| openstackgerrit | Vladimir Eremin proposed openstack/keystone-specs: Keystone slaveification spec https://review.openstack.org/197379 | 00:04 |
|---|---|---|
| *** spandhe has joined #openstack-keystone | 00:06 | |
| yottatsa | dstanek morganfainberg: done with proposal | 00:06 |
| *** lhcheng_ has quit IRC | 00:09 | |
| yottatsa | Can you please please look on it? Is everything correct? | 00:11 |
| *** dsirrine_ has joined #openstack-keystone | 00:14 | |
| *** yottatsa has quit IRC | 00:21 | |
| *** chlong has joined #openstack-keystone | 00:21 | |
| *** csd has quit IRC | 00:26 | |
| *** sirushti has quit IRC | 00:28 | |
| *** diazjf has joined #openstack-keystone | 00:29 | |
| *** dims has joined #openstack-keystone | 00:32 | |
| *** sirushti has joined #openstack-keystone | 00:33 | |
| *** kfox1111 is now known as kfox1111_away | 00:33 | |
| *** csd has joined #openstack-keystone | 00:33 | |
| *** dims_ has joined #openstack-keystone | 00:35 | |
| *** dims has quit IRC | 00:39 | |
| *** geoffarnold has quit IRC | 00:40 | |
| *** ankita_w_ has quit IRC | 00:46 | |
| *** BrAsS_mOnKeY has quit IRC | 00:49 | |
| *** _cjones_ has quit IRC | 00:49 | |
| *** _cjones_ has joined #openstack-keystone | 00:50 | |
| *** _cjones_ has quit IRC | 00:55 | |
| *** crc32 has quit IRC | 00:55 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 00:58 | |
| *** boris-42 has quit IRC | 01:02 | |
| *** stevemar has joined #openstack-keystone | 01:02 | |
| *** Rockyg has joined #openstack-keystone | 01:03 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 01:04 | |
| *** tellesnobrega_ has joined #openstack-keystone | 01:05 | |
| *** kiran-r has joined #openstack-keystone | 01:10 | |
| *** piyanai has joined #openstack-keystone | 01:11 | |
| *** r-daneel has quit IRC | 01:11 | |
| *** ncoghlan has joined #openstack-keystone | 01:19 | |
| *** davechen has joined #openstack-keystone | 01:20 | |
| *** ncoghlan has quit IRC | 01:20 | |
| *** ncoghlan has joined #openstack-keystone | 01:20 | |
| *** ncoghlan has quit IRC | 01:20 | |
| *** zzzeek has quit IRC | 01:23 | |
| *** Rockyg has quit IRC | 01:28 | |
| *** tellesnobrega_ has quit IRC | 01:38 | |
| *** diazjf has quit IRC | 01:47 | |
| *** ankita_wagh has joined #openstack-keystone | 01:54 | |
| *** kiran-r has quit IRC | 02:14 | |
| *** piyanai has quit IRC | 02:15 | |
| *** ankita_wagh has quit IRC | 02:18 | |
| *** ankita_wagh has joined #openstack-keystone | 02:19 | |
| *** Ephur_ has quit IRC | 02:19 | |
| jamielennox | stevemar, morganfainberg: want to have a look at two simple ones for me https://review.openstack.org/#/c/193422/ and follow up | 02:28 |
| *** tqtran has quit IRC | 02:28 | |
| *** tobe has joined #openstack-keystone | 02:29 | |
| stevemar | oh thats neat | 02:30 |
| morganfainberg | jamielennox: slick | 02:32 |
| jamielennox | godamn it - that's not what i wanted to show you | 02:32 |
| *** juvenn has joined #openstack-keystone | 02:32 | |
| morganfainberg | lol | 02:33 |
| jamielennox | https://review.openstack.org/#/c/196949/2 | 02:33 |
| morganfainberg | ahaha | 02:33 |
| jamielennox | that and follow up is simple | 02:33 |
| morganfainberg | that is a bit different yah | 02:33 |
| jamielennox | the glane one is about as good as it can be without a lot of refactoring | 02:34 |
| jamielennox | (that i don't want to do) | 02:34 |
| *** Kennan has quit IRC | 02:38 | |
| *** Kennan has joined #openstack-keystone | 02:38 | |
| *** spandhe has quit IRC | 02:41 | |
| *** gyee has quit IRC | 02:52 | |
| *** fangzhou has quit IRC | 02:54 | |
| *** piyanai has joined #openstack-keystone | 02:59 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Create a simple base class from AuthProtocol https://review.openstack.org/180816 | 02:59 |
| *** ankita_wagh has quit IRC | 03:01 | |
| *** richm has quit IRC | 03:20 | |
| *** zzzeek has joined #openstack-keystone | 03:26 | |
| *** zzzeek has quit IRC | 03:26 | |
| *** htruta_ has quit IRC | 03:28 | |
| *** jecarey has joined #openstack-keystone | 03:43 | |
| *** mabrams has joined #openstack-keystone | 03:45 | |
| *** diazjf has joined #openstack-keystone | 03:45 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 03:55 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Generate new config options for oslo.cache https://review.openstack.org/196700 | 03:55 |
| *** stevemar has quit IRC | 04:00 | |
| *** stevemar has joined #openstack-keystone | 04:01 | |
| *** ankita_wagh has joined #openstack-keystone | 04:02 | |
| *** dims_ has quit IRC | 04:03 | |
| *** lhcheng has joined #openstack-keystone | 04:03 | |
| *** ChanServ sets mode: +v lhcheng | 04:03 | |
| *** juvenn has quit IRC | 04:06 | |
| *** juvenn has joined #openstack-keystone | 04:06 | |
| *** davechen has quit IRC | 04:07 | |
| *** davechen has joined #openstack-keystone | 04:08 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Add user_token and service_token to request https://review.openstack.org/196949 | 04:17 |
| *** davechen1 has joined #openstack-keystone | 04:17 | |
| *** davechen has quit IRC | 04:18 | |
| *** davechen has joined #openstack-keystone | 04:20 | |
| *** jecarey has quit IRC | 04:21 | |
| *** davechen1 has quit IRC | 04:22 | |
| *** morganfainberg is now known as caerbannograbbit | 04:24 | |
| *** caerbannograbbit is now known as CaerbannogRabbit | 04:24 | |
| *** tobe has quit IRC | 04:26 | |
| CaerbannogRabbit | jamielennox: +a on that one btw. | 04:27 |
| jamielennox | CaerbannogRabbit: oh, seet | 04:28 |
| jamielennox | sweet | 04:28 |
| jamielennox | CaerbannogRabbit: https://review.openstack.org/#/c/196950/ is almost exactly the same if you have a minute | 04:28 |
| CaerbannogRabbit | maaaaybe | 04:29 |
| *** piyanai has quit IRC | 04:31 | |
| *** henrynash has joined #openstack-keystone | 04:36 | |
| *** ChanServ sets mode: +v henrynash | 04:36 | |
| *** browne1 has joined #openstack-keystone | 04:40 | |
| *** browne has quit IRC | 04:40 | |
| *** kiran-r has joined #openstack-keystone | 04:41 | |
| *** hrou has quit IRC | 04:45 | |
| *** ajayaa_ has joined #openstack-keystone | 04:45 | |
| *** juvenn has quit IRC | 04:50 | |
| *** kiran-r has quit IRC | 04:56 | |
| *** kiran-r has joined #openstack-keystone | 04:56 | |
| *** ajayaa_ has quit IRC | 05:01 | |
| *** chlong has quit IRC | 05:03 | |
| *** dims has joined #openstack-keystone | 05:07 | |
| *** dims has quit IRC | 05:12 | |
| *** diazjf has left #openstack-keystone | 05:18 | |
| *** chlong has joined #openstack-keystone | 05:21 | |
| *** tobe has joined #openstack-keystone | 05:26 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Move fileutils functions to oslo.policy https://review.openstack.org/197420 | 05:27 |
| *** yottatsa has joined #openstack-keystone | 05:45 | |
| openstackgerrit | Vladimir Eremin proposed openstack/keystone-specs: Keystone slaveification spec https://review.openstack.org/197379 | 05:57 |
| *** tobe has quit IRC | 05:59 | |
| *** e0ne has joined #openstack-keystone | 05:59 | |
| *** chlong has quit IRC | 06:01 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/197428 | 06:01 |
| *** chlong has joined #openstack-keystone | 06:01 | |
| *** chenhong has joined #openstack-keystone | 06:06 | |
| *** e0ne has quit IRC | 06:11 | |
| yottatsa | stevemar, why do you need it? ) | 06:13 |
| yottatsa | I mean, config point rename | 06:13 |
| stevemar | yottatsa: ? | 06:13 |
| stevemar | oh, i'm just screwing around, testing something | 06:13 |
| yottatsa | :) | 06:13 |
| stevemar | ignore that please :) | 06:13 |
| yottatsa | BTW, can you please re-review Keystone slaveification spec https://review.openstack.org/197379 | 06:14 |
| stevemar | yottatsa: yeah, probably tomorrow, looks like a good improvement though | 06:14 |
| stevemar | i dont see any red flags | 06:14 |
| stevemar | red flags/warnings | 06:15 |
| *** gokrokve has joined #openstack-keystone | 06:16 | |
| yottatsa | Actually I've got a code patch already. Can I propose it before spec will be Merged? | 06:16 |
| stevemar | yottatsa: sure | 06:16 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/197428 | 06:17 |
| *** gokrokve has quit IRC | 06:18 | |
| *** ajayaa_ has joined #openstack-keystone | 06:19 | |
| *** chlong has quit IRC | 06:19 | |
| *** browne1 has quit IRC | 06:21 | |
| stevemar | yottatsa: i'm done screwing around now :) | 06:23 |
| yottatsa | Are you writing some kind of automation? | 06:23 |
| stevemar | yeah, trying to anyway... https://review.openstack.org/#/c/177620/ | 06:23 |
| stevemar | bed time for me! see ya | 06:28 |
| *** stevemar has quit IRC | 06:28 | |
| *** stevemar has joined #openstack-keystone | 06:28 | |
| *** stevemar has quit IRC | 06:31 | |
| *** chlong has joined #openstack-keystone | 06:33 | |
| *** ianbrown has quit IRC | 06:35 | |
| *** arunkant__ has joined #openstack-keystone | 06:35 | |
| *** arunkant_ has quit IRC | 06:38 | |
| yottatsa | stevemar see ya! | 06:39 |
| *** arunkant_ has joined #openstack-keystone | 06:43 | |
| *** lhcheng has quit IRC | 06:44 | |
| *** arunkant__ has quit IRC | 06:47 | |
| *** juvenn has joined #openstack-keystone | 06:48 | |
| *** ankita_wagh has quit IRC | 06:49 | |
| *** henrynash has quit IRC | 06:53 | |
| *** tobe has joined #openstack-keystone | 06:53 | |
| *** belmoreira has joined #openstack-keystone | 06:54 | |
| *** juvenn has quit IRC | 06:55 | |
| *** chenhong has quit IRC | 06:56 | |
| *** chenhong has joined #openstack-keystone | 06:57 | |
| *** lufix has joined #openstack-keystone | 06:57 | |
| *** pawel_ has joined #openstack-keystone | 07:09 | |
| *** abhishekk has joined #openstack-keystone | 07:12 | |
| *** chlong has quit IRC | 07:24 | |
| yottatsa | Just found out thah "EngineFacade is deprecated. Please use oslo.db.sqlalchemy.enginefacade for new development". Does anybody plan to rewrite keystone/common/sql/core.py onto new API? | 07:31 |
| openstackgerrit | Vladimir Eremin proposed openstack/keystone: Keystone slaveification spec https://review.openstack.org/197455 | 07:43 |
| openstackgerrit | Vladimir Eremin proposed openstack/keystone: Keystone slaveification https://review.openstack.org/197455 | 07:44 |
| *** jistr has joined #openstack-keystone | 07:45 | |
| *** yottatsa has quit IRC | 07:49 | |
| *** kiran-r has quit IRC | 07:52 | |
| *** amaretskiy has joined #openstack-keystone | 07:54 | |
| *** e0ne has joined #openstack-keystone | 07:56 | |
| *** chenhong has quit IRC | 07:57 | |
| *** chenhong has joined #openstack-keystone | 07:57 | |
| *** afazekas is now known as __afazekas | 07:59 | |
| *** arunkant__ has joined #openstack-keystone | 08:07 | |
| *** fhubik has joined #openstack-keystone | 08:11 | |
| *** arunkant_ has quit IRC | 08:11 | |
| *** yottatsa has joined #openstack-keystone | 08:11 | |
| *** chenhong has quit IRC | 08:12 | |
| *** chenhong has joined #openstack-keystone | 08:12 | |
| breton | folks, I would highly appreciate if you review https://review.openstack.org/#/c/190863/ | 08:19 |
| *** __afazekas is now known as afazekas | 08:20 | |
| *** chenhong has quit IRC | 08:23 | |
| *** chenhong has joined #openstack-keystone | 08:23 | |
| davechen | breton: seems no cores is still online and the author Deepti is not here too. | 08:26 |
| davechen | It's a good patch, especially, as to the performance improvement. | 08:28 |
| breton | ++ | 08:29 |
| *** dguerri` is now known as dguerri | 08:29 | |
| breton | that's why I really-really want it in and maybe backported to kilo | 08:29 |
| *** diabloneo has joined #openstack-keystone | 08:29 | |
| *** lsmola has joined #openstack-keystone | 08:29 | |
| *** chenhong has quit IRC | 08:30 | |
| *** stevemar has joined #openstack-keystone | 08:30 | |
| *** lhcheng has joined #openstack-keystone | 08:33 | |
| *** ChanServ sets mode: +v lhcheng | 08:33 | |
| *** stevemar has quit IRC | 08:34 | |
| *** e0ne is now known as e0ne_ | 08:36 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: OS-FEDERATION no longer extension in docs https://review.openstack.org/192671 | 08:36 |
| *** juvenn has joined #openstack-keystone | 08:38 | |
| *** lhcheng has quit IRC | 08:38 | |
| *** e0ne_ is now known as e0ne | 08:38 | |
| *** rdo has quit IRC | 08:39 | |
| *** dguerri is now known as dguerri` | 08:41 | |
| *** rdo has joined #openstack-keystone | 08:41 | |
| *** e0ne has quit IRC | 08:41 | |
| *** lhcheng has joined #openstack-keystone | 08:45 | |
| *** ChanServ sets mode: +v lhcheng | 08:45 | |
| *** aix has joined #openstack-keystone | 08:48 | |
| *** afazekas is now known as __afazekas | 08:50 | |
| *** dims has joined #openstack-keystone | 09:08 | |
| *** dims has quit IRC | 09:14 | |
| *** BrAsS_mOnKeY has quit IRC | 09:21 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 09:22 | |
| *** afazekas has joined #openstack-keystone | 09:24 | |
| *** BrAsS_mOnKeY has quit IRC | 09:26 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 09:27 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Show friendly message when request body is not provided https://review.openstack.org/195429 | 09:30 |
| *** aix has quit IRC | 09:31 | |
| davechen | marekd: thanks a lot. ;-) | 09:31 |
| *** fhubik is now known as fhubik_afk | 09:32 | |
| marekd | davechen: for? :-) | 09:32 |
| davechen | marekd: there are a lot of work around that bugs. | 09:32 |
| davechen | ah, you just help ot rebase my patch, you forgot? too fast. | 09:32 |
| marekd | ah, yes. | 09:32 |
| marekd | davechen: i saw few of your patches, so didn't remember which you could mention. | 09:33 |
| davechen | marekd: haha, they need cores's reviews. | 09:33 |
| marekd | davechen: what's the difference between https://review.openstack.org/#/c/195001/5 and next one? They seem to have exactly the same commit title. | 09:33 |
| davechen | marekd: this one is trying to close the bug reported by someone. | 09:34 |
| davechen | but after looking into that bug, I found a lot of entities in keystone has the same issue. | 09:34 |
| davechen | so, i just registered a blanket bug in LP. | 09:34 |
| davechen | and all of the rest go to that bug instead. | 09:35 |
| *** e0ne has joined #openstack-keystone | 09:35 | |
| *** fhubik_afk is now known as fhubik | 09:35 | |
| davechen | the commit message is the same but the desc is a little different. | 09:35 |
| davechen | I am going to differentiate a little bit about the commit message in the following patch. | 09:36 |
| davechen | marekd: seems you are not in US or Europe? | 09:36 |
| marekd | I am in Europe | 09:37 |
| marekd | in Switzerland. | 09:37 |
| marekd | why would you think I am not in Europe? It's freaking hot middle of my work day. | 09:37 |
| davechen | what's your time, I am a little scared, must be deep in light or early in the morning. | 09:37 |
| marekd | :-) | 09:37 |
| marekd | 11.37 AM | 09:38 |
| davechen | not a bad time, :) | 09:38 |
| marekd | not at all | 09:38 |
| davechen | great, so I can catch you in this timeslot. | 09:38 |
| marekd | sure! | 09:38 |
| marekd | i feel lonely here | 09:39 |
| davechen | why? better than me | 09:39 |
| marekd | why? | 09:39 |
