Thursday, 2016-10-06

klindgrenquestion for other ops - anyone feel like openstack clients --debug printing of the username/password parameters is a LOL WTActualF00:02
klindgrenfeature.00:02
xavpaicewow00:03
* xavpaice goes and has a go00:03
xavpaiceyup, there it is.00:04
xavpaiceLOL WTActualF indeed00:04
klindgrenyea - this bit me yesterday internally00:04
xavpaicepastebin?00:04
klindgreninternal slack - but might as well have been00:04
xavpaicethere's parts of the output that are clean - "'password': '***'" from an 'openstack --debug token issue'00:05
klindgrenok filling a bug.  As I dont think users/ops expect that doing debug would send their password in clear text to the console.  Thats ripe for cred leakage00:06
xavpaiceyeah, it's bound to bite others, just that some wouldn't notice00:06
klindgreneven -vv does it00:06
*** jamesden_ has quit IRC00:07
xavpaiceseems to be just the auth_config_hook(): bit of it that's not clean00:08
*** paulobanon has quit IRC00:09
klindgrenI see it in two spots in the output.  1.) in the options: Namespace bit 2.) in the Using paramaters bit00:11
*** paulobanon has joined #openstack-operators00:11
xavpaiceouchy00:11
*** ducttape_ has quit IRC00:12
klindgrenand again in the defaults: under options00:12
klindgrenhttps://bugs.launchpad.net/python-openstackclient/+bug/163082200:22
openstackLaunchpad bug 1630822 in python-openstackclient "Debug and -vv outputs user password in plain text" [Undecided,New]00:22
*** markvoelker has joined #openstack-operators00:22
*** emagana has quit IRC00:27
*** markvoelker has quit IRC00:27
*** Vinsh has joined #openstack-operators00:33
*** emagana has joined #openstack-operators00:33
*** ducttape_ has joined #openstack-operators00:37
*** emagana has quit IRC00:38
*** VW has joined #openstack-operators00:42
mriedemklindgren: which version?00:43
klindgren1.7.200:43
*** emagana has joined #openstack-operators00:44
mriedemok so liberty00:44
klindgrenxavpaice, what is your version?00:44
xavpaiceopenstackclient - 3.2.000:45
*** emagana has quit IRC00:45
mriedemso newton00:46
*** emagana_ has joined #openstack-operators00:46
mriedemok, so not fixed yet i guess00:46
*** VW has quit IRC00:47
*** dtrainor has quit IRC00:47
*** emagana_ has quit IRC00:47
klindgrenhrm00:51
klindgrenthis was suppose to be fixed in 2015-10-1500:52
klindgrenhttps://review.openstack.org/#/c/233271/00:52
mriedemhmm https://github.com/openstack/python-openstackclient/commit/f0a81c284d2f533e0fe8adc747c5bd0532a7684f00:53
mriedemyup00:53
xavpaicehttps://review.openstack.org/#/c/233271/7/openstackclient/common/clientmanager.py line 170?00:53
klindgrenyea00:53
mriedemnote that was released in 1.8.000:54
mriedemso didn't make liberty00:54
mriedemand for whatever reason they didn't backport it00:54
klindgrenbut its showing up in 3.2.000:54
mriedemthat code lives in osc_lib now00:54
klindgrenwith xav00:54
mriedemhttp://git.openstack.org/cgit/openstack/osc-lib/tree/osc_lib/shell.py#n36600:54
xavpaiceI'd paste, but my password is in there ;)00:54
*** zul has joined #openstack-operators00:55
klindgrenguessing: http://git.openstack.org/cgit/openstack/osc-lib/tree/osc_lib/shell.py#n40000:56
*** Hosam has quit IRC00:57
klindgrenatleast under my old versions it was in options:, default: and paramaters sections00:57
*** Hosam has joined #openstack-operators00:57
*** Apoorva_ has joined #openstack-operators00:58
*** Apoorva has quit IRC01:01
mriedemi've cherry picked back at least the change above to liberty01:01
mriedemi don't have a master devstack up to check out the 3.2.0 issue01:01
*** Hosam has quit IRC01:01
* mriedem stacks01:02
