| *** spzala has quit IRC | 00:04 | |
| *** spzala has joined #openstack-keystone | 00:09 | |
| *** bjornar has quit IRC | 01:00 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 01:21 |
|---|---|---|
| *** spzala_ has joined #openstack-keystone | 01:24 | |
| *** spzala has quit IRC | 01:26 | |
| *** EinstCrazy has joined #openstack-keystone | 01:29 | |
| *** mylu has quit IRC | 01:42 | |
| *** mylu has joined #openstack-keystone | 01:43 | |
| *** dan_nguyen has joined #openstack-keystone | 01:49 | |
| *** EinstCrazy has quit IRC | 02:10 | |
| *** sdake has joined #openstack-keystone | 02:11 | |
| *** EinstCrazy has joined #openstack-keystone | 02:11 | |
| *** jamielennox is now known as jamielennox|away | 02:13 | |
| *** sdake has quit IRC | 02:18 | |
| *** dan_nguyen has quit IRC | 02:20 | |
| *** ebalduf has joined #openstack-keystone | 02:24 | |
| *** david_cu has joined #openstack-keystone | 03:12 | |
| *** EinstCra_ has joined #openstack-keystone | 03:22 | |
| *** EinstCrazy has quit IRC | 03:24 | |
| *** spzala_ has quit IRC | 03:26 | |
| *** spzala has joined #openstack-keystone | 03:27 | |
| *** spzala has quit IRC | 03:31 | |
| *** links has joined #openstack-keystone | 03:33 | |
| *** david_cu has quit IRC | 03:39 | |
| *** david_cu has joined #openstack-keystone | 03:40 | |
| *** dan_nguyen has joined #openstack-keystone | 03:41 | |
| *** dan_nguyen has quit IRC | 03:49 | |
| *** david_cu has quit IRC | 03:57 | |
| *** ebalduf has quit IRC | 04:03 | |
| *** david_cu has joined #openstack-keystone | 04:14 | |
| morgan | stevemar: i vote we ignore D400 indefintely | 04:21 |
| morgan | stevemar: re: https://bugs.launchpad.net/keystone/+bug/1562250 | 04:21 |
| openstack | Launchpad bug 1562250 in OpenStack Identity (keystone) "Enforce PEP8 coding convention - D400:First line should end with a period." [Wishlist,In progress] - Assigned to Steve Martinelli (stevemar) | 04:21 |
| morgan | stevemar: this doesn't really provide a lot of benefit and is firmly in the category of "meh". I'm fine with the newline requirements etc, but this one feels like something we sholdn't bother with even though the code is proposed. | 04:22 |
| stevemar | morgan: i had the same opinion, but I run a quick codesearch and i think we're in the minority | 04:24 |
| morgan | stevemar: doesn't mean i still don't think it's worth enforcing | 04:25 |
| morgan | stevemar: it's silly, trivial, and not worth causing the gate to bounce it out for imho | 04:25 |
| morgan | i commented on the bug and on the patch (+1, but i wont ever +2 it) | 04:25 |
| stevemar | morgan: yeah, i get ya. i did it on a whim since someone filed a bug | 04:26 |
| morgan | if i'd had caught the bug i'd have "wont fixed" the bug ;) | 04:26 |
| morgan | but since you had written code and all.... | 04:26 |
| stevemar | morgan: dolph recommended it to a few utsa students as low hanging fruit, i didn't realize it was meant for them :( | 04:26 |
| morgan | doh! | 04:28 |
| *** pgreg has joined #openstack-keystone | 04:48 | |
| *** david_cu has quit IRC | 04:52 | |
| *** roxanaghe has joined #openstack-keystone | 05:45 | |
| *** roxanaghe has quit IRC | 05:47 | |
| prometheanfire | well | 05:50 |
| prometheanfire | db_sync fails from liberty -> mitaka | 05:50 |
| prometheanfire | 2016-03-28 00:50:19.741 6595 ERROR oslo_db.sqlalchemy.exc_filters ProgrammingError: column "domain_id" of relation "role" already exists | 05:51 |
| prometheanfire | I'm guessing noone tested this on postgres? | 05:52 |
| prometheanfire | that was 088_domain_specific_roles.py, 091_migrate_data_to_local_user_and_password_tables.py also fails | 05:58 |
| prometheanfire | fyi, none of the other services failed db_upgrade | 05:58 |
| prometheanfire | well, this upgrade fucked my install I think | 06:03 |
| prometheanfire | and to run some stuff manually, not sure if I did it right, but keystone's running again | 06:10 |
| *** harlowja_at_home has quit IRC | 06:12 | |
| *** GB21 has joined #openstack-keystone | 06:17 | |
| *** rk4n has joined #openstack-keystone | 06:17 | |
| *** Nirupama has joined #openstack-keystone | 06:18 | |
| *** harlowja_at_home has joined #openstack-keystone | 06:23 | |
| *** rk4n has quit IRC | 06:24 | |
| *** mylu has quit IRC | 06:27 | |
| *** naresht has joined #openstack-keystone | 06:28 | |
| *** spzala has joined #openstack-keystone | 06:32 | |
| *** spzala has quit IRC | 06:36 | |
| openstackgerrit | Merged openstack/keystone: Update dev docs and sample script for v3/bootstrap https://review.openstack.org/290897 | 06:38 |
| *** roxanaghe has joined #openstack-keystone | 06:47 | |
| *** pcaruana has joined #openstack-keystone | 06:49 | |
| *** roxanaghe has quit IRC | 06:52 | |
| *** gangadhar has joined #openstack-keystone | 06:53 | |
| *** sheel has joined #openstack-keystone | 06:54 | |
| gangadhar | Hi everyone. I want to configure keystone to ldap server. | 07:10 |
| gangadhar | I have installed devstack with default sql driver and installed openldap in another machine | 07:11 |
| gangadhar | How can I create users in ldap server and configure in keystone.conf? | 07:12 |
| *** e0ne has joined #openstack-keystone | 07:15 | |
| *** e0ne has quit IRC | 07:18 | |
| prometheanfire | ya, they seem to be afk now | 07:27 |
| *** spzala has joined #openstack-keystone | 07:32 | |
| prometheanfire | has anyone tested this? for some reason openstack endpoint list is trying to go somewhere it shouldn't, almost like it's removing a slash...... | 07:33 |
| prometheanfire | https://example.com:35357admin/v3/auth/tokens: | 07:33 |
| *** spzala has quit IRC | 07:38 | |
| prometheanfire | so | 07:40 |
| prometheanfire | why is the openstack client mangling the url incorrectly | 07:40 |
| prometheanfire | btw | 07:40 |
| prometheanfire | this is with the stable/mitaka upper-constraints | 07:40 |
| prometheanfire | so this breaks shit | 07:40 |
| *** GB21 has quit IRC | 07:43 | |
| prometheanfire | seems to be common, not just the admin url | 07:48 |
| prometheanfire | db has this for endpoint https://example.com:5000/v3 | 07:48 |
| prometheanfire | so that seems fine | 07:48 |
| prometheanfire | first request seems to pass, but returns the wrong url | 07:52 |
| prometheanfire | returns it without the slash | 07:52 |
| prometheanfire | RESP BODY: {"version": {"status": "stable", "updated": "2016-04-04T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v3+json"}], "id": "v3.6", "links": [{"href": "https://example.com:5000admin/v3/", "rel": "self"}]}} | 07:53 |
| *** spzala has joined #openstack-keystone | 07:54 | |
| prometheanfire | debug log of keystone doesn't show anything other than keystone/middleware/auth.py:71 being called | 07:55 |
| *** tqtran has joined #openstack-keystone | 07:58 | |
| *** spzala has quit IRC | 07:58 | |
| prometheanfire | ok, new release seems fucked, rolling back | 08:00 |
| *** henrynash has joined #openstack-keystone | 08:01 | |
| *** ChanServ sets mode: +v henrynash | 08:01 | |
| prometheanfire | well, neat, can't because DB upgrades are one way | 08:01 |
| prometheanfire | so | 08:06 |
| prometheanfire | not sure where the code keystone uses to build the url returned to clients is, but it fails | 08:07 |
| prometheanfire | it strips or doesn't include the slash between port and path | 08:07 |
| prometheanfire | https://example.com:5000admin/v3/ for example | 08:07 |
| prometheanfire | this causes clients to fail | 08:07 |
| *** e0ne has joined #openstack-keystone | 08:14 | |
| *** rk4n has joined #openstack-keystone | 08:15 | |
| *** rk4n has quit IRC | 08:18 | |
| *** rk4n has joined #openstack-keystone | 08:18 | |
| *** roxanaghe has joined #openstack-keystone | 08:36 | |
| *** GB21 has joined #openstack-keystone | 08:36 | |
| *** roxanaghe has quit IRC | 08:40 | |
| *** martinus__ has quit IRC | 08:48 | |
| *** spzala has joined #openstack-keystone | 08:55 | |
| *** spzala has quit IRC | 09:00 | |
| *** GB21 has quit IRC | 09:16 | |
| *** agireud has quit IRC | 09:27 | |
| *** agireud has joined #openstack-keystone | 09:28 | |
| *** gangadhar has quit IRC | 09:31 | |
| *** henrynash has quit IRC | 09:33 | |
| *** gangadhar has joined #openstack-keystone | 09:34 | |
| gangadhar | Why project admin is unable to grant a role to user? Using this policy: https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json | 09:34 |
| gangadhar | But changing the line from "identity:create_grant": "rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants" to "identity:create_grant": "rule:cloud_admin or rule:domain_admin_for_list_grants or rule:project_admin_for_list_grants" it started working | 09:35 |
| *** pcaruana has quit IRC | 09:42 | |
| *** pcaruana has joined #openstack-keystone | 09:55 | |
| *** spzala has joined #openstack-keystone | 09:56 | |
| *** GB21 has joined #openstack-keystone | 09:59 | |
| *** spzala has quit IRC | 10:01 | |
| openstackgerrit | Boris Bobrov proposed openstack/python-keystoneclient: Support flag `truncated` returned by identity service https://review.openstack.org/293048 | 10:01 |
| gangadhar | Any help regarding issue "project admin is unable to grant a role to user"? ^^^ | 10:11 |
| *** GB21 has quit IRC | 10:14 | |
| *** GB21 has joined #openstack-keystone | 10:21 | |
| *** roxanaghe has joined #openstack-keystone | 10:24 | |
| *** EinstCra_ has quit IRC | 10:25 | |
| *** roxanaghe has quit IRC | 10:28 | |
| *** tqtran has quit IRC | 10:30 | |
| gangadhar | Any help on domain things? | 10:49 |
| *** GB21 has quit IRC | 10:54 | |
| *** spzala has joined #openstack-keystone | 10:57 | |
| *** spzala has quit IRC | 11:02 | |
| *** rodrigods has quit IRC | 11:03 | |
| *** rodrigods has joined #openstack-keystone | 11:03 | |
| *** pcaruana has quit IRC | 11:09 | |
| *** GB21 has joined #openstack-keystone | 11:11 | |
| *** trown|outtypewww is now known as trown|PTO | 11:22 | |
| *** pcaruana has joined #openstack-keystone | 11:23 | |
| *** tqtran has joined #openstack-keystone | 11:26 | |
| *** doug-fish has joined #openstack-keystone | 11:27 | |
| *** GB21 has quit IRC | 11:27 | |
| *** tqtran has quit IRC | 11:31 | |
| *** gordc has joined #openstack-keystone | 11:33 | |
| *** GB21 has joined #openstack-keystone | 11:47 | |
| *** flaper87 has quit IRC | 11:48 | |
| *** EinstCrazy has joined #openstack-keystone | 11:50 | |
| *** flaper87 has joined #openstack-keystone | 11:51 | |
| *** pauloewerton has joined #openstack-keystone | 11:55 | |
| *** spzala has joined #openstack-keystone | 11:58 | |
| *** spzala has quit IRC | 12:03 | |
| *** roxanaghe has joined #openstack-keystone | 12:12 | |
| *** roxanaghe has quit IRC | 12:17 | |
| *** bjornar has joined #openstack-keystone | 12:20 | |
| *** spandhe has quit IRC | 12:29 | |
| *** edmondsw has joined #openstack-keystone | 12:30 | |
| *** GB21 has quit IRC | 12:34 | |
| *** pcaruana has quit IRC | 12:39 | |
| raildo | gangadhar: project admin can grant a role to user, "rule:project_admin_for_grants" | 12:49 |
| *** pcaruana has joined #openstack-keystone | 12:52 | |
| *** pnavarro has joined #openstack-keystone | 12:52 | |
| *** spzala has joined #openstack-keystone | 12:59 | |
| *** xenogear has joined #openstack-keystone | 13:00 | |
| *** spzala has quit IRC | 13:04 | |
| *** ninag has joined #openstack-keystone | 13:11 | |
| *** spzala has joined #openstack-keystone | 13:12 | |
| *** rcrit_ has quit IRC | 13:16 | |
| *** xenogear has quit IRC | 13:18 | |
| *** pnavarro has quit IRC | 13:21 | |
| *** pnavarro has joined #openstack-keystone | 13:21 | |
| *** pnavarro has quit IRC | 13:21 | |
| *** ayoung has joined #openstack-keystone | 13:22 | |
| *** ChanServ sets mode: +v ayoung | 13:22 | |
| *** jsavak has joined #openstack-keystone | 13:25 | |
| *** amakarov has quit IRC | 13:26 | |
| *** tqtran has joined #openstack-keystone | 13:28 | |
| *** tqtran has quit IRC | 13:32 | |
| *** amakarov has joined #openstack-keystone | 13:32 | |
| *** links has quit IRC | 13:36 | |
| *** openstackgerrit has quit IRC | 13:48 | |
| *** openstackgerrit has joined #openstack-keystone | 13:48 | |
| *** richm has joined #openstack-keystone | 13:50 | |
| *** EinstCrazy has quit IRC | 13:52 | |
| *** Nirupama has quit IRC | 13:52 | |
| openstackgerrit | Merged openstack/keystone: Fix keystone-manage config file path https://review.openstack.org/296110 | 13:57 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:59 | |
| *** ametts has joined #openstack-keystone | 13:59 | |
| *** roxanaghe has joined #openstack-keystone | 14:00 | |
| *** rdo has quit IRC | 14:00 | |
| *** ebalduf has joined #openstack-keystone | 14:00 | |
| *** hongbin has joined #openstack-keystone | 14:01 | |
| *** rdo has joined #openstack-keystone | 14:02 | |
| *** knikolla has joined #openstack-keystone | 14:04 | |
| *** roxanaghe has quit IRC | 14:04 | |
| *** hongbin has left #openstack-keystone | 14:07 | |
| *** gangadhar has quit IRC | 14:11 | |
| *** tellesnobrega_af is now known as tellesnobrega | 14:13 | |
| lbragstad | o/ mornin' | 14:18 |
| *** doug-fis_ has joined #openstack-keystone | 14:19 | |
| *** slberger has joined #openstack-keystone | 14:19 | |
| *** knikolla has quit IRC | 14:20 | |
| *** knikolla has joined #openstack-keystone | 14:21 | |
