| jlk | Fun question, is db_sync --expand / --migrate / --contract idempotent? Lets say I run our upgrade playbook twice, will it fail horribly if it tries to --expand a db that's already been --contract ed? | 00:01 |
|---|---|---|
| stevemar | jlk: nope! it's still experimental so we haven't enforced that yet | 00:05 |
| jlk | craaaaaap | 00:05 |
| stevemar | jlk: refer to bugs: https://bugs.launchpad.net/keystone/+bug/1615024 and https://bugs.launchpad.net/keystone/+bug/1615014 | 00:06 |
| openstack | stevemar: Error: Could not gather data from Launchpad for bug #1615024 (https://launchpad.net/bugs/1615024). The error has been logged | 00:06 |
| jlk | I have to bake something int our stuff then to work around that | 00:06 |
| openstack | Launchpad bug 1615014 in OpenStack Identity (keystone) "Prevent --expand, --migrate, --contract from being run out of order" [Low,Triaged] - Assigned to Henry Nash (henry-nash) | 00:06 |
| stevemar | aaaand https://bugs.launchpad.net/keystone/+bug/1623117 | 00:06 |
| openstack | Launchpad bug 1623117 in OpenStack Identity (keystone) "Prevent keystone from serving requests when schema or data migrations are not up to date" [Medium,New] | 00:06 |
| stevemar | jlk: you upgrading like that now? not sticking to the minimal downtime approach? | 00:07 |
| jlk | Going to give it a try for Mitaka -> Newton | 00:07 |
| jlk | for keystone, nova, and neutron | 00:07 |
| stevemar | jlk: okay, we're eager to hear feedback | 00:08 |
| jlk | Mostly I'm worried that if our upgrade fails and we start over, we would attempt another round of expand, migrate, and contract. | 00:08 |
| jlk | I'd hope they'd noop and return 0 | 00:08 |
| stevemar | jlk: do you store any credentials in keystone? using the /v3/credentials or ec2 API? | 00:08 |
| jlk | no, I don't believe we're storing any credentials | 00:08 |
| stevemar | jlk: then you'll be fine | 00:08 |
| jlk | but for the sake of argument... | 00:08 |
| stevemar | jlk: the only tricky part of the migrate this time around is that we encrypt credentials while the --migrate is run, so in the case of a new credential being created it's weird | 00:09 |
| stevemar | but if you don't have any, you'll be safe | 00:09 |
| jlk | I don't _think_ we do | 00:09 |
| *** mserngawy_ has quit IRC | 00:10 | |
| *** guoshan has quit IRC | 00:10 | |
| jlk | oh, neutron isn't live yet. Still have to coordinate and shut down all neutron-server to do the contract. | 00:11 |
| *** guoshan has joined #openstack-keystone | 00:11 | |
| jlk | I'm doing this now so that I have something to talk about at Summit next week :) | 00:14 |
| jamielennox | stevemar: we forceably encrypt credentials? i thought you had to set that up yourself | 00:14 |
| jamielennox | opt-in like | 00:14 |
| *** guoshan_ has joined #openstack-keystone | 00:15 | |
| *** guoshan has quit IRC | 00:15 | |
| jamielennox | the problem for credential storage keys is the same as fernet keys, what jlk is looking at doesn't have a key distribution story | 00:17 |
| stevemar | jlk: we would love all kinds of feedback | 00:17 |
| stevemar | jamielennox: we do enforce credential encryption as of newton | 00:18 |
| stevemar | jamielennox: you have to run keystone-manage credential_setup before upgrading (or on a fresh install) | 00:19 |
| jamielennox | stevemar: thats quite a barrier, as you need the same keys on all your keystone nodes | 00:21 |
| stevemar | jamielennox: yes, but this was a gaping hole for far too long and folks who setup fernet can re-use the same approach | 00:21 |
| stevemar | jamielennox: actually.... | 00:21 |
| stevemar | jamielennox: we supported the null key encryption right, so you don't have to actually setup any proper keys, just run the stinkin command | 00:22 |
| jamielennox | stevemar: the command will generate keys, if we support null why would i need to run the command at all? | 00:23 |
| jamielennox | it seems to work without it, but i don't do much credential work | 00:24 |
| stevemar | you don't have to run the command actually, we'll support it with a null key | 00:24 |
| stevemar | thats how rdo was fixed | 00:24 |
| stevemar | they don't run the command | 00:24 |
| stevemar | grenade does | 00:24 |
| jamielennox | excellent - so nothing to do here :) | 00:25 |
| *** LamT__ has quit IRC | 00:32 | |
| *** adrian_otto has joined #openstack-keystone | 00:37 | |
| *** adrian_otto has quit IRC | 00:42 | |
| *** guoshan_ has quit IRC | 00:45 | |
| *** adrian_otto has joined #openstack-keystone | 00:46 | |
| *** adrian_otto has quit IRC | 00:52 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Validate mapping exists when creating/updating a protocol https://review.openstack.org/362397 | 00:55 |
| *** tqtran has quit IRC | 01:00 | |
| *** hoangcx has joined #openstack-keystone | 01:02 | |
| *** Zer0Byte__ has quit IRC | 01:15 | |
| *** davechen has joined #openstack-keystone | 01:21 | |
| *** guoshan has joined #openstack-keystone | 01:30 | |
| *** adrian_otto has joined #openstack-keystone | 01:40 | |
| *** markvoelker has joined #openstack-keystone | 01:43 | |
| *** asettle has joined #openstack-keystone | 01:47 | |
| *** browne has quit IRC | 01:49 | |
| *** markvoelker has quit IRC | 01:49 | |
| *** iurygregory_ has quit IRC | 01:49 | |
| *** asettle has quit IRC | 01:51 | |
| *** jperry has joined #openstack-keystone | 01:56 | |
| openstackgerrit | liujunpeng proposed openstack/keystone: Fix LOG.warn to LOG.warning https://review.openstack.org/388279 | 01:57 |
| *** wangqun has joined #openstack-keystone | 02:01 | |
| *** phalmos has quit IRC | 02:02 | |
| *** chlong has joined #openstack-keystone | 02:16 | |
| *** kiran-r has quit IRC | 02:20 | |
| *** agrebennikov has quit IRC | 02:23 | |
| *** flwang1 has quit IRC | 02:27 | |
| *** kiran-r has joined #openstack-keystone | 02:27 | |
| *** dave-mccowan has quit IRC | 02:29 | |
| *** kiran-r has quit IRC | 02:47 | |
| *** guoshan has quit IRC | 02:55 | |
| *** nicolasbock has quit IRC | 02:56 | |
| *** guoshan has joined #openstack-keystone | 02:58 | |
| stevemar | davechen: thanks for the quick -2 there ^ | 03:06 |
| openstackgerrit | Merged openstack/keystone: Tweak api-ref for v3 groups status codes https://review.openstack.org/367793 | 03:11 |
| davechen | stevemar: np, looks like the change is attractive, I saw it was tried many time before. :) | 03:14 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Remove unused statements in matches https://review.openstack.org/387548 | 03:14 |
| stevemar | davechen: yeah, i've seen it three times now :( | 03:15 |
| *** gagehugo has quit IRC | 03:17 | |
| *** code-R has joined #openstack-keystone | 03:41 | |
| *** code-R_ has joined #openstack-keystone | 03:43 | |
| *** tqtran has joined #openstack-keystone | 03:45 | |
| *** code-R has quit IRC | 03:45 | |
| *** links has joined #openstack-keystone | 03:46 | |
