| *** su_zhang_ has joined #openstack-keystone | 00:00 | |
| *** su_zhang has quit IRC | 00:00 | |
| *** spzala has quit IRC | 00:00 | |
| *** ducttape_ has quit IRC | 00:01 | |
| *** rbak_ has quit IRC | 00:01 | |
| *** ayoung has quit IRC | 00:10 | |
| *** markvoelker has quit IRC | 00:11 | |
| *** shaleh|away is now known as shaleh | 00:11 | |
| openstackgerrit | Merged openstack/keystone: Add asserts for service providers https://review.openstack.org/265809 | 00:11 |
|---|---|---|
| openstackgerrit | Merged openstack/keystone: Fix docstring https://review.openstack.org/269899 | 00:12 |
| *** darrenc_afk is now known as darrenc | 00:12 | |
| *** phalmos has quit IRC | 00:15 | |
| *** gildub has joined #openstack-keystone | 00:15 | |
| *** phalmos has joined #openstack-keystone | 00:16 | |
| *** phalmos has quit IRC | 00:16 | |
| *** markvoelker has joined #openstack-keystone | 00:18 | |
| *** jasonsb has joined #openstack-keystone | 00:25 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Address comments from Implied Role manager patch https://review.openstack.org/269990 | 00:25 |
| *** zqfan has joined #openstack-keystone | 00:26 | |
| *** gyee has quit IRC | 00:28 | |
| *** yarkot has joined #openstack-keystone | 00:29 | |
| *** gyee has joined #openstack-keystone | 00:30 | |
| *** ChanServ sets mode: +v gyee | 00:30 | |
| *** gildub has quit IRC | 00:32 | |
| *** tsymanczyk has quit IRC | 00:36 | |
| *** lhcheng_ has quit IRC | 00:36 | |
| *** gildub has joined #openstack-keystone | 00:37 | |
| *** shoutm_ has joined #openstack-keystone | 00:39 | |
| *** shoutm has quit IRC | 00:42 | |
| *** x58 has quit IRC | 00:50 | |
| *** x58 has joined #openstack-keystone | 01:00 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove duplicate LDAP test class https://review.openstack.org/271106 | 01:00 |
| *** jidar has quit IRC | 01:00 | |
| *** jidar has joined #openstack-keystone | 01:04 | |
| *** doug-fish has quit IRC | 01:04 | |
| *** doug-fish has joined #openstack-keystone | 01:05 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 01:05 |
| *** doug-fish has quit IRC | 01:06 | |
| *** doug-fish has joined #openstack-keystone | 01:06 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 01:06 |
| *** markvoelker has quit IRC | 01:09 | |
| *** su_zhang_ has quit IRC | 01:09 | |
| *** davechen has joined #openstack-keystone | 01:09 | |
| *** su_zhang has joined #openstack-keystone | 01:14 | |
| *** spzala has joined #openstack-keystone | 01:16 | |
| *** yarkot_ has joined #openstack-keystone | 01:18 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 01:18 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add tests for role management with v3policy file https://review.openstack.org/261846 | 01:19 |
| *** spzala has quit IRC | 01:21 | |
| *** spzala has joined #openstack-keystone | 01:25 | |
| *** davechen1 has joined #openstack-keystone | 01:28 | |
| *** _cjones_ has quit IRC | 01:29 | |
| *** spzala has quit IRC | 01:29 | |
| *** yarkot_ has quit IRC | 01:29 | |
| *** davechen has quit IRC | 01:30 | |
| *** dslev has joined #openstack-keystone | 01:30 | |
| *** dslev_ has joined #openstack-keystone | 01:32 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add CRUD support for domain specific roles https://review.openstack.org/261870 | 01:33 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules in the v3 policy sample for domain specifc roles https://review.openstack.org/262078 | 01:34 |
| *** dslev has quit IRC | 01:35 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify implied roles to honor domain specific roles https://review.openstack.org/263064 | 01:38 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules for domain specific role assignments https://review.openstack.org/263549 | 01:38 |
| *** henrynash has joined #openstack-keystone | 01:39 | |
| *** ChanServ sets mode: +v henrynash | 01:39 | |
| *** ayoung has joined #openstack-keystone | 01:41 | |
| *** ChanServ sets mode: +v ayoung | 01:41 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove additional references to ldap role attribs https://review.openstack.org/270551 | 01:41 |
| *** shoutm_ has quit IRC | 01:49 | |
| *** lhcheng has joined #openstack-keystone | 01:52 | |
| *** ChanServ sets mode: +v lhcheng | 01:52 | |
| stevemar | notmorgan: anything else we need to deprecate in keystone server? | 01:52 |
| stevemar | we did v2 APIs, ldap write for identity, PKI, and memcache/memcache_pool for tokens | 01:53 |
| stevemar | i think we're done... | 01:53 |
| *** dslev_ has quit IRC | 01:55 | |
| *** shoutm has joined #openstack-keystone | 01:55 | |
| stevemar | ayoung: is revoke_by_expiration() pointless at this point? | 02:00 |
| ayoung | stevemar, I think so | 02:01 |
| ayoung | stevemar, refresh me: is that userid and expiration? | 02:01 |
| stevemar | ayoung: seems like it's only used if there is no audit_id in the token | 02:01 |
| stevemar | which never happens? | 02:01 |
| ayoung | that was a cheap way to revoke by ID | 02:01 |
| ayoung | actually, I take that back | 02:01 |
| ayoung | that might be a keeper | 02:01 |
| ayoung | it was a way to revoke all the tokens generated from a single token | 02:02 |
| stevemar | it has been deprecated since Juno with remove_in=0 | 02:02 |
| ayoung | we force unscoped to scoped only | 02:02 |
| ayoung | stevemar, meh | 02:02 |
| ayoung | I think it broken Horizon | 02:02 |
| *** spzala has joined #openstack-keystone | 02:02 | |
| ayoung | if you revoked all the tokens with the same expiration, and horizon was using the unscoped to get the scoped | 02:03 |
| ayoung | we decided it had to be "pointed downhill" | 02:03 |
| notmorgan | stevemar: uhmm. | 02:03 |
| notmorgan | Don't think we have more to deprecate | 02:03 |
| notmorgan | ... | 02:03 |
| stevemar | ayoung: i'll propose a patch, comment on there | 02:03 |
| notmorgan | Tokens should always have an audit I'd now | 02:03 |
| *** browne has quit IRC | 02:04 | |
| *** dims__ has joined #openstack-keystone | 02:04 | |
| notmorgan | ayoung: same reason revoke by audit chain id was an issue | 02:05 |
| notmorgan | Broke horizon. :( | 02:05 |
| *** dims_ has quit IRC | 02:06 | |
| *** spzala has quit IRC | 02:06 | |
| *** jaosorior has quit IRC | 02:12 | |
| *** su_zhang has quit IRC | 02:12 | |
| *** jaosorior has joined #openstack-keystone | 02:12 | |
| *** su_zhang has joined #openstack-keystone | 02:16 | |
| *** doug-fish has quit IRC | 02:20 | |
| *** doug-fish has joined #openstack-keystone | 02:21 | |
| *** doug-fish has quit IRC | 02:21 | |
| *** doug-fish has joined #openstack-keystone | 02:21 | |
| *** davechen1 has quit IRC | 02:23 | |
| *** su_zhang has quit IRC | 02:25 | |
| *** su_zhang has joined #openstack-keystone | 02:25 | |
| *** shoutm has quit IRC | 02:25 | |
| *** su_zhang has quit IRC | 02:26 | |
| *** shoutm has joined #openstack-keystone | 02:27 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Allow parameter expansion in endpoint_override https://review.openstack.org/271120 | 02:39 |
| jamielennox | ^ is one of the prettiest patterns i've seen in python | 02:41 |
| jamielennox | the whole duck typing just works thing | 02:41 |
| * lhcheng ear is itching.. wonder what broke in horizon | 02:41 | |
| *** spzala has joined #openstack-keystone | 02:42 | |
| ayoung | lhcheng, nothing, we broken and fixen long ago | 02:44 |
| lhcheng | ayoung: whew | 02:45 |
| lhcheng | ayoung: thanks for confirming | 02:45 |
| lhcheng | ayoung: adding IdP management panels to horizon in case your interested: https://review.openstack.org/#/c/244991/ | 02:46 |
| *** woodster_ has quit IRC | 02:46 | |
| lhcheng | stevemar: you done some rebasing on the new ui, what is the checkbox "Change parent revision" for? | 02:49 |
| stevemar | lhcheng: i think it attempts to rebase the dependent patch too | 02:49 |
| *** doug-fish has quit IRC | 02:50 | |
| ayoung | jamielennox, I'm still stiching the Implied Role review back together after you hacked it apart. Thank You | 02:52 |
| jamielennox | ayoung: i was quite proud of that review - found lots of stuff ;) | 02:53 |
| *** richm has quit IRC | 02:53 | |
| ayoung | jamielennox, the code is much, much better due to that | 02:55 |
| jamielennox | ayoung: i've got my test script here somewhere if you want it | 02:55 |
| ayoung | jamielennox, nah...I want to be surprised! | 02:55 |
| ayoung | jamielennox, we need that as a functional test somehow. | 02:56 |
| jamielennox | ayoung: http://paste.openstack.org/show/484619/ | 02:56 |
| ayoung | jamielennox, why the uuids? | 02:56 |
| jamielennox | ayoung: they're the role_ids keystone created | 02:57 |
| ayoung | jamielennox, so, for a functional test, we should do a roel create for each of those first? | 02:57 |
| jamielennox | you'd need to openstack role create role1 etc and insert actual id | 02:57 |
| ayoung | jamielennox, I'm thinking that functional tests need to be out of the Keystone tree, as they should pull in the client. Should be a separate repo? | 02:58 |
| ayoung | testing without client is just too much like our API tests already | 02:58 |
| jamielennox | ayoung: depends, when the right code is available in client they could be client functional tests | 02:59 |
| ayoung | jamielennox, I think if we had them out of tree, and the client code was used to call them, we would have functional tests already | 03:00 |
| ayoung | As it is, we have the stub inplace and have for 2 releases now | 03:00 |
| jamielennox | ayoung: maybe they should just go in tempest ? | 03:00 |
| ayoung | stevemar, I think I want to split functional tests out into their own repo and have them run from the clilent | 03:00 |
| ayoung | jamielennox, no | 03:00 |
| ayoung | we should write and manage them | 03:01 |
| ayoung | just like we were going to do inside hte Keystone repo | 03:01 |
| ayoung | maybe use the tempest infrastructure, but they should be in a separate repo | 03:01 |
| *** spzala has quit IRC | 03:04 | |
| jamielennox | notmorgan: jenkins +1ed this: https://review.openstack.org/#/c/271051/2 :O | 03:04 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 03:04 |
| *** spzala has joined #openstack-keystone | 03:04 | |
| jamielennox | this is the same problem with the v3 only gate job though, it only runs against the basic devstack deploy | 03:05 |
| jamielennox | how do we get it into the other services | 03:05 |
| jamielennox | ayoung: ^ would also interest you | 03:05 |
| ayoung | jamielennox, maybe we need to change the basic devstack deploy? | 03:06 |
| jamielennox | ayoung: you'd never get past the stalemate | 03:06 |
| jamielennox | the base can't change until it doesn't break everyone's testing, no-one's testing is broken because it's not doing the right thing | 03:07 |
| ayoung | jamielennox, yeah. | 03:07 |
| ayoung | jamielennox, programming is like sex... | 03:08 |
| jamielennox | it's always long enough between looking at project-config that i've completely forgotten how it works | 03:08 |
| jamielennox | (hopefully not like sex) | 03:08 |
| *** spzala has quit IRC | 03:09 | |
| jamielennox | ayoung: i changed it to default to Default domain so hopefully we can get a gate job running in services where it's not Default | 03:15 |
| *** links has joined #openstack-keystone | 03:26 | |
| *** wasmum- has quit IRC | 03:33 | |
| *** lhcheng has quit IRC | 03:33 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 03:34 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 03:35 |
| *** wasmum has joined #openstack-keystone | 03:36 | |
| *** links has quit IRC | 03:40 | |
| *** bill_az has quit IRC | 03:46 | |
| *** links has joined #openstack-keystone | 03:48 | |
| *** spandhe has quit IRC | 03:48 | |
| *** doug-fish has joined #openstack-keystone | 03:50 | |
| openstackgerrit | Merged openstack/keystone: Doc FIX https://review.openstack.org/267253 | 03:58 |
| *** doug-fish has quit IRC | 04:00 | |
| *** shoutm_ has joined #openstack-keystone | 04:03 | |
| *** links has quit IRC | 04:04 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/269321 | 04:04 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/268453 | 04:04 |
| *** shoutm has quit IRC | 04:05 | |
| *** dims__ has quit IRC | 04:08 | |
| *** vgridnev has joined #openstack-keystone | 04:08 | |
| ayoung | henrynash, OK, I think I have circular dependencies licked. | 04:10 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Allow parameter expansion in endpoint_override https://review.openstack.org/271120 | 04:11 |
| *** daemontool_ has quit IRC | 04:12 | |
