| *** zhurong has joined #openstack-keystone | 00:03 | |
| *** panbalag has joined #openstack-keystone | 00:15 | |
| *** zhurong has quit IRC | 00:20 | |
| *** panbalag has left #openstack-keystone | 00:23 | |
| *** phalmos_ has quit IRC | 00:29 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:38 | |
| *** Dinesh_Bhor has quit IRC | 00:49 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:50 | |
| Dinesh_Bhor | cmurphy: Hi, you there? Want to discuss about this: https://review.openstack.org/#/c/267456/16 | 00:54 |
|---|---|---|
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth master: Updated from global requirements https://review.openstack.org/537056 | 00:57 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/537057 | 00:57 |
| *** zhurong has joined #openstack-keystone | 00:58 | |
| *** nicolasbock has quit IRC | 00:58 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/ldappool master: Updated from global requirements https://review.openstack.org/534941 | 00:59 |
| *** r-daneel has quit IRC | 01:01 | |
| lbragstad | did gerrit just slow down for anyone else? | 01:12 |
| gagehugo | it's been slow for me all day | 01:14 |
| lbragstad | :/ | 01:15 |
| *** Dinesh_Bhor has quit IRC | 01:15 | |
| lbragstad | fyi - i pulled https://review.openstack.org/#/c/530490/ off the end of the queue since it's not dependent on any of the system token work | 01:15 |
| lbragstad | all the stuff needed for that API already merged | 01:15 |
| gagehugo | ok | 01:16 |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:19 | |
| *** aselius has quit IRC | 01:19 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add release note for system-scope https://review.openstack.org/528039 | 01:21 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update documentation to reflect system-scope https://review.openstack.org/530133 | 01:21 |
| *** david-lyle has quit IRC | 01:22 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy master: Updated from global requirements https://review.openstack.org/537146 | 01:25 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/523791 | 01:27 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient master: Updated from global requirements https://review.openstack.org/537164 | 01:29 |
| *** panbalag has joined #openstack-keystone | 01:31 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/ldappool master: Updated from global requirements https://review.openstack.org/534941 | 01:58 |
| *** dikonoor has joined #openstack-keystone | 02:03 | |
| *** panbalag has quit IRC | 02:08 | |
| *** Dinesh_Bhor has quit IRC | 02:15 | |
| *** Dinesh__Bhor has joined #openstack-keystone | 02:15 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/523791 | 02:18 |
| *** harlowja has quit IRC | 02:20 | |
| *** dikonoo has joined #openstack-keystone | 02:22 | |
| *** dikonoor has quit IRC | 02:22 | |
| *** gyee has quit IRC | 02:31 | |
| *** wxy has joined #openstack-keystone | 02:33 | |
| *** gongysh has joined #openstack-keystone | 02:35 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Improve limit sql backend https://review.openstack.org/535587 | 02:49 |
| *** aojea has joined #openstack-keystone | 02:49 | |
| *** aojea_ has joined #openstack-keystone | 02:53 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add limit provider https://review.openstack.org/524109 | 02:54 |
| *** aojea has quit IRC | 02:56 | |
| *** zhurong has quit IRC | 02:57 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Implement policies for limits https://review.openstack.org/530143 | 02:58 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Expose unified limit APIs https://review.openstack.org/524110 | 02:58 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add api-ref for unified limits https://review.openstack.org/535688 | 02:58 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add limit provider https://review.openstack.org/524109 | 03:00 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Implement policies for limits https://review.openstack.org/530143 | 03:01 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Expose unified limit APIs https://review.openstack.org/524110 | 03:01 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add api-ref for unified limits https://review.openstack.org/535688 | 03:01 |
| *** aojea_ has quit IRC | 03:03 | |
| *** david-lyle has joined #openstack-keystone | 03:31 | |
| *** david-lyle has quit IRC | 03:32 | |
| *** david-lyle has joined #openstack-keystone | 03:33 | |
| *** charleswang has joined #openstack-keystone | 03:37 | |
| *** david-lyle has quit IRC | 03:39 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add limit provider https://review.openstack.org/524109 | 03:43 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Implement policies for limits https://review.openstack.org/530143 | 03:43 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Expose unified limit APIs https://review.openstack.org/524110 | 03:43 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add api-ref for unified limits https://review.openstack.org/535688 | 03:43 |
| charleswang | @here I see below zuul error for review https://review.openstack.org/#/c/506340/ . I can reproduce locally with devstack and tox. Can someone familiar with keystone database take a look. I have no idea how to fix it. | 03:44 |
| charleswang | oslo_db.exception.DBNonExistentConstraint: (pymysql.err.InternalError) (1091, u"Can't DROP 'user_domain_id_fkey'; check that column/key exists") [SQL: u'ALTER TABLE user DROP FOREIGN KEY user_domain_id_fkey'] | 03:45 |
| *** annp has joined #openstack-keystone | 03:48 | |
| lbragstad | wxy: posted a possible solution to the try/except question - https://review.openstack.org/#/c/535587/4 | 03:49 |
| wxy | lbragstad: looking. :) | 03:49 |
| vish_18 | lbragstad: https://bugs.launchpad.net/keystone/+bug/1714937 | 03:49 |
| openstack | Launchpad bug 1714937 in OpenStack Identity (keystone) "keystone returns 500 on password change" [Low,Confirmed] - Assigned to Vishakha Agarwal (vishakha.agarwal) | 03:49 |
| vish_18 | Had some query regarding this bug | 03:50 |
| lbragstad | vish_18: sure thing | 03:57 |
| lbragstad | reading the report again quick | 03:57 |
