18:00:39 #startmeeting Keystone 18:00:40 Meeting started Tue Sep 23 18:00:39 2014 UTC and is due to finish in 60 minutes. The chair is morganfainberg. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:00:41 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 18:00:44 The meeting name has been set to 'keystone' 18:00:49 #topic Juno RC1 18:00:59 #link https://launchpad.net/keystone/+milestone/juno-rc1 18:01:02 we're really close! 18:01:13 o/ 18:01:24 Yay! 18:01:32 There are a couple things gating, if all goes well they'll land today, then we can get RC cut. 18:01:40 morganfainberg, those two memcached bugs are fixed by the reivew I just +Aed? 18:01:44 ayoung, yep 18:02:10 morganfainberg: that config option is back now? 18:02:13 \o 18:02:18 #link https://review.openstack.org/#/c/119452/ 18:02:18 dstanek, which one? 18:02:30 morganfainberg: socket_timeout maybe? 18:02:44 wasn't lost in keystone server 18:02:49 the middleware one needs it re-added 18:02:50 morganfainberg: ah ok 18:02:58 is it back in middleware then? 18:03:07 dstanek, it will be when I repost it ;) 18:03:24 morganfainberg: excellent :-) 18:03:31 or when YorikSar does (whichever of us gets to it first today) 18:03:35 #link https://gist.github.com/dolph/651c6a1748f69637abd0 18:03:47 those are the outstanding reviews for blocking keystone / middleware / client 18:04:00 as you might notice, client has none. and 0.11.1 is released! 18:04:12 yay for client 18:04:20 https://review.openstack.org/#/c/106838/ should have been in there 18:04:23 barely broken anything this time. 18:04:25 i'm generally very happy with the pool now that it is based on Queue and not the default - would love to get more eyes on it still 18:04:40 as soon as middleware has those reviews land we'll cut the middleware release. 18:04:59 #topic keystonemiddleware release 18:05:03 bknudson, anything to add? 18:05:14 morganfainberg: nope, just wondering if it was planned 18:05:25 bknudson, as soon as we can be done fighting with the gate. 18:05:40 bknudson, so... today? tomororw? very soon™ 18:05:55 #topic auth_token support identity v3 for service user auth 18:06:00 bknudson, o/ again :) 18:06:21 I get asked a lot about using domains for service users 18:06:29 bknudson, yes 18:06:33 especially since we've got the per-domain backend 18:06:48 but that wouldn't work because you can't set the domain for auth_token 18:06:54 so I proposed a change to support it... 18:07:07 #link https://review.openstack.org/#/c/123011/ 18:07:26 and here's the devstack change to make it easy to configure it: https://review.openstack.org/#/c/123012/ 18:07:43 also, I changed devstack to put all the auth token configuration in one place (in lib/keystone) 18:07:48 bknudson, no 18:08:00 service user auth should be done by plugin 18:08:16 so those should be registered by password auth plugin 18:08:25 gyee: I know it should be... wasn't sure how to do it though 18:08:33 didn't jamielennox have a patch to make auth_token middleware support auth plugin? 18:08:54 bknudson, configure a plugin class 18:09:05 then dynamically local that class and register the params 18:09:28 s/local/load/ 18:09:34 this looks like it: https://review.openstack.org/#/c/115857/ 18:09:41 I'll take a look at that one instead 18:10:13 close, but that patch is not quite doing it right 18:10:26 gyee: https://review.openstack.org/#/c/115857/ isn't right either? 18:10:32 no 18:10:59 the plugin should register whatever params it need 18:11:27 * dwaite waves from the bleachers 18:11:43 alright... let me mark mine wip and take a look at jamie's 18:12:16 we can take this discussion to gerrit 18:12:22 whole point of supporting auth plugin is to allow different auth mechanisms 18:13:34 can we have it pick the auth plugin from the options? 18:13:48 and have all options for all auth plugin options registered? 