xavpaiceI'm just using a client installed in a venv, from pip, with an elderly openstack01:02
xavpaiceoutput is in the bug, but scrubbed a bit01:02
*** dtrainor has joined #openstack-operators01:02
*** Apoorva_ has quit IRC01:03
mriedemxavpaice: klindgren: http://git.openstack.org/cgit/openstack/python-openstackclient/tree/openstackclient/common/client_config.py#n18301:04
mriedemand http://git.openstack.org/cgit/openstack/osc-lib/tree/osc_lib/cli/client_config.py#n14801:04
klindgrenif LOG.debug or LOG.INFO  strutils.mask_password(self.<thingbeing printed>)01:07
*** zul has quit IRC01:08
*** emagana has joined #openstack-operators01:10
mriedempushing the openstackclient patch after pep8 finishes01:10
*** zul has joined #openstack-operators01:12
mriedemhttps://review.openstack.org/38269901:12
mriedemxavpaice: can you test ^ ?01:12
*** emagana has quit IRC01:14
xavpaicehold the line caller..01:15
mriedemditto01:18
mriedemhttps://review.openstack.org/38270101:18
xavpaicehttps://review.openstack.org/382699 doesn't do it01:18
xavpaicesorry that was unclear - it doesn't fix the issue01:19
mriedemah yeah i see01:21
xavpaicealso https://review.openstack.org/382701 doesn't change the output - still see my password01:22
mriedemyeah i hit the wrong thing01:22
mriedemweird, does --mask change anything by chance?01:23
mriedemactually that defaults to True so shouldn't be a problem01:24
mriedemseems like it's something in os-client-config01:31
* xavpaice upgrades01:33
xavpaicesame issue with os-client-config 1.21.101:33
mriedemyeah idk, i'm not real familiar with osc01:34
mriedemi thought that auth_config_hook debug log was the ticket01:34
xavpaicewell, it's all good info collecting01:34
mriedemxavpaice: how did you test it? pull the change down and rebuild the venv?01:34
xavpaicehacky hacky edit the code with vi01:36
xavpaicedirty, but it's easy to rebuild the venv if I break stuff01:36
xavpaiceheck, hang on a bit, I need to re-try some of those tests01:38
xavpaice:/01:38
mriedemno you're right, it doesn't fix it01:40
mriedemi have the recreate locally01:40
xavpaicejust retested, same01:41
mriedemxavpaice: it's osc_lib01:49
mriedemhttp://paste.openstack.org/show/584600/01:50
mriedemi injected an exception in auth_config_hook in osc-lib01:50
mriedemthat's the "raise Exception(str(config))" part01:50
xavpaicenice01:51
xavpaiceby jove, you've got it01:54
mriedemsweet01:55
xavpaicehttps://review.openstack.org/#/c/382701/1 - when I test it correctly - fixes it01:55
mriedemcool01:55
xavpaice(apologies for busted testing)01:55
mriedemprobably doesn't hurt to have both01:55
mriedemnp01:55
xavpaiceindeed01:55
mriedemit's duplicated code for now as they are moving osc to use osc-lib01:55
xavpaiceyeah, but the other change might fix things for the in-between versions01:56
mriedemyup01:59
mriedemi'll be backporting the osc one01:59
mriedemok well that was fun, i'm going to try to do something non-work related for the last hour i have before bed02:00
xavpaicethe trouble with timezones.  Only 3pm here.02:02
mriedemheh02:03
mriedemi added the OSSA to this also02:04
mriedemso there is some awareness02:04
xavpaiceyeah, that's entirely appropriate - nice job on such a fast fix, by the way02:05
mriedemthanks02:06
mriedemnow i'm an osc ATC and can go to the pike summit!02:06
