| notmorgan | and revoke tree was particularly bad | 00:00 |
|---|---|---|
| jamielennox | what does json not handle in revoke tree? | 00:00 |
| notmorgan | it thinks it is self-referential | 00:00 |
| notmorgan | msgpack lets me yank apart the revoke tree on serialization | 00:00 |
| notmorgan | json i would need to know it was a revoke tree ahead of time | 00:00 |
| notmorgan | it's all written as 10% pure internal interfaces so we can change is as we see fit | 00:01 |
| *** browne has joined #openstack-keystone | 00:01 | |
| notmorgan | 100%* | 00:01 |
| *** doug-fish has joined #openstack-keystone | 00:01 | |
| *** jbell8 has quit IRC | 00:02 | |
| stevemar | notmorgan: jamielennox this should be easy peasy: https://review.openstack.org/#/c/277574/1 | 00:09 |
| *** mylu has quit IRC | 00:09 | |
| jamielennox | stevemar: willing to +2 if you want to test it out live | 00:11 |
| stevemar | jamielennox: yeah, that's what i was hoping to hear :) | 00:12 |
| jamielennox | i thought it seems to be missing something to kick off the config file generation | 00:12 |
| stevemar | jamielennox: if the link 404's i'll self approve a removal of the line | 00:12 |
| stevemar | jamielennox: thats done by the change in conf.py | 00:12 |
| jamielennox | is the config opts enough? | 00:12 |
| stevemar | apparently | 00:12 |
| jamielennox | alright, we can try it out | 00:12 |
| stevemar | https://github.com/openstack/nova/commit/9a3ed7631a7654cf7656ece6875cb09ee301f991 | 00:13 |
| stevemar | jamielennox: ^ | 00:13 |
| stevemar | pretty much copy pasta | 00:13 |
| *** daemontool has joined #openstack-keystone | 00:17 | |
| *** mylu has joined #openstack-keystone | 00:18 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add a test that uses trusts and implies roles https://review.openstack.org/277319 | 00:20 |
| *** doug-fish has quit IRC | 00:22 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Replace exit() by sys.exit() https://review.openstack.org/274519 | 00:24 |
| *** doug-fish has joined #openstack-keystone | 00:24 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Replace exit() with sys.exit() https://review.openstack.org/274519 | 00:25 |
| *** doug-fish has quit IRC | 00:25 | |
| *** doug-fish has joined #openstack-keystone | 00:26 | |
| *** doug-fish has quit IRC | 00:27 | |
| stevemar | dstanek: feel free to approve that one... ^ i won't tattle tale on you for changing 4 lines | 00:27 |
| dstanek | stevemar: that's twice as many as the original commit :-) | 00:29 |
| stevemar | hehe | 00:29 |
| stevemar | dstanek: meh, minor | 00:29 |
| dstanek | stevemar: i'll let the tests run and then go ahead and approve if there's no more work to do | 00:29 |
| stevemar | dstanek: sounds good to me boss | 00:29 |
| *** doug-fish has joined #openstack-keystone | 00:30 | |
| *** shoutm has joined #openstack-keystone | 00:34 | |
| *** bill_az has quit IRC | 00:35 | |
| *** jasonsb has joined #openstack-keystone | 00:38 | |
| *** doug-fish has quit IRC | 00:40 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Small typos on the ldap.url config option help https://review.openstack.org/277639 | 00:43 |
| *** doug-fish has joined #openstack-keystone | 00:45 | |
| *** itlinux has joined #openstack-keystone | 00:52 | |
| *** clenimar has quit IRC | 00:53 | |
| *** shoutm_ has joined #openstack-keystone | 00:59 | |
| *** shoutm has quit IRC | 01:00 | |
| *** browne has quit IRC | 01:01 | |
| *** browne has joined #openstack-keystone | 01:03 | |
| *** doug-fish has quit IRC | 01:13 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Trying py27/34 with oslo-master https://review.openstack.org/277648 | 01:25 |
| *** su_zhang has quit IRC | 01:25 | |
| *** clenimar has joined #openstack-keystone | 01:29 | |
| *** gildub has quit IRC | 01:35 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Avoid wrong deletion of domain assignments https://review.openstack.org/275706 | 01:38 |
| stevemar | dstanek: it passed | 01:58 |
| dstanek | stevemar: approved | 01:59 |
| stevemar | ty | 01:59 |
| *** shoutm_ has quit IRC | 02:02 | |
| *** shoutm has joined #openstack-keystone | 02:02 | |
| *** gyee has quit IRC | 02:06 | |
| *** doug-fish has joined #openstack-keystone | 02:14 | |
| stevemar | dolphm: dstanek lbragstad notmorgan TOTP patch up, and it needs eyes on it: https://review.openstack.org/#/c/274901/3 | 02:15 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Trying py27/34 with oslo-master https://review.openstack.org/277648 | 02:16 |
| *** doug-fish has quit IRC | 02:19 | |
| *** doug-fish has joined #openstack-keystone | 02:25 | |
| *** browne has quit IRC | 02:27 | |
| *** mylu has quit IRC | 02:32 | |
| notmorgan | stevemar: uhm... release notes makes no sense to me, it keeps erroring in less-than-useful ways | 02:35 |
| stevemar | notmorgan: referring to something specific? | 02:35 |
| notmorgan | /home/jenkins/workspace/gate-keystone-releasenotes/releasenotes/source/unreleased.rst:96: WARNING: Definition list ends without a blank line; unexpected unindent. | 02:35 |
| *** mylu has joined #openstack-keystone | 02:35 | |
| notmorgan | can't figure out what is going on. the previous changeset works. this one doesn't. I've looked and the - > ... bit is the same as the once above it. | 02:36 |
| notmorgan | last time this happened a random rebase solved it... but afaict it didn't change anything | 02:37 |
| stevemar | notmorgan: commented no https://review.openstack.org/#/c/277615/1 | 02:37 |
| stevemar | on* | 02:37 |
| notmorgan | nope | 02:38 |
| notmorgan | fixed that and it still fails locally | 02:38 |
| stevemar | notmorgan: i'll pull it down | 02:38 |
| notmorgan | new clean venv | 02:38 |
| notmorgan | reno does not produce useful errors :( | 02:39 |
| notmorgan | WTF. it worked this time | 02:39 |
| notmorgan | zero changes | 02:39 |
| notmorgan | the files have the same md5 hash | 02:39 |
| notmorgan | i changed nothing and it works. | 02:39 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Rollup URL_NORMALIZER middleware https://review.openstack.org/277615 | 02:39 |
| * notmorgan shrugs and gives up. | 02:40 | |
| stevemar | lol | 02:40 |
| notmorgan | so anyway... | 02:40 |
| notmorgan | you have lots of deprecation code to review :P | 02:40 |
| notmorgan | and i have one more bug fix/cleanup patch to layer on top to make S3 actually have a v3 controller | 02:41 |
| stevemar | notmorgan: wat.... i am getting the same error now | 02:41 |
| *** edmondsw has quit IRC | 02:41 | |
| notmorgan | stevemar: right!? | 02:41 |
| notmorgan | then it randomly worked. | 02:41 |
| notmorgan | the last time was a "update:" whas a unicode error | 02:42 |
| stevemar | notmorgan: i had a comment in one of the patches, there's redundant code in middleware | 02:42 |
| stevemar | notmorgan: https://github.com/openstack/keystone/blob/master/keystone/middleware/core.py#L84 | 02:43 |
| notmorgan | yeah i saw that | 02:43 |
| notmorgan | not sure what it was meant to be for | 02:43 |
| notmorgan | i was planning on taking a closer look but ... i mean... does it do anything? | 02:43 |
| stevemar | notmorgan: if it used, rip it out | 02:44 |
| stevemar | if its not* used... | 02:44 |
| notmorgan | riht it isn't in our pipeline | 02:44 |
| *** clenimar has quit IRC | 02:44 | |
| notmorgan | so i just hadn't figured out why someone would be using it | 02:44 |
| notmorgan | maybe its the predecessor to JsonBody? | 02:45 |
| stevemar | notmorgan: oh right, the release notes only take effect once commited | 02:45 |
| *** doug-fish has quit IRC | 02:45 | |
| notmorgan | stevemar: /me facepalms | 02:45 |
| stevemar | notmorgan: so changing it, and running tox -e releasenotes won't fix it :) | 02:46 |
| stevemar | gotta commit! | 02:46 |
| stevemar | hehe | 02:46 |
| *** doug-fish has joined #openstack-keystone | 02:46 | |
| notmorgan | yeah i think PostParams is what JsonBody ended up doing + json decode | 02:46 |
| *** fawadkhaliq has joined #openstack-keystone | 02:47 | |
| stevemar | notmorgan: poking again for https://review.openstack.org/#/c/277574/ | 02:47 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove PostParams middleware https://review.openstack.org/277664 | 02:49 |
| notmorgan | stevemar: ^ | 02:49 |
| *** doug-fish has quit IRC | 02:50 | |
| notmorgan | stevemar: sorry that is kindof deep on the stack but trying to avoid rebase for the sake of rebasing | 02:50 |
| stevemar | notmorgan: np | 02:51 |
| *** clenimar has joined #openstack-keystone | 02:51 | |
| notmorgan | stevemar: so that unwinds a ton of ick. next ick to unwind the @protected decorator, which now can be unwound more easily because the middleware has been unwound. | 02:52 |
| stevemar | notmorgan: no desire to review the totp patch :) | 02:53 |
| notmorgan | the S3 one? | 02:53 |
| notmorgan | that one has resolved the legal stick-y-ness and also documented it so someone doesn't try and roll it back in | 02:53 |
| stevemar | notmorgan: sorry, TOTP, https://review.openstack.org/#/c/274901/ | 02:53 |
| notmorgan | and break it. | 02:53 |
| notmorgan | oh TOTP | 02:53 |
| notmorgan | hah | 02:53 |
| notmorgan | i need food and beer first | 02:53 |
| stevemar | wasn't a typo lol | 02:53 |
| * notmorgan is not reading well. | 02:54 | |
| *** dan_nguyen has quit IRC | 02:55 | |
| notmorgan | lol i have code that looks *a lot* like that code | 02:57 |
| notmorgan | for my CLI google-auth thing | 02:57 |
| *** lhcheng has quit IRC | 02:59 | |
| *** EinstCrazy has joined #openstack-keystone | 03:02 | |
| notmorgan | stevemar: the javascript "find" on the page makes me sad | 03:03 |
| stevemar | notmorgan: what find? | 03:03 |
| notmorgan | in gerrit | 03:04 |
| notmorgan | the javascript search | 03:04 |
| notmorgan | vs. letting me use my browser's "search" function | 03:04 |
| *** shoutm has quit IRC | 03:05 | |
| notmorgan | stevemar: reviewed totp | 03:07 |
| *** EinstCrazy has quit IRC | 03:07 | |
| *** shoutm has joined #openstack-keystone | 03:10 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Missing 'region' in service and 'name' in endpoint for EndpointFilterCatalog https://review.openstack.org/265797 | 03:13 |
| *** browne has joined #openstack-keystone | 03:13 | |
| *** mylu has quit IRC | 03:14 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Return 404 instead of 401 for tokens w/o roles https://review.openstack.org/277436 | 03:26 |
| *** dims has joined #openstack-keystone | 03:27 | |
| *** dims_ has quit IRC | 03:28 | |
| *** dims has quit IRC | 03:30 | |
| *** ccard_ has joined #openstack-keystone | 03:31 | |
| *** doug-fish has joined #openstack-keystone | 03:32 | |
| *** mylu has joined #openstack-keystone | 03:33 | |
| *** su_zhang has joined #openstack-keystone | 03:34 | |
| *** ccard__ has quit IRC | 03:34 | |
| *** spandhe has quit IRC | 03:37 | |
| *** links has joined #openstack-keystone | 03:41 | |
| *** dims has joined #openstack-keystone | 03:43 | |
| *** mylu has quit IRC | 03:45 | |
| *** mylu has joined #openstack-keystone | 03:46 | |
| *** dims has quit IRC | 03:47 | |
| *** gildub has joined #openstack-keystone | 03:47 | |
| *** mylu has quit IRC | 03:49 | |
| *** mylu has joined #openstack-keystone | 03:49 | |
| *** dikonoor has joined #openstack-keystone | 03:51 | |
| *** diazjf has joined #openstack-keystone | 03:54 | |
| *** diazjf1 has joined #openstack-keystone | 03:55 | |
| *** doug-fish has quit IRC | 03:56 | |
| *** doug-fish has joined #openstack-keystone | 03:56 | |
| *** doug-fish has quit IRC | 03:57 | |
| *** diazjf has quit IRC | 03:58 | |
| *** diazjf1 has quit IRC | 03:58 | |
| *** doug-fis_ has joined #openstack-keystone | 04:00 | |
| *** doug-fis_ has quit IRC | 04:04 | |
| *** doug-fish has joined #openstack-keystone | 04:09 | |
| *** ayoung has quit IRC | 04:15 | |
| *** shoutm_ has joined #openstack-keystone | 04:19 | |
| *** mylu has quit IRC | 04:19 | |
| *** shoutm has quit IRC | 04:20 | |
| *** mylu has joined #openstack-keystone | 04:20 | |
| *** shoutm_ has quit IRC | 04:28 | |
| openstackgerrit | Merged openstack/keystone: Small typos on the ldap.url config option help https://review.openstack.org/277639 | 04:30 |
| *** daemontool has quit IRC | 04:32 | |
| *** shoutm has joined #openstack-keystone | 04:32 | |
| *** daemontool has joined #openstack-keystone | 04:32 | |
| *** dikonoor has quit IRC | 04:37 | |
| *** mylu has quit IRC | 04:38 | |
