| *** iurygregory has quit IRC | 00:03 | |
| *** iurygregory has joined #openstack-keystone | 00:05 | |
| *** r-daneel has quit IRC | 00:08 | |
| *** chlong has quit IRC | 00:20 | |
| *** shoutm_ has joined #openstack-keystone | 00:20 | |
| *** chlong has joined #openstack-keystone | 00:20 | |
| *** shoutm has quit IRC | 00:23 | |
| *** EinstCrazy has quit IRC | 00:25 | |
| *** su_zhang has joined #openstack-keystone | 00:27 | |
| *** gildub has quit IRC | 00:31 | |
| *** su_zhang has quit IRC | 00:32 | |
| *** zqfan has joined #openstack-keystone | 00:34 | |
| *** su_zhang has joined #openstack-keystone | 00:36 | |
| mgagne | notmorgan thinking about not having regional nodes and instead pay the latency tax "once" and also make all keystonemiddleware cache to the same regional memcached server so all services can benefit from it. | 00:39 |
|---|---|---|
| *** oomichi has joined #openstack-keystone | 00:40 | |
| mgagne | notmorgan removing ping (SELECT 1) and ROLLBACK (I gained ~36% performance) but it's clearly not recommended by sqlalchemy manual | 00:40 |
| *** chlong has quit IRC | 00:41 | |
| notmorgan | That will break a lot of things if the connection drops | 00:41 |
| mgagne | of course | 00:41 |
| notmorgan | Solvable but we need to rework the whole connection thing. | 00:41 |
| mgagne | was more or less trying to see the actual cost of those requests on the overall process | 00:41 |
| *** chlong has joined #openstack-keystone | 00:41 | |
| mgagne | I figured that one out =) | 00:42 |
| *** david-lyle has joined #openstack-keystone | 00:42 | |
| openstackgerrit | Merged openstack/keystone: Ensure pycadf initiator IDs are UUID https://review.openstack.org/252182 | 00:43 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 00:45 |
| *** shoutm has joined #openstack-keystone | 00:47 | |
| *** chlong has quit IRC | 00:48 | |
| *** chlong has joined #openstack-keystone | 00:49 | |
| *** shoutm_ has quit IRC | 00:50 | |
| *** chlong has quit IRC | 00:53 | |
| *** chlong has joined #openstack-keystone | 00:53 | |
| *** pgbridge_ has joined #openstack-keystone | 00:57 | |
| *** ngupta has quit IRC | 01:00 | |
| *** ngupta has joined #openstack-keystone | 01:01 | |
| *** pgbridge has quit IRC | 01:01 | |
| *** shoutm has quit IRC | 01:02 | |
| *** shoutm has joined #openstack-keystone | 01:04 | |
| *** iurygregory has quit IRC | 01:07 | |
| *** iurygregory has joined #openstack-keystone | 01:11 | |
| *** kk has joined #openstack-keystone | 01:14 | |
| kk | i am trying to access swift using keystone. It was working just fine. but now suddenly, when i type keystone tenant-list or user-list or endpoint list, anything.. it shows expecting an endpoint provided by --os-endpoint or env variable | 01:16 |
| kk | how can i resolve this issue. help! | 01:16 |
| *** davechen has joined #openstack-keystone | 01:17 | |
| *** roxanaghe has quit IRC | 01:17 | |
| *** _cjones_ has quit IRC | 01:18 | |
| *** _cjones_ has joined #openstack-keystone | 01:19 | |
| *** gildub has joined #openstack-keystone | 01:23 | |
| notmorgan | kk: first off, the keystone CLI is deprecated and we highly recommend moving to openstackclient (common client) | 01:23 |
| *** _cjones_ has quit IRC | 01:23 | |
| notmorgan | kk: not sure why you're getting that error, did you just update some packages? | 01:24 |
| kk | no. i didn't update any package | 01:32 |
| kk | @notmorgan | 01:32 |
| *** EinstCrazy has joined #openstack-keystone | 01:33 | |
| *** r-daneel has joined #openstack-keystone | 01:39 | |
| *** r-daneel has quit IRC | 01:39 | |
| *** kk has quit IRC | 01:48 | |
| *** gildub has quit IRC | 01:50 | |
| *** chlong has quit IRC | 01:55 | |
| *** chlong has joined #openstack-keystone | 01:55 | |
| ayoung | Can someone please just +2A the RoleAPI and we'll deal with bugs if it happens to be wrong? Please? | 01:58 |
| ayoung | https://review.openstack.org/#/c/242614/ | 01:58 |
| *** EinstCrazy has quit IRC | 01:58 | |
| *** jsavak has joined #openstack-keystone | 02:03 | |
| *** david-lyle has quit IRC | 02:05 | |
| *** su_zhang has quit IRC | 02:07 | |
| ayoung | seriously, its not that hard | 02:08 |
| *** EinstCrazy has joined #openstack-keystone | 02:10 | |
| ayoung | gyee, jamielennox https://review.openstack.org/#/c/242614/ please. | 02:14 |
| *** shoutm has quit IRC | 02:14 | |
| ayoung | BTW, totally going on tour next summer's midcycle http://bostinno.streetwise.co/2016/01/22/new-england-craft-breweries-map-of-every-massachusetts-brewery/ | 02:18 |
| ayoung | mgagne, revocations need to go away. | 02:19 |
| mgagne | ayoung could I get more context? :D | 02:19 |
| ayoung | Our system is dumb. We should not force users to go to Keystone first | 02:19 |
| ayoung | Just go directly to Nova with userid and password | 02:19 |
| ayoung | it is no safer, and maybe a little less safe, to send the password to Keystone then to Nova | 02:20 |
| mgagne | ayoung how is this related to revocation? | 02:20 |
| ayoung | mgagne, because if we did that we would never revoke | 02:20 |
| ayoung | tokens are a mix of authenticatio0n and authorization | 02:20 |
| ayoung | as such they are not good at either | 02:21 |
| ayoung | if we authenticated directly to Nova, then nova could look up the roles for the users, we'd know they were current | 02:21 |
| mgagne | ayoung so I remove a role from a user, how is the token invalidated? | 02:21 |
| *** shoutm has joined #openstack-keystone | 02:21 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:21 | |
| ayoung | mgagne, in my world, there are no tokens | 02:21 |
| ayoung | you remove a role from a user, next time that user goes to Nova, the operations associated with that role fail | 02:21 |
| mgagne | ayoung is there latency in your world? =) | 02:22 |
| ayoung | mgagne, no more or no less than there is now | 02:22 |
| ayoung | if you cache, you increase latency | 02:22 |
| mgagne | ayoung and much is there in yours? | 02:22 |
| ayoung | mgagne, the reason we have Keystone is so we don't copy passwords around. Password suck | 02:23 |
| ayoung | so if you really care about secuirty, you use a real crypto authenitcation mechanism | 02:23 |
| ayoung | the best option there is client certs | 02:23 |
| ayoung | second is Kerberos | 02:23 |
| ayoung | I;'ve been saying this for years | 02:23 |
| ayoung | I'm like the wild hermit in the Life of Brian | 02:23 |
| mgagne | I'm not sure I'm ready to go down that path tonight. | 02:23 |
| ayoung | mgagne, its better than us continuing to expand the mess that is revocations | 02:24 |
| ayoung | right now, we revoke on too many events | 02:24 |
| mgagne | as an operator, I'm not much interested in the next feature or what could be so much better than now. I'm looking to make stuff work now (like this week) | 02:24 |
| ayoung | mgagne, OK, what kind of tokens are you using? | 02:24 |
| mgagne | we are currently using PKI, trying to move to fernet now | 02:25 |
| ayoung | mgagne, OK, so with Fernet, we need revocation events, because tokens are not persisted | 02:25 |
| ayoung | if you move to UUID, tokens are persisted, so to revoke a token, you just erase it from the backing store | 02:25 |
| ayoung | most of the revocation stuff was written with PKI in mind. It was meant to happen out of tree | 02:26 |
| mgagne | we don't have much writes in the keystone database: not much role assignment changes, only creation of new accounts | 02:26 |
| ayoung | but then Fernet happend | 02:26 |
| *** davechen1 has joined #openstack-keystone | 02:26 | |
| *** shoutm has quit IRC | 02:26 | |
| ayoung | so, we have an effort underway, lead by lbragstad, to clean things up: | 02:26 |
| *** davechen has quit IRC | 02:26 | |
| *** shoutm has joined #openstack-keystone | 02:27 | |
| ayoung | the big thing is that, for revocation events, we can drop revoke by, say , project or domain disable | 02:27 |
| ayoung | with fernet, we will verify the domain at token validation time, so we don;'t need to record that | 02:27 |
| ayoung | but...sincee we need to make this all work wityh uuid tokens, we need to make sure the logic is sound not only for fernet but for uud | 02:28 |
| ayoung | uuid | 02:28 |
| ayoung | so, from your perspective as an operation, it means that you should have fewer syncs based on token revocations, but it will be essential to make sure that project disable etc are in sync across geographies | 02:29 |
| mgagne | our plan is to have one centralized database which might be replicated or not. | 02:29 |
| mgagne | challenge is how to make it so 100ms latency doesn't show too much | 02:30 |
| *** EinstCrazy has quit IRC | 02:30 | |
| *** davechen3 has joined #openstack-keystone | 02:30 | |
| *** EinstCrazy has joined #openstack-keystone | 02:31 | |
| *** davechen1 has quit IRC | 02:31 | |
| mgagne | our draft of possible solutions which don't imply implementation new code (or little): https://gist.github.com/mgagne/6061dccbb3d2419204b8 | 02:32 |
| mgagne | problem is that we don't have time budget for 3) (galera cluster) | 02:34 |
| mgagne | so we might end up with 2) Lot of cache in keystonemiddleware and keep centralized keystone service. | 02:35 |
| ayoung | mgagne, with fernet, the tax will be paid twice minimum | 02:35 |
| *** wanghua has joined #openstack-keystone | 02:35 | |
| mgagne | ayoung which use case? | 02:35 |
| ayoung | once per user getting a token, then once per service validating the token | 02:35 |
| mgagne | ayoung no | 02:35 |
| ayoung | so on a openstack server create | 02:35 |
| *** richm has quit IRC | 02:35 | |
| mgagne | ayoung the user gets its token at the centralized service | 02:35 |
| ayoung | ok | 02:35 |
| mgagne | which he is already doing anyway | 02:36 |
| ayoung | check | 02:36 |
| ayoung | so are Nova and glance going to share a cache? | 02:36 |
| mgagne | yes | 02:36 |
| mgagne | Glance is per region | 02:36 |
| mgagne | plan is to hook keystonemiddleware to the same memcached server and share the cache | 02:37 |
| *** fawadkhaliq has quit IRC | 02:38 | |
| mgagne | regional services are all located in the same facility | 02:38 |
| ayoung | mgagne, makes sense. | 02:38 |
| ayoung | so then the question is, how long to let a token stay in cache | 02:38 |
| mgagne | we tried regional keystone nodes with centralized database, we are paying the latency tax for each queries and there is a lot so yea =( | 02:38 |
| ayoung | there are 2 use cases | 02:38 |
| ayoung | 1 is CLI, which is, essentially one token per call | 02:38 |
| ayoung | the other is horizon, which is one long lived token for all calls | 02:39 |
| ayoung | and horizon doesn't know if a token has been revoked | 02:39 |
| ayoung | are you even using horizon or a horizon like service? | 02:39 |
| mgagne | it's hooked to the centralized keystone | 02:40 |
| mgagne | we don't have horizon in our regions, it's a global service | 02:40 |
| *** davechen3 is now known as davechen | 02:40 | |
| mgagne | global = in that one central region with more management nodes | 02:40 |
| ayoung | mgagne, so, you probaly want horizon validating tokens before sending them out. Otherwise, what I say stands | 02:41 |
| mgagne | how can this be done? | 02:41 |
| ayoung | I don't know. I don't think it can be done without code changes | 02:41 |
| ayoung | I'm just thinking it through | 02:41 |
| ayoung | mgagne, lets assume that it can't be done easily.... | 02:41 |
| ayoung | so a user goes to central horizon, gets a token. This token has a long life | 02:41 |
| ayoung | we set it to an hour, buyt m,any sites had to up that to deal with long running tasks | 02:42 |
| ayoung | so, say 12 hours | 02:42 |
| ayoung | or 8 or whatever | 02:42 |
| ayoung | I think you would want to make the cache timeout match the horizon session cache. | 02:42 |
| mgagne | does ksmiddleware know about token expiration? | 02:42 |
| ayoung | so if your sessions are 10 minutes, make the memcache timeout be 10 minues | 02:42 |
| mgagne | can't it cache it to no more than expiration time when possible? | 02:43 |
| ayoung | mgagne, nahm, it relies on Keystone to validate that,except for PKI | 02:43 |
| ayoung | with fernet, you might want to think about validating locally. | 02:43 |
