| *** eandersson_ has joined #openstack-keystone | 00:07 | |
| *** jamesmcarthur has quit IRC | 00:10 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:14 | |
| *** jamesmcarthur has quit IRC | 00:27 | |
| *** gyee has quit IRC | 00:30 | |
| *** lbragstad has quit IRC | 00:40 | |
| *** markvoelker has joined #openstack-keystone | 00:43 | |
| *** whoami-rajat has joined #openstack-keystone | 00:51 | |
| *** tkajinam_ has joined #openstack-keystone | 00:58 | |
| *** tkajinam has quit IRC | 01:01 | |
| *** markvoelker has quit IRC | 01:21 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:23 | |
| *** Nel1x has joined #openstack-keystone | 01:25 | |
| *** lbragstad has joined #openstack-keystone | 01:44 | |
| *** ChanServ sets mode: +o lbragstad | 01:44 | |
| *** jamesmcarthur has quit IRC | 02:22 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:23 | |
| *** lbragstad has quit IRC | 02:24 | |
| *** jamesmcarthur has quit IRC | 02:53 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:53 | |
| *** Nel1x has quit IRC | 03:05 | |
| openstackgerrit | Ghanshyam Mann proposed openstack/keystone master: Migrate keystone-dsvm-grenade-multinode job to Ubuntu Bionic https://review.openstack.org/641925 | 03:08 |
|---|---|---|
| openstackgerrit | Ghanshyam Mann proposed openstack/keystone master: Migrate keystone-dsvm-grenade-multinode job to Ubuntu Bionic https://review.openstack.org/641925 | 03:09 |
| *** jamesmcarthur has quit IRC | 03:27 | |
| *** itlinux has quit IRC | 03:41 | |
| *** jaosorior has joined #openstack-keystone | 05:22 | |
| *** markvoelker has joined #openstack-keystone | 05:47 | |
| *** vishakha has joined #openstack-keystone | 06:04 | |
| *** pcaruana has joined #openstack-keystone | 06:19 | |
| *** masayukig[m]2 is now known as masayukig[m] | 06:45 | |
| *** masayukig[m] is now known as masayuki4 | 06:45 | |
| *** masayuki4 is now known as masayuki6 | 06:48 | |
| *** masayuki6 is now known as masayukig[m] | 06:48 | |
| *** masayukig[m] is now known as masayukig | 06:48 | |
| eandersson_ | Why would a trust show up in list, but not show? | 07:14 |
| *** tonyb is now known as tonyb_gone | 07:20 | |
| *** tonyb_gone is now known as tonyb | 07:21 | |
| *** awalende has joined #openstack-keystone | 08:09 | |
| *** rcernin has quit IRC | 08:09 | |
| openstackgerrit | Chason Chan proposed openstack/keystone master: Fix the incorrect release name of project guide https://review.openstack.org/642972 | 08:45 |
| *** xek has joined #openstack-keystone | 08:50 | |
| *** kukacz has quit IRC | 09:15 | |
| *** kukacz has joined #openstack-keystone | 09:17 | |
| *** tkajinam__ has joined #openstack-keystone | 09:22 | |
| *** FlorianFa has joined #openstack-keystone | 09:23 | |
| *** tkajinam_ has quit IRC | 09:25 | |
| *** Emine has joined #openstack-keystone | 09:53 | |
| vishakha | cmurphy: Regarding your patch https://review.openstack.org/#/c/642026/. We havn't compact the db migrations from long run. Is there any specific reason for it? | 10:37 |
| cmurphy | vishakha: we don't compact them, we keep them there in case we need to backport a migration between releases so that it would run before the next release | 10:40 |
| vishakha | cmurphy: We can compact till EOL releases. Cant we? | 10:41 |
| cmurphy | vishakha: we could but I'm not sure what the benefit is? plus EOL is subjective now that we have extended maintenance branches | 10:42 |
| vishakha | cmurphy: the benefit is that we can remove placeholders and empty migrations. | 10:45 |
