| *** spzala has quit IRC | 00:00 | |
| rderose | breton: setting a datetime default has been a nightmare | 00:00 |
|---|---|---|
| rderose | breton: more than you know, believe me | 00:00 |
| *** spzala has joined #openstack-keystone | 00:00 | |
| *** spzala has quit IRC | 00:00 | |
| breton | < Define the column with a DEFAULT clause that specifies a constant default value. | 00:00 |
| *** spzala has joined #openstack-keystone | 00:01 | |
| rderose | breton: yeah, try to do that with sqlalchemy that will support all of our supported databases and all of the different db versions | 00:01 |
| rderose | :) | 00:01 |
| *** spzala has quit IRC | 00:01 | |
| *** spzala has joined #openstack-keystone | 00:01 | |
| rderose | breton: I think I'm just going to remove the server_default | 00:02 |
| breton | rderose: i tried, doesn't help | 00:02 |
| rderose | breton: really? | 00:02 |
| rderose | breton: if you remove the server_default, it still automatically gets set? | 00:02 |
| breton | rderose: yep. I stupidly edited keystone/common/sql/contract_repo/versions/002_password_created_at_not_nullable.py and the bug is still there. | 00:03 |
| rderose | breton: how did you edit it? | 00:03 |
| *** spzala has quit IRC | 00:04 | |
| breton | - server_default=sql.func.now()) | 00:04 |
| breton | + ) | 00:04 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 00:04 |
| breton | rderose: i know this won't go to upstream, but for testing it is fine, since the tests recreate the db each time from scratch | 00:05 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Add missing sections in configuration doc https://review.openstack.org/367027 | 00:05 |
| rderose | breton: I mean, you'd have to let it set it initially and then at the end remove it like so: password.c.created_at.alter(server_default='') | 00:06 |
| rderose | breton: but it sounds, it's just that it's a timestamp column? | 00:06 |
| breton | rderose: yep | 00:07 |
| rderose | breton: dam!!! | 00:07 |
| breton | also | 00:07 |
| breton | why is created_at timestamp and expires_at datetime? | 00:08 |
| breton | why is there is this difference in types? | 00:08 |
| rderose | breton: because mysql 5.5 datetime doesn't support server_default | 00:09 |
| rderose | breton: timestamp does; was recommended by zzzeek | 00:09 |
| breton | wait. | 00:10 |
| breton | why keystone/common/sql/contract_repo/versions/002_password_created_at_not_nullable.py doesn't get executed when the tests are run? | 00:10 |
| rderose | it should | 00:11 |
| breton | http://paste.openstack.org/show/568488/ | 00:13 |
| breton | actually even http://paste.openstack.org/show/568489/ | 00:13 |
| rderose | breton: the test still fail, but is the created_at date automatically getting updated with the change? | 00:14 |
| rderose | breton: so when column changes, does the created_at change like before? | 00:15 |
| breton | rderose: yep, the behaviour is still like in the bugreport | 00:17 |
| rderose | breton: hmm... | 00:18 |
| rderose | breton: I'll have to research this some more then | 00:19 |
| rderose | @$!@#$#!@#$! | 00:19 |
| *** esp has quit IRC | 00:19 | |
| breton | rderose: the problem is that 002_password_created_at_not_nullable.py is not executed in tests | 00:20 |
| breton | rderose: at all | 00:20 |
| rderose | breton: it has to be, otherwise it would be datetime column and not timestamp | 00:21 |
| rderose | breton: right, aren't you seeing that the column is a timestamp | 00:21 |
| rderose | breton: when you run the tests | 00:21 |
| breton | rderose: not sure. I didn't try to differ them in tests, i just observed the different in the code | 00:25 |
| rderose | breton: so why do you think it's not being executed? | 00:26 |
| *** adrian_otto has quit IRC | 00:26 | |
| *** iurygregory_ has quit IRC | 00:26 | |
| breton | rderose: http://paste.openstack.org/show/568729/ | 00:28 |
| breton | rderose: i inserted "assert False" to upgrade(). It was supposed to fail everything. It hasn't. | 00:29 |
| *** harlowja has joined #openstack-keystone | 00:29 | |
| samueldmq | lbragstad: see my comment in https://review.openstack.org/#/c/345688 | 00:29 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Updates configuration doc with latest changes https://review.openstack.org/367027 | 00:30 |
| samueldmq | lbragstad: looks like a valid failure | 00:30 |
| *** roxanaghe has quit IRC | 00:30 | |
| rderose | breton: I need some coffee :) | 00:30 |
| breton | rderose: the tests succeeds even if i make this absolute SyntaxError: http://paste.openstack.org/show/568730/ | 00:30 |
| rderose | breton: how about IRONMAN? | 00:31 |
| rderose | will that work? | 00:31 |
| rderose | @!$#$$#!#$ | 00:31 |
| rderose | :) | 00:31 |
| breton | rderose: meh, batman was better :p | 00:31 |
| rderose | hahaha | 00:31 |
| *** topol_ has joined #openstack-keystone | 00:31 | |
| *** ChanServ sets mode: +v topol_ | 00:31 | |
| breton | not the last one though. | 00:31 |
| breton | ok, now i really need to go to sleep. | 00:32 |
| rderose | breton: yeah, thanks again | 00:32 |
| rderose | breton: I'll keep working on this | 00:32 |
| rderose | breton: touch base with you tomorrow | 00:33 |
| *** tqtran has quit IRC | 00:39 | |
| *** ddieterly has joined #openstack-keystone | 00:44 | |
| *** esp has joined #openstack-keystone | 00:48 | |
| *** spzala has joined #openstack-keystone | 00:48 | |
| *** gyee_ has quit IRC | 00:48 | |
| *** chlong has quit IRC | 01:03 | |
| *** davechen has joined #openstack-keystone | 01:20 | |
| *** javis has quit IRC | 01:26 | |
| *** sdake has joined #openstack-keystone | 01:32 | |
| *** wangqun has joined #openstack-keystone | 01:35 | |
| *** ddieterly has quit IRC | 01:35 | |
| *** tqtran has joined #openstack-keystone | 01:36 | |
| *** tqtran has quit IRC | 01:40 | |
| *** openstack has joined #openstack-keystone | 01:42 | |
| *** ddieterly has joined #openstack-keystone | 01:42 | |
| *** ddieterly has quit IRC | 01:46 | |
| *** asettle has joined #openstack-keystone | 01:47 | |
| *** asettle has quit IRC | 01:51 | |
| stevemar | rderose: uh oh | 02:03 |
| stevemar | breton: thanks for the find, great bug | 02:03 |
| rderose | stevemar: tell me about it :) | 02:03 |
| rderose | stevemar: I think I have a solution | 02:04 |
| rderose | stevemar: chatted with zzzeek | 02:04 |
| rderose | stevemar: testing it out now | 02:04 |
| stevemar | rderose: cool cool, i think amakarov reported a similar bug | 02:04 |
| rderose | stevemar: should have an updated patch soon: https://review.openstack.org/#/c/367025/4 | 02:04 |
| *** spzala has quit IRC | 02:04 | |
| *** spzala has joined #openstack-keystone | 02:05 | |
| *** ddieterly has joined #openstack-keystone | 02:06 | |
| *** spzala has quit IRC | 02:07 | |
| *** spzala has joined #openstack-keystone | 02:07 | |
| *** chlong has joined #openstack-keystone | 02:19 | |
| *** ddieterly has quit IRC | 02:19 | |
| *** ddieterly has joined #openstack-keystone | 02:22 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 02:27 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 02:30 |
| *** spzala has quit IRC | 02:33 | |
| *** spzala has joined #openstack-keystone | 02:33 | |
| *** spzala has quit IRC | 02:35 | |
| *** spzala has joined #openstack-keystone | 02:35 | |
| *** ddieterly has quit IRC | 02:41 | |
| dstanek | stevemar: are we OK to break backward compat for the bug? https://review.openstack.org/#/c/365177 | 02:50 |
| *** spzala has quit IRC | 02:50 | |
| stevemar | dstanek: i think domain specific roles are still experimental | 02:51 |
| stevemar | doubtful that we've documented that anywhere, but they've only hung around for one release | 02:51 |
| *** spzala has joined #openstack-keystone | 02:51 | |
| stevemar | dstanek: plus, as you mentioned, it results in a bug anyway | 02:51 |
| dstanek | stevemar: coolio, just checking before I +A | 02:51 |
| stevemar | dstanek: you good | 02:51 |
| dstanek | stevemar: you good too | 02:51 |
| stevemar | heading out, early night, little one is waking up | 02:52 |
| dstanek | stevemar: have a good night | 02:53 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes a nit in a comment https://review.openstack.org/367058 | 02:55 |
| *** spzala has quit IRC | 02:55 | |
| *** chrisshattuck has joined #openstack-keystone | 03:14 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Return password_expires_at during auth https://review.openstack.org/367008 | 03:18 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Return password_expires_at during auth https://review.openstack.org/367008 | 03:19 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 03:22 |