| *** daemontool_ has joined #openstack-keystone | 04:13 | |
| *** links has joined #openstack-keystone | 04:16 | |
| openstackgerrit | ayoung proposed openstack/keystone: Check for circular references when expanding implied roles https://review.openstack.org/271134 | 04:16 |
| *** shaleh has quit IRC | 04:18 | |
| *** daemontool_ has quit IRC | 04:18 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: remove deprecated revoke_by_expiration function https://review.openstack.org/271135 | 04:20 |
| *** agireud has quit IRC | 04:20 | |
| *** agireud has joined #openstack-keystone | 04:22 | |
| *** links has quit IRC | 04:27 | |
| *** links has joined #openstack-keystone | 04:28 | |
| *** wanghua has quit IRC | 04:44 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Removed deprecated revoke KVS backend https://review.openstack.org/267777 | 04:49 |
| *** links has quit IRC | 04:50 | |
| *** browne has joined #openstack-keystone | 04:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 04:55 |
| *** fawadkhaliq has joined #openstack-keystone | 04:56 | |
| *** links has joined #openstack-keystone | 04:57 | |
| *** spzala has joined #openstack-keystone | 05:05 | |
| *** lhcheng has joined #openstack-keystone | 05:07 | |
| *** ChanServ sets mode: +v lhcheng | 05:07 | |
| *** su_zhang has joined #openstack-keystone | 05:07 | |
| *** spzala has quit IRC | 05:10 | |
| stevemar | dstanek: ewww for the failing test cases here: https://review.openstack.org/#/c/267777/ | 05:11 |
| *** links has quit IRC | 05:13 | |
| *** links has joined #openstack-keystone | 05:21 | |
| *** vgridnev has quit IRC | 05:24 | |
| *** doug-fish has joined #openstack-keystone | 05:32 | |
| *** doug-fish has quit IRC | 05:32 | |
| *** links has quit IRC | 05:36 | |
| *** links has joined #openstack-keystone | 05:37 | |
| *** gildub has quit IRC | 05:43 | |
| *** markvoelker has joined #openstack-keystone | 05:44 | |
| *** shoutm has joined #openstack-keystone | 05:47 | |
| *** vgridnev has joined #openstack-keystone | 05:47 | |
| openstackgerrit | Merged openstack/keystone: Add checks for token data creep using jsonschema https://review.openstack.org/254258 | 05:49 |
| *** shoutm_ has quit IRC | 05:49 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 05:53 |
| *** vikram has joined #openstack-keystone | 05:56 | |
| *** links has quit IRC | 05:59 | |
| *** links has joined #openstack-keystone | 06:01 | |
| *** markvoelker_ has joined #openstack-keystone | 06:04 | |
| *** markvoelker has quit IRC | 06:07 | |
| *** links has quit IRC | 06:22 | |
| *** links has joined #openstack-keystone | 06:23 | |
| *** shoutm_ has joined #openstack-keystone | 06:32 | |
| *** _cjones_ has joined #openstack-keystone | 06:32 | |
| *** shoutm has quit IRC | 06:32 | |
| *** jaosorior has quit IRC | 06:32 | |
| *** jaosorior has joined #openstack-keystone | 06:33 | |
| *** vgridnev has quit IRC | 06:33 | |
| *** _cjones_ has quit IRC | 06:34 | |
| *** _cjones_ has joined #openstack-keystone | 06:35 | |
| *** shoutm_ has quit IRC | 06:40 | |
| *** Nirupama has joined #openstack-keystone | 06:45 | |
| *** shoutm has joined #openstack-keystone | 06:45 | |
| *** links has quit IRC | 06:46 | |
| *** links has joined #openstack-keystone | 06:50 | |
| *** vgridnev has joined #openstack-keystone | 06:54 | |
| *** su_zhang has quit IRC | 06:59 | |
| *** su_zhang has joined #openstack-keystone | 07:06 | |
| *** links has quit IRC | 07:09 | |
| *** links has joined #openstack-keystone | 07:09 | |
| vikram | Facing some issues with latest devstack installtion | 07:12 |
| *** pnavarro has joined #openstack-keystone | 07:12 | |
| vikram | Can someone help ;) | 07:13 |
| *** _cjones_ has quit IRC | 07:17 | |
| *** pnavarro has quit IRC | 07:18 | |
| *** _cjones_ has joined #openstack-keystone | 07:18 | |
| *** EinstCrazy has quit IRC | 07:21 | |
| breton | morning keystone | 07:29 |
| *** rcernin has joined #openstack-keystone | 07:31 | |
| *** links has quit IRC | 07:31 | |
| *** su_zhang has quit IRC | 07:33 | |
| *** belmoreira has joined #openstack-keystone | 07:34 | |
| *** oomichi has joined #openstack-keystone | 07:44 | |
| *** links has joined #openstack-keystone | 07:48 | |
| *** jed56 has joined #openstack-keystone | 07:48 | |
| *** links has quit IRC | 07:54 | |
| *** lhcheng has quit IRC | 07:55 | |
| *** shoutm has quit IRC | 08:03 | |
| *** shoutm has joined #openstack-keystone | 08:04 | |
| *** spzala has joined #openstack-keystone | 08:05 | |
| *** spzala has quit IRC | 08:09 | |
| *** boris-42 has quit IRC | 08:13 | |
| *** _cjones_ has quit IRC | 08:15 | |
| *** daemontool has joined #openstack-keystone | 08:18 | |
| *** vgridnev has quit IRC | 08:20 | |
| *** spandhe has joined #openstack-keystone | 08:22 | |
| *** shoutm_ has joined #openstack-keystone | 08:22 | |
| *** links has joined #openstack-keystone | 08:22 | |
| *** shoutm has quit IRC | 08:25 | |
| *** davechen has joined #openstack-keystone | 08:26 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enhance manager list_role_assignments to support group listing https://review.openstack.org/265650 | 08:27 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify implied roles to honor domain specific roles https://review.openstack.org/263064 | 08:33 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules for domain specific role assignments https://review.openstack.org/263549 | 08:34 |
| *** links has quit IRC | 08:35 | |
| *** shoutm_ has quit IRC | 08:36 | |
| *** henrynash has quit IRC | 08:37 | |
| *** markvoelker_ has quit IRC | 08:38 | |
| vikram | can someone help for " Discovering versions from the identity service failed when creating the password plugin. Attempting to determine version from URL." | 08:42 |
| vikram | getting this error with devstack installation | 08:43 |
| vikram | can someone help | 08:43 |
| *** oomichi is now known as oomichi_away | 08:45 | |
| *** pnavarro has joined #openstack-keystone | 08:45 | |
| *** daemontool has quit IRC | 08:48 | |
| *** daemontool has joined #openstack-keystone | 08:48 | |
| *** oomichi_away has quit IRC | 08:49 | |
| *** spandhe has quit IRC | 08:52 | |
| *** fhubik has joined #openstack-keystone | 08:54 | |
| *** browne has quit IRC | 08:58 | |
| *** daemontool_ has joined #openstack-keystone | 09:03 | |
| *** daemontool has quit IRC | 09:06 | |
| *** jistr has joined #openstack-keystone | 09:15 | |
| breton | https://cloud.google.com/iam/ -- iam in google cloud | 09:16 |
| *** mhickey has joined #openstack-keystone | 09:23 | |
| *** e0ne has joined #openstack-keystone | 09:24 | |
| *** vgridnev has joined #openstack-keystone | 09:25 | |
| *** e0ne has quit IRC | 09:27 | |
| *** tyagiprince has joined #openstack-keystone | 09:27 | |
| *** tyagiprince has quit IRC | 09:28 | |
| *** tyagiprince has joined #openstack-keystone | 09:28 | |
| *** boris-42 has joined #openstack-keystone | 09:33 | |
| *** markvoelker has joined #openstack-keystone | 09:34 | |
| *** markvoelker has quit IRC | 09:39 | |
| *** markvoelker has joined #openstack-keystone | 09:39 | |
| *** lhcheng has joined #openstack-keystone | 09:43 | |
| *** ChanServ sets mode: +v lhcheng | 09:43 | |
| *** markvoelker has quit IRC | 09:44 | |
| *** markvoelker has joined #openstack-keystone | 09:45 | |
| *** lhcheng has quit IRC | 09:48 | |
| *** markvoelker has quit IRC | 09:50 | |
| *** fhubik has quit IRC | 09:50 | |
| davechen | vikram: try to remove the outdated yam file | 09:58 |
| davechen | vikram: i think you hit this bug - https://bugs.launchpad.net/devstack/+bug/1515352 | 10:00 |
| openstack | Launchpad bug 1515352 in devstack "Stacking fails on fedora 22 "Could not determine a suitable URL for the plugin"" [Undecided,Fix committed] | 10:00 |
| vikram | davechen: thanks | 10:00 |
| davechen | remove this file ~/.config/openstack/clouds.yaml should work for you | 10:00 |
| tyagiprince | dstanek: Yep reading documentations and code these days.. not able to picturize the servers and clients.. Who is doing what work etc.. | 10:08 |
| *** jaosorior has quit IRC | 10:14 | |
| *** jaosorior has joined #openstack-keystone | 10:15 | |
| *** aix has joined #openstack-keystone | 10:23 | |
| *** jasonsb has quit IRC | 10:26 | |
| *** bradjones_ has quit IRC | 10:28 | |
| *** bradjones_ has joined #openstack-keystone | 10:29 | |
| *** bradjones_ has quit IRC | 10:29 | |
| *** bradjones_ has joined #openstack-keystone | 10:29 | |
| *** genunix has joined #openstack-keystone | 10:32 | |
| genunix | Hello, I have a little question - is it possible to ensure some users are automatically assigned to newly created project with defined role? I was thinking about writing a paste middleware to do this but I am not sure how to inject code to be executed after tenant creation (and not before the app itself as in case of filters). | 10:34 |
| *** markvoelker has joined #openstack-keystone | 10:35 | |
| notmorgan | genunix: there currently isn't a way to do that. it's been talked about a bunch at the midcycles and summits | 10:35 |
| notmorgan | there is clearly a desire for that kind of functionality | 10:35 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 10:36 |
| notmorgan | genunix: we've long said that it might be best to have something listen to the rabbit bus for <create> events and then have an out-side service trigger and do the work of the auto provisioning | 10:37 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 10:37 |
| notmorgan | genunix: i don't know if a paste filter will really do what you want | 10:37 |
| *** shoutm has joined #openstack-keystone | 10:37 | |
| *** markvoelker has quit IRC | 10:39 | |
| *** bradjones_ has quit IRC | 10:40 | |
| *** e0ne has joined #openstack-keystone | 10:40 | |
| openstackgerrit | Merged openstack/keystone: Fix typo abstact in comments https://review.openstack.org/270558 | 10:40 |
| *** bradjones_ has joined #openstack-keystone | 10:41 | |
| *** bradjones_ has quit IRC | 10:41 | |
| *** bradjones_ has joined #openstack-keystone | 10:41 | |
| genunix | notmorgan: thank you for answer. So maybe only reasonable way is to create class that will inherit endpoint class and just override method for tenant creation? | 10:43 |
| *** vgridnev has quit IRC | 10:44 | |
| *** bradjones_ has quit IRC | 10:45 | |
| *** vikram has left #openstack-keystone | 10:47 | |
| *** bradjones_ has joined #openstack-keystone | 10:47 | |
| *** bradjones_ has quit IRC | 10:47 | |
| *** bradjones_ has joined #openstack-keystone | 10:47 | |
| *** vgridnev has joined #openstack-keystone | 10:48 | |
| notmorgan | genunix: or have an external service that listens for the tenant creation, and then does the work via the keystone apis when you get the event | 10:50 |
| notmorgan | i don't recommend subclassing if you can work with the event listener | 10:50 |
| *** dims has joined #openstack-keystone | 11:00 | |
| *** fhubik has joined #openstack-keystone | 11:01 | |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: POC Online Schema Migration: Add BinaryHex field https://review.openstack.org/269693 | 11:09 |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Unit test for checking cross-version migrations compatibility https://review.openstack.org/241603 | 11:09 |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Online schema migration documentation https://review.openstack.org/265252 | 11:09 |
| *** markvoelker has joined #openstack-keystone | 11:12 | |
| *** tyagiprince has quit IRC | 11:14 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Relax the schema validation to accept empty request body https://review.openstack.org/237448 | 11:14 |
| *** markvoelker has quit IRC | 11:18 | |
| *** fawadkhaliq has quit IRC | 11:22 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:23 | |
| *** aix has quit IRC | 11:23 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Relax the schema validation to accept empty request body https://review.openstack.org/237448 | 11:24 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 11:29 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 11:30 |
| *** aix has joined #openstack-keystone | 11:37 | |
| *** fawadkhaliq has quit IRC | 11:41 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 11:41 |
| *** fhubik is now known as fhubik_brb | 11:46 | |
| *** openstackgerrit has quit IRC | 11:47 | |
| *** openstackgerrit has joined #openstack-keystone | 11:47 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:48 | |
| *** fhubik_brb is now known as fhubik | 11:48 | |