| *** yottatsa has quit IRC | 09:40 | |
| davechen | But time difference. | 09:40 |
| davechen | bad* | 09:40 |
| davechen | have a good day, I am going to take shuttle and back home. | 09:41 |
| marekd | davechen: thanks, you too. | 09:41 |
| davechen | ;-) | 09:41 |
| *** davechen has left #openstack-keystone | 09:42 | |
| *** bradjones has quit IRC | 09:44 | |
| *** bradjones has joined #openstack-keystone | 09:46 | |
| *** bradjones has quit IRC | 09:46 | |
| *** bradjones has joined #openstack-keystone | 09:46 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/197254 | 09:56 |
| *** aix has joined #openstack-keystone | 09:58 | |
| *** dims has joined #openstack-keystone | 09:59 | |
| *** lhcheng has quit IRC | 10:06 | |
| *** stevemar has joined #openstack-keystone | 10:19 | |
| *** stevemar has quit IRC | 10:22 | |
| *** fhubik is now known as fhubik_afk | 10:34 | |
| *** diabloneo has quit IRC | 10:36 | |
| *** e0ne is now known as e0ne_ | 10:39 | |
| *** e0ne_ is now known as e0ne | 10:39 | |
| *** mabrams has left #openstack-keystone | 10:45 | |
| *** mabrams has joined #openstack-keystone | 10:45 | |
| *** mabrams has left #openstack-keystone | 10:46 | |
| *** abhishekk has quit IRC | 11:11 | |
| *** abhishekk has joined #openstack-keystone | 11:12 | |
| samueldmq | morning | 11:14 |
| samueldmq | dstanek: hi, you around ? | 11:14 |
| *** yottatsa has joined #openstack-keystone | 11:16 | |
| *** fhubik_afk is now known as fhubik | 11:17 | |
| *** fhubik is now known as fhubik_afk | 11:18 | |
| *** ajayaa_ has quit IRC | 11:23 | |
| *** e0ne is now known as e0ne_ | 11:24 | |
| *** e0ne_ is now known as e0ne | 11:24 | |
| *** yottatsa has quit IRC | 11:29 | |
| *** juvenn has quit IRC | 11:32 | |
| *** yottatsa has joined #openstack-keystone | 11:35 | |
| *** ajayaa_ has joined #openstack-keystone | 11:39 | |
| *** fhubik_afk is now known as fhubik | 11:41 | |
| *** tobe has quit IRC | 11:46 | |
| *** piyanai has joined #openstack-keystone | 11:47 | |
| *** arunkant_ has joined #openstack-keystone | 11:51 | |
| *** arunkant has joined #openstack-keystone | 11:54 | |
| *** arunkant__ has quit IRC | 11:54 | |
| *** jaosorior has joined #openstack-keystone | 11:56 | |
| *** arunkant_ has quit IRC | 11:57 | |
| *** fhubik is now known as fhubik_afk | 12:11 | |
| *** markvoelker has quit IRC | 12:14 | |
| *** markvoelker has joined #openstack-keystone | 12:14 | |
| dstanek | samueldmq: yes | 12:15 |
| samueldmq | dstanek: hey, I was looking at the domain-specific backends feature | 12:16 |
| samueldmq | dstanek: and confirmed that we don't support multiple SQL connections in there | 12:16 |
| *** yottatsa has quit IRC | 12:17 | |
| samueldmq | dstanek: would it be that hard to instantiate multiple Engine objects from sqlalchemy and manage them ? | 12:17 |
| *** raginbajin has quit IRC | 12:18 | |
| *** yottatsa has joined #openstack-keystone | 12:18 | |
| *** kiran-r has joined #openstack-keystone | 12:18 | |
| *** raginbajin has joined #openstack-keystone | 12:19 | |
| samueldmq | dstanek: actually I should've asked first if you're familiar with that code/feature :-) | 12:20 |
| *** radez_g0n3 is now known as radez | 12:21 | |
| amaretskiy | Hi all! Can someone review https://review.openstack.org/#/c/188457/ :) | 12:23 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/196485 | 12:24 |
| dstanek | samueldmq: there is actually a proposal somewhere for that; i don't think it's terribly hard (but not easy), but does start to get operationally tricky too | 12:25 |
| samueldmq | dstanek: great. I'll search for bps or specs on that | 12:27 |
| samueldmq | dstanek: with reseller that feature becomes still more important | 12:27 |
| samueldmq | dstanek: thanks | 12:27 |
| *** zigo has quit IRC | 12:28 | |
| *** zigo has joined #openstack-keystone | 12:29 | |
| *** csoukup has joined #openstack-keystone | 12:32 | |
| *** kiran-r has quit IRC | 12:32 | |
| *** edmondsw has joined #openstack-keystone | 12:32 | |
| *** tellesnobrega_ has joined #openstack-keystone | 12:40 | |
| *** e0ne is now known as e0ne_ | 12:41 | |
| *** e0ne_ is now known as e0ne | 12:42 | |
| *** bknudson has joined #openstack-keystone | 12:45 | |
| *** ChanServ sets mode: +v bknudson | 12:45 | |
| *** tellesnobrega__ has joined #openstack-keystone | 12:47 | |
| *** tellesnobrega_ has quit IRC | 12:49 | |
| *** jasondotstar has joined #openstack-keystone | 12:51 | |
| *** e0ne is now known as e0ne_ | 12:53 | |
| *** tellesnobrega__ has quit IRC | 12:55 | |
| *** Ctina__ has joined #openstack-keystone | 12:56 | |
| *** e0ne_ is now known as e0ne | 12:57 | |
| *** jsavak has joined #openstack-keystone | 12:57 | |
| *** jecarey has joined #openstack-keystone | 13:00 | |
| *** radez is now known as radez_g0n3 | 13:06 | |
| openstackgerrit | Vladimir Eremin proposed openstack/keystone: Keystone slaveification https://review.openstack.org/197455 | 13:09 |
| *** woodster_ has joined #openstack-keystone | 13:11 | |
| *** stevemar has joined #openstack-keystone | 13:12 | |
| *** Ephur has joined #openstack-keystone | 13:13 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: OS-FEDERATION no longer extension in docs https://review.openstack.org/192671 | 13:14 |
| marekd | bknudson: i fixed you comments, can you re +2 ? | 13:14 |
| *** trey has joined #openstack-keystone | 13:14 | |
| *** jsavak has quit IRC | 13:20 | |
| *** jsavak has joined #openstack-keystone | 13:22 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 13:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v3_token() https://review.openstack.org/196774 | 13:26 |
| *** topol has joined #openstack-keystone | 13:27 | |
| *** ChanServ sets mode: +v topol | 13:27 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 13:27 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v3_token() https://review.openstack.org/196774 | 13:27 |
| *** stevemar has quit IRC | 13:27 | |
| *** browne has joined #openstack-keystone | 13:28 | |
| lbragstad | bknudson: do you know what happened with the timeutils strtime() issue? http://cdn.pasteraw.com/i3j45fhbtv6i0mgxupxb1xvy6jzkggb | 13:31 |
| lbragstad | bknudson: I remember seeing a commit you had that undeprecated it? | 13:32 |
| bknudson | lbragstad: the fix is https://review.openstack.org/#/c/196842/ | 13:32 |
| *** richm has joined #openstack-keystone | 13:33 | |
| *** dsirrine_ has quit IRC | 13:33 | |
| jdandrea | bknudson: Is the Introduction to this out of date as well? It doesn't mention sessions until the second section. http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html | 13:34 |
| jdandrea | If so, np - want to make sure I have my v3 ducks in order. :) | 13:34 |
| bknudson | jdandrea: it is out of date. | 13:35 |
| jdandrea | ok, thx | 13:35 |
| *** jsavak has quit IRC | 13:36 | |
| *** jsavak has joined #openstack-keystone | 13:36 | |
| *** abhishekk has quit IRC | 13:38 | |
| samueldmq | dstanek: I am working on the 'policy by url' spec now | 13:43 |
| samueldmq | dstanek: there is an interesting comment from you there | 13:43 |
| *** trey has quit IRC | 13:43 | |
| samueldmq | dstanek: let me know when you have some time to have a quick discussion on that | 13:43 |
| *** Ctina__ is now known as ctina | 13:43 | |
| samueldmq | dstanek: "s the URL just an arbitrary decision? Couldn't a deployer configure the url as 'rax-iad-compute' and then use that as the URL when storing the policy? Also, where is the URL configured?" | 13:44 |
| *** dsirrine_ has joined #openstack-keystone | 13:45 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Maintain the expiry of v2 fernet tokens https://review.openstack.org/196475 | 13:49 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Do not require the token_id for converting v3 to v2 tokens https://review.openstack.org/196476 | 13:50 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: When validating a V3 token as V2, use the v3_to_v2 conversion https://review.openstack.org/196483 | 13:50 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Convert issue_v2_token to always issue a v3_token and convert https://review.openstack.org/196548 | 13:50 |
| *** arunkant_ has joined #openstack-keystone | 13:50 | |
| *** radez_g0n3 is now known as radez | 13:50 | |
| *** arunkant__ has joined #openstack-keystone | 13:52 | |
| dstanek | samueldmq: yessir, i did write that. even if it is arbitrary we should say that. making it a URL and not saying "it really doesn't matter what it is", I think, will make it difficult for a deployer since services may have multiple URLs pointing to them. which one do they pick? | 13:53 |
| dstanek | if it's arbitrary it doesn't matter which one | 13:53 |
| *** arunkant has quit IRC | 13:54 | |
| *** arunkant_ has quit IRC | 13:55 | |
| *** gokrokve has joined #openstack-keystone | 13:56 | |
| *** jsavak has quit IRC | 13:56 | |
| *** zzzeek has joined #openstack-keystone | 13:56 | |
| samueldmq | dstanek: that should be an URL exisitng in the service catalog | 13:57 |
| samueldmq | dstanek: I think we should be able to do taht somehow | 13:57 |
| *** fhubik_afk is now known as fhubik | 13:57 | |
| samueldmq | dstanek: what I'd like to talk to you was the REST aspects of those APIs, as I see some alternatives | 13:58 |
| *** kiran-r has joined #openstack-keystone | 13:58 | |
| samueldmq | dstanek: the challenge is : how do we associate a policy entity to an endpoint ? | 13:59 |
| samueldmq | dstanek: I see some available options: | 13:59 |
| *** dims has quit IRC | 13:59 | |
| samueldmq | dstanek: i) we could make the policy id a hash of the endpoint_url, so it would be easier to, for example, add a policy per project association, as we allow custom ids | 14:00 |
| samueldmq | but I don't think it is REST, it may be being too flexible | 14:00 |
| *** dims has joined #openstack-keystone | 14:00 | |
| *** jsavak has joined #openstack-keystone | 14:01 | |
| samueldmq | dstanek: ii) we could create endpoint_url, service_id/type, region_id as attributes of policy entity | 14:01 |
| *** jsavak has quit IRC | 14:02 | |
| samueldmq | dstanek: iii) or simply create an attribute called 'target', that would contain filters, that could be one of the above .. as we have for endpoint group filters | 14:02 |
| samueldmq | i.e a policy is a resource that is owned/applies to a set of targets, identified by the filters defined in its 'target' attribute | 14:03 |
| samueldmq | dstanek: or iv) make associations via REST (kind of what we have today).. /policies/<policy_id>/endpoints/<endpoint_id> | 14:04 |
| samueldmq | this one is very REST, but not sure how we can fit the url in there | 14:04 |
| samueldmq | that's all ... sorry I said it was quick :( | 14:04 |
| *** mylu has joined #openstack-keystone | 14:05 | |
| *** Ephur has quit IRC | 14:07 | |
| *** kiran-r has quit IRC | 14:07 | |
| *** e0ne is now known as e0ne_ | 14:08 | |
| *** piyanai has quit IRC | 14:09 | |
| *** raildo has quit IRC | 14:12 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:12 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/196485 | 14:13 |
| *** kiran-r has joined #openstack-keystone | 14:14 | |
| *** piyanai has joined #openstack-keystone | 14:15 | |
| *** piyanai has quit IRC | 14:15 | |
| *** raildo has joined #openstack-keystone | 14:15 | |
| *** mylu has quit IRC | 14:22 | |
| *** dguerri` is now known as dguerri | 14:22 | |
| *** stevemar has joined #openstack-keystone | 14:28 | |
| *** mylu has joined #openstack-keystone | 14:31 | |
| *** stevemar has quit IRC | 14:32 | |
| *** mylu has quit IRC | 14:35 | |
| *** hrou has joined #openstack-keystone | 14:39 | |
| *** darrenc_ has joined #openstack-keystone | 14:39 | |
| *** kiran-r has quit IRC | 14:40 | |
| *** serverascode_ has joined #openstack-keystone | 14:41 | |
| *** breton_ has joined #openstack-keystone | 14:41 | |
| *** devanand1 has joined #openstack-keystone | 14:41 | |
| *** gordc_af1 has joined #openstack-keystone | 14:41 | |
| *** Nakato_ has joined #openstack-keystone | 14:41 | |
| *** radez` has joined #openstack-keystone | 14:45 | |
| *** mtreinish_ has joined #openstack-keystone | 14:45 | |
| *** EmilienM_ has joined #openstack-keystone | 14:45 | |
| *** dguerri_ has joined #openstack-keystone | 14:45 | |
| *** rharwood_ has joined #openstack-keystone | 14:45 | |
| *** mtreinish has quit IRC | 14:46 | |
| *** rushiagr_away has quit IRC | 14:46 | |
| *** gordc_afk has quit IRC | 14:46 | |
| *** mancdaz has quit IRC | 14:46 | |
| *** EmilienM has quit IRC | 14:46 | |
| *** radez has quit IRC | 14:46 | |
| *** rharwood has quit IRC | 14:46 | |
| *** dguerri has quit IRC | 14:46 | |
| *** serverascode has quit IRC | 14:46 | |
| *** devananda has quit IRC | 14:46 | |
| *** Nakato has quit IRC | 14:46 | |
| *** darrenc has quit IRC | 14:46 | |
| *** breton has quit IRC | 14:46 | |
| *** timburke has quit IRC | 14:46 | |
| *** rharwood_ is now known as rharwood | 14:46 | |
| *** EmilienM_ is now known as EmilienM | 14:46 | |
| *** dguerri_ is now known as dguerri | 14:46 | |
| *** dguerri has quit IRC | 14:46 | |
| *** dguerri has joined #openstack-keystone | 14:46 | |
| *** mtreinish_ is now known as mtreinish | 14:46 | |
| *** mylu has joined #openstack-keystone | 14:46 | |
| *** diazjf has joined #openstack-keystone | 14:47 | |
| *** ayoung has joined #openstack-keystone | 14:47 | |
| *** ChanServ sets mode: +v ayoung | 14:47 | |
| *** slberger has joined #openstack-keystone | 14:48 | |
| *** timburke has joined #openstack-keystone | 14:48 | |
| *** fhubik is now known as fhubik_afk | 14:49 | |
| *** kiran-r has joined #openstack-keystone | 14:51 | |
| *** geoffarnold has joined #openstack-keystone | 14:55 | |
| *** serverascode_ is now known as serverascode | 14:56 | |
| *** geoffarnold has quit IRC | 14:57 | |
| *** geoffarnold has joined #openstack-keystone | 14:58 | |
| openstackgerrit | Vladimir Eremin proposed openstack/keystone-specs: Keystone slaveification spec https://review.openstack.org/197379 | 14:58 |
| yottatsa | amakarov_away, buddy are you here? | 14:59 |
| *** fhubik_afk is now known as fhubik | 15:01 | |
| *** devanand1 is now known as devananda | 15:01 | |
| *** ajayaa_ has quit IRC | 15:07 | |
| *** e0ne_ is now known as e0ne | 15:07 | |
| *** mancdaz has joined #openstack-keystone | 15:07 | |
| amakarov_away | yottatsa, yo! | 15:09 |
| *** amakarov_away is now known as amakarov | 15:09 | |
| yottatsa | Could you please re-review https://review.openstack.org/197379 | 15:09 |
| yottatsa | I've posted an explanation for this pretty usual case into spec. | 15:10 |
| *** belmoreira has quit IRC | 15:10 | |
| amakarov | yottatsa, my concern is about db configuration becoming messy | 15:10 |
| amakarov | yottatsa, I understand what are you proposing and see it's advantages | 15:12 |
| yottatsa | Configuration option is already exists. | 15:12 |
| amakarov | yottatsa, also I see that cloud deployment will involve more 1 specialist | 15:12 |
| amakarov | s/more 1/1 more/ | 15:13 |
| amakarov | and it troubles me | 15:13 |
| yottatsa | 1 more for what? | 15:13 |
