| *** markvoelker has quit IRC | 00:00 | |
| *** markvoelker has joined #openstack-keystone | 00:01 | |
| openstackgerrit | Merged openstack/keystone: Fixes spelling mistakes https://review.openstack.org/364527 | 00:08 |
|---|---|---|
| *** fangxu has joined #openstack-keystone | 00:10 | |
| *** markvoelker has quit IRC | 00:35 | |
| *** tonytan4ever has joined #openstack-keystone | 00:38 | |
| *** markvoelker has joined #openstack-keystone | 00:44 | |
| stevemar | dolphm: o/ | 00:45 |
| lbragstad | stevemar o/ | 00:53 |
| stevemar | lbragstad: ahoy | 00:53 |
| stevemar | lbragstad: looks like a build error | 00:53 |
| lbragstad | stevemar digging | 00:53 |
| stevemar | lbragstad: just finishing something up, 30 more minutes :P | 00:53 |
| stevemar | lbragstad: your drive home is too quick | 00:53 |
| stevemar | lbragstad: MultiFernet requires at least one Fernet instance | 00:54 |
| stevemar | it'll fix the tests too | 00:54 |
| lbragstad | trying to recreate locally | 00:55 |
| *** chrisshattuck has joined #openstack-keystone | 00:57 | |
| *** chrisshattuck has quit IRC | 00:58 | |
| *** ddieterly has joined #openstack-keystone | 01:02 | |
| *** ddieterly is now known as ddieterly[away] | 01:02 | |
| *** spzala has joined #openstack-keystone | 01:20 | |
| *** ddieterly[away] is now known as ddieterly | 01:23 | |
| lbragstad | dolphm stevemar so - those failures are interesting - i think they are because we moved them to be module level (?) | 01:23 |
| *** arunkant has joined #openstack-keystone | 01:24 | |
| lbragstad | er - we move the get_multi_fernet_keys() and primary_key_hash() functions to be module level | 01:24 |
| *** spzala has quit IRC | 01:25 | |
| stevemar | lbragstad: ready eddie | 01:27 |
| lbragstad | stevemar sure thing | 01:27 |
| *** ddieterly has quit IRC | 01:27 | |
| stevemar | lbragstad: no idea, haven't looked at this in a while :( | 01:27 |
| stevemar | dolphm: o/ | 01:27 |
| *** markvoelker has quit IRC | 01:28 | |
| *** markvoelker has joined #openstack-keystone | 01:35 | |
| *** EinstCrazy has joined #openstack-keystone | 01:38 | |
| *** wangqun_ has joined #openstack-keystone | 01:40 | |
| *** markvoelker has quit IRC | 01:40 | |
| *** esp has quit IRC | 01:41 | |
| *** gyee has quit IRC | 01:47 | |
| *** spzala has joined #openstack-keystone | 01:49 | |
| *** davechen has joined #openstack-keystone | 01:51 | |
| dolphm | lbragstad: you're kidding | 01:55 |
| lbragstad | dolphm nope | 01:56 |
| lbragstad | working through it now | 01:57 |
| dolphm | lbragstad: link to a failure? | 01:57 |
| stevemar | dolphm: want to join our hangout? | 01:57 |
| dolphm | is that where all the cool kids are? | 01:58 |
| lbragstad | dolphm yep | 01:58 |
| lbragstad | dolphm , unit.TestCase | 01:59 |
| lbragstad | dolphm https://hangouts.google.com/hangouts/_/4zl5wbdnbrh6vol7kctelsz4rue?authuser=0&hl=en | 01:59 |
| stevemar | dolphm: i feel funny about making a new required step in the upgrade path | 02:04 |
| *** markvoelker has joined #openstack-keystone | 02:04 | |
| stevemar | lbragstad: https://github.com/openstack-dev/grenade/tree/master/projects/10_keystone | 02:04 |
| *** chlong has joined #openstack-keystone | 02:05 | |
| dolphm | stevemar: required only if you're using credentials | 02:07 |
| dolphm | stevemar: but i agree - it's something we should be cautious about | 02:07 |
| stevemar | dolphm: refer to https://review.openstack.org/#/c/355618/49/keystone/common/sql/data_migration_repo/versions/003_migrate_unencrypted_credentials.py | 02:07 |
| lbragstad | dolphm well, it's in the migration | 02:07 |
| stevemar | dolphm: upgrade will fail | 02:07 |
| lbragstad | same with new installs | 02:08 |
| dolphm | lbragstad: maybe query for any credentials first, before reading the credential repo? | 02:08 |
| stevemar | new installs will fail if someone doesn't run credential_setup before running keystone | 02:08 |
| stevemar | thats what i said :) | 02:08 |
| stevemar | but then the entire API will be unusable until someone runs credentials_setup :) | 02:09 |
| *** phalmos has quit IRC | 02:10 | |
| stevemar | lbragstad: https://review.openstack.org/#/c/355618/49/keystone/common/sql/contract_repo/versions/003_remove_unencrypted_blob_column_from_credential.py | 02:12 |
| *** tqtran has quit IRC | 02:15 | |
| *** roxanaghe has joined #openstack-keystone | 02:15 | |
| *** browne has quit IRC | 02:19 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Typo: key_manger_factory to key_mangler_factory https://review.openstack.org/364619 | 02:19 |
| *** sdake has quit IRC | 02:21 | |
| *** fangxu has quit IRC | 02:23 | |
| *** su_zhang has joined #openstack-keystone | 02:23 | |
| *** markvoelker has quit IRC | 02:23 | |
| *** fangxu has joined #openstack-keystone | 02:25 | |
| *** tonytan4ever has quit IRC | 02:25 | |
| lbragstad | dolphm are you able to recreate the key repository issues locally? | 02:25 |
| *** fangxu has quit IRC | 02:26 | |
| lbragstad | dolphm do we want to pull these back into the provider? | 02:26 |
| lbragstad | Provider class, that is? | 02:27 |
| *** roxanaghe has quit IRC | 02:28 | |
| *** tonytan4ever has joined #openstack-keystone | 02:29 | |
| *** spzala has quit IRC | 02:30 | |
| *** su_zhang has quit IRC | 02:36 | |
| *** su_zhang has joined #openstack-keystone | 02:36 | |
| *** esp has joined #openstack-keystone | 02:38 | |
| *** su_zhang has quit IRC | 02:40 | |
| *** chrisshattuck has joined #openstack-keystone | 02:40 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/355618 | 02:54 |
| lbragstad | dolphm stevemar ^ | 02:54 |
| lbragstad | that's all passing for me locally | 02:54 |
| stevemar | lbragstad: one comment | 02:57 |
| lbragstad | stevemar responded | 02:59 |
| lbragstad | stevemar responded again | 03:02 |
| *** asettle has joined #openstack-keystone | 03:05 | |
| stevemar | lbragstad: responded again | 03:05 |
| stevemar | lbragstad: responded again again | 03:05 |
| stevemar | dolphm: i'll give you a final looksy | 03:05 |
| *** asettle has quit IRC | 03:10 | |
| *** __zouyee has joined #openstack-keystone | 03:20 | |
| stevemar | lbragstad: nooo py34 failures | 03:28 |
| stevemar | lbragstad: keystone.exception.CredentialEncryptionError: Credential could not be encrypted: Unicode-objects must be encoded before hashing | 03:29 |
| lbragstad | stevemar we need an encode for the hash_key?! | 03:42 |
| *** ianw has quit IRC | 03:46 | |
| *** links has joined #openstack-keystone | 03:46 | |
| *** tonytan_brb has joined #openstack-keystone | 03:47 | |
| *** tonytan4ever has quit IRC | 03:49 | |
| * stevemar shrugs at lbragstad | 03:53 | |
| lbragstad | stevemar running it locally | 03:54 |
| *** chlong has quit IRC | 04:01 | |
| *** esp has quit IRC | 04:07 | |
| *** fangxu has joined #openstack-keystone | 04:15 | |
| *** dikonoor has joined #openstack-keystone | 04:16 | |
| *** dikonoo has joined #openstack-keystone | 04:16 | |
| *** chrisshattuck has quit IRC | 04:17 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/355618 | 04:17 |
| lbragstad | stevemar i think it's fixed... | 04:17 |
| lbragstad | stevemar running all the tests now | 04:17 |
| lbragstad | well - starting with the py34 | 04:17 |
| lbragstad | and they passed | 04:18 |
| lbragstad | running py27 | 04:18 |
| *** chlong has joined #openstack-keystone | 04:18 | |
| stevemar | lbragstad: yay | 04:20 |
| stevemar | dolphm or dstanek around? | 04:20 |
| *** ianw has joined #openstack-keystone | 04:21 | |
| lbragstad | stevemar alright py27 tests passed locally, too | 04:25 |
| stevemar | lbragstad: ffs, pep8 failed, but not your fault | 04:25 |
| stevemar | lbragstad: "gate-keystone-pep8-ubuntu-xenial: POST_FAILURE" | 04:25 |
| lbragstad | serious.. | 04:25 |
