| *** _hrou_ has joined #openstack-keystone | 00:00 | |
| *** dsirrine has joined #openstack-keystone | 00:02 | |
| *** lhcheng has joined #openstack-keystone | 00:02 | |
| *** ChanServ sets mode: +v lhcheng | 00:02 | |
| *** hrou has quit IRC | 00:03 | |
| *** mylu has quit IRC | 00:07 | |
| *** woodster_ has quit IRC | 00:09 | |
| *** dims_ has quit IRC | 00:17 | |
| *** shadower has quit IRC | 00:23 | |
| *** shadower has joined #openstack-keystone | 00:23 | |
| *** jsavak has joined #openstack-keystone | 00:34 | |
| *** btully has joined #openstack-keystone | 00:36 | |
| *** jsavak has quit IRC | 00:38 | |
| *** btully has quit IRC | 00:40 | |
| *** jsavak has joined #openstack-keystone | 00:43 | |
| *** mylu has joined #openstack-keystone | 00:58 | |
| *** david-lyle has quit IRC | 01:13 | |
| *** dsirrine has quit IRC | 01:23 | |
| *** jsavak has quit IRC | 01:25 | |
| *** geoffarnold has joined #openstack-keystone | 01:35 | |
| *** mylu has quit IRC | 01:35 | |
| *** geoffarn_ has joined #openstack-keystone | 01:36 | |
| *** mylu has joined #openstack-keystone | 01:36 | |
| *** geoffarnold has quit IRC | 01:40 | |
| *** david-lyle has joined #openstack-keystone | 01:44 | |
| *** geoffarn_ is now known as geoffarnoldX | 01:46 | |
| *** geoffarnoldX has quit IRC | 01:56 | |
| *** geoffarnold has joined #openstack-keystone | 01:57 | |
| *** geoffarnold has quit IRC | 02:04 | |
| *** geoffarnold has joined #openstack-keystone | 02:04 | |
| *** mylu has quit IRC | 02:08 | |
| *** mylu has joined #openstack-keystone | 02:10 | |
| *** geoffarnold has quit IRC | 02:18 | |
| *** geoffarnold has joined #openstack-keystone | 02:18 | |
| *** dimsum__ has joined #openstack-keystone | 02:21 | |
| *** geoffarnold has quit IRC | 02:25 | |
| *** geoffarnold has joined #openstack-keystone | 02:26 | |
| *** akanksha_ has quit IRC | 02:28 | |
| *** mestery has quit IRC | 02:37 | |
| *** mestery has joined #openstack-keystone | 02:38 | |
| *** dimsum__ has quit IRC | 02:40 | |
| *** ayoung has quit IRC | 02:41 | |
| *** mylu has quit IRC | 02:41 | |
| *** su_zhang_ has joined #openstack-keystone | 02:48 | |
| *** topol has joined #openstack-keystone | 02:52 | |
| *** ChanServ sets mode: +v topol | 02:52 | |
| *** mylu has joined #openstack-keystone | 02:56 | |
| *** geoffarn_ has joined #openstack-keystone | 03:01 | |
| *** geoffarnold has quit IRC | 03:01 | |
| *** geoffarn_ is now known as geoffarnoldX | 03:21 | |
| *** geoffarnold has joined #openstack-keystone | 03:22 | |
| *** su_zhang_ has quit IRC | 03:27 | |
| *** david-lyle has quit IRC | 03:32 | |
| *** hrou has joined #openstack-keystone | 03:41 | |
| *** geoffarnold has quit IRC | 03:43 | |
| *** geoffarnold has joined #openstack-keystone | 03:43 | |
| *** david-lyle has joined #openstack-keystone | 03:44 | |
| *** _hrou_ has quit IRC | 03:44 | |
| *** topol has quit IRC | 03:47 | |
| *** david-lyle has quit IRC | 03:48 | |
| *** david-lyle has joined #openstack-keystone | 03:53 | |
| *** david-lyle has quit IRC | 04:02 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Make __all__ immutable https://review.openstack.org/230025 | 04:02 |
|---|---|---|
| *** geoffarnold has quit IRC | 04:04 | |
| *** geoffarnold has joined #openstack-keystone | 04:05 | |
| *** david-lyle has joined #openstack-keystone | 04:06 | |
| *** david-lyle has quit IRC | 04:12 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: Update the project description https://review.openstack.org/230866 | 04:19 |
| *** jaosorior has joined #openstack-keystone | 04:19 | |
| *** dimsum__ has joined #openstack-keystone | 04:21 | |
| *** mylu has quit IRC | 04:22 | |
| *** david-lyle has joined #openstack-keystone | 04:22 | |
| *** geoffarn_ has joined #openstack-keystone | 04:26 | |
| *** geoffarnold has quit IRC | 04:27 | |
| *** amit213 has quit IRC | 04:28 | |
| *** amit213 has joined #openstack-keystone | 04:28 | |
| *** david-lyle has quit IRC | 04:29 | |
| *** _hrou_ has joined #openstack-keystone | 04:40 | |
| *** hrou has quit IRC | 04:43 | |
| *** fifieldt has joined #openstack-keystone | 04:46 | |
| *** geoffarn_ has quit IRC | 04:47 | |
| *** geoffarnold has joined #openstack-keystone | 04:47 | |
| *** _hrou_ has quit IRC | 04:47 | |
| *** btully has joined #openstack-keystone | 04:51 | |
| *** topol has joined #openstack-keystone | 04:51 | |
| *** ChanServ sets mode: +v topol | 04:51 | |
| *** topol has quit IRC | 04:55 | |
| *** topol has joined #openstack-keystone | 05:00 | |
| *** ChanServ sets mode: +v topol | 05:00 | |
| *** topol has quit IRC | 05:01 | |
| *** geoffarnold has quit IRC | 05:08 | |
| *** geoffarnold has joined #openstack-keystone | 05:09 | |
| *** stevemar_ has quit IRC | 05:20 | |
| *** geoffarnold has quit IRC | 05:30 | |
| *** geoffarnold has joined #openstack-keystone | 05:30 | |
| *** btully has quit IRC | 05:34 | |
| *** btully has joined #openstack-keystone | 05:38 | |
| *** lhcheng has quit IRC | 05:51 | |
| *** geoffarnold has quit IRC | 05:51 | |
| *** geoffarnold has joined #openstack-keystone | 05:52 | |
| *** sdake has joined #openstack-keystone | 06:06 | |
| *** sdake has quit IRC | 06:10 | |
| *** sdake has joined #openstack-keystone | 06:11 | |
| *** lsmola has joined #openstack-keystone | 06:13 | |
| *** mflobo has left #openstack-keystone | 06:16 | |
| *** mflobo has joined #openstack-keystone | 06:19 | |
| *** mflobo has left #openstack-keystone | 06:19 | |
| *** sdake has quit IRC | 06:27 | |
| *** sdake has joined #openstack-keystone | 06:31 | |
| *** sdake has quit IRC | 06:31 | |
| *** geoffarnold has quit IRC | 06:33 | |
| *** geoffarnold has joined #openstack-keystone | 06:34 | |
| *** su_zhang_ has joined #openstack-keystone | 06:35 | |
| *** links has joined #openstack-keystone | 06:35 | |
| *** Nirupama has joined #openstack-keystone | 06:59 | |
| *** henrynash has joined #openstack-keystone | 07:10 | |
| *** ChanServ sets mode: +v henrynash | 07:10 | |
| *** su_zhang_ has quit IRC | 07:11 | |
| *** geoffarnold has quit IRC | 07:16 | |
| *** geoffarnold has joined #openstack-keystone | 07:17 | |
| *** mancdaz has joined #openstack-keystone | 07:24 | |
| *** fifieldt has quit IRC | 07:28 | |
| *** ParsectiX has joined #openstack-keystone | 07:35 | |
| *** geoffarnold has quit IRC | 07:37 | |
| *** geoffarnold has joined #openstack-keystone | 07:38 | |
| *** Guest38007 is now known as d0ugal | 07:41 | |
| *** d0ugal has quit IRC | 07:41 | |
| *** d0ugal has joined #openstack-keystone | 07:41 | |
| *** aix has quit IRC | 07:45 | |
| *** aix has joined #openstack-keystone | 07:45 | |
| *** wwwjfy_ has quit IRC | 07:50 | |
| *** fhubik has joined #openstack-keystone | 07:54 | |
| *** fhubik is now known as fhubik_brb | 07:55 | |
| *** pnavarro has joined #openstack-keystone | 07:55 | |
| *** fhubik_brb is now known as fhubik | 07:58 | |
| *** geoffarnold has quit IRC | 07:59 | |
| *** geoffarnold has joined #openstack-keystone | 08:00 | |
| *** topol has joined #openstack-keystone | 08:02 | |
| *** ChanServ sets mode: +v topol | 08:02 | |
| *** arif-ali has quit IRC | 08:05 | |
| *** wwwjfy_ has joined #openstack-keystone | 08:06 | |
| *** topol has quit IRC | 08:06 | |
| *** arif-ali has joined #openstack-keystone | 08:09 | |
| *** e0ne has joined #openstack-keystone | 08:10 | |
| *** jvarlamova has joined #openstack-keystone | 08:15 | |
| *** fhubik is now known as fhubik_brb | 08:15 | |
| *** arif-ali has quit IRC | 08:16 | |
| *** kodokuu has joined #openstack-keystone | 08:18 | |
| *** arif-ali has joined #openstack-keystone | 08:19 | |
| *** geoffarnold has quit IRC | 08:20 | |
| *** geoffarnold has joined #openstack-keystone | 08:20 | |
| kodokuu | Hi. Sometimes I have a trace in nova with "NeutronClientException: Authentication required" because neutron have error ==> "Failed to validate token", "code": 404, "title": "Not Found" AND I can see in keystone WARNING keystone.common.wsgi [-] Failed to validate token | 08:21 |
| kodokuu | anyone know why I have this error ? | 08:22 |
| *** btully has quit IRC | 08:25 | |
| *** david-lyle has joined #openstack-keystone | 08:28 | |
| *** arif-ali has quit IRC | 08:34 | |
| *** fhubik_brb is now known as fhubik | 08:35 | |
| *** wwwjfy_ has quit IRC | 08:36 | |
| *** jistr has joined #openstack-keystone | 08:38 | |
| *** arif-ali has joined #openstack-keystone | 08:39 | |
| *** wwwjfy_ has joined #openstack-keystone | 08:41 | |
| *** geoffarnold has quit IRC | 08:41 | |
| *** geoffarnold has joined #openstack-keystone | 08:42 | |
| marekd | kodokuu: keystone cannot validate token, but it probably looks more like neutron problem. | 08:46 |
| *** arif-ali has quit IRC | 08:47 | |
| *** david-lyle has quit IRC | 08:51 | |
| *** arif-ali has joined #openstack-keystone | 08:51 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Handle 16-char non-uuid user IDs in payload https://review.openstack.org/226121 | 08:53 |
| *** jistr has quit IRC | 09:00 | |
| *** david-lyle has joined #openstack-keystone | 09:00 | |
| *** jistr has joined #openstack-keystone | 09:01 | |
| *** fhubik is now known as fhubik_brb | 09:02 | |
| *** geoffarnold has quit IRC | 09:03 | |
| *** geoffarnold has joined #openstack-keystone | 09:03 | |
| kodokuu | marekd Why ? Maybe after keystone expire token, neutron still try to use old token ? | 09:04 |
| *** markvoelker has joined #openstack-keystone | 09:05 | |
| *** markvoelker_ has joined #openstack-keystone | 09:06 | |
| *** david-lyle has quit IRC | 09:07 | |
| *** jmccrory has quit IRC | 09:07 | |
| *** jmccrory has joined #openstack-keystone | 09:08 | |
| *** markvoelker has quit IRC | 09:09 | |
| *** marzif has joined #openstack-keystone | 09:18 | |
| *** fhubik_brb is now known as fhubik | 09:19 | |
| *** markvoelker_ has quit IRC | 09:20 | |
| *** david-lyle has joined #openstack-keystone | 09:23 | |
| *** geoffarnold has quit IRC | 09:24 | |
| *** geoffarnold has joined #openstack-keystone | 09:24 | |
| *** david-lyle has quit IRC | 09:27 | |
| marekd | kodokuu: so i'd still say this is not keystone working worngly | 09:30 |
| *** david-lyle has joined #openstack-keystone | 09:30 | |
| marekd | either play with expiration time | 09:30 |
| marekd | or neutron is doing something wrong and using old tokens | 09:30 |
| *** marzif has quit IRC | 09:37 | |
| *** geoffarnold has quit IRC | 09:45 | |
| *** geoffarnold has joined #openstack-keystone | 09:46 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 09:53 |
| *** david-lyle has quit IRC | 09:54 | |
| *** katkapilatova has joined #openstack-keystone | 10:00 | |
| *** katkapilatova has left #openstack-keystone | 10:01 | |
| *** david-lyle has joined #openstack-keystone | 10:01 | |
| *** wwwjfy_ has quit IRC | 10:02 | |
| *** geoffarnold has quit IRC | 10:07 | |
| *** geoffarnold has joined #openstack-keystone | 10:07 | |
| *** wwwjfy_ has joined #openstack-keystone | 10:07 | |
| *** e0ne has quit IRC | 10:10 | |
| *** e0ne has joined #openstack-keystone | 10:14 | |
| *** kodokuu has quit IRC | 10:15 | |
| *** david-lyle has quit IRC | 10:16 | |
| *** david-lyle has joined #openstack-keystone | 10:19 | |
| *** fhubik is now known as fhubik_brb | 10:22 | |
| *** geoffarnold has quit IRC | 10:28 | |
| *** marzif has joined #openstack-keystone | 10:28 | |
| *** pnavarro is now known as pnavarro|mtg | 10:28 | |
| *** geoffarnold has joined #openstack-keystone | 10:28 | |
| *** david-lyle has quit IRC | 10:29 | |
| *** david-lyle has joined #openstack-keystone | 10:32 | |
| *** Burgosz has joined #openstack-keystone | 10:41 | |
| *** david-lyle has quit IRC | 10:42 | |
| *** yottatsa has joined #openstack-keystone | 10:46 | |
| *** itlinux has joined #openstack-keystone | 10:46 | |
| *** david-lyle has joined #openstack-keystone | 10:49 | |
| *** geoffarnold has quit IRC | 10:49 | |
| *** geoffarnold has joined #openstack-keystone | 10:50 | |
| *** david-lyle has quit IRC | 10:53 | |
| *** david-lyle has joined #openstack-keystone | 10:56 | |
| *** aix has quit IRC | 11:03 | |
| *** marzif has quit IRC | 11:05 | |
| *** marzif has joined #openstack-keystone | 11:05 | |
| *** david-lyle has quit IRC | 11:07 | |
| *** david-lyle has joined #openstack-keystone | 11:08 | |
| *** marzif has quit IRC | 11:10 | |
| *** geoffarnold has quit IRC | 11:11 | |
| *** marzif has joined #openstack-keystone | 11:11 | |
| *** geoffarnold has joined #openstack-keystone | 11:11 | |
| *** david-lyle has quit IRC | 11:18 | |
| *** david-lyle has joined #openstack-keystone | 11:25 | |
| *** pnavarro|mtg is now known as pnavarro|lunch | 11:25 | |
| *** fhubik_brb is now known as fhubik | 11:26 | |
| *** iurygregory has joined #openstack-keystone | 11:30 | |
| *** geoffarnold has quit IRC | 11:32 | |
| samueldmq | morning | 11:32 |
| *** geoffarnold has joined #openstack-keystone | 11:33 | |
| samueldmq | quick quesiton, when we propose a backport, it is against origin/stable/* and not against gerrit/stable/*, right ? | 11:33 |
| *** aix has joined #openstack-keystone | 11:35 | |
| *** Madkiss has joined #openstack-keystone | 11:38 | |
| Madkiss | hey folks | 11:38 |
| Madkiss | morgan: are you there by chance? :) | 11:38 |