| *** fawadkhaliq has quit IRC | 11:49 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:50 | |
| *** ajayaa has joined #openstack-keystone | 11:50 | |
| *** tyagiprince has joined #openstack-keystone | 11:51 | |
| *** bradjones_ has quit IRC | 11:52 | |
| *** boris-42 has quit IRC | 11:53 | |
| *** bradjones_ has joined #openstack-keystone | 11:53 | |
| *** bradjones_ has quit IRC | 11:53 | |
| *** bradjones_ has joined #openstack-keystone | 11:53 | |
| *** fawadkhaliq has quit IRC | 11:54 | |
| *** ajayaa has quit IRC | 11:59 | |
| *** ajayaa has joined #openstack-keystone | 12:00 | |
| *** bradjones has quit IRC | 12:01 | |
| *** bradjones_ is now known as bradjones | 12:01 | |
| *** jaosorior has quit IRC | 12:03 | |
| *** jaosorior has joined #openstack-keystone | 12:03 | |
| *** spzala has joined #openstack-keystone | 12:05 | |
| *** markvoelker has joined #openstack-keystone | 12:07 | |
| *** spzala has quit IRC | 12:09 | |
| *** markvoelker has quit IRC | 12:12 | |
| *** openstackgerrit has quit IRC | 12:33 | |
| *** openstackgerrit has joined #openstack-keystone | 12:33 | |
| *** gordc has joined #openstack-keystone | 12:34 | |
| *** markvoelker has joined #openstack-keystone | 12:42 | |
| dstanek | tyagiprince: focus on just one. for example, use the curl commands from the keystone docs against keystone to see what is happening | 12:44 |
| dstanek | tyagiprince: that way the client isn't doing anything | 12:44 |
| tyagiprince | dstanek: Okay.. Thanks.. | 12:45 |
| dstanek | tyagiprince: and to answer you question from a few days ago....the different projects all have different ways they are architected. | 12:46 |
| *** markvoelker has quit IRC | 12:54 | |
| *** pauloewerton has joined #openstack-keystone | 12:57 | |
| *** bill_az has joined #openstack-keystone | 12:59 | |
| ajayaa | davechen, Can you please clarify your comment on https://review.openstack.org/#/c/270057/3? | 12:59 |
| *** dims is now known as dimsum__ | 13:00 | |
| *** vgridnev has quit IRC | 13:01 | |
| raildo | dstanek: ping, can you help me with this patch? https://review.openstack.org/#/c/134095/ we are getting a error on py34 http://logs.openstack.org/95/134095/15/check/gate-keystone-python34/b026c5a/console.html.gz | 13:02 |
| raildo | dstanek: and I don't know how to fix it :( | 13:02 |
| *** fhubik is now known as fhubik_brb | 13:04 | |
| *** daemontool_ has quit IRC | 13:04 | |
| ajayaa | lbragstad, What could be a good place to store the urn namespace in https://review.openstack.org/#/c/252182. | 13:08 |
| ajayaa | I though common/utils.py is a good place to store it and I am importing the same in tests. | 13:08 |
| ajayaa | s/though/thought | 13:09 |
| *** fhubik_brb is now known as fhubik | 13:11 | |
| *** vgridnev has joined #openstack-keystone | 13:16 | |
| *** e0ne has quit IRC | 13:16 | |
| *** e0ne has joined #openstack-keystone | 13:17 | |
| *** vgridnev has quit IRC | 13:19 | |
| *** edmondsw has joined #openstack-keystone | 13:20 | |
| *** fhubik is now known as fhubik_brb | 13:20 | |
| dstanek | raildo: sure, i can take a look | 13:21 |
| davechen | ajayaa: seem like i have not commented on that patch. | 13:22 |
| davechen | ajayaa: you meant this one https://review.openstack.org/#/c/270057/ ? | 13:23 |
| *** vgridnev has joined #openstack-keystone | 13:24 | |
| *** mattt has joined #openstack-keystone | 13:28 | |
| ajayaa | davechen, sorry. wrong link. This one: https://review.openstack.org/#/c/252182/6 | 13:28 |
| mattt | hi all, anyone familiar with https://review.openstack.org/#/c/215212/ ? | 13:29 |
| davechen | ajayaa: pls check the source from uuid, it's 32 instead of 64. | 13:29 |
| davechen | ajayaa: i have aleady pasted the code there. | 13:30 |
| *** Nirupama has quit IRC | 13:31 | |
| davechen | from the source i see that the lenght of the hex should be 32 or else it will raise ValueError. | 13:31 |
| davechen | /hex/hex string | 13:31 |
| ajayaa | The length of hex should be more than 64 to raise a ValueError. | 13:33 |
| ajayaa | davachen ^^ | 13:33 |
| davechen | ajayaa: why? | 13:33 |
| davechen | if len(hex) != 32: | 13:34 |
| davechen | raise ValueError('badly formed hexadecimal UUID string') | 13:34 |
| davechen | my source is outdated? | 13:34 |
| ajayaa | What do you mean by source? | 13:34 |
| ajayaa | Python source or patch source? | 13:35 |
| davechen | ajayaa: if you pass the way the value in that way, i think it should strictly match with the 32 insead of no more that 64 or 32 | 13:35 |
| ajayaa | len(uuid.uuid4().hex) gives 32. | 13:35 |
| davechen | ajayaa: the code from uuid | 13:35 |
| davechen | ajayaa: yep, so why you check the length with 64? | 13:36 |
| davechen | ajayaa: pls dig into the code python27\lib\uuid.py | 13:36 |
| ajayaa | What we are trying to do there is, if the value is valid hex value then return it. | 13:36 |
| ajayaa | Otherwise we are creating new UUID using uuid.uuid5. | 13:36 |
| ajayaa | That's all we are doing. | 13:37 |
| davechen | ajayaa: so how do you catch the valueError? why it comes from? | 13:37 |
| davechen | ajayaa: it's from uuid lib, right? | 13:38 |
| ajayaa | Yes. | 13:38 |
| *** markvoelker has joined #openstack-keystone | 13:38 | |
| davechen | ajayaa: so, the lib has tell you the length should be 32 size. | 13:38 |
| ajayaa | The ValueError comes if the length is more than 32 or less than 32 and the value is not valid UUID hex value. | 13:38 |
| ajayaa | davechen, yes. | 13:39 |
| ajayaa | If it's not then we will make sure we output a value which is 32 chracters in length and can be used in other places. | 13:40 |
| ajayaa | 64 limit is there for the simple reason being we are only concerned with cases where value is a concatenation of two uuid hex values. | 13:40 |
| ajayaa | davechen, Do I make sense? :) | 13:41 |
| davechen | ajayaa: i see. | 13:41 |
| *** markvoelker has quit IRC | 13:43 | |
| ajayaa | I need help with one thing. What do you think is a good place to put RESOURCE_ID_NAMESPACE present in utils.py file. | 13:43 |
| ajayaa | davechen ^^ | 13:43 |
| davechen | ajayaa: i think it's okay to put the constant there, thanks for the clarification! | 13:48 |
| ajayaa | you are welcome. | 13:50 |
| *** tyagiprince has quit IRC | 13:53 | |
| dstanek | mattt: what's up? | 13:55 |
| *** fhubik_brb is now known as fhubik | 13:55 | |
| *** doug-fish has joined #openstack-keystone | 13:55 | |
| *** markvoelker has joined #openstack-keystone | 13:59 | |
| *** belmoreira has quit IRC | 14:00 | |
| *** markvoelker_ has joined #openstack-keystone | 14:01 | |
| mattt | dstanek: dolphm is fielding some questions for us in #openstack-ansible :) | 14:04 |
| *** markvoelker has quit IRC | 14:04 | |
| *** tyagiprince has joined #openstack-keystone | 14:05 | |
| *** dslev_ has joined #openstack-keystone | 14:06 | |
| raildo | dstanek: thanks :) | 14:08 |
| *** daemontool has joined #openstack-keystone | 14:08 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Update mod_wsgi + cache config docs https://review.openstack.org/271311 | 14:10 |
| *** daemontool_ has joined #openstack-keystone | 14:12 | |
| *** daemontool has quit IRC | 14:13 | |
| lbragstad | bug day! | 14:16 |
| lbragstad | dstanek have you ever read http://rfc.zeromq.org/spec:22 ? | 14:18 |
| *** richm has joined #openstack-keystone | 14:18 | |
| ajayaa | lbragstad, Hey! I want a little help with https://review.openstack.org/#/c/252182/ | 14:21 |
| lbragstad | ayoung sure, what's up? | 14:22 |
| ajayaa | What common file should I put RESOURCE_ID_NAMESPACE in? | 14:22 |
| ajayaa | wrong autoocompletion I suppose*. :) | 14:23 |
| lbragstad | could it be imported as a constant from keystone/common/utils.py ? | 14:23 |
| *** Ephur has quit IRC | 14:23 | |
| ajayaa | okay. Already did that. Will push it. Thanks. | 14:24 |
| ajayaa | One more thing, when stevemar says test with non-ascii chracter what does he mean? | 14:24 |
| ajayaa | Shall the input be somthing like 'ß' * 65 | 14:25 |
| lbragstad | ajayaa yes - I believe that is what he was referencing | 14:25 |
| bknudson | lbragstad: is there an etherpad for bugday work? | 14:25 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Fix nits in include names patch https://review.openstack.org/270884 | 14:25 |
| ajayaa | lbragstad, Okay. If I put 'ß' in Python file then I would have declare encoding on the top. | 14:26 |
| ajayaa | Would that be a problem? | 14:26 |
| lbragstad | ajayaa cool | 14:26 |
| lbragstad | bknudson yep! | 14:26 |
| lbragstad | bknudson let me grab you the links | 14:26 |
| ajayaa | Else I can put '\xc3\x9f' in the Python file. | 14:27 |
| ajayaa | If I take second route then I won't have to declare encoding on the top. | 14:27 |
| ajayaa | What do you suggest? | 14:27 |
| lbragstad | these are the gerrit dashboard that dstanek and I have created - https://goo.gl/tvfU8y and https://bit.ly/keystone-bug-reviews | 14:27 |
| bknudson | ajayaa: there's encoding specified in some keystone files already. Use either method. | 14:27 |
| lbragstad | bknudson here is the etherpad - https://etherpad.openstack.org/p/keystone-office-hours | 14:28 |
| bknudson | ok... looks like I just go about my normal business then. | 14:28 |
| lbragstad | bknudson we were using that to track In Progress patches and bugs - but I think we can actually get most of that out of the dashboards | 14:29 |
| ajayaa | bknudson, Thanks! | 14:29 |
| bknudson | lbragstad: are people using the etherpad or are they using the dashboards? | 14:30 |
| lbragstad | bknudson I use both - but the dashboards typically stay more up-to-date because it's a better source of truth | 14:31 |
| lbragstad | bknudson I think the etherpad could be populated with bugs that you want to collaborate on | 14:31 |
| *** fhubik is now known as fhubik_brb | 14:32 | |
| *** fhubik_brb is now known as fhubik | 14:32 | |
| lbragstad | i.e. you've pushed several patch set on a particular bug fix and now you have to go do other things - so it gives me a place to look for bugs I can keep moving forward | 14:32 |
| lbragstad | dstanek and I were hoping that it would result in less stale bug fixes just sitting in gerrit | 14:32 |
| bknudson | lbragstad: can you update the etherpad with that information? | 14:32 |
| lbragstad | bknudson yeah I can do that | 14:32 |
| lbragstad | dstanek are you ok with that? | 14:33 |
| bknudson | I thought the point of office hours is that we're around to discuss reviews... not that we sit around doing reviews like we're always doing anyways. | 14:35 |
| *** daemontool_ has quit IRC | 14:37 | |
| *** tyagiprince has quit IRC | 14:38 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Relax the schema validation to accept empty request body https://review.openstack.org/237448 | 14:39 |
| *** dslev_ has quit IRC | 14:39 | |
| lbragstad | bknudson we can certainly discuss things - I'm open to that | 14:40 |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: Ensure pycadf initiator IDs are UUID https://review.openstack.org/252182 | 14:42 |
| *** spzala has joined #openstack-keystone | 14:42 | |
| ajayaa | lbragstad, A quick review on the above patch will be appreciated. :) | 14:43 |
| davechen | dstanek, lbragstad, bknudson: i hope this get a little better - https://review.openstack.org/#/c/237448/. | 14:43 |
| davechen | dstanek, lbragstad, bknudson: appreciate your review, leave your comments if there is anything I missed. | 14:45 |
| davechen | turn off my computer, and head off to bed, have a nice day, all! | 14:46 |
| *** su_zhang has joined #openstack-keystone | 14:46 | |
| *** davechen has left #openstack-keystone | 14:46 | |
| *** pcaruana has joined #openstack-keystone | 14:46 | |
| *** pnavarro has quit IRC | 14:48 | |
| lbragstad | ajayaa reviewed - I think its getting there, just one comment left really | 14:49 |
| *** dslev_ has joined #openstack-keystone | 14:52 | |
| *** jsavak has joined #openstack-keystone | 14:53 | |
| *** markvoelker has joined #openstack-keystone | 14:57 | |
| *** erhudy has joined #openstack-keystone | 14:57 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Revert "Disable memory caching of tokens" https://review.openstack.org/271352 | 15:00 |
| *** rbak has joined #openstack-keystone | 15:00 | |
| *** markvoelker_ has quit IRC | 15:01 | |
| *** mhickey has quit IRC | 15:02 | |
| dolphm | for anyone doing multi node deployments of keystone, you should know how our cache invalidation *actually* behaves https://gist.github.com/dolph/04bd4984c7d1f34ef821 | 15:02 |
| *** jsavak has quit IRC | 15:03 | |
