| *** edmondsw has joined #openstack-keystone | 00:09 | |
| *** edmondsw has quit IRC | 00:14 | |
| *** panbalag has joined #openstack-keystone | 00:22 | |
| *** panbalag has left #openstack-keystone | 00:23 | |
| *** odyssey4me has quit IRC | 00:23 | |
| *** odyssey4me has joined #openstack-keystone | 00:23 | |
| *** chenyb4 has joined #openstack-keystone | 00:50 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 01:50 | |
| *** AlexeyAbashkin has quit IRC | 01:54 | |
| *** edmondsw has joined #openstack-keystone | 01:57 | |
| *** alex_xu has joined #openstack-keystone | 01:58 | |
| *** edmondsw has quit IRC | 02:02 | |
| *** sapd_ has joined #openstack-keystone | 02:23 | |
| *** sapd has quit IRC | 02:26 | |
| *** markvoelker has quit IRC | 02:28 | |
| *** markvoelker has joined #openstack-keystone | 02:29 | |
| *** markvoelker has quit IRC | 02:34 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Unified limit update APIs Refactor https://review.openstack.org/559552 | 02:38 |
|---|---|---|
| *** gagehugo has quit IRC | 02:40 | |
| *** gagehugo has joined #openstack-keystone | 02:48 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 02:50 | |
| *** AlexeyAbashkin has quit IRC | 02:55 | |
| *** sonuk has joined #openstack-keystone | 03:26 | |
| *** edmondsw has joined #openstack-keystone | 03:45 | |
| *** annp has joined #openstack-keystone | 03:46 | |
| *** edmondsw has quit IRC | 03:50 | |
| *** abhi89 has joined #openstack-keystone | 03:52 | |
| *** chenyb4 has quit IRC | 04:00 | |
| *** fabian has joined #openstack-keystone | 04:03 | |
| *** fabian is now known as chenyb4 | 04:03 | |
| *** links has joined #openstack-keystone | 04:25 | |
| *** dikonoor has joined #openstack-keystone | 04:47 | |
| *** marius1 has joined #openstack-keystone | 05:08 | |
| *** marius1 has quit IRC | 05:17 | |
| *** edmondsw has joined #openstack-keystone | 05:33 | |
| *** edmondsw has quit IRC | 05:38 | |
| *** marius1 has joined #openstack-keystone | 05:40 | |
| *** zhurong has joined #openstack-keystone | 05:44 | |
| *** abhi89 has quit IRC | 05:45 | |
| *** pcichy has joined #openstack-keystone | 05:59 | |
| *** d0ugal has quit IRC | 06:12 | |
| *** martinus__ has joined #openstack-keystone | 06:20 | |
| *** namnh has joined #openstack-keystone | 06:29 | |
| *** pcaruana has joined #openstack-keystone | 06:35 | |
| *** namnh has quit IRC | 06:46 | |
| *** namnh has joined #openstack-keystone | 06:46 | |
| *** belmoreira has joined #openstack-keystone | 06:49 | |
| *** zhurong has quit IRC | 07:13 | |
| *** tesseract has joined #openstack-keystone | 07:14 | |
| *** namnh has quit IRC | 07:14 | |
| *** namnh has joined #openstack-keystone | 07:14 | |
| *** rcernin has quit IRC | 07:16 | |
| *** edmondsw has joined #openstack-keystone | 07:21 | |
| *** edmondsw has quit IRC | 07:26 | |
| *** d0ugal has joined #openstack-keystone | 07:32 | |
| *** d0ugal has quit IRC | 07:32 | |
| *** d0ugal has joined #openstack-keystone | 07:32 | |
| *** jistr is now known as jistr|dentist | 07:34 | |
| *** aloga has quit IRC | 07:34 | |
| *** aloga has joined #openstack-keystone | 07:34 | |
| *** hoonetorg has quit IRC | 07:59 | |
| *** pcichy has quit IRC | 08:10 | |
| *** pcichy has joined #openstack-keystone | 08:10 | |
| *** hoonetorg has joined #openstack-keystone | 08:12 | |
| *** dikonoor has quit IRC | 08:36 | |
| *** jistr|dentist is now known as jistr | 09:02 | |
| *** alex_xu has quit IRC | 09:03 | |
| hugokuo | Hi Team, | 09:06 |
| hugokuo | While making a request to Swift, there's a header in the response WWW-Authenticate: Keystone uri='http://192.168.56.25:500/v2.0' ` | 09:07 |
| hugokuo | Is this returned by keystonemiddleware? | 09:07 |
| *** alex_xu has joined #openstack-keystone | 09:08 | |
| *** edmondsw has joined #openstack-keystone | 09:10 | |
| *** dikonoor has joined #openstack-keystone | 09:10 | |
| wxy | hugokuo: yeah. https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L681-L683 | 09:11 |
| hugokuo | I'm reading RFC https://tools.ietf.org/html/rfc7235#section-2.1 and https://tools.ietf.org/html/rfc7230#section-3.2.6 . It looks like the string should be quoted by double quote instead of single quote? | 09:11 |