*** mriedem has quit IRC02:18
*** pontusf4 has quit IRC02:33
*** pontusf4 has joined #openstack-operators02:34
*** ducttape_ has quit IRC02:51
*** maticue has quit IRC02:55
*** VW has joined #openstack-operators03:29
*** dtrainor has quit IRC03:33
*** armax has quit IRC03:41
*** armax has joined #openstack-operators03:47
*** armax has quit IRC04:02
*** armax has joined #openstack-operators04:02
*** armax has quit IRC04:03
*** markvoelker has joined #openstack-operators04:25
*** markvoelker has quit IRC04:30
*** sudswas__ has joined #openstack-operators04:36
*** sudipto has joined #openstack-operators04:36
*** VW has quit IRC04:38
*** sudipto has quit IRC04:42
*** sudswas__ has quit IRC04:42
*** liverpooler has quit IRC04:45
*** Rockyg has quit IRC05:03
*** makowals has quit IRC05:05
*** bjolo_ has joined #openstack-operators05:06
*** admin0 has joined #openstack-operators05:26
*** emagana has joined #openstack-operators05:26
*** markvoelker has joined #openstack-operators05:26
*** markvoelker has quit IRC05:31
*** liverpooler has joined #openstack-operators06:02
*** emagana has quit IRC06:02
*** liverpooler has quit IRC06:07
*** liverpooler has joined #openstack-operators06:07
*** rcernin has joined #openstack-operators06:15
*** makowals has joined #openstack-operators06:19
*** markvoelker has joined #openstack-operators06:27
*** simon-AS559 has joined #openstack-operators06:30
*** markvoelker has quit IRC06:32
*** VW has joined #openstack-operators06:38
*** VW has quit IRC06:43
*** simon-AS559 has quit IRC06:49
*** mjrichardson has quit IRC07:06
*** tesseract- has joined #openstack-operators07:11
*** zeih has joined #openstack-operators07:18
*** zeih has quit IRC07:19
*** zeih has joined #openstack-operators07:19
*** pcaruana has joined #openstack-operators07:26
*** markvoelker has joined #openstack-operators07:28
*** markvoelker has quit IRC07:32
*** mjrichardson has joined #openstack-operators07:35
*** simon-AS559 has joined #openstack-operators07:38
*** jsheeren has joined #openstack-operators07:38
*** bjolo_ has quit IRC07:42
*** mjrichardson has quit IRC07:47
*** racedo has quit IRC07:53
*** mjrichardson has joined #openstack-operators07:55
*** ducttape_ has joined #openstack-operators07:56
*** racedo has joined #openstack-operators07:57
*** ducttape_ has quit IRC08:01
*** emagana has joined #openstack-operators08:14
*** emagana has quit IRC08:19
*** zeih has quit IRC08:26
*** dbecker has joined #openstack-operators08:27
*** derekh has joined #openstack-operators08:38
*** dc_mattj has joined #openstack-operators08:39
*** MrDanDan has joined #openstack-operators08:50
*** ducttape_ has joined #openstack-operators08:57
*** shintaro has joined #openstack-operators09:00
*** racedo has quit IRC09:01
*** ducttape_ has quit IRC09:02
*** bjolo_ has joined #openstack-operators09:02
*** racedo has joined #openstack-operators09:03
*** zeih has joined #openstack-operators09:04
*** racedo has quit IRC09:04
*** racedo has joined #openstack-operators09:12
*** saneax-_-|AFK is now known as saneax09:39
*** tholiv has joined #openstack-operators09:51
*** ducttape_ has joined #openstack-operators09:57
*** shintaro has quit IRC10:00
*** ducttape_ has quit IRC10:02
*** dc_mattj has quit IRC10:03
*** dc_mattj has joined #openstack-operators10:12
*** dc_mattj has quit IRC10:27
*** pjm6 has quit IRC10:54
*** pjm6 has joined #openstack-operators10:54
*** ducttape_ has joined #openstack-operators10:58
*** ducttape_ has quit IRC11:03
*** d0ugal has quit IRC11:05
*** jsheeren has quit IRC11:05
*** d0ugal has joined #openstack-operators11:06
*** RaginBajin has quit IRC11:08
*** jsheeren has joined #openstack-operators11:09
*** RaginBajin has joined #openstack-operators11:10
*** RaginBajin has quit IRC11:20
*** pasquier-s has quit IRC11:20
*** RaginBajin has joined #openstack-operators11:20
*** pasquier-s has joined #openstack-operators11:20
