| *** timburke has joined #openstack-keystone | 00:00 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:01 | |
| *** erus has quit IRC | 00:07 | |
| *** erus has joined #openstack-keystone | 00:08 | |
| *** erus has quit IRC | 00:13 | |
| *** erus has joined #openstack-keystone | 00:14 | |
| *** jamesmcarthur has quit IRC | 00:31 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:54 | |
| *** markvoelker has joined #openstack-keystone | 00:55 | |
| *** jamesmcarthur has quit IRC | 00:58 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:27 | |
| *** erus has quit IRC | 01:27 | |
| *** erus has joined #openstack-keystone | 01:28 | |
| *** whoami-rajat has joined #openstack-keystone | 01:31 | |
| *** jamesmcarthur has quit IRC | 01:34 | |
| *** lbragstad has joined #openstack-keystone | 02:02 | |
| *** ChanServ sets mode: +o lbragstad | 02:02 | |
| *** rcernin_ has joined #openstack-keystone | 02:05 | |
| *** rcernin has quit IRC | 02:06 | |
| *** rcernin_ has quit IRC | 02:12 | |
| *** rcernin has joined #openstack-keystone | 02:15 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:44 | |
| *** prometheanfire has joined #openstack-keystone | 02:58 | |
| prometheanfire | Werkzeug===0.15.1 breaks keystone it looks like | 02:58 |
|---|---|---|
| gagehugo | uh oh | 02:59 |
| prometheanfire | master | 03:01 |
| prometheanfire | and reqs caught it, just an fyi | 03:01 |
| *** jamesmcarthur has quit IRC | 03:04 | |
| *** phasespace has quit IRC | 03:14 | |
| *** samueldmq has quit IRC | 03:15 | |
| *** openstackgerrit has joined #openstack-keystone | 03:22 | |
| openstackgerrit | ayoung proposed openstack/keystone master: Allow an explicit_domain_id parameter when creating a domain https://review.openstack.org/605235 | 03:22 |
| *** spsurya has joined #openstack-keystone | 03:31 | |
| *** jamesmcarthur has joined #openstack-keystone | 03:56 | |
| *** jamesmcarthur has quit IRC | 03:59 | |
| *** jamesmcarthur has joined #openstack-keystone | 04:01 | |
| *** jamesmcarthur has quit IRC | 04:05 | |
| *** jamesmcarthur has joined #openstack-keystone | 04:08 | |
| *** jamesmcarthur has quit IRC | 04:08 | |
| *** jamesmcarthur has joined #openstack-keystone | 04:08 | |
| *** jamesmcarthur has quit IRC | 04:17 | |
| *** jamesmcarthur has joined #openstack-keystone | 04:18 | |
| *** jamesmcarthur has quit IRC | 04:25 | |
| *** jamesmcarthur_ has joined #openstack-keystone | 04:26 | |
| *** jamesmcarthur_ has quit IRC | 04:39 | |
| *** jamesmcarthur has joined #openstack-keystone | 04:40 | |
| *** erus has quit IRC | 04:40 | |
| *** erus has joined #openstack-keystone | 04:41 | |
| *** jamesmcarthur has quit IRC | 04:46 | |
| *** ileixe has joined #openstack-keystone | 04:55 | |
| *** adriant has quit IRC | 05:07 | |
| *** adriant has joined #openstack-keystone | 05:08 | |
| *** shyamb has joined #openstack-keystone | 05:16 | |
| *** lbragstad has quit IRC | 05:33 | |
| *** pcaruana has joined #openstack-keystone | 05:35 | |
| *** shyamb has quit IRC | 05:38 | |
| *** jamesmcarthur has joined #openstack-keystone | 05:41 | |
| *** jamesmcarthur has quit IRC | 05:46 | |
| *** jamesmcarthur has joined #openstack-keystone | 05:57 | |
| *** markvoelker has quit IRC | 05:58 | |
| *** jamesmcarthur has quit IRC | 06:01 | |
| *** shyamb has joined #openstack-keystone | 06:07 | |
| *** openstackgerrit has quit IRC | 06:09 | |
| *** jamesmcarthur has joined #openstack-keystone | 06:28 | |
| *** markvoelker has joined #openstack-keystone | 06:29 | |
| *** awalende has joined #openstack-keystone | 07:11 | |
| *** erus has quit IRC | 07:13 | |
| *** erus has joined #openstack-keystone | 07:14 | |
| ileixe | Hello, guys. | 07:19 |
