| *** spzala has quit IRC | 00:00 | |
| *** crinkle has quit IRC | 00:03 | |
| *** crinkle_ has joined #openstack-keystone | 00:03 | |
| *** crinkle_ is now known as crinkle | 00:04 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove support for trust scoped tokens in v2.0 https://review.openstack.org/278802 | 00:05 |
|---|---|---|
| lbragstad | ayoung ^ | 00:05 |
| lbragstad | ayoung there is one test case there that is failing that I can't figure out | 00:05 |
| lbragstad | something to do with token persistence | 00:05 |
| *** mylu has joined #openstack-keystone | 00:05 | |
| *** nekrodesk has quit IRC | 00:11 | |
| dstanek | lbragstad: you still working? | 00:13 |
| dstanek | bigjools: are you thinking version discovery? | 00:14 |
| bigjools | dstanek: it's in direct contradiction to http://dolphm.com/openstack-keystone-service-catalog/ | 00:15 |
| bigjools | and yes, discovery | 00:15 |
| dstanek | you may want to ask the devstack folks | 00:15 |
| bigjools | sure, just wanted to get you guys opinion on it | 00:17 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Convert policy to yaml https://review.openstack.org/278542 | 00:20 |
| *** mylu has quit IRC | 00:26 | |
| *** jsavak has quit IRC | 00:28 | |
| *** mylu has joined #openstack-keystone | 00:29 | |
| *** nekrodesk has joined #openstack-keystone | 00:32 | |
| *** Dave_____ is now known as Dave | 00:34 | |
| jamielennox | bigjools: there shouldn't be a v3 version in the catalog | 00:34 |
| bigjools | jamielennox: right, thanks. just wondered if devstack was special. | 00:34 |
| *** slberger has left #openstack-keystone | 00:34 | |
| *** mylu has quit IRC | 00:40 | |
| *** mylu has joined #openstack-keystone | 00:40 | |
| *** aginwala has quit IRC | 00:42 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 00:43 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Allow parameter expansion in endpoint_override https://review.openstack.org/271120 | 00:43 |
| *** aginwala has joined #openstack-keystone | 00:45 | |
| *** mylu has quit IRC | 00:46 | |
| *** aginwala has quit IRC | 00:46 | |
| *** aginwala has joined #openstack-keystone | 00:46 | |
| *** mylu has joined #openstack-keystone | 00:47 | |
| *** mylu has quit IRC | 00:49 | |
| *** mylu has joined #openstack-keystone | 00:49 | |
| openstackgerrit | Tin Lam proposed openstack/keystone: Removing H405 violations from keystone https://review.openstack.org/278190 | 00:50 |
| *** mylu has quit IRC | 00:52 | |
| *** mylu has joined #openstack-keystone | 00:55 | |
| *** spzala has joined #openstack-keystone | 00:55 | |
| *** mylu has quit IRC | 00:59 | |
| *** spzala has quit IRC | 01:00 | |
| *** mylu has joined #openstack-keystone | 01:01 | |
| *** mylu has quit IRC | 01:03 | |
| *** mylu has joined #openstack-keystone | 01:06 | |
| *** mylu has quit IRC | 01:08 | |
| *** mylu has joined #openstack-keystone | 01:08 | |
| *** aginwala has quit IRC | 01:13 | |
| *** mylu has quit IRC | 01:13 | |
| *** jbell8 has quit IRC | 01:15 | |
| *** mylu has joined #openstack-keystone | 01:15 | |
| zigo | stevemar: I'm around now. | 01:16 |
| zigo | Are you still up? | 01:16 |
| *** harlowja has quit IRC | 01:18 | |
| *** mylu has quit IRC | 01:18 | |
| *** chlong has joined #openstack-keystone | 01:18 | |
| *** aginwala has joined #openstack-keystone | 01:20 | |
| *** spandhe has quit IRC | 01:21 | |
| *** _cjones_ has quit IRC | 01:24 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/278677 | 01:28 |
| *** jasondotstar has quit IRC | 01:35 | |
| *** raginbajin has quit IRC | 01:35 | |
| *** aginwala has quit IRC | 01:35 | |
| *** jasonsb has joined #openstack-keystone | 01:35 | |
| *** dims_ has joined #openstack-keystone | 01:37 | |
| *** jasondotstar has joined #openstack-keystone | 01:37 | |
| *** raginbajin has joined #openstack-keystone | 01:37 | |
| *** dims has quit IRC | 01:38 | |
| *** dims_ has quit IRC | 01:41 | |
| *** gildub has quit IRC | 01:41 | |
| *** alex_xu has quit IRC | 01:43 | |
| *** lhcheng has quit IRC | 01:44 | |
| *** alex_xu has joined #openstack-keystone | 01:45 | |
| *** gyee has quit IRC | 01:48 | |
| *** dims has joined #openstack-keystone | 01:49 | |
| openstackgerrit | Anu G Enchackal proposed openstack/keystone: test commit https://review.openstack.org/278826 | 01:50 |
| *** mylu has joined #openstack-keystone | 01:51 | |
| *** mylu has quit IRC | 01:54 | |
| *** spzala has joined #openstack-keystone | 01:58 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Split oslo_config and list all opts https://review.openstack.org/267277 | 02:02 |
| *** spzala has quit IRC | 02:02 | |
| *** lhcheng has joined #openstack-keystone | 02:03 | |
| *** ChanServ sets mode: +v lhcheng | 02:03 | |
| *** edmondsw has quit IRC | 02:03 | |
| *** lhcheng has quit IRC | 02:03 | |
| *** browne has quit IRC | 02:07 | |
| *** alex_xu has quit IRC | 02:08 | |
| *** alex_xu has joined #openstack-keystone | 02:10 | |
| *** jasonsb has quit IRC | 02:10 | |
| *** daemontool has quit IRC | 02:11 | |
| *** jasonsb has joined #openstack-keystone | 02:13 | |
| *** jasonsb has quit IRC | 02:14 | |
| *** clenimar_ has joined #openstack-keystone | 02:14 | |
| dolphm | bigjools: ideally, devstack would use unversioned endpoints, but the reality is that we have an ecosystem of existing clients that don't *all* support api version discovery *well*, so the catalog reflects the lowest common denominator. any step we can make towards smarter clients is a step towards unversioned endpoints. | 02:14 |
| bigjools | gotcha | 02:15 |
| *** openstackgerrit has quit IRC | 02:15 | |
| dolphm | bigjools: so it's not simply a matter of changing the endpoints that are created in devstack :( although that's a great way to find what breaks ;) | 02:15 |
| *** chlong has quit IRC | 02:15 | |
| bigjools | yeah, I'm doing precisely that right now, I see breakage :) | 02:16 |
| *** clenimar_ has quit IRC | 02:16 | |
| jamielennox | dolphm: sure, but the fact that they've got /v3 endpoints in the catalog means that it should have broken already if there was something relying on that | 02:18 |
| dolphm | jamielennox: i'm not *just* talking about keystone, and i'm not *just* talking about the latest version of every client | 02:19 |
| dolphm | bigjools: jamielennox: for bonus points, make tempest work with unversioned URLs in the [identity] url and url_v3 config options, and let it work with unversioned URLs in the actual catalog | 02:21 |
| dolphm | otherwise, defcore effectively asserts that everyone use versioned URLs | 02:21 |
| jamielennox | dolphm: agree on nova and others, however for devstack its almost by definition the latest version so i think it's ok to do the newest thing there | 02:21 |
| *** spzala has joined #openstack-keystone | 02:21 | |
| *** daemontool has joined #openstack-keystone | 02:23 | |
| *** openstackgerrit has joined #openstack-keystone | 02:23 | |
| *** chlong has joined #openstack-keystone | 02:29 | |
| *** spzala has quit IRC | 02:29 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 02:31 |
| *** nekrodesk has quit IRC | 02:31 | |
| *** jbell8 has joined #openstack-keystone | 02:32 | |
| *** jbell8 has quit IRC | 02:39 | |
| *** lhcheng has joined #openstack-keystone | 02:45 | |
| *** ChanServ sets mode: +v lhcheng | 02:45 | |
| *** su_zhang has quit IRC | 02:45 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/278728 | 02:46 |
| *** csoukup_ has joined #openstack-keystone | 02:46 | |
| *** woodster_ has quit IRC | 02:46 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/278678 | 02:47 |
| *** csoukup_ has quit IRC | 02:50 | |
| *** lhcheng_ has joined #openstack-keystone | 02:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 02:54 |
| *** lhcheng has quit IRC | 02:56 | |
| *** roxanaghe has quit IRC | 02:58 | |
| *** lhcheng has joined #openstack-keystone | 02:58 | |
| *** ChanServ sets mode: +v lhcheng | 02:58 | |
| *** dikonoor has joined #openstack-keystone | 03:00 | |
| *** lhcheng_ has quit IRC | 03:01 | |
| *** browne has joined #openstack-keystone | 03:06 | |
| *** mylu has joined #openstack-keystone | 03:06 | |
| *** daemontool has quit IRC | 03:08 | |
| *** links has joined #openstack-keystone | 03:10 | |
| *** spandhe has joined #openstack-keystone | 03:11 | |
| *** spandhe_ has joined #openstack-keystone | 03:13 | |
| dstanek | yay, here comes all the things! | 03:13 |
| *** bill_az_ has quit IRC | 03:15 | |
| *** spandhe has quit IRC | 03:15 | |
| *** spandhe_ is now known as spandhe | 03:15 | |
| *** fawadkhaliq has joined #openstack-keystone | 03:16 | |
| *** spandhe has quit IRC | 03:20 | |
| *** spandhe has joined #openstack-keystone | 03:20 | |
| *** mylu has quit IRC | 03:34 | |
| *** mylu has joined #openstack-keystone | 03:35 | |
| openstackgerrit | Merged openstack/keystone: Remove support for trusts in v2.0 https://review.openstack.org/274850 | 03:39 |
| openstackgerrit | Merged openstack/keystone: Consolidate the fernet provider validate_v2_token() https://review.openstack.org/274851 | 03:39 |
| openstackgerrit | Merged openstack/keystone: Added CORS support to Keystone https://review.openstack.org/241317 | 03:39 |
| openstackgerrit | Merged openstack/keystone: Make fernet work with oauth1 authentication https://review.openstack.org/267781 | 03:39 |
| *** lhcheng has quit IRC | 03:42 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 03:43 |
| *** su_zhang has joined #openstack-keystone | 03:43 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 03:44 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 03:45 |
| *** roxanaghe has joined #openstack-keystone | 03:46 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 03:47 |
| *** roxanaghe has quit IRC | 03:47 | |
| *** nekrodesk has joined #openstack-keystone | 03:48 | |
| *** jasonsb has joined #openstack-keystone | 03:52 | |
| *** ptoohill has left #openstack-keystone | 03:52 | |
| stevemar | dstanek: ALL THE THINGS MERGED! | 03:56 |
| *** aginwala has joined #openstack-keystone | 04:04 | |
| *** lhcheng has joined #openstack-keystone | 04:07 | |
| *** ChanServ sets mode: +v lhcheng | 04:07 | |
| *** tsymanczyk has joined #openstack-keystone | 04:13 | |
| *** Guest52385 has quit IRC | 04:13 | |
| *** tsymanczyk is now known as Guest19120 | 04:13 | |
| *** boris-42 has quit IRC | 04:14 | |
| *** woodster_ has joined #openstack-keystone | 04:23 | |
| *** Nirupama has joined #openstack-keystone | 04:25 | |
| *** diazjf has joined #openstack-keystone | 04:28 | |
| *** jgriffith is now known as jgriffith_away | 04:31 | |
| *** mylu has quit IRC | 04:34 | |
| *** aginwala has quit IRC | 04:34 | |
| *** mylu has joined #openstack-keystone | 04:38 | |
| *** dims has quit IRC | 04:43 | |
| *** fawadkhaliq has quit IRC | 04:46 | |
| *** roxanaghe has joined #openstack-keystone | 04:48 | |
| ayoung | Wow | 04:51 |
| ayoung | such merge. Very Gate | 04:51 |
| *** roxanaghe has quit IRC | 04:52 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Service Catalog Subsets by ID https://review.openstack.org/160909 | 04:57 |
| openstackgerrit | ayoung proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 04:57 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove PostParams middleware https://review.openstack.org/277664 | 04:58 |
| stevemar | ayoung: ^ easyyyy patch | 05:02 |
| *** markvoelker has quit IRC | 05:03 | |
| *** clenimar_ has joined #openstack-keystone | 05:04 | |
| *** clenimar_ has quit IRC | 05:04 | |
| *** jamielennox is now known as jamielennox|away | 05:06 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Make pep8 *the* linting interface https://review.openstack.org/278599 | 05:06 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Deprecate admin_token_auth https://review.openstack.org/275443 | 05:07 |
