| *** imacdonn has quit IRC | 00:00 | |
| *** imacdonn has joined #openstack-keystone | 00:00 | |
| *** itlinux has joined #openstack-keystone | 00:10 | |
| openstackgerrit | Merged openstack/keystone master: Add CentOS support in devstack federation plugin https://review.openstack.org/633374 | 00:10 |
|---|---|---|
| *** edmondsw has quit IRC | 00:38 | |
| *** erus1 has quit IRC | 00:42 | |
| *** erus1 has joined #openstack-keystone | 00:42 | |
| *** gyee has quit IRC | 00:51 | |
| *** markvoelker has joined #openstack-keystone | 01:10 | |
| *** erus1 has quit IRC | 01:11 | |
| *** erus1 has joined #openstack-keystone | 01:12 | |
| kmalloc | lbragstad: there is also a massive slowdown around the holidays. i expect us to be close to rocky or beyond by the end of the cycle | 01:13 |
| kmalloc | if we're diligent we might surpase pike. | 01:13 |
| *** markvoelker has quit IRC | 01:15 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:32 | |
| *** lbragstad has quit IRC | 01:35 | |
| *** whoami-rajat has joined #openstack-keystone | 02:37 | |
| *** ileixe has joined #openstack-keystone | 02:39 | |
| *** aojea has joined #openstack-keystone | 03:12 | |
| *** aojea has quit IRC | 03:17 | |
| *** Dinesh_Bhor has quit IRC | 03:43 | |
| *** lbragstad has joined #openstack-keystone | 03:47 | |
| *** ChanServ sets mode: +o lbragstad | 03:47 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 03:50 | |
| *** erus1 has quit IRC | 04:20 | |
| *** itlinux has quit IRC | 04:41 | |
| *** spsurya has joined #openstack-keystone | 05:05 | |
| *** shyamb has joined #openstack-keystone | 05:11 | |
| *** shyamb has quit IRC | 05:44 | |
| *** shyamb has joined #openstack-keystone | 05:48 | |
| *** edmondsw has joined #openstack-keystone | 06:19 | |
| *** markvoelker has joined #openstack-keystone | 06:20 | |
| *** markvoelker has quit IRC | 06:24 | |
| *** shyamb has quit IRC | 06:52 | |
| *** shyamb has joined #openstack-keystone | 06:55 | |
| *** aojea has joined #openstack-keystone | 06:57 | |
| *** aojea has quit IRC | 07:07 | |
| *** shyamb has quit IRC | 07:38 | |
| *** awalende has joined #openstack-keystone | 08:12 | |
| vishakha | lbragstad: The extra parameter "region"was deprecated , which will be removed in queens release https://review.openstack.org/#/c/594921/ | 08:20 |
| vishakha | *train release | 08:20 |
| *** markvoelker has joined #openstack-keystone | 08:20 | |
| *** bnemec has joined #openstack-keystone | 08:29 | |
| *** yan0s has joined #openstack-keystone | 08:46 | |
| *** shyamb has joined #openstack-keystone | 08:47 | |
| *** tkajinam has quit IRC | 08:48 | |
| *** pcaruana has joined #openstack-keystone | 08:51 | |
| *** markvoelker has quit IRC | 08:54 | |
| *** mvkr has joined #openstack-keystone | 09:33 | |
| *** markvoelker has joined #openstack-keystone | 09:51 | |
| *** shyamb has quit IRC | 10:10 | |
| *** shyamb has joined #openstack-keystone | 10:11 | |
| *** markvoelker has quit IRC | 10:24 | |
| openstackgerrit | Yang Youseok proposed openstack/keystonemiddleware master: Add auth invalidation in auth_token for identity endpoint update https://review.openstack.org/633695 | 10:32 |
| openstackgerrit | Yang Youseok proposed openstack/keystonemiddleware master: Add auth invalidation in auth_token for identity endpoint update https://review.openstack.org/633695 | 10:34 |
| lbragstad | vishakha oh - gotcha, i'll take another look at that today | 10:35 |
| vishakha | lbragstad: sure | 10:36 |
| *** Dinesh_Bhor has quit IRC | 10:38 | |
| *** shyamb has quit IRC | 10:38 | |
| *** shyamb has joined #openstack-keystone | 10:40 | |
| *** shyamb has quit IRC | 10:45 | |
| *** mvkr has quit IRC | 10:46 | |
| *** mvkr has joined #openstack-keystone | 11:03 | |
| *** markvoelker has joined #openstack-keystone | 11:21 | |
| *** shyamb has joined #openstack-keystone | 11:35 | |
| *** markvoelker has quit IRC | 11:53 | |
| *** shyamb has quit IRC | 11:53 | |
| *** shyamb has joined #openstack-keystone | 11:55 | |
| *** erus has quit IRC | 11:59 | |
| *** kukacz has quit IRC | 12:04 | |
| *** erus has joined #openstack-keystone | 12:04 | |
| *** kukacz has joined #openstack-keystone | 12:04 | |
