Wednesday, 2019-10-02

*** brinzhang has joined #openstack-qa00:04
*** brinzhang_ has quit IRC00:07
*** igordc has quit IRC00:15
*** mattw4 has quit IRC00:17
*** hongbin has joined #openstack-qa00:30
*** brinzhang_ has joined #openstack-qa00:31
*** brinzhang has quit IRC00:34
*** hongbin has quit IRC00:50
*** yamamoto has quit IRC00:52
*** yamamoto has joined #openstack-qa00:56
*** brinzhang has joined #openstack-qa01:03
*** brinzhang has quit IRC01:05
*** brinzhang has joined #openstack-qa01:05
*** brinzhang has quit IRC01:05
*** brinzhang has joined #openstack-qa01:06
*** brinzhang_ has quit IRC01:06
*** yamamoto has quit IRC01:23
*** brinzhang_ has joined #openstack-qa01:23
*** yamamoto has joined #openstack-qa01:26
*** brinzhang has quit IRC01:27
*** markvoelker has quit IRC01:35
*** spsurya has joined #openstack-qa01:47
*** yamamoto has quit IRC01:59
*** yamamoto has joined #openstack-qa02:04
*** irclogbot_2 has quit IRC02:09
*** irclogbot_1 has joined #openstack-qa02:13
openstackgerritMerged openstack/tempest master: Call tearDownClass when handling skip exception on setUpClass  https://review.opendev.org/68600802:23
*** brinzhang has joined #openstack-qa02:44
*** brinzhang_ has quit IRC02:47
*** markvoelker has joined #openstack-qa03:10
*** yamamoto has quit IRC03:23
*** brinzhang_ has joined #openstack-qa03:46
*** brinzhang has quit IRC03:50
*** yamamoto has joined #openstack-qa04:02
*** yamamoto has quit IRC04:02
*** yamamoto has joined #openstack-qa04:05
*** yamamoto has quit IRC04:07
*** yamamoto has joined #openstack-qa04:09
*** yamamoto has quit IRC04:17
*** yamamoto has joined #openstack-qa04:22
*** yamamoto has quit IRC04:26
*** yamamoto has joined #openstack-qa04:29
*** yamamoto has quit IRC04:31
*** cgoncalves has quit IRC04:37
*** eandersson has quit IRC04:40
*** dasp has quit IRC04:40
*** cgoncalves has joined #openstack-qa04:46
*** pcaruana has joined #openstack-qa04:52
*** yamamoto has joined #openstack-qa05:11
*** yamamoto has quit IRC05:19
*** Luzi has joined #openstack-qa05:21
*** kopecmartin|off is now known as kopecmartin05:49
*** rcernin_ has joined #openstack-qa05:59
*** rcernin has quit IRC06:01
*** yamamoto has joined #openstack-qa06:21
*** yamamoto has quit IRC06:27
*** brinzhang_ has quit IRC06:32
*** brinzhang_ has joined #openstack-qa06:32
*** dasp has joined #openstack-qa06:40
*** rcernin_ has quit IRC06:45
*** rcernin has joined #openstack-qa06:45
*** tesseract has joined #openstack-qa06:57
*** iurygregory has joined #openstack-qa07:00
*** brinzhang has joined #openstack-qa07:03
*** gcheresh has joined #openstack-qa07:03
*** rcernin has quit IRC07:04
*** brinzhang_ has quit IRC07:05
*** yamamoto has joined #openstack-qa07:07
*** slaweq has joined #openstack-qa07:10
*** tosky has joined #openstack-qa07:17
*** yamamoto has quit IRC07:17
openstackgerritAkihiro Motoki proposed openstack/devstack master: lib/horizon: no need to specify keystone v3 to API version  https://review.opendev.org/67241907:34
*** slaweq has quit IRC07:38
*** jpena|off is now known as jpena07:48
*** slaweq has joined #openstack-qa07:57
*** rpittau|afk is now known as rpittau07:57
*** e0ne has joined #openstack-qa07:57
*** markvoelker has quit IRC08:09
*** jpena is now known as jpena|brb08:10
*** brinzhang_ has joined #openstack-qa08:16
*** brinzhang_ has quit IRC08:16
*** brinzhang_ has joined #openstack-qa08:17
*** brinzhang_ has quit IRC08:17
*** brinzhang_ has joined #openstack-qa08:17
*** brinzhang_ has quit IRC08:18
*** brinzhang_ has joined #openstack-qa08:18
*** brinzhang_ has quit IRC08:18
*** brinzhang_ has joined #openstack-qa08:19
*** brinzhang has quit IRC08:20
*** e0ne has quit IRC08:20
*** gfidente has joined #openstack-qa08:32
*** jpena|brb is now known as jpena08:32
*** brinzhang has joined #openstack-qa08:36
*** brinzhang_ has quit IRC08:39
openstackgerritAkihiro Motoki proposed openstack/devstack master: doc: Avoid duplicated entries in toctree  https://review.opendev.org/67242008:47
*** yamamoto has joined #openstack-qa09:17
*** yamamoto has quit IRC09:18
*** e0ne has joined #openstack-qa09:24
*** brinzhang has quit IRC09:47
openstackgerritMasayuki Igawa proposed openstack/coverage2sql master: Add PDF documentation build  https://review.opendev.org/68611809:49
