| *** Dinesh_Bhor has joined #openstack-keystone | 00:34 | |
| *** Dinesh_Bhor has quit IRC | 01:27 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:35 | |
| *** Dinesh_Bhor has quit IRC | 02:02 | |
| *** annp has joined #openstack-keystone | 02:26 | |
| wxy-xiyuan | ping vishakha | 02:36 |
|---|---|---|
| wxy-xiyuan | Re https://review.openstack.org/#/c/610005 | 02:36 |
| *** openstackgerrit has joined #openstack-keystone | 02:41 | |
| openstackgerrit | Merged openstack/keystone master: Clarify group-mapping example in docs https://review.openstack.org/607967 | 02:41 |
| *** felipemonteiro has joined #openstack-keystone | 02:42 | |
| vishakha | wxy-xiyuan: hello | 02:49 |
| wxy-xiyuan | vishakha: hi, for this patch, you want to test a case that the `region_id` could not be '', right? | 02:50 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Default and resource limit should not be '-ve' https://review.openstack.org/610479 | 02:51 |
| *** Dinesh_Bhor has joined #openstack-keystone | 02:55 | |
| vishakha | wxy-xiyuan: yes if user passed empty region-id | 03:07 |
| *** dave-mccowan has quit IRC | 03:08 | |
| gagehugo | vishakha: left some comments on https://review.openstack.org/#/c/610479/ once those are addressed it should be good :) | 03:08 |
| gagehugo | wxy-xiyuan: o/ | 03:08 |
| vishakha | gagehugo: Thanks for the comments. Working on those | 03:09 |
| wxy-xiyuan | gagehugo: :) | 03:09 |
| wxy-xiyuan | vishakha: Thanks, it makes sense. | 03:11 |
| vishakha | wxy-xiyuan: your welcome :) | 03:12 |
| *** Dinesh_Bhor has quit IRC | 03:36 | |
| *** felipemonteiro has quit IRC | 04:04 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:30 | |
| *** viks__ has joined #openstack-keystone | 04:34 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Default and resource limit should not be '-ve' https://review.openstack.org/610479 | 04:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Remove incorrect copyright notice. https://review.openstack.org/610879 | 05:14 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Remove incorrect copyright notice. https://review.openstack.org/610879 | 05:15 |
| kmalloc | wxy-xiyuan: ^ | 05:15 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Added test case update registered limit with region https://review.openstack.org/610005 | 05:34 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: [WIP] Implement scope_type checking for role_assignments https://review.openstack.org/609210 | 05:49 |
| *** Dinesh_Bhor has quit IRC | 06:16 | |
| wxy-xiyuan | kmalloc: cool. Thanks for the quick update. Leaving +W to other non-huawei reviewer :) | 06:24 |
| *** rdopiera has joined #openstack-keystone | 06:36 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Allow registered limit's region_id to be None https://review.openstack.org/610887 | 06:42 |
| *** rcernin has quit IRC | 07:01 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: [WIP] Implement scope_type checking for role_assignments https://review.openstack.org/609210 | 07:24 |
| *** markvoelker has quit IRC | 07:29 | |
| *** markvoelker has joined #openstack-keystone | 07:29 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:33 | |
| *** mvkr has quit IRC | 07:34 | |
| *** markvoelker has quit IRC | 07:34 | |
| *** mvkr has joined #openstack-keystone | 08:14 | |
| *** markvoelker has joined #openstack-keystone | 08:30 | |
| *** mvkr has quit IRC | 08:35 | |
| *** mvkr has joined #openstack-keystone | 08:48 | |
| *** markvoelker has quit IRC | 09:03 | |
| lbragstad | ayoung interesting | 09:13 |
| lbragstad | thanks for the heads up - i'll take another look today | 09:13 |
| *** mvkr has quit IRC | 09:40 | |
| *** mvkr has joined #openstack-keystone | 09:41 | |
| BlackDex | Hello there. Is it possible to have multiple local storage disks per instance? | 09:51 |
| BlackDex | so, a separate boot/os disk and a separate data disk both living on the local storage, no volumes/cinder | 09:52 |
| *** imacdonn has quit IRC | 09:54 | |
| *** imacdonn has joined #openstack-keystone | 09:55 | |
| lbragstad | BlackDex that might be a good question for the operator ML or #openstack-dev | 09:55 |
| BlackDex | lbragstad: Ill try #openstack-dev :) | 09:56 |
| lbragstad | it does sound cinder specific; someone in #openstack-cinder might have an answer, too | 09:56 |
