| kmalloc | lbragstad: i think we can just not set headers in KSM instead of setting them to None | 00:08 |
|---|---|---|
| kmalloc | to be WSGI compliant | 00:08 |
| kmalloc | https://review.openstack.org/#/c/613681/1/keystonemiddleware/auth_token/_request.py | 00:08 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystonemiddleware master: [WIP] Correct auth_token headers to be WSGI compliant https://review.openstack.org/613681 | 00:21 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystonemiddleware master: [WIP] Correct auth_token headers to be WSGI compliant https://review.openstack.org/613681 | 00:33 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystonemiddleware master: [WIP] Correct auth_token headers to be WSGI compliant https://review.openstack.org/613681 | 00:34 |
| *** irclogbot_1 has quit IRC | 00:38 | |
| *** erus has quit IRC | 01:00 | |
| wxy-xiyuan | gagehugo: for https://review.openstack.org/#/c/612625/ is it OK now? Since the related deprecation patch has been merged already. Or any other part need be improved? | 01:22 |
| *** aojea has joined #openstack-keystone | 01:23 | |
| *** _01000101_ has joined #openstack-keystone | 01:25 | |
| _01000101_ | Good evening. Should keystone (master) should pass the py27 tests without modification? I'm getting test failures and want to make sure my env is OK before I proceed with a change. | 01:27 |
| *** aojea has quit IRC | 01:27 | |
| wxy-xiyuan | _01000101_: what error you hit? generally, it should be passed by `tox -e py27` command. | 01:28 |
| _01000101_ | keystone.tests.unit.test_sql_upgrade.FullMigration.test_migration_024_add_created_expires_at_int_columns_password ----------------------------------------------------------------------------------------------------------------- Captured traceback: ~~~~~~~~~~~~~~~~~~~ Traceback (most recent call last): File "keystone/tests/unit/test_sql_upgrade.py", line 2371, in test_migration_024_add_created_expires_at_int_ | 01:34 |
| _01000101_ | Hmm, one sec, let me use pastebin | 01:34 |
| _01000101_ | https://pastebin.com/JuETy1F8 | 01:35 |
| _01000101_ | The errors mostly look the same / similar to the one posted | 01:35 |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:36 | |
| wxy-xiyuan | _01000101_: is sqlite installed ? | 01:36 |
| _01000101_ | I simply did `pip install -r test-requirements.txt` (like what I would do for other projects) and then right to tox. I'm installing sqlite3 now | 01:37 |
| _01000101_ | wxy-xiyuan: I re-ran with sqlite3 installed but I got the same failures | 01:43 |
| wxy-xiyuan | _01000101_: emm, so only 18 tests case failed. are all errors the same? | 01:44 |
| _01000101_ | That about sums it up. It's a huge amount of output between failures, but they mostly look like this - oslo_db.exception.DBNonExistentTable: (sqlite3.OperationalError) error in trigger federated_user_insert_trigger: no such table: main.migration_tmp [SQL: u'ALTER TABLE federated_user RENAME TO migration_tmp'] (Background on this error at: http://sqlalche.me/e/e3q8) | 01:47 |
| *** markvoelker has quit IRC | 02:00 | |
| *** markvoelker has joined #openstack-keystone | 02:00 | |
| _01000101_ | It looks like someone had the same issue recently - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=909989 | 02:01 |
| openstack | Debian bug 909989 in src:keystone "keystone: FTBFS (failing tests)" [Serious,Fixed] | 02:01 |
| *** markvoelker has quit IRC | 02:02 | |
| wxy-xiyuan | _01000101_: it works well in my local env. I guess it's related to some libraries version problem. | 02:03 |
| _01000101_ | I've submitted patches for Nova and CinderClient very recently without issue using the same steps for testing. I'm running latest OpenSUSE and latest packages from PyPi | 02:04 |