| yottatsa | slave_connection is not a required option. Leaving it unspecified makes code works like before and it's already done in oslo.db. And it's already implemented in Nova e.g. | 15:14 |
| amakarov | if it was just database admin, not it require a DevOps too | 15:14 |
| *** piyanai has joined #openstack-keystone | 15:15 | |
| *** piyanai has quit IRC | 15:16 | |
| amakarov | yottatsa, ok, the case: I want to deploy keystone in several DC | 15:16 |
| yottatsa | amakarov, okay, which DB you're using for it? | 15:16 |
| amakarov | yottatsa, I've configured Galera | 15:16 |
| amakarov | yottatsa, let it be mysal | 15:16 |
| amakarov | mysql | 15:16 |
| amakarov | what db architecture should I use? | 15:17 |
| yottatsa | amakarov, what do you prefer without this proposal? | 15:17 |
| yottatsa | amakarov, let's pretent there is no proposal | 15:18 |
| yottatsa | so you could connect keystone to local Galera replica (connection=sql://.....@localhost), but it have some implications | 15:19 |
| *** e0ne is now known as e0ne_ | 15:19 | |
| amakarov | yottatsa, for now it's Galera in a weird mode when mysql is a master-slave cluster in the cloud and multi-master architecture across them | 15:20 |
| *** e0ne_ is now known as e0ne | 15:20 | |
| amakarov | yottatsa, agree - at least I have to wait for replications to complete | 15:20 |
| amakarov | So do I having master-slave | 15:21 |
| yottatsa | amakarov, so you could select a designated Galera node and call it master and connect to it | 15:22 |
| amakarov | The point is to have query routing configured somewhere outside of keystone | 15:22 |
| amakarov | yottatsa, +1 | 15:22 |
| yottatsa | so if you have noticeable RTT between keystone and this master, it push down the performance | 15:24 |
| yottatsa | I mean if you have no "query routing configured somewhere outside of keystone" | 15:24 |
| yottatsa | My point (and proposal) it to use already exists slave_connection to fine grained routing, because it costs us few lines of code. | 15:26 |
| *** afazekas has quit IRC | 15:26 | |
| yottatsa | *is to use | 15:26 |
| *** piyanai has joined #openstack-keystone | 15:26 | |
| CaerbannogRabbit | bknudson: I want to point out it feels liked we are going backwards with the timeutils depreciations. | 15:26 |
| * CaerbannogRabbit shrugs. | 15:26 | |
| *** jsavak has joined #openstack-keystone | 15:26 | |
| openstackgerrit | Merged openstack/keystone: OS-FEDERATION no longer extension in docs https://review.openstack.org/192671 | 15:27 |
| bknudson | CaerbannogRabbit: oslo is deprecating it, not us | 15:28 |
| *** mylu has quit IRC | 15:28 | |
| CaerbannogRabbit | bknudson: I know. I just mean we are again carrying the time code *shrug* :( | 15:29 |
| *** mylu has joined #openstack-keystone | 15:30 | |
| *** CaerbannogRabbit is now known as morganfainberg | 15:30 | |
| *** anhhuynx has joined #openstack-keystone | 15:30 | |
| amakarov | yottatsa, ok, speaking in terms of use cases: I deploy a distributed cloud with synchronized assignment storage (live example). I've cpecified master/slave connections in the keystone config. I've placed use_slave everywhere I see fit (here will be problems). And then I discover I need to direct some additional query to the slave. What should I do? | 15:30 |
| amakarov | s/cpecified/specified/ | 15:30 |
| yottatsa | what do you mean "then I discover I need to direct some additional query to the slave"? | 15:32 |
| amakarov | yottatsa, I've found a bottleneck for example | 15:32 |
| amakarov | I see, that select query is executed on a master many times per action | 15:33 |
| yottatsa | speaking of code, let's see an example https://review.openstack.org/#/c/197455/3/keystone/assignment/backends/sql.py | 15:33 |
| *** jkomg has joined #openstack-keystone | 15:33 | |
| yottatsa | I re-route read requests on slave with use_slave=True | 15:34 |
| amakarov | yottatsa, you've done it in the code | 15:35 |
| yottatsa | It's because (I quote you) " I discover I need to direct some additional query to the slave//I've found a bottleneck " on a token issuing | 15:35 |
| yottatsa | amakarov, yep. What's wrong doing it in code? | 15:35 |
| *** kfox1111_away is now known as kfox1111 | 15:35 | |
| amakarov | yottatsa, I don't want to touch the code on a production environment | 15:36 |
| *** chenhong has joined #openstack-keystone | 15:36 | |
| *** Lactem has joined #openstack-keystone | 15:36 | |
| amakarov | It was tested, checked, reviewed, approved and carved in stone | 15:36 |
| amakarov | yottatsa, I want to be able to do it in the same place I configured my database infrastructure | 15:37 |
| morganfainberg | raildo: ping | 15:37 |
| *** hrou_ has joined #openstack-keystone | 15:37 | |
| *** hrou has quit IRC | 15:37 | |
| *** lufix has quit IRC | 15:38 | |
| yottatsa | amakarov, you could use your existing infra in Fuel I guess ) | 15:38 |
| amakarov | yottatsa, routing over routing? ) | 15:38 |
| yottatsa | BTW, this code helps people who still didn't manage to make "query routing configured somewhere outside of keystone" | 15:38 |
| yottatsa | I prefer to have routing in application if application is designed to make it. | 15:39 |
| *** jasondotstar has quit IRC | 15:39 | |
| amakarov | yottatsa, let's postpone it a bit - I have a meetings scheduled | 15:40 |
| amakarov | s/meetings/meeting/ | 15:40 |
| yottatsa | cya | 15:40 |
| yottatsa | I'm off to lunch | 15:40 |
| yottatsa | amakarov, could you please mail yottatsa@yandex-team.ru (Russian maybe) | 15:41 |
| openstackgerrit | Theodore Ilie proposed openstack/keystone: Add test case for deleting endpoint with space in url https://review.openstack.org/196883 | 15:43 |
| Lactem | : ) | 15:43 |
| *** yottatsa has quit IRC | 15:43 | |
| *** piyanai has quit IRC | 15:45 | |
| *** yottatsa has joined #openstack-keystone | 15:46 | |
| *** Lactem has quit IRC | 15:48 | |
| *** ajayaa_ has joined #openstack-keystone | 15:48 | |
| *** kiran-r has quit IRC | 15:48 | |
| gsilvis | I'm working on some K2K federation stuff, and I'm a little confused. I was under the impression that I could map projects in the IdP to new projects in the SP---is this doable? | 15:49 |
| lbragstad | cc marekd ^ | 15:49 |
| *** piyanai has joined #openstack-keystone | 15:49 | |
| *** mylu has quit IRC | 15:50 | |
| *** slberger1 has joined #openstack-keystone | 15:50 | |
| *** jasondotstar has joined #openstack-keystone | 15:50 | |
| *** slberger has quit IRC | 15:51 | |
| jdandrea | For Keystone v3 I'm getting an odd error. Not finding an explanation in the docs, which I'm striving to follow (for Sessions). Thoughts appreciated! http://paste.openstack.org/show/332395/ | 15:56 |
| *** henrynash has joined #openstack-keystone | 15:57 | |
| *** ChanServ sets mode: +v henrynash | 15:57 | |
| richm | jdandrea: You need to specify a domain for your user | 15:59 |
| *** BrAsS_mOnKeY has quit IRC | 16:00 | |
| richm | jdandrea: you also need to specify either a project or a domain - not both | 16:00 |
| jdandrea | richm: domain_name='domain' doesn't do it then? | 16:00 |
| richm | jdandrea: That requests a domain scoped token | 16:00 |
| jdandrea | Ok. Is there an example in the docs that shows this? I'm getting confused by the different terminology. | 16:00 |
| richm | jdandrea: Is there a user_domain_name parameter? | 16:00 |
| richm | If so, that's what you use to specify the domain for the user | 16:00 |
| jdandrea | richm: There is. What's domain_name for then, hmm ... | 16:01 |
| richm | It is to request a domain scoped token | 16:01 |
| jdandrea | richm: Ok. I'm confused then. I probably need to find a primer on all the different params and how they're used. | 16:01 |
| richm | Basically, when you request a token, you are requesting a token in order to use that token to do something | 16:01 |
| jdandrea | I can specify user_domain_id='domain' though. | 16:02 |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 16:02 | |
| richm | yes, you can specify either the user_domain_name or user_domain_id | 16:02 |
| *** BrAsS_mOnKeY has quit IRC | 16:02 | |
| richm | Are you going to use that token to do something to an entire domain, or use that token to do something with a project inside a domain? | 16:02 |
| jdandrea | Could be one or the other, depending ... | 16:03 |
| raildo | morganfainberg, hi :) | 16:03 |
| *** mylu has joined #openstack-keystone | 16:04 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 16:04 | |
| morganfainberg | raildo: https://review.openstack.org/#/c/153007/32/api/v3/identity-api-v3.rst what is "user is not available to projects above it" | 16:04 |
| *** BrAsS_mOnKeY has quit IRC | 16:04 | |
| morganfainberg | raildo: it's not super clear in the spec. | 16:05 |
| richm | jdandrea: Then you'll have to specify either the project_id (or project_name + project_domain_name), or the domain_name or domain_id, depending on what you are going to use the token for | 16:06 |
| jdandrea | richm: Thanks! That helps. | 16:07 |
| *** jsavak has quit IRC | 16:07 | |
| jdandrea | I think the notion of domain names in general is new to me and I'm confusing it with region names and such. | 16:08 |
| *** jistr has quit IRC | 16:08 | |
| jdandrea | I see domain name and think of a FQDN. | 16:08 |
| *** shaleh has joined #openstack-keystone | 16:09 | |
| raildo | I didn't find this in the link, but what I remember during the reseller discussion is, by default, a user in a high level domain is not visible in the hierarchy. we need to grant a role for then in the subprojects | 16:10 |
| raildo | morganfainberg, ^ | 16:10 |
| *** yottatsa has quit IRC | 16:10 | |
| raildo | morganfainberg, "not available" is very strong, I don't think that is the best way to describe the behaviour, maybe I can add some about it in the API spec | 16:12 |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 16:12 | |
| morganfainberg | That would be good. | 16:12 |
| raildo | morganfainberg, sure | 16:12 |
| morganfainberg | It's uhmm. Add | 16:13 |
| *** jsavak has joined #openstack-keystone | 16:13 | |
| morganfainberg | Sec* | 16:13 |
| jdandrea | richm: Tried it. I'm told the request requires AuthN but I gave it creds. Hmm. I followed http://docs.openstack.org/developer/python-keystoneclient/using-sessions.html (Sessions for Users) but did *not* set verify (not sure where the ca.cert would be). | 16:13 |
| jdandrea | Will keep hacking. | 16:13 |
| morganfainberg | raildo: not accessible | 16:13 |
| morganfainberg | Rail do around line 861 | 16:14 |
| morganfainberg | raildo: ^^ | 16:14 |
| *** jsavak has quit IRC | 16:14 | |
| *** dima__ has joined #openstack-keystone | 16:14 | |
| *** Lactem has joined #openstack-keystone | 16:15 | |
| ayoung | morganfainberg, I've been thinking about specs, and how to fix the process. What I really thin we need is an online editor, where people can propose changes, the owner accepts or rejects changes, and then we vote on accepting them at the weekly meeting | 16:18 |
| raildo | morganfainberg, I founded. ah, it's other argument. We think that a user created in a sub project.is_domain=true, can't have a role assignment in a parent project | 16:18 |
| raildo | morganfainberg, makes sense? | 16:18 |
| ayoung | Seems only Google docs has come up as tool that supports that. I'll keep looking | 16:18 |
| *** mylu has quit IRC | 16:18 | |
| bknudson | Microsoft Word and email | 16:19 |
| bknudson | he he | 16:19 |
| morganfainberg | ayoung: I'm about to just say we use bugs in LP. Having a separate tool is going to run into the same issues really. | 16:19 |
| *** kiran-r has joined #openstack-keystone | 16:19 | |
| ayoung | morganfainberg, I would support you wholheartedly. | 16:19 |
| *** _kiran_ has joined #openstack-keystone | 16:19 | |
| *** _kiran_ has quit IRC | 16:19 | |
| morganfainberg | ayoung: there is only one concern and I think we can solve it. The notion of "approved" | 16:19 |
| morganfainberg | Trying to figure that detail out. | 16:20 |
| *** mylu has joined #openstack-keystone | 16:20 | |
| ayoung | morganfainberg, wouldn't that be "Triaged" | 16:21 |
| morganfainberg | Won't change API spec changes. But that is fine. | 16:21 |
| morganfainberg | ayoung: soft of. That field is shared with "in progress" so you need to look at the history or guess about approval. | 16:21 |
| *** spandhe has joined #openstack-keystone | 16:21 | |
| morganfainberg | Especially if there is POC code proposed. | 16:22 |
| *** ajayaa_ has quit IRC | 16:22 | |
| *** ajayaa has joined #openstack-keystone | 16:22 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 16:22 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v3_token() https://review.openstack.org/196774 | 16:22 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v2_token() https://review.openstack.org/197647 | 16:22 |
| morganfainberg | And we need to go back through all bugs and mark specs as wishlist / add "rfe" in the title. Finally anything that isn't a feature moves to low prio. The "approved" part is the only thing that has me stumped. | 16:23 |
| morganfainberg | And not sure how important that is. | 16:23 |
| *** gyee has joined #openstack-keystone | 16:24 | |
| *** ChanServ sets mode: +v gyee | 16:24 | |
| *** chenhong has quit IRC | 16:26 | |
| *** rushiagr_away has joined #openstack-keystone | 16:26 | |
| ayoung | morganfainberg, I think collaborative editing is still important for big features, but I would prefer it if we put that energy into something that had a lifespan after the feature was released | 16:26 |
| morganfainberg | Maybe there is another LP setting I can tweak for this. I'll go poke at it today. | 16:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add unit test for fernet provider https://review.openstack.org/197649 | 16:26 |
| ayoung | and that was more of a living document | 16:26 |
| morganfainberg | The API spec is still that. | 16:27 |
| morganfainberg | And anything broader wiki (like the dynamic policy) | 16:27 |
| gsilvis | Is there a guide somewhere for what exactly mapping rules can look like? The API docs I've found don't really explain it | 16:28 |
| morganfainberg | ayoung: and the docs. | 16:28 |
| *** jk|osx has joined #openstack-keystone | 16:28 | |
| openstackgerrit | Hans Feldt proposed openstack/keystone: Fix LDAP group filter https://review.openstack.org/197650 | 16:28 |
| ayoung | morganfainberg, I want Wiki-with-approval | 16:29 |
| *** jkomg has quit IRC | 16:31 | |
| morganfainberg | ayoung: ask -infra and the foundation about that. I don't know about our wiki tools but some wikis can support that. | 16:31 |
| *** amaretskiy has quit IRC | 16:32 | |
| *** tqtran has joined #openstack-keystone | 16:33 | |
| ayoung | morganfainberg, actually, what I really want is Etherpad+approval | 16:33 |
| ayoung | but wiki would probably work | 16:34 |
| morganfainberg | Let's not try and wedge that into the awful node app :P | 16:34 |
| ayoung | Heh | 16:34 |
| ayoung | Nah, I'll look around and see if there is something that makes sense. Won't happen today | 16:34 |
| *** vilobhmm has joined #openstack-keystone | 16:35 | |
