| *** empty_cup has quit IRC | 00:15 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:22 | |
| *** markvoelker has quit IRC | 00:25 | |
| *** deepika08 has joined #openstack-keystone | 00:37 | |
| *** felipemonteiro has joined #openstack-keystone | 01:50 | |
| *** felipemonteiro has quit IRC | 01:56 | |
| *** dklyle has quit IRC | 01:57 | |
| *** david-lyle has joined #openstack-keystone | 01:57 | |
| *** masber has joined #openstack-keystone | 02:09 | |
| *** dave-mccowan has quit IRC | 02:13 | |
| *** wxy has joined #openstack-keystone | 02:16 | |
| *** gyee has quit IRC | 02:17 | |
| *** markvoelker has joined #openstack-keystone | 02:26 | |
| *** felipemonteiro has joined #openstack-keystone | 02:29 | |
| *** redrobot has quit IRC | 02:31 | |
| *** felipemonteiro has quit IRC | 02:37 | |
| *** panbalag has joined #openstack-keystone | 02:45 | |
| *** david-lyle has quit IRC | 02:45 | |
| *** deepika08 has quit IRC | 02:47 | |
| *** masuberu has joined #openstack-keystone | 02:52 | |
| *** masber has quit IRC | 02:52 | |
| *** markvoelker has quit IRC | 02:56 | |
| *** markvoelker has joined #openstack-keystone | 02:57 | |
| *** panbalag has quit IRC | 02:58 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Enable Foreign keys for sql backend unit test https://review.openstack.org/558029 | 03:01 |
|---|---|---|
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Enable foreign keys for test_v3_catalog https://review.openstack.org/558193 | 03:02 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Enable foreign keys for unit test https://review.openstack.org/558193 | 03:04 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: [DNM] Enable FK for unit tests by default https://review.openstack.org/558185 | 03:05 |
| *** sapd has quit IRC | 03:08 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Do not return all the limits for POST request. https://review.openstack.org/550736 | 03:10 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Unified limit update APIs Refactor https://review.openstack.org/559552 | 03:10 |
| *** namnh has joined #openstack-keystone | 03:14 | |
| *** nicolasbock has quit IRC | 03:31 | |
| *** masuberu has quit IRC | 04:47 | |
| *** links has joined #openstack-keystone | 04:50 | |
| *** zeus has quit IRC | 05:04 | |
| *** belmoreira has joined #openstack-keystone | 05:22 | |
| *** dklyle has joined #openstack-keystone | 05:47 | |
| *** jaosorior has joined #openstack-keystone | 06:07 | |
| *** sapd has joined #openstack-keystone | 06:16 | |
| *** martinus__ has joined #openstack-keystone | 06:24 | |
| *** dklyle has quit IRC | 06:29 | |
| *** pcichy has joined #openstack-keystone | 06:29 | |
| *** pcichy has quit IRC | 06:39 | |
| *** jaosorior has quit IRC | 06:41 | |
| *** pcichy has joined #openstack-keystone | 06:41 | |
| *** annp has joined #openstack-keystone | 06:48 | |
| *** rcernin_ has joined #openstack-keystone | 06:50 | |
| *** rcernin has quit IRC | 06:51 | |
| *** rcernin_ has quit IRC | 07:05 | |
| *** tesseract has joined #openstack-keystone | 07:25 | |
| *** dklyle has joined #openstack-keystone | 07:34 | |
| *** belmoreira has quit IRC | 07:37 | |
| *** aloga has quit IRC | 07:52 | |
| *** aloga has joined #openstack-keystone | 07:52 | |
| *** belmoreira has joined #openstack-keystone | 08:01 | |
| *** pcaruana has joined #openstack-keystone | 08:08 | |
| *** belmoreira has quit IRC | 08:10 | |
| *** belmoreira has joined #openstack-keystone | 08:11 | |
| *** aloga has quit IRC | 08:21 | |
| *** vegarl has quit IRC | 08:43 | |
| *** vegarl has joined #openstack-keystone | 08:44 | |
| yankcrime | thanks lbragstad - i'll take a look now | 08:46 |
| *** Dinesh_Bhor has quit IRC | 08:48 | |
| *** namnh has quit IRC | 08:50 | |
| *** namnh has joined #openstack-keystone | 08:51 | |
| *** dklyle has quit IRC | 08:56 | |
| *** dklyle has joined #openstack-keystone | 09:15 | |
| *** belmoreira has quit IRC | 09:16 | |
| *** dklyle has quit IRC | 09:26 | |
| *** namnh has quit IRC | 09:55 | |
| *** namnh has joined #openstack-keystone | 09:56 | |
| *** namnh has quit IRC | 09:59 | |
| *** raildo has joined #openstack-keystone | 10:15 | |
| *** rabel has joined #openstack-keystone | 10:26 | |
| rabel | hi there. can anyone explain role inheritance in openstack to me or provide a link where i could read it up? | 10:27 |
| *** annp has quit IRC | 10:37 | |
| *** nicolasbock has joined #openstack-keystone | 10:42 | |
| *** belmoreira has joined #openstack-keystone | 11:02 | |
| *** r-daneel has quit IRC | 11:04 | |
| *** panbalag has joined #openstack-keystone | 11:06 | |
| *** panbalag has quit IRC | 11:06 | |
