitely a UX improvement, especially if we lots of users in LDAP | 20:47 |
| morganfainberg | gyee: but it's going to really depend on the scope of the change. | 20:47 |
| bknudson | for kilo you can backport pretty much anything. | 20:47 |
| morganfainberg | bknudson: ++ | 20:47 |
| gyee | kilo to juno | 20:47 |
| bknudson | gyee: https://wiki.openstack.org/wiki/Releases -- Juno is Security-only | 20:48 |
| gyee | yikes | 20:48 |
| morganfainberg | bknudson: oh hadn't realized. | 20:49 |
| bknudson | stable support team might be more willing to support longer if companies would step up with support. | 20:49 |
| morganfainberg | now i have heard we can do more than security on those... but it reaaaaaaaaaaally needs to be justified | 20:49 |
| bknudson | more like the release team. | 20:49 |
| gyee | security and performance should be easier to justify, I hope | 20:50 |
| samueldmq | gyee, ++ | 20:50 |
| bknudson | I think performance would be hard to justify. | 20:50 |
| bknudson | everyone just forks openstack stable anyways | 20:51 |
| gyee | hah | 20:51 |
| *** henrynash has quit IRC | 20:51 | |
| morganfainberg | gyee: solution: ping the stable maintainers (hint: dolphm and bknudson are the first line of defense for keystone) | 20:51 |
| gyee | bknudson, dolphm, what do you guys think? | 20:52 |
| bknudson | gyee: it's not security-related, so I think no backport. | 20:52 |
| *** HT_sergio has quit IRC | 20:53 | |
| gyee | ah fork it :) | 20:53 |
| morganfainberg | gyee: spork it! | 20:53 |
| morganfainberg | because sporks are weird | 20:53 |
| gyee | dah! | 20:53 |
| *** iamjarvo has quit IRC | 20:54 | |
| stevemar | morganfainberg, also backish | 20:55 |
| morganfainberg | stevemar: but x-project meeting about to start | 20:57 |
| morganfainberg | :( | 20:57 |
| *** gokrokve has quit IRC | 21:01 | |
| *** gokrokve has joined #openstack-keystone | 21:02 | |
| *** HenryG has quit IRC | 21:04 | |
| *** jsavak has quit IRC | 21:05 | |
| *** HenryG has joined #openstack-keystone | 21:07 | |
| *** lhcheng_ is now known as lhcheng | 21:10 | |
| *** ChanServ sets mode: +v lhcheng | 21:10 | |
| *** lufix_ has quit IRC | 21:15 | |
| *** mattfarina has quit IRC | 21:15 | |
| *** ayoung has quit IRC | 21:17 | |
| *** ayoung has joined #openstack-keystone | 21:19 | |
| *** ChanServ sets mode: +v ayoung | 21:19 | |
| *** iamjarvo has joined #openstack-keystone | 21:25 | |
| *** timcline has quit IRC | 21:30 | |
| *** iamjarvo has quit IRC | 21:31 | |
| *** jsavak has joined #openstack-keystone | 21:44 | |
| samueldmq | dstanek I replied your comments at # 137202 (Improve List Role Assignments Filters Performance) | 21:47 |
| samueldmq | amakarov_away, ^ | 21:47 |
| samueldmq | I really would appreciate reviews on that, since I have been working on that for a cycle at this moment : ) | 21:48 |
| samueldmq | actually I started that before Kilo summit at Paris | 21:50 |
| lbragstad | dstanek: how is your gerrty review stuff coming along with vim script? | 21:50 |
| *** gokrokve has quit IRC | 21:50 | |
| *** jsavak has quit IRC | 21:57 | |
| *** jsavak has joined #openstack-keystone | 21:58 | |
| *** gokrokve has joined #openstack-keystone | 21:59 | |
| *** gokrokve has quit IRC | 22:05 | |
| *** gokrokve has joined #openstack-keystone | 22:06 | |
| dstanek | samueldmq: which review is that? | 22:07 |
| *** iamjarvo has joined #openstack-keystone | 22:08 | |
| dstanek | lbragstad: i started working on some other gertty changes while i'm waiting for my gertty changes to merge | 22:08 |
| samueldmq | dstanek, Improve List Role Assignments Filters Performance | 22:08 |
| samueldmq | dstanek, you have a comment there | 22:08 |
| dstanek | samueldmq: why is that comment block changing? you renamed domain to project in examples and it's not clear to me why | 22:11 |
| samueldmq | dstanek, it was not just that I changed domain to project | 22:12 |
| samueldmq | dstanek, it was "'project_id': domain_id," and I fixed it | 22:13 |
| samueldmq | dstanek, also, I changed the format in which we represent the assignments (now the expanded assignments, in the manager level) | 22:13 |
| dstanek | samueldmq: that's why i voted -1; several different change in the patch | 22:14 |
| dstanek | the entire method was rewritten and it was hard to tell if the doc changes were caused by that or if the change was for another reason | 22:14 |
| samueldmq | dstanek, yes .. but as we are moving the expansion logic from controller to manager, manager has to have its own way to represent the expanded assignments | 22:14 |
| samueldmq | dstanek, well .. I could split that patch into two ... one passes the filters to the drivers and keep the expasion logic/formatting at controller level | 22:17 |
