*** lbragstad has quit IRC | 00:14 | |
*** jamesmcarthur has quit IRC | 00:27 | |
*** gyee has quit IRC | 00:48 | |
*** ileixe has joined #openstack-keystone | 00:56 | |
*** jamesmcarthur has joined #openstack-keystone | 00:58 | |
wxy-xiyuan | cmurphy: lbragstad: sorry that I was offline yesterday. Just saw your message. | 01:11 |
---|---|---|
*** jamesmcarthur has quit IRC | 01:15 | |
*** jamesmcarthur has joined #openstack-keystone | 01:16 | |
openstackgerrit | Merged openstack/keystone master: Implement domain reader functionality for projects https://review.openstack.org/624218 | 01:31 |
openstackgerrit | Merged openstack/keystone master: Implement domain member functionality for projects https://review.openstack.org/624219 | 01:31 |
*** lbragstad has joined #openstack-keystone | 01:35 | |
*** ChanServ sets mode: +o lbragstad | 01:35 | |
*** jamesmcarthur has quit IRC | 01:39 | |
*** jamesmcarthur has joined #openstack-keystone | 01:40 | |
*** jamesmcarthur has quit IRC | 01:44 | |
openstackgerrit | Merged openstack/keystone master: Make system members the same as system readers for credentials https://review.openstack.org/641128 | 01:45 |
*** jamesmcarthur has joined #openstack-keystone | 02:35 | |
*** markvoelker has joined #openstack-keystone | 02:43 | |
*** jamesmcarthur has quit IRC | 02:59 | |
*** jamesmcarthur has joined #openstack-keystone | 03:04 | |
*** jamesmcarthur has quit IRC | 03:18 | |
*** erus has quit IRC | 03:18 | |
*** erus has joined #openstack-keystone | 03:19 | |
*** jamesmcarthur has joined #openstack-keystone | 03:19 | |
*** jamesmcarthur has quit IRC | 03:49 | |
*** erus has quit IRC | 03:49 | |
*** erus has joined #openstack-keystone | 03:49 | |
*** whoami-rajat has joined #openstack-keystone | 04:10 | |
*** ileixe has quit IRC | 04:21 | |
*** ileixe has joined #openstack-keystone | 04:34 | |
*** phasespace has quit IRC | 05:14 | |
*** lbragstad has quit IRC | 06:06 | |
*** pcaruana has joined #openstack-keystone | 06:11 | |
*** phasespace has joined #openstack-keystone | 07:18 | |
*** rcernin has quit IRC | 07:24 | |
*** xek_ has joined #openstack-keystone | 07:41 | |
*** openstackgerrit has quit IRC | 08:17 | |
*** whoami-rajat has quit IRC | 09:10 | |
*** whoami-rajat has joined #openstack-keystone | 09:18 | |
*** pcaruana has quit IRC | 09:45 | |
*** pcaruana has joined #openstack-keystone | 09:46 | |
*** openstackgerrit has joined #openstack-keystone | 10:49 | |
*** erus has quit IRC | 10:49 | |
openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add domain scope support for group policies https://review.openstack.org/643937 | 10:49 |
*** erus has joined #openstack-keystone | 10:50 | |
*** jaosorior has quit IRC | 10:53 | |
*** ileixe has quit IRC | 11:20 | |
*** whoami-rajat has quit IRC | 11:30 | |
*** whoami-rajat has joined #openstack-keystone | 11:34 | |
*** dave-mccowan has joined #openstack-keystone | 11:51 | |
*** jaosorior has joined #openstack-keystone | 11:51 | |
*** raildo has joined #openstack-keystone | 11:53 | |
*** dave-mccowan has quit IRC | 11:53 | |
*** jamesmcarthur has joined #openstack-keystone | 12:11 | |
*** markvoelker has quit IRC | 12:22 | |
*** jamesmcarthur has quit IRC | 12:30 | |
*** jamesmcarthur has joined #openstack-keystone | 12:31 | |
*** jamesmcarthur has quit IRC | 12:35 | |
*** lbragstad has joined #openstack-keystone | 12:54 | |
*** ChanServ sets mode: +o lbragstad | 12:54 | |
*** irclogbot_3 has quit IRC | 13:07 | |
*** irclogbot_3 has joined #openstack-keystone | 13:08 | |
*** jamesmcarthur has joined #openstack-keystone | 13:10 | |
*** altlogbot_3 has quit IRC | 13:23 | |
*** altlogbot_1 has joined #openstack-keystone | 13:24 | |
*** altlogbot_1 has quit IRC | 13:39 | |
*** whoami-rajat has quit IRC | 13:40 | |
*** altlogbot_3 has joined #openstack-keystone | 13:40 | |
bnemec | lbragstad: The Bison are still dancing! | 13:41 |
