| *** r-daneel_ has quit IRC | 00:03 | |
| *** amcrn has joined #openstack-keystone | 00:04 | |
| *** achampion has quit IRC | 00:08 | |
| *** jorge_munoz has quit IRC | 00:12 | |
| *** wwriverrat has quit IRC | 00:21 | |
| *** wwriverrat has joined #openstack-keystone | 00:24 | |
| *** wwriverrat has left #openstack-keystone | 00:25 | |
| *** nkinder_ has joined #openstack-keystone | 00:26 | |
| *** gokrokve has joined #openstack-keystone | 00:29 | |
| *** oomichi has joined #openstack-keystone | 00:34 | |
| *** HenryG has quit IRC | 00:36 | |
| *** rodrigods_ has joined #openstack-keystone | 00:37 | |
| *** marcoemorais has quit IRC | 00:44 | |
| *** david-lyle has quit IRC | 00:50 | |
| *** jorge_munoz has joined #openstack-keystone | 00:51 | |
| morganfainberg | nkinder_, mind taking a look at https://review.openstack.org/#/c/119345/ (LDAP related), more ldap eyes on it would be great. | 01:03 |
|---|---|---|
| morganfainberg | nkinder_, since it's a RC blocker | 01:03 |
| nkinder_ | morganfainberg: sure | 01:03 |
| nkinder_ | morganfainberg: about to eat dinner, but I'll look it over afterwards | 01:03 |
| morganfainberg | it *looks* sane to me. but you know... i'd rather combine my "yeah looks sane" with your ldap expertise | 01:03 |
| morganfainberg | nkinder_, yah np, enjoy dinner and thanks! :) | 01:04 |
| stevemar | nkinder_, morganfainberg definitely need some ldap experts on it :\ | 01:04 |
| nkinder_ | morganfainberg: I thought gyee fixed this as a part of one of his other patches recently | 01:04 |
| morganfainberg | nkinder_, sortof. it's 1/2 fixed this goes the other 1/2 of the way | 01:04 |
| morganfainberg | nkinder_, afaict | 01:04 |
| nkinder_ | morganfainberg: hmm, do you have a link handy to gyee's fix for the other half? | 01:05 |
| morganfainberg | nkinder_, but if it isn't needed, i'm happy as well. :) | 01:05 |
| nkinder_ | no worries if not, I'll hunt it down | 01:05 |
| morganfainberg | nkinder_, i think it was the read-only attr bit | 01:05 |
| morganfainberg | nkinder_, sec. | 01:05 |
| nkinder_ | morganfainberg: yeah, that's the one | 01:05 |
| morganfainberg | nkinder_, https://review.openstack.org/#/c/117658/ | 01:05 |
| nkinder_ | yep | 01:06 |
| gyee | morganfainberg, k, I am familiar with that one | 01:06 |
| gyee | was going to review it last week | 01:06 |
| morganfainberg | nkinder_, really appreciate it :) yeah if both of you review it and it looks good, i'd feel better about getting it merged in | 01:06 |
| morganfainberg | gyee, ^ | 01:06 |
| nkinder_ | morganfainberg: from gyee's commit message - "This patch also added the missing ID attribute when creating an object in LDAP." | 01:07 |
| nkinder_ | I'll compare the code though to make sure | 01:07 |
| morganfainberg | nkinder_, yeah thats what i'm looking for. | 01:07 |
| nkinder_ | stevemar: I plan to dive into setting up federation in the next week or two. I'll likely have some questions pointed your way. | 01:08 |
| nkinder_ | stevemar: just a heads up... | 01:08 |
| morganfainberg | nkinder_, gyee, if it turns out we don't need it i'm going to be happy to punt it from RC | 01:08 |
| gyee | nkinder_, we need that 1/2 fix | 01:08 |
| gyee | our LDAP logic is all over the place | 01:08 |
| *** achampion has joined #openstack-keystone | 01:08 | |
| gyee | ideally all LDAP related stuff are in common/ldap/core.py | 01:09 |
| * morganfainberg plans on spending a lot more time with LDAP next cycle. | 01:09 | |
| morganfainberg | especially since i want to get us testing against a real LDAP impl. | 01:09 |
| gyee | morganfainberg, we should seriously think about retiring read-write LDAP | 01:09 |
| morganfainberg | gyee, things to discuss @ the summit | 01:10 |
| gyee | absolutely! | 01:10 |
| morganfainberg | gyee, i'd actually like to at the very least if we're keeping it make it completly split out as a separate driver. | 01:10 |
| morganfainberg | gyee, rather than inter-mingled. so we can optimise for read-only | 01:10 |
| gyee | yes, and focusing optimizing its performance | 01:10 |
| morganfainberg | yep | 01:10 |
| stevemar | nkinder_, cool with me | 01:11 |
| morganfainberg | stevemar, if you have some spare cycles to mull over things, i'm going to be asking you how we do K2K *real* testing in Kilo :) | 01:12 |
| *** _cjones_ has quit IRC | 01:12 | |
| morganfainberg | stevemar, don't need an answer now, but... :) | 01:12 |
| stevemar | morganfainberg, good, cause I don't have one | 01:12 |
| stevemar | :P | 01:12 |
| morganfainberg | stevemar, hehe | 01:12 |
| *** _cjones_ has joined #openstack-keystone | 01:12 | |
| *** achampion has quit IRC | 01:13 | |
| *** achampion has joined #openstack-keystone | 01:13 | |
| *** oomichi has quit IRC | 01:16 | |
| openstackgerrit | A change was merged to openstack/keystone: Fix minor spelling issues in comments https://review.openstack.org/122990 | 01:16 |
| morganfainberg | hey look stevemar ^ :P | 01:17 |
| stevemar | ZOMG | 01:17 |
| *** _cjones_ has quit IRC | 01:17 | |
| *** gokrokve_ has joined #openstack-keystone | 01:22 | |
| *** gyee has quit IRC | 01:25 | |
| *** gokrokve has quit IRC | 01:25 | |
| *** gokrokve_ has quit IRC | 01:27 | |
| nkinder_ | morganfainberg: I can help you with getting the testing side of that up and running. I've just built a bunch of automation for that sort of thing for my own testing. | 01:29 |
| morganfainberg | nkinder_, sweet. i'm hoping we can follow in the steps of the other functional testing suites | 01:30 |
| nkinder_ | morganfainberg: one of the bugs I fixed a week or two ago has hit quite a number of people running icehouse (it's fixed in stable/icehouse now). It's stuff we could catch with live LDAP testing. | 01:30 |
| morganfainberg | exactly | 01:30 |
| morganfainberg | and i want multi-domain testing as well (per domain backends) etc | 01:30 |
| morganfainberg | so i think we have a lot of improvement we can do. | 01:31 |
| nkinder_ | morganfainberg: also, debugging of LDAP is pretty ugly. I usually resort to packet capture and adding more logging to the code. :( | 01:31 |
| nkinder_ | morganfainberg: we should definitely devote some summit time to discussing this | 01:31 |
| morganfainberg | nkinder_, yep | 01:31 |
| nkinder_ | morganfainberg: I'm in agreement with gyee. We need this additional fix (though I'm still reviewing the whole thing). | 01:32 |
| nkinder_ | morganfainberg: It's catching an issue in the LDAP assignment driver | 01:32 |
| morganfainberg | nkinder_, sounds good. i'll look for your +1. if you +1 and i have a +2 from gyee i feel like that covers the ldap expertise | 01:33 |
| morganfainberg | nkinder_, and the rest of it def. looks "right" | 01:33 |
| openstackgerrit | Dave Chen proposed a change to openstack/keystone: local configuration should be allowed in "keystone-paste.ini" https://review.openstack.org/121439 | 01:33 |
| *** diegows has quit IRC | 01:35 | |
| ayoung-afk | morganfainberg, something is strange. I know I +2ed that review right when I first saw it earlier today | 01:38 |
| *** ayoung-afk is now known as ayoung | 01:38 | |
| morganfainberg | ayoung, the LDAP one? it's had some work done on it today | 01:38 |
| ayoung | morganfainberg, no, bknudson's fix for oslo config | 01:38 |
| ayoung | ah...it was in middleware | 01:39 |
| morganfainberg | oh you +2'd middleware | 01:39 |
| ayoung | not in keystone, that is why | 01:39 |
| morganfainberg | yeah. | 01:39 |
| ayoung | looking at the LDAP one now | 01:39 |
| morganfainberg | ayoung, ah tyvm :) | 01:40 |
| ayoung | morganfainberg, what does he mean by "older LDAPs?" | 01:40 |
| morganfainberg | ayoung, g. OpenLDAP 2.3 | 01:40 |
| ayoung | I mean, this code is from more than three years ago | 01:40 |
| ayoung | morganfainberg, yeah, I meant like time wise. | 01:41 |
| ayoung | where are we now... | 01:41 |
| morganfainberg | i think we may have some changes recently that changed this around. | 01:41 |
| morganfainberg | like some of the refactoring of how we handle things in ldap during juno | 01:41 |
| ayoung | morganfainberg, hmmm | 01:41 |
| morganfainberg | ayoung, it's also specific to emulation enabled afaict | 01:42 |
| morganfainberg | ayoung, which may not be heavily used in the older openldaps | 01:42 |
| ayoung | it seems innocuous | 01:42 |
| morganfainberg | s/in/with | 01:42 |
| ayoung | morganfainberg, yeah...I just worry that this is going to "fix" things for the author and break it for someone else | 01:43 |
| ayoung | I hate that we lack real LDAP testing | 01:43 |
| ayoung | I wonder what the right testing matrix would be? | 01:43 |
| ayoung | OpenLDAP (versions?), FreeIPA, AD. | 01:43 |
| ayoung | I wonder if we could get Microsoft to run an out of tree check job against AD? | 01:44 |
| morganfainberg | ayoung, i think this falls into the "functional" testing bucket. though AD would likely need to be external CI | 01:44 |
| ayoung | maybe alex piloti's team could set it up | 01:44 |
| ayoung | or CERN | 01:44 |
| morganfainberg | ayoung, that would be awesome. maybe not Microsoft, but perhaps one of the companies that is interested in it | 01:44 |
| ayoung | MS is paying more attention | 01:45 |
| ayoung | I went to an OpenStack meetup in the Cambrige office. They had some interesting things going on | 01:45 |
| ayoung | OpenVSwitch running on Microsoft server | 01:45 |
| *** alex_xu has quit IRC | 01:45 | |
| morganfainberg | i'd love them to be directly involved, but if not i think we have some companies that could/would dedicate resources to it | 01:45 |
| ayoung | morganfainberg, primeministerp (Peter Pouliot) works for them | 01:46 |
| morganfainberg | cool | 01:46 |
| ayoung | he's been the guy keeping the HyperV dream alive | 01:46 |
| ayoung | offered to get us some AD licenses etc | 01:46 |
| morganfainberg | def. someone to talk to then. | 01:46 |
| ayoung | they have a slew of internal CI, I'll see if they can run an external AD job. SHoulda thought of that before | 01:46 |
| morganfainberg | would be great to have external CI for that | 01:47 |
| ayoung | ++ | 01:47 |
| morganfainberg | ayoung, I'd also like to see RAX document jython deplopyment of keystone and external CI it. | 01:47 |
| ayoung | ++ | 01:47 |
| ayoung | morganfainberg, "external CI" as a Keystone session at the design summit? | 01:48 |
| morganfainberg | ayoung, i think it's a definite possibility or a "pod" (or whtever the equivalent this time will be) discussion | 01:48 |
| ayoung | morganfainberg, I think that is the ticket...we identify the various LDAP setups we need to test and get someone's name on the line for each | 01:49 |
| morganfainberg | well anything OpenLDAP i want us to gate on as 1st party CI. | 01:49 |
| morganfainberg | but other than that yeah that would be awesome. | 01:49 |
| ayoung | I can talk with RH internal; we already have a CI job (or have at some point) and I can get nkinder_ and our next level boss to put some pressure on to run a FreeIPA based job there | 01:49 |
| morganfainberg | woo :) | 01:50 |
| ayoung | I thinkits time | 01:50 |
| nkinder_ | morganfainberg: reviewed | 01:50 |
| morganfainberg | nkinder_, tyvm! | 01:50 |
| nkinder_ | morganfainberg: Looks good. There's one comment that could be added, but not worth holding things up for it. | 01:50 |
| morganfainberg | nkinder_, ah looks like we're just waiting for a clean "check" run now. | 01:50 |
| nkinder_ | morganfainberg: yeah, it's in the check queue | 01:50 |
| morganfainberg | unless ayoung sees anything glaringly wrong, but ... it *looks* pretty sane, just wasn't sure on the LDAP specifics. | 01:51 |
| nkinder_ | morganfainberg: honestly, AD would be an ideal gate test (and FreeIPA) | 01:51 |
| ayoung | nkinder_, read up...I think we have a plan for dealing with LDAP and all its complexities: | 01:51 |
| morganfainberg | nkinder_, yeah, though AD (due to licensing) would likely nesscitate it being external CI (see scroll back) | 01:51 |
| ayoung | we make an external CI framework for LDAP testing | 01:51 |
| ayoung | and then identify one person at the summit for each variety | 01:52 |
| ayoung | so we'll that the FreeIPA variation, probably get CERN to do AD since they were the driving force behind it, if we can';t get MS to take it | 01:52 |
| ayoung | upstream CI will be run against OpenLDAP and devstack | 01:52 |
| ayoung | morganfainberg, I say we go with the following scenario: | 01:52 |
| nkinder_ | ayoung: yeah. I have automation that builds a complete AD VM setup, a Keystone VM from a fresh RHEL cloud image (full all-in-one RDO install actually), and configures Keystone to use AD with no intervention. | 01:53 |
| ayoung | install is done on SQL. LDAP is mounted in a specific domain with a precanned set of users, and we run the LDAPLiveTests against it | 01:53 |
| nkinder_ | morganfainberg: yeah, if we can get the licensing issue nailed down, it's completely automatable. | 01:53 |
| morganfainberg | nkinder_, nice. | 01:53 |
| morganfainberg | this discussion makes me really happy. | 01:54 |
| ayoung | nkinder_, maybe we can get Oracle to run it: https://twitter.com/RDOcommunity/status/514080480757841921 | 01:55 |
| nkinder_ | ayoung: LOL | 01:55 |
| *** shakamunyi has quit IRC | 01:57 | |
| *** alex_xu has joined #openstack-keystone | 01:59 | |
| *** rodrigods_ has quit IRC | 02:01 | |
| ayoung | morganfainberg, do you have +A ability here https://review.openstack.org/#/c/120261/ | 02:02 |
| ayoung | there are 2 +2s | 02:02 |
