| *** browne has quit IRC | 00:02 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Specify that unknown arguments can be passed to fetch_token https://review.openstack.org/379034 | 00:04 |
|---|---|---|
| *** adrian_otto has joined #openstack-keystone | 00:08 | |
| ayoung | jamielennox, the question I had was whether that should be something enforced on the KEystone server, or only in middleware | 00:17 |
| * ayoung reads up and sees you just discussed this | 00:17 | |
| jamielennox | ayoung: that's exactly the question i was asking :) | 00:17 |
| jamielennox | i had some code that was assuming it would be enforced by keystone server - but am not feeling like we should have to do that | 00:18 |
| ayoung | so, went through that thought process, too. I figure that it *HAS* to be enforced in middleware, but it *might* be enforced in keystone, too | 00:18 |
| ayoung | not much to be gained by adding it to the server, though | 00:19 |
| jamielennox | right, so middleware is going to have to know and do some things | 00:19 |
| jamielennox | but taking just the change to keystone, i don't see a problem with an ?allow_expired flag to keystone on its own | 00:20 |
| jamielennox | i don't see why you would need a service token to fetch that | 00:20 |
| jamielennox | which means enforcing everything from middleware | 00:20 |
| *** tonytan4ever has joined #openstack-keystone | 00:24 | |
| *** sdake_ has quit IRC | 00:25 | |
| jamielennox | ayoung: anyway, basically i want to check that other people who have thought about this have the same ideas | 00:26 |
| jamielennox | ayoung: like maybe we had discussed a reason it had to be enforced on the server | 00:27 |
| *** adrian_otto has quit IRC | 00:27 | |
| *** jamielennox is now known as jamielennox|away | 00:29 | |
| *** tonytan4ever has quit IRC | 00:30 | |
| *** jamielennox|away is now known as jamielennox | 00:33 | |
| *** roxanaghe has joined #openstack-keystone | 00:51 | |
| *** sdake has joined #openstack-keystone | 00:52 | |
| *** roxanaghe has quit IRC | 00:53 | |
| stevemar | jamielennox: eh | 01:10 |
| stevemar | jamielennox: just catching up... | 01:11 |
| openstackgerrit | gengchc2 proposed openstack/keystone: Fix a typo in core.py and bp-domain-config-default-82e42d946ee7cb43.yaml https://review.openstack.org/379052 | 01:11 |
| jamielennox | stevemar: np | 01:11 |
| *** markvoelker has joined #openstack-keystone | 01:13 | |
| *** davechen has joined #openstack-keystone | 01:18 | |
| *** ddieterly has joined #openstack-keystone | 01:41 | |
| *** jamielennox is now known as jamielennox|away | 01:42 | |
| *** woodster_ has joined #openstack-keystone | 01:51 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Add foreign key to trust table https://review.openstack.org/368422 | 02:27 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Invalidate trust when the trustor or trustee is deleted https://review.openstack.org/369354 | 02:27 |
| *** jorge_munoz has quit IRC | 02:36 | |
| *** jorge_munoz has joined #openstack-keystone | 02:40 | |
| *** sdake has quit IRC | 02:52 | |
| *** gagehugo has quit IRC | 02:57 | |
| *** marekd2 has joined #openstack-keystone | 03:01 | |
| *** gagehugo has joined #openstack-keystone | 03:02 | |
| *** david-lyle has quit IRC | 03:04 | |
| *** gagehugo has quit IRC | 03:05 | |
| *** marekd2 has quit IRC | 03:05 | |
| *** jamielennox|away is now known as jamielennox | 03:11 | |
| *** sdake has joined #openstack-keystone | 03:16 | |
| *** TonyXu has joined #openstack-keystone | 03:16 | |
| *** sdake has quit IRC | 03:19 | |
| openstackgerrit | George Tian proposed openstack/keystone: remove no use variable https://review.openstack.org/379102 | 03:21 |
| *** ngupta has joined #openstack-keystone | 03:27 | |
| *** sdake has joined #openstack-keystone | 03:31 | |
| *** links has joined #openstack-keystone | 03:33 | |
| *** ddieterly has quit IRC | 03:33 | |
| *** aswadr_ has joined #openstack-keystone | 03:42 | |
| stevemar | jamielennox: ^ | 03:45 |
| stevemar | https://review.openstack.org/#/c/379102/1 | 03:45 |
| *** diltram has quit IRC | 03:46 | |
| *** hoonetorg has quit IRC | 03:47 | |
| *** pcaruana has quit IRC | 03:47 | |
| *** xek__ has quit IRC | 03:47 | |
| openstackgerrit | Merged openstack/keystone: Fix a typo in core.py and bp-domain-config-default-82e42d946ee7cb43.yaml https://review.openstack.org/379052 | 03:48 |
| *** d0ugal has quit IRC | 03:48 | |
| *** Dave___ has joined #openstack-keystone | 03:48 | |
| *** diltram has joined #openstack-keystone | 03:50 | |
| *** oomichi has quit IRC | 03:52 | |
| *** Dave has quit IRC | 03:52 | |
| *** hoonetorg has joined #openstack-keystone | 03:53 | |