*** iurygregory has quit IRC09:57
*** yamamoto has joined #openstack-qa09:58
*** yamamoto has quit IRC10:04
*** yamamoto has joined #openstack-qa10:09
*** gfidente has quit IRC10:09
*** markvoelker has joined #openstack-qa10:10
*** markvoelker has quit IRC10:15
openstackgerritMasayuki Igawa proposed openstack/qa-specs master: Update sphinx library and treat warnings as errors  https://review.opendev.org/47603510:16
*** iurygregory has joined #openstack-qa10:17
*** rcernin has joined #openstack-qa10:25
*** slaweq has quit IRC10:38
*** slaweq has joined #openstack-qa10:42
*** tosky_ has joined #openstack-qa10:49
*** slaweq has quit IRC10:51
*** e0ne has quit IRC10:51
*** tosky has quit IRC10:52
*** slaweq has joined #openstack-qa10:57
*** tosky_ is now known as tosky10:58
*** tosky_ has joined #openstack-qa11:02
*** tosky is now known as Guest1863911:02
*** tosky_ is now known as tosky11:02
*** rh-jelabarre has quit IRC11:04
*** Guest18639 has quit IRC11:04
*** rh-jelabarre has joined #openstack-qa11:05
*** openstackstatus has quit IRC11:09
*** rnoriega- has quit IRC11:09
*** rnoriega_ has joined #openstack-qa11:13
*** gfidente has joined #openstack-qa11:22
*** jpena is now known as jpena|lunch11:24
*** raildo has joined #openstack-qa11:38
*** rpittau is now known as rpittau|afk11:38
*** yamamoto has quit IRC11:42
*** artom has joined #openstack-qa11:47
*** raildo has quit IRC11:52
*** raildo has joined #openstack-qa11:54
*** yamamoto has joined #openstack-qa12:03
*** yamamoto has quit IRC12:06
*** ccamposr has quit IRC12:06
*** yamamoto has joined #openstack-qa12:11
*** jpena|lunch is now known as jpena12:29
*** ccamposr has joined #openstack-qa12:33
*** nweinber has joined #openstack-qa12:47
*** mriedem has joined #openstack-qa13:08
*** e0ne has joined #openstack-qa13:13
*** yamamoto has quit IRC13:29
*** yamamoto has joined #openstack-qa13:29
*** Luzi has quit IRC13:40
*** markvoelker has joined #openstack-qa13:53
*** markvoelker has quit IRC13:58
*** ccamposr has quit IRC13:59
*** yamamoto has quit IRC13:59
*** mriedem has quit IRC14:10
*** mriedem has joined #openstack-qa14:10
*** gkadam has joined #openstack-qa14:12
*** gkadam has quit IRC14:12
*** markvoelker has joined #openstack-qa14:26
*** openstackstatus has joined #openstack-qa14:28
*** ChanServ sets mode: +v openstackstatus14:28
*** rcernin has quit IRC14:30
*** ccamposr has joined #openstack-qa14:34
*** ccamposr has quit IRC14:38
*** ccamposr has joined #openstack-qa14:39
*** ccamposr has quit IRC14:56
*** ccamposr has joined #openstack-qa14:58
*** ccamposr__ has joined #openstack-qa15:00
*** ccamposr__ has quit IRC15:01
*** ccamposr__ has joined #openstack-qa15:01
*** ccamposr has quit IRC15:03
*** ccamposr has joined #openstack-qa15:03
*** ccamposr__ has quit IRC15:06
*** gcheresh has quit IRC15:06
*** ccamposr__ has joined #openstack-qa15:07
*** ccamposr has quit IRC15:09
*** ccamposr__ has quit IRC15:12
*** ccamposr has joined #openstack-qa15:12
*** ccamposr has quit IRC15:14
*** ccamposr has joined #openstack-qa15:15
*** ccamposr__ has joined #openstack-qa15:19
*** gfidente has quit IRC15:20
*** ccamposr has quit IRC15:22
*** yamamoto has joined #openstack-qa15:22
*** ccamposr has joined #openstack-qa15:22
*** mattw4 has joined #openstack-qa15:23
*** ccamposr__ has quit IRC15:24
*** markvoelker has quit IRC15:25
*** ccamposr__ has joined #openstack-qa15:26
*** ccamposr has quit IRC15:29
*** yamamoto has quit IRC15:29
*** ccamposr__ has quit IRC15:29
*** ccamposr__ has joined #openstack-qa15:30
*** ccamposr__ has quit IRC15:34
*** ccamposr has joined #openstack-qa15:35
*** iurygregory has quit IRC15:37
*** tosky_ has joined #openstack-qa15:41
openstackgerritColleen Murphy proposed openstack/tempest master: Add system scope for admin auth  https://review.opendev.org/68607315:41
*** tosky is now known as Guest8305815:41
*** tosky_ is now known as tosky15:41
*** Guest83058 has quit IRC15:43
*** ccamposr has quit IRC15:48
*** ccamposr has joined #openstack-qa15:49
*** gfidente has joined #openstack-qa16:09
*** pcaruana has quit IRC16:10
*** pcaruana has joined #openstack-qa16:11
*** ccamposr has quit IRC16:14
*** tesseract has quit IRC16:29
*** tosky_ has joined #openstack-qa16:40
*** tosky has quit IRC16:43
*** rfolco is now known as rfolco|dentist16:44
*** tosky_ is now known as tosky16:45
*** ccamposr has joined #openstack-qa16:54
ccamposrbuenas16:54
