| *** gyee has quit IRC | 00:07 | |
| *** gyee has joined #openstack-keystone | 00:14 | |
| *** ChanServ sets mode: +v gyee | 00:14 | |
| *** gyee has quit IRC | 00:24 | |
| *** henrynash has quit IRC | 00:24 | |
| *** harlowja_ has joined #openstack-keystone | 00:27 | |
| *** harlowja has quit IRC | 00:30 | |
| *** shoutm has quit IRC | 00:32 | |
| *** sripriya has quit IRC | 00:41 | |
| *** shaleh has quit IRC | 00:59 | |
| *** clayton has quit IRC | 01:17 | |
| *** EinstCrazy has joined #openstack-keystone | 01:17 | |
| *** clayton has joined #openstack-keystone | 01:18 | |
| *** davechen has joined #openstack-keystone | 01:19 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for endpoint policy SQL driver https://review.openstack.org/212006 | 01:20 |
|---|---|---|
| *** _cjones_ has quit IRC | 01:24 | |
| *** clayton has quit IRC | 01:30 | |
| *** gyee has joined #openstack-keystone | 01:31 | |
| *** ChanServ sets mode: +v gyee | 01:31 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Be consistent in how we give error codes in the Identity spec https://review.openstack.org/263960 | 01:32 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fixes query.one() return usage in endpoint-policy https://review.openstack.org/208609 | 01:33 |
| *** fangxu_ has joined #openstack-keystone | 01:33 | |
| samueldmq | bknudson_: responded and sent a new version, let me know if this makes sense to you ^ | 01:33 |
| *** fangxu has quit IRC | 01:34 | |
| *** fangxu_ is now known as fangxu | 01:34 | |
| *** _zouyee has joined #openstack-keystone | 01:37 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for the policy SQL driver https://review.openstack.org/212957 | 01:41 |
| *** davechen1 has joined #openstack-keystone | 01:43 | |
| *** davechen has quit IRC | 01:46 | |
| *** davechen has joined #openstack-keystone | 01:48 | |
| *** davechen1 has quit IRC | 01:50 | |
| *** clayton has joined #openstack-keystone | 01:50 | |
| *** henrynash has joined #openstack-keystone | 01:58 | |
| *** ChanServ sets mode: +v henrynash | 01:58 | |
| stevemar | dstanek: need you to take a quick look at: https://review.openstack.org/#/c/263113/ | 02:03 |
| stevemar | it is a hacking change and the author isn't groking how it's done | 02:04 |
| *** henrynash has quit IRC | 02:14 | |
| *** davechen has quit IRC | 02:15 | |
| *** topol has joined #openstack-keystone | 02:44 | |
| *** ChanServ sets mode: +v topol | 02:44 | |
| *** topol has quit IRC | 02:48 | |
| *** dims has quit IRC | 02:59 | |
| *** browne has quit IRC | 03:02 | |
| *** browne has joined #openstack-keystone | 03:02 | |
| *** fangxu has quit IRC | 03:04 | |
| *** niusmallnan has joined #openstack-keystone | 03:07 | |
| *** niusmallnan has left #openstack-keystone | 03:09 | |
| *** fangxu has joined #openstack-keystone | 03:18 | |
| *** fangxu has quit IRC | 03:23 | |
| *** gyee has quit IRC | 03:30 | |
| *** woodster_ has quit IRC | 03:36 | |
| *** zqfan has joined #openstack-keystone | 03:40 | |
| *** links has joined #openstack-keystone | 03:51 | |
| *** richm has quit IRC | 03:53 | |
| *** browne has quit IRC | 04:08 | |
| *** PsionTheory has quit IRC | 04:13 | |
| *** oomichi has quit IRC | 04:49 | |
| *** Nirupama has joined #openstack-keystone | 05:07 | |
| *** fangxu has joined #openstack-keystone | 05:10 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:17 | |
| *** Magesh has joined #openstack-keystone | 05:36 | |
| Magesh | now i configuring openstack liberty version | 05:36 |
| Magesh | when i restart httpd service i am getting error | 05:37 |
| Magesh | error mentioned below | 05:37 |
| Magesh | [root@controller ~]# systemctl restart httpd.service Job for httpd.service failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details. | 05:37 |
| Magesh | Please help me | 05:37 |
| Magesh | [root@controller ~]# service httpd status | 05:38 |
| Magesh | Redirecting to /bin/systemctl status httpd.service httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled) Drop-In: /usr/lib/systemd/system/httpd.service.d └─openstack-dashboard.conf Active: failed (Result: exit-code) since Wed 2016-01-06 06:35:43 CET; 2min 21s ago Process: 19294 ExecStartPre=/usr/bin/python /usr/share/openstack-dashboard/manage.py c | 05:38 |
| *** jrist has quit IRC | 05:39 | |
| Magesh | when i restart httpd service i am getting error | 05:44 |
| Magesh | systemctl restart httpd.service | 05:44 |
| Magesh | failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details. | 05:45 |
| *** jrist has joined #openstack-keystone | 05:51 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Implements base classes for functional tests https://review.openstack.org/253971 | 05:54 |
| *** henrynash has joined #openstack-keystone | 05:55 | |
| *** ChanServ sets mode: +v henrynash | 05:55 | |
| *** Magesh has quit IRC | 06:00 | |
| *** Magesh has joined #openstack-keystone | 06:02 | |
| Magesh | Hi | 06:02 |
| Magesh | when i restart httpd service getting error | 06:02 |
| Magesh | [root@controller ~]# systemctl restart httpd.service Job for httpd.service failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details. | 06:02 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Be consistent in how we give error codes in the Identity spec https://review.openstack.org/263960 | 06:06 |
| Magesh | hi | 06:14 |
| Magesh | help me | 06:14 |
| Magesh | now i configuring openstack liberty | 06:15 |
| Magesh | when i restart httpd service getting error | 06:15 |
| Magesh | Job for httpd.service failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details. | 06:15 |
| *** david-lyle_ has joined #openstack-keystone | 06:24 | |
| *** gwei3 has joined #openstack-keystone | 06:34 | |
| Magesh | when i restart httpd service getting error | 06:38 |
| Magesh | Job for httpd.service failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details | 06:39 |
| Magesh | in openstack liberty | 06:39 |
| openstackgerrit | Merged openstack/keystone: Define paste entrypoints https://review.openstack.org/263155 | 06:46 |
| *** chlong has quit IRC | 06:50 | |
| *** david-lyle_ has quit IRC | 06:56 | |
| *** belmoreira has joined #openstack-keystone | 06:59 | |
| *** gwei31 has joined #openstack-keystone | 07:00 | |
| *** gwei31 has quit IRC | 07:01 | |
| *** gwei3 has quit IRC | 07:01 | |
| *** Magesh has quit IRC | 07:07 | |
| *** shoutm has joined #openstack-keystone | 07:11 | |
| *** spandhe has joined #openstack-keystone | 07:20 | |
| *** e0ne has joined #openstack-keystone | 07:25 | |
| *** henrynash has quit IRC | 07:30 | |
| *** shoutm_ has joined #openstack-keystone | 07:30 | |
| *** shoutm has quit IRC | 07:33 | |
| *** henrynash has joined #openstack-keystone | 07:33 | |
| *** ChanServ sets mode: +v henrynash | 07:33 | |
| *** fawadkhaliq has quit IRC | 07:37 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules for domain specific role assignments https://review.openstack.org/263549 | 07:39 |
| *** fawadkhaliq has joined #openstack-keystone | 07:40 | |
| *** magesh has joined #openstack-keystone | 07:41 | |
| magesh | when restart httpd service getting error | 07:41 |
| magesh | [root@controller ~]# systemctl restart httpd.service memcached.service Job for httpd.service failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details. | 07:42 |
| openstackgerrit | Merged openstack/keystone: Do not use __builtin__ in python3 https://review.openstack.org/262773 | 07:47 |
| *** fawadkhaliq has quit IRC | 07:48 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:49 | |
| *** spandhe has quit IRC | 08:02 | |
| *** chlong has joined #openstack-keystone | 08:11 | |
| openstackgerrit | Merged openstack/keystone: Use oslo_config PortOpt support https://review.openstack.org/238291 | 08:14 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264065 | 08:16 |
| openstackgerrit | henry-nash proposed openstack/keystone: Correct docstring for federation driver interface https://review.openstack.org/264068 | 08:26 |
| *** shoutm_ has quit IRC | 08:29 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Correct docstring for federation driver interface https://review.openstack.org/264068 | 08:31 |
| openstackgerrit | henry-nash proposed openstack/keystone: Create V9 version of federation driver interface https://review.openstack.org/262307 | 08:31 |
| *** shoutm has joined #openstack-keystone | 08:31 | |
| *** EinstCra_ has joined #openstack-keystone | 08:32 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Correct docstrings for federation driver interface https://review.openstack.org/264068 | 08:33 |
| *** EinstCrazy has quit IRC | 08:35 | |
| *** shoutm has quit IRC | 08:40 | |
| *** fawadkhaliq has quit IRC | 08:46 | |
| *** henrynash has quit IRC | 08:49 | |
| openstackgerrit | Reedip proposed openstack/pycadf: remove suport for py33 https://review.openstack.org/264081 | 08:55 |
| *** fawadkhaliq has joined #openstack-keystone | 08:56 | |
| *** fhubik has joined #openstack-keystone | 09:00 | |
| *** fhubik is now known as fhubik_brb | 09:05 | |
| *** fawadkhaliq has quit IRC | 09:07 | |
| openstackgerrit | Merged openstack/keystone: Config option for insecure responses https://review.openstack.org/207226 | 09:08 |
| openstackgerrit | Merged openstack/keystone: Correct SecurityError with unicode args https://review.openstack.org/248464 | 09:10 |
| *** shoutm has joined #openstack-keystone | 09:14 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264065 | 09:16 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264065 | 09:17 |
| *** jistr has joined #openstack-keystone | 09:17 | |
