| *** hemna is now known as hemnafk | 00:01 | |
| *** lhcheng has joined #openstack-keystone | 00:02 | |
| *** ChanServ sets mode: +v lhcheng | 00:02 | |
| *** browne has joined #openstack-keystone | 00:03 | |
| *** dsirrine has quit IRC | 00:07 | |
| openstackgerrit | Alan Pevec proposed openstack/keystone: Run WSGI with group=keystone https://review.openstack.org/187800 | 00:21 |
|---|---|---|
| *** dsirrine has joined #openstack-keystone | 00:22 | |
| *** Sayaji has quit IRC | 00:22 | |
| *** ncoghlan has joined #openstack-keystone | 00:24 | |
| openstackgerrit | Alan Pevec proposed openstack/keystone: disable admin_token by default https://review.openstack.org/185464 | 00:31 |
| openstackgerrit | Alan Pevec proposed openstack/keystone: disable admin_token by default https://review.openstack.org/185464 | 00:33 |
| *** gokrokve has quit IRC | 00:54 | |
| *** gokrokve has joined #openstack-keystone | 00:55 | |
| *** csoukup has joined #openstack-keystone | 00:55 | |
| *** gokrokve has quit IRC | 00:59 | |
| *** Raildo_ has joined #openstack-keystone | 01:02 | |
| *** Raildo has quit IRC | 01:04 | |
| *** _cjones_ has quit IRC | 01:06 | |
| *** samueldmq has joined #openstack-keystone | 01:08 | |
| dstanek | gyee: did you get your answer? | 01:12 |
| *** spandhe has quit IRC | 01:13 | |
| gyee | dstanek, no, need your Python expertise | 01:14 |
| dstanek | gyee: what are you having trouble with? | 01:14 |
| *** gokrokve has joined #openstack-keystone | 01:14 | |
| gyee | dstanek, trying to lookup the package version from the code | 01:14 |
| gyee | dstanek, https://review.openstack.org/#/c/180769/10/keystonemiddleware/auth_token/__init__.py | 01:15 |
| gyee | I was trying to help out Roxana | 01:15 |
| *** ayoung has joined #openstack-keystone | 01:15 | |
| *** ChanServ sets mode: +v ayoung | 01:15 | |
| gyee | but I have no idea how to construct this string "{project}/{project_version} ksv.auth_token/{ksm_version}" | 01:15 |
| gyee | dstanek, I was thinking popen('pip freeze ...') but I thought better of it :) | 01:16 |
| dstanek | gyee: ah, ok. looking | 01:16 |
| *** Raildo_ has quit IRC | 01:18 | |
| dstanek | gyee: i was hoping that pbr had a new magic way to do it | 01:23 |
| gyee | dstanek, that would be awesome if it can | 01:23 |
| dstanek | we can use the old standby of pkg_resources | 01:24 |
| gyee | you mean open the file and parse the content? | 01:24 |
| dstanek | something like pkg_resources.get_distribution('python-keystoneclient').version | 01:24 |
| dstanek | not sure how you can get the distribution for the module you are currently in though | 01:25 |
| gyee | yeah, if the package is not installed by pip, it won't help either | 01:27 |
| gyee | dstanek, ya think we have rpm for python-keystoneclient? | 01:28 |
| gyee | or debian | 01:28 |
| gyee | maybe we'll just make user-agent string configurable and let the config tools fill in the blank? | 01:29 |
| *** alanf-mc has quit IRC | 01:31 | |
| *** browne has quit IRC | 01:31 | |
| *** tobe has joined #openstack-keystone | 01:33 | |
| dstanek | gyee: not sure yet | 01:34 |
| dstanek | morganfainberg: you commented about passing in the project name somehow. any ideas on how to do that? | 01:51 |
| morganfainberg | dstanek: hmm? | 01:55 |
| morganfainberg | oh. | 01:55 |
| morganfainberg | uhhhhhhhhhh | 01:55 |
| morganfainberg | how do we pass the options for swift and other non-oslo-conforming projects? | 01:56 |
| dstanek | morganfainberg: ah, yeah, sorry - no context for you | 01:56 |
| morganfainberg | there was a review up about that | 01:56 |
| dstanek | apart from the useragent one? | 01:56 |
| morganfainberg | looking | 01:59 |
| morganfainberg | dstanek: what https://review.openstack.org/#/c/143063/ is trying to do | 02:00 |
| morganfainberg | dstanek: not rely on the global conf | 02:00 |
| *** fangzhou has quit IRC | 02:00 | |
| dstanek | oslo.config == make things hard/let's not worry about software design! | 02:01 |
| dstanek | morganfainberg: that's just getting about the lack of registration - i need to find a way for the called to pass in some additional args | 02:02 |
| dstanek | maybe just in the constructor of the middleware | 02:02 |
| morganfainberg | yeah | 02:02 |
| morganfainberg | that is probably how it needs to work | 02:02 |
| morganfainberg | te whole "conf.project" thing seems specious | 02:03 |
| *** dsirrine has quit IRC | 02:04 | |
| lifeless | morganfainberg: review 167194 might terrify you | 02:06 |
| morganfainberg | really... | 02:07 |
| morganfainberg | why would you do that to me:P | 02:07 |
| morganfainberg | lifeless: that is really frightening | 02:08 |
| lifeless | because you deserve it :) | 02:08 |
| morganfainberg | lifeless: hah. | 02:09 |
| morganfainberg | there are reasons i like my little world of identity | 02:09 |
| morganfainberg | *shiftyeyes* | 02:09 |
| *** rushiagr_away is now known as rushiagr | 02:09 | |
| dstanek | lifeless: very nice; that's pretty bad because it shows function arguments and those case can all kinds of secret data | 02:22 |
| lifeless | dstanek: yes :) | 02:23 |
| lifeless | dstanek: thus my -2 banhammer | 02:23 |
| *** Kennan2 has joined #openstack-keystone | 02:37 | |
| *** davechen_afk is now known as davechen | 02:37 | |
| *** Kennan has quit IRC | 02:38 | |
| *** rushiagr is now known as rushiagr_away | 02:40 | |
| *** lhcheng_ has joined #openstack-keystone | 02:47 | |
| *** lhcheng has quit IRC | 02:47 | |
| *** Kennan2 is now known as Kennan | 02:49 | |
| *** dims__ has quit IRC | 02:56 | |
| openstackgerrit | guang-yee proposed openstack/keystone: Unable to list role assignments in Project https://review.openstack.org/180846 | 02:57 |
| *** richm has quit IRC | 02:58 | |
| *** gyee is now known as operator99 | 03:00 | |
| *** samueldmq has quit IRC | 03:03 | |
| *** nkinder_ has joined #openstack-keystone | 03:09 | |
| *** gokrokve_ has joined #openstack-keystone | 03:17 | |
| *** alanf-mc has joined #openstack-keystone | 03:21 | |
| *** gokrokve has quit IRC | 03:21 | |
| *** gokrokve_ has quit IRC | 03:21 | |
| *** alanf-mc has quit IRC | 03:25 | |
| *** spandhe has joined #openstack-keystone | 03:36 | |
| *** kiran-r has joined #openstack-keystone | 03:38 | |
| *** spandhe_ has joined #openstack-keystone | 03:42 | |
| *** spandhe has quit IRC | 03:43 | |
| *** spandhe_ is now known as spandhe | 03:43 | |
| *** markvoelker has quit IRC | 03:44 | |
| *** iamjarvo has joined #openstack-keystone | 03:49 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Add testcases to test DefaultDomain https://review.openstack.org/185855 | 03:53 |
| *** browne has joined #openstack-keystone | 03:55 | |
| openstackgerrit | Divya K Konoor proposed openstack/pycadf: Add api_audit_map.conf for Ceilometer project https://review.openstack.org/187593 | 04:11 |
| *** topol has joined #openstack-keystone | 04:29 | |
| *** ChanServ sets mode: +v topol | 04:29 | |
| *** spandhe has quit IRC | 04:41 | |
| *** spandhe has joined #openstack-keystone | 04:45 | |
| *** markvoelker has joined #openstack-keystone | 04:45 | |
| *** _cjones_ has joined #openstack-keystone | 04:48 | |
| *** markvoelker has quit IRC | 04:50 | |
| *** lhcheng_ has quit IRC | 04:54 | |
| *** _cjones_ has quit IRC | 04:55 | |
| *** stevemar has quit IRC | 04:58 | |
| *** kiran-r has quit IRC | 04:59 | |
| *** mabrams has joined #openstack-keystone | 05:33 | |
| *** henrynash has joined #openstack-keystone | 05:37 | |
| *** ChanServ sets mode: +v henrynash | 05:37 | |
| *** henrynash has quit IRC | 05:37 | |
| *** topol has quit IRC | 05:38 | |
| *** lhcheng has joined #openstack-keystone | 05:46 | |
| *** ChanServ sets mode: +v lhcheng | 05:46 | |
| *** dguerri`away has quit IRC | 05:55 | |
| *** dguerri`away has joined #openstack-keystone | 05:57 | |
| *** dguerri`away is now known as dguerri | 05:57 | |
| *** iamjarvo has quit IRC | 05:58 | |
| *** josecastroleon has joined #openstack-keystone | 05:59 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the wrong order of parameters when using assertEqual https://review.openstack.org/187869 | 06:00 |
| *** woodster_ has quit IRC | 06:00 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/186279 | 06:05 |
| *** kiran-r has joined #openstack-keystone | 06:10 | |
| *** csoukup has quit IRC | 06:17 | |
| *** henrynash has joined #openstack-keystone | 06:20 | |
| *** ChanServ sets mode: +v henrynash | 06:20 | |
| *** belmoreira has joined #openstack-keystone | 06:26 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Don't store expire into memcache https://review.openstack.org/174196 | 06:33 |
| *** markvoelker has joined #openstack-keystone | 06:34 | |
| *** markvoelker has quit IRC | 06:38 | |
| *** spandhe has quit IRC | 06:57 | |
| *** browne has quit IRC | 07:02 | |
| *** ncoghlan has quit IRC | 07:02 | |
| *** sudorandom has quit IRC | 07:16 | |
| *** Nakato has quit IRC | 07:16 | |
| *** pnavarro has joined #openstack-keystone | 07:17 | |
| openstackgerrit | guang-yee proposed openstack/keystone: Unable to list role assignments in Project https://review.openstack.org/180846 | 07:17 |
| *** sudorandom has joined #openstack-keystone | 07:18 | |
| *** Nakato has joined #openstack-keystone | 07:18 | |
| *** bradjones has quit IRC | 07:20 | |
| *** bradjones has joined #openstack-keystone | 07:22 | |
| *** rlt_ has joined #openstack-keystone | 07:23 | |
| breton | morning | 07:26 |
| *** henrynash has quit IRC | 07:27 | |
| *** chlong has quit IRC | 07:37 | |
| *** belmoreira has quit IRC | 07:42 | |
| *** belmoreira has joined #openstack-keystone | 07:46 | |
| davechen | lhcheng: ping? | 07:48 |
| davechen | lhcheng: Lin, do you know where is policy files used in the horizon? | 07:49 |
| davechen | can we edit or read it directly from the dashboard? | 07:49 |
| evrardjp | good morning | 07:50 |
| *** jistr has joined #openstack-keystone | 07:51 | |
| *** tobe has quit IRC | 07:52 | |
| *** henrynash has joined #openstack-keystone | 07:54 | |
| *** ChanServ sets mode: +v henrynash | 07:54 | |
| lhcheng | davechen: horizon got a copy of the policy file in https://github.com/openstack/horizon/tree/master/openstack_dashboard/conf | 07:55 |
| lhcheng | not the ideal way, would have utilized the policy api for this. But other projects didn't populate the policy api, so this is the best we can do so far. | 07:57 |
| davechen | lhcheng: yep, I found these files in the source, do you know where it used? | 07:57 |
| lhcheng | davechen: no, it can't be edited or viewed from the dashboard | 07:57 |
| lhcheng | davechen: it is used for all of the panels. | 07:57 |
| *** dims_ has joined #openstack-keystone | 07:58 | |
| lhcheng | for example: in Identity -> User table, available action displayed are based on the policy file. | 07:58 |
| davechen | lhcheng: okay. so, when service API called, we need these file for policy enforcement? | 07:59 |
| davechen | lhcheng: got you. | 07:59 |
