| *** EinstCrazy has quit IRC | 00:02 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Return default value for pkg_version if missing https://review.openstack.org/222042 | 00:03 |
|---|---|---|
| *** henrynash has joined #openstack-keystone | 00:32 | |
| *** ChanServ sets mode: +v henrynash | 00:32 | |
| henrynash | stevemar: do you know how to debug gate-tempest-dsvm-keystone-eventlet-full (or even where to look at what the test actually does)? | 00:36 |
| henrynash | stevemar: I see my patch (which changes doc strings) continually fail on it….due to a timeout…looks at first glance to be a dubious check in the test for the length of time the test dhold run | 00:36 |
| stevemar | henrynash: i normally start with console.log to see what failed | 00:36 |
| henrynash | stevemar; yep, did that | 00:37 |
| stevemar | henrynash: the eventlet run has been super buggy lately | 00:37 |
| henrynash | stevemar: all tests pass, but then it seems to say the test had already timedout by the time t checks to see if it shodl have completed | 00:37 |
| henrynash | stevemar: example: http://logs.openstack.org/68/264068/6/check/gate-tempest-dsvm-keystone-eventlet-full/f575b16/console.html | 00:38 |
| stevemar | jamielennox: yeah, i think it just timed out... http://logs.openstack.org/68/264068/6/check/gate-tempest-dsvm-keystone-eventlet-full/947b46b/console.html#_2016-01-17_21_42_48_600 | 00:38 |
| stevemar | time when it ended ... 21:42:48.600 | 00:38 |
| stevemar | henrynash: job started -> 19:46:40.963 | 00:38 |
| stevemar | i guess theres a 2h limit | 00:39 |
| *** dims has joined #openstack-keystone | 00:39 | |
| henrynash | stevemar: II;ve rechecked 6 or 7 times….so thinking we may need to fix the test! | 00:39 |
| stevemar | henrynash: i don't think theres a specific single test that's causing it | 00:40 |
| stevemar | henrynash: i think tempest has a timeout condition, let me check | 00:40 |
| henrynash | stevemar: oh, you mean it may be a tempest thing….no test shlat run more than 2hrs... | 00:40 |
| stevemar | henrynash: https://github.com/openstack-infra/project-config/blob/a3dcb17a7cf70ca8478486c82ff819e74f1f148c/jenkins/jobs/devstack-gate.yaml#L1890-L1895 | 00:41 |
| stevemar | timeout 125 minutes | 00:41 |
| henrynash | stevemar: close…very close…. | 00:42 |
| henrynash | .stevemar: …adn actually, shold really have failed, since test ran for 115 mins | 00:42 |
| henrynash | shouldn’t really have.... | 00:43 |
| stevemar | i think that includes the setup too | 00:43 |
| stevemar | couldn't hurt to propose a change to bump it, i'll whip up a change 1 sec | 00:43 |
| stevemar | henrynash: i think someone has been adding tempest tests | 00:43 |
| *** shoutm has joined #openstack-keystone | 00:45 | |
| henrynash | ok | 00:45 |
| stevemar | henrynash: oh there's also this: https://github.com/openstack-infra/project-config/blob/a3dcb17a7cf70ca8478486c82ff819e74f1f148c/jenkins/jobs/devstack-gate.yaml#L1907 | 00:46 |
| henrynash | stevemar: not sure which wins… | 00:48 |
| stevemar | henrynash: https://review.openstack.org/#/c/268826/ | 00:54 |
| henrynash | stevemar: grt, +1 | 00:54 |
| *** dims has quit IRC | 01:01 | |
| *** EinstCrazy has joined #openstack-keystone | 01:19 | |
| *** shoutm_ has joined #openstack-keystone | 01:40 | |
| *** shoutm has quit IRC | 01:40 | |
| *** davechen has joined #openstack-keystone | 02:06 | |
| *** jamielennox is now known as jamielennox|away | 02:14 | |
| *** PsionTheory has quit IRC | 02:24 | |
| *** markvoelker_ has quit IRC | 02:26 | |
| *** shoutm_ has quit IRC | 02:36 | |
| *** gsilvis has quit IRC | 02:37 | |
| ayoung | can someone please +2A https://review.openstack.org/#/c/264260/22 ? stevemar jamielennox|away marekd ? | 02:38 |
| *** shoutm has joined #openstack-keystone | 02:39 | |
| *** dims has joined #openstack-keystone | 02:52 | |
| *** GB21 has joined #openstack-keystone | 03:21 | |
| *** EinstCrazy has quit IRC | 03:22 | |
| openstackgerrit | javeme proposed openstack/python-keystoneclient: Encode the url parameters for base.CrudManager https://review.openstack.org/254154 | 03:23 |
| *** EinstCrazy has joined #openstack-keystone | 03:23 | |
| *** EinstCrazy has quit IRC | 03:24 | |
| *** EinstCrazy has joined #openstack-keystone | 03:24 | |
| openstackgerrit | javeme proposed openstack/python-keystoneclient: Encode the url parameters for base.CrudManager https://review.openstack.org/254154 | 03:26 |
| *** links has joined #openstack-keystone | 03:26 | |
| *** GB21 has quit IRC | 03:27 | |
| *** EinstCra_ has joined #openstack-keystone | 03:29 | |
| *** EinstCrazy has quit IRC | 03:29 | |
| *** EinstCra_ has quit IRC | 03:30 | |
| *** EinstCrazy has joined #openstack-keystone | 03:30 | |
| *** EinstCrazy has quit IRC | 03:32 | |
| *** EinstCrazy has joined #openstack-keystone | 03:32 | |
| *** EinstCrazy has quit IRC | 03:34 | |
| *** EinstCrazy has joined #openstack-keystone | 03:35 | |
| *** EinstCrazy has quit IRC | 03:39 | |
| *** EinstCrazy has joined #openstack-keystone | 03:41 | |
| *** EinstCrazy has quit IRC | 03:43 | |
| *** EinstCrazy has joined #openstack-keystone | 03:43 | |
| *** EinstCrazy has quit IRC | 03:44 | |
| *** EinstCrazy has joined #openstack-keystone | 03:44 | |
| *** EinstCra_ has joined #openstack-keystone | 03:45 | |
| stevemar | ayoung: was gonna give that a nice long look first thing tomorrow | 03:46 |
| ayoung | stevemar, that will work | 03:46 |
| *** EinstCrazy has quit IRC | 03:48 | |
| *** nkinder has joined #openstack-keystone | 03:51 | |
| *** nkinder has quit IRC | 03:58 | |
| *** shoutm has quit IRC | 04:19 | |
| *** shoutm has joined #openstack-keystone | 04:21 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:23 | |
| *** EinstCra_ has quit IRC | 04:27 | |
| *** EinstCrazy has joined #openstack-keystone | 04:28 | |
| *** vivekd has joined #openstack-keystone | 04:29 | |
| *** oomichi has joined #openstack-keystone | 04:31 | |
| *** vivekd has quit IRC | 04:36 | |
| *** shoutm has quit IRC | 04:40 | |
| *** fawadkhaliq has quit IRC | 04:44 | |
| *** shoutm has joined #openstack-keystone | 04:45 | |
| *** oomichi has quit IRC | 04:50 | |
| *** lhcheng has joined #openstack-keystone | 04:50 | |
| *** ChanServ sets mode: +v lhcheng | 04:50 | |
| *** dims has quit IRC | 04:58 | |
| *** spandhe has joined #openstack-keystone | 05:07 | |
| *** lhcheng has quit IRC | 05:07 | |
| stevemar | henrynash: wanna give this a quite look over, it'll help mark a blueprint as completed :) https://review.openstack.org/#/c/259730/ | 05:08 |
| *** daemontool has quit IRC | 05:27 | |
| *** daemontool has joined #openstack-keystone | 05:27 | |
| *** henrynash has quit IRC | 05:30 | |
| *** lhcheng has joined #openstack-keystone | 05:30 | |
| *** ChanServ sets mode: +v lhcheng | 05:30 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove eventlet support https://review.openstack.org/249486 | 05:31 |
| *** daemontool has quit IRC | 05:33 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:34 | |
| *** lhcheng has quit IRC | 05:35 | |
| *** jaosorior has joined #openstack-keystone | 05:41 | |
| *** henrynash has joined #openstack-keystone | 05:49 | |
| *** ChanServ sets mode: +v henrynash | 05:49 | |
| *** shoutm_ has joined #openstack-keystone | 05:50 | |
| openstackgerrit | Merged openstack/keystone: Correct docstrings for federation driver interface https://review.openstack.org/264068 | 05:50 |
| *** jasonsb has joined #openstack-keystone | 05:50 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264346 | 05:51 |
| *** shoutm has quit IRC | 05:52 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: document the bootstrapping process https://review.openstack.org/259730 | 05:59 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Make sure the assignment creation use the right arguments https://review.openstack.org/268738 | 06:01 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Zanata https://review.openstack.org/268567 | 06:05 |
| *** spandhe has quit IRC | 06:14 | |
| *** Nirupama has joined #openstack-keystone | 06:32 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 06:37 |
| davechen | stevemar: thank you! | 06:38 |
| * davechen the gating make me sick! | 06:38 | |
| *** lhcheng has joined #openstack-keystone | 06:39 | |
| *** ChanServ sets mode: +v lhcheng | 06:39 | |
| *** jasonsb has quit IRC | 06:45 | |
| *** EinstCra_ has joined #openstack-keystone | 06:49 | |
| *** shoutm_ has quit IRC | 06:50 | |
| *** shoutm has joined #openstack-keystone | 06:52 | |
| *** EinstCrazy has quit IRC | 06:53 | |
| stevemar | davechen: yeah :( | 06:57 |
| stevemar | davechen: i'll work with the infra team tomorrow on what the issue is | 06:57 |
| stevemar | looks like it started on the 15th | 06:57 |
| *** chlong has quit IRC | 07:00 | |
| *** EinstCrazy has joined #openstack-keystone | 07:20 | |
| *** gildub has quit IRC | 07:20 | |
| davechen | stevemar: cool! hope infra team can release us from "recheck". :) | 07:21 |
| *** EinstCra_ has quit IRC | 07:24 | |
| *** e0ne has joined #openstack-keystone | 07:25 | |
| *** Nirupama has quit IRC | 07:25 | |
| *** rcernin has joined #openstack-keystone | 07:41 | |
| *** EinstCrazy has quit IRC | 07:48 | |
| *** daemontool has joined #openstack-keystone | 07:48 | |
| *** shoutm_ has joined #openstack-keystone | 07:48 | |
| *** shoutm has quit IRC | 07:51 | |
| *** EinstCrazy has joined #openstack-keystone | 07:52 | |
| *** Nirupama has joined #openstack-keystone | 07:52 | |
| *** henrynash has quit IRC | 07:57 | |
| *** daemontool has quit IRC | 07:58 | |
| *** Nirupama has quit IRC | 08:10 | |
| *** belmoreira has joined #openstack-keystone | 08:11 | |
| *** fawadkhaliq has quit IRC | 08:12 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:13 | |
| *** e0ne has quit IRC | 08:20 | |
| *** oomichi has joined #openstack-keystone | 08:23 | |
| *** Nirupama has joined #openstack-keystone | 08:29 | |
| *** jaosorior has quit IRC | 08:29 | |
| *** jaosorior has joined #openstack-keystone | 08:30 | |
| *** fhubik has joined #openstack-keystone | 08:35 | |
| *** gildub has joined #openstack-keystone | 08:36 | |
| *** jed56 has joined #openstack-keystone | 08:38 | |
| *** comstud has joined #openstack-keystone | 08:40 | |
| *** pnavarro has joined #openstack-keystone | 08:42 | |
| marekd | ayoung: i added it to my list. | 08:53 |
| *** fawadkhaliq has quit IRC | 09:01 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:01 | |
| *** daemontool has joined #openstack-keystone | 09:02 | |
| *** daemontool has quit IRC | 09:03 | |
| *** daemontool has joined #openstack-keystone | 09:03 | |
| *** daemontool_ has joined #openstack-keystone | 09:04 | |
| *** shoutm has joined #openstack-keystone | 09:05 | |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Unit test for checking cross-version migrations compatibility https://review.openstack.org/241603 | 09:06 |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Online schema migration documentation https://review.openstack.org/265252 | 09:06 |
| *** shoutm_ has quit IRC | 09:07 | |
| *** daemontool has quit IRC | 09:08 | |
| *** daemontool_ is now known as daemontool | 09:11 | |
| *** jistr has joined #openstack-keystone | 09:14 | |
| *** jaosorior has quit IRC | 09:17 | |
| *** jaosorior has joined #openstack-keystone | 09:18 | |
| *** aix has joined #openstack-keystone | 09:28 | |
| *** lhcheng has quit IRC | 09:38 | |
| *** fhubik is now known as fhubik_brb | 09:39 | |
| *** davechen has left #openstack-keystone | 09:54 | |
| *** fhubik_brb is now known as fhubik | 09:56 | |
| *** Nirupama has quit IRC | 10:07 | |
| *** e0ne has joined #openstack-keystone | 10:11 | |
| *** shoutm has quit IRC | 10:27 | |
