| *** jamielennox is now known as jamielennox|away | 00:25 | |
| *** jamielennox|away is now known as jamielennox | 00:31 | |
| *** zhurong has joined #openstack-mistral | 00:31 | |
| *** gongysh has joined #openstack-mistral | 00:47 | |
| *** dprince has joined #openstack-mistral | 01:15 | |
| *** gongysh has quit IRC | 01:16 | |
| *** dprince has quit IRC | 01:26 | |
| *** thrash is now known as thrash|g0ne | 01:29 | |
| *** bobh has quit IRC | 02:31 | |
| *** bobh has joined #openstack-mistral | 03:04 | |
| *** bobh has quit IRC | 03:09 | |
| *** Qiming has quit IRC | 04:04 | |
| *** Qiming has joined #openstack-mistral | 04:06 | |
| *** zhurong has quit IRC | 04:09 | |
| *** zhurong has joined #openstack-mistral | 04:30 | |
| *** sharatss has joined #openstack-mistral | 05:29 | |
| *** zhurong has quit IRC | 05:41 | |
| *** jaosorior has joined #openstack-mistral | 05:56 | |
| *** zhurong has joined #openstack-mistral | 06:05 | |
| *** d0ugal has joined #openstack-mistral | 06:52 | |
| *** d0ugal has quit IRC | 06:54 | |
| *** d0ugal has joined #openstack-mistral | 06:58 | |
| *** d0ugal has joined #openstack-mistral | 06:58 | |
| openstackgerrit | Sharat Sharma proposed openstack/mistral-dashboard master: Change the Next button to Validate https://review.openstack.org/452066 | 07:04 |
|---|---|---|
| openstackgerrit | Sharat Sharma proposed openstack/mistral-dashboard master: Change the Next button to Validate https://review.openstack.org/452066 | 07:06 |
| *** jpich has joined #openstack-mistral | 07:14 | |
| *** d0ugal has quit IRC | 07:22 | |
| *** sharatss has quit IRC | 07:23 | |
| *** sharatss has joined #openstack-mistral | 07:23 | |
| *** Qiming has quit IRC | 07:26 | |
| *** d0ugal has joined #openstack-mistral | 07:26 | |
| *** d0ugal has joined #openstack-mistral | 07:26 | |
| *** Qiming has joined #openstack-mistral | 07:32 | |
| therve | d0ugal, rakhmerov https://bitbucket.org/zzzeek/sqlalchemy/issues/3950/11-regression-due-to-typedecorator-copy | 07:39 |
| therve | 1.1.8 incoming | 07:39 |
| d0ugal | oh, cool | 07:40 |
| openstackgerrit | Dougal Matthews proposed openstack/mistral master: Workaround SQLAlchemy 1.1 issue https://review.openstack.org/451985 | 07:55 |
| d0ugal | oh, looks like there is larger CI issues today. | 08:10 |
| *** tuan_ has joined #openstack-mistral | 08:10 | |
| tuan_ | morning folks | 08:19 |
| d0ugal | tuan_: hey | 08:20 |
| tuan_ | yesterday i have had a talk with Dougal about refreshing expired token in mistral that should support multi VIM | 08:20 |
| tuan_ | thanks dougal again for your time | 08:20 |
| tuan_ | i would like to have more ideas about it | 08:21 |
| d0ugal | tuan_: I think rakhmerov said he wont be around todau | 08:21 |
| d0ugal | today | 08:21 |
| tuan_ | okay | 08:21 |
| tuan_ | but may be other guys have some ideas | 08:21 |
| tuan_ | :D | 08:21 |
| d0ugal | Others might be, but I think that is who you wanted to speak with :) | 08:21 |
| d0ugal | yup! | 08:22 |
| d0ugal | If you don't have any luck, you could try the meeting on Monday. | 08:22 |
| tuan_ | well, i would like to have as much as possible | 08:22 |
| tuan_ | yep, i will definitely join it | 08:22 |
| tuan_ | otherwise, i think the refreshing the expired token when calling clients in mistral is not supported | 08:23 |
| tuan_ | this situation is what i told you yesterday | 08:24 |
| tuan_ | therefore i would like to write a bug report for it | 08:24 |
| tuan_ | how do you think about it | 08:26 |