| *** edmondsw has quit IRC | 09:14 | |
| wxy | hugokuo: indeed. The RFC said that. | 09:22 |
| hugokuo | kk | 09:27 |
| hugokuo | I'll file a bug in LP | 09:27 |
| hugokuo | Should it be in keystone's LP or some other place? https://launchpad.net/keystone | 09:33 |
| *** gyankum has joined #openstack-keystone | 09:34 | |
| wxy | https://launchpad.net/keystonemiddleware I think. | 09:34 |
| hugokuo | thx man | 09:34 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Mark the idp's domain_id unique https://review.openstack.org/559676 | 09:35 |
| *** dikonoor has quit IRC | 09:48 | |
| *** namnh has quit IRC | 09:58 | |
| *** marius1 has quit IRC | 09:58 | |
| *** namnh has joined #openstack-keystone | 09:58 | |
| *** ygl has joined #openstack-keystone | 09:59 | |
| ygl | hi all | 09:59 |
| ygl | I am unable to delete other users' stacks as admin user | 09:59 |
| ygl | can someone help me what exactly to modify in the heat policy.json file | 10:00 |
| *** namnh has quit IRC | 10:08 | |
| *** dikonoor has joined #openstack-keystone | 10:10 | |
| ygl | can anyone help me please | 10:16 |
| *** chenyb4 has quit IRC | 10:17 | |
| *** ygl has left #openstack-keystone | 10:17 | |
| *** gyankum has quit IRC | 10:27 | |
| *** nicolasbock has joined #openstack-keystone | 10:34 | |
| *** marius1 has joined #openstack-keystone | 10:42 | |
| *** panbalag has joined #openstack-keystone | 10:44 | |
| *** panbalag has left #openstack-keystone | 10:44 | |
| *** dikonoor has quit IRC | 10:49 | |
| *** marius1 has quit IRC | 10:55 | |
| *** dikonoor has joined #openstack-keystone | 10:57 | |
| *** edmondsw has joined #openstack-keystone | 10:58 | |
| *** edmondsw has quit IRC | 11:03 | |
| *** marius1 has joined #openstack-keystone | 11:05 | |
| *** marius1 has quit IRC | 11:07 | |
| *** sonuk has quit IRC | 11:39 | |
| *** gyankum has joined #openstack-keystone | 11:45 | |
| *** sonuk has joined #openstack-keystone | 12:03 | |
| *** edmondsw has joined #openstack-keystone | 12:04 | |
| *** gyankum has quit IRC | 12:04 | |
| *** raildo has joined #openstack-keystone | 12:04 | |
| *** panbalag has joined #openstack-keystone | 12:31 | |
| *** nicolasbock has quit IRC | 12:33 | |
| *** marius1 has joined #openstack-keystone | 12:34 | |
| *** nicolasbock has joined #openstack-keystone | 12:37 | |
| *** odyssey4me has quit IRC | 12:38 | |
| *** odyssey4me has joined #openstack-keystone | 12:38 | |
| *** dave-mccowan has joined #openstack-keystone | 12:41 | |
| *** dave-mcc_ has joined #openstack-keystone | 12:44 | |
| *** dave-mccowan has quit IRC | 12:45 | |
| *** pcaruana has quit IRC | 12:46 | |
| *** panbalag has left #openstack-keystone | 12:53 | |
| *** panbalag has joined #openstack-keystone | 12:56 | |
| *** panbalag has left #openstack-keystone | 12:57 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 13:01 | |
| *** dikonoo has joined #openstack-keystone | 13:02 | |
| *** dikonoor has quit IRC | 13:06 | |
| *** chenyb4 has joined #openstack-keystone | 13:08 | |
| *** AlexeyAbashkin has quit IRC | 13:10 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 13:10 | |
| *** pcaruana has joined #openstack-keystone | 13:11 | |
| *** AlexeyAbashkin has quit IRC | 13:17 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 13:17 | |
| *** lbragstad has joined #openstack-keystone | 13:27 | |
| *** ChanServ sets mode: +o lbragstad | 13:27 | |
| *** david-lyle has quit IRC | 13:31 | |
| *** markvoelker has joined #openstack-keystone | 13:34 | |
| *** AlexeyAbashkin has quit IRC | 13:34 | |
| *** markvoelker_ has joined #openstack-keystone | 13:36 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 13:37 | |
| *** belmoreira has quit IRC | 13:38 | |
| *** markvoelker has quit IRC | 13:39 | |
| *** idlemind has joined #openstack-keystone | 13:40 | |
| *** dikonoo has quit IRC | 13:42 | |
| *** mvk has quit IRC | 13:42 | |
| *** dikonoo has joined #openstack-keystone | 13:42 | |
| *** dikonoor has joined #openstack-keystone | 13:45 | |
| *** dikonoo has quit IRC | 13:49 | |
| *** r-daneel has joined #openstack-keystone | 13:54 | |
| *** chenyb4 has quit IRC | 14:00 | |