| *** shoutm has joined #openstack-keystone | 10:31 | |
| *** bradjones has quit IRC | 10:38 | |
| *** bradjones has joined #openstack-keystone | 10:40 | |
| *** bradjones has quit IRC | 10:40 | |
| *** bradjones has joined #openstack-keystone | 10:40 | |
| *** gildub has quit IRC | 10:43 | |
| *** mhickey has joined #openstack-keystone | 10:45 | |
| *** dims has joined #openstack-keystone | 10:54 | |
| *** shoutm has quit IRC | 11:08 | |
| *** flaper87 has quit IRC | 11:11 | |
| *** flaper87 has joined #openstack-keystone | 11:11 | |
| *** Nirupama has joined #openstack-keystone | 11:24 | |
| *** lhcheng has joined #openstack-keystone | 11:26 | |
| *** ChanServ sets mode: +v lhcheng | 11:26 | |
| *** Nirupama has quit IRC | 11:27 | |
| *** Nirupama has joined #openstack-keystone | 11:27 | |
| *** lhcheng has quit IRC | 11:31 | |
| *** oomichi is now known as oomichi_away | 11:51 | |
| samueldmq | morning all | 11:56 |
| *** daemontool has quit IRC | 11:58 | |
| *** daemontool has joined #openstack-keystone | 11:59 | |
| *** daemontool_ has joined #openstack-keystone | 12:04 | |
| *** daemontool has quit IRC | 12:07 | |
| *** dims has quit IRC | 12:10 | |
| *** Nirupama has quit IRC | 12:11 | |
| samueldmq | I hit that issue with the eventlet job this weekend | 12:12 |
| samueldmq | stevemar: may tht mean our tests are slower ? or something else related to our code vs infra ? | 12:13 |
| *** fawadkhaliq has quit IRC | 12:13 | |
| *** raildo-afk is now known as raildo | 12:15 | |
| *** josecastroleon has joined #openstack-keystone | 12:15 | |
| *** daemontool_ has quit IRC | 12:24 | |
| *** daemontool_ has joined #openstack-keystone | 12:25 | |
| *** daemontool_ has quit IRC | 12:25 | |
| *** fhubik is now known as fhubik_brb | 12:25 | |
| *** fhubik_brb is now known as fhubik | 12:25 | |
| *** daemontool_ has joined #openstack-keystone | 12:25 | |
| *** bradjones has quit IRC | 12:30 | |
| *** daemontool_ has quit IRC | 12:31 | |
| *** gordc has joined #openstack-keystone | 12:33 | |
| *** fhubik is now known as fhubik_brb | 12:34 | |
| *** chlong has joined #openstack-keystone | 12:36 | |
| *** fawadkhaliq has joined #openstack-keystone | 12:40 | |
| *** pauloewerton has joined #openstack-keystone | 13:03 | |
| *** doug-fish has joined #openstack-keystone | 13:04 | |
| *** dims has joined #openstack-keystone | 13:11 | |
| *** edmondsw has joined #openstack-keystone | 13:12 | |
| *** rcernin has quit IRC | 13:19 | |
| *** iurygregory has joined #openstack-keystone | 13:19 | |
| *** daemontool has joined #openstack-keystone | 13:21 | |
| *** aix has quit IRC | 13:21 | |
| *** fhubik_brb is now known as fhubik | 13:23 | |
| *** links has quit IRC | 13:33 | |
| *** fawadkhaliq has quit IRC | 13:34 | |
| *** lhcheng has joined #openstack-keystone | 13:40 | |
| *** ChanServ sets mode: +v lhcheng | 13:40 | |
| *** lhcheng has quit IRC | 13:44 | |
| *** aix has joined #openstack-keystone | 13:47 | |
| *** edmondsw has quit IRC | 14:02 | |
| *** tjcocozz has joined #openstack-keystone | 14:07 | |
| lbragstad | tjcocozz o/ | 14:08 |
| lbragstad | tjcocozz mornin'! | 14:08 |
| tjcocozz | good morning lbragstad | 14:08 |
| lbragstad | tjcocozz sorry I didn't get to your ping last friday regarding https://review.openstack.org/#/c/267649/ | 14:08 |
| lbragstad | tjcocozz I had every intention to, but got tied up with a bunch of things | 14:08 |
| tjcocozz | lbragstad, it was small so its not a big deal. | 14:09 |
| lbragstad | tjcocozz still want to walk through that change - I want to make sure I've addressed your comments, too | 14:09 |
| tjcocozz | lbragstad, that would be awesome! | 14:09 |
| lbragstad | tjcocozz cool! | 14:10 |
| lbragstad | tjcocozz so right now - I guess the current bug is that https://github.com/openstack/keystone/blob/1baa32afd0b43887125e35cfba4597556fc187df/keystone/common/authorization.py#L98-L99 are set on every request, regardless of the request using oauth or not | 14:11 |
| lbragstad | so, auth_context['consumer_id'] will be None on every request | 14:12 |
| lbragstad | not sure how much you can do with that, but... | 14:12 |
| tjcocozz | lbragstad, but what about the method that it calls... it checks if it is scoped before it returns the consumer_id https://github.com/openstack/keystone/blob/d250e82462426f23e1833d6d77b70f998cbe1094/keystone/models/token_model.py#L271 | 14:13 |
| lbragstad | tjcocozz yeah - so it should return None, right? | 14:14 |
| lbragstad | https://github.com/openstack/keystone/blob/d250e82462426f23e1833d6d77b70f998cbe1094/keystone/models/token_model.py#L274 | 14:14 |
| tjcocozz | yes | 14:14 |
| tjcocozz | lbragstad, but it doesn't? | 14:14 |
| lbragstad | oh... | 14:15 |
| lbragstad | tjcocozz I think I know what you're saying | 14:15 |
| tjcocozz | lbragstad, sorry i'm not to good with my words :-) | 14:15 |
| lbragstad | tjcocozz technically - we don't need the else statement here - https://review.openstack.org/#/c/267649/4/keystone/common/authorization.py | 14:15 |
| lbragstad | tjcocozz right? | 14:16 |
| tjcocozz | lbragstad, thats what i am thinking exactly | 14:16 |
| lbragstad | tjcocozz ++ that makes sense | 14:16 |
| tjcocozz | lbragstad, but it is much more readable | 14:16 |
| lbragstad | tjcocozz because we would just be setting auth_context['consumer_id'] and auth_context['access_token_id'] to None, just like we do now | 14:17 |
| tjcocozz | lbragstad, yes sir. | 14:17 |
| lbragstad | tjcocozz so - we seem to do that with some of the other things in that method but I don't think it's 100% consistent | 14:18 |
| lbragstad | tjcocozz for example - we follow that pattern with the trust auth variables but not with the federated group ids. | 14:18 |
| tjcocozz | lbragstad, in token_model.py? | 14:18 |
| lbragstad | in authorization.py | 14:18 |
| lbragstad | the pattern being - if we are dealing with trust scope we set the trust variables, else we explicitly set them to None. | 14:20 |
| tjcocozz | yeah, in this block of code none of the methods return none. https://github.com/openstack/keystone/blob/68b7c6c098bcec7635d3c17b7908643aad0bb638/keystone/common/authorization.py#L82-L90 I think you should keep what your doing just so it is easier to understand the code. Otherwise at mimimum a comment should be added. | 14:23 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 14:25 |
| tjcocozz | lbragstad, do you think the commit message should be updated? | 14:28 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 14:29 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Fix indentation for oauth context https://review.openstack.org/267649 | 14:29 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet work with oauth1 authentication https://review.openstack.org/267781 | 14:29 |
| lbragstad | tjcocozz does that work? ^ | 14:29 |
| tjcocozz | lbragstad, works for me. | 14:29 |
| lbragstad | tjcocozz awesome - thanks! | 14:29 |
| tjcocozz | lbragstad, :-) | 14:31 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Extract token backend tests https://review.openstack.org/269111 | 14:32 |
| *** daemontool has quit IRC | 14:35 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 14:36 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet work with oauth1 authentication https://review.openstack.org/267781 | 14:36 |
| *** fawadkhaliq has joined #openstack-keystone | 14:38 | |
| *** daemontool has joined #openstack-keystone | 14:41 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Extract trust backend tests https://review.openstack.org/269115 | 14:41 |
| *** petertr7_away is now known as petertr7 | 14:44 | |
| dstanek | anyone know why we seem to be having a hard time getting things through the gate? | 14:50 |
| dstanek | breton: are you still wanting to push forward on https://review.openstack.org/#/c/167594/ ? | 14:51 |
| samueldmq | dstanek: eventlet gate failing ? | 14:51 |
| samueldmq | dstanek: https://review.openstack.org/#/c/268826/ | 14:52 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Extract trust backend tests https://review.openstack.org/269115 | 14:52 |
| dstanek | samueldmq: i'd have to look and see which one it is | 14:52 |
| *** superdan is now known as dansmith | 14:54 | |
| samueldmq | dstanek: afaik most of the known failures are related to this, see stevemar's patch above | 14:54 |
| dstanek | samueldmq: has anyone figured out why yet? | 14:54 |
| dstanek | that and i'm still getting 503s periodically | 14:55 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:55 | |
| samueldmq | dstanek: well, stevemar's patch proposes to bump timeout for the gate | 14:55 |
| dstanek | so we probably need to figure out the root cause :-( | 14:56 |
| samueldmq | dstanek: but AJaeger left a comment there ... | 14:56 |
| samueldmq | dstanek: exactly, rather than just bumping and forgetting it for a bit | 14:56 |
| samueldmq | dstanek: I agree with you, and I am also getting 503s from times to times | 14:56 |
| tjcocozz | samueldmq, dstanek the 503's are annoying and they seem random too. | 14:58 |
| *** lhcheng has joined #openstack-keystone | 14:58 | |
| *** ChanServ sets mode: +v lhcheng | 14:58 | |
| *** fhubik is now known as fhubik_brb | 14:59 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Extract catalog backend tests https://review.openstack.org/269125 | 15:03 |
| *** fhubik_brb is now known as fhubik | 15:12 | |
| samueldmq | tjcocozz: dstanek: yeah I guess it's related to a server (behind proxy?) having issues (eg hitting 100% cpu) | 15:16 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Extract policy backend tests https://review.openstack.org/269133 | 15:16 |
| *** timcline has joined #openstack-keystone | 15:18 | |
| tjcocozz | samueldmq, we need to throw more computers at it! lol | 15:20 |
| dstanek | samueldmq: it looks like the slowness may be just a few tests that are super slow | 15:26 |
| *** med_ has quit IRC | 15:28 | |
| samueldmq | dstanek: yes I agree that may be the root cause, are investigating that ? | 15:28 |
| samueldmq | tjcocozz: haha yes, and remove the failing ones :) | 15:29 |
| dstanek | samueldmq: yep, llooking for what is slow | 15:29 |
| samueldmq | dstanek: nice, let me know if you need a hand | 15:30 |
| samueldmq | dstanek: running the tests and listing their time should make it easy to identify who's takin a day to run :) | 15:30 |
| samueldmq | dstanek: but it can be tempest tests vs our own suite | 15:30 |
| *** petertr7 is now known as petertr7_away | 15:31 | |
| *** chlong has quit IRC | 15:31 | |
| dstanek | samueldmq: none of these tests are ours. it's all tempest | 15:31 |
| dstanek | samueldmq: running all of the tests would be too slow :-) | 15:32 |
| samueldmq | dstanek: harder to debug then | 15:32 |
| samueldmq | dstanek: yep | 15:32 |
| *** gsilvis has joined #openstack-keystone | 15:32 | |
| samueldmq | dstanek: btw I have something to sync with you regarding reorganizing test_backend.py | 15:33 |
| *** petertr7_away is now known as petertr7 | 15:33 | |
| samueldmq | dstanek: I've discussed with henrynash and I am uploading patches accordingly | 15:33 |
| samueldmq | dstanek: whenever you have some time | 15:33 |
| dstanek | samueldmq: sure what's up? | 15:33 |
| samueldmq | dstanek: basically splitting test_backend.py, which is too big | 15:34 |
| samueldmq | dstanek: tests should go into their own backend, eg assignment tests will go to unit/backend/assignment/core.py | 15:34 |
| samueldmq | dstanek: and so on | 15:34 |
| samueldmq | dstanek: like https://review.openstack.org/#/c/268307/ | 15:35 |
| dstanek | samueldmq: i agree - i am in the process of doing that to catalog tests https://review.openstack.org/#/c/267297/ | 15:35 |
| dstanek | adding real tests to get coverage over the backends | 15:35 |