| wxy-xiyuan | _01000101_: So the package just skipped related tests. It is perhaps still a problem in Keystone. I'll trying to reproduce it locally. Feel free to register a bug in Launchpad. Thanks. https://bugs.launchpad.net/keystone | 02:17 |
| _01000101_ | Roger that, thanks | 02:18 |
| _01000101_ | https://bugs.launchpad.net/keystone/+bug/1802035 filed | 02:40 |
| openstack | Launchpad bug 1802035 in OpenStack Identity (keystone) "Master branch failing py27 tests (oslo_db.exception.DBNonExistentTable:)" [Undecided,New] | 02:40 |
| *** felipemonteiro has joined #openstack-keystone | 02:51 | |
| *** _01000101_ has quit IRC | 02:58 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Add abstract method in trusts base.py https://review.openstack.org/614716 | 03:14 |
| *** felipemonteiro has quit IRC | 03:16 | |
| *** felipemonteiro has joined #openstack-keystone | 03:37 | |
| *** felipemonteiro has quit IRC | 04:15 | |
| *** Dinesh_Bhor has quit IRC | 04:15 | |
| *** jmlowe has quit IRC | 04:21 | |
| *** felipemonteiro has joined #openstack-keystone | 04:31 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:34 | |
| *** sapd1_ has quit IRC | 04:35 | |
| *** sapd1 has joined #openstack-keystone | 04:36 | |
| *** felipemonteiro has quit IRC | 04:43 | |
| *** felipemonteiro has joined #openstack-keystone | 04:47 | |
| *** felipemonteiro has quit IRC | 04:53 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Fixing nits https://review.openstack.org/616072 | 05:40 |
| *** jrist has quit IRC | 05:58 | |
| openstackgerrit | Ghanshyam Mann proposed openstack/keystone master: DNM: testing system_scope https://review.openstack.org/616075 | 06:02 |
| *** jrist has joined #openstack-keystone | 06:11 | |
| *** aojea has joined #openstack-keystone | 06:27 | |
| *** aojea has quit IRC | 06:31 | |
| *** felipemonteiro has joined #openstack-keystone | 06:50 | |
| *** andreaf has quit IRC | 06:53 | |
| *** andreaf has joined #openstack-keystone | 06:55 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Refresh health check doc https://review.openstack.org/615754 | 07:29 |
| *** pcaruana has joined #openstack-keystone | 07:36 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Refresh admin doc https://review.openstack.org/615754 | 07:58 |
| *** felipemonteiro has quit IRC | 08:06 | |
| *** BlackDex has quit IRC | 08:20 | |
| *** BlackDex has joined #openstack-keystone | 08:33 | |
| *** amoralej|off is now known as amoralej | 08:45 | |
| *** dims has quit IRC | 08:52 | |
| *** dims has joined #openstack-keystone | 08:53 | |
| *** dims has quit IRC | 08:58 | |
| *** dims has joined #openstack-keystone | 08:59 | |
| *** kukacz has quit IRC | 09:04 | |
| *** kukacz has joined #openstack-keystone | 09:05 | |
| *** Dinesh_Bhor has quit IRC | 09:43 | |
| openstackgerrit | Merged openstack/keystone master: Add py36 tox environment https://review.openstack.org/615841 | 09:49 |
| openstackgerrit | Merged openstack/keystone-tempest-plugin master: Add python3 functional test job https://review.openstack.org/614492 | 09:49 |
| openstackgerrit | Merged openstack/keystonemiddleware master: Stop supporting revocation list https://review.openstack.org/613651 | 10:09 |
| *** ondrejme has joined #openstack-keystone | 10:27 | |
| ondrejme | Hi, tempest IdentityV3UsersTest keep failing on "The request you have made requires authentication", and in debug logs i see 'X-Auth-Token': '<omitted>'. I think the problem is because http requests don't include this X-Auth-Token. How can i include it to the message please? I run on ocata. | 10:29 |
| cmurphy | ondrejme: if you see x-auth-token in the keystone logs that means it's coming through in the request, the omitted is just to avoid leaking sensitive data in the logs | 10:31 |
| ondrejme | Oh, i see | 10:32 |
| cmurphy | ondrejme: if you turn on insecure_debug in the keystone logs it should give you more information about why the authentication failed | 10:32 |