| davechen | lhcheng: many thanks, l will have a try. | 07:59 |
| lhcheng | davechen: one example: https://github.com/openstack/horizon/blob/master/openstack_dashboard/dashboards/identity/users/tables.py#L50 | 08:00 |
| lhcheng | It checks the rule "identity:update_user" to determin if Edit User button should be available to the user. | 08:01 |
| *** rushiagr_away is now known as rushiagr | 08:02 | |
| *** dims_ has quit IRC | 08:03 | |
| davechen | lhcheng: yep, this is similar with the actions in the other services. | 08:03 |
| davechen | lhcheng: I am clear, just trying to understand why we need these files in the horizon and a copy of each service. | 08:04 |
| *** fhubik has joined #openstack-keystone | 08:06 | |
| lhcheng | davechen: when we get the rest of the projects to move to the centralized policy file, we can remove the copy here. somewhere down the long road. :) | 08:06 |
| davechen | lhcheng: hope so, the centralized policy is a attractive stuff. | 08:07 |
| lhcheng | davechen: yes, it will solve a lot of problem. | 08:09 |
| lhcheng | davechen: hitting the bed, have a good day! | 08:10 |
| davechen | lhcheng: some guys from nova is also watching at this, let's hope this could be happened in the 'L' | 08:10 |
| davechen | lhcheng: good night | 08:10 |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: WIP: Add testcases of list_role_assignments of v3 domains https://review.openstack.org/187899 | 08:10 |
| davechen | lhcheng: have a sweet dream. :) | 08:10 |
| *** Kennan2 has joined #openstack-keystone | 08:11 | |
| *** sudorandom has quit IRC | 08:11 | |
| lhcheng | davechen: maybe I'll dream of the dynamic policy already used. hah | 08:11 |
| *** Kennan has quit IRC | 08:11 | |
| lhcheng | bye! | 08:11 |
| *** bdossant has joined #openstack-keystone | 08:12 | |
| davechen | lhcheng: bye. :) | 08:12 |
| *** Nakato has quit IRC | 08:13 | |
| *** henrynash has quit IRC | 08:13 | |
| *** tobe has joined #openstack-keystone | 08:14 | |
| *** Nakato has joined #openstack-keystone | 08:14 | |
| *** sudorandom has joined #openstack-keystone | 08:19 | |
| *** henrynash has joined #openstack-keystone | 08:19 | |
| *** ChanServ sets mode: +v henrynash | 08:19 | |
| *** henrynash has quit IRC | 08:21 | |
| *** markvoelker has joined #openstack-keystone | 08:22 | |
| *** henrynash has joined #openstack-keystone | 08:23 | |
| *** ChanServ sets mode: +v henrynash | 08:23 | |
| *** markvoelker has quit IRC | 08:27 | |
| *** henrynash has quit IRC | 08:28 | |
| *** henrynash has joined #openstack-keystone | 08:30 | |
| *** ChanServ sets mode: +v henrynash | 08:30 | |
| *** henrynash has quit IRC | 08:31 | |
| *** spandhe has joined #openstack-keystone | 08:31 | |
| *** henrynash has joined #openstack-keystone | 08:39 | |
| *** ChanServ sets mode: +v henrynash | 08:39 | |
| *** henrynash has quit IRC | 08:41 | |
| *** henrynash has joined #openstack-keystone | 08:42 | |
| *** ChanServ sets mode: +v henrynash | 08:42 | |
| *** e0ne has joined #openstack-keystone | 08:46 | |
| *** henrynash has quit IRC | 08:47 | |
| *** henrynash has joined #openstack-keystone | 08:48 | |
| *** ChanServ sets mode: +v henrynash | 08:48 | |
| *** henrynash has quit IRC | 08:52 | |
| *** e0ne is now known as e0ne_ | 09:01 | |
| *** e0ne_ is now known as e0ne | 09:01 | |
| *** tellesnobrega has quit IRC | 09:07 | |
| *** fhubik is now known as fhubik_afk | 09:15 | |
| *** afazekas has joined #openstack-keystone | 09:22 | |
| *** fhubik_afk is now known as fhubik | 09:39 | |
| *** davechen is now known as davechen_afk | 09:43 | |
| *** e0ne is now known as e0ne_ | 09:55 | |
| *** e0ne_ is now known as e0ne | 09:57 | |
| *** davidckennedy has joined #openstack-keystone | 09:59 | |
| *** tellesnobrega has joined #openstack-keystone | 10:02 | |
| *** dims_ has joined #openstack-keystone | 10:06 | |
| *** lhcheng has quit IRC | 10:07 | |
| *** markvoelker has joined #openstack-keystone | 10:11 | |
| *** fhubik is now known as fhubik_afk | 10:15 | |
| *** markvoelker has quit IRC | 10:15 | |
| *** mabrams has quit IRC | 10:23 | |
| *** spandhe has quit IRC | 10:23 | |
| *** samueldmq has joined #openstack-keystone | 10:23 | |
| samueldmq | morning | 10:32 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystonemiddleware: Enforce endpoint constraint https://review.openstack.org/177661 | 10:32 |
| samueldmq | ayoung, hi, dynamic policies look to be shaking people up | 10:41 |
| samueldmq | ayoung, and it's said there is a lot of interest on it o/ | 10:42 |
| samueldmq | ayoung, that's a lot of motivation :) | 10:42 |
| *** Dave has joined #openstack-keystone | 10:44 | |
| *** fhubik_afk is now known as fhubik | 10:53 | |
| *** fhubik is now known as fhubik_afk | 11:15 | |
| *** aix has quit IRC | 11:25 | |
| *** rushiagr is now known as rushiagr_away | 11:25 | |
| *** e0ne is now known as e0ne_ | 11:32 | |
| *** markvoelker has joined #openstack-keystone | 11:42 | |
| *** e0ne_ has quit IRC | 11:42 | |
| *** woodster_ has joined #openstack-keystone | 11:44 | |
| *** markvoelker has quit IRC | 11:46 | |
| *** tobe has quit IRC | 11:56 | |
| *** Raildo has joined #openstack-keystone | 11:56 | |
| *** mabrams has joined #openstack-keystone | 11:56 | |
| *** tobe has joined #openstack-keystone | 11:57 | |
| *** e0ne has joined #openstack-keystone | 11:58 | |
| *** aix has joined #openstack-keystone | 12:00 | |
| *** fhubik_afk is now known as fhubik | 12:01 | |
| *** markvoelker has joined #openstack-keystone | 12:01 | |
| *** tobe has quit IRC | 12:02 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Add default domain to fixture.v3.V3FederationToken https://review.openstack.org/187516 | 12:07 |
| *** avozza is now known as zz_avozza | 12:16 | |
| *** zz_avozza is now known as avozza | 12:17 | |
| *** iurygregory has joined #openstack-keystone | 12:22 | |
| *** avozza has left #openstack-keystone | 12:25 | |
| *** kiranr has joined #openstack-keystone | 12:34 | |
| *** kiran-r has quit IRC | 12:34 | |
| *** gordc has joined #openstack-keystone | 12:38 | |
| *** henrynash has joined #openstack-keystone | 12:38 | |
| *** ChanServ sets mode: +v henrynash | 12:38 | |
| *** kiranr has quit IRC | 12:39 | |
| *** iurygregory has quit IRC | 12:40 | |
| *** iamjarvo has joined #openstack-keystone | 12:41 | |
| *** iurygregory has joined #openstack-keystone | 12:45 | |
| *** rwsu has joined #openstack-keystone | 12:54 | |
| *** bknudson has joined #openstack-keystone | 12:56 | |
| *** ChanServ sets mode: +v bknudson | 12:56 | |
| *** jistr is now known as jistr|mtg | 12:57 | |
| *** mattfarina has joined #openstack-keystone | 13:04 | |
| *** Raildo_ has joined #openstack-keystone | 13:04 | |
| *** dsirrine has joined #openstack-keystone | 13:05 | |
| dolphm | bknudson: i'm happy to +A this now, but wanted to find out if you intended to make another patchset first https://review.openstack.org/#/c/187751/ cc- morganfainberg | 13:07 |
| *** Raildo has quit IRC | 13:07 | |
| bknudson | dolphm: I can try to come up with some comments... not sure what the comment is but I'll try to come up with something | 13:09 |
| bknudson | I don't think we can switch to isoformat() in any number of steps | 13:09 |
| dolphm | bknudson: agree, unless timeutils is changed first | 13:10 |
| dolphm | i was thinking about adding oslo to bug 1461251 for unacceptable impact | 13:10 |
| openstack | bug 1461251 in Keystone "Stop using deprecated oslo_utils.timeutils.isotime" [Critical,In progress] https://launchpad.net/bugs/1461251 - Assigned to Brant Knudson (blk-u) | 13:10 |
| *** henrynash has quit IRC | 13:11 | |
| dims_ | dolphm: i am tending to agree, yes, please | 13:12 |
| bknudson | dolphm: considering the effect of the deprecating it, I agree it would be better for oslo to not deprecated | 13:12 |
| *** Raildo__ has joined #openstack-keystone | 13:12 | |
| *** pnavarro has quit IRC | 13:12 | |
| dolphm | dims_: working on it now | 13:12 |
| bknudson | If oslo un-deprecates then we can just abandon my fixes | 13:12 |
| bknudson | if oslo really wants this function gone then we'll have to figure out something. | 13:13 |
| dims_ | bknudson: ack. at least it started the conversation that there are issues with the timeutils and at some point folks have to move up somehow. let's talk to jd__ and un-deprecate it | 13:13 |
| *** richm has joined #openstack-keystone | 13:14 | |
| dims_ | bknudson: we rolled back one change in oslo.serialization related to this isotime | 13:14 |
| *** pnavarro has joined #openstack-keystone | 13:15 | |
| bknudson | " YYYY-MM-DDTHH:MM:SS.mmmmmm or, if microsecond is 0, YYYY-MM-DDTHH:MM:SS" -- this is going to be an issue with isoformat -- sometimes it has microseconds and sometimes it doesn't | 13:15 |
| *** Raildo_ has quit IRC | 13:15 | |
| *** stevemar has joined #openstack-keystone | 13:17 | |
| *** ChanServ sets mode: +v stevemar | 13:17 | |
| dolphm | bknudson: it's actually based on non-zero microseconds? | 13:17 |
| dolphm | as in, blatant transient issue...? | 13:17 |
| bknudson | dolphm: yes, whether it includes the microseconds or not | 13:17 |
| * dolphm *facepalm* | 13:18 | |
| bknudson | right, it's usually going to include the microseconds | 13:18 |
| bknudson | the chances are slim of getting 0, but if it happens to you you're going to be confused | 13:18 |
| dolphm | and tempest is going to balk | 13:19 |
| dolphm | there's probably already a bug report floating around somewhere | 13:20 |
| dolphm | or at least some failed gate jobs that someone blindly rechecked | 13:20 |
| *** Raildo__ has quit IRC | 13:21 | |
| *** zzzeek has joined #openstack-keystone | 13:23 | |
| bknudson | dims_: what was the reason for rolling back the oslo.serialization change? is there a bug? | 13:26 |
| dims_ | bknudson: we changed the wireformat and nova cells did not like it | 13:28 |
| dims_ | bknudson: not an api change | 13:28 |
| bknudson | that's pretty much the same issue we'd have with changing the timestamp format in a token | 13:28 |
| *** jsavak has joined #openstack-keystone | 13:32 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Switch from deprecated isotime https://review.openstack.org/187751 | 13:32 |
| bknudson | that's interesting that isotime has subsecond=False... you'd think we'd usually want subsecond resolution | 13:34 |
| bknudson | computers can do a lot in a second | 13:34 |
| *** fhubik is now known as fhubik_afk | 13:34 | |
| *** fhubik_afk is now known as fhubik | 13:35 | |
| *** fhubik is now known as fhubik_afk | 13:35 | |
| dims_ | bknudson: this is the one i mentioned - https://review.openstack.org/#/c/187306/ | 13:35 |
| *** henrynash has joined #openstack-keystone | 13:36 | |
| *** ChanServ sets mode: +v henrynash | 13:36 | |
| bknudson | the change in the test makes it pretty obvious that it's breaking backwards-compat | 13:37 |
| bknudson | https://review.openstack.org/#/c/187306/2/oslo_serialization/jsonutils.py changed a use of isoformat() to strtime() ... but I thought we were supposed to switch to isoformat | 13:38 |