| samueldmq | dstanek, the second moves the expasion logic to the manager | 22:17 |
| samueldmq | dstanek, and keep only the formatting logic at the controller level | 22:17 |
| *** iamjarvo has quit IRC | 22:21 | |
| *** edmondsw has quit IRC | 22:22 | |
| morganfainberg | hmm.. dtroyer think we can drop "python-" from keystoneclient with the 2.0.0 release as well? :P | 22:23 |
| * morganfainberg does not like that convention | 22:23 | |
| *** fangzhou has joined #openstack-keystone | 22:24 | |
| *** dims has quit IRC | 22:25 | |
| *** gordc has quit IRC | 22:27 | |
| *** dims has joined #openstack-keystone | 22:28 | |
| dstanek | samueldmq: that sounds sane | 22:28 |
| dstanek | morganfainberg: ++ | 22:28 |
| bknudson | what if we have a js-keystoneclient? | 22:29 |
| samueldmq | dstanek, ok I will be working on that ... maybe that's been there for a long time because it's hard to review, not sure but that's a fair possibility | 22:29 |
| bknudson | should be emcascript-keystoneclient | 22:30 |
| samueldmq | go-keystoneclient !! | 22:30 |
| samueldmq | should be fun :) | 22:30 |
| gyee | lets do this | 22:30 |
| bknudson | I'd like to see it. | 22:30 |
| dtroyer | morganfainberg: I'm all for that. IIRc it was a debian-ism that prompted it in the first place | 22:30 |
| dtroyer | and I've regretted with OSc since day 3 | 22:31 |
| gyee | hahahah | 22:31 |
| gyee | dtroyer, took you 3 days?! :) | 22:31 |
| dtroyer | I was an ignorant young (python)-pup back then | 22:31 |
| *** radez is now known as radez_g0n3 | 22:34 | |
| *** lifeless has quit IRC | 22:35 | |
| dstanek | if you don't have the python- prefix how will pip know you what the Python version of the client? | 22:39 |
| *** ayoung has quit IRC | 22:41 | |
| dstanek | jamielennox: i started hacking on flask today | 22:49 |
| *** zzzeek has quit IRC | 22:51 | |
| jamielennox | dstanek: ok, cool. i've been reading some of the docs but i was going to check with you first | 22:51 |
| *** lhcheng_ has joined #openstack-keystone | 22:51 | |
| morganfainberg | dstanek: i.. i don't have words for that... | 22:52 |
| morganfainberg | dstanek: *cry* | 22:52 |
| morganfainberg | dstanek: the pip + python question that is | 22:52 |
| samueldmq | heheh | 22:52 |
| dstanek | morganfainberg: i'm just concerned that it'll accidentally install the ruby versio | 22:53 |
| *** lhcheng has quit IRC | 22:53 | |
| *** e0ne has quit IRC | 22:53 | |
| morganfainberg | dstanek: you know... this *is* on eavesdrop... be careful... someone might think youre serious | 22:55 |
| *** csoukup has quit IRC | 22:56 | |
| dstanek | morganfainberg: that would be too funny - just to be a jerk i was register ruby-keystoneclient on pypi | 22:56 |
| *** dguerri is now known as dguerri`away | 22:57 | |
| morganfainberg | dstanek: now if you made pip install it by calling out to the ruby equivalent installer and install a ruby binding | 22:57 |
| morganfainberg | dstanek: i might... i might have to tip my hat. | 22:57 |
| morganfainberg | and owe you a beer or 7 | 22:57 |
| morganfainberg | because that'd be serious commitment to a joke | 22:57 |
| *** stevemar has quit IRC | 22:58 | |
| dstanek | a little too much maybe | 23:01 |
| *** bknudson has quit IRC | 23:05 | |
| *** Ephur has quit IRC | 23:06 | |
| *** jsavak has quit IRC | 23:07 | |
| *** chlong has joined #openstack-keystone | 23:09 | |
| *** chlong has quit IRC | 23:15 | |
| *** markvoelker has quit IRC | 23:15 | |
| *** darrenc is now known as darrenc_afk | 23:26 | |
| *** gokrokve has quit IRC | 23:27 | |
| *** hemna is now known as hemnafk | 23:31 | |
| jamielennox | morganfainberg: i'll be back in like an hour. can you hold down the session questions? | 23:32 |
| morganfainberg | jamielennox: ok so, tell everyone to dogpile you when you're back. check. | 23:33 |
| morganfainberg | jamielennox: ;) | 23:33 |
| morganfainberg | jamielennox: yeah i think the questions are mostly in order now / should taper off. | 23:33 |
| morganfainberg | jamielennox: thanks for jumping in | 23:33 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:35 | |
| *** darrenc_afk is now known as darrenc | 23:37 | |
| *** fangzhou has quit IRC | 23:37 | |
| *** jamielennox is now known as jamielennox|away | 23:42 | |
| *** chlong has joined #openstack-keystone | 23:44 | |
| *** alanf-mc has quit IRC | 23:48 | |
| *** lifeless has joined #openstack-keystone | 23:54 | |
| *** csoukup has joined #openstack-keystone | 23:54 | |
| *** vilobhmm has quit IRC | 23:57 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystonemiddleware: Send the correct user-agent to Keystone https://review.openstack.org/180769 | 23:57 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!