| *** roxanaghe has quit IRC | 00:00 | |
| *** su_zhang has joined #openstack-keystone | 00:22 | |
| *** tqtran has joined #openstack-keystone | 00:24 | |
| *** tqtran has quit IRC | 00:28 | |
| *** adrian_otto has joined #openstack-keystone | 01:12 | |
| *** su_zhang has quit IRC | 01:17 | |
| *** su_zhang has joined #openstack-keystone | 01:17 | |
| *** EinstCrazy has joined #openstack-keystone | 01:23 | |
| *** roxanaghe has joined #openstack-keystone | 01:25 | |
| *** roxanaghe has quit IRC | 01:29 | |
| *** adrian_otto1 has joined #openstack-keystone | 01:33 | |
| *** adrian_otto has quit IRC | 01:34 | |
| *** tonytan4ever has joined #openstack-keystone | 01:42 | |
| *** wangqun has joined #openstack-keystone | 01:46 | |
| *** tonytan4ever has quit IRC | 01:47 | |
| openstackgerrit | Anh Tran proposed openstack/keystone: api-ref: Correcting V3 OS-INHERIT APIs https://review.openstack.org/352690 | 01:49 |
|---|---|---|
| *** su_zhang has quit IRC | 01:59 | |
| *** adrian_otto1 has quit IRC | 01:59 | |
| *** tonytan4ever has joined #openstack-keystone | 02:01 | |
| *** jamielennox is now known as jamielennox|away | 02:10 | |
| *** jamielennox|away is now known as jamielennox | 02:30 | |
| *** davechen has joined #openstack-keystone | 02:38 | |
| stevemar | jamielennox: o/ | 02:57 |
| jamielennox | stevemar: hello | 02:57 |
| stevemar | jamielennox: take a quick look at a bug / fix? | 02:57 |
| jamielennox | sure | 02:58 |
| stevemar | jamielennox: https://bugs.launchpad.net/bugs/1603038 and the fix https://review.openstack.org/344496 | 02:58 |
| openstack | Launchpad bug 1603038 in OpenStack Identity (keystone) "Execption on admin_token usage ValueError: Unrecognized " [Medium,In progress] - Assigned to Colleen Murphy (krinkle) | 02:58 |
| jamielennox | oh, yea - i have that one open | 02:58 |
| jamielennox | i'm not sure i like how the context_env works, it means it will only work with the admin_token middleware which is deprecated | 02:59 |
| jamielennox | but then so is CONF.keystone_authtoken.admin_token so maybe it doesn't matter | 03:00 |
| stevemar | jamielennox: it'll probably be pretty tough to get rid of the admin_token middleware in all honesty | 03:02 |
| jamielennox | stevemar: how auth_token and admin_token fit together is a little bit funky already | 03:10 |
| jamielennox | but i don't think we can rely on that in non-keystone services | 03:11 |
| stevemar | rely on what ? | 03:11 |
| jamielennox | oh, wait - i'm looking at keystone/middleware not keystonemiddleware | 03:12 |
| stevemar | ^_^ | 03:13 |
| stevemar | jamielennox: you refactored it! :) | 03:13 |
| jamielennox | yea, it all made sense at the time :p | 03:13 |
| jamielennox | stevemar: +Aed - there might still be weird edge cases when using admin_token - but i'm pretty sure there has always been weird edge cases using admin_token | 03:31 |
| stevemar | jamielennox: totally | 03:40 |
| *** tonytan4ever has quit IRC | 03:46 | |
| *** su_zhang has joined #openstack-keystone | 03:52 | |
| *** EinstCrazy has quit IRC | 03:53 | |
| *** chlong has joined #openstack-keystone | 04:21 | |
| *** tqtran has joined #openstack-keystone | 04:26 | |
| *** tqtran has quit IRC | 04:30 | |
| *** EinstCrazy has joined #openstack-keystone | 04:33 | |
| *** jaosorior has joined #openstack-keystone | 04:47 | |
| *** roxanaghe has joined #openstack-keystone | 04:49 | |
| *** roxanaghe has quit IRC | 04:52 | |
| *** EinstCrazy has quit IRC | 04:54 | |
| *** EinstCrazy has joined #openstack-keystone | 04:55 | |
| openstackgerrit | Merged openstack/keystone: Skip middleware request processing for admin token https://review.openstack.org/344496 | 04:58 |
| *** EinstCrazy has quit IRC | 04:59 | |
| *** EinstCrazy has joined #openstack-keystone | 05:00 | |
| openstackgerrit | Merged openstack/keystone: Constraints are ready to be used for tox.ini https://review.openstack.org/354875 | 05:03 |
| *** GB21 has joined #openstack-keystone | 05:21 | |
| *** rcernin has joined #openstack-keystone | 05:25 | |
| *** EinstCrazy has quit IRC | 05:26 | |
| *** EinstCrazy has joined #openstack-keystone | 05:27 | |
| *** EinstCra_ has joined #openstack-keystone | 05:30 | |
| *** EinstCrazy has quit IRC | 05:31 | |
| *** adriant has quit IRC | 05:40 | |
| *** rkrum has joined #openstack-keystone | 05:47 | |
| *** roxanaghe has joined #openstack-keystone | 05:52 | |
| *** roxanaghe has quit IRC | 05:57 | |
| *** agireud has quit IRC | 06:01 | |
| *** agireud has joined #openstack-keystone | 06:10 | |
| *** jmccrory is now known as jmccrory_away | 06:12 | |
| *** david-lyle has joined #openstack-keystone | 06:36 | |
| *** pcaruana has joined #openstack-keystone | 06:36 | |
| *** david-lyle_ has quit IRC | 06:39 | |
| *** tonytan4ever has joined #openstack-keystone | 06:47 | |
| *** belmoreira has joined #openstack-keystone | 06:48 | |
| *** tonytan4ever has quit IRC | 06:52 | |
| *** wangqun has quit IRC | 06:54 | |
| *** rkrum has quit IRC | 07:07 | |
| *** chlong has quit IRC | 07:08 | |
| *** chlong has joined #openstack-keystone | 07:25 | |
| *** su_zhang has quit IRC | 07:25 | |
| *** GB21 has quit IRC | 07:38 | |
| *** roxanaghe has joined #openstack-keystone | 07:41 | |
| *** roxanaghe has quit IRC | 07:45 | |
| *** wangqun has joined #openstack-keystone | 07:53 | |