| *** chrisshattuck has quit IRC | 03:23 | |
| *** chrisshattuck has joined #openstack-keystone | 03:23 | |
| rderose | For my migration script need to check if mysql 5.6.5. I can check for mysql (if migrate_engine.name == 'mysql'), but does anyone know how to check the version? | 03:24 |
| rderose | engine.version doesn't work | 03:24 |
| *** fangxu has quit IRC | 03:29 | |
| openstackgerrit | Nguyen Phuong An proposed openstack/keystone: [api-ref] Remove parameters unused in keystone v2 https://review.openstack.org/365947 | 03:45 |
| openstackgerrit | Merged openstack/keystone: Project domain must match role domain for assignment https://review.openstack.org/365177 | 03:46 |
| *** GB21 has joined #openstack-keystone | 04:05 | |
| *** esp has quit IRC | 04:12 | |
| *** code-R has joined #openstack-keystone | 04:19 | |
| *** links has joined #openstack-keystone | 04:28 | |
| *** markvoelker has quit IRC | 04:30 | |
| *** markvoelker has joined #openstack-keystone | 04:31 | |
| *** GB21 has quit IRC | 04:35 | |
| *** dikonoor has joined #openstack-keystone | 04:39 | |
| *** woodster_ has quit IRC | 04:39 | |
| *** can8dnSix has joined #openstack-keystone | 04:40 | |
| *** esp has joined #openstack-keystone | 04:42 | |
| openstackgerrit | Nguyen Phuong An proposed openstack/keystone: [api-ref] Remove parameters unused in keystone v2 https://review.openstack.org/365947 | 04:48 |
| *** GB21 has joined #openstack-keystone | 04:51 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Return password_expires_at during auth https://review.openstack.org/367008 | 04:52 |
| *** dikonoor has quit IRC | 04:54 | |
| *** dikonoor has joined #openstack-keystone | 04:56 | |
| *** sdake has quit IRC | 04:56 | |
| *** code-R_ has joined #openstack-keystone | 04:57 | |
| *** sdake has joined #openstack-keystone | 05:00 | |
| *** code-R has quit IRC | 05:00 | |
| openstackgerrit | Merged openstack/keystone: Fixes a nit in a comment https://review.openstack.org/367058 | 05:04 |
| *** code-R_ has quit IRC | 05:08 | |
| *** can8dnSix has quit IRC | 05:10 | |
| *** jaosorior has joined #openstack-keystone | 05:10 | |
| *** chlong has quit IRC | 05:14 | |
| *** GB21 has quit IRC | 05:14 | |
| *** chrisshattuck has quit IRC | 05:20 | |
| *** GB21 has joined #openstack-keystone | 05:27 | |
| *** spzala has joined #openstack-keystone | 05:27 | |
| *** ChanServ sets mode: +v henrynash | 05:30 | |
| *** chlong has joined #openstack-keystone | 05:30 | |
| *** links has quit IRC | 05:31 | |
| *** spzala has quit IRC | 05:31 | |
| *** cnf has quit IRC | 05:32 | |
| *** dikonoor has quit IRC | 05:33 | |
| *** roxanaghe has joined #openstack-keystone | 05:37 | |
| *** tqtran has joined #openstack-keystone | 05:38 | |
| *** esp has quit IRC | 05:38 | |
| *** richm has quit IRC | 05:40 | |
| *** tqtran has quit IRC | 05:42 | |
| *** roxanaghe has quit IRC | 05:46 | |
| *** links has joined #openstack-keystone | 05:46 | |
| *** code-R has joined #openstack-keystone | 05:47 | |
| *** dikonoor has joined #openstack-keystone | 05:48 | |
| *** hoangcx has joined #openstack-keystone | 05:50 | |
| *** swamireddy1 has joined #openstack-keystone | 05:50 | |
| *** code-R_ has joined #openstack-keystone | 05:55 | |
| *** sdake_ has joined #openstack-keystone | 05:56 | |
| *** code-R has quit IRC | 05:57 | |
| *** sdake has quit IRC | 05:58 | |
| *** code-R_ has quit IRC | 06:00 | |
| *** dikonoor has quit IRC | 06:03 | |
| *** annp has joined #openstack-keystone | 06:04 | |
| *** chlong has quit IRC | 06:13 | |
| *** gagehugo has joined #openstack-keystone | 06:22 | |
| *** hoonetorg has quit IRC | 06:25 | |
| *** chlong has joined #openstack-keystone | 06:26 | |
| openstackgerrit | Nguyen Phuong An proposed openstack/keystone: [api-ref] Correct response code status https://review.openstack.org/367121 | 06:42 |
| *** topol_ has quit IRC | 06:43 | |
| *** tonytan4ever has quit IRC | 06:49 | |
| *** jpena|away is now known as jpena|off | 06:52 | |
| *** swamireddy1 has quit IRC | 06:57 | |
| *** hoangcx has quit IRC | 06:57 | |
| *** tesseract- has joined #openstack-keystone | 07:04 | |
| *** maestropandy has joined #openstack-keystone | 07:25 | |
| *** maestropandy has left #openstack-keystone | 07:25 | |
| *** jed56 has joined #openstack-keystone | 07:33 | |
| *** openstackgerrit has quit IRC | 07:33 | |
| *** openstackgerrit has joined #openstack-keystone | 07:34 | |
| breton | o/ | 07:35 |
| breton | rderose: wait, the problem is not with server_default | 07:38 |
| breton | rderose: the problem is that migration scripts do not run in tests | 07:39 |
| *** tqtran has joined #openstack-keystone | 07:39 | |
| *** cnf has joined #openstack-keystone | 07:40 | |
| *** topol_ has joined #openstack-keystone | 07:43 | |
| *** ChanServ sets mode: +v topol_ | 07:43 | |
| *** tqtran has quit IRC | 07:43 | |
| *** topol_ has quit IRC | 07:49 | |
| *** tonytan4ever has joined #openstack-keystone | 07:50 | |
| *** chlong has quit IRC | 07:52 | |
| *** jpena|off is now known as jpena | 07:54 | |
| *** tonytan4ever has quit IRC | 07:54 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** maestropandy has joined #openstack-keystone | 08:00 | |
| *** adriant has quit IRC | 08:06 | |
| *** maestropandy has left #openstack-keystone | 08:15 | |
| *** sdake_ is now known as sdake | 08:17 | |
| *** dikonoor has joined #openstack-keystone | 08:24 | |
| *** cnf has quit IRC | 08:27 | |
| *** cnf has joined #openstack-keystone | 08:28 | |
| wangqun | Hi all, I meet a bug when I set quota for a project. I am using kilo version of keystone. | 08:32 |
| wangqun | when I run the following command. | 08:33 |
| wangqun | openstack --debug quota set --volumes 20 623051a1ce4f417ea5b99e2bedca5e39 | 08:33 |
| wangqun | It will show the error. | 08:34 |
| wangqun | File "/usr/local/lib/python2.7/dist-packages/openstackclient/common/quota.py", line 124, in take_action | 08:34 |
| wangqun | **volume_kwargs) | 08:34 |
| wangqun | File "/usr/local/lib/python2.7/dist-packages/cinderclient/v1/quotas.py", line 47, in update | 08:34 |
| wangqun | result = self._update('/os-quota-sets/%s' % (tenant_id), body) | 08:34 |
| wangqun | I don't know how to fix the problem. | 08:34 |
| *** joerch has joined #openstack-keystone | 08:34 | |
| wangqun | Can anyone help me? | 08:35 |
| *** jaosorior is now known as jaosorior_lunch | 08:40 | |
| *** asettle has joined #openstack-keystone | 08:40 | |
| breton | wangqun: please post the full traceback to paste.openstack.org | 08:41 |
| wangqun | breton:Thanks. I will do it. | 08:42 |
| *** namnh has joined #openstack-keystone | 08:45 | |
| openstackgerrit | Lu lei proposed openstack/keystone: Repalce six.iterXXX(aaa) with aaa.XXX() https://review.openstack.org/367213 | 08:45 |
| *** code-R has joined #openstack-keystone | 09:00 | |
| *** code-R_ has joined #openstack-keystone | 09:02 | |
| *** maestropandy has joined #openstack-keystone | 09:03 | |
| *** code-R has quit IRC | 09:05 | |
| *** pnavarro has joined #openstack-keystone | 09:18 | |
| *** NishaYadav has joined #openstack-keystone | 09:19 | |
| *** nisha_ has joined #openstack-keystone | 09:19 | |
| *** nisha_ has quit IRC | 09:20 | |
| NishaYadav | o/ | 09:20 |
| *** asettle has quit IRC | 09:23 | |
| *** asettle has joined #openstack-keystone | 09:23 | |
| *** davechen has left #openstack-keystone | 09:34 | |
| *** asettle has joined #openstack-keystone | 09:41 | |
| *** mvk has quit IRC | 09:43 | |
| *** spzala has joined #openstack-keystone | 09:52 | |
| *** namnh has quit IRC | 09:54 | |
| *** spzala has quit IRC | 09:56 | |
| *** annp has quit IRC | 09:59 | |
| *** GB21 has quit IRC | 10:05 | |
| *** richm has joined #openstack-keystone | 10:08 | |
| *** GB21 has joined #openstack-keystone | 10:11 | |
| *** mvk has joined #openstack-keystone | 10:13 | |
| *** nisha_ has joined #openstack-keystone | 10:14 | |
| *** NishaYadav has quit IRC | 10:17 | |
| *** NishaYadav has joined #openstack-keystone | 10:27 | |
| *** NishaYadav is now known as Guest3546 | 10:28 | |
| *** nisha__ has joined #openstack-keystone | 10:30 | |
| *** nisha_ has quit IRC | 10:31 | |
| *** Guest3546 has quit IRC | 10:33 | |
| *** tqtran has joined #openstack-keystone | 10:42 | |
| *** wangqun has quit IRC | 10:46 | |
| *** tqtran has quit IRC | 10:46 | |
| *** dikonoor has quit IRC | 10:53 | |