| BlackDex | thx | 09:56 |
| BlackDex | :) | 09:56 |
| BlackDex | Sorry, i see i'm in keystone | 09:56 |
| BlackDex | haha | 09:56 |
| BlackDex | wanted to ask in @openstack | 09:56 |
| lbragstad | :) | 09:57 |
| BlackDex | All those channels | 09:57 |
| lbragstad | tell me about it | 09:57 |
| *** markvoelker has joined #openstack-keystone | 10:00 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Fixing update registered limit api-ref https://review.openstack.org/610000 | 10:07 |
| *** jamielennox has quit IRC | 10:11 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Fixing update registered limit api-ref https://review.openstack.org/610000 | 10:12 |
| *** jamielennox has joined #openstack-keystone | 10:13 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Fixing update unified limit api-ref https://review.openstack.org/610000 | 10:16 |
| *** Dinesh_Bhor has quit IRC | 10:20 | |
| *** felipemonteiro has joined #openstack-keystone | 10:27 | |
| *** markvoelker has quit IRC | 10:34 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 10:54 | |
| lbragstad | wxy-xiyuan do you remember if we ever decided on if we were going to allow negative values for limits? | 10:59 |
| lbragstad | e.g., if a resource has a negative value, it's not limited? | 10:59 |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1797876 | 10:59 |
| openstack | Launchpad bug 1797876 in OpenStack Identity (keystone) "Default values for registered limit allows to set negative value" [Undecided,In progress] - Assigned to Vishakha Agarwal (vishakha.agarwal) | 10:59 |
| *** Dinesh_Bhor has quit IRC | 11:06 | |
| *** dave-mccowan has joined #openstack-keystone | 11:09 | |
| *** felipemonteiro has quit IRC | 11:20 | |
| wxy-xiyuan | lbragstad: I think we didn't have the related discussion. | 11:25 |
| wxy-xiyuan | lbragstad: We should keep the behavior the same with what most services do now. | 11:26 |
| openstackgerrit | Merged openstack/oslo.policy master: Clean up .gitignore references to personal tools https://review.openstack.org/610414 | 11:27 |
| wxy-xiyuan | lbragstad: for example, currently, set volume's quota to -1 in cinder means no limit IIRC | 11:28 |
| wxy-xiyuan | lbragstad: different service may have different behavior. But I guess most of them use -1 for unlimited. | 11:29 |
| *** markvoelker has joined #openstack-keystone | 11:31 | |
| wxy-xiyuan | lbragstad: glance now uses config options for limit which treat negative values for unlimited as well. | 11:31 |
| lbragstad | i think nova does, too | 11:32 |
| lbragstad | https://github.com/openstack/nova/blob/master/nova/conf/quota.py#L29 | 11:33 |
| lbragstad | adriant does adjutant have a weekly meeting? | 11:34 |
| wxy-xiyuan | lbragstad: ++, so we should allow negative values. | 11:34 |
| lbragstad | so - how does that work with a hierarchy? | 11:36 |
| lbragstad | negative values in flat enforcement don't seem to be an issue | 11:36 |
| wxy-xiyuan | lbragstad: I think we have a bug in our code for hierarchy model if we treat negative value as unlimited. | 11:37 |
| lbragstad | so - using negative values for limits will be conditional based on the enforcement model? | 11:37 |
| wxy-xiyuan | No, we should always allow negative values for limits, no matter what model is chosen. | 11:38 |
| lbragstad | oh, got it. i missed that part then | 11:38 |
| wxy-xiyuan | I mean in hierarchy model, if parent is a negative values, its child can have a positive value, but currently in our code, we just check child <= parent which is wrong. | 11:39 |
| lbragstad | if a parent project has a limit of 10 cores and someone tries to set the child limit to negative, that should error, right? | 11:39 |
| wxy-xiyuan | lbragstad: I think so. | 11:40 |
| lbragstad | ok - i agree | 11:40 |
| lbragstad | if a parent project has a limit of -1 on cores then a child project can have a limit of -1 on cores | 11:40 |
| lbragstad | since child.limit <= parent.limit, which is what we do today i think | 11:41 |
| wxy-xiyuan | yes. | 11:41 |
| lbragstad | cool - that makes sense | 11:41 |
| *** jistr is now known as jistr|afk | 11:47 | |
| openstackgerrit | Merged openstack/oslo.limit master: Clean up .gitignore references to personal tools https://review.openstack.org/610418 | 11:53 |
