| *** lhcheng has quit IRC | 00:06 | |
| *** doug-fish has joined #openstack-keystone | 00:08 | |
| *** fawadkhaliq has quit IRC | 00:09 | |
| *** rbridgeman_ has quit IRC | 00:12 | |
| *** doug-fish has quit IRC | 00:13 | |
| *** doug-fish has joined #openstack-keystone | 00:13 | |
| *** raddaoui has quit IRC | 00:17 | |
| *** furface has quit IRC | 00:17 | |
| *** doug-fish has quit IRC | 00:18 | |
| *** gyee has quit IRC | 00:20 | |
| lbragstad | mfisch fernet tokens only use revocation events, i don't think they are used with revocation lists | 00:36 |
|---|---|---|
| *** amit213 has quit IRC | 00:42 | |
| lbragstad | mfisch I don't think that piece was done yet | 00:43 |
| *** gb21 has quit IRC | 00:55 | |
| *** roxanaghe has joined #openstack-keystone | 00:58 | |
| *** amrith is now known as _amrith_ | 01:01 | |
| *** _amrith_ is now known as amrith | 01:02 | |
| *** roxanaghe has quit IRC | 01:03 | |
| *** gb21 has joined #openstack-keystone | 01:07 | |
| *** dan_nguyen has quit IRC | 01:10 | |
| *** csoukup has joined #openstack-keystone | 01:11 | |
| *** ozialien10 has quit IRC | 01:12 | |
| *** furface has joined #openstack-keystone | 01:13 | |
| *** amit213 has joined #openstack-keystone | 01:14 | |
| *** amit213 has quit IRC | 01:16 | |
| *** csoukup has quit IRC | 01:16 | |
| *** furface has quit IRC | 01:21 | |
| *** sdake has joined #openstack-keystone | 01:22 | |
| *** EinstCrazy has joined #openstack-keystone | 01:27 | |
| *** gb21 has quit IRC | 01:28 | |
| *** dims has quit IRC | 01:30 | |
| *** ksavich has joined #openstack-keystone | 01:31 | |
| *** dims has joined #openstack-keystone | 01:35 | |
| *** gb21 has joined #openstack-keystone | 01:43 | |
| *** julim has joined #openstack-keystone | 01:45 | |
| openstackgerrit | ayoung proposed openstack/keystone: Replace revoke tree with linear search https://review.openstack.org/311652 | 01:46 |
| *** stingaci has quit IRC | 01:52 | |
| *** doug-fish has joined #openstack-keystone | 01:53 | |
| *** doug-fish has quit IRC | 01:58 | |
| *** stingaci has joined #openstack-keystone | 02:04 | |
| *** dan_nguyen has joined #openstack-keystone | 02:04 | |
| *** sdake_ has joined #openstack-keystone | 02:08 | |
| *** dan_nguyen has quit IRC | 02:09 | |
| *** sdake has quit IRC | 02:11 | |
| *** TxGVNN has joined #openstack-keystone | 02:12 | |
| *** doug-fish has joined #openstack-keystone | 02:12 | |
| openstackgerrit | Matt Fischer proposed openstack/keystonemiddleware: Update config options https://review.openstack.org/312809 | 02:12 |
| *** doug-fish has quit IRC | 02:17 | |
| openstackgerrit | ZhiQiang Fan proposed openstack/keystone: do not search file on real environment https://review.openstack.org/309882 | 02:18 |
| *** woodster_ has quit IRC | 02:18 | |
| openstackgerrit | Matt Fischer proposed openstack/keystonemiddleware: Update config options https://review.openstack.org/312809 | 02:18 |
| *** tqtran has quit IRC | 02:19 | |
| openstackgerrit | ZhiQiang Fan proposed openstack/keystone: do not search file on real environment https://review.openstack.org/309882 | 02:21 |
| *** stingaci has quit IRC | 02:22 | |
| *** sdake_ has quit IRC | 02:27 | |
| *** jaosorior has joined #openstack-keystone | 02:28 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:32 | |
| *** pushkaru has quit IRC | 02:36 | |
| *** pushkaru has joined #openstack-keystone | 02:37 | |
| *** spzala has quit IRC | 02:37 | |
| *** spzala has joined #openstack-keystone | 02:38 | |
| *** pushkaru has quit IRC | 02:39 | |
| *** pumarani__ has joined #openstack-keystone | 02:39 | |
| *** spzala has quit IRC | 02:42 | |
| *** pumarani__ has quit IRC | 02:44 | |
| *** pushkaru has joined #openstack-keystone | 02:46 | |
| *** TxGVNN1 has joined #openstack-keystone | 02:46 | |
| *** TxGVNN has quit IRC | 02:46 | |
| *** TxGVNN1 is now known as TxGVNN | 02:46 | |
| *** amrith is now known as _amrith_ | 02:47 | |
| *** roxanaghe has joined #openstack-keystone | 02:47 | |
| *** jaosorior has quit IRC | 02:48 | |
| *** gb21 has quit IRC | 02:52 | |
| *** roxanaghe has quit IRC | 02:52 | |
| *** pushkaru has quit IRC | 02:53 | |
| *** spzala has joined #openstack-keystone | 03:03 | |
| *** lhcheng has joined #openstack-keystone | 03:04 | |
| *** ChanServ sets mode: +v lhcheng | 03:04 | |
| *** gb21 has joined #openstack-keystone | 03:04 | |
| *** fangxu has quit IRC | 03:05 | |
| *** spzala has quit IRC | 03:08 | |
| *** fawadkhaliq has quit IRC | 03:41 | |
| *** lamt has quit IRC | 03:45 | |
| *** pleia2 has quit IRC | 03:51 | |
| *** daemontool has quit IRC | 03:57 | |
| *** daemontool has joined #openstack-keystone | 03:58 | |
| *** stingaci has joined #openstack-keystone | 04:03 | |
| *** spzala has joined #openstack-keystone | 04:04 | |
| *** stingaci has quit IRC | 04:07 | |
| *** spzala has quit IRC | 04:09 | |
| *** furface has joined #openstack-keystone | 04:16 | |
| *** sdake has joined #openstack-keystone | 04:18 | |
| *** arunkant has quit IRC | 04:21 | |
| *** arunkant has joined #openstack-keystone | 04:21 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone-specs: Credential Encryption https://review.openstack.org/284950 | 04:27 |
| *** TxGVNN has quit IRC | 04:32 | |
| *** dikonoor has joined #openstack-keystone | 04:34 | |
| *** dikonoor has quit IRC | 04:39 | |
| *** dikonoor has joined #openstack-keystone | 04:40 | |
| *** dikonoo has joined #openstack-keystone | 04:41 | |
| *** dikonoo has quit IRC | 04:41 | |
| *** dave-mccowan has quit IRC | 04:45 | |
| dikonoor | stevemar:hi Steve | 04:47 |
| *** sdake has quit IRC | 04:47 | |
| *** sdake has joined #openstack-keystone | 04:48 | |
| dikonoor | stevemar:I am trying to get some UT added for https://review.openstack.org/#/c/312126/ . This is LP bug https://bugs.launchpad.net/keystone/+bug/1577804 | 04:48 |
| openstack | Launchpad bug 1577804 in OpenStack Identity (keystone) "/v3/users?name=<name> bypasses user_filter for LDAP" [Undecided,In progress] - Assigned to Matthew Edmonds (edmondsw) | 04:48 |
| patchbot | dikonoor: patch 312126 - keystone - Honor ldap_filter on filtered user list | 04:48 |
| dikonoor | stevemar: I can't get to figure out where the unit testcases should go into. I mean I can't locate any existing ones around user filters around LDAP.My guess is that the changes must go into test_base.py under tests/unit/identity/backends. Could you give me some clue? | 04:49 |
| *** gb21 has quit IRC | 05:01 | |
| *** spzala has joined #openstack-keystone | 05:03 | |
| *** stingaci has joined #openstack-keystone | 05:05 | |
| *** spzala has quit IRC | 05:08 | |
| *** roxanaghe has joined #openstack-keystone | 05:08 | |
| *** stingaci has quit IRC | 05:09 | |
| *** roxanaghe has quit IRC | 05:12 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:18 | |
| *** yolanda has joined #openstack-keystone | 05:26 | |
| *** lhcheng has quit IRC | 05:28 | |
| stevemar | dikonoor: hey divya! there are a few spots where ldap is tested | 05:45 |
| stevemar | https://github.com/openstack/keystone/blob/master/keystone/tests/unit/identity/backends/test_ldap.py invokes code here: https://github.com/openstack/keystone/blob/master/keystone/tests/unit/identity/backends/test_base.py | 05:45 |
| stevemar | which does basic backend testing for identity | 05:45 |
| stevemar | this suite does more specific ldap tests: https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_backend_ldap.py | 05:46 |
| stevemar | and this one here tests things from more of a utility perspective: https://github.com/openstack/keystone/blob/master/keystone/tests/unit/common/test_ldap.py | 05:46 |
| stevemar | dikonoor: if you're looking for filter related stuff, https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_backend_ldap.py#L225 is a good start | 05:47 |
| *** bigdogstl has joined #openstack-keystone | 05:51 | |
| *** bigdogstl has quit IRC | 05:56 | |
| *** furface has quit IRC | 05:58 | |
| *** openstackgerrit has quit IRC | 06:03 | |
| *** openstackgerrit has joined #openstack-keystone | 06:03 | |
| *** spzala has joined #openstack-keystone | 06:03 | |
| *** stingaci has joined #openstack-keystone | 06:06 | |
| *** vgridnev has joined #openstack-keystone | 06:07 | |
| *** spzala has quit IRC | 06:09 | |
| *** stingaci has quit IRC | 06:11 | |
| *** sdake has quit IRC | 06:32 | |
| openstackgerrit | Merged openstack/keystone: Add conflict validation for idp update https://review.openstack.org/294201 | 06:35 |
| *** tesseract has joined #openstack-keystone | 06:44 | |
| *** tesseract is now known as Guest21288 | 06:45 | |
| *** EinstCrazy has quit IRC | 06:46 | |
| *** EinstCrazy has joined #openstack-keystone | 06:46 | |
| *** pnavarro has quit IRC | 06:46 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/311548 | 06:55 |
| *** spzala has joined #openstack-keystone | 07:05 | |
| *** stingaci has joined #openstack-keystone | 07:07 | |
| *** roxanaghe has joined #openstack-keystone | 07:09 | |
| *** spzala has quit IRC | 07:10 | |
| *** stingaci has quit IRC | 07:12 | |
| *** roxanaghe has quit IRC | 07:14 | |
| *** yolanda has quit IRC | 07:36 | |
| *** yolanda has joined #openstack-keystone | 07:44 | |
| *** mvk_ has quit IRC | 07:44 | |
| *** dmk0202 has joined #openstack-keystone | 07:57 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** dmk0202 has quit IRC | 08:03 | |
| *** pnavarro has joined #openstack-keystone | 08:03 | |
| *** zzzeek has joined #openstack-keystone | 08:04 | |
| *** spzala has joined #openstack-keystone | 08:06 | |
