| *** haplo37_ has joined #openstack-keystone | 00:00 | |
| *** phalmos has quit IRC | 00:09 | |
| *** sdake_ has quit IRC | 00:16 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Move audit initiator creation to request https://review.openstack.org/342658 | 00:42 |
|---|---|---|
| *** browne has quit IRC | 00:52 | |
| *** david-lyle has quit IRC | 00:52 | |
| *** sdake has joined #openstack-keystone | 00:53 | |
| *** tqtran has quit IRC | 00:56 | |
| *** spzala has joined #openstack-keystone | 00:59 | |
| *** samueldmq has quit IRC | 01:01 | |
| *** spzala has quit IRC | 01:03 | |
| *** spzala has joined #openstack-keystone | 01:03 | |
| *** agireud has quit IRC | 01:10 | |
| *** samueldmq has joined #openstack-keystone | 01:14 | |
| *** ChanServ sets mode: +v samueldmq | 01:14 | |
| *** iurygregory_ has quit IRC | 01:26 | |
| *** phalmos has joined #openstack-keystone | 01:29 | |
| *** hoangcx has joined #openstack-keystone | 01:30 | |
| *** gyee has quit IRC | 01:46 | |
| *** woodster_ has quit IRC | 01:50 | |
| *** prometheanfire has joined #openstack-keystone | 02:06 | |
| prometheanfire | is keystone going to warn be about this every time it starts now? | 02:06 |
| prometheanfire | 2016-10-04 21:00:06.240 7140 WARNING keystone.assignment.core [-] Deprecated: Use of the identity driver config to automatically configure the same assignment driver has been deprecated, in the "O" release, the assignment driver will need to be expicitly configured if different than the default (SQL). | 02:06 |
| *** browne has joined #openstack-keystone | 02:17 | |
| *** sdake has quit IRC | 02:18 | |
| *** sdake has joined #openstack-keystone | 02:20 | |
| trananhkma | lbragstad, o/ | 02:57 |
| trananhkma | lbragstad, in your comment at: https://bugs.launchpad.net/keystone/+bug/1630259/ -- what token provider (`CONF [token] provider`) | 02:59 |
| openstack | Launchpad bug 1630259 in OpenStack Identity (keystone) "KeyError: 'is_domain' during mitaka -> newton rolling upgrade" [High,Triaged] - Assigned to Lance Bragstad (lbragstad) | 02:59 |
| trananhkma | lbragstad, in my nova.conf file, under [token], there is only one option: driver = sql | 03:00 |
| trananhkma | lbragstad, Is that what's you want? | 03:01 |
| trananhkma | lbragstad, 's/nova.conf/keystone.conf/g' | 03:03 |
| *** agireud has joined #openstack-keystone | 03:14 | |
| *** spzala has quit IRC | 03:20 | |
| *** browne has quit IRC | 03:27 | |
| dolphm | trananhkma: token provider is a different option than the driver; if you haven't set it, then it'll default to uuid | 03:28 |
| trananhkma | dolphm, yes, I haven't set it | 03:29 |
| dolphm | trananhkma: can you leave a comment in the bug that you haven't set [token] provider, so it should be the default value (uuid)? | 03:30 |
| trananhkma | dolphm, yes, sure :) | 03:31 |
| dolphm | trananhkma: thank you! | 03:31 |
| * prometheanfire wishes the other services would switch to wsgi... | 03:40 | |
| *** sdake has quit IRC | 03:43 | |
| *** sdake has joined #openstack-keystone | 03:43 | |
| *** links has joined #openstack-keystone | 03:45 | |
| *** markvoelker has quit IRC | 03:48 | |
| stevemar | jays win!! | 03:54 |
| *** dikonoor has joined #openstack-keystone | 03:55 | |
| *** tqtran has joined #openstack-keystone | 03:55 | |
| stevemar | prometheanfire: file a bug, i'll take a look at it | 03:55 |
| stevemar | prometheanfire: if it's happening by default we should get rid of the warning or not make it the default | 03:55 |
| prometheanfire | stevemar: sure | 03:55 |
| stevemar | prometheanfire: i think i know what it is | 03:56 |
| stevemar | prometheanfire: https://github.com/openstack/keystone/blob/master/keystone/conf/assignment.py#L18-L28 has no default | 03:56 |
| stevemar | it should be sql | 03:56 |
| stevemar | since thats the only backend we provide (we removed ldap) | 03:56 |
| prometheanfire | ya | 03:56 |
| stevemar | prometheanfire: i'll file a bug | 03:57 |
| prometheanfire | stevemar: thanks | 03:57 |
| stevemar | it's a bit intertwined | 03:57 |
| *** tqtran has quit IRC | 03:59 | |
| stevemar | prometheanfire: https://bugs.launchpad.net/keystone/+bug/1630435 | 04:05 |
| openstack | Launchpad bug 1630435 in OpenStack Identity (keystone) "make the assignment backend default to sql" [High,Confirmed] | 04:05 |
| *** nicolasbock has quit IRC | 04:05 | |
| stevemar | dolphm: sounds like we should consider getting lbragstad's fix in, maybe rc3 | 04:06 |
| prometheanfire | stevemar: I have updated keystone though | 04:06 |
| dolphm | stevemar: ++ | 04:06 |
| prometheanfire | no problem this release :P | 04:06 |
| stevemar | dolphm: have you (or lbragstad) reviewed and tested the fix? | 04:07 |
| dolphm | stevemar: i have not | 04:07 |
| *** spzala has joined #openstack-keystone | 04:07 | |
| *** spzala has quit IRC | 04:07 | |
| stevemar | dolphm: lbragstad's comment in the bug report is very good, i think the fix is fine too | 04:13 |
| stevemar | not sure if unit testing it is possible (easily anyway) | 04:13 |
| dolphm | was trananhkma able to test it? | 04:13 |
| *** code-R has joined #openstack-keystone | 04:14 | |
| dolphm | stevemar: ^ | 04:17 |
| stevemar | dolphm: not AFAIK, trananhkma? | 04:18 |
| trananhkma | dolphm, I will test it | 04:18 |
| trananhkma | stevemar, sorry? | 04:19 |
| stevemar | trananhkma: oh i was just wondering if you had a chance to test the lbragstad's fix :) | 04:19 |
| trananhkma | stevemar, ah, ok | 04:21 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Make returning is_domain conditional https://review.openstack.org/382032 | 04:23 |
| dolphm | trananhkma: stevemar: ^ | 04:23 |
| stevemar | dolphm: y, i saw | 04:24 |
| stevemar | dolphm: i feel like this is safe to merge as it | 04:24 |
| stevemar | is | 04:24 |
| stevemar | its a simple check before accessing a key | 04:24 |
| dolphm | stevemar: i just revised the message | 04:25 |
| *** sdake has quit IRC | 04:25 | |
| stevemar | yeah | 04:25 |
| dolphm | trananhkma: stevemar: lbragstad: clean backport https://review.openstack.org/#/c/382135/ | 04:25 |
| stevemar | dolphm: jumping the gun :P | 04:26 |
| dolphm | stevemar: it's time :) | 04:26 |
| stevemar | dolphm: if we get it merged in newton i can tag rc3 soon and only get a minor whooping from the release team | 04:27 |
| *** adriant has quit IRC | 04:28 | |
| dolphm | stevemar: this bug should be reproducible without a rolling upgrade scenario | 04:28 |
| stevemar | dolphm: we could also merge https://review.openstack.org/#/c/379607/ | 04:28 |
| dolphm | stevemar: i think i'd be down for that | 04:29 |
| stevemar | dolphm: removed my -W | 04:29 |
| *** adriant has joined #openstack-keystone | 04:30 | |
| dolphm | stevemar: went ahead and +2'd the backport, but i'd rather know that it's been tested by trananhkma | 04:34 |
| dolphm | worst case, i'd expect that backtrace to be fixed, only to be replaced by another similar backtrace elsewhere | 04:35 |
| *** phalmos has quit IRC | 04:37 | |
| *** annp has joined #openstack-keystone | 04:39 | |
| stevemar | dolphm: right | 04:43 |
| *** GB21 has joined #openstack-keystone | 04:46 | |
| *** markvoelker has joined #openstack-keystone | 04:49 | |
| *** sdake has joined #openstack-keystone | 04:51 | |
| stevemar | dolphm: i'd prefer knowing it actually fixes the issue | 04:51 |
| stevemar | i'll try and recreate the problem (and test with the fix) | 04:51 |
| *** HenryG has quit IRC | 04:51 | |
| *** HenryG has joined #openstack-keystone | 04:52 | |
| *** markvoelker has quit IRC | 04:54 | |
| *** bjolo_ has joined #openstack-keystone | 04:58 | |
| trananhkma | dolphm, stevemar, lbragstad, the fix worked very well, thank you so much! | 04:59 |
| stevemar | trananhkma: ++ | 04:59 |
| stevemar | trananhkma: i'll approve it | 04:59 |
| stevemar | trananhkma: thanks for finding the bug and testing the fix so quickly | 05:04 |
| *** jaosorior has joined #openstack-keystone | 05:07 | |
| prometheanfire | stevemar: guess what | 05:11 |
| prometheanfire | stevemar: it's not keystone that fails migrations on postgres this release but nova :D | 05:12 |
| prometheanfire | https://gist.github.com/prometheanfire/98689217594ffa210cab83a0ac5ff588 | 05:12 |
| prometheanfire | I kinda wonder if it's just because I never used aggregates | 05:12 |
| stevemar | prometheanfire: you scared me for a sec | 05:14 |
| prometheanfire | :D | 05:14 |
| prometheanfire | now it's another team member I get to scare | 05:14 |
| openstackgerrit | Merged openstack/keystone: Add tests for validating expired tokens https://review.openstack.org/382069 | 05:18 |
| *** adriant has quit IRC | 05:19 | |
| *** agireud has quit IRC | 05:19 | |
| *** code-R has quit IRC | 05:22 | |
| *** denismakogon has joined #openstack-keystone | 05:24 | |
| *** jaosorior has quit IRC | 05:35 | |
| *** amoralej|off has quit IRC | 05:35 | |
| *** akrzos has quit IRC | 05:35 | |
| *** jaosorior has joined #openstack-keystone | 05:35 | |
| *** akrzos has joined #openstack-keystone | 05:35 | |
| *** agireud has joined #openstack-keystone | 05:38 | |
| *** GB21 has quit IRC | 05:38 | |
| *** richm has quit IRC | 05:40 | |
| *** amoralej has joined #openstack-keystone | 05:41 | |
