| *** openstackgerrit has quit IRC | 00:01 | |
| *** openstackgerrit has joined #openstack-keystone | 00:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/230464 | 00:05 |
|---|---|---|
| *** sdake_ has joined #openstack-keystone | 00:11 | |
| *** sdake has quit IRC | 00:11 | |
| *** hrou has joined #openstack-keystone | 00:12 | |
| *** phalmos has joined #openstack-keystone | 00:12 | |
| *** _hrou_ has quit IRC | 00:15 | |
| *** henrynash has quit IRC | 00:21 | |
| *** annasort has quit IRC | 00:22 | |
| *** annasort has joined #openstack-keystone | 00:22 | |
| *** freerunner has quit IRC | 00:23 | |
| *** shadower has joined #openstack-keystone | 00:23 | |
| *** aix has quit IRC | 00:23 | |
| *** d0ugal has quit IRC | 00:24 | |
| *** btully has quit IRC | 00:25 | |
| *** aix has joined #openstack-keystone | 00:28 | |
| *** freerunner has joined #openstack-keystone | 00:28 | |
| *** Kennan_Vacation has joined #openstack-keystone | 00:29 | |
| *** d0ugal has joined #openstack-keystone | 00:30 | |
| *** d0ugal is now known as Guest74554 | 00:30 | |
| *** phalmos has quit IRC | 00:31 | |
| *** jbell8 has joined #openstack-keystone | 00:32 | |
| *** _cjones_ has quit IRC | 00:33 | |
| *** stevemar_ has joined #openstack-keystone | 00:34 | |
| *** ChanServ sets mode: +o stevemar_ | 00:34 | |
| *** jbell8 has quit IRC | 00:37 | |
| *** richm has joined #openstack-keystone | 00:40 | |
| *** woodster_ has joined #openstack-keystone | 00:40 | |
| *** harlowja has quit IRC | 00:44 | |
| *** richm has quit IRC | 00:45 | |
| *** gsilvis has quit IRC | 00:56 | |
| *** gsilvis has joined #openstack-keystone | 00:56 | |
| *** harlowja has joined #openstack-keystone | 00:59 | |
| *** dims has quit IRC | 01:00 | |
| *** richm has joined #openstack-keystone | 01:01 | |
| *** su_zhang has quit IRC | 01:01 | |
| openstackgerrit | Merged openstack/keystone: Reclassify get_project_by_name() controller method https://review.openstack.org/231207 | 01:06 |
| *** gordc has joined #openstack-keystone | 01:16 | |
| *** gildub has quit IRC | 01:17 | |
| *** richm has quit IRC | 01:34 | |
| *** agireud has quit IRC | 01:38 | |
| *** btully has joined #openstack-keystone | 01:40 | |
| *** wwwjfy has quit IRC | 01:44 | |
| *** btully has quit IRC | 01:45 | |
| *** lhcheng has joined #openstack-keystone | 01:45 | |
| *** ChanServ sets mode: +v lhcheng | 01:45 | |
| *** roxanagh_ has quit IRC | 01:46 | |
| *** gildub has joined #openstack-keystone | 01:52 | |
| *** stevemar_ has quit IRC | 01:54 | |
| *** stevemar_ has joined #openstack-keystone | 01:55 | |
| *** ChanServ sets mode: +o stevemar_ | 01:55 | |
| *** agireud has joined #openstack-keystone | 01:56 | |
| *** doug-fish has joined #openstack-keystone | 02:01 | |
| *** topol has joined #openstack-keystone | 02:03 | |
| *** ChanServ sets mode: +v topol | 02:03 | |
| *** doug-fish has quit IRC | 02:06 | |
| *** topol has quit IRC | 02:07 | |
| *** Kennan_Vacation is now known as Kennan | 02:08 | |
| *** sdake_ is now known as sdake | 02:15 | |
| *** geoffarnoldX is now known as geoffarnold | 02:18 | |
| *** markvoelker has joined #openstack-keystone | 02:20 | |
| *** markvoelker_ has joined #openstack-keystone | 02:23 | |
| *** markvoelker has quit IRC | 02:25 | |
| stevemar_ | jamielennox: holy smacks, that memcache stuff is brutal | 02:25 |
| jamielennox | stevemar_: yea | 02:26 |
| jamielennox | there's not that many lines in that patch, but just figuring out where everything went took me a while to write | 02:26 |
| *** sdake has quit IRC | 02:30 | |
| *** ngupta has joined #openstack-keystone | 02:39 | |
| *** wwwjfy has joined #openstack-keystone | 02:44 | |
| *** markvoelker has joined #openstack-keystone | 02:44 | |
| *** markvoelker_ has quit IRC | 02:47 | |
| *** haneef__ has joined #openstack-keystone | 02:51 | |
| *** mylu has joined #openstack-keystone | 02:53 | |
| *** haneef_ has quit IRC | 02:53 | |
| *** gordc has quit IRC | 02:59 | |
| *** sdake has joined #openstack-keystone | 03:02 | |
| lhcheng | jamielennox: question on KSM, if the memcache_server is not configured, it will cache the validated user_token in the in-process memory right? | 03:06 |
| *** darrenc is now known as darrenc_afk | 03:08 | |
| *** tristanC has quit IRC | 03:10 | |
| *** tristanC has joined #openstack-keystone | 03:12 | |
| *** zzzeek has joined #openstack-keystone | 03:14 | |
| *** geoffarnold is now known as geoffarnoldX | 03:20 | |
| *** markvoelker has quit IRC | 03:25 | |
| *** su_zhang has joined #openstack-keystone | 03:27 | |
| morgan | jamielennox: the memcache code hurts my brain | 03:30 |
| morgan | stevemar_: i just told people to bug topol about things. | 03:32 |
| morgan | Hehehehe *snicker* | 03:32 |
| stevemar_ | morgan: uh oh | 03:33 |
| *** darrenc_afk is now known as darrenc | 03:34 | |
| *** markvoelker has joined #openstack-keystone | 03:38 | |
| *** btully has joined #openstack-keystone | 03:42 | |
| *** markvoelker has quit IRC | 03:44 | |
| *** lhcheng has quit IRC | 03:46 | |
| *** markvoelker has joined #openstack-keystone | 03:47 | |
| *** markvoelker_ has joined #openstack-keystone | 03:49 | |
| *** markvoelker_ has quit IRC | 03:52 | |
| *** markvoelker has quit IRC | 03:52 | |
| *** roxanagh_ has joined #openstack-keystone | 03:54 | |
| *** fawadkhaliq has joined #openstack-keystone | 03:55 | |
| openstackgerrit | Tony Wang proposed openstack/keystone: improve code and comments test_catalog https://review.openstack.org/232318 | 04:01 |
| *** EinstCrazy has joined #openstack-keystone | 04:04 | |
| *** lhcheng has joined #openstack-keystone | 04:05 | |
| *** ChanServ sets mode: +v lhcheng | 04:05 | |
| *** david8hu has quit IRC | 04:07 | |
| *** david8hu has joined #openstack-keystone | 04:07 | |
| *** EinstCrazy has quit IRC | 04:09 | |
| *** dims has joined #openstack-keystone | 04:10 | |
| *** lhcheng has quit IRC | 04:10 | |
| *** roxanagh_ has quit IRC | 04:13 | |
| *** vivekd has joined #openstack-keystone | 04:14 | |
| *** mylu has quit IRC | 04:18 | |
| *** mylu has joined #openstack-keystone | 04:19 | |
| *** markvoelker has joined #openstack-keystone | 04:22 | |
| *** mylu has quit IRC | 04:23 | |
| *** mylu has joined #openstack-keystone | 04:24 | |
| *** mylu has quit IRC | 04:26 | |
| *** mylu has joined #openstack-keystone | 04:26 | |
| *** markvoelker has quit IRC | 04:27 | |
| *** hrou has quit IRC | 04:30 | |
| *** davechen has joined #openstack-keystone | 04:30 | |
| *** roxanagh_ has joined #openstack-keystone | 04:31 | |
| *** markvoelker has joined #openstack-keystone | 04:37 | |
| *** jaosorior has joined #openstack-keystone | 04:40 | |
| openstackgerrit | lei zhang proposed openstack/keystone: :qUpdate sample catalog templates https://review.openstack.org/218711 | 04:40 |
| *** mylu has quit IRC | 04:40 | |
| *** markvoelker has quit IRC | 04:43 | |
| *** markvoelker has joined #openstack-keystone | 04:44 | |
| *** morgan has quit IRC | 04:47 | |
| *** morgan has joined #openstack-keystone | 04:50 | |
| *** ChanServ sets mode: +v morgan | 04:50 | |
| *** markvoelker has quit IRC | 04:53 | |
| *** Nirupama has joined #openstack-keystone | 05:02 | |
| *** GB21 has joined #openstack-keystone | 05:02 | |
| *** markvoelker has joined #openstack-keystone | 05:03 | |
| *** geoffarnoldX has quit IRC | 05:07 | |
| *** markvoelker has quit IRC | 05:08 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Update sample catalog templates https://review.openstack.org/218711 | 05:08 |
| *** mflobo has joined #openstack-keystone | 05:08 | |
| openstackgerrit | Merged openstack/keystone: Document httpd for accept on /identity, /identity_admin https://review.openstack.org/195766 | 05:09 |
| *** ngupta has quit IRC | 05:12 | |
| *** EinstCrazy has joined #openstack-keystone | 05:14 | |
| *** markvoelker has joined #openstack-keystone | 05:18 | |
| *** EinstCrazy has quit IRC | 05:20 | |
| *** markvoelker has quit IRC | 05:22 | |
| *** lhcheng has joined #openstack-keystone | 05:30 | |
| *** ChanServ sets mode: +v lhcheng | 05:30 | |
| *** markvoelker has joined #openstack-keystone | 05:32 | |
| *** EinstCrazy has joined #openstack-keystone | 05:34 | |
| *** GB21 has quit IRC | 05:35 | |
| *** markvoelker has quit IRC | 05:37 | |
| *** roxanagh_ has quit IRC | 05:43 | |
| openstackgerrit | Hidekazu Nakamura proposed openstack/keystone: Update development environment set up doc https://review.openstack.org/223020 | 05:46 |
| *** zzzeek has quit IRC | 05:47 | |
| *** markvoelker has joined #openstack-keystone | 05:47 | |
| *** GB21 has joined #openstack-keystone | 05:50 | |
| *** lhcheng has quit IRC | 05:51 | |
| *** lhcheng has joined #openstack-keystone | 05:52 | |
| *** ChanServ sets mode: +v lhcheng | 05:52 | |
| *** markvoelker has quit IRC | 05:52 | |
| *** jaosorior has quit IRC | 05:54 | |
| *** jaosorior has joined #openstack-keystone | 05:54 | |
| openstackgerrit | Tony Wang proposed openstack/keystone: improve code and comments in test_catalog https://review.openstack.org/232318 | 05:58 |
| *** markvoelker has joined #openstack-keystone | 06:02 | |
| openstackgerrit | Merged openstack/keystone: functional tests for keystone on subpaths https://review.openstack.org/196186 | 06:05 |
| *** su_zhang has quit IRC | 06:07 | |
| *** vivekd has quit IRC | 06:07 | |
| *** mflobo has left #openstack-keystone | 06:07 | |
| *** markvoelker has quit IRC | 06:08 | |
| *** flwang has quit IRC | 06:13 | |
| *** jaosorior has quit IRC | 06:13 | |
| *** lhcheng has quit IRC | 06:14 | |
| *** jaosorior has joined #openstack-keystone | 06:14 | |
| *** su_zhang has joined #openstack-keystone | 06:14 | |
| *** jaosorior has quit IRC | 06:16 | |
| *** jaosorior has joined #openstack-keystone | 06:17 | |
| *** vivekd has joined #openstack-keystone | 06:20 | |
| *** GB21 has quit IRC | 06:21 | |
| *** doug-fish has joined #openstack-keystone | 06:25 | |
| *** doug-fish has quit IRC | 06:29 | |
| *** btully has quit IRC | 06:30 | |
| *** itlinux has joined #openstack-keystone | 06:37 | |
| *** jbell8 has joined #openstack-keystone | 06:39 | |
| *** jvarlamova has joined #openstack-keystone | 06:39 | |
| *** pnavarro has joined #openstack-keystone | 06:39 | |
| *** roxanagh_ has joined #openstack-keystone | 06:44 | |
| *** markvoelker has joined #openstack-keystone | 06:46 | |
| *** gildub has quit IRC | 06:50 | |
| *** roxanagh_ has quit IRC | 06:50 | |
| *** markvoelker has quit IRC | 06:50 | |
| *** browne has quit IRC | 06:58 | |
| *** markvoelker has joined #openstack-keystone | 06:59 | |
| *** markvoelker has quit IRC | 07:04 | |
| *** rudolfvriend has joined #openstack-keystone | 07:04 | |
| *** su_zhang has quit IRC | 07:05 | |
| *** btully has joined #openstack-keystone | 07:06 | |
| *** jbell8 has quit IRC | 07:09 | |
| *** jbell8 has joined #openstack-keystone | 07:10 | |
| *** btully has quit IRC | 07:11 | |
| *** markvoelker has joined #openstack-keystone | 07:14 | |
| *** stevemar_ has quit IRC | 07:14 | |
| *** stevemar_ has joined #openstack-keystone | 07:14 | |
| *** ChanServ sets mode: +o stevemar_ | 07:14 | |
| *** stevemar_ has quit IRC | 07:18 | |
| *** aix has quit IRC | 07:18 | |
| *** markvoelker has quit IRC | 07:18 | |
| *** fawadkhaliq has quit IRC | 07:20 | |
| *** Guest74554 is now known as d0ugal | 07:23 | |
| *** d0ugal has quit IRC | 07:23 | |
| *** d0ugal has joined #openstack-keystone | 07:23 | |
| *** ParsectiX has joined #openstack-keystone | 07:27 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Remove auth headers in AuthProtocol https://review.openstack.org/229751 | 07:27 |
| *** markvoelker has joined #openstack-keystone | 07:28 | |
| *** markvoelker has quit IRC | 07:33 | |
| *** fhubik has joined #openstack-keystone | 07:33 | |
| *** kiran-r has joined #openstack-keystone | 07:35 | |
| *** woodster_ has quit IRC | 07:39 | |
| *** exploreshaifali has joined #openstack-keystone | 07:40 | |
| *** henrynash has joined #openstack-keystone | 07:40 | |
| *** ChanServ sets mode: +v henrynash | 07:40 | |
| *** markvoelker has joined #openstack-keystone | 07:43 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:44 | |
| *** jaosorior has quit IRC | 07:45 | |
| *** roxanagh_ has joined #openstack-keystone | 07:47 | |
| *** aix has joined #openstack-keystone | 07:47 | |
| *** openstackstatus has quit IRC | 07:47 | |
| *** markvoelker has quit IRC | 07:48 | |
| *** openstackstatus has joined #openstack-keystone | 07:48 | |
| *** ChanServ sets mode: +v openstackstatus | 07:48 | |
| *** jaosorior has joined #openstack-keystone | 07:49 | |
| *** vivekd has quit IRC | 07:51 | |
| *** roxanagh_ has quit IRC | 07:52 | |
| *** markvoelker has joined #openstack-keystone | 07:58 | |
| *** markvoelker has quit IRC | 08:02 | |
| *** davechen has quit IRC | 08:13 | |
| *** henrynash has quit IRC | 08:24 | |
| *** markvoelker has joined #openstack-keystone | 08:26 | |
| *** jbell8 has quit IRC | 08:28 | |
| *** markvoelker has quit IRC | 08:31 | |
| *** akanksha_ has quit IRC | 08:38 | |
| *** markvoelker has joined #openstack-keystone | 08:40 | |
| *** jistr has joined #openstack-keystone | 08:40 | |
| *** markvoelker has quit IRC | 08:46 | |
| *** roxanagh_ has joined #openstack-keystone | 08:49 | |
| *** exploreshaifali has quit IRC | 08:49 | |
| *** roxanagh_ has quit IRC | 08:53 | |
| *** markvoelker has joined #openstack-keystone | 08:55 | |
| openstackgerrit | Dave Chen proposed openstack/keystonemiddleware: update middlewarearchitecture.rst https://review.openstack.org/219162 | 08:57 |
| *** markvoelker has quit IRC | 08:59 | |
| *** aix has quit IRC | 08:59 | |
| *** henrynash has joined #openstack-keystone | 09:02 | |
| *** ChanServ sets mode: +v henrynash | 09:02 | |
| *** markvoelker has joined #openstack-keystone | 09:03 | |
