| morgan | prometheanfire: because i wantt o know if i should ask if you ever sleep ;) | 00:00 |
|---|---|---|
| prometheanfire | I'm CDT, UTC-5 | 00:00 |
| morgan | ah not too bad then | 00:00 |
| * morgan is Pacific time | 00:00 | |
| prometheanfire | ya | 00:00 |
| prometheanfire | also, agreed, this just seems like a broken check or something | 00:01 |
| openstackgerrit | Nguyen Hung Phuong proposed openstack/keystone: Fix typos in Keystone files https://review.openstack.org/298471 | 00:03 |
| *** mylu has joined #openstack-keystone | 00:07 | |
| *** mylu has quit IRC | 00:08 | |
| *** mylu has joined #openstack-keystone | 00:09 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix typos in Keystone files https://review.openstack.org/298471 | 00:10 |
| *** fawadkhaliq has quit IRC | 00:12 | |
| morgan | lbragstad: pinf | 00:12 |
| morgan | ping* | 00:13 |
| morgan | lbragstad: https://review.openstack.org/#/c/272358/37/keystone/common/validation/parameter_types.py i think the change is wrong. | 00:13 |
| patchbot | morgan: patch 272358 - keystone - The name can be just white character except projec... | 00:13 |
| *** fawadkhaliq has joined #openstack-keystone | 00:13 | |
| morgan | lbragstad: is it really supposed to be [\S+] not [\S]+ ? | 00:13 |
| *** harlowja has quit IRC | 00:16 | |
| *** diazjf has joined #openstack-keystone | 00:17 | |
| *** dflorea has quit IRC | 00:20 | |
| *** maxabidi has quit IRC | 00:26 | |
| *** gyee has quit IRC | 00:26 | |
| *** morgan changes topic to "Tag bugs as rc-potential - fix more bugs! | Master is accepting code for Newton!" | 00:29 | |
| *** sdake_ has joined #openstack-keystone | 00:35 | |
| *** roxanaghe has quit IRC | 00:37 | |
| *** sdake has quit IRC | 00:38 | |
| *** fawadkhaliq has quit IRC | 00:40 | |
| *** diazjf has quit IRC | 00:40 | |
| *** fawadkhaliq has joined #openstack-keystone | 00:40 | |
| *** richm has quit IRC | 00:41 | |
| *** roxanaghe has joined #openstack-keystone | 00:42 | |
| *** sdake_ has quit IRC | 00:47 | |
| *** sdake has joined #openstack-keystone | 00:47 | |
| *** harlowja has joined #openstack-keystone | 00:51 | |
| *** roxanaghe has quit IRC | 00:52 | |
| *** jorge_munoz has quit IRC | 00:54 | |
| *** fawadkhaliq has quit IRC | 01:02 | |
| *** fawadkhaliq has joined #openstack-keystone | 01:07 | |
| *** EinstCrazy has joined #openstack-keystone | 01:07 | |
| *** browne has quit IRC | 01:10 | |
| *** tqtran has quit IRC | 01:14 | |
| *** fawadkhaliq has quit IRC | 01:14 | |
| *** lhcheng has quit IRC | 01:17 | |
| *** agrebennikov has quit IRC | 01:19 | |
| *** dan_nguyen has quit IRC | 01:29 | |
| *** jamielennox|away is now known as jamielennox | 01:29 | |
| *** csoukup has joined #openstack-keystone | 01:44 | |
| *** roxanaghe has joined #openstack-keystone | 01:53 | |
| *** browne has joined #openstack-keystone | 01:53 | |
| *** edmondsw has quit IRC | 01:56 | |
| *** woodster_ has quit IRC | 01:57 | |
| *** lhcheng has joined #openstack-keystone | 01:57 | |
| *** ChanServ sets mode: +v lhcheng | 01:57 | |
| *** roxanaghe has quit IRC | 01:58 | |
| *** harlowja has quit IRC | 01:59 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 02:00 |
| *** lhcheng has quit IRC | 02:03 | |
| *** tqtran has joined #openstack-keystone | 02:12 | |
| *** tqtran has quit IRC | 02:17 | |
| prometheanfire | stevemar: I'm guessing you are stevebot? :P | 02:26 |
| * prometheanfire should probably blog that openstack mitaka is in gentoo | 02:27 | |
| stevemar | prometheanfire: o/ | 02:27 |
| stevemar | yes ;0 | 02:27 |
| stevemar | prometheanfire: you should! | 02:27 |
| prometheanfire | I mainly wanted to beat the other distros, normally I'm within a few hours of release, but they are sometimes quicker | 02:28 |
| *** lhcheng has joined #openstack-keystone | 02:32 | |
| *** ChanServ sets mode: +v lhcheng | 02:32 | |
| *** lhcheng has quit IRC | 02:32 | |
| *** lhcheng has joined #openstack-keystone | 02:33 | |
| *** ChanServ sets mode: +v lhcheng | 02:33 | |
| prometheanfire | on todo for tomorrow then | 02:34 |
| stevemar | prometheanfire: i'm hoping morgan finishes up the two migration issues you found, we can then release mitaka-rc2 | 02:37 |
| stevemar | prometheanfire: pretty sure both issues are postgres specific | 02:38 |
| prometheanfire | the second one is too? | 02:38 |
| prometheanfire | that seems like accessing a datastructure that doesn't exist | 02:38 |
| prometheanfire | https://bugs.launchpad.net/keystone/+bug/1562965 | 02:39 |
| openstack | Launchpad bug 1562965 in OpenStack Identity (keystone) " liberty -> mitaka db migrate fails on postgresql 091 migration" [Undecided,New] | 02:39 |
| *** tellesnobrega is now known as tellesnobrega_af | 02:40 | |
| prometheanfire | switching it to 'if row.has_key('user_password'):' should work | 02:41 |
| prometheanfire | I don't know the intended behavior of that piece though, so... | 02:41 |
| * prometheanfire shrugs | 02:41 | |
| *** tellesnobrega_af is now known as tellesnobrega | 02:41 | |
| prometheanfire | I don't think it will ever return true though | 02:42 |
| prometheanfire | user_password is not in the select statement | 02:42 |
| stevemar | prometheanfire: i suggest pg specific since it works with mysql with our CI tests | 02:42 |
| prometheanfire | ah | 02:42 |
| stevemar | or maybe you found a weird edge case in your deployment | 02:43 |
| prometheanfire | possibly | 02:43 |
| *** lifeless has quit IRC | 02:43 | |
| *** lifeless has joined #openstack-keystone | 02:44 | |
| ayoung | prometheanfire, in python if row['user_password']: would evaluate to False if the row was empty | 02:45 |
| ayoung | prometheanfire, we split migrations into two pieces | 02:46 |
| prometheanfire | what if the key 'user_password' wasn't in row | 02:46 |
| ayoung | the first creates the new table | 02:46 |
| ayoung | the second migrates the data | 02:46 |
| ayoung | prometheanfire, I don't think that makes sense | 02:46 |
| ayoung | it might be Null | 02:46 |
| ayoung | but the column has to exist...let me look at the prior migration | 02:46 |
| prometheanfire | column in which table? | 02:46 |
| ayoung | prometheanfire, https://github.com/openstack/keystone/blob/9.0.0.0rc1/keystone/common/sql/migrate_repo/versions/090_add_local_user_and_password_tables.py | 02:47 |
| ayoung | prometheanfire, we are creating a new table just for passwords | 02:47 |
| prometheanfire | right | 02:47 |
| ayoung | splitting the user table so that on user can have multiple credentials | 02:47 |
| prometheanfire | I have that table, and it's populated | 02:47 |
| *** harlowja has joined #openstack-keystone | 02:47 | |
| ayoung | so that column does not seem to exist | 02:47 |
| prometheanfire | which table should have the password collumn | 02:48 |
| ayoung | sel.execute() is on user_table, no? | 02:48 |
| ayoung | https://github.com/openstack/keystone/blob/9.0.0.0rc1/keystone/common/sql/migrate_repo/versions/091_migrate_data_to_local_user_and_password_tables.py#L43 | 02:48 |
| prometheanfire | ya | 02:48 |
| ayoung | ah a join | 02:48 |
| ayoung | so a join on user_table, local_user_table] | 02:49 |
| ayoung | prometheanfire, maybe the mysql version is more forgiving and just skips that row? | 02:50 |
| prometheanfire | maybe? | 02:51 |
| ayoung | prometheanfire, or maybe that row is from an older table and it has since been dropped in your databe | 02:51 |
| ayoung | database | 02:51 |
| ayoung | would help if I could ssh to my machine | 02:51 |
| prometheanfire | lol | 02:51 |
| *** harlowja has quit IRC | 02:52 | |
| morgan | stevemar: on a plane. Will be looking at migrations tonight | 02:52 |
| *** real56 has joined #openstack-keystone | 02:52 | |
| ayoung | and why are all my VMs shutoff | 02:53 |
| *** agrebennikov has joined #openstack-keystone | 02:53 | |
| prometheanfire | that select pulls these keys only | 02:53 |
| ayoung | and not starting | 02:53 |
| prometheanfire | user_id | user_extra | user_enabled | user_default_project_id | local_user_id | local_user_user_id | local_user_domain_id | local_user_name | 02:53 |
| prometheanfire | generated sql statement here | 02:53 |
| prometheanfire | ELECT "user".id AS user_id, "user".extra AS user_extra, "user".enabled AS user_enabled, "user".default_project_id AS user_default_project_id, local_user.id AS local_user_id, local_user.user_id AS local_user_user_id, local_user.domain_id AS local_user_domain_id, local_user.name AS local_user_name FROM "user" JOIN local_user ON "user".id = local_user.user_id; | 02:54 |
| *** sheel has joined #openstack-keystone | 02:54 | |
| morgan | stevemar: also the first bug prometheanfire found (88) is not pg specific, just happens most deploys aren't long running enough to be impacted. | 02:54 |
| prometheanfire | benifit of a rolling release disto? :P | 02:54 |
| morgan | Or detriment ;) | 02:55 |
| prometheanfire | indeed | 02:55 |
| prometheanfire | that might be the cause here too, dunno | 02:55 |
| ayoung | prometheanfire, looks like it is supposed to have user_password, which I bet it does before the drops. | 02:56 |
| ayoung | look at the last 3 lines of the function | 02:56 |
| prometheanfire | ya, it probably did | 02:56 |
| ayoung | use_labels=True | 02:56 |
| ayoung | I bet that autogenerates the user_ and local_user_ values | 02:56 |
| ayoung | prometheanfire, are you running postgresql>? | 02:57 |
| prometheanfire | yes, I have both ipython and pqsl open | 02:58 |
| prometheanfire | where do I put the use_labels=True ? | 02:58 |
| *** EinstCrazy has quit IRC | 02:58 | |
| prometheanfire | oh, it's already there | 02:58 |
| *** EinstCra_ has joined #openstack-keystone | 02:58 | |
| ayoung | prometheanfire, so you can run the migrations manually | 02:58 |
| ayoung | do you care if you kill your data? | 02:58 |
| prometheanfire | not particularly | 02:58 |
| prometheanfire | I think I already migrated though | 02:59 |
| ayoung | heh...we used to support downgrades...but not anymore | 02:59 |
| prometheanfire | password table is populated | 02:59 |
| ayoung | So you could try dropping the DB, and running the migrations forward to just before this one | 02:59 |
| prometheanfire | in fact I think it's overpopulated | 02:59 |
| ayoung | keystone-manage db-sync soemthing...let me see | 02:59 |
| prometheanfire | oh, I do care about that :P | 02:59 |
| prometheanfire | guaranteed loss vs hopefully not loosing | 03:00 |
| prometheanfire | I just got this to mitaka | 03:00 |
| ayoung | prometheanfire, did you take a dump of the data prior to migrating? | 03:00 |
| prometheanfire | ayoung: this seem right to you? http://paste.openstack.org/show/492182/ | 03:01 |
| prometheanfire | ayoung: no, I was stupid | 03:01 |
| prometheanfire | I meant to snap the VM prior to run, but it was late, etcetc | 03:01 |
| ayoung | prometheanfire, sure | 03:01 |
| ayoung | why not? | 03:01 |
| prometheanfire | I think I've repopulated that table 10x | 03:01 |
| ayoung | do you do automated backups otherwise? | 03:01 |
| ayoung | Oh yeah. 1-8...I see it now | 03:02 |
| prometheanfire | sometimes, not often enough, I need to move this storage backend to one of the datasets that are backed up | 03:02 |
| ayoung | prometheanfire, did you only have 8 users? | 03:02 |
| prometheanfire | I think I'm gonna drop id 8 - 80 | 03:02 |
| prometheanfire | yes | 03:02 |
| ayoung | ok so my guess is you have duplicated data all through the password table now, too, right? | 03:03 |
| ayoung | please don't show | 03:03 |
| prometheanfire | ya | 03:03 |
| prometheanfire | I knew not to show, that's why I selected | 03:03 |
| ayoung | prometheanfire, dupes we can deal with | 03:03 |
| prometheanfire | ya, it doesn't seem to be harming anything | 03:04 |
| prometheanfire | it repeates predictibly | 03:04 |
| prometheanfire | which is why I could just delete 9-80 | 03:04 |
| ayoung | prometheanfire, so I wouldn't expect that migration to run a second time. The column it migrated was dropped. But do you still have the password fields? | 03:04 |
| * ayoung hopes they migrated before the drop | 03:04 | |
| prometheanfire | I probably tried it a bunch | 03:05 |
| prometheanfire | re-runing db_sync did it I think | 03:05 |
| ayoung | it should not have. There is a table that says the current version | 03:05 |
| prometheanfire | or manual fiddling | 03:05 |
