| *** Kennan2 is now known as Kennan | 00:02 | |
| *** topol has joined #openstack-keystone | 00:03 | |
| *** ChanServ sets mode: +v topol | 00:03 | |
| *** topol has quit IRC | 00:08 | |
| *** vmbrasseur has quit IRC | 00:10 | |
| *** vmb is now known as vmbrasseur | 00:10 | |
| *** shadower49 has quit IRC | 00:23 | |
| *** shadower49 has joined #openstack-keystone | 00:23 | |
| *** RA_ has joined #openstack-keystone | 00:42 | |
| *** bknudson has joined #openstack-keystone | 00:49 | |
| *** ChanServ sets mode: +v bknudson | 00:49 | |
| *** mylu has quit IRC | 00:52 | |
| *** mylu has joined #openstack-keystone | 01:05 | |
| *** mylu has quit IRC | 01:17 | |
| *** diegows has quit IRC | 01:30 | |
| *** mylu has joined #openstack-keystone | 01:31 | |
| *** ngupta has joined #openstack-keystone | 01:34 | |
| *** abhirc has joined #openstack-keystone | 01:43 | |
| *** piyanai has quit IRC | 01:44 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 01:48 | |
| *** davechen has joined #openstack-keystone | 01:50 | |
| *** Kennan has quit IRC | 02:02 | |
| *** Kennan has joined #openstack-keystone | 02:02 | |
| *** lhcheng has joined #openstack-keystone | 02:05 | |
| *** ChanServ sets mode: +v lhcheng | 02:05 | |
| *** jamielennox is now known as jamielennox|away | 02:20 | |
| *** abhirc has quit IRC | 02:23 | |
| *** jamielennox|away is now known as jamielennox | 02:32 | |
| *** mylu has quit IRC | 02:32 | |
| *** topol has joined #openstack-keystone | 02:35 | |
| *** ChanServ sets mode: +v topol | 02:35 | |
| *** topol has quit IRC | 02:39 | |
| *** ngupta has quit IRC | 02:47 | |
| *** hakimo has joined #openstack-keystone | 02:52 | |
| *** hakimo_ has quit IRC | 02:55 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 03:20 | |
| *** gordc has joined #openstack-keystone | 03:26 | |
| *** dikonoor has joined #openstack-keystone | 03:28 | |
| *** openstackgerrit has quit IRC | 03:31 | |
| *** openstackgerrit has joined #openstack-keystone | 03:32 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Reject rule if assertion type unset https://review.openstack.org/216088 | 03:34 |
|---|---|---|
| *** ankita_wagh has joined #openstack-keystone | 03:54 | |
| *** gordc has quit IRC | 03:56 | |
| *** lhcheng has quit IRC | 04:21 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 04:23 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 04:34 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Use min and max on IntOpt option types https://review.openstack.org/212373 | 04:53 |
| *** hrou has quit IRC | 05:02 | |
| *** kiran-r has joined #openstack-keystone | 05:10 | |
| *** geoffarnold has joined #openstack-keystone | 05:11 | |
| *** geoffarnold has quit IRC | 05:15 | |
| *** geoffarnold has joined #openstack-keystone | 05:21 | |
| *** urulama has joined #openstack-keystone | 05:27 | |
| *** ankita_wagh has quit IRC | 05:41 | |
| *** ankita_wagh has joined #openstack-keystone | 05:41 | |
| *** henrynash has joined #openstack-keystone | 05:47 | |
| *** ChanServ sets mode: +v henrynash | 05:47 | |
| *** jamielennox is now known as jamielennox|away | 05:47 | |
| *** henrynash has quit IRC | 05:55 | |
| *** henrynash has joined #openstack-keystone | 05:58 | |
| *** ChanServ sets mode: +v henrynash | 05:58 | |
| *** stevemar has joined #openstack-keystone | 06:02 | |
| *** ChanServ sets mode: +v stevemar | 06:02 | |
| *** dikonoor has quit IRC | 06:04 | |
| stevemar | i wonder if jamielennox|away is truly away | 06:07 |
| *** urulama has quit IRC | 06:08 | |
| *** urulama has joined #openstack-keystone | 06:09 | |
| *** henrynash has quit IRC | 06:09 | |
| *** lsmola has joined #openstack-keystone | 06:11 | |
| *** Nirupama has joined #openstack-keystone | 06:18 | |
| *** geoffarnold is now known as geoffarnoldX | 06:21 | |
| *** _kiran_ has joined #openstack-keystone | 06:25 | |
| *** kiran-r has quit IRC | 06:27 | |
| *** geoffarnoldX is now known as geoffarnold | 06:27 | |
| *** geoffarnold is now known as geoffarnoldX | 06:29 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint_filter migrations into keystone core https://review.openstack.org/186988 | 06:50 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint filter into keystone core https://review.openstack.org/183377 | 06:50 |
| *** stevemar has quit IRC | 06:53 | |
| *** fhubik has joined #openstack-keystone | 07:02 | |
| *** ankita_wagh has quit IRC | 07:05 | |
| *** RA_ has quit IRC | 07:09 | |
| *** _kiran_ has quit IRC | 07:17 | |
| *** rajesht has joined #openstack-keystone | 07:24 | |
| rajesht | hi cores, | 07:24 |
| rajesht | need one more +2 on patch https://review.openstack.org/#/c/210365/ | 07:25 |
| *** paulose has joined #openstack-keystone | 07:32 | |
| paulose | hi is it a good practice to add users to admin role | 07:32 |
| *** henrynash has joined #openstack-keystone | 07:43 | |
| *** ChanServ sets mode: +v henrynash | 07:43 | |
| tobasco_ | can i run keystone in apache with and without ssl at the same time? | 07:44 |
| tobasco_ | i cannot get keystone ssl to work with ceilometer for example, im thinking about applying the ssl cert on the haproxy load balancer infront of keystone instead | 07:44 |
| *** yottatsa has joined #openstack-keystone | 07:50 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Ensure ephemeral user's user_id is url-safe https://review.openstack.org/215221 | 07:54 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Respect federated user name in tokens. https://review.openstack.org/211093 | 07:54 |
| *** pnavarro has joined #openstack-keystone | 07:59 | |
| *** yottatsa has quit IRC | 08:08 | |
| *** fhubik is now known as fhubik_brb | 08:09 | |
| *** paulose has quit IRC | 08:13 | |
| *** yottatsa has joined #openstack-keystone | 08:15 | |
| *** jistr has joined #openstack-keystone | 08:17 | |
| *** yottatsa has quit IRC | 08:23 | |
| *** yottatsa has joined #openstack-keystone | 08:25 | |
| *** urulama has quit IRC | 08:26 | |
| *** urulama has joined #openstack-keystone | 08:27 | |
| *** fhubik_brb is now known as fhubik | 08:31 | |
| *** yottatsa has quit IRC | 08:39 | |
| *** jistr has quit IRC | 08:45 | |
| *** jistr has joined #openstack-keystone | 08:47 | |
| *** shadower49 is now known as shadower | 08:48 | |
| *** henrynash has quit IRC | 08:50 | |
| *** pnavarro is now known as pnavarro|mtg | 08:55 | |
| openstackgerrit | Merged openstack/keystoneauth: Clean up exception messages https://review.openstack.org/214295 | 08:58 |
| *** jistr has quit IRC | 09:08 | |
| *** amakarov has joined #openstack-keystone | 09:15 | |
| *** katkapilatova has joined #openstack-keystone | 09:20 | |
| *** aix has joined #openstack-keystone | 09:20 | |
| *** lhinds has joined #openstack-keystone | 09:20 | |
| *** lhinds has quit IRC | 09:21 | |
| *** pnavarro|mtg is now known as pnavarro | 09:21 | |
| *** claudiub has joined #openstack-keystone | 09:23 | |
| *** rajesht_ has joined #openstack-keystone | 09:34 | |
| *** rajesht has quit IRC | 09:34 | |
| *** e0ne has joined #openstack-keystone | 09:51 | |
| *** davechen has left #openstack-keystone | 09:53 | |
| openstackgerrit | Merged openstack/keystone: Stop using deprecated assignment manager methods https://review.openstack.org/213371 | 09:58 |
| *** yottatsa has joined #openstack-keystone | 10:06 | |
| *** e0ne has quit IRC | 10:08 | |
| openstackgerrit | Merged openstack/keystone: Remove deprecated methods from assignment.Manager https://review.openstack.org/210174 | 10:08 |
| *** Kennan has quit IRC | 10:09 | |
| *** Kennan has joined #openstack-keystone | 10:10 | |
| *** fhubik is now known as fhubik_brb | 10:13 | |
| *** aix has quit IRC | 10:15 | |
| *** yottatsa has quit IRC | 10:18 | |
| *** e0ne has joined #openstack-keystone | 10:18 | |
| *** yottatsa has joined #openstack-keystone | 10:19 | |
| *** urulama has quit IRC | 10:31 | |
| *** marzif has joined #openstack-keystone | 10:31 | |
| *** urulama has joined #openstack-keystone | 10:31 | |
| *** ekarlso has quit IRC | 10:32 | |
| *** ekarlso has joined #openstack-keystone | 10:32 | |
| *** e0ne has quit IRC | 10:40 | |
| *** aix has joined #openstack-keystone | 10:48 | |
| *** jamielennox|away has quit IRC | 10:50 | |
| *** mhu has quit IRC | 10:51 | |
| *** jistr has joined #openstack-keystone | 10:52 | |
| *** nzeer has quit IRC | 10:54 | |
| *** Guest7770 has quit IRC | 10:55 | |
| *** jacorob has quit IRC | 10:55 | |
| *** eglute has quit IRC | 10:55 | |
| *** lbragstad has quit IRC | 10:55 | |
| *** jacorob has joined #openstack-keystone | 10:55 | |
| *** ctracey has quit IRC | 10:55 | |
| *** mhu has joined #openstack-keystone | 10:56 | |
| *** sudorandom has quit IRC | 10:56 | |
| *** blewis has joined #openstack-keystone | 10:56 | |
| *** akscram has quit IRC | 10:56 | |
| *** dikonoo has joined #openstack-keystone | 10:56 | |
| *** dikonoor has joined #openstack-keystone | 10:56 | |
| *** dikonoo has quit IRC | 10:56 | |
| *** blewis is now known as Guest5469 | 10:56 | |
| *** vmbrasseur has quit IRC | 10:56 | |
| *** ctracey has joined #openstack-keystone | 10:58 | |
| *** sudorandom has joined #openstack-keystone | 11:01 | |
| *** vmbrasseur has joined #openstack-keystone | 11:01 | |
| *** lbragstad has joined #openstack-keystone | 11:02 | |
| *** eglute has joined #openstack-keystone | 11:02 | |
| *** nzeer has joined #openstack-keystone | 11:02 | |
| *** akscram has joined #openstack-keystone | 11:03 | |
| *** jamielennox|away has joined #openstack-keystone | 11:04 | |
| *** jamielennox|away is now known as jamielennox | 11:04 | |
| *** ChanServ sets mode: +v jamielennox | 11:04 | |
| *** samueldmq has joined #openstack-keystone | 11:10 | |
| samueldmq | morning | 11:10 |
| *** abhirc has joined #openstack-keystone | 11:18 | |
| *** jaosorior has joined #openstack-keystone | 11:19 | |
| *** fhubik_brb is now known as fhubik | 11:22 | |
| *** topol has joined #openstack-keystone | 11:23 | |
| *** ChanServ sets mode: +v topol | 11:23 | |
| *** Nirupama has quit IRC | 11:27 | |
| *** topol has quit IRC | 11:28 | |
| samueldmq | any information we need to pass down to the service (from middleware) is done via env vars, right ? | 11:29 |
| *** gordc has joined #openstack-keystone | 11:43 | |
| *** rajesht_ has quit IRC | 12:06 | |
| *** shoutm has joined #openstack-keystone | 12:07 | |
| *** markvoelker_ has quit IRC | 12:10 | |
| *** piyanai has joined #openstack-keystone | 12:14 | |
| *** urulama has quit IRC | 12:15 | |
| *** raildo-afk is now known as raildo | 12:15 | |
| *** urulama has joined #openstack-keystone | 12:15 | |
| claudiub | hello, any keystone folks can look at this bug fix? https://review.openstack.org/#/c/211686/ | 12:16 |
| *** geoffarnoldX is now known as geoffarnold | 12:16 | |
| *** markvoelker has joined #openstack-keystone | 12:17 | |
| *** geoffarnold is now known as geoffarnoldX | 12:19 | |
| *** markvoelker has quit IRC | 12:19 | |
| *** markvoelker has joined #openstack-keystone | 12:20 | |
| *** piyanai has quit IRC | 12:20 | |
| *** markvoelker has quit IRC | 12:20 | |
| *** diegows has joined #openstack-keystone | 12:20 | |
| *** diegows has quit IRC | 12:21 | |
| *** abhirc has quit IRC | 12:22 | |
| *** vivekd has joined #openstack-keystone | 12:23 | |
| *** markvoelker has joined #openstack-keystone | 12:25 | |
| sileht | dolphm, hi, perhaps you can take a look to https://review.openstack.org/#/c/208965/ I have fixed your remarks, thx | 12:25 |
| *** daemontool__ has joined #openstack-keystone | 12:27 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Handle tokens created and quickly revoked with insufficient timestamp precision https://review.openstack.org/216236 | 12:27 |
| *** piyanai has joined #openstack-keystone | 12:27 | |
| *** daemontool_ has quit IRC | 12:29 | |
| *** edmondsw has joined #openstack-keystone | 12:31 | |
| *** jistr has quit IRC | 12:31 | |
| *** jistr has joined #openstack-keystone | 12:33 | |
| *** petertr7_away is now known as petertr7 | 12:37 | |
| *** doug-fish has joined #openstack-keystone | 12:48 | |
| *** bknudson has left #openstack-keystone | 12:50 | |
| marekd | dolphm: Hi. Anychances for revisiting https://review.openstack.org/#/c/215221 ? There were mostly nits, so should be easy to re-evaluate. And I would like to have this patch soon in master as I have a few chaines of patches depending on this one. | 12:55 |
| marekd | dolphm: another questions - so whenever we add new 'field' to the fernet payload, it will take some space no matter whether it's set or not, right? | 12:56 |
| dolphm | marekd: ++ | 12:57 |
| dolphm | marekd: and yes to your question | 12:57 |
| dolphm | marekd: it'll add at least a byte | 12:57 |
| marekd | ah, that's still better rather than 4bytes as we expect uuids to be 4 bytes. | 12:58 |
| dolphm | marekd: but because of the block cipher, may or may not impact the fernet token size *immediately* (but will impact us later on) | 12:58 |
