| *** tellesnobrega_af is now known as tellesnobrega | 00:02 | |
| *** EinstCrazy has quit IRC | 00:04 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP: Remove eventlet support https://review.openstack.org/249486 | 00:08 |
|---|---|---|
| stevemar | notmorgan: in case you are interested ;) https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:bp/removed-as-of-mitaka,n,z | 00:09 |
| kfox1111 | lbragstad: so dropping out the .xxx subsecond stuff should be a fine workaround then. | 00:11 |
| *** gildub has joined #openstack-keystone | 00:16 | |
| *** markvoelker has quit IRC | 00:26 | |
| openstackgerrit | David Stanek proposed openstack/python-keystoneclient: Removes py26 support https://review.openstack.org/249494 | 00:28 |
| *** dims has joined #openstack-keystone | 00:30 | |
| *** dims_ has quit IRC | 00:31 | |
| *** aginwala has quit IRC | 00:32 | |
| *** aginwala has joined #openstack-keystone | 00:36 | |
| *** mylu_ has quit IRC | 00:37 | |
| *** miyagishi_t has joined #openstack-keystone | 00:38 | |
| *** mylu has joined #openstack-keystone | 00:39 | |
| *** shaleh|away has quit IRC | 00:42 | |
| *** lhcheng_ has quit IRC | 00:42 | |
| *** lhcheng has joined #openstack-keystone | 00:42 | |
| *** ChanServ sets mode: +v lhcheng | 00:42 | |
| *** jerrygb has quit IRC | 00:45 | |
| *** lhcheng has quit IRC | 00:46 | |
| *** jerrygb has joined #openstack-keystone | 00:46 | |
| *** tellesnobrega is now known as tellesnobrega_af | 00:49 | |
| *** jerrygb has quit IRC | 00:50 | |
| *** bknudson has quit IRC | 00:56 | |
| *** bknudson has joined #openstack-keystone | 00:58 | |
| *** ChanServ sets mode: +v bknudson | 00:58 | |
| *** EinstCrazy has joined #openstack-keystone | 01:05 | |
| *** doug-fish has joined #openstack-keystone | 01:07 | |
| *** doug-fish has quit IRC | 01:12 | |
| *** swebb has quit IRC | 01:14 | |
| *** josecastroleon has joined #openstack-keystone | 01:17 | |
| lbragstad | kfox1111 the only issue with that and fernet tokens is if you get a token, revoke it and get a new token *all* within the same second. If you do that, the newest token will still be considered invalid by keystone because the revocation event's 'issued_before' time is the same as the token creation time (both are truncated to .000000Z in some cases because SQL does truncation on datetime objects depending on the | 01:17 |
| lbragstad | version you're working with). | 01:17 |
| lbragstad | in that case, keystone will err on the side of security and return a 404 i believe | 01:18 |
| lbragstad | getting a new token within the realm of the *next* second mitigates the problem | 01:18 |
| kfox1111 | ah. | 01:19 |
| lbragstad | technically, that problem should be a lot harder to recreate once we have subsecond precision in keystone's backend (involves removing datetime sql formats from the keystone schema) and getting the fernet spec to have sub-second precision | 01:19 |
| lbragstad | kfox1111 we're actively working towards both of those goals [0] [1] | 01:20 |
| lbragstad | [0] https://github.com/fernet/spec/issues/12 | 01:20 |
| kfox1111 | its taking like 30min to rebuild ceph, but I should have a patched version in a few minutes I hope. if that works, I'll try that first. if not, then I'll try and patch keystone. | 01:20 |
| lbragstad | [1] https://review.openstack.org/#/c/243742/ | 01:20 |
| *** aginwala has quit IRC | 01:21 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Use subprocess.check_output instead of Popen https://review.openstack.org/249504 | 01:21 |
| kfox1111 | lbragstad: cool. thanks. I'll have a look. | 01:21 |
| *** aginwala has joined #openstack-keystone | 01:21 | |
| lbragstad | kfox1111 no problem, more details here if you care to read - https://github.com/openstack/tempest/blob/master/tempest/api/identity/v3/test_users.py#L61-L68 | 01:22 |
| kfox1111 | ah. right. | 01:24 |
| kfox1111 | I remember that conversation at the summit. | 01:24 |
| kfox1111 | there we go. | 01:26 |
| kfox1111 | yeah, between the 'WSGIChunkedRequest On' and the patched radosgw, its working now. | 01:26 |
| *** markvoelker has joined #openstack-keystone | 01:27 | |
| *** darrenc is now known as darrenc_afk | 01:27 | |
| *** markvoelker has quit IRC | 01:31 | |
| *** swebb has joined #openstack-keystone | 01:33 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Cleanup region refs https://review.openstack.org/249509 | 01:34 |
| openstackgerrit | Sean Perry proposed openstack/keystone: Use subprocess.check_output instead of Popen https://review.openstack.org/249504 | 01:38 |
| openstackgerrit | Sean Perry proposed openstack/keystone: Cleanup region refs https://review.openstack.org/249510 | 01:44 |
| *** josecastroleon has quit IRC | 01:46 | |
| *** mylu has quit IRC | 01:47 | |
| *** gildub has quit IRC | 01:49 | |
| *** btully has quit IRC | 01:52 | |
| *** csoukup has joined #openstack-keystone | 01:53 | |
| *** mylu has joined #openstack-keystone | 01:53 | |
| *** aginwala has quit IRC | 01:53 | |
| *** aginwala has joined #openstack-keystone | 01:58 | |
| *** jerrygb has joined #openstack-keystone | 01:59 | |
| *** aginwala_ has joined #openstack-keystone | 02:02 | |
| *** aginwala_ has quit IRC | 02:03 | |
| *** aginwala_ has joined #openstack-keystone | 02:03 | |
| *** darrenc_afk is now known as darrenc | 02:05 | |
| *** aginwala has quit IRC | 02:05 | |
| *** jbell8 has joined #openstack-keystone | 02:12 | |
| *** jbell8 has quit IRC | 02:14 | |
| openstackgerrit | Diane Fleming proposed openstack/keystone-specs: missing new attribute about Token https://review.openstack.org/242719 | 02:25 |
| *** markvoelker has joined #openstack-keystone | 02:28 | |
| *** jerrygb has quit IRC | 02:32 | |
| *** markvoelker has quit IRC | 02:33 | |
| *** jerrygb has joined #openstack-keystone | 02:33 | |
| *** jerrygb has quit IRC | 02:37 | |
| jamielennox | lbragstad: how do i use openstack-ansible to make custom scenarios | 02:37 |
| *** dims has quit IRC | 02:39 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add release notes for removed-as-of-mitaka https://review.openstack.org/249523 | 02:39 |
| *** jerrygb has joined #openstack-keystone | 02:40 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove `extras` from token data https://review.openstack.org/249480 | 02:40 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove LDAP Resource and LDAP Assignment backends https://review.openstack.org/231872 | 02:43 |
| lbragstad | jamielennox custom scenarios? | 02:44 |
| lbragstad | jamielennox custom deployments? | 02:44 |
| lbragstad | jamielennox there are a lot of keystone knobs available for tuning/tampering here - https://github.com/openstack/openstack-ansible/blob/master/playbooks/roles/os_keystone/defaults/main.yml | 02:47 |
| stevemar | i just realzied we didn't deprecate the role backend for ldap: https://github.com/openstack/keystone/blob/master/keystone/assignment/role_backends/ldap.py | 02:54 |
| stevemar | we deprecated the assignment and resource backends | 02:54 |
| stevemar | that sucks | 02:54 |
| *** spandhe has quit IRC | 02:54 | |
| jamielennox | lbragstad: i guess i'm looking for a way to write my own playbook, i want to just deploy keystone and tweak a bunch of knobs | 02:54 |
| jamielennox | but i don't necessarily want to write them in openstack-ansible directory or anythin | 02:55 |
| jamielennox | ideally i want to write a yml file with a deployment scenario and then pretty much at execution time tell it the hosts file to use | 02:55 |
| *** aginwala_ has quit IRC | 02:55 | |
| jamielennox | i've done this before by a script that essentially runs ansible-playbook -i "user@host," playbook.yml | 02:56 |
| lbragstad | jamielennox hmmm, like keystone knobs or apache knobs? | 02:57 |
| lbragstad | or both | 02:57 |
| lbragstad | you could fork and play with https://github.com/dolph/keystone-deploy | 02:58 |
| jamielennox | lbragstad: i'm trying to figure out if i can use openstack-ansible as i'm half way through rewriting my own ansible scripts and want to not waste the time | 02:58 |
| lbragstad | jamielennox keystone-deploy sets up keystone from source | 02:58 |
| lbragstad | and a more "development environment" fashion | 02:58 |
| lbragstad | it doesn't install from wheels, like OSA does | 02:58 |
| *** aginwala has joined #openstack-keystone | 02:59 | |
| jamielennox | lbragstad: that's almost the same as what i'm writing | 02:59 |
| lbragstad | jamielennox it's what I used to create the federation playbacks that I used = https://github.com/lbragstad/keystone-deploy/tree/federation | 02:59 |
| lbragstad | playbooks* | 02:59 |
| lbragstad | it's also what I used to deploy a 34 node globally distributed keystone/galera cluster ;) https://github.com/lbragstad/keystone-deploy/tree/galera | 03:00 |
| jamielennox | lbragstad: yea, so i have a very similar ansible environment | 03:01 |
| lbragstad | jamielennox nice | 03:01 |
| jamielennox | what i don't see with ansible is a nice way to share this stuff | 03:02 |
| *** jmccrory has quit IRC | 03:02 | |
| jamielennox | everyone has a very specific environment that works for them | 03:02 |
| lbragstad | jamielennox yeah... dolphm and i went back and forth trying to consolidate stuff and share it | 03:02 |
| jamielennox | i was looking to see if i could just import the os_keystone role and customize it as required | 03:02 |
| notmorgan | jamielennox: ping (re ksa things when you're done with this chat) | 03:02 |
| lbragstad | jamielennox we wanted to leveraged the keystone-deploy project to have common stuff that just does simple keystone stuff and then configure keystone a bunch of different ways to test against. | 03:03 |
| jamielennox | lbragstad: right, so i've currently got a base keystone role and i was going to add like a federation role, and a shib role etc | 03:03 |
| lbragstad | jamielennox i'm not 100% sure if you can suck in the os_keystone role and override... maybe? | 03:03 |
| jamielennox | but because they're all editing the same conf files it's becoming super messy | 03:03 |
| lbragstad | actually... you might be able to so, but you'd have to have the osa repo as a module within your project | 03:04 |
| jamielennox | the other option seems to be just stick everything in the same role and have a whole bunch of options | 03:04 |
| lbragstad | jamielennox yeah, it's hard to be DRY with ansible when you're doing complex things like federation | 03:04 |
| *** jmccrory has joined #openstack-keystone | 03:04 | |
| jamielennox | the openstack-ansible stuff has lots of cool federation stuff i would like to reuse, but it seems like you need to install it globally | 03:05 |
| jamielennox | like it's looking for handlers and things in /etc | 03:05 |