| ileixe | It's quite old bp though, anyone know the current status of the bp 'https://specs.openstack.org/openstack/keystone-specs/specs/juno/hierarchical_multitenancy.html'? | 07:20 |
| *** yan0s has joined #openstack-keystone | 07:34 | |
| *** shyamb has quit IRC | 07:48 | |
| *** shyamb has joined #openstack-keystone | 07:48 | |
| *** tkajinam has quit IRC | 08:21 | |
| *** xek has joined #openstack-keystone | 08:30 | |
| *** shyamb has quit IRC | 08:33 | |
| *** erus has quit IRC | 08:33 | |
| *** erus has joined #openstack-keystone | 08:34 | |
| *** erus has quit IRC | 09:05 | |
| *** erus has joined #openstack-keystone | 09:05 | |
| *** rcernin has quit IRC | 09:11 | |
| *** erus has quit IRC | 09:20 | |
| *** erus has joined #openstack-keystone | 09:21 | |
| *** erus has quit IRC | 09:36 | |
| *** erus has joined #openstack-keystone | 09:36 | |
| *** erus has quit IRC | 09:43 | |
| *** erus has joined #openstack-keystone | 09:44 | |
| *** shyamb has joined #openstack-keystone | 09:50 | |
| *** erus has quit IRC | 09:55 | |
| *** erus has joined #openstack-keystone | 09:56 | |
| *** zigo has joined #openstack-keystone | 09:59 | |
| *** erus has quit IRC | 10:21 | |
| *** erus has joined #openstack-keystone | 10:21 | |
| *** shyamb has quit IRC | 11:50 | |
| *** shyamb has joined #openstack-keystone | 11:50 | |
| *** phasespace has joined #openstack-keystone | 11:54 | |
| *** jamesmcarthur has quit IRC | 12:23 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:23 | |
| *** markvoelker has quit IRC | 12:25 | |
| *** markvoelker has joined #openstack-keystone | 12:25 | |
| *** shyamb has quit IRC | 12:27 | |
| *** shyamb has joined #openstack-keystone | 12:28 | |
| cmurphy | morning o/ | 12:28 |
| cmurphy | ileixe: that's implemented in keystone, but other projects don't really take advantage of it yet. we're working on managing quota for hierarchical projects. | 12:29 |
| *** jamesmcarthur has quit IRC | 12:33 | |
| *** jmlowe has quit IRC | 12:34 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:35 | |
| *** jamesmcarthur has quit IRC | 12:40 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:44 | |
| *** shyamb has quit IRC | 12:46 | |
| *** raildo has joined #openstack-keystone | 12:59 | |
| *** StefanPaetowJisc has joined #openstack-keystone | 13:00 | |
| *** StefanPaetowJisc has quit IRC | 13:04 | |
| *** StefanPaetowJisc has joined #openstack-keystone | 13:05 | |
| *** erus has quit IRC | 13:05 | |
| *** erus has joined #openstack-keystone | 13:06 | |
| *** StefanPaetowJisc has quit IRC | 13:07 | |
| *** StefanPaetowJisc has joined #openstack-keystone | 13:12 | |
| *** StefanPaetowJisc is now known as StefanPaetow2 | 13:12 | |
| *** StefanPaetow2 is now known as StefanPaetowJisc | 13:12 | |
| gagehugo | o/ | 13:14 |
| *** StefanPaetowJisc has joined #openstack-keystone | 13:14 | |
| *** lbragstad has joined #openstack-keystone | 13:22 | |
| *** ChanServ sets mode: +o lbragstad | 13:22 | |
| *** trident has quit IRC | 13:30 | |
| *** trident has joined #openstack-keystone | 13:33 | |
| *** awalende has quit IRC | 13:37 | |
| *** awalende has joined #openstack-keystone | 13:37 | |
| *** erus has quit IRC | 13:37 | |
| *** erus has joined #openstack-keystone | 13:38 | |
| *** awalende has quit IRC | 13:42 | |
| *** openstackgerrit has joined #openstack-keystone | 13:44 | |
| openstackgerrit | Stephen Finucane proposed openstack/oslo.policy master: Follow the new PTI for document build https://review.openstack.org/549088 | 13:44 |
| lbragstad | https://etherpad.openstack.org/p/keystone-stein-rc2-tracking is getting pretty short | 13:54 |
| cmurphy | someone help me with my timezone/dst math, meeting is in two hours? | 14:08 |
| lbragstad | correct | 14:10 |
| *** erus has quit IRC | 14:10 | |
| lbragstad | 0900 - 1000 PT iirc | 14:10 |