| *** marzif has joined #openstack-keystone | 09:07 | |
| *** markvoelker has quit IRC | 09:08 | |
| *** markvoelker has joined #openstack-keystone | 09:10 | |
| *** aix has joined #openstack-keystone | 09:11 | |
| *** fawadkhaliq has quit IRC | 09:13 | |
| *** markvoelker has quit IRC | 09:15 | |
| *** e0ne has joined #openstack-keystone | 09:23 | |
| *** henrynash has quit IRC | 09:27 | |
| *** vivekd has joined #openstack-keystone | 09:30 | |
| *** phalmos has joined #openstack-keystone | 09:33 | |
| *** phalmos has quit IRC | 09:35 | |
| *** phalmos has joined #openstack-keystone | 09:36 | |
| *** amakarov_away is now known as amakarov | 09:38 | |
| *** markvoelker has joined #openstack-keystone | 09:40 | |
| *** markvoelker has quit IRC | 09:45 | |
| *** roxanagh_ has joined #openstack-keystone | 09:50 | |
| *** roxanagh_ has quit IRC | 09:54 | |
| *** markvoelker has joined #openstack-keystone | 09:55 | |
| *** markvoelker has quit IRC | 09:59 | |
| *** markvoelker has joined #openstack-keystone | 10:04 | |
| *** GB21 has joined #openstack-keystone | 10:09 | |
| *** markvoelker has quit IRC | 10:09 | |
| *** marzif has quit IRC | 10:10 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:13 | |
| *** fawadkhaliq has quit IRC | 10:18 | |
| *** markvoelker has joined #openstack-keystone | 10:19 | |
| *** markvoelker has quit IRC | 10:24 | |
| *** EinstCrazy has quit IRC | 10:30 | |
| *** markvoelker has joined #openstack-keystone | 10:33 | |
| *** markvoelker has quit IRC | 10:38 | |
| *** sdake has quit IRC | 10:41 | |
| *** henrynash has joined #openstack-keystone | 10:43 | |
| *** ChanServ sets mode: +v henrynash | 10:43 | |
| *** flwang has joined #openstack-keystone | 10:44 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:45 | |
| *** markvoelker has joined #openstack-keystone | 10:47 | |
| *** kiranr has joined #openstack-keystone | 10:49 | |
| *** kiran-r has quit IRC | 10:51 | |
| *** henrynash has quit IRC | 10:51 | |
| *** roxanagh_ has joined #openstack-keystone | 10:51 | |
| *** phalmos has quit IRC | 10:52 | |
| *** markvoelker has quit IRC | 10:55 | |
| *** roxanagh_ has quit IRC | 10:56 | |
| *** wwwjfy has quit IRC | 10:58 | |
| *** markvoelker has joined #openstack-keystone | 11:02 | |
| *** pnavarro is now known as pnavarro|lunch | 11:05 | |
| *** markvoelker has quit IRC | 11:12 | |
| *** markvoelker has joined #openstack-keystone | 11:17 | |
| *** markvoelker has quit IRC | 11:24 | |
| *** markvoelker has joined #openstack-keystone | 11:32 | |
| *** topol_ has joined #openstack-keystone | 11:35 | |
| *** ChanServ sets mode: +v topol_ | 11:35 | |
| *** markvoelker has quit IRC | 11:36 | |
| *** marzif has joined #openstack-keystone | 11:37 | |
| *** thiagop has joined #openstack-keystone | 11:39 | |
| *** markvoelker has joined #openstack-keystone | 11:47 | |
| *** markvoelker has quit IRC | 11:51 | |
| *** roxanagh_ has joined #openstack-keystone | 11:52 | |
| *** markvoelker has joined #openstack-keystone | 11:57 | |
| *** GB21 has quit IRC | 11:57 | |
| *** roxanagh_ has quit IRC | 11:59 | |
| *** markvoelker has quit IRC | 12:01 | |
| *** markvoelker has joined #openstack-keystone | 12:03 | |
| *** markvoelker has quit IRC | 12:08 | |
| *** markvoelker has joined #openstack-keystone | 12:12 | |
| *** markvoelker has quit IRC | 12:16 | |
| *** gordc has joined #openstack-keystone | 12:22 | |
| *** stevemar_ has joined #openstack-keystone | 12:31 | |
| *** ChanServ sets mode: +o stevemar_ | 12:31 | |
| *** thiagop is now known as thiagop-away | 12:32 | |
| *** hrou has joined #openstack-keystone | 12:32 | |
| *** Nirupama has quit IRC | 12:33 | |
| *** thiagop-away is now known as thiagop-afk | 12:34 | |
| *** itlinux has quit IRC | 12:34 | |
| *** stevemar_ has quit IRC | 12:34 | |
| *** GB21 has joined #openstack-keystone | 12:36 | |
| *** itlinux has joined #openstack-keystone | 12:37 | |
| *** edmondsw has joined #openstack-keystone | 12:38 | |
| *** pnavarro|lunch is now known as pnavarro | 12:38 | |
| *** su_zhang has joined #openstack-keystone | 12:38 | |
| *** doug-fish has joined #openstack-keystone | 12:39 | |
| *** _afazekas has joined #openstack-keystone | 12:39 | |
| *** _afazekas has quit IRC | 12:40 | |
| *** markvoelker has joined #openstack-keystone | 12:41 | |
| *** doug-fish has quit IRC | 12:41 | |
| *** doug-fish has joined #openstack-keystone | 12:41 | |
| *** markvoelker has quit IRC | 12:45 | |
| *** markvoelker has joined #openstack-keystone | 12:46 | |
| *** markvoelker has quit IRC | 12:49 | |
| *** markvoelker has joined #openstack-keystone | 12:49 | |
| *** markvoelker has quit IRC | 12:50 | |
| *** markvoelker has joined #openstack-keystone | 12:50 | |
| *** roxanagh_ has joined #openstack-keystone | 12:56 | |
| *** boris-42 has quit IRC | 12:58 | |
| *** nicodemos has joined #openstack-keystone | 12:58 | |
| *** roxanagh_ has quit IRC | 13:01 | |
| *** zz_john5223 is now known as john5223 | 13:02 | |
| *** wwwjfy has joined #openstack-keystone | 13:05 | |
| *** doug-fis_ has joined #openstack-keystone | 13:08 | |
| *** afazekas_ has joined #openstack-keystone | 13:09 | |
| *** markvoelker_ has joined #openstack-keystone | 13:11 | |
| *** doug-fish has quit IRC | 13:11 | |
| *** su_zhang has quit IRC | 13:11 | |
| *** markvoelker has quit IRC | 13:12 | |
| *** topol_ has quit IRC | 13:20 | |
| *** topol has joined #openstack-keystone | 13:20 | |
| *** ChanServ sets mode: +v topol | 13:20 | |
| *** marzif has quit IRC | 13:20 | |
| *** marzif has joined #openstack-keystone | 13:22 | |
| *** btully has joined #openstack-keystone | 13:22 | |
| *** markvoelker_ has quit IRC | 13:23 | |
| *** kiranr has quit IRC | 13:23 | |
| *** topol has quit IRC | 13:25 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Correct typo in copyright https://review.openstack.org/232528 | 13:25 |
| *** vivekd_ has joined #openstack-keystone | 13:30 | |
| *** zzzeek has joined #openstack-keystone | 13:30 | |
| *** vivekd has quit IRC | 13:31 | |
| *** vivekd_ is now known as vivekd | 13:31 | |
| mordred | jamielennox, morgan: btw - the reason to not call it type and to call it service_type is that type is an actual thing in python | 13:32 |
| *** kun_huang has joined #openstack-keystone | 13:36 | |
| kun_huang | where does the 'argument' come from at https://github.com/openstack/keystone/blob/master/keystone/common/kvs/backends/memcached.py#L86 | 13:36 |
| *** markvoelker has joined #openstack-keystone | 13:38 | |
| *** marzif has quit IRC | 13:41 | |
| *** marzif has joined #openstack-keystone | 13:41 | |
| *** afazekas_ has quit IRC | 13:42 | |
| *** boris-42 has joined #openstack-keystone | 13:43 | |
| *** markvoelker has quit IRC | 13:43 | |
| *** markvoelker has joined #openstack-keystone | 13:45 | |
| *** markvoelker has quit IRC | 13:50 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:50 | |
| *** markvoelker has joined #openstack-keystone | 13:53 | |
| dolphm | bknudson: any idea where the stable maintenance schedule is, specifically for security supported projects? the schedule seems to have disappeared | 13:54 |
| bknudson | dolphm: I think I remember dhellmann making some changes ... | 13:54 |
| dolphm | bknudson: the best i can find is this half-baked declaration https://security.openstack.org/vmt-process.html#supported-versions | 13:54 |
| bknudson | as in, moving it to git repo | 13:54 |
| bknudson | dolphm: https://wiki.openstack.org/wiki/Releases ? | 13:55 |
| bknudson | oh, that has a link to the new doc | 13:55 |
| bknudson | http://docs.openstack.org/releases/ | 13:55 |
| bknudson | is that what you're looking for? | 13:55 |
| breton | what do you think about switching from using ldap's search_ext_s instead of search_s | 13:56 |
| breton | ? | 13:56 |
| bknudson | breton: search_s just winds up calling search_ext_s | 13:56 |
| bknudson | they're the same thing | 13:56 |
| *** ngupta has joined #openstack-keystone | 13:56 | |
| dolphm | bknudson: that's closer - i was looking for EOL dates | 13:56 |
| dolphm | and transition dates from supported to security-supported | 13:57 |
| breton | bknudson: indeed | 13:57 |
| *** markvoelker has quit IRC | 13:58 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Fixed missed translatable string inside exception https://review.openstack.org/232544 | 13:58 |
| bknudson | dolphm: I think I've seen the doc that has the plans... probably have a link somewhere | 13:58 |
| *** roxanagh_ has joined #openstack-keystone | 13:58 | |
| bknudson | it would be nice to have the info on http://docs.openstack.org/releases/ | 13:58 |
| *** fawadkhaliq has quit IRC | 13:58 | |
| bknudson | dolphm: this one? https://wiki.openstack.org/wiki/StableBranch#Support_phases | 13:59 |
| *** marzif has quit IRC | 14:00 | |
| dolphm | bknudson: oh yeah, that's closer... there's a page that uses those dates, plus the 14 month total support cycle, to publish precise EOL dates | 14:00 |
| dolphm | or there used to be | 14:00 |
| *** marzif has joined #openstack-keystone | 14:01 | |
| bknudson | dolphm: from the summit discussions there's no promise of 14 months. Eventually we just give up on it because nobody's keeping it running. | 14:01 |
| bknudson | maybe it will be easier to support the old releases with better dependency management tooling. | 14:02 |
| *** marzif has quit IRC | 14:02 | |
| dolphm | bknudson: ah, that sounds familiar. i didn't realize that would result in deleting the schedule altogether though | 14:02 |
| *** _afazekas has joined #openstack-keystone | 14:03 | |
| dolphm | it also used to be helpful to see how long past EOL various releases were... | 14:03 |
| *** _afazekas has quit IRC | 14:03 | |
| bknudson | how about add it to http://docs.openstack.org/releases/ ? | 14:03 |
| bknudson | should be able to find the eol date from the tags in git repos | 14:04 |
| *** roxanagh_ has quit IRC | 14:04 | |
| *** markvoelker has joined #openstack-keystone | 14:06 | |
| *** markvoelker_ has joined #openstack-keystone | 14:08 | |
| bknudson | dolphm: this page has dates, so this must be the one you were thinking of: https://wiki.openstack.org/wiki/Releases | 14:10 |
| dolphm | bknudson: but no dates in the future | 14:11 |
| bknudson | y, because it's not maintained anymore | 14:11 |
| *** markvoelker has quit IRC | 14:11 | |
| dolphm | so, new thing does not sufficiently replace old thing :( | 14:12 |
| *** alejandrito has joined #openstack-keystone | 14:12 | |
| *** thiagop-afk is now known as thiagop | 14:20 | |
| *** csoukup has joined #openstack-keystone | 14:20 | |
| *** timcline has joined #openstack-keystone | 14:21 | |
| *** topol has joined #openstack-keystone | 14:27 | |
| *** ChanServ sets mode: +v topol | 14:27 | |
| *** stevemar_ has joined #openstack-keystone | 14:28 | |
| *** ChanServ sets mode: +o stevemar_ | 14:28 | |
| *** sdake has joined #openstack-keystone | 14:29 | |
| *** david_cu has joined #openstack-keystone | 14:35 | |
| *** markvoelker_ has quit IRC | 14:35 | |
| *** e0ne has quit IRC | 14:37 | |
| *** jaosorior has quit IRC | 14:38 | |
| *** jaosorior has joined #openstack-keystone | 14:38 | |
| *** tonytan4ever has joined #openstack-keystone | 14:40 | |
| *** hrou has quit IRC | 14:42 | |
| *** hrou has joined #openstack-keystone | 14:42 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Remove domain table references https://review.openstack.org/165936 | 14:42 |
| *** lkjahsdkfj has joined #openstack-keystone | 14:44 | |
| *** lkjahsdkfj has quit IRC | 14:44 | |
| *** lkjahsdkfj has joined #openstack-keystone | 14:44 | |
| lbragstad | dolphm: do you want a perf environment for - https://review.openstack.org/#/c/215212/10 ? | 14:45 |
| *** uiyice has quit IRC | 14:45 | |
| *** lkjahsdkfj is now known as uiyice | 14:46 | |
| *** hrou has quit IRC | 14:47 | |
| *** kun_huang has left #openstack-keystone | 14:48 | |
| dolphm | lbragstad: environment? | 14:48 |
| dolphm | lbragstad: i have a devstack install on baremetal we could use, just have to dig out the benchmark tools we used last time and run them | 14:48 |
| lbragstad | dolphm: i was reading your comment on that review about not having performance tested that patch yet, did you have any idea in mind for how you wanted to do that? | 14:48 |
| lbragstad | ah, devstack, nevermind | 14:49 |
| *** slberger has joined #openstack-keystone | 14:50 | |
| *** timcline has quit IRC | 14:51 | |
| dolphm | lbragstad: re run these? https://gist.github.com/dolph/cb9de036e91eabdefebe | 14:51 |
| *** timcline has joined #openstack-keystone | 14:51 | |
| *** timcline has quit IRC | 14:51 | |
| *** timcline has joined #openstack-keystone | 14:52 | |
| lbragstad | dolphm: yeah, that's what I was thinking | 14:52 |
| lbragstad | dolphm: would we need to make that specific to get_catalog? | 14:53 |
| *** pnavarro is now known as pnavarro|afk | 14:53 | |
| dolphm | lbragstad: no, it's auth performance where we want to see an improvement, right? | 14:54 |
| dolphm | lbragstad: err, auths & validations | 14:54 |
| *** mtreinish has quit IRC | 14:54 | |
| *** mtreinish has joined #openstack-keystone | 14:54 | |
| lbragstad | dolphm: yeah, and that should cover get_catalog since get_catalog is used in both of those, makes sense | 14:54 |
| *** markvoelker has joined #openstack-keystone | 14:55 | |
| *** e0ne has joined #openstack-keystone | 14:57 | |
| *** nate_gone has quit IRC | 14:58 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:59 | |
| *** browne has joined #openstack-keystone | 15:01 | |
| *** fawadkhaliq has quit IRC | 15:04 | |
| *** marzif has joined #openstack-keystone | 15:06 | |
| dolphm | lbragstad: running a benchmark now | 15:07 |
| lbragstad | dolphm: a base line without the patch? | 15:07 |
| dstanek | ayoung: busy? | 15:10 |