| jamielennox | which probably makes sense for production deploys, but isn't useful for me | 03:05 |
| jamielennox | but again, no way i can see to share this | 03:06 |
| lbragstad | jamielennox I would maybe try and run it by the osa guys? | 03:06 |
| lbragstad | cloudnull are you around? ^^ | 03:06 |
| jamielennox | i find ansible makes the initial stuff easy, but the more i play with it it's missing some development tools | 03:07 |
| *** breitz has quit IRC | 03:09 | |
| *** breitz has joined #openstack-keystone | 03:09 | |
| jamielennox | lbragstad: ok, i think i'm going to have to finish writing my own. i'll try cloudnull and others later but it's not their priority | 03:10 |
| jamielennox | i'll just lump everything into the same keystone role | 03:10 |
| lbragstad | jamielennox sounds good, let me know what you come up with | 03:13 |
| jamielennox | notmorgan: whats up with you? | 03:14 |
| *** RA has joined #openstack-keystone | 03:14 | |
| *** RA is now known as Guest30762 | 03:14 | |
| *** Guest30762 is now known as RA_ | 03:16 | |
| *** jerrygb has quit IRC | 03:16 | |
| *** jerrygb has joined #openstack-keystone | 03:16 | |
| *** jerrygb has quit IRC | 03:21 | |
| *** markvoelker has joined #openstack-keystone | 03:29 | |
| stevemar | notmorgan: the fact that the ldap role backend hasn't been deprecated makes me sad | 03:29 |
| notmorgan | jamielennox: just wanted to see what your response to mordred's comment on the KSA thing | 03:30 |
| *** darrenc is now known as darrenc_afk | 03:33 | |
| *** markvoelker has quit IRC | 03:34 | |
| *** markvoelker has joined #openstack-keystone | 03:35 | |
| *** harshs has quit IRC | 03:36 | |
| *** richm has quit IRC | 03:38 | |
| *** boris-42 has quit IRC | 03:38 | |
| *** john5223 is now known as zz_john5223 | 03:41 | |
| *** aginwala has quit IRC | 03:41 | |
| *** LZ has joined #openstack-keystone | 03:45 | |
| *** darrenc_afk is now known as darrenc | 03:59 | |
| *** gildub has joined #openstack-keystone | 04:05 | |
| *** zz_john5223 is now known as john5223 | 04:20 | |
| *** chenli has joined #openstack-keystone | 04:26 | |
| chenli | hello, I just installed a devstack, and I want to check the "tenants" created by devstack. I noticed that keystone client is not being used anymore. But when I run "openstack project list", I get " The resource could not be found. (HTTP 404)" | 04:29 |
| chenli | anyone can help me here ? | 04:30 |
| *** diazjf has joined #openstack-keystone | 04:30 | |
| stevemar | chenli: use `openstack project list --debug` and copy your output here: http://paste.openstack.org/ | 04:30 |
| chenli | http://paste.openstack.org/show/479950/ | 04:32 |
| *** diazjf1 has joined #openstack-keystone | 04:32 | |
| chenli | I'm using user " source ~/devstack/accrc/demo/admin" | 04:32 |
| stevemar | chenli: try adding /v2.0 to OS_AUTH_URL | 04:34 |
| stevemar | `export OS_AUTH_URL=http://9.197.45.36:35357v2.0 | 04:34 |
| *** diazjf has quit IRC | 04:34 | |
| chenli | stevemar: error : Failed to parse: 9.197.45.36:35357v2.0 | 04:35 |
| stevemar | chenli: add a slash before v2.0, that's a typo | 04:35 |
| chenli | soory | 04:35 |
| chenli | stevemar: o~ it works! | 04:37 |
| chenli | stevemar: thanks ! | 04:38 |
| *** roxanaghe has quit IRC | 04:38 | |
| chenli | stevemar: is this a bug for devstack ? | 04:38 |
| *** doug-fish has joined #openstack-keystone | 04:42 | |
| *** nkinder has joined #openstack-keystone | 04:44 | |
| *** zao has joined #openstack-keystone | 04:44 | |
| *** zao has left #openstack-keystone | 04:46 | |
| *** doug-fish has quit IRC | 04:46 | |
| stevemar | chenli: maybe, i'm surprised it didn't work, it should auto-negotiate for either v2.0 or v3 | 05:05 |
| *** aginwala has joined #openstack-keystone | 05:06 | |
| chenli | stevemar: command "nova list" can work | 05:07 |
| chenli | stevemar: but not openstackclient | 05:07 |
| stevemar | chenli: there is decent support for VMs and servers in openstackclient, we are encouraging folks to try it out | 05:08 |
| chenli | stevemar: ? sorry, can you elaborate a little more ? | 05:09 |
| stevemar | chenli: try `openstack server list` | 05:09 |
| stevemar | or `openstack server create` | 05:10 |
| chenli | stevemar: o~ it do not work if there is no v2.0 in OS_AUTH_URL | 05:11 |
| *** btully has joined #openstack-keystone | 05:20 | |
| *** doug-fish has joined #openstack-keystone | 05:23 | |
| *** doug-fish has quit IRC | 05:27 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove LDAP Resource and LDAP Assignment backends https://review.openstack.org/231872 | 05:29 |
| *** aginwala has quit IRC | 05:34 | |
| *** harshs has joined #openstack-keystone | 05:42 | |
| *** aginwala has joined #openstack-keystone | 05:46 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Cleanup region refs https://review.openstack.org/249509 | 05:58 |
| *** Nirupama has joined #openstack-keystone | 06:00 | |
| *** jaosorior has joined #openstack-keystone | 06:02 | |
| *** jasonsb has joined #openstack-keystone | 06:09 | |
| *** ajayaa has joined #openstack-keystone | 06:12 | |
| openstackgerrit | li,chen proposed openstack/python-keystoneclient: Add v2.0 check on auth_url https://review.openstack.org/249578 | 06:12 |
| *** jaosorior has quit IRC | 06:17 | |
| *** jaosorior has joined #openstack-keystone | 06:18 | |
| *** rcernin has joined #openstack-keystone | 06:20 | |
| *** jaosorior has quit IRC | 06:28 | |
| *** lhcheng has joined #openstack-keystone | 06:31 | |
| *** ChanServ sets mode: +v lhcheng | 06:31 | |
| *** spandhe has joined #openstack-keystone | 06:35 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove LDAP Resource and LDAP Assignment backends https://review.openstack.org/231872 | 06:35 |
| *** jasonsb has quit IRC | 06:35 | |
| *** jasonsb has joined #openstack-keystone | 06:37 | |
| *** josecastroleon has joined #openstack-keystone | 06:39 | |
| *** lhcheng has quit IRC | 06:46 | |
| *** aginwala has quit IRC | 06:56 | |
| *** gildub has quit IRC | 06:56 | |
| chenli | stevemar: hi, I filed a bug for this: https://bugs.launchpad.net/python-keystoneclient/+bug/1519624, and submit a change : https://review.openstack.org/#/c/249578/ | 06:57 |
| openstack | Launchpad bug 1519624 in python-keystoneclient "v2.0 is missing in OS_AUTH_URL " [Undecided,In progress] - Assigned to li,chen (chen-li) | 06:57 |
| *** aginwala has joined #openstack-keystone | 06:59 | |
| *** mylu has quit IRC | 07:03 | |
| *** mylu has joined #openstack-keystone | 07:04 | |
| *** mylu has quit IRC | 07:08 | |
| *** jasonsb has quit IRC | 07:10 | |
| *** lhcheng has joined #openstack-keystone | 07:15 | |
| *** ChanServ sets mode: +v lhcheng | 07:15 | |
| *** spandhe has quit IRC | 07:18 | |
| *** harshs has quit IRC | 07:21 | |
| *** spandhe has joined #openstack-keystone | 07:22 | |
| *** doug-fish has joined #openstack-keystone | 07:30 | |
| *** harshs has joined #openstack-keystone | 07:33 | |
| *** dims has joined #openstack-keystone | 07:35 | |
| *** doug-fish has quit IRC | 07:35 | |
| *** jaosorior has joined #openstack-keystone | 07:36 | |
| *** aginwala has quit IRC | 07:36 | |
| *** toddnni has quit IRC | 07:38 | |
| *** dims_ has joined #openstack-keystone | 07:39 | |
| *** dims has quit IRC | 07:40 | |
| *** gildub has joined #openstack-keystone | 07:45 | |
| *** rcernin_ has joined #openstack-keystone | 07:47 | |
| *** henrynash has joined #openstack-keystone | 07:51 | |
| *** ChanServ sets mode: +v henrynash | 07:51 | |
| *** diazjf1 has quit IRC | 08:01 | |
| *** RA_ has quit IRC | 08:06 | |
| *** e0ne has joined #openstack-keystone | 08:07 | |
| *** e0ne has quit IRC | 08:12 | |
| *** spandhe has quit IRC | 08:13 | |
| *** e0ne has joined #openstack-keystone | 08:16 | |
| *** e0ne has quit IRC | 08:28 | |
| *** e0ne has joined #openstack-keystone | 08:33 | |
| *** aginwala has joined #openstack-keystone | 08:37 | |
| *** fhubik has joined #openstack-keystone | 08:39 | |
| *** aginwala has quit IRC | 08:41 | |
| *** e0ne has quit IRC | 08:44 | |
| *** lhcheng has quit IRC | 08:52 | |
| openstackgerrit | Merged openstack/keystone: Correct docstring warnings https://review.openstack.org/244333 | 09:03 |
| *** mkoderer_ is now known as mkoderer | 09:11 | |
| *** lhcheng has joined #openstack-keystone | 09:14 | |
| *** ChanServ sets mode: +v lhcheng | 09:14 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Allow url-safe project and domain names to be optionally enforced https://review.openstack.org/248083 | 09:15 |
| marekd | opilotte: hey | 09:16 |
| marekd | you here? | 09:16 |
| *** lhcheng has quit IRC | 09:19 | |
| odyssey4me | jamielennox I'm sure that we can help you get what you want done. Ping me when you're back online. cc lbragstad cloudnull | 09:27 |
| jamielennox | odyssey4me: hey, i was just giving up :) | 09:28 |
| odyssey4me | jamielennox ah, can you describe what you're hoping to achieve? | 09:28 |
| jamielennox | i was copying the bits i need out | 09:28 |
| jamielennox | odyssey4me: i can - are you going to be around in an hour or so? | 09:28 |
| odyssey4me | jamielennox yep, for sure | 09:29 |
| jamielennox | great, i'll chat with you then | 09:29 |
| *** dims_ has quit IRC | 09:34 | |
| *** jistr has joined #openstack-keystone | 09:35 | |
| *** chenli has quit IRC | 09:37 | |
| *** fhubik is now known as fhubik_brb | 09:40 | |
| *** fhubik_brb is now known as fhubik | 09:41 | |
| *** fhubik is now known as fhubik_brb | 09:51 | |
| *** bapalm has quit IRC | 09:53 | |
| *** sshen_ has joined #openstack-keystone | 09:54 | |
| *** sshen has quit IRC | 09:55 | |
| *** bapalm has joined #openstack-keystone | 09:55 | |
| *** e0ne has joined #openstack-keystone | 10:01 | |
| *** mhickey has joined #openstack-keystone | 10:02 | |
| *** miyagishi_t has quit IRC | 10:02 | |
| *** rcernin_ has quit IRC | 10:06 | |
| *** RA_ has joined #openstack-keystone | 10:07 | |
| *** fhubik_brb is now known as fhubik | 10:13 | |
| *** EinstCrazy has quit IRC | 10:13 | |
| *** harshs has quit IRC | 10:18 | |
| *** RA_ has quit IRC | 10:34 | |
| *** RA_ has joined #openstack-keystone | 10:47 | |
| *** LZ has quit IRC | 10:49 | |
| samueldmq | morning | 11:00 |
| *** RA_ has quit IRC | 11:00 | |
| breton | morning | 11:01 |
| marekd | samueldmq: hey, so you claim endpoint filtering will not work with service providers as per your comment on line 62? | 11:06 |
| marekd | see, we needed you yesterday but you went away :/ | 11:06 |
| samueldmq | marekd: oh sorry, after the meeting :( | 11:09 |
| samueldmq | marekd: I didn't see any ping | 11:09 |
| samueldmq | marekd: so, was that comment clear, any agreement, disagreement you'd like to discuss ? | 11:10 |
| marekd | https://review.openstack.org/#/c/188534/8/specs/backlog/service-providers-filters.rst | 11:10 |