| *** iamjarvo has quit IRC | 13:38 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Listing policies filtered by service endpoint URL https://review.openstack.org/186765 | 13:39 |
| samueldmq | ayoung, dolphm ^ | 13:39 |
| ayoung | samueldmq, um... | 13:40 |
| *** mabrams has left #openstack-keystone | 13:40 | |
| ayoung | we probably need to merge that to a single policy. Is that how it works now? returns multiple? | 13:40 |
| *** gokrokve has joined #openstack-keystone | 13:41 | |
| samueldmq | ayoung, the return of /policies is a list | 13:41 |
| *** e0ne is now known as e0ne_ | 13:41 | |
| *** e0ne_ is now known as e0ne | 13:41 | |
| samueldmq | ayoung, although a call closer to /policy?endpoint_url=<...> would make more sense | 13:41 |
| samueldmq | ayoung, since (at least for now) we have only a policy per endpoint | 13:42 |
| *** fhubik_afk is now known as fhubik | 13:42 | |
| ayoung | samueldmq, yeah. that was my intention here | 13:42 |
| ayoung | oh, well, this is probably right....I need to think about it. | 13:43 |
| *** dan_ has joined #openstack-keystone | 13:43 | |
| *** dan_ is now known as Guest83679 | 13:43 | |
| samueldmq | ayoung, ok | 13:45 |
| *** henrynash has quit IRC | 13:46 | |
| samueldmq | ayoung, also I need to talk to you regarding the unified policy thing, although I need to go in a bit | 13:46 |
| *** geoffarnold_ is now known as geoffarnold | 13:47 | |
| samueldmq | ayoung, did you see sdague's comment in the ML ? | 13:47 |
| ayoung | samueldmq, yeah, unified is going to take some work. But it will be worth it in the long run. | 13:47 |
| openstackgerrit | Merged openstack/keystonemiddleware: Depend on keystoneclient for expiration checking https://review.openstack.org/174197 | 13:48 |
| samueldmq | ayoung, basically, policies change in different timings for different projects, unifying them may be a trap when services changes its their APIs | 13:48 |
| samueldmq | ayoung, services versions would be very dependent on the new policy management service version | 13:49 |
| samueldmq | ayoung, people shoudl be free from having to do lock step upgrades of everything all at once, not make them have to do more of that | 13:49 |
| samueldmq | ayoung, I think this point is fair, and we really need to consider it | 13:49 |
| ayoung | samueldmq, let me catch up...they are all good points. | 13:49 |
| samueldmq | ayoung, yes, I had a conversation earlier with sdague in the nova channel, you can take a look there later if you want | 13:50 |
| *** dsirrine has quit IRC | 13:50 | |
| *** fhubik is now known as fhubik_afk | 13:53 | |
| samueldmq | ayoung, I need to go afk for a bit, back soon (time to you to catch up) :) | 13:53 |
| *** henrynash has joined #openstack-keystone | 13:54 | |
| *** ChanServ sets mode: +v henrynash | 13:54 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:54 | |
| *** gokrokve has quit IRC | 13:57 | |
| *** gokrokve has joined #openstack-keystone | 13:58 | |
| *** jistr|mtg is now known as jistr | 13:59 | |
| *** topol has joined #openstack-keystone | 13:59 | |
| *** ChanServ sets mode: +v topol | 13:59 | |
| *** dsirrine has joined #openstack-keystone | 14:02 | |
| *** csoukup has joined #openstack-keystone | 14:02 | |
| *** Kennan2 has quit IRC | 14:02 | |
| *** Kennan has joined #openstack-keystone | 14:03 | |
| lbragstad | henrynash: around? wondering if this has something to do with the sql domain stuff -- https://bugs.launchpad.net/keystone/+bug/1461299 | 14:04 |
| openstack | Launchpad bug 1461299 in Keystone "Failure on list users when using ldap domain configuration from database" [Undecided,New] - Assigned to Roxana Gherle (roxana-gherle) | 14:04 |
| henrynash | lbragstad: looking | 14:05 |
| rodrigods | marekd, stevemar what was the conclusion regarding the mapping lib? | 14:07 |
| rodrigods | couldn't attend the meeting yesterday | 14:07 |
| marekd | rodrigods: stays in keystone | 14:07 |
| rodrigods | hmm | 14:07 |
| henrynash | lbragstad: I’ve asked for a debug log….sicne can’t really tell from the initial info where the problem lies | 14:09 |
| openstackgerrit | Divya K Konoor proposed openstack/pycadf: Add api_audit_map.conf for Ceilometer project https://review.openstack.org/187593 | 14:09 |
| *** blewis has joined #openstack-keystone | 14:09 | |
| lbragstad | henrynash: yeah, it seemed a little vague, but want to check with you if it seemed like it was on that path | 14:09 |
| henrynash | lbragstad: sounds lile some error we are throwing that is badly formatted….coul dbe in teh domain config stuff, yes | 14:11 |
| dstanek | lbragstad: henrynash: looks like someone is using str() on one of the object returned by the i18n helpers | 14:12 |
| *** samuel-dmq has joined #openstack-keystone | 14:12 | |
| lbragstad | dstanek: ++ | 14:12 |
| *** fhubik_afk is now known as fhubik | 14:12 | |
| *** triggerz is now known as tobasco | 14:14 | |
| *** blewis has quit IRC | 14:18 | |
| bknudson | our team in china has the DB2 CI running again -- http://dal05.objectstorage.softlayer.net/v1/AUTH_58396f85-2c60-47b9-aaf8-e03bc24a1a6f/cilog/51/187751/1/only-comments/ibm-db2-ci-keystone/c58ba2b/ | 14:18 |
| bknudson | they're wondering if they can get approval to start posting results for all change sets | 14:18 |
| bknudson | I'll add it to the meeting agenda, but would be nice to not have to wait a week | 14:19 |
| *** blewis has joined #openstack-keystone | 14:19 | |
| dstanek | bknudson: why was the time function deprecated in oslo? | 14:20 |
| samuel-dmq | bknudson, it runs keystone tests against DB2, right ? | 14:20 |
| *** blewis` has joined #openstack-keystone | 14:20 | |
| samuel-dmq | bknudson, I remember to already have seen this in the past | 14:20 |
| bknudson | dstanek: here's the review that deprecated it: https://review.openstack.org/#/c/182602/ | 14:22 |
| bknudson | samuel-dmq: the DB2 CI sets up a system with DB2 and runs some tempest tests... so it goes through the migration and exercises some functions | 14:23 |
| bknudson | samuel-dmq: it was turned off after it started posting failures for no reason. The team in china has been working to fix the problems and they say it's working now. | 14:23 |
| *** henrynash has quit IRC | 14:24 | |
| *** blewis has quit IRC | 14:24 | |
| samuel-dmq | bknudson, nice, I think it would be great to have it back | 14:24 |
| samuel-dmq | bknudson, although I think it would be non-voting so them we can ensure it is working well again | 14:24 |
| *** david-lyle has quit IRC | 14:25 | |
| bknudson | samuel-dmq: y... I don't think it's possible to make external CI jobs voting. | 14:25 |
| samuel-dmq | bknudson, nice, makes sense | 14:26 |
| *** timcline has joined #openstack-keystone | 14:27 | |
| *** rwsu has quit IRC | 14:31 | |
| *** henrynash has joined #openstack-keystone | 14:31 | |
| *** ChanServ sets mode: +v henrynash | 14:31 | |
| *** henrynash has quit IRC | 14:32 | |
| *** iamjarvo has joined #openstack-keystone | 14:32 | |
| *** iamjarvo has quit IRC | 14:32 | |
| *** iamjarvo has joined #openstack-keystone | 14:33 | |
| *** pnavarro has quit IRC | 14:34 | |
| *** raildo has joined #openstack-keystone | 14:39 | |
| *** afazekas has quit IRC | 14:43 | |
| *** henrynash has joined #openstack-keystone | 14:44 | |
| *** ChanServ sets mode: +v henrynash | 14:44 | |
| *** henrynash has quit IRC | 14:44 | |
| *** henrynash has joined #openstack-keystone | 14:45 | |
| *** ChanServ sets mode: +v henrynash | 14:45 | |
| davidckennedy | Had me worried there for a second ayoung until I realised I'd already pushed https://review.openstack.org/#/c/153296/ into the canal. | 14:48 |
| *** fhubik is now known as fhubik_afk | 14:49 | |
| ayoung | davidckennedy, heh | 15:01 |
| ayoung | davidckennedy, you happy with the direction we are headed with endpoint binding? | 15:01 |
| ayoung | davidckennedy, btw, gyee is wrong in his comment | 15:02 |
| ayoung | "It should use the "default" rule if global target is not defined in policy.json." no it should not. That rule will be enforced later on. | 15:03 |
| *** kiran-r has joined #openstack-keystone | 15:05 | |
| *** henrynash has quit IRC | 15:08 | |
| *** henrynash has joined #openstack-keystone | 15:09 | |
| *** ChanServ sets mode: +v henrynash | 15:09 | |
| *** HT_sergio has joined #openstack-keystone | 15:10 | |
| *** iamjarvo has quit IRC | 15:10 | |
| *** bdossant has quit IRC | 15:11 | |
| *** kiran-r has quit IRC | 15:13 | |
| *** iamjarvo has joined #openstack-keystone | 15:14 | |
| *** mestery_ has joined #openstack-keystone | 15:17 | |
| *** rwsu has joined #openstack-keystone | 15:19 | |
| *** mestery has quit IRC | 15:20 | |
| marekd | gyee, stevemar: please look at it https://review.openstack.org/#/c/187516/3 | 15:24 |
| *** fhubik_afk is now known as fhubik | 15:25 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Add protocol docstring in FederationBaseAuthPlugin https://review.openstack.org/187610 | 15:28 |
| *** fhubik has quit IRC | 15:30 | |
| *** mestery_ is now known as mestery | 15:30 | |
| *** henrynash has quit IRC | 15:32 | |
| *** e0ne is now known as e0ne_ | 15:32 | |
| *** kiran-r has joined #openstack-keystone | 15:35 | |
| *** e0ne_ is now known as e0ne | 15:35 | |
| *** david-lyle has joined #openstack-keystone | 15:39 | |
| *** hemnafk is now known as hemna | 15:41 | |
| *** david-lyle has quit IRC | 15:47 | |
| *** david-lyle has joined #openstack-keystone | 15:53 | |
| *** radez_g0n3 is now known as radez | 16:01 | |
| *** davidchep has joined #openstack-keystone | 16:03 | |
| *** rushiagr_away is now known as rushiagr | 16:03 | |
| *** samuel-dmq has quit IRC | 16:05 | |
| *** belmoreira has quit IRC | 16:07 | |
| *** _cjones_ has joined #openstack-keystone | 16:07 | |
| *** jistr has quit IRC | 16:11 | |
| *** gokrokve_ has joined #openstack-keystone | 16:12 | |
| *** afazekas has joined #openstack-keystone | 16:12 | |
| *** kiranr has joined #openstack-keystone | 16:14 | |
| *** kiran-r has quit IRC | 16:14 | |
| *** gokrokve has quit IRC | 16:14 | |
| *** dims_ has quit IRC | 16:18 | |
| *** dims_ has joined #openstack-keystone | 16:18 | |
| *** SaintAardvark has joined #openstack-keystone | 16:19 | |
| *** gordc is now known as gordc_afk | 16:19 | |
| *** dims__ has joined #openstack-keystone | 16:20 | |
| *** jamielennox is now known as jamielennox|away | 16:21 | |
| *** david-lyle has quit IRC | 16:22 | |
| *** spandhe has joined #openstack-keystone | 16:22 | |
| *** gyee has joined #openstack-keystone | 16:23 | |
| *** ChanServ sets mode: +v gyee | 16:23 | |
| *** alanf-mc has joined #openstack-keystone | 16:24 | |
| *** dims_ has quit IRC | 16:24 | |
| *** spandhe has quit IRC | 16:27 | |
| *** lhcheng has joined #openstack-keystone | 16:32 | |
| *** ChanServ sets mode: +v lhcheng | 16:32 | |