*** tholiv has quit IRC11:34
*** tholiv has joined #openstack-operators11:34
*** dc_mattj has joined #openstack-operators11:35
*** tholiv has quit IRC11:36
*** tholiv has joined #openstack-operators11:36
*** dc_mattj has quit IRC11:42
*** racedo has quit IRC11:49
*** tatwaffe has joined #openstack-operators11:53
*** zeih has quit IRC11:55
*** racedo has joined #openstack-operators11:55
*** uxdanielle has quit IRC11:56
*** ducttape_ has joined #openstack-operators11:59
*** zeih has joined #openstack-operators12:02
*** dc_mattj has joined #openstack-operators12:03
*** ducttape_ has quit IRC12:04
*** dc_mattj has quit IRC12:09
*** ducttape_ has joined #openstack-operators12:11
*** maticue has joined #openstack-operators12:25
*** ducttape_ has quit IRC12:30
*** markvoelker has joined #openstack-operators12:31
*** ducttape_ has joined #openstack-operators12:43
*** ducttape_ has quit IRC12:47
*** liverpooler has quit IRC12:56
*** zeih has quit IRC13:05
*** ducttape_ has joined #openstack-operators13:06
*** mriedem has joined #openstack-operators13:16
*** VW_ has joined #openstack-operators13:21
*** ducttape_ has quit IRC13:28
*** jsheeren has quit IRC13:29
*** zul has quit IRC13:30
*** zul has joined #openstack-operators13:33
mriedemrandom question, how often do you use os-flavor-access?13:35
mriedemto give multiple tenants access to a private flavor13:35
*** ducttape_ has joined #openstack-operators13:58
*** dtrainor has joined #openstack-operators14:05
*** dc_mattj has joined #openstack-operators14:10
*** simon-AS559 has quit IRC14:15
*** bjolo_ has quit IRC14:18
*** dc_mattj has quit IRC14:19
*** jamesdenton has joined #openstack-operators14:22
*** liverpooler has joined #openstack-operators14:23
*** dc_mattj has joined #openstack-operators14:26
*** MrDanDan has quit IRC14:29
*** dminer has joined #openstack-operators14:30
*** dminer has left #openstack-operators14:30
*** VW_ has quit IRC14:31
*** dminer has joined #openstack-operators14:31
*** VW has joined #openstack-operators14:31
*** hj-hpe has joined #openstack-operators14:37
*** dc_mattj has quit IRC14:39
*** Hosam has joined #openstack-operators14:40
*** Hosam_ has joined #openstack-operators14:40
*** dc_mattj has joined #openstack-operators14:43
*** Hosam has quit IRC14:44
*** armax has joined #openstack-operators14:54
*** DuncanT has quit IRC14:55
*** bryan_att has quit IRC14:55
*** peterjenkins_ has quit IRC14:55
*** kelv has quit IRC14:55
*** pkoraca has quit IRC14:55
*** fyxim has quit IRC14:55
*** dc_mattj has quit IRC14:58
*** bdeschenes has joined #openstack-operators15:03
*** marst has quit IRC15:08
*** armax has quit IRC15:10
*** peterjenkins_ has joined #openstack-operators15:11
*** armax has joined #openstack-operators15:11
*** nicodemus_ has joined #openstack-operators15:11
*** fyxim has joined #openstack-operators15:11
*** bryan_att has joined #openstack-operators15:13
*** Hosam_ has quit IRC15:13
*** Hosam has joined #openstack-operators15:14
*** r-daneel has joined #openstack-operators15:17
*** marst has joined #openstack-operators15:19
*** Hosam has quit IRC15:19
*** kelv has joined #openstack-operators15:29
*** saneax is now known as saneax-_-|AFK15:29
*** DuncanT has joined #openstack-operators15:36
*** ducttape_ has quit IRC15:37
*** pkoraca has joined #openstack-operators15:49
*** emagana has joined #openstack-operators15:51
*** unrahul has quit IRC15:52
*** unrahul has joined #openstack-operators15:52
*** ducttape_ has joined #openstack-operators15:52
klindgrenwe dont use it very often15:53
klindgrenhowever we are going to start doing it with baremetal15:53