| vish_18 | lbragstad: As per my understanding "Fernet " is a non-persistent token which is not stored in any DB. When a user tries to change the password, keystone deletes and revokes all the tokens specific to that user. In case of Fernet it should look for any persistent DB. | 03:58 |
| lbragstad | yeah - that would be one option | 03:59 |
| vish_18 | lbragstad: I made some changes regarding this. Should I share the patch with you? | 04:00 |
| lbragstad | vish_18: absolutely, are you able to propose it for review using gerrit? | 04:01 |
| vish_18 | lbragstad: Not yet. | 04:02 |
| vish_18 | lbragstad: I will do it | 04:02 |
| lbragstad | that'd be great if possible | 04:02 |
| vish_18 | lbragstad: ok. Thanks | 04:03 |
| lbragstad | vish_18: do you have a gerrit account setup already? | 04:03 |
| vish_18 | lbragstad: yes i have | 04:04 |
| lbragstad | charleswang: it looks like the patch it expecting to remove a fk but it's not actually in the database | 04:05 |
| lbragstad | or the test database | 04:05 |
| lbragstad | charleswang: if you run that migration against a real database and not SQLite, does it execute properly? | 04:06 |
| *** gongysh has quit IRC | 04:07 | |
| wxy | lbragstad: have to go for lunch now. I will update the patch later. | 04:08 |
| lbragstad | wxy: sounds good - just an option | 04:08 |
| lbragstad | cmurphy: hrybacki - keystone queens bug list is up for review https://etherpad.openstack.org/p/keystone-queens-bug-list | 04:10 |
| *** dave-mccowan has quit IRC | 04:27 | |
| *** gongysh has joined #openstack-keystone | 04:29 | |
| *** blake has joined #openstack-keystone | 04:29 | |
| *** vish_18 has quit IRC | 04:29 | |
| *** annp has quit IRC | 04:33 | |
| *** annp has joined #openstack-keystone | 04:34 | |
| *** pramodrj07 has quit IRC | 04:39 | |
| *** Dinesh__Bhor has quit IRC | 04:40 | |
| *** Dinesh__Bhor has joined #openstack-keystone | 04:40 | |
| openstackgerrit | Merged openstack/ldappool master: Updated from global requirements https://review.openstack.org/534941 | 04:41 |
| *** masber has joined #openstack-keystone | 04:42 | |
| openstackgerrit | Merged openstack/keystoneauth master: Updated from global requirements https://review.openstack.org/537056 | 04:47 |
| *** blake has quit IRC | 04:48 | |
| gagehugo | lbragstad approved some of the scope changes, lets see if the gate takes :) | 05:06 |
| * gagehugo heads to bed | 05:07 | |
| gagehugo | wxy o/ | 05:07 |
| *** dikonoo has quit IRC | 05:12 | |
| charleswang | lbragstad: I cannot find where "user_domain_id_fkey" is defined in the keystone repo. | 05:17 |
| *** harlowja has joined #openstack-keystone | 05:19 | |
| *** dikonoor has joined #openstack-keystone | 05:29 | |
| *** links has joined #openstack-keystone | 05:32 | |
| openstackgerrit | Gao Fei proposed openstack/keystone-specs master: Replace curly quotes with straight quotes https://review.openstack.org/537259 | 05:40 |
| *** Sandy619 has joined #openstack-keystone | 05:41 | |
| *** Sandy619 has quit IRC | 05:46 | |
| *** dikonoor has quit IRC | 05:51 | |
| *** dikonoor has joined #openstack-keystone | 05:52 | |
| *** clayton has quit IRC | 05:58 | |
| *** Dinesh__Bhor has quit IRC | 05:59 | |
| *** rcernin_ has joined #openstack-keystone | 06:03 | |
| *** rcernin has quit IRC | 06:03 | |
| *** clayton has joined #openstack-keystone | 06:04 | |
| *** dikonoor has quit IRC | 06:06 | |
| *** dikonoor has joined #openstack-keystone | 06:06 | |
| *** Dinesh__Bhor has joined #openstack-keystone | 06:08 | |
| *** dikonoor has quit IRC | 06:15 | |
| *** blake has joined #openstack-keystone | 06:28 | |
| *** dikonoor has joined #openstack-keystone | 06:30 | |
| *** threestrands has joined #openstack-keystone | 06:39 | |
| *** blake has quit IRC | 06:46 | |
| *** blake has joined #openstack-keystone | 06:46 | |
| *** Dinesh__Bhor has quit IRC | 06:46 | |
| *** blake has quit IRC | 06:47 | |
| *** threestrands has quit IRC | 06:49 | |
| *** Dinesh__Bhor has joined #openstack-keystone | 06:50 | |
| *** Dinesh__Bhor has quit IRC | 06:52 | |
| *** Dinesh__Bhor has joined #openstack-keystone | 06:52 | |
| *** blake has joined #openstack-keystone | 07:02 | |
| *** annp has quit IRC | 07:10 | |
| *** pcaruana has joined #openstack-keystone | 07:10 | |
| *** rcernin has joined #openstack-keystone | 07:12 | |
| *** rcernin_ has quit IRC | 07:12 | |
| *** Dinesh__Bhor has quit IRC | 07:17 | |
| *** pcaruana has quit IRC | 07:21 | |
| *** pcaruana has joined #openstack-keystone | 07:22 | |
| *** markvoelker has quit IRC | 07:25 | |
| *** markvoelker has joined #openstack-keystone | 07:27 | |
| *** markvoelker has quit IRC | 07:32 | |
| *** charleswang has quit IRC | 07:41 | |
| *** adriant has quit IRC | 07:53 | |
| *** adriant has joined #openstack-keystone | 07:53 | |
| *** itlinux has joined #openstack-keystone | 07:56 | |
| *** pcaruana has quit IRC | 08:01 | |
| evrardjp | good morning | 08:07 |
| evrardjp | cmurphy: thanks a lot on the quick response there. | 08:09 |
| evrardjp | also, how long is your upgrade test broken? | 08:10 |
| evrardjp | omg zuul queue... | 08:19 |
| evrardjp | patches waiting there for 16h50. | 08:19 |
| *** blake has quit IRC | 08:20 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:23 | |
| *** itlinux has quit IRC | 08:24 | |
| *** tesseract has joined #openstack-keystone | 08:27 | |
| *** pcaruana has joined #openstack-keystone | 08:39 | |
| *** dikonoo has joined #openstack-keystone | 08:41 | |
| *** dikonoor has quit IRC | 08:42 | |
| cmurphy | evrardjp: the bug was merged on monday, our test isn't broken it just doesn't test on mariadb 10.2 :) | 08:42 |
| *** rcernin has quit IRC | 08:44 | |
| evrardjp | cmurphy: no I mean the current one | 08:46 |
| cmurphy | evrardjp: oh the osa upgrade test? | 08:47 |
| evrardjp | openstack-ansible-keystone-rolling-upgrade | 08:47 |
| evrardjp | yes | 08:47 |
| cmurphy | evrardjp: i'm not sure, i don't think i've ever seen it working | 08:47 |
| evrardjp | I am worried :D | 08:47 |
| evrardjp | mmm | 08:47 |
| cmurphy | was going to ask you guys about it after feature freeze | 08:47 |
| evrardjp | I will put that into my todolist. | 08:47 |
| evrardjp | yeah ofc! | 08:47 |
| cmurphy | awesome | 08:47 |
| evrardjp | we want our tests to be reliable! | 08:48 |
