| *** dgonzalez has quit IRC | 00:08 | |
| *** dgonzalez has joined #openstack-keystone | 00:15 | |
| *** code-R has quit IRC | 00:19 | |
| *** code-R has joined #openstack-keystone | 00:27 | |
| *** iurygregory_ has joined #openstack-keystone | 00:28 | |
| *** chrisshattuck has joined #openstack-keystone | 00:57 | |
| *** jamielennox is now known as jamielennox|away | 01:09 | |
| *** jamielennox|away is now known as jamielennox | 01:43 | |
| *** EinstCrazy has joined #openstack-keystone | 01:44 | |
| *** jamielennox is now known as jamielennox|away | 01:53 | |
| *** EinstCra_ has joined #openstack-keystone | 02:01 | |
| *** EinstCrazy has quit IRC | 02:02 | |
| *** code-R_ has joined #openstack-keystone | 02:02 | |
| *** code-R has quit IRC | 02:05 | |
| *** EinstCrazy has joined #openstack-keystone | 02:06 | |
| *** EinstCra_ has quit IRC | 02:07 | |
| *** wangqun has joined #openstack-keystone | 02:11 | |
| *** GB21 has joined #openstack-keystone | 02:25 | |
| *** davechen has joined #openstack-keystone | 02:35 | |
| *** GB21 has quit IRC | 02:43 | |
| *** jamielennox|away is now known as jamielennox | 02:43 | |
| *** chrisshattuck has quit IRC | 02:56 | |
| *** chrisshattuck has joined #openstack-keystone | 03:04 | |
| *** chrisshattuck has quit IRC | 03:05 | |
| *** chrisshattuck has joined #openstack-keystone | 03:06 | |
| *** rcernin has joined #openstack-keystone | 03:09 | |
| *** chrisshattuck has quit IRC | 03:10 | |
| *** chrisshattuck has joined #openstack-keystone | 03:10 | |
| *** code-R_ has quit IRC | 03:11 | |
| *** roxanagh_ has joined #openstack-keystone | 03:11 | |
| *** code-R has joined #openstack-keystone | 03:11 | |
| *** ravelar159 has joined #openstack-keystone | 03:19 | |
| *** davechen has quit IRC | 03:49 | |
| stevemar | jamielennox: i was half way through reviewing that patch | 03:50 |
|---|---|---|
| stevemar | jamielennox: hmm | 03:50 |
| stevemar | jamielennox: OIDC isn't necessary for that bug, not under "extra" | 03:50 |
| *** iurygregory_ has quit IRC | 03:52 | |
| stevemar | jamielennox: i wouldn't mind opening a SAML specific bug about the entry point, but i guess we can keep that one open | 03:52 |
| *** chrisshattuck has quit IRC | 03:54 | |
| *** M00nr41n has joined #openstack-keystone | 03:56 | |
| *** GB21 has joined #openstack-keystone | 04:08 | |
| *** EinstCrazy has quit IRC | 04:12 | |
| *** ravelar159 has quit IRC | 04:13 | |
| *** roxanagh_ has quit IRC | 04:24 | |
| *** M00nr41n has quit IRC | 04:28 | |
| *** roxanagh_ has joined #openstack-keystone | 04:30 | |
| *** GB21 has quit IRC | 04:40 | |
| *** roxanagh_ has quit IRC | 04:40 | |
| *** roxanagh_ has joined #openstack-keystone | 04:43 | |
| *** ravelar159 has joined #openstack-keystone | 04:45 | |
| *** roxanagh_ has quit IRC | 04:47 | |
| *** ravelar159 has quit IRC | 04:49 | |
| jamielennox | gah, stupid dogpile value crap | 04:49 |
| *** GB21 has joined #openstack-keystone | 04:58 | |
| stevemar | jamielennox: http://i.imgur.com/8iVy7t6.jpg | 05:00 |
| *** sheel has joined #openstack-keystone | 05:07 | |
| jamielennox | lol | 05:07 |
| jamielennox | kind of a pile | 05:07 |
| *** bj0rnar- has quit IRC | 05:08 | |
| jamielennox | just spent most of the day on a auth_token oslo.cache conversion to realize that dogpile writes its own metadata to the value and so new values aren't compatible with old values | 05:08 |
| jamielennox | everytime i try this it doesn't work right | 05:08 |
| jamielennox | stevemar: would people accept a cache flush on auth_token update? | 05:09 |
| *** bj0rnar has joined #openstack-keystone | 05:10 | |
| stevemar | jamielennox: what do you mean by `on auth_token update`? | 05:12 |
| jamielennox | stevemar: so dogpile.cache writes its own format to the cache, so if i go via it then all old cache values are dead | 05:14 |
| jamielennox | stevemar: i'm pretty sure i can maintain config compatibility | 05:15 |
| jamielennox | stevemar: but when you update keystonemiddleware all the existing values in cache would get ignored | 05:15 |
| jamielennox | i'm guessing it's not worth it - but it's annoying as i thought i had this solved | 05:15 |
| jamielennox | damn, back later | 05:16 |
| stevemar | jamielennox: oh, you mean when they upgrade to a version of ksm that includes some change | 05:18 |
| stevemar | jamielennox: i think that (a cache flush) would be OK... | 05:18 |
| stevemar | you're upgrading the whole cloud, it'll take a while | 05:19 |
| *** code-R has quit IRC | 05:23 | |
| *** M00nr41n has joined #openstack-keystone | 05:24 | |
| stevemar | sleep time | 05:28 |
| openstackgerrit | Merged openstack/keystone: Refactoring: remove the duplicate method https://review.openstack.org/336963 | 05:37 |
| *** code-R has joined #openstack-keystone | 05:39 | |
| *** ravelar159 has joined #openstack-keystone | 05:39 | |
| *** itisha has quit IRC | 05:40 | |
| *** roxanagh_ has joined #openstack-keystone | 05:44 | |
| *** ravelar159 has quit IRC | 05:45 | |
| *** itisha has joined #openstack-keystone | 05:47 | |
| *** roxanagh_ has quit IRC | 05:48 | |
| *** ravelar159 has joined #openstack-keystone | 05:52 | |
| openstackgerrit | yuyafei proposed openstack/python-keystoneclient: Add __ne__ built-in function https://review.openstack.org/337435 | 05:53 |
| *** davechen has joined #openstack-keystone | 05:54 | |
| *** maestropandy has joined #openstack-keystone | 05:54 | |
| *** tonytan4ever has quit IRC | 05:55 | |
| *** code-R_ has joined #openstack-keystone | 05:56 | |
| *** code-R has quit IRC | 05:59 | |
| *** rcernin has quit IRC | 06:01 | |
| *** EinstCrazy has joined #openstack-keystone | 06:04 | |
| *** ravelar159 has quit IRC | 06:14 | |
| *** GB21 has quit IRC | 06:15 | |
| *** code-R_ has quit IRC | 06:19 | |
| *** code-R has joined #openstack-keystone | 06:20 | |
| *** maestropandy has quit IRC | 06:24 | |
| *** hogepodge has quit IRC | 06:25 | |
| *** hogepodge has joined #openstack-keystone | 06:27 | |
| *** maestropandy has joined #openstack-keystone | 06:28 | |
| *** ravelar159 has joined #openstack-keystone | 06:30 | |
| *** rcernin has joined #openstack-keystone | 06:32 | |
| *** roxanagh_ has joined #openstack-keystone | 06:44 | |
| *** pcaruana has joined #openstack-keystone | 06:46 | |
| *** roxanagh_ has quit IRC | 06:49 | |
| *** ravelar159 has quit IRC | 06:52 | |
| openstackgerrit | zhufl proposed openstack/keystone: Remove unused LOG https://review.openstack.org/337466 | 06:53 |
| *** tonytan4ever has joined #openstack-keystone | 06:55 | |
| *** ravelar159 has joined #openstack-keystone | 07:00 | |
| *** tonytan4ever has quit IRC | 07:00 | |
| *** ravelar159 has quit IRC | 07:05 | |
| *** tesseract- has joined #openstack-keystone | 07:09 | |
| *** danpawlik has joined #openstack-keystone | 07:12 | |
| *** jpena|off is now known as jpena | 07:15 | |
| *** kevinbenton has quit IRC | 07:17 | |
| *** clenimar has quit IRC | 07:19 | |
| *** clenimar has joined #openstack-keystone | 07:20 | |
| *** kevinbenton has joined #openstack-keystone | 07:20 | |
| *** dancn` is now known as dancn | 07:23 | |
| *** dancn has quit IRC | 07:24 | |
| *** dancn has joined #openstack-keystone | 07:24 | |
| openstackgerrit | yuyafei proposed openstack/python-keystoneclient: Remove white space between print and () https://review.openstack.org/337494 | 07:24 |
| openstackgerrit | Atsushi SAKAI proposed openstack/keystone: [doc/api]Remove space within word https://review.openstack.org/337509 | 07:39 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: WIP - oidc: fix OpenID Connect authorization code grant_type https://review.openstack.org/330006 | 07:47 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: move the get_unscoped_auth_ref into the base class https://review.openstack.org/337140 | 07:47 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: add discovery document support https://review.openstack.org/330464 | 07:47 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: deprecate grant_type argument https://review.openstack.org/330465 | 07:47 |
| openstackgerrit | Merged openstack/keystone: Handle catalog backends that don't support all functions. https://review.openstack.org/336400 | 07:49 |
| *** chlong has quit IRC | 07:52 | |
| *** EinstCrazy has quit IRC | 07:53 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: WIP - oidc: fix OpenID Connect authorization code grant_type https://review.openstack.org/330006 | 07:53 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: move the get_unscoped_auth_ref into the base class https://review.openstack.org/337140 | 07:53 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: add discovery document support https://review.openstack.org/330464 | 07:53 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: deprecate grant_type argument https://review.openstack.org/330465 | 07:53 |
| *** ravelar159 has joined #openstack-keystone | 07:54 | |
| *** EinstCrazy has joined #openstack-keystone | 07:56 | |
| *** ravelar159 has quit IRC | 07:59 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** tonytan4ever has joined #openstack-keystone | 08:03 | |
| *** chlong has joined #openstack-keystone | 08:04 | |
| *** tonytan4ever has quit IRC | 08:08 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: move the get_unscoped_auth_ref into the base class https://review.openstack.org/337140 | 08:11 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: deprecate grant_type argument https://review.openstack.org/330465 | 08:11 |
| *** davechen has left #openstack-keystone | 08:15 | |
