| *** darrenc is now known as darrenc_afk | 00:12 | |
| *** darrenc_afk is now known as darrenc | 00:22 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add flag to append project_id to catalog URL https://review.openstack.org/148166 | 00:33 |
|---|---|---|
| *** browne has joined #openstack-keystone | 00:45 | |
| *** richm has joined #openstack-keystone | 00:57 | |
| *** lhcheng has joined #openstack-keystone | 00:57 | |
| *** ChanServ sets mode: +v lhcheng | 00:57 | |
| *** richm has quit IRC | 01:08 | |
| *** alex_xu has quit IRC | 01:18 | |
| *** alex_xu has joined #openstack-keystone | 01:23 | |
| *** erkules has joined #openstack-keystone | 01:40 | |
| *** richm has joined #openstack-keystone | 01:41 | |
| *** erkules_ has quit IRC | 01:43 | |
| *** jimbaker has quit IRC | 01:47 | |
| *** richm has quit IRC | 01:49 | |
| *** lhcheng has quit IRC | 01:50 | |
| *** lhcheng has joined #openstack-keystone | 01:51 | |
| *** ChanServ sets mode: +v lhcheng | 01:51 | |
| *** jimbaker has joined #openstack-keystone | 01:51 | |
| *** jimbaker has quit IRC | 01:51 | |
| *** jimbaker has joined #openstack-keystone | 01:51 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove project association before removing endpoint group https://review.openstack.org/173192 | 02:07 |
| *** stevemar has joined #openstack-keystone | 02:14 | |
| *** ChanServ sets mode: +v stevemar | 02:14 | |
| *** ayoung has quit IRC | 02:20 | |
| *** davechen has joined #openstack-keystone | 02:38 | |
| *** davechen1 has joined #openstack-keystone | 02:44 | |
| *** davechen2 has joined #openstack-keystone | 02:46 | |
| *** davechen has quit IRC | 02:46 | |
| *** davechen1 has quit IRC | 02:48 | |
| *** david-lyle has quit IRC | 02:55 | |
| *** jamielennox is now known as jamielennox|away | 02:58 | |
| *** jamielennox|away is now known as jamielennox | 03:03 | |
| *** lhcheng has quit IRC | 03:09 | |
| *** topol has joined #openstack-keystone | 03:12 | |
| *** ChanServ sets mode: +v topol | 03:12 | |
| *** topol has quit IRC | 03:13 | |
| *** lhcheng has joined #openstack-keystone | 03:34 | |
| *** ChanServ sets mode: +v lhcheng | 03:34 | |
| *** iamjarvo has joined #openstack-keystone | 03:49 | |
| *** ishant has joined #openstack-keystone | 04:04 | |
| *** rushiagr_away is now known as rushiagr | 04:20 | |
| *** boris-42 has quit IRC | 04:58 | |
| *** ishant has quit IRC | 05:13 | |
| *** _kiran_ has joined #openstack-keystone | 05:15 | |
| *** ishant has joined #openstack-keystone | 05:38 | |
| *** iamjarvo has quit IRC | 05:55 | |
| *** lhcheng has quit IRC | 06:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/172624 | 06:05 |
| *** afazekas_ has joined #openstack-keystone | 06:10 | |
| *** stevemar has quit IRC | 06:40 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add flag to append project_id to catalog URL https://review.openstack.org/148166 | 06:51 |
| *** jamielennox is now known as jamielennox|away | 06:52 | |
| *** browne has quit IRC | 06:52 | |
| *** stevemar has joined #openstack-keystone | 06:54 | |
| *** ChanServ sets mode: +v stevemar | 06:54 | |
| *** jaosorior has joined #openstack-keystone | 06:58 | |
| *** tsufiev has joined #openstack-keystone | 07:04 | |
| *** browne has joined #openstack-keystone | 07:05 | |
| *** amakarov has joined #openstack-keystone | 07:07 | |
| *** browne has quit IRC | 07:21 | |
| *** unixlike has joined #openstack-keystone | 07:27 | |
| unixlike | Hi there ! | 07:27 |
| unixlike | sorry for my english in advance | 07:28 |
| unixlike | is there an possible way to configure mongodb as database backend of keystone ? :) | 07:28 |
| *** chlong has quit IRC | 07:29 | |
| unixlike | i mean using mongo instead of mysql | 07:31 |
| *** pnavarro has joined #openstack-keystone | 07:31 | |
| *** kiranr has joined #openstack-keystone | 07:38 | |
| *** _kiran_ has quit IRC | 07:39 | |
| *** jistr has joined #openstack-keystone | 07:47 | |
| openstackgerrit | huanghao proposed openstack/keystone: Add unique constraint to Service.type field. https://review.openstack.org/175290 | 07:48 |
| stevemar | unixlike, i don't think keystone supports mongodb | 07:55 |
| stevemar | unixlike, but ask on the mailing list to be certain | 07:55 |
| *** _kiran_ has joined #openstack-keystone | 07:57 | |
| *** kiranr has quit IRC | 07:57 | |
| *** fhubik has joined #openstack-keystone | 08:06 | |
| *** stevemar has quit IRC | 08:06 | |
| *** ajayaa has joined #openstack-keystone | 08:11 | |
| *** erkules has quit IRC | 08:13 | |
| *** erkules has joined #openstack-keystone | 08:13 | |
| *** fhubik is now known as fhubik_afk | 08:25 | |
| openstackgerrit | huanghao proposed openstack/keystone: Add unique constraint to Service.type field. https://review.openstack.org/175290 | 08:34 |
| *** fhubik_afk is now known as fhubik | 08:41 | |
| *** f13o has joined #openstack-keystone | 08:47 | |
| *** chlong has joined #openstack-keystone | 08:50 | |
| davechen2 | dstanek: hi David, | 09:08 |
| davechen2 | dstanek: I just reply your question regarding to this bug (https://bugs.launchpad.net/keystone/+bug/1369388), pls kindly check it at your convenience. | 09:10 |
| openstack | Launchpad bug 1369388 in Keystone "local configuration is not allowed in "keystone-paste.ini"" [Low,In progress] - Assigned to Dave Chen (wei-d-chen) | 09:10 |
| *** chlong has quit IRC | 09:20 | |
| *** pcaruana has quit IRC | 09:27 | |
| *** henrynash has quit IRC | 09:27 | |
| *** ishant has quit IRC | 09:28 | |
| *** pcaruana has joined #openstack-keystone | 09:30 | |
| *** chlong has joined #openstack-keystone | 09:32 | |
| *** fhubik is now known as fhubik_afk | 09:33 | |
| *** fhubik_afk is now known as fhubik | 09:37 | |
| *** davechen2 has left #openstack-keystone | 09:50 | |
| *** fhubik is now known as fhubik_afk | 09:51 | |
| *** boris-42 has joined #openstack-keystone | 09:51 | |
| *** fhubik_afk is now known as fhubik | 09:54 | |
| *** aix has joined #openstack-keystone | 10:01 | |
| openstackgerrit | Matthieu Huin proposed openstack/keystone: Get method's class name in a python3-compatible way https://review.openstack.org/158777 | 10:10 |
| *** rushiagr is now known as rushiagr_away | 10:38 | |
| *** fhubik is now known as fhubik_afk | 10:47 | |
| *** fhubik_afk is now known as fhubik | 11:02 | |
| *** afaranha has quit IRC | 11:02 | |
| *** afaranha_ has quit IRC | 11:03 | |
| *** fhubik is now known as fhubik_afk | 11:04 | |
| *** afazekas_ has quit IRC | 11:24 | |
| *** afazekas_ has joined #openstack-keystone | 11:28 | |
| *** fhubik_afk is now known as fhubik | 11:33 | |
| dstanek | unixlike: there is a mongodb backend for caching, but not any of the actual subsystem data | 11:37 |
| *** fhubik_afk has joined #openstack-keystone | 11:45 | |
| *** fhubik_afk has quit IRC | 11:46 | |
| *** fhubik_afk has joined #openstack-keystone | 11:46 | |
| *** fhubik_afk is now known as fhubik_meeting | 11:46 | |
| *** fhubik has quit IRC | 11:46 | |
| *** fhubik_meeting has quit IRC | 11:50 | |
| *** jistr has quit IRC | 11:57 | |
| *** chlong has quit IRC | 11:58 | |
| *** afazekas_ has quit IRC | 11:58 | |
| *** fhubik has joined #openstack-keystone | 11:59 | |
| *** fhubik is now known as fhubik_meeting | 12:00 | |
| *** jistr has joined #openstack-keystone | 12:03 | |
| *** henrynash has joined #openstack-keystone | 12:17 | |
| *** ChanServ sets mode: +v henrynash | 12:17 | |
| *** bknudson has quit IRC | 12:26 | |
| *** jamielennox|away is now known as jamielennox | 12:31 | |
| *** pnavarro has quit IRC | 12:31 | |
| *** jamielennox is now known as jamielennox|away | 12:32 | |
| *** pnavarro has joined #openstack-keystone | 12:37 | |
| *** gordc has joined #openstack-keystone | 12:37 | |
| *** joesavak has joined #openstack-keystone | 12:47 | |
| *** henrynash has quit IRC | 12:49 | |
| *** bknudson has joined #openstack-keystone | 12:55 | |
| *** ChanServ sets mode: +v bknudson | 12:55 | |
| *** lifeless has quit IRC | 13:05 | |
| *** f13o has quit IRC | 13:07 | |
| *** fhubik_ has joined #openstack-keystone | 13:08 | |
| *** richm has joined #openstack-keystone | 13:09 | |
| *** fhubik_meeting has quit IRC | 13:12 | |
| *** f13o has joined #openstack-keystone | 13:12 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds proper isolation to templated catalog tests https://review.openstack.org/174556 | 13:13 |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 13:15 |
| *** fhubik_ is now known as fhubik | 13:18 | |
| *** iamjarvo has joined #openstack-keystone | 13:30 | |
| *** krykowski has joined #openstack-keystone | 13:32 | |
| *** iamjarvo has quit IRC | 13:33 | |
| *** jistr_ has joined #openstack-keystone | 13:35 | |
| *** jistr has quit IRC | 13:38 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:42 | |
| *** jistr_ has quit IRC | 13:44 | |
| *** jistr has joined #openstack-keystone | 13:44 | |
| *** davechen has joined #openstack-keystone | 13:44 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes KVS catalog backend https://review.openstack.org/158442 | 13:44 |
| *** mattfarina has joined #openstack-keystone | 13:45 | |
