| *** gyee has quit IRC | 00:04 | |
| *** markvoelker has quit IRC | 00:44 | |
| *** felipemonteiro has quit IRC | 01:38 | |
| *** felipemonteiro has joined #openstack-keystone | 01:54 | |
| *** dave-mccowan has joined #openstack-keystone | 02:00 | |
| *** felipemonteiro has quit IRC | 02:10 | |
| *** dave-mccowan has quit IRC | 02:20 | |
| *** felipemonteiro has joined #openstack-keystone | 02:58 | |
| *** prashkre has joined #openstack-keystone | 02:58 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement Trust Flush via keystone-manage. https://review.openstack.org/589378 | 03:03 |
|---|---|---|
| *** lbragstad has quit IRC | 03:04 | |
| *** lbragstad has joined #openstack-keystone | 03:11 | |
| *** ChanServ sets mode: +o lbragstad | 03:11 | |
| *** felipemonteiro has quit IRC | 03:23 | |
| *** prashkre has quit IRC | 03:32 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 03:41 | |
| *** felipemonteiro has joined #openstack-keystone | 03:46 | |
| *** lbragstad has quit IRC | 03:48 | |
| *** prashkre has joined #openstack-keystone | 03:48 | |
| *** felipemonteiro has quit IRC | 03:52 | |
| *** felipemonteiro has joined #openstack-keystone | 03:56 | |
| *** felipemonteiro has quit IRC | 04:00 | |
| *** Dinesh_Bhor has quit IRC | 04:02 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:28 | |
| openstackgerrit | Merged openstack/keystone-tempest-plugin master: Rename keystone zuul jobs https://review.openstack.org/603198 | 04:39 |
| *** jaosorior has joined #openstack-keystone | 04:54 | |
| *** shyamb has joined #openstack-keystone | 05:02 | |
| *** Dinesh_Bhor has quit IRC | 05:08 | |
| *** prashkre has quit IRC | 05:14 | |
| *** shyamb has quit IRC | 05:14 | |
| vishakha | wxy-xiyuan: Hello. Can you pl review https://review.openstack.org/#/c/589378/. Thanks | 05:17 |
| *** shyamb has joined #openstack-keystone | 05:20 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 05:26 | |
| *** belmoreira has joined #openstack-keystone | 05:30 | |
| vishakha | lbragstad, cmurphy : In this https://review.openstack.org/#/c/588211/. According to the latest comment of lance I need to assert domain _id + groupid in the attribute?? Looking for the response . Thanks | 05:33 |
| *** shyamb has quit IRC | 05:36 | |
| *** prashkre has joined #openstack-keystone | 05:38 | |
| *** shyamb has joined #openstack-keystone | 05:38 | |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone-tempest-plugin master: Import another job from project-config https://review.openstack.org/603281 | 05:52 |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone-tempest-plugin master: Import another job from project-config https://review.openstack.org/603281 | 05:54 |
| *** shyamb has quit IRC | 06:07 | |
| *** shyamb has joined #openstack-keystone | 06:38 | |
| AJaeger | keystone cores, would be great to get this one in as well, please ^ | 06:44 |
| *** rcernin has quit IRC | 07:03 | |
| *** Dinesh_Bhor has quit IRC | 07:09 | |
| *** prashkre has quit IRC | 07:12 | |
| *** prashkre has joined #openstack-keystone | 07:12 | |
| cmurphy | AJaeger: we actually just renamed that job, it was already imported https://review.openstack.org/601463 | 07:14 |
| AJaeger | cmurphy: this is for keystone-tempest-plugin - following the rename | 07:14 |
| AJaeger | did I use the wrong name? double checking... | 07:15 |
| AJaeger | cmurphy: ah, indeed - old keysteon repo checkout. Will fix. | 07:15 |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone-tempest-plugin master: Import another job from project-config https://review.openstack.org/603281 | 07:16 |
| AJaeger | cmurphy: thanks, is this good now? ^ | 07:16 |
| cmurphy | AJaeger: i think so | 07:17 |
| cmurphy | vishakha: I will try to add a comment with more detail, it is going to be slightly complicated | 07:18 |
| AJaeger | thanks, cmurphy | 07:18 |
| vishakha | cmurphy: Sure. Thanks for the response. | 07:19 |
