| *** erlon has quit IRC | 00:00 | |
| *** tqtran has quit IRC | 00:04 | |
| *** lucas_ has quit IRC | 00:05 | |
| *** phalmos has quit IRC | 00:07 | |
| *** phalmos has joined #openstack-keystone | 00:12 | |
| *** jaosorior has quit IRC | 00:27 | |
| *** agrebennikov__ has quit IRC | 00:29 | |
| *** thorst_ has joined #openstack-keystone | 00:41 | |
| *** openstackgerrit has quit IRC | 01:02 | |
| *** thorst_ has quit IRC | 01:05 | |
| *** dave-mccowan has quit IRC | 01:05 | |
| *** thorst_ has joined #openstack-keystone | 01:06 | |
| *** thorst_ has quit IRC | 01:10 | |
| *** martinlopes has quit IRC | 01:15 | |
| *** adrian_otto has quit IRC | 01:16 | |
| *** thorst_ has joined #openstack-keystone | 01:16 | |
| *** martinlopes has joined #openstack-keystone | 01:21 | |
| *** gyee has quit IRC | 01:22 | |
| *** thorst_ has quit IRC | 01:25 | |
| *** thorst_ has joined #openstack-keystone | 01:33 | |
| *** jose-phillips has quit IRC | 01:44 | |
| *** thorst_ has joined #openstack-keystone | 01:53 | |
| *** thorst_ has quit IRC | 01:57 | |
| *** thorst_ has joined #openstack-keystone | 02:29 | |
| *** thorst_ has joined #openstack-keystone | 02:52 | |
| *** openstackgerrit has joined #openstack-keystone | 03:10 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: WIP Fix multiple uuid warnings with pycadf https://review.openstack.org/426411 | 03:10 |
|---|---|---|
| *** thorst_ has joined #openstack-keystone | 03:13 | |
| *** thorst_ has quit IRC | 03:20 | |
| *** thorst_ has joined #openstack-keystone | 03:55 | |
| *** thorst_ has quit IRC | 03:55 | |
| *** nicolasbock has quit IRC | 04:01 | |
| *** lucas_ has joined #openstack-keystone | 04:02 | |
| *** lucas_ has quit IRC | 04:06 | |
| *** lucas_ has joined #openstack-keystone | 04:09 | |
| *** lucas_ has quit IRC | 04:09 | |
| *** stingaci has quit IRC | 04:09 | |
| *** dikonoor has joined #openstack-keystone | 04:27 | |
| *** thorst_ has joined #openstack-keystone | 05:33 | |
| *** thorst_ has quit IRC | 05:38 | |
| *** phalmos has quit IRC | 05:40 | |
| *** martinlopes has quit IRC | 06:07 | |
| *** markvoelker has joined #openstack-keystone | 06:10 | |
| *** markvoelker_ has quit IRC | 06:12 | |
| *** mnaser has quit IRC | 06:12 | |
| *** arunkant has quit IRC | 06:13 | |
| *** arunkant has joined #openstack-keystone | 06:13 | |
| *** adriant has quit IRC | 06:22 | |
| *** mnaser has joined #openstack-keystone | 06:28 | |
| *** clayton has quit IRC | 06:46 | |
| *** ravelar has quit IRC | 06:58 | |
| *** thorst_ has joined #openstack-keystone | 07:00 | |
| *** rcernin has joined #openstack-keystone | 07:06 | |
| *** thorst_ has quit IRC | 07:06 | |
| *** tesseract has joined #openstack-keystone | 07:16 | |
| *** richm has joined #openstack-keystone | 07:20 | |
| *** pcaruana has joined #openstack-keystone | 07:39 | |
| *** pcaruana has quit IRC | 07:42 | |
| *** pcaruana has joined #openstack-keystone | 07:43 | |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone master: Prepare for using standard python tests https://review.openstack.org/427862 | 08:04 |
| *** nkinder has joined #openstack-keystone | 08:09 | |
| *** rcernin has quit IRC | 08:28 | |
| *** edmondsw has joined #openstack-keystone | 08:43 | |
| *** edmondsw has quit IRC | 08:48 | |
| *** rcernin has joined #openstack-keystone | 08:52 | |
| *** richm has quit IRC | 08:55 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:01 | |
| *** thorst_ has joined #openstack-keystone | 09:02 | |
| *** thorst_ has quit IRC | 09:08 | |
| *** richm has joined #openstack-keystone | 09:18 | |
| *** jvarlamova_ has quit IRC | 10:07 | |
| *** masterjcool has quit IRC | 10:12 | |
| *** jvarlamova_ has joined #openstack-keystone | 10:14 | |
| *** phalmos has joined #openstack-keystone | 10:20 | |
| *** masterjcool has joined #openstack-keystone | 10:23 | |
| *** erlon has joined #openstack-keystone | 10:45 | |
| *** phalmos has quit IRC | 10:51 | |
| *** phalmos has joined #openstack-keystone | 10:51 | |
| *** thorst_ has joined #openstack-keystone | 11:04 | |
| *** thorst_ has quit IRC | 11:08 | |
| *** nicolasbock has joined #openstack-keystone | 11:18 | |
| *** nkinder has quit IRC | 11:28 | |
| *** pnavarro has joined #openstack-keystone | 11:32 | |
| *** aloga has quit IRC | 11:35 | |
| *** aloga has joined #openstack-keystone | 11:36 | |
| *** catintheroof has joined #openstack-keystone | 11:47 | |
| *** openstackgerrit has quit IRC | 12:03 | |
| *** edmondsw has joined #openstack-keystone | 12:04 | |