| *** erus has joined #openstack-keystone | 14:11 | |
| *** StefanPaetowJisc has quit IRC | 14:12 | |
| cmurphy | cool | 14:12 |
| *** StefanPaetowJisc has joined #openstack-keystone | 14:13 | |
| *** StefanPaetowJisc has quit IRC | 14:16 | |
| *** erus has quit IRC | 14:16 | |
| *** erus has joined #openstack-keystone | 14:17 | |
| *** shyamb has joined #openstack-keystone | 14:20 | |
| openstackgerrit | Raildo Mascena proposed openstack/keystone master: [WIP]Fixing dn_to_id function for cases were id it's not in the DN https://review.openstack.org/649177 | 14:24 |
| lbragstad | i back ported the last patch we were hoping to land for stein | 14:32 |
| lbragstad | https://etherpad.openstack.org/p/keystone-stein-rc2-tracking should be up-to-date | 14:32 |
| gagehugo | ack | 14:33 |
| *** shyamb has quit IRC | 14:34 | |
| *** shyamb has joined #openstack-keystone | 14:34 | |
| lbragstad | we have to merge 622589 (master) -> 649297 (stable/stein) -> 649344 (stable/stein) | 14:35 |
| *** erus has quit IRC | 14:35 | |
| *** shyamb has quit IRC | 14:35 | |
| cmurphy | lbragstad: do all of the policies removed in 622589 have corresponding system/domain-scope/reader role updates? | 14:35 |
| lbragstad | 622589 and 649297 could be gated in parallel though | 14:35 |
| *** erus has joined #openstack-keystone | 14:35 | |
| lbragstad | no - they are just redundant with the current defaults in code | 14:35 |
| cmurphy | oh because they are all just "rule:admin_required" | 14:36 |
| lbragstad | any remaining scope type work or default role work should be tracked in bug report for the resource | 14:36 |
| lbragstad | yep - exactly | 14:36 |
| cmurphy | hrm but some of them are actually rule:cloud_admin | 14:37 |
| lbragstad | fwiw - we could have landed a patch to the policy.v3cloudsample.json file back in pike when we implemented policy in code to clean up all of those duplicate policies, but we never did | 14:37 |
| cmurphy | "identity:create_policy_association_for_endpoint": "rule:cloud_admin", | 14:37 |
| lbragstad | hm | 14:38 |
| lbragstad | weird - https://pasted.tech/pastes/9da2ae9475d9d03bd5f8e461702db59ff44b9989.raw | 14:40 |
| cmurphy | that doesn't match up with what's in https://review.openstack.org/#/c/622589/5/etc/policy.v3cloudsample.json | 14:41 |
| lbragstad | nope - it doesn't | 14:41 |
| lbragstad | i wonder if i had a bad copy/paste? | 14:41 |
| gagehugo | hmm | 14:43 |
| *** shyamb has joined #openstack-keystone | 14:43 | |
| *** ileixe has quit IRC | 14:57 | |
| *** yan0s has quit IRC | 15:04 | |
| *** shyamb has quit IRC | 15:06 | |
| *** erus has quit IRC | 15:06 | |
| *** shyamb has joined #openstack-keystone | 15:07 | |
| *** erus has joined #openstack-keystone | 15:07 | |
| *** vishakha has joined #openstack-keystone | 15:16 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: DRY: Remove redundant policies from policy.v3cloudsample.json https://review.openstack.org/622589 | 15:17 |
| *** jamesmcarthur has quit IRC | 15:24 | |
| *** jamesmcarthur has joined #openstack-keystone | 15:25 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: DRY: Remove redundant policies from policy.v3cloudsample.json https://review.openstack.org/622589 | 15:38 |
| *** erus has quit IRC | 15:38 | |
| *** erus has joined #openstack-keystone | 15:39 | |
| *** jamesmcarthur has quit IRC | 15:44 | |
| *** shyamb has quit IRC | 15:47 | |
| *** wxy| has joined #openstack-keystone | 15:48 | |
| knikolla | o/ | 15:49 |
| lbragstad | cmurphy gagehugo ok - updated ^ | 15:51 |
| *** shyamb has joined #openstack-keystone | 15:51 | |
| lbragstad | that should be ready to go | 15:51 |
| cmurphy | lbragstad: comment on the release note | 15:52 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: DRY: Remove redundant policies from policy.v3cloudsample.json https://review.openstack.org/622589 | 15:53 |