| vishakha | cmurphy: Also pl look into https://review.openstack.org/#/c/594921/. Hope I am doing the same you said in the comment. But my unit test cases are failing | 07:21 |
| *** shyamb has quit IRC | 07:22 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:27 | |
| cmurphy | vishakha: commented what i think the problem is | 07:30 |
| vishakha | : cmurphy thanks I got it | 07:32 |
| vishakha | cmurphy: thanks, got it | 07:33 |
| AJaeger | keystone cores: could you review https://review.openstack.org/#/c/603239/ as well, please? That blocks shade and openstacksdks. | 07:34 |
| cmurphy | AJaeger: is there a shade patch that depends-on that to show it fixes the issue? | 07:36 |
| AJaeger | cmurphy: just updated https://review.openstack.org/#/c/603239/ | 07:38 |
| AJaeger | argh, wrong one... | 07:38 |
| AJaeger | cmurphy: https://review.openstack.org/#/c/603098 is the one | 07:39 |
| cmurphy | AJaeger: thanks | 07:39 |
| AJaeger | cmurphy: mordred was faster - see https://review.openstack.org/#/c/600292/ | 07:39 |
| openstackgerrit | Vishakha Agarwal proposed openstack/python-keystoneclient master: create() call in v3.regions.py is wrong https://review.openstack.org/594921 | 07:52 |
| *** belmoreira has quit IRC | 08:15 | |
| *** prashkre has quit IRC | 08:18 | |
| *** prashkre has joined #openstack-keystone | 08:18 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement Trust Flush via keystone-manage. https://review.openstack.org/589378 | 08:21 |
| *** sonuk has quit IRC | 08:23 | |
| openstackgerrit | Chason Chan proposed openstack/keystone master: Update api-ref for setting an account lockout threshold https://review.openstack.org/603319 | 08:24 |
| *** markvoelker has joined #openstack-keystone | 08:36 | |
| *** shyamb has joined #openstack-keystone | 08:45 | |
| *** Dinesh_Bhor has quit IRC | 08:45 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 08:53 | |
| *** lbragstad has joined #openstack-keystone | 08:59 | |
| *** ChanServ sets mode: +o lbragstad | 08:59 | |
| *** prashkre has quit IRC | 08:59 | |
| *** Dinesh_Bhor has quit IRC | 09:01 | |
| *** prashkre has joined #openstack-keystone | 09:03 | |
| *** belmoreira has joined #openstack-keystone | 09:04 | |
| *** belmoreira has quit IRC | 09:10 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 09:10 | |
| *** markvoelker has quit IRC | 09:11 | |
| *** belmoreira has joined #openstack-keystone | 09:11 | |
| *** idlemind has quit IRC | 09:18 | |
| *** dtantsur|afk is now known as dtantsur | 09:36 | |
| *** shyamb has quit IRC | 09:46 | |
| *** prashkre has quit IRC | 09:47 | |
| *** shyamb has joined #openstack-keystone | 09:47 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Adresses LDAP case-sensitive issue https://review.openstack.org/603345 | 09:48 |
| *** prashkre has joined #openstack-keystone | 09:58 | |
| *** Emine has joined #openstack-keystone | 09:58 | |
| *** markvoelker has joined #openstack-keystone | 10:07 | |
| *** Dinesh_Bhor has quit IRC | 10:10 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 10:18 | |
| lbragstad | would anyone be opposed to having bugs for each specific federated identity documentation improvement? | 10:25 |
| *** shyamb has quit IRC | 10:26 | |
| cmurphy | not opposed, though i was already planning on going through it and porting parts of my blog post to it | 10:32 |
| lbragstad | ++ | 10:33 |
| lbragstad | i'm wondering if it would be useful to track specific areas of improvement as bugs, or if it's just noise | 10:34 |
| cmurphy | if the items to improve are clearly enumerable i guess it makes sense to track it, if it's just "make better" that feels more like noise | 10:38 |
| lbragstad | agreed | 10:39 |
| lbragstad | i'll open bugs for the actionable ones with clear targets | 10:40 |
| *** markvoelker has quit IRC | 10:41 | |
| *** Dinesh_Bhor has quit IRC | 10:49 | |