| morganfainberg | ayoung, nope. not infra core | 02:02 |
| morganfainberg | ayoung, i *think* this is blocking on the governance change | 02:03 |
| morganfainberg | ayoung, either that... or it's the wrong day for new repos | 02:03 |
| ayoung | morganfainberg, I thought they were waiting a +1 from dolphm | 02:03 |
| morganfainberg | ayoung, yeah. they are on the governance change | 02:03 |
| *** jorge_munoz has quit IRC | 02:03 | |
| *** gordc has joined #openstack-keystone | 02:09 | |
| *** dims_ has quit IRC | 02:15 | |
| *** dims has joined #openstack-keystone | 02:16 | |
| *** amcrn has quit IRC | 02:16 | |
| *** radez_g0n3 is now known as radez | 02:19 | |
| *** dims has quit IRC | 02:20 | |
| *** andreaf has quit IRC | 02:23 | |
| *** andreaf has joined #openstack-keystone | 02:24 | |
| *** jorge_munoz has joined #openstack-keystone | 02:28 | |
| *** jimbaker has quit IRC | 02:40 | |
| *** jimbaker has joined #openstack-keystone | 02:44 | |
| *** jimbaker has quit IRC | 02:44 | |
| *** jimbaker has joined #openstack-keystone | 02:44 | |
| *** soulxu_ has joined #openstack-keystone | 02:45 | |
| *** alex_xu has quit IRC | 02:48 | |
| *** HenryG has joined #openstack-keystone | 02:48 | |
| *** KanagarajM has joined #openstack-keystone | 02:58 | |
| *** KanagarajM has quit IRC | 03:06 | |
| *** richm1 has quit IRC | 03:08 | |
| *** saran has joined #openstack-keystone | 03:16 | |
| *** saran has quit IRC | 03:17 | |
| *** ukalifon3 has joined #openstack-keystone | 03:17 | |
| *** ukalifon1 has quit IRC | 03:19 | |
| *** jorge_munoz has quit IRC | 03:24 | |
| *** ayoung has quit IRC | 03:31 | |
| *** zzzeek has quit IRC | 03:37 | |
| *** morgan_remote_ has joined #openstack-keystone | 03:50 | |
| *** marcoemorais has joined #openstack-keystone | 03:50 | |
| *** marcoemorais1 has joined #openstack-keystone | 03:52 | |
| *** soulxu__ has joined #openstack-keystone | 03:54 | |
| *** marcoemorais has quit IRC | 03:55 | |
| *** soulxu_ has quit IRC | 03:57 | |
| *** vdreamarkitex has quit IRC | 03:58 | |
| *** cjellick has quit IRC | 04:02 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: local configuration should be allowed in "keystone-paste.ini" https://review.openstack.org/121439 | 04:04 |
| *** Sanchit has left #openstack-keystone | 04:16 | |
| *** gokrokve has joined #openstack-keystone | 04:20 | |
| *** vdreamarkitex has joined #openstack-keystone | 04:29 | |
| *** cjellick has joined #openstack-keystone | 04:31 | |
| *** gordc has quit IRC | 04:31 | |
| *** cjellick has quit IRC | 04:35 | |
| *** radez is now known as radez_g0n3 | 04:39 | |
| openstackgerrit | Dave Chen proposed a change to openstack/keystone: local configuration should be allowed in "keystone-paste.ini" https://review.openstack.org/121439 | 04:44 |
| openstackgerrit | Dave Chen proposed a change to openstack/keystone: local configuration should be allowed in "keystone-paste.ini" https://review.openstack.org/121439 | 04:48 |
| *** vdreamarkitex has quit IRC | 04:49 | |
| *** gokrokve_ has joined #openstack-keystone | 04:50 | |
| *** gokrokve has quit IRC | 04:53 | |
| *** _cjones_ has joined #openstack-keystone | 05:11 | |
| *** gokrokve_ has quit IRC | 05:13 | |
| *** gokrokve has joined #openstack-keystone | 05:14 | |
| *** _cjones_ has quit IRC | 05:16 | |
| *** _cjones_ has joined #openstack-keystone | 05:16 | |
| *** gokrokve has quit IRC | 05:18 | |
| *** gokrokve has joined #openstack-keystone | 05:24 | |
| *** vhoward has joined #openstack-keystone | 05:26 | |
| *** harlowja is now known as harlowja_away | 05:31 | |
| *** cjellick has joined #openstack-keystone | 05:31 | |
| *** cjellick has quit IRC | 05:36 | |
| *** cjellick has joined #openstack-keystone | 05:44 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Fix auth_token for old oslo.config https://review.openstack.org/123198 | 05:46 |
| *** rushiagr_away is now known as rushiagr | 05:52 | |
| *** afazekas has joined #openstack-keystone | 05:53 | |
| *** cjellick has quit IRC | 05:56 | |
| *** morgan_remote_ has quit IRC | 06:00 | |
| *** jaosorior has joined #openstack-keystone | 06:05 | |
| *** k4n0 has joined #openstack-keystone | 06:23 | |
| *** amerine has quit IRC | 06:29 | |
| *** andreaf has quit IRC | 06:32 | |
| *** andreaf has joined #openstack-keystone | 06:32 | |
| *** ukalifon3 has left #openstack-keystone | 06:36 | |
| *** drjones has joined #openstack-keystone | 06:38 | |
| *** ukalifon1 has joined #openstack-keystone | 06:39 | |
| *** drjones has quit IRC | 06:40 | |
| *** drjones has joined #openstack-keystone | 06:40 | |
| *** _cjones_ has quit IRC | 06:41 | |
| *** stevemar has quit IRC | 06:43 | |
| *** drjones has quit IRC | 06:44 | |
| *** henrynash has joined #openstack-keystone | 06:45 | |
| *** lufix has joined #openstack-keystone | 06:46 | |
| *** gokrokve_ has joined #openstack-keystone | 06:49 | |
| *** cjellick has joined #openstack-keystone | 06:51 | |
| *** gokrokve has quit IRC | 06:51 | |
| *** gokrokve_ has quit IRC | 06:54 | |
| *** cjellick has quit IRC | 06:56 | |
| *** morgan_remote_ has joined #openstack-keystone | 07:09 | |
| *** andreaf has quit IRC | 07:11 | |
| *** wanghong has quit IRC | 07:11 | |
| *** BAKfr has joined #openstack-keystone | 07:21 | |
| *** gokrokve has joined #openstack-keystone | 07:25 | |
| *** gokrokve has quit IRC | 07:27 | |
| *** gokrokve has joined #openstack-keystone | 07:27 | |
| *** wanghong has joined #openstack-keystone | 07:28 | |
| *** soulxu__ has quit IRC | 07:31 | |
| *** dguitarbite has quit IRC | 07:31 | |
| *** gokrokve has quit IRC | 07:32 | |
| *** marcoemorais1 has quit IRC | 07:33 | |
| openstackgerrit | Dave Chen proposed a change to openstack/keystone: Remove duplicated assertion https://review.openstack.org/123382 | 07:47 |
| *** alex_xu has joined #openstack-keystone | 07:47 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: token signing support alternative message digest https://review.openstack.org/117372 | 07:49 |
| *** cjellick has joined #openstack-keystone | 07:52 | |
| openstackgerrit | Dave Chen proposed a change to openstack/keystone: Remove duplicated assertion https://review.openstack.org/123382 | 07:53 |
| *** cjellick has quit IRC | 07:57 | |
| *** jaosorior has left #openstack-keystone | 07:59 | |
| *** jaosorior has joined #openstack-keystone | 07:59 | |
| *** dguitarbite_ has joined #openstack-keystone | 08:01 | |
| openstackgerrit | A change was merged to openstack/keystone: Fix create and user-role-add in LDAP backend https://review.openstack.org/119345 | 08:01 |
| *** dguitarbite_ is now known as dguitarbite | 08:02 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Do not iterate action.choices if it is none https://review.openstack.org/123016 | 08:02 |
| *** f13o has joined #openstack-keystone | 08:11 | |
| *** f13o has quit IRC | 08:15 | |
| *** f13o has joined #openstack-keystone | 08:15 | |
| *** gokrokve has joined #openstack-keystone | 08:26 | |
| *** gokrokve has quit IRC | 08:31 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Add an extension to store domain specific configuration in SQL. https://review.openstack.org/123238 | 08:34 |
| *** viklund has joined #openstack-keystone | 08:37 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Add an extension to store domain specific configuration in SQL. https://review.openstack.org/123238 | 08:38 |
| *** cjellick has joined #openstack-keystone | 08:53 | |
| *** cjellick has quit IRC | 08:57 | |
| *** morgan_remote_ has quit IRC | 09:10 | |
| *** henrynash has quit IRC | 09:14 | |
| *** KanagarajM has joined #openstack-keystone | 09:26 | |
| *** gokrokve has joined #openstack-keystone | 09:26 | |
| *** gokrokve has quit IRC | 09:30 | |
| *** andreaf_ is now known as andreaf | 09:36 | |
| *** Tahmina has joined #openstack-keystone | 09:43 | |
| *** amakarov_away is now known as amakarov | 09:44 | |
| *** dguitarbite has quit IRC | 09:53 | |
| *** cjellick has joined #openstack-keystone | 09:54 | |
| *** aix has joined #openstack-keystone | 09:57 | |
| *** cjellick has quit IRC | 09:59 | |
| *** henrynash has joined #openstack-keystone | 10:02 | |
| *** junhongl has quit IRC | 10:19 | |
| *** junhongl has joined #openstack-keystone | 10:21 | |
| *** diegows has joined #openstack-keystone | 10:23 | |
| *** dguitarbite has joined #openstack-keystone | 10:25 | |
| *** gokrokve has joined #openstack-keystone | 10:26 | |
| *** ajayaa has joined #openstack-keystone | 10:28 | |
| *** gokrokve has quit IRC | 10:30 | |
| *** soulxu_ has joined #openstack-keystone | 10:34 | |
| *** alex_xu has quit IRC | 10:38 | |
| *** soulxu__ has joined #openstack-keystone | 10:46 | |
| *** soulxu_ has quit IRC | 10:49 | |
| *** henrynash has quit IRC | 10:50 | |
| *** henrynash has joined #openstack-keystone | 10:52 | |
| *** cjellick has joined #openstack-keystone | 10:55 | |
| *** soulxu_ has joined #openstack-keystone | 10:56 | |
| *** cjellick has quit IRC | 10:59 | |
| *** soulxu__ has quit IRC | 10:59 | |
| *** garcianavalon has joined #openstack-keystone | 11:01 | |
| *** soulxu_ has quit IRC | 11:02 | |
| *** soulxu_ has joined #openstack-keystone | 11:02 | |
| *** henrynash has quit IRC | 11:08 | |
| *** achampion has quit IRC | 11:12 | |
| *** vdreamarkitex has joined #openstack-keystone | 11:17 | |
| *** soulxu_ has quit IRC | 11:19 | |
| *** soulxu_ has joined #openstack-keystone | 11:20 | |
| *** amarouni has joined #openstack-keystone | 11:21 | |
| *** dims has joined #openstack-keystone | 11:25 | |
| *** gokrokve has joined #openstack-keystone | 11:26 | |
| *** gokrokve has quit IRC | 11:31 | |
| *** gordc has joined #openstack-keystone | 11:35 | |
| *** lufix has quit IRC | 11:37 | |
| *** samuelmz has joined #openstack-keystone | 11:37 | |
| *** ukalifon1 has quit IRC | 11:46 | |
| *** gordc has quit IRC | 11:51 | |
| samuelmz | dolphm, ping | 11:51 |
| *** ukalifon1 has joined #openstack-keystone | 11:52 | |
| *** cjellick has joined #openstack-keystone | 11:56 | |
| *** cjellick has quit IRC | 12:00 | |
| *** achampion has joined #openstack-keystone | 12:04 | |
| *** k4n0 has quit IRC | 12:09 | |
| *** amarouni has left #openstack-keystone | 12:10 | |
| *** dims has quit IRC | 12:13 | |
| *** dims has joined #openstack-keystone | 12:14 | |
| *** gokrokve has joined #openstack-keystone | 12:26 | |
| *** KanagarajM has quit IRC | 12:29 | |
| *** gokrokve has quit IRC | 12:31 | |
| *** soulxu_ is now known as alex_xu | 12:55 | |
| *** cjellick has joined #openstack-keystone | 12:57 | |
| *** cjellick has quit IRC | 13:01 | |
| *** Tahmina has quit IRC | 13:03 | |
| *** gordc has joined #openstack-keystone | 13:12 | |
| *** zzzeek has joined #openstack-keystone | 13:13 | |
| *** nkinder_ has quit IRC | 13:14 | |
| *** miqui has joined #openstack-keystone | 13:15 | |
| *** alex_xu has quit IRC | 13:24 | |
| chmouel | it's kind of painful to launch the keystonemiddleware unittests these days :( | 13:25 |
| chmouel | (or at least on macosx) | 13:25 |
| *** zzzeek has quit IRC | 13:25 | |
| *** victsou has joined #openstack-keystone | 13:26 | |
| *** topol has joined #openstack-keystone | 13:26 | |
| *** gokrokve has joined #openstack-keystone | 13:26 | |
| *** bknudson has joined #openstack-keystone | 13:28 | |
| *** gokrokve has quit IRC | 13:31 | |
| *** radez_g0n3 is now known as radez | 13:32 | |
| *** stevemar has joined #openstack-keystone | 13:34 | |
| *** ayoung has joined #openstack-keystone | 13:34 | |
| *** vhoward has left #openstack-keystone | 13:35 | |
| *** ajayaa has quit IRC | 13:37 | |
| *** richm has joined #openstack-keystone | 13:38 | |
| chmouel | mhu: http://pastie.org/private/tiarpbno1mt8p4lwmbol9q | 13:38 |
| *** andreaf is now known as andreaf_ | 13:38 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Enumerate Projects with Unscoped Tokens https://review.openstack.org/106838 | 13:47 |
| ayoung | chmouel, always get a little giggle out of that site name. | 13:48 |
| chmouel | ayoung: hahah :) | 13:48 |
| * ayoung reads up | 13:48 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:52 | |
| *** jaosorior has quit IRC | 13:52 | |
| *** ajayaa has joined #openstack-keystone | 13:54 | |
| ayoung | chmouel, tox is not an option on Mac? I know that at least two Keystone core do their work on mac, so I think there is something you are missing | 13:54 |
| ayoung | that looks like it is reading the wrong config. | 13:54 |
| chmouel | ayoung: it wasn't working for me when launching maybe there is some tricks? the paste i sent earlier was on f20 | 13:55 |
| ayoung | how'd you run it? | 13:55 |
| chmouel | ayoung: another colleague launched it on his mac and wasn't working for him either | 13:55 |
| chmouel | tox -epy34 for me tox -epy27 for my colleague (both fails) | 13:55 |
| ayoung | chmouel, how old were the venvs? | 13:57 |
| chmouel | i rm -rf them beforehand | 13:57 |
| chmouel | trying again | 13:57 |
| ayoung | tox -epy27 failed for me, but in a different way. trying with -r | 13:57 |
| *** cjellick has joined #openstack-keystone | 13:57 | |
| *** joesavak has joined #openstack-keystone | 13:57 | |
| *** r-daneel_ has joined #openstack-keystone | 14:00 | |
| ayoung | chmouel, I got the same thing | 14:00 |
| chmouel | ayoung: ah at least i am not the only one :) | 14:00 |
| ayoung | chmouel, I've learned that if you are the one complaining, and I am not seeing the problem, the issue is far morelikely on my side.... | 14:01 |
