| *** aliguori has quit IRC | 00:01 | |
| *** adiantum has quit IRC | 00:02 | |
| *** gregp76 has quit IRC | 00:04 | |
| *** Zangetsue has joined #openstack | 00:04 | |
| *** joearnold has quit IRC | 00:06 | |
| *** adiantum has joined #openstack | 00:06 | |
| *** jeffjapan has joined #openstack | 00:07 | |
| *** vernhart has quit IRC | 00:08 | |
| *** rds__ has quit IRC | 00:13 | |
| *** reldan has quit IRC | 00:14 | |
| *** pharkmillups has quit IRC | 00:18 | |
| *** j1mc is now known as j1mc_not_here | 00:21 | |
| *** joearnold has joined #openstack | 00:22 | |
| *** jeffjapan has quit IRC | 00:22 | |
| *** littleidea has quit IRC | 00:22 | |
| *** adiantum has quit IRC | 00:24 | |
| *** jeffjapan has joined #openstack | 00:25 | |
| *** joearnold has quit IRC | 00:27 | |
| *** aliguori has joined #openstack | 00:30 | |
| *** adiantum has joined #openstack | 00:31 | |
| *** winston-d has joined #openstack | 00:34 | |
| *** nelson has quit IRC | 00:36 | |
| *** nelson has joined #openstack | 00:37 | |
| *** mahadev has joined #openstack | 00:38 | |
| *** adjohn has quit IRC | 00:39 | |
| *** adiantum has quit IRC | 00:40 | |
| *** mahadev has quit IRC | 00:42 | |
| *** justinsb has quit IRC | 00:44 | |
| *** justinsb has joined #openstack | 00:45 | |
| *** adiantum has joined #openstack | 00:46 | |
| *** maplebed has quit IRC | 00:48 | |
| *** mahadev has joined #openstack | 00:49 | |
| *** clauden_ has quit IRC | 01:08 | |
| *** bluetux has joined #openstack | 01:12 | |
| *** adiantum has quit IRC | 01:12 | |
| *** dendrobates is now known as dendro-afk | 01:15 | |
| *** j1mc_not_here has quit IRC | 01:16 | |
| *** littleidea has joined #openstack | 01:16 | |
| *** j1mc_not_here has joined #openstack | 01:17 | |
| *** j1mc_not_here is now known as j1mc | 01:17 | |
| *** adiantum has joined #openstack | 01:18 | |
| *** Ryan_Lane has quit IRC | 01:26 | |
| *** burris has joined #openstack | 01:27 | |
| *** johnpur has quit IRC | 01:44 | |
| *** benbenhappy has joined #openstack | 01:46 | |
| *** dendro-afk is now known as dendrobates | 01:56 | |
| *** adiantum has quit IRC | 01:58 | |
| *** adiantum has joined #openstack | 02:02 | |
| *** adiantum has quit IRC | 02:13 | |
| *** burris has quit IRC | 02:15 | |
| HugoKuo | excuse me , how to update python-eventlet on ubuntu maverick ? | 02:17 |
|---|---|---|
| *** adiantum has joined #openstack | 02:17 | |
| HugoKuo | I check the python-eventlet version in my host is 0.9.12 | 02:18 |
| uvirtbot | New bug: #746909 in nova "Cannot ping or ssh instance when network manager is FlatManager" [Undecided,New] https://launchpad.net/bugs/746909 | 02:21 |
| *** kashyap has joined #openstack | 02:22 | |
| *** adiantum has quit IRC | 02:54 | |
| uvirtbot | New bug: #746922 in nova "DescribeAddresses returns all Floating IPs regardless of AllocateAddress" [Undecided,New] https://launchpad.net/bugs/746922 | 02:56 |
| *** dovetaildan has quit IRC | 02:58 | |
| *** adiantum has joined #openstack | 03:00 | |
| *** dovetaildan has joined #openstack | 03:00 | |
| *** adjohn has joined #openstack | 03:00 | |
| *** adjohn has quit IRC | 03:02 | |
| *** jfluhmann has quit IRC | 03:07 | |
| winston-d | HugoKuo : on RHEL, i use easy_install to install/update python packages. | 03:07 |
| *** littleidea has quit IRC | 03:21 | |
| HugoKuo | ok thanks~ | 03:22 |
| HugoKuo | btw , which boto version should be installed in nova? | 03:22 |
| *** adiantum has quit IRC | 03:23 | |
| HugoKuo | bcz I failed to upload image to objectstore ... | 03:23 |
| HugoKuo | I remember that I face this problem before | 03:23 |
| *** dendrobates is now known as dendro-afk | 03:30 | |
| *** AimanA is now known as HouseAway | 03:32 | |
| *** littleidea has joined #openstack | 03:33 | |
| *** adiantum has joined #openstack | 03:36 | |
| HugoKuo | should I install python-boto 2.0 ? | 03:52 |
| *** zenmatt has quit IRC | 04:00 | |
| *** littleidea has quit IRC | 04:01 | |
| *** j1mc has quit IRC | 04:02 | |
| *** kashyap has quit IRC | 04:05 | |
| *** littleidea has joined #openstack | 04:08 | |
| *** adiantum has quit IRC | 04:09 | |
| *** mahadev has quit IRC | 04:09 | |
| *** adiantum has joined #openstack | 04:13 | |
| *** nRy has quit IRC | 04:20 | |
| *** adjohn has joined #openstack | 04:20 | |
| *** adiantum has quit IRC | 04:23 | |
| *** lionel has quit IRC | 04:24 | |
| *** lionel has joined #openstack | 04:25 | |
| *** mahadev has joined #openstack | 04:25 | |
| *** hadrian has quit IRC | 04:25 | |
| *** mahadev has quit IRC | 04:26 | |
| *** kashyap has joined #openstack | 04:26 | |
| *** RickB17_ has quit IRC | 04:27 | |
| *** adiantum has joined #openstack | 04:29 | |
| *** adiantum has quit IRC | 04:40 | |
| *** guynaor has joined #openstack | 04:41 | |
| *** guynaor has left #openstack | 04:41 | |
| *** adiantum has joined #openstack | 04:46 | |
| *** f4m8_ is now known as f4m8 | 04:49 | |
| *** adjohn has quit IRC | 04:58 | |
| *** adjohn has joined #openstack | 04:58 | |
| *** benbenhappy has quit IRC | 04:59 | |
| *** littleidea has quit IRC | 05:00 | |
| *** mahadev has joined #openstack | 05:01 | |
| *** mahadev has quit IRC | 05:06 | |
| *** ramkrsna has joined #openstack | 05:11 | |
| *** ramkrsna has joined #openstack | 05:11 | |
| *** benbenhappy has joined #openstack | 05:18 | |
| *** Ryan_Lane has joined #openstack | 05:43 | |
| *** littleidea has joined #openstack | 05:43 | |
| *** pharkmillups has joined #openstack | 05:45 | |
| *** jfluhmann has joined #openstack | 05:53 | |
| *** vernhart has joined #openstack | 05:55 | |
| *** rchavik has joined #openstack | 06:02 | |
| *** littleidea has quit IRC | 06:08 | |
| *** littleidea has joined #openstack | 06:12 | |
| *** daveiw has quit IRC | 06:18 | |
| *** benbenhappy has left #openstack | 06:19 | |
| *** adiantum has quit IRC | 06:30 | |
| zykes- | soren: do you know if there's a newer libvirt package in ubuntu ? | 06:33 |
| *** adiantum has joined #openstack | 06:36 | |
| *** benbenhappy has joined #openstack | 06:40 | |
| *** nerens has joined #openstack | 06:44 | |
| *** adiantum has quit IRC | 06:46 | |
| ttx | zykes-: if you define "newer", I should be able to answer that | 06:47 |
| *** pharkmillups has quit IRC | 06:48 | |
| zykes- | ttx: 0.8.6+ | 06:51 |
| *** allsystemsarego has joined #openstack | 06:52 | |
| *** adiantum has joined #openstack | 06:53 | |
| *** lionel has quit IRC | 06:54 | |
| *** lionel has joined #openstack | 06:55 | |
| ttx | zykes-: Natty has 0.8.8 | 06:56 |
| zykes- | ttx: that's a bit "too" new | 06:57 |
| zykes- | don't want to have to upgrade from lts | 06:58 |
| ttx | zykes-: our openstack PPA has a backported 0.8.8 for LTS | 06:58 |
| ttx | https://launchpad.net/~nova-core/+archive/trunk?field.series_filter=lucid | 06:59 |
| zykes- | oh | 06:59 |
| zykes- | nice! | 06:59 |
| *** adiantum has quit IRC | 06:59 | |
| ttx | zykes-: our PPA basically has everything required to run nova on 10.04 LTS, including the necessary library upgrades | 07:01 |
| ttx | and we are striving to make sure Natty can run Nova without any PPA addition. | 07:01 |
| *** adiantum has joined #openstack | 07:03 | |
| *** rcc has joined #openstack | 07:03 | |
| *** flopflip_ has joined #openstack | 07:04 | |
| *** flopflip has quit IRC | 07:07 | |
| zykes- | ah | 07:08 |
| zykes- | natty is 11.04 ? | 07:08 |
| ttx | will be, yes. | 07:09 |
| zykes- | would it be hard to rebuild a package of virt-manager as well ? | 07:10 |
| ttx | zykes-: maybe... depends on the number of deps to also upgrade. | 07:11 |
| *** benbenhappy has left #openstack | 07:30 | |
| soren | zykes-: Newer than what? | 07:31 |
| HugoKuo | https://answers.launchpad.net/nova-deployment-tool/+question/151261 :\ bzr930 any clue? | 07:33 |
| soren | I'm not sure anyone should be using that deployment tool. | 07:35 |
| soren | it doesn't seem to have been touched in months. | 07:35 |
| zykes- | soren: 0.8.8 | 07:36 |
| zykes- | was ok : ) | 07:36 |
| zykes- | soren: would it be possible to bp virt-manager ? | 07:36 |
| soren | zykes-: Why? | 07:36 |
| zykes- | 0.8.6 has more options for newer libvirt then 0.8.4 | 07:36 |
| soren | Nova's PPA is not a general purpose backport repository for virtualisation stuff. | 07:37 |
| zykes- | i know | 07:37 |
| soren | ok... | 07:37 |
| soren | You shoulnd't be using virt-manager to deal with Nova's virtual machines. | 07:37 |
| zykes- | i'm not, it was more of a general question | 07:37 |
| soren | Err.. | 07:38 |
| soren | Well, of course it's possible to backport virt-manager. | 07:38 |
| soren | You can backport anything. | 07:38 |
| soren | *anything* | 07:38 |
| zykes- | ;) | 07:38 |
| *** onlany has joined #openstack | 07:39 | |
| HugoKuo | alright :< | 07:48 |
| HugoKuo | forget about deployment tool :\ | 07:48 |
| *** Ryan_Lane has quit IRC | 07:56 | |
| *** omidhdl has joined #openstack | 07:57 | |
| *** adiantum has quit IRC | 07:59 | |
| *** daveiw has joined #openstack | 08:01 | |
| *** aixenv has quit IRC | 08:02 | |
| *** aixenv has joined #openstack | 08:03 | |
| *** adiantum has joined #openstack | 08:04 | |
| *** bkkrw has joined #openstack | 08:05 | |
| *** Nacx has joined #openstack | 08:09 | |
| *** irahgel has joined #openstack | 08:17 | |
| *** jeffjapan has quit IRC | 08:31 | |
| *** lionel has quit IRC | 08:41 | |
| *** reldan has joined #openstack | 08:42 | |
| *** littleidea has quit IRC | 08:45 | |
| HugoKuo | Manually install nova and test to upload image again | 08:46 |
| HugoKuo | still failed | 08:46 |
| *** VoVo64 has joined #openstack | 08:48 | |
| *** adiantum has quit IRC | 08:49 | |
| *** adiantum has joined #openstack | 08:53 | |
| *** littleidea has joined #openstack | 08:54 | |
| onlany | HugoKuo, what is ur error message? | 08:59 |
| HugoKuo | Traceback (most recent call last): | 09:01 |
| HugoKuo | File "/usr/bin/euca-upload-bundle", line 39, in <module> | 09:01 |
| HugoKuo | from boto.s3 import Connection | 09:01 |
| HugoKuo | ImportError: cannot import name Connection | 09:01 |
| HugoKuo | https://answers.launchpad.net/nova/+question/151261 | 09:01 |
| *** MarcMorata has joined #openstack | 09:03 | |
| onlany | HugoKuo: https://bugs.launchpad.net/nova/+bug/623888 | 09:05 |
| uvirtbot | Launchpad bug 623888 in nova "euca-upload-bundle -b mybucket -m /tmp/vmlinuz-2.6.32-23-server.manifest.xml" [Undecided,Invalid] | 09:05 |
| *** omidhdl has quit IRC | 09:07 | |
| HugoKuo | but in boto1.9b is already installed | 09:08 |
| HugoKuo | while I try to use Bexar would not have this problem.....it happens while I use trunk:bzr930 | 09:09 |
| onlany | tried uplaoad manually? | 09:09 |
| onlany | http://wiki.openstack.org/RunningNova/ManualImageRegistration | 09:09 |
| *** adjohn has quit IRC | 09:17 | |
| *** ramkrsna has quit IRC | 09:24 | |
| *** Zangetsue has quit IRC | 09:27 | |
| HugoKuo | okok | 09:32 |
| *** Zangetsue has joined #openstack | 09:32 | |
| HugoKuo | I'm restore all my host now , make it clear | 09:32 |
| *** littleidea has quit IRC | 09:32 | |
| *** adiantum has quit IRC | 09:33 | |
| *** adiantum has joined #openstack | 09:39 | |
| *** rds__ has joined #openstack | 09:40 | |
| HugoKuo | whatever , I guess it'll failed even upload manually | 09:40 |
| HugoKuo | let me try it | 09:40 |
| *** miclorb_ has quit IRC | 09:42 | |
| *** adiantum has quit IRC | 09:47 | |
| *** zigo-_- has joined #openstack | 09:51 | |
| *** MarcMorata has quit IRC | 09:51 | |
| *** Nacx has quit IRC | 09:51 | |
| *** MarcMorata has joined #openstack | 09:53 | |
| *** Nacx has joined #openstack | 09:54 | |
| *** adiantum has joined #openstack | 09:54 | |
| *** miclorb_ has joined #openstack | 09:59 | |
| *** ibarrera has joined #openstack | 10:02 | |
| *** miclorb_ has quit IRC | 10:03 | |
| *** reldan has quit IRC | 10:17 | |
| *** miclorb has joined #openstack | 10:19 | |
| *** naehring has joined #openstack | 10:26 | |
| *** adiantum has quit IRC | 10:27 | |
| naehring | Hi there! I've got a question regarding the flag "injected_network_template" in libvirt_conn.py. How do I define another destination file in the image? Is there an existing flag? | 10:29 |
| *** adiantum has joined #openstack | 10:31 | |
| *** omidhdl has joined #openstack | 10:34 | |
| *** fabiand_ has joined #openstack | 10:39 | |
| *** omidhdl has quit IRC | 10:43 | |
| *** ramkrsna has joined #openstack | 10:43 | |
| *** miclorb has quit IRC | 10:45 | |
| *** adiantum has quit IRC | 10:46 | |
| naehring | ls | 10:50 |
| *** adiantum has joined #openstack | 10:52 | |
| zigo-_- | no such file or directory | 10:52 |
| zigo-_- | :) | 10:52 |
| zigo-_- | Is someone available to help me writing short man pages descriptions for swift binaries? | 10:54 |
| zigo-_- | Please, do not reply all at the same time, stop flooding ... | 10:55 |
| *** reldan has joined #openstack | 10:56 | |
| *** adiantum has quit IRC | 10:59 | |
| *** lwollney has quit IRC | 11:04 | |
| *** adiantum has joined #openstack | 11:05 | |
| *** ramkrsna has quit IRC | 11:08 | |
| *** rcc has quit IRC | 11:11 | |
| *** adiantum has quit IRC | 11:27 | |
| *** ctennis has quit IRC | 11:34 | |
| *** RobertLaptop has quit IRC | 11:42 | |
| soren | naehring: I'd strongly advice to ignore it. Use dhcp to configure networking. | 11:45 |
| naehring | soren: this is not possible for the case. I would like to use dhcp, but in this evalution the need the injection. I've enhanced it to support the destination os for me now. I know, that dhcp is really the better solution :( | 11:48 |
| *** ctennis has joined #openstack | 11:52 | |
| *** ctennis has joined #openstack | 11:52 | |
| *** rcc has joined #openstack | 11:55 | |
| alekibango | zigo-_-: i can help editing a bit. but i do not know that much about swift. | 11:55 |
| *** openstackjenkins has quit IRC | 11:55 | |
| *** openstackjenkins has joined #openstack | 11:56 | |
| alekibango | but as i would love to learn more, this might be good intro :) | 11:56 |
| *** irahgel has quit IRC | 11:58 | |
| *** metoikos has joined #openstack | 11:58 | |
| *** irahgel has joined #openstack | 11:59 | |
| jaypipes | *yawn* | 12:00 |
| *** adjohn has joined #openstack | 12:00 | |