| *** shyamb has joined #openstack-keystone | 10:56 | |
| cmurphy | samueldmq: I see from http://lists.openstack.org/pipermail/openstack-dev/2018-September/134182.html that you're an outreachy coordinator, and I notice that the deadlines on https://wiki.openstack.org/wiki/Outreachy are out of date, what's the project submission deadline for the next round? | 11:19 |
| *** imacdonn has quit IRC | 11:19 | |
| *** imacdonn has joined #openstack-keystone | 11:19 | |
| *** prashkre has quit IRC | 11:31 | |
| *** prashkre has joined #openstack-keystone | 11:31 | |
| dtantsur | hi folks, could you approve https://review.openstack.org/#/c/603239/ please? It's blocking openstacksdk CI | 11:34 |
| cmurphy | lbragstad: ^ | 11:35 |
| lbragstad | ah - i was going to review that yesterday | 11:44 |
| lbragstad | thanks for the reminder | 11:44 |
| *** prashkre has quit IRC | 11:53 | |
| *** prashkre has joined #openstack-keystone | 11:53 | |
| *** markvoelker has joined #openstack-keystone | 12:04 | |
| *** shyamb has quit IRC | 12:06 | |
| *** shyamb has joined #openstack-keystone | 12:07 | |
| lbragstad | cmurphy do you remember if we received specific feedback on the proxy idp stuff from the operator session on wednesday morning? | 12:17 |
| lbragstad | i'm not sure i recall an operator with a federated deployment being in the room? | 12:17 |
| cmurphy | lbragstad: sort of, I think one person was saying we don't currently support their use case where keystone needs to forward to a discovery endpoint so the user could pick an IdP, which is something the proxy IdP idea could fix | 12:19 |
| *** dtantsur has left #openstack-keystone | 12:19 | |
| lbragstad | mmm | 12:19 |
| lbragstad | because keystone would be the discovery endpoint? | 12:20 |
| cmurphy | right | 12:20 |
| cmurphy | although - | 12:20 |
| lbragstad | i remember chris, erik, and mike being in the room | 12:20 |
| cmurphy | what they wanted was to be able to have some kind of arbitrary flexible idp list | 12:21 |
| cmurphy | and the problem with keystone today is you have to name each idp in keystone | 12:21 |
| lbragstad | does horizon fetch that list from keystone? | 12:21 |
| lbragstad | when it gives users a drop down during login? | 12:22 |
| cmurphy | horizon is static, you have to give the protocol and idp list in local_settings.py | 12:23 |
| lbragstad | ahh | 12:23 |
| cmurphy | so that's another problem | 12:23 |
| lbragstad | sure | 12:23 |
| lbragstad | why is naming idps in keystone a problem? | 12:24 |
| cmurphy | it's a problem for their use case where it sounded like IdPs come and go? but I didn't really understand that part | 12:25 |
| lbragstad | interesting | 12:25 |
| lbragstad | apparently i glossed over that | 12:25 |
| cmurphy | yeah i didn't take good notes on that part | 12:26 |
| cmurphy | maybe kmalloc remembers better | 12:26 |
| cmurphy | or knikolla | 12:26 |
| lbragstad | hopefully :) | 12:26 |
| *** raildo has joined #openstack-keystone | 12:26 | |
| AJaeger | lbragstad: could you review a small change for zuul.yaml on keystone-tempest, please? Want to cleanup those files... https://review.openstack.org/603281 | 12:31 |
| lbragstad | AJaeger done - thanks! | 12:32 |
| errr | Im having an issue with federation. Im using shibboleth, and ADFS is my IDP. I have verified that /Shibboleth.sso/Session shows I have a valid session. In the keystone logs it shows to be properly mapping my user into the "fedgroup" in the "Default" domain as I have defined in my rules.json file, but at horizon it tells me "Login failed: An error occurred authenticating. Please try again later." | 12:34 |
| errr | any ideas what else I could check to see why I cant get into Horizon? | 12:34 |
| cmurphy | errr: if the keystone logs (with debug=true and insecure_debug=true) aren't giving anything useful then in horizon's local_settings.py you can set LOGGING->handlers->console->level to 'DEBUG' which might give more useful input on horizon's side | 12:36 |