| *** jaosorior has joined #openstack-keystone | 11:08 | |
| *** r-daneel has joined #openstack-keystone | 11:11 | |
| *** jaosorior has quit IRC | 11:16 | |
| *** dklyle has joined #openstack-keystone | 11:25 | |
| *** mvk has quit IRC | 11:40 | |
| *** panbalag has joined #openstack-keystone | 11:43 | |
| *** panbalag has quit IRC | 11:45 | |
| *** dklyle has quit IRC | 11:50 | |
| *** edmondsw has joined #openstack-keystone | 12:13 | |
| *** edmondsw has quit IRC | 12:13 | |
| *** edmondsw has joined #openstack-keystone | 12:13 | |
| *** sonuk has joined #openstack-keystone | 12:27 | |
| *** alex_xu has quit IRC | 12:29 | |
| andreykurilin | hi folks! I have a strange case. I'm trying to create a role 'Foo', keystone returns 409 error - 'duplicate entry found '. But I cannot find role "Foo" while listing all roles. How this can be fixed? Any ideas? | 12:30 |
| *** pcaruana has quit IRC | 12:30 | |
| lbragstad | andreykurilin: is there a domain-specific role named 'Foo'? | 12:36 |
| *** alex_xu has joined #openstack-keystone | 12:36 | |
| lbragstad | rabel: role inheritance useful when you have projects in a tree structure of some kind | 12:36 |
| lbragstad | rabel: you can give users a role on one project, and have it inherit down the tree, so they get consistent authorization elsewhere in the tree wrt the node in the tree that has the assignment | 12:38 |
| andreykurilin | lbragstad: yes. "default" domain. | 12:41 |
| andreykurilin | lbragstad: `if "Foo" not in keystone.roles.list(domain="default"): keystone.roles.create(name="Foo", domain="default")` something like this | 12:43 |
| lbragstad | andreykurilin: checking to see if I can recreate | 12:43 |
| *** panbalag has joined #openstack-keystone | 12:44 | |
| *** panbalag has left #openstack-keystone | 12:44 | |
| andreykurilin | lbragstad: domains.list gives just one default domain | 12:45 |
| *** belmoreira has quit IRC | 12:45 | |
| lbragstad | hmm | 12:45 |
| lbragstad | that's odd | 12:45 |
| lbragstad | do you see a trace from the sql transaction in the logs? | 12:47 |
| andreykurilin | not sure that I have access to them :( | 12:49 |
| *** mvk has joined #openstack-keystone | 12:50 | |
| *** usr2033 has joined #openstack-keystone | 12:58 | |
| lbragstad | andreykurilin: interesting, i double checked the unique constraint | 13:00 |
| lbragstad | i suspected having a role named 'foo' in another domain might be affect it when it shouldn't | 13:00 |
| lbragstad | affecting* | 13:00 |
| lbragstad | but - turns out that's not the case, i was able to create a role named 'foo' in a domain and a role named 'foo' without a domain | 13:01 |
| *** sonuk has quit IRC | 13:01 | |
| andreykurilin | lbragstad: `keystone.roles.list(domain=None)` doesn't show "Foo" either | 13:03 |
| *** pcaruana has joined #openstack-keystone | 13:08 | |
| *** dave-mccowan has joined #openstack-keystone | 13:09 | |
| lbragstad | it looks like you're using keystoneclient? | 13:17 |
| *** dave-mcc_ has joined #openstack-keystone | 13:17 | |
| usr2033 | i have encountered something on deleting domain and i don't know if it is a bug. https://developer.openstack.org/api-ref/identity/v3/#delete-domain says "When you delete a domain, this call also deletes all entities owned by it, such as users, groups, and projects, and any credentials and granted roles that relate to those entities." but when i delete domain with "openstack domain delete <domain-id>" role assignment of user to deleted | 13:18 |
| usr2033 | domain resides. Does anybody know something about this? Am i doing something wrong? | 13:18 |
| rabel | lbragstad: how would i do this? can i assign the role to the user for the root project and set "inherited=True" and the user has the same permissions for the subprojects automatically? | 13:19 |
| *** dave-mccowan has quit IRC | 13:19 | |
| lbragstad | usr2033: i just tested locally | 13:26 |
| lbragstad | usr2033: i set up a new domain, created a user and project within it, then granted the user a role on the project | 13:26 |
| lbragstad | i disabled the domain, then deleted it | 13:27 |
| lbragstad | the domain, user, project, and role assignment were all deleted | 13:27 |
| lbragstad | usr2033: are you using something differently that results in different behavior? | 13:27 |
| lbragstad | rabel: yeah - i think so, but i believe we have docs | 13:28 |
| lbragstad | rabel: https://developer.openstack.org/api-ref/identity/v3/index.html#os-inherit not sure if you've seen that yet | 13:28 |
| rabel | lbragstad: thanks. i will play around with that a little bit | 13:30 |
