| *** gyee has quit IRC | 00:04 | |
| *** chrisshattuck has quit IRC | 00:11 | |
| *** thorst has quit IRC | 00:18 | |
| *** thorst has joined #openstack-keystone | 00:18 | |
| *** itlinux has joined #openstack-keystone | 00:18 | |
| *** catintheroof has joined #openstack-keystone | 00:18 | |
| *** thorst has quit IRC | 00:23 | |
| openstackgerrit | chenaidong1 proposed openstack/keystone master: Remove duplicate code https://review.openstack.org/499872 | 00:24 |
|---|---|---|
| *** catintheroof has quit IRC | 00:31 | |
| *** thorst has joined #openstack-keystone | 00:32 | |
| *** jamesbenson has joined #openstack-keystone | 00:35 | |
| *** thorst has quit IRC | 00:39 | |
| *** jamesbenson has quit IRC | 00:40 | |
| *** thorst has joined #openstack-keystone | 00:40 | |
| openstackgerrit | chenaidong1 proposed openstack/keystone master: Policy exception https://review.openstack.org/501181 | 00:44 |
| *** thorst has quit IRC | 00:44 | |
| openstackgerrit | chenaidong1 proposed openstack/keystone master: Policy exception https://review.openstack.org/501181 | 00:47 |
| *** harlowja has quit IRC | 00:48 | |
| *** aahh has quit IRC | 00:54 | |
| *** agrebennikov has quit IRC | 01:05 | |
| *** thorst has joined #openstack-keystone | 01:08 | |
| *** thorst has quit IRC | 01:09 | |
| *** zhurong has joined #openstack-keystone | 01:14 | |
| *** chrisshattuck has joined #openstack-keystone | 01:38 | |
| *** ricolin has joined #openstack-keystone | 01:42 | |
| *** otleimat has quit IRC | 01:42 | |
| *** chrisshattuck has quit IRC | 01:49 | |
| *** aselius has quit IRC | 01:59 | |
| *** markvoelker has quit IRC | 02:11 | |
| *** thorst has joined #openstack-keystone | 02:15 | |
| *** thorst has quit IRC | 02:15 | |
| *** chrisshattuck has joined #openstack-keystone | 02:18 | |
| *** itlinux has quit IRC | 02:37 | |
| *** zxy has quit IRC | 02:39 | |
| *** itlinux has joined #openstack-keystone | 02:40 | |
| *** itlinux has quit IRC | 02:41 | |
| *** zxy has joined #openstack-keystone | 02:42 | |
| *** chrisshattuck has quit IRC | 02:44 | |
| *** chrisshattuck has joined #openstack-keystone | 02:47 | |
| *** chrisshattuck has quit IRC | 02:57 | |
| *** iurygregory has quit IRC | 03:10 | |
| *** iurygregory has joined #openstack-keystone | 03:10 | |
| *** markvoelker has joined #openstack-keystone | 03:11 | |
| *** itlinux has joined #openstack-keystone | 03:19 | |
| *** chrisshattuck has joined #openstack-keystone | 03:29 | |
| *** markvoelker has quit IRC | 03:46 | |
| *** harlowja has joined #openstack-keystone | 04:06 | |
| *** jamesbenson has joined #openstack-keystone | 04:12 | |
| *** thorst has joined #openstack-keystone | 04:16 | |
| *** jamesbenson has quit IRC | 04:16 | |
| *** stevemar has quit IRC | 04:19 | |
| *** charz has quit IRC | 04:19 | |
| *** charz_ has joined #openstack-keystone | 04:20 | |
| *** gagehugo has quit IRC | 04:20 | |
| *** spotz has quit IRC | 04:20 | |
| *** jistr|off has quit IRC | 04:20 | |
| *** gagehugo has joined #openstack-keystone | 04:20 | |
| *** thorst has quit IRC | 04:21 | |
| *** kevinbenton has quit IRC | 04:21 | |
| *** spotz has joined #openstack-keystone | 04:22 | |
| *** kevinbenton has joined #openstack-keystone | 04:23 | |
| *** jistr has joined #openstack-keystone | 04:24 | |
| *** stevemar has joined #openstack-keystone | 04:26 | |
| *** iurygregory has quit IRC | 04:30 | |
| *** iurygregory has joined #openstack-keystone | 04:36 | |
| *** zhurong has quit IRC | 04:38 | |
| *** dims has quit IRC | 04:40 | |
| *** markvoelker has joined #openstack-keystone | 04:43 | |
| *** boris_42 has joined #openstack-keystone | 04:52 | |
| *** zhurong has joined #openstack-keystone | 05:08 | |
| *** harlowja has quit IRC | 05:11 | |
| *** pcaruana has joined #openstack-keystone | 05:15 | |
| *** markvoelker has quit IRC | 05:16 | |
| *** thorst has joined #openstack-keystone | 05:17 | |
| *** chrisshattuck has quit IRC | 05:21 | |
| *** thorst has quit IRC | 05:22 | |
| *** chrisshattuck has joined #openstack-keystone | 05:31 | |
| *** chrisshattuck has quit IRC | 05:33 | |
| *** jaosorior has joined #openstack-keystone | 05:39 | |
| *** chrisshattuck has joined #openstack-keystone | 05:42 | |
| *** rybridges1 has quit IRC | 05:47 | |
| *** markvoelker has joined #openstack-keystone | 06:13 | |
| *** thorst has joined #openstack-keystone | 06:18 | |
| *** thorst has quit IRC | 06:23 | |
| *** jmlowe has quit IRC | 06:29 | |
| *** jaosorior has quit IRC | 06:33 | |
| *** cfriesen has quit IRC | 06:42 | |
| *** markvoelker has quit IRC | 06:47 | |
| *** rcernin has joined #openstack-keystone | 06:53 | |
| openstackgerrit | Shan Guo proposed openstack/keystone master: Update links in keystone https://review.openstack.org/501589 | 07:03 |
| *** aojea has joined #openstack-keystone | 07:13 | |
| *** aojea has quit IRC | 07:13 | |
| *** aojea has joined #openstack-keystone | 07:13 | |
| *** tesseract has joined #openstack-keystone | 07:13 | |