| ayoung | I like the git aspect of specs, just wish it were more of a collaborative effort | 16:35 |
| *** geoffarnold has quit IRC | 16:35 | |
| ayoung | It would almost make sense for it to continue to be a git repo, but with a pull request approach, so you can conitnue to work in your home editor, but you can't make "comments" instead you offer your interpretation | 16:36 |
| ayoung | like fixing nits and the like | 16:36 |
| *** diazjf has quit IRC | 16:36 | |
| ayoung | I think that the gerrit approval is not what we want | 16:36 |
| ayoung | it should be a core vote instead | 16:36 |
| ayoung | that way, you don't have the case of "I can't approve this, because I wrote it" | 16:37 |
| ayoung | and it puts the onus on the cores to actually understand the specs.... | 16:37 |
| *** diazjf has joined #openstack-keystone | 16:40 | |
| morganfainberg | ayoung: Git (strictly as a versioning) is fine. It's all the other tooling around got that makes it bad for specs. | 16:43 |
| morganfainberg | And merging / conflict resolution tips it away from good. | 16:43 |
| *** piyanai has quit IRC | 16:43 | |
| *** piyanai has joined #openstack-keystone | 16:43 | |
| ayoung | morganfainberg, exactly. | 16:44 |
| *** geoffarnold has joined #openstack-keystone | 16:44 | |
| *** piyanai has quit IRC | 16:44 | |
| morganfainberg | Honestly... Most bug trackers get this right. | 16:44 |
| ayoung | morganfainberg, although I think that doing merging by hand for these kinds of docs would be trivial upon conflict. | 16:44 |
| morganfainberg | Just LP has a few glaring gaps and we can't fix that. | 16:44 |
| ayoung | morganfainberg, I do like the idea that we track everything with the bug tracker | 16:45 |
| ayoung | Bugzilla is a PITA too | 16:45 |
| *** csoukup has quit IRC | 16:45 | |
| ayoung | morganfainberg, but, take https://review.openstack.org/#/c/192422/2/specs/backlog/policy-by-url.rst,cm | 16:45 |
| morganfainberg | Sure. But one tool does what we need. Then. It is tracking work. | 16:46 |
| ayoung | most of dstanek 's comments are just capitalization etc, and those should just be made in the doc. Contrast that with david8hu 's request that we make it per project, which is "out of scope" | 16:46 |
| ayoung | I would be fine with dropping the Blueprint app. | 16:47 |
| *** piyanai has joined #openstack-keystone | 16:48 | |
| morganfainberg | I like the bugs because conversation can be preserved. Examples uploaded. | 16:49 |
| morganfainberg | And the description title can be edited. | 16:49 |
| *** lhcheng has joined #openstack-keystone | 16:51 | |
| *** ChanServ sets mode: +v lhcheng | 16:51 | |
| *** roxanaghe has joined #openstack-keystone | 16:52 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Policy by URL https://review.openstack.org/192422 | 16:53 |
| ayoung | morganfainberg, we are planning on merging identity-api-v3-os-endpoint-policy.rst into the core API, or leave it in an extension? I need to know where to add the API for ^^ | 16:54 |
| *** aix has quit IRC | 16:55 | |
| *** belmoreira has joined #openstack-keystone | 16:55 | |
| *** mylu has quit IRC | 16:58 | |
| *** mylu has joined #openstack-keystone | 16:59 | |
| *** piyanai has quit IRC | 16:59 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain in token response https://review.openstack.org/197331 | 17:00 |
| *** hrou_ has quit IRC | 17:01 | |
| *** browne has quit IRC | 17:02 | |
| *** piyanai has joined #openstack-keystone | 17:03 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:04 | |
| morganfainberg | ayoung: no extensions. | 17:04 |
| morganfainberg | Please don't bring them back ;) | 17:04 |
| *** breton_ is now known as breton | 17:04 | |
| ayoung | morganfainberg, so what are we doing about the API docs? | 17:04 |
| openstackgerrit | Roxana Gherle proposed openstack/python-keystoneclient: Change default endpoint type for Keystone v3 to 'public' https://review.openstack.org/185200 | 17:04 |
| morganfainberg | Slowly updating things. | 17:04 |
| *** mylu has quit IRC | 17:05 | |
| morganfainberg | Things are being made core. But we can't change the urls | 17:05 |
| morganfainberg | We can say this is holdover from the past. | 17:05 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3-os-endpoint-policy.rst has the term "Extension" in there. Should we at least modify the API specs | 17:05 |
| morganfainberg | And it's on/there by default | 17:05 |
| morganfainberg | Yes. It's a slow migrate to remove it. It's happened elsewhere (federation) | 17:05 |
| ayoung | morganfainberg, cuz there is no version in there for the extension | 17:05 |
| bknudson | we should provide the new url along with the old url | 17:06 |
| *** mylu has joined #openstack-keystone | 17:06 | |
| morganfainberg | bknudson: yes. We should. | 17:06 |
| ayoung | and this would be a rev of identity-api-v3-os-endpoint-policy.rst | 17:06 |
| morganfainberg | ayoung: backlog moving the extension to core | 17:06 |
| ayoung | this is starting to get microversioning | 17:06 |
| *** lhcheng has quit IRC | 17:06 | |
| morganfainberg | Leave it where it is. | 17:06 |
| *** kiran-r has quit IRC | 17:07 | |
| morganfainberg | We can't micoversion until flask | 17:07 |
| ayoung | morganfainberg, what about the API changes for policy_by_url | 17:07 |
| *** lhcheng has joined #openstack-keystone | 17:07 | |
| *** ChanServ sets mode: +v lhcheng | 17:07 | |
| *** henrynash has quit IRC | 17:07 | |
| morganfainberg | If it makes sense leaving it in the same place as other things do that | 17:08 |
| *** mylu has quit IRC | 17:08 | |
| morganfainberg | We will eventually get everything moved to core. | 17:08 |
| morganfainberg | It was always planned to be a slow migrate because t is a lot of work. | 17:08 |
| *** mylu has joined #openstack-keystone | 17:08 | |
| ayoung | morganfainberg, dream on here; what would be the "right" solution for updating something that is today an extension | 17:09 |
| ayoung | is it "merge extension into core first" | 17:10 |
| *** vilobhmm has quit IRC | 17:10 | |
| ayoung | and then rev the API | 17:10 |
| morganfainberg | I'd prefer to merge it to core first | 17:10 |
| morganfainberg | But if I can't have that I'll take the inverse | 17:10 |
| ayoung | morganfainberg, can it stay in its own document | 17:10 |
| *** vilobhmm has joined #openstack-keystone | 17:10 | |
| *** mylu has quit IRC | 17:10 | |
| *** mylu has joined #openstack-keystone | 17:10 | |
| ayoung | and we just update the main document to point to the current extension doc? | 17:11 |
| morganfainberg | It can stay as its own document. We could make each subsystem its own document if we wanted. | 17:11 |
| morganfainberg | I think that is fine | 17:11 |
| *** dguerri is now known as dguerri` | 17:11 | |
| morganfainberg | Point the main doc at the separate doc. We might want to split documents out a bit anyway to make it easier to read / manage long term. | 17:11 |
| samueldmq | btw I have something to discuss on the policy by endpoint URL thing ... ayoung | 17:12 |
| *** geoffarnold has quit IRC | 17:13 | |
| samueldmq | ayoung: see http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2015-07-01.log.html#t2015-07-01T13:59:17 | 17:13 |
| amakarov | morganfainberg, ayoung: greetings! I see you have different opinion on resolving group role revocation issue: https://review.openstack.org/#/c/141854/ Can we reach a consensus somehow? :) | 17:14 |
| *** geoffarnold has joined #openstack-keystone | 17:14 | |
| morganfainberg | amakarov: my opinion is api behavior/contract break is there | 17:14 |
| morganfainberg | amakarov: I like your proposal much more than what we have personally. | 17:14 |
| morganfainberg | amakarov: really I am only -1 because of the behavior change. Which is against the contract. | 17:15 |
| david8hu | ayoung, samueldmg, I think we have enough resource to get per project done for Liberty. We need to nail down a good design, and see how to divide it up among those that can help implement this thing. | 17:15 |
| morganfainberg | Not sure what to point you at to solve that. | 17:15 |
| morganfainberg | Or if this would be an "ok" break (my view is it really isn't ok to break the behavior... But I might be wrong / overruled here) | 17:16 |
| samueldmq | david8hu: you mean policy per project ? | 17:16 |
| david8hu | samueldmq, yes policy per project at an url | 17:17 |
| amakarov | morganfainberg, I agree, but there is a trade-off: if we revoke by user_id we'll end up with revocation event list as big as TRL we trying to get away from. | 17:17 |
| morganfainberg | bknudson: want to weigh in on ^ the behavior change (just look at my comment and the test case, doesn't need a whole review atm, just a second pair of "is this a real break") | 17:17 |
| morganfainberg | Eyes | 17:17 |
| *** piyanai has quit IRC | 17:18 | |
| *** ankita_wagh has joined #openstack-keystone | 17:18 | |
| amakarov | morganfainberg, so ayoung suggested to revoke by scope disregarding possible splash | 17:18 |
| morganfainberg | amakarov: let's get bknudson's view. I'll ok this if he says it's a reasonable break. | 17:18 |
| morganfainberg | Or not a real concern | 17:18 |
| morganfainberg | I want a second pair of eyes. Like I said, your solution is way better than today's | 17:19 |
| bknudson | what API is breaking? | 17:19 |
| david8hu | samueldmg, ayoung, roxanaghe noticed that nova is still using an incubator copy of oslo.policy. I think roxanaghe is going to help migrate it to oslo.policy library :) | 17:19 |
| *** diazjf has quit IRC | 17:19 | |
| *** e0ne is now known as e0ne_ | 17:19 | |
| amakarov | bknudson, hi! Here it is: https://review.openstack.org/#/c/141854/ | 17:19 |
| morganfainberg | bknudson: revocation of a group assignment will cause all role-project tokens to be revoked | 17:19 |
| morganfainberg | Not just for those who are part of the group | 17:19 |
| bknudson | why does the API have to change? | 17:20 |
| *** e0ne_ is now known as e0ne | 17:20 | |
| morganfainberg | So it's change to role-project vs user-project.if(user is part of group) | 17:20 |
| *** mylu has quit IRC | 17:20 | |
| morganfainberg | bknudson: to minimize the number of events issues for revocation | 17:20 |
| amakarov | bknudson, several patches ago (on the summit actually) I offered fine-grained revocation by user-role-project for all users in the group | 17:20 |
| * morganfainberg will | 17:21 | |
| morganfainberg | Let amakarov explain | 17:21 |
| * morganfainberg is on mobile. | 17:21 | |
| bknudson | but the test is showing that there's more tokens being revoked than before | 17:21 |
| samueldmq | david8hu: I don't think we can have per project policy in L | 17:21 |
| amakarov | ayoung suggested to revoke by role-project impacting some innocents | 17:22 |
| amakarov | bknudson, yes | 17:22 |
| bknudson | I don't think which tokens are revoked on any operation is API breaking anyways | 17:22 |
| *** mylu has joined #openstack-keystone | 17:22 | |
| amakarov | and there is a reason for it | 17:22 |
| david8hu | samueldmq, why not? | 17:22 |
| samueldmq | david8hu: that requires another caching mechanism from what we have in place | 17:22 |
| bknudson | we could randomly revoke tokens | 17:22 |
| amakarov | if we revoke something for OUR users - it's ok to identify them | 17:22 |
| samueldmq | david8hu: that's a huge change and have to be very well discussed | 17:23 |
| samueldmq | david8hu: I prefer to put all the dynamic policies changes in place | 17:23 |
| amakarov | bknudson, but if users are from some external provider identifying them can be tricky | 17:23 |
| samueldmq | david8hu: have better default policies, better delegation | 17:23 |
| morganfainberg | bknudson: if you don't see revocations as an api break (in a case like this) I'm good with it. | 17:23 |
| amakarov | that's how I understand ayoung's consern | 17:23 |
| samueldmq | david8hu: solve 968696 and then we can go for per project policy | 17:23 |
| bknudson | I don't see revocations as an API break | 17:23 |
| samueldmq | david8hu: if that makes sense .. | 17:23 |
| david8hu | samueldmq, we don't have a cache mechanism. Let's get it right from the beginnning, so we do not need to band-aid it it later. | 17:24 |
| morganfainberg | bknudson: thanks that works for me. | 17:24 |
| samueldmq | david8hu: the cache mechanism is the way we store the policy into files, that will be read from the service | 17:24 |
| morganfainberg | bknudson: thanks. | 17:24 |
| morganfainberg | amakarov: let me do one more review. And I'll reverse the -1 | 17:24 |
| samueldmq | david8hu: that would require a per-project policy.json ? | 17:24 |
| samueldmq | david8hu: in the endpoints ? | 17:25 |
| bknudson | https://review.openstack.org/#/c/141854/26/keystone/tests/unit/test_v3_auth.py -- should be using entrypoints rather than module paths | 17:25 |
| *** jsavak has joined #openstack-keystone | 17:25 | |
| *** gokrokve_ has joined #openstack-keystone | 17:26 | |
| amakarov | morganfainberg, you're welcome. Actually I don't like the imperfect solutions, but this is a trade-off, I don't know how to make it more granular | 17:26 |
| *** trey has joined #openstack-keystone | 17:26 | |
| morganfainberg | amakarov: yeah. And I tend to err on conservative with api / behavior breaks | 17:26 |
| morganfainberg | So... That s why I wanted another set of eyes. | 17:27 |
| *** gokrokve has quit IRC | 17:27 | |
| amakarov | morganfainberg, hope to discuss a concept of short-term tokens on mid-cycle | 17:27 |
| david8hu | samueldmg, something like PUT /policies/{policy_id}/OS-ENDPOINT-POLICY/{endpoint}/project/{project_id} | 17:29 |
| *** e0ne is now known as e0ne_ | 17:29 | |
| *** fangzhou has joined #openstack-keystone | 17:32 | |
| *** e0ne_ is now known as e0ne | 17:32 | |
| *** arunkant_ has joined #openstack-keystone | 17:32 | |
| *** mylu has quit IRC | 17:32 | |
| roxanaghe | samueldmq, david8hu, what I noticed yesterday during some policy code reading is that there is a lot of code duplication in nova/neutron/etc for policy enforcement, do we want to move that to using a consolidated version of policy enforcement from oslo.policy? | 17:32 |
| *** piyanai has joined #openstack-keystone | 17:33 | |
| *** mylu has joined #openstack-keystone | 17:34 | |
| samueldmq | morganfainberg: amakarov looking at that change, if a group role grant is deleted, *any* other token containing the same role and scope would be revoked as well | 17:34 |
| amakarov | samueldmq, yes | 17:34 |
| morganfainberg | amakarov: I have a goal to kill bearer tokens. | 17:34 |
| morganfainberg | amakarov: and we have a path to do it. | 17:34 |
| samueldmq | morganfainberg: amakarov I think the best solution would be a single notification telling the revoke API the exact assignment that was deleted | 17:34 |
| morganfainberg | Maybe 1-2 cycles from having all the prices in play | 17:34 |
| morganfainberg | Peices* | 17:34 |
| samueldmq | morganfainberg: amakarov and then revoke api knows, if it was a group assignment, that it needs to ask identity_api to list users and then revoke the individual tokens | 17:35 |