| *** amakarov_away is now known as amakarov | 10:55 | |
| *** jpena is now known as jpena|lunch | 10:59 | |
| openstackgerrit | Lu lei proposed openstack/keystone: Replace six iteration methods with standard ones https://review.openstack.org/367213 | 10:59 |
| *** nisha__ has quit IRC | 11:13 | |
| *** maestropandy has quit IRC | 11:19 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 11:22 |
| *** dikonoor has joined #openstack-keystone | 11:23 | |
| *** dikonoor has quit IRC | 11:28 | |
| *** dikonoor has joined #openstack-keystone | 11:29 | |
| *** dikonoor has quit IRC | 11:40 | |
| *** tonytan4ever has joined #openstack-keystone | 11:51 | |
| *** links has quit IRC | 11:52 | |
| *** jaosorior_lunch is now known as jaosorior | 11:56 | |
| *** tonytan4ever has quit IRC | 11:56 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: [api-ref] Correct response code status https://review.openstack.org/367121 | 11:59 |
| *** shaleh_ has joined #openstack-keystone | 12:09 | |
| *** shaleh has quit IRC | 12:12 | |
| *** raildo has joined #openstack-keystone | 12:17 | |
| *** jpena|lunch is now known as jpena | 12:21 | |
| *** pauloewerton has joined #openstack-keystone | 12:26 | |
| breton | i think i don't understand something | 12:26 |
| breton | do we run the migrations in tests setup? | 12:27 |
| breton | or we just create all the tables separately? | 12:27 |
| *** EinstCrazy has joined #openstack-keystone | 12:31 | |
| *** su_zhang has joined #openstack-keystone | 12:36 | |
| *** GB21 has quit IRC | 12:36 | |
| *** shaleh has joined #openstack-keystone | 12:37 | |
| breton | it seems that we don't run migrations at all and it's ok | 12:37 |
| breton | because of https://github.com/openstack/keystone/blob/master/keystone/tests/unit/ksfixtures/database.py#L154 | 12:39 |
| breton | so bug 1621449 is probably invalid :( | 12:39 |
| openstack | bug 1621449 in OpenStack Identity (keystone) "Unit tests run on old db schema" [High,Confirmed] https://launchpad.net/bugs/1621449 | 12:39 |
| *** shaleh_ has quit IRC | 12:39 | |
| *** maestropandy has joined #openstack-keystone | 12:46 | |
| *** jaosorior has quit IRC | 12:51 | |
| *** jaosorior has joined #openstack-keystone | 12:51 | |
| stevemar | breton: there should be a test that upgrades all the way in test_sql_migrate | 12:53 |
| *** dikonoor has joined #openstack-keystone | 12:54 | |
| *** maestropandy has quit IRC | 12:54 | |
| breton | stevemar: there is such test, yes | 12:56 |
| breton | stevemar: but for other, non-upgrade tests, the tables are created not with migrations | 12:56 |
| breton | stevemar: but with metadata.create_all() | 12:57 |
| *** maestropandy has joined #openstack-keystone | 13:00 | |
| *** spzala has joined #openstack-keystone | 13:06 | |
| *** tonytan4ever has joined #openstack-keystone | 13:07 | |
| amakarov | breton, I assume it's for speed, unit tests don't care about migrations - those are for other things | 13:10 |
| *** tonytan4ever has quit IRC | 13:12 | |
| *** jraju has joined #openstack-keystone | 13:12 | |
| *** tonytan4ever has joined #openstack-keystone | 13:14 | |
| *** su_zhang has quit IRC | 13:16 | |
| *** su_zhang has joined #openstack-keystone | 13:16 | |
| *** su_zhang_ has joined #openstack-keystone | 13:20 | |
| *** sdake_ has joined #openstack-keystone | 13:20 | |
| lbragstad | samueldmq checking | 13:20 |
| *** su_zhang has quit IRC | 13:20 | |
| *** sdake has quit IRC | 13:22 | |
| *** aloga_ has joined #openstack-keystone | 13:24 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Syncronize Password model with the migrated schema https://review.openstack.org/367374 | 13:24 |
| breton | rderose: ^ | 13:25 |
| lbragstad | samueldmq stevemar interesting - looks like keystone-manage fernet_setup only runs when fernet is the default in Devstack https://github.com/openstack-dev/devstack/blob/b74fc6886ff7b373644f886238118dd0c34046f2/lib/keystone#L512-L514 | 13:26 |
| *** ddieterly has joined #openstack-keystone | 13:27 | |
| *** topol_ has joined #openstack-keystone | 13:28 | |
| *** ChanServ sets mode: +v topol_ | 13:28 | |
| *** topol_ has quit IRC | 13:29 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: [WIP] Move fernet utils to backend https://review.openstack.org/356499 | 13:30 |
| *** ddieterly has quit IRC | 13:31 | |
| *** xenogear has quit IRC | 13:34 | |
| lbragstad | samueldmq stevemar it looks like the still isn't a fernet-keys repository during the grenade run - http://logs.openstack.org/88/345688/15/check/gate-grenade-dsvm-neutron-ubuntu-trusty/df5abb2/logs/etc/keystone/ | 13:40 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: WIP: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 13:42 |
| *** woodster_ has joined #openstack-keystone | 13:45 | |
| *** joerch has quit IRC | 13:48 | |
| *** spzala has quit IRC | 13:49 | |
| stevemar | lbragstad: dagnabbit | 13:50 |
| *** xenogear has joined #openstack-keystone | 13:50 | |
| *** spzala has joined #openstack-keystone | 13:50 | |
| lbragstad | stevemar i wonder if it is because keystone-manage fernet_setup isn't run on the upgrade (?) | 13:50 |
| *** Administrator_ has joined #openstack-keystone | 13:51 | |
| stevemar | lbragstad: i didn't think so, but i saw your grenade patch, let's see what happens | 13:51 |
| *** gagehugo_ has joined #openstack-keystone | 13:51 | |
| stevemar | lbragstad: i don't think we have enough runway to make fernet the default in newton | 13:51 |
| *** gagehugo has quit IRC | 13:51 | |
| *** gagehugo_ has quit IRC | 13:51 | |
| lbragstad | stevemar agreed - just testing it | 13:52 |
| *** gagehugo has joined #openstack-keystone | 13:52 | |
| lbragstad | stevemar if that passes - i'll mark everything with a -2 or a wip until we open for ocata and we will land it first thing then? | 13:52 |
| lbragstad | which would mean reproposing the grenade patch to from-newton | 13:52 |
| lbragstad | instead of from-mitaka | 13:52 |
| *** zhugaoxiao has quit IRC | 13:54 | |
| *** spzala has quit IRC | 13:55 | |
| lbragstad | it would be nice to confidently merge https://review.openstack.org/#/c/345688/ first thing in Ocata, though | 13:56 |
| lbragstad | stevemar what about the null key for credential encryption - are we going to bring up the FFE in next weeks meeting? | 13:58 |
| *** topol_ has joined #openstack-keystone | 13:59 | |
| *** ChanServ sets mode: +v topol_ | 13:59 | |
| *** chrisshattuck has joined #openstack-keystone | 14:00 | |
| samueldmq | lbragstad: so that's a devstack thing right? | 14:01 |
| samueldmq | lbragstad: that needs to run fernet_setup when keystone config is set to fernet ? | 14:01 |
| lbragstad | samueldmq which part? | 14:01 |
| samueldmq | ^ | 14:01 |
| lbragstad | samueldmq well - the only failure in the most recent run was grenade related | 14:02 |
| lbragstad | so upgrade testing | 14:02 |
| *** ddieterly has joined #openstack-keystone | 14:02 | |
| lbragstad | and when you look at the logs from the failure - keystone doesn't have a fernet-keys directory in /etc/ | 14:02 |
| lbragstad | so i'm curious if that was the problem | 14:02 |
| samueldmq | lbragstad: seems to be related | 14:03 |
| lbragstad | samueldmq dstanek just found this - http://logs.openstack.org/88/345688/15/check/gate-grenade-dsvm-neutron-ubuntu-trusty/49cc486/logs/apache/keystone.txt.gz#_2016-09-08_03_15_03_019 | 14:03 |
| lbragstad | which is exactly the problem | 14:03 |
| lbragstad | looks like keystone is throwing a 500 during version discovery | 14:03 |
| lbragstad | so - that grenade patch *should* fix it | 14:04 |
| samueldmq | lbragstad: what patch ? you have a link ? | 14:04 |
| lbragstad | samueldmq https://review.openstack.org/#/c/367384/ | 14:04 |
| *** chrisshattuck has quit IRC | 14:05 | |
| openstackgerrit | Merged openstack/keystone: Introduce null key for credential encryption https://review.openstack.org/366831 | 14:05 |
| lbragstad | ^ i have https://review.openstack.org/#/c/367384/ dependent on ^ | 14:05 |
| openstackgerrit | Merged openstack/keystone: Log warning if null key is used for encryption https://review.openstack.org/366832 | 14:05 |
| openstackgerrit | Merged openstack/keystone: Add docs for the null key https://review.openstack.org/366854 | 14:05 |
| openstackgerrit | Merged openstack/keystone: [api-ref] Correct response code status https://review.openstack.org/367121 | 14:05 |
| *** chrisshattuck has joined #openstack-keystone | 14:05 | |