| lbragstad | dstanek you didn't have a patch for this did you - https://review.openstack.org/#/c/215715/ ? | 15:36 |
| *** ninag has joined #openstack-keystone | 15:36 | |
| lbragstad | dstanek I meant to follow up with you on that one | 15:36 |
| samueldmq | dstanek: I have one just moving code around, yours is doing more than that right? | 15:36 |
| samueldmq | dstanek: you think yours could be rebased on https://review.openstack.org/#/c/269125/ ? | 15:37 |
| samueldmq | and I am glad you agree too :) | 15:37 |
| dstanek | samueldmq: no, not yet - in my working copy i have almost fixed the tests to run against sql and templated catalogs | 15:37 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Remove keyring as a test-requiremnet https://review.openstack.org/269146 | 15:37 |
| dstanek | lbragstad: i never had the time to actually finish :-( | 15:37 |
| lbragstad | dstanek no worries! i just didn't want to lose track of it | 15:37 |
| samueldmq | dstanek: nice, after moving the backend tests into their own backend dires | 15:38 |
| dstanek | lbragstad: it's on my trello board. although it seems that there is so much stuff in progress that trello is almost irrelevant now | 15:38 |
| dstanek | lbragstad: also we are down to about 260 bugs on keystone server! | 15:38 |
| lbragstad | dstanek ++ | 15:39 |
| samueldmq | dstanek: the idea is to remove test_backend_sql.py in favor of, let's say, backend/identity/test_sql.py and backend/assignment/test_sql.py and so on | 15:39 |
| dstanek | samueldmq: checkout my patch. i don't think that is the right thing to do | 15:39 |
| lbragstad | dstanek that's surprising because jorge_munoz and I opened a bunch last week ;) | 15:39 |
| *** nkinder has joined #openstack-keystone | 15:39 | |
| *** phalmos has joined #openstack-keystone | 15:40 | |
| dstanek | lbragstad: we've been kicking a** on Friday's (and lots in between :) | 15:41 |
| samueldmq | dstanek: I see, the difference is that we propose to put your BaseTests in backend/catalog/core.py and each backend into their own files (test_sql, test_ldap) | 15:41 |
| * notmorgan wishes templated catalogs could die | 15:41 | |
| samueldmq | dstanek: vs everything inside a test_backends.py file together | 15:42 |
| notmorgan | =/ | 15:42 |
| samueldmq | dstanek: is that really different ? :) | 15:42 |
| notmorgan | we should just deprecate templated catalog. | 15:42 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Extract identity backend tests https://review.openstack.org/269148 | 15:42 |
| dstanek | samueldmq: no. i'd rather see just test_backends.py for each subsystem | 15:42 |
| lbragstad | dstanek hoping that it's been closing irrelevant/invalid bugs earlier too | 15:42 |
| dstanek | samueldmq: as much as possible i want to make a class (or classes) that hold test cases. then have classes that subclass that and provide backend specific setup | 15:44 |
| dstanek | samueldmq: of course, skipping tests that can't be implemented | 15:44 |
| samueldmq | dstanek: that's the same in the other proposal | 15:45 |
| samueldmq | dstanek: it's just a matter of where we put the common tests | 15:45 |
| samueldmq | dstanek: and where we put the subclasses (for sql, ldap, ..) | 15:45 |
| dstanek | samueldmq: i'm saying i'd rather now explode the number of files if we don't need to | 15:45 |
| dstanek | s/now/not/ | 15:46 |
| samueldmq | dstanek: makes sense too, and yours is closer to how we organize the code itself | 15:46 |
| dstanek | it's like going from one extreme (very few huge files) to the other (tons of tiny ones) - i'd rather take baby steps | 15:47 |
| samueldmq | dstanek: let's discuss that with henrynash when he's back, so that we will all be in the same page | 15:47 |
| dstanek | samueldmq: my latest is a little different. i have spit the catalog tests into two classes in a core.py | 15:47 |
| samueldmq | dstanek: yes, but we all agree we should split them based on the module (assignments, identity, etc) | 15:47 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied roles driver and manager https://review.openstack.org/264260 | 15:48 |
| *** lhcheng has quit IRC | 15:48 | |
| dstanek | samueldmq: not necessarily module, but along subsystem boundries | 15:48 |
| samueldmq | dstanek: assignment, catalog, endpoint_policy, federation, oauth1, trust, auth, identity, resource, credential, policy, revoke, token | 15:49 |
| samueldmq | dstanek: if those are sybsystem boundries, we're talking the same :) | 15:49 |
| dstanek | samueldmq: yep. i just want to make sure we are using more precise language to reduce ambiguity | 15:50 |
| *** pgbridge has quit IRC | 15:50 | |
| samueldmq | dstanek: good, what's your definiton of module/submodule ? something standalone ? | 15:51 |
| dstanek | samueldmq: it's not my definition. in Python a .py file is a module | 15:52 |
| samueldmq | dstanek: so assignment or identity can't be a module, now I understand your point | 15:53 |
| openstackgerrit | werner mendizabal proposed openstack/keystone-specs: Time-based One-time Password https://review.openstack.org/130376 | 15:53 |
| * samueldmq 's hungry, brb after lunch | 15:53 | |
| dstanek | samueldmq: you could saying they are a package since a package in Python is basically a directory with an __init__.py | 15:53 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 15:53 |
| dstanek | samueldmq: but i think subsystem is more architecturally accurate | 15:54 |
| *** josecastroleon has quit IRC | 15:58 | |
| *** josecastroleon has joined #openstack-keystone | 15:59 | |
| *** links has joined #openstack-keystone | 16:00 | |
| *** diazjf has joined #openstack-keystone | 16:09 | |
| *** petertr7 is now known as petertr7_away | 16:10 | |
| *** vivekd has joined #openstack-keystone | 16:12 | |
| *** edmondsw has joined #openstack-keystone | 16:16 | |
| *** slberger has joined #openstack-keystone | 16:20 | |
| *** belmoreira has quit IRC | 16:22 | |
| *** links has quit IRC | 16:23 | |
| *** woodster_ has joined #openstack-keystone | 16:27 | |
| *** tonytan4ever has joined #openstack-keystone | 16:27 | |
| *** josecastroleon has quit IRC | 16:29 | |
| *** josecastroleon has joined #openstack-keystone | 16:30 | |
| *** jaosorior has quit IRC | 16:34 | |
| *** jaosorior has joined #openstack-keystone | 16:35 | |
| *** med_ has joined #openstack-keystone | 16:37 | |
| *** med_ is now known as Guest51217 | 16:37 | |
| *** amakarov has joined #openstack-keystone | 16:39 | |
| *** henrynash has joined #openstack-keystone | 16:42 | |
| *** ChanServ sets mode: +v henrynash | 16:42 | |
| *** peter-hamilton has joined #openstack-keystone | 16:44 | |
| *** jaosorior has quit IRC | 16:46 | |
| *** jaosorior has joined #openstack-keystone | 16:47 | |
| bknudson_ | notmorgan: I thought you'd like templated catalog since it's static. | 16:47 |
| notmorgan | bknudson_: difference between static on disk and changing based on auth context | 16:48 |
| *** _cjones_ has joined #openstack-keystone | 16:48 | |
| notmorgan | bknudson_: the templated catalog wouldn't be bad except that it requires a lot of overhead to add/remove/change endpoints at an administration level. [i would prefer things be CMS in this regard, but that is a battle i can't win] | 16:48 |
| -openstackstatus- NOTICE: Gerrit is restarting quickly as a workaround for performance degradation | 16:49 | |
| bknudson_ | let's change the backend to just store a json blob | 16:49 |
| *** narengan has joined #openstack-keystone | 16:49 | |
| notmorgan | well if that is the case we should also use pgsql, cause it has a json storage type that is better than our hacky one | 16:50 |
| *** pgbridge has joined #openstack-keystone | 16:50 | |
| notmorgan | bknudson_: or we could use mongo db, i head document storage and nosql is all the rage | 16:50 |
| notmorgan | s/head/hear | 16:50 |
| bknudson_ | nice. webscale. | 16:50 |
| breton | dstanek: since we're going to have fernet by default, no. | 16:54 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: SQLAlchemy column type for materialized path https://review.openstack.org/251445 | 16:54 |
| breton | memcache for tokens worked not so bad btw. | 16:55 |
| notmorgan | breton: memcache backend? | 16:57 |
| notmorgan | ugh | 16:57 |
| notmorgan | nooooooo | 16:57 |
| notmorgan | never use that | 16:57 |
| breton | memcache_pool | 16:57 |
| notmorgan | never use that | 16:57 |
| notmorgan | :P | 16:57 |
| breton | nope, it was good before fernet | 16:57 |
| notmorgan | never use memcache as a stable storage | 16:57 |
| notmorgan | ever | 16:57 |
| notmorgan | it was a bad idea in grizzly | 16:57 |
| notmorgan | it was a bad idea in folsom | 16:58 |
| notmorgan | it continues to be a bad idea in mitaka | 16:58 |
| notmorgan | it was never a good choice | 16:58 |
| notmorgan | using memcache for stable storage is a terrible idea. memcache_pool did not make it a less terrible idea | 16:58 |
| breton | nothing else worked on 100 requests per second, and people wanted it. | 16:58 |
| breton | why are tokens a stable storage? | 16:59 |
| notmorgan | because they are needed to be referenced by keystone | 16:59 |
| notmorgan | they are not really ephemeral until fernet | 16:59 |
| notmorgan | and i would say that anyone using memcache is asking for their openstack to fall over in weird ways | 17:00 |
| *** josecastroleon has quit IRC | 17:00 | |
| notmorgan | it always caused a ton of issues, sue 100 requests per second... until you issued too many tokens, then you never could auth until tokens expired | 17:00 |
| breton | what's too many tokens? | 17:01 |
| notmorgan | memcache is the worst token backend to use [that is even remotely production possible]. and people "wanting" it means they didn't understand the issues with it / ran at a small enough scale that it didn't matter | 17:01 |
| notmorgan | breton: about 1000 active tokens for a user. | 17:01 |
| *** josecastroleon has joined #openstack-keystone | 17:01 | |
| notmorgan | depending on token size | 17:01 |
| notmorgan | could be more if they used pki | 17:01 |
| notmorgan | erm less | 17:01 |
| notmorgan | a lot less | 17:01 |
| breton | what's the problem with having 1000 active tokens for a user? | 17:02 |
| breton | in memcache | 17:02 |
| notmorgan | you exceed the slab size | 17:02 |
| notmorgan | for a given key | 17:02 |
| notmorgan | you can't issue any more tokens until you prune the data in the slab/dump it | 17:02 |
| notmorgan | memcache is not meant to hold giant objects | 17:02 |
| notmorgan | we have to track all the tokens for a given user, so we need an active list of all tokens | 17:03 |
| notmorgan | this all comes down to token revocation hell. | 17:03 |
| notmorgan | because if a user wants to change password we need to know all the tokens to revoke [even if we don't put them in the revocation list] | 17:04 |
| notmorgan | we have to lookup the list of tokens to delete from memcache, or you never remove a token unless it expires | 17:04 |
| notmorgan | or worse.. LRUs out | 17:04 |
| notmorgan | if it LRUs out before expiry, you now have actions that should succeed fail because the backend dumped data randomly | 17:05 |
| notmorgan | memcache is not stable storage, tokens need to be in stable storage unless fernet is used | 17:05 |
| *** sweetJeebus has joined #openstack-keystone | 17:05 | |
| *** dims_ has joined #openstack-keystone | 17:05 | |
| *** vivekd has quit IRC | 17:08 | |
| *** dims has quit IRC | 17:08 | |
| *** hockeynut_afk has joined #openstack-keystone | 17:10 | |
| *** mhickey has quit IRC | 17:11 | |
| *** fhubik is now known as fhubik_brb | 17:13 | |
| *** fhubik_brb is now known as fhubik | 17:14 | |
| *** timcline has quit IRC | 17:14 | |