| *** chrisshattuck has joined #openstack-keystone | 07:36 | |
| *** markvoelker has joined #openstack-keystone | 07:44 | |
| *** jamesbenson has joined #openstack-keystone | 07:48 | |
| *** jamesbenson has quit IRC | 07:52 | |
| *** ioggstream has joined #openstack-keystone | 07:54 | |
| *** tbh_ has joined #openstack-keystone | 07:59 | |
| *** markvoelker has quit IRC | 08:17 | |
| *** jaosorior has joined #openstack-keystone | 08:17 | |
| *** thorst has joined #openstack-keystone | 08:20 | |
| *** thorst has quit IRC | 08:24 | |
| *** jaosorior has quit IRC | 08:50 | |
| *** oomichi has quit IRC | 08:53 | |
| *** oomichi has joined #openstack-keystone | 08:54 | |
| *** markvoelker has joined #openstack-keystone | 09:14 | |
| *** mvk has joined #openstack-keystone | 09:16 | |
| *** jaosorior has joined #openstack-keystone | 09:47 | |
| *** markvoelker has quit IRC | 09:48 | |
| *** edmondsw has joined #openstack-keystone | 09:54 | |
| *** jamesbenson has joined #openstack-keystone | 09:56 | |
| *** edmondsw has quit IRC | 09:58 | |
| *** jamesbenson has quit IRC | 10:01 | |
| *** Summer has joined #openstack-keystone | 10:02 | |
| *** jmlowe has joined #openstack-keystone | 10:08 | |
| *** jmlowe_ has joined #openstack-keystone | 10:11 | |
| *** jmlowe has quit IRC | 10:14 | |
| *** thorst has joined #openstack-keystone | 10:21 | |
| *** zhurong has quit IRC | 10:23 | |
| *** thorst has quit IRC | 10:26 | |
| *** chrisshattuck has joined #openstack-keystone | 10:33 | |
| *** chrisshattuck has quit IRC | 10:33 | |
| *** markvoelker has joined #openstack-keystone | 10:45 | |
| *** Summer has quit IRC | 10:51 | |
| *** szaher has quit IRC | 11:07 | |
| *** ioggstream has quit IRC | 11:17 | |
| *** markvoelker has quit IRC | 11:17 | |
| *** tbh_ has quit IRC | 11:19 | |
| *** zhurong has joined #openstack-keystone | 11:20 | |
| *** thorst has joined #openstack-keystone | 11:22 | |
| *** thorst has quit IRC | 11:30 | |
| *** raildo has joined #openstack-keystone | 11:55 | |
| *** szaher has joined #openstack-keystone | 11:59 | |
| *** thorst has joined #openstack-keystone | 12:01 | |
| *** thorst_ has joined #openstack-keystone | 12:03 | |
| *** thorst__ has joined #openstack-keystone | 12:05 | |
| *** thorst has quit IRC | 12:05 | |
| *** thorst_ has quit IRC | 12:07 | |
| *** dims has joined #openstack-keystone | 12:07 | |
| *** catintheroof has joined #openstack-keystone | 12:11 | |
| *** markvoelker has joined #openstack-keystone | 12:15 | |
| *** jaosorior has quit IRC | 12:15 | |
| *** dave-mccowan has joined #openstack-keystone | 12:20 | |
| *** markvoelker has quit IRC | 12:24 | |
| *** markvoelker has joined #openstack-keystone | 12:24 | |
| *** zhurong has quit IRC | 12:25 | |
| *** edmondsw has joined #openstack-keystone | 12:32 | |
| *** catintheroof has quit IRC | 12:33 | |
| *** catintheroof has joined #openstack-keystone | 12:38 | |
| *** dave-mcc_ has joined #openstack-keystone | 12:39 | |
| *** dave-mccowan has quit IRC | 12:42 | |
| *** edmondsw has quit IRC | 12:43 | |
| *** edmondsw has joined #openstack-keystone | 12:43 | |
| *** jaosorior has joined #openstack-keystone | 12:44 | |
| *** edmondsw has quit IRC | 12:48 | |
| *** edmondsw has joined #openstack-keystone | 12:54 | |
| *** raildo has quit IRC | 13:02 | |
| *** raildo has joined #openstack-keystone | 13:03 | |
| *** zhouyaguo has joined #openstack-keystone | 13:08 | |
| zhouyaguo | Hi, Can anybody kindly help to merge this? https://review.openstack.org/#/c/500891/ , another oslo.db commit is blocked by this one. Thanks very much. | 13:10 |
| *** edmondsw_ has joined #openstack-keystone | 13:14 | |
| *** edmondsw has quit IRC | 13:15 | |
| cmurphy | zhouyaguo: done | 13:18 |
| *** itlinux has quit IRC | 13:19 | |
| *** raildo has quit IRC | 13:20 | |
| *** catintheroof has quit IRC | 13:27 | |
| *** catintheroof has joined #openstack-keystone | 13:27 | |
| *** edmondsw_ is now known as edmondsw | 13:29 | |
| zhouyaguo | cmurphy: hey, Thank you very much for ur help. | 13:29 |
| *** raildo has joined #openstack-keystone | 13:31 | |
| *** jamesbenson has joined #openstack-keystone | 13:32 | |
| *** raildo has quit IRC | 13:35 | |
| *** raildo has joined #openstack-keystone | 13:36 | |
| *** catintheroof has quit IRC | 13:37 | |
| *** catintheroof has joined #openstack-keystone | 13:37 | |
| *** catintheroof has quit IRC | 13:39 | |
| *** catintheroof has joined #openstack-keystone | 13:40 | |
| *** f13o has joined #openstack-keystone | 13:42 | |
| *** f13o has quit IRC | 13:42 | |
| *** thegreenhundred has joined #openstack-keystone | 13:50 | |
| knikolla | o/ | 13:57 |
| *** dave-mcc_ is now known as dave-mccowan | 13:57 | |
| *** cfriesen has joined #openstack-keystone | 14:01 | |
| *** agrebennikov has joined #openstack-keystone | 14:10 | |
| *** ayoung_ has joined #openstack-keystone | 14:18 | |
| *** ayoung_ has quit IRC | 14:19 | |
| *** aojea has quit IRC | 14:27 | |
| *** edmondsw has quit IRC | 14:30 | |