| *** GB21 has joined #openstack-keystone | 07:53 | |
| *** Ephur has quit IRC | 07:57 | |
| *** wangqun has quit IRC | 07:59 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** sdake has joined #openstack-keystone | 08:01 | |
| *** zzzeek has joined #openstack-keystone | 08:02 | |
| *** tonytan4ever has joined #openstack-keystone | 08:03 | |
| *** chlong has quit IRC | 08:07 | |
| *** tonytan4ever has quit IRC | 08:08 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** sdake has quit IRC | 08:15 | |
| *** tqtran has joined #openstack-keystone | 08:27 | |
| *** tqtran has quit IRC | 08:31 | |
| *** sdake has joined #openstack-keystone | 08:35 | |
| *** markvoelker has joined #openstack-keystone | 08:41 | |
| *** sdake has quit IRC | 08:43 | |
| *** markvoelker has quit IRC | 08:45 | |
| *** mvk has joined #openstack-keystone | 08:56 | |
| *** ktychkova has joined #openstack-keystone | 09:08 | |
| *** roxanaghe has joined #openstack-keystone | 09:29 | |
| *** roxanaghe has quit IRC | 09:33 | |
| *** jaosorior is now known as jaosorior_brb | 09:38 | |
| *** sdake has joined #openstack-keystone | 09:46 | |
| *** wangqun has joined #openstack-keystone | 09:57 | |
| *** amakarov_away is now known as amakarov | 10:00 | |
| *** tonytan4ever has joined #openstack-keystone | 10:04 | |
| *** wangqun has quit IRC | 10:05 | |
| *** tonytan4ever has quit IRC | 10:08 | |
| *** EinstCra_ has quit IRC | 10:20 | |
| *** asettle has joined #openstack-keystone | 10:25 | |
| *** jaosorior_brb is now known as jaosorior | 10:31 | |
| *** markvoelker has joined #openstack-keystone | 10:42 | |
| *** markvoelker has quit IRC | 10:47 | |
| *** roxanaghe has joined #openstack-keystone | 11:17 | |
| *** roxanaghe has quit IRC | 11:22 | |
| *** jaosorior has quit IRC | 11:34 | |
| *** jaosorior has joined #openstack-keystone | 11:35 | |
| *** asettle has quit IRC | 11:36 | |
| *** rodrigods has quit IRC | 11:38 | |
| *** rodrigods has joined #openstack-keystone | 11:38 | |
| *** asettle has joined #openstack-keystone | 11:50 | |
| *** sdake has quit IRC | 12:02 | |
| *** edmondsw has joined #openstack-keystone | 12:04 | |
| *** tonytan4ever has joined #openstack-keystone | 12:05 | |
| *** sdake has joined #openstack-keystone | 12:06 | |
| *** tonytan4ever has quit IRC | 12:09 | |
| *** sigmavirus|away is now known as sigmavirus | 12:10 | |
| *** asettle has quit IRC | 12:11 | |
| henrynash | anyone know how tell test_sql_upgrade to run against other databases? Since we use oslo_db.test_base now, I assume is something like setting OS_TEST_DBAPI_ADMIN_CONNECTION...but can't seem to make that work...any ideas? | 12:12 |
| *** tonytan4ever has joined #openstack-keystone | 12:13 | |
| *** roxanaghe has joined #openstack-keystone | 12:18 | |
| *** gordc has joined #openstack-keystone | 12:19 | |
| *** roxanaghe has quit IRC | 12:23 | |
| *** markvoelker has joined #openstack-keystone | 12:30 | |
| *** woodster_ has joined #openstack-keystone | 12:32 | |
| *** GB21 has quit IRC | 12:35 | |
| *** timss has joined #openstack-keystone | 12:35 | |
| *** sdake has quit IRC | 12:38 | |
| *** julim has joined #openstack-keystone | 12:44 | |
| *** raildo has joined #openstack-keystone | 12:46 | |
| *** rkrum has joined #openstack-keystone | 12:47 | |
| *** pauloewerton has joined #openstack-keystone | 12:50 | |
| *** amoralej|off has quit IRC | 12:50 | |
| *** amoralej has joined #openstack-keystone | 12:53 | |
| *** julim has quit IRC | 13:01 | |
| *** julim has joined #openstack-keystone | 13:05 | |
| *** davechen has left #openstack-keystone | 13:06 | |
| *** rkrum has quit IRC | 13:10 | |
| *** rkrum has joined #openstack-keystone | 13:11 | |
| *** rkrum has quit IRC | 13:16 | |
| *** asettle has joined #openstack-keystone | 13:17 | |
| dstanek | henrynash: in the past i have changed our database fixture | 13:19 |
| stevemar | o/ | 13:19 |
| breton | me too | 13:20 |
| breton | figuring out proper env variables was hard | 13:20 |
| *** GB21 has joined #openstack-keystone | 13:24 | |
| lbragstad | morning keystone! | 13:25 |
| *** woodburn has quit IRC | 13:29 | |
| raildo | lbragstad, morning :) | 13:29 |
| *** belmoreira has quit IRC | 13:31 | |
| dolphm | henrynash: there's an environment variable, but the tests are currently broken according to dstanek | 13:33 |
| *** tonytan4ever has quit IRC | 13:33 | |
| dolphm | henrynash: https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_sql_upgrade.py#L14-L32 | 13:34 |
| dstanek | henrynash: dolphm: yeah, i was having problem because of our root domain :-( | 13:34 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix nits in PCI-DSS Minimum password age requirements https://review.openstack.org/355095 | 13:36 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix nits in PCI-DSS Minimum password age requirements https://review.openstack.org/355095 | 13:41 |
| *** GB21 has quit IRC | 13:41 | |
| dolphm | dstanek: abandon in favor of request local caching? https://review.openstack.org/#/c/183189/ | 13:43 |
| patchbot | dolphm: patch 183189 - keystone - WIP: reduce redundant get_user calls | 13:43 |
| dstanek | dolphm: i'll take a deeper look in a bit, but my first reaction is to keep it. local caching is a hack | 13:44 |
| dolphm | dstanek: i don't disagree, but i wonder if it's worth the effort | 13:44 |