| *** pnavarro has joined #openstack-keystone | 08:22 | |
| *** wanghua has quit IRC | 08:25 | |
| *** rvba has joined #openstack-keystone | 08:27 | |
| *** rvba has quit IRC | 08:27 | |
| *** rvba has joined #openstack-keystone | 08:27 | |
| *** roxanagh_ has joined #openstack-keystone | 08:33 | |
| *** roxanagh_ has quit IRC | 08:37 | |
| *** yolanda has quit IRC | 08:41 | |
| *** yolanda has joined #openstack-keystone | 08:42 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove headers from context https://review.openstack.org/337016 | 08:44 |
| *** ravelar159 has joined #openstack-keystone | 08:48 | |
| *** code-R has quit IRC | 08:49 | |
| *** ravelar159 has quit IRC | 08:54 | |
| *** GB21 has joined #openstack-keystone | 08:54 | |
| *** nisha has joined #openstack-keystone | 08:57 | |
| *** EinstCrazy has quit IRC | 09:03 | |
| *** EinstCrazy has joined #openstack-keystone | 09:03 | |
| *** bjornar_ has joined #openstack-keystone | 09:09 | |
| *** EinstCra_ has joined #openstack-keystone | 09:20 | |
| *** yolanda has quit IRC | 09:21 | |
| *** yolanda has joined #openstack-keystone | 09:22 | |
| *** EinstCrazy has quit IRC | 09:23 | |
| *** maestropandy has quit IRC | 09:23 | |
| *** maestropandy has joined #openstack-keystone | 09:31 | |
| *** nisha has quit IRC | 09:35 | |
| *** nisha has joined #openstack-keystone | 09:36 | |
| *** ravelar159 has joined #openstack-keystone | 09:43 | |
| *** yolanda has quit IRC | 09:43 | |
| *** yolanda has joined #openstack-keystone | 09:45 | |
| *** ravelar159 has quit IRC | 09:47 | |
| *** EinstCrazy has joined #openstack-keystone | 10:02 | |
| *** wangqun has quit IRC | 10:03 | |
| *** EinstCra_ has quit IRC | 10:04 | |
| *** henrynash has quit IRC | 10:06 | |
| *** roxanagh_ has joined #openstack-keystone | 10:21 | |
| *** samueldmq has joined #openstack-keystone | 10:23 | |
| *** ChanServ sets mode: +v samueldmq | 10:23 | |
| samueldmq | morning keystone | 10:23 |
| samueldmq | morning keystone | 10:23 |
| *** roxanagh_ has quit IRC | 10:25 | |
| *** ntpttr has quit IRC | 10:30 | |
| *** ntpttr has joined #openstack-keystone | 10:31 | |
| *** EinstCrazy has quit IRC | 10:33 | |
| *** ravelar159 has joined #openstack-keystone | 10:36 | |
| *** maestropandy has quit IRC | 10:36 | |
| *** dims has joined #openstack-keystone | 10:38 | |
| *** ravelar159 has quit IRC | 10:41 | |
| *** henrynash has joined #openstack-keystone | 10:42 | |
| *** ChanServ sets mode: +v henrynash | 10:42 | |
| *** itisha has quit IRC | 10:50 | |
| *** rodrigods has quit IRC | 10:51 | |
| *** rodrigods has joined #openstack-keystone | 10:51 | |
| *** yolanda has quit IRC | 10:52 | |
| *** itisha has joined #openstack-keystone | 10:52 | |
| *** yolanda has joined #openstack-keystone | 10:56 | |
| *** GB21 has quit IRC | 11:12 | |
| *** henrynash has quit IRC | 11:29 | |
| *** ravelar159 has joined #openstack-keystone | 11:30 | |
| *** GB21 has joined #openstack-keystone | 11:32 | |
| *** jed56 has joined #openstack-keystone | 11:33 | |
| *** ravelar159 has quit IRC | 11:35 | |
| *** yolanda has quit IRC | 11:35 | |
| *** nisha_ has joined #openstack-keystone | 11:38 | |
| *** henrynash has joined #openstack-keystone | 11:40 | |
| *** ChanServ sets mode: +v henrynash | 11:40 | |
| *** nisha has quit IRC | 11:40 | |
| *** gordc has joined #openstack-keystone | 11:44 | |
| *** henrynash has quit IRC | 11:44 | |
| samueldmq | stevemar: all reviewed and on the gates | 11:47 |
| nisha_ | hi stevemar | 11:48 |
| nisha_ | samueldmq, am here | 11:49 |
| openstackgerrit | Shoham Peller proposed openstack/keystone: Fixed the query params in role_assignments https://review.openstack.org/337632 | 11:54 |
| *** nisha_ has quit IRC | 11:57 | |
| *** nisha_ has joined #openstack-keystone | 11:57 | |
| dstanek | samueldmq: good morning | 12:00 |
| samueldmq | dstanek: morning | 12:00 |
| *** tonytan4ever has joined #openstack-keystone | 12:04 | |
| *** raildo-afk is now known as raildo | 12:07 | |
| *** maestropandy has joined #openstack-keystone | 12:08 | |
| openstackgerrit | Puneet Arora proposed openstack/keystone: Fixed a Typo https://review.openstack.org/337636 | 12:08 |
| *** roxanagh_ has joined #openstack-keystone | 12:09 | |
| *** tonytan4ever has quit IRC | 12:09 | |
| *** yolanda has joined #openstack-keystone | 12:11 | |
| *** chlong has quit IRC | 12:12 | |
| *** roxanagh_ has quit IRC | 12:13 | |
| openstackgerrit | yuyafei proposed openstack/python-keystoneclient: Remove print in tests.functional.v3.test_implied_roles https://review.openstack.org/337494 | 12:15 |
| *** henrynash has joined #openstack-keystone | 12:18 | |
| *** ChanServ sets mode: +v henrynash | 12:18 | |
| *** openstackgerrit has quit IRC | 12:19 | |
| *** openstackgerrit has joined #openstack-keystone | 12:19 | |
| openstackgerrit | Shoham Peller proposed openstack/keystone: Fixed the query params in role_assignments https://review.openstack.org/337632 | 12:19 |
| *** jpena is now known as jpena|lunch | 12:21 | |
| *** henrynash has quit IRC | 12:22 | |
| *** ravelar159 has joined #openstack-keystone | 12:25 | |
| *** ravelar159 has quit IRC | 12:29 | |
| *** lamt has joined #openstack-keystone | 12:33 | |
| *** chlong has joined #openstack-keystone | 12:43 | |
| *** pauloewerton has joined #openstack-keystone | 12:48 | |
| *** henrynash has joined #openstack-keystone | 12:49 | |
| *** ChanServ sets mode: +v henrynash | 12:49 | |
| *** TxGVNN has joined #openstack-keystone | 12:49 | |
| *** henrynash has quit IRC | 12:55 | |
| *** jed56 has quit IRC | 12:55 | |
| *** mdavidson has quit IRC | 12:55 | |
| *** jed56 has joined #openstack-keystone | 12:57 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Docs: Fix the query params in role_assignments example https://review.openstack.org/337632 | 12:59 |
| *** GB21 has quit IRC | 13:02 | |
| *** samueldmq has quit IRC | 13:04 | |
| *** julim has joined #openstack-keystone | 13:05 | |
| *** yolanda has quit IRC | 13:05 | |
| *** tonytan4ever has joined #openstack-keystone | 13:05 | |
| *** yolanda has joined #openstack-keystone | 13:07 | |
| *** samueldmq has joined #openstack-keystone | 13:09 | |
| *** ChanServ sets mode: +v samueldmq | 13:09 | |
| *** tonytan4ever has quit IRC | 13:10 | |
| *** ravelar159 has joined #openstack-keystone | 13:19 | |
| *** henrynash has joined #openstack-keystone | 13:19 | |
| *** ChanServ sets mode: +v henrynash | 13:19 | |
| *** ravelar159 has quit IRC | 13:23 | |
| *** sheel has quit IRC | 13:25 | |
| *** code-R has joined #openstack-keystone | 13:30 | |
| stevemar | morning samueldmq | 13:30 |
| *** jpena|lunch is now known as jpena | 13:34 | |
| *** raildo has quit IRC | 13:34 | |
| *** code-R_ has joined #openstack-keystone | 13:34 | |
| *** raildo-afk has joined #openstack-keystone | 13:35 | |
| *** nisha_ has quit IRC | 13:35 | |
| *** raildo-afk is now known as raildo | 13:36 | |
| *** nisha_ has joined #openstack-keystone | 13:36 | |
| *** code-R has quit IRC | 13:37 | |
| *** links has joined #openstack-keystone | 13:38 | |
| *** pnavarro has quit IRC | 13:39 | |
| *** ravelar159 has joined #openstack-keystone | 13:42 | |
| *** ayoung has joined #openstack-keystone | 13:43 | |
| *** ChanServ sets mode: +v ayoung | 13:43 | |
| *** links has quit IRC | 13:45 | |
| *** jsavak has joined #openstack-keystone | 13:47 | |
| *** code-R has joined #openstack-keystone | 13:47 | |
| openstackgerrit | Merged openstack/keystone: generate separate index files for each api-ref https://review.openstack.org/337363 | 13:48 |
| *** itisha has quit IRC | 13:50 | |
| *** code-R_ has quit IRC | 13:51 | |
| openstackgerrit | Merged openstack/keystone: move OAUTH1 API to extensions https://review.openstack.org/337373 | 13:53 |
| openstackgerrit | Merged openstack/keystone: Add missing preamble for v3 and v3-ext https://review.openstack.org/337375 | 13:54 |
| *** spzala has joined #openstack-keystone | 13:54 | |
| *** links has joined #openstack-keystone | 13:56 | |
| *** code-R_ has joined #openstack-keystone | 13:56 | |
| *** tonytan4ever has joined #openstack-keystone | 13:56 | |
| *** roxanagh_ has joined #openstack-keystone | 13:57 | |
| *** henrynash has quit IRC | 13:58 | |
| *** links has quit IRC | 13:59 | |
| *** code-R has quit IRC | 13:59 | |
| *** roxanagh_ has quit IRC | 14:01 | |
| samueldmq | stevemar: o/ | 14:01 |
| samueldmq | aloga: I assume this is not WIP anymore ? 330006 | 14:02 |
| samueldmq | patch 330006 | 14:02 |
| patchbot | samueldmq: https://review.openstack.org/#/c/330006/ - keystoneauth - WIP - oidc: fix OpenID Connect authorization code ... | 14:02 |
| *** ravelar159 has quit IRC | 14:02 | |
| *** woodster_ has joined #openstack-keystone | 14:05 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Add migration-complete step to keystone-manage https://review.openstack.org/337680 | 14:06 |
| samueldmq | ayoung: notmorgan: hey, last time I remember I got fernet working in the gate was with that patch for linear search in revoke BUT without the cache | 14:06 |
| samueldmq | ayoung: notmorgan: I am running a recheck in https://review.openstack.org/#/c/319497/ and expecting it to still fail | 14:07 |
| patchbot | samueldmq: patch 319497 - keystone - DO NOT MERGE: Test fix for fernet race condition | 14:07 |
| ayoung | yep | 14:07 |
| samueldmq | how should we proceed with that ? | 14:07 |
| samueldmq | ayoung: hey | 14:07 |
| *** jsavak has quit IRC | 14:07 | |
| samueldmq | ayoung: so.. it doesn't seem to work with that cache ... and we want fernet back as the default in devstackk :( | 14:07 |