| *** belmoreira has joined #openstack-keystone | 13:32 | |
| andreykurilin | lbragstad: yes. it is keystoneclient | 13:32 |
| usr2033 | @lbragstad i set only domain admin role to user | 13:35 |
| usr2033 | lbragstad i use keystone version 8 with v3 api | 13:37 |
| lbragstad | hmm | 13:39 |
| lbragstad | usr2033: here is what i did locally - http://paste.openstack.org/raw/720220/ | 13:39 |
| lbragstad | usr2033: so you're on liberty? | 13:40 |
| *** zeus has joined #openstack-keystone | 13:43 | |
| *** zeus is now known as Guest44752 | 13:43 | |
| *** Guest44752 is now known as zeus | 13:45 | |
| *** zeus has joined #openstack-keystone | 13:45 | |
| lbragstad | kmalloc: i went through and updated all the stable reviews I've +1'd to +2 | 13:46 |
| lbragstad | and kicked a couple that you've +2'd through | 13:46 |
| usr2033 | lbragstad, yes i am in liberty | 13:56 |
| *** panbalag has joined #openstack-keystone | 13:59 | |
| usr2033 | lbragstad, my issue is already created user. my user already has default domain and project role. i grant new role in new domain. | 13:59 |
| *** panbalag has left #openstack-keystone | 13:59 | |
| usr2033 | lbragstad | 13:59 |
| usr2033 | lbragstad, in your case i got success too | 13:59 |
| *** belmoreira has quit IRC | 13:59 | |
| lbragstad | so - the user in the domain you're deleting has roles in other domains? | 14:01 |
| lbragstad | and those aren't being cleaned up? | 14:01 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement enforcement model logic in Manager https://review.openstack.org/562715 | 14:04 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Expose endpoint to return enforcement model https://review.openstack.org/562716 | 14:04 |
| *** felipemonteiro has joined #openstack-keystone | 14:07 | |
| usr2033 | lbragstad, yes user has roles in other domains, all roles of user stays | 14:08 |
| usr2033 | after deleting domain | 14:08 |
| kmalloc | lbragstad: awesome | 14:10 |
| *** xinran_ has joined #openstack-keystone | 14:10 | |
| lbragstad | usr2033: ok - let me recreate with that case then | 14:10 |
| *** alex_xu has quit IRC | 14:11 | |
| *** alex_xu has joined #openstack-keystone | 14:17 | |
| usr2033 | lbragstad: :+1: | 14:19 |
| mordred | kmalloc, lbragstad: ok. the devstack fix for the block-storage endpoint has merged. what additional would y'all like for landing https://review.openstack.org/#/q/topic:service-type-aliases ? | 14:23 |
| kmalloc | I'm good with it as is honestly. | 14:24 |
| kmalloc | I want to help get a doc published (docs.o.o) or similar for the mapping of aliases and links in ksa. | 14:24 |
| lbragstad | usr2033: same thing - http://paste.openstack.org/raw/720227/ | 14:25 |
| kmalloc | But that can come post landing this. | 14:25 |
| kmalloc | mordred: reviewing the code now btw. | 14:25 |
| lbragstad | usr2033: but i added the user to a project in two different domains, and it looks like the role assignments were clean up for both | 14:25 |
| kmalloc | lbragstad: yay a second stable reviewer | 14:25 |
| lbragstad | kmalloc: ++ | 14:25 |
| mordred | kmalloc: thanks! and yes, I agree about doc | 14:26 |
| kmalloc | mordred: and I said I'd help with the doc job, I just need to get the ick out of my sinuses (yay springtime) to see straight :P. Much better today with heavy allergy meds. | 14:28 |
| *** alex_xu has quit IRC | 14:29 | |
| mordred | kmalloc: springtime sinuses are the worst | 14:29 |
| *** felipemonteiro_ has joined #openstack-keystone | 14:30 | |
| *** belmoreira has joined #openstack-keystone | 14:32 | |
| usr2033 | lbragstad: i will try with project role too. | 14:33 |
| lbragstad | i can retry with a domain role | 14:34 |
| lbragstad | i forgot about that | 14:34 |
| *** felipemonteiro has quit IRC | 14:34 | |
| *** openstackgerrit has quit IRC | 14:34 | |
| *** links has quit IRC | 14:34 | |
| usr2033 | lbragstad, thanks for your attention | 14:35 |
| hrybacki | cmurphy: have you come across anyone that has an example of using app creds that live in an rc file by chance? | 14:35 |
| lbragstad | usr2033: same result - http://paste.openstack.org/raw/720230/ | 14:38 |
| lbragstad | everything gets cleaned up | 14:39 |
| lbragstad | at least with master | 14:39 |
| cmurphy | hrybacki: are you looking for a real world example? I can show you a demo example but I haven't encountered anyone using it in real life yet | 14:39 |
| *** jmlowe has quit IRC | 14:39 | |
| hrybacki | cmurphy: a demo example would be fine :) | 14:40 |
| *** felipemonteiro_ has quit IRC | 14:42 | |
| *** felipemonteiro_ has joined #openstack-keystone | 14:42 | |