| ayoung | david8hu, davidckennedy samueldmq, davechen_afk I'm going to push for having policy based discussions on openstack-dev for now, to make it more of a Cross project effort. Can you guys check in there, please, if you are not already | 16:33 |
| *** kiranr has quit IRC | 16:36 | |
| *** _kiran_ has joined #openstack-keystone | 16:36 | |
| david8hu | ayoung, yes, I do subscribe to openstack-dev mailing list. I think it is a good idea since it gets a lot more exposure. | 16:36 |
| *** dand has joined #openstack-keystone | 16:38 | |
| *** dand has left #openstack-keystone | 16:38 | |
| dstanek | morganfainberg, bknudson, gyee: this is what i was thinking for the useragent fix - http://paste.openstack.org/show/259856/ | 16:38 |
| gyee | ayoung, I am confused by your policy fetch interval email | 16:38 |
| dstanek | i just don't like how we get project, but i don't know what would be the right way | 16:38 |
| *** dand has joined #openstack-keystone | 16:38 | |
| gyee | thought we only fetch on the needed basis | 16:39 |
| gyee | dstanek, looking | 16:39 |
| ayoung | gyee, fetch and cache, hold for 1 minute (or 5) | 16:39 |
| ayoung | if the cache is invalid, refetch | 16:39 |
| gyee | ayoung, no, I thought we are going with burning the policy hash in the token | 16:39 |
| *** marzif_ has joined #openstack-keystone | 16:39 | |
| ayoung | gyee, not this go-round | 16:39 |
| gyee | and fetch only if the policy version is not found in the cache | 16:39 |
| bknudson | dstanek: that's neat. | 16:39 |
| ayoung | gyee, maybe long term...but I was not proposing that yet | 16:40 |
| gyee | ayoung, why not? | 16:40 |
| gyee | lets do this right | 16:40 |
| bknudson | dstanek: seems like anything is better than what we've got | 16:40 |
| dstanek | bknudson: there isn't any tests on the original review so i have to get a few of those before i resubmit | 16:40 |
| ayoung | gyee, write up the spec. I have no problem with it....that I can think of off the top of my head. | 16:40 |
| gyee | as sean mentioned, we want to avoid roundtrips to keystone as much as possible | 16:40 |
| bknudson | tests? what for? | 16:40 |
| bknudson | that just slows us down | 16:41 |
| gyee | ayoung, sure | 16:41 |
| dstanek | can i quote you on that? | 16:41 |
| ayoung | gyee, it will increas token payload, but only a little bit...woud not need to be in the signed portion of the fernet tokens...I think? | 16:41 |
| stevemar | morganfainberg, are we doing a point release of ksc to release jamielennox's? ec2 stuff? | 16:41 |
| *** _kiran_ has quit IRC | 16:41 | |
| ayoung | in fact...we would not want it in the signed portion | 16:42 |
| gyee | ayoung, exactly | 16:42 |
| gyee | because fernet tokens are constructed on validation | 16:42 |
| gyee | dstanek, that works only if the package is installed via pip right? | 16:43 |
| ayoung | gyee, what would we do about PKI? Just leave the old policy in place? | 16:43 |
| gyee | ayoung, sure, default policy is a fallback | 16:43 |
| gyee | but it should be configurable | 16:43 |
| gyee | that's how it works today I think | 16:44 |
| dstanek | gyee: pip or distutils | 16:44 |
| ayoung | revoke by policyid? | 16:45 |
| ayoung | heh | 16:45 |
| gyee | dstanek, I am afraid if the package is installed via rpm, debian, etc, this won't work | 16:45 |
| dstanek | gyee: i'll test, but it should | 16:45 |
| gyee | ayoung, actually, revoke by policy ain't bad | 16:46 |
| gyee | dstanek, that would be awesome if its package agnostic | 16:46 |
| *** gokrokve has joined #openstack-keystone | 16:46 | |
| stevemar | morganfainberg, can someone else release keystoneclient? cc dou.. dh.. dammit | 16:46 |
| dstanek | gyee: checking on debian now | 16:48 |
| ayoung | gyee, so...getting the policy ID into the token would be, I think, after a fetch and cache strategy. We need to go incremental here, but we can certainly get that spec written and prioritized. | 16:48 |
| *** gokrokve_ has quit IRC | 16:49 | |
| *** gokrokve has quit IRC | 16:51 | |
| morganfainberg | stevemar: jamielennox|away can. I just didn't push the tag. Will be done this morning. | 16:53 |
| gyee | ayoung, agree, baby steps I suppose | 16:55 |
| gyee | dstanek, thanks! | 16:55 |
| *** afazekas has quit IRC | 16:55 | |
| *** belmoreira has joined #openstack-keystone | 16:58 | |
| dstanek | gyee: success | 16:59 |
| dstanek | gyee: on a virgin debian 7 boxen http://paste.openstack.org/show/259868/ | 16:59 |
| gyee | dstanek, nice! U DA MAN! | 17:00 |
| dstanek | gyee: i may test fedora just for fun | 17:01 |
| *** dand has quit IRC | 17:03 | |
| *** spandhe has joined #openstack-keystone | 17:03 | |
| gyee | let me get an HP monkey to test hLinux | 17:03 |
| gyee | stevemar, bknudson, you guys buying bluebox :) | 17:04 |
| *** roxanaghe has joined #openstack-keystone | 17:05 | |
| gyee | roxanaghe, say hi to dstanek | 17:08 |
| stevemar | gyee, not me personally, but apparently yes | 17:09 |
| *** afazekas has joined #openstack-keystone | 17:09 | |
| roxanaghe | haha | 17:09 |
| roxanaghe | hi dstanek, looking forward for your patch :) | 17:09 |
| gyee | roxanaghe, dstanek like his thanks in the form of beer | 17:10 |
| gyee | I think | 17:10 |
| dstanek | hi roxanaghe | 17:10 |
| dstanek | gyee: who wouldn't? | 17:10 |
| roxanaghe | that can be arranged of course | 17:10 |
| roxanaghe | anything for an expert patch | 17:11 |
| *** jsavak has quit IRC | 17:11 | |
| *** radez is now known as radez_g0n3 | 17:11 | |
| *** david-lyle has joined #openstack-keystone | 17:13 | |
| *** david-lyle has quit IRC | 17:13 | |
| *** josecastroleon has quit IRC | 17:14 | |
| *** dand has joined #openstack-keystone | 17:14 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/186932 | 17:15 |
| *** david-lyle has joined #openstack-keystone | 17:15 | |
| *** dguerri is now known as dguerri`away | 17:15 | |
| *** rushiagr is now known as rushiagr_away | 17:15 | |
| openstackgerrit | Merged openstack/pycadf: Add api_audit_map.conf for Ceilometer project https://review.openstack.org/187593 | 17:16 |
| dstanek | gyee: centos is a pain, but it works | 17:16 |
| *** e0ne has quit IRC | 17:17 | |
| gyee | dstanek, centos using apt-get right? | 17:18 |
| dstanek | ? | 17:18 |
| gyee | what's centos's package management? apt-get? | 17:19 |
| dstanek | yum, it's based on RHEL | 17:19 |
| *** spandhe has quit IRC | 17:22 | |
| roxanaghe | dstanek, for the user-agent patch - do you think we also need a code change in swift - in order to pass a project='swift' type of value ? | 17:23 |
| roxanaghe | I've been looking to see if there is any good configuration value set for swift that we can use in keystonemiddleware.auth_token.. | 17:24 |
| roxanaghe | but I didin't find one yet | 17:24 |
| *** iamjarvo has quit IRC | 17:24 | |
| *** iamjarvo has joined #openstack-keystone | 17:26 | |
| dstanek | roxanaghe: the way i have it coded make it unnecessary, but it would be nice to somehow know it's switf | 17:27 |
| dstanek | roxanaghe: did you see the paste i created? | 17:28 |
| *** david-lyle has quit IRC | 17:28 | |
| roxanaghe | yup, gyee forwarded it to me | 17:28 |
| roxanaghe | but with that code you still won't have a user-agent for swift | 17:29 |
| roxanaghe | dstanek ^^ | 17:29 |
| *** lihkin has joined #openstack-keystone | 17:30 | |
| openstackgerrit | Merged openstack/keystoneauth: Add default domain to fixture.v3.V3FederationToken https://review.openstack.org/187516 | 17:32 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/186932 | 17:33 |
| *** geoffarnold has quit IRC | 17:35 | |
| dstanek | roxanaghe: not the correct user-agent at leaset | 17:35 |
| *** samleon has joined #openstack-keystone | 17:38 | |
| *** henrynash has joined #openstack-keystone | 17:38 | |
| *** ChanServ sets mode: +v henrynash | 17:38 | |
| *** gordc_afk is now known as gordc | 17:39 | |
| *** iamjarvo has quit IRC | 17:39 | |
| *** kiran-r has joined #openstack-keystone | 17:41 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/186932 | 17:44 |
| *** radez_g0n3 is now known as radez | 17:46 | |
| *** iamjarvo has joined #openstack-keystone | 17:52 | |
| gyee | henrynash, for the list role assignment for subtree spec, I have a mockup impl here https://review.openstack.org/#/c/180846/ | 17:53 |
| *** dguerri`away is now known as dguerri | 17:59 | |
| *** RichardRaseley has joined #openstack-keystone | 18:00 | |
| *** lihkin has quit IRC | 18:01 | |
| RichardRaseley | Pardon the possibly incorrect terminology, but is the Keystone v3 API a requirement for us to use a 'split identity' configuration? For example, I want my OpenStack services accounts (and role assignments) in the SQL backend, but integrate with LDAP for user identities. | 18:01 |
| *** kiran-r has quit IRC | 18:02 | |
| *** belmoreira has quit IRC | 18:02 | |
| *** lihkin has joined #openstack-keystone | 18:02 | |
| *** tqtran has joined #openstack-keystone | 18:04 | |
| gyee | RichardRaseley, yes, domain-specific backend is a V3 feature only | 18:05 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Revocation engine refactoring https://review.openstack.org/188131 | 18:06 |
| RichardRaseley | gyee: Thank you, that helps tremendously. | 18:06 |
| bknudson | v2 doesn't support domains, it only works with "default" domain | 18:06 |
| *** afazekas has quit IRC | 18:07 | |
| *** spandhe has joined #openstack-keystone | 18:07 | |
| breton | memcache_pool is terrible. | 18:09 |
| *** amakarov_away is now known as amakarov | 18:09 | |
| *** rlt_ has quit IRC | 18:10 | |
| amakarov | breton, it gets all it can out of the horrible python-memcached :) | 18:10 |
| dstanek | breton: in other apps i've worked on i've never had a need for anything like it | 18:11 |
| breton | yeah, python-memcached is terrible too. | 18:12 |
| breton | we rewrite more and more portions of it to make it scalable and HA | 18:13 |
| dstanek | python-memcached will probably be replaced by one of the alternatives soon - there is already a plan for it | 18:17 |
| *** amakarov is now known as amakarov_away | 18:18 | |
| *** marzif_ has quit IRC | 18:19 | |
| *** marzif_ has joined #openstack-keystone | 18:19 | |
| zzzeek | hey keystone, is “DeprecationWarning: Using function/method 'oslo_utils.timeutils.isotime()' is deprecated in version '1.6' and will be removed in a future version: use datetime.datetime.isoformat()” something you are all dealing with or is my specific test environment (I run a subset of Keystone tests against SQLAlchemy master) needing changes ? | 18:21 |
| dstanek | zzzeek: yes, bknudson has a fix to disable the error | 18:21 |
| bknudson | zzzeek: the fix is working it's way through the gate -- https://review.openstack.org/#/c/187751/ | 18:21 |
| zzzeek | dstanek: ok great :) | 18:21 |
| zzzeek | bknudson: thanks | 18:21 |
| *** elmiko has joined #openstack-keystone | 18:31 | |
| elmiko | dolphm: hey, do you have a minute to talk about the api-wg ? | 18:31 |
| dolphm | elmiko: what's up? | 18:31 |