| *** jsavak has joined #openstack-keystone | 15:03 | |
| bknudson | can you configure dogpile.cache to push invalidations to memcache? | 15:04 |
| dolphm | bknudson: i imagine you'd have to region.set(key, dogpile.cache.api.NoValue) or something | 15:11 |
| openstackgerrit | Merged openstack/keystone-specs: Enable `id`, `enabled` filter for list IdP https://review.openstack.org/267949 | 15:12 |
| lbragstad | dolphm do we have to make any changes to keystone to account for that? | 15:12 |
| *** markvoelker has quit IRC | 15:12 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:13 | |
| *** mhickey has joined #openstack-keystone | 15:14 | |
| dolphm | you know what? we're using invalidate() (which does not write to the shared cache) in some instances where we should be using delete() (which writes to the share cache, but you must know the key to delete) | 15:17 |
| *** jistr has quit IRC | 15:18 | |
| *** jsavak has quit IRC | 15:22 | |
| *** tonytan4ever has joined #openstack-keystone | 15:22 | |
| *** jsavak has joined #openstack-keystone | 15:23 | |
| *** timcline has joined #openstack-keystone | 15:26 | |
| *** fhubik is now known as fhubik_brb | 15:26 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Revert "Disable memory caching of tokens" https://review.openstack.org/271352 | 15:35 |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: Ensure pycadf initiator IDs are UUID https://review.openstack.org/252182 | 15:36 |
| lbragstad | stevemar notmorgan fyi - https://review.openstack.org/#/c/271352/2 | 15:38 |
| lbragstad | bknudson looks like ^ will improve the gate? | 15:39 |
| bknudson | lbragstad: new releases of keystonemiddleware are going to be blacklisted due to the change that's proposed to be reverted. | 15:39 |
| lbragstad | bknudson gotcha | 15:40 |
| bknudson | Here's the requirements change: https://review.openstack.org/#/c/270417/ | 15:40 |
| lbragstad | bknudson the new releases of keystonemiddleware are going to be blacklisted until the proposed revert is merged? | 15:40 |
| bknudson | 4.1.0 was blacklisted because of this change so if we release a 4.2.0 with this change it'll be blacklisted, too. | 15:41 |
| bknudson | I expect it will also impact deployers. | 15:42 |
| *** mhickey has quit IRC | 15:42 | |
| *** markvoelker has joined #openstack-keystone | 15:44 | |
| *** woodster_ has joined #openstack-keystone | 15:44 | |
| stevemar | bknudson: we're gonna revert the change and make it go through deprecation | 15:45 |
| stevemar | bknudson: want to revert "don't cache signed tokens" too? | 15:45 |
| bknudson | stevemar: I think it's correct to not cache signed tokens, isn't it? they're validated offline so what's the point? | 15:47 |
| stevemar | wild assumptions like that may cause 4.2.0 to be black listed too :O | 15:47 |
| bknudson | it would make the revert of no-memory-cache easier to also revert "don't cache signed tokens" | 15:47 |
| bknudson | and it can just be re-applied if we want it back. | 15:48 |
| stevemar | that's what i was thinking | 15:48 |
| bknudson | ok, I'll propose both reverts. | 15:48 |
| stevemar | cool | 15:48 |
| stevemar | lets just revert everything from 4.1.0 -> 4.0.0 | 15:49 |
| *** henrynash has joined #openstack-keystone | 15:49 | |
| *** ChanServ sets mode: +v henrynash | 15:49 | |
| *** fhubik_brb is now known as fhubik | 15:49 | |
| *** fhubik has quit IRC | 15:50 | |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: Ensure pycadf initiator IDs are UUID https://review.openstack.org/252182 | 15:52 |
| *** e0ne has quit IRC | 15:52 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Revert "Disable memory caching of tokens" https://review.openstack.org/271352 | 15:52 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Revert "Don't cache signed tokens" https://review.openstack.org/271403 | 15:52 |
| *** e0ne has joined #openstack-keystone | 15:53 | |
| stevemar | bknudson: thanks | 15:53 |
| bknudson | there were a lot of changes from 4.0.0 to 4.1.0 | 15:53 |
| stevemar | bknudson: i was joking | 15:53 |
| bknudson | got me! | 15:53 |
| stevemar | i need a sarcasm emoji | 15:54 |
| bknudson | I heard it's the upside-down smiley | 15:54 |
| stevemar | lbragstad: ^ | 15:54 |
| *** mhickey has joined #openstack-keystone | 15:54 | |
| raildo | stevemar: something like http://cdn1.theodysseyonline.com/files/2015/07/26/6357352043304163112016680847_854950bf0643fb4d7e482248ba3532a8d4cbe2bd2961d4d717f622274a51f309.jpg | 15:55 |
| lbragstad | lol | 15:55 |
| *** fawadkhaliq has joined #openstack-keystone | 15:57 | |
| stevemar | looks like reno doesn't build for ksm: https://review.openstack.org/#/c/270974/ | 15:57 |
| stevemar | excellent | 15:57 |
| *** dslev_ has quit IRC | 15:57 | |
| *** daemontool has joined #openstack-keystone | 15:58 | |
| samueldmq | stevemar: looks to be an easy fix ? want me to do it ? | 15:59 |
| bknudson | that's where the release note went | 15:59 |
| bknudson | tox -e releasenotes on master works for me locally | 16:00 |
| samueldmq | bknudson: same here | 16:02 |
| stevemar | lbragstad: samueldmq: bknudson: let's also get a deprecation warning in about that, and i'll change notmorgan's reno patch to 'deprecated' instead of 'removed' | 16:03 |
| stevemar | this way it's ready for a monday realease of 4.2.0 | 16:03 |
| *** daemontool has quit IRC | 16:03 | |
| bknudson | I'll get to work on a deprecation patch | 16:03 |
| *** patient-0-bl0gan is now known as blogan | 16:05 | |
| samueldmq | ++ | 16:05 |
| *** jsavak has quit IRC | 16:05 | |
| *** jsavak has joined #openstack-keystone | 16:06 | |
| *** vgridnev has quit IRC | 16:07 | |
| *** browne has joined #openstack-keystone | 16:07 | |
| *** mhickey has quit IRC | 16:11 | |
| *** zqfan has quit IRC | 16:11 | |
| *** tsymanczyk has joined #openstack-keystone | 16:11 | |
| *** timcline has quit IRC | 16:12 | |
| *** tsymanczyk is now known as Guest91437 | 16:12 | |
| *** jsavak has quit IRC | 16:15 | |
| *** rcernin has quit IRC | 16:15 | |
| *** diazjf has joined #openstack-keystone | 16:15 | |
| *** jsavak has joined #openstack-keystone | 16:16 | |
| *** slberger has joined #openstack-keystone | 16:16 | |
| *** peter-hamilton has joined #openstack-keystone | 16:16 | |
| *** diazjf1 has joined #openstack-keystone | 16:17 | |
| *** diazjf has quit IRC | 16:20 | |
| *** diazjf has joined #openstack-keystone | 16:21 | |
| *** diazjf1 has quit IRC | 16:22 | |
| dstanek | lbragstad: i've never seen that | 16:23 |
| *** rderose has joined #openstack-keystone | 16:23 | |
| dstanek | bknudson: lbragstad i have no issue with it being updated | 16:24 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Add reno for caching change https://review.openstack.org/270974 | 16:25 |
| stevemar | bknudson: samueldmq lbragstad ^ | 16:25 |
| samueldmq | stevemar: 6 means O right ? | 16:31 |
| samueldmq | stevemar: Ocata | 16:31 |
| *** rderose has quit IRC | 16:33 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Deprecate in-process cache https://review.openstack.org/271421 | 16:33 |
| bknudson | stevemar: what do you think about squashing the reno note with the deprecation? | 16:34 |
| *** jaosorior has quit IRC | 16:35 | |
| *** roxanagh_ has joined #openstack-keystone | 16:35 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Deprecate in-process cache https://review.openstack.org/271421 | 16:37 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Deprecate in-process cache https://review.openstack.org/271421 | 16:38 |
| *** spandhe has joined #openstack-keystone | 16:38 | |
| stevemar | bknudson: totally fine with that | 16:38 |
| bknudson | alright, I'll update the reno change. | 16:39 |
| *** simondodsley has joined #openstack-keystone | 16:39 | |
| *** timcline has joined #openstack-keystone | 16:40 | |
| *** jistr has joined #openstack-keystone | 16:43 | |
| *** pnavarro has joined #openstack-keystone | 16:43 | |
| *** GB21 has joined #openstack-keystone | 16:44 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Deprecate in-process cache https://review.openstack.org/270974 | 16:46 |
| stevemar | bknudson: 6.0.0 makes sense? | 16:48 |
| stevemar | i figured N is 5.0.0 and O is 6.0.0? | 16:49 |
| bknudson | stevemar: no number makes sense since we don't know what release numbers are going to be. | 16:49 |
| bknudson | I think we should just put 5. | 16:49 |
| stevemar | yeah? | 16:49 |
| stevemar | hmm | 16:49 |
| bknudson | since that's the next one... then maybe we have to update it later. | 16:49 |
| bknudson | or maybe we could just say sometime in the O release? | 16:50 |
| bknudson | sometime in the O development cycle | 16:51 |
| stevemar | bknudson: i was thinking O release, but ksm doesn't really follow that >.< | 16:51 |
| stevemar | yeah | 16:51 |
| stevemar | i i thought we do major version bumps between dev cycles | 16:52 |
| bknudson | O is going to be confusing because it looks like a 0 | 16:52 |
| bknudson | we should have skipped that letter | 16:52 |
| stevemar | hehe | 16:52 |
| bknudson | we do major version bumps when we remove function | 16:52 |
| stevemar | i thought we do major version bumps because when we want to do a stable release, we will bump it to 4.Y.0 for M and 5.0.0 for N... | 16:54 |
| stevemar | anytime we have a library change we have to bump Y? | 16:54 |
| bknudson | if a new feature is added you bump Y | 16:54 |
| bknudson | according to semver | 16:54 |
| *** rcernin has joined #openstack-keystone | 16:54 | |
| *** browne has quit IRC | 16:54 | |
| *** lhcheng has joined #openstack-keystone | 16:54 | |
| *** ChanServ sets mode: +v lhcheng | 16:54 | |
| bknudson | if the release only includes bug fixes and no new features then you bump the "fix" | 16:55 |
| ayoung | henrynash, can we treat https://review.openstack.org/#/c/271134/ as just a bug fix, and anything more as a separate change? | 16:55 |
| *** e0ne has quit IRC | 16:55 | |
| stevemar | what about a dependent library change? | 16:55 |
| henrynash | ayoung: ok, I’m good with that…. | 16:55 |
| stevemar | like an oslo version changes | 16:56 |
| bknudson | you don't remove features in stable so you wouldn't bump the major version #. | 16:56 |
| bknudson | and you don't add features in stable so you wouldn't bump the minor version #, so only fixes. | 16:56 |
| ayoung | henrynash, thanks. Although I did not order the patch, I'd prefer to get this one in before the API change goes through, and you depend heavily on the API change | 16:56 |
| stevemar | bknudson: hmm, i could have sworn i read somewhere that library changes bump the minor version number | 16:56 |
| henrynash | ayoung: +2’d | 16:56 |
| ayoung | henrynash, excellent. samueldmq can you chime in on https://review.openstack.org/#/c/271134/ as you found the original problem | 16:57 |
| bknudson | stevemar: y, I think we want to do that. The reason you change the reqs is if you rely on new features in the library, and we shouldn't be doing that in stable. | 16:57 |
| stevemar | bknudson: "will be removed in keystonemiddleware 5.0.0 (or in the `O` development cycle)" is fine with me | 16:57 |
| bknudson | stevemar: I'll update the review. | 16:58 |
| stevemar | bknudson: cool | 16:58 |
| ayoung | henrynash, so API patch https://review.openstack.org/#/c/242614/ was a bit of a rewrite. jamielennox pushed me to get things correct by the API spec, and I think it is a lot tigheter, but still could use eyes. | 16:58 |
| henrynash | ayoung: will look | 16:59 |
| stevemar | bknudson: why didn't you use the oslo.log version utils function (report deprecation function) | 16:59 |
| stevemar | err.. deprecated* | 16:59 |
| bknudson | stevemar: I copied how we did deprecations in other parts. | 16:59 |
| ayoung | I'd love it if that got in before the midcycle, and then the midcycle on can focus on DSR series exclusively | 16:59 |
| stevemar | fair enough | 16:59 |
| stevemar | ayoung: that would be nice | 16:59 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Deprecate in-process cache https://review.openstack.org/270974 | 17:01 |
| stevemar | thanks bknudson | 17:02 |
| samueldmq | ayoung: sure, looking now | 17:03 |
| samueldmq | stevemar: bknudson so we release a new major version of middleware each 2 scycles ? | 17:04 |
| samueldmq | cycles* | 17:04 |
| stevemar | lbragstad: dstanek if one of you could look at the chain here: https://review.openstack.org/#/c/270974/ and it's two dependent patches, that'll be awesomeo | 17:05 |
| bknudson | samueldmq: we can release new major version whenever we feel like it. | 17:05 |