| *** oomichi has joined #openstack-keystone | 03:54 | |
| *** diltram has quit IRC | 03:55 | |
| *** woodburn has quit IRC | 03:55 | |
| *** woodburn has joined #openstack-keystone | 03:56 | |
| *** diltram has joined #openstack-keystone | 03:56 | |
| *** d0ugal has joined #openstack-keystone | 03:57 | |
| *** pcaruana has joined #openstack-keystone | 03:59 | |
| openstackgerrit | Cao Xuan Hoang proposed openstack/keystone: Add Apache 2.0 license to source file https://review.openstack.org/379111 | 04:02 |
| *** lifeless has quit IRC | 04:02 | |
| *** lifeless has joined #openstack-keystone | 04:05 | |
| *** TonyXu has quit IRC | 04:05 | |
| *** TonyXu has joined #openstack-keystone | 04:06 | |
| *** ngupta has quit IRC | 04:08 | |
| *** ngupta has joined #openstack-keystone | 04:08 | |
| *** ngupta has quit IRC | 04:13 | |
| *** vaishali has joined #openstack-keystone | 04:13 | |
| stevemar | zzzeek: can the following operation be done online: change a column from sql.String(64) to sql.String(255), i.e. not have downtime | 04:27 |
| openstackgerrit | lilintan proposed openstack/keystoneauth: Use mockpatch fixtures from fixtures https://review.openstack.org/379120 | 04:41 |
| openstackgerrit | George Tian proposed openstack/keystone: Remove no use variable (domain_id) https://review.openstack.org/379122 | 04:43 |
| *** dikonoo has joined #openstack-keystone | 04:44 | |
| *** GB21 has joined #openstack-keystone | 04:52 | |
| *** sdake has quit IRC | 05:00 | |
| *** vaishali has quit IRC | 05:12 | |
| *** dikonoo has quit IRC | 05:17 | |
| *** marekd2 has joined #openstack-keystone | 05:21 | |
| *** vaishali has joined #openstack-keystone | 05:25 | |
| *** marekd2 has quit IRC | 05:25 | |
| *** dikonoor has joined #openstack-keystone | 05:28 | |
| *** richm has quit IRC | 05:40 | |
| breton | o/ | 05:43 |
| *** adriant has quit IRC | 05:43 | |
| *** xek has joined #openstack-keystone | 05:59 | |
| *** woodster_ has quit IRC | 06:00 | |
| stevemar | breton: o/ | 06:03 |
| stevemar | jamielennox: are https://review.openstack.org/#/c/379035/1 and https://review.openstack.org/#/c/379034/2 related to the long lived operation / reservation bp? | 06:16 |
| stevemar | jamielennox: if so, change the topic to the same for each ;) | 06:17 |
| breton | it seems that landing that caching fix lowered keystone performance on token issuing | 06:18 |
| * breton working on it now | 06:19 | |
| stevemar | breton: bah | 06:19 |
| *** rcernin has joined #openstack-keystone | 06:22 | |
| *** dikonoor has quit IRC | 06:23 | |
| *** dikonoor has joined #openstack-keystone | 06:27 | |
| *** jaosorior has joined #openstack-keystone | 06:58 | |
| *** amoralej|off is now known as amoralej | 07:06 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/379139 | 07:14 |
| openstackgerrit | Nam Nguyen Hoai proposed openstack/keystone: Fix typo in docstring https://review.openstack.org/378218 | 07:14 |
| *** asettle has joined #openstack-keystone | 07:39 | |
| openstackgerrit | George Tian proposed openstack/keystone: Remove the no use arg (auth=None) https://review.openstack.org/379234 | 07:41 |
| openstackgerrit | Merged openstack/keystoneauth: Use mockpatch fixtures from fixtures https://review.openstack.org/379120 | 07:59 |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** Dave___ is now known as Dave | 08:07 | |
| *** aswadr_ has quit IRC | 08:12 | |
| *** marekd2 has joined #openstack-keystone | 08:16 | |
| *** marekd2 has quit IRC | 08:20 | |
| *** pnavarro has joined #openstack-keystone | 09:00 | |
| *** annakoppad has joined #openstack-keystone | 09:02 | |
| *** jaosorior is now known as jaosorior_lunch | 09:05 | |
| *** jed56 has quit IRC | 09:05 | |
| annakoppad | hello all, I am currently working on this bug, https://bugs.launchpad.net/keystone/+bug/1274581. can someone help? | 09:06 |
| openstack | Launchpad bug 1274581 in OpenStack Identity (keystone) "keystone ldap identity backend will not work without TLS_CACERT path specified in an ldap.conf file" [Low,Confirmed] - Assigned to Annapoornima Koppad (annakoppad) | 09:06 |
| *** namnh has joined #openstack-keystone | 09:09 | |
| *** haplo37_ has quit IRC | 09:23 | |
| *** haplo37_ has joined #openstack-keystone | 09:26 | |
| openstackgerrit | Merged openstack/oslo.policy: doc: Add introduction to index page https://review.openstack.org/378490 | 09:33 |
| *** code-R has joined #openstack-keystone | 09:39 | |
| *** code-R_ has joined #openstack-keystone | 09:41 | |
| *** code-R has quit IRC | 09:44 | |
| openstackgerrit | George Tian proposed openstack/keystone: Remove the no use arg https://review.openstack.org/379266 | 09:45 |