| dolphm | dstanek: it'd be great if request context lazily loaded things like that | 13:45 |
| *** belmoreira has joined #openstack-keystone | 13:50 | |
| *** chlong has joined #openstack-keystone | 13:52 | |
| *** ayoung has joined #openstack-keystone | 13:55 | |
| *** ChanServ sets mode: +v ayoung | 13:55 | |
| openstackgerrit | Alexander Ignatyev proposed openstack/keystone: Support new osprofiler API https://review.openstack.org/341401 | 13:55 |
| *** dims has quit IRC | 13:59 | |
| *** adrian_otto has joined #openstack-keystone | 14:01 | |
| *** dims has joined #openstack-keystone | 14:05 | |
| *** roxanaghe has joined #openstack-keystone | 14:06 | |
| *** GB21 has joined #openstack-keystone | 14:07 | |
| *** su_zhang has joined #openstack-keystone | 14:08 | |
| *** roxanaghe has quit IRC | 14:10 | |
| *** sdake has joined #openstack-keystone | 14:10 | |
| *** adrian_otto has quit IRC | 14:13 | |
| *** adrian_otto has joined #openstack-keystone | 14:15 | |
| *** ezpz has joined #openstack-keystone | 14:19 | |
| *** adrian_otto has quit IRC | 14:20 | |
| *** tonytan4ever has joined #openstack-keystone | 14:23 | |
| *** ravelar has joined #openstack-keystone | 14:24 | |
| *** ametts has joined #openstack-keystone | 14:26 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Create rolling upgrades migration repos https://review.openstack.org/355490 | 14:27 |
| *** tqtran has joined #openstack-keystone | 14:30 | |
| *** pcaruana has quit IRC | 14:30 | |
| *** spedione|AWAY is now known as spedione | 14:31 | |
| *** tqtran has quit IRC | 14:34 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Create rolling upgrades migration repos https://review.openstack.org/355490 | 14:39 |
| *** jdennis1 has quit IRC | 14:45 | |
| *** slberger has joined #openstack-keystone | 14:45 | |
| henrynash | rderose, davechen: I must admit I am getting confused as to why everyone else is proposing patches up for rolling upgrades....I have had the series of patches up for weeks.... | 14:47 |
| *** sdake has quit IRC | 14:48 | |
| rderose | henrynash: creating a patch with the 3 repos (expand, migrate, contract), do you have a patch that has this approach? | 14:50 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Create rolling upgrades migration repos https://review.openstack.org/355490 | 14:51 |
| henrynash | rderose: no, mine ahs two - and I have argued why we should not have a repo for --migrate, and I still don't think we should. Anyway, I don't this the way round it is to basically bypass someone else's patches | 14:51 |
| rderose | henrynash: Okay, I'll look at your patches again and if duplicate (or close), I'll abandon this one. I don't want to step on your toes, but would argue for the 3 repos approach. | 14:55 |
| henrynash | rderose: how would you to migrate 1000 rows at a time, with traditional repo approach? | 14:56 |
| *** michauds has joined #openstack-keystone | 14:56 | |
| rderose | henrynash: batch them and you would be in migration phase longer | 14:57 |
| henrynash | rderose: if we had a million rows to migrate, if we did it in one go we might lock up the database and cause denial of service for a while | 14:57 |
| rderose | henrynash: you could batch the million rows, right? | 14:58 |
| rderose | so are you arguing having an expand and contract repo, but not a migrate? | 14:58 |
| henrynash | rderose: yep, but usually the batch size is determined by the operator by calling (something like): keystone-manage db_sync -- migrate --delta 1000 | 14:59 |
| henrynash | rderose: not proposing we support that yet (but this is what some of the other projects do) | 14:59 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: [wip] Add prepare_ldap command https://review.openstack.org/343028 | 14:59 |
| *** spzala has joined #openstack-keystone | 15:01 | |
| rderose | henrynash: okay, makes sense. and we currently support batching, right? why couldn't we support this within a new migrate repo? | 15:03 |
| henrynash | rderose: not quite sure what you mean in terms of supporting batching currently...you mean in regaular sql commands? We have an optional limit, but not sure about batching | 15:04 |
| *** su_zhang has quit IRC | 15:05 | |
| *** rcernin has quit IRC | 15:06 | |
| *** jdennis has joined #openstack-keystone | 15:10 | |
| *** mvk has quit IRC | 15:10 | |
| henrynash | dstanek: hi | 15:11 |
| openstackgerrit | Merged openstack/keystone-specs: Simplify manage-migration spec by introducing database triggers https://review.openstack.org/351798 | 15:17 |
| *** diazjf has joined #openstack-keystone | 15:27 | |
| *** su_zhang has joined #openstack-keystone | 15:31 | |
| *** edtubill has joined #openstack-keystone | 15:33 | |
| *** belmoreira has quit IRC | 15:38 | |
| *** edtubill has quit IRC | 15:40 | |
| *** edtubill has joined #openstack-keystone | 15:40 | |
| *** diazjf has left #openstack-keystone | 15:40 | |
| *** haplo37__ has joined #openstack-keystone | 15:41 | |
| *** asettle has quit IRC | 15:46 | |
| *** asettle has joined #openstack-keystone | 15:47 | |
| *** asettle has quit IRC | 15:53 | |
| *** asettle has joined #openstack-keystone | 15:54 | |
| henrynash | dstanek, dolphm: are you sure that teh overrides in backend_sql.conf are still honored? Wasn't that codde stripped out of test_sql_upgrade when it was converted to use oslo_db test_base? | 16:01 |