| ayoung | what do you get if you run: sudo keystone-manage db_version | 03:06 |
| prometheanfire | 95 | 03:06 |
| ayoung | so that comes from a table that is stored in the same database. Running the migrations again should be a no-op | 03:06 |
| ayoung | prometheanfire, so...I just jumped in without context. Are you OK, or do you still need help? | 03:07 |
| prometheanfire | I manually edited the files to get it to pass, before that I tried running db_sync multiple times | 03:07 |
| prometheanfire | I'm good now | 03:08 |
| prometheanfire | I think I just need to clean up that table | 03:08 |
| ayoung | prometheanfire, and probably the password table. maybe localuser as well | 03:08 |
| prometheanfire | local_user has these columns and only 8 entries | 03:09 |
| prometheanfire | id | user_id | domain_id | name | 03:09 |
| ayoung | that looks right | 03:09 |
| prometheanfire | ezpz cleanup | 03:10 |
| prometheanfire | delete from password where id > 8; | 03:10 |
| prometheanfire | I did test with select first | 03:10 |
| ayoung | heh | 03:10 |
| ayoung | I still don't like that it executed multiple times. Did you somehow run the migration directly, or the sql from it, without using keystone-manage? | 03:11 |
| prometheanfire | safer would be to delete non-unique ignoring the id | 03:11 |
| prometheanfire | yes | 03:11 |
| prometheanfire | I've been playing in ipython and probably did that | 03:11 |
| *** tqtran has joined #openstack-keystone | 03:13 | |
| ayoung | ok...ON YOUR LIVE DATASET WITHOUT BACKUPS? | 03:13 |
| ayoung | Dude. | 03:13 |
| ayoung | Bad Cop. No Donut./ | 03:13 |
| *** links has joined #openstack-keystone | 03:13 | |
| morgan | prometheanfire: noooo not ipython | 03:14 |
| prometheanfire | wat | 03:14 |
| prometheanfire | I said I didn't make an initial backup | 03:14 |
| prometheanfire | I've made one since then | 03:15 |
| morgan | hehe | 03:15 |
| morgan | annnnyway | 03:15 |
| morgan | ayoung: i just don't ask questions yanno | 03:15 |
| *** harlowja_at_home has quit IRC | 03:15 | |
| morgan | ayoung: especially ones i don't want to know the answer to | 03:15 |
| ayoung | morgan, I was really hoping I was going to get him to rerun the migrations forward from 0 | 03:16 |
| morgan | ayoung: i had already asked | 03:16 |
| ayoung | cuz I don't have postgresql setup | 03:16 |
| * ayoung misses postgres | 03:16 | |
| morgan | i expect i'll pgsql-ing it up tomorrow | 03:16 |
| morgan | i dn't mis postgres | 03:16 |
| morgan | i wish we could pick a RDBMS and tell folks "this is the one we support, others you are on your own for" | 03:16 |
| prometheanfire | node03-zp00/custom-vms@mitaka-complete | 03:17 |
| prometheanfire | see, snapshot :P | 03:17 |
| ayoung | morgan, me too, and I want that one to be postgres | 03:17 |
| morgan | ayoung: db2! | 03:17 |
| prometheanfire | ayoung: :D | 03:17 |
| morgan | ayoung: MS SQL! | 03:17 |
| morgan | ayoung: ORACLE!!!! | 03:17 |
| prometheanfire | morgan: coming soon to linux | 03:17 |
| ayoung | morgan, I've done DB2. I'll take Postgresq | 03:17 |
| ayoung | done all of them | 03:17 |
| ayoung | and Access | 03:17 |
| ayoung | XBase | 03:17 |
| morgan | sybase was the most annoying (before it became MSSQL | 03:17 |
| prometheanfire | excell | 03:17 |
| *** tqtran has quit IRC | 03:17 | |
| morgan | esp. with raw partition support | 03:17 |
| ayoung | Access rewrote my working sql into a format it could no longer execute | 03:18 |
| morgan | i need... i need a working mysql db to figure out this stupid migration | 03:18 |
| ayoung | Foxpro was so much better. But then MS bought it and buried it | 03:18 |
| morgan | https://review.openstack.org/#/c/298402/ it is failing in wierd ways | 03:18 |
| patchbot | morgan: patch 298402 - keystone - Correct `role_name` constraint dropping | 03:18 |
| prometheanfire | so | 03:19 |
| morgan | mostly i am not sure why i'm matching more than one constraint atm | 03:19 |
| ayoung | oh mein gott im himmel... | 03:19 |
| prometheanfire | what should remain in the user table (not the local_user table) | 03:19 |
| * morgan glares at airport wifis | 03:19 | |
| morgan | 400ms-2800ms latency :( | 03:20 |
| morgan | oooh i wonder if c.columns is an iter | 03:20 |
| morgan | vs. a list/tuple/thing | 03:20 |
| *** pushkaru has joined #openstack-keystone | 03:24 | |
| prometheanfire | so, if someone could tell me what columns remain in the user table that'd be nice :P | 03:24 |
| *** harlowja has joined #openstack-keystone | 03:29 | |
| morgan | prometheanfire: after 91? | 03:32 |
| prometheanfire | ya | 03:32 |
| morgan | dolphm: I wish I had a macbook retina ATM, so I could use it w/o needing to put it away for takeoff | 03:33 |
| *** ayoung has quit IRC | 03:46 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: prep repo for newton release https://review.openstack.org/298514 | 03:57 |
| *** roxanaghe has joined #openstack-keystone | 04:00 | |
| *** real56 has quit IRC | 04:03 | |
| *** harlowja has quit IRC | 04:06 | |
| *** harlowja has joined #openstack-keystone | 04:09 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 04:10 |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add release notes for return-request-id-to-caller https://review.openstack.org/276644 | 04:15 |
| *** fawadkhaliq has joined #openstack-keystone | 04:20 | |
| *** fawadk has joined #openstack-keystone | 04:21 | |
| *** fawadkhaliq has quit IRC | 04:25 | |
| *** csoukup has quit IRC | 04:37 | |
| *** dpippenger has joined #openstack-keystone | 04:40 | |
| *** mylu has quit IRC | 04:46 | |
| *** mylu has joined #openstack-keystone | 04:47 | |
| *** spandhe_ has joined #openstack-keystone | 04:48 | |
| *** spandhe has quit IRC | 04:49 | |
| *** spandhe_ is now known as spandhe | 04:49 | |
| *** fawadk has quit IRC | 05:00 | |
| *** roxanaghe has quit IRC | 05:02 | |
| *** mylu has quit IRC | 05:03 | |
| *** roxanaghe has joined #openstack-keystone | 05:05 | |
| *** pcaruana has quit IRC | 05:09 | |
| openstackgerrit | Merged openstack/keystone: Fix typos in Keystone files https://review.openstack.org/298471 | 05:15 |
| *** lhcheng has quit IRC | 05:17 | |
| *** mylu has joined #openstack-keystone | 05:27 | |
| *** roxanaghe has quit IRC | 05:35 | |
| *** gangadhar has joined #openstack-keystone | 05:37 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:38 | |
| *** GB21 has joined #openstack-keystone | 05:39 | |
| *** lhcheng has joined #openstack-keystone | 05:43 | |
| *** ChanServ sets mode: +v lhcheng | 05:43 | |
| *** Nirupama has joined #openstack-keystone | 05:47 | |
| *** furface has quit IRC | 05:50 | |
| *** sdake_ has joined #openstack-keystone | 05:51 | |
| *** sdake has quit IRC | 05:52 | |
| *** pushkaru has quit IRC | 05:54 | |
| *** spandhe has quit IRC | 06:06 | |
| *** agrebennikov has quit IRC | 06:07 | |
| *** jaosorior has joined #openstack-keystone | 06:08 | |
| *** mylu has quit IRC | 06:11 | |
| openstackgerrit | Merged openstack/keystone: Add `patch_cover` to keystone https://review.openstack.org/294189 | 06:13 |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3) https://review.openstack.org/267456 | 06:17 |
| *** tesseract has joined #openstack-keystone | 06:19 | |
| *** harlowja has quit IRC | 06:19 | |
| *** tesseract is now known as Guest58782 | 06:19 | |
| *** furface has joined #openstack-keystone | 06:20 | |
| *** markvoelker has joined #openstack-keystone | 06:22 | |
| *** markvoelker_ has joined #openstack-keystone | 06:23 | |
| *** lhcheng has quit IRC | 06:25 | |
| *** markvoelker has quit IRC | 06:27 | |
| *** harlowja has joined #openstack-keystone | 06:32 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Correct `role_name` constraint dropping https://review.openstack.org/298402 | 06:33 |
| *** roxanaghe has joined #openstack-keystone | 06:36 | |
| *** roxanaghe has quit IRC | 06:41 | |
| *** markvoelker_ has quit IRC | 06:43 | |
| *** markvoelker has joined #openstack-keystone | 06:44 | |
| *** henrynash has joined #openstack-keystone | 06:45 | |
| *** ChanServ sets mode: +v henrynash | 06:45 | |
| *** lmiccini has quit IRC | 06:46 | |
| *** fawadkhaliq has quit IRC | 06:49 | |
| *** lmiccini has joined #openstack-keystone | 06:50 | |
| *** GB21 has quit IRC | 07:05 | |
| *** bjornar has joined #openstack-keystone | 07:12 | |
| *** markvoelker has quit IRC | 07:12 | |
| *** tqtran has joined #openstack-keystone | 07:14 | |
| *** GB21 has joined #openstack-keystone | 07:17 | |
| *** tqtran has quit IRC | 07:18 | |
| *** pgreg has joined #openstack-keystone | 07:21 | |
| *** sdake_ has quit IRC | 07:22 | |
| *** pgreg has quit IRC | 07:23 | |
| *** bjornar has quit IRC | 07:24 | |
| *** sdake has joined #openstack-keystone | 07:25 | |
| naresht | "$openstack domain list" this command giving an ERROR: openstack Authentication cannot be scoped to multiple targets. Pick one of: project, domain or trust | 07:27 |
| *** pgreg has joined #openstack-keystone | 07:27 | |
| naresht | Could anyone help me here ? | 07:27 |
| naresht | printenv | grep OS_ gives http://paste.openstack.org/show/492206/ | 07:29 |
| *** rcernin has joined #openstack-keystone | 07:36 | |
| *** martinus__ has joined #openstack-keystone | 07:40 | |
| *** browne has quit IRC | 07:45 | |
| *** pcaruana has joined #openstack-keystone | 07:48 | |
| *** daemontool has joined #openstack-keystone | 07:50 | |
| *** daemontool_ has joined #openstack-keystone | 07:58 | |
| *** daemontool has quit IRC | 08:02 | |
| *** markvoelker has joined #openstack-keystone | 08:13 | |
| *** markvoelker has quit IRC | 08:17 | |
| *** jistr has joined #openstack-keystone | 08:23 | |
| *** roxanaghe has joined #openstack-keystone | 08:24 | |
| *** dims has quit IRC | 08:26 | |
| *** roxanaghe has quit IRC | 08:29 | |
| *** dims has joined #openstack-keystone | 08:31 | |
| *** dpippenger has quit IRC | 08:32 | |
| marekd | naresht: try without OS_DOMAIN_NAME | 08:32 |
| marekd | naresht: also, you can remote OS_TENANT_NAME as you have PROJECT already | 08:33 |
| marekd | s/remote/remove/ | 08:33 |
| naresht | I tried with OS_DOMAIN_NAME, OS_TENANT_NAME ..same error we are getting | 08:42 |
| *** daemontool_ has quit IRC | 08:43 | |
| *** daemontool_ has joined #openstack-keystone | 08:43 | |
| naresht | +marekd: What is this "s/remote/remove/" | 08:44 |
| marekd | regular expresssion | 08:44 |
| marekd | naresht: i told you to REMOVE OS_DOMAIN_NAME | 08:44 |
| *** rk4n has joined #openstack-keystone | 08:45 | |
| *** gangadhar has quit IRC | 08:45 | |
| *** mvk has joined #openstack-keystone | 08:46 | |
| naresht | sorry ..!! I tried without OS_DOMAIN_NAME | 08:46 |
| naresht | +marekd: | 08:48 |
| naresht | +marekd: here is the openrc file http://paste.openstack.org/show/492215/ | 08:53 |
| *** GB21 has quit IRC | 08:54 | |
| marekd | naresht: looks good | 08:56 |
| marekd | which version are you using? | 08:56 |
| marekd | is it devstack? | 08:56 |
| naresht | Yes devstack kilo | 08:56 |
| marekd | naresht: is it rc file generated by devstack ? | 08:57 |
| naresht | Yes | 08:58 |
| naresht | +marekd: domain list is not working after I configured keystone as SP. I followed this link http://blog.rodrigods.com/it-is-time-to-play-with-keystone-to-keystone-federation-in-kilo/ | 08:59 |
| marekd | naresht: so you are oing to use k2k and list dmains or somethinf like that? | 08:59 |
| marekd | which authentication plugin are you using right now? | 09:00 |
| marekd | federation ? | 09:00 |
| naresht | Shibboleth | 09:01 |
| marekd | lol | 09:01 |
| marekd | naresht: ok, try first with normal auth | 09:01 |
| marekd | username and password. | 09:01 |
| marekd | and see if it works | 09:02 |
| naresht | I want create group, project and assign role to member with openstack command... but it is not working | 09:03 |
| naresht | +marekd: ok | 09:03 |
| marekd | naresht: man | 09:03 |
| marekd | naresht: you are trying to access openstck via federation and configure it.... | 09:03 |
| marekd | this is not how it should work. | 09:04 |
| marekd | go to page 0 and make sure you can access it without federated accesss. | 09:04 |
| marekd | once ou have it, configure project and group | 09:04 |
| marekd | I will even advise you to actually make sure it works with an external IdP | 09:04 |
| marekd | and only then it's best to configure it with k2k | 09:05 |