18:14:01 bknudson, right 18:14:03 lets get bknudson 's chang in, and then debate jamies 18:14:19 I think jamies goes further, but needs some of what is in bknudson 's anyway 18:14:19 ayoung, that's fine, we can do the step approach 18:14:43 if we truly support auth plugin, then do this right 18:14:48 I took off the wip if we're willing to take this step (which is just using v3 password auth instead of v2) 18:15:09 yes, lets 18:16:50 #topic Bug Triage 18:17:11 Ok, so the goal is to get all bugs out of new state for Keystone, Keystoneclient and Middleware 18:17:50 when you triage the bugs, make sure you get the priority and the status set. Once we have the "new" bug list under control I'm planning on firing up a bot that reports new-untriaged bugs once every 2h to the -keystone channel 18:17:58 https://bugs.launchpad.net/keystone/?field.searchtext=&orderby=-importance&search=Search&field.status%3Alist=NEW&field.status%3Alist=CONFIRMED&field.status%3Alist=TRIAGED&field.status%3Alist=INPROGRESS&assignee_option=any&field.assignee=&field.bug_reporter=&field.bug_commenter=&field.subscriber=&field.structural_subscriber=&field.tag=&field.tags_combinator=ANY&field.has_cve.used=&field.omit_dupes.used=&field.omit_dupes=on&field.aff 18:17:58 ects_me.used=&field.has_patch.used=&field.has_branches.used=&field.has_branches=on&field.has_no_branches.used=&field.has_no_branches=on&field.has_blueprints.used=&field.has_blueprints=on&field.has_no_blueprints.used=&field.has_no_blueprints=on 18:18:01 ugh 18:18:08 wow 18:18:18 right now we have ~17 in keystone, 5 in keystoneclient, and 4 in middleware i think 18:18:23 yeah, we need a better way to do that url...one sec 18:19:00 ideally we should never go more than a weekend between a bug report and the bug getting triaged. 18:19:23 http://bit.ly/1pbPPCs 18:19:41 16 new in Keystone 18:19:42 ayoung ftw! 18:19:45 obviously there are a ton of bugs gaining dust in the backlog, i know lbragstad, stevemar, and I have been trying to clean the dead ones up. 18:20:20 but lets focus on getting everything triaged (that means prioritsed and not "new") and we can plan backlog cleanup a little more "as we have time to" 18:20:28 are there any bugs for Juno RC1 needing patches? or it is just matter of reviewing the existent ones? 18:20:45 rodrigods, RC1 is almost complete, should be ready to go today or tomorrow. 18:20:55 i think all the rc1 bugs are completed 18:21:04 great 18:21:10 rodrigods, so unless there is a new bug we need to address, (i hope not!) all are addressed 18:21:36 let's hop not =) 18:21:40 exactly 18:22:04 morganfainberg, do we want to go through the new bugs now or later in -keystone 18:22:21 stevemar, lets see if we have time when we hit the end of the agenda 18:22:24 we probably do have time. 18:22:42 #topic Kilo Summit Sessions Discussion 18:22:50 #link https://etherpad.openstack.org/p/keystone-kilo-summit-sessions 18:23:11 Please file thoughts in the etherpad! we'll use that to help figure out our sessions for the summit. 18:23:18 Looks like there's plenty of ideas for topics 18:23:25 we should have 6 or 7 sessions and either a 1/2 or full day meetup 18:23:37 details are still being worked out so not set in stone. 18:24:13 I'd expect it to be hard to get a lot done in a 1/2 day meedup. 18:24:14 a lot of the ideas can be consolidated into "like" sessions, and anything that is a "yes we should do it" will not be it's own session but maybe a topic we talk about in the hall/pod/meetup 18:24:29 take 1/2 day to figure out what to cover. 18:24:35 are we planning an unconference session in Amsterdam? 18:24:39 bknudson, i think the meetup is meant to be like the pod sessions last time 18:24:50 in atl 18:25:05 morganfainberg, Apparently, when I delete a project in Keystone, The Nova is not notified of this change, so it can not delete their instances and update their quotas. 18:25:05 I saw that there is a notification code in Keystone but I do not know if the problem is that Nova non consumes their notification. 