| *** jaosorior has quit IRC | 11:45 | |
| *** jaosorior has joined #openstack-keystone | 11:45 | |
| *** Burgosz has quit IRC | 11:46 | |
| samueldmq | Madkiss: hi | 11:50 |
| *** jaosorior_ has joined #openstack-keystone | 11:53 | |
| *** geoffarnold has quit IRC | 11:54 | |
| *** geoffarnold has joined #openstack-keystone | 11:54 | |
| Madkiss | We're seeing a strange effect here: Horizon is terribly slow, and we suspect Keystone to be the root cause for it | 11:54 |
| *** jaosorior has quit IRC | 11:57 | |
| *** nicodemos has joined #openstack-keystone | 12:00 | |
| *** e0ne has quit IRC | 12:01 | |
| *** baffle_ is now known as baffle | 12:01 | |
| *** yottatsa has quit IRC | 12:02 | |
| *** Nirupama has quit IRC | 12:03 | |
| *** jaosorior_ has quit IRC | 12:04 | |
| *** jaosorior has joined #openstack-keystone | 12:04 | |
| *** marzif has quit IRC | 12:12 | |
| *** marzif has joined #openstack-keystone | 12:12 | |
| *** e0ne has joined #openstack-keystone | 12:13 | |
| *** geoffarn_ has joined #openstack-keystone | 12:15 | |
| *** raildo-afk is now known as raildo | 12:16 | |
| *** jecarey_ has quit IRC | 12:17 | |
| *** nisha has joined #openstack-keystone | 12:18 | |
| *** geoffarnold has quit IRC | 12:20 | |
| *** marzif has quit IRC | 12:21 | |
| *** jaosorior has quit IRC | 12:27 | |
| *** jaosorior has joined #openstack-keystone | 12:28 | |
| marekd | dstanek: hello. | 12:31 |
| dstanek | marekd: hi | 12:31 |
| *** doug-fish has joined #openstack-keystone | 12:31 | |
| marekd | dstanek: running a functional testsuite should work as with: tox -efunctional federation (for this patch https://review.openstack.org/#/c/203258/) ? | 12:31 |
| marekd | or what is the right wayto specify file/class/test to run ? | 12:32 |
| *** ayoung has joined #openstack-keystone | 12:33 | |
| *** ChanServ sets mode: +v ayoung | 12:33 | |
| dstanek | marekd: you can specify the class just like you do for unit tests | 12:35 |
| marekd | dstanek: ok, i found the error , there was no __init__.py in the tests/functional/federation | 12:35 |
| *** geoffarn_ has quit IRC | 12:36 | |
| *** geoffarnold has joined #openstack-keystone | 12:36 | |
| *** doug-fish has quit IRC | 12:37 | |
| *** edmondsw has joined #openstack-keystone | 12:37 | |
| *** doug-fish has joined #openstack-keystone | 12:37 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Federation Identity Provider functional tests https://review.openstack.org/203258 | 12:40 |
| *** doug-fish has quit IRC | 12:42 | |
| *** doug-fish has joined #openstack-keystone | 12:42 | |
| *** agireud has quit IRC | 12:47 | |
| *** yottatsa has joined #openstack-keystone | 12:48 | |
| *** amakarov_away is now known as amakarov | 12:50 | |
| marekd | dstanek: https://review.openstack.org/#/c/203142/8/keystone/tests/functional/core.py looks like fetching values from the environment doesn't really work. Any quick ideas on how to fix it? | 12:54 |
| *** geoffarnold has quit IRC | 12:57 | |
| *** geoffarnold has joined #openstack-keystone | 12:58 | |
| *** pauloewerton has joined #openstack-keystone | 12:59 | |
| dstanek | marekd: not sure, but in about 30 minutes i can take a look | 12:59 |
| *** jecarey has joined #openstack-keystone | 13:00 | |
| marekd | dstanek: would be heplful, thanks | 13:01 |
| *** jsavak has joined #openstack-keystone | 13:03 | |
| *** hrou has joined #openstack-keystone | 13:03 | |
| *** pnavarro|lunch is now known as pnavarro | 13:06 | |
| *** dimsum__ is now known as dims | 13:08 | |
| *** fhubik is now known as fhubik_brb | 13:09 | |
| *** geoffarnold has quit IRC | 13:19 | |
| *** geoffarnold has joined #openstack-keystone | 13:19 | |
| *** gordc has joined #openstack-keystone | 13:21 | |
| *** zzzeek has joined #openstack-keystone | 13:21 | |
| *** links has quit IRC | 13:22 | |
| *** fhubik_brb is now known as fhubik | 13:24 | |
| *** chlong has joined #openstack-keystone | 13:26 | |
| *** btully has joined #openstack-keystone | 13:30 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Federation Identity Provider functional tests https://review.openstack.org/203258 | 13:31 |
| marekd | dstanek: this ^^ basically works when i harcode my devstacks urls/passwors/projects id | 13:32 |
| marekd | dstanek: i will try to focus more on functional tests now | 13:32 |
| marekd | dstanek: so i will probably also bug you a little bit more :-) | 13:32 |
| *** erhudy has joined #openstack-keystone | 13:32 | |
| *** jasondotstar|afk is now known as jasondotstar | 13:32 | |
| *** nisha_ has joined #openstack-keystone | 13:36 | |
| *** nisha_ has quit IRC | 13:36 | |
| *** nisha_ has joined #openstack-keystone | 13:38 | |
| *** nisha has quit IRC | 13:39 | |
| *** geoffarnold has quit IRC | 13:40 | |
| *** nisha_ is now known as nisha | 13:40 | |
| dstanek | marekd: bug me as often as you need | 13:40 |
| *** geoffarnold has joined #openstack-keystone | 13:40 | |
| *** zz_john5223 is now known as john5223 | 13:47 | |
| *** csoukup has joined #openstack-keystone | 13:51 | |
| *** dsirrine has joined #openstack-keystone | 13:51 | |
| *** ParsectiX has quit IRC | 13:53 | |
| *** diazjf has joined #openstack-keystone | 13:54 | |
| *** openstackstatus has joined #openstack-keystone | 13:57 | |
| *** ChanServ sets mode: +v openstackstatus | 13:57 | |
| *** yottatsa has quit IRC | 13:57 | |
| *** su_zhang_ has joined #openstack-keystone | 14:01 | |
| *** stevemar_ has joined #openstack-keystone | 14:01 | |
| *** ChanServ sets mode: +o stevemar_ | 14:01 | |
| *** topol has joined #openstack-keystone | 14:01 | |
| *** ChanServ sets mode: +v topol | 14:01 | |
| *** geoffarn_ has joined #openstack-keystone | 14:02 | |
| *** geoffarnold has quit IRC | 14:02 | |
| *** links has joined #openstack-keystone | 14:05 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Expose method list inconsistency in federation api https://review.openstack.org/229125 | 14:08 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:09 | |
| *** ngupta has joined #openstack-keystone | 14:10 | |
| *** yottatsa has joined #openstack-keystone | 14:13 | |
| samueldmq | lbragstad: ping - https://review.openstack.org/#/c/229125 | 14:13 |
| samueldmq | lbragstad: thanks for adding the @wip annotation, but you forgot to remove a comment there :) | 14:13 |
| lbragstad | i'll push another revision | 14:14 |
| *** richm has joined #openstack-keystone | 14:14 | |
| *** Guest38101 is now known as zeus | 14:14 | |
| stevemar_ | dolphm lbragstad dstanek morgan bknudson henrynash marekd jamielennox|away any last minute stuff going into liberty RC2?? | 14:14 |
| *** zeus has quit IRC | 14:14 | |
| *** zeus has joined #openstack-keystone | 14:14 | |
| lbragstad | stevemar_: not that I can think of | 14:14 |
| bknudson | stevemar_: keystone seems to be working in the gate. | 14:15 |
| henrynash | stevemar_: nothing from me | 14:15 |
| stevemar_ | bknudson: in the gate, SHIP IT! | 14:15 |
| samueldmq | stevemar_: wait .. there is a patch from lbragstad that maybe worth it including | 14:15 |
| samueldmq | let me find the link again | 14:15 |
| stevemar_ | lets hope we don't have an RC3 | 14:15 |
| stevemar_ | samueldmq: uh oh | 14:15 |
| samueldmq | stevemar_: lbragstad see https://review.openstack.org/#/c/221786/ | 14:15 |
| *** raildo is now known as raildo-afk | 14:16 | |
| stevemar_ | lbragstad: is that one rc worthy? ^ | 14:16 |
| marekd | stevemar_: nope. | 14:16 |
| lbragstad | stevemar_: that protects against the upgrade case | 14:16 |
| *** vivekd has joined #openstack-keystone | 14:17 | |
| *** thiagop has joined #openstack-keystone | 14:17 | |
| *** diazjf has quit IRC | 14:18 | |
| stevemar_ | lbragstad: explain that more? | 14:18 |
| lbragstad | stevemar_: that patch only makes sense to have in liberty | 14:18 |
| lbragstad | stevemar_: when fernet was first implemented, we padded the tokens before giving them back to theuser | 14:19 |
| lbragstad | stevemar_: that changed, in keystone we now remove all the padding from the token before returning it to the user | 14:19 |
| stevemar_ | lbragstad: well, we are cutting liberty | 14:19 |
| lbragstad | and then we re-inflate that padding on the way back in, when we validate the token | 14:19 |
| lbragstad | stevemar_: yeah, for some reason i thought that patch merged | 14:19 |
| stevemar_ | lbragstad: so we definitely need it in liberty? | 14:20 |
| lbragstad | stevemar_: that patch makes it so that, in liberty, we can validate tokens that have padding, and tokens that don't have padding, it should be removed in Mitaka because liberty only issues tokens that don't have padding... | 14:20 |
| lbragstad | stevemar_: yes | 14:20 |
| lbragstad | stevemar_: it has been up for a while, i lost track of it | 14:21 |
| samueldmq | lbragstad: ++ it will give stability (tokens will still be valid through upgrade), we don't know what timeout they give to tkens | 14:21 |
| lbragstad | stevemar_: I can address those last couple comments, | 14:21 |
| stevemar_ | lbragstad: it's all good, the bug wasn't tagged | 14:21 |
| stevemar_ | lbragstad: so i lost track of it too, yeah, fix them up and we are look at it again | 14:22 |
| lbragstad | stevemar_: ok, i'll get a new patch up this morning | 14:22 |
| stevemar_ | lbragstad: cool | 14:22 |
| stevemar_ | cc dolphm ^ | 14:22 |
| *** geoffarn_ has quit IRC | 14:22 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add caching to get_catalog https://review.openstack.org/215212 | 14:23 |
| lbragstad | clear | 14:23 |
| *** geoffarnold has joined #openstack-keystone | 14:23 | |
| * lbragstad moves to an *actual* terminal... | 14:23 | |
| stevemar_ | lbragstad: actually, it should be done on in stable/liberty | 14:23 |
| stevemar_ | since it's going to be removed in mitaka | 14:23 |
| stevemar_ | and master is mitaka right now | 14:24 |
| lbragstad | stevemar_: ok, i'm wondering what the process should be for that though... | 14:24 |
| samueldmq | stevemar_: ++ | 14:24 |
| samueldmq | lbragstad: just proposing the change against origin/stable/liberty ? | 14:25 |
| lbragstad | stevemar_: because we'd be merging something to a stable branch without it in master/ | 14:25 |
| stevemar_ | thats a good point | 14:25 |
| *** raildo-afk is now known as raildo | 14:25 | |
| stevemar_ | it makes sense to me to only propose to stable/liberty since it's going to be reverted in M | 14:26 |
| *** roxanagh_ has joined #openstack-keystone | 14:26 | |
| bknudson | if the fix isn't needed in master put it to stable/liberty | 14:26 |
| samueldmq | stevemar_: yeah and it will be all done | 14:26 |
| bknudson | we only expect it in master first because we don't want a regression | 14:26 |
| stevemar_ | but you can propose to master, we can get it in, backport it, then propose a revert to master | 14:27 |
| bknudson | that's more confusing | 14:27 |
| stevemar_ | bknudson: \o/ | 14:27 |
| stevemar_ | bknudson: you're more familiar with stable than i am, can we propose directly to stable? or does it have to be a backport? | 14:28 |
| bknudson | stevemar_: you can do anything you want. | 14:28 |
| stevemar_ | yay | 14:29 |
| bknudson | there's nothing that forces change in stable to be backports | 14:29 |
| stevemar_ | lbragstad: that's your answer | 14:29 |
| bknudson | as long as you have a good reason to do it. | 14:29 |
| *** nisha has quit IRC | 14:29 | |
| *** tonytan4ever has joined #openstack-keystone | 14:31 | |
| stevemar_ | bknudson: "only applicable to liberty" is a good reason | 14:32 |
| lbragstad | stevemar_: https://review.openstack.org/#/c/231022/ | 14:32 |
| *** jsavak has quit IRC | 14:32 | |
| stevemar_ | everyone ^ | 14:33 |
| * marekd shall reconfig irc client to highlight 'everyone' | 14:34 | |
| stevemar_ | everyone should do that ^ :) | 14:34 |
| stevemar_ | dolphm: would appreciate your eyes on ^ | 14:35 |
| dstanek | stevemar_: not that i know of | 14:36 |
| bknudson | ok, I'm confused... why does this only need to be in liberty and not in M? | 14:37 |
| *** chlong has quit IRC | 14:38 | |
| *** tonytan4ever has quit IRC | 14:40 | |
| lbragstad | bknudson: we don't issue fernet tokens with padding on them in liberty | 14:40 |
| *** jsavak has joined #openstack-keystone | 14:40 | |
| lbragstad | bknudson: so the upgrade only effects kilo to liberty | 14:40 |
| bknudson | lbragstad: what if I upgrade from kilo to M? | 14:41 |
| lbragstad | bknudson: is that an upgrade we support/ | 14:41 |
| lbragstad | bknudson: https://github.com/openstack/keystone/commit/f3e3a653f9c9ce0f9a7ba842eff118e5887eb388 | 14:41 |
| bknudson | lbragstad: sure, you can upgrade from k to m. | 14:42 |
| bknudson | as long as you follow the upgrade notes for each release | 14:42 |
| lbragstad | hmm, ok, I can propose that to master then too | 14:42 |
| *** alextricity has joined #openstack-keystone | 14:43 | |
| *** tonytan4ever has joined #openstack-keystone | 14:43 | |
| *** phalmos has joined #openstack-keystone | 14:44 | |
| *** geoffarn_ has joined #openstack-keystone | 14:44 | |
| *** geoffarnold has quit IRC | 14:45 | |
| bknudson | I'm sure we can remove it sometime... usually it's N+2. | 14:47 |
| *** ngupta has quit IRC | 14:47 | |