| amakarov | samueldmq, there is a problem: token doesn't have a group ) | 17:35 |
| *** e0ne has quit IRC | 17:35 | |
| samueldmq | amakarov: sure, that's why you need to iterate over group's users | 17:35 |
| *** arunkant has joined #openstack-keystone | 17:35 | |
| amakarov | samueldmq, so such revocation event can't be effectively used to validate tokens | 17:36 |
| *** arunkant__ has quit IRC | 17:36 | |
| samueldmq | amakarov: but iterating on gorup's users doesn't have to be done in the assignment_api, it should happen in the revoke_api | 17:36 |
| samueldmq | amakarov: that receive the event from asisngment deletion , and iterate over the users, revoking their individual tokens | 17:37 |
| david8hu | roxanaghe, samueldmg, I think we need to go into each of the service to make those changes. Otherwise, services won't be able to pickup the proposed customized policy overlay feature in the future. | 17:37 |
| *** trey has quit IRC | 17:37 | |
| samueldmq | david8hu: customized policy is just a dict on keystone server | 17:37 |
| amakarov | samueldmq, I've done exactly this a couple of CR's before | 17:37 |
| samueldmq | david8hu: we download that and overlay the existing policy | 17:38 |
| *** belmoreira has quit IRC | 17:38 | |
| *** fhubik has quit IRC | 17:38 | |
| samueldmq | amakarov: I remember you iterated over the group's users in the assignment_api and raised a notification for each user | 17:38 |
| *** arunkant_ has quit IRC | 17:38 | |
| david8hu | samueldmq, I am confused. Aren't you plan to change oslo.policy? | 17:39 |
| samueldmq | amakarov: I am saying to raise a single notification on the exact assignment that was deleted, revoke_api will know what ot do and revoke properly | 17:39 |
| amakarov | samueldmq, but 1: revocation list grows as big as TLR, 2: no way to validate tokens for external users | 17:39 |
| *** trey has joined #openstack-keystone | 17:39 | |
| samueldmq | amakarov: so we can't list users from a remote group ? | 17:40 |
| amakarov | samueldmq, do you propose to fire a revocation event with group-role-resource? | 17:40 |
| morganfainberg | samueldmq: you can only revoke on values in the token. | 17:40 |
| morganfainberg | amakarov: we could revoke user-role-project? It's less than token-id | 17:41 |
| morganfainberg | amakarov: but more than role-project | 17:41 |
| samueldmq | roxanaghe: we have the base policy.py that was imported to services through oslo-incubator | 17:41 |
| samueldmq | roxanaghe: that's now in oslo-policy, imported from individual services | 17:41 |
| *** jsavak has quit IRC | 17:42 | |
| samueldmq | roxanaghe: if there is some code that can still be shared, sure we can put that in the common oslo.policy library | 17:42 |
| amakarov | morganfainberg, we can't revoke by federated users | 17:42 |
| samueldmq | morganfainberg: that's exactly what I was saying | 17:42 |
| morganfainberg | But federated users *do* have groups in the token, right? | 17:42 |
| amakarov | morganfainberg, exactly | 17:43 |
| samueldmq | morganfainberg: the revoke_api receives a notification saying (group,role,target) was delete | 17:43 |
| amakarov | morganfainberg, I thought to complicate revocation logic a bit | 17:43 |
| morganfainberg | So... We could do group-project-role and any non-federated users are user-project-role? | 17:43 |
| samueldmq | morganfainberg: revoke_api decides what to do, iterate over the group's users (if it can do), etc | 17:43 |
| morganfainberg | it is a lot more complex that way. | 17:43 |
| samueldmq | morganfainberg: +++ | 17:43 |
| amakarov | morganfainberg, and, by the way, after my last refactoring I think I can try this out... | 17:43 |
| *** piyanai has quit IRC | 17:44 | |
| morganfainberg | amakarov: I really am not opposed to your current solution. | 17:44 |
| openstackgerrit | Jason Obrien proposed openstack/keystone: Updated docs for Keystone startup https://review.openstack.org/197225 | 17:44 |
| morganfainberg | amakarov: we can make it more refined as an arson? | 17:44 |
| morganfainberg | Ahdhhdhdhuxuudhh | 17:44 |
| david8hu | samueldmq, nova does not import oslo.policy. It does "from nova.openstack.common import policy" | 17:44 |
| morganfainberg | Stupid autocorrect | 17:44 |
| morganfainberg | It turned itself back on post update | 17:45 |
| samueldmq | david8hu: it still doesnt, but will | 17:45 |
| morganfainberg | As an addon* | 17:45 |
| *** browne has joined #openstack-keystone | 17:45 | |
| samueldmq | hehe | 17:45 |
| *** mestery_ has joined #openstack-keystone | 17:46 | |
| *** richm has quit IRC | 17:46 | |
| david8hu | samueldmg, it? | 17:46 |
| *** piyanai has joined #openstack-keystone | 17:46 | |
| samueldmq | david8hu: yes all the services will import policy.py from oslo.policy (that's the same as defined on oslo-incubator) | 17:46 |
| samueldmq | david8hu: taht comes to services as openstack.common.. etc | 17:47 |
| *** vilobhmm has quit IRC | 17:47 | |
| amakarov | morganfainberg, maybe stop as we are for now and postpone by-group revocation until after mid-cycle if we understand that revocations will last long enough? | 17:47 |
| morganfainberg | Sure. | 17:48 |
| roxanaghe | samueldmq, david8hu - yup samueldmq is right I see now that the code is updated/synced from oslo_policy | 17:49 |
| *** mestery has quit IRC | 17:49 | |
| roxanaghe | samueldmq, david8u - that's a nice automated code duplication mechanism in my opinion. do we ever want to change that to import oslo_policy directly? | 17:50 |
| samueldmq | amakarov: morganfainberg I see somehting like this http://paste.openstack.org/show/332728/ | 17:50 |
| *** richm has joined #openstack-keystone | 17:50 | |
| *** rwsu has quit IRC | 17:50 | |
| samueldmq | roxanaghe: yes the idea is to have every project improting from oslo_policy | 17:50 |
| samueldmq | roxanaghe: david8hu well... this is how things happen: | 17:50 |
| samueldmq | roxanaghe: david8hu common code first enters the incubation process, so it lives in the oslo-incubator process | 17:51 |
| david8hu | samueldmq, roxanaghe, Sounds like no-op, then. Then what's the point of graduating oslo.policy ealier this year :) | 17:51 |
| samueldmq | roxanaghe: david8hu after they graduate to its own library (such as oslo-policy), services don't need to synchronize that code manually anymore | 17:51 |
| amakarov | samueldmq, if we'll can revoke by group we won't need group iteration on revoke at all | 17:51 |
| samueldmq | roxanaghe: david8hu they just import it from the library instead | 17:52 |
| samueldmq | amakarov: only for federated users we can find group in the tokne | 17:52 |
| *** jdennis has quit IRC | 17:52 | |
| samueldmq | amakarov: for normal users we only have the user_id, so we'll need to iterate over them if they're not federated | 17:52 |
| *** piyanai has quit IRC | 17:52 | |
| amakarov | samueldmq, for normal user we can request it's groups | 17:53 |
| samueldmq | david8hu: did I answer your question ? ^ that's the incubation proces | 17:53 |
| roxanaghe | samueldmq, ok - so services will take care of making this easy switch to oslo_policy direct impoirt somewhere in the near future.. | 17:53 |
| roxanaghe | *import | 17:53 |
| samueldmq | roxanaghe: it's already happening, most of them already did, let me find the bug I've opened .. jsut a sec | 17:53 |
| samueldmq | roxanaghe: david8hu see https://bugs.launchpad.net/nova/+bug/1458945 | 17:54 |
| openstack | Launchpad bug 1458945 in Cinder "Use graduated oslo.policy instead of oslo-incubator code" [Medium,In progress] - Assigned to Ivan Kolodyazhny (e0ne) | 17:54 |
| *** rwsu has joined #openstack-keystone | 17:54 | |
| samueldmq | amakarov: I think token revokation list is supposed to contain the exact information needed to decide whether a token is invalid, without needign to get back to keystone and looking at group's users or whatever | 17:55 |
| roxanaghe | samueldmq - cool!! that expains a lot of my doubts. thanks for the info | 17:55 |
| samueldmq | amakarov: so for each token coming form a user, you request his/her groups to check if there is a revokaiton to one of those groups in that target/role | 17:56 |
| amakarov | samueldmq, TRL is supported | 17:56 |
| samueldmq | amakarov: that's terrible I think | 17:56 |
| *** csoukup has joined #openstack-keystone | 17:56 | |
| samueldmq | roxanaghe: np feel free to share any question/thought you have :) | 17:56 |
| amakarov | samueldmq, agree | 17:57 |
| amakarov | samueldmq, so current solution looks like a compromise | 17:58 |
| amakarov | samueldmq, it creates TRL if needed, and a revocation event which impact a bit more than supposed | 17:59 |
| *** browne has quit IRC | 18:01 | |
| samueldmq | amakarov: yes and I appreciate you wanting to improve our current solution | 18:01 |
| samueldmq | amakarov: I'll take a better look at your patch later today and leave comments, though I think you got what I am saying :) | 18:01 |
| samueldmq | ayoung: morganfainberg so ... I have listed the alternatives we have to associate a policy with an endpoint_url | 18:02 |
| *** browne has joined #openstack-keystone | 18:02 | |
| samueldmq | ayoung: morganfainberg http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2015-07-01.log.html#t2015-07-01T13:59:17 | 18:02 |
| samueldmq | ayoung: morganfainberg I'd like to get a couple of eyes on that and then discuss it quickly, as I am working on the spec right now :) | 18:03 |
| amakarov | samueldmq, do you know what is the entry point? bknudson is offline and I'm a bit lost what was he about in the patch comment... | 18:03 |
| samueldmq | ayoung: morganfainberg well... whenever you're available, of course | 18:03 |
| amakarov | entrypoint | 18:03 |
| *** mestery_ is now known as mestery | 18:04 | |
| *** Kennan has quit IRC | 18:04 | |
| samueldmq | amakarov: I think he's talking about ... wait | 18:04 |
| *** Kennan has joined #openstack-keystone | 18:05 | |
| samueldmq | amakarov: I think that's somehting that allows you to only specify driver='kvs' | 18:06 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:06 | |
| amakarov | samueldmq, blood magic 0_o | 18:06 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/196485 | 18:06 |
| lbragstad | morganfainberg: fyi, got these passing https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:consolidate-fernet-provider,n,z | 18:08 |
| lbragstad | working on the consolidating the v2 validate token logic from Fernet into the BaseProvider, but it's pretty messy | 18:08 |
| morganfainberg | lbragstad: nice | 18:09 |
| morganfainberg | lbragstad: hope my patches help some on that front | 18:09 |
| *** yottatsa has joined #openstack-keystone | 18:09 | |
| lbragstad | morganfainberg: yeah, they do, I think we'll probably have a merge conflict but.. that's fine | 18:10 |
| samueldmq | amakarov: well, it's in the 'revoke' group of the config, if you talk about 'kvs' there we can map it to keystone.contrib.revoke.backends.kvs.Revoke | 18:10 |
| lbragstad | morganfainberg: I rebased your chain this morning | 18:10 |
| morganfainberg | lbragstad: sounds good | 18:10 |
| samueldmq | amakarov: but you better confirm with bknudson , or just test it :) | 18:10 |
| morganfainberg | lbragstad: yeah that was an unfun set of patches. | 18:10 |
| amakarov | samueldmq, thank you - just run the tests using it - it works :) | 18:11 |
| morganfainberg | lbragstad: and i've run into a series of just "odd" side effects because i was digging into the depths of the token providers | 18:11 |
| lbragstad | morganfainberg: collapsing the v2 stuff into the base provider is going to be ugly :( | 18:11 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Group role revocation invalidates all user tokens https://review.openstack.org/141854 | 18:11 |
| morganfainberg | lbragstad: thats why i did the work to make v2 issue like fernet first | 18:11 |
| lbragstad | morganfainberg: at least with the issue path we have the _get_token_id() method that we can abstract things out to | 18:11 |
| amakarov | morganfainberg, ayoung, bknudson, samueldmq ^^ | 18:12 |
| morganfainberg | lbragstad: so we do v3 token -> convert -> get_id | 18:12 |
| lbragstad | morganfainberg: the validate_v2_token might have to wait until your patches land? | 18:12 |
| morganfainberg | yeah probably | 18:12 |
| lbragstad | morganfainberg: ok, I'm good with that... | 18:12 |
| morganfainberg | well validate was easier than issue v2 | 18:12 |
| morganfainberg | fwiw | 18:12 |
| morganfainberg | validate was already passing | 18:12 |
| morganfainberg | (mostly) | 18:12 |
| morganfainberg | issue v2 is icky | 18:12 |
| lbragstad | yeah, i have issue v2, issue v3, and validate v3 passing now | 18:13 |
| morganfainberg | lbragstad: https://review.openstack.org/#/c/196483/ validate | 18:13 |
| lbragstad | but validate v2 is the rough one | 18:13 |
| morganfainberg | for v2 | 18:13 |
| morganfainberg | then collapsing fernet over really isn't crazy | 18:13 |
| lbragstad | awesome, | 18:13 |
| morganfainberg | just a extract "sane values" in get_id | 18:13 |
| lbragstad | that works | 18:13 |
| morganfainberg | but first step is make the non-fernet look like fernet workflow | 18:13 |
| lbragstad | I'm going to wait to tackle collapsing the validate_v2_token() until that lands | 18:14 |
| *** mylu has quit IRC | 18:14 | |
| morganfainberg | ok sounds good | 18:14 |
| morganfainberg | let me poke at your stuff here and see what i can +2. | 18:14 |
| lbragstad | morganfainberg: awesome | 18:14 |
| *** mylu has joined #openstack-keystone | 18:16 | |
| morganfainberg | lbragstad: and the nice thing is with this collapse, we test all of the code paths without needing to treat fernet as too insanely special | 18:16 |
| morganfainberg | lbragstad: we should *probably* life most of the common provider code up into the manager | 18:16 |
| morganfainberg | lbragstad: long term | 18:16 |
| lbragstad | morganfainberg: yeah, that's going be awesome, then I can start the purge | 18:16 |
| morganfainberg | lbragstad: that way we can really limit what the underlying provider needs to do | 18:16 |
| morganfainberg | if it really is just "get_id" or "extract_token_body" | 18:17 |
| lbragstad | the purge of a million different types of test modules that describe different types of provider behaviors | 18:17 |
| morganfainberg | that might make lives much easier | 18:17 |
| lbragstad | ++ | 18:17 |
| *** kiran-r has joined #openstack-keystone | 18:18 | |
| samueldmq | morganfainberg: lbragstad so that the providers only contain the really essential code that differs between them, avoiding code duplication (and bugs) and tests as well | 18:18 |
| samueldmq | if I am understanding it well | 18:18 |
| lbragstad | samueldmq: yeah | 18:18 |
| *** diazjf has joined #openstack-keystone | 18:19 | |
| samueldmq | lbragstad: hmm, looks something great :) | 18:19 |
| lbragstad | samueldmq: everything with a provider should only be specific to that providers token implementation | 18:19 |