| cmurphy | vishakha: but we can't change the version numbers so we still end up with empty gaps | 10:48 |
| vishakha | cmurphy: Could you please elaborate why we cant change version numbers | 10:50 |
| cmurphy | vishakha: that would break the database of running deployments, all deployments store the current migration version number and can only go up from there | 10:51 |
| vishakha | cmurphy: I saw cinder do the same migrations . https://review.openstack.org/#/q/topic:compact_db+(status:open+OR+status:merged). I am not sure whether they face the same issue as they do migrations quite often after few releases. | 11:24 |
| *** raildo has joined #openstack-keystone | 11:37 | |
| cmurphy | vishakha: looks like they control the initial version with the INIT_VERSION constant and they re-set that to the latest version before compacting | 11:38 |
| cmurphy | we don't have anything like that, but no reason we couldn't afaict | 11:38 |
| vishakha | cmurphy: ok . That means if we want we can also achieve by resetting version | 11:40 |
| cmurphy | vishakha: i think so | 11:41 |
| vishakha | cmurphy: ok thanks | 11:44 |
| *** markvoelker has quit IRC | 12:12 | |
| *** markvoelker has joined #openstack-keystone | 12:13 | |
| *** mchlumsky has joined #openstack-keystone | 12:38 | |
| *** awalende has quit IRC | 12:43 | |
| *** awalende has joined #openstack-keystone | 12:45 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:47 | |
| *** lbragstad has joined #openstack-keystone | 13:31 | |
| *** ChanServ sets mode: +o lbragstad | 13:31 | |
| *** jamesmcarthur has quit IRC | 13:41 | |
| *** Emine has quit IRC | 13:59 | |
| *** jamesmcarthur has joined #openstack-keystone | 14:00 | |
| *** jamesmcarthur has quit IRC | 14:00 | |
| *** jamesmcarthur has joined #openstack-keystone | 14:01 | |
| *** Emine has joined #openstack-keystone | 14:08 | |
| *** irclogbot_1 has quit IRC | 14:09 | |
| *** irclogbot_1 has joined #openstack-keystone | 14:12 | |
| *** bnemec has quit IRC | 14:22 | |
| *** Emine has quit IRC | 14:24 | |
| *** Emine has joined #openstack-keystone | 14:24 | |
| *** irclogbot_1 has quit IRC | 14:25 | |
| *** bnemec has joined #openstack-keystone | 14:27 | |
| *** irclogbot_1 has joined #openstack-keystone | 14:27 | |
| *** mloza has joined #openstack-keystone | 14:53 | |
| mloza | Hello, how can I get the domain context menu to show up in the default domain? | 14:53 |
| mloza | i'm login as admin | 14:54 |
| *** erus has joined #openstack-keystone | 15:15 | |
| erus | o/ | 15:19 |
| *** awalende has quit IRC | 15:28 | |
| *** irclogbot_1 has quit IRC | 15:36 | |
| *** irclogbot_1 has joined #openstack-keystone | 15:39 | |
| *** irclogbot_1 has quit IRC | 15:49 | |
| *** irclogbot_1 has joined #openstack-keystone | 15:51 | |
| *** erus has quit IRC | 15:52 | |
| *** irclogbot_1 has quit IRC | 15:52 | |
| *** irclogbot_1 has joined #openstack-keystone | 15:56 | |
| *** erus has joined #openstack-keystone | 16:00 | |
| knikolla | o/ | 16:03 |
| *** Emine has quit IRC | 16:20 | |
| *** irclogbot_1 has quit IRC | 16:24 | |
| *** erus has quit IRC | 16:24 | |
| *** erus has joined #openstack-keystone | 16:25 | |
| *** gyee has joined #openstack-keystone | 16:25 | |
| *** irclogbot_1 has joined #openstack-keystone | 16:26 | |
| erus | hello knikolla o/ | 16:29 |
| knikolla | hi erus! | 16:32 |
| *** FlorianFa has quit IRC | 16:41 | |
| *** dave-mccowan has joined #openstack-keystone | 16:43 | |
| *** erus has quit IRC | 16:43 | |
| lbragstad | quick update on the system-scope and default roles patches with tempest | 16:43 |