| *** erus has quit IRC | 12:23 | |
| *** erus has joined #openstack-keystone | 12:25 | |
| *** abhi89 has joined #openstack-keystone | 12:30 | |
| *** erus has quit IRC | 12:30 | |
| abhi89 | Hi All.. i have a doubt.. while creating image from api we don't mention any project-id, so looks like image is not associated with a project as such.. in the UI, image created in one project cannot be seen when we login via another project (both project have same compute & storage resources).. but we can deploy a vm in a project where this image doesn't exist using the image-id.. both of them kind of contradict.. | 12:31 |
| abhi89 | visibility of the image was set to private | 12:32 |
| *** erus has joined #openstack-keystone | 12:36 | |
| *** pcaruana has quit IRC | 12:40 | |
| *** erus has quit IRC | 12:43 | |
| *** pcaruana has joined #openstack-keystone | 12:50 | |
| *** markvoelker has joined #openstack-keystone | 12:50 | |
| *** erus has joined #openstack-keystone | 12:51 | |
| *** shyamb has quit IRC | 12:55 | |
| *** erus has quit IRC | 12:58 | |
| *** yan0s has quit IRC | 13:04 | |
| *** erus has joined #openstack-keystone | 13:07 | |
| *** ileixe has quit IRC | 13:08 | |
| *** aojea_ has joined #openstack-keystone | 13:10 | |
| *** xek has joined #openstack-keystone | 13:11 | |
| *** erus has quit IRC | 13:13 | |
| *** aojea_ has quit IRC | 13:14 | |
| *** yan0s has joined #openstack-keystone | 13:17 | |
| *** markvoelker has quit IRC | 13:20 | |
| *** erus has joined #openstack-keystone | 13:22 | |
| *** yan0s has quit IRC | 13:22 | |
| *** erus has quit IRC | 13:28 | |
| *** yan0s has joined #openstack-keystone | 13:34 | |
| *** erus has joined #openstack-keystone | 13:37 | |
| *** erus has quit IRC | 13:45 | |
| *** erus has joined #openstack-keystone | 13:52 | |
| *** erus has quit IRC | 13:58 | |
| *** erus has joined #openstack-keystone | 14:06 | |
| *** aojea_ has joined #openstack-keystone | 14:12 | |
| *** shyamb has joined #openstack-keystone | 14:12 | |
| *** erus has quit IRC | 14:12 | |
| *** mchlumsky has joined #openstack-keystone | 14:16 | |
| *** erus1 has joined #openstack-keystone | 14:17 | |
| *** shyamb has quit IRC | 14:20 | |
| *** aojea_ has quit IRC | 14:30 | |
| *** yan0s has quit IRC | 14:30 | |
| *** aojea_ has joined #openstack-keystone | 14:33 | |
| *** dave-mccowan has joined #openstack-keystone | 14:38 | |
| *** dave-mccowan has quit IRC | 14:45 | |
| *** pcaruana has quit IRC | 14:45 | |
| *** yan0s has joined #openstack-keystone | 14:50 | |
| *** pcaruana has joined #openstack-keystone | 14:53 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Drop ephemeral from api-ref https://review.openstack.org/633757 | 15:06 |
| *** aojea_ has quit IRC | 15:16 | |
| *** aojea_ has joined #openstack-keystone | 15:16 | |
| knikolla | o/ | 15:20 |
| *** aojea_ has quit IRC | 15:21 | |
| *** wxy| has joined #openstack-keystone | 15:28 | |
| *** awalende has quit IRC | 15:33 | |
| *** awalende has joined #openstack-keystone | 15:33 | |
| *** awalende has quit IRC | 15:37 | |
| *** openstackgerrit has quit IRC | 15:51 | |
| kmalloc | o/ | 15:58 |
| lbragstad | hola | 16:00 |
| *** erus1 has quit IRC | 16:00 | |
| *** erus1 has joined #openstack-keystone | 16:00 | |
| *** yan0s has quit IRC | 16:10 | |
| *** Nel1x has joined #openstack-keystone | 16:36 | |
| *** abhi89 has quit IRC | 16:40 | |
| *** brtknr has joined #openstack-keystone | 16:43 | |
| brtknr | hello | 16:43 |
| brtknr | since when did keystone tokens start being scoped by project_name? | 16:44 |
| brtknr | i do not seem to be able to do this in queens | 16:44 |
| brtknr | is this a rocky+ feature? | 16:44 |
| brtknr | i seem to be able to use tokens generated under one project scope in another project scope | 16:45 |
| *** mchlumsky has quit IRC | 16:45 | |
| lbragstad | brtknr do you have an example? | 16:45 |
| *** mchlumsky has joined #openstack-keystone | 16:48 | |
| ayoung | cmurphy, lets talk service ID and app creds. \ | 16:56 |
| ayoung | I wanted to hold off during the meeting, but I tripped over that particular one before | 16:56 |
| cmurphy | ayoung: i'm still halfway in another meeting, let's talk in ~30 minutes? | 16:57 |