| *** fawadkhaliq has quit IRC | 08:06 | |
| *** yolanda has quit IRC | 08:08 | |
| *** stingaci has joined #openstack-keystone | 08:09 | |
| *** spzala has quit IRC | 08:11 | |
| *** dmk0202 has joined #openstack-keystone | 08:11 | |
| *** yolanda has joined #openstack-keystone | 08:13 | |
| *** stingaci has quit IRC | 08:13 | |
| *** jistr has joined #openstack-keystone | 08:34 | |
| *** mvk_ has joined #openstack-keystone | 08:39 | |
| *** jorge_munoz has joined #openstack-keystone | 08:49 | |
| *** spzala has joined #openstack-keystone | 09:07 | |
| *** stingaci has joined #openstack-keystone | 09:10 | |
| *** spzala has quit IRC | 09:12 | |
| *** stingaci has quit IRC | 09:14 | |
| *** vgridnev has quit IRC | 09:18 | |
| *** sdake has joined #openstack-keystone | 09:24 | |
| *** pnavarro has quit IRC | 09:50 | |
| *** pnavarro has joined #openstack-keystone | 10:02 | |
| openstackgerrit | Gyorgy Szombathelyi proposed openstack/keystone: Allow 'domain' property for local.group https://review.openstack.org/310147 | 10:03 |
| openstackgerrit | Gyorgy Szombathelyi proposed openstack/keystone: Add mapping validation tests https://review.openstack.org/312881 | 10:03 |
| *** spzala has joined #openstack-keystone | 10:08 | |
| *** yolanda has quit IRC | 10:09 | |
| *** vgridnev has joined #openstack-keystone | 10:09 | |
| *** stingaci has joined #openstack-keystone | 10:11 | |
| *** spzala has quit IRC | 10:13 | |
| *** yolanda has joined #openstack-keystone | 10:13 | |
| *** stingaci has quit IRC | 10:15 | |
| *** _amrith_ is now known as amrith | 10:21 | |
| *** sdake has quit IRC | 10:29 | |
| *** EinstCrazy has quit IRC | 10:41 | |
| *** roxanaghe has joined #openstack-keystone | 10:46 | |
| *** roxanaghe has quit IRC | 10:50 | |
| samueldmq | morning keystone | 10:57 |
| *** links has joined #openstack-keystone | 11:05 | |
| *** spzala has joined #openstack-keystone | 11:09 | |
| *** amrith is now known as _amrith_ | 11:12 | |
| *** stingaci has joined #openstack-keystone | 11:12 | |
| *** mou has joined #openstack-keystone | 11:13 | |
| *** spzala has quit IRC | 11:14 | |
| *** stingaci has quit IRC | 11:17 | |
| *** yolanda has quit IRC | 11:32 | |
| *** yolanda has joined #openstack-keystone | 11:38 | |
| *** mou has quit IRC | 11:46 | |
| *** mou has joined #openstack-keystone | 11:47 | |
| *** links has quit IRC | 11:53 | |
| *** dave-mccowan has joined #openstack-keystone | 11:53 | |
| *** gordc has joined #openstack-keystone | 11:56 | |
| *** dave-mcc_ has joined #openstack-keystone | 11:56 | |
| *** tellesnobrega_af is now known as tellesnobrega | 11:57 | |
| *** dave-mccowan has quit IRC | 11:58 | |
| *** ekarlso has quit IRC | 12:06 | |
| *** ekarlso has joined #openstack-keystone | 12:06 | |
| *** spzala has joined #openstack-keystone | 12:10 | |
| *** ChanServ sets mode: +v samueldmq | 12:13 | |
| *** spzala has quit IRC | 12:15 | |
| dstanek | morning | 12:16 |
| *** rodrigods has quit IRC | 12:17 | |
| *** rodrigods has joined #openstack-keystone | 12:18 | |
| *** alee has quit IRC | 12:24 | |
| *** roxanaghe has joined #openstack-keystone | 12:34 | |
| *** ninag has joined #openstack-keystone | 12:37 | |
| *** roxanaghe has quit IRC | 12:38 | |
| *** yolanda has quit IRC | 12:38 | |
| *** richm has joined #openstack-keystone | 12:41 | |
| *** yolanda has joined #openstack-keystone | 12:44 | |
| *** spzala has joined #openstack-keystone | 12:48 | |
| *** bapalm has joined #openstack-keystone | 12:54 | |
| *** pauloewerton has joined #openstack-keystone | 12:59 | |
| *** yolanda has quit IRC | 13:00 | |
| *** tonytan4ever has joined #openstack-keystone | 13:01 | |
| *** _amrith_ is now known as amrith | 13:03 | |
| *** yolanda has joined #openstack-keystone | 13:05 | |
| *** tonytan4ever has quit IRC | 13:08 | |
| *** stingaci has joined #openstack-keystone | 13:14 | |
| *** tonytan4ever has joined #openstack-keystone | 13:15 | |
| *** stingaci has quit IRC | 13:18 | |
| *** jsavak has joined #openstack-keystone | 13:18 | |
| *** BjoernT has joined #openstack-keystone | 13:20 | |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 13:20 | |
| *** alee has joined #openstack-keystone | 13:27 | |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 13:35 | |
| *** daemontool_ has joined #openstack-keystone | 13:35 | |
| *** daemontool has quit IRC | 13:37 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:45 | |
| *** openstackgerrit has quit IRC | 13:47 | |
| *** openstackgerrit has joined #openstack-keystone | 13:47 | |
| *** EinstCrazy has joined #openstack-keystone | 13:49 | |
| *** mhickey has joined #openstack-keystone | 13:51 | |
| *** csoukup has joined #openstack-keystone | 13:52 | |
| *** errr has left #openstack-keystone | 13:54 | |
| *** ametts has joined #openstack-keystone | 13:55 | |
| ayoung | dstanek, morning! | 13:59 |
| ayoung | Do we have any best practices written up about how to transport Fernet Keys for rotation? | 13:59 |
| *** pushkaru has joined #openstack-keystone | 14:03 | |
| ayoung | lbragstad, your blog is down, and many other articles reference it for Fernet key rotation. | 14:06 |
| *** timcline has joined #openstack-keystone | 14:07 | |
| samueldmq | ayoung: that remembers me to resurrect mine | 14:07 |
| *** links has joined #openstack-keystone | 14:07 | |
| ayoung | samueldmq, yes please | 14:07 |
| samueldmq | ayoung: will try to do today, because if I leave for tomorrow, I will never do it :) | 14:08 |
| *** stingaci has joined #openstack-keystone | 14:15 | |
| *** links has quit IRC | 14:16 | |
| *** pnavarro has quit IRC | 14:19 | |
| dstanek | hmmm....i'm a bit worried about our keystoneclient unit tests | 14:19 |
| *** stingaci has quit IRC | 14:19 | |
| dstanek | for example, this doesn't appear to test anything http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/tests/unit/v3/test_projects.py#n301 | 14:19 |
| lbragstad | ayoung thanks - i've been fighting it for a while.. I need to spend a weekend tuning it | 14:19 |
| lbragstad | ayoung it's back up now though | 14:20 |
| bknudson | dstanek: we could write the same test as a functional test. | 14:20 |
| ayoung | http://nukees.com/d/20160504.html | 14:20 |
| ayoung | Last Panel | 14:21 |
| bknudson | dstanek: and then have the unit tests re-implement the functional test with mock so that we can run the tests without the server, too. | 14:21 |
| *** nalind has joined #openstack-keystone | 14:22 | |
| dstanek | bknudson: that would be cool to see | 14:23 |
| dstanek | it looks like there are at least a few tests that are just testing out mocking system. "yep, it looks like the mock data was returned. passed." | 14:24 |
| bknudson | probably required for 100% coverage. | 14:24 |
| bknudson | which would indicate a poor design of the code or tests. | 14:25 |
| *** rm_work has quit IRC | 14:27 | |
| dstanek | bknudson: i found hints of the issue while reviewing https://review.openstack.org/#/c/296246/8 | 14:27 |
| patchbot | dstanek: patch 296246 - python-keystoneclient - Allow send null value in extra properties | 14:27 |
| *** krotscheck has quit IRC | 14:27 | |
| bknudson | dstanek: that's a pretty bad bug, considering how long the behavior has been broken in the client. | 14:28 |
| bknudson | I thought we had ways to verify the request was made correctly? | 14:28 |
| *** mjb has quit IRC | 14:28 | |
| bknudson | e.g., self.assertQueryStringIs('subtree_as_ids') | 14:29 |
| *** jistr has quit IRC | 14:29 | |
| dstanek | bknudson: i think we do | 14:29 |
| dstanek | bknudson: it's also a bug that discourages the use of extras :-) | 14:30 |
| bknudson | oh, it's just extras, not removing description (for example)? | 14:30 |
| bknudson | if so then not that big of a deal. | 14:31 |
| *** pnavarro has joined #openstack-keystone | 14:31 | |
| lbragstad | looks like the audit id fix didn't completely fix up the gate - http://status.openstack.org/elastic-recheck/index.html | 14:31 |
| dstanek | bknudson: no, i think it's everything. | 14:31 |
| *** slberger has joined #openstack-keystone | 14:31 | |
| dstanek | it looks like ksc makes the assumption that you can't null out anything | 14:31 |
| *** TxGVNN has joined #openstack-keystone | 14:32 | |
| bknudson | identity spec says if you set it to null it's removed, right, not set to null? | 14:32 |
| *** krotscheck has joined #openstack-keystone | 14:33 | |
| rodrigods | dstanek, the mocked test in that case only shows that ksc passes correctly the value from the underlying layer | 14:33 |
| rodrigods | actually i think that's the correct way of implementing unit tests | 14:34 |
| rodrigods | each layer should mock the result from the layer below it | 14:34 |
| bknudson | when you mock things you still have to verify that the application accessed the mock as expected. | 14:34 |
| *** doug-fish has joined #openstack-keystone | 14:35 | |
| rodrigods | bknudson, yes, didn't mean the opposite | 14:35 |
| bknudson | e.g., if functionA calls functionB, you mock functionB, and your test ensures functionA called functionB with the expected arguments | 14:35 |
| *** mjb has joined #openstack-keystone | 14:35 | |
| rodrigods | bknudson, right | 14:35 |
| rodrigods | that is missing indeed | 14:36 |
| bknudson | I think that's what dstanek is noticing in the keystoneclient unit tests. | 14:36 |
| rodrigods | ++ | 14:36 |
| rodrigods | i can take a look in the tests to fix those kind of issues | 14:36 |
| rodrigods | not right now, but in the next couple of weeks | 14:37 |