| *** felipemonteiro__ has joined #openstack-keystone | 14:46 | |
| cmurphy | hrybacki: something like http://paste.openstack.org/show/720232/ | 14:49 |
| cmurphy | also if you stand up horizon on master you can download an RC file with app creds | 14:50 |
| *** felipemonteiro_ has quit IRC | 14:50 | |
| *** mvk has quit IRC | 14:52 | |
| lbragstad | cmurphy: oh - that's neat | 14:58 |
| *** jmlowe has joined #openstack-keystone | 15:01 | |
| lbragstad | kmalloc: ayoung curious if you'd like to review https://review.openstack.org/#/c/530509/ | 15:02 |
| *** tonytan4ever has joined #openstack-keystone | 15:02 | |
| *** jmlowe has quit IRC | 15:03 | |
| ayoung | lbragstad, I'd take jamielennox 's comments as canon | 15:03 |
| usr2033 | lbragstad, all roles you set in same domain as i understand :( | 15:03 |
| ayoung | X- | 15:04 |
| ayoung | Dictionary is strange | 15:04 |
| ayoung | hmm thought I reviewed that...bet I have a bunch of drafts | 15:04 |
| hrybacki | thanks a bunch cmurphy ! | 15:04 |
| *** jmlowe has joined #openstack-keystone | 15:04 | |
| lbragstad | ayoung: yeah - the dictionary bit is weird | 15:04 |
| ayoung | lbragstad, that makes the contract Python specific. | 15:05 |
| lbragstad | i guess i'm trying to figure out a way to make it so that we can pass that information in the header while keeping it open for expansion later | 15:05 |
| ayoung | yeah | 15:05 |
| lbragstad | because we might do something more interesting in the future | 15:05 |
| lbragstad | instead of 'system': {'all': True} | 15:05 |
| usr2033 | lbragstad, i already have an user_z with domain admin role in domain domain_a, i created new domain named domain_b and i gave domain admin role to user_z on domain_b. | 15:05 |
| usr2033 | lbragstad, my new domain has no project. | 15:06 |
| lbragstad | we could do 'system': {'service': '4d52512c24ec433b8f57dcfebf97c692'} or what-not | 15:06 |
| *** alex_xu has joined #openstack-keystone | 15:07 | |
| lbragstad | usr2033: what domain does uesr_z belong to? | 15:09 |
| *** belmoreira has quit IRC | 15:09 | |
| *** germs has joined #openstack-keystone | 15:10 | |
| *** germs has quit IRC | 15:10 | |
| *** germs has joined #openstack-keystone | 15:10 | |
| lbragstad | ayoung: about the X- header bit, kmalloc had input against that in a previous patch set | 15:12 |
| *** Guest29196 has quit IRC | 15:21 | |
| *** Rhvs has joined #openstack-keystone | 15:21 | |
| *** jaosorior has joined #openstack-keystone | 15:23 | |
| *** openstackgerrit has joined #openstack-keystone | 15:31 | |
| openstackgerrit | Ken Giusti proposed openstack/oslo.policy master: Remove stale pip-missing-reqs tox test https://review.openstack.org/565803 | 15:31 |
| *** felipemonteiro__ has quit IRC | 15:39 | |
| kmalloc | lbragstad: yep | 15:47 |
| kmalloc | ayoung: we need to stop proliferating more x- prefixed headers | 15:47 |
| kmalloc | ayoung: https://tools.ietf.org/html/rfc6648 | 15:47 |
| kmalloc | so future headers should be descriptive and prefixed with OS, OpenStack, os-keystone, os-identity, etc (or whatever we want to use) | 15:48 |
| *** jaosorior has quit IRC | 15:49 | |
| *** gyee has joined #openstack-keystone | 15:59 | |
| kmalloc | mordred: ok i reviewed most of it, but looks like a bunch of patches might need rebases. | 15:59 |
| kmalloc | lbragstad: commented | 16:02 |
| lbragstad | kmalloc: thanks - i'll check here in a minute once i push a few limit patches | 16:03 |
| kmalloc | lbragstad: mostly just said the same thing else where (re X- prefix). | 16:04 |
| kmalloc | i am inclined to dislike the 'system': {'all': True} | 16:04 |
| kmalloc | to be "more" HTTP like, you could make it: 'system-all' or a list (comma delimited, future) of allowed | 16:05 |
| kmalloc | it also allows adding OPENSTACK-System-Scope header multiple times to make it automatically concatenated with commas (HTTP standard) works | 16:05 |
| kmalloc | ayoung: ^ | 16:05 |
| * ayoung read mordred as Murdered. | 16:08 | |
| *** nkinder has joined #openstack-keystone | 16:12 | |
| nkinder | cmurphy: do you know of any examples of using application credentials in RC files? | 16:13 |
| cmurphy | nkinder: :) http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2018-05-02.log.html#t2018-05-02T14:35:43 | 16:14 |
| nkinder | cmurphy: the documentation shows a middleware configuration example, but not RC usage | 16:14 |
| cmurphy | the RC file would be basically the same but with the options uppercased and prefixed with OS_ | 16:15 |
| nkinder | cmurphy, Thanks! I figured as much, but wanted to be sure :) | 16:15 |
| *** tesseract has quit IRC | 16:18 | |