| mgagne | 1st time, it will validate with keystone, aren't metadata about token returned? if so, why not use it to adjust TTL related to expiration time? | 02:44 |
| mgagne | how can you validate locally? | 02:44 |
| ayoung | mgagne, usually the TTL is much longer than cache timeout | 02:44 |
| ayoung | would you really want an 8 hour cache timeout? | 02:44 |
| mgagne | "usually" is a synonym of assumption and bugs =) | 02:44 |
| mgagne | ayoung lets say I put 1h. TTL==token lifetime | 02:45 |
| ayoung | mgagne, believe me, if we could make the timeout 4 minutes I'd be ecstatic | 02:45 |
| ayoung | mgagne, why> | 02:45 |
| ayoung | ? | 02:45 |
| ayoung | it means you never want to check that a token is revoked | 02:45 |
| ayoung | tokens never get extended | 02:45 |
| mgagne | the guy runs around, doing nothing with his token. he then comes to our API after 40m and ask stuff. we cache it for 1h. what now? will ksmiddleware cache it for 1h? | 02:46 |
| ayoung | I'd say 10 minutes is the longest I'd recommend, and probably too long at that. Make it 5 | 02:46 |
| ayoung | He has a slightly longer response time on his first call to Nova cuz his token is flushed from cache | 02:46 |
| ayoung | he won't notice it | 02:46 |
| ayoung | 5 minutes | 02:46 |
| ayoung | that is network clock sync slop allowance anyway | 02:47 |
| mgagne | so cache is not aware of revocation events nor token TTL. | 02:47 |
| ayoung | mgagne, that is correct | 02:47 |
| mgagne | I see room for improvement =) | 02:47 |
| ayoung | mgagne, with PKI, revokcation list was checked in process. BUt Fernet or UUID you need to go back to Keystone server to validate | 02:48 |
| *** jasonsb has joined #openstack-keystone | 02:48 | |
| *** chlong has quit IRC | 02:49 | |
| mgagne | I see _check_revocations_for_cached. is this what you are referring to? | 02:49 |
| *** chlong has joined #openstack-keystone | 02:49 | |
| *** davechen1 has joined #openstack-keystone | 02:51 | |
| *** davechen2 has joined #openstack-keystone | 02:52 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 02:53 |
| *** davechen has quit IRC | 02:54 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:54 | |
| *** davechen2 is now known as davechen | 02:54 | |
| *** lhcheng has quit IRC | 02:55 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 02:55 |
| *** davechen1 has quit IRC | 02:56 | |
| ayoung | mgagne, yeah, but remember, there are two thingss: revocation list, designed to be read from a remote proces, and revoatione events. These are checked in keystone server only | 02:56 |
| *** daemontool has quit IRC | 02:56 | |
| mgagne | list was for PKI which isn't a thing anymore | 02:56 |
| mgagne | right? | 02:56 |
| mgagne | and event is for internal stuff? | 02:57 |
| *** EinstCrazy has quit IRC | 02:59 | |
| *** EinstCrazy has joined #openstack-keystone | 03:00 | |
| mgagne | 10pm, I have to go, we can talk more tomorrow, thanks for your help! | 03:02 |
| *** lhcheng has joined #openstack-keystone | 03:06 | |
| *** ChanServ sets mode: +v lhcheng | 03:06 | |
| *** jsavak has quit IRC | 03:06 | |
| *** gildub has joined #openstack-keystone | 03:09 | |
| *** lhcheng has quit IRC | 03:11 | |
| *** browne has quit IRC | 03:15 | |
| *** bill_az has quit IRC | 03:16 | |
| *** chlong has quit IRC | 03:17 | |
| *** chlong has joined #openstack-keystone | 03:18 | |
| *** chlong has quit IRC | 03:19 | |
| *** chlong has joined #openstack-keystone | 03:20 | |
| *** david-lyle has joined #openstack-keystone | 03:25 | |
| openstackgerrit | Merged openstack/keystone: Refactor test auth_plugin config into fixture https://review.openstack.org/266396 | 03:26 |
| *** woodster_ has quit IRC | 03:26 | |
| *** spandhe has quit IRC | 03:29 | |
| *** henrynash has quit IRC | 03:29 | |
| *** henrynash has joined #openstack-keystone | 03:29 | |
| *** ChanServ sets mode: +v henrynash | 03:29 | |
| *** ccard__ has joined #openstack-keystone | 03:31 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 03:33 |
| *** ccard_ has quit IRC | 03:34 | |
| *** iurygregory has quit IRC | 03:41 | |
| notmorgan | ayoung: hey, sorry just got back can look at the api thing | 03:41 |
| ayoung | notmorgan, thanks, please do. | 03:42 |
| ayoung | notmorgan, I hate to be a noodfe | 03:42 |
| ayoung | noodge | 03:42 |
| ayoung | actually, that is a lie, I really don;t mind it | 03:42 |
| notmorgan | ayoung: eh. i've been roped back into server things | 03:42 |
| ayoung | but it is i the only way on these more complex patches to make things move | 03:42 |
| notmorgan | unforuntately | 03:42 |
| notmorgan | so meh | 03:42 |
| ayoung | this one is making progress | 03:42 |
| *** iurygregory has joined #openstack-keystone | 03:43 | |
| notmorgan | ayoung: you may want to look at https://review.openstack.org/#/c/272007/ | 03:43 |
| notmorgan | ayoung: it's that whole "don't ask for things from the backends more tha once" thing | 03:44 |
| notmorgan | so for a request we will only ever hit the backend/memcache once for .get_domain(<id>) for example | 03:44 |
| notmorgan | ayoung: looking for general feedback on it | 03:44 |
| ayoung | notmorgan, is this a dogpile replacement? | 03:45 |
| notmorgan | no it hooks into dogpile | 03:45 |
| ayoung | OK... | 03:45 |
| notmorgan | so we stash anything we lookup in the request context effectively | 03:45 |
| notmorgan | it's a 2nd cache tier in process that is request specific | 03:45 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add tests in preparation of projects acting as a domain https://review.openstack.org/272369 | 03:45 |
| notmorgan | so duplicated calls don't have to socket()->memcache()->deserialize() | 03:45 |
| notmorgan | it just does the deserialize step | 03:46 |
| notmorgan | and btw, the hardest part was serializing/deserilaizing the RevokeTree | 03:46 |
| notmorgan | :P | 03:46 |
| openstackgerrit | henry-nash proposed openstack/keystone: Removes project.domain_id FK https://review.openstack.org/233274 | 03:46 |
| notmorgan | if that goes a way i can save ~50 microseconds per deserialize :P ok... not worth it :P | 03:46 |
| notmorgan | ayoung: this one? | 03:47 |
| notmorgan | https://review.openstack.org/#/c/242614/ | 03:47 |
| ayoung | notmorgan, that should not have been hard to serialize. I went through that process way back when. But thanks | 03:48 |
| ayoung | that tree needs a lumberjack | 03:48 |
| notmorgan | it is. JSON thinks it has circular references | 03:48 |
| ayoung | Joy | 03:48 |
| notmorgan | so i used msgpack | 03:48 |
| ayoung | rapture | 03:48 |
| notmorgan | and created a serializer that just dumps .revoke_map | 03:48 |
| notmorgan | and restores it on a new object when needed | 03:48 |
| notmorgan | for deserialize | 03:48 |
| notmorgan | was easier than trying to figure out how to know it was in-fact a revoketree, msgpack did it all for free | 03:49 |
| *** dims has joined #openstack-keystone | 03:49 | |
| notmorgan | and the difference was ~60usec vs ~7usec | 03:49 |
| openstackgerrit | henry-nash proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 03:49 |
| notmorgan | in a synthetic pure deserliaize test | 03:49 |
| notmorgan | which is close to what an event looks like | 03:49 |
| ayoung | notmorgan, can we just chop off all the spurious revoke events? | 03:49 |
| notmorgan | ayoung: more work | 03:50 |
| ayoung | we don;'t need anything but by userid/time and byt token id | 03:50 |
| notmorgan | less work to just serialize the whole thing. | 03:50 |
| notmorgan | once we cut down all the extra revoke event types, i'll push the logic down to SQL | 03:50 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Relax the schema validation to accept empty request body https://review.openstack.org/237448 | 03:50 |
| ayoung | No , I mean kill it in the treee. now | 03:50 |
| notmorgan | since SQL can do the lookup for us more cheaply at that point | 03:50 |
| ayoung | I should just write that patch | 03:51 |
| notmorgan | out of scope for this change | 03:51 |
| ayoung | I know | 03:51 |
| notmorgan | easy to stack that on next | 03:51 |
| ayoung | it just keeps coming up | 03:51 |
| notmorgan | i was holding off on hacking away on revoke tree | 03:51 |
| notmorgan | since this was a clear and easy test/win | 03:51 |
| *** dims has quit IRC | 03:51 | |
| notmorgan | and i had to hack on dogpile anyway to make role assignment caching work | 03:51 |
| ayoung | notmorgan, put the move of the model into its own change, I think. | 03:51 |
| ayoung | not important, though... | 03:52 |
| notmorgan | ayoung: notice this is WIP. it's more for "do we like the concept?" | 03:52 |
| notmorgan | before i do cleanup / finalization | 03:52 |
| ayoung | yeah...I do like the idea | 03:52 |
| notmorgan | there is another change that will default caching on in keystone always if we go foreward with it | 03:52 |
| ayoung | just all the crud in the revoke distracts from the core | 03:52 |
| notmorgan | and jsut defualt to the null (cache nothing) actual dogpile backend | 03:52 |
| ayoung | there is no native caching in the database, is there? | 03:53 |
| notmorgan | no | 03:53 |
| notmorgan | you can hook dogpile onto SQL-A but the invalidates still need to be written | 03:53 |
| ayoung | and we are so stateless that we query every time | 03:53 |
| notmorgan | and we might as well cache at the business logic layer | 03:53 |
| notmorgan | right. | 03:53 |
| notmorgan | this is not that bad a thing tbh | 03:54 |
| *** harlowja has quit IRC | 03:54 | |
| notmorgan | and caching higher up saves us driver logic too | 03:54 |
| ayoung | notmorgan, is this the heart of it https://review.openstack.org/#/c/272007/edit/keystone/middleware/auth.py | 03:54 |
| notmorgan | uhm | 03:55 |
| notmorgan | are you editing that? | 03:55 |
| notmorgan | cause... i can't open that page | 03:55 |
| ayoung | ah...I ddid a minor edit to do al ine break | 03:55 |
| ayoung | one sec | 03:55 |
| openstackgerrit | ayoung proposed openstack/keystone: WIP/DNM: Use requst local caching [full cache] https://review.openstack.org/272007 | 03:55 |
| notmorgan | there | 03:55 |
| notmorgan | hehe | 03:55 |
| notmorgan | i can't view your mid-edit changes | 03:56 |
| ayoung | I did al ine break and laost put in that newline lbragstad asked for | 03:56 |
| *** dims has joined #openstack-keystone | 03:56 | |
| ayoung | https://review.openstack.org/#/c/272007/3/keystone/middleware/auth.py that | 03:56 |
| ayoung | notmorgan, so, where does the cache get read? | 03:56 |
| notmorgan | in the _context_proxy | 03:56 |
| notmorgan | so memoize hits the _context_proxy before hitting the backend | 03:57 |
| ayoung | notmorgan, so, we already have dogpile caching set up, and this extends that? | 03:57 |
| notmorgan | @memoize->dogpile.region->_context_proxy->dogpile_backend | 03:57 |
| notmorgan | i just layed the new context_proxy in | 03:57 |
| notmorgan | in the "dogpile" way | 03:57 |
| notmorgan | you cna add proxies [as many as you want] in before the backend | 03:57 |
| notmorgan | and the context proxy stores the data for that request in thread.local | 03:57 |
| ayoung | notmorgan, ok, so the new proxy is in memery, and, local to the request? | 03:57 |
| notmorgan | yep | 03:58 |
| *** roxanaghe has joined #openstack-keystone | 03:58 | |
| ayoung | so each requst will get its own copy | 03:58 |
| notmorgan | yep | 03:58 |
| ayoung | and if that is a miss, it goes to dogpile | 03:58 |
| notmorgan | yep | 03:58 |
| notmorgan | and if an .invalidate() happens it affects both thread.local and dogpile. | 03:58 |
| ayoung | what was configured before...that is alos in memory, but shared... | 03:58 |
| notmorgan | before it was default configured off | 03:58 |
| ayoung | now, in mod_wsgi, does where does the existing dogpile cahce live? | 03:58 |
| notmorgan | for unit tests we had a synthetic dict() based backend that looked like a memcache interface | 03:58 |
| notmorgan | still do. | 03:58 |
| ayoung | what threading model are we running under? | 03:59 |
| notmorgan | in mod_wsgi once my next devstack change lands we will run everything with a real memcache in devstack too | 03:59 |
| notmorgan | uhmm... i think we're worker | 03:59 |
| notmorgan | but WSGIDaemonProcess | 03:59 |
| ayoung | worker means what? | 03:59 |
| notmorgan | not prefork apache | 03:59 |