| marekd | and my question | 11:10 |
| marekd | previous | 11:10 |
| marekd | samueldmq: therre was no ping as i couldnt locate your nickname on openstack-meeting :-) | 11:10 |
| samueldmq | marekd: interesting, I was there o/ | 11:11 |
| samueldmq | marekd: anyways ... you refer to the comment in L6 2? | 11:11 |
| *** NM has joined #openstack-keystone | 11:14 | |
| samueldmq | marekd: if so, yes, we will need new APIs to assign the endpoints (or gorups of them) to SPs or whatever else we want | 11:14 |
| *** RA_ has joined #openstack-keystone | 11:15 | |
| marekd | hm, | 11:20 |
| marekd | samueldmq: but extending endpoint filtering or completely separate from them ? | 11:20 |
| marekd | samueldmq: ping | 11:25 |
| *** fhubik is now known as fhubik_brb | 11:26 | |
| *** tellesnobrega_af is now known as tellesnobrega | 11:28 | |
| *** wuhg has quit IRC | 11:31 | |
| samueldmq | samueldmq: I think extending endpoint filtering | 11:31 |
| samueldmq | marekd: oh that was for you, not to myself | 11:31 |
| marekd | samueldmq: i will need to dive into the code | 11:32 |
| marekd | but. | 11:32 |
| samueldmq | marekd: it's still endpoint filtering (it still filters endpoints and create groups) | 11:32 |
| marekd | what would be the workflow for that? | 11:32 |
| samueldmq | marekd: but assign to a different entity | 11:32 |
| marekd | samueldmq: can you walk me through? | 11:32 |
| samueldmq | marekd: sure, let me get the code | 11:32 |
| notmorgan | hmm.. it is morning isn't it? | 11:33 |
| marekd | midday | 11:33 |
| samueldmq | notmorgan: here it is :) | 11:33 |
| notmorgan | hah | 11:33 |
| notmorgan | samueldmq: it is also morning here | 11:34 |
| samueldmq | notmorgan: in lovely Portland ? | 11:34 |
| samueldmq | :) | 11:34 |
| marekd | notmorgan: so as usuall, the answer is 'depends' | 11:34 |
| notmorgan | samueldmq: NYC | 11:34 |
| notmorgan | hey can either of you get to http://status.openstack.org/zuul/ ? | 11:34 |
| * samueldmq forgets notmorgan travels a lot | 11:34 | |
| notmorgan | samueldmq: holday travel | 11:34 |
| marekd | notmorgan: i cannot get through | 11:35 |
| samueldmq | notmorgan: great, enjoy | 11:35 |
| notmorgan | marekd: ok cool, just making sure it wasn't just me | 11:35 |
| samueldmq | notmorgan: me neither, loading infinitely | 11:35 |
| marekd | notmorgan: yes, europe is cut off too. | 11:35 |
| marekd | samueldmq: anyway, can we get back to it in ~1h ? | 11:36 |
| marekd | i need to eat something. | 11:36 |
| marekd | hardy had a breakfast today | 11:36 |
| marekd | hardly | 11:36 |
| samueldmq | marekd: sure, go | 11:36 |
| samueldmq | marekd: bon apetit | 11:37 |
| samueldmq | appetit* (my French is bad now) :/ | 11:37 |
| *** jamielennox is now known as jamielennox|away | 11:42 | |
| *** EinstCrazy has joined #openstack-keystone | 11:47 | |
| *** EinstCrazy has quit IRC | 11:49 | |
| *** EinstCrazy has joined #openstack-keystone | 11:50 | |
| *** NM has quit IRC | 11:58 | |
| *** jamielennox|away is now known as jamielennox | 12:01 | |
| *** jmccrory has quit IRC | 12:12 | |
| *** fhubik_brb is now known as fhubik | 12:19 | |
| *** Nirupama has quit IRC | 12:19 | |
| *** jmccrory has joined #openstack-keystone | 12:20 | |
| *** NM has joined #openstack-keystone | 12:20 | |
| marekd | samueldmq: ok, i am here. | 12:21 |
| marekd | samueldmq: teach me, master :-) | 12:21 |
| samueldmq | marekd: nah, let me see what I can do :) | 12:23 |
| *** raildo-afk is now known as raildo | 12:23 | |
| samueldmq | marekd: so, the entity in question may be an endpoint (single) or a group of them | 12:23 |
| samueldmq | marekd: which is assigned to something (project for now, but we want to add SP and domain) | 12:24 |
| marekd | samueldmq: not really | 12:24 |
| marekd | samueldmq: SP would be a endpoint replacement. | 12:24 |
| marekd | so for each project i would filter available SPs | 12:25 |
| marekd | just like we do with endpoints today | 12:25 |
| marekd | makes sense? | 12:25 |
| samueldmq | marekd: so I propose a completely new API | 12:26 |
| marekd | why? | 12:26 |
| samueldmq | marekd: inside federation: sp_filter | 12:26 |
| marekd | why? | 12:26 |
| samueldmq | marekd: becayse that's endpoint_filter, and now it has nothing to do with endpoint anymore | 12:26 |
| marekd | samueldmq: stevemar and the rest voted for extending the existing endpoint filtering API | 12:27 |
| samueldmq | marekd: because you said "SP would be a endpoint replacement" | 12:27 |
| marekd | well, we would specif sp_id instead of endpoint id. | 12:27 |
| samueldmq | marekd: just a moment, let me recap the spec | 12:27 |
| marekd | samueldmq: sure | 12:27 |
| marekd | where is the docs for endpoint filtering api ? | 12:28 |
| samueldmq | marekd: https://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-ep-filter-ext.html | 12:28 |
| samueldmq | marekd: so it actually is a SP (or a group of it) that is returned for a project or domain | 12:29 |
| marekd | samueldmq: yes | 12:29 |
| marekd | and i don't want to limit them all | 12:29 |
| marekd | og | 12:30 |
| marekd | i don't want to always list them all. | 12:30 |
| samueldmq | marekd: so that has nothing to do with endpoints and the actual catalog | 12:30 |
| samueldmq | marekd: for me, endpoint_filter has similar behavior, but for endpoints | 12:30 |
| marekd | ok, i am trying to extend todas api, as agreed and recommended on the meeting yesterday | 12:31 |
| samueldmq | marekd: so it should be a separate API (perhaps re-using the same logic internally would be pssible) | 12:31 |
| marekd | i am asking if you see any constraints that will make it impossible. | 12:31 |
| samueldmq | marekd: nothing is impossible :p | 12:32 |
| marekd | yes, but in openstack it may take infinity | 12:32 |
| samueldmq | marekd: if you re-use, perhaps we will need to identify when a filter is actually trying to filter SPs, and apply that using the federation manager? | 12:32 |
| samueldmq | marekd: let me find a pointer to it | 12:32 |
| samueldmq | marekd: https://github.com/openstack/keystone/blob/dafbf5b8b2ef93ef0e785432fd34629a9d76b248/keystone/catalog/controllers.py#L404-L418 | 12:33 |
| samueldmq | marekd: L410 it starts iterating over the list of endpoints , and will look for those whose satisfy the filters | 12:34 |
| samueldmq | marekd: however I am still not conviced we should do that inside endpoint_filter (cc stevemar) | 12:35 |
| samueldmq | I will look again at yesterday's irc log | 12:35 |
| marekd | ok, let me add alternative | 12:35 |
| marekd | samueldmq: thanks. | 12:35 |
| *** NM has quit IRC | 12:35 | |
| samueldmq | marekd: np | 12:35 |
| *** RA_ has quit IRC | 12:36 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Domain Specific Roles https://review.openstack.org/226661 | 12:37 |
| *** gordc has joined #openstack-keystone | 12:41 | |
| *** dims has joined #openstack-keystone | 12:42 | |
| samueldmq | henrynash: hi | 12:46 |
| samueldmq | henrynash: about 'domain specific roles' spec | 12:47 |
| *** jerrygb has joined #openstack-keystone | 12:48 | |
| *** e0ne_ has joined #openstack-keystone | 12:48 | |
| *** boris-42 has joined #openstack-keystone | 12:49 | |
| *** e0ne has quit IRC | 12:51 | |
| *** gildub has quit IRC | 12:54 | |
| henrynash | samuedlmq: hi | 12:55 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/249478 | 12:56 |
| samueldmq | henrynash: hi, L102-105 https://review.openstack.org/#/c/226661/26/specs/mitaka/domain-specific-roles.rst | 12:56 |
| samueldmq | henrynash: just to confirm, because I got a bit confused with the reference to role-groups there | 12:57 |
| henrynash | bugger | 12:57 |
| openstackgerrit | Konstantin Maximov proposed openstack/keystone: Add test for domains list filtering and limiting https://review.openstack.org/207456 | 12:57 |
| samueldmq | henrynash: isn't defining implied roles like defining role-groupS ? | 12:57 |
| henrynash | I thought I’d squashed all references to role-groups! | 12:57 |
| samueldmq | henrynash: :) | 12:57 |
| henrynash | sorry, I’ll replace with domain specific roles! | 12:58 |
| samueldmq | henrynash: make sure that paragraph still makes sense when replacing role-groups -> domain specific roles | 12:59 |
| henrynash | yeah, I think i’ll shorten it | 12:59 |
| samueldmq | henrynash: ++ | 12:59 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Domain Specific Roles https://review.openstack.org/226661 | 13:02 |
| *** chlong has joined #openstack-keystone | 13:03 | |
| samueldmq | henrynash: +1'ed again, thanks! looks great now | 13:03 |
| henrynash | samueldmq: thx | 13:05 |
| *** david-lyle has quit IRC | 13:09 | |
| *** zqfan_AFK has joined #openstack-keystone | 13:09 | |
| marekd | samueldmq: so endpoint group is simply a filter with multiple atributes to filter | 13:10 |
| samueldmq | marekd: on endpoints | 13:12 |
| marekd | yes yes | 13:12 |
| marekd | ok, i also see we need to build it on top of OS-EP-FILTER but with new routes, so kind of new api | 13:12 |
| marekd | simply not completely new. | 13:13 |
| *** jerrygb has quit IRC | 13:13 | |
| marekd | samueldmq: i am re-specing it. | 13:13 |
| marekd | samueldmq: one more q. | 13:14 |
| samueldmq | marekd: okay, I will look again once you submit | 13:14 |
| samueldmq | marekd: sure | 13:14 |
| marekd | so when is specify endpoint and associate it with a project it will then show as available in the service catalog. so endpoint filtering filters in (as opposed to filters out) endpoints, right? | 13:14 |
| samueldmq | marekd: ++ | 13:15 |
| samueldmq | yes | 13:15 |
| marekd | samueldmq: cool | 13:15 |
| *** topol has joined #openstack-keystone | 13:23 | |
| *** ChanServ sets mode: +v topol | 13:23 | |
| *** ayoung has joined #openstack-keystone | 13:28 | |
| *** ChanServ sets mode: +v ayoung | 13:28 | |
| *** jerrygb has joined #openstack-keystone | 13:34 | |
| *** jerrygb has quit IRC | 13:39 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystonemiddleware: Add a mock-fixture for keystonemiddleware auth_protocol https://review.openstack.org/249794 | 13:51 |
| notmorgan | bknudson: ^ first pass (start) of the KSM mock fixture | 13:51 |
| notmorgan | needs a little more work but | 13:51 |
| notmorgan | it's a start | 13:51 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystonemiddleware: Add a mock-fixture for keystonemiddleware auth_protocol https://review.openstack.org/249794 | 13:52 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystonemiddleware: Add a mock-fixture for keystonemiddleware auth_protocol https://review.openstack.org/249794 | 13:53 |
| *** ajayaa has quit IRC | 13:59 | |
| *** openstackgerrit has quit IRC | 14:06 | |
| notmorgan | hm. i wish we had a nice factory for creating dummy/test tokens | 14:07 |