| ayoung | kill the cache | 14:08 |
| ayoung | helll, just Kill Keystone | 14:08 |
| raildo | ayoung, \m/ | 14:08 |
| dstanek | samueldmq: what's the issue? | 14:08 |
| samueldmq | dstanek: remember we had fernet as default token provider in devstack | 14:09 |
| samueldmq | dstanek: then the gates started failing intermittently | 14:09 |
| dstanek | it was a cache issue? | 14:10 |
| samueldmq | dstanek: I am getting you links ... but gerrit seems to be super slow | 14:10 |
| samueldmq | dstanek: ayoung proposed this https://review.openstack.org/#/c/311652/ | 14:11 |
| patchbot | samueldmq: patch 311652 - keystone - Replace revoke tree with linear search (MERGED) | 14:11 |
| samueldmq | dstanek: which had caching disabled in a given version, then my test (patch 319497) passed in all the gates | 14:11 |
| patchbot | samueldmq: https://review.openstack.org/#/c/319497/ - keystone - DO NOT MERGE: Test fix for fernet race condition | 14:11 |
| samueldmq | so I think the issue is fernet + that cache | 14:11 |
| ayoung | if you revoke something, you need to make sure the cache is invalidated, or you don't end up actually revoking | 14:12 |
| *** code-R has joined #openstack-keystone | 14:13 | |
| ayoung | and the cache invalidation probably needs to complete before the return from the revoke call, or you will have a race condition | 14:13 |
| dstanek | ayoung: ++ revoke *needs* to remove the token from cache | 14:14 |
| *** permalac has quit IRC | 14:14 | |
| ayoung | I'm coming around to notmorgan 's way of thinking that a revoke check should be a sql query | 14:14 |
| ayoung | dstanek, not sure it is the token cache that is the problem. it is the revoke event cache that needs to be invalidated, | 14:15 |
| *** nisha_ has quit IRC | 14:15 | |
| *** code-R_ has quit IRC | 14:15 | |
| *** nisha has joined #openstack-keystone | 14:15 | |
| samueldmq | ayoung: is there a possibility that reqA (invalidate token) and reqB (try something with that token) arrives at almost the same time | 14:15 |
| samueldmq | but reqA returns later than reqB ? | 14:15 |
| ayoung | samueldmq, not from a meaningful test | 14:16 |
| stevemar | samueldmq: nisha can you start referencing this bug in the commit message that fixes the docstrings in keystoneclient? https://bugs.launchpad.net/python-keystoneclient/+bug/1330769 | 14:16 |
| openstack | Launchpad bug 1330769 in python-keystoneclient "docstrings are inadequate" [Wishlist,In progress] - Assigned to Brant Knudson (blk-u) | 14:16 |
| ayoung | samueldmq, the test itself is a single thread | 14:16 |
| ayoung | even if the requests are handled by separate threads in Keystone, they should still be serialized by the test | 14:17 |
| samueldmq | ayoung: ah you're correct | 14:17 |
| ayoung | what is failing? | 14:18 |
| samueldmq | ayoung: in the test ? | 14:18 |
| ayoung | samueldmq, in the gate | 14:18 |
| samueldmq | ayoung: a revoked token is still valid after DELETE /tokens | 14:18 |
| samueldmq | well, a token that is supposed to be revoked... | 14:19 |
| samueldmq | ayoung: e.g http://logs.openstack.org/97/319497/1/check/gate-tempest-dsvm-full/25b34ec/console.html.gz#_2016-05-25_13_02_33_255 | 14:20 |
| *** dmellado has quit IRC | 14:21 | |
| samueldmq | ayoung: and see the test https://github.com/openstack/tempest/blob/ebcc070dc5e23a649a2c5875b1917f8bf8809ef4/tempest/api/identity/admin/v2/test_users_negative.py#L83-L99 | 14:21 |
| *** dmellado has joined #openstack-keystone | 14:21 | |
| ayoung | how come that does not show up in http://git.openstack.org/cgit/openstack/tempest/tree/tempest/api/identity/v2 | 14:22 |
| dstanek | samueldmq: this traceback is a little scary. i didn't read the test itself, but i'm assuming they tried to create a user and didn't specify a token; http://logs.openstack.org/97/319497/1/check/gate-tempest-dsvm-full/25b34ec/console.html.gz#_2016-05-25_13_02_33_256 | 14:22 |
| ayoung | v2.test_users_negative | 14:22 |
| ayoung | is this a branch? An old branch? | 14:22 |
| ayoung | admin...missed that | 14:23 |
| samueldmq | dstanek: yes, see https://github.com/openstack/tempest/blob/ebcc070dc5e23a649a2c5875b1917f8bf8809ef4/tempest/api/identity/admin/v2/test_users_negative.py#L83-L99 | 14:23 |
| samueldmq | dstanek: it actually tries an invalid token (revoked) | 14:23 |
| ayoung | http://git.openstack.org/cgit/openstack/tempest/tree/tempest/api/identity/admin/v2/test_users_negative.py#n85 | 14:23 |
| dstanek | ok, so bad test name :-( | 14:23 |
| samueldmq | dstanek: ++ | 14:24 |
| *** sheel has joined #openstack-keystone | 14:24 | |
| samueldmq | ayoung: yes that's a better link :) | 14:24 |
| ayoung | OK, that is not "without a token" but rather with "recently revoked v2 token" | 14:24 |
| samueldmq | ayoung: the same actually, nvm | 14:24 |
| samueldmq | ayoung: exactly, which happens to still be valid | 14:24 |
| ayoung | samueldmq, there was a race condition in posting the link | 14:25 |
| samueldmq | hehe | 14:25 |
| ayoung | ok, so that hits... | 14:25 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/routers.py#n41 | 14:26 |
| ayoung | right? | 14:26 |
| ayoung | V2 delete? | 14:26 |
| samueldmq | yes | 14:26 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/controllers.py#n457 | 14:26 |
| *** richm has joined #openstack-keystone | 14:26 | |
| ayoung | no cache yet... | 14:26 |
| samueldmq | ayoung: then http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/controllers.py#n452 | 14:27 |
| ayoung | pretty sure we can remove termie's comment | 14:27 |
| ayoung | this stuff is not moving to middleware | 14:27 |
| ayoung | self.token_provider_api.revoke_token(token_id) | 14:28 |
| samueldmq | ayoung: yes, this http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/provider.py#n439 | 14:28 |
| ayoung | samueldmq, so is this running with fernet that fails? | 14:29 |
| samueldmq | ayoung: yes | 14:29 |
| *** darosale has joined #openstack-keystone | 14:29 | |
| ayoung | so should be the call to | 14:29 |
| ayoung | self.revoke_api.revoke_by_audit_id(token_ref.audit_id) | 14:29 |
| ayoung | that actually hs some effect | 14:29 |
| *** dmellado has quit IRC | 14:29 | |
| dstanek | samueldmq: ayoung: just trying to catch up and look at the code at the same time. if we delete a token i don't see how it gets out of the cache that validate uses | 14:30 |
| *** dmellado has joined #openstack-keystone | 14:30 | |
| ayoung | dstanek, neither do I | 14:30 |
| ayoung | dstanek, that is what I am just realizing | 14:30 |
| dstanek | ayoung: so i was right earlier! | 14:31 |
| samueldmq | dstanek: ayoung: validate_non_persistent_token ? | 14:31 |
| samueldmq | or maybe even _validate_token | 14:31 |
| dstanek | if we have the token id we just need to remove if from the cache of those 3 methods | 14:31 |
| *** spzala has quit IRC | 14:31 | |
| ayoung | dstanek, I'm also realizing I don't like a lot of the checks we make that, if triggered, would result in us not recording the revoke event | 14:31 |
| *** spzala has joined #openstack-keystone | 14:32 | |
| samueldmq | but if that's it, why does it only fail with fernet ? | 14:32 |
| ayoung | samueldmq, fernet is the "non persisted" option | 14:33 |
| openstackgerrit | Merged openstack/python-keystoneclient: Remove print in tests.functional.v3.test_implied_roles https://review.openstack.org/337494 | 14:33 |
| dstanek | samueldmq: there are three validate methods using the MEMOIZE decorator in there. probably have the clear them all | 14:33 |
| *** pnavarro has joined #openstack-keystone | 14:33 | |
| samueldmq | oh wait, validate_v2_token calls validate_non_persistent_token directly | 14:33 |
| *** sigmavirus_away is now known as sigmavirus | 14:33 | |
| *** sigmavirus is now known as bops | 14:33 | |
| ayoung | otherwise we end up editing the token record and that gets updating in the cache | 14:34 |
| *** darosale has quit IRC | 14:34 | |
| *** bops is now known as sigmavirus | 14:34 | |
| samueldmq | same for v3 ... yes, that seems to be the cache of validate_non_persistent_token ? | 14:34 |
| breton | lots of bug mail from Steve | 14:35 |
| dstanek | breton: he's like a nagging wife sometimes :-) | 14:35 |
| openstackgerrit | Merged openstack/keystone: [doc/api]Remove space within word https://review.openstack.org/337509 | 14:36 |
| *** spzala has quit IRC | 14:36 | |
| samueldmq | dstanek: ayoung: see http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/provider.py#n421 | 14:37 |
| samueldmq | # This method isn't actually called in the case of non-persistent | 14:37 |
| samueldmq | # tokens, but we include the invalidation in case this ever changes | 14:37 |
| samueldmq | # in the future. | 14:37 |
| ayoung | samueldmq, right | 14:37 |
| samueldmq | ayoung: dstanek: that's why I had this https://review.openstack.org/#/c/316991/ | 14:37 |
| patchbot | samueldmq: patch 316991 - keystone - Invalidate token cache after token delete | 14:37 |
| samueldmq | to make cache invalidation happen for fernet too | 14:37 |
| ayoung | I think a call to that line needs to be at the bottom of | 14:37 |
| ayoung | delete_tokens | 14:38 |
| *** tonytan4ever has quit IRC | 14:39 | |
| dstanek | samueldmq: what calls that? | 14:39 |
| samueldmq | ayoung: that's basically what I am doing in that patch, placing the invalidate call at revoke_token | 14:39 |
| dstanek | ayoung: ++ | 14:39 |
| *** tonytan4ever has joined #openstack-keystone | 14:39 | |
| samueldmq | dstanek: previously it was just the persistence layer | 14:39 |