| lbragstad | stevemar i'll review that next | 17:05 |
| bknudson | could be multiple times in a cycle or never. | 17:05 |
| bknudson | samueldmq: we follow semver -- http://semver.org/ | 17:06 |
| *** pnavarro has quit IRC | 17:06 | |
| *** jistr has quit IRC | 17:08 | |
| samueldmq | bknudson: nice, looks similar to what nova does with microversions | 17:08 |
| bknudson | samueldmq: do they have major-minor-patch? I thought they just incremented a number | 17:08 |
| *** jistr has joined #openstack-keystone | 17:09 | |
| samueldmq | bknudson: they don't have patch, only major-minor | 17:10 |
| samueldmq | bknudson: http://docs.openstack.org/developer/nova/api_microversions.html | 17:10 |
| bknudson | "It is vital that the two methods have the same name" -- weird. | 17:11 |
| dstanek | stevemar: shore | 17:12 |
| samueldmq | bknudson: the spec https://specs.openstack.org/openstack/nova-specs/specs/kilo/implemented/api-microversions.html#versioning | 17:12 |
| dstanek | looks like ayoung beat me to it | 17:13 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Address comments from Implied Role manager patch https://review.openstack.org/269990 | 17:13 |
| ayoung | :) | 17:13 |
| ayoung | I'm omn a +2 Rampage | 17:13 |
| *** _cjones_ has joined #openstack-keystone | 17:13 | |
| ayoung | I was looking for the PKI fix in the middleware reviews and started doing reviews | 17:13 |
| ayoung | occupational hazard | 17:13 |
| *** jistr has quit IRC | 17:14 | |
| *** _cjones_ has quit IRC | 17:14 | |
| *** _cjones_ has joined #openstack-keystone | 17:14 | |
| *** tyagiprince has joined #openstack-keystone | 17:16 | |
| *** jistr has joined #openstack-keystone | 17:17 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Check for circular references when expanding implied roles https://review.openstack.org/271134 | 17:19 |
| samueldmq | ayoung: henrynash: commented on https://review.openstack.org/#/c/271134 | 17:24 |
| *** Guest91437 has quit IRC | 17:24 | |
| henrynash | samueldmq: yep, a log would certainly be a good thing | 17:25 |
| dstanek | lbragstad: i'm going to update https://review.openstack.org/#/c/237448/9 so that we can close another bug. | 17:25 |
| ayoung | samueldmq, stopping the creation is a bigger patch, and can happen, too | 17:25 |
| ayoung | this is a "keep us moving ahead" approach and is intentionally as small as possible | 17:26 |
| ayoung | I'll add the logging | 17:26 |
| dstanek | raildo: areyou around? | 17:26 |
| raildo | dstanek: yes | 17:26 |
| samueldmq | ayoung: so could we do a related-bug ? and only close in the other patch for creation ? | 17:27 |
| samueldmq | ayoung: I agree we should get this first to keep us moving | 17:27 |
| dstanek | raildo: that patch from this morning is strange - it seems like the index isn't being enforced in the same way - have you looked at it at all? | 17:27 |
| henrynash | stevemar, ayoung: first in a series of simplification patches for our ldap tests (this one saves a whole test run of IdenitityTests): https://review.openstack.org/#/c/271106/ | 17:27 |
| *** gyee_ has joined #openstack-keystone | 17:27 | |
| ayoung | samueldmq, can this one go in as is, or do you hold firm on the log message? | 17:28 |
| samueldmq | henrynash: nice! I always had in mind that we needed to revisit our LDAP test scenarios | 17:29 |
| ayoung | henrynash, awesome sauce there | 17:29 |
| samueldmq | ayoung: I think this is really important, as a way to let the deployer know and fix it | 17:29 |
| ayoung | samueldmq, OK...fixing now | 17:29 |
| samueldmq | ayoung: even more important if we don't stop at the creation later | 17:29 |
| samueldmq | ayoung: I can do it if you want too | 17:29 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update mod_wsgi + cache config docs https://review.openstack.org/271311 | 17:29 |
| raildo | dstanek: I'm thinking it must have something wrong on the script, maybe we should log on the driver | 17:30 |
| ayoung | samueldmq, yeah, please give a go at "stop cycles at creation" | 17:32 |
| ayoung | that would be great | 17:32 |
| *** jsavak has quit IRC | 17:35 | |
| *** jsavak has joined #openstack-keystone | 17:35 | |
| samueldmq | ayoung: nice, will do later, and that will be consistent with hierarchical projects (which we don't allow) | 17:36 |
| *** browne has joined #openstack-keystone | 17:36 | |
| samueldmq | ayoung: and will make notmorgan happy about it | 17:36 |
| ayoung | lbragstad, dstanek dolphm you guys just scoped: bstein is awesome | 17:36 |
| ayoung | http://finance.yahoo.com/news/rackspace-hires-brian-stein-vice-140000513.html | 17:37 |
| ayoung | Not surprised that Scott Crenshaw hired him...again. They are both former RHers, and Stein was the guy that physically yanked me into OpenStack | 17:38 |
| *** jasonsb has joined #openstack-keystone | 17:40 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Allow project domain_id to be nullable at the manager level https://review.openstack.org/264533 | 17:41 |
| notmorgan | Allo | 17:42 |
| *** tsymanczyk has joined #openstack-keystone | 17:43 | |
| *** tsymanczyk is now known as Guest42984 | 17:43 | |
| dstanek | ayoung: nice | 17:45 |
| ayoung | dstanek, he's sharp. I know he relocated his family to Portland for Puppet, so I don't know if he is going to move to the mothership | 17:46 |
| dstanek | raildo: figured it out | 17:46 |
| raildo | dstanek: you have my curiosity now you have my attention | 17:48 |
| *** su_zhang has quit IRC | 17:50 | |
| *** mdavidson has quit IRC | 17:50 | |
| -openstackstatus- NOTICE: Restarting zuul due to a memory leak | 17:50 | |
| dstanek | raildo: the mock isn't working. i'm creating a new patch now | 17:50 |
| dstanek | openstackstatus: Java ftw! | 17:51 |
| stevemar | dstanek: hmm, i wonder if that is the queue or the web page | 17:53 |
| notmorgan | stevemar: bknudson we should bound the revert out of the gate and forget the deprecation. Just leave the crappy in memory cache in. | 17:53 |
| ayoung | dstanek, does running pip against a venv cache a load of files in /tmp? | 17:56 |
| ayoung | I filled up /tmp running pep8, and had to delete a bunch of /tm,p/pip-* dirs | 17:56 |
| *** jistr has quit IRC | 17:57 | |
| *** jsavak has quit IRC | 17:57 | |
| *** jsavak has joined #openstack-keystone | 17:58 | |
| *** Ephur has joined #openstack-keystone | 17:58 | |
| dstanek | raildo: why are you checking for the log message anyway? | 17:59 |
| *** fawadkhaliq has quit IRC | 17:59 | |
| *** fawadkhaliq has joined #openstack-keystone | 17:59 | |
| dstanek | ayoung: i've not had that problem, but i know others that have | 17:59 |
| stevemar | dstanek: looks like the queue was reset :\ | 18:00 |
| ayoung | stevemar, dstanek : I want to propose that we split the functional tests out of the keystone repo and instead put them in their own repo. The functional tests will be far more valudable if we treat them as testing things across our hole body of supported code. Specifically, we should use the echo service that dolphm wrote, be able to test policy changes against it, and also make sure the keystone client works. | 18:00 |
| ayoung | valudable: my new world for today! | 18:01 |
| dstanek | ayoung: i think that's a good conversation to have after we get some of them written | 18:01 |
| ayoung | dstanek, I think that this is why we don't have any written | 18:01 |
| ayoung | There is a real reluctance to put anything but the most necessary changes into the keystone repo | 18:02 |
| stevemar | ayoung: not when it comes to tests | 18:02 |
| raildo | dstanek: htruta that have made this mock code, and he is not here today :( but I think that someone have asked us to log the error on de duplicateEntry case and he found this example to test it https://github.com/openstack/keystone/blob/da3cd2dc4deed0093662e5ce098d8c022f654bc2/keystone/tests/unit/backend/domain_config/core.py#L493-L498 | 18:02 |
| ayoung | dstanek, I know you put a bunch of effort in to that. It has bothered me that we have not built on it | 18:02 |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: Change get_project permission https://review.openstack.org/270057 | 18:02 |
| ayoung | stevemar, a functional test that, say, set up the LDAP server or a different Database? | 18:02 |
| ayoung | stevemar, or that pulls in various versions of the client? | 18:03 |
| notmorgan | Did Oslo cache for middleware.land somewhere? | 18:03 |
| notmorgan | Cause if it did we need to bounce that revert now | 18:03 |
| notmorgan | And fix that first | 18:03 |
| ayoung | We started off there, and backed off it. Just...think on it. | 18:03 |
| raildo | dstanek: the trick part is that this works on py27 and not on py34 =/ | 18:03 |
| notmorgan | We cannot be on Oslo.cache and have the in-memory caching | 18:03 |
| notmorgan | Default | 18:03 |
| notmorgan | It will destroy production systems. | 18:04 |
| notmorgan | As in massive breakage. Run them out of ram | 18:04 |
| ayoung | notmorgan, I just +2ed that | 18:04 |
| dstanek | raildo: sure log the error, but i'm not convinced that we need to test for that | 18:04 |
| ayoung | notmorgan, course, I want to get rid of all caching of token validations, but that is me | 18:05 |
| stevemar | ayoung: the ldap/database or other setup bits should either be devstack extensions like dstanek proposed, i think that's fine to keep in keystone for now | 18:05 |
| ayoung | stevemar, the real issue is a functional test across client and middleware and policy | 18:05 |
| ayoung | we've needed that for a long time. Why is this not a "duh, yup tyhat makes sense?" | 18:06 |
| raildo | dstanek: that was I thought... | 18:06 |
| dstanek | raildo: it's not a 2.7 vs. 3.4. it's a test ordering issue | 18:06 |
| ayoung | we should have done this when we realized th client tests don't belong in keystone prop-er | 18:06 |
| ayoung | notmorgan, stevemar, lets just, for the sake of progress, assume we were going to create a keystone-tests repo. What would be the process? | 18:07 |
| stevemar | ayoung: i'm all for functional tests, just keep them in the same repo | 18:07 |
| *** boris-42 has joined #openstack-keystone | 18:08 | |
| dstanek | stevemar: maybe we can get some of those changes in then :-) i'll rebase and await the +2s! | 18:08 |
| ayoung | stevemar, a true functional test goes from CLI to Keystone to service through middleware and policy | 18:08 |
| notmorgan | ok let me check cause i might need to bounce that change | 18:08 |
| dstanek | ayoung: exactly | 18:09 |
| raildo | dstanek: so, do you think that I can just remove this log test? | 18:09 |
| ayoung | dstanek, do you remember when we had the client tests, all those different versions, inside the keystone code base and we removed them? | 18:10 |
| ayoung | We really should have given them a place to land | 18:10 |
| dstanek | raildo: i'm trying to get something that'll work, but we could remove | 18:10 |
| stevemar | ayoung: http://docs.openstack.org/infra/manual/creators.html ? | 18:10 |
| notmorgan | bknudson, dstanek, stevemar: ok so i -2'd the move to oslo.cache for keystonemiddleware. we're blocked on that for 2 cycles now | 18:10 |
| notmorgan | bknudson, dstanek, stevemar: I also severely disagree with mreidm's statement on the impact. it affected the gate in a very specific way due to the way the gate runs. we have had multiple complaints about in-consisted validation over the years due to undocumented badly implemented default caching in-process | 18:11 |
| notmorgan | frankly, i blame termie | 18:12 |
| notmorgan | :P | 18:12 |
| stevemar | notmorgan: i'm not understanding why we can't bring in oslo.cache, and make that default, but i'm not as familiar as you are. | 18:12 |
| notmorgan | stevemar: because... on every get oslo.cache does not removed expired items from the in-memory dict | 18:12 |
| ayoung | stevemar, thanks. I'll write something up. | 18:12 |
| notmorgan | if you default to in-memory cache, and i am sure people are in the wild | 18:12 |
| stevemar | notmorgan: can't we modify oslo.cache? | 18:12 |
| notmorgan | you will add things to this in-memory dict and never remove them. | 18:12 |
| notmorgan | i wouldn't want to duplicate memorycache | 18:12 |
| notmorgan | it is a horrible design | 18:13 |
| dimsum__ | notmorgan : stevemar : DictCacheBackend | 18:13 |
| notmorgan | i've been trying to kill the "run through a dict on every get to remove items" because a) it's slow. | 18:13 |
| stevemar | notmorgan: that seems like a bad design for oslo.cache, if nothing is ever removed | 18:13 |