| *** tqtran has quit IRC | 03:50 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/388317 | 03:51 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/388318 | 03:51 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Allow fetching an expired token https://review.openstack.org/382098 | 03:52 |
| *** guoshan has quit IRC | 03:57 | |
| stevemar | jamielennox: release note that dude ^ | 04:05 |
| jamielennox | stevemar: damnit, i always forget thta | 04:07 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Allow fetching an expired token https://review.openstack.org/382098 | 04:11 |
| *** code-R has joined #openstack-keystone | 04:11 | |
| *** code-R_ has quit IRC | 04:11 | |
| *** adrian_otto1 has joined #openstack-keystone | 04:14 | |
| *** davechen has quit IRC | 04:16 | |
| *** adrian_otto has quit IRC | 04:17 | |
| *** trananhkma has joined #openstack-keystone | 04:19 | |
| *** code-R_ has joined #openstack-keystone | 04:22 | |
| *** code-R has quit IRC | 04:25 | |
| *** adriant has quit IRC | 04:25 | |
| *** GB21 has joined #openstack-keystone | 04:29 | |
| stevemar | jamielennox: old age finally catching up to you | 04:31 |
| *** dikonoor has joined #openstack-keystone | 04:33 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Allow fetching an expired token https://review.openstack.org/382098 | 04:34 |
| *** kiran-r has joined #openstack-keystone | 04:38 | |
| *** kiran-r has quit IRC | 04:43 | |
| jamielennox | what are we up to now - api version wise? | 04:48 |
| *** jperry has quit IRC | 04:53 | |
| stevemar | jamielennox: 3.8... i think | 04:54 |
| stevemar | let me check | 04:54 |
| stevemar | https://github.com/openstack/keystone/blob/master/keystone/version/controllers.py#L142-L160 | 04:54 |
| stevemar | jamielennox: yeah, 3.8 will be ocata | 04:55 |
| *** kiran-r has joined #openstack-keystone | 04:55 | |
| *** guoshan has joined #openstack-keystone | 04:58 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Allow fetching an expired token https://review.openstack.org/382098 | 05:00 |
| jamielennox | stevemar: thanks, what's your opinion on the ?allow_expired vs ?allow_expired=1 | 05:00 |
| stevemar | jamielennox: we typically use ==true don't we? | 05:01 |
| stevemar | iirc, with role-assignments --inherited and --effective | 05:01 |
| jamielennox | stevemar: hmm? this is an api | 05:02 |
| jamielennox | so GET /v3/auth/token?allow_expired | 05:02 |
| jamielennox | vs | 05:02 |
| jamielennox | so GET /v3/auth/token?allow_expired=1 | 05:02 |
| stevemar | yeah, sorry i wasn't clear | 05:03 |
| *** guoshan has quit IRC | 05:03 | |
| jamielennox | i know nocatalog works without a value | 05:03 |
| stevemar | jamielennox: dammit http://imgur.com/a/3aTID | 05:04 |
| stevemar | jamielennox: so effective works with no value | 05:04 |
| stevemar | jamielennox: but include_names and include_subtree work with booleans | 05:05 |
| jamielennox | stevemar: lol, but include_subtree doesn't | 05:05 |
| stevemar | i thought we had asked the API working group about this? | 05:05 |
| jamielennox | we had a conversation on this once looking for precendence - i thought we decided to have the =1, but i don't remember what the api wg said | 05:05 |
| openstackgerrit | Merged openstack/keystone: Follow-on of memcache token persistence removal https://review.openstack.org/387730 | 05:05 |
| stevemar | surely stackoverflow has something on this :P | 05:06 |
| stevemar | http://stackoverflow.com/questions/4557387/is-a-url-query-parameter-valid-if-it-has-no-value | 05:07 |
| jamielennox | IMO i like the =1 | 05:07 |
| jamielennox | you can make both work | 05:07 |
| stevemar | jamielennox: i definitely think key-value makes more sense | 05:08 |
| stevemar | jamielennox: just a question of allow_expired=True or allow_expired=1 | 05:08 |
| jamielennox | stevemar: i just passed it into the oslo str_to_bool | 05:09 |
| stevemar | but theres an oslo utils forthat | 05:09 |
| stevemar | \o/ | 05:09 |
| jamielennox | it's been -1ed a few times | 05:09 |
| stevemar | what has? | 05:10 |
| jamielennox | dolphm: and others on the spec asking to have the =1 removed | 05:10 |
| *** raginbaj- has joined #openstack-keystone | 05:11 | |
| stevemar | in favor of no key? or true? | 05:11 |
| stevemar | also the spec is merged so meh | 05:12 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/388318 | 05:14 |
| jamielennox | stevemar: yea, but ayoung probably pulled the trigger on that one a bit fast | 05:14 |
| stevemar | meh impl. details | 05:16 |
| *** jaosorior has joined #openstack-keystone | 05:21 | |
| *** kiran-r has quit IRC | 05:22 | |
| *** adrian_otto1 has quit IRC | 05:32 | |
| *** qwertyco has joined #openstack-keystone | 05:34 | |
| r1chardj0n3s | hey, folks, I'm getting an SSO login failure and all that's logged is this: | 05:39 |
| r1chardj0n3s | 2016-10-19 05:38:15.481 32565 WARNING keystone.common.wsgi [req-3024ad07-3234-4160-b2b3-9fa6d3e9a502 - - - - -] An unexpected error prevented the server from fulfilling your request. | 05:39 |
| r1chardj0n3s | is there some way to get more detail than that? | 05:39 |
| *** richm has quit IRC | 05:41 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/388317 | 05:51 |
| *** GB21 has quit IRC | 05:52 | |
| *** guoshan has joined #openstack-keystone | 05:59 | |
| *** kiran-r has joined #openstack-keystone | 05:59 | |
| breton | r1chardj0n3s: maybe there is traceback in some other keystone log | 06:03 |
| breton | morning, keystone | 06:03 |
| *** guoshan has quit IRC | 06:03 | |
| *** GB21 has joined #openstack-keystone | 06:04 | |
| *** trananhkma has quit IRC | 06:07 | |
| *** code-R_ has quit IRC | 06:07 | |
| *** trananhkma has joined #openstack-keystone | 06:07 | |
| *** trananhkma has left #openstack-keystone | 06:07 | |
| *** trananhkma has joined #openstack-keystone | 06:08 | |
| *** rcernin has joined #openstack-keystone | 06:11 | |
| *** clayton has quit IRC | 06:12 | |
| *** markvoelker has joined #openstack-keystone | 06:14 | |
| *** markvoelker has quit IRC | 06:19 | |
| *** voelzmo has joined #openstack-keystone | 06:21 | |
| *** belmoreira has joined #openstack-keystone | 06:26 | |
| *** guoshan has joined #openstack-keystone | 06:27 | |
| *** kiran-r has quit IRC | 06:32 | |
| breton | oh those oslo releases | 06:32 |
| *** markvoelker has joined #openstack-keystone | 06:33 | |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Reorder APIs in api-ref for v3 groups https://review.openstack.org/374577 | 06:34 |
| *** markvoelker has quit IRC | 06:38 | |
| *** markvoelker has joined #openstack-keystone | 06:38 | |
| *** jaosorior has quit IRC | 06:47 | |
| *** voelzmo has quit IRC | 06:51 | |
| *** voelzmo has joined #openstack-keystone | 06:52 | |
| *** clayton has joined #openstack-keystone | 06:56 | |
| *** jaosorior has joined #openstack-keystone | 07:00 | |