| ayoung | so why is that one failing? | 14:40 |
| samueldmq | in that patch I want the token provider to call it after a token revoke | 14:40 |
| samueldmq | so it's executed regardless token type (persistent or not) | 14:40 |
| ayoung | keystone.tests.unit.test_backend_sql.SqlTokenCacheInvalidation.test_delete_unscoped_token | 14:40 |
| ayoung | keystone.tests.unit.test_backend_sql.SqlTokenCacheInvalidation.test_delete_scoped_token_by_user_and_tenant | 14:40 |
| samueldmq | ayoung: I haven't taken a deeper look (at least not recently) | 14:41 |
| ayoung | keystone.tests.unit.test_backend_sql.SqlTokenCacheInvalidation.test_delete_scoped_token_by_user | 14:41 |
| ayoung | keystone.tests.unit.test_backend_sql.SqlTokenCacheInvalidation.test_delete_scoped_token_by_id | 14:41 |
| samueldmq | ayoung: but it looks like tests were calling the persistence layer and expecting the cache to be revoked ? | 14:41 |
| ayoung | 'm seeing a pattern | 14:41 |
| dstanek | samueldmq: if our persistence layer is clearing the cache then we are just doing it wrong | 14:41 |
| dstanek | that is super sad actually :-( | 14:41 |
| *** nisha has quit IRC | 14:42 | |
| samueldmq | dstanek: yes, that's happening... which means fernet don't invalidate validate cache at all :( | 14:42 |
| samueldmq | I can't remember why I thought that wasn't the main issue anymore at the time | 14:43 |
| *** ddieterly has joined #openstack-keystone | 14:43 | |
| samueldmq | let's see if 319497 breaks; then I can rebase it on 316991 and see what happens | 14:43 |
| *** itisha has joined #openstack-keystone | 14:43 | |
| *** haneef has quit IRC | 14:43 | |
| ayoung | 2a7db0e3 (Samuel de Medeiros Queiroz 2016-03-04 14:16:31 -0300 534) def test_delete_scoped_token_by_id(self): | 14:44 |
| ayoung | but that looks like it was a refactoring | 14:44 |
| ayoung | henrynash_ did it | 14:46 |
| ayoung | nope it was notmorgan ! | 14:46 |
| ayoung | I take that back. It was henrynash_ | 14:47 |
| ayoung | git show 07a080d3 | 14:47 |
| *** raildo is now known as raildo-afk | 14:47 | |
| *** raildo-afk is now known as raildo | 14:47 | |
| samueldmq | ayoung: yes, it's bypassing the provider by calling self.token_provider_api._persistence.delete_tokens | 14:49 |
| samueldmq | ayoung: I just need to fix the tests to call the token_provider itself | 14:50 |
| samueldmq | ayoung: dstanek: I remember someone told me that it doesn't matter at the end because the revocation events should revoke the token | 14:51 |
| samueldmq | even if validate_token returned success | 14:51 |
| samueldmq | question is whether revoke logic has always been broken, and properly invalidating the cache was doing the work :-) | 14:52 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Invalidate token cache after token delete https://review.openstack.org/316991 | 14:56 |
| samueldmq | ayoung: or simply call it too in the provider ^ | 14:56 |
| samueldmq | let's see how that goes | 14:56 |
| samueldmq | brb | 14:56 |
| samueldmq | dstanek: ^ you too :) | 14:56 |
| *** code-R has quit IRC | 14:58 | |
| *** timcline has joined #openstack-keystone | 14:59 | |
| *** spzala has joined #openstack-keystone | 15:00 | |
| *** code-R has joined #openstack-keystone | 15:01 | |
| *** KevinE has joined #openstack-keystone | 15:01 | |
| *** KevinE_ has joined #openstack-keystone | 15:02 | |
| *** phalmos has joined #openstack-keystone | 15:03 | |
| *** ddieterly is now known as ddieterly[away] | 15:05 | |
| *** KevinE has quit IRC | 15:05 | |
| *** chrisshattuck has joined #openstack-keystone | 15:06 | |
| *** code-R has quit IRC | 15:06 | |
| *** diazjf has joined #openstack-keystone | 15:06 | |
| *** danpawlik has quit IRC | 15:07 | |
| breton | oh how i love cache issues | 15:10 |
| breton | fixed a cache issue and found 3 in tests | 15:11 |
| *** roxanagh_ has joined #openstack-keystone | 15:11 | |
| *** BjoernT has joined #openstack-keystone | 15:13 | |
| *** roxanagh_ has quit IRC | 15:16 | |
| openstackgerrit | Merged openstack/keystone: Fixed a Typo https://review.openstack.org/337636 | 15:24 |
| openstackgerrit | Merged openstack/keystone: Remove unused LOG https://review.openstack.org/337466 | 15:25 |
| openstackgerrit | Merged openstack/keystone: Docs: Fix the query params in role_assignments example https://review.openstack.org/337632 | 15:26 |
| *** yolanda has quit IRC | 15:28 | |
| *** yolanda has joined #openstack-keystone | 15:30 | |
| *** openstackgerrit has quit IRC | 15:33 | |
| *** openstackgerrit has joined #openstack-keystone | 15:33 | |
| *** jed56 has quit IRC | 15:35 | |
| *** ddieterly[away] is now known as ddieterly | 15:36 | |
| *** code-R has joined #openstack-keystone | 15:37 | |
| *** haneef_ has quit IRC | 15:37 | |
| *** maestropandy has quit IRC | 15:38 | |
| *** harlowja has joined #openstack-keystone | 15:40 | |
| *** code-R_ has joined #openstack-keystone | 15:42 | |
| *** code-R has quit IRC | 15:45 | |
| *** gyee has joined #openstack-keystone | 15:45 | |
| *** ChanServ sets mode: +v gyee | 15:45 | |
| *** TxGVNN has quit IRC | 15:48 | |
| *** fangxu has quit IRC | 15:53 | |
| *** yolanda has quit IRC | 15:55 | |
| *** yolanda has joined #openstack-keystone | 15:56 | |
| *** spzala has quit IRC | 16:01 | |
| *** sdake has joined #openstack-keystone | 16:06 | |
| *** spzala has joined #openstack-keystone | 16:07 | |
| *** henrynash has joined #openstack-keystone | 16:08 | |
| *** ChanServ sets mode: +v henrynash | 16:08 | |
| henrynash_ | ayoung: what did I break? | 16:08 |
| ayoung | henrynash_, just common sense | 16:08 |
| ayoung | henrynash_, heh...the issue is that the tests for revocation | 16:09 |
| *** spzala has quit IRC | 16:09 | |
| ayoung | hitting the sql backend was then checking for revocations | 16:09 |
| *** spzala has joined #openstack-keystone | 16:09 | |
| ayoung | which does not make sense in a non-persisted-token-world | 16:09 |
| henrynash_ | ayoung: hmm, oops | 16:09 |
| ayoung | henrynash_, samueldmq is working on getting a round that. Be willing to provide feedback on the reviews where we might have to yank the tests, | 16:10 |
| ayoung | surpirsed it took this long to trip over those assumptions | 16:11 |
| *** sdake has quit IRC | 16:11 | |
| henrynash_ | ok | 16:11 |
| *** roxanagh_ has joined #openstack-keystone | 16:12 | |
| henrynash_ | so I have a dumb question (which I should know the answer to, but clearly do not): if you upgrade keystone (say LIberty to Mitaka), does it automatically run (the equivilent of) a db_sync to migrate the DB or is that always a manual step (as an aside, can’t find any documentation on upgarding keystone in our docs)… | 16:12 |
| *** adu has joined #openstack-keystone | 16:14 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: DO NOT MERGE: Test fix for fernet race condition https://review.openstack.org/319497 | 16:16 |
| *** roxanagh_ has quit IRC | 16:16 | |
| ayoung | henrynash_, no automatice | 16:16 |
| ayoung | s | 16:16 |
| samueldmq | ayoung: dstanek: henrynash: ^added depends-on the patch that does explicit revocation for fernet ^ | 16:17 |
| ayoung | no automatic migration. You need to explicitly run it, and therein lies a problem | 16:17 |
| samueldmq | let's hear what jenkins sats | 16:17 |
| samueldmq | says | 16:17 |
| henrynash_ | ayoung: ah, ok….that explains why I can’t fdin any code that does that! | 16:17 |
| ayoung | samueldmq, there is no code in that commit | 16:17 |
| ayoung | just docs | 16:17 |
| samueldmq | that's just to test the gate | 16:17 |
| samueldmq | ayoung: it depends on a devstack change that enables fernet, and on my cache change | 16:18 |
| samueldmq | ayoung: it doesn't matter what that patch actually does, just want to run the gates | 16:18 |
| *** nisha has joined #openstack-keystone | 16:21 | |
| *** bjornar_ has quit IRC | 16:22 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Add migration-complete step to keystone-manage https://review.openstack.org/337680 | 16:24 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Add migration-complete step to keystone-manage https://review.openstack.org/337680 | 16:24 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Fix cache invalidation https://review.openstack.org/327885 | 16:26 |
| *** code-R_ has quit IRC | 16:27 | |
| *** code-R has joined #openstack-keystone | 16:27 | |
| *** yolanda has quit IRC | 16:28 | |
| *** spzala has quit IRC | 16:30 | |
| *** yolanda has joined #openstack-keystone | 16:31 | |
| *** rcernin has quit IRC | 16:31 | |
| *** spzala has joined #openstack-keystone | 16:33 | |
| *** tesseract- has quit IRC | 16:33 | |
| *** pcaruana has quit IRC | 16:33 | |
| *** hogepodge has quit IRC | 16:34 | |
| breton | how do we set id for @decorators.idempotent_id ? | 16:37 |
| breton | just copypasting from uuid4() or somehow else? | 16:37 |
| *** spzala has quit IRC | 16:37 | |
| dstanek | breton: what is decorators.idempotent_id? | 16:38 |
| breton | dstanek: it is used in keystone_tempest_plugin/tests/api/identity/v3/test_identity_providers.py for example: https://github.com/openstack/keystone/blob/master/keystone_tempest_plugin/tests/api/identity/v3/test_identity_providers.py#L49 | 16:40 |
| breton | it seems that there is a tool for that, http://docs.openstack.org/developer/tempest/HACKING.html#test-identification-with-idempotent-id | 16:40 |
| *** hogepodge has joined #openstack-keystone | 16:41 | |
| *** KevinE_ has quit IRC | 16:42 | |
| *** tonytan_brb has joined #openstack-keystone | 16:44 | |
