| *** shoutm_ has joined #openstack-keystone | 00:07 | |
| *** pushkaru has joined #openstack-keystone | 00:08 | |
| *** jbell8 has quit IRC | 00:10 | |
| *** shoutm has quit IRC | 00:10 | |
| *** _cjones__ has quit IRC | 00:11 | |
| *** _cjones_ has joined #openstack-keystone | 00:11 | |
| *** _cjones__ has joined #openstack-keystone | 00:15 | |
| *** _cjones_ has quit IRC | 00:16 | |
| *** _cjones__ has quit IRC | 00:17 | |
| *** _cjones_ has joined #openstack-keystone | 00:18 | |
| openstackgerrit | Merged openstack/keystone: Simplify admin_required policy https://review.openstack.org/273193 | 00:20 |
|---|---|---|
| openstackgerrit | Merged openstack/keystone: Test hyphens instead of underscores in request attributes https://review.openstack.org/258601 | 00:21 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 00:25 |
| *** daemontool has quit IRC | 00:26 | |
| *** _cjones_ has quit IRC | 00:26 | |
| *** _cjones_ has joined #openstack-keystone | 00:26 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 00:27 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 00:28 |
| *** ninag has quit IRC | 00:28 | |
| *** _cjones_ has quit IRC | 00:32 | |
| *** _cjones_ has joined #openstack-keystone | 00:32 | |
| *** mgarza_ has quit IRC | 00:33 | |
| *** _cjones__ has joined #openstack-keystone | 00:35 | |
| *** _cjones_ has quit IRC | 00:35 | |
| *** _cjones_ has joined #openstack-keystone | 00:37 | |
| *** _cjones__ has quit IRC | 00:37 | |
| *** RA_ has quit IRC | 00:42 | |
| *** _cjones_ has quit IRC | 00:42 | |
| *** _cjones_ has joined #openstack-keystone | 00:43 | |
| *** _cjones__ has joined #openstack-keystone | 00:47 | |
| *** _cjones_ has quit IRC | 00:48 | |
| ayoung | jamielennox, you know how you were saying implied roles should not be a whole different API? You were right | 00:48 |
| ayoung | I'm reworking it now, it will be | 00:48 |
| jamielennox | ayoung: :) | 00:48 |
| ayoung | path='/role/{prior_role_id}/implies/{implied_role_id}', | 00:49 |
| ayoung | there is no need for prior_ in there | 00:49 |
| jamielennox | ayoung: is this going to affect it getting in for mitaka? | 00:49 |
| ayoung | nah | 00:49 |
| jamielennox | i still think you should cause we'll be stuck with the api | 00:49 |
| ayoung | I'll submit the spec change at the same time. I think it will be fine | 00:50 |
| ayoung | its justa tune up | 00:50 |
| jamielennox | ayoung: as an aside i don't really like the PUT /role/X/imples/Y syntax but we use it all over keystone | 00:50 |
| jamielennox | i think it should just be {'role': {'id': XYZ, 'implies': [ABC, DEF]}} | 00:50 |
| ayoung | Can you voice why you don't like it? There might be something there | 00:50 |
| ayoung | As a PATCH to the role object? | 00:51 |
| jamielennox | ayoung: it doesn't give any information back | 00:51 |
| jamielennox | i'd love to be using PATCH, but none of our APIs do that | 00:51 |
| jamielennox | i don't know, it's not a battle i'm worried about | 00:52 |
| ayoung | I guess I tend to think relationally about these. The rule is a separate entity from the role itself | 00:52 |
| jamielennox | as i said we use the PUT X/imples/Y with no data no resp body format in lots of places | 00:52 |
| jamielennox | but yea, i'd love it to just be a function of the standard role api | 00:53 |
| ayoung | jamielennox, also, notmorgan brought up the point of priv escalation. I put in a rule that said admin could not be implied, only explicit | 00:54 |
| jamielennox | yea, there's the admin RBAC problem here | 00:54 |
| ayoung | If all roles were defined via inference, then just putting a "no cycles" would be enough to stop a priv escalation | 00:54 |
| ayoung | limiting the inference to cloud_admin should be sufficient, | 00:55 |
| *** dims_ has quit IRC | 00:55 | |
| jamielennox | testing admin is probably fine, i think adding role implications should be a really priviledged call | 00:55 |
| jamielennox | right | 00:55 |
| ayoung | gyee did not like the one-off rule. Thinking about putting a config option for roles that can't be implied | 00:55 |
| ayoung | with the default being admin | 00:55 |
| jamielennox | henry is going to want to change it all for domain specific roles - i have concerns about that anyway | 00:55 |
| ayoung | I do, too. Specifically, I suspect that what we want to do for domains, we are going to want to do for projects eventually too | 00:56 |
| ayoung | domains should not be special | 00:56 |
| ayoung | but that is the whole namespacing problem all over again | 00:56 |
| jamielennox | i just think we are twisting ourself too much to match what people already have | 00:57 |
| jamielennox | policy is still very static, i'm not sure i want everyone defining there own, yes i understand that basic roles become capabilities etc | 00:57 |
| jamielennox | but i'm still not sure that the cloud admin should define things for their cloud in sufficient detail and people use what is provided | 00:58 |
| jamielennox | i go back and forth between we should make it easy for people to customize to their liking, and damn it just provide something sensible and make everyone conform | 00:59 |
| *** pushkaru has quit IRC | 01:00 | |
| ayoung | jamielennox, I tend more toward that latter myself | 01:02 |
| ayoung | just that what we provide now is not there... | 01:02 |
| *** EinstCrazy has joined #openstack-keystone | 01:15 | |
| *** davechen has joined #openstack-keystone | 01:18 | |
| *** EinstCrazy has quit IRC | 01:24 | |
| *** pushkaru has joined #openstack-keystone | 01:24 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/272790 | 01:27 |
| *** EinstCrazy has joined #openstack-keystone | 01:28 | |
| *** su_zhang has joined #openstack-keystone | 01:29 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/272825 | 01:31 |
| *** jasonsb has joined #openstack-keystone | 01:31 | |
| *** EinstCrazy has quit IRC | 01:32 | |
| *** EinstCrazy has joined #openstack-keystone | 01:35 | |
| *** EinstCrazy has quit IRC | 01:35 | |
| *** davechen1 has joined #openstack-keystone | 01:36 | |
| *** davechen has quit IRC | 01:37 | |
| *** davechen2 has joined #openstack-keystone | 01:43 | |
| *** _cjones_ has joined #openstack-keystone | 01:44 | |
| *** _cjones__ has quit IRC | 01:44 | |
| *** davechen1 has quit IRC | 01:44 | |
| *** EinstCrazy has joined #openstack-keystone | 01:46 | |
| *** davechen has joined #openstack-keystone | 01:55 | |
| *** davechen2 has quit IRC | 01:57 | |
| *** EinstCrazy has quit IRC | 02:07 | |
| *** _cjones_ has quit IRC | 02:11 | |
| *** _cjones_ has joined #openstack-keystone | 02:14 | |
| *** _cjones_ has quit IRC | 02:16 | |
| *** browne has quit IRC | 02:16 | |
| *** RA_ has joined #openstack-keystone | 02:17 | |
| *** spandhe has quit IRC | 02:19 | |
| *** tobe has joined #openstack-keystone | 02:22 | |
| *** woodster_ has quit IRC | 02:26 | |
| *** pushkaru has quit IRC | 02:36 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:37 | |
| *** e0ne has joined #openstack-keystone | 02:41 | |
| *** EinstCrazy has joined #openstack-keystone | 02:42 | |
| *** alexvictorchan has quit IRC | 02:46 | |
| *** alexvictorchan has joined #openstack-keystone | 02:47 | |
| *** e0ne has quit IRC | 02:48 | |
| *** e0ne has joined #openstack-keystone | 02:50 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 02:54 |
| *** e0ne_ has joined #openstack-keystone | 02:54 | |
| *** e0ne has quit IRC | 02:55 | |
| htruta | ayoung, hey | 02:55 |
| htruta | ayoung, looks like on HMT stuff we only use the visitor pattern when we talk about the way we traverse the tree, because there isn't actually a different treatment for visiting a node | 02:57 |
| ayoung | htruta, heh...got you thinking! | 02:57 |
| ayoung | htruta, now, looking to the future. We want to do an operation on a set of nodes under a tree... | 02:57 |
| htruta | ayoung, in a long long future when we have reseller, for example, we might have some different treatment for regular projects and projects acting as domains | 02:59 |
| ayoung | or depending on whether the reseller can see inside them or not. | 02:59 |
| *** richm has quit IRC | 02:59 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Update Implied Role API https://review.openstack.org/273323 | 03:01 |
| htruta | ayoung, true | 03:02 |
| htruta | ayoung, I was wondering if you intend to discuss this with the guys in the midcycle | 03:03 |
| ayoung | htruta, maybe...I have a bout threee majore efforts going on right now, only one is upstream keystone | 03:03 |
| *** spandhe has joined #openstack-keystone | 03:04 | |
| htruta | ayoung, ok. I'll try to fix that by this week... lots of things here too | 03:04 |
| ayoung | focus on what the others are beating you up over...I can live with this as is if needs be. Its not make or break, but it will be better my way. But if it means a nother round of discussions, I can punt. | 03:05 |
| htruta | ayoung, actually, no one is beating. We've agreed that we will have the param ?cascade, instead of the new route | 03:07 |
| ayoung | OK...then all good | 03:07 |
| htruta | ayoung, the point we were not considering was the tree policy check | 03:07 |
| ayoung | OK | 03:07 |
| ayoung | that is the important part | 03:07 |
| *** RA_ has quit IRC | 03:09 | |
| *** browne has joined #openstack-keystone | 03:21 | |
| *** EinstCrazy has quit IRC | 03:31 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 03:33 |
| *** su_zhang has quit IRC | 03:36 | |
| *** EinstCrazy has joined #openstack-keystone | 03:37 | |