| lbragstad | samueldmq: so if we can start pulling all the duplicate code out of differnet providers and consolidate it into the inherited methods of the BaseProvider, then we make testing each provider more sane because it's all the same code path | 18:20 |
| morganfainberg | lbragstad: https://review.openstack.org/#/c/196774/ +2 ,but you could make the @property better | 18:20 |
| morganfainberg | lbragstad: if you are spinning another patchset | 18:20 |
| samueldmq | lbragstad: ++ and a common test class for the baseprovide which is much more consistent | 18:20 |
| lbragstad | morganfainberg: https://review.openstack.org/#/c/196774/8/keystone/token/providers/common.py | 18:21 |
| samueldmq | lbragstad: that looks sane | 18:21 |
| lbragstad | morganfainberg: then we have to pass the auth_context to the property method? | 18:21 |
| morganfainberg | no | 18:21 |
| lbragstad | then it wouldn't be a property method I don't think | 18:21 |
| lbragstad | oh | 18:21 |
| morganfainberg | if the @property raised NotImplemented | 18:21 |
| morganfainberg | just check .supports_bind | 18:22 |
| lbragstad | oh | 18:22 |
| morganfainberg | if <provider>.supports_bind | 18:22 |
| morganfainberg | if you wanted to | 18:22 |
| morganfainberg | *shrug* | 18:22 |
| morganfainberg | like i said, i'm fine with it as is | 18:22 |
| lbragstad | and uuids .supprts_bind just passes | 18:22 |
| lbragstad | samueldmq: ++ we should have a single test cases that we can read like a book that describes how tokens behave | 18:23 |
| *** e0ne has joined #openstack-keystone | 18:23 | |
| *** e0ne is now known as e0ne_ | 18:23 | |
| *** e0ne_ is now known as e0ne | 18:23 | |
| *** piyanai has joined #openstack-keystone | 18:23 | |
| *** e0ne has quit IRC | 18:23 | |
| lbragstad | morganfainberg: I like that better, I can respin another patch (or just change it in a different patchset since that already passed Jenkins?) | 18:23 |
| morganfainberg | add it as a followup | 18:24 |
| lbragstad | morganfainberg: will do | 18:24 |
| morganfainberg | if no one -1s | 18:24 |
| morganfainberg | or whatever | 18:24 |
| morganfainberg | gyee: ^ could use some eyes on some nice cleanup patches | 18:24 |
| morganfainberg | gyee: around fernet | 18:24 |
| *** e0ne has joined #openstack-keystone | 18:24 | |
| morganfainberg | gyee: cause we all want fernet to be awesome | 18:24 |
| morganfainberg | lbragstad: i'm surprised your issue_v2 token one was "just working" | 18:24 |
| openstackgerrit | janonymous proposed openstack/keystone: Python 3: Replace unicode with six.text_type https://review.openstack.org/193866 | 18:25 |
| lbragstad | morganfainberg: yeah me too... | 18:25 |
| lbragstad | it was a "well, this *should* work", then run tox | 18:25 |
| *** jdennis has joined #openstack-keystone | 18:25 | |
| morganfainberg | i'd like to hold on that one until we get validate and expiry fixed | 18:25 |
| morganfainberg | gyee: so https://review.openstack.org/#/c/196774/8 https://review.openstack.org/#/c/196877/ https://review.openstack.org/#/c/196475/ | 18:26 |
| morganfainberg | then we get to play some rebase fun | 18:26 |
| *** jsavak has joined #openstack-keystone | 18:27 | |
| *** packet has joined #openstack-keystone | 18:29 | |
| *** slberger1 has quit IRC | 18:31 | |
| gyee | morganfainberg, yes, looking | 18:31 |
| *** e0ne is now known as e0ne_ | 18:34 | |
| *** piyanai has quit IRC | 18:34 | |
| *** piyanai has joined #openstack-keystone | 18:35 | |
| *** jaosorior has quit IRC | 18:36 | |
| *** e0ne_ is now known as e0ne | 18:37 | |
| *** kiran-r has quit IRC | 18:38 | |
| *** kiran-r has joined #openstack-keystone | 18:39 | |
| *** piyanai has quit IRC | 18:39 | |
| *** Rockyg has joined #openstack-keystone | 18:41 | |
| *** kiran-r has quit IRC | 18:44 | |
| jdandrea | richm (or anyone who can help shed light): Continuing to run into AuthN problems using keystone v3. Steps to reproduce here: http://paste.openstack.org/show/332891/ | 18:44 |
| *** slberger has joined #openstack-keystone | 18:47 | |
| morganfainberg | gyee: i'm going to take a look at the user-agent patch from roxanaghe in a second here. I'd like to see that get merged so i'll de conflict and see if we cna address the comments quickly | 18:49 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v2_token() https://review.openstack.org/197647 | 18:49 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor _supports_bind_authentication method https://review.openstack.org/197699 | 18:49 |
| lbragstad | morganfainberg: gyee moar token provider code! | 18:50 |
| gyee | morganfainberg, sure, thanks | 18:50 |
| *** gokrokve_ has quit IRC | 18:50 | |
| gyee | jdandrea, I am guessing user don't have role assigned for the given project | 18:50 |
| *** fangzhou has quit IRC | 18:50 | |
| gyee | lbragstad, mo reviews | 18:51 |
| roxanaghe | morganfainberg, https://review.openstack.org/#/c/180769/12 this one? I am rebasing right now .. | 18:51 |
| morganfainberg | roxanaghe: oh okie :) | 18:51 |
| *** bradjones has quit IRC | 18:51 | |
| morganfainberg | roxanaghe: cool | 18:51 |
| morganfainberg | roxanaghe: i'll not rebase it for you then :) | 18:51 |
| morganfainberg | roxanaghe: yay! | 18:51 |
| roxanaghe | morganfainberg - you'll have something to review in 5 minutes :) | 18:52 |
| morganfainberg | woot | 18:52 |
| morganfainberg | roxanaghe: yeah i didn't want that to get lost it is a useful thing to have | 18:52 |
| *** bradjones has joined #openstack-keystone | 18:52 | |
| *** bradjones has quit IRC | 18:52 | |
| *** bradjones has joined #openstack-keystone | 18:52 | |
| gyee | roxanaghe, clock has started :) | 18:52 |
| roxanaghe | hmm.. | 18:53 |
| lbragstad | gyee: responded https://review.openstack.org/#/c/196774/ | 18:53 |
| gyee | lbragstad, please respin, if user id is missing we are in soup anyway | 18:54 |
| lbragstad | gyee: ok | 18:54 |
| *** yottatsa has quit IRC | 18:54 | |
| *** lufix has joined #openstack-keystone | 18:54 | |
| *** yottatsa has joined #openstack-keystone | 18:57 | |
| *** yottatsa has quit IRC | 18:58 | |
| *** fangzhou has joined #openstack-keystone | 18:58 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v2_token() https://review.openstack.org/197647 | 18:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor _supports_bind_authentication method https://review.openstack.org/197699 | 18:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 18:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v3_token() https://review.openstack.org/196774 | 18:58 |
| *** Lactem has quit IRC | 19:00 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v2_token() https://review.openstack.org/197706 | 19:01 |
| *** jsavak has quit IRC | 19:07 | |
| *** shaleh has quit IRC | 19:07 | |
| *** crc32 has joined #openstack-keystone | 19:08 | |
| *** crc32 has quit IRC | 19:10 | |
| *** crc32 has joined #openstack-keystone | 19:10 | |
| *** gokrokve has joined #openstack-keystone | 19:10 | |
| *** arunkant_ has joined #openstack-keystone | 19:10 | |
| *** boris-42 has joined #openstack-keystone | 19:13 | |
| *** arunkant has quit IRC | 19:14 | |
| odyssey4me | marekd are you around, or perhaps anyone else who can help with a federation related question | 19:15 |
| odyssey4me | ? | 19:15 |
| richm | jdandrea: I don't see anything obviously wrong | 19:21 |
| jdandrea | richm: Yep, me neither. *scratches head* | 19:22 |
| *** ankita_wagh has quit IRC | 19:23 | |
| * morganfainberg will write code again sometime. | 19:23 | |
| * morganfainberg dreams. | 19:23 | |
| raildo | haha | 19:24 |
| gyee | he's in MLK I have a dream mode :D | 19:24 |
| jdandrea | lol | 19:25 |
| *** piyanai has joined #openstack-keystone | 19:25 | |
| raildo | morganfainberg, I have some patches in reseller, if you want to help :P | 19:25 |
| *** kiran-r has joined #openstack-keystone | 19:26 | |
| gyee | odyssey4me, what's the issue? | 19:27 |
| *** Lactem has joined #openstack-keystone | 19:28 | |
| odyssey4me | thanks gyee it would appear that the keystone SP is giving out it's IP address in the SAML data, whereas the metadata and external reference from the IDP only refers to the DNS name | 19:28 |
| *** Lactem has quit IRC | 19:28 | |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: Adding Documentation for Mapping Combinations https://review.openstack.org/192850 | 19:28 |
| odyssey4me | so what's happening is the IDP is not authorising, saying that it doesn't know anything about resources on the IP address based URL | 19:29 |
| *** anhhuynx has quit IRC | 19:29 | |
| gyee | can you do nslookup on IdP to see if those IP resolve to anything? | 19:31 |
| odyssey4me | I'm wondering whether there's a way to tell keystone/shibboleth that it needs to send the DNS name instead of the IP. The Shibboleth metadata only shows the DNS name, the Keystone Apache config has the DNS name, and the keystone public endpoint is DNS name based. | 19:31 |
| odyssey4me | gyee that IP is the same as the DNS name - it's the right IP - but the IDP doesn't have any information about the IP - only the DNS name | 19:31 |
| *** fangzhou has quit IRC | 19:32 | |
| gyee | can you paste the error log to pastebin somewhere? | 19:32 |
| odyssey4me | gyee it's an ADFS IDP, FYI - will pastebin shortly | 19:33 |
| bknudson | https://bugs.launchpad.net/python-keystoneclient/+bug/1470626 | 19:34 |
| openstack | Launchpad bug 1470626 in python-keystoneclient "gate-tempest-dsvm failing when referencing keystoneauth1" [Undecided,New] | 19:34 |
| bknudson | how is that possible? | 19:34 |
| *** dguerri` is now known as dguerri | 19:34 | |
| jdandrea | gyee, the user is admin and member for the project in question, and CLI works. | 19:34 |
| bknudson | somebody's using keystoneauth already? | 19:34 |
| odyssey4me | gyee the event log error shown: http://pastebin.com/z8W3JNuj | 19:34 |
| *** piyanai has quit IRC | 19:34 | |
| *** Rockyg has quit IRC | 19:35 | |
| *** gokrokve has quit IRC | 19:36 | |
| *** BrAsS_mOnKeY has quit IRC | 19:36 | |
| jdandrea | gyee, richm: The plot thickens. I wonder if *this* has anything to do with it. http://paste.openstack.org/raw/333048/ | 19:36 |
| jdandrea | (In that example, I've edited it. "controller" is really a FQDN. The 10.1.1.1 IPs, however, actually exist as-is in keystone. | 19:36 |
| *** jasondotstar has quit IRC | 19:37 | |
| *** Lactem has joined #openstack-keystone | 19:38 | |
| *** e0ne has quit IRC | 19:38 | |
| gyee | jdandrea, you got a 401, not a 404 or unable to connect, so the endpoint is definitely servicing the request | 19:38 |
| jdandrea | gyee: This is true. | 19:38 |
| jdandrea | I'm at a loss then. CLI works. python library returns a 401. Hmm. | 19:39 |
| gyee | jdandrea, most likely your user password is wrong, or you don't have any role for the given project | 19:39 |
| jdandrea | Same credentials (ostensibly). | 19:39 |
| *** jsavak has joined #openstack-keystone | 19:39 | |
| jdandrea | The same credentials work using the CLI. The user is assigned as admin and member to the project in question. | 19:40 |
| richm | jdandrea: if the cli works, try enabling --debug to see the arguments passed to and from - unfortunately this will not show you the auth args (the data POSTed to the /v3/auth/tokens url) | 19:40 |
| jdandrea | richm: Trying ... | 19:40 |
| odyssey4me | gyee rookie error - the resource I was accessing (Horizon) was where the IP address came from... sorry to waste your time :/ | 19:41 |
| gyee | odyssey4me, no problem, glad you got it working | 19:41 |
| *** kiran-r has quit IRC | 19:42 | |
| jdandrea | gyee, richm: Boom. It's using the authurl endpoint under the hood. http://paste.openstack.org/show/333049/ | 19:43 |
| jdandrea | Even though I gave it the publicurl one (?). | 19:43 |
| Lactem | https://review.openstack.org/#/c/196883/6 Can anyone take a look at my newest patch set? | 19:44 |
| *** dguerri is now known as dguerri` | 19:44 | |
| jdandrea | If the python lib does the same thing, I imagine it won't work remotely (though it's also odd that it doesn't work *locally* either). Separately: Is there a good rationale I can give the cluster admin as to why adminurl endpoints should be publicly reachable? | 19:44 |
| openstackgerrit | Roxana Gherle proposed openstack/keystonemiddleware: Send the correct user-agent to Keystone https://review.openstack.org/180769 | 19:44 |
| jdandrea | Oh! It's also using v2. | 19:45 |
| jdandrea | Retrying and forcing v3. | 19:45 |
| *** yottatsa has joined #openstack-keystone | 19:45 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystonemiddleware: Send the correct user-agent to Keystone https://review.openstack.org/180769 | 19:45 |
| *** yottatsa has quit IRC | 19:46 | |
| *** jsavak has quit IRC | 19:47 | |
| jdandrea | v3 refused. It falls back to v2, but the v3 endpoint is listed (this is kilo). Gaaah. :) | 19:47 |
| *** jsavak has joined #openstack-keystone | 19:47 | |
| gyee | jdandrea, you are using openstack CLI right? | 19:47 |
| jdandrea | gyee: Yes. | 19:47 |
| gyee | it should support v3 | 19:48 |
| jdandrea | Trying keystone --os-identity-api-version 3 --debug user-list (and v3, and 3.0). | 19:48 |
| *** fangzhou has joined #openstack-keystone | 19:48 | |
| *** ctina_ has joined #openstack-keystone | 19:48 | |
| jdandrea | None of those work. It always falls back to 2. (WARNING: unsupported identity-api-version 3, falling back to 2.0) | 19:49 |
| gyee | openstack --os-identity-api-verison 3 --os-auth-type v3password --os-username username --os-user-domain-id domain_id --os-project-id project_id projects list | 19:49 |
| roxanaghe | morganfainberg - sorry that was way longer than 5 minutes, I got into some git squashing fights... | 19:49 |
| jdandrea | The openstack command isn't on this cluster. | 19:49 |
| gyee | keystone CLI does not support v3 | 19:50 |
| jdandrea | python-keystoneclient (keystone) won't work with v3? | 19:50 |
| jdandrea | gyee: even though there's --os-identity-api-version? heh. ok. | 19:50 |
| *** yottatsa has joined #openstack-keystone | 19:51 | |
| samueldmq | gyee: --os-url $KEYSTONE_SERVICE_URI/v3 ? | 19:51 |
| gyee | I hope we have a big fat warning in keystone CLI to indicate the fact that v3 is not supported | 19:52 |
| *** yottatsa has quit IRC | 19:52 | |
| *** yottatsa has joined #openstack-keystone | 19:52 | |
| samueldmq | gyee: I think we have to provide --os-url as well in osclient | 19:52 |
| *** ctina has quit IRC | 19:52 | |
| bknudson | gyee: tjere | 19:52 |
| samueldmq | gyee: based on this jamielennox's patch https://review.openstack.org/#/c/186682/9/functions-common | 19:52 |
| *** Rockyg has joined #openstack-keystone | 19:52 | |
| bknudson | there's no --os-api-version argument to keystone CLI | 19:52 |
| jdandrea | gyee: What I see is "WARNING: unsupported identity-api-version 3, falling back to 2.0)" but I saw that and thought it didn't make sense because I see the endpoints in keystone plus they're advertised by the REST API. | 19:53 |
| *** ctina_ has quit IRC | 19:53 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystonemiddleware: Send the correct user-agent to Keystone https://review.openstack.org/180769 | 19:53 |