| notmorgan | but not event apache | 03:59 |
| notmorgan | it's the threaded apache | 03:59 |
| notmorgan | and we run 5 process, single thread in mod_wsgi | 03:59 |
| ayoung | 5 proc 1 thread...does that mean that, effectively, we are doing pre-fork cuz there is onoly one thread per process? | 04:00 |
| notmorgan | most deployments run everything worker (threaded) apache unless you *really* need prefork | 04:00 |
| openstackgerrit | henry-nash proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 04:00 |
| notmorgan | right for the wsgi_workers | 04:00 |
| notmorgan | but not for apache | 04:01 |
| notmorgan | apache will multiplex to the workers, just the workers handle a single thing | 04:01 |
| notmorgan | also, i think a thread in mod_wsgi is different than a python thread | 04:01 |
| notmorgan | it's a C-thread that runs a python interpreter | 04:01 |
| *** EinstCrazy has quit IRC | 04:01 | |
| notmorgan | so think of it like a single-threaded python task even if mod_Wsgi has many threads | 04:02 |
| notmorgan | fwiw, i've been told you can OOM a machine with 10 keystone workers in mod_wsgi if its an 8GB node | 04:03 |
| notmorgan | in some folks dev deployments | 04:03 |
| *** shoutm_ has joined #openstack-keystone | 04:04 | |
| *** dims has quit IRC | 04:05 | |
| *** browne has joined #openstack-keystone | 04:05 | |
| ayoung | notmorgan, so, IIUC, a thread here will get reused. Does that mean that the global python objects will be reused in the next request? | 04:05 |
| notmorgan | yeah, i think so. | 04:05 |
| notmorgan | but a thread.local is specific to that request | 04:06 |
| ayoung | initialization only has to be run when the thread is spun up, so once per process | 04:06 |
| notmorgan | yea. | 04:06 |
| notmorgan | or when the thread is torn down | 04:06 |
| ayoung | so this cache you are doing is thread local? | 04:06 |
| notmorgan | yes. | 04:06 |
| notmorgan | it's hooked into oslo.context | 04:06 |
| notmorgan | we use the same thread.local cache, so if we clear it for a request, we clear our request cache too | 04:06 |
| ayoung | who's word am I supposed to take that oslo.context is thread local? | 04:07 |
| notmorgan | ayoung: https://github.com/openstack/oslo.context/blob/master/oslo_context/context.py#L28 https://github.com/openstack/oslo.context/blob/master/oslo_context/context.py#L165 https://github.com/openstack/oslo.context/blob/master/oslo_context/context.py#L70 | 04:07 |
| *** shoutm has quit IRC | 04:08 | |
| notmorgan | oslo_context's | 04:08 |
| ayoung | this has the potential to be a security hole. If data from one request can show up in another due to the cache. | 04:08 |
| notmorgan | the data i am storing there is never available outside of the oslo_context direct access | 04:08 |
| ayoung | _request_store = threading.local() | 04:08 |
| *** davechen1 has joined #openstack-keystone | 04:08 | |
| ayoung | we better test the fO(&*) out of that | 04:08 |
| notmorgan | threading.local is pretty damn well tested | 04:09 |
| ayoung | ok... | 04:09 |
| ayoung | so, how does your additional cache help us? | 04:09 |
| notmorgan | it means that if a request asks for say .get_domain('default') | 04:10 |
| notmorgan | it is stored in the requests' context rather than needing to reach out | 04:10 |
| notmorgan | so no socket() no networking, no waiting on memcache, | 04:10 |
| *** davechen has quit IRC | 04:10 | |
| notmorgan | strict .deserialize() | 04:10 |
| notmorgan | and return | 04:10 |
| notmorgan | if it isn't a cache miss. this means all the duplicated .get_domain for checking user, project, user_project, project_domain, trust.user.domain | 04:11 |
| ayoung | why even serialize? why not just store python objects? | 04:11 |
| notmorgan | becomes cached in-process | 04:11 |
| notmorgan | well it has to be isolated | 04:11 |
| ayoung | from what | 04:11 |
| notmorgan | you cna't return a dict, dicts are mutable | 04:11 |
| notmorgan | if someone did .get_domain('default') then dom_ref['id'] = 'HAI' | 04:11 |
| notmorgan | now .get_domain('default') would return bogus data | 04:12 |
| notmorgan | the options are copy.deepcopy(), serialize(), or custom copy() code | 04:12 |
| notmorgan | deepcopy has bizzare performance implications | 04:12 |
| notmorgan | since it has a TON of sanity checking | 04:12 |
| *** fawadkhaliq has quit IRC | 04:12 | |
| notmorgan | i would use json, but revoke tree needs to die first | 04:12 |
| notmorgan | msgpack was super easy | 04:12 |
| notmorgan | and already available (and really isn't slow) and no "security" concerns like pickle has | 04:13 |
| notmorgan | order of speed: json 7usec, deepcopy (simple objects) 13usec, pickle 30usec, msgpack 60usec, deepcopy (complex) unknown | 04:14 |
| notmorgan | s/unkown/variable | 04:14 |
| notmorgan | but a lot of extra code isneeded to use json, and deepcopy is highly variable | 04:14 |
| notmorgan | pickle raises security concerns always, even if it shouldnt because it's never exposed in a way to the user. | 04:14 |
| notmorgan | so until revoke tree is gone msgpack, but honestly an avg of 50usec per deserialze doesn't seem like much to fret over | 04:15 |
| notmorgan | we're well within CPU slices | 04:15 |
| notmorgan | on any modern proc | 04:15 |
| ayoung | notmorgan, but this cache is only in a singe process, why worry about mutablilty>? | 04:16 |
| notmorgan | because if somethng in the request changes the id, then we break the rest of the request that relies on that object | 04:16 |
| notmorgan | get_project_domain, change ref, get user_domain (same as project_domain), now the data is wrong | 04:17 |
| ayoung | notmorgan, and that is why I coded the models with the immutable switch all those years ago... | 04:17 |
| notmorgan | except we can't make it imutable | 04:17 |
| ayoung | but tree should be immutable | 04:17 |
| ayoung | or, really, should not need to be serialized. | 04:17 |
| ayoung | but, I think your apporach is solid | 04:17 |
| ayoung | its on the conservative side, which I can't fault | 04:18 |
| notmorgan | we often do want it to be mutable (domain_ref for example) since we pass that into update_domain at times w/o copyu | 04:18 |
| ayoung | might make our memory overhead a bit higher... | 04:18 |
| ayoung | right | 04:18 |
| notmorgan | not really | 04:18 |
| notmorgan | minimally so for the serialized content | 04:18 |
| notmorgan | because each time we call .get_domain, we do all the SQL object book keeping | 04:18 |
| notmorgan | and spin up a new ORM object then .to_dict it | 04:18 |
| ayoung | tree could be painful. I'd think long and hard if we could skip serializing the tree. | 04:19 |
| notmorgan | we might actually have lower over head since no ORM overhead | 04:19 |
| notmorgan | ayoung: tree serializes just fine if i only serialize .revoke_map, and i expect to kill most of the tree before mitaka closes | 04:19 |
| ayoung | works for me | 04:19 |
| ayoung | https://review.openstack.org/#/c/242614/ awaits | 04:19 |
| notmorgan | so we will be able to drop down to json. but this all works for now as is | 04:19 |
| notmorgan | and reduces runtime (4core i7 5660u) laptop by 20sec for our unit tests | 04:20 |
| notmorgan | and in gate (depending on node/ssd/non-ssd/etc) up to 100s | 04:20 |
| notmorgan | and i've seen between 5 and 20m improvment in some dsvm runs | 04:20 |
| notmorgan | so non-trivial benefits even on top of memcache :) | 04:20 |
| notmorgan | ooh i just realized something | 04:21 |
| notmorgan | need to fix something in the context thing hehe, your point on "does threading.local" work. it does.. but you have to be smart about it | 04:22 |
| *** davechen has joined #openstack-keystone | 04:24 | |
| notmorgan | oh we're good | 04:24 |
| notmorgan | nvm | 04:24 |
| notmorgan | my explicit .update_store() does exactly waht is needed | 04:24 |
| ayoung | you had me at : reduces runtime (4core i7 5660u) laptop by 20sec for our unit tests | 04:25 |
| notmorgan | ;) | 04:25 |
| notmorgan | well 2core + SMT | 04:25 |
| notmorgan | but effectively 4core | 04:25 |
| ayoung | notmorgan, BTW, we are making progress on getting Keystone Eventlet out of Tripleo. I think that is the last place in the tent that still requires it | 04:26 |
| notmorgan | cool | 04:26 |
| ayoung | the undercloud change went through, but overcloud is more complex | 04:26 |
| *** davechen1 has quit IRC | 04:26 | |
| *** vivekd has joined #openstack-keystone | 04:28 | |
| notmorgan | good stuff | 04:29 |
| *** shoutm has joined #openstack-keystone | 04:31 | |
| *** shoutm_ has quit IRC | 04:32 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:32 | |
| hugokuo | Hi all | 04:36 |
| hugokuo | I got a couple of question for Keystone and Keystone middleware. | 04:37 |
| hugokuo | Q1. Does Keystone allows operator to setup the prefix for token ? eg. AUTH_1234567 or COOL_1234567 | 04:38 |
| hugokuo | Q2. In a case there's 3 Keystone servers non-federated, how's the best way to deal with user's request in a service? | 04:39 |
| hugokuo | thx | 04:39 |
| stevemar | hugokuo: q1: nope, no prefix for tokens | 04:40 |
| hugokuo | stevemar: copy. | 04:40 |
| *** shoutm has quit IRC | 04:43 | |
| ayoung | hugokuo, to answer q1: no | 04:44 |
| hugokuo | neat | 04:44 |
| *** shoutm has joined #openstack-keystone | 04:45 | |
| hugokuo | Then my original plan would not able be implemented. If there's token prefix for different keystone, I can properly have a new middleware to select which Keystone server for validating incoming token in Swift proxy server | 04:46 |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 04:46 |
| *** stevemar has quit IRC | 04:47 | |
| *** topol has quit IRC | 04:47 | |
| *** iurygregory has quit IRC | 04:48 | |
| *** vivekd has quit IRC | 04:48 | |
| *** iurygregory has joined #openstack-keystone | 04:49 | |
| notmorgan | ayoung: uhm | 04:51 |
| hugokuo | hmm... perhaps I cen return different hostname of same service in each Keystone server. And then write another middleware to parse the incoming request's hostname header. To extract the keystone server index from the hostname header | 04:52 |
| notmorgan | i am clearly not understanding the implied roles? is it a one-to-one relation ship atm? | 04:52 |
| notmorgan | it looks like you get exactly 1 implied role for a previous role? | 04:52 |
| notmorgan | and also do we really wand "admin or cloud_admin"? | 04:52 |
| notmorgan | to be able to make them? | 04:52 |
| * notmorgan is looking at code. | 04:53 | |
| notmorgan | not at the docs fwiw | 04:53 |
| notmorgan | oh nvm was looking at .get_implied_role not list_role_inference_rules | 04:53 |
| notmorgan | and list_implied_roles | 04:53 |
| ayoung | notmorgan, its is a many to many relationship | 04:54 |
| notmorgan | right | 04:54 |
| ayoung | so one prior role can imply many implied roles | 04:54 |
| ayoung | and one role can be implied by multiple prior | 04:54 |
| ayoung | we deal with cycles in a few patches that are already in | 04:55 |
| notmorgan | right | 04:55 |
| ayoung | basically, allow them, but test | 04:55 |
| notmorgan | so.. | 04:55 |
| notmorgan | admin, vs cloud_admin | 04:55 |
| ayoung | right | 04:55 |
| ayoung | you could now say admin implied cloud_admin, | 04:55 |
| notmorgan | there doesn't seem to be any protection that the user has the prior/implied/whatever role | 04:55 |
| ayoung | ? | 04:56 |
| ayoung | what user? | 04:56 |
| notmorgan | the user creating the implied role | 04:56 |
| notmorgan | you've said in the v3 policy file "admin or cloud admin" | 04:56 |
| notmorgan | so domain admins can create implied roles? | 04:56 |
| *** roxanaghe has quit IRC | 04:56 | |
| ayoung | notmorgan, is that too trusting for now? | 04:56 |
| ayoung | hmmm | 04:57 |
| *** stevemar_znc has joined #openstack-keystone | 04:57 | |
| notmorgan | and there seems to be no protection to prevent a domain admin from creating an implied role | 04:57 |
| ayoung | you may be right | 04:57 |
| notmorgan | that she doesn't have | 04:57 |
| notmorgan | and escalate perms | 04:57 |
| notmorgan | i want the cloud admin role, so create an implied role that will cascade it onto me | 04:57 |
| ayoung | is_admin would protect against that, but we can't count on that yet | 04:57 |