| *** fhubik has quit IRC | 17:14 | |
| *** timcline has joined #openstack-keystone | 17:15 | |
| sweetJeebus | Hi. @dolphm, do you have a couple of minutes for a quick chat? | 17:15 |
| sweetJeebus | Or perhaps anyone else who knows a lot about the future direction of keystone? | 17:16 |
| stevemar | sweetJeebus: i'm sure any number of us could answer, whats up | 17:18 |
| sweetJeebus | Thanks! | 17:18 |
| *** e0ne has quit IRC | 17:19 | |
| sweetJeebus | We're looking at the project we've been taking on in which I'm trying to get v3 Identity API running alongside a mixed environment of icehouse and kilo | 17:19 |
| sweetJeebus | and liberty | 17:19 |
| sweetJeebus | and we're wondering if its even worth it. | 17:19 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: SQLAlchemy column type for materialized path https://review.openstack.org/251445 | 17:19 |
| *** timcline has quit IRC | 17:19 | |
| sweetJeebus | We're talking about getting everything updated to kilo and beyond first, then coming back to this | 17:20 |
| sweetJeebus | but after a long winded conversation, I need to know one thing in particular | 17:20 |
| stevemar | dolphm: dstanek ayoung henrynash marekd jamielennox|away breton look for that nasty eventlet job to be made non-voting, change is being merged now | 17:20 |
| sweetJeebus | how long is v2 expected to be supported? Is there a plan to deprecate it anytime? | 17:20 |
| notmorgan | stevemar: dolphm dstanek breton bknudson_ henrynash marekd jamielennox|away i still vote remove eventlet job | 17:20 |
| notmorgan | sweetJeebus: as soon as we can. | 17:21 |
| raildo | sweetJeebus: https://review.openstack.org/#/c/251530/ | 17:21 |
| notmorgan | sweetJeebus: ideally mitaka | 17:21 |
| stevemar | sweetJeebus: the plan is still deprecate v2.0 APIs in M | 17:21 |
| notmorgan | sweetJeebus: we are very close to having everything happily running v3 all the time | 17:21 |
| bknudson_ | notmorgan: do you think we should have a uwsgi job? | 17:21 |
| sweetJeebus | ha. That was precise. | 17:21 |
| sweetJeebus | Thanks :) | 17:21 |
| stevemar | sweetJeebus: the CRUD APIs will be around for another 4 releases, things like user create, project delete, those things | 17:21 |
| notmorgan | bknudson_: i think we can probably do a uwsgi/suburl job for everything | 17:21 |
| bknudson_ | notmorgan: I'm working on devstack change and gave for a uwsgi job. | 17:21 |
| bknudson_ | gave -> gate | 17:22 |
| notmorgan | bknudson_: not just keystone. | 17:22 |
| stevemar | sweetJeebus: the auth APIs, like POST /tokens, we will keep around for a loooong time | 17:22 |
| notmorgan | bknudson_: but we should do a uwsgi job imo. | 17:22 |
| sweetJeebus | @stevemar: thanks. I'm going to go suggest we get everything upgraded and then flip to v3 | 17:22 |
| stevemar | sweetJeebus: ++ | 17:22 |
| sweetJeebus | I was already thinking to do that | 17:22 |
| bknudson_ | notmorgan: I'd like to see that too but baby steps | 17:22 |
| stevemar | sweetJeebus: glad we could give you a precise answer | 17:23 |
| notmorgan | bknudson_: yeah so, lets plan a uwsgi job for keystone/horizon[maybe swift since it is also apache/mod_wsgi supported] | 17:23 |
| sweetJeebus | @stevemar: me too. Thanks | 17:23 |
| notmorgan | bknudson_: lets ask the swift folks on that. and then we can look at spinning sub-url on top of that work | 17:23 |
| notmorgan | but def. keystone/horizon in uwsgi | 17:23 |
| *** vivekd has joined #openstack-keystone | 17:27 | |
| *** itlinux has joined #openstack-keystone | 17:27 | |
| *** daemontool has quit IRC | 17:30 | |
| *** josecastroleon has quit IRC | 17:31 | |
| *** daemontool has joined #openstack-keystone | 17:31 | |
| *** josecastroleon has joined #openstack-keystone | 17:32 | |
| *** petertr7_away is now known as petertr7 | 17:33 | |
| *** itlinux has quit IRC | 17:35 | |
| *** BrAsS_mOnKeY is now known as g2` | 17:36 | |
| *** daemontool has quit IRC | 17:38 | |
| *** daemontool has joined #openstack-keystone | 17:39 | |
| *** tonytan4ever has quit IRC | 17:40 | |
| *** avarner__ has joined #openstack-keystone | 17:47 | |
| *** avarner__ is now known as avarner | 17:47 | |
| avarner | Does anyone know how to find a project's parent id, from the command line? | 17:48 |
| notmorgan | avarner: if it is anywhere it's in openstack client | 17:50 |
| notmorgan | keystoneclient cli does not work with v3 | 17:50 |
| notmorgan | but not sure where in openstackclient that is | 17:50 |
| raildo | avarner: if you are using openstack client if v3 enabled, you just need do a 'openstack project get' | 17:50 |
| *** sweetJeebus has quit IRC | 17:51 | |
| avarner | raildo, thanks, that must mean I don't have v3 enabled | 17:51 |
| avarner | Do you know how to enable it? | 17:51 |
| avarner | I just ran the devstack last week, so it should have recent versions of software. | 17:51 |
| dstanek | breton: i still don't mind deprecating it and the pool in favor of anything else :-) | 17:51 |
| notmorgan | dstanek: fernet! | 17:51 |
| notmorgan | :) | 17:52 |
| dstanek | notmorgan: ++ | 17:52 |
| raildo | avarner: you must need set the auth url for v3, for example: 'export OS_AUTH_URL=http://keystone:5000/v3' and the identity api version 'export OS_IDENTITY_API_VERSION=3' | 17:53 |
| raildo | avarner: there is other ways to do that... there is a great post blog for ayoung explaining it: http://adam.younglogic.com/2013/09/keystone-v3-api-examples/ | 17:54 |
| ayoung | raildo, that works, but the common CLI should work | 17:55 |
| ayoung | and is easier | 17:55 |
| raildo | ayoung: sure | 17:56 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enhance manager list_role_assignments to support group listing https://review.openstack.org/265650 | 17:57 |
| *** petertr7 is now known as petertr7_away | 17:58 | |
| samueldmq | henrynash: hi | 17:58 |
| henrynash | samueldmq: hi | 17:58 |
| *** jaosorior has quit IRC | 17:59 | |
| dstanek | ayoung: oldy-but-goody https://bugs.launchpad.net/keystone/+bug/1268751 :-) | 17:59 |
| openstack | Launchpad bug 1268751 in OpenStack Identity (keystone) "Potential token revocation abuse via group membership" [High,Triaged] - Assigned to Lance Bragstad (lbragstad) | 17:59 |
| avarner | raildo, I set the environmental variables, and `openstack project list` works (but doesn't give parent id's) | 17:59 |
| avarner | But when I do 'openstack project get`, it says: openstack: 'project' is not an openstack command. See 'openstack --help'. | 17:59 |
| ayoung | dstanek, if we change over to revocation events, I think that one is closed implicitly | 18:00 |
| ayoung | dstanek, so...depends on Fernet being default, and the work to have uuid and fernet use the same code base and all that....let's target it for this release, and see if we can make it happen | 18:00 |
| ayoung | dstanek, bascially what I said in https://bugs.launchpad.net/keystone/+bug/1268751/comments/28 | 18:01 |
| openstack | Launchpad bug 1268751 in OpenStack Identity (keystone) "Potential token revocation abuse via group membership" [High,Triaged] - Assigned to Lance Bragstad (lbragstad) | 18:01 |
| samueldmq | henrynash: so, I was talking to dstanek earlier today about spliting test_backend.py | 18:02 |
| *** josecastroleon has quit IRC | 18:02 | |
| henrynash | samueldmqL ok.... | 18:02 |
| samueldmq | henrynash: he has a different proposal, le me get a link | 18:02 |
| *** itlinux has joined #openstack-keystone | 18:02 | |
| henrynash | samueldmq: had a feeling he might! | 18:02 |
| *** josecastroleon has joined #openstack-keystone | 18:03 | |
| samueldmq | henrynash: hehe https://review.openstack.org/#/c/267297/ | 18:03 |
| samueldmq | henrynash: basically we create a {subsystem} dir inside unit, and then create a test_backends.py to hold the test code | 18:03 |
| raildo | avarner: ops, sorry. try 'openstack project show <project_id>' | 18:04 |
| samueldmq | henrynash: vs backend/{subsystem}/[core.py, test_sql, ..] | 18:04 |
| samueldmq | henrynash: which makes sense to me too | 18:04 |
| avarner | raildo, thanks! working now | 18:04 |
| raildo | avarner: nice :) | 18:05 |
| dstanek | henrynash: not much different. just want to limit the explosion of files until we need it | 18:05 |
| avarner | create works also, i can make child projects | 18:05 |
| henrynash | samueldmq: so I’m ok with that approach too…..although do we need a test_backend_sql as well? | 18:05 |
| henrynash | samueldmq: always thouse “test_backend” was a duplicative use of the word test….since we don’t actualluy run teh tests directly in it and it’s already in a test hierarchy! | 18:06 |
| samueldmq | henrynash: we'd put Base(), SQLTests(Base) and LDAPTests(Base) inside the same test_backend file | 18:06 |
| *** fawadkhaliq has quit IRC | 18:06 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Mark memcache and memcache_pool token deprecated https://review.openstack.org/269229 | 18:06 |
| samueldmq | henrynash: I meant test_backends.py; them all together | 18:07 |
| samueldmq | henrynash: since test_backend_sql and test_backend_ldap would be too small files | 18:07 |
| henrynash | samueldmq: ok, I guess that workds…thinking….. | 18:07 |
| samueldmq | henrynash: just inheriting from Base and overriding the dirver | 18:07 |
| notmorgan | dstanek: ^ | 18:08 |
| *** tyagiprince has joined #openstack-keystone | 18:08 | |
| henrynash | sameuldmq: actually, need to drop off for a while…but bascially I trust dstanek’s ideas for tests probably more than my own ;-) | 18:08 |
| samueldmq | dstanek: yes, I agree with you in avoiding the explosion of files | 18:08 |
| samueldmq | henrynash: nice sir, I also like his proposal, thanks | 18:09 |
| *** fawadkhaliq has joined #openstack-keystone | 18:10 | |
| dstanek | notmorgan: no plans on removing? | 18:10 |
| dstanek | henrynash: samueldmq: let's get this done! | 18:10 |
| tyagiprince | Hii.. can someone tell me which python module is there in keystone code for routing purpose? Is it webob? | 18:10 |
| *** fawadkhaliq has quit IRC | 18:11 | |
| notmorgan | dstanek: i can't say we can remove it until we have plans to remove uuid tokens too | 18:11 |
| *** lhcheng has joined #openstack-keystone | 18:11 | |
| *** ChanServ sets mode: +v lhcheng | 18:11 | |
| notmorgan | dstanek: people, sadly, want to use it and we shouldn't take their toys away as much as i don't want anyone using it | 18:11 |
| dstanek | tyagiprince: there are many routers.py files that hold our routes. webob is just for request/response objects | 18:11 |
| samueldmq | dstanek: nice, my plans are to do this as a 2-step process | 18:12 |
| samueldmq | dstanek: 1) split test_backend.py into {subsystem}/test_backends.py, putting only the base test classes for now | 18:12 |
| samueldmq | dstanek: 2) move test_backend_[sql|ldap|...].py into {subsystem}/test_backends.py | 18:13 |
| dstanek | samueldmq: be careful to only put backend tests in test_backends.py; so nothing that does web requests | 18:14 |
| dstanek | i want that stuff split out into test_v3_api.py and test_v2_api.py | 18:14 |
| samueldmq | dstanek: yes, only backend tests | 18:14 |
| samueldmq | dstanek: I guess all webrequests-based tests are in test_v3* | 18:15 |
| samueldmq | dstanek: and yes, need to be looked separately; btw most of them may be used as functional tests, right ? | 18:15 |
| *** timcline has joined #openstack-keystone | 18:15 | |
| dstanek | samueldmq: maybe used as functional tests - not entirely sure | 18:17 |
| *** jistr has quit IRC | 18:17 | |
| * stevemar is finish with lunch and ready for more keystone! | 18:17 | |
| *** timcline has quit IRC | 18:18 | |
| *** timcline_ has joined #openstack-keystone | 18:18 | |