| notmorgan | dimsum__: we added it :( | 18:13 |
| notmorgan | dimsum__: damn it i wish i had seen. i would have -2 | 18:13 |
| notmorgan | that design is the worst possible choice. | 18:13 |
| notmorgan | stevemar: yes. DO NOT use the in-memory dict for short-term cache data. | 18:14 |
| dimsum__ | notmorgan : that's a lift for nova | 18:14 |
| *** timcline has quit IRC | 18:14 | |
| notmorgan | dimsum__: i would have still -2'd | 18:14 |
| notmorgan | dimsum__: it is horrible. | 18:14 |
| notmorgan | it is the reason i wanted memorycache oslo-incubator thing to go away | 18:14 |
| * notmorgan sighs. | 18:14 | |
| *** timcline has joined #openstack-keystone | 18:14 | |
| dimsum__ | no point in fixing what you feel is broken? | 18:14 |
| *** shoutm has quit IRC | 18:15 | |
| notmorgan | you can't fix the broken-ness | 18:15 |
| notmorgan | in that design | 18:15 |
| dimsum__ | so we need a new backend with an alternative design? | 18:15 |
| notmorgan | basically you shouldn't expect items to fall out of the dict. either clean it yourself or use a real cache backend. | 18:16 |
| notmorgan | it's really expensive to walk a dict full the stuff and expire things. | 18:16 |
| notmorgan | i've looked into many alternatives and they all come down to the same thing... if you walk a dict that is full every single get | 18:16 |
| notmorgan | you end up with kindof a bunch of ick | 18:17 |
| dstanek | notmorgan: a dict is the wrong data structure. | 18:17 |
| notmorgan | also.. you are caching per-process/worker and it really causes inconsistent things with the way we use eventlet | 18:17 |
| notmorgan | the offload in a real environment isn't very beneficial | 18:17 |
| dimsum__ | dstanek : what's a better data structure? | 18:17 |
| dstanek | dimsum__: i have used a dict of dict to implement a similar concept | 18:18 |
| notmorgan | dstanek: i've done the implementation. it doesn't help really | 18:18 |
| dstanek | the outer dict was keyed by the minute of the hour '00' and the inner dict was the cache | 18:18 |
| *** tyagiprince1 has joined #openstack-keystone | 18:18 | |
| notmorgan | dstanek: and/or you memory bloat massively because python doesn't really LRU things out | 18:19 |
| dstanek | notmorgan: if gives you an O(1) flush | 18:19 |
| *** timcline has quit IRC | 18:19 | |
| stevemar | bunch of keystone changes are gonna land soon :O | 18:19 |
| notmorgan | dstanek: but we have issues where we cram too much in. we really need the scrub on every get | 18:19 |
| *** tyagiprince has quit IRC | 18:19 | |
| *** tyagiprince1 is now known as tyagiprince | 18:19 | |
| notmorgan | dstanek: or we have a serious impact to memory use. it's a bad situation created by a bad cache implementation that we've just carried forever | 18:20 |
| dstanek | notmorgan: i'm not saying that it would work perfectly; just that a flat dict is definitely not correct | 18:20 |
| notmorgan | dstanek: i am going to argue that making an in-memory LRU cache is a bad idea in python | 18:20 |
| dstanek | i'm very happy saying not to have in memory caches because ultimately it doesn't scale | 18:20 |
| notmorgan | dstanek: just a fundamentally bad choice unless you are making an app to compete with memcache | 18:21 |
| notmorgan | which case, there are a lot of other design considerations you can add that i doubt we'll have people happy about in our code | 18:21 |
| notmorgan | like handoff of slabs, scrubbers that can free things as extra workers, etc | 18:21 |
| notmorgan | but... lets use C/C++ and/or the things that do this well | 18:22 |
| dstanek | notmorgan: let's face it. as evident by the existence of a memcache token backend, we don't understand slabs :-) | 18:22 |
| notmorgan | in openstack we don't | 18:22 |
| notmorgan | in openstack we don't understand "caching" | 18:23 |
| notmorgan | we do a very bad job of it in general | 18:23 |
| *** su_zhang has joined #openstack-keystone | 18:24 | |
| notmorgan | dimsum__: anyway.. | 18:27 |
| notmorgan | dimsum__: at least we didn't land things in ksm. | 18:27 |
| *** rderose has joined #openstack-keystone | 18:27 | |
| notmorgan | dimsum__: that would force me to bounce the revert out for now. | 18:27 |
| dimsum__ | notmorgan : ok i understand the issues now | 18:28 |
| notmorgan | dimsum__: yeah sorry, it just feels like when we have things people consider emergencies we do MASSIVE wide-sweeping changes fast | 18:28 |
| notmorgan | but the slower march towards better is ignored | 18:28 |
| notmorgan | and can't even get review time | 18:28 |
| notmorgan | because everyone is focused on features | 18:29 |
| notmorgan | so i am kindof really grumpy about this whole situation | 18:29 |
| notmorgan | making targeted fixes and addressing things vs OMG REVERT OMG OMG OMG IT IS BROKEND OMG | 18:29 |
| notmorgan | we already blacklisted the broken ksm | 18:29 |
| notmorgan | this could have been a bit more measured. | 18:30 |
| * notmorgan wont bounce the revert out of the gate, but this is getting old. | 18:30 | |
| *** rderose has quit IRC | 18:33 | |
| *** timcline has joined #openstack-keystone | 18:34 | |
| *** GB21 has quit IRC | 18:36 | |
| *** jsavak has quit IRC | 18:37 | |
| *** jsavak has joined #openstack-keystone | 18:37 | |
| dimsum__ | notmorgan : am usually on the side of the one yelled at :) | 18:39 |
| notmorgan | dimsum__: well i'm not yelling at you this time :) | 18:40 |
| dimsum__ | notmorgan : didn't say you were, just commiserating :) | 18:40 |
| notmorgan | dimsum__: yar | 18:40 |
| *** jbell8 has joined #openstack-keystone | 18:43 | |
| *** harlowja has quit IRC | 18:46 | |
| *** harlowja has joined #openstack-keystone | 18:46 | |
| dstanek | raildo: ok, i give up. i dug into the magic in sql alchemy and i don't think it's worth checking the log message | 18:47 |
| raildo | dstanek: don't give up :P | 18:48 |
| raildo | dstanek: I'll send another patch, thanks for dig into it :) | 18:49 |
| dstanek | raildo: np | 18:50 |
| *** tyagiprince1 has joined #openstack-keystone | 18:50 | |
| dstanek | third core for https://review.openstack.org/#/c/215715/ ? | 18:51 |
| *** tyagiprince has quit IRC | 18:52 | |
| *** tyagiprince1 is now known as tyagiprince | 18:52 | |
| *** e0ne has joined #openstack-keystone | 18:52 | |
| notmorgan | dstanek: let me review that | 18:55 |
| notmorgan | looking at it now | 18:55 |
| openstackgerrit | Merged openstack/keystone: Remove more ldap project references https://review.openstack.org/270530 | 18:56 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: keystonemiddleware is not a requirement https://review.openstack.org/271480 | 18:58 |
| ayoung | dimsum__, casual nick Friday? | 18:58 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 18:59 |
| *** PsionTheory has joined #openstack-keystone | 19:01 | |
| openstackgerrit | Merged openstack/keystone: Remove additional references to ldap role attribs https://review.openstack.org/270551 | 19:03 |
| dimsum__ | ayoung : y :) | 19:03 |
| notmorgan | lbragstad: ping | 19:03 |
| notmorgan | lbragstad: cache things have questions | 19:03 |
| dolphm | notmorgan: go go cache | 19:04 |
| notmorgan | dolphm: it's hard, so few people in openstack get caching. i feel lucky most of the keystoners get it. | 19:04 |
| dolphm | notmorgan: i put this demo together this morning - you should be familiar with the surprise already :) https://gist.github.com/dolph/04bd4984c7d1f34ef821 | 19:05 |
| notmorgan | dolphm: yeah the region invalidate? | 19:06 |
| dolphm | notmorgan: also, we use invalidate() wrongly in a few places | 19:06 |
| dolphm | notmorgan: yes | 19:06 |
| notmorgan | yeah | 19:06 |
| notmorgan | the non-region complete invalidate does a delete | 19:06 |
| notmorgan | but that is since you're acting on a known key | 19:06 |
| tyagiprince | Where can I find the code for creating a network and subnet? | 19:06 |
| notmorgan | the design from a standpoing that you don't know all the keys, the invalidate() a tthe region level is a cool dodge to just set an override timestamp | 19:07 |
| notmorgan | dolphm: also remember @memoize works different that region.get | 19:07 |
| dolphm | tyagiprince: looking for #openstack-neutron? | 19:07 |
| tyagiprince | sorry | 19:07 |
| notmorgan | dolphm: memoization has a lot of extra logic around cache times. | 19:07 |
| dolphm | notmorgan: oh? i'll have to look into that next | 19:08 |
| notmorgan | dolphm: yeah @memoize has all sorts of logic for check if the key is there, and ability to do async runners | 19:08 |
| notmorgan | and also ignore invalide caches while your async runner updates | 19:08 |
| notmorgan | so you only have 1 updater happening at a time | 19:09 |
| notmorgan | it also has configurable levels of fudge-factor "this is expired because i said it is, but memecache says it isn't yet" type stuff | 19:09 |
| dolphm | notmorgan: using get_or_update() or whatever in dogpile? | 19:09 |
| notmorgan | the memoization stuff is much much much more complex than the .get/set | 19:09 |
| openstackgerrit | Merged openstack/keystone: List assignments with names https://review.openstack.org/249958 | 19:10 |
| notmorgan | dolphm: yeah it's something regenerate, and it raises up an exception if regeneration is needed | 19:10 |
| openstackgerrit | Merged openstack/keystone: Mark memcache and memcache_pool token deprecated https://review.openstack.org/269229 | 19:10 |
| notmorgan | it's pretty cool to dig into | 19:10 |
| openstackgerrit | Merged openstack/keystone: Deprecate `hash_algorithm` config option https://review.openstack.org/256260 | 19:10 |
| notmorgan | dolphm: how much performance gain are we seeing with the computed_assignments stuff? | 19:10 |
| notmorgan | dolphm: i'm curious how impactfl the whole region .invalidate is | 19:11 |
| dolphm | notmorgan: 10% ish on validate | 19:11 |
| notmorgan | nice | 19:11 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: Constraint to prevent duplicate endpoints https://review.openstack.org/134095 | 19:11 |
| *** rcernin has quit IRC | 19:12 | |
| notmorgan | dolphm: so we could *probably* dodge the need to invalidate the whole region with a minor tweak to the cache_key generator. but not worth holding up the change on that | 19:13 |
| notmorgan | dolphm: but it'll require extra logic to calculate what the impact is on update. | 19:13 |
| notmorgan | dolphm: the alternative is to calculate the impacted projects for a user/domain and invalidate just that user's info rather than the whole region's | 19:14 |
| notmorgan | dolphm: also... i need to check something on the region wide invalidate... this may not work right | 19:14 |
| notmorgan | yep | 19:15 |
| notmorgan | region wide invalidate is in-memory | 19:15 |
| notmorgan | meaning other workers wont see the invalidate | 19:15 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove keystone/common/cache/_memcache_pool.py https://review.openstack.org/271485 | 19:15 |
| notmorgan | dolphm: ^ cc, this wont work across mod_wsgi/uwsgi workers | 19:15 |
| notmorgan | lbragstad: ^ | 19:16 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:16 |
| stevemar | notmorgan: i think we need a caching discussion at the midcycle :) | 19:17 |
| notmorgan | stevemar: we do | 19:17 |
| notmorgan | dolphm: https://bitbucket.org/zzzeek/dogpile.cache/src/c6913eb143b24b4a886124ff0da5c935ea34e3ac/dogpile/cache/region.py?at=master&fileviewer=file-view-default#region.py-304:347 | 19:17 |
| notmorgan | dolphm: it's an instance thing on region, not something the backend is aware of. that is something we should consider pushing a fix for up to dogpile itself. | 19:17 |
| notmorgan | dolphm: but that caching patch is a no-go | 19:17 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:17 |
| notmorgan | sorry | 19:18 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:19 |
| stevemar | bknudson: no breakfast tacos at embassy :( | 19:19 |
| bknudson | huevos rancheros? | 19:20 |
| stevemar | bknudson: they have a lovely omelette bar | 19:20 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:20 |
| stevemar | bknudson: you could get them to make your eggs a la rancheros | 19:20 |
| notmorgan | dolphm, stevemar, lbragstad: I -1/-workflowed the patch | 19:20 |
| notmorgan | dolphm, stevemar, lbragstad: i can roll up a fix that will address the issue pretty quickly | 19:21 |
| bknudson | Ei a la rancheros | 19:21 |
| bknudson | just to get another language in there | 19:21 |
| notmorgan | dolphm, stevemar, lbragstad: but we can't merge that patch. sorry =/ | 19:21 |