| *** fawadkhaliq has quit IRC | 04:42 | |
| *** mylu has joined #openstack-keystone | 04:42 | |
| openstackgerrit | Merged openstack/keystone: Replace exit() with sys.exit() https://review.openstack.org/274519 | 04:45 |
| openstackgerrit | Merged openstack/keystone: include sample config file in docs https://review.openstack.org/277574 | 04:45 |
| *** shoutm has quit IRC | 04:49 | |
| *** shoutm has joined #openstack-keystone | 04:53 | |
| *** mylu has quit IRC | 04:55 | |
| *** dan_nguyen has joined #openstack-keystone | 04:56 | |
| *** dulek has joined #openstack-keystone | 05:00 | |
| *** shoutm_ has joined #openstack-keystone | 05:00 | |
| *** roxanaghe has joined #openstack-keystone | 05:01 | |
| *** shoutm has quit IRC | 05:03 | |
| *** mylu has joined #openstack-keystone | 05:05 | |
| *** jgriffith is now known as jgriffith_away | 05:07 | |
| *** jbell8 has joined #openstack-keystone | 05:11 | |
| *** mylu has quit IRC | 05:13 | |
| *** jbell8 has quit IRC | 05:13 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:14 | |
| *** fawadkhaliq has quit IRC | 05:14 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:14 | |
| *** jbell8 has joined #openstack-keystone | 05:15 | |
| *** GB21 has joined #openstack-keystone | 05:19 | |
| *** mylu has joined #openstack-keystone | 05:20 | |
| *** daemontool_ has joined #openstack-keystone | 05:21 | |
| *** daemontool has quit IRC | 05:22 | |
| *** GB21 has quit IRC | 05:25 | |
| *** jbell8 has quit IRC | 05:34 | |
| *** jbell8 has joined #openstack-keystone | 05:34 | |
| *** Nirupama has joined #openstack-keystone | 05:36 | |
| *** GB21 has joined #openstack-keystone | 05:38 | |
| *** dan_nguyen has quit IRC | 05:40 | |
| *** roxanaghe has quit IRC | 05:42 | |
| *** mylu has quit IRC | 05:45 | |
| *** roxanaghe has joined #openstack-keystone | 05:46 | |
| *** mylu has joined #openstack-keystone | 05:46 | |
| *** doug-fish has quit IRC | 05:48 | |
| *** mylu has quit IRC | 05:49 | |
| *** clenimar has quit IRC | 05:49 | |
| *** mylu has joined #openstack-keystone | 05:53 | |
| *** jbell8 has quit IRC | 05:54 | |
| *** jbell8 has joined #openstack-keystone | 05:55 | |
| *** mylu has quit IRC | 05:55 | |
| *** doug-fish has joined #openstack-keystone | 05:55 | |
| *** shoutm_ has quit IRC | 05:57 | |
| *** shoutm has joined #openstack-keystone | 05:57 | |
| *** roxanaghe has quit IRC | 06:07 | |
| *** doug-fish has quit IRC | 06:08 | |
| *** dikonoor has joined #openstack-keystone | 06:09 | |
| *** shoutm has quit IRC | 06:20 | |
| *** shoutm has joined #openstack-keystone | 06:25 | |
| *** shoutm_ has joined #openstack-keystone | 06:36 | |
| *** roxanaghe has joined #openstack-keystone | 06:37 | |
| *** shoutm has quit IRC | 06:38 | |
| *** roxanaghe has quit IRC | 06:44 | |
| openstackgerrit | Kalaswan Datta proposed openstack/keystone: Clear the project ID from user information https://review.openstack.org/277707 | 06:51 |
| *** shoutm has joined #openstack-keystone | 06:56 | |
| openstackgerrit | Kalaswan Datta proposed openstack/keystone: Clear the project ID from user information https://review.openstack.org/277707 | 06:56 |
| *** shoutm_ has quit IRC | 06:58 | |
| *** rudolfvriend has joined #openstack-keystone | 07:27 | |
| *** jbell8 has quit IRC | 07:29 | |
| *** jbell8 has joined #openstack-keystone | 07:30 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: remove link that 404s in sample config https://review.openstack.org/277716 | 07:32 |
| *** richm has joined #openstack-keystone | 07:34 | |
| *** doug-fish has joined #openstack-keystone | 07:38 | |
| *** henrynash has joined #openstack-keystone | 07:40 | |
| *** ChanServ sets mode: +v henrynash | 07:40 | |
| *** belmoreira has joined #openstack-keystone | 07:41 | |
| *** doug-fis_ has joined #openstack-keystone | 07:42 | |
| *** doug-fish has quit IRC | 07:43 | |
| *** doug-fis_ has quit IRC | 07:47 | |
| *** nkinder has joined #openstack-keystone | 07:48 | |
| *** jbell8 has quit IRC | 07:51 | |
| *** jbell8 has joined #openstack-keystone | 07:52 | |
| *** su_zhang has quit IRC | 07:54 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Change get_project permission https://review.openstack.org/270057 | 07:57 |
| *** mvk has joined #openstack-keystone | 08:04 | |
| *** GB21 has quit IRC | 08:04 | |
| *** nkinder has quit IRC | 08:10 | |
| *** browne has quit IRC | 08:18 | |
| *** pnavarro has joined #openstack-keystone | 08:19 | |
| *** sinese_ has joined #openstack-keystone | 08:24 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove eventlet support https://review.openstack.org/249486 | 08:26 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove eventlet support https://review.openstack.org/249486 | 08:26 |
| *** oomichi has quit IRC | 08:28 | |
| *** shoutm has quit IRC | 08:34 | |
| *** shoutm has joined #openstack-keystone | 08:35 | |
| *** jaosorior has joined #openstack-keystone | 08:37 | |
| *** e0ne has joined #openstack-keystone | 08:49 | |
| *** mvk has quit IRC | 08:49 | |
| *** fhubik has joined #openstack-keystone | 08:56 | |
| *** shoutm_ has joined #openstack-keystone | 08:56 | |
| *** shoutm has quit IRC | 08:58 | |
| *** jaosorior has quit IRC | 09:03 | |
| *** fhubik is now known as fhubik_brb | 09:04 | |
| *** jaosorior has joined #openstack-keystone | 09:08 | |
| *** jaosorior has quit IRC | 09:08 | |
| *** jaosorior has joined #openstack-keystone | 09:09 | |
| *** fhubik_brb is now known as fhubik | 09:15 | |
| *** pnavarro has quit IRC | 09:16 | |
| *** mvk has joined #openstack-keystone | 09:17 | |
| *** dikonoor has quit IRC | 09:17 | |
| *** dikonoor has joined #openstack-keystone | 09:18 | |
| *** e0ne has quit IRC | 09:19 | |
| *** dikonoo has joined #openstack-keystone | 09:19 | |
| *** dikonoor has quit IRC | 09:23 | |
| *** mvk has quit IRC | 09:29 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Change get_project permission https://review.openstack.org/270057 | 09:30 |
| *** mvk has joined #openstack-keystone | 09:30 | |
| *** GB21 has joined #openstack-keystone | 09:32 | |
| *** pnavarro has joined #openstack-keystone | 09:33 | |
| *** mhickey has joined #openstack-keystone | 09:37 | |
| *** jsheeren has joined #openstack-keystone | 09:39 | |
| *** daemontool has joined #openstack-keystone | 09:39 | |
| *** jbell8 has quit IRC | 09:40 | |
| *** daemontool_ has quit IRC | 09:40 | |
| *** jbell8 has joined #openstack-keystone | 09:44 | |
| *** richm has quit IRC | 09:46 | |
| *** fawadkhaliq has quit IRC | 09:47 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:47 | |
| *** jbell8 has quit IRC | 09:51 | |
| *** fhubik is now known as fhubik_brb | 09:52 | |
| *** fhubik_brb is now known as fhubik | 09:52 | |
| *** fawadkhaliq has quit IRC | 10:01 | |
| *** jsheeren has quit IRC | 10:03 | |
| *** richm has joined #openstack-keystone | 10:03 | |
| *** jsheeren has joined #openstack-keystone | 10:06 | |
| *** GB21 has quit IRC | 10:12 | |
| *** GB21 has joined #openstack-keystone | 10:12 | |
| *** e0ne has joined #openstack-keystone | 10:21 | |
| *** GB21 has quit IRC | 10:23 | |
| *** GB21 has joined #openstack-keystone | 10:24 | |
| *** nkinder has joined #openstack-keystone | 10:28 | |
| *** jaosorior has quit IRC | 10:29 | |
| *** jaosorior has joined #openstack-keystone | 10:29 | |
| *** esp has joined #openstack-keystone | 10:30 | |
| *** brad[] has quit IRC | 10:33 | |
| *** samueldmq1 has joined #openstack-keystone | 10:33 | |
| *** brad[] has joined #openstack-keystone | 10:33 | |
| *** esp has quit IRC | 10:37 | |
| *** samueldmq1 has quit IRC | 10:38 | |
| *** dims has joined #openstack-keystone | 10:45 | |
| *** dims has quit IRC | 10:49 | |
| *** dims has joined #openstack-keystone | 10:50 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:50 | |
| *** richm has quit IRC | 11:06 | |
| *** mvk has quit IRC | 11:07 | |
| *** mvk has joined #openstack-keystone | 11:08 | |
| *** fawadkhaliq has quit IRC | 11:19 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:19 | |
| *** fawadkhaliq has quit IRC | 11:19 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:20 | |
| *** fhubik has quit IRC | 11:33 | |
| *** dims_ has joined #openstack-keystone | 11:40 | |
| *** dims has quit IRC | 11:40 | |
| *** boris-42 has quit IRC | 11:43 | |
| *** richm has joined #openstack-keystone | 11:48 | |
| *** GB21 has quit IRC | 11:51 | |
| *** xek_ is now known as xek | 11:51 | |
| *** pnavarro has quit IRC | 11:56 | |
| *** nkinder has quit IRC | 12:02 | |
| *** richm has quit IRC | 12:08 | |
| *** dims_ has quit IRC | 12:11 | |
| *** richm has joined #openstack-keystone | 12:13 | |
| *** nkinder has joined #openstack-keystone | 12:18 | |
| *** dims_ has joined #openstack-keystone | 12:19 | |
| *** gildub has quit IRC | 12:24 | |
| *** nkinder has quit IRC | 12:27 | |
| *** gordc has joined #openstack-keystone | 12:36 | |
| Anticimex | hey | 12:38 |
| *** openstackgerrit_ has joined #openstack-keystone | 12:38 | |
| Anticimex | trying to make a production deployment decision of kilo or liberty based on a *hard* keystone v3 requirement (federation). what's the correct choice from keystone v3 support point of view? | 12:38 |
| *** fawadkhaliq has quit IRC | 12:43 | |
| henrynash | Anticimex: not quite sure what you mean by “correct choice from a kyetsone v3 support point of view"? | 12:44 |
| *** doug-fish has joined #openstack-keystone | 12:45 | |
| Anticimex | hi henry | 12:46 |
| Anticimex | i mean openstack components level of implementation of keystone v3 (domains) | 12:46 |
| Anticimex | eg. heat's ec2api dependency on python-novaclient leads to: https://bugs.launchpad.net/keystone/+bug/1534655 , when testing autoscaling | 12:47 |
| openstack | Launchpad bug 1534655 in heat (Ubuntu) "Autoscaling auth failure in OpenStack Kilo 2015.1.2" [Undecided,Confirmed] | 12:47 |
| *** doug-fish has quit IRC | 12:47 | |
| *** doug-fish has joined #openstack-keystone | 12:48 | |
| Anticimex | i'm grepping in *-specs now and finding that glance is doing some keystone trust work for mitaka, otherwise many keystone v3 things seems to have been targetted for juno | 12:48 |
| Anticimex | ceilometer had some keystone specs for kilo | 12:48 |
| Anticimex | (rbac) | 12:48 |
| dstanek | Anticimex: the newer the release the more features you will have | 12:49 |
| dstanek | and likely more bugs fixes. not everything is always backported | 12:50 |
| Anticimex | right, i checked around launchpad and it seems to agree | 13:00 |
| *** pnavarro has joined #openstack-keystone | 13:02 | |
| *** kalaswan has joined #openstack-keystone | 13:06 | |
| *** woodster_ has quit IRC | 13:06 | |
| *** links has quit IRC | 13:17 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:22 | |
| *** bill_az has joined #openstack-keystone | 13:25 | |
| dims_ | bknudson_ : stevemar : around? need input on this suggestion from sdague - https://review.openstack.org/#/c/277676/ | 13:40 |
| *** ninag has joined #openstack-keystone | 13:40 | |
| dims_ | bknudson_ : stevemar : so i am trying to run py27/py34 of keystone against oslo.* master as periodic jobs, there's one quirk in keystone's tox.ini's testenv:py34 which is additional deps for nose. i was trying to account for that in my project-config review above and ended up with a -1 from Sean | 13:42 |
| *** daemontool has quit IRC | 13:42 | |
| *** henrynash has quit IRC | 13:51 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Deprecate Saml2 auth plugin https://review.openstack.org/275438 | 13:51 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Deprecate Saml2 auth plugin https://review.openstack.org/275438 | 13:53 |
| *** edmondsw has joined #openstack-keystone | 13:56 | |
| *** openstackgerrit_ has quit IRC | 13:56 | |
| *** jsavak has joined #openstack-keystone | 13:58 | |
| *** daemontool has joined #openstack-keystone | 13:59 | |
| *** vgridnev has joined #openstack-keystone | 14:00 | |
| *** dims_ has quit IRC | 14:03 | |
| *** bdossant has joined #openstack-keystone | 14:05 | |
| *** petertr7_away is now known as petertr7 | 14:05 | |
| *** dims has joined #openstack-keystone | 14:10 | |
| *** shoutm_ has quit IRC | 14:11 | |
| *** Nirupama has quit IRC | 14:14 | |
| *** mylu has joined #openstack-keystone | 14:14 | |
| *** daemontool_ has joined #openstack-keystone | 14:16 | |
| *** links has joined #openstack-keystone | 14:16 | |