| *** voelzmo has quit IRC | 07:06 | |
| *** tesseract has joined #openstack-keystone | 07:08 | |
| *** tesseract is now known as Guest90211 | 07:09 | |
| *** qwertyco has quit IRC | 07:11 | |
| *** ganeshk_ has joined #openstack-keystone | 07:14 | |
| *** voelzmo has joined #openstack-keystone | 07:14 | |
| *** oomichi has quit IRC | 07:16 | |
| ganeshk_ | Hi all, repeatedly I am getting this error "DEBUG:keystoneclient.session:RESP: DEBUG:keystoneclient.session:Request returned failure status: 500 ERROR: Internal Server Error (HTTP 500) (Request-ID: req-ff9e7f95-a364-48b5-b6ef-6ff9c676a935)" | 07:16 |
| *** oomichi has joined #openstack-keystone | 07:17 | |
| ganeshk_ | Can someone conform this error http://paste.openstack.org/show/586329/ about keystone or not? | 07:34 |
| *** trananhkma has quit IRC | 07:37 | |
| openstackgerrit | huyupeng proposed openstack/keystone: Use assertTrue instead of assertEqual(True, arg) https://review.openstack.org/388507 | 07:40 |
| *** clayton has quit IRC | 07:41 | |
| *** markvoelker has quit IRC | 07:41 | |
| *** haplo37_ has quit IRC | 07:42 | |
| *** haplo37_ has joined #openstack-keystone | 07:45 | |
| *** clayton has joined #openstack-keystone | 07:45 | |
| *** tqtran has joined #openstack-keystone | 07:49 | |
| openstackgerrit | huyupeng proposed openstack/keystone: Use assertTrue or assertFalse instead of assertEqual https://review.openstack.org/388507 | 07:52 |
| *** amoralej|off is now known as amoralej | 07:52 | |
| *** tqtran has quit IRC | 07:53 | |
| *** markvoelker has joined #openstack-keystone | 07:58 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:01 | |
| breton | ganeshk_: this is probably keystone error. You need to check your keystone log. | 08:03 |
| *** rcernin has quit IRC | 08:16 | |
| *** rcernin has joined #openstack-keystone | 08:16 | |
| *** rcernin has quit IRC | 08:18 | |
| *** rcernin has joined #openstack-keystone | 08:19 | |
| *** rcernin has quit IRC | 08:19 | |
| *** rcernin has joined #openstack-keystone | 08:19 | |
| *** jaosorior is now known as jaosorior_lunch | 08:20 | |
| *** oomichi has quit IRC | 08:23 | |
| openstackgerrit | NITIN GUPTA proposed openstack/keystone: added test cases for verifying the fix regarding bug #1614154 https://review.openstack.org/388541 | 08:25 |
| openstack | bug 1614154 in OpenStack Identity (keystone) "Hints with values of None seem to be broken" [Medium,Confirmed] https://launchpad.net/bugs/1614154 - Assigned to NITIN GUPTA (nitin-29-gupta) | 08:25 |
| *** oomichi has joined #openstack-keystone | 08:25 | |
| ganeshk_ | breton: can you understand this http://paste.openstack.org/show/586332/ | 08:30 |
| *** code-R has joined #openstack-keystone | 08:30 | |
| breton | ganeshk_: not relly. There should be keystone.log or a traceback in apache log | 08:32 |
| *** code-R_ has joined #openstack-keystone | 08:33 | |
| *** code-R has quit IRC | 08:36 | |
| *** andreykurilin has joined #openstack-keystone | 08:38 | |
| ganeshk_ | breton: Under apache2 logs, I can see only keystone-error.log and keystone-access.log | 08:40 |
| ganeshk_ | breton: I can see keystone.log under /var/log/keystone | 08:40 |
| ganeshk_ | breton: /var/log/keystone/keystone.log showing older logs | 08:41 |
| breton | ganeshk_: try keystone-error.log | 08:57 |
| *** jgrassle1 is now known as jgrassler | 08:57 | |
| ganeshk_ | breton: Ok | 08:58 |
| ganeshk_ | breton: keystone-error.log http://paste.openstack.org/show/586335/ | 09:02 |
| *** jaosorior_lunch is now known as jaosorior | 09:05 | |
| *** links has quit IRC | 09:09 | |
| *** asettle has joined #openstack-keystone | 09:22 | |
| breton | ganeshk_: is there anything with word "Traceback"? | 09:25 |
| *** pnavarro has joined #openstack-keystone | 09:25 | |
| *** alex_xu has quit IRC | 09:29 | |
| *** alex_xu has joined #openstack-keystone | 09:31 | |
| *** markvoelker has quit IRC | 09:36 | |
| ganeshk_ | breton: No | 09:38 |
| *** jaosorior has quit IRC | 09:43 | |
| *** jaosorior has joined #openstack-keystone | 09:43 | |
| openstackgerrit | NITIN GUPTA proposed openstack/keystone: added test cases for verifying the fix regarding bug #1614154 https://review.openstack.org/388541 | 09:43 |
| openstack | bug 1614154 in OpenStack Identity (keystone) "Hints with values of None seem to be broken" [Medium,Confirmed] https://launchpad.net/bugs/1614154 - Assigned to NITIN GUPTA (nitin-29-gupta) | 09:43 |
| *** jperry has joined #openstack-keystone | 09:49 | |
| *** TonyXu has quit IRC | 09:53 | |
| breton | ganeshk_: anythin with word ERROR or WARNING? | 10:01 |
| ganeshk_ | breton: No | 10:01 |
| ganeshk_ | breton: I have reboot the machine. Now, It looks fine for now | 10:01 |
| *** TonyXu has joined #openstack-keystone | 10:05 | |
| *** code-R_ has quit IRC | 10:06 | |
| *** richm has joined #openstack-keystone | 10:11 | |
| *** mvk has quit IRC | 10:14 | |
| *** guoshan has quit IRC | 10:20 | |
| *** code-R has joined #openstack-keystone | 10:20 | |
| *** hoangcx has quit IRC | 10:23 | |
| *** nicolasbock has joined #openstack-keystone | 10:27 | |
| *** code-R_ has joined #openstack-keystone | 10:29 | |
| *** code-R__ has joined #openstack-keystone | 10:31 | |
| *** code-R has quit IRC | 10:33 | |
| *** code-R_ has quit IRC | 10:34 | |
| *** guoshan has joined #openstack-keystone | 10:37 | |
| *** wangqun has quit IRC | 10:38 | |
| *** mvk has joined #openstack-keystone | 10:43 | |
| ganeshk_ | breton: Can you check this http://paste.openstack.org/show/586347/ | 10:53 |
| *** haplo37_ has quit IRC | 10:54 | |
| *** haplo37_ has joined #openstack-keystone | 10:56 | |
| *** voelzmo has quit IRC | 10:59 | |
| *** voelzmo_ has joined #openstack-keystone | 11:02 | |
| *** voelzmo_ has quit IRC | 11:05 | |
| openstackgerrit | pawnesh kumar proposed openstack/python-keystoneclient: Updated coverage configuration file https://review.openstack.org/388618 | 11:09 |
| *** edmondsw has joined #openstack-keystone | 11:10 | |
| *** robcresswell has quit IRC | 11:12 | |
| openstackgerrit | NITIN GUPTA proposed openstack/keystone: added test cases for verifying the fix regarding bug #1614154 https://review.openstack.org/388541 | 11:12 |
| openstack | bug 1614154 in OpenStack Identity (keystone) "Hints with values of None seem to be broken" [Medium,Confirmed] https://launchpad.net/bugs/1614154 - Assigned to NITIN GUPTA (nitin-29-gupta) | 11:12 |
| *** Zer0Byte__ has joined #openstack-keystone | 11:13 | |
| *** voelzmo has joined #openstack-keystone | 11:14 | |
| *** dave-mccowan has joined #openstack-keystone | 11:17 | |
| *** voelzmo has quit IRC | 11:19 | |
| *** Zer0Byte__ has quit IRC | 11:21 | |
| *** markvoelker has joined #openstack-keystone | 11:21 | |
| *** adrian_otto has joined #openstack-keystone | 11:26 | |
| openstackgerrit | pawnesh kumar proposed openstack/python-keystoneclient: Enable code coverage report in console output https://review.openstack.org/388625 | 11:26 |