| *** openstackgerrit has joined #openstack-keystone | 14:07 | |
| notmorgan | that i could use. | 14:07 |
| notmorgan | bah | 14:07 |
| *** jerrygb has joined #openstack-keystone | 14:13 | |
| *** jaosorior has quit IRC | 14:17 | |
| *** rcernin has quit IRC | 14:19 | |
| *** nkinder has quit IRC | 14:20 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/python-keystoneclient: Add include_subtree to role_list_assignments call https://review.openstack.org/188184 | 14:20 |
| *** mylu has joined #openstack-keystone | 14:26 | |
| *** urulama has quit IRC | 14:29 | |
| *** urulama has joined #openstack-keystone | 14:30 | |
| opilotte | dstanek, dolphm, marekd: https://review.openstack.org/#/c/210581 | 14:31 |
| *** mylu has quit IRC | 14:31 | |
| marekd | opilotte: i pinged you earlier. | 14:31 |
| marekd | not reading backlog? | 14:31 |
| opilotte | what backlog? | 14:32 |
| *** pauloewerton has joined #openstack-keystone | 14:36 | |
| marekd | "old logs" | 14:36 |
| *** mylu has joined #openstack-keystone | 14:37 | |
| *** tellesnobrega is now known as tellesnobrega_af | 14:38 | |
| opilotte | well, I can see you asked me: you here? | 14:38 |
| opilotte | so to answer your question, yes, I am | 14:38 |
| opilotte | how are you? | 14:39 |
| marekd | opilotte: so cool! so i have a question : do you happen to expect that those group ids will be in group_ids parameter in the assertion? | 14:39 |
| opilotte | marekd: can you give me more details? which assertion are you refering to? | 14:40 |
| marekd | saml assertion | 14:41 |
| marekd | https://review.openstack.org/#/c/210581/22/keystone/tests/unit/mapping_fixtures.py line 1062 | 14:41 |
| marekd | do you expect this value will be issued by an IdP ? | 14:42 |
| opilotte | yes | 14:42 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystonemiddleware: Add a mock-fixture for keystonemiddleware auth_protocol https://review.openstack.org/249794 | 14:43 |
| marekd | opilotte: oups. | 14:43 |
| marekd | opilotte: let's say that my groups are issued in ADFS_GROUP_IDS | 14:43 |
| marekd | and it's org's policy | 14:44 |
| marekd | your patch will be useless then, right? | 14:44 |
| marekd | because it will expect group_ids | 14:44 |
| *** tellesnobrega_af is now known as tellesnobrega | 14:44 | |
| opilotte | well, same thing with any kind of application interface, you have to pass specific arguments if you want the thing to work... right? | 14:46 |
| marekd | opilotte: are you talking now about putting specific arguments to idp or keystone? | 14:47 |
| dstanek | opilotte: that's on the list, but there's a lot on the list | 14:48 |
| opilotte | the mapping does the job of translating the remote attributes to the local attributes | 14:49 |
| opilotte | marekd: are you talking about the remote part? | 14:49 |
| marekd | opilotte: yes, but you just confirmed that group_ids are hardcoded | 14:49 |
| marekd | in the mapping | 14:49 |
| opilotte | local rules are, remote are not | 14:49 |
| opilotte | that's the role of the mapping, right? | 14:50 |
| opilotte | map the remote attributes to the local ones | 14:50 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystonemiddleware: Add a mock-fixture for keystonemiddleware auth_protocol https://review.openstack.org/249794 | 14:51 |
| opilotte | marekd: sorry, I didn't understand your question correctly when I said you: yes | 14:51 |
| marekd | opilotte: group_ids in remote are not hardcoded | 14:51 |
| marekd | they can be whatever | 14:51 |
| marekd | this is what you meant | 14:52 |
| opilotte | marekd: correct | 14:52 |
| marekd | opilotte: ok | 14:52 |
| marekd | so that's fine. | 14:52 |
| opilotte | marekd: I wrote my own IdP, so I control what I send to keystone. Buf if you don't control the IdP, you can map the attribute differently | 14:53 |
| marekd | opilotte: yes, but you dont need to always want to map it differently, esp to hardocded values. anyway, the tests were kind of misleading. | 14:54 |
| marekd | you cleared it now. | 14:54 |
| opilotte | marekd: indeed, it's confusing | 14:54 |
| marekd | anyway, i voted on it (+2) | 14:55 |
| opilotte | marekd: thanks! I hope it gets merged this time, It's getting old... | 14:56 |
| marekd | yes | 14:56 |
| marekd | lets hope | 14:56 |
| marekd | it's all in dstanek's hands now :P | 14:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystonemiddleware: Add a mock-fixture for keystonemiddleware auth_protocol https://review.openstack.org/249794 | 14:58 |
| *** NM has joined #openstack-keystone | 14:58 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystonemiddleware: Add a mock-fixture for keystonemiddleware auth_protocol https://review.openstack.org/249794 | 15:00 |
| *** pumaranikar has joined #openstack-keystone | 15:00 | |
| *** tellesnobrega is now known as tellesnobrega_af | 15:01 | |
| *** mylu has quit IRC | 15:09 | |
| *** e0ne_ has quit IRC | 15:09 | |
| *** nkinder has joined #openstack-keystone | 15:10 | |
| *** mylu has joined #openstack-keystone | 15:10 | |
| *** e0ne has joined #openstack-keystone | 15:11 | |
| *** slberger has joined #openstack-keystone | 15:13 | |
| *** mylu has quit IRC | 15:15 | |
| *** aix has quit IRC | 15:16 | |
| *** NM has quit IRC | 15:17 | |
| *** navid_ has joined #openstack-keystone | 15:19 | |
| *** tellesnobrega_af is now known as tellesnobrega | 15:21 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Materialized path mixin and field for hierarchical models https://review.openstack.org/249847 | 15:23 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move region configuration to a critical section https://review.openstack.org/222173 | 15:27 |
| *** devl_ has joined #openstack-keystone | 15:29 | |
| *** chlong has quit IRC | 15:31 | |
| *** harshs has joined #openstack-keystone | 15:32 | |
| *** fhubik is now known as fhubik_brb | 15:34 | |
| *** davechen has joined #openstack-keystone | 15:34 | |
| *** navid_ has quit IRC | 15:36 | |
| *** navid_ has joined #openstack-keystone | 15:36 | |
| *** navid__ has joined #openstack-keystone | 15:38 | |
| *** fhubik_brb is now known as fhubik | 15:38 | |
| *** navid__ has left #openstack-keystone | 15:38 | |
| *** fhubik is now known as fhubik_brb | 15:38 | |
| *** urulama has quit IRC | 15:40 | |
| *** urulama has joined #openstack-keystone | 15:40 | |
| *** thiagop has joined #openstack-keystone | 15:40 | |
| *** amakarov has quit IRC | 15:42 | |
| *** fhubik_brb is now known as fhubik | 15:44 | |
| *** ajayaa has joined #openstack-keystone | 15:45 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Deprecate the pki and pkiz token providers. https://review.openstack.org/241389 | 15:47 |
| notmorgan | lbragstad: oh really? | 15:48 |
| notmorgan | lbragstad: wow. | 15:48 |
| lbragstad | notmorgan is that not the plan? | 15:49 |
| notmorgan | lbragstad: no idea | 15:49 |
| lbragstad | notmorgan :) | 15:49 |
| notmorgan | lbragstad: how many keystone meetings have i been to this cycle? | 15:49 |
| notmorgan | lbragstad: oh thats right... 1 | 15:49 |
| notmorgan | :P | 15:49 |
| *** aix has joined #openstack-keystone | 15:49 | |
| lbragstad | this is true :) | 15:49 |
| notmorgan | also.. if you have a sec to look over that fluffy middleware review ^^ i'd appreciate it | 15:50 |
| notmorgan | i think it's semi-sane | 15:50 |
| notmorgan | but.............. | 15:50 |
| notmorgan | yanno | 15:50 |
| lbragstad | notmorgan link? | 15:50 |
| notmorgan | https://review.openstack.org/249794 | 15:50 |
| notmorgan | this is in direct response to the silly ceilometer broke again cause they are mocking internal interfaces of ATM | 15:51 |
| lbragstad | notmorgan ah, is there a bug open for that? | 15:51 |
| notmorgan | nah | 15:51 |
| notmorgan | no bug afaik | 15:51 |
| lbragstad | the ceilometer thing? | 15:51 |
| notmorgan | it was a stable backport that changed something | 15:51 |
| notmorgan | and ceilometer was patching the memcache interface on KSM | 15:52 |
| notmorgan | to "return" their tokens | 15:52 |
| notmorgan | so it broke them | 15:52 |
| *** NM has joined #openstack-keystone | 15:52 | |
| notmorgan | the bug is "STOP PATCHING INTERNAL INTERFACES <other project>" :P | 15:52 |
| stevemar | notmorgan: thanks for doing that | 15:52 |
| lbragstad | gotcha | 15:52 |
| stevemar | bknudson will appreciate it | 15:52 |
| notmorgan | stevemar: it needs tests.. and i haven't *tried* it | 15:52 |
| notmorgan | but ... it's a first stab at the problem | 15:53 |
| openstackgerrit | Sean Perry proposed openstack/keystone: Cleanup region refs https://review.openstack.org/249509 | 15:53 |
| notmorgan | at least no syntax errors :P | 15:53 |
| stevemar | lol | 15:54 |
| *** ajayaa has quit IRC | 15:57 | |
| *** boris-42 has quit IRC | 15:58 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Expand endpoint filters to service providers https://review.openstack.org/188534 | 15:59 |
| *** dims has quit IRC | 16:09 | |
| *** dims has joined #openstack-keystone | 16:11 | |
| *** harshs has quit IRC | 16:13 | |
| *** tellesnobrega is now known as tellesnobrega_af | 16:13 | |
| *** EinstCrazy has quit IRC | 16:14 | |
| *** navid___ has joined #openstack-keystone | 16:17 | |
| *** navid_ has quit IRC | 16:21 | |
| *** navid_ has joined #openstack-keystone | 16:22 | |
| *** urulama has quit IRC | 16:23 | |
| *** urulama has joined #openstack-keystone | 16:23 | |
| *** navid___ has quit IRC | 16:25 | |
| lbragstad | stevemar around? | 16:28 |
| *** devl_ has quit IRC | 16:29 | |
| *** navid__ has joined #openstack-keystone | 16:29 | |
| lbragstad | stevemar do you have any specific wording you want to use to answer this? https://review.openstack.org/#/c/241389/4//COMMIT_MSG | 16:29 |
| *** navid_ has quit IRC | 16:30 | |
| kfox1111 | so, question... radosgw needs an admin token to verify other tokens with... can you make a restricted admin token if your going multiregion and you want to not give some regions admin access? | 16:34 |
| notmorgan | kfox1111: "restricted admin" ? | 16:35 |
| *** shaleh has joined #openstack-keystone | 16:35 | |
| kfox1111 | something like an admin token, (something that doesn't expire) | 16:35 |
| notmorgan | uhm. | 16:36 |
| notmorgan | all tokens expire | 16:36 |
| kfox1111 | the admin token doesn't... its hard coded. | 16:36 |
| stevemar | lbragstad: yo | 16:36 |
| notmorgan | kfox1111: oh yeah that is a terrible thing that needs to go away | 16:36 |
| notmorgan | kfox1111: running with admin_token in production is scaaaaary | 16:37 |
| stevemar | lbragstad: mention that there is a major security bug with PKI and an OSSA/OSSN will be provided | 16:37 |
| shaleh | isn't there a spec or review that removes the admin token by default? | 16:37 |
| kfox1111 | it seems like its the only way to support radosgw at present. :/ | 16:37 |