| dstanek | dims: i can switch keystone from being a whitelist to a blacklist and get rid of nose | 14:16 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 14:17 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Test list project hierarchy is correct for a large tree https://review.openstack.org/277512 | 14:17 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Add backend support for deleting a projects list https://review.openstack.org/245916 | 14:17 |
| *** daemontool has quit IRC | 14:17 | |
| *** jgriffith_away is now known as jgriffith | 14:21 | |
| *** jsavak has quit IRC | 14:21 | |
| dims | dstanek : that would be awesome! | 14:21 |
| *** esp has joined #openstack-keystone | 14:21 | |
| *** jsavak has joined #openstack-keystone | 14:22 | |
| *** esp has quit IRC | 14:29 | |
| dstanek | dims: i can get it done in a little bit | 14:31 |
| dims | awesome! | 14:32 |
| *** mylu has quit IRC | 14:34 | |
| *** dave-mccowan has joined #openstack-keystone | 14:34 | |
| *** dikonoo has quit IRC | 14:35 | |
| *** jgriffith is now known as jgriffith_away | 14:35 | |
| *** mylu has joined #openstack-keystone | 14:35 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Deprecate Saml2 auth plugin https://review.openstack.org/275438 | 14:35 |
| *** jgriffith_away is now known as jgriffith | 14:43 | |
| *** dikonoor has joined #openstack-keystone | 14:49 | |
| *** pnavarro has quit IRC | 14:50 | |
| *** amit213 has quit IRC | 14:51 | |
| *** kalaswan has quit IRC | 14:51 | |
| *** fawadkhaliq has quit IRC | 14:52 | |
| *** links has quit IRC | 14:54 | |
| *** timcline has joined #openstack-keystone | 14:56 | |
| *** mylu has quit IRC | 14:56 | |
| *** mylu has joined #openstack-keystone | 14:57 | |
| *** timcline has quit IRC | 15:01 | |
| *** timcline has joined #openstack-keystone | 15:01 | |
| *** pnavarro has joined #openstack-keystone | 15:03 | |
| *** nkinder has joined #openstack-keystone | 15:04 | |
| *** su_zhang has joined #openstack-keystone | 15:05 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:07 | |
| *** pnavarro has quit IRC | 15:09 | |
| *** timcline_ has joined #openstack-keystone | 15:12 | |
| *** timcline has quit IRC | 15:13 | |
| *** timcline_ has quit IRC | 15:15 | |
| *** timcline has joined #openstack-keystone | 15:15 | |
| *** timcline_ has joined #openstack-keystone | 15:17 | |
| *** timcline has quit IRC | 15:21 | |
| *** pnavarro has joined #openstack-keystone | 15:22 | |
| *** rk4n has joined #openstack-keystone | 15:23 | |
| *** phalmos has joined #openstack-keystone | 15:23 | |
| *** clenimar has joined #openstack-keystone | 15:27 | |
| *** pushkaru has joined #openstack-keystone | 15:27 | |
| *** slberger has joined #openstack-keystone | 15:35 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Add tests for trust using impersonation https://review.openstack.org/273279 | 15:35 |
| *** petertr7 is now known as petertr7_away | 15:38 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Fix trust redelegation tests https://review.openstack.org/273232 | 15:40 |
| *** woodster_ has joined #openstack-keystone | 15:45 | |
| tjcocozz | so i am stacking devstack with liberty and i am running into this problem where it is trying to install eventlet from the upper-constraints.txt file. (https://github.com/openstack/requirements/blob/master/upper-constraints.txt#L121) well it turns out this does not exist in pypi (https://pypi.python.org/pypi/eventlet/0.18.1) How do changes get applied to upper-constraints.txt ? | 15:51 |
| *** jsheeren has quit IRC | 15:54 | |
| stevemar | dims: o/ | 15:54 |
| dstanek | tjcocozz: submit a review to the requirements project? | 15:54 |
| dstanek | dims: so i tried to get rid of nose, but it looks like it will require some really ugly keystone changes to work | 15:55 |
| dims | stevemar : dstanek volunteered to help fixup the py34 tox target | 15:55 |
| tjcocozz | dstanek, doing it now, thanks. | 15:55 |
| stevemar | dims: looks like it the fix didn't work :\ | 15:56 |
| dims | dstanek : ouch, can you please respond on that review so we can convince sdague to let things be for now? | 15:56 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone-specs: Change token method https://review.openstack.org/277908 | 15:58 |
| dstanek | dims: sure | 15:58 |
| dstanek | dims: i'm going to see if there is a way for me to limit the badness before i respond | 16:03 |
| *** gokrokve has joined #openstack-keystone | 16:04 | |
| *** sinese_ has quit IRC | 16:04 | |
| dstanek | dims: the problem is that there is no way to blacklist files from the test listing step | 16:04 |
| *** pnavarro has quit IRC | 16:05 | |
| *** mvk has quit IRC | 16:07 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:08 | |
| dims | dstanek : yep, we had that problem in nova too | 16:11 |
| *** boris-42 has joined #openstack-keystone | 16:11 | |
| bknudson_ | dstanek: can we switch from nose to python -m unittest ? | 16:11 |
| dstanek | dims: what did they do to get around it? i'm mocking modules now | 16:12 |
| *** daemontool__ has joined #openstack-keystone | 16:12 | |
| dims | dstanek : had to slowly fix it - series of patches | 16:12 |
| *** daemontool__ is now known as daemontool | 16:13 | |
| dims | dstanek : including fixing other libs like boto etc | 16:13 |
| dstanek | dims: we're stuck until someone fixes ldap :-( | 16:13 |
| dstanek | bknudson_: the review isn't as bad as i thought - almost have all of the tests running | 16:13 |
| dstanek | bknudson_: i like the blacklist because that means new files are automatically tests and it's easier to see what isn't | 16:14 |
| dims | dstanek : right, we use blacklist in nova as well | 16:14 |
| *** hrou_ has left #openstack-keystone | 16:14 | |
| stevemar | dstanek: i would hope that by now our blacklist is shorter than our whitelist :) | 16:14 |
| dstanek | stevemar: i'll let you know in a minute :-) | 16:15 |
| * dstanek crosses fingers | 16:15 | |
| *** daemontool_ has quit IRC | 16:15 | |
| *** nkinder has quit IRC | 16:16 | |
| *** petertr7_away is now known as petertr7 | 16:18 | |
| dstanek | stevemar: without any blacklisting 2236 out of 5374 fail | 16:20 |
| bknudson_ | we need to clean up the duplication in the unit tests | 16:21 |
| *** jbell8 has joined #openstack-keystone | 16:21 | |
| *** nkinder has joined #openstack-keystone | 16:21 | |
| *** belmoreira has quit IRC | 16:21 | |
| *** diazjf has joined #openstack-keystone | 16:27 | |
| *** vgridnev has quit IRC | 16:27 | |
| *** ninag_ has joined #openstack-keystone | 16:29 | |
| *** ninag has quit IRC | 16:31 | |
| lbragstad | stevemar want me to send the email for this or do you want to? https://bugs.launchpad.net/keystone/+bug/1543321 | 16:31 |
| openstack | Launchpad bug 1543321 in OpenStack Identity (keystone) "Trusts on v2.0 are undocumented" [Undecided,New] | 16:31 |
| lbragstad | stevemar hopping in a meeting now | 16:32 |
| *** timcline_ has quit IRC | 16:32 | |
| *** browne has joined #openstack-keystone | 16:32 | |
| *** timcline has joined #openstack-keystone | 16:33 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add a test that uses trusts and implies roles https://review.openstack.org/277319 | 16:33 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add a test that uses trusts and implies roles https://review.openstack.org/277319 | 16:34 |
| stevemar | lbragstad: go ahead and send it off, i trust ya :P | 16:35 |
| *** petertr7 is now known as petertr7_away | 16:35 | |
| *** pnavarro has joined #openstack-keystone | 16:38 | |
| *** timcline_ has joined #openstack-keystone | 16:38 | |
| *** petertr7_away is now known as petertr7 | 16:38 | |
| dstanek | dims: do you know how to have ostestr only run specific tests? like 'tox -e py27 -- test_cli' | 16:39 |
| *** timcline_ has quit IRC | 16:39 | |
| *** timcline_ has joined #openstack-keystone | 16:40 | |
| *** timcline has quit IRC | 16:41 | |
| notmorgan | dstanek: ostestr seems to be weird to me :( | 16:47 |
| *** dikonoor has quit IRC | 16:48 | |
| dstanek | notmorgan: if by weird you mean dumb, then yes i agree | 16:49 |
| notmorgan | hehe | 16:49 |
| bknudson_ | dstanek: --regex | 16:51 |
| *** Raildo has joined #openstack-keystone | 16:55 | |
| *** Raildo is now known as raildo | 16:55 | |
| dstanek | bknudson_: yeah, i found that, but i still can't find a way to pass testr args like '--failing' | 16:55 |
| *** ninag_ has quit IRC | 16:56 | |
| *** ninag has joined #openstack-keystone | 16:56 | |
| *** jgriffith is now known as jgriffith_away | 16:58 | |
| *** raildo has quit IRC | 16:59 | |
| notmorgan | dstanek: ostestr seems to a be a lot less usable than testr itself | 17:00 |
| *** bdossant has quit IRC | 17:00 | |
| dstanek | notmorgan: it is, but it adds a feature that i need for py3 (unless i want to just steal the regex logic | 17:00 |
| dims | mtreinish : ^^ ostestr questions :) | 17:00 |
| * notmorgan would like to see ostestr go away | 17:01 | |
| notmorgan | dstanek: stealthe logic | 17:01 |
| notmorgan | don't use ostestr | 17:01 |
| notmorgan | i will be a lot less happy w/ ostestr | 17:01 |
| dims | notmorgan : OR we could fix ostestr :) | 17:02 |
| *** peter-hamilton has joined #openstack-keystone | 17:02 | |
| dstanek | dims: why not fix testr since ostestr is for fixing its bugs? | 17:02 |
| dims | i've been able to get in some fixes quickly and released quickly as well | 17:02 |
| notmorgan | dstanek: ++ | 17:02 |
| notmorgan | i would rather just fix testr | 17:02 |
| dims | dstanek : ha, great question :) | 17:02 |
| *** d0ugal has quit IRC | 17:02 | |
| notmorgan | seriously, i don't want keystone to use ostestr. | 17:02 |
| bknudson_ | keystoneauth uses ostestr | 17:03 |
| dstanek | a lot of this feels like testr is just not designed to be a developer tool - nose is far better for my workflow | 17:03 |
| notmorgan | bknudson_: and i want to stop it | 17:03 |
| notmorgan | bknudson_: in fact i want that to go back to normal testr | 17:03 |
| notmorgan | bknudson_: i just haven't gotten around to it | 17:03 |
| *** raildo-afk is now known as raildo | 17:03 | |
| bknudson_ | I'm not sure why that's used... maybe it's part of the skeleton project? | 17:04 |
| notmorgan | bknudson_: because i dont have to do as much with ksa tests [they are much simplier] | 17:04 |
| *** jaosorior has quit IRC | 17:04 | |
| notmorgan | bknudson_: i think someone ported over to it | 17:04 |
| notmorgan | because iirc i used testr when ksa started | 17:04 |
| notmorgan | dstanek: i'd rather have testr/nose both be available | 17:04 |
| bknudson_ | commit ec16789cf11717e3d04cf1beb0e27f22cc98f156 | 17:04 |
| bknudson_ | notmorgan: you can probably guess who +2d it. | 17:05 |
| notmorgan | bknudson_: yep | 17:05 |
| notmorgan | bknudson_: i didn't realize how much less-usable ostestr was at the time | 17:06 |
| *** daemontool has quit IRC | 17:06 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Revert "Convert project to os-testr" https://review.openstack.org/277965 | 17:07 |
| bknudson_ | apparently it makes error messages easier to read? | 17:07 |
| *** spandhe has joined #openstack-keystone | 17:07 | |
| notmorgan | bknudson_: ^ | 17:07 |
| lbragstad | stevemar sent | 17:07 |
| dstanek | bknudson_: don't make errors :-P | 17:07 |
| bknudson_ | I'm not sure what the difference is in the error reporting ... seems to work fine in keystone | 17:07 |
| *** richm has quit IRC | 17:07 | |
| notmorgan | bknudson_: agreed | 17:07 |
| *** timcline has joined #openstack-keystone | 17:07 | |
| *** ninag has quit IRC | 17:07 | |
| notmorgan | dstanek: if you can make testr and nose play nicely together [maybe an env var?] | 17:08 |
| *** dan_nguyen has joined #openstack-keystone | 17:08 | |
| notmorgan | dstanek: i'd be very happy to see it used. | 17:08 |
| bknudson_ | what's so great about nose? | 17:08 |
| notmorgan | bknudson_: better for isolated test runs / debugging | 17:08 |
| bknudson_ | over, e.g., python -m unittest | 17:08 |
| notmorgan | bknudson_: not a ton. both are good runners | 17:09 |
| notmorgan | bknudson_: slightly different workflows. | 17:09 |
| dstanek | bknudson_: i'm fond of using nose+plugins | 17:09 |
| notmorgan | the plugins are better w/ nose | 17:09 |
| bknudson_ | noseplugs | 17:09 |
| notmorgan | but baseline use, they are about the same | 17:09 |
| *** timcline has quit IRC | 17:09 | |
| notmorgan | mordred: https://review.openstack.org/277965 | 17:09 |
