| jamielennox | bigjools: we tend to be strict | 00:05 |
|---|---|---|
| bigjools | I can do strict | 00:06 |
| samueldmq | jamielennox, hi | 00:11 |
| samueldmq | jamielennox, you already have ds patches for v3 ? :-) | 00:11 |
| jamielennox | samueldmq: if only it was just devstack :( | 00:11 |
| jamielennox | need https://review.openstack.org/187094 for ksc | 00:12 |
| samueldmq | jamielennox, :/ is that ec2 stuff related ? or you need to get that merged to then have time for ds ? | 00:12 |
| jamielennox | https://review.openstack.org/187127 for osc | 00:12 |
| jamielennox | then devstack patches start https://review.openstack.org/186678 | 00:13 |
| *** gokrokve has quit IRC | 00:13 | |
| *** zzzeek has quit IRC | 00:14 | |
| *** gokrokve has joined #openstack-keystone | 00:14 | |
| samueldmq | jamielennox, why do the other gates fail ? | 00:16 |
| jamielennox | samueldmq: there is an auth issue with osc | 00:16 |
| jamielennox | umm | 00:16 |
| jamielennox | https://review.openstack.org/187033 | 00:17 |
| jamielennox | so need that one as well | 00:17 |
| samueldmq | jamielennox, and don't forget to run 'check experimental' to see how things are progressing :-) | 00:17 |
| jamielennox | samueldmq: i haven't gotten it to run to the end on my own machine yet :) | 00:17 |
| *** gokrokve has quit IRC | 00:18 | |
| samueldmq | jamielennox, k :) | 00:20 |
| *** someara2 has quit IRC | 00:25 | |
| *** someara2 has joined #openstack-keystone | 00:25 | |
| samueldmq | jamielennox, looking at #187094, I found some issues in the copyrights | 00:29 |
| jamielennox | samueldmq: oh, yea ok - that's because i c&p the file from v2 | 00:29 |
| *** someara2 has quit IRC | 00:30 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add EC2 CRUD credential support to v3 API https://review.openstack.org/187094 | 00:30 |
| lifeless | jamielennox: did you just say 'thats ok'....'c&p' ? | 00:32 |
| lifeless | cause. | 00:32 |
| lifeless | Really? | 00:32 |
| jamielennox | lifeless: i then went and fixed it - but i'm always weird about changing copyright headers on files | 00:33 |
| jamielennox | lifeless: the fact that file exists at all is a concern for everyone | 00:33 |
| lifeless | :) | 00:34 |
| *** gyee has quit IRC | 00:34 | |
| samueldmq | jamielennox, why is that defining a __repr__ ? I don't see that on other resources | 00:36 |
| samueldmq | jamielennox, is tht what is returned when we print it ? | 00:36 |
| jamielennox | samueldmq: it came from the v2 file | 00:36 |
| jamielennox | yep | 00:36 |
| samueldmq | jamielennox, cool | 00:36 |
| jamielennox | i didn't see any reason to remove it | 00:36 |
| samueldmq | jamielennox, ++ | 00:37 |
| samueldmq | jamielennox, is there any diff between /v3/ec2.py and /v2.0/ec2.py | 00:38 |
| jamielennox | samueldmq: just the imports i think | 00:38 |
| jamielennox | oh - i removed the EC2().delete function - cause as far as i can tell it must be broken in v2 :p | 00:38 |
| samueldmq | jamielennox, yeah, that's the only thing that changes | 00:39 |
| samueldmq | jamielennox, isn't there any way to easily re-use that code? | 00:40 |
| samueldmq | jamielennox, (I am not against your approach, I am just looking at the possibilities :)) | 00:40 |
| jamielennox | samueldmq: we haven't for anything else - but for everything else there is generally at least some difference between v2 and v3 | 00:41 |
| jamielennox | it's possible, i don't know if it's worth it | 00:42 |
| samueldmq | jamielennox, ksclient code is cool :) | 00:42 |
| jamielennox | samueldmq: it's really not | 00:42 |
| samueldmq | jamielennox, at least not for now, maybe in a future patch | 00:42 |
| samueldmq | jamielennox, what doesn't make you happy in ther , | 00:42 |
| samueldmq | ? | 00:42 |
| jamielennox | samueldmq: amongst other things the base CRUD create etc methods get in the way - you can see a lot of managers ignoring them and going straight to the _get/_post functions to get around them | 00:44 |
| jamielennox | once you start talking about how it auths there is a long list of problems there | 00:44 |
| jamielennox | but essentially we can't break any existing behaviour so we've had to build hack on top of hack | 00:44 |
| samueldmq | jamielennox, :/ | 00:44 |
| jamielennox | when it was initially built it was a backend for the CLI, so there are a lot of assumptions that don't work for a normal library | 00:45 |
| jamielennox | anyway there are plans afoot to fix it | 00:45 |
| samueldmq | jamielennox, ++ | 00:47 |
| samueldmq | jamielennox, btw, what exactly are ec2 credentials ? | 00:48 |
| jamielennox | ec2 is aws's compute service, the way aws does auth is with a access_id and secret key which you sign messages with | 00:48 |
| jamielennox | i don't know why but at some point there was the intention that nova was going to be EC2 compatible | 00:49 |
| jamielennox | and so keystone had to know how to auth with these credentials | 00:49 |
| jamielennox | i think now they are mostly unused except for heat who uses them as a hack around the limitations in trusts | 00:49 |
| *** nkinder__ has joined #openstack-keystone | 00:50 | |
| jamielennox | i've never used them myself | 00:50 |
| samueldmq | jamielennox, me neither (obviously seen from my question) :p | 00:50 |
| samueldmq | jamielennox, we shouldn't redefine the tests in v3/test_ec2.py | 00:51 |
| samueldmq | jamielennox, just create the file, and the class EC2Tests should inherit from the class EC2Tests from v2.à | 00:51 |
| samueldmq | v2.0* | 00:51 |
| samueldmq | jamielennox, makes sense? | 00:51 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 00:52 | |
| *** _cjones_ has quit IRC | 00:52 | |
| samueldmq | jamielennox, the same for ec2.EC2Manager | 00:55 |
| samueldmq | jamielennox, left one last review, let me know if you disagree with what I suggested | 00:56 |
| jamielennox | samueldmq: i'm torn, they should be different things but it's just the server side implementation is stupid | 00:59 |
| *** lhcheng has quit IRC | 01:01 | |
| samueldmq | jamielennox, hmm ... and actually if you hadn't removed the 'def delete(self):' in EC2, we didnt need to redefine that at all | 01:02 |
| samueldmq | jamielennox, actually that should happend to any entity that hasn't changed from v2 to v3 | 01:02 |
| samueldmq | jamielennox, and maybe placed in a separate directory other than v2.0 and v3 | 01:02 |
| *** lhcheng has joined #openstack-keystone | 01:03 | |
| *** ChanServ sets mode: +v lhcheng | 01:03 | |
| samueldmq | jamielennox, but well ... one thing at a time :) | 01:03 |
| *** lhcheng has quit IRC | 01:07 | |
| samueldmq | jamielennox, currently looking at the osc change | 01:08 |
| jamielennox | there's a bug in the OSC change | 01:09 |
| jamielennox | it says identity.tenants and it's supposed to be identity.project | 01:10 |
| jamielennox | s | 01:10 |
| samueldmq | jamielennox, is there any difference between /identity/v3/ec2creds.py and /identity/v2.0/ec2creds.py ? | 01:12 |
| jamielennox | i think just that bug i mentione | 01:12 |
| jamielennox | d | 01:12 |
| samueldmq | jamielennox, is the bug in v2.0? (in the v2.0 endpoint it says project, when it should be tenant) | 01:12 |
| jamielennox | no, it's a c&p mistake, it's supposed to be tenants in v2 but projects in v3 | 01:12 |
| jamielennox | but i know it's OSC policy that they will replicate the code between versions | 01:13 |
| jamielennox | because that way you can fix inconsistencies in individual APIs | 01:13 |
| samueldmq | jamielennox, yeah makes sense, as it is the cli .. | 01:14 |
| * morganfainberg lurks in the corner of the airport | 01:15 | |
| samueldmq | morganfainberg, o/ | 01:15 |
| morganfainberg | jamielennox: i pay so little attention to anything beyond the apache license | 01:15 |
| morganfainberg | :P | 01:15 |
| samueldmq | jamielennox, in the osc change ... only the copyright to be chagned | 01:16 |
| samueldmq | jamielennox, and a small nit in a comment | 01:16 |
| samueldmq | doc* | 01:16 |
| jamielennox | morganfainberg: yea, i have no idea what the policy is on assigning copyright any more | 01:17 |
| morganfainberg | jamielennox: my rule is "i don't" | 01:17 |
| jamielennox | i know if i more or less c&p a file i'm not supposed to change it | 01:17 |
| jamielennox | morganfainberg: same | 01:17 |
| morganfainberg | and if someone complains... then i'll fix it | 01:17 |
| samueldmq | jamielennox, morganfainberg even the year ? | 01:17 |
| morganfainberg | and appologize then | 01:17 |
| jamielennox | samueldmq: i really don't know | 01:17 |
| morganfainberg | samueldmq: i'd remove the copyright over changing the year | 01:17 |
| morganfainberg | if i change anything it'll be removing those things | 01:18 |
| morganfainberg | my personal rule | 01:18 |
| morganfainberg | and so far, no one has complained | 01:18 |
| * morganfainberg doesn't go out of the way to remove them | 01:18 | |
| samueldmq | morganfainberg, remove the whole copyright ? | 01:18 |
| samueldmq | oO | 01:18 |
| morganfainberg | if i am changing copyright headers | 01:19 |
| morganfainberg | that is my rule. i'd remove them vs. "correct" them | 01:19 |
| samueldmq | morganfainberg, ah yes , and just keep the license thing | 01:19 |
| jamielennox | i don't think copyright headers make sense on a file that has had half a dozen companies change them | 01:19 |
| morganfainberg | i don't like them in *every* file. we have a git log if someone wants to know who did what for what company | 01:19 |
| morganfainberg | jamielennox: ++ | 01:19 |
| dstanek | morganfainberg: +++ | 01:19 |
| stevemar | jamielennox, btw, what did you want to do about https://review.openstack.org/#/c/187103/ ? | 01:20 |
| morganfainberg | stevemar: oh hai | 01:20 |
| samueldmq | yeah, we should remove them all :) | 01:20 |
| stevemar | morganfainberg, heyooo | 01:20 |
| morganfainberg | samueldmq: that is treacherous waters. | 01:20 |
| samueldmq | I will propose a bp, 'no more copyrights' | 01:20 |
| samueldmq | and see things exploding | 01:20 |
| samueldmq | openstack-specs | 01:20 |
| jamielennox | stevemar: what ever you like, i just noticed the mistake and fixed it | 01:20 |
| morganfainberg | samueldmq: don't go out of your way to remove them. this has gone rounds w/ the TC and such | 01:20 |
| morganfainberg | it's not a winning battle | 01:20 |
| morganfainberg | better to ignore them. | 01:21 |
| samueldmq | morganfainberg, (in fact I was only kidding) :) | 01:21 |
| samueldmq | I don't want to struggle in that front | 01:21 |
| jamielennox | morganfainberg: weigh in on https://review.openstack.org/#/c/187094/ i'm inclined to replicate the code because it should be different for v2 and v3 - and this is what OSC does | 01:22 |
| dstanek | morganfainberg: what is the legality of a copyright given our cla? | 01:22 |
| stevemar | jamielennox, cool enough of a reason for me | 01:22 |
| jamielennox | i could figure out some way of inheritting v3 from the v2 managers and tests but i don't know it buys us anything | 01:22 |
| morganfainberg | dstanek: basically CLA wins | 01:23 |
| dstanek | i think it's pretty explicit in that you give away most traditional copyright rights | 01:23 |
| morganfainberg | dstanek: afaik | 01:23 |
| morganfainberg | jamielennox: hmm. | 01:23 |
| morganfainberg | jamielennox: you could common class important things | 01:23 |
| morganfainberg | but meh | 01:23 |
| morganfainberg | replicating code is ok | 01:23 |
| morganfainberg | esp. if things start varying more | 01:24 |
| jamielennox | right, i could figure out some multiple inheritence way to share stuff | 01:24 |
| morganfainberg | jamielennox: MixIns! (no don't) | 01:24 |
| jamielennox | right - i don't think it helps readability at all | 01:24 |
| jamielennox | there are lots of places between v2 and v3 where we essentially duplicate code, | 01:25 |
| jamielennox | especially in tests | 01:25 |
| samueldmq | I think we could put the common code in a separate directory (other than v2.0 and v3) | 01:25 |
| samueldmq | but not sure how worth it could be | 01:26 |
| morganfainberg | samueldmq: eh. | 01:26 |
| * morganfainberg shrugs | 01:26 | |
| * morganfainberg is pretty non-committal about that particular thing | 01:26 | |
| jamielennox | samueldmq: there isn't a lot of interest in fixing CRUD for ksc | 01:26 |
| morganfainberg | jamielennox: yep | 01:27 |
| jamielennox | we're taking the bits we want over to keystoneauth and hopefully the SDK will come along and take the rest of it off our hands completely | 01:27 |
| morganfainberg | basically limp it along for SDK and KSA to take over | 01:27 |
| samueldmq | jamielennox, hmm, so if we have been doing that (copying code) in other places, and we have those plans | 01:28 |
| samueldmq | jamielennox, maybe there isn't a good reasong to try and re-use the code | 01:28 |
| samueldmq | jamielennox, (not completely sure about the tests though, as they are 100% the same) | 01:29 |
| * morganfainberg deprecates keystoneclient (j/k!!!) | 01:29 | |
| jamielennox | samueldmq: if i didn't need it for OSC i wouldn't have implemented it at all | 01:29 |
| jamielennox | morganfainberg: one of those joking/not joking situations | 01:30 |
| samueldmq | hehe | 01:30 |
| morganfainberg | sorry not sorry? ;) | 01:30 |
| samueldmq | jamielennox, I don't have a hard concern on that ... if others (morganfainberg stevemar ?) agree with that duplication | 01:31 |