| dolphm | lbragstad: already done. baseline: http://cdn.pasteraw.com/ckcktfzmzed96b2x8rvn2g2nybutpak | 15:10 |
| dolphm | lbragstad: nevermind, i just remembered this is my minimal devstack install. the service catalog is pretty sparse | 15:11 |
| ayoung | dstanek, always, but always time for you. | 15:12 |
| lbragstad | dolphm: ah, i think the bootstrap.py script is a parse catalog too | 15:12 |
| dstanek | ayoung: :-) | 15:12 |
| dstanek | ayoung: you reminded me the other day that i need to finish up my DNS catalog POC | 15:13 |
| dstanek | ayoung: have you don't anything like that in the past? | 15:13 |
| ayoung | dstanek, its been disccused from time to time, but I am not sure how to do the project filtering side of it | 15:14 |
| ayoung | I mean, with the current approach, we can make endpoints private. If things are in DNS...they are not private, are they? | 15:14 |
| dstanek | in my current POC no, but we could do magic with dnssec to make that happen | 15:15 |
| *** aix has quit IRC | 15:16 | |
| dstanek | ayoung: generally speaking how useful is the filtering? | 15:16 |
| ayoung | dstanek, I think very | 15:17 |
| ayoung | if you have multiple nova, it is how people select the right one | 15:17 |
| ayoung | dstanek, oooh, dnssec...interesting..tell me more about that. | 15:17 |
| openstackgerrit | Merged openstack/keystonemiddleware: Handle memcache pool arguments collectively https://review.openstack.org/212341 | 15:17 |
| *** su_zhang has joined #openstack-keystone | 15:18 | |
| dstanek | you mean multiple nova in a region and a user needs to use a particular one? | 15:18 |
| dolphm | lbragstad: going to build a full devstack install and run it again, but meetings for now | 15:18 |
| dstanek | we can force authentication to the dns server and provide custom catalogs (i think) | 15:18 |
| dstanek | so many rfcs with so many extensions and hacks | 15:18 |
| dstanek | hard to keep track of what is real and what people just really want to do | 15:19 |
| lbragstad | dolphm ok, need me to do anything? | 15:19 |
| dolphm | lbragstad: get the roles caching patch passing ;) | 15:19 |
| lbragstad | dolphm sounds good, i just bit the bullet and switched to textual | 15:20 |
| dolphm | lbragstad: enjoy! | 15:21 |
| *** roxanagh_ has joined #openstack-keystone | 15:22 | |
| *** david-ly_ has joined #openstack-keystone | 15:22 | |
| *** david-lyle has quit IRC | 15:23 | |
| lbragstad | dolphm you said you have a patch locally for https://review.openstack.org/#/c/215212/10/keystone/catalog/core.py | 15:23 |
| *** timcline has quit IRC | 15:23 | |
| lbragstad | dolphm if you have a diff, i can push that for review | 15:24 |
| *** timcline has joined #openstack-keystone | 15:24 | |
| *** david-ly_ is now known as david-lyle | 15:24 | |
| *** alejandrito has quit IRC | 15:25 | |
| *** alejandrito has joined #openstack-keystone | 15:25 | |
| dolphm | lbragstad: i don't keep patches locally | 15:26 |
| *** jbell8 has joined #openstack-keystone | 15:26 | |
| dstanek | ayoung: i'm not quite sure how filtering and the service catalog standardization spec play together | 15:30 |
| *** hrou has joined #openstack-keystone | 15:31 | |
| ayoung | dstanek, ok, lets think how we want this to work. Our goal is to get the vcatalog out of the token, right? | 15:31 |
| *** roxanagh_ has quit IRC | 15:31 | |
| ayoung | but, when a user needs to do "openstack server create" they need to know where to find the appropriate compute server | 15:31 |
| ayoung | Now, if there were only one endpoint per service, I guess we would do something like | 15:32 |
| ayoung | "give me the compute server for domain mycompany.rackspace.com" | 15:32 |
| *** phalmos has joined #openstack-keystone | 15:33 | |
| *** doug-fis_ is now known as doug-fish | 15:33 | |
| ayoung | that would be a URI record with the nova server in it, and we'd have to figure out the quere params: | 15:33 |
| bknudson | dolphm: https://wiki.openstack.org/wiki/StableBranchRelease has some more info about stable branches, too | 15:34 |
| *** ParsectiX has quit IRC | 15:34 | |
| dolphm | bknudson: hey, very bottom of that page has what i was looking for! | 15:35 |
| dstanek | ayoung: so.... | 15:35 |
| dstanek | ayoung: dig +noque +nocmd +nostats _services._tcp.RegionOne.example-cloud.local PTR @104.239.230.39 | 15:35 |
| dstanek | that will get you a list of services for the RegionOne region | 15:36 |
| dstanek | dig +noque +nocmd +nostats _os-compute._tcp.RegionOne.example-cloud.local PTR @104.239.230.39 | 15:36 |
| dstanek | that will get you the endpoints for the compute region | 15:36 |
| *** tonytan4ever has quit IRC | 15:37 | |
| dstanek | ayoung: and then for the details get the SRV and TXT records for the endpoint you want to hit | 15:37 |
| ayoung | dstanek, URI, I think, not SRV | 15:37 |
| dstanek | ayoung: depends on the spec you are following - this is how i think dns-sd it done | 15:38 |
| dstanek | dns service discovery is the rfc that documents apple's bonjour protocol | 15:38 |
| dolphm | lbragstad: okay, new baseline, but still have a relatively small catalog ... didn't enable any optional services. http://cdn.pasteraw.com/7uw5n9flpze72dfyxyy4tzj5rnn36tz | 15:39 |
| dstanek | ayoung: right now my goal is just to get something working and then worry about the exact rfc details later | 15:40 |
| dstanek | ayoung: i just have a bit more client work and then i think it's "working" | 15:40 |
| ayoung | dstanek, regardless of spec, we dopn't want SRV records. We want to be able to point multiple services at the same host, on the same port (443) | 15:41 |
| dstanek | ayoung: and that won't work with this? the txt record would have the path to use | 15:42 |
| ayoung | dstanek, TXT works | 15:42 |
| ayoung | its just, I think, being superseded by URI | 15:42 |
| ayoung | There is no way in a TXT record to say "this is a URI" but I know they are often used that way | 15:43 |
| *** hrou has quit IRC | 15:44 | |
| dstanek | ayoung: it's part of the rfc6763 protocol - the registered names also have a list of the key/value pairs for the txt record | 15:44 |
| dstanek | ayoung: so i have this mostly working as-is and i think with a little focus i can have a workable demo by tomorrow | 15:44 |
| ayoung | dstanek, fantastic | 15:45 |
| dolphm | lbragstad: initial result: 2.7% performance improvement by adding caching to the catalog with 5 services in the catalog. running each variation several times now to get a more accurate number. | 15:45 |
| lbragstad | dolphm cool, and that was without the patch | 15:45 |
| dolphm | lbragstad: we need to thoroughly profile fernet validations | 15:46 |
| ayoung | dstanek, yeah, looks like URI are too new to depend on : https://tools.ietf.org/html/rfc7553 June 2015 | 15:46 |
| dstanek | dolphm: i want to make the catalog 100% faster :-) | 15:46 |
| ayoung | we'll use them when we can | 15:46 |
| *** dims has quit IRC | 15:46 | |
| lbragstad | dolphm ok | 15:46 |
| dolphm | dstanek: by killing it or what? | 15:46 |
| *** gyee has joined #openstack-keystone | 15:46 | |
| *** ChanServ sets mode: +v gyee | 15:46 | |
| bknudson | dolphm: doesn't it depend on how many projects there are? | 15:46 |
| dstanek | dolphm: putting it in DNS | 15:46 |
| *** timcline_ has joined #openstack-keystone | 15:46 | |
| bknudson | since you get a different catalog for each project | 15:47 |
| bknudson | or does it do the replacement afterwards? | 15:47 |
| dolphm | bknudson: uhh, what's "it"? | 15:47 |
| dstanek | ayoung: i have the catalog browsable in Bonjour GUI Browser a few weeks ago, but i think i broke it when i started to use custome service types that are not IANA registered | 15:48 |
| bknudson | dolphm: the token catalog code... wherever it is that keystone puts the project id in the catalog | 15:48 |
| ayoung | dstanek, what record types do you need? | 15:48 |
| bknudson | also it can put the user ID in the catalog | 15:48 |
| dstanek | ayoung: i also have not (and do not want!) implemented the part of the spec that will allow self registration | 15:49 |
| dstanek | ayoung: _os_itentity._tcp isn't real. for a while i was using _http._tcp for everything, but it isn't granular enough | 15:49 |
| *** itlinux has quit IRC | 15:49 | |
| ayoung | dstanek, That looks like a SRV record to me | 15:50 |
| dolphm | bknudson: the method signature is get_catalog(self, user_id, tenant_id), which is the call i'm testing caching on. not sure if that answers your question? | 15:50 |
| ayoung | dstanek, for example _kpasswd._tcp is SRV | 15:50 |
| *** pnavarro|afk is now known as pnavarro | 15:50 | |
| *** timcline has quit IRC | 15:50 | |
| bknudson | dolphm: y, don't you want to move that down to where it gets the catalog without replacements? | 15:51 |
| bknudson | then it won't depend on user_id and tenant_id | 15:51 |
| dstanek | ayoung: yes, it's a SRV record, but it represents a service type | 15:51 |
| *** _cjones_ has joined #openstack-keystone | 15:51 | |
| *** njohnston has joined #openstack-keystone | 15:51 | |
| lbragstad | bknudson isn't that only a concern if you are filtering catalog content based on the project you're scoping to | 15:52 |
| dstanek | ayoung: it may just be the crappy Mac client i was using because in theory it shouldn't need to know the service type | 15:52 |
| dstanek | ayoung: http://www.dns-sd.org/servicetypes.html | 15:52 |
| ayoung | dstanek, those "are" PTR records: | 15:52 |
| bknudson | lbragstad: no, every time you get a catalog it replaces $(tenant_id)s in the compute endpoint with whatever project your token is scoped to | 15:52 |
| *** fawadkhaliq has joined #openstack-keystone | 15:52 | |
| ayoung | http://paste.fedoraproject.org/276485/43195671/ | 15:52 |
| dolphm | bknudson: what call would that be? | 15:53 |
| ayoung | that is just the name | 15:53 |
| lbragstad | bknudson ah, never mind, I was thinking of something else | 15:53 |
| dstanek | ayoung: ah, right, right. they point to the service instances | 15:53 |
| bknudson | dolphm: trying to find it... probably buried in the catalog driver | 15:53 |
| lbragstad | dolphm bknudson https://github.com/openstack/keystone/blob/master/keystone/catalog/backends/sql.py#L289-L290 | 15:54 |
| bknudson | lbragstad: that's it. | 15:54 |
| lbragstad | dolphm bknudson it looks like that happens in the drivers | 15:54 |
| bknudson | what a crappy design! | 15:54 |
| bknudson | move it up to the manager | 15:54 |
| bknudson | unless somehow the driver can do the replacement better. | 15:55 |
| dolphm | bknudson: yep | 15:55 |
| lbragstad | weird, the actual url formatting method is in the manager already | 15:57 |
| lbragstad | but it's called from the driver.... | 15:57 |
| *** vivekd has quit IRC | 15:57 | |
| *** dims has joined #openstack-keystone | 15:57 | |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/catalog/core.py | 15:57 |
| lbragstad | actually - https://github.com/openstack/keystone/blob/master/keystone/catalog/core.py#L45 | 15:57 |
| dolphm | lbragstad: are you talking about format_url? | 15:57 |
| lbragstad | dolphm yeah | 15:58 |
| dolphm | lbragstad: that's not in the manager, it's a function in the core module | 15:58 |
| bknudson | also, we sure need a get_catalog and get_v3_catalog in the driver! | 15:58 |
| lbragstad | dolphm yeah, you're right | 15:58 |
| dolphm | bknudson: duh | 15:58 |
| bknudson | that should be way up in the controller | 15:58 |
| dolphm | bknudson: *just* like we need v2 and v3 tokens to be stored differently in the db for uuid, etc | 15:59 |
| *** dims_ has joined #openstack-keystone | 15:59 | |
| lbragstad | so, we should refactor the driver to just give us everything, then format it according to the catalog version needed | 15:59 |
| dolphm | lbragstad: yep | 16:00 |
| lbragstad | then when we do caching on the catalog, we can cache the whole thing, instead of catalog + tenant pairs | 16:00 |
| dolphm | right | 16:00 |
| dolphm | well | 16:00 |
| dolphm | that works for the base catalog driver | 16:00 |
| dolphm | the obfuscated catalog driver will have to be per pair still | 16:00 |
| lbragstad | why is that? | 16:00 |
| *** _cjones_ has quit IRC | 16:01 | |
| *** _cjones_ has joined #openstack-keystone | 16:02 | |
| dolphm | lbragstad: because it hides catalog entries per tenant or per user or whatever | 16:02 |
| bknudson | y, the endpoint filtering | 16:02 |
| *** dims has quit IRC | 16:02 | |
| bknudson | you'll have to pass the tenant_id or user_id in or whatever it needs | 16:02 |
| lbragstad | ah | 16:03 |
| morgan | You dont need to cache the filtered version | 16:03 |
| bknudson | but you don't have to do the replacement or v2-to-v3 conversion | 16:03 |
| dolphm | morgan: i was just about to say that | 16:03 |
| dolphm | if it called the same single cached method | 16:03 |
| lbragstad | just cache the *whole* thing | 16:03 |
| bknudson | I think the filtering is done via sql? | 16:03 |
| bknudson | but of course the join could be reimplemented in python | 16:03 |
| lbragstad | then the expensive part becomes the formatting operation | 16:03 |
| morgan | bknudson: so refactor that part to use the full catalog ;) | 16:03 |
| morgan | There are two other ways to approach it but they arent "easy" because it requires alternative cache regions. A lot of code to make that happen in keystone | 16:04 |
| dolphm | morgan: did you see the patch i posted? it adds a second cache region | 16:05 |
| dolphm | not super hard, most of the APIs were already in place | 16:05 |
| *** e0ne has quit IRC | 16:05 | |
| morgan | Ah | 16:05 |
| lbragstad | it wasn't that much code either | 16:05 |
| morgan | No didnt see | 16:05 |
| dolphm | morgan: https://review.openstack.org/#/c/215212/10/keystone/catalog/core.py,unified | 16:05 |
| morgan | Ah not too bad | 16:06 |