| marekd | really, use password first | 09:05 |
| marekd | and make sure everything is okay. | 09:05 |
| marekd | if not, and you are short on time you can remove and reinstall devstack :) | 09:05 |
| *** sileht has quit IRC | 09:07 | |
| naresht | +marekd: ok, Thanks | 09:08 |
| marekd | naresht: don't attempt to do everyhing at once | 09:08 |
| *** mhickey has joined #openstack-keystone | 09:08 | |
| marekd | because it's easy to make a mistake and hard to debug where | 09:08 |
| *** rm_work has quit IRC | 09:08 | |
| *** mgagne has quit IRC | 09:08 | |
| marekd | step by step. | 09:09 |
| *** EinstCra_ is now known as EinstCrazy | 09:09 | |
| marekd | did you have devstack ready and did you login there? | 09:09 |
| *** pumaranikar has quit IRC | 09:09 | |
| *** dtroyer has quit IRC | 09:10 | |
| *** mjb has quit IRC | 09:11 | |
| *** comstud has quit IRC | 09:11 | |
| *** sileht has joined #openstack-keystone | 09:13 | |
| *** dtroyer has joined #openstack-keystone | 09:13 | |
| *** comstud has joined #openstack-keystone | 09:13 | |
| *** rm_work has joined #openstack-keystone | 09:13 | |
| *** mjb has joined #openstack-keystone | 09:14 | |
| *** mgagne has joined #openstack-keystone | 09:14 | |
| *** mgagne is now known as Guest68910 | 09:14 | |
| *** pumaranikar has joined #openstack-keystone | 09:14 | |
| naresht | +marekd: yes I'm ready with devstack | 09:15 |
| marekd | naresht: cool! | 09:15 |
| marekd | can you login with user and password? | 09:15 |
| naresht | Yes | 09:16 |
| marekd | naresht: did you configure project, groups and role assignments? | 09:16 |
| *** e0ne has joined #openstack-keystone | 09:18 | |
| naresht | +marekd: No need to change api V2 to V3 | 09:18 |
| naresht | ? | 09:18 |
| marekd | need to change API to V3 | 09:18 |
| naresht | Ok | 09:18 |
| naresht | +marekd: yes created group and project and role assignments | 09:21 |
| *** bjornar has joined #openstack-keystone | 09:23 | |
| naresht | + marekd: mapping need to do after configuring keystone as SP right ? | 09:25 |
| marekd | before | 09:27 |
| naresht | ok | 09:27 |
| *** dpippenger has joined #openstack-keystone | 09:31 | |
| *** dpippenger has quit IRC | 09:32 | |
| *** lifeless has quit IRC | 09:39 | |
| *** lifeless has joined #openstack-keystone | 09:40 | |
| *** Nirupama has quit IRC | 09:49 | |
| *** daemontool_ has quit IRC | 09:55 | |
| *** daemontool_ has joined #openstack-keystone | 09:55 | |
| *** daemontool_ has quit IRC | 09:56 | |
| *** daemontool_ has joined #openstack-keystone | 09:56 | |
| *** henrynash has quit IRC | 09:57 | |
| *** pgreg has quit IRC | 10:04 | |
| *** Nirupama has joined #openstack-keystone | 10:05 | |
| *** sdake has quit IRC | 10:10 | |
| *** roxanaghe has joined #openstack-keystone | 10:12 | |
| *** markvoelker has joined #openstack-keystone | 10:14 | |
| *** tqtran has joined #openstack-keystone | 10:15 | |
| *** roxanaghe has quit IRC | 10:17 | |
| *** tqtran has quit IRC | 10:20 | |
| *** markvoelker has quit IRC | 10:20 | |
| *** shangxdy has joined #openstack-keystone | 10:33 | |
| *** flaper87 has quit IRC | 10:36 | |
| *** flaper87 has joined #openstack-keystone | 10:36 | |
| *** EinstCrazy has quit IRC | 10:52 | |
| *** tellesnobrega is now known as tellesnobrega_af | 11:05 | |
| *** shangxdy has quit IRC | 11:08 | |
| *** mvk_ has joined #openstack-keystone | 11:15 | |
| *** markvoelker has joined #openstack-keystone | 11:16 | |
| *** mvk has quit IRC | 11:19 | |
| *** markvoelker has quit IRC | 11:21 | |
| *** Nirupama has quit IRC | 11:26 | |
| *** gordc has joined #openstack-keystone | 11:30 | |
| *** dpippenger has joined #openstack-keystone | 11:32 | |
| *** dpippenger has quit IRC | 11:33 | |
| *** Nirupama has joined #openstack-keystone | 11:42 | |
| *** rodrigods has quit IRC | 11:42 | |
| *** rodrigods has joined #openstack-keystone | 11:42 | |
| *** henrynash has joined #openstack-keystone | 11:44 | |
| *** ChanServ sets mode: +v henrynash | 11:44 | |
| *** naresht has quit IRC | 11:56 | |
| *** roxanaghe has joined #openstack-keystone | 12:01 | |
| *** trown|PTO is now known as trown | 12:01 | |
| *** roxanaghe has quit IRC | 12:05 | |
| *** pauloewerton has joined #openstack-keystone | 12:06 | |
| *** henrynash has quit IRC | 12:11 | |
| *** markvoelker has joined #openstack-keystone | 12:17 | |
| *** raildo-afk is now known as raildo | 12:20 | |
| *** markvoelker has quit IRC | 12:22 | |
| *** EinstCrazy has joined #openstack-keystone | 12:27 | |
| *** jaosorior has quit IRC | 12:38 | |
| *** jaosorior has joined #openstack-keystone | 12:39 | |
| *** jaosorior has quit IRC | 12:42 | |
| *** jaosorior has joined #openstack-keystone | 12:43 | |
| *** EinstCrazy has quit IRC | 12:48 | |
| *** Nirupama has quit IRC | 12:51 | |
| *** links has quit IRC | 13:02 | |
| *** ninag has joined #openstack-keystone | 13:03 | |
| *** EinstCrazy has joined #openstack-keystone | 13:06 | |
| *** edmondsw has joined #openstack-keystone | 13:09 | |
| *** ayoung has joined #openstack-keystone | 13:09 | |
| *** ChanServ sets mode: +v ayoung | 13:09 | |
| *** pushkaru has joined #openstack-keystone | 13:18 | |
| *** markvoelker has joined #openstack-keystone | 13:18 | |
| *** ametts has joined #openstack-keystone | 13:22 | |
| *** markvoelker has quit IRC | 13:22 | |
| *** markvoelker has joined #openstack-keystone | 13:23 | |
| *** EinstCrazy has quit IRC | 13:24 | |
| *** markvoelker_ has joined #openstack-keystone | 13:28 | |
| *** jsavak has joined #openstack-keystone | 13:30 | |
| *** mylu has joined #openstack-keystone | 13:30 | |
| *** markvoelker has quit IRC | 13:32 | |
| *** woodster_ has joined #openstack-keystone | 13:32 | |
| *** mylu has quit IRC | 13:32 | |
| *** dpippenger has joined #openstack-keystone | 13:32 | |
| *** mylu has joined #openstack-keystone | 13:32 | |
| openstackgerrit | Kalaswan Datta proposed openstack/keystone: Clear the project ID from user information https://review.openstack.org/277707 | 13:32 |
| *** dpippenger has quit IRC | 13:35 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor to allow for service provider caching https://review.openstack.org/298748 | 13:35 |
| *** naresht has joined #openstack-keystone | 13:41 | |
| *** henrynash has joined #openstack-keystone | 13:46 | |
| *** ChanServ sets mode: +v henrynash | 13:46 | |
| *** roxanaghe has joined #openstack-keystone | 13:49 | |
| *** mylu has quit IRC | 13:50 | |
| *** roxanaghe has quit IRC | 13:53 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: Add users functional tests https://review.openstack.org/289306 | 13:56 |
| samueldmq | bknudson: rodrigods: ^ all comments addressed, thanks for reviewing | 13:57 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:57 | |
| *** mylu has joined #openstack-keystone | 13:58 | |
| *** mkoderer__ has quit IRC | 13:59 | |
| *** richm has joined #openstack-keystone | 14:02 | |
| *** mkoderer__ has joined #openstack-keystone | 14:02 | |
| *** daemontool_ is now known as daemontool | 14:06 | |
| *** markvoelker_ has quit IRC | 14:15 | |
| *** jmlowe has joined #openstack-keystone | 14:16 | |
| *** tqtran has joined #openstack-keystone | 14:17 | |
| *** slberger has joined #openstack-keystone | 14:18 | |
| jmlowe | Are ec2 credentials supposed to work against v3 keystone credentials with domains in Liberty? | 14:18 |
| *** tellesnobrega_af is now known as tellesnobrega | 14:19 | |
| *** tqtran has quit IRC | 14:21 | |
| *** sdake has joined #openstack-keystone | 14:27 | |
| *** sdake_ has joined #openstack-keystone | 14:30 | |
| *** sdake has quit IRC | 14:32 | |
| *** dan_nguyen has joined #openstack-keystone | 14:34 | |
| *** sdake_ is now known as sdake | 14:37 | |
| *** doug-fish has joined #openstack-keystone | 14:38 | |
| henrynash | ayoung, stevemar: if you have a moment, perhaps one of you could take a peek at: https://review.openstack.org/#/c/290223/ | 14:40 |
| patchbot | henrynash: patch 290223 - keystone - Make modifications to domain config atomic | 14:40 |
| stevemar | henrynash: consider it added to the list | 14:40 |
| henrynash | stevemar: thx | 14:40 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Fetch Policy by URL https://review.openstack.org/298788 | 14:41 |
| *** david_cu has joined #openstack-keystone | 14:41 | |
| ayoung | henrynash, looking | 14:41 |
| henrynash | ayoung: thx | 14:41 |
| ayoung | henrynash, your commit titles are too verbose. | 14:42 |
| ayoung | h nevermind | 14:42 |
| ayoung | I misparsed. it is fine | 14:42 |
| henrynash | ayoung: :-) | 14:42 |
| ayoung | henrynash, coulda swornd I approved that one already | 14:42 |
| henrynash | ayoung: np | 14:43 |
| ayoung | henrynash, as Keystone gets more mature, I expect us to rely more and more on the database for atomicity like this change does | 14:44 |
| ayoung | wish we had a real database.... | 14:44 |
| henrynash | ayoung: agreed….you mean our support for MyQuicheSQL ? | 14:44 |
| ayoung | Heh | 14:45 |
| ayoung | henrynash, +2A | 14:45 |
| *** jorge_munoz has joined #openstack-keystone | 14:45 | |
| henrynash | ayoung: thx | 14:45 |
| jmlowe | I can't seem to get ec2 credentials to work with anything other than the default domain, is that expected behavior? | 14:45 |
| *** rderose has joined #openstack-keystone | 14:46 | |
| *** toddnni has quit IRC | 14:46 | |
| ayoung | jmlowe, No idea...but it is probably time I learned this | 14:47 |
| ayoung | jmlowe, what are you doing? | 14:47 |
| jmlowe | I've got more users than I would have guessed trying to use keystone generated ec2 credentials on Liberty, my read of the ec2token keystone middleware leads me to think it should work for all users but only the ones in the default domain work leading me to believe it's only able to issue v2 tokens | 14:48 |
| *** henrynash has quit IRC | 14:49 | |
| ayoung | jmlowe, could be. let me dig a bit | 14:49 |
| *** roxanaghe has joined #openstack-keystone | 14:49 | |
| *** GB21 has joined #openstack-keystone | 14:50 | |
| raildo | jmlowe: I thick ec2 credentials only works with API v2.0, so my guess for this is yes. this should works only in the default domain | 14:51 |
| jmlowe | ec2token keystone middleware looks v3 ready, is the v2.0 happening somewhere else? | 14:53 |
| *** bjornar has quit IRC | 14:53 | |
| morgan | bknudson: will fix the comments on the 88 migration shortly | 14:53 |
| morgan | bknudson: the reason for 96 and 101 is because as prometheanfire said, some people may have manually "fixed" their migration (comment) and moved on. this is really being overly cautious | 14:54 |
| *** roxanaghe has quit IRC | 14:54 | |
| ayoung | jmlowe, wheredo you see that? | 14:54 |
| bknudson | morgan: ok, the comment should say that | 14:54 |
| morgan | bknudson: i thought i put that in there | 14:54 |
| * morgan 2x checks | 14:55 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/ec2_token.py looks kinda v2 specific to me | 14:55 |
| bknudson | morgan: also, the code can probably be clearer... could just check if the index exists already | 14:55 |
| morgan | bknudson: it's one of those cases where you have to do programatic lookup of the index | 14:55 |
| morgan | bknudson: because you have no idea what the index is named | 14:55 |
| morgan | bknudson: it could be named at least 2 different things if not some automatic magic names too | 14:56 |
| prometheanfire | morgan: ya, it was a pain to debug :| | 14:56 |
| morgan | bknudson: basically dropping unique constraints should never rely on the "name" in our codebase (as crappy as that is) | 14:56 |
| bknudson | oh, never mind, I thought 96 and 101 were recreating the other index, but it's just dropping the old one | 14:57 |
| morgan | yeah | 14:57 |
| prometheanfire | the column recreation should be behind a check | 14:58 |
| prometheanfire | most things should be when dealing with migrations imo :P | 14:58 |
| *** mylu has quit IRC | 14:58 | |
| *** mylu has joined #openstack-keystone | 14:59 | |
| *** mylu_ has joined #openstack-keystone | 15:00 | |
| ayoung | jmlowe, but you are right that the keystone server seems to be V3 capable for ec2 | 15:00 |
| ayoung | so jmlowe maybe the URL is wrong | 15:01 |
| openstackgerrit | Merged openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 15:01 |
| *** mylu has quit IRC | 15:01 | |