| *** doug-fish has quit IRC | 14:21 | |
| knikolla | o/ | 14:21 |
| *** mhickey has joined #openstack-keystone | 14:23 | |
| morgan | Oh hai | 14:32 |
| ayoung | knikolla, you tracking on the LDAP stuff? | 14:34 |
| *** pauloewerton has quit IRC | 14:34 | |
| *** shangxdy has joined #openstack-keystone | 14:36 | |
| knikolla | ayoung, yeah. | 14:37 |
| knikolla | morgan, thanks for the feedback. | 14:37 |
| morgan | knikolla: of course. You're also going to want to propose moving the ldap3 spec from back log to Newton | 14:37 |
| morgan | In the keystone-specs repo | 14:38 |
| *** markvoelker has joined #openstack-keystone | 14:38 | |
| morgan | knikolla: it is looking good. Some general cleanup, and tests and we might have an ldap3 driver early in the cycle ;) | 14:39 |
| *** pushkaru has joined #openstack-keystone | 14:39 | |
| knikolla | morgan, i'll do that. who should i set a assignees and contributors? | 14:40 |
| morgan | You as asignee and if someone else is contributing significantly, them. | 14:40 |
| *** sdake has joined #openstack-keystone | 14:42 | |
| *** mylu has joined #openstack-keystone | 14:42 | |
| *** csoukup has joined #openstack-keystone | 14:43 | |
| ayoung | the spec is written knikolla , just git move it and submit as a review | 14:43 |
| ayoung | feel free to update the contributors, but leave me as the owner | 14:44 |
| stevemar | ayoung knikolla i'm actually going to clen up the specs today | 14:44 |
| *** mylu has quit IRC | 14:44 | |
| knikolla | stevemar, ongoing = newton? | 14:44 |
| ayoung | knikolla, you get credit if it succeeds. I take blame if it fails. | 14:44 |
| *** mylu has joined #openstack-keystone | 14:44 | |
| morgan | knikolla: https://github.com/openstack/keystone-specs/blob/master/specs/backlog/ldap3.rst | 14:45 |
| stevemar | knikolla: yep | 14:45 |
| knikolla | morgan, yep, i've already read most of the specs :) | 14:45 |
| knikolla | ayoung, thanks | 14:46 |
| morgan | stevemar: so do we have a need for another RC yet? I think I saw some possible major issues with links overnight by prometheanfire | 14:46 |
| morgan | stevemar: and possibly a postgres migrate fail | 14:46 |
| stevemar | morgan: yeah... i saw those this morning, not sure whats going on there | 14:46 |
| *** sdake has quit IRC | 14:46 | |
| *** sdake has joined #openstack-keystone | 14:47 | |
| morgan | The links thing worries me the most | 14:47 |
| morgan | Since it could potentially affect a wide range of deploys. | 14:48 |
| *** timcline has joined #openstack-keystone | 14:48 | |
| bknudson | there were changes to the links code -- https://review.openstack.org/#/c/226464/ | 14:49 |
| patchbot | bknudson: patch 226464 - keystone - wsgi: fix base_url finding (MERGED) | 14:49 |
| morgan | bknudson: that might be it. Let me take a look | 14:49 |
| stevemar | morgan: did prometheanfire file a bug? | 14:49 |
| morgan | stevemar: unknown, I opted to ignore when I was half asleep | 14:50 |
| stevemar | morgan: maybe it is osc :P | 14:50 |
| morgan | stevemar: nah, the json from keystone was missing the slash from what I saw in the backlog | 14:50 |
| morgan | stevemar: let me take a gander at the code - it might be straightforward | 14:51 |
| morgan | euuw.. we use url = 'http://localhost:%d' % CONF.eventlet_server.public_port ... :P | 14:52 |
| prometheanfire | I didn't file a bug yey | 14:52 |
| prometheanfire | I didn't file a bug yet | 14:52 |
| ayoung | stevemar, morgan for the OpenStack deploys you have worked on, have they been puppet managed? I'm trying to figure out how to distributed update policy files. | 14:52 |
| prometheanfire | also, not using eventlet, but wsgi | 14:53 |
| ayoung | Or have we all just punted on that thus far? | 14:53 |
| lbragstad | tjcocozz morgan do we (as keystone) publish our test coverage results - or run them through jenkins? | 14:53 |
| morgan | prometheanfire: oooh. yeah ok i think i know where this is then. | 14:53 |
| morgan | prometheanfire: this is likely exclusive to eventlet (sorry) also move to mod_wsgi soon ;) | 14:53 |
| morgan | prometheanfire: or uwsgi (eventlet is going away in Newton) | 14:53 |
| tjcocozz | lbragstad, we will soon. we were running the coverage test after patch gets merged for some reason https://review.openstack.org/#/c/297351/ | 14:54 |
| patchbot | tjcocozz: patch 297351 - openstack-infra/project-config - Move `keystone-coverage-db` job to check queue | 14:54 |
| morgan | ayoung: uhm. i have usually work with things ansible/puppet/chef based | 14:54 |
| prometheanfire | uwsgi uses the same code path as eventlet? | 14:54 |
| morgan | prometheanfire: not exactly | 14:54 |
| lbragstad | tjcocozz so are test coverage results of a patch going to be viewable when it's up for review? | 14:55 |
| morgan | prometheanfire: it usues a bit of code that is somewhere more similar to mod_wsgi, but it is run/managed by the uwsgi app instead of keystone's "keystone-all" script and python implemnetation of coroutines | 14:55 |
| prometheanfire | I do go though a socket with eventlet | 14:55 |
| lbragstad | tjcocozz I should be able to click on the job link and see the output of the coverage run, right? | 14:55 |
| tjcocozz | lbragstad, yes. | 14:55 |
| lbragstad | tjcocozz sweet | 14:55 |
| prometheanfire | bah | 14:55 |
| prometheanfire | I do go though a socket with uwsgi | 14:56 |
| lbragstad | tjcocozz so do we have a path forward for this? | 14:56 |
| lbragstad | https://review.openstack.org/#/c/294189/2 | 14:56 |
| patchbot | lbragstad: patch 294189 - keystone - Add `patch_cover` to keystone | 14:56 |
| *** mylu has quit IRC | 14:56 | |
| morgan | prometheanfire: uwsgi is a standalone process(es) and can use a unix domain socket | 14:56 |
| prometheanfire | right | 14:56 |
| lbragstad | tjcocozz or do we need it anymore? | 14:56 |
| openstackgerrit | Merged openstack/python-keystoneclient: Allow seeing full token response when debug enabled https://review.openstack.org/292414 | 14:56 |
| *** pauloewerton has joined #openstack-keystone | 14:56 | |
| *** mylu has joined #openstack-keystone | 14:56 | |
| morgan | prometheanfire: or listen locally with uwsgi protocol, wsgi protocol, or serve HTTP directly | 14:56 |
| morgan | tjcocozz: my -1 on your cover patch was in agreement with bknudson, but i am also concerned about strict gating. | 14:57 |
| tjcocozz | lbragstad, i am not sure what you mean by path forward . i think let me find another project that is doing that already to double check. | 14:57 |
| tjcocozz | morgan, there won't be strick gating | 14:57 |
| morgan | tjcocozz: then i'm happy with the patch post fix bknudson pointed out | 14:57 |
| tjcocozz | morgan, it will be non-voting at best. | 14:57 |
| morgan | tjcocozz: :) | 14:57 |
| lbragstad | tjcocozz I was wondering if we are still going to have a patch_cover method if we are going to be publishing our testing results on every patch | 14:57 |
| *** fawadkhaliq has joined #openstack-keystone | 14:58 | |
| morgan | lbragstad: it could just be a jenkins job with results. | 14:58 |
| morgan | prometheanfire: so let me take a look at the eventlet path - i think i have an idea of what is going on. | 14:58 |
| lbragstad | tjcocozz maybe we just start with publishing results first and then build more advanced coverage comparison one we get use to having coverage published/ | 14:58 |
| lbragstad | ? | 14:58 |
| * lbragstad shrugs | 14:58 | |
| prometheanfire | k | 14:58 |
| tjcocozz | lbragstad, with the current patches up we will have both. Looking at other project they are running just my path_cover change under 'tox -e cover' | 14:59 |
| morgan | lbragstad: i think it's fair to just start with coverage stuff like tjcocozz proposed especially if it's at most non-vote | 14:59 |
| morgan | stevemar: ^ cc (re coverage) | 14:59 |
| prometheanfire | it was confusing for a long time, thought I was doing something wrong, but the DB has the right entries in the endpoint table | 14:59 |
| morgan | prometheanfire: yeah i was going to ask for a copy of the DB entries once i got deeper if i didn't find anything | 15:00 |
| prometheanfire | morgan: also, when bypassing auth (using the admin token, it works | 15:00 |
| *** jsavak has quit IRC | 15:00 | |
| *** mylu has quit IRC | 15:00 | |
| stevemar | morgan: we have a coverage job that runs in the *post* section of our gate... not sure how useful it is there | 15:00 |
| lbragstad | tjcocozz is that script copy/pasted from somewhere - or another project/ | 15:00 |
| morgan | prometheanfire: expected w/ admin_token - it doesn't use the catalog | 15:00 |
| prometheanfire | k | 15:00 |
| tjcocozz | lbragstad, i added where i found it in the patch. | 15:00 |
| morgan | stevemar: right, i think this should be (poribably) a check non-vote | 15:00 |
| prometheanfire | well, I'm going afk for 10-15 min, will be back then | 15:00 |
| morgan | stevemar: (and with a comment that says this should *always* be non-vote) | 15:01 |
| morgan | prometheanfire: enjoy your AFK :) | 15:01 |
| tjcocozz | lbragstad, https://review.openstack.org/#/c/294189/2/tools/cover.sh | 15:01 |
| patchbot | tjcocozz: patch 294189 - keystone - Add `patch_cover` to keystone | 15:01 |
| *** ebalduf has quit IRC | 15:01 | |
| morgan | stevemar: once tjcocozz's patch lands. | 15:01 |
| *** jsavak has joined #openstack-keystone | 15:01 | |
| lbragstad | but we also have https://review.openstack.org/#/c/297351/1 | 15:02 |
| patchbot | lbragstad: patch 297351 - openstack-infra/project-config - Move `keystone-coverage-db` job to check queue | 15:02 |
| tjcocozz | lbragstad, right before 'ALLOWED_EXTRA_MISSING' <- do you think that comment is enough? | 15:02 |
| morgan | stevemar: dude, 15" screen is sooooooooo massive compared to 14 and 13. | 15:02 |
| *** diazjf has joined #openstack-keystone | 15:03 | |
| stevemar | lbragstad: that's the right place for it :) | 15:03 |
| *** mylu has joined #openstack-keystone | 15:03 | |
| morgan | prometheanfire: ok i have a fix ( stevemar we have a RC blocker, filing the bug now ) | 15:03 |
| lbragstad | stevemar I agree | 15:04 |
| ayoung | morgan, I want the policy file IDs to be a hash of the contents of the policy. | 15:04 |
| morgan | stevemar: url = 'http://localhost:%d' % CONF.eventlet_server.public_port should be url = 'http://localhost:%d/' % CONF.eventlet_server.public_port | 15:04 |
| stevemar | morgan: ugh! okay, file away | 15:04 |
| stevemar | .... | 15:04 |
| ayoung | That gives us a few things | 15:04 |
| stevemar | damn eventlet | 15:04 |
| morgan | stevemar: or the rstrip is doing it | 15:04 |
| morgan | but basically we used to do url = context['host_url'] | 15:04 |
| morgan | i am 2x checking before i write the code, but ick | 15:05 |
| bknudson | curl http://localhost:5000 works fine | 15:05 |
| ayoung | bah,...too much for an IRC conversation. I'll write it up in an etherpad | 15:05 |
| morgan | bknudson: it's an issue with the resulting links in the body | 15:05 |
| morgan | ... <snip> "links": [{"href": "https://example.com:5000admin/v3/", "rel": "self"}]}} </snip> | 15:06 |
| morgan | so looking into what we changed/how eventlet is horked specifically in link generation now. | 15:06 |
| morgan | bknudson: or what could cause it. | 15:06 |
| bknudson | haven't seen that myself | 15:06 |
| morgan | bknudson: but from what prometheanfire is saying, upgrade broke his environment because of that ^ and keystone/osc-identity uses that | 15:06 |
| morgan | bknudson: it's eventlet specific it looks like. | 15:07 |
| * morgan grabs power cord and goes and pokes at this a bit more. | 15:07 | |
| *** edmondsw has quit IRC | 15:07 | |
| *** rderose has joined #openstack-keystone | 15:08 | |
| *** tellesnobrega is now known as tellesnobrega_af | 15:09 | |
| morgan | ayoung: ok. | 15:11 |
| *** shangxdy has quit IRC | 15:12 | |
| prometheanfire | morgan: if you have a patch I can test | 15:16 |
| morgan | prometheanfire: i'm trying to duplicate now. can you post your keystone.conf (minus sensitive data like sql-connection strings, admin_token value)? | 15:17 |
| prometheanfire | was converting to v3 at the same time as upgrade | 15:17 |
| prometheanfire | it's very basic | 15:17 |
| morgan | prometheanfire: just so i am sure i am looking at all the variables. | 15:17 |
| prometheanfire | k | 15:18 |
| morgan | prometheanfire: also please use paste.openstack.org to post it if you don't mind. | 15:18 |
| stevemar | converting endpoints to v3 at the same time is probably something you want to avoid doing at the same time | 15:18 |
| morgan | will be easier than fishing it out of irc | 15:18 |
| morgan | and ++ upgrade then convert to v3, or convert to v3 then upgrade | 15:18 |
| prometheanfire | ah | 15:19 |
| *** woodster_ has joined #openstack-keystone | 15:19 | |
| prometheanfire | just made a gist :P | 15:19 |
| bknudson | are deployers setting their identity endpoints to have /v3 now? | 15:19 |
| morgan | gist is good | 15:19 |
| prometheanfire | http://paste.openstack.org/show/492081/ | 15:19 |
| morgan | prometheanfire: also, i'd like to know what you had to "fix" the migrations | 15:20 |
| morgan | after go through this | 15:20 |