| *** clayton has joined #openstack-keystone | 12:13 | |
| *** openstackgerrit has joined #openstack-keystone | 12:13 | |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone master: Prepare for using standard python tests https://review.openstack.org/427862 | 12:13 |
| *** dave-mccowan has joined #openstack-keystone | 12:15 | |
| *** thorst_ has joined #openstack-keystone | 12:33 | |
| *** thorst_ has quit IRC | 12:34 | |
| samueldmq | morning keystone | 12:49 |
| dstanek | morning samueldmq | 12:50 |
| samueldmq | dstanek: o/ | 12:51 |
| *** mvk has quit IRC | 12:55 | |
| *** richm has quit IRC | 12:57 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone master: Stop reading local config dirs for domain-specific SQL config driver https://review.openstack.org/427940 | 13:00 |
| *** thorst_ has joined #openstack-keystone | 13:01 | |
| stevemar | o/ | 13:13 |
| samueldmq | stevemar: howdy | 13:14 |
| *** richm has joined #openstack-keystone | 13:17 | |
| *** phalmos has quit IRC | 13:23 | |
| *** v1k0d3n has joined #openstack-keystone | 13:24 | |
| stevemar | samueldmq: hola! | 13:25 |
| *** mvk has joined #openstack-keystone | 13:29 | |
| *** BobBall has left #openstack-keystone | 13:35 | |
| *** lamt has joined #openstack-keystone | 13:46 | |
| *** lamt has quit IRC | 13:46 | |
| *** lamt has joined #openstack-keystone | 13:47 | |
| *** lamt has quit IRC | 14:04 | |
| *** spzala has joined #openstack-keystone | 14:11 | |
| *** nkinder has joined #openstack-keystone | 14:14 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone master: Modify the spelling mistakes https://review.openstack.org/423079 | 14:23 |
| *** jperry has joined #openstack-keystone | 14:27 | |
| *** gitudaniel has joined #openstack-keystone | 14:31 | |
| gitudaniel | o/ | 14:32 |
| *** agrebennikov__ has joined #openstack-keystone | 14:33 | |
| gitudaniel | hey guys, I've been trying to set up a keystone user and group using the --keystone-user and --keystone-group. The full command I ran is keystone-manage fernet_setup --keystone-user KEYSTONE --keystone-group KEYSTONE_GROUP. I ran this command as root and got 24897 ERROR keystone. Here is the full paste http://paste.openstack.org/show/597375/ | 14:35 |
| dstanek | gitudaniel: is KEYSTONE_USER a valid user? | 14:36 |
| gitudaniel | dstanek: I tried that as well and got the same error | 14:38 |
| dstanek | gitudaniel: what are you actually trying to do? | 14:39 |
| *** lamt has joined #openstack-keystone | 14:39 | |
| *** zzzeek has quit IRC | 14:40 | |
| *** zzzeek has joined #openstack-keystone | 14:40 | |
| stevemar | dstanek: had a question about the content_length in your webob fix patch | 14:40 |
| dstanek | stevemar: fire away | 14:41 |
| stevemar | ts in the review | 14:41 |
| stevemar | but why set it for only one of the responses? | 14:41 |
| *** spilla has joined #openstack-keystone | 14:42 | |
| gitudaniel | dstanek: I'm trying to set up fernet keys on keystone. I ran the command keystone-manage fernet_setup and was told that --keystone-user is needed. I'm setting up a keystone development environment from source so that I can understand how it all comes together | 14:42 |
| dstanek | stevemar: opening the review now... | 14:42 |
| dstanek | gitudaniel: that is the unix user and group that you what the repository created as | 14:46 |
| dstanek | stevemar: are we creating responses in other places i didn't find? | 14:47 |
| gitudaniel | dstanek: if I understand you correctly the user and group on my host pc?? | 14:48 |
| dstanek | gitudaniel: yes, i'm pretty sure i use root for that and then manually change the permissions so my webserver can read it too | 14:50 |
| gitudaniel | dstanek: thanks let me give it a go | 14:51 |
| *** nkinder has quit IRC | 14:55 | |
| stevemar | proposed RC: https://review.openstack.org/#/c/428185/ | 14:55 |
| stevemar | the stable/ocata branch will be created off of the current tip of keystone master | 14:55 |
| stevemar | we can backport any fixes to stable/ocata and create RC2 if necessary | 14:56 |
| *** stingaci has joined #openstack-keystone | 14:57 | |
| gitudaniel | dstanek: thanks it worked. The fernet keys have been created 25267 INFO keystone.common.fernet_utils [-] Become a valid new key: /etc/keystone/fernet-keys/0 | 14:58 |
| *** nkinder has joined #openstack-keystone | 15:00 | |
| stevemar | crinkle: o/ | 15:09 |
| *** dikonoor has quit IRC | 15:10 | |
| *** johndperkins has quit IRC | 15:17 | |
| *** dave-mccowan has quit IRC | 15:18 | |