| ayoung | chmouel, I'm going to guess that this is suspec: commit d281bd25461eda49963522a5bf2583b84bb7d147: Updated from global requirements | 14:02 |
| ayoung | lets see... | 14:02 |
| *** cjellick has quit IRC | 14:02 | |
| chmouel | ah this sounds a god culpurit | 14:02 |
| chmouel | netaddr? | 14:02 |
| ayoung | there are some other recent commits that might also be culpable | 14:02 |
| ayoung | "Always add auth URI to unauthorized requests" | 14:02 |
| ayoung | considering the error is on an url that looks like an authurl check | 14:03 |
| ayoung | File "keystonemiddleware/tests/test_auth_token_middleware.py", line 1317, in test_auth_plugin | 14:03 |
| ayoung | that is | 14:03 |
| chmouel | ah yeah mhu was mentioning this to me offline just before ^ | 14:04 |
| *** nkinder_ has joined #openstack-keystone | 14:04 | |
| *** toysrough has quit IRC | 14:04 | |
| *** gokrokve_ has joined #openstack-keystone | 14:05 | |
| *** mflobo_ has joined #openstack-keystone | 14:05 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/tests/test_auth_token_middleware.py#n1317 | 14:05 |
| morganfainberg | chmouel, as of yesterday i was able to use tox on a mac | 14:06 |
| morganfainberg | chmouel, but.. there is a caveate | 14:06 |
| ayoung | http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/tests/test_auth_token_middleware.py#n62 | 14:06 |
| ayoung | morganfainberg, run with -r | 14:06 |
| ayoung | something has changed, and its not a Mac issue | 14:06 |
| morganfainberg | ayoung, you need to brew install stuff | 14:06 |
| ayoung | it is a kmid | 14:06 |
| ayoung | morganfainberg, its not a mac issue, I have it on F20 | 14:06 |
| morganfainberg | oh that one | 14:06 |
| morganfainberg | oh thats got a fix gating iirc | 14:07 |
| morganfainberg | top of the queue | 14:07 |
| ayoung | sehr kuhl | 14:07 |
| morganfainberg | https://review.openstack.org/#/c/123021/ | 14:07 |
| *** mflobo has quit IRC | 14:07 | |
| *** jsavak has joined #openstack-keystone | 14:07 | |
| chmouel | nice :) | 14:07 |
| morganfainberg | hopefully will merge in 11mins | 14:07 |
| morganfainberg | or so | 14:07 |
| *** achampion has quit IRC | 14:08 | |
| morganfainberg | ayoung, down to 1 review blocking keystone | 14:09 |
| ayoung | which? | 14:09 |
| morganfainberg | memcache pool | 14:09 |
| morganfainberg | https://review.openstack.org/#/c/119452/ | 14:09 |
| ayoung | morganfainberg, I'll trade you a memcache pool for a client review... | 14:10 |
| ayoung | https://review.openstack.org/106838 | 14:10 |
| morganfainberg | ksc is ready for the 0.11.1 release (will ask TTX to cut it in a few minutes unless dolph is around) | 14:10 |
| morganfainberg | ayoung, sure will review that once done with things like release 1-on-one unless dolphm is around doing it. | 14:10 |
| ayoung | Harumph | 14:11 |
| morganfainberg | ayoung, supposed to do the release thing in lik 2 mins :P | 14:11 |
| morganfainberg | or i'd review it now | 14:11 |
| ayoung | fair enough | 14:11 |
| *** joesavak has quit IRC | 14:11 | |
| ayoung | Damn YorikSar you like taking the easy patches don't you? | 14:12 |
| *** achampion has joined #openstack-keystone | 14:12 | |
| chmouel | if someone masterize their py3, encoding, buffer and stuff like that please feel free to advise me about this https://bugs.launchpad.net/keystonemiddleware/+bug/1372484 | 14:12 |
| uvirtbot | Launchpad bug 1372484 in keystonemiddleware "auth_token body errors are not returned as bytes for py34" [Undecided,New] | 14:12 |
| morganfainberg | chmouel, the bug looks legitimate. | 14:13 |
| *** mflobo_ has quit IRC | 14:13 | |
| morganfainberg | chmouel, but i haven't tested it | 14:13 |
| morganfainberg | chmouel, the fix seems... "sane" that is in the bug | 14:13 |
| *** mflobo has joined #openstack-keystone | 14:13 | |
| ayoung | morganfainberg, so there is no pooling library for memcache that we can use? We have to carry this code ourselves? | 14:13 |
| morganfainberg | ayoung, the issue is thread.local | 14:13 |
| chmouel | ah, yeah was trying to send a proper patch but i needed to be able to run the untittests first :) | 14:13 |
| ayoung | of course it is | 14:13 |
| morganfainberg | ayoung, in K we'll convert to pymemcached (and so will dogpile upstream) | 14:14 |
| ayoung | morganfainberg, is this one of those Eventlet only issues? | 14:14 |
| morganfainberg | then we can look at other options. | 14:14 |
| morganfainberg | ayoung, yep | 14:14 |
| *** jsavak has quit IRC | 14:14 | |
| morganfainberg | ayoung, joyous right? | 14:14 |
| ayoung | morganfainberg, OK, I'm digging in. Eventlet is not going to beat me. We are getting rigd of that thinkg in Kilo | 14:14 |
| morganfainberg | ayoung, probably deprecate in K, remove in L or M | 14:15 |
| morganfainberg | but yes. | 14:15 |
| ayoung | morganfainberg, so what is this patch doing to get around threadlocal? | 14:16 |
| morganfainberg | ayoung, it's making a memcache pool that is based on the queue.Queue object (locking across greenthreads) and replaces the base class in memcache client with object | 14:16 |
| morganfainberg | not using thread.local | 14:16 |
| YorikSar | ayoung: Huh? | 14:17 |
| ayoung | YorikSar, looking at your Memcache Pool patch | 14:17 |
| YorikSar | ayoung: Oh, yes, I like to put up couple diff lines | 14:17 |
| ayoung | YorikSar, how does that patch work? | 14:18 |
| YorikSar | ayoung: When user turns on 'memcache_pool' backend for cache and/or memcache token persistence backend, it uses a very special dogpile.cache backend that keeps pool of connections to memcached and reuses them and does some fancy stuff with them | 14:20 |
| ayoung | YorikSar, I don't see enough code to make that happen. Is it in here: https://review.openstack.org/#/c/119452/31/keystone/common/cache/_memcache_pool.py,cm | 14:20 |
| *** david-lyle has joined #openstack-keystone | 14:21 | |
| ayoung | does @contextlib.contextmanager somehow synchronize here? | 14:22 |
| YorikSar | ayoung: No, but Queue does | 14:22 |
| YorikSar | ayoung: We subclass stdlib Queue that does all synchronization for us | 14:23 |
| ayoung | and that ensures that the ref counting to the pool is atomic? | 14:23 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Read idp_metadata_path value from CONF.saml https://review.openstack.org/123446 | 14:23 |
| marekd | stevemar: ^^ | 14:24 |
| morganfainberg | ayoung, yep | 14:24 |
| stevemar | thanks marekd | 14:24 |
| stevemar | morganfainberg, ^ | 14:24 |
| ayoung | YorikSar, morganfainberg what are we modeling as a queue? THe connection pool? | 14:25 |
| morganfainberg | ayoung, correct. | 14:25 |
| ayoung | FIFO? | 14:26 |
| morganfainberg | marekd, stevemar, is that changing the behavior from the last release? | 14:26 |
| ayoung | I guess it makes sense... | 14:26 |
| marekd | no | 14:26 |
| marekd | morganfainberg: no. | 14:26 |
| ayoung | stricter than we need, but who cares | 14:26 |
| stevemar | morganfainberg, no, a bug with k2k | 14:26 |
| morganfainberg | ayoung, hm, it might be using the queue as a stack instead. we had it as a stack when it was the list. | 14:27 |
| morganfainberg | ayoung, it also will reap unused connections | 14:27 |
| morganfainberg | ayoung, after a period of time | 14:27 |
| ayoung | morganfainberg, what performs that operation? | 14:28 |
| ayoung | there is not explicit timer thread | 14:28 |
| morganfainberg | ayoung, on connection release, we look at how long connections are idle in the queue, it's a simple search the queue for the TTL and compare | 14:28 |
| morganfainberg | reap if needed | 14:28 |
| morganfainberg | ayoung, it's part of the context manager. | 14:28 |
| ayoung | morganfainberg, so we clean uop just when there is activity? | 14:29 |
| morganfainberg | ayoung, correct. | 14:29 |
| morganfainberg | ayoung, there is also a maximum size | 14:29 |
| morganfainberg | ayoung, so you don't balloon usage. | 14:29 |
| ayoung | yeah, I see that, and I get it now... | 14:29 |
| rodrigods | makes sense to do something like that https://wiki.openstack.org/wiki/KeystonePerformance after Juno release? | 14:29 |
| ayoung | what is a memcache connection anyway? I'd have thought it to be a TCP socket. Couldn';t we time out the socket it self? | 14:30 |
| ayoung | and wouldn't that be more correct? | 14:30 |
| morganfainberg | ayoung, the memcache client objects are smart, they reconnect | 14:30 |
| morganfainberg | ayoung, among other things, and track dead memcache servers | 14:30 |
| ayoung | morganfainberg, then why even bother to clean up? They can't be that resource intensive | 14:31 |
| ayoung | but cleaning up upon activity seems backwards | 14:31 |
| ayoung | its like, we had a bunch of activilty, so create a bunch of connections...then things die down...then we have a new flurry of activity...and we remove resources? | 14:32 |
| morganfainberg | ayoung, well we only cleanup on release, meaning if there is a bunch of activity the connections will be active again | 14:32 |
| ayoung | ah.... | 14:32 |
| ayoung | what calls release? | 14:32 |
| YorikSar | ayoung: After we had peak of activity, we clean up during usual rare activity | 14:32 |
| YorikSar | ayoung: __exit__ in context manager basically | 14:33 |
| morganfainberg | ayoung, release is the after the yeild in the contextmanager | 14:33 |
| ayoung | what does that map to in keystone? | 14:33 |
| YorikSar | ayoung: And each operation with memcached is wrapped into that context manager. | 14:33 |
| YorikSar | ayoung: Like when dogpile calls 'self.client.set(...)' or .get or whatevet, each operation is wrapped in that context manager | 14:34 |
| YorikSar | ayoung: that acquires Client object from pool, does that operation and releases it back. | 14:34 |
| YorikSar | ayoung: And after that it looks to the bottom of the stack for connections that stay there for too long. | 14:35 |
| morganfainberg | ayoung, in reality, we likely will never see connections disappear with any load on keystone | 14:35 |
| openstackgerrit | Chmouel Boudjnah proposed a change to openstack/keystonemiddleware: Encode middleware error message as bytes https://review.openstack.org/123451 | 14:35 |
| ayoung | YorikSar, sar, so, yeah, its right at a burst of activity. | 14:35 |
| ayoung | morganfainberg, its not a deal breaker, | 14:35 |
| morganfainberg | ayoung, because connections will continue to be used. | 14:35 |
| ayoung | just the same kind of messines we have with the SQL token backend and cleanup: no good time to run it | 14:36 |
| morganfainberg | ayoung, my local testing showed the connections consistently being used with a single thread doing token requests in a tight-ish loop | 14:36 |
| morganfainberg | ayoung, yeah. | 14:36 |
| morganfainberg | ayoung, so i don't think if keystone is under any real load we'll actually see reaping. | 14:37 |
| ayoung | morganfainberg, activity goes in cycles | 14:37 |
| morganfainberg | ayoung, the point is it doesn't take a ton of activity to keep the pool active | 14:37 |
| morganfainberg | ayoung, but it doesn't add significant delays if the pool is active and hitting the maxsize limit unless you're woefully tuned to the low end. | 14:38 |
| ayoung | morganfainberg, model this: 1000 connections. Then idle for an hour, then 1000 connections. | 14:38 |
| morganfainberg | ayoung, in a production environment, you're not going to be idle for an hour, you might see 100rps then 1000rps | 14:38 |
| ayoung | morganfainberg, make sure it is a queue then, not a stack | 14:39 |
| morganfainberg | ayoung, even at 100rps you'll keep the pool mostly active. | 14:39 |
| morganfainberg | ayoung, the reaping is pretty efficient. | 14:39 |
| ayoung | if you do a stack, you'll have one or two entries at the top active, and the bottom will not be cleaned up | 14:39 |
| morganfainberg | ayoung, the cleaner reapse from the left | 14:40 |
| morganfainberg | ayoung, the conenctions are aqcuired from the right (pop) | 14:40 |
| ayoung | nah, do both from the right | 14:40 |
| ayoung | but...not this patch | 14:40 |
| morganfainberg | ayoung, hehe open to modifying this once we're into K | 14:41 |
| ayoung | I think we have something wrong, but I need to think about the right way to do it | 14:41 |
| morganfainberg | also we'll move to pymemcached which eliminates some of the dirty hacks to deal with thread.local | 14:41 |
| ayoung | morganfainberg, this is just how I understand code: | 14:41 |
| morganfainberg | as will dogpile. | 14:41 |
| ayoung | deal | 14:41 |
| morganfainberg | we would have done that this cycle but we were past dep. freeze | 14:42 |
| *** Xeye has joined #openstack-keystone | 14:42 | |
| *** Xeye has quit IRC | 14:43 | |
| morganfainberg | argh1@!@!!!!! | 14:43 |
| *** garcianavalon has quit IRC | 14:44 | |
| morganfainberg | middleware fix didn't pass gate :( | 14:44 |
| YorikSar | ayoung, morganfainberg: We acquire and release conns from/to top of the stack, but do cleanup from the bottom | 14:50 |
| ayoung | YorikSar, the more I think about it, the more I am convinced that there is no right way to do this without having a cleanup thread. Your solution is fine | 14:51 |
| *** andreaf has joined #openstack-keystone | 14:51 | |
| YorikSar | ayoung: I had cleanup thread... But everybody said "We don't want extra threads in Keystone!" | 14:51 |
| ayoung | YorikSar, they are correct | 14:52 |
| morganfainberg | ayoung, i really don't want to start advocating "cleanup" threads as a pattern within keystone. i'd rather not do any cleanup on the stack. | 14:52 |