| *** mhickey has joined #openstack-keystone | 09:19 | |
| *** aix has joined #openstack-keystone | 09:23 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:35 | |
| *** fawadkhaliq has quit IRC | 09:36 | |
| *** fhubik_brb is now known as fhubik | 09:38 | |
| *** EinstCra_ has quit IRC | 09:40 | |
| *** EinstCrazy has joined #openstack-keystone | 09:42 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:43 | |
| *** fhubik is now known as fhubik_brb | 09:45 | |
| *** _zouyee has quit IRC | 09:46 | |
| *** EinstCrazy has quit IRC | 10:04 | |
| *** shoutm has quit IRC | 10:05 | |
| *** fawadkhaliq has quit IRC | 10:09 | |
| *** fhubik_brb is now known as fhubik | 10:17 | |
| *** shoutm has joined #openstack-keystone | 10:24 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:44 | |
| *** fawadkhaliq has quit IRC | 10:45 | |
| *** dims has joined #openstack-keystone | 10:47 | |
| *** fhubik is now known as fhubik_brb | 10:48 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:54 | |
| *** mhickey has quit IRC | 10:56 | |
| *** fawadkhaliq has quit IRC | 10:56 | |
| *** _zouyee has joined #openstack-keystone | 10:57 | |
| *** fhubik_brb is now known as fhubik | 11:03 | |
| *** GB21 has joined #openstack-keystone | 11:07 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:10 | |
| *** lhcheng has joined #openstack-keystone | 11:19 | |
| *** ChanServ sets mode: +v lhcheng | 11:19 | |
| *** fawadkhaliq has quit IRC | 11:24 | |
| *** fhubik is now known as fhubik_brb | 11:45 | |
| *** mhickey has joined #openstack-keystone | 11:46 | |
| *** Magesh_ has joined #openstack-keystone | 11:49 | |
| Magesh_ | when i restarting httpd service getting error | 11:49 |
| Magesh_ | [root@controller ~]# systemctl start httpd.service Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details. | 11:50 |
| *** doug-fish has joined #openstack-keystone | 11:59 | |
| *** lhcheng has quit IRC | 12:16 | |
| *** lhcheng has joined #openstack-keystone | 12:17 | |
| *** ChanServ sets mode: +v lhcheng | 12:17 | |
| *** pauloewerton has joined #openstack-keystone | 12:19 | |
| *** kashyap has joined #openstack-keystone | 12:21 | |
| *** lhcheng has quit IRC | 12:21 | |
| *** ktychkova has quit IRC | 12:22 | |
| *** GB21 has quit IRC | 12:22 | |
| kashyap | Hi folks, stumbled across this yak, while trying to do another test - with today's Git, does anyone else see these kind of Keystone errors when setting up DevStack? -- https://bugs.launchpad.net/devstack/+bug/1490950 | 12:23 |
| openstack | Launchpad bug 1490950 in devstack "stack.sh on master fails during creation some Keystone roles" [Undecided,New] | 12:23 |
| kashyap | As I noted in comment#5, it's still reproducible despite upgrading python-openstackclient, and re-doing it. | 12:24 |
| *** gordc has joined #openstack-keystone | 12:26 | |
| *** fawadkhaliq has joined #openstack-keystone | 12:38 | |
| *** fawadkhaliq has quit IRC | 12:39 | |
| *** fawadkhaliq has joined #openstack-keystone | 12:39 | |
| *** EinstCrazy has joined #openstack-keystone | 12:53 | |
| *** fhubik_brb is now known as fhubik | 13:01 | |
| dims | kashyap : i bet you will see some issues in keystone's logs (i've seen some VersionConflict errors when library versions are mismatched) | 13:06 |
| kashyap | dims: I did look at the log, but it was mostly about CLI parsing errors | 13:08 |
| kashyap | dims: But, I can't claim I've deeply investigated the log - so I'll look at it closely | 13:09 |
| kashyap | Thanks | 13:09 |
| *** EinstCrazy has quit IRC | 13:09 | |
| kashyap | dims: Duh, you're right - "ContextualVersionConflict: (urllib3 1.14 (/usr/lib/python2.7/site-packages), Requirement.parse('urllib3==1.13.1'), set(['requests'])) | 13:11 |
| kashyap | " | 13:11 |
| dims | :) | 13:11 |
| *** EinstCrazy has joined #openstack-keystone | 13:11 | |
| *** EinstCrazy has quit IRC | 13:12 | |
| *** martinus__ has quit IRC | 13:13 | |
| *** martinus__ has joined #openstack-keystone | 13:15 | |
| dims | kashyap : can you get me a paste with the traceback and a few more lines before this happens? | 13:15 |
| dims | oops...pretty please :) | 13:15 |
| kashyap | 1 sec, torn between several SSH sessions | 13:15 |
| kashyap | dims: http://paste.fedoraproject.org/307746/45208618/ | 13:17 |
| kashyap | It has complete log, didn't trim it I'm afraid. | 13:17 |
| dims | kashyap : so typically i go to /opt/stack/keystone and do a pip install of the requirements.txt when i run into this | 13:18 |
| dims | and then try a restart | 13:19 |
| dims | "pip install -U -r requirements.txt" | 13:19 |
| kashyap | dims: Okay, let me try that. Yeah, probably I should make a habit of it | 13:19 |
| dims | throw in a sudo depending on your environment | 13:19 |
| *** dslev has joined #openstack-keystone | 13:22 | |
| dstanek | stevemar: ok, looking now | 13:23 |
| kashyap | Yeah, I normally place everything under ~/src | 13:23 |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/python-keystoneclient: Handle EmptyCatalog exception in list federated projects https://review.openstack.org/243153 | 13:29 |
| *** Nirupama has quit IRC | 13:29 | |
| *** links has quit IRC | 13:32 | |
| *** edmondsw has joined #openstack-keystone | 13:34 | |
| *** magesh has quit IRC | 13:38 | |
| *** Magesh_ has quit IRC | 13:38 | |
| *** lhinds has joined #openstack-keystone | 13:38 | |
| *** dslev has quit IRC | 13:38 | |
| *** topol has joined #openstack-keystone | 13:39 | |
| *** ChanServ sets mode: +v topol | 13:39 | |
| *** topol has quit IRC | 13:42 | |
| *** dave-mccowan has joined #openstack-keystone | 13:45 | |
| *** thiagop has joined #openstack-keystone | 13:49 | |
| *** ninag has joined #openstack-keystone | 14:02 | |
| *** petertr7_away is now known as petertr7 | 14:05 | |
| *** richm has joined #openstack-keystone | 14:08 | |
| *** ayoung has joined #openstack-keystone | 14:11 | |
| *** ChanServ sets mode: +v ayoung | 14:11 | |
| *** richm has quit IRC | 14:12 | |
| *** dslevin_ has joined #openstack-keystone | 14:12 | |
| *** links has joined #openstack-keystone | 14:22 | |
| *** richm has joined #openstack-keystone | 14:24 | |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/python-keystoneclient: Handle EmptyCatalog exception in list federated projects https://review.openstack.org/243153 | 14:27 |
| *** links has quit IRC | 14:28 | |
| *** jsavak has joined #openstack-keystone | 14:32 | |
| *** jsavak has quit IRC | 14:32 | |
| *** jsavak has joined #openstack-keystone | 14:33 | |
| *** jbell8 has joined #openstack-keystone | 14:37 | |
| *** gordc has quit IRC | 14:37 | |
| *** kashyap has left #openstack-keystone | 14:46 | |
| openstackgerrit | Merged openstack/oslo.policy: Add string format rendering to RoleCheck.__call__() https://review.openstack.org/258808 | 14:55 |
| *** gordc has joined #openstack-keystone | 14:55 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:59 | |
| *** phalmos has joined #openstack-keystone | 15:02 | |
| *** thiagop is now known as thiagop-lunch | 15:03 | |
| *** _zouyee has quit IRC | 15:07 | |
| dolphm | lbragstad: you asked me about one of davechen's comments the other day - this review is also related if you're still interested https://review.openstack.org/#/c/258785/2/keystone/tests/unit/test_associate_project_endpoint_extension.py | 15:19 |
| *** lhcheng has joined #openstack-keystone | 15:19 | |
| *** ChanServ sets mode: +v lhcheng | 15:19 | |
| lbragstad | dolphm I did see that, I will be sure to review it today | 15:19 |
| *** timcline has joined #openstack-keystone | 15:25 | |
| *** petertr7 is now known as petertr7_away | 15:28 | |
| *** breitz has quit IRC | 15:30 | |
| *** lhinds has quit IRC | 15:30 | |
| *** breitz has joined #openstack-keystone | 15:30 | |
| *** lhinds has joined #openstack-keystone | 15:30 | |
| *** petertr7_away is now known as petertr7 | 15:35 | |
| *** tonytan4ever has joined #openstack-keystone | 15:40 | |
| *** lhcheng_ has joined #openstack-keystone | 15:48 | |
| *** KarthikB has joined #openstack-keystone | 15:48 | |
| openstackgerrit | Merged openstack/keystone-specs: Clarify project hierarchy and parent usage within the API https://review.openstack.org/200624 | 15:49 |
| *** lhcheng has quit IRC | 15:51 | |
| *** slberger has joined #openstack-keystone | 15:54 | |
| *** topol has joined #openstack-keystone | 15:56 | |
| *** ChanServ sets mode: +v topol | 15:57 | |
| *** phalmos has quit IRC | 16:02 | |
| *** jsavak has quit IRC | 16:04 | |
| *** fangxu has quit IRC | 16:06 | |
| *** lhinds has quit IRC | 16:06 | |
| *** jsavak has joined #openstack-keystone | 16:08 | |
| *** slberger1 has joined #openstack-keystone | 16:10 | |
| *** kfox1111 has left #openstack-keystone | 16:11 | |
| *** slberger has quit IRC | 16:12 | |
| *** vgridnev has joined #openstack-keystone | 16:13 | |
| *** Qiang has joined #openstack-keystone | 16:16 | |
| *** belmoreira has quit IRC | 16:18 | |
| *** shoutm has quit IRC | 16:23 | |
| *** Qiang has quit IRC | 16:24 | |
| *** qiangw has joined #openstack-keystone | 16:25 | |
| *** qiangw has left #openstack-keystone | 16:25 | |
| *** fhubik is now known as fhubik_brb | 16:31 | |
| *** fhubik_brb is now known as fhubik | 16:33 | |
| *** dslevin_ has quit IRC | 16:34 | |
| *** diazjf has joined #openstack-keystone | 16:37 | |
| openstackgerrit | Merged openstack/pycadf: Put py34 first in the env order of tox https://review.openstack.org/260516 | 16:40 |
| openstackgerrit | Merged openstack/pycadf: remove suport for py33 https://review.openstack.org/264081 | 16:40 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 16:42 |