| marekd | dolphm: i am thinking about this limit of 255 bytes | 12:58 |
| *** dsirrine has quit IRC | 12:58 | |
| marekd | if we mix project_id and user name we might break the limit. | 12:59 |
| *** yottatsa has quit IRC | 12:59 | |
| dolphm | marekd: especially if those aren't uuids | 12:59 |
| marekd | project_id is typically uuid | 12:59 |
| *** annasort has joined #openstack-keystone | 13:00 | |
| marekd | for the names - i am thinking whether some set of good practces "don't set username" will help. | 13:00 |
| dolphm | marekd: don't set username in the mapping? | 13:01 |
| marekd | dolphm: yes, if you don't set username it will take user_id value. | 13:01 |
| marekd | or simply "mind that username must go to fernet payoad and this can hit your performance" | 13:01 |
| dolphm | marekd: do we really need to support separate usernames then? | 13:01 |
| marekd | dolphm: separate name and id ? | 13:02 |
| dolphm | marekd: yes | 13:02 |
| dolphm | marekd: token size is not just performance, it's a user experience compromise... in this case, we're trading one UX issue for another (usernames available to OS vs smaller tokens) | 13:02 |
| marekd | dolphm: given that we allow users to set user_name and this may be different from user_id we would break this rule in fernet. | 13:03 |
| marekd | dolphm: our engines will fill username if they are missing, and this will be pretty much equal to user_id | 13:04 |
| marekd | the problem is if you need user_id to be say...email and name something nicer | 13:04 |
| dolphm | marekd: but why would people *need* that? | 13:04 |
| marekd | dolphm: I don't know - a service provider wants to be able to show "Dolph Mathews" in the dashboard rather that your e-mail address ? Now, while there mifht be lots of Dolphs we can assume there is only dolph.mathews@gmai.com Or worse...what if you identify users (user_id) by some random uuid known only to your IdP. | 13:06 |
| *** yottatsa has joined #openstack-keystone | 13:07 | |
| marekd | "Hello uu452123fhsdfsdF" doesn't sound nice. | 13:07 |
| dolphm | marekd: so, don't show a user "name" in horizon at all then | 13:07 |
| marekd | i am good with that. | 13:07 |
| marekd | dolphm: the question is whether we can break the logic and stop supporting name in the mapping rules. | 13:09 |
| marekd | and build it from given id. | 13:09 |
| *** yottatsa has quit IRC | 13:09 | |
| dolphm | marekd: that will be difficult, but it sounds like we should have that conversation with horizon folks and other federation stakeholders | 13:10 |
| marekd | will ask today during my weekly meeting what my folks think about it. | 13:10 |
| dolphm | marekd: my username has very little value to me beyond being an input to authentication... as an output of authentication, it's useless! | 13:11 |
| *** hrou has joined #openstack-keystone | 13:11 | |
| marekd | yeah, yet username is a required users's field. | 13:12 |
| *** dims has joined #openstack-keystone | 13:12 | |
| samueldmq | lbragstad, hey, are you around ? | 13:13 |
| dolphm | marekd: well that made sense when the only auth method in keystone was username + password :) | 13:15 |
| marekd | dolphm: uh, looks like bigger movement in OpenStack. | 13:17 |
| marekd | not sure if I should push for squeezing name in the fernet payload. | 13:17 |
| *** jsavak has joined #openstack-keystone | 13:17 | |
| marekd | dolphm: nevertheless i think those are more important: https://review.openstack.org/#/c/215221/5 and later https://review.openstack.org/#/c/202176/19 | 13:18 |
| *** curioswati has joined #openstack-keystone | 13:18 | |
| marekd | as those are kind of blockers. | 13:18 |
| *** yottatsa has joined #openstack-keystone | 13:18 | |
| *** richm has joined #openstack-keystone | 13:19 | |
| curioswati | Hello I am a newbie and want to contribute to keystone. I looked for low hanging fruits and found one to work on. Can anyone tell me how should I begin? I am totally new to openstack. | 13:20 |
| *** dsirrine has joined #openstack-keystone | 13:20 | |
| *** csoukup has joined #openstack-keystone | 13:21 | |
| *** eglute has quit IRC | 13:21 | |
| *** jecarey has joined #openstack-keystone | 13:21 | |
| samueldmq | dstanek, morning, need some advice on dealing with files in python :) | 13:22 |
| dstanek | samueldmq: ? | 13:22 |
| *** d34dh0r53 has quit IRC | 13:22 | |
| *** sigmavirus24_awa has quit IRC | 13:22 | |
| samueldmq | dstanek, https://review.openstack.org/#/c/200257/4/oslo_policy/policy.py | 13:22 |
| *** dolphm has quit IRC | 13:22 | |
| samueldmq | dstanek, if I have a single file to write to, and I have different evenlet processes, taht will eventually fail, right ? | 13:23 |
| samueldmq | dstanek, see david's comment there | 13:23 |
| marekd | samueldmq: what are evenlet processes? | 13:23 |
| *** dims has quit IRC | 13:23 | |
| *** e0ne has joined #openstack-keystone | 13:23 | |
| samueldmq | marekd, evenlet thread, I think that's what I meant | 13:23 |
| dstanek | samueldmq: that's a good question. i think you could run into trouble yes | 13:25 |
| samueldmq | dstanek, soo.. if I try to open the file, and if it fails because it's already occupied, I give up | 13:25 |
| *** jamielennox has quit IRC | 13:26 | |
| *** nicodemos has joined #openstack-keystone | 13:26 | |
| samueldmq | dstanek, wouldn't that be a valid mechanism to allow only a policy request per endpoint to keystone | 13:26 |
| samueldmq | ? | 13:26 |
| dstanek | samueldmq: it won't fail unless you do a lock of some sort | 13:26 |
| marekd | samueldmq: who will stop you from opening file twice? | 13:26 |
| marekd | os ? | 13:26 |
| *** jecarey has quit IRC | 13:26 | |
| dstanek | samueldmq: have you woked with file locks before? | 13:27 |
| *** sigmavirus24_awa has joined #openstack-keystone | 13:27 | |
| *** doug-fish has quit IRC | 13:27 | |
| samueldmq | marekd, I thought os would block that, but as dstack said, we need a lock | 13:27 |
| samueldmq | dstanek, yes, but not in python | 13:27 |
| samueldmq | dstanek, have we ever used that in our keystone code ? | 13:27 |
| dstanek | samueldmq: then you'll want to do the same thing | 13:28 |
| *** doug-fish has joined #openstack-keystone | 13:28 | |
| dstanek | samueldmq: no, because generally we don't write to files | 13:28 |
| samueldmq | dstanek, ok | 13:28 |
| *** eglute has joined #openstack-keystone | 13:28 | |
| *** bapalm_ has joined #openstack-keystone | 13:28 | |
| samueldmq | dstanek, so if we do a lock, you agree we avoid multiple requests to keystone per endpoint ? :-) | 13:28 |
| *** thiagop has joined #openstack-keystone | 13:29 | |
| *** d34dh0r53 has joined #openstack-keystone | 13:29 | |
| dstanek | samueldmq: also you'll want to use the file context manager so the file handle is always properly closes | 13:29 |
| samueldmq | dstanek, using 'with' ? | 13:29 |
| dstanek | samueldmq: how would that avoid it? | 13:29 |
| *** doug-fis_ has joined #openstack-keystone | 13:29 | |
| *** curioswati has left #openstack-keystone | 13:30 | |
| *** zzzeek has joined #openstack-keystone | 13:30 | |
| samueldmq | dstanek, so .. there is a single file to be written to, right ? if it has a lock, only an eventlet trhead will open it, the others will fail | 13:30 |
| samueldmq | dstanek, oh wait, does each eventlet thread will have its own ksclient instance ? | 13:31 |
| *** doug-fi__ has joined #openstack-keystone | 13:31 | |
| *** links has joined #openstack-keystone | 13:31 | |
| samueldmq | dstanek, 'will each eventlet thread have its own ksclient instance?' is better english :-) | 13:31 |
| dstanek | i think that you should catch the (i think) IOError when you try to obtain the exclusive lock and just don't write to the file. | 13:32 |
| *** yottatsa has quit IRC | 13:32 | |
| *** doug-fish has quit IRC | 13:32 | |
| *** jecarey has joined #openstack-keystone | 13:32 | |
| dstanek | you have the option then of returning "old" policy if you can safely read it from somewhere or just hitting Keystone for it | 13:32 |
| dstanek | ]i don't think you should fail the request | 13:32 |
| *** doug-fish has joined #openstack-keystone | 13:33 | |
| *** dolphm has joined #openstack-keystone | 13:33 | |
| *** yottatsa has joined #openstack-keystone | 13:33 | |
| *** doug-fis_ has quit IRC | 13:34 | |
| *** doug-fish has quit IRC | 13:34 | |
| samueldmq | dstanek, sure, if for a given evenlet thread it fails to open, just give up of updating the policy (don't reject the request, just continue without updating policy) | 13:34 |
| *** doug-fish has joined #openstack-keystone | 13:34 | |
| samueldmq | dstanek, that maybe because another thread's alreaady updating the policy | 13:34 |
| dstanek | samueldmq: at the point where you are writing you have already hit Keystone right? | 13:35 |
| samueldmq | dstanek, so we avoid N calls to keystone when the policy expires, where N is the number of evenelt threads | 13:35 |
| *** doug-fi__ has quit IRC | 13:36 | |
| dstanek | samueldmq: so you will acquire the lock before hitting keystone? | 13:36 |
| samueldmq | dstanek, yes | 13:36 |
| *** petertr7 is now known as petertr7_away | 13:36 | |
| samueldmq | dstanek, that's the idea | 13:37 |
| dstanek | samueldmq: so that would be in the Keystone code right? | 13:40 |
| *** piyanai has quit IRC | 13:41 | |
| samueldmq | dstanek, ksmiddleware, who writes to the file | 13:41 |
| *** bknudson has joined #openstack-keystone | 13:41 | |
| *** ChanServ sets mode: +v bknudson | 13:41 | |
| samueldmq | dstanek, as the file containing the dynamic-policy is written locally, in order to be read later at enforcement time | 13:41 |
| dstanek | samueldmq: :-) right, sorry. i meant just no oslo code. | 13:41 |
| samueldmq | dstanek, yes, called by ksmiddleware | 13:42 |
| samueldmq | dstanek, wait... actually that code belonds to oslo, since the file writes are handled there, i.e we use oslo to update_dynamic_policy | 13:42 |
| samueldmq | dstanek, but we can revisit that if you think it isn't the appropriate pleace | 13:43 |
| *** jamielennox|away has joined #openstack-keystone | 13:43 | |
| *** doug-fish has quit IRC | 13:43 | |
| dstanek | samueldmq: that's what i said above ^ you'll still hit keystone and will just be locked out of writing the file | 13:43 |
| *** jamielennox|away is now known as jamielennox | 13:43 | |
| *** ChanServ sets mode: +v jamielennox | 13:43 | |
| *** doug-fish has joined #openstack-keystone | 13:43 | |
| samueldmq | dstanek, hm, so the code to open/write to the file would need to live at middleware | 13:44 |
| *** topol has joined #openstack-keystone | 13:46 | |
| *** ChanServ sets mode: +v topol | 13:46 | |
| dstanek | samueldmq: if you want to prevent multiple keystone hits then yes, but you still have the possibility of a race condition so i don't know how safe it is | 13:47 |
| *** diazjf has joined #openstack-keystone | 13:47 | |
| samueldmq | dstanek, even if using atomic locks etc, we can have race conditions ? | 13:47 |
| *** doug-fish has quit IRC | 13:48 | |
| samueldmq | dstanek, actually there will alway be race condition, as they are all competing for opening the file, but the fact is that only 1 will open it, and if we use an atomic lock we can guarantee that | 13:48 |
| dstanek | samueldmq: sure, for the writes you won't have a race | 13:49 |
| dstanek | samueldmq: but you are expecting to be able to read the file while the lock is holding right? | 13:49 |
| *** geoffarnoldX is now known as geoffarnold | 13:50 | |
| *** doug-fish has joined #openstack-keystone | 13:50 | |
| samueldmq | dstanek, we write to a common temp file, and then atomically rename it ot the one we read | 13:50 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Materialized path mixin for hierarchical models https://review.openstack.org/198418 | 13:50 |
| samueldmq | dstanek, so I think that shouldnt be an issue | 13:51 |
| *** dims_ has joined #openstack-keystone | 13:52 | |
| samueldmq | bknudson, did we cover all your topics in the last meeting ? I am going to update that page, so making sure I am not leaving something that was uncovered .. | 13:53 |
| bknudson | samueldmq: just clear it out | 13:54 |
| samueldmq | bknudson, thanks | 13:54 |
| bknudson | I can add things to it again if I want to cover it. | 13:54 |
| *** yottatsa has quit IRC | 13:55 | |
| dstanek | samueldmq: i'm not sure you are correct. if thread A opens the file, thread B replaces the file and the thread A goes to read....what do you expect to happen? | 13:56 |
| *** petertr7_away is now known as petertr7 | 13:57 | |
| samueldmq | dstanek, so thread A could even read a half old and a half updated . | 13:57 |
| samueldmq | dstanek, right ? | 13:57 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Materialized path mixin for hierarchical models https://review.openstack.org/198418 | 13:58 |