| *** markvoelker has joined #openstack-keystone | 05:50 | |
| *** GB21 has joined #openstack-keystone | 05:50 | |
| *** denismakogon has quit IRC | 05:52 | |
| *** prometheanfire has left #openstack-keystone | 05:53 | |
| *** denismakogon has joined #openstack-keystone | 05:54 | |
| *** markvoelker has quit IRC | 05:55 | |
| breton | morning, keystoneers | 06:01 |
| *** david-lyle has joined #openstack-keystone | 06:08 | |
| *** bjolo_ has quit IRC | 06:24 | |
| *** pnavarro has joined #openstack-keystone | 06:41 | |
| *** pcaruana has joined #openstack-keystone | 06:46 | |
| *** markvoelker has joined #openstack-keystone | 06:51 | |
| *** rcernin has joined #openstack-keystone | 06:53 | |
| *** code-R has joined #openstack-keystone | 06:54 | |
| *** code-R_ has joined #openstack-keystone | 06:56 | |
| *** markvoelker has quit IRC | 06:56 | |
| *** code-R has quit IRC | 06:59 | |
| *** tqtran has joined #openstack-keystone | 07:00 | |
| *** david-lyle has quit IRC | 07:02 | |
| *** tqtran has quit IRC | 07:05 | |
| *** AlexeyAbashkin has quit IRC | 07:07 | |
| *** tesseract- has joined #openstack-keystone | 07:07 | |
| *** rcernin has quit IRC | 07:12 | |
| *** rcernin has joined #openstack-keystone | 07:12 | |
| *** hogepodge has quit IRC | 07:21 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:46 | |
| *** GB21 has quit IRC | 07:49 | |
| *** markvoelker has joined #openstack-keystone | 07:51 | |
| *** asettle has joined #openstack-keystone | 07:54 | |
| *** markvoelker has quit IRC | 07:56 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| openstackgerrit | Merged openstack/keystone: Make returning is_domain conditional https://review.openstack.org/382032 | 08:08 |
| *** hogepodge has joined #openstack-keystone | 08:11 | |
| *** EinstCrazy has joined #openstack-keystone | 08:16 | |
| *** GB21 has joined #openstack-keystone | 08:36 | |
| bjolo | stevemar, still up? | 08:47 |
| *** denismakogon has quit IRC | 08:49 | |
| *** jaosorior is now known as jaosorior_lunch | 08:50 | |
| *** markvoelker has joined #openstack-keystone | 08:52 | |
| *** markvoelker has quit IRC | 08:57 | |
| *** sdake has quit IRC | 08:59 | |
| *** josecastroleon has joined #openstack-keystone | 09:16 | |
| *** TonyXu has joined #openstack-keystone | 09:18 | |
| *** EinstCrazy has quit IRC | 09:23 | |
| *** EinstCrazy has joined #openstack-keystone | 09:32 | |
| *** EinstCrazy has quit IRC | 09:34 | |
| *** jaosorior_lunch is now known as jaosorior | 09:46 | |
| *** code-R_ has quit IRC | 09:46 | |
| *** markvoelker has joined #openstack-keystone | 09:53 | |
| *** code-R has joined #openstack-keystone | 09:57 | |
| *** markvoelker has quit IRC | 09:58 | |
| *** annp has quit IRC | 10:01 | |
| *** denismakogon_ has joined #openstack-keystone | 10:01 | |
| *** tqtran has joined #openstack-keystone | 10:02 | |
| *** code-R has quit IRC | 10:02 | |
| *** code-R has joined #openstack-keystone | 10:03 | |
| *** tqtran has quit IRC | 10:06 | |
| *** mvk has quit IRC | 10:09 | |
| *** richm has joined #openstack-keystone | 10:10 | |
| bjolo | silly question perhaps. working with setting up a ldap domain config. Are all the config options for [ldap] applicable for a domain config file as well? | 10:10 |
| *** code-R has quit IRC | 10:13 | |
| *** code-R has joined #openstack-keystone | 10:18 | |
| *** dikonoor has quit IRC | 10:23 | |
| *** code-R has quit IRC | 10:28 | |
| *** GB21 has quit IRC | 10:30 | |
| *** hoangcx has quit IRC | 10:31 | |
| *** code-R has joined #openstack-keystone | 10:31 | |
| *** code-R has quit IRC | 10:33 | |
| *** vkramskikh has joined #openstack-keystone | 10:34 | |
| vkramskikh | hey folks, where can I see the change list between API v3.6 and v3.7? | 10:35 |
| *** denismakogon_ has quit IRC | 10:35 | |
| *** GB21 has joined #openstack-keystone | 10:39 | |
| *** pnavarro has quit IRC | 10:40 | |
| *** code-R has joined #openstack-keystone | 10:40 | |
| *** nicolasbock has joined #openstack-keystone | 10:40 | |
| *** mvk has joined #openstack-keystone | 10:41 | |
| *** code-R has quit IRC | 10:52 | |
| *** markvoelker has joined #openstack-keystone | 10:54 | |
| *** code-R has joined #openstack-keystone | 10:58 | |
| *** markvoelker has quit IRC | 10:59 | |
| *** code-R has quit IRC | 11:01 | |
| *** code-R has joined #openstack-keystone | 11:28 | |
| *** code-R_ has joined #openstack-keystone | 11:30 | |
| *** code-R has quit IRC | 11:33 | |
| *** msno has joined #openstack-keystone | 11:51 | |
| *** pnavarro has joined #openstack-keystone | 11:51 | |
| msno | hi guyz.. i am using a curl command to fetch some details .. but its giving me " Token validation experienced an error communicating with Keystone " | 11:53 |
| msno | i am using "openstack token issue"then | 11:53 |
| msno | running the following comand with that token | 11:53 |
| msno | curl -X GET -H "Content-Type: application/json" -H "X-Auth-Token: e741c5135a0646b49c8eb1c6be10d7d5" https://10.60.2.41:9085/api/v1/hlm/model/entities/servers; echo | 11:54 |
| *** markvoelker has joined #openstack-keystone | 11:54 | |
| breton | msno: what is the service you are trying to send the request to? | 11:59 |
| *** markvoelker has quit IRC | 11:59 | |
| breton | msno: there are no errors like this in keystonemiddleware, so you probably should talk to the authors of the service you are trying to use | 12:00 |
| breton | msno: is that openvim? | 12:00 |
| msno | breton, haproxy | 12:00 |
| msno | 9085 is haproxy service .. novamon | 12:00 |
| *** pjm6_ has joined #openstack-keystone | 12:01 | |
| breton | msno: i have no idea what novamon is :) but you should talk to the guys who wrote it. | 12:01 |
| msno | breton, ok.. but its not the issue with service or the curl command.. in another setup .. its working | 12:02 |
| msno | breton, the token fetched in this setup is the culprit | 12:02 |
| msno | any pointers on that area\ | 12:02 |
| breton | i can't think of any. | 12:03 |
| *** pjm6 has quit IRC | 12:04 | |
| *** amoralej is now known as amoralej|lunch | 12:06 | |
| msno | ok | 12:08 |
| *** beddari has joined #openstack-keystone | 12:09 | |
| *** code-R_ has quit IRC | 12:11 | |
| beddari | simple question I think, but I'm coming up short: how can I allow my normal, non-admin, local v3 user, created in a domain, list what projects it has access to? | 12:12 |
| beddari | keystone of course does this already, but I wasn't able to comprehend how to do what it does, api or command line wise | 12:12 |
| *** code-R has joined #openstack-keystone | 12:14 | |
| beddari | argh. _horizon_ as a keystone client can already list projects for a user, was my point. | 12:16 |
| breton | beddari: http://developer.openstack.org/api-ref/identity/v3/?expanded=get-available-project-scopes-detail#get-available-project-scopes | 12:17 |
| breton | /v3/auth/projects | 12:17 |
| breton | Get available project scopes | 12:17 |
| beddari | breton: how did I not find that, will try ... thanks! | 12:17 |
| mah | Hi all, How to let openstack use Nova access API v2.0 instead of v2.1 ? | 12:19 |
| *** sdake has joined #openstack-keystone | 12:19 | |
| breton | mah: have you tried asking in #openstack-nova or #openstack-dev? | 12:20 |
| * breton doesn't know | 12:20 | |
| mah | I asked in #openstack-dev but did not got answers | 12:20 |
| mah | will try #openstack-nova | 12:21 |
| *** raildo has joined #openstack-keystone | 12:22 | |
| beddari | mah: I think perhaps the question is too generic, having 3-4 years experience with operating I don't understand it :P | 12:29 |
| mah | Now there is microversions introduced by openstack | 12:31 |
| mah | so Nova API may have v2 | 12:32 |
| mah | or v2.1 | 12:32 |
| mah | When I open the API access in the dashboard, I found the Compute Service is using this endpoint : http://192.168.162.13:8774/v2.1/090430ef536f432f85debec425a1d13d | 12:33 |
| mah | I need it to use v2 not v2.1 | 12:33 |
| breton | mah: you need to change endpoint in the catalog | 12:35 |
| mah | will that mess up anything ? | 12:38 |
| *** markvoelker has joined #openstack-keystone | 12:44 | |
| beddari | not likely | 12:45 |
| beddari | mah: the easiest would probably be to just update it in the db :) | 12:48 |
| beddari | mah: but you might have to find out how that enpoint url was created in the first place ... | 12:49 |
| mah | ok thanks /beddari | 12:52 |
| *** raildo has quit IRC | 12:55 | |
| *** GB21 has quit IRC | 12:56 | |
| *** josecastroleon has quit IRC | 12:57 | |
| *** raildo has joined #openstack-keystone | 12:57 | |
| *** edmondsw has joined #openstack-keystone | 12:59 | |
| *** ash__ has joined #openstack-keystone | 13:13 | |
| *** EinstCrazy has joined #openstack-keystone | 13:15 | |
| *** EinstCrazy has quit IRC | 13:15 | |
| ash__ | Hello. I want to contribute to OpenStack for Outreachy. I want to work on the Keystone/Infra - Improving Keystone jobs for new scenarios project. Can anyone give me any pointers on where/how to get started? Thanks. | 13:16 |
| *** amoralej|lunch is now known as amoralej | 13:21 | |
| dims | rodrigods : raildo : i see your names on https://wiki.openstack.org/wiki/Outreachy as possible mentors, can one of you please help with ash__ 's query? | 13:29 |