| stevemar | lbragstad: the null key is merged, it was a bug, no need for an ffe | 14:06 |
| lbragstad | stevemar what about an ffe for credential encryption? | 14:06 |
| stevemar | lbragstad: *granted* | 14:06 |
| samueldmq | o/ | 14:07 |
| lbragstad | ayoung ping - want me to abandon https://review.openstack.org/#/c/365087/ since the null key stuff merged? | 14:07 |
| lbragstad | stevemar sweet | 14:07 |
| stevemar | lbragstad: it's just a formality tbh | 14:07 |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: [WIP] Add sql backend for fernet keys https://review.openstack.org/367405 | 14:07 |
| samueldmq | lbragstad: stevemar's stamp on it! | 14:07 |
| ayoung | lbragstad, yes, please | 14:07 |
| ayoung | lbragstad, I got it | 14:07 |
| lbragstad | ayoung sorry - just did it | 14:07 |
| ayoung | NP | 14:08 |
| lbragstad | ayoung i think EmilienM's stuff was in the process of merging - but hopefully there aren't any more upgrade issues | 14:08 |
| ayoung | lbragstad, Shhh...I still want that in... | 14:08 |
| lbragstad | ayoung ++ | 14:09 |
| *** topol_ has quit IRC | 14:10 | |
| *** sdake has joined #openstack-keystone | 14:10 | |
| *** sdake_ has quit IRC | 14:12 | |
| *** gagehugo_ has joined #openstack-keystone | 14:13 | |
| *** su_zhang_ has quit IRC | 14:13 | |
| *** su_zhang has joined #openstack-keystone | 14:13 | |
| *** EinstCrazy has quit IRC | 14:15 | |
| *** su_zhang has quit IRC | 14:18 | |
| *** EinstCrazy has joined #openstack-keystone | 14:19 | |
| *** jaugustine has joined #openstack-keystone | 14:20 | |
| rderose | breton: adding the server_default to the model is not going to fix the error | 14:26 |
| rderose | breton: mysql versions below 5.6.5 will still update the timestamp when any column in the row is updated | 14:28 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation assignment driver https://review.openstack.org/291318 | 14:28 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move dependency-related trust logic to manager https://review.openstack.org/360735 | 14:28 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation trust driver https://review.openstack.org/291871 | 14:29 |
| rderose | breton: I'm going back to the drawing board on this one and I think, just going to propose that we manually fix this in the contract repo with a simple (not ideal) approach | 14:29 |
| rderose | amakarov: is this still a bug: https://bugs.launchpad.net/keystone/+bug/1620764? | 14:30 |
| openstack | Launchpad bug 1620764 in OpenStack Identity (keystone) "migration test fails on table addition" [Undecided,New] - Assigned to Ron De Rose (ronald-de-rose) | 14:30 |
| rderose | amakarov: did you see my comments? | 14:30 |
| amakarov | rderose, yes, and followed the example you provided | 14:30 |
| lbragstad | stevemar samueldmq dstanek looks like the grenade patch makes https://review.openstack.org/#/c/345688/ pass | 14:31 |
| amakarov | rderose, that created even more questions :) | 14:31 |
| rderose | amakarov: haha of course | 14:31 |
| rderose | amakarov: it just gets more complicated huh | 14:31 |
| rderose | amakarov: oh, and it looks like your patch passed the gate | 14:32 |
| rderose | cool | 14:32 |
| amakarov | rderose, I've removed empty migrations | 14:32 |
| amakarov | rderose, so what if I need those migrations? I don't understand how this thing works and why it failed! :) | 14:33 |
| rderose | amakarov: oh, was that it? because you had empty migrations in contract and migrate? | 14:33 |
| rderose | amakarov: ah, let me dig into that | 14:33 |
| rderose | amakarov: can you update the bug description? | 14:33 |
| amakarov | rderose, of course | 14:34 |
| rderose | amakarov: cool | 14:34 |
| *** rodrigods has quit IRC | 14:35 | |
| *** rodrigods has joined #openstack-keystone | 14:35 | |
| breton | rderose: ok. But the patch works for me. Could you please -1 it with your concerns? | 14:35 |
| lbragstad | dstanek this is interesting - http://logs.openstack.org/52/367052/2/check/gate-tempest-dsvm-neutron-full-ubuntu-xenial/21066fa/console.html#_2016-09-08_03_30_31_297510 | 14:36 |
| lbragstad | that's from stevemar's patch to make fernet default in devstack | 14:36 |
| *** scarab_ has joined #openstack-keystone | 14:38 | |
| rderose | breton: in talking with zzzeek func.now() for mysql 5.6.4 and older will set current_timestamp onupdate, which is what we saw. For these older versions, he suggests using "server_default="CURRENT_TIMESTAMP()" | 14:39 |
| breton | rderose: also, my mysql version is 5.5.50-0+deb8u1 and it works for me | 14:39 |
| rderose | breton: the column is not getting updated like before? | 14:39 |
| breton | rderose: yes, the column is not getting updated like before. | 14:40 |
| rderose | breton: what the #$@#% | 14:40 |
| rderose | breton: what about the UTC problem? that's still an issue, right? | 14:40 |
| breton | rderose: nope. Everything works for me. | 14:41 |
| *** EinstCrazy has quit IRC | 14:41 | |
| rderose | breton: how is that possible, func.now() is not UTC? | 14:42 |
| breton | rderose: that's why https://review.openstack.org/367374 closes-bug, not partial-bug. | 14:42 |
| breton | rderose: no idea :) | 14:42 |
| *** mvk has quit IRC | 14:42 | |
| rderose | breton: I just don't trust it now and afraid that different versions of mysql will fail | 14:43 |
| *** ravelar has joined #openstack-keystone | 14:43 | |
| breton | rderose: ok. I will test it on an older version now | 14:43 |
| rderose | breton: cool | 14:43 |
| *** michauds has joined #openstack-keystone | 14:43 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Flag to bypass expiry and revocation check on token validation https://review.openstack.org/358131 | 14:44 |
| breton | rderose: sorry, but the oldest i can test on my localhost is 5.5.47-0, from debian oldstable. | 14:47 |
| breton | rderose: even ubuntu 12.04 has 5.5.50 | 14:48 |
| rderose | breton: hmm... | 14:48 |
| rderose | breton: this is just hard to explain, especially the UTC issue. If you set the db to UTC+4, func.now() should set the default created_at accordingly | 14:49 |
| rderose | breton: for existing passwords | 14:49 |
| rderose | breton: that should still be a problem | 14:50 |
| breton | rderose: i am in utc+3, and everything in the db is in UTC | 14:50 |
| rderose | breton: actually, it does now. because our tests don't have existing passwords, right? | 14:51 |
| rderose | breton: the server_default would only kick in for old passwords | 14:51 |
| rderose | breton: so I think that would still be a problem | 14:52 |
| breton | rderose: don't know | 14:52 |
| rderose | breton: we need a test for that | 14:52 |
| breton | rderose: yep. Let me write one for it. | 14:52 |
| *** dikonoor has quit IRC | 14:52 | |
| rderose | breton: and I really don't trust that the onupdate will not be a problem for all versions... have to get zzzeek's input on why that is working for you | 14:52 |
| rderose | breton: have a meeting at the top of the hour, let me know what you find out | 14:53 |
| *** jraju has quit IRC | 14:59 | |
| ayoung | Wow....we do a lot of Business logic in the auth controller. How did we let that happen? | 15:00 |
| ayoung | I wonder if what we really should have is an auth Manager. | 15:01 |
| ayoung | I'm thinking through the "long lived token" thing | 15:01 |
| *** ddieterly has quit IRC | 15:01 | |
| *** aloga_ has quit IRC | 15:02 | |
| ayoung | and so we need a call that returns the data associated with a token. The auth_data, as it is called throughout the middleware. | 15:02 |
| ayoung | I think that this is a variation on the auth call, with a flag that says "ignore revocation and expiry" as I put in the spec | 15:03 |
| ayoung | https://review.openstack.org/#/c/358131/ | 15:03 |
| ayoung | we have revocations in a separate backend from tokens. And we call into that from the auth controller | 15:04 |
| ayoung | seems that, instead, we should have the auth controller (HTTP specific logic) call into the auth manager (business logic) that calls the token persistance layer to get the data, and then checks expiry and revocation | 15:05 |
| ayoung | this is the pipeline we dioscussed in San Antonio during a midcycle several years ago | 15:06 |
| rderose | amakarov: you never created empty migration scripts for data_migrate and contract? | 15:09 |
| amakarov | rderose, https://review.openstack.org/#/c/208488/51 | 15:10 |
| amakarov | tried it | 15:10 |
| *** scarab_ has quit IRC | 15:10 | |
| rderose | amakarov: which patch set? | 15:11 |