lbragstad | yessir | 13:41 |
bnemec | And can we just take a moment to appreciate that sports slang allows me to use that phrase with a straight face? :-) | 13:41 |
lbragstad | we'll see what happens with Duke ;) | 13:42 |
*** irclogbot_3 has quit IRC | 13:45 | |
bnemec | Worst case scenario, you get to watch Zion Williamson for 40 minutes. | 13:45 |
bnemec | A man that large should not be able to move the way he does. | 13:46 |
*** irclogbot_2 has joined #openstack-keystone | 13:46 | |
lbragstad | https://www.inforum.com/sports/basketball/990981-Schnepf-With-Duke-next-NDSU-will-receive-the-most-exposure-the-school-has-ever-seen | 13:48 |
lbragstad | they are expecting *this* game to be the most exposure the university has ever seen | 13:48 |
lbragstad | which is a real bold statement, given NDSU's football program has won 7 national titles in 8 years | 13:49 |
*** erus has quit IRC | 13:51 | |
*** adriant has quit IRC | 13:51 | |
*** adriant has joined #openstack-keystone | 13:52 | |
*** jistr is now known as jistr|call | 13:52 | |
bnemec | Impressive. Although I'm probably a bit biased because my cousin went to NDSU too, so I pay more attention to it than most people. | 13:54 |
bnemec | And you never know. There's precedent for a 16-1 upset now. :-) | 13:55 |
*** phasespace has quit IRC | 13:58 | |
* lbragstad is glad he went to NDSU before tuition rates increased with every national championship | 13:58 | |
*** jistr|call is now known as jistr | 14:00 | |
openstackgerrit | Merged openstack/keystone master: trivial: correct spelling in test names https://review.openstack.org/644993 | 14:01 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove assignment policies from policy.v3cloudsample.json https://review.openstack.org/640943 | 14:07 |
lbragstad | ok - most patches in https://etherpad.openstack.org/p/keystone-stein-rc2-tracking are rechecked and passing zuul | 14:08 |
lbragstad | a lot of them already have +2 if anyone is looking to do reviews | 14:08 |
*** jaosorior has quit IRC | 14:15 | |
*** whoami-rajat has joined #openstack-keystone | 14:23 | |
gagehugo | o/ | 14:28 |
*** jamesmcarthur has quit IRC | 14:29 | |
*** jamesmcarthur has joined #openstack-keystone | 14:35 | |
*** altlogbot_3 has quit IRC | 14:35 | |
*** altlogbot_3 has joined #openstack-keystone | 14:36 | |
*** irclogbot_2 has quit IRC | 14:38 | |
*** irclogbot_0 has joined #openstack-keystone | 14:39 | |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update system grant policies for system reader https://review.openstack.org/622615 | 14:44 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update system grant policies for system member https://review.openstack.org/645021 | 14:44 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update system grant policies for system admin https://review.openstack.org/645022 | 14:44 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Test domain users against system assignment API https://review.openstack.org/645023 | 14:44 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Test project users against system assignment API https://review.openstack.org/645024 | 14:44 |
lbragstad | cmurphy we haven't made mention of the rc tracking etherpad on the mailing list, have we? | 14:45 |
cmurphy | lbragstad: not yet afaik | 14:45 |
lbragstad | would you like me to send a note? or were you planning on including it in the newsletter? | 14:45 |
cmurphy | it's already in my newsletter draft but i wasn't going to send that till tomorrow or saturday so feel free to drop a note now | 14:46 |
cmurphy | fyi i'm taking tomorrow off mostly | 14:46 |
lbragstad | ack | 14:50 |
lbragstad | done | 14:50 |
cmurphy | ty | 14:51 |