| dims | rodrigods : raildo : (see above :) | 13:29 |
| raildo | dims, thanks for the ping :) | 13:30 |
| raildo | hey ash__ :) It's one idea to improve some functional tests related to Keystone, and maybe create new jobs for this scenarios, for any doubts related to the outreachy process I suggest go to #openstack-opw, and we can clarify any doubts about it | 13:32 |
| raildo | ash__, besides that you have to submit an application for the outreachy program: https://www.gnome.org/outreachy/ and the deadline for apply is October 17, 2016. | 13:33 |
| raildo | ash__, since you get the approval, the internship will be made in the period of December 2016 until March 2017 | 13:33 |
| lbragstad | dolphm thanks for the backport and the commit message clean up | 13:34 |
| lbragstad | stevemar thanks for the reviews | 13:34 |
| lbragstad | trananhkma thanks for testing :) | 13:34 |
| raildo | lbragstad, ++ it was a quickly fix :) thanks sir! | 13:35 |
| lbragstad | raildo no problem - thanks for reviewing! | 13:35 |
| *** jaosorior has quit IRC | 13:36 | |
| ash__ | I asked about the keystone project there and they directed me to this channel | 13:36 |
| *** jaosorior has joined #openstack-keystone | 13:36 | |
| ash__ | "there" being #openstack-opw | 13:36 |
| raildo | ash__, great :) so, do you have any experience with openstack? | 13:39 |
| *** jed56 has left #openstack-keystone | 13:42 | |
| *** ayoung has quit IRC | 13:47 | |
| *** TonyXu has quit IRC | 13:49 | |
| *** dave-mccowan has joined #openstack-keystone | 13:50 | |
| *** alex_xu has quit IRC | 13:55 | |
| stevemar | lbragstad: we are spinning up rc3 for the upgrade fix | 13:57 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Default the assignment backend to SQL https://review.openstack.org/382428 | 13:57 |
| lbragstad | stevemar sweet | 13:57 |
| stevemar | lbragstad: oh nice, i was just going to pick that up | 13:57 |
| lbragstad | stevemar totally missed that part when I was mucking with that bug and i opened it for Newton | 13:57 |
| stevemar | lbragstad: there's one more thing we can remove ^ | 13:57 |
| lbragstad | stevemar what's that? | 13:58 |
| stevemar | trying to find i | 13:58 |
| stevemar | t | 13:58 |
| knikolla | o/ morning! | 13:58 |
| lbragstad | knikolla o/ | 13:58 |
| stevemar | lbragstad: this stuff https://github.com/openstack/keystone/blob/master/keystone/assignment/core.py#L71-L92 | 13:58 |
| stevemar | lbragstad: also it'll be great to get this merged: https://review.openstack.org/#/c/375928/ | 13:59 |
| lbragstad | stevemar ooof - that's a beast | 14:00 |
| stevemar | lbragstad: yeah, sizeable, but nothing complicated | 14:00 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Default the assignment backend to SQL https://review.openstack.org/382428 | 14:00 |
| *** alex_xu has joined #openstack-keystone | 14:02 | |
| *** chris_hultin|AWA is now known as chris_hultin | 14:03 | |
| lbragstad | stevemar so every driver is just going to have a base class - right? | 14:04 |
| stevemar | lbragstad: right, no more Vx classes | 14:04 |
| *** TonyXu has joined #openstack-keystone | 14:04 | |
| stevemar | and the base class should have the same functions that the driver has | 14:05 |
| stevemar | rather, backend | 14:05 |
| lbragstad | the base class is the driver interface - right? | 14:05 |
| lbragstad | and then the specific backends implement that interface? | 14:05 |
| breton | yey, finally | 14:06 |
| breton | the Vx thing was messy :( | 14:06 |
| lbragstad | stevemar I'm reviewing it now - but it probably wouldn't be a bad idea to have dstanek give it a once over, too | 14:06 |
| lbragstad | since he did quite a bit of work initially on it | 14:07 |
| stevemar | breton: bad experiment :) | 14:08 |
| lbragstad | oh - nice... | 14:09 |
| stevemar | errr :( | 14:09 |
| lbragstad | this breaks the core -> driver thing | 14:09 |
| dstanek | lbragstad: stevemar: which one? | 14:09 |
| stevemar | https://review.openstack.org/#/c/375928/ | 14:09 |
| lbragstad | dstanek https://review.openstack.org/#/c/375928 | 14:09 |
| dstanek | cool, i'll take a look | 14:09 |
| *** LamT__ has joined #openstack-keystone | 14:10 | |
| stevemar | lbragstad: can you add to https://review.openstack.org/#/c/375914/ abt the assignment driver stuff | 14:10 |
| stevemar | lbragstad: theres also https://github.com/openstack/keystone/blob/master/keystone/resource/core.py#L56-L62 | 14:11 |
| *** dims has quit IRC | 14:11 | |
| stevemar | lbragstad: same issue for resource driver: https://github.com/openstack/keystone/blob/master/keystone/conf/resource.py#L18-L25 | 14:12 |
| lbragstad | stevemar do you want a separate release note in my patch for the assignment config default? | 14:12 |
| lbragstad | stevemar do we have a bug open for the resource driver? | 14:12 |
| stevemar | lbragstad: add it to mine, i'll keep a running tally | 14:12 |
| *** links has quit IRC | 14:14 | |
| *** jaosorior has quit IRC | 14:16 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: create release notes for removed functionality https://review.openstack.org/375914 | 14:16 |
| *** dims has joined #openstack-keystone | 14:17 | |
| breton | some time ago we had a page where we wrote "what's new in 3.x API". Do we have such page now? | 14:18 |
| *** lamt has joined #openstack-keystone | 14:20 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Default the assignment backend to SQL https://review.openstack.org/382428 | 14:21 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Default the resource backend to SQL https://review.openstack.org/382453 | 14:21 |
| *** phalmos has joined #openstack-keystone | 14:22 | |
| *** gagehugo has joined #openstack-keystone | 14:22 | |
| *** phalmos has quit IRC | 14:23 | |
| *** alee has joined #openstack-keystone | 14:23 | |
| stevemar | breton: we kind of added that to some parts in the API reg | 14:24 |
| stevemar | ref | 14:24 |
| bknudson | breton: used to be at the top of the api ref | 14:28 |
| bknudson | there must be some way to add a section to the new v3 api ref with this info | 14:28 |
| *** ash__ has quit IRC | 14:28 | |
| stevemar | bknudson: for sure there is | 14:30 |
| dstanek | lbragstad: stevemar: i only had a few minor comments that could be fixed in a follow up review | 14:30 |
| stevemar | breton: you can add a "whats_new.inc" file here https://github.com/openstack/keystone/tree/master/api-ref/source/v3 and add it to the top of index.rst of course | 14:31 |
| lbragstad | dstanek cool - i'll let you kick it through the door | 14:31 |
| breton | stevemar: i'll probably do that a little later, after finishing working on a patch | 14:31 |
| dstanek | lbragstad: kicked | 14:31 |
| *** rodrigods has quit IRC | 14:32 | |
| stevemar | breton: cool, the old APIs are still around in https://github.com/openstack/keystone-specs/blob/master/attic/v3/identity-api-v3.rst for reference | 14:32 |
| *** rodrigods has joined #openstack-keystone | 14:32 | |
| lbragstad | dstanek sweet! | 14:32 |
| *** jorge_munoz has joined #openstack-keystone | 14:32 | |
| *** spzala has joined #openstack-keystone | 14:35 | |
| dstanek | so i created a domain domain1, a group domain1_admins and gave the group the admin role on the domain - but i can't login to horizon with a user from that group | 14:37 |
| dstanek | do i actually need a member role too? | 14:37 |
| *** jorge_munoz has quit IRC | 14:37 | |
| *** LamT__ has quit IRC | 14:38 | |
| *** edmondsw has quit IRC | 14:38 | |
| *** pjm6_ has quit IRC | 14:38 | |
| *** richm has quit IRC | 14:38 | |
| *** hogepodge has quit IRC | 14:38 | |
| *** tesseract- has quit IRC | 14:38 | |
| *** akrzos has quit IRC | 14:38 | |
| *** samueldmq has quit IRC | 14:38 | |
| *** alee has quit IRC | 14:38 | |
| *** clenimar has quit IRC | 14:38 | |
| *** mugsie has quit IRC | 14:38 | |
| *** mugsie has joined #openstack-keystone | 14:39 | |
| *** pjm6 has joined #openstack-keystone | 14:39 | |
| *** edmondsw has joined #openstack-keystone | 14:39 | |
| *** clenimar has joined #openstack-keystone | 14:39 | |
| *** alee has joined #openstack-keystone | 14:39 | |
| *** hogepodge has joined #openstack-keystone | 14:39 | |
| *** akrzos has joined #openstack-keystone | 14:39 | |
| *** jorge_munoz has joined #openstack-keystone | 14:39 | |
| *** richm has joined #openstack-keystone | 14:39 | |
| *** tesseract- has joined #openstack-keystone | 14:39 | |
| *** DuncanT has quit IRC | 14:41 | |
| *** LamT__ has joined #openstack-keystone | 14:43 | |
| *** samueldmq has joined #openstack-keystone | 14:44 | |
| *** ChanServ sets mode: +v samueldmq | 14:44 | |
| *** david-lyle has joined #openstack-keystone | 14:45 | |
| *** DuncanT has joined #openstack-keystone | 14:47 | |
| *** david-lyle has quit IRC | 14:54 | |
| breton | dstanek: have you tried mocking dogpile.cache in https://github.com/openstack/keystone/blob/master/keystone/tests/unit/common/test_cache.py#L50 ? Or you just left a comment? | 14:56 |
| breton | i am trying to replace it with mock and it is pita with weird isinstance() calls | 14:57 |
| dstanek | breton: i actually think that comment can just be removed | 14:58 |