| bknudson | in a lot of cases for keystoneclient there isn't much to validate, just that the request hit the right URI. | 14:37 |
| bknudson | but if there's a request body it should validate the body. | 14:37 |
| dstanek | rodrigods: that test i referenced works fine without the parent_id line on 303. so i don't think it's testing anything | 14:37 |
| rodrigods | dstanek, yeah, it is missing to verify the parameters called | 14:38 |
| rodrigods | the body, as bknudson said ^ | 14:39 |
| bknudson | dstanek has eyes like an eagle. | 14:39 |
| rodrigods | ++ | 14:41 |
| rodrigods | bknudson, our uwsgi job runs all tempest tests, right? | 14:42 |
| bknudson | yes, it's the same as the regular gate tempest. | 14:42 |
| rodrigods | cool | 14:42 |
| bknudson | except it's uwsgi rather than apache mod_wsgi | 14:43 |
| stevemar | for some reason i have 3 meetings in 17 minutes | 14:43 |
| rodrigods | bknudson, we may want to add our plugin tests there, but when we have at least 1 | 14:44 |
| rodrigods | stevemar, lol | 14:44 |
| lbragstad | dolphm some more recent failures - http://status.openstack.org/elastic-recheck/index.html | 14:45 |
| lbragstad | dolphm scroll down to Bug 1577558 - v2.0 fernet tokens audit ids are inconsistent | 14:45 |
| openstack | bug 1577558 in OpenStack Security Advisory "v2.0 fernet tokens audit ids are inconsistent" [Undecided,Incomplete] https://launchpad.net/bugs/1577558 | 14:45 |
| *** diazjf has joined #openstack-keystone | 14:46 | |
| *** ramishra has quit IRC | 14:47 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Add federation related tests https://review.openstack.org/293040 | 14:48 |
| bknudson | I wonder if we could write a gate job that would remove non-test changes and verify that the tests fail? | 14:48 |
| bknudson | that's something I wind up doing manually pretty often | 14:49 |
| *** ramishra has joined #openstack-keystone | 14:49 | |
| *** slberger has left #openstack-keystone | 14:49 | |
| *** sdake has joined #openstack-keystone | 14:50 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Replace tempest-lib with tempest.lib https://review.openstack.org/310911 | 14:50 |
| *** rderose has joined #openstack-keystone | 14:50 | |
| *** jistr has joined #openstack-keystone | 14:51 | |
| dstanek | bknudson: i have a few helper scripts i use to do that. i can clean them up and maybe they'd be of value to others? | 14:51 |
| bknudson | dstanek: I wouldn't mind seeing it. | 14:51 |
| bknudson | maybe we could get a reviewer-tools repository | 14:52 |
| dstanek | bknudson: i'll pull it together later today and let you know when it's there | 14:53 |
| dstanek | i'll gist it or something | 14:53 |
| *** jorge_munoz_ has joined #openstack-keystone | 14:56 | |
| *** ayoung has quit IRC | 14:59 | |
| *** diazjf has quit IRC | 14:59 | |
| *** jorge_munoz has quit IRC | 14:59 | |
| *** jorge_munoz_ is now known as jorge_munoz | 14:59 | |
| *** diazjf has joined #openstack-keystone | 15:02 | |
| *** jaosorior has joined #openstack-keystone | 15:02 | |
| *** phalmos has joined #openstack-keystone | 15:03 | |
| stevemar | dstanek: can you review https://review.openstack.org/#/c/310147/ | 15:03 |
| patchbot | stevemar: patch 310147 - keystone - Allow 'domain' property for local.group | 15:03 |
| dstanek | stevemar: shore | 15:04 |
| *** pnavarro has quit IRC | 15:04 | |
| *** jaosorior has quit IRC | 15:06 | |
| *** lhcheng has joined #openstack-keystone | 15:06 | |
| *** ChanServ sets mode: +v lhcheng | 15:06 | |
| *** BjoernT has quit IRC | 15:09 | |
| *** arunkant_ has joined #openstack-keystone | 15:12 | |
| *** pleia2 has joined #openstack-keystone | 15:15 | |
| dstanek | stevemar: in the bug there is an assertion that we a group either needs an id or (name and domain) - is that true? | 15:17 |
| arunkant_ | dstanek : Can you review https://review.openstack.org/#/c/279828/ as it has been pending for a while. | 15:18 |
| patchbot | arunkant_: patch 279828 - keystonemiddleware - Adding audit middleware specific notification driv... | 15:18 |
| rodrigods | bknudson, dstanek at least for bugs, if we split the bug exposing test and the fix, we could use git revisions | 15:18 |
| rodrigods | but for gate... have no idea | 15:19 |
| dstanek | arunkant_: i should be able to look at it today | 15:19 |
| dstanek | rodrigods: i don't know that i'd want to enforce that. too much of a pain for contributors | 15:20 |
| bknudson | rodrigods: y, I wish more contributors would do that since it would help with reviews and also we'd know what the old behavior was (maybe it was correct) | 15:21 |
| bknudson | and it would also show that the code is testaable. | 15:21 |
| rodrigods | ++ | 15:21 |
| rodrigods | dstanek, contributors like more commits :) | 15:21 |
| *** julim has quit IRC | 15:22 | |
| dstanek | rodrigods: why? i would guess that is just the few that care abot stats and not getting work done | 15:22 |
| rodrigods | dstanek, just kidding | 15:22 |
| *** basilAB has quit IRC | 15:23 | |
| *** basilAB has joined #openstack-keystone | 15:23 | |
| *** arunkant has quit IRC | 15:23 | |
| *** med_ has quit IRC | 15:23 | |
| *** med_ has joined #openstack-keystone | 15:24 | |
| *** med_ is now known as Guest82506 | 15:24 | |
| *** julim has joined #openstack-keystone | 15:24 | |
| rodrigods | dstanek, if we start to write patches like that, new contributors will tend to copy the behavior | 15:24 |
| *** TemporalBeing1 has joined #openstack-keystone | 15:25 | |
| *** agrebennikov__ has joined #openstack-keystone | 15:25 | |
| *** Guest82506 is now known as medberry | 15:25 | |
| *** medberry has quit IRC | 15:25 | |
| *** medberry has joined #openstack-keystone | 15:25 | |
| rodrigods | shouldn't be mandatory but preferable | 15:25 |
| bknudson | do we have an onboarding doc? | 15:26 |
| bknudson | if not we should | 15:26 |
| rodrigods | bknudson, samueldmq had a patch for that | 15:26 |
| rodrigods | https://review.openstack.org/#/c/302789/ | 15:26 |
| patchbot | rodrigods: patch 302789 - keystone - Add API Change Tutorial | 15:26 |
| rodrigods | it is only for new changes, though | 15:27 |
| bknudson | that would be part of an onboarding doc. | 15:27 |
| rodrigods | a great addition for it would be "fixing bugs" | 15:27 |
| bknudson | Here: http://docs.openstack.org/developer/keystone/community.html | 15:27 |
| bknudson | needs more info | 15:27 |
| rodrigods | hmm | 15:27 |
| rodrigods | ++ | 15:27 |
| bknudson | although I'm not sure if that would be part of an onboarding doc or the onboarding doc itself. | 15:28 |
| bknudson | the getting started section on http://docs.openstack.org/developer/keystone/ is probably where people would go to start. | 15:28 |
| *** arunkant has joined #openstack-keystone | 15:29 | |
| TemporalBeing1 | I am trying to figure out how OS-KSCATALOG works so I can implement the functionality for Mimic. I see the information at http://developer.openstack.org/api-ref-identity-v2-ext.html but it's not nearly as complete as I need, at least per the End Point Templates (no real examples, especially with %tenant_id% substitution or what exactly is required). | 15:29 |
| TemporalBeing1 | Where can I find the code for the OS-KSCATALOG extension? I don't see anything in related to "OS-KSCATALOG" in https://github.com/openstack/keystone | 15:29 |
| rodrigods | bknudson, yes, i started from here: http://docs.openstack.org/developer/keystone/devref/development.environment.html | 15:30 |
| *** slberger has joined #openstack-keystone | 15:30 | |
| bknudson | doesn't really tell you everything either. It would at least have to tell contributors how to get a launchpad ID, and where gerrit is and stuff. | 15:31 |
| bknudson | assume they don't know anything. | 15:32 |
| *** ayoung has joined #openstack-keystone | 15:32 | |
| *** ChanServ sets mode: +v ayoung | 15:32 | |
| rodrigods | bknudson, http://docs.openstack.org/infra/manual/developers.html | 15:33 |
| samueldmq | stevemar: about bug 1575057 | 15:37 |
| openstack | bug 1575057 in OpenStack Identity (keystone) "'domain' is not honored in local.group mapping" [Medium,In progress] https://launchpad.net/bugs/1575057 - Assigned to György Szombathelyi (gyurco) | 15:37 |
| dstanek | samueldmq: what about it? | 15:38 |
| samueldmq | stevemar: how does it reflect to an end user perspective ? | 15:38 |
| samueldmq | dstanek: ^ | 15:38 |
| samueldmq | if a mapping contained a domain, we expected a domain in there, right ? | 15:38 |
| *** dmk0202 has quit IRC | 15:38 | |
| stevemar | samueldmq: i think it was worse than that | 15:38 |
| samueldmq | replace first "domain" by group | 15:39 |
| dstanek | samueldmq: no, if a mapping contains a group with a name then it also needs a domain | 15:39 |
| stevemar | samueldmq: what dstanek said | 15:39 |
| dstanek | samueldmq: i think it will blow up every time the mapping is evaluated | 15:39 |
| *** pgbridge has joined #openstack-keystone | 15:39 | |
| stevemar | yep... | 15:39 |
| samueldmq | stevemar: dstanek: so mapping using a group ID was working fine, but with group name ... no | 15:39 |
| stevemar | samueldmq: tests were passing because we were not calling the schema validator (where it was blowing up) | 15:40 |
| samueldmq | it's weird no one hit that before (it's been there sine mitaka) | 15:40 |
| samueldmq | :( | 15:40 |
| samueldmq | dstanek: nice find on the docs example | 15:41 |
| dstanek | samueldmq: fixing that now :-) | 15:41 |
| rodrigods | i had, but forgot to open bug / fix it | 15:41 |
| rodrigods | the docs are wrong too, as pointed by dstanek | 15:42 |