| dolphm | whoa, do you not have to restart apache2 anymore to apply code changes to keystone in devstack? | 16:07 |
| *** marzif has quit IRC | 16:08 | |
| *** marzif has joined #openstack-keystone | 16:08 | |
| lbragstad | dolphm why exactly did you need to have a second region for catalog again? | 16:09 |
| bknudson | dolphm: apache will start new instances whenever it feels like it | 16:09 |
| lbragstad | #feature | 16:09 |
| dstanek | ayoung: this feels like it's a lot of DNS calls (even though they should the light and cached) | 16:10 |
| bknudson | this was causing gate failures in grenade because stuff was being upgraded while keystone was service requests | 16:10 |
| bknudson | serving | 16:10 |
| ayoung | dstanek, what would be the optimized case? If all I want to do is nova boot, I really should only need to ask "where is my nova server" | 16:11 |
| dstanek | ayoung: yeah, i don't know :-( right now it would be a handful of DNS calls | 16:11 |
| ayoung | dstanek, otoh, If I need to know Sahara or Trove or whatnot, I should be able to ask for just that | 16:12 |
| dolphm | lbragstad: so that i could invalidate the entire region at once without having to enumerate cache keys to invalidate | 16:12 |
| dolphm | lbragstad: and not invalidate the rest of keystone's cache along with | 16:12 |
| lbragstad | dolphm ah, ok | 16:12 |
| * morgan will revisit making devstack use uwsgi soon. | 16:12 | |
| morgan | Should make gate better and easier to move other apis to apache | 16:13 |
| dolphm | morgan: on that note, https://developer.rackspace.com/blog/keystone_horizon_nginx/ | 16:14 |
| morgan | Yah. | 16:15 |
| morgan | I was going to rework devstack to setup apache all at once then make uwsgi do the heavy lifting in the same procedural way we do today | 16:15 |
| *** su_zhang has quit IRC | 16:15 | |
| morgan | So keystone and horizon would be moved over | 16:16 |
| morgan | Would also open the door for someone to easily use nginx ;) | 16:16 |
| *** timcline_ has quit IRC | 16:17 | |
| *** timcline has joined #openstack-keystone | 16:18 | |
| *** arunkant_ has joined #openstack-keystone | 16:19 | |
| *** mylu has joined #openstack-keystone | 16:24 | |
| dolphm | morgan: so use apache + uwsgi in the gate? | 16:24 |
| morgan | Yah | 16:25 |
| *** timcline_ has joined #openstack-keystone | 16:25 | |
| morgan | Will remove the "reatart apache" issue almost completely | 16:25 |
| bknudson | before devstack update the keystone instructions with how to set it up. | 16:25 |
| *** jsavak has joined #openstack-keystone | 16:25 | |
| morgan | Among other things | 16:26 |
| morgan | bknudson: the plan is a wip for devstack to show it works | 16:26 |
| openstackgerrit | Merged openstack/keystone: Enable hardcoded_bind_all_interfaces Bandit test https://review.openstack.org/225690 | 16:26 |
| morgan | Then deal with docs. | 16:26 |
| bknudson | that works for me. | 16:26 |
| morgan | Or find someone who is better at doc writing :P | 16:27 |
| *** geoffarnold has joined #openstack-keystone | 16:27 | |
| *** kiran-r has joined #openstack-keystone | 16:27 | |
| bknudson | https://uwsgi-docs.readthedocs.org/en/latest/Apache.html#mod-proxy-uwsgi ? | 16:27 |
| morgan | Yep | 16:27 |
| morgan | Or just mod_proxy | 16:27 |
| morgan | Both work | 16:27 |
| * morgan may have done a POC already | 16:28 | |
| *** mylu has quit IRC | 16:28 | |
| ayoung | morgan, we don't have any logic in the mapping backend like the SHA256 id_mapping code, do we? We have any way to map a long UserID to a sha256 haed one? | 16:28 |
| *** timcline has quit IRC | 16:28 | |
| morgan | ayoung: huh? | 16:29 |
| *** geoffarn_ has joined #openstack-keystone | 16:29 | |
| morgan | Not sure what youre asking | 16:29 |
| dstanek | ayoung: i guess if the know the region domain then you could do 2 queries | 16:30 |
| dstanek | ayoung: https://gist.github.com/dstanek/093f851fdea8ebfd893d | 16:30 |
| *** geoffarnold has quit IRC | 16:32 | |
| ayoung | morgan, in the Federation mapping code, do we have a way of taking in a long userid like this: glance/openstack.ayoung.os1.test@AYOUNG.OS1.TEST so a s a sha256 version | 16:33 |
| morgan | Uhm... Dunno off the top of my head | 16:33 |
| morgan | Sorry =/ | 16:34 |
| ayoung | morgan, we've been able to replace the service users with Kerberos services, but the names get too long | 16:34 |
| ayoung | I might be able to do something to split on the REALM though | 16:34 |
| ayoung | so it should only be glance/openstack.ayoung.os1.test | 16:34 |
| morgan | It shouldnt be hard to do a sha256 hook in for the mapping table | 16:34 |
| morgan | I thought we used that for federated users alreafy | 16:35 |
| ayoung | morgan, trying to do this in the existing code base, though | 16:35 |
| *** jsavak has quit IRC | 16:35 | |
| ayoung | that is what I thought, too | 16:35 |
| morgan | Domain_id + user_id | 16:35 |
| morgan | Hashed to sha256 | 16:35 |
| *** jsavak has joined #openstack-keystone | 16:35 | |
| *** lhcheng has joined #openstack-keystone | 16:35 | |
| *** ChanServ sets mode: +v lhcheng | 16:35 | |
| morgan | Pretty sure we do that for ephemeral users | 16:35 |
| ayoung | morgan, but the logic seems to be in the domain_specific_backend code only, and only for ldap over SQL | 16:36 |
| ayoung | I thought so too... | 16:36 |
| ayoung | maybe I missed it | 16:36 |
| morgan | marekd, stevemar_, ^ | 16:36 |
| *** jistr has quit IRC | 16:38 | |
| *** arunkant_ has quit IRC | 16:38 | |
| ayoung | dstanek, publicURL._os-compute._tcp could be publicURL._os-compute._https. THe text should be "URI=https://FQDN/compute/v2.1 I think | 16:38 |
| ayoung | but you are on to something here. | 16:38 |
| *** janonymous_ has joined #openstack-keystone | 16:38 | |
| ayoung | morgan, yeah, so when we URLEncode the USer ID that is that long principal, we overflow the DB columnet by 1 character | 16:39 |
| janonymous_ | Hi , Could somebody help me with : https://review.openstack.org/#/c/193866/ , i think i have to abandon this change :( | 16:39 |
| ayoung | janonymous_, what abandon? | 16:41 |
| *** jsavak has quit IRC | 16:41 | |
| janonymous_ | ayoung: This patch . | 16:41 |
| morgan | janonymous_: it's just a conversion of strings needed | 16:42 |
| ayoung | janonymous_, typo. I meant "why" | 16:42 |
| morgan | Pretty easy | 16:42 |
| *** phalmos has quit IRC | 16:42 | |
| *** jasonsb has joined #openstack-keystone | 16:42 | |
| morgan | You need to convert an output string to a something the method can work with. So uou might need tk just str() or similar | 16:42 |
| dolphm | janonymous_: you want someone to abandon it for you? or you want help getting it to pass jenkins? | 16:43 |
| janonymous_ | If someone could help me to pass it with gate it would be better. As morgan suggested i tried unicode , string also but it still failed , i donno why | 16:44 |
| dstanek | ayoung: we could add that in there. i modeled the openstack services after the _http._tcp service | 16:44 |
| ayoung | dstanek, so their approach is to do it as two pieces: FQDN in one query, suburl in a second? | 16:45 |
| ayoung | I guess that is fine. Slightly more terse, slightly harder to cut and paste | 16:45 |
| janonymous_ | ayoung: Ohh, because of the reason i mentioned :( | 16:46 |
| dstanek | ayoung: yes, i believe so; once i get it working i'll revisit the RFC and impl | 16:46 |
| ayoung | dstanek, so then the question is how to map from project to catalog, if it is not in the token | 16:47 |
| dstanek | ayoung: what do you mean? a project specific catalog? | 16:48 |
| *** agireud has quit IRC | 16:48 | |
| *** roxanaghe has quit IRC | 16:48 | |
| *** rudolfvriend has quit IRC | 16:48 | |
| *** fhubik has quit IRC | 16:49 | |
| *** drjones has joined #openstack-keystone | 16:49 | |
| *** ayoung is now known as ayoung-afk | 16:50 | |
| *** agireud has joined #openstack-keystone | 16:51 | |
| *** _cjones_ has quit IRC | 16:52 | |
| *** arunkant_ has joined #openstack-keystone | 16:54 | |
| *** jsavak has joined #openstack-keystone | 16:54 | |
| *** drjones has quit IRC | 16:54 | |
| *** _cjones_ has joined #openstack-keystone | 16:55 | |
| *** timcline_ has quit IRC | 16:56 | |
| *** timcline has joined #openstack-keystone | 16:56 | |
| *** drjones has joined #openstack-keystone | 16:58 | |
| *** jsavak has quit IRC | 16:58 | |
| *** jsavak has joined #openstack-keystone | 16:58 | |
| stevemar_ | morgan: catching up... | 16:58 |
| *** su_zhang has joined #openstack-keystone | 17:00 | |
| *** _cjones_ has quit IRC | 17:01 | |
| dstanek | janonymous_: it's possible that we just can't do that patch; our version takes into account that the Message is a special object | 17:03 |
| *** jaosorior has quit IRC | 17:04 | |
| *** jaosorior has joined #openstack-keystone | 17:04 | |
| dolphm | lbragstad: profiled an entire benchmark run, this is with the catalog caching patch https://gist.github.com/dolph/3bf24039b83a147eeb5c | 17:05 |
| dstanek | janonymous_: the Python 2.7 version of assertRaisesRegexp explicitly turns the message into a string using str() and that just won't work | 17:05 |
| lbragstad | dolphm nice, get_token_data seems to be right up there, that makes sense | 17:06 |
| lbragstad | dolphm and closely after that there is _populate_roles | 17:07 |
| *** mylu has joined #openstack-keystone | 17:07 | |
| lbragstad | dolphm btw, i think i narrowed down one of the issues with the role caching patch | 17:07 |
| *** jaosorior has quit IRC | 17:08 | |
| janonymous_ | dstanek: Please suggest what should be done | 17:08 |
| dstanek | janonymous_: probably abandon | 17:08 |
| dstanek | janonymous_: we may be able to simplify our version, but i don't see how we can get rid of it | 17:09 |
| janonymous_ | dstanek: I was thinking of that in the first place but i thought there might be some solution | 17:09 |
| janonymous_ | dstanek: but anyway i think that's fine for me | 17:09 |
| *** jsavak has quit IRC | 17:09 | |
| dstanek | janonymous_: the problem is that we can't call the 2.7 version is an i18n exception | 17:10 |
| *** jsavak has joined #openstack-keystone | 17:10 | |
| dolphm | lbragstad: something is wrong with the catalog caching patch if it's calling the sql backend just as much as it's hitting the manager :-/ | 17:10 |
| *** thiagop is now known as thiagop-afk | 17:11 | |
| lbragstad | dolphm is the profiler only using one user? | 17:11 |
| dolphm | lbragstad: it's the benchmark in that gist -- yes | 17:11 |
| dolphm | well, two: admin & demo | 17:11 |
| lbragstad | dolphm hmmm | 17:11 |
| lbragstad | dolphm so, keystone should only be making two full trips to the database | 17:11 |
| dolphm | goddammit devstack doesn't run with caching enabled rofl | 17:12 |
| *** afazekas_ has joined #openstack-keystone | 17:12 | |
| morgan | dolphm: correct | 17:12 |
| dstanek | janonymous_: just commented on the review | 17:12 |
| * dolphm facepalm | 17:12 | |
| lbragstad | dolphm oops | 17:12 |
| morgan | dolphm: explicit choice | 17:12 |
| dolphm | now my whole day makes sense | 17:12 |
| lbragstad | dolphm that fine though, now we have a profiled fernet run! | 17:13 |
| *** amakarov is now known as amakarov_away | 17:13 | |
| dolphm | lbragstad: now we're going to have a profiled fernet run with caching! | 17:13 |
| dolphm | lbragstad: i was expecting a double digit percent improvement from the catalog caching patch, maybe i'll see that now | 17:14 |
| lbragstad | dolphm ++ | 17:14 |
| *** dims has joined #openstack-keystone | 17:15 | |
| janonymous_ | dstanek: I'll abandon the patch then . But anyone willing to work on that please feel free to reopen the same :) | 17:15 |
| dstanek | janonymous_: i think the best we can do it reduce that method to 2 or 3 lines | 17:17 |
| *** dims has quit IRC | 17:18 | |
| *** drjones has quit IRC | 17:18 | |
| *** dims_ has quit IRC | 17:19 | |
| *** _cjones_ has joined #openstack-keystone | 17:19 | |
| *** roxanaghe has joined #openstack-keystone | 17:19 | |
| *** fawadkhaliq has quit IRC | 17:19 | |
| *** itlinux has joined #openstack-keystone | 17:20 | |
| lbragstad | dolphm i might see a problem with caching roles | 17:20 |
| lbragstad | dolphm we cache on user_id + tenant_id right now | 17:21 |
| *** janonymous__ has joined #openstack-keystone | 17:22 | |
| lbragstad | dolphm but https://github.com/openstack/keystone/blob/0e1d261ecf1adcf6f12c2c390ca26300376b1a32/keystone/tests/unit/test_v3_auth.py#L2153 will fail if a user is added to a group, | 17:22 |
| *** janonymous_ has quit IRC | 17:22 | |
| lbragstad | dolphm we might need to invalidate the role cache when a user is added to a group | 17:22 |
| *** timcline_ has joined #openstack-keystone | 17:24 | |
| *** tonytan4ever has joined #openstack-keystone | 17:24 | |
| *** mylu has quit IRC | 17:25 | |
| *** timcline has quit IRC | 17:25 | |
| *** mylu has joined #openstack-keystone | 17:26 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Restricting domain_id update https://review.openstack.org/207218 | 17:27 |
| dolphm | morgan: what's the pypi module that keystone's memcache_pool depends on? | 17:29 |
| *** timcline_ has quit IRC | 17:29 | |
| *** timcline has joined #openstack-keystone | 17:30 | |
| dolphm | morgan: python-memcached? | 17:30 |
| *** timcline_ has joined #openstack-keystone | 17:31 | |
| *** geoffarn_ is now known as geoffarnoldX | 17:31 | |
| *** exploreshaifali has joined #openstack-keystone | 17:31 | |
| *** hrou has joined #openstack-keystone | 17:31 | |
| morgan | Yeah. Think so | 17:32 |
| dstanek | dolphm: yeah | 17:32 |
| *** shadower has quit IRC | 17:32 | |
| *** timcline has quit IRC | 17:34 | |
| *** mylu has quit IRC | 17:35 | |
| *** marzif has quit IRC | 17:35 | |
| *** john5223 is now known as zz_john5223 | 17:36 | |
| *** janonymous__ has quit IRC | 17:39 | |