| dstanek | samueldmq: i don't think it can ever get a half written file because of how unix file semantics works (unless they move happens between two different file systems | 13:59 |
| *** ngupta has joined #openstack-keystone | 13:59 | |
| dstanek | samueldmq: i think in general the reader will be OK, I just don't know if that's a unix guarantee | 13:59 |
| *** boris-42 has joined #openstack-keystone | 14:00 | |
| *** yottatsa has joined #openstack-keystone | 14:00 | |
| samueldmq | dstanek, so I need to check that case where A is reading and B is writting atomically (moving the tmp file) at the same time | 14:01 |
| samueldmq | dstanek, you know someone in the community I could check that with ? | 14:01 |
| dstanek | samueldmq: i think we need to find out what happens | 14:01 |
| dstanek | samueldmq: maybe start with -infra? | 14:02 |
| *** pnavarro has quit IRC | 14:02 | |
| samueldmq | dstanek, yes :) | 14:04 |
| dstanek | samueldmq: also we'll have to note that the tmp file and the policy file must be on the same file system | 14:04 |
| samueldmq | dstanek, also.. how does eventlet work ? does it creates multiple instantiations of the service or does it share the same instance? | 14:05 |
| samueldmq | dstanek, more specifically, would multiple evenlet threads share the same ksclient ? | 14:05 |
| *** henrynash has joined #openstack-keystone | 14:06 | |
| *** ChanServ sets mode: +v henrynash | 14:06 | |
| samueldmq | dstanek, about the tmp file, yes, we look at where the policy file is, and create a tmp in the same dir :) | 14:06 |
| dstanek | samueldmq: i don't think they share everything, but i'm not entirely sure which things are shared and which are not | 14:06 |
| dstanek | samueldmq: we'll also have to be very careful here since we are introducing a new attack vector | 14:07 |
| samueldmq | dstanek, yes because they will need to share the same .tmp file, maybe we just get hte policy file and add a .tmp at the end | 14:07 |
| samueldmq | dstanek, yes, but it's basically the same of having attacker updating the policy file directly, isn't it ? | 14:08 |
| *** jamielennox has quit IRC | 14:08 | |
| dstanek | samueldmq: yes and no. we don't do that right now so it doesn't matter. in the API where they are uploading a policy we know it's coming and can take proper action. in the new case we have to be careful that we can't be tricked on *any* request to write a policy | 14:09 |
| *** jamielennox|away has joined #openstack-keystone | 14:10 | |
| *** jamielennox|away is now known as jamielennox | 14:11 | |
| *** ChanServ sets mode: +v jamielennox | 14:11 | |
| *** marzif has quit IRC | 14:11 | |
| *** marzif has joined #openstack-keystone | 14:12 | |
| dstanek | samueldmq: so it looks like once the file is opened for read that we should be OK. it sounds like the file handle remains active and the file isn't actually deleted until it's closed. it's just that you can no longer see it through the filesystem. | 14:13 |
| openstackgerrit | Nikita Konovalov proposed openstack/python-keystoneclient: Fix logging of binary contentent in request https://review.openstack.org/183514 | 14:14 |
| samueldmq | dstanek, yeah, you looking at infra ? | 14:14 |
| samueldmq | so we're safe from that -) | 14:14 |
| samueldmq | :-) | 14:14 |
| dstanek | samueldmq: reading now... | 14:16 |
| dstanek | samueldmq: excellent. i had to look it up in one of my old unix books | 14:17 |
| *** narengan has joined #openstack-keystone | 14:17 | |
| *** nkinder has joined #openstack-keystone | 14:19 | |
| samueldmq | dstanek, nice, we just confirmed then, thanks for looking at it as well | 14:19 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Prevent exception due to missing id of LDAP entity https://review.openstack.org/207960 | 14:19 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Expose exception due to missing id of LDAP entity https://review.openstack.org/211088 | 14:19 |
| marekd | samueldmq: so is a eventlet green thread is one posix process/thread ? | 14:20 |
| *** petertr7 is now known as petertr7_away | 14:20 | |
| *** bknudson has quit IRC | 14:21 | |
| dstanek | marekd: no, eventlet is cooperative dispatch...no real threads afaik | 14:21 |
| samueldmq | dstanek, if we wanted to keep the file writing logic at oslo.policy, would it make sense to you to do something like (at ksmiddlewre): 1) oslo.lock_policy_file 2) ksclient.get_policy_from_keystone 3) oslo.write_policy_and_release | 14:21 |
| *** markvoelker has quit IRC | 14:21 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Prevent exception due to missing id of LDAP entity https://review.openstack.org/207960 | 14:21 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Expose exception due to missing id of LDAP entity https://review.openstack.org/211088 | 14:22 |
| samueldmq | dstanek, just to leave the file handling at oslo .. if that makes more sense | 14:22 |
| *** markvoelker has joined #openstack-keystone | 14:22 | |
| marekd | dstanek: so actaly if you open the file in one green thread, read n bytes, and start reading file in another green thread it will start from n+1'th byte? | 14:22 |
| marekd | as internally this is one posix process/thread etc etc | 14:23 |
| dstanek | samueldmq: my biggest concern there is that we'll have to be careful to unlock the file in a timely manner. if we use the context manager i think it's less of a concern | 14:23 |
| dstanek | marekd: no, ideally you'd have opened the file twice. once in each green "thread" | 14:23 |
| *** shoutm has quit IRC | 14:24 | |
| marekd | dstanek: a, it will give two fds | 14:24 |
| dstanek | marekd: the way i think of it (which may not be entirely technically accurate) is that eventlet has a list of "threads" which are really just objects. each time one of the objects call IO bound methods (and other things) it moves down the list and give another object the chance to execute | 14:25 |
| dstanek | marekd: yes, same as opening the file twice | 14:25 |
| marekd | yeah | 14:25 |
| samueldmq | dstanek, something like with lock(file): | 14:25 |
| marekd | from open(2): │16:25:20 +dstanek | marekd: the way i think of it (which may not be entirely │ breton_ | 14:25 |
| samueldmq | ? | 14:25 |
| samueldmq | ? | 14:25 |
| *** petertr7_away is now known as petertr7 | 14:25 | |
| marekd | Each open(2) of a file creates a new open file description; | 14:26 |
| marekd | thus, there may be multiple open file descriptions corresponding | 14:26 |
| marekd | to a file inode. | 14:26 |
| dstanek | marekd: exactly | 14:26 |
| * samueldmq is reading up | 14:26 | |
| samueldmq | nice :) | 14:27 |
| *** jasonsb has quit IRC | 14:27 | |
| dstanek | samueldmq: sure, i don't know what the new fangled way to do it is. in the past i've used fcntl (a stdlib module) to do this soft of thing | 14:27 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Make application initialization a critical section https://review.openstack.org/210001 | 14:27 |
| dstanek | samueldmq: fcntl(f.fileno(), fcntl.LOCK_EX|fcntl.LOCK_NB) -- or something like that | 14:28 |
| *** yottatsa has quit IRC | 14:28 | |
| *** yottatsa has joined #openstack-keystone | 14:29 | |
| *** tonytan4ever has joined #openstack-keystone | 14:29 | |
| samueldmq | dstanek, I am still digesting , looking at the fcntl module | 14:29 |
| *** narengan has quit IRC | 14:29 | |
| *** narengan has joined #openstack-keystone | 14:30 | |
| *** shoutm has joined #openstack-keystone | 14:30 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 14:30 |
| dstanek | samueldmq: fcntl.lockf :-) | 14:30 |
| samueldmq | dstanek, hm, so this does exactly the locking thing | 14:31 |
| *** ngupta has quit IRC | 14:31 | |
| *** diazjf has quit IRC | 14:31 | |
| samueldmq | dstanek, yeah, "lockf - apply, test or remove a POSIX lock on an open file " | 14:31 |
| dstanek | samueldmq: actually flock is the right thing here....my memory isn't so great in my advanced age | 14:31 |
| dstanek | samueldmq: yes, that is using system calls to lock the file | 14:31 |
| samueldmq | dstanek, advanced age ? that made me laugh :-) | 14:32 |
| *** jecarey has quit IRC | 14:33 | |
| dstanek | i think it may be breakfast time | 14:34 |
| samueldmq | dstanek, so looks like there is some coding to be done :) | 14:34 |
| samueldmq | dstanek, bon apetit | 14:34 |
| *** narengan has quit IRC | 14:34 | |
| *** alejandrito has joined #openstack-keystone | 14:37 | |
| *** jecarey has joined #openstack-keystone | 14:40 | |
| *** bapalm_ has quit IRC | 14:41 | |
| *** diazjf has joined #openstack-keystone | 14:42 | |
| *** jecarey has quit IRC | 14:44 | |
| *** pgbridge has quit IRC | 14:44 | |
| *** bapalm- has joined #openstack-keystone | 14:45 | |
| htruta | is anyone else having problems on running keystone tests? | 14:48 |
| htruta | tox gives me "Double requirement given" | 14:48 |
| *** pgbridge has joined #openstack-keystone | 14:49 | |
| *** yottatsa has quit IRC | 14:51 | |
| *** fhubik is now known as fhubik_brb | 14:51 | |
| *** yottatsa has joined #openstack-keystone | 14:51 | |
| *** fhubik_brb is now known as fhubik | 14:52 | |
| *** jecarey has joined #openstack-keystone | 14:57 | |
| krotscheck | Does keystone make use of any nonbasic http headers? | 14:58 |
| morganfainberg | Yes | 14:58 |
| krotscheck | morganfainberg: Which ones? | 14:59 |
| morganfainberg | X-auth-token? | 14:59 |
| krotscheck | kk | 14:59 |
| krotscheck | ANything else? | 14:59 |
| morganfainberg | X-subject-token | 14:59 |
| dolphm | krotscheck: and X-Subject-Token | 14:59 |
| krotscheck | Awesome, thanks | 14:59 |
| morganfainberg | Umm... Maybe one more | 14:59 |
| *** shoutm has quit IRC | 15:00 | |
| dolphm | morganfainberg: i can't think of any that are used externally | 15:00 |
| *** jecarey_ has joined #openstack-keystone | 15:00 | |
| *** jecarey_ has quit IRC | 15:00 | |
| *** jecarey has quit IRC | 15:00 | |
| morganfainberg | dolphm: yeah | 15:00 |
| *** jecarey has joined #openstack-keystone | 15:00 | |
| samueldmq | morganfainberg, Cache-Control ? | 15:00 |
| morganfainberg | samueldmq: that is http spec | 15:00 |
| samueldmq | if that's non-basic | 15:00 |
| dolphm | krotscheck: ignore the ones that are "new in version 3.4 -- those aren't used outside keystone https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3.rst#headers | 15:00 |
| morganfainberg | At this point | 15:01 |
| samueldmq | morganfainberg, k got it | 15:01 |
| dolphm | morganfainberg: those really shouldn't be documented as part of that spec, at all | 15:01 |
| krotscheck | The list considered basic is "Accept, Accept-language, Content-type, cache-control, content-language, expires, last-modified, pragma" | 15:01 |
| *** geoffarnold is now known as geoffarnoldX | 15:01 | |
| *** mpmsimo has joined #openstack-keystone | 15:01 | |
| morganfainberg | dolphm: fair enough | 15:01 |
| dolphm | morganfainberg: i take that back -- they're all used for tokenless authz? | 15:02 |
| morganfainberg | dolphm: oooh yah maybe | 15:02 |
| krotscheck | Hooookay. | 15:02 |
| dolphm | morganfainberg: against keystone? | 15:02 |
| dolphm | morganfainberg: or auth_token? | 15:02 |
| krotscheck | Ok, so I'd like to add some middleware to keystone, and from the number of headers y'all have it makes a bit more sense to do it in code rather than in paste.ini | 15:03 |
| morganfainberg | Hmm. Keystone | 15:03 |
| * krotscheck has specs and docs and things for the curious. | 15:03 | |
| *** mpmsimo1 has joined #openstack-keystone | 15:03 | |
| morganfainberg | Auth token doesn't use the token less stuff yet (ever?) | 15:03 |
| krotscheck | My question is: Where would that live? | 15:03 |
| openstackgerrit | Andrey Pavlov proposed openstack/keystone: Add S3 signature v4 checking https://review.openstack.org/215481 | 15:04 |
| morganfainberg | krotscheck: don't do it in paste-ini ... Even if we had no other headers | 15:04 |
| krotscheck | morganfainberg: Is there a single magic place where I can add it then? | 15:04 |
| * krotscheck is grepping through code right now to try to understand how the app is set up. | 15:05 | |
| morganfainberg | Depends what are they? | 15:05 |
| morganfainberg | And are they sent out or consumed by keystone? | 15:05 |
| morganfainberg | Or both | 15:05 |
| *** narengan has joined #openstack-keystone | 15:05 | |
| krotscheck | morganfainberg: https://review.openstack.org/#/c/199769/9/ironic/api/app.py | 15:06 |
| krotscheck | Example | 15:06 |
| *** mpmsimo has quit IRC | 15:06 | |
| morganfainberg | Ok I don't know pecan | 15:06 |
| dolphm | krotscheck: "from the number of headers y'all have it makes a bit more sense to do it in code rather than in paste.ini" what does this mean? | 15:06 |
| samueldmq | henrynash, dolphm fyi: change #208609 now contains tests as you guys asked for it (in its parent change) | 15:06 |