| *** sdake has joined #openstack-keystone | 09:47 | |
| *** namnh has quit IRC | 09:54 | |
| *** code-R_ has quit IRC | 09:54 | |
| *** code-R has joined #openstack-keystone | 09:55 | |
| openstackgerrit | Annapoornima Koppad proposed openstack/keystone: Updating the document regarding LDAP options Closes-bug : #1274581 https://review.openstack.org/379334 | 09:59 |
| *** richm has joined #openstack-keystone | 10:10 | |
| *** thebloggu has joined #openstack-keystone | 10:13 | |
| openstackgerrit | Annapoornima Koppad proposed openstack/keystone: Updating the document regarding LDAP options https://review.openstack.org/379334 | 10:14 |
| *** ayoung has quit IRC | 10:27 | |
| *** mvk has quit IRC | 10:29 | |
| *** nicolasbock has joined #openstack-keystone | 10:34 | |
| *** annakoppad has quit IRC | 10:35 | |
| *** GB21 has quit IRC | 10:37 | |
| *** TonyXu has quit IRC | 10:37 | |
| *** ayoung has joined #openstack-keystone | 10:40 | |
| *** ChanServ sets mode: +v ayoung | 10:40 | |
| *** GB21 has joined #openstack-keystone | 10:49 | |
| *** davechen has left #openstack-keystone | 10:51 | |
| *** mvk has joined #openstack-keystone | 10:55 | |
| *** jaosorior_lunch is now known as jaosorior | 11:02 | |
| *** dikonoor has quit IRC | 11:07 | |
| *** openstackgerrit has quit IRC | 11:19 | |
| *** openstackgerrit has joined #openstack-keystone | 11:19 | |
| *** cnf has left #openstack-keystone | 11:23 | |
| *** jrist has joined #openstack-keystone | 11:25 | |
| *** dikonoor has joined #openstack-keystone | 11:26 | |
| *** thebloggu has quit IRC | 11:38 | |
| *** haplo37_ has quit IRC | 11:42 | |
| *** haplo37_ has joined #openstack-keystone | 11:44 | |
| *** rodrigods has quit IRC | 11:51 | |
| *** rodrigods has joined #openstack-keystone | 11:51 | |
| *** jrist has quit IRC | 11:56 | |
| *** dikonoor has quit IRC | 11:56 | |
| *** amoralej is now known as amoralej|lunch | 11:59 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Special 401/403 debug responses with qa disabled https://review.openstack.org/377792 | 12:06 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Special 401/403 debug responses with qa disabled https://review.openstack.org/377792 | 12:06 |
| *** artmr has joined #openstack-keystone | 12:07 | |
| *** vaishali has quit IRC | 12:12 | |
| *** raildo has joined #openstack-keystone | 12:14 | |
| *** TonyXu has joined #openstack-keystone | 12:14 | |
| *** edmondsw has joined #openstack-keystone | 12:15 | |
| *** jrist has joined #openstack-keystone | 12:17 | |
| *** catintheroof has joined #openstack-keystone | 12:18 | |
| *** vaishali has joined #openstack-keystone | 12:24 | |
| *** jrist has quit IRC | 12:28 | |
| catintheroof | morning, one quick question, when a service (eg. nova) validates a fernet token against keystone, from where (is allways, or most of the time) does keystone get the info to return the response to the service for the service to get the needed info to continue with the request ? | 12:30 |
| frickler | keystone needs oslo.log >= 3.4.0 even for newton, should this get fixed before the release https://bugs.launchpad.net/keystone/+bug/1628883 | 12:32 |
| openstack | Launchpad bug 1628883 in keystone (Ubuntu) "Minimum requirements too low on oslo.log for keystone" [Undecided,Triaged] - Assigned to Corey Bryant (corey.bryant) | 12:32 |
| *** vaishali has quit IRC | 12:35 | |
| *** GB21 has quit IRC | 12:55 | |
| *** ddieterly has joined #openstack-keystone | 12:56 | |
| breton | frickler: why >= 3.4.0? | 12:57 |
| *** david-lyle has joined #openstack-keystone | 12:57 | |
| breton | frickler: it's the first version to define that variable? | 12:57 |
| *** ddieterly has quit IRC | 12:59 | |
| *** ddieterly has joined #openstack-keystone | 12:59 | |
| breton | looks like it | 12:59 |
| *** ddieterly has quit IRC | 12:59 | |
| frickler | breton: yes, that is what I gather from "git tag -l --contains 7f1973af" in oslo.log | 13:00 |
| *** lamt has joined #openstack-keystone | 13:03 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Import module instead of object https://review.openstack.org/377198 | 13:07 |
| breton | frickler: https://review.openstack.org/379451 | 13:08 |
| breton | stevemar: ^ | 13:09 |
| breton | master already has newer oslo.log | 13:09 |
| frickler | breton: I'm not sure whether you can do this so easily for stable branches without matching global-requirements | 13:12 |
| *** links has quit IRC | 13:17 | |
| openstackgerrit | Merged openstack/keystone: Add Apache 2.0 license to source file https://review.openstack.org/379111 | 13:20 |
| openstackgerrit | Merged openstack/keystone: Make test_v3_auth exercise the whole API https://review.openstack.org/378681 | 13:21 |