| lbragstad | we need https://review.openstack.org/#/c/624794/2 and https://review.openstack.org/#/c/642102/3 to merge before we can get https://review.openstack.org/#/c/624218/8 into keystone | 16:43 |
| *** erus has joined #openstack-keystone | 16:43 | |
| erus | how are you? knikolla | 16:45 |
| *** dtruong has joined #openstack-keystone | 16:50 | |
| eandersson_ | morning | 16:53 |
| *** eandersson_ is now known as eandersson | 16:54 | |
| eandersson | We have had a few fun issues with Trusts. | 16:54 |
| *** FlorianFa has joined #openstack-keystone | 16:54 | |
| eandersson | The most common issue is that a user has a trust, but it gets a role removed for some reason. This invalidates the trust permanently. | 16:54 |
| eandersson | Another issue was a role id changing (by mistake usually) | 16:54 |
| eandersson | And this causes clusters owned by that user to be permanently broken (e.g. Senlin or Magnum). | 16:55 |
| *** erus has quit IRC | 16:55 | |
| *** erus has joined #openstack-keystone | 16:56 | |
| eandersson | What is the intended scenario to recover from the above? | 16:56 |
| eandersson | 1) delete and re-create the trust, but how is a service like Senlin supposed to handle this? | 16:56 |
| eandersson | Is Senlin supposed to re-create it automatically, as Senlin created it in the first place. | 16:57 |
| eandersson | Or is Senlin supposed to expose an api to allow the user to create a new trust for the cluster? | 16:57 |
| eandersson | 2) Is Senlin supposed to always mimic the users exact roles? if Senlin always created a trust with only _member_, this is much less likely to happen (and maybe allows you to add additional roles on demand?) | 16:57 |
| eandersson | maybe lbragstad ^ ? | 17:07 |
| lbragstad | eandersson well - trusts are immutable | 17:09 |
| lbragstad | so updating them when roles changes isn't going to be possible | 17:09 |
| eandersson | For sure | 17:09 |
| lbragstad | Senlin is the thing creating the trust, right? | 17:09 |
| eandersson | Yes | 17:10 |
| lbragstad | is Senlin the trustee or the trustor? | 17:10 |
| lbragstad | er - the senlin user | 17:10 |
| eandersson | Trustor would be my user | 17:12 |
| lbragstad | ok | 17:12 |
| lbragstad | so the user creates the trust and gives it to senlin? | 17:12 |
| eandersson | Yes | 17:12 |
| eandersson | And for the life of that auto-scaling group that trust will be used. | 17:12 |
| lbragstad | and the root of the issue is that the user has a role assignment change which invalidates the trust? | 17:13 |
| eandersson | Yep | 17:13 |
| lbragstad | so - one thing you could try, is to use a specific role in the trust that only allows senlin to do what it needs to do | 17:14 |
| lbragstad | (i'd need to dig into the trusts implementation - but i know application credentials will validate the role during usage) | 17:14 |
| lbragstad | so - if the user always have the role required for senlin to do its thing, then the application credential at least will remain valid | 17:15 |
| lbragstad | regardless of other assignments changing for that user | 17:15 |
| eandersson | My initial thinking would be to always only give the trust, _member_ | 17:15 |
| eandersson | but how would Senlin know if the user needs SwiftOp or admin? | 17:16 |
| eandersson | Because we don't want to prevent a admin user from creating a cluster etc, but at the same time there is no garunatee that an admin will always have admin. | 17:16 |
| lbragstad | right - i guess that depends on what senlin is doing on behalf of the user? | 17:18 |