| *** ninag has joined #openstack-keystone | 17:10 | |
| *** mylu has quit IRC | 17:10 | |
| *** timcline has joined #openstack-keystone | 17:10 | |
| dstanek | notmorgan: i'll fix to not use os-testr before i submit. maybe i'll just use is to create the massive regex | 17:10 |
| *** timcline_ has quit IRC | 17:10 | |
| notmorgan | dstanek: actually... hey can you use the .testr.conf and use a new pattern match? | 17:10 |
| notmorgan | iirc there was a way to do that | 17:11 |
| *** ninag has quit IRC | 17:11 | |
| *** timcline has quit IRC | 17:11 | |
| *** ninag has joined #openstack-keystone | 17:11 | |
| *** timcline has joined #openstack-keystone | 17:11 | |
| bknudson_ | is there a way to run doctest on tox -e py27 ? | 17:12 |
| bknudson_ | that would be handy for keystoneauth / keystoneclient | 17:12 |
| notmorgan | bknudson_: doctest? | 17:12 |
| dstanek | notmorgan: my plan was to just pass it a regex. i don't want to change anything fundamental since this is only "temporary" | 17:12 |
| *** gyee has joined #openstack-keystone | 17:12 | |
| *** ChanServ sets mode: +v gyee | 17:12 | |
| bknudson_ | notmorgan: https://docs.python.org/2/library/doctest.html | 17:13 |
| notmorgan | oh neat | 17:13 |
| notmorgan | dstanek: ++ | 17:13 |
| dstanek | bknudson_: just append it to the commands list | 17:13 |
| dstanek | bknudson_: do we have doctests? | 17:13 |
| dstanek | bknudson_: normally those are considered to be bad to do | 17:13 |
| bknudson_ | you mean do we have example code? | 17:13 |
| bknudson_ | why is example code bad? | 17:14 |
| *** nkinder has quit IRC | 17:14 | |
| dstanek | bknudson_: a doctest is a test that is in the docstring - because you have to have the setup code in there too | 17:14 |
| bknudson_ | y, I'm not sure how the setup code works. We'd have to do mocking somehow. | 17:15 |
| dstanek | bknudson_: normally that all goes in the docstring, which is why i don't like it | 17:15 |
| bknudson_ | otherwise you'd have to set up devstack just to run the tests | 17:15 |
| *** ninag has quit IRC | 17:16 | |
| bknudson_ | we need a new doctest2 that has a fixture section. | 17:16 |
| *** ninag has joined #openstack-keystone | 17:16 | |
| bknudson_ | http://nose.readthedocs.org/en/latest/doc_tests/test_doctest_fixtures/doctest_fixtures.html | 17:16 |
| bknudson_ | now I see why you love nose so much | 17:17 |
| bknudson_ | https://bugs.python.org/issue4899 -- REJECTED | 17:17 |
| bknudson_ | maybe we should reference the test and make sure the test is readable. | 17:20 |
| bknudson_ | instead of embedded example code | 17:20 |
| *** ninag has quit IRC | 17:20 | |
| *** su_zhang has quit IRC | 17:21 | |
| dstanek | bknudson_: it's a tough balance, but that's probably not a bad idea | 17:21 |
| dstanek | there are 200 people in this channel, but only ~20 actually participate :-( | 17:22 |
| notmorgan | dstanek: wow el capitan (OS X) wont let me install git-review :( | 17:22 |
| notmorgan | dstanek: without a reboot and disabling major security features | 17:22 |
| dstanek | notmorgan: really? what features? | 17:22 |
| notmorgan | SIP | 17:22 |
| notmorgan | it restricts non-apple signed apps from writing to /System | 17:23 |
| notmorgan | basically | 17:23 |
| notmorgan | and /usr/bin etc | 17:23 |
| notmorgan | and git review tries to drop it's CLI in one of them | 17:23 |
| notmorgan | vs usr/local like pip does. | 17:23 |
| notmorgan | dstanek: even wtih root you can't write there. | 17:23 |
| -openstackstatus- NOTICE: Gerrit is restarting now, to alleviate current performance impact and WebUI errors. | 17:24 | |
| notmorgan | dstanek: and you can't disable SIP at runtime, has to be done from recovery-mode | 17:24 |
| notmorgan | for that matter, can't enable it at runtime either | 17:24 |
| notmorgan | it;s written to NVRAM | 17:24 |
| dstanek | notmorgan: haha. mac sucks | 17:24 |
| notmorgan | dstanek: i just grabbed the mac cause it was closer for checking in before meeting | 17:25 |
| notmorgan | usually it's in another room | 17:25 |
| notmorgan | and turned off | 17:25 |
| *** timcline has quit IRC | 17:25 | |
| *** timcline has joined #openstack-keystone | 17:26 | |
| notmorgan | bknudson_: ok https://review.openstack.org/#/c/277965/ rebased | 17:27 |
| *** mylu has joined #openstack-keystone | 17:27 | |
| *** timcline has quit IRC | 17:30 | |
| *** timcline has joined #openstack-keystone | 17:30 | |
| *** e0ne has quit IRC | 17:32 | |
| *** _cjones_ has joined #openstack-keystone | 17:34 | |
| *** mylu has quit IRC | 17:34 | |
| *** gokrokve_ has joined #openstack-keystone | 17:34 | |
| notmorgan | dolphm: just got the email to get scheduling for OSIC | 17:35 |
| notmorgan | dolphm: i guess this means i need to figure out my test plan :P | 17:35 |
| stevemar | notmorgan: lbragstad i put you both on the agenda for the keystone meeting: https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting#Main_Agenda | 17:35 |
| notmorgan | stevemar: damn it. | 17:36 |
| notmorgan | stevemar: :P | 17:36 |
| *** mylu has joined #openstack-keystone | 17:36 | |
| *** maxabidi has quit IRC | 17:37 | |
| *** gokrokve has quit IRC | 17:37 | |
| *** jaosorior has joined #openstack-keystone | 17:39 | |
| *** samueldmq has joined #openstack-keystone | 17:44 | |
| notmorgan | jamielennox: what is the status of the oslo_context ksm changes? | 17:45 |
| *** browne has quit IRC | 17:46 | |
| *** sinese_ has joined #openstack-keystone | 17:46 | |
| notmorgan | jamielennox: and more to the point any thing i can do to help, i'd like to have that baking in mitaka | 17:49 |
| notmorgan | jamielennox: so it's usable out the gate in newton. | 17:50 |
| *** vgridnev has joined #openstack-keystone | 17:53 | |
| *** jaosorior has quit IRC | 17:53 | |
| *** mylu has quit IRC | 17:56 | |
| *** mylu has joined #openstack-keystone | 17:57 | |
| *** mylu has quit IRC | 17:58 | |
| *** lhcheng_ has joined #openstack-keystone | 17:59 | |
| *** mylu has joined #openstack-keystone | 18:00 | |
| dims | dstanek : what's the consensus? so i can go bug sdague :) https://review.openstack.org/#/c/277676/ | 18:00 |
| dstanek | dims: i'm fixing in keystone, but not using ostestr | 18:00 |
| dims | dstanek : cool thanks | 18:01 |
| *** tsymanczyk has joined #openstack-keystone | 18:01 | |
| dstanek | dims: ostestr doesn't appear to completely work in Py3 anyway :-( | 18:02 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Move redelegated_trust_id out of extras https://review.openstack.org/276474 | 18:03 |
| *** mylu has quit IRC | 18:03 | |
| *** jasonsb has quit IRC | 18:04 | |
| *** roxanaghe has joined #openstack-keystone | 18:05 | |
| *** su_zhang has joined #openstack-keystone | 18:05 | |
| *** woodster_ has quit IRC | 18:06 | |
| *** mylu has joined #openstack-keystone | 18:08 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Introduce an identity_admin role to policy.json https://review.openstack.org/274143 | 18:09 |
| *** gokrokve_ has quit IRC | 18:11 | |
| *** mhickey has quit IRC | 18:11 | |
| *** rudolfvriend has quit IRC | 18:15 | |
| *** e0ne has joined #openstack-keystone | 18:17 | |
| *** petertr7 is now known as petertr7_away | 18:18 | |
| edmondsw | does openstackclient not support CRUD for role assignments? I'm not seeing it in --help | 18:19 |
| *** ninag has joined #openstack-keystone | 18:20 | |
| lbragstad | edmondsw its owned under openstack role (add,remove,etc) | 18:20 |
| edmondsw | oh, I see it now... role add... but it looks like it's only for projects and users... not domains, groups | 18:20 |
| *** ninag_ has joined #openstack-keystone | 18:21 | |
| samueldmq | edmondsw: yes, as lbragstad said.. /role_assignments is only a GET route in keystone | 18:21 |
| *** jsavak has quit IRC | 18:21 | |
| edmondsw | right, I knew that... just overlooked it in the help... but why doesn't it support groups and domains? | 18:21 |
| lbragstad | notmorgan could you use something like https://github.com/openstack/oslo.config/blob/master/oslo_config/cfg.py#L1164 instead of MultiStrOpt? | 18:22 |
| *** ninag has quit IRC | 18:25 | |
| *** roxanaghe has quit IRC | 18:25 | |
| *** daemontool has joined #openstack-keystone | 18:25 | |
| *** rk4n has quit IRC | 18:25 | |
| *** browne has joined #openstack-keystone | 18:26 | |
| *** su_zhang has quit IRC | 18:29 | |
| *** su_zhang has joined #openstack-keystone | 18:29 | |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: API support for project cascade update https://review.openstack.org/243585 | 18:32 |
| *** aginwala has joined #openstack-keystone | 18:32 | |
| notmorgan | lbragstad: ugly | 18:33 |
| notmorgan | and npo | 18:33 |
| *** lhcheng_ has quit IRC | 18:33 | |
| notmorgan | no* | 18:33 |
| notmorgan | we don't really restrict role name character sets | 18:33 |
| notmorgan | soooooo | 18:33 |
| *** jgriffith_away is now known as jgriffith | 18:34 | |
| notmorgan | dolphm: re: https://review.openstack.org/#/c/274973/ I 100% agree on separate repo, but i'm not volunteering to split/maintain it. | 18:36 |
| notmorgan | dolphm: and no one else is. | 18:36 |
| notmorgan | dolphm: aaaannnnd we will still need to carry it =/ | 18:36 |
| notmorgan | dolphm: so might as well at least finish the no-more-extension work | 18:36 |
| lbragstad | notmorgan it causes a problem for people programatically determining a config because MultiStrOpt and ListOpt are both read in as lists... | 18:39 |
| lbragstad | and you have no way of determining what it came from | 18:39 |
| cloudnull | ^ truth | 18:40 |
| notmorgan | lbragstad: this was the argument against multistropt waaay back and was said "sorry we use it for reasons such as <can't deliniate boundries>". | 18:40 |
| dolphm | notmorgan: why not merge the "required" middleware into a single, common middleware again? wsgi is insanely elegant, i really don't want to lose that power | 18:40 |
| notmorgan | dolphm: it already is that . | 18:40 |
| notmorgan | dolphm: if you look you just need to not auto-wrap the apps | 18:41 |
| cloudnull | notmorgan: you can set bounds in listops | 18:41 |
| cloudnull | https://github.com/openstack/oslo.config/blob/master/oslo_config/cfg.py#L1156-L1175 | 18:41 |
| notmorgan | cloudnull: not when you have no reserved characters :P | 18:41 |
| notmorgan | dolphm: i did exactly what you're describing just one step further to auto-wrap the app-factories | 18:41 |
| notmorgan | dolphm: _RequestHandler is middleware because i was replicating "today" behavior before changing it | 18:42 |
| cloudnull | this is true, you cant define the delimiter. | 18:42 |
| dolphm | notmorgan: "auto wrapping" == hardcoding the pipeline outside of paste | 18:42 |
| notmorgan | cloudnull: that is the issue with the root_role thing. we don't have reserved characters :( | 18:42 |
| notmorgan | dolphm: my next step was to make it not-middleware but figured it was something to cleanup once the code was done | 18:43 |
| cloudnull | the issue isnt really one related to the config within the project, the issue is a deployer one. | 18:43 |
| notmorgan | dolphm: also, i *really* didn't want middlware that "reaches into the db" | 18:43 |
| cloudnull | we cant rewrite config using python | 18:44 |
| cloudnull | we have to require an override for all options within a given config and rerev that on every release. | 18:44 |
| notmorgan | dolphm: but like i said, it's not a big change to do what you're proposing | 18:44 |
| cloudnull | which is a nightmare. | 18:44 |
| notmorgan | cloudnull: and we're backed into a corner here | 18:44 |
| openstackgerrit | Trevor McKay proposed openstack/python-keystoneclient: Handle exception on UnicodeDecodError in logging of request https://review.openstack.org/278027 | 18:44 |
| *** aginwala has quit IRC | 18:45 | |
| cloudnull | fair enough | 18:45 |
| *** mylu has quit IRC | 18:45 | |
| *** pnavarro has quit IRC | 18:45 | |
| cloudnull | i mean its a problem we're going to have to learn to deal with | 18:45 |
| notmorgan | cloudnull: :P this is a history and compatibility vs pain for conf. managment software :( | 18:45 |
| cloudnull | but if it can be avoided, i'd advocate for that | 18:45 |
| notmorgan | cloudnull: there is no good answer | 18:45 |
| notmorgan | cloudnull: long term it'll all wash out | 18:45 |
| * notmorgan wonders... | 18:46 | |
| notmorgan | i wonder if we could make multistropt read into a set() instead? | 18:46 |