| openstackgerrit | Merged openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 04:57 |
| notmorgan | rightr. | 04:57 |
| ayoung | so we should change the policy to be admin only for now | 04:57 |
| notmorgan | cloud_admin only for v3 iirc | 04:57 |
| ayoung | notmorgan, so only need to change v3cloudsample? | 04:59 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 04:59 |
| *** topol_ has joined #openstack-keystone | 04:59 | |
| notmorgan | still lookin | 04:59 |
| notmorgan | gbut that one is the firs tthing that stands out | 04:59 |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 05:00 |
| *** topol_ is now known as topol | 05:01 | |
| *** ayoung is now known as ayoung_ZZZzzzz | 05:01 | |
| *** ChanServ sets mode: +v topol | 05:01 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 05:03 |
| notmorgan | ayoung_ZZZzzzz: ok -1 on the security concern. but otherwise (didn't look at the tests too closely) looks reasonable | 05:04 |
| *** shoutm_ has joined #openstack-keystone | 05:10 | |
| *** shoutm has quit IRC | 05:12 | |
| *** zqfan has quit IRC | 05:21 | |
| *** vivekd has joined #openstack-keystone | 05:23 | |
| *** EinstCrazy has joined #openstack-keystone | 05:41 | |
| *** shoutm_ has quit IRC | 05:52 | |
| *** spandhe has joined #openstack-keystone | 05:54 | |
| *** shoutm has joined #openstack-keystone | 05:56 | |
| *** su_zhang has joined #openstack-keystone | 05:57 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone-specs: PCI-DSS v3.1 https://review.openstack.org/272396 | 05:59 |
| dolphm | sorry ^ | 05:59 |
| *** EinstCrazy has quit IRC | 06:04 | |
| *** lhcheng has joined #openstack-keystone | 06:06 | |
| *** ChanServ sets mode: +v lhcheng | 06:06 | |
| *** shoutm_ has joined #openstack-keystone | 06:07 | |
| *** shoutm has quit IRC | 06:08 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 06:09 |
| jamielennox | ugh | 06:10 |
| *** fawadkhaliq has quit IRC | 06:13 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 06:14 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone-specs: PCI-DSS v3.1 https://review.openstack.org/272396 | 06:16 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Relax the schema validation to accept empty request body https://review.openstack.org/237448 | 06:20 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove the duplicated testcase https://review.openstack.org/272401 | 06:20 |
| *** shoutm_ has quit IRC | 06:22 | |
| *** shoutm has joined #openstack-keystone | 06:23 | |
| *** redrobot has left #openstack-keystone | 06:26 | |
| *** EinstCrazy has joined #openstack-keystone | 06:26 | |
| *** redrobot has joined #openstack-keystone | 06:27 | |
| *** lhcheng has quit IRC | 06:29 | |
| *** zqfan has joined #openstack-keystone | 06:31 | |
| *** su_zhang has quit IRC | 06:36 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 06:37 |
| *** gyee has quit IRC | 06:37 | |
| *** belmoreira has joined #openstack-keystone | 06:37 | |
| *** EinstCrazy has quit IRC | 06:40 | |
| *** zqfan has quit IRC | 06:40 | |
| *** EinstCrazy has joined #openstack-keystone | 06:41 | |
| *** rcernin has joined #openstack-keystone | 06:53 | |
| *** vivekd has quit IRC | 06:58 | |
| *** mkoshiya_ has joined #openstack-keystone | 07:02 | |
| *** GB21 has joined #openstack-keystone | 07:05 | |
| *** su_zhang has joined #openstack-keystone | 07:12 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 07:13 |
| *** spandhe has quit IRC | 07:14 | |
| *** shoutm has quit IRC | 07:17 | |
| *** vgridnev has joined #openstack-keystone | 07:17 | |
| *** shoutm has joined #openstack-keystone | 07:20 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:20 | |
| *** EinstCrazy has quit IRC | 07:26 | |
| mkoshiya_ | Hi, all. could you please review bp/return-request-id-to-caller ? #link https://review.openstack.org/#/c/261188/ and Related Changes. | 07:27 |
| mkoshiya_ | Thank you | 07:27 |
| *** simondodsley has quit IRC | 07:28 | |
| *** mkoshiya_ has left #openstack-keystone | 07:35 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 07:41 |
| *** fawadkhaliq has quit IRC | 07:49 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:50 | |
| *** GB21 has quit IRC | 07:59 | |
| *** EinstCrazy has joined #openstack-keystone | 08:00 | |
| *** EinstCra_ has joined #openstack-keystone | 08:13 | |
| *** EinstCrazy has quit IRC | 08:14 | |
| *** su_zhang has quit IRC | 08:21 | |
| *** pnavarro has joined #openstack-keystone | 08:23 | |
| *** GB21 has joined #openstack-keystone | 08:27 | |
| *** shoutm_ has joined #openstack-keystone | 08:38 | |
| *** jaosorior has joined #openstack-keystone | 08:40 | |
| *** shoutm has quit IRC | 08:41 | |
| *** fhubik has joined #openstack-keystone | 08:47 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Relax the schema validation to accept empty request body https://review.openstack.org/237448 | 08:47 |
| *** fawadkhaliq has quit IRC | 08:57 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:57 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 09:07 |
| *** browne has quit IRC | 09:14 | |
| *** jistr has joined #openstack-keystone | 09:19 | |
| *** markvoelker has quit IRC | 09:23 | |
| *** mhickey has joined #openstack-keystone | 09:32 | |
| *** fawadkhaliq has quit IRC | 09:39 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:39 | |
| *** fhubik has quit IRC | 09:40 | |
| *** EinstCra_ has quit IRC | 09:48 | |
| openstackgerrit | Dina Belova proposed openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 09:48 |
| *** vivekd has joined #openstack-keystone | 09:54 | |
| *** davechen has quit IRC | 09:56 | |
| *** shoutm has joined #openstack-keystone | 09:57 | |
| *** shoutm_ has quit IRC | 10:00 | |
| *** vivekd has quit IRC | 10:10 | |
| *** jamielennox is now known as jamielennox|away | 10:15 | |
| *** vivekd has joined #openstack-keystone | 10:22 | |
| *** jaosorior has quit IRC | 10:23 | |
| *** markvoelker has joined #openstack-keystone | 10:23 | |
| *** jaosorior has joined #openstack-keystone | 10:24 | |
| *** jamielennox|away is now known as jamielennox | 10:25 | |
| *** iurygregory has quit IRC | 10:27 | |
| *** markvoelker has quit IRC | 10:28 | |
| *** iurygregory has joined #openstack-keystone | 10:30 | |
| *** aix_ has quit IRC | 10:32 | |
| *** EinstCrazy has joined #openstack-keystone | 10:38 | |
| *** shoutm has quit IRC | 10:39 | |
| *** fhubik has joined #openstack-keystone | 10:40 | |
| *** alexpro has joined #openstack-keystone | 10:40 | |
| *** iurygregory has quit IRC | 10:41 | |
| *** iurygregory has joined #openstack-keystone | 10:42 | |
| *** fhubik is now known as fhubik_brb | 10:47 | |
| *** fhubik_brb is now known as fhubik | 10:48 | |
| *** iurygregory has quit IRC | 11:00 | |
| *** vivekd has quit IRC | 11:01 | |
| *** iurygregory has joined #openstack-keystone | 11:02 | |
| *** davechen has joined #openstack-keystone | 11:02 | |
| *** fhubik has quit IRC | 11:03 | |
| *** chlong has quit IRC | 11:05 | |
| *** chlong has joined #openstack-keystone | 11:10 | |
| *** aix_ has joined #openstack-keystone | 11:13 | |
| *** davechen1 has joined #openstack-keystone | 11:16 | |
| *** davechen has quit IRC | 11:18 | |
| *** shoutm has joined #openstack-keystone | 11:26 | |
| *** shoutm has quit IRC | 11:31 | |
| *** shoutm has joined #openstack-keystone | 11:33 | |
| *** fawadkhaliq has quit IRC | 11:34 | |
| *** vgridnev has quit IRC | 11:45 | |
| *** gildub has quit IRC | 11:56 | |
| *** pauloewerton has joined #openstack-keystone | 12:07 | |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: Add backend support for deleting a projects list https://review.openstack.org/245916 | 12:08 |
| *** jaosorior has quit IRC | 12:12 | |
| *** jaosorior has joined #openstack-keystone | 12:13 | |
| *** daemontool has joined #openstack-keystone | 12:14 | |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 12:14 |
| *** iurygregory has quit IRC | 12:16 | |
| *** iurygregory has joined #openstack-keystone | 12:17 | |
| *** doug-fish has joined #openstack-keystone | 12:21 | |
| *** vgridnev has joined #openstack-keystone | 12:22 | |
| *** doug-fish has quit IRC | 12:23 | |
| *** doug-fish has joined #openstack-keystone | 12:24 | |
| *** markvoelker has joined #openstack-keystone | 12:25 | |
| *** dims has joined #openstack-keystone | 12:28 | |
| *** doug-fish has quit IRC | 12:28 | |
| *** markvoelker has quit IRC | 12:29 | |
| *** iurygregory has quit IRC | 12:30 | |
| *** iurygregory has joined #openstack-keystone | 12:30 | |
| *** doug-fish has joined #openstack-keystone | 12:31 | |
| *** doug-fish has quit IRC | 12:35 | |
| *** vgridnev has quit IRC | 12:41 | |
| *** vgridnev has joined #openstack-keystone | 12:42 | |
| *** dims has quit IRC | 12:45 | |
| *** pauloewerton has quit IRC | 12:48 | |
| *** iurygregory has quit IRC | 12:49 | |
| *** shoutm_ has joined #openstack-keystone | 12:50 | |
| *** iurygregory has joined #openstack-keystone | 12:52 | |
| *** pauloewerton has joined #openstack-keystone | 12:52 | |
| *** shoutm has quit IRC | 12:52 | |
| *** iurygregory has quit IRC | 12:54 | |
| *** daemontool has quit IRC | 12:55 | |
| *** shoutm has joined #openstack-keystone | 12:58 | |
| *** shoutm_ has quit IRC | 12:58 | |
| *** raildo-afk is now known as raildo | 12:59 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:02 | |
| *** bill_az has joined #openstack-keystone | 13:02 | |
| *** shoutm has quit IRC | 13:08 | |
| *** shoutm has joined #openstack-keystone | 13:09 | |
| *** topol has quit IRC | 13:11 | |
| *** raildo is now known as raildo-afk | 13:13 | |
| *** raildo-afk is now known as raildo | 13:14 | |
| *** topol_ has joined #openstack-keystone | 13:15 | |
| *** jsavak has joined #openstack-keystone | 13:18 | |
| *** gordc has joined #openstack-keystone | 13:18 | |
| *** edmondsw has joined #openstack-keystone | 13:18 | |
| *** davechen1 has left #openstack-keystone | 13:19 | |
| *** davechen1 has joined #openstack-keystone | 13:24 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 13:24 |
| *** fawadkhaliq has quit IRC | 13:25 | |
| davechen1 | dstanek: hi sir, | 13:25 |
| davechen1 | dstanek: so, how about just remove 'test_calling_create_with_empty_entity_arg_fails' instead? | 13:25 |
| *** markvoelker has joined #openstack-keystone | 13:25 | |
| *** davechen1 is now known as davechen | 13:26 | |
| *** markvoelker has quit IRC | 13:28 | |
| *** markvoelker has joined #openstack-keystone | 13:28 | |
| *** doug-fish has joined #openstack-keystone | 13:30 | |
| *** shoutm has quit IRC | 13:30 | |
| *** spzala has joined #openstack-keystone | 13:33 | |
| *** doug-fish has quit IRC | 13:37 | |
| *** doug-fish has joined #openstack-keystone | 13:38 | |
| *** topol_ has quit IRC | 13:39 | |
| *** ninag has joined #openstack-keystone | 13:42 | |
| *** topol_ has joined #openstack-keystone | 13:42 | |
| *** doug-fish has quit IRC | 13:43 | |
| *** aix_ has quit IRC | 14:00 | |
| *** aix has joined #openstack-keystone | 14:02 | |
| *** shoutm has joined #openstack-keystone | 14:06 | |
| *** richm has joined #openstack-keystone | 14:10 | |
| *** su_zhang has joined #openstack-keystone | 14:13 | |
| *** dslevin1 has quit IRC | 14:20 | |
| *** daemontool has joined #openstack-keystone | 14:24 | |
| *** doug-fish has joined #openstack-keystone | 14:26 | |
| *** clenimar has joined #openstack-keystone | 14:26 | |
| *** doug-fish has quit IRC | 14:26 | |
| *** dims has joined #openstack-keystone | 14:27 | |
| *** clenimar has quit IRC | 14:27 | |
| *** doug-fish has joined #openstack-keystone | 14:27 | |
| *** clenimar has joined #openstack-keystone | 14:28 | |
| *** clenimar has quit IRC | 14:28 | |
| *** dims has quit IRC | 14:29 | |
| *** clenimar has joined #openstack-keystone | 14:29 | |
| *** shoutm has quit IRC | 14:31 | |
| *** dims has joined #openstack-keystone | 14:32 | |
| *** iurygregory has joined #openstack-keystone | 14:33 | |
| *** boris-42 has quit IRC | 14:34 | |
| *** bill_az has quit IRC | 14:34 | |
| *** yarkot has quit IRC | 14:35 | |
| *** boris-42 has joined #openstack-keystone | 14:35 | |
| *** clenimar has quit IRC | 14:35 | |
| *** clenimar has joined #openstack-keystone | 14:35 | |
| notmorgan | Zzzzzzzzzzzz | 14:41 |
| *** davechen has left #openstack-keystone | 14:42 | |
| *** daemontool has quit IRC | 14:43 | |