| *** shoutm_ has quit IRC | 03:40 | |
| *** roxanaghe has joined #openstack-keystone | 03:42 | |
| *** KarthikB has joined #openstack-keystone | 03:43 | |
| *** yarkot has joined #openstack-keystone | 03:45 | |
| *** shoutm has joined #openstack-keystone | 03:47 | |
| *** e0ne_ has quit IRC | 03:48 | |
| *** EinstCrazy has quit IRC | 03:48 | |
| *** fawadkhaliq has quit IRC | 03:49 | |
| *** EinstCrazy has joined #openstack-keystone | 03:49 | |
| *** roxanaghe has quit IRC | 03:51 | |
| *** roxanaghe has joined #openstack-keystone | 03:52 | |
| *** jdennis1 has joined #openstack-keystone | 03:53 | |
| *** jdennis has quit IRC | 03:53 | |
| *** spandhe has quit IRC | 03:54 | |
| *** shoutm_ has joined #openstack-keystone | 04:01 | |
| *** gyee has joined #openstack-keystone | 04:03 | |
| *** ChanServ sets mode: +v gyee | 04:03 | |
| *** gyee has quit IRC | 04:03 | |
| *** shoutm has quit IRC | 04:04 | |
| *** EinstCrazy has quit IRC | 04:05 | |
| *** e0ne has joined #openstack-keystone | 04:08 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 04:13 |
| *** su_zhang has joined #openstack-keystone | 04:17 | |
| *** vivekd_ has joined #openstack-keystone | 04:29 | |
| *** vivekd has quit IRC | 04:31 | |
| *** vivekd_ is now known as vivekd | 04:31 | |
| *** vivekd has quit IRC | 04:38 | |
| *** e0ne has quit IRC | 04:44 | |
| *** jbell8 has joined #openstack-keystone | 04:44 | |
| *** shoutm has joined #openstack-keystone | 04:46 | |
| *** shoutm_ has quit IRC | 04:49 | |
| *** KarthikB has quit IRC | 04:49 | |
| *** henrynash has joined #openstack-keystone | 04:53 | |
| *** ChanServ sets mode: +v henrynash | 04:53 | |
| *** EinstCrazy has joined #openstack-keystone | 04:53 | |
| *** oomichi has joined #openstack-keystone | 04:54 | |
| *** spandhe has joined #openstack-keystone | 04:57 | |
| *** EinstCrazy has quit IRC | 05:03 | |
| *** spandhe_ has joined #openstack-keystone | 05:03 | |
| *** su_zhang has quit IRC | 05:04 | |
| *** spandhe has quit IRC | 05:04 | |
| *** spandhe_ is now known as spandhe | 05:04 | |
| *** jamielennox is now known as jamielennox|away | 05:05 | |
| *** daemontool has joined #openstack-keystone | 05:05 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/keystone: Use the oslo.utils.reflection to extract the class name https://review.openstack.org/241494 | 05:06 |
| *** roxanaghe has quit IRC | 05:06 | |
| *** RA_ has joined #openstack-keystone | 05:09 | |
| *** EinstCrazy has joined #openstack-keystone | 05:10 | |
| *** su_zhang has joined #openstack-keystone | 05:14 | |
| *** jaosorior has joined #openstack-keystone | 05:21 | |
| *** roxanaghe has joined #openstack-keystone | 05:24 | |
| *** reddy has joined #openstack-keystone | 05:30 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:32 | |
| *** teju has joined #openstack-keystone | 05:44 | |
| *** fawadkhaliq has quit IRC | 05:45 | |
| *** shoutm has quit IRC | 05:47 | |
| *** shoutm has joined #openstack-keystone | 05:48 | |
| *** mc_nair has quit IRC | 06:00 | |
| *** topol has quit IRC | 06:00 | |
| *** spandhe has quit IRC | 06:03 | |
| *** topol_ has joined #openstack-keystone | 06:03 | |
| *** spandhe has joined #openstack-keystone | 06:08 | |
| teju | hi, how to create policies in openstack kilo using openstack/keystone CLI ? | 06:14 |
| *** fawadkhaliq has joined #openstack-keystone | 06:19 | |
| *** henrynash has quit IRC | 06:26 | |
| *** jbell8 has quit IRC | 06:27 | |
| *** spandhe has quit IRC | 06:27 | |
| *** jbell8 has joined #openstack-keystone | 06:27 | |
| *** Nirupama has joined #openstack-keystone | 06:28 | |
| *** jbell8 has quit IRC | 06:30 | |
| *** jbell8 has joined #openstack-keystone | 06:31 | |
| *** EinstCra_ has joined #openstack-keystone | 06:36 | |
| *** EinstCrazy has quit IRC | 06:36 | |
| *** EinstCra_ has quit IRC | 06:37 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Service Providers and Projects associations https://review.openstack.org/264854 | 06:39 |
| *** RA_ has quit IRC | 06:48 | |
| *** jaosorior has quit IRC | 07:03 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 07:07 |
| *** boris-42 has joined #openstack-keystone | 07:17 | |
| *** jaosorior has joined #openstack-keystone | 07:38 | |
| *** roxanaghe has quit IRC | 07:38 | |
| *** su_zhang has quit IRC | 07:41 | |
| *** roxanaghe has joined #openstack-keystone | 07:41 | |
| *** _cjones_ has joined #openstack-keystone | 07:43 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Service Providers and Projects associations https://review.openstack.org/264854 | 07:43 |
| *** lhcheng has joined #openstack-keystone | 07:55 | |
| *** ChanServ sets mode: +v lhcheng | 07:55 | |
| *** _cjones_ has quit IRC | 07:58 | |
| *** belmoreira has joined #openstack-keystone | 07:59 | |
| *** lhcheng has quit IRC | 08:00 | |
| *** david8hu has quit IRC | 08:19 | |
| *** permalac has joined #openstack-keystone | 08:19 | |
| *** david8hu has joined #openstack-keystone | 08:20 | |
| *** pnavarro has joined #openstack-keystone | 08:24 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Make WebSSO trusted_dashboard hostname case-insensitive https://review.openstack.org/273394 | 08:45 |
| *** roxanaghe has quit IRC | 08:58 | |
| *** sinese has joined #openstack-keystone | 09:00 | |
| *** fhubik has joined #openstack-keystone | 09:01 | |
| *** roxanaghe has joined #openstack-keystone | 09:04 | |
| *** roxanaghe has quit IRC | 09:04 | |
| *** browne has quit IRC | 09:08 | |
| *** vgridnev has joined #openstack-keystone | 09:14 | |
| *** jistr has joined #openstack-keystone | 09:16 | |
| *** fhubik is now known as fhubik_brb | 09:17 | |
| *** fhubik_brb is now known as fhubik | 09:21 | |
| *** jaosorior has quit IRC | 09:21 | |
| *** jaosorior has joined #openstack-keystone | 09:22 | |
| marekd | samueldmq: so, did you already -2 something? :-) | 09:22 |
| *** EinstCrazy has joined #openstack-keystone | 09:31 | |
| *** jaosorior has quit IRC | 09:34 | |
| *** mhickey has joined #openstack-keystone | 09:35 | |
| *** jaosorior has joined #openstack-keystone | 09:35 | |
| *** pnavarro has quit IRC | 09:35 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Consolidate `test_contrib_ec2.py` into `test_credential.py` https://review.openstack.org/271886 | 09:37 |
| davechen | marekd: all fixed up. | 09:37 |
| davechen | marekd: i am not sure if we should split the patch into smaller ones. | 09:38 |
| marekd | davechen: i think it's fine | 09:39 |
| marekd | i am actually working already on another step | 09:39 |
| marekd | on top of that one. | 09:39 |
| marekd | anyway, thanks for the help! | 09:39 |
| davechen | marekd: call the api? | 09:39 |
| davechen | to filter the sp in the token response? | 09:40 |
| marekd | davechen: no, service providers groups! | 09:40 |
| davechen | marekd: got you. | 09:40 |
| *** jistr is now known as jistr|biab | 09:43 | |
| marekd | davechen: will add you to the reviewers list. | 09:43 |
| *** wanghua has quit IRC | 09:44 | |
| davechen | marekd: sure. | 09:44 |
| davechen | marekd: i forgot to comment on that patch. | 09:44 |
| davechen | marekd: we should make all of those experimental. | 09:44 |
| davechen | marekd: currently, it's not | 09:44 |
| davechen | marekd: will address it later since i am going to catch up the shuttle. | 09:45 |
| marekd | uhu | 09:45 |
| davechen | i think those api should be experimental at first. | 09:45 |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 09:50 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Service Providers and Projects associations https://review.openstack.org/264854 | 09:54 |
| davechen | marekd: done | 09:54 |
| marekd | done what | 09:54 |
| davechen | marekd: the last mins :) | 09:54 |
| davechen | marked all those api as experimental | 09:54 |
| *** davechen has left #openstack-keystone | 09:55 | |
| *** fawadkhaliq has quit IRC | 09:57 | |
| marekd | ok cool :) | 09:57 |
| *** fawadkhaliq has joined #openstack-keystone | 09:58 | |
| *** sinese has quit IRC | 10:05 | |
| *** rcernin has joined #openstack-keystone | 10:18 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers Group CRUD operations. https://review.openstack.org/273438 | 10:23 |
| *** aix has joined #openstack-keystone | 10:42 | |
| *** fawadkhaliq has quit IRC | 10:42 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:42 | |
| *** jistr|biab is now known as jistr | 10:57 | |
| *** permalac has quit IRC | 10:57 | |
| *** jbell8 has quit IRC | 11:02 | |
| *** fhubik is now known as fhubik_brb | 11:07 | |
| *** fhubik_brb is now known as fhubik | 11:07 | |
| *** dims has joined #openstack-keystone | 11:07 | |
| *** fhubik is now known as fhubik_brb | 11:09 | |
| *** apetrov has joined #openstack-keystone | 11:19 | |
| *** tobe has quit IRC | 11:41 | |
| *** sinese has joined #openstack-keystone | 11:46 | |
| *** aix has quit IRC | 11:46 | |
| *** fhubik_brb is now known as fhubik | 11:47 | |
| *** jdennis1 has quit IRC | 11:47 | |
| *** jdennis has joined #openstack-keystone | 11:47 | |
| *** sinese has quit IRC | 11:47 | |
| *** sinese has joined #openstack-keystone | 11:48 | |
| *** shoutm_ has joined #openstack-keystone | 11:48 | |
| *** shoutm has quit IRC | 11:48 | |
| *** teju has quit IRC | 11:49 | |
| *** doug-fish has joined #openstack-keystone | 11:49 | |
| *** sinese has quit IRC | 11:53 | |
| *** roxanaghe has joined #openstack-keystone | 12:04 | |
| *** e0ne has joined #openstack-keystone | 12:06 | |
| *** roxanaghe has quit IRC | 12:09 | |
| *** fhubik is now known as fhubik_brb | 12:17 | |