| evrardjp | else it's not worth it, nobody would watch them :p | 08:48 |
| cmurphy | exactly | 08:48 |
| *** tesseract has quit IRC | 08:54 | |
| *** tesseract has joined #openstack-keystone | 09:03 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Improve limit sql backend https://review.openstack.org/535587 | 09:06 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add limit provider https://review.openstack.org/524109 | 09:06 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Implement policies for limits https://review.openstack.org/530143 | 09:06 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Expose unified limit APIs https://review.openstack.org/524110 | 09:06 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add api-ref for unified limits https://review.openstack.org/535688 | 09:06 |
| *** harlowja has quit IRC | 09:07 | |
| *** freerunner has quit IRC | 09:08 | |
| *** itlinux has joined #openstack-keystone | 09:12 | |
| *** freerunner has joined #openstack-keystone | 09:14 | |
| *** markvoelker has joined #openstack-keystone | 09:28 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Closes-Bug: #1714937 https://review.openstack.org/537322 | 09:34 |
| openstack | bug 1714937 in OpenStack Identity (keystone) "keystone returns 500 on password change" [Low,Confirmed] https://launchpad.net/bugs/1714937 - Assigned to Vishakha Agarwal (vishakha.agarwal) | 09:34 |
| *** markvoelker has quit IRC | 10:02 | |
| *** jaosorior has quit IRC | 10:16 | |
| *** jaosorior has joined #openstack-keystone | 10:17 | |
| *** sambetts|afk is now known as sambetts | 10:20 | |
| *** dikonoo has quit IRC | 10:21 | |
| *** dikonoo has joined #openstack-keystone | 10:33 | |
| *** rcernin has joined #openstack-keystone | 10:34 | |
| *** dikonoo has quit IRC | 10:48 | |
| *** AlexeyAbashkin has quit IRC | 10:53 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 10:54 | |
| *** markvoelker has joined #openstack-keystone | 10:58 | |
| *** gongysh has quit IRC | 11:16 | |
| *** sapd_ has quit IRC | 11:19 | |
| *** sapd_ has joined #openstack-keystone | 11:19 | |
| *** itlinux has quit IRC | 11:23 | |
| *** markvoelker has quit IRC | 11:32 | |
| *** itlinux has joined #openstack-keystone | 11:38 | |
| *** mvenesio has joined #openstack-keystone | 11:45 | |
| *** dave-mccowan has joined #openstack-keystone | 12:09 | |
| *** zhurong has joined #openstack-keystone | 12:10 | |
| *** mvk has quit IRC | 12:19 | |
| *** raildo has joined #openstack-keystone | 12:27 | |
| *** markvoelker has joined #openstack-keystone | 12:29 | |
| *** mvk has joined #openstack-keystone | 12:31 | |
| *** yangzhenyu_ has joined #openstack-keystone | 12:39 | |
| yangzhenyu_ | cmurphy, hi, I have some question about application-credentials. Do I need a token when create the application-credentials? If I need a token, is not it still required username and password? | 12:43 |
| cmurphy | yangzhenyu_: to create one, yes you need a token which you would get with a usernamd and password. After you've created it, you can use it to get a new token without a username and password. | 12:50 |
| *** mvk has quit IRC | 12:56 | |
| *** efried_back_wed is now known as efried | 12:58 | |
| yangzhenyu_ | cmurphy, Thanks, | 13:03 |
| yangzhenyu_ | However, application credentials encourage not to save the user name and password to the configuration file. Where do the usernames and passwords of application credentials come from? | 13:03 |
| *** markvoelker has quit IRC | 13:03 | |
| yangzhenyu_ | Also, for service components like Nova, where does it save the key after obtaining an application credential? | 13:04 |
| yangzhenyu_ | After I read the spec file, it's not clear to me, I need your help, thanks. | 13:05 |
| cmurphy | yangzhenyu_: you create an application credential the same way you create any other resource the way you do today, you need a username and password from your openrc or clouds.yaml. after you've created it, you can use the application credential "id" and "secret" to authenticate | 13:06 |
| cmurphy | a service component like nova would put `application_credential_id` and `application_credential_secret` in their [keystone_authtoken] section to authenticate with it | 13:07 |
| cmurphy | yangzhenyu_: i'll be writing up docs in the next week or so so hopefully it'll be more clear | 13:08 |
| yangzhenyu_ | Thank you | 13:08 |
| yangzhenyu_ | That is to say, the user name and password still need to write to the configuration file. Just replace the username and password in the component configuration file with the application credentials. I mainly want to understand the difference between the use and the previous. | 13:11 |
| yangzhenyu_ | cmurphy, However, one of the more crucial issues to be solved in the spec file is to avoid saving the username and password to the configuration file. | 13:15 |
| cmurphy | yangzhenyu_: you're right, there is still a kind of username and password we're just calling id and secret. The difference is 1) if the application credential is compromised, that doesn't mean the user is compromised (especially important for ldap and federated users) 2) the application credential can be rotated without downtime | 13:17 |
| cmurphy | avoiding writing down any kind of secrets in config files is a different problem that the oslo people are working on solving | 13:17 |
| yangzhenyu_ | cmurphy, However, for components like nova, we still have to write the application credentials to the configuration file. How to do rotate without downtime? | 13:21 |
| *** edmondsw has joined #openstack-keystone | 13:21 | |
| *** edmondsw_ has joined #openstack-keystone | 13:22 | |
| cmurphy | yangzhenyu_: you create a new application credential with the same permissions as the old one, and then can just update the [keystone_authtoken] config with the new id and secret | 13:24 |
| cmurphy | where in the case of changing say the nova service user password you would have to first change the password with keystone, which would break nova temporarily until you have a chance to update the config file | 13:25 |
| yangzhenyu_ | cmurphy, I think update the nova.conf for section [keystone_authtoken], it need to restart the nova service. | 13:26 |
| *** edmondsw has quit IRC | 13:26 | |