| ayoung | I think the cleanup is unnecessary if each connection is doing nothing when idle. So long as there is a top number of connections, we are ok | 14:52 |
| ayoung | max out and stay there | 14:52 |
| morganfainberg | since you need to budget resources for maximum number of connections anyway | 14:52 |
| morganfainberg | ayoung, there is a tunable for idle timeout, you could do that effectively by settnig it to some rediculously high number | 14:53 |
| morganfainberg | like 1day | 14:53 |
| ayoung | YorikSar, morganfainberg why is MemcachePool a separate class from ConnectionPool? | 14:54 |
| morganfainberg | ayoung, my view, ease of testing the connection pool. | 14:54 |
| ayoung | k | 14:54 |
| YorikSar | ayoung: To clearly separate functionality. | 14:54 |
| YorikSar | (and tests, right) | 14:55 |
| ayoung | YorikSar, in the future, if you have two classes, keep them as two classes. Favor composition over inheritance | 14:55 |
| YorikSar | ayoung: Well... It's not very clear how we can plug in memcache specifics into abstract pool without weird hooks or smth like that. I prefered to just do inheritance. | 14:57 |
| *** KanagarajM has joined #openstack-keystone | 14:57 | |
| ayoung | YorikSar, you have 3 classes. One is a pool, which manages resources. One is a memcache connections. In between you have an adapter | 14:57 |
| morganfainberg | YorikSar, it wouldn't be too hard. but it's fine as is for now. | 14:57 |
| YorikSar | ayoung: But probably 'MemcacheClientManager' with smth like 'before_acquire' and 'before_release' methods would be better. | 14:57 |
| ayoung | yep...lots of code like this | 14:57 |
| ayoung | and not for this patch | 14:58 |
| ayoung | just for future reference | 14:58 |
| *** andreaf has quit IRC | 14:58 | |
| *** andreaf has joined #openstack-keystone | 14:58 | |
| YorikSar | ayoung: I might put up anoter review for that refactor :) | 14:58 |
| ayoung | YorikSar, after this one merges, please | 14:59 |
| dstanek | morganfainberg: checkout the new middelware version now; so that we can get this going | 14:59 |
| YorikSar | ayoung: Sure | 14:59 |
| dstanek | s/checkout/checking out/ | 14:59 |
| ayoung | dstanek, is that for chmouel 's problem? | 14:59 |
| ayoung | ah...disregard | 14:59 |
| *** jorge_munoz has joined #openstack-keystone | 14:59 | |
| morganfainberg | dstanek, thanks :) | 14:59 |
| morganfainberg | dstanek, it likely needs some adjusting | 14:59 |
| dstanek | ayoung: k - no i was talking about the pool review i -1ed | 15:00 |
| morganfainberg | dstanek, but it should be close, i didn't port the unit tests over, i can do that if needed. | 15:00 |
| dstanek | morganfainberg: is the goal for this to get into oslo post release? | 15:01 |
| morganfainberg | dstanek, possibly. | 15:01 |
| morganfainberg | dstanek, not sure where it'll land long term. | 15:01 |
| YorikSar | morganfainberg: _memcache_pool.py needs to be synched from Keystone version... | 15:01 |
| YorikSar | morganfainberg: I think I can do it later today | 15:01 |
| morganfainberg | YorikSar, i did a sync since you posted. | 15:02 |
| morganfainberg | YorikSar, there are some changes that were needed (notably the debuglogger needed to go because it was too spammy for middleware) etc | 15:02 |
| morganfainberg | YorikSar, and i18n change, etc | 15:03 |
| YorikSar | morganfainberg: Ah, CONNECTION_GET_TIMEOUT is not used in Keystone version anymore... | 15:03 |
| morganfainberg | YorikSar, wait it isn't? | 15:03 |
| morganfainberg | YorikSar, ... | 15:04 |
| morganfainberg | YorikSar, why? | 15:04 |
| morganfainberg | YorikSar, oh no it should be? | 15:04 |
| YorikSar | morganfainberg: No, it's replaced with config value | 15:04 |
| *** ajayaa has quit IRC | 15:05 | |
| morganfainberg | YorikSar, no | 15:05 |
| morganfainberg | YorikSar, in the accquire context manager | 15:05 |
| morganfainberg | oh oh oh that thing | 15:05 |
| morganfainberg | yeah we can clean it up later | 15:05 |
| YorikSar | morganfainberg: self._connection_get_timeout | 15:05 |
| YorikSar | morganfainberg: Yep | 15:05 |
| morganfainberg | YorikSar, yeah we can clean it up later. | 15:05 |
| morganfainberg | YorikSar, scared me for a sec, thought we didn't timeout the acquire! | 15:06 |
| morganfainberg | ever | 15:06 |
| morganfainberg | :P | 15:06 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Server SAML metadata publicly https://review.openstack.org/123466 | 15:07 |
| stevemar | marekd, ^ | 15:07 |
| YorikSar | morganfainberg: Ok, I don't see socket_timeout in middleware | 15:07 |
| YorikSar | morganfainberg: in auth_token.py | 15:08 |
| morganfainberg | YorikSar, it wasn't in the latest post of connection pool | 15:08 |
| marekd | stevemar: thanks | 15:08 |
| marekd | stevemar: did you try it with apache? | 15:09 |
| YorikSar | morganfainberg: It's passed in **self._arguments to memcache.Client | 15:09 |
| stevemar | marekd, yep | 15:09 |
| marekd | ok | 15:10 |
| YorikSar | morganfainberg: It's jsut not present in auth_token's config | 15:10 |
| *** victsou has quit IRC | 15:10 | |
| morganfainberg | YorikSar, ah, thats fine we'll need to add it back in. | 15:10 |
| morganfainberg | YorikSar, might have been dropped in the refactor to make it optional | 15:10 |
| marekd | stevemar: i think there should be a bug against that. | 15:11 |
| YorikSar | morganfainberg: btw, in reserve() we cat remove @contextmanager and just do 'return self._pool.get()' :) | 15:11 |
| morganfainberg | YorikSar, hm. | 15:11 |
| stevemar | marekd, i don't think this one will get in this release :( - unless you think it's critical | 15:11 |
| stevemar | marekd, and yes, needs a bug | 15:12 |
| marekd | stevemar: i don't | 15:12 |
| YorikSar | morganfainberg: So that we return another context manager instead of wrapping it. | 15:12 |
| YorikSar | morganfainberg: But that's not a big issue. | 15:12 |
| marekd | stevemar: this == k2k or this patch? | 15:12 |
| morganfainberg | YorikSar, ah. eyah i see it | 15:12 |
| stevemar | marekd, i wanted to post the fix anyway | 15:12 |
| stevemar | marekd, this patch | 15:12 |
| marekd | stevemar: understood. | 15:12 |
| morganfainberg | marekd, k2k is already in afaict | 15:12 |
| marekd | morganfainberg: yes yes. | 15:12 |
| morganfainberg | marekd, unless there is a damn good reason don't want to revert it :) | 15:12 |
| stevemar | morganfainberg, it may have code to activate skynet | 15:13 |
| morganfainberg | stevemar, REVERT REVERT | 15:13 |
| marekd | morganfainberg: stevemar: yeah, saml2 is skunet's communiation protocol. | 15:14 |
| YorikSar | What's k2k? | 15:16 |
| morganfainberg | YorikSar, keystone to keystone federation | 15:16 |
| YorikSar | morganfainberg: Oh, right. | 15:16 |
| YorikSar | morganfainberg: Cool feature :) | 15:16 |
| morganfainberg | YorikSar, give credit to marekd and stevemar for making it happen | 15:17 |
| YorikSar | marekd, stevemar: Good job :) | 15:18 |
| marekd | YorikSar: thanks, but we will open champagne after it's really deployed in some DCs :-) | 15:19 |
| YorikSar | marekd: Do you have any users in mind? | 15:19 |
| *** cjellick has joined #openstack-keystone | 15:19 | |
| YorikSar | marekd: We have a customer that would need just that... But it's too late - they already getting Icehouse. | 15:20 |
| marekd | YorikSar: Icehouse has also federation built in. | 15:20 |
| YorikSar | marekd: But not k2k | 15:21 |
| marekd | YorikSar: and speaking about specific user...well CERN is very much interested in it :-) | 15:21 |
| YorikSar | marekd: Oh, cool. That means they won't let it rot :) | 15:21 |
| marekd | we should have it deployed soon (Icehouse federation, not k2k). | 15:22 |
| marekd | YorikSar: no, they won't :-) | 15:22 |
| ayoung | how does the whole "multiple servers" work in memcache? Can we assume no degree of ACIDity from the commits? | 15:22 |
| *** joesavak has joined #openstack-keystone | 15:24 | |
| morganfainberg | ayoung, memcached is atomic on the backend, multiple servers endup being a hash/bucket | 15:25 |
| morganfainberg | ayoung, you don't replicate between them. | 15:25 |
| YorikSar | ayoung: memcacged don't have ACID at all. Just simple instructions are atomic, nothing more. | 15:25 |
| YorikSar | Well, there is CAS and stuff, but it's not used in Keystone anymore. | 15:26 |
| *** jsavak has joined #openstack-keystone | 15:26 | |
| morganfainberg | YorikSar, that is a dirty word | 15:26 |
| morganfainberg | YorikSar, :P | 15:26 |
| ayoung | um....so when we have a list of memcached servers to try... | 15:26 |
| morganfainberg | YorikSar, CAS isn't supported by dogpile. | 15:26 |
| ayoung | Close Air Support? | 15:26 |
| morganfainberg | YorikSar, thankfully | 15:26 |
| ayoung | I knew Memcach was dangerous.... | 15:26 |
| morganfainberg | ayoung, it highlights yet again why memcache is awful for token storage | 15:27 |
| morganfainberg | ayoung, for caching, it would be a cache miss at worst | 15:27 |
| YorikSar | ayoung: Compare And Save | 15:27 |
| ayoung | right, I knew that | 15:27 |
| bknudson | compare and set | 15:28 |
| * ayoung was googling the answer but got distracted | 15:28 | |
| ayoung | Clear and Stagger | 15:28 |
| * YorikSar read 'googling' as 'dogpiling' | 15:28 | |
| *** gokrokve_ has quit IRC | 15:28 | |
| morganfainberg | lol | 15:28 |
| ayoung | DOGPILE on the RABBIT! | 15:28 |
| ayoung | morganfainberg, YorikSar ok, last question: a user would have to explicitly enable the pooing, right? | 15:29 |
| YorikSar | ayoung: yep | 15:29 |
| morganfainberg | ayoung, yes. | 15:29 |
| *** joesavak has quit IRC | 15:29 | |
| ayoung | the feature will lay dormant until requested. | 15:29 |
| ayoung | OK...I cant +A | 15:29 |
| morganfainberg | ayoung, it is opt-in only | 15:29 |
| YorikSar | morganfainberg: Ha! I'm first! | 15:29 |
| morganfainberg | YorikSar, faster at the keyboarding! | 15:29 |
| YorikSar | ayoung: Why cant? | 15:30 |
| YorikSar | morganfainberg: Short answers only ;) | 15:30 |
| ayoung | heh | 15:30 |
| morganfainberg | YorikSar, hah | 15:30 |
| ayoung | because I have fat fingers and was typoing *can* | 15:30 |
| YorikSar | ayoung: Wow, you fingers must've covered half the keyboard | 15:30 |
| ayoung | was that muscle memory? Like always typin g after in? | 15:31 |
| ayoung | I can +A | 15:31 |
| ayoung | yeah...the one stray letter on the keyboard that would reverse what I mean.... | 15:31 |
| morganfainberg | ayoung, tyvm for the review. :) i will get that client one reviewed (though I was pretty happy with it earlier when we found the issue with the domain != domain_id) | 15:32 |
| morganfainberg | ayoung, so don't see an issue with the client one as of right now. | 15:32 |
| ayoung | morganfainberg, I think you pushed me toward a better solution on that one | 15:32 |
| ayoung | I ended up moving the code up one layer of the inheritance tree, and now we could potentially use the "fall back to auth_url" approach for other calls. | 15:33 |
| morganfainberg | ayoung, happy to help. ooh i see the fallback_to_auth | 15:33 |
| morganfainberg | ayoung, yeah that is a bit more readable | 15:33 |
| * ayoung likes doing the +A | 15:33 | |
| morganfainberg | yeah | 15:33 |
| YorikSar | ayoung: Yay! THanks :) | 15:34 |
| *** david-ly_ has joined #openstack-keystone | 15:34 | |
| morganfainberg | ayoung, and i think that is the last major RC blocker for keystone. | 15:35 |
| morganfainberg | ayoung, once that gates we should be RC-ready. :) | 15:35 |
| morganfainberg | which means... we might *yet again* be first to the RC race. | 15:35 |
| morganfainberg | :) | 15:35 |
| ayoung | this is my first Keystone release without a huge patch | 15:35 |
| morganfainberg | ayoung, lots of cleanup though | 15:36 |
| *** david-lyle has quit IRC | 15:36 | |
| ayoung | Essex:LDAP....Folsom:PKI Tokens...Grizzly:Restructuring and Trusts...Havana:Split Identity...Icehouse:Revocation Events | 15:37 |
| *** gokrokve has joined #openstack-keystone | 15:37 | |
| *** gyee has joined #openstack-keystone | 15:37 | |
| morganfainberg | ayoung, Kilo... ???? | 15:37 |
| ayoung | Its cuz I've been battling Kerberos | 15:37 |
| ayoung | morganfainberg, for Kilo...endpoint scoping of tokens, I hope | 15:37 |
| morganfainberg | ayoung, ++ | 15:37 |
| ayoung | actually, more than that | 15:37 |
| ayoung | I want a switch that says "unscoped to scoped only" | 15:38 |
| *** jsavak has quit IRC | 15:38 | |
| ayoung | that plus endpoint binding gets us a hugely more secure Keystone | 15:38 |
| morganfainberg | ayoung, and kerberos should be good initially because you've been spending a lot of time wrangling it this cycle. | 15:38 |
| ayoung | heh...you'd thinkso | 15:38 |
| morganfainberg | ayoung, eh, not that it'd be bad, but it means you've spent more time working on it. sometimes that helps when it's massive cross-project stuff | 15:39 |
| ayoung | morganfainberg, we are likely to be introducing a new binding for Python to talk to Kerberos here shortly. Replace python-kerberos with python-gssapi (which is the right interface) and work twoard getting that as core python | 15:39 |
| morganfainberg | so, at the summit looks like we're getting a 6-7 sessions (we had 8 in ATL), and at least a 1/2 day meetup slot (might become a full day instead) | 15:39 |
| ayoung | possibly write a PEP for it | 15:39 |
| ayoung | morganfainberg, CI and testing should be one. We can include any LDAP and Federation details into that | 15:40 |