| errr | ok thanks | 12:37 |
| cmurphy | shibd.log or shibd_warn.log or the main apache error.log might also be useful places to look | 12:37 |
| errr | nothing there, like those are all showing success | 12:38 |
| *** prashkre has quit IRC | 12:40 | |
| errr | yay! fixed thanks! | 12:44 |
| cmurphy | \o/ | 12:44 |
| cmurphy | errr: what was the problem? | 12:44 |
| errr | when my co-workers dont use valid SSL certs it makes me want to punch things. | 12:44 |
| errr | so much extra work Ive done helping them when at every turn it was from being to cheap or lazy to get a valid cert for this lab | 12:45 |
| *** shyamb has quit IRC | 12:45 | |
| *** shyamb has joined #openstack-keystone | 12:45 | |
| *** shyamb has quit IRC | 12:50 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Adresses LDAP case-sensitive issue https://review.openstack.org/603345 | 13:12 |
| *** prashkre has joined #openstack-keystone | 13:27 | |
| openstackgerrit | Merged openstack/keystone master: Properly normalize domain ids in flask https://review.openstack.org/603239 | 13:33 |
| *** glb has joined #openstack-keystone | 13:36 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Convert legacy functional jobs to Zuul-v3-native https://review.openstack.org/602452 | 13:44 |
| *** lbragstad has quit IRC | 13:53 | |
| *** lbragstad has joined #openstack-keystone | 13:54 | |
| *** ChanServ sets mode: +o lbragstad | 13:54 | |
| hrybacki | kmalloc gagehugo can either of you help me understand the difference between the purpose of `resources` and the `resource_mapping` ? I dug down into the the latter but the former doesn't seem to have much in underlying code. But I noted that all of the root level paths for the APIS are tied to `resources` | 14:03 |
| *** shyamb has joined #openstack-keystone | 14:04 | |
| hrybacki | e.g. why not just have all the resources inside of the `resource_mapping` | 14:04 |
| *** Emine has quit IRC | 14:06 | |
| kmalloc | hrybacki: resources does some extra magic | 14:16 |
| kmalloc | Baiscally "known" paths | 14:17 |
| hrybacki | kmalloc: ah, okay. Is that in the upstream docs and I just missed them maybe? | 14:17 |
| kmalloc | No, it's custom for our impl | 14:17 |
| hrybacki | okay, I'll dig around in the common code again | 14:18 |
| hrybacki | thanks kmalloc | 14:18 |
| kmalloc | It just is "this is common stuff" and it does the json home bits | 14:18 |
| kmalloc | Without needing explicit rel, etc | 14:18 |
| kmalloc | Most folks will use resource_mapping | 14:18 |
| *** Emine has joined #openstack-keystone | 14:19 | |
| kmalloc | But we have enough things currently, it made sense to have a "common" register this route code | 14:19 |
| kmalloc | Look at federation, it uses both. | 14:19 |
| hrybacki | ack, will do | 14:19 |
| kmalloc | https://review.openstack.org/#/c/603239/1 lbragstad cmurphy | 14:24 |
| kmalloc | That didn't work before, I omitted the get domain ID from token method | 14:24 |
| kmalloc | We didn't test inferred domain membership on creation | 14:24 |
| kmalloc | Shade found it. | 14:24 |
| lbragstad | kmalloc does that need to be backported? | 14:25 |
| kmalloc | The only place get ID from token was used was in normalize domain, so the new code splits it out. | 14:25 |
| kmalloc | Don't think so, I'll check | 14:25 |
| kmalloc | My guess is it wasn't even hit until groups | 14:25 |
| kmalloc | Which landed in stien | 14:25 |
| kmalloc | Since domain specific roles always require an explicit domain, and most other things are not domain owned. | 14:26 |
| kmalloc | Need to run, Dr appointment | 14:26 |
| kmalloc | Might miss meeting today. | 14:26 |
| cmurphy | kmalloc: not sure I understand, it sounds like the 500 was caused by not passing the request object to cls._get_domain_id_from_token()? so my suggestion could work? | 14:27 |