| *** lucasxu has joined #openstack-keystone | 14:36 | |
| *** edmondsw has joined #openstack-keystone | 14:37 | |
| *** lucasxu has quit IRC | 14:41 | |
| openstackgerrit | Merged openstack/keystone master: Replace DbMigrationError with DBMigrationError https://review.openstack.org/500891 | 14:42 |
| gagehugo | o/ | 14:51 |
| lbragstad | o/ | 14:52 |
| *** chrisshattuck has joined #openstack-keystone | 14:52 | |
| *** zhouyaguo has quit IRC | 14:58 | |
| *** chrisshattuck has joined #openstack-keystone | 15:02 | |
| knikolla | lbragstad: quick sync up on global role assignments? | 15:07 |
| lbragstad | knikolla: sure - just wrapping something up quick | 15:07 |
| knikolla | sure | 15:07 |
| lbragstad | knikolla: ok - what's up | 15:08 |
| knikolla | lbragstad: reporting in to help. so far did a first pass on all the reviews. | 15:09 |
| lbragstad | knikolla: nice - i need to look at those again, i know there is feedback | 15:10 |
| lbragstad | and i need to address it | 15:10 |
| lbragstad | knikolla: i think we're still on the oslo bits | 15:11 |
| lbragstad | knikolla: https://etherpad.openstack.org/p/keystone-global-roles-poc | 15:11 |
| lbragstad | since all of #1 and #2 are done except #2.1 | 15:11 |
| knikolla | lbragstad: yep, was just checking that. | 15:11 |
| knikolla | lbragstad: what would be a realistic goal for the few remaining days? | 15:13 |
| lbragstad | knikolla: that's a good questin | 15:13 |
| lbragstad | question* | 15:13 |
| lbragstad | i don't know if we'll get the whole PoC done | 15:13 |
| lbragstad | but, something that might be useful would be a couple patches to oslo that show how to consume global roles? | 15:13 |
| lbragstad | and relaying theinformation into the project? | 15:14 |
| lbragstad | or proposing a patch to nova that reworks the policy bits to recognize that? | 15:14 |
| knikolla | i can take up the nova bits | 15:14 |
| lbragstad | i think that'd be powerful since it shows the developers of other projects how they use this new thign | 15:14 |
| knikolla | agree | 15:14 |
| lbragstad | and if we connect the dots properly, it should be helpful | 15:15 |
| lbragstad | so - in order for that to happen | 15:15 |
| lbragstad | we need | 15:15 |
| lbragstad | 1.) oslo to understand globally scoped token | 15:15 |
| lbragstad | tokens* | 15:15 |
| lbragstad | 2.) scope to be integrated into the DocumentedRuleDefault object | 15:15 |
| *** otleimat has joined #openstack-keystone | 15:15 | |
| lbragstad | 3.) patch to nova showcasing how it all works | 15:16 |
| lbragstad | am i missing anything? | 15:16 |
| knikolla | lbragstad: that should be pretty much it. | 15:16 |
| knikolla | avoiding any client side tooling. | 15:16 |
| lbragstad | yeah | 15:17 |
| lbragstad | like horizon you mean? | 15:17 |
| knikolla | keystoneauth, osc, etc. yeah | 15:17 |
| lbragstad | right | 15:17 |
| lbragstad | i think that's out of scope at this point | 15:18 |
| knikolla | yep. | 15:18 |
| lbragstad | i can work on getting patch up to oslo.policy that includes scope | 15:19 |
| lbragstad | in the DocumentedRuleDefault object | 15:19 |
| knikolla | i'll pick up the nova changes then | 15:19 |
| knikolla | lbragstad: the interface will be as described in the oslo.policy spec right? | 15:20 |
| knikolla | if so, i have all i need to start and we can meet up in the middle. | 15:20 |
| lbragstad | knikolla: which interface? | 15:21 |
| lbragstad | adding scope? | 15:21 |
| lbragstad | we should include that here -https://review.openstack.org/#/c/500207/ | 15:21 |
| lbragstad | https://review.openstack.org/#/c/500207/ | 15:21 |
| knikolla | lbragstad: yeah | 15:22 |
| knikolla | i mean the way to use the DocumentedRuleDefault will be as described in the spec | 15:23 |
| lbragstad | oh - yeah | 15:23 |
| lbragstad | right now the only thing in the spec is how to include scope in the rule definition | 15:23 |
| lbragstad | but exposing its attributes in an example would be useful | 15:23 |
| knikolla | lbragstad: the oslo.policy enforce method also has to be modified right? | 15:25 |
| lbragstad | knikolla: i *think* so, but i haven't dug into that in detail yet | 15:26 |
| lbragstad | i assume it needs to be able to handle global scope from the context and global scope from the policy rule | 15:26 |
| *** nicolasbock has joined #openstack-keystone | 15:26 | |
| knikolla | lbragstad: because my gut feeling is that it would be enough to define the rule with global scope and modify the enforce method and it **should** work globally for all projects | 15:27 |
| *** itlinux has joined #openstack-keystone | 15:27 | |
| knikolla | at least those that have policy in code. | 15:27 |
| lbragstad | yeah - the only remaining question is what oslo.context does with scope | 15:30 |
| lbragstad | because most projects use the context supplied through oslo.context and don't consume the token directly | 15:31 |
| knikolla | so we need to extend oslo.context with is_global | 15:32 |