| ayoung | Primo! | 16:57 |
| *** wxy| has quit IRC | 16:59 | |
| *** pcaruana has quit IRC | 17:01 | |
| *** gyee has joined #openstack-keystone | 17:03 | |
| cmurphy | ayoung: okay i'm here | 17:19 |
| cmurphy | do you have suggestions for how to solve this issue? | 17:19 |
| cmurphy | the problem i was struggling with is that the service might be behind a proxy and so has no idea what host and especially what path the client was requesting | 17:19 |
| cmurphy | it can find the host in the x-foward-host headers but not the original path, which is a problem with devstack which has eg glance in /image | 17:20 |
| cmurphy | which means it can't use that data to compare the requested host to a catalog endpoint | 17:23 |
| kmalloc | brtknr: tokens should always be scoped to the project id. project name may be used to authenticate if domain(s) are also used to identify the project uniquely | 17:27 |
| *** bnemec has quit IRC | 17:27 | |
| kmalloc | brtknr: if you can use a token from one project in another (and the role isn't admin + performing admin-actions) there is a concern. It might be broken policy (if you've done custom policy work) or a real concern with upstream keystone's defaults (it happens) | 17:28 |
| kmalloc | brtknr: if you cna provide us with more examples/reproduction steps we can help you narrow it down. | 17:28 |
| * cmurphy runs home to eat food | 17:32 | |
| cmurphy | bbiab | 17:32 |
| *** erus1 has quit IRC | 17:36 | |
| ayoung | cmurphy, so, yeah | 17:38 |
| ayoung | I think we do need a parameter in the config files. The question is can we automate it, and what does it mean to be overrideen | 17:39 |
| ayoung | kmalloc, is there something in oslo-config where we could say "If this fragment is imported into Nova, set the service name to compute?" | 17:40 |
| kmalloc | ayoung: there is a "set default" that nova could use for options imported | 17:41 |
| kmalloc | ksm defines an option, nova sets the default | 17:42 |
| kmalloc | it could be overidden by the operator, but it would default to something set by nova. | 17:42 |
| kmalloc | we use the mechanism for osprofiler | 17:42 |
| kmalloc | to ensure it is off by default | 17:42 |
| ayoung | so if there is no default set, is there some way we could automate finding that default just by including it in middleware? | 17:42 |
| kmalloc | not easily | 17:42 |
| kmalloc | i mean we could look at the package details, but that is not guaranteed to be super useful | 17:43 |
| kmalloc | i'd recommend explicit default set in service | 17:43 |
| kmalloc | (patch per service) | 17:43 |
| ayoung | so....by default we would get something like "not specified" | 17:43 |
| kmalloc | yeah | 17:43 |
| kmalloc | or "" | 17:43 |
| kmalloc | whatever ksm sets as the explicit default | 17:43 |
| ayoung | could we look up a nova specific value? | 17:44 |
| kmalloc | the reason i would rather do an explicit default set is that it is then encoded as an explicit set | 17:44 |
| ayoung | yep | 17:44 |
| kmalloc | vs "something nova provided but could change because it wasn't intended for this" | 17:44 |
| ayoung | So... | 17:45 |
| ayoung | what if the unset value was just required for amibuous situations | 17:45 |
| ayoung | like, say both nova and neutron had a /net suburl | 17:45 |
| kmalloc | Ksm runs in the process space | 17:46 |
| ayoung | we only check "service" if the suburl could potentially match in multiple services | 17:46 |
| kmalloc | So if you use service type url doesn't matter | 17:46 |
| ayoung | right...but for the vast majority of cases, we don't need to know service type | 17:47 |
| ayoung | or is that dangerous | 17:47 |
| kmalloc | Sure... You could do that but realistically, url matching across deployments will be harder/more work/slower than service type. | 17:47 |
| kmalloc | Not dangerous, just more prone to error | 17:47 |
| ayoung | what if the client sent the service type in the request? | 17:47 |
| ayoung | "we think we are going to Nova" | 17:48 |
| kmalloc | I don't trust clients for security | 17:48 |
| kmalloc | This is security. | 17:48 |
| ayoung | the default is to deny | 17:48 |