| *** knikolla has joined #openstack-keystone | 15:01 | |
| morgan | oooh. | 15:02 |
| morgan | uhm... | 15:02 |
| morgan | bknudson: ok i have to do something ugly here... | 15:02 |
| jmlowe | my keystone_ec2_url in nova.conf is https://<controller>:5000/v2.0/ec2tokens, I don't think it worked if I switched to /v3/ec2tokens | 15:02 |
| morgan | bknudson: i cant just try/except around the domain_id column being created... | 15:02 |
| morgan | bknudson: because the exception is different based upon the driver (pymysql, mysqldb, psgql, etc) | 15:03 |
| morgan | ugh | 15:03 |
| bknudson | they don't have a common base class? | 15:03 |
| morgan | checking but it looks like it isn't. | 15:03 |
| morgan | DBError: (pymysql.err.InternalError) | 15:04 |
| morgan | that is being raised by pymysql.err | 15:04 |
| morgan | in the migration | 15:04 |
| jmlowe | ayoung: should it do the right thing or do I need to try to get a url with v3 to work? | 15:04 |
| morgan | not by sql-a | 15:04 |
| bknudson | InternalError doesn't seem accurate | 15:04 |
| morgan | =/ | 15:04 |
| morgan | DBError: (pymysql.err.InternalError) (1060, u"Duplicate column name 'domain_id'") [SQL: u"\nALTER TABLE role ADD domain_id VARCHAR(64) NOT NULL DEFAULT '<<null>>'"] | 15:04 |
| morgan | that is the full line from db_sync | 15:04 |
| ayoung | jmlowe, I don't know. I'm making this up as I go along. | 15:04 |
| jmlowe | ayoung: aren't we all? | 15:05 |
| ayoung | jmlowe, what is the URL you haveright now? | 15:05 |
| morgan | ok, let me query the table directly and figure out if it has the column *ugh* | 15:05 |
| jmlowe | ayoung: https://<controller>:5000/v2.0/ec2tokens | 15:05 |
| bknudson | morgan: doing introspection of the table isn't the worst thing | 15:05 |
| morgan | bknudson: no just... annoying :( | 15:05 |
| ayoung | jmlowe, OK, so that is v2 specific. I would expect us to use a non v2 url for v2/v3. But then again, some of the other auth does allow v3 in v2, but onloy default domain, which sounds like what you are seing. | 15:06 |
| ayoung | Let me see if it wil honor a v3 based URL... | 15:06 |
| *** openstackgerrit has quit IRC | 15:06 | |
| morgan | ah role_Table.columns | 15:06 |
| jmlowe | ayoung: I sat next to you in the HPC bof in Vancouver, it may interest you to know that this is the project I'm working on http://jetstream-cloud.org | 15:06 |
| morgan | sometimes the ORM is ice. | 15:06 |
| morgan | nice* | 15:06 |
| *** openstackgerrit has joined #openstack-keystone | 15:06 | |
| ayoung | "LATency...its the Nemisis of HPC...that is why you job runs endlessly....your process gates on latency...." | 15:08 |
| *** diazjf has joined #openstack-keystone | 15:09 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Correct `role_name` constraint dropping https://review.openstack.org/298402 | 15:09 |
| morgan | bknudson: ^ comments addressed. | 15:10 |
| morgan | and duplicate of patch pushed for stable/mitaka as well | 15:10 |
| jmlowe | ayoung: at this point we'd be happy if the bioinformaticists would stop writing O(n!) code in perl | 15:10 |
| bknudson | morgan: still no tests | 15:10 |
| *** jaugustine has joined #openstack-keystone | 15:11 | |
| ayoung | jmlowe, http://adam.younglogic.com/2012/07/latency/ | 15:11 |
| *** tellesnobrega is now known as tellesnobrega_af | 15:12 | |
| morgan | bknudson: unfortuately i can't do tests today =/ I have a ton of things to take care of :( notably finding a new job related :( so- i can generate tests tomorrow if stevemar doesn't mind holding up RC. | 15:12 |
| jmlowe | ayoung: I love it | 15:12 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Run federation tests under Python 3 https://review.openstack.org/294797 | 15:12 |
| morgan | bknudson: or i'm happy to have someone else do the tests. but just reality of being unemployed :( | 15:12 |
| bknudson | when you're unemployed there's no vacation | 15:12 |
| morgan | bknudson: when you're unemployed and have interviews/calls/etc, you can't code at the same time :P | 15:13 |
| *** toddnni has joined #openstack-keystone | 15:14 | |
| morgan | bknudson: anyway. happy to write tests but i need to run and deal with stuff for the majority of the day. (also these tests are def. gonna be ugly cause they have to do the same work as the migration just to do the migration) | 15:14 |
| jmlowe | ayoung: is there something special I have to do to get that to show up under v3, I get 404 when I try to curl | 15:18 |
| jmlowe | ayoung: some paste config? | 15:18 |
| ayoung | jmlowe, so, something recylced my current test cluster...let me see if I can bring it back up and try myself. | 15:18 |
| ayoung | jmlowe, I have actually never dealt with the EC2 API thus far | 15:19 |
| jmlowe | ayoung: I didn't think anybody would use it, clearly I was wrong | 15:21 |
| *** gordc has quit IRC | 15:23 | |
| *** rcernin has quit IRC | 15:27 | |
| *** Ephur has joined #openstack-keystone | 15:27 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Cleaning up identity.core https://review.openstack.org/296140 | 15:30 |
| *** links has joined #openstack-keystone | 15:32 | |
| *** arunkant has joined #openstack-keystone | 15:32 | |
| bknudson | morgan: good luck on the interviews by the way | 15:34 |
| morgan | bknudson: thnx :) | 15:34 |
| *** roxanaghe has joined #openstack-keystone | 15:34 | |
| *** dpippenger has joined #openstack-keystone | 15:34 | |
| *** dpippenger has quit IRC | 15:36 | |
| *** gyee has joined #openstack-keystone | 15:41 | |
| *** ChanServ sets mode: +v gyee | 15:41 | |
| *** harlowja has quit IRC | 15:41 | |
| *** gordc has joined #openstack-keystone | 15:46 | |
| *** henrynash has joined #openstack-keystone | 15:49 | |
| *** ChanServ sets mode: +v henrynash | 15:49 | |
| *** roxanagh_ has joined #openstack-keystone | 15:50 | |
| *** roxanagh_ has quit IRC | 15:55 | |
| *** agrebennikov has joined #openstack-keystone | 15:55 | |
| jmlowe | ayoung: totally missed the fact that only POST method would work for that url, now 400 bad request, so I guess I need to actually figure out how to use the api | 15:56 |
| ayoung | jmlowe, curl should work | 15:58 |
| ayoung | does it work with a V2 request first? | 15:58 |
| *** gokrokve has joined #openstack-keystone | 15:59 | |
| *** ametts has quit IRC | 15:59 | |
| ayoung | samueldmq, so I wrote up "fetchpolicy by Endpoing URL" as a spec, but I don;t know what that API would look like. You can't really embed a URL into a GET request | 16:01 |
| *** Guest58782 has quit IRC | 16:03 | |
| *** links has quit IRC | 16:04 | |
| lbragstad | rderose quick follow up question here - https://review.openstack.org/#/c/292611/2 | 16:04 |
| patchbot | lbragstad: patch 292611 - keystone - Move identity.backends.sql model code to sql_model.py | 16:04 |
| rderose | lbragstad: sure | 16:04 |
| lbragstad | rderose I left a comment to your response https://review.openstack.org/#/c/292611/2/keystone/identity/backends/model.py | 16:05 |
| patchbot | lbragstad: patch 292611 - keystone - Move identity.backends.sql model code to sql_model.py | 16:05 |
| *** agrebennikov has quit IRC | 16:05 | |
| jmlowe | ayoung: I get the same 400 bad request error with both, so at least it's being routed properly | 16:05 |
| rderose | lbragstad: You are correct in your comment. When an ldap user authenticates, we'll store a ldap_user record in SQL. | 16:06 |
| lbragstad | rderose ok - cool | 16:06 |
| ayoung | rderose, what is going to happen with the id_mapping stuff? | 16:07 |
| ayoung | Is the meeting in 53 minutes or 113 minnutes? | 16:08 |
| rderose | ayoung: we'll refactor the mapping engine to remove tech debt once we've shadowed ldap users | 16:09 |
| ayoung | rderose, that is not tech debt | 16:09 |
| ayoung | rderose, it is a very hard fought over compromise | 16:10 |
| ayoung | and it should have been the heart of the shadow user approach | 16:10 |
| ayoung | rderose, the issue is, if a user has never authenticated to Keystone, how can we find out her userid to assign her a role? | 16:10 |
| rderose | ayoung: okay, point taken. to be honest, I'm still getting familiar with this code base. lets chat once I start shadowing ldap users | 16:11 |
| ayoung | heh | 16:11 |
| ayoung | rderose, cool. Lot to be done here. Are you going to Austin? | 16:11 |
| lbragstad | rderose I left a couple more comments on the latest patch set - it's lookin' good though! | 16:12 |
| rderose | ayoung: yeah, I'll be there :) would be great for us to get together to work on this. | 16:12 |
| rderose | lbragstad: cool | 16:12 |
| *** browne has joined #openstack-keystone | 16:12 | |
| *** mylu_ has quit IRC | 16:13 | |
| *** mylu has joined #openstack-keystone | 16:13 | |
| knikolla | according to my calendar the meeting is in ~107 minutes | 16:13 |
| *** jistr has quit IRC | 16:14 | |
| *** lhcheng has joined #openstack-keystone | 16:14 | |
| *** ChanServ sets mode: +v lhcheng | 16:14 | |
| ayoung | knikolla, yeah, but that whole Daylight savings thing | 16:15 |
| ayoung | jmlowe, OK, I have a new deployment up | 16:15 |
| ayoung | I need to learn EC2.... | 16:15 |
| *** naresht has quit IRC | 16:16 | |
| knikolla | ayoung, i'm subscribed to http://eavesdrop.openstack.org/irc-meetings.ical | 16:16 |
| *** tellesnobrega_af is now known as tellesnobrega | 16:16 | |
| knikolla | so i figure it autohandles that | 16:16 |
| *** agrebennikov has joined #openstack-keystone | 16:23 | |
| *** jsavak has quit IRC | 16:26 | |
| *** dpippenger has joined #openstack-keystone | 16:27 | |
| *** agrebennikov has quit IRC | 16:28 | |
| *** harlowja has joined #openstack-keystone | 16:29 | |
| *** dpippenger has quit IRC | 16:29 | |
| *** jsavak has joined #openstack-keystone | 16:29 | |
| *** tqtran has joined #openstack-keystone | 16:30 | |
| *** e0ne has quit IRC | 16:31 | |
| *** mylu has quit IRC | 16:34 | |
| *** mylu has joined #openstack-keystone | 16:34 | |
| *** mylu has quit IRC | 16:34 | |
| *** mylu has joined #openstack-keystone | 16:34 | |
| *** mylu has quit IRC | 16:35 | |
| *** Guest68910 is now known as mgagne | 16:38 | |
| *** mgagne has quit IRC | 16:38 | |
| *** mgagne has joined #openstack-keystone | 16:38 | |
| *** timcline has joined #openstack-keystone | 16:40 | |
| *** agrebennikov has joined #openstack-keystone | 16:41 | |
| *** nisha_ has joined #openstack-keystone | 16:44 | |
| *** pcaruana has quit IRC | 16:48 | |
| *** david_cu has quit IRC | 16:50 | |
| *** diazjf has quit IRC | 16:50 | |
| *** mvk_ has quit IRC | 16:56 | |
| *** ametts has joined #openstack-keystone | 16:57 | |
| *** harlowja_ has joined #openstack-keystone | 16:58 | |
| *** nisha__ has joined #openstack-keystone | 16:59 | |
| *** harlowja has quit IRC | 17:00 | |
| *** mgagne_ has joined #openstack-keystone | 17:06 | |
| *** dtroyer has quit IRC | 17:07 | |
| *** zhiyan has quit IRC | 17:07 | |
| *** ryanpetrello has quit IRC | 17:07 | |
| *** patchbot has quit IRC | 17:07 | |
| *** rha has quit IRC | 17:07 | |
| *** sudorandom has quit IRC | 17:07 | |
| *** blogan has quit IRC | 17:07 | |
| *** gsilvis has quit IRC | 17:07 | |
| *** BrAsS_mOnKeY has quit IRC | 17:07 | |
| *** tpeoples has quit IRC | 17:07 | |
| *** adam_g has quit IRC | 17:07 | |
| *** jasondotstar has quit IRC | 17:07 | |
| *** baffle has quit IRC | 17:07 | |
| *** ametts has quit IRC | 17:07 | |
| *** roxanaghe has quit IRC | 17:07 | |
| *** mjb has quit IRC | 17:07 | |
| *** mgagne has quit IRC | 17:07 | |
| *** comstud has quit IRC | 17:07 | |
| *** hockeynut has quit IRC | 17:07 | |
| *** dhellmann has quit IRC | 17:07 | |
| *** kfox1111 has quit IRC | 17:07 | |
| *** zzzeek has quit IRC | 17:07 | |
| *** samueldmq has quit IRC | 17:07 | |
| *** darrenc has quit IRC | 17:07 | |
| *** sigmavirus24 has quit IRC | 17:07 | |
| *** eglute has quit IRC | 17:07 | |
| *** gus has quit IRC | 17:07 | |
| *** Nakato has quit IRC | 17:07 | |
| *** cloudnull has quit IRC | 17:07 | |
| *** mhu has quit IRC | 17:07 | |
| *** jamielennox has quit IRC | 17:07 | |
| *** Anticimex has quit IRC | 17:07 | |
| *** mfisch has quit IRC | 17:07 | |
| *** d34dh0r53 has quit IRC | 17:07 | |
| *** eglute has joined #openstack-keystone | 17:07 | |
| *** dtroyer has joined #openstack-keystone | 17:07 | |
| *** comstud has joined #openstack-keystone | 17:07 | |
| *** d34dh0r53 has joined #openstack-keystone | 17:07 | |