| stevemar | notmorgan: remove memcache pool in 0? | 18:18 |
| dstanek | notmorgan: in this case their toys are fundamentally broken | 18:18 |
| notmorgan | dstanek: i'm happy to do a remove in +2 | 18:19 |
| notmorgan | just figured i'd start conservative | 18:19 |
| notmorgan | stevemar: ^ see my comment to dstanek as to why | 18:19 |
| stevemar | notmorgan: hmm, okay | 18:19 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Mark memcache and memcache_pool token deprecated https://review.openstack.org/269229 | 18:22 |
| stevemar | dstanek: i changed up https://review.openstack.org/#/c/269229/2 you can rubber stamp it now | 18:22 |
| dstanek | stevemar: notmorgan: stamped | 18:23 |
| *** david-lyle has quit IRC | 18:23 | |
| stevemar | notmorgan: dstanek oh actually... are there any config options that are specific to memcache and memcache_pool for tokens? | 18:23 |
| tyagiprince | dstanek: I see many files in common directory. and there is router.py file which is being imported to other routers.py files. | 18:24 |
| tyagiprince | dstanek: Is there any documentation which shows me a path to understanding the keystone code? | 18:26 |
| *** timcline_ has quit IRC | 18:27 | |
| dstanek | tyagiprince: not really. wsgi.py is basically the starting point for the web requests. the routers.py file have the actually URL -> code mapping | 18:28 |
| *** timcline has joined #openstack-keystone | 18:30 | |
| stevemar | lbragstad: dolphm got a minute to talk about shadow users? | 18:31 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Make sure the assignment creation use the right arguments https://review.openstack.org/268738 | 18:32 |
| *** henrynash has quit IRC | 18:32 | |
| stevemar | notmorgan: dstanek wanna help finish the bootstrapping spec? https://review.openstack.org/#/c/268738/3 and https://review.openstack.org/#/c/259730/ should be gating and i can mark it done | 18:32 |
| *** josecastroleon has quit IRC | 18:32 | |
| dstanek | stevemar: sure. popping some lunch in the over, but i'll get on it after | 18:33 |
| stevemar | dstanek: cool | 18:33 |
| *** josecastroleon has joined #openstack-keystone | 18:33 | |
| notmorgan | dstanek, stevemar we can adjust that down the road once fernet is the default | 18:35 |
| lbragstad | stevemar I can try - but rderose is probably the guy you need | 18:35 |
| stevemar | lbragstad: but he ain't online :O | 18:35 |
| lbragstad | stevemar yeah I just noticed that | 18:35 |
| stevemar | lbragstad: even if https://review.openstack.org/#/c/262045 lands, there's still more work right? | 18:36 |
| stevemar | lbragstad: like making sure the controller create entries in the identity table, and so forth | 18:36 |
| notmorgan | hm | 18:37 |
| lbragstad | stevemar yes, I believe so | 18:37 |
| notmorgan | stevemar: i am ok with that fix to bootstrap, though we probably should invert the logic for user/project get and do a .get_by_name first and then try and create after? /shrug | 18:37 |
| *** lhcheng has quit IRC | 18:39 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split assignment backend tests https://review.openstack.org/268307 | 18:39 |
| stevemar | notmorgan: you're the one that did it that way :P | 18:39 |
| *** david-lyle has joined #openstack-keystone | 18:39 | |
| stevemar | notmorgan: potatoe, potato | 18:39 |
| notmorgan | stevemar: i know, like i said we maaaaaaaaay want to invert that | 18:39 |
| notmorgan | but for now. | 18:40 |
| notmorgan | it's fine | 18:40 |
| stevemar | notmorgan: just trying to mark BPs complete in launchpad :) | 18:40 |
| stevemar | notmorgan: and last one: https://review.openstack.org/#/c/259730/ | 18:40 |
| notmorgan | stevemar: we should say "admin_token" method is not recommended | 18:41 |
| notmorgan | but that can be a followup | 18:41 |
| *** aix has quit IRC | 18:42 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split assignment backend tests https://review.openstack.org/268307 | 18:42 |
| samueldmq | dstanek: this one ^ should be in the format we discussed | 18:42 |
| notmorgan | stevemar: https://review.openstack.org/#/c/231872/ needs love :( | 18:43 |
| *** doug-fish has quit IRC | 18:43 | |
| stevemar | notmorgan: ugh, i know! | 18:43 |
| stevemar | i can't untangle it! | 18:43 |
| *** hockeynut_afk is now known as hockeynut | 18:43 | |
| stevemar | notmorgan: tbh, that was gonna be my goal for the hackathon :P | 18:43 |
| notmorgan | oh god. | 18:43 |
| notmorgan | the merge conflicts THE MERGE CONFLICTS | 18:44 |
| * notmorgan shuffles off back into the cathedral | 18:44 | |
| notmorgan | stevemar: hope you got the hunchback of notre dame reference there. :P | 18:46 |
| *** david-lyle has quit IRC | 18:46 | |
| stevemar | notmorgan: i didn't :( | 18:46 |
| notmorgan | stevemar: not the disney movie thing either :P | 18:47 |
| stevemar | notmorgan: when i hear cathedral, i think act 1 in diablo 2 | 18:47 |
| notmorgan | he says "The Bells... THE BELLS" | 18:47 |
| notmorgan | annnnyway | 18:47 |
| *** jdennis1 has joined #openstack-keystone | 18:47 | |
| *** jdennis has quit IRC | 18:47 | |
| stevemar | notmorgan: oh, did you get approval? i don't need to know, just making talk | 18:48 |
| notmorgan | stevemar: oh yeah i need to book flight/hotel though | 18:48 |
| stevemar | wow that came out poorly | 18:48 |
| stevemar | yay! | 18:48 |
| notmorgan | which is super painful since... <14days | 18:48 |
| notmorgan | and i need to book manchester uk trip too. | 18:48 |
| *** petertr7_away is now known as petertr7 | 18:50 | |
| notmorgan | stevemar: i am going to rework the revocation events code a bunch here shortly | 18:51 |
| stevemar | notmorgan: that's a bold move | 18:51 |
| dstanek | raildo: htruta: any thoughts on https://review.openstack.org/#/c/134095 - seems like it should be easy to fix it up and close another bug | 18:51 |
| notmorgan | stevemar: it's speculative but we're doing a lot of work in python we probably don't need to do. | 18:52 |
| notmorgan | stevemar: our tests are slooooooowwwwwwwwwwwww | 18:52 |
| raildo | dstanek: sure, I'll fix it today :) | 18:53 |
| stevemar | notmorgan: they are frightfully slow | 18:53 |
| notmorgan | stevemar: not as abad as nova's | 18:53 |
| notmorgan | but getting there | 18:53 |
| stevemar | dolphm: ping when you're back please | 18:53 |
| notmorgan | if we stopped spinning up/down a whole keystone server for things [maybe spin up one per thread and just keep it around and make the tests isolated via another mechanism] | 18:53 |
| notmorgan | it would be better | 18:54 |
| notmorgan | but i am betting a ton of the time is evenlet spinup/down | 18:54 |
| dstanek | notmorgan: i have some patches i am working on to do just that | 18:54 |
| notmorgan | dstanek: yay | 18:54 |
| dstanek | i've also been moving things into fixtures | 18:55 |
| notmorgan | i mean.. we have SOME things that need their own server, like when we swap out backends. | 18:55 |
| dstanek | and reducing when they are used | 18:55 |
| * notmorgan nods. | 18:55 | |
| *** tyagiprince has quit IRC | 18:55 | |
| notmorgan | if i can unwind this ldap thing, i'm gonna push to get it landed today | 18:55 |
| notmorgan | sorry if it makes your stuff harder. | 18:55 |
| notmorgan | stevemar: omg | 18:56 |
| notmorgan | stevemar: this thing moved up to 542 failed tests :( | 18:56 |
| notmorgan | oh i see why | 18:56 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split resource backend tests https://review.openstack.org/268702 | 18:58 |
| stevemar | notmorgan: i would be SOOOO HAPPY if you could unwind the ldap crap | 18:58 |
| *** peter-hamilton has quit IRC | 19:00 | |
| dstanek | notmorgan: stevemar: thoughts on a fixture here? https://review.openstack.org/#/c/266396/2 | 19:01 |
| dstanek | lbragstad: i'll fix up https://review.openstack.org/#/c/266397/2 to make it more obvious. initially that code was doing more work, but i cut it down | 19:03 |
| *** josecastroleon has quit IRC | 19:04 | |
| lbragstad | dstanek ++ works for me; i'm happy with the change. my comment was more of a question than anything else | 19:04 |
| *** josecastroleon has joined #openstack-keystone | 19:05 | |
| *** avarner has quit IRC | 19:06 | |
| stevemar | dstanek: rubber stamped | 19:06 |
| notmorgan | dstanek: doesn't look bad to me | 19:07 |
| samueldmq | stevemar: https://review.openstack.org/#/c/265650 closes another bp (assignment-maanger-cleanup) | 19:07 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove LDAP Resource and LDAP Assignment backends https://review.openstack.org/231872 | 19:07 |
| notmorgan | stevemar: ^ that is just a rebase, and down to 11 failures | 19:07 |
| notmorgan | still wip/unwinding it | 19:08 |
| *** itlinux has quit IRC | 19:08 | |
| stevemar | notmorgan: cool, bknudson_ had concerns about removing a public function we didn't deprecate | 19:08 |
| stevemar | notmorgan: if you're seeing the comments in the history | 19:08 |
| notmorgan | nope | 19:08 |
| notmorgan | which function? | 19:08 |
| notmorgan | nope | 19:09 |
| stevemar | notmorgan: https://review.openstack.org/#/c/231872/9/keystone/assignment/backends/sql.py | 19:09 |
| notmorgan | i disagree since we just don't ever call it | 19:09 |
| *** tyagiprince has joined #openstack-keystone | 19:09 | |
| notmorgan | but we could just make it return nothing useful. | 19:09 |
| notmorgan | or conf. | 19:09 |
| notmorgan | as well | 19:09 |
| lbragstad | samueldmq question for you on a test | 19:09 |
| stevemar | yeah, i think that's what he is saying | 19:09 |
| stevemar | notmorgan: | 19:09 |
| stevemar | ^ | 19:09 |
| *** pnavarro has quit IRC | 19:10 | |
| dstanek | backward compat is overrated | 19:10 |
| lbragstad | dstanek ++ | 19:10 |
| notmorgan | let me deal with the other failures before dealing with the relative nitpicking on removal of things | 19:10 |
| notmorgan | that we don't call anymore | 19:10 |
| *** david-lyle has joined #openstack-keystone | 19:10 | |
| dstanek | stevemar: topol: read the o'reilly book yesterday - well written | 19:11 |
| topol | dstanek, Thanks! That means a lot coming from you!!! | 19:11 |
| lbragstad | samueldmq (or anyone up for a test behavior question) this shouldn't return a 200 should it? https://github.com/openstack/keystone/blob/1baa32afd0b43887125e35cfba4597556fc187df/keystone/tests/unit/test_v3_assignment.py#L151 | 19:12 |
| *** lhcheng has joined #openstack-keystone | 19:12 | |
| *** ChanServ sets mode: +v lhcheng | 19:12 | |
| stevemar | dstanek: hopefully it was nothing new for you :) | 19:12 |
| *** tonytan4ever has joined #openstack-keystone | 19:12 | |
| stevemar | dstanek: but thanks! | 19:12 |
| *** AJaeger has joined #openstack-keystone | 19:12 | |
| dstanek | stevemar: nice refresher :-) it was a quick read which was nice | 19:13 |
| AJaeger | Hi keystone cores, I'd like to merge bandit and pep8 targets and have two alternative proposals: https://review.openstack.org/261993 and https://review.openstack.org/265148 . Merging these into one "linter" target (one names it pep8, the other linters) allows us to reduce our CI load. Could you tell me which way you prefer and merge, please? I'll take care of related projects and project-config | 19:15 |
| AJaeger | change... | 19:15 |
| notmorgan | what is... _set_default_is_domain_project !? | 19:15 |
| bknudson_ | AJaeger: whichever one you prefer works for me. | 19:16 |
| notmorgan | it seems to only ever be used in test_backend_ldap | 19:16 |
| notmorgan | AJaeger: i'll trust your preference. | 19:16 |
| notmorgan | AJaeger: either works for me | 19:16 |
| stevemar | AJaeger: i like dolph's suggestion of just naming it pep8 | 19:16 |
| stevemar | since, we're used to that | 19:16 |
| bknudson_ | AJaeger: not sure why you proposed both? | 19:16 |