| lbragstad | knikolla: yeah - or something along those lines | 15:32 |
| knikolla | and tie that in to how the context is created | 15:32 |
| knikolla | and how the context is consumed by the policy enforcer | 15:32 |
| lbragstad | right - because contexts are created by some information in the token | 15:32 |
| lbragstad | knikolla: https://docs.openstack.org/oslo.context/latest/user/usage.html#context-variables for example | 15:33 |
| knikolla | lbragstad: yep | 15:34 |
| knikolla | lbragstad: i'll look into that. your changes make issuing a global token possible right? | 15:35 |
| lbragstad | yep | 15:35 |
| lbragstad | knikolla: you can get a globally scoped token with https://review.openstack.org/#/c/498577/ | 15:36 |
| knikolla | lbragstad: will deploy a devstack with it today and extend the context in nova to work with global tokens. | 15:36 |
| lbragstad | which is the last patch in the series for the PoC as far as keystone patches go | 15:36 |
| lbragstad | knikolla: awesome - i'll starting tinkering with oslo.policy and adding scope today | 15:37 |
| knikolla | lbragstad: great! | 15:37 |
| *** aselius has joined #openstack-keystone | 15:48 | |
| *** zhouyaguo has joined #openstack-keystone | 15:52 | |
| *** panbalag has joined #openstack-keystone | 15:52 | |
| *** itlinux has quit IRC | 15:55 | |
| *** itlinux has joined #openstack-keystone | 15:58 | |
| panbalag | Hello. I'm trying to exercise password_regex option in keystone.conf, but it doesn't seem to be working. I opened a bug https://bugs.launchpad.net/keystone/+bug/1715684 Can anyone take a look at it and let me know if I'm not defining the regex correctly or is it a valid bug? | 16:00 |
| openstack | Launchpad bug 1715684 in OpenStack Identity (keystone) "password_regex option in keystone.conf not working" [Undecided,New] | 16:00 |
| *** itlinux has quit IRC | 16:06 | |
| kmalloc | stevemar: is Topol going to be at the PTG? | 16:07 |
| *** raildo has quit IRC | 16:08 | |
| kmalloc | I don't see him in IRC or I'd ask him directly | 16:08 |
| lbragstad | panbalag: are you sure that option is being set in the [security_compliance] section of the configuration file? | 16:08 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/conf/security_compliance.py#L94 | 16:08 |
| panbalag | lbragstad: Yeah. it is set. | 16:10 |
| *** raildo has joined #openstack-keystone | 16:12 | |
| lbragstad | panbalag: do you have any logging in keystone when you make that request? | 16:12 |
| lbragstad | panbalag: we have tests locally that exercise this - https://github.com/openstack/keystone/blob/40653eac50de22d3838349ce80be8ac7b3e2fbcc/keystone/tests/unit/test_v3_identity.py#L1046 | 16:12 |
| *** raildo has quit IRC | 16:13 | |
| *** lucnbbktp has joined #openstack-keystone | 16:15 | |
| panbalag | lbragstad: no logs in keystone.log - maybe i can turn on debug mode and try | 16:15 |
| lbragstad | panbalag: yeah - that might be helpful | 16:15 |
| lbragstad | panbalag: are you using the identity sql backend? | 16:16 |
| lbragstad | or ldap? | 16:16 |
| lbragstad | i assume sql? | 16:16 |
| panbalag | lbragstad: sql | 16:16 |
| lbragstad | ok | 16:16 |
| lbragstad | just double checking | 16:16 |
| panbalag | lbragstad: this is the only option to turn on debug mode right? "insecure_debug = true" | 16:17 |
| lbragstad | panbalag: that and https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L141 | 16:18 |
| gagehugo | panbalag lbragstad I can't recreate that bug | 16:18 |
| gagehugo | The password does not match the requirements: 1 letter, 1 digit, 7 chars. (HTTP 400) (Request-ID: req-6bc397d5-5cdb-460c-8c30-8bd6edac13ec) | 16:18 |
| panbalag | lbragstad: strange - i'm not seeing any logs in keystone.log even after turning on debug mode. | 16:20 |
| panbalag | lbragstad: does httpd logs show anything related to keystone? | 16:21 |
| lbragstad | gagehugo: are you working off master? | 16:22 |
| gagehugo | yup | 16:22 |
| lbragstad | panbalag: what version of openstack are you using? | 16:22 |
| panbalag | lbragstad: Pike | 16:23 |
| lbragstad | panbalag: how are you running keystone? in apache? | 16:26 |
| lbragstad | httpd i mean? | 16:26 |
| gagehugo | I'm running it behind apache | 16:26 |
| panbalag | lbragstad: yes | 16:27 |
| lbragstad | panbalag: ok - trying to recreate with pike quick | 16:27 |
| *** jaosorior has quit IRC | 16:30 | |
| lbragstad | yeah - i can't recreate this either | 16:31 |
| *** lucnbbktp has quit IRC | 16:31 | |
| lbragstad | i get 400 on Pike when i try to create a user with password as 'password' using the regex in the description | 16:32 |
| *** raildo has joined #openstack-keystone | 16:33 | |
| lbragstad | panbalag: are you use you're not interacting with a keystone node that doesn't have the new configuration changes? | 16:34 |
| lbragstad | or hasn't been bounced? | 16:34 |
| panbalag | lbragstad: double checking | 16:35 |
| *** itlinux has joined #openstack-keystone | 16:36 | |