| *** daemontool has joined #openstack-keystone | 14:47 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:49 | |
| *** pushkaru has joined #openstack-keystone | 14:54 | |
| *** mhickey has quit IRC | 15:01 | |
| *** mhickey has joined #openstack-keystone | 15:07 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:11 | |
| *** aix has quit IRC | 15:12 | |
| *** aix has joined #openstack-keystone | 15:13 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Add spec for multifactor authentication https://review.openstack.org/272287 | 15:22 |
| *** david-lyle_ has joined #openstack-keystone | 15:26 | |
| *** timcline has joined #openstack-keystone | 15:26 | |
| *** ChanServ sets mode: +v topol_ | 15:26 | |
| *** topol_ is now known as topol | 15:26 | |
| *** simondodsley has joined #openstack-keystone | 15:26 | |
| *** tonytan4ever has joined #openstack-keystone | 15:28 | |
| lbragstad | i suppose everyone is going to be traveling today huh | 15:46 |
| *** slberger has joined #openstack-keystone | 15:50 | |
| *** gokrokve has joined #openstack-keystone | 15:50 | |
| *** GB21 has quit IRC | 15:54 | |
| raildo | lbragstad: are you going for the midcycle? | 15:54 |
| lbragstad | raildo yep | 15:55 |
| raildo | lbragstad: nice :) | 15:55 |
| lbragstad | raildo are you? | 15:55 |
| *** genunix has left #openstack-keystone | 15:56 | |
| raildo | lbragstad: no, it's really expensive for me :( | 15:56 |
| lbragstad | raildo that's understandable | 15:57 |
| lbragstad | raildo did you have any more luck with the fernet trust things? | 15:57 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Reuse project scoped token check for trusts https://review.openstack.org/253672 | 15:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add checks for domain scoped data creep https://review.openstack.org/253671 | 15:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add checks for project scoped data creep to tests https://review.openstack.org/253670 | 15:58 |
| raildo | lbragstad: I'm debbuging the code, and I think there is some problem when we create a token v2 with trust... I was waiting to see you and ayoung_ZZZzzzz online to talk about it | 15:59 |
| lbragstad | raildo ah - gotcha | 15:59 |
| lbragstad | raildo also - another thing we are trying to do related to our conversation from yesterday is this https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:consolidate-fernet-provider | 16:00 |
| raildo | lbragstad: but since you probably will be travelling, maybe we can talk about it later.... | 16:00 |
| lbragstad | raildo i'm not traveling until tomorrow | 16:00 |
| lbragstad | so I'll be available all day today | 16:00 |
| *** GB21 has joined #openstack-keystone | 16:01 | |
| raildo | lbragstad: great, so I'll dig into this problem a little more and come back with some more information :) | 16:01 |
| *** jsavak has quit IRC | 16:01 | |
| *** phalmos has joined #openstack-keystone | 16:01 | |
| lbragstad | raildo awesome - a big piece of getting fernet to be default is consolidating those code paths | 16:01 |
| raildo | lbragstad: got it :) | 16:03 |
| raildo | lbragstad: i saw that this method doesn't return the auth_response: https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_auth.py#L1044 | 16:04 |
| *** jsavak has joined #openstack-keystone | 16:05 | |
| raildo | lbragstad: now I'm try to understand the reason | 16:06 |
| *** vgridnev has quit IRC | 16:08 | |
| *** vgridnev has joined #openstack-keystone | 16:09 | |
| *** r-daneel has joined #openstack-keystone | 16:10 | |
| *** mylu has joined #openstack-keystone | 16:15 | |
| *** belmoreira has quit IRC | 16:16 | |
| *** david-lyle_ has quit IRC | 16:18 | |
| *** fawadkhaliq has quit IRC | 16:20 | |
| *** avarner has quit IRC | 16:20 | |
| *** GB21 has quit IRC | 16:23 | |
| *** dims has quit IRC | 16:24 | |
| *** chlong is now known as chlong_zzz | 16:28 | |
| *** avarner has joined #openstack-keystone | 16:28 | |
| *** phalmos has quit IRC | 16:29 | |
| *** phalmos has joined #openstack-keystone | 16:29 | |
| *** avarner_ has joined #openstack-keystone | 16:34 | |
| *** woodster_ has joined #openstack-keystone | 16:36 | |
| *** avarner__ has joined #openstack-keystone | 16:36 | |
| *** mhickey has quit IRC | 16:36 | |
| *** avarner has quit IRC | 16:36 | |
| *** e0ne has joined #openstack-keystone | 16:37 | |
| *** mylu has quit IRC | 16:37 | |
| *** stevemar_znc is now known as stevemar | 16:38 | |
| *** avarner_ has quit IRC | 16:39 | |
| *** mylu has joined #openstack-keystone | 16:40 | |
| *** avarner has joined #openstack-keystone | 16:41 | |
| *** spandhe has joined #openstack-keystone | 16:42 | |
| *** avarner__ has quit IRC | 16:43 | |
| *** diazjf has joined #openstack-keystone | 16:44 | |
| *** browne has joined #openstack-keystone | 16:44 | |
| *** _cjones_ has joined #openstack-keystone | 16:46 | |
| htruta | hey henrynash: maybe you can add this to your review list: https://review.openstack.org/#/q/topic:bp/project-tree-deletion | 16:47 |
| htruta | HMT stuff | 16:47 |
| henrynash | htruta: sure | 16:47 |
| *** roxanaghe has joined #openstack-keystone | 16:47 | |
| *** mylu has quit IRC | 16:48 | |
| henrynash | htruta: project tree delete…neat! | 16:48 |
| *** _cjones_ has quit IRC | 16:48 | |
| *** mhickey has joined #openstack-keystone | 16:48 | |
| *** _cjones_ has joined #openstack-keystone | 16:48 | |
| *** mylu has joined #openstack-keystone | 16:49 | |
| *** dims has joined #openstack-keystone | 16:50 | |
| *** vgridnev has quit IRC | 16:51 | |
| *** gokrokve has quit IRC | 16:52 | |
| *** gokrokve has joined #openstack-keystone | 16:54 | |
| *** su_zhang has quit IRC | 16:54 | |
| htruta | henrynash: thanks | 16:55 |
| *** dims has quit IRC | 16:56 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:57 | |
| *** jbell8 has joined #openstack-keystone | 16:58 | |
| *** erhudy has quit IRC | 17:00 | |
| *** mylu has quit IRC | 17:02 | |
| *** rbak has joined #openstack-keystone | 17:03 | |
| *** fawadk has joined #openstack-keystone | 17:03 | |
| *** diazjf has quit IRC | 17:03 | |
| *** diazjf1 has joined #openstack-keystone | 17:03 | |
| *** gokrokve has quit IRC | 17:03 | |
| *** mylu has joined #openstack-keystone | 17:04 | |
| *** EinstCra_ has joined #openstack-keystone | 17:04 | |
| *** pauloegf has joined #openstack-keystone | 17:05 | |
| *** fhubik has joined #openstack-keystone | 17:05 | |
| *** fhubik has quit IRC | 17:06 | |
| *** EinstCrazy has quit IRC | 17:07 | |
| *** pauloewerton has quit IRC | 17:07 | |
| *** stevemar has quit IRC | 17:07 | |
| *** fawadkhaliq has quit IRC | 17:07 | |
| *** stevemar_znc has joined #openstack-keystone | 17:08 | |
| *** mylu has quit IRC | 17:09 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Enhance manager list_role_assignments to support group listing https://review.openstack.org/265650 | 17:15 |
| *** openstackgerrit has quit IRC | 17:17 | |
| *** openstackgerrit has joined #openstack-keystone | 17:17 | |
| *** gokrokve has joined #openstack-keystone | 17:18 | |
| *** e0ne_ has joined #openstack-keystone | 17:18 | |
| *** spzala_ has joined #openstack-keystone | 17:20 | |
| *** e0ne has quit IRC | 17:20 | |
| *** spzala has quit IRC | 17:20 | |
| *** clenimar has quit IRC | 17:22 | |
| *** jsavak has quit IRC | 17:23 | |
| *** vgridnev has joined #openstack-keystone | 17:24 | |
| *** jsavak has joined #openstack-keystone | 17:27 | |
| *** timcline has quit IRC | 17:27 | |
| *** jsavak has quit IRC | 17:27 | |
| htruta | henrynash: are you still around? | 17:29 |
| htruta | looks like we don't need to update this you suggested here: https://review.openstack.org/#/c/248295/7/keystone/resource/backends/sql.py | 17:29 |
| henrynash | htruta: for a short while, yes | 17:29 |
| *** stevemar_znc has quit IRC | 17:30 | |
| *** rvba has quit IRC | 17:30 | |
| henrynash | htruta: becasue…. | 17:30 |
| htruta | henrynash: I don't know why, but manager already calls it like this: https://review.openstack.org/#/c/248295/7/keystone/resource/core.py@820 | 17:30 |
| htruta | it has "project" on the signature | 17:30 |
| *** EmilienM has quit IRC | 17:30 | |
| *** aix has quit IRC | 17:30 | |
| *** e0ne_ has quit IRC | 17:31 | |
| *** jsavak has joined #openstack-keystone | 17:33 | |
| henrynash | htruta: interesting….I’m not quite sure if that is enough, however - I agree “morally” this should be enough, but I think if manger code wrote a call like: get_project(project_id=xyz) would that fail to work against a V8 driver? | 17:33 |
| *** dgonzalez has quit IRC | 17:34 | |
| htruta | henrynash: good question. Will test it here | 17:34 |
| *** mylu has joined #openstack-keystone | 17:34 | |
| *** stevemar_znc has joined #openstack-keystone | 17:34 | |
| *** EmilienM has joined #openstack-keystone | 17:34 | |
| *** dgonzalez has joined #openstack-keystone | 17:34 | |
| *** rvba has joined #openstack-keystone | 17:34 | |
| *** rvba has quit IRC | 17:34 | |
| *** rvba has joined #openstack-keystone | 17:34 | |
| *** ayoung_ZZZzzzz is now known as ayoung | 17:35 | |
| *** ayoung has quit IRC | 17:36 | |
| *** jsavak has quit IRC | 17:37 | |
| *** tonytan4ever has quit IRC | 17:37 | |
| henrynash | htruta: actually I *think* we are OK - since the wrapper code should satisfy the postional paramater call, and will just call the V8 drive get_project() method in non-positional fashion | 17:37 |
| htruta | henrynash: that's what I think too | 17:37 |
| *** mylu has quit IRC | 17:38 | |
| *** mylu has joined #openstack-keystone | 17:40 | |
| *** ayoung has joined #openstack-keystone | 17:41 | |
| *** ChanServ sets mode: +v ayoung | 17:41 | |
| *** vgridnev has quit IRC | 17:43 | |
| *** jsavak has joined #openstack-keystone | 17:45 | |
| *** vgridnev has joined #openstack-keystone | 17:46 | |
| *** raildo is now known as raildo-afk | 17:47 | |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: Add backend support for deleting a projects list https://review.openstack.org/245916 | 17:47 |
| *** raildo-afk is now known as raildo | 17:49 | |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 17:49 |
| *** jsavak has quit IRC | 17:50 | |
| *** hockeynut is now known as hockeynut_otr | 17:51 | |
| *** diazjf1 has quit IRC | 17:52 | |
| *** hockeynut_otr is now known as hockeynut | 17:52 | |
| *** tonytan4ever has joined #openstack-keystone | 17:52 | |
| *** jsavak has joined #openstack-keystone | 17:53 | |
| *** dgonzalez has quit IRC | 17:53 | |
| *** henrynash has quit IRC | 17:54 | |
| *** spzala_ has quit IRC | 17:54 | |
| *** jaosorior has quit IRC | 17:55 | |
| *** spzala has joined #openstack-keystone | 17:55 | |
| *** dgonzalez has joined #openstack-keystone | 17:55 | |
| *** spzala has quit IRC | 17:56 | |
| *** spzala has joined #openstack-keystone | 17:56 | |
| *** jsavak has quit IRC | 17:57 | |
| *** rderose has joined #openstack-keystone | 17:58 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:59 | |
| *** timcline has joined #openstack-keystone | 18:00 | |
| *** hockeynut_afk has joined #openstack-keystone | 18:00 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:03 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 18:04 | |
| *** hockeynut_afk has quit IRC | 18:05 | |
| *** hockeynut_otr has joined #openstack-keystone | 18:06 | |
| *** jsavak has joined #openstack-keystone | 18:08 | |
| *** raildo is now known as raildo-afk | 18:10 | |
| *** su_zhang has joined #openstack-keystone | 18:10 | |
| *** jistr has quit IRC | 18:11 | |
| *** raildo-afk is now known as raildo | 18:13 | |
| *** rderose has quit IRC | 18:13 | |
| *** mylu has quit IRC | 18:13 | |
| *** gokrokve has quit IRC | 18:17 | |
| *** harlowja has joined #openstack-keystone | 18:18 | |
| *** mgarza has joined #openstack-keystone | 18:19 | |
| *** stevemar_znc is now known as stevemar | 18:20 | |
| *** ChanServ sets mode: +o stevemar | 18:20 | |
| *** e0ne has joined #openstack-keystone | 18:21 | |
| pauloegf | lbragstad, hi, you around? | 18:22 |
| *** fawadk has quit IRC | 18:24 | |
| *** jsavak has quit IRC | 18:25 | |
| *** mhickey has quit IRC | 18:27 | |
| *** hockeynut_otr has quit IRC | 18:28 | |
| *** timcline has quit IRC | 18:31 | |
| *** jsavak has joined #openstack-keystone | 18:35 | |