| openstackgerrit | Merged openstack/keystoneauth master: Trivial: Update pypi url to new url https://review.openstack.org/565418 | 16:19 |
| *** felipemonteiro has joined #openstack-keystone | 16:20 | |
| *** xinran_ has quit IRC | 16:20 | |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Use Status variables in tests https://review.openstack.org/564258 | 16:20 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Reference class variable in Status https://review.openstack.org/564262 | 16:20 |
| mordred | kmalloc: I think that should take care of the rebase needs | 16:21 |
| mordred | wasn't as bad as I thought | 16:21 |
| kmalloc | mordred: cool. | 16:21 |
| kmalloc | yeah it looks ghood, just needed that so we can land it all :) | 16:21 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add policy for limit model protection https://review.openstack.org/562714 | 16:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement enforcement model logic in Manager https://review.openstack.org/562715 | 16:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Expose endpoint to return enforcement model https://review.openstack.org/562716 | 16:25 |
| *** tonytan4ever has quit IRC | 16:26 | |
| *** tonytan4ever has joined #openstack-keystone | 16:26 | |
| lbragstad | kmalloc: yeah - passing a dictionary in a header seems odd | 16:26 |
| kmalloc | lbragstad: so. what are we trying to pass in | 16:27 |
| lbragstad | but with the addition of more service scoped stuff in the future | 16:27 |
| lbragstad | i wanted to avoid having to add more headers | 16:27 |
| kmalloc | ok, so lets use a list of values | 16:27 |
| kmalloc | openstack-system-scope: <type>, <type>, <type> | 16:27 |
| kmalloc | and the default can be system-all (today)? | 16:27 |
| lbragstad | what is type? | 16:27 |
| kmalloc | instead of system: all | 16:28 |
| kmalloc | system-all | 16:28 |
| lbragstad | if 'scope': 'system': {'all': True} is in a token | 16:28 |
| lbragstad | what does that look like in the header? | 16:28 |
| lbragstad | translated to the header* | 16:28 |
| kmalloc | openstack-system-scope: system-all | 16:28 |
| lbragstad | ah | 16:29 |
| lbragstad | so 'system-all' would be special | 16:29 |
| kmalloc | since headers can be comma delimited | 16:29 |
| kmalloc | example could be (future) | 16:29 |
| kmalloc | openstack-system-scope: nova-all, glance-all | 16:29 |
| lbragstad | so if we did something like 'scope': {'system': {'service': '30e0dcd33bf543f69a099c5228d2ad59'} | 16:29 |
| kmalloc | openstack-system-scope: system-<id> ? | 16:30 |
| kmalloc | or service-id | 16:30 |
| lbragstad | where ID would be the service id? | 16:30 |
| kmalloc | ooor... | 16:30 |
| kmalloc | i mean... | 16:30 |
| kmalloc | is it always going to be :system: | 16:30 |
| kmalloc | because then we can do: openstack-system-scope: all | 16:30 |
| lbragstad | right - that can probably be inferred from the header name | 16:30 |
| kmalloc | or openstack-system-scope: 30e0dcd33bf543f69a099c5228d2ad59 | 16:31 |
| lbragstad | it would be like saying x-project-id: project-id | 16:31 |
| kmalloc | where "all" is magic | 16:31 |
| lbragstad | sure | 16:31 |
| kmalloc | and remember, we can have it concatentated | 16:31 |
| kmalloc | if you want multiple services | 16:31 |
| lbragstad | wouldn't that be like scoping to multiple projects? | 16:31 |
| kmalloc | e.g.: openstack-system-scope: 30e0dcd33bf543f69a099c5228d2ad59, deadbeef1, deadbeef2 | 16:31 |
| kmalloc | it would, i was just explaining how it could work if we wanted that | 16:32 |
| lbragstad | sure | 16:32 |
| lbragstad | ok - that makes sense | 16:32 |
| lbragstad | we only support all today anyway | 16:32 |
| kmalloc | so, lets dump the dict in the header, no reason to do that | 16:32 |
| lbragstad | ok - i can respin that patch to take the key of the system scope and put that in the header instead | 16:32 |
| kmalloc | and we make "all" the default (current) and can add specific services (eityher via alias e.g.: nova / nova-all / etc, or by id | 16:32 |
| lbragstad | ^ righ? | 16:32 |
| kmalloc | yeah | 16:32 |
| kmalloc | that would be what i would do | 16:33 |
| lbragstad | cool | 16:33 |
| kmalloc | it simplifies it a lot | 16:33 |
| lbragstad | yeah | 16:33 |
| kmalloc | and it makes it more generic | 16:33 |
| lbragstad | i agree | 16:33 |
| lbragstad | cc jamielennox ayoung ^ | 16:33 |
| lbragstad | thanks kmalloc | 16:33 |
| lbragstad | kmalloc: fwiw - the limit model patch should be ready for some reviews | 16:33 |
| mordred | kmalloc: you missed one https://review.openstack.org/#/c/559154 | 16:33 |
| hrybacki | lbragstad: no bites on my default roles pitch for the policy meeting :P | 16:57 |