| prometheanfire | bknudson: I know rackspace (private cloud) is | 15:20 |
| *** mhickey has quit IRC | 15:20 | |
| morgan | that is a VERY basic config | 15:20 |
| prometheanfire | my fix was hackish and bad | 15:20 |
| prometheanfire | I told you | 15:20 |
| prometheanfire | I basically use defaults everwhere | 15:20 |
| morgan | good, eliminates icky config issues | 15:20 |
| stevemar | prometheanfire: defaults everywhere! | 15:21 |
| morgan | stevemar: sane defaults! | 15:21 |
| -openstackstatus- NOTICE: Gerrit is restarting on review.openstack.org in an attempt to address an issue reading an object from the ec2-api repository | 15:21 | |
| *** rderose has quit IRC | 15:22 | |
| prometheanfire | this was my old one http://paste.openstack.org/show/492082/ | 15:22 |
| *** mhickey has joined #openstack-keystone | 15:22 | |
| prometheanfire | I switch to fernet as well, but did run the script to generate the keys, so that shold be fine | 15:22 |
| prometheanfire | that was from liberty | 15:22 |
| morgan | prometheanfire: hmm... i can't seem to duplicate this now. | 15:24 |
| morgan | prometheanfire: it errored once and now it works. | 15:24 |
| *** pgreg_ has joined #openstack-keystone | 15:24 | |
| morgan | yeah that should be fine. | 15:25 |
| prometheanfire | think I've had this setup around since havana, so some old config stuff stuck around | 15:26 |
| *** david_cu has joined #openstack-keystone | 15:27 | |
| *** spzala has quit IRC | 15:28 | |
| *** pgreg has quit IRC | 15:28 | |
| *** fawadkhaliq has quit IRC | 15:28 | |
| *** spzala has joined #openstack-keystone | 15:29 | |
| *** rderose has joined #openstack-keystone | 15:30 | |
| morgan | prometheanfire: ok, what command did you type to get the error | 15:30 |
| *** roxanaghe has joined #openstack-keystone | 15:31 | |
| morgan | prometheanfire: because i can't duplicate it now... it's working. | 15:31 |
| samueldmq | bknudson: stevemar: dstanek: patch 289306 needs some love | 15:31 |
| patchbot | samueldmq: https://review.openstack.org/#/c/289306/ - python-keystoneclient - Add users functional tests | 15:31 |
| prometheanfire | morgan: openstack endpoint list --debug | 15:31 |
| bknudson | lots of reviews need love | 15:32 |
| samueldmq | stevemar: about those functional tests in the client; there is a student who is willing to get involved in keystone | 15:32 |
| samueldmq | stevemar: my idea is to get that one in ^ and let her write the others, and then keep contributing in that front | 15:33 |
| prometheanfire | still getting it too | 15:33 |
| samueldmq | stevemar: in the context of Outreachy program https://wiki.openstack.org/wiki/Outreachy | 15:33 |
| *** spzala has quit IRC | 15:33 | |
| morgan | prometheanfire: hmm.. what auth URL (you can obscure the hostname) are you using? | 15:33 |
| prometheanfire | OS_AUTH_URL=https://master.openstack.mthode.org:5000/v3 | 15:34 |
| prometheanfire | meh | 15:34 |
| prometheanfire | behind a fw | 15:35 |
| morgan | prometheanfire: and did you set OS_IDENTITY_API_VERSION ? | 15:35 |
| *** roxanaghe has quit IRC | 15:35 | |
| prometheanfire | yes | 15:35 |
| prometheanfire | OS_IDENTITY_API_VERSION=3 | 15:35 |
| prometheanfire | I can't see this as a problem client side | 15:35 |
| morgan | ok, can you provide me with the records in the db now? -- though i am not seeing why that should be an issue. | 15:35 |
| morgan | everything is looking correct... | 15:36 |
| morgan | related: what version of openstack-client do you have installed? | 15:36 |
| morgan | i'm trying with: (keystone-venv) whitewalker:~ notmorgan$ openstack --version | 15:36 |
| morgan | openstack 2.2.0 | 15:36 |
| *** diazjf has quit IRC | 15:36 | |
| prometheanfire | http://paste.openstack.org/show/492087/ | 15:37 |
| prometheanfire | 2.2.0 | 15:37 |
| *** pgreg_ has quit IRC | 15:38 | |
| *** spandhe has joined #openstack-keystone | 15:38 | |
| prometheanfire | now, if only we could get it to do it again for you :P | 15:38 |
| *** pgreg has joined #openstack-keystone | 15:38 | |
| ayoung | samueldmq, can you take a look at https://etherpad.openstack.org/p/tripleo-policy-updates and tell me if it passes a sanity check? | 15:39 |
| prometheanfire | which codepath were you looking at? | 15:39 |
| *** mylu has quit IRC | 15:40 | |
| *** spzala has joined #openstack-keystone | 15:40 | |
| morgan | prometheanfire: well i was looking at the stuff in wsgi.py, but now i just need to duplicate it so i can poke at the server w/o the client | 15:40 |
| ayoung | samueldmq, I know you worked on the DYnamic Policy proof of concept last summer, and I think that you can best understand what I am trying to say. Even if I don't say it very well | 15:40 |
| morgan | prometheanfire: it's weird that you have "35757admin/v3" | 15:40 |
| morgan | that is the part that is tripping me up | 15:40 |
| morgan | or 5000admin/v3 | 15:41 |
| prometheanfire | ya, the stripping is killing the clients | 15:41 |
| morgan | well, no | 15:41 |
| morgan | the "admin" is erroneous | 15:41 |
| prometheanfire | Unexpected exception for https://master.openstack.mthode.org:5000admin/v3/auth/tokens: Failed to parse: master.openstack.mthode.org:5000admin | 15:41 |
| morgan | right | 15:41 |
| ayoung | morgan, so https://etherpad.openstack.org/p/tripleo-policy-updates is my first attempt to make the approach coherent. | 15:41 |
| morgan | that shouldn't be "5000admin/v3" it should be "5000/v3" | 15:41 |
| morgan | 5000admin isn't something inet can parse as a valid port | 15:42 |
| *** diazjf has joined #openstack-keystone | 15:42 | |
| prometheanfire | could it be related to 088 or 091 migrations? | 15:42 |
| morgan | i doubt it | 15:42 |
| prometheanfire | those are the two I had trouble with | 15:42 |
| *** roxanaghe has joined #openstack-keystone | 15:42 | |
| morgan | if the records from the db are what are in your paste... it should be fine | 15:43 |
| prometheanfire | ok | 15:43 |
| *** ebalduf has joined #openstack-keystone | 15:43 | |
| morgan | i assume you're using an openrc file? | 15:43 |
| prometheanfire | ya | 15:43 |
| morgan | can you just take a look to make sure your auth_URL isn't somehow in there twice, once with "admin" wedged next to the port? | 15:44 |
| *** real56 has joined #openstack-keystone | 15:44 | |
| morgan | just 3x checking | 15:44 |
| prometheanfire | admin isn't in there at all | 15:44 |
| morgan | cool. | 15:44 |
| morgan | hmm | 15:44 |
| samueldmq | ayoung: sure, looking | 15:45 |
| ayoung | thanks | 15:46 |
| morgan | ayoung: what if i don't want to look?! what then? :P | 15:46 |
| morgan | ayoung: will look when i'm done with helping prometheanfire | 15:46 |
| ayoung | morgan, then you can just come in at the last minute and -2 something like someone else that couldn't be bothered being involved in design decisions | 15:46 |
| morgan | ayoung: oh, perfect | 15:46 |
| morgan | ayoung: let me just -2 it now | 15:46 |
| morgan | ;) | 15:47 |
| ayoung | morgan, can you -2 an Etherpad? | 15:47 |
| *** mylu has joined #openstack-keystone | 15:47 | |
| morgan | ayoung: there we go. | 15:48 |
| morgan | i think i just did | 15:48 |
| prometheanfire | morgan: it could have something to do with my project domain name and user domain name maybe? though default is the only entry in the domain table | 15:48 |
| ayoung | Heh | 15:48 |
| morgan | ayoung: ok ok back to helping prometheanfire | 15:48 |
| morgan | prometheanfire: unlikely. | 15:48 |
| *** mylu has quit IRC | 15:49 | |
| *** mylu has joined #openstack-keystone | 15:49 | |
| prometheanfire | wonder if it's in here https://github.com/openstack/keystone/blob/stable/mitaka/keystone/common/wsgi.py#L371 | 15:50 |
| morgan | prometheanfire: ok... next step, can you give me a full paste of the openstack endpoint list --debug? | 15:50 |
| morgan | prometheanfire: that was what i was looking at, but i need to duplicate the issue / have confidence i know where the issue comes from before we change something | 15:51 |
| morgan | prometheanfire: most of that code only is triggerd if you have [eventlet_server] in your config file | 15:52 |
| prometheanfire | morgan: http://paste.openstack.org/show/492094/ | 15:52 |
| *** jsavak has quit IRC | 15:53 | |
| *** mylu has quit IRC | 15:53 | |
| *** jsavak has joined #openstack-keystone | 15:53 | |
| morgan | prometheanfire: oooh | 15:54 |
| morgan | you have your keystone behind nginx? | 15:54 |
| prometheanfire | yes | 15:54 |
| morgan | prometheanfire: ok. this might help me a bit more | 15:55 |
| prometheanfire | you want the location bit from the nginx config? | 15:55 |
| morgan | one sec. maybe | 15:55 |
| morgan | yeah | 15:56 |
| prometheanfire | I can confirm it doesn't hit that base_url method (inserted prings | 15:56 |
| prometheanfire | I can confirm it doesn't hit that base_url method (inserted prints) | 15:56 |
| *** pgreg has quit IRC | 15:56 | |
| morgan | prometheanfire: cool. thnx for confirming | 15:56 |
| prometheanfire | http://paste.openstack.org/show/492096/ | 15:56 |
| morgan | prometheanfire: oh are you using uwsgi or eventlet on a socket? | 15:57 |
| morgan | prometheanfire: /me is a little confused. | 15:57 |
| morgan | or is nginx just cool :P | 15:58 |
| prometheanfire | nginx -> uwsgi | 15:58 |
| morgan | ahhh ok | 15:58 |
| morgan | nginx looks sane | 15:58 |
| *** diazjf has quit IRC | 15:58 | |
| morgan | this feels like "admin" somewhere has gotten wedged into the host URL. somehow | 15:58 |
| morgan | and keystone is just doing magic to append it. | 15:59 |
| morgan | in a bad way | 15:59 |
| prometheanfire | I think I figured it out | 16:00 |
| prometheanfire | testing now | 16:00 |
| prometheanfire | well, it seems to be getting it from uwsgi_param SCRIPT_NAME | 16:01 |
| prometheanfire | http://paste.openstack.org/show/492098/ | 16:01 |
| morgan | oooh | 16:01 |
| prometheanfire | but removing the param doesn't work | 16:01 |
| morgan | right | 16:02 |
| *** mylu has joined #openstack-keystone | 16:02 | |
| morgan | but hmmm that shouldn't affect the base links like that | 16:03 |
| prometheanfire | well, setting it to an empty string seems to get further | 16:03 |
| prometheanfire | 2016-03-28 11:03:15.329 9855 ERROR keystone.auth.plugins.core DomainNotFound: Could not find domain: default | 16:03 |
| *** mylu has quit IRC | 16:03 | |
| morgan | that one i've seen before | 16:04 |
| *** lhcheng has joined #openstack-keystone | 16:04 | |
| *** ChanServ sets mode: +v lhcheng | 16:04 | |
| *** tqtran has joined #openstack-keystone | 16:04 | |
| prometheanfire | oh? | 16:05 |
| morgan | prometheanfire: that is likely you did OS_DOMAIN_NAME=default | 16:05 |
| morgan | which the name is "Default" | 16:05 |
| prometheanfire | ah, right | 16:05 |
| morgan | if you used OS_DOMAIN_ID=default it would work | 16:05 |
| prometheanfire | id is default, name is Default | 16:05 |
| prometheanfire | in the db | 16:05 |
| morgan | yep | 16:05 |
| *** jorge_munoz has joined #openstack-keystone | 16:05 | |
| morgan | OS_DOMAIN_ID=default or OS_DOMAIN_NAME=Default | 16:06 |
| morgan | we... are case sensitive in domain_name (even though I am not sure we should be) | 16:06 |
| morgan | or osc does something weird on the name. | 16:06 |
| prometheanfire | ya, switch and now it can't access fernet keys, perm issue | 16:06 |
| *** jorge_munoz_ has joined #openstack-keystone | 16:06 | |
| morgan | ok, that is totally solvable | 16:07 |
| morgan | and not a keystone issue :P but a posix permissions issue | 16:07 |
| lbragstad | dolphm yeah - _get_roles_for_user is taking a ton of time | 16:07 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L279-L287 | 16:07 |
| prometheanfire | or that dir went away | 16:07 |
| morgan | right. the keys are... not available to the app, regardless of the reason | 16:07 |
| lbragstad | dolphm both calls to the assignment_api are cached and the role_api.get_role() is also cached | 16:07 |
| *** mylu has joined #openstack-keystone | 16:08 | |
| morgan | so can you summarize exactly what triped you up in the upgrade? So we can either fix developer docs and/or provide a fix in code? [just so i am not chasing through a ton of IRC locks to find it] | 16:08 |
| prometheanfire | and there, it works | 16:09 |
| dolphm | lbragstad: _list_effective_role_assignments = _get_group_ids_for_user_id + list_role_assignments_for_actor | 16:09 |
| dolphm | both of which are dog slow | 16:09 |
| prometheanfire | dolphm: hi | 16:09 |
| dolphm | prometheanfire: o/ | 16:10 |
| prometheanfire | morgan: the issue was in my nginx config | 16:10 |
| *** jorge_munoz has quit IRC | 16:10 | |
| *** jorge_munoz_ is now known as jorge_munoz | 16:10 | |
| prometheanfire | the before and after | 16:10 |
| prometheanfire | # uwsgi_param SCRIPT_NAME admin; uwsgi_param SCRIPT_NAME ''; | 16:10 |
| prometheanfire | well, not all in one line... | 16:10 |
| morgan | prometheanfire: great. thnx- can you now let me know what was wrong with the migrations? | 16:10 |
| ayoung | dolphm, nested queires the problem? | 16:10 |
| lbragstad | dolphm but get_roles_for_user_and_domain and get_roles_for_user_and_project should cache on argument, right? | 16:10 |
| prometheanfire | sure | 16:10 |