| gagehugo | lbragstad no rush but can you look at https://bugs.launchpad.net/keystone/+bug/1714179 as well, I think what I posted was the consensus about extras b/c we looked into doing that same thing as the bug mentions | 16:38 |
| openstack | Launchpad bug 1714179 in OpenStack Identity (keystone) "keystone project can not update or search extra filed" [Undecided,Invalid] - Assigned to 曾永明 (zengyongming) | 16:38 |
| gagehugo | before we did tags | 16:38 |
| *** thorst__ has quit IRC | 16:39 | |
| *** thorst has joined #openstack-keystone | 16:43 | |
| *** rcernin has quit IRC | 16:45 | |
| *** thorst has quit IRC | 16:48 | |
| *** thorst_ has joined #openstack-keystone | 16:48 | |
| lbragstad | gagehugo: yeah - that makes sense | 16:48 |
| *** itlinux has quit IRC | 16:48 | |
| lbragstad | gagehugo: we've had the stance of moving away from extras and discouraging it's use for a long time | 16:48 |
| gagehugo | lbragstad yeah | 16:49 |
| *** edmondsw has quit IRC | 16:49 | |
| lbragstad | stepping away for lunch quick | 16:50 |
| *** junbo has quit IRC | 16:50 | |
| *** itlinux has joined #openstack-keystone | 16:51 | |
| *** edmondsw has joined #openstack-keystone | 16:51 | |
| *** edmondsw_ has joined #openstack-keystone | 16:55 | |
| *** junbo has joined #openstack-keystone | 16:55 | |
| *** edmondsw has quit IRC | 16:56 | |
| *** edmondsw_ has quit IRC | 16:57 | |
| *** edmondsw has joined #openstack-keystone | 16:57 | |
| *** edmondsw has quit IRC | 17:00 | |
| *** zhouyaguo has quit IRC | 17:02 | |
| *** itlinux has quit IRC | 17:02 | |
| *** charz_ has quit IRC | 17:04 | |
| *** charz has joined #openstack-keystone | 17:07 | |
| panbalag | lbragstad: found that it works on the undercloud ("The password does not match the requirements: None. (HTTP 400)") and not on the overcloud. do you have a tripleo deployment that you can check on? | 17:08 |
| *** edmondsw has joined #openstack-keystone | 17:10 | |
| *** edmondsw has quit IRC | 17:14 | |
| *** itlinux has joined #openstack-keystone | 17:15 | |
| *** ricolin has quit IRC | 17:16 | |
| *** panbalag has quit IRC | 17:18 | |
| *** harlowja has joined #openstack-keystone | 17:19 | |
| *** edmondsw has joined #openstack-keystone | 17:21 | |
| *** aahh has joined #openstack-keystone | 17:21 | |
| *** itlinux has quit IRC | 17:21 | |
| *** tesseract has quit IRC | 17:23 | |
| *** chlong has joined #openstack-keystone | 17:24 | |
| *** edmondsw has quit IRC | 17:25 | |
| *** edmondsw has joined #openstack-keystone | 17:33 | |
| *** raildo has quit IRC | 17:33 | |
| *** panbalag has joined #openstack-keystone | 17:35 | |
| *** edmondsw has quit IRC | 17:37 | |
| *** edmondsw has joined #openstack-keystone | 17:37 | |
| *** edmondsw has quit IRC | 17:49 | |
| *** jmlowe has joined #openstack-keystone | 17:55 | |
| *** jmlowe_ has quit IRC | 17:57 | |
| *** edmondsw has joined #openstack-keystone | 17:59 | |
| *** jmlowe has quit IRC | 18:06 | |
| *** jmlowe has joined #openstack-keystone | 18:06 | |
| *** panbalag has quit IRC | 18:14 | |
| *** edmondsw has quit IRC | 18:18 | |
| *** edmondsw has joined #openstack-keystone | 18:24 | |
| *** dims has quit IRC | 18:34 | |
| stevemar | kmalloc: i believe he is not going | 18:35 |
| *** dims has joined #openstack-keystone | 18:36 | |
| kmalloc | darn | 18:36 |
| kmalloc | you? | 18:36 |
| *** dims has quit IRC | 18:41 | |
| *** edmondsw has quit IRC | 18:44 | |
| *** dims has joined #openstack-keystone | 18:45 | |
| stevemar | kmalloc: same, unfortunately | 18:46 |
| stevemar | kmalloc: henrynash will be there | 18:46 |
| kmalloc | stevemar: bah, two of the people I wanted to bug aren't going to be there. | 18:47 |
| kmalloc | henry is nice to see, but he wasn't on the short list of folks I wanted to bug. | 18:47 |
| *** edmondsw has joined #openstack-keystone | 18:48 | |
| *** edmondsw has quit IRC | 18:48 | |
| stevemar | kmalloc: i feel honored to have made the list :) | 18:50 |
| *** boris_42 has quit IRC | 18:50 | |
| *** chlong has quit IRC | 18:51 | |
| *** chlong_ has joined #openstack-keystone | 18:51 | |
| kmalloc | stevemar: hehe | 18:52 |
| *** aojea has joined #openstack-keystone | 18:54 | |
| *** edmondsw has joined #openstack-keystone | 18:54 | |
| *** edmondsw has quit IRC | 18:57 | |
| *** edmondsw has joined #openstack-keystone | 18:57 | |
| *** edmondsw has quit IRC | 18:58 | |
| *** aojea has quit IRC | 18:58 | |
| *** edmondsw_ has joined #openstack-keystone | 19:05 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Adds Bandit #nosec flag to instances of SHA1 https://review.openstack.org/500115 | 19:06 |
| *** chlong_ has quit IRC | 19:07 | |
| *** chlong_ has joined #openstack-keystone | 19:08 | |
| kmalloc | gagehugo: commented on bug 1714179 and commented. you're spot on | 19:09 |
| openstack | bug 1714179 in OpenStack Identity (keystone) "keystone project can not update or search extra field" [Undecided,Invalid] https://launchpad.net/bugs/1714179 - Assigned to 曾永明 (zengyongming) | 19:09 |
| *** edmondsw_ has quit IRC | 19:09 | |