| bknudson | maybe add a note that the backwards-compatibility can be removed in N, and then we can add it to the release notes. | 14:48 |
| bknudson | or we could just say in the release notes that fernet tokens aren't compatible between releases. | 14:48 |
| *** slberger has joined #openstack-keystone | 14:50 | |
| bknudson | there should be tests that have the old format of fernet tokens working with the latest code so that we know we can upgrade. | 14:50 |
| *** jsavak has quit IRC | 14:51 | |
| *** woodster_ has joined #openstack-keystone | 14:52 | |
| *** EmilienM has quit IRC | 14:55 | |
| *** EmilienM has joined #openstack-keystone | 14:55 | |
| *** david-ly_ has joined #openstack-keystone | 14:56 | |
| *** david-lyle has quit IRC | 14:57 | |
| *** stevemar_ has quit IRC | 14:57 | |
| *** david-ly_ is now known as david-lyle | 14:57 | |
| *** stevemar_ has joined #openstack-keystone | 14:57 | |
| *** ChanServ sets mode: +o stevemar_ | 14:57 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Config option for insecure responses https://review.openstack.org/207226 | 14:59 |
| *** fhubik has quit IRC | 14:59 | |
| lbragstad | bknudson: dolphm so are we not going to put https://review.openstack.org/#/c/231022/1 in master? | 15:01 |
| *** nicodemos has quit IRC | 15:01 | |
| dolphm | lbragstad: with mitaka open, do we need to? | 15:02 |
| lbragstad | bknudson: I can unabandon https://review.openstack.org/#/c/221786/ | 15:02 |
| dolphm | lbragstad: if you want to support direct upgrades from kilo->mitaka then it'd be useful | 15:02 |
| *** stevemar_ has quit IRC | 15:02 | |
| dolphm | i don't know if we traditionally support skipping or not | 15:02 |
| lbragstad | dolphm: is that something we are going to bother with? | 15:02 |
| dolphm | i know people try, and there's always a recommendation against | 15:02 |
| bknudson | does it cost anything to carry it? | 15:02 |
| lbragstad | bknudson: a test... | 15:03 |
| lbragstad | i think? | 15:03 |
| *** aix has quit IRC | 15:03 | |
| *** david-ly_ has joined #openstack-keystone | 15:03 | |
| *** david-lyle has quit IRC | 15:03 | |
| bknudson | I think we should put it in master, with a note that we can remove it in n. | 15:03 |
| lbragstad | bknudson: alright, so i'll unabandon https://review.openstack.org/#/c/221786/ fix it up, then use that as the backport | 15:04 |
| *** david-ly_ is now known as david-lyle | 15:04 | |
| bknudson | great, thanks | 15:05 |
| *** geoffarn_ has quit IRC | 15:05 | |
| *** vivekd has quit IRC | 15:05 | |
| *** geoffarnold has joined #openstack-keystone | 15:06 | |
| samueldmq | bknudson: lbragstad cool, sounds pretty right :) | 15:06 |
| *** yottatsa has quit IRC | 15:06 | |
| dolphm | lbragstad: that patch should also exist in kilo so that you can upgrade from unpatched kilo to patched kilo | 15:07 |
| lbragstad | dolphm: true, i'll propose that as well | 15:07 |
| dolphm | bknudson: easy enough | 15:07 |
| *** jecarey has quit IRC | 15:08 | |
| *** su_zhang_ has quit IRC | 15:12 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Ensure token validation works irrespective of padding https://review.openstack.org/221786 | 15:12 |
| *** diazjf has joined #openstack-keystone | 15:15 | |
| morgan | *yawn* yep need coffee, definitely a monday... | 15:15 |
| *** stevemar_ has joined #openstack-keystone | 15:18 | |
| *** ChanServ sets mode: +o stevemar_ | 15:18 | |
| marekd | dstanek: did you have a chance to take a look why environment variabes are not honoured? | 15:20 |
| bknudson | it's probably tox not passing the env vars through | 15:22 |
| stevemar_ | lbragstad: bknudson looks like this bug might miss liberty rc2 then | 15:22 |
| *** alejandrito has joined #openstack-keystone | 15:23 | |
| *** jasonsb_ has joined #openstack-keystone | 15:24 | |
| alextricity | Hey, does anybody know about keystone's "auth_context" | 15:24 |
| alextricity | ? | 15:24 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Ensure token validation works irrespective of padding https://review.openstack.org/221786 | 15:24 |
| alextricity | I'm trying to figure out why my keystone federation isn't working. To me it looks like wsgi.py isn't issuing the right GET request (the request doesn't have the parameters it should have) | 15:25 |
| dolphm | marekd: ^ | 15:25 |
| alextricity | Was wondering if maybe it's this; There is either no auth token in the request or the certificate issuer is not trusted. No auth context will be set. process_request /usr/local/lib/python2.7/dist-packages/keystone/middleware/core.py:301 | 15:25 |
| *** jsavak has joined #openstack-keystone | 15:25 | |
| marekd | alextricity: some more context would be useful. | 15:26 |
| marekd | esp what client are you using? | 15:26 |
| *** ngupta has joined #openstack-keystone | 15:26 | |
| *** geoffarnold has quit IRC | 15:26 | |
| alextricity | marekd: Sure. I'm just doing this through horizon using firefox. I have keystone federation set up with oidc. | 15:27 |
| alextricity | to authenticate with google | 15:27 |
| *** geoffarnold has joined #openstack-keystone | 15:27 | |
| *** Ephur has joined #openstack-keystone | 15:27 | |
| marekd | alextricity: allrighty. | 15:27 |
| marekd | alextricity: and what exactly GET call is failing for you. Can you specify the url ? | 15:28 |
| marekd | alextricity: (there are many calls in that workflow, that's why i am asking) | 15:28 |
| *** tonytan4ever has quit IRC | 15:29 | |
| alextricity | marekd: Absolutely. The mod_auth_openidc apache module requires a redirect URI to redirect me back to horizon. So it's issuing a GET https://furiouscat.com:5000/v3/auth/OS-FEDERATION/websso/redirect: | 15:29 |
| alextricity | But i'm pretty sure this is suppose to have some parameters associated with it. | 15:30 |
| marekd | you should have ?origin=horizon.website.url | 15:30 |
| stevemar_ | alextricity: the random colon at the end it weird: https://furiouscat.com:5000/v3/auth/OS-FEDERATION/websso/redirect: | 15:31 |
| alextricity | It's not building out the query_string like it should here: https://github.com/openstack/keystone/blob/f15d9f493cf36bdb431412e6bc1d33876dd68fa3/keystone/common/wsgi.py#L202 | 15:31 |
| alextricity | Oh..that was a copy/paste typo | 15:31 |
| alextricity | The logs don't show that colon | 15:31 |
| alextricity | marekd: Right. I should..but for some reason i'm not.. :/ | 15:32 |
| stevemar_ | alextricity: hitting furiouscat.com/ works well, looks like you have horizon setup correctly | 15:32 |
| alextricity | Wait...are you saying I should have that origin paramter configured in my apache configs? | 15:32 |
| marekd | alextricity: not in apache | 15:32 |
| *** nisha has joined #openstack-keystone | 15:32 | |
| marekd | alextricity: somewhere in apache. | 15:32 |
| marekd | tfu | 15:32 |
| *** jsavak has quit IRC | 15:32 | |
| marekd | in horizon | 15:32 |
| dstanek | marekd: I'm playing with it now | 15:33 |
| marekd | dstanek: thanks! | 15:33 |
| *** jsavak has joined #openstack-keystone | 15:33 | |
| marekd | alextricity: when I try https://furiouscat.com:5000/v3/auth/OS-FEDERATION/websso/redirect i see what i had expected to see: http://cdn.pasteraw.com/gbwrwo1i1ljwwfrfzeaxq4u89ehtnz7# | 15:33 |
| lbragstad | bknudson: dolphm stevemar_ master - https://review.openstack.org/#/c/221786/ | 15:34 |
| lbragstad | stable/liberty - https://review.openstack.org/#/c/231051/ | 15:34 |
| marekd | alextricity: so i'd check whether horizon is configured well. | 15:34 |
| lbragstad | stable/kilo - https://review.openstack.org/#/c/231057/ (had some conflicts here) | 15:34 |
| alextricity | marekd: Yeah..that's what I'm trying to work through..I've been banging my head over this | 15:34 |
| alextricity | Would it be maybe the KEYSTONE_URL in dashboard configs? | 15:34 |
| alextricity | I'll check | 15:35 |
| marekd | i assume you know what's the purpose of the 'origin' parameter. | 15:35 |
| marekd | alextricity: rather not | 15:35 |
| alextricity | marekd: I'm still a little hazy with how this all works | 15:35 |
| alextricity | but I presume that origin parameter is where i'm suppose be taken | 15:35 |
| marekd | alextricity: don't worry - it's a little bit confusing at the beginning. | 15:36 |
| *** Guest43458 is now known as med_ | 15:36 | |
| *** med_ has quit IRC | 15:36 | |
| *** med_ has joined #openstack-keystone | 15:36 | |
| marekd | alextricity: origin is the url where you will be taken once you authenticate with keystone (usually it will be horizon that you hit first) | 15:36 |
| *** med_ is now known as med | 15:37 | |
| *** med is now known as med_ | 15:38 | |
| *** dims has quit IRC | 15:40 | |
| *** ayoung has quit IRC | 15:41 | |
| alextricity | marekd: stevemar_ Where is it suppose to build out that origin paramter? | 15:42 |
| alextricity | Is that information gathered from the apache oidc module? | 15:42 |
| *** diazjf has quit IRC | 15:42 | |
| *** su_zhang_ has joined #openstack-keystone | 15:42 | |
| marekd | https://github.com/openstack/django_openstack_auth/blob/master/openstack_auth/utils.py#L189 | 15:42 |
| marekd | it's horizon | 15:42 |
| alextricity | wait. marekd you said that is configured in horizon? | 15:43 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Documentation for other services https://review.openstack.org/204801 | 15:44 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Additional documentation for services https://review.openstack.org/211184 | 15:44 |
| *** diazjf has joined #openstack-keystone | 15:44 | |
| marekd | https://github.com/openstack/django_openstack_auth/blob/master/openstack_auth/utils.py#L244 | 15:46 |
| marekd | this should avtually be configured by default | 15:46 |
| marekd | alextricity: | 15:46 |
| *** pnavarro is now known as pnavarro|off | 15:46 | |
| *** su_zhang_ has quit IRC | 15:47 | |
| *** dims has joined #openstack-keystone | 15:47 | |
| *** dims has quit IRC | 15:47 | |
| *** Guest96374 has joined #openstack-keystone | 15:47 | |
| *** Guest96374 has quit IRC | 15:48 | |
| *** david-ly_ has joined #openstack-keystone | 15:48 | |
| *** david-lyle has quit IRC | 15:48 | |
| *** dims_ has joined #openstack-keystone | 15:48 | |
| *** geoffarnold is now known as geoffarnoldX | 15:49 | |
| *** david-ly_ is now known as david-lyle | 15:49 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Expose method list inconsistency in federation api https://review.openstack.org/229125 | 15:50 |
| *** jasonsb_ has quit IRC | 15:50 | |
| marekd | alextricity: did you setup in horizon WEBSSO_IDP_MAPPING = "saml2" ? | 15:51 |
| *** nisha has quit IRC | 15:52 | |
| *** diazjf has left #openstack-keystone | 15:54 | |
| *** alejandrito has quit IRC | 15:55 | |
| marekd | alextricity: try hitting this url and see what happens: https://furiouscat.com:5000/v3/auth/OS-FEDERATION/websso/saml2/auth?origin=<url encoded horizon url> | 15:57 |
| marekd | sorry | 15:59 |
| marekd | https://furiouscat.com:5000/v3/auth/OS-FEDERATION/websso/saml2?origin=<url encoded horizon url> | 15:59 |
| *** richm has quit IRC | 15:59 | |
| alextricity | Hey marekd I didn't set that directive in my local_settings.py | 16:00 |
| marekd | alextricity: so maybe that's the reason | 16:00 |
| alextricity | Is that also needed for oidc? | 16:00 |
| marekd | alextricity: for each protocol | 16:00 |
| alextricity | in local_settings.py right? | 16:00 |
| marekd | alextricity: settings.py rather? | 16:00 |
| marekd | well anyway | 16:00 |
| marekd | which protocol did you configure on keystone? | 16:01 |
| marekd | oidc? | 16:01 |
| alextricity | yes | 16:01 |
| marekd | set the same name in WEBSSO_IDP_MAPPING | 16:01 |
| marekd | oidc | 16:01 |
| alextricity | marekd: Oh..a new error | 16:06 |
| alextricity | I heard that's called progress in openstack | 16:06 |
| alextricity | XD | 16:06 |
| alextricity | jk | 16:06 |
| marekd | alextricity: did you configure keystone ? | 16:06 |
| marekd | alextricity: anyway, which tz are you ? | 16:06 |
| alextricity | Central | 16:06 |
| marekd | CEST? | 16:06 |
| alextricity | CST | 16:07 |
| marekd | uh | 16:07 |
| alextricity | yes. I configued keystone. My identity provider is there, so are my mappings and protocols | 16:07 |
| *** itlinux has quit IRC | 16:08 | |
| marekd | alextricity: which error now ? | 16:08 |
| *** yottatsa has joined #openstack-keystone | 16:08 | |
| alextricity | marekd: It looks like a django error now | 16:08 |
| alextricity | 'str' object has no attribute 'get' | 16:08 |
| alextricity | Exception Location: sr/local/lib/python2.7/dist-packages/openstack_dashboard/wsgi/../../openstack_auth/utils.py in get_websso_url, line 246 | 16:09 |
| marekd | alextricity: so try WEBSSO_IDP_MAPPING = {'oidc'} | 16:09 |
| *** geoffarnoldX has quit IRC | 16:09 | |
| *** geoffarnold has joined #openstack-keystone | 16:09 | |
| *** raildo is now known as raildo-afk | 16:10 | |
| alextricity | Same :/ furiouscat.com | 16:10 |
| *** raildo-afk is now known as raildo | 16:12 | |
| stevemar_ | alextricity: you are using django_openstack_auth 2.0.0? | 16:12 |
| alextricity | yes, 2.0.1 | 16:13 |
| marekd | this is all because multiple paths to websso | 16:13 |