| jdandrea | bknudson: I'm using keystone client 1.2.0 and I see --os-identity-api-version in the Optional arguments. (?) | 19:53 |
| *** piyanai has joined #openstack-keystone | 19:53 | |
| bknudson | jdandrea: ugh. we need to drop that | 19:54 |
| gyee | samueldmq, we shouldn't need os-url | 19:54 |
| bknudson | but then the keystone CLI is deprecated already. | 19:54 |
| *** yottatsa has quit IRC | 19:54 | |
| bknudson | so we'll be dropping the whole thing soon enough | 19:55 |
| dstanek | bknudson: it will be really interesting to see what happens when with the first release of ksc and doesn't include the cli | 19:55 |
| bknudson | I think we'll be support 1.99 for a long time. | 19:56 |
| Lactem | dstanek: Hello. | 19:56 |
| dstanek | Lactem: hi | 19:56 |
| gyee | dstanek, disappear for a week after the release so you won't get harm? :) | 19:56 |
| Lactem | I made a new patch set. | 19:56 |
| jdandrea | bknudson: So python-openstackclient will be the way to go for keystone going forward. I'll make that case to get it on the cluster. ;) | 19:56 |
| dstanek | gyee: it'll be the PTL at the time that will have to hide | 19:57 |
| bknudson | jdandrea: python-openstackclient is the recommended replacement | 19:57 |
| dstanek | Lactem: for which thing? | 19:57 |
| Lactem | https://review.openstack.org/#/c/196883/6 | 19:57 |
| jdandrea | bknudson: Sounds good. | 19:57 |
| Lactem | deleting endpoint | 19:57 |
| *** amakarov is now known as amakarov_away | 19:58 | |
| jdandrea | bknudson: If I switch to python-openstackclient does all that documentation about python-keystoneclient and the libraries no longer apply? (Meaning do I now have to include different libraries to get the same functionality in my python scripts?) | 19:59 |
| gyee | dstanek, not that you care, but Cavs got Love! | 19:59 |
| *** ajayaa has quit IRC | 19:59 | |
| bknudson | jdandrea: python-openstackclient uses python-keystoneclient | 20:00 |
| bknudson | Love is a traitor | 20:00 |
| gyee | hah | 20:01 |
| dstanek | gyee: yeah, i saw that. maybe next year Lebron won't give up so easily | 20:01 |
| *** yottatsa has joined #openstack-keystone | 20:01 | |
| dstanek | Lactem: i'll try it out now | 20:03 |
| *** lufix_ has joined #openstack-keystone | 20:03 | |
| jdandrea | bknudson: Ah, so the CLI part is going away, but python-keystoneclient remains overall. It's just that the python-openstackclient will be the unified CLI way to get to it, and that supports v3. | 20:03 |
| gyee | yep | 20:03 |
| *** ankita_wagh has joined #openstack-keystone | 20:04 | |
| jdandrea | Excellent. | 20:04 |
| jdandrea | As for our adminurl endpoints being 10.1.1.1 ... :/ | 20:04 |
| yottatsa | Good evening! | 20:06 |
| yottatsa | Can you please review https://blueprints.launchpad.net/keystone/+spec/keystone-slaveification? | 20:06 |
| richm | If I add an endpoint using openstack --os-identity-api-version 3 endpoint create .... - should I be able to see them with openstack --os-identity-api-version 2 endpoint list? | 20:06 |
| openstackgerrit | Roxana Gherle proposed openstack/keystonemiddleware: Send the correct user-agent to Keystone https://review.openstack.org/180769 | 20:07 |
| gyee | richm, there's a bug :) | 20:07 |
| richm | gyee: link? | 20:07 |
| gyee | not sure if we have one filed yet | 20:07 |
| richm | arg | 20:07 |
| gyee | but you add an endpoint using v3, it won't show up in v2 | 20:08 |
| richm | gyee: yes, that's what I'm seeing | 20:08 |
| richm | gyee: should I go ahead and file it? This is a major pain for puppet-keystone | 20:08 |
| gyee | they are not backward compatible | 20:08 |
| gyee | richm, yes, please file one | 20:08 |
| gyee | richm, I just made aware yesterday | 20:09 |
| richm | what about the opposite? If I add an endpoint with v2, can I see it with v3? | 20:09 |
| gyee | richm, yes | 20:10 |
| gyee | if you add an endpoint in v2, it will show up as 3 separate endpoints in v3 | 20:10 |
| richm | I guess we'll have to use that as a workaround | 20:10 |
| *** belmoreira has joined #openstack-keystone | 20:11 | |
| gyee | yes, if you want to support both v2 and v3 | 20:11 |
| richm | we have to | 20:11 |
| *** jsavak has quit IRC | 20:12 | |
| richm | we will break all kinds of existing workflow if "openstack endpoint list" suddenly stops working after upgrading to Keystone v3 | 20:12 |
| *** yottatsa has quit IRC | 20:14 | |
| *** belmoreira has quit IRC | 20:15 | |
| *** jsavak has joined #openstack-keystone | 20:15 | |
| richm | https://bugs.launchpad.net/keystone/+bug/1470635 | 20:16 |
| openstack | Launchpad bug 1470635 in Keystone "endpoints added with v3 are not visible with v2" [Undecided,New] | 20:16 |
| *** e0ne has joined #openstack-keystone | 20:18 | |
| openstackgerrit | Merged openstack/oslo.policy: Move fileutils functions to oslo.policy https://review.openstack.org/197420 | 20:18 |
| morganfainberg | roxanaghe: no worries ;) | 20:22 |
| *** cburgess_ has quit IRC | 20:23 | |
| *** cburgess has joined #openstack-keystone | 20:23 | |
| *** fangzhou has quit IRC | 20:26 | |
| samueldmq | is there any real difference between different interfaces for the same endpoint ? | 20:26 |
| htruta | hey morganfainberg, do you think we have room for deprecating "/" in project names in liberty? | 20:27 |
| gyee | samueldmq, yes | 20:27 |
| samueldmq | gyee: what is it? how do we distinguish them? | 20:27 |
| htruta | that would make it easier for us to pass the project hierarchy in M | 20:28 |
| morganfainberg | htruta: it;s likely going to be an issue in general. you probably need to send to the ML and possibly the OPS ML too to see if people are using '/' much in project names | 20:28 |
| samueldmq | gyee: in the request? because looking at devstack, all three have the same url | 20:28 |
| samueldmq | gyee: http://paste.openstack.org/show/333095/ | 20:28 |
| *** packet has quit IRC | 20:28 | |
| htruta | morganfainberg: fine. I'll do it. | 20:29 |
| gyee | samueldmq, keystoneclient let you choose which interface to use | 20:29 |
| morganfainberg | htruta: sorry it's just not something i can say "yes we can do this" or " no we can't" | 20:29 |
| htruta | but form keystone side, we won't have much resistance, I guess. Right? | 20:29 |
| htruta | from* | 20:29 |
| morganfainberg | htruta: but i dont see an issue adding it to L - its a very minor if-check if we do deprecate it | 20:29 |
| samueldmq | gyee: how does keystone server know what interface you want to use ? does that go in the request ? | 20:30 |
| samueldmq | gyee: since we don't have different ports for different interfaces (except in keystone) I don't see how that could work | 20:30 |
| gyee | samueldmq, in production, we do | 20:30 |
| htruta | in case we decide to go this way, will we need a spec for it? | 20:30 |
| samueldmq | gyee: how ? could you please give me an example ? | 20:31 |
| gyee | interface is not something controlled by keystone server | 20:31 |
| gyee | it is used by the clients to talk to the service | 20:31 |
| samueldmq | gyee: so it should not be an information stored there, right ? | 20:32 |
| htruta | morganfainberg: ^ | 20:32 |
| gyee | sameuldmq, interface is a property of an endpoint, | 20:32 |
| morganfainberg | htruta: we will need to update the API spec and likely a lightweight spec saying "why we're doing it" | 20:32 |
| morganfainberg | but ask the ML question first | 20:32 |
| morganfainberg | should make the spec easier to justify if we're doing that route | 20:32 |
| morganfainberg | "hey see, no one uses this" | 20:33 |
| samueldmq | gyee: so you can reach an endpoint in different ways ... i.e different ports ? | 20:33 |
| gyee | client select endpoint by passing endpoint filter to auth plugin get_endpoint() | 20:33 |
| htruta | morganfainberg: yes, I will. I was just wondering what the next steps would be, assuming that community will accept it | 20:33 |
| dstanek | Lactem: that's getting closer | 20:33 |
| Lactem | Yay. | 20:33 |
| gyee | samueldmq, yes | 20:34 |
| samueldmq | gyee: so different interfaces DO NOT make sense if they point to the same URL (hostname + port) | 20:34 |
| gyee | for example, in deployment, I have a bunch of services running on the same host, they can just use to "internal" endpoints | 20:34 |
| gyee | external endpoints are usually protected with SSL, proxies, rate/bandwidth limiting, etc | 20:35 |
| gyee | internal services talking to each other do not need to go through public endpoints | 20:35 |
| samueldmq | gyee: and internal endpoints can use local addresses | 20:35 |
| samueldmq | gyee: so the port can be the same, and addresses different | 20:36 |
| gyee | sure, that's also possible | 20:36 |
| *** Jason10258 has joined #openstack-keystone | 20:36 | |
| samueldmq | gyee: for example, internal keystone endpoint could be localhost:5000, while for public I show 150.165.23.13:5000 | 20:36 |
| *** openstackgerrit has quit IRC | 20:37 | |
| *** jasondotstar has joined #openstack-keystone | 20:37 | |
| gyee | samueldmq, yes, that's possible | 20:37 |
| mylu | Hi guys I have a question about federation, about to mapping rules to be exact, is there anyone can help me with that? | 20:37 |
| *** jasondotstar has quit IRC | 20:37 | |
| samueldmq | gyee: so they make sense if I have different addresses and/or ports | 20:37 |
| samueldmq | gyee: so I could say an URL uniquely identifies and endpoint | 20:37 |
| *** openstackgerrit has joined #openstack-keystone | 20:37 | |
| samueldmq | gyee: is that right ? conceptually | 20:37 |
| gyee | samueldmq, both | 20:37 |
| gyee | could be different address and/or different ports | 20:38 |
| samueldmq | gyee: exactly | 20:38 |
| samueldmq | gyee: is my sentence above correct then ? | 20:38 |
| samueldmq | gyee: an URL shoudl uniquely idenitfy an endpoint | 20:39 |
| gyee | samueldmq, one sec | 20:39 |
| samueldmq | gyee: because if it doesn't, tehre is no reason to use different interfaces :) | 20:39 |
| samueldmq | gyee: sure | 20:39 |
| dstanek | samueldmq: endpoint is confusing sometimes because a single server can have multiple endpoints that point to the same controller on the same server | 20:39 |
| *** ayoung has quit IRC | 20:45 | |
| *** arunkant__ has joined #openstack-keystone | 20:45 | |
| *** fangzhou has joined #openstack-keystone | 20:46 | |
| samueldmq | dstanek: yeah | 20:47 |
| samueldmq | dstanek: the more I understand them, the more I think policy by URL would be appropriate | 20:48 |
| samueldmq | dstanek: my reasoning is: if you have different URLs, there is difference between different interfaces | 20:48 |
| *** arunkant_ has quit IRC | 20:48 | |
| samueldmq | then you could have different policies .. otherwise, if there is no difference between different interfaces (even in the network level), there is no reason to have different policies (and they have the same url) | 20:49 |
| samueldmq | if that makes sense ... | 20:49 |
| dstanek | samueldmq: so do you need to have a policy for each defined interface? if not what happends? | 20:50 |
| samueldmq | dstanek: if I want to have a policy per interface, I should have a URL per interface | 20:50 |
| samueldmq | dstanek: if I haven't different URLs, why do I even have different interfaces? | 20:51 |
| dstanek | samueldmq: but that doesn't answer my question :-) | 20:52 |
| dstanek | if i have 2 different URLs that point to the same service/endpoint how many policies do i need? | 20:52 |
| samueldmq | dstanek: it depneds on your choic | 20:53 |
| samueldmq | e | 20:53 |
| gyee | URL can be an endpoint for multiple services | 20:53 |
| samueldmq | gyee: for URL in the SC I understand as ADDRESS + PORT | 20:54 |
| samueldmq | gyee: so a single service | 20:54 |
| samueldmq | right ? | 20:54 |
| dstanek | samueldmq: what happens if you only provide a policy for one of the URLs? | 20:54 |
| samueldmq | dstanek: and specify the other as being the endpoint_url in ksmiddleware, what does it do ? | 20:55 |
| gyee | policy per URL doesn't make sense | 20:55 |
| gyee | URL can have multiple services | 20:56 |
| samueldmq | dstanek: gyee so I think a policy per endpoint_group makes sense | 20:56 |
| samueldmq | dstanek: gyee so we can group endpoints as we want | 20:56 |
| dstanek | samueldmq: http://internal.service:3000 goes to a load balancer that eventually hits service-A - https://public.service:3000 goes through public SSL terminators/load balancers etc. and eventually hits service-A | 20:56 |
| samueldmq | need | 20:56 |
| dstanek | samueldmq: do i need to specify two different policies? | 20:57 |
| *** spandhe has quit IRC | 20:57 | |
| gyee | samueldmq, yes, per endpoint group make sense | 20:57 |
| samueldmq | gyee: and the deployer chooses whatever makes sense to him | 20:57 |
| dstanek | samueldmq: that's why i was down on using URL in that review | 20:57 |
| samueldmq | dstanek: you could allow everything in the internal endpoint | 20:57 |
| samueldmq | dstanek: as that could be supposed to be used by services internally | 20:58 |
| samueldmq | dstanek: so everything allowed policy for internal interface, for example | 20:58 |
| samueldmq | dstanek: if that makes sense | 20:58 |
| dstanek | samueldmq: so do i need to specify two different policies? | 20:58 |
| samueldmq | dstanek: if you want to make them the same, you would both: i) associate the same policy with the 2 URLs | 20:59 |
| gyee | dstanek, endpoint group is much flexible | 20:59 |
| dstanek | gyee: i totally agree | 20:59 |
| samueldmq | dstanek: ii) define a policy for the service/region (what would be what we could get if you don't find a policy specific to that URL) | 20:59 |
| *** arunkant__ has quit IRC | 21:00 | |
| gyee | samueldqm, service and region are essentially "endpoint groups" | 21:00 |
| gyee | service is a collection of endpoint of the same service_id | 21:00 |
| samueldmq | dstanek: although having to assign the policies for 2 urls doesn't make sense I htink | 21:00 |
| gyee | region is a collection of services | 21:01 |
| dstanek | gyee: but i think samueldmq wants to allow different policies for different URLs - not sure if that's useful to a deployer | 21:01 |
| samueldmq | dstanek: hey, however I can't provide 2 different policies for the same endpoint today, even if they have different URLs | 21:01 |
| dstanek | samueldmq: right | 21:01 |
| samueldmq | dstanek: so we couldn't allow that, and have no way to restrict it on the server | 21:01 |
| samueldmq | dstanek: because it doesn't know anything | 21:01 |
| samueldmq | about them being the same endpoint at the end | 21:02 |
| gyee | URL by itself is meaningless | 21:02 |
| dstanek | that's why URL is conffusing...which one should be used? in reality it doesn't matter because the thing in the config just has to match what's in the DB - the string could be arbitrary | 21:02 |
| gyee | it is ambiguous | 21:02 |
| samueldmq | gyee: dstanek however we have the same issue with policy per endpoint_id | 21:03 |