| *** KevinE has joined #openstack-keystone | 16:45 | |
| *** tonytan4ever has quit IRC | 16:46 | |
| rodrigods | breton, check-uuid --fix | 16:47 |
| rodrigods | you pass the package you want to fix | 16:47 |
| rodrigods | breton, check-uuid --fix keystone_tempest_plugin (if you are trying to fix some tests there) | 16:47 |
| breton | rodrigods: oh, since you are here, i have more questions | 16:49 |
| *** hogepodge has quit IRC | 16:50 | |
| rodrigods | breton, cool, ask away | 16:50 |
| breton | rodrigods: why do we need keystone_tempest_plugin/services/identity/clients.py:Federation and all the methods there? Are they used by something? | 16:50 |
| rodrigods | breton, they are for the federation API clients | 16:50 |
| rodrigods | too much code in common | 16:50 |
| breton | rodrigods: nevermind, see where they are used already | 16:50 |
| breton | rodrigods: so that code basically reimplements keystoneclient, but more lightweight? | 16:51 |
| rodrigods | breton, yeah... the idea in tempest is to not call the python clients | 16:51 |
| *** jpena is now known as jpena|off | 16:51 | |
| breton | rodrigods: cool. So to implement code to work with catalog i need to subclass clients.Identity and implement my methods there? | 16:52 |
| rodrigods | breton, yeah, basically :) | 16:53 |
| rodrigods | breton, remember to keep them as simpler as possible, just JSON parsing | 16:53 |
| * rodrigods is glad someone else is adding integration tests :) | 16:53 | |
| breton | rodrigods: suppose i want to run test_identity_provider_create. What do i need to do that? | 16:55 |
| rodrigods | breton, install/config tempest / execute the tests via "tox -e all-plugin -- keystone" | 16:56 |
| rodrigods | oops, tox -e all-plugin -- test_identity_provider_create | 16:56 |
| rodrigods | or... you can use testr: testr run test_identity_provider_create | 16:56 |
| breton | rodrigods: so basically perform steps from http://docs.openstack.org/developer/tempest/overview.html#quickstart and tox -e all-plugin -- test_identity_provider_create? | 16:57 |
| rodrigods | breton, you don't need a "tempest init", just pip install tempest, create a tempest.conf inside tempest/etc and you should be fine | 16:58 |
| rodrigods | breton, if you are using devstack, it is already done for you | 16:59 |
| rodrigods | breton, you just need to run the tests | 16:59 |
| *** diazjf has quit IRC | 16:59 | |
| *** adu has quit IRC | 17:00 | |
| breton | rodrigods: got it, thanks | 17:00 |
| *** spzala has joined #openstack-keystone | 17:02 | |
| *** spzala has quit IRC | 17:02 | |
| *** ayoung has quit IRC | 17:02 | |
| *** hogepodge has joined #openstack-keystone | 17:02 | |
| samueldmq | is anyone here familiar with CORS ? | 17:04 |
| *** permalac has joined #openstack-keystone | 17:09 | |
| *** yolanda has quit IRC | 17:09 | |
| xek | samueldmq, I did a simple "allow all" configuration a while ago | 17:10 |
| samueldmq | xek: nice, I have a quick question about it | 17:11 |
| samueldmq | xek: if I have 2 servers: 1 for serving pages and another for the REST API | 17:12 |
| samueldmq | xek: when my browser gets a page and that page tries to access the REST API that fails | 17:12 |
| samueldmq | xek: that's a CORS issue right ? | 17:12 |
| *** adu has joined #openstack-keystone | 17:13 | |
| xek | samueldmq, may be... check for the "Access-Control-Allow-Origin" header, it also needs to return this header when queried with http OPTIONS command | 17:13 |
| breton | rodrigods: how does tempest know my identity service url? | 17:14 |
| samueldmq | xek: who should set, let's say, 'Access-Control-Allow-Origin: *' ? | 17:14 |
| rodrigods | breton, a config at tempest.conf | 17:14 |
| samueldmq | xek: the server serving the pages? | 17:14 |
| samueldmq | xek: or the server with REST API? | 17:14 |
| xek | samueldmq, the api service | 17:14 |
| *** tqtran has joined #openstack-keystone | 17:14 | |
| breton | rodrigods: http://paste.openstack.org/show/526046/ this is my tempest.conf. Should i add anything there? | 17:15 |
| samueldmq | xek: if I am understanding correctly it should be the server service the pages, to tell the browser to trust the another server with APIs | 17:15 |
| samueldmq | xek: isn't this right ? | 17:15 |
| breton | rodrigods: that's not devstack | 17:15 |
| rodrigods | breton, yep, let me show you an example | 17:15 |
| breton | rodrigods: found it at http://docs.openstack.org/developer/tempest/configuration.html#tempest-configuration, but would love to see yours | 17:16 |
| xek | samueldmq, I'm pretty certain it's the api service - it controls whether it is safe to call it from other pages | 17:16 |
| *** rcernin has joined #openstack-keystone | 17:17 | |
| *** hogepodge has quit IRC | 17:17 | |
| breton | rodrigods: oh, it already was in etc. | 17:17 |
| rodrigods | breton, http://paste.openstack.org/show/526048/ | 17:17 |
| rodrigods | breton, cool | 17:18 |
| samueldmq | xek: hmm, I thought the interface should specify to the browser that it's safe to ask something from the API server | 17:18 |
| samueldmq | xek: rather than the API server saying to browser, hey it's okay to call me | 17:18 |
| breton | rodrigods: perfect, thanks | 17:18 |
| *** ddieterly is now known as ddieterly[away] | 17:19 | |
| xek | samueldmq, that way a hacker could build a page that calls any other site, maybe with the users credentials with which they logged in | 17:20 |
| samueldmq | xek: on the other way, what if the page is modified locally to call an untrusted API? | 17:22 |
| *** mdavidson has joined #openstack-keystone | 17:23 | |
| *** hogepodge has joined #openstack-keystone | 17:23 | |
| xek | samueldmq, there will be a javascript error when using the xmlhttprequest api | 17:23 |
| *** adu has quit IRC | 17:24 | |
| *** spzala has joined #openstack-keystone | 17:24 | |
| breton | rodrigods: what directory should i run "tox -e all-plugins -- keystone" in? | 17:24 |
| rodrigods | breton, tempest root | 17:24 |
| rodrigods | breton, you can also run testr init; testr run keystone | 17:25 |
| xek | samueldmq, but you may still do a POST to an external page, which is sometimes used (also by hackers) to do cross-site scripting | 17:25 |
| samueldmq | xek: hmm, interesting | 17:25 |
| samueldmq | xek: the page came from server1 and is on user's browser | 17:25 |
| samueldmq | xek: page wants to make GET /v3/users on server2 (API server) | 17:26 |
| samueldmq | xek: then server2 must specify that it allows receiving requests from cross origin ? is that right ? | 17:26 |
| xek | samueldmq, the absence of the header will prevent the script from reading the response | 17:27 |
| xek | samueldmq, in case of a post, it would first do an OPTIONS query, and only if the OPTIONS query returns a proper header, it will do a real POST | 17:28 |
| samueldmq | xek: so the request to server2 (API) comes with an info saying the request originally came from a page that was originated on server1 | 17:28 |
| samueldmq | xek: something like that .. | 17:28 |
| breton | rodrigods: how do i run it from tempest root if i installed tempest from pip? :) | 17:28 |
| *** hogepodge has quit IRC | 17:28 | |
| xek | samueldmq, not sure about other methods, but probably they follow the same scenario, that modifying queries first do an OPTIONS query | 17:28 |
| breton | rodrigods: or i shouldn't do it? :) | 17:29 |
| xek | samueldmq, no, the header contains the info what is allowed, and the browser decides | 17:29 |
| rodrigods | breton, ah... than you need to create a "cloud" | 17:32 |
| rodrigods | breton, like described in the link you pasted above | 17:32 |
| *** fangxu has joined #openstack-keystone | 17:32 | |
| *** tonytan_brb has quit IRC | 17:34 | |
| *** fangxu has quit IRC | 17:34 | |
| *** bjornar_ has joined #openstack-keystone | 17:35 | |
| stevemar | samueldmq: added you to https://review.openstack.org/#/c/337805/1 | 17:35 |
| patchbot | stevemar: patch 337805 - api-site - use in-tree docs for identity APIs | 17:35 |
| stevemar | samueldmq: please take a look | 17:35 |
| *** hogepodge has joined #openstack-keystone | 17:36 | |
| *** nisha_ has joined #openstack-keystone | 17:36 | |
| *** nisha has quit IRC | 17:40 | |
| *** gagehugo has joined #openstack-keystone | 17:40 | |
| samueldmq | stevemar: looking at https://review.openstack.org/#/c/337805/1/www/static/.htaccess | 17:42 |
| patchbot | samueldmq: patch 337805 - api-site - use in-tree docs for identity APIs | 17:42 |
| samueldmq | stevemar: first URL gets redirected to second one, right ? | 17:42 |
| *** bjornar_ has quit IRC | 17:44 | |
| *** gagehugo has quit IRC | 17:47 | |
| *** gagehugo has joined #openstack-keystone | 17:50 | |
| *** shaleh has joined #openstack-keystone | 17:53 | |
| *** jaugustine has joined #openstack-keystone | 17:55 | |
| *** hogepodge has quit IRC | 17:55 | |
| stevemar | meeting time! | 17:59 |
| stevemar | time to jump over to -meeting! ajayaa, amakarov, ayoung, breton, browne, crinkle, claudiub, davechen, david8hu, dolphm, dstanek, edmondsw, gyee, henrynash, hogepodge, htruta, jamielennox, joesavak, jorge_munoz, knikolla, lbragstad, lhcheng, marekd, MaxPC, morgan, nkinder, notmorgan, raildo, rodrigods, rderose, roxanaghe, samleon, samueldmq, shaleh, stevemar, tjcocozz, tsymanczyk, topol, vivekd, wanghong, xek | 17:59 |
| samueldmq | dstanek: patch 319497 just failed, even depending on the other patch that invalidates the cache :( | 18:10 |