| *** sdake_ has joined #openstack-keystone | 17:07 | |
| ayoung | samueldmq, is your Policy fetch policy Proof of concept posted anywhere? | 17:07 |
| *** gyee has quit IRC | 17:07 | |
| *** nisha_ has quit IRC | 17:07 | |
| *** patchbot` has joined #openstack-keystone | 17:07 | |
| *** sdake has quit IRC | 17:07 | |
| *** trown is now known as trown|lunch | 17:07 | |
| *** roxanaghe_ has joined #openstack-keystone | 17:07 | |
| *** patchbot` is now known as patchbot | 17:07 | |
| *** bjornar has joined #openstack-keystone | 17:07 | |
| *** Nakato_ has joined #openstack-keystone | 17:07 | |
| *** baffle_ has joined #openstack-keystone | 17:07 | |
| *** dflorea has joined #openstack-keystone | 17:07 | |
| *** hockeynut_afk has joined #openstack-keystone | 17:07 | |
| *** gsilvis_ has joined #openstack-keystone | 17:07 | |
| *** ryanpetrello_ has joined #openstack-keystone | 17:07 | |
| *** kfox1111_ has joined #openstack-keystone | 17:07 | |
| *** Anticime1 has joined #openstack-keystone | 17:07 | |
| *** sudorandom_ has joined #openstack-keystone | 17:07 | |
| *** samueldm1 has joined #openstack-keystone | 17:07 | |
| *** ametts_ has joined #openstack-keystone | 17:07 | |
| *** sudorandom_ is now known as sudorandom | 17:07 | |
| *** ryanpetrello_ is now known as ryanpetrello | 17:07 | |
| *** BrAsS_mO- has joined #openstack-keystone | 17:07 | |
| *** adam_g` has joined #openstack-keystone | 17:07 | |
| *** dhellmann has joined #openstack-keystone | 17:07 | |
| *** mjb has joined #openstack-keystone | 17:07 | |
| *** mfisch has joined #openstack-keystone | 17:07 | |
| *** hockeynut_afk is now known as hockeynut | 17:07 | |
| *** mgagne_ has quit IRC | 17:07 | |
| *** mgagne_ has joined #openstack-keystone | 17:07 | |
| *** mfisch is now known as Guest28049 | 17:08 | |
| *** blogan has joined #openstack-keystone | 17:08 | |
| *** jasondotstar has joined #openstack-keystone | 17:08 | |
| *** cloudnull has joined #openstack-keystone | 17:08 | |
| *** darrenc has joined #openstack-keystone | 17:08 | |
| *** adam_g` is now known as adam_g | 17:08 | |
| *** adam_g has quit IRC | 17:08 | |
| *** adam_g has joined #openstack-keystone | 17:08 | |
| *** zzzeek has joined #openstack-keystone | 17:08 | |
| *** gus has joined #openstack-keystone | 17:09 | |
| *** rderose has quit IRC | 17:09 | |
| *** _sigmavirus24 has joined #openstack-keystone | 17:10 | |
| *** dflorea has quit IRC | 17:11 | |
| *** rha has joined #openstack-keystone | 17:11 | |
| *** dflorea has joined #openstack-keystone | 17:12 | |
| stevemar | ayoung: its in 47 minutes now :) | 17:12 |
| *** jamielennox has joined #openstack-keystone | 17:12 | |
| *** ChanServ sets mode: +v jamielennox | 17:12 | |
| jmlowe | ayoung: awesome | 17:12 |
| ayoung | jmlowe, so the old keystone CLI does not seem to be happy...maybe a V2 vs v3 thing...I'll convert to a V2 URL... | 17:13 |
| *** toddnni_ has joined #openstack-keystone | 17:13 | |
| *** toddnni has quit IRC | 17:13 | |
| *** toddnni_ is now known as toddnni | 17:14 | |
| *** daemontool has quit IRC | 17:14 | |
| *** _sigmavirus24 is now known as sigmavirus24 | 17:14 | |
| *** sigmavirus24 has joined #openstack-keystone | 17:14 | |
| *** mgagne_ is now known as mgagne | 17:15 | |
| *** zhiyan has joined #openstack-keystone | 17:17 | |
| ayoung | jmlowe, hmmm | 17:18 |
| ayoung | jmlowe, so, as an authed user, I should be able to just run: keystone --insecure ec2-credentials-create | 17:19 |
| ayoung | no args, and get a credential for that project for the current user, no? | 17:19 |
| *** tpeoples has joined #openstack-keystone | 17:19 | |
| ayoung | and that seems to be unhappy on my system... | 17:20 |
| *** shaleh has joined #openstack-keystone | 17:20 | |
| *** harlowja has joined #openstack-keystone | 17:20 | |
| ayoung | jmlowe, its not reporting an error, but there is nothing created, nothing stored in the DB. | 17:21 |
| shaleh | ayoung: what is holding up the OSC changes for implied roles? | 17:21 |
| ayoung | shaleh, incompetane on my part? | 17:21 |
| samueldm1 | ayoung: you can sha(url) | 17:21 |
| ayoung | shaleh, want to make it happen? | 17:21 |
| ayoung | samueldm1, ? | 17:21 |
| samueldm1 | ayoung: and also query the list filtering by the url | 17:21 |
| shaleh | ayoung: I started on it yesterday afternoon :-) | 17:22 |
| ayoung | samueldm1, yeah, I was thinking sha(url) | 17:22 |
| ayoung | but that is kinda nasty | 17:22 |
| ayoung | shaleh, take it | 17:22 |
| samueldm1 | ayoung: wait it's not my original myself | 17:22 |
| shaleh | ayoung: I submitted a bug because the spec does not match keystone output | 17:22 |
| samueldm1 | wait | 17:22 |
| *** samueldm1 has quit IRC | 17:22 | |
| *** samueldmq has joined #openstack-keystone | 17:22 | |
| *** harlowja_ has quit IRC | 17:22 | |
| stevemar | anyone feel like adding unit tests to https://review.openstack.org/#/c/298402 ? | 17:22 |
| *** ChanServ sets mode: +v samueldmq | 17:22 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Add users functional tests https://review.openstack.org/289306 | 17:23 |
| samueldmq | ayoung: yeah but we don't have lots of options besides that | 17:23 |
| ayoung | samueldmq, is the endpoint ID approach really so bad? | 17:23 |
| ayoung | I guess it means a restart | 17:23 |
| ayoung | and with the URL we could avoid that | 17:23 |
| ayoung | if we made the endpoint ID the sha(url).... | 17:23 |
| samueldmq | ayoung: the only fact of the ID is that you don't know it ahead of time | 17:23 |
| ayoung | man, I like hashing | 17:24 |
| jmlowe | ayoung: that's what I thought, I used the "openstack" client "openstack ec2 create <uid> <pid>" | 17:24 |
| ayoung | jmlowe, pid? | 17:24 |
| ayoung | ah | 17:24 |
| jmlowe | project | 17:24 |
| ayoung | jmlowe, let me try that | 17:24 |
| shaleh | stevemar: that does not sound like fun coding :-) | 17:25 |
| jmlowe | debugging with ha is the bane of my existance, I'm going to capture the http going back and forth as soon as I can isolate it to one keysone | 17:26 |
| shaleh | jmlowe: no joke | 17:26 |
| shaleh | jmlowe: add in some ssl for even less fun | 17:26 |
| stevemar | knikolla: here's your very own blueprint! https://blueprints.launchpad.net/keystone/+spec/ldap3 | 17:26 |
| *** spandhe has joined #openstack-keystone | 17:27 | |
| jmlowe | sysdig keeps my sanity | 17:27 |
| ayoung | jmlowe, and that API only exists if I use a V2.0 AUTH URL and ID API version 2.0... | 17:27 |
| knikolla | stevemar, yay! | 17:27 |
| jmlowe | ayoung: does it matter as long as you get the id's straight? | 17:28 |
| *** dpippenger has joined #openstack-keystone | 17:28 | |
| stevemar | shaleh: it's gotta get done! | 17:28 |
| shaleh | jmlowe: sysdig looks interesting. is it container specific? | 17:28 |
| *** dflorea has quit IRC | 17:29 | |
| stevemar | bknudson: did you want to create the unit tests? i can work on them for a bit | 17:29 |
| *** Daviey has joined #openstack-keystone | 17:29 | |
| bknudson | stevemar: I don't think I'd be able to get to it until tomorrow | 17:29 |
| stevemar | okay | 17:29 |
| stevemar | i can work on them today | 17:29 |
| jmlowe | shaleh: nope, I don't do containers really, but if you are working with them it's the only tool I know of that can really dissect them, it's more that its so powerful that you can use it when working with containers | 17:31 |
| openstackgerrit | Merged openstack/keystone-specs: prep repo for newton release https://review.openstack.org/298514 | 17:31 |
| *** spandhe has quit IRC | 17:31 | |
| *** dflorea has joined #openstack-keystone | 17:32 | |
| *** sdake has joined #openstack-keystone | 17:33 | |
| ayoung | jmlowe, so, nothing seems to be working right. I might need to go into debug mode to figure out what is wrong, but I assume it is not what you problem is. | 17:33 |
| *** sdake_ has quit IRC | 17:34 | |
| jmlowe | ayoung: atm I only get 400 errors out of the v3/ec2token endpoint when using nova-api ec2 | 17:36 |
| *** roxanaghe has joined #openstack-keystone | 17:38 | |
| *** gokrokve has quit IRC | 17:39 | |
| *** ebalduf_ has joined #openstack-keystone | 17:40 | |
| ayoung | jmlowe, if you ue the --deug option from the CLI, it gives you the JSON. You can do stuff like: http://adam.younglogic.com/2013/09/keystone-v3-api-examples/ and http://adam.younglogic.com/2013/11/policy-enforcement-openstack/ | 17:41 |
| *** spandhe has joined #openstack-keystone | 17:41 | |
| ayoung | find out what does and does not work | 17:41 |
| jmlowe | ayoung: looks like keystone gives back a valid token, so this is looking more like the ec2 part of nova-api can't handle v3 tokens | 17:41 |
| ayoung | jmlowe, that might be keystonemiddleware, though | 17:41 |
| ayoung | checkto see if it is an open bug | 17:42 |
| *** roxanaghe has quit IRC | 17:43 | |
| jmlowe | http://paste.openstack.org/show/492334/ | 17:45 |
| *** e0ne has joined #openstack-keystone | 17:47 | |
| *** haneef has joined #openstack-keystone | 17:48 | |
| *** jmlowe has quit IRC | 17:49 | |
| *** jmlowe has joined #openstack-keystone | 17:55 | |
| *** rderose has joined #openstack-keystone | 17:55 | |
| *** sdake has quit IRC | 17:57 | |
| *** e0ne has quit IRC | 17:58 | |
| *** real56 has joined #openstack-keystone | 17:58 | |
| *** mhickey has quit IRC | 17:59 | |
| jmlowe | that last paste was the response to http://paste.openstack.org/show/492336/ | 17:59 |
| *** gagehugo has joined #openstack-keystone | 18:00 | |
| *** pcaruana has joined #openstack-keystone | 18:02 | |
| *** sdake has joined #openstack-keystone | 18:02 | |
| *** dflorea has quit IRC | 18:03 | |
| jmlowe | ayoung: based on those captures would you concur that the ec2 part of nova-api is choking on v3 tokens | 18:03 |
| ayoung | jmlowe, nope | 18:05 |
| ayoung | jmlowe, I think it is keystonemiddelware, not ec2 | 18:05 |
| ayoung | but to you...it would look the same | 18:05 |
| ayoung | jmlowe, there are unit tests in middleware that look like they are V2 only. I don't think middleware can handle the v3 token formate | 18:06 |
| jmlowe | <- doesn't really understand keystone middleware | 18:06 |
| *** gmmaha has left #openstack-keystone | 18:06 | |
| *** rk4n has quit IRC | 18:06 | |
| *** rk4n has joined #openstack-keystone | 18:06 | |
| *** dflorea has joined #openstack-keystone | 18:07 | |
| *** diazjf has joined #openstack-keystone | 18:07 | |
| *** sdake has quit IRC | 18:08 | |
| *** sdake_ has joined #openstack-keystone | 18:08 | |
| *** dflorea has quit IRC | 18:12 | |
| *** trown|lunch is now known as trown | 18:12 | |
| openstackgerrit | Merged openstack/keystone: Make modifications to domain config atomic https://review.openstack.org/290223 | 18:13 |
| *** e0ne has joined #openstack-keystone | 18:13 | |
| jmlowe | ayoung: maybe I have a gross conceptual error, how can it be keystone if a v3 token is returned to the requesting service, that should successfully complete the transaction no? | 18:15 |
| ayoung | jmlowe, keystonemiddleware runs in the nova server | 18:15 |
| jmlowe | gross conceptual error it is then | 18:16 |
| ayoung | jmlowe, do you have acces to the nova server? Can you look at the paste pipeline, and see what middleware filters are run? | 18:17 |
| jmlowe | I do, nova paste filters? | 18:17 |
| *** jaosorior has quit IRC | 18:18 | |
| ayoung | yep | 18:18 |
| ayoung | look in /etc/nova | 18:18 |
| ayoung | I think | 18:18 |
| jmlowe | for reference centos 7, rdo bits | 18:18 |
| ayoung | /etc/nova/api-paste.ini | 18:19 |
| morgan | samueldmq: to write the tests you need a test that migrates to 87, then changes the constraint name, then runs 88 (success); failure is migrate to 87, injects another constraint then fails to migration to 88 (fail), 96 and 101 need to migrate to N-1, inject the constraint and then migrate to N | 18:20 |
| morgan | samueldmq: they're going to be relatively ugly tests to write. | 18:20 |
| morgan | samueldmq: but def. feel free to jump on them and write them :) | 18:20 |
| jmlowe | just the ec2 parts? | 18:20 |
| jmlowe | http://paste.openstack.org/show/492341/ | 18:21 |
| samueldmq | morgan: cool, thanks for sharing the test plan | 18:21 |
| samueldmq | morgan: I am making sure I understand the issue completely, then will jump on the tests | 18:22 |
| *** e0ne has quit IRC | 18:25 | |