| stevemar | i'm going to hit the rebase button | 04:25 |
| stevemar | so it gets bumped and recheked | 04:25 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/355618 | 04:25 |
| stevemar | done.. | 04:26 |
| lbragstad | stevemar yeah - pep8 passes locally | 04:26 |
| lbragstad | stevemar thansk | 04:26 |
| stevemar | lbragstad: dolphm and dstanek both +2ed, so i'm going to go ahead and +2/+W this one | 04:26 |
| lbragstad | stevemar do you know what the wait time on the gate queue is? | 04:28 |
| stevemar | lbragstad: only 2 patches deep | 04:28 |
| stevemar | lbragstad: and everything just had a post failure :| | 04:28 |
| stevemar | lbragstad: not yours though | 04:28 |
| lbragstad | stevemar 1 hour 10 minutes | 04:29 |
| stevemar | so you should get priority boarding lol | 04:29 |
| lbragstad | hopefully | 04:30 |
| *** spzala has joined #openstack-keystone | 04:30 | |
| stevemar | lbragstad: nope, post_failing all over the place | 04:33 |
| *** spzala has quit IRC | 04:35 | |
| stevemar | lbragstad: i don't see how this is a quick fix | 04:36 |
| lbragstad | post_failing? | 04:36 |
| *** evrardjp has quit IRC | 04:36 | |
| *** d34dh0r53 has quit IRC | 04:36 | |
| stevemar | lbragstad: yeah, look at the check and gate queues: http://status.openstack.org/zuul/ | 04:36 |
| stevemar | eveyrthing is red | 04:36 |
| lbragstad | "he's dead jim" | 04:36 |
| stevemar | lbragstad: pretty much | 04:37 |
| *** sigmavirus has quit IRC | 04:37 | |
| stevemar | the logs are saying nothing | 04:37 |
| lbragstad | stevemar so what's our plan | 04:37 |
| stevemar | lbragstad: merge it as a FFE and include it in rc1 i suppose | 04:37 |
| stevemar | lbragstad: in a few hours ttx is going to release keystone at whatever hash level i propose | 04:38 |
| lbragstad | ok | 04:38 |
| stevemar | lbragstad: i can't propose a hash that isn't merged :\ | 04:38 |
| lbragstad | stevemar agreed | 04:38 |
| stevemar | and the gate is, as you can see, dead | 04:38 |
| lbragstad | wanna consult in the morning? | 04:38 |
| lbragstad | I'm suppose to be out tomorrow afternoon but I'm around tomorrow morning to help with whatever I can | 04:39 |
| stevemar | lbragstad: we can recap and talk about merging this into rc1 | 04:39 |
| lbragstad | stevemar sounds good - i'll be on by 8 or earlier | 04:40 |
| stevemar | lbragstad: it definitely won't be going into newton-3 though, it's almost 7am in france, ttx will be releasing soon | 04:40 |
| lbragstad | 9 or earlier your time | 04:40 |
| lbragstad | yeah... | 04:40 |
| stevemar | lbragstad: i'll be up in a few hours (the kiddo will inevitably wake us once :) ) i can recheck the change again | 04:42 |
| stevemar | lbragstad: anyway, i'm off for now | 04:43 |
| stevemar | "he's dead jim" | 04:43 |
| lbragstad | stevemar same - ping on google if you need anyting | 04:43 |
| stevemar | lbragstad: thanks for the extra hours today | 04:43 |
| stevemar | i appreciate it ++ | 04:43 |
| lbragstad | no problem - you too | 04:43 |
| stevemar | your beers are on me in barcelona | 04:43 |
| lbragstad | lol - i'll hold ya to it ;) | 04:44 |
| *** tonytan_brb has quit IRC | 04:44 | |
| *** _sigmavirus24 has joined #openstack-keystone | 04:44 | |
| *** d34dh0r53 has joined #openstack-keystone | 04:47 | |
| *** evrardjp has joined #openstack-keystone | 04:48 | |
| *** ravelar has joined #openstack-keystone | 04:51 | |
| *** dolphm has quit IRC | 05:07 | |
| *** fungi has quit IRC | 05:08 | |
| *** lbragstad has quit IRC | 05:09 | |
| -openstackstatus- NOTICE: The logs volume is full causing jobs to fail with POST_FAILURE. This is being worked on, please do not recheck until notified. | 05:09 | |
| *** ChanServ changes topic to "The logs volume is full causing jobs to fail with POST_FAILURE. This is being worked on, please do not recheck until notified." | 05:09 | |
| *** dolphm has joined #openstack-keystone | 05:13 | |
| *** ChanServ sets mode: +o dolphm | 05:13 | |
| *** lbragstad has joined #openstack-keystone | 05:18 | |
| *** fungi has joined #openstack-keystone | 05:22 | |
| *** chlong has quit IRC | 05:27 | |
| *** adriant has quit IRC | 05:27 | |
| *** adriant has joined #openstack-keystone | 05:32 | |
| *** ravelar has quit IRC | 05:32 | |
| *** ChanServ changes topic to "Newton Deadlines: http://releases.openstack.org/newton/schedule.html | Meeting Agenda https://etherpad.openstack.org/p/keystone-weekly-meeting" | 05:35 | |
| -openstackstatus- NOTICE: Space has been freed up on the log server. If you have POST_FAILURE results it is now safe to issue a 'recheck' | 05:35 | |
| *** richm has quit IRC | 05:39 | |
| *** chlong has joined #openstack-keystone | 05:48 | |
| *** adriant has quit IRC | 06:19 | |
| *** woodster_ has quit IRC | 06:29 | |
| *** rcernin has joined #openstack-keystone | 06:40 | |
| *** pcaruana has joined #openstack-keystone | 06:48 | |
| *** chlong has quit IRC | 06:49 | |
| *** tesseract- has joined #openstack-keystone | 07:02 | |
| *** NishaYadav has joined #openstack-keystone | 07:07 | |
| *** NishaYadav is now known as Guest1044 | 07:07 | |
| *** brad[] has quit IRC | 07:09 | |
| *** Guest1044 has quit IRC | 07:09 | |
| *** brad[] has joined #openstack-keystone | 07:10 | |
| *** nisha_ has joined #openstack-keystone | 07:14 | |
| *** nisha_ has quit IRC | 07:25 | |
| *** spzala has joined #openstack-keystone | 07:30 | |
| *** spzala has quit IRC | 07:35 | |
| *** jpena|off is now known as jpena | 07:51 | |
| *** __zouyee has quit IRC | 07:58 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** fangxu has quit IRC | 08:00 | |
| *** fangxu has joined #openstack-keystone | 08:01 | |
| *** joerch has left #openstack-keystone | 08:04 | |
| openstackgerrit | Merged openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/355618 | 08:04 |
| openstackgerrit | Merged openstack/keystone: Typo: key_manger_factory to key_mangler_factory https://review.openstack.org/364619 | 08:05 |
| *** asettle has joined #openstack-keystone | 08:07 | |
| *** __zouyee has joined #openstack-keystone | 08:16 | |
| *** EinstCra_ has joined #openstack-keystone | 09:03 | |
| *** __zouyee has quit IRC | 09:03 | |
| *** code-R has joined #openstack-keystone | 09:06 | |
| *** EinstCrazy has quit IRC | 09:06 | |
| *** jaosorior has joined #openstack-keystone | 09:11 | |
| *** code-R_ has joined #openstack-keystone | 09:11 | |
| *** code-R has quit IRC | 09:13 | |
| *** __zouyee has joined #openstack-keystone | 09:17 | |
| stevemar | lbragstad: well this is awkward :) | 09:25 |
| stevemar | lbragstad: we released milestone 3 (without credential encryption) at 3 am | 09:26 |
| stevemar | lbragstad: andreas rechecked the credential encryption work and it merged at 4am | 09:26 |
| stevemar | so we'll have to revert it, or propose a FFE | 09:26 |
| *** __zouyee has quit IRC | 09:41 | |
| *** EinstCra_ has quit IRC | 09:48 | |
| *** NishaYadav has joined #openstack-keystone | 09:52 | |
| NishaYadav | o/ | 09:53 |
| *** joerch has joined #openstack-keystone | 09:54 | |
| *** EinstCrazy has joined #openstack-keystone | 10:02 | |
| *** EinstCrazy has quit IRC | 10:05 | |
| *** davechen has left #openstack-keystone | 10:10 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 10:10 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 10:10 |
| *** markvoelker has joined #openstack-keystone | 10:10 | |
| *** EinstCrazy has joined #openstack-keystone | 10:10 | |
| *** richm has joined #openstack-keystone | 10:12 | |
| *** EinstCrazy has quit IRC | 10:13 | |
| *** EinstCrazy has joined #openstack-keystone | 10:13 | |
| *** EinstCrazy has quit IRC | 10:14 | |
| *** EinstCrazy has joined #openstack-keystone | 10:15 | |
| *** kevinbenton has quit IRC | 10:15 | |
| *** kevinbenton has joined #openstack-keystone | 10:17 | |