| cmurphy | is your tempest admin user configured with the correct credentials? | 10:32 |
| ondrejme | It should be, yes. I will check insecure_debug logs, thanks for now | 10:33 |
| ondrejme | I asked about the token because logs also say: | 10:36 |
| ondrejme | INFO keystone.middleware.auth [req-26d6f611-971c-4027-8001-2be61ea5bfa0 016aafa0ba9f4a50aacb3f9fe47226f8 f22b586f94e04669a6bc6035427a886c - default default] Invalid user token | 10:36 |
| cmurphy | ondrejme: are you using uuid or fernet tokens? | 10:36 |
| cmurphy | that message could mean the fernet key repository is misconfigured | 10:36 |
| ondrejme | fernet | 10:36 |
| cmurphy | are you able to authenticate at all? or is it just tempest having the problem? | 10:37 |
| ondrejme | It's just tempest | 10:37 |
| cmurphy | hmm | 10:37 |
| cmurphy | well insecure_debug should make it clear what's wrong | 10:37 |
| *** Dinesh_Bhor has joined #openstack-keystone | 10:37 | |
| ondrejme | ok, ill check | 10:38 |
| ondrejme | This looks a bit better | 10:47 |
| ondrejme | WARNING keystone.common.wsgi [req-7e8aed75-6f4b-4f31-8150-b2ac647ee5f9 - - - - -] Authorization failed. Invalid username or password (Disable insecure_debug mode to suppress these details.) | 10:48 |
| cmurphy | yeah so looks like the credentials in your tempest conf are wrong | 10:48 |
| ondrejme | but in tempest.conf im sure that the "admin_username" and "admin_password" are correct | 10:48 |
| ondrejme | i deploy through kolla | 10:48 |
| ondrejme | and i check password in passwords.yaml | 10:48 |
| ondrejme | should i provide different credentials to tempest? | 10:49 |
| cmurphy | try using the openstack client with those credentials to check if they really work? | 10:50 |
| ondrejme | i just checked, they work (tried a bad password too and it didn't) | 10:59 |
| ondrejme | Can swift's proxy-server section [filter:authtoken] have anything to do with this? | 11:01 |
| cmurphy | I don't think so, it shouldn't interfere with direct requests to keystone | 11:01 |
| cmurphy | did you update tempest recently? maybe they changed how the auth params are set up | 11:02 |
| ondrejme | This is my tempest conf: https://pastebin.com/TefShTwW | 11:03 |
| cmurphy | i'm not a tempest expert | 11:04 |
| cmurphy | reading the docs i wonder if use_dynamic_credentials has anything to do with it | 11:04 |
| ondrejme | Hundreds of other tests pass with this setup though | 11:05 |
| ondrejme | without authorization problem | 11:05 |
| cmurphy | okay so it's not a problem with the admin credentials then, just the Users test | 11:06 |
| cmurphy | is it the test_user_update_own_password test that's failing? | 11:07 |
| ondrejme | yes | 11:07 |
| ondrejme | also 2 more | 11:07 |
| cmurphy | which others? | 11:07 |
| ondrejme | test_password_history_check_self_service_api | 11:07 |
| ondrejme | test_user_account_lockout | 11:07 |
| cmurphy | the Authorization failed message in the logs is expected for the update password test http://git.openstack.org/cgit/openstack/tempest/tree/tempest/api/identity/v3/test_users.py#n97 | 11:08 |
| cmurphy | so what's the actual failure from tempest? | 11:08 |
| ondrejme | tempest.lib.exceptions.Unauthorized: Unauthorized | 11:09 |
| ondrejme | Details: Invalid username or password (Disable insecure_debug mode to suppress these details.) | 11:09 |
| cmurphy | can you paste the whole test output? | 11:10 |
| ondrejme | sure, gimme a sec | 11:10 |
| cmurphy | unauthorized is expected at least at some point | 11:10 |
| ondrejme | in keystone logs i can also see: | 11:11 |
| ondrejme | 2018-11-07 11:10:43.119 20 DEBUG keystone.middleware.auth [req-b37c545f-a8b4-4c8f-894e-2fd7b28dd898 - - - - -] There is either no auth token in the request or the certificate issuer is not trusted. No auth context will be set | 11:11 |
| cmurphy | that's benign | 11:11 |