| openstackgerrit | ayoung proposed openstack/keystone: SQL migrations for implied roles https://review.openstack.org/264259 | 16:42 |
| openstackgerrit | ayoung proposed openstack/keystone: backend for implied roles https://review.openstack.org/264260 | 16:42 |
| *** dslevin_ has joined #openstack-keystone | 16:44 | |
| *** _cjones_ has joined #openstack-keystone | 16:47 | |
| *** dslevin_ has quit IRC | 16:49 | |
| *** fhubik has quit IRC | 16:51 | |
| dtroyer_zz | stevemar: I need a bit of refresh re DevStack and Identity v3… do you know if we still run jobs using v2 anywhere? | 16:52 |
| stevemar | dtroyer_zz: i believe it's all v3 nowadays | 16:56 |
| openstackgerrit | Merged openstack/keystone-specs: Be consistent in how we give error codes in the Identity spec https://review.openstack.org/263960 | 16:58 |
| *** gyee has joined #openstack-keystone | 16:58 | |
| *** ChanServ sets mode: +v gyee | 16:58 | |
| stevemar | dolphm: keystoneauth for liberty has been busted for a while | 16:59 |
| dolphm | stevemar: yeah, i've heard complaints | 17:00 |
| dtroyer_zz | coolness, thanks stevemar | 17:00 |
| stevemar | dolphm: i was going to look at it next week, i think it's got to with how other libraries are using it in the dsvm setup | 17:02 |
| stevemar | dtroyer_zz: v2 APIs will still work | 17:07 |
| stevemar | auth and crud | 17:07 |
| stevemar | dtroyer_zz: but the way we setup devstack, and the scripts only call v3 APIs to set everything up | 17:08 |
| *** phalmos has joined #openstack-keystone | 17:08 | |
| *** henrynash has joined #openstack-keystone | 17:10 | |
| *** ChanServ sets mode: +v henrynash | 17:10 | |
| *** jgriffith is now known as jgriffith_away | 17:15 | |
| dtroyer_zz | that's my concern, whether DevStack still needs to support v2 itself (not starting it, but using it) | 17:16 |
| dtroyer_zz | I've seen some reviews come in with v3 hard-coded | 17:16 |
| dtroyer_zz | if we can properly start and test v2 but stack.sh only uses v3, I'm happy-ish | 17:17 |
| dtroyer_zz | (modulo hard-codin ickyness) | 17:17 |
| ayoung | henrynash, I split the patch | 17:21 |
| ayoung | I only added you as co-author on the API piece. Is that accurate? | 17:22 |
| henrynash | ayoung: yep, just saw that…. | 17:22 |
| ayoung | henrynash, and it is not to be stingy with credit, just want you to be able to +2 more of it | 17:22 |
| henrynash | ayoung: I think that’s fair (although, I added a tiny bit to the controller to interpret the role_id in the indirect and a new test in test_assignment to check for it…..so maybe if we are being strict….) | 17:23 |
| henrynash | ayoung: didn’t suspect stingyness at all! | 17:23 |
| ayoung | henrynash, that is all in the API section of the split patches | 17:24 |
| henrynash | ayoung: in deed | 17:24 |
| henrynash | (as well as indeed) | 17:24 |
| bknudson_ | one of you can +2 since you're both cores. | 17:25 |
| bknudson_ | as long as you both agree on the changes | 17:25 |
| ayoung | samueldmq, care to look at those: you origianlly suggested the split | 17:25 |
| ayoung | https://review.openstack.org/#/c/264259/ is the first one/ migration | 17:26 |
| *** jgriffith_away is now known as jgriffith | 17:30 | |
| openstackgerrit | Harshada Mangesh Kakad proposed openstack/keystone: Fixing the deprecated library function. https://review.openstack.org/262731 | 17:31 |
| lbragstad | dstanek it's nice to have you back from vacation! | 17:31 |
| *** e0ne has quit IRC | 17:32 | |
| dstanek | lbragstad: good to be back! | 17:32 |
| lbragstad | dstanek planning on a bug day Friday? | 17:32 |
| *** ninag has quit IRC | 17:33 | |
| *** ninag has joined #openstack-keystone | 17:33 | |
| dstanek | absolutely...i need to update the etherpad | 17:34 |
| lbragstad | dstanek sweet... this one right? https://etherpad.openstack.org/p/keystone-bug-bash | 17:34 |
| stevemar | bug bash, bug smash, bug crash | 17:36 |
| dstanek | yep | 17:36 |
| dstanek | lbragstad: oh, wait no | 17:36 |
| dstanek | https://etherpad.openstack.org/p/keystone-office-hours | 17:36 |
| lbragstad | dstanek do you have a different etherpad? | 17:36 |
| lbragstad | dstanek oh... | 17:37 |
| lbragstad | i thought that was just information about the process | 17:37 |
| *** ninag_ has joined #openstack-keystone | 17:37 | |
| stevemar | can someone explain the magic behind: https://review.openstack.org/#/c/239608/10 | 17:37 |
| lbragstad | do we want to track bugs and progress in there too (weekly)? | 17:37 |
| lbragstad | stevemar we should performance test that... | 17:38 |
| stevemar | "For Mysql, (valid, expires) key is better than (expires, valid) for getting token revocation list query" | 17:38 |
| *** ninag has quit IRC | 17:38 | |
| stevemar | lbragstad: the commit message says he tested it with a million records | 17:38 |
| *** jbell8 has quit IRC | 17:38 | |
| stevemar | i am just wondering why it's better to do one way instead of the other | 17:38 |
| lbragstad | stevemar ah | 17:39 |
| lbragstad | dstanek should we collapse those two etherpads into one? | 17:39 |
| henrynash | ayoung: on implied roles, I think you put me co-author on the API one…most of my code is in the backend one | 17:39 |
| ayoung | henrynash, ah...right | 17:40 |
| *** ninag_ has quit IRC | 17:40 | |
| ayoung | OK I'll add you to both | 17:40 |
| *** ninag has joined #openstack-keystone | 17:40 | |
| henrynash | ayoung: probably the most accurate | 17:40 |
| dstanek | lbragstad: i wouldn't have a problem with that | 17:41 |
| lbragstad | dstanek want to use the office hours one or the bug-bash one? | 17:41 |
| openstackgerrit | ayoung proposed openstack/keystone: backend for implied roles https://review.openstack.org/264260 | 17:41 |
| dstanek | lbragstad: i'll let you pick :-) | 17:42 |
| stevemar | is it cause it's easier to check boolean then date, instead of date then boolean? | 17:44 |
| stevemar | lbragstad: ^ | 17:44 |
| *** ninag has quit IRC | 17:44 | |
| openstackgerrit | Tom Cocozzello proposed openstack/python-keystoneclient: WIP set up incude names for list role assignments https://review.openstack.org/255392 | 17:44 |
| stevemar | dolphm: you too since you are active today: https://review.openstack.org/#/c/239608/10 | 17:44 |
| *** jistr has quit IRC | 17:45 | |
| lbragstad | stevemar I'm not entirely sure, but whatever the case, I think it needs to be added as a comment explaining the reasoning. | 17:45 |
| *** shaleh has joined #openstack-keystone | 17:45 | |
| ayoung | henrynash, I'd like to get the migration merged, even if the others malinger. With there being several migrations all trying to claim the same number, it is going to be the cause of most of the rebasing | 17:47 |
| *** ninag has joined #openstack-keystone | 17:48 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Wrong usage of "a/an" https://review.openstack.org/262340 | 17:48 |
| lbragstad | jorge_munoz do you remember if we ever opened a bug for deprecating the use of 'CONF.is_domain_immutable'? | 17:49 |
| lbragstad | cc - dolphm ^ | 17:49 |
| lbragstad | jorge_munoz I remember us having that as an action item from a conversation we had, I can't remember if the bug was ever opened though. | 17:49 |
| *** RichardRaseley has joined #openstack-keystone | 17:50 | |
| RichardRaseley | Can anyone point me to a good resource on getting started developing against OpenStack Keystone in Python? | 17:50 |
| lbragstad | RichardRaseley http://docs.openstack.org/developer/keystone/developing.html is a good place to start if you haven't read it already | 17:51 |
| RichardRaseley | I've got a Kilo cloud and am working on some tooling against it. At this time it is basic user / role / project management[ | 17:51 |
| lbragstad | RichardRaseley along with - http://docs.openstack.org/developer/keystone/devref/development.environment.html | 17:51 |
| shaleh | RichardRaseley: you mean using python-keystonelient lib for your own apps? | 17:51 |
| RichardRaseley | lbragstad: Thank you. | 17:51 |
| RichardRaseley | shaleh: Yes, I am just going to develop a simple user / role / project management script. | 17:51 |
| lbragstad | RichardRaseley that information can be specific to keystone development. | 17:51 |
| lbragstad | RichardRaseley which might not be exactly what you need (sorry, I jumped to gun in answering your question) | 17:52 |
| *** ninag has quit IRC | 17:52 | |
| shaleh | RichardRaseley: Jamie Lennox and a few of the other devs have nice blogs with short examples. Also, I find just loading up the lib in thr interpreter and experimenting to be a good way to learn. | 17:52 |
| *** ninag has joined #openstack-keystone | 17:53 | |
| lbragstad | RichardRaseley for a script you can use the openstack client | 17:53 |
| RichardRaseley | lbragstad: Yeah, that seems to be good info on setting up a development environment and the like, but I am looking for something to get me started at the code level, e.g here's how you auth, here's how you query users, etc. | 17:53 |
| lbragstad | RichardRaseley ++ to what shaleh said, too | 17:53 |
| RichardRaseley | lbragstad: So you would suggest I just shell out from my python code? | 17:53 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove redundant check after enforcing schema validation https://review.openstack.org/262768 | 17:53 |
| lbragstad | RichardRaseley dolphm also has a simple script that bootstraps a keystone deployment using keystoneclient, that might be helpful for you to reference (as a start) | 17:54 |
| shaleh | RichardRaseley: if you are used to REST, check out the API specs here: https://github.com/openstack/keystone-specs/tree/master/api/v3 | 17:54 |