| *** wangqun_ has quit IRC | 10:17 | |
| *** markvoelker has quit IRC | 10:22 | |
| *** EinstCrazy has quit IRC | 10:24 | |
| *** NishaYadav has quit IRC | 10:27 | |
| *** markvoelker has joined #openstack-keystone | 10:30 | |
| *** NishaYadav has joined #openstack-keystone | 10:33 | |
| *** NishaYadav is now known as Guest42370 | 10:33 | |
| samueldmq | morning keystone | 10:33 |
| *** nisha_ has joined #openstack-keystone | 10:36 | |
| *** nisha_ has quit IRC | 10:36 | |
| *** Guest42370 has quit IRC | 10:38 | |
| *** nisha_ has joined #openstack-keystone | 10:38 | |
| nisha_ | good morning samueldmq | 10:39 |
| *** markvoelker has quit IRC | 10:40 | |
| *** snecklifter has quit IRC | 10:44 | |
| *** snecklifter has joined #openstack-keystone | 10:45 | |
| samueldmq | nisha_: o/ | 10:45 |
| *** amakarov has joined #openstack-keystone | 10:51 | |
| *** dikonoor has quit IRC | 11:07 | |
| *** dikonoo has quit IRC | 11:07 | |
| *** afred312 has quit IRC | 11:07 | |
| *** darrenc has quit IRC | 11:07 | |
| *** lamt has quit IRC | 11:07 | |
| *** anteaya has quit IRC | 11:07 | |
| *** jidar has quit IRC | 11:07 | |
| *** dikonoor has joined #openstack-keystone | 11:09 | |
| *** dikonoo has joined #openstack-keystone | 11:09 | |
| *** afred312 has joined #openstack-keystone | 11:09 | |
| *** darrenc has joined #openstack-keystone | 11:09 | |
| *** lamt has joined #openstack-keystone | 11:09 | |
| *** anteaya has joined #openstack-keystone | 11:09 | |
| *** jidar has joined #openstack-keystone | 11:09 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: [WIP] Move fernet utils to backend https://review.openstack.org/356499 | 11:18 |
| *** dikonoor has quit IRC | 11:24 | |
| *** dikonoo has quit IRC | 11:25 | |
| *** dikonoor has joined #openstack-keystone | 11:25 | |
| *** dikonoo has joined #openstack-keystone | 11:25 | |
| *** jpena is now known as jpena|extendedlu | 11:28 | |
| *** jpena|extendedlu is now known as jpena|longlunch | 11:29 | |
| *** spzala has joined #openstack-keystone | 11:31 | |
| *** spzala has quit IRC | 11:35 | |
| *** aloga has quit IRC | 11:41 | |
| *** nisha__ has joined #openstack-keystone | 12:04 | |
| *** _sigmavirus24 is now known as sigmavirus | 12:05 | |
| *** sigmavirus has joined #openstack-keystone | 12:05 | |
| *** nisha__ is now known as nishaYadav | 12:05 | |
| *** ekarlso_ has joined #openstack-keystone | 12:05 | |
| *** raildo has joined #openstack-keystone | 12:06 | |
| *** nisha_ has quit IRC | 12:07 | |
| *** ekarlso_ has quit IRC | 12:11 | |
| *** flaper87 has quit IRC | 12:11 | |
| *** asettle has quit IRC | 12:13 | |
| *** __zouyee has joined #openstack-keystone | 12:27 | |
| *** rodrigods has quit IRC | 12:27 | |
| *** rodrigods has joined #openstack-keystone | 12:27 | |
| *** flaper87 has joined #openstack-keystone | 12:29 | |
| *** flaper87 has quit IRC | 12:29 | |
| *** flaper87 has joined #openstack-keystone | 12:29 | |
| *** rreimberg has joined #openstack-keystone | 12:37 | |
| *** jaosorior has quit IRC | 12:43 | |
| *** jaosorior has joined #openstack-keystone | 12:43 | |
| *** dikonoor has quit IRC | 12:52 | |
| dikonoo | bknudson :Hi | 12:52 |
| dikonoo | bknudson : I need another +2 for this to get merged. A very simple bug fix.https://review.openstack.org/#/c/359675/3 | 12:53 |
| dikonoo | bknudson: Could you take a look? | 12:53 |
| *** woodster_ has joined #openstack-keystone | 12:56 | |
| *** erhudy has joined #openstack-keystone | 12:58 | |
| bknudson | dikonoo: It's on my list of things to look at. | 13:03 |
| *** __zouyee has quit IRC | 13:03 | |
| dikonoo | bknudson : sure.Thanks | 13:04 |
| *** ezpz has joined #openstack-keystone | 13:04 | |
| lbragstad | stevemar hmm | 13:07 |
| *** pauloewerton has joined #openstack-keystone | 13:07 | |
| *** jaosorior has quit IRC | 13:09 | |
| *** ezpz has quit IRC | 13:09 | |
| *** asettle has joined #openstack-keystone | 13:13 | |
| *** BjoernT has joined #openstack-keystone | 13:14 | |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 13:14 | |
| *** aloga has joined #openstack-keystone | 13:15 | |
| *** spzala has joined #openstack-keystone | 13:16 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: [WIP] Move fernet utils to backend https://review.openstack.org/356499 | 13:16 |
| *** asettle has quit IRC | 13:19 | |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 13:22 | |
| *** dstanek has quit IRC | 13:25 | |
| *** madorn has quit IRC | 13:27 | |
| *** ayoung has joined #openstack-keystone | 13:29 | |
| *** ChanServ sets mode: +v ayoung | 13:29 | |
| *** dstanek has joined #openstack-keystone | 13:34 | |
| *** ChanServ sets mode: +v dstanek | 13:34 | |
| *** madorn has joined #openstack-keystone | 13:34 | |
| *** code-R_ has quit IRC | 13:39 | |
| *** links has quit IRC | 13:41 | |
| openstackgerrit | Doug Hellmann proposed openstack/python-keystoneclient: Update reno for stable/newton https://review.openstack.org/364944 | 13:42 |
| samueldmq | do we have the concept of x509 federated authentication ? | 13:46 |
| *** kevinbenton has quit IRC | 13:47 | |
| rodrigods | samueldmq, it is the "tokenless auth" | 13:49 |
| rodrigods | hmm "federated" | 13:49 |
| rodrigods | don't think so | 13:49 |
| *** su_zhang has joined #openstack-keystone | 13:49 | |
| bknudson | x509 authentication was added a couple of releases ago | 13:49 |
| samueldmq | I don't see the relation between users and certificates | 13:50 |
| samueldmq | thus not the relation between local vs federated in that context | 13:50 |
| bknudson | it maps the cn to a user or something | 13:50 |
| *** kevinbenton has joined #openstack-keystone | 13:50 | |
| rodrigods | it is more used for services users | 13:50 |
| rodrigods | since the services have a certificate in a tls env | 13:51 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone-specs/tree/specs/keystone/liberty/keystone-tokenless-authz-with-x509-ssl-client-cert.rst | 13:51 |
| samueldmq | hmm okay | 13:52 |
| samueldmq | so it uses the concept of mapping as well | 13:52 |
| samueldmq | http://docs.openstack.org/developer/keystone/configure_tokenless_x509.html | 13:52 |
| *** browne has joined #openstack-keystone | 13:52 | |
| samueldmq | just as federation does | 13:52 |
| rodrigods | yes, it gets the env vars exported by apache and maps to keystone concepts using mappings | 13:52 |
| samueldmq | rodrigods: bknudson: thanks for clarifying, I am looking at this cp spec : https://review.openstack.org/#/c/222293 | 13:54 |
| samueldmq | that talks a lot about that functionality | 13:54 |
| *** su_zhang has quit IRC | 13:55 | |
| *** su_zhang has joined #openstack-keystone | 13:55 | |
| *** ravelar has joined #openstack-keystone | 13:59 | |
| *** su_zhang has quit IRC | 13:59 | |
| *** su_zhang has joined #openstack-keystone | 14:00 | |
| *** tesseract- has quit IRC | 14:03 | |
| *** code-R has joined #openstack-keystone | 14:04 | |
| dstanek | i truly hate "D202 No blank lines allowed after function docstring" | 14:04 |
| lbragstad | dstanek here is a fix from dolphm's refactor a while back https://review.openstack.org/#/c/364986/ | 14:05 |
| dstanek | lbragstad: coolio, i'll take a look | 14:08 |
| dstanek | i suck at this vacation thing everyone talks about :-( | 14:09 |
| samueldmq | stevemar: it would be nice if a keystoner with experience in eventlet issues and why we dropped it voiced @ https://review.openstack.org/#/c/164035 | 14:09 |
| samueldmq | it's a cross-project spec talking about dropping eventlet support; and we've done it already! :) | 14:10 |
| samueldmq | keystone cores ^ | 14:10 |
| *** tesseract- has joined #openstack-keystone | 14:13 | |
| dstanek | lbragstad: dolphm: https://review.openstack.org/364562 | 14:13 |