| stevemar | lbragstad: "details will not be provided until the OSSA is sent out by the vulnerability management team" | 16:37 |
| *** diazjf has joined #openstack-keystone | 16:38 | |
| notmorgan | kfox1111: the ceph folks really need to address that because if it is the only way, I'd tell people not to use radosgw | 16:38 |
| kfox1111 | k. | 16:38 |
| notmorgan | kfox1111: as a very strong recommendation. | 16:38 |
| kfox1111 | :/ | 16:38 |
| notmorgan | my only recommendation would be in that case to use swift if you need s3-like storage. | 16:39 |
| *** diazjf1 has joined #openstack-keystone | 16:39 | |
| kfox1111 | swift's a lot of effort. if your running ceph as backend anyway, you can share all your storage. | 16:40 |
| kfox1111 | its much preferable. :/ | 16:40 |
| *** devl_ has joined #openstack-keystone | 16:40 | |
| shaleh | is there consensus on whether the public/private IdP spec is a good thing? The reviews on the spec mostly focus on the sloppy nature of the spec and not the actual meat of it really. | 16:41 |
| notmorgan | kfox1111: sure. but i have to fall back to the fact that radosgw isn't really playing nice if it requires admin_token and/or only does v2 | 16:41 |
| kfox1111 | right. :/ | 16:41 |
| kfox1111 | still, I can't afford to dedicate storage for two seperate systems. | 16:42 |
| *** diazjf has quit IRC | 16:42 | |
| notmorgan | kfox1111: now, you *could* still share your resources but front things with swift and rbd volumes behind swift | 16:42 |
| *** devl_ has quit IRC | 16:42 | |
| kfox1111 | I'd probably personally have to fix ceph before I'd go to swift. | 16:42 |
| kfox1111 | far scarier. | 16:42 |
| *** devl_ has joined #openstack-keystone | 16:42 | |
| kfox1111 | really complicated. :/ | 16:42 |
| * notmorgan doesn't particularly like ceph outside of block-device use these days | 16:42 | |
| notmorgan | and even then... eh | 16:42 |
| kfox1111 | what do you use? | 16:43 |
| kfox1111 | the self healing | 16:43 |
| notmorgan | i don't run a cloud atm :P | 16:43 |
| kfox1111 | ness of it is invaluable. | 16:43 |
| kfox1111 | ah. ok. ;) | 16:43 |
| notmorgan | eh, i was running things that could handle "volume died, make new instance with new volume" | 16:43 |
| notmorgan | i didn't need crazy volumes from cinder, just the more ephemeral storage | 16:43 |
| *** devl_ has quit IRC | 16:44 | |
| notmorgan | and where more stability was needed, was based on SAN exports. | 16:44 |
| kfox1111 | yeah, 9 out of 10 vm's I run don't need volumes. but that 10% really benifits. | 16:44 |
| *** devl_ has joined #openstack-keystone | 16:44 | |
| kfox1111 | ceph seems cheeper compared to a san. but if you already had one, that makes sense. | 16:44 |
| notmorgan | operational costs are not low with ceph | 16:45 |
| * notmorgan shrugs | 16:45 | |
| kfox1111 | depends on the site. ours seems very low. | 16:45 |
| kfox1111 | most of our ceph's are fairly behind though. most of them are still giant. | 16:46 |
| *** devl_ has quit IRC | 16:46 | |
| kfox1111 | gota fix that one of these days. | 16:46 |
| notmorgan | anyway, i would personally run swift over radosgw, that is my recommendation for now. | 16:47 |
| kfox1111 | yeah, that's not going to happen. :/ | 16:47 |
| kfox1111 | so I gota fix radosgw. | 16:47 |
| kfox1111 | ceph also should help with manilla once that stabilizes a bit. | 16:48 |
| *** josecastroleon has quit IRC | 16:48 | |
| kfox1111 | sharing the same storage backend with the three different protocol types (block, file, object) should really help drive down costs. most of the propriatary vendors have done the exact same thing. but its always so expensive. :/ | 16:49 |
| kfox1111 | finally having a pure opensource solution to the problem is going to be awesome. :) | 16:50 |
| *** josecastroleon has joined #openstack-keystone | 16:50 | |
| *** amakarov has joined #openstack-keystone | 16:50 | |
| *** roxanaghe has joined #openstack-keystone | 16:52 | |
| *** pumaranikar has quit IRC | 16:54 | |
| *** pumaranikar has joined #openstack-keystone | 16:54 | |
| *** jistr has quit IRC | 17:02 | |
| *** markvoelker has quit IRC | 17:03 | |
| *** diazjf1 has quit IRC | 17:05 | |
| kfox1111 | notmorgan: https://github.com/ceph/ceph/pull/6337 looks interesting on the radosgw front. | 17:08 |
| *** spandhe has joined #openstack-keystone | 17:08 | |
| *** spandhe has quit IRC | 17:08 | |
| *** fhubik has quit IRC | 17:08 | |
| *** e0ne has quit IRC | 17:09 | |
| *** tellesnobrega_af is now known as tellesnobrega | 17:11 | |
| *** urulama has quit IRC | 17:12 | |
| *** davechen1 has joined #openstack-keystone | 17:12 | |
| *** urulama has joined #openstack-keystone | 17:12 | |
| *** davechen has quit IRC | 17:12 | |
| *** EinstCrazy has joined #openstack-keystone | 17:14 | |
| kfox1111 | notmorgan: it looks like it adds full v3 support with pki and user/password and everything. | 17:15 |
| *** ajayaa has joined #openstack-keystone | 17:15 | |
| kfox1111 | it would be cool if someone on the keystone team woudl review it. | 17:15 |
| *** ohno13 has joined #openstack-keystone | 17:22 | |
| *** jerrygb has quit IRC | 17:27 | |
| *** jerrygb has joined #openstack-keystone | 17:28 | |
| *** jerrygb has quit IRC | 17:28 | |
| *** jerrygb has joined #openstack-keystone | 17:28 | |
| shaleh | pki? | 17:29 |
| *** EinstCrazy has quit IRC | 17:29 | |
| shaleh | isnt that deprecated heavily? | 17:29 |
| *** david-lyle has joined #openstack-keystone | 17:30 | |
| *** mhickey has quit IRC | 17:33 | |
| dstanek | anyone know why the ldap identity backend has generates_uuids() == False? | 17:33 |
| dstanek | henrynash: ^ | 17:33 |
| ohno13 | Is there any configuration parameter that would prevent you from disabling the hash mapping of IDs when using LDAP as the backend for users? | 17:36 |
| *** NM has quit IRC | 17:37 | |
| *** raildo is now known as raildo-afk | 17:38 | |
| notmorgan | dstanek: because it isn't a uuid | 17:39 |
| *** tellesnobrega has left #openstack-keystone | 17:39 | |
| notmorgan | dstanek: it's a DN | 17:39 |
| notmorgan | dstanek: it *may* use uuid behind the scenes in some cases. | 17:39 |
| notmorgan | but it's not a flat uuid. iirc | 17:39 |
| *** raildo-afk is now known as raildo | 17:39 | |
| dstanek | notmorgan: but isn't the ID set from the user_id_attribute and friends? | 17:40 |
| notmorgan | well the attribute is | 17:40 |
| notmorgan | but it can also not be UUID | 17:40 |
| notmorgan | it can be <string> | 17:40 |
| dstanek | what would be the side effect of it being a non-UUID string (assuming that string is URL safe) | 17:41 |
| *** navid__ has quit IRC | 17:41 | |
| *** jasonsb has joined #openstack-keystone | 17:42 | |
| *** jerrygb has quit IRC | 17:43 | |
| *** spandhe has joined #openstack-keystone | 17:43 | |
| *** davechen1 has quit IRC | 17:44 | |
| notmorgan | dstanek: it wasn't generateD? | 17:44 |
| notmorgan | remember ldap identity also was/is r/o not just r/w mode | 17:44 |
| dstanek | notmorgan: no, in this case i want to take it from LDAP directly | 17:44 |
| notmorgan | dstanek: i am... i'm not sure what you're driving at | 17:47 |
| *** mylu has joined #openstack-keystone | 17:47 | |
| *** mylu has quit IRC | 17:48 | |
| *** tyagiprince has joined #openstack-keystone | 17:58 | |
| *** david-lyle has quit IRC | 18:00 | |
| tyagiprince | Hii.. I have configured my keystone to authenticate from the active directory.. I want to know if I can improve the authentication more by kerberizing keystone or theres some more better way? | 18:01 |
| stevemar | tyagiprince: what do you mean improve? | 18:02 |
| tyagiprince | the current situation is that I am sending my user credentials as clear text is on the network.. Also I am doing the assignment work in mysql.. which I think should be done more easily through GUI, not through CLI.. | 18:06 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: WIP List assignments with names https://review.openstack.org/249958 | 18:06 |
| tyagiprince | stevemar: | 18:07 |
| *** e0ne has joined #openstack-keystone | 18:07 | |
| henrynash | dstanek: it’s to do with whether we need to create an intermediate mapping of not, | 18:09 |
| notmorgan | henrynash: ah that was it | 18:09 |
| notmorgan | cool | 18:09 |
| henrynash | dstanek: rather than hard code whether to build an intermediat emapping or not based on driver name, we use that method to determine its capability | 18:10 |
| dstanek | henrynash: right, but i'm interested to know why we need one for LDAP if the user_id_attribute is being set properly, for instance | 18:12 |
| shaleh | is there consensus on whether the public/private IdP spec is a good thing? The reviews on the spec mostly focus on the sloppy nature of the spec and not the actual meat of it really. | 18:12 |
| tyagiprince | stevemar: If I use ldap driver for the assignment, I have to change the schema of my active directory.. | 18:12 |
| notmorgan | stevemar: do you know why bknudson has https://review.openstack.org/#/c/242512/ as WIP? i'd love to have that land. | 18:12 |
| notmorgan | tyagiprince: don't use LDAP driver for assignment | 18:12 |
| notmorgan | tyagiprince: that has been deprecated and will not live on too much longer | 18:13 |
| henrynash | dstanek: in multi-domain identity, we don;t trust any given LDAP service to generate a unique (across all other domains) user ID | 18:13 |
| tyagiprince | notmorgan: but then its too much difficult to manage them on mysql.. what more options do I have? | 18:13 |
| dstanek | henrynash: ah, ok | 18:13 |
| notmorgan | tyagiprince: so ldap assignment has been barely supported/functional for many releases. it never really received the work other backends god | 18:14 |
| notmorgan | got* | 18:14 |
| *** urulama has quit IRC | 18:14 | |
| *** slberger has left #openstack-keystone | 18:14 | |
| notmorgan | tyagiprince: so really the answer is MySQL. you already have to have it for nova, neutron, etc | 18:14 |
| dstanek | henrynash: but if backward_compatible_ids is set to true then ldap running on the default domain would respect the user_id_attribute right? | 18:14 |
| stevemar | notmorgan: marekd reported an issue with ADFS | 18:14 |
| *** urulama has joined #openstack-keystone | 18:15 | |
| *** daemontool has joined #openstack-keystone | 18:15 | |
| *** diazjf has joined #openstack-keystone | 18:15 | |
| notmorgan | stevemar: doh! | 18:15 |
| henrynash | dstanek: absolutely correct | 18:15 |
| notmorgan | tyagiprince: or you can write your own backend. but that is a BIG task | 18:15 |
| notmorgan | tyagiprince: theoretically it also works on pgsql and/or db2 ... but that is not as well tested as mysql | 18:16 |
| *** diazjf has quit IRC | 18:16 | |
| *** harshs has joined #openstack-keystone | 18:16 | |