| cmurphy | yangzhenyu_: yes, so not 0 downtime but much less than the downtime between making the update in keystone and making the update in nova | 13:27 |
| cmurphy | yangzhenyu_: it's also possible we could make that config option not need a service restart in the future https://review.openstack.org/#/c/534605/ | 13:28 |
| yangzhenyu_ | cmurphy, | 13:29 |
| yangzhenyu_ | Ok, Thank you, I probably understand. Looking forward to your more detailed documentation. | 13:29 |
| cmurphy | yangzhenyu_: great :) happy to answer any other questions if you think of any | 13:30 |
| yangzhenyu_ | That's great! | 13:30 |
| openstackgerrit | Merged openstack/keystone master: Fix column rename migration for mariadb 10.2 https://review.openstack.org/536869 | 13:47 |
| *** AlexeyAbashkin has quit IRC | 13:47 | |
| *** rcernin has quit IRC | 13:47 | |
| *** daidv has quit IRC | 13:50 | |
| *** mvk has joined #openstack-keystone | 13:56 | |
| *** panbalag has joined #openstack-keystone | 13:58 | |
| *** markvoelker has joined #openstack-keystone | 14:00 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 14:00 | |
| *** jaosorior has quit IRC | 14:05 | |
| *** panbalag has left #openstack-keystone | 14:12 | |
| *** links has quit IRC | 14:15 | |
| *** zhurong has quit IRC | 14:18 | |
| *** markvoelker has quit IRC | 14:27 | |
| *** markvoelker has joined #openstack-keystone | 14:27 | |
| *** AlexeyAbashkin has quit IRC | 14:33 | |
| cmurphy | anyone awake yet? would be really good to get https://review.openstack.org/#/c/524415/ and https://review.openstack.org/#/c/534965/ gating asap | 14:43 |
| lbragstad | o/ | 14:44 |
| cmurphy | \o | 14:44 |
| lbragstad | damn... | 14:44 |
| cmurphy | ya sorry lbragstad | 14:44 |
| lbragstad | we have a couple things creeping closer to the gate | 14:47 |
| knikolla | o/ | 14:47 |
| *** aselius has joined #openstack-keystone | 14:49 | |
| gagehugo | o/ | 14:54 |
| *** markvoelker has quit IRC | 14:55 | |
| knikolla | cmurphy: kicked both reviews through :) | 14:58 |
| * knikolla goes to get breakfast now | 14:58 | |
| *** markvoelker has joined #openstack-keystone | 14:59 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 15:00 | |
| cmurphy | knikolla: yay ty :D | 15:00 |
| lbragstad | i can hear zuul grinding from my house | 15:03 |
| knikolla | lbragstad: pardon, i think that's my stomach.haha | 15:04 |
| lbragstad | lol | 15:04 |
| lbragstad | we can start queuing up this series too since the mariadb 10.2 patch merged https://review.openstack.org/#/c/524423/41 | 15:13 |
| hrybacki | woo! | 15:15 |
| hrybacki | lbragstad: I have to provide some int. training during the policy meeting time today fyi =/ | 15:15 |
| lbragstad | hrybacki: no worries - i don't think much is going to be happening today during the meeting anyway | 15:16 |
| lbragstad | there isn't anything on the agenda | 15:16 |
| *** itlinux has quit IRC | 15:16 | |
| hrybacki | ack | 15:17 |
| *** itlinux has joined #openstack-keystone | 15:18 | |
| *** dave-mccowan has quit IRC | 15:22 | |
| -openstackstatus- NOTICE: gerrit has been suffering from a full disk, some mails may have been lost in the last couple of hours. we will now restart gerrit to address ongoing slowness, too | 15:24 | |
| cmurphy | huh i was wondering about that ^ | 15:24 |
| *** mvenesio has quit IRC | 15:29 | |
| *** panbalag has joined #openstack-keystone | 15:29 | |
| *** Guest28399 is now known as mgagne | 15:33 | |
| *** mgagne has joined #openstack-keystone | 15:33 | |
| *** edmondsw_ is now known as edmondsw | 15:34 | |
| *** charleswnag has joined #openstack-keystone | 15:36 | |
| *** itlinux has quit IRC | 15:40 | |
| *** dave-mccowan has joined #openstack-keystone | 15:46 | |
| *** david-lyle has joined #openstack-keystone | 15:50 | |
| *** jose-phi_ has joined #openstack-keystone | 15:52 | |
| *** jose-phillips has quit IRC | 15:54 | |
| *** AlexeyAbashkin has quit IRC | 16:05 | |
| lbragstad | fwiw - the unified limit series is back up | 16:07 |
| openstackgerrit | Merged openstack/python-keystoneclient master: Add system role functionality https://review.openstack.org/524415 | 16:13 |
| openstackgerrit | Merged openstack/python-keystoneclient master: Add CRUD support for application credentials https://review.openstack.org/534965 | 16:15 |
| lbragstad | also - https://review.openstack.org/#/c/524416/ seems to be failing because we don't have a new ksa release yet, but we're working on it | 16:23 |
| *** spilla has joined #openstack-keystone | 16:23 | |
| lbragstad | it is ready for reviews even though Zuul -1'd it | 16:23 |
| cmurphy | lbragstad: ksa or ksc? | 16:24 |
| cmurphy | i don't think that is going to work without a ksc release | 16:24 |
| lbragstad | ksa i think | 16:25 |
| cmurphy | it has a depends-on on the ksc change | 16:25 |
| lbragstad | http://logs.openstack.org/16/524416/2/check/openstack-tox-py27/ffe040f/job-output.txt.gz#_2018-01-22_21_25_51_306034 | 16:25 |
| lbragstad | i think it's tripping on a missing attribute that was added in ksa | 16:25 |
| lbragstad | well - now that we have the pending ksc patches merged, i can do a ksc release | 16:26 |
| cmurphy | \o/ | 16:26 |
| cmurphy | but that will also need a requirements bump before osc can consume it | 16:27 |
| lbragstad | ack - i'll get that rolling asap then | 16:27 |
| lbragstad | huh - the github mirror hasn't updated yet | 16:29 |
| lbragstad | https://review.openstack.org/537445 | 16:30 |
| cmurphy | http://git.openstack.org/cgit/openstack/python-keystoneclient/commit/?id=1e8c9302fc055f78964f3eaef32e09dae89eb2fa who needs github :P | 16:30 |
| lbragstad | inorite? | 16:31 |
| *** pcaruana has quit IRC | 16:35 | |
| *** AJaeger has joined #openstack-keystone | 16:45 | |
| *** AJaeger has left #openstack-keystone | 16:45 | |
| openstackgerrit | CHARLES WANG proposed openstack/keystone master: Delete users before deleting domains https://review.openstack.org/506340 | 16:46 |
| *** gagehugo__ has joined #openstack-keystone | 16:49 | |
| *** gyee has joined #openstack-keystone | 16:59 | |
| *** nkinder has quit IRC | 16:59 | |
| *** hrybacki is now known as hrybacki_mtg | 17:04 | |
| openstackgerrit | Merged openstack/keystone master: Add scope_types to domain policies https://review.openstack.org/525705 | 17:12 |
| *** gagehugo__ has quit IRC | 17:14 | |