| samueldmq | rodrigods: :( | 15:42 |
| samueldmq | dstanek: nice man! looking forward to see it :) | 15:42 |
| openstackgerrit | yolanda.robla proposed openstack/keystoneauth: Use betamax hooks to mask fixture results https://review.openstack.org/311133 | 15:44 |
| *** ayoung has quit IRC | 15:46 | |
| *** Guest21288 has quit IRC | 15:46 | |
| *** stingaci has joined #openstack-keystone | 15:48 | |
| openstackgerrit | Marcos FermÃn Lobo proposed openstack/python-keystoneclient: Added endpoint group filter manager methods https://review.openstack.org/182658 | 15:52 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystonemiddleware: Fix D401 PEP257 violation and enable H403 https://review.openstack.org/312767 | 15:52 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes example in the mapping combinations docs https://review.openstack.org/313034 | 15:53 |
| *** lhcheng has quit IRC | 15:56 | |
| samueldmq | dstanek: domain_id isn't always a UUID? | 15:56 |
| *** lhcheng has joined #openstack-keystone | 15:56 | |
| *** ChanServ sets mode: +v lhcheng | 15:56 | |
| dstanek | did anyone start adding federation stuff to the keystone client? | 15:57 |
| dstanek | actually, i guess osc. adding ipds and stuff... | 15:57 |
| samueldmq | dstanek: nvm, those docs already reference to domain_id as something like "abc1234" | 15:57 |
| rodrigods | dstanek, yes | 15:57 |
| samueldmq | dstanek: hmm not sure about osc, looks like ksc already supports it ? | 15:57 |
| dstanek | rodrigods: is that you? | 15:58 |
| rodrigods | hm? | 15:58 |
| *** edtubill has joined #openstack-keystone | 15:58 | |
| samueldmq | rodrigods: who is implementing federation stuff in osc | 15:59 |
| dstanek | rodrigods: yes, what samueldmq said :-) | 15:59 |
| rodrigods | samueldmq, marek implemented a lot of it | 15:59 |
| rodrigods | the CRUD operations and also authentication | 15:59 |
| samueldmq | dstanek: ^ | 15:59 |
| samueldmq | conversation in cycles | 15:59 |
| samueldmq | hehe :D | 16:00 |
| *** stingaci has quit IRC | 16:00 | |
| dstanek | rodrigods: i didn't see it in the osc help, maybe i'm just missing something | 16:00 |
| *** jsavak has quit IRC | 16:00 | |
| *** jsavak has joined #openstack-keystone | 16:00 | |
| rodrigods | dstanek, me neither | 16:01 |
| rodrigods | that's odd, i was sure it was there | 16:01 |
| rodrigods | let me check the code | 16:01 |
| dstanek | i was going to add it last night when i was fixing my k2k ansible role, but thought i'd ask here before putting in the work | 16:01 |
| rodrigods | dstanek, https://github.com/openstack/python-openstackclient/blob/master/openstackclient/identity/v3/identity_provider.py | 16:01 |
| rodrigods | https://github.com/openstack/python-openstackclient/blob/master/openstackclient/identity/v3/service_provider.py | 16:01 |
| rodrigods | dstanek, do you use rippowam? :) | 16:02 |
| dstanek | rodrigods: what is that? | 16:02 |
| rodrigods | dstanek, https://github.com/admiyo/rippowam | 16:02 |
| rodrigods | since when we suggest httpd over eventlet? i mean, the cycle | 16:04 |
| rodrigods | kilo? | 16:04 |
| *** woodster_ has joined #openstack-keystone | 16:07 | |
| dstanek | rodrigods: that's been the recommentation for quite a while. not it's now even possible to use eventlet. | 16:07 |
| edtubill | dstanek, rderose, stevemar: Hey guys, here is the etherpad for the PCI password stuff: https://etherpad.openstack.org/p/keystone-newton-pci-dss . Please look/add stuff if needed. | 16:08 |
| dstanek | edtubill: here is some work i did on password rotation http://bit.ly/1SRrhxn | 16:11 |
| samueldmq | is auth_type a valid config option yet ? | 16:11 |
| samueldmq | looks like it was removed in favor of auth_plugin | 16:12 |
| samueldmq | can anyone confirm that ? | 16:12 |
| edtubill | dstanek: cool, I'll add that to the etherpad. | 16:12 |
| *** medberry is now known as med_ | 16:14 | |
| *** browne has joined #openstack-keystone | 16:14 | |
| *** vgridnev has quit IRC | 16:15 | |
| *** roxanaghe has joined #openstack-keystone | 16:15 | |
| dstanek | edtubill: i not finding the password complexity enforcement stuff right now | 16:15 |
| edtubill | dstanek: kk, just add it to the etherpad if you do happen to find it and thx! | 16:19 |
| *** vgridnev has joined #openstack-keystone | 16:21 | |
| *** vgridnev has quit IRC | 16:21 | |
| *** navidp has joined #openstack-keystone | 16:21 | |
| stevemar | dstanek: i dont think you ever commited that | 16:23 |
| dstanek | stevemar: no, but i thought i submitted it | 16:23 |
| dstanek | stevemar: all the password stuff was rejected :-( | 16:24 |
| *** yolanda has quit IRC | 16:25 | |
| stevemar | dstanek: not anymore! | 16:26 |
| dstanek | i feel vindicated! | 16:27 |
| *** csoukup has quit IRC | 16:27 | |
| lbragstad | better late than never, right? | 16:27 |
| *** sdake_ has joined #openstack-keystone | 16:28 | |
| *** mhickey has quit IRC | 16:29 | |
| *** yolanda has joined #openstack-keystone | 16:30 | |
| *** sdake has quit IRC | 16:31 | |
| *** dan_nguyen has joined #openstack-keystone | 16:33 | |
| *** fangxu has joined #openstack-keystone | 16:36 | |
| *** henrynash has joined #openstack-keystone | 16:40 | |
| *** ChanServ sets mode: +v henrynash | 16:40 | |
| openstackgerrit | Navid Pustchi proposed openstack/keystonemiddleware: Fix D400 PEP257 violation https://review.openstack.org/313052 | 16:42 |
| *** agrebennikov__ has quit IRC | 16:45 | |
| dstanek | rodrigods: i wonder if i just have an old version of osc | 16:47 |
| rodrigods | dstanek, i have a fresh devstack install here and the commands don't appear too | 16:48 |
| rodrigods | maybe they weren't added to the correct files | 16:48 |
| rodrigods | in osc | 16:48 |
| dstanek | rodrigods: ok, well then i guess i'll have to dig in a bit :-( | 16:48 |
| rodrigods | =( | 16:48 |
| rodrigods | it is also annoying to figure out the commands | 16:49 |
| *** TxGVNN has quit IRC | 16:49 | |
| *** timcline has quit IRC | 16:51 | |
| *** roxanaghe_ has joined #openstack-keystone | 16:54 | |
| *** roxanaghe has quit IRC | 16:54 | |
| *** roxanaghe__ has joined #openstack-keystone | 16:55 | |
| *** navid_ has joined #openstack-keystone | 16:57 | |
| *** roxanaghe_ has quit IRC | 16:59 | |
| *** sdake_ has quit IRC | 17:00 | |
| *** navidp has quit IRC | 17:00 | |
| *** stingaci has joined #openstack-keystone | 17:01 | |
| dstanek | rodrigods: haha, i just took a look | 17:03 |
| samueldmq | stevemar: ping | 17:03 |
| dstanek | they only show up when you ask for the v3 api | 17:03 |
| samueldmq | stevemar: ksclient config options are also listed at middleware config file, right ? | 17:03 |
| samueldmq | dstanek: ^ | 17:03 |
| dstanek | rodrigods: openstack --os-identity-api-version=3 | 17:03 |
| dstanek | samueldmq: what options? | 17:04 |
| samueldmq | dstanek: eg auth_plugin | 17:04 |
| dstanek | samueldmq: i wouldn't have thought so, but maybe. why? | 17:04 |
| samueldmq | dstanek: patch 312809 | 17:05 |
| patchbot | samueldmq: https://review.openstack.org/#/c/312809/ - keystonemiddleware - Update config options | 17:05 |
| samueldmq | dstanek: when reviewing, the only place I was able to find defining auth_section and auth_plugin was keystoneclient | 17:06 |
| samueldmq | so my understanding is that it will appear in middleware config file (as the client is used by it) | 17:07 |
| *** yolanda has quit IRC | 17:07 | |
| *** yolanda has joined #openstack-keystone | 17:07 | |
| *** rbridgeman_ has joined #openstack-keystone | 17:09 | |
| dstanek | samueldmq: isn't that configured by the services? | 17:09 |
| dstanek | samueldmq: like http://docs.openstack.org/developer/nova/sample_config.html (the keystone_authtoken section, etc) | 17:10 |
| *** diazjf has quit IRC | 17:10 | |
| *** hoonetorg has joined #openstack-keystone | 17:11 | |
| samueldmq | dstanek: yes it is | 17:13 |
| samueldmq | dstanek: my question is where auth_type option is defined, I couldn't find it anywhere | 17:13 |
| *** jsavak has quit IRC | 17:14 | |
| samueldmq | dstanek: auth_section appears inside middleware config (in the nova example you showed above), and it's defined in keystone client | 17:14 |
| samueldmq | however I can't find auth_type :( | 17:15 |
| *** jsavak has joined #openstack-keystone | 17:15 | |
| *** henrynash has quit IRC | 17:15 | |
| dstanek | auth_type is in there as well. looks like it is marked as deprecated | 17:15 |
| samueldmq | dstanek: https://github.com/openstack/python-keystoneclient/search?utf8=%E2%9C%93&q=auth_type | 17:16 |
| samueldmq | returns me nothing | 17:16 |
| *** dan_nguyen has quit IRC | 17:17 | |
| *** jistr has quit IRC | 17:17 | |
| *** timcline has joined #openstack-keystone | 17:18 | |
| dstanek | samueldmq: i have no idea what, if anything, uses that | 17:18 |
| samueldmq | dstanek: ok, me neither, I will dig a bit more on it | 17:19 |
| dstanek | samueldmq: where were you seeing if referenced? | 17:19 |
| samueldmq | something's smelling bad there | 17:19 |
| dstanek | the only auth_type i remember is the environment var | 17:19 |
| samueldmq | dstanek: maybe it is always from an envvar, and has never been a config option | 17:20 |
| *** gyee has joined #openstack-keystone | 17:21 | |
| *** ChanServ sets mode: +v gyee | 17:21 | |
| *** timcline has quit IRC | 17:22 | |
| samueldmq | dstanek: so my question is why we document it in the configuration file, if it's an environment var | 17:22 |
| *** timcline has joined #openstack-keystone | 17:22 | |