| *** jsavak has quit IRC | 18:36 | |
| *** jsavak has joined #openstack-keystone | 18:36 | |
| *** gokrokve has joined #openstack-keystone | 18:37 | |
| *** jsavak has quit IRC | 18:41 | |
| *** gokrokve has quit IRC | 18:42 | |
| *** jsavak has joined #openstack-keystone | 18:42 | |
| lbragstad | raildo why is that? | 18:43 |
| lbragstad | pauloegf o/ | 18:43 |
| lbragstad | pauloegf what can I help you with? | 18:43 |
| ayoung | lbragstad, you the only person not in transit right now? | 18:44 |
| lbragstad | ayoung pretty much | 18:44 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Replace tenant for project in resource files https://review.openstack.org/248295 | 18:45 |
| lbragstad | ayoung i'll be in transit tomorrow morning early | 18:45 |
| ayoung | lbragstad, I'll be available On IRC. Let me know what tech I should try to use for remote presence. OK | 18:45 |
| raildo | lbragstad: I'm come bace to investigate this now, I had some problems with my pc here | 18:45 |
| *** vgridnev has quit IRC | 18:45 | |
| lbragstad | raildo sounds good.. | 18:46 |
| lbragstad | ayoung have you heard if we are going to use anything in particular? | 18:46 |
| ayoung | lbragstad, nope | 18:46 |
| lbragstad | ayoung ok - me either, I'll be sure to ask tomorrow | 18:47 |
| raildo | please, create a hangouts for the mere mortals here \o | 18:47 |
| ayoung | stevemar, what does IBM tend to use for remote presence? | 18:48 |
| ayoung | raildo, is Hangout the best option for you guys? At Red Hat we use Bluejeans and the results have been pretty good | 18:48 |
| pauloegf | lbragstad, about your comment in https://review.openstack.org/#/c/244248/11/keystone/resource/controllers.py | 18:48 |
| *** avarner has quit IRC | 18:49 | |
| pauloegf | lbragstad, do you have any idea on how to do the mapping of the cascade parameter in routers.py? | 18:49 |
| raildo | ayoung: any simple stream option work for us, I've never used bluejeans but sounds good to me | 18:50 |
| pauloegf | we've already tried to put a new parameter in json_home but it didn't work well =\ | 18:50 |
| lbragstad | pauloegf I think you'd just have to point the operation to a different method | 18:50 |
| *** browne has quit IRC | 18:50 | |
| ayoung | raildo, only problem is, none of the people on site know it. I was on site last time, and samueldmq gave his presentation using it. Maybe you are right to go with a hangout | 18:51 |
| ayoung | raildo, can we set up one now that is good for the week? | 18:51 |
| *** EinstCra_ has quit IRC | 18:51 | |
| lbragstad | pauloegf could the cascade flag be a query string? (does that make sense from a REST perspective)? | 18:52 |
| ayoung | raildo, Sent an invite.. we can set it up now and make it easy for tomorrow | 18:52 |
| raildo | ayoung: bluejeans is not free? :( | 18:52 |
| htruta | lbragstad: I'm working with pauloegf on this | 18:52 |
| lbragstad | like DELETE /v3/projects/{project_id}?cascade versus DELETE /v3/projects/{project_id}/cascade | 18:52 |
| ayoung | raildo, THE CLIENT is free. RH has a subscription | 18:53 |
| lbragstad | htruta o/ | 18:53 |
| raildo | ayoung: oh, great :) | 18:53 |
| ayoung | raildo, are any of you guys on team Brazil co-located anymore? | 18:53 |
| htruta | we did it as a new rout to specifically enforce a new policy rule | 18:53 |
| ayoung | or are you scatterd to the winds now? | 18:53 |
| raildo | me, htruta and pauloegf are in the same room, right now :) | 18:54 |
| lbragstad | htruta ah - I was thinking you could consolidate the methods in the controller with a query string. The existing delete_project method would just pull out the cascade query string and apply the policy accordingly? | 18:54 |
| *** lhcheng has joined #openstack-keystone | 18:54 | |
| *** ChanServ sets mode: +v lhcheng | 18:54 | |
| ayoung | raildo, you don't need to answer, but are you getting the ping from hangouts? | 18:55 |
| htruta | lbragstad: I think so.. | 18:55 |
| raildo | ayoung: ops, sorry | 18:55 |
| raildo | lbragstad: are you suggest make the policy check on the code, like we did for parent_id? | 18:56 |
| lbragstad | raildo i'm not sure... i thinks so? | 18:57 |
| raildo | let me find the code... | 18:57 |
| lbragstad | not sure if that is the best way to do it but I wouldn't mind seeing the difference in implementation with what is already proposed | 18:57 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:57 | |
| *** RichardRaseley has joined #openstack-keystone | 18:57 | |
| ayoung | raildo, No problem, this is the commo check, not the actual operation | 18:57 |
| lbragstad | ayoung what do you think about the DELETE /v3/projects/{project_id}/cascade API call? | 18:57 |
| raildo | lbragstad: something like that https://github.com/openstack/keystone/blob/master/keystone/resource/controllers.py#L234-L240 | 18:58 |
| *** jaosorior_ has joined #openstack-keystone | 18:58 | |
| lbragstad | from a rest perspective - should the cascade thing be a query string? | 18:58 |
| htruta | lbragstad, pauloegf: https://review.openstack.org/#/c/148730/20/specs/liberty/recursive-deletion.rst@77 makes sense? | 18:58 |
| *** diazjf has joined #openstack-keystone | 18:58 | |
| RichardRaseley | How would one delete a role assignment with python-keystoneclient? When attempting a client.role_assignments.delete I get an "MethodNotImplemented: Delete not supported for role assignments" error. | 18:58 |
| ayoung | lbragstad, it feels like it should be query string, because there might be multiple modifiers and you end up with API explosion | 18:58 |
| ayoung | bu8t I can;t think what else you would add | 18:58 |
| htruta | ayoung: take a look at the link I've just pasted | 18:59 |
| pauloegf | htruta, checking | 18:59 |
| *** ninag has quit IRC | 18:59 | |
| lbragstad | htruta so - henry is making the point that we need a separate policy for the cascade behavior? | 18:59 |
| *** gokrokve has joined #openstack-keystone | 18:59 | |
| raildo | RichardRaseley: I think that you should use openstack client for this operation | 19:00 |
| ayoung | htruta, I think you are on the right track. Let me ask you this; if we do /cascade, how will we have limited ourselves, and is that a deliberate choice? | 19:00 |
| htruta | lbragstad: yes | 19:01 |
| ayoung | if, otoh, we made is a query parameter, could we do, say, wildcard matching in the future ,or some other traverse the tree operation, and in a non-surprising way? | 19:01 |
| htruta | ayoung: what do you mean by limiting? | 19:01 |
| ayoung | htruta, say I want to delete all projects in a tree that start with demo_ | 19:02 |
| lbragstad | htruta so in that case - i would say do it as a query string and then check for the presence of the query string in the current delete_project method - https://github.com/openstack/keystone/blob/200e7f3dff763087b99df8748d50dd4d2cfc32b8/keystone/resource/core.py#L336-L362 | 19:02 |
| ayoung | or all proejcts in a tree where the owner is htruta | 19:02 |
| RichardRaseley | raildo: No, I was recommended (in this channel) to use python-keystoneclient directly when developing against Keystone. I am not going to change it at this point. Am interested only in how to delete a role assignment using python-keystoneclient 2.0.0 | 19:02 |
| ayoung | or any other operation performed over the whole tree | 19:02 |
| *** jasonsb has quit IRC | 19:02 | |
| ayoung | not just delete | 19:02 |
| *** ninag has joined #openstack-keystone | 19:02 | |
| *** jsavak has quit IRC | 19:02 | |
| ayoung | maybe I want to disable all of the lbragstad projects but not delete them because there are some htruta owned projects underneath, and I want them to saty around | 19:03 |
| ayoung | stay | 19:03 |
| RichardRaseley | It looks like there is a delete method for role_assignments, but it doesn't seem to work in the way that I expected. | 19:03 |
| ayoung | I thin query params are the right mechanism. And then the question is how to enforce policy on them...I will think about that, | 19:03 |
| *** jsavak has joined #openstack-keystone | 19:03 | |
| lbragstad | I have a feeling if query strings are used the policy is going to be in code | 19:04 |
| notmorgan | lbragstad: so, the reason things had to be moved in the cache patch was otherwise circular imports | 19:04 |
| htruta | ayoung: I see you problem, but do not see how query string will solve that | 19:04 |
| raildo | RichardRaseley: yeap https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/role_assignments.py#L124 | 19:04 |
| *** gokrokve has quit IRC | 19:04 | |
| notmorgan | lbragstad: revoke.core -> imports common.cache and common.cache._context_proxy can't import revoke.model (since revoke.core is imported from __init__ | 19:05 |
| RichardRaseley | raildo: So how does one 'remove' or 'unset' or 'delete' a role assignment? | 19:05 |
| RichardRaseley | What is the proper nomenclature? | 19:05 |
| htruta | ayoung, lbragstad: I see a query string as a filter of something... I this case, we are kind of doing a different operation | 19:05 |
| openstackgerrit | Merged openstack/keystone: Add testcases to check cache invalidation https://review.openstack.org/258785 | 19:06 |
| htruta | lbragstad, ayoung: see this rodrigods comment: https://review.openstack.org/#/c/148730/3/specs/kilo/recursive-deletion.rst@66 | 19:06 |
| lbragstad | notmorgan ah - makes sense | 19:07 |
| notmorgan | lbragstad: answering the comment can't be done via phone :( | 19:07 |
| notmorgan | lbragstad: because new gerrit ui is broken on mobile devices | 19:07 |
| notmorgan | (massive downside) | 19:07 |
| *** henrynash has joined #openstack-keystone | 19:07 | |
| *** ChanServ sets mode: +v henrynash | 19:07 | |
| lbragstad | notmorgan no that makes sense... i'll update the review | 19:07 |
| raildo | RichardRaseley: I jus know you can do that on openstackclient doing "openstack role remove --user USER_NAME (or group) --project TENANT_ID ROLE_NAME(or domain)" | 19:07 |
| notmorgan | oooh look it's snowing | 19:07 |
| openstackgerrit | Merged openstack/keystone: Fix trust redelegation and associated test https://review.openstack.org/269824 | 19:07 |
| openstackgerrit | Merged openstack/keystone: Online schema migration documentation https://review.openstack.org/265252 | 19:08 |
| raildo | RichardRaseley: but there should be a way to do that on keystoneclient, I just don't know how... | 19:08 |
| ayoung | htruta, so, I am not saying that we should do the wildcard approach here. I am saying that the query paramter approach supports it better | 19:08 |
| openstackgerrit | Merged openstack/keystone: Unit test for checking cross-version migrations compatibility https://review.openstack.org/241603 | 19:08 |
| RichardRaseley | raildo: OK, thank you for trying to help. =] | 19:08 |
| ayoung | notmorgan, what do you think of a hardcoded check that admin can never be an implied role? | 19:08 |
| raildo | RichardRaseley: np :) | 19:09 |
| htruta | RichardRaseley: if you're using the python API, this is the method you should call: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/roles.py#L179 | 19:10 |
| notmorgan | ayoung: are we making admin a "special" hard coded role then? | 19:10 |
| notmorgan | ayoung: i'm not sure what the best solution to the security escalation concern is tbh | 19:10 |
| ayoung | notmorgan, yes, based on the same logic as is_admin, I think | 19:10 |
| RichardRaseley | htruta: That looks like it, thank you! | 19:10 |
| notmorgan | time to board... be back in a bit | 19:10 |
| ayoung | notmorgan, right now, admin is the root of the tree. Implying admin by todays standards would be wrong | 19:10 |
| ayoung | its supposed to be a DAG, and admin is the root node | 19:11 |
| ayoung | heh | 19:11 |
| notmorgan | ftr i'm not apposed to it | 19:11 |
| ayoung | notmorgan, I'll propose it. thanks | 19:11 |
| notmorgan | just not sure what the "best" / "correct for now" / "whatever" option is | 19:11 |
| *** timcline has joined #openstack-keystone | 19:12 | |
| htruta | ayoung: but do you agree that the query parameter just seems conceptually wrong: | 19:12 |
| RichardRaseley | htruta: Hmm... I don't seem to have access to that method... | 19:12 |
| RichardRaseley | 'revoke' | 19:12 |
| *** dims has joined #openstack-keystone | 19:13 | |
| *** r-daneel has quit IRC | 19:18 | |