| *** aginwala has joined #openstack-keystone | 05:08 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:11 | |
| *** aginwala has quit IRC | 05:12 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Make pep8 *the* linting interface https://review.openstack.org/278602 | 05:14 |
| *** dave-mcc_ has quit IRC | 05:15 | |
| openstackgerrit | Merged openstack/keystone: Added tokenless auth headers to CORS middleware https://review.openstack.org/278580 | 05:18 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 05:20 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Followup for LDAP removal https://review.openstack.org/277196 | 05:21 |
| *** jgriffith_away is now known as jgriffith | 05:21 | |
| *** mylu has quit IRC | 05:24 | |
| *** mylu has joined #openstack-keystone | 05:27 | |
| *** jamielennox|away is now known as jamielennox | 05:31 | |
| *** roxanaghe has joined #openstack-keystone | 05:49 | |
| *** roxanaghe has quit IRC | 05:52 | |
| *** roxanaghe has joined #openstack-keystone | 05:52 | |
| *** vgridnev has joined #openstack-keystone | 05:58 | |
| *** dikonoor has quit IRC | 05:59 | |
| *** markvoelker has joined #openstack-keystone | 06:04 | |
| *** wasmum has quit IRC | 06:05 | |
| *** jaosorior has joined #openstack-keystone | 06:10 | |
| *** dan_nguyen has quit IRC | 06:18 | |
| stevemar | jamielennox: poke | 06:19 |
| jamielennox | stevemar: sup | 06:19 |
| stevemar | jamielennox: punt this one through? https://review.openstack.org/#/c/277664/ | 06:19 |
| stevemar | jamielennox: it's not used anywhere... | 06:20 |
| jamielennox | stevemar: weird, done | 06:20 |
| stevemar | thanks sir | 06:21 |
| *** spandhe has quit IRC | 06:32 | |
| *** markvoelker has quit IRC | 06:34 | |
| openstackgerrit | Merged openstack/keystone: Make pep8 *the* linting interface https://review.openstack.org/278591 | 06:36 |
| *** woodster_ has quit IRC | 06:36 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/278676 | 06:36 |
| openstackgerrit | Merged openstack/keystone: Moves policy setup into a fixture. https://review.openstack.org/278528 | 06:37 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix release note of removal of v2.0 trusts support https://review.openstack.org/278647 | 06:39 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Stop using nose as a Python3 test runner https://review.openstack.org/278054 | 06:40 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Enables token_data_helper tests for Python3 https://review.openstack.org/278055 | 06:40 |
| *** lhcheng has quit IRC | 06:42 | |
| *** vgridnev has quit IRC | 06:43 | |
| *** henrynash has joined #openstack-keystone | 06:47 | |
| *** ChanServ sets mode: +v henrynash | 06:47 | |
| *** vgridnev has joined #openstack-keystone | 06:55 | |
| *** jaosorior has quit IRC | 06:56 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Change get_project permission https://review.openstack.org/270057 | 06:59 |
| *** aginwala has joined #openstack-keystone | 07:02 | |
| *** vgridnev has quit IRC | 07:10 | |
| *** vgridnev has joined #openstack-keystone | 07:18 | |
| *** jaosorior has joined #openstack-keystone | 07:20 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove eventlet support https://review.openstack.org/249486 | 07:28 |
| openstackgerrit | Merged openstack/keystone: Deprecate Saml2 auth plugin https://review.openstack.org/275438 | 07:29 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove eventlet support https://review.openstack.org/249486 | 07:29 |
| openstackgerrit | Merged openstack/keystone: Add backend support for deleting a projects list https://review.openstack.org/245916 | 07:30 |
| *** rudolfvriend has joined #openstack-keystone | 07:32 | |
| *** jaosorior has quit IRC | 07:32 | |
| *** fhubik has joined #openstack-keystone | 07:36 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/278901 | 07:40 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/278902 | 07:40 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/278903 | 07:40 |
| *** diazjf has quit IRC | 07:42 | |
| *** spandhe has joined #openstack-keystone | 07:42 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/278907 | 07:44 |
| *** spandhe_ has joined #openstack-keystone | 07:45 | |
| *** spandhe has quit IRC | 07:47 | |
| *** spandhe_ is now known as spandhe | 07:47 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 07:52 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 07:53 |
| *** richm has joined #openstack-keystone | 07:55 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 07:55 |
| *** fhubik has quit IRC | 07:57 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Deprecate admin_token_auth https://review.openstack.org/275443 | 07:58 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Followup for LDAP removal https://review.openstack.org/277196 | 07:59 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 07:59 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 08:00 |
| *** jaosorior has joined #openstack-keystone | 08:05 | |
| openstackgerrit | Merged openstack/keystone: Remove PostParams middleware https://review.openstack.org/277664 | 08:05 |
| *** vgridnev has quit IRC | 08:06 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 08:08 |
| *** aginwala_ has joined #openstack-keystone | 08:09 | |
| *** sinese_ has joined #openstack-keystone | 08:10 | |
| *** aginwala has quit IRC | 08:11 | |
| *** mylu has quit IRC | 08:12 | |
| *** spandhe_ has joined #openstack-keystone | 08:26 | |
| *** jed56 has joined #openstack-keystone | 08:26 | |
| *** spandhe has quit IRC | 08:28 | |
| *** spandhe_ is now known as spandhe | 08:28 | |
| *** henrynash has quit IRC | 08:31 | |
| *** su_zhang has quit IRC | 08:34 | |
| *** sinese_ has quit IRC | 08:34 | |
| *** su_zhang has joined #openstack-keystone | 08:35 | |
| *** rcernin has joined #openstack-keystone | 08:35 | |
| *** browne has quit IRC | 08:38 | |
| *** su_zhang has quit IRC | 08:39 | |
| *** e0ne has joined #openstack-keystone | 08:42 | |
| *** aginwala_ has quit IRC | 08:43 | |
| *** mylu has joined #openstack-keystone | 08:43 | |
| *** pnavarro has joined #openstack-keystone | 08:43 | |
| *** aginwala has joined #openstack-keystone | 08:44 | |
| *** openstackgerrit has quit IRC | 08:47 | |
| *** openstackgerrit_ has joined #openstack-keystone | 08:47 | |
| *** mhickey has joined #openstack-keystone | 08:47 | |
| *** mylu has quit IRC | 08:47 | |
| *** openstackgerrit_ is now known as openstackgerrit | 08:48 | |
| *** aginwala has quit IRC | 08:49 | |
| *** alex_xu_ has joined #openstack-keystone | 08:49 | |
| *** alex_xu has quit IRC | 08:52 | |
| *** roxanaghe has quit IRC | 08:57 | |
| *** fawadkhaliq has quit IRC | 08:59 | |
| *** fhubik has joined #openstack-keystone | 09:00 | |
| *** fhubik is now known as fhubik_brb | 09:00 | |
| *** fhubik_brb is now known as fhubik | 09:05 | |
| *** mylu has joined #openstack-keystone | 09:13 | |
| *** fhubik is now known as fhubik_brb | 09:13 | |
| *** spandhe has quit IRC | 09:14 | |
| *** mylu has quit IRC | 09:18 | |
| *** _cjones_ has joined #openstack-keystone | 09:18 | |
| *** fhubik_brb is now known as fhubik | 09:18 | |
| *** _cjones_ has quit IRC | 09:25 | |
| *** vgridnev has joined #openstack-keystone | 09:25 | |
| *** _cjones_ has joined #openstack-keystone | 09:25 | |
| *** mvk has joined #openstack-keystone | 09:27 | |
| *** markvoelker has joined #openstack-keystone | 09:31 | |
| *** alexpro has quit IRC | 09:33 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/278903 | 09:33 |
| *** markvoelker has quit IRC | 09:36 | |
| *** gildub has joined #openstack-keystone | 09:38 | |
| *** gildub has quit IRC | 09:45 | |
| *** _cjones_ has quit IRC | 09:46 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/278902 | 09:46 |
| rudolfvriend | good morning keystone crowd ;) a maybe dumb question from a contributor newbie: how do I indicate best that I’m ‚done‘ with a commit and the review can proceed? https://review.openstack.org/#/c/276873/ | 09:57 |
| *** roxanaghe has joined #openstack-keystone | 09:58 | |
| *** gildub has joined #openstack-keystone | 10:02 | |
| *** roxanaghe has quit IRC | 10:02 | |
| *** spandhe has joined #openstack-keystone | 10:02 | |
| *** nekrodesk has quit IRC | 10:02 | |
| *** vgridnev has quit IRC | 10:03 | |
| *** vgridnev has joined #openstack-keystone | 10:08 | |
| *** vgridnev has quit IRC | 10:09 | |
| *** vgridnev has joined #openstack-keystone | 10:11 | |
| *** vgridnev has quit IRC | 10:12 | |
| *** vgridnev has joined #openstack-keystone | 10:12 | |
| *** vgridnev has quit IRC | 10:13 | |
| *** mylu has joined #openstack-keystone | 10:14 | |
| *** vgridnev has joined #openstack-keystone | 10:15 | |
| *** mylu has quit IRC | 10:19 | |
| *** gildub has quit IRC | 10:21 | |
| *** gildub has joined #openstack-keystone | 10:22 | |
| marekd | rudolfvriend: welcome! | 10:25 |
| marekd | rudolfvriend: first of all I doubt anybody will be doing serious reviews if the automatic jenkins tests are not passing | 10:26 |
| marekd | so make sure they do | 10:26 |
| marekd | and even if they still pass and you are not ready for a review you can still upload your code and later hit a button "Reply" and set "Workflow" to -1 | 10:27 |
| marekd | which will be a clear indication for the reviewers that the patch is still "work in progress" | 10:27 |
| rudolfvriend | does that mean when everything is ‚green‘ (tests) and workflow is not -1 that the review will be picked up again? | 10:32 |
| *** vgridnev has quit IRC | 10:34 | |
| marekd | rudolfvriend: what do you mean 'picked up' ? | 10:39 |
| marekd | if workflow is not set to -1 and tests passes this means that somebody doing reviews will be likely to take a look. It's pointless to review something that even doesn't pass unit tests :-) | 10:40 |
| *** vgridnev has joined #openstack-keystone | 10:42 | |
| *** vgridnev has quit IRC | 10:45 | |
| *** vgridnev has joined #openstack-keystone | 10:46 | |
| *** jbell8 has joined #openstack-keystone | 10:48 | |
| *** dims has joined #openstack-keystone | 10:48 | |
| rudolfvriend | ok. understood: I do not need to do anything else besides making sure the tests pass and worklow is not set to -1.. thanks. | 10:52 |
| marekd | rudolfvriend: well, you can also ask some cores (and non-cores) to review the patch. But, try to be gentle in that matter :-) | 10:54 |
| marekd | but i seee you added some reviewers in the patch | 10:54 |
| *** mvk has quit IRC | 10:54 | |
| *** roxanaghe has joined #openstack-keystone | 10:59 | |
| *** roxanaghe has quit IRC | 11:03 | |
| openstackgerrit | Merged openstack/keystone: Fix release note of removal of v2.0 trusts support https://review.openstack.org/278647 | 11:13 |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/278901 | 11:15 |
| *** fawadkhaliq has joined #openstack-keystone | 11:16 | |
| *** daemontool has joined #openstack-keystone | 11:21 | |
| *** mvk has joined #openstack-keystone | 11:26 | |
| *** jbell8 has quit IRC | 11:28 | |
| *** jbell8 has joined #openstack-keystone | 11:29 | |
| *** markvoelker has joined #openstack-keystone | 11:32 | |
| *** fhubik is now known as fhubik_brb | 11:33 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Trying py27/34 with oslo-master https://review.openstack.org/277648 | 11:33 |
| *** fhubik_brb is now known as fhubik | 11:34 | |
| *** markvoelker has quit IRC | 11:37 | |
| *** fhubik is now known as fhubik_brb | 11:41 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 11:41 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 11:44 |
| samueldmq | bknudson_: stevemar: besides project-team-guide patch on docs (264398) | 11:45 |
| samueldmq | bknudson_: stevemar: our corresponding keystone docs patch needs love (246400) | 11:45 |
| *** vgridnev has quit IRC | 11:56 | |