| *** geoffarnoldX is now known as geoffarn_ | 17:40 | |
| *** e0ne has joined #openstack-keystone | 17:40 | |
| breton | yes, python-memcached | 17:41 |
| *** ngupta has quit IRC | 17:43 | |
| *** tull has joined #openstack-keystone | 17:43 | |
| *** ngupta has joined #openstack-keystone | 17:45 | |
| *** itlinux has quit IRC | 17:46 | |
| *** itlinux has joined #openstack-keystone | 17:46 | |
| *** fawadkhaliq has joined #openstack-keystone | 17:48 | |
| *** itlinux has quit IRC | 17:51 | |
| *** devkulkarni has joined #openstack-keystone | 17:56 | |
| *** jsavak has quit IRC | 17:59 | |
| *** janonymous_ has joined #openstack-keystone | 17:59 | |
| devkulkarni | Hi keystone team, since yesterday solum's devstack gate is failing.. the logs indicate that job is getting authorization failure while setting up solum's user and roles.. here is the stack trace: http://logs.openstack.org/88/230588/5/check/gate-solum-devstack-dsvm/4fc57f8/logs/devstacklog.txt.gz#_2015-10-08_17_04_10_665 .. I need some guidance on how to fix this issue. | 18:00 |
| *** lhcheng has quit IRC | 18:01 | |
| bknudson | devkulkarni: why still using keystone and not openstack CLI? | 18:01 |
| devkulkarni | bknudson: haven't gotten around to switching over the openstack cli yet.. | 18:02 |
| bknudson | it's probably failing to auth since devstack is setting identity api version to v3 and keystone CLI only supports v2. | 18:02 |
| devkulkarni | bknudson: I see | 18:02 |
| bknudson | but I think that happened a while ago, not yesterday | 18:02 |
| *** lhcheng has joined #openstack-keystone | 18:03 | |
| *** ChanServ sets mode: +v lhcheng | 18:03 | |
| devkulkarni | bknudson: you think switching over openstack cli might help? does it work with v3 by default? | 18:03 |
| *** nicodemos_ has joined #openstack-keystone | 18:03 | |
| bknudson | devkulkarni: openstack CLI works with v3 and v2. | 18:04 |
| *** nicodemos_ has quit IRC | 18:04 | |
| bknudson | there's lots of examples in there as shown in the logs | 18:04 |
| devkulkarni | bknudson: I see.. here is a strange thing though.. I have a devstack setup in which I tried both ks and osc commands | 18:04 |
| devkulkarni | bknudson: yes. | 18:05 |
| devkulkarni | bknudson: for example, I tried ' keystone role-list ' and 'openstack role list' both required me to use admin creds | 18:05 |
| *** zz_john5223 is now known as john5223 | 18:06 | |
| devkulkarni | without admin, I was getting Authorizationfailure for both | 18:06 |
| *** kiran-r has quit IRC | 18:06 | |
| devkulkarni | since the error that I am getting on the devstack gate is similar, I am wondering if something else would need to be changed as well | 18:06 |
| bknudson | devkulkarni: by default you do need to be an admin to list roles. | 18:06 |
| bknudson | devkulkarni: maybe need to check some keystone logs or get debug info on the keystone cli call | 18:08 |
| *** su_zhang has quit IRC | 18:09 | |
| devkulkarni | bknudson: yes.. but because without admin I am seeing Authorization failure for both keystone and osc, I am wondering if the gate failure is due to not using the osc client or something else | 18:09 |
| *** dims has joined #openstack-keystone | 18:09 | |
| devkulkarni | bknudson: I will try changing over to osc | 18:09 |
| devkulkarni | is there a good comprehensive documentation of all the commands and available options for osc keystone somewhere? | 18:10 |
| *** su_zhang has joined #openstack-keystone | 18:16 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add caching to get_catalog https://review.openstack.org/215212 | 18:17 |
| dolphm | lbragstad: creation is faster by 16.7% and validation is faster by 7.5% with ^ https://gist.github.com/dolph/3bf24039b83a147eeb5c | 18:17 |
| *** itlinux has joined #openstack-keystone | 18:17 | |
| lbragstad | dolphm awesome! | 18:17 |
| *** exploreshaifali has quit IRC | 18:19 | |
| dolphm | lbragstad: looking at the remaining profile, your roles patch has the potential to shave another 10% off that | 18:19 |
| lbragstad | dolphm yeah, i think that's going to be tricky | 18:20 |
| lbragstad | caching roles that is | 18:20 |
| lbragstad | working on it now | 18:20 |
| lbragstad | i pulled down the patch that adds caching to roles and I'm looking at some of the issues with it | 18:21 |
| dolphm | lbragstad: i added revised the catalog caching patch based on something i missed that profiling revealed :) | 18:23 |
| lbragstad | dolphm i see you added caching to get_v3_catalog | 18:24 |
| lbragstad | dolphm is that what you mean? | 18:24 |
| dolphm | lbragstad: yep! | 18:26 |
| dolphm | lbragstad: i didn't realize that the driver's base implementation wasn't being used at all in sql's case (which makes sense, but anyway) | 18:26 |
| *** phalmos has joined #openstack-keystone | 18:27 | |
| lbragstad | dolphm interesting | 18:27 |
| lbragstad | dolphm trying to fix the role caching patch with http://cdn.pasteraw.com/pgjae8ibogjf1b4hubtxyosctr9db20 (or along the lines of) | 18:29 |
| stevemar_ | devkulkarni: yep, all the commands are here; http://docs.openstack.org/developer/python-openstackclient/command-list.html | 18:29 |
| *** zhenq has joined #openstack-keystone | 18:29 | |
| devkulkarni | thanks stevemar_ | 18:29 |
| lbragstad | dolphm but i think i'm still missing something | 18:29 |
| lbragstad | dolphm that's a bridge we'll have to figure out how to cross if we want that extra 10% | 18:30 |
| dolphm | lbragstad: what makes you say that you're missing something? | 18:31 |
| lbragstad | dolphm because https://github.com/openstack/keystone/blob/0e1d261ecf1adcf6f12c2c390ca26300376b1a32/keystone/tests/unit/test_v3_auth.py#L2153 still fails after i added that diff | 18:32 |
| *** itlinux has quit IRC | 18:32 | |
| lbragstad | dolphm i think it's because i'm trying to invalidate the cache in another region? | 18:33 |
| lbragstad | dolphm so from the idenitty manager, i'm trying to invalidate stuff in the assignment manager, which i'm not sure is possible... | 18:36 |
| dolphm | lbragstad: fwiw, here's the ranked list of things that get_token_data() spends it's time on http://cdn.pasteraw.com/mo8y8iixeuyegdrnmxbaqfvevojzoff | 18:38 |
| dolphm | for some reason service providers is also slow, and there's no federation in this deployment. | 18:38 |
| dolphm | lbragstad: anyway, i'm looking at the roles patch... | 18:39 |
| *** geoffarn_ is now known as geoffarnoldX | 18:41 | |
| lbragstad | dolphm let me push a new version of that patch, it'll make it easier to review | 18:41 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add caching to get_catalog https://review.openstack.org/215212 | 18:41 |
| dolphm | lbragstad: fixed builds ^ | 18:41 |
| *** doug-fish has quit IRC | 18:43 | |
| *** e0ne has quit IRC | 18:44 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 18:44 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 18:45 |
| lbragstad | dolphm new patch up ^ | 18:46 |
| lbragstad | with my attempt to invalidate based on add_user_to_group | 18:46 |
| dolphm | lbragstad: looking | 18:47 |
| *** agireud- has joined #openstack-keystone | 18:48 | |
| *** e0ne has joined #openstack-keystone | 18:49 | |
| *** agireud has quit IRC | 18:49 | |
| *** agireud- is now known as agireud | 18:49 | |
| dolphm | lbragstad: so you probably need to take the same approach i did - i didn't want to explicitly enumerate user+tenant pairs to invalidate catalogs. you don't want to explicitly enumerate user project pairs to invalidate assignments either | 18:50 |
| *** su_zhang has quit IRC | 18:50 | |
| ayoung-afk | devkulkarni, service tenant is probably in a different domain | 18:50 |
| dolphm | lbragstad: solution, create a new cache region and you can invalidate the entire thing at once | 18:50 |
| *** ayoung-afk is now known as ayoung | 18:50 | |
| lbragstad | dolphm ok, looking at your patch again | 18:52 |
| *** itlinux has joined #openstack-keystone | 18:52 | |
| *** itlinux has quit IRC | 18:55 | |
| dolphm | lbragstad: my patch is going to fail tests, dammit | 18:59 |
| dolphm | lbragstad: this is where i'm at with your patch, but i'm going to go back and fix mine http://cdn.pasteraw.com/nguo0grjpb4z4ukl1vjmr6mr5s767xv | 19:00 |
| lbragstad | dolphm pull down your diff now | 19:00 |
| lbragstad | pulling* | 19:01 |
| lbragstad | dolphm are the tests on your patch failing with AttributeError: 'CacheRegion' object has no attribute 'expiration_time' ? | 19:10 |
| dolphm | lbragstad: with the patch i started on top of yours, yes | 19:11 |
| openstackgerrit | Sam Leong proposed openstack/keystone: add initiator to v2 calls for additional auditing https://review.openstack.org/231123 | 19:11 |
| lbragstad | dolphm ok | 19:12 |
| openstackgerrit | Sam Leong proposed openstack/keystone: add initiator to v2 calls for additional auditing https://review.openstack.org/231123 | 19:12 |
| *** telemonster has quit IRC | 19:12 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update test modules passing on py34 https://review.openstack.org/231635 | 19:13 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix fernet key writing for python 3 https://review.openstack.org/231710 | 19:13 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix fernet padding for python 3 https://review.openstack.org/231711 | 19:13 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Handle fernet payload timestamp differences https://review.openstack.org/232711 | 19:13 |
| bknudson | it's going to be really hard to get python3 support without dogpile supporting it | 19:16 |
| *** geoffarnoldX has quit IRC | 19:17 | |
| bknudson | I thought I was making progress on test_fernet_provider but that's not going to work now | 19:17 |
| lbragstad | bknudson why is that/ | 19:18 |
| dolphm | bknudson: it's dependent on dogpile somehow? | 19:18 |
| bknudson | because now it's calling a bunch of functions that do caching. | 19:18 |
| dolphm | bknudson: when caching is disabled? | 19:19 |
| bknudson | keystone.tests.unit.token.test_fernet_provider.TestValidate.test_validate_v3_token_federated_info calls create_domain | 19:19 |
| bknudson | hmmm, maybe this was failing before and I didn't notice it due to the other issues | 19:19 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add caching to get_catalog https://review.openstack.org/215212 | 19:20 |
| bknudson | I swear this wasn't failing a couple days ago. | 19:20 |
| morgan | Dogpile should work with py3 | 19:20 |
| dolphm | lbragstad: alright my patch is passing *all* the tests now, not just the ones i was running before :P | 19:20 |
| bknudson | maybe we're calling it wrong? | 19:20 |
| bknudson | TypeError: Unicode-objects must be encoded before hashing | 19:20 |
| morgan | Python-memcache is probably still not py3 compat | 19:20 |
| dolphm | lbragstad: might want to rebase on top of it so you're not looking at test failures that aren't your fault! | 19:20 |
| bknudson | from /opt/stack/keystone/.tox/py34/lib/python3.4/site-packages/dogpile/cache/util.py | 19:21 |
| morgan | Key generator needs a fix | 19:21 |
| dolphm | python-memcached * | 19:21 |
| lbragstad | dolphm which patch did you completely fix up? | 19:21 |
| morgan | We can write our own keygenerator | 19:21 |
| morgan | And bypass that | 19:21 |
| dolphm | lbragstad: catalog caching | 19:21 |
| lbragstad | https://review.openstack.org/#/c/215212/12 dolphm ? | 19:21 |
| lbragstad | ok | 19:21 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 19:21 |
| bknudson | ok, let me take a stab | 19:22 |
| bknudson | I think oslo.cache has some example code | 19:22 |
| bknudson | actually, maybe oslo.cache will solve all our problems. | 19:23 |
| bknudson | maybe we should switch to that. | 19:23 |
| *** tqtran_ has joined #openstack-keystone | 19:26 | |
| openstackgerrit | Sonali proposed openstack/keystone: Do not rebuild revoke_tree on each validate-token https://review.openstack.org/232715 | 19:29 |
| dolphm | \o/ lbragstad ^^ | 19:31 |
| lbragstad | oh, nice! | 19:32 |
| stevemar_ | dolphm: lbragstad refering to the do not rebuild revoke tree? | 19:33 |
| lbragstad | stevemar_ yep | 19:33 |
| stevemar_ | lbragstad: yup, we had someone looking at that internally | 19:34 |
| stevemar_ | be nice to them, it's their first patch | 19:34 |
| lbragstad | stevemar_ I'm *always* nice | 19:34 |
| lbragstad | :) | 19:34 |
| *** itlinux has joined #openstack-keystone | 19:34 | |
| stevemar_ | lbragstad: you, yeah, it's true | 19:35 |
| lbragstad | stevemar_ adding myself to that one, for sure | 19:35 |
| *** timcline_ has quit IRC | 19:39 | |
| *** timcline has joined #openstack-keystone | 19:40 | |
| *** jsavak has joined #openstack-keystone | 19:40 | |
| lbragstad | dolphm running tests against my patch now | 19:41 |
| *** su_zhang has joined #openstack-keystone | 19:41 | |
| *** e0ne has quit IRC | 19:42 | |
| *** timcline_ has joined #openstack-keystone | 19:43 | |
| *** timcline has quit IRC | 19:43 | |
| *** jsavak has quit IRC | 19:45 | |
| *** jsavak has joined #openstack-keystone | 19:46 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 19:47 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 19:48 |
| *** akanksha_ has joined #openstack-keystone | 19:52 | |
| *** mylu has joined #openstack-keystone | 19:54 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/oslo.policy: Custom fixture to avoid external call in HttpCheck https://review.openstack.org/232725 | 19:55 |
| *** tqtran_ is now known as tqtran | 19:58 | |
| devkulkarni | bknudson, ayoung: ping | 20:00 |
| devkulkarni | bknudson: so I changed solum's devstack setup code to use osc | 20:00 |
| devkulkarni | I am running into an issue for the service create command. | 20:01 |
| devkulkarni | on gate logs, I am seeing this error: http://paste.openstack.org/show/475786/ | 20:01 |