| ayoung | so..yeah, in the ambiguous case, there would be a problem | 17:48 |
| kmalloc | You are expecting to gate access on service type in ksm based upon token values. | 17:48 |
| kmalloc | Ksm still needs to know what service type it really is. Clients cannot provide that sanely to ksm. | 17:49 |
| cmurphy | o/ | 17:49 |
| ayoung | ok...so I think we'll need to get a patch into each of the services specifying service type | 17:49 |
| ayoung | It can be any string./ | 17:50 |
| ayoung | We come up with a set of defaults that match the current service catalog | 17:50 |
| ayoung | but nothing prevents a deployment for coming up with their own | 17:50 |
| ayoung | so compute could become gold-compute to only allow in gold customers | 17:50 |
| kmalloc | Yeah. Use os-service-types values, eventually we will integrate with that. | 17:51 |
| kmalloc | For defaults* | 17:51 |
| cmurphy | we have a set of standards already, projects can't come up with their own https://service-types.openstack.org/service-types.json | 17:51 |
| ayoung | cmurphy, right. | 17:51 |
| kmalloc | Also.we can expand the same.mechanism to endpoints (not just services) for the gold-compute example. | 17:52 |
| ayoung | cmurphy, one use case I was tripped up on a while back was how to do per-endpoing access, as opposed to per service. Like, two different Nova servers with different pay structures | 17:52 |
| kmalloc | But start with just os-service-types for the service type itself. | 17:52 |
| ayoung | it puts some complexity on the4 Keystone side, but the enforcement is fairly simple | 17:53 |
| ayoung | so long as the config value is a string, we can provide a sane default in each of the services, but let the deployers override the value | 17:53 |
| ayoung | cmurphy, I assume you cam to roughly the same conclusion? | 17:58 |
| clarkb | as a heads up keystone changes are failing pep8 jobs due to a new release of pycodestyle. I don't know what the requirements team intends to do to address that, but one option is for keystone to fix the issues if it hasn't arleady | 17:59 |
| cmurphy | ayoung: I came to the conclusion that we needed a config value, i wasn't aware of how we could provide a sane default so that's good to know | 17:59 |
| cmurphy | clarkb: thanks for the headsup | 18:00 |
| clarkb | requirements team points out that the linters are managed per project. So you'll want to pin or fix the errors locally | 18:04 |
| ayoung | looking nopw | 18:07 |
| ayoung | now | 18:07 |
| kmalloc | clarkb: we'll fix this on our end. | 18:09 |
| kmalloc | thanks | 18:09 |
| ayoung | clarkb, kmalloc, just git rebase then tox -re pep8 right | 18:10 |
| clarkb | ayoung: yup the -r being the important flag to pull in latest pycodestyle | 18:10 |
| kmalloc | ayoung: yeah that should rebuild the environment for you. | 18:10 |
| ayoung | running now | 18:10 |
| *** aojea has joined #openstack-keystone | 18:10 | |
| kmalloc | ayoung: we just need to exempt E117 for now | 18:11 |
| kmalloc | ayoung: should fix us and we can circle back later | 18:11 |
| kmalloc | i'll get a patch spun up here in a second. | 18:11 |
| ayoung | let me see what the errors look like | 18:12 |
| kmalloc | http://logs.openstack.org/78/633378/4/gate/openstack-tox-pep8/1b8b41a/job-output.txt.gz#_2019-01-29_17_42_47_901238 | 18:12 |
| ayoung | its only 5 lines | 18:12 |
| ayoung | kmalloc, I got it | 18:12 |
| *** aojea has quit IRC | 18:15 | |
| *** aojea has joined #openstack-keystone | 18:29 | |
| *** jdennis has quit IRC | 18:32 | |
| *** awalende has joined #openstack-keystone | 18:45 | |
| *** jdennis has joined #openstack-keystone | 18:48 | |
| *** openstackgerrit has joined #openstack-keystone | 18:49 | |
| openstackgerrit | ayoung proposed openstack/keystone master: Adjust Indents to meet PEP8 E117 https://review.openstack.org/633800 | 18:49 |
| *** awalende has quit IRC | 18:49 | |
| *** aojea has quit IRC | 18:52 | |
| *** aojea has joined #openstack-keystone | 18:53 | |
| ayoung | kmalloc, ^^ | 18:56 |
| *** aojea has quit IRC | 18:57 | |
| *** mvkr has quit IRC | 19:06 | |