| AJaeger | dolphm: gave a -1 on 261993 (which was using name linters) | 19:16 |
| AJaeger | bknudson_: I proposed 261993 first and then offered the alternative ;) | 19:17 |
| notmorgan | AJaeger: having been part of the original discussion, i don't really care which. i like "linter" vs "linters" | 19:17 |
| notmorgan | AJaeger: but i'm also fine leaving itpep8 | 19:17 |
| bknudson_ | delint | 19:17 |
| bknudson_ | or just lint . I'm lazy | 19:17 |
| dstanek | AJaeger: i like linters better, but i'd be happy with whatever you do | 19:17 |
| AJaeger | we had some lengthy discussion on #openstack-infra that everybody is used to pep8 but it's named wrongly, it's our target where all lin like jobs are added and somebody proposed linters and we went with that. | 19:17 |
| bknudson_ | what happens if there's only one linter? | 19:17 |
| dstanek | bknudson_: ++ to lint | 19:17 |
| notmorgan | bknudson_: the job is a linter job, doesn't matter how many | 19:18 |
| AJaeger | If you want to stay with pep8, fine with me. If we rename, let's use linters ;) | 19:18 |
| notmorgan | you don't call it a "tests" job its a "test" job | 19:18 |
| notmorgan | ;) | 19:18 |
| * notmorgan stops arguing grammar in naming for CS things | 19:18 | |
| dstanek | AJaeger: i'd go with linters then if others are moving in that direction anyway | 19:19 |
| AJaeger | dstanek: we're trying to mov slowly in the direction of linters. So, that's a preference but not a hard rule | 19:20 |
| bknudson_ | we can modify pep8 and then add linters as an alias, I assume | 19:20 |
| bknudson_ | and eventually remove pep8 | 19:20 |
| notmorgan | bknudson_: ++ | 19:21 |
| AJaeger | bknudson_: like 261993? Or do you have a better proposal? | 19:21 |
| notmorgan | w...t...f | 19:21 |
| bknudson_ | AJaeger: like https://review.openstack.org/#/c/265148/1/tox.ini | 19:21 |
| bknudson_ | ok, my preference is for https://review.openstack.org/#/c/265148/ since it reuses pep8 which people are used to. | 19:22 |
| AJaeger | bknudson_: will not work - pep8 uses {posargs} and tox is broken, it will not expand | 19:22 |
| bknudson_ | I have never passed an arg to tox -e pep8 | 19:23 |
| AJaeger | bknudson_: ARgh, that's my change - let me double check it ;) | 19:23 |
| AJaeger | sure, that works - but if you use the same aliasing for commands as well to alias linters and pep8 it might fail | 19:24 |
| AJaeger | bknudson_: so, the aliasing of pep8 completly to linters - not sure how that works with tox ;( | 19:26 |
| openstackgerrit | Merged openstack/keystoneauth: Remove keyring as a test-requiremnet https://review.openstack.org/269146 | 19:26 |
| *** david-lyle_ has joined #openstack-keystone | 19:27 | |
| *** dslev has joined #openstack-keystone | 19:28 | |
| bknudson_ | AJaeger: can you do commands={[testenv:pep8]commands} like you do with deps? | 19:28 |
| bknudson_ | echo "Use tox -e linters instead" {[testenv:linters]commands} | 19:29 |
| AJaeger | bknudson_: YEs - unless commands uses {posargs}, then it breaks | 19:29 |
| AJaeger | And pep8 currently uses posargs. We can remove it from flake8 and be fine ;) | 19:29 |
| AJaeger | shall I update 265148 in this direction (after testing ;) ? | 19:30 |
| bknudson_ | AJaeger: I'm fine with 265148 as-is. The renaming can be done in a follow-on. | 19:30 |
| *** david-lyle has quit IRC | 19:31 | |
| AJaeger | then let me provide a followup for that one... | 19:32 |
| *** fawadkhaliq has joined #openstack-keystone | 19:35 | |
| *** josecastroleon has quit IRC | 19:35 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove LDAP Resource and LDAP Assignment backends https://review.openstack.org/231872 | 19:35 |
| notmorgan | stevemar: ^ down to three failures | 19:36 |
| *** josecastroleon has joined #openstack-keystone | 19:36 | |
| stevemar | notmorgan: nice | 19:37 |
| stevemar | dstanek: wow, i forgot we even had a non-sql backend for this: https://review.openstack.org/#/c/267777/ | 19:37 |
| *** david-lyle_ has quit IRC | 19:37 | |
| stevemar | dstanek: are there any more kvs backends?! | 19:37 |
| dstanek | stevemar: i don't think so | 19:37 |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone: Add linters environment, keep pep8 as alias https://review.openstack.org/269248 | 19:37 |
| AJaeger | Here's the suggested followup, works fine locally ^ | 19:38 |
| * AJaeger adds some comments to tox.ini | 19:38 | |
| dstanek | stevemar: token persistence | 19:38 |
| notmorgan | yeah that is a bit special | 19:38 |
| notmorgan | anyway | 19:38 |
| notmorgan | dstanek: lol | 19:38 |
| notmorgan | you know... if those two kvs backends die, we cna just drop the dogpile_kvs code | 19:38 |
| notmorgan | stevemar: 2 more tests to unwind! | 19:38 |
| *** david-lyle has joined #openstack-keystone | 19:39 | |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone: Add linters environment, keep pep8 as alias https://review.openstack.org/269248 | 19:39 |
| AJaeger | anybody else wants to +2A 265148? I'll work on the infra change then... | 19:39 |
| AJaeger | Wait, on infra change after 269248 is in... | 19:40 |
| notmorgan | oh these tests are synthetic and not valid. ldap did magic and automatically just defaulted domain_id=default_domain | 19:41 |
| notmorgan | stevemar: i might have this all unwound | 19:42 |
| notmorgan | stevemar: running fiull tests to make sure | 19:42 |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone: Add linters environment, keep pep8 as alias https://review.openstack.org/269248 | 19:43 |
| AJaeger | bknudson_: updated as suggested ^ | 19:43 |
| lbragstad | in the process of switching fernet to be the default - I'm seeing a lot of strange assignment issues. | 19:43 |
| notmorgan | AJaeger: oh neat | 19:43 |
| lbragstad | amakarov o/ jorge_munoz and I have some trust redelegation questions for you | 19:44 |
| bknudson_ | AJaeger: I get errors saying that echo isn't a valid command. | 19:44 |
| AJaeger | bknudson_: I added whitelist_externals | 19:45 |
| AJaeger | now it's fine for me | 19:45 |
| bknudson_ | when I run tox -e pep8 it says "WARNING:test command found but not installed in testenv" cmd: /bin/bash | 19:46 |
| *** itlinux has joined #openstack-keystone | 19:46 | |
| *** david-lyle has quit IRC | 19:46 | |
| bknudson_ | it's not echo it's bash | 19:46 |
| AJaeger | bknudson_: indeed, found in backcsroll, will fix | 19:47 |
| bknudson_ | happens with tox -e pep8, too | 19:47 |
| AJaeger | bknudson_: I noticed echo first, fix it and now it's bash ;/ | 19:48 |
| bknudson_ | maybe it overrode other whitelist | 19:49 |
| bknudson_ | {[testenv]whitelist} | 19:49 |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone: Add linters environment, keep pep8 as alias https://review.openstack.org/269248 | 19:52 |
| AJaeger | works now for me... ^ | 19:52 |
| AJaeger | infra change: https://review.openstack.org/261994 | 19:52 |
| *** timcline has quit IRC | 19:54 | |
| *** timcline has joined #openstack-keystone | 19:54 | |
| AJaeger | once these changes are in and working for a few days, I update the other keystone projects in the same way. | 19:55 |
| AJaeger | If anything breaks, please ping me and I'll fix | 19:55 |
| *** fawadkhaliq has quit IRC | 19:56 | |
| bknudson_ | AJaeger: you're going to remove the bandit job? | 19:56 |
| *** e0ne has joined #openstack-keystone | 19:56 | |
| AJaeger | yes, bknudson_ | 19:57 |
| *** narengan12 has joined #openstack-keystone | 19:57 | |
| *** narengan has quit IRC | 19:57 | |
| *** timcline has quit IRC | 19:58 | |
| AJaeger | bknudson_: it first needs the infra job to merge, so added a depends-on... | 20:00 |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone: Remove bandit tox environment https://review.openstack.org/269253 | 20:00 |
| *** spandhe has joined #openstack-keystone | 20:06 | |
| *** josecastroleon has quit IRC | 20:06 | |
| *** josecastroleon has joined #openstack-keystone | 20:07 | |
| *** timcline has joined #openstack-keystone | 20:08 | |
| *** spzala has joined #openstack-keystone | 20:13 | |
| openstackgerrit | Andreas Jaeger proposed openstack/keystonemiddleware: Merge pep8 and bandit into linters https://review.openstack.org/269259 | 20:17 |
| openstackgerrit | Andreas Jaeger proposed openstack/keystonemiddleware: Remove bandit tox environment https://review.openstack.org/269260 | 20:17 |
| *** tonytan4ever has quit IRC | 20:19 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove LDAP Resource and LDAP Assignment backends https://review.openstack.org/231872 | 20:20 |
| notmorgan | stevemar: ^ that should be a complete unwind of all the issues | 20:21 |
| samueldmq | notmorgan: passing jenkins ? | 20:21 |
| notmorgan | samueldmq: it should once i push the pep8 fix | 20:21 |
| samueldmq | notmorgan: well, at least tox ens locally | 20:21 |
| samueldmq | notmorgan: nice! | 20:22 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove LDAP Resource and LDAP Assignment backends https://review.openstack.org/231872 | 20:22 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 20:22 |
| notmorgan | yes locally it is passing | 20:22 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied roles driver and manager https://review.openstack.org/264260 | 20:22 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 20:22 |
| ayoung | notmorgan, Dangit | 20:23 |
| samueldmq | +60, -1295, beautiful numbers | 20:23 |
| ayoung | that is going to conflict with my commit, as I had to no-op things in that backend | 20:23 |
| notmorgan | ayoung: yeah sorry :( | 20:23 |
| ayoung | notmorgan, If you +2AS mine, I'll do the work to strip it out of yours | 20:24 |
| notmorgan | ayoung: uhhhhhh | 20:24 |
| ayoung | :) | 20:24 |
| ayoung | notmorgan, just let mine go through...I'm happy to rebase yours manuyally once it does | 20:24 |
| notmorgan | ayoung: i'll offer the inverse actually. | 20:25 |
| notmorgan | ayoung: this one has been a nightmare of rebase hell over and over | 20:25 |
| notmorgan | ayoung: since a rebase for yours will likely be a git rm <file> | 20:25 |
| ayoung | notmorgan, I'm, happy to rebase it for you | 20:25 |
| *** tonytan4ever has joined #openstack-keystone | 20:25 | |
| notmorgan | ayoung: if you were just no-oping things in a driver | 20:25 |
| ayoung | I was responsible for the LDAP code, I'd not mind being part of giving it the old Yeller treatment | 20:25 |
| ayoung | implied roles backend is ready to go | 20:26 |
| ayoung | notmorgan, I'll rebase yours now, if you don't mind | 20:26 |
| notmorgan | ayoung: actually can you let it just sit and pass jenkins | 20:26 |
| *** petertr7 is now known as petertr7_away | 20:26 | |
| ayoung | notmorgan, happy to | 20:27 |
| notmorgan | ayoung: i'd really like to know if i caught everything | 20:27 |
| notmorgan | ayoung: i'll make a deal with you, whichever lands first the other of us rebases the other patchset | 20:27 |
| notmorgan | or whichever starts gate first | 20:27 |
| ayoung | notmorgan, I'd rather rebase mine on yours and you +2 | 20:27 |
| notmorgan | that is, we just do the rebase on top and call it a day | 20:27 |
| ayoung | getting the +2 on mine is hardest | 20:27 |
| notmorgan | well i'm also not in a real "review code" mind set atm | 20:27 |
| *** doug-fish has joined #openstack-keystone | 20:28 | |
| notmorgan | will be a few hours after chasing that horrible rebase down | 20:28 |
| notmorgan | brain is fried | 20:28 |
| *** jasonsb has joined #openstack-keystone | 20:29 | |
| *** gildub has joined #openstack-keystone | 20:31 | |
| notmorgan | stevemar: https://review.openstack.org/#/c/265023/ - this needs your decision | 20:31 |
| *** jasonsb has quit IRC | 20:31 | |
| *** jasonsb has joined #openstack-keystone | 20:31 | |