| alextricity | I am running two horizon boxes | 16:13 |
| alextricity | load balanced by haproxy | 16:13 |
| *** _cjones_ has joined #openstack-keystone | 16:14 | |
| marekd | alextricity: actually, if you remove (sorry) WEBSSO_IDP_MAPPING it should work fine | 16:16 |
| *** alejandrito has joined #openstack-keystone | 16:16 | |
| *** stevemar_ has quit IRC | 16:17 | |
| *** stevemar_ has joined #openstack-keystone | 16:18 | |
| *** ChanServ sets mode: +o stevemar_ | 16:18 | |
| alextricity | Oh okay. I'll keep digging into openstack_auth to see where my problem is, but to be clear, this wouldn't be a problem with the auth_context not being populated right? | 16:19 |
| *** tonytan4ever has joined #openstack-keystone | 16:19 | |
| marekd | alextricity: no | 16:19 |
| marekd | i already told yo | 16:19 |
| marekd | try the url by hand | 16:19 |
| marekd | i posted it earlier | 16:19 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project name constraints https://review.openstack.org/158372 | 16:20 |
| *** marzif has joined #openstack-keystone | 16:20 | |
| alextricity | marekd: ah..sorry. So much text | 16:21 |
| marekd | alextricity: | 16:21 |
| marekd | i gotta go for now | 16:21 |
| alextricity | marekd: For sure. Thanks for your time :) | 16:21 |
| marekd | try it and ping me tomorrow if you have problems | 16:21 |
| alextricity | Alright. thank you | 16:21 |
| marekd | alextricity: it's more like misconfiguration rather than actual bug in the code. | 16:21 |
| alextricity | marekd: Yeah probably. I tried hitting that URL by hand but I get the same message. I'll keep working on it! Thanks again | 16:22 |
| *** yottatsa has quit IRC | 16:24 | |
| *** hrou has quit IRC | 16:24 | |
| *** hrou has joined #openstack-keystone | 16:24 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Sample Identity endpoints changed to unversioned https://review.openstack.org/130669 | 16:24 |
| *** hrou has quit IRC | 16:24 | |
| *** ngupta has quit IRC | 16:25 | |
| *** ngupta has joined #openstack-keystone | 16:25 | |
| *** yottatsa has joined #openstack-keystone | 16:26 | |
| *** jistr has quit IRC | 16:26 | |
| dolphm | anyone know of a git shortcut to effectively "delete the current branch" | 16:26 |
| *** e0ne has quit IRC | 16:28 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: Update the project description https://review.openstack.org/230866 | 16:28 |
| stevemar_ | dolphm: ^ | 16:29 |
| *** geoffarnold has quit IRC | 16:30 | |
| *** geoffarnold has joined #openstack-keystone | 16:31 | |
| *** lhcheng has joined #openstack-keystone | 16:32 | |
| *** ChanServ sets mode: +v lhcheng | 16:32 | |
| *** bknudson has left #openstack-keystone | 16:34 | |
| *** bknudson has joined #openstack-keystone | 16:35 | |
| *** ChanServ sets mode: +v bknudson | 16:35 | |
| *** bknudson has left #openstack-keystone | 16:35 | |
| *** bknudson has joined #openstack-keystone | 16:35 | |
| *** ChanServ sets mode: +v bknudson | 16:35 | |
| *** jaosorior has quit IRC | 16:36 | |
| *** jaosorior_ has joined #openstack-keystone | 16:36 | |
| *** alejandrito has quit IRC | 16:37 | |
| *** ayoung has joined #openstack-keystone | 16:37 | |
| *** ChanServ sets mode: +v ayoung | 16:37 | |
| stevemar_ | dolphm: oh right, one more thing | 16:38 |
| *** raildo is now known as raildo-afk | 16:38 | |
| stevemar_ | dolphm: https://review.openstack.org/#/c/230231/ | 16:38 |
| stevemar_ | or bknudson | 16:38 |
| bknudson | stevemar_: I can take a look. | 16:40 |
| bknudson | stevemar_: we don't have the fix released in master yet. | 16:40 |
| stevemar_ | bknudson: yes we do | 16:40 |
| stevemar_ | https://review.openstack.org/#/c/230151/ | 16:41 |
| bknudson | stevemar_: according to this there is no tag with that commit -- http://git.openstack.org/cgit/openstack/python-keystoneclient/log/ | 16:41 |
| *** raildo-afk is now known as raildo | 16:41 | |
| stevemar_ | bknudson: its the first one on the list | 16:42 |
| bknudson | stevemar_: there's no tag for it | 16:42 |
| bknudson | it hasn't been released | 16:42 |
| bknudson | the last release was 1.7.1 | 16:43 |
| stevemar_ | bknudson: its gotta be released as a refresh in master before refreshed in liberty? that seems odd | 16:47 |
| bknudson | I guess since we don't have a master release yet it should be fine. | 16:48 |
| bknudson | it'll be strange to have master say it's at 1.7.1 while stable is at 1.7.2. | 16:49 |
| *** ngupta has quit IRC | 16:50 | |
| *** richm has joined #openstack-keystone | 16:50 | |
| stevemar_ | bknudson: asking dhellmann in -relmgr-office | 16:50 |
| *** jasonsb_ has joined #openstack-keystone | 16:51 | |
| stevemar_ | bknudson: master will be bumped up to 1.8.0 as soon as we need to release something | 16:51 |
| *** geoffarnold has quit IRC | 16:52 | |
| *** geoffarnold has joined #openstack-keystone | 16:52 | |
| bknudson | stevemar_: don't we need to release this bug fix? | 16:53 |
| *** kiran-r has joined #openstack-keystone | 16:53 | |
| stevemar_ | bknudson: you have successfully confused me and everything i thought i knew about stable | 16:54 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 16:55 |
| dstanek | marekd: ^ that will do it | 16:55 |
| *** jasonsb_ has quit IRC | 16:56 | |
| dstanek | marekd: i also moved the test_v3 stuff you were importing to a more common place | 16:56 |
| *** atiwari has joined #openstack-keystone | 16:56 | |
| *** jaosorior_ has quit IRC | 16:58 | |
| *** jaosorior has joined #openstack-keystone | 16:59 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystoneauth: Update the project description https://review.openstack.org/230866 | 17:00 |
| *** su_zhang_ has joined #openstack-keystone | 17:00 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystoneauth: Remove "Features" section from README https://review.openstack.org/231094 | 17:02 |
| openstackgerrit | Dolph Mathews proposed openstack/keystoneauth: Make RST section delineation length match title https://review.openstack.org/231096 | 17:04 |
| *** roxanagh_ has quit IRC | 17:04 | |
| dolphm | stevemar_: morgan: dhellmann: why aren't our package releases getting to pypi? problem or missed step with the new release tooling? https://bugs.launchpad.net/keystoneauth/+bug/1502501 | 17:06 |
| openstack | Launchpad bug 1502501 in keystoneauth "releases not published to pypi" [Undecided,New] | 17:06 |
| *** roxanagh_ has joined #openstack-keystone | 17:06 | |
| amakarov | bknudson, o/ | 17:07 |
| *** ngupta has joined #openstack-keystone | 17:08 | |
| *** marzif has quit IRC | 17:09 | |
| *** thiagop has quit IRC | 17:09 | |
| amakarov | bknudson, in https://review.openstack.org/#/c/229865/ you are fixing 1-liners and also doing many edits, can these edits be considered related to this CR? | 17:09 |
| *** iurygregory has quit IRC | 17:09 | |
| lbragstad | dolphm: random thought on the fernet + tempest issues | 17:09 |
| *** pauloewerton has quit IRC | 17:10 | |
| amakarov | bknudson, you are changind documentation after all... | 17:10 |
| lbragstad | dolphm: mysql truncates subsecond precision, but how does it do that? Does it ever round up? Does it always round down? I'm trying to test manually now | 17:10 |
| dolphm | lbragstad: i believe the docs say it simply truncates unsupport precesion | 17:11 |
| dolphm | unsupported* precision* | 17:11 |
| *** aix has joined #openstack-keystone | 17:11 | |
| lbragstad | dolphm: this is what i'm testing manually - http://cdn.pasteraw.com/etjprig71cmtj4vjh2hc1dufpzha01g | 17:12 |
| *** geoffarn_ has joined #openstack-keystone | 17:13 | |
| *** geoffarnold has quit IRC | 17:14 | |
| dolphm | lbragstad: weird, what version is that? | 17:14 |
| lbragstad | dolphm: Server version: 5.5.44-0ubuntu0.14.04.1 (Ubuntu) | 17:14 |
| lbragstad | dolphm: this was on my tempest box | 17:14 |
| *** pnavarro|off has quit IRC | 17:15 | |
| dolphm | "However, when MySQL stores a value into a column of any temporal data type, it discards any fractional part and does not store it." | 17:16 |
| dolphm | lbragstad: what does "SELECT NOW(6);" return? | 17:16 |
| *** e0ne has joined #openstack-keystone | 17:17 | |
| lbragstad | dolphm: interesting, the truncations works as you describe it in maria | 17:17 |
| dolphm | lbragstad: maria 5.5? | 17:17 |
| lbragstad | dolphm: 10.0.21-MariaDB-1~trusty-wsrep-log | 17:18 |
| *** raildo is now known as raildo-afk | 17:18 | |
| lbragstad | dolphm: select now(6) returns - 2015-10-05 17:07:01.419608 | 17:19 |
| dolphm | lbragstad: in mysql 5.5 or maria 10.0.21? | 17:19 |
| *** thiagop has joined #openstack-keystone | 17:20 | |
| lbragstad | dolphm: in maria 10.0.21 is returns subsecond precision | 17:21 |
| *** tellesnobrega is now known as tellesnobrega_af | 17:21 | |
| *** stevemar_ has quit IRC | 17:21 | |
| *** richm has quit IRC | 17:26 | |
| *** raildo-afk is now known as raildo | 17:30 | |
| *** openstackgerrit has quit IRC | 17:31 | |
| *** openstackgerrit has joined #openstack-keystone | 17:32 | |
| *** samleon has joined #openstack-keystone | 17:32 | |
| *** itlinux has joined #openstack-keystone | 17:33 | |
| *** jsavak has quit IRC | 17:33 | |
| lhcheng | question on KSM, when there's no memcache_servers defined on the config, it uses a _CachePool() in the code. Does the mean it is still performing some caching? | 17:34 |
| *** alejandrito has joined #openstack-keystone | 17:34 | |
| lhcheng | https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_cache.py#L149 | 17:34 |
| *** jsavak has joined #openstack-keystone | 17:34 | |
| *** geoffarn_ has quit IRC | 17:34 | |
| *** geoffarnold has joined #openstack-keystone | 17:35 | |
| *** stevemar_ has joined #openstack-keystone | 17:36 | |
| *** ChanServ sets mode: +o stevemar_ | 17:36 | |
| *** alejandrito has quit IRC | 17:38 | |
| *** jsavak has quit IRC | 17:47 | |
| *** jsavak has joined #openstack-keystone | 17:47 | |
| *** raildo is now known as raildo-afk | 17:48 | |
| morgan | lhcheng: by default keystonemiddleware does in-memory caching. I've long wanted to make that not the case and require caching to be opt in only | 17:49 |
| morgan | dolphm lbragstad: mysql/maria started supporting subsecond precision at some point. But we dont have a hard mysql version requirement for openstack, we cannot assume it will be the case. | 17:50 |
| *** iurygregory has joined #openstack-keystone | 17:50 | |
| *** diazjf has joined #openstack-keystone | 17:52 | |
| *** tellesnobrega_af is now known as tellesnobrega | 17:53 | |
| *** yottatsa has quit IRC | 17:54 | |
| *** yottatsa has joined #openstack-keystone | 17:54 | |
| *** itlinux has quit IRC | 17:54 | |
| *** geoffarnold has quit IRC | 17:56 | |
| samueldmq | lbragstad: the backport to kilo is actually failing in our tests | 17:56 |
| *** doug-fis_ has joined #openstack-keystone | 17:56 | |
| *** geoffarnold has joined #openstack-keystone | 17:56 | |
| *** doug-fish has quit IRC | 17:56 | |
| *** tellesnobrega is now known as tellesnobrega_af | 17:59 | |
| htruta | hey henrynash, are you around? | 17:59 |
| lbragstad | samueldmq: thanks for the heads up... looking | 17:59 |
| htruta | henrynash: I'm just a little bit concerned about your first comment here: https://review.openstack.org/#/c/213448/18/keystone/resource/core.py | 17:59 |
| *** tellesnobrega_af is now known as tellesnobrega | 18:01 | |
| *** openstackgerrit has quit IRC | 18:01 | |
| *** openstackgerrit has joined #openstack-keystone | 18:02 | |
| lhcheng | morgan: in-memory caching, that means just per process caching? | 18:04 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add initiator to v2 calls for additional auditing https://review.openstack.org/231123 | 18:05 |
| *** jasonsb has joined #openstack-keystone | 18:06 | |
| morgan | Yes | 18:06 |
| bknudson | amakarov: I don't think I have any docstring changes in flight. | 18:07 |
| bknudson | or the ones that I do have are fixing rst issues rather than pep257 | 18:07 |
| amakarov | bknudson, for ex.: https://review.openstack.org/#/c/229865/1/keystone/contrib/federation/utils.py,cm | 18:08 |
| bknudson | amakarov: what about it? | 18:08 |
| lhcheng | morgan: I see.. does KSM also caches the token it presents to keystone for token validation? | 18:09 |
| amakarov | bknudson, you are changing not only PEP257, but also the contents of a docstring | 18:10 |
| bknudson | amakarov: I didn't change that, it was dolphm | 18:10 |
| *** jasonsb has quit IRC | 18:10 | |
| amakarov | bknudson, oh, sorry - I've reviewed the set of changes and didn't notice that not only you are among the authors :) | 18:12 |
| morgan | lhcheng: not sure what you're asking? | 18:12 |
| amakarov | dolphm, in https://review.openstack.org/#/c/229865/ you are fixing 1-liners and also doing many edits, can these edits be considered related to this CR? | 18:13 |
| *** kiran-r has quit IRC | 18:13 | |
| *** aix has quit IRC | 18:14 | |
| *** raildo-afk is now known as raildo | 18:14 | |
| *** mylu has joined #openstack-keystone | 18:14 | |
| *** geoffarn_ has joined #openstack-keystone | 18:17 | |
| *** roxanagh_ has quit IRC | 18:18 | |
| *** geoffarnold has quit IRC | 18:18 | |