| *** gyee has quit IRC | 17:15 | |
| *** charleswnag has quit IRC | 17:27 | |
| *** mvk has quit IRC | 17:35 | |
| *** pramodrj07 has joined #openstack-keystone | 17:37 | |
| knikolla | if anyone's interested, i'm working on a self-service ui/api for our cloud to allow users to request new projects, invite users to their owned projects, and manage the members. | 17:38 |
| knikolla | will open source it next week. | 17:38 |
| lbragstad | knikolla: nice - i'd like to have a look | 17:40 |
| lbragstad | knikolla: is that going to benefit from the system scope stuff eventually? | 17:40 |
| lbragstad | s/is/i hope/ | 17:41 |
| knikolla | lbragstad: yes and no. no, because ownership of a project is defined by a special role on the project, so it's project scoped assignment. yes, because i called this special role project_admin, which is super confusing cause today that means something else, but with system scope that concept will go away. | 17:42 |
| *** nkinder has joined #openstack-keystone | 17:44 | |
| lbragstad | gotcha | 17:44 |
| knikolla | lbragstad: but on the other hand. the microservice only really needs identity access. so scope { system: 'identity' } will be nice. | 17:44 |
| lbragstad | right.. instead of access as a cloud administrator | 17:45 |
| lbragstad | that's cool | 17:45 |
| knikolla | it works well with SSO, because user's have no permissions when they first sign up. so they're redirected to the project request form. | 17:46 |
| *** aojea has joined #openstack-keystone | 17:46 | |
| knikolla | oh, and by the way we have SSO now in our cloud :) | 17:46 |
| lbragstad | sweet! i bet that's nice to have now, i remember you talking about that | 17:49 |
| *** mvenesio has joined #openstack-keystone | 17:49 | |
| knikolla | lbragstad: it will be, it's currently unusable because we have tooling in place that creates users and projects in keystone based on users filling a google form and a it being approved in a google spreadsheet. | 17:51 |
| knikolla | no one really understand the code written to do that since the engineer who did it left a while ago. | 17:51 |
| *** Tahvok has quit IRC | 17:51 | |
| lbragstad | ahhh | 17:52 |
| knikolla | so even if people can log in, they don't have permissions. | 17:52 |
| *** Tahvok has joined #openstack-keystone | 17:52 | |
| openstackgerrit | OpenStack Release Bot proposed openstack/keystoneauth master: Update reno for stable/queens https://review.openstack.org/537494 | 18:00 |
| openstackgerrit | OpenStack Release Bot proposed openstack/keystonemiddleware master: Update reno for stable/queens https://review.openstack.org/537497 | 18:01 |
| *** david-lyle has quit IRC | 18:04 | |
| openstackgerrit | OpenStack Release Bot proposed openstack/oslo.policy master: Update reno for stable/queens https://review.openstack.org/537550 | 18:06 |
| *** sambetts is now known as sambetts|afk | 18:08 | |
| *** tesseract has quit IRC | 18:08 | |
| *** hrybacki_mtg is now known as hrybacki | 18:14 | |
| *** panbalag1 has joined #openstack-keystone | 18:22 | |
| *** panbalag has quit IRC | 18:24 | |
| *** panbalag1 has left #openstack-keystone | 18:29 | |
| *** pramodrj07 has quit IRC | 18:31 | |
| *** Pramod has joined #openstack-keystone | 18:31 | |
| *** phalmos has joined #openstack-keystone | 18:32 | |
| cmurphy | kmalloc: around? could you look at https://review.openstack.org/#/c/501148/ so we can close https://bugs.launchpad.net/keystone/+bug/1566416 ? | 18:43 |
| openstack | Launchpad bug 1566416 in OpenStack Security Advisory "Keystone does not validate that s3tokens requests came from s3_token middleware" [Undecided,Incomplete] | 18:43 |
| *** Pramod has quit IRC | 18:56 | |
| *** yangzhenyu__ has joined #openstack-keystone | 19:04 | |
| *** yangzhenyu_ has quit IRC | 19:08 | |
| *** david-lyle has joined #openstack-keystone | 19:17 | |
| *** pcaruana has joined #openstack-keystone | 19:27 | |
| *** pcaruana has quit IRC | 19:27 | |
| cmurphy | if someone would like to take a look at https://review.openstack.org/#/c/524423/41 and https://review.openstack.org/#/c/525346/32 that will get that stack rolling :) | 19:30 |
| *** muttley has joined #openstack-keystone | 19:32 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 19:34 | |
| *** harlowja has joined #openstack-keystone | 19:38 | |
| *** AlexeyAbashkin has quit IRC | 19:38 | |
| gagehugo | cmurphy I'll redeploy but those should be fine, they worked for me when I tested it last week | 19:39 |
| lbragstad | yes - please | 19:40 |
| lbragstad | fwiw - i'm working on a client for the registered limit stuff in case that helps anyone with reviews | 19:40 |
| openstackgerrit | OpenStack Release Bot proposed openstack/python-keystoneclient master: Update reno for stable/queens https://review.openstack.org/537630 | 19:46 |
| *** muttley has quit IRC | 19:48 | |
| *** dave-mccowan has quit IRC | 19:58 | |
| *** dtruong has joined #openstack-keystone | 20:20 | |
| kmalloc | cmurphy: done | 20:25 |
| cmurphy | kmalloc: ty | 20:26 |
| cmurphy | lbragstad: wxy I've been wondering today if maybe we could have some kind of trial period or feature branch for unified limits for a cycle instead of merging it/making it "supported" this release | 20:29 |
| cmurphy | i feel like we need to write a library around it and develop the flat model and give the other projects a chance to play with it so we can shake out issues in the API | 20:29 |
| lbragstad | so we can have api breaking changes | 20:30 |
| lbragstad | if we do a feature branch, how do people deploy it if they are feeling dangerous? | 20:30 |
| cmurphy | not sure | 20:31 |
| cmurphy | I just feel like the REST API on its own is not that useful and doesn't really *need* to be here this cycle, but once we get a better feeling of how this is going to work end-to-end we might want to change it but it'll be too late | 20:32 |
| cmurphy | just wanted to float a what-if | 20:35 |
| lbragstad | so - i think the last time we talked about something like this it was with the swift team | 20:35 |
| lbragstad | if we do a feature branch, we'd have to rebase it somewhat regularly so that people deploying the feature can stay relatively close to master | 20:36 |
| cmurphy | sure | 20:36 |