| RichardRaseley | For someone getting started, would you recommend use of the python libraries or interacting with the API through REST? The former would seem a bit clearer? | 17:54 |
| stevemar | dolphm: i re-added the tests here: https://review.openstack.org/#/c/262768/ they pass locally, i think they were duplicates, but we can remove them in another patch | 17:55 |
| lbragstad | RichardRaseley https://gist.github.com/dolph/02c6d37f49596b3f4298#file-bootstrap-py | 17:55 |
| shaleh | RichardRaseley: essentially you auth by making a Session. Then you call bits of the API using the Session object. The curve is not very steep. | 17:55 |
| lbragstad | RichardRaseley in the long term, using the libraries would be beneficial | 17:56 |
| RichardRaseley | OK, I will poke at it from that direction. Thanks! | 17:56 |
| RichardRaseley | Thank you both, shaleh and lbragstad. | 17:56 |
| lbragstad | RichardRaseley np, good luck! | 17:56 |
| shaleh | RichardRaseley: np | 17:57 |
| *** ninag has quit IRC | 17:57 | |
| *** ninag has joined #openstack-keystone | 17:58 | |
| *** ninag has quit IRC | 18:02 | |
| *** roxanaghe has joined #openstack-keystone | 18:03 | |
| *** phalmos has quit IRC | 18:03 | |
| *** phalmos has joined #openstack-keystone | 18:09 | |
| *** petertr7 is now known as petertr7_away | 18:13 | |
| *** ninag has joined #openstack-keystone | 18:13 | |
| *** jsavak has quit IRC | 18:14 | |
| *** jsavak has joined #openstack-keystone | 18:14 | |
| *** ninag_ has joined #openstack-keystone | 18:14 | |
| *** ninag__ has joined #openstack-keystone | 18:16 | |
| *** mhickey has quit IRC | 18:16 | |
| *** ninag has quit IRC | 18:17 | |
| breton | gyee: yep, I am still working on that bug | 18:18 |
| breton | gyee: sorry for long radiosilence on it | 18:18 |
| *** ninag_ has quit IRC | 18:18 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Docstring: Mark optional parameter as optional. https://review.openstack.org/258349 | 18:21 |
| openstackgerrit | Ayush Garg proposed openstack/keystone: Update warn with warning for logging https://review.openstack.org/264295 | 18:22 |
| *** PsionTheory has joined #openstack-keystone | 18:24 | |
| *** rdo has quit IRC | 18:26 | |
| stevemar | lunch time! | 18:27 |
| gyee | breton, np, I was about to write code :) | 18:27 |
| *** rdo has joined #openstack-keystone | 18:28 | |
| RichardRaseley | lbragstad and shaleh: All of the python examples I am seeing are using `keystoneclient`. Is that what I should be doing, or should I use `openstackclient`? | 18:29 |
| shaleh | RichardRaseley: 'keystoneclient' is provided by python-keystoneclient pip package. Yes, use that for a 100% Python experience. no need to shell out. | 18:29 |
| *** jsavak has quit IRC | 18:30 | |
| shaleh | RichardRaseley: what release of OpenStack are you targeting currently? | 18:30 |
| RichardRaseley | shaleh: OK, so the 'keystoneclient is deprecated' warning from people is more about using from the CLI vs. development. | 18:30 |
| RichardRaseley | shaleh: Juno | 18:30 |
| shaleh | RichardRaseley: yes. The 'keystoneclient' CLI is deprecated. But it is also the name of the Python lib :-) | 18:31 |
| RichardRaseley | Ah, OK | 18:32 |
| shaleh | in Juno I think keystoneclient CLI is your best bet though. | 18:32 |
| shaleh | RichardRaseley: all of the other OpenStack services use python-keystoneclient to talk to keystone. If you grep around for it in their code you will see good examples of authenticating. | 18:33 |
| RichardRaseley | shaleh: OK, thank you! | 18:33 |
| shaleh | RichardRaseley: I just barely saw kilo, so unfortunately my knowledge of juno is mostly from tribal wisdom. | 18:34 |
| *** spandhe has joined #openstack-keystone | 18:38 | |
| *** jsavak has joined #openstack-keystone | 18:40 | |
| *** jbell8 has joined #openstack-keystone | 18:43 | |
| *** e0ne has joined #openstack-keystone | 18:44 | |
| notmorgan | lbragstad: we didn't have a bug for deprecating that but iirc we did it | 18:44 |
| notmorgan | ayoung: this should be an easy +2/+A https://review.openstack.org/#/c/256969/ and closes the loop a but more on keystone-manage bootstrap | 18:46 |
| ayoung | notmorgan, trade you one for one | 18:46 |
| notmorgan | ayoung: depending on how complex and if it's server | 18:46 |
| notmorgan | ayoung: :P | 18:46 |
| ayoung | notmorgan, https://review.openstack.org/#/c/264259/1 but henrynash already undermined me | 18:47 |
| notmorgan | oh | 18:47 |
| ayoung | are we even insiting on tests for migrations anymore? | 18:48 |
| notmorgan | ayoung: we do. | 18:48 |
| notmorgan | ayoung: but mostly it's with data manipulation | 18:48 |
| ayoung | this seemed to be simplicity itself. | 18:49 |
| notmorgan | usually the migration comes with code that exercises it | 18:49 |
| notmorgan | fwiw | 18:49 |
| notmorgan | this one is doing some manipulation of data [creating Fkeys] and should have a simple test to ensure it's created correctly | 18:50 |
| *** fawadkhaliq has quit IRC | 18:50 | |
| notmorgan | or... like i said, code to exercise it vs. just putting in a schema. [follow ups that can merge at the same time is also good] | 18:50 |
| notmorgan | imo | 18:50 |
| ayoung | notmorgan, this was a split...and it is this kind of confusion that made me resist doing the split | 18:51 |
| openstackgerrit | ayoung proposed openstack/keystone: SQL migrations for implied roles https://review.openstack.org/264259 | 18:52 |
| notmorgan | ayoung: i think adding that into the commit message would make it easier to see | 18:55 |
| notmorgan | ayoung: then | 18:55 |
| notmorgan | ayoung: :) | 18:55 |
| *** alejandrito has joined #openstack-keystone | 18:56 | |
| RichardRaseley | I am attempting to write a pretty basic script to manipulate users / roles / projects in Keystone. My first test was this (http://paste.openstack.org/show/483169/) which fails with a keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin: An auth plugin is required to determine endpoint URL. | 18:57 |
| openstackgerrit | ayoung proposed openstack/keystone: SQL migrations for implied roles https://review.openstack.org/264259 | 18:57 |
| *** browne has joined #openstack-keystone | 18:57 | |
| ayoung | notmorgan, henrynash there ya go. | 18:58 |
| notmorgan | ayoung: ++ | 18:58 |
| RichardRaseley | It is not clear to me (in my example above) if I can use the client object directly, or if I have to use it via a session? | 19:00 |
| lbragstad | RichardRaseley can you try using the v3 client? | 19:01 |
| bknudson_ | you pass the session to the client | 19:01 |
| shaleh | lbragstad: Juno | 19:01 |
| lbragstad | oh | 19:01 |
| RichardRaseley | Sorry, I am on Kilo | 19:01 |
| shaleh | RichardRaseley: ah, that is a little more pleasant :-) | 19:02 |
| RichardRaseley | shaleh: Good. =] | 19:02 |
| RichardRaseley | So I first create a session as outlined here: http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html ? | 19:02 |
| bknudson_ | RichardRaseley: http://docs.openstack.org/developer/python-keystoneclient/using-sessions.html | 19:03 |
| bknudson_ | and it's also here http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html#authenticating-using-sessions | 19:03 |
| bknudson_ | unfortunately, it's a little out of date -- sessions are now in keystoneauth and not in keystoneclient | 19:04 |
| *** kfox1111 has joined #openstack-keystone | 19:04 | |
| RichardRaseley | Wow, this is pretty confusing for someone just getting started. | 19:04 |
| *** tonytan4ever has quit IRC | 19:04 | |
| kfox1111 | I'm seeing maybe a bug in keystone client... can someone have alook at this stack trace? | 19:05 |
| kfox1111 | http://pastebin.com/4jmST0kU | 19:05 |
| shaleh | RichardRaseley: it actually follows common Python REST API access practices | 19:05 |
| RichardRaseley | So is there a canonical example for Kilo that I can reference that is up to date? | 19:05 |
| RichardRaseley | shaleh: I don't know what that means in regard to me wanting to write a simple script, all I know is it is quite confusing for me. | 19:05 |
| RichardRaseley | bknudson_: So I need to use keystoneauth? Is that a separate python package? Part of keystone client? | 19:06 |
| bknudson_ | you can continue to use keystoneclient sessions so the docs still work. | 19:06 |
| *** fawadkhaliq has joined #openstack-keystone | 19:06 | |
| bknudson_ | but it's preferred to use keystoneauth. keystoneauth is a separate python package (actually it's keystoneauth1) | 19:06 |
| RichardRaseley | OK | 19:06 |
| kfox1111 | the strange thing is, it looks like a session pool http connection isn't tryign to be reestablished? is this a bug? | 19:07 |
| *** jbell8 has quit IRC | 19:07 | |
| *** petertr7_away is now known as petertr7 | 19:08 | |
| *** fawadkhaliq has quit IRC | 19:13 | |
| *** edmondsw has quit IRC | 19:14 | |
| *** jbell8 has joined #openstack-keystone | 19:14 | |
| *** tonytan4ever has joined #openstack-keystone | 19:15 | |
| *** edmondsw has joined #openstack-keystone | 19:17 | |
| *** harlowja_ has quit IRC | 19:18 | |
| *** harlowja has joined #openstack-keystone | 19:19 | |
| openstackgerrit | Merged openstack/keystone: Reject user creation using admin token without domain https://review.openstack.org/196942 | 19:19 |
| openstackgerrit | Merged openstack/keystone: Updating sample configuration file https://review.openstack.org/264065 | 19:21 |
| *** pece has joined #openstack-keystone | 19:26 | |
| kfox1111 | anyone see that kind of behavior out of keystoneclient? | 19:27 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264320 | 19:30 |