| patchbot | samueldmq: https://review.openstack.org/#/c/319497/ - keystone - DO NOT MERGE: Test fix for fernet race condition | 18:10 |
| dstanek | samueldmq: hmmm....that's not good | 18:10 |
| *** adu has joined #openstack-keystone | 18:13 | |
| -openstackstatus- NOTICE: Job instability resulting from a block storage connectivity error on mirror.iad.rax.openstack.org has been corrected; jobs running in rax-iad should be more reliable again. | 18:14 | |
| *** tonytan4ever has joined #openstack-keystone | 18:15 | |
| *** ddieterly[away] is now known as ddieterly | 18:16 | |
| *** ayoung has joined #openstack-keystone | 18:16 | |
| *** ChanServ sets mode: +v ayoung | 18:16 | |
| *** adu has quit IRC | 18:20 | |
| *** spzala has quit IRC | 18:21 | |
| *** hogepodge has joined #openstack-keystone | 18:26 | |
| *** diazjf has joined #openstack-keystone | 18:27 | |
| *** pnavarro has quit IRC | 18:30 | |
| *** diazjf has quit IRC | 18:31 | |
| *** diazjf has joined #openstack-keystone | 18:34 | |
| *** diazjf has quit IRC | 18:40 | |
| *** thiagolib has joined #openstack-keystone | 18:45 | |
| *** code-R has quit IRC | 18:50 | |
| *** hogepodge has quit IRC | 18:53 | |
| *** diazjf has joined #openstack-keystone | 18:54 | |
| *** bjornar_ has joined #openstack-keystone | 18:55 | |
| *** diazjf has quit IRC | 18:57 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 services https://review.openstack.org/337274 | 18:57 |
| *** gagehugo has quit IRC | 18:58 | |
| *** M00nr41n has quit IRC | 18:58 | |
| *** M00nr41n has joined #openstack-keystone | 19:00 | |
| *** diazjf has joined #openstack-keystone | 19:00 | |
| stevemar | keystoners, assemble again! | 19:00 |
| *** hogepodge has joined #openstack-keystone | 19:00 | |
| ayoung | henrynash, so, I was thinking that migrations would need to run in two steps | 19:00 |
| henrynash | ayoung: that’s kind of what the spec says | 19:01 |
| stevemar | henrynash: include any references to how nova claims they will do it | 19:01 |
| ayoung | henrynash, I was thinking of it in terms of a state machine | 19:01 |
| henrynash | stevemar: will do | 19:01 |
| stevemar | this one seems like a slam dunk though | 19:01 |
| dolphm | henrynash: ayoung: ++ | 19:01 |
| ayoung | henrynash, so we have two conflictuing approaches. We do upgrades from major relese to major release only | 19:01 |
| ayoung | Mitaka to Newton for example | 19:01 |
| ayoung | but then others track master | 19:01 |
| ayoung | and "migrations complete" would, I think, make it hard to handle both cases. I think we need to discuss things a little more granularly | 19:02 |
| henrynash | ayoung: hmm, I agree | 19:02 |
| jamielennox | henrynash: i feel like we're still missing a code layer that can deal with 2 different versions of the database though right? | 19:02 |
| shaleh | jamielennox: pretty much | 19:02 |
| ayoung | henrynash, so...remember back when I wanted each extension to have its own migration? It was thinking along these lines: | 19:03 |
| ayoung | when we add a feature, we want to touch as little code as possible | 19:03 |
| henrynash | ayoung: I was too, but I don;t think one db can be controlled by two different version repos | 19:03 |
| dolphm | henrynash: ayoung: if we had a read-only mode for keystone, where it knew it wasn't allowed to accept write requests, we could workaround a lot of issues like this. so, limited functionality while we can maintain "zero downtime" | 19:03 |
| ayoung | dolphm, I think that might be a useful tool, and address some of the issues, but not all | 19:03 |
| shaleh | dolphm: yeah, that has come up a bit lately and would be a great idea. | 19:03 |
| henrynash | ayoung: and we, for instance, add new attributes to existing ytables in the main repo in a miagration | 19:03 |
| dolphm | shaleh: do you know if that approach would work for other services? | 19:04 |
| henrynash | ayoung: I need to go aoffline for bit.I’’ll be back on later | 19:04 |
| ayoung | dolphm, however...if we split revocations into a separate db backend, and said "read only for all but revoations" we would be ain a better place | 19:04 |
| jamielennox | dolphm: tables are all still locked for reading when doing a migration with table changes right? so it wouldn't continue to just work | 19:04 |
| dolphm | shaleh: it only makes sense for us (to me) because we have fernet | 19:04 |
| ayoung | dolphm, so...take that idea one step further | 19:04 |
| dstanek | dolphm: shadow users makes read-only mode a little harder now | 19:04 |
| dolphm | dstanek: ++ | 19:04 |
| shaleh | dolphm: even without Fernet, in the UUID case we could validate but not create tokens. | 19:04 |
| dolphm | shaleh: right, but we can do our entire auth lifecycle without writing if you're using fernet | 19:05 |
| dolphm | so, zero downtime for our primary use case | 19:05 |
| ayoung | dolphm, thouight experieiment here (not seriously proposing) if we were to split Keystone up into separate microservices, such that id, assignment, policy, auth, revoke ran on separate serviers, and we had to migrate each individually | 19:05 |
| dstanek | dolphm: when you auth (depending on the type of user) we will do a write | 19:05 |
| shaleh | dolphm: true. | 19:05 |
| ayoung | and yet maintain 100% uptime | 19:05 |
| ayoung | we would have separate migrations on each server for both code and database | 19:05 |
| shaleh | dolphm: as for other services I think it would be a challenge but there is a minimal case for many/most of them for read-only. | 19:06 |
| dstanek | dolphm: aren't we doing some kind of last activity in addition to the last auth? | 19:06 |
| shaleh | dolphm: I think Nova would be a challenge. | 19:06 |
| ayoung | what if we had separate sql repos for each, or if we used alembic which, IIUC, does a dependency tree for sql migrations? | 19:06 |
| shaleh | I have to head to the office now. Laters all. | 19:07 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add service functional tests https://review.openstack.org/337351 | 19:07 |
| ayoung | shaleh, wait | 19:07 |
| ayoung | shaleh, are you going to finish the OSC work for implied roles? | 19:07 |
| *** jaugustine has quit IRC | 19:07 | |
| ayoung | or should I grab it back | 19:07 |
| *** code-R has joined #openstack-keystone | 19:07 | |
| shaleh | ayoung: grab it back if you need it now. Sorry, I was being bounced around on issues at work for a bit. | 19:07 |
| dolphm | dstanek: yes, but you could sacrifice that functionality during an upgrade | 19:08 |
| ayoung | shaleh, NP...just needed to know | 19:08 |
| dstanek | dolphm: i don | 19:08 |
| dstanek | t think it's impossible, just that it's going to litter our code with checks for the 'is_read_only'. so we'll have to come up with a way to do it right | 19:09 |
| ayoung | dolphm, OK, so my whole rant against nested/hmt in domains...it was based on the work you are addressing for auto-provisioning. If we need to sync two tress, somehow, we need to be able to treat the project-under-domain as a namespace. THat is really what I think is broken, and I don't know how to make it work with the existing restrictions | 19:11 |
| *** clenimar has quit IRC | 19:12 | |
| dolphm | ayoung: "if we need to sync two trees" - why would you need to sync more than a group of projects under a single parent at a time? | 19:12 |
| *** shaleh has quit IRC | 19:13 | |
| *** bjornar_ has quit IRC | 19:13 | |
| notmorgan | dolphm: ++ | 19:17 |
| ayoung | dolphm, K2K | 19:19 |
| ayoung | John comes from BU, Mary from Norteastern | 19:19 |
| *** julim has quit IRC | 19:19 | |
| ayoung | they both come into the project at MIT | 19:19 |
| ayoung | both have a project called "test" | 19:20 |
| ayoung | now, whichone gets there first would get a project called test | 19:20 |
| dolphm | ayoung: so map them into separate parent projects to avoid that, right? | 19:20 |
| notmorgan | dolphm: well domains. but yes. | 19:22 |
| dolphm | notmorgan: i hesitated on which term to use, but yes, a project acting as a domain at the very least | 19:22 |
| ayoung | notmorgan, domains are a keystone concept | 19:22 |
| ayoung | quota is not | 19:22 |
| ayoung | we've made a specialy kind of hell for admins here | 19:22 |
| ayoung | or...we find a way to work both projects into the same domain | 19:23 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 policies https://review.openstack.org/337829 | 19:23 |
| ayoung | and then we don;t get lynched | 19:24 |
| dolphm | ayoung: if they're coming in from different IdP's, I'd like to map them into separate domains | 19:24 |
| ayoung | cuz it would probably take until the Boston summit for the lynchmob to find us, and I don't want to be lynched at home | 19:24 |
| ayoung | dolphm, but they are coming out of the same quota. | 19:24 |
| ayoung | need to be in a single tree somehow | 19:24 |
| notmorgan | i don't see mapping multiple idps to a single domain as viable in the current way keystone works? | 19:25 |
| dolphm | ayoung: so, two projects acting as domains under the same parent domain, where the quota actually is set? | 19:25 |
| *** sheel has quit IRC | 19:25 | |
| notmorgan | didn't way say idps need to be mapped uniqely to domains? | 19:26 |
| ayoung | dolphm, as I said, a special hell for admins | 19:26 |
| *** hogepodge has quit IRC | 19:27 | |
| *** slberger has joined #openstack-keystone | 19:27 | |
| dstanek | ayoung: how would 2 different users with two different projects be under the same quota? | 19:28 |
| ayoung | dstanek, you mean to say we should not allow this? | 19:28 |
| dstanek | ayoung: no, i don't understand the usecase | 19:29 |