| *** henrynash has joined #openstack-keystone | 13:47 | |
| *** ChanServ sets mode: +v henrynash | 13:47 | |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP: Force SQLite to properly deal with foreign keys https://review.openstack.org/126030 | 13:47 |
| *** Ephur has joined #openstack-keystone | 13:57 | |
| *** fhubik has quit IRC | 13:59 | |
| *** rushil has joined #openstack-keystone | 13:59 | |
| dstanek | anyone know if deployers take advantage of the lack of Service.type uniqueness? https://review.openstack.org/#/c/175290/ | 14:00 |
| dstanek | dolphm: ^ | 14:00 |
| dolphm | dstanek: not that i'm aware of | 14:01 |
| dolphm | dstanek: wait, that's not what i was thinking of. why on earth would you make it unique? | 14:02 |
| dstanek | dolphm: ok. i thought i remembered someone talking about that in the past. but i can't find record of it | 14:02 |
| dolphm | dstanek: i'm going to -2 | 14:03 |
| dstanek | dolphm: just did that :-( | 14:05 |
| *** chrisshattuck has quit IRC | 14:05 | |
| *** ajayaa has quit IRC | 14:06 | |
| davechen | dstanek, dolphm: but at least it's meaningless if there is a lot of redundant entries in the tables. | 14:08 |
| davechen | dstanek, dolphm: seems this can also be found with other enties. | 14:08 |
| dstanek | davechen: what exactly happens if there are redundant entries? a traceback? can both of them have endpoints in the catalog? | 14:09 |
| davechen | dstanek: no harm, just looks ugly. :) | 14:10 |
| dstanek | davechen: about your bug comment. the reason you may have a function arg defined that is not used is that you are adhering to an interface | 14:11 |
| davechen | dstanek: so, you think it okay if we pass a argument but we do nothing with it? I think both is okay. | 14:12 |
| davechen | dstanek: as long as there is some information print out. | 14:13 |
| openstackgerrit | Matthieu Huin proposed openstack/keystone: Get method's class name in a python3-compatible way https://review.openstack.org/158777 | 14:13 |
| dstanek | davechen: in this case we'd have to if were want to deprecate the behavior - or maybe we could catch it a show a better error message than a traceback | 14:14 |
| *** chrisshattuck has joined #openstack-keystone | 14:14 | |
| davechen | dstanek: going to rework on that patch, btw, thanks for your comment and your advice. :-D | 14:14 |
| dstanek | davechen: i think in the specific case you were talking about we could just change the docs | 14:14 |
| davechen | dstanek: hmm, there are already some docs about that. | 14:15 |
| dstanek | davechen: the problem you were having it that specific filter doesn't take an additional args | 14:15 |
| davechen | dstanek: maybe, but one thing is sure, I am going to add it in the docstring. | 14:17 |
| dstanek | davechen: for example, the apps take extra args | 14:18 |
| *** afazekas_ has joined #openstack-keystone | 14:18 | |
| davechen | dstanek: yes, and dstanek, what do you think about this bug (https://bugs.launchpad.net/keystone/+bug/1403408)? | 14:19 |
| openstack | Launchpad bug 1403408 in Keystone "Redundant endpoints found in the table "endpoint"" [Medium,Confirmed] - Assigned to Dave Chen (wei-d-chen) | 14:19 |
| dstanek | davechen: did you see my comment there? | 14:19 |
| *** henrynash has quit IRC | 14:20 | |
| davechen | dstanek: thanks, I am going to reference that bug with your comments as well. | 14:21 |
| davechen | dstanek: so I can stop working at that :) | 14:22 |
| dstanek | davechen: it's probably a good idea to put that on the agenda for tomorrow's meeting to get feedback on the backward compat issue i mentioned | 14:22 |
| davechen | dstanek: Just notice you have post comments to both bugs. yes, I will add a agenda, but not sure I can wake up on time. | 14:23 |
| *** iamjarvo has joined #openstack-keystone | 14:24 | |
| dstanek | davechen: add my name next to yours and if you are not around i can ask the question | 14:24 |
| davechen | dstanek: I must struggle for several times before get up. :) | 14:24 |
| davechen | dstanek: Great! thanks you. | 14:25 |
| dstanek | davechen: np | 14:25 |
| dstanek | i'll also ask a little later when more people are awake. | 14:25 |
| davechen | dstanek: where is your base, I am based in far east, so the time is bad for me. | 14:26 |
| dstanek | I'm in the EST timezone in the US - for me the meeting is 2PM localtime | 14:26 |
| *** afazekas_ has quit IRC | 14:26 | |
| davechen | dstanek: 2 am for me. :P | 14:27 |
| dstanek | davechen: yeah, i can get the answer for you. no need to be up that late for something like this | 14:28 |
| *** ayoung has joined #openstack-keystone | 14:28 | |
| *** ChanServ sets mode: +v ayoung | 14:28 | |
| davechen | dstanek: thanks, see you tomorrow. | 14:29 |
| dstanek | davechen: have a good night | 14:30 |
| *** afazekas_ has joined #openstack-keystone | 14:30 | |
| davechen | dstanek: thanks, happy coding. | 14:31 |
| *** davechen has left #openstack-keystone | 14:31 | |
| *** lifeless has joined #openstack-keystone | 14:32 | |
| *** chrisshattuck has quit IRC | 14:33 | |
| *** chrisshattuck has joined #openstack-keystone | 14:34 | |
| *** thedodd has joined #openstack-keystone | 14:34 | |
| *** afazekas_ has quit IRC | 14:36 | |
| *** stevemar has joined #openstack-keystone | 14:39 | |
| *** ChanServ sets mode: +v stevemar | 14:39 | |
| *** browne has joined #openstack-keystone | 14:39 | |
| *** f13o has quit IRC | 14:40 | |
| *** f13o has joined #openstack-keystone | 14:40 | |
| *** gordc has quit IRC | 14:44 | |
| *** gordc has joined #openstack-keystone | 14:46 | |
| *** afazekas_ has joined #openstack-keystone | 14:47 | |
| *** chrisshattuck has quit IRC | 14:48 | |
| *** chrisshattuck has joined #openstack-keystone | 14:52 | |
| *** chrisshattuck has quit IRC | 14:52 | |
| *** zzzeek has joined #openstack-keystone | 14:58 | |
| *** rwsu has joined #openstack-keystone | 15:02 | |
| *** afazekas_ has quit IRC | 15:08 | |
| *** browne has quit IRC | 15:08 | |
| openstackgerrit | David Peraza proposed openstack/keystone: Testing my keystone dev env https://review.openstack.org/175443 | 15:10 |
| *** jistr has quit IRC | 15:14 | |
| *** ajayaa has joined #openstack-keystone | 15:16 | |
| *** _kiran_ has quit IRC | 15:18 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 15:20 |
| *** afazekas_ has joined #openstack-keystone | 15:21 | |
| *** krykowski has quit IRC | 15:23 | |
| morganfainberg | dstanek: service.type can't be unique. We can make a name+type (or similar) unique to prevent duplicates from being made. | 15:24 |
| morganfainberg | dstanek: but unique type would break Rackspace deployment for example (if you were to be using keystone) for those who are using pre-nova compute and nova compute (public cloud) | 15:25 |
| *** afazekas_ has quit IRC | 15:26 | |
| *** jistr has joined #openstack-keystone | 15:28 | |
| stevemar | morganfainberg, ++ | 15:33 |
| * morganfainberg would have preferred service.type be unique. But that ship has sailed. | 15:36 | |
| *** afazekas_ has joined #openstack-keystone | 15:37 | |
| dstanek | morganfainberg: that's what i thought...although i couldn't remember why | 15:42 |
| *** gyee has joined #openstack-keystone | 15:45 | |
| *** ChanServ sets mode: +v gyee | 15:45 | |
| *** afazekas_ has quit IRC | 15:47 | |
| bknudson | is there an rc2 for keystone? | 15:48 |
| *** rm_work is now known as rm_work|away | 15:52 | |
| *** jistr_ has joined #openstack-keystone | 15:53 | |
| *** tqtran has joined #openstack-keystone | 15:55 | |
| *** jistr has quit IRC | 15:56 | |
| *** _cjones_ has joined #openstack-keystone | 15:57 | |
| *** _cjones_ has quit IRC | 15:59 | |
| *** _cjones_ has joined #openstack-keystone | 15:59 | |
| *** henrynash has joined #openstack-keystone | 16:02 | |
| *** ChanServ sets mode: +v henrynash | 16:02 | |
| *** davidckennedy has joined #openstack-keystone | 16:04 | |
| *** jistr_ is now known as jistr | 16:05 | |
| *** davidckennedy has quit IRC | 16:05 | |
| morganfainberg | bknudson, we just opened the window | 16:11 |
| morganfainberg | bknudson, like... 30 minutes ago | 16:11 |
| morganfainberg | so yes, now there is an RC2 for keystone we are working on. | 16:11 |
| morganfainberg | here is the list of bugs: https://launchpad.net/keystone/+milestone/kilo-rc2 | 16:11 |
| *** iamjarvo has quit IRC | 16:11 | |
| openstackgerrit | Merged openstack/keystone: Loosen validation on matching trusted dashboard https://review.openstack.org/175169 | 16:12 |
| *** ChanServ changes topic to "Liberty Development Open | Kilo RC2: https://launchpad.net/keystone/+milestone/kilo-rc2 | Look for RC-critical bugs | Review Liberty Keystone Specs" | 16:12 | |
| *** browne has joined #openstack-keystone | 16:21 | |
| *** iamjarvo has joined #openstack-keystone | 16:23 | |
| *** iamjarvo has quit IRC | 16:23 | |
| *** iamjarvo has joined #openstack-keystone | 16:24 | |
| *** thedodd has quit IRC | 16:24 | |
| *** jistr has quit IRC | 16:24 | |
| *** henrynash has quit IRC | 16:26 | |
| *** alexsyip has joined #openstack-keystone | 16:27 | |
| *** rm_work|away is now known as rm_work | 16:31 | |