| devkulkarni | but on my local devstack, I am seeing this: http://paste.openstack.org/show/475787/ | 20:01 |
| devkulkarni | notice that the flags for the two seem to be different | 20:02 |
| devkulkarni | on my local devstack, the version of openstack client installed is 1.7.1 | 20:02 |
| *** janonymous_ has quit IRC | 20:02 | |
| devkulkarni | any ideas what is the right way of invoking service create command | 20:02 |
| *** tonytan4ever has quit IRC | 20:03 | |
| *** mylu has quit IRC | 20:03 | |
| *** jsavak has quit IRC | 20:03 | |
| bknudson | devkulkarni: you've probably got your env vars set for identity version v2 while the gate has the env vars set to v3. | 20:03 |
| devkulkarni | bknudson: oh! | 20:03 |
| *** mylu has joined #openstack-keystone | 20:03 | |
| *** jsavak has joined #openstack-keystone | 20:04 | |
| devkulkarni | bknudson: you are right | 20:04 |
| devkulkarni | bknudson: will change local to v3 and try | 20:04 |
| bknudson | most of the openstack commands normalize the arguments but looks like this one is different | 20:04 |
| *** mylu has quit IRC | 20:05 | |
| devkulkarni | bknudson: no longer getting syntax error on my local env..which is good for me to exercise the gate again | 20:06 |
| *** mylu has joined #openstack-keystone | 20:06 | |
| devkulkarni | bknudson: thanks for the tip | 20:06 |
| *** itlinux has quit IRC | 20:06 | |
| *** mylu has quit IRC | 20:08 | |
| *** tonytan4ever has joined #openstack-keystone | 20:09 | |
| *** mylu has joined #openstack-keystone | 20:09 | |
| *** jsavak has quit IRC | 20:11 | |
| *** browne has quit IRC | 20:15 | |
| *** browne has joined #openstack-keystone | 20:15 | |
| *** sdake has quit IRC | 20:17 | |
| *** jsavak has joined #openstack-keystone | 20:20 | |
| *** mylu has quit IRC | 20:23 | |
| *** mylu has joined #openstack-keystone | 20:23 | |
| *** sdake has joined #openstack-keystone | 20:23 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 20:24 |
| *** pnavarro has quit IRC | 20:24 | |
| lbragstad | dolphm the only test that is failing is keystone.tests.unit.test_v2_keystoneclient.ClientDrivenTestCase.test_role_create_member_role but other than that it passes ^ | 20:24 |
| *** jsavak has quit IRC | 20:24 | |
| lbragstad | dolphm if you want to try and pull that down and see what you get for performance | 20:24 |
| *** mylu has quit IRC | 20:25 | |
| dolphm | lbragstad: what's up with that test? | 20:25 |
| *** jsavak has joined #openstack-keystone | 20:25 | |
| *** mylu has joined #openstack-keystone | 20:25 | |
| lbragstad | dolphm i'm not quite sure, i'm still digging into it, doesn't seem assignment specific http://cdn.pasteraw.com/g6ixrm4vfenqy42jqysfc5fjziwsoce | 20:26 |
| lbragstad | dolphm oh... | 20:28 |
| dolphm | lbragstad: role deleted and cache not invalidated? | 20:29 |
| *** mylu has quit IRC | 20:30 | |
| lbragstad | dolphm something like that, but maybe i'm missing an invalidate call in the assignment v2 path | 20:30 |
| lbragstad | dolphm looking in the assignment/router.py and i don't see an operation for v2 role delete | 20:31 |
| dolphm | lbragstad: you want to hand caching and cache invalidation at the manager layer, not the router/controller layer | 20:32 |
| lbragstad | dolphm right, i'm just trying to track down where i'm missing that from somewhere else in the pipeline | 20:33 |
| dolphm | lbragstad: hint: http://cdn.pasteraw.com/h4yubbxfp1iijv8eyhymjd2cwimckw0 | 20:33 |
| lbragstad | yep, i think that's it | 20:34 |
| lbragstad | dolphm rerunning and pushing a new version | 20:34 |
| *** pnavarro has joined #openstack-keystone | 20:36 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 20:39 |
| lbragstad | dolphm passed tests | 20:39 |
| dolphm | lbragstad: token creation is 13.6% faster on the first benchmark run | 20:43 |
| *** edmondsw has quit IRC | 20:43 | |
| dolphm | lbragstad: token validation is 1.3% faster on the first benchmark run | 20:44 |
| *** mylu has joined #openstack-keystone | 20:44 | |
| *** mylu has quit IRC | 20:45 | |
| *** timcline_ has quit IRC | 20:46 | |
| *** devkulkarni1 has joined #openstack-keystone | 20:46 | |
| *** timcline has joined #openstack-keystone | 20:46 | |
| dolphm | lbragstad: running two more benchmarks, but token creation is ~28% faster with both patches in place | 20:47 |
| *** mylu has joined #openstack-keystone | 20:47 | |
| *** devkulkarni has quit IRC | 20:47 | |
| *** su_zhang has quit IRC | 20:48 | |
| dolphm | lbragstad: we should look at compressing things in memcache next. spending cpu time on compression and decompression would be more time efficient than hitting the network. | 20:48 |
| dolphm | morgan: ^ | 20:48 |
| dolphm | morgan: it'd be a part of dogpile, i assume? if it's not already doing compression | 20:49 |
| lbragstad | dolphm so with both patches it's about 28% faster?! | 20:50 |
| dolphm | lbragstad: fernet token creation, yes | 20:50 |
| lbragstad | mfisch ^ | 20:50 |
| morgan | Uhm. | 20:50 |
| lbragstad | dolphm does your benchmark record response times? | 20:51 |
| dolphm | lbragstad: yes, scroll to the bottom https://gist.github.com/dolph/3bf24039b83a147eeb5c | 20:52 |
| *** jsavak has quit IRC | 20:52 | |
| dolphm | lbragstad: unpatched is pure stable/liberty. role caching is catalog caching + role caching | 20:53 |
| lbragstad | dolphm awesome | 20:53 |
| *** jsavak has joined #openstack-keystone | 20:53 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 20:53 |
| dolphm | that's 28.6% faster on token creation, to be more precise | 20:53 |
| lbragstad | dolphm it's nice that *with* caching the token creation and token validation times are more consistent with each other | 20:53 |
| dolphm | and 11.8% faster on token validation | 20:54 |
| dolphm | total | 20:54 |
| lbragstad | 76 ms response times for create and 79 ms for validation | 20:54 |
| *** jsavak has quit IRC | 20:54 | |
| *** jsavak has joined #openstack-keystone | 20:55 | |
| dolphm | lbragstad: and this is a profile of keystone during the benchmark run with both patches applied https://gist.githubusercontent.com/dolph/3bf24039b83a147eeb5c/raw/f735cd38c3b4af3a51e5bb514ca0b665d0845805/role-caching-patch.profile | 20:55 |
| lbragstad | dolphm nice, that's a significant improvement from the last profile | 20:56 |
| lbragstad | s/last/original/ | 20:56 |
| dolphm | lbragstad: so now, this is where we're spending time in get_token_data() http://cdn.pasteraw.com/etbwfte0d04dik9s60ojufggjbhlksq | 20:57 |
| lbragstad | really? | 20:58 |
| dolphm | really. | 20:58 |
| lbragstad | _populate_service_providers? | 20:58 |
| dolphm | yep. | 20:58 |
| lbragstad | o.O | 20:58 |
| dolphm | AND THERE ARE NONE! | 20:58 |
| *** ig0r_ has joined #openstack-keystone | 20:58 | |
| *** raildo is now known as raildo-afk | 20:59 | |
| *** mylu has quit IRC | 21:00 | |
| lbragstad | dolphm hmm, there isn't anything special about get_enabled_service_providers() that i can see | 21:01 |
| *** mylu has joined #openstack-keystone | 21:01 | |
| *** ig0r_ has quit IRC | 21:03 | |
| bknudson | it might be the first thing to hit the database so needs to do a checkout | 21:04 |
| bknudson | of the connection | 21:04 |
| dolphm | lbragstad: it spends all it's time hitting sql | 21:04 |
| *** ig0r_ has joined #openstack-keystone | 21:05 | |
| dolphm | lbragstad: iterating on get_enabled_service_providers(), as best i can tell from reading the profile | 21:05 |
| *** mylu_ has joined #openstack-keystone | 21:05 | |
| *** mylu has quit IRC | 21:06 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 21:07 |
| *** mylu_ has quit IRC | 21:08 | |
| *** mylu has joined #openstack-keystone | 21:09 | |
| *** jsavak has quit IRC | 21:09 | |
| *** GB21 has quit IRC | 21:10 | |
| *** ig0r_ has quit IRC | 21:10 | |
| *** pnavarro has quit IRC | 21:11 | |
| *** timcline_ has joined #openstack-keystone | 21:11 | |
| *** topol has quit IRC | 21:12 | |
| *** mylu has quit IRC | 21:13 | |
| *** timcline has quit IRC | 21:15 | |
| *** spandhe has joined #openstack-keystone | 21:15 | |
| *** su_zhang has joined #openstack-keystone | 21:18 | |
| *** ayoung has quit IRC | 21:21 | |
| *** csoukup has quit IRC | 21:25 | |
| *** fawadkhaliq has quit IRC | 21:27 | |
| *** nicodemos has quit IRC | 21:27 | |
| *** sdake has quit IRC | 21:28 | |
| SpamapS | morgan: did you know that pinterest also made their own python memcache client lib? https://github.com/pinterest/pymemcache | 21:30 |
| dolphm | lbragstad: alright, i'm out for the week - wedding this weekend. performance patches are all yours! | 21:31 |
| lbragstad | dolphm sounds good, thanks for the help! | 21:32 |
| *** jsavak has joined #openstack-keystone | 21:35 | |
| morgan | SpamapS: yes | 21:35 |
| *** tonytan4ever has quit IRC | 21:36 | |
| morgan | It is way better than the main one everyone uses. But it doesnt do hashring (yet?) or multi server really well | 21:36 |
| *** jsavak has quit IRC | 21:39 | |
| SpamapS | morgan: https://github.com/pinterest/pymemcache/blob/master/pymemcache/client/hash.py | 21:39 |
| SpamapS | oh thats just regular hash | 21:39 |
| *** jsavak has joined #openstack-keystone | 21:39 | |
| SpamapS | oh no | 21:40 |
| SpamapS | morgan: it uses Rendevouz hashing | 21:40 |
| SpamapS | morgan: https://en.wikipedia.org/wiki/Rendezvous_hashing | 21:40 |
| SpamapS | morgan: so it's actually the better choice for eventlet-ers now ;) | 21:41 |
| SpamapS | morgan: that was added June 26 | 21:43 |
| SpamapS | well, clanedstined's Rendevouz was, and then now it's private | 21:43 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:43 | |
| *** jbell8 has quit IRC | 21:46 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/oslo.policy: Custom fixture to avoid external call in HttpCheck https://review.openstack.org/232725 | 21:52 |
| *** jimbaker has joined #openstack-keystone | 21:54 | |
| *** gordc has quit IRC | 21:55 | |
| dstanek | so when using ksc's service_catalog what makes the decision to use v2 vs v3? | 21:58 |
| jamielennox | dstanek: what do you mean? | 21:58 |
| dstanek | uggg...i think i found it | 21:58 |
| *** mylu has joined #openstack-keystone | 21:58 | |
| jamielennox | there's a v2 and v3 object, the factory() creats the right one | 21:58 |
| dstanek | jamielennox: i think ServiceCatalog.factory is what i was looking for | 21:58 |
| dstanek | jamielennox: i just hacked the client to use DNS for the catalog and not i'm trying to see how easy it would be use do it for real | 22:00 |
| jamielennox | dstanek: so i've always considered that an option, and basically you don't do it there | 22:00 |
| jamielennox | the thing that calls the service catalog is get_endpoint() in an auth plugin, i think you want to override that and not use the catalog at all | 22:01 |
| dstanek | jamielennox: i don | 22:06 |
| dstanek | 't see get_endpoint in the auth plugins | 22:06 |
| *** thiagop-afk is now known as thiagop | 22:06 | |
| dstanek | oh, wait. maybe in auth.base | 22:07 |
| jamielennox | dstanek: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/base.py#L272 | 22:07 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/oslo.policy: Custom fixture to avoid external call in HttpCheck https://review.openstack.org/232725 | 22:10 |
| dstanek | jamielennox: hmmm...i was thinking of just changing the factory to know about DNS as an alternative to v2 or v3 | 22:10 |
| dims | stevemar_: bknudson: thanks for the reviews. the code looks much better now :) ^^ | 22:11 |
| jamielennox | factory kind of involves you knowing the entire catalog and then searching it | 22:11 |
| jamielennox | get_endpoint will only ask you for one thing at a time | 22:11 |
| jamielennox | i guess it depends how you are using dns | 22:12 |
| dstanek | jamielennox: https://gist.github.com/dstanek/093f851fdea8ebfd893d | 22:12 |
| dstanek | jamielennox: goal was service discovery and a few weeks ago you could browse the service catalog in a Bonjour GUI, but i somehow broke that along the way | 22:13 |
| *** mylu has quit IRC | 22:14 | |
| *** mylu has joined #openstack-keystone | 22:14 | |
| jamielennox | dstanek: SRV doesn't give you a port right? | 22:14 |
| dstanek | the SRV does include the port | 22:14 |
| jamielennox | dstanek: https://review.openstack.org/#/c/223429/ | 22:14 |
| jamielennox | i went with TXT | 22:14 |
| dstanek | jamielennox: how are you handling muliple services with multiple urls? | 22:16 |
| dstanek | jamielennox: i'm implementing the DNS-SD rfc (or at least trying to ) | 22:16 |
| jamielennox | dstanek: i'm not apparenlty - i'm not completely sure of how this should be done properly | 22:17 |
| jamielennox | TXT seemed right because i could get a full "http://xxxx:yyy/zzzz" style response | 22:17 |
| jamielennox | but this is an auth endpoint and i didn't really envision there would be multiple entries | 22:18 |
| dstanek | jamielennox: in the rfc the srv record holds the domain and port and a txt record holds path and other metadata | 22:18 |
| *** geoffarnold has joined #openstack-keystone | 22:18 | |
| jamielennox | yea, i need to read that spec properly | 22:18 |
| dstanek | me too :-) | 22:19 |
| *** david_cu has quit IRC | 22:19 | |
| dstanek | i just wanted to get something working - and now i'm told not to use bind9 so i have to see what the replacement is | 22:19 |
| jamielennox | i saw that comment | 22:19 |
| *** alejandrito has quit IRC | 22:20 | |
| jamielennox | i'm considering that a comment from admins, i don't care where they host the records | 22:20 |
| jamielennox | anyway the reason to do get_endpoint is you will be passed params like service_type so that you know what records to look for rather than load them all in advance | 22:22 |
| jamielennox | to properly implement the service catalog interface you are going to have to find all endpoints | 22:22 |