| *** woodburn has quit IRC | 14:59 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: re-add valid comment about None domain ID https://review.openstack.org/382487 | 14:59 |
| stevemar | dstanek: so, i made the one change, but i don't think the other suggestion makes sense | 15:00 |
| *** david-lyle has joined #openstack-keystone | 15:00 | |
| dstanek | stevemar: the name one doesn't make sense? | 15:00 |
| stevemar | dstanek: right, the token provider needs a base class | 15:00 |
| dstanek | stevemar: is it actually a base class to something else? | 15:00 |
| stevemar | dstanek: the other base classes are called FooDriverBase | 15:00 |
| *** jistr is now known as jistr|call | 15:01 | |
| *** ravelar has joined #openstack-keystone | 15:04 | |
| *** ddieterly has joined #openstack-keystone | 15:05 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Simplify the KeystoneToken model https://review.openstack.org/380664 | 15:12 |
| *** rcernin has quit IRC | 15:12 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use validate_v3_token instead of validate_token https://review.openstack.org/380349 | 15:12 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Ensure all v2.0 tokens are validated the same way https://review.openstack.org/372655 | 15:12 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: One validate method to rule them all... https://review.openstack.org/374243 | 15:12 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove validate_v2_token() method https://review.openstack.org/380663 | 15:12 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make sure all v3 tokens are validated the same way https://review.openstack.org/371083 | 15:12 |
| *** pcaruana has quit IRC | 15:13 | |
| *** jistr|call is now known as jistr | 15:13 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: remove legacy driver tox target https://review.openstack.org/382501 | 15:18 |
| stevemar | dstanek: ^ and https://review.openstack.org/#/c/382499/ if you're interested | 15:18 |
| *** phalmos has joined #openstack-keystone | 15:19 | |
| *** ddieterly is now known as ddieterly[away] | 15:22 | |
| *** tesseract- has quit IRC | 15:24 | |
| *** code-R has quit IRC | 15:25 | |
| *** code-R has joined #openstack-keystone | 15:25 | |
| *** david-lyle has quit IRC | 15:26 | |
| *** ddieterly[away] is now known as ddieterly | 15:26 | |
| openstackgerrit | Merged openstack/keystone: Remove stable driver interfaces https://review.openstack.org/375928 | 15:31 |
| *** adrian_otto has joined #openstack-keystone | 15:31 | |
| stevemar | yeaaaasss | 15:31 |
| stevemar | +50, -2917 | 15:31 |
| *** david-lyle has joined #openstack-keystone | 15:32 | |
| dstanek | stevemar: shore | 15:34 |
| *** jaosorior has joined #openstack-keystone | 15:37 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Improve check_token validation performance https://review.openstack.org/382107 | 15:47 |
| *** david-lyle has quit IRC | 15:53 | |
| *** code-R_ has joined #openstack-keystone | 15:57 | |
| *** code-R has quit IRC | 16:00 | |
| *** gyee has joined #openstack-keystone | 16:00 | |
| *** adrian_otto has quit IRC | 16:00 | |
| *** cnf has joined #openstack-keystone | 16:01 | |
| *** adrian_otto has joined #openstack-keystone | 16:02 | |
| cnf | anyone know of a good resource to learn about keystone? I can't figure out what combination of roles profiles domains etc you need to do something | 16:02 |
| *** phalmos has quit IRC | 16:02 | |
| *** code-R_ has quit IRC | 16:09 | |
| *** phalmos has joined #openstack-keystone | 16:10 | |
| *** mvk has quit IRC | 16:11 | |
| knikolla | cnf: what are you trying to accomplish? | 16:12 |
| cnf | anything? | 16:13 |
| cnf | I have users that can't do a damn thing | 16:13 |
| cnf | and I don't understand what needs to be done to make it work | 16:14 |
| *** pnavarro has quit IRC | 16:15 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add revocation event indexes https://review.openstack.org/376523 | 16:16 |
| cnf | I though I had made an admin user | 16:17 |
| cnf | but it can't see any resources in horizon, and can't edit most things | 16:17 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Improve check_token validation performance https://review.openstack.org/382107 | 16:17 |
| cnf | I don't get the Project tab in horizon, either | 16:18 |
| *** haplo37_ has quit IRC | 16:18 | |
| *** haplo37_ has joined #openstack-keystone | 16:21 | |
| cnf | ugh, i though I had assigned the user to a project, but in horizon i can't see it belonging to a project | 16:21 |
| cnf | i think | 16:21 |
| *** woodster_ has joined #openstack-keystone | 16:26 | |
| *** ddieterly is now known as ddieterly[away] | 16:27 | |
| *** ayoung has joined #openstack-keystone | 16:28 | |
| *** ChanServ sets mode: +v ayoung | 16:28 | |
| *** ddieterly[away] is now known as ddieterly | 16:30 | |
| ayoung | rodrigods, trying to think through what it would mean to do Key rotations in a Tripleo environment. I do not want to be putting tarballs into swift with keys in them. | 16:30 |
| ayoung | The best I can come up with is this: | 16:30 |
| ayoung | user the keystone_manage pki_setup to generate a keypair and a cert. Send that cert to the undercloud. Undercloud encrypts the fernet key with the public key in the cert, and puts that in the tarball. Tarball goes to the Keystone server and gets unpacked. Keystone decrypts the fernet key and sticks it into rotation. | 16:32 |
| ayoung | For people with a real CA, the pki_setup can be replaced with something that gets a certificate signed for real | 16:33 |
| *** msno has quit IRC | 16:33 | |
| cnf | what would enable a service on a domain? | 16:33 |
| *** gus_ is now known as gus | 16:33 | |
| ayoung | actually, I wouldnot mind getting pki_setup talking to certmonger if it is going to stay arounnd, but I think it is one the chopping block | 16:33 |
| ayoung | cnf can you clarify what you are asking? | 16:34 |
| * ayoung might have missed the context...looks in evesdrop | 16:34 | |
| cnf | I have services (nova and swift) that are not showing on one domain, and are on another | 16:34 |
| cnf | while glance and neutron show in both | 16:35 |
| ayoung | cnf, you mean that when you get a token scoped to one domain, it is missing elements of the service catalog? | 16:35 |
| cnf | when I get a what now? | 16:35 |
| cnf | i'm just looking in horizon | 16:35 |
| ayoung | Are you sure the tokens are scoped to the domain, or are you just using users that are managed by a differnt domain | 16:35 |
| ayoung | cnf, we really made Keystone confusing when we introduced the term domain | 16:35 |
| ayoung | let me see if i can explain | 16:36 |
| ayoung | no, is too much, let me sum up | 16:36 |
| ayoung | when a user tries to get a token from Keystone, there are 2 different domains that come into play | 16:36 |
| jlk | lol | 16:36 |
| ayoung | the first is the domain where the user is managed. The second is the domain where the project is managed | 16:36 |
| ayoung | When a user requests a token, you want it scoped to a project | 16:37 |
| ayoung | otherwise, you don't geta service catalog. | 16:37 |
| ayoung | http://adam.younglogic.com/2015/08/template-for-a-keystonev3-rc/ | 16:38 |
| ayoung | and, since I wrote that, I've learned that we really want to clear out all old env vars that start with OS_ | 16:38 |
| ayoung | I | 16:38 |
| ayoung | I'd recommend adding something like this | 16:38 |
| ayoung | across | 16:39 |
| ayoung | http://adam.younglogic.com/2016/07/clear-keystone-env/ | 16:39 |
| cnf | I'm not sure I understand what you are trying to tell me | 16:39 |
| ayoung | unset `env | awk -F= ‘/OS_/ {print $1}’ | xargs` | 16:40 |
| ayoung | cnf, My work here is done. | 16:40 |
| cnf | also for myenv in `env|grep OS_|awk -F= '{print $1}'`; do unset $myenv; done | 16:40 |
| cnf | or that | 16:40 |
| ayoung | yep, that works | 16:40 |
| ayoung | piping grep into awk makes awk sad | 16:40 |
| cnf | fine | 16:41 |
| ayoung | "I COULD HAVE DONE THAT FOR YOU!" awk cries | 16:41 |
| ayoung | heh | 16:41 |
| jlk | that's like catting and piping into grep | 16:41 |
| cnf | I still have no idea what I am supposed to do | 16:41 |
| ayoung | anyway, can you restart your question now that I've made the water nice and muddy> | 16:41 |
| ayoung | ? | 16:41 |
| cnf | I don't understand anything at all about how permissions etc work, it seems | 16:41 |
| cnf | I have 2 domains | 16:42 |
| cnf | default, and USers | 16:42 |
| *** jaosorior has quit IRC | 16:42 | |
| cnf | if I log in with a user under the Users domain on horizon | 16:42 |
| cnf | half the options are missing, and what I have a lot of the functions don't work | 16:43 |
| ayoung | OK, let's start with that | 16:43 |
| cnf | I can't select a project at the top | 16:43 |
| cnf | even though I added the user to the project | 16:43 |
| ayoung | Horizon hides a lot from you. I'd recommend using the Command line to understand what is going on. OK? | 16:43 |
| cnf | i think, I have no idea how to check anything with the cli | 16:43 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add revocation event indexes https://review.openstack.org/376523 | 16:43 |