ccamposrestas?16:54
ccamposres rabbit16:54
ccamposrte libero de tu leak tocho16:55
*** e0ne has quit IRC16:55
openstackgerritGhanshyam Mann proposed openstack/tempest master: Fix the logging of request body credentials  https://review.opendev.org/68622017:01
*** ccamposr has quit IRC17:02
gmanncmurphy: fyi, there is old patch for system scope support.  I am ok with either one- https://review.opendev.org/#/c/604909/17:03
cmurphygmann: thanks, why does that one have no votes?17:04
gmannthere were few things to verify (after PTG discussions). It was on me to re-review that17:04
gmannbut did not get time. I will start that review this week or early next week.17:05
cmurphyi'll review it too, it looks pretty similar to mine17:06
cmurphygmann: after the admin credentials can support system scope i've been working through ideas for general rbac testing17:09
gmanncmurphy: +1. thanks17:09
cmurphybasically i'd like for tempest to support nine more personas in addition to primary/alt, to represent the three scopes and three default roles in keystone17:09
cmurphyand then projects could implement tests for each persona for each policy, something like https://github.com/cmurphy/keystone-tempest-plugin-1/commit/a8d1968b6b7840fb70153925a4d36c3ae975203f17:10
gmanncmurphy: you mean with 'system', 'project', 'domain' X 'admin', 'member', 'reader' ?17:11
cmurphygmann: right17:11
cmurphyso tests could use things like self.os_system_reader or self.os_domain_admin etc17:13
gmannonly challenge with that will be 'reader' which is new role and master Tempest needs to test the all supported branches(Queens->..) also.17:13
gmannyeah, we need to redirect self.os_system_reader to self.os_system_member/admin or something if reader role not present.17:13
cmurphygmann: what if we only implemented rbac tests in tempest plugins?17:14
gmanncmurphy: you mean in keystone_tempest_plugin or patrole ?17:14
cmurphygmann: i'm talking about rbac testing for all the projects, so keystone_tempest_plugin and glance_tempest_plugin and nova_tempest_plugin etc17:15
cmurphycc lbragstad ^17:16
* lbragstad lingers17:16
cmurphyi don't think older branches should have to use eg self.os_system_reader in their tests, this would be for new tests as the projects actually start using the reader role17:17
gmanncmurphy: yes, Tempest existing tests can keep using the credential same way. It can only provide the support for new scope and role in credential.17:19
gmannrbac test in plugins: how those will be different than Patrole tests ?17:19
gmannin Nova, we decided to go with unit tests as of now. and later we go with Patrole or something for Tempest like tests17:21
cmurphygmann: 1) projects get controle over their own tests, the patrole/qa team doesn't have to own them, 2) the way patrole works i think is too complicated for this, it uses the two tempest personas but changes around the role assignments in the background, whereas i think it is simpler if the nine personas exist out of the box17:22
*** gfidente has quit IRC17:22
gmanncmurphy: and that is for positive tests case only or negative too ?17:26
cmurphygmann: for both i think17:26
*** jpena is now known as jpena|off17:27
cmurphypatrole i think is not ideal for regression testing because it checks the expected result by parsing the policy file or the policy-in-code, and also is not flexible enough to check for anything besides the response code, i think it is better for projects to write regular tests describing the behavior they are expecting for each policy17:27
gmannok, main concern for other projects like Nova is 'to perform the complete operation for rbac verification'. keystone might be ok as operation are not so heavy.17:28
gmannthat is same concern irrespective of tests location either patrole or plugin17:29
cmurphyright, i think there's no way to get around the fact that there will be a whole lot of tests17:30
gmannyeah, and if we try to cover the negative and positive cases then it will be lot of duplicate tests also or it end up building framework like Patrole (switch the role for tests and check policy authorization)17:32