| morganfainberg | samueldmq: it's really a question of effort. | 01:31 |
| samueldmq | jamielennox, I am not against it.. let's make that move | 01:31 |
| samueldmq | morganfainberg, yeah I see ... how worth it that could be | 01:31 |
| morganfainberg | i'm totally willing to support people making that code better | 01:31 |
| morganfainberg | but if really if you have better things to work on, please do. | 01:32 |
| morganfainberg | especially KeystoneAuth or similar types of initatives that directly improve our user's experience | 01:32 |
| * samueldmq needs to take a look at keystoneauth | 01:32 | |
| morganfainberg | improving this part of keystoneclient is not *really* a huge win | 01:32 |
| morganfainberg | samueldmq: please do. it's starting to shape up | 01:33 |
| samueldmq | is keystoneauth the new repo ? | 01:33 |
| *** radez is now known as radez_g0n3 | 01:33 | |
| morganfainberg | next release should move it to keystoneauth1 and a virtual keystoneauth package | 01:33 |
| morganfainberg | samueldmq: yeah it's openstack/keystoneauth | 01:33 |
| samueldmq | morganfainberg, cool, I will take a look | 01:33 |
| samueldmq | morganfainberg, is there doc about it as well ? | 01:33 |
| * morganfainberg needs to bug dhellmann about getting a keystoneauthv1 branch | 01:33 | |
| morganfainberg | samueldmq: the readme. but it's really about taking the session code out of keystoneclient and fix it. | 01:34 |
| * samueldmq could simply checks if there are docs instead of asking everything | 01:34 | |
| morganfainberg | and jamielennox 's blog posts | 01:34 |
| * samueldmq apologizes | 01:34 | |
| morganfainberg | but we need more docs | 01:34 |
| *** alanf-mc has quit IRC | 01:34 | |
| morganfainberg | ooh | 01:35 |
| morganfainberg | jamielennox: ping | 01:35 |
| jamielennox | samueldmq: don't apologise - there is really no where else you could learn about this stuff at the moment than iRC | 01:35 |
| jamielennox | morganfainberg: i've been chatting for about 40 min... | 01:35 |
| ayoung | NAKED PING! | 01:35 |
| *** boris-42 has quit IRC | 01:35 | |
| *** ctracey has quit IRC | 01:35 | |
| samueldmq | jamielennox, +1'ed the ksclient change | 01:36 |
| *** briancurtin has quit IRC | 01:36 | |
| *** serverascode has quit IRC | 01:36 | |
| samueldmq | jamielennox, thx :) | 01:36 |
| samueldmq | ayoung, your naked ping made people disconnect | 01:36 |
| samueldmq | ayoung, please don't do that agian :) | 01:36 |
| morganfainberg | ayoung: ping | 01:36 |
| morganfainberg | ayoung: ping | 01:36 |
| ayoung | morganfainberg, do you really want to start this? | 01:36 |
| samueldmq | morganfainberg, please :( | 01:36 |
| morganfainberg | ayoung: only doing it in response of your announcement to the channel ;) | 01:37 |
| morganfainberg | dstanek: you around? | 01:37 |
| morganfainberg | dstanek: have a question for you if you are. | 01:37 |
| dstanek | morganfainberg: yes | 01:37 |
| samueldmq | morganfainberg, nice thanks, I will take a look at ka, as I find some free time in the policy stuff + reviews | 01:37 |
| ayoung | dstanek, is no longer | 01:37 |
| ayoung | ROUND! | 01:37 |
| morganfainberg | hm. is Lin around? | 01:38 |
| ayoung | samueldmq, I think I need to revamp the policy overview | 01:38 |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Allow a user to get his own user information https://review.openstack.org/181298 | 01:39 |
| ayoung | add in the new specs about "subsets" and the endpoint binding... | 01:39 |
| dstanek | ayoung: :-P | 01:39 |
| samueldmq | ayoung, I am ok if you need .. I should already updated that spec, but time has been thigh, sorry | 01:40 |
| samueldmq | ayoung, I am ok if you need to add more things in there | 01:40 |
| samueldmq | ayoung, btw, what is that tokens subset thing | 01:41 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: unified policy file https://review.openstack.org/134656 | 01:41 |
| samueldmq | ayoung, this will fail pep8 ^ | 01:41 |
| ayoung | dstanek, samueldmq the overview spec is the one I am least concerned with getting approved | 01:41 |
| ayoung | It is really there just othave an official document for the overall strategy | 01:42 |
| morganfainberg | everything fails pep8 :P | 01:42 |
| samueldmq | ayoung, your commit message has 2³² chars :p | 01:42 |
| ayoung | so long as the smaller specs keep making progress,we are headed in the right direction | 01:42 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: unified policy file https://review.openstack.org/134656 | 01:42 |
| samueldmq | ayoung, ++ makes sense | 01:43 |
| *** briancurtin has joined #openstack-keystone | 01:43 | |
| samueldmq | ayoung, but I think we should agree in all the points of the general approach | 01:43 |
| ayoung | samueldmq, its what I get for editing in the Browser window. | 01:43 |
| *** ctracey has joined #openstack-keystone | 01:43 | |
| samueldmq | ayoung, and then get that merged to get people looking at the other specs | 01:43 |
| samueldmq | ayoung, hehe | 01:43 |
| *** serverascode has joined #openstack-keystone | 01:44 | |
| ayoung | "Let me explain:" http://24.media.tumblr.com/tumblr_lnlxjw3rAo1ql9pqpo1_500.gif | 01:45 |
| samueldmq | ayoung, haha | 01:46 |
| samueldmq | ayoung, btw, I am looking at the Subset Tokens spec | 01:47 |
| samueldmq | ayoung, the user requesting the token has to say it wants a subset of roles/endpoints ? | 01:47 |
| openstackgerrit | Merged openstack/keystone: Improve error message when tenant ID does not exist https://review.openstack.org/131255 | 01:47 |
| jamielennox | ahh - at this point i feel like glance is my v3 nemesis | 01:48 |
| jamielennox | i guess along with swift and ironic and a couple of others | 01:48 |
| jamielennox | so yea, maybe nemesis is strong - but rah! | 01:49 |
| ayoung | samueldmq, yep. We treat the existing behavior as the default unless specified | 01:50 |
| *** blewis has joined #openstack-keystone | 01:50 | |
| ayoung | samueldmq, it will allow a user to remove roles from a token so the token only has the minimal required to perform the work requested | 01:50 |
| samueldmq | ayoung, subsets of roles should be something delegated right ? This way looks to be something requested | 01:50 |
| samueldmq | ayoung, not sure I am understanding it correctly, still looking at the spec | 01:51 |
| ayoung | samueldmq, trusts actually do that already | 01:51 |
| ayoung | you can create a trust with a subset of your roles | 01:51 |
| samueldmq | ayoung, why do we need to request a token with only a subset of roles ? | 01:51 |
| samueldmq | ayoung, how does the user know what roles he need ? | 01:51 |
| ayoung | this is to limit the exposure on a given token. If you know you only need the "read_glance" role when sending a token to Nova, you don't send a token with "write_image_to_glance" on it | 01:51 |
| samueldmq | ayoung, he has no access to the policy | 01:51 |
| ayoung | samueldmq, right now, there is no clear way to know. We need other BPs implemented before we can make use of this | 01:52 |
| ayoung | baby steps | 01:52 |
| ayoung | to start with, and admin could say, or publish the policy. We'll get better tooling over time | 01:52 |
| samueldmq | ayoung, yeah, and you're in the almost last steps .. I can't see the path ;) | 01:52 |
| ayoung | its all necessary, but this change has to be ther in order for the rest of it to be usefukl | 01:53 |
| samueldmq | ayoung, anyway, I need to take a better look at that spec before having a concrete opinion over that | 01:53 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:53 | |
| ayoung | also, with implied (inherited) roles, a user could then ask for an implied role instead of the explicitly assigned...but I am holding off on that part until we get there | 01:53 |
| samueldmq | ayoung, btw, talking about what goes in the token | 01:54 |
| samueldmq | ayoung, I think we should add parent_id in the token, so that would simplify life for other projects that need, let's say, enforce hierarchical quota | 01:54 |
| samueldmq | morganfainberg, dstanek cc ^ | 01:55 |
| *** boris-42 has joined #openstack-keystone | 01:55 | |
| ayoung | wha? | 01:55 |
| *** blewis has quit IRC | 01:55 | |
| ayoung | parent_id for project? | 01:55 |
| samueldmq | ayoung, in the token, we specify the project_id .. I am saying we should specify its parent as well | 01:56 |
| ayoung | samueldmq, nope | 01:56 |
| samueldmq | ayoung, so when nova wants to enforce quota | 01:56 |
| ayoung | cuz we care about the whole chain | 01:56 |
| samueldmq | it doesn't need to get a project from keystone all the time | 01:56 |
| ayoung | it might not be parent, but great-great-grandparent | 01:56 |
| samueldmq | no | 01:56 |
| ayoung | for quota | 01:57 |
| samueldmq | you only cares about your parent | 01:57 |
| ayoung | it is nested arbitratily deep | 01:57 |
| ayoung | but my quota might be set 3-6levels higher | 01:57 |
| samueldmq | you are ok with your parent, and so on | 01:57 |
| samueldmq | ayoung, yes, and that must be set level by level | 01:57 |
| ayoung | if we know the project ID, we can deduce partnet, and so on up the chain. If that is not the case, something bigger than this is wrong | 01:57 |
| samueldmq | ayoung, so the children quota is always <= parent's quota | 01:58 |
| ayoung | samueldmq, i'LL LET YOU THINK ABOUT WHY JUST SETTING PARENT_ID IS EITHER INSUFFICIENT OR NOT REQUIRED | 01:58 |
| ayoung | damn caps lock | 01:58 |
| samueldmq | D: | 01:58 |
| samueldmq | ayoung, I still think it's enough :p | 01:59 |
| samueldmq | ayoung, if you need to, lets say, increase your quota, that should be ok if your parent still have slots | 01:59 |
| ayoung | samueldmq, and if they don't...you get a token for the parent...and so on up the chain....hmmm | 02:00 |
| dstanek | samueldmq: so quota is always defined on the direct parent? | 02:00 |
| samueldmq | dstanek, children quotas are based on the parent's quota | 02:00 |
| ayoung | samueldmq, then "set quote for child" should be done using a parent project scoped token, not the child | 02:01 |
| samueldmq | dstanek, and who cares about the parent quota ? the grandparent .. | 02:01 |
| *** davechen__ has quit IRC | 02:01 | |
| morganfainberg | jamielennox: i'm going to propose a new config for keystonemiddleware | 02:01 |
| *** davechen1 has joined #openstack-keystone | 02:01 | |
| jamielennox | morganfainberg: mmmm | 02:02 |
| *** liusheng has quit IRC | 02:02 | |
| morganfainberg | jamielennox: where we take [keystone_auth_token]\memcached_servers over [default] | 02:02 |
| samueldmq | ayoung, hmm... what I said is useful in the case you have the token in the project you're CRUDing quotas ... | 02:02 |
| morganfainberg | if they exist | 02:02 |
| dstanek | samueldmq: i don't know what their quota datastructures look like, but they could just store the calculated quota for each project | 02:02 |
| samueldmq | ayoung, is that what you're saying all the time ? | 02:02 |
| jamielennox | morganfainberg: why would we move memcached_servers rather than jump straight to dogpile | 02:02 |
| samueldmq | dstanek, yeah; but enforcement on children depend on parents ;.. yyou shouldn't be able to increase you quota if it passes your parent's limit | 02:03 |
| morganfainberg | jamielennox: well we probably want to still support a transitional "you don't need dogpile configs" | 02:03 |
| *** tobe has joined #openstack-keystone | 02:03 | |
| morganfainberg | but you can configure different memcache servers for ATM over sya... nova | 02:03 |
| morganfainberg | since nova also uses oslo.memorycache | 02:03 |
| morganfainberg | oslo incubator* | 02:03 |
| dstanek | samueldmq: sure, but it could still be enforce on the project level and only edited on the parent level | 02:03 |
| samueldmq | dstanek, but I think I got what ayoung was trying to say: 'you don't use a project scoped token to update that project's quota, for example' | 02:03 |
| jamielennox | morganfainberg: sure, but you're suggesting to add them as additional vlaues that will hopefully be deprecated soon | 02:03 |
| ayoung | samueldmq, If I want to query quota, a token for that projedct should be sufficient. But If I am setting it based on the parent project's quote, I am effectively performin an operaion on the parent, no the child. | 02:03 |
| *** davechen has quit IRC | 02:03 | |
| samueldmq | dstanek, yeah, editing will come from parents .. | 02:04 |
| jamielennox | morganfainberg: are those options locations dictated by oslo.memorycache? | 02:04 |
| morganfainberg | jamielennox: yes | 02:04 |
| morganfainberg | jamielennox: that is why | 02:04 |
| jamielennox | morganfainberg: wrong | 02:04 |
| ayoung | samueldmq, we good on that? | 02:04 |
| morganfainberg | jamielennox: i want to do a [KATM] takes priority | 02:04 |
| morganfainberg | so we aren't in a weird loop getting rid of memorycache since nova also uses it. | 02:05 |
| jamielennox | morganfainberg: is oslo.memorycache the thing that gives us that in memory fallback caching mode | 02:05 |
| morganfainberg | ye | 02:05 |
| samueldmq | ayoung, kind of .. I need to take a better look on the hierarchical quotas stuff, but I agree with you | 02:05 |
| morganfainberg | p | 02:05 |
| morganfainberg | i was looking at replacing all of it | 02:05 |
| samueldmq | ayoung, editing comes from parents .. | 02:05 |
| morganfainberg | and ditching the last incubator code in middleware | 02:05 |