| lbragstad | oh - good call | 15:53 |
| lbragstad | thanks :) | 15:53 |
| cmurphy | lgtm | 15:53 |
| gagehugo | lbragstad the cloud_admin ones weren't redundant correct? | 15:54 |
| lbragstad | correct - cloud_admin is specific to the policy.v3cloudsample.json file | 15:55 |
| lbragstad | it's just a more opinionated version of rule:admin_required | 15:55 |
| lbragstad | iiuc | 15:55 |
| lbragstad | rule:cloud_admin should eventually be replaced with system scope functionality | 15:56 |
| gagehugo | yeah | 16:00 |
| cmurphy | meeting now in #openstack-meeting-alt | 16:00 |
| gagehugo | lbragstad: should those get/list/create policy entries still be in https://review.openstack.org/#/c/622589/8/keystone/tests/unit/test_policy.py ? | 16:03 |
| *** jamesmcarthur has joined #openstack-keystone | 16:04 | |
| *** erus has quit IRC | 16:06 | |
| *** erus has joined #openstack-keystone | 16:07 | |
| gagehugo | nvm | 16:13 |
| *** eandersson has joined #openstack-keystone | 16:16 | |
| eandersson | Anyone know a common cause for "This is not a recognized Fernet token"? We have a single site seeing this quite often with mostly internal traffic | 16:21 |
| *** jamesmcarthur has quit IRC | 16:21 | |
| eandersson | It looks like only our monitoring software is having issues with this so far, but difficult to say. | 16:21 |
| eandersson | Pretty sure it started happening with the introduction of caching (memcached) in that site (was disabled by mistake before that) | 16:24 |
| gagehugo | eandersson: https://bugs.launchpad.net/keystone/+bug/1702230/comments/5 | 16:26 |
| openstack | Launchpad bug 1702230 in OpenStack Identity (keystone) "fernet token fails with keystone HA" [Undecided,Invalid] - Assigned to PRAVIN (jarvisopenstack) | 16:26 |
| gagehugo | but also I saw a comment somewhere saying they saw the same issue before with memcache | 16:26 |
| *** jamesmcarthur has joined #openstack-keystone | 16:27 | |
| eandersson | The keys do look like they are replicating fine. | 16:28 |
| lbragstad | eandersson is the issue intermittent or consistent? | 16:28 |
| eandersson | intermittent | 16:28 |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1816927 | 16:29 |
| openstack | Launchpad bug 1816927 in openstack-ansible "Deployments with high churn are susceptible to false positives with token validation" [Undecided,Fix committed] | 16:29 |
| lbragstad | ^ that was a crazy edge case pas-ha brought to us regarding high churn deployments | 16:29 |
| lbragstad | if you get a 401, and you attempt to valid the token again, does it work? | 16:30 |
| eandersson | It looks like we are getting a 404. | 16:30 |
| eandersson | It's just odd as we have many keystone deployments and this is the first one to have experienced this problem. | 16:31 |
| eandersson | Unfortunately I noticed that this instance is still running Mitaka. | 16:31 |
| kmalloc | do you have in-memory cache enabled? | 16:31 |
| kmalloc | also tokens have 1 second resolution | 16:32 |
| kmalloc | so if there is a delete/invalidate it can invalidate a larger swath | 16:32 |
| kmalloc | i ... think this was only fixed or somewhat fixed in rocky+ | 16:33 |
| eandersson | in-memory cache should be disabled everywhere, everything should be powered by memcached now | 16:33 |
| eandersson | (which is also when we started seeing this issue) | 16:33 |
| eandersson | We basically swapped out the current config and introduced containers | 16:34 |
| kmalloc | shared memcache? | 16:34 |
| eandersson | Yes | 16:34 |
| kmalloc | ok. | 16:34 |
| kmalloc | if it wasn't shared it's as bad as in-memory | 16:34 |
| eandersson | The only difference in this env is that swift is sharing the same memcached | 16:34 |