| morgan | prometheanfire: those [if needed] are likely going to be another RC. | 16:11 |
| dolphm | ayoung: not sure yet | 16:11 |
| prometheanfire | morgan: those variables do seem to be needed | 16:11 |
| morgan | ah. | 16:11 |
| prometheanfire | without it I get the error here http://paste.openstack.org/show/492098/ | 16:12 |
| *** dan_nguyen has joined #openstack-keystone | 16:12 | |
| morgan | prometheanfire: ahh, so we are doing weird things with the links. | 16:13 |
| prometheanfire | ya, somewhere | 16:13 |
| dolphm | ayoung: we're digging through a profiling run of fernet token validation w/ caching enabled http://cdn.pasteraw.com/q3frata9qgad1g0nx971nj9p4le9kek | 16:13 |
| dolphm | lbragstad: caching *is* enabled here, right? | 16:13 |
| prometheanfire | morgan: I had to comment out this https://github.com/openstack/keystone/blob/stable/mitaka/keystone/common/sql/migrate_repo/versions/088_domain_specific_roles.py#L32-L33 | 16:13 |
| lbragstad | dolphm CONF.cache.enabled = True | 16:14 |
| morgan | prometheanfire: oooh | 16:14 |
| lbragstad | catalog caching defaults to true | 16:14 |
| morgan | prometheanfire: so we need to figure out how to do that same thing in pgsql | 16:14 |
| prometheanfire | I had to comment out a thing here too, but forget which :( https://github.com/openstack/keystone/blob/stable/mitaka/keystone/common/sql/migrate_repo/versions/091_migrate_data_to_local_user_and_password_tables.py | 16:14 |
| morgan | prometheanfire: can you restore an isolated DB from a backup and just try to do a migration and see where it fails (and file a couple bugs on the specifics) | 16:15 |
| lbragstad | dolphm I can set CONF.resource.caching = true and CONF.catalog.caching = true and rerun? | 16:15 |
| lbragstad | even though they default to true anyway | 16:15 |
| *** e0ne has quit IRC | 16:16 | |
| ayoung | dolphm, the cache looks like it is slow | 16:16 |
| prometheanfire | no, I was stupid, forgot to do a snap | 16:16 |
| morgan | prometheanfire: and ping me with the IDs and (or i can) tag the bugs for the rc-potential | 16:16 |
| ayoung | /opt/stack/keystone/keystone/common/cache/_context_cache.py:93(get) -> 10388 | 16:16 |
| morgan | prometheanfire: since i think if it's an issue we are legitimately going to need another RC. | 16:16 |
| prometheanfire | I'll make a bug for 088 and mention 091 | 16:17 |
| dolphm | lbragstad: ideally, we would just have caching on list_role_assignments() and be done -- but ... morgan: can we cache on kwargs in mitaka? | 16:17 |
| prometheanfire | both should fail with psql | 16:17 |
| morgan | dolphm: no, but i have a fix that could make it work | 16:17 |
| ayoung | dolphm, that is one of the larges numbers in there. Is it caching to memcache? Maybe the IPC is the bottleneck. | 16:18 |
| lbragstad | dolphm list_role_assignments()? where do we call that in get_token_data? | 16:18 |
| lbragstad | here - https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L415 | 16:19 |
| dolphm | ayoung: i think we're just doing a bunch of repetitive work in keystone that we were not doing in liberty | 16:19 |
| ayoung | dolphm, during token validation? | 16:19 |
| morgan | dolphm: https://bitbucket.org/zzzeek/dogpile.cache/pull-requests/46/add-a-key-word-arg-aware-cache-key/diff this is the kwarg aware key-generator | 16:20 |
| dolphm | lbragstad: list_role_assignments() is called by /opt/stack/keystone/keystone/common/manager.py:115(wrapped) | 16:20 |
| dolphm | lbragstad: which is called by /opt/stack/keystone/keystone/middleware/auth.py:77(_build_token_auth_context) | 16:20 |
| morgan | dolphm: if we apply that to oslo.cache (it would need to be oslo.cache at this point i think -- might be something we can apply to mitaka in our code) | 16:21 |
| lbragstad | oh - it looks related to implied roles | 16:21 |
| lbragstad | https://github.com/openstack/keystone/commit/a270766eb9c3f2074af550a72661a6a825e9975b | 16:21 |
| prometheanfire | morgan: https://bugs.launchpad.net/keystone/+bug/1562934 | 16:21 |
| openstack | Launchpad bug 1562934 in OpenStack Identity (keystone) "liberty -> mitaka db migrate fails on postgresql" [Undecided,New] | 16:21 |
| morgan | prometheanfire: thanks. | 16:21 |
| dolphm | lbragstad: so, morgan's solution sounds like a possible solution. otherwise, we should look further down the stack | 16:22 |
| dolphm | (in keystone, for places to add caching) | 16:22 |
| roxanaghe | ayoung: knikolla: so I've started looking at unit tests for the new ldap3 driver and it seems like there is no completely implemented mock lib for ldap3 yet | 16:22 |
| roxanaghe | ayoung: knikolla: see https://github.com/cannatag/ldap3/issues/115 | 16:23 |
| ayoung | roxanaghe, looking | 16:23 |
| morgan | prometheanfire: can you try and duplicate the 91 issue? | 16:23 |
| ayoung | roxanaghe, I don;t think we were using those in Keystone. We built our own...IIRC | 16:24 |
| prometheanfire | morgan: the SCRIPT_NAME thing, that a doc issue? | 16:24 |
| roxanaghe | ayoung: yes, I saw we have the fakeldap module which is basically our own mock | 16:25 |
| *** fawadkhaliq has joined #openstack-keystone | 16:25 | |
| ayoung | yep http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/fakeldap.py | 16:25 |
| *** diazjf has joined #openstack-keystone | 16:25 | |
| morgan | prometheanfire: the db_sync one (91 migration) | 16:25 |
| morgan | prometheanfire: maybe in an isolated restore from a previous db snapshot? | 16:25 |
| roxanaghe | ayoung: but that fakeldap won't be good for ldap3 because it uses python-ldap | 16:25 |
| prometheanfire | morgan: not sure I can reproduce :( | 16:25 |
| ayoung | roxanaghe, and, yes, I don't love it and would rather use the upstream | 16:25 |
| prometheanfire | I don't have a snapshot | 16:25 |
| morgan | prometheanfire: ah no worries then | 16:25 |
| morgan | ah, next time for upgrade i recommend taking a dump/snapshot (for restore purposes) and also so we can try fixing it if you run across things like this again. | 16:26 |
| prometheanfire | morgan: if I could get translations into sql syntax (for both 88 and 91) then I might be able to give more info | 16:26 |
| prometheanfire | your stuff isn't as easy to read as neutron's db_upgrade stuff | 16:26 |
| morgan | prometheanfire: sure. let me know, i'll see what i can do (I admit I'm way way way less familiar with pgsql) | 16:26 |
| *** spzala_ has joined #openstack-keystone | 16:26 | |
| prometheanfire | morgan: mysql syntax is fine | 16:27 |
| prometheanfire | I'll translate | 16:27 |
| morgan | stevemar: https://bugs.launchpad.net/keystone/+bug/1562934 RC-Potential | 16:27 |
| openstack | Launchpad bug 1562934 in OpenStack Identity (keystone) "liberty -> mitaka db migrate fails on postgresql" [High,New] | 16:27 |
| lbragstad | dolphm what would be our other option? We could try and make list_role_assignments() not take kwargs and make it explicit, then we could add caching like we do to everything else in keystone | 16:27 |
| prometheanfire | stevemar: I'm around on irc to help with that too | 16:27 |
| *** madhuri has joined #openstack-keystone | 16:27 | |
| morgan | stevemar: going to work with prometheanfire to try and address it. | 16:27 |
| ayoung | samueldmq, so, what do you think? Do we drive on with Puppet and Heat, or do we try to make it work with the Dynamic approach? | 16:27 |
| *** gyee has joined #openstack-keystone | 16:28 | |
| *** ChanServ sets mode: +v gyee | 16:28 | |
| morgan | prometheanfire: i, unfortunately have a job interview today and a flight and a ton of things to do when I get home, so it might be tomorrow. | 16:28 |
| madhuri | Hi keystone team! I am facing this error "Could not determine a suitable URL for the plugin" with devstack setup | 16:28 |
| roxanaghe | ayoung: so should we try help the development of the mock lib for ldap3 upstream in the open source repo? | 16:28 |
| morgan | prometheanfire: yay for being unemployed :( | 16:28 |
| prometheanfire | morgan: ok | 16:28 |
| prometheanfire | morgan: good luck | 16:28 |
| madhuri | Could you please help? | 16:28 |
| ayoung | roxanaghe, well, that would be the more generally useful approach. | 16:28 |
| morgan | roxanaghe: /wave - that would be a nice approach | 16:28 |
| prometheanfire | morgan: stevemar: if you know a way to re-run a particular migration that would work | 16:29 |
| morgan | prometheanfire: usually - I use a DB restore | 16:29 |
| roxanaghe | ayoung: yeah, not sure if it's the fastest :) | 16:29 |
| morgan | prometheanfire: then run it, try a fix, restore DB, run it, etc | 16:29 |
| prometheanfire | ya | 16:29 |
| morgan | prometheanfire: it's really the only sure-fire way to guarantee reproduction of migration issues | 16:29 |
| roxanaghe | ayoung: morgan: but I would like to take a look at how big the work is there | 16:29 |
| morgan | roxanaghe: ++ | 16:29 |
| ayoung | roxanaghe, but it is probably the most long-term maintainable. We could carry a local copy of the mock until it got merged upstream. It looks like somone has started | 16:30 |
| prometheanfire | I'll see if I can decode your sql statements :P | 16:30 |
| *** spzala has quit IRC | 16:30 | |
| morgan | prometheanfire: thanks. | 16:30 |
| ayoung | roxanaghe, ah...no it looks like he went his own way | 16:30 |
| morgan | prometheanfire: i am guessing the uniqueconstraing error is just an issue with "what the heck pgsql does with unique constraints" | 16:31 |
| ayoung | roxanaghe, https://github.com/tjcsl/ion/issues/369 ? | 16:31 |
| prometheanfire | pribably | 16:31 |
| ayoung | closed? | 16:31 |
| prometheanfire | the second one worked though | 16:31 |
| prometheanfire | it's how it interacts with the drop most likely | 16:31 |
| morgan | prometheanfire: right. | 16:31 |
| *** jsavak has quit IRC | 16:31 | |
| ayoung | ah, that is an external project | 16:31 |
| prometheanfire | what does that do anyway, I'm not familiar with UniqueConstraint | 16:32 |
| roxanaghe | ayoung: https://github.com/cannatag/ldap3/blob/master/ldap3/strategy/mockSync.py this is the start of it | 16:32 |
| *** mylu has quit IRC | 16:32 | |
| *** jsavak has joined #openstack-keystone | 16:32 | |
| *** browne has quit IRC | 16:32 | |
| roxanaghe | ayoung: I saw that - that seems to be another project which I didn't quite understand what it really does :) | 16:32 |
| ayoung | yeah | 16:32 |
| morgan | it would be nice if ldap3 had a "betamax" like interface | 16:33 |
| *** jsavak has quit IRC | 16:33 | |
| morgan | where we could just record responses from a real ldap server and replay them. | 16:33 |
| ayoung | morgan, better than the normal one but doomed to obscurity? | 16:33 |
| prometheanfire | morgan: I'll tell sigmavirus24, iirc he wrote it | 16:33 |
| *** jsavak has joined #openstack-keystone | 16:33 | |
| sigmavirus24 | prometheanfire: you realize I am right here, right? | 16:33 |
| morgan | prometheanfire: the way betamax works is hooks into requests - a very different interface/style than ldp3 | 16:33 |
| sigmavirus24 | That said, I don't have a need for that, so I'm not about to write it :P | 16:34 |
| prometheanfire | sigmavirus24: of course :P | 16:34 |
| sigmavirus24 | morgan: is also correct | 16:34 |
| *** rderose has quit IRC | 16:34 | |
| roxanaghe | ayoung: morgan: what these guys are trying to do is implement a pure python ldap server http://sldap3.readthedocs.org/en/latest/ and use that to do mocking | 16:34 |
| morgan | roxanaghe: i've seen that... i'm suspect on a "pure python ldap" server | 16:34 |
| roxanaghe | morgan: aha | 16:35 |
| prometheanfire | morgan: if you have a mitaka server, can you 'select * from role;' and tell me what's in the domain_id collumn | 16:35 |
| *** mylu has joined #openstack-keystone | 16:35 | |
| prometheanfire | also, 'ixu_role_name' isn't mentioned at all anywhere in that table | 16:36 |
| prometheanfire | so maybe I don't have to care or it was removed and still errored | 16:36 |
| ayoung | roxanaghe, I'm tempted to leave our implementation in place to start, maybe clean it up. A general purpose mock often degenerates into a full, but poor, implementation | 16:36 |
| morgan | prometheanfire: ah we might need to do a lookup on the constraint. | 16:36 |
| morgan | prometheanfire: instead of fixed name drop | 16:36 |
| prometheanfire | well, I consider 088 to have completed 'successfully' based off what I can see it trying to do | 16:37 |
| ayoung | roxanaghe, If thee were something already available, I might be more tempted to rewrite, but since there isn't, maybe we just look at the nastiness of ours and clean it up | 16:37 |
| morgan | prometheanfire: right. | 16:37 |
| prometheanfire | that collumn is full of <<null>> for me though | 16:37 |
| prometheanfire | that seems odd | 16:37 |
| roxanaghe | ayoung: so you're thinking make a fakeldap for ldap3? | 16:38 |
| ayoung | roxanaghe, yes, but I am easily persuadable either way. You make the call. | 16:38 |
| morgan | prometheanfire: we'll need to just check before dropping/make sure constraints are cleared as expected | 16:38 |
| morgan | prometheanfire: i wont have a mitaka db for a bit | 16:39 |
| prometheanfire | ok | 16:39 |
| morgan | prometheanfire: like i said, this might be tomorrow. or at least later this afternoon | 16:39 |