| eandersson | Probably never anything requiring admin, or even swift (at this time). | 17:18 |
| eandersson | https://github.com/openstack/senlin/tree/master/senlin/drivers/os | 17:18 |
| eandersson | but apparently has the concept of network_delete, but not sure when it would ever need to do that | 17:19 |
| eandersson | https://github.com/openstack/senlin/blob/master/senlin/drivers/os/neutron_v2.py#L44 | 17:19 |
| lbragstad | sure - those are also going to be dependent on whatever the policy is for those services | 17:19 |
| *** gyee has quit IRC | 17:20 | |
| lbragstad | (i'm assuming defaults, but that might not be the case and could vary per deployment) | 17:20 |
| *** gyee has joined #openstack-keystone | 17:20 | |
| lbragstad | this might be a bit clunky... but | 17:21 |
| lbragstad | one option would be for a user to be notified prior to a role assignment change | 17:21 |
| lbragstad | (e.g., you're going to have admin removed from project X in 3 days) | 17:21 |
| lbragstad | then they have the opportunity to create a new application credential that excludes the admin role and they can give that to senlin instead | 17:22 |
| *** erus has quit IRC | 17:22 | |
| lbragstad | (in a gracefully rotation kind-of-way) | 17:22 |
| *** erus has joined #openstack-keystone | 17:23 | |
| *** problem_v has joined #openstack-keystone | 17:26 | |
| *** dave-mccowan has quit IRC | 17:27 | |
| lbragstad | just tried it locally and if i create a trust, then remove a role from the trustor, i can't fetch the trust anymore | 17:29 |
| *** erus has quit IRC | 17:29 | |
| dtruong | yes, that's what we encountered | 17:29 |
| lbragstad | actually - i can? | 17:29 |
| *** erus has joined #openstack-keystone | 17:29 | |
| lbragstad | https://pasted.tech/pastes/dac9cd22532004767b1a0f9c8dd30bc630482e8d.raw | 17:30 |
| dtruong | nvm, you can fetch the trust | 17:30 |
| dtruong | but any operations using that trust do not work anymore | 17:30 |
| lbragstad | correct - which seems like weird UX | 17:31 |
| eandersson | we are brb =] | 17:33 |
| lbragstad | https://git.openstack.org/cgit/openstack/keystone/tree/keystone/assignment/core.py#n266 app creds do that automatically | 17:33 |
| *** jamesmcarthur has quit IRC | 17:49 | |
| *** vishakha has quit IRC | 18:07 | |
| *** xek_ has joined #openstack-keystone | 18:08 | |
| *** xek has quit IRC | 18:10 | |
| kmalloc | *cough* anyone have lots of experience with etcd? | 18:24 |
| *** zaneb has joined #openstack-keystone | 18:25 | |
| kmalloc | as in, anyone know where etcd gets grumpy with data changing | 18:25 |
| kmalloc | hmm. probably the wrong tool for the job | 18:27 |
| zaneb | lbragstad: if you have a moment, could you provide some clarification on https://storyboard.openstack.org/#!/story/1701498#comment-118387 ? (re: trusts with impersonation=True and allow_redelegation=True) | 18:27 |
| lbragstad | sure - i can take a look in a bit | 18:28 |
| *** pcaruana has quit IRC | 18:29 | |
| kmalloc | ok we have a security (open / public) concern i'll be filing a bug against oslo.cache, keystone, and KSM for. | 18:29 |
| *** erus has quit IRC | 18:29 | |
| *** erus has joined #openstack-keystone | 18:30 | |
| kmalloc | it's not (directly/easily) exploitable, but potentially could cause horrible UX for everyone if caching is enabled and has security concerns | 18:30 |
| kmalloc | this might be the force to move to pymemcache. | 18:30 |
| *** Emine has joined #openstack-keystone | 18:33 | |
| *** ayoung has joined #openstack-keystone | 18:34 | |