| stevemar | notmorgan: the middleware one, the one that is gating? | 19:23 |
| dolphm | notmorgan: bknudson: was there no way to use that memcache_pool? | 19:23 |
| notmorgan | stevemar: no the role_assignment onme | 19:23 |
| notmorgan | stevemar: i wish i could say that about the middleware one [the revert i assume you're talking about] | 19:23 |
| stevemar | notmorgan: what role assignment one? i was away for about an hour for lunch so i'm kinda behind | 19:23 |
| dolphm | because we still have keystone.common.cache.backends.memcache_pool | 19:23 |
| notmorgan | stevemar: https://review.openstack.org/#/c/215715/17 | 19:24 |
| dolphm | stevemar: i didn't know there was a way to avoid notmorgan's issue ^ | 19:25 |
| *** chmouel_ is now known as chmouel | 19:25 | |
| dolphm | and we run into it elsewhere already, like the catalog backend | 19:25 |
| stevemar | oh jeez | 19:25 |
| dolphm | distributed services, yo | 19:26 |
| bknudson | we should go back to 1 big computer | 19:27 |
| dolphm | i'm curious as to how a proxy (proxybackend?) could provide a solution! | 19:27 |
| *** jasonsb has quit IRC | 19:27 | |
| dolphm | and i know where we can buy big computer from! | 19:27 |
| bknudson | he he | 19:27 |
| *** markvoelker has quit IRC | 19:27 | |
| *** rderose has joined #openstack-keystone | 19:30 | |
| notmorgan | dolphm: i am working on spinning up a fix now. | 19:31 |
| notmorgan | dolphm: i think you'll like it. just need to figure out one detail, but it should be pretty straight forward. | 19:32 |
| *** su_zhang has quit IRC | 19:32 | |
| notmorgan | dolphm: so what happens is i will create an explicit invalidate key on the backend | 19:32 |
| notmorgan | dolphm: and the proxy, which sits in the middle of <region> [proxy] <backend> <storage> | 19:33 |
| notmorgan | dolphm: will look up that key and handle the invalidation/setting of the expired time on the tuple itself. | 19:33 |
| notmorgan | dolphm: the difference is instead of calling <region>.invalidate you'll call <region>.set(<invalidate key, now) | 19:34 |
| notmorgan | dolphm: so we create a helper function to set that value. the proxy will muck with the expires time on the stuff from the backend only in certain specific scenarios, the same way the .hard_invalidate stuff works | 19:35 |
| *** fawadkhaliq has quit IRC | 19:35 | |
| lbragstad | notmorgan just catching up now | 19:36 |
| notmorgan | so to the region the returned (<expires>, <VALUE>) will suddenly be (<expires>[modified to be expired], VALUE) which will then just work | 19:36 |
| notmorgan | as expected. | 19:36 |
| lbragstad | notmorgan are you spinning a fix to make https://review.openstack.org/#/c/215715/ work? | 19:36 |
| notmorgan | lbragstad: yes. working on building the proxy now | 19:37 |
| lbragstad | notmorgan ah - sweet | 19:37 |
| lbragstad | notmorgan thanks! | 19:37 |
| notmorgan | lbragstad: unless you want to. i mean.. i am happy to let you do it if you want to take a crack at it, but i already know how to fix it (if you read up) | 19:37 |
| lbragstad | notmorgan go for it - i'm curious to review it | 19:37 |
| notmorgan | lbragstad: i don't want to take all the glory (READ: be the only person who knows this stuff:P) | 19:37 |
| *** lhcheng has quit IRC | 19:37 | |
| lbragstad | notmorgan i want to see how you fix it - because you understand it better than i do | 19:37 |
| notmorgan | lbragstad: sounds good. give me a short bit. i need to context switch to dogpile-isms | 19:38 |
| notmorgan | and need to figure out "this one weird trick" i mean... | 19:38 |
| lbragstad | notmorgan and... it's bug friday and we need to close bugs! | 19:38 |
| *** tyagiprince has quit IRC | 19:38 | |
| notmorgan | lbragstad: eh, i'm chasing things down for some folks wrong in the gate that might result in more bugs =/ | 19:38 |
| lbragstad | \o/ | 19:39 |
| dstanek | dogpile seems to make things so much more complicated | 19:40 |
| stevemar | dstanek: lbragstad if you're looking for bug take downs, each of these have patches: https://bugs.launchpad.net/keystone/+bug/1526462 https://bugs.launchpad.net/keystone/+bug/1500631 https://bugs.launchpad.net/horizon/+bug/1017606 | 19:43 |
| openstack | Launchpad bug 1526462 in OpenStack Identity (keystone) "Need support for OpenDirectory in LDAP driver" [Medium,In progress] - Assigned to Alexander Makarov (amakarov) | 19:43 |
| openstack | Launchpad bug 1500631 in OpenStack Identity (keystone) "support multiple LDAP URIs" [Medium,In progress] - Assigned to Eric Brown (ericwb) | 19:43 |
| stevemar | and all targeting mitaka-3 :O | 19:43 |
| openstack | Launchpad bug 1017606 in OpenStack Identity (keystone) "Mixing references to 'Tenants' and 'Projects' is confusing" [Medium,In progress] - Assigned to Henrique Truta (henriquetruta) | 19:43 |
| notmorgan | dstanek: it does in some ways | 19:44 |
| dstanek | stevemar: cool, i can take a look in a minute. doing a quick test refactor that i want to get opinions on :-) | 19:44 |
| notmorgan | dstanek: but the reality is we can also propose nice changes to it. zzzeek is super awesome at accepting fixes/cleanups | 19:44 |
| notmorgan | and dogpile is still very rough around the edges | 19:45 |
| notmorgan | heck i owe zzzeek a bunch of code still :( | 19:45 |
| zzzeek | Dstanek: yeah, but testtools and pbr are just problem free :) | 19:47 |
| lbragstad | stevemar reviewed - thanks! | 19:47 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/268453 | 19:48 |
| lbragstad | stevemar https://review.openstack.org/#/c/253671/ and https://review.openstack.org/#/c/253670/ close a bug and don't have negative feedback so far | 19:48 |
| *** gordc has quit IRC | 19:48 | |
| *** rderose has quit IRC | 19:50 | |
| notmorgan | zzzeek: hehe | 19:51 |
| notmorgan | zzzeek: but to be fair... dogpile works pretty darn well. we can improve the developer experience with it and add some general cleanup... | 19:52 |
| notmorgan | zzzeek: but it still works pretty darn well | 19:52 |
| * notmorgan wishes it was easier to handle kwargs in cache-key building [i might actually have a thought on that for at least oslo.cache] | 19:53 | |
| notmorgan | zzzeek: what if we did an inspect.get_argspec (cached), alphabetize the argnames and compare the positional/passed data down with argspec and then populate defaults that aren't passed in? [sorry if that is a bad description] | 19:54 |
| notmorgan | zzzeek: i think it would mean the key generator would need to optionally be passed an argspec? | 19:55 |
| zzzeek | Notmorgan: I never really work on dogpile so it could use other co-maintainers | 19:55 |
| notmorgan | zzzeek: let me try and get my headspace clear and i'll be happy to volunteer to hel | 19:55 |
| notmorgan | p | 19:55 |
| notmorgan | zzzeek: but to be fair... it really does mostly *just work* | 19:55 |
| zzzeek | Dogpile I could almost see being a stack forge project | 19:56 |
| notmorgan | zzzeek: i was going to recommend pulling it into gerrity/CI here actually | 19:56 |
| notmorgan | zzzeek: (stackforge is gone, but it wont be an "openstack official project") | 19:56 |
| notmorgan | zzzeek: if we want to grab a few more maintainers | 19:57 |
| *** dims has joined #openstack-keystone | 19:57 | |
| notmorgan | zzzeek: but i can work with bitbucket too if you'd rather keep it there. | 19:57 |
| *** dimsum__ has quit IRC | 19:57 | |
| zzzeek | Stack forge is gone, where did pecan and sqlalchemy-migrate go? | 19:57 |
| notmorgan | zzzeek: everything is in the openstack namespace now | 19:58 |
| dhellmann | zzzeek : openstack/sqlalchemey-migrate and back to github for pecan: https://github.com/pecan | 19:58 |
| zzzeek | I don't like bitbucket either but alternatives for issue tracking aren't great | 19:58 |
| anteaya | lbragstad: is madorn a keystone contributor? | 19:59 |
| notmorgan | just if it isn't in the governance .yaml it isn't an official project | 19:59 |
| anteaya | lbragstad: he dropped me a pm and isn't replying | 19:59 |
| notmorgan | anteaya: who is madorn? | 19:59 |
| notmorgan | name doesn't look familiar to me | 20:00 |
| anteaya | notmorgan: the person who alerted infra to a sandbox permission issue the other day | 20:00 |
| notmorgan | oh | 20:00 |
| anteaya | and lbragstad joined in the conversation | 20:00 |
| anteaya | yeah he isn't in channel, so trying to understand the connection | 20:00 |
| notmorgan | zzzeek: agreed. the issue trackers out there kindof suck | 20:00 |
| anteaya | he asked something of me and disappeared now I am trying to confirm | 20:00 |
| dstanek | anteaya: he's racker that does training (i think) | 20:00 |
| lbragstad | anteaya madorn is an openstack/keystone constributor at rackspace | 20:01 |
| lbragstad | contributor* | 20:01 |
| notmorgan | zzzeek: i have a couple things on github... and i loathe PRs but the issue tracker is integrated so it's nicer than <point at thing over there and hope someone looks> | 20:01 |
| anteaya | dstanek: can you ask him to reply to my response to his pm to me? | 20:01 |
| anteaya | lbragstad: ^^ | 20:01 |
| dstanek | lbragstad: is he a contributor? | 20:01 |
| zzzeek | Dhellmann notmorgan what are the options for outside projects to be ok for openstack devs to get company credit ? Don't need to host anywhere special anymore ? | 20:01 |
| lbragstad | dstanek I think he does contributions through training other openstack contributors | 20:01 |
| notmorgan | zzzeek: not sure what you're asking | 20:02 |
| anteaya | can you ask him to answer my question? | 20:02 |
| dstanek | lbragstad: yes, i can see that. i thought you meant code | 20:02 |
| dstanek | anteaya: sure | 20:02 |
| anteaya | I'm trying to help him but I would like him to confirm | 20:02 |
| zzzeek | Eg can I add sqlalchemy to a list somewhere and people can finally get paid to submit patches by their employers | 20:02 |
| anteaya | dstanek: thanks | 20:02 |
| *** raildo is now known as raildo-afk | 20:02 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Get revocation list with only audit ids https://review.openstack.org/260196 | 20:02 |
| notmorgan | zzzeek: ah, afaik it needs to be hosted in our gerrit/ci for openstack stuff. and for things like openstack ATC credit it would need to be an official openstack project (petition to the TC) | 20:03 |
| notmorgan | zzzeek: but just hosting it in openstack gerrit/ci means it is a bit easier for openstack devs to contribute.. it might be a bit harder for non-openstack folks to. | 20:04 |
| ryanpetrello | zzzeek yep, I moved pecan back to GH and Travis-CI awhile ago | 20:04 |
| notmorgan | zzzeek: CLA is not required for non-openstack projects iirc and the gate jobs can be isolated to their own queue so they don't get wedged when things backup due to dsvm things | 20:05 |
| notmorgan | zzzeek: but travis and GH is also pretty darn good [been using it for my small library] | 20:05 |
| notmorgan | i just loathe pull requests compared to gerrit if the team is more than ~4-5 people | 20:05 |
| bknudson | http://gerrithub.io/ | 20:06 |
| *** roxanagh_ has quit IRC | 20:06 | |
| bknudson | https://reviewable.io/ | 20:07 |
| notmorgan | bknudson: yeah | 20:07 |
| *** e0ne has quit IRC | 20:08 | |
| notmorgan | not sure i like gerrithub... but that's something aside | 20:08 |
| * notmorgan goes back to cache code. | 20:09 | |
| *** su_zhang has joined #openstack-keystone | 20:14 | |
| *** pcaruana has quit IRC | 20:14 | |
| *** tonytan4ever has quit IRC | 20:17 | |
| zzzeek | notmorgan: i dig gerrit just not launchpad | 20:18 |
| *** su_zhang has quit IRC | 20:19 | |
| notmorgan | zzzeek: yeah. for dogpile it might be "ok"-ish. but SQL-A has enough traffic it would be painful to move | 20:19 |
| notmorgan | zzzeek: like i said, happy to volunteer to help maintain dogpile either moving it or keeping it in bitbucket | 20:20 |
| zzzeek | notmorgan: i remain curiosu about phabricator | 20:20 |
| notmorgan | zzzeek: it should be a thing i hear | 20:22 |
| notmorgan | sooooonish | 20:22 |
| *** e0ne has joined #openstack-keystone | 20:24 | |
| *** timcline has quit IRC | 20:25 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactors validation tests to better see the cases https://review.openstack.org/271515 | 20:27 |
| *** jasonsb has joined #openstack-keystone | 20:27 | |
| dstanek | lbragstad: you around? | 20:27 |
| *** timcline has joined #openstack-keystone | 20:28 | |
| *** pnavarro has joined #openstack-keystone | 20:32 | |
| *** lhcheng_ has joined #openstack-keystone | 20:37 | |