| kmalloc | shouldn't impact anything | 16:34 |
| kmalloc | adding swift* | 16:34 |
| eandersson | btw we are seeing this in nova/neutron/swift, but only swift api calls are failing | 16:35 |
| kmalloc | weird. | 16:35 |
| kmalloc | wonder if swift is caching negative responses. | 16:36 |
| eandersson | In fact I think the calls that are failing are sharing token. | 16:36 |
| kmalloc | odd question is there an explicit delete of the token? | 16:37 |
| eandersson | nope | 16:37 |
| timburke | iirc, swift lets keystonemiddleware be in charge of deciding what to cache and when, fwiw, though i can help dig into that some more | 16:37 |
| kmalloc | timburke: i thought so, but we also have some odd "pass a cache into ksm" logic | 16:37 |
| kmalloc | so swift could be totally changing how the caching works. | 16:37 |
| kmalloc | and i just am not familiar if it does. | 16:38 |
| kmalloc | it used to be more opinionated way back when | 16:38 |
| eandersson | Actually it does not use the same token. Let me change that. | 16:39 |
| kmalloc | eandersson: what is the "high churn" part, just a lot of token issuance? | 16:39 |
| eandersson | Sorry, we don't really have high churn in this deployment. | 16:40 |
| eandersson | We have a couple of monitor services that hit the apis every 5 minutes | 16:40 |
| eandersson | and a synth monitor that creates a vm every ~10 minutes | 16:40 |
| eandersson | times 3 | 16:41 |
| kmalloc | ah | 16:41 |
| eandersson | That is pretty much all that happens on this deployment | 16:41 |
| eandersson | In fact this is our deployment with the lowest number of api calls | 16:42 |
| *** erus has quit IRC | 16:42 | |
| *** shyamb has quit IRC | 16:43 | |
| eandersson | In the last ~18 hours I see 228 calls to swift from one of the monitors and 91 failed. | 16:43 |
| *** erus has joined #openstack-keystone | 16:43 | |
| kmalloc | how odd. | 16:44 |
| kmalloc | makes me wonder if something somewhere is encoding the data from the token badloy | 16:44 |
| kmalloc | badly* | 16:44 |
| eandersson | Yea - it's just odd as we have like 300 of these monitors globally, and only this one site ever has this lol | 16:45 |
| kmalloc | this is the only one on mitaka? | 16:47 |
| *** erus has quit IRC | 16:49 | |
| *** erus has joined #openstack-keystone | 16:49 | |
| eandersson | Yea, but we only recently upgraded Keystone everywhere else. | 16:50 |
| kmalloc | super weird. | 16:51 |
| *** jamesmcarthur_ has joined #openstack-keystone | 16:53 | |
| *** erus has quit IRC | 16:56 | |
| *** jamesmcarthur has quit IRC | 16:57 | |
| *** erus has joined #openstack-keystone | 16:57 | |
| kmalloc | you might need to add some extra debugging in to see what is happening with swift and why it's different | 16:58 |
| kmalloc | unfortunately, i just don't know what is coming out broken. | 16:58 |
| *** wxy| has quit IRC | 17:01 | |
| *** erus has quit IRC | 17:02 | |
| *** erus has joined #openstack-keystone | 17:03 | |
| openstackgerrit | ayoung proposed openstack/keystone master: Allow an explicit_domain_id parameter when creating a domain https://review.openstack.org/605235 | 17:04 |
| ayoung | cmurphy, lbragstad I had started the spec a while back https://review.openstack.org/#/c/612099/4/specs/keystone/ongoing/predictable-ids.rst | 17:08 |
| *** erus has quit IRC | 17:10 | |
| *** erus has joined #openstack-keystone | 17:10 | |
| cmurphy | oh good | 17:13 |
| ayoung | lbragstad, https://refactoring.guru/pull-up-method see how the common method exists in all the sub classes to start, and then ends up in the baseclass? That is the geenral pattern we are going to have to do here. But the end state is the removal of duplicated cod | 17:21 |
| ayoung | e | 17:21 |