| kmalloc | lbragstad, cmurphy, ayoung, hrybacki: https://bugs.launchpad.net/oslo.cache/+bug/1819957 (ayoung/hrybacki that came from our convo yesterday) | 18:44 |
| openstack | Launchpad bug 1819957 in oslo.cache "Caching with stale data when a server disconnects due to network partition and reconnects" [Undecided,New] | 18:44 |
| kmalloc | cc bnemec ^ | 18:44 |
| ayoung | kmalloc, ++ | 18:45 |
| kmalloc | and this is going to need stable backports. | 18:45 |
| kmalloc | *sigh* | 18:45 |
| *** jamesmcarthur has joined #openstack-keystone | 18:47 | |
| *** gmann is now known as gmann_afk | 18:48 | |
| hrybacki | and downstream backports kmalloc **double sigh** | 18:55 |
| bnemec | Sounds like a job for Delegationman! ;-) | 18:56 |
| bnemec | kmalloc: So you're working on the fix? | 18:56 |
| bnemec | I just commented on the bug. | 18:56 |
| *** mchlumsky_ has joined #openstack-keystone | 19:03 | |
| *** mchlumsky has quit IRC | 19:04 | |
| *** zzzeek has quit IRC | 19:04 | |
| *** zzzeek has joined #openstack-keystone | 19:07 | |
| kmalloc | bnemec: yeah | 19:10 |
| kmalloc | not sure who else can really do so. | 19:11 |
| kmalloc | bnemec: hberaud might be able to, but really it's a small fix and i'm already going to be doing a massive amount of ... stuff for the pymemcache thing(s) | 19:11 |
| *** emine__ has joined #openstack-keystone | 19:12 | |
| bnemec | kmalloc: Yeah, works for me. We'll scrounge up some other cores to get it approved. | 19:13 |
| *** Emine has quit IRC | 19:13 | |
| bnemec | Apparently that's not a co-owned library though. :-/ | 19:13 |
| bnemec | https://review.openstack.org/#/admin/groups/686,members | 19:13 |
| kmalloc | yeah | 19:16 |
| kmalloc | ... | 19:16 |
| kmalloc | bnemec: that is probably because no one wants to do caching work. | 19:16 |
| kmalloc | and it gets done incorrectly a lot | 19:16 |
| kmalloc | bnemec: a single-core approval for oslo.cache is fine IMO | 19:17 |
| bnemec | kmalloc: After what I saw digging into that eventlet/memcache pool bug I don't blame them. :-P | 19:17 |
| bnemec | kmalloc: Yeah, that's always an option. Especially if the patch submitter is a core. | 19:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: trivial: fix broken link in trust API reference https://review.openstack.org/643148 | 19:46 |
| lbragstad | zaneb in need to do some more digging on the trust impersonation + redelegation bits | 19:54 |
| lbragstad | i remember seeing something somewhere (a bug perhaps) that eluded to the two not working well together - or being a massive foot gun | 19:54 |
| lbragstad | brb | 20:01 |
| *** dklyle has quit IRC | 20:09 | |
| *** dklyle has joined #openstack-keystone | 20:16 | |
| *** jamesmcarthur has quit IRC | 20:29 | |
| *** gmann_afk is now known as gmann | 20:41 | |
| *** whoami-rajat has quit IRC | 21:11 | |
| rm_work | cmurphy: I think https://review.openstack.org/#/c/643021/ is slightly off, commented. Thanks for taking this one though :thumbsup: | 21:23 |
| *** rcernin has joined #openstack-keystone | 21:57 | |
| *** raildo has quit IRC | 22:10 | |
| *** lifeless has quit IRC | 22:27 | |
| *** lifeless has joined #openstack-keystone | 22:27 | |
| *** adriant has quit IRC | 22:29 | |
| *** dave-mccowan has joined #openstack-keystone | 23:27 | |
| *** xek_ has quit IRC | 23:33 | |
| openstackgerrit | jessegler proposed openstack/oslo.policy master: Corrects tox.ini snippet to point to config file https://review.openstack.org/643186 | 23:33 |
| *** dave-mccowan has quit IRC | 23:38 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!