| *** aix has joined #openstack-keystone | 12:17 | |
| *** sinese has joined #openstack-keystone | 12:18 | |
| *** pauloewerton has joined #openstack-keystone | 12:21 | |
| *** raildo-afk is now known as raildo | 12:25 | |
| *** e0ne has quit IRC | 12:27 | |
| *** daemontool_ has joined #openstack-keystone | 12:27 | |
| *** e0ne has joined #openstack-keystone | 12:27 | |
| *** daemontool has quit IRC | 12:28 | |
| *** tobe has joined #openstack-keystone | 12:41 | |
| *** fhubik_brb is now known as fhubik | 12:43 | |
| *** amakarov has joined #openstack-keystone | 12:44 | |
| *** dims has quit IRC | 12:47 | |
| openstackgerrit | Andreas Jaeger proposed openstack/python-keystoneclient: Update translation setup https://review.openstack.org/273510 | 12:48 |
| *** mattt has joined #openstack-keystone | 12:49 | |
| *** bill_az has joined #openstack-keystone | 12:52 | |
| odyssey4me | dolphm dstanek lbragstad notmorgan hughsaunders mattt Coming back to the discussion from https://review.openstack.org/271357 - it would appear that catalogue caching was actually implemented in Kilo and Liberty too... and we seem to be picking up similar behaviour in Kilo. This is not entirely certain yet as we're not seeing it nearly as often, but we are seeing some failures of the same sort. | 12:52 |
| *** daemontool_ has quit IRC | 12:53 | |
| dstanek | odyssey4me: you are frequently editing the catalog? | 12:55 |
| odyssey4me | dstanek the issue arises when we're standing up a new environment - the issue shows because after setting up the services we're immediately running tests against it | 12:59 |
| odyssey4me | the environment is setup with multiple service hosts (ie two keystone, two glance api, etc) | 12:59 |
| odyssey4me | hughsaunders is digging into it | 13:00 |
| *** shoutm_ has quit IRC | 13:03 | |
| samueldmq | morning all | 13:06 |
| samueldmq | marekd: hey, not yet :) | 13:06 |
| *** tobe has quit IRC | 13:09 | |
| *** ninag has joined #openstack-keystone | 13:10 | |
| marekd | samueldmq: but you are not at the midcycle, are you? | 13:10 |
| samueldmq | marekd: yes I am, davechen isn't :( | 13:12 |
| marekd | samueldmq: i was wondering where did this photo from Brad's tweet was coming from | 13:12 |
| marekd | samueldmq: ah, cool! | 13:12 |
| marekd | samueldmq: so we switched, as i am missing too this time :-) | 13:13 |
| samueldmq | marekd: hehe yes he took the photo there at the midcycle | 13:15 |
| *** peter-hamilton has joined #openstack-keystone | 13:16 | |
| samueldmq | marekd: you should go to next, which is probably going to happen in Brazil :-) | 13:16 |
| marekd | samueldmq: yeah, makes sense | 13:16 |
| marekd | samueldmq: wat? | 13:16 |
| marekd | who said that? | 13:16 |
| samueldmq | marekd: yep, that | 13:17 |
| samueldmq | marekd: next midcycle in Brazil | 13:17 |
| *** fawadkhaliq has quit IRC | 13:17 | |
| *** jsavak has joined #openstack-keystone | 13:17 | |
| *** jsavak has quit IRC | 13:17 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:17 | |
| *** jsavak has joined #openstack-keystone | 13:17 | |
| marekd | but who decided that? | 13:17 |
| samueldmq | marekd: well, that's the idea, see https://etherpad.openstack.org/p/keystone-mitaka-midcycle | 13:17 |
| samueldmq | marekd: first topic of discussion | 13:18 |
| marekd | samueldmq: what time is there now? | 13:20 |
| samueldmq | marekd: 7:20 am here | 13:21 |
| marekd | ah yes | 13:21 |
| marekd | 7 hours diff | 13:21 |
| marekd | samueldmq: i will try to dial in for the hangouts | 13:25 |
| marekd | stevemar: I am reading backlog from midcycle etherpad. Just a heads up that I got a feedback from some operators that they would like to see some 'user expiration' and I see shadow users are trying to somehow address that. | 13:26 |
| samueldmq | marekd: cool, ayoung did this yesterday, so he could participate | 13:28 |
| marekd | samueldmq: did he call in for a whole day? | 13:28 |
| samueldmq | marekd: most part of it | 13:28 |
| openstackgerrit | Andreas Jaeger proposed openstack/python-keystoneclient: Update translation setup https://review.openstack.org/273510 | 13:28 |
| *** e0ne has quit IRC | 13:29 | |
| *** fhubik is now known as fhubik_brb | 13:30 | |
| marekd | ok, i will call in for the beginning of the day | 13:30 |
| *** RA_ has joined #openstack-keystone | 13:31 | |
| *** Nirupama has quit IRC | 13:38 | |
| *** fhubik_brb is now known as fhubik | 13:41 | |
| *** henrynash has joined #openstack-keystone | 13:41 | |
| *** ChanServ sets mode: +v henrynash | 13:41 | |
| *** avarner has joined #openstack-keystone | 13:50 | |
| htruta | henrynash: hi. regarding bug 1440107. If I understand correctly, the problem is only that we should have an option to delete only group or only user assignments | 13:51 |
| openstack | bug 1440107 in OpenStack Identity (keystone) "Clearing up project assignments makes assumptions that domain_id != project_id" [Low,Triaged] https://launchpad.net/bugs/1440107 | 13:51 |
| htruta | right? | 13:51 |
| *** avarner has quit IRC | 13:52 | |
| *** RA_ has quit IRC | 13:52 | |
| *** amakarov has quit IRC | 13:52 | |
| ayoung | marekd, I called in for the whole group portion. Once they broke down into small teams I signed off. | 13:57 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split assignment backend tests https://review.openstack.org/268307 | 13:57 |
| *** richm has joined #openstack-keystone | 13:58 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split resource backend tests https://review.openstack.org/268702 | 13:58 |
| *** jed56 has joined #openstack-keystone | 13:58 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split token backend tests https://review.openstack.org/269111 | 13:59 |
| *** jsavak has quit IRC | 13:59 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split trust backend tests https://review.openstack.org/269115 | 13:59 |
| *** jsavak has joined #openstack-keystone | 14:00 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split catalog backend tests https://review.openstack.org/269125 | 14:00 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split policy backend tests https://review.openstack.org/269133 | 14:01 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split identity backend tests https://review.openstack.org/269148 | 14:02 |
| samueldmq | tjcocozz: ^ | 14:04 |
| marekd | ayoung: cool1 | 14:04 |
| marekd | i will try calling in today | 14:04 |
| *** jsavak has quit IRC | 14:06 | |
| *** jsavak has joined #openstack-keystone | 14:06 | |
| *** ericksonsantos has joined #openstack-keystone | 14:09 | |
| openstackgerrit | Andreas Jaeger proposed openstack/python-keystoneclient: Update translation setup https://review.openstack.org/273510 | 14:12 |
| *** henrynash has quit IRC | 14:16 | |
| *** e0ne has joined #openstack-keystone | 14:19 | |
| *** phalmos has quit IRC | 14:23 | |
| ayoung | bknudson, we need a better way to debug failures like this http://logs.openstack.org/14/242614/63/check/gate-keystone-python27/5f5d65c/testr_results.html.gz comparing JSON home outputs is painful | 14:26 |
| *** reddy has quit IRC | 14:27 | |
| *** permalac has joined #openstack-keystone | 14:29 | |
| *** paul-carlton2 has joined #openstack-keystone | 14:41 | |
| *** jsavak has quit IRC | 14:42 | |
| *** thiagolib has joined #openstack-keystone | 14:42 | |
| *** jsavak has joined #openstack-keystone | 14:43 | |
| *** fawadkhaliq has quit IRC | 14:51 | |
| *** tonytan4ever has joined #openstack-keystone | 14:52 | |
| *** pushkaru has joined #openstack-keystone | 14:52 | |
| *** amakarov has joined #openstack-keystone | 15:01 | |
| *** topol_ is now known as topol | 15:03 | |
| *** ChanServ sets mode: +v topol | 15:03 | |
| *** slberger has joined #openstack-keystone | 15:05 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 15:07 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:08 | |
| *** dims has joined #openstack-keystone | 15:08 | |
| tjcocozz | samueldmq, i'm on it! | 15:09 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add tests for role management with v3policy file https://review.openstack.org/261846 | 15:09 |
| bknudson | ayoung: yes, the output could be better. I think I had to copy-paste the jsons into a couple text files to compare | 15:11 |
| bknudson | maybe testtools has a better way to show diffs in strings. | 15:11 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add CRUD support for domain specific roles https://review.openstack.org/261870 | 15:12 |
| bknudson | this also happened recently when I was trying to switch the saml files from lxml to built-in xml | 15:12 |
| ayoung | bknudson, it happened when I converted the URLs for implied roles in the latest revision | 15:12 |
| ayoung | https://review.openstack.org/#/c/242614/61..64/keystone/assignment/routers.py bknudson | 15:13 |
| *** edmondsw has joined #openstack-keystone | 15:14 | |
| ayoung | oh probably just drop the implied from the test... | 15:14 |
| bknudson | the way we're doing JSON home validation is probably overkill now. | 15:14 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules in the v3 policy sample for domain specifc roles https://review.openstack.org/262078 | 15:14 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify implied roles to honor domain specific roles https://review.openstack.org/263064 | 15:15 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules for domain specific role assignments https://review.openstack.org/263549 | 15:15 |