| *** vgridnev has joined #openstack-keystone | 11:56 | |
| *** pnavarro has quit IRC | 12:03 | |
| *** peter-hamilton has joined #openstack-keystone | 12:07 | |
| *** spandhe has quit IRC | 12:08 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain filter to v3 list_projects https://review.openstack.org/158398 | 12:09 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Allow project domain_id to be nullable at the manager level https://review.openstack.org/264533 | 12:09 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add tests in preparation of projects acting as a domain https://review.openstack.org/272369 | 12:09 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Verify project unique constraints for projects acting as domains https://review.openstack.org/158372 | 12:09 |
| *** ig0r_ has joined #openstack-keystone | 12:12 | |
| *** mylu has joined #openstack-keystone | 12:14 | |
| *** gildub has quit IRC | 12:14 | |
| *** mylu has quit IRC | 12:18 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Change get_project permission https://review.openstack.org/270057 | 12:23 |
| *** jbell8 has quit IRC | 12:24 | |
| *** doug-fish has joined #openstack-keystone | 12:29 | |
| samueldmq | dstanek: hi | 12:30 |
| samueldmq | dstanek: I'd like to your view on this (https://review.openstack.org/#/c/244149/24/keystone/resource/core.py) | 12:32 |
| samueldmq | dstanek: I don't like the way it is, but maybe I am just being too hard | 12:33 |
| *** markvoelker has joined #openstack-keystone | 12:33 | |
| *** markvoelker has quit IRC | 12:37 | |
| *** daemontool has quit IRC | 12:39 | |
| *** fhubik_brb is now known as fhubik | 12:39 | |
| *** daemontool has joined #openstack-keystone | 12:39 | |
| *** dims has quit IRC | 12:40 | |
| rodrigods | samueldmq, ^ agree with you about the log | 12:41 |
| rodrigods | htruta, ^ | 12:42 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fix nits from domain specific roles CRUD support https://review.openstack.org/279029 | 12:44 |
| samueldmq | rodrigods: thanks for looking at it | 12:44 |
| samueldmq | stevemar: ayoung: ^ adressed nits left on domain specific roles CRUD ^ | 12:45 |
| *** pnavarro has joined #openstack-keystone | 12:49 | |
| *** daemontool_ has joined #openstack-keystone | 12:49 | |
| *** daemontool__ has joined #openstack-keystone | 12:49 | |
| *** daemontool has quit IRC | 12:51 | |
| htruta | rodrigods, samueldmq, I agree that the HTTP method is enough. But how will it appear on that specific message? | 12:51 |
| rodrigods | htruta, when you try to perform the action, the message is displayed right? so you know the method you've called. if you are debugging for someone else, the endpoint called is displayed in the logs prior to the actual error message | 12:53 |
| *** raildo-afk is now known as raildo | 12:53 | |
| *** daemontool_ has quit IRC | 12:54 | |
| htruta | rodrigods: right. I just intend to have it in the same message as the error. If you, for example, use a tool to parse logs, like a logstash and only filters the ERROR ones, you wouldn't easily know that | 12:54 |
| dstanek | samueldmq: i agree, that seems odd. instead of asserting maybe that needs to return a boolean and leave the messaging to the caller | 12:55 |
| rodrigods | htruta, ^ makes more sense | 12:55 |
| samueldmq | dstanek: ++ that's a good alternative | 12:55 |
| rodrigods | htruta, filtering doesn't apply for this scenario actually... you can't debug the forbidden error without knowing what you are looking for | 12:57 |
| samueldmq | ++ | 12:57 |
| htruta | rodrigods, samueldmq: I disagree with the filtering, but I liked dstanek's suggestion. Guess that'll make everybody happy | 12:58 |
| *** su_zhang has joined #openstack-keystone | 12:59 | |
| *** roxanaghe has joined #openstack-keystone | 13:00 | |
| *** su_zhang has quit IRC | 13:03 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Create V9 version of catalog driver interface https://review.openstack.org/269455 | 13:04 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers and Projects associations https://review.openstack.org/264854 | 13:04 |
| *** roxanaghe has quit IRC | 13:05 | |
| *** pauloewerton has joined #openstack-keystone | 13:08 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers Group CRUD operations. https://review.openstack.org/273438 | 13:09 |
| *** nekrodesk has joined #openstack-keystone | 13:11 | |
| *** nekrodesk has quit IRC | 13:11 | |
| *** jsavak has joined #openstack-keystone | 13:12 | |
| *** mylu has joined #openstack-keystone | 13:14 | |
| *** nekrodesk has joined #openstack-keystone | 13:16 | |
| *** nekrodesk has quit IRC | 13:16 | |
| *** esp has joined #openstack-keystone | 13:17 | |
| *** nekrodesk has joined #openstack-keystone | 13:18 | |
| *** nekrodesk has quit IRC | 13:18 | |
| *** mylu has quit IRC | 13:19 | |
| *** dims has joined #openstack-keystone | 13:20 | |
| *** nekrodesk has joined #openstack-keystone | 13:20 | |
| *** nekrodesk has quit IRC | 13:20 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service providers groups associations https://review.openstack.org/275636 | 13:20 |
| *** nekrodesk has joined #openstack-keystone | 13:22 | |
| *** nekrodesk has quit IRC | 13:22 | |
| *** Guest57497 is now known as zeus | 13:22 | |
| *** zeus has joined #openstack-keystone | 13:22 | |
| *** daemontool__ has quit IRC | 13:23 | |
| *** markvoelker has joined #openstack-keystone | 13:23 | |
| *** esp has quit IRC | 13:23 | |
| *** nekrodesk has joined #openstack-keystone | 13:26 | |
| *** nekrodesk has quit IRC | 13:26 | |
| *** nekrodesk has joined #openstack-keystone | 13:30 | |
| *** nekrodesk has quit IRC | 13:30 | |
| *** nekrodesk has joined #openstack-keystone | 13:33 | |
| *** woodster_ has joined #openstack-keystone | 13:33 | |
| *** daemontool__ has joined #openstack-keystone | 13:35 | |
| *** edmondsw has joined #openstack-keystone | 13:38 | |
| *** daemontool_ has joined #openstack-keystone | 13:42 | |
| *** Nirupama has quit IRC | 13:43 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 13:44 |
| htruta | samueldmq, rodrigods, dstanek take a look now | 13:44 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 13:45 |
| *** daemontool__ has quit IRC | 13:46 | |
| *** links has quit IRC | 13:48 | |
| *** ninag has joined #openstack-keystone | 13:55 | |
| *** daemontool_ is now known as daemontool | 13:56 | |
| *** fhubik is now known as fhubik_brb | 13:57 | |
| *** edmondsw has quit IRC | 13:59 | |
| *** dancn has joined #openstack-keystone | 14:01 | |
| *** roxanaghe has joined #openstack-keystone | 14:01 | |
| *** richm has quit IRC | 14:03 | |
| *** jaosorior has quit IRC | 14:05 | |
| *** jaosorior has joined #openstack-keystone | 14:05 | |
| *** roxanaghe has quit IRC | 14:06 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 14:07 |
| *** dave-mccowan has joined #openstack-keystone | 14:08 | |
| *** dave-mcc_ has joined #openstack-keystone | 14:11 | |
| *** dave-mccowan has quit IRC | 14:14 | |
| *** krotscheck_dcm is now known as krotscheck | 14:15 | |
| tjcocozz | htruta, ping | 14:17 |
| htruta | tjcocozz: hi | 14:17 |
| tjcocozz | htruta, can you explain what L330 does in https://review.openstack.org/#/c/243585/12/keystone/resource/controllers.py | 14:17 |
| tjcocozz | htruta, this method https://github.com/openstack/keystone/blob/2702645af1ad2c390948c947b27824b7a12a34e9/keystone/common/controller.py#L787 | 14:18 |
| *** richm has joined #openstack-keystone | 14:18 | |
| htruta | tjcocozz: it enforces the policy rule, to see if the user has permission to that. Is that correct, raildo ? | 14:18 |
| tjcocozz | htruta, i thought that is what the method _check_projects_list does. | 14:19 |
| tjcocozz | htruta, in resource/controllers.py ^_^ | 14:20 |
| *** spzala has joined #openstack-keystone | 14:21 | |
| raildo | tjcocozz: the _check_projects_list check for the role access on the subtree, in other words, if the user have a assignment in the subtree | 14:22 |
| raildo | tjcocozz: but we have to verify if the specific role can perform the update_project action | 14:22 |
| raildo | tjcocozz: so, we made a check_protection for every project on the subtree | 14:23 |
| tjcocozz | raildo, thank you. you cleared it up. | 14:23 |
| *** su_zhang has joined #openstack-keystone | 14:23 | |
| raildo | tjcocozz: np | 14:23 |
| tjcocozz | raildo, htruta that makes sense. i new i was missing something | 14:23 |
| raildo | tjcocozz: we made on this way, because we can reuse the _check_projects_list on the delete project :) | 14:27 |
| *** links has joined #openstack-keystone | 14:28 | |
| raildo | tjcocozz: and just change the check_protection to verify the delete_project action | 14:28 |
| tjcocozz | raildo, cool! that works for me. Almost done reviewing it now. i just want to pull it down and test some things | 14:29 |
| raildo | tjcocozz: great :) | 14:30 |
| ayoung | samueldmq, +2. make sure you add reviewers to those. I added Henry. | 14:41 |
| ayoung | samueldmq, put this one to bet, please: https://review.openstack.org/#/c/158398/52 | 14:44 |
| *** fhubik_brb is now known as fhubik | 14:47 | |
| *** fhubik is now known as fhubik_brb | 14:57 | |
| *** roxanaghe has joined #openstack-keystone | 15:02 | |
| *** jaosorior has quit IRC | 15:06 | |
| *** nekrodesk has quit IRC | 15:06 | |
| *** roxanaghe has quit IRC | 15:06 | |
| *** fhubik_brb is now known as fhubik | 15:12 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:17 | |
| *** phalmos has joined #openstack-keystone | 15:18 | |
| *** ig0r_ has quit IRC | 15:21 | |
| *** pushkaru has joined #openstack-keystone | 15:21 | |
| *** csoukup_ has joined #openstack-keystone | 15:23 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 15:28 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 15:29 |
| *** henrynash has joined #openstack-keystone | 15:30 | |
| *** ChanServ sets mode: +v henrynash | 15:30 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 15:31 |
| *** petertr7 is now known as petertr7_away | 15:31 | |
| *** daemontool_ has joined #openstack-keystone | 15:32 | |
| *** jsavak has quit IRC | 15:32 | |
| *** daemontool has quit IRC | 15:34 | |
| *** woodster_ has quit IRC | 15:36 | |
| *** dave-mcc_ has quit IRC | 15:37 | |
| *** dave-mccowan has joined #openstack-keystone | 15:37 | |
| samueldmq | ayoung: nice, will look now | 15:38 |
| *** jsavak has joined #openstack-keystone | 15:40 | |
| ayoung | samueldmq, that one is origianlly from last may. It is one line and a bunch of tests. I swear sometimes we are just abusive | 15:40 |
| ayoung | correction. it is from last February. Must have been one in a chain | 15:41 |
| *** fawadkhaliq has quit IRC | 15:42 | |
| *** fawadkhaliq has joined #openstack-keystone | 15:43 | |
| *** edmondsw has joined #openstack-keystone | 15:43 | |
| *** mylu has joined #openstack-keystone | 15:44 | |
| samueldmq | ayoung: yes, sometimes we are too slow | 15:45 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Fix trust chain/redelegation tests https://review.openstack.org/278163 | 15:45 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Consolidate trust tests into a single class https://review.openstack.org/278628 | 15:45 |
| *** knikolla has joined #openstack-keystone | 15:48 | |
| *** pnavarro has quit IRC | 15:48 | |
| *** roxanaghe has joined #openstack-keystone | 15:49 | |
| ayoung | jorge_munoz, those two look good. Why is it that we can now drop the redelegated_trust_id from new_trust_ref? | 15:49 |
| samueldmq | ayoung: what's in the top of that chain ? | 15:50 |
| ayoung | samueldmq, that is a bunch of HMT stuff. I think the end state is domain-is-a-project | 15:50 |
| samueldmq | ayoung: I really hate the way dependencies are show in the new gerrit ui :/ | 15:50 |