| dolphm | bknudson: amakarov: many of pep257's requirements will require rewriting docstrings to be compliant. that's the goal. our docstrings suck. | 18:18 |
| bknudson | does the pep257 or some other checker validate correct use of :raises: and :param: and stuff? | 18:19 |
| bknudson | that would also be handy | 18:19 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for projects acting as domains https://review.openstack.org/213448 | 18:19 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project name constraints https://review.openstack.org/158372 | 18:19 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain parameter to get_project_by_name https://review.openstack.org/210600 | 18:19 |
| amakarov | dolphm, so these are not just unrelated changes, they are to satisfy pep 257 requirements? | 18:19 |
| *** diazjf has quit IRC | 18:20 | |
| dolphm | amakarov: unless you have an idea about how to rewrite the docstring's one line summary to fit in a single line... | 18:20 |
| bknudson | amakarov: try it out. check out the change and revert the line and see if it still passes. | 18:21 |
| *** itlinux has joined #openstack-keystone | 18:21 | |
| dolphm | amakarov: if you have an alternative solution, i'd be happy to revise | 18:21 |
| * amakarov trying it out | 18:22 | |
| bknudson | I wouldn't get too hung up on unrelated doc changes. It's really unlikely this is going to be reverted. | 18:22 |
| *** jasonsb has joined #openstack-keystone | 18:24 | |
| amakarov | bknudson, do these 1-liners have some considerable impact on resulting (generated) documentation? | 18:25 |
| amakarov | bknudson, tox -r -e pep8 succeeded on HEAD^ for that change... | 18:26 |
| bknudson | amakarov: the docstrings for keystone are so useless I don't think it will have a considerable impact. The goal is to not have to spend time commenting on pep257 violations in reviews. | 18:27 |
| bknudson | amakarov: it was the change in tox.ini that caused the docstrings to fail | 18:27 |
| *** dims_ has quit IRC | 18:27 | |
| *** thiagop has quit IRC | 18:28 | |
| amakarov | bknudson, well, let's consider that changes related to the change | 18:28 |
| *** jasonsb has quit IRC | 18:29 | |
| *** browne has joined #openstack-keystone | 18:30 | |
| amakarov | dolphm, https://review.openstack.org/#/c/229855/1/keystone/common/base64utils.py,cm | 18:30 |
| amakarov | if r""" is used, what will '\\' yield as a result in the doc? | 18:31 |
| amakarov | dolphm, I fear some magic is here too :) | 18:32 |
| *** thiagop has joined #openstack-keystone | 18:32 | |
| *** Guest14841 is now known as tsymanczyk | 18:32 | |
| *** yottatsa has quit IRC | 18:33 | |
| *** su_zhang_ has quit IRC | 18:34 | |
| *** atiwari has quit IRC | 18:37 | |
| *** geoffarnold has joined #openstack-keystone | 18:39 | |
| *** geoffarn_ has quit IRC | 18:39 | |
| *** hrou has joined #openstack-keystone | 18:41 | |
| dolphm | amakarov: i believe you're correct, the escape should be removed | 18:41 |
| *** mylu has quit IRC | 18:41 | |
| *** jsavak has quit IRC | 18:42 | |
| dolphm | amakarov: otherwise the escape is rendered in the output because it's treated as a raw string | 18:42 |
| dolphm | amakarov: to demo, http://cdn.pasteraw.com/63b2fod4jvwgkmic99p5cy7zjc6ae87 | 18:44 |
| *** links has quit IRC | 18:44 | |
| *** mylu has joined #openstack-keystone | 18:45 | |
| *** raildo is now known as raildo-afk | 18:45 | |
| *** raildo-afk is now known as raildo | 18:45 | |
| amakarov | dolphm, yes, I've tried this out in the Python console, but wasn't sure if it is handled by sphinx(python) only | 18:45 |
| *** marzif has joined #openstack-keystone | 18:46 | |
| dolphm | amakarov: sphinx parses docstrings per pep257 as far as i'm aware. i'm not sure if you've read the pep, but it goes as far as including parsing algorithms. | 18:46 |
| dolphm | amakarov: if you want to play with pep257, i have a sample file that A) passes pep257, and B) illustrates every major assertion of pep257 http://dolphm.com/pep257-good-python-docstrings-by-example/ | 18:47 |
| *** akanksha_ has joined #openstack-keystone | 18:47 | |
| *** jsavak has joined #openstack-keystone | 18:47 | |
| amakarov | dolphm, you are right: I'm used to check using pep8 only | 18:48 |
| amakarov | and read it of course :) | 18:48 |
| *** diegows has joined #openstack-keystone | 18:48 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix D301: Use r”“” if any backslashes in your docstring (PEP257) https://review.openstack.org/229855 | 18:48 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix D210: No whitespaces allowed surrounding docstring text (PEP257) https://review.openstack.org/229857 | 18:49 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix D200: 1 line docstrings should fit with quotes (PEP257) https://review.openstack.org/229865 | 18:49 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix D202: No blank lines after function docstring (PEP257) https://review.openstack.org/229887 | 18:49 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix D204: blank line required after class docstring (PEP257) https://review.openstack.org/229898 | 18:49 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Promote an arbitrary string to be a docstring https://review.openstack.org/229916 | 18:49 |
| *** stevemar_ has quit IRC | 18:50 | |
| *** stevemar_ has joined #openstack-keystone | 18:50 | |
| *** ChanServ sets mode: +o stevemar_ | 18:50 | |
| *** amakarov is now known as amakarov_away | 18:51 | |
| *** roxanagh_ has joined #openstack-keystone | 18:52 | |
| *** marzif has quit IRC | 18:54 | |
| *** marzif has joined #openstack-keystone | 18:55 | |
| *** stevemar_ has quit IRC | 18:55 | |
| *** dims_ has joined #openstack-keystone | 18:58 | |
| *** dims_ has quit IRC | 18:58 | |
| *** dims_ has joined #openstack-keystone | 18:59 | |
| *** jaosorior has quit IRC | 18:59 | |
| *** geoffarnold has quit IRC | 19:00 | |
| *** geoffarnold has joined #openstack-keystone | 19:00 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Tests for projects acting as domains https://review.openstack.org/211219 | 19:01 |
| *** gyee has joined #openstack-keystone | 19:03 | |
| *** ChanServ sets mode: +v gyee | 19:03 | |
| *** dims_ has quit IRC | 19:03 | |
| dolphm | code reviews have come a long way https://review.openstack.org/#/c/285 | 19:05 |
| *** SpamapS has joined #openstack-keystone | 19:06 | |
| SpamapS | Hey keystoners.. | 19:06 |
| SpamapS | Was there ever resolution on "how to do key revocation without deleting an unpredictably large number of keys at any given time" ? | 19:06 |
| *** e0ne has quit IRC | 19:06 | |
| SpamapS | err | 19:06 |
| SpamapS | s/key/token/ | 19:06 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add docstring validation https://review.openstack.org/229689 | 19:07 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix D210: No whitespaces allowed surrounding docstring text (PEP257) https://review.openstack.org/229857 | 19:07 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix D202: No blank lines after function docstring (PEP257) https://review.openstack.org/229887 | 19:07 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix D300: Use """triple double quotes""" (PEP257) https://review.openstack.org/229853 | 19:07 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix D208: Docstring over indented. (PEP257) https://review.openstack.org/229837 | 19:07 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix D301: Use r”“” if any backslashes in your docstring (PEP257) https://review.openstack.org/229855 | 19:07 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix D402: First line should not be the function's "signature" (PEP257) https://review.openstack.org/229839 | 19:07 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix D200: 1 line docstrings should fit with quotes (PEP257) https://review.openstack.org/229865 | 19:07 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix D204: blank line required after class docstring (PEP257) https://review.openstack.org/229898 | 19:08 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Promote an arbitrary string to be a docstring https://review.openstack.org/229916 | 19:08 |
| morgan | SpamapS: you mean with fernet? | 19:08 |
| morgan | SpamapS: or.. Uh | 19:08 |
| morgan | Wait with the s// i dont know what you're asking | 19:08 |
| dolphm | SpamapS: ^^ i was just about to ask if you have a bug or something?? | 19:09 |
| dolphm | SpamapS: also not sure if you're referring to the old revocation list, mass-deleting UUID/PKI tokens in sql, or token revocation events | 19:10 |
| SpamapS | revocation events | 19:10 |
| SpamapS | with fernet tokens | 19:10 |
| dolphm | SpamapS: what was unpredictable about them? | 19:11 |
| SpamapS | dolphm: it would delete any expired events on any new revocation | 19:11 |
| SpamapS | so sometimes, 100ms responsetime, sometimes 10s | 19:11 |
| dolphm | SpamapS: ah, that's morgan's patch | 19:11 |
| morgan | dolphm: ? | 19:12 |
| dolphm | SpamapS: the old behavior was to delete old revocation events on every token validation. the new behavior is to delete old revocation events each time a new revocation event is issued | 19:12 |
| morgan | Oh. | 19:12 |
| morgan | Yeah | 19:12 |
| morgan | Old events dont really matter if they linger | 19:13 |
| *** wolsen_ is now known as wolsen | 19:13 | |
| dolphm | well, they do :-/ | 19:13 |
| morgan | As long as they are cleaned up? | 19:13 |
| dolphm | if you have a whole lot, token validations are slow. if you have a lot of events in a short time, and then never have any again, then validations will be slow forever | 19:13 |
| SpamapS | So there's never been thought given to just clearing them out in batches or as an asynchronous background process? | 19:14 |
| morgan | We can fix the "load events" query to ignore exipred | 19:14 |
| morgan | That would be easy | 19:14 |
| *** jsavak has quit IRC | 19:15 | |
| *** jsavak has joined #openstack-keystone | 19:15 | |
| dolphm | morgan: how often are they reloaded from DB? i assume we're caching them, although i haven't seen that code | 19:15 |
| SpamapS | ignoring expired would add a range filter, meaning different index usage profile | 19:15 |
| morgan | SpamapS: and i think that is a fine compromise. | 19:16 |
| morgan | dolphm: we sortof cache them | 19:16 |
| morgan | But it would be easy to curate in memory. | 19:16 |
| *** stevemar_ has joined #openstack-keystone | 19:16 | |
| *** ChanServ sets mode: +o stevemar_ | 19:16 | |
| SpamapS | It's kind of a medium priority btw. The reality is that token invalidation should not be super common in a cloud that isn't just being tested for keystone functionality. ;) | 19:17 |
| morgan | SpamapS: it is possible to add a flush mechanism. | 19:17 |
| dolphm | SpamapS: most of the bugs we've seen with fernet are a result of aggressive testing, not real world issues | 19:17 |
| SpamapS | dolphm: right, thats what I see here too. | 19:17 |
| SpamapS | Rally sets up 100 users and then deletes them all. | 19:18 |
| SpamapS | And goes "HEY THAT TOOK A LONG TIME" | 19:18 |
| dolphm | :) | 19:18 |
| SpamapS | The other bit that our testers had was that token validation was _SUPER_ CPU hungry | 19:19 |
| SpamapS | on account of having to rebuild the catalog over and over and over | 19:19 |
| SpamapS | They've set that as medium as well, since they can just throw cores at that problem. | 19:20 |
| morgan | SpamapS: i've always seen rally scenarios for keystone to be very non-representative of real world uses. Highly contrived and not super useful unless you look at the avg over time responses | 19:20 |
| morgan | SpamapS: i think we have caching for the catalog now which helps | 19:20 |
| SpamapS | yeah, one problem is these testers are pointed at Kilo. | 19:20 |
| *** geoffarn_ has joined #openstack-keystone | 19:21 | |
| *** geoffarnold has quit IRC | 19:22 | |
| boris-42 | SpamapS: you can use exisitng users | 19:23 |
| boris-42 | morgan: so very disagree on this | 19:23 |
| morgan | boris-42: rally scenarios are absolutely not real work representative for keystone. Never have been. The data is not very useful unless you are comparing it across runs. | 19:24 |
| boris-42 | morgan: for example authentication one is very representative | 19:24 |
| morgan | boris-42: only sortof. It is so highly contrived in setup i still disagree | 19:25 |
| dolphm | lbragstad: where's your catalog caching patch? ^ | 19:25 |
| morgan | boris-42: but then again I have (as you know) not been a huge fan of rally. So take my view with a grain of salt | 19:25 |
| SpamapS | boris-42: I may recommend that to my testers. Right now we're just filtering the user delete as low priority. | 19:26 |
| SpamapS | morgan: until I see an alternative that does what it does, I'm a fan of Rally. Contrived performance tests trump no performance tests. | 19:26 |
| dolphm | SpamapS: what does it do that you don't get from other performance testing tools? | 19:27 |
| SpamapS | I'd rather look at a bad result and go "yeah, that test needs work" than try to grok what will happen by reading code and docs. ;) | 19:27 |