| dstanek | henrynash: muchas gracias | 18:16 |
| *** diazjf has joined #openstack-keystone | 18:16 | |
| henrynash | dstanek: yw (in spanish) | 18:17 |
| dstanek | henrynash: on another note. i got an email about renewing our domain so I'll put some of adam's drawings up there this weekend | 18:17 |
| *** toddnni has joined #openstack-keystone | 18:17 | |
| henrynash | dstanek: cool! | 18:17 |
| henrynash | dstanek: happy to pay this time if required! | 18:17 |
| *** diazjf has quit IRC | 18:18 | |
| tyagiprince | notmorgan stevemar: Will the kerberos or freeipa help me head to better authentication and assignment task using mysql? | 18:19 |
| tyagiprince | I read many articles by adam and jammie out on there blogs | 18:20 |
| dstanek | henrynash: nah...i have lots of languishing domains so i get the volume discount :-) | 18:20 |
| *** david-lyle has joined #openstack-keystone | 18:20 | |
| henrynash | dstanek: !!!!! | 18:20 |
| notmorgan | tyagiprince: federation might make it easier. however, i am not sure if krb5 is going to solve much more than general federation for you. I'd defer to ayoung or jamielennox to discuss your usecase more in depth | 18:21 |
| ayoung | tyagiprince, really depends on what you are trying to do | 18:22 |
| * ayoung reads up | 18:22 | |
| ayoung | tyagiprince, so...one thing you can try is to enroll your Keystone server (maybe using RealmD) with AD and using Kerberos and SSSD Federation | 18:23 |
| ayoung | You can do it Via FreeIPA and a Trust. Current FreeIPA supports one way trusts with AD (or so I've been told, have not tested) | 18:24 |
| notmorgan | ahhh we have summoned the ayoung ! | 18:24 |
| ayoung | and enroll your Keystone server with the FreeIPA server will probably be a little better isolation from the changes you might want to make | 18:24 |
| *** daemontool has quit IRC | 18:24 | |
| notmorgan | ayoung: seriously, i thought you'd be on break today | 18:24 |
| ayoung | notmorgan, I have kids. Work is my break. | 18:24 |
| notmorgan | ayoung: also have a good thanksgiving :) | 18:25 |
| ayoung | You too | 18:25 |
| notmorgan | ayoung: will do. enjoying the NYC weather atm | 18:25 |
| notmorgan | and actually hacking on code/cloud things | 18:25 |
| ayoung | :) | 18:25 |
| samueldmq | stevemar: finished reviewing (voted and/or commented on) all the specs listed in your gist | 18:34 |
| samueldmq | stevemar: except for #244694, which is marked as blocked by ayoung | 18:34 |
| stevemar | samueldmq: beautiful | 18:34 |
| ayoung | tyagiprince, I am not a fan of passing passwords across the wire. Kerberos or Client Certs are the only cryptographically secure means to do web authentication. OTP is a better approach if you must do Password | 18:34 |
| samueldmq | stevemar: :) | 18:34 |
| ayoung | samueldmq, you can still review | 18:35 |
| ayoung | samueldmq, I have yet to get enough feedback to determine if people want it or not | 18:35 |
| ayoung | I'm kindof afrain of it | 18:35 |
| * notmorgan abstains from all specs until after M1 *shiftyeyes* | 18:35 | |
| ayoung | what was the stevemar link again? | 18:35 |
| notmorgan | ayoung: channel topic? | 18:36 |
| ayoung | thanks | 18:36 |
| notmorgan | ayoung: np. | 18:36 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Deprecate the pki and pkiz token providers. https://review.openstack.org/241389 | 18:36 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Deprecate the pki and pkiz token providers. https://review.openstack.org/241389 | 18:37 |
| ayoung | notmorgan, oh comoen on...push this one over the limit: https://review.openstack.org/#/c/248083/ | 18:37 |
| ayoung | its go two core writing it, whihc makes it harder to get approval | 18:37 |
| shaleh | ayoung: enforcing that while not supporting escaping existing projects is a bad idea IMHO | 18:39 |
| notmorgan | ayoung: you have 2x cores +2 | 18:39 |
| notmorgan | did we change how specs are approved? | 18:39 |
| notmorgan | i ... have missed almost every meeting :P | 18:40 |
| notmorgan | remember | 18:40 |
| ayoung | notmorgan, I am an author | 18:40 |
| notmorgan | oh | 18:40 |
| ayoung | not going to +A it | 18:40 |
| ayoung | shaleh, add that to the review. | 18:40 |
| notmorgan | i actually think stevemar should tip it over. | 18:40 |
| notmorgan | tbh | 18:40 |
| ayoung | shaleh, including how you think the escaping should work | 18:40 |
| notmorgan | but i can circle back up on it if really needed | 18:41 |
| ayoung | notmorgan, a comment alomng the lines of "HAve not reviewed in depth but agree/disagree with direction" would be useful from you | 18:41 |
| ayoung | shaleh, so...I think I can get behind that | 18:41 |
| ayoung | you are saying that if a domain name is x@y/z we would allow it like OS_DOMAIN_NAME="x%1234t%9876" | 18:42 |
| shaleh | ayoung: blocking new projects while allowing existing makes sense. The operator did not name these, their users did. If the op has to arbitrarily rename or discard projects that would not be pretty. | 18:42 |
| ayoung | assuming the oproper unicode | 18:42 |
| notmorgan | ayoung: ok commented. | 18:43 |
| ayoung | shaleh, there is the miniscule possiblity of conflict with wsomeone being a smartass if we do that | 18:43 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Materialized path mixin and field for hierarchical models https://review.openstack.org/249847 | 18:43 |
| shaleh | ayoung: true. But that is always an issue. The provided keystone-manage tool would identify the rare cases that happens. | 18:43 |
| ayoung | shaleh, I'd rather that the deconflicting be done manually. | 18:44 |
| shaleh | ayoung: agreed, I said identify | 18:45 |
| ayoung | shaleh, so what are you proposing? | 18:45 |
| samueldmq | ayoung: stevemar: notmorgan: shaleh: so, as I was talking to marekd earlier today | 18:46 |
| samueldmq | sorry I missed this topic in yesterday's meeting, but I really think SP filtering should be a separate API under federation | 18:46 |
| samueldmq | different from endpoint_filter API | 18:47 |
| shaleh | samueldmq: like the IdP filtering proposal, yes? | 18:47 |
| *** devl_ has joined #openstack-keystone | 18:47 | |
| samueldmq | endpoints are under catalog API; thus endpoint_filter lives there | 18:47 |
| samueldmq | SP are under federation; this sp_filter should live there | 18:47 |
| shaleh | ayoung: as we were discussing yesterday, a URL encoding like the %foo you show above | 18:47 |
| samueldmq | that's how I see, we should try to re-use a small portion of code (assigning endpoints to projects) and make the API confusing | 18:48 |
| shaleh | ayoung: it would be NICE if python-keystoneclient handled the encoding | 18:48 |
| samueldmq | both endpoints and SP will be in the token, but they're different things | 18:48 |
| shaleh | samueldmq: so the code to add the SP list would first attempt to filter it? | 18:48 |
| shaleh | samueldmq: what about the unscoped token case? There is no project yet | 18:49 |
| samueldmq | shaleh: yes the code to add SPs in the token would attemp tofilter them, as we do for endpoints | 18:49 |
| samueldmq | shaleh: we could add an option to specify what to do; in endpoint case, we have: add_all_if_no_filter_specified | 18:50 |
| samueldmq | shaleh: (I don't recall the name exactly) | 18:50 |
| ayoung | Domain specific roles is ready to go | 18:50 |
| ayoung | shaleh, that is not a complete solution | 18:50 |
| samueldmq | ayoung: nice | 18:50 |
| samueldmq | ayoung: I agree | 18:50 |
| shaleh | ayoung: what am I missing? | 18:51 |
| ayoung | are you saying that if we enable strict, then all existing conflicting projects, instead of being disabled, are accessable via their escaped names? And we only allo that? | 18:51 |
| ayoung | And we do not allow people to write ones that are psecifcially escaped? | 18:51 |
| ayoung | or that we automatically port to the escaped version? | 18:51 |
| samueldmq | shaleh: right now I am not arguing about the functionality itself, but where we do put our code; I am arguing for clarity and not mixing things for the sake of re-using a very small portion of code (that can even be put in a common place) | 18:52 |
| ayoung | I think a utility to port is better, but it should be a deliberate choice | 18:52 |
| ayoung | shaleh, going strict is a deliberate choice. If you can't notify your users to update their project names, you can't go strict | 18:52 |
| ayoung | making migration possible or eaiser is a follow on, not part of the initial spec | 18:53 |
| samueldmq | shaleh: brb | 18:53 |
| ayoung | waiting for it to be perfect means we are going to be stuc, and automatically deconflicting is am istake | 18:53 |
| ayoung | so, I disagree on the escaping | 18:53 |
| ayoung | its an easy SQL query to write, and a one time cost | 18:54 |
| ayoung | actually, it is not an easy SQL query, but should be do-able with python+sql | 18:54 |
| shaleh | ayoung: but it breaks the end user. Not the op | 18:56 |
| ayoung | shaleh, enabling this is going to break a script that uses the name. Period. It will cause pain. Life is Pain. | 18:57 |
| ayoung | Anyone who says differntly is selling something | 18:57 |
| shaleh | ayoung: if we update keystoneclient with it then the only ones who will notice are the ones calling the APIs manually or via another programming language | 18:57 |
| *** e0ne has quit IRC | 18:58 | |
| shaleh | ayoung: a tool to identify names that cannot be used without encoding gets us quite a way there and is in the spec. | 18:59 |
| shaleh | ayoung: the question is what to do with ops that have a decent number of unusable names | 19:00 |
| shaleh | ayoung: we can a) provide a way to magically rename them b) provide as much tooling as possible to support them via escaping c) find another choice d) make the ops problems and walk away | 19:01 |
| shaleh | I am not fond of D | 19:01 |
| ayoung | b/c | 19:01 |
| ayoung | shaleh, we need to support names like A/B/C for the nesting case that this is building, so automatically escapuing them will defeat the purpose | 19:02 |
| shaleh | ayoung: that is my opinion as well. I am open to another solution. I proposed escaping because it is the classic solution to this problem and it will be easy to understand as well | 19:02 |
| ayoung | shaleh, walk it through from start to finish. With finish being "we are going to use the new URLS in the OS_DOMAIN_NAME type env vars for nested domains | 19:03 |
| ayoung | escaping, as I see it, gets in the way of that | 19:04 |
| ayoung | shaleh, I can see the argument that we want a separate option to say "strict for new" | 19:05 |
| shaleh | ayoung: hmm. I misunderstood. I did not expect the final project name to be "A/B/C". I expected it to be "C", parent "B", parent "C" | 19:05 |