| lbragstad | and they'd be required to deploy from source | 20:36 |
| lbragstad | afaik | 20:36 |
| cmurphy | I don't really feel like that's a problem, the feature is not that useful to end-users until the other openstack services start consuming it | 20:37 |
| cmurphy | so i don't think there will be operators in the wild using the feature branch | 20:37 |
| lbragstad | sure.. | 20:38 |
| lbragstad | or customer specific services... | 20:38 |
| cmurphy | yeah i guess | 20:38 |
| lbragstad | but... i'm not sure how likely that is | 20:38 |
| * lbragstad shrug | 20:38 | |
| lbragstad | one other concern that might not be a concern... idk... is having a plan once we make a feature branch | 20:39 |
| lbragstad | i wouldn't want to get into the habit of just rebasing it and not actively working on a plan to make it proper | 20:39 |
| lbragstad | again - i could be paranoid | 20:40 |
| cmurphy | not paranoid, would be good to have a solid plan | 20:40 |
| lbragstad | i just worry that rocky comes up and we are on the verge of releasing it and it's like" | 20:41 |
| lbragstad | "oh, crap, we didn't do anything with limits..." | 20:41 |
| *** dave-mccowan has joined #openstack-keystone | 20:41 | |
| cmurphy | the plan thing is sort of what's concerning me now, it feels like we're about to release a thing and we don't have a plan for after it's released | 20:42 |
| lbragstad | that's the *best* way to releas | 20:42 |
| lbragstad | it's like letting wild animals out at the zoo! | 20:42 |
| cmurphy | lol | 20:42 |
| lbragstad | but yeah - i see what you mean | 20:43 |
| lbragstad | i think fungi was also involved in the feature branch discussion we had.. | 20:43 |
| cmurphy | maybe it doesn't have to be a feature branch, maybe just don't merge the controller and api-ref this particular week | 20:43 |
| cmurphy | give us some time in the rocky cycle to develop some utilities around it | 20:44 |
| *** itlinux has joined #openstack-keystone | 20:44 | |
| cmurphy | idk | 20:44 |
| lbragstad | yeah... | 20:45 |
| lbragstad | without knowing all the details about feature branches.. that feels a little more complete to me | 20:45 |
| lbragstad | not sure how much of a difference that makes | 20:45 |
| *** belmoreira has joined #openstack-keystone | 20:51 | |
| cmurphy | (I don't want to discourage people from reviewing the limits stack https://review.openstack.org/#/c/535587 :) ) | 20:52 |
| lbragstad | i can hop on tonight with wxy and see what we come up with | 20:53 |
| lbragstad | i'd like his input | 20:53 |
| cmurphy | yes definitely | 20:53 |
| cmurphy | the reason i was thinking about it was i was playing with limits and found this API awkward http://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/limits-api.html#update-project-limits | 20:56 |
| cmurphy | i think it seemed reasonable when we merged the spec | 20:57 |
| cmurphy | but it makes me wonder if it will be awkward when we build utilities around it | 20:57 |
| cmurphy | and on the one hand we should merge it because that's what we agreed to in the spec but on the other hand then we're stuck with it if it turns out to be weird | 20:57 |
| lbragstad | yeah... and this isn't the first time warts like this have happened | 21:04 |
| lbragstad | between the spec process and the implementation | 21:04 |
| lbragstad | what do you find odd about the update limit api? | 21:05 |
| *** chason has quit IRC | 21:10 | |
| cmurphy | it's using a PUT to update a whole batch yet it requires IDs for each individual item | 21:12 |
| lbragstad | oh - yea... | 21:13 |
| cmurphy | I remember we were wondering whether these things should have IDs and we came out on the side of having IDs but it's still slightly awkward | 21:13 |
| lbragstad | i guess that is a bit strange... | 21:13 |
| gagehugo | cmurphy worked fine for me :) | 21:14 |
| cmurphy | gagehugo: \o/ | 21:15 |
| *** chason has joined #openstack-keystone | 21:15 | |
| cmurphy | on the other hand it's definitely never going to be perfect so maybe best to get keystone able to serve *something* and put the fine-tuning in the clients/libraries | 21:17 |
| *** raildo has quit IRC | 21:17 | |
| lbragstad | yeah - that's kinda where i was going with the plan bit... | 21:18 |
| lbragstad | it we put it off, we need a plan in place for how we are going to improve it and what we're going to improve by a specific date | 21:19 |
| lbragstad | otherwise i just think it'll keep slipping | 21:19 |
| lbragstad | or it will be easier for it to | 21:19 |
| *** yangzhenyu__ has quit IRC | 21:20 | |
| *** yangzhenyu__ has joined #openstack-keystone | 21:20 | |
| *** aojea_ has joined #openstack-keystone | 21:21 | |
| *** aojea_ has quit IRC | 21:21 | |
| cmurphy | yeah | 21:21 |
| *** aojea has quit IRC | 21:23 | |
| cmurphy | if it's merged it's definitely easier for anyone to pick it up and build on it | 21:23 |
| *** ayoung has joined #openstack-keystone | 21:24 | |
| *** dave-mccowan has quit IRC | 21:25 | |
| lbragstad | agreed | 21:28 |
| *** threestrands has joined #openstack-keystone | 21:41 | |
| *** threestrands_ has joined #openstack-keystone | 21:44 | |
| *** threestrands_ has quit IRC | 21:44 | |
| *** threestrands_ has joined #openstack-keystone | 21:44 | |
| openstackgerrit | Lance Bragstad proposed openstack/python-keystoneclient master: WIP: functionality for registered limits https://review.openstack.org/537668 | 21:47 |
| lbragstad | wxy: ^ | 21:47 |
| *** threestrands has quit IRC | 21:47 | |
| lbragstad | i noticed a few things that are out of line with the specification while working on that | 21:47 |
| lbragstad | we'll either have to update the specification or update the implementation | 21:47 |
| lbragstad | https://review.openstack.org/#/c/530490/ could use another set of eyes | 21:50 |
| gagehugo | lbragstad I will take a look once I get home later today at the system scope stuff | 21:51 |
| lbragstad | gagehugo: thanks! | 21:51 |
| gagehugo | too many meetings today :( | 21:51 |
| gagehugo | system scope seems pretty close | 21:51 |
| lbragstad | i still seem to be having an issue with https://review.openstack.org/#/c/530410/ but i have absolutely no idea what is happening there | 21:52 |
| lbragstad | seems like a tempest thing? | 21:52 |
| gagehugo | oh it is 401'ing | 21:53 |