| samueldmq | and should be very easy to review/merge, given that the change is very simple | 15:07 |
| morganfainberg | Does that mean cors headers are sent on our requests or consumed by keystone there? (I assume the former based on how cors works) | 15:07 |
| morganfainberg | dolphm: it means he isn't wedging things into our paste pipeline | 15:07 |
| *** mpmsimo1 has quit IRC | 15:08 | |
| krotscheck | dolphm: The TL/DR version is that there's a middleware that permits breaking the browser sandbox, but it needs to have a list of nonstandard headers explicitly provided to it. You can do that in paste.ini, or in oslo.confg, however the nature of oslo_middleware and oslo-config-generator is that you can't make App-specific properties show up in generated config files. Which leaves me with two things: 1- custom documentation for every single | 15:08 |
| krotscheck | API, or 2- tell the middleware which custom headers are being used. | 15:08 |
| krotscheck | morganfainberg: Sortof. The "Allow headers" field is "Here's a header that the client is permitted to send to us". The "expose headers" field is "Here's a list of headers that the client is permitted to read on our response. | 15:09 |
| dolphm | krotscheck: 3) change the nature of oslo-config-generator ? | 15:09 |
| morganfainberg | Hmm.. Not sure where to put that atm... | 15:11 |
| krotscheck | dolphm... and then propagate the new config markup to all the projects? | 15:11 |
| dolphm | krotscheck: i don't know -- where/how would you test keystone running with CORS? | 15:12 |
| * morganfainberg wants to see paste die. But I know that isn't reasonable. | 15:12 | |
| krotscheck | dolphm: Well, the middleware itself is pretty hardcore tested already. The way I'd add tests to keystone is to add header checks to make sure no new added headers sneak in without our knowledge. | 15:12 |
| krotscheck | morganfainberg: Well, I see pasteinit pointing at all the generators in the service.py... | 15:13 |
| morganfainberg | Yes. We are working to collapse that into a single thing | 15:13 |
| morganfainberg | They way we have it sucks :( | 15:14 |
| krotscheck | morganfainberg: Is that likely to happen before feature freeze? | 15:14 |
| morganfainberg | Dunno | 15:14 |
| krotscheck | Ok, lemme rephrase that. Is that likely to happen _this week_? | 15:14 |
| krotscheck | Because feature freeze. | 15:14 |
| morganfainberg | Dunno | 15:14 |
| morganfainberg | And that isn't impacted by ff | 15:14 |
| krotscheck | Ok, so what's your recommended approach? | 15:14 |
| *** piyanai has joined #openstack-keystone | 15:15 | |
| krotscheck | Note: I can use paste.ini things, but that requires a ton more documentation and is less testable. | 15:15 |
| krotscheck | And if I have to do that for every service in openstack there's no way I'm going to get it done before feature freeze. | 15:15 |
| morganfainberg | I am unsure how you can place in Oslo middleware except in paste until we are off our awful wsgi code | 15:15 |
| morganfainberg | I would look to see if you can put it in the base wsgi.py stuff | 15:16 |
| morganfainberg | As low | 15:16 |
| morganfainberg | Level as possible | 15:16 |
| morganfainberg | That way as long as it is tested we can worry about carrying that forward as we move away from the icky paste stuff | 15:17 |
| morganfainberg | krotscheck: in here https://github.com/openstack/keystone/blob/master/keystone/common/wsgi.py | 15:18 |
| morganfainberg | Probably | 15:18 |
| krotscheck | Checking | 15:19 |
| morganfainberg | In render response | 15:19 |
| morganfainberg | Is my guess | 15:19 |
| *** urulama has quit IRC | 15:20 | |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/common/wsgi.py#L736 | 15:20 |
| *** urulama has joined #openstack-keystone | 15:20 | |
| *** geoffarnoldX is now known as geoffarnold | 15:22 | |
| *** fhubik has quit IRC | 15:27 | |
| *** geoffarnold has quit IRC | 15:28 | |
| *** jsavak has quit IRC | 15:30 | |
| *** jsavak has joined #openstack-keystone | 15:31 | |
| *** narengan has quit IRC | 15:31 | |
| *** narengan has joined #openstack-keystone | 15:32 | |
| *** jasonsb has joined #openstack-keystone | 15:35 | |
| *** jistr has quit IRC | 15:35 | |
| *** dims__ has joined #openstack-keystone | 15:36 | |
| *** tellesnobrega has quit IRC | 15:37 | |
| *** david-ly_ is now known as david-lyle | 15:38 | |
| *** jistr has joined #openstack-keystone | 15:38 | |
| *** jsavak has quit IRC | 15:39 | |
| *** dims_ has quit IRC | 15:39 | |
| *** jsavak has joined #openstack-keystone | 15:40 | |
| *** raildo is now known as raildo-afk | 15:42 | |
| *** raildo-afk is now known as raildo | 15:42 | |
| *** e0ne has quit IRC | 15:42 | |
| *** tellesnobrega has joined #openstack-keystone | 15:43 | |
| *** e0ne has joined #openstack-keystone | 15:44 | |
| *** lhcheng has joined #openstack-keystone | 15:47 | |
| *** ChanServ sets mode: +v lhcheng | 15:47 | |
| *** doug-fish has quit IRC | 15:49 | |
| *** doug-fish has joined #openstack-keystone | 15:49 | |
| openstackgerrit | Olivier Pilotte proposed openstack/keystone-specs: Accepts Group IDs from the IdP without domain https://review.openstack.org/216308 | 15:52 |
| *** alejandrito has quit IRC | 15:53 | |
| *** doug-fish has quit IRC | 15:54 | |
| *** gyee has joined #openstack-keystone | 15:54 | |
| *** ChanServ sets mode: +v gyee | 15:54 | |
| *** petertr7 is now known as petertr7_away | 15:56 | |
| *** katkapilatova has left #openstack-keystone | 15:57 | |
| *** yottatsa has quit IRC | 15:58 | |
| *** ngupta has joined #openstack-keystone | 15:58 | |
| *** yottatsa has joined #openstack-keystone | 16:00 | |
| *** geoffarnold has joined #openstack-keystone | 16:01 | |
| *** bknudson has joined #openstack-keystone | 16:01 | |
| *** ChanServ sets mode: +v bknudson | 16:01 | |
| *** doug-fish has joined #openstack-keystone | 16:05 | |
| *** links has quit IRC | 16:08 | |
| *** mpmsimo has joined #openstack-keystone | 16:08 | |
| *** urulama has quit IRC | 16:11 | |
| *** urulama has joined #openstack-keystone | 16:12 | |
| *** __dstanek__ has joined #openstack-keystone | 16:12 | |
| *** mpmsimo has quit IRC | 16:12 | |
| *** dims__ has quit IRC | 16:12 | |
| *** jistr has quit IRC | 16:13 | |
| *** dims has joined #openstack-keystone | 16:13 | |
| __dstanek__ | as my son says, "everything is awesome!" | 16:13 |
| *** dims is now known as dims__ | 16:13 | |
| *** marzif has quit IRC | 16:18 | |
| *** _cjones_ has joined #openstack-keystone | 16:19 | |
| samueldmq | __dstanek__, ++ | 16:20 |
| samueldmq | gyee, ping - need to check some requirements on policies with you, as youre the stackholder for this atm :-) | 16:20 |
| *** narengan has quit IRC | 16:24 | |
| *** BAKfr has quit IRC | 16:25 | |
| *** BAKfr has joined #openstack-keystone | 16:26 | |
| *** doug-fish has quit IRC | 16:31 | |
| *** doug-fish has joined #openstack-keystone | 16:31 | |
| *** jsavak has quit IRC | 16:34 | |
| *** narengan has joined #openstack-keystone | 16:34 | |
| *** jsavak has joined #openstack-keystone | 16:38 | |
| gyee | samueldmq, sure, let me email | 16:41 |
| *** jsavak has quit IRC | 16:42 | |
| samueldmq | gyee, k ping me when you're available :-) | 16:42 |
| *** dims__ has quit IRC | 16:43 | |
| *** jsavak has joined #openstack-keystone | 16:43 | |
| *** tonytan4ever has quit IRC | 16:45 | |
| *** dims__ has joined #openstack-keystone | 16:45 | |
| *** lhcheng has quit IRC | 16:52 | |
| *** ankita_wagh has joined #openstack-keystone | 16:53 | |
| *** piyanai has quit IRC | 16:54 | |
| *** tonytan4ever has joined #openstack-keystone | 16:55 | |
| *** urulama is now known as urulama__ | 16:56 | |
| *** diegows has joined #openstack-keystone | 17:00 | |
| dims__ | __dstanek__: morganfainberg: or other policy folks... please bless this review? https://review.openstack.org/#/c/215868/ | 17:00 |
| *** piyanai has joined #openstack-keystone | 17:00 | |
| morganfainberg | Hi. Will look as soon as I order breakfast | 17:00 |
| dims__ | thanks morganfainberg | 17:01 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Tests for projects acting as domains https://review.openstack.org/211219 | 17:01 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for projects acting as domains https://review.openstack.org/213448 | 17:01 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Unit tests for is_domain field in project's table https://review.openstack.org/212045 | 17:01 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Replicate domain info in projects table https://review.openstack.org/211170 | 17:01 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project name constraints https://review.openstack.org/158372 | 17:01 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain parameter to get_project_by_name https://review.openstack.org/210600 | 17:01 |
| dstanek | morganfainberg: i may beat you to it | 17:02 |
| morganfainberg | dstanek: hehe | 17:02 |
| *** topol has quit IRC | 17:04 | |
| * dims__ ready to be the referee | 17:04 | |
| *** mpmsimo has joined #openstack-keystone | 17:05 | |
| openstackgerrit | Olivier Pilotte proposed openstack/keystone-specs: Accepts Group IDs from the IdP without domain https://review.openstack.org/216308 | 17:07 |
| *** roxanaghe has joined #openstack-keystone | 17:08 | |
| *** doug-fish has quit IRC | 17:08 | |
| *** doug-fish has joined #openstack-keystone | 17:09 | |
| *** mpmsimo has quit IRC | 17:09 | |
| morganfainberg | dims__: photo finish!! | 17:10 |
| dims__ | haha | 17:11 |
| dims__ | thanks to both of you | 17:11 |
| morganfainberg | +A | 17:11 |
| *** marzif has joined #openstack-keystone | 17:12 | |
| * morganfainberg tags dstanek in for the next review | 17:12 | |
| *** doug-fish has quit IRC | 17:13 | |
| *** mylu has joined #openstack-keystone | 17:13 | |
| *** jecarey has quit IRC | 17:14 | |
| dstanek | morganfainberg: sure | 17:15 |
| morganfainberg | Hehe | 17:15 |
| morganfainberg | dstanek: any hope of getting flask-y things this cycle? | 17:15 |
| morganfainberg | dolphm: I totally am going to try roasting my own coffee. I expect it to be awful :P | 17:16 |
| morganfainberg | But I'm going to send you some :P | 17:16 |
| *** dsirrine has quit IRC | 17:17 | |
| dstanek | morganfainberg: i think partially yes, i was working on breaking up a couple more patches yesterday. i've been changing lots of infrastructural things like wsgi to test things all working | 17:17 |
| morganfainberg | Nod | 17:17 |
| *** marzif has quit IRC | 17:17 | |
| dstanek | morganfainberg: that sounds like a lot of work | 17:18 |
| morganfainberg | Yah. It does. | 17:18 |
| openstackgerrit | Merged openstack/keystonemiddleware: Allow to use oslo.config without global CONF https://review.openstack.org/208965 | 17:18 |
| morganfainberg | Also if you have a few i'd like a full review of keystoneauth | 17:19 |
| morganfainberg | Anything that looks awful. | 17:19 |
| morganfainberg | I want to get it into g-r | 17:19 |
| morganfainberg | But we need 1.0 for that | 17:19 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Some fixes in the is_domain field creation https://review.openstack.org/215167 | 17:19 |
| *** petertr7_away is now known as petertr7 | 17:20 | |
| *** aix has quit IRC | 17:20 | |
| *** samleon has joined #openstack-keystone | 17:22 | |
| *** urulama__ has quit IRC | 17:23 | |
| *** urulama__ has joined #openstack-keystone | 17:24 | |
| *** ankita_wagh has quit IRC | 17:24 | |
| morganfainberg | mordred jamielennox: just approved the backlog of ksa patches | 17:25 |
| morganfainberg | I want to wind down dev if at all possible for 1.0 before the end of the week. | 17:25 |
| mordred | morganfainberg: woot! | 17:25 |
| mordred | ++ | 17:25 |
| morganfainberg | Unless we really have missed on things. | 17:25 |
| morganfainberg | So look at -1 Jenkins etc patches and les see if we want them | 17:25 |
| morganfainberg | And I'll poke jamielennox later today to see if we need to land anything else specific | 17:26 |
| morganfainberg | And try and corral some keystone-cores to full review ksa1 | 17:27 |
| *** diegows has quit IRC | 17:29 | |
| *** lhcheng has joined #openstack-keystone | 17:31 | |
| *** ChanServ sets mode: +v lhcheng | 17:31 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Stops using deprecated assignment manager methods https://review.openstack.org/216347 | 17:31 |
| *** alextricity has joined #openstack-keystone | 17:33 | |
| dstanek | htruta: i don't know when to review all that stuff. it's still changing so frequently | 17:33 |
| *** mylu has quit IRC | 17:34 | |
| *** mylu has joined #openstack-keystone | 17:35 | |
| *** dsirrine has joined #openstack-keystone | 17:35 | |
| *** mylu has quit IRC | 17:36 | |
| *** piyanai has quit IRC | 17:36 | |