| *** phalmos has quit IRC | 16:43 | |
| ayoung | cnf, so start with the template I gave you, and create a keystone.rc file | 16:44 |
| ayoung | . ./keystone.rc ; openstack token issue | 16:44 |
| cnf | with what credentials? | 16:45 |
| cnf | my current one uses the super admin token | 16:45 |
| ayoung | cnf, I know, a CLI. How barbaric. You come to #openstack-keystone, its like going back through time.... | 16:45 |
| cnf | I live on a CLI | 16:45 |
| cnf | I just do NOT understand the openstack one, at all | 16:45 |
| cnf | so what credentials are you wanting me to enter? | 16:46 |
| cnf | so far, I have done everything with OS_TOKEN= | 16:47 |
| cnf | assuming that would always show me everything | 16:47 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add revocation event indexes https://review.openstack.org/376523 | 16:47 |
| cnf | ayoung: ? | 16:47 |
| jlk | Tokens are... special | 16:48 |
| ayoung | cnf, No not OS_TOKEN | 16:48 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Improve check_token validation performance https://review.openstack.org/382107 | 16:48 |
| ayoung | cnf, the template in the first link I set shows the env vars you want to set | 16:48 |
| cnf | with what login... | 16:49 |
| cnf | what username and password am I using with that | 16:49 |
| ayoung | cnf, whatever you use in Horizon | 16:49 |
| cnf | uhm | 16:50 |
| cnf | I.. | 16:50 |
| ayoung | cnf, when you log in to horizon, here is, roughly what happens | 16:50 |
| cnf | what? | 16:50 |
| ayoung | you pass in userid and password. THose get sent to Keystone to fetch atoken for you. | 16:50 |
| ayoung | that token might be scoped to a project by default, or it might be unscoped. | 16:50 |
| ayoung | THe reasons why vary based on your server set up | 16:50 |
| cnf | I have an admin user that can _ONLY_ see the default domain | 16:51 |
| cnf | and I have a Users domain where NO user works right | 16:51 |
| ayoung | OK, let's use the Admin user to start | 16:51 |
| ayoung | When you log in to horizon, the Admin user gets a token scoped to some project, probably called"Admin" as well | 16:51 |
| ayoung | so OS_USERNAME=Admin OS_USER_DOMAIN_NAME=Default | 16:52 |
| *** david-lyle has joined #openstack-keystone | 16:52 | |
| ayoung | usually the domain is set up with and ID of default and a Domain Name of Default, note the capitalization difference | 16:53 |
| cnf | # openstack token issue | 16:53 |
| cnf | The request you have made requires authentication. (HTTP 401) (Request-ID: req-89110583-d7ce-4c3c-be6a-b6997c694317) | 16:53 |
| ayoung | cnf did you createa keystone.rc and source it? If so, then one of more of the env vars are wrong | 16:54 |
| cnf | yes, I did | 16:54 |
| cnf | ok, default is not Default | 16:55 |
| ayoung | that is one reason I'd recommend clearing the environment at the start, to make sure there is no bleed over from earlier attempts | 16:55 |
| ayoung | ++ | 16:55 |
| cnf | all my files clear all OS_ on source | 16:55 |
| ayoung | Cool | 16:55 |
| jlk | just to be sure, you've got a password too, right? | 16:56 |
| cnf | what do you mean, a password too? | 16:57 |
| jlk | When you auth to Keystone, as a user (not the OS_TOKEN), you need to provide a user name, a password, a project, and a domain | 16:57 |
| cnf | ayoung: so I have sourced that one, with the admin user on the default domain | 16:57 |
| cnf | jlk: yes, that's what I am using now | 16:57 |
| *** spilla has joined #openstack-keystone | 16:58 | |
| jlk | The username and password are specific to the user. The project and domain are specific to the _session_. Your user could have roles in multiple projects and domains. You generally have to pick one for the session. | 16:58 |
| *** ddieterly is now known as ddieterly[away] | 16:58 | |
| ayoung | so whate jlk is asking is do you have a valid valud for OS_PASSWORD set | 16:59 |
| * ayoung can't type | 16:59 | |
| cnf | well, yes... | 16:59 |
| cnf | as I have said it works | 16:59 |
| cnf | well, the token issue bit, anyway | 17:00 |
| ayoung | oke, what about openstack user list? | 17:00 |
| cnf | so now what? | 17:00 |
| cnf | I see the service users, and demo | 17:00 |
| cnf | you know, nova, neutron, glance etc | 17:00 |
| ayoung | right, they are all in the default domain, too. Are you seeing the users in the other domain? | 17:01 |
| cnf | no | 17:01 |
| cnf | I see them with # openstack user list --domain Users though | 17:01 |
| ayoung | good | 17:01 |
| ayoung | there are some conifg options which would affect that. But that is good | 17:02 |
| ayoung | ok, so now you want to look at the roles assigned to a user in the Users domain | 17:02 |
| cnf | yeah, no idea how to do that | 17:02 |
| ayoung | openstack role assignment list | 17:02 |
| cnf | uhm | 17:03 |
| cnf | any way to have that show names instead of Ds? | 17:03 |
| cnf | IDs | 17:03 |
| *** ddieterly[away] is now known as ddieterly | 17:03 | |
| cnf | right, --names | 17:04 |
| ayoung | cnf, to answer that requires more time and more alcohol than I currently have available. | 17:04 |
| ayoung | Heh | 17:04 |
| ayoung | suffice to say, I don't actually have a working openstack server where I have admin on it right now | 17:05 |
| *** adrian_otto has quit IRC | 17:05 | |
| jlk | I have the sads for that | 17:05 |
| ayoung | cnf, so, you need to get to the point where one of the users in the Users domain has a role assignment on a project, and have them request a token for that project | 17:05 |
| cnf | o,O | 17:06 |
| jlk | I should do a session at summit on using Ursula so you can point at any openStack you have some access to boot VMs so you can get a solid 3 node openstack built | 17:06 |
| ayoung | jlk, its cuz Iwork on Tripleo, and am resource constrained...had just taken down my system for a reinstall | 17:06 |
| cnf | I have a NUC with ESXi to test | 17:06 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Redis cache backend using hash as a native region https://review.openstack.org/382576 | 17:06 |
| cnf | so a role has to be assigned to a project? | 17:07 |
| ayoung | cnf, yep | 17:07 |
| jlk | cnf: what he's trying to say is that if you want to be able to see the catalog from the Users domain, the user you are logging in as will need to have at least a _member_ role in a project that exists in the Users domain. | 17:07 |
| ayoung | cnf a role assignment is a tuple: user, project, role | 17:07 |
| cnf | uhm | 17:07 |
| ayoung | jlk I was thinking of trying to get a Null role defined. It can't do anything in the project expect show you that you can't do anything. | 17:08 |
| jlk | heh | 17:08 |
| cnf | o,O | 17:08 |
| jlk | cnf: Access to things is driven by roles. Roles link together a user and a project | 17:08 |
| ayoung | jlk that is the way my mind has been warped by being on Keystone this long. | 17:08 |
| jlk | and when you add Domains to the mix, a project may be specific to a single domain | 17:08 |
| *** adrian_otto has joined #openstack-keystone | 17:09 | |
| ayoung | Having a Null role defined would show us how 90% of policy is way too permissive | 17:09 |
| jlk | probably | 17:09 |
| ayoung | jlk I wish we never introduced domains. I wish we had made projects hierarchical from the get go and left it at that | 17:09 |
| cnf | wow, this stuff is confusing | 17:10 |
| * ayoung gets the sads from Keystone history | 17:10 | |
| *** tqtran has joined #openstack-keystone | 17:10 | |
| jlk | it does make things awkward, even before talking about projects that span domains, or having domain level roles | 17:10 |
| ayoung | jlk, yep. Yuck. | 17:10 |
| *** phalmos has joined #openstack-keystone | 17:10 | |
| * ayoung needs food. | 17:10 | |
| cnf | and all I need domains for is to have LDAP auth | 17:10 |
| ayoung | cnf making a lunchrun. Back in a bit. | 17:10 |
| jlk | cnf: sadly, yes. This is a thing that has grown "organically" over time. | 17:10 |
| cnf | \o | 17:11 |
| cnf | thanks so far | 17:11 |
| cnf | still confused as fuck, but I did learn some things | 17:11 |
| jlk | Bottom line, there should be some projects that exist in the Users domain | 17:11 |
| *** adrian_otto has quit IRC | 17:11 | |
| jlk | and within those projects, you can assign some roles (such as _member_) to your LDAP users | 17:11 |
| cnf | yeah, I _think_ I have something working | 17:11 |
| jlk | so that when they log in, they log in with the magic combo of domain, user, and project. | 17:11 |
| cnf | what is _member_ ? I have seen it, but I have no idea what is special about it | 17:12 |
| jlk | it's a defacto standard for the base level of rights | 17:12 |
| cnf | hmm, ok | 17:12 |
| cnf | I just have admin and user roles, i think | 17:12 |
| jlk | I hesitate to say that it's not hardcoded anywhere in the actual code, other than policy | 17:12 |
| jlk | cnf: it's quite likely then that your policy files have been modified. | 17:12 |
| cnf | idno, I just followed the install docs on openstack.org | 17:13 |
| cnf | which has led me up weird places before, admitedly | 17:13 |
| jlk | did you edit any policy.json files? | 17:13 |
| cnf | uhm, I don't think so | 17:14 |
| jlk | those are the files that enforce the access levels. | 17:14 |