lbragstad | i assume next week is going to be the last opportunity we have to get things in for rc2 | 14:51 |
lbragstad | the week after is the final target | 14:51 |
cmurphy | pretty much | 14:51 |
cmurphy | we probably have till thursday of that week to actually propose rc2 | 14:51 |
lbragstad | cutting RCs close to final target gives me the nervous sweats | 14:52 |
cmurphy | :) | 14:52 |
lbragstad | so we're planning on having RC2 by the 28th? | 14:52 |
lbragstad | or 4/1 or 4/2? | 14:54 |
cmurphy | imo i would say either when all the major rc2 bugs are closed or by 4/2 whichever comes first | 14:55 |
* lbragstad nods | 14:55 | |
*** raildo has quit IRC | 14:56 | |
openstackgerrit | OpenStack Release Bot proposed openstack/keystone master: Update master for stable/stein https://review.openstack.org/645201 | 14:57 |
*** raildo has joined #openstack-keystone | 14:58 | |
* gagehugo watches 50 emails appear about issues fixed in rc1 | 15:02 | |
bnemec | Heh, +7'd. | 15:03 |
bnemec | Also, \o/ for 20% performance improvements! | 15:03 |
*** jamesmcarthur has quit IRC | 15:27 | |
*** jamesmcarthur has joined #openstack-keystone | 15:45 | |
*** erus has joined #openstack-keystone | 15:49 | |
*** jamesmcarthur has quit IRC | 15:50 | |
*** jamesmcarthur has joined #openstack-keystone | 15:54 | |
*** gyee has joined #openstack-keystone | 15:57 | |
mordred | cmurphy, lbragstad, kmalloc: https://review.openstack.org/#/c/644251/ if you get a sec - it's in service of the stack moving nova away from python-*client | 16:04 |
lbragstad | cmurphy are we missing a link to release notes https://docs.openstack.org/releasenotes/keystone/ for stein? | 16:05 |
mordred | https://review.openstack.org/#/c/643601/ is an example using it | 16:05 |
cmurphy | lbragstad: I assume that will appear when stein is released? | 16:05 |
kmalloc | mordred: +2. i'll let lbragstad or cmurphy +A | 16:06 |
cmurphy | oh the current series is empty | 16:06 |
kmalloc | mordred: it looks sane to me. | 16:06 |
cmurphy | hmm | 16:06 |
lbragstad | http://lists.openstack.org/pipermail/openstack-discuss/2019-March/004093.html | 16:06 |
kmalloc | bnemec: I should have a local test of oslo.cache today | 16:06 |
cmurphy | lbragstad: maybe we should check with release team | 16:06 |
kmalloc | bnemec: if you really think we can't release an oslo.cache update i'll do dirty things in keystone | 16:06 |
lbragstad | ++ | 16:07 |
kmalloc | bnemec: but really it wont be good because i'll need to specifically introspect oslo.cache options | 16:07 |
openstackgerrit | Merged openstack/keystone master: Implement domain reader functionality for user API https://review.openstack.org/623319 | 16:07 |
gagehugo | uh | 16:07 |
openstackgerrit | Merged openstack/keystone master: Implement domain member functionality for user API https://review.openstack.org/623320 | 16:07 |
kmalloc | and we try not to do "read/modify options from other source" where possible | 16:07 |
bnemec | kmalloc: I'm fine with releasing oslo.cache to fix this. We'll need to convince the release/requirements teams too though. :-) | 16:08 |
bnemec | Yeah, that would be grosser than my eventlet pool fix. | 16:08 |
kmalloc | bnemec: the other option is defer the fix till post Stein release, and backport the fix | 16:09 |
*** erus has quit IRC | 16:09 | |
kmalloc | i have a patch for KSM i'm spinning up for the non-oslo-cache path(s) | 16:09 |
bnemec | Seems silly to wait when we have a fix. | 16:09 |
*** erus has joined #openstack-keystone | 16:09 | |
bnemec | It's not like we aren't going to fix this, it's just a question of timing. | 16:09 |
bnemec | I'd rather have it available in the initial release of Stein that people will start testing. | 16:09 |
cmurphy | either way we'd have to convince them, keystonemiddleware is just as frozen as oslo.cache | 16:10 |