| *** lamt has quit IRC | 13:21 | |
| *** jaosorior has quit IRC | 13:21 | |
| *** jaosorior has joined #openstack-keystone | 13:22 | |
| *** amoralej|lunch is now known as amoralej | 13:22 | |
| *** gagehugo has joined #openstack-keystone | 13:30 | |
| breton | frickler: well, we probably can't merge it | 13:34 |
| *** spzala has joined #openstack-keystone | 13:56 | |
| *** ngupta has joined #openstack-keystone | 14:00 | |
| *** haplo37_ has quit IRC | 14:01 | |
| *** pnavarro has quit IRC | 14:03 | |
| *** haplo37_ has joined #openstack-keystone | 14:04 | |
| *** chris_hultin|AWA is now known as chris_hultin | 14:05 | |
| *** jaugustine has joined #openstack-keystone | 14:05 | |
| *** agrebennikov has joined #openstack-keystone | 14:07 | |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Tweak api-ref for v3 groups status codes https://review.openstack.org/367793 | 14:07 |
| *** ravelar has joined #openstack-keystone | 14:10 | |
| *** ravelar has quit IRC | 14:11 | |
| *** ravelar has joined #openstack-keystone | 14:12 | |
| *** ddieterly has joined #openstack-keystone | 14:14 | |
| *** ngupta has quit IRC | 14:17 | |
| openstackgerrit | Alexey Yelistratov proposed openstack/keystone: Add DB operations tracing https://review.openstack.org/294535 | 14:22 |
| *** sdake has quit IRC | 14:24 | |
| *** sdake has joined #openstack-keystone | 14:26 | |
| *** sdake_ has joined #openstack-keystone | 14:34 | |
| *** jorge_munoz_ has joined #openstack-keystone | 14:35 | |
| *** sdake has quit IRC | 14:36 | |
| *** jorge_munoz has quit IRC | 14:37 | |
| *** jorge_munoz_ is now known as jorge_munoz | 14:37 | |
| *** TonyXu has quit IRC | 14:44 | |
| *** nicolasbock has quit IRC | 14:44 | |
| *** chris_hultin is now known as chris_hultin|AWA | 14:45 | |
| *** nicolasbock has joined #openstack-keystone | 14:52 | |
| *** jamielennox is now known as jamielennox|away | 14:53 | |
| *** aswadr_ has joined #openstack-keystone | 14:53 | |
| *** sdake_ is now known as sdake_dnd | 14:53 | |
| *** TonyXu has joined #openstack-keystone | 14:59 | |
| *** sdake has joined #openstack-keystone | 14:59 | |
| *** jamielennox|away is now known as jamielennox | 15:00 | |
| *** sdake_dnd has quit IRC | 15:00 | |
| *** agrebennikov has quit IRC | 15:00 | |
| *** thumpba has joined #openstack-keystone | 15:01 | |
| *** chris_hultin|AWA is now known as chris_hultin | 15:07 | |
| *** thumpba has quit IRC | 15:11 | |
| *** thumpba has joined #openstack-keystone | 15:12 | |
| openstackgerrit | Arthur Miranda proposed openstack/python-keystoneclient: Prevent attempts to "filter" find() calls by globally unique IDs https://review.openstack.org/375730 | 15:16 |
| knikolla | rodrigods: had a chance to look at the devstack plugin? | 15:17 |
| rodrigods | knikolla, not yet, sorry :( | 15:17 |
| *** ravelar has quit IRC | 15:19 | |
| *** ravelar has joined #openstack-keystone | 15:19 | |
| *** sdake is now known as sdake_dnd | 15:26 | |
| stevemar | breton: it was already discussed here: https://bugs.launchpad.net/cinder/+bug/1623168 | 15:26 |
| openstack | Launchpad bug 1623168 in Cinder "referencing versionutils.deprecated.NEWTON in oslo.log <3.4.0" [Undecided,In progress] - Assigned to Eric Harney (eharney) | 15:26 |
| *** adrian_otto has joined #openstack-keystone | 15:28 | |
| *** arunkant has joined #openstack-keystone | 15:30 | |
| *** thumpba has quit IRC | 15:34 | |
| *** amoralej is now known as amoralej|off | 15:37 | |
| *** tonytan4ever has joined #openstack-keystone | 15:45 | |
| openstackgerrit | Annapoornima Koppad proposed openstack/keystone: Updating the document regarding LDAP options https://review.openstack.org/379334 | 15:46 |
| *** openstackgerrit has quit IRC | 15:49 | |
| *** openstackgerrit has joined #openstack-keystone | 15:50 | |
| *** ddieterly is now known as ddieterly[away] | 15:52 | |
| *** chris_hultin is now known as chris_hultin|AWA | 16:01 | |
| *** ddieterly[away] is now known as ddieterly | 16:02 | |
| *** pcaruana has quit IRC | 16:03 | |
| *** woodster_ has joined #openstack-keystone | 16:03 | |
| *** rcernin has quit IRC | 16:05 | |
| *** lifeless has quit IRC | 16:25 | |
| *** sdake_dnd is now known as sdake | 16:27 | |
| *** scarlisle has joined #openstack-keystone | 16:31 | |
| *** lifeless has joined #openstack-keystone | 16:33 | |
| *** cnf has joined #openstack-keystone | 16:33 | |
| *** gyee has joined #openstack-keystone | 16:36 | |
| openstackgerrit | Arthur Miranda proposed openstack/python-keystoneclient: Prevent attempts to "filter" list() calls by globally unique IDs https://review.openstack.org/378001 | 16:37 |
| *** ravelar has quit IRC | 16:38 | |