| *** tqtran has joined #openstack-keystone | 17:23 | |
| *** alee has left #openstack-keystone | 17:23 | |
| *** timcline has quit IRC | 17:23 | |
| openstackgerrit | Merged openstack/keystone: Allow 'domain' property for local.group https://review.openstack.org/310147 | 17:23 |
| *** fedruantine has quit IRC | 17:24 | |
| *** fangxu has quit IRC | 17:25 | |
| *** timcline has joined #openstack-keystone | 17:25 | |
| dstanek | samueldmq: did you check keystoneauth? if anything uses it i would expect that to be it | 17:25 |
| samueldmq | dstanek: good catch | 17:26 |
| samueldmq | dstanek: I had forgot about it, I need to put my love on keystoneauth too | 17:27 |
| *** aginwala has joined #openstack-keystone | 17:28 | |
| samueldmq | dstanek: thanks | 17:30 |
| samueldmq | dstanek: the way it reads from http://docs.openstack.org/developer/nova/sample_config.html | 17:30 |
| samueldmq | # Deprecated group/name - [DEFAULT]/auth_plugin | 17:30 |
| samueldmq | #auth_type = <None> | 17:30 |
| samueldmq | It means auth_type is deprecated in favor of auth_plugin right? | 17:30 |
| openstackgerrit | Merged openstack/keystone: do not search file on real environment https://review.openstack.org/309882 | 17:30 |
| *** tonytan4ever has quit IRC | 17:31 | |
| *** lhcheng has quit IRC | 17:31 | |
| *** lhcheng has joined #openstack-keystone | 17:31 | |
| *** ChanServ sets mode: +v lhcheng | 17:31 | |
| *** jsavak has quit IRC | 17:31 | |
| *** nikhil has quit IRC | 17:31 | |
| *** csoukup has joined #openstack-keystone | 17:31 | |
| *** nikhil has joined #openstack-keystone | 17:32 | |
| *** ayoung has joined #openstack-keystone | 17:33 | |
| *** ChanServ sets mode: +v ayoung | 17:33 | |
| *** tonytan4ever has joined #openstack-keystone | 17:34 | |
| *** fangxu has joined #openstack-keystone | 17:38 | |
| hoonetorg | hi | 17:39 |
| openstackgerrit | yolanda.robla proposed openstack/keystoneauth: Use betamax hooks to mask fixture results https://review.openstack.org/311133 | 17:39 |
| hoonetorg | does the admin user need the _member_ role or can it be removed? | 17:40 |
| yolanda | morgan,keystone-cores... that change should be ready to go finally | 17:40 |
| hoonetorg | that is what the salt-formula-keystone actually does. | 17:40 |
| *** jsavak has joined #openstack-keystone | 17:41 | |
| hoonetorg | so is it enough, that the admin user has !only! the admin role? | 17:41 |
| yolanda | thx sigmavirus24 for the betamax release, and your help with that | 17:41 |
| *** rm_work has joined #openstack-keystone | 17:51 | |
| *** itlinux has joined #openstack-keystone | 17:52 | |
| openstackgerrit | Merged openstack/keystone: Fixes example in the mapping combinations docs https://review.openstack.org/313034 | 17:58 |
| openstackgerrit | Gyorgy Szombathelyi proposed openstack/keystone: Add mapping validation tests https://review.openstack.org/312881 | 18:02 |
| *** lhcheng has quit IRC | 18:04 | |
| *** lhcheng has joined #openstack-keystone | 18:04 | |
| *** ChanServ sets mode: +v lhcheng | 18:04 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Fix D401 PEP257 violation and enable H403 https://review.openstack.org/312767 | 18:07 |
| *** aginwala has quit IRC | 18:07 | |
| *** jasonsb has joined #openstack-keystone | 18:07 | |
| *** aginwala has joined #openstack-keystone | 18:07 | |
| *** navid_ has quit IRC | 18:09 | |
| *** pushkaru has quit IRC | 18:10 | |
| *** lhcheng has quit IRC | 18:11 | |
| openstackgerrit | Gyorgy Szombathelyi proposed openstack/keystone: Add mapping validation tests https://review.openstack.org/312881 | 18:11 |
| *** lhcheng has joined #openstack-keystone | 18:11 | |
| *** ChanServ sets mode: +v lhcheng | 18:11 | |
| *** aginwala has quit IRC | 18:11 | |
| *** yolanda has quit IRC | 18:15 | |
| *** Nakato has quit IRC | 18:19 | |
| *** Nakato has joined #openstack-keystone | 18:22 | |
| *** jsavak has quit IRC | 18:26 | |
| *** ninag has quit IRC | 18:30 | |
| *** ninag has joined #openstack-keystone | 18:30 | |
| *** doug-fis_ has joined #openstack-keystone | 18:31 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Update config options https://review.openstack.org/312809 | 18:32 |
| *** doug-fi__ has joined #openstack-keystone | 18:32 | |
| *** ninag_ has joined #openstack-keystone | 18:32 | |
| *** ninag_ has quit IRC | 18:32 | |
| *** ninag_ has joined #openstack-keystone | 18:33 | |
| *** doug-fish has quit IRC | 18:34 | |
| *** ninag has quit IRC | 18:35 | |
| *** doug-fis_ has quit IRC | 18:35 | |
| *** dan_nguyen has joined #openstack-keystone | 18:36 | |
| *** doug-fi__ has quit IRC | 18:37 | |
| *** ninag_ has quit IRC | 18:38 | |
| *** doug-fish has joined #openstack-keystone | 18:42 | |
| *** doug-fish has quit IRC | 18:42 | |
| *** doug-fish has joined #openstack-keystone | 18:43 | |
| stevemar | gerrit is sloowwww today | 18:43 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Fix D400 PEP257 violation https://review.openstack.org/313052 | 18:43 |
| *** doug-fish has quit IRC | 18:43 | |
| sigmavirus24 | stevemar: seconded | 18:43 |
| *** doug-fish has joined #openstack-keystone | 18:43 | |
| *** doug-fish has quit IRC | 18:44 | |
| *** tqtran has quit IRC | 18:44 | |
| *** doug-fish has joined #openstack-keystone | 18:44 | |
| *** jsavak has joined #openstack-keystone | 18:46 | |
| *** sdake has joined #openstack-keystone | 18:48 | |
| rodrigods | dstanek, ahh true, it hides based on the api version | 18:48 |
| *** doug-fish has quit IRC | 18:49 | |
| bknudson | gerrit gives proxy error for me. | 18:49 |
| *** doug-fish has joined #openstack-keystone | 18:50 | |
| *** tqtran has joined #openstack-keystone | 18:50 | |
| *** ninag has joined #openstack-keystone | 18:53 | |
| *** mvk_ has quit IRC | 18:54 | |
| *** pushkaru has joined #openstack-keystone | 18:54 | |
| *** sdake_ has joined #openstack-keystone | 18:55 | |
| *** aginwala has joined #openstack-keystone | 18:55 | |
| *** diazjf has joined #openstack-keystone | 18:56 | |
| *** ninag has quit IRC | 18:56 | |
| *** sdake has quit IRC | 18:57 | |
| *** aginwala has quit IRC | 18:59 | |
| *** aginwala has joined #openstack-keystone | 19:02 | |
| stevemar | bknudson: guess you can't work today :) | 19:02 |
| *** haplo37 has joined #openstack-keystone | 19:04 | |
| dstanek | bknudson: refresh. it's only transient for me | 19:04 |
| *** doug-fish has quit IRC | 19:08 | |
| *** aginwala has quit IRC | 19:08 | |
| *** dikonoor has quit IRC | 19:09 | |
| *** pushkaru has quit IRC | 19:15 | |
| -openstackstatus- NOTICE: Gerrit is restarting to address performance issues related to a suspected memory leak | 19:21 | |
| *** fangxu has quit IRC | 19:22 | |
| bknudson | anybody use vagrant to do their openstack dev? | 19:23 |
| openstackgerrit | Divya K Konoor proposed openstack/keystone: Honor ldap_filter on filtered user list https://review.openstack.org/312126 | 19:26 |
| lbragstad | bknudson I use to | 19:26 |
| *** navid_ has joined #openstack-keystone | 19:28 | |
| openstackgerrit | Divya K Konoor proposed openstack/keystone: Honor ldap_filter on filtered user list https://review.openstack.org/312126 | 19:28 |
| bknudson | people might find this interesting: https://review.openstack.org/#/c/291817/12/files/apache-keystone-uwsgi-proxy.template | 19:29 |
| patchbot | bknudson: patch 291817 - openstack-dev/devstack - Deploy keystone running in uwsgi proxy by apache | 19:29 |
| bknudson | keystone under uwsgi listens on a unix socket | 19:29 |
| *** ninag has joined #openstack-keystone | 19:29 | |
| bknudson | ProxyPass /identity unix:/tmp/keystone-public-uwsgi.sock|http://identity/ retry=0 | 19:30 |
| bknudson | I tried using uwsgi protocol but that didn't work for some reason, but http worked. | 19:30 |
| bknudson | this required ubuntu 16.04 | 19:30 |
| *** doug-fish has joined #openstack-keystone | 19:31 | |
| bknudson | looks like OSA is set up for ports -- http://git.openstack.org/cgit/openstack/openstack-ansible-os_keystone/tree/templates/keystone-httpd.conf.j2 :( | 19:31 |
| bknudson | and uses mod_wsgi :( | 19:32 |
| dolphm | bknudson: for now! | 19:32 |
| *** mvk_ has joined #openstack-keystone | 19:32 | |
| stevemar | bknudson: i think we know some folks over in OSA land that can fix that | 19:32 |
| odyssey4me | lol | 19:32 |
| odyssey4me | I wonder who that would be. | 19:33 |
| dolphm | bknudson: stevemar: are we going to change our documented recommendation to be nginx + uwsgi this cycle? | 19:33 |
| bknudson | dolphm: I'm hoping that will happen this cycle. Didn't get any pushback in the cross-project session. | 19:34 |
| odyssey4me | hmm, that'll make operators hurl rocks at you | 19:34 |
| stevemar | dolphm: probably not nginx since we don't have that gating yet, and it doesn't have fun federation plugins | 19:34 |
| odyssey4me | how does that affect the federation implementations? | 19:34 |
| stevemar | dolphm: but apache + uwsgi for sure | 19:34 |
| stevemar | odyssey4me: greatly! | 19:35 |
| bknudson | nobody has given a good reason for switching to nginx. | 19:35 |
| dstanek | stevemar: shib supports nginx now | 19:35 |
| bknudson | it's trendier... | 19:35 |
| stevemar | dstanek: we haven't tested enough on nginx to claim it's 100% supported | 19:35 |
| odyssey4me | well, for us we could aid the transition - most of our deployers implement keystone in containers so we can just ditch the container and rebuild it in the upgrade process... but that's not a fun proposition | 19:35 |
| stevemar | by enough, i mean at all | 19:35 |
| *** ninag has quit IRC | 19:36 | |