| *** iamjarvo has quit IRC | 16:31 | |
| *** arunkant has quit IRC | 16:34 | |
| *** nkinder has quit IRC | 16:38 | |
| dolphm | morganfainberg: i'm assuming we can +A stable/kilo patches then | 16:42 |
| morganfainberg | dolphm, yep. i need to unblock one or two | 16:42 |
| *** arunkant has joined #openstack-keystone | 16:48 | |
| *** iamjarvo has joined #openstack-keystone | 16:51 | |
| *** iamjarvo has quit IRC | 16:51 | |
| *** iamjarvo has joined #openstack-keystone | 16:52 | |
| *** david8hu has quit IRC | 16:57 | |
| *** f13o has quit IRC | 16:57 | |
| openstackgerrit | guang-yee proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 17:03 |
| openstackgerrit | Dolph Mathews proposed openstack/keystonemiddleware: Refactor: extract echo_app from enclosing class https://review.openstack.org/175489 | 17:05 |
| *** david8hu has joined #openstack-keystone | 17:06 | |
| *** ajayaa has quit IRC | 17:14 | |
| *** Guest36304 is now known as mgagne | 17:16 | |
| *** mgagne has joined #openstack-keystone | 17:16 | |
| *** lhcheng has joined #openstack-keystone | 17:17 | |
| *** ChanServ sets mode: +v lhcheng | 17:17 | |
| *** pnavarro has quit IRC | 17:29 | |
| *** harlowja_away is now known as harlowja | 17:38 | |
| *** edmondsw has joined #openstack-keystone | 17:39 | |
| lhcheng | dstanek: your Spidey sense tingling on https://bugs.launchpad.net/keystone/+bug/1440958 | 17:42 |
| openstack | Launchpad bug 1440958 in Keystone "loosen validation on matching trusted dashboard" [Medium,Fix committed] - Assigned to Lin Hua Cheng (lin-hua-cheng) | 17:42 |
| lhcheng | dstanek: the validation would still be performed on the "origin" query parameter, that didn't change. | 17:43 |
| dstanek | lhcheng: right, i was just pointing out that it could be possible to be attacked if the dashboard had an unvalidated redirect | 17:48 |
| *** david-lyle has joined #openstack-keystone | 17:50 | |
| lhcheng | dstanek: hmm you mean something like http://horizon.com?origin=http://horizon.com?redirect=<bad_url> | 17:53 |
| dstanek | lhcheng: exactly | 17:54 |
| openstackgerrit | Merged openstack/keystonemiddleware: Pull echo service out of auth_token. https://review.openstack.org/165171 | 17:54 |
| dstanek | lhcheng: i think it's unlikely since it looks like Horizon is doing the right things and Django does a great job of protecting against this sort of thing; | 17:56 |
| lhcheng | dstanek: yeah, it is covered by django: https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a | 18:00 |
| *** david-lyle_ has joined #openstack-keystone | 18:01 | |
| *** david-lyle has quit IRC | 18:01 | |
| lhcheng | dstanek: cool, I wasn't aware of this check until I looked it up. | 18:02 |
| dstanek | lhcheng: the safe URL stuff? django does a great job of protecting you. but if you don't use that then you could be vulnerable | 18:02 |
| dstanek | for instance, /auth/login?next=xyz; django's auth app takes care of checking this for you, but if you make a different view that accepted a 'next' param you would have to do that yourself | 18:03 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/172139 | 18:04 |
| *** mattfarina has quit IRC | 18:04 | |
| ayoung | lhcheng, https://review.openstack.org/#/c/173669/3 finally tested. Works correctly, and same system does not work without patch. Any thoughts on how better to test it? AFAICT, the websso patch is not touched by unit tests, or my code would have asploded in past revisions | 18:04 |
| ayoung | lhcheng, I'm tempted to say leave https://bugs.launchpad.net/keystone/+bug/1440958 alone. It is not a real problem. What we do need is better error reporting if the match fails | 18:06 |
| openstack | Launchpad bug 1440958 in Keystone "loosen validation on matching trusted dashboard" [Medium,Fix committed] - Assigned to Lin Hua Cheng (lin-hua-cheng) | 18:06 |
| *** david-lyle_ is now known as david-lyle | 18:06 | |
| lhcheng | dstanek: horizon leverages the django login view for the login, which eventually goes to https://github.com/django/django/blob/002425fe39f62faafaa32e400f7531809181a1a0/django/contrib/auth/views.py#L47 | 18:06 |
| lhcheng | dstanek: so we're good. | 18:06 |
| ayoung | GAH that got committed already? | 18:06 |
| ayoung | Damnit...I was going to say "don't do it" | 18:07 |
| stevemar | ayoung, you approved it :) | 18:08 |
| stevemar | https://review.openstack.org/#/c/175169/ | 18:08 |
| ayoung | stevemar, I know | 18:08 |
| stevemar | hehe | 18:08 |
| ayoung | I had a change of heart | 18:08 |
| morganfainberg | ayoung, REVERT REVERT! Full reverse! | 18:08 |
| stevemar | it's not a huge issue, i like the change | 18:08 |
| ayoung | morganfainberg, nah | 18:08 |
| morganfainberg | :P | 18:08 |
| morganfainberg | ayoung, the change is fine. | 18:08 |
| ayoung | stevemar, the things is, what we really need is a list of of URLS, not just a single one | 18:08 |
| ayoung | right now we have highlander syndrome | 18:09 |
| stevemar | you can make it a list by defining it multiple times | 18:09 |
| ayoung | does that work? | 18:09 |
| stevemar | it's cfg.ListOpt | 18:09 |
| stevemar | yep | 18:09 |
| morganfainberg | ayoung, we have a bunch of movies each one claiming there can be only one, and a television series? | 18:09 |
| stevemar | trusted_dashboard = host1.com, trusted_dashboard = host2.com | 18:09 |
| morganfainberg | ayoung, but clearly there are more than that | 18:10 |
| ayoung | morganfainberg, poorly written, and no good soundtracks since Freddie passed on | 18:10 |
| stevemar | new line instead of comma | 18:10 |
| morganfainberg | ayoung, right?! | 18:10 |
| *** rushil has quit IRC | 18:10 | |
| morganfainberg | stevemar, uhm ListOpt would be: trusted_dashboard = host1.com, host2.com | 18:10 |
| morganfainberg | stevemar, right? | 18:10 |
| morganfainberg | MultiStrOpt would be multi-line | 18:10 |
| ayoung | How does Keystone work? "Its a kind of magic." | 18:10 |
| morganfainberg | ayoung, magnets | 18:10 |
| stevemar | ah right MultiStrOpt it what i meant | 18:10 |
| stevemar | i was going from memory, bad idea | 18:11 |
| morganfainberg | stevemar, heh | 18:11 |
| * morganfainberg needs coffee. | 18:11 | |
| * stevemar is drinking some now | 18:11 | |
| ayoung | morganfainberg, so...K2K means we need smarter auth plugins, right? When performing some operation, the clients are going to need to do the whole token->saml->token thing for the user? | 18:12 |
| morganfainberg | ayoung, yes we will need that | 18:12 |
| morganfainberg | ayoung, this is something that should get baked into keystoneauth | 18:12 |
| ayoung | morganfainberg, OK. I think that finally gives us a way to fix my origianl concern about Keystone | 18:12 |
| ayoung | we can make it possible to dothis: | 18:12 |
| ayoung | got to nova and perform "create server" .... | 18:12 |
| dstanek | morganfainberg: i would rather have more specific URLs than just host matching | 18:13 |
| ayoung | then when nova goes to glance, client can look at the token data and say "no glance in here, let me get a token for *that*" | 18:13 |
| morganfainberg | dstanek, i was just explaining the opt versions not what they meant. | 18:13 |
| morganfainberg | dstanek, i'm ok if we switch to something better than host (or smarter if more than host is provided) | 18:13 |
| dstanek | morganfainberg: ah | 18:13 |
| ayoung | its the same general mechanism "look at the token, determine if it will get us the next step, if not, go back to keystone..." | 18:14 |
| morganfainberg | ayoung, sure, now if you need to be smart about *what* glance to use [this one or that one], i don't expect us to get crazy about it [let the user decide] | 18:14 |
| morganfainberg | ayoung, but yes. - the rough edges we need tow ork out is how do we know that-cloud-over-there has glance... | 18:14 |
| ayoung | morganfainberg, different issue there. There is actually a BP for that, separate...let me link | 18:14 |
| morganfainberg | ayoung, without having to auth and ask every-single-time. | 18:15 |
| ayoung | https://review.openstack.org/#/c/132623/2 | 18:15 |
| morganfainberg | ayoung, what is that? | 18:15 |
| ayoung | morganfainberg, it will indicate on a given resource "which endpoint holds this" | 18:15 |
| morganfainberg | except you can't know | 18:16 |
| *** mattfarina has joined #openstack-keystone | 18:16 | |
| ayoung | so, if the glance image you need is in a specific server, the client will be able to tell from the URL | 18:16 |
| lhcheng | ayoung: as for the test of https://review.openstack.org/#/c/173669/3 , I have already added a test that validates the generated redirect url. So that code path is already covered in here: https://github.com/openstack/django_openstack_auth/blob/master/openstack_auth/tests/tests.py#L860-L872 | 18:16 |
| morganfainberg | what if that-cloud-over-there changes their endpoints? | 18:16 |
| ayoung | morganfainberg, then the resource you just pointed to is no longer valid | 18:16 |
| lhcheng | ayoung: if the test still pass, you're good :) | 18:16 |
| morganfainberg | ayoung, the catalog doesn't know what endpoints a remote SP has | 18:17 |