| openstackgerrit | Merged openstack/keystone master: Loosen the assertion for logging scope type warnings https://review.openstack.org/597186 | 11:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement scope_type checking for credentials https://review.openstack.org/594547 | 12:01 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove obsolete credential policies https://review.openstack.org/597187 | 12:01 |
| *** markvoelker has quit IRC | 12:04 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Allow registered limit's region_id to be None https://review.openstack.org/610887 | 12:05 |
| *** shyamb has joined #openstack-keystone | 12:09 | |
| *** Emine has joined #openstack-keystone | 12:30 | |
| *** felipemonteiro has joined #openstack-keystone | 12:32 | |
| *** raildo has joined #openstack-keystone | 12:35 | |
| *** Emine has quit IRC | 13:09 | |
| *** mchlumsky has joined #openstack-keystone | 13:13 | |
| *** shyamb has quit IRC | 13:14 | |
| openstackgerrit | ayoung proposed openstack/oslo.policy master: namespaced flag on checker CLI https://review.openstack.org/610402 | 13:19 |
| *** jistr|afk is now known as jistr | 13:20 | |
| *** felipemonteiro has quit IRC | 13:27 | |
| openstackgerrit | ayoung proposed openstack/keystone master: WIP Catalog for Unscoped Tokens https://review.openstack.org/610975 | 13:51 |
| hrybacki | lbragstad: I can't maske it to Berlin -- Ozz and Adam have taken over the talk. I know they were working to move some things around due to conflicts though | 14:19 |
| lbragstad | hrybacki sounds good - thanks for the update! | 14:20 |
| cmurphy | hrybacki: :'( | 14:24 |
| hrybacki | I'll be at PTS(ummit)! | 14:24 |
| hrybacki | My Fall kinda blew apart =/ | 14:25 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Update API version to 3.11 https://review.openstack.org/608216 | 14:32 |
| openstackgerrit | Jose Castro Leon proposed openstack/keystone master: Add caching on trust role validation to improve performance https://review.openstack.org/608963 | 14:35 |
| openstackgerrit | Merged openstack/oslo.policy master: Add guidelines for naming policies https://review.openstack.org/606214 | 14:39 |
| hrybacki | lbragstad: wooooooooo^^ | 14:54 |
| lbragstad | damn... | 14:54 |
| hrybacki | They said it couldn't be done.. | 14:55 |
| hrybacki | Did we get much operator feedback? | 14:55 |
| *** felipemonteiro has joined #openstack-keystone | 14:55 | |
| lbragstad | "make all policy names the same they said... it'll be easy they said" | 14:55 |
| lbragstad | :'( | 14:55 |
| *** Emine has joined #openstack-keystone | 14:56 | |
| hrybacki | only 7 patchsets. Seems to be missing a zero | 14:57 |
| lbragstad | ikr | 14:58 |
| ayoung | can someone explain to me how https://review.openstack.org/#/c/608963/4 adds caching? | 15:14 |
| ayoung | hrybacki, I'm sorry to be missing you there. I might need to force a trip to some customer in the RDU area to compensate | 15:17 |
| *** wxy| has joined #openstack-keystone | 15:19 | |
| lbragstad | ayoung it uses an API that is cache | 15:30 |
| lbragstad | cached* | 15:30 |
| lbragstad | ayoung https://review.openstack.org/#/c/608963/4/keystone/assignment/core.py@113 | 15:31 |
| hrybacki | ayoung: you are welcome down anytime :) | 15:35 |
| ayoung | lbragstad, ah...the old code was calling a similarly named but different API? | 15:36 |
| ayoung | list_role_assignments is not cached? | 15:36 |
| lbragstad | no | 15:40 |
| lbragstad | i think that's because it's got a million kwargs | 15:40 |
| lbragstad | and methods with kwargs aren't cachable? | 15:40 |
| lbragstad | that said, the new method signature has a kwarg in it... | 15:41 |
| lbragstad | kmalloc might have to take a gander at that ^ but I'm pretty sure caching doesn't work on methods with kwargs | 15:45 |
| lbragstad | which is strange because i validated that patch locally and noticed a 77% performance increase | 15:46 |
| *** felipemonteiro has quit IRC | 15:49 | |
| openstackgerrit | Merged openstack/oslo.policy master: Add docs for developers testing APIs https://review.openstack.org/604192 | 15:56 |
| kmalloc | lbragstad: caching can now work with kwargs | 16:02 |
| kmalloc | we fixed that in doghpile | 16:02 |
| kmalloc | we can do that witha change to our coce | 16:02 |
| hrybacki | o/ | 16:02 |
| lbragstad | kmalloc oh - awesome | 16:05 |