18:25:20 Do you know tell me if this really is a problem, and if it would be possible (or necessary) a design session to discuss how to resolve this? 18:25:36 raildo, notifications need to be turned on and nova needs to listen for them. 18:25:44 ++ 18:25:45 raildo: sounds more like a bug than a design session 18:25:59 raildo, if it isn't working as intended, it is likely a bug 18:26:01 dstanek, OK 18:26:21 same goes with Swift account deletion 18:26:31 and neutron networks 18:26:45 gyee, and barbican secrets? items? whatevet they call them 18:26:53 yes, yes, and yes 18:26:56 and the another thing is I'm proposing a design session about hierarchical projects in cross projects, because we are implementing hierarchical projects in Horizon and we are supporting an implementation in Nova about hierarchical quotas. 18:27:02 #link https://etherpad.openstack.org/p/kilo-crossproject-summit-topics 18:27:16 dstanek, morganfainberg This is the right place to suggest this session? How can I get the Keystone folks "support" to discuss this? 18:27:36 raildo, letting us know here was a good start 18:27:40 raildo, this and the etherpad are absolutely the right place to start talking about it :) 18:28:04 great :) 18:28:34 Question: aren't projects being identified as tenants? 18:28:43 [Forgive the noob] 18:28:49 vdreamarkitex, yep 18:29:02 only on Tuesdays though 18:29:06 thanks for the clarification. 18:29:12 :-) 18:29:15 vdreamarkitex, tenants and projects have been used interchangably. We are trying to standardized on the term projects 18:29:24 vdreamarkitex, they are, forgive the name multitenancy - multiprojectcy actually sounded worse 18:29:43 * ayoung mutters 18:29:45 another great discussion (or not) would be about changing domain_id to parent_project_id =) 18:29:49 rotfl :-) 18:30:16 hah 18:30:31 rodrigods, you mean, making there be no distinction between projects and domains? Making domains top level projects? 18:30:39 rodrigods, i think you would make ayoung happy 18:30:46 * ayoung never happy 18:30:54 * ayoung grump 18:30:57 ayoung, ++ 18:31:01 ayoung, lies, you were happy for a moment when we gated on apache. only a moment though 18:31:18 * ayoung admits did crack smile then 18:31:26 this would be a hot discussion! hahaha 18:31:57 rodrigods, add it to the etherpad, we can discuss at the summit 18:32:04 I thought that was discussed at the last summit -- merging domains and projects 18:32:09 bknudson, it was 18:32:10 the keystone etherpad 18:32:16 bknudson, and i thnk the one before it too 18:32:23 stevemar, will add and let raildo do the honors =) 18:32:24 multidomaincy? 18:32:28 #link https://etherpad.openstack.org/p/keystone-kilo-summit-sessions 18:32:31 gyee, #veto 18:32:36 haha 18:33:04 that one is worse than multiprojectcy 18:33:07 rodrigods, ++ 18:33:30 Hi there 18:33:50 anything else on summit discussions? 18:34:10 morganfainberg, lets just say that there is too much and leave it at that 18:34:10 #topic Open Discussion 18:34:22 Anything else before we head on to bug triaging and the bug report 18:34:47 PTL elections are open. dolphm is not running, morganfainberg is running. If you want to run, throw your name in the hat now 18:34:56 (Sorry I'm french so I don't understand hard sentences :/) 18:34:57 and may god have mercy on your soul..... 18:34:59 (henry joined….apologies for being late) 18:35:05 henrynash, welcome. 18:35:20 c0okie no worries. and welcome 18:35:38 * ayoung not running. 18:35:44 * ayoung running in opposite direction 18:36:20 Thank you morganfainberg :) 18:36:22 * dstanek goes to nominate ayoung for fun 18:36:40 yes, ayoung for president 18:36:45 #topic Bug Triage / Weekly Bug Report 18:36:47 oh, sorry, not that election 18:36:49 stevemar, o/ 18:36:55 or lbragstad o/ 18:36:59 #link http://keystone-weekly-bug-report.tempusfrangit.org/weekly-bug-reports/keystone-weekly-bug-report.html 18:37:09 weekly report is looking good, shortest it's been in weeks 18:37:14 I will take the Sherman approach 18:37:23 so thanks to everyone for stepping up the bug triage 18:37:28 "Spelling error in keystone/common/utils.py" looks pretty bad 18:37:38 bknudson, sev 1 right there 18:37:45 I don't think we need bugs for spelling errors. 18:37:46 bknudson: yes, I know …we’ll have to hold up Juno I think 18:37:50 "If drafted, I will not run; if nominated, I will not accept; if elected, I will not serve." 