| samueldmq | what does it happen if I have different policies for different endpoint ids that represent the same endpoint but in different interfaces | 21:03 |
| samueldmq | which one do I fetch ? | 21:03 |
| dstanek | samueldmq: i always thought the service would have a single value in it's config policy="my awesome service policy" and that string would match what's in the database | 21:04 |
| gyee | do we have an use case where policy is different for different interface? | 21:04 |
| gyee | I would hope not | 21:04 |
| dstanek | is there a need to have a single service protected by different policies? | 21:05 |
| samueldmq | gyee: maybe we haven't but we don't restrict that in the server | 21:05 |
| samueldmq | gyee: so we allow one to do so | 21:05 |
| gyee | dstanek, highly unlikely | 21:05 |
| gyee | dstanek, I can't think of one | 21:05 |
| dstanek | samueldmq: but you can't do it now by design | 21:05 |
| dstanek | why allow it if we don't need to? | 21:05 |
| samueldmq | dstanek: we don't need to allow it | 21:06 |
| samueldmq | dstanek: but how can we restrict it ? | 21:06 |
| dstanek | gyee: it would be easy enough to add that as a feature later - much harder to remove | 21:06 |
| gyee | sure | 21:06 |
| dstanek | samueldmq: see my comment a few lines up about how i thought it was supposed to work | 21:06 |
| samueldmq | dstanek: we could allow one to define its own policy id | 21:07 |
| samueldmq | dstanek: and one specify the policy id in the middleware | 21:07 |
| samueldmq | dstanek: so you could call your policy stanek's-awesome-policy | 21:08 |
| *** e0ne has quit IRC | 21:08 | |
| samueldmq | dstanek: and set your endpoint to fetch that | 21:08 |
| dstanek | samueldmq: right, i thought URL was picked arbitrarily as a way to know ahead of time what the value will be without having to wait for keystone to get an endpoint_id | 21:08 |
| dstanek | samueldmq: exactly, that's why i made the comment about it being arbitrary | 21:09 |
| samueldmq | dstanek: yes, and that can be done by allowing one to define the identifier | 21:09 |
| *** henrynash has joined #openstack-keystone | 21:09 | |
| *** ChanServ sets mode: +v henrynash | 21:09 | |
| samueldmq | dstanek: puppet can set id to be the encoded URL, if the deployer wants it | 21:09 |
| samueldmq | dstanek: and we could advice people to do so, but not being the only thing we allow | 21:10 |
| samueldmq | hmmmm ... that makes sense | 21:10 |
| dstanek | samueldmq: yep, it could be whatever they want. but as soon as you say it has to be a URL they will wonder which one... | 21:10 |
| samueldmq | dstanek: yeah, it can be whatever | 21:11 |
| samueldmq | dstanek: it can even be the deployer's shopping list that the deployer register on keystone as a policy json | 21:11 |
| *** lufix_ has quit IRC | 21:11 | |
| samueldmq | dstanek: and wants that fetched and applied to an endpoint's policy | 21:12 |
| samueldmq | dstanek: well ... really kidding :-) | 21:12 |
| samueldmq | dstanek: and identify that as /policies/my_shopping_list | 21:12 |
| samueldmq | gyee: you agree on this solution using custom ids (the user defines) and set what policy will be used in the endpoint by configuring that id | 21:16 |
| samueldmq | gyee: the id could be the url if one wants, or whatever :) | 21:16 |
| samueldmq | gyee: vs using the endpoint-group | 21:16 |
| gyee | absolutely | 21:17 |
| gyee | so as long as the custom endpoint ID is globally unique | 21:17 |
| samueldmq | gyee: we don't care about endpoint ids, we don't care about endpoints at all in this solution | 21:17 |
| samueldmq | gyee: you register your policy with gyee-prefered-id | 21:17 |
| samueldmq | gyee: and tell middleware to fetch policy with id gyee-prefered-id | 21:18 |
| samueldmq | gyee: that's all | 21:18 |
| dstanek | you would be specifying a policy ID rather than an endpoint ID | 21:18 |
| samueldmq | dstanek: exactly | 21:18 |
| gyee | how's that different from register policy with endpoint group? | 21:19 |
| gyee | just saying :) | 21:19 |
| samueldmq | gyee: you can have the id a priori | 21:19 |
| samueldmq | gyee: as you can define the policy's id | 21:19 |
| samueldmq | gyee: that's the motivation of using the URL | 21:19 |
| samueldmq | so CMS knows that a priori, if that makes sense | 21:20 |
| gyee | let me get this straight | 21:21 |
| gyee | 1) you can create endpoints with a custom ID so as long as the ID is globally unique | 21:22 |
| samueldmq | gyee: sure go ahead | 21:22 |
| samueldmq | gyee: no | 21:22 |
| gyee | 2) then assign a policy for the given endpoint ID | 21:22 |
| samueldmq | gyee: you create policies, and tell middleware to fetch that specific policy | 21:22 |
| samueldmq | gyee: dstanek oh .. that way we don't touch the endpoint constraint solution anymore, that could be using the endpoint ids as opposed to URLs | 21:23 |
| gyee | oh, policies with a custom ID? | 21:23 |
| samueldmq | gyee: yeah | 21:23 |
| gyee | wfm! | 21:23 |
| gyee | I like the solution | 21:24 |
| samueldmq | gyee: :-) and for your solution for endpoint constraint you can use the endpoint ids .. as you were planning a few patch sets ago ... (I think) | 21:24 |
| samueldmq | dstanek: gyee great then! I have to go home .. thanks for this conversation :-) | 21:25 |
| samueldmq | morganfainberg: ayoung cc ~ | 21:25 |
| samueldmq | ^ | 21:25 |
| gyee | sameldmq, super, thanks! | 21:26 |
| openstackgerrit | Roxana Gherle proposed openstack/keystonemiddleware: Send the correct user-agent to Keystone https://review.openstack.org/180769 | 21:26 |
| *** jk|osx has quit IRC | 21:27 | |
| *** edmondsw has quit IRC | 21:28 | |
| *** radez` is now known as radez_g0n3 | 21:35 | |
| *** yottatsa has joined #openstack-keystone | 21:41 | |
| *** hrou has joined #openstack-keystone | 21:42 | |
| openstackgerrit | Merged openstack/keystone-specs: Enable listing of role assignments in a project hierarchy https://review.openstack.org/187045 | 21:42 |
| *** diazjf has left #openstack-keystone | 21:43 | |
| yottatsa | gyee merge me merge me :) | 21:44 |
| gyee | say what? | 21:45 |
| yottatsa | gyee https://review.openstack.org/197379/ | 21:46 |
| yottatsa | this morning there was double CR+2 | 21:47 |
| gyee | oh, let me look | 21:48 |
| gyee | sorry I haven't read the whole thing yet | 21:48 |
| openstackgerrit | Theodore Ilie proposed openstack/keystone: Add test case for deleting endpoint with space in url https://review.openstack.org/196883 | 21:48 |
| yottatsa | sure! | 21:48 |
| Lactem | dstanek: I made the new patch set. | 21:49 |
| *** ayoung has joined #openstack-keystone | 21:51 | |
| *** ChanServ sets mode: +v ayoung | 21:51 | |
| *** lufix has quit IRC | 21:51 | |
| *** bknudson has quit IRC | 21:51 | |
| *** mylu has quit IRC | 21:54 | |
| *** ianbrown has joined #openstack-keystone | 21:55 | |
| *** Lactem has quit IRC | 21:57 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 21:58 | |
| *** jkomg has joined #openstack-keystone | 21:58 | |
| openstackgerrit | Jason Obrien proposed openstack/keystone: Updated docs for Keystone startup https://review.openstack.org/197225 | 22:02 |
| gyee | yottatsa, I like how you say "Carefully add ..." :D | 22:03 |
| *** chlong has joined #openstack-keystone | 22:10 | |
| yottatsa | gyee :) | 22:15 |
| yottatsa | Speaking about measurements | 22:16 |
| yottatsa | gyee, our current Keystone Icehouse setup (pki, galera backend, designated master) experience some problems with offsite dc | 22:17 |
| *** dims_ has joined #openstack-keystone | 22:17 | |
| yottatsa | average ping is 7-8ms | 22:18 |
| dstanek | yottatsa: what do you mean by local replica in that spec? | 22:19 |
| *** 20WABLD1U has joined #openstack-keystone | 22:19 | |
| *** 32NACAI4Z has joined #openstack-keystone | 22:19 | |
| yottatsa | dstanek: check out https://review.openstack.org/#/c/197379/3/specs/backlog/keystone-slaveification.rst,unified | 22:19 |
| yottatsa | dstanek: Proposed Change section | 22:20 |
| *** 20WABLD1U has left #openstack-keystone | 22:20 | |
| *** dims has quit IRC | 22:21 | |
| yottatsa | there is a deployment example illustration, where is Galera node, Keystone and HAProxy installed on one server | 22:21 |
| *** jk|osx has joined #openstack-keystone | 22:21 | |
| dstanek | yottatsa: why callout a local server? | 22:21 |
| dstanek | yottatsa: don't you just want to have a slave connection so that you can spread out the safe reads? | 22:22 |
| *** jkomg has quit IRC | 22:22 | |
| yottatsa | gyee, token issue on local MySQL: 110ms, on slow link: 340ms | 22:22 |
| *** Jason10258 has quit IRC | 22:23 | |
| yottatsa | dstanek: I just want to have a slave connection for every safe read | 22:23 |
| 32NACAI4Z | dstanek: Jenkins is about to +1 me. | 22:23 |
| yottatsa | dstanek, and deployer can decide on thier what to use as a slave | 22:24 |
| *** jsavak has quit IRC | 22:25 | |
| dstanek | 32NACAI4Z: ? | 22:25 |
| 32NACAI4Z | Oh I'm not sure why it changed my name. | 22:26 |
| yottatsa | I have 4 DC with RTT between them from 7 to 20 ms, so I prefer deployment I mentioned before | 22:26 |
| *** jsavak has joined #openstack-keystone | 22:26 | |
| *** 32NACAI4Z is now known as Lactem | 22:26 | |
| dstanek | yottatsa: that's why i was asking about the local replication; it sounds like you are suggesting that as a model since it's in the proposed change section | 22:27 |
| Lactem | That's better. dstanek: On Zuul, all the builds are almost done with success (and the two that sometimes fail already passed). | 22:27 |
| yottatsa | dstanek: it's just a description I've added on 3rd iteration | 22:28 |
| yottatsa | should I remove it? | 22:28 |
| Lactem | Wait never mind. That's just check, not gate. : / | 22:28 |
| Lactem | Wait but it doesn't have to go through gate until the +2s, so never mind that never mind. | 22:29 |
| *** chlong has quit IRC | 22:30 | |
| *** chlong has joined #openstack-keystone | 22:30 | |
| dstanek | Lactem: i won't go into the gate until you get a +A | 22:30 |
| Lactem | dstanek: +A? | 22:31 |
| gyee | yottatsa, dstanek, yeah, using local replica is a no brainer | 22:33 |
| gyee | I can live with a little bit of replication lag, this is no different than local caching | 22:35 |
| yottatsa | gyee, I've answered on comments | 22:36 |
| dstanek | gyee: yottatsa: what i don't get about the example is why a slave_connection is needed if you are active-active and each keystone has a database instance; can't you always read/write locally? | 22:36 |
| yottatsa | dstanek, technically you can, but Galera is not really like it | 22:37 |
| *** darrenc_ is now known as darrenc | 22:37 | |
| gyee | dstanek, if you always write locally, you may run into collisions | 22:37 |
| *** henrynash has quit IRC | 22:38 | |
| yottatsa | gyee, dstanek exactly | 22:38 |
| yottatsa | dstanek, here is the paper https://www.percona.com/blog/2012/11/20/understanding-multi-node-writing-conflict-metrics-in-percona-xtradb-cluster-and-galera/ | 22:38 |
| dstanek | but in the example you are writing through HAProxy that will distribute writes to any of the three servers right? | 22:39 |
| gyee | that example is for read I think | 22:39 |
| yottatsa | dstanek, no. I've named Galeras as a master and slave. It's done by "backup" option in this http://docs.openstack.org/high-availability-guide/content/ha-aa-haproxy.html config | 22:40 |
| yottatsa | every ``HAProxy`` connects to all Galera servers and all HAProxy use same Galera server in same time | 22:41 |
| yottatsa | So slave_connection is going local, and master is going on "Galera 1" via any of HAproxy. And if "Galera 1" went down, master is going on "Galera 2" | 22:42 |
| *** browne has quit IRC | 22:43 | |
| Lactem | dstanek: Jenkins gave the +1. :) | 22:43 |
| yottatsa | as you need no write to db in Kilo + fernet, its a perfect solution that gives you 60ms on token issue and 5-40 ms on validation | 22:44 |
| dstanek | yottatsa: i think your example is confusing and hides the use cases (i'm not a deployer, so this configuration may be common) | 22:47 |
| *** jsavak has quit IRC | 22:48 | |
| dstanek | yottatsa: there are two real benefits that should be called out. the possibility of a local replica to speed up reads and the reduction in database load on the write node | 22:48 |
| bigjools | hey. anyone else using testshib right now? | 22:49 |
| bigjools | I'm seeing it complain that my entity is missing, despite it appearing in their own list | 22:49 |
| *** jsavak has joined #openstack-keystone | 22:50 | |
| yottatsa | dstanek, I'll make another patchset. | 22:52 |
| openstackgerrit | Vladimir Eremin proposed openstack/keystone-specs: Keystone slaveification spec https://review.openstack.org/197379 | 22:53 |
| yottatsa | dstanek, gyee everything is fixed | 22:53 |
| yottatsa | up all night to send patch, up all night to get lucky )) | 22:55 |
| openstackgerrit | Roxana Gherle proposed openstack/python-keystoneclient: Change default endpoint type for Keystone v3 to 'public' https://review.openstack.org/185200 | 22:56 |
| *** topol has quit IRC | 22:56 | |
| *** jecarey has quit IRC | 22:57 | |
| *** jsavak has quit IRC | 22:58 | |
| yottatsa | dstanek, thank you, I've mentioned it | 22:58 |
| *** _hrou_ has joined #openstack-keystone | 23:06 | |
| openstackgerrit | Merged openstack/pycadf: ensure id is not empty https://review.openstack.org/194397 | 23:08 |
| *** _hrou_ has quit IRC | 23:11 | |
| yottatsa | dstanek, gyee: can you please re-vote? )) | 23:11 |
| *** _hrou_ has joined #openstack-keystone | 23:11 | |
| yottatsa | jenkins +1 | 23:11 |
| Lactem | Same, same. | 23:11 |
| *** hrou has quit IRC | 23:12 | |
| *** _hrou_ has quit IRC | 23:12 | |
| *** hrou has joined #openstack-keystone | 23:12 | |
| *** Lactem has quit IRC | 23:13 | |
| yottatsa | Lactem :) | 23:16 |
| *** piyanai has quit IRC | 23:19 | |
| *** Nakato_ is now known as Nakato | 23:19 | |
| *** fangzhou has quit IRC | 23:21 | |
| gyee | yottatsa, looks good! | 23:21 |
| *** fangzhou_ has joined #openstack-keystone | 23:22 | |
| *** ctina_ has joined #openstack-keystone | 23:22 | |
| *** stevemar has joined #openstack-keystone | 23:32 | |
| openstackgerrit | lifeless proposed openstack/keystone: Update requirements by hand. https://review.openstack.org/197773 | 23:34 |
| *** stevemar has quit IRC | 23:35 | |
| *** mylu has joined #openstack-keystone | 23:38 | |
| *** yottatsa has quit IRC | 23:38 | |
| *** browne has joined #openstack-keystone | 23:39 | |
| *** dsirrine_ has quit IRC | 23:40 | |
| openstackgerrit | lifeless proposed openstack/keystone: Update requirements by hand. https://review.openstack.org/197773 | 23:40 |
| *** gyee has quit IRC | 23:40 | |
| *** ctina_ has quit IRC | 23:41 | |
| openstackgerrit | Merged openstack/keystone: Consolidate the fernet provider issue_v3_token() https://review.openstack.org/196774 | 23:44 |
| *** jk|osx has quit IRC | 23:47 | |
| *** mylu has quit IRC | 23:52 | |
| *** dsirrine_ has joined #openstack-keystone | 23:53 | |
| *** trey has quit IRC | 23:53 | |
| *** mylu has joined #openstack-keystone | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!