| *** felipemonteiro has joined #openstack-keystone | 14:00 | |
| *** spilla has joined #openstack-keystone | 14:01 | |
| *** markvoelker_ has quit IRC | 14:03 | |
| *** dikonoo has joined #openstack-keystone | 14:04 | |
| *** dikonoor has quit IRC | 14:09 | |
| *** felipemonteiro_ has joined #openstack-keystone | 14:09 | |
| *** felipemonteiro has quit IRC | 14:12 | |
| *** r-daneel_ has joined #openstack-keystone | 14:16 | |
| *** dikonoor has joined #openstack-keystone | 14:18 | |
| *** r-daneel has quit IRC | 14:18 | |
| *** r-daneel_ is now known as r-daneel | 14:18 | |
| openstackgerrit | Doug Hellmann proposed openstack/keystonemiddleware master: add lower-constraints job https://review.openstack.org/555626 | 14:18 |
| *** dikonoor has quit IRC | 14:18 | |
| *** dikonoor has joined #openstack-keystone | 14:19 | |
| *** dikonoo has quit IRC | 14:19 | |
| openstackgerrit | Doug Hellmann proposed openstack/keystoneauth master: add lower-constraints job https://review.openstack.org/555625 | 14:21 |
| *** mvk has joined #openstack-keystone | 14:21 | |
| *** jroll has quit IRC | 14:22 | |
| *** marius1 has quit IRC | 14:22 | |
| *** jroll has joined #openstack-keystone | 14:23 | |
| openstackgerrit | Doug Hellmann proposed openstack/python-keystoneclient master: add lower-constraints job https://review.openstack.org/556142 | 14:26 |
| *** r-daneel has quit IRC | 14:27 | |
| *** belmoreira has joined #openstack-keystone | 14:30 | |
| *** r-daneel has joined #openstack-keystone | 14:35 | |
| kmalloc | Wxy, hugokuo : that may be python library representation. Remember ' and " are both acceptable. Is that actually the header on the wire or what ksm passes down via request. If it is the latter, the rfc doesn't matter, we're in Python and ' is the default. | 14:37 |
| *** ayoung has joined #openstack-keystone | 14:38 | |
| knikolla | o/ | 14:38 |
| *** dklyle has joined #openstack-keystone | 14:51 | |
| *** dikonoor has quit IRC | 14:52 | |
| *** dikonoor has joined #openstack-keystone | 14:53 | |
| *** AlexeyAbashkin has quit IRC | 14:54 | |
| *** marius1 has joined #openstack-keystone | 14:56 | |
| hugokuo | kmalloc: It's not the later one as I know. | 14:58 |
| lbragstad | relatively easy review here - https://review.openstack.org/#/c/558217/7 | 14:59 |
| *** dikonoo has joined #openstack-keystone | 15:00 | |
| *** dikonoor has quit IRC | 15:04 | |
| *** dikonoor has joined #openstack-keystone | 15:04 | |
| *** dikonoo has quit IRC | 15:06 | |
| lbragstad | knikolla: ty | 15:11 |
| knikolla | lbragstad: that's a long != list. | 15:11 |
| knikolla | lbragstad: this should be failing right? https://review.openstack.org/#/c/559435/ | 15:13 |
| knikolla | oh you rebased on top of the fix. | 15:13 |
| knikolla | nice | 15:13 |
| lbragstad | yeah - i was thinking about just merging those two patches together and writing a release note | 15:14 |
| lbragstad | that'd be a pretty easy thing to propose and have ready for tomorrow | 15:15 |
| knikolla | lbragstad: release note with the test or in a separate patch? | 15:17 |
| lbragstad | knikolla: i was going to squash https://review.openstack.org/#/c/546969/4 and https://review.openstack.org/#/c/559435/3 and write a release note | 15:18 |
| lbragstad | so it would all be in one pathc | 15:18 |
| lbragstad | patch* | 15:18 |
| knikolla | lbragstad: sounds good. ping me when you get that up so i can review, both look good. | 15:18 |
| *** felipemonteiro_ has quit IRC | 15:19 | |
| lbragstad | ++ i should be able to get to that after lunch for sure | 15:19 |
| lbragstad | doing a bunch of bug triage now | 15:19 |
| *** felipemonteiro_ has joined #openstack-keystone | 15:19 | |
| lbragstad | knikolla: i did see that new bug you opened about federated login after deleting a shadow user | 15:19 |
| lbragstad | i wonder it that is cache related? | 15:20 |
| hrybacki | lbragstad: have 15 mins to chat default role spec at like 1PM your time? | 15:20 |
| lbragstad | hrybacki: sure | 15:20 |
| hrybacki | lbragstad: ++ | 15:20 |
| lbragstad | my schedule is open today, so just ping me whenever | 15:21 |
| *** marius1 has quit IRC | 15:21 | |