| ayoung | bknudson, you guys started there, yet? | 15:17 |
| bknudson | ayoung: not yet | 15:17 |
| bknudson | rackspace people aren't here yet | 15:17 |
| edmondsw | ayoung, henry says implied roles tests are still failing, fyi | 15:17 |
| *** phalmos has joined #openstack-keystone | 15:17 | |
| ayoung | edmondsw, yeah, the version tests. JSON Home stuff | 15:18 |
| edmondsw | yep | 15:18 |
| ayoung | workingon that now...and tripleo at the same time | 15:18 |
| ayoung | edmondsw, just got it to work. New version in a moment | 15:18 |
| edmondsw | cool | 15:18 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 15:19 |
| ayoung | edmondsw, so, I didn't change the data that came back from the rest calls, just the URLs themselves. | 15:19 |
| ayoung | It was not until this morning that I realized that might not have been what you meant | 15:19 |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 15:20 |
| edmondsw | I was thinking that whenever you get a role, you'd see in it's json what it implies and what is implied by it | 15:20 |
| edmondsw | as well as changing the paths | 15:21 |
| edmondsw | but I haven't looked at your new changes yet | 15:21 |
| *** tonytan_brb has joined #openstack-keystone | 15:23 | |
| *** fhubik has quit IRC | 15:23 | |
| *** tonytan_brb has quit IRC | 15:23 | |
| *** tonytan_brb has joined #openstack-keystone | 15:24 | |
| *** timcline has joined #openstack-keystone | 15:25 | |
| *** fhubik has joined #openstack-keystone | 15:25 | |
| notmorgan | odyssey4me: def. let me know what you find | 15:25 |
| notmorgan | stevemar: https://review.openstack.org/#/c/272007/ | 15:26 |
| *** tonytan4ever has quit IRC | 15:26 | |
| *** fhubik has quit IRC | 15:27 | |
| *** diazjf has joined #openstack-keystone | 15:27 | |
| notmorgan | stevemar: do you have the Zetta.io folks email addrs? | 15:31 |
| notmorgan | stevemar: or can you get me a test account so i can verify the OCC stuff? | 15:31 |
| notmorgan | [I can't get the SMS verify to work because... probably SMS is weird] | 15:31 |
| *** raildo is now known as raildo-afk | 15:33 | |
| marekd | stevemar: notmorgan looks like you guys are not connected to the Google hangout room | 15:33 |
| *** spzala has joined #openstack-keystone | 15:33 | |
| *** su_zhang has joined #openstack-keystone | 15:33 | |
| stevemar | marekd: brad will connect | 15:33 |
| marekd | stevemar: OKAY | 15:34 |
| marekd | whenever you want. | 15:34 |
| marekd | topol: i called in Call-in: 1-888-426-6840 (21899776) | 15:36 |
| marekd | yet "the host has not yet arrived" ? | 15:36 |
| marekd | us number is fine i can use google voide | 15:36 |
| marekd | voice | 15:37 |
| ayoung | calling in now | 15:37 |
| samueldmq | tjcocozz: https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:bp/project-tree-deletion | 15:37 |
| *** AJaeger has quit IRC | 15:37 | |
| marekd | ayoung: 1-888-426-6840 ? | 15:37 |
| ayoung | marekd, yeah | 15:38 |
| marekd | topol: ayoung ok i am in | 15:39 |
| *** jsavak has quit IRC | 15:39 | |
| *** jsavak has joined #openstack-keystone | 15:40 | |
| topol | mared, ayoung, Ok good | 15:40 |
| *** KarthikB has joined #openstack-keystone | 15:41 | |
| *** mgarza_ has joined #openstack-keystone | 15:45 | |
| *** alexvictorchan has quit IRC | 15:46 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Reuse project scoped token check for trusts https://review.openstack.org/253672 | 15:46 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add checks for domain scoped data creep https://review.openstack.org/253671 | 15:46 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add checks for project scoped data creep to tests https://review.openstack.org/253670 | 15:46 |
| *** narengan has joined #openstack-keystone | 16:01 | |
| *** vgridnev has quit IRC | 16:07 | |
| *** vgridnev has joined #openstack-keystone | 16:07 | |
| *** aix has quit IRC | 16:08 | |
| *** vgridnev has quit IRC | 16:12 | |
| *** browne has joined #openstack-keystone | 16:13 | |
| stevemar | ayoung: we're looking at: http://docs-draft.openstack.org/96/272396/2/check/gate-keystone-specs-docs/94c8fed//doc/build/html/specs/newton/pci-dss.html | 16:13 |
| *** su_zhang has quit IRC | 16:25 | |
| *** shaleh has joined #openstack-keystone | 16:25 | |
| shaleh | dolphm: re: tracing metaclass for Manager instances. What are you looking for? | 16:26 |
| *** clenimar has joined #openstack-keystone | 16:26 | |
| dolphm | shaleh: i want to know when we actually hit manager methods, and what the arguments are | 16:27 |
| *** KarthikB has quit IRC | 16:27 | |
| dolphm | shaleh: in contrast to cache hits, where dogpile is crazy verbose | 16:27 |
| shaleh | dolphm: any method of a Manager or just a certain set of them? | 16:27 |
| dolphm | shaleh: all of them | 16:27 |
| dolphm | shaleh: i just want good logging at that layer | 16:27 |
| shaleh | dolphm: have you seen autologging? https://github.com/mzipay/Autologging you decorate the class with '@traced' and logging happens. We could probably hack that to use oslo_logging instead. | 16:28 |
| *** su_zhang has joined #openstack-keystone | 16:28 | |
| shaleh | dolphm: so the question is how much more than that do we need? | 16:29 |
| stevemar | ayoung: did i hang up? | 16:29 |
| shaleh | dolphm: I can take this on. I just want to be sure I have captured your use cases. | 16:30 |
| *** belmoreira has quit IRC | 16:31 | |
| *** jbell8 has joined #openstack-keystone | 16:32 | |
| ayoung | stevemar, it is all muffled at this point | 16:32 |
| marekd | i am stalled as well | 16:32 |
| marekd | i am back now | 16:33 |
| marekd | stevemar: | 16:33 |
| *** jbell8 has quit IRC | 16:35 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:35 | |
| *** jbell8 has joined #openstack-keystone | 16:35 | |
| *** paul-carlton2 has quit IRC | 16:36 | |
| *** raildo-afk is now known as raildo | 16:37 | |
| *** KarthikB has joined #openstack-keystone | 16:38 | |
| *** clenimar has left #openstack-keystone | 16:42 | |
| *** clenimar_ has joined #openstack-keystone | 16:42 | |
| *** clenimar has joined #openstack-keystone | 16:45 | |
| dolphm | http://www.isaca.org/Groups/Professional-English/pci-compliance/GroupDocuments/Meet%20PCI%20DSS%20Requirements%20with%20FOSS.pdf | 16:46 |
| *** cdcasey has joined #openstack-keystone | 16:48 | |
| stevemar | marekd: ayoung we took a break | 16:50 |
| *** amakarov_ has joined #openstack-keystone | 16:51 | |
| *** amakarov has quit IRC | 16:51 | |
| *** _cjones_ has joined #openstack-keystone | 16:52 | |
| *** _cjones_ has quit IRC | 16:54 | |
| *** _cjones_ has joined #openstack-keystone | 16:55 | |
| marekd | stevemar: i can hear that. | 16:55 |
| marekd | anyways, i need to run | 16:55 |
| marekd | so i logged out | 16:55 |
| *** spzala has quit IRC | 16:55 | |
| *** alexvictorchan has joined #openstack-keystone | 16:56 | |
| notmorgan | bknudson: https://review.openstack.org/253793 | 16:57 |
| stevemar | marekd: alrighty | 16:57 |
| stevemar | marekd: thx for joining | 16:57 |
| *** jed56 has quit IRC | 17:03 | |
| *** arunkant_ has joined #openstack-keystone | 17:04 | |
| *** diazjf1 has joined #openstack-keystone | 17:05 | |
| *** tonytan_brb has quit IRC | 17:07 | |
| *** csoukup has joined #openstack-keystone | 17:08 | |
| *** diazjf has quit IRC | 17:09 | |
| dstanek | stevemar: http://docs.openstack.org/developer/nova/upgrade.html#process | 17:09 |
| *** KarthikB has quit IRC | 17:10 | |
| *** tonytan4ever has joined #openstack-keystone | 17:11 | |
| *** su_zhang has quit IRC | 17:11 | |
| *** su_zhang has joined #openstack-keystone | 17:12 | |
| *** e0ne has quit IRC | 17:15 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:16 | |
| bknudson | https://etherpad.openstack.org/p/mitaka-crossproject-upgrades | 17:17 |
| *** woodster_ has joined #openstack-keystone | 17:19 | |
| *** jaosorior has quit IRC | 17:21 | |
| *** jaosorior has joined #openstack-keystone | 17:22 | |
| *** KarthikB has joined #openstack-keystone | 17:24 | |
| *** permalac has quit IRC | 17:25 | |
| *** tristanC has joined #openstack-keystone | 17:26 | |
| tristanC | bknudson: greeting sir, I've a question about bug 1490804. To fix that issue, one need both keystone and keystone middleware patch right ? | 17:27 |
| openstack | bug 1490804 in OpenStack Security Advisory "PKI Token Revocation Bypass (CVE-2015-7546)" [Undecided,Confirmed] https://launchpad.net/bugs/1490804 | 17:27 |
| bknudson | tristanC: yes, you need to update keystone and keystonemiddleware | 17:27 |
| *** su_zhang has quit IRC | 17:29 | |
| tristanC | bknudson: alright thanks. One more thing... I've started the ossa wrap-up, can you confirm me that so far, only the stable/kilo patch of keystone has been tagged, is this correct ? | 17:31 |
| bknudson | checking. | 17:31 |
| *** raildo is now known as raildo-afk | 17:31 | |
| tristanC | e.g.: https://review.openstack.org/#/c/273679/1/ossa/OSSA-2016-005.yaml | 17:31 |
| tristanC | bknudson: thank you! that's very appreciated, I often get confused by the release model of middlewares | 17:33 |
| bknudson | tristanC: my notes say that all the work is complete... let me check quick | 17:33 |
| bknudson | oh, it might be merged but not released yet. | 17:33 |
| tristanC | using git tag --contains with all merged sha1 only showed 2015.1.3 | 17:34 |
| *** su_zhang has joined #openstack-keystone | 17:37 | |
| *** jistr has quit IRC | 17:38 | |
| bknudson | tristanC: the keystonemiddleware change hasn't been released on stable/liberty or stable/kilo | 17:43 |