| *** voelzmo has joined #openstack-keystone | 11:31 | |
| breton | ganeshk_: can't comment anything on this :) | 11:33 |
| *** adrian_otto has quit IRC | 11:42 | |
| stevemar | breton: ALL the releases! | 11:50 |
| *** tqtran has joined #openstack-keystone | 11:50 | |
| *** adrian_otto has joined #openstack-keystone | 11:51 | |
| *** tqtran has quit IRC | 11:55 | |
| *** adrian_otto has quit IRC | 11:57 | |
| *** belmorei_ has joined #openstack-keystone | 12:00 | |
| *** belmoreira has quit IRC | 12:01 | |
| openstackgerrit | NITIN GUPTA proposed openstack/keystone: added test cases for verifying the fix regarding bug #1614154 https://review.openstack.org/388541 | 12:03 |
| openstack | bug 1614154 in OpenStack Identity (keystone) "Hints with values of None seem to be broken" [Medium,Confirmed] https://launchpad.net/bugs/1614154 - Assigned to NITIN GUPTA (nitin-29-gupta) | 12:03 |
| *** maticue has joined #openstack-keystone | 12:11 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/oslo.policy: Remove wrong paramter type for class NotCheck https://review.openstack.org/388656 | 12:12 |
| *** raildo has joined #openstack-keystone | 12:16 | |
| *** lamt has joined #openstack-keystone | 12:20 | |
| *** links has joined #openstack-keystone | 12:20 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Tweak api-ref doc for v3 roles status codes https://review.openstack.org/367794 | 12:29 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Tweak api-ref doc for v3 roles https://review.openstack.org/376169 | 12:29 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Updated coverage configuration file https://review.openstack.org/388618 | 12:38 |
| *** mnaser has quit IRC | 12:40 | |
| *** bjolo_ has joined #openstack-keystone | 12:40 | |
| *** afazekas has quit IRC | 12:41 | |
| *** voelzmo has quit IRC | 12:41 | |
| *** afazekas has joined #openstack-keystone | 12:42 | |
| *** bjolo__ has quit IRC | 12:43 | |
| *** GB21 has quit IRC | 12:43 | |
| *** rakhmerov has quit IRC | 12:44 | |
| *** jaosorior has quit IRC | 12:44 | |
| *** mnaser has joined #openstack-keystone | 12:44 | |
| *** jaosorior has joined #openstack-keystone | 12:44 | |
| *** woodster_ has joined #openstack-keystone | 12:45 | |
| *** rakhmerov has joined #openstack-keystone | 12:45 | |
| *** voelzmo has joined #openstack-keystone | 12:45 | |
| *** amoralej is now known as amoralej|lunch | 12:52 | |
| *** gagehugo has joined #openstack-keystone | 12:53 | |
| *** belmorei_ has quit IRC | 12:53 | |
| *** jperry has quit IRC | 12:54 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/oslo.policy: Make exception PolicyNotAuthorized more readable https://review.openstack.org/388683 | 12:56 |
| *** belmoreira has joined #openstack-keystone | 12:57 | |
| *** links has quit IRC | 12:59 | |
| openstackgerrit | NITIN GUPTA proposed openstack/keystone: added test cases for verifying the fix regarding bug #1614154 https://review.openstack.org/388541 | 13:01 |
| openstack | bug 1614154 in OpenStack Identity (keystone) "Hints with values of None seem to be broken" [Medium,Confirmed] https://launchpad.net/bugs/1614154 - Assigned to NITIN GUPTA (nitin-29-gupta) | 13:01 |
| *** asettle has quit IRC | 13:12 | |
| *** asettle has joined #openstack-keystone | 13:13 | |
| *** jperry has joined #openstack-keystone | 13:14 | |
| openstackgerrit | Merged openstack/keystone: Reorder APIs in api-ref for v3 groups https://review.openstack.org/374577 | 13:14 |
| *** mugsie has joined #openstack-keystone | 13:17 | |
| *** jaosorior is now known as jaosorior_brb | 13:17 | |
| *** spzala has joined #openstack-keystone | 13:27 | |
| *** ganeshk_ has quit IRC | 13:30 | |
| *** sfilatov has joined #openstack-keystone | 13:36 | |
| *** mvk has quit IRC | 13:50 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Domain included for role in list_role_assignment https://review.openstack.org/373516 | 13:51 |
| *** agrebennikov has joined #openstack-keystone | 13:52 | |
| *** mvk has joined #openstack-keystone | 13:53 | |
| *** amoralej|lunch is now known as amoralej | 13:57 | |
| *** belmoreira has quit IRC | 13:59 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/388317 | 14:00 |
| *** belmoreira has joined #openstack-keystone | 14:05 | |
| *** gagehugo_ has joined #openstack-keystone | 14:07 | |
| *** gagehugo has quit IRC | 14:08 | |
| *** belmoreira has quit IRC | 14:13 | |
| *** ayoung has quit IRC | 14:15 | |
| *** knikolla has joined #openstack-keystone | 14:15 | |
| *** edtubill has joined #openstack-keystone | 14:16 | |
| *** edtubill has joined #openstack-keystone | 14:17 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add release note for fernet tokens https://review.openstack.org/376526 | 14:24 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 14:24 |
| lbragstad | rderose thanks for the reviews! ^ | 14:24 |
| *** jaosorior_brb is now known as jaosorior | 14:25 | |
| *** jistr is now known as jistr|call | 14:28 | |
| *** chris_hultin|AWA is now known as chris_hultin | 14:29 | |
| *** sfilatov has quit IRC | 14:30 | |
| *** markvoelker has quit IRC | 14:33 | |
| rderose | lbragstad: you bet! thanks for the patches. noticed you've updated. I'll take another look this morning. | 14:41 |
| lbragstad | rderose thanks! | 14:42 |
| *** voelzmo has quit IRC | 14:42 | |
| *** sfilatov has joined #openstack-keystone | 14:44 | |
| *** guoshan has quit IRC | 14:44 | |
| *** code-R__ has quit IRC | 14:45 | |
| *** voelzmo has joined #openstack-keystone | 14:45 | |
| *** code-R has joined #openstack-keystone | 14:45 | |
| *** sfilatov has quit IRC | 14:46 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 14:50 |
| *** sfilatov has joined #openstack-keystone | 14:50 | |
| *** jaosorior has quit IRC | 14:50 | |
| *** pnavarro has quit IRC | 14:53 | |
| *** ravelar has joined #openstack-keystone | 14:54 | |
| *** phalmos has joined #openstack-keystone | 15:04 | |
| *** simondodsley has joined #openstack-keystone | 15:07 | |
| *** jistr|call is now known as jistr | 15:12 | |
| *** Guest90211 has quit IRC | 15:13 | |
| *** itisha has joined #openstack-keystone | 15:13 | |
| *** jaugustine has joined #openstack-keystone | 15:14 | |
| *** pcaruana has quit IRC | 15:14 | |
| *** ayoung has joined #openstack-keystone | 15:15 | |
| *** ChanServ sets mode: +v ayoung | 15:15 | |
| *** rcernin has quit IRC | 15:16 | |
| *** spilla has joined #openstack-keystone | 15:17 | |
| *** nk2527 has joined #openstack-keystone | 15:20 | |
| openstackgerrit | melissaml proposed openstack/keystoneauth: TrivialFix: Remove default=None when set value in Config https://review.openstack.org/388762 | 15:25 |
| *** hoonetorg has quit IRC | 15:29 | |
| openstackgerrit | Merged openstack/keystone: Tweak api-ref doc for v3 roles status codes https://review.openstack.org/367794 | 15:35 |