| stevemar | bah, why did i not get the notice for https://bugs.launchpad.net/keystoneauth/+bug/1660436 | 15:20 |
| openstack | Launchpad bug 1660436 in OpenStack Dashboard (Horizon) "Federated users cannot log into horizon" [Critical,In progress] - Assigned to Colleen Murphy (krinkle) | 15:20 |
| robcresswell | stevemar: The doa fix puts us in a strange place | 15:23 |
| stevemar | robcresswell: whys that? | 15:23 |
| * robcresswell still doesnt understand why thats a separate lib | 15:23 | |
| stevemar | just backport it to stable/ocata and re-release, bump FFE upper-constraints | 15:23 |
| robcresswell | stevemar: Just due to versioning and release. I guess we just backport? | 15:24 |
| robcresswell | yeah | 15:24 |
| stevemar | robcresswell: the requirements team will hate us, but thats not new :) | 15:24 |
| robcresswell | There isnt a stable/ocata branch... | 15:24 |
| robcresswell | hmm | 15:24 |
| stevemar | oh wait, you haven't done that yet | 15:24 |
| stevemar | ah | 15:24 |
| stevemar | even better | 15:24 |
| robcresswell | it should be done, since that should've gone last week | 15:25 |
| stevemar | robcresswell: release a point release for DOA (3.1.1) https://github.com/openstack/releases/blob/master/deliverables/ocata/django_openstack_auth.yaml | 15:25 |
| stevemar | robcresswell: i can propose it :) | 15:25 |
| robcresswell | stevemar: I'm a little confused by the missing branch though, thats all. | 15:26 |
| robcresswell | I'll go bug the release team. | 15:26 |
| stevemar | robcresswell: the PTL is supposed to propse the branch now | 15:26 |
| *** lamt has quit IRC | 15:26 | |
| stevemar | robcresswell: or release liaison | 15:26 |
| robcresswell | >.< | 15:26 |
| stevemar | robcresswell: see https://review.openstack.org/#/c/428185/1/deliverables/ocata/keystone.yaml :) | 15:27 |
| robcresswell | okay | 15:27 |
| robcresswell | so that should've been done | 15:27 |
| robcresswell | maybe we can sneak in the doa release | 15:27 |
| stevemar | robcresswell: meh, do it now and make stable/ocata tag the 3.1.1 release | 15:28 |
| stevemar | robcresswell: let the release / requirements team know though | 15:28 |
| stevemar | they appreciate a heads up :) | 15:28 |
| robcresswell | fun stuff | 15:28 |
| crinkle | o/ | 15:28 |
| stevemar | crinkle: nevermind me, i'm a dummy | 15:29 |
| *** edmondsw_ has joined #openstack-keystone | 15:32 | |
| *** adrian_otto has joined #openstack-keystone | 15:33 | |
| *** dave-mccowan has joined #openstack-keystone | 15:34 | |
| *** edmondsw has quit IRC | 15:34 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: WIP add db_sync check https://review.openstack.org/416383 | 15:36 |
| stevemar | crinkle: about that fix... | 15:37 |
| *** jaosorior has joined #openstack-keystone | 15:37 | |
| *** lamt has joined #openstack-keystone | 15:37 | |
| stevemar | crinkle: won't we be playing whack-a-mole with the clients? | 15:37 |
| stevemar | crinkle: if images/volumes/object storage/networking panels all load i'm OK with it :) | 15:38 |
| *** thiagolib has quit IRC | 15:38 | |
| crinkle | stevemar: I haven't checked if it affects other clients, I'll spin up the other services and see | 15:40 |
| stevemar | crinkle: ack | 15:40 |
| *** edtubill has joined #openstack-keystone | 15:40 | |
| *** ravelar has joined #openstack-keystone | 15:41 | |
| knikolla | o/ | 15:42 |
| *** chris_hultin|AWA is now known as chris_hultin | 15:43 | |
| *** chris_hultin is now known as chris_hultin|AWA | 15:44 | |
| *** lucas_ has joined #openstack-keystone | 15:45 | |
| *** chris_hultin|AWA is now known as chris_hultin | 15:46 | |
| stevemar | crinkle: but no change in keystone necessary? | 15:46 |
| stevemar | crinkle: that'll be nice :) | 15:46 |
| crinkle | stevemar: I don't think so | 15:48 |
| *** adrian_otto has quit IRC | 15:51 | |
| stevemar | yay | 16:08 |
| stevemar | lbragstad dolphm ayoung bknudson dstanek jamielennox samueldmq rodrigods breton morgan let's not merge any new code for the next 24-48 hours (release notes, docs, tests are fine) | 16:10 |
| samueldmq | stevemar: ack | 16:11 |
| lbragstad | stevemar works for me | 16:11 |
| bknudson | ok | 16:11 |
| *** lucas_ has quit IRC | 16:11 | |
| *** lucas_ has joined #openstack-keystone | 16:12 | |
| *** rcernin has quit IRC | 16:29 | |
| ayoung | ACK | 16:32 |
| *** ayoung is now known as ayoung-dentist | 16:32 | |
| *** lucas_ has quit IRC | 16:34 | |
| *** adrian_otto has joined #openstack-keystone | 16:35 | |