| *** garet_ has joined #openstack | 12:01 | |
| *** adjohn has quit IRC | 12:02 | |
| niksnut | anybody know if it's possible to access nova-api via IPv6? it only seems to listen for IPv4 TCP connections here | 12:07 |
| *** czajkowski has quit IRC | 12:08 | |
| *** czajkowski has joined #openstack | 12:08 | |
| *** drico has quit IRC | 12:09 | |
| *** bcwaldon has joined #openstack | 12:10 | |
| *** deshantm_laptop has joined #openstack | 12:14 | |
| *** f4m8 is now known as f4m8_ | 12:15 | |
| garet_ | hello, i am discovering openstack and I am wondering if it is suitable to my needs | 12:17 |
| garet_ | I have hypervisors with vpshere et citrix xenserver (and soon kvm boxes) | 12:17 |
| zigo-_- | garet_: What do you wana know/do? | 12:19 |
| garet_ | and I want to be able to easily deploy virtual machines to theses machines based on what they do (means if I have an oracle db server, I want it on VMWare), if a user wants a production vm, put it on xenserver and if I want development machines, I want it on kvm | 12:19 |
| garet_ | will openstack be able to help me administer that seamlessly ? | 12:19 |
| *** zul has quit IRC | 12:20 | |
| *** zul has joined #openstack | 12:20 | |
| zigo-_- | I don't think openstack does VMWare just yet. | 12:20 |
| zigo-_- | It wont really be helpfull to have things automated for new customers. | 12:20 |
| garet_ | zigo : i've read it's in cactus roadmap | 12:20 |
| zigo-_- | Maybe, I'm not familliar enough with it yet ... :) | 12:21 |
| soren | OpenStack has support for VMWare vSphere. | 12:23 |
| garet_ | in fact I don't find anywhere a clear definition of what is a compute node | 12:23 |
| garet_ | does that stand for an hypervisor ? | 12:23 |
| soren | Compute nodes are the nodes that actually run virtual machines. | 12:24 |
| zigo-_- | soren: Hi there! Did you get my email? | 12:25 |
| alekibango | zigo-_-: btw... getting public version of your code: bzr branch lp:~thomas-goirand/nova/debian | 12:25 |
| *** bcwaldon has quit IRC | 12:26 | |
| zigo-_- | alekibango: Hello! :) | 12:26 |
| zigo-_- | I'm working on swift now. | 12:26 |
| zigo-_- | Doing stub man pages. | 12:26 |
| alekibango | do you have some repo with it? | 12:26 |
| zigo-_- | alekibango: Do you know enough to give me short descriptions of each binaries? | 12:26 |
| alekibango | i would try helping | 12:26 |
| zigo-_- | Cool! | 12:26 |
| alekibango | not yet... but i will try | 12:26 |
| zigo-_- | Not yet. | 12:26 |
| zigo-_- | Let me finish what I'm doing right now... | 12:27 |
| alekibango | k | 12:27 |
| garet_ | and can one define "per usage" distribution of virtual machines to classes of compute nodes (i.e. vmware boxes, kvm boxes) ? | 12:27 |
| zigo-_- | What's the bzr command to do a mv of a file? I tried and it complained ... | 12:27 |
| alekibango | i will need to go downtown for hour or 2... so when i will be back, i will msg you | 12:27 |
| zigo-_- | bzr mv swift/swift-init.8 python-swift/ | 12:27 |
| zigo-_- | bzr: ERROR: Could not move to python-swift: debian/mans/python-swift is not versioned. | 12:27 |
| soren | zigo-_-: Um... When? | 12:28 |
| zigo-_- | What's that? | 12:28 |
| zigo-_- | How to fix? | 12:28 |
| alekibango | zigo-_-: add mans first? | 12:28 |
| soren | zigo-_-: No, the e-mail. | 12:28 |
| zigo-_- | soren: yesterday. | 12:28 |
| alekibango | not sure... i am not using bzr much :) | 12:28 |
| zigo-_- | soren: Basically, I was saying that my debian init scripts were ready! | 12:28 |
| soren | zigo-_-: I still don't see it. | 12:29 |
| soren | What was the subject? | 12:29 |
| zigo-_- | "My latest push" | 12:29 |
| soren | zigo-_-: HEh.. Gmail thinks it was spam. | 12:30 |
| zigo-_- | Google is 3v1l (tm), don't use their service. | 12:30 |
| zigo-_- | :) | 12:30 |
| *** shentonfreude has joined #openstack | 12:30 | |
| deepy | With a subject like that, I'd say you deserved it :P | 12:31 |
| zigo-_- | I got stuck 30 seconds thinking about a subject... | 12:31 |
| zigo-_- | :) | 12:31 |
| sandywalsh | amazon open sourcing EC2 fully: http://tinyurl.com/3s6zlb5 | 12:31 |
| alekibango | 3v1 ?? | 12:31 |
| alekibango | ah... evil :) | 12:31 |
| alekibango | yes they are having fun being efil | 12:32 |
| deepy | Nice one sandywalsh | 12:32 |
| alekibango | sandywalsh: wow | 12:32 |
| rcc | wtf | 12:32 |
| alekibango | thats great news... | 12:32 |
| rcc | that's awesome | 12:32 |
| alekibango | :) | 12:32 |
| *** CloudChris has joined #openstack | 12:33 | |
| rcc | :D | 12:33 |
| deepy | nova.sh completly failed form e | 12:34 |
| deepy | http://paste.openstack.org/show/1050/ - that's my log | 12:34 |
| *** naehring has quit IRC | 12:42 | |
| *** icarus901 has quit IRC | 12:44 | |
| zigo-_- | That's an april fool. | 12:45 |
| zigo-_- | I wont ever believe any news I see today. | 12:45 |
| zigo-_- | Oh, I knew without watching the URL content! :) | 12:45 |
| alekibango | :) | 12:50 |
| zigo-_- | Did you see www.debian.org, www.gentoo.org and so on? :) | 12:50 |
| alekibango | wow | 12:51 |
| zigo-_- | Another 04-fool ... | 12:52 |
| *** dprince has joined #openstack | 12:52 | |
| alekibango | i do not like this one | 12:52 |
| zigo-_- | I don't either. Because it's quite truth that we are uselessly spreading efforts. | 12:53 |
| alekibango | its not debian who is spreading efforts imho :) | 12:53 |
| zigo-_- | :) | 12:53 |
| zigo-_- | alekibango: Can you explain shortly what's the principles of Swift? | 12:55 |
| zigo-_- | Why does it has so many services? | 12:55 |
| alekibango | it stores users, containers, blobs... | 12:56 |
| zigo-_- | Because it's one per functionality, and orders come from the message queue??? | 12:56 |
| *** bcwaldon has joined #openstack | 12:56 | |
| alekibango | zigo-_-: you should wait hour or 2 for americans.. they will help | 12:57 |
| *** rchavik has quit IRC | 12:57 | |
| uvirtbot | New bug: #746731 in nova "xenstore.py xapi plugin uses potentially insecure shell=True" [Medium,Confirmed] https://launchpad.net/bugs/746731 | 12:57 |
| zigo-_- | Ok. | 12:58 |
| alekibango | lol i see my image in swift manual :) | 12:58 |
| alekibango | i thought it will be used for nova... | 12:58 |
| alekibango | zigo-_-: so maybe i know about swift more than i know... :) | 12:58 |
| *** ppetraki has joined #openstack | 13:03 | |
| *** iammartian has quit IRC | 13:06 | |
| *** mastermind has quit IRC | 13:06 | |
| *** hadrian has joined #openstack | 13:08 | |
| *** adiantum has joined #openstack | 13:13 | |
| *** deshantm_laptop has quit IRC | 13:15 | |
| alekibango | zigo-_-: why i do not like debian.org joke: it sounds like sort of collectivism for me... -- Try imagine people in EU, Russia and China uniting against common enemy - USA... Or people united in one state controlled church over whole earth.... | 13:17 |
| alekibango | i rather sacrifice unity than truth and freedom. | 13:17 |
| pvo | this topic is too deep for an early friday morning. :) | 13:18 |
| alekibango | sorry pvo :) | 13:18 |
| *** Zangetsue has quit IRC | 13:18 | |
| alekibango | i heard this argument about unity abused horrible ways many times already | 13:20 |
| *** omidhdl has joined #openstack | 13:21 | |
| *** zenmatt has joined #openstack | 13:21 | |
| *** johnpur has joined #openstack | 13:23 | |
| *** ChanServ sets mode: +v johnpur | 13:23 | |
| *** hggdh has quit IRC | 13:23 | |
| zigo-_- | pvo: Hi! | 13:23 |
| *** hggdh has joined #openstack | 13:24 | |
| *** jfluhmann_ has joined #openstack | 13:24 | |
| *** sparkycollier has joined #openstack | 13:24 | |
| *** littleidea has joined #openstack | 13:26 | |
| pvo | hey zigo-_- | 13:26 |
| *** omidhdl has quit IRC | 13:26 | |
| *** pvo is now known as pvo_away | 13:31 | |
| *** dmshelton has joined #openstack | 13:33 | |
| *** deshantm_laptop has joined #openstack | 13:34 | |
| *** omidhdl has joined #openstack | 13:34 | |
| annegentle | alekibango: really? Which swift manual, which image? I created one using the same clipart as yours. :) | 13:36 |
| *** deshantm_laptop has quit IRC | 13:37 | |
| alekibango | annegentle: maybe you are right, but they look sooo similar :) | 13:38 |
| alekibango | i am glad you liked those images | 13:39 |
| alekibango | annegentle: who could be best to ask for help with man pages of swift binaries? | 13:40 |
| zigo-_- | soren: Is it ok if I add stuffs so that swift-proxy package generates keys by itself in /etc/swift? | 13:40 |
| alekibango | you know. debian has really strong policies, all binaries should have manual pages | 13:40 |
| zigo-_- | I also believe that small descriptions wont hurt! | 13:41 |
| zigo-_- | I already did swift-init ... | 13:41 |
| zigo-_- | And also rewrote the init scripts of swift. | 13:42 |
| zigo-_- | What was before was a good intention, but it's not policy compliant. | 13:42 |
| zigo-_- | Init scripts really should be editable by the admin, and have start, stop, etc. | 13:42 |
| zigo-_- | They are conf files, so they will stay if the package is removed, and as a consequence should check if the binary that they call is present on the hdd. | 13:43 |
| zigo-_- | Maybe what I did could be simplified though... | 13:43 |
| zigo-_- | But lintian will whine... | 13:44 |
| annegentle | alekibango: ummm... someone was working on them but I'm not sure who, I'll ask around. | 13:45 |
| alekibango | thanks... | 13:45 |
| zigo-_- | cheers | 13:46 |
| alekibango | zigo-_-: i now go out, when i will be back (~2hours), i will help editing... prepare repository... | 13:48 |
| zigo-_- | Ok ! | 13:48 |
| zigo-_- | I've just pushed ... | 13:48 |
| zigo-_- | bzr+ssh://bazaar.launchpad.net/~thomas-goirand/swift/debian/ | 13:48 |
| *** mray has joined #openstack | 13:48 | |
| *** reldan has quit IRC | 13:49 | |
| alekibango | heh... its bzr branch lp:~thomas-goirand/swift/debian | 13:50 |
| *** littleidea has quit IRC | 13:55 | |
| *** littleidea has joined #openstack | 14:01 | |
| *** omidhdl has quit IRC | 14:02 | |
| *** Zangetsue has joined #openstack | 14:03 | |
| *** littleidea has quit IRC | 14:06 | |
| *** irahgel has quit IRC | 14:08 | |
| *** RobertLaptop has joined #openstack | 14:09 | |
| zigo-_- | Yiaaaaaaaaaaa! swift is not lintian clean! :) | 14:10 |
| *** irahgel has joined #openstack | 14:11 | |
| *** gondoi has joined #openstack | 14:17 | |
| zigo-_- | s/not/now/ | 14:18 |
| *** imsplitbit has joined #openstack | 14:20 | |
| redbo | hrm.. I think you'll probably be sad to find how out of date that swift debian directory was before you forked. | 14:23 |
| *** RobertLaptop_ has joined #openstack | 14:25 | |
| *** reldan has joined #openstack | 14:25 | |
| *** RobertLaptop has quit IRC | 14:26 | |
| *** mirrorbox has joined #openstack | 14:26 | |
| *** RobertLaptop_ has quit IRC | 14:27 | |
| *** RobertLaptop has joined #openstack | 14:27 | |
| *** dspano has joined #openstack | 14:28 | |
| *** fabiand_ has left #openstack | 14:29 | |
| *** adiantum has quit IRC | 14:31 | |
| *** fabiand_ has joined #openstack | 14:34 | |
| BK_man | ping ping. Could anybody run tools/euca-get-ajax-console <instanceID> ? | 14:35 |
| * BK_man merged euca2ools with Ubuntu package and still gets EC2Connection instance has no attribute 'get_ajax_console' error on euca2ools 1.3.1 | 14:36 | |
| *** fabiand_ has quit IRC | 14:37 | |
| *** gondoi has quit IRC | 14:37 | |
| *** adiantum has joined #openstack | 14:46 | |
| *** onlany has quit IRC | 14:48 | |
| *** littleidea has joined #openstack | 14:50 | |
| redbo | mtaylor,soren: can someone sync the swift branches in openstack-ubuntu-packagers and/or whatever the buildd thing uses with what's in lp:swift/debian ? | 14:54 |
| *** dendro-afk is now known as dendrobates | 14:54 | |
| uvirtbot | New bug: #747394 in nova "XenServer port needs to clear out vm-data/networking before issuing resetnetwork command" [Undecided,New] https://launchpad.net/bugs/747394 | 14:57 |
| soren | redbo: Will do. | 14:58 |
| *** m_3 has quit IRC | 14:58 | |
| redbo | thanks | 14:59 |
| soren | BK_man: I just proposed a fix for that. | 15:00 |
| soren | BK_man: Well, "just" as in a couple of hours ago. | 15:00 |
| *** littleidea has quit IRC | 15:00 | |
| soren | redbo: Er... | 15:01 |
| BK_man | soren: what is bug#? or branch id? | 15:01 |
| soren | BK_man: lp:~soren/nova/support-newer-euca2ools | 15:01 |
| soren | BK_man: Forgot to file a bug :( | 15:02 |
| *** jbryce has quit IRC | 15:02 | |
| *** mray1 has joined #openstack | 15:02 | |
| soren | redbo: I can't really merge them easily. They have no common ancestry. | 15:03 |
| soren | redbo: I wonder why you're still maintaining it? | 15:03 |
| *** mray1 has quit IRC | 15:04 | |
| *** mray2 has joined #openstack | 15:04 | |
| *** mray has quit IRC | 15:05 | |
| redbo | soren: I don't know how it's supposed to work. We've just been making changes in there as we need them. | 15:06 |
| soren | redbo: But where are they used? | 15:06 |
| *** kbringard has joined #openstack | 15:06 | |
| soren | redbo: Aren't you using the packages we build? | 15:06 |
| *** Nacx has quit IRC | 15:06 | |
| *** m_3 has joined #openstack | 15:07 | |
| redbo | soren: Not for anything I know of. We don't really want to use the PPAs in production, and we use source install for dev? | 15:07 |
| gholt | Many of us have no idea how the packaging is supposed to work to be honest. Last we heard we were supposed to patch swift/debian | 15:08 |
| *** mray2 has quit IRC | 15:08 | |
| soren | How do you know that your changes to swift/debian work if you don't use them? | 15:08 |
| * soren is rather confused | 15:08 | |
| gholt | We don't really, other than a quick test | 15:08 |
| BK_man | soren: applied your patch - still don't working: http://paste.openstack.org/show/1054/ | 15:08 |
| redbo | we do use those to build packages | 15:09 |
| soren | BK_man: Err, my bad. | 15:09 |
| redbo | soren: that's what we use to build our production packages currently | 15:09 |
| *** m_3 has quit IRC | 15:11 | |
| soren | Awesome. So Rackspace uses differently built packages on a different operating system. | 15:11 |
| redbo | that's why I was trying to get you to sync the other stuff up with ours :) | 15:11 |
| soren | *nod* | 15:11 |