| lbragstad | hrybacki: :( yeah - we need to start knocking on doors | 17:01 |
| lbragstad | i can make a point to do that this weke | 17:01 |
| lbragstad | week* | 17:01 |
| * lbragstad goes to run a couple errands over lunch | 17:01 | |
| hrybacki | lbragstad: yeah, I'm gonna bring your original post to our internal list -- hopefully drum up some support there | 17:01 |
| hrybacki | ayoung: ^^ | 17:01 |
| lbragstad | i'm usually not a fan of asking for reviews on the mailing list - but since it involved several parts of the community it might need that visibility | 17:02 |
| *** openstackgerrit has quit IRC | 17:04 | |
| kmalloc | mordred: yeah reviewing that now | 17:05 |
| hrybacki | lbragstad: precisely. My fear is we approach M2 and then someone decides to jump in and bike-shed pass the deadline | 17:07 |
| kmalloc | mordred: looks good to me | 17:09 |
| kmalloc | hrybacki: if it is in our code base, lbragstad can step in and say "uh, bike shed elsewhere" | 17:09 |
| *** felipemonteiro_ has joined #openstack-keystone | 17:10 | |
| kmalloc | hrybacki: if it is important to land, we should land it -- M2 is the deadline and if people engage 1 minute to midnight, they're in the wrong (imo) if they're bikeshedding | 17:10 |
| hrybacki | kmalloc: well, it is an openstack-spec (that we hope will turn into a community goal in the next release) 'there be dragons' | 17:10 |
| hrybacki | but I agree with that wholeheartedly. I want to at least be able to point to several direct asks for input should that scenario arise | 17:11 |
| ayoung | I'm easy on this. Just that jamielennox spent a lot of time on Context, so I take his opinion fairly seriously. | 17:11 |
| *** panbalag has joined #openstack-keystone | 17:11 | |
| kmalloc | can't say much besides push back on bikeshedding at the last minute by saying "where were you before when I asked, <here>, <here>, <here>" | 17:11 |
| kmalloc | ayoung: yeah the rest of the context comments weren't hard to see where he was coming from | 17:11 |
| kmalloc | the header bit, that one I get his confusion, but we're trying to adhere to the RFCs going forward (as we should) | 17:12 |
| kmalloc | hrybacki: i would probably highligh (not "hey review this") but engage the idea via the ML | 17:12 |
| kmalloc | this isn't asking for reviews | 17:12 |
| mordred | kmalloc: RFCs ... more like RFskeez | 17:12 |
| kmalloc | it is asking for feedback | 17:12 |
| kmalloc | mordred: lol | 17:13 |
| *** germs has quit IRC | 17:14 | |
| kmalloc | hrybacki: this is making sure you have mindshare on the direction of the spec/goal | 17:14 |
| *** felipemonteiro has quit IRC | 17:15 | |
| * hrybacki nods | 17:15 | |
| *** germs has joined #openstack-keystone | 17:17 | |
| *** germs has quit IRC | 17:17 | |
| *** germs has joined #openstack-keystone | 17:17 | |
| *** germs has quit IRC | 17:18 | |
| *** germs has joined #openstack-keystone | 17:19 | |
| *** germs has quit IRC | 17:19 | |
| *** germs has joined #openstack-keystone | 17:19 | |
| lbragstad[m] | ++ well put kmalloc | 17:29 |
| *** panbalag has quit IRC | 17:44 | |
| *** rabel has left #openstack-keystone | 17:44 | |
| *** panbalag has joined #openstack-keystone | 17:45 | |
| *** panbalag has left #openstack-keystone | 17:46 | |
| ayoung | kmalloc, hrybacki after taking the dog for a walk, and thinking about this, I think we should 1. Add a new header IAW the old style and 2. Add a brand new set of headers as a follow on patch that matches the RFC. | 17:46 |
| ayoung | 1 is to get things moving, and to not have a one off. 2 is for the long term direction. | 17:46 |
| kmalloc | ayoung: no, don't add the old style at all | 17:48 |
| kmalloc | really. | 17:48 |
| kmalloc | don't proliferate x- style headers for new headers. | 17:48 |
| ayoung | kmalloc, no, really, add the old style. | 17:48 |
| kmalloc | -2 | 17:48 |
| ayoung | It does not matter. | 17:48 |
| kmalloc | it does. | 17:48 |
| ayoung | It is the current pattern. A deliberate change of the pattern should occur. And I would not hold this up for the new pattern | 17:48 |
| kmalloc | the general direction of openstack is to eliminate x- prefixed headers | 17:49 |
| kmalloc | we shouldn't add another x-prefixed header | 17:49 |
| kmalloc | and support it forever | 17:49 |
| kmalloc | because if we add it, we support it forever | 17:49 |
| ayoung | Yes we should. | 17:49 |
| kmalloc | absolutely not | 17:50 |
| ayoung | Because otherwise it is a one off, and that will mess people up more. | 17:50 |
| ayoung | We can then convert the whole set of headers over en mass | 17:50 |