| bknudson | stable/liberty would be 2.3.3 and stable/kilo would be 1.5.4. | 17:43 |
| bknudson | the changes are merged but not released. | 17:43 |
| *** mhickey has quit IRC | 17:45 | |
| *** mhickey has joined #openstack-keystone | 17:45 | |
| tristanC | nice, so OSSA version numbers are correct. thank! | 17:45 |
| *** browne has quit IRC | 17:46 | |
| *** timcline has quit IRC | 17:49 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Time-based One-time Password https://review.openstack.org/130376 | 17:50 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Add spec for multifactor authentication https://review.openstack.org/272287 | 17:50 |
| *** diazjf1 has quit IRC | 17:50 | |
| *** mhickey has quit IRC | 17:53 | |
| *** diazjf has joined #openstack-keystone | 17:56 | |
| *** narengan has quit IRC | 17:56 | |
| *** diazjf has quit IRC | 17:57 | |
| *** diazjf has joined #openstack-keystone | 18:02 | |
| *** rodrigods has quit IRC | 18:03 | |
| *** rodrigods has joined #openstack-keystone | 18:03 | |
| clenimar | samueldmq, hey there! | 18:07 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 18:07 |
| clenimar | samueldmq, have you seen last comment on bug #1294735? | 18:08 |
| openstack | bug 1294735 in OpenStack Identity (keystone) "Disable domain doesn't disable users in the domain" [Medium,Triaged] https://launchpad.net/bugs/1294735 | 18:08 |
| *** SpamapS has joined #openstack-keystone | 18:09 | |
| SpamapS | notmorgan: here I mean. :) | 18:09 |
| notmorgan | yessss | 18:09 |
| notmorgan | SpamapS: so ftr you're seeing mod_wsgi only occupy 5 HTTPD workers no matter how many backend processes are running? | 18:09 |
| notmorgan | and how are the mod_wsgi workers looking (load wise)? | 18:10 |
| SpamapS | notmorgan: all of them are using about 110 - 120 % CPU | 18:10 |
| SpamapS | so the threads are a little busy | 18:10 |
| notmorgan | and 3rd bit of info, this is neutron+nova hammering keystone with effectively unlimited resources | 18:10 |
| notmorgan | (insane cpu/ram controller node) | 18:10 |
| SpamapS | 128G ram, 48 cores | 18:10 |
| notmorgan | ok and running memcache? | 18:11 |
| SpamapS | neutron-server is set to have 8 worker processes | 18:11 |
| SpamapS | yeah memcache is primarily what they're doing | 18:11 |
| SpamapS | I mean, from an I/O standpoint | 18:11 |
| notmorgan | right | 18:11 |
| notmorgan | expected. | 18:11 |
| notmorgan | hmm. how does the memcache process health/connection count look? | 18:11 |
| notmorgan | not hitting like nofile limit there or anything? | 18:12 |
| SpamapS | no, I did check that | 18:12 |
| SpamapS | it's humming along | 18:12 |
| notmorgan | cool. i figured but worth asking | 18:12 |
| SpamapS | Not that many connections really, couple hundred | 18:12 |
| notmorgan | ok. thats quite reasonable | 18:13 |
| *** edmondsw has quit IRC | 18:13 | |
| notmorgan | so the question is how come we're pegging a small number of HTTPd processes when there are a bunch more running [load isn't being shared around much]? | 18:13 |
| *** boris-42 has quit IRC | 18:13 | |
| notmorgan | but the mod_wsgi workers are all receiving reaosnable load [sorry for re-iterating, trying to shift brain context from code -> ops] | 18:14 |
| SpamapS | Yeah I'd expect there to be like, 8 or nine, all under 100% | 18:14 |
| notmorgan | and you said ~70 HTTPD workers or so active on the system | 18:14 |
| SpamapS | let me fire up the test again so I can see the load | 18:14 |
| notmorgan | ok | 18:14 |
| notmorgan | cool | 18:14 |
| *** timothy_3ymanczy has joined #openstack-keystone | 18:14 | |
| SpamapS | as far as "what is the cloud doing"... 30 threads spinning up and deleting 3000 vms | 18:15 |
| SpamapS | in 300 projects | 18:15 |
| notmorgan | right | 18:15 |
| notmorgan | that is not unreasonable by any stretch of the imagination | 18:15 |
| SpamapS | with 1000 fake hypervisors | 18:15 |
| notmorgan | right | 18:15 |
| SpamapS | Oh there's a midcycle going on | 18:16 |
| notmorgan | yesh | 18:16 |
| SpamapS | so you can discuss w/ peers! ;-) | 18:16 |
| notmorgan | exactly! | 18:16 |
| SpamapS | happy to give anyone qualified root on these boxes to poke around | 18:17 |
| notmorgan | i'm sitting here at the IBM offices in austin chatting over lunch now | 18:17 |
| notmorgan | ooh i'll take that access! ;) | 18:17 |
| SpamapS | which mid cycle is htat? | 18:17 |
| notmorgan | Keystone's | 18:17 |
| notmorgan | i mean... it's totally the right one | 18:17 |
| SpamapS | awesome | 18:17 |
| SpamapS | so | 18:17 |
| SpamapS | funny storry | 18:17 |
| SpamapS | story | 18:18 |
| SpamapS | it's not happening anymore | 18:18 |
| notmorgan | AHA | 18:18 |
| SpamapS | all the httpd's are being used | 18:18 |
| notmorgan | hehe | 18:18 |
| notmorgan | well if it starts happening again i def. want to know! | 18:18 |
| notmorgan | maybe something lingering was hanging on to the old processes/config? | 18:18 |
| SpamapS | I kind of wonder if just aggressively restarting httpd didn't solve it while things were busy | 18:18 |
| SpamapS | Yeah thats what I wonder | 18:19 |
| SpamapS | we're back to being limited by the number of nova-scheduler's | 18:19 |
| notmorgan | ohhhh yeah https aggressive restarts are... wonky under load | 18:19 |
| SpamapS | well I tried gracefu | 18:19 |
| SpamapS | graceful | 18:19 |
| notmorgan | yeah that isn't going to help for a LOOONG run | 18:19 |
| notmorgan | you need to be much more aggressive with mod_wsgi underload | 18:19 |
| SpamapS | I'd think it would, since it closes even kept alive connections | 18:19 |
| notmorgan | it will hang onto things for a looooooong time | 18:19 |
| notmorgan | mod_wsgi is weird | 18:20 |
| SpamapS | oh does mod_wsgi change the graceful handling? | 18:20 |
| notmorgan | sortof | 18:20 |
| notmorgan | apache does a bad job of owning subordinate non-httpd processes | 18:20 |
| notmorgan | this is the reason why in gate we have a apache-stop, sleep, apache-start vs an apache-restart | 18:20 |
| SpamapS | makes perfect sense | 18:21 |
| notmorgan | and some folks here were having the exact same issue | 18:21 |
| SpamapS | notmorgan: I kind of wonder sometimes if bad signal handling is the reason containers are so popular. ;) | 18:22 |
| notmorgan | mod_wsgi is a great "production capable" reference wsgi impl | 18:22 |
| notmorgan | it just has edge cases that have been around since apache 1.2 | 18:22 |
| notmorgan | and it's not easy to solve | 18:22 |
| notmorgan | but you also don't really hit them until load+scale | 18:22 |
| notmorgan | most dpeloyments of apache don't do this model or are small enough to see it infrequently | 18:22 |
| SpamapS | I didn't realize it didn't just run inside an httpd space like mod_php does | 18:23 |
| SpamapS | I've got no ops experience with mod_wsgi. mod_php I know how to make fly (well.. I did.. until fastcgi got so good there's no reason to use mod_php ;) | 18:23 |
| notmorgan | it is a separate process | 18:23 |
| notmorgan | since we use daemon mod | 18:23 |
| notmorgan | mode* | 18:23 |
| notmorgan | we can do it like mod_php but there are lots and lots of issues | 18:23 |
| notmorgan | mod_python is aslo terribad compared to mod_php | 18:24 |
| SpamapS | Python's a very different animal. :) | 18:24 |
| notmorgan | exactly | 18:24 |
| SpamapS | anyway | 18:24 |
| SpamapS | this felt very corner case too | 18:24 |
| SpamapS | in our production deploy, we actually just spin up lots of keystone vms to handle this stuff | 18:24 |
| SpamapS | each one with processes=5 and threads=5 | 18:24 |
| SpamapS | and 8 vcpu, 16G of RAM | 18:25 |
| SpamapS | so that's likely why we haven't seen it in our usual scale testing | 18:25 |
| notmorgan | yar | 18:25 |
| *** timcline has joined #openstack-keystone | 18:25 | |
| notmorgan | also, new change to keystone landing soon(ish) should make keystone improve token throughput more | 18:26 |
| *** fawadkhaliq has quit IRC | 18:26 | |
| notmorgan | well two changes | 18:26 |
| notmorgan | so we'll mve even further down the stack of "bottlenecks" | 18:26 |
| *** timothy_3ymanczy is now known as tsymanczyk | 18:27 | |
| samueldmq | ayoung: could you check my comment on https://review.openstack.org/#/c/273323 | 18:29 |
| ayoung | samueldmq, in this case it does not read right as roles | 18:30 |
| ayoung | the role (prior role id) implies the role (implied role id) | 18:30 |
| ayoung | samueldmq, especially for this API it is a singular | 18:31 |
| *** ajmiller has quit IRC | 18:31 | |
| ayoung | samueldmq, but for all these APIs, the singular makes sense since it is more closely associated with the first id, and they are all one to one or one to many relations | 18:31 |
| *** csoukup has quit IRC | 18:33 | |
| *** browne has joined #openstack-keystone | 18:33 | |
| *** e0ne has joined #openstack-keystone | 18:34 | |
| *** jaosorior has quit IRC | 18:35 | |
| *** timcline has quit IRC | 18:35 | |
| *** jaosorior has joined #openstack-keystone | 18:35 | |
| *** spandhe has joined #openstack-keystone | 18:35 | |
| samueldmq | ayoung: for me, /roles is a set of roles | 18:37 |
| *** jsavak has quit IRC | 18:37 | |
| samueldmq | ayoung: /roles/{id} is a singular thing | 18:37 |
| ayoung | samueldmq, in this case, it is an association between one and the other | 18:37 |
| samueldmq | ayoung: so /roles/{id}/implies... does make sense | 18:37 |
| ayoung | roles implies a collection | 18:37 |
| ayoung | it doesn't read right | 18:37 |