| elmiko | not much, i'm just doing some outreach to the listed liaisons to raise some awareness of a few docs that currently in the works | 18:31 |
| dolphm | elmiko: hit me! | 18:32 |
| elmiko | one is a set of proposed merge guidelines for the wg process; https://review.openstack.org/#/c/186836/ | 18:32 |
| elmiko | the other is some liaison responsibilities that the nova folks have put together to experiment with; https://wiki.openstack.org/wiki/Nova/APIWGLiaisons | 18:32 |
| elmiko | i think in the next few weeks we will start to ramp up our messaging on the ml about upcoming guidelines | 18:33 |
| elmiko | the biggest change is our effort to get more inclusion of the liaisons in the final guideline merge process | 18:33 |
| *** david-lyle has joined #openstack-keystone | 18:33 | |
| elmiko | so, i'm just making the rounds and saying hi to everyone, passing the links on =) | 18:33 |
| dolphm | elmiko: cool, i'll review/read both | 18:34 |
| elmiko | and of course, if you have any questions or concerns we're usually hanging out in openstack-api, and i'm mostly pingable | 18:34 |
| elmiko | dolphm: cool, thanks for your time =) | 18:34 |
| *** spandhe has left #openstack-keystone | 18:35 | |
| dolphm | elmiko: ooh, another channel to join! | 18:35 |
| elmiko | hehe | 18:35 |
| *** gokrokve has joined #openstack-keystone | 18:39 | |
| morganfainberg | stevemar, jamielennox|away: python-keystoneclient 1.6.0 released | 18:39 |
| bknudson | on to 2.0! | 18:39 |
| morganfainberg | stevemar, jamielennox|away: cna one of you send the release notes to the ML for me? | 18:39 |
| morganfainberg | i need to duck into another meeting | 18:39 |
| *** aix has quit IRC | 18:39 | |
| morganfainberg | bknudson: ^ cc | 18:39 |
| * morganfainberg forgot to push the tag last night or it would have already been sent | 18:40 | |
| *** elmiko has left #openstack-keystone | 18:48 | |
| *** spandhe has joined #openstack-keystone | 18:49 | |
| lifeless | bknudson: hai | 18:50 |
| bknudson | lifeless: hi | 18:50 |
| lifeless | bknudson: if you have time to talk about the multiple requirements file thing, I'd like that | 18:50 |
| lifeless | bknudson: as in, why are there multiple test requirements files for keystone | 18:50 |
| bknudson | lifeless: sure. | 18:50 |
| lifeless | what triggers adding new ones | 18:51 |
| bknudson | there's one for py26, one for py33 | 18:51 |
| bknudson | one for -bandit | 18:51 |
| bknudson | one for functional tests | 18:51 |
| bknudson | I think that's it | 18:51 |
| lifeless | the py26 and 33 ones will go away entirely with environment markers, which should be usable with the next image that infra successfully build | 18:51 |
| openstackgerrit | Merged openstack/keystone: Switch from deprecated isotime https://review.openstack.org/187751 | 18:52 |
| lifeless | whats in the bandit and functional ones ? what drove creating dedicated files? | 18:52 |
| bknudson | y, and once we get all our deps working with py34 then we'll only need the one | 18:52 |
| lifeless | could you expand on that? With marks you should be able to have just one right now | 18:52 |
| lifeless | 'markers' | 18:53 |
| bknudson | lifeless: for the functional tests, we had the requirements in tox.ini | 18:53 |
| bknudson | lifeless: do you have docs on using markers? <-- dstanek | 18:53 |
| bknudson | lifeless: since the reqs were in tox.ini, they weren't updated automatically by the tool so they were out of date | 18:53 |
| lifeless | http://docs.openstack.org/developer/pbr/#environment-markers | 18:54 |
| dstanek | oh, neat | 18:54 |
| lifeless | I'm doing the work to make update.py update setup.cfg atm | 18:54 |
| dstanek | using that for functional tests is a good idea | 18:54 |
| lifeless | so I don't see anything problematic in test-requirements-functional | 18:54 |
| lifeless | can't it just be in test-requirements? | 18:55 |
| *** mordred has quit IRC | 18:55 | |
| *** mordred has joined #openstack-keystone | 18:55 | |
| lifeless | huh, keystone still uses nose | 18:55 |
| lifeless | I thought everyone had migrated | 18:56 |
| lifeless | anyhow no matter, ignore my squirrel there :) | 18:56 |
| dstanek | lifeless: nose is for py3 tests | 18:56 |
| lifeless | dstanek: why? | 18:56 |
| dstanek | lifeless: so we can list the files to be tested - this may have already changed, but not everything was importable in Py3 | 18:57 |
| *** marzif_ has quit IRC | 18:57 | |
| lifeless | dstanek: I mean, I'm confused. You can do the same with testtools (and by extension testr) - you don't have to use discovery | 18:58 |
| lifeless | if its not straight forward we can certainly add a thing to do what you need without switching runner | 18:58 |
| * lifeless focuses back on the first thing | 18:58 | |
| dstanek | lifeless: i was told that it was not possible and followed the lead of a few other projects | 18:58 |
| lifeless | dstanek: noone spoke to upstream about it at all :( | 18:59 |
| bknudson | I don't have a problem with putting test-requirements-functional in test-requirements. | 19:00 |
| bknudson | as I said they were in tox.ini before so that wasn't going to work | 19:01 |
| *** RichardRaseley has quit IRC | 19:01 | |
| bknudson | I can propose that, or if dstanek has a minute? | 19:01 |
| lifeless | bandit too seems unobjectionable | 19:01 |
| bknudson | the annoying thing with mixing bandit with all the other test reqs is that it will slow down the bandit run | 19:02 |
| dstanek | bknudson: propose a change to use markers? i can do it if you don't have the time right now | 19:02 |
| bknudson | all bandit requires is bandit | 19:02 |
| lifeless | bknudson: really? | 19:02 |
| lifeless | bknudson: let me do a couple timing runs | 19:03 |
| bknudson | keystone test-requirements has lxml | 19:03 |
| *** alanf-mc has quit IRC | 19:03 | |
| bknudson | dstanek: y, if you want to try using markers that would be neat, otherwise just merge test-requirements-functional into test-requirements | 19:04 |
| lifeless | bknudson: yes but that caches now | 19:05 |
| lifeless | bknudson: just setting up a throwaway container | 19:05 |
| *** timcline has quit IRC | 19:05 | |
| *** alanf-mc has joined #openstack-keystone | 19:07 | |
| bknudson | real 0m32.121s vs real 0m24.196s | 19:07 |
| bknudson | that's on my dev system. | 19:07 |
| bknudson | so having a separate test-requirements-bandit is probably not worth it. | 19:08 |
| bknudson | considering how often I plan on running it. | 19:08 |
| lifeless | hmm, I think we want wheel in virtualenv these days. I'll chase dstufft on that :) | 19:09 |
| lifeless | ahha already there | 19:10 |
| lifeless | first run, seeding stuff - 1m38 to create-and-run | 19:12 |
| lifeless | second run 26s to create-and-run | 19:13 |
| lifeless | cached wheels FTW | 19:13 |
| lifeless | bknudson: ^ | 19:13 |
| *** e0ne has joined #openstack-keystone | 19:13 | |
| bknudson | when the tox env was already primed it real 0m15.590s | 19:14 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move bandit requirements into test-requirements.txt https://review.openstack.org/188152 | 19:17 |
| openstackgerrit | lifeless proposed openstack/keystone: Consolidate test-requirements files. https://review.openstack.org/188154 | 19:17 |
| lifeless | hah | 19:18 |
| lifeless | bknudson: sorry for overlapping | 19:18 |
| lifeless | bknudson: I did both in my patch FWIW, but happy to abandon or rebase on yours or wahtever | 19:18 |
| bknudson | lifeless: is there some trick with env markers that can be used here? | 19:18 |
| bknudson | I think dstanek was looking into that. | 19:19 |
| bknudson | l already abandoned mine. | 19:19 |
| lifeless | bknudson: there's a couple things we could do if it it matters. We can in principle[not tested] specify a custom variable to test against and use that to filter | 19:19 |
| bknudson | bandit probably should have a fixture that can be loaded for unit tests. | 19:19 |
| lifeless | bknudson: but since the deps in the split out files were so uninteresting, I don't think there's any point | 19:19 |
| bknudson | let's keep it simple. | 19:22 |
| dstanek | lifeless: bknudson: i think that looks good | 19:29 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Run WSGI with group=keystone https://review.openstack.org/187800 | 19:29 |
| lifeless | 42s to create-and-run with cached wheels | 19:31 |
| lifeless | 10s to run with a cached venv | 19:31 |
| lifeless | so it seems entirely feasible any which way to me; the build of the install time is in keystone itself | 19:31 |
| *** iamjarvo has quit IRC | 19:39 | |
| htruta | morganfainberg, henrynash, ayoung: did you see David's suggestion on how to solve the delimiter problem in reseller? | 19:48 |
| raildo | ^ http://www.mail-archive.com/openstack-dev@lists.openstack.org/msg54582.html | 19:49 |
| *** timcline has joined #openstack-keystone | 19:51 | |
| *** timcline has quit IRC | 19:52 | |
| *** alanf-mc has quit IRC | 19:55 | |
| dstanek | htruta: question about your delimiter email | 19:59 |
| dstanek | htruta: what domain_id does the 'is_domain' project have? | 20:00 |
| htruta | it has its id | 20:00 |
| *** geoffarnold has joined #openstack-keystone | 20:00 | |
| *** iamjarvo has joined #openstack-keystone | 20:00 | |
| htruta | dstanek: is_domain project with id A has domain_id A | 20:00 |
| *** geoffarnold has quit IRC | 20:01 | |
| dstanek | so that is_domain project can't have the same name as its children right? | 20:01 |
| raildo | dstanek, a is_domain project can have the same name then a not is_domain project that its your children, | 20:02 |
| *** tqtran has quit IRC | 20:02 | |
| *** tqtran has joined #openstack-keystone | 20:03 | |
| raildo | in other way, I can have a project with the same name then a domain (project with is domain flag enabled) | 20:03 |
| dstanek | so the domain_id of the child is a real domain and not the is_domain project | 20:03 |
| dstanek | ? | 20:03 |
| *** alanf-mc has joined #openstack-keystone | 20:03 | |
| htruta | dstanek: there won't be any "real domains" | 20:03 |
| raildo | domain is the is_domain project. | 20:04 |
| htruta | the is_domain projects will be the domains, and the domain_id of the child will be that one | 20:04 |
| raildo | in the htruta example, we have A (is_domain=true)-> B -> A (is_domain=false) | 20:04 |
| htruta | ^these three projects have the same domain_id, which is A's id | 20:05 |
| dstanek | in each of those projects what is the domain_id set to? | 20:05 |
| dstanek | but don't we have a unique constraint on domain_id/name? | 20:05 |
| htruta | dstanek: we've changed the constraint | 20:06 |
| htruta | it now is domain_id, name, is_domain | 20:06 |
| raildo | dstanek, https://review.openstack.org/#/c/158372/ | 20:06 |
| *** topol has quit IRC | 20:06 | |
| htruta | I guess that's because we won't break some v3 contract the allows creating a project inside a domain with the domain name | 20:06 |
| dstanek | ah, that review is what i was missing | 20:08 |