| *** lucas_ has joined #openstack-keystone | 16:38 | |
| *** tesseract has quit IRC | 16:41 | |
| *** nkinder has quit IRC | 16:46 | |
| *** browne has joined #openstack-keystone | 16:47 | |
| *** dikonoor has joined #openstack-keystone | 16:52 | |
| *** gitudaniel has quit IRC | 16:59 | |
| *** ravelar has quit IRC | 16:59 | |
| *** ravelar has joined #openstack-keystone | 17:00 | |
| rodrigods | stevemar, ack | 17:01 |
| *** hoonetorg has quit IRC | 17:03 | |
| *** hoonetorg has joined #openstack-keystone | 17:04 | |
| *** richm has quit IRC | 17:07 | |
| *** lucas_ has quit IRC | 17:22 | |
| openstackgerrit | Merged openstack/keystone master: Modify the spelling mistakes https://review.openstack.org/423079 | 17:33 |
| openstackgerrit | Merged openstack/keystone master: Prepare for using standard python tests https://review.openstack.org/427862 | 17:35 |
| *** hoonetorg has quit IRC | 17:38 | |
| *** chlong has joined #openstack-keystone | 17:39 | |
| *** hoonetorg has joined #openstack-keystone | 17:40 | |
| *** hoonetorg has quit IRC | 17:47 | |
| *** lucas_ has joined #openstack-keystone | 17:51 | |
| *** jose-phillips has joined #openstack-keystone | 17:55 | |
| *** hoonetorg has joined #openstack-keystone | 17:59 | |
| *** Ephur has joined #openstack-keystone | 18:05 | |
| *** lucas_ has quit IRC | 18:17 | |
| crinkle | stevemar: seems like novaclient was the only one with an issue | 18:17 |
| *** dikonoor has quit IRC | 18:18 | |
| *** lucas_ has joined #openstack-keystone | 18:18 | |
| *** tqtran has joined #openstack-keystone | 18:19 | |
| *** spzala has quit IRC | 18:31 | |
| *** spzala has joined #openstack-keystone | 18:32 | |
| * morgan merges all the code! | 18:34 | |
| *** mvk has quit IRC | 18:35 | |
| *** spzala has quit IRC | 18:37 | |
| stevemar | crinkle: great to hear | 18:40 |
| *** chris_hultin is now known as chris_hultin|AWA | 18:43 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Deprecate (and emit message) auth_token_middleware https://review.openstack.org/427962 | 18:54 |
| morgan | stevemar: ^ re-proposed with pike in mind. | 18:54 |
| morgan | stevemar: for post Ocata release | 18:54 |
| rderose | Is there a Keystone/Horizon meeting today? Are we still having these? | 18:54 |
| stevemar | rderose: let me ask, thanks for the reminder | 18:55 |
| stevemar | rderose: i think we're all in heads-down RC mode | 18:55 |
| stevemar | rderose: was there something you wanted to talk about? | 18:55 |
| *** ayoung-dentist is now known as ayoung | 18:55 | |
| rderose | stevemar: nah, just wanting to take a longer lunch | 18:55 |
| rderose | :) | 18:55 |
| stevemar | rderose: go forth young man! | 18:56 |
| rderose | haha | 18:56 |
| rderose | thx | 18:56 |
| *** portdirect is now known as portdirect_away | 18:57 | |
| robcresswell | I would like to continue them next cycle at least, though I understand if everyone is tired with end of release | 18:57 |
| robcresswell | (I've seized power in Horizon again. *ahem* I mean, diplomatically elected) | 18:57 |
| morgan | ayoung: ugh dentist? | 18:57 |
| morgan | ayoung: sorry man. never fun. | 18:58 |
| rderose | robcresswell: yeah, would like them to continue as well | 18:58 |
| rderose | next cycle sounds good | 18:58 |
| ayoung | morgan, all done | 18:58 |
| morgan | stevemar: respinning KVS removal code. | 18:58 |
| morgan | stevemar: so we have it teed up for the moment pike opens | 18:58 |
| robcresswell | rderose: Yeah, I think its been pretty productive, and really useful to have some actual knowledge rather than all of Horizon just asking Dave | 18:59 |
| morgan | stevemar: i can't wait to land removing > 2000 lines | 18:59 |
| rderose | robcresswell: yeah :) | 18:59 |
| morgan | ayoung: i need to review your authorization refactor | 18:59 |
| rderose | morgan: ++ | 18:59 |
| morgan | ayoung: but at a glance, looks like the right direction | 18:59 |
| ayoung | morgan, it is just necessary to have all of the is_admin checks use the same mechanism | 18:59 |
| morgan | ayoung: i agree | 19:00 |
| morgan | ayoung: you know... i think we need to re-visit having unscoped RBAC. | 19:00 |
| morgan | ayoung: in keystone. | 19:00 |
| ayoung | morgan, everywhere, or just for certain operations? | 19:00 |
| morgan | ayoung: we'd maintain scoped RBAC as well | 19:01 |
| morgan | but having unscoped rbac would be... good for things like Admin | 19:01 |
| ayoung | morgan, Kubernetes has them as 2 different things. | 19:01 |
| morgan | yeah | 19:01 |
| morgan | that is the way i think we should be leaning | 19:01 |