| openstackgerrit | Merged openstack/keystone: Tweak api-ref doc for v3 roles https://review.openstack.org/376169 | 15:35 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/388317 | 15:36 |
| *** jistr is now known as jistr|biab | 15:39 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove issue_v2_token https://review.openstack.org/386762 | 15:42 |
| *** links has joined #openstack-keystone | 15:46 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: refactor the token controller https://review.openstack.org/386726 | 15:47 |
| *** tqtran has joined #openstack-keystone | 15:51 | |
| *** phalmos has quit IRC | 15:56 | |
| *** tqtran has quit IRC | 15:56 | |
| breton | http://lists.openstack.org/pipermail/openstack-dev/2016-October/106083.html might be interesting. It has not [keystone], so it might be not in your inbox. | 15:59 |
| *** code-R has quit IRC | 16:03 | |
| dstanek | breton: briancurtin: that seems unfortunate. why do we have to parse the URL anyway. should the response to that URL have the desired info? | 16:04 |
| *** code-R has joined #openstack-keystone | 16:05 | |
| *** jistr|biab is now known as jistr | 16:05 | |
| *** ayoung has quit IRC | 16:06 | |
| *** voelzmo has quit IRC | 16:08 | |
| briancurtin | dstanek: this started with identity only having v2 in (at least) the devstack service catalog, so there was once a suggestion to go above it to the root to figure out all the versions it offers (since we needed to be able to provide v3 endpoints even if you auth to v2). i can’t remember what other services had multi-versions installed but only one listed, | 16:12 |
| briancurtin | but that’s also come up | 16:12 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: refactor the token controller https://review.openstack.org/386726 | 16:12 |
| dstanek | briancurtin: keystone not having a link to root in the /v2.0 or /v3 is dump and broken | 16:16 |
| dstanek | if you need to do URL parsing then we've failed as an API | 16:16 |
| dstanek | (the exception *maybe* is uri templates and that's not what this is:) | 16:16 |
| briancurtin | dstanek: i’ll go back through the services i can and see if any of them offer root in their version-specific responses. i’d love to have solved it this way from the start but that doesn’t sound familiar, or at least widespread enough to have tried it | 16:18 |
| briancurtin | though maybe i was just looking at said documentation for those responses, which is usually wrong/incomplete | 16:18 |
| briancurtin | dstanek: yeah i just tried again going to what comes back in the SC (versioned endpoints) and identity and compute just give me details about themselves, with no reference to the root or anything else. most documentation shows that if you call /vX it’ll give you that version’s details, and if you go to / it’ll give you all, but no one seems to give me | 16:26 |
| briancurtin | root directly | 16:26 |
| *** sfilatov has quit IRC | 16:29 | |
| *** links has quit IRC | 16:31 | |
| *** Zer0Byte__ has joined #openstack-keystone | 16:39 | |
| dstanek | briancurtin: yeah, that's super short sighted | 16:46 |
| *** nk2527 has quit IRC | 16:47 | |
| briancurtin | dstanek: i don’t love what we have right now, but it’s at least serviceable until something better comes along, though the latter situation in that email still seems impossible | 16:48 |
| dstanek | briancurtin: the nested services thing? | 16:49 |
| briancurtin | yep | 16:49 |
| dstanek | that services provided a link to their root then that would solve that for you right? | 16:49 |
| briancurtin | dstanek: yep, if everyone told me where root was, probably all of this path manipulation and guesswork and potential extra GET calls could be removed | 16:50 |
| *** pcaruana has joined #openstack-keystone | 16:51 | |
| *** Guest41366 is now known as redrobot | 16:56 | |
| *** mugsie has quit IRC | 16:56 | |
| *** mugsie has joined #openstack-keystone | 16:58 | |
| *** spzala has quit IRC | 17:02 | |
| *** spzala has joined #openstack-keystone | 17:02 | |
| *** amoralej is now known as amoralej|off | 17:04 | |
| *** dikonoor has quit IRC | 17:05 | |
| jlk | stevemar: hey, I know you've been paying a lot of attention to openstack client lately. Have you seen a bug where it is reading config from a clouds.yaml file, and is trying to figure out an API version, by doing a "startswith" action on it, but the value from the config is a int rather than a string, causing a traceback? | 17:06 |
| *** spzala has quit IRC | 17:07 | |
| *** tqtran has joined #openstack-keystone | 17:09 | |
| *** edtubill has quit IRC | 17:18 | |
| *** simondodsley has quit IRC | 17:24 | |
| *** spzala has joined #openstack-keystone | 17:29 | |
| stevemar | jlk: hmmm, haven't seen that bug, but it sounds entirely possible | 17:31 |
| *** mvk has quit IRC | 17:31 | |
| jlk | alright. I'll file it. | 17:31 |
| stevemar | jlk: its probably os-client-config related -- https://github.com/openstack/os-client-config/blob/master/os_client_config/cloud_config.py looks like it always assumes the version is a string | 17:33 |
| stevemar | mordred: ^ | 17:33 |
| jlk | oh maybe that's where it goes, yes | 17:33 |
| jlk | that's in the traceback | 17:33 |
| jlk | well sort of | 17:33 |
| jlk | osc_lib/cli/client_config.py | 17:34 |
| *** code-R has quit IRC | 17:34 | |
| stevemar | jlk: back when we handled this all in OSC proper, we stringified all the values coming from environment vars | 17:34 |
| stevemar | ah osc-lib client_config is a super class of occ client config, should be fixed in occ i think | 17:34 |
| stevemar | jlk: either way, report the bug | 17:34 |
| stevemar | jlk: i imagine that wrapping the version in quotes fixes the problem, yeah? | 17:35 |
| jlk | https://github.com/openstack/osc-lib/blob/master/osc_lib/cli/client_config.py#L85 | 17:35 |
| jlk | Yea, I "fixed" it in the yaml by making it a string | 17:35 |
| jlk | because pyyaml "helpfully" translates things in yaml to matching python objects. | 17:35 |
| stevemar | jlk: :) | 17:36 |
| mordred | jlk, stevemar: the intent inside of occ is to strigify stuff - this seems missed | 17:36 |
| stevemar | jlk: hehe, dammit pyyaml! | 17:36 |
| mordred | I know we had a "stringify a bunch of things" patch a while back | 17:36 |
| stevemar | mordred: this is actually osc-lib only | 17:36 |
| jlk | stevemar: I discovered that fun one because it translates what it thinks is a time stamp into a datetime object, but it does it poorly, so it loses the timezone info when it does it | 17:36 |
| jlk | proper timestamp as string -> timestamp object without zone data -> back out to invalid time string :( | 17:37 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: refactor the token controller https://review.openstack.org/386726 | 17:37 |
| jlk | maybe I'll just send up a patch for osc-lib | 17:37 |