| soren | You know that Jenkins stores the source packages so that you can build them yourself whereever you want, right? | 15:12 |
| soren | The ones that get uploaded to the PPA? | 15:12 |
| kbringard | I have a question about the glance update command | 15:13 |
| kbringard | if anyone has a moment to listen to me ramble | 15:13 |
| gholt | soren: Is there a reason we'd want to do that instead of just pulling down swift/debian and building? | 15:13 |
| redbo | soren: No, I don't really know anything about Jenkins. But like I said, we can't really use a PPA to deploy. I guess we could make a "what we have deployed" PPA. | 15:14 |
| soren | gholt: The result should be the same, except one is completely automatic, the other is manual (i.e. error prone). | 15:14 |
| soren | gholt: And, everyone would be testing the same stuff. | 15:15 |
| BK_man | soren: Jenkins should do basic testing from my point of view | 15:15 |
| soren | gholt: WEll, that and swift/debian isn't what is used to build the ppa packages. | 15:15 |
| gholt | Didn't it used to be? | 15:15 |
| BK_man | soren | 15:15 |
| soren | gholt: This was months ago. | 15:15 |
| gholt | I can keep track, and I work on the project. :P | 15:16 |
| gholt | s/can/can't/ | 15:16 |
| BK_man | soren: that's a thing what we currently going to implement for our RHEL build | 15:16 |
| *** dragondm has joined #openstack | 15:16 | |
| gholt | Which is a lot of the reason why we don't rely on those packages. | 15:16 |
| gholt | I'm fine with others packaging the code, btw. We just need to help them maintain it. | 15:17 |
| soren | BK_man: I don't understand what you're saying. | 15:19 |
| BK_man | soren: nova trunk -> build packages (Ubuntu, RHEL, Debian, ...) -> test -> upload | 15:19 |
| soren | What is "test" here? | 15:19 |
| BK_man | soren: upload only occurs when tests are completed. | 15:20 |
| soren | BK_man: What tests? | 15:20 |
| BK_man | soren: we are working on that. Integration. Bring up env, start daemons, create project, upload image, run instance, etc | 15:20 |
| soren | Ok. | 15:21 |
| BK_man | soren: we'll be doing this for RHEL port. | 15:21 |
| BK_man | soren: could you please fix your euca-get-ajax-term branch? | 15:21 |
| soren | I did. | 15:22 |
| soren | 13 minutes ago. | 15:22 |
| BK_man | soren: got it. sorry for disturbing you | 15:23 |
| soren | np | 15:23 |
| *** RobertLaptop has quit IRC | 15:23 | |
| BK_man | soren: is it working for you? | 15:23 |
| BK_man | UnknownError: An unknown error has occurred. Please try your request again. | 15:23 |
| * BK_man going to debug this. No such file or directory :-( | 15:24 | |
| soren | BK_man: Let me test it again. | 15:25 |
| BK_man | soren: something broken in my packaging (I actually trying to get this working on RHEL first time) | 15:26 |
| soren | BK_man: It works for me. | 15:26 |
| *** dendrobates is now known as dendro-afk | 15:29 | |
| *** m_3 has joined #openstack | 15:35 | |
| *** bkkrw has quit IRC | 15:35 | |
| *** RobertLaptop has joined #openstack | 15:35 | |
| *** daveiw has left #openstack | 15:35 | |
| soren | redbo: Alright, they're reasonably up-to-date now. | 15:36 |
| soren | redbo: There are a few differences that I'm not sure how to reconcile. | 15:36 |
| soren | redbo: I'd like to decomission lp:swift/debian ASAP. I had no idea it was used anymore. | 15:37 |
| soren | redbo: We should all be testing the same stuff. | 15:37 |
| gholt | How are we supposed to make packaging work now? Like if I add or remove a new bin? | 15:37 |
| soren | Same thing, really, except instead of changing stuff in lp:swift/debian, you change it in the "real" packaging branch. | 15:38 |
| gholt | Which is...... | 15:38 |
| soren | lp:~openstack-ubuntu-packagers/ubuntu/natty/swift/ubuntu/ | 15:38 |
| soren | I do believe you have write access to that. | 15:39 |
| soren | Let me check. | 15:39 |
| RickB17 | I'm attempting to use CloudFuse to mount a container in a Ubuntu 10.04.1 server. I am receiving an "Unable to Authenticate" error. Are there any utilities to use to verify my swift storage cloud is properly accepting request? It works fine on a windows box running CyberDuck. | 15:39 |
| *** gondoi has joined #openstack | 15:39 | |
| RickB17 | the above error is returned from the "cloudfuse" mount command | 15:39 |
| btorch | RickB17: can u authenticate on that ubuntu server using curl ? | 15:39 |
| soren | gholt: You didn't, but you do now. | 15:40 |
| gholt | soren: But natty isn't even released yet. | 15:40 |
| soren | gholt: So... | 15:40 |
| RickB17 | i believe so. I receive a "HTTP/1.1 204 No Content" back | 15:40 |
| soren | gholt: That's exactly why we're developing against it? | 15:40 |
| *** hazmat has quit IRC | 15:41 | |
| redbo | We can probably build lucid packages from it. | 15:41 |
| gholt | I think you have a different goal that we do maybe. | 15:41 |
| btorch | RickB17: u getting the headers back ? -i | 15:41 |
| soren | redbo: Err... Yes. Jenkins does that for you already! | 15:42 |
| *** garet_ has quit IRC | 15:42 | |
| soren | redbo: For every single commit to your trunk, Jenkins takes trunk, applies packaging for each of Lucid, Maverick and Natty, uploads source packages for each of them to a PPA, and builds binary packages. | 15:43 |
| redbo | I don't know anything about jenkins :) Maybe I'll learn, but right now building packages isn't that much of a headache. | 15:43 |
| RickB17 | I see X-Storage-Token being returned along with a "X-Auth-Token:" | 15:43 |
| RickB17 | sorry for my ignorance, i'm relatively new to swift. | 15:43 |
| ttx | redbo: it's *magic* | 15:43 |
| soren | redbo: It's not about whether it's a head ache. It's a chore. It can be automated. As such, it should. | 15:43 |
| gholt | soren: There's a swift-debian in jenkins that you'll probably want to kill too if you kill swift/debian | 15:44 |
| btorch | RickB17: no worries, cool .. let me test it on my saio | 15:44 |
| *** dendro-afk is now known as dendrobates | 15:44 | |
| soren | gholt: I will. | 15:44 |
| * soren makes a note | 15:44 | |
| RickB17 | btorch: i have three nodes, one auth, one proxy, one storage. the storage node has 3 zones (each a different drive) | 15:45 |
| *** craniumslows has joined #openstack | 15:45 | |
| * soren cooks dinner | 15:45 | |
| * BK_man discovered problem s/netcat/nc/ | 15:45 | |
| redbo | I guess I could pull .debs from the continuous PPA, but sometimes we need things that there's no PPA for. | 15:45 |
| craniumslows | Open stack dudes are about to talk here at the pre txlf dealio | 15:45 |
| *** reldan has quit IRC | 15:46 | |
| redbo | It's considerably easier just to cut our own packages, I think. | 15:46 |
| deepy | http://paste.openstack.org/show/1050/ - anyone know how I can repair that? | 15:47 |
| redbo | ttx: it's not magic enough :) | 15:48 |
| kbringard | deepy: did you run nova-manage db sync? | 15:48 |
| kbringard | it looks like your db isn't getting created or you don't have write access to it | 15:50 |
| gholt | redbo: Where does it even put these packages? I clicked a crapload but haven't found anything but some tarballs here and there. | 15:50 |
| *** craniumslows has quit IRC | 15:50 | |
| *** mahadev has joined #openstack | 15:50 | |
| *** craniumslows has joined #openstack | 15:50 | |
| redbo | gholt: iunno. | 15:51 |
| gholt | redbo: Lol. I wish things that weren't really broken would quit getting fixed. | 15:53 |
| gholt | I'm sure I'm missing the big picture though, just speaking for myself. | 15:54 |
| *** mahadev has quit IRC | 15:55 | |
| *** hazmat has joined #openstack | 15:56 | |
| *** rcc has quit IRC | 15:57 | |
| gholt | soren: I'm still trying to figure out what's what. There's an lp:ubuntu/swift that it looks like you just updated, but I don't have access to commit to. And there's :~openstack-ubuntu-packagers/ubuntu/natty/swift/ubuntu which I do have access to, but doesn't have the update you just did. | 15:59 |
| *** Daviey has quit IRC | 15:59 | |
| *** maplebed has joined #openstack | 16:01 | |
| redbo | gholt: it's just a priority mismatch. | 16:03 |
| deepy | kbringard: yes, http://paste.openstack.org/show/1055/ | 16:06 |
| deepy | stupid breadcrumbs, rolling in under the enter key and making me unable to type | 16:06 |
| craniumslows | How hard is it to dig into django? I gotten change that front end up | 16:07 |
| *** Daviey has joined #openstack | 16:08 | |
| *** pharkmillups has joined #openstack | 16:08 | |
| btorch | RickB17: sorry got pulled into a conversation ... installing it now and testing it soon | 16:11 |
| *** arun_ has joined #openstack | 16:12 | |
| RickB17 | btorch: Thanks, np. Take your time. | 16:14 |
| btorch | RickB17: it worked for me | 16:15 |
| *** enigma1 has joined #openstack | 16:15 | |
| btorch | RickB17: http://paste.openstack.org/show/1056/ | 16:15 |
| RickB17 | btorch: thanks, let me check my syntax. | 16:16 |
| btorch | RickB17: don't remember but what error you were getting ? what version of swift ? | 16:16 |
| RickB17 | "Unable to Authenticate" is my error | 16:16 |
| btorch | RickB17: I'm using swift 1.2.0 and maverick | 16:16 |
| *** bcwaldon has quit IRC | 16:17 | |
| btorch | RickB17: you provided a good authurl ? | 16:17 |
| RickB17 | btorch: Confirming that now. | 16:18 |
| RickB17 | btorch: authurl=https://proxyaddress:8080/auth/v1.0 same results | 16:19 |
| RickB17 | btorch: tried it with dns name at first, changed to IP address, same results. | 16:20 |
| RickB17 | btorch: I followed http://swift.openstack.org/howto_installmultinode.html for setting it up. | 16:21 |
| btorch | RickB17: are you using devauth ? | 16:21 |
| RickB17 | btorch: I'm not entirely sure. That may be the issue. | 16:22 |
| *** MarcMorata has quit IRC | 16:25 | |
| *** MarcMorata has joined #openstack | 16:26 | |
| *** byeager has joined #openstack | 16:26 | |
| kbringard | deepy: that's odd, I'm not really sure :-/ | 16:27 |
| kbringard | are you running the latest code? | 16:28 |
| RickB17 | btorch: I believe I am using devauth since in my proxy-server.conf i have auth and now swauth in the pipeline. | 16:28 |
| RickB17 | *now = not | 16:28 |
| btorch | RickB17: you said you have an auth box right ? you should be pointing your authurl to the auth box address and not the proxyaddress as you mentioned above | 16:29 |
| btorch | RickB17: can you paste you auth config files on paste.openstack.org for me | 16:29 |
| RickB17 | btorch: k, i'll retry that. Thats what I originally had, but i changed it when i seen your example. | 16:29 |
| RickB17 | btorch: sure thing | 16:29 |
| *** dprince has quit IRC | 16:30 | |
| deepy | kbringard: I used nova.sh | 16:30 |
| deepy | So I am hoping that I run a new version | 16:31 |
| kbringard | hmm, probably, I don't know much about the nova.sh script | 16:31 |
| kbringard | what OS? | 16:31 |
| deepy | Debian | 16:31 |
| btorch | RickB17: http://paste.openstack.org/show/1057/ | 16:32 |
| kbringard | which repos are you using? I've never tried running openstack on plain debian, but I know they tend to be pretty far behind in their versions (with security patches slipstreamed in) | 16:33 |
| deepy | Entirely possible | 16:34 |
| kbringard | I don't know how much leeway you have, but personally I've found that Ubuntu is the easiest to get openstack up and running on | 16:35 |
| deepy | I don't like Ubuntu at all and I avoid it | 16:35 |
| kbringard | if you just want to test it out and have a ubuntu machine, that's probably the best way to go | 16:35 |
| *** MarcMorata has quit IRC | 16:35 | |
| *** gondoi has quit IRC | 16:36 | |
| kbringard | yea, we're a redhat shop here... but I bit the bullet and build a ubuntu machine because I was pulling all of my hair out | 16:36 |
| *** jtran has joined #openstack | 16:36 | |
| deepy | I don't like how the VMs are all 64bit | 16:36 |
| deepy | the pre-built ones | 16:36 |
| kbringard | you can get 32-bit ones... but they're ubuntu :-p | 16:36 |
| RickB17 | btorch: I added to your paste | 16:36 |
| deepy | both ones on the website were 64bit | 16:37 |
| kbringard | if your machine is just for breaking with openstack, I'd try enabling the experimental repos | 16:37 |
| kbringard | that way you'll be getting the more cutting edge packages in debian | 16:37 |
| jtran | how do i go about submitting a unit test ? Do I submit a bug as wishlist? | 16:37 |
| jarrod | what format does openstack take xen snapshots in? | 16:37 |
| *** kirshil has quit IRC | 16:37 | |
| deepy | Could you point to one of those 32bit Ubuntu VMs? | 16:38 |
| kbringard | http://uec-images.ubuntu.com/maverick/current/maverick-server-uec-i386.tar.gz | 16:38 |
| kbringard | http://uec-images.ubuntu.com/ | 16:39 |
| kbringard | if you go there, you can choose your release | 16:39 |
| deepy | That looks more Ubuntu than Nova | 16:39 |
| kbringard | then click current and scroll down | 16:39 |
| RickB17 | dtorch: http://paste.openstack.org/show/1059/ auth-server.conf output | 16:39 |
| kbringard | deepy: oh, perhaps I was confused, I thought you were looking for images to import into nova | 16:39 |
| kbringard | sorry | 16:39 |
| deepy | Ah, no heh | 16:39 |
| btorch | RickB17: you need to replace "X-Storage-Url" with your storage url provided by the auth headers | 16:40 |
| RickB17 | btorch: ok | 16:40 |
| *** jfluhmann_ has quit IRC | 16:40 | |
| deepy | I am looking for a image with Nova so I can begin testing and evaluating without feeling down by the installation | 16:41 |
| RickB17 | btorch: done and updated | 16:41 |
| btorch | RickB17: paste number ? | 16:41 |
| RickB17 | http://paste.openstack.org/show/1060/ | 16:42 |
| btorch | cool | 16:42 |
| jarrod | deepy which hypervisor are you using | 16:42 |
| deepy | virtualbox | 16:42 |
| jarrod | ah ok | 16:42 |
| deepy | and I'm on 32bit! | 16:43 |
| RickB17 | btorch: that was done on my auth box directly, not the box with cloudfuse. | 16:43 |
| *** mahadev has joined #openstack | 16:43 | |
| *** craniumslows has left #openstack | 16:44 | |
| kbringard | deepy: even if you hate ubuntu, if you install it in a VM, it's super easy to get the latest trunk running | 16:44 |