| amakarov | 51 | 15:11 |
| amakarov | rderose, tests didn't pass | 15:12 |
| *** su_zhang has joined #openstack-keystone | 15:12 | |
| rderose | amakarov: okay, looking now | 15:12 |
| breton | rderose: although i am writing a test | 15:16 |
| breton | rderose: it is probably unrelated to my issue | 15:16 |
| breton | rderose: because my issue happens only in unittests | 15:16 |
| *** spzala has joined #openstack-keystone | 15:16 | |
| lbragstad | samueldmq these must be the revocation caching issues you were referencing - http://logs.openstack.org/88/345688/16/check/gate-tempest-dsvm-neutron-full-ubuntu-xenial/080d0c0/console.html#_2016-09-08_14_46_53_253862 | 15:16 |
| rderose | breton: true | 15:16 |
| breton | rderose: and not in reallife | 15:16 |
| rderose | breton: not real life? | 15:16 |
| breton | rderose: well, outside of unit tests :) | 15:17 |
| rderose | breton: yeah, okay | 15:17 |
| breton | rderose: so the test probably will go to another patchset. | 15:17 |
| breton | *to another patch | 15:17 |
| *** sdake_ has joined #openstack-keystone | 15:21 | |
| *** sdake has quit IRC | 15:22 | |
| breton | rderose: after migration UTC gets inserted. | 15:23 |
| rderose | breton: yeah, agree | 15:24 |
| breton | rderose: so func.now() actually inserts UTC | 15:25 |
| rderose | breton: wow, not according to the docs | 15:26 |
| breton | rderose: or maybe something else works, not func.now(). | 15:26 |
| rderose | breton: maybe... | 15:27 |
| breton | rderose: i am not sure how to test it though. Because the gates are in UTC afaik. | 15:28 |
| breton | rderose: and we need to emulate non-UTC environment | 15:28 |
| rderose | breton: yeah | 15:28 |
| breton | and i don't know how to do that | 15:28 |
| *** javis has joined #openstack-keystone | 15:30 | |
| samueldmq | lbragstad: yes | 15:32 |
| lbragstad | hah - it looks specific to the change password tests | 15:33 |
| lbragstad | for both v2.0 and v3 | 15:33 |
| samueldmq | lbragstad: maybe not ... wait let me see | 15:33 |
| breton | lbragstad: that's the one we are now working on | 15:33 |
| samueldmq | lbragstad: hmm | 15:33 |
| breton | lbragstad: with rderose | 15:33 |
| lbragstad | cc dstanek ^ | 15:33 |
| lbragstad | breton the fernet default revocation caching issues? | 15:33 |
| samueldmq | lbragstad: is there a known reason for that bug ? | 15:33 |
| breton | lbragstad: nope, password change | 15:34 |
| samueldmq | lbragstad: in that case (the link you posted) it's failing to validate the token | 15:34 |
| lbragstad | breton bug report? | 15:34 |
| samueldmq | lbragstad: the revocation issue I was looking at was the opposite | 15:34 |
| lbragstad | hmm | 15:34 |
| samueldmq | lbragstad: the token was expected to be revoked, but was still valid | 15:35 |
| lbragstad | samueldmq this time it is suppose to be valid but it isn't | 15:35 |
| breton | lbragstad: https://bugs.launchpad.net/keystone/+bug/1621200, but the root cause is fixed in https://review.openstack.org/#/c/367374/1 | 15:35 |
| openstack | Launchpad bug 1621200 in OpenStack Identity (keystone) "MySQLOpportunisticIdentityDriverTestCase.test_change_password fails in UTC+N timezone" [Undecided,In progress] - Assigned to Boris Bobrov (bbobrov) | 15:36 |
| *** esp has joined #openstack-keystone | 15:38 | |
| samueldmq | lbragstad: hmm, if the other tests are not failing .... | 15:39 |
| samueldmq | lbragstad: I'd assume dstanek's patch actually fixed the issue we used to see | 15:39 |
| lbragstad | samueldmq i would assume it at least fixed some of them | 15:39 |
| samueldmq | ++ | 15:41 |
| *** thiagolib has joined #openstack-keystone | 15:41 | |
| dstanek | i fix bug | 15:41 |
| lbragstad | but - i wonder why we seem to still be having issues with password tests? | 15:42 |
| *** browne has joined #openstack-keystone | 15:44 | |
| *** topol_ has joined #openstack-keystone | 15:49 | |
| *** ChanServ sets mode: +v topol_ | 15:49 | |
| *** roxanaghe has joined #openstack-keystone | 15:50 | |
| *** topol_ has quit IRC | 15:50 | |
| *** maestropandy has quit IRC | 15:55 | |
| *** BjoernT has joined #openstack-keystone | 15:57 | |
| *** su_zhang has quit IRC | 16:02 | |
| *** su_zhang has joined #openstack-keystone | 16:03 | |
| *** su_zhang has quit IRC | 16:07 | |
| *** ravelar has quit IRC | 16:12 | |
| *** ravelar has joined #openstack-keystone | 16:13 | |
| *** woodburn has left #openstack-keystone | 16:16 | |
| *** woodburn has joined #openstack-keystone | 16:17 | |
| *** tesseract- has quit IRC | 16:21 | |
| *** cher75 has joined #openstack-keystone | 16:28 | |
| *** ametts has joined #openstack-keystone | 16:32 | |
| *** ravelar has quit IRC | 16:33 | |
| *** ravelar has joined #openstack-keystone | 16:33 | |
| breton | guys, what about out microversions spec? Will it be implemented in N? | 16:38 |
| breton | or in O? | 16:38 |
| breton | ok, https://review.openstack.org/#/c/366268/ | 16:38 |
| *** spzala has quit IRC | 16:39 | |
| *** spzala has joined #openstack-keystone | 16:40 | |
| *** gyee_ has joined #openstack-keystone | 16:40 | |
| *** clenimar has joined #openstack-keystone | 16:43 | |
| *** spzala has quit IRC | 16:44 | |
| *** cher75 has quit IRC | 16:45 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: New notes on advanced upgrade/fallback for cluster https://review.openstack.org/360733 | 16:45 |
| *** spzala has joined #openstack-keystone | 16:46 | |
| *** code-R_ has quit IRC | 16:47 | |
| stevemar | breton: to be implemented when we need it | 16:49 |
| *** spzala has quit IRC | 16:50 | |
| *** arunkant__ has joined #openstack-keystone | 16:55 | |
| *** spzala has joined #openstack-keystone | 16:57 | |
| *** jaosorior has quit IRC | 17:01 | |
| *** spzala has quit IRC | 17:02 | |
| *** Gorian has quit IRC | 17:03 | |
| *** ezpz has quit IRC | 17:03 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Support domain-specific configuration management https://review.openstack.org/358770 | 17:06 |
| stevemar | lbragstad: want to take a quick look at https://review.openstack.org/360733 | 17:08 |
| *** spzala has joined #openstack-keystone | 17:09 | |
| *** slberger has joined #openstack-keystone | 17:09 | |
| lbragstad | stevemar yeah | 17:12 |
| *** adrian_otto has joined #openstack-keystone | 17:12 | |
| *** spzala has quit IRC | 17:14 | |
| *** su_zhang has joined #openstack-keystone | 17:15 | |
| *** fangxu has joined #openstack-keystone | 17:19 | |
| *** marekd2 has joined #openstack-keystone | 17:20 | |
| *** jpena is now known as jpena|off | 17:21 | |
| *** marekd2 has quit IRC | 17:21 | |
| *** joerch has joined #openstack-keystone | 17:21 | |
| *** spzala has joined #openstack-keystone | 17:25 | |
| *** spzala has quit IRC | 17:29 | |
| *** michauds has quit IRC | 17:30 | |
| *** spzala has joined #openstack-keystone | 17:31 | |
| *** spzala has quit IRC | 17:35 | |
| *** code-R has joined #openstack-keystone | 17:35 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 17:36 |
| *** code-R_ has joined #openstack-keystone | 17:38 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 17:40 |
| *** code-R has quit IRC | 17:42 | |
| *** spzala has joined #openstack-keystone | 17:42 | |
| notmorgan | ayoung: it's amazing how much logic is there. however, it's is the only place we really broke the "business logic below the controller" thing | 17:43 |
| ayoung | notmorgan, yeah...I was puzzling through it. I think it is because a lot of it is HTTP specific for authentication | 17:43 |
| notmorgan | rderose: gratz on core... also "sucker" ;) now you have to review things! | 17:44 |
| ayoung | we really should split authN and authZ up more clearly | 17:44 |
| notmorgan | ayoung: pretty much, basically that logic really does belong (most of the http stuff) in the controller | 17:44 |
| ayoung | right. | 17:44 |
| notmorgan | the token things are isolated to the token manager... some authz stuff could be shuffled | 17:44 |
| rderose | notmorgan: thanks man! yeah, got find time to do reviews :) | 17:44 |
| ayoung | just looking through the plugins, you see it is all HTTP specific header operations | 17:44 |
| ayoung | notmorgan, with the exception of Password, which should be Basic Auth, dagnabit | 17:45 |
| *** adrian_otto has quit IRC | 17:45 | |
| notmorgan | ayoung: nope, DIGEST ;) | 17:45 |
| notmorgan | ayoung: but same thing ;) | 17:45 |
| *** tqtran has joined #openstack-keystone | 17:46 | |
| notmorgan | it's sad when SoCal has been nicer weather than PDX in the last few days i've been here vs. when I was home | 17:46 |