| lbragstad | i was wondering why performance was so good when i noticed the kwargs | 16:05 |
| lbragstad | glad we fixed that | 16:06 |
| lbragstad | i'll retract my -1 | 16:06 |
| kmalloc | lbragstad: noooowww we need a cache region we invalidate with any change that impacts that API call | 16:08 |
| *** d0ugal has quit IRC | 16:21 | |
| *** d0ugal has joined #openstack-keystone | 16:23 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Allow registered limit's region_id to be None https://review.openstack.org/610887 | 16:43 |
| lbragstad | kmalloc yeah - exactly | 17:04 |
| lbragstad | that's the way it is in other APIs and that's probably fine | 17:04 |
| lbragstad | not sure if we should be validating invalid query parameters better, but... | 17:04 |
| kmalloc | ok let me dig up that key generator code for ayoung | 17:04 |
| kmalloc | so we can use kwargs | 17:05 |
| kmalloc | and eliminate all the self._update_user bs | 17:05 |
| kmalloc | ayoung, lbragstad: we need to use https://dogpilecache.readthedocs.io/en/latest/api.html#dogpile.cache.util.function_key_generator | 17:05 |
| kmalloc | sorry https://dogpilecache.readthedocs.io/en/latest/api.html#dogpile.cache.util.kwarg_function_key_generator | 17:06 |
| kmalloc | which i think is just setting a value on the region(s) | 17:06 |
| *** wxy| has quit IRC | 17:07 | |
| kmalloc | https://github.com/openstack/oslo.cache/blob/master/oslo_cache/core.py#L175 | 17:08 |
| kmalloc | yep, just needs to be passed there | 17:08 |
| kmalloc | wew can change that in oslo.cache | 17:09 |
| *** mvkr has quit IRC | 17:13 | |
| openstackgerrit | Merged openstack/keystone master: Increment versioning with pbr instruction https://review.openstack.org/610557 | 17:30 |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.policy master: Add minor nits in testing documentation https://review.openstack.org/611111 | 17:39 |
| kmalloc | lbragstad: where was the oslo.cache bug? | 17:39 |
| lbragstad | for? | 17:39 |
| kmalloc | there was something ... and i can't remember what we chased down the real bug was | 17:39 |
| lbragstad | er - which one? | 17:39 |
| kmalloc | the config dict thing | 17:39 |
| lbragstad | oh | 17:39 |
| lbragstad | sec | 17:40 |
| kmalloc | i'm trying to dig up the actual issue | 17:40 |
| kmalloc | i found the bug | 17:40 |
| kmalloc | but it's missing some context of why multistr opt can't work. | 17:40 |
| kmalloc | or... some such | 17:40 |
| lbragstad | https://bugs.launchpad.net/oslo.cache/+bug/1743036 | 17:40 |
| openstack | Launchpad bug 1743036 in oslo.cache "Multiple memcached back-end instances breaks caching" [Undecided,Confirmed] - Assigned to Morgan Fainberg (mdrnstm) | 17:40 |
| lbragstad | ^ | 17:40 |
| kmalloc | right | 17:40 |
| lbragstad | that one? | 17:40 |
| kmalloc | and i'm missing the context of what the real root cause of the bug is/was | 17:40 |
| kmalloc | hmm. | 17:41 |
| kmalloc | something about how url is processed by dogpile, i guess? | 17:41 |
| kmalloc | because i'm not seeing issues in the oslo.cache code | 17:41 |
| kmalloc | it looks... sane? | 17:41 |
| lbragstad | oslo.cache doesn't deal with backend_argument properly | 17:41 |
| kmalloc | hmm. | 17:41 |
| lbragstad | but it does with memcache_servers | 17:42 |
| kmalloc | multistropt is a list | 17:42 |
| kmalloc | so, we end up with url:127.0.0.1,127.0.0.2:1121 | 17:42 |
| kmalloc | 11211 | 17:42 |
| kmalloc | which splits to url, 127.0.0.1,127.0.0.2:11211 | 17:42 |
| kmalloc | and that is... incorrect somehow | 17:43 |
| lbragstad | yeah - it's weird | 17:43 |
| lbragstad | i thought it had something to do with how those connections were getting established? | 17:43 |
| kmalloc | it might be | 17:44 |
| kmalloc | i wish i hadn't lost the context on this | 17:44 |
| kmalloc | i know where the bug is | 17:44 |
| kmalloc | i have no idea what the bug is though | 17:44 |
| kmalloc | ooh wait a sec. | 17:45 |
| kmalloc | ah. | 17:45 |
| kmalloc | memcache_servers is a list | 17:46 |
| kmalloc | backend_argument url is a string. | 17:46 |
| kmalloc | ok this is fixable | 17:46 |
| kmalloc | Let me propose a fix and if you have a quick env to test withj, that would be great | 17:46 |
| kmalloc | also... wtf. someone mangled something | 17:47 |
| kmalloc | it looks like we override the backend_url with... memcache_servers regardless | 17:48 |