| dstanek | not sure why the bot didn't report that in here.... | 14:13 |
| dstanek | oh, samueldmq. you already +2ed that before bknudson vetoed your vote | 14:14 |
| bknudson | I've got a veto? | 14:15 |
| dstanek | bknudson: you know you do and you love to use it | 14:16 |
| dstanek | bknudson: i added a test for my new functionality and as a bonus added a test for the original functionality (for free!) | 14:18 |
| openstackgerrit | Eric Brown proposed openstack/python-keystoneclient: Update reno for stable/newton https://review.openstack.org/364944 | 14:18 |
| *** spedione|AWAY is now known as spedione | 14:19 | |
| bknudson | dstanek: that's just a bot that I run that posts -1 when there's no test changes. | 14:20 |
| bknudson | I wish. | 14:20 |
| samueldmq | dstanek: 1 test + 1 for free ? I will take a look before it's sold out | 14:20 |
| *** nisha_ has joined #openstack-keystone | 14:22 | |
| bknudson | we should change the managers to use wrapt - https://wrapt.readthedocs.io/en/latest/ | 14:22 |
| bknudson | rather than maintaining our own crappy implementation | 14:22 |
| dstanek | bknudson: maybe, but i don't care about managing the 3 lines of code since it's easy to see what they do | 14:23 |
| dstanek | browne: breton: you guys may be working toward the same goal on backporting my cache invalidation patch | 14:23 |
| samueldmq | dstanek: I think your tests test_callable_passthru is not showing it is passing through | 14:24 |
| samueldmq | dstanek: if it was caching it would still pass I believe | 14:25 |
| dstanek | bknudson: i'll have to look into that a bit more. lots there to understand | 14:25 |
| dstanek | samueldmq: why is that? | 14:25 |
| *** nishaYadav has quit IRC | 14:25 | |
| *** asettle has joined #openstack-keystone | 14:25 | |
| dstanek | because the values are different? | 14:25 |
| browne | dstanek: looks it requires dogpile.cache 0.6.2, but mitaka is on 0.5.7 | 14:25 |
| dstanek | browne: yep, exactly | 14:25 |
| browne | what's the rules on updating upper-constraints in stable releases | 14:26 |
| dstanek | browne: breton was talking about getting some inspiration from some of the older patchsets that did the monkey patching | 14:26 |
| samueldmq | dstanek: no, test_property_passthru is okay asserting the values are different | 14:26 |
| *** ezpz has joined #openstack-keystone | 14:26 | |
| bknudson | upper-constraints only shows what the gate tests. The project's requirements.txt tells what versions are supported. | 14:26 |
| dstanek | browne: that i don't know because last time i asked i got two different answers. if you find the docs for it i'd love to see them | 14:26 |
| dstanek | samueldmq: oh i see. no if the value was cached it would always return the same number | 14:27 |
| samueldmq | dstanek: but test_callable_passthru is not correct I think, it passes anyways, because the cache would be the same anyways | 14:27 |
| dstanek | if you run that test against master you'll see it fail | 14:27 |
| browne | breton: feel free to take over my patch if you like. i just started the cherry-pick, because i need to test it out on mitaka | 14:28 |
| dstanek | samueldmq: in current paster mgr.p would be the same no matter how many times you call it | 14:28 |
| dstanek | i need to ensure they are always different in this test | 14:29 |
| samueldmq | dstanek: so it would be nice to prove with a counter too | 14:29 |
| samueldmq | dstanek: I commented out your change in the common manager | 14:29 |
| dstanek | samueldmq: prove what? | 14:29 |
| samueldmq | dstanek: and the tests still pass | 14:29 |
| dstanek | samueldmq: really? fails on master for me | 14:30 |
| dstanek | samueldmq: did you leave the setattr in? | 14:30 |
| samueldmq | dstanek: ah no, I commented it too | 14:30 |
| samueldmq | mb | 14:30 |
| samueldmq | dstanek: but test_callable_passthru still passes | 14:31 |
| dstanek | samueldmq: then you are not testing correctly. the original code was doing the setattr as a caching optimization and that's the problem :-) | 14:32 |
| *** gema has joined #openstack-keystone | 14:33 | |
| samueldmq | dstanek: if the manager caches Inner and method, the test passes | 14:33 |
| samueldmq | dstanek: if it does not, the test still passes | 14:34 |
| dstanek | samueldmq: oh, that test is just showing the existing behavior works. you get the thing you are asking ofr | 14:34 |
| *** su_zhang has quit IRC | 14:34 | |
| *** su_zhang has joined #openstack-keystone | 14:35 | |
| *** spedione is now known as spedione|AWAY | 14:36 | |
| samueldmq | dstanek: but if callable, it should not be a passthrough | 14:36 |
| samueldmq | but a cache instead? | 14:36 |
| dstanek | samueldmq: no, it should give back the thing. we use setattr so that we don't even trigger the __getattr__ for the second call | 14:37 |
| gema | I wonder if someone could help us figure out what public, internal and admin endpoints are supposed to be so that we can set them up correctly and expose them to the world ? | 14:37 |
| gema | the documentation is not helping a ton or we haven't found the right doc for this | 14:37 |
| dstanek | __getattr__ is expensive and is only called when you are asking for something that an object does not have. so after the first lookup we use setattr so that it will have it | 14:37 |
| samueldmq | dstanek: okay, so what was the issue with the previous behavior ? (setting the attribute in the manager too) | 14:38 |
| samueldmq | dstanek: ah, the case where attributes are dynamic ? | 14:38 |
| gema | (this is on newton) | 14:38 |
| dstanek | samueldmq: yes properties. the original code would look them up and save the value to the instance. so the property would not be invoked a second time | 14:39 |
| *** spedione|AWAY is now known as spedione | 14:39 | |
| *** su_zhang has quit IRC | 14:39 | |
| dstanek | bknudson: the assertIs wasn't working for some reason | 14:39 |
| dstanek | bknudson: they are clearly the same object http://paste.openstack.org/show/566090/ and when debugging had the same id | 14:40 |
| dstanek | i was in a rush so i didn't try to figure out what was going on | 14:40 |
| samueldmq | dstanek: ok, adding one more "contradiction" to my count, +2'ed as it is | 14:44 |
| samueldmq | let's see if bknudson likes it as it is too :-) | 14:45 |
| bknudson | I'm not in a rush | 14:46 |
| *** links has joined #openstack-keystone | 14:47 | |
| *** EinstCrazy has joined #openstack-keystone | 14:47 | |
| *** EinstCrazy has quit IRC | 14:52 | |
| stevemar | o/ | 14:53 |
| *** EinstCrazy has joined #openstack-keystone | 14:53 | |
| *** EinstCrazy has quit IRC | 14:55 | |
| *** thebloggu has joined #openstack-keystone | 14:55 | |
| *** phalmos has joined #openstack-keystone | 14:57 | |
| *** rcernin has quit IRC | 15:01 | |
| *** links has quit IRC | 15:03 | |
| bknudson | gerrit is slow | 15:05 |
| lbragstad | yup | 15:06 |
| dstanek | gerrit is not happy today | 15:07 |
| stevemar | gerrit is not in a rush, like bknudson | 15:08 |
| lbragstad | weekend started early ;) | 15:08 |
| dstanek | bknudson: samueldmq: i'm on vacation today - so i probably won't be around to address follow up comments until later in the afternoon | 15:08 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Few commands missing from configuration doc https://review.openstack.org/365022 | 15:08 |
| stevemar | browne: theres also credential_rotate and credential_migrate now | 15:11 |
| browne | oh ok, i can update | 15:12 |
| stevemar | anyone want to push https://review.openstack.org/#/c/359675/ ? | 15:13 |
| stevemar | it adds i18n support to a message in keystonemiddleware | 15:13 |
| *** pcaruana has quit IRC | 15:15 | |