| mordred | stevemar: oh - it is? | 17:37 |
| jlk | because it looks pretty easy to stringify it here | 17:37 |
| jlk | unless | 17:37 |
| jlk | no it's here. | 17:38 |
| stevemar | mordred: yeah, the offending line is: https://github.com/openstack/osc-lib/blob/master/osc_lib/cli/client_config.py#L85 | 17:38 |
| stevemar | just add str() around config.get('identity_api_version', '') i think | 17:38 |
| mordred | stevemar: config.get('auth_type', None).endswith('password')): that's going to break too | 17:38 |
| mordred | stevemar: if there is no value | 17:38 |
| mordred | that said - occ should never have an empty value in auth_type ... | 17:39 |
| stevemar | mordred: oh you're assuming a password where it's just numbers? | 17:39 |
| stevemar | oh wait, auth type! | 17:39 |
| mordred | stevemar: no - I'm saying if the fallthrough of the get happens | 17:39 |
| mordred | stevemar: the endswith will be unhappy | 17:39 |
| *** sfilatov has joined #openstack-keystone | 17:39 | |
| stevemar | ah | 17:39 |
| mordred | but I think you can take out the , None - because the default value of auth_type from occ is "password" | 17:39 |
| stevemar | separate bug, but yeah | 17:39 |
| mordred | yah | 17:39 |
| stevemar | yeah | 17:39 |
| stevemar | should just get nixed | 17:39 |
| stevemar | eh, i'll fix it now | 17:40 |
| jlk | Bug filed, patch incoming | 17:41 |
| jlk | https://bugs.launchpad.net/python-openstackclient/+bug/1634986 | 17:41 |
| openstack | Launchpad bug 1634986 in python-openstackclient "osc_lib attempts string actions on int objects when determining auth API version" [Undecided,New] | 17:41 |
| *** spzala has quit IRC | 17:42 | |
| jlk | stevemar: I'll fix that endswith('password') bit too in my patch | 17:42 |
| jlk | (otherwise we'll have conflicts) | 17:44 |
| stevemar | jlk: sounds bueno to me | 17:46 |
| stevemar | jlk: i have a test you can add | 17:50 |
| jlk | just added two | 17:50 |
| jlk | well, I added two for testing with int versions | 17:50 |
| jlk | Do you have one for testing the password None thing? | 17:50 |
| stevemar | jlk: http://paste.openstack.org/show/586448/ | 17:51 |
| stevemar | jlk: nah, that ones a bit funky to test | 17:51 |
| jlk | okay my tests are slightly different | 17:52 |
| jlk | https://review.openstack.org/388832 | 17:53 |
| *** spzala has joined #openstack-keystone | 17:54 | |
| *** spzala has quit IRC | 17:59 | |
| *** mvk has joined #openstack-keystone | 18:02 | |
| stevemar | jlk: how you got omgjlk as your email address is anyone's guess :P | 18:04 |
| jlk | stevemar: haha, there was a guy at Blue Box who was stationed for a week to help with on-boarding. He had 0 effs to give, so he'd make any change like that if our manager approved it. | 18:05 |
| jlk | Our manager also had 0 effs to give. | 18:05 |
| stevemar | jlk: had a comment on the patch, i think the placement of the bracket is off? | 18:08 |
| jlk | oh let me look again | 18:09 |
| jlk | yeah I see it | 18:09 |
| jlk | patch set 2 uploaded. | 18:10 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: WIP validate consumer_id exists directly https://review.openstack.org/388842 | 18:16 |
| stevemar | jlk: looks like we have to link up osc-lib patches to close python-openstackclient bugs in launchpad, womp womp (cc dtroyer) | 18:18 |
| *** itisha has quit IRC | 18:19 | |
| stevemar | gagehugo_: you gonna toss up another patch for https://review.openstack.org/#/c/361435/ ? | 18:21 |
| stevemar | gagehugo_: i want to push that one through while dstanek and i are around, it's gone through enough bikeshedding ;P | 18:22 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Doctor check for LDAP domain specific configs https://review.openstack.org/361435 | 18:25 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Doctor check for LDAP domain specific configs https://review.openstack.org/361435 | 18:26 |
| stevemar | dstanek: ^ | 18:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add release note for fernet tokens https://review.openstack.org/376526 | 18:28 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 18:28 |
| *** sfilatov has quit IRC | 18:30 | |
| *** sfilatov has joined #openstack-keystone | 18:31 | |
| *** phalmos has joined #openstack-keystone | 18:32 | |
| jlk | stevemar: re keystone live upgrade, my first attempt has a failure. "Credential migration in progress. Cannot perform writes to credential table." | 18:33 |
| *** voelzmo has joined #openstack-keystone | 18:33 | |
| jlk | this was doing the db_sync --expand while the old code (mitaka) was running | 18:33 |
| rderose | lbragstad: ^ | 18:34 |
| lbragstad | jlk what steps did you take? | 18:35 |
| *** sfilatov has quit IRC | 18:35 | |
| jlk | old keystone is running, config files updated to newton level, and new code on the machine for newton | 18:35 |
| jlk | (code is in a venv) | 18:35 |
| lbragstad | ok | 18:36 |
| *** phalmos_ has joined #openstack-keystone | 18:36 | |
| jlk | just doing new keystone-manage db_sync --expand | 18:36 |
| jlk | and... now | 18:36 |
| jlk | lovely | 18:36 |
| jlk | [SQL: u'\nALTER TABLE credential ADD key_hash VARCHAR(64)'] | 18:36 |
| jlk | (trying --expand again) | 18:36 |
| jlk | oh crap | 18:37 |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Document OS-SIMPLE-CERT Routes https://review.openstack.org/385028 | 18:37 |
| lbragstad | so the expand step should add the new columns to the credential table and put triggers in place | 18:37 |
| jlk | so --expand failed, but the automation tried --migrate after that | 18:37 |
| jlk | which completed | 18:37 |
| lbragstad | ?! | 18:37 |
| lbragstad | jlk do you have any credentials in your backend? | 18:38 |
| lbragstad | or do you use the credentail backend at all? | 18:38 |
| jlk | I think there's a bug in the automation. It's doing these actions in a loop, and it's not stopping the loop if one of the items failed. | 18:38 |
| jlk | lbragstad: I think it's on, but there shouldn't be any credentials there. This is a test cloud I just built on mitaka | 18:39 |
| lbragstad | jlk what's doing the automation? | 18:39 |
| *** phalmos has quit IRC | 18:39 | |
| jlk | I can dig in the db | 18:39 |
| jlk | lbragstad: it's Ansible. | 18:39 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: WIP validate consumer_id exists directly https://review.openstack.org/388842 | 18:39 |
| jlk | I can easily work around this by making these distinct tasks instead of one task with a loop | 18:39 |
| rderose | lbragstad jlk: "Credential migration in progress. Cannot perform writes to credential table." is expected, right? | 18:39 |
| lbragstad | essentially - yes | 18:39 |
| lbragstad | after doing the --expand | 18:39 |
| lbragstad | if anything tries to write to the credential table outside of the --migrate process that error will be thrown | 18:40 |
| jlk | hrm | 18:40 |