| prometheanfire | k | 16:39 |
| prometheanfire | if I understood UniqueConstraint better I could translate easier | 16:40 |
| stevemar | morgan: prometheanfire: what ended up happening with the funky url? | 16:40 |
| prometheanfire | stevemar: the script requires a variable SCRIPT_NAME to be passed | 16:41 |
| stevemar | prometheanfire: ah nice | 16:41 |
| prometheanfire | previously it was set to admin, this caused URLs to have that variable prepended to the path | 16:41 |
| knikolla | ayoung, roxanaghe: just read the conversation | 16:41 |
| prometheanfire | so http://example.com:5000admin/v3 | 16:42 |
| stevemar | prometheanfire: yep yep, now for the postgres bug | 16:42 |
| prometheanfire | it still requires that variable to be set, but I set it to '' | 16:42 |
| prometheanfire | ok, done with the SCRIPT_NAME bug | 16:42 |
| stevemar | bknudson: are the opportunistic db tests running? | 16:42 |
| roxanaghe | ayoung: ok, let me research some more. I'm more inclined to contribute to the open source project since our fakeldap is strongly related to our python-ldap implementation | 16:43 |
| prometheanfire | stevemar: if you could translate this to actual sql, I might be able to test some more https://github.com/openstack/keystone/blob/stable/mitaka/keystone/common/sql/migrate_repo/versions/088_domain_specific_roles.py#L32-L37 | 16:43 |
| ayoung | roxanaghe, ++ | 16:43 |
| *** ebalduf has quit IRC | 16:43 | |
| knikolla | roxanaghe, ++ | 16:43 |
| stevemar | prometheanfire: sure, lemme see | 16:44 |
| *** david-lyle_ has joined #openstack-keystone | 16:44 | |
| knikolla | ayoung, we're pretty early in the so I think we can afford going the longer term best route. | 16:44 |
| knikolla | in the cycle* | 16:44 |
| *** rderose has joined #openstack-keystone | 16:44 | |
| *** david-lyle has quit IRC | 16:44 | |
| ayoung | knikolla, sure, just want to make sure we are realistice about that. | 16:45 |
| roxanaghe | knikolla: ldap3 seems so cool in terms of APIs and docs, it just that they are still early implementation in terms of unit testing tools :) | 16:45 |
| *** real56 has quit IRC | 16:45 | |
| prometheanfire | I think that drops the old entries from the domain_id collumn and repopulates it with ixu_role_name_domain_id staticly | 16:46 |
| *** real56 has joined #openstack-keystone | 16:46 | |
| lbragstad | rderose nice clean up here - https://review.openstack.org/#/c/294305/ | 16:46 |
| patchbot | lbragstad: patch 294305 - keystone - Moved name formatting (clean) out of the driver | 16:46 |
| knikolla | roxanaghe, agree on the APIs, but I found the docs a bit shallow at places. | 16:47 |
| rderose | lbragstad: thanks man :) | 16:47 |
| lbragstad | rderose thank you | 16:47 |
| *** real56 has quit IRC | 16:47 | |
| *** david-lyle has joined #openstack-keystone | 16:48 | |
| *** real56 has joined #openstack-keystone | 16:48 | |
| roxanaghe | knikolla: I see. also, do you know if we will have to do a lot of code customization to work with AD server? | 16:48 |
| *** david-lyle_ has quit IRC | 16:49 | |
| knikolla | roxanaghe, i don't think so. we'll find out. | 16:50 |
| knikolla | gotta go now, lunch break. | 16:50 |
| roxanaghe | knikolla: cool, have a good one! | 16:50 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Base for keystone tempest plugin https://review.openstack.org/297292 | 16:51 |
| prometheanfire | stevemar: morgan I figured out how to manually run a migration script again, just replace migrate_engine with sql.create_engine('connection_string_here') | 16:54 |
| morgan | prometheanfire: but that doesn't really "re-run" the migration properly | 16:54 |
| morgan | it could also clobber data | 16:54 |
| morgan | ok so the section you highlighted is changing what column is the unique constraint | 16:55 |
| prometheanfire | morgan: true | 16:55 |
| prometheanfire | I've been careful about it so far | 16:55 |
| morgan | prometheanfire: instead of just unique constraint of "role_name" | 16:55 |
| morgan | it now makes the unqiue constraint (role_name, domain_id) | 16:55 |
| prometheanfire | "ixu_role_name_domain_id" UNIQUE CONSTRAINT, btree (name, domain_id) | 16:56 |
| morgan | yeah similar | 16:56 |
| prometheanfire | that's what I have in psql | 16:56 |
| morgan | now... i think this is a broken migration | 16:56 |
| morgan | looking at it | 16:56 |
| morgan | *sigh* | 16:56 |
| prometheanfire | lol | 16:56 |
| morgan | stevemar: ping | 16:56 |
| stevemar | morgan: poke | 16:56 |
| stevemar | i have been trying to translate that into sql, not easy | 16:56 |
| morgan | stevemar: are we doing magic to ensure we aren't duplicating role_name with <<null>> domain_id? | 16:57 |
| morgan | stevemar: oh. i see what we're doing | 16:57 |
| morgan | oh gah.. that is awful | 16:57 |
| morgan | ok | 16:57 |
| prometheanfire | look at my last comment | 16:57 |
| prometheanfire | https://bugs.launchpad.net/keystone/+bug/1562934 | 16:57 |
| openstack | Launchpad bug 1562934 in OpenStack Identity (keystone) "liberty -> mitaka db migrate fails on postgresql" [High,New] | 16:57 |
| prometheanfire | includes translations | 16:57 |
| *** jsavak has quit IRC | 16:58 | |
| prometheanfire | the second error I don't think I got, but am getting now because it was already run | 16:58 |
| morgan | prometheanfire: that makes sense since you already ran the migration | 16:58 |
| morgan | prometheanfire: since the constraint already exists now | 16:58 |
| prometheanfire | the first error I was getting though | 16:58 |
| morgan | ok, it's an issue where the constraint name isn't consistent in pgsql | 16:58 |
| morgan | prometheanfire: can you show me the constraints on your role table? | 16:59 |
| morgan | prometheanfire: in mysql i'd do something like "show create table <role_table_name>" | 16:59 |
| morgan | not sure waht the pgsql equiv is. | 16:59 |
| morgan | but i want to see if you were just missing the contraint before or if it was named differently and is now possibly broken (having both constraints would be bad(tm)) | 17:00 |
| morgan | both = unique(role_name), unique(role_name, domain_id) | 17:00 |
| prometheanfire | http://paste.openstack.org/show/492114/ | 17:00 |
| morgan | yep | 17:00 |
| morgan | role_name_key | 17:00 |
| prometheanfire | that's after the migrate | 17:01 |
| morgan | that is the one that should have been dropped. so we need to do a constraint search | 17:01 |
| morgan | and look for the constraint that only affects role_name | 17:01 |
| stevemar | yeah, role names had to be unique before | 17:01 |
| prometheanfire | so I need to drop that? | 17:01 |
| morgan | ok stevemar this is an RC blocker. | 17:01 |
| morgan | prometheanfire: well we need to fix the migration to do the right thing and make a new one to also do it for people like you who are beyond the migration | 17:01 |
| morgan | it shouldn't impact you today, but it will def. break things in the future | 17:02 |
| prometheanfire | ok | 17:02 |
| prometheanfire | I can test the migration when you have the next one | 17:02 |
| stevemar | morgan: prometheanfire the initial migration failed because the unique constraint (role names) was never there? | 17:03 |
| prometheanfire | stevemar: yes, that's the section I commented out | 17:03 |
| prometheanfire | the drop statement | 17:03 |
| stevemar | i wonder why it was never there... it should have been created long ago | 17:03 |
| prometheanfire | it sounds like it still isn't correct | 17:03 |
| stevemar | you upgraded from havana to liberty, then mitaka? | 17:04 |
| prometheanfire | each release I did db_upgrade | 17:04 |
| prometheanfire | so I didn't skip any | 17:04 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Cleanup LDAP models https://review.openstack.org/285301 | 17:04 |
| morgan | stevemar: yeah he's on the latest mitaka RC | 17:05 |
| morgan | stevemar: marked as "critical" and attached to mitaka and newton. | 17:05 |
| morgan | stevemar: i'll start working on a fix to search for the constraint instead of blindly using the "name" | 17:06 |
| morgan | (we need a new RC target for mitaka) | 17:06 |
| morgan | stevemar: awww.. we already added placeholders =/ | 17:07 |
| stevemar | morgan: yep... | 17:08 |
| samueldmq | ayoung: I looked at it | 17:08 |
| samueldmq | ayoung: maybe starting by improving the existing tooling makes more sense | 17:08 |
| samueldmq | ayoung: what do you propose exactly ? make CMS use the keystone API ? | 17:09 |
| samueldmq | *keystone policy API | 17:09 |
| stevemar | morgan: time to modify one of the placeholders i guess?! | 17:10 |
| *** nisha has joined #openstack-keystone | 17:10 | |
| *** henrynash has joined #openstack-keystone | 17:10 | |
| *** ChanServ sets mode: +v henrynash | 17:10 | |
| prometheanfire | stevemar: morgan: added reminder for myself to make sure the contraints in the role table are corrected | 17:10 |
| *** browne has joined #openstack-keystone | 17:11 | |
| samueldmq | tjcocozz: hi | 17:14 |
| samueldmq | tjcocozz: did we get to a conclusion on this thing : patch 281863 | 17:14 |
| patchbot | samueldmq: https://review.openstack.org/#/c/281863/ - keystone-specs - Clarify projects subtree as list option docs | 17:14 |
| samueldmq | tjcocozz: I mean, I submitted this patch in complement to something you were submitting | 17:14 |
| morgan | stevemar: yeah | 17:15 |
| samueldmq | tjcocozz: iirc it was a test that assumed the ordering | 17:15 |
| morgan | prometheanfire: will ping you with a migration to test | 17:15 |
| morgan | :) | 17:15 |
| prometheanfire | k | 17:15 |
| prometheanfire | looking at 91 now | 17:15 |
| morgan | prometheanfire: we might need to split 91 issue into it's own bug | 17:16 |
| morgan | in fact, we should | 17:16 |
| *** mylu has quit IRC | 17:16 | |
| nisha | hi everyone :) | 17:16 |
| samueldmq | nisha: hi! | 17:17 |
| prometheanfire | that's fine | 17:17 |
| prometheanfire | this row doesn't exist for me | 17:17 |
| prometheanfire | https://github.com/openstack/keystone/blob/stable/mitaka/keystone/common/sql/migrate_repo/versions/091_migrate_data_to_local_user_and_password_tables.py#L51 | 17:17 |
| nisha | hey samueldmq | 17:17 |
| *** mylu has joined #openstack-keystone | 17:18 | |
| samueldmq | nisha: regarding our proposal for outreachy | 17:18 |
| samueldmq | nisha: we can actually start working on the tests themselves (for keystoneclient) | 17:18 |
| samueldmq | nisha: I started the effort by adding the tests for users, see patch 289306 | 17:18 |
| patchbot | samueldmq: https://review.openstack.org/#/c/289306/ - python-keystoneclient - Add users functional tests | 17:18 |
| nisha | samueldmq, do you mean running the tests ? | 17:18 |
| *** mylu has quit IRC | 17:19 | |
| prometheanfire | morgan: bug https://bugs.launchpad.net/keystone/+bug/1562965 | 17:19 |
| openstack | Launchpad bug 1562965 in OpenStack Identity (keystone) " liberty -> mitaka db migrate fails on postgresql 091 migration" [Undecided,New] | 17:19 |
| *** jsavak has joined #openstack-keystone | 17:19 | |
| samueldmq | nisha: we first need to write them; I just wrote the tests for user (see link above) | 17:19 |
| samueldmq | nisha: you can take a look at that, review and test it | 17:19 |
| samueldmq | nisha: so start writting the other tests is already a great step | 17:20 |
| samueldmq | nisha: and we can keep this in the program, and also work on some other improvements | 17:20 |
| samueldmq | nisha: does this make sense ? | 17:23 |
| *** edmondsw has joined #openstack-keystone | 17:23 | |
| samueldmq | henrynash: hi, I addressed your comment in patch 285301 | 17:23 |
| patchbot | samueldmq: https://review.openstack.org/#/c/285301/ - keystone - Cleanup LDAP models | 17:23 |
| samueldmq | henrynash: I didn't know that common/models.py thing was only used by ldap | 17:23 |
| samueldmq | henrynash: lots of things got removed in the new patchset | 17:23 |
| henrynash | samuedlmq: ok, thanks, will take a look | 17:24 |
| *** agrebennikov has joined #openstack-keystone | 17:24 | |
| *** mylu has joined #openstack-keystone | 17:24 | |
| *** david-lyle has quit IRC | 17:24 | |
| morgan | stevemar: this looks "right" http://paste.openstack.org/show/492118/ | 17:25 |
| *** david-lyle has joined #openstack-keystone | 17:25 | |
| morgan | stevemar: 2x check and i'll roll an update to the placeholder | 17:25 |
| morgan | stevemar: also.. lets evaluate low-cost backports since we have RC blocker. (bugs that fixes landed post mitaka rc) | 17:26 |
| nisha | yeah, I think that will work :) | 17:26 |
| nisha | How can I know, which areas need tests and the ones that need improvements? | 17:27 |
| nisha | can we mention that in application or do we plan to work on them as we go? | 17:27 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Add federation related tests https://review.openstack.org/293040 | 17:28 |
| bknudson | stevemar: the opportunistic tests are running in http://logs.openstack.org/37/295837/8/check/gate-keystone-python27-db/61ba0c1/console.html.gz#_2016-03-23_17_29_27_061 | 17:29 |
| ayoung | samueldmq, I don;t know. I don't think we can make a decision until we have the issues clearly laid out | 17:29 |