| kbringard | http://cloud.ubuntu.com/2010/12/bleeding-edge-openstack-nova-on-maverick-updated-x2/ | 16:44 |
| RickB17 | btorch: when i run it from the box with cloudfuse, i get the same results | 16:44 |
| jarrod | if you like redhat over ubuntu -- that sounds like a deep seeded issue | 16:45 |
| kbringard | takes like, < 5 minutes | 16:45 |
| deepy | To be honest I don't even like Linux at all, I very much prefer BSD, but I loathe Ubuntu enough to refuse to install it | 16:46 |
| *** irahgel has left #openstack | 16:46 | |
| btorch | RickB17: same curl results from the cloudfuse box ? | 16:46 |
| RickB17 | btorch: yes, want me to post them? | 16:47 |
| RickB17 | btorch: http://paste.openstack.org/show/1061/ | 16:48 |
| btorch | RickB17: I'm wondering y you are getting 204 and not 200 ... | 16:49 |
| btorch | RickB17: can u paste you proxy-server.conf as well | 16:49 |
| RickB17 | btorch: http://paste.openstack.org/show/1062/ | 16:50 |
| *** fysa has quit IRC | 16:53 | |
| *** lionel_ has joined #openstack | 16:53 | |
| *** joearnold has joined #openstack | 16:56 | |
| *** fysa has joined #openstack | 16:59 | |
| *** JulioBell has quit IRC | 17:00 | |
| *** JulioBell has joined #openstack | 17:01 | |
| btorch | RickB17: ok looks to me you are using devauth, run your cloudfuse command and show me the pastes for the command/output and also the new lines that show up in your auth logs and proxy logs | 17:02 |
| *** Ryan_Lane has joined #openstack | 17:04 | |
| RickB17 | btorch: http://paste.openstack.org/show/1063/ | 17:05 |
| btorch | RickB17: dude you are using http | 17:07 |
| RickB17 | btorch: one second yeah just noticed | 17:07 |
| RickB17 | btorch: mistype i had https before let me repaste | 17:07 |
| btorch | cool | 17:07 |
| RickB17 | btorch: same error, let me update the paste | 17:08 |
| btorch | RickB17: can u use IPs instead of hostnames too | 17:08 |
| RickB17 | btorch: will do | 17:08 |
| RickB17 | btorch: http://paste.openstack.org/show/1064/ | 17:09 |
| btorch | I'm changing my setup to use ssl as well .. since the only difference I see is that | 17:09 |
| btorch | RickB17: ok now I get the same issue as you | 17:10 |
| RickB17 | btorch: it doesn't appear to even put any entries in the logs anywhere | 17:11 |
| RickB17 | btorch: I really appreciate you taking the time to work on this with me. | 17:12 |
| btorch | RickB17: let me bring my devauth back and try http and https with it | 17:13 |
| *** bcwaldon has joined #openstack | 17:20 | |
| *** lionel_ has quit IRC | 17:26 | |
| *** lionel_ has joined #openstack | 17:27 | |
| *** RobertLaptop has quit IRC | 17:28 | |
| *** rlucio has joined #openstack | 17:30 | |
| *** omidhdl has joined #openstack | 17:30 | |
| btorch | RickB17: having some problems myself with cloudfuse while using devauth ... not sure why right now | 17:32 |
| RickB17 | btorch: okay. but it should work if i disable ssh? | 17:32 |
| RickB17 | btorch: if thats the case, i can get by with that for now since it's all internal | 17:33 |
| btorch | RickB17: right now I'm trying with everything proxy/auth on http since I assume if I have auth on https I will get that unable to authenticate | 17:33 |
| RickB17 | btorch: do you have a blog or anything? | 17:34 |
| btorch | RickB17: give that a try... you should just need auth to be on http... my previous setup I had auth on http (swauth) | 17:34 |
| btorch | RickB17: about this ? :) | 17:34 |
| RickB17 | btorch: about your experiences with swift or IT in general | 17:35 |
| btorch | RickB17: yeah zeroaccess.org but I'm not extremely active on it.. I try :( | 17:35 |
| *** adiantum has quit IRC | 17:36 | |
| RickB17 | btorch: I will add it to my feed :-D | 17:36 |
| *** RobertLaptop has joined #openstack | 17:41 | |
| RickB17 | redbo: are you the author of cloudfuse? (https://github.com/redbo/cloudfuse) | 17:42 |
| *** hazmat has quit IRC | 17:43 | |
| btorch | RickB17: no redbo is ... he went out for lunch when he gets back I was gonna ask him about the https thing | 17:43 |
| *** diegoparrilla has joined #openstack | 17:43 | |
| RickB17 | btorch: perfect. Thanks. I'll watch the chat here. | 17:44 |
| btorch | RickB17: does it work if you change auth to HTTP ? | 17:44 |
| RickB17 | btorch: haven't tested yet. Will try it now. | 17:44 |
| eday | sandywalsh: hey! read your oauth wiki page. when you talk about a child zone needing to ask the parent zone to authenticate, are you assuming an external auth service will be setup in the same zone structure as nova? if so, why? it seems auth shouldn't need to follow the same zone boundaries as nova | 17:45 |
| *** joearnold has quit IRC | 17:45 | |
| btorch | RickB17: once I move my swauth to http it works ... the storage-url uses https but that is because I use pound to proxy it over to http on the backend | 17:46 |
| *** joearnold has joined #openstack | 17:46 | |
| sandywalsh | eday, right. I'm assuming a single over-arching auth service outside of the zones | 17:46 |
| sandywalsh | eday, gets way to complicated to keep an auth per zone | 17:46 |
| sandywalsh | *too | 17:46 |
| eday | sandywalsh: but the diagrams show auth bouncing through every zone boundary | 17:47 |
| sandywalsh | eday, that was thinking out loud stuff ... later on I suggest it's easier to keep it outside | 17:47 |
| sandywalsh | eday, I should make that more explicit | 17:47 |
| eday | sandywalsh: ahh, ok. I saw that as a final example, but didn't seem to get much attention. my vote would be for that :) | 17:48 |
| btorch | RickB17: yeah it's definately something with auth https | 17:48 |
| sandywalsh | eday, definitely ... the other ones are too chatty | 17:49 |
| *** JulioBell has quit IRC | 17:49 | |
| openstackjenkins | Project nova build #761: SUCCESS in 2 min 33 sec: http://jenkins.openstack.org/job/nova/761/ | 17:49 |
| openstackjenkins | Tarmac: Added synchronize_session parameter to a query in fixed_ip_disassociate_all_by_timeout() and fix #735974. | 17:49 |
| eday | sandywalsh: yeah, and would require excessive auth layers (one per zone) | 17:49 |
| btorch | RickB17: http://paste.openstack.org/show/1065/ | 17:49 |
| *** metoikos has quit IRC | 17:50 | |
| sandywalsh | eday, yup, the authz stuff at the end is where it gets really interesting ... touches on instance naming and could be used for caching as well | 17:50 |
| eday | sandywalsh: as for authz on projects, don't think of instances belonging to a user and project, rather think of them only beloning to a single 'owner', which may be a user, project, or something else (this is a change coming in diablo most likely with splitting out auth service) | 17:50 |
| RickB17 | btorch: this may be a stupid question, but what areas of the config do i have to change to disable ssl? | 17:50 |
| RickB17 | btorch: at first glance i see it on the proxy server conf | 17:51 |
| eday | sandywalsh: so then authz tuples can just be (owner,verb), and no need to flatten projects/instances | 17:51 |
| sandywalsh | eday, hmm, don't see how that would work. You need to know the subject for the permissions | 17:51 |
| btorch | RickB17: just for the auth-server in the auth-server.conf disable the cert_file and key_file and just restart the service | 17:52 |
| *** adiantum has joined #openstack | 17:52 | |
| sandywalsh | eday, "(Alice) (can_halt) (ami-1234)" | 17:52 |
| sandywalsh | eday, but she can't halt ami-666 | 17:52 |
| btorch | RickB17: you can leave the proxy-server with https .. I don't have a problem with the storage url being https at lease | 17:53 |
| btorch | s/lease/least/ | 17:53 |
| eday | sandywalsh: sure, but thats resolved at a zone. Alice would be authed with the tuples (alice,can_halt), (bob,can_halt), and (shared_project,can_halt) | 17:53 |
| eday | sandywalsh: and then a zone can apply those, using the instance.owner == tuple[0] | 17:54 |
| RickB17 | btorch: i guess it just doesn't like me.... The server could not comply with the request since it is either malformed or otherwise incorrect.<br /><br /> | 17:54 |
| RickB17 | btorch: 400 bad request | 17:54 |
| sandywalsh | eday, rather than try to synchronize project information between public/private zones, just flatten down to "instances" as the most-common-denominator | 17:54 |
| btorch | RickB17: is that from restarting it ? | 17:55 |
| sandywalsh | eday, let the deployment worry about its project hierarchy | 17:55 |
| RickB17 | btorch: no from rerunning cloudfuse | 17:55 |
| btorch | RickB17: what about curl ? | 17:55 |
| sandywalsh | eday, issue is when ZoneA adds Fred to the project ... when does ZoneB learn of that? | 17:56 |
| sandywalsh | eday, (need to write that down) | 17:56 |
| eday | sandywalsh: what would you flatten? if we just have (owners,action) tuples that can apply to any resource? (instance, network, volume, etc.) | 17:56 |
| *** littleidea has joined #openstack | 17:56 | |
| RickB17 | btorch: cannot connect to host. Let me check some stuff out.. | 17:57 |
| btorch | RickB17: also is there a reason you are using devauth instead of swauth ? | 17:57 |
| eday | sandywalsh: well, fred would get ('project',can_do_something) tuple added in the auth step, so next time fred logs in he can start doing stuff for project | 17:57 |
| RickB17 | btorch: no reason other than thats how it was in the setup guide | 17:57 |
| redbo | btorch,RickB17: what's the deal? | 17:57 |
| btorch | RickB17: for the 1.2 or 1.3 docs ? | 17:57 |
| sandywalsh | eday, right ... fred would need to log in again. That may be fine first round | 17:57 |
| eday | sandywalsh: nova won't manage whos in what project, the auth service just provides the (owner,perms) pairs | 17:57 |
| sandywalsh | eday, right, agreed | 17:58 |
| RickB17 | btorch: i used http://docs.openstack.org/openstack-object-storage/admin/os-objectstorage-admin-book.pdf | 17:58 |
| *** littleidea has quit IRC | 17:58 | |
| sandywalsh | eday, still think the subject is required though ... still not clear why your think we can leave it out. Can you elaborate? | 17:58 |
| redbo | it's probably being a pain about self-signed certs | 17:59 |
| eday | sandywalsh: can you elaborate on the question more first? not quite sure I get it ;) | 17:59 |
| RickB17 | btorch: if swauth is the recommended method i would like to use that. Do have a link offhand that i could reference? | 18:00 |
| sandywalsh | eday you say the tuples can just be (subject, verb) ... but I don't see how you can leave out ,object). We can't allow blanket can_foo and we can't assume that object owner is sufficient | 18:01 |
| sandywalsh | eday, ami-1234.owner = Alice, but Bob could have permission to manage the instance. | 18:01 |
| sandywalsh | eday, irc suck for this :) | 18:02 |
| sandywalsh | *sucks | 18:02 |
| gholt | RickB17: If you're using code from trunk, using http://swift.openstack.org/ docs is best. | 18:02 |
| eday | sandywalsh: sure, so when bob issues a 'halt' request, bobs auth step returns (Alice,can_halt) as one of the tuples | 18:02 |
| * btorch should prbably add that to my nook :) | 18:02 | |
| gholt | RickB17: If you're using the latest stable release (1.2 for Swift), the guide pdf should be fine. | 18:03 |
| RickB17 | gholt: thanks, i will read the auth section there. | 18:03 |
| sandywalsh | eday, how can Zone B auth do that when it doesn't know about the shared group that Bob and Alice are in. Only Zone A knows that. | 18:04 |
| *** burris has joined #openstack | 18:04 | |
| eday | sandywalsh: well, forget about 'zones' for a sec, they would both contact the same auth service, no? | 18:05 |
| sandywalsh | eday, no, not in a federated case. Private/public deployments. MyCo -> ServiceProvider | 18:05 |
| *** littleidea has joined #openstack | 18:07 | |
| *** littleidea has quit IRC | 18:07 | |
| eday | sandywalsh: we may be getting ahead of ourselves then with authz here... hmm. first we need to be clear where auth tokens can be verified and where authz tuples are stored | 18:07 |
| vishy | in your wiki page | 18:08 |
| redbo | btorch: I pushed a change where it doesn't check the CA when authenticating. I'll probably make it an option later. | 18:08 |
| eday | sandywalsh: asuming these are the same, wherever the child zone verifies the token, it would be the same place that manage the relationships (in the form of tuples) and returns those | 18:09 |
| sandywalsh | eday, quite possibly. I think we can agree that there is an external service to the zones. I'm just thinking ahead I guess. | 18:09 |
| vishy | sandywalsh: authn should return all of the subjects, so the subjects for Bob are: Bob, SharedAliceBobGroup, sysadmin | 18:09 |
| openstackjenkins | Project nova build #762: SUCCESS in 2 min 28 sec: http://jenkins.openstack.org/job/nova/762/ | 18:09 |
| openstackjenkins | Tarmac: Add checking if the floating_ip is allocated or not before appending to result array in DescribeAddresses. | 18:09 |
| btorch | redbo: cool I'll pull it down and recompile it in a sec | 18:09 |
| sandywalsh | vishy, Hmm, that's a possibility as well. I prefer the flattening though. Smaller set size (I think :) | 18:10 |
| sandywalsh | eday, correct. | 18:10 |
| eday | sandywalsh: can you explain the flattening? what exactly are you flatting from->to? | 18:11 |
| sandywalsh | eday, the main takeaway is the all this policy enforcement needs to come out of nova | 18:11 |
| vishy | sandywalsh: that is the point of authz in the prototype branch | 18:11 |
| sandywalsh | eday, Zone A (private cloud) has a bunch of groups. Zone B (Service Provider) doesn't know about these groups. It only knows about Instance ID and the broader project/account they belong to (for billing) | 18:12 |
| sandywalsh | eday, so Zone A needs to flatten all these groups down to just their Instance IDs so Zone B can deal with it | 18:12 |
| *** dmshelton has quit IRC | 18:13 | |
| vishy | I don't think ZoneB needs anything but ids | 18:13 |
| sandywalsh | vishy, yes, but I don't think that will work in the federated case ... since objects are not shared between deployments | 18:13 |
| sandywalsh | vishy, agreed | 18:13 |
| vishy | sandywalsh: but zoneA doesn't need to know about ZoneBs ids | 18:14 |