| morganfainberg | I'm going to start an Etherpad for us here in a minute | 15:40 |
| ayoung | good deal | 15:40 |
| morganfainberg | so we can get discussions going. | 15:40 |
| ayoung | morganfainberg, thank you for running for PTL. | 15:41 |
| morganfainberg | ayoung, of course! | 15:41 |
| *** zzzeek has joined #openstack-keystone | 15:41 | |
| * ayoung would have felt guilty for not running, but really doesn't want the job | 15:41 | |
| morganfainberg | ayoung, i figured you didn't want the job. | 15:41 |
| marekd | morganfainberg: so it's confirmed already? :-) | 15:42 |
| morganfainberg | marekd, nah, still open, if you want to run too go for it ;) | 15:42 |
| marekd | morganfainberg: that was not my point... | 15:42 |
| morganfainberg | marekd, but so far i'm the only candidate | 15:42 |
| marekd | morganfainberg: yeah, i figured. | 15:42 |
| morganfainberg | marekd, wont be official until they open the election on the .. uh 27th? | 15:42 |
| morganfainberg | if i'm the only candidate then, i win, if not election is final early oct | 15:43 |
| marekd | morganfainberg: does it mean hackathons will take place in California? :P | 15:43 |
| morganfainberg | marekd, likely will still be in SAT if dolphm, geekdom, and RAX are kind enough to let us | 15:43 |
| morganfainberg | marekd, it's a good location for us because it has justifications for people to make it (can also do important customer visits) and it's about middle of the country | 15:44 |
| marekd | morganfainberg: and no as expensive as Cal i guess... | 15:44 |
| morganfainberg | marekd, i wouldn't be opposed to looking at hitting up raliegh or boston either if those made sense. I'd need to see about booking space up at HP HQ (bay area) if we were to do it in cali (I don't have an office here in SoCal and the hacker-spaces are ... limited) | 15:45 |
| morganfainberg | marekd, we'll discussit for sure at the summit. | 15:45 |
| marekd | morganfainberg: ++ | 15:46 |
| nkinder_ | ayoung, morganfainberg: https://review.openstack.org/#/c/123488/ | 15:47 |
| ayoung | nkinder_, thanks | 15:49 |
| ayoung | nkinder_, what group has +2 on that? | 15:49 |
| nkinder_ | puppet-core IIRC | 15:49 |
| nkinder_ | ayoung: puppet-manager-core | 15:50 |
| ayoung | nkinder_, I added them | 15:50 |
| nkinder_ | ayoung: "ultra high-scale" :) | 15:50 |
| morganfainberg | ayoung, bknudson, gyee, dolphm, dstanek, stevemar, marekd, nkinder_, lbragstad, henrynash, topol https://etherpad.openstack.org/p/keystone-kilo-summit-sessions | 15:51 |
| *** jasondotstar has joined #openstack-keystone | 15:51 | |
| *** gokrokve has quit IRC | 15:51 | |
| lbragstad | nice | 15:51 |
| ayoung | nkinder_, I think K2K will replace the primary use case we were headed for with PKI tokens. I have to think more about it, but, yeah...right now, I don't think most deployments will hit the casew where token validations are the performance bottleneck | 15:51 |
| nkinder_ | morganfainberg: cool | 15:52 |
| nkinder_ | morganfainberg: have you thought about a federation topic, particularly with how to make it more usable (CLI, Horizon, etc.)? | 15:52 |
| nkinder_ | morganfainberg: it might fall into a cross-project thing with Horizon too though | 15:52 |
| morganfainberg | nkinder_, worth adding to the list for sure. | 15:53 |
| nkinder_ | k, will do | 15:53 |
| morganfainberg | nkinder_, this is just open discussion so we know what we want to cover. it's getting to that time so we should get some ideas in place before scheduling needs to occur. | 15:53 |
| *** achampion has quit IRC | 15:54 | |
| ayoung | Who wrote LDAP rewrite? | 15:54 |
| bknudson | ayoung: me. we've been talking about it for years. | 15:54 |
| ayoung | bknudson, so...how about a different approach | 15:55 |
| *** _cjones_ has joined #openstack-keystone | 15:55 | |
| bknudson | ayoung: splitting it up into read-only/read-write/Active Directory | 15:55 |
| ayoung | bknudson, using SSSD and apache to do the work for us | 15:55 |
| bknudson | I'm happy with a different approach | 15:55 |
| ayoung | bknudson, http://adam.younglogic.com/2014/05/keystone-federation-via-mod_lookup_identity/ look at for conetxt http://adam.younglogic.com/2014/05/mod_lookup_identity/ | 15:56 |
| ayoung | bknudson, and with that setup, we should be able to do SSSD direct to AD. | 15:59 |
| ayoung | nkinder_, can sssd run on a Mac? | 15:59 |
| nkinder_ | ayoung: not sure that's ever been attempted | 15:59 |
| *** rodrigods_ has joined #openstack-keystone | 15:59 | |
| ayoung | nkinder_, might be a deal breaker for devs | 15:59 |
| lbragstad | that etherpad filled up quick | 16:01 |
| morganfainberg | ayoung, we largely don't run OpenLDAP on mac anyway | 16:02 |
| morganfainberg | ayoung, it's not unreasonable to say you can't run the SSSD tests on OS X if they don't work | 16:02 |
| ayoung | morganfainberg, but the LDAP code can run on a Mac today. You might not do it, but I suspect someone does | 16:04 |
| morganfainberg | ayoung, sure. let me check something | 16:05 |
| morganfainberg | ayoung, haven't tried compiling sssd for mac | 16:05 |
| gyee | ayoung, morganfainberg, bknudson, I did setup LDAP auth with Apache before | 16:11 |
| gyee | problem is it has to do it in conjunction with basic auth | 16:11 |
| ayoung | morganfainberg, so the mod lookup idenetiy approach needs dbus support and sssd. I know it runs by default on Fedora etc, and I know Debian based distros can support it. | 16:11 |
| gyee | I had to setup a different endpoint to make it work | 16:11 |
| gyee | like /v3/auth/tokens/ldap or something | 16:12 |
| ayoung | gyee, its really the group list that is the issue | 16:12 |
| bknudson | gyee: that's similar to federation | 16:12 |
| ayoung | with Kerberos or X509 backed by LDAP we have a decent solution | 16:12 |
| gyee | but I totally understand ayoung's thinking when you mentioned /v3/auth/tokens/<mechanism> awhile back | 16:13 |
| ayoung | the one thing that would be good is if we could use the mapping code to add groups to what we get out of LDAP | 16:13 |
| gyee | bknudson, it similar to federation, but I am not sure apache is conveying the attributes in the case of LDAP auth though | 16:14 |
| gyee | like setting the user objectclass attributes in the request environment | 16:15 |
| bknudson | gyee: right, we'd need our own middleware for that | 16:15 |
| gyee | bknudson, no, you don't need middleware, just a new provider, and protocol map | 16:15 |
| gyee | just like federation | 16:15 |
| *** marcoemorais has joined #openstack-keystone | 16:16 | |
| ayoung | morganfainberg, asking about Mac support in #sssd | 16:16 |
| bknudson | gyee: but we don't have the attributes to map? | 16:16 |
| gyee | with basic auth, Apache is already setting the REMOTE_USER | 16:16 |
| morganfainberg | ayoung, cool | 16:16 |
| bknudson | Apache doesn't care about the attributes so it's not going to fetch them. | 16:16 |
| gyee | bknudson, yeah that's a problem | 16:17 |
| bknudson | I think it just does a compare | 16:17 |
| gyee | we need the attributes | 16:17 |
| ayoung | gyee, is that you adding "Signed requests?" | 16:18 |
| gyee | ayoung, no | 16:18 |
| gyee | ayoung, you mean signature auth? | 16:18 |
| morganfainberg | that is me | 16:19 |
| morganfainberg | signed requests like EC2 does with keypairs. | 16:19 |
| gyee | oh, the etherpad | 16:19 |
| gyee | sorry, I need to scroll back | 16:19 |
| ayoung | morganfainberg, do you have a link for that? It might be something I'm working towards, too | 16:21 |
| * ayoung has never worked with EC2. really | 16:21 | |
| morganfainberg | ayoung, it's HMAC signed requests, so you have a keypair and you sign your request, it does require asking for the other info about your auth on the backend though | 16:22 |
| *** wwriverrat has joined #openstack-keystone | 16:22 | |
| morganfainberg | ayoung, let me see if i can find info on it from EC2 | 16:22 |
| ayoung | http://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html ? | 16:22 |
| morganfainberg | ayoung, http://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html | 16:22 |
| *** Haneef has joined #openstack-keystone | 16:22 | |
| ayoung | beat ya too it | 16:23 |
| morganfainberg | hehe | 16:23 |
| ayoung | So...couple problems with that. Nova can't sign a request to glance for you. | 16:23 |
| morganfainberg | ayoung, yeah it might not be a perfect analog. | 16:24 |
| morganfainberg | ayoung, but it might work for the principle request, it's worth exploring (possibly longer term) | 16:25 |
| ayoung | morganfainberg, if my request is synchronos, the server can authenticate me directly. That kind of signing is better for Async, which means it ties in with oslo messaging | 16:25 |
| ayoung | I presented on that last summit. | 16:25 |
| ayoung | but it means we need a mech for Keypair managment. | 16:25 |
| ayoung | The credential API was supposed to be that, no? | 16:26 |
| *** meera has joined #openstack-keystone | 16:26 | |
| *** BAKfr has quit IRC | 16:27 | |
| ayoung | morganfainberg, I wonder if browser based Crypto can be used to sign a request? | 16:29 |
| morganfainberg | interesting thought | 16:30 |
| ayoung | morganfainberg, if so, then a signed request via javascript becomes an alternative | 16:31 |
| morganfainberg | i'll bet javascript could do the work. | 16:31 |
| *** rushiagr is now known as rushiagr_away | 16:31 | |
| *** rushiagr_away is now known as rushiagr | 16:32 | |
| *** rodrigods_ has quit IRC | 16:32 | |
| ayoung | morganfainberg, it might be browser specific | 16:33 |
| *** richm has quit IRC | 16:34 | |
| ayoung | morganfainberg, lets start with this one http://matasano.com/articles/javascript-cryptography/ | 16:34 |
| morganfainberg | ayoung, cool | 16:34 |
| ayoung | morganfainberg, but, I think that Crypto in Javascript and Crypto called from Javascript are two different things | 16:35 |
| ayoung | we only would accept that latter | 16:35 |
| morganfainberg | yeah | 16:35 |
| *** rushiagr is now known as rushiagr_away | 16:36 | |
| morganfainberg | ok i'm going to go get breakfast... | 16:39 |
| morganfainberg | be back before the meeting. | 16:39 |
| *** afazekas has quit IRC | 16:40 | |
| *** arunkant has joined #openstack-keystone | 16:41 | |
| openstackgerrit | Andre Aranha proposed a change to openstack/keystone: Creating a policy sample https://review.openstack.org/123509 | 16:43 |
| afaranha | Reading openstack policies in general, we think that the roles are quite complicated, we don't know which roles are appropriated for each user. For example, in many policies just the admin role is described. Our proposal is to clarify for the cloud user whats the role organizations, for example, cloud_admin is the role for the admins, project_admin for the project admin and project_member a member with a role in a project but with no ad | 16:44 |
| afaranha | The ideia is create a policy.cloudsample.json, where was defined roles as a project_admin, domain_admin, cloud_admin and project_member and determine their permissions, making policies closer to the business reality. | 16:45 |
| afaranha | what do you think about it? | 16:45 |
| morganfainberg | afaranha, how does this compare to http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json ? | 16:46 |
| ayoung | https://developer.mozilla.org/en-US/Persona/Crypto | 16:46 |
| *** richm has joined #openstack-keystone | 16:47 | |
| *** gokrokve has joined #openstack-keystone | 16:48 | |
| afaranha | the roles are more defined | 16:51 |
| afaranha | we have specific roles for the cloud admin, the domain admin, project admin and for a project member | 16:51 |
| morganfainberg | afaranha, right. the cloudsample one should be similar in that regard. | 16:52 |
| afaranha | the sample provided in keystone are only defining the admin role | 16:52 |
| afaranha | there is no separations, in roles, for other kind of users | 16:53 |
| afaranha | except for service role | 16:53 |
| morganfainberg | afaranha, ah i see, | 16:53 |
| morganfainberg | afaranha, i'm not opoosed to having other example policy files, it's worth discussing the merits of having them in-tree, documented, etc. | 16:54 |
| afaranha | one of the motivations for this is that we got confused because there are 2 roles for member in keystone, "_member_" and "Meber" | 16:54 |
| afaranha | yes, sure | 16:55 |
| morganfainberg | afaranha, eventually i'd like to see a richer default policy for keystone, but we need to work on how to provide that without breaking current deployments | 16:55 |
| afaranha | Now we are going to work on the documentation | 16:55 |
| morganfainberg | afaranha, cool | 16:55 |
| afaranha | currently we are submitting a paper to a conference with a use experience with policies in Opensatck | 16:55 |
| afaranha | we are going to create a documentation based on this[ | 16:55 |
| *** lufix has joined #openstack-keystone | 16:55 | |
| *** lufix has quit IRC | 16:56 | |
| *** lufix has joined #openstack-keystone | 16:56 | |
| morganfainberg | afaranha, i look forward to seeing the documentation / paper | 16:56 |
| afaranha | sure, thanks :) | 16:56 |
| afaranha | and we are doing this for the main Openstack policies, Cinder, Nova, Glance and Neutron also | 16:56 |
| afaranha | good to have a good feedback | 16:56 |
| afaranha | morganfainberg: Two problem that we encountered, that is not in this scope, is the sync of the different policies and hardcoded checks, without using the policy permissions | 16:59 |