| openstackgerrit | Alexey Yelistratov proposed openstack/keystone: Add DB operations tracing https://review.openstack.org/294535 | 16:41 |
| *** adrian_otto has quit IRC | 16:44 | |
| *** browne has joined #openstack-keystone | 16:54 | |
| *** roxanaghe has joined #openstack-keystone | 16:55 | |
| *** haplo37_ has quit IRC | 16:56 | |
| *** haplo37_ has joined #openstack-keystone | 16:58 | |
| *** ravelar has joined #openstack-keystone | 17:05 | |
| *** ddieterly is now known as ddieterly[away] | 17:07 | |
| *** code-R has quit IRC | 17:07 | |
| *** mvk has quit IRC | 17:08 | |
| *** jaosorior has quit IRC | 17:20 | |
| *** aswadr_ has quit IRC | 17:22 | |
| *** asettle has quit IRC | 17:26 | |
| *** roxanaghe has quit IRC | 17:27 | |
| *** roxanaghe has joined #openstack-keystone | 17:28 | |
| *** ddieterly[away] is now known as ddieterly | 17:31 | |
| *** asettle has joined #openstack-keystone | 17:34 | |
| *** TonyXu has quit IRC | 17:34 | |
| *** TonyXu has joined #openstack-keystone | 17:35 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove support for PKI and PKIz tokens https://review.openstack.org/374479 | 17:36 |
| *** asettle has quit IRC | 17:36 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove support for PKI and PKIz tokens https://review.openstack.org/374479 | 17:51 |
| *** ravelar has quit IRC | 17:55 | |
| *** ravelar has joined #openstack-keystone | 17:55 | |
| stevemar | zzzeek: poke -- not sure if you caught my ping yesterday | 17:55 |
| zzzeek | stevemar: i may have missed it | 17:55 |
| stevemar | zzzeek: it was late at night :) but i had a question about changing the size of a column | 17:56 |
| stevemar | zzzeek: the story starts here: http://lists.openstack.org/pipermail/openstack-dev/2016-September/104743.html | 17:56 |
| stevemar | zzzeek: i wanted to know if doing that can be done online, so we don't have to take keystone offline to do that | 17:56 |
| zzzeek | stevemar: it shouldn't be an issue but jaypipes might be the best expert on if mysql has in the past had issues on that kind of migration | 17:57 |
| stevemar | zzzeek: alright, i can bug him when he's available, i figured it would depend on whatever database we end up using | 17:58 |
| zzzeek | stevemar: well we worry most about mysql. older versions tend to hvae more of these problems | 17:59 |
| zzzeek | stevemar: also how big is this table | 17:59 |
| zzzeek | stevemar: if you are < 10K rows, do anything you want | 17:59 |
| stevemar | zzzeek: that'll depend on the deployment, it's resizing the project name... so yeah | 18:00 |
| stevemar | its like <10K for 90% of deployments, that dang 10% that makes things difficult | 18:00 |
| zzzeek | stevemar: usually I'll try to consider what reasonable sizes for the table would be...yeah | 18:00 |
| stevemar | likely* | 18:01 |
| zzzeek | stevemar: googling suggests mysql still has issues w/ column size increases locking the table | 18:01 |
| stevemar | zzzeek: i'm not even sure why we have the name set to 64 anyway, maybe there's a reason there -- ayoung or dolphm may know | 18:01 |
| stevemar | zzzeek: womp womp | 18:01 |
| stevemar | zzzeek: even the newer versions? | 18:02 |
| zzzeek | stevemar: mmmm maybe | 18:03 |
| morgan | history | 18:03 |
| morgan | no reason otherwise | 18:03 |
| zzzeek | stevemar: i had heard they had improved this stuff but looking at 5.7's docs still loaded w/ caveats | 18:03 |
| zzzeek | stevemar: the painful way is, make new table w/ new column, copy all data from old table to new, then rename back. | 18:04 |
| morgan | its mostly a keep the table smaller and keeping "name" base requests for auth to not be 255 chars | 18:04 |
| zzzeek | stevemar: alembic has this feature now and it is functional for mysql though you need to be careful w it | 18:04 |
| morgan | but in short, it can be increased | 18:04 |
| *** ddieterly is now known as ddieterly[away] | 18:04 | |
| stevemar | morgan: thanks for the history lesson :) | 18:04 |
| stevemar | zzzeek: i was hoping it-would-just-work (tm) as of version 5.5 or whatever the default is on ubuntu 12.04 | 18:05 |
| zzzeek | stevemar: mysql also has a LOCK clause which can impact this, though that's only in newer vresions and again im not sure what scenarios it takes effect within | 18:05 |
| zzzeek | stevemar: the canonical docs are http://dev.mysql.com/doc/refman/5.7/en/alter-table.html if you want to try to pick apart the discussion under "Storage, Performance, and Concurrency Considerations" | 18:05 |
| stevemar | zzzeek: creating a new table and copying the data, doesn't that mean we'll have to go offline (for the copying portion) | 18:06 |