| *** hogepodge has joined #openstack-keystone | 19:29 | |
| dstanek | ayoung: just trying to follow along | 19:29 |
| ayoung | dstanek, I set up an organizational project on RAX. Its paid for by me. I pull toghther people from different regions to work there | 19:29 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 policies https://review.openstack.org/337829 | 19:29 |
| ayoung | its all out of my quota | 19:30 |
| dstanek | ayoung: i can see a project quota on a project that both users are using....just in your example it seems that there a two different projects | 19:30 |
| ayoung | people do their work at home, and then sync it up to rax | 19:30 |
| ayoung | dstanek, proejct is the unit of security and info hiding in Openstack | 19:30 |
| dstanek | ayoung: i guess what i don't get is "now, whichone gets there first would get a project called test" | 19:30 |
| ayoung | so two team members each have a hierarchy of stuff tehy are working on, and want to share with each other | 19:31 |
| dstanek | that seems unrelated to quota | 19:31 |
| *** gyee has quit IRC | 19:31 | |
| ayoung | dstanek, each has a project called "wordpress" that they want to share with other members of the team | 19:31 |
| ayoung | dstanek, quota is simply "who pays for it" | 19:33 |
| ayoung | if the resource is paid for by a user ,they need to be able to create subprojects underneath that and divvy out access to other people | 19:34 |
| *** nisha_ has quit IRC | 19:36 | |
| openstackgerrit | David Stanek proposed openstack/python-keystoneclient: WIP: Response objects from Manager methods https://review.openstack.org/329913 | 19:36 |
| openstackgerrit | David Stanek proposed openstack/python-keystoneclient: Use the adapter instead of the client in tests https://review.openstack.org/337835 | 19:36 |
| dstanek | ayoung: yeah, i get all that. i wasn't getting how it's a rebuttal to dolphm's point | 19:37 |
| *** nisha_ has joined #openstack-keystone | 19:37 | |
| *** spzala has joined #openstack-keystone | 19:39 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add policy functional tests https://review.openstack.org/337836 | 19:39 |
| *** ddieterly is now known as ddieterly[away] | 19:40 | |
| ayoung | dstanek, my point is that we can't inflict domains on the other projects. We need to make projects nestable, and the project name needs to act as a namespace. Something that dolphm and notmorgan had said is too risky to allow. I argue that the alternative, trying to allow nesting anywhere else, will confuse people even more greatly than this. TO gyee's point in the meeting that we needed namesopacing...sure...we jsut | 19:41 |
| ayoung | didn't need a different namespace object (domain) from what we already had (tenant) and introducing it really does not make things at all clearer. | 19:41 |
| ayoung | THe namespace should be a single hierarchy | 19:41 |
| ayoung | like URLS, or like the filesystem in an OS | 19:42 |
| stevemar | breton: "lots of bug mail from Steve" :) | 19:42 |
| stevemar | gotta smash those old bugs | 19:42 |
| *** hogepodge has quit IRC | 19:43 | |
| *** hogepodge has joined #openstack-keystone | 19:44 | |
| *** nisha_ has quit IRC | 19:44 | |
| *** julim has joined #openstack-keystone | 19:45 | |
| dstanek | ayoung: i agree. that's why i like nested domains instead of projects. but i do realize that nobody outside of keystone understands domains | 19:46 |
| dstanek | ayoung: i think of domains like directories and projects like files | 19:46 |
| ayoung | dstanek, projects are like directories and resources are like files | 19:46 |
| ayoung | domains are like mountpoints | 19:47 |
| dstanek | the problem i have with that and our current HMT impl is 'is_domain' | 19:47 |
| dstanek | i find it terrible because it's the exact opposite of refactoring and makes me sad | 19:47 |
| *** roxanagh_ has joined #openstack-keystone | 19:48 | |
| dstanek | maybe that wouldn't have happened if there was only nested projects...but i don't know | 19:48 |
| raildo | dstanek, ++ I think the problem with is_domain is only this feature it's not enough, we need to extend it to provide subproject with is_domain, and the quota for domain, to this change make sense | 19:50 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 policies https://review.openstack.org/337829 | 19:51 |
| *** roxanagh_ has quit IRC | 19:52 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 services https://review.openstack.org/337274 | 19:55 |
| dstanek | raildo: i think the fact that we have a boolean value at all is bad | 19:55 |
| dstanek | you wouldn't have a single object represent a user and a group | 19:56 |
| raildo | dstanek, yes, that's why on the first phase we made at this way, focus in remove the domain concept after that, and only have one single 'project' object | 19:57 |
| *** toddnni has joined #openstack-keystone | 19:58 | |
| dstanek | will a project behave differently if it's a domain w/ users vs. a project of resources? | 19:58 |
| raildo | dstanek, no, it will be always a project, but sometimes can have a plus feature on it. | 19:58 |
| raildo | dstanek, when you need this feature (be a namespace), you can enable it | 19:59 |
| dstanek | what is a 'plus feature'? | 19:59 |
| raildo | dstanek, provide reseller for example, if need it, you can make project is_domain and handle with user, if you don't need, you can create just a regular project and handle only with resources | 20:00 |
| dstanek | raildo: that's my point. those should be two distict objects in code | 20:01 |
| *** sheel has joined #openstack-keystone | 20:01 | |
| raildo | I'm not saying it is the best solution, but hmt and reseller it is a huge change and it was not easy everyone happy | 20:02 |
| raildo | dstanek, the problem was, have one kind of object in single hierarchy | 20:03 |
| raildo | (only project hierarchy) | 20:03 |
| raildo | or have two kinds of objects in a single hierarchy | 20:03 |
| raildo | domain -> domain -> project -> project | 20:03 |
| *** ddieterly[away] is now known as ddieterly | 20:03 | |
| raildo | we choose keep with one single object, adding this flag | 20:04 |
| raildo | and after that, try to remove domains concept | 20:04 |
| raildo | since, every other service works with project | 20:04 |
| dstanek | but even if domains no longer exist you would need the is_domain to deal with behavior differences right? | 20:05 |
| stevemar | this change is hilarious: https://review.openstack.org/#/c/337808/ | 20:05 |
| patchbot | stevemar: patch 337808 - api-site - remove identity APIs | 20:05 |
| stevemar | +0, -47892 | 20:05 |
| stevemar | gotta pad my stackalytics stats | 20:06 |
| raildo | dstanek, hum.. kind of, I think we can think in a better (and small) change to improve this point | 20:06 |
| *** diazjf has quit IRC | 20:08 | |
| raildo | stevemar, the top8 LOC changes on stackalytics have 47k, you will have 42K only on this change :P | 20:09 |
| stevemar | buahahaha | 20:09 |
| stevemar | i probably have a handful only now | 20:09 |
| stevemar | i haven't written any code \o/ | 20:09 |
| raildo | stevemar, lol | 20:09 |
| raildo | how to crack stackalytics, by stevemar | 20:10 |
| *** bjornar_ has joined #openstack-keystone | 20:16 | |
| samueldmq | stevemar: that change is great | 20:23 |
| samueldmq | :) | 20:23 |
| *** samueldmq has quit IRC | 20:24 | |
| *** spzala has quit IRC | 20:28 | |
| *** spzala has joined #openstack-keystone | 20:29 | |
| *** hogepodge has quit IRC | 20:29 | |
| *** hogepodge has joined #openstack-keystone | 20:31 | |
| *** maestropandy has joined #openstack-keystone | 20:31 | |
| *** spzala has quit IRC | 20:34 | |
| *** raildo is now known as raildo-afk | 20:44 | |
| *** hogepodge has quit IRC | 20:45 | |
| *** hogepodge has joined #openstack-keystone | 20:47 | |
| *** spzala has joined #openstack-keystone | 20:49 | |
| ayoung | crud...I need hotel reservations. what hotel for midcycle again? | 20:53 |
| *** gyee has joined #openstack-keystone | 20:55 | |
| *** ChanServ sets mode: +v gyee | 20:55 | |
| *** chrisshattuck has quit IRC | 20:59 | |
| openstackgerrit | Merged openstack/keystone: Fixes hacking's handling of log hints https://review.openstack.org/336708 | 20:59 |
| *** chrisshattuck has joined #openstack-keystone | 21:07 | |
| *** hogepodge has quit IRC | 21:09 | |
| *** tonytan4ever has quit IRC | 21:09 | |
| *** diazjf has joined #openstack-keystone | 21:11 | |
| *** hogepodge has joined #openstack-keystone | 21:14 | |
| stevemar | ayoung: i'm at an awful one near the airport | 21:21 |
| stevemar | gonna be driving in everyday | 21:21 |
| stevemar | maybe topol will be the chauffer | 21:21 |
| ayoung | stevemar, who else is there? We have a quorum | 21:22 |
| *** pauloewerton has quit IRC | 21:22 | |
| stevemar | ayoung: i think it's just us schmucks from ibm that are stuck at the airport hotel | 21:25 |
| ayoung | stevemar, that is 5 pax though | 21:25 |
| ayoung | you, topol, henrynash bknudson_ jamielennox right? | 21:25 |
| stevemar | ayoung: probably | 21:26 |
| ayoung | which hotel? | 21:27 |
| stevemar | ayoung: https://goo.gl/maps/q4yeMa5hckz | 21:27 |
| stevemar | ayoung: the nice thing is, there's transit that goes to the office consistently | 21:28 |
| *** phalmos has quit IRC | 21:29 | |
| stevemar | dolphm: dstanek lbragstad gyee which hotel are you guys at? | 21:30 |
| gyee | stevemar, I am staying at my home | 21:31 |
| stevemar | gyee: got room for a few more? :) | 21:31 |