| ayoung | Engineers Sam talks to Adam...? | 18:38 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add tests for role management with v3policy file https://review.openstack.org/261846 | 18:38 |
| ayoung | taking one lefts | 18:38 |
| ayoung | it would make sense if it were /roles/a+b+c/imply/d | 18:39 |
| samueldmq | ayoung: but we already have: give me ROLES X | 18:39 |
| *** jsavak has joined #openstack-keystone | 18:39 | |
| ayoung | no, give me all roles implied by role x | 18:40 |
| samueldmq | ayoung: give me ENGINEERS a | 18:40 |
| samueldmq | that's what we have | 18:40 |
| ayoung | samueldmq, I'd be more prone to change elsewhere... | 18:40 |
| ayoung | lets see. | 18:40 |
| *** diazjf has left #openstack-keystone | 18:40 | |
| *** diazjf has joined #openstack-keystone | 18:40 | |
| *** diazjf has quit IRC | 18:41 | |
| ayoung | samueldmq, we have GET /role/{prior_role_id}/implies | 18:41 |
| ayoung | samueldmq, now, if it were: GET /roles/implied_by/{prior_role_id} I'd agree with you | 18:42 |
| ayoung | or | 18:42 |
| ayoung | GET /roles?implied_by={prior_role_id} I'd agree with you | 18:42 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:42 | |
| *** diazjf has joined #openstack-keystone | 18:42 | |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: Add backend support for deleting a projects list https://review.openstack.org/245916 | 18:43 |
| ayoung | samueldmq, ya dig? | 18:44 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Time-based One-time Password https://review.openstack.org/130376 | 18:44 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Add spec for multifactor authentication https://review.openstack.org/272287 | 18:44 |
| samueldmq | ayoung: I agree with those too, but actually that still makes sense to me | 18:45 |
| ayoung | samueldmq, I'd ask you to remove the -1 on that, but lets hold off on merging it until the Applied Role API change itself is approved, to ensure that I reflects what is implemented | 18:46 |
| samueldmq | ayoung: because that's how we're doing for all entities | 18:46 |
| samueldmq | ayoung: yes, and let's see other's opinions on that too | 18:46 |
| ayoung | samueldmq, for most API, is is singular for a single entity and plural for lists | 18:46 |
| samueldmq | ayoung: henry looks to be in agreement with me | 18:46 |
| samueldmq | ayoung: roles/{id} users/{id} are both a single entity | 18:47 |
| samueldmq | ayoung: and are in plural | 18:47 |
| samueldmq | brb | 18:47 |
| ayoung | samueldmq, you are right...I'll fix | 18:49 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Update Implied Role API https://review.openstack.org/273323 | 18:52 |
| *** timcline has joined #openstack-keystone | 18:53 | |
| clenimar | samueldmq, have you seen last comment on bug #1294735? I've reproduced it here and although the enabled flag remains true, I'm not able to get a new token. Looks like an invalid bug to me, right? | 18:55 |
| openstack | bug 1294735 in OpenStack Identity (keystone) "Disable domain doesn't disable users in the domain" [Medium,Triaged] https://launchpad.net/bugs/1294735 | 18:55 |
| openstackgerrit | Merged openstack/keystonemiddleware: Remove unnecessary _reject_request function https://review.openstack.org/268546 | 18:55 |
| *** tsymanczyk has quit IRC | 18:56 | |
| *** su_zhang_ has joined #openstack-keystone | 18:57 | |
| samueldmq | clenimar: hi, will take a look now | 18:59 |
| samueldmq | ayoung: good, thanks sir | 18:59 |
| ayoung | samueldmq, fixing the code now | 18:59 |
| samueldmq | ayoung: perfect | 18:59 |
| *** su_zhang has quit IRC | 19:01 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: More validation of roles for domain-scoped tokens https://review.openstack.org/273713 | 19:01 |
| openstackgerrit | Merged openstack/keystone: Improves domain name case sensitivity tests https://review.openstack.org/236103 | 19:02 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 19:02 |
| samueldmq | clenimar: disabling a domain doesn't need to disable all the users, this is by design | 19:05 |
| *** tsymancz1k has joined #openstack-keystone | 19:05 | |
| samueldmq | clenimar: we block users (yes, enabled users) in that domain to get a token in token issuance time | 19:05 |
| samueldmq | clenimar: looks to be invalid, just let me recheck all the comments in there | 19:05 |
| *** mgarza_ has quit IRC | 19:09 | |
| *** mgarza_ has joined #openstack-keystone | 19:10 | |
| *** rodrigods has quit IRC | 19:10 | |
| *** rodrigods has joined #openstack-keystone | 19:11 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 19:11 |
| samueldmq | ayoung: nice, will get to this ^ later, the spec change looks gret | 19:13 |
| ayoung | samueldmq, thanks | 19:13 |
| ayoung | samueldmq, it needs a couple more revisions. I'm going for the record here. | 19:14 |
| ayoung | stevemar, what is the record for most revisison for a review now? | 19:14 |
| *** diazjf has quit IRC | 19:14 | |
| *** diazjf has joined #openstack-keystone | 19:14 | |
| *** cdcasey has quit IRC | 19:15 | |
| clenimar | samueldmq, okay. thank you :) | 19:15 |
| htruta | any core to an easy WF on this: https://review.openstack.org/#/c/248295/ ? | 19:20 |
| ayoung | samueldmq, what time are things restarting? | 19:26 |
| ayoung | htruta, that makes me happy | 19:29 |
| ayoung | +2A and lets see what breaks | 19:29 |
| *** _cjones_ has quit IRC | 19:30 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Reuse project scoped token check for trusts https://review.openstack.org/253672 | 19:30 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add checks for domain scoped data creep https://review.openstack.org/253671 | 19:30 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add checks for project scoped data creep to tests https://review.openstack.org/253670 | 19:30 |
| *** sshen_ has quit IRC | 19:30 | |
| lbragstad | bknudson I rolled your changes into ^ | 19:30 |
| lbragstad | bknudson thanks! | 19:30 |
| bknudson | nice. | 19:30 |
| *** pushkaru has quit IRC | 19:30 | |
| htruta | ayoung: awesome. I don't believe it'll break much things... | 19:31 |
| *** pushkaru has joined #openstack-keystone | 19:31 | |
| *** sshen has joined #openstack-keystone | 19:31 | |
| htruta | htruta: keep smiling! | 19:31 |
| *** _cjones_ has joined #openstack-keystone | 19:31 | |
| htruta | ayoung: ^ | 19:31 |
| *** pushkaru has quit IRC | 19:31 | |
| ayoung | htruta, yeah, it shouldn't. THere reason it was all tenant was due to the V2 API, and we couldn't break things there, but I think we are insulated enough from it. Unit tests should have broken if it changed things | 19:31 |
| *** jsavak has quit IRC | 19:31 | |
| *** pushkaru has joined #openstack-keystone | 19:32 | |
| *** narengan has joined #openstack-keystone | 19:32 | |
| htruta | ayoung: exactly. the one that removes it from the assignment directory in on progress. let's get rid of tenant | 19:32 |
| htruta | the assignment one will be a little bit more complicated. but no reason to not be happy | 19:33 |
| ayoung | stevemar, samueldmq bknudson things starting there again? I have to run an errand at 3 | 19:33 |
| notmorgan | ayoung: yes. | 19:33 |
| bknudson | ayoung: yes, delegated roles | 19:33 |
| bknudson | unified delegation | 19:33 |
| ayoung | notmorgan, I tried calling in | 19:33 |
| ayoung | got kicked out | 19:33 |
| ayoung | topol, dial in please | 19:35 |
| topol | ayoung dialing | 19:35 |
| shaleh | samueldmq: overall, good work on the unit tests! One question. In the final review you remove keystone/tests/unit/test_backend.py from tox.ini but you do not add back in the new name or any of the other new files you added. | 19:35 |
| ayoung | stevemar, samueldmq bknudson is he showing slides? | 19:37 |
| bknudson | ayoung: yes, we're seeing some slides | 19:37 |
| bknudson | ayoung: https://docs.google.com/presentation/d/1JFKGYp9r2rh2mF1OCMvrxxnzq_n7WhGCKm4owK6THJ4/edit#slide=id.p | 19:38 |
| bknudson | slide 5 | 19:38 |
| notmorgan | ayoung: you typing? | 19:39 |
| lbragstad | typey typey | 19:39 |
| ayoung | notmorgan, muted | 19:39 |
| notmorgan | ayoung: cool thnx wasn't super loud wasn't sure if it was typing or just distortion :) | 19:39 |
| ayoung | what slide #? | 19:39 |
| notmorgan | 5? 6? | 19:39 |
| notmorgan | it's the "example workflow" | 19:40 |
| samueldmq | shaleh: good question, we doesn't need to because those are tests definitions, notice that the classes inherited from object | 19:42 |
| samueldmq | shaleh: however the subclasses inheriting from them (inside, for example: test_backend_sql) need to | 19:42 |
| samueldmq | shaleh: makes sense ? | 19:42 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Reuse project scoped token check for trusts https://review.openstack.org/253672 | 19:43 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add checks for domain scoped data creep https://review.openstack.org/253671 | 19:43 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add checks for project scoped data creep to tests https://review.openstack.org/253670 | 19:43 |
| shaleh | samueldmq: not seeing the connection between what you said (which is valid) and what is in the list of tox.ini python files. | 19:43 |
| lbragstad | bknudson missed your last comment - updated ^ | 19:44 |
| samueldmq | shaleh: perhaps even if no tests were run it would make sense o put them in the list ? | 19:44 |
| samueldmq | shaleh: just to make sure it's valid py34 syntax ? | 19:44 |
| samueldmq | shaleh: even if not running the tests themselves .... makes sense ? | 19:45 |