| *** spzala has quit IRC | 17:47 | |
| notmorgan | (SoCal desertish areas, let alone ocean locations) | 17:47 |
| *** spzala has joined #openstack-keystone | 17:48 | |
| ayoung | notmorgan, I should write up a spec for that | 17:50 |
| bknudson | seems like the controller should be pulling the headers out to make them available | 17:50 |
| ayoung | bknudson, I thought that, but, it really is not a protocol agnostic | 17:52 |
| notmorgan | ayoung: wouldn't hurt, but my guess is that spec could wait - the setup we have now is in need or refinement not an overhaul like some other things | 17:52 |
| ayoung | the only part that really is protocol agnostic is external, which lets APache do essentially that | 17:52 |
| *** spzala has quit IRC | 17:52 | |
| ayoung | notmorgan, I would really like to get all of the methods stuff gone, and do it all in apache modules. | 17:53 |
| ayoung | Then again, I would like to spend my time on Keystone, and I can't | 17:53 |
| notmorgan | ayoung: like i said, refinement not overhaul ;) | 17:53 |
| notmorgan | also don't forget uwsgi may be used behind nginx | 17:53 |
| notmorgan | so be aware it can't be "apache specific" but i'm sure you're already thinking that | 17:54 |
| ayoung | notmorgan, but, to the heart of the matter, I need to get someone to code the "ignore expiration and revocation" | 17:54 |
| ayoung | notmorgan, right..whatever is passed in to mapping. | 17:54 |
| *** LamT_ has joined #openstack-keystone | 17:54 | |
| notmorgan | ayoung: i can commit to the rev event fixes and cleanup.... but sorry i'm punting on jumping on that grenade ;) | 17:54 |
| ayoung | notmorgan, nah, I want to give it to an outreachy intern anyway | 17:55 |
| ayoung | Or do it myself | 17:55 |
| * notmorgan nods. | 17:55 | |
| *** su_zhang has quit IRC | 17:55 | |
| notmorgan | if i was more involved with keystone I'd probably just write a bunch of code for lingering specs. | 17:55 |
| notmorgan | but as I'm not... | 17:55 |
| ayoung | I'm just gonna write specs and hope to get others to implement | 17:56 |
| * notmorgan looks at the clock and decides another coffee this early is a bad plan(tm) | 17:57 | |
| * ayoung looks at clock and realized lunch time is fast receding | 17:59 | |
| notmorgan | ayoung: yeah damn east coast time :P | 18:01 |
| * notmorgan is going to grab lunch in ~30m | 18:01 | |
| notmorgan | so your lunch is waaaaay late | 18:01 |
| notmorgan | dstanek: https://review.openstack.org/#/c/211693/2 I reviewed it again because I'm a rebel | 18:02 |
| *** chrisshattuck has quit IRC | 18:02 | |
| notmorgan | ayoung: re https://review.openstack.org/#/c/358131/3/attic/v3/identity-api-v3.rst, isn't ?noexpire a validate call? | 18:06 |
| notmorgan | ayoung: that isn't part of the POST. | 18:06 |
| notmorgan | ayoung: it's a GET, unless you are flagging the token itself as non-expiring (sounds dangerous) | 18:06 |
| *** gyee_ has quit IRC | 18:06 | |
| *** wasmum has quit IRC | 18:06 | |
| dstanek | notmorgan: rebel without or with a cause? | 18:07 |
| notmorgan | dstanek: without a clue | 18:07 |
| ayoung | notmorgan, yes it is a GET call | 18:07 |
| notmorgan | ayoung: ok i'll comment there. i was worried i was confused | 18:07 |
| ayoung | you are saying "ignore expiration and revocation on this call" | 18:07 |
| dstanek | notmorgan: right there with you | 18:07 |
| ayoung | should not change the state of the token, but will return successfully even if the token is revoked or expired | 18:07 |
| *** spzala has joined #openstack-keystone | 18:09 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 18:11 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 18:13 |
| *** spzala has quit IRC | 18:14 | |
| notmorgan | ayoung: commented | 18:15 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 18:15 |
| notmorgan | ayoung: -1 for the POST vs GET, and a bunch of nits/comments on the spec itself, but nothing critical | 18:15 |
| ayoung | notmorgan, thanks. It seems like the keystone server changes should be minimal for this. It is mostly a change in the way one service talks to another | 18:15 |
| notmorgan | ayoung: overall, looks good except for GET vs POST | 18:15 |
| ayoung | notmorgan, the big thing is going to be, when nova calls glance, it needs to send the service token along with the users token | 18:16 |
| notmorgan | ayoung: yeah | 18:16 |
| ayoung | we already have support for that, right? | 18:16 |
| notmorgan | we ... well sortof | 18:16 |
| notmorgan | code change in nova might be needed | 18:16 |
| ayoung | was hoping it could be in config and client instead | 18:16 |
| notmorgan | ksa does not have that baked in (yet) iirc | 18:17 |
| notmorgan | ksa+middleware. it was one of the things I was hoping to use via an auth plugin | 18:17 |
| notmorgan | but it should be a trivial auth plugin update to make it happen | 18:17 |
| notmorgan | and then nova config vs code change (now that I think about it) | 18:17 |
| * notmorgan runs off for lunching | 18:17 | |
| * notmorgan is back until lunch actually happens. | 18:24 | |
| *** sdake_ is now known as sdake | 18:27 | |
| notmorgan | stevemar: https://github.com/openstack/keystone/blob/master/keystone/conf/__init__.py#L125 we can remove that option now, right? | 18:28 |
| notmorgan | stevemar: since we don't have eventlet | 18:28 |
| *** michauds has joined #openstack-keystone | 18:33 | |
| *** su_zhang has joined #openstack-keystone | 18:33 | |
| *** spzala has joined #openstack-keystone | 18:33 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 18:40 |
| *** gagehugo has quit IRC | 18:44 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 18:44 |
| * stevemar waves to notmorgan | 18:45 | |
| stevemar | notmorgan: i suppose we could remove that option, i completely forgot about it | 18:45 |
| *** gagehugo has joined #openstack-keystone | 18:45 | |
| stevemar | cause it's not bundled with the regular options | 18:45 |
| openstackgerrit | Merged openstack/keystone: Replace six iteration methods with standard ones https://review.openstack.org/367213 | 18:46 |
| *** su_zhang has quit IRC | 18:47 | |
| stevemar | notmorgan: i imagine we could remove the pydev-debug-host options too | 18:49 |
| notmorgan | those we probably want to keep | 18:49 |
| stevemar | ^_- | 18:50 |
| stevemar | notmorgan: gonna push a patch or want me to do it? | 18:50 |
| notmorgan | stevemar: i can when I get home next week | 18:51 |
| notmorgan | can't really do it until then | 18:51 |
| notmorgan | lost the cord for my laptop's power supply | 18:51 |
| *** scarlisle has joined #openstack-keystone | 18:51 | |
| stevemar | notmorgan: hehe | 18:51 |
| notmorgan | so, no laptop with a charge atm =/ | 18:51 |
| stevemar | notmorgan: that's unfortunate | 18:51 |
| *** david-lyle has quit IRC | 18:53 | |
| notmorgan | stevemar: and ~1000mi from home. | 18:53 |
| *** david-lyle has joined #openstack-keystone | 18:53 | |
| openstackgerrit | Doug Hellmann proposed openstack/keystone: standardize release note page ordering https://review.openstack.org/367574 | 18:54 |
| stevemar | lbragstad: i had the same questions about the "tests" in mfisch's docs | 19:01 |
| lbragstad | stevemar yeah - just curious if we want to be more explicit there/ | 19:01 |
| stevemar | lbragstad: i am just trying to get it merged :) | 19:02 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: New notes on advanced upgrade/fallback for cluster https://review.openstack.org/360733 | 19:03 |
| stevemar | lbragstad: i changed the Keystone -> keystone stuff | 19:03 |
| lbragstad | stevemar sweet | 19:03 |
| stevemar | i don't know what to add for tests and i don't agree with your first and other change :P | 19:03 |
| lbragstad | stevemar gotcha | 19:03 |
| lbragstad | yeah - that was more of a minor comment | 19:04 |
| lbragstad | if we can figure out what we want to do about the phrasing of tests, i'm good with it | 19:04 |
| *** amakarov is now known as amakarov_away | 19:08 | |
| *** pnavarro has quit IRC | 19:19 | |
| lbragstad | samueldmq have you looked at the test_user_update_own_password tests recently? | 19:22 |
| lbragstad | in tempest? | 19:23 |
| stevemar | lbragstad: i'm not sure what to write for tests | 19:24 |
| lbragstad | stevemar you could just replace it with a statement saying to confirm keystone it up and running properly | 19:27 |
| lbragstad | (really ambiguous, but...) | 19:27 |
| lbragstad | how they do that is up to them | 19:27 |