| morgan | SpamapS: and i dont disagree with value. I disagree with using it in isolation of subsequent tests. Compare runs of rally avgs. Dont use it once and use that data | 19:27 |
| SpamapS | dolphm: I haven't seen another comprehensive openstack performance testing tool? | 19:27 |
| dolphm | SpamapS: well that's not a complement of the tool itself, but rather of the established test suite | 19:28 |
| morgan | SpamapS: it shows value as a run over run avg/progression. It is close to useless as a one-off test | 19:28 |
| SpamapS | dolphm: +1 to that. :) The tool does have useful outputs as well. | 19:28 |
| SpamapS | morgan: I'd agree with that assessment. :) | 19:28 |
| lbragstad | dolphm: I have it marked as wip somewhere | 19:29 |
| morgan | SpamapS: and as better scenarios are written my view might change. | 19:29 |
| SpamapS | I'd also judge most performance testing tools I"ve used as such. :) | 19:29 |
| lbragstad | dolphm: https://review.openstack.org/#/c/215212/ | 19:29 |
| dolphm | SpamapS: i'd be curious to hear your results after adding that to your performance tests ^ if the current patchset does not break your test suite outright | 19:29 |
| *** itlinux has quit IRC | 19:30 | |
| dolphm | SpamapS: (it doesn't do cache invalidation properly yet) | 19:30 |
| *** sdake has joined #openstack-keystone | 19:30 | |
| SpamapS | dolphm: oh lovely, I was going to have to write that if it didn't already exist. :) | 19:30 |
| morgan | That patch is a recipe for disaster since invalidations cant occur with it eaisly | 19:31 |
| *** mylu has quit IRC | 19:31 | |
| morgan | But it should show the benefit of caching | 19:31 |
| *** mylu has joined #openstack-keystone | 19:32 | |
| dolphm | aside: what the hell does CatalogDriverV8 mean? | 19:32 |
| *** mylu has quit IRC | 19:32 | |
| morgan | dolphm: its to show compatibility with the different driver interfaces | 19:32 |
| *** mylu has joined #openstack-keystone | 19:32 | |
| morgan | So if we add a method / remove / change - it would be v9 next | 19:32 |
| dolphm | oooh, *that* change landed | 19:33 |
| morgan | It is the start of the stable driver interface work | 19:33 |
| morgan | Yeah | 19:33 |
| dolphm | i must have never noticed | 19:33 |
| morgan | Then it landed smoothly ;) | 19:33 |
| morgan | The versions all just started at 8 because this was keystone v8 in liberty | 19:34 |
| dstanek | ... and under the radar | 19:34 |
| morgan | dolphm: not sure how to invalidate all the caches with user_id etc in there :( | 19:35 |
| morgan | Unless... We use some other value as a seed for the cache key in the generator | 19:35 |
| morgan | When you change the catalog the seed changes? | 19:36 |
| morgan | I probably could brew something up to handle it. | 19:36 |
| dolphm | morgan: does dogpile have an invalidate_all() or something? | 19:36 |
| morgan | Yes for a whole region | 19:36 |
| morgan | But we share a region across all caches atm | 19:36 |
| *** marzif has quit IRC | 19:37 | |
| morgan | We could spin up a new region or find a way to wedge a "seed" value into the args. Both are reasonably complex efforts with how caching is built in keystone | 19:38 |
| dolphm | morgan: hmm | 19:39 |
| dolphm | morgan: the challenge with lance's patch is that certain operations will require invalidating all cached catalogs, so you may as well have a discrete cache region and invalidate the whole thing? | 19:40 |
| *** jsavak has quit IRC | 19:41 | |
| *** jsavak has joined #openstack-keystone | 19:42 | |
| morgan | Yes. Or a value that is used to calculate the cache keys that changes when you need to invalidate with the current (shared) region | 19:42 |
| *** geoffarnold has joined #openstack-keystone | 19:43 | |
| *** geoffarn_ has quit IRC | 19:43 | |
| stevemar_ | lbragstad: gah, your patch is failing cause of the grenade issue | 19:44 |
| *** henrynash has quit IRC | 19:44 | |
| *** itlinux has joined #openstack-keystone | 19:45 | |
| *** doug-fis_ is now known as doug-fish | 19:50 | |
| lbragstad | stevemar_: grenade issue? | 19:51 |
| stevemar_ | lbragstad: yes, https://bugs.launchpad.net/oslo-incubator/+bug/1446583 | 19:51 |
| openstack | Launchpad bug 1446583 in oslo.service "services no longer reliably stop in stable/liberty / master" [Critical,New] | 19:52 |
| stevemar_ | lbragstad: we might have to cut rc2 without your fix, and cut rc3 when it's more stable | 19:52 |
| *** mylu has quit IRC | 19:52 | |
| lbragstad | stevemar_: ok | 19:52 |
| *** dims_ has joined #openstack-keystone | 19:53 | |
| lbragstad | stevemar_: i don't think it's even entered check yet? | 19:54 |
| stevemar_ | lbragstad: right, its an intermittent failure | 19:54 |
| stevemar_ | so you might get hit by it, you might not | 19:55 |
| * lbragstad is feeling lucky | 19:55 | |
| dolphm | lbragstad: which fix is that? | 19:57 |
| dolphm | stevemar_: ^ | 19:57 |
| lhcheng | morgan: sorry, my question is not that clear. let me step back a bit. | 19:57 |
| lhcheng | morgan: so when KSM needs to validate user token, if looks it up in the cache, if not found it would connect to keystone to validate the token, it will authenticate using the credentials (service user) provided in [keystone_authtoken] to be able to make the validate token call. | 19:57 |
| *** dims_ has quit IRC | 19:57 | |
| lbragstad | https://review.openstack.org/#/c/221786/ dolphm | 19:57 |
| dolphm | ah okay | 19:58 |
| lhcheng | morgan: the service token used to make the validate token call, is that also place in memcache ? | 19:58 |
| *** mylu has joined #openstack-keystone | 19:59 | |
| dolphm | lhcheng: can you clarify, is what about the token placed in which memcache instance? | 19:59 |
| *** sdake has quit IRC | 19:59 | |
| stevemar_ | dolphm: https://review.openstack.org/#/c/208064/ | 19:59 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add test case passing is_domain flag as False https://review.openstack.org/229549 | 20:00 |
| *** jsavak has quit IRC | 20:00 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Filters is_domain=True in v2 get_project_by_name https://review.openstack.org/224842 | 20:00 |
| *** jsavak has joined #openstack-keystone | 20:01 | |
| bknudson | lhcheng: auth_token uses a regular keystoneclient session which doesn't support caching the token in memcache as far as I know. | 20:01 |
| lhcheng | dolphm: I understand KSM place the hashed token as key in the cache for all the user token that has been recently validated. | 20:01 |
| lhcheng | dolphm: I am just curious if we do any caching of the service token (credentials used for making validation token call) | 20:02 |
| alextricity | marekd: stevemar_: RE: oidc keystone federation. Turns out I forgot to include the protocol in the redirect URI | 20:02 |
| lhcheng | bknudson: ah | 20:02 |
| alextricity | marekd: stevemar_ Now i'm working thorugh Unauthorized issues after I log into goole | 20:03 |
| *** itlinux has quit IRC | 20:03 | |
| alextricity | google* | 20:03 |
| lhcheng | bknudson: so if I have 20 user requests on nova (with different tokens), KSM will do 20 get token call for the service user? | 20:03 |
| bknudson | lhcheng: the session can work however it wants to, but it typically will reuse its token until shortly before it expires. | 20:04 |
| *** geoffarnold has quit IRC | 20:04 | |
| *** geoffarnold has joined #openstack-keystone | 20:04 | |
| bknudson | or maybe it just waits for an unauthorized response from the server before it gets a new token | 20:04 |
| bknudson | there was a bug recently fixed where auth_token would get multiple tokens because multiple threads try to auth at the same time | 20:05 |
| *** atiwari has joined #openstack-keystone | 20:06 | |
| lhcheng | bknudson: excellent, that's what we hit! | 20:08 |
| lhcheng | bknudson: we're doing some perf testing, running 200 user requests in parallel. | 20:08 |
| *** jasonsb has joined #openstack-keystone | 20:09 | |
| bknudson | lhcheng: https://review.openstack.org/#/q/Ib6487de7de638abc69660c851bd048a8ec177109,n,z | 20:09 |
| lhcheng | bknudson: and we noticed, that our internal authentication system has been hammered more than what we expected | 20:09 |
| *** henrynash has joined #openstack-keystone | 20:09 | |
| *** ChanServ sets mode: +v henrynash | 20:09 | |
| bknudson | lhcheng: looks like the fix for that one hasn't been released. | 20:09 |
| morgan | lhcheng: no service tokens are not in memcache afaik, they are in process memory | 20:10 |
| *** su_zhang_ has joined #openstack-keystone | 20:10 | |
| *** maxabidi has joined #openstack-keystone | 20:11 | |
| *** markvoelker has joined #openstack-keystone | 20:12 | |
| *** roxanagh_ has quit IRC | 20:13 | |
| *** mylu has quit IRC | 20:13 | |
| *** raildo is now known as raildo-afk | 20:13 | |
| lhcheng | morgan: okay.. so in our rally performance tests, I noticed that rally re-uses the same token for the 200 concurrent requests, and we wondered why using the same user token would be triggering 200 calls to our internal authentication system. | 20:14 |
| *** jasonsb has quit IRC | 20:14 | |
| morgan | lhcheng: maybe jamie fixed the caching thing? I honestly don't remember if we got that fix landed | 20:14 |
| *** e0ne has joined #openstack-keystone | 20:15 | |
| lhcheng | morgan: having the service token not cached at least explains the mystery why so many user/password check happening :) | 20:15 |
| morgan | lhcheng: no it doesn't really | 20:15 |
| boris-42 | lhcheng: rally doesn't reuse token | 20:16 |
| *** dims_ has joined #openstack-keystone | 20:16 | |
| *** dims_ has quit IRC | 20:16 | |
| morgan | if rally is not reusing tokens (^^) then yes 200 requests makes sense | 20:16 |
| *** dims_ has joined #openstack-keystone | 20:16 | |
| *** csoukup has quit IRC | 20:17 | |
| lhcheng | boris-42: I thought it is caching the tokens here: https://github.com/openstack/rally/blob/master/rally/osclients.py#L295 | 20:18 |
| *** raildo-afk is now known as raildo | 20:18 | |
| *** henrynash has quit IRC | 20:19 | |
| lhcheng | boris-42: for concurrent tests, it doesn't re-use the token? think we set the configure in here: https://github.com/openstack/rally/blob/master/rally-jobs/rally-ironic.yaml | 20:21 |
| *** tqtran_ has joined #openstack-keystone | 20:21 | |
| lhcheng | morgan: cool, I'll ping jamie later in the day to check the current state. | 20:22 |
| *** raildo is now known as raildo-afk | 20:23 | |
| *** geoffarnold has quit IRC | 20:25 | |
| *** geoffarnold has joined #openstack-keystone | 20:25 | |
| *** jbell8 has joined #openstack-keystone | 20:28 | |
| lhcheng | bknudson: thanks for the link! this will be handy | 20:29 |
| *** roxanagh_ has joined #openstack-keystone | 20:29 | |
| lhcheng | dims_: hello, curious why you abandoned this patch: https://review.openstack.org/#/c/229361/ ? | 20:29 |
| *** agireud has joined #openstack-keystone | 20:31 | |
| dims_ | lhcheng: do you feel it's useful? restored | 20:31 |
| *** john5223 is now known as zz_john5223 | 20:32 | |
| *** jsavak has quit IRC | 20:32 | |
| *** jsavak has joined #openstack-keystone | 20:33 | |
| *** diegows has quit IRC | 20:35 | |
| lhcheng | dims_: thanks! yeah, seems useful. will ask jamie later for more info, if he thinks backport worthy. | 20:36 |
| *** erhudy has quit IRC | 20:39 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Handle 16-char non-uuid user IDs in payload https://review.openstack.org/226121 | 20:45 |
| opilotte | i'm having a problem with tox: DistributionNotFound: No distributions at all found for .[ldap,memcache,mongodb] | 20:48 |
| opilotte | anyone ran into this problem? | 20:48 |
| *** aix has joined #openstack-keystone | 20:49 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Handle 16-char non-uuid user IDs in payload https://review.openstack.org/226121 | 20:53 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add caching to get_catalog https://review.openstack.org/215212 | 21:01 |
| dolphm | SpamapS: mfisch: morgan: lbragstad: dstanek: ^ got this patch passing but had to introduce a second cache region due to the unique requirement for cache invalidation behavior. fixtures and things were affected, but hopefully it's sufficiently clean. it should certainly be worth performance testing as-is. | 21:03 |
| lbragstad | dolphm: awesome, thanks for picking that up | 21:04 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add caching to get_catalog https://review.openstack.org/215212 | 21:05 |
| dolphm | lbragstad: i've been meaning to for awhile :-/ | 21:05 |
| *** tonytan4ever has quit IRC | 21:06 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add caching to get_catalog https://review.openstack.org/215212 | 21:08 |
| *** geoffarn_ has joined #openstack-keystone | 21:08 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 21:08 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Trivial fix of some typos found https://review.openstack.org/231189 | 21:08 |
| *** zigo has quit IRC | 21:09 | |
| *** maxabidi has quit IRC | 21:09 | |
| slberger | Are revocation events stored in memcache when enabled for resources? | 21:09 |
| *** zigo has joined #openstack-keystone | 21:10 | |
| *** geoffarnold has quit IRC | 21:12 | |