| kmalloc | yeah someone mangled this badly | 17:49 |
| kmalloc | oh wait nvm. | 17:49 |
| *** rdopiera has quit IRC | 17:50 | |
| hrybacki | anyone recall when v2 was originally deprecated by chance? | 18:05 |
| lbragstad | like mitaka | 18:06 |
| hrybacki | ++ I knew it was quite a ways back | 18:06 |
| kmalloc | well. | 18:07 |
| kmalloc | officially deprecated | 18:07 |
| kmalloc | or like "seriously folks, lets not do things in v2" | 18:07 |
| kmalloc | because that latter bit was like grizzly | 18:08 |
| hrybacki | kmalloc: officially -- trying to correct some confused support personnel | 18:09 |
| kmalloc | long enough ago ;) | 18:09 |
| kmalloc | oi | 18:12 |
| kmalloc | finding cache bugs =/ | 18:12 |
| lbragstad | yeah - mitaka is when we had to officially deprecate it | 18:13 |
| *** mvkr has joined #openstack-keystone | 18:14 | |
| *** Emine has quit IRC | 18:15 | |
| *** gyee has joined #openstack-keystone | 18:19 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Support KWARGS in the cache key generating function(s). https://review.openstack.org/611120 | 18:21 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Invalidate app cred AFTER deletion https://review.openstack.org/611121 | 18:21 |
| kmalloc | lbragstad: ^ those are somewhat interesting. | 18:21 |
| kmalloc | lets see if they pass | 18:21 |
| kmalloc | the second one is somewhat important :( | 18:21 |
| kmalloc | lbragstad: trying to think what else is in the pipeline that needs cleanup besides KSM/AuthContext now | 18:22 |
| kmalloc | pymemcached. | 18:22 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Invalidate app cred AFTER deletion https://review.openstack.org/611121 | 18:29 |
| *** dave-mccowan has quit IRC | 19:07 | |
| *** dave-mccowan has joined #openstack-keystone | 19:08 | |
| lbragstad | kmalloc are you getting this locally when you run docs? http://paste.openstack.org/raw/732271/ | 19:10 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement scaffolding for upgrade checks https://review.openstack.org/608785 | 19:10 |
| *** aning has quit IRC | 19:15 | |
| kmalloc | hm. | 19:15 |
| kmalloc | i wasn't | 19:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Pass context objects to policy enforcement https://review.openstack.org/605539 | 19:15 |
| kmalloc | lbragstad: that looks like something doing stupid introspection on the docstring | 19:16 |
| lbragstad | doesn't happen in the gate from what i can tell | 19:16 |
| lbragstad | curious if anyone else was hitting it though | 19:16 |
| kmalloc | i think it's something in docs looking at the introspection and saying OMG functools.partial is not a thing | 19:16 |
| kmalloc | sooooooo *shrug* | 19:17 |
| *** aning has joined #openstack-keystone | 19:18 | |
| openstackgerrit | Sean McGinnis proposed openstack/keystoneauth master: Update sphinx extension logging https://review.openstack.org/611135 | 19:21 |
| openstackgerrit | Sean McGinnis proposed openstack/oslo.policy master: Update sphinx extension logging https://review.openstack.org/611143 | 19:35 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Pass context objects to policy enforcement https://review.openstack.org/605539 | 19:40 |
| *** raildo has quit IRC | 19:46 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system reader role in domains API https://review.openstack.org/605485 | 19:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system member role in domains API https://review.openstack.org/605849 | 19:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system admin role in domains API https://review.openstack.org/605850 | 19:55 |
| *** mchlumsky has quit IRC | 21:25 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system reader role in users API https://review.openstack.org/611179 | 21:41 |
| * lbragstad steps away | 21:41 | |
| *** lbragstad is now known as lbragstad-503 | 21:42 | |
| kmalloc | the lbragstad service is temporarily unavailable. | 21:49 |
| openstackgerrit | Corey Bryant proposed openstack/keystone master: py3 ldap does not allow bytes for DN/RDN/field names https://review.openstack.org/611190 | 22:43 |
| *** rcernin has joined #openstack-keystone | 22:49 | |
| *** dave-mccowan has quit IRC | 23:24 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!