| ayoung | lhcheng, good to know | 18:17 |
| morganfainberg | ayoung, SPs are a top-level construct in the catalog | 18:17 |
| ayoung | morganfainberg, you are thinking too hard | 18:17 |
| morganfainberg | ayoung, today i have to ask an SP for it's catalog | 18:17 |
| morganfainberg | to know what services are even there | 18:17 |
| * morganfainberg might be a level behind where you are | 18:17 | |
| morganfainberg | you're talking when a resource already exists | 18:17 |
| morganfainberg | i'm talking from a "i want to interact with a cloud... no specific resource *yet*" | 18:18 |
| ayoung | morganfainberg, right...this is the MOC team, think "I have a bunch of mini openstack deployments, and I need to start sharing resources between them, but no one is willing to give up control of their own cloud" | 18:18 |
| morganfainberg | ayoung, so we still don't know what exists where - which we need to solve | 18:19 |
| morganfainberg | ayoung, ultimately, i think we make catalog non-priv. | 18:19 |
| morganfainberg | the priv version has filtering etc | 18:19 |
| * ayoung thinking | 18:20 | |
| *** david-lyle has quit IRC | 18:20 | |
| morganfainberg | but the "what services do i have running" isn't unreasonable to just publish | 18:20 |
| *** david-lyle has joined #openstack-keystone | 18:20 | |
| * ayoung thinking he needs to leave to pick up his kid from camp as it is vacation weeek...yikes | 18:20 | |
| ayoung | morganfainberg, just services, no endpoints? | 18:21 |
| morganfainberg | endpoints might be filtered | 18:21 |
| morganfainberg | based upon your auth | 18:21 |
| ayoung | "my cloud admits to supporting nova, glance, and cinder..." | 18:21 |
| morganfainberg | and you need a local token anyway to interact with nova/glance/etc | 18:21 |
| morganfainberg | thats my thought | 18:21 |
| ayoung | interesting...I think that is the right level of sharing...I'll chew it over. | 18:21 |
| * ayoung needs to go | 18:22 | |
| ayoung | back online in a few | 18:22 |
| *** ayoung has quit IRC | 18:22 | |
| dstanek | gyee: responded to a few of your comments in rev9 of https://review.openstack.org/#/c/167675 | 18:37 |
| gyee | dstanek, thanks, I'll take a look and push a patch for David | 18:39 |
| *** david-lyle has quit IRC | 18:41 | |
| dstanek | gyee: let me know if you have questions. i'm just looking to not slow everything down by default | 18:42 |
| gyee | sure, I'll push a patch for David Kennedy as he's in UK timezone | 18:47 |
| *** rushil has joined #openstack-keystone | 18:49 | |
| *** iamjarvo has quit IRC | 18:58 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/172624 | 19:09 |
| *** iamjarvo has joined #openstack-keystone | 19:11 | |
| *** iamjarvo has quit IRC | 19:11 | |
| *** iamjarvo has joined #openstack-keystone | 19:12 | |
| *** iamjarvo_ has joined #openstack-keystone | 19:13 | |
| *** iamjarvo_ has quit IRC | 19:13 | |
| *** iamjarvo_ has joined #openstack-keystone | 19:13 | |
| *** iamjarvo has quit IRC | 19:16 | |
| lhcheng | dstanek, morganfainberg: so we'll keep the validation for the trusted_dashboard for now? or revert it back and come up with a smarter way? | 19:20 |
| morganfainberg | lhcheng, we can keep it as is now, but we could detect if it's a full URI down the line and be more restrictive | 19:21 |
| stevemar | gordc, ping | 19:23 |
| lhcheng | morganfainberg: hmm could simply change the check into: <redirect_url>.startswith (<url in trusted_dashboard>) | 19:23 |
| lhcheng | morganfainberg: that way, the deployer can configure how much restrictive they want it to be.. | 19:24 |
| *** iamjarvo_ has quit IRC | 19:24 | |
| morganfainberg | lhcheng: since it is early Liberty feel free to propose that change. | 19:24 |
| gordc | stevemar: whatup? | 19:24 |
| morganfainberg | lhcheng: ping dstanek on what he'd like to see. | 19:25 |
| lhcheng | morganfainberg: cool, will do! | 19:25 |
| stevemar | gordc, whats up with swift and notifications, doesn't look like it uses oslo messaging? | 19:25 |
| gordc | it don't | 19:25 |
| gordc | stevemar: swift hates oslo. | 19:25 |
| gordc | don't quote me | 19:26 |
| stevemar | gordc, sooo pycadf for swift would bomb out? | 19:26 |
| gordc | no... well there's away around it... let me grab you code | 19:26 |
| gordc | https://github.com/openstack/ceilometermiddleware/blob/master/ceilometermiddleware/swift.py | 19:26 |
| gordc | stevemar: i actually build a pycadf message from api already... but it doesn't really build the same amount of detail as audit middleware | 19:27 |
| gordc | stevemar: i should probably port what i did for ceilometermiddleware to audit middleware tbh | 19:27 |
| stevemar | probably | 19:27 |
| gordc | FINE! i'll do it! | 19:28 |
| *** aix has quit IRC | 19:29 | |
| dolphm | bknudson: i'm afraid i'm missing something here, so i didn't -1, but: https://review.openstack.org/#/c/127066/12/keystonemiddleware/auth_token/_auth.py | 19:30 |
| stevemar | why is swift not forced to use oslo messaging? | 19:31 |
| dolphm | stevemar: swift is very special | 19:33 |
| stevemar | dolphm, seems like it | 19:34 |
| stevemar | gosh that's annoying | 19:34 |
| *** iamjarvo has joined #openstack-keystone | 19:35 | |
| gyee | dstanek, have time for a quick chat? https://review.openstack.org/#/c/167675/9/keystone/catalog/backends/sql.py | 19:48 |
| *** ayoung_ has joined #openstack-keystone | 19:50 | |
| *** pnavarro has joined #openstack-keystone | 19:51 | |
| morganfainberg | dolphm, so what you're saying is... swift is ... swift? | 19:53 |
| stevemar | morganfainberg, yep | 19:55 |
| bknudson | we're getting swift-boated | 19:56 |
| morganfainberg | uh. | 19:57 |
| morganfainberg | ...... | 19:57 |
| bknudson | dstanek: is there an infra change for tox -e functional already? | 19:59 |
| dstanek | bknudson: yes, well i have it locally - was waiting for our tox target to merge | 19:59 |
| bknudson | dstanek: get ready to push it! | 19:59 |
| dstanek | bknudson: yay! | 20:00 |
| *** joesavak has quit IRC | 20:13 | |
| *** pnavarro has quit IRC | 20:15 | |
| morganfainberg | dstanek, on the topic of functional... | 20:17 |
| morganfainberg | dstanek, i wonder how hard it would be to re-use some of the functional testing for defcore [long term] | 20:18 |
| morganfainberg | hogepodge might appreciate it if we find useful ways of doing so. | 20:18 |
| dstanek | morganfainberg: can you point me to what they are doing? | 20:18 |
| *** joesavak has joined #openstack-keystone | 20:18 | |
| * morganfainberg summons hogepodge | 20:18 | |
| dstanek | morganfainberg: i could imagine we have similar goals | 20:19 |
| morganfainberg | dstanek, well they are working on a number of tests that can be done w/o scribbling on a DB. | 20:19 |
| morganfainberg | dstanek, basically a pure API test | 20:19 |
| morganfainberg | some test *may* do writes, but if it requires cloud admin, it's out | 20:19 |
| dstanek | morganfainberg: that's exactly what i want to see for functional tests - all black-box tests using the client or requests | 20:20 |
| morganfainberg | dstanek, i figured we'd continue down the functional initiative | 20:20 |
| morganfainberg | and start improving the tests along those lines | 20:20 |
| morganfainberg | but i figured that was your goal | 20:21 |
| * hogepodge appears | 20:21 | |
| morganfainberg | that would be "A wild hogepodge appears" | 20:21 |
| morganfainberg | hogepodge, ^^ re testing functional | 20:21 |
| morganfainberg | hogepodge, sooo might be helpful! | 20:22 |
| dstanek | hogepodge: morganfainberg says there is some kind of testing around defcore - can you point me to it? | 20:23 |
| bknudson | we need to be able to pick which functional tests to run | 20:24 |
| bknudson | does keystone do that the same way tempest does? | 20:24 |
| hogepodge | https://github.com/openstack/defcore | 20:24 |
| dstanek | bknudson: you mean the direction i am heading? | 20:24 |
| bknudson | we only have a few tests now, but eventually we'll have to be able to exclude some | 20:25 |
| bknudson | maybe you only want to run "smoke" tests, or maybe you only want to run read-only tests. | 20:25 |
| dstanek | i am currently doing things just like unit tests where you can pick using a regex for the test name | 20:25 |
| dstanek | for something like that we can implement a tagging mechanism, but i don't know if that exists in testtools | 20:26 |
| dstanek | in the past i've done stuff like that with lettuce | 20:26 |
| bknudson | tempest already has a bunch of config switches | 20:26 |
| dstanek | i'll have to look and see how they implement it and see how easy it is to copy | 20:27 |
| bknudson | tempest also has test ids. | 20:27 |
| *** pnavarro has joined #openstack-keystone | 20:28 | |
| hogepodge | dstanek: https://review.openstack.org/#/c/169655/ | 20:28 |
| bknudson | we should definitely have functional tests for getting a token. | 20:29 |
| bknudson | and validating tokens and revoking tokens. | 20:30 |
| *** spandhe has joined #openstack-keystone | 20:34 | |