| cmurphy | kmalloc: can wait till you're back | 14:28 |
| kmalloc | No, it was because the function didn't exist on the resourcebase | 14:28 |
| cmurphy | oh i see | 14:28 |
| kmalloc | :) | 14:28 |
| gagehugo | o/ | 14:28 |
| * gagehugo reads scrollback | 14:29 | |
| lbragstad | i was wondering about htat | 14:29 |
| lbragstad | i looked at the copy i have locally and that method isn't in the flask specific bits | 14:29 |
| kmalloc | Exactly | 14:29 |
| lbragstad | the wsgi/server implementation prior to flask also is the one that accepted request objecst | 14:29 |
| lbragstad | which is what caused me to notice it - since the method signature was different | 14:30 |
| kmalloc | And since the rule is (except special circumstances) don't change tests when porting to flask, test gaps can lead to broken behavior | 14:30 |
| kmalloc | We didn't test for this, it was broken. Thankfully shade/sdk did test for it. | 14:30 |
| kmalloc | Even if it was unintentional | 14:30 |
| kmalloc | Turns out, it was an accident it was even tested over there as well. | 14:31 |
| lbragstad | glad we added tests | 14:31 |
| AJaeger | thanks, lbragstad ! | 14:48 |
| lbragstad | no problem - thanks for the clean up | 14:53 |
| *** wxy| has joined #openstack-keystone | 15:08 | |
| *** belmoreira has quit IRC | 15:15 | |
| *** shyamb has quit IRC | 15:18 | |
| *** felipemonteiro has joined #openstack-keystone | 15:24 | |
| *** prashkre has quit IRC | 15:28 | |
| *** Emine has quit IRC | 15:31 | |
| *** naptastic has joined #openstack-keystone | 15:32 | |
| naptastic | Is `keystone-manage bootstrap` responsible for creating roles? | 15:33 |
| cmurphy | naptastic: pre-rocky it is responsible for creating the admin role, in rocky+ it creates the admin, member, and reader roles | 15:34 |
| naptastic | cmurphy, Awesome. It's not doing so right now, and it's not giving any clue as to why, at least that I've been able to find. | 15:35 |
| naptastic | Is there a way to create the 'admin' role in the 'default' domain otherwise? | 15:35 |
| cmurphy | naptastic: it's not supposed to create them in domains, it creates global roles | 15:36 |
| cmurphy | `openstack role create admin/member/reader` would do the trick | 15:36 |
| cmurphy | well if the admin role isn't there you'd have a hard time creating any roles | 15:37 |
| naptastic | YEP. :-) | 15:37 |
| cmurphy | oh well something is wrong there | 15:38 |
| naptastic | oh yeah. Lemme see if I can find the more useful error. | 15:38 |
| cmurphy | when you run keystone-manage bootstrap does it give any errors? or an info log saying that the role was created? or info log saying it is already created? | 15:38 |
| *** felipemonteiro has quit IRC | 15:39 | |
| naptastic | It exits 0 and prints nothing. It also doesn't put anything in /var/log/keystone. | 15:39 |
| cmurphy | hmm usually even if it does nothing it should print something | 15:40 |
| naptastic | The only output I've gotten out of it is that it needs OS_BOOTSTRAP_PASSWORD, which I then set, and then it exits 0 without printing anything. | 15:40 |
| cmurphy | maybe i always run it with debug=true, maybe try setting that in keystone.conf and see if there's more output? | 15:41 |
| naptastic | (I'm using Queens, btw. The setup is... uncommon, I'm sure. We're deploying via Puppet and integrating with an established LDAP system to which we have read-only access.) | 15:41 |
| cmurphy | the roles should be created in sql so that shouldn't be an issue | 15:41 |
| cmurphy | is the admin role not there in the roles table? | 15:41 |
| naptastic | Checking... | 15:42 |
| naptastic | admin and _member_ are in the role table, with {} extras and NULL domain_ids. So that's right. | 15:42 |
| cmurphy | okay, so then bootstrap worked correctly, so what's the actual problem you're facing? | 15:43 |