| jamielennox | morganfainberg: so i'm fine with the idea - but honestly i'd be inclined to just deprecate it out | 02:05 |
| * morganfainberg was also looking at moving to pymemcache | 02:05 | |
| ayoung | samueldmq, yeah, and then the child projects are just like any other resource managed by the parent; | 02:05 |
| morganfainberg | because we have issues with the pool stuff | 02:05 |
| morganfainberg | andpymemcahce has a built in pool and doesn't suck w/ thread.local | 02:06 |
| samueldmq | ayoung, with tokens scoped to parents, right ? | 02:06 |
| jamielennox | morganfainberg: i have no particular love of dogpile, the one time i tried to use it i found it a bit confusing - but i really like that if we use dogpile people can do whatever they like on the backend and it's not our problem | 02:06 |
| samueldmq | ayoung, i.e, quotas in child are managed in a higher level | 02:06 |
| ayoung | samueldmq, correct. | 02:06 |
| morganfainberg | jamielennox: someone is working on making "oslo.cache" a thing | 02:06 |
| morganfainberg | but i am not sure of the current status | 02:06 |
| jamielennox | morganfainberg: do i want oslo messing with this? | 02:07 |
| ayoung | Now, reading quota is a little strange, as it can either be done for "this project that I am inside of right now" or "This child project" | 02:07 |
| samueldmq | ayoung, k, so parent_id in the token isn't required for now | 02:07 |
| ayoung | right | 02:07 |
| morganfainberg | jamielennox: with what? | 02:07 |
| jamielennox | morganfainberg: what is oslo.cache going to give me that i can't just use dogpile | 02:07 |
| jamielennox | is it just CONF handling? | 02:08 |
| morganfainberg | jamielennox: oslo.config option handling and a thin wrapper to help smooth the rough edges while we work on cleaning up the upstream | 02:08 |
| jamielennox | (which will hopefully be done better than oslo.memorycache) | 02:08 |
| * morganfainberg has like 5 or 6 patches to push up to dogpile) | 02:08 | |
| morganfainberg | and one just needs tests | 02:09 |
| morganfainberg | my goal has been to rip out a bunch of the custom code we have in keystone | 02:09 |
| morganfainberg | wrapping dogpile | 02:09 |
| jamielennox | morganfainberg: ok, fair enough | 02:09 |
| jamielennox | so you want to do the memorycache fix as well | 02:09 |
| *** davechen2 has joined #openstack-keystone | 02:11 | |
| *** browne has quit IRC | 02:11 | |
| davechen2 | jamielennox: Jamie, are you still working on this patch: replace-extensions? I saw docs still failed on that patch. | 02:12 |
| jamielennox | davechen2: oh, yea i can fix that, i forgot about that one | 02:13 |
| *** davechen1 has quit IRC | 02:13 | |
| davechen2 | jamielennox: I am trying to move endpoint filter into core in another patch, and try to raise the exception if upgrade is invoked. | 02:14 |
| davechen2 | jamielennox: Although it works for jekins, but i am not quite sure about that, so you may help to judge. :) | 02:14 |
| samueldmq | morganfainberg, thanks (Adds inherited column to RoleAssignment PK) | 02:15 |
| samueldmq | morganfainberg, should I propose a backport ? | 02:15 |
| jamielennox | davechen2: that's great, let me see why this is failing - ideally i just want the doc builder to ignore that file | 02:16 |
| morganfainberg | we could try and do a backport | 02:16 |
| morganfainberg | samueldmq: i'm not opposed to it | 02:16 |
| jamielennox | it used to do that, but there was some changes as to how docs were built | 02:16 |
| morganfainberg | samueldmq: but it's not a fun backport remember you need to make sure changes are idempoent and then can be reapplied, etc | 02:16 |
| samueldmq | morganfainberg, should I add a point in tomorrow's meeting ? just to have an agreement ? | 02:16 |
| morganfainberg | sure, ask brant and dolphm as the first line of defence on stable branches | 02:17 |
| openstackgerrit | liusheng proposed openstack/keystone: Remove the deprecated ec2 token middleware https://review.openstack.org/185509 | 02:17 |
| * morganfainberg has to hop on a plane | 02:17 | |
| samueldmq | morganfainberg, this is very important when we have hierarchical projects | 02:17 |
| davechen2 | jamielennox: that patch is here, I add you as the reviewer, you may help to review when you get a chance. https://review.openstack.org/#/c/186988/ | 02:17 |
| morganfainberg | see ya later | 02:17 |
| stevemar | morganfainberg, have fun | 02:17 |
| samueldmq | morganfainberg, we should consider at least backporting to K | 02:17 |
| samueldmq | morganfainberg, see you | 02:17 |
| stevemar | morganfainberg, did you ever send off the ppt to business folk for flair? i might send it to our folks otherwise | 02:17 |
| morganfainberg | stevemar: I'm going to work on it this week but hp folk are busy this week. | 02:18 |
| morganfainberg | Feel free to send it off. Just make sure hey know it's not just for you to present. | 02:18 |
| morganfainberg | I am also going to convert it to html | 02:19 |
| morganfainberg | So we can publish it. | 02:19 |
| * morganfainberg is working on htmlizing but hasn't gotten far. | 02:19 | |
| jamielennox | davechen2: hmm, i think it will be easiest if we just raise the error if the upgrade/downgrade functions are called | 02:19 |
| jamielennox | it appears we would have to name each file individually in an exclude list to get the docs to ignore them and that's a pointless list to maintain | 02:20 |
| davechen2 | jamielennox: I did that way in that patch, but i am not quite sure, fix the jenkins so other would start to review at that patch. :) | 02:20 |
| jamielennox | davechen2: are they dependent on that patch? | 02:21 |
| davechen2 | jamielennox: not yet, it's depends on the a different patch, just cannot figure out a way to depend on two patches. | 02:21 |
| jamielennox | davechen2: you can't :( | 02:21 |
| davechen2 | jamielennox: cann't what? :) | 02:22 |
| jamielennox | depend on two patches | 02:22 |
| *** liusheng has joined #openstack-keystone | 02:22 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Move endpoint_policy migrations into keystone core https://review.openstack.org/171916 | 02:22 |
| davechen2 | jamielennox: so, let's it be, and when your patch got merged, I can rebase on yours. | 02:23 |
| *** davechen1 has joined #openstack-keystone | 02:25 | |
| *** davechen2 has quit IRC | 02:27 | |
| *** someara2 has joined #openstack-keystone | 02:29 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Move endpoint_policy migrations into keystone core https://review.openstack.org/171916 | 02:30 |
| *** davechen2 has joined #openstack-keystone | 02:31 | |
| *** davechen1 has quit IRC | 02:32 | |
| stevemar | morganfainberg, cool cool, i already sent them a draft, andy gave awesome feedback | 02:35 |
| stevemar | i'll be making a second copy to tweak things a bit | 02:35 |
| *** chlong has quit IRC | 02:39 | |
| *** davechen2 is now known as up | 02:41 | |
| *** browne has joined #openstack-keystone | 02:42 | |
| *** up has left #openstack-keystone | 02:43 | |
| *** davechen has joined #openstack-keystone | 02:44 | |
| *** richm has quit IRC | 02:47 | |
| *** dims___ has quit IRC | 02:48 | |
| *** arunkant has quit IRC | 02:51 | |
| *** Kennan has joined #openstack-keystone | 02:52 | |
| *** arunkant has joined #openstack-keystone | 02:55 | |
| *** someara2 has quit IRC | 03:09 | |
| *** someara2 has joined #openstack-keystone | 03:09 | |
| openstackgerrit | Merged openstack/keystone: Adds inherited column to RoleAssignment PK https://review.openstack.org/142472 | 03:12 |
| *** someara2 has quit IRC | 03:13 | |
| *** samueldmq has quit IRC | 03:15 | |
| *** samueldmq has joined #openstack-keystone | 03:15 | |
| *** chlong has joined #openstack-keystone | 03:22 | |
| *** someara2 has joined #openstack-keystone | 03:27 | |
| jamielennox | holy crap, devstack v3 only completed | 03:44 |
| *** dims_ has joined #openstack-keystone | 03:48 | |
| *** samueldmq has quit IRC | 03:50 | |
| *** dims_ has quit IRC | 03:53 | |
| *** kwills has quit IRC | 03:55 | |
| *** ayoung has quit IRC | 04:12 | |
| *** lhcheng has joined #openstack-keystone | 04:16 | |
| *** ChanServ sets mode: +v lhcheng | 04:16 | |
| *** someara2 has quit IRC | 04:21 | |
| *** david-lyle has quit IRC | 04:24 | |
| *** david-lyle has joined #openstack-keystone | 04:25 | |
| stevemar | jamielennox, \o/ | 04:42 |
| jamielennox | stevemar: :) | 04:43 |
| jamielennox | it doesn't mean it's all that close - just that that should be all i need from ksc and osc | 04:43 |
| stevemar | i remember trying to make devstack v3 compliant (naively) back when i first started in grizzly | 04:43 |
| jamielennox | stevemar: yea, this isn't my first attempt either | 04:45 |
| *** spandhe has quit IRC | 04:55 | |
| *** spandhe has joined #openstack-keystone | 04:58 | |
| *** lhcheng_ has joined #openstack-keystone | 05:06 | |
| *** tobe has quit IRC | 05:08 | |
| *** lhcheng has quit IRC | 05:09 | |
| *** kiran-r has joined #openstack-keystone | 05:13 | |
| openstackgerrit | Tobias Urdin proposed openstack/keystone: Fix domain id not being dict for token data https://review.openstack.org/187456 | 05:21 |
| *** someara2 has joined #openstack-keystone | 05:22 | |
| *** triggerz has joined #openstack-keystone | 05:25 | |
| *** triggerz is now known as tobasco | 05:25 | |
| *** someara2 has quit IRC | 05:27 | |
| *** _cjones_ has joined #openstack-keystone | 05:28 | |
| *** stevemar has quit IRC | 05:31 | |
| *** tobe has joined #openstack-keystone | 05:37 | |
| *** spandhe has quit IRC | 06:04 | |
| *** mabrams has joined #openstack-keystone | 06:05 | |
| *** Kennan2 has joined #openstack-keystone | 06:06 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/186279 | 06:06 |
| *** Kennan has quit IRC | 06:06 | |
| *** tobe has quit IRC | 06:13 | |
| *** ajayaa has joined #openstack-keystone | 06:23 | |
| *** henrynash has joined #openstack-keystone | 06:23 | |
| *** ChanServ sets mode: +v henrynash | 06:23 | |
| ajayaa | Hi. Can anyone point me to documentation where there is an example of how to create an ec2 credential for a user using v3 api. | 06:24 |
| ajayaa | ? | 06:24 |
| *** _cjones_ has quit IRC | 06:30 | |
| openstackgerrit | guang-yee proposed openstack/keystonemiddleware: Enforce endpoint constraint https://review.openstack.org/177661 | 06:37 |
| *** dims_ has joined #openstack-keystone | 06:37 | |
| *** tobe has joined #openstack-keystone | 06:38 | |
| *** belmoreira has joined #openstack-keystone | 06:38 | |
| davechen | ajayaa: hi, I didn't notice there is any doc about that, maybe we have but I didn't read it. | 06:41 |
| *** dims_ has quit IRC | 06:42 | |
| ajayaa | davechen, Hi. The way it's done in v3 is confusing. I am not sure what to put in blob field while creating ec2 credential for a user. | 06:42 |
| davechen | ajayaa: I think what you are looking for is some manual for ec2 credential for credential CRUD? | 06:42 |
| ajayaa | davechen, yes. | 06:42 |
| ajayaa | If I get something done then maybe I will put a patch. | 06:43 |
| ajayaa | Or if you are interested, you can take it up. | 06:43 |
| davechen | yes, that great. Does some help manual from the openstack command help? | 06:43 |
| davechen | ajayaa, some easy way I use when I cannot find some manual is trying to read some test code. | 06:44 |
| ajayaa | davechen, nope. The cli is also not helpful in this case. | 06:45 |
| davechen | ajayaa, from those testcase, you will know what's the input and what's the expected result, this is really a workaround :) | 06:45 |
| ajayaa | Reading a test is a good idea. | 06:45 |
| ajayaa | I will do that. Thanks for the idea davechen. | 06:45 |
| davechen | ajayaa, example: blob = {"access" ..., "secret" ... } | 06:47 |
| ajayaa | http://paste.openstack.org/show/255340/ | 06:47 |
| ajayaa | davechen, this is what I am trying out. | 06:48 |
| ajayaa | But validation fails. Now it has come down to permutations and combinations of escape characters. | 06:48 |
| ajayaa | :( | 06:48 |
| *** krykowski has joined #openstack-keystone | 06:53 | |
| davechen | ajayaa: me too, I am trying to have a look at this. | 06:54 |
| ajayaa | davechen, please let me know if you have any success. | 06:55 |
| *** krykowski has quit IRC | 07:05 | |
| marekd | morning. | 07:08 |
| *** woodster_ has quit IRC | 07:10 | |
| *** jsheeren has joined #openstack-keystone | 07:13 | |
| *** browne has quit IRC | 07:22 | |
| *** lufix has joined #openstack-keystone | 07:22 | |
| *** lhcheng_ has quit IRC | 07:23 | |
| *** Kennan has joined #openstack-keystone | 07:39 | |
| *** Kennan2 has quit IRC | 07:39 | |
| *** pnavarro has joined #openstack-keystone | 07:46 | |
| *** dguerri`away is now known as dguerri | 07:48 | |
| *** jistr has joined #openstack-keystone | 07:48 | |
| *** chlong has quit IRC | 07:56 | |
| *** henrynash has quit IRC | 08:01 | |
| *** fhubik has joined #openstack-keystone | 08:14 | |
| *** fhubik is now known as fhubik_afk | 08:15 | |
| *** fhubik_afk is now known as fhubik | 08:20 | |
| *** bjornar has joined #openstack-keystone | 08:24 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Refactor SAML2 auth plugins https://review.openstack.org/176746 | 08:24 |
| davechen | ajayaa: still around? | 08:44 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Refactor SAML2 auth plugins https://review.openstack.org/176746 | 08:44 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Depend on python-keystoneauth https://review.openstack.org/186854 | 08:44 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 08:49 |