| ayoung | morgan, to be honest, I don't have the heart for that battle any more. | 19:02 |
| morgan | ayoung: well you have 2-3 of us who are more inclined, and i think only 1 who was originally strongly against (since gyee isn't involved) | 19:02 |
| morgan | ayoung: gyee wanted oddly scoped rbac vs unscoped for some operations | 19:03 |
| morgan | ayoung i mean... | 19:03 |
| morgan | anyway... | 19:03 |
| ayoung | morgan, the scope part has been in there since termie, it was just poorly implemented...but, for now, I'd rather close the loop on what we've started then tilt at any further windmills | 19:03 |
| morgan | not saying you shold be the bearer of that torch | 19:04 |
| morgan | just saying we should re-evaluate that | 19:04 |
| morgan | annnnnd... with your changes it becomes easier since is_admin is checked in one place | 19:04 |
| morgan | thats all :) | 19:04 |
| * morgan kicks LDAP identity. | 19:05 | |
| stevemar | morgan: why are you kicking it? | 19:06 |
| morgan | stevemar: because our "unit tests" suck for it. | 19:06 |
| stevemar | they're not that bad | 19:06 |
| morgan | have you looked at FAKELDAP? | 19:06 |
| morgan | yes they are. | 19:06 |
| morgan | i don't mean the real unit tests i mean the ... lets fake the LDAP backend tests | 19:06 |
| stevemar | ohhh | 19:06 |
| stevemar | yeah :( | 19:06 |
| morgan | note air quotes "unit tests" | 19:07 |
| stevemar | morgan: i've been meaning to push up a patch to fix devstack | 19:07 |
| stevemar | to create an LDAP upon start up | 19:07 |
| *** jdennis has quit IRC | 19:08 | |
| * stevemar thinking about doing it by default | 19:08 | |
| morgan | do it as a multi-VM thing and actually use IPA | 19:08 |
| morgan | vs "slapd" | 19:08 |
| morgan | but we should do that and ditch any test that is "fake ldap" | 19:09 |
| ayoung | We could probably clean up the LDAP unit tests with proper canned responses. FakeLDAP is pretty nasty | 19:09 |
| morgan | ayoung: as long as we had a functional test suite for LDAP, we could. unfortunately we can't atm because... we don't test the end-to-end (and i say that loosely) otherwise right now | 19:09 |
| ayoung | Then again, we should just toss all of the LDAP code into a middleware layer and use Federation | 19:09 |
| morgan | but it shouldn't be hard to do really. | 19:09 |
| morgan | ayoung: mod_ldap | 19:10 |
| ayoung | something like what dstanek is doing with SAML | 19:10 |
| morgan | ;) | 19:10 |
| ayoung | nah | 19:10 |
| ayoung | mod_ldap is too hard coded. I looked | 19:10 |
| ayoung | Push all of the LDAP calls up front, though, and populate env vars | 19:10 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Remove KVS code https://review.openstack.org/424862 | 19:13 |
| ayoung | +5, -2189 | 19:14 |
| ayoung | I can +2 on that alone! | 19:14 |
| *** andrewbogott has quit IRC | 19:16 | |
| ayoung | morgan, I'm going through "deploy keystone via Kubernetes" | 19:17 |
| ayoung | once I get that working ,one thing I want to try is | 19:17 |
| ayoung | deploy a new container for each IdP | 19:18 |
| ayoung | whole separate HTTPD server when you push out a new protocol, with just that protocol on it | 19:18 |
| ayoung | AUTH_URL will then be per IdP as well | 19:18 |
| *** andrewbogott has joined #openstack-keystone | 19:22 | |
| *** chris_hultin|AWA is now known as chris_hultin | 19:32 | |
| *** spzala has joined #openstack-keystone | 19:33 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Deprecate (and slate for removal) UUID tokens https://review.openstack.org/428388 | 19:33 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Deprecate (and slate for removal) UUID tokens https://review.openstack.org/428388 | 19:36 |
| *** spzala has quit IRC | 19:38 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Deprecate (and slate for removal) UUID tokens https://review.openstack.org/428388 | 19:38 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Deprecate (and emit message) auth_token_middleware https://review.openstack.org/427878 | 19:41 |
| morgan | samueldmq, stevemar: merged ayoung's and my commits for https://review.openstack.org/#/c/427878/ (admin_token), this way it does not remove major functionality (as it shouldn't) but makes it easier to cleanup/remove in the future. | 19:43 |
| ayoung | morgan, I thought we were keeping UUID tokens | 19:46 |
| ayoung | there is still a need for them | 19:46 |
| *** spzala has joined #openstack-keystone | 19:46 | |
| morgan | ayoung: nah. | 19:47 |