| *** whoami-rajat has quit IRC | 19:07 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add configuration options for JWS provider https://review.openstack.org/628676 | 19:08 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add keystone-manage jws_setup functionality https://review.openstack.org/615315 | 19:08 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add test fixture for the JWS key repository https://review.openstack.org/614547 | 19:08 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add PyJWT as a requirement https://review.openstack.org/614548 | 19:08 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement JWS token provider https://review.openstack.org/614549 | 19:08 |
| lbragstad | hit an issue with lower-constraints ^ | 19:08 |
| lbragstad | should be fixed | 19:08 |
| kmalloc | ayoung: i actually dislike the readability of that log.warning change more than the original | 19:19 |
| ayoung | let me look | 19:19 |
| kmalloc | ayoung: it's correct (the new one) | 19:20 |
| ayoung | kmalloc, yeah..I kinda went back and forth on it | 19:20 |
| kmalloc | but it is less readable, indent lines up with the second line of the if | 19:20 |
| kmalloc | whatever | 19:20 |
| kmalloc | +2/+A | 19:20 |
| ayoung | heh | 19:20 |
| kmalloc | not worth quibbling over. i disagree with a number of the pep8 things we lean on | 19:21 |
| kmalloc | most of all, at this point the 80-line one | 19:21 |
| kmalloc | i'd support moving to a 120column setup, would make a number of our lines of code easier to read | 19:21 |
| ayoung | I wonder if I could do something with that log on | 19:21 |
| kmalloc | s/80-line/80-column | 19:21 |
| ayoung | e | 19:21 |
| kmalloc | ayoung: nah, just let it be. | 19:21 |
| ayoung | R | 19:22 |
| kmalloc | not worth extra time on it, this is unbreak the gate | 19:22 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove domain policies from policy.v3cloudsample.json https://review.openstack.org/605876 | 20:00 |
| *** blake has joined #openstack-keystone | 20:05 | |
| *** blake has quit IRC | 20:25 | |
| *** aojea has joined #openstack-keystone | 20:29 | |
| *** aojea has quit IRC | 20:30 | |
| *** aojea_ has joined #openstack-keystone | 20:30 | |
| *** xek has quit IRC | 20:54 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add JWS token provider documentation https://review.openstack.org/633831 | 21:36 |
| * lbragstad steps away to take a late lunch | 21:47 | |
| *** mchlumsky has quit IRC | 22:00 | |
| *** erus1 has joined #openstack-keystone | 22:16 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add API for /v3/access_rules https://review.openstack.org/628524 | 22:17 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add SQL migrations for app cred capabilities https://review.openstack.org/631936 | 22:17 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add driver support for app cred capabilities https://review.openstack.org/631937 | 22:17 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add manager support for app cred capabilities https://review.openstack.org/628193 | 22:17 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add API changes for app cred capabilities https://review.openstack.org/628168 | 22:17 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add capabilities to token validation https://review.openstack.org/631993 | 22:17 |
| *** aojea_ has quit IRC | 22:33 | |
| *** gyee has quit IRC | 22:35 | |
| *** tkajinam has joined #openstack-keystone | 22:55 | |
| -openstackstatus- NOTICE: http://zuul.openstack.org is not working. https://zuul.openstack.org does work. Please use that while we investigate. | 23:13 | |
| kmalloc | lbragstad: re https://review.openstack.org/#/c/628676/4 if we add jwe support we really want to have a new config group? | 23:40 |
| *** rcernin has quit IRC | 23:53 | |
| lbragstad | i think so | 23:54 |
| lbragstad | because we would be signing with a private key, then encrypting with it | 23:55 |
| lbragstad | and vice versa | 23:55 |
| lbragstad | i was thinking if we keep the repositories separate we mitigate the possibility of someone using a signed token and ciphertext from the same private key | 23:57 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!