| ayoung | http://www.w3.org/TR/WebCryptoAPI/ | 16:59 |
| morganfainberg | afaranha, V2 definitely only uses admin. | 17:00 |
| morganfainberg | afaranha, and that isn't going to change. | 17:00 |
| morganfainberg | afaranha, v3 shouldn't have hard-coded checks | 17:00 |
| morganfainberg | afaranha, other openstack projects do have hardcoded "admin" and similar roles | 17:00 |
| afaranha | exactly | 17:01 |
| *** _cjones_ has quit IRC | 17:03 | |
| *** _cjones_ has joined #openstack-keystone | 17:03 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:04 | |
| *** david-ly_ is now known as david-lyle | 17:04 | |
| topol | morganfainberg where on your summit session list would we put Keystone Horizon fedration integration? | 17:04 |
| *** stevemar has quit IRC | 17:04 | |
| *** lufix has quit IRC | 17:05 | |
| topol | federation integration? | 17:05 |
| *** stevemar has joined #openstack-keystone | 17:05 | |
| marekd | topol: i think it's already there - 9.2 | 17:05 |
| gyee | topol, are you guys going to donate a CADF consuming service to Jenkins so we can gate the stuff? | 17:07 |
| *** wwriverrat has left #openstack-keystone | 17:07 | |
| *** rushiagr_away is now known as rushiagr | 17:08 | |
| *** _cjones_ has quit IRC | 17:08 | |
| topol | marekd, good eye. I did not see it. its a long list | 17:08 |
| marekd | topol: lots of cool stuff :-) | 17:09 |
| topol | gyee, I think that is a good idea. Need to understand how much work that is but I really like that idea | 17:09 |
| topol | gyee, I added to the summit session list | 17:11 |
| nkinder_ | topol: yeah, I added the Horizon/Federation topic | 17:11 |
| nkinder_ | topol: I'd like to sync up with you on that ahead of time | 17:12 |
| topol | nkinder_ do we need to clarify between Kerberos and non-Kerberos versions of Horizon/Federation? | 17:12 |
| topol | nkinder_ absolutely, we can syn up anytime | 17:13 |
| nkinder_ | topol: Probably not. I think we can come up with a single solution for both | 17:13 |
| gyee | topol, thanks! auditing is easily the least understood and under appreciated component of AAA | 17:14 |
| gyee | its like AAa | 17:14 |
| marekd | gyee: ++ | 17:14 |
| topol | gyee, we can certainly discuss what we need to do to enhance audit | 17:15 |
| gyee | audit and forensics | 17:16 |
| *** rwsu has quit IRC | 17:17 | |
| *** harlowja_away is now known as harlowja | 17:19 | |
| topol | gyee I was looking for something I can help code in Kilo. | 17:20 |
| topol | gyee sounds like you have some ideas | 17:20 |
| *** _cjones_ has joined #openstack-keystone | 17:22 | |
| *** vhoward has joined #openstack-keystone | 17:23 | |
| gyee | topol, for one, I would love to have the ability to trace an API call | 17:23 |
| *** amcrn has joined #openstack-keystone | 17:23 | |
| topol | gyee, I added a section 15 to the summit session wiki if you want to add stuff to it | 17:24 |
| topol | gyee for audit | 17:24 |
| *** stevemar has quit IRC | 17:31 | |
| *** stevemar has joined #openstack-keystone | 17:32 | |
| gyee | topol, k, I'll add. At the very least, on an update event, we need to know which fields were updated | 17:32 |
| gyee | right now we are just sending a resource ID, which is not good enough | 17:32 |
| *** rwsu has joined #openstack-keystone | 17:36 | |
| morganfainberg | getting food finally should be back for the meeting, if not i might be a minute or two late | 17:37 |
| topol | gyee, cool. Sign me up | 17:40 |
| *** jsavak has joined #openstack-keystone | 17:41 | |
| *** victsou has joined #openstack-keystone | 17:44 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/identity-api: API documentation for Hierarchical Multitenancy https://review.openstack.org/111355 | 17:45 |
| stevemar | jeez this list filled up fast -> https://etherpad.openstack.org/p/keystone-kilo-summit-sessions | 17:45 |
| *** rushiagr is now known as rushiagr_away | 17:46 | |
| gyee | afaranha, welcome to the role management party, its more scary than you think :) | 17:49 |
| gyee | afaranha, https://bugs.launchpad.net/keystone/+bug/890411 for starters | 17:49 |
| uvirtbot | Launchpad bug 890411 in keystone "Tenant role conflicts/overlaps can be a security issue" [Medium,Invalid] | 17:49 |
| *** joesavak has joined #openstack-keystone | 17:49 | |
| *** samuelmz has quit IRC | 17:49 | |
| stevemar | we really need some better CI for keystone :( | 17:52 |
| *** jsavak has quit IRC | 17:52 | |
| dstanek | stevemar: needs to be faster! | 17:55 |
| stevemar | dstanek, sloth life - live slow, die whenever | 17:56 |
| stevemar | i'll escort myself out now | 17:56 |
| dstanek | living the sloth life | 17:57 |
| raildo | stevemar, can I suggest some design session for Kilo in the etherpad? | 17:57 |
| *** rushiagr_away is now known as rushiagr | 17:57 | |
| stevemar | raildo, of course | 17:58 |
| raildo | stevemar, great :) | 17:58 |
| morganfainberg | meeetin time! | 17:59 |
| *** joesavak has quit IRC | 18:02 | |
| *** zzzeek has quit IRC | 18:21 | |
| *** aix has quit IRC | 18:24 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:25 | |
| *** rushiagr is now known as rushiagr_away | 18:30 | |
| *** henrynash has joined #openstack-keystone | 18:34 | |
| henrynash | tahmina: you about? | 18:35 |
| *** victsou has quit IRC | 18:46 | |
| *** Haneef has quit IRC | 18:48 | |
| morganfainberg | down to 10 "new" bugs in keystone https://bugs.launchpad.net/keystone/+bugs?search=Search&field.status=New | 18:59 |
| ayoung | bknudson, morganfainberg, where do the commonclient folks hang out? | 19:01 |
| bknudson | -sdk | 19:01 |
| lbragstad | morganfainberg: nice! | 19:01 |
| ayoung | in #openstack-sdk ? | 19:02 |
| *** ukalifon1 has quit IRC | 19:02 | |
| bknudson | #openstack-sdks | 19:02 |
| morganfainberg | nkinder_, ping re: https://bugs.launchpad.net/keystone/+bug/1209343 is this specific to multi-backend LDAP or *all* ldap? | 19:03 |
| uvirtbot | Launchpad bug 1209343 in keystone "Split backend does not provide ldap.set_option(ldap.OPT_X_TLS_CACERTFILE) for ldaps connections" [Wishlist,In progress] | 19:03 |
| nkinder_ | morganfainberg: checking... | 19:03 |
| morganfainberg | bcause if it isn't *all* ldap it isn't needed for icehouse | 19:03 |
| nkinder_ | morganfainberg: all | 19:04 |
| morganfainberg | ok | 19:04 |
| nkinder_ | morganfainberg: that bug description should be changed | 19:04 |
| morganfainberg | nkinder_, can you do it or does a bug driver need to? | 19:04 |
| morganfainberg | nkinder_, if you can that would be great so we get the right info in it | 19:05 |
| nkinder_ | morganfainberg: ah, I think "split" refers to identity/assignment | 19:05 |
| nkinder_ | morganfainberg: I was thinking "multi" as well... | 19:05 |
| morganfainberg | otherwise let me know what i need to / should change | 19:05 |
| morganfainberg | because it would be good to tag to stable/icehouse if we need it | 19:05 |
| lbragstad | morganfainberg: room subject is now out of date? | 19:05 |
| morganfainberg | this room subject? | 19:05 |
| morganfainberg | nope, still valid till we hit RC. | 19:05 |
| morganfainberg | and middleware isn't released | 19:06 |
| lbragstad | gotcha | 19:06 |
| lbragstad | morganfainberg: do we have to go through all the 'juno-rc-potential' tags now too? | 19:06 |
| nkinder_ | morganfainberg: bug summary updated | 19:06 |
| morganfainberg | lbragstad, we should. | 19:07 |
| nkinder_ | morganfainberg: I've already proposed it for stable/icehouse too | 19:07 |
| lbragstad | https://bugs.launchpad.net/keystone/+bugs?field.searchtext=&orderby=-importance&search=Search&field.status%3Alist=NEW&field.status%3Alist=CONFIRMED&field.status%3Alist=TRIAGED&field.status%3Alist=INPROGRESS&field.status%3Alist=FIXCOMMITTED&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&assignee_option=any&field.assignee=&field.bug_reporter=&field.bug_comment | 19:07 |
| lbragstad | er=&field.subscriber=&field.structural_subscriber=&field.tag=juno-rc-potential+&field.tags_combinator=ANY&field.has_cve.used=&field.omit_dupes.used=&field.omit_dupes=on&field.affects_me.used=&field.has_patch.used=&field.has_branches.used=&field.has_branches=on&field.has_no_branches.used=&field.has_no_branches=on&field.has_blueprints.used=&field.has_blueprints=on&field.has_no_blueprints.used=&field.has_n | 19:07 |
| lbragstad | o_blueprints=on | 19:07 |
| morganfainberg | nkinder_, i saw. | 19:07 |
| morganfainberg | lbragstad, https://bugs.launchpad.net/keystone/+bugs?field.tag=juno-rc-potential | 19:07 |
| lbragstad | morganfainberg: thanks | 19:07 |
| lbragstad | should we add 'juno-backport-potential'? | 19:08 |
| morganfainberg | uh we could. | 19:08 |
| morganfainberg | nkinder_, i tagged that bug to RC fyi | 19:08 |
| *** _cjones_ has quit IRC | 19:08 | |
| nkinder_ | morganfainberg: ok, great | 19:08 |
| dstanek | morganfainberg: checkout the last 2 comments on https://bugs.launchpad.net/keystone/+bug/1354208 | 19:08 |
| morganfainberg | nkinder_, it should land shortly. | 19:08 |
| uvirtbot | Launchpad bug 1354208 in keystone/icehouse "[OSSA 2014-029] Catalog replacement allows reading config (CVE-2014-3621)" [Medium,Fix committed] | 19:08 |
| nkinder_ | morganfainberg: yep, just waiting for the gate | 19:08 |
| morganfainberg | dstanek, oh fun | 19:09 |
| morganfainberg | dstanek, yeah i think we need another patchset that is icehouse specific :( | 19:09 |
| morganfainberg | or uh.. wat it says it merged to icehouse? | 19:10 |
| dstanek | morganfainberg: i had a patch on icehouse already merge | 19:10 |
| morganfainberg | and havana has a merge | 19:10 |
| morganfainberg | so what is he asking? | 19:10 |
| morganfainberg | oh is that a recent "release" of stable? | 19:11 |
| dstanek | is 2014.1.2.1 a previous release of icehouse? that's how i read it | 19:11 |
| morganfainberg | he'd need to get the entire chain | 19:11 |
| morganfainberg | or repackage the patches. | 19:11 |
| nkinder_ | ayoung: https://review.openstack.org/123547 | 19:11 |
| dstanek | morganfainberg: we had lots of churn there, so there may be lots of patches that would need to be included too | 19:12 |
| morganfainberg | nkinder_, bknudson, gyee, ayoung, https://bugs.launchpad.net/keystone/+bug/1358243 this one looks legitimate - makes sense. just trying to get it out of "new" | 19:12 |
| uvirtbot | Launchpad bug 1358243 in keystone "LDAP Critical extension is unavailable 500 error " [Low,New] | 19:12 |
| bknudson | morganfainberg: if you don't want to get the error then don't set the page size | 19:12 |
| bknudson | if you configure to ask for a page size then it seems like it should fail | 19:13 |
| morganfainberg | bknudson, works for me. | 19:13 |
| morganfainberg | bknudson, i would say this really does feel like a "dude you should know your ldap server's limits" | 19:13 |
| bknudson | maybe the docs could describe what's going to happen if you set it. | 19:13 |
| morganfainberg | i can tag it as a docfix instead | 19:13 |
| dstanek | bknudson: so thats configured on the server side to include page size on the query to LDAP? | 19:14 |
| ayoung | nkinder_, why does this require so many changes https://review.openstack.org/#/c/123547/1/spec/classes/keystone_spec.rb,cm ? | 19:14 |
| bknudson | I think so.. check into it | 19:14 |
| nkinder_ | ayoung: those are tests | 19:14 |
| ayoung | nkinder_, were they not there before? | 19:15 |
| morganfainberg | ayoung, https://bugs.launchpad.net/keystone/+bug/1208588 this looks like spec not bug (for sure). | 19:15 |
| uvirtbot | Launchpad bug 1208588 in keystone "Support getting Auth attributes from Kerberos PAC" [Wishlist,New] | 19:15 |
| nkinder_ | ayoung: because only a simple test was there to ensure that pki_setup wasn't run when token_provider=uuid | 19:15 |
| nkinder_ | ayoung: now that we do run pki_setup, we have a matrix of things to check | 19:16 |
| morganfainberg | and something you're currently working on. | 19:16 |
| ayoung | nkinder_, but what about if token_provider=pki | 19:16 |
| nkinder_ | ayoung: those are already there | 19:16 |
| ayoung | that test was there or no? | 19:16 |
| ayoung | so no way to reuse the existing tests? | 19:16 |
| nkinder_ | ayoung: there may be some ruby/spec magic to have a parameter that changes with test iterations | 19:17 |
| nkinder_ | ayoung: I'm not sure how though | 19:17 |
| ayoung | ok....we'll let the maintainer kick it back if there is a problem with duplication | 19:18 |
| nkinder_ | ayoung: I figure a puppet expert will let me know | 19:18 |
| *** Hillary_Effertz5 has joined #openstack-keystone | 19:20 | |
| richm | yes, you can have a test that takes arguments | 19:21 |
| richm | https://review.openstack.org/109676 | 19:22 |
| richm | see keystone_spec.rb | 19:22 |
| richm | you can run a test function in a loop, passing in different parameters each time | 19:23 |
| richm | allowing you to reuse test "functions" | 19:23 |
| *** Hillary_Effertz5 has quit IRC | 19:25 | |
| nkinder_ | richm: hmm, let me see how I would apply that to my tests | 19:26 |
| *** HenryG is now known as HenryG_afk | 19:27 | |
| *** samuelmz has joined #openstack-keystone | 19:28 | |
| gyee | morganfainberg, yes, we need to return a better error message | 19:28 |
| nkinder_ | richm: ok, so take this test example - http://paste.openstack.org/show/114671/ | 19:30 |
| nkinder_ | richm: I want to have a version of it where token_format => 'UUID' | 19:30 |