| shaleh | samueldmq: if the goal is clarity, having seeming random files in the tox.ini list is not helping is it? | 19:46 |
| samueldmq | shaleh: yes, need to check with someone else wht the goal of that list is | 19:47 |
| samueldmq | bknudson: what should be in the list of files of py34 tox env ? | 19:47 |
| samueldmq | bknudson: any file that passes py34 syntax check ? | 19:48 |
| bknudson | samueldmq: all the files that pass with python 3.4 | 19:48 |
| shaleh | bknudson: the goal is all of the unit tests eventually, right? | 19:48 |
| bknudson | shaleh: yes, eventually that will be all the files and then we're done (and can switch to testr?) | 19:48 |
| lbragstad | dstanek https://review.openstack.org/#/c/253671/13 and https://review.openstack.org/#/c/253670/12 close a bug | 19:48 |
| samueldmq | shaleh: it may not execute the tests and still pass py34 syntax | 19:49 |
| samueldmq | ? | 19:49 |
| shaleh | samueldmq: might be worth adding all of them, run the tests and remove the failures we cannot help | 19:49 |
| shaleh | samueldmq: seeing as it USED to work, because it was in the list | 19:49 |
| samueldmq | shaleh: yes, just to keep as it was before | 19:49 |
| bknudson | don't remove anything from the list | 19:49 |
| samueldmq | shaleh: ++ | 19:49 |
| samueldmq | shaleh: will do, as I need to do a rebase anyways :-( | 19:50 |
| samueldmq | bknudson: ++ | 19:50 |
| shaleh | bknudson: samueldmq is refactoring. A file no longer exists so he removed it | 19:50 |
| samueldmq | bknudson: but I will add the other new files that replace the old one | 19:50 |
| shaleh | bknudson: I asked him because he pulled pieces of the file into other files along the way | 19:50 |
| dstanek | bknudson: yes, once the tests can run move to testr | 19:50 |
| bknudson | oh, hopefully those files work with py34 otherwise we've lost some coverage. | 19:51 |
| dstanek | the files not currently in the list are there because they don't work in Python 3 | 19:51 |
| samueldmq | bknudson: they will, I am only moving code around | 19:51 |
| samueldmq | dstanek: I split file A into B, C and D (then A no longer exists) | 19:52 |
| samueldmq | dstanek: I removed A from the list in tox but didn't add B C and D | 19:52 |
| samueldmq | that's my fault and I am fixing it in the pacthes (still under review) | 19:52 |
| openstackgerrit | Merged openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 19:53 |
| *** fpatwa has joined #openstack-keystone | 19:53 | |
| dstanek | samueldmq: yeah, we definitely want to do that | 19:53 |
| shaleh | samueldmq: it MIGHT be worth doing all of the tox.ini editing in the last review | 19:53 |
| shaleh | otherwise you have 6 reviews trying to add a line in the same place and that may confuse things | 19:53 |
| shaleh | samueldmq: I did not -1 along the way for this little concern. Especially since you have to rebase all of them anyways :-) | 19:54 |
| samueldmq | shaleh: but that way we would ensure coverage is kept in every review | 19:54 |
| shaleh | but now my name is on the review so I can follow along | 19:54 |
| samueldmq | shaleh: and I need to rebase that anyways :-( | 19:54 |
| samueldmq | shaleh: I am working on this | 19:55 |
| shaleh | samueldmq: try and do it per review. if it causes a hassle doing it in the last one | 19:55 |
| samueldmq | shaleh: ++ | 19:55 |
| samueldmq | shaleh: gonna be much easier than the rebase itself :-) | 19:56 |
| shaleh | just make a comment somewhere that it is happening on the last one if needed | 19:56 |
| shaleh | samueldmq: you have my sympathy. I played this game for weeks with my unit test cleanup. | 19:56 |
| *** ayoung has quit IRC | 19:56 | |
| samueldmq | shaleh: eheh | 19:56 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:57 |
| *** amakarov_ has quit IRC | 19:58 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:59 |
| *** _cjones_ has quit IRC | 20:05 | |
| *** tsufiev has quit IRC | 20:07 | |
| *** lhcheng has joined #openstack-keystone | 20:07 | |
| *** ChanServ sets mode: +v lhcheng | 20:07 | |
| *** tsufiev has joined #openstack-keystone | 20:07 | |
| *** _cjones_ has joined #openstack-keystone | 20:08 | |
| *** tsymancz1k has quit IRC | 20:08 | |
| dstanek | dolphm: http://paste.openstack.org/show/485312/ | 20:09 |
| *** lhcheng_ has joined #openstack-keystone | 20:09 | |
| *** jsavak has joined #openstack-keystone | 20:12 | |
| *** tsymanczyk has joined #openstack-keystone | 20:12 | |
| *** lhcheng has quit IRC | 20:12 | |
| *** tsymanczyk is now known as Guest71884 | 20:12 | |
| jidar | how would one go about creating a role that grants non _admin_ users of a project access to create images? | 20:14 |
| *** drjones has joined #openstack-keystone | 20:15 | |
| *** _cjones_ has quit IRC | 20:15 | |
| dolphm | notmorgan: http://paste.openstack.org/show/485311/ + http://cdn.pasteraw.com/53surl8k5hlt5jn3wpva2wy6rvm499b + http://cdn.pasteraw.com/r0plw03p360i9ll87trvqid4j0tj5qs | 20:17 |
| *** amakarov has joined #openstack-keystone | 20:18 | |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: Manager support for project cascade update https://review.openstack.org/243584 | 20:20 |
| *** alexpro has joined #openstack-keystone | 20:20 | |
| *** ayoung has joined #openstack-keystone | 20:22 | |
| *** ChanServ sets mode: +v ayoung | 20:22 | |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: Manager support for project cascade update https://review.openstack.org/243584 | 20:22 |
| *** narengan has quit IRC | 20:22 | |
| ayoung | amakarov_, suspect that we need to get beyond the materialized path review in order for you to make any progress | 20:22 |
| *** fpatwa has quit IRC | 20:23 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Replace tenant for project in resource files https://review.openstack.org/248295 | 20:26 |
| *** diazjf has quit IRC | 20:26 | |
| *** lhcheng_ has quit IRC | 20:26 | |
| htruta | ayoung: we got a merge problem. Can you +A it again? https://review.openstack.org/#/c/248295/ | 20:26 |
| ayoung | htruta, looking | 20:26 |
| ayoung | htruta, why'd get_project_by_name move? | 20:28 |
| ayoung | it was in base an now is in v8? | 20:28 |
| *** jsavak has quit IRC | 20:30 | |
| *** jsavak has joined #openstack-keystone | 20:30 | |
| ayoung | bknudson, are we once again in small group mode? I got kicked off the dial in, can't tell what is going on/ | 20:31 |
| *** diazjf has joined #openstack-keystone | 20:31 | |
| bknudson | ayoung: yes, working in small groups for the afternoon | 20:31 |
| ayoung | bknudson, can you ask people to update etherpad with what they are workign on? | 20:31 |
| *** jbell8 has quit IRC | 20:32 | |
| ayoung | amakarov, can you summarize on etherpad any outcomes from the unified delegation discussion? | 20:32 |
| htruta | ayoung: because we changed the signature, and it could break some places that call it using kwarg | 20:32 |
| ayoung | htruta, Aha! | 20:32 |
| ayoung | that is kindof what I was worried about | 20:32 |
| ayoung | who caught that? | 20:32 |
| htruta | ayoung: I guess it was bknudson | 20:33 |
| htruta | who else? | 20:33 |
| ayoung | htruta, I'd guess jamielennox | 20:34 |
| ayoung | but it is early for him. Still, I don';t think we use kwargs when calling backend anywhere, not anywhere sane anyways. | 20:34 |
| ayoung | I'll let it pass the Zuul check before re +A though | 20:34 |
| htruta | ayoung: it was really bknudson. look in patch set 3 comments | 20:35 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 20:37 |
| *** vgridnev has joined #openstack-keystone | 20:37 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 20:37 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: AuthContextMiddleware admin token handling https://review.openstack.org/198931 | 20:39 |
| *** su_zhang_ has quit IRC | 20:41 | |
| *** jaosorior has quit IRC | 20:41 | |
| *** timcline_ has joined #openstack-keystone | 20:48 | |
| *** Guest71884 has quit IRC | 20:48 | |
| *** timcline_ has quit IRC | 20:48 | |
| *** alexpro has quit IRC | 20:49 | |
| *** timcline has quit IRC | 20:51 | |
| samueldmq | clenimar: what was your test related to that bug ? | 20:51 |
| samueldmq | clenimar: I saw that it wasn't possible to get a token to the scoped domain | 20:51 |
| *** drjones has quit IRC | 20:51 | |
| samueldmq | clenimar: but OLD tokens still worked | 20:51 |
| samueldmq | clenimar: that means they weren't invalidated | 20:51 |
| samueldmq | (or revoked) | 20:52 |
| samueldmq | revoked would be a better word in this context | 20:52 |
| htruta | samueldmq, in his tests, the old ones didn't work either | 20:52 |
| htruta | samueldmq: and, even if they do, it seems like another bug. right? | 20:52 |
| *** timcline has joined #openstack-keystone | 20:53 | |
| *** cdcasey has joined #openstack-keystone | 20:58 | |
| *** cdcasey has quit IRC | 20:58 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add tests for role management with v3policy file https://review.openstack.org/261846 | 21:01 |
| *** rcernin has quit IRC | 21:02 | |
| *** jsavak has quit IRC | 21:05 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: replace tenant with project in cli.py https://review.openstack.org/273757 | 21:10 |
| *** gildub has joined #openstack-keystone | 21:10 | |
| *** RichardRaseley has joined #openstack-keystone | 21:11 | |
| stevemar | samueldmq: notmorgan https://review.openstack.org/#/c/273757/ | 21:11 |
| stevemar | bknudson: https://review.openstack.org/#/c/272134/ | 21:13 |