| dstanek | jamielennox: yeah, i'm already filtering base on some of them, but didn't get to them all yet | 22:23 |
| dstanek | jamielennox: i got some nova commands working and that's really what my goal was | 22:24 |
| jamielennox | fair enough, i'd love to see if something like this is possible | 22:25 |
| dstanek | the biggest problem is that i do lotso dns queries, but i think that's just the way it goes | 22:25 |
| jamielennox | so you could cache this on the auth plugin | 22:26 |
| jamielennox | i do that already for discovery | 22:27 |
| morgan | SpamapS: yeah those additions were very newish | 22:29 |
| dstanek | dnspython has some caching capabilities too. i just haven't looked into it much | 22:29 |
| SpamapS | morgan: indeed | 22:30 |
| *** hrou has quit IRC | 22:33 | |
| *** _hrou_ has joined #openstack-keystone | 22:33 | |
| *** arunkant has quit IRC | 22:37 | |
| *** slberger has left #openstack-keystone | 22:38 | |
| *** devkulkarni has joined #openstack-keystone | 22:40 | |
| morgan | solution: stop making keystone a configuration of the endpoints :P use consul or ZK and have endpoints self-register | 22:40 |
| morgan | dolphm: ^ :P | 22:40 |
| jamielennox | well you wouldn't manage the dns entries via keystone | 22:41 |
| jamielennox | there's pacemaker, hostname dns and all sorts of other things you could use to keep the hosts static | 22:42 |
| jamielennox | i don't think self-register is a win | 22:42 |
| *** devkulkarni1 has quit IRC | 22:42 | |
| *** _hrou_ has quit IRC | 22:49 | |
| *** ngupta has quit IRC | 22:50 | |
| morgan | jamielennox: with consul it is. the host is configured to know it's endpoint when it registers with keystone, when it drops consul/ZK would drop it from the catalog | 22:50 |
| morgan | you need to know DNS/IP/Whatever for CMS anyway | 22:50 |
| jamielennox | morgan: i don't consider that a catalog job, the same pattern is already done via loadbalancer which the catalog is pointing to | 22:51 |
| morgan | consul also has a healthcheck that would auto-drop things out if needed. it is a bit of a redesign, but the whole "configure keystone via APIs to do something we have to manage elsewhere" but do it less well than the other systems seems flawed | 22:51 |
| *** jsavak has quit IRC | 22:51 | |
| morgan | the catalog shouldn't be something keystone has to care about except for translating to old clients | 22:52 |
| morgan | is more my point | 22:52 |
| morgan | keystone-as-the-catalog is a suboptimal design and lacks in many ways. | 22:52 |
| *** jsavak has joined #openstack-keystone | 22:52 | |
| morgan | there are other ways to get the data to the clients without needing to do API config to point at a load balancer for example | 22:53 |
| jamielennox | i don't know the consul formats or anything, i'd be ok with one url that keystone returns instead of a catalog, but i'm not sure why consul/zk is better than haproxy | 22:53 |
| jamielennox | (for this case) | 22:53 |
| morgan | the point of consul is that is knows what APIs are available and even has a DNS interface | 22:54 |
| morgan | and is is distributed | 22:54 |
| morgan | so if nova needs to know where glance is, it can reference consul | 22:54 |
| jamielennox | so dns seems a terrible way to refer to something that is expected to auto-register and occasionally fall out | 22:55 |
| morgan | nah. | 22:55 |
| jamielennox | ttls | 22:55 |
| morgan | it's a fairly proven mechanism. | 22:55 |
| morgan | still better than what we do today | 22:56 |
| morgan | i think keystone is doing way too much | 22:56 |
| morgan | and it does a poor job at many of the things | 22:56 |
| morgan | the catalog is definitely a place where we've missed | 22:56 |
| stevemar_ | morgan: yep | 22:57 |
| stevemar_ | morgan: it should be much easier to get the catalog | 22:57 |
| jamielennox | i would agree with that | 22:57 |
| morgan | there is a nice x-project session to talk about a DLM/Distributed-KVS system (ZK/consul) so once that decison has been codified for openstack we can look at the strengths of the system rather than NIHing it | 22:57 |
| morgan | consul is explicitly designed for service discovery | 22:58 |
| morgan | ZK is not as good at it, but is pretty close | 22:58 |
| morgan | ZK is a better DLM and has better python bindings | 22:58 |
| *** jbell8 has joined #openstack-keystone | 22:59 | |
| *** henrynash has joined #openstack-keystone | 22:59 | |
| *** ChanServ sets mode: +v henrynash | 22:59 | |
| morgan | but the long/short is we have a distributed system that changes over time. and we have mixed in a bad way admin and config tasks for the catalog (service discovery) | 22:59 |
| jamielennox | that's going to be an interesting discussion, but i don't think it's got such keystone implications | 22:59 |
| morgan | i think it absolutely has keystone implications | 22:59 |
| morgan | as once that is lined up we should make ZK or Consul the backend for the catalog | 23:00 |
| *** timcline_ has quit IRC | 23:00 | |
| morgan | and stop configuring it in keystone... | 23:00 |
| morgan | when a service comes up, it connects to the local agent for consul/ZK and says "I am nova-api" for example, and there is a healthcheck enabled. nova-api then appears in the catalog. if it's behind a LB, thats fine, you can jump into the LB config | 23:01 |
| morgan | configure this all at the endpoint side | 23:01 |
| jamielennox | but you never want that anyway, you want the LB in the catalog | 23:01 |
| jamielennox | and haproxy/whatever people are using does that | 23:01 |
| morgan | so it tags in on the LB's service | 23:01 |
| morgan | but it still should NOT be an API call in keystone to setup | 23:02 |
| jamielennox | sure, but puppet/ansible whatever you are spawning these things with can do that | 23:02 |
| *** gordc has joined #openstack-keystone | 23:02 | |
| morgan | no. | 23:02 |
| jamielennox | morgan: absolutely agree it's not a keystone call | 23:02 |
| jamielennox | the LB address goes into catalog | 23:02 |
| jamielennox | then you talk to the LB when bringing up/down endpoints | 23:02 |
| morgan | the LB address shouldn't be a Keysotne call either | 23:02 |
| jamielennox | to that - meh | 23:03 |
| jamielennox | you add an entry per service, and if you're dealing with load balancers you do it once | 23:03 |
| morgan | except every time I want to add another entry / lb I still need to make a keystone call | 23:03 |
| morgan | and every time I want to drop something out | 23:03 |
| morgan | I need to make a keystone call | 23:03 |
| morgan | what if I want 4 nova-apis? | 23:04 |
| morgan | then 10 | 23:04 |
| morgan | different regions, etc | 23:04 |
| morgan | pull in/out regions, etc | 23:04 |
| morgan | this is all silly to be keystone calls | 23:04 |
| morgan | the keystone catalog is poorly implemented and does a lot of "stand up new X" stuff badly | 23:04 |
| jamielennox | and i would agree with that, but adding new regions or endpoints to a deployment should be a big decision | 23:05 |
| *** gordc has quit IRC | 23:05 | |
| morgan | but that shouldn't mean "we make this painful and done poorly in keystone to make it a big decision" | 23:05 |
| jamielennox | the overhead of having to deal with keystone there should be not an issue | 23:05 |
| morgan | except it is archaic | 23:06 |
| morgan | and really could be much much simpler | 23:06 |
| morgan | this should be trivial to standup a new set of endpoints or region | 23:06 |
| jamielennox | maybe if they come out with 1 DLM service, not abstraction, not new oslo library but one required service | 23:06 |
| morgan | that is the plan | 23:06 |
| morgan | a single DLM that is a hard requirement for openstack | 23:06 |
| jamielennox | otherwise i'd prefer to handle it ourselves than have a dozen backends | 23:06 |
| morgan | no abstraction | 23:06 |
| morgan | and write to the DLMs explicit bindings | 23:07 |
| morgan | that is what we are pushing for | 23:07 |
| morgan | either consul or zookeeper | 23:07 |
| morgan | not "either or" not "both" not "whatever you feel like" | 23:07 |
| dims | morgan: "pushing for" where? openstack-specs? | 23:07 |
| morgan | dims: there was a ML thread on it | 23:07 |
| morgan | and there is a summit session on it | 23:08 |
| morgan | and from there x-project spec will come up | 23:08 |
| dims | morgan: cool just want to make sure i pay attention :) | 23:08 |
| morgan | actually i think openstack-spec has one already | 23:08 |
| jamielennox | ok, i'll look again based on the outcome of that, but i still don't consider it a huge keystone win | 23:08 |
| morgan | jamielennox: I think it's a medium win for keystone, but a major win for openstack | 23:08 |
| jamielennox | yep | 23:08 |
| morgan | dims: harlowja was working on the spec | 23:08 |
| dims | right | 23:09 |
| morgan | jamielennox: but medium wins for keystone are big wins for deployers and adoption of openstack | 23:09 |
| morgan | jamielennox: keystone should never have "major wins", if we do at this point we probably screwed up somewhere | 23:09 |
| jamielennox | v4! | 23:09 |
| harlowja | what i do | 23:09 |
| morgan | harlowja: DLM discussion | 23:09 |
| harlowja | oh | 23:09 |
| harlowja | ya | 23:09 |
| jamielennox | ah - you're not PTL anymore, that's not going to get to you as muc | 23:09 |
| jamielennox | h | 23:09 |
| *** su_zhang has quit IRC | 23:09 | |
| morgan | jamielennox: nope. I'm all for v4 once we split Crud from auth (now) | 23:10 |
| harlowja | i'm hoping it becomes less of a discsussion in general, and becomes more of an acceptance/realization | 23:10 |
| harlowja | i think the discussion sorta isn't useful much anymore (but meh, i'm very biased, haha) | 23:10 |
| morgan | harlowja: i think we need to use the "lock the door and no you can't leave until you accept this" | 23:10 |
| harlowja | +1 | 23:10 |
| morgan | method of "discussion" | 23:10 |
| morgan | :) | 23:10 |
| morgan | cc mordred ^ | 23:10 |
| harlowja | waterboarding not included, lol | 23:10 |
| *** jsavak has quit IRC | 23:11 | |
| jamielennox | someone should do some reading on what's legal in japan... | 23:12 |
| harlowja | ha | 23:12 |
| harlowja | the thing that bugs me, is that etc.d, and coreos, (docker?) have all understood what this kind of thing can offer, and they move there projects forward, if openstack gets stuck in discussion around this stuff, i generally feel it will make itself irrelevant by doing that | 23:13 |
| harlowja | buuuuut ya, let's all make sure ^ doesn't happen | 23:13 |
| harlowja | and thats my speech for today, ha | 23:14 |
| morgan | harlowja: mordred is on the same page as is flaper87 | 23:15 |
| * harlowja reads backlog and sees u guys already talked about some of this, hahaha | 23:16 | |
| morgan | i think we have a good amount of "seriously we should just do this" | 23:16 |
| morgan | sanity to add to the room | 23:16 |
| morgan | yah | 23:16 |
| harlowja | if u guys have questions about kazoo (the zookeeper python client); bug me and all | 23:17 |
| *** arunkant_ has quit IRC | 23:17 | |
| harlowja | idk what other consul, etc.d have for python clients (if anything at all) | 23:17 |
| harlowja | i can even make little demo scripts for u guys to try to see what a service catalog, thinks coming online/going offline, and others getting notified of this look like... | 23:18 |
| harlowja | not really that hard to do ^ | 23:18 |
| harlowja | *using kazoo | 23:18 |
| morgan | harlowja: lets get the DLM solidified at the summit then... | 23:19 |
| dstanek | jamielennox: still hanging around? | 23:19 |
| jamielennox | dstanek: yea | 23:19 |
| morgan | harlowja: I then plan to build that all into keystonemiddleware | 23:19 |
| harlowja | cool | 23:19 |
| morgan | harlowja: or at least get help to do so | 23:20 |
| harlowja | hopefully more than jelly solid to | 23:20 |
| morgan | harlowja: i think people will appreciate the DLM stuff as it will make all the crappy locking go away (long term) | 23:20 |
| morgan | harlowja: i prefer consul fwiw, but i think ZK is an easier sell | 23:20 |
| morgan | and as long as we land on one of them, yay | 23:20 |
| harlowja | is there a decent python client for consul? | 23:20 |
| jamielennox | marekd: did we never provide a complete saml CLI plugin? | 23:20 |
| morgan | harlowja: not as good as zk's but yes | 23:21 |
| dstanek | jamielennox: is there a different way to write this so that i don't have to generate the entire catalog to find a single url? http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/service_catalog.py#n254 | 23:21 |
| * harlowja doesn't really know (i'm a kazoo core reviewer, blah blah, so haven't looked around much, ha) | 23:21 | |
| morgan | harlowja: it is fully functional, just not as refined/clean | 23:21 |
| morgan | harlowja: consul uses a local agent on every machine with a couple cluster masters, so the python client always talks to the local agent | 23:21 |
| jamielennox | dstanek: this is why i think you're better off with get_endpoint because it asks for one item | 23:21 |
| dstanek | morgan: speak of zk - i've mostly implemented dns-sd for the service catalog | 23:22 |
| morgan | dstanek: nice | 23:22 |
| morgan | harlowja: but like i said, i think ZK is going to be an easier sell | 23:22 |
| harlowja | java! | 23:22 |
| harlowja | but java! | 23:22 |
| dstanek | jamielennox: but anything that wants to use a catalog will have to use my dns abstraction anyway right? | 23:22 |
| jamielennox | dstanek: what wants to use a catlog? | 23:22 |
| morgan | harlowja: and i can work around any ZK specific limitations for "OMG WE HAVE THE BETTER TOOLS" | 23:22 |
| jamielennox | directly? | 23:22 |
| *** dims has quit IRC | 23:23 | |
| dstanek | jamielennox: no idea, but it's a public api | 23:23 |