| gagehugo | kmalloc ok cool | 19:11 |
| *** chlong__ has joined #openstack-keystone | 19:12 | |
| knikolla | lbragstad: i'm having issues with assigning a global role | 19:13 |
| knikolla | err.. .globally assigning a role | 19:13 |
| lbragstad | knikolla: what's up? | 19:13 |
| *** chlong_ has quit IRC | 19:14 | |
| knikolla | lbragstad: http://paste.openstack.org/show/620666/ | 19:15 |
| knikolla | doing this http://paste.openstack.org/show/620667/ | 19:16 |
| lbragstad | huh - it looks like it's not picking up the UserGlobal bit | 19:18 |
| lbragstad | knikolla: or actually, it looks like sql doesn't like the fact your passing UserGlobal | 19:20 |
| lbragstad | to sql | 19:20 |
| knikolla | lbragstad: yup. type is enum and it doesn't include UserGlobal | 19:21 |
| knikolla | enum('UserProject','GroupProject','UserDomain','GroupDomain') | 19:22 |
| lbragstad | wasn't that that included in a previous patch? | 19:22 |
| knikolla | lbragstad: needs a db migration | 19:22 |
| lbragstad | knikolla: doesn't is just need to be done in the sql model? | 19:23 |
| lbragstad | https://review.openstack.org/#/c/494338/7/keystone/assignment/backends/sql.py | 19:23 |
| knikolla | lbragstad: i'm guessing it's not enough. http://paste.openstack.org/show/620668/ | 19:24 |
| lbragstad | knikolla: that's weird, because it passes unit tests | 19:25 |
| lbragstad | i wonder if that's something to do with sqlite or whatnot | 19:25 |
| knikolla | lbragstad: there is no enum in sqlite AFAIK | 19:26 |
| *** chlong__ has quit IRC | 19:26 | |
| *** chlong_ has joined #openstack-keystone | 19:27 | |
| kmalloc | euw, using enum? | 19:29 |
| lbragstad | well - the RoleAssignment backend uses Enum | 19:29 |
| kmalloc | oh man | 19:30 |
| lbragstad | see line 336 https://review.openstack.org/#/c/494338/7/keystone/assignment/backends/sql.py | 19:30 |
| *** pcaruana has quit IRC | 19:31 | |
| kmalloc | uhm. | 19:31 |
| kmalloc | i think that is very very highly mysql specific | 19:31 |
| knikolla | lbragstad: i see that, but that's the model definition, needs a matching migration | 19:31 |
| kmalloc | in optimised implementation | 19:31 |
| kmalloc | as in... that might be a bad idea | 19:31 |
| kmalloc | eh | 19:32 |
| *** chlong_ has quit IRC | 19:32 | |
| kmalloc | it's in most backends... | 19:32 |
| kmalloc | but i really *really* would not use it | 19:32 |
| kmalloc | i would make the code smart. | 19:32 |
| *** chlong_ has joined #openstack-keystone | 19:33 | |
| lbragstad | damn- https://github.com/openstack/keystone/blob/af4e98c770d771144463e6dd49cb4b559d48c403/keystone/common/sql/migrate_repo/versions/067_kilo.py#L188 | 19:33 |
| kmalloc | that way new types are *not* needing enum changes | 19:33 |
| kmalloc | and migrations | 19:33 |
| kmalloc | so can we not use enum? | 19:33 |
| kmalloc | oh bah | 19:33 |
| kmalloc | we should really make that go away | 19:33 |
| kmalloc | lbragstad: suggest migrate away from ENUM and make it in-code | 19:33 |
| knikolla | ++ | 19:34 |
| kmalloc | since we already have it... but we can use this as an opportunity to nuke it in the schema | 19:34 |
| knikolla | kmalloc: is there anything at all that enum brings to the table in terms of optimization? | 19:34 |
| kmalloc | looking into it, but i think it's just leaning on the engine to enforce | 19:34 |
| kmalloc | yeah it's very much just enforcement | 19:36 |
| kmalloc | i don't think it really adds any optimisations in the backend | 19:36 |
| kmalloc | afaict | 19:36 |
| knikolla | i support nuking them then | 19:36 |
| kmalloc | ah | 19:37 |
| kmalloc | here is the benefit | 19:37 |
| *** edmondsw has joined #openstack-keystone | 19:37 | |
| lbragstad | so - it sounds like we need a patch before https://review.openstack.org/#/c/494338/ that moved Enum into code? | 19:37 |
| kmalloc | ENUM('value1','value2',...)1 or 2 bytes, depending on the number of enumeration values (65,535 values maximum) | 19:37 |
| *** thorst_ has quit IRC | 19:37 | |
| kmalloc | it uses 1 or 2 bytes of storage instead of the whole string in the table | 19:37 |
| kmalloc | so indexes *and* values are much smaller, you store the data once | 19:38 |
| kmalloc | that said... *eh*, not sure we should worry about that kind of optimization | 19:38 |
| knikolla | we could tinyint if size is a concern | 19:38 |
| kmalloc | we aren't really .. well | 19:38 |
| knikolla | still... they're actually quite readable as they clearly enumerate the values | 19:39 |
| *** chlong__ has joined #openstack-keystone | 19:41 | |
| *** chlong_ has quit IRC | 19:43 | |
| *** thorst has joined #openstack-keystone | 19:43 | |
| lbragstad | so do we want to remove the Enum support from the backend and move everything into the application or do we want to add two other types in a migration? | 19:44 |
| kmalloc | i think they're pretty evil | 19:44 |
| *** panbalag has joined #openstack-keystone | 19:44 | |
| kmalloc | lets ask mordred | 19:45 |