| gyee | 1 hr commute to Cisco so I'll be up early | 21:31 |
| stevemar | gyee: are shalel and roxanaghe joining us ? :) | 21:31 |
| ayoung | hmmm 300+ night not gonna work | 21:31 |
| gyee | stevemar, yes | 21:31 |
| ayoung | I might end up bunking with gyee | 21:32 |
| stevemar | gyee: \o/ | 21:32 |
| stevemar | 300/night?! | 21:32 |
| gyee | let me put up my house on airbnb | 21:32 |
| notmorgan | cburgess: ping - please coordinate with stevemar | 21:33 |
| *** diazjf has quit IRC | 21:33 | |
| notmorgan | cburgess: re midcycle, I may/may not make it. | 21:33 |
| stevemar | cburgess: o/ | 21:33 |
| notmorgan | since i have travel on either side of it already | 21:33 |
| *** diazjf has joined #openstack-keystone | 21:34 | |
| stevemar | cburgess: i have no idea what i have to coordinate with you on, but i'm here to help! | 21:34 |
| notmorgan | stevemar, cburgess: just final location / other details | 21:34 |
| notmorgan | rooms, etc | 21:34 |
| cburgess | notmorgan stevemar Right | 21:34 |
| cburgess | notmorgan stevemar I will follow-up on the final details this week and get them to you stevemar | 21:34 |
| stevemar | cburgess: works for me :) | 21:35 |
| ayoung | WOw...air BnB | 21:35 |
| cburgess | stevemar What does the count stand at right now? | 21:35 |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Support encryption of credentials in Keystone https://review.openstack.org/317169 | 21:35 |
| notmorgan | cburgess: uhmmm. | 21:35 |
| stevemar | cburgess: https://docs.google.com/spreadsheets/d/1qTupqEyYwXnNnO-sW0kRhh-I9hvpPHA7QAuewXnw6AA/edit 28, if you include the tentatives | 21:36 |
| cburgess | stevemar Thanks | 21:36 |
| cburgess | stevemar Is 30 a good final number we can lock in? | 21:36 |
| stevemar | cburgess: i'd say so | 21:36 |
| *** roxanagh_ has joined #openstack-keystone | 21:36 | |
| stevemar | cburgess: we've never had more than 30 | 21:36 |
| cburgess | stevemar OK I see 19 confirmed and 8 tenative | 21:36 |
| stevemar | it's already -1, lin cheng won't attend | 21:37 |
| notmorgan | 35 initial limit was because bay area opened a few doors for more folks | 21:37 |
| cburgess | stevemar OK great. Let me get with the people doing the setup and confirm the details. I will probably need some info from each attendee ahead of time to pre-create the network access passes for them. I'll let you know what I end up needing. | 21:37 |
| notmorgan | but 30 is safe. | 21:37 |
| stevemar | jamielennox: you attending midcycle? | 21:37 |
| notmorgan | esp at this point | 21:37 |
| notmorgan | stevemar: he said he was unlikely to | 21:37 |
| notmorgan | i think in the meeting today | 21:37 |
| stevemar | cburgess: sounds good | 21:37 |
| stevemar | cburgess: i can get you that info quickly (probably) | 21:38 |
| cburgess | stevemar Great. Let me find out what info I need. | 21:38 |
| stevemar | cburgess: the biggest issue is making sure we all have wifi access :D | 21:38 |
| cburgess | stevemar Yup. Thats why I want to pre-create the account. Should help elimate some of the bottle neck. | 21:39 |
| notmorgan | stevemar: it will require MAC Address, Social Security Number (sorry if you're not a US citezen), Bank Account Number, Mother's maiden name, passport-style photograph, encryption keys (private), and finally your left leg. ( :P ) | 21:39 |
| openstackgerrit | Shawn Berger proposed openstack/keystone: Added name to duplicate entry error message. https://review.openstack.org/337892 | 21:39 |
| notmorgan | cburgess: ^ sound about right? hehe | 21:39 |
| notmorgan | j/k | 21:39 |
| stevemar | :) | 21:39 |
| notmorgan | ^_^ | 21:39 |
| cburgess | LOL | 21:39 |
| cburgess | We aren't *that* bad. | 21:39 |
| stevemar | breton: you are not attending? :( | 21:39 |
| *** roxanagh_ has quit IRC | 21:41 | |
| *** ddieterly is now known as ddieterly[away] | 21:42 | |
| stevemar | breton: do i need to find dims and talk to him | 21:42 |
| *** sigmavirus is now known as sigmavirus_away | 21:42 | |
| *** diazjf has quit IRC | 21:43 | |
| *** tonytan4ever has joined #openstack-keystone | 21:49 | |
| breton | stevemar: the midcycle? Nope, sorry. But i'll be happy to participate if you do something like Hangouts or other conferencing | 21:59 |
| *** ddieterly[away] is now known as ddieterly | 22:06 | |
| *** KevinE has quit IRC | 22:07 | |
| ayoung | gyee, 36 minutes dublin to SJO without traffic. How long think it will take when you do this during the mid cycle? | 22:07 |
| *** BjoernT has quit IRC | 22:11 | |
| *** ddieterly is now known as ddieterly[away] | 22:11 | |
| dstanek | stevemar: don't remember :-) checking now | 22:14 |
| openstackgerrit | Merged openstack/keystone: Use skip_test_overrides everywhere we feature skip https://review.openstack.org/336718 | 22:14 |
| dstanek | stevemar: hyatt regency santa clara | 22:17 |
| *** ddieterly[away] is now known as ddieterly | 22:17 | |
| *** adu has joined #openstack-keystone | 22:18 | |
| *** timcline has quit IRC | 22:21 | |
| *** timcline has joined #openstack-keystone | 22:22 | |
| stevemar | breton: i'll see what we can arrange | 22:26 |
| stevemar | ayoung: dstanek at hyatt regency santa clara | 22:26 |
| *** timcline has quit IRC | 22:26 | |
| ayoung | stevemar, any sort of code to get the price down? | 22:26 |
| ayoung | $381 USD | 22:27 |
| ayoung | Full prepayment required, non-refundable, no date changes. | 22:27 |
| ayoung | goes up from there | 22:27 |
| stevemar | not that i know of | 22:28 |
| *** spzala has quit IRC | 22:29 | |
| *** maestropandy has quit IRC | 22:29 | |
| *** spzala has joined #openstack-keystone | 22:30 | |
| *** spzala has quit IRC | 22:34 | |
| *** ddieterly is now known as ddieterly[away] | 22:36 | |
| *** ddieterly[away] has quit IRC | 22:36 | |
| *** sheel has quit IRC | 22:45 | |
| dstanek | ayoung: is that per night? | 22:46 |
| dstanek | i'm almost 100% sure that dolph and lance are both at that hotel | 22:47 |
| dstanek | ayoung: i booked it at 259 per night for 3 nights | 22:48 |
| *** timcline has joined #openstack-keystone | 22:52 | |
| *** timcline has quit IRC | 22:57 | |
| *** gordc has quit IRC | 22:59 | |
| *** itisha has quit IRC | 23:00 | |
| *** adu has quit IRC | 23:05 | |
| *** spzala has joined #openstack-keystone | 23:08 | |
| *** spzala has quit IRC | 23:08 | |
| *** spzala has joined #openstack-keystone | 23:09 | |
| *** spzala has quit IRC | 23:14 | |
| *** BjoernT has joined #openstack-keystone | 23:14 | |
| *** rcernin has quit IRC | 23:18 | |
| *** chrisshattuck has quit IRC | 23:18 | |
| *** code-R has quit IRC | 23:19 | |
| *** BjoernT has quit IRC | 23:19 | |
| gyee | ayoung, with 680s traffic, that's at least 1 hour one way commute between 7-10am | 23:21 |
| ayoung | gyee, that is what I figured. You going to come in early or something? | 23:21 |
| gyee | you staying in my backyard? :-) | 23:22 |
| ayoung | gyee, I don;t think so. Don';t like the commute options | 23:22 |
| gyee | ayoung, the hotels are a lot cheaper in Dublin, I can carpool with you | 23:23 |
| gyee | let me check | 23:23 |
| ayoung | gyee, I honestly think I would rather crash on your couch then take a hotel in Dublin | 23:23 |
| gyee | I can check with the wife | 23:24 |
| *** roxanagh_ has joined #openstack-keystone | 23:24 | |
| gyee | https://www.google.com/?gws_rd=ssl#q=hotel%20dublin%20ca&tbs=ls:-1,lf_hd:-1,lf_maxhp:-1,lf_maxhpitems:100-125-150-225,lf_maxhpcur:USD,lf_msr:-1,lf_hc:-1,lf_ha:0,lf_haitems:1023,lf:1,lf_ui:6&hotel_dates=2016-07-17,2016-07-18&rflfq=1&rlha=1&rlla=0&rllag=37700223,-121917975,1489&tbm=lcl&rldimm=13317741092652517230&rlfi=hd:2016-07-17%2C2016-07-18;si:12613908450429461434 | 23:24 |
| gyee | sorry | 23:25 |
| gyee | http://doubletree3.hilton.com/en/hotels/california/doubletree-by-hilton-hotel-pleasanton-at-the-club-PLEPCDT/index.html | 23:25 |
| gyee | this one is right next to Club Sport | 23:25 |
| ayoung | Maybe I can stay in my old Company bay in Camp Parks | 23:25 |
| ayoung | IHG Army Hotels Camp Parks | 23:25 |
| gyee | camp parks is 5 minutes from my house | 23:25 |
| gyee | right next to santi rita county jail too | 23:26 |
| gyee | though it mostly house female prisoner these days | 23:27 |
| ayoung | I am no longer in the National Guard. I am not allowed on base. THink I'll opt out of the Jail option, too | 23:27 |
| gyee | I can see them working out in the yard every time I pass by | 23:27 |
| rodrigods | gyee, will have your own orange is the new black? | 23:28 |
| rodrigods | you have* | 23:28 |
| rodrigods | have no idea why i typed "will" | 23:29 |
| gyee | hahah | 23:29 |
| *** roxanagh_ has quit IRC | 23:29 | |
| *** breton has quit IRC | 23:32 | |
| *** permalac has quit IRC | 23:35 | |
| *** tonytan4ever has quit IRC | 23:41 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Improve docs for v3 services https://review.openstack.org/337274 | 23:42 |
| jamielennox | stevemar: yep, i'm coming - and in that airport hotel | 23:44 |
| *** breton has joined #openstack-keystone | 23:45 | |
| *** slberger has left #openstack-keystone | 23:46 | |
| jamielennox | notmorgan: so oslo.cache took all the dict and memorypool code from keystonemiddleware - but dogpile.cache wraps it in a tuple with some metadata dict so it's not compatible | 23:47 |
| jamielennox | notmorgan: so it's nice that it took it but it's basically useless :( | 23:47 |
| jamielennox | cause it's not going to be compatible with old entries | 23:47 |
| *** spzala has joined #openstack-keystone | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