| *** shardy has joined #openstack-mistral | 08:26 | |
| *** shardy has quit IRC | 08:37 | |
| *** shardy has joined #openstack-mistral | 08:38 | |
| d0ugal | tuan_: isn't the bug I sent you before good enough? | 09:33 |
| d0ugal | https://bugs.launchpad.net/mistral/+bug/1595084 | 09:33 |
| openstack | Launchpad bug 1595084 in Mistral "Workflow execution lifespan is limited by auth token expire time" [High,Confirmed] | 09:33 |
| *** tuan_ has quit IRC | 09:38 | |
| *** zhurong has quit IRC | 10:18 | |
| *** tuan_ has joined #openstack-mistral | 10:19 | |
| *** thrash|g0ne is now known as thrash | 10:26 | |
| *** zhurong has joined #openstack-mistral | 10:41 | |
| *** shardy is now known as shardy_lunch | 11:14 | |
| tuan_ | d0ugal: Hi Dougal, sorry for my late reply since i had something to do in urgent | 11:17 |
| tuan_ | yep, this bug was about that | 11:18 |
| tuan_ | however, shardy he proposed an algorithms in heat | 11:18 |
| tuan_ | and now we want to implement his idea in mistral | 11:18 |
| tuan_ | :) | 11:18 |
| tuan_ | thannks and i am going to talk to him | 11:18 |
| d0ugal | tuan_: yup, doing something similar to Heat is a good starting point. | 11:20 |
| tuan_ | well yup | 11:21 |
| tuan_ | it is actually what i want to mention | 11:21 |
| *** jkilpatr has joined #openstack-mistral | 11:21 | |
| tuan_ | however it is only using trust in keystone v3 | 11:21 |
| tuan_ | what about backward compatibility | 11:21 |
| tuan_ | or just let the previous releases deprecated | 11:22 |
| tuan_ | then we just support some current verisons that support v3 | 11:22 |
| tuan_ | i myself support for the solution of only supporting trust in keystone v3 | 11:23 |
| tuan_ | if we want to make it general to support backward compatibility | 11:23 |
| tuan_ | it is not an easy task | 11:23 |
| d0ugal | tuan_: I don't expect this feature to be backported. | 11:24 |
| tuan_ | yup | 11:25 |
| tuan_ | what about this | 11:25 |
| tuan_ | now we are using mistral context to trigger other clients? like nova client, neutron client | 11:26 |
| tuan_ | ? | 11:26 |
| d0ugal | yes | 11:27 |
| tuan_ | when mistral passes it | 11:27 |
| tuan_ | for instance, nova client may realize that, the token for this user may expired | 11:28 |
| tuan_ | then it fails | 11:28 |
| tuan_ | what about we can query the keystone for this context | 11:28 |
| tuan_ | and from that query, we can acquire a new token for this context | 11:29 |
| tuan_ | and then continue | 11:29 |
| d0ugal | I guess that could work, it sounds a bit hacky | 11:29 |
| d0ugal | Why not use trusts? | 11:29 |
| therve | tuan_, How do you acquire a new token? | 11:30 |
| openstackgerrit | Brad P. Crochet proposed openstack/mistral-specs master: Adding securing sensitive data spec https://review.openstack.org/450853 | 11:30 |
| tuan_ | what about it | 11:33 |
| tuan_ | http://paste.openstack.org/show/605044/ | 11:33 |
| tuan_ | please add comments, ideas, i need to go out for another private problem :( | 11:33 |
| therve | I don't understand how that would work :) | 11:33 |
| tuan_ | i will be back soo | 11:33 |
| therve | Your token is expired, you need the user password to get a new one | 11:33 |
| tuan_ | yeap | 11:34 |
| tuan_ | through the context | 11:34 |
| tuan_ | keystone = keystoneclient.Client(**context) | 11:34 |
| tuan_ | this line | 11:34 |
| jaosorior | that would be done automatically with keystone sessions | 11:35 |
| breton | oh wow, yes, you should use keystone sessions | 11:35 |
| breton | *keystoneauth sessions | 11:35 |