| kmalloc | mordred: view on ENUM DB schema type? | 19:45 |
| kmalloc | we aren't really constrained in storage (it's not a lot of storage) | 19:45 |
| kmalloc | we have 2 options, 1) add types, 2) make the ENUM enforcement in-app | 19:46 |
| kmalloc | lbragstad: ftr, adding types (from what i can tell) is an alter and not additive | 19:46 |
| kmalloc | unless we pivot to a new column (and will have to do that each-and-every-time we add types) | 19:46 |
| lbragstad | we do already have this in app https://github.com/openstack/keystone/blob/40653eac50de22d3838349ce80be8ac7b3e2fbcc/keystone/assignment/backends/sql.py#L28-L40 | 19:46 |
| kmalloc | i'm inclined to say make it in-app logic for future maintainability with rolling upgrade support | 19:47 |
| kmalloc | vs endless column pivots | 19:47 |
| kmalloc | do the pivot once | 19:47 |
| kmalloc | and then we're in-code for updates instead of migrations | 19:47 |
| lbragstad | yeah | 19:47 |
| *** thorst has quit IRC | 19:47 | |
| kmalloc | also for non-SQL backends, if the app does the logic (in the manager) | 19:48 |
| kmalloc | we can avoid needing to implement that at the driver level each time | 19:48 |
| lbragstad | true | 19:48 |
| kmalloc | so i'm inclined to say: pivot to in-app and push enforcement to manager | 19:48 |
| kmalloc | drivers really should be very very simplistic | 19:49 |
| kmalloc | get/store data | 19:49 |
| lbragstad | yeah | 19:49 |
| lbragstad | agree | 19:49 |
| kmalloc | so, then i think the answer is straight forward | 19:49 |
| kmalloc | :) | 19:49 |
| kmalloc | in-app vs expand the enum | 19:49 |
| lbragstad | so - we will need a migration | 19:50 |
| lbragstad | to migrate from the enum to a new column | 19:50 |
| kmalloc | yep | 19:50 |
| *** itlinux has joined #openstack-keystone | 19:50 | |
| kmalloc | and fwiw, i am happy with either a multi-write (write to both columns for a cycle) model in app | 19:50 |
| kmalloc | vs triggers | 19:50 |
| kmalloc | but if you want triggers i will review the bits besides the triggers and not -2 | 19:51 |
| kmalloc | or -1 based on that | 19:51 |
| *** itlinux has quit IRC | 19:53 | |
| *** edmondsw has quit IRC | 19:53 | |
| *** edmondsw has joined #openstack-keystone | 19:53 | |
| lbragstad | we could do a final migration in the contract phase? | 19:54 |
| *** itlinux has joined #openstack-keystone | 19:54 | |
| *** edmondsw has quit IRC | 19:58 | |
| mordred | kmalloc: morning! | 20:02 |
| *** aojea has joined #openstack-keystone | 20:02 | |
| mordred | kmalloc: biggest issue with ENUM in schema is that adding a new value requires a schema change -whereas just using int or tinyint or whatnot with an enum/mapping defined in code does not | 20:03 |
| mordred | kmalloc: otoh - int/tinyint with enum in code has issues with enum in code maybe being out of sync with db ... BUT - since we use ORM layer for all of our db access anyway, we're going to have a code level mapping/definition anyway so I'm not sure it's worth much to push it to the db layer | 20:04 |
| mordred | kmalloc: I see now thatyou have said some of those things already | 20:04 |
| kmalloc | mordred: you have confirmed exactly what I expected | 20:05 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add backport migrations for Pike https://review.openstack.org/501859 | 20:05 |
| lbragstad | kmalloc: knikolla ^ | 20:05 |
| kmalloc | lbragstad: i stand by the decisdion to move to in-app logic based on what mordred said | 20:09 |
| lbragstad | sure - working on a patch | 20:09 |
| *** edmondsw has joined #openstack-keystone | 20:14 | |
| *** itlinux has quit IRC | 20:15 | |
| *** thorst has joined #openstack-keystone | 20:16 | |
| lbragstad | kmalloc: do you have a name in mind for the new column? | 20:17 |
| lbragstad | 'assignment_type' | 20:17 |
| lbragstad | ? | 20:17 |
| kmalloc | wfm | 20:17 |
| *** thorst_ has joined #openstack-keystone | 20:18 | |
| *** thorst has quit IRC | 20:20 | |
| *** aahh has quit IRC | 20:20 | |
| *** thorst_ has quit IRC | 20:23 | |
| *** thorst has joined #openstack-keystone | 20:24 | |
| *** chlong__ has quit IRC | 20:42 | |
| lbragstad | knikolla: i should have a patch up relatively soon | 20:43 |
| lbragstad | knikolla: i'm going to rebase all the global role patches to be dependent on the migration | 20:43 |
| knikolla | lbragstad: sounds good. i got it to work by manually altering the enum to include UserGlobal. | 20:44 |
| knikolla | in mysql | 20:44 |
| knikolla | so now i have a global scoped token and am looking into oslo.context and nova. | 20:44 |
| lbragstad | knikolla: cool - so you're not blocked at least | 20:44 |
| knikolla | lbragstad: nope :) no worries | 20:45 |
| ayoung | lbragstad, knikolla http://docs.ansible.com/ansible-tower/3.1.4/html/userguide/security.html#rbac-ug | 20:45 |
| ayoung | implied roles in Ansible | 20:46 |
| ayoung | The way that Keystone attempts to do RBAC is fast becoming the Norm | 20:47 |
| ayoung | Instead of Global Roles Ansible seems to call them "Singleton roles" but hey | 20:48 |