| kmalloc | no, document it, we use openstack-blah headers for microversions and have a bad migration for that too | 17:50 |
| kmalloc | please please please do not add more x- prefixed headers for new functionality | 17:51 |
| kmalloc | i wont -2 this. | 17:51 |
| kmalloc | but i will -1 it every time if it has a x- prefix | 17:51 |
| kmalloc | with the same comment. | 17:51 |
| ayoung | kmalloc, so, I don't really have a dog in the fight. This is just my opinion on the way to do it with out messing up the users, but I will not hold it up either way. | 17:51 |
| ayoung | The hill is yours. | 17:52 |
| kmalloc | it wont mess up the users -- this is behind the scenes ksm/ksa stuff | 17:52 |
| kmalloc | a user will never send openstack-system-scope header | 17:52 |
| kmalloc | or should never | 17:52 |
| kmalloc | s/ksa/keystone-server | 17:52 |
| kmalloc | this is how we communicate to the services what scope, similar to x-project-id | 17:53 |
| lbragstad | things would remain backwards compat it we didn't add the new x-style header, wouldn't they? | 18:18 |
| lbragstad | it would just force users to use the new style header for the new authorization? | 18:19 |
| ayoung | lbragstad, yes...this is just nit picking. It would probably be fine either way, and if kmalloc cares so strongly, lets just do it his way. | 18:25 |
| lbragstad | ayoung: kmalloc ok - i have another context question | 18:37 |
| kmalloc | sure | 18:37 |
| lbragstad | the context object has a system attribute right? | 18:37 |
| lbragstad | and that should technically represent the token's system scope | 18:38 |
| lbragstad | when we call things like https://review.openstack.org/#/c/530509/5/oslo_context/context.py,unified@296 should it be | 18:38 |
| kmalloc | o tjoml sp/ | 18:39 |
| kmalloc | i think so* | 18:39 |
| lbragstad | ctx.system = {'all': True} | 18:39 |
| lbragstad | or should it be ctx.system = 'all' | 18:39 |
| kmalloc | why are we doing "all": true | 18:39 |
| kmalloc | i think it should jsut be "all" | 18:39 |
| kmalloc | not sure what benefit the dict adds | 18:39 |
| kmalloc | if we only ever support one type of system code | 18:39 |
| *** openstackgerrit has joined #openstack-keystone | 18:39 | |
| openstackgerrit | Merged openstack/keystoneauth master: fix a typo in session.py https://review.openstack.org/556397 | 18:39 |
| lbragstad | ok | 18:40 |
| lbragstad | i thought we were checking the dictionary values more strictly in oslo.policy | 18:40 |
| lbragstad | https://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L834 | 18:41 |
| kmalloc | we can transform it if needed | 18:41 |
| kmalloc | go with what is needed to work correctly | 18:42 |
| lbragstad | so should context expect to be passed the system scope from the token? or should it be called like ctx = context.RequestContext(system='all') | 18:44 |
| kmalloc | i am not sure. | 18:45 |
| kmalloc | honestly | 18:45 |
| kmalloc | i think either works? | 18:45 |
| lbragstad | ok - i had the wrong idea | 18:55 |
| *** pcichy has quit IRC | 18:55 | |
| lbragstad | i was thinking that oslo.context was going to handle that | 18:55 |
| lbragstad | but actually that's up to ksm | 18:55 |
| kmalloc | yeah | 18:55 |
| lbragstad | i had my wires crossed | 18:56 |
| openstackgerrit | Merged openstack/python-keystoneclient master: Trivial: Update pypi url to new url https://review.openstack.org/563055 | 18:57 |
| *** felipemonteiro__ has joined #openstack-keystone | 18:59 | |
| *** felipemonteiro_ has quit IRC | 18:59 | |
| kmalloc | :) | 19:02 |
| kmalloc | its all good man | 19:02 |
| openstackgerrit | Lance Bragstad proposed openstack/keystonemiddleware master: Introduce new header for system-scoped tokens https://review.openstack.org/564072 | 19:15 |
| lbragstad | mmk ^ | 19:15 |
| lbragstad | that should do it | 19:15 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add LDAP user-backed functional testing gate https://review.openstack.org/558940 | 19:18 |
| lbragstad | oslo.context patch - https://review.openstack.org/#/c/564072/ | 19:19 |
| *** deepika08 has joined #openstack-keystone | 19:21 | |
| lbragstad | cc jamielennox ^ | 19:30 |
| *** linkmark has joined #openstack-keystone | 19:35 | |
| -openstackstatus- NOTICE: The Gerrit service at review.openstack.org will be offline starting at 20:00 (in roughly 25 minutes) for a server move and operating system upgrade: http://lists.openstack.org/pipermail/openstack-dev/2018-May/130118.html | 19:36 | |
| *** mvk has joined #openstack-keystone | 19:45 | |
| *** linkmark has quit IRC | 19:46 | |
| *** felipemonteiro_ has joined #openstack-keystone | 19:51 | |