| knikolla | lbragstad: disabling caching and checking real quick. | 15:22 |
| *** marius1 has joined #openstack-keystone | 15:23 | |
| knikolla | lbragstad: yup, disabling caching fixed that. | 15:23 |
| lbragstad | interesting | 15:23 |
| lbragstad | so the shadow user api doesn't clear the cache when a shadow user is deleted? | 15:24 |
| knikolla | looks like it. | 15:24 |
| lbragstad | hmm | 15:24 |
| knikolla | had some students discover it when playing around with mappings. | 15:26 |
| *** prometheanfire has left #openstack-keystone | 15:33 | |
| *** marius1 has quit IRC | 15:33 | |
| *** germs has joined #openstack-keystone | 15:34 | |
| *** germs has quit IRC | 15:34 | |
| *** germs has joined #openstack-keystone | 15:34 | |
| *** germs has quit IRC | 15:35 | |
| *** germs has joined #openstack-keystone | 15:36 | |
| *** germs has quit IRC | 15:36 | |
| *** germs has joined #openstack-keystone | 15:36 | |
| *** links has quit IRC | 15:37 | |
| *** dikonoo has joined #openstack-keystone | 15:39 | |
| lbragstad | kmalloc: hugokuo so is https://bugs.launchpad.net/keystonemiddleware/+bug/1762362 confirmed? | 15:40 |
| openstack | Launchpad bug 1762362 in keystonemiddleware "[RFC] HTTP header field values should be quoted by double quote rather than single-quote" [Undecided,New] | 15:40 |
| *** dikonoor has quit IRC | 15:43 | |
| *** fiddletwix has quit IRC | 15:44 | |
| *** gyee has joined #openstack-keystone | 15:45 | |
| *** fiddletwix has joined #openstack-keystone | 15:45 | |
| *** jdennis has quit IRC | 15:46 | |
| *** timothyb89_ is now known as timothyb89 | 15:46 | |
| *** jdennis has joined #openstack-keystone | 15:46 | |
| *** nicolasbock has quit IRC | 15:52 | |
| *** belmoreira has quit IRC | 15:58 | |
| hugokuo | lbragstad: I filed it. That's confirmed the ksm returned single quote. But if it should follow the RFC will be determined by upstream core team. | 15:59 |
| kmalloc | lbragstad: that might not be ksm, it might be an underlying liv | 16:04 |
| kmalloc | Library | 16:04 |
| kmalloc | * | 16:04 |
| lbragstad | yeah - keystone doesn't use ksm? | 16:04 |
| kmalloc | Not directly, afair | 16:04 |
| kmalloc | I can check when o get home. | 16:05 |
| kmalloc | But my guess is it isn't keystone or ksm. | 16:05 |
| hugokuo | This line in ksm header_val = 'Keystone uri=\'%s\'' % self._auth_uri | 16:06 |
| hugokuo | I tested it by change the code to have double quote and it works as expected. | 16:06 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Allow cleaning up non-existant group assignments https://review.openstack.org/546969 | 16:08 |
| lbragstad | knikolla: ^ | 16:14 |
| *** panbalag has joined #openstack-keystone | 16:17 | |
| *** panbalag has left #openstack-keystone | 16:17 | |
| *** felipemonteiro_ has quit IRC | 16:17 | |
| * lbragstad breaks for lunch | 16:17 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 16:18 | |
| *** spilla has quit IRC | 16:21 | |
| *** spilla has joined #openstack-keystone | 16:22 | |
| yankcrime | lbragstad: some good news for your return - switching keystone's token provider out from uuid to fernet solved my federation-related woes | 16:23 |
| yankcrime | thanks again for the help! | 16:23 |
| *** sonuk has quit IRC | 16:23 | |
| openstackgerrit | Johannes Grassler proposed openstack/keystone-specs master: Add capabilities to application credentials https://review.openstack.org/396331 | 16:25 |
| *** germs has quit IRC | 16:28 | |
| *** germs has joined #openstack-keystone | 16:28 | |
| *** germs has quit IRC | 16:28 | |
| *** germs has joined #openstack-keystone | 16:28 | |
| *** germs has quit IRC | 16:28 | |
| *** germs has joined #openstack-keystone | 16:28 | |
| *** germs has quit IRC | 16:28 | |
| *** germs has joined #openstack-keystone | 16:28 | |
| *** germs has quit IRC | 16:31 | |
| *** germs has joined #openstack-keystone | 16:33 | |
| *** germs has quit IRC | 16:33 | |
| *** germs has joined #openstack-keystone | 16:33 | |
| *** germs has quit IRC | 16:35 | |
| *** tesseract has quit IRC | 16:48 | |
| *** jgwentworth is now known as melwitt | 16:51 | |