| samueldmq | shown* | 15:50 |
| ayoung | samueldmq, yeah. | 15:51 |
| ayoung | samueldmq, there is the "same topic" tab, though | 15:51 |
| ayoung | samueldmq, hackathon at the next summit that pushes through the HMT changes. | 15:52 |
| *** dobson has quit IRC | 15:52 | |
| ayoung | samueldmq, 2 GOALS: | 15:52 |
| ayoung | 1. Domain-is-a-project fully supported | 15:52 |
| ayoung | 2. Strict naming so we can form names for nested proejcts like Dom1/p1/p2/p3 | 15:53 |
| ayoung | Those two things should have been there years ago. | 15:53 |
| *** EmilienM has quit IRC | 15:53 | |
| samueldmq | ayoung: "reseller (phase 1): top level projects as domains" is targeted m-3 | 15:54 |
| ayoung | samueldmq, excellent. But is it going to happen? | 15:54 |
| samueldmq | ayoung: I am looking at domain roles, project tree disabling/deletion, then reseller pahse 1 | 15:54 |
| samueldmq | ayoung: I don't know, I will review | 15:54 |
| ayoung | samueldmq, anything that needs my review throw at me, please | 15:54 |
| *** phalmos has quit IRC | 15:55 | |
| samueldmq | ayoung: ++ | 15:55 |
| ayoung | samueldmq, I want HMT and dynamic policy. Then I can quit the project in peace | 15:55 |
| ayoung | :) | 15:55 |
| *** slberger has joined #openstack-keystone | 15:55 | |
| henrynash | ayoung, samueldmq: are we saying we are not putting in domains as a project in mitaka? | 15:56 |
| ayoung | henrynash, we are | 15:56 |
| ayoung | henrynash, I am being a pessimist | 15:56 |
| ayoung | I want them in yesterday | 15:57 |
| ayoung | henrynash, so what do we need to do to get them in ? | 15:57 |
| henrynash | ayoung, samueldmq: I have worked a lot of on these patches over the last few weeks, and the first lot are good to go, imho | 15:57 |
| henrynash | ayoung, samueldmq: we need a fix to cinders broken nester quotos for before the main one will pass…they aer fixing it | 15:58 |
| ayoung | henrynash, we were just griping over the webUI making it hard to tell where a chain starts. WHich is the first of the first? | 15:58 |
| henrynash | ayoung: it’s appaling | 15:58 |
| henrynash | let me get that for you | 15:58 |
| samueldmq | yeah | 15:58 |
| * ayoung wonders at the entemology of appalling... | 15:58 | |
| *** dan_nguyen has joined #openstack-keystone | 15:58 | |
| samueldmq | htruta: ayoung: henrynash: it's possible to use False instead of 0 here: https://review.openstack.org/#/c/158398/52/keystone/resource/controllers.py | 15:59 |
| ayoung | from Old French apalir ‘grow pale,’ | 15:59 |
| samueldmq | are you okay if I update it ? | 15:59 |
| henrynash | ayoung, samueldmq: https://review.openstack.org/#/c/264533/24 | 15:59 |
| henrynash | that’s the first one | 15:59 |
| ayoung | samueldmq, leave the nits for now | 15:59 |
| *** phalmos has joined #openstack-keystone | 15:59 | |
| ayoung | just revord them and we'll fix as bugs | 15:59 |
| ayoung | henrynash, is 89 good to go for a migration number? | 16:00 |
| henrynash | samueldmq: so the explict check is for a string of ‘0’ in our filter matches | 16:00 |
| samueldmq | ayoung: henrynash: +2+A it's working now | 16:00 |
| samueldmq | as it is | 16:00 |
| ayoung | OK | 16:00 |
| samueldmq | henrynash: only 4 patches ? | 16:01 |
| samueldmq | henrynash: for phase 1 ? | 16:01 |
| samueldmq | henrynash: that's what I can see from 'related changes' in https://review.openstack.org/#/c/264533 | 16:01 |
| ayoung | I love ther Null Object Pattern | 16:01 |
| htruta | samueldmq: there is more... but after the "projects acting as domains" they're pretty simple | 16:01 |
| ayoung | https://en.wikipedia.org/wiki/Null_Object_pattern should be required reading | 16:01 |
| henrynash | samueldmq: so there are 5 includeing the one that swicthes over to domains actually stored as projects | 16:02 |
| htruta | henrynash: there is also the one that drops the domain table | 16:02 |
| samueldmq | htruta: got it, btw do you have an etherpad with the list of patches and their organization, | 16:02 |
| henrynash | samueldmq: there are then some clean up ones that I havement worked (whichi remove old code) | 16:02 |
| samueldmq | ? | 16:02 |
| henrynash | samueldmq: yes, including that | 16:02 |
| htruta | samueldmq: not yet, I can create one | 16:02 |
| samueldmq | htruta: would be helpful, and I guess quick for you to create one:) | 16:02 |
| jorge_munoz | ayoung: Because redelegated_trust_id is read-only attribute, it should not be passed in the ref.' | 16:03 |
| ayoung | jorge_munoz, how is it deduced then? | 16:04 |
| henrynash | samuedlmq: I had held off on those inccase we were only doing “additive changes” to the database in mitaka…now we have dropped that idea (for m) I can lick those into shape too | 16:04 |
| ayoung | jorge_munoz, line number? please | 16:04 |
| *** links has quit IRC | 16:04 | |
| samueldmq | henrynash: NULL_DOMAIN_ID = '<<keystone.domain.root>>' | 16:04 |
| samueldmq | henrynash: same as you did ? for concurrency, etc ? | 16:04 |
| ayoung | henrynash, get the clean up ones posted WIP, please | 16:04 |
| samueldmq | henrynash: I meant, same as you did for domain roles | 16:04 |
| jorge_munoz | ayoung: https://github.com/openstack/keystone/blob/master/keystone/trust/core.py#L147 | 16:04 |
| *** dobson has joined #openstack-keystone | 16:05 | |
| ayoung | jorge_munoz, but in the test that is not available. That is inside the controller | 16:05 |
| ayoung | below the controller I should say | 16:05 |
| henrynash | samuedlmq: yes, with the added idea that we actual use this row as FK enforcement - | 16:05 |
| ayoung | how does the test say "create a new trust extending this old one" now? | 16:05 |
| *** EmilienM has joined #openstack-keystone | 16:06 | |
| ayoung | jorge_munoz, and, I apologize, as I was mot intimately involved in the trust redelegation work. I wish I had been. | 16:06 |
| ayoung | So thanks veryh much for tackling this | 16:06 |
| htruta | ayoung, samueldmq, henrynash: here you go https://etherpad.openstack.org/p/reseller-phase1-patches | 16:07 |
| *** phalmos has quit IRC | 16:07 | |
| henrynash | ayoung thx | 16:07 |
| *** phalmos has joined #openstack-keystone | 16:08 | |
| jorge_munoz | ayoung: np, it should not be needed. When a new trust is created with a delegated auth, the redelegated id is retrieve from the trusted token. | 16:08 |
| ayoung | Ah. | 16:09 |
| ayoung | jorge_munoz, did we make that a hard-and-fast requirment? That you use a token from a trust in order to redelgate the trust only? | 16:09 |
| samueldmq | htruta: thanks | 16:10 |
| jorge_munoz | ayoung: From my understanding, the only way one can redelegate a trust is with a trusted token. | 16:11 |
| ayoung | jorge_munoz, OK. I like | 16:11 |
| ayoung | that makes a lot of sense to me. I can fully endorse this | 16:11 |
| ayoung | and it is a pattern to continue. | 16:11 |
| *** woodster_ has joined #openstack-keystone | 16:11 | |
| *** mylu has quit IRC | 16:12 | |
| *** mylu has joined #openstack-keystone | 16:12 | |
| *** vgridnev has quit IRC | 16:15 | |
| *** mylu_ has joined #openstack-keystone | 16:17 | |
| *** mylu has quit IRC | 16:17 | |
| *** diazjf has joined #openstack-keystone | 16:18 | |
| ayoung | henrynash, samueldmq Ok, that chain looks good up til the last one that is still failing tests etx | 16:18 |
| henrynash | ayoung: I’ll post a new one soon for https://review.openstack.org/#/c/231289, althoug it will stil fial teh cinder tests | 16:19 |
| ayoung | henrynash, sounds good. Where is the "strict naming" feature these days? | 16:20 |
| henrynash | ayoung: all merges | 16:20 |
| henrynash | merged | 16:20 |
| ayoung | awesome | 16:20 |
| ayoung | henrynash, now the real issue: how do we get people to use that as the default | 16:20 |
| *** diazjf1 has joined #openstack-keystone | 16:20 | |
| ayoung | project name is mutable, right? | 16:21 |
| henrynash | ayoung: I say intoduce features they need that depend on it! | 16:21 |
| *** browne has joined #openstack-keystone | 16:21 | |
| henrynash | ayoung: you mean, can you modify teh project name? yes | 16:21 |
| ayoung | henrynash, I'm still stuck on getting is_admin_project supported. New installs are easy, but migrations...oy gewalt! | 16:21 |
| henrynash | ayoung: understand | 16:21 |
| *** vgridnev has joined #openstack-keystone | 16:22 | |
| *** diazjf has quit IRC | 16:22 | |
| *** vgridnev has quit IRC | 16:22 | |
| ayoung | henrynash, so what do you think of this plan.... | 16:22 |
| ayoung | 1. create a middleware piece that enforces policy, limited only to the roles | 16:23 |
| * samueldmq will be back in a bit, lunch time | 16:23 | |
| ayoung | 2. create policy rules that are based on URL, not the hidden API name | 16:23 |
| ayoung | 3. Fetch that RBAC policy from Keystone dynamically | 16:23 |
| ayoung | I think that is the way forward | 16:24 |
| ayoung | leave the scope check where it is now, deep in the code, and guards the object out of the database | 16:24 |
| *** mvk has quit IRC | 16:24 | |
| ayoung | we could even push it deeper in in some cases, right near the drivers. | 16:24 |
| ayoung | we can leave the HTTP check as is. And nothing says you can't do additional role checks there, too | 16:25 |
| ayoung | maybe we indicate via an env var whether the object has passed the role check in the middleware | 16:25 |
| ayoung | and the middleware one has an explicit exception for the admin override? | 16:26 |
| ayoung | Does that meet your concerns? | 16:26 |
| * ayoung should not have numbered. | 16:26 | |
| henrynash | ayoung: sorry, was distracted…reading up | 16:26 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 16:27 |
| henrynash | ayoung: sorry, continued distractions at the moment, need tp unt on this conversation for a bit (since it needs serious thinking….)…. | 16:29 |
| ayoung | henrynash, No problem. I'm going to write that up as a spec and we can discuss there. | 16:29 |
| henrynash | ayoung: that’s a good idea | 16:30 |
| *** browne has quit IRC | 16:33 | |
| *** peter-hamilton has quit IRC | 16:34 | |
| *** mylu has joined #openstack-keystone | 16:36 | |
| *** mylu_ has quit IRC | 16:38 | |
| *** andrewbogott has quit IRC | 16:38 | |
| *** tpeoples has quit IRC | 16:38 | |
| *** comstud has quit IRC | 16:38 | |
| *** richm has quit IRC | 16:39 | |
| *** ayoung has quit IRC | 16:39 | |
| *** errr_ has quit IRC | 16:39 | |
| *** wasmum has joined #openstack-keystone | 16:40 | |
| *** jdennis has quit IRC | 16:41 | |
| *** jdennis has joined #openstack-keystone | 16:42 | |
| *** tpeoples has joined #openstack-keystone | 16:43 | |
| *** andrewbogott has joined #openstack-keystone | 16:44 | |
| *** comstud has joined #openstack-keystone | 16:44 | |
| samueldmq | henrynash: "Support an additional (more standard) inheritance rule" is targeted m-3 | 16:44 |
| samueldmq | henrynash: but it appears as Slow progress; do we still want it in m3? | 16:44 |
| *** browne has joined #openstack-keystone | 16:44 | |
| henrynash | samueldmq: I’m punting on that…and have abandoned it | 16:45 |
| henrynash | sameudlmq: thought I had marked it as so? | 16:45 |
| *** phalmos_ has joined #openstack-keystone | 16:50 | |
| *** roxanaghe has quit IRC | 16:51 | |
| *** r-daneel has joined #openstack-keystone | 16:52 | |
| *** ayoung has joined #openstack-keystone | 16:52 | |
| *** ChanServ sets mode: +v ayoung | 16:52 | |
| samueldmq | henrynash: I will remove the target from it | 16:52 |
| henrynash | samuedlmq: thx | 16:53 |
| samueldmq | henrynash: done, np | 16:53 |
| *** errr_ has joined #openstack-keystone | 16:53 | |
| *** phalmos has quit IRC | 16:54 | |
| *** rcernin has quit IRC | 16:56 | |
| *** nekrodesk has joined #openstack-keystone | 16:57 | |
| *** nekrodesk has quit IRC | 16:57 | |
| *** daemontool_ has quit IRC | 16:57 | |