| lbragstad | yeah... but tempest doesn't know how to do anything with system scope yet and we're not enforce_scope on policies.. which would result in a different 403 anyway | 21:55 |
| gagehugo | :? | 21:55 |
| *** spilla has quit IRC | 21:57 | |
| *** belmoreira has quit IRC | 22:00 | |
| *** mvenesio has quit IRC | 22:05 | |
| *** rcernin has joined #openstack-keystone | 22:14 | |
| lbragstad | cmurphy: do we have the ability to label things as experimental still? | 22:27 |
| *** rcernin has quit IRC | 22:29 | |
| *** jrist has quit IRC | 22:29 | |
| *** jrist has joined #openstack-keystone | 22:30 | |
| cmurphy | lbragstad: i don't think so | 22:31 |
| *** rcernin has joined #openstack-keystone | 22:31 | |
| lbragstad | http://paste.openstack.org/show/652844/ | 22:32 |
| lbragstad | looks like we do :) | 22:32 |
| lbragstad | we mark three other APIs as experimental | 22:32 |
| cmurphy | which ones? | 22:32 |
| lbragstad | implied_roles | 22:33 |
| lbragstad | role_inference | 22:33 |
| lbragstad | well - two implied_roles APIs and one role_inference API | 22:33 |
| cmurphy | wow | 22:34 |
| cmurphy | those should maybe be promoted | 22:34 |
| lbragstad | lol | 22:34 |
| cmurphy | afaik we're treating all our APIs as stable | 22:34 |
| lbragstad | yeah - that's what i've been told | 22:34 |
| knikolla | that's like gmail's beta tag | 22:34 |
| cmurphy | lol | 22:35 |
| lbragstad | i'd love to use the experimental tag more | 22:35 |
| cmurphy | we totally could https://specs.openstack.org/openstack/api-wg/guidelines/api_interoperability.html#new-or-experimental-services-and-versioning | 22:36 |
| lbragstad | so - if i'm reading the right... | 22:37 |
| lbragstad | that just requires that we mark the limit and registered limit apis as experimental | 22:37 |
| lbragstad | or do we really have to pull it out into a separate service? | 22:38 |
| cmurphy | hmm it looks like they were going to define it better and it didn't quite make it https://review.openstack.org/#/c/273158/ | 22:39 |
| lbragstad | huh | 22:40 |
| lbragstad | so i wonder if that means we can still use what we have to mark things as experimental or not? | 22:40 |
| cmurphy | part of what mordred's been working on seems to define it somewhat https://review.openstack.org/#/c/459710/17/guidelines/discoverability.rst | 22:42 |
| cmurphy | it would need its own endpoint | 22:42 |
| lbragstad | nice | 22:44 |
| lbragstad | https://review.openstack.org/#/c/459710/17/guidelines/discoverability.rst@278 | 22:44 |
| lbragstad | it's own endpoint or an entirely new service? | 22:44 |
| lbragstad | i've heard /v3/auth/tokens as being an "endpoint" | 22:45 |
| lbragstad | unless i skimmed the definition | 22:45 |
| mordred | oh - the word 'endpoint' is highly over subscribed | 22:46 |
| lbragstad | there he is | 22:46 |
| lbragstad | mordred: right, it totally is | 22:46 |
| mordred | endpoint in the context that matters here is 'thing that can be found from the catalog' | 22:46 |
| lbragstad | mordred: what's your interpretation of it at https://review.openstack.org/#/c/459710/17/guidelines/discoverability.rst@278 ? | 22:46 |
| lbragstad | hmm | 22:46 |
| lbragstad | ok | 22:47 |
| cmurphy | that would mean the version endpoint like /v3 | 22:47 |
| mordred | yah | 22:47 |
| *** edmondsw has quit IRC | 22:47 | |
| mordred | I haven't read all the scrollback though ... | 22:47 |
| lbragstad | technically, i can discover subsystems of an endpoint though... | 22:47 |
| cmurphy | mordred: we're just wondering if we can add an experimental API | 22:47 |
| mordred | yes. I mean - honestly, from my POV, as long as you have a *something* that I can query somewhere to find out if that experimental thing exists | 22:48 |
| lbragstad | like this - https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_versions.py#L358-L362 | 22:48 |
| mordred | to *me* that's fine ... like swift has a /info endpint that returns sets of flags you can use to check to see if swift can do a particular thing | 22:49 |
| mordred | lbragstad: how is 'hints': {'status': 'experimental'} exposed? | 22:50 |
| lbragstad | for example - https://github.com/openstack/keystone/blob/master/keystone/assignment/routers.py#L60-L92 | 22:50 |
| lbragstad | its in the json home document | 22:50 |
| * lbragstad double checks | 22:50 | |
| mordred | lbragstad: I may not have ever seen the json home document | 22:51 |
| cmurphy | is that discoverable via GET /v3 though? | 22:51 |
| *** itlinux has quit IRC | 22:51 | |
| lbragstad | curl -X GET -H 'Accept: application/json-home' http://192.168.122.160:35357/v3/ | 22:52 |
| lbragstad | it returns a big ole hot mess of a response... | 22:53 |
| lbragstad | curl -X GET -H 'Accept: application/json-home' http://192.168.122.160:35357/v3/ | python -m json.tool | 22:53 |
| lbragstad | makes it readable | 22:53 |
| cmurphy | oh interesting | 22:53 |
| mordred | fascinating | 22:53 |
| * mordred goes to play | 22:53 | |
| lbragstad | snippet | 22:55 |
| lbragstad | http://paste.openstack.org/raw/652878/ | 22:55 |
| lbragstad | ^ experimental | 22:55 |
| mordred | wow. FASCINATING | 22:56 |
| lbragstad | :) | 22:56 |
| cmurphy | lol well if mordred didn't know about this then it's probably safe to say not many other people do either | 22:56 |
| lbragstad | i remember bknudson working on that a *long* time ago | 22:56 |
| lbragstad | so... | 22:57 |
| lbragstad | does that mean it's discoverable?! :D | 22:57 |
| mordred | well... | 22:58 |
| mordred | a few things, just as an fyi | 22:58 |
| mordred | https://docs.openstack.org/api/openstack-identity/3/rel/implied_role <-- that URL is wrong if it's supposed to be a URL to the API docs | 22:58 |
| lbragstad | yeah - we've had bugs opened about that... | 22:59 |
| lbragstad | gagehugo: worked on it | 22:59 |
| mordred | BUT | 22:59 |
| mordred | yah - I think that seems like good discoverability | 22:59 |
| lbragstad | \o/ | 23:00 |
| mordred | lbragstad: it would be nice if there was a way for me to get from GET /roles/{prior_role_id}/implies/{implied_role_id} to https://docs.openstack.org/api/openstack-identity/3/rel/implied_role in the document | 23:01 |
| mordred | but I guess that could be done by reading, parsing and making an inverted mapping on href-template | 23:01 |