| *** zz_john5223 is now known as john5223 | 21:12 | |
| mfisch | dolphm: nice! | 21:13 |
| mfisch | dolphm: whats the speedup? | 21:13 |
| openstackgerrit | Brant Knudson proposed openstack/keystoneauth: auto-generate release history https://review.openstack.org/227657 | 21:16 |
| dolphm | mfisch: have not performance tested myself -- just got the thing passing unit tests :) | 21:17 |
| dolphm | mfisch: there's another patch after it that should have a similar benefit, but it also needs similar work IIRC. haven't looked at it recently | 21:17 |
| mfisch | dolphm: I'm still working on getting our K upgraded to L-ish, but that wont be until after Tokyo at this point | 21:18 |
| mfisch | I'm happy to help test tho | 21:18 |
| *** geoffarn_ is now known as geoffarnold | 21:24 | |
| lbragstad | dolphm: regarding https://review.openstack.org/#/c/231191/2 i don't think we have a doc patch | 21:24 |
| *** phalmos has quit IRC | 21:24 | |
| lbragstad | dolphm: mfisch https://review.openstack.org/#/c/215715/ should have a similar performance benefit to the first caching patch | 21:25 |
| lbragstad | but, it needs some work | 21:25 |
| *** marzif has joined #openstack-keystone | 21:26 | |
| mfisch | dolphm: the catalog one will only help getting tokens not validating right? | 21:27 |
| lhcheng | keystone history question, did we re-use token for the GET token call before? | 21:28 |
| lhcheng | Right now, every time I make a call GET token, it always return a new token. | 21:28 |
| *** marzif has quit IRC | 21:29 | |
| morgan | lhcheng: huh? | 21:29 |
| *** geoffarnold has quit IRC | 21:29 | |
| mfisch | lhcheng: that was HP special sauce | 21:29 |
| morgan | lhcheng: there was an edge case at one point where a PKI token could be re-issued identically | 21:29 |
| *** marzif has joined #openstack-keystone | 21:29 | |
| bknudson | I hope GET of a token doesn't return a new token. | 21:29 |
| morgan | and HP did magic awful re-issue logic | 21:29 |
| lhcheng | morgan: when I make a call to "keystone token-get " I always get a new token. | 21:29 |
| morgan | that re-authenticates | 21:29 |
| morgan | so eys | 21:29 |
| lhcheng | mfisch: yeah, that could be the HP special sauce :P | 21:30 |
| morgan | yes* | 21:30 |
| mfisch | yes absolutely | 21:30 |
| mfisch | Jason has been bugging me to add it here | 21:30 |
| morgan | mfisch: don't do it | 21:30 |
| morgan | mfisch: it is a trap | 21:30 |
| *** geoffarnold has joined #openstack-keystone | 21:30 | |
| mfisch | working for HP you mean? | 21:31 |
| mfisch | "i'll be here all week thanks you've been a great audience" | 21:32 |
| * lhcheng understands how mfisch feels when Jason asks for features :P | 21:32 | |
| lbragstad | lhcheng: token-get is a POST | 21:33 |
| lbragstad | to /auth/tokens/ | 21:33 |
| lbragstad | right/ | 21:33 |
| lbragstad | ? | 21:33 |
| lbragstad | so you *should* be getting a new token | 21:33 |
| mfisch | DEBUG:requests.packages.urllib3.connectionpool:"POST /v2.0/tokens HTTP/1.1" 200 6417 | 21:33 |
| lhcheng | lbragstad: yeah, KSC is still doing a POST to /v2.0/tokens | 21:33 |
| mfisch | I interpreted the question as "did keystone ever support token re-issue in the tree" | 21:34 |
| morgan | mfisch: PKI tokens could be identically re-issued within a 1 second window | 21:34 |
| lhcheng | mfisch: your interpretation is right.. I was wondering if keystone ever supported that. | 21:35 |
| morgan | for a given user/scope combination | 21:35 |
| morgan | this was pre-... Havana? | 21:35 |
| *** jsavak has quit IRC | 21:35 | |
| mfisch | lhcheng is having an HP flashback I believe | 21:35 |
| morgan | lhcheng: token-get is a "get me a new token" call from the CLI | 21:35 |
| morgan | lhcheng: also, don't use the keystone cli | 21:35 |
| lhcheng | mfisch: this is bad, I think I am getting sick.. | 21:36 |
| mfisch | lol | 21:36 |
| *** thiagop has quit IRC | 21:36 | |
| morgan | the reason for the re-issue was because pki token data didn't have any unique values - until subsecond precision was added | 21:36 |
| morgan | today audit-ids solve the same issue (and better) | 21:36 |
| lhcheng | morgan: yeah, just used something quick to test. do we have the versionless auth in L (/auth/tokens) ? | 21:37 |
| morgan | uh | 21:37 |
| morgan | versionless auth? | 21:37 |
| morgan | no. | 21:38 |
| morgan | that is on the backlog | 21:38 |
| morgan | "good idea but someone has to engineer it" | 21:38 |
| lhcheng | using /auth/tokens instead of /v2.0/tokens | 21:38 |
| lhcheng | okay.. | 21:38 |
| *** topol has quit IRC | 21:40 | |
| lhcheng | morgan: good to know for the PKI token re-issue bug | 21:42 |
| morgan | lhcheng: but any modern/supported vintage of keystone will not reissue the same token twice | 21:42 |
| morgan | i think we fixed that issue in icehouse | 21:43 |
| lbragstad | for UUID tokens, right? | 21:43 |
| *** edmondsw has quit IRC | 21:44 | |
| *** jbell8 has quit IRC | 21:47 | |
| *** jbell8 has joined #openstack-keystone | 21:48 | |
| *** jbell8 has quit IRC | 21:49 | |
| bknudson | so even PKI tokens can be switched to use seconds for timestamps. | 21:51 |
| *** e0ne has quit IRC | 21:51 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 21:51 |
| *** e0ne has joined #openstack-keystone | 21:54 | |
| *** jasonsb has joined #openstack-keystone | 21:57 | |
| *** harlowja has quit IRC | 21:59 | |
| *** e0ne has quit IRC | 22:01 | |
| *** jasonsb has quit IRC | 22:01 | |
| *** stevemar_ has quit IRC | 22:02 | |
| *** stevemar_ has joined #openstack-keystone | 22:02 | |
| *** ChanServ sets mode: +o stevemar_ | 22:02 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Reclassify get_project_by_name() controller method https://review.openstack.org/231207 | 22:04 |
| morgan | bknudson: yes | 22:04 |
| *** marzif has quit IRC | 22:04 | |
| *** stevemar_ has quit IRC | 22:05 | |
| *** stevemar_ has joined #openstack-keystone | 22:05 | |
| *** ChanServ sets mode: +o stevemar_ | 22:05 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:06 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/230578 | 22:08 |
| *** chlong has joined #openstack-keystone | 22:10 | |
| *** hrou has quit IRC | 22:11 | |
| *** ngupta has quit IRC | 22:12 | |
| *** geoffarnold has quit IRC | 22:12 | |
| *** geoffarn_ has joined #openstack-keystone | 22:12 | |
| *** openstackgerrit has quit IRC | 22:16 | |
| *** openstackgerrit has joined #openstack-keystone | 22:17 | |
| john5223 | which part of keystone handles the "methods" when you hit the keystone endpoint? i know it calls into auth/plugins/password.py but who actually calls that based on method=["password"]? | 22:18 |
| john5223 | nvm, i think i found it. def load_auth_method | 22:20 |
| john5223 | trying to implement something like this: https://ask.openstack.org/en/question/53047/how-to-implement-2-factor-authentication-in-horizon/ | 22:21 |
| john5223 | has anyone done that before? | 22:21 |
| john5223 | and would i just drop my OTP method inside keystone/auth/plugins then modify keystone.conf to have methods = external,password,token,OTP ? | 22:24 |
| john5223 | trying to do it from outside keystone codebase like you can with the external auth plugin architecture but looks like i gotta drop it directly into the keystone project | 22:24 |
| john5223 | oh wait: password = keystone.auth.plugins.password.Password .. nvm looks like i can have it outside | 22:25 |
| *** tonytan4ever has joined #openstack-keystone | 22:31 | |
| *** jamielennox|away is now known as jamielennox | 22:31 | |
| dstanek | john5223: you can definitely have your plugin outside of Keysotne | 22:33 |
| *** geoffarnold has joined #openstack-keystone | 22:33 | |
| john5223 | awesome. im going to start with that and then maybe contribute back into keystone when i have it all working | 22:33 |
| *** geoffarn_ has quit IRC | 22:34 | |
| *** jbell8 has joined #openstack-keystone | 22:36 | |
| morgan | john5223: remember that the methods configured in keystone.conf are a logical or (you may use any one of them, or any combination of them), you may need to create a replacement password method that has a hard OTP requirement | 22:36 |
| *** jbell8 has quit IRC | 22:38 | |
| dstanek | morgan: when you say replacement do you mean a new entrypoint like ot-password? | 22:40 |
| *** jbell8 has joined #openstack-keystone | 22:40 | |
| morgan | dstanek: yes. and then in keystone.conf set method password=<new entrypoint> | 22:40 |
| dstanek | morgan: gotcha, i thought you were saying to register with the same name and tbh i don't what what setuptools does | 22:41 |
| john5223 | gotcha. its going to be a little complicated b/c i only have some clients that use otp, some dont so i'll have to dynamically be able to tell.... and then relay that to horizon so i can show the extra OTP form value to fill in | 22:41 |
| john5223 | so this will be fun | 22:41 |
| SpamapS | dolphm: hm, the thundering herd would be strong with that cache invalidation. | 22:41 |
| morgan | SpamapS: catalog cache invalidation should be infrequent | 22:42 |
| dstanek | SpamapS: for the catalog patch? | 22:42 |
| *** gordc has quit IRC | 22:42 | |
| SpamapS | morgan: Agree! | 22:42 |
| SpamapS | so I suggest just set a TTL and let it do its work. | 22:42 |
| dstanek | it would be no different than status quo | 22:42 |
| SpamapS | "Endpoint changes will take up to 5 minutes" | 22:42 |
| morgan | SpamapS: except we have some enforcement that is dependent on these catalog bits. | 22:42 |
| SpamapS | morgan: same answer. :) | 22:42 |
| morgan | SpamapS: the per-user-per-tenant catalogs are not highly cachable | 22:43 |
| morgan | the global catalog is much more cachable | 22:43 |
| morgan | if we cached the global catalog and made the filter eficient | 22:43 |
| SpamapS | morgan: the patch I'm looking at caches get_catalog | 22:43 |
| morgan | it would mean a single hit / invalidate | 22:43 |
| SpamapS | so, per user per project | 22:43 |
| morgan | yes. which can be adjusted | 22:43 |
| morgan | if the results from the DB are cached, and the filtering etc is cleaned up | 22:44 |
| morgan | rather than trying to cache every permutation of user/catalog/scope | 22:44 |
| morgan | we cache the raw results and filter | 22:44 |
| SpamapS | morgan: the problem right now is the CPU pain of producing the catalog, not so much the DB | 22:44 |
| morgan | single cache point, single invalidation, minimal thundering herd | 22:44 |
| morgan | SpamapS: construct the catalog completely, cache the filter params. | 22:44 |
| morgan | e.g. "these endpoints for X user/project" where applicable | 22:45 |
| morgan | (that is easy to invalidate due to the way endpoint filtering works) | 22:45 |
| morgan | and do a fast(er) filtering than load, load, compare, build | 22:45 |
| SpamapS | so have a cache key with endpoint in it somehow? | 22:45 |
| *** raildo-afk is now known as raildo | 22:45 | |
| morgan | the two caches are: complete service catalog | 22:46 |
| morgan | and "endpoint filter" | 22:46 |
| morgan | so you can do a quick apply of the endpoint filter to the complete catalog | 22:46 |
| morgan | dict.copy() is less punative than <create catalog> | 22:46 |
| morgan | (worst cast) | 22:46 |
| morgan | so worst case scenario: dict.copy().apply_filter | 22:46 |
| SpamapS | so, when I add an endpoint | 22:47 |
| morgan | which just pops off / dels some keys | 22:47 |
| SpamapS | I have to create a new catalog | 22:47 |
| SpamapS | and then the filtered ones | 22:47 |
| morgan | you'd invalidate the global catalog, next request would be slower but it would cache for everything | 22:47 |
| morgan | the filters are a list of endpoint ids for a project | 22:47 |
| SpamapS | so to make that not thundering-herd, I need a coalesce mechanism | 22:47 |
| morgan | if the scope is <project> you apply the filter | 22:47 |
| SpamapS | the next request would be the next 100 requests | 22:47 |
| morgan | if you change the endpoint filter you only invalidate the filter | 22:47 |
| *** roxanagh_ has quit IRC | 22:48 | |
| *** harlowja has joined #openstack-keystone | 22:48 | |
| morgan | if you change the global catalog you only invalidate the global catalog | 22:48 |
| SpamapS | unless we use something like gearman and coalesce around a single cache worker | 22:48 |
| morgan | dogpile already does this if you don't use in-memory | 22:48 |
| morgan | via a lock in (memcache, or redis) | 22:48 |
| SpamapS | yes, so when I invalidate the global catalog, until it becomes valid again, every worker kicks off the "Make me a new global catalog" | 22:48 |
| morgan | you can even fire off an async runner | 22:48 |
| SpamapS | what? | 22:48 |
| morgan | dogpile has an async runner concept | 22:49 |
| SpamapS | wat! | 22:49 |
| * SpamapS reads | 22:49 | |
| morgan | where one worker does a refresh and all others would just use the old value | 22:49 |
| morgan | until the refresh occurs | 22:49 |
| SpamapS | that's handy | 22:49 |
| morgan | keystone is not well setup for it, but it could be implemented | 22:49 |
| SpamapS | assuming you don't rely on actual memcached TTL's ;) | 22:49 |
| morgan | you do, but you have a fudge window in there | 22:49 |