| *** arunkant_ has joined #openstack-keystone | 16:01 | |
| *** BjoernT has joined #openstack-keystone | 16:02 | |
| dstanek | henrynash: no, but in a few minutes i can switch gears and try to help figure it out | 16:02 |
| *** adrian_otto has joined #openstack-keystone | 16:02 | |
| dstanek | lunching/dealing with cable guy right now | 16:02 |
| henrynash | dstaneK: ok, thks! | 16:02 |
| henrynash | dstanek :-) | 16:02 |
| *** GB21 has quit IRC | 16:05 | |
| *** tqtran has joined #openstack-keystone | 16:08 | |
| *** dims has quit IRC | 16:10 | |
| *** gyee has joined #openstack-keystone | 16:12 | |
| *** Ephur has joined #openstack-keystone | 16:18 | |
| *** su_zhang has quit IRC | 16:21 | |
| *** spedione is now known as spedione|AWAY | 16:25 | |
| *** ametts_ has joined #openstack-keystone | 16:28 | |
| *** hockeynut has joined #openstack-keystone | 16:28 | |
| *** ametts has quit IRC | 16:30 | |
| *** dkehn_ has quit IRC | 16:31 | |
| *** tqtran has quit IRC | 16:31 | |
| *** tqtran has joined #openstack-keystone | 16:40 | |
| *** dims has joined #openstack-keystone | 16:42 | |
| *** tqtran has quit IRC | 16:44 | |
| *** dims has quit IRC | 16:47 | |
| *** esp has joined #openstack-keystone | 16:47 | |
| *** dkehn has joined #openstack-keystone | 16:48 | |
| *** roxanaghe has joined #openstack-keystone | 16:48 | |
| *** spedione|AWAY is now known as spedione | 16:49 | |
| *** dims has joined #openstack-keystone | 16:53 | |
| henrynash | dstanek: fyi, have made progress on it...so ping me when you are back on | 16:54 |
| *** adrian_otto has quit IRC | 16:54 | |
| *** tonytan4ever has quit IRC | 16:54 | |
| *** GB21 has joined #openstack-keystone | 16:55 | |
| *** adrian_otto has joined #openstack-keystone | 16:57 | |
| *** slberger has quit IRC | 16:58 | |
| *** sdake has joined #openstack-keystone | 17:00 | |
| *** slberger has joined #openstack-keystone | 17:01 | |
| *** ravelar1 has joined #openstack-keystone | 17:05 | |
| *** ravelar has quit IRC | 17:05 | |
| *** jaosorior has quit IRC | 17:06 | |
| *** esp has quit IRC | 17:06 | |
| *** Ephur has quit IRC | 17:07 | |
| *** harlowja has joined #openstack-keystone | 17:08 | |
| stevemar | henrynash: rderose you guys like stepping on each others toes today eh ;) | 17:09 |
| rderose | stevemar: ;) | 17:09 |
| stevemar | rderose: i think henrynash had first dibs on the patches, let's let him finish it up :) | 17:09 |
| stevemar | reviewing is *just* as important!!! | 17:09 |
| rderose | stevemar: agree, I've abandon my patch for now | 17:10 |
| stevemar | rderose: :) | 17:10 |
| rderose | stevemar henrynash: will add my comments to the latest patch | 17:10 |
| stevemar | glad to hear i didn't need to pass around the peace stick | 17:10 |
| stevemar | i've named it lucille | 17:10 |
| rderose | haha | 17:10 |
| rderose | :) | 17:10 |
| rderose | stevemar: why lucille? | 17:11 |
| stevemar | rderose: you need to read the walking dead | 17:11 |
| rderose | ah | 17:12 |
| *** esp has joined #openstack-keystone | 17:13 | |
| *** asettle has quit IRC | 17:15 | |
| *** su_zhang has joined #openstack-keystone | 17:17 | |
| *** Ephur has joined #openstack-keystone | 17:19 | |
| *** Ephur has quit IRC | 17:20 | |
| *** tqtran has joined #openstack-keystone | 17:21 | |
| *** su_zhang has quit IRC | 17:21 | |
| *** su_zhang has joined #openstack-keystone | 17:22 | |
| *** ayoung has quit IRC | 17:25 | |
| *** asettle has joined #openstack-keystone | 17:26 | |
| *** tqtran has quit IRC | 17:29 | |
| *** adrian_otto1 has joined #openstack-keystone | 17:31 | |
| *** tqtran has joined #openstack-keystone | 17:32 | |
| *** Gorian|work has joined #openstack-keystone | 17:34 | |
| *** adrian_otto has quit IRC | 17:35 | |
| *** iurygregory has quit IRC | 17:36 | |
| *** rcernin has joined #openstack-keystone | 17:37 | |
| openstackgerrit | Merged openstack/keystone: api-ref: Correcting V3 OS-INHERIT APIs https://review.openstack.org/352690 | 17:37 |
| *** Ephur has joined #openstack-keystone | 17:39 | |
| *** edtubill has quit IRC | 17:40 | |
| *** ayoung has joined #openstack-keystone | 17:41 | |
| *** ChanServ sets mode: +v ayoung | 17:41 | |
| *** tonytan4ever has joined #openstack-keystone | 17:45 | |
| *** iurygregory has joined #openstack-keystone | 17:53 | |
| dstanek | henrynash: back | 17:53 |
| *** GB21 has quit IRC | 17:56 | |
| *** Ephur has quit IRC | 18:04 | |
| *** Ephur has joined #openstack-keystone | 18:06 | |
| *** Ephur has quit IRC | 18:08 | |
| *** Ephur has joined #openstack-keystone | 18:08 | |
| stevemar | whoa wheres bknudson | 18:08 |
| *** bknudson has joined #openstack-keystone | 18:21 | |
| *** ChanServ sets mode: +v bknudson | 18:21 | |
| *** Ephur has quit IRC | 18:25 | |
| *** Ephur has joined #openstack-keystone | 18:26 | |
| *** manous has joined #openstack-keystone | 18:27 | |
| manous | hello | 18:27 |
| manous | please how can i solve this issue http://paste.openstack.org/show/Xk8wFs98stbHaHhWF7BP/ | 18:28 |
| manous | in shell i can list everything | 18:28 |
| manous | but in horizon i have error | 18:28 |
| *** neophy has joined #openstack-keystone | 18:33 | |
| *** ayoung has quit IRC | 18:37 | |
| *** tqtran has quit IRC | 18:39 | |