| cmurphy | that's normal | 11:11 |
| ondrejme | kk, ill fetch the tempest logs | 11:12 |
| *** sapd1 has quit IRC | 11:12 | |
| *** sapd1 has joined #openstack-keystone | 11:12 | |
| ondrejme | https://pastebin.com/BA3KTMfV | 11:15 |
| ondrejme | log for the three tests | 11:15 |
| *** aojea_ has joined #openstack-keystone | 11:18 | |
| cmurphy | do you have password restrictions set in [security_compliance] in keystone.conf? or any logs about password restrictions in the logs? | 11:20 |
| ondrejme | nope, nothing like that in my keystone.conf | 11:22 |
| *** aojea_ has quit IRC | 11:23 | |
| ondrejme | keystone.conf https://pastebin.com/n7FPHMBC | 11:23 |
| cmurphy | it kind of seems like a timing issue to me | 11:24 |
| cmurphy | two of the tests are failing on _restore_password which means they were able to successfully change the password once | 11:24 |
| cmurphy | the other is failing because it's expecting to have the user locked out but they aren't locked out yet | 11:24 |
| cmurphy | ondrejme: what version of tempest are you using? | 11:26 |
| cmurphy | because I think we fixed this https://review.openstack.org/249863 | 11:27 |
| ondrejme | i checked for these changes earlier when debugging, they are present in the code | 11:28 |
| cmurphy | hrm | 11:29 |
| cmurphy | i'm out of ideas then | 11:29 |
| *** Dinesh_Bhor has quit IRC | 11:33 | |
| ondrejme | Ok, here's a twist | 11:47 |
| ondrejme | we actually use Master tempest | 11:47 |
| ondrejme | on ocata | 11:47 |
| cmurphy | i don't think we test master tempest on ocata keystone but in any case those tests haven't changed much and the sleep still applies | 11:49 |
| *** raildo has joined #openstack-keystone | 12:24 | |
| ondrejme | The weird thing is that this only happens on identity v3 tests.. | 12:38 |
| *** amoralej is now known as amoralej|lunch | 13:06 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/keystone master: Remove redundant variables from context class https://review.openstack.org/616198 | 13:32 |
| openstackgerrit | Merged openstack/ldappool master: Allow pool status to be printed as a table https://review.openstack.org/614842 | 13:37 |
| openstackgerrit | Merged openstack/keystone-specs master: fix misspelling of configuration https://review.openstack.org/613945 | 13:38 |
| openstackgerrit | Merged openstack/keystone-specs master: Update policy security roadmap https://review.openstack.org/602443 | 13:39 |
| *** pcaruana has quit IRC | 13:45 | |
| *** jmlowe has joined #openstack-keystone | 13:47 | |
| *** pcaruana has joined #openstack-keystone | 14:00 | |
| *** aojea_ has joined #openstack-keystone | 14:04 | |
| *** amoralej|lunch is now known as amoralej | 14:25 | |
| *** pcaruana has quit IRC | 14:33 | |
| *** pcaruana has joined #openstack-keystone | 14:34 | |
| *** jistr is now known as jistr|call | 15:00 | |
| *** ondrejme has quit IRC | 15:03 | |
| *** aojea_ has quit IRC | 15:04 | |
| gagehugo | wxy-xiyuan: the ps is still deleting that function, it should be kept in if we are deprecating it now right? | 15:05 |
| *** felipemonteiro has joined #openstack-keystone | 15:16 | |
| *** jistr|call is now known as jistr | 15:29 | |
| *** aojea_ has joined #openstack-keystone | 15:30 | |
| cmurphy | knikolla: i have a band-aid for the federation tests if you want to have a look https://review.openstack.org/615391 | 15:33 |
| knikolla | cmurphy: thanks! easy +2! | 15:34 |
| cmurphy | \o/ | 15:34 |
| *** aojea_ has quit IRC | 15:35 | |
| *** aojea_ has joined #openstack-keystone | 15:35 | |
| *** aojea_ has quit IRC | 15:35 | |
| cmurphy | knikolla: kmalloc the deadline to select outreachy interns is on monday, can we sync up on picking people soonish? | 15:35 |
| cmurphy | i'm stressed about picking from so many good candidates :( | 15:36 |
| *** aojea_ has joined #openstack-keystone | 15:36 | |