| lbragstad | it could be through tests or manually, etc... | 19:27 |
| stevemar | lbragstad: i'm cool with that, want me to propose the wording? | 19:27 |
| lbragstad | stevemar sure - i'm sifting tempest stuff right now | 19:27 |
| *** su_zhang has joined #openstack-keystone | 19:33 | |
| *** chrisshattuck has joined #openstack-keystone | 19:34 | |
| *** adrian_otto has joined #openstack-keystone | 19:34 | |
| *** fangxu has quit IRC | 19:35 | |
| *** su_zhang has quit IRC | 19:38 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: WIP: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 19:40 |
| lbragstad | samueldmq I don't think the latest failures with the fernet patch are due to revocation caching | 19:43 |
| lbragstad | dstanek ^ | 19:43 |
| dstanek | lbragstad: errors in caching again? | 19:43 |
| lbragstad | i don't think so | 19:44 |
| lbragstad | dstanek https://review.openstack.org/#/c/367595/ | 19:44 |
| lbragstad | samueldmq ^ | 19:44 |
| lbragstad | dstanek samueldmq checkout the three failures here - http://logs.openstack.org/88/345688/16/check/gate-tempest-dsvm-neutron-full-ubuntu-xenial/080d0c0/console.html#_2016-09-08_14_46_53_253862 | 19:44 |
| samueldmq | lbragstad: I've not looked at the test recently | 19:45 |
| samueldmq | lbragstad: the failure there is different than what I used to see | 19:45 |
| samueldmq | lbragstad: as we talked earlier, it's now failing because it doesn't find the token .. and it was the opposite at that time | 19:46 |
| lbragstad | dstanek samueldmq it is returning a 404 | 19:46 |
| lbragstad | samueldmq right - but dstanek beat caching into submission | 19:46 |
| lbragstad | dstanek samueldmq and now we get a 404 | 19:46 |
| lbragstad | in this method https://github.com/openstack/tempest/blob/53015677cd2d96ade6863c67b4736128195798ff/tempest/api/identity/v3/test_users.py#L37-L47 | 19:46 |
| lbragstad | which is trying to change a password and authenticate | 19:47 |
| lbragstad | (probably within the same second) | 19:47 |
| lbragstad | which means it could be hitting the revocation check (and the revocation events are working properly) | 19:47 |
| *** code-R_ has quit IRC | 19:47 | |
| samueldmq | lbragstad: hmm so maybe it was relying in the wrong behavior before ? | 19:49 |
| samueldmq | it is failing for other token formats too ? | 19:49 |
| samueldmq | or only fernet | 19:49 |
| samueldmq | brb | 19:49 |
| lbragstad | I assume only fernet | 19:49 |
| dstanek | lbragstad: yeah, that would be problematic if it were in the same second | 19:49 |
| dstanek | why would this problem only appear with fernet though? if it's a revocation issue | 19:49 |
| *** sdake_ has joined #openstack-keystone | 19:50 | |
| lbragstad | becuase fernet is granular to the second? | 19:50 |
| * lbragstad dstanek that doesn't explain why this test fails though - http://logs.openstack.org/88/345688/16/check/gate-tempest-dsvm-neutron-full-ubuntu-xenial/080d0c0/console.html#_2016-09-08_14_46_53_261419 | 19:50 | |
| *** sdake has quit IRC | 19:52 | |
| *** slberger has quit IRC | 19:53 | |
| dstanek | lbragstad: is that actually a fernet thing or a revocation thing? | 19:54 |
| dstanek | lbragstad: or are uuids only to the minute? | 19:55 |
| *** slberger has joined #openstack-keystone | 19:55 | |
| lbragstad | dstanek uuids are microsecond | 19:56 |
| lbragstad | dstanek the second precision with fernet is because of the spec | 19:56 |
| bknudson | there was an issue with revocation events because some version of mysql only had second-level granularity too | 19:56 |
| dstanek | lbragstad: ah, right | 19:57 |
| dstanek | i hate it when all the things are broken | 19:57 |
| lbragstad | dstanek ++ | 19:58 |
| lbragstad | so i can see why tempest.api.identity.v2.test_users.IdentityUsersTest.test_user_update_own_password and tempest.api.identity.v3.test_users.IdentityUsersTest.test_user_update_own_password fail that way because the have the _restore_password method | 19:59 |
| mtreinish | bknudson: heh, it's most versions of mysql | 19:59 |
| lbragstad | but tempest.api.identity.admin.v3.test_users.UsersV3TestJSON.test_update_user_password does not | 20:00 |
| bknudson | I don't remember when that changed in mysql | 20:00 |
| mtreinish | bknudson: looking at https://dev.mysql.com/doc/refman/5.6/en/fractional-seconds.html it was a thing starting in 5.6.4 | 20:00 |
| mtreinish | at least for time, datetime, timestamp columns | 20:01 |
| mtreinish | I had to deal with that in subunit2sql at one point too | 20:01 |
| bknudson | mtreinish: because it changed or because it was truncating? | 20:02 |
| mtreinish | because it was truncating on the infra server | 20:03 |
| mtreinish | I ended up just splitting the microseconds into a separate integer column | 20:03 |
| mtreinish | and gluing the pieces together in python | 20:04 |
| bknudson | does openstack say what version of mysql is supported? | 20:06 |
| mtreinish | That's a good question, I don't think so. At least I've never seen it documented anywhere explicitly | 20:08 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 20:10 |
| bknudson | I assume it's higher than 1 | 20:10 |
| *** su_zhang has joined #openstack-keystone | 20:10 | |
| *** su_zhang has quit IRC | 20:18 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 20:18 |
| *** asettle has quit IRC | 20:19 | |
| *** asettle has joined #openstack-keystone | 20:21 | |
| *** su_zhang has joined #openstack-keystone | 20:23 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 20:23 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: New notes on advanced upgrade/fallback for cluster https://review.openstack.org/360733 | 20:25 |
| *** asettle has quit IRC | 20:25 | |
| stevemar | lbragstad: updated https://review.openstack.org/#/c/360733/ | 20:25 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: POC sql query revoked tokens https://review.openstack.org/359371 | 20:30 |
| *** su_zhang has quit IRC | 20:32 | |
| samueldmq | lbragstad: back | 20:32 |
| *** ravelar has quit IRC | 20:32 | |
| rderose | stevemar: just saw your comment regarding password_expires_at | 20:34 |
| *** fangxu has joined #openstack-keystone | 20:35 | |
| rderose | stevemar: password_expires_at will be returned now for all users (SQL, LDAP...) | 20:35 |
| lbragstad | samueldmq o/ | 20:35 |
| samueldmq | lbragstad: did you get what's going on ? | 20:35 |
| rderose | stevemar: and in order for it to be useful, it needs to be returned in auth | 20:35 |
| rderose | stevemar: not changing the auth API, it includes the user object | 20:35 |
| lbragstad | samueldmq partially - just kinda stepping through it with dstanek | 20:36 |
| stevemar | rderose: whats it return for ldap and federated users? | 20:36 |
| samueldmq | lbragstad: need help ? | 20:36 |
| rderose | just returns password_expires_at: None | 20:36 |
| stevemar | i see | 20:36 |
| samueldmq | lbragstad: let me know if you need a couple of extra eyes | 20:36 |
| lbragstad | samueldmq so apparently 3 tests failed in the last run | 20:36 |
| rderose | stevemar: the horizon team is adding a new dialog window for this | 20:36 |
| stevemar | rderose: why would you need it as part of the auth request? | 20:37 |
| stevemar | ohhh | 20:37 |
| lbragstad | samueldmq i think i understand why two of them failed | 20:37 |
| stevemar | that wasn't in the commit message :) | 20:37 |
| rderose | stevemar: auth response | 20:37 |
| lbragstad | samueldmq but i'm trying to figure out why http://logs.openstack.org/88/345688/16/check/gate-tempest-dsvm-neutron-full-ubuntu-xenial/080d0c0/console.html#_2016-09-08_14_46_53_261419 failed | 20:37 |
| rderose | stevemar: true | 20:37 |
| stevemar | rderose: new dialog window eh | 20:37 |
| stevemar | rderose: any way we can bump this to O? | 20:37 |
| rderose | stevemar: yeah, saying it's time to change your password, 7 days left or something | 20:37 |
| rderose | stevemar: we could, but it's such a small change :) | 20:38 |
| stevemar | that ones a bit dicey, i don't like playing around with auth so late in the game | 20:38 |
| david-lyle | stevemar: we won't consume until O | 20:38 |
| rderose | stevemar: well, there you go :) | 20:38 |
| stevemar | david-lyle: o/ | 20:38 |
| stevemar | david-lyle: thanks for confirming | 20:39 |
| stevemar | rderose: we cool? | 20:39 |
| samueldmq | lbragstad: hmm, that test failed in both v2 and v3 | 20:39 |
| rderose | stevemar: we cool! | 20:39 |
| stevemar | *fist bump* | 20:39 |