| notmorgan | stevemar: either we need to decide to break environments that use this and revert the revert in master, or we need to land the backports | 20:32 |
| notmorgan | stevemar: i do not disagree that it re-introduces the issue, but it is a behavior we have people in the wild relying on. | 20:32 |
| notmorgan | stevemar: and it is expected to re-introduce the behavior [it's the whole point of the revert] | 20:32 |
| *** tyagiprince has quit IRC | 20:33 | |
| *** petertr7_away is now known as petertr7 | 20:34 | |
| *** vgridnev has joined #openstack-keystone | 20:36 | |
| stevemar | notmorgan: grumble grumble | 20:36 |
| stevemar | either way, someone is gonna be broken | 20:36 |
| notmorgan | stevemar: with the revert, very low impact | 20:36 |
| stevemar | notmorgan: waiting for dolphm to resurface | 20:36 |
| notmorgan | swift and swift has already said don't use V2 specific api | 20:36 |
| notmorgan | erm middleware w/ name-based | 20:37 |
| notmorgan | acls | 20:37 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 20:37 | |
| notmorgan | back in like 2014 | 20:37 |
| *** josecastroleon has quit IRC | 20:37 | |
| notmorgan | or so. | 20:37 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 20:37 | |
| notmorgan | keystone definitely does not rely on username for anything from the token, and most everyone else uses it at most for "display" [horizon?] type purposes | 20:38 |
| *** josecastroleon has joined #openstack-keystone | 20:38 | |
| notmorgan | based on that, i'll take breaking people relying on username [since that is changable anyway] | 20:38 |
| *** markvoelker has joined #openstack-keystone | 20:38 | |
| AJaeger | bknudson_: is there anything I should do for 269253? | 20:38 |
| notmorgan | heck if you use username ACLs and someone's username changes and another person gets it, you're screwed anyway | 20:38 |
| * notmorgan sticks with the general view that username ACLs with keystoneauth is dumb | 20:39 | |
| bknudson_ | AJaeger: I think it's going to fail until the bandit job is removed (for example, remove gate-keystone-tox-bandit from https://review.openstack.org/#/c/261994/ ) | 20:40 |
| AJaeger | bknudson_: exactly | 20:40 |
| AJaeger | there's nothing we can do now for that - I commented already | 20:40 |
| AJaeger | just wanted to know whether I can do anything, e.g. update commit message? | 20:40 |
| AJaeger | Or should I mark as WIP for now? | 20:41 |
| bknudson_ | AJaeger: https://review.openstack.org/#/c/261994/4/zuul/layout.yaml doesn't remove gate-keystone-tox-bandit gate | 20:41 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split assignment backend tests https://review.openstack.org/268307 | 20:41 |
| AJaeger | bknudson_: it does - it runs it only on liberty | 20:41 |
| bknudson_ | AJaeger: oh, that makes sense. | 20:42 |
| AJaeger | if we backport my changes, we can remove it completely | 20:42 |
| stevemar | notmorgan: btw, ldap patch is failing 2 tests: https://jenkins03.openstack.org/job/gate-keystone-python27/1375/console | 20:42 |
| * AJaeger prefers small steps here | 20:42 | |
| bknudson_ | I don't know if it's worth it to backport or not. | 20:42 |
| notmorgan | that was passing locally | 20:43 |
| AJaeger | bknudson_: makes infra setup easier ;) but we do not need to backport | 20:43 |
| notmorgan | stevemar: | 20:43 |
| notmorgan | stevemar: our tests suck. | 20:44 |
| notmorgan | stevemar: this was passing locally :( | 20:44 |
| AJaeger | bknudson_: let's fix master first and then see whether backporting is worth it | 20:44 |
| *** _cjones_ has quit IRC | 20:45 | |
| *** _cjones_ has joined #openstack-keystone | 20:45 | |
| *** drjones has joined #openstack-keystone | 20:47 | |
| *** _cjones_ has quit IRC | 20:47 | |
| *** mhickey has joined #openstack-keystone | 20:47 | |
| *** henrynash has joined #openstack-keystone | 20:49 | |
| *** ChanServ sets mode: +v henrynash | 20:49 | |
| *** thiagolib has quit IRC | 20:49 | |
| *** vivekd has quit IRC | 20:50 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split resource backend tests https://review.openstack.org/268702 | 20:54 |
| *** phalmos has quit IRC | 20:55 | |
| *** phalmos has joined #openstack-keystone | 20:57 | |
| *** stack_ has joined #openstack-keystone | 20:57 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove LDAP Resource and LDAP Assignment backends https://review.openstack.org/231872 | 20:58 |
| *** vgridnev has quit IRC | 20:58 | |
| notmorgan | stevemar: ^ that should fix those two tests now | 20:58 |
| openstackgerrit | Andreas Jaeger proposed openstack/python-keystoneclient: Merge pep8 and bandit into linters https://review.openstack.org/269268 | 20:59 |
| openstackgerrit | Andreas Jaeger proposed openstack/python-keystoneclient: Remove bandit tox environment https://review.openstack.org/269269 | 20:59 |
| *** AJaeger has left #openstack-keystone | 21:01 | |
| *** narengan12 has quit IRC | 21:01 | |
| *** Guest31270 is now known as tsymanczyk | 21:01 | |
| *** raildo is now known as raildo-afk | 21:01 | |
| *** stack_ is now known as narengan | 21:02 | |
| *** pauloewerton has quit IRC | 21:04 | |
| *** josecastroleon has quit IRC | 21:08 | |
| *** daemontool has quit IRC | 21:08 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Mark memcache and memcache_pool token deprecated https://review.openstack.org/269229 | 21:08 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: List assignments with names https://review.openstack.org/249958 | 21:09 |
| stevemar | notmorgan: fixed up https://review.openstack.org/#/c/269229/3 for you, it was failing pep8, i re-approved | 21:09 |
| *** josecastroleon has joined #openstack-keystone | 21:09 | |
| notmorgan | ok | 21:10 |
| notmorgan | cool thnx | 21:10 |
| stevemar | notmorgan: np, just trying to clear our patch backlog :) | 21:10 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split token backend tests https://review.openstack.org/269111 | 21:14 |
| notmorgan | oh hah | 21:17 |
| notmorgan | it's supposed to be a holiday today | 21:18 |
| * notmorgan facepalms. | 21:18 | |
| notmorgan | i was supposed to not work :P or something | 21:18 |
| *** phalmos has quit IRC | 21:20 | |
| *** tonytan4ever has quit IRC | 21:20 | |
| *** avarner has joined #openstack-keystone | 21:24 | |
| *** lhcheng has quit IRC | 21:24 | |
| *** vgridnev has joined #openstack-keystone | 21:25 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split trust backend tests https://review.openstack.org/269115 | 21:27 |
| *** petertr7 is now known as petertr7_away | 21:37 | |
| *** tonytan4ever has joined #openstack-keystone | 21:38 | |
| *** josecastroleon has quit IRC | 21:39 | |
| *** josecastroleon has joined #openstack-keystone | 21:40 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split catalog backend tests https://review.openstack.org/269125 | 21:42 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 21:45 |
| lbragstad | ayoung ^ that's not going to pass but I'm hitting strange assignment issues - mind giving it a once over? | 21:45 |
| ayoung | lbragstad, sure | 21:45 |
| lbragstad | ayoung thanks | 21:46 |
| ayoung | lbragstad, what are you seeing? | 21:46 |
| lbragstad | ayoung https://review.openstack.org/#/c/258650/14/keystone/tests/unit/test_v3_assignment.py | 21:46 |
| lbragstad | ayoung for example - i'm not sure how test_crud_user_domain_role_grants passed before | 21:47 |
| ayoung | lbragstad, well, the failure might be due to a change on the admin user | 21:47 |
| lbragstad | ayoung yeah, that's a possibility | 21:48 |
| lbragstad | but why would that work with UUID and not with Fernet | 21:48 |
| ayoung | the UNAUTHORIZED response is that the user making the request is unauthorized...is that supposed to be theadmin user here? | 21:48 |
| lbragstad | whatever self.user is | 21:48 |
| ayoung | lbragstad, kneejerk reaction: revocation evetns | 21:48 |
| lbragstad | I think that is the user making the self.post, self.get, self.delete, self.patch requests | 21:48 |
| ayoung | the admin user token got revoked? | 21:48 |
| lbragstad | ayoung I don't think it got revoked, | 21:49 |
| ayoung | lbragstad, in deleting the role assignment... | 21:49 |
| lbragstad | ayoung I was wondering if it was something related to building the role assignments | 21:49 |
| lbragstad | on every auth/validate call | 21:49 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: List assignments with names https://review.openstack.org/249958 | 21:50 |
| *** ericksonsantos has quit IRC | 21:51 | |
| lbragstad | ayoung if you run that locally - there are about 20-some patches that fail | 21:52 |
| lbragstad | s/patches/tests/ | 21:53 |
| ayoung | I'll give it a run | 21:53 |
| lbragstad | ayoung and most of them are in keystone/tests/unit/test_auth.py | 21:53 |
| lbragstad | specifically around trusts and v2 | 21:53 |
| *** vgridnev has quit IRC | 21:53 | |
| lbragstad | well, trusts + v2 + fernet | 21:53 |
| ayoung | lbragstad, can you +2A this damn one and put it to bed https://review.openstack.org/#/c/264260 | 21:53 |
| dstanek | lbragstad: what is self.token_properties here: https://review.openstack.org/#/c/253670/3/keystone/tests/unit/test_v3.py ? | 21:53 |
| lbragstad | ayoung yes, i'll review | 21:54 |
| lbragstad | dstanek self.token_properties are the properties the make up unscoped, domain-scoped, project-scoped, and trust-scoped tokens | 21:55 |
| dstanek | lbragstad: why is that being modified in an assertion method? | 21:56 |
| lbragstad | dstanek it could be modified elsewhere, I made self.token_properties as general as a could and then in cases where we need to check for specific scoped, i modified it to include the properties required for that scope. | 21:57 |
| dstanek | lbragstad: i'll have to dig a little deeper. it's being modified there, but not being used so it's not clear why that change is being made | 21:58 |
| lbragstad | dstanek self.token_properties isn't being used? | 21:59 |
| ayoung | lbragstad, the ones I am seeing fail are all trusts | 21:59 |
| lbragstad | dstanek line 677 uses self.token_properties | 22:00 |
| lbragstad | ayoung yeah - trusts with v2, right? | 22:00 |
| *** mhickey has quit IRC | 22:00 | |
| dstanek | lbragstad: ah i see, you are dynamically creating that schema | 22:01 |
| lbragstad | dstanek yep | 22:01 |
| ayoung | lbragstad, looks like it | 22:01 |
| ayoung | lbragstad, test_auth is V2 | 22:01 |
| lbragstad | dstanek since we assert different token properties depending on the scope | 22:01 |
| lbragstad | ayoung yeah - that's what I was thinking | 22:01 |
| ayoung | test_v3_auth is v3. THere is a little bleed over | 22:01 |
| ayoung | lbragstad, let me look at the one you commendted out though | 22:02 |
| lbragstad | ayoung i'm not real sure what the correct behavior is in some of those cases. | 22:02 |
| *** bknudson_ has quit IRC | 22:02 | |
| *** edmondsw has quit IRC | 22:02 | |
| *** diazjf has quit IRC | 22:03 | |
| *** mhickey has joined #openstack-keystone | 22:04 | |
| *** jamielennox|away is now known as jamielennox | 22:09 | |
| *** josecastroleon has quit IRC | 22:10 | |
| *** gildub has quit IRC | 22:10 | |
| *** josecastroleon has joined #openstack-keystone | 22:11 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: List assignments with names https://review.openstack.org/249958 | 22:12 |
| *** chlong has joined #openstack-keystone | 22:12 | |
| ayoung | lbragstad, sooooostrange thing.Ran it in the debugger and it succeeded. I wonder if there is arace condition somewhere in the validation path. | 22:13 |
| lbragstad | ayoung ?! | 22:13 |
| lbragstad | really? | 22:13 |
| ayoung | lbragstad, I wouldn't put too much credence in it yet | 22:14 |