| knikolla | cmurphy: sure. do we want to schedule a bluejeans call? | 15:36 |
| cmurphy | knikolla: if you have a bluejeans account sure | 15:36 |
| knikolla | i got locked out of it since i got a new phone and forgot to add it as a 2FA device :/ but i'm sure kmalloc does have one. | 15:38 |
| knikolla | otherwise hangouts or any other service should work. | 15:38 |
| *** felipemonteiro has quit IRC | 15:39 | |
| *** david-lyle has quit IRC | 15:42 | |
| *** dklyle has joined #openstack-keystone | 15:47 | |
| *** aojea_ has quit IRC | 15:56 | |
| *** aojea_ has joined #openstack-keystone | 15:57 | |
| *** gyee has joined #openstack-keystone | 15:58 | |
| kmalloc | cmurphy: send the link to his redhat account. :) | 16:04 |
| kmalloc | :P | 16:04 |
| kmalloc | cmurphy: yeah I can schedule blue jeans in a second. | 16:04 |
| *** aojea_ has quit IRC | 16:06 | |
| kmalloc | I am free anytime post coffee and have blue jeans ready. | 16:07 |
| kmalloc | knikolla, cmurphy ^ | 16:07 |
| cmurphy | i could join in about 20 minutes probably | 16:08 |
| cmurphy | or could do later tonight or tomorrow if you guys want time to review the applications | 16:09 |
| knikolla | either way works for me. i'm free in about about 15 minutes until the hour. then will be free after 2 hours | 16:11 |
| *** imacdonn has quit IRC | 16:17 | |
| *** imacdonn has joined #openstack-keystone | 16:17 | |
| kmalloc | Let's do later | 16:31 |
| kmalloc | Or we could do now. | 16:32 |
| kmalloc | Hold on let me get to the computer | 16:32 |
| cmurphy | i'm here | 16:32 |
| cmurphy | we can do a quick session now and do another tomorrow if we need to | 16:33 |
| kmalloc | sec | 16:33 |
| kmalloc | cmurphy, knikolla: https://bluejeans.com/5606719471 | 16:33 |
| kmalloc | now works for me. | 16:34 |
| *** pcaruana has quit IRC | 16:38 | |
| kmalloc | knikolla: lets plan for when you're done in ~2hrs (2pm Eastern ish?) | 16:45 |
| kmalloc | 1pm? | 16:45 |
| kmalloc | i can't do timezone math | 16:45 |
| kmalloc | .... | 16:45 |
| knikolla | kmalloc: sure. 1.30pm eastern works for me. | 16:46 |
| kmalloc | cool, cmurphy ^ | 16:47 |
| kmalloc | cmurphy: also i'm now approved as a mentor | 16:47 |
| kmalloc | so. yay! | 16:47 |
| samueldmq | easy approval \o/ | 16:47 |
| kmalloc | OH it's You! :) | 16:47 |
| kmalloc | hi samueldmq :) | 16:47 |
| samueldmq | heh :-) hi kmalloc and cmurphy | 16:48 |
| kmalloc | samueldmq: submitted for the other one too :P | 16:48 |
| samueldmq | kmalloc: awesome, approved! | 16:49 |
| cmurphy | haha kmalloc ignore my google doc invite then ;) | 16:49 |
| kmalloc | hehehehe | 16:49 |
| kmalloc | i assume samueldmq is _not_ going to be in berlin? | 16:49 |
| kmalloc | because ... it's always good to see him in person. | 16:50 |
| samueldmq | kmalloc: unfortunately your assumption is correct | 16:50 |
| kmalloc | boo | 16:50 |
| samueldmq | kmalloc: likewise thanks | 16:50 |
| samueldmq | kmalloc: I'm finishing to write my masters dissertation on intra-platform interop in openstack | 16:50 |
| kmalloc | nice | 16:51 |
| samueldmq | meaning I'll have plenty of things to prsent next time | 16:51 |
| kmalloc | samueldmq: nice. | 16:51 |
| * kmalloc is planning on going back to school (part time) for an advanced degree soon as well. | 16:52 | |
| kmalloc | reminds me i need to sign up for the "entrance" exam. | 16:52 |
| samueldmq | kmalloc: ++ I really enjoy studying, it's hard to balance things, but I like to suffer perhaps | 16:53 |
| lbragstad | samueldmq kmalloc you two must have figured out time travel or something... | 16:57 |
| samueldmq | lbragstad: o/ | 16:59 |
| samueldmq | lbragstad: oh sure, that's the same as dark circles under eyes | 16:59 |
| lbragstad | i tried washing the dark circles off.. it didn't work | 17:00 |
| samueldmq | lbragstad: I heard having more babies helps out | 17:01 |