| morgan | ayoung: with making fernet default, i don't think there is anymore. | 19:47 |
| morgan | if everything is driving towards / with fernet. slate UUID for removal. | 19:48 |
| * morgan disagreed with making fernet default | 19:48 | |
| ayoung | morgan, we need to solve some key sync issues then | 19:48 |
| morgan | but having lost that argument, i think we can drive to dropping uuid. | 19:48 |
| morgan | 2 cycles ;) | 19:48 |
| morgan | mostly it's proposed to force the issue | 19:49 |
| morgan | ayoung: but in reality, it's no more difficult than deploying SSL certs to multiple web servers | 19:49 |
| morgan | ayoung: and that is a solved(tm) problem | 19:49 |
| ayoung | morgan, we are still working on TLS.... | 19:50 |
| morgan | *we* are. the world has mechanisms to deploy SSL certs ot many places | 19:50 |
| morgan | fernet keys are no more complex than that | 19:50 |
| ayoung | morgan, most of the world does not do that at the Keystone layer, but at the HA Proxy level. Key sync needs some thought | 19:51 |
| morgan | ayoung: key sync needs exactly the same amount of thought as deploying SSL certs to multiple HA Proxies. | 19:51 |
| morgan | which most people do-infact do | 19:52 |
| morgan | or multiple apaches | 19:52 |
| morgan | or multiple nginx's | 19:52 |
| ayoung | morgan, ideally we would have some external, common method for producing, encrypting, transporting, and extracting keys in a secure manner. My old team was looking to use Custodia to do that | 19:52 |
| ayoung | https://github.com/latchset/custodia | 19:52 |
| morgan | that is *not* the concern of keystone to come up with | 19:52 |
| morgan | that is the concern of the devops tools | 19:52 |
| morgan | just like SSL certs | 19:52 |
| ayoung | But external mechanisms have never been very popular in OpenStack | 19:52 |
| morgan | we specify key location/configuration/format | 19:53 |
| morgan | like apache leans on ssl/pem formats | 19:53 |
| morgan | and yes, this is a case i am advocating punting over the wall | 19:53 |
| morgan | i can't come up with a solution that will work with chef, puppet, ansible, cfengine, docker, etc | 19:53 |
| morgan | we give the clear specification, and let deployers use tools to do so. | 19:54 |
| morgan | we may need another command to generate a simple fernet key vs. shove in a repo | 19:54 |
| morgan | but that is about as far as i could see us needing to go | 19:54 |
| morgan | rotation, etc can be pushed onto devops tools as long as we can generate a sane stand-alone key and provide the template for the repo (which iirc is super simple) | 19:55 |
| ayoung | morgan, I think Tripleo is OK on that front. I got them to think in terms of generating the Key on the undercloud, and pushing it out with Heat, but I do wish the mechanism was encrypted, and not just obfuscated | 19:55 |
| morgan | right, and that is not keystone's job to do | 19:55 |
| morgan | but i agree, it should be encrypted | 19:55 |
| ayoung | Its the extract, and more importantly, the import of the key that we do not have standardized | 19:55 |
| morgan | we can't solve that | 19:55 |
| ayoung | Course we can | 19:55 |
| ayoung | we don't want to solve it | 19:55 |
| morgan | we can make loading keys better in keystone | 19:55 |
| morgan | no we *cant* solve it | 19:56 |
| morgan | with the volume of tools used out there | 19:56 |
| morgan | we can only solve the keystone looking at the keys and using them | 19:56 |
| morgan | anything beyond keystone loading keys/consuming them (and loading i mean into it's process space) it out of scope | 19:56 |
| ayoung | morgan, if we could export import PKCS12 it would probably be the safest | 19:56 |
| morgan | s/it/is | 19:56 |
| ayoung | https://en.wikipedia.org/wiki/PKCS_12 | 19:56 |
| morgan | i don't think fernet can be PKCS_12'd but yes that is something we should look at | 19:57 |
| morgan | and like i said we probably need to be able to generate a stand-alone key | 19:57 |
| morgan | but those are much easier barriers to cover (minimal code) | 19:57 |
| ayoung | its not Fernet, its a symmetric key, and IO think anything can be PKCS_12ed. Which is the worst case of verbing I've seen all day | 19:58 |
| ayoung | Verbing weirds language | 19:58 |
| morgan | PKCS_12 is very specific about format and options | 19:59 |
| morgan | i don't know if we can put arbitrary data in it | 19:59 |
| morgan | i'm looking | 19:59 |
| morgan | it's https://tools.ietf.org/html/rfc7292 | 19:59 |
