| *** gyee has quit IRC | 00:01 | |
| *** jamesmcarthur has quit IRC | 00:01 | |
| *** lbragstad has joined #openstack-keystone | 00:26 | |
| *** ChanServ sets mode: +o lbragstad | 00:26 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:58 | |
| *** whoami-rajat has joined #openstack-keystone | 01:18 | |
| *** jamesmcarthur has quit IRC | 01:20 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:20 | |
| *** jamesmcarthur has quit IRC | 01:33 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:40 | |
| *** jamesmcarthur has quit IRC | 01:45 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:11 | |
| *** dasp has joined #openstack-keystone | 02:11 | |
| *** lbragstad has quit IRC | 02:12 | |
| *** ileixe has quit IRC | 02:48 | |
| *** vishalmanchanda has joined #openstack-keystone | 03:14 | |
| *** jamesmcarthur has quit IRC | 03:19 | |
| *** jamesmcarthur_ has joined #openstack-keystone | 03:19 | |
| *** ileixe has joined #openstack-keystone | 03:32 | |
| *** dasp has quit IRC | 04:08 | |
| *** jdwidari has quit IRC | 04:10 | |
| *** jamesmcarthur_ has quit IRC | 04:23 | |
| *** dasp has joined #openstack-keystone | 04:30 | |
| *** ileixe has quit IRC | 04:34 | |
| *** ileixe has joined #openstack-keystone | 04:38 | |
| *** shyamb has joined #openstack-keystone | 04:49 | |
| *** redrobot has quit IRC | 04:53 | |
| *** jamesmcarthur has joined #openstack-keystone | 04:54 | |
| *** tkajinam has quit IRC | 05:01 | |
| *** tkajinam has joined #openstack-keystone | 05:34 | |
| *** jamesmcarthur has quit IRC | 06:10 | |
| *** starborn has joined #openstack-keystone | 07:07 | |
| *** tesseract has joined #openstack-keystone | 07:19 | |
| *** shyamb has quit IRC | 07:38 | |
| *** jaosorior has joined #openstack-keystone | 07:49 | |
| *** tkajinam has quit IRC | 08:12 | |
| *** shyamb has joined #openstack-keystone | 08:39 | |
| *** pgaxatte has joined #openstack-keystone | 08:42 | |
| pgaxatte | hello | 08:42 |
|---|---|---|
| pgaxatte | i am playing with endpoint filtering | 08:43 |
| pgaxatte | but i have an issue when i put return_all_endpoints_if_no_filter to False | 08:44 |
| pgaxatte | since i don't have any filter at first, the admin's catalog is empty | 08:44 |
| pgaxatte | so i cannot manipulate anything with the openstack client | 08:44 |
| pgaxatte | is there a way around that? | 08:45 |
| pgaxatte | anyone? | 09:08 |
| *** dmellado has quit IRC | 09:09 | |
| *** dmellado has joined #openstack-keystone | 09:11 | |
| *** dmellado has quit IRC | 09:11 | |
| *** dmellado has joined #openstack-keystone | 09:15 | |
| *** raildo has joined #openstack-keystone | 10:06 | |
| *** shyamb has quit IRC | 10:07 | |
| *** shyamb has joined #openstack-keystone | 10:07 | |
| *** shyamb has quit IRC | 10:30 | |
| *** shyamb has joined #openstack-keystone | 10:38 | |
| *** aprice has quit IRC | 10:48 | |
| *** aprice has joined #openstack-keystone | 10:49 | |
| *** shyamb has quit IRC | 11:26 | |
| *** samueldmq has joined #openstack-keystone | 11:39 | |
| *** shyamb has joined #openstack-keystone | 11:42 | |
| *** redrobot has joined #openstack-keystone | 11:52 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:19 | |
| *** jamesmcarthur has quit IRC | 12:33 | |
| *** mchlumsky has joined #openstack-keystone | 12:35 | |
| *** lbragstad has joined #openstack-keystone | 12:39 | |
| *** ChanServ sets mode: +o lbragstad | 12:39 | |
| kmalloc | pgaxatte: what are you trying to solve with endpoint filtering? Most of the time it just isn't worth using. | 12:47 |
| *** jamesmcarthur has joined #openstack-keystone | 12:48 | |
| *** NM has joined #openstack-keystone | 12:49 | |
| pgaxatte | kmalloc i'm not sure I can give you a short version :) | 12:50 |
| pgaxatte | so please bare with me, here we go | 12:50 |
| kmalloc | Sure, take your time. :) | 12:51 |
| pgaxatte | we're trying to deploy new services on a k8s cluster, alongside an existing region deployed in a more legacy way | 12:51 |
| pgaxatte | let's say I want to deploy mistral in kubernetes | 12:51 |
| pgaxatte | i'd like to have a production version which would appear in everyone's catalog | 12:52 |
| pgaxatte | and be able to test a new version of mistral before going to production | 12:53 |