| naptastic | "Could not find project: services.: ProjectNotFound: Could not find project: services." in /var/log/keystone/keystone-admin.log | 15:43 |
| naptastic | when I do "openstack user list" or most anything else. | 15:43 |
| naptastic | If I try to create the "services" project (which seems like the wrong thing to do, but I tried it anyway) it says something more specific (one moment) | 15:44 |
| naptastic | ok, with a token it says "You have tried to create a resource using the admin token. As this token is not within a domain you must explicitly include a domain for this resource to belong to." | 15:45 |
| naptastic | trying with password... | 15:46 |
| cmurphy | naptastic: what does your openrc look like? you shouldn't normally be using OS_TOKEN for anything | 15:46 |
| naptastic | (I'm going to condense it a bit) | 15:47 |
| naptastic | unset OS_TOKEN OS_URL OS_PASSWORD OS_TENANT_NAME OS_USERNAME OS_AUTH_URL; export OS_IDENTITY_API_VERSION=3; export OS_PASSWORD=[redacted]; export OS_TENANT_NAME=admin; export OS_USERNAME=admin; export OS_AUTH_URL=http://10.0.40.16:5000/v3 | 15:47 |
| naptastic | sorry for the poor readability. IDK what kind of flood protection is in here and I didn't want to trip it. :) | 15:48 |
| cmurphy | naptastic: okay so I'm not sure where the 'services' project is coming from but instead of setting OS_TENANT_NAME you should set OS_PROJECT_NAME=admin, and you also need to set OS_USER_DOMAIN_NAME=Default and OS_PROJECT_DOMAIN_NAME=Default | 15:49 |
| naptastic | Ok, trying that | 15:50 |
| cmurphy | if you have OS_PROJECT_NAME=services or OS_TENANT_NAME=services set in your env for some reason that might cause it | 15:50 |
| naptastic | I've been very careful to keep env clean of OS_ variables, since they've caused me a lot of Python errors. (I can't remember them exactly.) | 15:52 |
| naptastic | User 999999 has no access to project 09d4f0ab68e243eda5de26855b6636aa _populate_roles /usr/lib/python2.7/dist-packages/keystone/token/providers/common.py: | 15:53 |
| naptastic | that seems more useful :) | 15:53 |
| cmurphy | naptastic: is your identity backend completely backed by ldap? you're not using something like https://docs.openstack.org/keystone/latest/admin/identity-domain-specific-config.html ? | 15:56 |
| naptastic | cmurphy, we're not using domain-specific configs. To be precise, identity is all in LDAP, and assignments are all in SQL. | 15:57 |
| cmurphy | naptastic: okay, iirc I think we never addressed that use case when we created the bootstrap command, so the only way to create the role assignment for an admin user living in ldap would be to edit the role_assignments sql table | 15:59 |
| cmurphy | I'd recommend setting up a separate domain for ldap users so that the admin user and service users can live in sql | 16:00 |
| naptastic | Gotcha. Well, switching back to domain-specific backends is doable (we tried it before) but how bad of an idea is modifying role_assignments directly? | 16:01 |
| naptastic | actually, I don't have that table. Is it different in Queens vs. Rocky? | 16:02 |
| naptastic | (I've got to go get lunch; I'll be back in less than 30 minutes, probably much less.) | 16:05 |
| cmurphy | naptastic: oh sorry the table name is just 'assignment' | 16:13 |
| cmurphy | naptastic: I would not officially recommend editing the table directly but anecdotally I have done it successfully | 16:14 |
| *** bnemec has quit IRC | 16:28 | |
| *** bnemec has joined #openstack-keystone | 16:28 | |
| *** wxy| has quit IRC | 16:29 | |
| naptastic | cmurphy, I fear no foreign key constraints. I will go boldly and restore a snapshot if I completely screw it up. :) Thanks for the info! | 16:34 |
| *** gyee has joined #openstack-keystone | 16:38 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Convert legacy functional jobs to Zuul-v3-native https://review.openstack.org/602452 | 16:39 |