| *** ninag has quit IRC | 19:21 | |
| htruta | lbragstad: who's the rest guru here? I'm looking for some guideline that says that "we only have query params for GET and HEAD calls in REST APIs" as in the spec | 19:21 |
| *** ninag has joined #openstack-keystone | 19:21 | |
| *** ninag has quit IRC | 19:22 | |
| *** ninag has joined #openstack-keystone | 19:22 | |
| notmorgan | And get must mirror head except no body returned. | 19:22 |
| openstackgerrit | henry-nash proposed openstack/keystone: Verify project unique constraints for projects acting as domains https://review.openstack.org/158372 | 19:23 |
| *** dims has quit IRC | 19:24 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add tests in preparation of projects acting as a domain https://review.openstack.org/272369 | 19:27 |
| *** browne has joined #openstack-keystone | 19:27 | |
| lbragstad | htruta i'm not sure - notmorgan do you have any advice on that? | 19:28 |
| notmorgan | What is the question? | 19:28 |
| *** simondodsley has quit IRC | 19:28 | |
| lbragstad | notmorgan what makes more sense... | 19:28 |
| lbragstad | notmorgan DELETE /v3/projects/{project_id}/cascade or DELETE /v3/projects/{project_id}?cascade | 19:29 |
| notmorgan | Uhmm not the query string | 19:30 |
| notmorgan | Cascade is an action | 19:30 |
| lbragstad | ok | 19:32 |
| notmorgan | OK reading a bit more | 19:34 |
| notmorgan | Often query string are used in this context | 19:35 |
| notmorgan | E.g. ?wipeData=true | 19:35 |
| notmorgan | So, no "wrong" way to do it | 19:35 |
| notmorgan | And the more I think the more the query string is correct because this isn't a resource called "cascade" | 19:36 |
| notmorgan | Sorry for backtracking. | 19:36 |
| lbragstad | notmorgan no - that makes sense | 19:36 |
| lbragstad | notmorgan that's the big reason why I wasn't sure about DELETE /projects/{project_id}/cascade | 19:37 |
| lbragstad | because it would seem like something owned by a project | 19:37 |
| lbragstad | notmorgan so maybe a better example would be DELETE /project/{project_id}?cascade=true | 19:37 |
| htruta | lbragstad, notmorgan: I see the cascade here as another operation, not a subset of the original | 19:39 |
| *** daemontool_ has joined #openstack-keystone | 19:39 | |
| notmorgan | lbragstad: ++ | 19:40 |
| notmorgan | Or delete projects is the cascade | 19:40 |
| *** clenimar has joined #openstack-keystone | 19:40 | |
| htruta | henrynash: any thoughts on the discussion DELETE /v3/projects/{project_id}/cascade or DELETE /v3/projects/{project_id}?cascade ? | 19:41 |
| htruta | henrynash: since you were active at the spec | 19:41 |
| *** daemontool has quit IRC | 19:43 | |
| henrynash | htruta: so one thing to consider is that you will ikely want a separate piolciy rule for cascade operations | 19:43 |
| henrynash | htruta: I know that doesn’t clinch the argumetn, since you can ensure a separate pokicy rule for either proposed API | 19:43 |
| *** ninag has quit IRC | 19:44 | |
| *** ninag has joined #openstack-keystone | 19:45 | |
| lbragstad | can our current routers.py route API calls to a specific controller method if a particular query string is present? | 19:45 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:45 |
| htruta | lbragstad: I don't think so... that's why I couldn't make it in a single method too | 19:45 |
| lbragstad | htruta ah - so *if* we able to do that we'd be able to enforce policy like we normally do | 19:46 |
| lbragstad | we were* | 19:46 |
| henrynash | htruta: for better, for worse we do support GET /role_assignments?project_id=XYZ&include_subtree=trye | 19:46 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:46 |
| htruta | lbragstad: I guess we can make the enforcement of it using the context | 19:48 |
| henrynash | lbragstad, htruta: you can make a seperate route work - see role_assigmnet list methods | 19:48 |
| lbragstad | henrynash with a query string? | 19:48 |
| henrynash | lbragstad: you have to be sneaky! | 19:48 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:49 |
| henrynash | lbragstad: basically you have an (unppriected) wrapper method that then calls the different (protected) methods for differnet varuiants of the API | 19:49 |
| lbragstad | henrynash huh - interesting... | 19:49 |
| lbragstad | htruta ^ that might be an option? | 19:49 |
| henrynash | lbragstad: see list_role_assignments_wrapper() in assignment/controller.py | 19:50 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:50 |
| henrynash | lbragstad, htruta: which is doing exactly what you would need to do…for a very simialr reason | 19:51 |
| htruta | lbragstad: sure it is an option for the enforcement stuff | 19:51 |
| *** henrynash has quit IRC | 19:52 | |
| htruta | henrynash, lbragstad: I'm just thinking if it conceptually makes sense (looks like it does) and a little bit concerned that we go against the spec | 19:52 |
| *** gokrokve has joined #openstack-keystone | 19:52 | |
| *** edmondsw has quit IRC | 19:53 | |
| *** ninag has quit IRC | 19:54 | |
| *** ninag has joined #openstack-keystone | 19:55 | |
| *** henrynash has joined #openstack-keystone | 19:55 | |
| *** ChanServ sets mode: +v henrynash | 19:55 | |
| *** gokrokve has quit IRC | 19:56 | |
| *** avarner has joined #openstack-keystone | 19:57 | |
| *** ninag has quit IRC | 19:58 | |
| *** rcernin has quit IRC | 19:58 | |
| *** ninag has joined #openstack-keystone | 19:59 | |
| *** pgbridge_ has quit IRC | 19:59 | |
| *** ninag_ has joined #openstack-keystone | 20:01 | |
| *** gokrokve has joined #openstack-keystone | 20:02 | |
| *** henrynash has quit IRC | 20:02 | |
| *** jsavak has quit IRC | 20:02 | |
| *** ninag_ has quit IRC | 20:02 | |
| *** ninag_ has joined #openstack-keystone | 20:02 | |
| *** jsavak has joined #openstack-keystone | 20:03 | |
| *** ninag has quit IRC | 20:03 | |
| *** vgridnev has joined #openstack-keystone | 20:06 | |
| *** diazjf has quit IRC | 20:11 | |
| ayoung | GAH | 20:15 |
| ayoung | htruta, I am not happy | 20:15 |
| htruta | ayoung: why is that? open your heart | 20:16 |
| ayoung | htruta, DID YOU JUST IGNORE ME! | 20:16 |
| *** pgbridge_ has joined #openstack-keystone | 20:16 | |
| ayoung | htruta, I did not press submit fast enoujgh and the review went through | 20:16 |
| raildo | lol | 20:16 |
| ayoung | htruta, it shoud not be a separate path | 20:16 |
| htruta | ayoung: lol | 20:16 |
| ayoung | henry nash should have known better, too | 20:16 |
| ayoung | laugh all you want, I'm not happyt | 20:17 |
| ayoung | you asked my opinion | 20:17 |
| ayoung | and I made it clear | 20:17 |
| ayoung | I don't have infinite bandwith | 20:17 |
| ayoung | it should not be a separate policy rule | 20:17 |
| ayoung | it should not be a separate URL | 20:17 |
| ayoung | see my responses on the last revision | 20:18 |
| htruta | ayoung: sorry. I just got convinced that, as notmorgan said, it'd make sense to have this as a filter | 20:18 |
| htruta | ayoung: will look your review | 20:18 |
| *** lhcheng_ has joined #openstack-keystone | 20:18 | |
| ayoung | as a filter or not as a filter? | 20:18 |
| ayoung | htruta, they are wrong | 20:19 |
| ayoung | I know it is a pain getting things in to Keystone, but when I make a point, please take it to heart | 20:19 |
| ayoung | and neither of the others are here to argue with now... | 20:20 |
| ayoung | gah | 20:20 |
| ayoung | htruta, ok...I'm assigning you homework | 20:20 |
| htruta | ayoung: we decided to do it as a filter enforcing a new rule | 20:20 |
| ayoung | htruta, https://en.wikipedia.org/wiki/Visitor_pattern | 20:20 |
| htruta | ayoung: looks like we're not doing a new rule | 20:20 |
| *** jbell8 has quit IRC | 20:21 | |
| ayoung | so, no. it is not a new route, it should be a query param, and we should be able to mix in multiple | 20:21 |
| *** jbell8 has joined #openstack-keystone | 20:21 | |
| ayoung | hmmmm | 20:21 |
| *** lhcheng has quit IRC | 20:21 | |
| ayoung | OK...I think I can work with this. | 20:21 |
| *** gildub has joined #openstack-keystone | 20:22 | |
| ayoung | we can say that /cascade implies it should be done on all below, regardless of the operation, and additional query params can determine if it applies etc | 20:22 |
| ayoung | but the policy needs to be the policy for the child node | 20:22 |
| *** timcline has quit IRC | 20:22 | |
| ayoung | now a new policy rule... | 20:22 |
| ayoung | that should be | 20:22 |
| htruta | ayoung: now, I'm officially confused | 20:22 |
| ayoung | *not* a new policy rule... | 20:23 |
| *** mhickey has joined #openstack-keystone | 20:24 | |
| ayoung | htruta, if you do DELETE projects/<project_id> it is just that project, and fails if there are children. If you do DELETE projects/<project_id>/cascade it should fail if it would fail on any of the child nodes | 20:24 |
| ayoung | not a new policy rule | 20:24 |
| ayoung | got me so far? | 20:24 |
| htruta | ayoung: yes | 20:25 |
| ayoung | OK, so what I am saying that I *can* work with is that /cascade implies "apply this operation to child nodes" and you could add additional filters on top of that | 20:25 |
| ayoung | its kindof dumb | 20:25 |
| ayoung | it should be ?cascade&filter1 but hey | 20:26 |
| ayoung | because some of the filters would probably imply recurse anyway | 20:26 |
| ayoung | its just frustrating when you pull me into a discussion, I make a point, go to submit it on the code review, and see the review has merged | 20:27 |
| htruta | ayoung: that shouldn't be a problem, because we don't allow any filter on delete/update projects so far | 20:27 |
| htruta | we'd only allow the ?cascade param | 20:27 |
| ayoung | htruta, I suspect we are doing a one off here. We really need to think about all the operations across a tree. DOing that in a consistent manner | 20:28 |
| ayoung | adding a ?cascade parameter to to, say assign role to user in project (explicit, as opposed to inherited) for example | 20:28 |
| ayoung | or anything else we want to do across the tree. | 20:28 |
| ayoung | we really don't want to have to create a new URL for everything | 20:29 |
| ayoung | apopplying policy check across the tree should not be too hard. | 20:29 |
| ayoung | We probably want something like : | 20:29 |
| ayoung | check_policy_for_tree(rule, root_project, context) | 20:30 |
| *** mylu has joined #openstack-keystone | 20:30 | |
| ayoung | that we could use for whenever the cascade parameter is allowed | 20:30 |
| ayoung | htruta, meh, whatever..I'm headed back to implied roles | 20:31 |
| *** diazjf has joined #openstack-keystone | 20:31 | |
| raildo | lbragstad: I think that I have found a error... when we are using fernet tokens with trust on the authenticate method, the trust will be consumed: https://github.com/openstack/keystone/blob/master/keystone/token/controllers.py#L148-L149 | 20:31 |
| htruta | ayoung: I see | 20:32 |
| *** rcernin has joined #openstack-keystone | 20:33 | |
| raildo | lbragstad: but here: https://github.com/openstack/keystone/blob/master/keystone/trust/backends/sql.py#L91-L93 this query_result is none, but we have a trust_id... | 20:33 |
| ayoung | htruta, your homework is to explain to me how the visitor pattern applies here, and for HTM in general. | 20:33 |
| ayoung | https://en.wikipedia.org/wiki/Visitor_pattern | 20:33 |
| *** flwang has left #openstack-keystone | 20:33 | |
| htruta | ayoung: ok :) | 20:33 |
| *** jsavak has quit IRC | 20:33 | |
| *** roxanaghe has quit IRC | 20:34 | |
| *** jsavak has joined #openstack-keystone | 20:34 | |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 20:34 |
| *** gokrokve has quit IRC | 20:34 | |
| raildo | lbragstad: I'll try verify where on the code we should be using this TrustModel table | 20:36 |
| *** harlowja_ has joined #openstack-keystone | 20:36 | |
| *** gokrokve has joined #openstack-keystone | 20:36 | |
| *** harlowja has quit IRC | 20:37 | |
| *** jbell8 has quit IRC | 20:38 | |
| *** jbell8_ has joined #openstack-keystone | 20:38 | |
| raildo | lbragstad: btw this is one of the tests that are broken on this behavior: https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_auth.py#L1135 | 20:38 |
| *** mylu has quit IRC | 20:42 | |