| openstackgerrit | Merged openstack/keystone: Change get_project permission https://review.openstack.org/270057 | 16:58 |
| openstackgerrit | Merged openstack/keystone: Fix nits from domain specific roles CRUD support https://review.openstack.org/279029 | 17:00 |
| *** nekrodesk has joined #openstack-keystone | 17:00 | |
| *** nekrodesk has quit IRC | 17:00 | |
| *** gyee has joined #openstack-keystone | 17:05 | |
| *** ChanServ sets mode: +v gyee | 17:05 | |
| *** roxanaghe has joined #openstack-keystone | 17:06 | |
| *** pushkaru has quit IRC | 17:06 | |
| *** roxanaghe has quit IRC | 17:07 | |
| *** petertr7_away is now known as petertr7 | 17:07 | |
| *** rudolfvriend has quit IRC | 17:08 | |
| *** e0ne has quit IRC | 17:14 | |
| *** fhubik has quit IRC | 17:15 | |
| *** nekrodesk has joined #openstack-keystone | 17:15 | |
| *** nekrodesk has quit IRC | 17:15 | |
| *** lhcheng has joined #openstack-keystone | 17:16 | |
| *** ChanServ sets mode: +v lhcheng | 17:16 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules in the v3 policy sample for domain specifc roles https://review.openstack.org/262078 | 17:18 |
| *** _cjones_ has joined #openstack-keystone | 17:19 | |
| henrynash | ayoung: see if you prefer this now https://review.openstack.org/#/c/262078/ (separate policy endpoints for global vs domain roles) | 17:19 |
| *** nekrodesk has joined #openstack-keystone | 17:19 | |
| *** nekrodesk has quit IRC | 17:19 | |
| ayoung | henrynash, you write like a bard | 17:20 |
| ayoung | "To ease complexity (and hence risk)" | 17:20 |
| henrynash | ayoung: (or maybe a bird) | 17:20 |
| ayoung | poetry | 17:20 |
| ayoung | henrynash, so...can you do multiple decorators on a function? | 17:21 |
| ayoung | like | 17:21 |
| ayoung | @controller.filterprotected('name', 'domain_id' | 17:21 |
| ayoung | but above that | 17:21 |
| ayoung | @controller.default('domain_id',None) | 17:21 |
| ayoung | or something? | 17:22 |
| henrynash | in theory, yes… | 17:22 |
| ayoung | yeah, you do that in line 374 | 17:22 |
| henrynash | (we do that with protected and vaidation) | 17:22 |
| ayoung | cool. That would be the pattern we would propagate in the future that you specify | 17:23 |
| ayoung | nice | 17:23 |
| henrynash | i kind of left | 17:23 |
| henrynash | it written out long hadn for now | 17:23 |
| henrynash | but yes, we could encapsualte the idea | 17:23 |
| ayoung | henrynash, yep...I like this | 17:23 |
| *** petertr7 is now known as petertr7_away | 17:23 | |
| ayoung | I like this a lot | 17:23 |
| *** pushkaru has joined #openstack-keystone | 17:24 | |
| ayoung | henrynash, you write default logic like I do...coming from other languages. dstanek would probably have written: self.method_name = method_name or '%s' | 17:25 |
| henrynash | ayoung: oops, yeah, I always forget you can do that! | 17:25 |
| dstanek | ayoung: ? | 17:25 |
| ayoung | henrynash, if there is another iteration. | 17:25 |
| henrynash | ayoung: sure | 17:25 |
| ayoung | dstanek, here: https://review.openstack.org/#/c/262078/17/keystone/common/router.py | 17:25 |
| ayoung | dstanek, lines 29ish | 17:26 |
| dstanek | ah, yeah. i probably would have gone with an 'or' unless there are real falsy values to consider | 17:27 |
| ayoung | dstanek, and it is a string. So a falsy value would be bizarre | 17:27 |
| ayoung | henrynash, is method_name the right name there? | 17:28 |
| *** ebalduf has joined #openstack-keystone | 17:28 | |
| dstanek | ayoung: '' | 17:28 |
| henrynash | ayoung: open to offers | 17:28 |
| ayoung | template? | 17:28 |
| ayoung | method_template? | 17:28 |
| henrynash | ayoung: good name | 17:28 |
| ayoung | henrynash, I was just trying to think how to make it self documenting. | 17:29 |
| dstanek | the_var_formerly_known_as_method_name | 17:29 |
| ayoung | OK./..I'll add those comments there. Looking at the rest | 17:29 |
| henrynash | dstanek: exactly | 17:29 |
| ayoung | dstanek, NI! | 17:29 |
| ayoung | Sorry, wrong referece | 17:29 |
| ayoung | that would be | 17:29 |
| ayoung | the_var_that_until_recently_was_called_method_name | 17:30 |
| *** nekrodesk has joined #openstack-keystone | 17:31 | |
| *** fawadkhaliq has quit IRC | 17:33 | |
| *** _cjones_ has quit IRC | 17:34 | |
| *** jsavak has quit IRC | 17:34 | |
| *** _cjones_ has joined #openstack-keystone | 17:36 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify implied roles to honor domain specific roles https://review.openstack.org/263064 | 17:42 |
| *** jsavak has joined #openstack-keystone | 17:42 | |
| gyee | stevemar, should be tag this one for backport? https://bugs.launchpad.net/keystone/+bug/1535878 | 17:45 |
| openstack | Launchpad bug 1535878 in OpenStack Identity (keystone) "A user with a role on a project should be able to issue a GET /project call" [Medium,Fix released] - Assigned to Ajaya Agrawal (ajayaa) | 17:45 |
| *** dmsimard has joined #openstack-keystone | 17:46 | |
| dmsimard | ayoung: o/ | 17:46 |
| ayoung | dmsimard, thanks | 17:46 |
| dmsimard | hopefully I don't have to explain this many more times :( | 17:46 |
| ayoung | dmsimard, we don;'t have morgainfainberg or jamielennox (well he's asleep I assume) now but... | 17:47 |
| ayoung | dmsimard, I will | 17:47 |
| ayoung | cut and paste from our previouis | 17:47 |
| dmsimard | sure | 17:47 |
| ayoung | dolphm, need your advice on a bug from the tripleo team, coming to them from devstack | 17:47 |
| ayoung | or anyone else that understands the keystoneauth migration for that matter | 17:48 |
| *** lhcheng has quit IRC | 17:48 | |
| ayoung | https://bugs.launchpad.net/puppet-nova/+bug/1542486 | 17:48 |
| openstack | Launchpad bug 1542486 in OpenStack Compute (nova) "nova-compute stack traces with BadRequest: Specifying 'tenant_id' other than authenticated tenant in request requires admin privileges" [Undecided,Incomplete] | 17:48 |
| *** lhcheng has joined #openstack-keystone | 17:49 | |
| *** ChanServ sets mode: +v lhcheng | 17:49 | |
| *** lhcheng has quit IRC | 17:49 | |
| *** lhcheng has joined #openstack-keystone | 17:49 | |
| *** ChanServ sets mode: +v lhcheng | 17:49 | |
| ayoung | dmsimard, https://git.openstack.org/cgit/openstack/puppet-nova/commit/?id=d09868a59c451932d67c66101b725182d7066a14 that was the commit right>? | 17:49 |
| ayoung | dmsimard, and the issue is the line "Add /v3 for neutron_auth_url parameter. It's now required in Nova. " | 17:50 |
| *** lhcheng has quit IRC | 17:50 | |
| ayoung | And it should not be required in Nova which is why sdague is being a bit of a stickler here | 17:50 |
| dmsimard | yes, before this, puppet-nova would default to the "password" plugin and unversioned keystone url | 17:50 |
| ayoung | ok...let me find the devstack commit and rationale | 17:50 |
| *** Guest15678 is now known as mariusv | 17:51 | |
| *** mariusv has quit IRC | 17:51 | |
| *** mariusv has joined #openstack-keystone | 17:51 | |
| dmsimard | this broke overnight, we reached out to #openstack-nova for help and they pointed us to the config that worked for devstack and thus aligned our defaults with that | 17:51 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules for domain specific role assignments https://review.openstack.org/263549 | 17:51 |
| ayoung | GAH | 17:52 |
| ayoung | dmsimard, do you have that link? | 17:53 |
| dmsimard | ayoung: for the discussion ? | 17:53 |
| dmsimard | lemme find it | 17:53 |
| ayoung | dmsimard, or just to the config for devstack | 17:53 |
| dmsimard | ayoung: http://eavesdrop.openstack.org/irclogs/%23openstack-nova/%23openstack-nova.2016-02-05.log.html#t2016-02-05T21:06:32 | 17:54 |
| ayoung | dmsimard, we have so many people coding to /v2.0 and we are not able to move beyond that. For example, devstack just reverted the change that defaulted to v3 cuz it broke swift | 17:54 |
| dmsimard | I can try to see where devstack configures that, I'm not super familiar with it | 17:54 |
| ayoung | dims, that was your conversation | 17:54 |
| *** knikolla has quit IRC | 17:54 | |
| * dims peeks | 17:55 | |
| ayoung | dmsimard, so I know I would like it to look like | 17:55 |
| ayoung | auth_plugin = password | 17:55 |
| ayoung | auth_url = http://127.0.0.1:35357/ | 17:55 |
| dmsimard | ayoung: this looks fairly old https://github.com/openstack-dev/devstack/commit/394968fa3d6b0f3b296b49d038aac25b74c2dca7 | 17:55 |
| ayoung | and that should work. The fact that it does not is what I am questioning | 17:55 |
| dmsimard | ayoung: yes, what you just put is what we had before | 17:55 |
| ayoung | dmsimard, I though neutron had been updated, and worked with all that | 17:56 |
| ayoung | jamielennox committed on Aug 27, 2015 | 17:56 |
| ayoung | Um... | 17:56 |
| dmsimard | ayoung: if you scroll a bit up in that eavesdrop, you can see I post logs to the failures and the config puppet was putting | 17:56 |
| ayoung | he wrote the negotiation code | 17:56 |
| dmsimard | logs: http://logs.openstack.org/92/276492/6/check/gate-puppet-openstack-integration-scenario001-tempest-dsvm-centos7/78b9c32/logs/nova/nova-compute.txt.gz | 17:56 |
| ayoung | if he could have used it, he would have. | 17:56 |
| ayoung | Hmmmm | 17:56 |
| *** fawadkhaliq has joined #openstack-keystone | 17:56 | |
| dmsimard | config: http://logs.openstack.org/92/276492/6/check/gate-puppet-openstack-integration-scenario001-tempest-dsvm-centos7/78b9c32/logs/etc/nova/nova.conf.txt.gz | 17:56 |
| *** spandhe has joined #openstack-keystone | 17:57 | |
| ayoung | dmsimard, the thing is, the /v3 should be unnecessary | 17:57 |
| dmsimard | in the config you see auth_plugin=password and unversioned auth_url | 17:57 |
| dmsimard | So there's a bug, because it doesn't work :p | 17:58 |
| ayoung | yeah...I'm stumpted. | 17:58 |
| dmsimard | I can't provide more proof than the two logs link I gave you | 17:58 |
| ayoung | dmsimard, I am willing to punt on this. THe whole "drop /v3 specific urls" was jamielennox 's burning platform. | 17:58 |
| *** Guest19120 has quit IRC | 17:59 | |
| ayoung | It is really hard to figure out what is the state of things without him here. Lets not waste any more cycles on it | 17:59 |
| dmsimard | Do what you gotta do, we have to use this because it works and it allows us to move forward - we can drop /v3 and go back to password when it's sorted out | 17:59 |
| ayoung | just know that it will burn us somewhere down the road | 17:59 |
| *** tsymanczyk has joined #openstack-keystone | 17:59 | |
| *** tsymanczyk is now known as Guest14347 | 17:59 | |
| *** Guest14347 has quit IRC | 18:00 | |
| ayoung | dmsimard, this falls into the bucket of things I would never have done that way in the first place. | 18:00 |
| ayoung | 4 year on this project and it is still all legacy to me | 18:00 |
| ayoung | but thanks for taking an interest | 18:00 |
| dmsimard | is there any other way, though ? | 18:00 |
| ayoung | dmsimard, yes, and I will explain at the summit but only in the presense of alcohol | 18:00 |
| ayoung | not worth it now. | 18:00 |
| dmsimard | Hah, drink one in my honor - I won't be able to go to Austin :) | 18:01 |
| *** lhcheng has joined #openstack-keystone | 18:03 | |
| *** ChanServ sets mode: +v lhcheng | 18:03 | |
| ayoung | Dagnabit | 18:04 |
| ayoung | dmsimard, that is unfortunate | 18:04 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 18:06 |
| *** browne has quit IRC | 18:07 | |
| *** jsavak has quit IRC | 18:07 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 18:07 |
| *** jsavak has joined #openstack-keystone | 18:08 | |
| *** aginwala has joined #openstack-keystone | 18:14 | |
| *** tsymancz1k has joined #openstack-keystone | 18:14 | |
| *** e0ne has joined #openstack-keystone | 18:15 | |
| *** rcernin has joined #openstack-keystone | 18:17 | |
| *** lhcheng has quit IRC | 18:19 | |