| *** iurygregory has quit IRC | 18:29 | |
| *** david_cu has joined #openstack-keystone | 18:30 | |
| openstackgerrit | Sean Perry proposed openstack/keystone-specs: Cleanup 'implied roles' section of Identity API V3 spec https://review.openstack.org/298925 | 18:31 |
| *** jsavak has quit IRC | 18:31 | |
| rodrigods | bknudson, ping... regarding https://review.openstack.org/#/c/294201/3/keystone/tests/unit/backend/legacy_drivers/federation/V8/api_v3.py (can we change the v8 backend method to handle the conflict?) | 18:31 |
| patchbot | rodrigods: patch 294201 - keystone - Add conflict validation for idp update | 18:31 |
| *** jsavak has joined #openstack-keystone | 18:32 | |
| *** GB21 has quit IRC | 18:35 | |
| *** iurygregory has joined #openstack-keystone | 18:37 | |
| *** e0ne has joined #openstack-keystone | 18:37 | |
| *** rk4n has quit IRC | 18:39 | |
| openstackgerrit | Merged openstack/keystone: Cleanup LDAP models https://review.openstack.org/285301 | 18:43 |
| *** david-lyle has quit IRC | 18:45 | |
| *** david-lyle has joined #openstack-keystone | 18:46 | |
| *** rderose has quit IRC | 18:55 | |
| *** e0ne has quit IRC | 18:59 | |
| ayoung | morgan, so, I think that is the general idea | 19:00 |
| ayoung | at least, in a deployment | 19:01 |
| morgan | i mean upstream | 19:01 |
| jamielennox | morgan: right, i don't know if you'd maintain it upstream though | 19:01 |
| morgan | we publish the base policy files and it can be packaged | 19:01 |
| ayoung | you would seed the repo with the policy files from the various projects, then customize | 19:01 |
| *** Guest28049 is now known as mfisch | 19:01 | |
| ayoung | and, part of that would be making the policy files consistent | 19:01 |
| *** sdake_ is now known as sdake | 19:01 | |
| ayoung | we would find that ther are common stanzas | 19:01 |
| *** mfisch is now known as Guest82454 | 19:01 | |
| ayoung | and then people are going to wanta tool (or build a tool) to generate policy files from fragments | 19:01 |
| morgan | ayoung: and it can be just installed as part of devstack or as an rpm | 19:02 |
| morgan | etc | 19:02 |
| morgan | and we just handle overrides via the CMS? | 19:02 |
| ayoung | morgan, do you remember me getting harangued about unified policy about a year ago? | 19:02 |
| morgan | ayoung: yeah. | 19:02 |
| morgan | ayoung: lets try and push on auto-gen policy [as nova asked] | 19:02 |
| morgan | with puppet | 19:02 |
| *** Guest82454 has quit IRC | 19:02 | |
| *** Guest82454 has joined #openstack-keystone | 19:02 | |
| morgan | as the deploy mechanism | 19:02 |
| ayoung | morgan, so, I'm going for "Art of the possible" here | 19:02 |
| morgan | for things. | 19:03 |
| *** Guest82454 is now known as mfisch | 19:03 | |
| jamielennox | you could even gate on that making some sort of sense | 19:03 |
| morgan | and then see about improving things for "central publish" | 19:03 |
| morgan | jamielennox: yes. | 19:03 |
| jamielennox | that policy was consistent across at least the main projects | 19:03 |
| morgan | jamielennox: that is the idea. | 19:03 |
| ayoung | morgan, I'd be interested in seeing what nova comes up with | 19:03 |
| jamielennox | i don't know if publishing makes sense | 19:03 |
| morgan | jamielennox: probably would need to be published [at least as a doc] | 19:03 |
| *** e0ne has joined #openstack-keystone | 19:03 | |
| *** e0ne has quit IRC | 19:03 | |
| jamielennox | morgan: right, but i don't see it being a repo or anything | 19:03 |
| ayoung | morgan, but, at my level, it is still an input to the config process | 19:04 |
| *** e0ne has joined #openstack-keystone | 19:04 | |
| morgan | jamielennox: depends on if you want it to be something easily consumed by <<UI/UX>> | 19:04 |
| morgan | ayoung: right. | 19:04 |
| morgan | ayoung: i think we're mostly on the same page | 19:04 |
| ayoung | morgan, so, I know that in Tripleo, I have a blank page | 19:04 |
| morgan | ayoung: i also think we made a big mistake trying to wedge things into the current keystone policy API :( | 19:04 |
| ayoung | Tripleo uses the puppet-keystone etc | 19:05 |
| *** jmlowe has quit IRC | 19:05 | |
| ayoung | and Kolla uses ansible | 19:05 |
| morgan | ayoung: so, lets start with improving CMS deploy things. | 19:05 |
| ayoung | but in both cases, they don';t have a repo of policy to pull from | 19:05 |
| morgan | ayoung: and go from there. | 19:05 |
| ayoung | morgan, I would be OK with this: | 19:05 |
| ayoung | policy is held in files in /etc/keystone/policy | 19:05 |
| ayoung | and indexed by the sha | 19:05 |
| ayoung | and then Puppet syncs from there | 19:06 |
| bknudson | rodrigods: we can change the v8 backend to raise a useful exception if the original exception was unexpected error. | 19:06 |
| morgan | in [backend], (file would be the first one) | 19:06 |
| morgan | ayoung: ++ | 19:06 |
| morgan | ayoung: i could see that | 19:06 |
| ayoung | morgan, then query is a passthrough | 19:06 |
| morgan | bknudson: ++ yeah useful exception > unexpected | 19:06 |
| ayoung | and the database stuff for assignemnt | 19:06 |
| ayoung | policy to endpoint | 19:06 |
| morgan | ayoung: which could strictly be used for UI. | 19:07 |
| ayoung | is in SQL, and, if it gets out of date...puppet could kick it | 19:07 |
| ayoung | right | 19:07 |
| rodrigods | bknudson, got it... will do that | 19:07 |
| rodrigods | thx | 19:07 |
| morgan | hmmmm... | 19:07 |
| ayoung | morgan, that works for all but initial install | 19:07 |
| *** e0ne has quit IRC | 19:07 | |
| ayoung | on an intial install, we would need to get the policy file prior to the keystone server being up.... | 19:07 |
| ayoung | hmm | 19:07 |
| *** krotscheck is now known as krotscheck_dcm | 19:07 | |
| morgan | lets talk more on the index by sha. | 19:07 |
| morgan | and how that works. | 19:07 |
| morgan | and how we get inita.. yes initial policy | 19:08 |
| ayoung | morgan, we could do the hash thing now...and we should | 19:08 |
| *** dflorea has joined #openstack-keystone | 19:08 | |
| ayoung | I have spec for that/ | 19:08 |
| morgan | ok, lets see... | 19:08 |
| morgan | oslo.policy can crunch all these things for us. | 19:08 |
| ayoung | https://review.openstack.org/#/c/297897/ | 19:08 |
| patchbot | ayoung: patch 297897 - keystone-specs - Identify Policy by Hash | 19:08 |
| *** jmlowe has joined #openstack-keystone | 19:09 | |
| morgan | so lets start with: endpoint -> policy file crunching in oslo.policy (identified by hash or not) | 19:09 |
| morgan | which could be placed anywhere [not asking for code just talking it through] | 19:10 |
| ayoung | morgan, I had the idea back when people were asking about project specific policy (about 3 years ago?) and we could even put the hash inthe token validation response if we really wanted. | 19:10 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: [WIP]Make fernet default token provider https://review.openstack.org/258650 | 19:10 |
| jamielennox | when done with this i'd like some advice on the cross project policy spec | 19:10 |
| ayoung | morgan, ok...lets start with that | 19:10 |
| ayoung | jamielennox, yes, please... | 19:10 |
| morgan | then we end up with a tool that can look at a token and policy files and know what the person can do | 19:10 |
| morgan | cool | 19:10 |
| jmlowe | ayoung: my connection has been flapping, was that paste sufficient or did you want to see more? | 19:10 |
| *** doug-fis_ has joined #openstack-keystone | 19:10 | |
| ayoung | morgan, we have a tool that can do it given the JSON now | 19:10 |
| morgan | right | 19:11 |
| ayoung | jmlowe, I'm on other issues ATM | 19:11 |
| morgan | but it's cli iirc not method things | 19:11 |
| raildo | ayoung: lbragstad ^ only 6 failed tests :) | 19:11 |
| morgan | but anyway | 19:11 |
| ayoung | morgan, hosting that CLI somewhere is easyish | 19:11 |
| morgan | thats fine. | 19:11 |
| ayoung | morgan, the issue is getting that pesky mountainto mohammad | 19:11 |
| ayoung | Or, in this case, collecting the policy files | 19:11 |
| morgan | we're back to the hard part of policy files collected | 19:11 |
| *** nisha__ has quit IRC | 19:12 | |
| jmlowe | ayoung: ack, didn't want to miss something, my connection is comcastic! | 19:12 |
| *** raildo is now known as raildo-afk | 19:12 | |
| *** pauloewerton has quit IRC | 19:12 | |
| *** real56 has quit IRC | 19:12 | |
| ayoung | morgan, so, we can, I think, have puppet do the heavy lifting | 19:12 |
| *** dflorea has quit IRC | 19:12 | |
| *** doug-fish has quit IRC | 19:12 | |
| morgan | ok i think we're being silly actually | 19:13 |
| ayoung | in an intial instll, puppet could pull the files from the RPM locations and stick them in Keystone around when it creates the initial service entry | 19:13 |
| morgan | initial install we don't care about | 19:13 |
| morgan | except for keystone. | 19:13 |
| ayoung | morgan, I do | 19:13 |
| morgan | no, you don't. ;) | 19:13 |
| ayoung | morgan, I have to make this workwith Tripleo | 19:13 |
| morgan | hold on | 19:13 |
| ayoung | morgan, I do in my day job | 19:13 |
| morgan | hold up! :) | 19:13 |
| *** akscram has quit IRC | 19:14 | |
| morgan | intiall install is no different EXCEPT in the keystone phase | 19:14 |
| morgan | for bootstrapping | 19:14 |
| ayoung | OK. | 19:14 |
| morgan | treat it all 100% the same. | 19:14 |
| morgan | adding a nova node is adding a nova node is adding a nova node | 19:14 |
| ayoung | you mean Keystone bootstrap has to do something | 19:14 |
| ayoung | becaue we need a policy file before we cando anything with keystone? | 19:14 |
| morgan | right | 19:14 |
| morgan | keystone can't do things past keystone-bootstrap without a policy file | 19:15 |
| morgan | once we have that bit done, it's all 100% the same no matter what we're doing | 19:15 |
| jamielennox | why is that different to any other service? | 19:15 |
| morgan | add another nova api, add a cinder api, add a glance api | 19:15 |
| *** akscram has joined #openstack-keystone | 19:15 | |
| ayoung | jamielennox, only if Keystone is the system of record | 19:15 |
| morgan | we process it the same way in initial setup as if you were expanding. | 19:15 |
| ayoung | jamielennox, if Nova needs a policy file from Keystone,no problem | 19:15 |
| morgan | so your CMS would do the lifting | 19:15 |
| ayoung | if Keystone needs a policy file from keystone and keystone is not running...bootstrap | 19:16 |
| morgan | it's not even forcing keystone to be the system of record | 19:16 |
| ayoung | morgan, so, what if a deployer wants to customize policy for one endpoint? | 19:16 |
| ayoung | I would thinkg it would be: | 19:16 |
| ayoung | uploade to keystone, | 19:16 |
| ayoung | set the endpoijnt-poicy mapping | 19:16 |
| jamielennox | i missed the bit where we went back to keystone maintaining these | 19:16 |
| ayoung | and then tell puppet resync | 19:17 |
| morgan | jamielennox: i'm trying to avoid that | 19:17 |
| jamielennox | right - so why is keystone different | 19:17 |
| ayoung | jamielennox, so, if it is not Keystone, it is going to be a repo that does what Keystone does | 19:17 |
| morgan | ayoung: or - update policy for endpoint, puppet does sync (to keystone and to endpoint) | 19:17 |
| morgan | jamielennox: only ebcause keystone has a naieve bootstrap step | 19:17 |
| morgan | jamielennox: you can't have a rich policy file with bootstrap today (in most cases) | 19:17 |
| jamielennox | that gets you around policy | 19:18 |
| morgan | jamielennox: so you need bootstrap - + minor things / config, then rich policy | 19:18 |
| ayoung | morgan, right. So, in tripleo terms, we would stage the policy to a directory on the undercloud | 19:18 |
| ayoung | morgan, and, actually, I have a services guy who built something like that with SSH for the sync | 19:19 |
| morgan | jamielennox: long term, bootstrap will become smart enough to not need the slightly more wiggle room | 19:19 |
| samueldmq | morgan: re: patch 298402 | 19:19 |
| patchbot | samueldmq: https://review.openstack.org/#/c/298402/ - keystone - Correct `role_name` constraint dropping | 19:19 |
| morgan | ayoung: now you're getting it. | 19:19 |
| jamielennox | morgan: what's in your wriggle room? | 19:19 |
| samueldmq | morgan: why do we need both 96 and 101 ? | 19:19 |
| ayoung | morgan, nah, I knew that was an option | 19:19 |