| ajayaa | davechen, yes. | 08:56 |
| *** aix has joined #openstack-keystone | 09:01 | |
| *** someara2 has joined #openstack-keystone | 09:02 | |
| davechen | ajayaa: I think it's field validation cause that issue. | 09:03 |
| davechen | ajayaa: It requires bold field is a string, but we pass a dict. | 09:03 |
| davechen | ajayaa: In the testcase, the dict is parsed to string by json.dumps() | 09:04 |
| ajayaa | davechen, Yes, a string needs to be passed. But I am having a hard time constructing a string of dictionary. | 09:04 |
| davechen | ajayaa: so the testcase can pass but I didn't figure out a way how to pass a string in the curl's body. | 09:04 |
| davechen | ajayaa: me either. | 09:05 |
| ajayaa | davechen, same case here. I tried to do it through postman rest client, but the error still persists. | 09:05 |
| ajayaa | I am having a hard time understanding why these things were made more complicated. | 09:06 |
| *** someara2 has quit IRC | 09:07 | |
| ajayaa | davechen, it worked. | 09:11 |
| ajayaa | All the double quotes inside the dict need to be escaped. | 09:11 |
| ajayaa | http://paste.openstack.org/show/255687/ | 09:11 |
| davechen | ajayaa: cool | 09:11 |
| ajayaa | davechen, Does the user need to generate access and secret on his own? | 09:12 |
| davechen | I am still wondering whether it's wise to put a hard requirement on the blob field. | 09:13 |
| ajayaa | davechen, +1. | 09:14 |
| davechen | ajayaa: maybe we can fix it. :) | 09:14 |
| ajayaa | If the user asks to create ec2 credentials for him then access and secret should be generated automatically in Keystone. | 09:15 |
| ajayaa | Need someone from Keystone cores to comment on this before we can fix the problem. | 09:15 |
| ajayaa | We need to be sure that it indeed is a problem. | 09:15 |
| ajayaa | :) | 09:15 |
| davechen | yep, | 09:15 |
| ajayaa | most the the Keystone cores will be here around 4 hours from now. | 09:16 |
| davechen | I tried the similar approach, and struggle for a long time, use double quote or single quote to escape. | 09:16 |
| davechen | I think I leave an extra comma there, sigh | 09:17 |
| ajayaa | It's hard man! we should be glad that we figured it out eventually. :) | 09:18 |
| ekarlso | is keystoneauth ready to go ? | 09:18 |
| *** rlt_ has joined #openstack-keystone | 09:18 | |
| davechen | ajayaa: imo, it's not flexible at least, and I really cannot understand why we need it's a string instead of handle with it in the code. | 09:18 |
| davechen | ajayaa: yep, cheers | 09:19 |
| ajayaa | davechen, It's because of the database scheme. See the credential table in keystone schema. | 09:20 |
| ajayaa | schema* | 09:20 |
| *** e0ne has joined #openstack-keystone | 09:20 | |
| davechen | ajayaa: I am off-duty now, nice to co-work with you to find a solution to make it work, and maybe we need some docs about the CLI command as well. | 09:21 |
| ajayaa | davechen, It was nice working with you. | 09:22 |
| *** davechen is now known as davechen_afk | 09:24 | |
| *** dims_ has joined #openstack-keystone | 09:26 | |
| *** dims_ has quit IRC | 09:31 | |
| *** afazekas has joined #openstack-keystone | 09:40 | |
| *** aix has quit IRC | 09:45 | |
| *** aix has joined #openstack-keystone | 09:45 | |
| *** josecastroleon has joined #openstack-keystone | 09:49 | |
| *** kwills has joined #openstack-keystone | 09:51 | |
| *** kwills has quit IRC | 09:56 | |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Replace status code 403 with ForbiddenAction.code https://review.openstack.org/187511 | 10:04 |
| *** e0ne is now known as e0ne_ | 10:13 | |
| evrardjp | hi everyone | 10:16 |
| evrardjp | for those who aren't used to the timings of the meeting, wouldn't it be better if there is the TIME of the meeting in the topic title? With a timezone for example :p | 10:18 |
| *** lufix has quit IRC | 10:19 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Honour ``service_providers`` in AccessInfo https://review.openstack.org/187514 | 10:20 |
| *** e0ne_ has quit IRC | 10:24 | |
| *** e0ne has joined #openstack-keystone | 10:29 | |
| *** samueldmq has joined #openstack-keystone | 10:31 | |
| samueldmq | good morning | 10:31 |
| samueldmq | operator99, hi, I'd like to talk about 'Enforce endpoint constraint' | 10:31 |
| samueldmq | operator99, let me know when you are available | 10:32 |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Add default domain to fixture.v3.V3FederationToken https://review.openstack.org/187516 | 10:35 |
| *** dguerri is now known as dguerri`away | 10:37 | |
| *** fhubik is now known as fhubik_afk | 10:47 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Federated domain identified by ``id`` not ``name`` https://review.openstack.org/187520 | 10:47 |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Honour ``service_providers`` in AccessInfo https://review.openstack.org/187514 | 10:51 |
| *** henrynash has joined #openstack-keystone | 10:53 | |
| *** ChanServ sets mode: +v henrynash | 10:53 | |
| *** dims_ has joined #openstack-keystone | 10:55 | |
| *** woodster_ has joined #openstack-keystone | 11:03 | |
| *** tobasco has quit IRC | 11:17 | |
| samueldmq | henrynash, hi | 11:17 |
| *** e0ne has quit IRC | 11:19 | |
| ccard | I'm confused about openstack regions. Horizon can be configured for multiple regions by setting AVAILABLE_REGIONS in local_settings to a list of region name -> keystone url mappings. How do these regions relate to the keystone.region table, the keystone.endpoint.region column and the region configured in e.g. neutron.conf and nova.conf? | 11:19 |
| *** amakarov_away is now known as amakarov | 11:20 | |
| *** rushiagr_away is now known as rushiagr | 11:22 | |
| *** fhubik_afk is now known as fhubik | 11:22 | |
| breton | samueldmq: great explanation on the ml | 11:23 |
| *** e0ne has joined #openstack-keystone | 11:24 | |
| *** e0ne is now known as e0ne_ | 11:25 | |
| *** triggerz has joined #openstack-keystone | 11:27 | |
| samueldmq | breton, thanks ... although I think our local webmail is messing up with formatting ;) | 11:27 |
| *** mabrams1 has joined #openstack-keystone | 11:29 | |
| *** mabrams has quit IRC | 11:29 | |
| *** e0ne_ is now known as e0ne | 11:30 | |
| samueldmq | henrynash, fyi, 'Adds inherited column to RoleAssignment PK' merged :) | 11:41 |
| henrynash | samuekdmq: sounds good…sorry burried under deadlines right now... | 11:42 |
| samueldmq | henrynash, completely understandable, have a good day :) | 11:43 |
| *** kwills has joined #openstack-keystone | 11:52 | |
| *** henrynash has quit IRC | 11:54 | |
| rushiagr | morganfainberg: hi | 11:55 |
| rushiagr | morganfainberg: I was going through the stable driver interfaces blueprint (https://review.openstack.org/#/c/177428/7/specs/backlog/stable-driver-interfaces.rst), and have some questions | 11:55 |
| rushiagr | morganfainberg: which is a good place to discuss them? here on IRC, or on that gerrit patch? The patch is merged, so wasn't so sure about the latter option | 11:56 |
| *** e0ne is now known as e0ne_ | 12:04 | |
| *** tobe has quit IRC | 12:07 | |
| samueldmq | rushiagr, hi | 12:09 |
| samueldmq | rushiagr, I think in this channel is fine, although morganfainberg probably is not available right now ;) | 12:09 |
| *** e0ne_ has quit IRC | 12:14 | |
| *** mabrams1 has quit IRC | 12:14 | |
| *** jsheeren has quit IRC | 12:15 | |
| *** mabrams has joined #openstack-keystone | 12:15 | |
| *** jistr is now known as jistr|class | 12:17 | |
| *** jistr|class is now known as jistr | 12:22 | |
| *** jsavak has joined #openstack-keystone | 12:24 | |
| *** breton is now known as chaosgoblin`` | 12:25 | |
| rushiagr | samueldmq: ok, thanks | 12:28 |
| samueldmq | rushiagr, np :) | 12:28 |
| rushiagr | morganfainberg: this is what I was writing as a comment on the spec gerrit submision: | 12:28 |
| rushiagr | Does this mean there will be a version bump for every change a developer proposes and manages to get it merged? Or there will be a version per release (e.g. 11 for kilo, 12 for liberty, and so on)? In the earlier case, how are we going to keep track of the changes which belong to a particular release (e.g. how to say that versions 7,8,9 landed in Kilo, and 10,11 landed in Liberty, etc)? Point versions, like 10.1, 10.2, | 12:28 |
| rushiagr | etc? | 12:28 |
| rushiagr | (regarding the versioning aspect) | 12:29 |
| *** ajayaa has quit IRC | 12:29 | |
| *** fhubik is now known as fhubik_afk | 12:34 | |
| *** e0ne has joined #openstack-keystone | 12:36 | |
| *** fhubik_afk is now known as fhubik | 12:36 | |
| *** chaosgoblin`` is now known as breton | 12:39 | |
| *** someara2 has joined #openstack-keystone | 12:41 | |
| *** someara2 has quit IRC | 12:45 | |
| *** iurygregory has quit IRC | 12:59 | |
| *** dsirrine has joined #openstack-keystone | 13:00 | |
| *** kiran-r has quit IRC | 13:09 | |
| *** emagana has joined #openstack-keystone | 13:09 | |
| *** emagana has quit IRC | 13:12 | |
| *** emagana has joined #openstack-keystone | 13:12 | |
| *** Ephur has joined #openstack-keystone | 13:13 | |
| *** emagana has quit IRC | 13:16 | |
| *** Ephur has quit IRC | 13:19 | |
| *** bknudson has joined #openstack-keystone | 13:20 | |
| *** ChanServ sets mode: +v bknudson | 13:20 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/186932 | 13:22 |
| *** Ephur has joined #openstack-keystone | 13:23 | |
| *** richm has joined #openstack-keystone | 13:23 | |
| *** bdossant has joined #openstack-keystone | 13:27 | |
| *** fhubik is now known as fhubik_afk | 13:27 | |
| *** radez_g0n3 is now known as radez | 13:28 | |
| *** nkinder__ has quit IRC | 13:30 | |
| *** dguerri`away is now known as dguerri | 13:31 | |
| *** ajayaa has joined #openstack-keystone | 13:39 | |
| *** ErickHeinrich has joined #openstack-keystone | 13:41 | |
| *** ErickHeinrich has quit IRC | 13:41 | |
| *** rushiagr is now known as rushiagr_away | 13:41 | |
| *** ayoung has joined #openstack-keystone | 13:45 | |
| *** ChanServ sets mode: +v ayoung | 13:45 | |
| *** HT_sergio has joined #openstack-keystone | 13:46 | |
| samueldmq | ayoung, hi | 13:47 |
| dstanek | rushiagr_away: morganfainberg is PST and is probably sleeping | 13:47 |
| samueldmq | ayoung, look at https://bugs.launchpad.net/designate/+bug/1458945 | 13:47 |
| openstack | Launchpad bug 1458945 in murano "Use graduated oslo.policy instead of oslo-incubator code" [High,Confirmed] - Assigned to Ekaterina Chernova (efedorova) | 13:47 |
| samueldmq | ayoung, I got people from other projects to confirm/work/invalidate that bug | 13:48 |
| dstanek | rushiagr_away: we can't logically do new versions for each change. that would mean we have to maintain maybe dozens of each backends at a time. | 13:48 |
| samueldmq | ayoung, I re-added some project which were previously marked as 'no longer affects' to then mark them as invalid | 13:48 |
| samueldmq | ayoung, so we could keep track of all them in that table | 13:49 |
| samueldmq | ayoung, but once re-added, I am not able to invalidate them .. it says permission denied | 13:49 |
| samueldmq | ayoung, the projects are swift ironic heat sahara manila designate | 13:49 |
| *** dims_ has quit IRC | 13:51 | |
| *** dims_ has joined #openstack-keystone | 13:51 | |
| *** bdossant_ has joined #openstack-keystone | 13:59 | |
| *** bdossant_ has quit IRC | 13:59 | |
| *** csoukup has joined #openstack-keystone | 14:00 | |
| *** fhubik_afk is now known as fhubik | 14:01 | |
| *** bdossant has quit IRC | 14:01 | |
| openstackgerrit | Divya K Konoor proposed openstack/pycadf: Add api_audit_map.conf for Ceilometer project https://review.openstack.org/187593 | 14:02 |
| *** bdossant has joined #openstack-keystone | 14:04 | |
| *** gokrokve has joined #openstack-keystone | 14:09 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:10 | |
| ayoung | samueldmq, hey | 14:11 |
| ayoung | samueldmq, I saw a bunch of that activity. Nice | 14:11 |
| ayoung | samueldmq, I think I want to work on the "fetch policy by URL" piece myself | 14:12 |
| ayoung | I need somethig early on the stack code wisse to work on, or I'm a go nutz | 14:12 |
| *** jistr is now known as jistr|mtg | 14:16 | |
| *** boris-42 has quit IRC | 14:18 | |
| *** ajayaa has quit IRC | 14:21 | |
| *** stevemar has joined #openstack-keystone | 14:23 | |
| *** ChanServ sets mode: +v stevemar | 14:23 | |
| *** timcline has joined #openstack-keystone | 14:23 | |
| *** radez is now known as radez_g0n3 | 14:23 | |
| rodrigods | marekd, there? | 14:23 |
| *** nkinder__ has joined #openstack-keystone | 14:26 | |
| *** radez_g0n3 is now known as radez | 14:26 | |
| marekd | yes | 14:28 |
| marekd | rodrigods: ^^ | 14:29 |
| rodrigods | marekd, so you are against the k2k auth plugin? how we could implement it in keystoneauth and Horizon use it? | 14:29 |
| marekd | rodrigods: my understanding is all auth plugins will be by default in keystoneauth | 14:29 |
| marekd | morganfainberg: am i right? ^^ | 14:30 |
| *** emagana has joined #openstack-keystone | 14:30 | |
| *** jistr|mtg is now known as jistr | 14:30 | |
| rodrigods | marekd, hmm didn't know about that... | 14:30 |
| morganfainberg | marekd: split out like we have now for saml2 etc. | 14:31 |
| marekd | morganfainberg: hm? you want to split k2k and ksa? | 14:31 |