| ayoung | htruta, raildo I have been laughing at myself for the past 5 minutes....didn't realize that spec had merged last summer | 20:43 |
| ayoung | sorry for overreaction. I need to pay attention to details | 20:43 |
| raildo | ayoung: np :) | 20:44 |
| *** mylu has joined #openstack-keystone | 20:44 | |
| ayoung | where is the corresponding code review raildo ? | 20:44 |
| htruta | ayoung: here it is: https://review.openstack.org/#/c/244248/11/doc/source/policy_mapping.rst | 20:44 |
| *** harlowja has joined #openstack-keystone | 20:45 | |
| *** harlowja_ has quit IRC | 20:45 | |
| raildo | ayoung: for the fernet error? | 20:45 |
| *** AJaeger has joined #openstack-keystone | 20:46 | |
| AJaeger | hi keystone cores, could I get another +2 on a keystoneauth patch to remove argparse, please? https://review.openstack.org/270370 | 20:46 |
| *** mylu has quit IRC | 20:47 | |
| ayoung | raildo, I won't -2, but please consider that comment sticky until addressed or you get me to retract it | 20:47 |
| ayoung | raildo, no ,on cascade | 20:47 |
| htruta | ayoung: that's on me and pauloegf | 20:48 |
| ayoung | htruta, deal. | 20:48 |
| htruta | raildo is kind of innocent in that | 20:48 |
| raildo | ayoung: htruta this is open source, I can fix it ¬¬ | 20:48 |
| raildo | (i'm kidding) | 20:48 |
| ayoung | htruta, tree operations should, in general, follow the pattern you would see using a file system, but better to be more transactional | 20:49 |
| ayoung | so check permissions on each node of the tree, then execute on each | 20:49 |
| *** mylu has joined #openstack-keystone | 20:49 | |
| htruta | ayoung: got it | 20:50 |
| *** raildo is now known as raildo-afk | 20:54 | |
| *** diazjf has quit IRC | 20:54 | |
| *** bknudson has joined #openstack-keystone | 20:55 | |
| *** ChanServ sets mode: +v bknudson | 20:55 | |
| *** clenimar has quit IRC | 20:57 | |
| *** daemontool has joined #openstack-keystone | 21:00 | |
| *** daemontool_ has quit IRC | 21:03 | |
| *** AJaeger has left #openstack-keystone | 21:04 | |
| *** pauloegf has quit IRC | 21:05 | |
| *** diazjf has joined #openstack-keystone | 21:06 | |
| *** daemontool_ has joined #openstack-keystone | 21:07 | |
| *** jsavak has quit IRC | 21:09 | |
| *** jsavak has joined #openstack-keystone | 21:10 | |
| *** daemontool has quit IRC | 21:10 | |
| mfisch | hey keystoners (who are not flying): you ever seen a case where the catalog is okay but endpoint-list is blank? | 21:11 |
| mfisch | the db is also ok | 21:11 |
| *** timcline has joined #openstack-keystone | 21:23 | |
| mfisch | nm | 21:23 |
| mfisch | v3 vs v2 issue | 21:23 |
| *** boris-42 has quit IRC | 21:23 | |
| *** richm has quit IRC | 21:25 | |
| *** timcline has quit IRC | 21:28 | |
| *** rcernin has quit IRC | 21:28 | |
| *** timcline has joined #openstack-keystone | 21:30 | |
| *** avarner_ has joined #openstack-keystone | 21:30 | |
| *** lhcheng_ has quit IRC | 21:31 | |
| *** lhcheng has joined #openstack-keystone | 21:32 | |
| *** ChanServ sets mode: +v lhcheng | 21:32 | |
| *** EinstCrazy has joined #openstack-keystone | 21:32 | |
| *** vgridnev has quit IRC | 21:33 | |
| *** avarner has quit IRC | 21:34 | |
| *** timcline has quit IRC | 21:35 | |
| *** avarner_ has quit IRC | 21:38 | |
| *** jaosorior_ has quit IRC | 21:39 | |
| *** mylu has quit IRC | 21:41 | |
| *** timcline has joined #openstack-keystone | 21:49 | |
| *** ayoung has quit IRC | 21:51 | |
| lbragstad | mfisch got it figured out? | 21:51 |
| *** richm has joined #openstack-keystone | 21:54 | |
| *** e0ne has quit IRC | 21:57 | |
| mfisch | lbragstad: yeah puppet is using v3 to make endpoints and v2 api call can't figure it out | 21:58 |
| mfisch | so keystone endpoint-list wont work | 21:58 |
| mfisch | I'm going to start dropping a v3 API openrc file into place too | 21:58 |
| *** ayoung has joined #openstack-keystone | 21:58 | |
| *** ChanServ sets mode: +v ayoung | 21:58 | |
| *** avarner has joined #openstack-keystone | 21:59 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 21:59 |
| lbragstad | mfisch ah - ok makes sense | 22:00 |
| mfisch | I told the team WWAYD v3!!! | 22:01 |
| *** tonytan4ever has quit IRC | 22:05 | |
| *** gokrokve has quit IRC | 22:06 | |
| *** mylu has joined #openstack-keystone | 22:06 | |
| *** diazjf has quit IRC | 22:07 | |
| *** su_zhang has quit IRC | 22:08 | |
| *** diazjf has joined #openstack-keystone | 22:10 | |
| *** alexvictorchan has joined #openstack-keystone | 22:14 | |
| *** mylu has quit IRC | 22:14 | |
| *** mhickey has quit IRC | 22:15 | |
| *** mylu has joined #openstack-keystone | 22:16 | |
| bknudson | openrc should set OS_CLOUD | 22:16 |
| *** jsavak has quit IRC | 22:17 | |
| *** jsavak has joined #openstack-keystone | 22:18 | |
| jamielennox | mfisch, bknudson: agreed, don't worry too much about a v3 openrc, switch to using OS_CLOUD | 22:21 |
| *** daemontool has joined #openstack-keystone | 22:23 | |
| *** jbell8_ has quit IRC | 22:25 | |
| *** daemontool_ has quit IRC | 22:27 | |
| *** timcline has quit IRC | 22:31 | |
| *** gokrokve has joined #openstack-keystone | 22:31 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update bandit.yaml https://review.openstack.org/267044 | 22:35 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Enable bandit tests https://review.openstack.org/267051 | 22:35 |
| *** jsavak has quit IRC | 22:35 | |
| *** gokrokve has quit IRC | 22:36 | |
| *** jsavak has joined #openstack-keystone | 22:36 | |
| tjcocozz | Tom Cocozzello proposed openstack/python-openstackclient: Return names in list role assignments https://review.openstack.org/#/c/255363 :-) | 22:38 |
| *** e0ne has joined #openstack-keystone | 22:39 | |
| *** daemontool_ has joined #openstack-keystone | 22:39 | |
| *** su_zhang has joined #openstack-keystone | 22:41 | |
| *** daemontool has quit IRC | 22:42 | |
| *** tonytan4ever has joined #openstack-keystone | 22:47 | |
| *** ninag_ has quit IRC | 22:48 | |
| *** ninag has joined #openstack-keystone | 22:48 | |
| *** mylu has quit IRC | 22:52 | |
| *** henrynash has joined #openstack-keystone | 22:52 | |
| *** ChanServ sets mode: +v henrynash | 22:52 | |
| *** ninag has quit IRC | 22:52 | |
| *** pnavarro has quit IRC | 22:54 | |
| *** boris-42 has joined #openstack-keystone | 22:54 | |
| *** dims has joined #openstack-keystone | 22:55 | |
| *** alexvictorchan has quit IRC | 22:55 | |
| *** mylu has joined #openstack-keystone | 22:55 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 22:55 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 22:56 |
| *** tonytan4ever has quit IRC | 22:59 | |
| *** doug-fish has quit IRC | 23:00 | |
| *** e0ne has quit IRC | 23:02 | |
| *** ebalduf has joined #openstack-keystone | 23:06 | |
| *** jsavak has quit IRC | 23:19 | |
| *** avarner has quit IRC | 23:21 | |
| *** diazjf has quit IRC | 23:22 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/272790 | 23:24 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/272791 | 23:24 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/272792 | 23:24 |
| *** mylu has quit IRC | 23:26 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/272817 | 23:28 |
| *** gokrokve has joined #openstack-keystone | 23:28 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:28 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf: Updated from global requirements https://review.openstack.org/272824 | 23:28 |
| *** roxanaghe has joined #openstack-keystone | 23:28 | |
| *** darrenc is now known as darrenc_afk | 23:28 | |
| *** ebalduf has quit IRC | 23:28 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/272825 | 23:28 |
| *** spzala has quit IRC | 23:28 | |
| *** spzala has joined #openstack-keystone | 23:29 | |
| *** spzala has quit IRC | 23:29 | |
| *** spzala has joined #openstack-keystone | 23:29 | |
| *** ebalduf has joined #openstack-keystone | 23:31 | |
| *** ebalduf has quit IRC | 23:32 | |
| *** gokrokve has quit IRC | 23:33 | |
| *** alexvictorchan has joined #openstack-keystone | 23:33 | |
| *** pushkaru has quit IRC | 23:36 | |
| *** darrenc_afk is now known as darrenc | 23:36 | |
| *** pushkaru has joined #openstack-keystone | 23:36 | |
| navidp | jamielennox, | 23:36 |
| *** mylu has joined #openstack-keystone | 23:38 | |
| navidp | jamielennox, hi have q auestion, where this options.url is getting value or initialized https://github.com/openstack/python-openstackclient/blob/master/openstackclient/shell.py#L211-L215 | 23:38 |
| jamielennox | navidp: oh, bah, that's kinda stupid | 23:39 |
| jamielennox | ok | 23:39 |
| *** mylu has quit IRC | 23:39 | |
| navidp | jamielennox, looking at tests in openstack client put a traceback in use service token part it never gets called | 23:41 |
| jamielennox | navidp: so here OSC is looping through every plugin in the system and installing every possible option into the --help text | 23:42 |
| jamielennox | https://github.com/openstack/python-openstackclient/blob/master/openstackclient/api/auth.py#L52 | 23:42 |
| jamielennox | this is terrible and has been discussed a few times | 23:42 |
| jamielennox | OSC registers its own plugin https://github.com/openstack/python-openstackclient/blob/master/openstackclient/api/auth_plugin.py#L53 that has url and token options | 23:43 |
| *** pushkaru has quit IRC | 23:43 | |
| jamielennox | so basically it's saying if the users have set url and token but not auth_type == token_endpoint then set it for them | 23:43 |
| jamielennox | and that's a compatability thing because of how OSC worked prior to plugins | 23:44 |
| jamielennox | navidp: if you can kill off that loop through all plugins that would be great | 23:44 |
| navidp | jamielennox, i would defenitely wanna do that, so is it getting used with current plugins? | 23:46 |
| navidp | jamielennox, shouldnt it get the default domain from conf instead of hard coding it ? https://github.com/openstack/python-openstackclient/blob/master/openstackclient/shell.py#L41 | 23:47 |
| jamielennox | navidp: so yea, by setting auth_type = token_endpoint L213 it means that it's going to use the OSC specific plugin | 23:47 |
| *** mylu has joined #openstack-keystone | 23:48 | |
| navidp | jamielennox, is there ant tests in osc that tests this L213 ? | 23:48 |
| jamielennox | in ksa we 'compromised' and now the admin_token plugin access URL/TOKEN https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/loading/_plugins/admin_token.py#L26 | 23:48 |
| jamielennox | navidp: i'm not sure | 23:48 |
| jamielennox | delete it and check | 23:49 |
| navidp | jamielennox, put a traceback didnt get caught | 23:49 |
| openstackgerrit | henry-nash proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 23:49 |
| jamielennox | navidp: not good - but not surprising | 23:49 |
| navidp | jamielennox, thanks i think this was the part that i was looking :) | 23:50 |
| jamielennox | navidp: so you can tell from the ksa register function whether a plugin is chosen, but i don't know if you can tell from os-client-config | 23:52 |
| *** lhcheng has quit IRC | 23:52 | |
| jamielennox | https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/loading/cli.py#L46 | 23:53 |
| jamielennox | so from a pure KSA perspective the way i'd do that is | 23:53 |
| jamielennox | if not loading.register_argparse_arguments(..): | 23:53 |
| jamielennox | parser.add_argument('--os-url', default=env.get('OS_URL')) | 23:54 |
| navidp | jamielennox, i will try this and see what i get, thanks for your help | 23:55 |
| jamielennox | same for token and that way when load_from_argparse_arguments failed you would be able to check the value of options.os_url and options.os_token wihtout relying on the plugins being registered | 23:55 |
| *** shoutm has joined #openstack-keystone | 23:55 | |
| jamielennox | i'm not familiar enough with how os-c-c handle argparse to know if that would work the same way | 23:56 |
| *** pushkaru has joined #openstack-keystone | 23:56 | |
| navidp | jamielennox, do you know who should i contact for it ? | 23:57 |
| jamielennox | for os-c-c? mordred and maybe greghaynes | 23:58 |
| navidp | jamielennox, ok will do | 23:58 |
| jamielennox | it's likely you're pushing the boundaries of it, so generally figure out what you need and he'll readily take patches | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!