kmalloc | i agree. | 16:10 |
kmalloc | but it is a lower barrier to just backport | 16:10 |
kmalloc | if people get grumpy this late in | 16:10 |
kmalloc | we've lived with this issue since the inception of caching in keystone / keystonemiddleware | 16:10 |
bnemec | True. I guess if we can't convince the R teams that we need this then we just wait. | 16:10 |
kmalloc | so... since ... uhm... havana? | 16:11 |
kmalloc | partly back then we couldn't use flush-on-reconnect because memcache was used to store the token data | 16:11 |
kmalloc | rather than just a cache | 16:11 |
mordred | kmalloc: \o/ - and also \o/ to less python-*client in life | 16:11 |
bnemec | In any case, we need to get the patch merged on master. | 16:12 |
bnemec | Then we can start arguing about when the backport gets released. | 16:12 |
* cmurphy needs to be away for a couple of hours, will look at 644251 later if someone else doesn't get to it first | 16:12 | |
kmalloc | mordred: i still want to move OSC to SDK for keystone... and then deprecate keystonelcient :) | 16:12 |
mordred | kmalloc: yes. I want to start working on that | 16:13 |
kmalloc | bnemec: yep, so, do you want me to do a VERY mocked up test that checks flush is called on reconnect? | 16:13 |
kmalloc | bnemec: or are you really ok with just local confirmation and test-less (letting functional/tempest) confirm we aren't breaking things in the non-reconnect model | 16:14 |
bnemec | kmalloc: If you can add a basic unit test that would make it more obvious if someone tries to remove this in the future. | 16:14 |
kmalloc | wfm. | 16:15 |
bnemec | But we can't meaningfully test this in unit tests, so meh. | 16:15 |
kmalloc | will do i think i can just mock the heck out of the client. | 16:15 |
kmalloc | i might spin up a functional test for oslo-cache (suite) that installs memcached and runs a suite of "did this do a thing" | 16:15 |
kmalloc | the hard part is forcing a disconnect... but i think i know how to do that too | 16:15 |
kmalloc | that latter part can come in Train. | 16:16 |
kmalloc | the functional tests that is. | 16:16 |
bnemec | +1 | 16:16 |
*** mriedem has joined #openstack-keystone | 16:16 | |
openstackgerrit | Matt Riedemann proposed openstack/keystone master: Fix typo in docs section header https://review.openstack.org/645224 | 16:16 |
mriedem | ATC accomplishment unlocked! | 16:19 |
bnemec | mriedem: Hasn't merged yet. :-P | 16:20 |
kmalloc | mriedem: oh no, you're going to use that to run for PTL next cycle aren't you? :P | 16:21 |
bnemec | lol | 16:23 |
*** njohnston has joined #openstack-keystone | 16:23 | |
* bnemec makes a note to run for PTL in all the projects where he has ATC | 16:24 | |
njohnston | Hi! I have a question about oslo.policy, specifically vis-a-vis it's application in Neutron - bnemec suggested I post it here. When creating a port, a user can supply an option to enable or disable port security, which in the default policy is only permitted for "rule:context_is_advsvc or rule:admin_or_network_owner". | 16:24 |
njohnston | If a normal non-admin user tries to create a port without supplying a port security option it works, with the default "port_security: True". If that same user supplies the option to enable port security it fails the policy check, even though it means no change in the resulting port. Is there a way to bypass the policy check when the thing being checked would result in a no-op? | 16:24 |
kmalloc | njohnston: depends on how neutron manages enforcement | 16:26 |
kmalloc | njohnston: the easiest mechanism is just to not call 'enforce()' in cases you don't want to. | 16:27 |
kmalloc | njohnston: it is totally fine to call enforce() conditionally or even multiple times in a given call | 16:27 |