| jlk | How did the "user" role get created? | 17:14 |
| jlk | I'm assuming you have access, so check out your keystone's policy.json file | 17:14 |
| *** ddieterly is now known as ddieterly[away] | 17:15 | |
| cnf | member_role_name is not set anywhere, so it's still default | 17:15 |
| cnf | I have no idea what policy.json does, or what I am looking for | 17:15 |
| jlk | Policy.json is what is used to check specific API actions against a user's role(s) to decide whether the action should be allowed or not | 17:16 |
| jlk | it's how the difference between admin and non-admin is handled | 17:16 |
| cnf | it has neither user, nor _member_ as a specifit string in it, though | 17:16 |
| jlk | yeah, because I think it relies on the "member_role_name" configuration option | 17:17 |
| jlk | actually no | 17:17 |
| jlk | that's something different (even more confusing) | 17:17 |
| jlk | so keystone is fairly permissive | 17:18 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Improve check_token validation performance https://review.openstack.org/382107 | 17:18 |
| jlk | I think ht mostly concerns itself with admin level actions, and then it allows any user to do the rest. I may be wrong, but that's what I'm seeing. | 17:18 |
| *** adrian_otto has joined #openstack-keystone | 17:18 | |
| jlk | maybe stevemar can lend a brain here. | 17:18 |
| jlk | cnf: other services are more explicit about _member_ | 17:18 |
| *** adrian_otto has quit IRC | 17:19 | |
| jlk | Anyway, your getting of the catalog may very well work with just the "user" role | 17:20 |
| *** ash__ has joined #openstack-keystone | 17:21 | |
| stevemar | jlk: ha, i'm stepping out to lunch (for reals, not trying to squirm out of a convo) | 17:22 |
| *** mvk has joined #openstack-keystone | 17:25 | |
| cnf | well, my brain hurts | 17:27 |
| cnf | i'm going to take a shower | 17:27 |
| cnf | and then try figure out why swift won't work with keystone | 17:27 |
| *** browne has joined #openstack-keystone | 17:30 | |
| jlk | oh that's another pile of fun! | 17:30 |
| cnf | hmm | 17:31 |
| cnf | swift works, with SWauth | 17:31 |
| cnf | can;t get it to do anything with keystone | 17:31 |
| cnf | openstack is great when it works | 17:32 |
| cnf | but boy, getting it there... | 17:32 |
| stevemar | cnf: the folks in #openstack-swift are a good source for integrating the two | 17:32 |
| cnf | stevemar: they sent me here for the keystone questions :P | 17:32 |
| stevemar | cnf timezone are you? | 17:32 |
| cnf | CET | 17:33 |
| stevemar | cnf: im lunching, ill help when i get back | 17:33 |
| cnf | that's cool, thanks | 17:33 |
| cnf | enjoy your lunch first, it's important :P | 17:33 |
| cnf | i'm off for a bit anyway | 17:33 |
| *** dikonoor has joined #openstack-keystone | 17:37 | |
| *** bjolo_ has joined #openstack-keystone | 17:41 | |
| jlk | so yeah, there's specific swift configuration entries to have it talk to Keystone | 17:41 |
| jlk | swift-proxy in particular | 17:41 |
| jlk | proxy-server.conf | 17:42 |
| jlk | You'l have to have a "keystoneauth" in your pipeline, and have two [filter:<something>] sections. One is [filter:keystoneauth] where details about roles go, and a "use = egg:swift#keystoneauth" line | 17:43 |
| jlk | then in [filter:authtoken] details about keystone go in, such as the URIs, an admin_password, an admin_tenant_name, an admin_user, and a few other details | 17:44 |
| jlk | (those admin_whatever details are usually a service account created for swift, like in our case it's a "swift" user) | 17:44 |
| cnf | jlk: i have authtoken keystoneauth | 17:48 |
| cnf | and both those sections | 17:48 |
| cnf | swift user exists, the urls are set | 17:48 |
| *** gagehugo has quit IRC | 17:48 | |
| jlk | Maybe this will help: | 17:48 |
| jlk | https://github.com/blueboxgroup/ursula/blob/master/roles/swift-proxy/templates/etc/swift/proxy-server.conf | 17:49 |
| cnf | yeah, gone over that a few douzen times | 17:49 |
| jlk | well, this one is the template we use in production | 17:49 |
| jlk | If you turn up swift proxy debugging, you might be able to catch it attempt to talk to keystone to sort out the auth | 17:49 |
| jlk | client software (like openstack client) will first get a token from keystone, then hit swift-proxy and provide that token | 17:50 |
| *** phalmos has quit IRC | 17:50 | |
| jlk | swift-proxy will use the keystone details to attempt to validate the token | 17:50 |
| *** amoralej is now known as amoralej|off | 17:50 | |
| cnf | hmm | 17:52 |
| cnf | I also don't have any decent client to talk to swift, really | 17:52 |
| jlk | the openstack client | 17:52 |
| jlk | openstack object list | 17:52 |
| jlk | or | 17:53 |
| jlk | openstack container list | 17:53 |
| cnf | hmm, that doesn't like a hostname I set, and I don't get where it gets it from | 17:54 |
| cnf | SSL error hostname A doesn't match hostname B | 17:54 |
| jlk | it gets the name for swift from the catalog | 17:54 |
| jlk | openstack catalog list | 17:55 |
| jlk | or openstack catalog show object-store | 17:55 |
| cnf | yeah, that shows the right hostname | 17:56 |
| jlk | so try "openstack --debug container list" and you will see more details about where it tries to connect to | 17:56 |
| *** spzala has quit IRC | 17:56 | |
| cnf | yeah, I did that | 17:56 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: DO NOT MERGE: test revocation search to sql https://review.openstack.org/374999 | 17:57 |
| cnf | hmz | 17:58 |
| cnf | wth is it doing? | 17:58 |
| cnf | oh, hmz | 17:58 |
| cnf | damn urrlib doesn't know SNI | 17:58 |
| cnf | o,O | 17:58 |
| jlk | Is it the client throwing the error, or is it swift-proxy reporting the error back when it can't talk to keystone? | 18:02 |
| cnf | client | 18:03 |
| cnf | other clients also don't work, so that's not my only problem by far | 18:03 |
| *** SamYaple_ has joined #openstack-keystone | 18:04 | |
| *** SamYaple_ has quit IRC | 18:04 | |
| *** SamYaple has quit IRC | 18:04 | |
| *** SamYaple has joined #openstack-keystone | 18:04 | |
| cnf | ugh, it seems I have no hosts where this works | 18:05 |
| cnf | >,< | 18:05 |
| *** gyee has quit IRC | 18:05 | |
| cnf | SL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version great | 18:05 |
| cnf | right, and if I run with --insecure, I get a 500 | 18:08 |
| jlk | well, that sounds like then the swift-proxy threw an error | 18:10 |
| jlk | and should be discoverable in the log | 18:10 |
| jlk | interesting that TLS works enough to get the token from keystone, but not to talk to swift. Are you using that different of a TLS setup between the two? | 18:10 |
| cnf | raise exceptions.DiscoveryFailure('Could not determine a suitable URL '#012DiscoveryFailure: Could not determine a suitable URL for the plugin (txn: tx5e5579fae6ad4a67bb7df-0057f541ef) | 18:10 |
| jlk | hrm, what's the URL you're providing? versioned, unversioned? | 18:11 |
| cnf | uhm, where? | 18:11 |
| *** LamT__ has quit IRC | 18:11 | |
| cnf | in proxy-server ? | 18:12 |
| *** gyee has joined #openstack-keystone | 18:13 | |
| cnf | it's just http://ip:5000/ | 18:13 |
| *** tqtran has quit IRC | 18:13 | |
| jlk | okay, so that means the keystone client code in swift's python environment is going to attempt to determine an API version to connect to | 18:14 |
| jlk | v2.0 or v3 | 18:15 |
| *** ddieterly[away] has quit IRC | 18:15 | |
| cnf | ok | 18:15 |
| jlk | but yes, this is indicating swift-proxy is having difficulty talking to keystone. Crank up that debugging | 18:16 |
| *** ash__ has quit IRC | 18:18 | |
| cnf | it's already on | 18:20 |
| cnf | the debug | 18:20 |
| *** spzala has joined #openstack-keystone | 18:24 | |
| *** david-lyle has quit IRC | 18:25 | |
| cnf | ok | 18:30 |
| cnf | jlk: it was a dns issue | 18:30 |
| jlk | neat! | 18:30 |
| cnf | o,O | 18:30 |
| cnf | so i'm at 401 Unauthorized now | 18:30 |
| cnf | at least that's something | 18:30 |
| *** gagehugo has joined #openstack-keystone | 18:30 | |
| jlk | it's a step in a direction | 18:32 |
| jlk | in swift at least there is configuration for what user roles are allowed to do things | 18:32 |
| jlk | such as operator_roles | 18:33 |
| jlk | those need to line up with keystone roles | 18:33 |
| jlk | so if your keystone role is "user", then "user" needs to be listed for operator_roles | 18:33 |
| openstackgerrit | Merged openstack/keystonemiddleware: Use the mocking fixture in notifier tests https://review.openstack.org/334295 | 18:34 |
| *** ddieterly has joined #openstack-keystone | 18:34 | |
| *** dikonoor has quit IRC | 18:34 | |
| *** code-R has joined #openstack-keystone | 18:35 | |
| cnf | ok, that wasn't it | 18:36 |
| cnf | anyway, I need a break ^^; | 18:36 |
| cnf | off to play some warframe, i'll be back after that | 18:36 |
| cnf | jlk: thanks for the help so far | 18:38 |
| jlk | No problem, cheers | 18:38 |
| *** code-R_ has joined #openstack-keystone | 18:38 | |
| *** code-R has quit IRC | 18:41 | |
| *** haplo37_ has quit IRC | 18:53 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Extract oslo_messaging specific audit tests https://review.openstack.org/334296 | 18:54 |