| *** sdake has joined #openstack-keystone | 15:16 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Few new commands missing from docs https://review.openstack.org/365022 | 15:18 |
| *** jpena|longlunch is now known as jpena | 15:19 | |
| stevemar | browne: thanks for fixing all the release note patches +1 | 15:19 |
| browne | np | 15:20 |
| -openstackstatus- NOTICE: The Gerrit service on review.openstack.org is restarting quickly to relieve resource pressure and restore normal performance | 15:21 | |
| *** spzala has quit IRC | 15:26 | |
| *** chrisshattuck has joined #openstack-keystone | 15:26 | |
| *** phalmos has quit IRC | 15:28 | |
| *** spzala has joined #openstack-keystone | 15:29 | |
| *** spzala has quit IRC | 15:29 | |
| *** phalmos has joined #openstack-keystone | 15:29 | |
| *** code-R has quit IRC | 15:33 | |
| samueldmq | stevemar: I can do it in a couple of minutes, if nobody else does it first | 15:35 |
| *** arunkant has joined #openstack-keystone | 15:36 | |
| *** nisha_ has quit IRC | 15:39 | |
| *** tesseract- has quit IRC | 15:42 | |
| samueldmq | stevemar: does that need a release note ? | 15:42 |
| samueldmq | not sure it's a bug, mostly an enhacement ? | 15:43 |
| samueldmq | enhancement* | 15:43 |
| stevemar | samueldmq: huh? the i18n logging in keystonemiddleware? | 15:44 |
| samueldmq | stevemar: yes | 15:47 |
| samueldmq | stevemar: it's not a fix of a real bug (even if there is one registered), just an enhancement | 15:47 |
| samueldmq | so perhaps it's fine as it is | 15:47 |
| stevemar | samueldmq: first rderose asks for a test then you ask for a release note :) | 15:48 |
| stevemar | samueldmq: its such a tiny change lol | 15:48 |
| samueldmq | stevemar: in that case it'd be nice to have a test for the release note too | 15:48 |
| stevemar | *shakes fist* | 15:48 |
| samueldmq | stevemar: +A :-) | 15:48 |
| dims | rderose : Ron, my brain is still parsing your nick as "redrose"... | 15:54 |
| samueldmq | dims: lol I had never thought it like that :-) | 15:55 |
| dims | samueldmq : if you liked that, try this http://www.dailywritingtips.com/cna-yuo-raed-tihs/ | 15:57 |
| *** chrisshattuck has quit IRC | 15:57 | |
| *** phalmos has quit IRC | 15:58 | |
| samueldmq | dims: lol nice, I saw that once in Portuguese; I was able to read it in English too | 15:58 |
| samueldmq | brain rocks | 15:58 |
| dims | totally :) | 15:58 |
| stevemar | dims: hehe, it's a good tea :) | 15:58 |
| *** chrisshattuck has joined #openstack-keystone | 16:00 | |
| lbragstad | stevemar dolphm dstanek added more docs for credential encryption - https://gist.github.com/lbragstad/ddfb10f9f9048414d1f781ba006e95d1#encrypted-credential-key-management | 16:03 |
| *** roxanaghe has joined #openstack-keystone | 16:10 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Update reno for stable/newton https://review.openstack.org/362414 | 16:11 |
| ayoung | What did we do with the API docs? | 16:11 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Add doctor checks for credential fernet keys https://review.openstack.org/365049 | 16:12 |
| ayoung | stevemar, we pulled API out of http://git.openstack.org/cgit/openstack/keystone-specs/tree/ where did we put it? | 16:12 |
| *** tonytan4ever has joined #openstack-keystone | 16:13 | |
| *** tonytan_brb has joined #openstack-keystone | 16:19 | |
| *** asettle has quit IRC | 16:21 | |
| *** tonytan4ever has quit IRC | 16:22 | |
| *** dims has quit IRC | 16:23 | |
| *** gyee has joined #openstack-keystone | 16:24 | |
| * samueldmq ayoung: https://github.com/openstack/keystone/tree/master/api-ref/source | 16:25 | |
| samueldmq | ayoung: https://github.com/openstack/keystone/tree/master/api-ref/source | 16:26 |
| samueldmq | not sure where /me came from | 16:26 |
| openstackgerrit | Merged openstack/python-keystoneclient: Remove deprecated 'data' credential argument https://review.openstack.org/352567 | 16:26 |
| lbragstad | samueldmq my textual client does that sometimes | 16:26 |
| lbragstad | https://www.google.com/ | 16:26 |
| lbragstad | tried to get it to happen ^ | 16:26 |
| samueldmq | lbragstad: hmm | 16:26 |
| samueldmq | lbragstad: hehe, I am using irccloud | 16:27 |
| lbragstad | sometimes when i paste only links, it somehow interprets it as /me <link> | 16:27 |
| samueldmq | lbragstad: looks to be the case that just happened to me | 16:27 |
| *** amakarov is now known as amakarov_away | 16:28 | |
| *** dims has joined #openstack-keystone | 16:32 | |
| samueldmq | lbragstad: doctor takes the docstring and prints it out ? | 16:40 |
| *** ebalduf_ has joined #openstack-keystone | 16:41 | |
| *** rdo_ has joined #openstack-keystone | 16:43 | |
| openstackgerrit | Merged openstack/keystoneauth: Update reno for stable/newton https://review.openstack.org/362412 | 16:43 |
| *** tqtran has joined #openstack-keystone | 16:43 | |
| *** rdo_ has quit IRC | 16:43 | |
| *** esp has joined #openstack-keystone | 16:46 | |
| lbragstad | samueldmq | 16:47 |
| lbragstad | samueldmq yep | 16:47 |
| samueldmq | lbragstad: cool | 16:48 |
| *** su_zhang has joined #openstack-keystone | 16:50 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Globalize authentication failure error https://review.openstack.org/359675 | 16:56 |
| stevemar | ayoung: yeah, the source is here: https://github.com/openstack/keystone/tree/master/api-ref/source and gets rendered here: http://developer.openstack.org/api-ref/identity/v3/index.html | 17:01 |
| stevemar | ayoung: for the sake of backing up, all the old stuff is here: https://github.com/openstack/keystone-specs/tree/master/attic | 17:02 |
| stevemar | ayoung: the new published APIs should have parity with the old stuff | 17:02 |
| stevemar | ayoung: we had an API sprint a few weeks back if you recall | 17:03 |
| stevemar | and folks have been cleaning up whatever lingered from the sprint | 17:03 |
| lbragstad | stevemar i'm out for the afternoon - ping me on google hangout if you need anything | 17:07 |
| lbragstad | i'll be on the road until 5 | 17:08 |
| *** roxanaghe has quit IRC | 17:10 | |
| *** roxanaghe has joined #openstack-keystone | 17:10 | |
| *** ddieterly has joined #openstack-keystone | 17:12 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Add doctor checks for credential fernet keys https://review.openstack.org/365049 | 17:16 |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 17:16 | |
| *** ddieterly has quit IRC | 17:19 | |
| *** chrisshattuck has quit IRC | 17:19 | |
| *** ddieterly has joined #openstack-keystone | 17:25 | |
| *** markvoelker has joined #openstack-keystone | 17:29 | |
| stevemar | lbragstad: let's deal with the ffe on monday | 17:29 |
| stevemar | err tuesday | 17:29 |
| stevemar | long weekend for most | 17:29 |
| *** ddieterly is now known as ddieterly[away] | 17:31 | |
| *** phalmos has joined #openstack-keystone | 17:32 | |
| samueldmq | stevemar: ffe ? | 17:33 |
| samueldmq | stevemar: for what ? | 17:33 |
| *** markvoelker has quit IRC | 17:34 | |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 17:34 | |
| *** markvoelker has joined #openstack-keystone | 17:34 | |
| -openstackstatus- NOTICE: The infrastructure team is taking Gerrit offline for maintenance, beginning shortly after 18:00 UTC for a potentially 4 hour maintenance window. | 17:38 | |
| stevemar | samueldmq: credential encryption | 17:39 |
| samueldmq | stevemar: oh I thought that was in before yesterday's cut | 17:39 |
| *** phalmos has quit IRC | 17:42 | |
| *** ebalduf_ has quit IRC | 17:46 | |
| *** phalmos has joined #openstack-keystone | 17:47 | |
| *** adrian_otto has joined #openstack-keystone | 17:49 | |
| *** thebloggu has quit IRC | 17:52 | |
| *** chrisshattuck has joined #openstack-keystone | 17:53 | |
| *** fangxu has quit IRC | 17:57 | |