| *** roxanaghe has joined #openstack-keystone | 18:31 | |
| ctracey | hey folks...question on keystoneclient if anyone has a few | 18:32 |
| *** gordc has joined #openstack-keystone | 18:32 | |
| *** phalmos_ has quit IRC | 18:33 | |
| ctracey | has any thought been given to allow alternate auth methods via something like stevedore plugins? | 18:33 |
| *** petertr7_away is now known as petertr7 | 18:33 | |
| ctracey | right now password and token can be somewhat limiting | 18:33 |
| *** mhickey has quit IRC | 18:34 | |
| *** su_zhang has quit IRC | 18:36 | |
| *** jlvillal has quit IRC | 18:38 | |
| *** drjones has joined #openstack-keystone | 18:39 | |
| *** _cjones_ has quit IRC | 18:39 | |
| *** jlvillal has joined #openstack-keystone | 18:39 | |
| ctracey | d'oh...maybe I spoke too soon | 18:39 |
| ctracey | i see the entrypoints, but not sure where/if those are being utilized | 18:40 |
| ctracey | i'll dig a bit further | 18:40 |
| *** gordc has quit IRC | 18:41 | |
| *** browne has joined #openstack-keystone | 18:44 | |
| *** knikolla has joined #openstack-keystone | 18:46 | |
| *** tsymancz1k has quit IRC | 18:50 | |
| *** clenimar has left #openstack-keystone | 18:50 | |
| *** gyee has quit IRC | 18:53 | |
| *** daemontool has joined #openstack-keystone | 18:54 | |
| ayoung | ctracey, so...yes | 18:56 |
| ayoung | the project you are looking for is keystoneauth | 18:56 |
| ayoung | keystoneclient should be just for talking to the keystone server for keystone business like adding users | 18:56 |
| ayoung | anything else should be via the openstack common CLI python-openstackclient | 18:57 |
| ayoung | and you can absotutley use auth plugins there. What kind are you looking for? | 18:57 |
| *** tsymanczyk has joined #openstack-keystone | 19:00 | |
| ctracey | heh - derp | 19:00 |
| stevemar | ctracey: o/ | 19:00 |
| *** jsavak has quit IRC | 19:00 | |
| *** tsymanczyk is now known as Guest9475 | 19:00 | |
| ctracey | I am looking at keystoneclient and not openstackclient...muscle memory | 19:00 |
| *** spandhe has quit IRC | 19:02 | |
| *** spandhe has joined #openstack-keystone | 19:02 | |
| *** jsavak has joined #openstack-keystone | 19:03 | |
| *** harlowja has joined #openstack-keystone | 19:04 | |
| ctracey | ok - this is looking much more promising :) | 19:04 |
| *** su_zhang has joined #openstack-keystone | 19:07 | |
| *** jsavak has quit IRC | 19:07 | |
| *** fawadkhaliq has quit IRC | 19:12 | |
| samueldmq | henrynash: stevemar: dstanek: I wonder if we could/should get ride of @controller.protectect in favor of direct calls for enforcement | 19:15 |
| samueldmq | henrynash: that would make your new version of "Modify rules in the v3 policy sample for domain specifc roles" muh simpler/easier to understand | 19:15 |
| samueldmq | protected* | 19:16 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Deprecate admin_token_auth https://review.openstack.org/275443 | 19:16 |
| *** phalmos has joined #openstack-keystone | 19:16 | |
| samueldmq | bknudson_: ayoung: you too ^ :) | 19:16 |
| *** phalmos has quit IRC | 19:17 | |
| bknudson_ | I don't think it's going to make a major difference whether it's a decorator or a call. We can design a decorator that's easy to use or a function that's confusing to call. | 19:17 |
| bknudson_ | functions are typically easier so might as well go that way | 19:18 |
| samueldmq | bknudson_: for domain roles specifically (https://review.openstack.org/#/c/262078/17/keystone/assignment/controllers.py) | 19:18 |
| samueldmq | bknudson_: it would be easier as a function, as domain roles have different policy entried than global roles | 19:19 |
| samueldmq | bknudson_: henrynash had to create different CRUD methods for domain roles just to hold the @protected annotation | 19:19 |
| bknudson_ | no, he didn't. He could have changed the decorator. | 19:19 |
| bknudson_ | e.g., @controller.protected(action='whatever') | 19:20 |
| samueldmq | bknudson_: but what does in action varies according to the parameters | 19:20 |
| samueldmq | goes* | 19:21 |
| samueldmq | i.e need to check on the role entity first to decide what check need to be done | 19:21 |
| bknudson_ | nobody's going to be able to understand it or use it anyways so what's the difference. | 19:21 |
| *** nekrodesk has quit IRC | 19:22 | |
| samueldmq | I think calling as a enforcement as a function would make it much clearer | 19:22 |
| bknudson_ | I agree might as well just make a function that you can call rather than mess up the code with extra functions | 19:22 |
| samueldmq | in this case specficially, as we wouldn't need to create create_domain_role, update_domain_roles, etc methods just for the deorator | 19:23 |
| bknudson_ | propose your alternative as a follow-on. | 19:23 |
| *** jsavak has joined #openstack-keystone | 19:23 | |
| *** jsavak has quit IRC | 19:23 | |
| samueldmq | will do, but my point is to get enough feedbck before going ahead | 19:24 |
| samueldmq | I don't want to put effort if others don't agree with me | 19:24 |
| samueldmq | from the beginning | 19:24 |
| *** jsavak has joined #openstack-keystone | 19:24 | |
| bknudson_ | ok, but you're asking us to put in effort | 19:24 |
| samueldmq | only effort I am asking from you is to discuss with me | 19:25 |
| samueldmq | I may make the change | 19:25 |
| *** boris-42 has joined #openstack-keystone | 19:26 | |
| edmondsw | jamielennox, what's you're take on https://bugs.launchpad.net/keystoneauth/+bug/1542024 | 19:27 |
| openstack | Launchpad bug 1542024 in keystoneauth "keystoneauth1.access.service_catalog.ServiceCatalog is missing factory method" [Undecided,New] | 19:27 |
| ayoung | samueldmq, leave the decorators. We can always do an explicit call if needed. The decorator was refactored from direct calls before | 19:30 |
| ayoung | what henry is hitting here is the need to do two different policy checks on the same API call based on the scope of the request, as this is the first time we have a resource that could be either globally scoped or scoped to a domain | 19:31 |
| *** jbell8 has joined #openstack-keystone | 19:31 | |
| *** jsavak has quit IRC | 19:31 | |
| *** jsavak has joined #openstack-keystone | 19:32 | |
| samueldmq | ayoung: I am thinking about extracting the contents of @protected to a function called enforce | 19:33 |
| samueldmq | ayoung: decorator calls enforce | 19:33 |
| samueldmq | ayoung: this way we can either use the decorator or call the function directly where appropriated | 19:33 |
| samueldmq | ayoung: but maybe that will become more confusing (lack of standard ?) | 19:34 |
| ayoung | samueldmq, I think that is fine. But we have the guts of that method already in common/controllers.py I think | 19:35 |
| dmsimard | oh, hey, ayoung.. stevemar might have an opinion on our issue :) | 19:35 |
| *** jbell8 has quit IRC | 19:35 | |
| ayoung | dmsimard, yep he very well might | 19:36 |
| ayoung | samueldmq, I was origianlly going to pull that method in to common/authorize.py ZI think | 19:36 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/authorization.py | 19:37 |
| *** jbell8 has joined #openstack-keystone | 19:37 | |
| *** phalmos has joined #openstack-keystone | 19:37 | |
| samueldmq | ayoung: could be a good idea; I think that's there just to ease imports ? as controllers already import controller.py to inherit from Controller | 19:37 |
| samueldmq | ayoung: but I agree with your idea | 19:37 |
| ayoung | samueldmq, so, you are pulling some stuff out of long term memory | 19:37 |
| ayoung | here is what I wanted to do | 19:37 |
| dmsimard | stevemar: please excuse my laziness but I've explained this a couple times already. We seem to be hitting issues in nova since the migration to keystoneauth1. We have worked around it for the time being but perhaps there is a real problem we need to address. | 19:38 |
| ayoung | 1. Get a good, cross project model for the data that is in the auth object | 19:38 |
| ayoung | that was this commit: | 19:38 |
| ayoung | https://review.openstack.org/#/c/184651/ | 19:38 |
| dmsimard | stevemar: Any chance you could read the backlog ( http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2016-02-11.log.html#t2016-02-11T17:46:50 ) where I explained this and let us know what you think ? | 19:38 |
| ayoung | samueldmq, I wanted that origianlly to be both inside and outside of Keystone...probably in keystoneauth is the right place | 19:38 |
| ayoung | but jamielennox had a different, dictionary based approach, which is the auth context. | 19:39 |
| ayoung | samueldmq, regardless, I want a policy enforcement call that is the same inside and outside keystone server | 19:40 |
| ayoung | so at a minimum, extracting the decorator off the controller would be a good step | 19:40 |
| samueldmq | ayoung: I see; lots of things work around dictionaries instead of objects | 19:40 |
| ayoung | or the logic inside the decorator | 19:40 |
| ayoung | samueldmq, yeah...it makes me sad | 19:40 |
| samueldmq | ayoung: we don't instantiate a role entity when a request arrives :/ | 19:41 |
| ayoung | samueldmq, to be fair, his goal was to work with the JSON respomnse from keystone without copying | 19:41 |
| ayoung | samueldmq, I am a believer in a strongly typed domain model. Not a Stringly typed. | 19:41 |
| samueldmq | ayoung: I like working with objects | 19:42 |
| samueldmq | ayoung: I was surprised we didn't worked with objects for entities (vs dics) when I started working in keystone | 19:42 |
| *** mylu has quit IRC | 19:42 | |
| samueldmq | ayoung: is it the same on other porjects you"ve seen (in openstack) ? | 19:42 |
| ayoung | samueldmq, blame termie. The original Keystone was in Java. The java guys ported to Python, but it looked like Java. Termie ported to maintainable python, but with a focus on key-value-pair datastores, and everything was a dictionary | 19:43 |
| samueldmq | ayoung: so that way, jsonschema validation would happen, let's say, when __init__ from Role entity is called | 19:43 |
| ayoung | To be fair, he was under time constraints, but I think he wanted it that way | 19:43 |
| *** mylu has joined #openstack-keystone | 19:44 | |
| samueldmq | ayoung: anyways we could do the change if we want to | 19:44 |
| ayoung | samueldmq, I want a strong domain model, and the token construction to be composed of adding those objects to a token-Work-in-progress, and then final step converted to JSON or other marshalling form | 19:44 |
| samueldmq | ayoung: and shouldn't be terrible to do it | 19:44 |
| ayoung | samueldmq, it involves getting consensus from the rest of the Keysteon core devs, which I was not able to do | 19:45 |
| samueldmq | ayoung: yes, token is composed of other entities, and to_dict may be used to convert to json | 19:45 |
| ayoung | jamielennox, in general was opposed | 19:45 |
| ayoung | consensus is hard | 19:45 |
| samueldmq | opposed in server or client or both ? | 19:45 |
| samueldmq | we actually have a models.py, but don't use it as models for instantiating model entities | 19:46 |
| *** nekrodesk has joined #openstack-keystone | 19:46 | |
| *** nekrodesk has quit IRC | 19:46 | |
| ayoung | samueldmq, so, I would be satisfied with getting it right in Keystone, but more important to me is having a common policy enforcement framework both inside and outside keystone | 19:47 |
| ayoung | and if the outside form is dictionary based, the inside one should be as well | 19:47 |
| stevemar | dmsimard: i'll add it to my list | 19:48 |
| dmsimard | is that a bad thing? :p | 19:48 |
| ayoung | samueldmq, Ideally, I would be able to hit keystone with just a username, credential, and a project, and keystone would build up a token model and check policy on that, without having to parse an actual token. But that is sort of where Fernet is headed. | 19:48 |