| *** haplo37_ has joined #openstack-keystone | 18:56 | |
| *** code-R_ has quit IRC | 18:56 | |
| *** code-R has joined #openstack-keystone | 18:56 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Improve check_token validation performance https://review.openstack.org/382107 | 19:00 |
| *** gyee has quit IRC | 19:03 | |
| *** lamt has quit IRC | 19:08 | |
| *** phalmos has joined #openstack-keystone | 19:09 | |
| *** tqtran has joined #openstack-keystone | 19:09 | |
| openstackgerrit | Merged openstack/keystone: re-add valid comment about None domain ID https://review.openstack.org/382487 | 19:10 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Improve check_token validation performance https://review.openstack.org/382107 | 19:20 |
| *** ddieterly is now known as ddieterly[away] | 19:23 | |
| *** david-lyle has joined #openstack-keystone | 19:23 | |
| *** ddieterly[away] is now known as ddieterly | 19:26 | |
| *** code-R has quit IRC | 19:29 | |
| *** bjolo_ has quit IRC | 19:33 | |
| *** alee is now known as alee_afk | 19:43 | |
| *** sdake has quit IRC | 19:45 | |
| *** sdake has joined #openstack-keystone | 19:46 | |
| *** knikolla_ has joined #openstack-keystone | 19:53 | |
| *** knikolla_ has quit IRC | 19:58 | |
| *** ddieterly is now known as ddieterly[away] | 19:58 | |
| *** knikolla_ has joined #openstack-keystone | 19:58 | |
| *** ddieterly[away] is now known as ddieterly | 19:59 | |
| *** knikolla_ has quit IRC | 20:00 | |
| cnf | hmm, now keystone is giving me tracebacks saying it can't find domain default | 20:05 |
| cnf | 2016-10-05 20:05:20.744 24 ERROR keystone.auth.controllers raise exception.DomainNotFound(domain_id=domain_id) | 20:05 |
| cnf | 2016-10-05 20:05:20.744 24 ERROR keystone.auth.controllers DomainNotFound: Could not find domain: default | 20:05 |
| cnf | domain list shows it, though | 20:06 |
| *** adrian_otto has joined #openstack-keystone | 20:06 | |
| *** adrian_otto has quit IRC | 20:06 | |
| *** asettle has quit IRC | 20:09 | |
| cnf | any one have an idea why I would get that? | 20:13 |
| *** adrian_otto has joined #openstack-keystone | 20:14 | |
| *** adrian_otto has quit IRC | 20:16 | |
| *** adrian_otto has joined #openstack-keystone | 20:16 | |
| *** adrian_otto has quit IRC | 20:18 | |
| *** adrian_otto has joined #openstack-keystone | 20:18 | |
| *** adrian_otto has quit IRC | 20:20 | |
| dstanek | cnf: put the full stack track on paste.openstack.org | 20:20 |
| *** adrian_otto has joined #openstack-keystone | 20:21 | |
| cnf | http://paste.openstack.org/show/584551/ | 20:22 |
| dstanek | cnf: what's the different between my.domain and the ip address? | 20:24 |
| cnf | my.domain is a dns entry | 20:24 |
| cnf | which points to that ip | 20:24 |
| *** phalmos has quit IRC | 20:24 | |
| cnf | dstanek: that's what I get when I do openstack container list --insecure | 20:26 |
| cnf | and openstack domain list does show an entry default | 20:26 |
| dstanek | cnf: also if looks like you are auth-ing on both 5000 and 35357 - is that intentional? | 20:27 |
| *** phalmos has joined #openstack-keystone | 20:28 | |
| cnf | uhm, idno? one is user and one is admin, isn't it? | 20:29 |
| cnf | 5000 is public and internal, and 35357 is admin | 20:31 |
| *** ddieterly is now known as ddieterly[away] | 20:34 | |
| dstanek | cnf: that true for the v2 api, but not the v3 api | 20:34 |
| cnf | oh? | 20:34 |
| cnf | huh? | 20:34 |
| cnf | I just followed the online docs | 20:34 |
| dstanek | i mentioned it because auths seemed to work on the 5000 port just fine | 20:34 |
| dstanek | cnf: which docs? | 20:35 |
| cnf | http://docs.openstack.org/mitaka/install-guide-ubuntu/keystone-services.html | 20:35 |
| cnf | at the bottom | 20:35 |
| openstackgerrit | Merged openstack/keystonemiddleware: Use oslo_messaging conf fixture https://review.openstack.org/336970 | 20:36 |
| cnf | also, it only fails for swift, everything else seems to work just fine | 20:37 |
| dstanek | cnf: is swift what's using that different url? | 20:37 |
| cnf | the url is set as an endpoint as well | 20:38 |
| dstanek | what happens when you do a 'domain show default' using the openstackclient? | 20:39 |
| dstanek | with v3 it shouldn't matter what port you go to as long as they both point to the same keystone instance | 20:39 |
| cnf | it shows me the domain entry | 20:40 |
| dstanek | do you know what url it's hitting? | 20:40 |
| cnf | http://paste.openstack.org/show/584557/ btw | 20:42 |
| cnf | I found the reference to the IP | 20:42 |
| *** ddieterly[away] is now known as ddieterly | 20:42 | |
| cnf | and changed it to use the domain entry | 20:42 |
| dstanek | i think you are still using different ports | 20:43 |
| cnf | and this is domain show default: http://paste.openstack.org/show/584558/ | 20:44 |
| cnf | yeah | 20:44 |
| *** adrian_otto has quit IRC | 20:44 | |
| *** adrian_otto1 has joined #openstack-keystone | 20:44 | |
| dstanek | cnf: it looks like the GET returned a 404. did you get an error? | 20:45 |
| cnf | 404? | 20:46 |
| dstanek | cnf: that's what it shows in the paste | 20:46 |
| cnf | I don't see a 404? | 20:46 |
| *** mriedem has joined #openstack-keystone | 20:46 | |
| cnf | I see 200 and 201? | 20:46 |
| mriedem | stevemar: ayoung: fyi https://www.openstack.org/summit/barcelona-2016/summit-schedule/events/16936/nova-completing-vendordata-v2 | 20:46 |
| dstanek | 2016-10-05 20:44:14.720 24 INFO eventlet.wsgi.server [req-2fb804a3-cced-4ccf-a512-0ddf0c3189b5 71327a7c1a4e4484b1a45bdfe10fc647 314e7e971f3a49129406c148cb7dd9d4 - 04d7c2fcba9e436096f789360a8cf14e 04d7c2fcba9e436096f789360a8cf14e] 172.17.0.1 - - [05/Oct/2016 20:44:14] "GET /v3/domains/default HTTP/1.1" 404 340 0.032001 | 20:47 |
| cnf | oh | 20:47 |
| cnf | so /v3/domains/default doesn't work, but /v3/domains?name=default does | 20:48 |
| ayoung | mriedem, looks good | 20:48 |
| *** adrian_otto1 has quit IRC | 20:49 | |
| stevemar | mriedem: https://review.openstack.org/#/q/topic:bp/allow-expired | 20:49 |
| cnf | dstanek: I have no idea what causes that :( | 20:50 |
| mriedem | stevemar: yeah, just pointing out the session, i put it at a time that doesn't conflict with keystone sessions | 20:51 |
| stevemar | mriedem: danke | 20:51 |
| stevemar | mriedem: hopefully we can have something you can test out by the summit | 20:51 |
| dstanek | cnf: is 'default' the name or id? | 20:51 |
| cnf | dstanek: uhm, name, can an id be "default"? o,O | 20:52 |
| dstanek | cnf: usually for default domain id=default and name=Default | 20:52 |
| cnf | uhm, I just followed the docs... | 20:53 |
| cnf | I have no idea how to get a domain with id=default | 20:53 |
| dstanek | the 404 is because it was checking to see if you have 'domain show' the id and the name= query was seeing if it could find it by name | 20:53 |
| cnf | ok | 20:53 |
| dstanek | cnf: so maybe use the actual id in your swift configuration | 20:53 |
| cnf | dstanek: same error | 20:55 |
| *** lamt has joined #openstack-keystone | 20:55 | |
| cnf | assuming i did it right | 20:55 |
| cnf | still get "ERROR keystone.auth.controllers DomainNotFound: Could not find domain: default" | 20:55 |
| *** raildo has quit IRC | 20:55 | |
| *** ddieterly is now known as ddieterly[away] | 20:56 | |
| cnf | also, it is configured the same way in nova and glance etc | 20:56 |
| cnf | and it works there | 20:56 |
| cnf | hmm | 20:57 |
| cnf | so swift is stupid | 20:57 |
| cnf | dstanek: so that seems to have worked | 20:57 |
| cnf | I kid you not, it is set by name in nova and glance etc | 20:57 |
| cnf | dstanek: thanks, that actually seems to do it | 21:00 |
| cnf | why do all the docs put the word "default" there? | 21:00 |
| cnf | if you can't actually make a domain with ID "default"? | 21:00 |
| *** phalmos has quit IRC | 21:01 | |
| *** phalmos has joined #openstack-keystone | 21:01 | |
| *** adrian_otto has joined #openstack-keystone | 21:02 | |
| jamielennox | stevemar: can you remove W-1 from https://review.openstack.org/#/c/359653/ | 21:04 |
| cnf | right... | 21:06 |
| cnf | dstanek: project_domain_ID vs project_domain_NAME | 21:06 |
| stevemar | jamielennox: done | 21:07 |
| jamielennox | ty | 21:07 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Improve check_token validation performance https://review.openstack.org/382107 | 21:09 |
| cnf | dstanek: so I have something that mostly works now, thanks for the help | 21:10 |
| cnf | tomorrow, i need to learn more on how keystone works | 21:10 |
| cnf | really... | 21:10 |
| dstanek | cnf: yw...that i can help you with...i know almost nothing about how swift works | 21:10 |
| cnf | that's ok, I need lots of keystone help, as well :P | 21:11 |
| *** ayoung has quit IRC | 21:12 | |
| cnf | like the difference between internal, public and admin endpoints | 21:12 |
| cnf | that still confuses me | 21:12 |
| stevemar | cnf: internal is meant to hit if you dont want to go external and use up bandwidth | 21:15 |
| stevemar | public and admin may as well be the same, it's only different for keystone for historical reasons, but if you're using v3 then it doesn't matter | 21:15 |
| cnf | stevemar: so... who decides that? | 21:15 |