| mordred | (trying to think forward to ways in which I could expose an "experimental=True" flag somewhere and have SDK not expose calls to APIs that are listed as experimental or something | 23:02 |
| *** itlinux has joined #openstack-keystone | 23:02 | |
| lbragstad | hmmm | 23:03 |
| mordred | but that's just dict manipulation - the informatoin is there and is queryable | 23:03 |
| mordred | I wonder how many other services have jsonhome and I didn't know | 23:03 |
| lbragstad | i have no idea... | 23:03 |
| lbragstad | cmurphy: thoughts? | 23:04 |
| mordred | barbican, freezer and zaqar seem to have code doing somethign with application/json-home at least | 23:06 |
| cmurphy | i don't think we've done a great job of communicating that we have experimental APIs | 23:06 |
| cmurphy | so i'd be worried about someone getting bit by that | 23:07 |
| cmurphy | but | 23:07 |
| cmurphy | this isn't likely to be used by end users yet | 23:07 |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1674676 | 23:07 |
| openstack | Launchpad bug 1674676 in OpenStack Identity (keystone) "The URL listed against the details of identity resources returns 404 Not Found error" [Medium,Fix released] - Assigned to Gage Hugo (gagehugo) | 23:07 |
| lbragstad | dstanek: described the usaeg of those links | 23:08 |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1674676/comments/3 | 23:08 |
| cmurphy | it still doesn't make a lot of sense for us to choose docs.openstack.org a part of an unresolveable URN | 23:09 |
| cmurphy | as part* | 23:09 |
| mordred | oh god. is this another thing like the extra-broken xmlns spec where the thing that looks like a url isn't actually a url? | 23:10 |
| cmurphy | lol don't you love those | 23:10 |
| lbragstad | cmurphy: i feel like we need to have a session on this at the PTG | 23:10 |
| mordred | (I had tim bray jump up and down yelling about how it was not an actual url and we should all get over it once. I still contend he's completely and utterly wrong and the design of that system is an example of epic amounts of hubris and design failure) | 23:10 |
| cmurphy | lbragstad: on experimental APIs or on limits in particular? | 23:11 |
| cmurphy | either way yes | 23:11 |
| lbragstad | cool | 23:11 |
| mordred | like - if you want a thing that's just a unique identifier - cool - just don't prefix it with the letters 'http://' | 23:11 |
| lbragstad | well - we'll have a session on limits regardless | 23:11 |
| lbragstad | but i think we either need to fix the json-home stuff or something... | 23:11 |
| lbragstad | because mordred is proving our case for us | 23:12 |
| mordred | because THOSE tell me it's describing a location that can be fetched over HTTP | 23:12 |
| lbragstad | json-home works for discoverability, which is good, it's just a little confusing when people go to use it | 23:12 |
| lbragstad | i feel like we should either fix it or redo it | 23:12 |
| cmurphy | yeah | 23:13 |
| lbragstad | the obvious benefit being we just build on the existing discovery mechanism we've had forever | 23:13 |
| mordred | ++ - and that honestly other people should have too | 23:13 |
| lbragstad | who knows, maybe we'll come up with improved processes for using it | 23:14 |
| * lbragstad is an optimist | 23:14 | |
| mordred | lbragstad: btw: https://en.wikipedia.org/wiki/Uniform_Resource_Name | 23:16 |
| mordred | my reading of that communicates to me that a more appropriate key might be 'urn:openstack:api:identity:3:rel:implied_role' and then I won't tell stories about xml | 23:18 |
| lbragstad | 'The term "URN" continues now as one of more than a hundred URI "schemes", urn:, paralleling http:, ftp:, and so forth. URIs of the urn: scheme are not locators, are not required to be associated with a particular protocol or access method, and need not be resolvable.' | 23:18 |
| mordred | lbragstad: yup | 23:18 |
| lbragstad | yeah.. | 23:18 |
| lbragstad | i agree the that http bits make it imply something it doesn't | 23:19 |
| lbragstad | or shouldn't according to the definition | 23:19 |
| lbragstad | i feel better about moving forward with the unified limit stuff if we can mark it as experimental | 23:20 |
| cmurphy | ++ | 23:20 |
| lbragstad | mordred: sounds like you're going to probably have some feedback on json-home at the PTG? | 23:21 |
| lbragstad | or ways that we can try and improve what we have implemented? | 23:21 |
| mordred | ugh. and now I'm off reading RFCs :) | 23:21 |
| mordred | lbragstad: honestly I think what;s there right now is totally workable and better than if it's not there | 23:22 |
| mordred | lbragstad: most of this is me being an ass and quibbling with semantic mistakes people have made while defining RFCs with their heads shoved in a dark hole | 23:22 |
| *** itlinux has quit IRC | 23:23 | |
| lbragstad | lol | 23:24 |
| lbragstad | fair enought - either way, we'll probably talk about it in dublin | 23:24 |
| lbragstad | cmurphy: updated https://review.openstack.org/#/c/524110/50 | 23:24 |
| lbragstad | that was good - i feel good about that... | 23:25 |
| * lbragstad has the warm fuzzys | 23:25 | |
| cmurphy | :D | 23:26 |
| lbragstad | do we wanna mark anything else as experimental this release? | 23:29 |
| mordred | lbragstad, cmurphy: well - y'all win the prize for having the coolest and most comprehensive api discoverability in all of openstack | 23:30 |
| cmurphy | mordred: yay \o/ | 23:30 |
| mordred | lbragstad, cmurphy: and I'm now going to turn my shame cannon on everyone else for being yutzes and NOT having json-home documents | 23:31 |
| cmurphy | mordred: excellent | 23:31 |
| lbragstad | lol | 23:31 |
| cmurphy | lbragstad: i feel pretty solid about application credentials, i think that's worth committing to non-experimentally | 23:31 |
| lbragstad | cmurphy: ++ | 23:31 |
| cmurphy | system scope also feels solid to me and it's super urgent | 23:32 |
| lbragstad | awesome - those should be some easy patches to respin and we should be ablet o get them gating tomorrow | 23:37 |
| lbragstad | focus on flushing bugs out of the APIs during Rocky and work on the whole enforcement model thing... | 23:37 |
| *** phalmos has quit IRC | 23:55 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!