| dstanek | htruta: do we actually need to use a delimiter instead of just specifying a list? | 20:08 |
| *** lihkin has quit IRC | 20:09 | |
| *** e0ne is now known as e0ne_ | 20:09 | |
| htruta | that's what morganfainberg has been saying... | 20:10 |
| dstanek | unless we need it in a url i don't see the need | 20:10 |
| *** geoffarnold has joined #openstack-keystone | 20:10 | |
| htruta | he said that we've already caused too much headache to ourselves, by allowing the user to user any character | 20:10 |
| *** lihkin has joined #openstack-keystone | 20:10 | |
| htruta | as a remember, since the beginning of HMT, we've been postponing this hierarchy representation | 20:11 |
| htruta | which I think is the most logical one | 20:11 |
| htruta | BTW, we don't even need to pass the whole hierarchy. I'd be fine with something like: "A.A" means the is_domain project, no matter which level it is | 20:12 |
| htruta | sorry, the is_domain=False project | 20:12 |
| htruta | while passing only name="A" would mean the is_domain project, when a conflict happens | 20:13 |
| *** alanf-mc has quit IRC | 20:13 | |
| htruta | that would be good because the is_domain=false project would not need to know the whole hierarchy until the is_domain A | 20:13 |
| *** e0ne_ is now known as e0ne | 20:14 | |
| *** alanf-mc has joined #openstack-keystone | 20:14 | |
| geoffarnold | Wouldn't that mean that Tempest tests would have to be aware of is_domain setting? Sounds like an interoperability nightmare | 20:14 |
| *** e0ne has quit IRC | 20:14 | |
| geoffarnold | By the way, this is not the first time this problem (the "oh bleep, we let people use any character in a name" problem) has occurred | 20:15 |
| *** alanf-mc has quit IRC | 20:16 | |
| geoffarnold | under POSIX, filenames could include any character, even slash | 20:17 |
| geoffarnold | this made slash-separated paths a bit of a problem, so the "FS1" environment variable was introduced to override slash as the default path separator | 20:18 |
| *** gokrokve has quit IRC | 20:18 | |
| htruta | geoffarnold: I see... wouldn't this be a good time to stop having these problems? | 20:18 |
| geoffarnold | and the icing on the cake was to allocate a special unicode character which could only be used for that purpose | 20:18 |
| geoffarnold | yes indeed | 20:18 |
| htruta | geoffarnold: that has some intersections with david chadwick's suggestion of each domain having a local delimiter | 20:19 |
| geoffarnold | yup | 20:19 |
| dstanek | htruta: so if the current domain abstraction goes away, what is A exists in 10 different projects (is_domain or not) | 20:21 |
| geoffarnold | given a time machine, i'd go back, ban the use of ".", ".." and "/", and then we could use normal POSIX path syntax (with FS1/FS2/FS3 overrides for crazies | 20:21 |
| geoffarnold | what do you mean by "goes away"? not dynamically? | 20:22 |
| htruta | dstanek: I'm not sure if I get your point... | 20:22 |
| geoffarnold | if I have an existing HMT tree, duplicate names in different branches are fine | 20:23 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Adds URL filter for GET /policies https://review.openstack.org/186874 | 20:25 |
| samueldmq | ayoung, ^ | 20:25 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: unified policy file https://review.openstack.org/134656 | 20:26 |
| dstanek | htruta: won't you always have to specify a fully qualified name? | 20:27 |
| ayoung | samueldmq, +2 from me. THanks | 20:27 |
| geoffarnold | htruta, +dstanek - i apologize for jumping into a long-running conversation without adequate background reading | 20:27 |
| ayoung | geoffarnold, I never apologize for that myself | 20:28 |
| htruta | dstanek: you mean, in the creation of the project? if so, we do not need | 20:28 |
| dstanek | geoffarnold: no need to apologize | 20:28 |
| geoffarnold | intuitively, this feels like a very familiar problem that's been solved several times before | 20:28 |
| dstanek | htruta: get_project_by_name or anything that operates on name instead of Id | 20:29 |
| htruta | if you're talking about on the token request...we might need it | 20:29 |
| raildo | dstanek, you just need to use domain_id (or name) and parent_id | 20:29 |
| samueldmq | ayoung, great, thanks :) | 20:29 |
| ayoung | samueldmq, so...on the "fetch" side, I think I can provide a little more insight | 20:30 |
| htruta | geoffarnold: no need to apologize at all | 20:31 |
| ayoung | samueldmq, we want the same "Enforcer" object like you see here: http://git.openstack.org/cgit/openstack/oslo.policy/tree/oslo_policy/policy.py#n312 | 20:31 |
| raildo | dstanek, sorry, in the get_project_by_name, it's just the domain_id. And now we add the is_domain flag. | 20:31 |
| ayoung | I kind of think that the number of command line params it takes is wrong...it does too much, but so what | 20:31 |
| htruta | btw, geoffarnold, dstanek, we could definitely use your opinion on the ML thread as well | 20:31 |
| geoffarnold | I'd like to understand why (if we assume we can solve the separator character issues) this doesn't simply reduce to relative and absolute pathnames with explicit or implicit chroot's when imposing domain scope | 20:32 |
| *** alanf-mc has joined #openstack-keystone | 20:33 | |
| ayoung | samueldmq, so...I would leave the Enforcer object as the proxy, and allow the user to swap out implementations of it. Kindof a bridge pattern | 20:33 |
| dstanek | raildo: so the only case where we need to specify a hierarchy is when a parent and child have the same name? | 20:34 |
| geoffarnold | and the problem of back-mapping from project ID to full path is just like the old Unix puzzle of reconstructing a path from an indoor number - tedious, but tractable (and eminently catchable) | 20:34 |
| ayoung | So, we extract out most of the logic of the existing enforcer into "StaticEnforcer" which is what you get loaded via stevedore by default, but then Keystonemiddleware registres adifferent enforcer class that does the fetch. | 20:34 |
| geoffarnold | why then, +dstanek? | 20:35 |
| geoffarnold | or have we overloaded something? | 20:35 |
| htruta | geoffarnold: we won't need absolute pathnames... only the relatives, once, at the worst case, I'd only need to know my subtree until my domain | 20:35 |
| raildo | dstanek, hum... for now, this is the only case that I see. because the other requests you can use domain_id (or name) and parent_id, since the project_name is unique in a domain. | 20:35 |
| htruta | dstanek: more specific than that... not a parent and a child. But an is_domain project AND a not is_domain project inside that is_domain project | 20:36 |
| geoffarnold | Unique in a domain? I can't have two projects, A and B, each with subprojects X and Y? | 20:36 |
| raildo | geoffarnold, nope. today a project name is unique in a domain, and we want to stay with this behavior. | 20:38 |
| geoffarnold | Doesn't that make blue-green releases tricky? http://martinfowler.com/bliki/BlueGreenDeployment.html | 20:38 |
| geoffarnold | Ah. | 20:39 |
| *** pnavarro has joined #openstack-keystone | 20:39 | |
| geoffarnold | I foresee a lot of subdomain creation to work around that | 20:39 |
| *** davidchep has quit IRC | 20:41 | |
| dstanek | raildo: i thought you said that domains are going away | 20:41 |
| raildo | dstanek, Domain will be a feature of project, we can create a project and add this feature enabling this "is_domain" flag. but we want to keep with the domain concept | 20:42 |
| dstanek | raildo: so keeping the current domain table instead of replacing it with is_domain projects? | 20:43 |
| geoffarnold | Service federation depends on the ability to associate policy (esp. IDM, but also quotas and some RBAC) with a node in the hierarchy, and to be able to effectively "chroot" to that node. I thought that was what you got by tagging a project as a domain | 20:43 |
| dstanek | so today: (X: domain) -> (Y: project) | 20:45 |
| raildo | dstanek, when we wrote the reseller spec, we find some problems in keep with two hierarchies, like domain hierarchy in domain table, and the same for project table. | 20:45 |
| dstanek | future? (X: project<is_domain=True>) -> (Y: project) | 20:45 |
| *** timcline has joined #openstack-keystone | 20:45 | |
| htruta | dstanek: exactly | 20:46 |
| raildo | dstanek, yes | 20:46 |
| dstanek | so in the future why would a project<is_domain=True> ever be returned by get_project_by_name? | 20:47 |
| htruta | geoffarnold: you're right. The subdomains will cover that use case | 20:47 |
| geoffarnold | so given that, how should I interpret "a project name is unique in a domain"? | 20:47 |
| htruta | dstanek: this is_domain project is an usual project with domain superpowers | 20:47 |
| geoffarnold | In my example, do I need to tag A and B as domains, so that X and Y don't clash in the parent? | 20:47 |
| dstanek | htruta: is there a reason for that? | 20:48 |
| htruta | we'll be able to create vms in it, for example | 20:48 |
| geoffarnold | So here's a reductio ad absurdum... why wouldn't I simply tag every project as a domain, thus avoiding namespace clashes? | 20:49 |
| dstanek | was there a rationale for that since it is what seem to be causing the need to specify the hierarchy? | 20:49 |
| raildo | dstanek, domain just working in Keystone, it's more easier handle with projects in the other services, and handle with this "domain power" in keystone | 20:49 |
| raildo | geoffarnold, domains and subdomains names, will be unique too. | 20:50 |
| geoffarnold | in what scope? | 20:50 |
| raildo | geoffarnold, in the cloud | 20:51 |
| geoffarnold | one reason to introduce hierarchical name spaces is to get away from the uniqueness required by a flat namespace | 20:51 |
| *** stevemar has quit IRC | 20:51 | |
| dstanek | raildo: is there a patch already to get right of Domain and Project.domain_id? | 20:51 |
| samueldmq | ayoung, looking, sorry was afk | 20:52 |
| ayoung | samueldmq, no problem. You are allowed to be AFK, and, with evesdrop, IRC is forever | 20:52 |
| samueldmq | ayoung, o/ | 20:52 |
| raildo | dstanek, in this patch we add this is_domain flag: https://review.openstack.org/#/c/157427/ | 20:53 |
| ayoung | samueldmq, I think what we want to do is make sure that the services can work with the same contract once we get them all using the oslo.policy library. | 20:53 |
| dstanek | raildo: right, but domains are going away as we know them right? | 20:53 |
| raildo | dstanek, and here, we change all the domain operations to the project side: https://review.openstack.org/#/c/143763/ | 20:53 |
| ayoung | So that means we have to identify the limits of the contract, which I would state as being they've called policy.Enforcer() | 20:54 |
| raildo | dstanek, and later, we remove all the domain references: https://review.openstack.org/#/c/165936/ | 20:54 |
| *** davidchep has joined #openstack-keystone | 20:54 | |