| *** mvk has joined #openstack-keystone | 18:06 | |
| stevemar | zzzeek: cause race conditions and such, new project could be created with the same name | 18:06 |
| zzzeek | stevemar: well the copy runs in the background. but yes then you get your race condition | 18:06 |
| stevemar | bah humbug | 18:07 |
| zzzeek | stevemar: you might have to just add a new column w/ new size and use that :) | 18:07 |
| stevemar | "new_name" make it super not helpful | 18:07 |
| zzzeek | stevemar: all you have to do is change the whole application everywhere to refer to both columns for the whole expanse of "O" | 18:07 |
| zzzeek | stevemar: dunno if you followed that convo everyone thought it was "easy" :) | 18:08 |
| stevemar | zzzeek: everything is always easy! | 18:08 |
| zzzeek | stevemar: as long as you never, ever use a trigger | 18:08 |
| zzzeek | then your whole applcation melts into flames | 18:08 |
| stevemar | zzzeek: duh, triggers are the devil's work | 18:08 |
| zzzeek | stevemar: in this case id agree b.c. id just do the ALTER | 18:09 |
| stevemar | :) | 18:09 |
| stevemar | zzzeek: we'll see about this change, the OP was just poking to see if it's possible, sounds like he's still tinkering with something | 18:09 |
| zzzeek | stevemar: if the table is <10k in 90% of the cases, the other 10% is what, 20K ? 100K? it's not a big deal til youre in the millions | 18:09 |
| stevemar | zzzeek: i'd be amazed if someone has 1M keystone projects somewhere | 18:09 |
| stevemar | mfisch`: how many projects do y'all have? | 18:10 |
| stevemar | morgan: do you have any data points here? | 18:10 |
| stevemar | dolphm: ? | 18:10 |
| morgan | stevemar: nope | 18:11 |
| ayoung | stevemar, name for what ctable? | 18:19 |
| stevemar | ayoung: the project name | 18:19 |
| *** woodster_ has quit IRC | 18:20 | |
| ayoung | stevemar, under 255 is indexable, I've never heard an argument for shorter being better | 18:20 |
| ayoung | however, I do suspect that the way the strings are stored is wasteful | 18:21 |
| ayoung | I have not looked in to the particulars, but my understanding is this | 18:21 |
| ayoung | for a varchar > 255 all of the strings go into a single block, and the column itself holds a pointer to the start of the string (niot sure how the length is handled) | 18:22 |
| ayoung | if you do a varchar < 255, the column is a fixed width, and the data is right there in the column, so no additional lookup, and that is required to be able to build an index | 18:23 |
| ayoung | now, if the column has something like a UUID, then you know that the right size is the length of a UUID; 32 chars, which is what we did to start | 18:24 |
| *** gyee has quit IRC | 18:24 | |
| ayoung | when we chose to do the HASH approach for the LDAP id_lookup table, we essentially ensured that most tables with user_ids in them would be half empty | 18:24 |
| ayoung | if we do the same for project name, and most project names are say, 15 characters long, we will have 255-15 characters per row that are blank | 18:25 |
| ayoung | for the projec_name, however, this is probably OK, as the only table that takes the hit is the project table in keystone. Everything else should only refer to rows in that table by ID. | 18:26 |
| ayoung | stevemar, make sense? | 18:26 |
| *** asettle has joined #openstack-keystone | 18:40 | |
| *** spzala has quit IRC | 18:40 | |
| *** spzala has joined #openstack-keystone | 18:41 | |
| morgan | ayoung: varchar isn't that inefficient. | 18:44 |
| morgan | there are some issues with page sizes and overflows in some cases. | 18:44 |
| *** ddieterly[away] is now known as ddieterly | 18:46 | |
| *** spzala has quit IRC | 18:46 | |
| *** ddieterly is now known as ddieterly[away] | 18:49 | |
| *** sdake has quit IRC | 18:50 | |
| *** sdake has joined #openstack-keystone | 18:50 | |
| *** code-R has joined #openstack-keystone | 18:53 | |
| *** ddieterly[away] is now known as ddieterly | 18:55 | |
| *** lamt has joined #openstack-keystone | 18:55 | |
| *** code-R_ has joined #openstack-keystone | 18:56 | |
| ayoung | morgan, stevemar so...policy stored in keystone. We should either make it work, or kill it. Preference? Topic for the summit? | 18:56 |
| morgan | i would kill it. | 18:56 |
| morgan | honestly | 18:56 |
| ayoung | morgan, I'm leaning that way myself | 18:57 |
| morgan | i think it hasn't been realized and has weird gaps. i also think the adoption of centralized policy like this is going to be hard. | 18:58 |
| morgan | as in there are other priorities for the other projects | 18:58 |
| *** code-R has quit IRC | 18:59 | |
| ayoung | morgan, and for security reasons, it feels like it should be treated as config, not data. | 18:59 |