*** rcernin has quit IRC16:01
mriedemyeah that makes sense16:03
openstackgerritDaniel Mellado proposed openstack/osops-tools-contrib: Add tox environement for ansible workloads  https://review.openstack.org/38307616:13
*** marst has quit IRC16:20
*** marst has joined #openstack-operators16:22
openstackgerritDaniel Mellado proposed openstack/osops-tools-contrib: Add tox environement for ansible workloads  https://review.openstack.org/38307616:24
*** ducttape_ has quit IRC16:30
*** tesseract- has quit IRC16:31
*** dminer has quit IRC16:48
*** ducttape_ has joined #openstack-operators16:54
*** Apoorva has joined #openstack-operators16:54
*** derekh has quit IRC16:56
*** Apoorva_ has joined #openstack-operators17:01
*** Apoorva has quit IRC17:04
*** Apoorva_ has quit IRC17:05
*** saneax-_-|AFK has quit IRC17:07
*** Apoorva has joined #openstack-operators17:12
*** saneax-_-|AFK has joined #openstack-operators17:18
*** emagana has quit IRC17:20
*** Rockyg has joined #openstack-operators17:23
*** Vinsh has quit IRC17:41
*** simon-AS559 has joined #openstack-operators17:41
*** Vinsh has joined #openstack-operators17:41
*** priteau has joined #openstack-operators18:01
*** emagana has joined #openstack-operators18:34
*** saneax-_-|AFK has quit IRC18:41
*** saneax-_-|AFK has joined #openstack-operators18:44
*** simon-AS559 has quit IRC18:49
*** harlowja has quit IRC18:50
*** akijak has quit IRC18:57
*** akijak has joined #openstack-operators18:59
*** ducttape_ has quit IRC19:09
*** maishsk has joined #openstack-operators19:13
claytonklindgren: yeah, that sort of thing is the reason why one of the asks at the ops meetup was the ability to grant flavor access with roles19:15
klindgrenyea - can enforce some of that stuff with policy19:16
klindgrenbut policy violation are a real pain in the ass19:16
klindgrenand imho are hacks to what people really want19:16
claytonhow so?19:16
klindgrenlike we have a policy that a request must have an AZ in it to boot a vm19:16
klindgrenwhich is enforced with policy, but if the end user doesn't supply one - they jsut get a 401 policy error19:17
klindgrenwithout any details as to why19:17
claytonah, I see what you mean19:17
claytonwell, with flavors I would hope they just wouldn't show up in flavor list if they didn't have access19:17
klindgrenthey wouldn't but we could grant  policy that only people with role blah can use flavor y19:18
klindgrenbut I dont think that would prevent people from seeing it as an option19:18
klindgren(currently)19:18
klindgrenunless you went the private flavors route19:18
*** racedo has quit IRC19:19
claytonright, that was the though, and use roles to grant people access, instead of specific tenants19:19
claytonit's a big pain in the ass to manage by tenant across multiple environments, since it wants the tenant by uuid, not by name19:19
claytonit'd be easier to grant a specific person the correct role in each environment19:19
*** jsheeren has joined #openstack-operators19:20
klindgrenyes19:22
*** maishsk has quit IRC19:33
*** ducttape_ has joined #openstack-operators19:39
*** emagana_ has joined #openstack-operators19:42
*** dalees has quit IRC19:43
*** emagana has quit IRC19:46
mriedemdoes anyone here configure nova services with non-default rpc topics?19:52
mriedembecause it's been proposed to remove that ability here https://review.openstack.org/#/c/351608/19:52
mriedemcburgess: jlk: klindgren: ^19:53
jlkI don't.19:53
klindgrenI don't19:53
cburgessFine with me19:53
mriedemok, i think i know of maybe one thing that used this as a backdoor to run multiple computes with different virt drivers on the same host19:54