| *** prashkre has joined #openstack-keystone | 16:40 | |
| *** prashkre has quit IRC | 16:44 | |
| *** prashkre has joined #openstack-keystone | 16:44 | |
| openstackgerrit | Harry Rybacki proposed openstack/keystone master: WIP: Convert projects API to Flask https://review.openstack.org/603451 | 17:17 |
| hrybacki | kmalloc: ^^ (heavy on the WIP) | 17:18 |
| hrybacki | only 5 of the endpoints covered so far | 17:18 |
| gagehugo | nice | 17:19 |
| lbragstad | #startmeeting keystone-office-hours | 17:20 |
| openstack | Meeting started Tue Sep 18 17:20:12 2018 UTC and is due to finish in 60 minutes. The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot. | 17:20 |
| lbragstad | oops | 17:20 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 17:20 |
| *** openstack changes topic to " (Meeting topic: keystone-office-hours)" | 17:20 | |
| *** ChanServ changes topic to "Rocky release schedule: https://releases.openstack.org/rocky/schedule.html | Meeting agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h | Trello: https://trello.com/b/wmyzbFq5/keystone-rocky-roadmap !!NOTE!! This Channel is Logged ( https://tinyurl.com/OpenStackKeystone )" | 17:20 | |
| openstack | The meeting name has been set to 'keystone_office_hours' | 17:20 |
| *** prashkre has quit IRC | 17:33 | |
| *** prashkre_ has joined #openstack-keystone | 17:33 | |
| hrybacki | Photo and video of damage, destruction caused by Hurricane Florence - The Washington Post (https://www.washingtonpost.com/graphics/2018/national/amp-stories/photo-and-video-of-damage-destruction-caused-by-hurricane-florence/) | 17:42 |
| hrybacki | I lived in Fayetteville (pictured) for a few years (my first home in NC). Pretty bad | 17:42 |
| kmalloc | o/ | 17:42 |
| hrybacki | \o | 17:42 |
| kmalloc | back from the dr. office yay | 17:43 |
| kmalloc | lbragstad: no need to backport, that bug (get_domain_id_from_token) was introduced when groups were added | 17:45 |
| kmalloc | lbragstad: to flask, so ... not long ago | 17:45 |
| kmalloc | def. post Rocky | 17:45 |
| lbragstad | ack | 17:45 |
| lbragstad | thanks! | 17:45 |
| gagehugo | o/ | 17:46 |
| kmalloc | lbragstad: and additional bugs/proposed fixes are closed out now that that has merged | 17:47 |
| lbragstad | ++ cool | 17:49 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Comment out un-runnable tests https://review.openstack.org/603459 | 17:54 |
| kmalloc | lbragstad: ^ that is in lieu of deletion of the tests to allow ayoung to respin them on top of flask auth. | 17:54 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: WIP: Convert auth to flask native dispatching https://review.openstack.org/603461 | 17:59 |
| kmalloc | hrybacki: hah, flaskification has only been 67 commits *so far* | 18:02 |
| kmalloc | we might get it all done in under 100 commits (oh man, so glad we didn't make this an intern project) | 18:03 |
| kmalloc | lbragstad: ^ | 18:03 |
| hrybacki | heh, that would be one frazzled intern | 18:05 |
| hrybacki | kmalloc: so how do I determine if the tags portion of the project API should be a resource or a `ks_flask.ResourceBase` or a `flask_restful.Resource` ? | 18:06 |
| kmalloc | hrybacki: gut feeling :P | 18:08 |
| hrybacki | heh, ResourceBase it is | 18:08 |
| kmalloc | hrybacki: typically a "resource" conforms as follows: A number of concurrent operations (GET/POST/PATCH/DELETE) in a single case, easy prefixing, and not a lot of path substitutions (easier to represent in a mapped resource) | 18:08 |
| kmalloc | hrybacki: basically, if you need to go through hoops to make resource work, use mapped resource instead | 18:09 |
| hrybacki | ack | 18:09 |
| lbragstad | kmalloc ack | 18:12 |
| *** prashkre_ has quit IRC | 18:21 | |
| *** prashkre_ has joined #openstack-keystone | 18:32 | |