| samueldmq | lbragstad: it is present in both test suites in tempest | 20:39 |
| rderose | stevemar :) | 20:39 |
| lbragstad | samueldmq i don't think so | 20:39 |
| lbragstad | samueldmq tempest.api.identity.v3.test_users.IdentityV3UsersTest.test_user_update_own_password and tempest.api.identity.v2.test_users.IdentityV2UsersTest.test_user_update_own_password | 20:40 |
| lbragstad | both failed but I think that is because they were doing an authenticate within the same second as a password change | 20:40 |
| samueldmq | dstanek: the v3 test has a sleep in there | 20:45 |
| samueldmq | lbragstad: ^ | 20:45 |
| samueldmq | lbragstad: https://github.com/openstack/tempest/blob/master/tempest/api/identity/admin/v3/test_users.py#L85 | 20:45 |
| lbragstad | samueldmq yep ] | 20:45 |
| samueldmq | lbragstad: so it can't be happening in the same second ? | 20:45 |
| lbragstad | samueldmq right | 20:45 |
| lbragstad | samueldmq that's the part that's confusing me | 20:45 |
| stevemar | lbragstad: i don't know what you want me to change in the upgrade doc :\ | 20:45 |
| stevemar | oh, the title? | 20:46 |
| lbragstad | stevemar yeah | 20:46 |
| lbragstad | samueldmq and it passes this time - https://review.openstack.org/#/c/345688/ | 20:46 |
| stevemar | lbragstad: hmm, then it'll be the same name as another section 2 below | 20:47 |
| samueldmq | ..... | 20:47 |
| stevemar | lbragstad: how about i break it up into single node deployment vs cluster | 20:47 |
| samueldmq | lbragstad: so it's intermittent :( | 20:47 |
| lbragstad | stevemar there's already a 'Upgrading with minimal downtime' section? | 20:48 |
| samueldmq | lbragstad: we should be able to add logs to keystone, and add a depends-on | 20:48 |
| samueldmq | lbragstad: to gather more information on why it's returning 404 | 20:48 |
| stevemar | lbragstad: bah i can't read | 20:50 |
| stevemar | lbragstad: can you also quickly review https://review.openstack.org/#/c/366270/ and it's dependent patch | 20:51 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: New notes on advanced upgrade/fallback for cluster https://review.openstack.org/360733 | 20:51 |
| lbragstad | samueldmq yeah - not sure but it could be hitting the revocation event somehow | 20:51 |
| samueldmq | lbragstad: I can't see how because the revocation event includes a timestamp | 20:52 |
| samueldmq | lbragstad: and the test sleeps for 1 second | 20:52 |
| lbragstad | stevemar are we addressing breton's comment here - https://review.openstack.org/#/c/366270/1/doc/source/index.rst ? | 20:52 |
| stevemar | lbragstad: you mean browne's :) | 20:52 |
| lbragstad | samueldmq true - what else could make that 404 though? | 20:53 |
| stevemar | lbragstad: no, i don't want to waste resources for a whitespace change that jenkins didn't fail :P | 20:53 |
| samueldmq | lbragstad: dunno need to take a better look | 20:53 |
| lbragstad | stevemar yep (sorry for the rogue ping breton) | 20:53 |
| samueldmq | lbragstad: it's a GET token, right ? | 20:53 |
| lbragstad | samueldmq yeah - a show token which i think is a GET /v3/auth/tokens | 20:53 |
| samueldmq | lbragstad: kk | 20:54 |
| stevemar | samueldmq: with the token you want to show passed in as X-Subject-Token | 20:55 |
| samueldmq | stevemar: and it's returned as x-subject-token too ? | 20:55 |
| stevemar | i do believe so, i'd have to check the API | 20:55 |
| stevemar | use x-auth-token for *your* token | 20:56 |
| samueldmq | stevemar: nvm, it's passed as x-subject-token, yes | 20:56 |
| samueldmq | stevemar: ++ | 20:56 |
| lbragstad | samueldmq stevemar https://github.com/openstack/tempest/blob/master/tempest/lib/services/identity/v3/identity_client.py#L32 | 20:56 |
| samueldmq | stevemar: token to perform -> x-auth-token | 20:56 |
| samueldmq | token to validate -> subject | 20:56 |
| *** mvk has joined #openstack-keystone | 20:58 | |
| *** harlowja_ has joined #openstack-keystone | 20:59 | |
| *** harlowja has quit IRC | 21:00 | |
| *** raildo has quit IRC | 21:01 | |
| *** fangxu has quit IRC | 21:01 | |
| *** su_zhang has joined #openstack-keystone | 21:03 | |
| *** javis has quit IRC | 21:03 | |
| *** fangxu has joined #openstack-keystone | 21:07 | |
| *** su_zhang has quit IRC | 21:08 | |
| *** pauloewerton has quit IRC | 21:14 | |
| *** shaleh has quit IRC | 21:16 | |
| *** ametts has quit IRC | 21:19 | |
| *** tonytan4ever has quit IRC | 21:27 | |
| *** ametts has joined #openstack-keystone | 21:31 | |
| lbragstad | dstanek we don't still use itertools for iterating over dictionaries do we? | 21:38 |
| lbragstad | from six? | 21:38 |
| *** adrian_otto has quit IRC | 21:40 | |
| *** javis has joined #openstack-keystone | 21:44 | |
| *** su_zhang has joined #openstack-keystone | 21:53 | |
| *** ametts has quit IRC | 21:57 | |
| *** javis has quit IRC | 22:01 | |
| *** fangxu has quit IRC | 22:04 | |
| dolphm | can someone give this a push? it's an entirely automated patch https://review.openstack.org/#/c/366958/ | 22:06 |
| dolphm | tox -e genconfig | 22:06 |
| dolphm | lbragstad: i believe there were a bunch of new features in itertools in 2.7, so we used six there mostly for 2.6 <-> 2.7 compatibility, which we don't care about anymore | 22:07 |
| samueldmq | dolphm: done | 22:08 |
| dolphm | samueldmq: thanks! | 22:08 |
| samueldmq | dolphm: anytime | 22:08 |
| *** chrisshattuck has quit IRC | 22:10 | |
| *** tristanC has quit IRC | 22:12 | |
| *** fangxu has joined #openstack-keystone | 22:13 | |
| *** slberger has left #openstack-keystone | 22:13 | |
| *** tristanC has joined #openstack-keystone | 22:13 | |
| *** michauds has quit IRC | 22:14 | |
| *** BjoernT has quit IRC | 22:17 | |
| *** harlowja has joined #openstack-keystone | 22:18 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 22:19 |
| *** harlowja_ has quit IRC | 22:22 | |
| *** mvk has quit IRC | 22:23 | |
| stevemar | dolphm: thanks for the reviews | 22:25 |
| stevemar | dolphm and samueldmq there are a few reviews out there by dhellmann that are ready to be merged | 22:26 |
| samueldmq | stevemar: will look now | 22:26 |
| *** tonytan4ever has joined #openstack-keystone | 22:28 | |
| samueldmq | stevemar: dhellmann: all approved | 22:30 |
| *** ntpttr has quit IRC | 22:31 | |
| *** su_zhang has quit IRC | 22:31 | |
| *** ntpttr has joined #openstack-keystone | 22:31 | |
| *** tonytan4ever has quit IRC | 22:33 | |
| *** sdake has joined #openstack-keystone | 22:34 | |
| *** sdake_ has quit IRC | 22:36 | |
| *** mvk has joined #openstack-keystone | 22:37 | |
| *** BjoernT has joined #openstack-keystone | 22:42 | |
| *** spzala has quit IRC | 22:48 | |
| *** spzala has joined #openstack-keystone | 22:49 | |
| *** adriant has joined #openstack-keystone | 22:50 | |
| *** spzala has quit IRC | 22:53 | |
| *** sdake has quit IRC | 22:59 | |
| *** BjoernT has quit IRC | 23:01 | |
| openstackgerrit | Merged openstack/keystone: New notes on advanced upgrade/fallback for cluster https://review.openstack.org/360733 | 23:04 |
| *** gagehugo has quit IRC | 23:05 | |
| openstackgerrit | Merged openstack/keystone: Update sample keystone.conf for Newton https://review.openstack.org/366958 | 23:11 |
| *** adrian_otto has joined #openstack-keystone | 23:16 | |
| ayoung | notmorgan, Using the kerberos authentication plugin requires installation of additional | 23:17 |
| ayoung | packages. These can be installed with:: | 23:17 |
| ayoung | $ pip install keystoneauth1[kerberos] | 23:17 |
| ayoung | we have an RPM for keystoneauth1 | 23:18 |
| openstackgerrit | Merged openstack/keystone: standardize release note page ordering https://review.openstack.org/367574 | 23:18 |
| *** asettle has joined #openstack-keystone | 23:22 | |
| *** ntpttr has quit IRC | 23:23 | |
| *** markvoelker has quit IRC | 23:25 | |
| *** ntpttr has joined #openstack-keystone | 23:28 | |
| *** asettle has quit IRC | 23:30 | |
| *** javis has joined #openstack-keystone | 23:31 | |
| openstackgerrit | Merged openstack/keystonemiddleware: standardize release note page ordering https://review.openstack.org/366975 | 23:31 |
| openstackgerrit | Merged openstack/keystoneauth: standardize release note page ordering https://review.openstack.org/366976 | 23:32 |
| *** shoutm has joined #openstack-keystone | 23:43 | |
| dstanek | lbragstad: what do you need itertools for? | 23:44 |
| *** shoutm has quit IRC | 23:46 | |
| *** BjoernT has joined #openstack-keystone | 23:52 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!