*** jaosorior has joined #openstack-keystone | 16:27 | |
kmalloc | so, enforce() can be called to see if the user has access to create a port, and then enforce() can be called again in the case when port_security is checked | 16:28 |
mriedem | kmalloc: oh god no | 16:28 |
kmalloc | the default rule would need to be split into 2 cases for that | 16:28 |
kmalloc | if you're doing enforcement as a decorator, you've backed yourself into a corner | 16:28 |
*** jamesmcarthur has quit IRC | 16:29 | |
kmalloc | you could also strip data out of the target_dict/enforcement data to make it conform before you call enforce() | 16:29 |
kmalloc | we do a mix of both within keystone. | 16:29 |
*** mriedem has left #openstack-keystone | 16:29 | |
kmalloc | we specifically moved away from decorator based because of headaches. | 16:30 |
*** erus has quit IRC | 16:30 | |
*** erus has joined #openstack-keystone | 16:30 | |
njohnston | kmalloc: No, we don't do a decorator, we do it in the API base as pretty much the first thing out of the gate. That tells me that in order to do this we'd need to put that check-defaults code right at the start of request processing. https://opendev.org/openstack/neutron/src/branch/master/neutron/api/v2/base.py#L468 | 16:32 |
kmalloc | right | 16:33 |
kmalloc | and that is exactly why you should enforce in the API like you do :) | 16:33 |
kmalloc | so you can move bits up and pre-process the request as needed | 16:33 |
njohnston | kmalloc: Thanks for the help, that really clarifies the task! | 16:33 |
kmalloc | sure thing! | 16:34 |
*** mvkr has quit IRC | 16:48 | |
*** jamesmcarthur has joined #openstack-keystone | 16:55 | |
*** jamesmcarthur has quit IRC | 17:01 | |
*** mvkr has joined #openstack-keystone | 17:16 | |
*** gmann is now known as gmann_afk | 17:43 | |
*** mvkr has quit IRC | 17:46 | |
*** cfey has joined #openstack-keystone | 18:05 | |
cfey | Hi all, can some maybe help me with keystone auth methods to implement a openidc config? | 18:07 |
cfey | Following tutorial https://cloud.denbi.de/wiki/cloud_admin/elixir_OIDC/ (and others also) create a method called "oidc" defined as "oidc = keystone.auth.plugins.mapped.Mapped" but it looks like this does not work since ocata. At the moment I'm a bit lost..tried with "openid" and "mapped" but always get the following error "Authorization failed. Attempted to authenticate with an unsupported method." | 18:10 |
*** whoami-rajat has quit IRC | 18:23 | |
openstackgerrit | Merged openstack/keystone master: Implement domain admin functionality for projects https://review.openstack.org/624220 | 18:29 |
openstackgerrit | Merged openstack/keystone master: Remove project policies from policy.v3cloudsample.json https://review.openstack.org/624222 | 18:29 |
*** gmann_afk is now known as gmann | 18:40 | |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add explicit testing for project users and the user API https://review.openstack.org/623322 | 18:44 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove user policies from policy.v3cloudsample.json https://review.openstack.org/623323 | 18:44 |
gagehugo | lbragstad: one question on https://review.openstack.org/#/c/638587/ | 18:46 |
gagehugo | s/question/comment | 18:46 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement domain reader for role_assignments https://review.openstack.org/638587 | 18:49 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add role assignment test coverage for domain members https://review.openstack.org/638593 | 18:49 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add role assignment test coverage for domain admins https://review.openstack.org/638597 | 18:49 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add role assignment testing for project users https://review.openstack.org/639718 | 18:49 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove assignment policies from policy.v3cloudsample.json https://review.openstack.org/640943 | 18:50 |