| dstanek | raildo: so what is the other projects would have to change is we treated Project<is_domain=True> the same as we tread Domain today? | 20:55 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/186932 | 20:55 |
| raildo | dstanek, hum... i don't get your question... if we need to change something in the current projects? | 20:57 |
| geoffarnold | raildo: after you've finished the Project<is_domain=True>, let's get back to the uniqueness issue, because it seems to be an independent topic | 20:57 |
| raildo | geoffarnold, I agree. this is not a final decision, it's just a decision to simplify our implementation in this first release. | 20:58 |
| htruta | geoffarnold: seems right | 20:58 |
| ayoung | raildo, can you make the minor changes I suggested in https://review.openstack.org/#/c/157427 and resubmit? I'd be happy to move that one along. | 20:58 |
| *** gordc has quit IRC | 20:58 | |
| dstanek | raildo: no, if we said that the will behave just like today's domain (not returned in get_project_by_name, etc) - what would the other projects have to do? | 20:58 |
| raildo | ayoung, sure, I'll do this today. sorry about that. | 20:58 |
| dstanek | geoffarnold: it's very similar, because if Project<is_domain=True> was treated like a domain then it would be unique | 20:59 |
| ayoung | raildo, no problem....your English is a heck of a lot better than my Portuguese | 20:59 |
| *** mattfarina has quit IRC | 20:59 | |
| *** davidchep has quit IRC | 21:00 | |
| htruta | ayoung: lol | 21:00 |
| samueldmq | ayoung, I will process your message and take a look in a bit, I am about to go home | 21:00 |
| samueldmq | ayoung, :) | 21:00 |
| ayoung | ++ | 21:00 |
| raildo | ayoung, thanks, but I know that I have to improve it :P | 21:00 |
| *** timcline has quit IRC | 21:01 | |
| ayoung | O meu hovercraft está cheio de enguias | 21:01 |
| htruta | dstanek: other projects won't have to do anything | 21:01 |
| htruta | they won't need to worry about domains | 21:01 |
| *** timcline has joined #openstack-keystone | 21:01 | |
| samueldmq | ayoung, lol .. that doesn't have any sense in portuguese | 21:02 |
| raildo | htruta, ++ | 21:02 |
| samueldmq | ayoung, haha actually it has, but it is strange, and funny | 21:03 |
| *** geoffarnold_ has joined #openstack-keystone | 21:03 | |
| *** davidchep has joined #openstack-keystone | 21:04 | |
| *** geoffarnold has quit IRC | 21:04 | |
| raildo | I have to go know, but I come back in 2 hours, if someone want to discuss more about this :D thank you dstanek, geoffarnold_ for your time. | 21:05 |
| *** pauloewerton has quit IRC | 21:05 | |
| htruta | me too. we may also continue it in the ML, or tomorrow | 21:06 |
| *** samueldmq has quit IRC | 21:06 | |
| dstanek | raildo, htruta : thanks for the info | 21:06 |
| geoffarnold_ | ML would be good - also we need to update the wiki | 21:06 |
| ayoung | Eu não vou comprar este disco, ele está arranhado. | 21:07 |
| *** fangzhou has joined #openstack-keystone | 21:08 | |
| morganfainberg | geoffarnold_: the issue is we *cannot* break the current API functionality | 21:08 |
| *** dsirrine has quit IRC | 21:08 | |
| morganfainberg | geoffarnold_: removing the uniqueness contraint(s) breaks our API contract | 21:08 |
| bknudson | you could break it if you had a config option | 21:08 |
| bknudson | so it was opt-in | 21:08 |
| geoffarnold_ | I understand. | 21:08 |
| morganfainberg | bknudson: lets not do that | 21:08 |
| morganfainberg | please | 21:08 |
| morganfainberg | please don't make it bad UX for the end users because someone did a "i want non-unique domains" | 21:08 |
| morganfainberg | it drives us to "every deployment is non-interoperable and a unique snowflake to use" and lots of code in tools like shade | 21:09 |
| *** dsirrine has joined #openstack-keystone | 21:09 | |
| morganfainberg | if we moved to microversions | 21:09 |
| morganfainberg | ... we could break the contract | 21:09 |
| geoffarnold_ | Implicit scope on existing APIs doesn't break contract, does it? | 21:09 |
| morganfainberg | but i think the flask work is needed before we do that. | 21:09 |
| morganfainberg | geoffarnold_: implicit scope? | 21:10 |
| geoffarnold_ | Adding a new API that effectively chroot's the hierarchy to the current node | 21:11 |
| geoffarnold_ | all existing API calls within that context behave as they do today | 21:12 |
| morganfainberg | geoffarnold_: i'd rather move to microversions | 21:12 |
| geoffarnold_ | orthogonal issue | 21:12 |
| morganfainberg | geoffarnold_: that seems like a not-great UX | 21:12 |
| morganfainberg | geoffarnold_: but that is just the surface view/gut feeling | 21:13 |
| geoffarnold_ | it's great UX if the user doesn't see the chroot; if it's done as a side-effect of logging in | 21:13 |
| morganfainberg | uhm | 21:13 |
| morganfainberg | i disagree. | 21:13 |
| morganfainberg | it makes understanding the uri structures for those *not* using the libraries less wonderful | 21:14 |
| geoffarnold_ | all OpenStack service calls are scoped by region today | 21:14 |
| morganfainberg | strictly form the python-keystoneclient lib (etc), we already provide that | 21:14 |
| *** iamjarvo has quit IRC | 21:14 | |
| morganfainberg | geoffarnold_: so - now i need to make http://<host>:5000/v2.0/<tenant|chroot>/<same api as before> | 21:15 |
| geoffarnold_ | how is it different for a user if the scope is to a subdomain within a region? | 21:15 |
| morganfainberg | you can't just make the URL different. | 21:15 |
| *** pnavarro has quit IRC | 21:15 | |
| morganfainberg | a lot o the API calls already do that | 21:16 |
| morganfainberg | some can't because they are administrative | 21:16 |
| morganfainberg | i don't think we can reconsile this nicely w/o again a microversion | 21:16 |
| morganfainberg | it's going to make using the APIs much harder. | 21:16 |
| geoffarnold_ | I'm happy to assume that for the moment | 21:17 |
| morganfainberg | it also doesn't really conform to RESt with the resource location concepts. | 21:17 |
| geoffarnold_ | but I'm going to test the idea again | 21:17 |
| morganfainberg | if it's "implicit" | 21:17 |
| morganfainberg | it really needs to be explicit | 21:17 |
| dstanek | morganfainberg: why are Project<is_domain=True> objects not just treated like Domain object and then we won't have this uniqueness problem | 21:18 |
| geoffarnold_ | i'm happy with project UUIDs being unique | 21:18 |
| morganfainberg | geoffarnold_: they already are. | 21:19 |
| geoffarnold_ | the problem only arises at the name-to-UUID mappings | 21:19 |
| morganfainberg | dstanek: we could do that. | 21:19 |
| morganfainberg | dstanek: there was a reason not to do that IIRC, but i don't remember the original argument now | 21:19 |
| dstanek | then things act exactly like they are today - nobody has to know where in the hierarchy they are | 21:20 |
| morganfainberg | dstanek: oh that doesn't solve the uniqueness issue though | 21:20 |
| dstanek | morganfainberg: why not? | 21:21 |
| morganfainberg | dstanek: in a given hierarchy you don't want to block the name "nova" because somewhere someone else created a domain called "nova" | 21:21 |
| morganfainberg | even outside of your heirarchy | 21:21 |
| geoffarnold_ | we wind up with two issues, (1) name-to-UUID mapping with two flavors: old, flat and new, hierarchical; (2) derived semantics from hierarchical relationships of projects | 21:21 |
| dstanek | morganfainberg: if the uniqueness is driven off of (name, domain_id) then that's not a problem | 21:21 |
| morganfainberg | dstanek: domains are today considered globally unique name-wise. | 21:22 |
| morganfainberg | we need the namespace specifier thats all | 21:22 |
| dstanek | domain_id being Project<is_domain=True>.id | 21:22 |
| geoffarnold_ | so this isn't really a hierachy | 21:22 |
| morganfainberg | but you can have A->A->A->A (all domains) | 21:22 |
| morganfainberg | geoffarnold_: the URLs need to be explicit - it isn't implicit in REST | 21:23 |
| geoffarnold_ | I'm pretty confident that if you asked developers what they'd expect from a hierarchical namespace, 99.9% would opt for something that looked like DNS or POSIX paths | 21:23 |
| morganfainberg | geoffarnold_: so you can do /<scope_id>/<API> | 21:23 |
| dstanek | they wouldn't all have the same domain_ids though - to maybe is should start saying parent_id instead of domain_id | 21:23 |
| dstanek | geoffarnold_: it's not too far off other than directories are also treated like files in our implementation | 21:24 |
| geoffarnold_ | well, that's a good thing | 21:24 |
| geoffarnold_ | I always felt Ritchie missed that trick | 21:25 |
| dstanek | really? that's what i want to get rid of | 21:25 |
| morganfainberg | dstanek: in the current impl, but we *could* just avoid the "can turn on VMs" type stuff in the domains | 21:25 |
| morganfainberg | dstanek: yeah. | 21:25 |
| *** iamjarvo has joined #openstack-keystone | 21:25 | |
| geoffarnold_ | The canonical namespace for projects is the flat UUID | 21:26 |
| geoffarnold_ | text names are used relatively rarely | 21:27 |
| morganfainberg | geoffarnold_: we need a clear unique way to reference an object globally in a deployment | 21:27 |
| geoffarnold_ | and needn't be treated as resource paths - their just tokens | 21:27 |
| morganfainberg | geoffarnold_: so we have said *always* the ID is that ID | 21:28 |
| morganfainberg | similar to how posix user ids can't be duplicated (without wonkyness) on a given system | 21:28 |
| geoffarnold_ | "object"? example? | 21:28 |
| morganfainberg | users, groups, projects, domains, etc | 21:28 |
| morganfainberg | in each type, the uuid is the unique identifier | 21:28 |
| morganfainberg | this is the index / reference point where we can audit from etc. | 21:29 |
| geoffarnold_ | so the UUIDs provide that unambiguous reference | 21:29 |
| morganfainberg | yes | 21:29 |
| morganfainberg | and we should have an unambiguous reference | 21:29 |
| morganfainberg | uuid.uuid.uuid.uuid might be very very bad. | 21:29 |
| geoffarnold_ | agreed | 21:29 |
| morganfainberg | ok so we're good on that front | 21:29 |
| ayoung | DNS is the cannonical way of doing namespaces | 21:30 |
| morganfainberg | yes the names should be used more often. | 21:30 |
| geoffarnold_ | one purpose (apart from readability) for text names is to provide a strong clue about relationships | 21:30 |
| ayoung | perhjaps something in conjunction with DNSSEC is appropriate | 21:30 |
| geoffarnold_ | not a bad idea | 21:30 |
| morganfainberg | ayoung: no DNS is *not* the canonical way to do namespaces, it is a way to do namespaces | 21:30 |
| ayoung | Show me another that is even close morganfainberg | 21:31 |
| geoffarnold_ | there is no single canonical way, but it would be nice to learn from successful models | 21:31 |
| ayoung | its won | 21:31 |
| dstanek | i think a filesystem is closer to what we are doing than dns | 21:31 |
| morganfainberg | ayoung: it is an implementation specific type of namespaces | 21:31 |
