19:04:19 <lbragstad> #startmeeting keystone-office-hours 19:04:20 <openstack> Meeting started Tue Oct 17 19:04:19 2017 UTC and is due to finish in 60 minutes. The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot. 19:04:21 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 19:04:24 <openstack> The meeting name has been set to 'keystone_office_hours' 19:04:36 <lbragstad> alrighty - who's around? 19:04:41 <cmurphy> o/ 19:04:47 <knikolla> o/ 19:05:11 <lbragstad> awesome - preferences on what you want to do? 19:05:25 <lbragstad> spec review, an implementation review, something focused, bugs? 19:06:01 <knikolla> hmmm.. any priorities? 19:06:04 <cmurphy> did my office hours dashboard break or are there no bug related patches in gerrit right now? 19:06:09 <lbragstad> or we can divide and conquer 19:06:24 <lbragstad> cmurphy: there aren't many patches that close bugs 19:06:32 <lbragstad> we worked through most of them, or they need fixing 19:06:43 <lbragstad> knikolla: anything from the meeting :) 19:07:04 * lbragstad fetches his new favorite link 19:07:08 <lbragstad> #link https://trello.com/b/5F0h9Hoe/keystone?menu=filter&filter=due:week 19:07:43 * cmurphy will go look at project tag things 19:08:00 <lbragstad> awesome - that'd be good 19:09:22 <lbragstad> knikolla: kmalloc would be good to get your opinions on https://review.openstack.org/#/c/505345/1 19:09:42 <knikolla> looking 19:10:30 <gagehugo> o/ 19:10:38 * knikolla will review specs then. if there's any implementation patches that need more eyes give me a ping. 19:10:40 <gagehugo> sorry was reading jwt 19:11:26 <lbragstad> gagehugo: by all means - keep reading JWT 19:11:59 <gagehugo> the spec looks good 19:16:44 <lbragstad> jamielennox: i assume this can be abandon now - https://review.openstack.org/#/c/248524/ ? 19:18:26 <lbragstad> lamt: you had an interest in the ksm+oslo.cache work didn't you? 19:18:32 <lbragstad> lamt: i just stumbled across https://review.openstack.org/#/c/268664/ 19:20:00 <cfriesen> lbragstad: In https://review.openstack.org/#/c/505345/1/specs/keystone/queens/auth-response-restrict-catalog.rs you talk about "getting Morgan's take on this". I don't know who that is. :) 19:20:12 <lbragstad> cfriesen: oh - i'm sorry 19:20:16 <lbragstad> Morgan == kmalloc 19:20:31 <cfriesen> thanks 19:20:42 <lbragstad> cfriesen: yep! spec looks good 19:22:07 <cfriesen> I'll try and respin shortly 19:22:26 <cfriesen> hopefully by tomorrow. 19:33:47 <kmalloc> lbragstad: hehe 19:34:23 <kmalloc> cfriesen: yeah, I had to change my nic to hide ;) 20:06:25 <kmalloc> lbragstad cfriesen: commented 20:06:38 <kmalloc> basically i want some metrics showing the benefit(S) of this filtering being server side. 20:09:19 <kmalloc> and be clear this is *not* to provide added security 20:09:58 <lbragstad> yeah - didn't mean to imply security in my comment 20:10:20 <kmalloc> right, but it highlightsd that people might think it does 20:10:25 <lbragstad> though - in hindsight, it probably came across that way 20:10:30 <kmalloc> we need to be very explicit it provides no added security 20:12:29 <lbragstad> updated my comment 20:17:11 <mike92> Hi. I was wondering if I could ask a question about endpoints in keystone? 20:17:30 <openstackgerrit> Merged openstack/python-keystoneclient master: Use generic user for both zuul v2 and v3 https://review.openstack.org/512509 20:24:07 <lbragstad> mike92: go for it 20:24:46 <mike92> Thanks. In my deployment, the endpoint url has a dynamic hostname in it. Like https://dyndns.com... At some points my keystone config processing, the dns may not be running. In these cases, I want to specify a uri with an explicit ip to the server I know is running the keystone server, like http://127.0.0.1. 