| notmorgan | oh no. | 18:46 |
| notmorgan | non-ordered | 18:46 |
| * notmorgan grubles. | 18:46 | |
| cloudnull | everything is terrible. we just need the least terrible option. :) | 18:46 |
| notmorgan | cloudnull: so in this case, i really wnat listopt | 18:47 |
| *** timcline has quit IRC | 18:47 | |
| notmorgan | but i don't think we can use it | 18:47 |
| cloudnull | yea if the domain can have a "," in it then its a no go | 18:47 |
| notmorgan | dolphm: https://review.openstack.org/#/c/277570/1/keystone/version/service.py look at line 103, "new" side. | 18:48 |
| notmorgan | dolphm: break that out and you have _RequestHandler as a middleware [prob. make it non-private] | 18:48 |
| notmorgan | cloudnull: it's "role name" in this case | 18:48 |
| notmorgan | cloudnull: but same thing | 18:48 |
| cloudnull | can a role name be straight unicode ? | 18:49 |
| notmorgan | dolphm: for each factory that is. | 18:49 |
| notmorgan | cloudnull: i think it's pretty much unrestricted | 18:49 |
| notmorgan | cloudnull: i mean... non-printing characters would be hard... and ASCII bell would be evil | 18:49 |
| *** aginwala has joined #openstack-keystone | 18:49 | |
| cloudnull | how many deployments to we think are in the wild with "," in the role name? | 18:51 |
| cloudnull | is this more or less fencing around the possibility or is it something that is known to exist ? | 18:52 |
| notmorgan | cloudnull: unknown | 18:53 |
| notmorgan | cloudnull: impossible to know | 18:53 |
| cloudnull | thats fair | 18:53 |
| notmorgan | cloudnull: and how many would use root_roles | 18:54 |
| notmorgan | even more impossible to know | 18:54 |
| notmorgan | since it's a new feature ;) | 18:54 |
| * cloudnull walks off cursing MultiStrOps | 18:54 | |
| *** lhcheng has joined #openstack-keystone | 18:54 | |
| *** ChanServ sets mode: +v lhcheng | 18:54 | |
| notmorgan | cloudnull: hehe | 18:54 |
| notmorgan | cloudnull: sorry :( | 18:54 |
| cloudnull | its really your only option which sucks | 18:54 |
| cloudnull | but i understand it | 18:55 |
| cloudnull | ill figure something out eventually | 18:55 |
| cloudnull | its just a matter of time and coffee | 18:55 |
| *** tmckay has joined #openstack-keystone | 18:56 | |
| mtreinish | dims, dstanek, notmorgan: are you looking for: https://review.openstack.org/#/c/267824/ | 18:56 |
| tmckay | Hi folks. I just submitted https://review.openstack.org/#/c/278027, it was breaking me in Sahara :) I figured I would take a shot | 18:56 |
| notmorgan | mtreinish: that would be nice. i basically don't want to use os-testr because some of that. | 18:57 |
| tmckay | please be harsh, I wanted to get the ball rolling again after the issue was abandoned a few months ago | 18:57 |
| notmorgan | mtreinish: but i also don't see the real benefit to os-testr over fixing issues in testr | 18:57 |
| lbragstad | so we want to document the behavior that we want, right? | 18:57 |
| notmorgan | mtreinish: that fix will make it so i am less likely to say "no os-testr" after my experience with it in ksa | 18:57 |
| lbragstad | do we want to do that in jorge_munoz's code review? | 18:58 |
| mtreinish | notmorgan: I agree, a lot of the stuff in os-testr is has upstream bugs filed | 18:58 |
| *** timcline has joined #openstack-keystone | 18:58 | |
| notmorgan | mtreinish: depending on how fast you land that will depend on how fast i remove os-testr from ksa/not remove it | 18:58 |
| notmorgan | mtreinish: ;) | 18:58 |
| *** timcline has quit IRC | 18:58 | |
| notmorgan | mtreinish: land and get it out the door. (as in i can wait if it's going to happen soon-ish) | 18:59 |
| *** timcline has joined #openstack-keystone | 18:59 | |
| notmorgan | mtreinish: but if it's going to be a looooooooonnnnnnggggg delay, i'll unrevert the revert when we get it :) | 18:59 |
| dims | mtreinish : +2'ed | 18:59 |
| *** timcline has quit IRC | 19:00 | |
| *** ninag_ has quit IRC | 19:00 | |
| mtreinish | dims: heh, might as well +A it, we're the only 2 active cores on os-testr :) | 19:00 |
| dims | mtreinish : done :) | 19:00 |
| *** timcline has joined #openstack-keystone | 19:01 | |
| dstanek | mtreinish: that's getting better (i don't fully understand how that works though) | 19:01 |
| jorge_munoz | amakarov: If i want to redelegated the initial trust i should be abled to find it thru the redelegated_trust_id. The trustor is the trustee_user is the test. | 19:01 |
| dstanek | mtreinish: someone should fix testr's biggest design flaw - the need to parse all files all the time | 19:01 |
| *** jsavak has joined #openstack-keystone | 19:01 | |
| jorge_munoz | amakarov: Setting it to self.user would just help bypass the policy file. | 19:01 |
| notmorgan | dolphm: so, due to deadlines and all that for other things, if you want to rebase/unwind those couple things to make it a sane single filter i'm 100% in support of it | 19:02 |
| *** raildo is now known as raildo-afk | 19:02 | |
| *** ninag has joined #openstack-keystone | 19:02 | |
| notmorgan | dolphm: i just don't expect to get back to this anytime within mitaka or newton personally :(. this was a diversion while i mulled over some other fixes. | 19:03 |
| amakarov | jorge_munoz, entire trust chain should have the same trustor | 19:03 |
| amakarov | jorge_munoz, this is the workflow | 19:03 |
| lbragstad | amakarov why? | 19:03 |
| lbragstad | that's not a chain | 19:03 |
| lbragstad | it's a web | 19:03 |
| mtreinish | dstanek: that's how unittest test discovery works | 19:03 |
| mtreinish | nose does basically the same thing | 19:04 |
| *** fawadkhaliq has quit IRC | 19:06 | |
| amakarov | lbragstad, that's how it works: to redelegate my trust from admin to user I need to specify that the new trust is between admin and user AND it was created using my trust | 19:06 |
| notmorgan | dolphm: that are higher on my prio list | 19:06 |
| mtreinish | dstanek: you can get around it by defining a static list of tests (either in code or outside) and using that instead | 19:06 |
| amakarov | lbragstad, If I create a trust from me to user, it's just a trust from me to that user | 19:06 |
| dstanek | mtreinish: you mean using the --blacklist option? | 19:06 |
| lbragstad | amakarov but when you do that with impersonation and redelegation it creates a new trust between the original trustor and the newest trustee... which isn't a chain | 19:07 |
| dstanek | mtreinish: that doesn't work because if doesn't happen before the "list tests" step | 19:07 |
| mtreinish | dstanek: no that still does discovery. You can use --subunit/--no-discover to skip discovery for a single test | 19:07 |
| amakarov | lbragstad, chain is maintained via redelegated_trust_id | 19:07 |
| mtreinish | or use --load-list | 19:07 |
| *** jsavak has quit IRC | 19:08 | |
| mtreinish | (which will only work after the passthrough patch lands) | 19:08 |
| *** jsavak has joined #openstack-keystone | 19:08 | |
| amakarov | lbragstad, btw "chain" isn't the term I used in the spec :) | 19:08 |
| dstanek | mtreinish: last time i tried load-list it still imported stuff that broke me. maybe it's better now. i've changed keystone to use the blacklist model though | 19:09 |
| amakarov | lbragstad, well, I used it, but not as a feature name | 19:09 |
| *** daemontool_ has joined #openstack-keystone | 19:10 | |
| jorge_munoz | amakarov: So you can’t redelegate without impersonation? | 19:10 |
| mtreinish | dstanek: the blacklist model is much easier to use. --load-list needs a full python path for each test object (module, class, or method) like you use for directly calling a runner without discvoer | 19:10 |
| mtreinish | it doesn't do discovery because of that | 19:10 |
| lbragstad | amakarov ok - lets define the API. jorge_munoz has a lot of questions on the intended behavior and at this point, knows more about trusts than I do. So, can we define the use cases that are actually *need* (not the ones that are possible)? | 19:11 |
| lbragstad | *needed*? | 19:11 |
| amakarov | jorge_munoz, why? Let me just double check the code, but I don't remember such restriction | 19:11 |
| *** daemontool__ has joined #openstack-keystone | 19:11 | |
| *** mylu has joined #openstack-keystone | 19:12 | |
| *** ninag_ has joined #openstack-keystone | 19:12 | |
| *** daemontool has quit IRC | 19:12 | |
| amakarov | jorge_munoz, from what I see create_trust manager method doesn't care about impersonation | 19:13 |
| *** daemontool_ has quit IRC | 19:14 | |
| jorge_munoz | amakarov: Sorry, what i meant to say is, is you have a chain of redelegated trust then a user can’ t impersonate. And to redelegate a chain of trust with impersonation set to true is done then all trust in the chain have to be match the original trustor. | 19:14 |
| *** ninag has quit IRC | 19:15 | |
| amakarov | jorge_munoz, and it whould be great to check if trust works with impersonation=False as create_trust controller method calls _require_user_is_trustor, which doesn't look good... | 19:15 |
| *** alex_xu has quit IRC | 19:15 | |
| *** mylu has quit IRC | 19:17 | |
| mfisch | lbragstad: ಠ_ಠ http://i.imgur.com/p0S7TKY.jpg | 19:17 |
| *** dims_ has joined #openstack-keystone | 19:17 | |
| amakarov | jorge_munoz, I see, what you are trying to do: you want to create a trust from user1 to user2, then from user2 to user3 and call it a chain - this will NOT work :) | 19:17 |
| *** dims has quit IRC | 19:17 | |
| *** alex_xu has joined #openstack-keystone | 19:18 | |
| jorge_munoz | amakarov: Is that not redelegation? | 19:19 |
| amakarov | jorge_munoz, the logic is following: create a trust from user1 to user2, authN/authZ as user2 using created trust, and then create a trust from user1 to user3 specifying that you are redelegating that initial trust | 19:19 |
| mtreinish | dstanek: actually I think you might be right, load-lists might still do discovery, although I don't think that's the intent | 19:19 |
| mtreinish | I need to dig some more, it might be a bug | 19:20 |
| *** mylu has joined #openstack-keystone | 19:20 | |
| amakarov | It's like user1 created a trust to user3 himself | 19:20 |
| lbragstad | mfisch ah - | 19:20 |
| lbragstad | digging for you link | 19:20 |
| lbragstad | mfisch sorry | 19:20 |
| jorge_munoz | amakarov: That is what the test does | 19:20 |
| dstanek | mtreinish: testr is just too compilcated. all i want to do is hack keystone :-( | 19:20 |
| mfisch | lbragstad: lol | 19:21 |
| amakarov | jorge_munoz, looking... | 19:21 |
| lbragstad | dolphm amakarov jorge_munoz what if we start defining the use cases and API here - https://etherpad.openstack.org/p/keystone-trust-behavior | 19:21 |
| mtreinish | dstanek: ++, well s/keystone/the projects I work on/ | 19:21 |
| lbragstad | mfisch where is the speaker bio pulled from? | 19:23 |
| mfisch | I think its your openstack.org bio | 19:24 |
| *** mylu has quit IRC | 19:24 | |
| mfisch | lbragstad: https://www.openstack.org/profile/speaker | 19:24 |
| mfisch | I'd just upload a picture and say "quinoa, guns, openstack" | 19:25 |
| lbragstad | mfisch ++ what else do you need? | 19:25 |
| *** dims_ has quit IRC | 19:27 | |
| mfisch | lol | 19:27 |
| openstackgerrit | Trevor McKay proposed openstack/python-keystoneclient: Handle exception on UnicodeDecodError in logging of request https://review.openstack.org/278027 | 19:28 |
| amakarov | jorge_munoz, double-checked your test: I'm still pretty sure my comment is valid. | 19:29 |
| *** su_zhang has quit IRC | 19:29 | |
| *** dims has joined #openstack-keystone | 19:30 | |
| *** su_zhang has joined #openstack-keystone | 19:32 | |
| jorge_munoz | amakarov: Ok, so a user should not be allow create a trust with impersonation from a redeleated trust that did not have impersonation to true? | 19:35 |
| stevemar | mfisch: rookie move lbragstad | 19:36 |
| *** ayoung has joined #openstack-keystone | 19:37 | |
| *** ChanServ sets mode: +v ayoung | 19:37 | |
| jorge_munoz | amakarov: Also, for a chain of trust(impersonation=True) should the redelegated_trust_id be required? | 19:37 |
| openstackgerrit | David Stanek proposed openstack/keystone: Uses open context manager for templated catalogs https://review.openstack.org/278053 | 19:37 |
| openstackgerrit | David Stanek proposed openstack/keystone: Stop using nose as a Python3 test runner https://review.openstack.org/278054 | 19:37 |