| ayoung | that gives you some time to migrate the existing | 19:05 |
| shaleh | C -> B -> A | 19:05 |
| ayoung | shaleh, yeah, we are trying to get out of our own way here | 19:06 |
| ayoung | henrynash, what do you think of doing this in two steps: | 19:06 |
| ayoung | henrynash, first diable new projects from being non-url safe | 19:06 |
| ayoung | henrynash, second being that we then enforce url safety everywhere | 19:07 |
| ayoung | maybe make the config option a tri-value | 19:07 |
| shaleh | no/new/strict | 19:07 |
| shaleh | it would be nice if we had a way to query ops and find out how likely this is to be an issue | 19:08 |
| ayoung | shaleh, so then the expected approach would be: | 19:08 |
| ayoung | 1. set to new | 19:08 |
| shaleh | if we had a tool to query their projects and produce a statistic "X good, Y bad" that they could report | 19:08 |
| ayoung | 2. identify problem projects and migrate | 19:09 |
| ayoung | 3. set to strict | 19:09 |
| *** henrynash has quit IRC | 19:09 | |
| * ayoung scared hentry away | 19:09 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/249478 | 19:09 |
| shaleh | ayoung: that is the only way forward that makes sense to me | 19:10 |
| ayoung | shaleh, OK...I'll update the spec with the ternary | 19:10 |
| ayoung | shaleh, can you -1 it with that comment? | 19:10 |
| ayoung | so we have a record | 19:10 |
| *** aix has quit IRC | 19:11 | |
| shaleh | ayoung: sure | 19:11 |
| shaleh | ayoung: what do you think. If we published a tool to make a stat and report it could we get ops to run it in a reasonably quick manner? | 19:11 |
| *** navid__ has joined #openstack-keystone | 19:12 | |
| *** davechen has joined #openstack-keystone | 19:12 | |
| *** navid__ has quit IRC | 19:15 | |
| *** navid_ has joined #openstack-keystone | 19:15 | |
| shaleh | ayoung: the spec references the URI RFC, which says 'ALPHA'. That usually means A-Za-z, no extended ascii like umlauts or cedilias. | 19:15 |
| shaleh | ayoung: is that our intent? | 19:15 |
| ayoung | shaleh, I hate cedilias | 19:16 |
| ayoung | and umlauts scare me | 19:16 |
| shaleh | ayoung: sure, but we have to allow those goose stepping ulauts :-) | 19:16 |
| ayoung | Nu? | 19:16 |
| ayoung | shaleh, we can start of more strict, so long as we have valid URLs | 19:16 |
| ayoung | if people complain and giove us wiggle room to make URLs still, we can be more forgiving | 19:17 |
| ayoung | I'd rather make sure we have somethint we can actually implement | 19:17 |
| shaleh | ayoung: "valid" is my concern. Technically we have to escape a fair amounf of foreign chars in URLs today | 19:17 |
| shaleh | and those chars are very likely to be used on project names | 19:17 |
| ayoung | http://לברוח זה.com | 19:18 |
| shaleh | That confused the hell out of hexchat :-) | 19:18 |
| shaleh | it showed me the correct chracters but it did not perceive it as a link | 19:18 |
| dstanek | so in a multi-domain setup does the default domain driver need to be in a separate config or should it be in the main config? | 19:20 |
| shaleh | ALPHA = %x41-5A / %x61-7A ; A-Z / a-z <-- the BnF RFC that the URI RFC points at | 19:20 |
| shaleh | ayoung: is there a reason not to support common EU language symbols? | 19:21 |
| ayoung | shaleh, %x41-5A will work as the name....think of it as "we will store the post processed" name, not the pre | 19:22 |
| ayoung | dstanek, you mean LDAP? | 19:23 |
| dstanek | ayoung: yes | 19:23 |
| *** navid_ has quit IRC | 19:23 | |
| ayoung | dstanek, I think it has to be in a separate config, even if it is the default domain | 19:23 |
| dstanek | ayoung: how does keystone know it's the default domain then? | 19:23 |
| ayoung | otherwise, the whole CONF.identity.driver would be the LDAP one | 19:24 |
| ayoung | dstanek, default domain ID is a conf value | 19:24 |
| ayoung | dstanek, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/config.py#n121 | 19:24 |
| ayoung | shaleh, https://逃離這個.com | 19:28 |
| ayoung | Itrs really fun mixing left to right and right to left languages | 19:29 |
| ayoung | https://الهروب من هذا.ic.ac.uk | 19:29 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: force releasenotes warnings to be treated as errors https://review.openstack.org/249988 | 19:29 |
| *** navid_ has joined #openstack-keystone | 19:29 | |
| lbragstad | i have a client side questions for anyone - can the auth endpoint change between login and subsequent requests in the same session? | 19:30 |
| *** ajayaa has quit IRC | 19:35 | |
| shaleh | ayoung: I added comments | 19:38 |
| ayoung | shaleh, cool | 19:38 |
| ayoung | lbragstad, only if your operator hates you | 19:39 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Allow url-safe project and domain names to be optionally enforced https://review.openstack.org/248083 | 19:41 |
| *** roxanaghe has quit IRC | 19:47 | |
| *** tyagiprince has quit IRC | 19:48 | |
| *** nkinder has quit IRC | 19:51 | |
| *** navid_ has quit IRC | 19:51 | |
| stevemar | dstanek: around? | 19:55 |
| *** gildub has joined #openstack-keystone | 19:55 | |
| dstanek | stevemar: sorta | 19:55 |
| dstanek | stevemar: what's up? | 19:55 |
| stevemar | dstanek: was wondering if i could get you to look at https://review.openstack.org/#/c/231872/ | 19:55 |
| stevemar | dstanek: theres some funniness going on in our test fixtures | 19:55 |
| dstanek | stevemar: sure. i can do it a little later today. banging my head against LDAP :-) right now | 19:56 |
| stevemar | dstanek: take it out on LDAP by removing some of it! | 19:57 |
| dstanek | stevemar: quick question. we talked about a multi-domain away ldap driver at some point. will that be a thing? | 19:57 |
| stevemar | hmm? | 19:57 |
| ayoung | dstanek, what's the problem? | 19:58 |
| stevemar | you can have many domains now, each backed by their own identity ldap | 19:58 |
| dstanek | stevemar: right, which can be the same instance. i was just wondering if we had plans to make a single ldap driver multi-domain aware. | 19:58 |
| dstanek | stevemar: i am thinking no | 19:59 |
| *** ohno13 has quit IRC | 20:00 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: WIP List assignments with names https://review.openstack.org/249958 | 20:01 |
| *** urulama has quit IRC | 20:02 | |
| stevemar | dstanek: no plans for that afaik | 20:02 |
| dstanek | stevemar: that's what i thought :-) thx | 20:02 |
| *** urulama has joined #openstack-keystone | 20:02 | |
| stevemar | np | 20:02 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Deprecate the pki and pkiz token providers. https://review.openstack.org/241389 | 20:03 |
| *** csoukup has quit IRC | 20:15 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: WIP List assignments with names https://review.openstack.org/249958 | 20:21 |
| *** john5223 is now known as zz_john5223 | 20:27 | |
| mordred | lbragstad: if that happens, I swear that my face will pop out of the computer screaming | 20:28 |
| *** NM has joined #openstack-keystone | 20:30 | |
| *** exploreshaifali has joined #openstack-keystone | 20:35 | |
| *** shaleh is now known as shaleh|away | 20:35 | |
| stevemar | mordred: now that's a visual | 20:40 |
| stevemar | lbragstad: you and dolphm have a few fernet related patches that are targeted for kilo, still going forward with those? https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:stable/kilo,n,z | 20:40 |
| shaleh|away | when running functional tests is there a way to see the request/response? Is it logged somewhere (or could it be if one set a variable)? | 20:42 |
| *** jasonsb has quit IRC | 20:44 | |
| shaleh|away | OS_LOG_CAPTURE=1 is the trick for that ^^^ BTW | 20:45 |
| *** e0ne has joined #openstack-keystone | 20:58 | |
| *** e0ne has quit IRC | 21:03 | |
| *** shaleh|away is now known as shaleh | 21:07 | |
| *** raildo is now known as raildo-afk | 21:11 | |
| *** zz_john5223 is now known as john5223 | 21:13 | |
| *** urulama has quit IRC | 21:13 | |
| *** urulama has joined #openstack-keystone | 21:14 | |
| *** mylu has joined #openstack-keystone | 21:15 | |
| *** roxanaghe has joined #openstack-keystone | 21:16 | |
| *** exploreshaifali has quit IRC | 21:20 | |
| *** dims_ has joined #openstack-keystone | 21:21 | |
| *** dims has quit IRC | 21:22 | |
| *** pauloewerton has quit IRC | 21:24 | |
| *** dims has joined #openstack-keystone | 21:26 | |
| *** nkinder has joined #openstack-keystone | 21:27 | |
| *** ayoung has quit IRC | 21:27 | |
| *** dims_ has quit IRC | 21:28 | |
| *** openstackgerrit has quit IRC | 21:36 | |
| *** openstackgerrit has joined #openstack-keystone | 21:37 | |
| *** aginwala has joined #openstack-keystone | 21:38 | |
| *** aginwala has quit IRC | 21:39 | |
| *** aginwala has joined #openstack-keystone | 21:40 | |
| stevemar | ah shaleh is so kind, helping out folks in #openstack with CLI | 21:44 |
| stevemar | paying your dues, paying your dues | 21:44 |
| stevemar | we've all been there | 21:44 |
| shaleh | stevemar: poor sap destroyed his running system following Internet advice. pip install --upgrade on top of debs | 21:46 |
| shaleh | stevemar: so he had half running openstack Ubuntu devs | 21:46 |
| shaleh | s/devs/debs/ | 21:46 |
| shaleh | it was pathetic really. Poor guy is linux savvy but not really admin material | 21:47 |
| stevemar | shaleh: i've been following the conversation | 21:47 |
| stevemar | shaleh: you and sam-i-am have been helping a lot | 21:47 |
| stevemar | thanks for being so patient | 21:47 |
| shaleh | I would not be here today if people had not given me the same kindness. | 21:48 |
| shaleh | although my sysadmin teacher beat it into my head pretty quickly how not to hose boxen :-) | 21:49 |
| shaleh | you only need to hose a box once at work to really learn | 21:50 |
| *** thiagop has quit IRC | 21:51 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Ensure endpoints returned is filtered correctly https://review.openstack.org/250032 | 21:52 |
| stevemar | shaleh: yep, or you take snapshots | 21:53 |
| *** dims_ has joined #openstack-keystone | 21:53 | |
| shaleh | stevemar: I learned before there were snapshots or even sudo | 21:53 |
| shaleh | I was taught to type a command, take hands off the keyboard and read it back, then press enter | 21:54 |
| shaleh | but yeah, I love snapshots now. LVM, Virtual Machines, etc. | 21:54 |
| stevemar | shaleh: read it back AND think about it :) | 21:55 |
| shaleh | stevemar: yup :-) | 21:56 |
| *** dims has quit IRC | 21:56 | |
| * shaleh cuts his teeth on a crusty commercial BSD | 21:56 | |
| shaleh | man I do not miss that pile o' crap | 21:56 |
| stevemar | we all had to start somewhere i suppose | 21:56 |
| shaleh | yup | 21:57 |
| shaleh | teach them how to fix it, how to think about the solution. Hopefully they pass it on to others | 21:57 |