| *** asettle has quit IRC | 18:41 | |
| *** rcernin has quit IRC | 18:42 | |
| stevemar | henrynash: around? | 18:46 |
| *** spzala has quit IRC | 18:48 | |
| *** spzala has joined #openstack-keystone | 18:48 | |
| *** tqtran has joined #openstack-keystone | 18:49 | |
| *** haplo37__ has quit IRC | 18:50 | |
| *** spzala has quit IRC | 18:51 | |
| *** hockeynut has quit IRC | 18:51 | |
| *** spzala has joined #openstack-keystone | 18:52 | |
| *** su_zhang has quit IRC | 18:56 | |
| *** itisha has joined #openstack-keystone | 18:58 | |
| *** tqtran has quit IRC | 18:59 | |
| henrynash | stevemar: hi | 19:03 |
| *** haplo37__ has joined #openstack-keystone | 19:04 | |
| henrynash | dstanek: so I don't think backend_sql is read anymore for test_sql_upgrade....I managed to make it work using the env var OS_TEST_DBAPI_ADMIN_CONNECTION which is ready be oslo_db | 19:04 |
| *** fifieldt has quit IRC | 19:07 | |
| *** edtubill has joined #openstack-keystone | 19:08 | |
| *** haplo37__ has quit IRC | 19:10 | |
| *** tqtran has joined #openstack-keystone | 19:12 | |
| stevemar | henrynash: do you remember what the heck we decided on the topic of "can domain scoped roles imply global roles?" | 19:13 |
| stevemar | henrynash: way back when designing DSR | 19:13 |
| *** ametts_ has quit IRC | 19:13 | |
| stevemar | https://review.openstack.org/#/c/351264/ | 19:13 |
| patchbot | stevemar: patch 351264 - keystone - Add domain check in domain-specific role implication | 19:13 |
| henrynash | stevemar: so a dsr needs to be able to imply a global role (or they would be useless, since only global roles exist in policy files) | 19:15 |
| henrynash | stevemar: a dsr from one domain probably shouldn't be able to imply a dsr in another domain | 19:15 |
| *** asettle has joined #openstack-keystone | 19:16 | |
| henrynash | stevemar: (at least even I am not sure I want to try and write the keystonepolicy rule that would check such an action) | 19:16 |
| henrynash | stevemar: you probably don't want a global role implying a dsr....can't really see the use case for that, and it would be confusing I suspect | 19:17 |
| *** ametts_ has joined #openstack-keystone | 19:18 | |
| *** fifieldt has joined #openstack-keystone | 19:18 | |
| *** ametts_ has quit IRC | 19:18 | |
| *** roxanaghe has quit IRC | 19:18 | |
| *** asettle has quit IRC | 19:19 | |
| *** ametts has joined #openstack-keystone | 19:19 | |
| *** haplo37__ has joined #openstack-keystone | 19:22 | |
| *** Nisha has joined #openstack-keystone | 19:24 | |
| *** Nisha is now known as Guest35335 | 19:24 | |
| *** Guest35335 is now known as nishaYadav | 19:25 | |
| *** nishaYadav is now known as Guest14451 | 19:25 | |
| *** Guest14451 is now known as nisha_ | 19:26 | |
| *** nisha_ is now known as nisha__ | 19:26 | |
| *** su_zhang has joined #openstack-keystone | 19:26 | |
| *** asettle has joined #openstack-keystone | 19:29 | |
| *** slberger has quit IRC | 19:31 | |
| *** asettle has quit IRC | 19:31 | |
| *** adrian_otto1 has quit IRC | 19:31 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/317169 | 19:33 |
| *** su_zhang has quit IRC | 19:34 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/317169 | 19:39 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add key_hash column to credential table https://review.openstack.org/355618 | 19:39 |
| *** tonytan4ever has quit IRC | 19:41 | |
| dstanek | henrynash: perfect, i'll give that a try too then | 19:46 |
| *** ayoung has joined #openstack-keystone | 19:48 | |
| *** ChanServ sets mode: +v ayoung | 19:48 | |
| *** nisha_ has joined #openstack-keystone | 19:50 | |
| *** nisha__ has quit IRC | 19:51 | |
| *** nisha_ has quit IRC | 19:51 | |
| *** nisha_ has joined #openstack-keystone | 19:52 | |
| henrynash | stevemar: ping | 19:52 |
| stevemar | henrynash: pong | 19:52 |
| openstackgerrit | henry-nash proposed openstack/keystone: POC of data migration using database triggers https://review.openstack.org/354343 | 19:53 |
| henrynash | stevemar: so i was under (maybe a false) impression taht we supported a two cycle upgrade (i.e. we would support Liberty->Newton in one leap)...is that your understanding? | 19:55 |
| stevemar | henrynash: that has been the case for a while now | 19:57 |
| henrynash | stevemar: dolphm^ | 19:57 |
| henrynash | oops | 19:57 |
| henrynash | dolphm:^ | 19:57 |
| dolphm | stevemar: when did that become true? | 19:58 |
| *** tonytan4ever has joined #openstack-keystone | 19:58 | |
| stevemar | it may not have been written down, but i think that's been the unwritten rule the ops have expected | 19:58 |
| bknudson | I didn't think we ever supported going directly from L->N | 19:58 |
| dolphm | stevemar: unwritten? | 19:59 |
| dolphm | grenade does not test that case as far as i know | 19:59 |
| stevemar | hey i'm happy to be wrong here | 19:59 |
| *** ravelar1 has quit IRC | 20:00 | |
| stevemar | our schema migrations put an upper limit on 2 | 20:00 |
| dolphm | stevemar: for maintenance purposes | 20:01 |
| stevemar | yes | 20:01 |
| stevemar | i asked in -operators | 20:01 |
| dolphm | stevemar: that should really not imply that we support skipping releases as a viable upgrade path | 20:01 |
| stevemar | IIRC most operators will choose to jump 2 releases, but do their db upgrades one at a time | 20:01 |