| *** doug-fish has quit IRC | 19:36 | |
| odyssey4me | well, why use uwsgi instead of mod_wsgi ? | 19:36 |
| dstanek | stevemar: testing is something we just need some time for, but it's there | 19:37 |
| bknudson | it keeps keystone out of the apache process. | 19:37 |
| odyssey4me | we can implement options and carry them for a cycle or two to give time for transition | 19:37 |
| bknudson | for devs it should be nicer since it's easy to restart keystone process and use pdb. | 19:37 |
| dstanek | bknudson: ++ a much better model | 19:37 |
| *** ninag has joined #openstack-keystone | 19:37 | |
| odyssey4me | considering that we're carrying Ubuntu Trusty and Ubuntu Xenial combined support for two cycles, maybe this should go with it - when we kill trusty support we also kill an older model | 19:38 |
| odyssey4me | so basically when you change the OS version you also change the model | 19:38 |
| bknudson | from what I've seen it's not going to be easy to support trusty and xenial together. | 19:39 |
| stevemar | odyssey4me: using uwsgi is nice since: 1) you can use pdb instead of rpdb and 2) you can restart uwsgi alone and not the web server (so you don't have to restart everything just for keystone) | 19:39 |
| odyssey4me | perhaps - we'll see, we're on that work now already and should have much of it done by Newton-2 | 19:40 |
| bknudson | the xenial mod_proxy at least support unix sockets. So I was asked to wait for xenial for the uwsgi devstack | 19:40 |
| bknudson | which I was told we'd have for the gate in a couple of weeks | 19:41 |
| odyssey4me | stevemar ok, so (1) nice for dev troubleshooting and (2) nice for co-located services (which we don't advocate) | 19:41 |
| *** navid_ has quit IRC | 19:42 | |
| odyssey4me | but considering we have a growing developer use case I think we can add it as an option | 19:42 |
| dstanek | odyssey4me: it also allows you to scale the apache and application server processes independently | 19:42 |
| *** harbor has quit IRC | 19:42 | |
| bknudson | if you're not colocating services then I'd suggest running uwsgi rather than bothering with apache. | 19:43 |
| odyssey4me | bknudson but then no federation, or any other hand-off auth options | 19:43 |
| bknudson | then have apache/haproxy on other machines. | 19:43 |
| dstanek | bknudson: that is the model i used for a high traffic webapp. machines running apaches were actually separate from the machines running the python processes | 19:44 |
| *** doug-fish has joined #openstack-keystone | 19:44 | |
| odyssey4me | alright, well we'd love to hear alternative deployment models and are happy to discuss and work together to implement something in OSA | 19:45 |
| odyssey4me | to be responsible we'd have to allow an opt-in model for a cycle, then change the default for a cycle, then drop the next cycle | 19:46 |
| odyssey4me | that gives plenty of time to test and transition | 19:46 |
| odyssey4me | and this cycle is a good time to introduce changes like that | 19:46 |
| bknudson | the other services (nova-api) aren't using mod_wsgi are they? | 19:47 |
| odyssey4me | whatever is implemented needs to support federation because we have consumers of that already | 19:47 |
| odyssey4me | no, for now apache is only used for keystone and horizon | 19:47 |
| bknudson | separate apache should support federation just fine... it's apache that does the saml work and passes headers to the uwsgi | 19:48 |
| odyssey4me | I'd like to transition other projects to use a similar model as it scales better, and scale is important to us. | 19:48 |
| odyssey4me | yup, agreed | 19:48 |
| *** doug-fish has quit IRC | 19:49 | |
| bknudson | you'll probably get this working before I can get it in devstack. | 19:49 |
| *** amrith has left #openstack-keystone | 19:49 | |
| odyssey4me | dolphm or lbragstad are you guys going to take a crack at a IP review to get it done? | 19:49 |
| odyssey4me | *WIP | 19:49 |
| *** doug-fish has joined #openstack-keystone | 19:50 | |
| bknudson | so the model would be there's a set of apache roles that forward requests to the individual service APIs, e.g., /identity -> keystone , /compute -> nova-api, etc. | 19:50 |
| bknudson | the apache nodes can also do :5000, etc., too. | 19:50 |
| lbragstad | odyssey4me WIP review for deploying keystone differently? | 19:51 |
| dolphm | odyssey4me: in OSA? | 19:52 |
| odyssey4me | yup, in the keystone role | 19:52 |
| odyssey4me | ie are you alright taking a go at it or do you need assistance making it happen? | 19:52 |
| dolphm | odyssey4me: i'd be interested for the sake of capstone, but i'm more interested in moving keystone to dstanek's federation implementation first, then switching to uwsgi as our reference deployment | 19:53 |
| dolphm | odyssey4me: in terms of timelines, we'd need assistance to make that happen anytime soon. putting v3 in public cloud production would certainly take precedence for the next month or two :) | 19:54 |
| dolphm | odyssey4me: after that, perhaps mid newton, and we might have bandwidth to pursue it | 19:55 |
| bknudson | hopefully by mid-newton we'll have this deployment model in the gate. | 19:55 |
| bknudson | at least for keystone | 19:56 |
| dolphm | bknudson: OSA basically follows the upstream recommendations wherever possible, so i'd think an upstream gate would be required before merging a similar change to OSA | 19:56 |
| hoonetorg | hi bknudson: i asked about an exception when starting keystone with wsgi ^^^ and you answered i should create my own wsgi scripts | 19:57 |
| odyssey4me | alright, would it be possible to outline the general implementation and any known configurations in an etherpad then I'd be happy to work on getting it into the keystone role for OSA which is consumed by capstone | 19:57 |
| hoonetorg | ist was on centos/el7 with mitaka from centos repos | 19:57 |
| dolphm | bknudson: and unfortunately that means we're going to be deploying mitaka in public cloud on mod_wsgi :( | 19:57 |
| hoonetorg | the solution was simple chown keystone:keystone /var/log/keystone | 19:57 |
| hoonetorg | *the solution was simple chown keystone:keystone /var/log/keystone/keystone.log | 19:58 |
| bknudson | hoonetorg: apache must have been configured to run as keystone or something. | 19:58 |
| hoonetorg | yep it is | 19:58 |
| dolphm | odyssey4me: http://docs.openstack.org/developer/keystone/apache-httpd.html#mod-proxy-uwsgi | 19:59 |
| dolphm | odyssey4me: https://github.com/openstack/keystone/blob/master/httpd/keystone-uwsgi-admin.ini | 19:59 |
| dolphm | odyssey4me: https://github.com/openstack/keystone/blob/master/httpd/uwsgi-keystone.conf | 19:59 |
| dolphm | odyssey4me: not nginx, but that's half the battle ^ | 19:59 |
| hoonetorg | bknudson: WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP} | 20:00 |
| dolphm | odyssey4me: i suspect federation support will be the only tricky bit in switching OSA to nginx | 20:00 |
| odyssey4me | dolphm alright, let me take a look into it and see what I can do | 20:00 |
| dolphm | odyssey4me: any idea how many people are using the federation support in OSA? | 20:01 |
| *** daemontool_ has quit IRC | 20:01 | |
| odyssey4me | the easiest short term option will obviously be to keep apache and just switch the back-end - from there we can try adding nginx | 20:01 |
| dolphm | odyssey4me: ++ | 20:02 |
| odyssey4me | dolphm I know that Belnet (where evrardjp comes from) was using it, and Comcast has also been testing it for production needs. | 20:02 |
| dolphm | odyssey4me: that where the biggest win is right now, as well | 20:02 |
| dolphm | that would be where* | 20:02 |
| evrardjp | true | 20:02 |
| *** dan_nguyen has quit IRC | 20:02 | |
| dolphm | evrardjp: awesome; complaints? | 20:03 |
| hoonetorg | bknudson: on a fresh install there is no /var/log/keystone/keystone.log when i run then keystone-manage db_sync this log file is created as root:root | 20:03 |
| evrardjp | federation? Lots of complaints | 20:03 |
| evrardjp | as usual | 20:03 |
| evrardjp | :D | 20:03 |
| bknudson | hoonetorg: I think other people have run into that too. | 20:03 |
| evrardjp | particularily to OSA, not that much | 20:03 |
| dolphm | evrardjp: how about on the spectrum from "it doesn't work" to "mapping is painful"? | 20:03 |
| hoonetorg | bknudson: i believe so too | 20:04 |
| odyssey4me | it's 9pm for me so I'm outta here for the day - will chat a bit more about this in the next week or two | 20:04 |
| bknudson | hoonetorg: maybe the correct thing to do is run keystone-manage db_sync as keystone user, too? | 20:05 |
| hoonetorg | i will fix that in my fork of the salt-formula-keystone and write a small comment on this | 20:05 |
| hoonetorg | yes that's the idea: let keystone-manage db_sync run as keystone user | 20:05 |
| bknudson | hoonetorg: does salt set up keystone to run under uwsgi? | 20:06 |
| hoonetorg | only in my fork | 20:06 |
| hoonetorg | i implemented it lately | 20:06 |
| hoonetorg | https://github.com/hoonetorg/salt-formula-keystone | 20:06 |
| evrardjp | mapping is painful is certainly something they said | 20:07 |
| *** dan_nguyen has joined #openstack-keystone | 20:08 | |
| hoonetorg | bknudson: https://github.com/hoonetorg/salt-formula-keystone/blob/develop/keystone/server.sls#L142-L174 | 20:08 |
| hoonetorg | (without the fix) | 20:09 |
| bknudson | hoonetorg: looks like that's running in mod_wsgi and not under uwsgi with mod_proxy | 20:10 |
| *** ayoung has quit IRC | 20:10 | |
| hoonetorg | ah sorry | 20:10 |