| *** mylu has joined #openstack-keystone | 17:36 | |
| dstanek | quick one: https://review.openstack.org/#/c/210478/ | 17:36 |
| *** dikonoor has quit IRC | 17:40 | |
| *** ankita_wagh has joined #openstack-keystone | 17:43 | |
| morganfainberg | It is amazing how much better I can see with glasses :P | 17:44 |
| krotscheck | morganfainberg: All this stuff in wsgi.py seems... vendored? | 17:44 |
| htruta | dstanek: it was just a rebase... I was having merge problems | 17:45 |
| morganfainberg | krotscheck: it is somewhat. But that is where we manage the requests. Once we move to flask that goes away | 17:45 |
| htruta | dstanek: https://review.openstack.org/#/c/212045 this one is a very good start :D | 17:45 |
| morganfainberg | krotscheck: so that is where I would place it to be processed on every request and it will get ported over to $better_thing once we ditch this custom framework thing | 17:46 |
| krotscheck | morganfainberg: I... have a slightly different proposal? | 17:47 |
| krotscheck | I have zero idea if itll work | 17:47 |
| morganfainberg | Sure. If it involves paste im going to cry | 17:47 |
| morganfainberg | Just FYI | 17:47 |
| krotscheck | It sortof involves paste. | 17:47 |
| * morganfainberg cries | 17:47 | |
| morganfainberg | See what you did? | 17:48 |
| krotscheck | But really just creates a uniform app factory | 17:48 |
| *** doug-fish has joined #openstack-keystone | 17:48 | |
| *** __dstanek__ has quit IRC | 17:48 | |
| morganfainberg | Yeah I don't want to add anything to the paste pipeline people might remove / break by accident | 17:48 |
| *** browne has joined #openstack-keystone | 17:48 | |
| morganfainberg | We have enough issues with that as is | 17:48 |
| morganfainberg | If that makes sense? | 17:48 |
| morganfainberg | I am hoping we get it down to keystone is a single entry and covers all the things (our APIs are not optional and cannot be turned off) | 17:49 |
| krotscheck | Right | 17:51 |
| krotscheck | morganfainberg: I'm currently looking at what glance does. | 17:51 |
| krotscheck | And I think it might be adaptable. | 17:51 |
| krotscheck | The paste.ini is here: https://github.com/openstack/glance/blob/master/etc/glance-api-paste.ini#L37 | 17:52 |
| krotscheck | And the root_app_factory referecned is here: https://github.com/openstack/glance/blob/master/glance/api/__init__.py | 17:52 |
| *** dsirrine has quit IRC | 17:52 | |
| *** Ephur has joined #openstack-keystone | 17:53 | |
| krotscheck | But looking at that, and your comments, the work necessary to make that a thing might be too impactful | 17:53 |
| morganfainberg | I would be much happier if this change involved zero paste-ini changes | 17:53 |
| *** csoukup has quit IRC | 17:53 | |
| krotscheck | Ok, well, can you provide me with a more specific approach than *hand wavey* somewhere in that vendored package that may be overwritten by a vendoring update? | 17:53 |
| morganfainberg | If there is no other good way ill accept paste-ini. But i'd rather not let deployers screw this bit up by accident/on purpose | 17:53 |
| *** jasonsb_ has joined #openstack-keystone | 17:54 | |
| *** Ephur has quit IRC | 17:54 | |
| morganfainberg | If you put it in render_response and add a test to ensure it is there | 17:54 |
| *** mylu has quit IRC | 17:54 | |
| *** jasonsb has quit IRC | 17:54 | |
| *** mylu has joined #openstack-keystone | 17:54 | |
| morganfainberg | The censoring bits are going away and we have carried thst for a long time without direct updates / copy paste | 17:55 |
| krotscheck | That's... not actually a place I can add middleware. | 17:55 |
| krotscheck | Like, where's the _app_ created. | 17:55 |
| morganfainberg | Hmm. | 17:55 |
| krotscheck | I see these "ComposingRouter" things | 17:55 |
| morganfainberg | This as real middleware sucks :( | 17:55 |
| morganfainberg | But uhhh | 17:55 |
| morganfainberg | If it is | 17:55 |
| krotscheck | But those don't extend Application | 17:55 |
| krotscheck | Which seems to be the thing we want | 17:55 |
| morganfainberg | Right. | 17:56 |
| morganfainberg | Hmm let me | 17:56 |
| morganfainberg | Find the base application thing | 17:56 |
| * morganfainberg dislikes middleware unless it is legitimately optional. | 17:56 | |
| morganfainberg | If not having this would break the world if probably should be baked in | 17:57 |
| morganfainberg | But i get why it is done this way | 17:57 |
| krotscheck | I just found a thing called initialize_application() | 17:57 |
| krotscheck | Is that a thing? | 17:57 |
| morganfainberg | Maybe? Im on my phone trying to finish late breakfast :P | 17:57 |
| krotscheck | kk | 17:57 |
| morganfainberg | Hmm https://github.com/openstack/keystone/blob/master/keystone/service.py | 17:58 |
| dstanek | krotscheck: what do you mean by is that a thing? | 17:58 |
| morganfainberg | That is where we have our app factories | 17:58 |
| *** mylu has quit IRC | 17:59 | |
| krotscheck | Ok, so all apps that are created go through there? | 17:59 |
| *** jecarey has joined #openstack-keystone | 17:59 | |
| *** rm_work is now known as rm_work|away | 18:00 | |
| morganfainberg | And in https://github.com/openstack/keystone/blob/master/keystone/common/wsgi.py you have "Application" | 18:00 |
| morganfainberg | That extends base application | 18:00 |
| *** mylu has joined #openstack-keystone | 18:00 | |
| dstanek | krotscheck: that is called in our httpd handler | 18:00 |
| krotscheck | Ok, sec. I think that's what I need, lemme apply the thing and run the tests and then I'll come back with questions. | 18:01 |
| morganfainberg | ++ | 18:01 |
| morganfainberg | ok | 18:01 |
| dstanek | krotscheck: ComposingRouter and ComposableRouter won't be around for too much longer | 18:01 |
| dstanek | i was actually hoping to delete all of common.wsgi, but that's probably not in the cards for this cycle | 18:02 |
| *** piyanai has joined #openstack-keystone | 18:02 | |
| *** mylu has quit IRC | 18:02 | |
| krotscheck | Cool, one last question. The X-Project-* headers and X-Domain-* headers - are those defined in constants somewhere? | 18:02 |
| *** mylu has joined #openstack-keystone | 18:04 | |
| krotscheck | I lied. | 18:04 |
| krotscheck | GET/PUT/POST/DELETE... any other HTTP methods in use? | 18:04 |
| morganfainberg | Patch | 18:04 |
| dstanek | options if we do that sort of thing | 18:05 |
| *** dsirrine has joined #openstack-keystone | 18:15 | |
| *** piyanai has quit IRC | 18:16 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Handle tokens created and quickly revoked with insufficient timestamp precision https://review.openstack.org/216236 | 18:18 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Do not revoke all of a user's tokens when a role assignment is deleted https://review.openstack.org/216367 | 18:18 |
| *** bapalm- is now known as bapalm_ | 18:19 | |
| *** ankita_w_ has joined #openstack-keystone | 18:27 | |
| *** piyanai has joined #openstack-keystone | 18:28 | |
| *** ankita_wagh has quit IRC | 18:30 | |
| openstackgerrit | Merged openstack/keystoneauth: Rename the actual plugin class to AdminToken https://review.openstack.org/213382 | 18:30 |
| *** jasonsb_ has quit IRC | 18:31 | |
| *** piyanai has quit IRC | 18:31 | |
| openstackgerrit | Merged openstack/keystoneauth: Port in the argument scrubbing from OCC https://review.openstack.org/213477 | 18:33 |
| *** Guest1060 has quit IRC | 18:34 | |
| *** piyanai has joined #openstack-keystone | 18:34 | |
| *** piyanai has quit IRC | 18:35 | |
| openstackgerrit | Merged openstack/oslo.policy: Overwrite option should not cause policy file reloading https://review.openstack.org/215868 | 18:39 |
| *** tsymanczyk has joined #openstack-keystone | 18:44 | |
| *** tsymanczyk is now known as Guest79943 | 18:44 | |
| *** rm_work|away is now known as rm_work | 18:48 | |
| *** geoffarnold is now known as geoffarnoldX | 18:49 | |
| *** geoffarnoldX is now known as geoffarnold | 18:49 | |
| openstackgerrit | Merged openstack/keystoneauth: Move session loading into loading module https://review.openstack.org/209349 | 18:51 |
| *** piyanai has joined #openstack-keystone | 18:51 | |
| *** narengan has quit IRC | 18:58 | |
| *** jasonsb has joined #openstack-keystone | 18:59 | |
| *** narengan has joined #openstack-keystone | 18:59 | |
| *** narengan has quit IRC | 18:59 | |
| *** ankita_wagh has joined #openstack-keystone | 18:59 | |
| *** ankita_w_ has quit IRC | 19:03 | |
| *** e0ne has quit IRC | 19:04 | |
| *** jsavak has quit IRC | 19:05 | |
| *** vivekd has quit IRC | 19:05 | |
| *** jsavak has joined #openstack-keystone | 19:07 | |
| krotscheck | Fun fact - the flavor of openssl available on my osx box does not permit me to pass all the keystone tests. | 19:08 |
| * krotscheck doesn't always test his code, but when he does, he does it in gerrit | 19:08 | |
| *** vivekd has joined #openstack-keystone | 19:08 | |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Added CORS support to Keystone https://review.openstack.org/216387 | 19:12 |
| alextricity | Is Adam Young in the house? | 19:14 |
| alextricity | Anybody know his handle? | 19:15 |
| samueldmq | alextricity, it's ayoung, but he's not in the channel atm | 19:16 |
| alextricity | samueldmq: Thanks. I was looking for someone to answer some questions about multi-domain backends. | 19:17 |
| samueldmq | alextricity, you can just ask here, someone else may have the answers you're looking for | 19:18 |
| alextricity | I'm getting some strange errors on my environment | 19:18 |
| samueldmq | gyee, basically, in the regard of policies, I need to know i) what inconsistency is acceptable for hp-cloud and ii) the probability you guys will deploy this solution in L :) | 19:19 |
| morganfainberg | krotscheck: we don't support OS X as a target for these reasons | 19:19 |
| alextricity | Does anybody know if the service users still use the sql identity driver? | 19:19 |
| morganfainberg | krotscheck: we used to, but it just became more and more painful to support | 19:19 |
| morganfainberg | krotscheck: you can brew update openssl...but still doesn't solve everything | 19:19 |
| *** jsavak has quit IRC | 19:19 | |
| morganfainberg | alextricity: ayoung is adam's IRC nick, but I think he's officially on vacation | 19:20 |
| *** jsavak has joined #openstack-keystone | 19:22 | |
| *** afaranha has joined #openstack-keystone | 19:23 | |
| *** afaranha has left #openstack-keystone | 19:23 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Test that unscoped tokens are revoked when deleting role assignments https://review.openstack.org/216391 | 19:24 |
| *** petertr7 is now known as petertr7_away | 19:25 | |
| krotscheck | morganfainberg: Bah, why can you not submit to apple? | 19:27 |
| morganfainberg | krotscheck: because they don't use / support the F/LOSS libraries | 19:28 |
| morganfainberg | they have moved to their own libs for things like LDAP and SSL | 19:28 |
| krotscheck | morganfainberg: SUBMIT! | 19:28 |
| morganfainberg | not worth the headache | 19:28 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Do not revoke all of a user's tokens when a role assignment is deleted https://review.openstack.org/216367 | 19:28 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Handle tokens created and quickly revoked with insufficient timestamp precision https://review.openstack.org/216236 | 19:28 |
| krotscheck | morganfainberg: The ghost of Steve Jobs Commands you! | 19:28 |
| morganfainberg | easier to say "keystone doesn't support OS X" | 19:28 |
| * morganfainberg hands the Ghost of Steve Jobs a vagrant file | 19:28 | |
| *** petertr7_away is now known as petertr7 | 19:29 | |
| *** urulama__ has quit IRC | 19:29 | |
| *** urulama__ has joined #openstack-keystone | 19:30 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 19:42 |
| *** Ephur has joined #openstack-keystone | 19:46 | |
| *** piyanai has quit IRC | 19:53 | |
| *** nicodemos has quit IRC | 19:57 | |
| *** jsavak has quit IRC | 19:57 | |
| *** thiagop has quit IRC | 20:01 | |
| *** exploreshaifali has joined #openstack-keystone | 20:04 | |
| morganfainberg | dstanek: wow. our FakeLDAP thing is just awful | 20:05 |
| morganfainberg | :( | 20:05 |
| * morganfainberg was trying to convert it to a fixture | 20:05 | |
| morganfainberg | but we do really weird things to support the "LiveLDAP" tests | 20:05 |
| morganfainberg | which really... don't do a heck of a lot | 20:05 |
| dstanek | morganfainberg: yeah, i tried too | 20:07 |
| dstanek | i ran out of interest :-) | 20:07 |
| morganfainberg | I'm going to rip apart the external config file crap and remove it | 20:08 |
| morganfainberg | LDAPLive should move under functional anyway | 20:08 |
| dstanek | i think the problem i ran into was all of the reloading of data - that's why i was trying to do it | 20:08 |