| stevemar | samueldmq: nope! | 17:58 |
| *** ravelar has quit IRC | 17:58 | |
| stevemar | samueldmq: we tagged at 816d26046af0482aa52a5b8faafe8ed1591cf8c6 | 17:58 |
| stevemar | https://github.com/openstack/keystone/commits/master | 17:59 |
| stevemar | so Merge "Fixes spelling mistakes" | 17:59 |
| samueldmq | stevemar: so it was mitaka-3 rc1 ? | 18:00 |
| *** jpena is now known as jpena|off | 18:01 | |
| *** su_zhang has quit IRC | 18:01 | |
| stevemar | newton rc1 ;) | 18:01 |
| samueldmq | stevemar: ah , yes | 18:02 |
| *** ravelar has joined #openstack-keystone | 18:04 | |
| -openstackstatus- NOTICE: Gerrit is now going offline for maintenance, reserving a maintenance window through 22:00 UTC. | 18:04 | |
| *** ChanServ changes topic to "Gerrit is now going offline for maintenance, reserving a maintenance window through 22:00 UTC." | 18:04 | |
| samueldmq | poor gerrit | 18:05 |
| *** su_zhang has joined #openstack-keystone | 18:05 | |
| *** su_zhang has quit IRC | 18:07 | |
| *** chrisshattuck has quit IRC | 18:07 | |
| *** ravelar has quit IRC | 18:12 | |
| jaugustine | Sounds like it's time for the weekend ! ;) | 18:13 |
| *** ddieterly[away] is now known as ddieterly | 18:20 | |
| *** spzala has joined #openstack-keystone | 18:20 | |
| EmilienM | stevemar: hello | 18:22 |
| stevemar | EmilienM: o/ | 18:22 |
| stevemar | lbragstad or dolphm around? | 18:22 |
| * EmilienM invokes Keystone gods | 18:23 | |
| stevemar | well lbragstad probably won't be around... | 18:23 |
| stevemar | "lbragstad: stevemar i'm out for the afternoon - ping me on google hangout if you need anything" | 18:23 |
| * dolphm is also sort of not here | 18:23 | |
| stevemar | EmilienM: you're stuck with me! | 18:23 |
| EmilienM | stevemar: between canadians :P | 18:23 |
| stevemar | EmilienM: so read the third point over here: http://docs.openstack.org/releasenotes/keystone/unreleased.html#upgrade-notes | 18:23 |
| stevemar | errr 4th point | 18:24 |
| * EmilienM reading | 18:24 | |
| EmilienM | stevemar: ok but our CI doesn't do upgrades | 18:24 |
| EmilienM | it's fresh installs | 18:24 |
| *** dikonoo has quit IRC | 18:25 | |
| *** spzala has quit IRC | 18:25 | |
| *** fangxu has joined #openstack-keystone | 18:25 | |
| *** gyee has quit IRC | 18:25 | |
| stevemar | EmilienM: right, so that kinda of implies that you've "upgraded" all the way, which means we no longer support storing unencrypted credentials, they have to be encrypted now | 18:25 |
| stevemar | Deployers must run keystone-manage credential_setup in order to use the credential API within Newton | 18:26 |
| EmilienM | ok | 18:26 |
| EmilienM | I'm going to investigate our we do in puppet keystone and I'll let you knpow | 18:26 |
| EmilienM | thanks | 18:26 |
| *** spzala has joined #openstack-keystone | 18:26 | |
| EmilienM | stevemar: is it a problem on multi keystone servers? | 18:26 |
| stevemar | EmilienM: are they sharing the same database? | 18:26 |
| *** phalmos has quit IRC | 18:26 | |
| EmilienM | stevemar: yes | 18:27 |
| EmilienM | in tripleo we don't use fernet anyway so | 18:27 |
| EmilienM | I guess that's fine? | 18:27 |
| EmilienM | the encryption is in db? | 18:27 |
| stevemar | EmilienM: that's fine, fernet is just a technique for encrypting things, this is totally different from fernet tokens | 18:28 |
| stevemar | yes, the values in the db will be encrypted | 18:28 |
| stevemar | this is where i wish lbragstad and dolphm were around :) | 18:28 |
| stevemar | EmilienM: i want to say that you'll have to run credential_setup on each server, but they'd know better than i | 18:29 |
| EmilienM | ayoung: https://bugs.launchpad.net/keystone/+bug/1619758/comments/1 | 18:29 |
| openstack | Launchpad bug 1619758 in tripleo "Credential Encryption breaks deployments without Fernet" [Undecided,New] | 18:29 |
| EmilienM | stevemar: ok i'm doing this work now | 18:29 |
| *** ravelar has joined #openstack-keystone | 18:29 | |
| EmilienM | stevemar: thanks ! (lol) | 18:29 |
| EmilienM | stevemar: it was friday | 18:29 |
| EmilienM | and I was about to leave | 18:29 |
| EmilienM | and you broke my afternoon. | 18:29 |
| stevemar | EmilienM: :( | 18:30 |
| *** phalmos has joined #openstack-keystone | 18:30 | |
| *** spzala has quit IRC | 18:30 | |
| stevemar | EmilienM: more info here: https://github.com/openstack-dev/devstack/commit/69d4a71dfe86e8111101dcd1bcf5a4138a7956a4 and here: https://github.com/openstack-dev/grenade/blob/master/projects/10_keystone/from-mitaka/upgrade-keystone | 18:31 |
| ayoung | stevemar, going to write a no-op driver | 18:32 |
| ayoung | we'll make that the default | 18:32 |
| EmilienM | lol | 18:32 |
| ayoung | stevemar, We are not forcing Fernet Keys on Tripleo. It is not a feasable task | 18:33 |
| EmilienM | stevemar: it's a bit sad to see this kind of change just before a release | 18:33 |
| *** su_zhang has joined #openstack-keystone | 18:33 | |
| ayoung | EmilienM, meh, its expected | 18:33 |
| EmilienM | stupid question: is there something else I should know? | 18:33 |
| ayoung | we need the feature, we just can't make it the default without an alternative | 18:33 |
| *** ravelar has quit IRC | 18:34 | |
| *** chrisshattuck has joined #openstack-keystone | 18:34 | |
| EmilienM | ok puppet-keystone doesn't have credential_setup support | 18:34 |
| EmilienM | i'm adding it by default | 18:34 |
| ayoung | EmilienM, that will break the credential backend | 18:35 |
| ayoung | we have three Keystone servers. If each generates and uses their own sym keys, and talk to the same database, one will encrypt with one key, and another will try to decrypt with a different one and fail | 18:35 |
| ayoung | we need key sync and rotation. | 18:35 |
| ayoung | We need Kite | 18:36 |
| ayoung | but that kite has sailed | 18:36 |
| EmilienM | so Keystone is currently broken if you run multiple keystone servers? | 18:36 |
| notmorgan | oh snap, rderose is core. | 18:36 |
| notmorgan | ;) | 18:36 |
| notmorgan | ayoung: no-op for what? | 18:37 |
| * notmorgan is reading backscroll. | 18:37 | |
| *** roxanaghe has quit IRC | 18:37 | |
| ayoung | notmorgan, credential encryption using the sym keys from fernet | 18:37 |
| * notmorgan has also been driving for 2 full days...sooooo | 18:37 | |
| notmorgan | ayoung: oh. yeah. | 18:37 |
| ayoung | and pretty sure that driver should not be called Fernet, as it is just encrypting | 18:37 |
| ayoung | not Fernetting | 18:37 |
| notmorgan | ayoung: i would call it AES :P | 18:37 |
| notmorgan | ayoung: as that is what it is. | 18:38 |
| ayoung | notmorgan, ++ | 18:38 |
| notmorgan | ayoung: i mean it is using HMAC(AES(payload)) but i mean.. standard way to "do it right" | 18:38 |
| ayoung | AES is about right | 18:39 |
| notmorgan | fernet is just a wrapper for exactly that. | 18:39 |
| ayoung | sure...and Fernet is a fine name. | 18:39 |
| ayoung | I see that it really is doing Fernet....good enough | 18:39 |
| notmorgan | but it is less about the "fernet" model of use (tokens with a payload) and more about the AES part in this case | 18:39 |
| notmorgan | but i would call it AES personally - but renaming it now... mayyyyyy not be worth the headache | 18:40 |
| EmilienM | stevemar: at what time should I run credential_setup ? | 18:40 |
| EmilienM | right after bootstrap? | 18:40 |
| EmilienM | or after fernet_setup ? | 18:40 |
| notmorgan | EmilienM: before or after fernet_setup is fine | 18:40 |
| notmorgan | EmilienM: it is just another fernet-like repository of keys | 18:40 |
| notmorgan | EmilienM: fernet_setup has no impace on credential_setup and vice-versa | 18:40 |
| EmilienM | before or after keystone-manage bootstrap ? | 18:41 |
| notmorgan | vise-versa? | 18:41 |
| EmilienM | vice-versa | 18:41 |