18:38:08 What's the subject of this discussion ? :x 18:38:28 c0okie, this is a keystone team weekly meeting 18:38:35 lbragstad, what's the criteria used to filter the bugs? 18:38:39 the bug about "glance exploding on config parsing" was an odd one... 18:38:49 Okay thanks 18:38:51 bknudson, agreed. 18:38:56 stevemar: I have a script that scrubs launchpad for bugs every 15 minutes 18:38:57 short of it is that glance would fail in grenade due to running with a really old oslo.config 18:39:06 so it wasn't what you might have expected. 18:39:13 and pulls the latest bugs that are open 18:40:02 stevemar: or in 'New', 'Confirmed', 'Triaged', 'In Progress' states 18:40:48 here are the links i use for open bugs, the URLs are too long for irc: https://gist.github.com/stevemart/f4ccc624a54e18032a3a 18:41:00 here is a current list of bugs that are in "new" state. https://gist.github.com/morganfainberg/7baeb6c97e75b7a2adb5 18:41:05 bknudson: (fyi, the bug reports on spelling mistakes were raised to create some (really) low hanging fruit for first contributors to learn the ropes) 18:41:22 stevemar, hehe 18:41:27 stevemar: nice 18:41:30 * lbragstad bookmarks 18:41:40 morganfainberg, HA 18:42:13 so https://bugs.launchpad.net/keystone/+bug/1368097 looks interesting 18:42:15 Launchpad bug 1368097 in keystone "UnicodeDecodeError using ldap backend" [Low,New] 18:42:18 lbragstad, stevemar, i'll create an auto-updating gist (unless one of you wants to) that has the untriaged bugs. will run it the same way we run the bot once things are sufficiently "not" spammy" 18:42:19 henrynash: ok... Just want people to know I'm not going to -1 because there's no bug for a spelling fix. 18:42:35 stevemar: that's the one i'm looking at now :-) 18:42:36 morganfainberg: cool 18:42:38 bknudson: agreed with that too 18:42:45 hey, are we good with deprecating the CLI altogether and going with the common client? 18:42:48 I'm lost... 18:42:54 I think there are now some things we can only do with common 18:43:03 i think their example is flawed 18:43:20 ayoung: keystone CLI only supports v2, so there's lots of things you can't do 18:43:23 create groups 18:43:27 ayoung, i don't think we can deprecate the CLI *yet*. but i'd defer that convo to jamielennox and stevemar. 18:43:33 ayoung, i'd love for that to happen, but not just yet 18:43:46 the only reason is we need to maintain compatibility for those folks who are on older deployments but use modern clients 18:43:51 ++ 18:43:56 also, I think it's a wider question if unified CLI is considered stable yet. 18:43:57 henrynash: I think a 'low-hanging-fruit' tag got started too, there might be some good stuff in there too for new devs 18:44:16 lbragstad: yep, agreed 18:44:18 I think the keystone CLI is confusing people. They'll keep using it and complaining that it doesn't support some operation until it goes away 18:44:21 morganfainberg, deprecation should be acceptable so long as there is nothing you can do only with the keystone cli. 18:44:27 Let me take that as a todo 18:44:36 ayoung, ++ 18:44:46 bknudson: ++ 18:44:47 first, we should take the todo to remove all references to keystone in our docs. 18:44:57 bknudson, getting there, i'm adding a function test jobs now to make sure we don't regress - but we're super short of people power 18:44:59 first, our own docs 18:45:05 bknudson, +100 on that one 18:45:08 then, the general keystone docs. 18:45:40 stevemar: what do we need to do….can I help? 18:45:49 i think https://bugs.launchpad.net/keystone/+bug/1369401 can be closed as won't fix also, it's v2 related 18:45:51 Launchpad bug 1369401 in keystone "Multiple services with same name and type" [Undecided,New] 18:46:37 jsonschema validation went in for v3 only 18:46:57 stevemar, the reporter says we can mark it wont fix 18:47:07 lbragstad: we should look at integrating json schema and json home. 18:47:15 maybe there's a way to publish the json schema through the json home doc. 18:47:26 bknudson: that's an idea 18:47:28 henrynash, review the current patches, see for yourself if anything *keystone* related is missing. I think a vote of confidence from more cores is what dtroyer is looking for to mark it 1.0 18:47:29 another idea for the summit 18:47:30 bknudson: is someone else doing that? 18:47:38 Zaqar? 