| morganfainberg | so I'm content to move those there in the process | 20:08 |
| morganfainberg | ah yeah I got rid of that with the python-ldap-test thing | 20:09 |
| morganfainberg | turned that into a fixture | 20:09 |
| morganfainberg | and bonus: we get real LDAP enforcement rather than "ooopse we don't really validate this is LDAP-y-things" | 20:09 |
| morganfainberg | the down side... you need a java runtime for unit tests | 20:09 |
| morganfainberg | but I'm not wholly upset by that | 20:09 |
| morganfainberg | so i think the steps are: 1) Move LiveTests to "functional" | 20:10 |
| morganfainberg | 2) Rip out config files on disks as "unit tests" | 20:10 |
| morganfainberg | 3) make test-ldap thing a fixture | 20:10 |
| *** thiagop has joined #openstack-keystone | 20:10 | |
| dolphm | morganfainberg: fakeldap has been a mess since day 1 :( | 20:11 |
| morganfainberg | http://paste.openstack.org/show/426341/ | 20:11 |
| morganfainberg | that is the fixture I am working with atm | 20:11 |
| morganfainberg | dstanek, dolphm, ^ cc | 20:11 |
| *** piyanai has joined #openstack-keystone | 20:11 | |
| *** Guest79943 has quit IRC | 20:12 | |
| *** exploreshaifali has quit IRC | 20:13 | |
| *** vivekd has quit IRC | 20:14 | |
| dstanek | morganfainberg: actually i did push this https://review.openstack.org/#/c/210088/ | 20:15 |
| dstanek | it's rather sad really that i have some much in motion that i can't remember what i've pushed | 20:15 |
| *** tonytan4ever has quit IRC | 20:15 | |
| morganfainberg | i really want to stop pretending a dict is a sufficient representation of LDAP | 20:16 |
| openstackgerrit | Merged openstack/keystoneauth: Do not log binary data during debug https://review.openstack.org/214380 | 20:16 |
| morganfainberg | I guess I could use your thing and just magically make it disappear behind the scenes and use the python-ldap-test | 20:17 |
| morganfainberg | but ugh. | 20:17 |
| *** yottatsa has quit IRC | 20:17 | |
| *** pnavarro has joined #openstack-keystone | 20:17 | |
| *** tsymanczyk has joined #openstack-keystone | 20:22 | |
| *** tsymanczyk is now known as Guest76519 | 20:23 | |
| *** jerrygb has joined #openstack-keystone | 20:33 | |
| *** jerrygb is now known as test0rz | 20:34 | |
| *** test0rz is now known as asd112z | 20:34 | |
| *** jasonsb_ has joined #openstack-keystone | 20:36 | |
| *** jasonsb has quit IRC | 20:36 | |
| *** woodster_ has joined #openstack-keystone | 20:37 | |
| openstackgerrit | Andrey Pavlov proposed openstack/keystone: Add S3 signature v4 checking https://review.openstack.org/215481 | 20:38 |
| *** jsavak has joined #openstack-keystone | 20:38 | |
| *** petertr7 is now known as petertr7_away | 20:42 | |
| dstanek | morganfainberg: what is your feeling on the stable interface stuff? have you been watching the implementations? | 20:42 |
| morganfainberg | i haven't really clearly been watching it | 20:42 |
| morganfainberg | was on my list for this week to circle up on | 20:42 |
| dstanek | morganfainberg: right not it's unfortunately just a "slightly" smarted ABCMeta in that if only enforces method names, but does allow you to have versions of that | 20:45 |
| edmondsw | I recently saw 6 unexplained "Authorization failed for token" errors spread over almost 5 minutes in cinder and nova. They apparently came from keystonemiddleware/auth_token/__init__.py (not the _identity.py one). The first was a few seconds after keystone restarted. During that restart, the httpd logs show a couple /v2.0/tokens/revoked calls getting 500 errors. Could that be causing this? keystonemiddleware no longer trus | 20:45 |
| edmondsw | ting tokens because it couldn't tell what had been revoked? | 20:45 |
| morganfainberg | dstanek: yeah | 20:45 |
| *** tonytan4ever has joined #openstack-keystone | 20:45 | |
| *** mylu has quit IRC | 20:46 | |
| dstanek | morganfainberg: i hacked this together in response to the existing review: https://review.openstack.org/#/c/215202/ | 20:46 |
| *** mylu has joined #openstack-keystone | 20:46 | |
| *** fangzhou has joined #openstack-keystone | 20:47 | |
| dolphm | edmondsw: what's the backtrace? | 20:49 |
| dolphm | edmondsw: but yes, 500's from keystone will crop up as 401's to the end user | 20:50 |
| edmondsw | can't find a trace for the 500 | 20:50 |
| dolphm | edmondsw: if you find a log, be sure to open a bug against keystone | 20:50 |
| edmondsw | and debug logging wasn't on, so it didn't print a trace for the 401s | 20:50 |
| dolphm | edmondsw: ah, i assumed you were referring to a devstack run. 500's aren't ever by design though, bug reports much appreciated! | 20:51 |
| edmondsw | yeah... if i can figure it out I'll open\ | 20:51 |
| dolphm | edmondsw: thanks! | 20:52 |
| morganfainberg | dstanek: so that is better. i dumped out the requirement for strictabc because it wasn't going to really fly in the timeline - i'm ok with somehting like this | 20:52 |
| edmondsw | the only way I know about the 500s was from httpd logs... nothing at all in the keystone logs there, which seems odd | 20:53 |
| dstanek | morganfainberg: take a look at the initial review when you have a few. the author was thinking of only supporting 1 version back and providing code that would make the old version act like the new one. | 20:54 |
| dstanek | morganfainberg: i don't know that it's necessarily a good thing to do that | 20:54 |
| morganfainberg | yeah no we can't do that | 20:54 |
| morganfainberg | it has to be *all versions* | 20:54 |
| morganfainberg | until we deprecate the version explicitly | 20:54 |
| morganfainberg | but yes code needs ot make the old version behave like the new | 20:55 |
| dstanek | morganfainberg: how can it? if we add a new method there is often no good way to add the behavior | 20:57 |
| morganfainberg | if we are breaking compatibility we are breaking our contract | 20:57 |
| morganfainberg | we are setting a contract on the backend driver interface | 20:57 |
| dstanek | so how would you safely add a method? | 20:57 |
| morganfainberg | either we deprecate the functionality and move slowly towards new or we do conversion logic | 20:57 |
| morganfainberg | you make an effort to not need to. if you really need to, the new method can't impact old versions running | 20:58 |
| morganfainberg | the minimum would be a 2-cycle interface contract. | 20:58 |
| dstanek | so then it needs to be optional in most cases and we'd look for it an raise a warning if we don't find it | 20:58 |
| morganfainberg | the reality is we should not be leaking backend implementation details to the end users | 20:59 |
| morganfainberg | we've really made no effort to define interfaces here. If cinder can do it, we can. | 20:59 |
| morganfainberg | the manager has a ton of logic in it to do things as needed | 20:59 |
| morganfainberg | so we can lift the business logic up until we can be assured all drivers have the support. | 21:00 |
| dstanek | the example we were working through is a driver that has '.list()' and we add a new '.list_by_name()' the implementation to implement list_by_name would table scan and do Python side filtering...which is no good | 21:00 |
| morganfainberg | but that would be the solution for the interim if the backend driver doesn't have .list_by_name | 21:00 |
| dstanek | i'll have to look at what cinder is doing | 21:00 |
| morganfainberg | they just don't change the contract | 21:00 |
| morganfainberg | same with neutron | 21:00 |
| morganfainberg | our usecases aren't that complex we can just commit to a contract. | 21:01 |
| dstanek | while that's technically true, you broke a large production implementation depending on table side a frequency of use | 21:01 |
| morganfainberg | they should move to the new version with optimised .list_by_name - the difference is we *dont* break the deployer completly every single time we update | 21:02 |
| dstanek | to me this method stuff is mostly useless since we will know what methods are changing - it's really the inputs and outputs that will help the driver writers | 21:02 |
| morganfainberg | i've heard more people bitch about the endless interface changes | 21:03 |
| *** jsavak has quit IRC | 21:03 | |
| morganfainberg | we should either a) not support pluggable backends outside of in-tree drivers | 21:03 |
| morganfainberg | or b) commit to a contract | 21:03 |
| morganfainberg | we're already not doing a | 21:03 |
| *** AndroUser2 has joined #openstack-keystone | 21:03 | |
| *** jsavak has joined #openstack-keystone | 21:03 | |
| morganfainberg | we have deployers that have to chase our interface changes with nearly every commit | 21:03 |
| dstanek | what are we changing so much? | 21:04 |
| morganfainberg | every release all of our driver interfaces seem to change/move/etc | 21:04 |
| morganfainberg | because people want $new_shiny_feature | 21:04 |
| dstanek | the complaints i have heard are that's it's nearly impossible to write a driver because you have to figure out what dictionary comes back when | 21:04 |
| *** ankita_w_ has joined #openstack-keystone | 21:04 | |
| morganfainberg | it's both | 21:04 |
| morganfainberg | what dict comes back and that once you figure that out, next cycle it changes | 21:05 |
| dstanek | and that we've removed keys thinking they were "implementation details" | 21:05 |
| morganfainberg | so we should commit to a clear interface for our drivers just like we do for the REST API | 21:05 |
| dstanek | for new features i'd rather see them optional for a release and then we don't have too worry too much | 21:05 |
| gyee | ++ | 21:05 |
| morganfainberg | except we're leaking to the end users then | 21:05 |
| gyee | so I can spend more time on the beach instead of refactoring the mongo driver :) | 21:05 |
| morganfainberg | which is incorrect | 21:05 |
| morganfainberg | we should be ensuring that the end user needs to know zero about the differences between backend implementations | 21:06 |
| dstanek | gyee: yeah, so what sort of issues have you been running into? | 21:06 |
| gyee | dstanek, public cloud is running Keystone with mongo driver | 21:06 |
| *** piyanai has quit IRC | 21:06 | |
| *** ankita_wagh has quit IRC | 21:07 | |
| morganfainberg | if that means we have a very crappy in-memory version of the list_by_name when the driver doesn't support it, the deployer may 403 it, but we don't break the user's expectation -- no 501 "oh this isn't implemented" or worse, 404 | 21:07 |
| gyee | its seem everything we pull we have to fix the driver because some of the interface's been moved around | 21:07 |
| gyee | that's during the time when we move assignment, identity, and resource drivers around | 21:07 |
| gyee | every upstream pull was an adventure | 21:07 |
| gyee | I made the mistake of not having a 3rd CI | 21:08 |
| gyee | and have it voting | 21:08 |
| dstanek | gyee: besides moving assignment->resouce what sort of breaking changes did we make? | 21:09 |
| morganfainberg | a lot of driver becomes dumber, manager smarter | 21:09 |
| morganfainberg | new args | 21:09 |
| morganfainberg | removed args | 21:09 |
| morganfainberg | etc | 21:09 |
| gyee | what he said ^^^ | 21:09 |
| morganfainberg | driver smarter manager dumber | 21:09 |
| morganfainberg | things move | 21:09 |
| morganfainberg | some of it is to make drivers behave similarly | 21:09 |
| gyee | like why am I getting a 500 Internal Error after an upstream pull | 21:10 |
| morganfainberg | we can make the docs better, but it doesn't really solve the issue | 21:10 |
| dstanek | while i agree with everything that was just said the method existence isn't any of that | 21:11 |
| morganfainberg | if we claim to support out-of-tree drivers at all, we should be committing to a contract on the driver interface | 21:11 |
| gyee | morganfainberg, maybe we need a 3rd CI? | 21:11 |
| dstanek | a better approach may be to have contract tests that shouldn't be changed | 21:11 |
| morganfainberg | s/claim to support/allow | 21:11 |
| morganfainberg | sure. | 21:12 |
| gyee | dstanek, yes | 21:12 |
| morganfainberg | same net effect | 21:12 |
| morganfainberg | however... | 21:12 |
| morganfainberg | you still need to support changing versions | 21:12 |
| dstanek | when we break a contract now we fix the broken tests - maybe need tests that can't change | 21:12 |
| morganfainberg | of the contract | 21:12 |
| morganfainberg | so the point was we support some layer of backwards compat as needed | 21:12 |
| morganfainberg | moving to the new driver interface version removes the compat layer | 21:12 |
| dstanek | why isn't that a manager/driver thing? if you add an arg is needs to be optional, kind of thing | 21:13 |
| gyee | dstanek, you mean the tests will be under openstack/keystone-compatibility repo? | 21:13 |
| morganfainberg | dstanek: because things aren't just easy to make "optional" | 21:13 |