| lbragstad | dolphm dstanek would you think that https://review.openstack.org/#/c/215715/ closes bug 1489061 ? | 19:31 |
| openstack | bug 1489061 in OpenStack Identity (keystone) "fernet token validation is slow" [Medium,Confirmed] https://launchpad.net/bugs/1489061 - Assigned to Grzegorz Grasza (xek) | 19:31 |
| dolphm | lbragstad: it's certainly a Partial-Bug at least | 19:31 |
| dolphm | lbragstad: maybe close it manually with a benchmark to demonstrate? | 19:31 |
| dolphm | whenever we have time for that :P | 19:32 |
| lbragstad | ok | 19:32 |
| dolphm | lbragstad: oh i did benchmark it. | 19:32 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264320 | 19:32 |
| lbragstad | dolphm so, partial or closes? | 19:33 |
| dolphm | lbragstad: from the last profile i did, this was the biggest time sink. the second biggest time sink was listing federated service providers - which marekd was looking into awhile back. i never saw a patch come from that. | 19:33 |
| lbragstad | i'll update the commit message | 19:33 |
| dolphm | lbragstad: just do Partial for now | 19:33 |
| lbragstad | dolphm I don't remember a patch for that | 19:33 |
| *** lhcheng_ has quit IRC | 19:33 | |
| dolphm | lbragstad: i don't either, i wrote a blog post to help him profile keystone himself | 19:33 |
| dolphm | http://dolphm.com/performance-profiling-openstack-services-with-repoze-profile/ | 19:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 19:34 |
| lbragstad | editing commit messages through the new gerrit ui is strange... | 19:34 |
| bknudson_ | editing anything through the new gerrit is strange | 19:36 |
| bknudson_ | or you could just say the new gerrit ui is strange. | 19:36 |
| bknudson_ | searching is strange | 19:36 |
| bknudson_ | copy-paste is strange | 19:36 |
| bknudson_ | empty lines are displayed taller | 19:37 |
| bknudson_ | scrolling is strange | 19:38 |
| bknudson_ | typing comments is strange | 19:38 |
| *** fangxu has joined #openstack-keystone | 19:39 | |
| * dolphm Today's featured rant brought to you by bknudson_ . | 19:40 | |
| tjcocozz | now that we are talking about the ui are the dependencies are listed under 'related changes' tab? | 19:40 |
| dolphm | tjcocozz: yes | 19:40 |
| tjcocozz | dolphm, thank you | 19:40 |
| *** e0ne has quit IRC | 19:47 | |
| stevemar | dolphm: thanks for all the reviews today | 19:47 |
| *** vgridnev has quit IRC | 19:48 | |
| stevemar | searching with the new gerrit ui is definitely strange | 19:49 |
| *** pece has quit IRC | 19:50 | |
| stevemar | dolphm: the liberty branch for keystoneauth fails here: http://logs.openstack.org/18/258318/1/check/gate-tempest-dsvm-neutron-src-keystoneauth/377ba5f/logs/screen-g-api.txt.gz | 19:51 |
| lbragstad | dstanek I updated https://etherpad.openstack.org/p/keystone-office-hours with a bunch of links to patches that close existing bugs - feel free to remove but hopefully it's a start for friday | 19:55 |
| dstanek | lbragstad: nice, thx! | 19:56 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Replace DateTime with BigInteger for Revocation Events https://review.openstack.org/243742 | 19:56 |
| lbragstad | dstanek np | 19:56 |
| dolphm | has anyone seen this i_ convention before? i'm not sure what to google def process_request(i_self, *i_args, **i_kwargs): | 19:58 |
| openstackgerrit | David Stanek proposed openstack/keystone: Change LOG.warn to LOG.warning https://review.openstack.org/263113 | 19:58 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds a hacking check looking for Logger.warn usage https://review.openstack.org/264334 | 19:58 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes hacking logger test cases to use same base https://review.openstack.org/264335 | 19:58 |
| stevemar | dolphm: sounds like soemthing out of java | 19:59 |
| dstanek | dolphm: yuck. where are you seeing that? | 19:59 |
| dolphm | https://review.openstack.org/#/c/244440/6/keystone/tests/unit/test_middleware.py,unified L71 | 19:59 |
| dolphm | dstanek: stevemar: ^ | 19:59 |
| dstanek | dolphm: he's probably doing to so he does't mask the values from the closure | 20:00 |
| dolphm | dstanek: ah, so it's like "inline" or something? | 20:01 |
| dstanek | although he's not using them so it doesn't really matter...i'm guessing that i_ means inner_ | 20:01 |
| dolphm | inner, yeah | 20:01 |
| htruta | henrynash: regarding your comment here: https://review.openstack.org/#/c/210600/40 | 20:04 |
| htruta | henrynash: I thought it would make sense if we only allowed passing domain_id=None for is_domain=True projects... if we pass it to projects with is_domain=False, we raise an error | 20:05 |
| *** jsavak has quit IRC | 20:05 | |
| stevemar | dolphm: more stable branch stuff; https://review.openstack.org/#/c/261706/ | 20:06 |
| stevemar | oh wait, that one isn't as easy, since it's not a cherry pick | 20:06 |
| *** thiagop-lunch is now known as thiagop | 20:07 | |
| *** fangxu has quit IRC | 20:07 | |
| breton | dolphm: I think it's just a throwaway variables | 20:07 |
| breton | I've seen people using _ as such variable | 20:07 |
| henrynash | htruta: yep…and maybe you override the leagcy test for to expect an NotImplemented error? | 20:08 |
| htruta | henrynash: makes sense | 20:08 |
| dolphm | breton: _ in the interpreter has a different meaning though. i prefer _throwaway_variables_to_simply_be_prefixed_by_underscores | 20:08 |
| bknudson_ | dolphm: he can't use self since self is referring to the containing class | 20:09 |
| bknudson_ | instance | 20:09 |
| bknudson_ | I think "i" is short for "inner" | 20:10 |
| breton | dolphm: https://google.github.io/styleguide/pyguide.html suggests to used `_' | 20:12 |
| *** woodster_ has joined #openstack-keystone | 20:12 | |
| bknudson_ | https://review.openstack.org/#/c/244440/6/keystone/tests/unit/test_middleware.py doesn't seem to be much of an improvement to me. | 20:14 |
| bknudson_ | I guess it's needed for the follow-on | 20:14 |
| *** jasonsb has quit IRC | 20:15 | |
| *** pkarikh has quit IRC | 20:21 | |
| *** belmoreira has joined #openstack-keystone | 20:22 | |
| RichardRaseley | I am working on a basic python script to do some user / role / project management against Keystone. When using `openstacclient` on the CLI, I am able to execute commands successfully. When trying to script the same operation I receive an error. Here is a paste which contains (1) my env variables, CLI commands, python script, and traceback error. http://paste.openstack.org/show/483179/ | 20:22 |
| RichardRaseley | Any insight would be greatly appreciated. | 20:22 |
| *** pkarikh has joined #openstack-keystone | 20:25 | |
| *** nkinder has quit IRC | 20:26 | |
| stevemar | RichardRaseley: use "username" instead of "user_id" on line 29 | 20:26 |
| *** nkinder has joined #openstack-keystone | 20:26 | |
| stevemar | and add the argument "project_domain_name" to v3.Password as well | 20:26 |
| stevemar | your user_id is most likely not "richard_raseley" :) | 20:26 |
| RichardRaseley | stevemar: Thank you. Can you expand on project_domain_name vs. user_domain_name? | 20:27 |
| stevemar | RichardRaseley: both project and user should be domain-scoped | 20:27 |
| stevemar | projects, users, and groups are all collected under a single domain, to allow for duplicate user names and such | 20:28 |
| *** e0ne has joined #openstack-keystone | 20:28 | |
| stevemar | so you have to specify, the user isn't just richard and the project isn't just openstack | 20:28 |
| stevemar | the user is: richard@default_domain and the project is: openstack@default_domain | 20:28 |
| stevemar | in the case of another domain, say domainB, you could have: richard@domainB working on project openstack@domainB | 20:29 |
| *** e0ne has quit IRC | 20:29 | |
| RichardRaseley | stevemar: Oh, OK - I haven't seen that in any of the docs I've been trying to follow. | 20:29 |
| RichardRaseley | Let me check that out. | 20:29 |
| stevemar | give it a whirl | 20:29 |
| *** jsavak has joined #openstack-keystone | 20:29 | |
| tjcocozz | stevemar, should auth_url be at port 5000 or 35357? | 20:30 |
| stevemar | bknudson_: dolphm any ideas on why liberty is failing to build for keystoneauth? http://logs.openstack.org/18/258318/1/check/gate-tempest-dsvm-neutron-src-keystoneauth/377ba5f/logs/screen-g-api.txt.gz | 20:30 |
| lbragstad | stevemar do you know if tony wang is on irc? | 20:30 |
| dolphm | cloudnull: ^ | 20:30 |
| stevemar | tjcocozz: doesn't matter for most cases, but 5000 is the ideal one | 20:30 |
| *** e0ne has joined #openstack-keystone | 20:30 | |
| bknudson_ | stevemar: let me get through this review and I'll take a look. | 20:30 |
| lbragstad | stevemar just curious if he had a follow on patch for - https://review.openstack.org/#/c/235214/9 | 20:30 |
| stevemar | bknudson_: the review is a proposal bot change :) | 20:31 |
| stevemar | lbragstad: i have no idea who he is :) | 20:31 |
| stevemar | lbragstad: what was the follow on patch supposed to address? | 20:31 |
| lbragstad | stevemar stuff like you're comment here -https://review.openstack.org/#/c/235214/9/keystone/tests/unit/test_v3_credential.py | 20:31 |
| stevemar | lbragstad: ohh | 20:32 |
| stevemar | i tried to do that, and then couldn't get it working | 20:32 |
| lbragstad | hm | 20:32 |
| stevemar | it wasn't critical enough for me to change my vote though | 20:32 |
| openstackgerrit | Navid Pustchi proposed openstack/keystone: Delete checks for default domain delete https://review.openstack.org/264342 | 20:32 |