| rderose | jlk: so you shouldn't run expand twice :) | 18:40 |
| jlk | well, sure | 18:40 |
| jlk | that's a bit of a problem with idempotency | 18:41 |
| lbragstad | jlk I tested this migration here - https://gist.github.com/lbragstad/ddfb10f9f9048414d1f781ba006e95d1#upgrade | 18:41 |
| jlk | like, the --expand should notice "I've already done this" | 18:41 |
| *** edtubill has joined #openstack-keystone | 18:41 | |
| rderose | jlk: I'm not sure if it does... | 18:41 |
| lbragstad | rderose jlk wouldn't that be up to sqlalchemy to recognize the db version? | 18:41 |
| lbragstad | er - migrate_version? | 18:42 |
| jlk | ¯\_(ツ)_/¯ | 18:42 |
| rderose | lbragstad: oh, right | 18:42 |
| rderose | it should | 18:42 |
| lbragstad | dstanek or dolphm might have a better answer than I though | 18:42 |
| dolphm | ooh, rolliing upgrades... | 18:43 |
| lbragstad | dolphm yep | 18:43 |
| rderose | SELECT * FROM keystone.migrate_version; | 18:43 |
| lbragstad | dolphm jlk has an interesting scenario | 18:43 |
| dolphm | jlk: you should be able to run --expand repeatedly | 18:44 |
| dolphm | jlk: there should be no reason to do so, but you can | 18:44 |
| jlk | Yeah, i think my problem si that after --expand failed, it went ahead and did --migrate | 18:44 |
| rderose | jlk: did it really fail though? | 18:45 |
| jlk | dolphm: Repeated upgrade automation runs, if it fails somewhere else. | 18:45 |
| dolphm | jlk: but you're getting that error message from keystone-manage --expand itself? | 18:45 |
| rderose | or, did it just log the error | 18:45 |
| jlk | rderose: it returned non-zero | 18:45 |
| dolphm | keystone-manage db_sync --expand * | 18:45 |
| jlk | her'es the error from --expand | 18:45 |
| gagehugo_ | stevermar: sounds good | 18:47 |
| *** gagehugo_ has quit IRC | 18:47 | |
| stevemar | gagehugo_: i submitted a new version :P | 18:47 |
| *** gagehugo has joined #openstack-keystone | 18:47 | |
| jlk | dolphm: http://paste.openstack.org/show/586463/ | 18:50 |
| lbragstad | huh - looks like it's failing to create the trigger | 18:51 |
| stevemar | lbragstad: gah | 18:51 |
| jlk | oh wait I think I misread the error | 18:51 |
| jlk | "'You do not have the SUPER privilege and binary logging is enabled (you *might* want to use the less safe log_bin_trust_function_creators variable)'" looks like the relevant bit | 18:52 |
| stevemar | it failed because we wrote to log?! | 18:52 |
| dolphm | jlk: is that an unrelated error, or the one you're asking about? | 18:52 |
| jlk | dolphm: well, this seemingly killed the --expand call | 18:53 |
| jlk | so it's the one I'm asking about | 18:53 |
| dolphm | stevemar: binary logging is the sql server's statement history | 18:53 |
| dolphm | jlk: it looks like your SQL user does not have the appropriate grant to create triggers | 18:54 |
| dolphm | stevemar: i.e. http://dev.mysql.com/doc/refman/5.7/en/binary-log.html | 18:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove issue_v2_token https://review.openstack.org/386762 | 18:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove issue_v2_token https://review.openstack.org/386762 | 18:58 |
| jlk | That'd be the user that's defined in keystone.conf, right? | 19:01 |
| *** phalmos_ has quit IRC | 19:01 | |
| lbragstad | jlk yep - the one defined in the sql connection string | 19:01 |
| jlk | remind me again how I'd show the grants? | 19:01 |
| jlk | | GRANT ALL PRIVILEGES ON `keystone`.* TO 'keystone'@'%' | 19:02 |
| dolphm | jlk: SHOW GRANTS | 19:03 |
| dolphm | jlk: GRANT ALL would probably "fix" the issue though. i imagine you have the minimal grants setup that keystone normally needs | 19:03 |
| jlk | I just pasted the grant | 19:04 |
| *** asettle has quit IRC | 19:04 | |
| dolphm | jlk: ah, i should have suspected from the leading pipe :P | 19:05 |
| dolphm | jlk: what is your sql server, exactly? | 19:06 |
| jlk | it's a percona xtradb cluster | 19:06 |
| jlk | 5.6.32-25.17-1.trusty | 19:07 |
| *** markvoelker has joined #openstack-keystone | 19:08 | |
| *** charz has quit IRC | 19:08 | |
| *** hugokuo has quit IRC | 19:09 | |
| dolphm | jlk: this is the pertinent doc ... http://dev.mysql.com/doc/refman/5.7/en/stored-programs-logging.html | 19:09 |
| *** phalmos has joined #openstack-keystone | 19:10 | |
| dolphm | jlk: We need to enable the variable log_bin_trust_function_creators. Enabling it is like saying to the server: “I trust regular users’ triggers and functions, and that they won’t cause problems, so allow my users to create them.” - https://www.percona.com/blog/2016/07/01/pt-online-schema-change-amazon-rds/ | 19:11 |
| dolphm | (that whole bit is a quote) | 19:11 |
| jlk | so what you're saying is that I can fix this with a change to my sql server config | 19:11 |
| *** charz has joined #openstack-keystone | 19:12 | |
| dolphm | jlk: SET GLOBAL log_bin_trust_function_creators = 1; # from that second link | 19:12 |
| *** hugokuo has joined #openstack-keystone | 19:12 | |
| jlk | alright, I'm in a meeting now, but when that's over I'll rebuild from snapshot and try that. | 19:13 |
| dolphm | jlk: you probably need to run it against each node in your cluster | 19:13 |
| jlk | yeah, Ansible takes care of that for me :D | 19:13 |
| *** timburke has quit IRC | 19:14 | |
| dolphm | jlk: i assume you're going to be in barcelona? | 19:15 |
| jlk | I am | 19:16 |
| jlk | I'm attempting to get this sorted out so I have feedback to talk about at barcelona | 19:16 |
| jlk | both keystone and nova I'm attempting "live" upgrades for Mitaka -> Newton | 19:16 |
| *** charz has quit IRC | 19:17 | |
| dolphm | jlk: awesome | 19:18 |
| dolphm | lbragstad: it'd probably be worth documenting for developers that triggers need to be deterministic in order to be applied correctly in a cluster | 19:21 |
| dolphm | lbragstad: so even if we could implement fernet in a trigger somehow for credential encryption... fernet is non-deterministic and would break replication | 19:22 |
| *** timburke has joined #openstack-keystone | 19:22 | |
| *** charz has joined #openstack-keystone | 19:23 | |
| *** nk2527 has joined #openstack-keystone | 19:27 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds warning when no domain configs were uploaded https://review.openstack.org/214287 | 19:40 |
| lbragstad | dolphm ah - got it.. i think that makes sense | 19:44 |
| lbragstad | dolphm what do you mean by non-deterministic? | 19:45 |
| *** ayoung has joined #openstack-keystone | 19:48 | |
| *** ChanServ sets mode: +v ayoung | 19:48 | |
| *** pcaruana has quit IRC | 19:50 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: [doc] remove auth plugin docs https://review.openstack.org/388882 | 19:54 |
| *** kiran-r has joined #openstack-keystone | 19:57 | |
| *** pnavarro has joined #openstack-keystone | 19:58 | |
| stevemar | dolphm: dstanek easy one ^ | 19:58 |
| *** edtubill has quit IRC | 20:01 | |