| morganfainberg | If they have dependencies that are more than basic Python. | 14:31 |
| marekd | morganfainberg: they don't | 14:31 |
| morganfainberg | Then it'd be in ksa unless jamielennox really feels strongly it shouldn't be. | 14:32 |
| marekd | morganfainberg: i wanted to confirm, that any auth plugins (Esp new) should be developed now under ksa umbrella, not ksc. | 14:32 |
| marekd | morganfainberg: ok, thanks. | 14:32 |
| morganfainberg | Ye...sssss | 14:32 |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Add protocol docstring in FederationBaseAuthPlugin https://review.openstack.org/187610 | 14:33 |
| rodrigods | marekd, morganfainberg thanks, will submit to ksa | 14:35 |
| dstanek | is mercador fulfilling the usecase that the BU guys were describing at the summit? | 14:41 |
| marekd | dstanek: is there any detailed description of mercador capabilities and functions? | 14:41 |
| dstanek | marekd: just the -dev list post that just came through | 14:42 |
| marekd | dstanek: the one long time ago before summit ? | 14:42 |
| marekd | dstanek: oh, my email just got synced and I can see it now | 14:43 |
| henrique_ | ayoung, morganfainberg (and anyone interested in reseller), I've just sent an email to openstack-dev regarding the project scoped token by name stuff we discussed in vancouver | 14:47 |
| henrique_ | you may want to take a look at it, and we can discuss it in today's meeting if we have room for it | 14:47 |
| *** henrique_ has quit IRC | 14:48 | |
| *** htruta has joined #openstack-keystone | 14:48 | |
| htruta | btw, henrique_ was me | 14:49 |
| dstanek | https://review.openstack.org/#/c/183698/ - strange new HTTP 5XX rules | 14:49 |
| *** radez is now known as radez_g0n3 | 14:54 | |
| *** hemnafk is now known as hemna | 15:02 | |
| *** mabrams has quit IRC | 15:03 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove deprecated external authentication plugins https://review.openstack.org/125701 | 15:05 |
| rodrigods | marekd, stevemar, "Shall we pull Federation Mapping Engine out of Keystone and make it separate library?" yeeeeees | 15:07 |
| marekd | rodrigods: :) | 15:08 |
| stevemar | rodrigods, marek and i want it out. i don't think anyone else does :( | 15:08 |
| marekd | rodrigods: we will get there...one day. | 15:08 |
| *** e0ne is now known as e0ne_ | 15:09 | |
| rodrigods | marekd, stevemar I want it. | 15:09 |
| *** e0ne_ is now known as e0ne | 15:09 | |
| stevemar | that makes 3 of us then | 15:10 |
| marekd | vs rest of the world | 15:10 |
| *** zzzeek has joined #openstack-keystone | 15:10 | |
| rodrigods | haha | 15:10 |
| *** samueldmq_ has joined #openstack-keystone | 15:10 | |
| marekd | rodrigods: well, ok if it doesn't happen I am not going to despair. | 15:11 |
| dstanek | rodrigods: will only keystone use it? | 15:11 |
| *** samueldmq_ is now known as samuel-dmq | 15:11 | |
| samuel-dmq | jamielennox, hi, I just saw a message here saying | 15:11 |
| samuel-dmq | <jamielennox> holy crap, devstack v3 only completed | 15:11 |
| samuel-dmq | jamielennox, did I misread something? | 15:11 |
| rodrigods | dstanek, good point :) | 15:12 |
| stevemar | dstanek, yes, but it's handy for admins creating a mapping to validate | 15:13 |
| rodrigods | stevemar, ++ | 15:13 |
| marekd | ...and not having to install whole keystone locally to try that out | 15:13 |
| dstanek | why don't we provide an api then: openstackclient validate-federation-mapping something.json | 15:14 |
| marekd | dstanek: we cannot validate mapping rules as of today. | 15:15 |
| dstanek | then how does a separate package help you? | 15:15 |
| marekd | dstanek: well, let's start the cli tool would be a local mapping rules tester - here is my ruleset, here is my parsed assertion (key values for instance) and as an output you see users' credentials based on the rules - user_id, groups (ids). | 15:17 |
| marekd | dstanek: if we make this tool part of keystone, you will need to install heavy keystone (with all the deps) just to test that out on you local laptop. | 15:17 |
| rodrigods | we can even add tools to help building rules | 15:18 |
| marekd | dstanek: with a pulled out library and wraper that'd be much lighter. | 15:18 |
| marekd | dstanek: that's my only argument, and hence i am saying im in favor of this, however i see your point and i will not push for separating the code extremly hard. | 15:19 |
| dstanek | rodrigods: start building the tools and then if it looks independently useful you have a better case | 15:19 |
| dstanek | marekd: so the real difference would be in the amount of deps your new package has right? | 15:20 |
| marekd | dstanek: yes. | 15:21 |
| marekd | dstanek: i think we will get there (separate lib) either way, maybe we just need to wait a little bit. I understand it. | 15:23 |
| bknudson | keystone unit tests are failing due to stuff in oslo being deprecated... I'll post a patch to disable the check for now | 15:33 |
| morganfainberg | bknudson: oooh doh! | 15:35 |
| *** samuel-dmq has quit IRC | 15:36 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove deprecation check in tests https://review.openstack.org/187639 | 15:36 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Revert "Remove deprecation check in tests" https://review.openstack.org/187640 | 15:36 |
| *** boris-42 has joined #openstack-keystone | 15:37 | |
| *** bdossant has quit IRC | 15:39 | |
| *** openstackgerrit has quit IRC | 15:42 | |
| *** fhubik is now known as fhubik_afk | 15:43 | |
| *** openstackgerrit has joined #openstack-keystone | 15:43 | |
| *** topol has joined #openstack-keystone | 15:44 | |
| *** ChanServ sets mode: +v topol | 15:44 | |
| *** SaintAardvark has joined #openstack-keystone | 15:46 | |
| *** bdossant has joined #openstack-keystone | 15:51 | |
| *** _cjones_ has joined #openstack-keystone | 15:51 | |
| *** someara2 has joined #openstack-keystone | 15:52 | |
| *** fhubik_afk is now known as fhubik | 15:59 | |
| *** jistr has quit IRC | 16:05 | |
| *** browne has joined #openstack-keystone | 16:10 | |
| *** gyee has joined #openstack-keystone | 16:10 | |
| *** ChanServ sets mode: +v gyee | 16:10 | |
| *** belmoreira has quit IRC | 16:12 | |
| *** gokrokve_ has joined #openstack-keystone | 16:14 | |
| *** bdossant has quit IRC | 16:15 | |
| *** gokrokve has quit IRC | 16:17 | |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Replace status code 403 with ForbiddenAction.code https://review.openstack.org/187511 | 16:22 |
| *** mattfarina has joined #openstack-keystone | 16:22 | |
| samueldmq | ayoung, hi, - you around ? saw your message but was afk | 16:25 |
| *** e0ne has quit IRC | 16:29 | |
| *** liusheng has quit IRC | 16:33 | |
| *** liusheng has joined #openstack-keystone | 16:33 | |
| *** fhubik has quit IRC | 16:34 | |
| *** lhcheng has joined #openstack-keystone | 16:39 | |
| *** ChanServ sets mode: +v lhcheng | 16:39 | |
| *** gokrokve_ has quit IRC | 16:43 | |
| *** gokrokve has joined #openstack-keystone | 16:43 | |
| *** gokrokve has quit IRC | 16:45 | |
| *** gokrokve_ has joined #openstack-keystone | 16:45 | |
| *** lufix has joined #openstack-keystone | 16:46 | |
| *** iurygregory has joined #openstack-keystone | 16:50 | |
| ayoung | samueldmq, yep | 16:53 |
| ayoung | samueldmq, you have not started actively coding the "fetch policy by url" feature, right? | 16:54 |
| samueldmq | ayoung, actually I am available from today to start the fetch policy in ksmiddleware | 16:54 |
| samueldmq | ayoung, I just made the changes in keystone server so far .. (updating them this afternoon) | 16:54 |
| ayoung | samueldmq, so started the work already? Cool | 16:55 |
| ayoung | samueldmq, fetch by URL? | 16:55 |
| *** lufix has quit IRC | 16:55 | |
| samueldmq | ayoung, I started just the keystone filter ... by endpoint_url | 16:55 |
| samueldmq | ayoung, you already know that | 16:55 |
| samueldmq | ayoung, the fetch part I am starting later today (if you don't grab it) | 16:56 |
| ayoung | samueldmq, wasn't sure if you had started coding. good to know | 16:56 |
| samueldmq | ayoung, nice | 16:56 |
| ayoung | better for you to implement...I'm just needing a coding task to keep from going crazy with all these specs | 16:56 |
| samueldmq | ayoung, GET /policies?endpoin_url=<url> | 16:56 |
| *** emagana has quit IRC | 16:57 | |
| *** emagana has joined #openstack-keystone | 16:59 | |
| *** dguerri is now known as dguerri`away | 17:04 | |
| *** alanf-mc has joined #openstack-keystone | 17:10 | |
| *** spandhe has joined #openstack-keystone | 17:11 | |
| *** samleon has joined #openstack-keystone | 17:14 | |
| samueldmq | ayoung, http://lists.openstack.org/pipermail/openstack-dev/2015-June/065496.html | 17:17 |
| *** rushiagr_away is now known as rushiagr | 17:17 | |
| ayoung | samueldmq, yes, I talked with them about it at the summit. I don't like that. | 17:18 |
| ayoung | samueldmq, I was, however, thinking something like this: | 17:19 |
| samueldmq | ayoung, we need to converge to a solution | 17:19 |
| samueldmq | ayoung, they said me that had talked to jamielennox (possibly morganfainberg as well) | 17:19 |
| rushiagr | dstanek: (regarding a new version for each change) that makes sense: too much of an overhead | 17:19 |
| gyee | ayoung, samueldmq, that proposal won't work | 17:19 |
| samueldmq | ayoung, we need to agree with people from other projects, then we have no problems with adoption | 17:19 |
| samueldmq | gyee, so then let's convince them | 17:19 |
| dstanek | rushiagr: i don't know if morganfainberg was explicit in there, but i always thought of a version as corresponding to a release | 17:20 |
| ayoung | samueldmq, lets try to loop them in to the dynamic policy discussions. I realize I want to do something....similar to what they suggest, but different | 17:20 |
| samueldmq | gyee, let's have a clean table from the start, and we will be good when adopting | 17:20 |
| gyee | tell horizon to parse Nova source code in order to setup a intuitive UI is going to be *fun* :) | 17:20 |
| ayoung | ok...lets stake a standard, tricky rule... | 17:20 |
| ayoung | let me see... | 17:20 |
| samueldmq | ayoung, what if we have a separate meeting for dynamic policy stuff | 17:20 |
| samueldmq | ? | 17:20 |
| morganfainberg | dstanek: hmm? | 17:20 |
| * morganfainberg reads backscroll. | 17:20 | |
| ayoung | samueldmq, Maybe. discussing that is in the agenda for today's keystone meeting | 17:21 |
| samueldmq | gyee, ++ good point | 17:21 |
| david8hu | I read about that proposal, too. I don't like how policy is hardcoded, but I do like a way for audit trail. | 17:21 |
| ayoung | samueldmq, I think I want to split up policy like this: | 17:21 |
| gyee | tell our security auditors to read the code to find out who can do what is even more fun | 17:21 |
| ayoung | let me link to the cloud sample... | 17:21 |
| dstanek | morganfainberg: https://review.openstack.org/#/c/177428/7/specs/backlog/stable-driver-interfaces.rst | 17:21 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json#n39 | 17:21 |
| samueldmq | gyee, please reply that email, let's converge in the idea | 17:21 |
| samueldmq | gyee, I like your arguments :) | 17:21 |
| *** henrynash has joined #openstack-keystone | 17:22 | |
| *** ChanServ sets mode: +v henrynash | 17:22 | |
| ayoung | OK, so my guidance was to split the "find the project_id" from the "assign this role" | 17:22 |
| ayoung | so, that line is kindof in that form: | 17:22 |
| morganfainberg | dstanek: the idea is there should *not* be many reasons to break the driver contract. | 17:22 |
| ayoung | sio I don't want tules like this rule:admin_and_matching_target_project_domain_id would be | 17:22 |
| morganfainberg | If you are breaking that contract it is a change. Release or not. | 17:22 |
| ayoung | better as | 17:22 |
| gyee | samueldmq, on yeah, let me read the Nova code to find out how to create a trust :) | 17:22 |
| morganfainberg | Some deployers chase master. You would need a new driver interface contract and still need to support the old contract if you are making a change | 17:23 |
| morganfainberg | rushiagr: ^cc | 17:23 |
| dstanek | morganfainberg: and breaking means remove, rename or update datatype right? | 17:23 |
| ayoung | "identity:get_project": "domain_id:%(project.domain_id)s and rule_get_project_role", | 17:23 |
| ayoung | samueldmq, and then rule_get_project_role would specify what role you need for that API | 17:23 |
| morganfainberg | dstanek: change to method signature, new data type, adding/removing methods etx | 17:23 |
| ayoung | its really verbose, but we could split it into two files | 17:23 |
| *** rlt_ has quit IRC | 17:23 | |
| david8hu | ayoung, gyee, samueldmq, The proposal will make it harder for me to come up with a programatic way to dump all capabilities assocaited with a token or user. | 17:23 |
| *** henrynash has quit IRC | 17:23 | |
| morganfainberg | dstanek: assume the driver is loaded from out of tree | 17:24 |
| ayoung | one which is never touched, and just matches the domain_id, the other which assigns roles | 17:24 |
| gyee | david8hu, can't you write a script to scan the source code? :) | 17:24 |
| ayoung | david8hu, the "in the code" proposal?" yeah | 17:24 |
| morganfainberg | If we adhere to our contract the driver should keep working. Even if we layer more business logic on top of it. | 17:24 |
| ayoung | david8hu, we'll work with sdague to make sure the approach is sane for all the requirements | 17:25 |