| hogepodge | I'd like for every api endpoint that doesn't need admin credentials to have tests and added to defcore. | 20:35 |
| hogepodge | That review (which I need to update) just gets identity into the defcore capabilities and required | 20:35 |
| bknudson | hogepodge: looks like you can reference tempest tests, what about keystone functional tests? | 20:36 |
| hogepodge | bknudson: We're looking at adding test sources so we can pull from different test suites | 20:37 |
| hogepodge | They need to be api only though, without needing admin credentials. | 20:37 |
| bknudson | the ones that we've got now don't require any credentials. | 20:38 |
| hogepodge | Keep in mind that configuration is already tough with Tempest, and we're wary about adding complexity on top of the test procedures. | 20:38 |
| hogepodge | Having n test suites for n projects is going to get really difficult to handle. | 20:38 |
| bknudson | maybe we should try to make sure we can all use the same config files or something. | 20:39 |
| hogepodge | bknudson: ideally I want to use a minimum config anway, and endpoint, user creds, and maybe some image and network names | 20:39 |
| bknudson | there's not much you can do against keystone with just user creds by default. | 20:41 |
| dstanek | hogepodge: that's really interesting. do you envision using the tests from the projects? | 20:41 |
| bknudson | get a token / delete a token -- get /, get /v2.0, get /v3. | 20:43 |
| hogepodge | dstanek: right now we have compute and storage in tempest, want to expand to identity and networking | 20:46 |
| dstanek | hogepodge: so i'm under the impression that tests that only hit keystone are considered functional test and don't belong in tempest...is that not correct? | 20:47 |
| *** edmondsw has quit IRC | 20:47 | |
| bknudson | there already are identity tests in tempest | 20:48 |
| hogepodge | bknudson: I just added non-admin identity tests | 20:48 |
| bknudson | I provided some for using a v3 token against a v2 service some time ago... might have been removed though | 20:48 |
| hogepodge | dstanek: If a test is used for defcore, it can be kept in tempest as part of interoperability testing | 20:49 |
| dstanek | bknudson: my understanding is that those things are supposed to be moved out | 20:49 |
| hogepodge | that becomes one of the criteria | 20:49 |
| bknudson | y, I think they're only there because we didn't have functional tests in keystone until this afternoon. | 20:49 |
| dstanek | so now i'm all sorts of confused because a significant number of our functional tests would be applicable to defcore | 20:50 |
| hogepodge | I can't speak for him, but mtreinish seems to want to make sure defcore is a major consumer of tempest. | 20:50 |
| bknudson | http://git.openstack.org/cgit/openstack/tempest/tree/tempest/api/identity/v3/test_tokens.py -- here they are | 20:50 |
| bknudson | here's a bunch: http://git.openstack.org/cgit/openstack/tempest/tree/tempest/api/identity/admin/v3 | 20:51 |
| hogepodge | dstanek: possibly, yes. swift already has its own major testing tree, and had a request submitted to start using their testing framework. That may become a larger model | 20:51 |
| hogepodge | dstanek: It's all under negotiation right now as we grow the process. We want to meet the needs of the community at large, and it's a big area for discussion. | 20:51 |
| mtreinish | dstanek: the contention is twofold, one if the test is a good interop test it probably also has value in the integrated test suite | 20:52 |
| mtreinish | some duplication between tests isn't reall a big deal | 20:52 |
| bknudson | mtreinish: once we've got it in keystone functional we delete from tempest, right? | 20:52 |
| mtreinish | the second is that tempest is designed to work against any deployed cloud which is a good fit for the defcore work, the functional tests don't necessarily have to have to have that constraint | 20:53 |
| mtreinish | bknudson: no not always | 20:53 |
| mtreinish | bknudson: https://wiki.openstack.org/wiki/QA/Tempest-test-removal | 20:53 |
| mtreinish | only where it makes sense | 20:53 |
| * morganfainberg avoids snarky responses while obnoxious git filter tree commands run in the background | 20:53 | |
| dstanek | mtreinish: so i've started to rewrite some of the tempest test in keystone; how do i know what should be removed from tempest? | 20:53 |
| mtreinish | dstanek: the parts of doing functional testing in a project tree aren't to duplicate what we've been doing in tempest | 20:54 |
| mtreinish | but to be more targetted and test lower level interactions to ensure things work | 20:54 |
| mtreinish | dstanek: well the wiki page gives the criteria for removal | 20:54 |
| bknudson | sounds like we need to consider whether a test should go in keystone or in tempest. | 20:55 |
| mtreinish | bknudson, dstanek: so for an example look at the 1 thing which has gone through this so far | 20:57 |
| dstanek | bknudson: i don't think so. i'd rather just say that our functional tests cover the usecases we care about and if there is overlap then that's OK | 20:57 |
| mtreinish | https://review.openstack.org/#/c/158852/ which was replaced with nova's: https://review.openstack.org/#/c/160423/ | 20:57 |
| dstanek | bknudson: i like the way we'll be able to point our tests at any keystone instance and run all of the usecases | 20:58 |
| *** stevemar has quit IRC | 20:58 | |
| bknudson | dstanek: you can point tempest at any keystone and run it. | 20:59 |
| mtreinish | dstanek: what I really like about that example is that it checks the db to ensure things didn't get stored when they shouldnt have | 20:59 |
| mtreinish | that's something functional testing can do and tempest can't | 20:59 |
| dstanek | bknudson: i have always had problems getting it to work on my devstack so i never followed through | 21:00 |
| morganfainberg | mtreinish, i would consider direct examination of the DB an exceptional case vs the norm though | 21:00 |
| bknudson | so I think one target of functional testing is federation... does that go in tempest? | 21:00 |
| mtreinish | well, if you constrain yourself to only testing the top level (like what tempest does) there is whole bunch of stuff you're going to miss | 21:00 |
| bknudson | catching tempest up with all the missing keystone tests is going to be a lot of work. | 21:00 |
| dstanek | mtreinish: i'd rather not do that if we can help it. makes the tests much more brittle | 21:00 |
| dstanek | mtreinish: for example, i want to run the tests and not care if the backend is LDAP, SQL or MongoDB | 21:01 |
| bknudson | we have a mongodb backend now? great! finally webscale. | 21:01 |
| morganfainberg | bknudson, shush :P | 21:01 |
| mtreinish | dstanek: my point is that what functional testing should give you is the ability to test a functional unit of keystone. Just testing through the api is already something we have and we've found we need more testing in between unit and that | 21:02 |
| mtreinish | bknudson: heh, I want to try webscale keystone | 21:02 |
| dstanek | mtreinish: right now i was planning on having functional tests only use the public api; do you know of cases where that isn't enough? | 21:04 |
| mtreinish | dstanek: although to be honest, I haven't really looked to closely at what you've be working on | 21:04 |
| dolphm | just want to point out that lbragstad has an 18 node keystone deployment running that spans two datacenters using fernet, and for example, you can create fernet tokens in either region and have them useable in the other region immediately. (same goes for user creates and whatnot) | 21:04 |
| dstanek | we only have web scale caching now :-( somebody was in there recently asking about using MondoDB for other backends | 21:05 |
| bknudson | fernet is webscale | 21:05 |
| dolphm | keystone is webscale! | 21:05 |
| mtreinish | dstanek: not with keystone, but there are tons of examples with things like neutron and nova where there are races which would be easily tested and caught | 21:05 |
| dstanek | dolphm: very nice | 21:05 |
| mtreinish | but we can't test with limiting ourselves to going through the rest api | 21:05 |
| morganfainberg | dolphm, that is actually a part of fernet i was disucssing using within HP recently | 21:05 |
| morganfainberg | dolphm, a big push to get us really looking at fernet cause... fernet. | 21:05 |
| * lbragstad cracks beers | 21:05 | |
| dolphm | morganfainberg: that's like, the *point* of fernet IMO lol | 21:05 |
| morganfainberg | dolphm, no, the point of fernet is no token persistence | 21:06 |
| morganfainberg | dolphm, the benefit is fernet is much much more | 21:06 |
| dolphm | which enables webscale! | 21:06 |
| morganfainberg | dolphm, ;) | 21:06 |
| * morganfainberg stares harder at awful git filter-tree commands | 21:06 | |
| dolphm | lbragstad: that reminds me, i got a Deschutes Saison that isn't approved for sale in TX by the TABC yet | 21:06 |
| mtreinish | morganfainberg: heh, yeah it's awful | 21:06 |
| bknudson | so what about federation tests, do they go in tempest for keystone? | 21:06 |