| -openstackstatus- NOTICE: zuul was restarted to update to the latest code; please recheck any changes uploaded within the past 10 minutes | 16:51 | |
| kmalloc | yankcrime: i am glad to hear that. | 16:59 |
| kmalloc | yankcrime: i figured that would work for you, but good for confirmation | 16:59 |
| kmalloc | wow, we screwed that up: Www-Authenticate: Keystone uri='http://192.168.56.25:5000/' | 17:01 |
| kmalloc | that looks... wrong somehow | 17:01 |
| kmalloc | not just in the ' vs " | 17:01 |
| *** AlexeyAbashkin has quit IRC | 17:02 | |
| *** david-lyle has joined #openstack-keystone | 17:04 | |
| kmalloc | hugokuo: if you want to propose a fix for ' vs " (and tests) we'll happily take / review it | 17:04 |
| *** germs has joined #openstack-keystone | 17:06 | |
| *** germs has quit IRC | 17:06 | |
| *** germs has joined #openstack-keystone | 17:06 | |
| *** dklyle has quit IRC | 17:07 | |
| lbragstad | yankcrime: awesome! let us know if you run into any other snags :) | 17:08 |
| kmalloc | lbragstad: yeah fixing the quotes is the corrective action in ksm | 17:09 |
| *** AlexeyAbashkin has joined #openstack-keystone | 17:09 | |
| *** germs has quit IRC | 17:09 | |
| *** germs has joined #openstack-keystone | 17:10 | |
| *** germs has quit IRC | 17:10 | |
| *** germs has joined #openstack-keystone | 17:10 | |
| lbragstad | kmalloc: nice | 17:10 |
| lbragstad | i confirmed the bug | 17:10 |
| kmalloc | lbragstad: https://review.openstack.org/#/c/559438/ is ready for eyes/merging | 17:10 |
| *** germs has quit IRC | 17:12 | |
| *** felipemonteiro has joined #openstack-keystone | 17:24 | |
| lbragstad | kmalloc: oh - sweet | 17:26 |
| lbragstad | that was on my list today | 17:26 |
| openstackgerrit | Doug Hellmann proposed openstack/keystoneauth master: add lower-constraints job https://review.openstack.org/555625 | 17:31 |
| kmalloc | jgrassler: o/ need a minor fix for the capabilities | 17:32 |
| kmalloc | jgrassler: but... it can be a follow up | 17:33 |
| *** r-daneel has quit IRC | 17:33 | |
| *** felipemonteiro_ has joined #openstack-keystone | 17:42 | |
| *** marius1 has joined #openstack-keystone | 17:42 | |
| *** mvk has quit IRC | 17:44 | |
| *** felipemonteiro has quit IRC | 17:46 | |
| *** dklyle has joined #openstack-keystone | 17:52 | |
| *** david-lyle has quit IRC | 17:53 | |
| lbragstad | i need to review that today, too | 17:57 |
| *** AlexeyAbashkin has quit IRC | 18:01 | |
| hrybacki | lbragstad: still free? :) | 18:05 |
| *** marius1 has quit IRC | 18:08 | |
| *** panbalag has joined #openstack-keystone | 18:09 | |
| *** panbalag has quit IRC | 18:12 | |
| openstackgerrit | Merged openstack/keystone master: Use the new pysaml2 constraints https://review.openstack.org/558217 | 18:24 |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:28 | |
| *** mvk has joined #openstack-keystone | 18:29 | |
| *** jdennis has quit IRC | 18:30 | |
| *** jdennis has joined #openstack-keystone | 18:30 | |
| *** dikonoo has quit IRC | 18:47 | |
| *** marius1 has joined #openstack-keystone | 18:58 | |
| *** AlexeyAbashkin has quit IRC | 19:09 | |
| ayoung | lbragstad, hrybacki kmalloc so as prep for my talk at summit...I wrote a second article on Istio and Keystone, this time looking into RBAC. https://adam.younglogic.com/2018/04/comparing-keystone-and-istio-rbac/ this is on top of what I wrote before https://adam.younglogic.com/2018/04/comparing-istio-and-keystone-middleware/ | 19:32 |
| ayoung | and knikolla and cmurphy of course...just didn't see you actively posting. But Everyone.... | 19:44 |
| knikolla | ayoung: i'll have a look. never found the time to dive into istio though i've heard it mentioned to me multiple times. | 19:48 |
| ayoung | knikolla, pretty sure it is "keystone middleware for Kubernetes based services" | 19:48 |
| knikolla | ayoung: not limited to that though | 19:49 |
| ayoung | plus a few other things, like a mutual Cert validation layer, but its the RBAC part that interests me | 19:49 |
| knikolla | and it is the other part that interests me :) | 19:55 |
| lbragstad | ldap developer docs available https://docs.openstack.org/devstack/latest/guides/devstack-with-ldap.html | 19:55 |