| notmorgan | EmilienM: wont matter as long as the config has the repo location defined | 18:41 |
| notmorgan | keystone-manage bootstrap is setting up the DB itself. | 18:41 |
| notmorgan | w/ user/roles/project/etc | 18:41 |
| openstackgerrit | ayoung proposed openstack/keystone: No Op provider for credential encryption https://review.openstack.org/365087 | 18:41 |
| EmilienM | ok good. Thanks. | 18:41 |
| dolphm | EmilienM: stevemar: it's a lot like the pattern for setting up fernet tokens -- you'll need to run credential_setup *once* on *one* server, sync the keys around, and you're good to go. there are operations to rotate keys, but there's no reason any of that should be a a regular operation (unless you think the database is compromised, or something) | 18:41 |
| notmorgan | credential data isn't touched by that | 18:41 |
| stevemar | EmilienM: sorry, was on a call for 10 minutes, i'd say after bootstrap is fine | 18:41 |
| EmilienM | ok | 18:42 |
| ayoung | dolphm, that is not a trivial amount of infrastructure to write | 18:42 |
| notmorgan | EmilienM: i generally would make bootstrap *always* first (best practice) | 18:42 |
| EmilienM | ayoung: how are we going to do for tripleo? | 18:42 |
| ayoung | you are talking a bout syncing crypto keys | 18:42 |
| notmorgan | EmilienM: the other stuff is all interchangable. | 18:42 |
| ayoung | EmilienM, I started an etherpad | 18:42 |
| EmilienM | ayoung: use noop? | 18:42 |
| ayoung | EmilienM, https://etherpad.openstack.org/p/keystone-fernet-token-cms | 18:42 |
| ayoung | EmilienM, that is a bandaid | 18:42 |
| ayoung | no-op will be the default in Keystone. We can't force people to Fernet | 18:43 |
| EmilienM | right | 18:43 |
| notmorgan | ayoung: NSS! USE NSS! I mean... | 18:43 |
| ayoung | once we have a key sync/rotate story in place, we can deprecate no-op and migrate people to fernet | 18:43 |
| notmorgan | ayoung: /me goes back under a rock. | 18:43 |
| ayoung | notmorgan, works for me | 18:43 |
| ayoung | notmorgan, CMS | 18:43 |
| notmorgan | hehe | 18:43 |
| dolphm | ayoung: you can also generate keys on the orchestration host and ship them to other servers | 18:44 |
| dolphm | ayoung: no need to use keystone's native credential_setup command | 18:44 |
| notmorgan | dolphm: do we have an ansible playbook for that pattern yet? | 18:44 |
| dolphm | it just creates a directory and populates it with a couple keys | 18:44 |
| ayoung | dolphm, yep, and that is what we are planning on doing. | 18:44 |
| notmorgan | dolphm: it feels like we should. | 18:44 |
| dolphm | notmorgan: not in OSA - they don't want credentials touching the ansible host | 18:44 |
| ayoung | dolphm, so, to do it right implies each of the Keystone servers has a way to decrypt messages means just for it | 18:44 |
| ayoung | it is actually really really close to the Kite use case | 18:45 |
| notmorgan | dolphm: no, i mean a general playbook that could be used for "genering/syncing" keys | 18:45 |
| notmorgan | regardless of *where* they are | 18:45 |
| ayoung | only we need this to work without Keystone auth | 18:45 |
| dolphm | notmorgan: oh, i think lance does | 18:45 |
| dolphm | notmorgan: he has like a fernet_rotate ansible playbook | 18:45 |
| *** fangxu has quit IRC | 18:45 | |
| notmorgan | dolphm: make sure that gets pubished up in some place "official"-ish | 18:45 |
| notmorgan | lbragstad: ^ | 18:45 |
| ayoung | EmilienM, once we have the FreeIPA integration, we will have a X509 story, and with that, a way to transport the keys | 18:45 |
| dolphm | notmorgan: where would ansible playbook go, officially, if they're not part of openstack-ansible? | 18:45 |
| notmorgan | because it should be something usable in general | 18:45 |
| EmilienM | ayoung: ok | 18:46 |
| EmilienM | ayoung: but how are we going to do for newton? | 18:46 |
| ayoung | without that, we have the risk if we did, say ,a Heat artifact, where the tarball would be world readable in the metadata. | 18:46 |
| EmilienM | the release is almost out | 18:46 |
| EmilienM | and this thing just happens | 18:46 |
| ayoung | EmilienM, for Newton, we use No Op | 18:46 |
| notmorgan | dolphm: i'd ask rbergeron | 18:46 |
| notmorgan | dolphm: she might have some guidance for that. | 18:46 |
| notmorgan | (she's not in this channel) | 18:46 |
| ayoung | notmorgan, the Ansible vault is password based. Would be kindof yucky to use for this | 18:46 |
| dolphm | EmilienM: it's about 2 lines of python to create a fernet key - drop that in a file and you're done | 18:47 |
| notmorgan | ayoung: the "general key" and "sync" key doesn't need to be tied to vault | 18:47 |
| dolphm | EmilienM: from cryptography.fernet import Fernet; print(Fernet.generate_key()) | 18:47 |
| notmorgan | ayoung: but i agree, vault would be like trying to use barbican for holding the fernet keys. (but barbican would be worse in this case) | 18:48 |
| stevemar | every time notmorgan slowly disappears http://i.imgur.com/9rMgh5I.gif | 18:48 |
| *** ravelar has joined #openstack-keystone | 18:48 | |
| notmorgan | stevemar: right? | 18:48 |
| stevemar | :) | 18:48 |
| EmilienM | all of this a Friday afternoon | 18:49 |
| dolphm | EmilienM: lbragstad also wrote a long step by step on a full migration w/ encrypted credentials if that helps you any https://gist.github.com/lbragstad/ddfb10f9f9048414d1f781ba006e95d1#file-migration-md | 18:50 |
| * notmorgan has to write code around rev-events once this next phonecall is done | 18:50 | |
| * dolphm has to step away | 18:50 | |
| EmilienM | dolphm: thx | 18:50 |
| notmorgan | dolphm: don't step, RUN! :) | 18:50 |
| notmorgan | dolphm: hide! :P | 18:50 |
| *** phalmos has quit IRC | 18:51 | |
| *** adelia has joined #openstack-keystone | 18:54 | |
| *** su_zhang has quit IRC | 18:57 | |
| *** su_zhang has joined #openstack-keystone | 18:57 | |
| *** ravelar has quit IRC | 18:59 | |
| *** su_zhang has quit IRC | 19:00 | |
| EmilienM | is it a big deal if I configure credential/key_repository all the time? is there some cases where we should not configure it? | 19:01 |
| EmilienM | ie: if I use a specific driver, etc | 19:01 |
| EmilienM | stevemar: ^ | 19:01 |
| stevemar | EmilienM: you can configure it if you want | 19:02 |
| stevemar | EmilienM: there's a reasonable default | 19:02 |
| EmilienM | what is the default? | 19:02 |
| *** sdake has quit IRC | 19:02 | |
| EmilienM | well i can fin dit | 19:02 |
| stevemar | EmilienM: https://github.com/openstack/keystone/blob/master/keystone/conf/credential.py#L39 | 19:03 |
| stevemar | '/etc/keystone/credential-keys/' | 19:03 |
| EmilienM | /etc/keystone/credential-keys/ | 19:03 |
| rodrigods | https://review.openstack.org/#/c/365087/1 | 19:03 |
| EmilienM | ok thanks | 19:03 |
| rodrigods | EmilienM, stevemar ^ | 19:03 |
| rodrigods | ok, stepped in the end of the conversation :P | 19:04 |
| *** ddieterly is now known as ddieterly[away] | 19:10 | |
| *** ChanServ changes topic to "Newton Deadlines: http://releases.openstack.org/newton/schedule.html | Meeting Agenda https://etherpad.openstack.org/p/keystone-weekly-meeting" | 19:13 | |
| -openstackstatus- NOTICE: Gerrit is completing an online re-index, you may encounter slowness until it is complete | 19:13 | |
| samueldmq | ayoung: the admin role is only global if it's assigned on the admin_project. is that right ? | 19:17 |
| *** ddieterly[away] is now known as ddieterly | 19:17 | |
| *** Nakato has quit IRC | 19:17 | |
| ayoung | EmilienM, samueldmq not yet | 19:18 |
| *** spzala has joined #openstack-keystone | 19:18 | |
| samueldmq | ayoung: ok, so it continues to have global privilegies | 19:18 |
| ayoung | samueldmq, a whole slew of changes need to creep through the variuous projects to kill that pariticular bug | 19:18 |