| eday | sandywalsh: why would instance ids need to be passed between zones? | 18:14 |
| sandywalsh | vishy, yes it would ... otherwise how would it select an instance to work with? Zone B fabricates the instance ID and returns it to Zone A after the boot() call | 18:15 |
| vishy | if zoneA makes a request to zoneB, zoneB is responsible for authZ. ZoneB requests subjects from ZoneA (included in validation of token) and verifies authz internally. | 18:15 |
| *** MarcMorata has joined #openstack | 18:15 | |
| vishy | that way zoneA doesn't need to track anything about the object in zone A aside from that it is in zoneb | 18:15 |
| vishy | s/about the object in zone A/about the object in zone B | 18:16 |
| sandywalsh | vishy, yes, but Zone B doesn't know the context of the permissions that Zone A supplied. It only knows <this user> and [ list of instance ids] | 18:16 |
| vishy | o | 18:16 |
| vishy | no | 18:16 |
| eday | vishy: agreed, except zone b should not request subject from zone a, it would just do that form the auth service, no? | 18:16 |
| vishy | it knows groups when it auths the token against zone As Authn | 18:16 |
| sandywalsh | eday, when I say zone B I mean the Auth service running at the service provider, not nova itself. | 18:17 |
| vishy | eday correct Zone As auth service | 18:17 |
| zigo-_- | soren: Where may I find the modified version of KVM that I need to package? | 18:17 |
| RickB17 | btorch,redbo: I download the latest source, but still receive a simple "Unable to authenticate." with SSL enabled. When i disable SSL on the auth server i receive this output: http://paste.openstack.org/show/1066/ | 18:17 |
| sandywalsh | vishy, the Groups of Zone a have no meaning in Zone B | 18:17 |
| btorch | hmm having problems pulling from github | 18:17 |
| eday | sandywalsh: if they shared a common auth service, they would, no? | 18:18 |
| sandywalsh | vishy, zone_a> nova_manage create project Foo ... Zone B never sees that | 18:18 |
| btorch | RickB17: curl ? | 18:18 |
| sandywalsh | eday, ah ... I don't think we can assume that can we? | 18:18 |
| sandywalsh | My private nova cloud has to use the Service Provider auth service? | 18:19 |
| eday | sandywalsh: if we're talking about the same user, we need to, no? | 18:19 |
| RickB17 | btorch: http://paste.openstack.org/show/1067/ | 18:19 |
| redbo | whaaaat... how could that happen? | 18:19 |
| sandywalsh | eday, I don't think so , OAuth doesn't require that. | 18:19 |
| RickB17 | btorch: could it be something with that 204 no content? | 18:19 |
| zigo-_- | Hey, can anyone do dpkg -l euca2ools on a working Openstack server, and tell me the version number? | 18:19 |
| * zigo-_- needs to know if the Debian version is ok ... | 18:19 | |
| vishy | sandywalsh: if the instance was launched in zoneB by a user coming from zoneA | 18:20 |
| vishy | then the owner is coming from zoneA | 18:20 |
| sandywalsh | yes | 18:20 |
| btorch | RickB17: no ... devauth returns 204 and swauth returns 200s .. that's fine | 18:20 |
| RickB17 | btorch: ok | 18:20 |
| vishy | so as long as zoneA returns a group that is that owner, zoneB should be good | 18:21 |
| RickB17 | btorch: http://paste.openstack.org/show/1068/ | 18:21 |
| RickB17 | btorch: added second output | 18:21 |
| sandywalsh | vishy, but that group doesn't exist in zone B. All Zone B knows is "Alice" and her authenticated token. | 18:22 |
| zigo-_- | Please, I need a bit of support to do my Debian packaging ... | 18:22 |
| zigo-_- | What's the euca2ools version required? | 18:22 |
| vishy | ZoneB knows the owner specified on instance launch | 18:22 |
| *** hazmat has joined #openstack | 18:22 | |
| vishy | I do agree though that anything more complicated than "owner" is going to be problematic | 18:23 |
| sandywalsh | vishy, yes, but Bob may have permission control that instance as well ... not the the person that created it. | 18:23 |
| vishy | sandywalsh: i think that is going to have to be handled with overrides. | 18:23 |
| sandywalsh | *to control | 18:23 |
| sandywalsh | vishy, can you explain an override? | 18:24 |
| vishy | so alice has to make an override call to zone b and say: allow zonea.Bob, or allow zonea.AliceAndBob | 18:24 |
| vishy | sandywalsh: but zoneB doesn't need to have a concept of the actual structure in zoneA, it just knows that X opaque ZoneA identifier is good. | 18:24 |
| sandywalsh | vishy, I'm not sure. I think I have a scheme where zone A can handle groups by flattening the groups on the Zone A side. | 18:25 |
| eday | vishy, sandywalsh: or zone B is just configured to grab authz info from the auth service in zone a | 18:25 |
| sandywalsh | vishy, yes, agreed | 18:25 |
| vishy | sandywalsh: as i said in the notes i added to your wiki page, I think that if we pass this through the services, authz doesn't need to be shared. | 18:25 |
| sandywalsh | eday, thought about that too .. that tricky, but possible I think. | 18:26 |
| vishy | sandywalsh: if you are flattening groups as you suggest then we have to share authz which i'm trying to avoid | 18:26 |
| sandywalsh | <looking> | 18:26 |
| eday | sandywalsh: because if we get mroe specific, we have a public cloud (rackspace) and private company (myco) using rackspace for bursting. myco has it's own auth/groups/whatever, and doesn't want to loose those when bursting. it configures a rackspace account with billing info/auth service (no configured users in rackspace, just an auth endpoint) | 18:28 |
| eday | sandywalsh: rackspace that can just bill the CC for that account for anything created under that auth service. which allows remote authz management, no? | 18:29 |
| sandywalsh | correct | 18:29 |
| eday | vishy, sandywalsh: or am I way off base? :) | 18:29 |
| sandywalsh | eday, from the service provider perspective I think that's the correct approach. | 18:29 |
| sandywalsh | vishy, I need to think about this override thing a little more. At first blush it seems problematic, but that could just be my lack of understanding. | 18:30 |
| vishy | sandywalsh: it is implemented in a basic form in the prototype branch if that helps | 18:30 |
| sandywalsh | vishy, pushing down to the services I don't like though. It makes child zones complicated and puts the auth "processing" code all over the place (vs just enforcement can_do_this()) | 18:31 |
| vishy | sandywalsh: how do you handle things like swift then? It puts authz colocated with the objects | 18:32 |
| sandywalsh | vishy, yes, I've looked at the branch, but I'm thinking from a practicality perspective. Can Zone A effectively keep those overrides in order. | 18:32 |
| *** lvaughn_ has quit IRC | 18:33 | |
| sandywalsh | vishy, it may be like eday says, if MyCo wants to use a Service Provider is needs to keep calling Zone B to keep the permissions up to date. | 18:33 |
| sandywalsh | icky though | 18:33 |
| *** lvaughn has joined #openstack | 18:33 | |
| eday | sandywalsh: what makes that icky? | 18:34 |
| *** MarcMorata has quit IRC | 18:34 | |
| sandywalsh | eday, smells like a poor mans replication scheme | 18:34 |
| eday | sandywalsh: replication? I guess I see it as if we're already federating authn, why not authz? | 18:35 |
| eday | pushing overrides between zones seems more like poor mans replication, and is bound to get out of sync | 18:36 |
| vishy | if granting permissions is done the same way in all deployments, i don't see how it is any more complicated | 18:36 |
| *** lvaughn_ has joined #openstack | 18:36 | |
| sandywalsh | eday, that's what I'm talking about ... pushing overrides | 18:36 |
| uvirtbot | New bug: #747618 in swift "Fix .admin get_user privileges." [Critical,In progress] https://launchpad.net/bugs/747618 | 18:36 |
| vishy | if alice wants to grant permissions to bob, she makes an auth call locally, and it is passed to the other zone, either through the service or by federated authz | 18:36 |
| vishy | i don't see what random crazy updates are getting pushed | 18:37 |
| eday | vishy: yeah. i guess with override it sounded like it was something remote zones would store in some way | 18:37 |
| *** sebastianstadil has quit IRC | 18:37 | |
| vishy | eday: yes, but it is only stored in the remote zone | 18:38 |
| *** lvaughn has quit IRC | 18:38 | |
| sandywalsh | eday, well, it would need to store it ... it would need to store the override (policy) | 18:38 |
| sandywalsh | hmm | 18:38 |
| vishy | eday: zoneA doesn't store it because the object belongs to zoneB | 18:38 |
| eday | vishy: if it's not stored remotely (outside the canonical authz service), I think we're all saying the same thing :) | 18:38 |
| sandywalsh | vishy, so if I have 3 service providers I need to issue that override to all three? | 18:39 |
| vishy | sandywalsh: no, it is per object | 18:39 |
| eday | vishy: ohh, you're talking about storing it with the object? | 18:39 |
| vishy | if you are talking per owner overrides, then it might be a little more complicated | 18:39 |
| vishy | but i think the amount of data there is pretty small. It could create syncing problems as zones are added and removed i suppose | 18:40 |
| eday | vishy: I was talking about the per-owner perms, not per-object | 18:40 |
| vishy | eday: ok I'm with you now | 18:41 |
| sandywalsh | vishy, well, I don't mind doing per-object permissions, but I don't think it's needed. If Zone A knows the permissions, it can just supply it when Alice authenticates. Why bother replicating it? | 18:41 |
| vishy | so what is the solution you are suggesting? ZoneB makes a call back to ZoneA for per-owner perms? | 18:41 |
| sandywalsh | that's what my wiki page talks about ... not having to update Zone B. Having Zone supply everything (possible since groups are flattened) | 18:42 |
| vishy | owner permissions do make more sense belonging to the Zone where the user is. object permissions have to be in zone where the object is. | 18:43 |
| sandywalsh | vishy, no call back ... permissions are supplied at auth time by Zone A | 18:43 |
| sandywalsh | I don't think the service provider should need to know about those complexities | 18:43 |
| sandywalsh | it just needs to know Tenant ID, Instance ID and User ID | 18:43 |
| sandywalsh | Zone A supplies the tuples of valid permissions (with Actions) | 18:44 |
| eday | sandywalsh: why does it need instance id? just the auth token, no? | 18:44 |
| vishy | sandywalsh: then auth in zone a needs to keep track of all of the objects in zoneB | 18:44 |
| eday | sandywalsh: the auth service should not track instance (and netowrk, volume, ...) ids | 18:44 |
| sandywalsh | vishy, yes, it needs to know all "externally managed" resources | 18:45 |
| vishy | eday: +1 | 18:45 |
| eday | sandywalsh: that's really heavy-weight for an auth service. what about when there are 10M swift objects? (resources) | 18:45 |
| vishy | yes that model blows up for swift pretty quickly | 18:46 |
| sandywalsh | hmm | 18:46 |
| sandywalsh | valid point | 18:46 |
| sandywalsh | but clean :) | 18:46 |
| creiht | we've learned that most models blow up for swift pretty quickly :) | 18:46 |
| eday | sandywalsh: it seems just managing <accounts> (which are users, projects, groups, etc) and relationships between those accounts. it then returns a tuple of (account,perms) | 18:46 |
| eday | creiht: damn you for building extremely scalable systems :) | 18:47 |
| creiht | lol | 18:47 |
| sandywalsh | eday, so we're still managing resources in auth, just projects/groups instead of instance ids | 18:47 |
| sandywalsh | let's say an order of magnitude savings (nothing to sneeze at of course) | 18:48 |
| vishy | i look at object_ids as belonging to authz | 18:48 |
| vishy | which is internal to the service | 18:48 |
| vishy | so that could be swifts current implementaton or a pluggable policy engine like the prototype authz | 18:48 |
| sandywalsh | vishy, you just +1'ed eday for saying it shouldn't belong to authz :) | 18:48 |
| vishy | sandywalsh: no i think it shouldn't belong to authn or any federated auth service | 18:49 |
| sandywalsh | (the 'internal to the service' thing worries me) | 18:49 |
| sandywalsh | ah, I'm talking about it being in AuthZ ... not AuthN | 18:49 |
| eday | sandywalsh: possibly multiple orders... could be millions of resources with a couple users/groups | 18:49 |
| vishy | sandywalsh: why? actions are completely service-specific. | 18:49 |
| sandywalsh | still a large bunch of objects to manage | 18:49 |
| *** bkkrw has joined #openstack | 18:50 | |
| sandywalsh | vishy, but they're just boolean checks (can_foo(user, object)) ... nothing more fancy. | 18:50 |
| vishy | if authz is mapping groups to actions and objects, the actions and objects are specific to the service | 18:50 |
| eday | vishy: but 'groups' are not service specific, ie, admin in swift == admin in nova perhaps | 18:50 |
| vishy | eday: correct | 18:50 |
| vishy | eday: which is why groups are returned by authn | 18:51 |
| sandywalsh | also, the service provider needs to know about every group from every customer. | 18:51 |
| vishy | and they are federated/etc. | 18:51 |
| eday | vishy: ok, but I see those as the input to authz, not authn | 18:51 |
| vishy | sure, the input | 18:51 |
| vishy | something calls authn, gets the groups and passes them to authz | 18:52 |
| creiht | It also gets bad, if for every single object access, you have to make an authz request | 18:52 |
| sandywalsh | creiht, yes | 18:52 |
| vishy | (or handles it internally like swift does) | 18:52 |
| sandywalsh | that's a lot of data for every service to maintain isn't it? | 18:53 |
| eday | vishy: and by authz, you imagine a per-service authz service? | 18:53 |
| vishy | eday: i think most of the services will share one authz service, but it would not be shared accross providers | 18:55 |
| eday | vishy: but now authz is split into two... group listing in the authN step, and authz just to get perms for those groups per service | 18:55 |
| vishy | so burrow, glance, nova might share the same authz, only because it makes setting policies a little easier, but i think they could just as easily use three separate ones. | 18:55 |
| eday | vishy: it would be nice to store those together and return once | 18:56 |