| cnf | internal vs public? | 21:15 |
| stevemar | cnf: you can decide the "interface" you want to use upon creating a connection to keystone | 21:16 |
| dstanek | cnf: public is what you give customers, internal is unmetered (like you'd want between services) and admin is for special admin functionaltiy | 21:16 |
| cnf | so uhm | 21:17 |
| cnf | if a client connects to say swift | 21:17 |
| cnf | it needs to then get a url for keystone | 21:17 |
| cnf | which one does that client get? | 21:17 |
| dstanek | cnf: so what url does swift use to talk to keystone? | 21:18 |
| dstanek | i would guess it uses the public url | 21:18 |
| cnf | I thought that the endpoints in keystone where used for service discovery? | 21:19 |
| dstanek | yes, keystone's own URL is often the exception... how do you get the catalog if you don't know how to connect to keystone? | 21:20 |
| dstanek | (unless you used an alternative discovery mechanism for keystone, like DNS) | 21:20 |
| cnf | right, but then you connect to keystone | 21:21 |
| cnf | how does a component pick a public or internal endpoint? | 21:21 |
| dstanek | cnf: i'm guessing each one picks what they want based on what they are doing. you can specify the interface using the client | 21:23 |
| dstanek | cnf: for example, in OSC i think the param is --os-interface | 21:23 |
| cnf | what client? | 21:23 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Improve check_token validation performance https://review.openstack.org/382107 | 21:23 |
| *** haplo37_ has quit IRC | 21:24 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Improve check_token validation performance https://review.openstack.org/382107 | 21:24 |
| *** ddieterly[away] is now known as ddieterly | 21:25 | |
| dstanek | cnf: if you are talking to a service you are likly using a client to do it | 21:25 |
| cnf | well, say nova, or glance etc | 21:25 |
| cnf | or horizon, it discovers all available services through keystone, from what I get | 21:26 |
| *** haplo37_ has joined #openstack-keystone | 21:26 | |
| *** spilla has quit IRC | 21:26 | |
| cnf | how does horizon decide what interface to use? | 21:26 |
| dstanek | cnf: for nova look at http://git.openstack.org/cgit/openstack/nova/tree/requirements.txt for a list of client it requires | 21:26 |
| dstanek | when it talks to cinder it uses the cinderclient, glance the glanceclient, etc | 21:26 |
| cnf | yeah, so how does it decide what endpoint to use? | 21:27 |
| dstanek | i'm assuming nova specifies the one it wants. maybe it's configurable, but i have no idea | 21:28 |
| cnf | hmm... | 21:28 |
| cnf | i'll play with defining silly ones | 21:28 |
| cnf | and see when it breaks | 21:28 |
| jamielennox | as a tip most services call interface endpoint_type - they're exactly the same | 21:30 |
| stevemar | jamielennox: rebase that ksm patch | 21:30 |
| jamielennox | stevemar: i just rechecked it, i don't see any reason it'd only fail on py35 | 21:30 |
| stevemar | jamielennox: yes i see that now | 21:31 |
| dstanek | cnf: i don't think anything will break if you add unused ones | 21:31 |
| stevemar | jamielennox: i approved it, zuul is happy about it | 21:31 |
| cnf | no, i mean replace exisitng ones | 21:31 |
| cnf | like change the public one for nova | 21:31 |
| cnf | and see if everything still works | 21:31 |
| dstanek | cnf: ah, i see. | 21:32 |
| cnf | dstanek: I have a weird way of learning, I guess | 21:32 |
| cnf | I break shit, then I get frustrated trying to fix it | 21:33 |
| cnf | ^^; | 21:33 |
| cnf | but learning how to fix things you broke makes it stick, you know | 21:33 |
| *** adrian_otto has quit IRC | 21:33 | |
| jamielennox | stevemar: oh, that ksm patch | 21:33 |
| *** adrian_otto has joined #openstack-keystone | 21:34 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Specify that unknown arguments can be passed to fetch_token https://review.openstack.org/379034 | 21:34 |
| *** mriedem has quit IRC | 21:38 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Improve check_token validation performance https://review.openstack.org/382107 | 21:40 |
| stevemar | jamielennox: generic client was never deprecated https://review.openstack.org/#/c/359706/1 | 21:42 |
| jamielennox | stevemar: gah, really? i think most people just forgot about it, it hasn't worked in v3 | 21:43 |
| *** knikolla_ has joined #openstack-keystone | 21:44 | |
| *** knikolla_ has quit IRC | 21:44 | |
| *** ravelar has quit IRC | 21:45 | |
| jamielennox | as noticed by the fact that i completely removed it and nothing complained | 21:45 |
| *** knikolla_ has joined #openstack-keystone | 21:45 | |
| stevemar | jamielennox: actually, bknudson may have saved your bacon | 21:45 |
| stevemar | https://github.com/openstack/python-keystoneclient/commit/0c2fef51d2b90df088d30e9b6c5079caae7c6578 | 21:45 |
| bknudson | still a long ways to go with removing that stuff | 21:46 |
| bknudson | since there's tests that use a lot of stuff that's deprecated | 21:46 |
| jamielennox | stevemar: nope, it looks like it was moved to avoid the deprecation warning | 21:46 |
| jamielennox | stevemar, bknudson: i'm not so concerned about not removing it now, basically rechecking that chain shows up places that are still using client incorrectly so we can go off and fix them | 21:47 |
| *** ddieterly is now known as ddieterly[away] | 21:47 | |
| jamielennox | though it's been a few weeks since i dived into that rabbit hole | 21:47 |
| openstackgerrit | Merged openstack/python-keystoneclient: Use fixtures from keystoneauth https://review.openstack.org/359642 | 21:48 |
| stevemar | jamielennox: frustrating | 21:49 |
| *** iurygregory_ has joined #openstack-keystone | 21:49 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Use AUTH_INTERFACE object from keystoneauth https://review.openstack.org/359653 | 21:49 |
| stevemar | jamielennox: lots of places using "access" too: http://codesearch.openstack.org/?q=from%20keystoneclient%20import%20access&i=nope&files=&repos= | 21:50 |
| *** phalmos has quit IRC | 21:50 | |
| stevemar | which is deprecated | 21:50 |
| jamielennox | stevemar, lbragstad: can you have another look at https://review.openstack.org/#/c/359506/ | 21:50 |
| jamielennox | i need to do more codesearch.o.o | 21:50 |
| stevemar | jamielennox: jah | 21:50 |
| jamielennox | actually horizon is a big one i really need to get back into | 21:51 |
| dstanek | jamielennox: ++ i'm trying to get into it as we speak | 21:53 |
| *** edmondsw has quit IRC | 21:53 | |
| dstanek | i don't get how horizon's is_domain_admin can possibly work | 21:54 |
| jamielennox | i've never understood how much of what horizon does it can possibly do | 21:56 |
| jamielennox | the token juggling and number of requests it does is impressive in a weird sort of way | 21:57 |
| *** spzala has quit IRC | 21:57 | |
| *** knikolla_ has quit IRC | 21:57 | |
| *** ddieterly[away] is now known as ddieterly | 21:58 | |
| *** lamt has quit IRC | 21:59 | |
| jamielennox | stevemar, dstanek: this is one of the other "features" i want to get into ksa: https://review.openstack.org/#/c/357633/ | 22:01 |
| *** adrian_otto has quit IRC | 22:02 | |
| *** adrian_otto has joined #openstack-keystone | 22:03 | |
| *** adriant has joined #openstack-keystone | 22:03 | |
| *** alee_afk is now known as alee | 22:04 | |
| *** lamt has joined #openstack-keystone | 22:04 | |
| *** adrian_otto has quit IRC | 22:19 | |
| *** chris_hultin is now known as chris_hultin|AWA | 22:23 | |
| *** spzala has joined #openstack-keystone | 22:27 | |
| *** adrian_otto has joined #openstack-keystone | 22:28 | |
| *** adrian_otto has quit IRC | 22:29 | |
| *** ddieterly has quit IRC | 22:29 | |
| *** spzala has quit IRC | 22:32 | |
| *** gyee has joined #openstack-keystone | 22:33 | |
| *** thebloggu has joined #openstack-keystone | 22:36 | |
| *** lamt has quit IRC | 22:44 | |
| *** knikolla_ has joined #openstack-keystone | 22:46 | |
| bigjools | Is it possible to delete a project that is defined as another project's parent? Or is that disallowed? | 22:52 |
| *** knikolla_ has quit IRC | 22:53 | |
| *** jamielennox is now known as jamielennox|away | 23:09 | |
| *** nicolasbock has quit IRC | 23:09 | |
| *** ddieterly has joined #openstack-keystone | 23:09 | |
| *** ddieterly has quit IRC | 23:09 | |
| *** asettle has joined #openstack-keystone | 23:15 | |
| *** asettle has quit IRC | 23:20 | |
| *** markvoelker has quit IRC | 23:22 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Refactor audit tests to use create_middleware https://review.openstack.org/336971 | 23:22 |
| *** lamt has joined #openstack-keystone | 23:24 | |
| rodrigods | bigjools, nope, only leafs | 23:25 |
| bigjools | thank you rodrigods | 23:25 |
| *** gyee has quit IRC | 23:31 | |
| *** knikolla_ has joined #openstack-keystone | 23:42 | |
| *** phalmos has joined #openstack-keystone | 23:45 | |
| *** knikolla_ has quit IRC | 23:45 | |
| *** knikolla_ has joined #openstack-keystone | 23:46 | |
| *** david-lyle has quit IRC | 23:47 | |
| *** sdake has quit IRC | 23:48 | |
| *** arunkant__ has quit IRC | 23:53 | |
| *** phalmos has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!