| stevemar | dmsimard: the list grows indefinitely | 19:49 |
| samueldmq | ayoung: how is policy enforcement framework different than oslo.policy? | 19:49 |
| ayoung | samueldmq, I think it would all be easier if we were working with a strong domain model, but, meh. Working code and 6 month release cycles and consensus | 19:49 |
| ayoung | samueldmq, this is the Keystone auth specific enforcemebnt: knows about roles and the other keystone specific objects | 19:49 |
| ayoung | so it would call oslo policy, | 19:49 |
| ayoung | oslo remains agnostic | 19:49 |
| dmsimard | stevemar: expected so, thanks ;) | 19:50 |
| ayoung | in fact, even the role: check should come out of oslo policy, as that is the only thing that is keystone specific in there | 19:50 |
| ayoung | dmsimard, if you can stay up late enough, the right person to bug is jamielennox . But its the middle of his night in Australia right now | 19:50 |
| *** jbell8 has quit IRC | 19:51 | |
| dmsimard | ayoung: can you follow up with him ? I don't really have the knowledge required to dig into this, it's a bit too low level for me :) | 19:51 |
| ayoung | dmsimard, will do | 19:52 |
| dmsimard | hopefully our conversation earlier gave you more info | 19:52 |
| *** nekrodesk has joined #openstack-keystone | 19:52 | |
| ayoung | dmsimard, I'll see if we can get a better approach. But for now, go with the /v3 URL and we can fix this in postproduction | 19:52 |
| dmsimard | k | 19:52 |
| ayoung | dmsimard, in the meantime, please +2 Apache HTTPD and get it moving: https://review.openstack.org/#/c/213175/ | 19:53 |
| ayoung | dmsimard, It will help avoid use debugging eventlet problems in the future, and provide a fix to the peopel that are seeing them now | 19:54 |
| dmsimard | ayoung: your assumption that I am a core in tripleo is wrong, I am a lowly newbie :P | 19:54 |
| ayoung | Ah | 19:54 |
| * ayoung needs to find others to bug | 19:54 | |
| *** aginwala has quit IRC | 19:56 | |
| *** roxanaghe has quit IRC | 19:57 | |
| *** mylu has quit IRC | 19:59 | |
| *** fawadkhaliq has joined #openstack-keystone | 20:02 | |
| samueldmq | stevemar: I will post an update to 275443 so we can merge it | 20:04 |
| *** aginwala has joined #openstack-keystone | 20:04 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Time-based One-time Password https://review.openstack.org/274901 | 20:06 |
| *** ayoung has quit IRC | 20:06 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Deprecate admin_token_auth https://review.openstack.org/275443 | 20:07 |
| *** vgridnev has joined #openstack-keystone | 20:07 | |
| samueldmq | stevemar: ^ | 20:07 |
| stevemar | thanks samueldmq | 20:08 |
| stevemar | :) | 20:08 |
| *** dmsimard has left #openstack-keystone | 20:08 | |
| samueldmq | stevemar: np :) | 20:08 |
| raildo | tjcocozz: are you around? | 20:08 |
| raildo | tjcocozz: it's about https://review.openstack.org/#/c/243585/12/keystone/resource/controllers.py | 20:09 |
| *** jasonsb has quit IRC | 20:09 | |
| samueldmq | stevemar: +2'ed too, didn't +1 for now in the case bknudson_ wants to vote there too | 20:10 |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Time-based One-time Password https://review.openstack.org/274901 | 20:10 |
| samueldmq | (I saw your comment there and he's been participating of that change a lot) | 20:10 |
| samueldmq | didn't +A * | 20:11 |
| samueldmq | henrynash: do you agree with my comment on 262078 ? | 20:15 |
| knikolla | Hi all! Quick question about keystone to keystone federation. A nonadmin user cant do identity:list_service_providers as per policy, but i'm able to get the service_providers from the service catalog doing ksclient2.service_catalog.catalog[u'service_providers']. Is this supposed to be the case? | 20:18 |
| knikolla | where ksclient2 is the client v3 from keystoneclient | 20:18 |
| *** su_zhang has quit IRC | 20:19 | |
| rodrigods | stevemar, ping... do you have, by any chance, an example of federation done via openstackclient? | 20:20 |
| *** ayoung has joined #openstack-keystone | 20:22 | |
| *** ChanServ sets mode: +v ayoung | 20:22 | |
| stevemar | rodrigods: not readily available :[ | 20:23 |
| rodrigods | :( ok, will make one here than | 20:23 |
| knikolla | rodrigods: i have already setup k2k as per your blog post and it's working. I'm just investigating better ways to code it using the keystoneclient functions. | 20:24 |
| *** rcernin has quit IRC | 20:24 | |
| rodrigods | knikolla, awesome, you may use openstackclient as well | 20:24 |
| rodrigods | it has a lot of federation stuff on it already | 20:24 |
| knikolla | its a cli though, i'm investigating python libraries. i saw that the keystone client has a federation.service_providers.list() function which requires admin privilege as per the identity:list_service_providers policy. However I saw that I can get the service provider list in the service catalog without admin privilege. | 20:26 |
| knikolla | doing v3client.service_catalog.catalog[u'service_providers'] | 20:26 |
| raildo | dolphm: ping, I answered your question here: https://review.openstack.org/#/c/258650/22/keystone/tests/unit/test_v3_assignment.py maybe you have any idea to help me to solve this problem... | 20:27 |
| rodrigods | knikolla, hmm that depends on what is returned in both calls | 20:27 |
| rodrigods | if they return the same information so we may open the service provider listing rule to non-admin users | 20:27 |
| rodrigods | at least, makes sense to me | 20:28 |
| *** ebalduf has quit IRC | 20:28 | |
| knikolla | client.federation.service_providers returns a ServiceProviderManager (or something like that) which has get/list/create methods. | 20:28 |
| dolphm | raildo: it looks like the wrong user is being used to execute the tests | 20:28 |
| knikolla | client.service_vatalog.catalog[u'service_providers'] returns a simple list | 20:28 |
| *** ebalduf has joined #openstack-keystone | 20:29 | |
| rodrigods | knikolla, I mean, what is sensitive there are the service provider attributes (sp_url, sp_auth_url and so on) | 20:29 |
| knikolla | let me check | 20:29 |
| rodrigods | if you can access them in the service_catalog list (which I think you can iirc), I think you can create a bug to change the service provider listing rule | 20:30 |
| *** fawadkhaliq has quit IRC | 20:30 | |
| knikolla | rodrigods, heres a pastebin with the comparison http://pastebin.com/raw/S5q75xhv | 20:33 |
| *** Guest9475 has quit IRC | 20:34 | |
| rodrigods | knikolla, pretty the same, i'd create a bug to change the default behavior in the policy | 20:35 |
| jamielennox | edmondsw: i commented on https://bugs.launchpad.net/keystoneauth/+bug/1542024 - i would be ok with adding a create() to the service catalog, but what you're doing is fine | 20:37 |
| openstack | Launchpad bug 1542024 in keystoneauth "keystoneauth1.access.service_catalog.ServiceCatalog is missing factory method" [Undecided,New] | 20:37 |
| knikolla | rodrigods, thanks. I'll do that. | 20:37 |
| *** ebalduf has quit IRC | 20:39 | |
| *** phalmos has quit IRC | 20:39 | |
| *** aginwala has quit IRC | 20:40 | |
| *** aginwala has joined #openstack-keystone | 20:40 | |
| *** ebalduf has joined #openstack-keystone | 20:40 | |
| jamielennox | knikolla: we're open to anything you come up with for how to make k2k easy on the client side | 20:42 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: [WIP]Make fernet default token provider https://review.openstack.org/258650 | 20:43 |
| knikolla | jamielennox that's great to hear! | 20:43 |
| jamielennox | knikolla: i've investigated it once or twice - this is an example of the script i was writing: http://paste.openstack.org/show/486755/ | 20:44 |
| jamielennox | i *think* at the time the list_service_providers wasn't ready | 20:44 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 20:44 |
| jamielennox | one thing i know we're missing is how to expose all the options via the CLI because you have multiple project_name parameters, but so far no one has a burning need for it | 20:46 |
| knikolla | I'll have a look at the Keystone2Keystone class | 20:48 |
| ayoung | jamielennox, unfortunatley , you and dmsimard seem to be working opposite sides of the clock. He was here asking about the issues with puppet and /v3. Am I correct in maintaining that we should be using Discovery and versionless URL everywhere? | 20:49 |
| knikolla | right now my code is a bit ugly as it messes with api calls and json (like in rodrigods blog post) | 20:49 |
| ayoung | knikolla, are you on a puppet managed system? | 20:49 |
| rodrigods | you're calling my code ugly! hehe | 20:49 |
| *** spzala has quit IRC | 20:49 | |
| *** su_zhang has joined #openstack-keystone | 20:50 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 20:50 |
| knikolla | hahaha nooo. I just think that should be handled in the background by a client library instead of be done by hand. | 20:50 |
| jamielennox | ayoung: i replied to your quick email, the devstack thing i think is just a quirk of the order things were done and by who. I would use discovery and versionless but from a puppet perspective i'd really just like them to take a blob so if we can get client certs working we don't need to retool it all | 20:50 |
| ayoung | knikolla, there was the start of a puppet module to setup K2K. I was actually just looking at that | 20:50 |
| knikolla | ayound: nope, i'm using two devstacks | 20:50 |
| knikolla | ayoung | 20:50 |
| knikolla | and some automation scripts to setup k2k | 20:51 |
| ayoung | knikolla, ah. Devstack. Joy. | 20:51 |
| rodrigods | knikolla, yeah... the K2K class was my code too (did the blog post before it was coded) | 20:51 |
| rodrigods | but as jamielennox said, we are missing it in the CLI | 20:51 |
| ayoung | jamielennox, yeah, I just read that. | 20:51 |
| jamielennox | ayoung: it's one of those things that doesn't really matter, but we forget that puppet and OSA copy defaults from devstack | 20:52 |
| jamielennox | so we should do the right thing there | 20:52 |
| *** daemontool_ has joined #openstack-keystone | 20:52 | |
| knikolla | I'll certainly have a look at it. We're hacking nova to attach a cinder volume from another devstack. It works, bu the code could use some polish though. | 20:52 |
| ayoung | jamielennox, Tripleo just merged HTTPD Keystone | 20:53 |
| jamielennox | ayoung: nice! | 20:53 |
| ayoung | I think that is the last vestige of Eventlet Keystone in our main projects | 20:53 |
| jamielennox | ayoung: i've started messing with ursula and they don't do it :( | 20:53 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 20:53 |
| *** e0ne has quit IRC | 20:53 | |
| ayoung | jamielennox, there are enough Big Blue Keystoners that you should be able to change that | 20:54 |
| ayoung | topol, make Jamie's life easy and get the Ursula folks to wise up and run Keystone HTTPD! | 20:54 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 20:55 |
| jamielennox | ayoung: yes, well, this is bluebox | 20:55 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Extract enforcement logic to its own method https://review.openstack.org/279263 | 20:55 |
| jamielennox | and this is the argument jesse was making at the summit about running keystone and horizon in seperate virtualenvs on the same box | 20:55 |
| jamielennox | so, hopefully soon | 20:55 |
| *** daemontool has quit IRC | 20:55 | |
| samueldmq | ayoung: bknudson_ ^ just submited the change, the new method could be used in henrynash's patch | 20:56 |
| *** su_zhang has quit IRC | 20:56 | |
| samueldmq | ayoung: and actually that new enforce method is what could be extracted to the new file (authorize.py or whatever) | 20:56 |