18:47:43 stevemar: link? 18:47:46 lbragstad: I think nova is looking at publishing their json schema 18:47:55 lbragstad: but they don't have json home 18:47:55 morganfainberg, marking it appropriately! 18:48:00 stevemar, already done 18:48:03 bknudson: gotcha 18:48:34 does anyone test on DB2? i have no idea how to deal with https://bugs.launchpad.net/keystone/+bug/1340793 18:48:36 Launchpad bug 1340793 in cinder "DB2 deadlock error not detected" [High,Confirmed] 18:48:44 dstanek, bknudson does 18:48:48 as does topol 18:48:53 henrynash, open patches: https://review.openstack.org/#/q/status:open+project:+openstack/python-openstackclient,n,z look for `keystone auth plugins` and `functional tests` 18:49:01 bknudson: publishing there v3 extension schemas/ 18:49:04 ? 18:49:09 dstanek, OTOH, lbragstad, does not test on DB2 anymore 18:49:11 ayoung, this looks like https://bugs.launchpad.net/keystone/+bug/1211586 a spec? is it a bug? 18:49:12 dstanek: since we use oslo.db this should be handled in oslo.db. 18:49:12 Launchpad bug 1211586 in keystone "Disable user lists without a filter" [Wishlist,New] 18:49:28 happy to mark it confirmed if we need it as a bug for tracking. 18:49:37 gotta bail a bit early today... i'll read this when i get back 18:49:47 o\ 18:50:06 bknudson: can it be marked as invalid for keystone then? 18:50:15 morganfainberg, it is a wishlist item...I think that is the appropriate starting place...if the fix got too big, then, yeah , a spec 18:50:24 ok will mark as confirme 18:50:25 d 18:50:38 it really is just to keep people from hanging themselse against slower keystones with large userlists 18:51:05 dstanek: yes, I'll mark it invalid for keystone 18:51:54 ugh, typing openstack with no params drops you into a shell 18:52:11 ayoung: I almost never want that, btw 18:52:30 mordred, you mean sometimes you do? Like, when? 18:53:34 ayoung: never 18:53:47 is openstack an alias for bash now? 18:53:53 #!/usr/bin/openstack 18:53:55 bknudson perhaps tests with DB2? 18:54:01 neutron does the same thing 18:54:10 topol: yes, I can run with db2 pretty easily 18:54:28 ugh. -h doesn't even list the commands, just all of the --os-* flags 18:54:40 lbragstad, this looks like https://bugs.launchpad.net/keystone/+bug/1370022 a wishlist/low since there is a "work around" in the bug 18:54:41 Launchpad bug 1370022 in keystone "Keystone cannot cope with being behind an SSL terminator for version list" [Undecided,New] 18:54:52 Could not load EntryPoint.parse('aggregate_add_host = openstackclient.compute.v2.aggregate:AddAggregateHost') 18:54:56 lbragstad, more of an enhancement to make it more friendly (something worht considering for Kilo) 18:54:59 dstanek: I can't update the status on https://bugs.launchpad.net/keystone/+bug/1340793 , it just times out 18:55:01 lbragstad, thoughts? 18:55:02 Launchpad bug 1340793 in cinder "DB2 deadlock error not detected" [High,Confirmed] 18:55:12 bknudson, yay LP 18:55:28 bknudson, trying to set as invalid? 18:55:41 morganfainberg: yeah, that makes sense 18:55:53 morganfainberg: I tried invalid a few times and also fix released since we've got the change in oslo 18:56:00 morganfainberg: we should be dealing with the header properly, but i can understand not 18:56:11 morganfainberg: oslo-incubator says fix released so we must have picked it up. 18:56:18 bknudson, i just marked it invalid. 18:56:25 morganfainberg: how? 18:56:33 bknudson, LP didn't timeout for me... 18:56:36 bknudson, :P 18:56:41 bknudson, probably dumb luck 18:56:48 * topol morganfainberg mark them ALL invalid :-) 18:57:23 3 minutes left 18:57:25 open a lauchpad bug that launchpad times out. 18:57:28 they probably use bugzilla 18:57:32 lol 18:57:49 bknudson +++ 18:58:28 ok we're at time. 18:58:33 lets continue in -keystone 18:58:37 thanks everyone! 18:58:44 #endmeeting