gmanni liked the john idea of injecting the policy flag in services side like os_profiler, if flag is true then service skip the API actual operation and only return policy enforce result17:33
cmurphyi hadn't heard that idea17:34
toskycmurphy: but of course if anything could be done to make the central patrole more useful for anyone, then we could just implement the patrole-based tests in each tempest plugin without reinventing the same more advanced functions every time17:34
toskymaybe it's going to be implicit in the process, maybe there is no really anything else general enough to be added to patrole, but I had to write it :)17:35
gmannpatrole based tests can be either patrole or plugin (same way like Tempest like tests).17:35
*** ccamposr has joined #openstack-qa17:36
gmanncmurphy: it was during nova sessions of system scope but I am not sure what will be the other opinions on that.17:37
cmurphytosky: that's true, just while i was trying to get familiar with patrole its design and architecture seemed really strange and overcomplicated when tempest on its own almost does what i envision17:37
*** ccamposr has quit IRC17:38
cmurphyif we try to tack on more things to patrole then it becomes even more complicated17:38
*** ccamposr has joined #openstack-qa17:38
*** ccamposr has quit IRC17:39
*** ccamposr has joined #openstack-qa17:39
cmurphyif these nine personas existed in tempest then the role-switching functionality of patrole wouldn't be needed, which is a big part of patrole's design17:40
toskyuhm, wouldn't patrole need to support other custom combinations "just in case"? Or given that it's all heavily tied to what keystone does, it wouldn't really matter in practice?17:41
gmannwith nine personas, we need to modify the tests to observe those new roles.17:42
cmurphytosky: it would be needed for patrole to test custom configuration, i am only concerned with testing the defaults17:42
*** ccamposr has quit IRC17:43
*** ccamposr__ has joined #openstack-qa17:43
*** pcaruana has quit IRC17:45
*** ccamposr__ has quit IRC17:49
gmanncmurphy: one way to avoid duplicate tests  is - instead of writing new tests in plugin, can we modify the plugin's existing tests to use new personas and redirect those personas to old defaults for stable branch testing ? and same we can do in Tempest? . and redirect can be handled via config option.17:49
gmanni mean current tests use os_primary.client (primary is member role). modify the tests to use os_project_reader.client and in test.py if no reader_role: os_project_reader = os_primary17:51
cmurphygmann: i don't think it would make sense to redirect personas, for example if i want to test that a project reader cannot create servers then redirecting to use the member role would cause the test to fail17:51
gmannyeah those are negative cases which needs to be write in plugins as new tests.17:52
*** ccamposr has joined #openstack-qa17:52
cmurphyso we have to do that anyway, so then why add the redirect complication for positive tests?17:53
gmannbut existing negative tests should be ok for lower role like reader17:53
*** ccamposr has quit IRC17:53
*** ccamposr has joined #openstack-qa17:54
cmurphyexisting negative tests in patrole?17:55
gmannno, in Tempest17:55
gmannsay, existing negative tests in Tempest is, member cannot create server only admin can. so this test will not be modified.17:56
gmannbecause there is no reader role yet so all existing negative case are with either member or admin role17:57
*** ccamposr__ has joined #openstack-qa17:57
*** ccamposr has quit IRC17:57
gmannand to cover the reader negative tests, those can be new tests in plugin17:57
cmurphyi'm in favor of avoiding duplication but i also think there's value in being really explicit about what's being tested, if the test is written so that "member" could mean member or reader or something else then that's not very clear17:58
cmurphyalso none of the tests account for scope at all17:58
cmurphyall new tests will need to be written for that17:58
gmanni was thinking scope can also be redirect. system_scope = project_scope if no system scope present.17:59
gmanni agree with your point but slowly we can remove the redirect once all stable branches have those default roles/scope17:59