| nkinder_ | the expectations of the test are the same, but there is a nested test that refers to the PKI provider that woulld need to be the UUID provider if token_format is UUID | 19:32 |
| gyee | morgainfainberg, bknudson, but seriously, that's low priority. They need to upgrade their LDAP server :) | 19:32 |
| *** roock has quit IRC | 19:32 | |
| bknudson | dstanek: oh, you were asking if the server can be configured to support paging or not? I think some servers do have this option | 19:33 |
| gyee | that extension's been around for what, the last 15 years? | 19:34 |
| nkinder_ | morganfainberg, gyee: It should check if paging is supported and skip the control | 19:34 |
| nkinder_ | gyee: simple paged results? Less than that for sure | 19:34 |
| bknudson | you can make the control non-critical and then it won't fail | 19:34 |
| gyee | nkinder_, I thought pagination support's been around for a long time | 19:34 |
| bknudson | but if the user asked for paging and we can't do it then it makes sense for it to fail. | 19:35 |
| nkinder_ | gyee: there are different forms | 19:35 |
| nkinder_ | gyee: VLV allowed paging, then that was deprecated | 19:35 |
| nkinder_ | Simple Paged Results is the current way of doing paging | 19:35 |
| gyee | nkinder_, ah I see | 19:35 |
| *** joesavak has joined #openstack-keystone | 19:36 | |
| bknudson | there's all sorts of reasons to disable paging. it may be hard to implement efficiently / safely | 19:36 |
| nkinder_ | gyee: I suppose it has been 15 years though... | 19:36 |
| gyee | is there a way to discovery that stuff? | 19:36 |
| bknudson | can set yourself up for a DoS attack | 19:36 |
| gyee | via API | 19:36 |
| bknudson | rootDSE might have it | 19:36 |
| openstackgerrit | A change was merged to openstack/keystone: Set LDAP certificate trust options for LDAPS and TLS https://review.openstack.org/120954 | 19:36 |
| *** meera has quit IRC | 19:37 | |
| *** jsavak has joined #openstack-keystone | 19:37 | |
| gyee | bknudson, but that's not a standard right? | 19:37 |
| bknudson | http://msdn.microsoft.com/en-us/library/ms684454%28v=vs.85%29.aspx | 19:37 |
| openstackgerrit | A change was merged to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 19:37 |
| bknudson | I don't think there's a standard covering it | 19:37 |
| *** meera has joined #openstack-keystone | 19:37 | |
| nkinder_ | gyee: search the rootDSE and look for "supportedControl" | 19:37 |
| nkinder_ | AD has rootDSE too IIRC | 19:37 |
| nkinder_ | It is a standard | 19:37 |
| nkinder_ | gyee, bknudson: http://msdn.microsoft.com/en-us/library/ms684291%28v=vs.85%29.aspx | 19:38 |
| bknudson | https://tools.ietf.org/html/rfc2251#section-3.4 -- maybe it is standard? | 19:38 |
| nkinder_ | that answers the AD question | 19:38 |
| bknudson | I guess it's right there in LDAPv3. | 19:38 |
| nkinder_ | bknudson: yep, definitely a standard | 19:39 |
| bknudson | surprised because it seems like most useful things aren't standardized in ldap. | 19:39 |
| *** _cjones_ has joined #openstack-keystone | 19:39 | |
| gyee | nkinder_, nice! here's what I got from our AD | 19:39 |
| gyee | dn: | 19:39 |
| gyee | supportedControl: 2.16.840.1.113730.3.4.18 | 19:39 |
| gyee | supportedControl: 2.16.840.1.113730.3.4.2 | 19:39 |
| gyee | supportedControl: 1.3.6.1.4.1.4203.1.10.1 | 19:39 |
| gyee | supportedControl: 1.2.840.113556.1.4.319 | 19:39 |
| gyee | supportedControl: 1.2.826.0.1.3344810.2.3 | 19:39 |
| gyee | supportedControl: 1.3.6.1.1.13.2 | 19:39 |
| gyee | supportedControl: 1.3.6.1.1.13.1 | 19:39 |
| gyee | supportedControl: 1.3.6.1.1.12 | 19:39 |
| gyee | # search result | 19:39 |
| gyee | search: 2 | 19:40 |
| gyee | result: 0 Success | 19:40 |
| gyee | # numResponses: 2 | 19:40 |
| gyee | # numEntries: 1 | 19:40 |
| morganfainberg | dstanek, is this still an issue: https://bugs.launchpad.net/python-keystoneclient/+bug/1260495 ? | 19:40 |
| uvirtbot | Launchpad bug 1260495 in pbr "Setting autodoc_tree_index_modules makes documentation builds fail" [Undecided,In progress] | 19:40 |
| *** joesavak has quit IRC | 19:40 | |
| morganfainberg | dstanek, or can i mark it as "invalid" now. | 19:40 |
| dstanek | morganfainberg: yes, it's still an issue | 19:40 |
| *** _cjones_ has quit IRC | 19:40 | |
| dstanek | morganfainberg: let me run a quick test though | 19:40 |
| morganfainberg | dstanek, ok marked as confirmed | 19:41 |
| *** _cjones_ has joined #openstack-keystone | 19:41 | |
| morganfainberg | dstanek, close it if it isn't | 19:41 |
| gyee | got the same list from m own OpenLDAP as well | 19:41 |
| nkinder_ | gyee: 1.2.840.113556.1.4.319 is simple paged results | 19:41 |
| nkinder_ | gyee: you wouldn't want to lookup the rootDSE every time you do a search though... | 19:42 |
| bknudson | at least it's easy to remember :) | 19:42 |
| bknudson | if it's optional then mark the server control as not critical | 19:43 |
| gyee | nkinder_, I mean we can query that information once at startup | 19:43 |
| gyee | if server doesn't support the extension, they put a nice warning message in the log | 19:44 |
| nkinder_ | gyee: yep, that would do just fine | 19:44 |
| morganfainberg | lbragstad, ok lets do a quick once over on the RC-potentials | 19:44 |
| morganfainberg | lbragstad, we are within 2 things merging to be RC ready, so we should make sure things aren't *actually* blockers | 19:44 |
| morganfainberg | lbragstad, e.g. https://bugs.launchpad.net/keystone/+bug/1370492 | 19:44 |
| uvirtbot | Launchpad bug 1370492 in keystone "calling curl "HEAD" ops time out on /v3/auth/tokens" [Medium,Confirmed] | 19:45 |
| morganfainberg | lbragstad, so we have doc bugs, do we push those through for RC (mostly doc bugs are still open | 19:46 |
| morganfainberg | nkinder_, can i borrow you for a sec? :) | 19:47 |
| nkinder_ | gyee, morganfainberg: Just added a comment to the LP with the recommended approach for a fix | 19:47 |
| nkinder_ | morganfainberg: sure, what's up? | 19:47 |
| morganfainberg | nkinder_, https://review.openstack.org/#/c/118590/ | 19:47 |
| morganfainberg | nkinder_, that is tagged as RC potential | 19:47 |
| morganfainberg | nkinder_, doing the last once over on RC blockers seeing if we need to get them in. | 19:48 |
| nkinder_ | morganfainberg: Yeah, I've looked that one over in detail previously (and discussed it with the developer) | 19:49 |
| morganfainberg | nkinder_, i'm happy to move it out of RC potential, but this one I'm not getting the full story on | 19:50 |
| nkinder_ | morganfainberg: my take is that much of it isn't really necessary | 19:50 |
| nkinder_ | morganfainberg: so here's the deal... | 19:50 |
| nkinder_ | We have the ability to create additional mappings. This was added to allow keystone to supply required attributes during LDAP entry creation (to satisfy schema/objectclass requirements) | 19:50 |
| morganfainberg | right | 19:51 |
| morganfainberg | that much i'm familir with | 19:51 |
| nkinder_ | morganfainberg: for example, if keystone uses 'uid' and 'cn' for 'id' and 'name', we might also need to supply 'sn' to satisfy LDAP | 19:51 |
| morganfainberg | yep | 19:51 |
| nkinder_ | So much of this change is to require/expect those additional mapped attributes to be returned form a search request | 19:52 |
| nkinder_ | So in the previous example, we would now request for uid, cn, and sn to be returned | 19:52 |
| nkinder_ | even though we never use sn for anything | 19:52 |
| morganfainberg | oh | 19:52 |
| nkinder_ | I don't think it's necessary | 19:52 |
| morganfainberg | nkinder_, ok i'll take the RC potential tag off, we can look into it being something we want in K, or even bits of it in K if that makes sense | 19:53 |
| nkinder_ | morganfainberg: +1 | 19:53 |
| nkinder_ | morganfainberg: there may be other stuff of value in there too though. Let me finish giving it another once-over | 19:53 |
| morganfainberg | right not abandoning, just making it non-RC | 19:54 |
| lbragstad | morganfainberg: on https://bugs.launchpad.net/keystone/+bug/1370492 | 19:55 |
| uvirtbot | Launchpad bug 1370492 in keystone "calling curl "HEAD" ops time out on /v3/auth/tokens" [Medium,Confirmed] | 19:55 |
| nkinder_ | morganfainberg: yeah, it's only adding validation for those additional mapped attribute. I don't think it's needed at all, but we should discuss it further with the developer who proposed it. | 19:55 |
| morganfainberg | lbragstad, that is the only thing on the RC list that worries me | 19:55 |
| lbragstad | I opened up an issue against WebOb | 19:55 |
| morganfainberg | lbragstad, ok so we "can't" do anything about it? | 19:56 |
| morganfainberg | no workarounds? | 19:56 |
| lbragstad | morganfainberg: not that I've discovered yet | 19:56 |
| morganfainberg | ugh | 19:56 |
| lbragstad | besides not doing HEAD requests ;) | 19:56 |
| morganfainberg | so.. we're "broken" in eventlet V3? since HEAD is used for token validation? | 19:57 |
| bknudson | lbragstad morganfainberg: the curl command says don't do -X HEAD | 19:57 |
| morganfainberg | oh hah | 19:57 |
| morganfainberg | -X HEAD whoa | 19:57 |
| lbragstad | bknudson: where/ | 19:57 |
| bknudson | morganfainberg: lbragstad: use -i or --head | 19:57 |
| morganfainberg | his option only changes the actual word used in the HTTP request, it does not alter the way curl behaves. So for example if you want to make a proper HEAD request, using -X HEAD will not suffice. You need to use the -I, --head option. | 19:58 |
| bknudson | if there's a bug here it's in curl, which shouldn't allow -X HEAD | 19:58 |
| openstackgerrit | David Stanek proposed a change to openstack/python-keystoneclient: Removes temporary fix for doc generation https://review.openstack.org/121667 | 19:58 |
| * lbragstad sigh | 19:58 | |
| dstanek | morganfainberg: yeah still an issue | 19:58 |
| morganfainberg | dstanek, ok | 19:59 |
| *** jsavak has quit IRC | 19:59 | |
| * lbragstad facepalm | 19:59 | |
| morganfainberg | lbragstad, marking as invalid. | 19:59 |
| dstanek | morganfainberg: i don't think anyone else believes me though | 19:59 |
| morganfainberg | lbragstad, help me look ones more over the "new" bugs | 20:05 |
| morganfainberg | lbragstad, i think these are all non-RC https://bugs.launchpad.net/keystone/+bugs?search=Search&field.status=New | 20:05 |
| morganfainberg | dstanek, if it helps i belive you :) | 20:07 |
| *** marcoemorais has quit IRC | 20:11 | |
| lbragstad | morganfainberg: thanks for marking invalid, | 20:12 |
| lbragstad | I updated with my comments and verified that --head works | 20:13 |
| morganfainberg | i did actually confirm it worked properly as well | 20:13 |
| morganfainberg | :P | 20:13 |
| morganfainberg | before makring invalid | 20:13 |
| * lbragstad feels silly for not reading the man page | 20:13 | |
| bknudson | webob could handle this better... dos if it leaves the connection open | 20:13 |
| bknudson | or is it eventlet? | 20:13 |
| morganfainberg | bknudson, there is the greenlet issue too | 20:13 |
| morganfainberg | bknudson, yeah eventlet | 20:13 |
| lbragstad | morganfainberg: https://bugs.launchpad.net/keystone/+bugs?search=Search&field.status=New are all open, and non RC-blocking, right? | 20:14 |
| morganfainberg | lbragstad, none look RC-blocky | 20:14 |
| morganfainberg | lbragstad, but wanted a second pair of eyes on them | 20:14 |
| bknudson | you're asking for it if you put an eventlet server on the internet. | 20:14 |
| lbragstad | morganfainberg: ok, checking | 20:14 |
| morganfainberg | bknudson, +++ | 20:14 |
| morganfainberg | bknudson i mean we could disable keepalives :( | 20:14 |
| *** amakarov has quit IRC | 20:17 | |
| *** radez is now known as radez_g0n3 | 20:18 | |
| lbragstad | nkinder_: ayoung bknudson ldap question, | 20:20 |
| lbragstad | should this be something we include for RC? https://bugs.launchpad.net/keystone/+bug/1366020 | 20:20 |
| uvirtbot | Launchpad bug 1366020 in keystone "LDAP Identity does not convert ID to DN for lookup" [Undecided,New] | 20:20 |
| *** amakarov has joined #openstack-keystone | 20:21 | |
| stevemar | ayoung, just finished reading the meeting logs, file bugs against OSC if you don't like the usability! please please | 20:22 |
| samuelmz | morganfainberg, could you take a look at bug #1373113 and possibly confirm it? | 20:22 |
| uvirtbot | Launchpad bug 1373113 in keystone "Wrong exception when deleting a domain group assignment using a not domain-aware backend" [Undecided,New] https://launchpad.net/bugs/1373113 | 20:22 |
| *** zzzeek has joined #openstack-keystone | 20:23 | |
| rodrigods | marekd, ping | 20:23 |
| rodrigods | or stevemar =) | 20:23 |
| *** amerine has joined #openstack-keystone | 20:23 | |
| stevemar | rodrigods, pong | 20:24 |
| rodrigods | stevemar, was taking a look at k2k patches, and didn't understand why this one was abandoned: https://review.openstack.org/#/c/104623/ | 20:24 |
| bknudson | lbragstad: there's no fixed proposed for it. | 20:25 |
| rodrigods | don't know much about websso, i guess | 20:25 |
| mfisch | nkinder_ has the best commit messages | 20:26 |
| *** gokrokve has quit IRC | 20:26 | |
| samuelmz | lbragstad, ping | 20:26 |
| nkinder_ | mfisch: I'm wordy... :) | 20:26 |
| lbragstad | bknudson: yeah, which is why I was asking. Would it be something we need to release | 20:26 |
| morganfainberg | samuelmz, that looks legitimate | 20:26 |
| *** gokrokve has joined #openstack-keystone | 20:26 | |
| mfisch | nkinder_: I' | 20:26 |
| bknudson | lbragstad: consider how long we've been living with this I'd say no. | 20:27 |