| *** Nakato has joined #openstack-keystone | 19:19 | |
| samueldmq | ayoung: ok. I am reading jamielennox|away and dolphm's spec on more granular roles in the cross-project repo | 19:19 |
| samueldmq | and I had that question, because it assumes that admin is still global (and it is correct) | 19:20 |
| *** spzala has quit IRC | 19:23 | |
| openstackgerrit | ayoung proposed openstack/keystone: No Op provider for credential encryption https://review.openstack.org/365087 | 19:24 |
| *** spzala has joined #openstack-keystone | 19:29 | |
| topol | dolphm you around? | 19:30 |
| topol | k try that | 19:31 |
| topol | dstanek, you around? | 19:31 |
| *** su_zhang has joined #openstack-keystone | 19:31 | |
| dstanek | topol: maybe, what's up? | 19:33 |
| *** spzala has quit IRC | 19:34 | |
| topol | dstanek, So Im leading a workgroup that's focused on driving the OpenStack Interoperability Challenge https://wiki.openstack.org/wiki/Interop_Challenge | 19:35 |
| *** ddieterly is now known as ddieterly[away] | 19:35 | |
| *** spzala has joined #openstack-keystone | 19:36 | |
| topol | dstanek, we have some agreed to workloads. We have them running on BlueBox. We wanted to test on RAX public cloud. Anyway to get me a free account for testing purposes/ | 19:36 |
| topol | ? | 19:36 |
| dstanek | topol: maybe i can ask as see who i need to talk to about that | 19:36 |
| topol | K, cool | 19:36 |
| *** su_zhang has quit IRC | 19:37 | |
| *** markvoelker has quit IRC | 19:37 | |
| topol | dstanek Egle Sigler would be aware of this effort if that helps | 19:38 |
| topol | dstaenk otherwise I pull out my credit card. but that would take away from my budget of buying you drinks in Barcelona :-) | 19:38 |
| topol | dstanek ^ | 19:38 |
| dstanek | lol | 19:38 |
| *** roxanaghe has joined #openstack-keystone | 19:39 | |
| *** ddieterly[away] is now known as ddieterly | 19:39 | |
| *** ezpz has quit IRC | 19:40 | |
| *** spzala has quit IRC | 19:40 | |
| *** links has joined #openstack-keystone | 19:43 | |
| dstanek | topol: email initiated. i'll let you know what i find out. | 19:47 |
| *** chrisshattuck has quit IRC | 19:47 | |
| *** chrisshattuck has joined #openstack-keystone | 19:49 | |
| *** su_zhang has joined #openstack-keystone | 19:50 | |
| topol | dstanek, cool thanks. I'll remind my wallet of your help in Barcelona :-) | 19:50 |
| *** ddieterly is now known as ddieterly[away] | 19:51 | |
| *** links has quit IRC | 19:55 | |
| *** spzala has joined #openstack-keystone | 19:56 | |
| *** su_zhang has quit IRC | 19:56 | |
| *** gyee has joined #openstack-keystone | 19:56 | |
| *** openstackgerrit has quit IRC | 20:04 | |
| *** openstackgerrit has joined #openstack-keystone | 20:04 | |
| *** tqtran has quit IRC | 20:07 | |
| *** spzala has quit IRC | 20:10 | |
| *** spzala has joined #openstack-keystone | 20:14 | |
| *** ddieterly[away] is now known as ddieterly | 20:14 | |
| *** su_zhang has joined #openstack-keystone | 20:14 | |
| *** roxanaghe has quit IRC | 20:15 | |
| *** spzala has quit IRC | 20:18 | |
| *** spedione is now known as spedione|AWAY | 20:20 | |
| *** BjoernT has quit IRC | 20:20 | |
| *** tonytan_brb has quit IRC | 20:42 | |
| *** rreimberg has quit IRC | 20:42 | |
| *** markvoelker has joined #openstack-keystone | 20:47 | |
| *** erhudy has quit IRC | 20:52 | |
| openstackgerrit | ayoung proposed openstack/keystone: No Op provider for credential encryption https://review.openstack.org/365087 | 20:54 |
| *** tqtran has joined #openstack-keystone | 20:54 | |
| *** ddieterly is now known as ddieterly[away] | 20:58 | |
| *** browne has quit IRC | 21:00 | |
| openstackgerrit | ayoung proposed openstack/keystone: No Op provider for credential encryption https://review.openstack.org/365087 | 21:06 |
| openstackgerrit | ayoung proposed openstack/keystone: No Op provider for credential encryption https://review.openstack.org/365087 | 21:08 |
| *** su_zhang has quit IRC | 21:11 | |
| *** roxanaghe has joined #openstack-keystone | 21:11 | |
| *** raildo has quit IRC | 21:11 | |
| *** ayoung has quit IRC | 21:13 | |
| *** su_zhang has joined #openstack-keystone | 21:14 | |
| *** gyee has quit IRC | 21:16 | |
| *** pauloewerton has quit IRC | 21:17 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Update reno for stable/newton https://review.openstack.org/364944 | 21:18 |
| *** sdake has joined #openstack-keystone | 21:19 | |
| *** adelia has quit IRC | 21:21 | |
| *** chrisshattuck has quit IRC | 21:23 | |
| *** roxanaghe has quit IRC | 21:28 | |
| *** roxanaghe has joined #openstack-keystone | 21:30 | |
| *** chrisshattuck has joined #openstack-keystone | 21:31 | |
| *** chrisshattuck has quit IRC | 21:31 | |
| *** gyee has joined #openstack-keystone | 21:32 | |
| *** chrisshattuck has joined #openstack-keystone | 21:32 | |
| *** chrisshattuck has quit IRC | 21:36 | |
| *** browne has joined #openstack-keystone | 21:36 | |
| *** chrisshattuck has joined #openstack-keystone | 21:37 | |
| *** roxanaghe has quit IRC | 21:37 | |
| *** chrisshattuck has quit IRC | 21:38 | |
| openstackgerrit | Merged openstack/keystone: Few new commands missing from docs https://review.openstack.org/365022 | 21:39 |
| *** roxanaghe has joined #openstack-keystone | 21:40 | |
| *** ianw has quit IRC | 21:40 | |
| *** chrisshattuck has joined #openstack-keystone | 21:41 | |
| *** chrisshattuck has quit IRC | 21:42 | |
| *** tonytan4ever has joined #openstack-keystone | 21:42 | |
| *** chrisshattuck has joined #openstack-keystone | 21:43 | |
| *** woodburn has quit IRC | 21:44 | |
| *** woodburn has joined #openstack-keystone | 21:44 | |
| *** chrisshattuck has quit IRC | 21:45 | |
| *** chrisshattuck has joined #openstack-keystone | 21:47 | |
| *** tonytan4ever has quit IRC | 21:48 | |
| *** chrisshattuck has quit IRC | 21:48 | |
| *** chrisshattuck has joined #openstack-keystone | 21:52 | |
| *** chrisshattuck has quit IRC | 21:53 | |
| *** jefrite has quit IRC | 21:58 | |
| *** ddieterly[away] has quit IRC | 21:58 | |
| breton | browne: thanks, i will | 22:04 |
| *** ianw has joined #openstack-keystone | 22:11 | |
| *** david-lyle has quit IRC | 22:15 | |
| *** browne has quit IRC | 22:16 | |
| *** jefrite has joined #openstack-keystone | 22:16 | |
| *** david-lyle has joined #openstack-keystone | 22:17 | |
| *** su_zhang has quit IRC | 22:26 | |
| *** ddieterly has joined #openstack-keystone | 22:32 | |
| *** ddieterly has quit IRC | 22:36 | |
| openstackgerrit | ayoung proposed openstack/keystone: No Op provider for credential encryption https://review.openstack.org/365087 | 22:38 |
| *** markvoelker has quit IRC | 22:47 | |
| *** ayoung has joined #openstack-keystone | 22:48 | |
| *** ChanServ sets mode: +v ayoung | 22:48 | |
| *** fangxu has joined #openstack-keystone | 22:53 | |
| *** asettle has joined #openstack-keystone | 23:05 | |
| *** fangxu has quit IRC | 23:05 | |
| *** esp has quit IRC | 23:05 | |
| *** esp has joined #openstack-keystone | 23:06 | |
| *** asettle has quit IRC | 23:10 | |
| *** esp has quit IRC | 23:10 | |
| *** openstackgerrit has quit IRC | 23:18 | |
| *** openstackgerrit has joined #openstack-keystone | 23:18 | |
| *** spzala has joined #openstack-keystone | 23:19 | |
| *** spzala has quit IRC | 23:23 | |
| *** spzala has joined #openstack-keystone | 23:34 | |
| *** tqtran has quit IRC | 23:41 | |
| *** spzala has quit IRC | 23:44 | |
| *** asettle has joined #openstack-keystone | 23:46 | |
| *** su_zhang has joined #openstack-keystone | 23:48 | |
| *** su_zhang has quit IRC | 23:48 | |
| *** su_zhang has joined #openstack-keystone | 23:49 | |
| *** su_zhang has quit IRC | 23:53 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