| *** marius1 has quit IRC | 20:03 | |
| *** pcichy has quit IRC | 20:04 | |
| hrybacki | ayoung: domain scope was pulled from the spec -- look back in the comments for more detail about that | 20:15 |
| hrybacki | tl;dr there is no 'real' domain scope (yet) | 20:15 |
| ayoung | hrybacki, it is in the examples | 20:15 |
| hrybacki | hanging chad, needs to be pulled as well. Good catch | 20:15 |
| ayoung | hrybacki, no | 20:16 |
| ayoung | hrybacki, domain scope needs to be put back in there, or domains themselves need to go away | 20:16 |
| hrybacki | ayoung: domain scope will come, and we will add it then. This was discussed in length | 20:16 |
| ayoung | Horizon now has support for domain scoped tokens | 20:16 |
| ayoung | it is a real thing | 20:16 |
| hrybacki | I'll let cmurphy weigh in here. We can emulate domain scope but it's not actually domain scope | 20:17 |
| ayoung | I'm more concerned about the Implied Roles comment | 20:17 |
| ayoung | hrybacki, cloudsamplev2 is in wide usage | 20:17 |
| ayoung | domain scope is real, its just not in default policy | 20:17 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json | 20:18 |
| ayoung | hrybacki, so I'd recommend putting domain scoped back in, and you can caveat it that way | 20:19 |
| hrybacki | ayoung: that was my literal approach but I was dissuaded by cmurphy and the team agreed | 20:20 |
| ayoung | hrybacki, you were right and they were wrong. | 20:21 |
| ayoung | :) | 20:21 |
| hrybacki | ayoung: I disagree with you know and past Harry :P | 20:21 |
| ayoung | hrybacki, so, if the goal is to make Domain scoping go away, I would be in full support | 20:22 |
| ayoung | however, users and groups are not owned by projects, and I absolutetly should not need a System scoped token to create either | 20:22 |
| ayoung | I mean, I know domains were a mistake | 20:23 |
| ayoung | but they are not one was can sweep under the rug now | 20:23 |
| hrybacki | All arguments I raised, the team discussed, and rejected | 20:23 |
| hrybacki | I agree with them now (to be clear) | 20:23 |
| kmalloc | domain scoping can be sidelines | 20:23 |
| kmalloc | we cannot remove it/make it go away | 20:23 |
| kmalloc | because it is part of the v3 api | 20:23 |
| kmalloc | sidelined* and/or suggested to "not be used" | 20:24 |
| hrybacki | WRT implied roles. Our aim (at the project level) is make these alterations by way of policy file changes that move into policy-in-code after being vetted | 20:24 |
| hrybacki | simple, quick, and easily modifiable. Customers will /really/ start to flip if we don't offer these things soon | 20:25 |
| hrybacki | implied roles were also discussed in length (during one of the office hours sessions IIRC) | 20:26 |
| ayoung | hrybacki, it was a tool built explicitly to aid in this problem | 20:28 |
| hrybacki | ayoung: that doesn't mean it's right for right now | 20:29 |
| hrybacki | we really need to keep this as simple as possible right now | 20:29 |
| hrybacki | maybe I misunderstand how you are advising we use them here. But minor mods to policy files is acceptable other projects and the team after a lot of discussion at PTG | 20:30 |
| ayoung | hrybacki, simple: | 20:31 |
| ayoung | create 2 rules | 20:31 |
| ayoung | admin implies memember | 20:31 |
| ayoung | member implies reader | 20:31 |
| ayoung | or auditor whatever it is called | 20:31 |
| ayoung | tag the API with the Lowest level role | 20:31 |
| ayoung | no need for the OR statements | 20:31 |
| ayoung | for project scoped apis, you still need the right system scoped role to get at it | 20:32 |
| hrybacki | I see what you are suggesting now. Create the implications during the bootstrap process and keep the policy files clean as possible? | 20:32 |
| ayoung | so you could give someone system:auditor and they can read all of the auditor roles | 20:32 |
| ayoung | yep | 20:32 |
| hrybacki | okay, I have to run to an appt. I'm gonna reflect on this while I walk | 20:32 |
| ayoung | cool | 20:33 |
| kmalloc | lbragstad: responded to your comments | 20:35 |
| kmalloc | need some more feedback before I post an updated patch | 20:35 |
| *** pcaruana has quit IRC | 20:36 | |