| bknudson | Anybody know why we have a "PooledMemachedBackend" -- http://git.openstack.org/cgit/openstack/oslo.cache/tree/oslo_cache/backends/memcache_pool.py#n42 | 20:02 |
| bknudson | does it give better performance? | 20:02 |
| dolphm | stevemar: whether it'd be nice to support or not is not the question -- it's a question of whether it's a viable, supported, tested, and documented upgrade path | 20:02 |
| dolphm | stevemar: and AFAIK we've never had the infrastructure resources to make the investment, much less project-level support | 20:03 |
| *** sigmavirus is now known as sigmavirus|away | 20:03 | |
| henrynash | dolphm, stevemar: I absolutely don't think we should try and support a rolling upgrade across 2 releases, I think the question is whether we still support the "offline" (I.e. naked db_sync) across 2 releases | 20:04 |
| stevemar | bknudson: supposedly | 20:05 |
| dolphm | henrynash: we can't say we support it unless we can test it, and it's not tested | 20:05 |
| stevemar | henrynash: dolphm what does the governance tag say | 20:05 |
| stevemar | https://governance.openstack.org/reference/tags/assert_supports-rolling-upgrade.html and https://governance.openstack.org/reference/tags/assert_supports-upgrade.html | 20:05 |
| stevemar | looks like we're in the clear henrynash | 20:06 |
| dolphm | https://governance.openstack.org/reference/tags/assert_supports-upgrade.html#requirements | 20:06 |
| dolphm | N-1 to N | 20:06 |
| stevemar | only n-1 | 20:06 |
| stevemar | henrynash: no testing, no docs, no nada :) | 20:06 |
| stevemar | n-1 it is! | 20:06 |
| * stevemar *applies PTL stamp* | 20:07 | |
| *** ravelar has joined #openstack-keystone | 20:07 | |
| *** su_zhang has joined #openstack-keystone | 20:08 | |
| *** nisha_ has quit IRC | 20:08 | |
| henrynash | stevemar: even for a non rolling upgrade? (just checking) | 20:08 |
| stevemar | henrynash: especially for that, we don't even had it implemented yet :) | 20:09 |
| stevemar | lets get folks rolling 1 release at a time | 20:09 |
| henrynash | stevemar: no, i was say for the NON rolling upgrade (i.e. what we have today) | 20:09 |
| stevemar | err, can't read | 20:09 |
| stevemar | yes, even for non-rolling, good ol fashioned offline upgrade, we never wrote anywhere that n-2 will work | 20:10 |
| stevemar | henrynash: i think *we* (IBM) used to have that policy for ICM/ICO which is why you and I are getting confused | 20:10 |
| henrynash | ok, we shall make so, captain | 20:10 |
| henrynash | dolphm: simplifcation patch will be done by end of day! | 20:11 |
| *** nisha_ has joined #openstack-keystone | 20:11 | |
| stevemar | 15:59 stevemar: what is the expectation for upgrading? jumping 2 releases? (k->m) | 20:11 |
| stevemar | 16:00 stevemar: or just single releases | 20:11 |
| stevemar | 16:03 jproulx: stevemar: just single releases, though seems many people are doing (k->l->m) in more or less one go. I'm working on testing it for my site now. From what I understand at least for nova you really ahve to go through Liberty because of the way the do lazy migration of DB entries (though I don't think you need to stay at L for any period of time, but as I said I'm in the middle of testing this so not | 20:11 |
| stevemar | 100% sure yet) | 20:11 |
| *** slberger has joined #openstack-keystone | 20:11 | |
| stevemar | henrynash: as i said, i think folks will upgrade many releases in one maintenance window, but will upgrade dbs one at a time | 20:12 |
| dolphm | stevemar: right, some deployers do multiple upgrades within a maintenance period, but it still takes 3 code bases | 20:13 |
| stevemar | ja | 20:13 |
| dolphm | henrynash: awesome! | 20:13 |
| dolphm | henrynash: poke me when you have a revision? happy to review it ASAP | 20:14 |
| *** neophy has quit IRC | 20:14 | |
| stevemar | 16:14 stevemar: jproulx: but the expectation is that DB schemas can only be ugpraded N-1 to N right? | 20:14 |
| stevemar | 16:14 jproulx: That's the official expectation yes. | 20:14 |
| dolphm | all accurate | 20:15 |
| henrynash | dolphm: separate issue: do we use a repo for the migration phase....the reason I did not do that in my patch was to allow migration in batches...i.e. if we had to migrate 1 million rows, then doing it in one go might cause a denial of service to other users of the database...most other projects support batching, e.g. to do 1000 rows you might execute keystone-manage db_sync --migrate --delta 1000 | 20:24 |
| *** cargonza has joined #openstack-keystone | 20:24 | |
| dolphm | henrynash: i'd say yes to a separate repo for data migrations, but that's not the reasoning i'd use | 20:25 |
| samueldmq | what does a token KVS backend buy us ? | 20:25 |
| dolphm | samueldmq: backing tokens to memcache and mongo | 20:25 |
| openstackgerrit | Tin Lam proposed openstack/keystone: api-ref: Document implied roles API https://review.openstack.org/355219 | 20:26 |
| crinkle | should i propose https://review.openstack.org/#/c/347543/ only to stable/mitaka or propose it in master and leave a TODO to remove it? | 20:26 |
| patchbot | crinkle: patch 347543 - keystone - Add dummy domain_id column to cached role | 20:26 |