| *** catintheroof has quit IRC | 20:49 | |
| *** catintheroof has joined #openstack-keystone | 20:49 | |
| *** catintheroof has quit IRC | 20:50 | |
| knikolla | ayoung: interesting | 20:51 |
| knikolla | it seems that it's a separate type of role though | 20:51 |
| ayoung | knikolla, yep. | 20:51 |
| knikolla | while we're keeping one type of role and offering multiple assignment types | 20:51 |
| ayoung | knikolla, Kubernetes does the same thing, calls them CLuster Roles | 20:52 |
| ayoung | and lbragstad 's proposal is to make GLobal Roles, but they are all saying the same thing: certain roles are scoped to a project, and certain ones apply cross projects | 20:52 |
| ayoung | is_admin_project is a way to shoehorn in that logic without changing the API version. | 20:53 |
| * lbragstad reads | 20:53 | |
| ayoung | the two global roles are System administrators and System Auditors. Second one is the Read only role. | 20:55 |
| *** dave-mccowan has quit IRC | 20:55 | |
| *** itlinux has joined #openstack-keystone | 20:58 | |
| *** thorst has quit IRC | 21:01 | |
| *** itlinux has quit IRC | 21:01 | |
| kmalloc | ayoung: that is a good place to start in general | 21:01 |
| *** thorst has joined #openstack-keystone | 21:01 | |
| knikolla | ayoung: we're eventually phasing out is_admin_project with global role assignment right? | 21:04 |
| *** itlinux has joined #openstack-keystone | 21:05 | |
| *** itlinux has quit IRC | 21:05 | |
| *** thorst has quit IRC | 21:05 | |
| *** panbalag has quit IRC | 21:09 | |
| knikolla | lbragstad: the context is built from the ksm env variables, and the ksm env variables are built from keystoneauth. so that's gonna need changes to all three even for a poc. | 21:10 |
| *** itlinux has joined #openstack-keystone | 21:10 | |
| ayoung | knikolla, yeah, that is the plan. But I can see a stumbling block with API version. Hopefully, we can sneak Global Roles in without a major API version bump | 21:19 |
| ayoung | knikolla, I wonder if the best thing to do is to do it in keystoneauth first, and make it aware of is_admin_project | 21:22 |
| ayoung | then work backwards to make Global roles happen in Keystone | 21:24 |
| ayoung | that way, people can start writing their policy rules today as soon as KSA hits | 21:24 |
| knikolla | ayoung: i think we might be able to sneak in global roles without a major version bump | 21:26 |
| knikolla | it doesn't change anything in a non backwards compat way | 21:26 |
| ayoung | that is true | 21:26 |
| ayoung | knikolla, I'd try to get the TC blessing on the concept ASAP. Ideally at the PTG | 21:27 |
| knikolla | lbragstad: ^^ | 21:28 |
| lbragstad | noted - we're dedicated almost all of monday and tuesday to policy in the baremetal/vm group | 21:29 |
| *** edmondsw has quit IRC | 21:32 | |
| *** edmondsw has joined #openstack-keystone | 21:34 | |
| *** chrisshattuck has quit IRC | 21:36 | |
| *** chrisshattuck has joined #openstack-keystone | 21:37 | |
| *** edmondsw has quit IRC | 21:38 | |
| kmalloc | the backward incompat change(s) would be like dropping is_admin_project | 21:45 |
| kmalloc | but we could be either/or aware | 21:45 |
| kmalloc | no major bump should be required. | 21:45 |
| lbragstad | kmalloc: going to push a wip patch for migrating assignments | 21:48 |
| lbragstad | kmalloc: it's failing the tests but i'd like to get some early eye on it | 21:48 |
| lbragstad | eyes* | 21:48 |
| kmalloc | sounds good | 21:48 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: WIP: Make assignment type not an Enum https://review.openstack.org/501885 | 21:51 |
| *** itlinux has quit IRC | 21:51 | |
| kmalloc | i need to circle up on my recent patches | 21:51 |
| lbragstad | i do too - i have like 50 patches in review right now | 21:51 |
| kmalloc | too many | 21:52 |
| lbragstad | nevermind 53 - and those are the ones passing jenkins | 21:52 |
| lbragstad | 69 in total =/ | 21:53 |
| gagehugo | knikolla bah ok | 21:53 |
| lbragstad | stepping away for a bit - but i'll be on later | 21:54 |
| *** jamesbenson has quit IRC | 22:03 | |
| *** jamesbenson has joined #openstack-keystone | 22:06 | |
| *** jamesbenson has quit IRC | 22:10 | |
| *** thegreenhundred has quit IRC | 22:11 | |
| kmalloc | lbragstad: commented on the WIP patch | 22:33 |
| *** chlong has joined #openstack-keystone | 22:44 | |
| *** aojea has quit IRC | 22:47 | |
| *** chlong has quit IRC | 22:51 | |
| *** chlong has joined #openstack-keystone | 22:52 | |
| *** thorst has joined #openstack-keystone | 22:54 | |
| *** thorst has quit IRC | 22:59 | |
| *** itlinux has joined #openstack-keystone | 23:04 | |
| *** itlinux has quit IRC | 23:04 | |
| *** chlong_ has joined #openstack-keystone | 23:04 | |
| *** chlong has quit IRC | 23:04 | |
| *** chlong_ has quit IRC | 23:09 | |
| *** chrisshattuck has quit IRC | 23:37 | |
| *** masunkar has joined #openstack-keystone | 23:56 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!