| *** dims__ has joined #openstack-keystone | 22:49 | |
| *** hrou has joined #openstack-keystone | 22:49 | |
| *** dims__ has quit IRC | 22:49 | |
| *** geoffarnold has quit IRC | 22:50 | |
| morgan | bascially if there is X time left on the cache, refresh it | 22:50 |
| morgan | but if no one comes in within the <X window, it falls out of memcache and is refreshed on demand | 22:50 |
| *** geoffarnold has joined #openstack-keystone | 22:50 | |
| SpamapS | Yeah, in past-life-memcache-expert role we just took the developer supplied TTL and doubled it to give to memcache, and then stored a json blob with the real TTL, and when that expired, we pushed a new one into the cache with the old value and now+5min as the ttl, and then only one thread would end up doing the cache refresh | 22:51 |
| morgan | dogpile stores a dogpile TTL which can be < backend TTL | 22:51 |
| SpamapS | which works great as long as memcached never runs out of space | 22:51 |
| morgan | by default they are the same though | 22:51 |
| SpamapS | yeah sounds like dogpile has this technique, which is great | 22:51 |
| morgan | the record really is {<dogpile TTL>, <serialized data>} | 22:51 |
| SpamapS | it just falls apart spectacularly when memcached gets full. | 22:51 |
| morgan | which isn't *really* dogpile's fault | 22:52 |
| SpamapS | since memcached starts deleting whatever it damn well wants to | 22:52 |
| morgan | and also dogpile does a decent job of just refreshing as needed if the data isn't there | 22:52 |
| SpamapS | well gearman coalescing is a fantastically simple way to prevent the herd | 22:52 |
| SpamapS | morgan: but if the data isn't there, dogpile has no old value to give out | 22:52 |
| morgan | dogpile has most of the same constructs, but the backend is the limiting factor | 22:53 |
| SpamapS | morgan: so you have to devise a way to synchronise all of the missers | 22:53 |
| morgan | because we do block waiting for data to be returned | 22:53 |
| *** dims_ has quit IRC | 22:53 | |
| SpamapS | it's a worst case scenarios | 22:53 |
| SpamapS | and the gearman answer is not exactly "simple" :) | 22:53 |
| morgan | ok got disconnected | 22:54 |
| morgan | missed the last 2-3 things tyou typed | 22:54 |
| morgan | so dogpile does a simple "lock the record" on the backend, all gets will block on the lock (keystone does blocking calls, vs. asyncio) | 22:54 |
| morgan | so a "refresh" really is atomic. | 22:54 |
| morgan | unless you use the async runner concept | 22:54 |
| morgan | provided the backend is shared [vs. say per-process in-memory] | 22:55 |
| *** geoffarnold has quit IRC | 22:55 | |
| *** zzzeek has quit IRC | 22:55 | |
| *** geoffarnold has joined #openstack-keystone | 22:55 | |
| SpamapS | morgan: the lock is using memcache CAS+poll? | 22:56 |
| morgan | SpamapS: no not that clever | 22:56 |
| morgan | SpamapS: memcache add (fails if the record already exists) | 22:56 |
| morgan | and poll | 22:56 |
| *** tonytan4ever has quit IRC | 22:57 | |
| raildo | morgan, what is the best way to do a keystone v3 API call in other service? like nova or cinder... | 22:57 |
| morgan | to create the lock. | 22:57 |
| morgan | CAS isn't implemented everywhere the same way so... | 22:57 |
| morgan | it had to be worked around | 22:57 |
| SpamapS | morgan: ugh | 22:58 |
| morgan | raildo: with keystoneclient? | 22:58 |
| morgan | raildo: (the library) | 22:58 |
| morgan | unless it's just auth, then it's keystoneauth | 22:58 |
| *** flwang has quit IRC | 22:58 | |
| SpamapS | morgan: this is the second thing that would benefit from having long running not-HTTP-serving keystone workers. | 22:59 |
| raildo | morgan, but I have to create a keystoneclient instance with the user credentials or as the service? | 22:59 |
| *** roxanagh_ has joined #openstack-keystone | 22:59 | |
| morgan | SpamapS: sortof | 22:59 |
| SpamapS | morgan: the other being record cleanup | 22:59 |
| morgan | SpamapS: I would say not really. | 22:59 |
| morgan | SpamapS: the token/whatever cleanup sure | 23:00 |
| morgan | SpamapS: a keystone-manage cron > long running worker process. | 23:00 |
| SpamapS | morgan: I'm thinking more of a trickling deleter than a batch deleter | 23:01 |
| morgan | SpamapS: I'd still make it part of keystone-manage | 23:01 |
| *** slberger has left #openstack-keystone | 23:01 | |
| morgan | but eh | 23:02 |
| SpamapS | morgan: Well I already did that for TripleO .. ;) | 23:02 |
| morgan | I think there are other problems before we get to trickling deletes | 23:02 |
| SpamapS | morgan: and it worked spectacularly for token deleting, but now we don't have to do that anymore.. ;) | 23:02 |
| morgan | that can be addressed in keystone code | 23:02 |
| morgan | managing more processes for keystone is already ugly | 23:02 |
| morgan | i'd rather (personally) see a batch-delete and optimizations to ignore expired records | 23:03 |
| SpamapS | morgan: but this dogpile thing is.. well I'm worried it will fall over at higher scale when we start having thousands of api threads polling memcached. | 23:03 |
| morgan | SpamapS: we already know it does fall over in memcache with eventlet | 23:04 |
| morgan | in fact, python-memcache will fallover via keystonemiddleware | 23:04 |
| SpamapS | thats not a thread. ;) | 23:04 |
| *** david-ly_ has joined #openstack-keystone | 23:04 | |
| morgan | in *Ever* service | 23:04 |
| morgan | it's worst than a thread | 23:04 |
| *** david-lyle has quit IRC | 23:04 | |
| morgan | eventlet highlights the thread.local issue(s) | 23:04 |
| SpamapS | So, ignore the threading model. You have _all of the concurrency of an entire openstack region_ that will want to refresh this catalog when it is invalidated. | 23:05 |
| morgan | memcache is a poor choice in really distributed models anyway | 23:05 |
| morgan | because lack of replication / scaling up | 23:05 |
| morgan | you basically have a big fat single point of failure | 23:06 |
| SpamapS | err | 23:06 |
| SpamapS | if you use it that way yeah | 23:06 |
| morgan | and the bucketing is *really* badly implemeted in python | 23:06 |
| morgan | or not depending on the library used | 23:06 |
| morgan | or not implemented that is | 23:06 |
| SpamapS | We're not able to use libmemcached right? | 23:07 |
| morgan | in dogpile you can | 23:07 |
| morgan | i think? | 23:07 |
| morgan | no it's pylibmc? | 23:07 |
| morgan | there are three implemented versions in python that dogpile supports | 23:07 |
| morgan | and two of them have severe limitations | 23:07 |
| morgan | python-memcache is a trainwreck. | 23:07 |
| SpamapS | we can't use it for the same reason we can't use libmysqlclient effectively. | 23:08 |
| morgan | and it's pure python | 23:08 |
| *** raildo is now known as raildo-afk | 23:08 | |
| morgan | pylibmc i think is mostly usable | 23:08 |
| SpamapS | I guess keystone doesn't have that problem anymore? | 23:08 |
| SpamapS | since it's happily sitting under apache? | 23:08 |
| morgan | and bmemcached has a narrow usecase | 23:08 |
| morgan | even with uwsgi or gunicorn | 23:08 |
| morgan | the issue goes away | 23:08 |
| SpamapS | right | 23:09 |
| morgan | eventlet was the real issue there afaict | 23:09 |
| SpamapS | the binary protocol isn't really a corner case. | 23:09 |
| morgan | the python implementation is rarely used | 23:10 |
| morgan | because of the limitations of the library | 23:10 |
| SpamapS | but it looks like the SASL part of python-binary-memcached is the thing people like. | 23:10 |
| morgan | yep | 23:10 |
| morgan | pretty much the only reason that lib is used | 23:10 |
| morgan | pylibmc i think is the best of the native dogpile ones but we couldn't use it in general until... Mitaka | 23:10 |
| morgan | and until we rip eventlet out of devstack/keystone we still can't rely on it | 23:10 |
| morgan | for the same reasons as libmysqlclient | 23:11 |
| morgan | anyway. | 23:11 |
| SpamapS | looks like python-binary-memcached doesn't do any hash ringing... :( | 23:11 |
| SpamapS | or hashing at all actually | 23:12 |
| morgan | yep | 23:12 |
| SpamapS | it just uses them in fallback mode | 23:12 |
| morgan | most python libs don't do hash ringing | 23:12 |
| morgan | some don't even do fallback mode | 23:12 |
| SpamapS | which is o_O | 23:12 |
| morgan | agreed | 23:12 |
| *** flwang has joined #openstack-keystone | 23:12 | |
| morgan | i nearly forked a memcache lib to solve this ~8mo ago | 23:13 |
| SpamapS | well is pylibmc bad? | 23:13 |
| morgan | because this is (frankly) a tiresome limitation | 23:13 |
| morgan | pylibmc is good as far as i know | 23:13 |
| morgan | i just haven't been able to use it ;) | 23:13 |
| SpamapS | libmemcached is the defacto standard for hash ring access and binary protocol use | 23:13 |
| morgan | it is libmemcache | 23:14 |
| morgan | so | 23:14 |
| SpamapS | so the only reason to avoid it would be GIL nonsense. | 23:14 |
| SpamapS | libmemcached | 23:14 |
| SpamapS | libmemcache is ZOMG WOW RUN AWAY | 23:14 |
| morgan | typo | 23:14 |
| morgan | :P | 23:14 |
| SpamapS | ;) | 23:14 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/230564 | 23:14 |
| *** jbell8 has quit IRC | 23:16 | |
| *** geoffarn_ has joined #openstack-keystone | 23:17 | |
| *** geoffarnold has quit IRC | 23:17 | |
| *** dims_ has joined #openstack-keystone | 23:17 | |
| *** jbell8 has joined #openstack-keystone | 23:18 | |
| boris-42 | lhcheng: sorry was not here | 23:24 |
| boris-42 | lhcheng: that cache works inside single iteraition* | 23:24 |
| *** zhiyan has quit IRC | 23:24 | |
| boris-42 | lhcheng: so each scenario iteration starts from authentication | 23:25 |
| *** zhiyan has joined #openstack-keystone | 23:26 | |
| *** jbell8 has quit IRC | 23:27 | |
| lhcheng | boris-42: does setting concurrency to 20 means 20 scenario iteration (authenticate 20 times)? | 23:27 |
| *** jbell8 has joined #openstack-keystone | 23:27 | |
| boris-42 | lhcheng: so times and concurrency are independent parameters | 23:28 |
| *** akanksha_ has quit IRC | 23:28 | |
| boris-42 | lhcheng: concurrency means the amount of iterations in parallel (over the time) | 23:28 |
| boris-42 | lhcheng: like 20 means (20 iterations will work in parallel) | 23:28 |
| boris-42 | lhcheng: times means total amount of iterations | 23:29 |
| boris-42 | lhcheng: so if you specify 20 times it means that rally will start 20 scenarios and just wait until they finih | 23:29 |
| lhcheng | boris-42: so for concurrency, for each of the parallel iteration, will have their own cache? | 23:34 |
| *** geoffarn_ is now known as geoffarnoldX | 23:34 | |
| lhcheng | and each have its own keystone token. | 23:35 |
| *** geoffarnoldX has quit IRC | 23:37 | |
| *** geoffarnold has joined #openstack-keystone | 23:38 | |
| boris-42 | lhcheng: yep | 23:40 |
| boris-42 | lhcheng: but you can write scenarios that behaviours in different wy | 23:40 |
| boris-42 | lhcheng: way* | 23:40 |
| lhcheng | boris-42: okay, got it now. | 23:40 |
| lhcheng | boris-42: the way it works is just right :) | 23:41 |
| boris-42 | lhcheng: if you need any help just ping me* (you can do it as well in openstack-rally chat) | 23:41 |
| lhcheng | boris-42: thanks for the explanation | 23:41 |
| lhcheng | boris-42: will do! | 23:41 |
| *** stevemar_ has quit IRC | 23:42 | |
| *** stevemar_ has joined #openstack-keystone | 23:45 | |
| *** ChanServ sets mode: +o stevemar_ | 23:45 | |
| stevemar_ | jamielennox: poke, since you are mr. KSA https://review.openstack.org/#/c/227657/ | 23:46 |
| jamielennox | stevemar_ done | 23:47 |
| SpamapS | boris-42: just a tiny point of precision missing there. concurrency is not parallel. Parallel operations are _things moving toward the same goal_. Concurrent operations are _things happening at the same time_. | 23:47 |
| *** jbell8 has quit IRC | 23:47 | |
| stevemar_ | jamielennox: \o/ | 23:48 |
| SpamapS | morgan: hey, I just thought of something. another option for async update of the cache is to fire off a worker in the background that will pre-compute all possible catalogs. ;) | 23:48 |
| *** jbell8 has joined #openstack-keystone | 23:48 | |
| jamielennox | what's the current catalog problem? | 23:49 |
| *** dims_ has quit IRC | 23:50 | |
| stevemar_ | jamielennox: aside from the fact that no one uses it? | 23:56 |
| jamielennox | stevemar_: that makes scaling it trivial | 23:56 |
| stevemar_ | heeh | 23:56 |
| jamielennox | stevemar_, morgan: i need to look at https://review.openstack.org/225516 for stable/kilo | 23:57 |
| jamielennox | or i need someone else to look at | 23:57 |
| openstackgerrit | Merged openstack/keystoneauth: Update the project description https://review.openstack.org/230866 | 23:58 |
| openstackgerrit | Merged openstack/keystoneauth: Remove "Features" section from README https://review.openstack.org/231094 | 23:58 |
| SpamapS | dolphm: https://review.openstack.org/#/c/215212/ <-- I -1'd, because I think it can be _way_ simpler. But I may have missed something so feel free to toss me a in a trashcan if that's the case. ;) | 23:59 |
| *** geoffarn_ has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!