cburgessmriedem I just gave it a +119:54
mriedembut that thing was crazy19:54
cburgessYeah this seems like a bad option to begin with so I full support John's removal.19:54
mriedem+W19:55
mriedemthanks19:55
*** dalees has joined #openstack-operators19:56
*** Rockyg has quit IRC19:58
jlkmaybe somebody is getting cute with rabbit load balancing and sharding?20:06
*** jsheeren has quit IRC20:07
*** harlowja has joined #openstack-operators20:17
*** paramite has quit IRC20:48
*** tholiv has quit IRC20:48
*** tholiv has joined #openstack-operators20:48
*** VW has quit IRC20:53
*** tholiv has quit IRC21:00
*** pilgrimstack1 has joined #openstack-operators21:02
*** pilgrimstack has quit IRC21:04
*** Apoorva_ has joined #openstack-operators21:04
*** Apoorva has quit IRC21:07
*** maticue has quit IRC21:14
*** harlowja has quit IRC21:17
*** bdeschenes has quit IRC21:29
auggyooh while we're asking about nova options, i have a question... is anyone customizing mkisofs_cmd to something other than their OS's default ISO maker (eg, ubuntu - genisoimage; windows - mkisofs; etc..)21:36
auggy(for config drive)21:37
auggycontext: http://docs.openstack.org/user-guide/cli-config-drive.html21:37
*** mriedem has quit IRC21:38
*** harlowja has joined #openstack-operators21:39
*** harlowja has quit IRC21:39
jlkno21:39
*** VW has joined #openstack-operators21:39
*** harlowja has joined #openstack-operators21:39
auggycool, i'll post to the ML too but i thought i'd vet it here first21:42
auggyjlk: do you know of any valid use case for why someone would need to modify this value to something other than their OS's preferred iso utility?21:43
*** rcernin has joined #openstack-operators21:47
*** simon-AS559 has joined #openstack-operators21:49
*** hj-hpe has quit IRC21:51
jlkstruggling to think of one21:52
jlkmaybe they have to patch it somehow? But they couldn't they replace the standard path?21:52
*** marst has quit IRC21:54
*** bdeschenes has joined #openstack-operators21:55
rcerninwhat channel is dedicated to openstackclient guys? is there any?21:57
*** ducttape_ has quit IRC21:58
*** rcernin has quit IRC21:59
*** rcernin has joined #openstack-operators21:59
*** nicodemus_ has quit IRC22:03
*** admin0 has quit IRC22:05
*** Apoorva_ has quit IRC22:12
*** Apoorva has joined #openstack-operators22:13
*** jamesdenton has quit IRC22:14
serverascodelol maybe being clever with test openstack deployment passwords is not so clever: https://bugs.launchpad.net/oslo.config/+bug/1577731 I was using "0pen$stack" as a rabbit password22:15
openstackLaunchpad bug 1577731 in shaker "NoSuchOptError: no such option in group DEFAULT: os_password" [Medium,Triaged]22:15
*** bdeschenes has quit IRC22:15
rcerninguys what is the right openstackclient channel on #irc?22:20
auggyjlk: thanks, you're probably right but figured i'd do my due diligence ;)22:21
auggyrcernin: you want #openstack-sdk22:22
auggyrcernin: i'm full of lies, sorry let me check the spelling22:23
auggyrcernin: #openstack-sdks22:23
auggyforgot an s there hehe22:23
rcerninauggy: thank you22:25
*** VW has quit IRC22:33
*** TonyXu has quit IRC22:41
*** TonyXu has joined #openstack-operators22:42
*** ducttape_ has joined #openstack-operators22:49
*** saneax-_-|AFK is now known as saneax23:12
*** priteau has quit IRC23:26
*** mriedem has joined #openstack-operators23:26
*** VW has joined #openstack-operators23:29
*** rcernin has quit IRC23:36
*** ducttape_ has quit IRC23:44
*** ducttape_ has joined #openstack-operators23:46
*** pcaruana has quit IRC23:55

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!