| prometheanfire | I'm not sure that this will work for anyone | 17:29 |
| prometheanfire | https://github.com/openstack/keystone/blob/9.0.0.0rc1/keystone/common/sql/migrate_repo/versions/091_migrate_data_to_local_user_and_password_tables.py#L51 | 17:29 |
| prometheanfire | the user_password row is never pulled that I can see | 17:30 |
| ayoung | samueldmq, At this exact moment in time I think that the dynamic is still the better approach. | 17:30 |
| *** spandhe_ has joined #openstack-keystone | 17:30 | |
| ayoung | samueldmq, to do that, it would take two things: | 17:30 |
| ayoung | 1. Fetch by URL or something capable of doing the lookup | 17:30 |
| ayoung | 2. Having Puppet configure the URL | 17:30 |
| *** spandhe has quit IRC | 17:31 | |
| *** spandhe_ is now known as spandhe | 17:31 | |
| samueldmq | ayoung: which is basically the same thing we had proposed before | 17:31 |
| ayoung | I guess it would take more than that: we'd also have to prepopulate the config files inside of Keystone. But I guess the endpoints could fall back to the local copy until that happens | 17:31 |
| samueldmq | ayoung: except that ksmiddleware is not hte one fetching the policies (but CMS instead) | 17:31 |
| morgan | prometheanfire: ah good to know | 17:31 |
| ayoung | samueldmq, was middleware fetching in your Proof of concept? | 17:32 |
| samueldmq | ayoung: yes | 17:32 |
| morgan | prometheanfire: i'll take a closer look once i'm done with this change set. | 17:32 |
| prometheanfire | k | 17:32 |
| *** ebalduf has joined #openstack-keystone | 17:32 | |
| ayoung | samueldmq, but policy was still evaluated at the lower level, after middleware, right? | 17:33 |
| prometheanfire | morgan: that patch doesn't work | 17:33 |
| prometheanfire | for 088 | 17:33 |
| morgan | prometheanfire: what is failing on it? | 17:33 |
| prometheanfire | http://paste.openstack.org/show/492119/ | 17:33 |
| morgan | prometheanfire: i might need to reconstruct the constraint itself. | 17:33 |
| morgan | oh. | 17:34 |
| morgan | that is annoying | 17:34 |
| morgan | ok i'll fix. | 17:34 |
| morgan | sec | 17:34 |
| prometheanfire | k | 17:34 |
| *** BigWillie has joined #openstack-keystone | 17:36 | |
| ayoung | samueldmq, I think there are some other issues with the middleware approach. Namely, the directory management part is tricky to get right. That was a part of PKI tokens I never felt happy with. | 17:38 |
| samueldmq | ayoung: well, if we provide a consistent policy API and people do use it with their CMS | 17:39 |
| samueldmq | ayoung: I'd be happy with that too; it's up to deployers if they decide to use the API that way | 17:39 |
| prometheanfire | if role_table.c.name.name in c.columns and len(c.columns) == 1: | 17:40 |
| prometheanfire | though c.drop doesn't work, it isn't a method | 17:40 |
| ayoung | samueldmq, OK, I'm going to put this on the Agenda for tomorrow. | 17:40 |
| samueldmq | ayoung: sounds good | 17:41 |
| bknudson | there's a postgres gate job that runs all the time and db_sync works fine -- http://logs.openstack.org/10/296110/2/check/gate-tempest-dsvm-postgres-full/e9c77d9/logs/devstacklog.txt.gz#_2016-03-28_11_50_13_452 | 17:42 |
| prometheanfire | bknudson: might be an edge case | 17:43 |
| ayoung | bknudson, so, I had a downstream request for a "limit" parameter for token flush. I had brushed it off (since we are headed toward fernet) but...starting to think it would be the right thing to do | 17:43 |
| ayoung | would that gate job test token flush, too? | 17:43 |
| *** doug-fis_ has quit IRC | 17:43 | |
| bknudson | ayoung: gate jobs don't configure token flushing as far as I know | 17:44 |
| bknudson | the token flush job already splits up the deletes into chunks | 17:44 |
| ayoung | bknudson, ok...might be a difference in behavior between RDBMSes. WHat is you take? Should we to a limit? | 17:44 |
| ayoung | when did that happen? | 17:44 |
| bknudson | what's the problem that they're trying to solve? | 17:45 |
| bknudson | it's probably been a year or a year and a half since that was added to token flush | 17:45 |
| ayoung | bknudson, huge initial flush if it was not set up at the start | 17:45 |
| ayoung | bknudson, https://bugzilla.redhat.com/show_bug.cgi?id=1127788 | 17:45 |
| openstack | bugzilla.redhat.com bug 1127788 in openstack-keystone "[RFE] keystone-manage token_flush fails when there is a huge number of tokens to flush" [Low,Assigned] - Assigned to ayoung | 17:45 |
| morgan | prometheanfire: so something more like http://paste.openstack.org/show/492122/ | 17:46 |
| morgan | see the difference between my last one and the new one on line 27,28,29 | 17:47 |
| prometheanfire | yep | 17:47 |
| bknudson | ayoung: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/persistence/backends/sql.py#n278 -- there's the loop | 17:47 |
| bknudson | the code kept changing for some reason | 17:48 |
| prometheanfire | morgan: fails, but maybe I don't need to run it on my DB | 17:48 |
| bknudson | ayoung: batch_size=1000 | 17:48 |
| morgan | prometheanfire: did it fail ont he second one? | 17:48 |
| morgan | creating the constraint or in the drop line? | 17:49 |
| morgan | if it failed in the drop line i have a bit more work to do, but it's getting closer | 17:49 |
| morgan | if it failed making the constraint, it worked as expected (and i'll need you to check the constraints on your table again) | 17:49 |
| prometheanfire | sec | 17:49 |
| prometheanfire | does this need the migration run? http://paste.openstack.org/show/492124/ | 17:50 |
| morgan | yup | 17:50 |
| morgan | ok it didn't work | 17:50 |
| morgan | *argh* | 17:50 |
| prometheanfire | ProgrammingError: (psycopg2.ProgrammingError) constraint "name" of relation "role" does not exist [SQL: 'ALTER TABLE role DROP CONSTRAINT name'] | 17:50 |
| morgan | give me a few, pushing it to gerrit and then will spin up a VM for me to really dig more into it. | 17:50 |
| prometheanfire | that's the error | 17:50 |
| prometheanfire | ok | 17:51 |
| prometheanfire | why's the sql you want to run? | 17:51 |
| prometheanfire | alter table role drop constraint role_name_key; | 17:51 |
| prometheanfire | morgan: ^ I think that's what you want? | 17:51 |
| prometheanfire | in my case | 17:51 |
| morgan | prometheanfire: right. but i'm trying to do it as part of the ORM, so i need to figure out the correct syntax to make the ORM return that | 17:52 |
| prometheanfire | right | 17:52 |
| prometheanfire | I'll try to figure it out as well, just wanted to be clear on the goal before I worked toward it | 17:52 |
| morgan | yeah, i think i know what it needs to be, i was just trying to be a bit more clever than I should have been | 17:53 |
| *** tqtran has quit IRC | 17:53 | |
| *** tellesnobrega_af is now known as tellesnobrega | 17:53 | |
| gmmaha | morgan: quick Q about the _member_ role. When should we really need it? I have a fresh master install of sources and admin user cannot create new project or user without the _member_ role being added.. Am i missing something w.r.t configs thats causinng this? | 17:54 |
| morgan | prometheanfire: ok try changing line 39 to: migrate.UniqueConstraint(role_table.c.name, name=c.name).drop() | 17:54 |
| prometheanfire | ok | 17:54 |
| prometheanfire | still the same | 17:55 |
| morgan | exact same error? | 17:55 |
| morgan | it should be ALTER TABLE role DROP CONSTRAINT role_name_key now... afact | 17:56 |
| prometheanfire | c.name has three values | 17:56 |
| morgan | erp... wha? | 17:56 |
| prometheanfire | I replaced the c.drop with print c.name | 17:56 |
| morgan | what are the values? | 17:56 |
| prometheanfire | http://paste.openstack.org/show/492126/ | 17:57 |
| prometheanfire | I think it's because I have this already | 17:57 |
| prometheanfire | "ixu_role_name_domain_id" UNIQUE CONSTRAINT, btree (name, domain_id) | 17:57 |
| *** e0ne has joined #openstack-keystone | 17:57 | |
| morgan | hmm. | 17:57 |
| morgan | no something else is weird. | 17:57 |
| morgan | ok well i am a lot closer. | 17:57 |
| morgan | i just need to figure out if i can just use the constraint object from the table instead of needing to reconstruct it. | 17:58 |
| morgan | have a phone call in 3 mins... so back when that is done | 17:58 |
| prometheanfire | k, good luch | 17:59 |
| prometheanfire | k, good luck | 17:59 |
| *** jsavak has quit IRC | 18:01 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Add `patch_cover` to keystone https://review.openstack.org/294189 | 18:01 |
| *** jsavak has joined #openstack-keystone | 18:02 | |
| *** doug-fish has joined #openstack-keystone | 18:04 | |
| *** doug-fis_ has joined #openstack-keystone | 18:05 | |
| tjcocozz | samueldmq, hey! about 281863. as far as i know between the push back from both our patches i didn't see a conclusion :p Any idea on how to move foward? | 18:06 |
| *** ericksonsantos has quit IRC | 18:07 | |
| *** agrebennikov has quit IRC | 18:08 | |
| *** doug-fish has quit IRC | 18:09 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Add `patch_cover` to keystone https://review.openstack.org/294189 | 18:10 |
| *** david-lyle_ has joined #openstack-keystone | 18:12 | |
| *** david-lyle has quit IRC | 18:14 | |
| *** pcaruana has quit IRC | 18:16 | |
| samueldmq | tjcocozz: looks like we can't make sure the drivers do that | 18:18 |
| samueldmq | tjcocozz: but could order in the manager | 18:18 |
| samueldmq | tjcocozz: if we want to do that | 18:18 |
| tjcocozz | samueldmq, I think that would be best. | 18:19 |
| *** henrynash has quit IRC | 18:20 | |
| *** henrynash has joined #openstack-keystone | 18:20 | |
| *** ChanServ sets mode: +v henrynash | 18:20 | |
| *** agrebennikov has joined #openstack-keystone | 18:21 | |
| *** edmondsw has quit IRC | 18:23 | |
| *** nisha_ has joined #openstack-keystone | 18:25 | |
| stevemar | prometheanfire: i wonder how many other ppl will hit this issue | 18:26 |
| prometheanfire | stevemar: dunno, I'm guessing people that have had long lived installs | 18:27 |
| *** nisha has quit IRC | 18:29 | |
| *** rderose has quit IRC | 18:29 | |
| samueldmq | tjcocozz: first questions first | 18:30 |
| prometheanfire | stevemar: maybe only long lived with postgres, not sure | 18:30 |
| *** real56 has quit IRC | 18:30 | |
| samueldmq | tjcocozz: do we have a reason to constrain it that way? | 18:30 |
| samueldmq | tjcocozz: i.e the result is ordered? | 18:30 |
| *** pcaruana has joined #openstack-keystone | 18:30 | |
| *** nisha_ has quit IRC | 18:30 | |
| tjcocozz | samueldmq, i am pretty sure it required for the hierarchical bp to work | 18:31 |
| samueldmq | tjcocozz: to work or to be optimized ? if it isn't ordered, the hierarchical code could order it | 18:32 |
| *** real56 has joined #openstack-keystone | 18:32 | |
| samueldmq | tjcocozz: or we could simply make the manager order it before returning | 18:32 |
| tjcocozz | samueldmq, i thought we used it make sure the project were delete in the correct order. | 18:32 |
| samueldmq | tjcocozz: and that's very bad if the hmt code is making that assumption | 18:32 |
| samueldmq | tjcocozz: ah yes, in the case of a delete cascade | 18:33 |
| samueldmq | tjcocozz: ++ | 18:33 |
| samueldmq | tjcocozz: I think in that case, the caller should order it; it's a very specific case | 18:33 |
| *** ebalduf has quit IRC | 18:33 | |
| tjcocozz | samueldmq, okay then that won't be to hard to do. I one of the patch set of the delete patch had a function to order the projects | 18:34 |
| *** tqtran has joined #openstack-keystone | 18:34 | |
| *** sdake_ has joined #openstack-keystone | 18:34 | |
| tjcocozz | samueldmq, should just be copy paste :p | 18:34 |
| *** sdake_ has quit IRC | 18:35 | |
| rodrigods | tjcocozz, why do you need specifically the list? can't you use subtree_as_ids? | 18:35 |
| rodrigods | (which returns a dict) | 18:35 |
| rodrigods | and ensures ordering | 18:35 |
| * tjcocozz is looking at subtree_as_ids now | 18:36 | |
| *** sdake has quit IRC | 18:37 | |
| tjcocozz | rodrigods this is what you are talking about https://github.com/openstack/keystone/blob/ca04d535c8d14d082fb785cf414b30e1405a7360/keystone/resource/core.py#L637? | 18:38 |
| rodrigods | tjcocozz, yes | 18:38 |
| ayoung | how can I find out who has +2 on a project? oslo.context in this case, but is there a definitive place to look these up? | 18:39 |
| *** sdake has joined #openstack-keystone | 18:39 | |
| rodrigods | ayoung, groups in gerrit | 18:39 |
| *** henrynash has quit IRC | 18:39 | |
| stevemar | rodrigods: ++ | 18:39 |
| *** rderose has joined #openstack-keystone | 18:39 | |
| rodrigods | ayoung, for example https://review.openstack.org/#/admin/groups/106,members | 18:39 |
| *** pushkaru has quit IRC | 18:40 | |
| ayoung | rodrigods, so that is the group itself. Is there a publically queryable way to map from repo to group? | 18:40 |
| *** pushkaru has joined #openstack-keystone | 18:40 | |
| ayoung | rodrigods, for example, I can approve oslo policy changes, but I am not on that list | 18:40 |
| rodrigods | ayoung, is always something like *-core | 18:41 |
| *** knikolla_ has joined #openstack-keystone | 18:41 | |
| rodrigods | ayoung, you can approve because you are here https://review.openstack.org/#/admin/groups/556,members | 18:41 |