| samueldmq | morgan: you may end this convo first :) | 19:19 |
| morgan | jamielennox: mostly setup of any extra domains/etc | 19:19 |
| morgan | jamielennox: that are needed for your "rich" policy | 19:19 |
| jamielennox | as i see it you deploy with rich policy immediately, your rich policy should support what is being bootstrapped | 19:20 |
| jamielennox | bootstrap itself is not affected by policy | 19:20 |
| morgan | jamielennox: except bootstrap is super super naieve | 19:20 |
| morgan | jamielennox: we need to improve bootstrap some more for that. that is all | 19:20 |
| morgan | jamielennox: i expect initally we will have a slightly different method for keystone and it'll become more streamlined as we improve this policy story | 19:20 |
| morgan | so we support the cases we need to support to be flexible enough for rich policy options | 19:21 |
| morgan | it's a chicken-egg scenario, and i'd rather err on the side of "good user story" vs "wedging the user story into what we implemented" on the policy ditribution | 19:21 |
| morgan | samueldmq: 96 is in case someone "fixed" the db or the migraton [we have at least one person who has done it] | 19:22 |
| morgan | samueldmq: and 101 is if they have used the "placeholder" migration already in their deployment | 19:22 |
| *** timcline has quit IRC | 19:22 | |
| morgan | samueldmq: so if they are already past 96 because theyt're running newton things, we need to still apply the "fix" logic to make sure only one constraint (domain_id, name) is in place | 19:23 |
| *** timcline has joined #openstack-keystone | 19:23 | |
| *** ericksonsantos has quit IRC | 19:23 | |
| morgan | anyway i need to drop off for a bit | 19:23 |
| ayoung | morgan, jamielennox so the short is that I need to build something for Tripleo | 19:24 |
| ayoung | either something specific to it, or something within the domain of Keystone | 19:24 |
| *** iurygregory has quit IRC | 19:24 | |
| *** nisha has joined #openstack-keystone | 19:24 | |
| samueldmq | morgan: how are they supposed to use the placehold migration? | 19:24 |
| samueldmq | morgan: I thought that was only reserved for backports ? | 19:25 |
| morgan | samueldmq: this is a backport | 19:25 |
| morgan | we already cut the branch | 19:25 |
| morgan | the only weird part here is 88 is also being "fixed" | 19:25 |
| jamielennox | ayoung: and tripleo is doing pre-baked images of the controller nodes right? | 19:25 |
| ayoung | jamielennox, no | 19:26 |
| samueldmq | morgan: yes, do we really need to fix it too? | 19:26 |
| morgan | samueldmq: so look at it like 101 is the "fix", 96 is the backport, and 88 is a "make sure we don't break people going forward" | 19:26 |
| ayoung | jamielennox, its stll building them at some point | 19:26 |
| morgan | samueldmq: yes we do. | 19:26 |
| morgan | if we hadn't cut the branch yet, this would have been easier | 19:26 |
| ayoung | jamielennox, and...if policy is done in Puppet, we need to change each and every puppet module | 19:26 |
| samueldmq | morgan: I got it | 19:26 |
| morgan | samueldmq: a deployment can fail migration 88, so we fix it | 19:26 |
| jamielennox | ayoung: ah, yea, sorry i mispoke | 19:26 |
| *** roxanaghe has joined #openstack-keystone | 19:26 | |
| ayoung | however, if we did it dynamcially, we still need to tweak something | 19:26 |
| morgan | samueldmq: a deployment may have "fixed" the migration in the wrong way, so we supply 96 [mitaka] | 19:27 |
| samueldmq | morgan: 101 and 96 is fix who is broken | 19:27 |
| jamielennox | ayoung: and puppet is building the images | 19:27 |
| morgan | samueldmq: and 101 is fixing people on master | 19:27 |
| ayoung | I was hoping to have it down to "drop this URL into the auth_token section" | 19:27 |
| samueldmq | morgan: 88 is dont let other get broken | 19:27 |
| morgan | samueldmq: yep | 19:27 |
| samueldmq | morgan: people on master don't get the placeholders right? | 19:27 |
| morgan | samueldmq: they have already run them | 19:27 |
| samueldmq | morgan: it's like they've already run the 96 | 19:27 |
| morgan | right | 19:27 |
| samueldmq | morgan: kk got it | 19:28 |
| morgan | they have run the no-op 96 | 19:28 |
| *** timcline has quit IRC | 19:28 | |
| morgan | and therefore can't run it again | 19:28 |
| morgan | (ok ok shouldn't run it again) | 19:28 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add conflict validation for idp update https://review.openstack.org/294201 | 19:28 |
| ayoung | jamielennox, I think that an image can be updated after deploy anyway, as it is just a VM, and running openstack overcloud deploy would repply any cahnges | 19:28 |
| ayoung | changes | 19:28 |
| jamielennox | yea, it just means you can't override the puppet, from an ansible perspective i think you can create a new template at a higher level and it would be taken in preference | 19:29 |
| *** rk4n has joined #openstack-keystone | 19:30 | |
| ayoung | jamielennox, I asked the Kolla folks. You need to restart the container for them. | 19:30 |
| ayoung | jamielennox, ah, ansible, I think we could pull from a user defined repo | 19:30 |
| jamielennox | ayoung: i'd expect you need to rebuild the container from them | 19:30 |
| ayoung | I would probably have Ansible populate the repo | 19:30 |
| *** nisha has quit IRC | 19:30 | |
| ayoung | jamielennox, its not a complete rebuild...they seemed to think it was pretty light | 19:30 |
| ayoung | jamielennox, anyway, that is another argument in favor of let the CMS handle it | 19:31 |
| ayoung | not sure what would happen in a container based deploy with a file change | 19:31 |
| *** roxanaghe has quit IRC | 19:31 | |
| *** jmlowe has quit IRC | 19:31 | |
| *** jsavak has quit IRC | 19:32 | |
| *** mylu has joined #openstack-keystone | 19:32 | |
| *** jmlowe has joined #openstack-keystone | 19:32 | |
| *** mylu has quit IRC | 19:33 | |
| ayoung | jamielennox, so, in ansible, I can totally see how to drive the policy from the Keystone database. I'm less clear in the Puppet case, but I am sure I can make it happen. | 19:37 |
| *** daemontool has joined #openstack-keystone | 19:38 | |
| ayoung | jamielennox, want to talk about your crossproject spec now? | 19:38 |
| ayoung | or do you need to go back to sleep? | 19:38 |
| jamielennox | ayoung: heh, both | 19:39 |
| jamielennox | just noticed some project-config stuff merged so was looking at conflicts there | 19:39 |
| jamielennox | https://review.openstack.org/#/c/245629/ | 19:39 |
| patchbot | jamielennox: patch 245629 - openstack-specs - A common policy scenario across all projects | 19:39 |
| jamielennox | ayoung, morgan, stevemar, bknudson et al | 19:40 |
| jamielennox | i'm basically coming down to do i want to strip out the project- parts of this and let the admin_project check do that work | 19:40 |
| jamielennox | it didn't exist at the time of first writing but i've come around to it | 19:41 |
| jamielennox | if we assume deploys are using the admin_project flag in policy then i don't need to worry about distinguishing between the admin-observer and the project-observer | 19:42 |
| jamielennox | we just define an observer role and use the is_admin_project to handle the rest | 19:42 |
| ayoung | jamielennox, you mean is_admin_project? | 19:42 |
| ayoung | yep | 19:42 |
| jamielennox | which turns it into a really short spec involving like 3 roles | 19:42 |
| ayoung | jamielennox, so as an aside, need to get that enforceable...I thought oslo-context was sufficient | 19:42 |
| ayoung | but bknudson had a comment that each of the projects reimplemtns | 19:43 |
| ayoung | jamielennox, I like that | 19:43 |
| jamielennox | as i think we are ditching '{service_type}_{api_capability}' roles | 19:43 |
| ayoung | jamielennox, so, one aspect I've seen that people want to be able to tune is neutron | 19:43 |
| ayoung | some place want member to be able to make changes there, some don't | 19:43 |
| jamielennox | ayoung: yea, i was working on a new version and it just seemed redundant having both and the is_admin_project | 19:43 |
| morgan | bknudson: shouldn't the opportunistic testing use pymysql? | 19:44 |
| jamielennox | the problem is i'm not sure how far people have made it enforcable | 19:44 |
| morgan | bknudson: +2/+A on your patch anyway.. but we can revisit mysql vs pymysql as needed | 19:44 |
| ayoung | jamielennox, I think that we make this spec depend on that being enfroceable | 19:44 |
| jamielennox | ayoung: it would simplify it a lo t | 19:44 |
| ayoung | instead of trying to duplicate effort | 19:44 |
| *** mylu has joined #openstack-keystone | 19:44 | |
| jamielennox | i need to have a look at who else is using the is_admin_project flag | 19:45 |
| bknudson | morgan: there's other fixes that have to merge first | 19:45 |
| *** raildo-afk is now known as raildo | 19:45 | |
| *** dflorea has joined #openstack-keystone | 19:45 | |
| morgan | bknudson: ah | 19:45 |
| ayoung | ok so the general divide is "can a Member do this, or should they be a project-admin" on any given api | 19:45 |
| morgan | bknudson: yeah doing the chain now. | 19:45 |
| bknudson | morgan: oslo.db does PyMySQL -- http://git.openstack.org/cgit/openstack/oslo.db/tree/setup.cfg#n21 | 19:45 |
| ayoung | andthen for the more sensitive APIs, reserve it for is_admin_project but the distinctio nstill applies | 19:46 |
| morgan | right but your test requirements were mysql? | 19:46 |
| jamielennox | ayoung: more or less, there's some observer stuff and {service_type)_admin but that's pretty easy | 19:46 |
| jamielennox | right | 19:46 |
| jamielennox | the problem is only then on services that don't use is_admin_project because we've made 3 more global roles | 19:46 |
| bknudson | morgan: oslo.db[mysql] will bring in PyMySQL>=0.6.2 | 19:46 |
| ayoung | ok...so basic roles are admin, member, observer. Assuming is_admin_project is enforces | 19:46 |
| morgan | bknudson: aahhh | 19:46 |
| morgan | ok | 19:47 |
| ayoung | and service_admin for the one offs? | 19:47 |
| morgan | anyway the chian should be all +2/+A now | 19:47 |
| bknudson | I didn't look at mysql-c ... if that's even a db that infra installs. | 19:47 |
| jamielennox | ayoung: service_observer as well, but they are both really easy because you put them in a rule up top of a policy file | 19:47 |
| bknudson | well, I guess the db would be there, but I didn't see that oslo.db has a fixture for it. | 19:47 |
| jamielennox | like admin = role:admin or role:identity_admin -- in the correct syntax | 19:47 |
| morgan | yeah | 19:48 |
| ayoung | jamielennox, or implied roles | 19:48 |
| morgan | ok anyway | 19:48 |
| morgan | bouncing out for a bit to deal with things. | 19:48 |
| ayoung | lets try to keep the policy files as simple as possible | 19:48 |
| jamielennox | ayoung: maybe, not sure how that would interact with a default policy | 19:48 |
| jamielennox | but it won't hurt | 19:48 |
| jamielennox | you'll just end up with both roles | 19:49 |
| ayoung | jamielennox, so, admin implies member, membver implies observer | 19:49 |
| ayoung | that is the basic one | 19:49 |
| ayoung | service_admin is its own thing, I think | 19:49 |
| ayoung | we could do admin implies service admin, but then that muddies things for the projects | 19:50 |
| jamielennox | ayoung: i think for the policy files i would still need to write it out | 19:50 |
| ayoung | jamielennox, why? | 19:50 |
| ayoung | this is exactly what implied roles are for | 19:50 |
| ayoung | you specify the lowest role needed to perform the operation | 19:50 |
| ayoung | let implied roles fill in the links from the users actual role assignment | 19:51 |
| jamielennox | wouldn't it cut out anyone with an existing setup | 19:51 |
| ayoung | jamielennox, getting default implied roles would be part of your spec | 19:51 |
| jamielennox | ayoung: whoa, i can barely get this passed and i want to create a role that everyone is asking for | 19:51 |
| ayoung | jamielennox, we are looking to define the basic set of roles | 19:52 |
| ayoung | implied roles is already merged | 19:52 |
| ayoung | getting the basic set of roles defined should include the inference rules | 19:52 |
| jamielennox | i think implied roles helps here but i'm not concerned if it requires doing conditionals in the policy files | 19:52 |