| hoonetorg | only read wsgi | 20:10 |
| hoonetorg | yes, no ahem: apache + mod_wsgi | 20:10 |
| hoonetorg | the problem will probably be the same if uwsgi runs as keystone | 20:11 |
| *** auggy has joined #openstack-keystone | 20:11 | |
| bknudson | you'll want the uwsgi process to run as keystone user. | 20:11 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add policy registration https://review.openstack.org/313141 | 20:11 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add authorize method to Enforcer https://review.openstack.org/313142 | 20:12 |
| bknudson | so you'd have the same problem if you do db_sync as root | 20:12 |
| auggy | sigmavirus24: thanks! | 20:12 |
| stevemar | evrardjp: i'd love to hear about ideas to make mapping and federation less painful :) cc dolphm | 20:12 |
| hoonetorg | thought on doing the same with nginx+uwsgi, but found a performance comparison where apache+mod_wsgi was faster | 20:12 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add policy registration https://review.openstack.org/313141 | 20:13 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add authorize method to Enforcer https://review.openstack.org/313142 | 20:13 |
| *** vgridnev has joined #openstack-keystone | 20:13 | |
| hoonetorg | yep, remind: do run keystone-manage db_sync as keystone user when using *wsgi* or check that the permissions of the logfile are correct | 20:14 |
| hoonetorg | the puppet and ansible guys have/had probably the same problem | 20:14 |
| *** alex_xu has quit IRC | 20:18 | |
| *** aginwala has joined #openstack-keystone | 20:19 | |
| *** alex_xu has joined #openstack-keystone | 20:22 | |
| *** pushkaru has joined #openstack-keystone | 20:24 | |
| *** rha has quit IRC | 20:25 | |
| *** rha has joined #openstack-keystone | 20:28 | |
| *** rha has quit IRC | 20:28 | |
| *** rha has joined #openstack-keystone | 20:28 | |
| -openstackstatus- NOTICE: Gerrit is restarting to revert incorrect changes to test result displays | 20:29 | |
| *** dmk0202 has joined #openstack-keystone | 20:29 | |
| *** tonytan4ever has quit IRC | 20:31 | |
| *** tonytan4ever has joined #openstack-keystone | 20:32 | |
| *** daemontool_ has joined #openstack-keystone | 20:35 | |
| *** sdake has joined #openstack-keystone | 20:35 | |
| *** sdake_ has quit IRC | 20:36 | |
| *** aginwala has quit IRC | 20:48 | |
| *** fangxu has joined #openstack-keystone | 20:49 | |
| *** amit213 has joined #openstack-keystone | 20:50 | |
| *** aginwala has joined #openstack-keystone | 20:51 | |
| *** neophy has joined #openstack-keystone | 20:55 | |
| *** haplo37 has quit IRC | 20:57 | |
| *** aginwala has quit IRC | 21:03 | |
| *** fawadkhaliq has joined #openstack-keystone | 21:04 | |
| *** rcernin has joined #openstack-keystone | 21:05 | |
| *** raddaoui has joined #openstack-keystone | 21:09 | |
| *** raildo is now known as raildo-afk | 21:11 | |
| bknudson | lbragstad: why did you stop using vagrant? | 21:14 |
| *** aginwala has joined #openstack-keystone | 21:14 | |
| *** aginwala has quit IRC | 21:16 | |
| *** roxanaghe__ has quit IRC | 21:17 | |
| *** roxanaghe has joined #openstack-keystone | 21:17 | |
| *** csoukup has quit IRC | 21:18 | |
| *** timcline has quit IRC | 21:20 | |
| lbragstad | bknudson I was doing weird things mounting drives and had issues with it. | 21:22 |
| lbragstad | bknudson so i switched completely to vim and do everything on a vm | 21:22 |
| bknudson | lbragstad: ok. I haven't tried vagrant yet. What you're doing sounds like how I work. | 21:23 |
| bknudson | looks like vagrant mounts your local directories somehow. | 21:23 |
| *** jdennis1 has joined #openstack-keystone | 21:23 | |
| lbragstad | bknudson you mount drives to a virtual box and run tests and everything from there? | 21:23 |
| lbragstad | bknudson yeah - you can supply a mapping in your vagrant file | 21:24 |
| bknudson | oh, no, I never figured out how to mount drives on the vm. | 21:24 |
| lbragstad | i was using it so that I could run my ide locally and the changes would be seen in the vm | 21:24 |
| *** jdennis has quit IRC | 21:24 | |
| bknudson | I tried fuse with sshfs but that was a disaster. | 21:24 |
| lbragstad | i've never tried that | 21:24 |
| bknudson | did you ever do any ansible on the vagrant? | 21:24 |
| bknudson | looks like vagrant can do ansible automatically | 21:25 |
| lbragstad | bknudson mm a couple times, mostly testing boostrap operations | 21:25 |
| lbragstad | but i haven't done much with the integration between vagrant and ansible | 21:25 |
| *** pushkaru has quit IRC | 21:26 | |
| *** vgridnev has quit IRC | 21:29 | |
| *** fawadkhaliq has quit IRC | 21:33 | |
| bknudson | I'd probably do all my editing and even tox - epy27 on the main system and then for devstack use the vagrant | 21:34 |
| *** ametts has quit IRC | 21:34 | |
| *** aginwala has joined #openstack-keystone | 21:37 | |
| rderose | edtubill: thanks, I'll review and update the etherpad | 21:37 |
| *** pauloewerton has quit IRC | 21:42 | |
| *** aginwala has quit IRC | 21:44 | |
| *** aginwala has joined #openstack-keystone | 21:45 | |
| *** aginwala_ has joined #openstack-keystone | 21:47 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for endpoint policy drivers https://review.openstack.org/212006 | 21:49 |
| *** sdake has quit IRC | 21:50 | |
| *** aginwala has quit IRC | 21:50 | |
| samueldmq | bknudson: everything addressed ^ thanks for all valuable comments | 21:50 |
| *** sdake has joined #openstack-keystone | 21:51 | |
| *** jasonsb has quit IRC | 21:55 | |
| *** sdake has quit IRC | 21:56 | |
| *** aginwala has joined #openstack-keystone | 21:56 | |
| *** ametts has joined #openstack-keystone | 21:56 | |
| *** jasonsb has joined #openstack-keystone | 21:58 | |
| *** aginwala_ has quit IRC | 21:59 | |
| *** nalind has quit IRC | 22:02 | |
| *** Ephur has joined #openstack-keystone | 22:02 | |
| *** ayoung has joined #openstack-keystone | 22:03 | |
| *** ChanServ sets mode: +v ayoung | 22:03 | |
| *** spzala has quit IRC | 22:04 | |
| *** spzala has joined #openstack-keystone | 22:04 | |
| *** ninag has quit IRC | 22:05 | |
| *** ninag has joined #openstack-keystone | 22:06 | |
| *** aginwala has quit IRC | 22:07 | |
| *** spzala has quit IRC | 22:09 | |
| *** ninag has quit IRC | 22:10 | |
| *** aginwala has joined #openstack-keystone | 22:13 | |
| *** furface has joined #openstack-keystone | 22:13 | |
| *** slberger has left #openstack-keystone | 22:14 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:14 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: PoC: share tests https://review.openstack.org/313175 | 22:15 |
| bknudson | dstanek: an example of what I was talking about earlier today ^ | 22:16 |
| bknudson | sharing tests between functional and unit. | 22:16 |
| *** aginwala has quit IRC | 22:17 | |
| bknudson | of course the goal would be to get rid of duplicate unit tests. | 22:20 |
| *** phalmos has quit IRC | 22:21 | |
| *** timcline has joined #openstack-keystone | 22:21 | |
| *** timcline has quit IRC | 22:25 | |
| *** jsavak has quit IRC | 22:26 | |
| *** rcernin has quit IRC | 22:29 | |
| *** edtubill has quit IRC | 22:30 | |
| rodrigods | bknudson, ^ nice! | 22:31 |
| bknudson | rodrigods: thanks. Maybe we have few enough functional tests that we could do this to all of them. | 22:32 |
| *** jsavak has joined #openstack-keystone | 22:32 | |
| rodrigods | bknudson, yes, totally doable | 22:32 |
| bknudson | maybe test_access wasn't the best choice... that one does import of tempest.lib whereas test_federation doesn't. | 22:33 |
| bknudson | oh, the other ones use os_client_config | 22:33 |
| *** diazjf has quit IRC | 22:34 | |
| bknudson | maybe could mock out base.get_client or something | 22:34 |
| rodrigods | bknudson, ++ | 22:34 |
| rodrigods | we could... but as we discussed earlier | 22:35 |
| *** ninag has joined #openstack-keystone | 22:35 | |
| *** ametts has quit IRC | 22:35 | |
| rodrigods | there are some kind of mocked tests that need specific checks | 22:35 |
| rodrigods | like to check if the underlying layer was called with the correct parameters | 22:35 |
| rodrigods | so the "body" of the tests would differ | 22:36 |
| rodrigods | from unit to fuctional | 22:36 |
| bknudson | we'd probably wind up implementing a new implementation of base.ClientTestCase | 22:36 |
| bknudson | I should add request body validation to https://review.openstack.org/#/c/313175/1/keystoneclient/tests/unit/test_access.py | 22:37 |
| patchbot | bknudson: patch 313175 - python-keystoneclient - PoC: share tests | 22:37 |
| rodrigods | bknudson, how this would work with the functional one? | 22:38 |
| bknudson | rodrigods: the functional test doesn't change: https://review.openstack.org/#/c/313175/1/keystoneclient/tests/functional/test_access.py | 22:38 |
| patchbot | bknudson: patch 313175 - python-keystoneclient - PoC: share tests | 22:38 |
| bknudson | it's the same as before. | 22:38 |
| *** aginwala has joined #openstack-keystone | 22:38 | |
| bknudson | only the unit test mocks out the server | 22:38 |
| *** ninag has quit IRC | 22:39 | |
| *** aginwala has quit IRC | 22:40 | |
| rodrigods | bknudson, got it | 22:40 |
| rodrigods | think it looks good | 22:41 |
| bknudson | the advantage is 1) we can run the unit tests more easily than functional tests, 2) no duplication of functional and unit tests | 22:41 |
| rodrigods | bknudson, sometimes we would have tests that only makes sense in one of these layers | 22:42 |
| *** aginwala has joined #openstack-keystone | 22:42 | |