| gyee | david8hu, with AI on top | 17:25 |
| ayoung | david8hu, are you still looking at "clean up the token pipeline?" | 17:25 |
| david8hu | gyee, ayoung, Maybe elastic search will help . LOL | 17:25 |
| *** nkinder_ has joined #openstack-keystone | 17:25 | |
| samueldmq | ayoung, david8hu ++ | 17:26 |
| david8hu | ayoung, yes, I am. Is accessinfo still alive? | 17:26 |
| samueldmq | ayoung, I am not sure about different files .. we should go away from files, not create more of them :p | 17:26 |
| ayoung | david8hu, alive and kicking...question is whether I need to add ServiceProviders before you can use it? | 17:26 |
| samueldmq | ayoung, but I agree with the idea | 17:26 |
| ayoung | david8hu, the name of the review has changed...I'll link | 17:27 |
| david8hu | ayoung, ServiceProviders? | 17:27 |
| ayoung | https://review.openstack.org/#/c/184651/ | 17:27 |
| rushiagr | morganfainberg: getting that.. But I'm still not clear what's decided on how to manage changes.. I think the layer on top of the driver will still need to know what version the db driver is exposing currently, so that that layer can decide which path to take depending upon that version number | 17:28 |
| rushiagr | morganfainberg: am I missing that discussion, or we are yet to reach a consensus on that discussion? | 17:28 |
| david8hu | ayoung, It is on my todo list. I will take a look, and provide feedback. | 17:28 |
| morganfainberg | rushiagr: correct. Think of this like how neutron and ironic handle the vendor drivers. | 17:29 |
| *** nkinder__ has quit IRC | 17:29 | |
| ayoung | david8hu, I'm going to add service providers. I'll need some new sample data for that, and it will motivate me to integrate the test fixtures with the rest of the server code | 17:29 |
| morganfainberg | They do not break the contract. And yes it limits what can be done. This spec just says that *if* we need to break the contract - we need to have logic to know how to work with the old interface as well | 17:30 |
| morganfainberg | I don't know if ironic or neutron specifically outline how to change the driver interface contracts. This is the definition we are putting forward for future cases. | 17:30 |
| morganfainberg | rushiagr: so yes, we need to know the version of the driver interface being used. | 17:30 |
| david8hu | ayoung, the patch has over 1000 LOC already :) Are you trying break a record or something. | 17:31 |
| *** ksavich has joined #openstack-keystone | 17:31 | |
| ayoung | david8hu, mostly testing | 17:31 |
| morganfainberg | And yes we will need to at least translate those results. (Should be a known) | 17:31 |
| *** nkinder_ has quit IRC | 17:31 | |
| ayoung | david8hu, there are some sampledata tokens in there copied over from KC. | 17:31 |
| *** e0ne has joined #openstack-keystone | 17:32 | |
| ayoung | david8hu, I will probably be dropping the LOC count when I do ServiceProviders by using existing fictures. rodrigods do we have sample JSON fixtures I can use for ServiceProvider testing in https://review.openstack.org/#/c/184651/ ? | 17:32 |
| david8hu | ayoung, I found those fixtures very useful for token formatter as well. I basically use them for free. Go ahead an incorporate them. | 17:32 |
| *** emagana has quit IRC | 17:32 | |
| ayoung | david8hu, We have had several iterations of the token fixtures over time. I'd probably be negligent if I just blindly copied them without good reason. I had good reason before, but less so now | 17:33 |
| lbragstad | we have quite a few new bugs this week | 17:36 |
| *** josecastroleon has quit IRC | 17:39 | |
| ayoung | $ openstack server list | 17:42 |
| ayoung | ERROR: openstackclient.shell Exception raised: (python-neutronclient 2.3.9 (/usr/lib/python2.7/site-packages), Requirement.parse('python-neutronclient<3,>=2.3.11')) | 17:42 |
| ayoung | joy | 17:43 |
| *** nkinder_ has joined #openstack-keystone | 17:43 | |
| stevemar | ayoung, $ pip install --update python-neutronclient | 17:44 |
| ayoung | stevemar, biter your tongue | 17:44 |
| ayoung | er...fingers | 17:44 |
| ayoung | stevemar, I'm trying to make this work using RPMS | 17:44 |
| stevemar | ohh | 17:44 |
| stevemar | pfft, on your own on that front | 17:44 |
| david8hu | ayoung, There is a RPM for that. | 17:44 |
| ayoung | if I keep doing pip...I never find out how our packages are all kinds of outofsync | 17:45 |
| ayoung | david8hu, where? | 17:45 |
| david8hu | ayoung, dont know ;) | 17:45 |
| ayoung | david8hu, I tried using the RDO repo...but maybe I have a copr enabled that got me too late an openstacklclient | 17:45 |
| ayoung | python-openstackclient noarch 1.0.3-2.fc23 openstack-kilo but python-neutronclient noarch 2.3.9-1.fc22 fedora | 17:46 |
| ayoung | david8hu, that looks wrong | 17:46 |
| david8hu | ayoung, perhaps time to migrate to pip install like stevemar suggested or try rpmfind.net | 17:49 |
| ayoung | david8hu, going to try the rdo-testing repo...but shipping a working version of the CLI should be baseline. I'm still kindof mad it wasn't wokring in Fedora22 right from install | 17:49 |
| ayoung | david8hu, nah, it is in here https://repos.fedorapeople.org/repos/openstack/openstack-kilo/testing/f22/ just not in "released" | 17:50 |
| david8hu | ayoung, Do you run devstack at all? | 17:50 |
| ayoung | david8hu, only in a VM | 17:50 |
| david8hu | ayoung, i see. | 17:50 |
| ayoung | david8hu, It made a mess of my workstation, replacing core site-packages with the upstream versions...which then broken when the time came to update the install | 17:51 |
| ayoung | I pip install rpdb and tox, and things like that, but that is about it | 17:51 |
| david8hu | ayoung, a lot of fun | 17:51 |
| ayoung | and we still ship a version of python-neutronclient that does not match what openstackclient needs | 17:51 |
| morganfainberg | g | 17:52 |
| ayoung | python-neutronclient.noarch 2.3.11-1.fc23 should be good. WTF? | 17:52 |
| morganfainberg | almost that time.... | 17:52 |
| *** e0ne is now known as e0ne_ | 17:52 | |
| *** someara2 has quit IRC | 17:54 | |
| *** someara2 has joined #openstack-keystone | 17:54 | |
| *** someara2 has quit IRC | 17:57 | |
| *** someara2 has joined #openstack-keystone | 17:57 | |
| *** e0ne_ is now known as e0ne | 17:57 | |
| *** aix has quit IRC | 17:57 | |
| rushiagr | morganfainberg: okay. That makes things clearer.. I still get a feeling that not all details have been either 1. documented or 2. not completely decided/thought throuogh/agreed upon | 17:57 |
| morganfainberg | rushiagr: the spec covers a lot of things but specs are not set in stone and can always be improved | 17:58 |
| morganfainberg | the other side is they are really about a direction. | 17:58 |
| *** henrynash has joined #openstack-keystone | 17:58 | |
| *** ChanServ sets mode: +v henrynash | 17:58 | |
| rushiagr | morganfainberg: hmm.. | 17:58 |
| rushiagr | morganfainberg: I'll spend some more time on this, maybe tomorrow. Sleeping time here.. | 17:58 |
| morganfainberg | things invariably change a little as implementation occurs | 17:58 |
| morganfainberg | rushiagr: sleep well! | 17:58 |
| rushiagr | morganfainberg: true. Thanks :) | 17:59 |
| marekd | gyee: https://review.openstack.org/#/c/187514/ please revisit, left a comment for ya | 18:00 |
| gyee | marekd, k, lemme 2x check on that decorator | 18:01 |
| openstackgerrit | Fernando Diaz proposed openstack/python-keystoneclient: Add openid connect client support https://review.openstack.org/134700 | 18:01 |
| *** radez_g0n3 is now known as radez | 18:02 | |
| *** edmondsw has joined #openstack-keystone | 18:02 | |
| *** ayoung is now known as ayoung_Eeyeore | 18:02 | |
| *** ayoung_Eeyeore is now known as ayoung | 18:02 | |
| morganfainberg | jamielennox: ping meeting | 18:03 |
| *** someara2 has quit IRC | 18:06 | |
| *** samleon has quit IRC | 18:06 | |
| ayoung | dstanek, >>> print keystoneclient.__file__ | 18:08 |
| ayoung | /opt/stack/python-keystoneclient/keystoneclient/__init__.pyc | 18:08 |
| ayoung | dstanek, how do I undo that? | 18:08 |
| ayoung | ie...use the fiels in /usr/lib/python27/site-packages? | 18:09 |
| *** openstackgerrit has quit IRC | 18:09 | |
| *** openstackgerrit has joined #openstack-keystone | 18:10 | |
| *** dguerri`away is now known as dguerri | 18:11 | |
| *** someara2 has joined #openstack-keystone | 18:19 | |
| dstanek | ayoung: set the correct path in your PYTHONPATH or in python set sys.path | 18:19 |
| ayoung | dstanek, it was easyintall...I got it | 18:22 |
| ayoung | .pth file somewhere | 18:22 |
| *** gokrokve_ has quit IRC | 18:23 | |
| *** HT_sergio has quit IRC | 18:30 | |
| *** someara2 has left #openstack-keystone | 18:37 | |
| *** blewis has joined #openstack-keystone | 18:41 | |
| *** erhudy has quit IRC | 18:42 | |
| *** gokrokve has joined #openstack-keystone | 18:42 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Add default domain to fixture.v3.V3FederationToken https://review.openstack.org/187516 | 18:42 |
| marekd | gyee: ^^ | 18:43 |
| gyee | marekd, looks good! waiting for Jenkins, don't want topol to call me Mr. Speedy | 18:44 |
| *** gokrokve has quit IRC | 18:44 | |
| * topol its a term of endearment | 18:44 | |
| *** gokrokve has joined #openstack-keystone | 18:44 | |
| marekd | gyee: sure | 18:44 |
| *** kiran-r has joined #openstack-keystone | 18:50 | |
| *** openstackgerrit has quit IRC | 18:56 | |
| *** openstackgerrit has joined #openstack-keystone | 18:56 | |
| *** Chenhong has joined #openstack-keystone | 18:59 | |
| *** henrynash has quit IRC | 19:00 | |
| *** Chenhong has quit IRC | 19:00 | |
| *** rushiagr is now known as rushiagr_away | 19:01 | |
| marekd | dstanek: keysone-mapper would simply depend on jsonschema and maybe something small vs whole keystone. | 19:01 |
| morganfainberg | my evaluation on splitting mapping out is strictly "who would use this besides us" | 19:01 |
| morganfainberg | thats really all i'm looking at for managing the overhead of splitting it out | 19:01 |
| marekd | morganfainberg: i see | 19:01 |
| marekd | morganfainberg: ok, so not let's split it for now. | 19:01 |
| morganfainberg | (considering we're going to be looking at merging some plugin things back in now that pbr is smarter [yay!]) | 19:02 |
| bknudson | another reason to split it out is you can have a different core group | 19:02 |
| morganfainberg | bknudson: do we have enough people legitimately interested in just that small bit of code to justify a core group | 19:02 |
| morganfainberg | if so, willing to support a split (and fair point) | 19:02 |
| marekd | morganfainberg: ok, let's not split it for now. | 19:02 |
| bknudson | I don't know what the plans are for the project | 19:02 |
| *** geoffarnold_ has joined #openstack-keystone | 19:03 | |
| dstanek | bknudson: project/module :-) | 19:03 |
| morganfainberg | bknudson: my general feeling is not split - and if we get a solid case to split we can. | 19:03 |
| marekd | bknudson: this cycle i think we will leave it as is. | 19:03 |
| morganfainberg | and iirc we can do sub-tree cores in gerrit. | 19:03 |
| marekd | bknudson: later i have some ideas. | 19:03 |
| morganfainberg | but i'd have to ask some -infra folks how / if that'd work | 19:03 |
| marekd | morganfainberg: there is no need for it IMHO | 19:03 |
| morganfainberg | annnnd henrynash is gone | 19:03 |
| *** HT_sergio has joined #openstack-keystone | 19:03 | |
| bknudson | the unit tests would be a lot faster if it was just mapping and not all keystone | 19:03 |
| marekd | morganfainberg: ok, tomorrow i will propose cli under keystone umbrella | 19:04 |
| gyee | marekd, have you think about how to manage mapping from UI? | 19:05 |
| gyee | like how to render a map in UI? | 19:05 |
| stevemar | gyee, as a json blob :P | 19:06 |
| *** Rockyg has joined #openstack-keystone | 19:06 | |
| gyee | stevemar, that's not UI | 19:06 |
| stevemar | we have have APIs to support adding a single rule or AND'ing a rule | 19:07 |
| gyee | stevemar, yeah, to be properly authorize on the mapping, I think we'll need to decompose it the same way we decompose policies | 19:08 |
| *** HT_sergio has quit IRC | 19:08 | |
| gyee | if you think about it, a map is a lot like an API, data coming in and data coming out | 19:09 |
| gyee | how do we authorize what data it can produce? | 19:10 |
| marekd | gyee: i imagine this as # keystone-mapper --mapping-rules <json with mapping> --input <kwy value stores, something like parsed credentials injected in the RuleProcessor> | 19:10 |
| marekd | gyee: no API, it's just string processing | 19:10 |
| marekd | gyee: KISS rule | 19:11 |
| * marekd needs to step out for a while | 19:13 | |
| *** davechen has joined #openstack-keystone | 19:14 | |
| ayoung | morganfainberg, mapping should be callable inside the endpoints. You could avoid having to go back to Keystone except to fetch role assignments | 19:15 |
| ayoung | tokenless everywhere | 19:15 |
| morganfainberg | ayoung: would break a lot of places. nova -> galnce | 19:15 |
| morganfainberg | etc | 19:15 |
| openstackgerrit | Merged openstack/keystoneauth: Honour ``service_providers`` in AccessInfo https://review.openstack.org/187514 | 19:16 |
| *** tellesnobrega_ has joined #openstack-keystone | 19:16 | |
| gyee | ayoung, that's why I suggest melting mapping with oslo.policy | 19:16 |
| *** iamjarvo has joined #openstack-keystone | 19:19 | |