| kmalloc | lbragstad: nah, i just don't sleep | 17:01 |
| lbragstad | samueldmq does it? that math doesn't work | 17:01 |
| samueldmq | :-) | 17:01 |
| lbragstad | ;) | 17:01 |
| *** irclogbot_1 has joined #openstack-keystone | 17:02 | |
| kmalloc | lbragstad: ask steve | 17:09 |
| kmalloc | i'm sure he can tell you | 17:09 |
| lbragstad | lol | 17:09 |
| openstackgerrit | Merged openstack/keystone master: Switch devstack plugin to samltest.id https://review.openstack.org/615391 | 18:17 |
| *** aojea_ has joined #openstack-keystone | 18:26 | |
| knikolla | kmalloc: cmurphy: ready when you are. | 18:31 |
| kmalloc | okie | 18:31 |
| kmalloc | thnx for the ping | 18:31 |
| cmurphy | coming | 18:32 |
| kmalloc | samueldmq: ping need you to approve knikolla for the unit tests one too | 18:41 |
| kmalloc | samueldmq: if ytou don | 18:41 |
| kmalloc | 't mind | 18:41 |
| knikolla | samueldmq: just sent the application | 18:43 |
| samueldmq | kmalloc: knikolla: my pleasure, done! thanks for doing so | 18:45 |
| *** aojea_ has quit IRC | 18:57 | |
| kmalloc | knikolla: i have a strange idea on federation testing... | 18:57 |
| knikolla | kmalloc: go on | 18:57 |
| kmalloc | knikolla: I'll stand up a dev server with vexxhost today we can install shib on for testing at least that way we control it | 18:57 |
| kmalloc | and we can run an OIDC provider on it too | 18:57 |
| kmalloc | i need to standup ipsilon for some other things (testing) in infra anyway | 18:58 |
| kmalloc | we can keep things non-voting but we'll at least fully own end-to-end the provider we're testing against | 18:58 |
| knikolla | sure. that sounds fine. | 18:58 |
| kmalloc | rahter than rely on "broken" or "well who knows" public things like testshib/saml.id | 18:58 |
| knikolla | for now. | 18:58 |
| kmalloc | exactly | 18:58 |
| cmurphy | kmalloc: did you see that i got the tests green? | 18:58 |
| kmalloc | cmurphy: yes i did! | 18:59 |
| knikolla | \o/ | 18:59 |
| kmalloc | cmurphy: it was why i was thinking we should at least own the test server | 18:59 |
| kmalloc | even if it isn't stood up in gate dynamically | 18:59 |
| cmurphy | if we can set it up ourselves then we can stand it up in the gate | 18:59 |
| kmalloc | that is the plan | 18:59 |
| cmurphy | but i don't want to have to be the one to set up a shibboleth idp | 18:59 |
| kmalloc | stand it up, and then replicate to gate | 19:00 |
| cmurphy | or maintain one | 19:00 |
| kmalloc | so we use this as a "what are the steps" bits to get it right | 19:00 |
| *** amoralej is now known as amoralej|off | 19:00 | |
| kmalloc | and we maintain a change to point to it so we can confirm our tests work like they should | 19:00 |
| kmalloc | (doesn't have to merge) | 19:00 |
| kmalloc | but i have to standup ipsilon for infra reasons. | 19:01 |
| kmalloc | *anyway* | 19:01 |
| knikolla | kmalloc: please document extensively the standing up process | 19:01 |
| kmalloc | so, might as well re-use that | 19:01 |
| kmalloc | knikolla: hehehe | 19:01 |
| kmalloc | knikolla: it will be done via ansible so i can repeat it | 19:01 |
| kmalloc | i have zero desire to hand-build anything | 19:01 |
| cmurphy | or containerize it so we don't have to understand it :P | 19:01 |
| knikolla | gotta love infra as code | 19:01 |
| kmalloc | cmurphy: well, ansible + docker. | 19:02 |
| cmurphy | sure | 19:02 |
| kmalloc | because that plays into infra / zuul nicely | 19:02 |
| kmalloc | but first steps: ansible and make it repeatable | 19:02 |
| kmalloc | the biggest question is the TLS/PKI setup | 19:02 |
| kmalloc | a self-signed easy-ca should be ok, right? for testing? | 19:03 |
| cmurphy | the biggest question is java-- | 19:03 |
| kmalloc | haha... | 19:03 |
| knikolla | ha, ha, h | 19:03 |
| kmalloc | i was actually looking at ipsilon (python) and seeing if it can run in isolation | 19:03 |