| ayoung | no conditionals required | 19:53 |
| ayoung | policy file just specifies the lowest rule on the chain. Period | 19:53 |
| ayoung | so if it I need observer, and I have member, it will work | 19:53 |
| jamielennox | ok, it is simpler, i'll do it that way and see if i get push back | 19:54 |
| ayoung | because member implies observer, and that ends up in the token | 19:54 |
| ayoung | jamielennox, the question is whether there are more granular roles than those three that people need. | 19:55 |
| *** sdake_ has joined #openstack-keystone | 19:55 | |
| jamielennox | any way, that was essentially what i was thinking i needed to remove the admin/project specific roles and use is_admin_project i just wanted to make sure it made sense | 19:55 |
| jamielennox | ayoung: i bet there are, but i want to pass something to at least get the services who do nothing up to scratch | 19:55 |
| jamielennox | ayoung: we can increment it from there | 19:56 |
| ayoung | jamielennox, ++ I'm with you | 19:56 |
| *** sheel has quit IRC | 19:57 | |
| *** dflorea has quit IRC | 19:57 | |
| *** sdake has quit IRC | 19:58 | |
| samueldmq | all keystone config options are in common/config.py right ? | 20:00 |
| *** iurygregory has joined #openstack-keystone | 20:00 | |
| *** dflorea has joined #openstack-keystone | 20:01 | |
| *** dflorea has quit IRC | 20:01 | |
| *** gokrokve has joined #openstack-keystone | 20:02 | |
| *** sdake_ is now known as sdake | 20:02 | |
| *** rderose has joined #openstack-keystone | 20:07 | |
| *** gokrokve has quit IRC | 20:08 | |
| *** dflorea has joined #openstack-keystone | 20:08 | |
| *** slberger has quit IRC | 20:11 | |
| *** slberger has joined #openstack-keystone | 20:12 | |
| *** dflorea has quit IRC | 20:12 | |
| *** jsavak has joined #openstack-keystone | 20:13 | |
| ayoung | samueldmq, yes | 20:13 |
| ayoung | samueldmq, at one point, we flirted with moving extension configs into the extensions/. That never happened, and we rolled extensions into main anyhow | 20:14 |
| *** ericksonsantos has joined #openstack-keystone | 20:19 | |
| samueldmq | ayoung: ++ | 20:20 |
| samueldmq | morgan: stevemar: we are officially in newton right? so patch 298402 is officially going on newton | 20:22 |
| patchbot | samueldmq: https://review.openstack.org/#/c/298402/ - keystone - Correct `role_name` constraint dropping | 20:22 |
| samueldmq | only the backports (to be submitted) will apply to mitaka | 20:22 |
| morgan | samueldmq: yes | 20:22 |
| samueldmq | morgan: ++ | 20:22 |
| morgan | samueldmq: there is a cherry pick of that proposed to stable/mitaka already | 20:22 |
| samueldmq | morgan: nice | 20:23 |
| *** timcline has joined #openstack-keystone | 20:23 | |
| samueldmq | morgan: I see it now | 20:23 |
| *** timcline has quit IRC | 20:23 | |
| stevemar | samueldmq: what morgan said | 20:23 |
| *** timcline has joined #openstack-keystone | 20:24 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Cleaning up identity.core https://review.openstack.org/296140 | 20:26 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Remove backend interface and common code out of identity.core https://review.openstack.org/296140 | 20:29 |
| *** gokrokve has joined #openstack-keystone | 20:29 | |
| tjcocozz | Has anyone had any problems when running tox -e debug and it gets stuck on installing deps? | 20:30 |
| *** diazjf has quit IRC | 20:30 | |
| tjcocozz | for some reason it is only working when i install dependecies with sudo... It gets stuck trying to install oslo.service. | 20:30 |
| *** diazjf has joined #openstack-keystone | 20:32 | |
| tjcocozz | I will take the silence as, “I am the only one facing this problem” :P | 20:32 |
| *** gyee has joined #openstack-keystone | 20:32 | |
| *** ChanServ sets mode: +v gyee | 20:32 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Random project should return positive numbers https://review.openstack.org/298970 | 20:34 |
| *** gokrokve has quit IRC | 20:34 | |
| *** dflorea has joined #openstack-keystone | 20:35 | |
| *** slberger has quit IRC | 20:36 | |
| knikolla | tjcocozz, try removing the .tox folder and try again | 20:36 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 20:37 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 20:37 | |
| tjcocozz | knikolla, tried that, and tried delete my venv too. Happens in py27 and debug | 20:37 |
| *** dflorea has quit IRC | 20:39 | |
| *** dflorea has joined #openstack-keystone | 20:39 | |
| *** slberger has joined #openstack-keystone | 20:39 | |
| samueldmq | morgan: not sure how we can test 96 and 101, since to get there we need to run 88 anyways | 20:45 |
| samueldmq | :-) | 20:45 |
| morgan | You need to inject the constraint again after 88 | 20:46 |
| bknudson | samueldmq: the unit test can make changes to the schema. | 20:46 |
| *** raildo is now known as raildo-afk | 20:47 | |
| *** gokrokve has joined #openstack-keystone | 20:48 | |
| samueldmq | morgan: bknudson: got it | 20:49 |
| *** ayoung has quit IRC | 20:54 | |
| *** dflorea has quit IRC | 20:54 | |
| *** agrebennikov has quit IRC | 20:55 | |
| *** ebalduf_ has quit IRC | 20:57 | |
| *** gagehugo has quit IRC | 21:00 | |
| *** dflorea has joined #openstack-keystone | 21:01 | |
| *** ebalduf has joined #openstack-keystone | 21:03 | |
| samueldmq | from the cp-meeting | 21:06 |
| samueldmq | dhellmann | for newton, all official project teams will use the openstack/releases repo to request and document releases | 21:06 |
| samueldmq | cc stevemar ^ | 21:06 |
| *** ninag has quit IRC | 21:06 | |
| samueldmq | just in the case we're not doing it yet ^ | 21:06 |
| dhellmann | samueldmq : you can see if I had to make any changes to acls for keystone deliverables by looking at https://review.openstack.org/298866 | 21:06 |
| *** trown is now known as trown|outtypewww | 21:07 | |
| samueldmq | dhellmann: ++ thanks | 21:08 |
| *** rk4n has quit IRC | 21:08 | |
| samueldmq | dhellmann: where may I check if we had more than one release liason for keystone in Mitaka ? | 21:08 |
| samueldmq | dhellmann: to check if we need to fix it | 21:09 |
| dhellmann | samueldmq : that wasn't a problem for keystone | 21:09 |
| samueldmq | dhellmann: perfect, just checking | 21:10 |
| samueldmq | dhellmann: thanks | 21:10 |
| *** agrebennikov has joined #openstack-keystone | 21:10 | |
| *** edmondsw has quit IRC | 21:12 | |
| *** mhickey has joined #openstack-keystone | 21:15 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Remove backend interface and common code out of identity.core https://review.openstack.org/296140 | 21:20 |
| *** rk4n has joined #openstack-keystone | 21:23 | |
| *** dflorea has quit IRC | 21:26 | |
| *** dflorea has joined #openstack-keystone | 21:27 | |
| *** diazjf has quit IRC | 21:29 | |
| *** jaugustine has quit IRC | 21:30 | |
| *** mhickey has quit IRC | 21:31 | |
| *** sdake_ has joined #openstack-keystone | 21:35 | |
| *** ebalduf has quit IRC | 21:36 | |
| *** sdake has quit IRC | 21:38 | |
| *** knikolla has quit IRC | 21:43 | |
| *** fawadkhaliq has joined #openstack-keystone | 21:44 | |
| *** dflorea has quit IRC | 21:46 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:47 | |
| *** ayoung has joined #openstack-keystone | 21:48 | |
| *** ChanServ sets mode: +v ayoung | 21:48 | |
| *** mylu has quit IRC | 21:49 | |
| *** mylu has joined #openstack-keystone | 21:50 | |
| *** dflorea has joined #openstack-keystone | 21:52 | |
| *** dflorea has quit IRC | 21:57 | |
| *** jsavak has quit IRC | 21:59 | |
| *** ninag has joined #openstack-keystone | 22:00 | |
| *** fawadkhaliq has quit IRC | 22:01 | |
| *** gokrokve has quit IRC | 22:01 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:02 | |
| *** gokrokve has joined #openstack-keystone | 22:02 | |
| stevemar | samueldmq: thanks for looking at it, i think we're good for release stuff for now, all our projects should be set up | 22:04 |
| *** dflorea has joined #openstack-keystone | 22:05 | |
| *** daemontool has quit IRC | 22:05 | |
| *** diazjf has joined #openstack-keystone | 22:06 | |
| samueldmq | stevemar: sure, just making sure to share the info from cp-meeting :) | 22:06 |
| stevemar | ;) | 22:06 |
| *** gokrokve has quit IRC | 22:07 | |
| *** gokrokve has joined #openstack-keystone | 22:07 | |
| *** david_cu has quit IRC | 22:08 | |
| *** diazjf has quit IRC | 22:09 | |
| *** bjornar has quit IRC | 22:12 | |
| *** mylu has quit IRC | 22:12 | |
| *** dflorea has quit IRC | 22:12 | |
| *** markvoelker has joined #openstack-keystone | 22:13 | |
| *** ametts_ has quit IRC | 22:15 | |
| *** dflorea has joined #openstack-keystone | 22:15 | |
| *** roxanaghe has joined #openstack-keystone | 22:15 | |
| *** fawadkhaliq has quit IRC | 22:15 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:16 | |
| *** diazjf has joined #openstack-keystone | 22:17 | |
| *** diazjf has quit IRC | 22:18 | |
| *** mylu has joined #openstack-keystone | 22:19 | |
| *** slberger has left #openstack-keystone | 22:19 | |
| *** roxanaghe has quit IRC | 22:19 | |
| *** mylu has quit IRC | 22:20 | |
| *** markvoelker has quit IRC | 22:20 | |
| *** markvoelker has joined #openstack-keystone | 22:21 | |
| *** diazjf has joined #openstack-keystone | 22:21 | |
| *** markvoelker_ has joined #openstack-keystone | 22:22 | |
| *** diazjf has quit IRC | 22:22 | |
| *** dflorea has quit IRC | 22:23 | |
| *** markvoelker has quit IRC | 22:26 | |
| *** sdake has joined #openstack-keystone | 22:26 | |
| *** sdake_ has quit IRC | 22:28 | |
| samueldmq | morgan: I am finding something weird while creating the test | 22:32 |
| samueldmq | http://paste.openstack.org/show/492372/ | 22:32 |
| samueldmq | this code works, that means that the name constraint hasn't been dropped after upgrading to 88 | 22:32 |
| morgan | I'll look in a few. | 22:33 |
| *** mylu has joined #openstack-keystone | 22:33 | |
| samueldmq | morgan: also, not sure I am supposed to change the constraint name that way | 22:34 |
| samueldmq | morgan: whevener you can :) | 22:34 |
| *** mylu has quit IRC | 22:34 | |
| samueldmq | ah, and that test is in test_sql_upgrade | 22:36 |
| *** ninag has quit IRC | 22:38 | |
| *** markvoelker_ has quit IRC | 22:39 | |
| *** ninag has joined #openstack-keystone | 22:41 | |
| *** ninag has quit IRC | 22:41 | |
| *** mylu has joined #openstack-keystone | 22:41 | |
| *** fawadkhaliq has quit IRC | 22:44 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:44 | |
| *** fawadkhaliq has quit IRC | 22:46 | |
| *** gordc has quit IRC | 22:51 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:52 | |
| *** rk4n has quit IRC | 22:54 | |
| *** dflorea has joined #openstack-keystone | 22:54 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Remove backend interface out of assignment.core https://review.openstack.org/299018 | 22:56 |
| *** dflorea has quit IRC | 22:57 | |
| *** timcline has quit IRC | 22:59 | |
| *** timcline has joined #openstack-keystone | 22:59 | |
| *** rderose has quit IRC | 23:00 | |
| *** dflorea has joined #openstack-keystone | 23:00 | |
| *** timcline has quit IRC | 23:04 | |
| *** gokrokve has quit IRC | 23:07 | |
| *** timcline has joined #openstack-keystone | 23:10 | |
| *** jorge_munoz has quit IRC | 23:15 | |
| *** dpippenger has quit IRC | 23:18 | |
| *** fawadkhaliq has quit IRC | 23:18 | |
| *** fawadkhaliq has joined #openstack-keystone | 23:20 | |
| *** fawadkhaliq has quit IRC | 23:22 | |
| *** rdo has quit IRC | 23:25 | |
| *** mylu has quit IRC | 23:28 | |
| *** gokrokve has joined #openstack-keystone | 23:33 | |
| *** rdo has joined #openstack-keystone | 23:33 | |
| *** gokrokve has quit IRC | 23:37 | |
| *** fawadkhaliq has joined #openstack-keystone | 23:41 | |
| *** gokrokve has joined #openstack-keystone | 23:41 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Improve error message for schema validation https://review.openstack.org/299036 | 23:43 |
| *** timcline has quit IRC | 23:43 | |
| *** sdake has quit IRC | 23:43 | |
| *** sdake has joined #openstack-keystone | 23:44 | |
| *** sdake has quit IRC | 23:44 | |
| *** sdake has joined #openstack-keystone | 23:44 | |
| *** pushkaru has quit IRC | 23:50 | |
| *** gokrokve has quit IRC | 23:55 | |
| *** dflorea has quit IRC | 23:55 | |
| *** mylu has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!