| dstanek | morganfainberg: the more you look at them the worse they become | 21:06 |
| morganfainberg | bknudson, functional for now | 21:06 |
| morganfainberg | bknudson, since we have more control on the scenarios and has next to no impact on other services. | 21:07 |
| bknudson | that makes sense. | 21:07 |
| morganfainberg | bknudson, long term i'd like a federated IdP used for some tests in tempest | 21:07 |
| bknudson | shouldn't need a whole tempest run for every possible keystone config. | 21:07 |
| morganfainberg | make sure we don't miss some critical bit that makes nova/neutron break with a federated token | 21:07 |
| morganfainberg | but lets start small | 21:07 |
| morganfainberg | and actually just test it ;) | 21:08 |
| bknudson | we should bikeshed it for a long time first. | 21:08 |
| morganfainberg | for k2k we wont ever run full tempest. | 21:08 |
| morganfainberg | bknudson, totally | 21:08 |
| morganfainberg | bknudson, can we have a whole session at the summon on bikeshedding the bikeshedding? | 21:08 |
| mtreinish | bknudson: that's our normal path to getting everything done | 21:08 |
| morganfainberg | mtreinish, dstanek, working on splitting keystoneauth bits from python-keystoneclient | 21:09 |
| morganfainberg | is not fun | 21:09 |
| dolphm | morganfainberg: last summit we stopped a sessions to define bikeshedding | 21:09 |
| dolphm | a session* | 21:09 |
| * mtreinish likes his dimly lit corner where he doesn't have to talk to anyone | 21:09 | |
| * morganfainberg is trying to avoid "fork keystoneclient" and then rip stuff out | 21:09 | |
| * morganfainberg shines a spot light on mtreinish's corner | 21:09 | |
| dolphm | morganfainberg: because someone asked, and then we argued over the definition of bikeshedding for a moment | 21:09 |
| morganfainberg | dolphm, that.. | 21:09 |
| morganfainberg | dolphm, is so sad it's epic | 21:09 |
| morganfainberg | ok so.. | 21:10 |
| morganfainberg | i am about >.< close to saying "screw this" and just forking keystoneclient and ripping crap out of it | 21:10 |
| morganfainberg | instead of trying to filter relevant files. | 21:10 |
| mtreinish | morganfainberg: are you working on something like this: http://git.openstack.org/cgit/openstack/tempest-lib/diff/tools/migrate_from_tempest.sh?id=5372a58a79ff6675756499e8fe3d00caa294d559 | 21:10 |
| morganfainberg | mtreinish, similar | 21:10 |
| morganfainberg | mtreinish, but more oslo-graduation style | 21:10 |
| mtreinish | which is what I used for the original tempest-lib split | 21:10 |
| morganfainberg | less tempest-y | 21:11 |
| mtreinish | heh, that's where I stole most of it from :) | 21:11 |
| morganfainberg | ;) | 21:11 |
| morganfainberg | yeah it's not fun. cause things are all inter-twined | 21:11 |
| morganfainberg | i don't know if i care if we carry all of keystoneclient's history in this split or not. | 21:11 |
| morganfainberg | i'm rapidly approaching don't get a crap. | 21:11 |
| morganfainberg | vs. isolated history that is. | 21:12 |
| morganfainberg | dolphm, dstanek, bknudson, gyee, any of you care if i just do a keystoneclient fork instead of isolating history out? | 21:12 |
| dstanek | morganfainberg: nope | 21:13 |
| morganfainberg | mtreinish, my issue is things are pretty inter-mixed. | 21:13 |
| mtreinish | morganfainberg: so we moved to just copying the file and using a list of change-ids in the commit msg | 21:13 |
| bknudson | morganfainberg: I like the history... but I've never had to deal with splitting a repo so I have no idea how hard it is to get it. | 21:13 |
| mtreinish | that way if people cared they could look things up | 21:13 |
| mtreinish | but we didn't have to worry about the history mess | 21:13 |
| morganfainberg | mtreinish, the issue here is i'd like to keep session history in repo. it's kindof a lot of things to care about to see how things changed | 21:14 |
| mtreinish | morganfainberg: yeah we had that inter-mixed issue (luckily not on the initial import) which is why we gave up using the git filter-tree in the script | 21:14 |
| morganfainberg | bknudson, it's doable but it's less fun each time i do it. at least with middleware it was *really* just 1 small directory | 21:14 |
| morganfainberg | this is not even remotely isolated. | 21:15 |
| morganfainberg | bknudson, this is my current filter-list: http://paste.openstack.org/show/204920/ | 21:15 |
| morganfainberg | bknudson, i can import session | 21:16 |
| morganfainberg | bknudson, i could just run with that and we can just copy things back in if needed. | 21:16 |
| morganfainberg | i *think* that is most of the auth things. | 21:16 |
| mtreinish | morganfainberg: my favorite was for whatever reason the script kept trying to pull in: http://git.openstack.org/cgit/openstack/tempest/commit/?id=ec3f7090203671f76f8886c26b36d8460858b023 | 21:16 |
| morganfainberg | HAHA | 21:17 |
| mtreinish | which doesn't have anything to do with the current tempest tree and all of those files no longer exist | 21:17 |
| bknudson | ugh, not again, stable/juno global requirements update is failing: https://review.openstack.org/#/c/173123/ | 21:18 |
| morganfainberg | bknudson, oslo.messaging | 21:18 |
| morganfainberg | bknudson, yay lets make stable branches of projects that never understood stable. /comfort | 21:18 |
| mtreinish | morganfainberg: heh, what part of the name "stable branch" makes you think they'll be stable :) | 21:23 |
| morganfainberg | bknudson, https://github.com/morganfainberg/keystoneauth that is my first pass | 21:28 |
| morganfainberg | still looking at tests and such | 21:29 |
| morganfainberg | my goal is to make it so i can replace the stuff in ksc and it works. | 21:29 |
| morganfainberg | for unit tests | 21:29 |
| bknudson | neat! | 21:29 |
| gyee | morganfainberg, does that history will not be preserved for the fork? | 21:31 |
| gyee | does that mean | 21:31 |
| *** mattfarina has quit IRC | 21:37 | |
| morganfainberg | bknudson, ok so passes pep8, did a couple force-pushes to my repo | 21:40 |
| morganfainberg | bknudson, checking unit tests and if these pass, will check coverage then see if i can make keystoneclient work through it's unit tests | 21:41 |
| morganfainberg | bknudson, if that all works will push the infra changes up | 21:41 |
| morganfainberg | then we start hacking it up to a real release | 21:41 |
| morganfainberg | gyee, i'm trying to hang onto the history w/o needing all of keystoneclient's history | 21:42 |
| morganfainberg | gyee, it will either be "only keystoneauth file history" or "all of keystoneclient history" | 21:42 |
| morganfainberg | not "no history" | 21:42 |
| gyee | that should be fine then | 21:44 |
| *** iamjarvo has quit IRC | 21:59 | |
| *** pnavarro has quit IRC | 22:04 | |
| *** david-lyle has joined #openstack-keystone | 22:04 | |
| *** joesavak has quit IRC | 22:07 | |
| *** alexsyip has quit IRC | 22:16 | |
| morganfainberg | jamielennox|away, ping: https://github.com/morganfainberg/keystoneauth | 22:20 |
| morganfainberg | jamielennox|away, is there anything missing? | 22:20 |
| morganfainberg | jamielennox|away, i can merge in any other required files pretty easily now. | 22:21 |
| openstackgerrit | Merged openstack/keystone: Move common checks into base testcase https://review.openstack.org/167852 | 22:25 |
| openstackgerrit | guang-yee proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 22:25 |
| *** rushil has quit IRC | 22:25 | |
| gyee | dstanek: take 12 ^^^ | 22:26 |
| *** bknudson has quit IRC | 22:26 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 22:26 |
| *** gordc has quit IRC | 22:26 | |
| *** blogan has joined #openstack-keystone | 22:31 | |
| dstanek | gyee: sweet ill take a look after dinner | 22:31 |
| blogan | got a question about the keystone client authentication | 22:33 |
| openstackgerrit | Merged openstack/keystone: Update developer doc to reference Ubuntu 14 https://review.openstack.org/174563 | 22:33 |
| blogan | is instantiated the keystoneclient.v2_0.v2_client.Client deprecated? | 22:33 |
| openstackgerrit | Merged openstack/keystone: Adds an initial functional test https://review.openstack.org/158466 | 22:33 |
| openstackgerrit | Merged openstack/keystone: adds a tox target for functional tests https://review.openstack.org/150528 | 22:33 |
| bigjools | hi - can someone help me please, I'm looking for the handler that deals with the websso url at /v3/auth/OS-FEDERATION/websso/kerberos?origin=foo | 22:33 |
| blogan | and v3 version of that | 22:33 |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/172139 | 22:33 |
| gyee | dstanek, Cavs don't play tonight :) | 22:39 |
| *** _cjones_ has quit IRC | 22:46 | |
| *** _cjones_ has joined #openstack-keystone | 22:49 | |
| morganfainberg | blogan, no. the client v2 object is not deprecated | 22:50 |
| morganfainberg | blogan, the CLI is deprecated | 22:50 |
| morganfainberg | blogan, from keystoneclient | 22:50 |
| blogan | morganfainberg: http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html#non-session-authentication-deprecated | 22:51 |