| morganfainberg | dstanek: also how do you know if a driver can take new <optional arg> | 21:14 |
| morganfainberg | or worse adding the "find_by_name" api | 21:14 |
| dstanek | i just worry that if we write naive implementations it'll be worse | 21:14 |
| morganfainberg | do we just 501 it? | 21:14 |
| morganfainberg | we have done a very very poor job of ensuring we take care of the end users [I don | 21:15 |
| morganfainberg | t care about deployers at the moment] | 21:15 |
| dstanek | morganfainberg: that's the more interesting problem. writing something that looks and the signatures and other things (i've been calling that inputs/outputs) | 21:15 |
| morganfainberg | end users matter more. not needing to know that cloud X doesn't support $feature$ because the driver interface is old | 21:15 |
| morganfainberg | is crappy | 21:15 |
| gyee | aren't the params part of the signature? | 21:15 |
| morganfainberg | even though it is running the same version of keystone | 21:15 |
| morganfainberg | (9.0 for example) | 21:16 |
| morganfainberg | if someone upgrades to keystone 9.0 and doesn't update driver interfaces to the new contract, there should be warnings and we should have a naieve implementation | 21:16 |
| morganfainberg | but it doesn't break the end user [403 aside, since access to a API is independent in this argument] | 21:17 |
| alextricity | Hello. I'm using AD for my keystone domain backend, but I get this message everytime: | 21:17 |
| alextricity | {"error": {"message": "User c113a4c78586ad32cde81aaa8596d6aa4aa92cd1f9c84b0114e76a7f25b96970 has no access to project 25eb9bc982494c2486f2c8159f830d29 (Disable debug mode to suppress these details.)", "code": 401, "title": "Unauthorized"}} | 21:17 |
| alextricity | Has anybody seen this? | 21:17 |
| gyee | morganfainberg, what's the process to create out-of-tree driver? | 21:17 |
| morganfainberg | gyee: what do you mean? | 21:17 |
| morganfainberg | you already did it | 21:17 |
| morganfainberg | :P | 21:17 |
| gyee | like folk? | 21:17 |
| morganfainberg | you'd base it on the correct version'd base class. | 21:17 |
| gyee | I mean where do I stash the code? | 21:18 |
| morganfainberg | IdentityDriver1234 | 21:18 |
| morganfainberg | gyee: wherever you want | 21:18 |
| gyee | oh | 21:18 |
| gyee | alrighty then | 21:18 |
| morganfainberg | base class would convey version. | 21:18 |
| morganfainberg | so if you were 3 versions behind (example): | 21:18 |
| dstanek | so, are we defining now breaking as "will work in a test environment"? | 21:18 |
| morganfainberg | IdentityDriverWrapper1234(IdentityDriverWrapper1233(IdentityDriver)) | 21:19 |
| morganfainberg | basically | 21:19 |
| morganfainberg | dstanek: will result in the same output [test environment or prod, not being specific] | 21:19 |
| gyee | alextricity, means your user have no role assignment on the given project | 21:19 |
| dstanek | until a naive implementation locks the table and nothing works | 21:20 |
| morganfainberg | if you use the API, so if the new api is "find by name" we will find by name - in memory if needed | 21:20 |
| morganfainberg | dstanek: this is at the manager layer so it might stream a lot of data. | 21:20 |
| *** hrou has quit IRC | 21:20 | |
| *** mylu has quit IRC | 21:21 | |
| *** mylu has joined #openstack-keystone | 21:21 | |
| dstanek | what about a case where we change the driver API for an existing REST API call that uses a non-performant naive implemenation | 21:21 |
| gyee | dstanek, I don't understand | 21:22 |
| dstanek | gyee: this is what we were arguing against last week. the Compatibilizer idea. writing a naive implementation of a new driver method | 21:24 |
| gyee | dstanek, but we have the hints param | 21:25 |
| dstanek | morganfainberg: i can do a dynamic subclass implementation in my meta class that will allow for naive implementations, but i'm not sure how that would work | 21:25 |
| dstanek | s/how/how well/ | 21:26 |
| gyee | the hints convey the information about what the backend is capable of | 21:26 |
| *** gordc has quit IRC | 21:26 | |
| dstanek | morganfainberg: my original thought was to have versioned classes and pick the parent dynamically, but after thinking through the implications i stopped | 21:26 |
| *** raildo is now known as raildo-afk | 21:27 | |
| dstanek | gyee: so what if a new driver was added? what do we do? | 21:27 |
| dstanek | gyee: s/driver/driver method/ | 21:28 |
| gyee | dstanek, emit a warning | 21:28 |
| gyee | and bump the version number up | 21:29 |
| dstanek | gyee: and provide a naive implementation for older versions? | 21:29 |
| gyee | no | 21:29 |
| dstanek | morganfainberg: is saying we should; i don't know that it can work | 21:30 |
| dstanek | morganfainberg: where in cinder are they versioning drivers? | 21:30 |
| gyee | we can't, we don't know what the native driver is capable of | 21:30 |
| *** diegows has joined #openstack-keystone | 21:33 | |
| *** samueldmq has quit IRC | 21:33 | |
| gyee | dstanek, that's how we ended up with this LDAP performance problem, see https://bugs.launchpad.net/python-keystoneclient/+bug/1417189 | 21:35 |
| openstack | Launchpad bug 1417189 in python-keystoneclient "Keystone v2 list users by name should be supported to avoid potential performance problem" [Undecided,In progress] - Assigned to rajiv (rajiv-kumar) | 21:35 |
| *** Guest76519 has quit IRC | 21:35 | |
| *** piyanai has joined #openstack-keystone | 21:35 | |
| gyee | dstanek, our identity driver used to do that, fetch all the users and do linear search in process | 21:36 |
| *** tsymanczyk has joined #openstack-keystone | 21:36 | |
| gyee | for lookup by name | 21:36 |
| dstanek | interesting...is that where the example came from? | 21:38 |
| *** thiagop has quit IRC | 21:39 | |
| *** pnavarro has quit IRC | 21:39 | |
| *** AndroUser2 has quit IRC | 21:39 | |
| *** geoffarnold has quit IRC | 21:41 | |
| *** ngupta_ has joined #openstack-keystone | 21:45 | |
| *** abhirc has joined #openstack-keystone | 21:47 | |
| *** samueldmq has joined #openstack-keystone | 21:47 | |
| *** abhirc has quit IRC | 21:47 | |
| *** abhirc has joined #openstack-keystone | 21:48 | |
| morganfainberg | gyee: i disagree | 21:48 |
| morganfainberg | The naive implementation *if the native driver doesnt have* the support is fine | 21:49 |
| morganfainberg | But if you are on the same driver interfaces no naive impl | 21:49 |
| morganfainberg | gyee, dstanek: the naive impl would only be if you were on version 4 of the interface and keystone used version 5 | 21:50 |
| morganfainberg | if you are on the same (max) interface keystone supports it is assumed your driver would have a native (or internally naive) implementation to use | 21:50 |
| morganfainberg | the naive impl would only be in the conversion classes not baked in always | 21:51 |
| morganfainberg | so 4->5 might have find_by_name implementatio | 21:51 |
| morganfainberg | if you upgraded to being based in version 5, you would support it natively in the driver/backend | 21:52 |
| *** ankita_wagh has joined #openstack-keystone | 21:53 | |
| morganfainberg | that being said we should pretty much *not* be adding/removing too much from the driver interfaces | 21:53 |
| *** ankita___ has joined #openstack-keystone | 21:53 | |
| *** ankita_w_ has quit IRC | 21:56 | |
| gyee | morganfainberg, so you are fine with fetching 4000 records and do linear search? :) | 21:56 |
| morganfainberg | gyee: only if you when upgrading keystone didn't update your backend driver to match the new interface | 21:56 |
| morganfainberg | and didn't listen to the warnings when you did UAT | 21:57 |
| morganfainberg | saying you should upgrade/update your driver | 21:57 |
| *** ankita_wagh has quit IRC | 21:57 | |
| morganfainberg | if you just leave your driver impl on $previous_version you get the basic implementation that is provided to make sure the drivers work | 21:58 |
| *** jsavak has quit IRC | 21:58 | |
| morganfainberg | i will argue that the linear search is a relatively less-likely issue. most will be "convert string arg X to list Y" in the case of passing a list of memcache servers | 21:58 |
| morganfainberg | for example | 21:58 |
| gyee | morganfainberg, sure, in theory we only need these from the drivers create(), get(id), delete(id), and update(id) | 21:59 |
| morganfainberg | so if we add find_by_name as the new interface. your old driver doesn't do find_by_name, we do it in the conversion object | 21:59 |
| gyee | the rest can be done above (performance aside) | 21:59 |
| morganfainberg | if you move to the new interface you implenment it natively | 22:00 |
| morganfainberg | if you continue with the old interface the driver continues to work but has performance implications | 22:00 |
| gyee | sure | 22:00 |
| morganfainberg | and warnings are thrown "heyyyyy you should update to the new contract" | 22:00 |
| gyee | in BOLD :) | 22:00 |
| morganfainberg | but if you're on the brand-new shiny interface contract, you should have no naive implementations that aren't baked into the driver itself (nothing above the driver) | 22:01 |
| morganfainberg | besides normal manager logic | 22:01 |
| morganfainberg | and we maintain a 2-cycle interface contract | 22:01 |
| gyee | sure, I can live with that | 22:02 |
| morganfainberg | if you don't update your interface within 1 yr... seriously? | 22:02 |
| morganfainberg | now... when do we increment the interface versions? each change? once a cycle? | 22:02 |
| morganfainberg | i don't know. | 22:02 |
| morganfainberg | each change becomes a bit painful | 22:02 |
| morganfainberg | maybe each milestone? | 22:02 |
| *** pgbridge has quit IRC | 22:03 | |
| morganfainberg | if you chase faster than that we can only do so much | 22:03 |
| gyee | we need to bump it whenever we introduce new interface right? | 22:03 |
| morganfainberg | possibly | 22:03 |
| morganfainberg | like i said, don't have a clear viewon that | 22:03 |
| gyee | major.minor.milestone? | 22:04 |
| morganfainberg | possibly | 22:04 |
| morganfainberg | the only concern i have with *every* change is that we end up with a large number of layers | 22:04 |
| morganfainberg | with compat code possibly | 22:04 |
| morganfainberg | I would be ok with bundling the changes once per milestone | 22:05 |
| morganfainberg | every 1.5 months is a fine window | 22:05 |
| morganfainberg | we just indicate to those writing drivers what the increment timeline is. | 22:05 |
| morganfainberg | that way they know when to update their drivers | 22:06 |
| *** piyanai has quit IRC | 22:06 | |
| morganfainberg | milestone is cut, next change is a version bump on the driver that is affected | 22:06 |
| gyee | actually once per release is fine | 22:06 |
| morganfainberg | or at feature freeze we lock the interfaces | 22:07 |
| morganfainberg | no more driver changes. | 22:07 |
| gyee | right | 22:07 |
| gyee | treat it like public APIs | 22:07 |
| morganfainberg | then once the next cycle opens, drivers get a new version when/if they are changed | 22:07 |
| *** diazjf has left #openstack-keystone | 22:07 | |
| gyee | what if no driver interface changes for a given release? we maintain the same version right? | 22:10 |
| morganfainberg | yep | 22:10 |
| morganfainberg | no change = no version change | 22:10 |
| *** ankita___ has quit IRC | 22:11 | |
| gyee | k, make sense | 22:11 |
| *** ankita_wagh has joined #openstack-keystone | 22:11 | |
| lbragstad | ls | 22:14 |
| * lbragstad fails | 22:15 | |
| *** ngupta has quit IRC | 22:15 | |
| samueldmq | lbragstad, I know well what it is hehe | 22:15 |
| *** topol has joined #openstack-keystone | 22:17 | |
| *** ChanServ sets mode: +v topol | 22:17 | |
| *** henrynash has quit IRC | 22:23 | |
| edmondsw | dolphm, tracked down the problem I was asking about earlier... opened https://bugs.launchpad.net/keystonemiddleware/+bug/1488267 | 22:23 |
| openstack | Launchpad bug 1488267 in keystonemiddleware "auth_token middleware reporting valid token as invalid" [Undecided,New] | 22:23 |
| *** tonytan4ever has quit IRC | 22:23 | |
| *** hrou has joined #openstack-keystone | 22:24 | |
| *** asd112z has quit IRC | 22:25 | |
| *** mylu has quit IRC | 22:25 | |
| *** mylu has joined #openstack-keystone | 22:26 | |
| *** topol has quit IRC | 22:28 | |
| *** topol has joined #openstack-keystone | 22:29 | |
| *** ChanServ sets mode: +v topol | 22:29 | |
| *** shoutm has joined #openstack-keystone | 22:32 | |
| *** ankita_w_ has joined #openstack-keystone | 22:33 | |
| *** bknudson has quit IRC | 22:33 | |
| *** topol has quit IRC | 22:33 | |
| *** doug-fish has quit IRC | 22:34 | |
| *** doug-fish has joined #openstack-keystone | 22:34 | |
| *** ankita_wagh has quit IRC | 22:36 | |
| *** jecarey has quit IRC | 22:37 | |