lbragstad | gagehugo nice - thanks | 18:50 |
lbragstad | fixed ^ | 18:50 |
*** itlinux has quit IRC | 18:55 | |
*** awalende has joined #openstack-keystone | 19:11 | |
*** mvkr has joined #openstack-keystone | 19:13 | |
*** phluger has joined #openstack-keystone | 19:23 | |
*** whoami-rajat has joined #openstack-keystone | 19:25 | |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update system group assignment policies for reader and member https://review.openstack.org/645309 | 19:29 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update group system grant policies for admins https://review.openstack.org/645310 | 19:29 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Test domain and project users against group system assignment API https://review.openstack.org/645311 | 19:29 |
openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove system assignment policies from policy.v3cloudsample.json https://review.openstack.org/645312 | 19:29 |
*** vkmc has joined #openstack-keystone | 20:07 | |
vkmc | o/ | 20:08 |
vkmc | I'm working on removing the dependency for keystoneclient in the manilaclient, and I have a few questions wrt keystoneauth | 20:08 |
vkmc | I see some projects got rid of their httpclients in favour or a sessionclient, extending the adapter.jsonlegacyadapter class | 20:09 |
vkmc | is this the recommended way to proceed? | 20:10 |
vkmc | jamielennox, I saw your worked on this on cinder side, so maybe you can give me a few pointers | 20:10 |
*** phluger has quit IRC | 20:45 | |
*** raildo has quit IRC | 21:12 | |
*** cfey has quit IRC | 21:30 | |
*** pcaruana has quit IRC | 21:33 | |
openstackgerrit | Merged openstack/keystone master: Only validate tokens once per request https://review.openstack.org/641499 | 21:38 |
openstackgerrit | Merged openstack/keystone master: Update master for stable/stein https://review.openstack.org/645201 | 21:38 |
openstackgerrit | Merged openstack/keystone master: Fix typo in docs section header https://review.openstack.org/645224 | 21:38 |
*** whoami-rajat has quit IRC | 21:45 | |
*** xek_ has quit IRC | 21:55 | |
*** njohnston_ has joined #openstack-keystone | 21:59 | |
*** njohnston has quit IRC | 21:59 | |
*** irclogbot_0 has quit IRC | 22:05 | |
kmalloc | bnemec: oh joy. this fix doesn't work... digging deep into trying to make this work | 22:07 |
bnemec | :-( | 22:10 |
*** rcernin has joined #openstack-keystone | 22:19 | |
kmalloc | trying to figure out how things get passed to the client constructor | 22:23 |
kmalloc | ok the issue is a fault in dogpile.cache | 22:25 |
kmalloc | we *can't* pass this value down. | 22:25 |
kmalloc | bnemec: return memcache.Client(self.url) | 22:26 |
kmalloc | bnemec: you just can't pass other arguments to the constructor :( | 22:26 |
kmalloc | this is pretty bad. | 22:28 |
*** cwright_ has quit IRC | 22:29 | |
*** cwright has joined #openstack-keystone | 22:32 | |
*** phasespace has joined #openstack-keystone | 22:39 | |
kmalloc | bnemec: i can fix the KSM bits that don't use oslo_cache. | 22:40 |
kmalloc | but fixing oslo_cache and keystone may be impossible. | 22:40 |
kmalloc | let me check, memcache pool might be doable | 22:41 |
kmalloc | ok i can fix memcache_pool and ksm | 22:42 |
kmalloc | i can't fix the non-pooled memcache client due to limitations in dogpile. | 22:42 |
*** timothyb89 has quit IRC | 22:46 | |
*** tkajinam has joined #openstack-keystone | 22:56 | |
*** awalende has quit IRC | 23:30 | |
*** lbragstad has quit IRC | 23:46 | |
*** jamesmcarthur has joined #openstack-keystone | 23:58 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!