| ayoung | its possible that the debugger did something else wonky | 22:14 |
| ayoung | this was in the log, though | 22:14 |
| ayoung | RBAC: Invalid token | 22:14 |
| ayoung | The request you have made requires authentication. | 22:14 |
| lbragstad | ayoung yeah I'm getting a few of those too | 22:14 |
| *** jlk has left #openstack-keystone | 22:15 | |
| lbragstad | ayoung I think at this point it all edge-cases | 22:15 |
| ayoung | that is from | 22:15 |
| ayoung | eystone/common/controller.py:84: LOG.warning(_LW('RBAC: Invalid token')) | 22:15 |
| ayoung | Binary file keystone/common/controller.pyc matches | 22:15 |
| ayoung | keystone/middleware/auth.py:58: LOG.warning(_LW('RBAC: Invalid token')) | 22:15 |
| ayoung | one of those two places | 22:15 |
| ayoung | let me change one and see... | 22:15 |
| slberger | Does anyone know how I can disable TRACE in the keystone apache configuration? TraceEnable off only works for apache and not wsgi | 22:15 |
| ayoung | RBAC: Invalid token passed to middleware | 22:16 |
| *** dims has joined #openstack-keystone | 22:17 | |
| ayoung | slberger, did you make the change in keystone.conf? | 22:17 |
| ayoung | lbragstad, so let me see what middleware is seeing... | 22:17 |
| lbragstad | ayoung ok | 22:17 |
| *** narengan has quit IRC | 22:17 | |
| slberger | @ayoung, is there a configuration option for that? | 22:18 |
| *** dims_ has quit IRC | 22:18 | |
| slberger | I did it in /etc/httpd/conf.d/keystone.conf | 22:18 |
| *** narengan has joined #openstack-keystone | 22:18 | |
| ayoung | slberger, yes, it isn /etc./keystone.... | 22:18 |
| ayoung | is in | 22:18 |
| slberger | @ayoung, ok let me check. I was unaware that was an option. | 22:19 |
| slberger | @ayoung, you wouldn't happen to know what section it would be in would you? | 22:20 |
| ayoung | slberger, I'd have to look | 22:20 |
| ayoung | slberger, http://git.openstack.org/cgit/openstack/keystone/tree/doc/source/configuration.rst | 22:21 |
| ayoung | slberger, http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n107 | 22:22 |
| slberger | ayoung, its in the oslo.log section? seems weird | 22:25 |
| ayoung | slberger, start with degug off | 22:25 |
| slberger | sorry read it wrong | 22:25 |
| ayoung | lbragstad, this is failing token_ref = token_model.KeystoneToken( | 22:25 |
| ayoung | token_id=token_id, | 22:25 |
| ayoung | token_data=self.token_provider_api.validate_token(token_id)) | 22:25 |
| *** timcline has quit IRC | 22:26 | |
| *** tsymanczyk has quit IRC | 22:27 | |
| lbragstad | ayoung why would that fail? | 22:27 |
| lbragstad | i assume it's the validate_token() | 22:27 |
| ayoung | lbragstad, no idea, does not log beyond that...still digginh | 22:27 |
| notmorgan | ayoung: i'm going to be re-writing revoke to leverage SQL rather than python to validate if a token is ok [speculative change] and check performance. this is since we've removed the KVS backend and i know that the rev. backend is slow | 22:30 |
| notmorgan | ayoung: will ping ya when i get it cleaned up. but with only a SQL backend, the in-python validation seems less optimal. | 22:30 |
| *** doug-fish has quit IRC | 22:31 | |
| ayoung | notmorgan, I need more context | 22:31 |
| notmorgan | ayoung: as you scale up, and have more rev. events | 22:31 |
| notmorgan | it gets slower and slower | 22:31 |
| ayoung | true, and we are, right now, screen against too many | 22:31 |
| *** doug-fish has joined #openstack-keystone | 22:31 | |
| ayoung | we only need to screen against the explicit ID | 22:32 |
| notmorgan | so, instead, i'm going to roll a speculative change to validate that leverages SQL for these lookups. | 22:32 |
| ayoung | all of the invalid X,Y,Z ones are irrelevant now if we check the DB for active users etc | 22:32 |
| ayoung | notmorgan, premature | 22:32 |
| ayoung | notmorgan, I'm not saying no | 22:32 |
| ayoung | I'm saying lets do the other first | 22:32 |
| notmorgan | the tree stuff needs to die imo | 22:32 |
| ayoung | regardless | 22:32 |
| notmorgan | and the kvs backend is being removed | 22:33 |
| ayoung | premature optimization...we can;t do what you are saying until both token formate use the same path | 22:33 |
| notmorgan | we have too much logic | 22:33 |
| ayoung | we need UUID to do the same thing as Fernet | 22:33 |
| notmorgan | i'm pushing the logic down to the driver where it belonds | 22:33 |
| notmorgan | belongs* | 22:33 |
| lbragstad | ayoung ++ | 22:33 |
| ayoung | that is fine | 22:33 |
| notmorgan | so, by doing so i'll just drop a lot of the stuff on the floor. | 22:33 |
| ayoung | but let's get lbragstad 's done, thne drop the other events, and then do that | 22:33 |
| notmorgan | wait what other events are we dropping? | 22:33 |
| ayoung | you don't need to carry revoke by domain etc | 22:34 |
| ayoung | most of them | 22:34 |
| *** doug-fis_ has joined #openstack-keystone | 22:34 | |
| notmorgan | what is the list? | 22:34 |
| *** narengan12 has joined #openstack-keystone | 22:34 | |
| notmorgan | we're keeping then? | 22:34 |
| ayoung | notmorgan, let me do other things right now...just accept that we are doing this and we can then drop them | 22:34 |
| ayoung | I';m pushed about 3 deep in the stack right now | 22:34 |
| ayoung | tryihng to help lance, and need to work on a critical issue for in house. | 22:35 |
| ayoung | notmorgan, we'll kill all but revoke by tokenid and a few others that are like it | 22:35 |
| notmorgan | ok that wont really change what i'm doing so. i'm still out to do the change, it can be rebased on top of whatever you're doing | 22:36 |
| ayoung | lbragstad, self.token_provider_api.validate_token .is that not in token/provider.py? | 22:36 |
| *** doug-fish has quit IRC | 22:36 | |
| ayoung | notmorgan, that is fine, and I fgully support the effort | 22:36 |
| *** doug-fish has joined #openstack-keystone | 22:36 | |
| *** spandhe_ has joined #openstack-keystone | 22:37 | |
| lbragstad | ayoung it might be in common.py | 22:37 |
| *** narengan has quit IRC | 22:37 | |
| *** spandhe has quit IRC | 22:38 | |
| *** spandhe_ is now known as spandhe | 22:38 | |
| *** doug-fis_ has quit IRC | 22:38 | |
| lbragstad | ayoung nope it should be in keystone/token/provider.py:204: | 22:39 |
| ayoung | yeah, my logging was truipping me up | 22:40 |
| *** spzala has quit IRC | 22:40 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split policy backend tests https://review.openstack.org/269133 | 22:40 |
| lbragstad | I gotta relocate quick, I'll be on tonight though | 22:40 |
| *** roxanaghe has joined #openstack-keystone | 22:40 | |
| *** spzala has joined #openstack-keystone | 22:40 | |
| ayoung | lbragstad, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/provider.py#n210 this fails | 22:41 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/269321 | 22:41 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/268452 | 22:41 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/268453 | 22:41 |
| *** josecastroleon has quit IRC | 22:41 | |
| *** _cjones_ has joined #openstack-keystone | 22:41 | |
| *** josecastroleon has joined #openstack-keystone | 22:42 | |
| *** drjones has quit IRC | 22:42 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split policy backend tests https://review.openstack.org/269133 | 22:43 |
| *** dims has quit IRC | 22:44 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/269338 | 22:45 |
| *** spzala has quit IRC | 22:45 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/268513 | 22:45 |
| *** spandhe has quit IRC | 22:46 | |
| *** dims has joined #openstack-keystone | 22:47 | |
| *** drjones has joined #openstack-keystone | 22:47 | |
| *** _cjones_ has quit IRC | 22:48 | |
| *** lhcheng has joined #openstack-keystone | 22:49 | |
| *** ChanServ sets mode: +v lhcheng | 22:49 | |
| *** narengan12 has quit IRC | 22:51 | |
| *** mhickey has quit IRC | 22:53 | |
| *** drjones has quit IRC | 22:55 | |
| *** _cjones_ has joined #openstack-keystone | 22:56 | |
| *** tonytan4ever has quit IRC | 22:56 | |
| *** gildub has joined #openstack-keystone | 22:59 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split identity backend tests https://review.openstack.org/269148 | 22:59 |
| samueldmq | henrynash: dstanek: split of test_backend should be reviewable now | 22:59 |
| samueldmq | henrynash: dstanek: starting at https://review.openstack.org/#/c/268307/ | 22:59 |
| ayoung | notmorgan, I think the thin that ias tripping up lbragstad 's test is exactly what we were just talking about | 23:00 |
| * samueldmq is checking out for today | 23:00 | |
| *** jasonsb has quit IRC | 23:00 | |
| ayoung | deleting a role assignement invalidate all tokens that had that assignement (I think) | 23:01 |
| *** jasonsb has joined #openstack-keystone | 23:01 | |
| ayoung | that can now go away, but it needs to go away for both UUID and Fernet at the same time | 23:01 |
| *** bknudson has joined #openstack-keystone | 23:05 | |
| *** ChanServ sets mode: +v bknudson | 23:05 | |
| *** dims has quit IRC | 23:05 | |
| *** dims has joined #openstack-keystone | 23:07 | |
| *** _cjones_ has quit IRC | 23:08 | |
| ayoung | lbragstad, when you get back: look at http://paste.openstack.org/show/484216/ | 23:10 |
| ayoung | lbragstad, the DELETE is for revoke_grant(user_id=1fd3dd98bf924fd786e6c8392dcca3d5, domain_id=9f7e2137b05544e0aa172068acff04b7, role_id=6c33300ec10147d48113870b2c509edb) | 23:11 |
| ayoung | the token revoke debugging I posted shows that a match with the token that is being rejected: | 23:11 |
| ayoung | REVOKE:name=role_id: key = 6c33300ec10147d48113870b2c509edb | 23:11 |
| ayoung | REVOKE:name=user_id: key = 1fd3dd98bf924fd786e6c8392dcca3d5 | 23:11 |
| ayoung | REVOKE:name=domain_id: key = 9f7e2137b05544e0aa172068acff04b7 | 23:12 |
| *** josecastroleon has quit IRC | 23:12 | |
| ayoung | the * are wild cards that will match any token | 23:12 |
| *** _cjones_ has joined #openstack-keystone | 23:13 | |
| *** josecastroleon has joined #openstack-keystone | 23:13 | |
| ayoung | lbragstad, so the wrong token is being used to make the call. I have not looked at the rest of the patch to see if you changed which token should be used by accident | 23:14 |
| ayoung | lbragstad, but this is the change I made http://paste.fedoraproject.org/312164/14531589/ | 23:15 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:15 | |
| *** diazjf has joined #openstack-keystone | 23:26 | |
| *** john5223 has quit IRC | 23:26 | |
| *** john5223 has joined #openstack-keystone | 23:28 | |
| *** doug-fish has quit IRC | 23:28 | |
| *** phalmos has joined #openstack-keystone | 23:30 | |
| *** ninag has quit IRC | 23:30 | |
| *** phalmos has quit IRC | 23:31 | |
| *** tsufiev has quit IRC | 23:32 | |
| *** gordc has quit IRC | 23:34 | |
| *** dims has quit IRC | 23:35 | |
| *** gildub has quit IRC | 23:35 | |
| *** _cjones_ has quit IRC | 23:37 | |
| *** _cjones_ has joined #openstack-keystone | 23:38 | |
| *** tsufiev has joined #openstack-keystone | 23:39 | |
| *** dims has joined #openstack-keystone | 23:39 | |
| *** dslev has quit IRC | 23:40 | |
| *** spzala has joined #openstack-keystone | 23:41 | |
| *** _cjones_ has quit IRC | 23:43 | |
| *** drjones has joined #openstack-keystone | 23:43 | |
| *** spzala has quit IRC | 23:46 | |
| *** drjones has quit IRC | 23:48 | |
| *** _cjones_ has joined #openstack-keystone | 23:48 | |
| *** shoutm has joined #openstack-keystone | 23:49 | |
| *** slberger has left #openstack-keystone | 23:51 | |
| *** _cjones_ has quit IRC | 23:54 | |
| *** _cjones_ has joined #openstack-keystone | 23:55 | |
| *** gildub has joined #openstack-keystone | 23:57 | |
| *** drjones has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!