| blogan | morganfainberg: thats abotu the deprecated way to authenticate right? | 22:51 |
| morganfainberg | blogan, correct | 22:51 |
| morganfainberg | blogan, doesn't impact the actual client object, the client object should still work [and be transparent] with the new authentication methods | 22:51 |
| blogan | so is this deprecated then too? | 22:52 |
| blogan | https://gist.github.com/the2hill/8b2918679eb876286e68 | 22:52 |
| blogan | morganfainberg: ^^ | 22:52 |
| morganfainberg | blogan, it isn't using the session mechanism, so yeah i think so. | 22:52 |
| morganfainberg | oh wait | 22:52 |
| morganfainberg | hm | 22:52 |
| blogan | morganfainberg: or would you suggest using the Password stuff | 22:52 |
| morganfainberg | no that is using session | 22:52 |
| morganfainberg | that should be fine to use | 22:52 |
| blogan | morganfainberg: i know, and its throwing me off | 22:52 |
| morganfainberg | it's about session and auth plugins. | 22:52 |
| blogan | morganfainberg: okay, since it is using the session mechanism, then it should be fine | 22:53 |
| morganfainberg | blogan, so i think that gist is just doing inverse order | 22:53 |
| morganfainberg | it's not passing a session object to the client | 22:53 |
| blogan | morganfainberg: so that would mean its wrong | 22:53 |
| bigjools | which version of django_openstack_auth should I use with Juno keystone? | 22:53 |
| morganfainberg | it's grabbing it from the client | 22:53 |
| blogan | morganfainberg: well the session that gets instantiated when then be used in novaclient or neutronclient | 22:53 |
| morganfainberg | blogan, i'd have to dig a bit more i'm off in git split land, but the actual client object should not be deprecated | 22:54 |
| blogan | morganfainberg: is the typical way to build a session using the Password class? | 22:54 |
| morganfainberg | blogan, this is the reference i'll point you at: http://www.jamielennox.net/blog/2014/02/24/client-session-objects/ | 22:55 |
| morganfainberg | blogan, it's the most concise explanation of using session that i've seen [since jamielennox|away wrote session object it helps] | 22:55 |
| blogan | morganfainberg: thanks, i'll read through it, just wonder if how that gist is doing it is also okay | 22:57 |
| morganfainberg | blogan, the gist is inverting some logic | 22:57 |
| blogan | morganfainberg: yeah thats what it seems, getting a client to get a session, seems odd | 22:58 |
| morganfainberg | blogan, it's not wrong but if you follow jamielennox|away's example you end up with the session independant of the client | 22:58 |
| blogan | morganfainberg: yeah but we're trying to support v2 and v3, and v2 accepts tenant_name, while v3 is looking for project_name | 22:58 |
| morganfainberg | blogan, fwiw i expect V2 to officially deprecate in liberty | 22:59 |
| blogan | morganfainberg: we're just in the testing crap out mode right now, we're probably doing soemthign wrong | 22:59 |
| lifeless | morganfainberg: I hope my questions about the middleware thing are making sense | 22:59 |
| morganfainberg | lifeless, totally did | 22:59 |
| blogan | morganfainberg: ah good to know | 22:59 |
| morganfainberg | lifeless, i tried to address the first round, haven't looked if there was a second round | 22:59 |
| morganfainberg | lifeless, i'll respond on the ML, but the long and short is nova's g-r is the issue | 23:01 |
| morganfainberg | middleware needs to coordinate it's release with requirements. | 23:01 |
| morganfainberg | 1.5 has flat out incompatible requirements with juno nova for example | 23:02 |
| morganfainberg | lifeless, the interfaces are all the same | 23:02 |
| morganfainberg | lifeless, so in this case because we run *in* the same interpreter as nova, our release needs to be in-line with nova's release. | 23:03 |
| morganfainberg | if we can lighten up middleware's dependencies (we are on the way) this may be less of an issue. thankfully middleware has very limited "new" functionality nova has to rely on. we pass some headers down to the app | 23:04 |
| morganfainberg | lifeless, i'll reply to the ML thread as well but it's long-and-short middleware is in a weird place when it comes to how it interfaces with the other apps. it would be better if it stood separate from the app's interpreter, but not sure how we'd accomplish that atm | 23:05 |
| morganfainberg | https://github.com/pypa/pip/issues/988 is largely at fault. but still if we have incompatible requirements we'd not be able to work with nova. | 23:06 |
| morganfainberg | middleware is again wierd. it is somewhere between a "service" and a library | 23:06 |
| morganfainberg | it's just implied dependencies all the way down. | 23:08 |
| morganfainberg | to be fair when we implemented the plugin auth it should have been a 2.x feature | 23:09 |
| morganfainberg | not a 1.x.x | 23:09 |
| lifeless | morganfainberg: why are the requirements incompatible? | 23:10 |
| lifeless | morganfainberg: as in, is nova too tight, or middleware too tight? | 23:11 |
| morganfainberg | lifeless, typically nova and the other services are | 23:11 |
| lifeless | mordred: ^ - this is an example of the known-good pathology :) | 23:11 |
| mordred | lifeless: reading - although I'm certain I will still disagree with you :) | 23:11 |
| morganfainberg | lifeless, yes and i'd rather go with provided known good than the current headache | 23:12 |
| lifeless | morganfainberg: right, with known-bad in-repo? | 23:12 |
| morganfainberg | lifeless, it is currently a massive headache for me the developer, and a miserable experience for deployers | 23:12 |
| morganfainberg | lifeless, known-bad for instance X | 23:12 |
| morganfainberg | lifeless, not globally known-bad | 23:12 |
| morganfainberg | or more "discovered bad" | 23:12 |
| lifeless | morganfainberg: yes. | 23:12 |
| mordred | it sounds like middleware did not participate properly in g-r | 23:13 |
| morganfainberg | mordred, it absolutely does. | 23:13 |
| mordred | then how does it have a problem? | 23:13 |
| morganfainberg | mordred, the issue is when did we g-r bump | 23:13 |
| morganfainberg | mordred, 1.2, 1.3, 1.5? | 23:13 |
| morganfainberg | mordred, and which version can run in nova | 23:13 |
| mordred | ah | 23:13 |
| morganfainberg | that was run in juno | 23:13 |
| mordred | you don't have stable release things do you? | 23:13 |
| morganfainberg | mordred, we do now. | 23:13 |
| mordred | yah | 23:13 |
| mordred | because you have to with our model currently | 23:14 |
| morganfainberg | but now the question is which versions get backports? | 23:14 |
| morganfainberg | all of them? | 23:14 |
| morganfainberg | this is getting silly :P | 23:14 |
| mordred | nope. only the one that's stable/kilo | 23:14 |
| mordred | the others are meh | 23:14 |
| morganfainberg | so then how does the deployer know this. | 23:14 |
| morganfainberg | or how do the developers deal with it | 23:14 |
| mordred | the deployer shold be deploying teh kilo release, no? | 23:14 |
| morganfainberg | do we increment X in the semver model per cycle? | 23:14 |
| mordred | why would a deployer or developer care about 1.3 at this point? | 23:14 |
| morganfainberg | mordred, 1.3 is the one that works with juno | 23:14 |
| *** alexsyip has joined #openstack-keystone | 23:14 | |
| mordred | why do you think semver communicates anything here? | 23:15 |
| morganfainberg | mordred, 1.5 came with kilo | 23:15 |
| mordred | semver is not a model that is applicable to server portions of openstack | 23:15 |
| lifeless | morganfainberg: 1.5 will work with juno too though right? functionally I mean | 23:15 |
| mordred | it's a wasted energy | 23:15 |
| morganfainberg | mordred, it doesn't. that was why i was moving middleware to release with the name-d versions of te servers | 23:15 |
| mordred | morganfainberg: yes | 23:15 |
| morganfainberg | lifeless, correct. | 23:15 |
| morganfainberg | mordred, this discussion spun out of why this change was occuring | 23:15 |
| mordred | gotcha | 23:15 |
| mordred | I did not read far enough back | 23:15 |
| mordred | yeah - basically - because we do that | 23:16 |
| morganfainberg | lifeless, in fact, 1.0.0 would work [except some security fixes that are scaaaaary] | 23:16 |
| morganfainberg | lifeless, config options aside [some nifty config options don't work with 1.0.0] | 23:16 |
| morganfainberg | but impact should be exactly zero on nova in that regard | 23:16 |
| mordred | if we want to decouple rather than continue to couple, we will have to change the entire release model and stable branch model, IMHO | 23:16 |
| mordred | and that may be a thing to do | 23:17 |
| morganfainberg | mordred, yeah middleware is a lib that is coupled to server releases, vs. say oslo.XXX which is a lib that is decoupled. | 23:17 |
| lifeless | mordred: I don't think so. There is really only one thing causing friction, and thats the requirements management - AFAICT | 23:17 |
| mordred | lifeless: that may be - but nobody (including you) have suggested a thing that will actually also work | 23:17 |
| lifeless | mordred: which is driven by multiple different audiences concerns | 23:17 |