| gagehugo | hrybacki might be better off doing mapped resource, you have {project_id} & {tag} | 18:55 |
| *** tobiash has left #openstack-keystone | 18:56 | |
| hrybacki | gagehugo: ack :) | 18:57 |
| gagehugo | https://github.com/openstack/keystone/blob/master/keystone/resource/routers.py | 18:59 |
| gagehugo | the update without {tag value} expects a body, so doing it as non-mapped might be weird | 19:00 |
| gagehugo | you may need to override wrap_member as well, as tags was written to follow the APIWG spec and it was specific on what should be returned (aka it was different than what keystone does by default) | 19:01 |
| gagehugo | if you see anything weird let me know and I can help | 19:01 |
| gagehugo | regarding that | 19:01 |
| naptastic | cmurphy, forgive my ignorance, but what do the <<double angle brackets>> signify in the tables related to assignment? (e.g., <<keystone.domain.root>>) | 19:06 |
| naptastic | And do I need to include them when I'm inserting values? | 19:07 |
| *** raildo has quit IRC | 19:14 | |
| *** raildo has joined #openstack-keystone | 19:20 | |
| naptastic | I included them and it worked :) | 19:27 |
| naptastic | Now I've just got to figure out why keystone-manage bootstrap is exiting 1 with no output. | 19:28 |
| hrybacki | I just lugged a Dell R910 up to my desk from the parking deck. I am no longer in Army shape -_- | 19:41 |
| lbragstad | :) | 19:47 |
| *** oikiki has joined #openstack-keystone | 19:48 | |
| *** dmellado has quit IRC | 20:01 | |
| *** david-lyle is now known as dklyle | 20:02 | |
| *** raildo_ has joined #openstack-keystone | 20:04 | |
| *** raha has joined #openstack-keystone | 20:05 | |
| *** raildo has quit IRC | 20:06 | |
| *** dave-mccowan has joined #openstack-keystone | 20:07 | |
| raha | Hi. I need to test my token proposal, but I have not had any OpenStack programming experiment, yet. Where should I start? | 20:10 |
| *** prashkre__ has joined #openstack-keystone | 20:10 | |
| *** prashkre_ has quit IRC | 20:14 | |
| raha | hi | 20:19 |
| openstackgerrit | Harry Rybacki proposed openstack/keystone master: WIP: Convert projects API to Flask https://review.openstack.org/603451 | 20:21 |
| *** rmascena__ has joined #openstack-keystone | 20:26 | |
| *** raildo_ has quit IRC | 20:29 | |
| *** raha has quit IRC | 20:34 | |
| *** rmascena__ has quit IRC | 20:35 | |
| knikolla | lbragstad: "Although the trains sound the same, much has changed in keystone since then." | 20:47 |
| knikolla | that sentence is... poetic | 20:48 |
| lbragstad | lol | 20:48 |
| lbragstad | how'd you find that post so quickly? | 20:49 |
| knikolla | lbragstad: was going through planet openstack | 20:50 |
| knikolla | and apparently the timing was uncanny as it was the topmost | 20:50 |
| lbragstad | huh | 20:53 |
| lbragstad | no kidding | 20:53 |
| *** dmellado has joined #openstack-keystone | 21:20 | |
| *** rmascena__ has joined #openstack-keystone | 21:25 | |
| knikolla | what's people's opinion of medium.com? i'm moving to yet another platform :/ | 21:25 |
| *** naptastic has quit IRC | 21:26 | |
| *** rmascena__ has quit IRC | 21:26 | |
| gagehugo | I've seen some decent articles on there | 21:27 |
| *** Emine has joined #openstack-keystone | 21:28 | |
| *** prashkre__ is now known as prashkre | 21:33 | |
| lbragstad | knikolla i have no idea | 21:35 |
| lbragstad | i've never used it | 21:35 |
| knikolla | https://medium.com/behind-clouds | 21:36 |
| knikolla | started a blog | 21:36 |
| knikolla | i'll probably be hosting my stuff there moving forward | 21:36 |
| *** Emine has quit IRC | 21:40 | |
| * lbragstad bookmarks | 21:45 | |
| *** oikiki has quit IRC | 21:47 | |
| *** prashkre has quit IRC | 21:52 | |
| *** jaosorior_ has joined #openstack-keystone | 22:42 | |
| *** jaosorior has quit IRC | 22:45 | |
| *** rcernin has joined #openstack-keystone | 22:47 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!