| *** joearnold has quit IRC | 18:56 | |
| vishy | eday: then you have to move objects back into authn though | 18:56 |
| vishy | (and actions) | 18:56 |
| eday | vishy: not objects, just perms on groups | 18:56 |
| eday | or, actions on groups | 18:56 |
| vishy | if you don't allow per-object permissions you could do it that way | 18:57 |
| eday | any per-object access overrides can still happen inside the service (nova.instance records, not an external service) | 18:57 |
| sandywalsh | in my proposal, only Zone A keeps a reference to all objects it owns (even if externally managed). For the Service Provider AuthZ is pretty easy. | 18:57 |
| vishy | eday: I don't know if permissions can be shared | 18:58 |
| vishy | eday: between deployments | 18:58 |
| eday | vishy: why not? | 18:58 |
| vishy | ZoneB may not want to allow users to create floating ips for example | 18:59 |
| eday | vishy: if my private cloud uses my orgs user/group structure, why can't that auth endpoint be used when bursting into the public cloud? | 18:59 |
| vishy | that means they have to validate against their own authn service anyway | 18:59 |
| sandywalsh | that's a decision for Zone A when it gives the Users Auth info | 18:59 |
| sandywalsh | Alice, can_create_floating_ip, * | 18:59 |
| *** drico has joined #openstack | 19:00 | |
| vishy | but that isn't a decision for zone A | 19:00 |
| vishy | it is a policy decision for zone B | 19:00 |
| sandywalsh | ah, I see your point | 19:00 |
| eday | vishy: isn't that a deployment constraint, not a auth constraint? | 19:00 |
| sandywalsh | well, that's easy to layer on | 19:00 |
| vishy | zones have to be able to manage their own policies | 19:00 |
| vishy | the main purpose of authz is to allow for policies to be enforced | 19:00 |
| sandywalsh | both are required: Zone A may give Alice permission, but Zone B may deny it | 19:01 |
| eday | it's like a deployment that doesn't have volumes, any volume_perms would be ignored | 19:01 |
| sandywalsh | yes | 19:01 |
| *** dmshelton has joined #openstack | 19:01 | |
| vishy | sigh I'm starting to be convinced that we have to federate authz as well | 19:01 |
| vishy | :( | 19:01 |
| sandywalsh | we don't have to, but the problem is more manageable if we do. | 19:02 |
| eday | I don't see that as a bad thing | 19:02 |
| soren | gholt: What yo usee on lp:ubuntu/swift is months old. | 19:03 |
| RickB17 | I'm receiving a code 400, message Bad HTTP/0.9 request from the curl command when requesting auth token from my auth-server. http://paste.openstack.org/show/1070/ | 19:03 |
| soren | gholt: The other URL (which is the correct one) wasn't updated. I hadn't pushed my changes yet. | 19:03 |
| sandywalsh | I need to capture this thread ... is this room logged anywhere? | 19:03 |
| RickB17 | btorch: this may be linked to why my cloudfuse isn't working i would imagine | 19:03 |
| soren | zigo-_-: Is there a modified version of KVM that you need to package? | 19:03 |
| eday | sandywalsh: http://eavesdrop.openstack.org/irclogs/%23openstack.2011-04-01.log | 19:04 |
| sandywalsh | eday, thx | 19:04 |
| RickB17 | btorch: this error only shows up when the certs are disabled on the auth-server | 19:05 |
| eday | vishy: you could also set some overrides when configuring the auth service. for example, when zoneB is configured with (billing info, authA endpoint, ...), it could also have "never allow floating_ip perms" | 19:05 |
| zigo-_- | soren: I thought you said nova needs a specific version? | 19:06 |
| zigo-_- | Or was I dreaming? | 19:06 |
| eday | vishy: so it's not so much authz, but more of a configured filter when using the authz service | 19:06 |
| vishy | eday: i think if a zone is using an external auth service, it will probably always want to have some sort of proxy to validate/remove permisions it doesn't like | 19:07 |
| devcamcar | creiht: you around? | 19:07 |
| *** Zangetsue_ has joined #openstack | 19:07 | |
| vishy | eday: I still don't see how the combined model handles per-object permissions well, and i really like the conceptual simplicity of authn and authz separate | 19:08 |
| vishy | but i do see your point about the splitting being a little odd | 19:08 |
| eday | vishy: per-object would just store group/action in the object record like swift | 19:08 |
| *** Zangetsue has quit IRC | 19:09 | |
| *** Zangetsue_ is now known as Zangetsue | 19:09 | |
| eday | vishy: and we could keep authn/authz seperate too, I would just want to keep the group listing in authz, not return it as part of authn | 19:09 |
| creiht | devcamcar: kinda | 19:09 |
| creiht | what's up? | 19:09 |
| vishy | eday: hmm, interesting, seems like groups have a lot to do with membership to me | 19:10 |
| eday | vishy: they do, but thats all authz, not authn | 19:10 |
| devcamcar | creiht: just trying to track down some rsync issues i'm seeing | 19:10 |
| creiht | btw, in swift right now we don't do per object permissions, just container level | 19:10 |
| sandywalsh | ah, interesting | 19:10 |
| devcamcar | creiht: http://paste.openstack.org/show/1072/ | 19:11 |
| eday | vishy: ie, openid from google isn't going to return a list of groups for authz | 19:11 |
| devcamcar | rsync is returning a lot of 5s | 19:11 |
| vishy | eday: so IDM plugs into authz then? | 19:11 |
| sandywalsh | and is authz done against groups or done against users -> containers? | 19:11 |
| devcamcar | which according to docs is a "network protocol error" or something like that | 19:11 |
| creiht | devcamcar: that can mean a lot of things :) | 19:11 |
| devcamcar | creiht: yea, unfortunately | 19:11 |
| vishy | eday: I'm just trying to figure out where I plug in my AD | 19:11 |
| *** gondoi has joined #openstack | 19:12 | |
| eday | vishy: some systems are both authN and AuthZ, and I think AD would fit there | 19:12 |
| sandywalsh | eday, I think the assumption is, if you want to do bursting you need to use an authn that can supply the permission tuples | 19:12 |
| *** ironcamel has quit IRC | 19:12 | |
| sandywalsh | eday, under the hood it can be anything (AD, etc), but the permissions need to be layered on to talk to a Service Provider | 19:13 |
| eday | sandywalsh: actually it's authz returning that, but we've been talking about a authn/authz all in one | 19:13 |
| redbo | devcamcar: you could try running that manually, without --quiet | 19:13 |
| creiht | devcamcar: most likely it had some sort of problem connecting to the remote machine (either network issue, or that node is really busy) | 19:14 |
| sandywalsh | eday, yes, authz would return it. What's the value in combining them? | 19:14 |
| creiht | I think that error may also come up if rsyncd isn't enabled on the remote machine | 19:14 |
| eday | sandywalsh: it's a multi-step token->user OK (authn), user->(groups,actions) (authz). we can split those, but I think we shouldn't do token->user->groups as "authN", since it's mixing the two | 19:15 |
| btorch | RickB17: the latest cloudfuse pull that I got from github worked with https auth | 19:15 |
| btorch | redbo: thanks | 19:15 |
| RickB17 | btorch: thanks i did download the .c file recompile and install it. i posted above what i feel is the casue of my problem. | 19:15 |
| uvirtbot | New bug: #747665 in glance "glance update won't update custom properties" [Undecided,New] https://launchpad.net/bugs/747665 | 19:16 |
| eday | and I wonder if we need to keep those as separate endpoints and have the extra RTT even if it's the same service | 19:16 |
| vishy | eday: seems like optionally separate is valuable | 19:16 |
| RickB17 | btorch: i'm just trying to figure out why it's doing it. when i disable the certs i get a 400 error in my auth-server syslog when requesting a token from the cloudfuse machine using curl | 19:16 |
| vishy | eday: but for the service we ship we can put them together | 19:16 |
| eday | vishy: for AD, would you want to store (group,action) in ad, and if not, where? | 19:16 |
| eday | vishy: ok, and just use our own rest auth protocol? or somehow tack this onto another? | 19:17 |
| sandywalsh | eday, we're back at (group, action) again, where'd the Object go? Is this being stored per-object? | 19:17 |
| eday | sandywalsh: no objects for per-owner perms | 19:17 |
| vishy | eday: doesn't owner become the object in that case? | 19:18 |
| eday | sandywalsh: per-object perms are stored inside the object record in the service (I think) like swift does | 19:18 |
| btorch | RickB17: on the proxy conf did u disable ssl for the filter:auth as well ? | 19:18 |
| devcamcar | creiht: seems that rsync is running everywhere | 19:18 |
| vishy | so it is actually (group, action, group) ? | 19:18 |
| sandywalsh | eday, I don't think that sufficient. You can't blanket permit Alice to halt instances. | 19:18 |
| eday | vishy: huh? | 19:19 |
| sandywalsh | that's | 19:19 |
| RickB17 | btorch: no, should have i? | 19:19 |
| sandywalsh | vishy, I think that makes more sense (group, action, group) | 19:19 |
| vishy | (alice -> can_halt -> alice's objects) | 19:19 |
| *** clauden_ has joined #openstack | 19:19 | |
| vishy | (alice -> can_halt -> bob's objects) | 19:19 |
| sandywalsh | yes | 19:19 |
| creiht | devcamcar: are the rsync errors isolated to one or a few machines or pretty evenly distributed? | 19:19 |
| eday | ohh, I'm assuming it's <account> -> [(group,action),...] | 19:19 |
| btorch | RickB17: if your auth-server is no longer running with the certs/key (ssl) then yes.. it should be false | 19:19 |
| eday | the first tuple is always the authN'd account | 19:20 |
| devcamcar | creiht: distributed | 19:20 |
| vishy | ah ok | 19:20 |
| vishy | good same page then | 19:20 |
| eday | yeah :) | 19:20 |
| soren | zigo-_-: Of KVM? No. | 19:20 |
| soren | zigo-_-: libvirt, though. | 19:20 |
| RickB17 | btorch: since cloudfuse works with https i just re-enabled the certs | 19:20 |
| sandywalsh | eday, sorry I'm missing that | 19:20 |
| eday | vishy: anyways, back to AD, where would you store (group,action) ? | 19:20 |
| vishy | eday: regarding rest auth protocol -> don't know that yet. | 19:20 |
| btorch | RickB17: ok then go back to how you used to have things and it should work now | 19:21 |
| vishy | eday: I'm considering the AD question | 19:21 |
| eday | sandywalsh: account->[(group,action),...] == (account,group,action),... | 19:21 |
| sandywalsh | eday, group = object group? | 19:21 |
| zigo-_- | soren: Ok, that is done then! :) | 19:21 |
| *** brd_from_italy has joined #openstack | 19:21 | |
| zigo-_- | I got all up and running now. | 19:21 |
| eday | vishy: might be nice to just support existing out of the box, which means they may need to be separate depending on the type. something like LDAP could be all-in-one | 19:21 |
| creiht | devcamcar: it is kinda hard to say without being on the machine | 19:22 |
| zigo-_- | The only main issue is nova-compute not having accessl to the libvirt socket file. | 19:22 |
| vishy | eday: the simplest policy engine is just a conf file | 19:22 |
| creiht | I would try running the command manually, and see if it presents an better info | 19:22 |
| eday | sandywalsh: I should say, group==owner of object | 19:22 |
| zigo-_- | I have to chown it once libvirt-bin starts ... | 19:22 |
| *** hadrian has quit IRC | 19:22 | |
| RickB17 | btorch: still getting unable to authenticate. no logs are showing up in my syslog on the auth-server when i run the command, but when i run curl it does. | 19:22 |
| vishy | eday: policies could go into ldap but i'm not sure if there is good support in ldap for it | 19:22 |
| Ryan_Lane | what kind of policies? | 19:23 |
| zigo-_- | soren: Where do I find the uec-publish-tarball command? | 19:23 |
| eday | Ryan_Lane: user X can reboot | 19:23 |
| zigo-_- | Which package? | 19:23 |
| Ryan_Lane | ahhh ok | 19:23 |
| eday | Ryan_Lane: is that a good fit fot ldap? | 19:23 |
| Ryan_Lane | and of course, now it's time to go to lunch :D | 19:23 |
| Ryan_Lane | heh | 19:23 |
| Ryan_Lane | back in like an hour | 19:23 |
| vishy | eday: the important thing is the policies have to be programattically overridable as well | 19:23 |
| sandywalsh | eday, then I don't get it. (account, owner of object, action) ... why not just (account, object, action) ? | 19:23 |
| *** Ryan_Lane is now known as Ryan_Lane|food | 19:23 | |
| *** adiantum has quit IRC | 19:23 | |
| eday | sandywalsh: because we don't want to store every object ID in the authZ service | 19:24 |
| vishy | sandywalsh: auth already manages owners, so it means no extra data has to move in | 19:24 |
| sandywalsh | ok, gotch ... thanks | 19:24 |
| sandywalsh | gotcha | 19:24 |
| sandywalsh | vishy, re: AD, people are violently opposed to extending their AD schemas | 19:24 |
| vishy | eday, sandywalsh: although if we have federated auth then i suppose it is a little troublesome | 19:25 |
| btorch | RickB17: you have the latest cloudfuse trunk ? | 19:25 |
| eday | vishy: and those overrides would exist in the same authZ policy store? | 19:25 |
| RickB17 | btorch: whats the easiest way to determine the version? | 19:25 |
| vishy | eday: does auth have to provide a way for other services to do owner overrides? | 19:25 |
| RickB17 | btorch: i ran it from the repo | 19:25 |
| eday | vishy: or for per-object overrides, in the object record of the given service? | 19:25 |
| vishy | s/services/zones | 19:25 |
| sandywalsh | vishy, eday Zone A would remember who created the instance, so it could supply that list | 19:26 |
| zigo-_- | soren: Should I package "cloud-utils" as well? Why isn't it in the depends of one of the nova packages? | 19:26 |
| *** jmaltin has joined #openstack | 19:26 | |
| devcamcar | creiht: yea, was hoping to get lucky and have it be something you'd seen before | 19:26 |
| *** dendrobates is now known as dendro-afk | 19:26 | |
| creiht | rsync can also tend to error a lot more when there is a lot of network activity | 19:26 |
| btorch | RickB17: ok let me go back to devauth :( | 19:27 |
| eday | sandywalsh: list of what, for what? im confused :) | 19:27 |
| vishy | so we have three "users" A.Alice A.Bob B.Frank | 19:27 |