| openstackgerrit | ayoung proposed openstack/keystone: Check for circular references when expanding implied roles https://review.openstack.org/271134 | 20:44 |
| *** rdo has quit IRC | 20:44 | |
| *** Guest42984 has quit IRC | 20:45 | |
| *** rdo has joined #openstack-keystone | 20:46 | |
| ayoung | henrynash, if you +2 https://review.openstack.org/#/c/271134/ and stevemar can affirm his with the logging change, we're a go to work on API on top of this | 20:46 |
| henrynash | ayoung: looking at it right now | 20:47 |
| lhcheng_ | ayoung: added one minor comment, up to you if want to fix it. | 20:48 |
| ayoung | yes it can | 20:49 |
| henrynash | ayoung: gerrit seems a lot less reliable now….seems to be unavailable at the drop of a hat | 20:50 |
| openstackgerrit | ayoung proposed openstack/keystone: Check for circular references when expanding implied roles https://review.openstack.org/271134 | 20:50 |
| ayoung | lhcheng_, I fixed that right in the browser...lets see if it works | 20:50 |
| lhcheng_ | ayoung: it works! thanks | 20:51 |
| lbragstad | dstanek yep | 20:52 |
| lbragstad | dstanek what's up? | 20:52 |
| henrynash | ayoung: can’t seem to get to gerrit right now…it looked good from what I say, only nit I was going to add was on you log message you refeence next_ref[], whereas it’s technical cleaner if you refernce next_role_id (in case we every change the algorithm of where the next role id came from)…..but I’d _+2 it even with that | 20:54 |
| ayoung | henrynash, nah, it has to be the ref, it is more than just the role id | 20:54 |
| ayoung | we want to get two different entries if the same role has two different priors | 20:54 |
| ayoung | oh...on the log message...yeah, but if that changes...meh | 20:55 |
| ayoung | henrynash, so I can treat it as a +2 from you if gerrit ever comes back? | 20:55 |
| henrynash | ayoung: i know, super nit…already +2’d it | 20:55 |
| ayoung | ah./..there is it | 20:56 |
| *** tonytan4ever has joined #openstack-keystone | 20:56 | |
| ayoung | we holding off on workflow for any reason? | 20:56 |
| *** tsymanczyk has joined #openstack-keystone | 20:57 | |
| henrynash | ayoung: no…only that you said Steve was gonna do it…oh, isse Lin had alrady added +2….fine for +A | 20:57 |
| ayoung | w00t | 20:57 |
| *** tsymanczyk is now known as Guest70015 | 20:57 | |
| lhcheng_ | ship it | 20:57 |
| *** pauloewerton has quit IRC | 20:58 | |
| *** e0ne has quit IRC | 20:58 | |
| lbragstad | ajayaa around? | 21:01 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Ensure pycadf initiator IDs are UUID https://review.openstack.org/252182 | 21:03 |
| ayoung | henrynash, I'm working out the merge conflict for API changes. | 21:03 |
| ayoung | my goal here is to do full press on API until it gets in, then play reviewer for the DSR changes | 21:04 |
| henrynash | ayoung: ok, I’’ll rebase once you’re done with that | 21:04 |
| *** jsavak has quit IRC | 21:04 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 21:05 |
| stevemar | lbragstad: probably not around, whats up? | 21:05 |
| lbragstad | ajayaa I apologize for miss-spelling stevemar in the comment - i pushed a new fix | 21:05 |
| stevemar | lbragstad: :) | 21:05 |
| ayoung | henrynash, and that is rebased on the cycle change, so we should have one straight branch for all these | 21:05 |
| lbragstad | stevemar totally agree on the hacking checks | 21:05 |
| stevemar | dstanek: https://review.openstack.org/#/c/252182/ should be ready to go if you want to squash another bug :) | 21:06 |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactors validation tests to better see the cases https://review.openstack.org/271515 | 21:07 |
| *** jsavak has joined #openstack-keystone | 21:07 | |
| dstanek | lbragstad: ^ i did that so i could test dchen's patch | 21:07 |
| dstanek | stevemar: so question about that. | 21:09 |
| openstackgerrit | henry-nash proposed openstack/keystone: Change project unique constraint https://review.openstack.org/158372 | 21:09 |
| dstanek | does that make is hard to correlate IDs from the audit system back to things in keystone? | 21:09 |
| stevemar | dstanek: whaddup | 21:09 |
| stevemar | potentially, yes but the audit should still have a "user_id" field | 21:10 |
| stevemar | the "initiator" object will have a "user_id" field | 21:10 |
| stevemar | in the case where user_id is not a uuid | 21:10 |
| stevemar | the spec for cadf says any ID fields must be UUID, so we can't go against the spec :( | 21:11 |
| dstanek | i'm just wondering if it cases a problem because not there isn't a way to lookup what a resource actually is | 21:11 |
| stevemar | dstanek: we could add user_domain_id and user_name | 21:14 |
| notmorgan | stevemar, lbragstad, dolphm, dstanek: almost done. pushing the change up now and will then work on some tests. | 21:15 |
| *** jasonsb has quit IRC | 21:15 | |
| stevemar | dstanek: the way the multi-domain IDs work now, they are essentially useless anyway, sadly | 21:15 |
| stevemar | if i have an ldap configured backend, my userid is pretty much a garbage value | 21:16 |
| stevemar | it is the initial user_id, then hashed, so looking it up is equally hard | 21:16 |
| dstanek | stevemar: made a comment about i18n the error string. do we need to do that? | 21:17 |
| *** pnavarro has quit IRC | 21:18 | |
| openstackgerrit | Merged openstack/keystone: deprecate write support for identity LDAP https://review.openstack.org/256257 | 21:18 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 21:21 |
| *** rderose has joined #openstack-keystone | 21:22 | |
| *** su_zhang has joined #openstack-keystone | 21:24 | |
| *** su_zhang has quit IRC | 21:26 | |
| *** su_zhang has joined #openstack-keystone | 21:26 | |
| *** tsymancz1k has joined #openstack-keystone | 21:27 | |
| *** rderose has quit IRC | 21:29 | |
| *** Guest70015 has quit IRC | 21:30 | |
| *** tsymancz1k has quit IRC | 21:32 | |
| dolphm | \o/ pci compliance, yay \o/ | 21:33 |
| *** pnavarro has joined #openstack-keystone | 21:37 | |
| *** markvoelker has joined #openstack-keystone | 21:40 | |
| *** markvoelker has quit IRC | 21:40 | |
| *** markvoelker has joined #openstack-keystone | 21:41 | |
| stevemar | looks like most of the bits i wanted in for mitaka-2 have merged | 21:44 |
| stevemar | yay | 21:44 |
| *** pcaruana has joined #openstack-keystone | 21:48 | |
| lbragstad | anyone want to review a fix for trusts?! https://review.openstack.org/#/c/269824/ | 21:49 |
| *** doug-fish has quit IRC | 21:49 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 21:52 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Apply invalidation proxy to the catalog cache region https://review.openstack.org/271536 | 21:52 |
| notmorgan | lbragstad: ^ | 21:52 |
| notmorgan | needs some unit tests | 21:52 |
| notmorgan | but that *should* solve the issue of "distributed things" | 21:52 |
| *** chris_19 has joined #openstack-keystone | 21:52 | |
| *** rcernin has joined #openstack-keystone | 21:53 | |
| notmorgan | dolphm: ^ cc, stevemar ^ | 21:53 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 21:55 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Apply invalidation proxy to the catalog cache region https://review.openstack.org/271536 | 21:55 |
| openstackgerrit | henry-nash proposed openstack/keystone: Allow project domain_id to be nullable at the manager level https://review.openstack.org/264533 | 21:55 |
| notmorgan | whoopse, missed something | 21:55 |
| notmorgan | needed an @property in there | 21:55 |
| *** timcline has quit IRC | 21:58 | |
| *** tsymanczyk has joined #openstack-keystone | 22:01 | |
| *** gordc has joined #openstack-keystone | 22:01 | |
| *** tsymanczyk is now known as Guest79095 | 22:01 | |
| *** peter-hamilton has quit IRC | 22:02 | |
| *** jsavak has quit IRC | 22:04 | |
| *** pnavarro has quit IRC | 22:04 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 22:09 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 22:09 |
| *** ninag has quit IRC | 22:14 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Allow project domain_id to be nullable at the manager level https://review.openstack.org/264533 | 22:19 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add tests for role management with v3policy file https://review.openstack.org/261846 | 22:21 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add CRUD support for domain specific roles https://review.openstack.org/261870 | 22:22 |
| *** RichardRaseley has joined #openstack-keystone | 22:22 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules in the v3 policy sample for domain specifc roles https://review.openstack.org/262078 | 22:22 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify implied roles to honor domain specific roles https://review.openstack.org/263064 | 22:25 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules for domain specific role assignments https://review.openstack.org/263549 | 22:25 |
| *** chris_19 has left #openstack-keystone | 22:28 | |
| stevemar | haneef_: rebase-a-mania | 22:28 |
| stevemar | henrynash, not haneef_ :( | 22:29 |
| henrynash | stevemar: ’tis me….and ’tis true! | 22:29 |
| stevemar | henrynash: which hotel you at next week? | 22:29 |
| henrynash | stevemar: I think I might be in the Marriot….but no matter, will still join you guys for breakfast! | 22:30 |
| *** markvoelker has quit IRC | 22:32 | |
| stevemar | henrynash: we get free breaky! | 22:34 |
| notmorgan | stevemar: which hotel are you at? | 22:34 |
| henrynash | steevmar: I think I do too….since I’m now “life time gold” for marriot…this sounded good until I realized that you only get that if you have staryed 2 years of your life in Marriotts…….. | 22:35 |
| stevemar | lol | 22:36 |
| stevemar | the downside of gold eh | 22:36 |
| *** gordc has quit IRC | 22:37 | |
| stevemar | gonna go for a run, gotta keep my new years reso ongoing :] | 22:37 |
| *** PsionTheory has quit IRC | 22:38 | |
| *** jbell8 has quit IRC | 22:52 | |
| *** rcernin has quit IRC | 22:53 | |
| *** dims_ has joined #openstack-keystone | 22:56 | |
| *** dims has quit IRC | 22:58 | |
| *** diazjf has quit IRC | 22:58 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:00 | |
| *** sdake has joined #openstack-keystone | 23:00 | |
| *** sdake has quit IRC | 23:01 | |
| edmondsw | henrynash, what does "dsr" stand for? | 23:03 |
| henrynash | edmondsw: domain specific roles | 23:03 |
| edmondsw | gotcha, tx | 23:04 |
| edmondsw | why would we want to let a project admin see domain roles? | 23:05 |
| edmondsw | henrynash ^ | 23:05 |
| henrynash | hold on... | 23:06 |
| henrynash | brb | 23:06 |
| edmondsw | sure | 23:06 |
| henrynash | edmondsw: so domain admin roles are created bya domain admin for use by them and project admins wiithi their domain (only) | 23:11 |
| henrynash | edmondsw: since project admins can read global roles, it seems right that they should be able to read domain roles for their own domain | 23:12 |
| edmondsw | why should they be able to read global roles either? | 23:12 |
| henrynash | edmondsw: how would they know which roles they could assign to their projects? | 23:13 |
| *** dims_ has quit IRC | 23:13 | |
| edmondsw | oh, I'm an idiot... I was thinking of role *assignments* not roles... | 23:14 |
| edmondsw | too late on a Friday (especially for you) | 23:15 |
| *** jamielennox is now known as jamielennox|away | 23:15 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Allow project domain_id to be nullable at the manager level https://review.openstack.org/264533 | 23:16 |
| henrynash | edmondsw: no worries! | 23:16 |
| openstackgerrit | henry-nash proposed openstack/keystone: Change project unique constraint https://review.openstack.org/158372 | 23:17 |
| openstackgerrit | henry-nash proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 23:18 |
| *** rbak has quit IRC | 23:26 | |
| *** roxanagh_ has joined #openstack-keystone | 23:30 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 23:32 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Apply invalidation proxy to the catalog cache region https://review.openstack.org/271536 | 23:32 |
| *** bill_az has quit IRC | 23:34 | |
| *** tonytan4ever has quit IRC | 23:35 | |
| *** slberger has left #openstack-keystone | 23:39 | |
| *** edmondsw has quit IRC | 23:41 | |
| *** simondodsley has quit IRC | 23:48 | |
| *** Ephur has quit IRC | 23:54 | |
| *** edmondsw has joined #openstack-keystone | 23:54 | |
| *** dims has joined #openstack-keystone | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