| jamielennox | dstanek: so with the session stuff i've tried to hide all that as much as possible | 23:24 |
| dstanek | jamielennox: if you don't think anyone should be using it i can just make a get_data() that returns 1 | 23:24 |
| jamielennox | you do session.get('/path', service_type='type', region_name='XXX', interface='public') | 23:24 |
| dstanek | morgan: somehow i broke the bonjour support though | 23:24 |
| morgan | uh. | 23:24 |
| jamielennox | that will call get_endpoint with that info | 23:25 |
| jamielennox | anyone that is using the service catalog directly should be moved over at this point | 23:25 |
| *** thiagop has quit IRC | 23:26 | |
| dstanek | jamielennox: i don't know. it still feels like i have to create a ServiceCatalog subclass so i can handle the v2 vs v3 interfaces and such | 23:26 |
| mordred | morgan, harlowja: I prefer consul because it's opinionated | 23:27 |
| mordred | ZK is great technology | 23:27 |
| morgan | mordred: ++ | 23:27 |
| mordred | but it's great techology that you use as a building block to build your opinion | 23:27 |
| morgan | i'm happy as long as we (openstack) are opinionated | 23:27 |
| jamielennox | dstanek: but assumedly you wouldn't have a catalog in the token to read | 23:27 |
| mordred | and I think that gets us in to trouble in openstack | 23:27 |
| morgan | about the tech we're using | 23:27 |
| morgan | and how we are using it | 23:27 |
| harlowja | if the features exist, and are pretty much the same across all (and the client isn't crap) i honestly just want one/any of them, lol | 23:28 |
| mordred | if we use zookeeper, we'll wind up with an oslo library that implements that various primitives that you need to have in the 'right' way | 23:28 |
| dstanek | jamielennox: that's a good point... | 23:28 |
| mordred | which we could TOTALLY do | 23:28 |
| mordred | and be successful | 23:28 |
| harlowja | kazoo | 23:28 |
| harlowja | ? | 23:28 |
| *** csoukup has joined #openstack-keystone | 23:28 | |
| mordred | but it seems like a longer path to me | 23:28 |
| dstanek | what are we using zk for? | 23:28 |
| jamielennox | dstanek: i'm happy to say that if you want to use newer features you have to be using session | 23:28 |
| harlowja | http://kazoo.readthedocs.org/ | 23:28 |
| harlowja | 'A wide range of recipe implementations' .. | 23:28 |
| jamielennox | stevemar_: do we not have a complete saml2 plugin? | 23:29 |
| openstackgerrit | Sam Leong proposed openstack/keystone: add initiator to v2 calls for additional auditing https://review.openstack.org/231123 | 23:29 |
| harlowja | 'Pure-Python based implementation of the wire protocol, avoiding all the memory leaks, lacking features, and debugging madness of the C library' ... | 23:29 |
| stevemar_ | jamielennox: we should | 23:29 |
| mordred | harlowja: I will read through the kazoo stuff, if you read through the consul stuff | 23:29 |
| harlowja | sureee :) | 23:29 |
| jamielennox | stevemar_: i see an unscoped plugin that takes all the right params, i see a scoped plugin that takes a token | 23:29 |
| jamielennox | stevemar_: but i can't see anything that lets me provide all the password and idp_id and a project_id together | 23:30 |
| stevemar_ | jamielennox: oh you are asking for one that does both at once? | 23:30 |
| jamielennox | and just have it scope it as it should | 23:30 |
| stevemar_ | jamielennox: i think marekd had one in ksc | 23:30 |
| dstanek | morgan: when you have a few checkout https://gist.github.com/dstanek/093f851fdea8ebfd893d and see if that makes sense to you. it's the DNS based catalog | 23:30 |
| jamielennox | stevemar_: i thought we had one | 23:30 |
| stevemar_ | https://github.com/openstack/python-keystoneclient/blob/master/setup.cfg#L40 | 23:31 |
| harlowja | mordred and ask if u want to know anything about kazoo, cause ya, i'm sorta core in that library, ha | 23:31 |
| stevemar_ | or does that just do the latter? i think it just does the latter | 23:31 |
| morgan | dstanek: will look in a few doing some updates on things | 23:31 |
| mordred | harlowja: cool | 23:31 |
| dstanek | morgan: no hurry. just trying to get the client working the right way instead of my hacks | 23:31 |
| morgan | nod | 23:31 |
| jamielennox | stevemar_: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/contrib/auth/v3/saml2.py#L914 | 23:32 |
| jamielennox | stevemar_: so it just inherits from v3.Token, but replaces "token": with "saml": | 23:32 |
| harlowja | https://github.com/rgs1/zk_shell is also nice, shell like interface to zookeeper (which also uses kazoo) | 23:32 |
| harlowja | mordred on the consul docs, where is there any references to what the actual api is?, is it rest based? something binary? | 23:33 |
| harlowja | if u know | 23:34 |
| mordred | https://www.consul.io/docs/agent/http.html | 23:34 |
| harlowja | ah, thx | 23:34 |
| dstanek | morgan: harlowja: reading back on the convo - if the endpoints self register we should make that pluggable - so zk isn't the only option | 23:34 |
| mordred | harlowja: there's also a DNS-based API for reading info out | 23:34 |
| mordred | harlowja: https://www.consul.io/docs/agent/dns.html | 23:34 |
| harlowja | dstanek i've got mixed feelings on that | 23:34 |
| mordred | dstanek: absolutely disagree | 23:34 |
| harlowja | mordred cool, dns like thingy, interesting | 23:34 |
| dstanek | mordred: why is that? | 23:34 |
| mordred | dstanek: if we make a choice for zk or consul or whatever, we should, as openstack, make one choice - there is no benefit to pluggability here | 23:35 |
| mordred | other than making things harder | 23:35 |
| jamielennox | stevemar_: that's kind of a blow, how is marekd actually using it like this? | 23:35 |
| harlowja | mordred any idea the best python client for consul? i might just set that up in ubuntu or something and mess around | 23:35 |
| morgan | dstanek: what mordred said but aslo consider that we want things to work the same way across clouds. | 23:35 |
| mordred | harlowja: I do not | 23:35 |
| dstanek | mordred: maybe, but you could argue that we keep adding dependencies and making things harder anyway | 23:36 |
| harlowja | more pain | 23:36 |
| mordred | dstanek: right. I want to remove them and to remove choice | 23:36 |
| harlowja | to the pain! | 23:36 |
| morgan | dstanek: and the DLMs work differently in many cases | 23:36 |
| morgan | so the abstraction is a lot of overhead and potentially very limiting | 23:36 |
| mordred | what morgan said | 23:36 |
| morgan | we should play to the strengths of the choice made. | 23:36 |
| morgan | harlowja: the consul python lib is the best option | 23:36 |
| harlowja | cool | 23:36 |
| harlowja | the other interesting thing that's in my mind here is the other things that are getting sucked into openstack that aren't using consul, but are prefering zookeeper, this is the other part of the question imho | 23:37 |
| harlowja | (but idk of which projects are using consul that much) | 23:37 |
| *** mylu has quit IRC | 23:37 | |
| harlowja | http://docs-draft.openstack.org/61/209661/29/check/gate-openstack-specs-docs/2ff62fa//doc/build/html/specs/chronicles-of-a-dlm.html#proposed-change (some listed here) | 23:37 |
| *** mylu has joined #openstack-keystone | 23:38 | |
| harlowja | kafka i think requires zookeeper? same with mesos | 23:38 |
| harlowja | juju as well | 23:38 |
| harlowja | ^ just something to think about | 23:38 |
| dstanek | mordred: morgan: then i think rfc 6763 should be consider too | 23:38 |
| harlowja | i might be able to point u at some people that will say from experience 'please don't use DNS' for this :-/ | 23:39 |
| harlowja | if u want to hear some stories, haha | 23:39 |
| morgan | dstanek: consul provides that by default | 23:39 |
| dstanek | harlowja: really? seems like the natural thing | 23:39 |
| stevemar_ | jamielennox: create 2 plugins? | 23:39 |
| mordred | harlowja: and docker and coreos use etcd | 23:40 |
| morgan | dns is a fine tool for discovery - but I would argue that it should be used for discovering "consul" | 23:40 |
| mordred | harlowja: I would point those people at google | 23:40 |
| morgan | not for every service | 23:40 |
| jamielennox | stevemar_: i know we solved this problem in the ksa-saml2 repo, but there's no way i can use this from CLI | 23:40 |
| *** su_zhang has joined #openstack-keystone | 23:40 | |
| mordred | harlowja: who use dns for this | 23:40 |
| *** dims has joined #openstack-keystone | 23:40 | |
| morgan | serv records and the like are good for a known entry point | 23:40 |
| mordred | harlowja: at larger scale than anyone else | 23:40 |
| harlowja | they might already have left to google, lol | 23:40 |
| harlowja | haha | 23:40 |
| mordred | DNS is the most scalable system in the world | 23:40 |
| mordred | anybody who says don't use it | 23:40 |
| mordred | does not know how to ops | 23:40 |
| morgan | but i'd still use consul DNS even past the base level serv record | 23:41 |
| morgan | fwiw | 23:41 |
| harlowja | kk, i've just heard painful stories, lol | 23:41 |
| mordred | sure | 23:41 |
| morgan | probably people who have caching resolvers doing bad things | 23:41 |
| mordred | there are people who tell war stories about using DRBD too | 23:41 |
| harlowja | :) | 23:41 |
| mordred | but it turns out it's rock solid | 23:41 |
| morgan | like caching NXDOMAIN and the like | 23:41 |
| mordred | you just have to not to bad things | 23:42 |
| dstanek | harlowja: you could say the same about OpenStack :-( more painful stories than success stories | 23:42 |
| harlowja | lol | 23:42 |
| morgan | mordred: I still hate DRBD backing nfs read-only filesystems | 23:42 |
| mordred | morgan: sure. but that's because nfs is stupid | 23:42 |
| mordred | DRBD is an excellent active-passive failover block device | 23:42 |
| mordred | if you use it for anything else, you're in for pain | 23:42 |
| mordred | but if you use it as a hot/cold standby block device in a 2 node config | 23:42 |
| mordred | it's unbeatable | 23:43 |
| dstanek | mordred: the problem i am having with DNS is that my implementation does a lot of requests to the server; sure it's cacheable, but i feel like i'm doing something wrong | 23:43 |
| *** mylu has quit IRC | 23:43 | |
| morgan | mordred: 2 node with an arbitrator and proper STONITH | 23:43 |
| mordred | morgan: don't need an abitrator | 23:43 |
| morgan | mordred: but yeah | 23:43 |
| mordred | in 2 node drbd | 23:43 |
| mordred | you just need a crossover cable | 23:43 |
| morgan | mordred: i've had a lot of issues with split brain in heartbeat/drbd the arbitrator made a big difference | 23:43 |
| *** henrynash has quit IRC | 23:44 | |
| mordred | not with a crossover cable you haven't | 23:44 |
| mordred | you will have that pain if you use the switching fabric | 23:44 |
| mordred | but you would not use the switching fabric if you want success | 23:44 |
| morgan | yes, but that is because of endlessly faulty cables and bad DC folks. the arbitrator was something i could control :P | 23:44 |
| mordred | you wold use 2 bonded direct cat6 cables between interfaces | 23:44 |
| *** su_zhang has quit IRC | 23:44 | |
| morgan | i couldn't fire DC hands | 23:45 |
| mordred | well, then there is your first problem | 23:45 |
| mordred | and it's certainly not DRBD's fault | 23:45 |
| mordred | non-trusted people with access to power | 23:45 |
| mordred | will kill you every time | 23:45 |
| morgan | well, it was somewhat of drbd being hard to debug with an occasionally faulty cable and then being unable to diagnose that | 23:45 |
| morgan | because of bad dc "smart" hands | 23:45 |
| morgan | but that aside | 23:46 |
| morgan | i still don't like drbd | 23:46 |
| morgan | but i also usually need more than 2 nodes in the systems I design. wrong use-cases | 23:46 |
| morgan | drbd with > 2 nodes makes me worry. | 23:46 |
| *** zhenq has quit IRC | 23:47 | |
| mordred | yes | 23:47 |
| mordred | don't use it for that | 23:48 |
| mordred | it's very good at doing one simple task | 23:48 |
| mordred | and doing it in a rocksolid manner | 23:48 |
| mordred | if you try to do anything else | 23:48 |
| mordred | it will be very bad for you | 23:48 |
| morgan | i will admit drbd has gotten way better | 23:49 |
| morgan | it did have some rather nasty bugs a while ago | 23:49 |
| morgan | but if i discount it in every case, i'm no better than the guy who blocked using XFS (in favor of ext4 when ext4 was new) because of "data loss bugs in xfs" | 23:49 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/oslo.policy: Custom fixture to avoid external call in HttpCheck https://review.openstack.org/232725 | 23:50 |
| *** su_zhang has joined #openstack-keystone | 23:51 | |
| *** harlowja has quit IRC | 23:52 | |
| *** harlowja has joined #openstack-keystone | 23:52 | |
| morgan | dstanek: you're going to also need a paired txt record to show the URL base unless there is a JSON home like document at root / with srv records | 23:55 |
| morgan | dstanek: because endpoints may not be on / | 23:55 |
| morgan | miht be on say /compute | 23:55 |
| morgan | or /identity | 23:55 |
| morgan | dstanek: otherwise i don't think that setup is really wonky | 23:56 |
| dstanek | morgan: there's already txt records due to the rfc | 23:56 |
| morgan | ah i see it now | 23:56 |
| dstanek | hmmmm...can i add a file to a gist or do i have to have a second one? | 23:56 |
| morgan | you can add files iirc | 23:57 |
| *** EinstCrazy has joined #openstack-keystone | 23:57 | |
| dstanek | oh, i can clone...maybe that'll work | 23:57 |
| jamielennox | stevemar_, morgan: finally got passed the nasty cache review, next is https://review.openstack.org/#/c/212342/ and it's easy | 23:58 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!