| *** doug-fis_ has joined #openstack-keystone | 22:37 | |
| *** roxanaghe has quit IRC | 22:38 | |
| *** geoffarnold has joined #openstack-keystone | 22:38 | |
| *** doug-fish has quit IRC | 22:38 | |
| *** jecarey has joined #openstack-keystone | 22:39 | |
| *** jasonsb_ has quit IRC | 22:40 | |
| *** tsufiev has quit IRC | 22:41 | |
| *** doug-fish has joined #openstack-keystone | 22:41 | |
| *** doug-fis_ has quit IRC | 22:42 | |
| *** geoffarnold has quit IRC | 22:42 | |
| *** hrou has quit IRC | 22:44 | |
| *** diegows has quit IRC | 22:45 | |
| *** geoffarnold has joined #openstack-keystone | 22:45 | |
| *** jaosorior has quit IRC | 22:45 | |
| *** doug-fish has quit IRC | 22:46 | |
| *** tsufiev has joined #openstack-keystone | 22:46 | |
| *** mylu has quit IRC | 22:52 | |
| *** jecarey has quit IRC | 22:54 | |
| *** edmondsw has quit IRC | 22:57 | |
| *** mylu has joined #openstack-keystone | 23:03 | |
| *** zzzeek has quit IRC | 23:10 | |
| *** claudiub has quit IRC | 23:12 | |
| dstanek | morganfainberg: gyee: my thought is that we'd version for each release | 23:12 |
| gyee | even without interface changes for a given release? | 23:13 |
| dstanek | gyee: i don't see why not | 23:15 |
| dstanek | then you are really saying this is a Liberty driver | 23:15 |
| gyee | dstanek, if we do that, we are forcing 3rd party driver to update the version | 23:16 |
| *** dims_ has joined #openstack-keystone | 23:16 | |
| gyee | unless we internally maintaining compatibility base on interface matching, not by version number | 23:16 |
| gyee | remove the +1 version check in the code | 23:17 |
| dstanek | morganfainberg: i'm fine with what you were saying before, i just disagree with what we are calling it. if we provide a naive implementation that forces someone to write to the new interface anyway then it's no better then just being up front and saying that we broke backward compat. | 23:18 |
| *** dims__ has quit IRC | 23:18 | |
| dstanek | gyee: in my mind each driver interface know what versions it is; i'll hack up a demo | 23:18 |
| morganfainberg | then we simply stop changing the driver interface - i mean that is my end goal | 23:18 |
| morganfainberg | stop changing the driver interfaces | 23:19 |
| dstanek | morganfainberg: ++ | 23:19 |
| morganfainberg | we have almost no reason to be changing driver interfaces at this point | 23:19 |
| morganfainberg | the fact that we are indicates we aren't thinking about the design | 23:19 |
| *** mylu has quit IRC | 23:19 | |
| *** dims__ has joined #openstack-keystone | 23:19 | |
| *** mylu has joined #openstack-keystone | 23:20 | |
| morganfainberg | the long/short is we need a contract there regardless | 23:20 |
| morganfainberg | and a cycle-to-cycle change is *not* a contract | 23:20 |
| *** mylu has quit IRC | 23:20 | |
| gyee | we need a contract | 23:20 |
| morganfainberg | this has to be at least as stable as our REST API | 23:20 |
| gyee | spit on the palm and seal it! | 23:20 |
| *** mylu has joined #openstack-keystone | 23:21 | |
| *** dims_ has quit IRC | 23:21 | |
| *** Ephur has quit IRC | 23:22 | |
| dstanek | doesn't our rest API change during master development? | 23:22 |
| dstanek | or once we commit we are locked in? | 23:22 |
| gyee | dstanek, we look API spec by M1 I think | 23:23 |
| gyee | s/look/lock/ | 23:24 |
| *** topol has joined #openstack-keystone | 23:24 | |
| *** ChanServ sets mode: +v topol | 23:24 | |
| dstanek | that's the theory | 23:24 |
| *** tsymanczyk is now known as Guest88622 | 23:26 | |
| *** Guest88622 is now known as tsymanczyk | 23:27 | |
| morganfainberg | and if we are supporting external plugins it needs to be more stable than our rest api | 23:32 |
| morganfainberg | the issue is we should really be changing the backend interfaces so infrequently that it is a major ordeal if something has to be changed out | 23:33 |
| morganfainberg | or even added at this point | 23:33 |
| dstanek | how stable are you thinking? i'm trying to think through implementation and that's the biggest variable in a design | 23:33 |
| morganfainberg | which is why i was advocating fro the naive implementation | 23:33 |
| gyee | how does neutron solved this problem, they have a tone of 3rd party drivers | 23:33 |
| morganfainberg | they don't change their interface | 23:33 |
| morganfainberg | i mean that is it | 23:33 |
| gyee | oh :) | 23:33 |
| morganfainberg | they comitted to a contract | 23:33 |
| morganfainberg | and stuck with it | 23:33 |
| *** doug-fish has joined #openstack-keystone | 23:34 | |
| gyee | I mean do they do any enforcements | 23:34 |
| morganfainberg | changing that interface is a *big* deal | 23:34 |
| morganfainberg | yes, 3rd party CI would break | 23:34 |
| morganfainberg | ;) | 23:34 |
| gyee | k | 23:34 |
| morganfainberg | or 1st party ci would break | 23:34 |
| morganfainberg | I was willing to give us wiggle room to progress the API with the compat layer | 23:34 |
| *** EmilienM has quit IRC | 23:34 | |
| morganfainberg | a naive implementation is not the end of the world... and the "big" issue implementations are really going to be far and few between | 23:35 |
| morganfainberg | minor changes such as updating args will be more the norm | 23:35 |
| gyee | yeah I agree | 23:35 |
| dstanek | then if that's the case it should be easy for us to support 1 class per supported version right? | 23:36 |
| morganfainberg | again part of the goal is never to leak implementation details to the end user | 23:36 |
| morganfainberg | so if we are not comitting to a contract fine. but if we are we need to supply compat for when we have to hcnage it. that is all | 23:36 |
| *** EmilienM has joined #openstack-keystone | 23:36 | |
| morganfainberg | dstanek: sure. 1 class = 1 version | 23:37 |
| morganfainberg | if you support 2 versions, 2 classes | 23:37 |
| *** stevephone has joined #openstack-keystone | 23:37 | |
| morganfainberg | but the APIs to the end user (the person consuming OpenStack ?Keystone Rest API) can't return different things | 23:37 |
| dstanek | how do you feel about the third-party driver subclassing a versioned class instead of Driver? | 23:37 |
| morganfainberg | so version 9 of keystone says get_user_by_name is supported, anything loaded by version 9 of keystone should support that [even if it's naive implemented] | 23:38 |
| *** woodster_ has quit IRC | 23:38 | |
| *** doug-fish has quit IRC | 23:38 | |
| morganfainberg | i'd expect them to be subclassing the version they are built on | 23:38 |
| morganfainberg | rather than *base* Driver | 23:38 |
| morganfainberg | they'd use DriverV22 for example | 23:38 |
| *** woodster_ has joined #openstack-keystone | 23:38 | |
| morganfainberg | and that tells us what the underlying implementation will support (if they don't adhere to that, we can't help) | 23:39 |
| dstanek | then really there is no work to be done...except for the hard part of making sure the interface is correct | 23:39 |
| morganfainberg | well we also have to support backwards compat with regards to the rest api. | 23:39 |
| morganfainberg | if the driver doesn't support .get_by_name either we are breaking our user Rest contract or our driver contract | 23:40 |
| dstanek | how fine grained should the versioning be? | 23:40 |
| morganfainberg | or we have a compat layer that does the naive conversion | 23:40 |
| morganfainberg | i'm ok with versioning on the driver being once per cycle or once per milestone | 23:40 |
| morganfainberg | not any faster than once per milestone | 23:40 |
| dstanek | once per milestone seems more natural to me | 23:41 |
| morganfainberg | if someone is chasing master, they know there is extra work to be done | 23:41 |
| morganfainberg | and i'm fine saddling them with that | 23:41 |
| *** morganfainberg is now known as morgan | 23:42 | |
| * gyee likes to chase master | 23:42 | |
| dstanek | ok, so we're saying the same thing there. i thought that you were saying that once per cycle was not enough | 23:42 |
| gyee | latest (and greatest) | 23:42 |
| dstanek | gyee: then you deserve the pain | 23:42 |
| morgan | dstanek: ++ | 23:42 |
| dstanek | :-P | 23:42 |
| gyee | no pain, no gain | 23:42 |
| dstanek | no pain, no complain | 23:42 |
| dstanek | so back to what i really care about then....i'm pretty sure that our own in-tree drivers return different data | 23:42 |
| morgan | dstanek: no once per cycle would be fine. if nothing changes you don't *have* to change it | 23:42 |
| morgan | dstanek: that is part of this initiative. fix that while we are at it | 23:43 |
| dstanek | i was going to hack typist up to check dict keys, but i just haven't done that yet | 23:43 |
| morgan | we're comitting to a contract | 23:43 |
| morgan | so we go commit to the contract -- for ourselves too | 23:43 |
| *** stevephone has quit IRC | 23:43 | |
| openstackgerrit | guang-yee proposed openstack/keystonemiddleware: Enforce endpoint constraint https://review.openstack.org/177661 | 23:43 |
| morgan | and if gyee is a masochist... we let him be a masochist | 23:43 |
| morgan | but i somehow think he'll start syncing about as often as once a milestone if the contract changes at most once per milestone :P | 23:44 |
| morgan | or the contract definition :P | 23:44 |
| gyee | I wasn't kidding, we did sync per milestone during the K2K stuff | 23:44 |
| morgan | hopefully with the added pain of changing the interfaces people will be more selective of running roughshod over the interface definitions as they make minor adjustments | 23:45 |
| gyee | key is how fast can you do hotfix :) | 23:45 |
| dstanek | ....and not create new problems | 23:46 |
| morgan | i can't belive our tests are so unisolated | 23:47 |
| morgan | the moment you say use cleanUp to remove the backends you get magical conflicts *everywhere* | 23:47 |
| morgan | this is just awful stuff | 23:47 |
| gyee | hah | 23:47 |
| dstanek | so right now: ":param dict user: a user object" | 23:48 |
| morgan | the per-domain backend is just awful in our testing harnesses | 23:48 |
| dstanek | i was thinking: ":param keystone.identity.schema.user user: a user object" | 23:48 |
| dstanek | and then validate against the schema | 23:48 |
| * morgan sighs... | 23:49 | |
| morgan | no you can't just say ".reset ldap" | 23:49 |
| gyee | dstanek, yes | 23:49 |
| * morgan yells at whoever implemented that | 23:49 | |
| gyee | morgan, you are using FakeLDAP? | 23:49 |
| morgan | trying to remove FakeLDAP | 23:49 |
| dstanek | gyee: typist only runs at test time, but at least it's something | 23:49 |
| morgan | move to something that enforces real LDAP semantics but still is in-mem | 23:50 |
| gyee | dstanek, I like the idea, I mean we can just reuse the JSON schema check right? | 23:50 |
| dstanek | gyee: maybe the create ones | 23:51 |
| gyee | sure | 23:51 |
| gyee | morgan, btw, I've been messing around with python3-ldap, and I LIKE IT! | 23:51 |
| morgan | gyee: ldap3 you mean | 23:51 |
| morgan | [they renamed it] | 23:52 |
| morgan | ;) | 23:52 |
| gyee | right | 23:52 |
| morgan | but yeah it's good | 23:52 |
| gyee | now I can even do discovery with DsaInfo | 23:52 |
| gyee | schema discovery | 23:52 |
| gyee | makes configuration much much easier | 23:52 |
| gyee | we can cut down a lot of mapping stuff | 23:52 |
| morgan | somewhat | 23:53 |
| morgan | not completely | 23:53 |
| morgan | wow fakeldap is a trainwreck | 23:54 |
| morgan | oh i see.. .reload_backends() | 23:55 |
| morgan | WHY IS THIS A THING | 23:55 |
| gyee | morgan, http://paste.openstack.org/show/426438/ | 23:55 |
| gyee | that's enough for me to skip most of the configuration we have today | 23:56 |
| morgan | gyee: except it isn't | 23:56 |
| morgan | because people configure things wackily | 23:56 |
| morgan | :P | 23:56 |
| *** jasonsb has joined #openstack-keystone | 23:56 | |
| gyee | sure, in that case, they'll have to overwrite | 23:56 |
| gyee | but for standard schema, that'll save a lot of work | 23:57 |
| morgan | oh of course.. because we just use random crap in our configs too because FakeLDAP just accepted it | 23:57 |
| morgan | wonderfull.... | 23:57 |
| * morgan glares. | 23:57 | |
| gyee | FakeLDAP is just a dict | 23:57 |
| morgan | it's worse that not testing the LDAP code from what I can tell | 23:57 |
| morgan | the .reload_backends and the just assuming the ldap roots exist are just awful | 23:58 |
| gyee | morgan, why even waste time on it, lets do func test instead | 23:58 |
| morgan | gyee: because we need to clean this up to make func tests work | 23:58 |
| morgan | not calling .reload_backends will make porting to func test better | 23:58 |
| morgan | or it's basically rewriting a mess of tests to just hit parity | 23:59 |
| morgan | for the funsies of rewriting test code | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!