| kmalloc | rather than shib. | 19:04 |
| kmalloc | as long as we are running saml2, OIDC, i'm happy | 19:04 |
| cmurphy | oh okay then | 19:04 |
| knikolla | java is a type of coffee beans, java is a type of coffee beans, java is a type of coffee beans... | 19:04 |
| kmalloc | `It is by caffeine alone I set my mind in motion. It is by the beans of Java that thoughts acquire speed, the hands acquire shakes, the shakes become a warning. It is by caffeine alone I set my mind in motion.` | 19:05 |
| * kmalloc resists the urge to change the channel topic to that ^ | 19:05 | |
| *** kmalloc is now known as needscoffee | 19:05 | |
| needscoffee | BRB. my new nick says it all. | 19:06 |
| * knikolla hands needscoffee a cup of coffee | 19:06 | |
| needscoffee | the real question... | 19:06 |
| needscoffee | do i drink .... | 19:07 |
| needscoffee | https://usercontent.irccloud-cdn.com/file/b6G5aCLH/1lb-ground_2048x2048_8c4fab8d-e6aa-4a33-90de-52184944022f_1024x1024.png | 19:07 |
| needscoffee | or... | 19:07 |
| needscoffee | https://usercontent.irccloud-cdn.com/file/qh9puZGS/death_wish_cauldron_aged_coffee_ground_1024x1024.jpg | 19:07 |
| cmurphy | obvs the seasonal blend | 19:08 |
| knikolla | obvs | 19:08 |
| needscoffee | it's SO good | 19:09 |
| * needscoffee wonders if there will be an issue bringing quality coffee with me to berlin in my bags. | 19:09 | |
| needscoffee | probably an issue with customs. | 19:10 |
| needscoffee | or some such | 19:10 |
| needscoffee | with how much I drink that is :P | 19:10 |
| needscoffee | oh, nice i should be ok as long as i bring less than 10kg | 19:11 |
| needscoffee | yeah i am not drinking 10kg :P | 19:11 |
| * needscoffee goes and drinks coffee... then writes code. | 19:12 | |
| needscoffee | cmurphy going to post a change for oslo.cache to implement pymemcache (will also go upstream long term) and will replace both pool and python-memcache | 19:13 |
| needscoffee | cmurphy: i'll want your eyes on it because... there are very few people in openstack that I know that understand the insanity that is memoization caching | 19:14 |
| cmurphy | needscoffee: i feel that you've grossly overestimated my understanding of caching | 19:15 |
| needscoffee | cmurphy: hhahaah nope. | 19:17 |
| needscoffee | you work on keystone, you have a strong grasp of what memoization really means and how it works. | 19:17 |
| cmurphy | lol | 19:18 |
| *** aojea_ has joined #openstack-keystone | 19:49 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Region update extra support https://review.openstack.org/517726 | 19:50 |
| *** nwilburn has quit IRC | 20:17 | |
| openstackgerrit | Merged openstack/keystone master: Fixing nits https://review.openstack.org/616072 | 20:19 |
| *** needscoffee is now known as kmalloc | 20:19 | |
| kmalloc | cmurphy: this new memcache client setup is *so much* better | 20:20 |
| kmalloc | and will make our caching superior. pooling is built-in | 20:20 |
| kmalloc | we can deprecate all the ick | 20:20 |
| *** aojea_ has quit IRC | 20:21 | |
| *** aojea_ has joined #openstack-keystone | 20:21 | |
| *** aojea_ has quit IRC | 20:43 | |
| *** aojea_ has joined #openstack-keystone | 20:46 | |
| *** pas-ha has quit IRC | 20:47 | |
| *** hogepodge has quit IRC | 20:47 | |
| *** pas-ha has joined #openstack-keystone | 20:48 | |
| *** mnaser has quit IRC | 20:48 | |
| *** lamt has quit IRC | 20:48 | |
| *** hogepodge has joined #openstack-keystone | 20:48 | |
| *** mnaser has joined #openstack-keystone | 20:49 | |
| *** andreaf has quit IRC | 20:51 | |
| *** andreaf has joined #openstack-keystone | 20:52 | |
| *** aojea_ has quit IRC | 20:56 | |
| *** aojea_ has joined #openstack-keystone | 20:58 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: DNM - zuul testing https://review.openstack.org/616305 | 21:02 |