| ayoung | samueldmq, looking | 20:56 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 20:58 |
| ayoung | samueldmq, ah...so you ahve a "self" parameter there | 20:59 |
| ayoung | that was the sticking point before. I would like it to be non-controller specific | 20:59 |
| samueldmq | ayoung: needed for the callback function | 20:59 |
| ayoung | but I don't know if we can do that for the ones that need to fetch from the DB first | 21:00 |
| *** lhcheng has joined #openstack-keystone | 21:00 | |
| *** ChanServ sets mode: +v lhcheng | 21:00 | |
| ayoung | samueldmq, that was why I never tangled with this. | 21:00 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 21:01 |
| ayoung | samueldmq, but, maybe this is OK. If it is a function that we can add to a controller, but is not specific to our tree, we can get the general purpose method I was hoping for | 21:01 |
| samueldmq | ayoung: so you okay with sticking with the self for now ? | 21:01 |
| samueldmq | ayoung: and put that in a separate file | 21:01 |
| *** richm has joined #openstack-keystone | 21:01 | |
| ayoung | yeah, put it in authorize.py | 21:02 |
| ayoung | if that works, it is a step in the right direction | 21:02 |
| *** aginwala has quit IRC | 21:02 | |
| topol | ayoung, jamielennox I believe we are working on that. jamielennox connect will paul czarkowski | 21:02 |
| ayoung | topol, we just got it to merge for Tripleo, which is why I bring it up | 21:03 |
| samueldmq | ayoung: we already have a authorization.py there | 21:03 |
| *** aginwala has joined #openstack-keystone | 21:03 | |
| ayoung | topol, really want Eventlet Keystone to be a painful memory only | 21:03 |
| ayoung | samueldmq, right, so you can move this function into that file | 21:03 |
| *** jsavak has quit IRC | 21:03 | |
| ayoung | that file is supposed to be the non-controller specific authorization/policy check logic | 21:04 |
| *** tsymanczyk has joined #openstack-keystone | 21:04 | |
| topol | ayoung, but its the only deployment I understand. Thats whats keeping it alive.. | 21:04 |
| jamielennox | ayoung, topol: i agree thought there is a probem with mod_wsgi and multiple venvs and i don't know a way to solve it | 21:04 |
| topol | ayoung, just kidding. we are working on that | 21:04 |
| jamielennox | other than docker, docker, docker | 21:04 |
| *** tsymanczyk is now known as Guest47583 | 21:04 | |
| *** jsavak has joined #openstack-keystone | 21:04 | |
| ayoung | jamielennox, funny you should say that: | 21:04 |
| jamielennox | it's just moving your problem | 21:04 |
| ayoung | http://adam.younglogic.com/2016/02/holla-kolla/ jamielennox | 21:04 |
| topol | jamielennox we should have a 1-1 sometime and compare notes on this | 21:05 |
| *** jsavak has quit IRC | 21:06 | |
| ayoung | topol, so, venv is a poor man's container system. Dawkah is the futchah! | 21:06 |
| topol | ayoung, gotta run. one of your fellow bostonians is in town and Im taking him to dinner | 21:06 |
| *** jsavak has joined #openstack-keystone | 21:06 | |
| topol | ayoung, agreed | 21:06 |
| jamielennox | topol: sure, i haven't gotten far other than it's something we'll need to fix and why it hasn't happened already | 21:07 |
| *** mhickey has joined #openstack-keystone | 21:07 | |
| topol | jamielennox catch me up some time on the issues. Also we should discuss docker/venv | 21:07 |
| jamielennox | ayoung: so i have an annoyance with kolla that is probably unjustified seeing as how i looked at it for about 10 minutes | 21:07 |
| topol | gotta run | 21:08 |
| ayoung | jamielennox, Heh, I spent the day in the chat room with those guys. I assure you there are issues | 21:08 |
| jamielennox | ayoung: i love the idea, the jinja2 formatting of the docker templates for multiple backends is super impressive | 21:08 |
| jamielennox | though i'm sure it's going to have problems | 21:08 |
| jamielennox | ayoung: but why did they build the kolla ansible stuff into the same project? | 21:09 |
| *** raildo is now known as raildo-afk | 21:09 | |
| ayoung | jamielennox, you mean both docker and ansible in the same one? | 21:09 |
| jamielennox | right, i want the docker scripts | 21:09 |
| *** su_zhang has joined #openstack-keystone | 21:09 | |
| jamielennox | there is almost no chance i can use the ansible stuff | 21:09 |
| jamielennox | i think they would have a way better time at adoption if they split those interests | 21:10 |
| ayoung | Do you have to use the ansible stuff? | 21:10 |
| jamielennox | this is why i said its probably unjustified given my 10 minute view | 21:10 |
| jamielennox | but from the howto/readme etc it's all about the ansible | 21:10 |
| ayoung | jamielennox, I think that Kolla and Docker in multiple containers needs orchestration no matter what. From what I understand of Docker orchestation, most of it assumes a single host. Ansible allows you to, potentially split it across multiple, so they weould b kindof limited if they did not | 21:11 |
| jamielennox | any scenario i can see using this from involves building containers from CI and plugging it into something else | 21:11 |
| *** aginwala has quit IRC | 21:11 | |
| ayoung | jamielennox, right now I am just thinking Devstack replacement, and then Tripleo. | 21:12 |
| jamielennox | anyway, i'm sure you could use the dockerfiles without the ansible stuff, but if they are looking for tips i think they should seperate those two concerns | 21:12 |
| ayoung | jamielennox, might be able to split into two repos, al-la Keystone and client did | 21:12 |
| ayoung | we can talk with them about it in Austin | 21:13 |
| jamielennox | for the same reason i think OSA should split the roles out from the deployment system - something they are doing now | 21:13 |
| ayoung | jamielennox, need to get these two teams in the same room and hash out the lines of responsibility, | 21:14 |
| jamielennox | ayoung: those two aren't going to overlap in any meaningful way i think | 21:14 |
| jamielennox | ayoung: unfortunately i heard a limitation of kolla is that it can't use kubernetes for some reason, that's a huge shame | 21:15 |
| ayoung | jamielennox, I'd take your word on it. I have not been involved with OSA at all, and Kolla only nominally. But I would think an ansible install effort should be container based | 21:15 |
| ayoung | I need to have a lot more laid about before I could really get my head around what it should look like. | 21:16 |
| *** aginwala has joined #openstack-keystone | 21:16 | |
| *** dan_nguyen has quit IRC | 21:18 | |
| *** spzala has joined #openstack-keystone | 21:19 | |
| *** spzala has quit IRC | 21:19 | |
| *** nekrodesk has quit IRC | 21:19 | |
| jamielennox | ayoung: so OSA is doing lxc containers via ansible, i think a CI driven deployment (the ideal) might need to be container based | 21:20 |
| *** pauloewerton has quit IRC | 21:24 | |
| *** pushkaru has quit IRC | 21:27 | |
| *** pushkaru has joined #openstack-keystone | 21:28 | |
| *** jorge_munoz has quit IRC | 21:29 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 21:37 |
| *** jbell8 has joined #openstack-keystone | 21:38 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 21:39 |
| *** mylu has joined #openstack-keystone | 21:39 | |
| *** jsavak has quit IRC | 21:41 | |
| *** mylu has quit IRC | 21:42 | |
| *** richm has quit IRC | 21:42 | |
| *** dan_nguyen has joined #openstack-keystone | 21:43 | |
| *** jbell8 has quit IRC | 21:44 | |
| *** jbell8 has joined #openstack-keystone | 21:45 | |
| *** jsavak has joined #openstack-keystone | 21:48 | |
| *** jsavak has quit IRC | 21:48 | |
| *** jsavak has joined #openstack-keystone | 21:49 | |
| *** jbell8 has quit IRC | 21:49 | |
| *** ninag has quit IRC | 21:51 | |
| *** ayoung has quit IRC | 21:52 | |
| *** aginwala has quit IRC | 21:54 | |
| *** daemontool_ has quit IRC | 21:56 | |
| *** aginwala has joined #openstack-keystone | 21:57 | |
| *** pgbridge has quit IRC | 21:58 | |
| *** nekrodesk has joined #openstack-keystone | 22:00 | |
| *** nekrodesk has quit IRC | 22:00 | |
| *** ayoung has joined #openstack-keystone | 22:00 | |
| *** ChanServ sets mode: +v ayoung | 22:00 | |
| *** chlong has quit IRC | 22:03 | |
| *** ebalduf has quit IRC | 22:03 | |
| *** pgbridge has joined #openstack-keystone | 22:04 | |
| *** nekrodesk has joined #openstack-keystone | 22:08 | |
| *** aginwala_ has joined #openstack-keystone | 22:10 | |
| *** aginwala has quit IRC | 22:10 | |
| *** clenimar has joined #openstack-keystone | 22:11 | |
| *** petertr7 is now known as petertr7_away | 22:18 | |
| *** knikolla has quit IRC | 22:19 | |
| *** vgridnev has quit IRC | 22:19 | |
| *** dims has quit IRC | 22:23 | |
| *** dims has joined #openstack-keystone | 22:26 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: AuthContextMiddleware admin token handling https://review.openstack.org/198931 | 22:30 |
| *** daemontool has joined #openstack-keystone | 22:34 | |
| *** sshen has joined #openstack-keystone | 22:35 | |
| *** ayoung has quit IRC | 22:37 | |
| *** ebalduf has joined #openstack-keystone | 22:43 | |
| *** mylu has joined #openstack-keystone | 22:45 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Switch to configless bandit https://review.openstack.org/278136 | 22:46 |
| *** henrynash has quit IRC | 22:48 | |
| *** clenimar has quit IRC | 22:50 | |
| *** ebalduf has quit IRC | 22:50 | |
| *** ninag has joined #openstack-keystone | 22:51 | |
| dolphm | lbragstad dstanek and myself just finished open sourcing our custom plugins for deploying keystone into our public cloud :D win https://github.com/rackerlabs/capstone | 22:51 |
| dolphm | stevemar: ^ | 22:52 |
| *** jsavak has quit IRC | 22:52 | |
| *** aginwala_ has quit IRC | 22:56 | |
| *** ninag has quit IRC | 22:56 | |
| *** aginwala has joined #openstack-keystone | 22:56 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:58 | |
| openstackgerrit | Merged openstack/keystone: Stop using nose as a Python3 test runner https://review.openstack.org/278054 | 23:03 |
| *** gildub has joined #openstack-keystone | 23:03 | |
| bknudson_ | dolphm: whoever drew those diagrams is sloppy. | 23:04 |
| bknudson_ | dolphm: you're going to convert the catalog from v2 to v3? | 23:06 |
| bknudson_ | https://github.com/rackerlabs/capstone/blob/master/capstone/token_provider.py#L84 | 23:07 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 23:11 |
| *** ninag has joined #openstack-keystone | 23:16 | |
| *** ninag has quit IRC | 23:16 | |
| *** slberger has left #openstack-keystone | 23:18 | |
| stevemar | dolphm: i was thinking there'd be much more :P | 23:20 |
| *** mhickey has quit IRC | 23:24 | |
| ekarlso | dolphm: u proxy to v2 ? | 23:25 |
| *** ayoung has joined #openstack-keystone | 23:25 | |
| *** ChanServ sets mode: +v ayoung | 23:25 | |
| dstanek | ekarlso: we will :-) | 23:26 |
| dstanek | stevemar: eventually there will be | 23:27 |
| *** pushkaru has quit IRC | 23:27 | |
| *** dan_nguyen has quit IRC | 23:28 | |
| *** chlong has joined #openstack-keystone | 23:30 | |
| dstanek | lbragstad: iterating fast | 23:31 |
| dstanek | lbragstad: got time to test? | 23:31 |
| ekarlso | dstanek: evil evil evil :p | 23:34 |
| ekarlso | dstanek: why not use v3 ? :p | 23:34 |
| dstanek | ekarlso: evil or clever? | 23:35 |
| ekarlso | dstanek: hehe, I dunno I just consume keystone :p | 23:35 |
| dstanek | ekarlso: needs to use the data stored in the other system for now | 23:35 |
| *** csoukup_ has quit IRC | 23:42 | |
| *** nekrodesk has quit IRC | 23:47 | |
| *** ayoung has quit IRC | 23:50 | |
| *** mylu has quit IRC | 23:52 | |
| *** mylu has joined #openstack-keystone | 23:53 | |
| *** csoukup_ has joined #openstack-keystone | 23:53 | |
| *** shoutm has joined #openstack-keystone | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!