| samueldmq | htruta: yes it's different bug we could just adapt the description/title of that bug | 21:14 |
| samueldmq | stevemar: neat | 21:15 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split assignment backend tests https://review.openstack.org/268307 | 21:16 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split resource backend tests https://review.openstack.org/268702 | 21:16 |
| *** EinstCrazy has quit IRC | 21:16 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split token backend tests https://review.openstack.org/269111 | 21:17 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split trust backend tests https://review.openstack.org/269115 | 21:17 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split catalog backend tests https://review.openstack.org/269125 | 21:17 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split policy backend tests https://review.openstack.org/269133 | 21:17 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split identity backend tests https://review.openstack.org/269148 | 21:17 |
| *** _cjones_ has joined #openstack-keystone | 21:17 | |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 21:17 |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: Add backend support for deleting a projects list https://review.openstack.org/245916 | 21:17 |
| *** EinstCrazy has joined #openstack-keystone | 21:17 | |
| *** pauloewerton has quit IRC | 21:20 | |
| *** jasonsb has quit IRC | 21:21 | |
| *** ayoung has quit IRC | 21:24 | |
| *** timcline has quit IRC | 21:27 | |
| *** rcernin has joined #openstack-keystone | 21:28 | |
| *** ebalduf has joined #openstack-keystone | 21:29 | |
| *** timcline_ has joined #openstack-keystone | 21:30 | |
| *** jsavak has joined #openstack-keystone | 21:31 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 21:31 |
| *** EinstCra_ has joined #openstack-keystone | 21:32 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 21:32 |
| *** EinstCrazy has quit IRC | 21:32 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Relax the schema validation to accept empty request body https://review.openstack.org/237448 | 21:36 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 21:38 |
| *** tsymancz1k has joined #openstack-keystone | 21:38 | |
| openstackgerrit | guang-yee proposed openstack/keystone: wsgi: fix base_url finding https://review.openstack.org/226464 | 21:38 |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Make WebSSO trusted_dashboard hostname case-insensitive https://review.openstack.org/273394 | 21:39 |
| *** topol has quit IRC | 21:40 | |
| *** topol_ has joined #openstack-keystone | 21:41 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 21:42 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Separate user identities https://review.openstack.org/262045 | 21:42 |
| *** peter-hamilton has quit IRC | 21:44 | |
| *** ayoung has joined #openstack-keystone | 21:47 | |
| *** ChanServ sets mode: +v ayoung | 21:47 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: AuthContextMiddleware admin token handling https://review.openstack.org/198931 | 21:47 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Relax the schema validation to accept empty request body https://review.openstack.org/237448 | 21:49 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove the duplicated testcase https://review.openstack.org/272401 | 21:49 |
| *** _cjones_ has quit IRC | 21:50 | |
| *** _cjones_ has joined #openstack-keystone | 21:51 | |
| *** vgridnev has quit IRC | 21:55 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Use requst local in-process cache per request https://review.openstack.org/272007 | 21:57 |
| notmorgan | stevemar: ^ | 21:57 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Relax the schema validation to accept empty request body https://review.openstack.org/237448 | 22:05 |
| *** edmondsw has joined #openstack-keystone | 22:08 | |
| *** su_zhang has joined #openstack-keystone | 22:09 | |
| *** jsavak has quit IRC | 22:11 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix schema validation to use JSONSchema for empty entity https://review.openstack.org/237448 | 22:14 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Unified delegation https://review.openstack.org/189816 | 22:15 |
| *** KarthikB has quit IRC | 22:18 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: replace tenant with project in cli.py https://review.openstack.org/273757 | 22:19 |
| stevemar | dolphm: https://review.openstack.org/#/c/265504/ | 22:20 |
| *** ayoung has quit IRC | 22:21 | |
| *** e0ne has quit IRC | 22:22 | |
| * lbragstad sets https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:bug/1224273 on the desk next to stevemar and walks away | 22:25 | |
| *** KarthikB has joined #openstack-keystone | 22:26 | |
| htruta | samueldmq, I'd rather have a separate discussion on that, to make it cleaner | 22:27 |
| *** timcline_ has quit IRC | 22:28 | |
| *** ebalduf has quit IRC | 22:30 | |
| *** topol_ is now known as topol | 22:32 | |
| *** ChanServ sets mode: +v topol | 22:32 | |
| *** RA_ has joined #openstack-keystone | 22:32 | |
| tjcocozz | htruta, hey do you mind if is submit another patch for this: https://review.openstack.org/#/c/244149/ It looks like you have a broken rebase. And i also optimized your code | 22:33 |
| htruta | tjcocozz, absolutely not. go ahead :) | 22:34 |
| tjcocozz | htruta, thanks! | 22:34 |
| htruta | tjcocozz, thank you | 22:35 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 22:36 |
| *** phalmos has quit IRC | 22:38 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add tests for role management with v3policy file https://review.openstack.org/261846 | 22:44 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add CRUD support for domain specific roles https://review.openstack.org/261870 | 22:44 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules in the v3 policy sample for domain specifc roles https://review.openstack.org/262078 | 22:45 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify implied roles to honor domain specific roles https://review.openstack.org/263064 | 22:45 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules for domain specific role assignments https://review.openstack.org/263549 | 22:46 |
| *** tonytan4ever has quit IRC | 22:47 | |
| htruta | tjcocozz, just saw your modification. I have a concern about the way you're creating the project_ids array | 22:48 |
| tjcocozz | htruta, yeah? whats going on? | 22:48 |
| tjcocozz | htruta, would it be easier to leave comments? | 22:48 |
| htruta | I did it that way because I'm not sure that list_projects_in_subtree is ordered according to the project level | 22:49 |
| tjcocozz | htruta, me and same looked through the code and it looks like it is to us. | 22:49 |
| tjcocozz | https://github.com/openstack/keystone/blob/b664fa91e3dd8b8902f6c6b8c87a648bfbfd1a9b/keystone/resource/V8_backends/sql.py#L93 | 22:50 |
| tjcocozz | htruta, i am making a test with a tree with 8 nodes. let me finish and we will see if i broke it ;-) | 22:50 |
| htruta | tjcocozz, hm... I see. that makes sense, then. | 22:52 |
| *** e0ne has joined #openstack-keystone | 22:56 | |
| *** shaleh has quit IRC | 22:57 | |
| *** shaleh has joined #openstack-keystone | 22:58 | |
| *** diazjf1 has joined #openstack-keystone | 22:58 | |
| stevemar | notmorgan: poke | 22:58 |
| notmorgan | hmm? | 22:58 |
| stevemar | notmorgan: can you comment on https://bugs.launchpad.net/keystone/+bug/1519210 and mark it as invalid if you think it is such | 22:58 |
| openstack | Launchpad bug 1519210 in OpenStack Identity (keystone) "opt-out of certain notifications" [Wishlist,In progress] - Assigned to Fernando Diaz (diazjf) | 22:58 |
| notmorgan | stevemar: uhmm. sure...... | 22:59 |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: invalidate cache immediately https://review.openstack.org/273218 | 22:59 |
| stevemar | notmorgan: doing bug triage/maint | 23:00 |
| *** e0ne_ has joined #openstack-keystone | 23:00 | |
| *** diazjf has quit IRC | 23:01 | |
| *** e0ne has quit IRC | 23:02 | |
| *** RA__ has joined #openstack-keystone | 23:06 | |
| *** RA_ has quit IRC | 23:06 | |
| *** timcline has joined #openstack-keystone | 23:08 | |
| *** KarthikB has quit IRC | 23:09 | |
| *** RA__ has quit IRC | 23:13 | |
| bigjools | hey, what's the official line on catalog URLs, should they have the API version or not? | 23:14 |
| *** Guest94234 is now known as jgriffith | 23:14 | |
| *** diazjf1 has quit IRC | 23:17 | |
| *** shaleh has quit IRC | 23:17 | |
| *** RA_ has joined #openstack-keystone | 23:20 | |
| *** su_zhang has quit IRC | 23:20 | |
| *** edmondsw has quit IRC | 23:23 | |
| *** amakarov has quit IRC | 23:25 | |
| *** sinese has quit IRC | 23:26 | |
| *** e0ne_ has quit IRC | 23:27 | |
| *** chlong has quit IRC | 23:32 | |
| *** ayoung has joined #openstack-keystone | 23:33 | |
| *** ChanServ sets mode: +v ayoung | 23:33 | |
| *** gordc has quit IRC | 23:38 | |
| *** su_zhang has joined #openstack-keystone | 23:44 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 23:45 |
| *** su_zhang has quit IRC | 23:46 | |
| *** su_zhang has joined #openstack-keystone | 23:47 | |
| *** slberger has left #openstack-keystone | 23:48 | |
| *** ayoung has quit IRC | 23:50 | |
| *** zqfan has joined #openstack-keystone | 23:52 | |
| *** pushkaru has quit IRC | 23:54 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:56 | |
| *** mgarza_ has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!