20:25:03 <mike92> Previously, I did this with OS_URL and admin_token. I could use OS_URL and it didn't matter what the endpoint in keystone was. Is there something similar I can do in Ocata or Pike? 20:26:05 <mike92> This would be for the openstack command. Previously I set OS_URL and openstack worked fine. Now I have problems because openstack is trying to contact the dyndns address and it's not connecting 20:34:08 <lbragstad> mike92: have you tried using OS_AUTH_URL? 20:34:10 <lbragstad> https://docs.openstack.org/python-openstackclient/latest/cli/authentication.html 20:38:50 <mike92> I do have OS_URL_SET, but openstack tries to use the endpoint in keystone during the communication 20:38:53 <mike92> # echo $OS_AUTH_URL 20:38:53 <mike92> http://127.0.0.1:35357/v3 20:38:53 <mike92> [root@localhost httpd]# openstack --debug endpoint list 20:38:53 <mike92> ... 20:38:53 <mike92> "POST /v3/auth/tokens HTTP/1.1" 201 1044 20:38:54 <mike92> {"token": {"is_domain": false, "methods": ["password"], "roles": [{"id": "03de69ec878843caa16d57c934ede47d", "name": "admin"}], "expires_at": "2017-11-16T20:36:50.000000Z", "project": {"domain": {"id": "default", "name": "Default"}, "id": "2a763d4465b346e4997eb305d3fc87c1", "name": "admin"}, "catalog": [{"endpoints": [{"url": "http://dyndns:35357/", "interface": "admin", "region": null, "region_id": null, "id": "e09499e3203e40198fa42f4f444f599d"} 20:39:00 <mike92> , {"url": "http://dyndns:35357/", "interface": "internal", "region": null, "region_id": null, "id": "dfbd1a6519ab4c658c1d913d2b025379"}, {"url": "http://dyndns:5000/", "interface": "public", "region": null, "region_id": null, "id": "c99f89d7f0a84364868bb12f4570570a"}], "type": "identity", "id": "295eaf6ea94547b4ae770f0bee7c4504", "name": "keystone"}], "user": {"domain": {"id": "default", "name": "Default"}, "password_expires_at": null, "name": "a 20:39:04 <mike92> dmin", "id": "395f1f23859245fe84dd1b056935de87"}, "audit_ids": ["V7RQCtHYRpuJj_y8RXDHBA"], "issued_at": "2017-10-17T20:36:50.000000Z"}} 20:39:07 <mike92> REQ: curl -g -i -X GET http://dyndns:35357/ -H "Accept: application/json" -H "User-Agent: osc-lib/1.7.0 keystoneauth1/3.1.0 python-requests/2.11.1 CPython/2.7.5" 20:39:12 <mike92> Starting new HTTP connection (1): dyndns 20:39:15 <mike92> It tries to contact the dyndns address 20:39:28 <mike92> sorry. I meant I have OS_AUTH_URL set 20:51:59 <lbragstad> oh - that seems openstack-client specific 20:52:15 <lbragstad> ping dtroyer ^ 20:59:23 <dtroyer> OS_URL should only be used if OS_TOKEN is also set, in which case the service catalog is bypassed and OS_URL is used directly to contact the service being used by the command. This breaks down for any command that talks to multiple services (such as looking up names/ID on another API). 21:00:25 <dtroyer> Otherwise we use the Service Catalog to locate the services. 21:01:12 <dtroyer> You may have an option to configure different interfaces (public/admin/internal) and select between thise in the service catalog, say setting internal to the IP address then forcing that when you need it 21:01:52 <openstackgerrit> Merged openstack/keystone master: Add JSON schema validation for project tags https://review.openstack.org/484483 21:03:38 <mike92> that's an interesting idea. I'll see if I can get something like to work in my deployment. 21:11:42 <gagehugo> cmurphy it's been awhile since I've looked at that OSC patch 21:13:27 <cmurphy> :) 21:14:43 <gagehugo> it definitely needs some fixing up 21:15:59 <mike92> Thanks for the help! 21:16:23 <openstackgerrit> Gage Hugo proposed openstack/keystone master: Add project tags api-ref documentation and reno https://review.openstack.org/472396 21:16:33 <cmurphy> gagehugo: i didn't look at much besides the docs, i was just using it to start validating the server code 21:16:55 <gagehugo> cmurphy I think it kinda works if I remember right 21:18:01 <gagehugo> lbragstad https://review.openstack.org/#/c/506751/ 21:19:05 <lbragstad> hmm - those look like legit failures 21:19:37 <gagehugo> yeah 21:20:14 <gagehugo> idk why jenkins/zuul never ran after you last pushed 21:20:32 <gagehugo> that might have been the previous zuul3 attempt 21:43:03 <openstackgerrit> Lance Bragstad proposed openstack/keystone master: Deleting an identity provider doesn't invalidate tokens https://review.openstack.org/512872 21:43:05 <lbragstad> partial fix for a bug ^ 22:00:06 <lbragstad> #endmeeting