| dstanek | stevemar: nothing is ever easy it seems :-) | 20:03 |
| dstanek | straight up removal! love it | 20:04 |
| openstackgerrit | Gage Hugo proposed openstack/keystone-specs: PCI-DSS Expired Password Users https://review.openstack.org/383832 | 20:04 |
| *** lamt has quit IRC | 20:06 | |
| *** erhudy has joined #openstack-keystone | 20:07 | |
| *** gagehugo_ has joined #openstack-keystone | 20:07 | |
| *** gagehugo_ has quit IRC | 20:07 | |
| *** gagehugo has quit IRC | 20:07 | |
| *** gagehugo has joined #openstack-keystone | 20:07 | |
| openstackgerrit | Jeffrey Augustine proposed openstack/keystone-specs: Add keystone project metadata https://review.openstack.org/388886 | 20:08 |
| stevemar | i have SO MANY TABS OPEN! | 20:11 |
| stevemar | so much to review | 20:11 |
| gagehugo | lol | 20:12 |
| stevemar | you people are developing code too fast! | 20:12 |
| *** ravelar has quit IRC | 20:14 | |
| stevemar | i have a laughable amount of keystone reviews | 20:15 |
| openstackgerrit | Gage Hugo proposed openstack/keystone-specs: PCI-DSS Expired Password Users https://review.openstack.org/383832 | 20:15 |
| jaugustine | <3 | 20:15 |
| lbragstad | do the needful stevemar, do the needful | 20:16 |
| *** hoonetorg has joined #openstack-keystone | 20:19 | |
| *** phalmos has quit IRC | 20:22 | |
| *** gagehugo has quit IRC | 20:24 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove issue_v2_token https://review.openstack.org/386762 | 20:34 |
| *** ravelar has joined #openstack-keystone | 20:34 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Document OS-SIMPLE-CERT Routes https://review.openstack.org/385028 | 20:35 |
| *** spilla has quit IRC | 20:36 | |
| *** ravelar has quit IRC | 20:39 | |
| *** voelzmo has quit IRC | 20:40 | |
| *** nicolasbock has quit IRC | 20:44 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove issue_v2_token https://review.openstack.org/386762 | 20:45 |
| *** jperry has quit IRC | 20:46 | |
| *** asettle has joined #openstack-keystone | 20:56 | |
| *** asettle has quit IRC | 20:57 | |
| *** markvoelker_ has joined #openstack-keystone | 20:57 | |
| *** markvoelker has quit IRC | 21:00 | |
| *** maticue has quit IRC | 21:01 | |
| *** spilla has joined #openstack-keystone | 21:01 | |
| *** phalmos has joined #openstack-keystone | 21:02 | |
| *** code-R has joined #openstack-keystone | 21:09 | |
| *** lamt has joined #openstack-keystone | 21:11 | |
| *** gagehugo has joined #openstack-keystone | 21:11 | |
| openstackgerrit | Tin Lam proposed openstack/keystone-specs: PCI-DSS Expired Password Users https://review.openstack.org/383832 | 21:11 |
| *** r-daneel has joined #openstack-keystone | 21:11 | |
| jlk | Attempt #2 coming up | 21:14 |
| *** code-R_ has joined #openstack-keystone | 21:16 | |
| *** agrebennikov has quit IRC | 21:16 | |
| *** phalmos has quit IRC | 21:16 | |
| *** jaugustine has quit IRC | 21:16 | |
| *** sfilatov has joined #openstack-keystone | 21:18 | |
| *** code-R has quit IRC | 21:18 | |
| *** pnavarro has quit IRC | 21:23 | |
| stevemar | jlk: good luck | 21:23 |
| breton | btw nice stuff regarding metadata | 21:26 |
| *** chris_hultin is now known as chris_hultin|AWA | 21:30 | |
| *** spilla has quit IRC | 21:31 | |
| jlk | stevemar: MUCH SUCCESS | 21:32 |
| stevemar | jlk: \o/ | 21:32 |
| jlk | dolphm: thanks for the tip, that seems to have solved it | 21:32 |
| stevemar | we should doc that tip in our docs | 21:32 |
| stevemar | hint hint jlk :P | 21:33 |
| jlk | yeah | 21:33 |
| jlk | uh.. | 21:33 |
| jlk | totes. | 21:33 |
| stevemar | :P | 21:33 |
| stevemar | i'll submit a patch if you dont | 21:33 |
| jlk | Nova is attempting live upgrade now, so I'm a tad distracted :D | 21:33 |
| stevemar | SET GLOBAL log_bin_trust_function_creators = 1; # | 21:33 |
| stevemar | thats the change right? | 21:34 |
| jlk | I ended up setting that in a config file, but yes. | 21:34 |
| stevemar | yah | 21:34 |
| jlk | I think it has to be ran on all members of a cluster | 21:34 |
| stevemar | jlk: did you try using keystone while it was upgrading? | 21:34 |
| jlk | I did not | 21:34 |
| jlk | I should have | 21:34 |
| jlk | that'll come later | 21:35 |
| stevemar | hehe yeah :P | 21:35 |
| jlk | I was going to set up a continuous rally or something to test uptime during upgrade | 21:36 |
| jlk | first part of nova went good. Restarted control services to new code, computes on old code, db migrated. Can still build a server! | 21:37 |
| breton | > For example, if you work on Keystone and decide that "safe" and "smart" are its two key attributes, a German Shepherd dog might be a great animal to express those characteristics | 21:47 |
| breton | btw was our mascot done? | 21:48 |
| *** code-R_ has quit IRC | 21:50 | |
| *** code-R has joined #openstack-keystone | 21:50 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove issue_v3_token in favor of issue_token https://review.openstack.org/386837 | 21:51 |
| lbragstad | breton ++ | 21:51 |
| lbragstad | breton for some reason I think the turtle was our mascot | 21:51 |
| lbragstad | breton but I would have been in favor of a german shepherd had it been an option :) | 21:52 |
| *** code-R has quit IRC | 21:53 | |
| *** lamt has quit IRC | 22:01 | |
| *** sfilatov has quit IRC | 22:08 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Allow fetching an expired token https://review.openstack.org/382098 | 22:15 |
| jamielennox | someone want to push https://review.openstack.org/#/c/387733/ and https://review.openstack.org/#/c/387734/ into ksa - stevemar already has a +2 on them | 22:17 |
| *** phalmos has joined #openstack-keystone | 22:22 | |
| *** harlowja has quit IRC | 22:33 | |
| *** agrebennikov has joined #openstack-keystone | 22:33 | |
| *** harlowja has joined #openstack-keystone | 22:48 | |
| *** phalmos has quit IRC | 22:50 | |
| stevemar | breton: waiting for the foundation to send me a draft version | 22:53 |
| stevemar | breton: where's that from? the bit about the german sheppard? | 22:53 |
| *** gyee has joined #openstack-keystone | 22:57 | |
| *** ChanServ sets mode: +v gyee | 22:57 | |
| *** Zer0Byte__ has quit IRC | 23:05 | |
| *** agrebennikov_ has joined #openstack-keystone | 23:06 | |
| *** phalmos has joined #openstack-keystone | 23:13 | |
| *** erhudy has quit IRC | 23:21 | |
| jlk | Good news! --expand, --migrate, --contract appear to be idempotent. | 23:23 |
| *** scarlisle has joined #openstack-keystone | 23:49 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Doctor check for LDAP domain specific configs https://review.openstack.org/361435 | 23:49 |
| *** spzala has joined #openstack-keystone | 23:51 | |
| *** agrebennikov_ has quit IRC | 23:51 | |
| *** kiran-r has quit IRC | 23:54 | |
| *** LiYuenan has quit IRC | 23:54 | |
| *** spzala has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!