| ayoung | morgan, we can CMS it if we need, but the real issue is that it requires a asym key for extract | 20:00 |
| morgan | ayoung: i don't mind supporting asym for extract | 20:00 |
| morgan | the other thing i totally would support would be a trivial impl for a "load_keys" function | 20:00 |
| ayoung | morgan, we could actually use CMS as the format, in straight encrypt form, and it ends up being the same thing. | 20:00 |
| morgan | and we test with raw files from disk, and a tar | 20:00 |
| morgan | actually... yes, i think that is the right jchoice. | 20:01 |
| morgan | we just add a load_keys entry-point for fernet | 20:01 |
| ayoung | morgan, but, again, no heart for it. nkinder's team is going to be looking in to Custodia support, I think in this upcoming release. | 20:01 |
| morgan | and we support simple archive, cms, repo | 20:01 |
| morgan | or suple archive (tar) and repo (today) and let nkinder's team propose cms/custodia/etc | 20:02 |
| morgan | or someone else help on that front | 20:02 |
| *** tqtran has quit IRC | 20:05 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: WIP Fix multiple uuid warnings with pycadf https://review.openstack.org/426411 | 20:09 |
| *** lucas_ has quit IRC | 20:12 | |
| *** lucas_ has joined #openstack-keystone | 20:12 | |
| *** adrian_otto has quit IRC | 20:13 | |
| *** mvk has joined #openstack-keystone | 20:38 | |
| *** lucas_ has quit IRC | 20:44 | |
| *** Ephur has quit IRC | 20:45 | |
| *** lucas_ has joined #openstack-keystone | 20:47 | |
| *** adriant has joined #openstack-keystone | 20:55 | |
| *** lucas_ has quit IRC | 20:58 | |
| *** harlowja has quit IRC | 21:00 | |
| *** jdennis has joined #openstack-keystone | 21:01 | |
| *** richm has joined #openstack-keystone | 21:02 | |
| *** lucas_ has joined #openstack-keystone | 21:02 | |
| knikolla | ayoung: still proposing the talk for RBAC for boston? | 21:07 |
| *** lucas_ is now known as lucashxu | 21:08 | |
| *** dave-mccowan has quit IRC | 21:10 | |
| ayoung | knikolla, yep | 21:11 |
| *** catintheroof has quit IRC | 21:14 | |
| *** catintheroof has joined #openstack-keystone | 21:15 | |
| *** catintheroof has quit IRC | 21:19 | |
| *** raildo has quit IRC | 21:19 | |
| *** andrewbogott has quit IRC | 21:26 | |
| *** andrewbogott has joined #openstack-keystone | 21:26 | |
| *** adrian_otto has joined #openstack-keystone | 21:39 | |
| *** dave-mccowan has joined #openstack-keystone | 21:47 | |
| openstackgerrit | OpenStack Release Bot proposed openstack/keystone master: Update reno for stable/ocata https://review.openstack.org/428443 | 21:48 |
| *** phalmos has joined #openstack-keystone | 21:52 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Policy in code https://review.openstack.org/428453 | 21:54 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Define a richer policy by default https://review.openstack.org/428454 | 21:54 |
| lbragstad | johnthetubaguy ^ | 21:54 |
| *** ravelar has quit IRC | 21:54 | |
| *** Ephur has joined #openstack-keystone | 21:57 | |
| knikolla | ayoung: want me to present with you? | 21:58 |
| lbragstad | this pertains to us - https://review.openstack.org/#/c/417441/ | 21:58 |
| ayoung | knikolla, I think we passed the submission deadline, but did you get added? Let me check | 21:59 |
| lbragstad | spilla gagehugo was that related to what you were working on? ^ | 21:59 |
| morgan | stevemar: did i just see stable/ocata cut? | 21:59 |
| knikolla | ayoung: nah, submission deadline is next monday. | 21:59 |
| stevemar | morgan: mmhmm | 21:59 |
| *** jdennis has quit IRC | 21:59 | |
| ayoung | knikolla, sure...go ahead and submit a bio | 21:59 |
| morgan | stevemar: woot. lets land pike code in master then! :P | 22:00 |
| stevemar | morgan: definitely :) | 22:00 |
| ayoung | knikolla, should be up there now | 22:01 |
| morgan | stevemar: also https://review.openstack.org/#/c/427878/2 should be better now, no more removing functionality | 22:01 |
| morgan | stevemar: woot https://review.openstack.org/#/c/424862/ can land now. | 22:01 |
| *** richm has quit IRC | 22:01 | |
| *** richm has joined #openstack-keystone | 22:01 | |
| gagehugo | lbragstad: https://review.openstack.org/417315 | 22:03 |
| lbragstad | gagehugo aha yep | 22:03 |
| lamt | gagehugo lbragstad : yup, would like to discuss microversions in ptg | 22:03 |
| morgan | stevemar: we should get that kvs stuff through the door as early as possible - it's kindof ugly and removes enough code we should try and avoid rebases | 22:04 |