| morgan | ++ | 18:59 |
| ayoung | morgan, BTW, we just had an internal sprint retrospective. The two things we demod were Fernet for Tripleo and The Novajoin service. The Novajoin automatically enorllss a new server booted from nova into a FreeIPA instance using the Metadata extensions | 19:01 |
| *** chris_hultin|AWA is now known as chris_hultin | 19:01 | |
| morgan | nice! | 19:01 |
| ayoung | I can work to get this demo'd for Keystone team in Barcelona, but I am wondering what the relationship there shouild be between that code and openstack proper | 19:02 |
| morgan | not sure. | 19:02 |
| ayoung | FreeIPA is an external project, but novajoin feels like it should be under Openstack | 19:02 |
| ayoung | Nova would not want it ( I suspect) but it might make sense to have it under the Keystone project, as it is identity | 19:03 |
| ayoung | The other choices were Barbican and Tripleo | 19:03 |
| morgan | i would make it non-big tent tbh | 19:03 |
| ayoung | It probably should not be a stand-alone...too much overhead | 19:03 |
| morgan | to start | 19:03 |
| morgan | you sure? | 19:03 |
| morgan | i mean... it seems optional. | 19:03 |
| ayoung | Well, we want it as a pre-req for Tripleo | 19:03 |
| morgan | so make it part of triple-o :) | 19:04 |
| ayoung | Maybe | 19:04 |
| ayoung | but it also give a story for per-node identity | 19:04 |
| ayoung | And people have been asking for that for a long while | 19:04 |
| ayoung | Plus the IPA server is LDAP, and we are already the team that owns that. | 19:06 |
| ayoung | The code is here for now https://github.com/rcritten/novajoin | 19:07 |
| morgan | well i'm not the PTL so i can't speak to if we want to adopt it | 19:08 |
| morgan | ;) | 19:08 |
| * morgan summons a wild stevemar | 19:08 | |
| * stevemar appears wildly | 19:09 | |
| morgan | ^ | 19:09 |
| *** asettle has quit IRC | 19:10 | |
| stevemar | well i have no idea what novajoin is, so i'm going to say no to adoption until i read about it :) | 19:10 |
| morgan | ayoung: you now have stevemar 's attention ;) | 19:11 |
| stevemar | morgan: ayoung -- not really, in the osc meeting :P | 19:11 |
| ayoung | stevemar, I'll do one better, and walk through a demo at the summit. | 19:11 |
| ayoung | We should at least be prepared to provide guidance for how to integrate it in with Openstack at large | 19:12 |
| *** adrian_otto has joined #openstack-keystone | 19:29 | |
| *** yarkot has quit IRC | 19:39 | |
| *** thiagolib has quit IRC | 19:39 | |
| *** thiagolib has joined #openstack-keystone | 19:41 | |
| *** spilla has joined #openstack-keystone | 19:41 | |
| *** yarkot has joined #openstack-keystone | 19:42 | |
| *** flaper87 has quit IRC | 19:43 | |
| *** briancli1e has quit IRC | 19:43 | |
| *** AlexOughton has joined #openstack-keystone | 19:44 | |
| *** jlwhite_ has joined #openstack-keystone | 19:45 | |
| *** code-R_ has quit IRC | 19:49 | |
| *** evrardjp has quit IRC | 19:50 | |
| *** Alex_Oughton has quit IRC | 19:50 | |
| *** jlwhite has quit IRC | 19:50 | |
| *** samueldmq has quit IRC | 19:50 | |
| *** briancline has joined #openstack-keystone | 19:50 | |
| *** jlwhite_ is now known as jlwhite | 19:50 | |
| *** samueldmq has joined #openstack-keystone | 19:50 | |
| *** ChanServ sets mode: +v samueldmq | 19:50 | |
| *** evrardjp has joined #openstack-keystone | 19:51 | |
| *** artmr has quit IRC | 19:53 | |
| *** woodster_ has joined #openstack-keystone | 19:54 | |
| *** spzala_ has joined #openstack-keystone | 19:57 | |
| stevemar | ayoung: i'll release a new version of ksc for you next week, requirements freeze will be finally over | 20:01 |
| stevemar | ayoung: you can do all your implied roles in osc | 20:01 |
| *** ayoung has quit IRC | 20:01 | |
| *** spzala_ has quit IRC | 20:01 | |
| *** spzala has joined #openstack-keystone | 20:03 | |
| *** code-R has joined #openstack-keystone | 20:07 | |
| *** sdake has quit IRC | 20:08 | |
| *** asettle has joined #openstack-keystone | 20:11 | |
| *** ddieterly is now known as ddieterly[away] | 20:11 | |
| *** lamt has quit IRC | 20:12 | |
| *** asettle has quit IRC | 20:21 | |
| *** ayoung has joined #openstack-keystone | 20:27 | |
| *** ChanServ sets mode: +v ayoung | 20:27 | |
| breton | wow, go Steve | 20:32 |
| *** catintheroof has quit IRC | 20:32 | |
| *** spilla has quit IRC | 20:32 | |
| openstackgerrit | Merged openstack/keystone: Fix typo in docstring https://review.openstack.org/378218 | 20:33 |
| *** cburgess_ has quit IRC | 20:36 | |
| *** browne has quit IRC | 20:37 | |
| *** edmondsw has quit IRC | 20:37 | |
| *** tonytan4ever has quit IRC | 20:38 | |