| openstackgerrit | David Stanek proposed openstack/keystone: Enables token_data_helper tests for Python3 https://review.openstack.org/278055 | 19:37 |
| amakarov | jorge_munoz, redelegated trust is the trust from the token - it's extracted automatically | 19:39 |
| openstackgerrit | Clenimar Filemon Sousa proposed openstack/keystone: Avoid wrong deletion of domain assignments https://review.openstack.org/275706 | 19:39 |
| amakarov | jorge_munoz, redelegated_trust_id should not be passed in the create trust request | 19:40 |
| *** can8dnSix has joined #openstack-keystone | 19:41 | |
| amakarov | jorge_munoz, please read this carefully: http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-trust-ext.html | 19:41 |
| *** dims has quit IRC | 19:41 | |
| *** dims has joined #openstack-keystone | 19:42 | |
| jorge_munoz | amakarov: ok, I think i understand the workflow of trust now. Its read-only, but i was able to pass it throu the request on trust creation. | 19:42 |
| amakarov | jorge_munoz, I think existing redelegation tests may halp you understand what's going on there | 19:45 |
| amakarov | s/halp/help/ | 19:45 |
| *** dims_ has joined #openstack-keystone | 19:46 | |
| *** mylu has joined #openstack-keystone | 19:46 | |
| *** timcline has quit IRC | 19:47 | |
| *** timcline has joined #openstack-keystone | 19:48 | |
| *** su_zhang has quit IRC | 19:48 | |
| *** su_zhang has joined #openstack-keystone | 19:48 | |
| *** dims has quit IRC | 19:49 | |
| *** e0ne has quit IRC | 19:49 | |
| *** su_zhang has quit IRC | 19:49 | |
| *** aginwala has quit IRC | 19:49 | |
| jorge_munoz | amakarov: Thanks, one last quick quiestion. All test in redelegation use impersonation. Should a user be allow to redelegate without impersonation? | 19:50 |
| *** su_zhang has joined #openstack-keystone | 19:50 | |
| *** ninag_ has quit IRC | 19:50 | |
| *** ninag has joined #openstack-keystone | 19:50 | |
| *** ninag has quit IRC | 19:51 | |
| *** ninag has joined #openstack-keystone | 19:51 | |
| *** su_zhang has quit IRC | 19:51 | |
| amakarov | jorge_munoz, in ideal case - yes. I don't remember if we agreed about this restriction or this just eluded our attention, but currently I can't recall the goal of it. | 19:51 |
| *** su_zhang has joined #openstack-keystone | 19:52 | |
| *** mylu has quit IRC | 19:53 | |
| amakarov | jorge_munoz, I assume impersonated trust should be allowed to create non-impersonated and impersonated both, while non-impersonated should allow creation of non-impersonated only | 19:53 |
| amakarov | jorge_munoz, I believe this is a minor bug to fix | 19:54 |
| *** aginwala has joined #openstack-keystone | 19:55 | |
| jorge_munoz | amakarov: Perfect, thanks. I’ll start looking at that. | 19:55 |
| amakarov | jorge_munoz, yw | 19:55 |
| *** amakarov is now known as amakarov_away | 19:55 | |
| *** su_zhang has quit IRC | 19:57 | |
| stevemar | only ayoung could somehow get his bio in another font than *every other presentation* https://www.openstack.org/summit/austin-2016/vote-for-speakers/presentation/6873 | 19:57 |
| *** dims_ has quit IRC | 19:57 | |
| stevemar | :] | 19:57 |
| ayoung | stevemar, they filterd out my blink tag, though | 19:58 |
| stevemar | lol | 19:58 |
| ayoung | I seriously have no clue how that happened. I cut and pasted it from the Vancouver summit site | 19:58 |
| *** ninag has quit IRC | 19:59 | |
| *** can8dnSix has quit IRC | 19:59 | |
| *** ninag has joined #openstack-keystone | 20:00 | |
| ayoung | https://www.openstack.org/summit/austin-2016/vote-for-speakers/presentation/8652 "Alternative implementation of Keystone in Haskell" Yehaw! | 20:00 |
| cloudnull | rated 0.. if there was -1 i'd rate it that. | 20:02 |
| *** ninag has quit IRC | 20:04 | |
| *** jgriffith has quit IRC | 20:05 | |
| tmckay | ping tjcocozz | 20:06 |
| tjcocozz | hi | 20:06 |
| gyee | lbragstad, whenever you have a chance https://review.openstack.org/#/c/226464/ | 20:06 |
| bknudson_ | haskell must be pretty great... don't even need to test anymore. | 20:06 |
| *** jgriffith has joined #openstack-keystone | 20:06 | |
| tmckay | Hey there! I was bitten by this during Sahara testing, so I decided to try to fix it :) | 20:06 |
| *** jgriffith is now known as Guest55421 | 20:06 | |
| *** petertr7_away is now known as petertr7 | 20:07 | |
| tmckay | tjcocozz, I copied the test code from an abandoned review, I'll go ahead and tweak it. Thanks! | 20:07 |
| tjcocozz | tmckay, thanks for fixing it! | 20:07 |
| tmckay | please be harsh, I am a guest in keystone ;-) All respect to the keymasters | 20:07 |
| *** rcernin has joined #openstack-keystone | 20:08 | |
| tmckay | once in a while I lack to dabble in other projects, :) | 20:08 |
| tjcocozz | tmckay, lolz then your going to want someone else to review it... queue bknudson_ ^^ | 20:08 |
| tmckay | ack. I'll have another review up in a few with tweaks (minor change though it is) | 20:08 |
| *** jsavak has quit IRC | 20:09 | |
| tjcocozz | tmckay, thanks! | 20:10 |
| *** jsavak has joined #openstack-keystone | 20:12 | |
| openstackgerrit | Clenimar Filemon Sousa proposed openstack/keystone: Avoid wrong deletion of domain assignments https://review.openstack.org/275706 | 20:13 |
| *** ninag has joined #openstack-keystone | 20:17 | |
| *** ninag_ has joined #openstack-keystone | 20:19 | |
| *** ninag has quit IRC | 20:21 | |
| ayoung | https://www.openstack.org/summit/austin-2016/vote-for-speakers/presentation/7903 Vote for that one so henry and I can sit in the back and snipe! | 20:22 |
| ayoung | "Security concerns? We’ve got your back and RBAC" | 20:22 |
| openstackgerrit | Trevor McKay proposed openstack/python-keystoneclient: Handle exception on UnicodeDecodError in logging of request https://review.openstack.org/278027 | 20:23 |
| *** Guest55421 is now known as jgriffith | 20:24 | |
| *** su_zhang has joined #openstack-keystone | 20:28 | |
| *** ninag_ has quit IRC | 20:28 | |
| *** mylu has joined #openstack-keystone | 20:29 | |
| *** raildo-afk is now known as raildo | 20:29 | |
| openstackgerrit | Trevor McKay proposed openstack/python-keystoneclient: Handle exception on UnicodeDecodError in logging of request https://review.openstack.org/278027 | 20:30 |
| *** su_zhang has quit IRC | 20:32 | |
| *** esp has joined #openstack-keystone | 20:35 | |
| raildo | ayoung, awesome title! | 20:36 |
| ayoung | raildo, Meh | 20:37 |
| ayoung | too cutesy | 20:37 |
| *** esp has quit IRC | 20:39 | |
| *** mylu has quit IRC | 20:40 | |
| *** mylu has joined #openstack-keystone | 20:40 | |
| *** aginwala has quit IRC | 20:40 | |
| *** aginwala has joined #openstack-keystone | 20:43 | |
| *** su_zhang has joined #openstack-keystone | 20:44 | |
| notmorgan | heh | 20:44 |
| notmorgan | (Keep in mind that the first 100 characters are what will wind up in the YouTube description. | 20:44 |
| notmorgan | someone missed deleting that. | 20:45 |
| *** esp has joined #openstack-keystone | 20:47 | |
| krotscheck | Hey, any cores out there able to look at https://review.openstack.org/#/c/241317/ for me? Keystone's the only remaining core openstack service that doesn't support it. | 20:47 |
| *** mylu has quit IRC | 20:48 | |
| notmorgan | ayoung: for newton, i would like to get implied roles to require you [the person setting the implied role] to have the role (admin role being magic) | 20:48 |
| notmorgan | ayoung: not needed this cycle clearly. | 20:48 |
| ayoung | ++++ | 20:48 |
| notmorgan | ayoung: i think having that would have eliminated the security hole you had to change policy for | 20:49 |
| notmorgan | ayoung: but this has to be iterative :) | 20:49 |
| *** esp has quit IRC | 20:51 | |
| ayoung | nope | 20:51 |
| notmorgan | ayoung: i'm thinking implied roles are going to only ever really be an admin thing actually. | 20:53 |
| notmorgan | ayoung: the more i think about it | 20:53 |
| notmorgan | since implied role is not scope specific | 20:53 |
| notmorgan | and shouldn't be | 20:53 |
| *** jsavak has quit IRC | 20:53 | |
| notmorgan | this is ignoring domain-roles. i mean just the core of implied roles | 20:54 |
| *** jsavak has joined #openstack-keystone | 20:54 | |
| *** henrynash has joined #openstack-keystone | 20:55 | |
| *** ChanServ sets mode: +v henrynash | 20:55 | |
| dolphm | jamielennox: henrynash: available for today's cross project meeting? | 20:56 |
| jamielennox | dolphm: yep | 20:56 |
| dolphm | ayoung: ^ if you're interested | 20:56 |
| henrynash | dolphm: I’m can’t do it today, sorry | 20:56 |
| ayoung | dolphm, yes | 20:56 |
| henrynash | dolphm: althoough I may lurk for a while.... | 20:57 |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Added CORS support to Keystone https://review.openstack.org/241317 | 20:57 |
| *** su_zhang has quit IRC | 20:57 | |
| *** aginwala has quit IRC | 20:57 | |
| henrynash | dolphm: in the regualr meeting irc channel? | 20:58 |
| jamielennox | henrynash: #openstack-meeting-cp | 20:58 |
| dolphm | henrynash: #openstack-meeting-cp | 20:58 |
| dolphm | in 2 minuets | 20:58 |
| jamielennox | jinx | 20:58 |
| samueldmq | henrynash: #openstack-meeting-cp | 20:58 |
| krotscheck | stevemar: Where's keystone's config generation script? | 20:58 |
| henrynash | ok, thx | 20:58 |
| krotscheck | stevemar: I don't see a bash script or a genconfig hook anywhere. | 20:59 |
| ayoung | notmorgan, notmorgan meaning "only admins will set up role inference rules" absolutely yes | 21:00 |
| samueldmq | krotscheck: tox -e genconfig | 21:00 |
| notmorgan | ayoung: only cloud-admin type folks. or explicitly delegated :can make these roles: | 21:01 |
| notmorgan | ayoung: erm implied roles not "make these roles" | 21:01 |
| notmorgan | (aka explicit role for the apis) | 21:01 |
| ayoung | notmorgan, yeah. DSRs will be more free to use | 21:01 |
| ayoung | domain specific roles I should say | 21:01 |
| *** daemontool has joined #openstack-keystone | 21:02 | |
| ayoung | as we've some acronym class there I've been told | 21:02 |
| krotscheck | samueldmq: Ah, yes. I am blind. | 21:02 |
| *** daemontool__ has quit IRC | 21:02 | |
| samueldmq | krotscheck: :) | 21:03 |
| samueldmq | krotscheck: nah that happens | 21:03 |
| krotscheck | samueldmq: Answered stevemar's quesiton :D | 21:03 |
| krotscheck | Turns out oslo.middleware's already in the config generator. | 21:03 |
| *** dims has joined #openstack-keystone | 21:03 | |
| krotscheck | aaanyway | 21:03 |
| *** krotscheck is now known as krotscheck_dcm | 21:03 | |
| *** e0ne has joined #openstack-keystone | 21:03 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: AuthContextMiddleware admin token handling https://review.openstack.org/198931 | 21:06 |
| notmorgan | bknudson_: can we merge the work from https://review.openstack.org/#/c/275443/ into that ^ or extract it and rebase on yours? | 21:13 |
| notmorgan | bknudson_: i would prefer to evict admin_token_auth from the pipeline vs just moving it | 21:13 |
| notmorgan | as default | 21:13 |
| bknudson_ | notmorgan: I'll put https://review.openstack.org/#/c/198931/ on https://review.openstack.org/#/c/275443/ | 21:14 |
| notmorgan | mine needs to be yanked out of the chain | 21:15 |
| notmorgan | would be better to just extrace the deprecation bits and add to yours or rebase on top of yours? | 21:15 |
| notmorgan | bknudson_: mine was deep in the pipeline cleanup chain, and that chain is broken up now cause ec2/s3 changes are squashed/not happening | 21:16 |
| bknudson_ | deprecating admin_token_auth shouldn't depend on ec2/s3 changes. | 21:17 |
| notmorgan | bknudson_: code structure wise was hard to do them independantly | 21:17 |
| notmorgan | since the ec2/s3 thing isn't happening, it needs to be pulled out | 21:17 |
| notmorgan | i picked the ec2/s3 first order since i was cleaning up .contrib first | 21:17 |
| notmorgan | so i'm guessing i am asking should i just rebase on top of yours? or ?? | 21:18 |
| stevemar | samueldmq: thanks for answering krotscheck_dcm's question :) | 21:18 |
| bknudson_ | notmorgan: no, I'd rather the admin_token deprecation happened first | 21:19 |
| notmorgan | ok | 21:19 |
| bknudson_ | then I don't have to mention any deprecation in mine, since it's already going away | 21:19 |
| notmorgan | ok | 21:19 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Fix trust chain/redelegation tests https://review.openstack.org/273232 | 21:19 |