| RickB17 | btorch: i don't mind going to swauth since it's the recommended method. WOuld that make it easier? | 19:27 |
| RickB17 | btorch: appears like i will ahve to go that way anyhow. | 19:27 |
| vishy | alice wants to allow bob and frank to terminate her instances | 19:27 |
| *** pharkmillups has quit IRC | 19:27 | |
| vishy | so she says A -> (A.bob, allow-halt, alice) | 19:28 |
| eday | vishy: and A and B are different auth services? | 19:29 |
| vishy | right | 19:29 |
| RickB17 | btorch: http://paste.openstack.org/show/1073/ swift version info | 19:29 |
| devcamcar | creiht: yea i'm watching rsync logs and it does eventually seem to right itself | 19:29 |
| eday | oh jeez, this is going to be a mess :) | 19:29 |
| btorch | RickB17: I would use swauth | 19:29 |
| vishy | how does she say that she wants to allow frank to terminate | 19:29 |
| devcamcar | creiht: just feels a bit brittle right now | 19:29 |
| vishy | ? | 19:29 |
| eday | vishy: don't allow it? :) | 19:29 |
| RickB17 | btorch: can you point me to a quick read to change it over? is it just a couple config file changes? | 19:29 |
| zigo-_- | root@GPLHost:node3320>_ ~# uec-publish-tarball ubuntu1010-UEC-localuser-image.tar.gz dub-bucket x86_64 | 19:29 |
| zigo-_- | Fri Apr 1 19:28:51 UTC 2011: ====== extracting image ====== | 19:29 |
| zigo-_- | tar: maverick-server-uec-amd64-floppy: Wrote only 8704 of 10240 bytes | 19:29 |
| vishy | hehe | 19:29 |
| zigo-_- | tar: maverick-server-uec-amd64.img: Cannot write: No space left on device | 19:29 |
| sandywalsh | eday, right, don't allow it | 19:29 |
| creiht | if it fails it will come back around and try again the next pass | 19:30 |
| zigo-_- | Is there a way to tell it not to use /tmp ??? | 19:30 |
| sandywalsh | eday, list of permissions | 19:30 |
| eday | vishy: or, if they share an authN system we can allow it | 19:30 |
| eday | and have different authZ for various auth groups | 19:30 |
| vishy | eday, sandywalsh: so I can't allow users using another auth system to access my instances | 19:30 |
| sandywalsh | eday, vishy but that's won't be the case in the public/private | 19:30 |
| eday | for example, authN may be openID, and public/private both provide authZ using openIDs | 19:30 |
| sandywalsh | vishy, they can, but the AuthZ needs to layer on the permissions tuples | 19:30 |
| sandywalsh | eday, does openID allow that? | 19:31 |
| sandywalsh | I can supply permissions? | 19:31 |
| *** aixenv has quit IRC | 19:31 | |
| sandywalsh | (like SAML assertions?) | 19:31 |
| eday | sandywalsh: no, openID doesn't, your authZ service does | 19:31 |
| RickB17 | btorch: i see info in http://swift.openstack.org/1.2/howto_installmultinode.html, i'll follow that for the swauth setup and then give it a try. | 19:31 |
| sandywalsh | right | 19:31 |
| eday | sandywalsh: openID gives you a common authN ID that all authZ systems can use | 19:32 |
| sandywalsh | gotcha | 19:32 |
| eday | vishy: so, I would say we punt and allow it if your underlying authN/authZ service is configure to do so | 19:32 |
| vishy | eday: so we can do it as long as the AuthN service is the same | 19:32 |
| vishy | but if there are two authz services | 19:32 |
| btorch | RickB17: give this a try http://paste.openstack.org/show/1074/ | 19:32 |
| btorch | RickB17: that's for the proxy-server.conf | 19:33 |
| vishy | which one do i tell to give permissions | 19:33 |
| eday | vishy: the one that owns things needs to give permissions | 19:33 |
| vishy | so i send the permission request to a | 19:33 |
| eday | vishy: otherwise security is fundamentally broken | 19:33 |
| vishy | A -> (B.Frank, allow-halt, alice) | 19:34 |
| vishy | and as long as A can validate that B.Frank is who he says he is he can terminate alices instances | 19:34 |
| sandywalsh | B.Frank or A.Frank? | 19:34 |
| eday | yeah, but now it's a mess to get B.franks perms from one place... hmm | 19:34 |
| *** littleidea has joined #openstack | 19:34 | |
| vishy | so i think what we are saying is that a deployment always validates with its own authz system | 19:35 |
| sandywalsh | since Frank is authn'ed on Zone A, it's a token from there. | 19:35 |
| sandywalsh | so it would be A.Frank? | 19:35 |
| eday | this is where we would need a per-object lookup depending on the owner | 19:35 |
| RickB17 | bortch: ok, i have applied that, then ran swif-init all restart | 19:35 |
| eday | vishy: we are? | 19:35 |
| RickB17 | btorch: on the proxy-server | 19:35 |
| btorch | RickB17: after you make the proxy-server.conf to use swauth and restart the service you will need to create the swatuh account as that doc show | 19:35 |
| btorch | RickB17: yes.. you will no longer need the auth box | 19:35 |
| vishy | eday: if frank tries to terminate alice's instances in A, then A is going to check its own authz to see if frank can | 19:36 |
| btorch | RickB17: later if you want you can always run a proxy there just for auth if you like | 19:36 |
| eday | vishy, sandywalsh: if B.frank authN's to nova zone, and it tries to reboot A.alice's instance, it would need to use A's authz server | 19:36 |
| sandywalsh | vishy, yes, B validates, but A supplies the perms | 19:36 |
| sandywalsh | eday, yes, but the permissions are all supplied in the zone A namespace. Zone B only has to do set comparisons | 19:37 |
| vishy | in that case, we don't really need to federate authz, we just need to be able to specify that we are allowing actions from users from an external authn service | 19:37 |
| *** aixenv has joined #openstack | 19:37 | |
| sandywalsh | vishy, yes, I think that's correct | 19:37 |
| eday | sandywalsh: set comparisons? huh? | 19:37 |
| eday | sandywalsh: B's auth only did the ID check | 19:38 |
| sandywalsh | eday, authz (sorry) | 19:38 |
| RickB17 | btorch: running the add-user command now. is it okay to use the same username/pw as with Devauth? | 19:38 |
| btorch | RickB17: yes in fact you should do this | 19:38 |
| eday | vishy: we still need to federate, how else would you get A's perms? | 19:39 |
| RickB17 | btorch: should it take a long time to complete? it's been running for ... about a minute now? | 19:39 |
| vishy | so authz in this model is responsible for managing: users/groups/roles/organizations (membership in general) and action policies | 19:39 |
| btorch | swauth-add-user -a -s AUTH_66962e4e335341c8b6463ccf3da2c4c1 -A https://127.0.0.1:8080/auth/ system root testpass | 19:40 |
| vishy | eday: only a needs a's perms? | 19:40 |
| btorch | RickB17: that was for u | 19:40 |
| btorch | RickB17: forgot the -K | 19:40 |
| vishy | eday: why would B need A's permissions? In a bursting scenario? | 19:40 |
| btorch | RickB17: -K supersecretkeythatichanged | 19:40 |
| RickB17 | btorch: swauth-add-user -K swauthkey -a system root testpass this is whats in the doc. | 19:41 |
| eday | vishy: yeah... what if authz A and authz B are priate clouds, and they're using instances in zoneC | 19:41 |
| eday | err, private | 19:41 |
| sandywalsh | vishy, eday I think zone B just treats the values in the perm groups as opaque objects (exception for the user id). But the actions and object groups are simple Set checks. | 19:41 |
| RickB17 | btorc: when i ran yoru command it came back instantly with "403 Forbidden" | 19:41 |
| btorch | RickB17: yeah but swauth-add-user will default to http ... your proxy is on https | 19:41 |
| vishy | eday: So zone C needs to make sure that it ok for "Alice" to launch instances and potentially start spending cash by checking her permissions with A | 19:42 |
| sandywalsh | vishy, yes, in the bursting case | 19:42 |
| RickB17 | btorch: what is the -s value? | 19:42 |
| eday | perhaps we should stop using 'zoneX' and say novaX and authX.. I'm confused by what service we're actually talking about in a zone sometimes | 19:42 |
| *** mahadev has quit IRC | 19:42 | |
| vishy | eday: good idea | 19:42 |
| sandywalsh | +1 | 19:42 |
| btorch | RickB17: I might be forgeting something ... the -s is so that it will use the same account hash that devauth had created before | 19:42 |
| vishy | ok another sticking point | 19:42 |
| vishy | how does a service define with auth what the possible actions are? Does it need to? | 19:43 |
| sandywalsh | vishy, authz_B needs to make sure it's ok for Alice to spend cash, it does so with the perms that were sent when Alice authenticated | 19:43 |
| eday | vishy: service API discovery | 19:43 |
| *** kakella has joined #openstack | 19:44 | |
| eday | vishy: of course this can vary between deployments, so if you wrote an auth manager to use a given endpoint, it may not be inclusive of all zones it can burst to | 19:44 |
| btorch | RickB17: try this swauth-list -K supersecretkeythatichanged -A https://127.0.0.1:8080/auth/ | 19:44 |
| btorch | RickB17: I'm assuming your super_admin_key is still that from your last paste | 19:44 |
| sandywalsh | vishy, eday can't it just send them all? | 19:45 |
| RickB17 | btorch: yeah i changed it :-D i never posted the real one. I've been replacing it. I get 403 forbidden | 19:45 |
| RickB17 | btorch: let me make sure i didn't make any typos | 19:45 |
| eday | sandywalsh: sure, but different versions may have different sets of "all", but that should be fine | 19:45 |
| sandywalsh | vishy, eday and authzB will only use what's needed? | 19:45 |
| eday | reason to upgrade :) | 19:45 |
| sandywalsh | :) | 19:45 |
| btorch | RickB17: if that works hehe .. the list should give you back an empty {} I believe | 19:45 |
| sandywalsh | vishy, eday I have to drop off ... but great discussion! | 19:45 |
| eday | sandywalsh: yeah, have a good weekend! | 19:46 |
| sandywalsh | vishy, eday summit! | 19:46 |
| RickB17 | btorch: i did make a typo, now i get a 500 server error | 19:46 |
| sandywalsh | eday, vishy thanks ... you too | 19:46 |
| RickB17 | btorch: list failed: 500 server error....internal server error. | 19:46 |
| vishy | agreed | 19:46 |
| eday | I think we can write a more detailed proposal to discuss now :) | 19:47 |
| btorch | RickB17: the proxy-server.conf I pasted for you I also made a typo .. should be "default_swift_cluster = local#https://10.118.56.31:8080/v1#https://127.0.0.1:8080/v1" | 19:47 |
| btorch | RickB17: you running this from within the proxy box right ? | 19:47 |
| eday | of course there is still the namespace issue and how to know what remote auth service to use | 19:47 |
| RickB17 | btorch: yes from the proxy box | 19:47 |
| RickB17 | btorch: ok fixed the http to https as well as verified the secretkey | 19:49 |
| sandywalsh | eday, vishy http://paste.openstack.org/show/1075/ | 19:50 |
| sandywalsh | trimmed down | 19:50 |
| RickB17 | Traceback (most recent call last): | 19:50 |
| RickB17 | File "/usr/bin/swauth-list", line 70, in <module> | 19:50 |
| RickB17 | parsed.path += '/' | 19:50 |
| RickB17 | AttributeError: can't set attribute | 19:50 |
| btorch | RickB17: also restart memcache just to be safe | 19:50 |
| btorch | RickB17: can u paste the whole command with the output on paste.openstack.org | 19:51 |
| RickB17 | btorch: http://paste.openstack.org/show/1076/ | 19:51 |
| btorch | RickB17: also the new proxy-server.conf unless u are using the one I pasted | 19:52 |
| btorch | RickB17: add / at the end of auth | 19:52 |
| kbringard | I have a question about glance update | 19:53 |
| RickB17 | btorch: http://paste.openstack.org/show/1077/ | 19:53 |
| kbringard | when I try to update the properties for an image, it only seems to take the first one that I specify | 19:53 |
| RickB17 | btorch: now i'm getting 403 access denied to resource | 19:53 |
| kbringard | and each subsequent run overwrites what was already there | 19:53 |
| kbringard | oh wait, actually... it's just the type= that gets blasted | 19:54 |
| kbringard | and you can't get it back in there | 19:55 |
| kbringard | this is probably that bug justinb was talking about | 19:55 |
| *** zenmatt has quit IRC | 19:56 | |
| *** omidhdl has quit IRC | 19:56 | |
| kbringard | ah, OK, I think I nailed down the failure case | 19:59 |
| btorch | RickB17: hmm and adding an account ? swauth-add-account | 20:00 |
| RickB17 | btorch: yeah i'll send you the output | 20:00 |
| RickB17 | btorch: http://paste.openstack.org/show/1078/ | 20:01 |
| RickB17 | btorch: lol nope | 20:01 |
| RickB17 | btorch: add user.... | 20:01 |
| RickB17 | btorch: should it be add-user? | 20:02 |
| btorch | RickB17: I'm just trying to test things out ... you can add an account too | 20:02 |
| soren | zigo-_-: Because it's not needed? | 20:03 |
| RickB17 | btorch: jumping into a quick meeting be back in 5-10 | 20:03 |
| soren | zigo-_-: Nova functions perfectly fine without client tools. | 20:03 |
| zigo-_- | Oh ok, got you. | 20:03 |
| zigo-_- | So then, uec-publish-tarball connects to what? | 20:03 |
| btorch | RickB17: http://paste.openstack.org/show/1080/ | 20:04 |
| *** rlucio has quit IRC | 20:04 | |
| zigo-_- | soren??? | 20:05 |
| zigo-_- | Gone for 30 more minz idle? :) | 20:05 |
| soren | zigo-_-: whuh? | 20:06 |
| zigo-_- | uec-publish-tarball connects to what? | 20:06 |
| zigo-_- | :) | 20:07 |
| soren | zigo-_-: uec-publish-tarballs talks to nova-objectstore and nova-api. | 20:07 |
| zigo-_- | Ok, thanks. | 20:07 |
| zigo-_- | Or to glance, right? | 20:07 |
| soren | ...why? | 20:07 |
| soren | No. | 20:07 |
| zigo-_- | Ah... | 20:07 |
| zigo-_- | Swift is a replacement for nova-objectstore, no? | 20:07 |
| zigo-_- | And I thought that Glance would be between the client and swift ... | 20:08 |
| zigo-_- | I'm not getting it right, am I? | 20:08 |
| soren | Not exactly :) | 20:08 |
| *** kashyap has quit IRC | 20:08 | |
| soren | Swift is a proper object store. | 20:08 |
| zigo-_- | Then what is Glance about? | 20:09 |
| soren | Glance is an image registry. | 20:09 |
| zigo-_- | That uses Swift, no? | 20:09 |
| soren | The OpenStack image registry, so to speak. | 20:09 |
| soren | Before Glance came along, Nova exposed an interface identical to Amazon EC2. | 20:10 |
| soren | You'd upload an image to S3 (nova-objectstore), and ask EC2 (nova-api) to "register" this image. | 20:10 |