| ayoung | rodrigods, I know...but that is a heuristic. I was wondering where that is enforced, and if it is public | 18:41 |
| rodrigods | ayoung, it appears in launchpad too | 18:41 |
| stevemar | ayoung: that may be in project-config | 18:41 |
| rodrigods | stevemar, ++ | 18:41 |
| morgan | stevemar: anyone who has long-lived installs could have mis-matched keys | 18:42 |
| stevemar | ayoung: https://github.com/openstack-infra/project-config/blob/e028bf1b358b4dde96326fe193ad8193b575ab0f/gerrit/acls/openstack/oslo.policy.config#L3 | 18:42 |
| morgan | stevemar: i also think very few have upgraded to mitaka yet | 18:42 |
| *** doug-fis_ has quit IRC | 18:43 | |
| *** doug-fish has joined #openstack-keystone | 18:44 | |
| *** sdake has quit IRC | 18:44 | |
| ayoung | ah so for us it is http://git.openstack.org/cgit/openstack-infra/project-config/tree/gerrit/acls/openstack/keystone.config#n6 | 18:44 |
| stevemar | ayoung: yeah, each repo has it's own config | 18:45 |
| *** henrynash has joined #openstack-keystone | 18:46 | |
| *** ChanServ sets mode: +v henrynash | 18:46 | |
| *** sdake has joined #openstack-keystone | 18:48 | |
| *** madhuri has quit IRC | 18:48 | |
| *** e0ne has quit IRC | 18:50 | |
| dolphm | morgan: i'm running into a circular dependency trying to add caching to the federation backend... is there a better place to put this? https://github.com/openstack/keystone/blob/master/keystone/common/cache/_context_cache.py#L22-L47 | 18:50 |
| dolphm | morgan: circular dependency when /opt/stack/keystone/keystone/federation/core.py tries to "from keystone.common import cache" http://cdn.pasteraw.com/bjy7z0v2jf8efe3651l276jot3we2ns | 18:51 |
| ayoung | dolphm, didn't we use internal notifications for just this reason? Cache invalidation? | 18:52 |
| prometheanfire | morgan: stevemar: th 088 issue, I'm not sure how to do this in sqlalchemy https://stackoverflow.com/questions/6843692/how-to-get-the-name-of-a-unique-constraint-in-postgresql | 18:52 |
| morgan | dolphm: uhmmmmm. | 18:53 |
| prometheanfire | postgres makes it harder to find the proper name | 18:53 |
| dolphm | ayoung: that handler looks to allow the revoke tree to be cachable | 18:53 |
| morgan | prometheanfire: yeah. that is the issue | 18:53 |
| morgan | dolphm: yeah we used the internal notification bits for cache invalidation so we could avoid needing to import <<other module>> and circular deps. | 18:53 |
| ayoung | dolphm, If I understand what you are seeing, Federation depends on cache, cached depends on revoke. And that last...seems wrong | 18:53 |
| morgan | ayoung: ^ cc | 18:53 |
| morgan | dolphm: uhm. | 18:54 |
| prometheanfire | this might be a problem with sqlalchemy not knowing how to do that | 18:54 |
| ayoung | morgan, why would the revoke code be in the cache? Is that just an artifact of "trying anything to make it work?" | 18:54 |
| morgan | ayoung: that is in the cache because the revoketree is hard to serialize | 18:55 |
| *** fawadkhaliq has quit IRC | 18:55 | |
| morgan | ayoung: and we're trying to offload multiple requests. | 18:55 |
| ayoung | morgan, kill the tree. Make it a linear search | 18:55 |
| morgan | ayoung: if the revoketree stops being a tree and is more of a "ask the SQL backend directly" | 18:55 |
| morgan | ayoung: and let the driver suss that out, it becomes way easier. | 18:55 |
| *** fawadkhaliq has joined #openstack-keystone | 18:55 | |
| morgan | and a simple memoize | 18:56 |
| morgan | slash invalidate (like everything else) | 18:56 |
| ayoung | I had the simplification patch 2/4rd done and then rebase hell hit... | 18:56 |
| patchbot | ayoung: https://review.openstack.org/#/c/2/ | 18:56 |
| ayoung | let me see | 18:56 |
| ayoung | https://review.openstack.org/#/c/285134/ | 18:56 |
| patchbot | ayoung: patch 285134 - keystone - Remove unneeded revocation events | 18:56 |
| ayoung | it was not pretty | 18:56 |
| morgan | prometheanfire: that would be unfortunate. i guess we could do direct DDL manipulation | 18:56 |
| ayoung | but +240, -830 | 18:56 |
| morgan | prometheanfire: for PGSQL. | 18:56 |
| prometheanfire | morgan: ya, for that check/modification | 18:56 |
| prometheanfire | does suck though | 18:57 |
| ayoung | its is on the queue of things to rework | 18:57 |
| morgan | ayoung: i'm wondering if we could just move to direct SQL query first. | 18:57 |
| morgan | ayoung: and then do the reduction. | 18:57 |
| morgan | it might be more straightforward, but would require adding a bunch of indexes to the table | 18:57 |
| dolphm | ayoung: that's accurate | 18:57 |
| ayoung | morgan, and a linear match? yeah, The code should still be there somewhere | 18:57 |
| ayoung | the tests used to do that as a check on the logic for the tree | 18:57 |
| morgan | ayoung: i was thinking .query(<filers for SQL>) | 18:58 |
| dolphm | ayoung: i just added the "Federation depends on cache" part though | 18:58 |
| morgan | and just ditch the tree completely | 18:58 |
| morgan | then do the reduction of your stuff. | 18:58 |
| morgan | s/reduction/simplification of event types | 18:58 |
| ayoung | morgan, if it is not in the tests, then it is in the origianl patch series | 18:58 |
| morgan | ayoung: yeah it's in the original patch series, but i'd go a step further and just make SQL do the heavy lifting | 18:59 |
| morgan | dolphm: hmm... how to unwind this | 18:59 |
| ayoung | morgan, I don;t know if you can. There are a lot of "don | 18:59 |
| ayoung | "don't cares" in the query | 18:59 |
| morgan | ayoung: we can probably doit with .OR. | 18:59 |
| morgan | ayoung: this or this or this or this | 19:00 |
| ayoung | select the whole list, cache, and then do a linear search, with the logic in python is, I think much more correct | 19:00 |
| ayoung | it would be a really nasty sql query | 19:00 |
| morgan | ayoung: if we had the reduced types, it would be trivial to do it in SQL | 19:00 |
| ayoung | why not just cache the whole list? We won't have that many | 19:00 |
| ayoung | true | 19:00 |
| ayoung | not 100 trivial, but much easier | 19:00 |
| morgan | and SQL is going to be faster/better with indexes than python will be liniarly | 19:00 |
| morgan | at the smaller scope that is | 19:01 |
| *** edmondsw has joined #openstack-keystone | 19:01 | |
| ayoung | morgan, but I think dolphm needs something for this release, and that is too big an effort for Mitaka | 19:01 |
| ayoung | If this is for Newton, would suggest this order: | 19:02 |
| ayoung | 1. Fernet default | 19:02 |
| ayoung | 2. Use Fernet mechanism for UUID | 19:02 |
| ayoung | 3. Reduce revocation events | 19:02 |
| ayoung | 3. Optimize revoke events further | 19:02 |
| ayoung | that should be 4 | 19:02 |
| morgan | i might be able to conver to SQL ... let me take a look once i've deal with the pgsql icky that prometheanfire hit | 19:02 |
| ayoung | morgan, its going to be a lot of throwaway work. I would not suggest doing that until we reduce the number of revoke events | 19:03 |
| morgan | ayoung: we'll see how it shakes out. for now the migration issue is a RC blocker :( | 19:04 |
| *** jorge_munoz has quit IRC | 19:07 | |
| *** jorge_munoz has joined #openstack-keystone | 19:08 | |
| prometheanfire | morgan: friend wants to just do a try except with ixu_role_name or role_name_key | 19:08 |
| morgan | prometheanfire: that is ok, but it doesn't solve the root problem :( | 19:09 |
| morgan | prometheanfire: i'll bet we have a number of variations on a theme here. | 19:09 |
| morgan | prometheanfire: i'd like to solve this programatically if at all possible. | 19:09 |
| prometheanfire | morgan: so, we need something unique to key off of to do the drop right? | 19:11 |
| prometheanfire | http://paste.openstack.org/show/492143/ | 19:11 |
| prometheanfire | that's our options | 19:11 |
| prometheanfire | it's the second one we want | 19:11 |
| *** pushkaru has quit IRC | 19:14 | |
| morgan | prometheanfire: yeah | 19:15 |
| morgan | prometheanfire: i'm building a mysql db to test with right now | 19:15 |
| morgan | prometheanfire: and then i'll poke at pgsql once i'm sure the logic is sane | 19:16 |
| morgan | even if it's DDL calls | 19:16 |
| morgan | ooh i think i see what i did wrong | 19:17 |
| morgan | blargh. | 19:17 |
| *** real56 has quit IRC | 19:17 | |
| prometheanfire | oh? | 19:17 |
| morgan | i don't like the way the constraint ends up looking | 19:17 |
| morgan | blech. yeah i'm referencing something in a weird way. this will be easier to suss out once i have my DB in hand | 19:18 |
| morgan | (downloading mysql atm) | 19:18 |
| prometheanfire | k | 19:18 |
| *** rderose has quit IRC | 19:18 | |
| *** e0ne has joined #openstack-keystone | 19:19 | |
| morgan | crinkle: btw: YAY config file being found properly now. | 19:19 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Add federation related tests https://review.openstack.org/293040 | 19:20 |
| dolphm | morgan: can request local caching be backported to mitaka? | 19:20 |
| morgan | dolphm: uhm. it landed in mitaka ;) | 19:20 |
| ayoung | morgan, migration issue is what? | 19:20 |
| dolphm | morgan: as soon as i asked, i realized i was getting release names wrong | 19:21 |
| morgan | ayoung: unrelated. | 19:21 |
| morgan | ayoung: it's an issue with uniqueconstraints being misnamed | 19:21 |
| *** e0ne has quit IRC | 19:21 | |
| *** rderose has joined #openstack-keystone | 19:21 | |
| ayoung | ajh | 19:21 |
| morgan | dolphm: :P | 19:21 |
| morgan | dolphm: to liberty you mean? | 19:21 |
| morgan | dolphm: probably. | 19:21 |
| morgan | it's pretty darn isolated code. | 19:21 |
| dolphm | morgan: yeah, i'd be curious what the effort would be | 19:22 |
| morgan | dolphm: it would probably be a pretty clean backport | 19:22 |
| morgan | with just shuffling things around | 19:22 |
| *** pushkaru has joined #openstack-keystone | 19:22 | |
| *** doug-fis_ has joined #openstack-keystone | 19:22 | |
| *** doug-fish has quit IRC | 19:25 | |
| *** roxanaghe has quit IRC | 19:25 | |
| *** e0ne has joined #openstack-keystone | 19:26 | |
| prometheanfire | morgan: think I have it | 19:27 |
| prometheanfire | morgan: http://paste.openstack.org/show/492148/ | 19:27 |
| prometheanfire | that seemd to drop my "role_name_key" UNIQUE CONSTRAINT, btree (name) | 19:27 |
| morgan | hmm | 19:27 |
| morgan | i thought i had that | 19:27 |
| *** doug-fis_ has quit IRC | 19:27 | |
| *** doug-fish has joined #openstack-keystone | 19:28 | |
| *** e0ne has quit IRC | 19:28 | |
| prometheanfire | it still throws a runtime error | 19:28 |
| prometheanfire | http://paste.openstack.org/show/492149/ | 19:28 |
| morgan | oh | 19:28 |
| morgan | that is easy to fix | 19:29 |
| morgan | that is just me being a bit derpy | 19:29 |
| morgan | prometheanfire: http://paste.openstack.org/show/492150/ | 19:30 |
| prometheanfire | ya, that'd work | 19:31 |
| prometheanfire | yep | 19:33 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Correct `role_name` constraint dropping https://review.openstack.org/298402 | 19:34 |
| morgan | prometheanfire: ^ | 19:34 |
| *** maxabidi has joined #openstack-keystone | 19:35 | |
| *** roxanaghe has joined #openstack-keystone | 19:35 | |
| *** sdake_ has joined #openstack-keystone | 19:36 | |
| *** mylu has quit IRC | 19:36 | |
| prometheanfire | not sure why it's needed in both 96 and 101 | 19:36 |
| prometheanfire | oh | 19:37 |
| prometheanfire | read the commit message | 19:37 |
| morgan | prometheanfire: yeah. it's being overly cautious | 19:37 |
| morgan | and then 88 and 96 will backport to stable/mitaka | 19:37 |
| prometheanfire | ya | 19:37 |
| prometheanfire | now, 91 | 19:37 |
| prometheanfire | lol | 19:37 |
| *** mylu has joined #openstack-keystone | 19:38 | |
| *** fawadkhaliq has quit IRC | 19:38 | |
| *** sdake has quit IRC | 19:38 | |
| *** fawadkhaliq has joined #openstack-keystone | 19:38 | |
| prometheanfire | morgan: you want to look at 91, I think this one is simpler | 19:39 |
| prometheanfire | and should fail in all cases that I can see, not postgres related | 19:39 |
| morgan | prometheanfire: mitaka version: https://review.openstack.org/#/c/298406/ | 19:41 |
| patchbot | morgan: patch 298406 - keystone (stable/mitaka) - Correct `role_name` constraint dropping | 19:41 |
| morgan | prometheanfire: ok 91... | 19:42 |
| morgan | what was the failure you were seeing? [bug id works] | 19:43 |
| prometheanfire | https://bugs.launchpad.net/keystone/+bug/1562965 | 19:43 |
| openstack | Launchpad bug 1562965 in OpenStack Identity (keystone) " liberty -> mitaka db migrate fails on postgresql 091 migration" [Undecided,New] | 19:43 |
| morgan | ooh | 19:45 |
| morgan | ok | 19:45 |
| *** clenimar has quit IRC | 19:45 | |
| morgan | huh | 19:45 |
| morgan | how the heck does that pass gate then... | 19:45 |
| morgan | oh .. no rows in user_rows :( | 19:45 |
| prometheanfire | morgan: I remaped it like this | 19:46 |
| prometheanfire | user_rows = sel.execute | 19:46 |
| prometheanfire | and for row in user_rows(): | 19:46 |
| prometheanfire | so it would fetch it each time | 19:46 |
| prometheanfire | for debugging purposes | 19:46 |
| morgan | right | 19:46 |