| *** felipemonteiro__ has quit IRC | 19:55 | |
| openstackgerrit | Merged openstack/keystonemiddleware master: Imported Translations from Zanata https://review.openstack.org/565455 | 19:59 |
| -openstackstatus- NOTICE: The Gerrit service at review.openstack.org will be offline over the next 1-2 hours for a server move and operating system upgrade: http://lists.openstack.org/pipermail/openstack-dev/2018-May/130118.html | 20:04 | |
| *** ChanServ changes topic to "The Gerrit service at review.openstack.org will be offline over the next 1-2 hours for a server move and operating system upgrade: http://lists.openstack.org/pipermail/openstack-dev/2018-May/130118.html" | 20:04 | |
| *** raildo has quit IRC | 20:06 | |
| *** felipemonteiro_ has quit IRC | 20:09 | |
| *** felipemonteiro_ has joined #openstack-keystone | 20:10 | |
| *** openstackgerrit has quit IRC | 20:27 | |
| *** pcaruana has quit IRC | 20:34 | |
| *** tonytan4ever has quit IRC | 20:45 | |
| *** tonytan4ever has joined #openstack-keystone | 20:45 | |
| *** jmlowe has quit IRC | 20:53 | |
| *** panbalag has joined #openstack-keystone | 21:00 | |
| *** panbalag has left #openstack-keystone | 21:00 | |
| *** redrobot has joined #openstack-keystone | 21:02 | |
| *** felipemonteiro__ has joined #openstack-keystone | 21:06 | |
| *** felipemonteiro_ has quit IRC | 21:09 | |
| *** linkmark has joined #openstack-keystone | 21:16 | |
| *** r-daneel has quit IRC | 21:25 | |
| *** jmlowe has joined #openstack-keystone | 21:31 | |
| *** jmlowe has quit IRC | 21:45 | |
| *** martinus__ has quit IRC | 21:48 | |
| *** openstackgerrit has joined #openstack-keystone | 21:55 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Add scenarios to strict hierarchy enforcement model https://review.openstack.org/565412 | 21:55 |
| lbragstad | wxy: ^ that should be good to review, let me know what you think | 21:55 |
| lbragstad | johnthetubaguy: yankcrime ^ | 21:56 |
| lbragstad | revised a lot of it, but attempted to keep as much of the CERN case there as possible | 21:57 |
| lbragstad | also tried to pull some stuff into bugs instead of keeping it in the spec | 21:57 |
| *** jmlowe has joined #openstack-keystone | 21:57 | |
| *** felipemonteiro_ has joined #openstack-keystone | 22:01 | |
| *** felipemonteiro__ has quit IRC | 22:01 | |
| *** openstackgerrit has quit IRC | 22:04 | |
| *** ChanServ changes topic to "Rocky release schedule: https://releases.openstack.org/rocky/schedule.html | Meeting agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h | Trello: https://trello.com/b/wmyzbFq5/keystone-rocky-roadmap" | 22:10 | |
| -openstackstatus- NOTICE: Gerrit maintenance has concluded successfully | 22:10 | |
| *** tonytan4ever has quit IRC | 22:22 | |
| *** tonytan4ever has joined #openstack-keystone | 22:23 | |
| *** panbalag has joined #openstack-keystone | 22:27 | |
| *** tonytan4ever has quit IRC | 22:29 | |
| *** edmondsw has quit IRC | 22:29 | |
| *** edmondsw has joined #openstack-keystone | 22:30 | |
| *** edmondsw has quit IRC | 22:35 | |
| *** edmondsw has joined #openstack-keystone | 22:35 | |
| *** rcernin has joined #openstack-keystone | 22:36 | |
| *** edmondsw has quit IRC | 22:39 | |
| *** deepika08 has quit IRC | 23:01 | |
| *** hrybacki_ has joined #openstack-keystone | 23:09 | |
| *** andreaf has quit IRC | 23:09 | |
| *** mnaser_ has joined #openstack-keystone | 23:09 | |
| *** Anticime1 has joined #openstack-keystone | 23:12 | |
| *** jlvillal_ has joined #openstack-keystone | 23:15 | |
| *** afazekas_ has joined #openstack-keystone | 23:15 | |
| *** _d34dh0r53_ has joined #openstack-keystone | 23:15 | |
| *** lbragstad[m] has quit IRC | 23:16 | |
| *** hrybacki has quit IRC | 23:16 | |
| *** mnaser has quit IRC | 23:16 | |
| *** afazekas has quit IRC | 23:16 | |
| *** jlvillal has quit IRC | 23:16 | |
| *** Anticimex has quit IRC | 23:16 | |
| *** d34dh0r53 has quit IRC | 23:16 | |
| *** hrybacki_ is now known as hrybacki | 23:16 | |
| *** mnaser_ is now known as mnaser | 23:16 | |
| *** jlvillal_ is now known as jlvillal | 23:19 | |
| *** panbalag has quit IRC | 23:19 | |
| *** jlvillal is now known as Guest10014 | 23:19 | |
| *** lbragstad[m] has joined #openstack-keystone | 23:23 | |
| *** panbalag has joined #openstack-keystone | 23:25 | |
| *** andreaf has joined #openstack-keystone | 23:25 | |
| *** dave-mcc_ has quit IRC | 23:32 | |
| *** dave-mccowan has joined #openstack-keystone | 23:36 | |
| *** panbalag has quit IRC | 23:37 | |
| *** panbalag has joined #openstack-keystone | 23:43 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!