| mfisch | nkinder_: I'm +1 on both reviews and thanks for looking at it, having developers look at the puppet modules is a big help | 20:27 |
| lbragstad | bknudson: ok | 20:27 |
| mfisch | things (like what you changed) get missed | 20:27 |
| nkinder_ | mfisch: awesome. Thanks for the reviews! | 20:27 |
| samuelmz | morganfainberg, ok I'm gonna fix this .. just need you to confirm it :-) | 20:27 |
| nkinder_ | mfisch: richm has some out there for deploying keystone in httpd | 20:27 |
| lbragstad | bknudson: fair enough, wanted to run it by the ldap savvy guys | 20:27 |
| nkinder_ | mfisch: not sure if you've looked at those, but that is important since httpd is the prefered deployment method now | 20:28 |
| morganfainberg | samuelmz, go ahead and fix. the moment you post the code it'll go to "in progress" | 20:28 |
| nkinder_ | mfisch: https://review.openstack.org/#/c/109676 | 20:28 |
| ayoung | stevemar, I think the problem is not usability (there might be some of that) but that I have a broken install | 20:29 |
| stevemar | rodrigods, we decided we didn't need a whole just to save service providers - since it's just a name and url | 20:29 |
| stevemar | ayoung, ahhh update to latest, got some new stuff in there | 20:29 |
| marekd | rodrigods: hello | 20:29 |
| samuelmz | morganfainberg, ok thanks | 20:29 |
| mfisch | nkinder_: I'll bring this up to colleen | 20:29 |
| marekd | rodrigods: looks like stevemar answered your questiong. | 20:29 |
| stevemar | ayoung, but honestly if you find anything wrong let me know or file a bug, the more proponents we have for osc the better | 20:29 |
| marekd | question | 20:30 |
| nkinder_ | mfisch: awesome, thanks | 20:30 |
| rodrigods | ayoung, I'm having issues as well. It works when I revert the session.Session commit | 20:30 |
| stevemar | ayoung, i'll fix it double time | 20:30 |
| ayoung | stevemar, we should probably add --interactive and have a no-arg call be the same as -h | 20:30 |
| ayoung | lbragstad, fire away (was away from my desk) | 20:30 |
| rodrigods | marekd, stevemar, so... they will only be regions? | 20:31 |
| nkinder_ | mfisch: if you don't mind, mention this related upstream puppetlabs change too - https://github.com/puppetlabs/puppetlabs-apache/pull/852/ | 20:31 |
| stevemar | rodrigods, yep | 20:31 |
| lbragstad | ayoung: was wondering if we should target https://bugs.launchpad.net/keystone/+bug/1366020 to a RC but, based on the above from bknudson, we're going to hold off. | 20:31 |
| uvirtbot | Launchpad bug 1366020 in keystone "LDAP Identity does not convert ID to DN for lookup" [Undecided,New] | 20:31 |
| rodrigods | stevemar, ahh ok, thanks =) | 20:31 |
| *** amcrn has quit IRC | 20:32 | |
| *** gokrokve has quit IRC | 20:32 | |
| *** gokrokve has joined #openstack-keystone | 20:33 | |
| ayoung | lbragstad, yeah...I filed that one, and still not sure how I feel about it | 20:34 |
| lbragstad | ayoung: we'll leave it as is for now | 20:35 |
| *** marekd is now known as marekd|away | 20:45 | |
| *** marcoemorais has joined #openstack-keystone | 20:46 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/keystone: Fix exception delete domain group grant in LDAP https://review.openstack.org/123585 | 20:53 |
| morganfainberg | samuelmz, i think we need a test for that as well | 20:55 |
| morganfainberg | samuelmz, so we can make sure it doesn't crop back up | 20:55 |
| mfisch | nkinder_: I've pinged the new community organizer person, she's giving a talk now I suspect. You can always drop by #puppet-openstack, we won't make you become a sysadmin or anything ;) | 20:57 |
| ayoung | stevemar, argparse comes from python-libs-2.7.5-11.fc20.x86_64 which is base Python...the error with the common client impliest an issue with python...are you testing 2.7 or 3.4? | 20:57 |
| stevemar | ayoung, i am using 2.7 in my dev. env. but we gate against 2.7 and 3.3 | 20:58 |
| morganfainberg | mfisch, i'm still scared of being asked devopsy questions :P ;) | 21:00 |
| morganfainberg | mfisch, i mean >.> .... | 21:00 |
| * mfisch nominates morganfainberg to give a talk on keystone at the next operators summit | 21:00 | |
| morganfainberg | OH NOES! | 21:01 |
| ayoung | mfisch, he gets to do the STATE OF THE KEYSTONE talk! | 21:01 |
| ayoung | Assume he gets elected | 21:01 |
| morganfainberg | ayoung, hey, that isn't a guarantee yet | 21:01 |
| *** gokrokve has quit IRC | 21:01 | |
| mfisch | I've not received any bribes yet for votes | 21:01 |
| ayoung | but everyone is saying "Not me!" | 21:01 |
| mfisch | +2s for votes | 21:01 |
| morganfainberg | ayoung, i think it's a webcast these days not a "talk" | 21:01 |
| *** meera has quit IRC | 21:02 | |
| *** meera has joined #openstack-keystone | 21:02 | |
| *** marcoemorais has quit IRC | 21:06 | |
| *** marcoemorais1 has joined #openstack-keystone | 21:06 | |
| *** stevemar has quit IRC | 21:13 | |
| ayoung | bknudson, morganfainberg, lbragstad can you guys pie on this review https://review.openstack.org/#/c/120310/ for | 21:17 |
| ayoung | creating the kerberos plugin repo | 21:17 |
| bknudson | ayoung: what's it for? Is there code already? | 21:18 |
| ayoung | governance | 21:18 |
| ayoung | let me bug ttx | 21:18 |
| *** gordc has quit IRC | 21:20 | |
| morganfainberg | ayoung, they're mostly waiting for dolphs "yep" on it afaict. | 21:23 |
| ayoung | morganfainberg, yeah | 21:23 |
| ayoung | morganfainberg, looking for the IRC log where he gave it the thumbs up | 21:23 |
| ayoung | must not have been in a meeting | 21:23 |
| morganfainberg | nope | 21:23 |
| bknudson | they were asking dolphm to +1 it | 21:23 |
| *** vhoward has left #openstack-keystone | 21:24 | |
| samuelmz | morganfainberg, yes sure ... tests are coming with the patch for bug #1367480 | 21:25 |
| uvirtbot | Launchpad bug 1367480 in keystone "Add test for grant CRUD on test_backend" [Low,Confirmed] https://launchpad.net/bugs/1367480 | 21:25 |
| morganfainberg | k | 21:25 |
| *** arosen has joined #openstack-keystone | 21:33 | |
| ayoung | morganfainberg, do you recall when we made the decision to go with a separate repo? | 21:33 |
| morganfainberg | uh, was right around the time jamie posted those | 21:33 |
| arosen | dtroyer: any idea about this? http://paste.openstack.org/show/114705/ | 21:33 |
| ayoung | must have been 2014-09-09 | 21:34 |
| dtroyer | arosen: first SWAG would be that SessionStore is not actually a Session, which is what has the request method | 21:38 |
| ayoung | do we need a bug number for recheck now? | 21:38 |
| morganfainberg | ayoung no. | 21:38 |
| dtroyer | arosen: I don't know what SessionStore is, it sounds like a container for Session objects maybe? | 21:39 |
| *** zzzeek has quit IRC | 21:40 | |
| arosen | dtroyer: ah right it isn't. I'm running into an issue getting the congressclient hooked into keystone without hardcoding the creds there | 21:41 |
| *** andreaf has quit IRC | 21:41 | |
| *** andreaf has joined #openstack-keystone | 21:42 | |
| dtroyer | arosen: as an OSC plugin or standalone? | 21:42 |
| arosen | dtroyer: standalone, the osc part just buys us the cli bits. | 21:42 |
| *** _cjones_ has quit IRC | 21:43 | |
| *** _cjones_ has joined #openstack-keystone | 21:44 | |
| *** amcrn has joined #openstack-keystone | 21:44 | |
| *** zzzeek has joined #openstack-keystone | 21:44 | |
| dtroyer | OSC also gives you an authenticated session…so right now doing it standalone means managing which auth plugin to use. I'm sure there is abetter way but you can brute-force it like in https://github.com/dtroyer/python-openstackclient/blob/master/openstackclient/common/clientmanager.py#L96 | 21:44 |
| dtroyer | we're planning to replace that with https://review.openstack.org/#/c/108325/ soon... | 21:45 |
| dtroyer | which is a better model to follow | 21:45 |
| *** topol has quit IRC | 21:46 | |
| *** _cjones_ has quit IRC | 21:48 | |
| *** _cjones_ has joined #openstack-keystone | 21:48 | |
| *** meera has quit IRC | 21:50 | |
| *** rkofman has quit IRC | 21:54 | |
| morganfainberg | tentative release schedule for Kilo: https://docs.google.com/spreadsheets/d/1Ypxkvsfth0DHsDKlPhsjtHaM4zJ_f9sdDgr3pArZEdY/edit#gid=353797089 | 21:54 |
| *** rkofman has joined #openstack-keystone | 21:55 | |
| bknudson | we haven't even gotten Juno out the door yet | 21:55 |
| *** nkinder_ has quit IRC | 21:56 | |
| morganfainberg | yep. but we're not having a whole summit session in paris dedicated to this | 21:56 |
| morganfainberg | instead we're hammering it out on the ML and in IRC before the summit | 21:56 |
| morganfainberg | this does mean the L cycle will likely be a short cycle (up to 3wks shorter) | 21:57 |
| *** jasondotstar has quit IRC | 21:57 | |
| bknudson | now we're talking about L? | 21:57 |
| morganfainberg | bknudson, if we set the K cycle at that schedule, L will be short. | 21:58 |
| *** harlowja is now known as harlowja_away | 22:01 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/keystone: Add test for grant CRUD on assignment backend https://review.openstack.org/123590 | 22:03 |
| samuelmz | morganfainberg, ^ | 22:03 |
| morganfainberg | samuelmz, thanks! | 22:03 |
| samuelmz | morganfainberg, :-) | 22:03 |
| *** harlowja_away is now known as harlowja | 22:03 | |
| *** miqui has quit IRC | 22:04 | |
| *** samuelmz is now known as samuelmz-away | 22:04 | |
| *** Tahmina has joined #openstack-keystone | 22:06 | |
| *** gokrokve has joined #openstack-keystone | 22:06 | |
| *** bknudson has quit IRC | 22:07 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:17 | |
| *** zzzeek has quit IRC | 22:21 | |
| *** amerine has quit IRC | 22:22 | |
| *** zzzeek has joined #openstack-keystone | 22:24 | |
| *** amerine has joined #openstack-keystone | 22:26 | |
| *** ayoung has quit IRC | 22:28 | |
| *** jorge_munoz has quit IRC | 22:31 | |
| *** openstackgerrit has quit IRC | 22:31 | |
| *** openstackgerrit has joined #openstack-keystone | 22:31 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Stop using intersphinx https://review.openstack.org/121311 | 22:35 |
| *** amerine has quit IRC | 22:42 | |
| *** amerine has joined #openstack-keystone | 22:44 | |
| *** nkinder_ has joined #openstack-keystone | 22:47 | |
| *** dims has quit IRC | 22:53 | |
| *** dims has joined #openstack-keystone | 22:54 | |
| *** dims has quit IRC | 22:59 | |
| *** marcoemorais1 has quit IRC | 23:07 | |
| *** marcoemorais has joined #openstack-keystone | 23:08 | |
| *** jimbaker has quit IRC | 23:12 | |
| *** jimbaker has joined #openstack-keystone | 23:12 | |
| *** jimbaker has quit IRC | 23:12 | |
| *** jimbaker has joined #openstack-keystone | 23:12 | |
| *** andreaf has quit IRC | 23:13 | |
| *** andreaf has joined #openstack-keystone | 23:14 | |
| *** andreaf has quit IRC | 23:15 | |
| *** gokrokve_ has joined #openstack-keystone | 23:19 | |
| *** dims has joined #openstack-keystone | 23:19 | |
| *** david-lyle has quit IRC | 23:20 | |
| *** gokrokve has quit IRC | 23:21 | |
| *** dhellmann has quit IRC | 23:21 | |
| *** dhellmann has joined #openstack-keystone | 23:21 | |
| *** david-lyle has joined #openstack-keystone | 23:21 | |
| *** david-lyle has quit IRC | 23:26 | |
| *** samuelmz-away has quit IRC | 23:27 | |
| *** openstackgerrit_ has joined #openstack-keystone | 23:28 | |
| *** ayoung has joined #openstack-keystone | 23:31 | |
| *** samuelmz-away has joined #openstack-keystone | 23:34 | |
| *** Joshua_Hodkiewic has joined #openstack-keystone | 23:39 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Prevent infinite recursion on persistence core on init https://review.openstack.org/123612 | 23:43 |
| morganfainberg | dstanek, gyee, henrynash, dolphm, ayoung, lbragstad, ^ | 23:44 |
| morganfainberg | bug reported that needs to be fixed prior to RC, it's a simple fix, confirmed it locally and that the fix works. | 23:44 |
| dstanek | morganfainberg: wow, didn't know that was a problem; sounds bad | 23:44 |
| *** Joshua_Hodkiewic has quit IRC | 23:45 | |
| morganfainberg | dstanek, it doesn't crash keystone or anything just spews recursive calls a lot | 23:45 |
| morganfainberg | dstanek, and then it will eventually stabilize, it's a bad thing™ but doesn't really break things too badly | 23:45 |
| morganfainberg | but it' stacks up a few thousand calls in a loop on keystone start | 23:45 |
| gyee | ouch! | 23:46 |
| morganfainberg | gyee, yeah haneef and arun found it | 23:46 |
| morganfainberg | since it's code that will be removed in about oh.. 1 day, i figure it's ok not to have a string in the AttributeError() raise | 23:47 |
| gyee | k :) | 23:48 |
| *** Alexane_Metz has joined #openstack-keystone | 23:51 | |
| *** alex_xu has joined #openstack-keystone | 23:51 | |
| morganfainberg | gyee, not sure it really warrants a unit test, i can if you want it. | 23:56 |
| morganfainberg | gyee, it's just mock .assert_called_with and a count | 23:56 |
| gyee | morganfainberg, if this's just temporary code then probably not worth the time | 23:57 |
| morganfainberg | gyee, yeah it's basically just for Juno to print that nice deprecation warning | 23:57 |
| morganfainberg | "hey don't use token_api" | 23:57 |
| gyee | morganfainberg, k, let me change my vote then | 23:57 |
| morganfainberg | added a new item to the summit list "Dependency Injection: Fix it" | 23:58 |
| *** marcoemorais has quit IRC | 23:58 | |
| *** marcoemorais has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!