gmannbecause at the end or when projects start remove the old role support then Tempest tests has to be modified18:00
gmannthough I have not thought on removal of old roles yet.  for example in Nova I am thinking to remove the old roles support after 2 cycle of new defaults is implemented (which will be Ussuri most probably ) but before that we have to modify the failed Tempest tests which are going to be lot.18:02
*** igordc has joined #openstack-qa18:03
gmannespecially when scope enforcement is enabled by default.18:03
*** ccamposr has joined #openstack-qa18:03
*** ccamposr__ has quit IRC18:03
cmurphywhat roles does nova need to remove?18:06
gmannsay adding system scope to current project scoped API. so old project admin will be removed in that API policy rule18:10
cmurphymaybe we need new flags in tempest indicating whether enforce_scope is set per-service18:11
gmannyeah18:14
gmannand slowly Tempest has to migrated to new defaults18:14
*** mattw4 has quit IRC18:16
*** mattw4 has joined #openstack-qa18:17
*** ccamposr has quit IRC18:17
*** ccamposr has joined #openstack-qa18:19
*** iurygregory has joined #openstack-qa18:21
openstackgerritGhanshyam Mann proposed openstack/tempest master: Fix the logging of request body credentials  https://review.opendev.org/68622018:22
*** ccamposr has quit IRC18:33
*** ccamposr has joined #openstack-qa18:33
*** e0ne has joined #openstack-qa18:34
*** e0ne has quit IRC18:40
*** ccamposr has quit IRC18:46
*** ccamposr has joined #openstack-qa18:48
*** mattw4 has quit IRC18:50
*** ccamposr has quit IRC18:51
*** dave-mccowan has joined #openstack-qa19:01
*** kopecmartin is now known as kopecmartin|off19:05
*** spsurya has quit IRC19:09
*** gcheresh has joined #openstack-qa19:15
*** yamamoto has joined #openstack-qa19:27
*** yamamoto has quit IRC19:32
*** dave-mccowan has quit IRC20:04
*** gcheresh has quit IRC20:06
*** dave-mccowan has joined #openstack-qa20:10
*** markvoelker has joined #openstack-qa20:21
*** mattw4 has joined #openstack-qa20:24
*** nweinber has quit IRC20:36
*** jgrosso has joined #openstack-qa20:50
*** tosky_ has joined #openstack-qa21:05
*** tosky has quit IRC21:06
*** tosky_ is now known as tosky21:08
*** markvoelker has quit IRC21:11
*** markvoelker has joined #openstack-qa21:12
*** yamamoto has joined #openstack-qa21:31
openstackgerritColleen Murphy proposed openstack/tempest master: WIP/PoC: Add default RBAC personas to dynamic creds  https://review.opendev.org/68630621:37
openstackgerritColleen Murphy proposed openstack/tempest master: WIP/PoC: Add default RBAC personas to dynamic creds  https://review.opendev.org/68630621:40
*** markvoelker has quit IRC21:41
*** markvoelker has joined #openstack-qa21:41
*** markvoelker has quit IRC21:45
*** markvoelker has joined #openstack-qa21:45
*** raildo has quit IRC21:47
*** e0ne has joined #openstack-qa21:49
gmannslaweq: amotoki : neutron new ipv6 job is failing few tests with ssh timeout but bgp with some other error, am i missing some configuration there ? - https://review.opendev.org/#/c/686043/522:10
*** rfolco|dentist is now known as rfolco22:17
*** markvoelker has quit IRC22:17
*** mriedem has quit IRC22:31
*** yamamoto has quit IRC22:34
*** e0ne has quit IRC22:35
*** slaweq has quit IRC22:35
*** ccamposr has joined #openstack-qa22:43
*** rcernin has joined #openstack-qa22:48
*** yamamoto has joined #openstack-qa23:09
openstackgerritGhanshyam Mann proposed openstack/tempest master: Fix the logging of request body credentials  https://review.opendev.org/68622023:11
gmannmasayukig: we have 686220 to get in for Tempest release. anything else you want to discuss in today office hour, otherwise I will skip this week.23:12
gmanni have updated that with reno23:12
*** tosky has quit IRC23:16
*** mattw4 has quit IRC23:28
*** bigdogstl has joined #openstack-qa23:52
bigdogstlI was wondering if anyone that know cred manager well can look at this https://bugs.launchpad.net/tempest/+bug/184641023:56
openstackLaunchpad bug 1846410 in tempest "When using 'use_dynamic_credentials = false' credentials are being modified somewhere in tempest lib" [Undecided,New]23:56

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!