| soren | This is the interface uec-publish-tarball uses (since it was made for EC2 and Eucalyptus). | 20:10 |
| soren | Swift can use several backends. One is Swift, I believe. | 20:11 |
| soren | I have very little experience with Glance, I'm afraid. | 20:11 |
| *** vernhart has quit IRC | 20:11 | |
| zigo-_- | Thanks, that helps. | 20:11 |
| kbringard | soren: so you can use the objectstore still with glance if you set up an s3 connector and tell it to connect to your objectstore api frontend, yea? | 20:12 |
| zigo-_- | soren: I still have an issue with the unix rights of libvirt over here... | 20:14 |
| zigo-_- | I had to Should-start: libvirt-bin, and then write a chown in nova-compute. | 20:15 |
| zigo-_- | That's not in my bzr, of course... | 20:15 |
| zigo-_- | Just a hack on my test server. | 20:15 |
| *** pothos_ has joined #openstack | 20:15 | |
| zigo-_- | Got to find a proper solution. | 20:15 |
| *** troytoman-away is now known as troytoman | 20:15 | |
| *** zenmatt has joined #openstack | 20:16 | |
| *** pothos has quit IRC | 20:17 | |
| *** pothos_ is now known as pothos | 20:17 | |
| zigo-_- | soren: But otherwise, I think you can pull from me for both swift and nova. Swift is now lintian clean, with some stubs manpages, and more extended descriptions. | 20:18 |
| RickB17 | btorch: back | 20:22 |
| btorch | RickB17: http://paste.openstack.org/show/1080/ | 20:23 |
| RickB17 | btorch: got it, running through it now. Thanks. | 20:23 |
| *** paltman has quit IRC | 20:23 | |
| RickB17 | btorch: http://paste.openstack.org/show/1082/ | 20:24 |
| RickB17 | btorch: 403 Forbidden returned | 20:24 |
| *** BK_man has quit IRC | 20:25 | |
| *** BK_man has joined #openstack | 20:25 | |
| RickB17 | btorch: anyway of resetting all permissions? | 20:26 |
| btorch | RickB17: not sure what's going on with your 403s there !? gholt any ideas on that ? he is going from devauth to swauth | 20:26 |
| btorch | RickB17: this works ? curl -i -GET https://127.0.0.1:8080/healthcheck | 20:27 |
| BK_man | did anybody tested ajaxterm stuff? Can't get it running, ajaxterm.py is returning Not Authorized: http://paste.openstack.org/show/1083/ | 20:27 |
| *** paltman has joined #openstack | 20:28 | |
| RickB17 | curl: (58) unable to use client certificate (no key found or wrong pass phrase?) | 20:28 |
| btorch | RickB17: use -k | 20:29 |
| btorch | curl -i -k | 20:29 |
| *** adiantum has joined #openstack | 20:29 | |
| RickB17 | curl -i -k -GET https://127.0.0.1:8080/healthcheck | 20:29 |
| RickB17 | curl: (58) unable to use client certificate (no key found or wrong pass phrase?) | 20:29 |
| btorch | RickB17: you got the correct cert_file/key_file in place in the proxy-server.conf ? | 20:31 |
| RickB17 | btorch: should be, shoudl i regenerate them? copy them from the auth or storage node? | 20:32 |
| RickB17 | btorch: I have to head out. I appreciate your time and help today. I'm assuming your a regular in this room, so I catch you back here? | 20:35 |
| btorch | RickB17: cool sorry we couldn't get this working | 20:35 |
| btorch | RickB17: yeah I'll be around | 20:35 |
| *** sebastianstadil has joined #openstack | 20:36 | |
| *** hazmat has quit IRC | 20:36 | |
| *** sebastianstadil has quit IRC | 20:37 | |
| *** vernhart has joined #openstack | 20:45 | |
| *** Ryan_Lane|food is now known as Ryan_Lane | 20:46 | |
| *** brd_from_italy has quit IRC | 20:47 | |
| *** brd_from_italy has joined #openstack | 20:51 | |
| *** joearnold has joined #openstack | 20:51 | |
| *** shentonfreude has quit IRC | 20:51 | |
| nelson | in .../proxy/server.py, is "# this is a temporary hook for migrations to set PUT timestamps" to be taken seriously? | 20:54 |
| *** zenmatt has quit IRC | 20:55 | |
| nelson | Because as far as I can see from reading the source, that's the only way to set the Last-Modified: header. | 20:55 |
| kbringard | jaypipes: thanks for the note on that glance update thing | 20:55 |
| kbringard | jaypipes: it looks like the code was merged between when I made the notes and when I checked out the code, so I kept seeing purge_props=False set, and was really confused why it was blasting the stuff | 20:56 |
| *** nelson has quit IRC | 20:56 | |
| kbringard | haha | 20:56 |
| *** nelson has joined #openstack | 20:56 | |
| kbringard | or rather, the apt repo I installed from didn't have this version... or something | 20:56 |
| kbringard | that's what I get I suppose :-) | 20:56 |
| *** BK_man has quit IRC | 20:58 | |
| *** brd_from_italy has quit IRC | 21:00 | |
| *** Ep5iloN_1 has joined #openstack | 21:01 | |
| *** adiantum has quit IRC | 21:02 | |
| *** sebastianstadil has joined #openstack | 21:02 | |
| *** _vinay has quit IRC | 21:03 | |
| *** imsplitbit has quit IRC | 21:03 | |
| *** Ep5iloN_ has quit IRC | 21:03 | |
| *** dendro-afk is now known as dendrobates | 21:06 | |
| jaypipes | kbringard: so, everything ok now? :) | 21:06 |
| *** h0cin has quit IRC | 21:06 | |
| kbringard | almost, I checked out the latest code and installed it, but then realized it installed to /usr/local/bin and the deb was /usr/bin | 21:07 |
| *** ironcamel has joined #openstack | 21:09 | |
| *** ctennis has quit IRC | 21:10 | |
| *** MarcMorata has joined #openstack | 21:10 | |
| *** zenmatt has joined #openstack | 21:12 | |
| kbringard | hrmm | 21:13 |
| *** zigo-_- has quit IRC | 21:13 | |
| kbringard | jaypipes: if I'm reading this correctly, it says it was merged to branch 100, right? | 21:14 |
| jaypipes | kbringard: one sec. | 21:14 |
| *** adiantum has joined #openstack | 21:14 | |
| jaypipes | kbringard: yes | 21:15 |
| kbringard | hmmmmmm | 21:15 |
| kbringard | ii glance 2011.2~bzr100-0ubuntu0ppa1~maverick2 OpenStack Image Registry and Delivery Service - Daemons | 21:15 |
| kbringard | ii python-glance 2011.2~bzr100-0ubuntu0ppa1~maverick2 OpenStack Image Registry and Delivery Service - Python library | 21:15 |
| *** clauden_ has quit IRC | 21:15 | |
| kbringard | but it's still happening | 21:15 |
| kbringard | I also removed the dpkg and installed the latest source instead | 21:16 |
| *** Zangetsue has quit IRC | 21:16 | |
| kbringard | with the same results | 21:16 |
| kbringard | so it may not actually be fixed | 21:16 |
| *** Zangetsue has joined #openstack | 21:16 | |
| *** dspano has quit IRC | 21:20 | |
| *** johnpur has quit IRC | 21:22 | |
| *** shawndecuir has joined #openstack | 21:23 | |
| *** ctennis has joined #openstack | 21:25 | |
| *** ctennis has joined #openstack | 21:25 | |
| uvirtbot | New bug: #747799 in glance "Delete image of size 0 gives AttributeError " [Undecided,New] https://launchpad.net/bugs/747799 | 21:27 |
| *** bcwaldon has quit IRC | 21:29 | |
| *** RobertLaptop has quit IRC | 21:29 | |
| *** adiantum has quit IRC | 21:29 | |
| *** ppetraki has quit IRC | 21:32 | |
| jaypipes | kbringard: hmm :( perhaps the ppa hasn't updated... | 21:33 |
| kbringard | well, I looked in /usr/lib/pymodules/python2.6/glance/registry/db/api.py | 21:33 |
| kbringard | and I see the purge_props=False in there | 21:34 |
| kbringard | I dunno, my brain hurts and it's Friday | 21:35 |
| kbringard | I'll dig back into it on Monday when I'm not over this week :-D | 21:35 |
| kbringard | thanks for the help | 21:35 |
| *** hazmat has joined #openstack | 21:35 | |
| *** adiantum has joined #openstack | 21:36 | |
| *** Zangetsue has quit IRC | 21:36 | |
| *** Zangetsue has joined #openstack | 21:36 | |
| *** enigma1 has quit IRC | 21:37 | |
| *** icarus901 has joined #openstack | 21:37 | |
| jaypipes | kbringard: sounds good :) | 21:38 |
| btorch | where does nova get the dns nameserver,domain,search from ? I have tried changing the networks table with the proper info and also setting up the dhcp_domain,flat_network_dns flags | 21:39 |
| btorch | using kvm | 21:40 |
| kbringard | btorch: I think it gets it all from dnsmasq | 21:41 |
| kbringard | but, because the --config-file= is blank | 21:41 |
| kbringard | it only takes what's explicitly passed on the command line | 21:41 |
| btorch | kbringard: aww good point | 21:41 |
| kbringard | I actually have a merge which allows you to specify a dnsmasq.conf file | 21:41 |
| kbringard | so you can control those things | 21:41 |
| kbringard | but I got it in after the freeze, so we're waiting | 21:42 |
| btorch | kbringard: who calls dnsmasq ? nova-network ? | 21:42 |
| kbringard | yea | 21:42 |
| kbringard | https://bugs.launchpad.net/nova/+bug/742578 | 21:42 |
| uvirtbot | Launchpad bug 742578 in nova "Wishlist: Nova-network dnsmasq settings are static" [Wishlist,In progress] | 21:42 |
| btorch | kbringard: is that in just one py file ? | 21:43 |
| kbringard | yea, it's in | 21:43 |
| kbringard | uhm | 21:43 |
| kbringard | nova/network/linux_net.py | 21:43 |
| kbringard | you can add the flags manually to that code | 21:44 |
| kbringard | or you can add my lines (it's like 4 of them) and use a dnsmasq.conf file | 21:44 |
| kbringard | as you like | 21:44 |
| *** zaccone has joined #openstack | 21:44 | |
| zaccone | Hello everybody | 21:44 |
| kbringard | btorch: look for this line: cmd = ['sudo', '-E', 'dnsmasq', | 21:45 |
| kbringard | all the flags it passes are after that | 21:45 |
| zaccone | Did anybody managed to run NFS client on standard system image taken from http://smoser.brickies.net/ubuntu/ttylinux-uec/ ? | 21:45 |
| *** burris has quit IRC | 21:45 | |
| btorch | kbringard: cool found it thanks | 21:45 |
| zaccone | mount: mounting 10.0.2.15:/nfs/cloud1 on /tmp/test/ failed: No such deviceWhen i try to mount anything via NFS I only get | 21:46 |
| kbringard | no worries | 21:46 |
| *** dendrobates is now known as dendro-afk | 21:46 | |
| *** allsystemsarego has quit IRC | 21:46 | |
| zaccone | mount: mounting 10.0.2.15:/nfs/cloud1 on /tmp/test/ failed: No such device | 21:46 |
| kbringard | I'm outa here, have a good weekend guys | 21:46 |
| *** kbringard has quit IRC | 21:46 | |
| zaccone | while mounting it on the source machine works fine. | 21:46 |
| *** Zangetsue_ has joined #openstack | 21:49 | |
| *** Zangetsue has quit IRC | 21:49 | |
| *** Zangetsue_ is now known as Zangetsue | 21:49 | |
| smoser | zaccone, i dont know. i would guess that you would need some nfs moundes in order to do that. | 21:52 |
| *** burris has joined #openstack | 21:52 | |
| smoser | the kernel is a standard ubuntu kernel see the readme | 21:52 |
| smoser | so you can get modules for it | 21:52 |
| zaccone | smoser: this is more like problem in image and busybox, which is quite badly equipped. | 21:53 |
| smoser | well, it could be, yes. | 21:53 |
| smoser | but i dont think so | 21:53 |
| smoser | most likely that kernel has: | 21:54 |
| smoser | CONFIG_NFS_FS=m | 21:54 |
| smoser | and i dont think i would have put the nfs module inside the image | 21:54 |
| smoser | so without that you're not getting nfs | 21:54 |
| smoser | i woudl suspect that ttylinux's busybox *does* have support for nfs mounts | 21:54 |
| smoser | that ttylinux-uec image is basically ttylinux + ubuntu kernel | 21:54 |
| zaccone | smoser: you mean that my ubuntu server kernel is misconfigured, i mean without nfs ? | 21:55 |
| zaccone | smoser: well i managed to do mount 10.0.2.15:/nfs/cloud1 /tmp/test on that 10.0.2.15 machine | 21:55 |
| zaccone | just to check whether it's server or client problem. | 21:55 |
| zaccone | well i don't feel like reconfiguring the kernel on the Ubuntu server :/ | 22:00 |
| *** adiantum has quit IRC | 22:00 | |
| *** rds__ has quit IRC | 22:03 | |
| *** bcwaldon has joined #openstack | 22:11 | |
| *** shawndecuir has left #openstack | 22:11 | |
| btorch | kbringard thanks | 22:12 |
| zaccone | hm, I've got another question. | 22:13 |
| *** adiantum has joined #openstack | 22:13 | |
| zaccone | Whenever I start the system | 22:13 |
| zaccone | I only have one openstack instance that's always in the scheduling state. I then have to use euca-run-instances to run another instance that is running fine. owever every time it has other instance Id (i-000001,2,3,4 etc). and different IP addres. | 22:14 |
| zaccone | How can i automate that process and have the the same instance being run? | 22:15 |
| *** gondoi has quit IRC | 22:16 | |
| *** dmshelton has quit IRC | 22:20 | |
| *** rds__ has joined #openstack | 22:21 | |
| *** bkkrw has quit IRC | 22:30 | |
| *** lvaughn_ has quit IRC | 22:31 | |
| *** fysa has quit IRC | 22:31 | |
| *** bcwaldon has quit IRC | 22:33 | |
| *** kakella has left #openstack | 22:36 | |
| *** MarcMorata has quit IRC | 22:37 | |
| *** Zangetsue has quit IRC | 22:39 | |
| openstackjenkins | Project swift build #234: SUCCESS in 28 sec: http://jenkins.openstack.org/job/swift/234/ | 22:47 |
| openstackjenkins | Tarmac: Now: | 22:47 |
| openstackjenkins | .super_admin may get any user info | 22:47 |
| openstackjenkins | .reseller_admin may not get .reseller_admin info | 22:47 |
| openstackjenkins | .admin may not get .reseller_admin or .admin info | 22:47 |
| openstackjenkins | users can't get any user info | 22:47 |
| *** lvaughn_ has joined #openstack | 22:47 | |
| *** fysa has joined #openstack | 22:47 | |
| *** bcwaldon has joined #openstack | 22:50 | |
| *** troytoman is now known as troytoman-away | 22:51 | |
| *** Ryan_Lane has quit IRC | 22:51 | |
| *** bcwaldon has quit IRC | 22:52 | |
| *** zaccone has quit IRC | 22:53 | |
| *** dendro-afk is now known as dendrobates | 22:55 | |
| *** joearnold has quit IRC | 22:56 | |
| *** adiantum has quit IRC | 23:02 | |
| *** jmaltin has quit IRC | 23:03 | |
| *** nid0 has quit IRC | 23:03 | |
| *** hazmat has quit IRC | 23:04 | |
| *** maplebed has quit IRC | 23:07 | |
| *** Ryan_Lane has joined #openstack | 23:10 | |
| uvirtbot | New bug: #747855 in nova "euca-describe-images shows all glance images as Private" [Undecided,New] https://launchpad.net/bugs/747855 | 23:11 |
| *** adiantum has joined #openstack | 23:15 | |
| *** dragondm has quit IRC | 23:24 | |
| uvirtbot | New bug: #747867 in swift "Replicator double quarantine" [High,Confirmed] https://launchpad.net/bugs/747867 | 23:36 |
| *** troytoman-away is now known as troytoman | 23:41 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!