| *** belmoreira has joined #openstack-keystone | 19:20 | |
| *** gyee has quit IRC | 19:21 | |
| samueldmq | ayoung, couldn't the policy endpoint binding be enforced somehow using the endpoint_url we will be defining for the policy fetch thing ? | 19:24 |
| samueldmq | ayoung, I mean the token endpoint binding | 19:25 |
| ayoung | morganfainberg, not if glance implements as well, and Nova was implicitly trusted | 19:26 |
| *** fangzhou has joined #openstack-keystone | 19:26 | |
| ayoung | samueldmq, yes it can | 19:26 |
| morganfainberg | ayoung: "implicit" trust is not something we do well in OpenStack at the moment. there is a lot of change needed for that to be a reality | 19:26 |
| ayoung | morganfainberg, or done with a delegation_id, but this is all in the realm of the possible. But it means we need to check mapping outside of Keystone itself | 19:27 |
| samueldmq | ayoung, great, so we should re-use that endpoint_url (will be in the keystoneauth_token session of services' configs | 19:27 |
| samueldmq | ayoung, instead of defining a hardcoded endpointid in the policy | 19:28 |
| samueldmq | ayoung, agreed ? | 19:28 |
| morganfainberg | ayoung: i think we need to have the policy work before we discuss merging mapping in. | 19:28 |
| *** HT_sergio has joined #openstack-keystone | 19:28 | |
| ayoung | samueldmq, sort of...hold that thought | 19:28 |
| *** fangzhou has quit IRC | 19:28 | |
| samueldmq | ayoung, k | 19:28 |
| *** fangzhou has joined #openstack-keystone | 19:29 | |
| ayoung | morganfainberg, not before discussing, just before implementing. We'd need everything from Keystone to be executable in an external way, and then Keystone becomes a respoitory consuimed by mapping and policy | 19:29 |
| ayoung | policy is the logical first step, but I think we have the broad strokes of that fleshed out | 19:30 |
| morganfainberg | ayoung: lets not dive too deep into this right now, lets get the stuff we need this cycle outlined and build this convo on that (the specs) | 19:30 |
| *** davechen has left #openstack-keystone | 19:31 | |
| *** miguelgrinberg has quit IRC | 19:31 | |
| ayoung | morganfainberg, We need to stop focusing on "what we can get done this release" as we an't get jack done inside a single release. These things take time, and we need to accept that. Often we find that a small change now will have to be undone later because we haven;t actually thought things through. IN the case of this mapping thing, I actually discussed it back in The Fall. | 19:32 |
| morganfainberg | ayoung: having a clear foundation (policy) to work from, even if it's the spec and not the implementation, will make the subsequent conversations easier | 19:32 |
| ayoung | http://adam.younglogic.com/2014/10/who-can-sign-for-what/ | 19:32 |
| ayoung | morganfainberg, having a clear vision of where we are headed will help everyone get aligned | 19:33 |
| ayoung | Anyway..you asked "who would ever want it" or something...that is the answer | 19:33 |
| morganfainberg | ayoung: honestly, i think we *need* the focus on the foundation [again not the implementation] so we can build on it | 19:33 |
| ayoung | and then gyee disappeared | 19:34 |
| *** miguelgr- has joined #openstack-keystone | 19:34 | |
| ayoung | morganfainberg, you know that I am working on that, too | 19:34 |
| morganfainberg | ayoung: yep | 19:35 |
| ayoung | morganfainberg, what do uyou think about Papai? External service, or part of Keystone? | 19:35 |
| ayoung | pretty sure I know what you will say... | 19:35 |
| * samueldmq is waiting morganfainberg view on that | 19:36 | |
| samueldmq | :) | 19:36 |
| morganfainberg | ayoung: honestly, i don't know | 19:36 |
| ayoung | morganfainberg, ok...let me see if I can lay out the pros and cons | 19:36 |
| ayoung | first, the cons...cuz I think they are shorter | 19:36 |
| morganfainberg | ayoung: i can see either side. i dont have a strong feeling it needs to be one way or another | 19:37 |
| ayoung | 1. adds more to keystone, and we are already talking about splitting it | 19:37 |
| morganfainberg | and by exernal you mean "in keystone's API" or "separate process"? | 19:37 |
| ayoung | 2. need to port the DNF library to python27 | 19:37 |
| ayoung | 3. It merges in code that could potentially have a life of its own. | 19:37 |
| ayoung | that is the cons of it being in the same repo | 19:37 |
| ayoung | morganfainberg, yeah | 19:37 |
| ayoung | morganfainberg, I am not saying this clearly ... | 19:38 |
| samueldmq | the API is in Keystone, the drivers (db) should be as well ... as we have been doing all the time :/ | 19:38 |
| ayoung | samueldmq, so...I can see that arguement, but there are a couple counter arguments | 19:39 |
| ayoung | I think the most powerful on keeping them separate argument is actually "managing the access control to the policy API should be separate from everything else" | 19:39 |
| ayoung | you don't want to screw up the policy that manages the policy server...by making changes inside the policy server | 19:40 |
| samueldmq | ayoung, you should manage the access control via keystone, no ? update policy et c... | 19:40 |
| ayoung | the biggest down side to keeping it in a separate repo is the data synchronization issue...and I think that is a solvable problem | 19:41 |
| ayoung | the biggest benefit is that we can split developme of Papaisfrom the rest of Keystone, and make it move faster | 19:41 |
| samueldmq | ayoung, should papai then own the APIs for managing the policy ? | 19:41 |
| ayoung | its in prototype stages now, which is good. It means we can make major changes without too much overhead | 19:41 |
| samueldmq | ayoung, and we deprecate keystone ones ? | 19:41 |
| ayoung | samueldmq, one possibility is that Keystone owns them and proxies papai | 19:42 |
| ayoung | another is that, yes, papai owns them | 19:42 |
| ayoung | there really are very few APIS, and those...are now Service Catalog specific | 19:42 |
| ayoung | get_policy_for_endpoint is the big one...that needs Keystone specific data | 19:42 |
| samueldmq | ayoung, if it is a separate service for managing the policies, I think that is good, but only separating the database is bad imo | 19:43 |
| ayoung | but, if the policy it fetches comes from Papai, and is cached in Keystone. | 19:43 |
| samueldmq | ayoung, however we have the policy associations by endpoint, etc | 19:43 |
| ayoung | samueldmq, I think we keep it as a separate service | 19:43 |
| ayoung | Papai might not need to know about the service catalog | 19:43 |
| samueldmq | ayoung, so you go for keystone and ask for the association | 19:44 |
| ayoung | OTOH, we might want to expose *some* of the policy management APIs direct from Papai | 19:44 |
| samueldmq | ayoung, get the policy id and fetch from papai | 19:44 |
| ayoung | samueldmq, and then Papai needs to support the Keystone servers attempt to request a policy by ID...somehow | 19:44 |
| ayoung | would love it if these IDs were hashses, and we could do this all Git-style | 19:44 |
| samueldmq | ayoung, and papai have granular api's to manage the policy and we deprecate keystone ones | 19:45 |
| ekarlso | what's papai ? | 19:45 |
| ayoung | samueldmq, and Papai needs to continue to support older policies, even after they are updated | 19:45 |
| *** miguelgr- has quit IRC | 19:45 | |
| samueldmq | ayoung, and papai ... | 19:45 |
| ayoung | we might have two endpoints,one that uses policyid 1234 ane one that uses id=abcd | 19:45 |
| samueldmq | ayoung, :) | 19:45 |
| samueldmq | ekarlso, policy store and management serivce, right ayoung ? | 19:46 |
| samueldmq | storage* | 19:46 |
| *** miguelgr- has joined #openstack-keystone | 19:46 | |
| ayoung | ekarlso, PAP is short of Policy Administration Point...standard term for this kind of service. We code named ours PAPAI due to the Brazilian influence | 19:46 |
| ayoung | ekarlso, the same Professor that originally presented on Federation (David Chadwick) now has a graduate student writing a service for policy management. He;'s writing it sort of OpenStack agnosically, so we need to bridge the gap between his design and what we expose | 19:48 |
| *** kiran-r has quit IRC | 19:48 | |
| samueldmq | ayoung, ekarlso where Papai = Dad :) | 19:48 |
| ayoung | they are supposed to get us code pretty soon | 19:48 |
| *** belmoreira has quit IRC | 19:49 | |
| samueldmq | ayoung, whether go to a generic representation (what they're proposing) and write a mapper or go to a less generic approach (we define tables, etc only to fit our needs) is somthing that is still being discussed right? | 19:50 |
| *** amakarov is now known as amakarov_away | 19:51 | |
| ayoung | samueldmq, yeah. I'm kindof postponing that discussion til I have code I can play with | 19:51 |
| samueldmq | ayoung, or did you buy the generic idea (the OpenStack agnosically implementation) and want that | 19:51 |
| ayoung | I want to see how good-bad-ugly it is | 19:51 |
| samueldmq | ayoung, I should be able to create a poc in the simpler idea | 19:51 |
| samueldmq | ayoung, could you point me to code where the checks (form oslo.policy) get instantiated from the policy rule string? | 19:51 |
| ayoung | samueldmq, lets let them run, and focus on the other pieces need to start | 19:51 |
| ayoung | samueldmq, yeah...one sec | 19:52 |
| *** ksavich has quit IRC | 19:52 | |
| *** alanf-mc has quit IRC | 19:54 | |
| morganfainberg | ayoung: separate is fine by me. Really I don't feel strongly it has to be one way or another. | 19:55 |
| *** blewis has quit IRC | 19:55 | |
| morganfainberg | ayoung: I'm more concerned with usability. | 19:56 |
| ayoung | morganfainberg, would we be willing to take it under our corner of the big tent? | 19:56 |
| ayoung | morganfainberg, they wrote it as a Django App. I'm assuming we would prefer Flask, right? | 19:56 |
| morganfainberg | So let's see what bknudson comes up with for the "keystone" corner of the tent. | 19:56 |
| samueldmq | ayoung, please make sure as well ioram knows we are still evaluating their proposal, which can be refused when you (the community) analyzes the code | 19:56 |
| ayoung | samueldmq, its bigger than just me. I'll be involved, but I want the whole team to take ownership of the decision. | 19:57 |
| morganfainberg | But I am not opposed to it. And django / flask I prefer flask but we have prior art for using django in OpenStack. | 19:57 |
| *** SaintAardvark has quit IRC | 19:57 | |
| samueldmq | ayoung, yes, that's why I said (the community) :) | 19:57 |
| ayoung | This is kindof the next big think in Keystone, beyond Fedearation, and we all need to be making informed choices | 19:58 |
| morganfainberg | ayoung: if that makes sense? | 19:58 |
| samueldmq | morganfainberg, great, you agree with having both the storage + management at other service (granular update of policy rules, etc) | 19:58 |
| samueldmq | morganfainberg, and then we deprecate keystone policy api's | 19:58 |
| samueldmq | morganfainberg, is that what's in your mind ? | 19:58 |
| samueldmq | :) | 19:58 |
| ayoung | morganfainberg, yeah...it does. Its why I specifically asked "prefer" | 19:58 |
| *** spandhe has quit IRC | 19:59 | |
| morganfainberg | ayoung: no preference until we determine what the keystone corner of the tent comprises. I see benefit to both sides. I am willing to go with the one that is more usable. I am leaning towards external for more usable. | 19:59 |
| ayoung | samueldmq, so the osl.policy code has its own parser: http://git.openstack.org/cgit/openstack/oslo.policy/tree/oslo_policy/_parser.py | 20:00 |
| morganfainberg | Lunch time. /me jumps out for a few. | 20:00 |
| ayoung | morganfainberg, and if we manage it, we *prefer* flask but are willing to *accept* DJango | 20:00 |
| samueldmq | morganfainberg, ++ | 20:00 |
| samueldmq | morganfainberg, bon apetit | 20:00 |
| ayoung | samueldmq, does ^^ answer your question about oslo.policy? | 20:01 |
| * ayoung has a meeting | 20:01 | |
| samueldmq | ayoung, yes, thanks | 20:01 |
| ayoung | cool | 20:01 |
| samueldmq | ayoung, going home now, talk to you later | 20:01 |
| *** ayoung is now known as ayoung-meeting | 20:01 | |
| *** miguelgr- is now known as miguelgrinberg | 20:05 | |
| *** samueldmq has quit IRC | 20:05 | |
| *** ayoung-meeting has quit IRC | 20:06 | |
| *** Raildo has joined #openstack-keystone | 20:08 | |
| *** openstackgerrit has quit IRC | 20:10 | |
| *** openstackgerrit has joined #openstack-keystone | 20:10 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Switch from deprecated isotime https://review.openstack.org/187751 | 20:11 |
| bknudson | ^ should fix the use of deprecated function | 20:12 |
| *** iamjarvo has quit IRC | 20:14 | |
| *** tellesnobrega_ has quit IRC | 20:16 | |
| *** timcline has quit IRC | 20:16 | |
| *** ayoung-meeting has joined #openstack-keystone | 20:23 | |
| *** HT_sergio has quit IRC | 20:27 | |
| *** alanf-mc has joined #openstack-keystone | 20:29 | |
| *** timcline has joined #openstack-keystone | 20:30 | |
| *** topol has quit IRC | 20:32 | |
| *** henrynash has joined #openstack-keystone | 20:32 | |
| *** ChanServ sets mode: +v henrynash | 20:32 | |
| *** henrynash has quit IRC | 20:33 | |
| *** jsavak has quit IRC | 20:33 | |
| *** jsavak has joined #openstack-keystone | 20:34 | |
| Raildo | stevemar, ping, hey can you take a moment later to see this patch? https://review.openstack.org/#/c/123539/ :) | 20:35 |