| jaosorior | yep | 11:35 |
| tuan_ | yup, | 11:35 |
| therve | jaosorior, How? | 11:35 |
| therve | Session will refresh the token automatically if you have the password | 11:36 |
| therve | Not on the mistral server side, AFAIU | 11:36 |
| tuan_ | i need to run now :D, sorry, i will be back. Just continue | 11:36 |
| jaosorior | breton: you're probably better informed than me to answer that ^ | 11:37 |
| jaosorior | or jamielennox ^^ | 11:38 |
| jaosorior | anyway, therve, tuan_ maybe using trusts in the answer there? | 11:49 |
| d0ugal | I hear from everyone we should move to using trusts :) | 11:49 |
| d0ugal | tuan_: so, I guess, why not use them? | 11:49 |
| therve | jaosorior, Yeah it might, I'm just wondering about the counter argument :) | 11:50 |
| therve | If there is something simpler, let's use that | 11:50 |
| therve | d0ugal, So there is a reason | 11:50 |
| therve | They don't work with federation | 11:50 |
| therve | Depending on what you need them for, service tokens may be a better idea | 11:50 |
| jaosorior | I think this issue should be brought to the mailing list. Maybe the keystone folks will have good feedback about this. | 11:51 |
| therve | Sure | 11:52 |
| d0ugal | therve: I see, it is all so complicated :) How do people learn this stuff? Is there good docs I've not found? | 11:53 |
| d0ugal | jaosorior: +1 | 11:53 |
| breton | therve: we are working on fixing them for federation | 11:53 |
| breton | therve: they are already working on some mappings | 11:54 |
| therve | d0ugal, Hum just being around that code for a while | 11:54 |
| breton | we discussed possible fixes at last meeting | 11:54 |
| therve | breton, OK. What about your comment about sessions? Is my reasoning correct? | 11:55 |
| breton | therve: i am not sure. I guess that there are credentials in **context. Instead of passing the credentials to keystoneclient, they should be used to consutruct auth plugin and auth session, and pass that to novaclient | 11:57 |
| therve | OK, but there is no magic that can recreate a token from an expired one :) | 11:58 |
| *** zhurong has quit IRC | 11:59 | |
| *** shardy_lunch is now known as shardy | 12:03 | |
| *** dprince has joined #openstack-mistral | 12:08 | |
| breton | therve: that's right :) | 12:17 |
| *** rook is now known as rook|tower | 12:31 | |
| *** catintheroof has joined #openstack-mistral | 12:36 | |
| *** chlong has joined #openstack-mistral | 12:40 | |
| tuan_ | therve: yeap | 13:02 |
| tuan_ | i am back, and sorry not to be clear about that | 13:02 |
| tuan_ | what i meant is actually the session | 13:02 |
| tuan_ | trusts is one solution | 13:02 |
| tuan_ | i just wanna know and find out more solution as much as possible | 13:02 |
| therve | tuan_, Where is the problem stated again? | 13:03 |
| tuan_ | well, you mean the token expired? | 13:03 |
| therve | I mean there is a launchpad bug somewhere | 13:03 |
| tuan_ | https://bugs.launchpad.net/mistral/+bug/1595084 | 13:04 |
| openstack | Launchpad bug 1595084 in Mistral "Workflow execution lifespan is limited by auth token expire time" [High,Confirmed] | 13:04 |
| tuan_ | it started last year | 13:04 |
| tuan_ | but no concrete answer for that | 13:04 |
| therve | As so trusts are used for cron triggers | 13:04 |
| tuan_ | yeap | 13:04 |
| therve | So for long workflows, service tokens may be a solution | 13:04 |
| therve | That's what nova uses for live-migration IIRC | 13:05 |
| therve | https://specs.openstack.org/openstack/nova-specs/specs/ocata/implemented/use-service-tokens.html | 13:05 |