| RichardRaseley | stevemar: OK, I now have as follows: http://paste.openstack.org/show/483180/ | 20:32 |
| lbragstad | stevemar I don't think it's enough to -1 but I was curious if a follow on was floating around somewhere. | 20:32 |
| stevemar | lbragstad: nope, i went and got distracted with other stuff | 20:33 |
| stevemar | RichardRaseley: any luck? | 20:33 |
| *** e0ne has quit IRC | 20:33 | |
| *** vgridnev has joined #openstack-keystone | 20:33 | |
| stevemar | RichardRaseley: oh, don't worry about actually adding the @ sign in your code, that was for illustrative purposes! | 20:33 |
| stevemar | the v3.Password plugin does all that logic for you, just supply the username, password, project, and what domain it's all in. | 20:34 |
| stevemar | sorry is i steered you wrong | 20:34 |
| RichardRaseley | stevemar: Oh, that's OK. Let me clean that up and try. | 20:34 |
| bknudson_ | stevemar: I could swear we've seen the issue in http://logs.openstack.org/18/258318/1/check/gate-tempest-dsvm-neutron-src-keystoneauth/377ba5f/logs/screen-g-api.txt.gz before. | 20:34 |
| stevemar | RichardRaseley: yeah, just chop off the "@default_domain" thing, that was just me trying to illustrate, apparently not well! | 20:35 |
| stevemar | bknudson_: yeah right? | 20:36 |
| RichardRaseley | stevemar: That got me what I was hoping for, thank you. | 20:36 |
| stevemar | RichardRaseley: yippie | 20:36 |
| openstackgerrit | Navid Pustchi proposed openstack/keystone: Delete checks for default domain delete https://review.openstack.org/264342 | 20:36 |
| *** jsavak has quit IRC | 20:37 | |
| stevemar | bknudson_: it is installing the latest ksm, 4.0.0 | 20:37 |
| stevemar | and oslo.config | 20:37 |
| dstanek | bknudson_: wasn't that an issue with using a newer version of oslo.config? | 20:37 |
| bknudson_ | the change was in keystoneauth, right. | 20:38 |
| stevemar | yep | 20:38 |
| *** jsavak has joined #openstack-keystone | 20:38 | |
| stevemar | stable/liberty of ksa | 20:38 |
| stevemar | dstanek: if that's the case, we'll have to cap it | 20:38 |
| stevemar | dims ^^ | 20:38 |
| *** mhickey has joined #openstack-keystone | 20:38 | |
| bknudson_ | we've got this change: https://review.openstack.org/#/c/253825/ | 20:40 |
| *** fpatwa has joined #openstack-keystone | 20:41 | |
| bknudson_ | change in keystonemiddleware: https://review.openstack.org/#/c/235090/ | 20:41 |
| dstanek | bknudson_: ah right, those things were removed at some point | 20:42 |
| *** dtroyer_zz has quit IRC | 20:43 | |
| bknudson_ | stevemar: so it's using latest keystonemiddleware with old keystoneauth seems a little odd. | 20:44 |
| bknudson_ | I thought we didn't even release keystoneauth in L. | 20:45 |
| *** dtroyer has joined #openstack-keystone | 20:45 | |
| fpatwa | I am trying to setup keystone with AD as backend using the Read-Only LDAP option (multi domain support) - I have it setup and as 'admin' user in sql can view the users in AD specific domain, but am not sure how to assign a role to domain admin user which is in AD | 20:45 |
| fpatwa | When I try it using the 'admin' user in sql I get Authorizatiion failure error | 20:46 |
| openstackgerrit | Merged openstack/keystone: Make `bootstrap` idempotent https://review.openstack.org/256969 | 20:48 |
| fpatwa | I would appreciate if anyone can provide any pointers - Thanks! - Farhan | 20:49 |
| RichardRaseley | stevemar: follow-up. If I want to wrap my keystone code in a try / except block, what is the correct way for me to capture the relevant errors? For example, in my ldap code I have `except ldap.LDAPError, e: ...` is there a similar 'class' (if that is the right term) of object to ldap.LDAPError? | 20:49 |
| openstackgerrit | Merged openstack/keystoneauth: Change LOG.warn to LOG.warning https://review.openstack.org/263116 | 20:50 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264346 | 20:50 |
| *** zqfan has quit IRC | 20:51 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain parameter to get_project_by_name https://review.openstack.org/210600 | 20:53 |
| dolphm | RichardRaseley: firstly, use "ldap.LDAPError as e" not "ldap.LDAPError, e" | 20:54 |
| dolphm | RichardRaseley: the comma is from py25, and in newer versions of python, looks like you're also trying to catch an exception named "e" | 20:56 |
| htruta | henrynash: hey, I was also thinking of splitting this one: https://review.openstack.org/#/c/158372/128 1 that makes project.domain_id nullable (that's pretty much your code) and the constraint changing itself. Makes sense? | 20:56 |
| dolphm | RichardRaseley: i'm also trying to figure out quite what you're asking for.. | 20:57 |
| dolphm | RichardRaseley: ldap.LDAPError *is* probably a class, and you're catching an instance of it | 20:57 |
| dolphm | RichardRaseley: well not probably, it *is* | 20:58 |
| *** david-lyle_ has joined #openstack-keystone | 20:59 | |
| *** david-lyle_ has quit IRC | 20:59 | |
| stevemar | bknudson_: i think we released an alpha of ksa | 20:59 |
| bknudson_ | I'll keep looking into it.. might be able to recreate by using old ksa with new middleware. | 20:59 |
| stevemar | bknudson_: maybe backport mordred's change | 20:59 |
| bknudson_ | might need to add some workaround logic (or backport something) | 21:00 |
| mordred | stevemar: what did I do? | 21:00 |
| stevemar | mordred: broke everything! | 21:00 |
| mordred | awesome | 21:00 |
| stevemar | mordred: so liberty of ksa is not building: https://review.openstack.org/#/c/258318/ | 21:01 |
| stevemar | mordred: here's the error: http://logs.openstack.org/18/258318/1/check/gate-tempest-dsvm-neutron-src-keystoneauth/377ba5f/logs/screen-g-api.txt.gz | 21:01 |
| stevemar | mordred: i'm wondering if backporting https://review.openstack.org/#/c/264348/ will fix it | 21:01 |
| mordred | http://logs.openstack.org/18/258318/1/check/gate-tempest-dsvm-neutron-src-keystoneauth/377ba5f/logs/screen-g-api.txt.gz | 21:02 |
| mordred | yah | 21:02 |
| bknudson_ | ohh, https://review.openstack.org/#/c/264348/ looks good. | 21:02 |
| mordred | so - yes | 21:02 |
| openstackgerrit | Merged openstack/keystone: Wrong usage of "an" https://review.openstack.org/262430 | 21:03 |
| bknudson_ | LOL because I just pointed at https://review.openstack.org/#/c/253825/ as a guess. | 21:03 |
| *** raildo has left #openstack-keystone | 21:03 | |
| bknudson_ | sometimes you get lucky | 21:04 |
| stevemar | bknudson_: backports are cheap, i went ahead and cherry picked | 21:04 |
| *** pauloewerton has quit IRC | 21:04 | |
| openstackgerrit | Merged openstack/keystone: fix reuse of variables https://review.openstack.org/245331 | 21:05 |
| openstackgerrit | Merged openstack/keystone: Add return value https://review.openstack.org/263111 | 21:05 |
| openstackgerrit | Merged openstack/keystone: Verify that attribute `enabled` equals True https://review.openstack.org/254881 | 21:05 |
| openstackgerrit | Merged openstack/keystoneauth: Add betamax to test-requirements.txt https://review.openstack.org/260183 | 21:08 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264346 | 21:08 |
| *** fangxu has joined #openstack-keystone | 21:08 | |
| *** spzala has joined #openstack-keystone | 21:08 | |
| lbragstad | navidp stevemar dolphm bknudson_ gyee breton around? | 21:08 |
| openstackgerrit | Merged openstack/python-keystoneclient: Change default endpoint for Keystone v3 to public https://review.openstack.org/250664 | 21:08 |
| lbragstad | want to see if we can come to a quick conclusion on what https://bugs.launchpad.net/keystone/+bug/1522616 means to us | 21:09 |
| openstack | Launchpad bug 1522616 in OpenStack Identity (keystone) "It's possible to disable the default domain through domain update API" [Medium,In progress] - Assigned to Navid Pustchi (npustchi) | 21:09 |
| lbragstad | since navidp has some fixes up already | 21:09 |
| navidp | o/ | 21:09 |
| gyee | lbragstad, yes sir | 21:10 |
| *** jbell8 has quit IRC | 21:10 | |
| lbragstad | do we think it's a bug? | 21:10 |
| gyee | I don't think so | 21:10 |
| lbragstad | the only reason why I opened it was because we don't allow that behavior when deleting the default domain, but it is possible to achieve the same end result by disabling it | 21:11 |
| gyee | there's nothing special about the domain | 21:11 |
| RichardRaseley | dolphm: Just seeing your replies no2w. | 21:11 |
| lbragstad | gyee i agree | 21:11 |
| RichardRaseley | now* | 21:11 |
| lbragstad | gyee i'm more or less talking about how we take a lot of precaution when deleting a domain but we don't take *any* when disabling it | 21:11 |
| gyee | you have to be a cloud admin to be able to disable a domain | 21:12 |
| RichardRaseley | dolphm: My intent is to gracefully capture any errors generated by my keystone code, and present those to the user. | 21:12 |
| lbragstad | and both actions result in the same thing | 21:12 |
| RichardRaseley | Thanks for the `as e` tip. | 21:12 |
| breton | why would we take any precautions? | 21:12 |
| dolphm | RichardRaseley: what exceptions are you expecting? | 21:12 |
| lbragstad | breton that predates me i think | 21:12 |
| breton | disabling is a precaution by itself, isn't it? | 21:12 |
| dolphm | RichardRaseley: and i assume this is in Keystone itself? | 21:12 |
| RichardRaseley | dolphm: That's a hard question. | 21:12 |
| gyee | lbragstad, you mean disable-before-deletion feature? | 21:13 |
| RichardRaseley | dolphm: I am developing a script to interact with Keystone. | 21:13 |
| dolphm | RichardRaseley: it should be easy - what exceptions does the code you're calling document as possible exceptions it could raise? | 21:13 |