| *** jmlowe has joined #openstack-keystone | 17:28 | |
| *** jamesmcarthur_ has quit IRC | 17:28 | |
| *** jmlowe has quit IRC | 17:37 | |
| *** shyamb has joined #openstack-keystone | 17:44 | |
| lbragstad | ayoung sure - i'll be nit picky here - but that pattern doesn't apply to this specific case because the functionality we're debating isn't actually implemented yet | 18:00 |
| lbragstad | i have a preference for hanging features off of technical debt refactors because it places a precedence on keeping code clean over implementing functionality | 18:01 |
| lbragstad | once a feature is implemented, there is less of a carrot to clean things up IMO | 18:03 |
| lbragstad | s/IMO/IME/ | 18:06 |
| cmurphy | i think we do want to end up making this consistent across all user backends, is why i'm okay with this for now | 18:08 |
| *** jmlowe has joined #openstack-keystone | 18:11 | |
| *** shyam89 has joined #openstack-keystone | 18:27 | |
| *** shyamb has quit IRC | 18:30 | |
| *** erus has quit IRC | 18:30 | |
| *** shyam89 has quit IRC | 18:31 | |
| *** erus has joined #openstack-keystone | 18:31 | |
| *** spsurya has quit IRC | 18:32 | |
| eandersson | kmalloc, we were using some old method to handle keystone auth with swift. I updated it to use a keystone session. | 18:40 |
| eandersson | If that does not solve it we will just enabled debug output and see what da heck is going on. | 18:40 |
| eandersson | btw for the Keystone PTG wcould we add something about managing trusts and the ops pains of trusts? | 18:45 |
| kmalloc | cmurphy: ^ | 18:45 |
| kmalloc | i may not be at the PTG/summit | 18:46 |
| kmalloc | but it isn't a bad thought | 18:46 |
| kmalloc | though, honestly, i am going to say i hope app creds supplant trusts | 18:46 |
| kmalloc | they solve most of the problems | 18:46 |
| eandersson | We are heavy users of Trusts and... well they are probably our biggest pain point with Keystone at this time. | 18:46 |
| kmalloc | right. and app creds smooth a lot of that over and largely replicate the functionality | 18:47 |
| kmalloc | it might (if they meet the needs) be worth helping you head that direction | 18:47 |
| *** prometheanfire has left #openstack-keystone | 18:49 | |
| eandersson | Our primary concerns are for Senlin and Magnum | 18:49 |
| eandersson | We have 3 Core Reviewers for Senlin so if that actually solves the issues we have, we can probably work on getting that implemented in Senlin at least. | 18:49 |
| eandersson | This is one of the short terms patterns we implemented... https://github.com/openstack/senlin/commit/3132c9df499c6f4bcdce19d6a2805351512d2976 | 18:50 |
| eandersson | Or rather carried over from the Magnum project. | 18:50 |
| eandersson | But yea would be interesting to discuss the path forward from a perspective of Magnum/Senlin | 18:52 |
| lbragstad | gagehugo i don't think that test is failing because we do set(policy_key).difference(set(expected_policy_keys)) | 18:52 |
| lbragstad | gagehugo which only returns the keys in policy_keys that *aren't* in expected_policy_keys | 18:53 |
| lbragstad | it doesn't include keys that are present in expected_policy_keys that are not in policy_keys | 18:54 |
| cmurphy | eandersson: kmalloc we can talk about trusts | 18:59 |
| cmurphy | would it be better to hash it out during the ops feedback session at the forum, or talk about it in relation to app creds at ptg, or give it its own session at the ptg? | 19:00 |
| eandersson | So we can talk from both the ops perspective, as well from the perspective as maintainers of multiple projects | 19:00 |
| eandersson | So any of those venues are fine for me | 19:01 |
| *** gmann is now known as gmann_afk | 19:04 | |