| stevemar | morgan: yep, i was just going to create the 'removed-as-of-pike' bp | 22:06 |
| morgan | gagehugo, lamt: as soon as we have a way to rev the api, i'll lift my -2 on that | 22:06 |
| *** thorst_ has quit IRC | 22:06 | |
| morgan | but until we have that in order, we can't move forward =/ (sorry) | 22:07 |
| gagehugo | yeah | 22:07 |
| lamt | morgan : agreed | 22:07 |
| stevemar | morgan: releaseeee noteeeee | 22:10 |
| * stevemar ducks | 22:10 | |
| stevemar | if you all just start including release notes, i won't have to -1 everyone | 22:10 |
| stevemar | :D | 22:10 |
| morgan | stevemar: shush | 22:11 |
| *** tqtran has joined #openstack-keystone | 22:11 | |
| morgan | stevemar: YOURE NOT PTL FOR MUCH LONGER! muahhahaha | 22:11 |
| morgan | i mean... | 22:11 |
| morgan | >> | 22:11 |
| morgan | << | 22:11 |
| stevemar | morgan: I KNOW RIGHT?! | 22:11 |
| stevemar | :D | 22:11 |
| morgan | ;) | 22:11 |
| stevemar | hehe | 22:11 |
| morgan | stevemar: i'm proposing a fix to pike, anything using DictBase w/o an extras column is being moved to ModelDictMixin and i'm renaming DictBase to something more descriptive | 22:12 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Define a richer policy by default https://review.openstack.org/428454 | 22:12 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Policy in code https://review.openstack.org/428453 | 22:12 |
| stevemar | morgan: sounds fine to me | 22:13 |
| morgan | stevemar: i think some of the models that use extras shouldn't be using it anyway | 22:17 |
| morgan | but... different change | 22:17 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Make use of Dict-base including extras explicit https://review.openstack.org/428472 | 22:20 |
| morgan | stevemar: in theory maybe we should white-list current things using DictBase and raise an exception if something new is based on it. | 22:21 |
| *** spilla has quit IRC | 22:22 | |
| *** harlowja has joined #openstack-keystone | 22:25 | |
| *** richm has quit IRC | 22:27 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Make use of Dict-base including extras explicit https://review.openstack.org/428472 | 22:28 |
| morgan | stevemar: ^ something like that | 22:28 |
| *** ravelar has joined #openstack-keystone | 22:29 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Make use of Dict-base including extras explicit https://review.openstack.org/428472 | 22:30 |
| *** thorst_ has joined #openstack-keystone | 22:31 | |
| *** harlowja has quit IRC | 22:32 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Remove KVS code https://review.openstack.org/424862 | 22:33 |
| *** harlowja has joined #openstack-keystone | 22:33 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Remove KVS code https://review.openstack.org/424862 | 22:34 |
| *** thorst_ has quit IRC | 22:35 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Remove KVS code https://review.openstack.org/424862 | 22:36 |
| *** edtubill has quit IRC | 22:36 | |
| morgan | stevemar: ^ there | 22:36 |
| stevemar | danke! | 22:36 |
| *** martinlopes has joined #openstack-keystone | 22:37 | |
| *** lucashxu has quit IRC | 22:37 | |
| morgan | stevemar: i got the requisite amount of snark in the remove-as-of-pike yaml file name | 22:37 |
| *** lucas_ has joined #openstack-keystone | 22:38 | |
| morgan | stevemar: releasenotes/notes/removed-as-of-pike-deadbeefdeadbeef.yaml (it's VALID hex!) | 22:40 |
| morgan | stevemar: def. let that go through ;) | 22:40 |
| *** erlon has quit IRC | 22:40 | |
| *** lucas_ has quit IRC | 22:44 | |
| *** portdirect_away is now known as portdirect | 22:49 | |
| -openstackstatus- NOTICE: Restarting gerrit due to performance problems | 22:51 | |
| *** edmondsw_ has quit IRC | 22:53 | |
| *** MasterOfBugs has joined #openstack-keystone | 22:54 | |
| *** edmondsw has joined #openstack-keystone | 22:54 | |
| *** adrian_otto has quit IRC | 22:57 | |
| *** edmondsw has quit IRC | 22:58 | |
| *** spzala has quit IRC | 23:09 | |
| *** spzala has joined #openstack-keystone | 23:09 | |
| *** chris_hultin is now known as chris_hultin|AWA | 23:16 | |
| *** spzala has quit IRC | 23:16 | |
| *** spzala has joined #openstack-keystone | 23:17 | |
| *** thorst_ has joined #openstack-keystone | 23:20 | |
| *** dave-mccowan has quit IRC | 23:28 | |
| *** jdennis has joined #openstack-keystone | 23:44 | |
| *** jdennis has quit IRC | 23:53 | |
| *** jdennis has joined #openstack-keystone | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!