| RichardRaseley | dolphm: I have absolutely no idea how to determine that. | 21:13 |
| gyee | that was done to mitigate some performance limitations I think | 21:14 |
| lbragstad | gyee right, we can't explicitly delete without disabling first, but that only applies to the default domain defined in the CONF. | 21:14 |
| lbragstad | link - https://github.com/openstack/keystone/blob/7f096301feac661cb043609c21ed318fd7b3e24d/keystone/resource/core.py#L556-L561 | 21:14 |
| RichardRaseley | dolphm: I am going to be listing / adding / deleting users / roles / projects | 21:14 |
| breton | ugh | 21:15 |
| lbragstad | we protect against deleteing the default domain, but we don't protect against disabling it. which results in the same behavior | 21:15 |
| breton | henrynash wrote that warning | 21:15 |
| lbragstad | breton yes | 21:15 |
| breton | henrynash: why shouldn't we delete or disable the default domain? | 21:16 |
| navidp | gyee, If you are cloud admin in default domain and disable default domain, cloud admin can not enable it agian, i think that causes issues. | 21:16 |
| breton | or did he | 21:17 |
| gyee | cloud admin doesn't have to come from default domain | 21:17 |
| lbragstad | I think it's a question of how much rope we want to be able to give people | 21:17 |
| gyee | we should remove that check | 21:17 |
| gyee | I thought we drew that line a long time ago | 21:17 |
| *** kragniz is now known as {^-^} | 21:17 | |
| lbragstad | we either remove the check and then warn people saying "hey, this could be really bad if you disable to delete this... you've been warned" | 21:18 |
| *** {^-^} is now known as Guest46353 | 21:18 | |
| *** Guest46353 is now known as kragniz | 21:18 | |
| lbragstad | or we can make disabling it consistent with the behavior of delete | 21:18 |
| lbragstad | either one works for me | 21:19 |
| lbragstad | just wanted to get the discussion rolling since navidp has some time and patches invested into it | 21:19 |
| dolphm | RichardRaseley: what python call are you making, exactly? | 21:19 |
| gyee | I think we should remove that check | 21:19 |
| lbragstad | gyee ok, so question | 21:19 |
| lbragstad | gyee would that have to go through a deprecation cycle? | 21:19 |
| RichardRaseley | dolphm: Thanks for taking time with what must seem like a really simple problem. | 21:20 |
| dolphm | RichardRaseley: it's a very broad problem :) | 21:20 |
| *** alejandrito has quit IRC | 21:20 | |
| gyee | lbragstad, I am not sure, stevemar's call I guess | 21:21 |
| lbragstad | gyee agreed | 21:21 |
| gyee | though I don't know if its an documented external-facing feature | 21:21 |
| gyee | if not, we can just remove it | 21:21 |
| lbragstad | ok | 21:21 |
| RichardRaseley | dolphm: My code isn't complete yet, but I will be calling the users.{create,list,show), project.{create,list,show}, and roles.{create,list,show} (and whatever is required to assign roles) | 21:21 |
| dolphm | RichardRaseley: using keystoneclient? | 21:22 |
| RichardRaseley | dolphm: Yes | 21:22 |
| lbragstad | navidp thoughts? | 21:23 |
| dolphm | RichardRaseley: so, you can catch keystoneclient.exceptions.ClientException to catch everything from keystoneclient, since all of our exceptions extend that | 21:23 |
| dolphm | RichardRaseley: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/exceptions.py#L22-L26 | 21:23 |
| RichardRaseley | dolphm: OK, that is really helpful. | 21:24 |
| *** lhcheng has joined #openstack-keystone | 21:24 | |
| *** ChanServ sets mode: +v lhcheng | 21:24 | |
| navidp | gyee, why a cloud admin can disable or delete default domain as long as it is default domain, not that it is special more as it breaks consistency | 21:24 |
| lbragstad | gotta run to a quick meeting, i'll read the scroll back once i'm done | 21:24 |
| gyee | lbragstad, nomorgan added bootstrap commands to keystone-manage | 21:24 |
| gyee | if needed, we can enhance to enable cloud admin domain | 21:25 |
| *** jsavak has quit IRC | 21:25 | |
| openstackgerrit | ayoung proposed openstack/keystone: SQL migrations for implied roles https://review.openstack.org/264259 | 21:25 |
| gyee | navidp, default domain was created to facilitate v2 to v3 migration only | 21:25 |
| gyee | there's nothing special about it | 21:25 |
| *** jsavak has joined #openstack-keystone | 21:25 | |
| gyee | cloud admin domain is configurable and it cloud be any domain | 21:25 |
| breton | that feel when there were no reviews for 3 weeks and then I get 100+ notifications about reviews in two days | 21:27 |
| RichardRaseley | dolphm: OK, thank you. | 21:27 |
| dolphm | breton: sorry | 21:27 |
| *** lhcheng_ has joined #openstack-keystone | 21:27 | |
| gyee | breton, its review seaon again :) | 21:27 |
| gyee | season | 21:27 |
| stevemar | breton: :) | 21:28 |
| navidp | gyee, ok then :) | 21:28 |
| openstackgerrit | ayoung proposed openstack/keystone: backend for implied roles https://review.openstack.org/264260 | 21:28 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 21:28 |
| stevemar | breton: i can confirm that as PTL, that feeling is awesome | 21:28 |
| *** belmoreira has quit IRC | 21:29 | |
| *** jsavak has quit IRC | 21:31 | |
| *** lhcheng has quit IRC | 21:31 | |
| *** jsavak has joined #openstack-keystone | 21:31 | |
| openstackgerrit | Eric Brown proposed openstack/keystonemiddleware: Use oslo_config choices support https://review.openstack.org/160031 | 21:42 |
| bknudson_ | there's something way off with the sample config file updater. | 21:45 |
| bknudson_ | https://review.openstack.org/#/c/264346/ | 21:45 |
| *** dave-mccowan has quit IRC | 21:47 | |
| *** timcline has quit IRC | 21:47 | |
| lbragstad | gyee just curious, but why was the default domain protected from being deleted then? | 21:50 |
| *** timcline has joined #openstack-keystone | 21:50 | |
| gyee | lbragstad, it shouldn't | 21:52 |
| gyee | don't remember why we did that, but it shouldn't receive any special treatments | 21:52 |
| samueldmq | ayoung: sure will look | 21:52 |
| samueldmq | ayoung: sorry for the delay, holiday here today :) | 21:53 |
| ayoung | samueldmq, thanks | 21:53 |
| lbragstad | gyee hm, ok. navidp we should follow up with henrynash when he is online | 21:53 |
| ayoung | lbragstad, you can;'t run without default domain | 21:53 |
| ayoung | everything would break | 21:53 |
| lbragstad | ayoung but the same is true if you disable the default domain, right? | 21:54 |
| ayoung | yep | 21:54 |
| lbragstad | ayoung and we don't protect against that | 21:54 |
| bknudson_ | if deleting the default domain would break anything then we should fix that | 21:54 |
| ayoung | but disable is reversable | 21:54 |
| ayoung | delete is forever | 21:54 |
| ayoung | pretty sure you can re-enable a domain with a service token | 21:54 |
| bknudson_ | not make it so you can't delete it | 21:54 |
| lbragstad | ayoung it's only reversible if you have a recovery plan, like a second domain somewhere | 21:55 |
| ayoung | bknudson_, we are: we are deprecating V2 | 21:55 |
| gyee | we should implement this in bootstrap | 21:55 |
| gyee | keystone-manage enable_cloud_admin or something | 21:55 |
| ayoung | gyee, pretty sure it is done now in bootstrap | 21:55 |
| *** vgridnev has quit IRC | 21:55 | |
| *** RichardRaseley has quit IRC | 21:55 | |
| dstanek | lbragstad: gyee: this is why commit messages should be 'why' and not 'what' :-P | 21:55 |
| gyee | ayoung, ++ | 21:55 |
| ayoung | gyee, just did a review for bootstrap to be idempotent. So if domain is deleted, it would be recreated | 21:56 |
| gyee | dstanek, amen brother! | 21:56 |
| lbragstad | dstanek ++ | 21:56 |
| ayoung | notmorgan wrote that | 21:56 |
| gyee | we're good then | 21:56 |
| bknudson_ | default domain is created by migration | 21:56 |
| gyee | so is __member__ role | 21:57 |
| lbragstad | bknudson_ is right - https://github.com/openstack/keystone/blob/7f096301feac661cb043609c21ed318fd7b3e24d/keystone/common/sql/migration_helpers.py#L47-L57 | 21:57 |
| bknudson_ | I hope nobody deletes the member role | 21:58 |
| *** jsavak has quit IRC | 21:58 | |
| gyee | it'll get magikally recreated | 21:59 |
| gyee | no worries | 21:59 |
| dstanek | gyee: what recreates it? | 22:00 |
| lbragstad | it doesn't look like it's in the migration | 22:00 |
| gyee | dstanek, https://github.com/openstack/keystone/blob/master/keystone/assignment/core.py#L165 | 22:02 |
| henrynash | navidp: hi…questions on default domain? | 22:02 |
| *** ninag__ has quit IRC | 22:02 | |
| navidp | henrynash, hi | 22:02 |
| dstanek | gyee: wow, crazy. i didn't know we did that | 22:02 |
| lbragstad | gyee interesting... | 22:03 |
| lbragstad | i didn't know that either | 22:03 |
| navidp | henrynash, is it possible to disable or delete default domain and cause no issues in keystone? | 22:03 |
| *** ninag has joined #openstack-keystone | 22:03 | |
| gyee | dstanek, that wasn't even an atomic operation either | 22:03 |
| gyee | there are two separate transactions there | 22:04 |
| henrynash | navidp: that *should* be possible, within certain restictions | 22:04 |
| *** dtroyer has quit IRC | 22:04 | |
| *** DuncanT has quit IRC | 22:04 | |
| *** bradjones has quit IRC | 22:04 | |
| *** diazjf has quit IRC | 22:04 | |
| henrynash | navidp: e.g. be careful if you are using ldap | 22:04 |
| *** bradjones has joined #openstack-keystone | 22:04 | |
| *** bradjones has quit IRC | 22:04 | |
| *** bradjones has joined #openstack-keystone | 22:04 | |
| *** diazjf has joined #openstack-keystone | 22:04 | |