| lbragstad | kmalloc: ack - | 20:39 |
| lbragstad | thoughts on https://bugs.launchpad.net/keystone/+bug/1729933 ? | 20:39 |
| openstack | Launchpad bug 1729933 in OpenStack Identity (keystone) "region update doesn't update extras" [Undecided,In progress] - Assigned to David Lyle (david-lyle) | 20:39 |
| ayoung | kmalloc, do you honestly thinkg there is an alternative to doing domain scoped for users and groups? DO we honestly want to make people system admins in order to add new users? Adding users should be cheap...its role assignements that are dangerous. | 20:39 |
| kmalloc | ayoung: no, i am not advocating for anything it was just a comment | 20:51 |
| ayoung | cool | 20:51 |
| kmalloc | ayoung: we can sideline we can say don't do this, we cannot remove the functionality from keystone | 20:51 |
| kmalloc | lbragstad: ugh, extras | 20:51 |
| kmalloc | lbragstad: sigh | 20:52 |
| lbragstad | =/ yeah... | 20:52 |
| ayoung | kmalloc, lbragstad one topic I want to discuss at the summit is multi-site OpenStack deployements where the different regions/sites are on different versions of OpenStack. | 20:52 |
| kmalloc | lbragstad: if it never worked for region, even if the table exists, i'll -2 any added extras support | 20:52 |
| ayoung | Something like the hub-and-spoke model, where a central keystone just forwards to another keystone | 20:52 |
| kmalloc | ayoung: theoretically possible with federation | 20:53 |
| kmalloc | realistically... unknown | 20:53 |
| lbragstad | i think the domain scope thing with users and group can still happen, i don't expect it to be system-scope for ever | 20:53 |
| lbragstad | if you're referencing the default roles specification | 20:53 |
| *** spilla has quit IRC | 20:55 | |
| *** r-daneel has joined #openstack-keystone | 21:00 | |
| kmalloc | lbragstad: just commented on the bug | 21:03 |
| kmalloc | lbragstad: basically if we can show regions EVER supported "Extras" we need to add it back in | 21:03 |
| *** harlowja has joined #openstack-keystone | 21:03 | |
| *** martinus__ has quit IRC | 21:03 | |
| kmalloc | else, nope, nope, not doing it, no, nope, no thanks | 21:03 |
| kmalloc | though I am not opposed to a Region['VendorData'] like thing | 21:03 |
| kmalloc | that is explicitly outlined as deployment specific | 21:04 |
| kmalloc | [AND is a little smarter, like Resource-Opts is, where a "None" clears the value] | 21:04 |
| ayoung | kmalloc, I think there is a little bit more to it than just Federation. I'll try to write up a decent agenda. | 21:07 |
| ayoung | lbragstad, are we going to have breakout rooms for design, or has all of that been conceded to the PTGs? | 21:07 |
| *** r-daneel has quit IRC | 21:15 | |
| *** spilla has joined #openstack-keystone | 21:16 | |
| *** r-daneel has joined #openstack-keystone | 21:16 | |
| lbragstad | ayoung: i don't think so | 21:17 |
| lbragstad | i think the rooms we get are for large discussions | 21:18 |
| lbragstad | like cross-project things | 21:18 |
| lbragstad | or feedback sessions | 21:18 |
| lbragstad | e.g. i don't think we'd get a room to work on keystone-specific things | 21:18 |
| lbragstad | they're also time-boxed to 40 minutes or so | 21:18 |
| ayoung | lbragstad, OK, so multi-site is a cross project topic. | 21:21 |
| ayoung | lbragstad, what I am realizing now is that even if there are multiple openstacks in a single org, they need to be only loosly-unified. If that makes sense | 21:21 |
| ayoung | like, maybe you only upgrade one at a time | 21:22 |
| ayoung | but you still want a unified Keystone scheme for them | 21:22 |
| kmalloc | there is no reason you can't use a bleeding edge keystone with an ancient <everything else> | 21:22 |
| ayoung | and thus having a database sync | 21:22 |
| kmalloc | and regions can be other deploys. | 21:22 |
| *** edmondsw has quit IRC | 21:22 | |
| ayoung | kmalloc, heh yes there is. and it has n othing to do with Keystone | 21:22 |
| kmalloc | i think that is how most orgs end up doing it | 21:22 |
| ayoung | and everything to do with our deployment tool | 21:22 |
| kmalloc | this sounds like an inflexible deployment tool :P | 21:23 |