| rodrigods | but... most of them seem to fit in both cases | 22:42 |
| bknudson | the functional tests should cover the entire client path from start to end. | 22:43 |
| bknudson | component-type unit tests should just test the individual component | 22:44 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: PoC: share tests https://review.openstack.org/313175 | 22:47 |
| bknudson | rodrigods: added request body validation to https://review.openstack.org/#/c/313175/2/keystoneclient/tests/unit/test_access.py | 22:47 |
| patchbot | bknudson: patch 313175 - python-keystoneclient - PoC: share tests | 22:47 |
| *** jsavak has quit IRC | 22:49 | |
| *** neophy has quit IRC | 22:50 | |
| rodrigods | bknudson, couldn't we just pass the expected body prior the call? | 22:50 |
| rodrigods | and it would fail there? | 22:50 |
| bknudson | does requests_mock support that? | 22:50 |
| rodrigods | bknudson, have no idea :) | 22:50 |
| *** david-lyle has quit IRC | 22:51 | |
| bknudson | rodrigods: I don't see in the docs you can match on the request body: http://requests-mock.readthedocs.io/en/latest/matching.html | 22:52 |
| rodrigods | bknudson, me neither, was looking there too | 22:52 |
| *** gordc has quit IRC | 22:52 | |
| bknudson | might be a little easier if it was possible. | 22:52 |
| rodrigods | yeah | 22:52 |
| rodrigods | just a register_body() | 22:53 |
| bknudson | then I could just match the response to the body | 22:53 |
| *** david-lyle has joined #openstack-keystone | 22:53 | |
| rodrigods | bknudson, have just one concern though... i don't think that functional test is a good example | 22:57 |
| *** aginwala has quit IRC | 22:57 | |
| rodrigods | ideally, we would try to use that auth_ref to perform a call | 22:57 |
| rodrigods | in the test | 22:57 |
| rodrigods | and that would not fit the "unit test" version | 22:57 |
| *** david-lyle has quit IRC | 22:58 | |
| bknudson | the unit test runs the same code as the functional test | 22:58 |
| bknudson | it just runs test_access_audit_id() | 22:58 |
| rodrigods | bknudson, i know | 22:58 |
| rodrigods | talking about the meaning of unit vs functional tests in general | 22:59 |
| bknudson | maybe you're saying the functional test is mostly useless | 22:59 |
| bknudson | there's several kinds of unit tests | 22:59 |
| bknudson | there's component tests and there's cross-layer tests and there's functional-style unit tests | 22:59 |
| *** aginwala has joined #openstack-keystone | 22:59 | |
| bknudson | they're all valid and have their uses | 23:00 |
| rodrigods | of course | 23:00 |
| rodrigods | what i mean for that specific test | 23:00 |
| *** rbridgeman_ has quit IRC | 23:00 | |
| rodrigods | is, its functional version, would not only try to get the scoped_auth_ref | 23:00 |
| rodrigods | but also would try to use it | 23:00 |
| bknudson | oh, sure, the test maybe isn't that useful | 23:00 |
| bknudson | I would like to see our functional tests cover larger scenarios... maybe call them "scenario" tests. | 23:01 |
| bknudson | that essentially follow the steps that an application would. | 23:01 |
| rodrigods | bknudson, ++ | 23:01 |
| bknudson | e.g., for federation create an idp, create a mapping, etc., all the way through getting a federated token. | 23:02 |
| rodrigods | bknudson, exactly! | 23:02 |
| rodrigods | and we can go even further | 23:02 |
| rodrigods | like using the federated token to create an instance in nova | 23:02 |
| bknudson | yes, then you're getting into tempest | 23:02 |
| rodrigods | yes | 23:03 |
| rodrigods | bknudson, that test you just described is what i'm doing in the next couple of weeks | 23:03 |
| rodrigods | without the nova part, and will submit to the keystone tree | 23:04 |
| bknudson | that'll be interesting to see. | 23:04 |
| rodrigods | bknudson, would need to wait for the federated gate, but still... | 23:05 |
| rodrigods | we could run in custom deployments | 23:05 |
| bknudson | rodrigods: that's going to be kind of tricky since it requires setting up stuff in apache, too. | 23:06 |
| bknudson | I guess the test just assumes that stuff is set up already | 23:06 |
| rodrigods | yes | 23:06 |
| *** ayoung has quit IRC | 23:07 | |
| bknudson | we're a little short on functional tests now: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/functional | 23:07 |
| rodrigods | bknudson, aren't we going to place them in keystone_tempest_plugin? | 23:08 |
| bknudson | oh, right, I forgot they're http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/functional | 23:08 |
| bknudson | oops | 23:08 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone_tempest_plugin | 23:08 |
| rodrigods | bknudson, but you are right, we are short on that | 23:08 |
| bknudson | there's already a scenario -- http://git.openstack.org/cgit/openstack/keystone/tree/keystone_tempest_plugin/tests/scenario | 23:08 |
| rodrigods | yes | 23:08 |
| bknudson | might want to start with a simple scenario where we get a token and do something and validate it | 23:09 |
| rodrigods | bknudson, that federation scenario is the reason why i started by testing the federation CRUD | 23:09 |
| bknudson | in the keystoneclient? | 23:09 |
| rodrigods | in keystone | 23:09 |
| bknudson | the scenario tests aren't going to use keystoneclient, though | 23:09 |
| rodrigods | https://review.openstack.org/#/c/302299/ | 23:09 |
| patchbot | rodrigods: patch 302299 - keystone - Add identity providers integration tests | 23:09 |
| rodrigods | and the follow up patches | 23:09 |
| bknudson | y, and I'm not sure which is the more valuable, the scenario test or tests for the individual apis. | 23:10 |
| rodrigods | my line of thinking was: test the APIs -> test a scenario that will use the APIs | 23:10 |
| *** GB21 has joined #openstack-keystone | 23:10 | |
| bknudson | since you're not going to have functional tests to cover the entire behavior of the api... we've got unit tests for that. | 23:11 |
| rodrigods | bknudson, yes, added a couple too (found some bugs) | 23:11 |
| bknudson | so I'd lean towards scenario tests being more useful | 23:11 |
| bknudson | ok, well, I guess our unit tests aren't that great either | 23:12 |
| rodrigods | bknudson, another reason to add these "simple" API tests was to have some tests running in our gate job | 23:12 |
| rodrigods | and have a "base" ready for ppl to start developing | 23:13 |
| bknudson | scenario tests don't need to be super complicated | 23:13 |
| bknudson | and having a more simple one would still be interesting | 23:13 |
| rodrigods | yeah, agree | 23:13 |
| rodrigods | bknudson, ahh... another reason | 23:15 |
| rodrigods | actually, the main reason | 23:15 |
| rodrigods | was to have the clients | 23:15 |
| rodrigods | idp_client, sp_client, mapping_client | 23:15 |
| rodrigods | in the plugin, so we could use them in the scenario :P | 23:15 |
| *** fangxu has quit IRC | 23:15 | |
| bknudson | sure. I'm not a big fan of the clients but that's the way tempest does it. | 23:16 |
| rodrigods | and... would not make sense to add the clients, without testing them a bit | 23:16 |
| rodrigods | bknudson, yeah, this makes me think of using only keystoneclient | 23:16 |
| bknudson | what the tests are doing shouldn't be complicated enough to require more classes. | 23:16 |
| bknudson | just doing request.get/post,etc., should be easy enough. | 23:17 |
| rodrigods | but we need to verify the get/posts before advancing the test | 23:18 |
| rodrigods | having them verified elsewhere makes sense to me | 23:18 |
| bknudson | if I was writing an application, I'd either do requests directly or use keystoneclient. I wouldn't write a new client. | 23:19 |
| rodrigods | bknudson, really? sometimes such wrappers can ease a lot some stuff | 23:20 |
| rodrigods | like default headers, tokens :), and so on.. | 23:20 |
| bknudson | rodrigods: I'm saying if I needed a wrapper I'd use keystoneclient. | 23:20 |
| rodrigods | ah, of course | 23:20 |
| *** stingaci has quit IRC | 23:20 | |
| bknudson | it's easy to set default headers in requests (use a session) | 23:20 |
| rodrigods | i'm not sure why tempest does not use the clients | 23:21 |
| rodrigods | since the actual consumers of the servers APIs are the clients | 23:21 |
| rodrigods | maybe to verify stuff while it is not in the client yet | 23:21 |
| *** timcline has joined #openstack-keystone | 23:22 | |
| bknudson | the servers also have to support clients other than the python API, for example I should be able to curl directly. | 23:22 |
| rodrigods | bknudson, hmm | 23:22 |
| bknudson | so I agree that tempest shouldn't rely on keystoneclient for all its testing. | 23:22 |
| rodrigods | true | 23:22 |
| bknudson | so what that boils down to is I think that the keystone functional tests should do requests directly. | 23:26 |
| *** timcline has quit IRC | 23:26 | |
| *** GB21 has quit IRC | 23:28 | |
| *** fangxu has joined #openstack-keystone | 23:29 | |
| *** krotscheck has quit IRC | 23:31 | |
| *** krotscheck has joined #openstack-keystone | 23:31 | |
| *** GB21 has joined #openstack-keystone | 23:32 | |
| *** lhcheng has quit IRC | 23:41 | |
| *** tqtran has quit IRC | 23:41 | |
| *** dmk0202 has quit IRC | 23:42 | |
| *** EinstCrazy has quit IRC | 23:48 | |
| *** roxanaghe has quit IRC | 23:51 | |
| *** ayoung has joined #openstack-keystone | 23:53 | |
| *** ChanServ sets mode: +v ayoung | 23:53 | |
| *** arunkant_ has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!