| lbragstad | henrynash why do we have the "certain restrictions" part? | 22:05 |
| henrynash | navidp: don’t use a bunch of teh v2 apis | 22:05 |
| gyee | it is also possible to forgot to lock your doors at night and point the gun at your foot | 22:05 |
| lbragstad | henrynash https://bugs.launchpad.net/keystone/+bug/1522616 is what we are talking about | 22:05 |
| openstack | Launchpad bug 1522616 in OpenStack Identity (keystone) "It's possible to disable the default domain through domain update API" [Medium,In progress] - Assigned to Navid Pustchi (npustchi) | 22:05 |
| bknudson_ | I get an exception whenever I point the gun at my foot. | 22:05 |
| navidp | henrynash, should we restrict that ? | 22:05 |
| bknudson_ | 400 | 22:05 |
| gyee | hahahah | 22:06 |
| gyee | bknudson_, oh you just make my day | 22:06 |
| lbragstad | bknudson_ you'll end up with a 503 | 22:06 |
| henrynash | navidp: I think we should all the disablement of the default domain | 22:06 |
| bknudson_ | lbragstad: probably 410 Gone | 22:07 |
| lbragstad | bknudson_ lol | 22:07 |
| henrynash | navidp: now a bunch of things *should* stop working if you do that….e.g. if I autenticate via v2, it shoudl fail | 22:07 |
| dstanek | bknudson_: 410 Gone | 22:07 |
| *** ninag has quit IRC | 22:07 | |
| bknudson_ | he he | 22:08 |
| dstanek | bknudson_: arrrg. you beat me to it | 22:08 |
| navidp | henrynash, so it is logical to disallow dosabling or deleteing default domain ? | 22:09 |
| henrynash | navidp: no, I am saying we should allow those things | 22:09 |
| henrynash | navidp: I think for now, not allowing youto delete the default domain is probably sensible | 22:10 |
| *** dtroyer has joined #openstack-keystone | 22:10 | |
| *** mhickey has quit IRC | 22:10 | |
| henrynash | navidp: since disabling achieves the same effect from a “things stop working” point of view….and someone deleting the dfault domain by mistake could be seriously catastrophic | 22:11 |
| henrynash | navidp: but you should definitely be able to disable it…… | 22:11 |
| henrynash | navidp: one issue would be if cloud admin is defined as having admin on the default domain (or a project within the default domain), I’m not sure how you could un-disable it…so we may have to add those checks | 22:12 |
| henrynash | navidp: or add an option to keystone-manage to re-enable it | 22:13 |
| *** petertr7 is now known as petertr7_away | 22:13 | |
| navidp | henrynash, so for now disabling, then add an option to re-enable it, satisfies? | 22:14 |
| lbragstad | right now you can re-enable it but you have to do it via another domain | 22:16 |
| henrynash | navidp: in the end, as was stated by someone, installations using the default domain should be the exception to the rule, but we’ll take a while to get there | 22:16 |
| samueldmq | dstanek: thanks for cleaning up the patch (abandoning) | 22:17 |
| dstanek | samueldmq: my pleasure :-) | 22:17 |
| *** DuncanT has joined #openstack-keystone | 22:17 | |
| navidp | henrynash, ok then fair. | 22:17 |
| *** shoutm has joined #openstack-keystone | 22:18 | |
| samueldmq | bknudson_: hi | 22:18 |
| henrynash | lbragstad: if you are usin the v3cloudsample, then you have to be either cloud admin or domain admin of the domain in question (and have a token to prove it)…..so that’s the issue if cloud admin is defined as having admin on the default domain (or a project within it)….you could never get a token on it | 22:18 |
| bknudson_ | samueldmq: what's up? | 22:18 |
| samueldmq | bknudson_: do you think it is worth it to keep/merge those 2 patches for sql driver tests of endpoint policy and policy backends ? | 22:18 |
| bknudson_ | stevemar: I was able to recreate the stable keystoneauth issue in vm. set up a venv with glance and pip install -U "keystoneauth1<1.2.0" | 22:18 |
| samueldmq | bknudson_: https://review.openstack.org/#/c/212957/ and https://review.openstack.org/#/c/212006/ | 22:19 |
| samueldmq | bknudson_: or do you think we don't need them and just need to test the backends themselves (managers) | 22:19 |
| bknudson_ | samueldmq: backends aren't managers. There should be tests for the backends and tests for the managers. | 22:20 |
| bknudson_ | don't mix them | 22:20 |
| samueldmq | bknudson_: yes I know | 22:20 |
| samueldmq | bknudson_: sorry yes I confused in my setence | 22:20 |
| samueldmq | bknudson_: I am actually creating tests for the sql backends | 22:20 |
| samueldmq | bknudson_: I was asking because of your comment here https://review.openstack.org/#/c/208609/10/keystone/tests/unit/backend/endpoint_policy/test_sql.py | 22:21 |
| samueldmq | bknudson_: if it was something specific to that test or relating to all those tests I wrote | 22:21 |
| bknudson_ | if we're testing the interface is correct, then the test should be for the interface and then run all the same tests for all the implementations | 22:21 |
| bknudson_ | sorry, should say : if we're testing that the driver implements the interface correctly, ... | 22:22 |
| *** dims has quit IRC | 22:22 | |
| samueldmq | bknudson_: agreed | 22:23 |
| bknudson_ | as in, if all the drivers need to work the same then put the test in PolicyBase and then have a SqlPolicy(PolicyBase) | 22:23 |
| bknudson_ | TestSqlPolicy(PolicyBase) | 22:23 |
| lbragstad | henrynash right, if you have a keystone deployment with one domain and you decide to disable it, | 22:23 |
| lbragstad | henrynash you can't really do anything else | 22:24 |
| lbragstad | henrynash which is where you are suggesting the use of keystone-manage to re-enable it? | 22:24 |
| bknudson_ | samueldmq: so shouldn't https://review.openstack.org/#/c/212957/6/keystone/tests/unit/backend/policy/test_sql.py have all these tests in a PolicyBase ? | 22:24 |
| bknudson_ | there's nothing specific to the SQL implementation as far as I can tell | 22:25 |
| *** tonytan4ever has quit IRC | 22:26 | |
| samueldmq | bknudson_: that's true, but for now it only has the sql backend | 22:26 |
| openstackgerrit | Merged openstack/python-keystoneclient: Fix Resource.__eq__ mismatch semantics of object equal https://review.openstack.org/251841 | 22:26 |
| samueldmq | bknudson_: how different would be SqlPolicy(PolicyBase) and TestSqlPolicy(PolicyBase) | 22:26 |
| bknudson_ | if we write it generic then somebody writing their own policy driver can use it to validate their implementation | 22:27 |
| samueldmq | bknudson_: but I am getting what you're saying, other backends supporting ldap and sql would already benefit from this | 22:27 |
| samueldmq | bknudson_: hmm, that's true, I was only thinking about our in-tree code | 22:27 |
| samueldmq | bknudson_: 100% agreed | 22:27 |
| bknudson_ | There might not be any difference in SqlPolicy vs PolicyBase, other than setting up the SQL backend in setUp (which should be a fixture, but maybe it's not) | 22:28 |
| bknudson_ | ideally the test wouldn't call self.driver.create_policy() in setUp, but would instead do SQL commands. | 22:29 |
| bknudson_ | otherwise if we break create_policy then all the tests would stop working | 22:29 |
| samueldmq | bknudson_: so not using the driver itself for creating the test scenario | 22:33 |
| samueldmq | bknudson_: got your point | 22:33 |
| bknudson_ | samueldmq: yep | 22:33 |
| samueldmq | dstanek: wait, was that yourself who abandoed that change ? or do you also have a bot for that work? | 22:35 |
| samueldmq | dstanek: I am asking because you(r bot) was pretty quick :-) | 22:36 |
| samueldmq | gyee: fixing a FIXME note from you here https://review.openstack.org/#/c/253219 | 22:38 |
| samueldmq | gyee: would be great to get your view on it | 22:38 |
| gyee | samueldmq, thanks, looking | 22:38 |
| samueldmq | gyee: thanks :) | 22:39 |
| *** timcline has quit IRC | 22:40 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Remove "deprecated" internal method https://review.openstack.org/262345 | 22:40 |
| *** phalmos has quit IRC | 22:41 | |
| *** tonytan4ever has joined #openstack-keystone | 22:45 | |
| *** KarthikB has quit IRC | 22:49 | |
| *** dims has joined #openstack-keystone | 22:53 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Replace textwrap with fast standard code https://review.openstack.org/252355 | 22:58 |
| shaleh | lbragstad: you around? | 23:00 |
| openstackgerrit | Merged openstack/python-keystoneclient: Deprecated tox -downloadcache option removed https://review.openstack.org/256816 | 23:00 |
| *** dims has quit IRC | 23:04 | |
| *** tonytan4ever has quit IRC | 23:07 | |
| *** diazjf has quit IRC | 23:12 | |
| *** topol has quit IRC | 23:18 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/264462 | 23:19 |
| *** henrynash has quit IRC | 23:20 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/264426 | 23:23 |
| *** henrynash has joined #openstack-keystone | 23:23 | |
| *** ChanServ sets mode: +v henrynash | 23:23 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:25 | |
| *** woodster_ has quit IRC | 23:26 | |
| *** dims_ has joined #openstack-keystone | 23:29 | |
| *** dave-mccowan has joined #openstack-keystone | 23:31 | |
| *** dims_ has quit IRC | 23:34 | |
| *** dims_ has joined #openstack-keystone | 23:36 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Set deprecated_reason on deprecated options https://review.openstack.org/264475 | 23:48 |
| *** gordc has quit IRC | 23:52 | |
| *** shaleh has quit IRC | 23:54 | |
| *** slberger1 has left #openstack-keystone | 23:55 | |
| *** itlinux has joined #openstack-keystone | 23:55 | |
| *** spzala has quit IRC | 23:57 | |
| *** oomichi has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!