| shaleh | When I was a Debian hacker I used to buy copies of W. Richard Stevens APUE for newbie hackers who had one too many C bugs. | 21:58 |
| shaleh | if that book can't make you a decent Unix hacker nothing will | 21:58 |
| *** aginwala_ has joined #openstack-keystone | 22:02 | |
| *** aginwala_ has quit IRC | 22:02 | |
| *** NM has quit IRC | 22:03 | |
| *** urulama has quit IRC | 22:03 | |
| *** urulama has joined #openstack-keystone | 22:03 | |
| *** aginwala_ has joined #openstack-keystone | 22:05 | |
| *** aginwala has quit IRC | 22:06 | |
| *** aginwala has joined #openstack-keystone | 22:08 | |
| *** aginwala has quit IRC | 22:08 | |
| *** aginwala_ has quit IRC | 22:08 | |
| *** aginwala has joined #openstack-keystone | 22:08 | |
| stevemar | shaleh: night time reading for me! http://poincare.matf.bg.ac.rs/~ivana//courses/ps/sistemi_knjige/pomocno/apue.pdf | 22:11 |
| davechen | Happy holiday to anyone who celebrates thanksgiving. | 22:12 |
| shaleh | stevemar: in all honesty, his books should be every Linux hacker's foundation. His TCP series is still the standard to work from. | 22:13 |
| shaleh | admittedly he was a BSD guy and it shows. But that does not reduce their value. | 22:13 |
| shaleh | these days we work at a higher level but whenever we need to step down into the details this is the deal. | 22:14 |
| shaleh | his section on what makes a daemon is worth it by itself | 22:14 |
| *** gildub has quit IRC | 22:20 | |
| *** harshs has quit IRC | 22:22 | |
| *** davechen has left #openstack-keystone | 22:24 | |
| stevemar | are my replies to the mailing list coming out funny? like the font size increasing? | 22:27 |
| stevemar | i think notes is doing something funny, it just started happening | 22:27 |
| shaleh | the one you sent at 1:40pm about the mid cycle looks normal | 22:30 |
| *** pumaranikar has quit IRC | 22:34 | |
| *** david-lyle has quit IRC | 22:34 | |
| *** pumaranikar has joined #openstack-keystone | 22:34 | |
| *** pumaranikar has quit IRC | 22:36 | |
| *** pumaranikar has joined #openstack-keystone | 22:36 | |
| *** pumaranikar has quit IRC | 22:48 | |
| stevemar | shaleh: what about the most recent one about the midcycle | 22:58 |
| shaleh | stevemar: you asked about odd fonts | 22:59 |
| shaleh | stevemar: the one you sent about the midcycle looks fine | 22:59 |
| stevemar | shaleh: i think it only happens when i reply | 22:59 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: remove PBR from requirements.txt https://review.openstack.org/247400 | 23:00 |
| shaleh | no more PBR? Really? | 23:01 |
| shaleh | can I kick it in the shins on the way out | 23:01 |
| shaleh | ?? | 23:01 |
| stevemar | shaleh: i'm not sure about that one | 23:02 |
| stevemar | i just fixed the commit msg | 23:02 |
| stevemar | i'd need lifeless to take a look at it ^^ | 23:02 |
| stevemar | shaleh: trying to prep ksa/ksm/ksc for mitaka-1 | 23:02 |
| stevemar | and keystone/liberty - keystone/kilo | 23:03 |
| stevemar | fun times | 23:03 |
| lifeless | stevemar: hmm, whats up ? | 23:03 |
| stevemar | lifeless: can you comment on https://review.openstack.org/247400 | 23:04 |
| lifeless | man, we need a faq on this | 23:04 |
| shaleh | FAQ: Q: Doesn't PBR suck? A: yes PBR sucks, but we live with it. | 23:04 |
| lifeless | I would -2 but I don't have the bit | 23:04 |
| *** aginwala has quit IRC | 23:05 | |
| stevemar | lifeless: thanks, i figured that was the answer. | 23:05 |
| stevemar | lifeless: normally these changes can be seen across all projects | 23:05 |
| lifeless | if pbr causes problems, we'll fix it | 23:06 |
| lifeless | shaleh: how does it suck? | 23:06 |
| lifeless | win 70 | 23:06 |
| lifeless | bah | 23:06 |
| *** david-lyle has joined #openstack-keystone | 23:07 | |
| shaleh | lifeless: it is hard to express it without vitriol. Sorry. The hours we have lost dealing with PBR related failures is high. | 23:07 |
| stevemar | mordred: last time i had an issue with pypi you fixed it magically, do you know whats going on here: https://pypi.python.org/pypi/python-keystoneclient | 23:07 |
| shaleh | often the real problem is not PBR but PBR gets in the middle and obscures the errors | 23:07 |
| stevemar | mordred: the page only says 1.3.3 is available, but we're at 1.8.1 now | 23:07 |
| lifeless | shaleh: are they pbr problems, or setupt-qrequires problems? | 23:08 |
| shaleh | lifeless: usually it has something to do with the monkey patching | 23:08 |
| lifeless | stevemar: https://pypi.python.org/simple/python-keystoneclient/ is worth a look | 23:09 |
| lifeless | stevemar: and that shows better data, so its worth pinging dstufft in #python-infra or #pypa-dev and asking | 23:09 |
| *** aginwala has joined #openstack-keystone | 23:09 | |
| lifeless | shaleh: pbr doesn't monkey patch anything; it uses the setuptools defined interfaces | 23:09 |
| stevemar | lifeless: danke | 23:09 |
| lifeless | shaleh: if you can file a bug whenever pbr is in the way, so we can improve it, that would be helpful | 23:09 |
| shaleh | lifeless: I will try. Like I said, often the culprit is some kind of slight mismatch and PBR just seems to mask the real problem. | 23:10 |
| lifeless | shaleh: sure, but masking the problem is a bug itself | 23:10 |
| shaleh | I have fixed many of these at work and when it was over I had no idea what the actual problem was. But it works now. | 23:11 |
| shaleh | which is where the frustration comes from | 23:11 |
| lifeless | shaleh: I would speculate that setuptools inability to deal with conflicts with setup_requires is a big component | 23:11 |
| lifeless | shaleh: we're working on being able to avoid / fix that upstream in the python packaging ecosystem | 23:11 |
| shaleh | lifeless: I'm inclined to agree | 23:11 |
| lifeless | shaleh: its not something we can fix from within pbr | 23:11 |
| lifeless | shaleh: there were some bad hacks to try, but they blew up in their own special ways :) | 23:11 |
| shaleh | lifeless: :-) | 23:12 |
| lifeless | [such as recursively invoking pip from within pbr...] aieee | 23:12 |
| shaleh | lifeless: at work, PBR is basically a curse you only inflict on your worst enemies | 23:12 |
| shaleh | I have helped most of the team unwedge a box at some point in the last 4 months | 23:13 |
| *** gildub has joined #openstack-keystone | 23:13 | |
| shaleh | lifeless: I get the defined entrance points. But it is kind of like debugging Python Twisted. The callbacks get insane after a while. | 23:14 |
| shaleh | next time I run into a problem I will try to be more methodical and see if our experience can save other | 23:14 |
| shaleh | TBH, I have taken to nuking it from orbit and starting fresh | 23:15 |
| *** med_ has quit IRC | 23:17 | |
| *** RA has joined #openstack-keystone | 23:20 | |
| *** RA is now known as Guest43529 | 23:20 | |
| *** david-lyle has quit IRC | 23:24 | |
| *** med_ has joined #openstack-keystone | 23:25 | |
| lifeless | shaleh: where is work ? | 23:26 |
| shaleh | lifeless: I am an HPE hacker too :-) I work with Guang at the Sunnyvale office. | 23:27 |
| shaleh | the frustration usually goes something like this: User had a VM they were hacking on a couple of weeks ago but they put it down to work on something else. They wake the VM up, do a git pull or the like and BAM nothing works. The real culprit is often tox or virtualenv or pip not being up to date. | 23:30 |
| *** csoukup has joined #openstack-keystone | 23:30 | |
| shaleh | coupled with user ran the VM at home without the proxy/VPN and now at the office those are needed so first there are random weird network issues | 23:30 |
| shaleh | I often walk over when I heard the cursing and gnashing | 23:31 |
| lifeless | shaleh: interesting | 23:31 |
| lifeless | shaleh: ok so - I point people at this often - https://rbtcollins.wordpress.com/2015/07/12/bootstrapping-developer-environments-for-openstack/ | 23:31 |
| shaleh | getting everyone on the virtualenv wagon will definitely be a plus | 23:32 |
| shaleh | devstack seems to amplify my dislike of PBR because I fight it there more often than not | 23:33 |
| shaleh | personally | 23:33 |
| shaleh | for some reason install stock Ubuntu, run devstack just leads to pain. | 23:33 |
| shaleh | I really, really, really want devstack to separate "setup for this machine for devstack's peculiar wants", "setup openstack", and "start all of the processes" | 23:35 |
| shaleh | this way I can easily snapshot machines between the steps | 23:36 |
| shaleh | if I had more spare time I have been thinking of just making a series of ansible playbooks that re-implemented devstack and be done with it | 23:37 |
| lifeless | shaleh: that might be nice; the initial setup does change over time though | 23:37 |
| lifeless | shaleh: are you using constraints, or you're still on kilo devstack? | 23:37 |
| shaleh | lifeless: sure, but I can easily run 'ensure env is sane' when i want | 23:37 |
| shaleh | the fact that it runs every time is the extra annoying part | 23:37 |
| shaleh | lifeless: I need to catch up, I started with a late kilo/early libery version for a project I was hacking on | 23:38 |
| shaleh | lifeless: re: your blog post, bindeps sounds interesting | 23:41 |
| shaleh | lifeless: something that blows up if the pip installed is the one from apt-get would be nice :-) | 23:42 |
| shaleh | if `dpkg -l | grep python-pip`; then die horrible; fi | 23:42 |
| shaleh | the number of lost souls who install that pip, then run --upgrade | 23:43 |
| shaleh | it just goes downhill from there | 23:43 |
| lifeless | shaleh: yep | 23:46 |
| lifeless | shaleh: file a bug on bindep, a negative-requirement seems like a plausible thing | 23:47 |
| lifeless | shaleh: (or a patch :)) | 23:47 |
| *** EinstCrazy has joined #openstack-keystone | 23:48 | |
| *** aginwala has quit IRC | 23:48 | |
| shaleh | lifeless: pull request on github or review on gerrit? | 23:48 |
| lifeless | shaleh: gerrit | 23:48 |
| shaleh | lifeless: roger that | 23:48 |
| shaleh | Sam-I-Am and I rescued a guy's system earlier today. Another admin set it up with Ubuntu packages and left. He was asked to fix a problem. All of the Internet wisdom says 'pip install something' so he tried. Totally wrecked things. | 23:50 |
| lifeless | yah | 23:50 |
| lifeless | ubuntu's patch to change pip to --user by default -> lots of havoc | 23:50 |
| shaleh | combination of packages versus pip AND kilo versus current | 23:50 |
| *** aginwala has joined #openstack-keystone | 23:50 | |
| shaleh | when did that go in? | 23:51 |
| shaleh | is that active in 14.04? | 23:51 |
| *** EinstCrazy has quit IRC | 23:52 | |
| *** devl_ has quit IRC | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!