| *** cburgess has joined #openstack-keystone | 20:38 | |
| *** ayoung has quit IRC | 20:39 | |
| *** ddieterly[away] is now known as ddieterly | 20:40 | |
| *** spzala has quit IRC | 20:43 | |
| *** spzala has joined #openstack-keystone | 20:43 | |
| *** melwitt has quit IRC | 20:44 | |
| *** briancline has quit IRC | 20:46 | |
| *** spzala has quit IRC | 20:48 | |
| *** spzala has joined #openstack-keystone | 20:49 | |
| *** antwash has joined #openstack-keystone | 20:51 | |
| antwash | Anyone have any idea what the ResellerAdmin role is for -- and what permission it has in swift? | 20:51 |
| *** melwitt has joined #openstack-keystone | 20:51 | |
| *** code-R has quit IRC | 20:51 | |
| *** melwitt is now known as Guest99228 | 20:52 | |
| stevemar | breton: eh, i've been meaning to do it for a while, just good timing, lots of folks are not re-running, i think i actually have a chance | 20:52 |
| *** amoralej|off has quit IRC | 20:53 | |
| *** briancline has joined #openstack-keystone | 20:53 | |
| *** spzala has quit IRC | 20:54 | |
| *** amoralej has joined #openstack-keystone | 20:55 | |
| *** lamt has joined #openstack-keystone | 20:56 | |
| *** spzala has joined #openstack-keystone | 20:57 | |
| stevemar | rodrigods: do you plan on adding the additional assertions to the implied role tests? https://review.openstack.org/#/c/368498/2/keystoneclient/tests/unit/v3/test_roles.py ? | 21:00 |
| *** lamt has quit IRC | 21:02 | |
| *** raildo has quit IRC | 21:02 | |
| *** spzala has quit IRC | 21:02 | |
| *** anteaya has quit IRC | 21:05 | |
| *** spzala has joined #openstack-keystone | 21:07 | |
| *** sdake has joined #openstack-keystone | 21:13 | |
| *** briancline has quit IRC | 21:14 | |
| *** briancline has joined #openstack-keystone | 21:19 | |
| *** gyee has joined #openstack-keystone | 21:22 | |
| *** ChanServ sets mode: +v gyee | 21:22 | |
| *** jaugustine has quit IRC | 21:23 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: Devstack plugin for Federation https://review.openstack.org/320623 | 21:24 |
| *** anteaya has joined #openstack-keystone | 21:28 | |
| *** ravelar has quit IRC | 21:33 | |
| *** adrian_otto has quit IRC | 21:35 | |
| *** haplo37_ has quit IRC | 21:37 | |
| *** tonytan4ever has joined #openstack-keystone | 21:38 | |
| *** haplo37_ has joined #openstack-keystone | 21:39 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Ensure all v2.0 tokens are validated the same way https://review.openstack.org/372655 | 21:39 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make sure all v3 tokens are validated the same way https://review.openstack.org/371083 | 21:39 |
| *** cnf has left #openstack-keystone | 21:40 | |
| *** tonytan4ever has quit IRC | 21:44 | |
| *** chris_hultin is now known as chris_hultin|AWA | 21:45 | |
| *** gagehugo has quit IRC | 21:47 | |
| *** adriant has joined #openstack-keystone | 21:51 | |
| *** browne has joined #openstack-keystone | 21:53 | |
| *** woodster_ has quit IRC | 22:00 | |
| *** spzala has quit IRC | 22:11 | |
| *** Guest99228 is now known as melwitt | 22:23 | |
| *** nkinder has quit IRC | 22:24 | |
| *** nicolasbock has quit IRC | 22:25 | |
| *** tonytan4ever has joined #openstack-keystone | 22:27 | |
| *** ayoung has joined #openstack-keystone | 22:28 | |
| *** ChanServ sets mode: +v ayoung | 22:28 | |
| *** iurygregory_ has joined #openstack-keystone | 22:47 | |
| *** ddieterly is now known as ddieterly[away] | 22:58 | |
| *** ayoung has quit IRC | 23:06 | |
| *** jamielennox is now known as jamielennox|away | 23:11 | |
| *** sdake has quit IRC | 23:12 | |
| *** ddieterly[away] is now known as ddieterly | 23:20 | |
| *** roxanaghe has quit IRC | 23:22 | |
| *** asettle has joined #openstack-keystone | 23:27 | |
| stevemar | SpamapS: you get my top vote for TC just for that intro | 23:28 |
| SpamapS | :-D | 23:29 |
| *** asettle has quit IRC | 23:32 | |
| *** tonytan4ever has quit IRC | 23:35 | |
| *** markvoelker has quit IRC | 23:36 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Use httplib constants for http status codes https://review.openstack.org/379855 | 23:43 |
| *** TonyXu has quit IRC | 23:43 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Remove the unused docs makefile https://review.openstack.org/379857 | 23:48 |
| *** ddieterly is now known as ddieterly[away] | 23:51 | |
| *** ayoung has joined #openstack-keystone | 23:51 | |
| *** ChanServ sets mode: +v ayoung | 23:51 | |
| *** browne has quit IRC | 23:52 | |
| *** jamielennox|away is now known as jamielennox | 23:52 | |
| *** ddieterly[away] has quit IRC | 23:54 | |
| *** sdake has joined #openstack-keystone | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!