| notmorgan | i'll either rebase mind later tonight or you can if you'd like. if i do it later i'll place yours on mind and drop the deprecation verbiage | 21:19 |
| stevemar | henrynash: ping if you're still around | 21:20 |
| samueldmq | stevemar: np | 21:21 |
| henrynash | stevemar: I’m lurking in the xproject meeting | 21:22 |
| stevemar | henrynash: oh, it can wait til that's over | 21:22 |
| *** browne has quit IRC | 21:24 | |
| *** daemontool_ has joined #openstack-keystone | 21:24 | |
| *** ninag has joined #openstack-keystone | 21:25 | |
| *** daemontool has quit IRC | 21:27 | |
| *** jbell8 has quit IRC | 21:30 | |
| *** ninag has quit IRC | 21:30 | |
| *** jgriffith is now known as jgriffith_away | 21:31 | |
| *** browne has joined #openstack-keystone | 21:34 | |
| dims | dstanek : https://review.openstack.org/#/c/278054/ looks good. | 21:35 |
| dims | stevemar : bknudson_ : can we please get that in? :) | 21:35 |
| bknudson_ | dims: we'll see what jenkins has to say | 21:35 |
| *** jsavak has quit IRC | 21:36 | |
| *** jsavak has joined #openstack-keystone | 21:37 | |
| *** vgridnev has quit IRC | 21:40 | |
| dstanek | bknudson_: jenkins can eat it :-) | 21:40 |
| *** jsavak has quit IRC | 21:41 | |
| dims | haha | 21:45 |
| *** jsavak has joined #openstack-keystone | 21:46 | |
| bknudson_ | don't make jenkins angry | 21:47 |
| bknudson_ | we'll probably have to sacrifice some animals now. | 21:47 |
| *** ninag has joined #openstack-keystone | 21:47 | |
| stevemar | bknudson_: i'm okay with sacrificing a core | 21:48 |
| stevemar | i'm glad to see our blacklist is getting smaller | 21:49 |
| *** raildo is now known as raildo-afk | 21:49 | |
| stevemar | bknudson_: also part of that chain: https://review.openstack.org/#/c/278053/1 | 21:50 |
| henrynash | stevemar: hi, what’s up | 21:53 |
| stevemar | dims: i don't see the os-testr library used? | 21:54 |
| dstanek | stevemar: i have a few more python3 reviews to crank out and then i'm start working through the m3 reviews! | 21:54 |
| stevemar | dstanek: awesome | 21:54 |
| dstanek | stevemar: os-testr is the test running | 21:54 |
| stevemar | henrynash: howdy, wanted to chat about dsr | 21:54 |
| dstanek | s/running/runner/ | 21:54 |
| henrynash | stevemar: dsr….ok… | 21:54 |
| henrynash | stevemar: (dynamic super rodents)? | 21:55 |
| *** petertr7 is now known as petertr7_away | 21:55 | |
| stevemar | henrynash: :) | 21:55 |
| *** su_zhang has joined #openstack-keystone | 21:55 | |
| stevemar | henrynash: just wanted to know if you think the domain specific roles stuff is still worth looking at? i know you've had the code posted for a while | 21:55 |
| dstanek | dirty scoundrels rotten | 21:56 |
| stevemar | henrynash: there's still some question marks about if this is the best approach for more fine grained policy | 21:56 |
| henrynash | stevemar: I just don’t buy that, no standard system can every suit all parties and domain admins can’t modify policy files | 21:57 |
| henrynash | stevemar: in fact, dsr becomes MORE relevant, when you have fined granined roles (since that’s where it gets it’s power) | 21:57 |
| stevemar | henrynash: alright, maybe i just need to refresh myself on the spec | 21:59 |
| stevemar | looks like ayoung and gyee have reviewed it, that's good | 21:59 |
| henrynash | ayoung: could you look at my fixes to the dsr patch….think I covered almost all the points you made | 22:00 |
| ayoung | henrynash, so to repeat: the way I've started thinking of things is in 3 levels. The top level is "here is the job you are assigned to do" the middle level is "here are the set of workflows you need to perform for your job" and the bottom level is "here are the permissions on the resources you need to perform the workflows" | 22:00 |
| *** jsavak has quit IRC | 22:00 | |
| ayoung | and henrynash your DSR is the top level | 22:00 |
| ayoung | so jamielennox 's proposal should probably be "workflows" and dolph's "end permissions" | 22:01 |
| henrynash | ayoung: certainly one way of looking at it | 22:01 |
| ayoung | I am a little worried that with really fine grained permissions and impolied roles we will expand the auth data too much | 22:01 |
| stevemar | henrynash: ayoung how does DSR play with https://review.openstack.org/#/c/245629/ ? can the two co-exist? | 22:01 |
| ayoung | I'd rather have that level expanded in the policy file itself | 22:02 |
| ayoung | stevemar, looking | 22:02 |
| henrynash | ayoung: it’s true, you gcould get lots of roles | 22:02 |
| ayoung | stevemar, the co-exisit | 22:02 |
| stevemar | gotta run the shop real quick, brb, i'll read the scroll back | 22:02 |
| stevemar | henrynash: i'll buckle down and actually review the code | 22:02 |
| jamielennox | ayoung: are you putting implied roles in the tokeN? | 22:03 |
| ayoung | stevemar, for example, henrynash goes and create a DSR called "distinguished-enigneer" which we assign to topol to make him feel good. Its really only given the "observer" role so he can't do an damage, though | 22:03 |
| henrynash | stevemar: thx | 22:03 |
| ayoung | well, miminal damage | 22:03 |
| jamielennox | sorry, the umbrella roles | 22:03 |
| ayoung | jamielennox, so, right now, yes. But we can shut that off with a config option | 22:03 |
| ayoung | I put that in there so we could convert to a dynamic policy approach in the future | 22:03 |
| jamielennox | ayoung: can we just start with it off | 22:04 |
| ayoung | jamielennox, nope | 22:04 |
| ayoung | jamielennox, I mean, we can do anything, | 22:04 |
| jamielennox | i don't see why if you have a role that implies other roles - the end roles are the more specific ones you would enforce on | 22:04 |
| ayoung | jamielennox, I want "admin implies member" at a minimum | 22:04 |
| jamielennox | everything implies member | 22:05 |
| ayoung | no | 22:05 |
| ayoung | I want that, and then I want the follow on patch that says "get a token with a subset of roles" | 22:05 |
| ayoung | so if you are an admin you can get a member token | 22:05 |
| ayoung | so youi don't swing your admin creds around everywhere | 22:05 |
| jamielennox | you are going to try and enforce from code what people put into the database | 22:06 |
| jamielennox | having admin is kind of a mess, what if we got to the point there was no admin role | 22:06 |
| jamielennox | someone got clever and renamed it global_admin | 22:06 |
| jamielennox | how do you expect to enforce a relationship | 22:06 |
| ayoung | heh, if they name it global_admin they will break every other service out there | 22:07 |
| ayoung | admin is like, hardcoded I found out the hard way | 22:08 |
| *** ninag has quit IRC | 22:08 | |
| ayoung | jamielennox, "what if we got to the point there was no admin role" I will be sooooo happpy | 22:08 |
| *** mylu has joined #openstack-keystone | 22:08 | |
| ayoung | jamielennox, so, why do you want it off? | 22:08 |
| jamielennox | for some services like glance the admin_role is specified in conf | 22:08 |
| jamielennox | the role is just a label, it's a hard concept to kill but you can probably relabel it | 22:09 |
| *** mylu has quit IRC | 22:09 | |
| jamielennox | it's the same problem that keystone can't provide any roles by default. we don't control that, we can't | 22:09 |
| jamielennox | we can specify what we think you should do and influence devstack | 22:09 |
| jamielennox | i'd like the role subset for a different reason, but i don't think you can just say admin implies something else | 22:10 |
| ayoung | jamielennox, OK, so the nice thing about implied roles is it gives us a way to move forward | 22:11 |
| ayoung | we can now change a policy file and people can unbreak things with implied roles | 22:11 |
| ayoung | say we add in the detailed roles you want, but they had not assigned them to anyone | 22:12 |
| *** sinese_ has quit IRC | 22:12 | |
| ayoung | you can start by saying "admin implies all these smaller ones" and get them in the tokens | 22:12 |
| ayoung | then, start removing admin and adding explicit assignments to people | 22:12 |
| jamielennox | maybe we should have left implied roles as there own concept as they are similar to domain specific roles except global | 22:13 |
| *** clenimar has quit IRC | 22:13 | |
| ayoung | the rules are their own concept. THe roles are roles | 22:13 |
| jamielennox | ie - they are a grouping mechanism not something i think you should be able to write policy against | 22:13 |
| ayoung | so, I could see you using them to generate policy in the future | 22:13 |
| ayoung | "we have too many roles, tokens are too big" | 22:14 |
| ayoung | so we generate a fragment of a policy file that gets included into the other projects | 22:14 |
| ayoung | jamielennox, here's what I really want to do | 22:16 |
| ayoung | 1. Leave the exisitng policy files alone | 22:16 |
| ayoung | 2. Write a bunch of rules that check policy against URLS, not policy identity_blah keys | 22:17 |
| ayoung | 3. Enforce these in middleware | 22:17 |
| ayoung | 4. Fetch them from a database | 22:17 |
| notmorgan | jamielennox: that is what i'd have preferred | 22:17 |
| ayoung | We do all that, then, yes, we can turn off the role expansion in the tokens | 22:18 |
| ayoung | but right now, its all or nothing | 22:18 |
| ayoung | there is no way to break a big role down into a little role | 22:18 |
| ayoung | and delegate a subset of what you have | 22:18 |
| ayoung | And that is a huge attack surface | 22:19 |
| ayoung | show me some other way to mitigate that | 22:19 |
| ayoung | something we can, practically speaking, make progress on. | 22:19 |
| *** mylu has joined #openstack-keystone | 22:19 | |
| *** henrynash has quit IRC | 22:19 | |
| jamielennox | so i'm fine with breaking down policy files | 22:20 |
| jamielennox | the more config management i do the less i want to have the services doing smart updating though | 22:20 |
| ayoung | jamielennox, I tried that | 22:20 |
| ayoung | it died in committee | 22:20 |
| *** diazjf has quit IRC | 22:20 | |
| jamielennox | an ansible job that updates policy through out an entire cloud is slightly risky but not that hard to do for something you'll update infrequently | 22:21 |
| ayoung | jamielennox, dead end | 22:22 |
| ayoung | "policy is a file that comes out of upstream openstack and we won't edit it" | 22:22 |
| ayoung | I started that way | 22:22 |
| *** tmckay has left #openstack-keystone | 22:22 | |
| ayoung | jamielennox, this was the smallest change I could make. | 22:23 |
| jamielennox | i don't care if it comes from upstream openstack | 22:23 |
| ayoung | jamielennox, everyone else does | 22:23 |
| jamielennox | this was the point of that cp spec, i wanted to make it a minimum better not solve everything for everyone | 22:23 |
| ayoung | and we can't go from what people deploy now to that spec without implied roles | 22:24 |
| ayoung | no practical path forward | 22:24 |
| ayoung | I think that spec is awesome | 22:24 |
| *** jbell8 has joined #openstack-keystone | 22:24 | |
| ayoung | and if we can make it happen, fantastic | 22:24 |
| ayoung | but we still need a way to transition people today to another policy file | 22:25 |
| jamielennox | ayoung: we can absolutely get to that spec now | 22:28 |
| jamielennox | ayoung: i essentially left admin as it was, added a bunch of new stuff | 22:28 |
| jamielennox | and when people get accustomed to having more roles than admin we make them fix whatever is hardcoded | 22:28 |
| ayoung | and no one will have any of those roles | 22:28 |
| jamielennox | so? they can add them | 22:29 |
| jamielennox | and if they don't add them it will never match policy | 22:29 |
| ayoung | so you will have policy files with "role:specific-thing or role:member" | 22:29 |
| jamielennox | adding roles that don't exist to policy files has no effect | 22:29 |
| ayoung | "adding roles that don't exist to policy files has no effect" | 22:29 |
| ayoung | exactly | 22:29 |
| jamielennox | assuming you don't require them - but we're not going to do anything backwards incompatible | 22:29 |
| jamielennox | yep, so you add them, then you get benefits | 22:30 |
| ayoung | jamielennox, lets get the roles laid out as you want them. We can write up example policy files of how to use them | 22:31 |
| jamielennox | dolphm, ayoung: if there's an ops midcycle somewhere next week i'd really like someone to put it to them | 22:32 |