| *** Raildo_ has joined #openstack-keystone | 20:35 | |
| stevemar | Raildo, NO! | 20:36 |
| stevemar | :) | 20:36 |
| stevemar | yeah sure, just give me a few minutes, helping someone else out | 20:36 |
| stevemar | trying to explain that v2 and v3 endpoints always exist in keystone :\ | 20:37 |
| *** henrynash has joined #openstack-keystone | 20:37 | |
| *** henrynash has quit IRC | 20:37 | |
| *** operator99 is now known as gyee | 20:39 | |
| *** Raildo has quit IRC | 20:39 | |
| *** spandhe has joined #openstack-keystone | 20:40 | |
| *** emagana has joined #openstack-keystone | 20:41 | |
| *** iamjarvo has joined #openstack-keystone | 20:42 | |
| bknudson | stevemar: you can configure the paste pipeline to remove either or both | 20:43 |
| *** emagana has quit IRC | 20:43 | |
| bknudson | although keystone without either v2 or v3 is not very useful | 20:44 |
| *** emagana has joined #openstack-keystone | 20:44 | |
| stevemar | bknudson, i don't think our product teams would support that recommendation | 20:45 |
| bknudson | we have to support everything possible! | 20:45 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Common base class for unit tests https://review.openstack.org/187770 | 20:49 |
| *** jsavak has quit IRC | 20:51 | |
| *** jsavak has joined #openstack-keystone | 20:52 | |
| *** gyee has quit IRC | 20:53 | |
| *** gyee has joined #openstack-keystone | 20:53 | |
| *** ChanServ sets mode: +v gyee | 20:53 | |
| *** emagana has quit IRC | 20:58 | |
| Raildo_ | stevemar, haha, thanks :D | 21:00 |
| stevemar | bknudson, i told them we might remove keystone CLI in L | 21:00 |
| stevemar | they were surprisd | 21:01 |
| *** iurygregory has quit IRC | 21:01 | |
| stevemar | but they sent me logs with the deprecation message everytime keystone CLI was used | 21:01 |
| stevemar | classic | 21:01 |
| bknudson | classic. | 21:01 |
| Raildo_ | stevemar, I was in a event here in Brazil and I guy told that in your company they use the Essex release... | 21:03 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Common base class for unit tests https://review.openstack.org/187770 | 21:03 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Switch from isotime https://review.openstack.org/187774 | 21:03 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Unit tests catch deprecated function usage https://review.openstack.org/187775 | 21:03 |
| *** Raildo__ has joined #openstack-keystone | 21:03 | |
| stevemar | Raildo_, essex is still the best release | 21:04 |
| stevemar | (i've never worked on essex, and that was a joke) | 21:04 |
| Raildo__ | haha | 21:04 |
| edmondsw | stevemar, bknudson the work to get all the services compatible with v3 continues, right? I'm hoping it | 21:05 |
| edmondsw | isn't too much longer before we can remove v2 from the pipeline if we want | 21:05 |
| bknudson | edmondsw: samueldmq is been working on providing a gate job that disables v2 | 21:06 |
| bknudson | if that works then it shows that all the services work with v3 | 21:06 |
| edmondsw | we know they don't today, but they should be moving that direction... | 21:06 |
| gyee | just pull v2 from pipeline and see who screams, then fix them one at a time | 21:07 |
| stevemar | edmondsw, yeah we're close, not there yet, but close | 21:07 |
| gyee | no guts, no glory | 21:08 |
| *** Raildo_ has quit IRC | 21:08 | |
| *** pnavarro has quit IRC | 21:08 | |
| edmondsw | https://trello.com/b/5qivasNp/keystone-v3 | 21:08 |
| edmondsw | I ran across that a while back | 21:08 |
| edmondsw | looks like it has had some recent activity | 21:09 |
| *** e0ne has quit IRC | 21:11 | |
| *** radez is now known as radez_g0n3 | 21:11 | |
| *** radez_g0n3 is now known as radez | 21:14 | |
| *** jsavak has quit IRC | 21:19 | |
| *** Raildo__ has quit IRC | 21:22 | |
| *** ayoung-meeting is now known as ayoung | 21:25 | |
| *** iamjarvo has quit IRC | 21:25 | |
| *** mattfarina has quit IRC | 21:28 | |
| jamielennox | morganfainberg: sorry i missed the meeting, it looks like ksa was discussed a lot | 21:28 |
| morganfainberg | jamielennox: yep. | 21:28 |
| morganfainberg | jamielennox: need to talk about auth plugins. | 21:30 |
| jamielennox | i'm just reading the eavesdrop now | 21:30 |
| *** jaypipes has joined #openstack-keystone | 21:33 | |
| jaypipes | morganfainberg, dolphm: hey what happened to the regions/ resource in the Keystone v3 API? I don't see it on http://developer.openstack.org/api-ref-identity-v3.html... | 21:33 |
| *** ayoung_ has joined #openstack-keystone | 21:34 | |
| jamielennox | bknudson: so i did: https://github.com/jamielennox/jsonhome | 21:35 |
| dolphm | jaypipes: i guess it's in the spec, but it's never been added to the docs? https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3.rst#regions-v3regions | 21:35 |
| stevemar | jaypipes, it should be there | 21:35 |
| stevemar | dolphm, jaypipes, yeah, use keystone-specs | 21:35 |
| morganfainberg | jaypipes: what dolphm said. | 21:36 |
| stevemar | jaypipes, the one you linked is missing a good chunk of features | 21:36 |
| dolphm | specs != docs # because pretty | 21:36 |
| bknudson | jamielennox: neat! | 21:36 |
| jamielennox | bknudson: i'm still looking at how it integrates into keystone | 21:36 |
| *** ayoung_ has quit IRC | 21:36 | |
| jamielennox | bknudson: keystone puts all the jsonhome documents onto the router object and then compiles them all into a document only when called | 21:37 |
| bknudson | jamielennox: it creates a big dict which is the JSON Home document | 21:37 |
| *** ayoung has quit IRC | 21:38 | |
| jamielennox | bknudson: when you have a minute do you want to have a look over the APIs of the lib and i'll look at moving it into stackforge and we can start consuming it for keystone and keystoneclient | 21:38 |
| jamielennox | i've tried to keep it fairly low level for now, i'm adding helpers to the object on the keystone side and we'll see if they are generally useful to move to the library | 21:39 |
| bknudson | jamielennox: looks good to me. | 21:41 |
| openstackgerrit | Merged openstack/python-keystoneclient: Add EC2 CRUD credential support to v3 API https://review.openstack.org/187094 | 21:41 |
| jamielennox | it does the inherit from dict thing which i was struggling with but i think in this case it makes sense | 21:42 |
| bknudson | using uritemplate makes the replacement pretty easy | 21:43 |
| jamielennox | bknudson: yea, that's a nice little library | 21:44 |
| *** nkinder_ has quit IRC | 21:44 | |
| *** dtroyer has quit IRC | 21:44 | |
| bknudson | looks like you could also use it to validate that all the variables are mentioned in the json home | 21:44 |
| jamielennox | bknudson: yea, i was experimenting with ways of putting this into keystone | 21:45 |
| jamielennox | and the latest one i've got a parameter repo on the Document so it always ensures that all the appropriate params are listed, and you don't always have to reference the same Paramters.domain_id or whatever it is | 21:46 |
| bknudson | sadly, flask uses a different format | 21:46 |
| bknudson | /post/<int:post_id> | 21:46 |
| jamielennox | :( | 21:46 |
| jamielennox | we might be able to just process that | 21:47 |
| bknudson | y, we could accept regular RFC paths and convert to the flask value | 21:47 |
| jamielennox | i was thinking the other way as we wouldn't have the type information | 21:47 |
| bknudson | I don't know if the type is all that useful for keystone | 21:48 |
| bknudson | can you have your own converters? | 21:48 |
| bknudson | maybe we could tell json-home about the type and it could put it on the flask path. | 21:48 |
| jamielennox | bknudson: i started looking into flask but dstanek was looking at it as well so i've left it to him | 21:49 |
| jamielennox | but i imagine there is a way we can abstract our own decorator that handles this all magically | 21:49 |
| bknudson | that maniac was trying to get rid of the paste pipeline | 21:49 |
| jamielennox | bknudson: i don't entirely disagree | 21:49 |
| jamielennox | but i was going to just strip it down for now | 21:50 |
| *** ayoung has joined #openstack-keystone | 21:50 | |
| *** ChanServ sets mode: +v ayoung | 21:50 | |
| *** aix has joined #openstack-keystone | 21:50 | |
| jamielennox | all the extensions in paste is one of the problems i was having with pecan | 21:50 |
| bknudson | we were already planning to make extensions core | 21:51 |
| *** dguerri is now known as dguerri`away | 21:51 | |
| jamielennox | right, so i started on that and dave chen was doing some as well | 21:52 |
| bknudson | https://review.openstack.org/#/c/187751/ passed jenkins (fixes unit tests in keystone) | 21:52 |
| jamielennox | and dstanek was looking at the whole dependency resolution thing which was another problem | 21:52 |
| *** Raildo has joined #openstack-keystone | 21:53 | |
| *** edmondsw has quit IRC | 21:55 | |
| *** bknudson has quit IRC | 21:56 | |
| *** radez is now known as radez_g0n3 | 21:59 | |
| *** lhcheng has quit IRC | 22:04 | |
| *** timcline has quit IRC | 22:04 | |
| morganfainberg | jamielennox: ok back | 22:06 |
| jamielennox | morganfainberg: i'm about to go out for 30 min or so | 22:07 |
| jamielennox | but quickly, why does relmgmt care about us doing a 1.6? | 22:07 |
| *** lhcheng has joined #openstack-keystone | 22:08 | |
| *** ChanServ sets mode: +v lhcheng | 22:08 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:09 | |
| morganfainberg | jamielennox: more than anything just making sure we don't have any carziness going on | 22:11 |
| morganfainberg | dhellmann has been releasing lots of stuff, and to ensure we're not going to cause an issue | 22:11 |
| morganfainberg | not because they need to be directly involved | 22:11 |
| morganfainberg | jamielennox: thats all | 22:12 |
| morganfainberg | jamielennox: keep in mind unless the project looking to consume the new functionality of KSC has conditional logic to not break if the feature is missing, the g-r will need an update as well | 22:13 |
| morganfainberg | not just a release of ksc | 22:13 |
| morganfainberg | lhcheng: you around? | 22:14 |
| lhcheng | morganfainberg: o/ | 22:14 |
| *** dtroyer has joined #openstack-keystone | 22:19 | |
| *** Rockyg has quit IRC | 22:31 | |
| *** dims__ has joined #openstack-keystone | 22:31 | |
| *** dims_ has quit IRC | 22:34 | |
| gyee | dstanek, morganfainberg, trying to understand your comments for https://review.openstack.org/#/c/180769/10/keystonemiddleware/auth_token/__init__.py | 22:35 |
| gyee | is there a way to lookup the package version from the code? | 22:35 |
| gyee | I am referring to "{project}/{project_version} ksv.auth_token/{ksm_version}" | 22:35 |
| jamielennox | morganfainberg: right - i was going to do an immediate bump of g-r because i need this for OSC | 22:38 |
| morganfainberg | jamielennox: ok | 22:39 |
| morganfainberg | gyee: i just recommented on it | 22:39 |
| morganfainberg | gyee: look at the standard format for user-agents | 22:39 |
| *** ayoung has quit IRC | 22:39 | |
| morganfainberg | gyee: you might be able to use pbr.. but that isn't a good option. | 22:39 |
| morganfainberg | gyee: since then it becomes a runtime requirement | 22:39 |
| gyee | morganfainberg, thanks, I was looking for a way to lookup package version from the code | 22:39 |
| morganfainberg | gyee: uhmm... not sure what to reocmmend | 22:40 |
| gyee | I was tempting to do popen but then the permission gods may disagree with me | 22:40 |
| gyee | :) | 22:40 |
| morganfainberg | gyee: i might break your fingers for a popen :P | 22:41 |
| gyee | heh | 22:41 |
| openstackgerrit | Alan Pevec proposed openstack/keystone: Run WSGI with group=keystone https://review.openstack.org/187800 | 22:42 |
| *** diegows has joined #openstack-keystone | 22:53 | |
| *** liusheng has quit IRC | 22:55 | |
| *** afazekas has quit IRC | 22:55 | |
| morganfainberg | jamielennox: ok going to release KSC | 22:56 |
| *** liusheng has joined #openstack-keystone | 22:56 | |
| *** zzzeek has quit IRC | 23:03 | |
| *** stevemar has quit IRC | 23:12 | |
| *** stevemar has joined #openstack-keystone | 23:12 | |
| *** ChanServ sets mode: +v stevemar | 23:12 | |
| *** csoukup has quit IRC | 23:18 | |
| *** markvoelker_ has quit IRC | 23:18 | |
| *** Sayaji has joined #openstack-keystone | 23:19 | |
| *** chlong has joined #openstack-keystone | 23:22 | |
| jamielennox | morganfainberg: great! thanks for that | 23:33 |
| *** lhcheng has quit IRC | 23:35 | |
| *** markvoelker has joined #openstack-keystone | 23:40 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Base use webob https://review.openstack.org/174200 | 23:43 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't rely on token_info for header building https://review.openstack.org/174199 | 23:43 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Move project included validation https://review.openstack.org/174198 | 23:43 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Depend on keystoneclient for expiration checking https://review.openstack.org/174197 | 23:43 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't store expire into memcache https://review.openstack.org/174196 | 23:43 |
| *** bradjones has quit IRC | 23:43 | |
| *** bradjones has joined #openstack-keystone | 23:45 | |
| *** diegows has quit IRC | 23:56 | |
| *** browne has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