| lifeless | mordred: I believe I did on that etherpad | 23:17 |
| morganfainberg | lifeless, i'm fine with moving back sometime in the future [i'm inclined to use a swift-semver model for middleware] until we can decouple | 23:18 |
| mordred | lifeless: I believe we missed each other some how | 23:18 |
| morganfainberg | vs. the 20XX.Y.Z model | 23:18 |
| mordred | lifeless: because "release a known good thing" is important | 23:18 |
| morganfainberg | lifeless, then when/if decouple happens its easy to swing it back to more open. | 23:18 |
| mordred | lifeless: I am not convinced that less restrictive requirements ranges will solve thigns- only produce a different as-yet-unknown set of challenges | 23:19 |
| mordred | these challenges suck | 23:19 |
| mordred | but we do fully grok them, bad as they are | 23:19 |
| mordred | so a replacement needs to be pretty fully fleshed out | 23:19 |
| mordred | no? | 23:19 |
| lifeless | mordred: fixing pip is a key part of any solution | 23:19 |
| mordred | well, yeah | 23:19 |
| lifeless | mordred: I am tired of solutions that presume we don't fix pip. thus doing that. | 23:19 |
| mordred | yes. | 23:19 |
| mordred | if/when pip does different things, I think the conversation becomes very different | 23:20 |
| lifeless | mordred: as a consequence, I now want to work through solutions that presume pip is fixed (to be no worse than e.g. yum or rpm) | 23:20 |
| morganfainberg | mordred, agreed. | 23:20 |
| mordred | gotcha | 23:20 |
| lifeless | we've spent way too long not fixing the fundamental tech debt | 23:20 |
| lifeless | </rant> | 23:20 |
| mordred | lifeless: I am on board with that - and I now understand the pov that you are speaking from | 23:20 |
| morganfainberg | hey mordred: https://github.com/morganfainberg/keystoneauth | 23:20 |
| mordred | morganfainberg: neat! | 23:21 |
| morganfainberg | it's on it's way. should have confirmation tomorrow if anything is missing. then get it to gerrit and play the "remove everything not needed" | 23:21 |
| mordred | morganfainberg: this is the thing that gets me keystoneauth and a Session object? | 23:21 |
| morganfainberg | mordred, yep | 23:21 |
| mordred | woot | 23:21 |
| morganfainberg | mordred, it still has a lot more dependencies than it needs. | 23:21 |
| morganfainberg | mordred, but this was just the split to get it out of client | 23:21 |
| mordred | morganfainberg: I may have some requests for some API functions :) | 23:21 |
| morganfainberg | mordred, next step is do massive restructure/kill things that suck, internalize the right interfaces | 23:21 |
| mordred | ++ | 23:22 |
| morganfainberg | i expect to get us to a good point for a 0.xx release, with a 1.0 a little later in the cycle | 23:22 |
| morganfainberg | i am going to go on record both in g-r and in this project, if we do a 2.x, all interfaces are open to be broken | 23:22 |
| morganfainberg | no implied contract across major versions. | 23:23 |
| morganfainberg | i hope we don't need a 2.x, but | 23:23 |
| morganfainberg | if we do... | 23:23 |
| mordred | morganfainberg: http://paste.openstack.org/show/204930/ | 23:24 |
| mordred | those are the interfaces on session I use right now | 23:25 |
| mordred | morganfainberg: obviously, some of them are ugly | 23:25 |
| morganfainberg | cool. | 23:25 |
| morganfainberg | yeah | 23:25 |
| mordred | morganfainberg: other than constructing the session, I never know anything other than the session | 23:25 |
| mordred | so have to ask it for all things | 23:25 |
| morganfainberg | right | 23:25 |
| morganfainberg | it would be nice if some of that was done for you if asked | 23:26 |
| mordred | morganfainberg: I'd like to be able to query some things about service endpoints and service catalog slightly differently - but I can also just chew on the service catalog for a while | 23:26 |
| morganfainberg | right | 23:26 |
| mordred | morganfainberg: oh - also ... | 23:26 |
| morganfainberg | sounds good. as soon as we have it in gerrit and stripped of the bits we don't want (oslo.serialization will go away from this thing) | 23:27 |
| mordred | morganfainberg: the top one on line 1 is the special way I have to get the url for constructing the keystone client | 23:27 |
| morganfainberg | i'll ping ya so we can fix these things. | 23:27 |
| mordred | the one on line 9 is the way the other services work :) | 23:27 |
| morganfainberg | ksc is weird | 23:27 |
| morganfainberg | because we've mixed auth *and* interfacing with our API | 23:27 |
| morganfainberg | i also aim to fix that in liberty | 23:28 |
| *** thedodd has joined #openstack-keystone | 23:30 | |
| *** rm_work is now known as rm_work|away | 23:31 | |
| *** arif-ali has quit IRC | 23:34 | |
| *** chlong has joined #openstack-keystone | 23:34 | |
| *** jaosorior has quit IRC | 23:42 | |
| *** david-ly_ has joined #openstack-keystone | 23:44 | |
| *** jamielennox|away is now known as jamielennox | 23:45 | |
| *** david-lyle has quit IRC | 23:45 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:46 | |
| *** david-ly_ is now known as david-lyle | 23:46 | |
| jamielennox | morganfainberg: if the tests are passing that looks fine to me | 23:49 |
| morganfainberg | jamielennox, tests are in-fact passing | 23:50 |
| jamielennox | only thing i see is a few extra pieces in openstack/common - but no big deal | 23:50 |
| morganfainberg | jamielennox, once it's in gerrit we want to eliminate as much oslo as we can. | 23:50 |
| jamielennox | morganfainberg: yep, there's a number of things i want to change there | 23:50 |
| morganfainberg | and restructure anything that needs to be internal api/etc | 23:50 |
| morganfainberg | jamielennox, does cms need to live here? | 23:50 |
| morganfainberg | should it live here? | 23:50 |
| morganfainberg | since cms *is* related to auth-y-things | 23:51 |
| jamielennox | morganfainberg: no, i don't think so | 23:52 |
| morganfainberg | well cms needs to move out of client | 23:52 |
| jamielennox | morganfainberg: i fully expect to do another keystonecommon library or something else soon, but i want this one fairly lean | 23:52 |
| morganfainberg | as does your positional decorator | 23:52 |
| jamielennox | hmm, positional.... | 23:52 |
| jamielennox | debtcollector did offer to take it | 23:52 |
| jamielennox | i just wasn't sure i wanted the dependency | 23:52 |
| morganfainberg | well we now have it copied in 2 repos | 23:53 |
| morganfainberg | keystoneauth shouldn't be required for it | 23:53 |
| morganfainberg | as it's useful on it's own | 23:53 |
| jamielennox | right | 23:53 |
| morganfainberg | so something we will need to fix | 23:54 |
| morganfainberg | the plugins got renamed in their entry points | 23:54 |
| jamielennox | maybe i just convert everything to **kwargs and make sure to check them all | 23:54 |
| morganfainberg | do we want to move our namespace to keystoneauth | 23:54 |
| morganfainberg | and just check keystoneclient as a fallback for compat? | 23:54 |
| jamielennox | ergh, probably | 23:54 |
| jamielennox | i mean there's no requirement, it's just a label | 23:54 |
| jamielennox | but it doesn't really make sense to be keystoneclient.X | 23:55 |
| morganfainberg | correct | 23:55 |
| morganfainberg | i think keystoneauth makes a ton more sense | 23:55 |
| jamielennox | ok, well that should be ok. i'll need to fix up OSC i think because they do there own thing | 23:55 |
| morganfainberg | jamielennox, the other thing is we will be ok to break anything/everything in the 2.x release of this if we want to go down that path | 23:56 |
| jamielennox | if we rename the label we can run them side by side - i'm not sure if that's easier or more confusing yet | 23:56 |
| jamielennox | ie password plugin from ksc wont conflict with ksa | 23:56 |
| morganfainberg | just going on record that this is totally fine to break all the things if we increment X in semver | 23:56 |
| morganfainberg | not that we have to break all the things | 23:57 |
| morganfainberg | anyway | 23:57 |
| jamielennox | yea, that's going to be a big task - but it shouldn't be required yet | 23:57 |
| morganfainberg | i'll work to get this into gerrit in the next couple days | 23:57 |
| jamielennox | morganfainberg: thanks for sorting that out | 23:57 |
| morganfainberg | since TC meeting is tomorrow... i wanted this up for the vote | 23:57 |
| morganfainberg | but it might be deferred until new TC convienes | 23:58 |
| *** openstackgerrit has quit IRC | 23:58 | |
| jamielennox | will this need a vote? i assumed it would just be an infra patch | 23:58 |
| *** openstackgerrit has joined #openstack-keystone | 23:58 | |
| morganfainberg | governance patch | 23:58 |
| morganfainberg | since it adds it to keystone | 23:58 |
| morganfainberg | need to fix the errors here | 23:59 |
| morganfainberg | https://review.openstack.org/#/c/175596/ | 23:59 |
| jamielennox | oh, meh - mostly a formality | 23:59 |
| morganfainberg | i keep forgetting '-' precedes "a" in alphabatizing | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!