| ayoung | all the others are pining for the Fjords | 21:31 |
| morganfainberg | dstanek: ++ | 21:31 |
| morganfainberg | ayoung: Posix filesystem? ^^ | 21:31 |
| geoffarnold_ | just no symlinks, please | 21:31 |
| ayoung | dstanek, NFS? | 21:32 |
| dstanek | ayoung: only it you don't like your data | 21:32 |
| geoffarnold_ | you trying to remind me of how I spent the 1980s? | 21:32 |
| ayoung | morganfainberg, filesystems are not global namespaces, they are local namespaces | 21:32 |
| geoffarnold_ | AFS would disagree | 21:32 |
| ayoung | only DNS is valid across organizational boundaries | 21:32 |
| dstanek | we don't need global - we need cloud namespaces | 21:32 |
| morganfainberg | ayoung: DNS is not a global namespace either | 21:33 |
| ayoung | dstanek, what about bursting | 21:33 |
| morganfainberg | ayoung: it has an implementation people consider "global" most of the time. | 21:33 |
| morganfainberg | except where they dont | 21:33 |
| *** jsavak has joined #openstack-keystone | 21:33 | |
| morganfainberg | and it can be overridden / mucked with / changed. | 21:33 |
| geoffarnold_ | we need relative namespaces plus a variety of root anchoring models | 21:33 |
| dstanek | geoffarnold_: what would that actually be used for? | 21:33 |
| ayoung | morganfainberg, anyway, what I was suggesting is that, if we need a "this name has to be valid across two clouds" mechanism, we ase *that* on DNS, and enforce using DNSSEC: you have to own the name you are trying to register... | 21:34 |
| dstanek | ayoung: i was thinking that ids would be prefixed or qualified with the cloud | 21:34 |
| geoffarnold_ | blue-green deployments, for instance? http://martinfowler.com/bliki/BlueGreenDeployment.html | 21:34 |
| morganfainberg | ayoung: we aren't talking about that here. | 21:34 |
| geoffarnold_ | turtles all the way down | 21:34 |
| morganfainberg | ayoung: we're talking about the hierarchy in a single cloud. | 21:34 |
| ayoung | morganfainberg, we should be | 21:35 |
| morganfainberg | ayoung: sure we could use DNS/DNSSEC for across clouds | 21:35 |
| morganfainberg | ayoung: no we shouldn't be talking about that for this issue | 21:35 |
| morganfainberg | ayoung: this is below what your advocating | 21:35 |
| ayoung | and then we say "domain names that are not DNS blah" might get bumped by the real owner if it conflicts | 21:35 |
| geoffarnold_ | lets stick to "within a region" for the moment | 21:35 |
| ayoung | then we state "domain names should be DNS names, or we will provide one for you at no extra cost" | 21:35 |
| morganfainberg | ayoung: that is layered above what we need to solve - and none of the recommendations change that ability to layer it on top | 21:35 |
| dstanek | geoffarnold_: this is all within a cloud or at least a keystone instance | 21:36 |
| morganfainberg | ayoung: i disagree. | 21:36 |
| ayoung | so my domain name is either redhat.com or redhat.dreamhost.com | 21:36 |
| morganfainberg | ayoung: but that is a different (again) conversation | 21:36 |
| morganfainberg | ayoung: and can be layered above this with any of the proposals | 21:36 |
| morganfainberg | above = still in keystone | 21:36 |
| ayoung | and then we drop the service catalog and put it all in DNS and make termie happy | 21:36 |
| morganfainberg | ayoung: making termie happy is about at the bottom of my list of things to consider at the moment. | 21:37 |
| ayoung | Heh | 21:37 |
| geoffarnold_ | I'm thinking of a multi-project Heat deployment; I need to be able to deploy it in a test domain and then in prod | 21:37 |
| geoffarnold_ | without changing all the project names | 21:37 |
| morganfainberg | geoffarnold_ dstanek: yes this needs to be focused on "within a single deployment" for the moment | 21:37 |
| *** Nikkau has joined #openstack-keystone | 21:37 | |
| ayoung | morganfainberg, really, what I am suggesting is that we think in terms of global naming. DNS is obviosuly, not going to work in many cases | 21:37 |
| morganfainberg | ayoung: and none of the proposals prevents that. lets not talk about that for the moment | 21:38 |
| ayoung | names are either global or local. We need to know which we are dealing with in a specific instance | 21:38 |
| morganfainberg | ayoung: we have a lower-levle issue to solve | 21:38 |
| morganfainberg | ayoung: stick within a single region/deployment for the moment | 21:38 |
| geoffarnold_ | I'm going to try to solve one version of the global problem in Mercador; that's why intra-region is fine for me | 21:38 |
| dstanek | ayoung: we are talking local | 21:38 |
| ayoung | First is the fact that project names are,right now, forced to be unique across all projects in a domain | 21:38 |
| ayoung | so, we should probably distinguish between the full qualified project name and the local project name | 21:39 |
| morganfainberg | ayoung: these are all parts of things we're already looking at this is not part of the conversation at hand - we are dealing with that. | 21:39 |
| ayoung | " removing the uniqueness contraint(s) breaks our API contract" | 21:39 |
| *** dontalton has joined #openstack-keystone | 21:39 | |
| ayoung | that is how the conversation started | 21:39 |
| morganfainberg | ayoung: the uniqueness contraint for the domains globally | 21:40 |
| openstackgerrit | Dan Nguyen proposed openstack/python-keystoneclient: Add include_subtree to role_list_assignments call https://review.openstack.org/188184 | 21:40 |
| morganfainberg | ayoung: it was a very very specific proposal that broke our API contract | 21:40 |
| morganfainberg | ayoung: out of context | 21:40 |
| ayoung | morganfainberg, our API contract should allow for two types of names: single values or an array. It needs to be an arry for HMT and for any type of nesting due to the delimeter issue | 21:41 |
| morganfainberg | so we need *a* uniqueness constraint for domains at one level. | 21:41 |
| morganfainberg | ayoung: ok i need to duck out for a meeting | 21:41 |
| morganfainberg | we will need to revisit this convo | 21:41 |
| dstanek | i'm bailing too for a little bit | 21:41 |
| geoffarnold_ | indeed... | 21:41 |
| geoffarnold_ | ok | 21:42 |
| *** geoffarnold_ is now known as geoffarnold | 21:42 | |
| ayoung | morganfainberg, I'll write up what I am thinking for the dev list. It should be simple enough to at least start the convo. | 21:42 |
| *** samueldmq has joined #openstack-keystone | 21:44 | |
| *** iamjarvo has quit IRC | 21:49 | |
| *** iamjarvo has joined #openstack-keystone | 21:49 | |
| *** iamjarvo has quit IRC | 21:50 | |
| *** blewis` has quit IRC | 21:58 | |
| *** blewis has joined #openstack-keystone | 22:01 | |
| *** HT_sergio has quit IRC | 22:16 | |
| *** henrynash has quit IRC | 22:18 | |
| *** tqtran has quit IRC | 22:20 | |
| *** jamielennox|away is now known as jamielennox | 22:20 | |
| *** lhcheng has quit IRC | 22:25 | |
| *** lhcheng has joined #openstack-keystone | 22:26 | |
| *** ChanServ sets mode: +v lhcheng | 22:26 | |
| *** dguerri is now known as dguerri`away | 22:29 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:30 | |
| *** bknudson has quit IRC | 22:31 | |
| jamielennox | gyee: in light of reply to https://review.openstack.org/#/c/174198/ can i get you to change your mind on https://review.openstack.org/#/c/174198/ | 22:33 |
| jamielennox | gyee: because then we can merge that and the one dependent on it | 22:34 |
| openstackgerrit | Merged openstack/keystone: Consolidate test-requirements files. https://review.openstack.org/188154 | 22:36 |
| gyee | jamielennox, k | 22:42 |
| jamielennox | gyee: i do fix that up somewhere later on | 22:42 |
| jamielennox | and thansk | 22:42 |
| gyee | I am fine with another patch to shave off the _token_is_vx() stuff | 22:42 |
| jamielennox | gyee: can you do the +a on https://review.openstack.org/#/c/174199/ as well - there's 3 +2s | 22:44 |
| gyee | jamielennox, k | 22:44 |
| gyee | one sec | 22:44 |
| *** lihkin has quit IRC | 22:48 | |
| *** htruta_ has joined #openstack-keystone | 22:49 | |
| *** dand has quit IRC | 22:49 | |
| *** csoukup has quit IRC | 22:49 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Remove custom header handling https://review.openstack.org/180385 | 22:50 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Fetch user token from request rather than env https://review.openstack.org/174202 | 22:50 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Remove the _msg_format function https://review.openstack.org/174201 | 22:50 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Base use webob https://review.openstack.org/174200 | 22:50 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Create a simple base class from AuthProtocol https://review.openstack.org/180816 | 22:50 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Refactor request methods onto request object https://review.openstack.org/180394 | 22:50 |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/186932 | 22:52 |
| *** Raildo_ has joined #openstack-keystone | 23:03 | |
| *** timcline has quit IRC | 23:05 | |
| *** tqtran has joined #openstack-keystone | 23:07 | |
| *** timcline has joined #openstack-keystone | 23:08 | |
| *** jsavak has quit IRC | 23:11 | |
| *** timcline has quit IRC | 23:12 | |
| *** chlong has joined #openstack-keystone | 23:19 | |
| openstackgerrit | guang-yee proposed openstack/keystone: Unable to list role assignments in Project https://review.openstack.org/180846 | 23:34 |
| *** dontalton has quit IRC | 23:37 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Move project included validation https://review.openstack.org/174198 | 23:38 |
| *** Raildo_ has quit IRC | 23:39 | |
| *** tellesnobrega has quit IRC | 23:40 | |
| *** rwsu has quit IRC | 23:41 | |
| gyee | dtroyer, stevemar, is this the latest common cli doc? http://docs.openstack.org/cli-reference/content/ | 23:45 |
| openstackgerrit | Merged openstack/keystonemiddleware: Don't rely on token_info for header building https://review.openstack.org/174199 | 23:46 |
| gyee | jamielennox, ^^ | 23:46 |
| jamielennox | gyee: i've no idea, running "openstack help" is fairly descriptive | 23:47 |
| openstackgerrit | Merged openstack/keystoneauth: Add protocol docstring in FederationBaseAuthPlugin https://review.openstack.org/187610 | 23:50 |
| dtroyer | gyee: no, it's at http://docs.openstack.org/developer/python-openstackclient/ | 23:51 |
| *** dims_ has joined #openstack-keystone | 23:51 | |
| gyee | dtroyer, ty! | 23:55 |
| *** dims__ has quit IRC | 23:55 | |
| openstackgerrit | Merged openstack/keystone: Update access control configuration in httpd config https://review.openstack.org/164515 | 23:55 |
| openstackgerrit | Merged openstack/keystone: Replace blacklist_functions with blacklist_calls https://review.openstack.org/187360 | 23:55 |
| gyee | jamielennox, corp ppl want a doc, you know how it goes :) | 23:55 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!