| gagehugo | lbragstad hmm ok | 19:09 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: DRY: Remove redundant policies from policy.v3cloudsample.json https://review.openstack.org/622589 | 19:10 |
| lbragstad | gagehugo ^ | 19:10 |
| lbragstad | that passes for me, but removed_policies should only include policies that have been removed from policy.v3cloudsample.json | 19:10 |
| gagehugo | ok, that's what I was expecting | 19:12 |
| lbragstad | but having said that policy.v3cloudsample.json includes other policies that are not default policies at all, which is fine i think | 19:13 |
| cmurphy | what's the reason it wasn't failing before? | 19:18 |
| *** erus has quit IRC | 19:20 | |
| lbragstad | because the test is using set(default_policy_keys).difference(set(v3_policy_keys)) | 19:20 |
| lbragstad | i think | 19:20 |
| *** erus has joined #openstack-keystone | 19:21 | |
| lbragstad | which only gives the keys in default_policy_keys that aren't included in v3_policy_keys (or expected_policy_keys in the actual test) | 19:21 |
| lbragstad | so - i think if i were to put this more clearly.. | 19:22 |
| lbragstad | the test is really only testing that policy.v3cloudsample.json includes the defaults | 19:22 |
| gagehugo | not matching? | 19:23 |
| lbragstad | it doesn't make an assertion about equal sets, no | 19:23 |
| lbragstad | so - if a key exists in default_policy_keys but not in policy.v3cloudsample.json - the assertion will fail | 19:24 |
| lbragstad | because the test things we forgot to add a policy to protect an endpoint to policy.v3cloudsample.json | 19:24 |
| lbragstad | thinks* | 19:25 |
| *** vishakha has quit IRC | 19:25 | |
| lbragstad | even though it doesn't necessarily make sense now that the policies are in code, but prior to that this test would have been more applicable | 19:25 |
| lbragstad | conversely, it is ok to have extra keys in policy.v3cloudsample.json - since those won't be returned in the diff used in the assertion | 19:27 |
| *** erus has quit IRC | 19:27 | |
| lbragstad | https://www.programiz.com/python-programming/methods/set/difference | 19:27 |
| *** erus has joined #openstack-keystone | 19:28 | |
| *** bbobrov has quit IRC | 19:30 | |
| *** bbobrov has joined #openstack-keystone | 19:31 | |
| lbragstad | i updated the backport to match | 19:42 |
| lbragstad | both *should* be ready to go | 19:42 |
| *** jmlowe has quit IRC | 19:47 | |
| lbragstad | fyi - not sure if others have seen this yet | 19:51 |
| lbragstad | https://www.openstack.org/summit/denver-2019/summit-schedule/events/23673/leveraging-openstack-keystone-for-multi-tenancy-support-in-kubernetes | 19:51 |
| gagehugo | yeah, there's a keystone-kubernetes webhook | 19:55 |
| gagehugo | lbragstad: https://github.com/kubernetes/cloud-provider-openstack/blob/master/docs/using-keystone-webhook-authenticator-and-authorizer.md | 19:59 |
| lbragstad | cmurphy did we ever come to consensus on sessions slots for rbac and unified limits? | 20:02 |
| lbragstad | https://www.openstack.org/summit/denver-2019/summit-schedule/events/23642/increasing-api-accessibility-with-granular-policy-and-default-roles | 20:03 |
| lbragstad | https://www.openstack.org/summit/denver-2019/summit-schedule/events/23641/unified-limits-update-and-migration | 20:03 |
| lbragstad | https://www.openstack.org/summit/denver-2019/summit-schedule/events/23712/migrating-nova-apis-to-keystone-scope-types | 20:03 |
| lbragstad | https://www.openstack.org/summit/denver-2019/summit-schedule/events/23715/feedback-gathering-for-unified-limits-proposal | 20:03 |
| *** jmlowe has joined #openstack-keystone | 20:03 | |
| lbragstad | iirc we were going to keep two forum sessions for RBAC but consolidate down to one for unified limits? | 20:03 |
| lbragstad | melwitt might be able to correct me, though | 20:04 |