| dolphm | henrynash: we should definitely be better about migrating smaller amount of data at a time, but that can be done in each individual data migration (batching smaller number of updates together, rather than doing an entire table, regardless of size) | 20:26 |
| samueldmq | dolphm: thanks. I am looking at change 348040 | 20:27 |
| dolphm | henrynash: i don't think the caller should have to do anything to get that behavior ... in other words, --migrate should never DoS the db, or lock it for extended periods | 20:27 |
| samueldmq | dolphm: "What is the utility of keeping KVS at all in a world where we are using multiple processes?" | 20:27 |
| *** tonytan4ever has quit IRC | 20:27 | |
| samueldmq | this was one of the comments left there, I found it interesting and can't have an answer | 20:28 |
| dolphm | samueldmq: kvs for token persistence is perhaps a bit special compared to the other backends (where i'm not sure anyone has used it in production besides HP) | 20:29 |
| dolphm | dstanek: cc ^ | 20:29 |
| dstanek | dolphm: do they actually use it in production? | 20:29 |
| samueldmq | dolphm: thanks for looking at it | 20:29 |
| henrynash | dolphm: I would think it hard for a repo migration to provide the optimal batching....I was imagining we would want to call migrate multiple times....or pass it some batch size that was appropraiet for the customers db in question, how much it is loaded etc.....i.e. how much db bandwidth do they want to use up for migration | 20:30 |
| *** sdake has quit IRC | 20:32 | |
| henrynash | dolphm: (in fact it is actually a mute question for Newton...there are no data migrations!!) | 20:32 |
| dolphm | dstanek: they *did* | 20:40 |
| dolphm | henrynash: that's true for the moment :P | 20:42 |
| dolphm | henrynash: maybe that should be a permanent part of oslo.db? [db] data_migration_batch_size = 100 # for example | 20:44 |
| *** adrian_otto has joined #openstack-keystone | 20:44 | |
| *** tonytan4ever has joined #openstack-keystone | 20:45 | |
| *** raildo has quit IRC | 20:54 | |
| breton | stevemar: regarding https://bugs.launchpad.net/oslo.cache/+bug/1590779 | 20:55 |
| openstack | Launchpad bug 1590779 in oslo.cache "Cache region invalidation works for local CacheRegion object only" [Undecided,In progress] - Assigned to Alexander Makarov (amakarov) | 20:55 |
| *** roxanaghe has joined #openstack-keystone | 20:55 | |
| stevemar | breton: hmm, yes? | 20:55 |
| breton | stevemar: i think it should be brought back to confirmed | 20:55 |
| stevemar | breton: brought back? | 20:55 |
| breton | stevemar: even if it will be fixed in oslo.cache, we shall probably have to enable it from keystone | 20:55 |
| stevemar | breton: oh the bug state | 20:55 |
| breton | stevemar: i am now working on ldap things, bug after that i want to tackle that bug | 20:56 |
| stevemar | breton: if oslo.cache accepts the backport, and releases a stable version, we'll get it for free | 20:56 |
| stevemar | breton: if you want it "confirmed" for tracking purposes, i can do that | 20:56 |
| stevemar | breton: but i'm not wrong in saying we have nothing to do with the fix, right? | 20:57 |
| breton | stevemar: if oslo.cache accepts the fix, it will not become automatically enabled for keystone | 20:57 |
| stevemar | breton: why not? | 20:57 |
| *** sdake has joined #openstack-keystone | 20:57 | |
| stevemar | breton: i was going to ping you about this earlier when i did the triage, but i assumed you were offline, good thing we're having the conversation now | 20:58 |
| breton | stevemar: because i think it's bad to enable cross-region invalidation in oslo.cache by default making all openstack project use it | 20:58 |
| breton | *cross-process | 20:58 |
| breton | stevemar: it might be only our weird ways of using it | 20:59 |
| breton | stevemar: the patch to oslo.cache (https://review.openstack.org/#/c/354831/) is in a very early stage and who knows what it becomes after discussion | 21:00 |
| patchbot | breton: patch 354831 - oslo.cache - Store cache invalidation timestamps on region backend | 21:00 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add credential functional tests https://review.openstack.org/348557 | 21:00 |
| nisha_ | samueldmq, rodrigods please have a look when you get time :) | 21:00 |
| nisha_ | ^ | 21:00 |
| breton | stevemar: and we have not yet figured out what dstanek has, because his patch was interesting | 21:01 |
| breton | stevemar: and if dstanek's patch won't work, i want to come up with a solution (what a nice name for a hack, eh?) that would work with both versions of dogpile.cache | 21:02 |
| dstanek | breton: i can't imagine anyone would not want it to properly invalidate | 21:02 |
| dstanek | breton: why would it not work? | 21:02 |
| breton | dstanek: i don't know. Is it ready for review? | 21:03 |
| *** haplo37__ has quit IRC | 21:03 | |
| *** julim has quit IRC | 21:03 | |
| dstanek | breton: i'll jump over to it and make sure it is. i'm pretty sure i got things working OK on friday | 21:04 |
| breton | dstanek: got it. Last time i checked it before Friday, so sorry if i'm not on the track | 21:05 |
| *** spedione is now known as chris_hultin | 21:06 | |
| *** spzala has quit IRC | 21:07 | |
| *** spzala has joined #openstack-keystone | 21:07 | |
| *** sdake has quit IRC | 21:08 | |
| *** adrian_otto has quit IRC | 21:12 | |