| *** raildo has quit IRC | 21:02 | |
| *** aojea_ has quit IRC | 21:05 | |
| *** aojea_ has joined #openstack-keystone | 21:06 | |
| *** mchlumsky has quit IRC | 21:33 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: DNM - zuul testing https://review.openstack.org/616305 | 21:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add scope documentation for service developers https://review.openstack.org/554727 | 22:36 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Change __all__ list to tuple https://review.openstack.org/616364 | 22:40 |
| gagehugo | there's a lot of UserWarning: Invalid uuid: <<keystone.domain.root>>. To ensure interoperability, identifiers should be a valid uuid. in the unit test logs :( | 22:52 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Region update extra support https://review.openstack.org/517726 | 22:57 |
| gagehugo | lbragstad: done | 22:58 |
| gagehugo | "pls no use extra" | 22:58 |
| kmalloc | gagehugo: yes. we should be exempting the root domain from CADF unless we extract it and make it a 1st order thing, which case, we probably want to do soemthing intellegent like sha515 <<keystone.domain.root>>>[:32] as the ID (migration) | 22:58 |
| kmalloc | and wire up a minor bit of compat code to handle the case where id=<<keystone.domain.root>> | 22:59 |
| * kmalloc is strongly of the opinion we should unhide the root domain and make it the global top-level (any roles granted on it are explicitly inherited only, no way to scope to the root domain directly) | 22:59 | |
| gagehugo | kmalloc: exempting should be pretty easy | 23:00 |
| gagehugo | https://github.com/openstack/pycadf/blob/master/pycadf/identifier.py#L36 | 23:00 |
| kmalloc | gagehugo: right. we should exempt it in keystone. | 23:00 |
| kmalloc | and never emit cadf if we're on that domain | 23:00 |
| gagehugo | oh I see | 23:00 |
| kmalloc | and like i said, we should unhide that domain in general and make ti the place where grants go that we want inherited down the whole tree | 23:01 |
| kmalloc | lbragstad, gagehugo: I'd rather reverse the contract breaking decision and drop the extra column for regions | 23:01 |
| kmalloc | fwiw | 23:01 |
| kmalloc | since we're in a API contract break in either case | 23:01 |
| kmalloc | a) we allow at creation but not on update | 23:02 |
| kmalloc | b) we don't allow on creation or update | 23:02 |
| kmalloc | my opinion is we just drop the "extra values" on the floor. | 23:02 |
| * kmalloc will comment on that review. | 23:02 | |
| kmalloc | gagehugo: commented on the review (cc lbragstad) with a -1 and a note that other cores should override my -1 if it should land as is. | 23:04 |
| gagehugo | I'm fine with either choice | 23:04 |
| kmalloc | i am not advocating eliminating the "additional_attributes" part of the json_schema because that would break creation requests | 23:04 |
| kmalloc | but i really would rather just drop extras to the floor | 23:04 |
| kmalloc | if we need the concept of extras we can add it back in, but in a well-defined location, e.g. [Resource-Object]->VendorData | 23:05 |
| gagehugo | I was just picking up work to close out bugs :p | 23:05 |
| kmalloc | yeah. | 23:05 |
| kmalloc | anyway, like i said, i vote for dropping the additional cruft on the floor on create and contracting out that column | 23:06 |
| gagehugo | sounds like a good Berlin topic too :) | 23:06 |
| kmalloc | if we could drop the extras columns everywhere, i would. | 23:07 |
| kmalloc | that design choice was one of the worst things we've ever had in keystone | 23:07 |
| kmalloc | it has also resulted in things like passwords being stored in plain text (historically) | 23:07 |
| *** aojea_ has quit IRC | 23:24 | |
| *** aojea_ has joined #openstack-keystone | 23:27 | |
| *** aojea_ has quit IRC | 23:32 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!