| cmurphy | i thought we decided something on the mailing list | 20:05 |
| cmurphy | but now it looks like we left it open ended | 20:05 |
| lbragstad | yeah - i seem to remember a conclusion somewhere... | 20:06 |
| cmurphy | in any case i support that plan | 20:07 |
| *** xek has quit IRC | 20:08 | |
| melwitt | lbragstad: oh, I thought we were consolidating both | 20:15 |
| lbragstad | i can't remember if we had that conversation solely in irc or what, but it doesn't look like the ML thread was updated | 20:17 |
| melwitt | let me find a link | 20:19 |
| melwitt | hmm. I have a reply I sent in my email but I don't see it in the openstack-discuss archive | 20:20 |
| lbragstad | o.0 | 20:21 |
| melwitt | and you replied to me | 20:21 |
| *** blake has joined #openstack-keystone | 20:21 | |
| melwitt | oh wait sorry | 20:21 |
| melwitt | I don't understand how these things are ordered | 20:21 |
| melwitt | lbragstad: this is where I said roll both into your sessions http://lists.openstack.org/pipermail/openstack-discuss/2019-March/004063.html | 20:21 |
| lbragstad | ah - http://lists.openstack.org/pipermail/openstack-discuss/2019-March/004064.html | 20:22 |
| *** markvoelker has quit IRC | 20:23 | |
| *** erus has quit IRC | 20:23 | |
| *** erus has joined #openstack-keystone | 20:24 | |
| lbragstad | so - are we still ok with that plan? | 20:24 |
| cmurphy | wfm | 20:25 |
| * lbragstad heads over to -dev | 20:26 | |
| *** pcaruana has quit IRC | 20:30 | |
| *** whoami-rajat has quit IRC | 20:30 | |
| melwitt | yeah? I haven't changed my mind since I wrote that :P | 20:32 |
| *** jamesmcarthur has joined #openstack-keystone | 20:47 | |
| *** jamesmcarthur has quit IRC | 20:47 | |
| *** jamesmcarthur has joined #openstack-keystone | 20:47 | |
| ayoung | cmurphy, I'm trying to getmy head around how the uuid change could break federation | 20:57 |
| ayoung | It looks like it was way down in the cadf code? | 20:57 |
| ayoung | Apr 02 19:05:44.695807 opensuse-150-ovh-bhs1-0004648810 devstack@keystone.service[10059]: ERROR keystone File "/opt/stack/keystone/keystone/notifications.py", line 723, in send_saml_audit_notification | 20:58 |
| cmurphy | it could be unrelated, it's the first time i've seen that though | 20:59 |
| ayoung | if the sha256 hash generated something that the cadf code thought was not a uuid, it might be catching a real error | 20:59 |
| ayoung | It did pass at least once, though, we earlier versions of the patch | 21:00 |
| ayoung | and the federation tests seem to be not consistant in what is failing | 21:00 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: DNM check if federation tests are broken https://review.openstack.org/649453 | 21:02 |
| *** erus has quit IRC | 21:02 | |
| *** erus has joined #openstack-keystone | 21:02 | |
| *** blake has quit IRC | 21:03 | |
| *** jamesmcarthur has quit IRC | 21:19 | |
| *** jamesmcarthur has joined #openstack-keystone | 21:45 | |
| *** jamesmcarthur has quit IRC | 21:50 | |
| *** blake has joined #openstack-keystone | 22:01 | |
| *** blake has quit IRC | 22:01 | |
| cmurphy | we still need one more approval for https://review.openstack.org/622589 | 22:20 |
| *** rcernin has joined #openstack-keystone | 22:25 | |
| *** jamesmcarthur has joined #openstack-keystone | 22:25 | |
| *** jamesmcarthur has quit IRC | 22:50 | |
| lbragstad | thanks cmurphy and gagehugo | 22:54 |
| *** tkajinam has joined #openstack-keystone | 22:55 | |
| *** gmann_afk is now known as gmann | 23:11 | |
| *** jamesmcarthur has joined #openstack-keystone | 23:14 | |
| *** jamesmcarthur has quit IRC | 23:43 | |
| *** jamesmcarthur has joined #openstack-keystone | 23:43 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!