| *** spzala has quit IRC | 21:13 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 ec2 https://review.openstack.org/350173 | 21:14 |
| nisha_ | samueldmq, rodrigods, thanks for suggestions, updated this too ^ | 21:15 |
| *** tqtran has quit IRC | 21:15 | |
| rodrigods | nisha_, think you found a bug | 21:17 |
| *** sdake has joined #openstack-keystone | 21:17 | |
| rodrigods | that's good! | 21:17 |
| nisha_ | rodrigods, in the credential tests? update one? | 21:17 |
| rodrigods | nisha_, yep | 21:17 |
| rodrigods | just confirmed by taking a look in the code | 21:17 |
| nisha_ | hmm | 21:18 |
| *** pauloewerton has quit IRC | 21:18 | |
| *** haplo37__ has joined #openstack-keystone | 21:18 | |
| nisha_ | samueldmq, suggested trying to update it by passing project=None for ec2 type credential, even then the tests didn't fail | 21:18 |
| *** mvk has joined #openstack-keystone | 21:19 | |
| samueldmq | I guess this is because None values get cut off when updaitng | 21:20 |
| nisha_ | rodrigods, samueldmq thanks :) | 21:20 |
| *** nisha_ has quit IRC | 21:24 | |
| *** adrian_otto has joined #openstack-keystone | 21:27 | |
| *** chris_hultin is now known as spedione|AWAY | 21:27 | |
| *** edtubill has quit IRC | 21:28 | |
| *** ametts has quit IRC | 21:28 | |
| *** adrian_otto has quit IRC | 21:34 | |
| *** sdake has quit IRC | 21:39 | |
| *** edtubill has joined #openstack-keystone | 21:41 | |
| openstackgerrit | Billy Olsen proposed openstack/keystone: Maintain ordered list for KVS token persistence https://review.openstack.org/348040 | 21:47 |
| *** adrian_otto has joined #openstack-keystone | 21:51 | |
| *** sdake has joined #openstack-keystone | 21:54 | |
| *** tqtran has joined #openstack-keystone | 21:55 | |
| *** harlowja has quit IRC | 21:55 | |
| *** tonytan4ever has quit IRC | 21:57 | |
| *** tqtran has quit IRC | 22:00 | |
| *** gordc has quit IRC | 22:00 | |
| *** tqtran has joined #openstack-keystone | 22:08 | |
| *** edtubill has quit IRC | 22:10 | |
| *** haplo37__ has quit IRC | 22:15 | |
| *** tqtran has quit IRC | 22:15 | |
| *** tqtran has joined #openstack-keystone | 22:16 | |
| *** jistr has quit IRC | 22:18 | |
| *** jistr has joined #openstack-keystone | 22:19 | |
| *** sdake has quit IRC | 22:20 | |
| *** hockeynut has joined #openstack-keystone | 22:29 | |
| *** slberger has left #openstack-keystone | 22:30 | |
| *** sdake has joined #openstack-keystone | 22:35 | |
| *** edmondsw has quit IRC | 22:51 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for rolling upgrades to keystone-manage https://review.openstack.org/349716 | 22:54 |
| *** sdake has quit IRC | 22:57 | |
| *** tonytan4ever has joined #openstack-keystone | 22:58 | |
| *** michauds has quit IRC | 23:02 | |
| *** tonytan4ever has quit IRC | 23:03 | |
| *** asettle has joined #openstack-keystone | 23:04 | |
| *** markvoelker has quit IRC | 23:06 | |
| *** asettle has quit IRC | 23:09 | |
| *** BjoernT has quit IRC | 23:13 | |
| *** ezpz has quit IRC | 23:18 | |
| *** manous has quit IRC | 23:18 | |
| openstackgerrit | Merged openstack/keystone: Remove the redundant verification in OAuth1 authorization https://review.openstack.org/349247 | 23:25 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move fernet utils into keystone/common/ https://review.openstack.org/353707 | 23:29 |
| *** gyee has quit IRC | 23:30 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Make a FernetUtils class https://review.openstack.org/353761 | 23:30 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Pass key_repository and max_active_keys to FernetUtils https://review.openstack.org/353762 | 23:30 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add credential encryption exception https://review.openstack.org/354494 | 23:31 |
| breton | huh | 23:31 |
| breton | that refactoring | 23:31 |
| breton | mnikolaenko: ^ please rebase on master, new things are merged | 23:33 |
| stevemar | breton: yeah, refactoring stuff n' things | 23:34 |
| stevemar | breton: lbragstad is picking up the "encrypting credentials" blueprint and it involved moving fernet around | 23:34 |
| stevemar | cause they want to re-use fernet keys | 23:35 |
| stevemar | the refactoring was already +2'ed by samueldmq, i just added the BP to the commit message and pushed through (I had +2ed originally) | 23:35 |
| breton | stevemar: cool. I and mnikolaenko are working on https://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/fernet-key-store.html | 23:35 |
| *** harlowja has joined #openstack-keystone | 23:36 | |
| breton | for O, obviously | 23:36 |
| stevemar | breton: ++ | 23:38 |
| *** Gorian|work has quit IRC | 23:38 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add data migration and contract schema logic to keystone-manage https://review.openstack.org/349939 | 23:41 |
| *** hockeynut has quit IRC | 23:43 | |
| *** gyee has joined #openstack-keystone | 23:49 | |
| openstackgerrit | henry-nash proposed openstack/keystone: POC of data migration using database triggers https://review.openstack.org/354343 | 23:50 |
| henrynash | dolphm, rderose: new patches up for rolling upgrades | 23:50 |
| rderose | henrynash: cool, I'll take a look. thanks. | 23:51 |
| henrynash | rderose: thx | 23:54 |
| *** Ephur has quit IRC | 23:58 | |
| *** esp has left #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!