| kmalloc | For what it is worth, endpoint filtering just hides the endpoints. Anyone can access them if they know the URI. Nothing prevents accessing the endpoints that are not visible in the catalog | 12:53 |
| pgaxatte | sure | 12:53 |
| pgaxatte | but the test is supposed to be temporary | 12:53 |
| pgaxatte | run by a CI/CD soft and destroyed if everything is ok | 12:54 |
| kmalloc | You can also solve the same problem with policy, blocking access with roles on the new service until it is ready. | 12:54 |
| pgaxatte | and if a full functional test is OK, we upgrade the mistral production | 12:54 |
| pgaxatte | hmmm that's interesting | 12:54 |
| kmalloc | And also, finally, you could just override the endpoint when testing it and not add it to the catalog at all until it is ready | 12:55 |
| pgaxatte | i need normal user to see a catalog without the test misrtal and a test user/project to see the same catalog but with the test mistral instead of the production | 12:55 |
| kmalloc | In general you can make it work, but the endpoint filtering API is kind of a trainwreck | 12:56 |
| pgaxatte | yeah it seems complicated | 12:57 |
| kmalloc | Overly so, and it shouldn't have ever been added how it is implemented. | 12:57 |
| kmalloc | So, back to using it. I know josecastroleon uses it at cern for pivoting and updating deployments. | 12:58 |
| kmalloc | He might be able to provide insight. I unfortunately haven't had coffee yet (it's not even 6am here yet). So my brain is only somewhat alive ;) | 12:59 |
| pgaxatte | haha I realllly need to talk to José then. I'm planning to visit him and his team on the CERN days soon :D | 12:59 |
| kmalloc | However, if I remember correctly you need to create a filter before flipping that option | 13:00 |
| pgaxatte | kmalloc yeah it appears so | 13:00 |
| kmalloc | The return_all_.... One but I admit it has been years since I used the API for anything. (I worked at HP when we used it) | 13:00 |
| kmalloc | I am a bit jealous, I want to go to the CERN days. | 13:01 |
| kmalloc | But I think I am on vacation when it is happening. Also, I live west coast US, it's a long flight :P | 13:02 |
| pgaxatte | haha i live 2h away from CERN so it's easy for me :D | 13:03 |
| pgaxatte | ok so maybe the endpoint filtering is bumpy road but it would fit my needs | 13:04 |
| pgaxatte | i don't know much about keystone so I need to get more info on policies and ACL | 13:05 |
| kmalloc | Well, def enjoy the CERN days, should be fun! I can try and help later today, but timezone offset, I am guessing you'll be asleep by the time I'm moving (have an early errand to also take care of). | 13:08 |
| pgaxatte | yeah i guess i'll be off when you start your day :) | 13:08 |
| kmalloc | I hope josecastroleon can help you out in more real-time. Ill check in on stuff and make sure there isn't some wonky bug if I can. | 13:08 |
| pgaxatte | alright thanks kmalloc for your early morning insight ;) | 13:09 |
| kmalloc | Happy to help! | 13:09 |
| pgaxatte | kmalloc I'm taking a look at policies, and they seem deprecated? | 13:11 |
| pgaxatte | as of queens apparently | 13:12 |
| *** shyamb has quit IRC | 13:14 | |
| *** NM has quit IRC | 13:18 | |
| *** shyamb has joined #openstack-keystone | 13:22 | |
| openstackgerrit | Jose Castro Leon proposed openstack/keystone master: Allow to filter endpoint groups by name https://review.opendev.org/658359 | 13:24 |
| *** NM has joined #openstack-keystone | 13:32 | |
| *** NM has left #openstack-keystone | 13:33 | |
| *** vishalmanchanda has quit IRC | 13:34 | |
| *** jdwidari has joined #openstack-keystone | 13:39 | |
| *** shyamb has quit IRC | 13:54 | |
| josecastroleon | Just realized that you mentioned me :D | 13:56 |
| josecastroleon | happy to help with endpoint filtering :D | 13:59 |
| pgaxatte | josecastroleon: I understand you have a use case close to what I want to achieve | 14:21 |
| josecastroleon | yes | 14:21 |
| pgaxatte | i'd like to expose a specific catalog to a project where rally/tempest will be doing tests | 14:21 |
| pgaxatte | and this catalog would contain some endpoints that should not be exposed to the rest of the users | 14:22 |
| josecastroleon | we have a base set of services that we offer and on-demand we enable some endpoints to more services to the users | 14:22 |
| pgaxatte | oh ok so it's not exactly the same | 14:22 |