| morgan | this one is ... grumble ... | 19:47 |
| prometheanfire | I agree, either I'm doing something wrong or it is passing gate via magic | 19:47 |
| *** BigWillie has quit IRC | 19:50 | |
| *** jaugustine has joined #openstack-keystone | 19:51 | |
| *** gagehugo has joined #openstack-keystone | 19:53 | |
| prometheanfire | morgan: probably just needs to change to if row.has_key('user_password'): | 19:54 |
| morgan | possibly | 19:55 |
| morgan | i'll look at it more in a bit. | 19:55 |
| morgan | need to take a break and #lunch | 19:55 |
| morgan | (and get to the airport) | 19:55 |
| prometheanfire | k | 19:56 |
| prometheanfire | ya, think it needs more | 19:57 |
| *** sheel has quit IRC | 19:57 | |
| *** knikolla_ has quit IRC | 19:57 | |
| *** sdake has joined #openstack-keystone | 20:03 | |
| tjcocozz | has anyone had pip get stuck when installing the requirements.txt file on 'oslo.service'? | 20:04 |
| *** rderose has quit IRC | 20:05 | |
| *** sdake_ has quit IRC | 20:06 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Correct `role_name` constraint dropping https://review.openstack.org/298402 | 20:07 |
| stevemar | morgan: pushed a pep8 friendly patch ^ | 20:07 |
| morgan | stevemar: thanks | 20:07 |
| morgan | stevemar: don't have a VM to run on atm and unfortunately internet is sloooooow | 20:07 |
| crinkle | morgan: yay for my things being merged \o/ | 20:09 |
| morgan | crinkle: right?! :) | 20:10 |
| morgan | crinkle: also, we have a new RC, planning to get your config file search added to mitaka | 20:10 |
| crinkle | morgan: neat :) | 20:10 |
| morgan | if stevemar doesn't mind that is | 20:11 |
| *** akscram has quit IRC | 20:11 | |
| stevemar | morgan: may as well | 20:11 |
| stevemar | crinkle: want to propose the backport? | 20:11 |
| crinkle | stevemar: sure | 20:11 |
| morgan | yay backport! | 20:11 |
| *** akscram has joined #openstack-keystone | 20:11 | |
| morgan | stevemar: gonna look at https://review.openstack.org/#/c/285521/ for a rebase | 20:14 |
| patchbot | morgan: patch 285521 - keystone - Closure table for HMT | 20:14 |
| morgan | stevemar: and also poke at request-local-cache as a backport to liberty on dolphm's request [since it's mostly transparent/encapsulated] | 20:14 |
| stevemar | morgan: closure table? | 20:14 |
| morgan | zzzeek: i should have some idea where i'm landing soon and hopefulyl will be able to pick back up w/ dogpile :) | 20:14 |
| morgan | stevemar: yeah rebase so it can land | 20:14 |
| morgan | stevemar: it would be good to have for the HMT stuff. | 20:14 |
| morgan | stevemar: but not for liberty, for newton. | 20:15 |
| stevemar | morgan: oh okay, you confsued me there | 20:15 |
| morgan | stevemar: step 1: unconfuze the ptl | 20:15 |
| morgan | stevemar: step 2: profit? | 20:15 |
| stevemar | morgan: backported crinkle fix https://review.openstack.org/#/c/298420/1 | 20:16 |
| patchbot | stevemar: patch 298420 - keystone (stable/mitaka) - Fix keystone-manage config file path | 20:16 |
| morgan | stevemar: +3 | 20:16 |
| *** BigWillie has joined #openstack-keystone | 20:17 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Add federation related tests https://review.openstack.org/293040 | 20:24 |
| *** fawadkhaliq has quit IRC | 20:24 | |
| morgan | topol: you're too quiet | 20:24 |
| *** fawadkhaliq has joined #openstack-keystone | 20:25 | |
| *** spzala_ has quit IRC | 20:34 | |
| *** jsavak has quit IRC | 20:40 | |
| *** mhickey has quit IRC | 20:43 | |
| *** sdake_ has joined #openstack-keystone | 20:43 | |
| *** sdake has quit IRC | 20:43 | |
| *** mylu has quit IRC | 20:51 | |
| *** BigWillie has quit IRC | 20:52 | |
| *** jsavak has joined #openstack-keystone | 20:54 | |
| *** fawadkhaliq has quit IRC | 20:59 | |
| *** pauloewerton has quit IRC | 21:00 | |
| *** fawadkhaliq has joined #openstack-keystone | 21:00 | |
| *** ericksonsantos has joined #openstack-keystone | 21:02 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Test list project hierarchy is correct for a large tree https://review.openstack.org/277512 | 21:05 |
| tjcocozz | samueldmq, ^^ updated my patch to add a test for get_projects_in_subtree_as_ids() Now to delete code needs to be updated to use get_projects_in_subtree_as_ids() | 21:08 |
| *** diazjf has quit IRC | 21:12 | |
| *** tqtran has quit IRC | 21:16 | |
| openstackgerrit | ayoung proposed openstack/keystone: default policy https://review.openstack.org/140113 | 21:18 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Identify Policy by Hash https://review.openstack.org/297897 | 21:21 |
| *** prometheanfire has quit IRC | 21:21 | |
| *** prometheanfire has joined #openstack-keystone | 21:22 | |
| *** raildo is now known as raildo-afk | 21:23 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Add `patch_cover` to keystone https://review.openstack.org/294189 | 21:26 |
| *** sdake_ is now known as sdake | 21:27 | |
| *** jsavak has quit IRC | 21:33 | |
| zzzeek | morgan: good to hear | 21:35 |
| *** doug-fish has quit IRC | 21:36 | |
| *** ebalduf_ has joined #openstack-keystone | 21:37 | |
| *** tqtran has joined #openstack-keystone | 21:39 | |
| *** gagehugo has quit IRC | 21:48 | |
| *** david_cu has quit IRC | 21:48 | |
| *** jaugustine has quit IRC | 21:50 | |
| *** doug-fish has joined #openstack-keystone | 21:57 | |
| *** dflorea has joined #openstack-keystone | 21:58 | |
| *** ninag has quit IRC | 22:09 | |
| *** slberger has left #openstack-keystone | 22:16 | |
| *** pushkaru has quit IRC | 22:25 | |
| *** henrynash has quit IRC | 22:29 | |
| *** markvoelker has quit IRC | 22:29 | |
| *** harlowja has joined #openstack-keystone | 22:32 | |
| *** harlowja has quit IRC | 22:32 | |
| *** harlowja has joined #openstack-keystone | 22:33 | |
| dflorea | Hi everyone. I hope this is the right forum to ask this question. Is there any plan to deprecate the v2 API? We currently use the jclouds library to talk to Keystone. But jclouds only supports Keystone v2 so I'm wondering if we should move to another library that supports Keystone v3. I know there are technical advantages to v3, but I'm taking a pragmatic look at what customers use today and what they will use in the next 12-24 mon | 22:35 |
| dflorea | ths. Thanks! | 22:35 |
| bknudson | dflorea: the v2 api is mostly deprecated already | 22:36 |
| bknudson | and the parts that put stuff in the URL that shouldn't be there | 22:37 |
| stevemar | dflorea: yeah what bknudson said... it's completely deprecated and will be removed in the Q release, 18+ months from now | 22:37 |
| bknudson | should say "the parts that aren't deprecated" | 22:37 |
| *** doug-fish has quit IRC | 22:37 | |
| *** ebalduf_ has quit IRC | 22:37 | |
| dflorea | bknudson, stevemar: Thanks for the reply. When I look online, the Identity API v2.0 still says "Supported". Are there parts of the API that are nevertheless deprecated? | 22:40 |
| bknudson | dflorea: where are you looking? | 22:41 |
| dflorea | bkundson: http://developer.openstack.org/api-ref-identity-v2.html | 22:41 |
| bknudson | maybe I'll find some time to update that site. | 22:42 |
| *** gordc has quit IRC | 22:43 | |
| dflorea | Ok. I'll take your word over the site. :) | 22:43 |
| morgan | dflorea: if there is a way to communicate/work with jclouds, we should (the keystone/openstack team) work to help them understand/handle the deprecation of v2 | 22:43 |
| morgan | bknudson, stevemar: ^ cc | 22:44 |
| dflorea | morgan: Ok. We will try to do that. I worry that we will end up in a bad situation if we continue to use jclouds. | 22:44 |
| morgan | dflorea: excatly why we should work with them | 22:47 |
| morgan | dflorea: don't hesitate to loop me in (or stevemar [haha see what i did there steve? also cc topol]) to help on that front | 22:47 |
| morgan | dflorea: we may not be java-programmers (i can't speak to topol's experience, he's been around forever), but we can def. help with any questions folks have when updating jclouds code | 22:48 |
| morgan | dflorea: also communication on the openstack-dev mailing list is a good option as well. :) | 22:48 |
| *** fawadkhaliq has quit IRC | 22:48 | |
| dflorea | morgan:Great. Thanks. We will reach out to them. Thanks for the support!! | 22:48 |
| *** csoukup has quit IRC | 22:49 | |
| morgan | dflorea: absolutely! long term i'd like to find a java programmer to make a keystoneauth library for that language | 22:49 |
| *** fawadkhaliq has joined #openstack-keystone | 22:49 | |
| morgan | so people aren't trying to update every lib that does openstack auth. | 22:49 |
| dflorea | morgan:Makes a ton of sense | 22:50 |
| morgan | stevemar: how cranky would -infra get if we tried to wedge in a Rust keystoneAuth lib? | 22:51 |
| stevemar | morgan: not at all :) | 22:51 |
| morgan | stevemar: i really want to use protobuf for ksa | 22:52 |
| morgan | stevemar: but i think that is a hard sell. | 22:52 |
| morgan | stevemar: i'm going to revisit the "split auth and catalog" routes spec this cycle if i'm writing code | 22:53 |
| morgan | stevemar: i think it would be a win to make us able to iterate on auth/tokens/catalog separate from api/crud | 22:53 |
| *** pushkaru has joined #openstack-keystone | 22:54 | |
| *** harlowja has quit IRC | 22:54 | |
| *** harlowja has joined #openstack-keystone | 22:54 | |
| knikolla | stevemar, on which keystoneauth1 release will this be included? https://review.openstack.org/#/c/289472/ | 22:55 |
| patchbot | knikolla: patch 289472 - keystoneauth - Adding authentication compatibility for OpenStackC... (MERGED) | 22:55 |
| stevemar | knikolla: the next one, but we our libraries are frozen right now while we release mitaka | 22:56 |
| *** david-lyle_ is now known as david-lyle | 22:57 | |
| knikolla | stevemar, i see. with that, this passes passes the py27 tests https://review.openstack.org/#/c/276350/ | 22:57 |
| patchbot | knikolla: patch 276350 - python-openstackclient - Moving authentication from keystoneclient to keyst... | 22:57 |
| knikolla | i manually checked | 22:57 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Cleaning up identity.core https://review.openstack.org/296140 | 22:58 |
| morgan | stevemar: so, for austin (assuming i'm there) I'd like to talk "non-python ksa" with everyone. | 22:58 |
| stevemar | morgan: better bring your tomato shield | 22:58 |
| morgan | see what the best approach will be to handle KSA and non-python variants and gating | 22:59 |
| stevemar | knikolla: as soon as we get the OK to release new libraries, i will release a new KSA | 22:59 |
| morgan | yeah but it's a real concern. | 22:59 |
| knikolla | stevemar, thanks! | 23:00 |
| knikolla | that would really help as getting the openstackclient change upstream is my task for the upcoming sprints. haha | 23:01 |
| stevemar | knikolla: believe me, i want to see OSC move to KSA more than anyone | 23:01 |
| *** pushkaru has quit IRC | 23:01 | |
| *** timcline has quit IRC | 23:01 | |
| stevemar | knikolla: with OSC using KSA, then we'll really have sweet federation support via CLI | 23:01 |
| knikolla | stevemar, amen! | 23:02 |
| topol | morgan, stevemar I will not admit to knowing Java | 23:08 |
| stevemar | topol: 9 people have recommended you on linkedin for your java skill | 23:10 |
| stevemar | mad java skills | 23:10 |
| topol | stevemar, morgan its worse: http://dl.acm.org/citation.cfm?id=1268011 | 23:11 |
| stevemar | COOTS'98 | 23:11 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Correct `role_name` constraint dropping https://review.openstack.org/298402 | 23:12 |
| morgan | topol: it's ok i expect you to write a lot of java | 23:16 |
| *** arunkant has quit IRC | 23:17 | |
| *** bjornar has quit IRC | 23:20 | |
| *** ametts has quit IRC | 23:22 | |
| *** harlowja has quit IRC | 23:25 | |
| *** harlowja has joined #openstack-keystone | 23:25 | |
| *** rk4n has quit IRC | 23:28 | |
| *** mylu has joined #openstack-keystone | 23:31 | |
| *** furface has joined #openstack-keystone | 23:43 | |
| *** knikolla has quit IRC | 23:44 | |
| morgan | stevemar: yay osc using KSA | 23:47 |
| *** fawadkhaliq has quit IRC | 23:50 | |
| *** fawadkhaliq has joined #openstack-keystone | 23:50 | |
| *** mylu has quit IRC | 23:51 | |
| *** fawadkhaliq has quit IRC | 23:52 | |
| *** fawadkhaliq has joined #openstack-keystone | 23:52 | |
| *** furface has quit IRC | 23:53 | |
| prometheanfire | morgan: wooo :D | 23:55 |
| prometheanfire | just need to update my compute nodes and I'm on mitaka | 23:56 |
| *** furface has joined #openstack-keystone | 23:57 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:58 | |
| morgan | prometheanfire: i expect to dig out the migration #91 tomorrow | 23:59 |
| prometheanfire | morgan: I'll be available | 23:59 |
| *** fawadkhaliq has quit IRC | 23:59 | |
| morgan | prometheanfire: i think i can address it. i am pretty sure this one wont require magic migrations to solve (forward ports) | 23:59 |
| *** fawadkhaliq has joined #openstack-keystone | 23:59 | |
| morgan | prometheanfire: since it is just a broken migration. we'll see though | 23:59 |
| morgan | prometheanfire: also, what TZ are you in? | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!