| kmalloc | but yeah, that is how i've seen folks crack that nut | 21:23 |
| kmalloc | it's still not pretty | 21:23 |
| ayoung | but I think having DB sync between version of Keystone is a reasonable design discussion | 21:23 |
| kmalloc | i.. well | 21:23 |
| kmalloc | i think this sounds kindof awful | 21:24 |
| ayoung | like, how to make a deployment work when one part is on Q and one is on R and one is on S | 21:24 |
| *** edmondsw has joined #openstack-keystone | 21:24 | |
| ayoung | nAH | 21:24 |
| kmalloc | everyone use "S" keystone *shiftyeyes* | 21:24 |
| ayoung | THey named it for Brian? | 21:24 |
| ayoung | https://www.linkedin.com/in/brian-stein-7b659b/ | 21:24 |
| kmalloc | in all honesty, i would refrain from referencing "db" anywhere in it. | 21:24 |
| kmalloc | simply so as to circumvent the convo around db-replication :P | 21:25 |
| ayoung | kmalloc yep | 21:25 |
| kmalloc | so, what I *think* you're looking for is something we sortof proposed in the past. | 21:25 |
| ayoung | kmalloc, the other convo I want to have is "how do I delete a project without orphaning the majority of my resources" | 21:26 |
| ayoung | ah...pause on mine...go on | 21:26 |
| kmalloc | something that may intercept a keystone call and replicate it [public interface] to other keystones via rest. | 21:26 |
| kmalloc | and some mechanism to "replay"/"catchup" | 21:26 |
| ayoung | thing is, our REST Apis are not create firendly, as they tend to allocate new IDs | 21:28 |
| kmalloc | but- it wont scale out. | 21:28 |
| ayoung | we'd want to make sure that a new Create is done with the ID from the server that has the right to create that record | 21:28 |
| kmalloc | i was actually thinking of something that would be a dogpile proxy, and it would talk to other dogpile proxies | 21:28 |
| kmalloc | originally | 21:28 |
| *** edmondsw has quit IRC | 21:29 | |
| kmalloc | but it has a lot of potential issues. | 21:29 |
| ayoung | My original view was that, in a multi-keystone deployment, each keystone server would be canonical for a subset of domains, and could write data for those, but only read data for other domains | 21:29 |
| ayoung | I'm not wedded to that impl, but I think the bones is | 21:29 |
| kmalloc | so you'd capture at just below the manager layer, and replicate that out to the other keystones | 21:29 |
| ayoung | "what data can I write locally, and what do I need to sync" | 21:30 |
| ayoung | I'm not sure where capture would happen. I think I'd be pretty flexible on the impl | 21:30 |
| kmalloc | it would need to be below the manager i think.. | 21:31 |
| kmalloc | but there are a lot of issues with "what if someone did an update for some new data that R dodens't know about via the S keystone and that is forwarded" | 21:31 |
| kmalloc | i think it's kindof going to be full of awful pitfalls/ | 21:31 |
| ayoung | kmalloc, right. But on the other hand, we can map it out, and at least start sketching out a solution | 21:33 |
| ayoung | We couild even say "it starts with K2K | 21:33 |
| ayoung | "but we need to keep data in sync" | 21:33 |
| kmalloc | i'd need to talk more, but honestly, i think k2k still solves 95-99% of what you're asking for | 21:34 |
| kmalloc | and really only has a lower bound of minimum supportable keystone | 21:35 |
| ayoung | kmalloc, I'm OK with K2K as the basis. Just want to map out the full use cases, including how to automate project creation and mapping. | 21:46 |
| *** raildo has quit IRC | 21:50 | |
| *** spilla has quit IRC | 22:12 | |
| *** rcernin has joined #openstack-keystone | 22:14 | |
| *** r-daneel has quit IRC | 22:15 | |
| *** r-daneel has joined #openstack-keystone | 22:16 | |
| *** r-daneel has quit IRC | 22:32 | |
| *** r-daneel has joined #openstack-keystone | 22:32 | |
| *** felipemonteiro_ has quit IRC | 22:36 | |
| *** dave-mcc_ has quit IRC | 22:49 | |
| *** r-daneel has quit IRC | 23:07 | |
| *** lbragstad has quit IRC | 23:17 | |
| *** lbragstad has joined #openstack-keystone | 23:36 | |
| *** ChanServ sets mode: +o lbragstad | 23:36 | |
| *** lbragstad has quit IRC | 23:47 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!