| ayoung | if, down the road, we want to get rid of the expanding of the roles in the token and do it in policy | 22:32 |
| ayoung | jamielennox, there is...we have someone attending | 22:32 |
| ayoung | https://wiki.openstack.org/wiki/Sprints | 22:33 |
| notmorgan | jamielennox: in manchester UK | 22:33 |
| notmorgan | jamielennox: i was going to go, but have had other things come up | 22:33 |
| ayoung | Manchester, UK | 22:33 |
| notmorgan | not sure who from keystone is going | 22:33 |
| notmorgan | if anyone | 22:33 |
| *** aginwala has joined #openstack-keystone | 22:33 | |
| ayoung | henry just left | 22:34 |
| ayoung | I think it is a bit of a trip for him, though | 22:34 |
| *** nkinder has joined #openstack-keystone | 22:35 | |
| jamielennox | england is small - but not that small | 22:37 |
| *** dims_ has joined #openstack-keystone | 22:39 | |
| *** henrynash has joined #openstack-keystone | 22:39 | |
| *** ChanServ sets mode: +v henrynash | 22:39 | |
| bknudson_ | 3 hours from bristol to manchester | 22:40 |
| *** dims has quit IRC | 22:40 | |
| bknudson_ | that's a short drive in my opinion | 22:41 |
| bknudson_ | I wish I could get anywhere in 3 hours | 22:41 |
| henrynash | bknudson_: who’s driving from Bristol to Manchester? | 22:42 |
| jamielennox | henrynash: you hopefully | 22:44 |
| jamielennox | henrynash: are you going to the ops midcycle next week? | 22:44 |
| henrynash | jamielennox: :-) so I was planning to…expect it’s full and they won;t let me have a ticket!!! | 22:45 |
| notmorgan | henrynash: you should reach out to the organiser | 22:45 |
| henrynash | notmorgan: done that, no joy | 22:45 |
| jamielennox | henrynash: ok, we want someone to present the policy scenarios spec to the ops and get some input | 22:45 |
| notmorgan | lae | 22:45 |
| notmorgan | lame* | 22:45 |
| henrynash | notmorgan, jamielennox: agreed….I was stunned when they bascaialy turned me down! | 22:46 |
| bknudson_ | we should all go and protest in front of the meetup | 22:48 |
| bknudson_ | dstanek: you played with fire -- https://review.openstack.org/#/c/278053/ | 22:48 |
| henrynash | notmorgan, jamielennix: if anyone knows Lauren Sell <lauren@openstack.org> then feel free to lobby her! | 22:51 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Switch bandit to no-config https://review.openstack.org/278136 | 22:51 |
| notmorgan | i know Lauren | 22:51 |
| notmorgan | but i don't think i am going to be much help | 22:51 |
| henrynash | notmorgan: I think they just are out of space…they didn’t book a big enough venue | 22:52 |
| notmorgan | if she was the one to turn you down [you made a case for it being about core represenatation] then they're really out of space | 22:52 |
| henrynash | notmorgan: yep…I think they just underestimated the interest in the UK | 22:52 |
| notmorgan | yeah | 22:52 |
| notmorgan | i figured it was community organiser not foundation organiser | 22:53 |
| henrynash | ok…well, gonna hit the sack... | 22:53 |
| notmorgan | see ya | 22:53 |
| *** henrynash has quit IRC | 22:53 | |
| bknudson_ | dstanek: might be related to new eventlet! | 22:55 |
| bknudson_ | dstanek: https://github.com/eventlet/eventlet/commit/5bf0a6f32b3e4459b38ad1895c9eb4b0b483dae1#commitcomment-15987613 | 22:55 |
| notmorgan | jamielennox: have a few moments? | 22:56 |
| *** mylu has quit IRC | 22:56 | |
| jamielennox | notmorgan: sure.. | 22:56 |
| notmorgan | jamielennox: just ran across this https://github.com/openstack/python-cinderclient/blob/master/cinderclient/tests/unit/fixture_data/keystone_client.py | 22:57 |
| jamielennox | notmorgan: oh - wow, ok | 22:57 |
| *** tsymanczyk has quit IRC | 22:58 | |
| notmorgan | jamielennox: trying to figure out the best way to unwind that in the ksa way... because it's breaking discovery in the cinderclient tests in some... subtleway | 22:58 |
| jamielennox | well that's a fairly easy fix | 22:58 |
| *** rcernin has quit IRC | 22:58 | |
| *** su_zhang has quit IRC | 22:58 | |
| *** su_zhang_ has joined #openstack-keystone | 22:58 | |
| notmorgan | jamielennox: yeah i figured i'd ask you and have the easy answer or muddle through a harder answer | 22:58 |
| jamielennox | notmorgan: it looks like everything in there can be replaced with a ksa fixture | 22:58 |
| dstanek | bknudson_: yeah, it looks like i got burned | 22:58 |
| notmorgan | it's the last of the things i think i need to fix for cinderclient -> ksa | 22:58 |
| bknudson_ | dstanek: fails the same way for me locally -- hangs | 22:59 |
| jamielennox | notmorgan: do you know what's wrong with their fixtures | 22:59 |
| jamielennox | notmorgan: i don't know if i want to know, just so long as we haven't made a compatibility mistake somewhere between ksa and ksc | 22:59 |
| *** mylu has joined #openstack-keystone | 22:59 | |
| dstanek | bknudson_: i wonder if i have a different version of eventlet locally | 22:59 |
| dstanek | i'm regenerating my venv now and trying it out | 22:59 |
| bknudson_ | dstanek: .tox/py34/bin/pip install -U eventlet | 22:59 |
| *** su_zhang_ has quit IRC | 22:59 | |
| *** su_zhang has joined #openstack-keystone | 23:00 | |
| *** su_zhang has quit IRC | 23:00 | |
| *** su_zhang has joined #openstack-keystone | 23:00 | |
| openstackgerrit | Dina Belova proposed openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 23:01 |
| notmorgan | jamielennox: it might be in their code | 23:01 |
| notmorgan | actually | 23:01 |
| jamielennox | notmorgan: i'm guessing it is, i just want to know someone checked it | 23:02 |
| jamielennox | someone in this case being... | 23:02 |
| *** daemontool__ has joined #openstack-keystone | 23:03 | |
| *** tsymanczyk has joined #openstack-keystone | 23:03 | |
| notmorgan | jamielennox: here is the breakage https://github.com/openstack/python-cinderclient/blob/master/cinderclient/shell.py#L772-L800 | 23:03 |
| notmorgan | the resulting path is '/' in *some* cases | 23:03 |
| notmorgan | not all | 23:03 |
| notmorgan | around line 790 | 23:03 |
| *** tsymanczyk is now known as Guest12840 | 23:03 | |
| dstanek | bknudson_: https://review.openstack.org/#/c/277912/1 screwed me i think | 23:03 |
| notmorgan | i'm guessing this is also something we can eliminate a chunk of. | 23:04 |
| jamielennox | notmorgan: gah, yea if you are replacing that with ksa's discovery then just remove it | 23:04 |
| dstanek | it works find with 17.0.4 | 23:04 |
| notmorgan | jamielennox: replace the whole function? | 23:04 |
| notmorgan | jamielennox: or just the extra bits. | 23:04 |
| jamielennox | notmorgan: you should be able to do it with a get_endpoint call | 23:04 |
| notmorgan | hmm. | 23:04 |
| jamielennox | or better yet just let the client do it | 23:04 |
| *** daemontool_ has quit IRC | 23:04 | |
| jamielennox | there's no reason for cinder to inspect that | 23:05 |
| jamielennox | cinder CLI | 23:05 |
| notmorgan | (v2_auth_url, v3_auth_url) = self._discover_auth_versions( | 23:06 |
| notmorgan | session=ks_session, | 23:06 |
| notmorgan | auth_url=self.options.os_auth_url) | 23:06 |
| notmorgan | that looks like where we can make this less icky | 23:06 |
| notmorgan | i'm trying to do minimal changes to get them on KSA then do larger cleanups | 23:06 |
| notmorgan | since on ksa = much much better sooner | 23:07 |
| notmorgan | and likely to land quicker | 23:07 |
| *** timcline has quit IRC | 23:07 | |
| notmorgan | really.. we do the same check like 3 times | 23:07 |
| * notmorgan sighs. | 23:07 | |
| dims_ | dstanek : got a log? (eventlet break) | 23:08 |
| dstanek | dims_: http://logs.openstack.org/53/278053/1/check/gate-keystone-python34/cf3e9e3/console.html | 23:08 |
| notmorgan | jamielennox: ok https://github.com/openstack/python-cinderclient/blob/master/cinderclient/shell.py#L802 this just needs to become loading thing | 23:08 |
| dstanek | looking to see if i can just disable a test or two | 23:08 |
| notmorgan | jamielennox: thanks. | 23:09 |
| dims_ | dstanek : ah wsgi, here's a fix that nova folks made https://review.openstack.org/#/c/278089/ | 23:10 |
| dims_ | dstanek : they switched the tests to use requests | 23:10 |
| *** peter-hamilton has quit IRC | 23:10 | |
| notmorgan | jamielennox: wow, cinder has it's own authplugin framework. | 23:12 |
| jamielennox | notmorgan: :( | 23:12 |
| notmorgan | jamielennox: oh for non-keystone auth | 23:12 |
| notmorgan | phew | 23:12 |
| jamielennox | notmorgan: is it the one that novaclient tried | 23:12 |
| notmorgan | PHEW | 23:12 |
| notmorgan | yeah | 23:12 |
| jamielennox | notmorgan: so i was never successful in doing a bridge between that and the new plugins, can't remember why | 23:12 |
| notmorgan | don't worry | 23:13 |
| jamielennox | there was something weird they did | 23:13 |
| notmorgan | they only fall back on it when keystone != auth_system | 23:13 |
| notmorgan | so we aren't used anyway | 23:13 |
| *** aginwala has quit IRC | 23:14 | |
| dstanek | dims_: this is an error on the server side it seems | 23:15 |
| *** aginwala has joined #openstack-keystone | 23:16 | |
| *** phalmos has quit IRC | 23:16 | |
| *** gokrokve has joined #openstack-keystone | 23:19 | |
| dims_ | dstanek : +1 to skip these tests, we can ping haypo has he submitted some of these changes in eventlet tomorrow morning europe time | 23:19 |
| dstanek | dims_: i think i got it now; i suspect this is starting to fail all of our py3 tests, but luckily they are not voting | 23:20 |
| *** daemontool_ has joined #openstack-keystone | 23:20 | |
| dims_ | dstanek : ok | 23:20 |
| *** daemontool__ has quit IRC | 23:22 | |
| *** gokrokve has quit IRC | 23:23 | |
| *** daemontool_ has quit IRC | 23:28 | |
| *** daemontool has joined #openstack-keystone | 23:29 | |
| *** slberger has left #openstack-keystone | 23:32 | |
| bigjools | is there any kind of test double/fake or actual test fixture that can be re-used outside of keystone tests in other projects? | 23:34 |
| openstackgerrit | David Stanek proposed openstack/keystone: Disable the ipv6 tests https://review.openstack.org/278147 | 23:36 |
| dstanek | bknudson_: try that ^ | 23:36 |
| dstanek | bigjools: what are you trying to do? | 23:38 |
| bigjools | dstanek: for my sins, I'm adding better v3 support in Rally but their tests are mocked like crazy and extremely brittle. I was wondering if I could use a real fixture instead. | 23:38 |
| *** gordc has quit IRC | 23:39 | |
| dstanek | bigjools: for keystone you may be able to use some of ours, but i doubt it. they are very specific to how we setup our unit tess | 23:39 |
| dstanek | bigjools: how are they brittle? | 23:39 |
| bigjools | yeah I figured as much | 23:39 |
| bigjools | brittle because almost every aspect of creating a client is a mock and depends on implementation details, so you can't re-implement a function (to do the same thing) without breaking a test. | 23:40 |
| *** pushkaru has quit IRC | 23:40 | |
| bigjools | I'd love to see oslo.fakes or oslo.fixtures | 23:40 |
| dstanek | bigjools: yeah, that sounds like they are doing it wrong. do you have a link i can look at? | 23:40 |
| bigjools | I'll point you at some of their tests, one sec | 23:41 |
| dstanek | bigjools: there are generic fixtures | 23:41 |
| *** pushkaru has joined #openstack-keystone | 23:41 | |
| bigjools | dstanek: here's an example. The mocks are all set up in the test base class (another anti-pattern :( ) https://github.com/openstack/rally/blob/master/tests/unit/plugins/openstack/scenarios/keystone/test_utils.py | 23:43 |
| dstanek | bigjools: keystone specific: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/ksfixtures ; olso.test fixtures can be mostly found here: http://git.openstack.org/cgit/openstack/oslotest/tree/oslotest | 23:43 |
| bigjools | looking, thanks | 23:44 |
| dstanek | bigjools: wow,mocking uuid? | 23:44 |
| dstanek | bigjools: you can start migrating that setup code into fixtures | 23:44 |
| bigjools | I'm saying nothing :) | 23:44 |
| bigjools | I just started hacking on rally a week ago | 23:45 |
| *** pushkaru has quit IRC | 23:45 | |
| dstanek | bigjools: good luck with that :-) | 23:46 |
| bigjools | dstanek: yeah thanks :) | 23:46 |
| *** su_zhang has quit IRC | 23:47 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:51 | |
| *** shoutm has joined #openstack-keystone | 23:57 | |
| *** su_zhang has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