| josecastroleon | it is | 14:22 |
| *** bnemec is now known as beekneemech | 14:23 | |
| pgaxatte | because in my case i would have 2 endpoints for the same service | 14:23 |
| pgaxatte | one for production and one for testing | 14:23 |
| josecastroleon | we have a set of endpoint groups that are offered to the users (base offering) | 14:23 |
| josecastroleon | nova cinder manila and so on | 14:24 |
| josecastroleon | and we use other filters to enable for example neutron for few users | 14:24 |
| pgaxatte | ok | 14:25 |
| pgaxatte | did you set return_all_endpoints_if_no_filter = False | 14:25 |
| pgaxatte | in keystone.conf? | 14:25 |
| josecastroleon | yes | 14:25 |
| pgaxatte | and I guess you grouped your endpoint per service_id? | 14:27 |
| josecastroleon | or per region | 14:27 |
| pgaxatte | but do you have at some point 2 endpoints for the same service on the same region? | 14:28 |
| *** erus has joined #openstack-keystone | 14:32 | |
| erus | o/ | 14:33 |
| josecastroleon | yes, but you can use any attribute in the endpoint | 14:35 |
| josecastroleon | https://github.com/openstack/keystone/blob/06b024a2231a5a3035b1e972b45a3dbdfa584e75/keystone/catalog/core.py#L279-L292 | 14:36 |
| pgaxatte | ok I think I can make this work with filtering and grouping | 14:40 |
| pgaxatte | now I need to figure out how to do that in openstack-helm :D | 14:41 |
| *** raildo has quit IRC | 14:43 | |
| *** erus has quit IRC | 14:48 | |
| *** erus has joined #openstack-keystone | 14:49 | |
| *** jaosorior has quit IRC | 14:49 | |
| *** cmurphy is now known as cmorpheus | 14:54 | |
| *** raildo has joined #openstack-keystone | 14:56 | |
| *** imacdonn has quit IRC | 15:12 | |
| *** imacdonn has joined #openstack-keystone | 15:12 | |
| *** gyee has joined #openstack-keystone | 15:17 | |
| *** pgaxatte has quit IRC | 15:18 | |
| *** samueldmq has quit IRC | 15:20 | |
| *** raildo has quit IRC | 15:24 | |
| *** starborn has quit IRC | 15:26 | |
| *** josecastroleon has quit IRC | 15:32 | |
| *** raildo has joined #openstack-keystone | 16:02 | |
| *** xek has joined #openstack-keystone | 16:10 | |
| mloza | Hello, how can you make openstack CLI commands don't care about self-signed certs? | 16:15 |
| cmorpheus | mloza: with the --insecure flag | 16:23 |
| *** raildo has quit IRC | 16:23 | |
| mloza | cmorpheus: thanks | 16:24 |
| *** jamesmcarthur has quit IRC | 16:54 | |
| *** whoami-rajat has quit IRC | 16:58 | |
| *** raildo has joined #openstack-keystone | 17:28 | |
| *** whoami-rajat has joined #openstack-keystone | 18:09 | |
| *** dklyle_ has joined #openstack-keystone | 19:02 | |
| *** david-lyle has quit IRC | 19:04 | |
| mloza | Hello, I have default and testdomain as domain. I have testdomain pointed to an LDAP server. I login to the default domain as admin and set the domain context to testdomain. I went to create a Project under testdomain but when I Project Member it is empty. | 19:07 |
| mloza | It suppose to have the LDAP users | 19:07 |
| mloza | but when I go to Project Members it is empty* | 19:08 |
| mloza | Am I missing a role assignment? | 19:08 |
| *** tesseract has quit IRC | 19:12 | |
| mloza | I can create a project under testdomain but I don't see it listed in Horizon. It shows in `openstack project list` | 19:25 |
| *** jistr has quit IRC | 19:28 | |
| *** jistr has joined #openstack-keystone | 19:28 | |
| *** jistr has quit IRC | 19:29 | |
| *** jistr has joined #openstack-keystone | 19:33 | |
| *** jistr has quit IRC | 19:40 | |
| *** jistr has joined #openstack-keystone | 19:41 | |
| *** imacdonn has quit IRC | 19:51 | |
| rodrigods | i guess that now i have to go after this project deletion thing https://twitter.com/opensourceway/status/1126843586530746370 | 20:45 |
| cmorpheus | :) | 20:46 |
| *** mchlumsky has quit IRC | 21:04 | |
| *** raildo has quit IRC | 21:57 | |
| *** rcernin has quit IRC | 21:58 | |
| cmorpheus | mloza: the project members tab would probably be empty until you add a role assignment for a user to it, it won't contain ldap users automatically | 22:00 |
| *** whoami-rajat has quit IRC | 22:39 | |
| *** lbragstad has quit IRC | 22:58 | |
| *** gyee has quit IRC | 23:26 | |
| *** xek has quit IRC | 23:36 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!