| tuan_ | so to summary, in case the access token expired, we have one solution for service token | 13:06 |
| tuan_ | another one is trust with cron job | 13:06 |
| tuan_ | but for federation, trust is a good solution | 13:07 |
| therve | No for federation trusts don't work currently | 13:08 |
| *** tuan_ has quit IRC | 13:12 | |
| *** toure|gone is now known as toure | 13:13 | |
| tuan | and also the solution for one keystone trusts another one | 13:15 |
| tuan | therve: could you update me about it | 13:15 |
| *** tuan has joined #openstack-mistral | 13:15 | |
| therve | tuan, Sorry update about what? | 13:15 |
| tuan | about the federation | 13:20 |
| tuan | i though that trusts is used for one keystone trusting another one | 13:21 |
| tuan | ? | 13:21 |
| therve | one keystone user trusting another one | 13:26 |
| *** sharatss has quit IRC | 13:27 | |
| tuan | is it for federation? | 13:28 |
| therve | No that's totally unrelated | 13:28 |
| tuan | ahha, now i got it | 13:28 |
| tuan | okay, thanks guys | 13:28 |
| tuan | i am now asking keystone guys for the service token usage | 13:29 |
| tuan | i will update you guys later for it | 13:29 |
| *** amoralej is now known as amoralej|lunch | 13:54 | |
| therve | d0ugal, I believe there is still an issue with the gate wrt py3.5 | 14:15 |
| d0ugal | therve: damn :) | 14:15 |
| therve | Also overall the gate is still broken :) | 14:15 |
| d0ugal | oh, I thought I just seen some pass | 14:16 |
| d0ugal | but yeah, I just seen the message not to recheck | 14:16 |
| d0ugal | oops. | 14:16 |
| *** jamielennox is now known as jamielennox|away | 14:16 | |
| *** bobh has joined #openstack-mistral | 14:20 | |
| *** amoralej|lunch is now known as amoralej | 14:36 | |
| tuan | Hi guys, | 14:45 |
| tuan | hope you are still there | 14:45 |
| tuan | after discussing with keystone guys | 14:46 |
| tuan | i myself think that obtaining the service token through keystone session by using keystoneauth1 library seems a way to go | 14:46 |
| tuan | if we go with this case | 14:48 |
| tuan | we have to provide the auth_options for each service, e.g. nova, neutron, etc. into somewhere (may be a conf file and then load them to the oslo config) | 14:49 |
| tuan | then mistral can use these auth_options to talk to each service if user token is expired | 14:50 |
| tuan | what do you guys think about it? | 14:50 |
| *** jaosorior has quit IRC | 15:28 | |
| *** jpich has quit IRC | 16:16 | |
| *** toure is now known as toure|food | 16:21 | |
| *** shardy has quit IRC | 17:17 | |
| *** toure|food is now known as toure | 17:35 | |
| *** amoralej is now known as amoralej|off | 18:54 | |
| openstackgerrit | Kupai József proposed openstack/mistral master: Limit the number of finished executions. https://review.openstack.org/446680 | 19:16 |
| *** tuan has quit IRC | 19:25 | |
| *** Qiming has quit IRC | 20:12 | |
| *** Qiming has joined #openstack-mistral | 20:16 | |
| *** dprince has quit IRC | 20:36 | |
| *** Qiming has quit IRC | 21:01 | |
| *** Qiming has joined #openstack-mistral | 21:02 | |
| *** thrash is now known as thrash|g0ne | 21:24 | |
| *** fultonj has quit IRC | 21:40 | |
| *** bobh has quit IRC | 22:18 | |
| *** catintheroof has quit IRC | 22:36 | |
| *** bobh has joined #openstack-mistral | 23:29 | |
| *** bobh has quit IRC | 23:30 | |
| *** bobh has joined #openstack-mistral | 23:31 | |
| *** bobh has quit IRC | 23:36 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!