| *** marg7175 has joined #openstack-keystone | 00:10 | |
| *** tqtran has quit IRC | 00:13 | |
| *** stingaci has quit IRC | 00:19 | |
| *** roxanaghe has quit IRC | 00:28 | |
| *** sdake has joined #openstack-keystone | 00:32 | |
| *** sdake_ has quit IRC | 00:34 | |
| *** lhcheng has quit IRC | 00:42 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes bug where the updated federated display_name is not getting returned https://review.openstack.org/301987 | 00:43 |
|---|---|---|
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes bug where the updated federated display_name is not returned https://review.openstack.org/301987 | 00:45 |
| *** dflorea has quit IRC | 00:46 | |
| *** dave-mcc_ has joined #openstack-keystone | 00:50 | |
| *** sdake_ has joined #openstack-keystone | 00:51 | |
| *** sdake has quit IRC | 00:51 | |
| *** dave-mccowan has quit IRC | 00:51 | |
| rderose_ | stevemar dolphm breton: fixed bug where updated display_name wasn't being returned: https://review.openstack.org/#/c/301987/ | 00:52 |
| patchbot | rderose_: patch 301987 - keystone - Fixes bug where the updated federated display_name... | 00:52 |
| rderose_ | breton: thanks for catching these 2 bugs; can't believe I missed that first one | 00:52 |
| *** rderose_ has quit IRC | 00:54 | |
| *** knikolla has quit IRC | 00:56 | |
| *** mylu has quit IRC | 01:03 | |
| *** roxanaghe has joined #openstack-keystone | 01:07 | |
| *** zzzeek_ has quit IRC | 01:10 | |
| *** roxanaghe has quit IRC | 01:12 | |
| *** zzzeek has joined #openstack-keystone | 01:13 | |
| *** wxy has joined #openstack-keystone | 01:20 | |
| *** lhcheng has joined #openstack-keystone | 01:23 | |
| *** ChanServ sets mode: +v lhcheng | 01:23 | |
| *** lhcheng_ has joined #openstack-keystone | 01:24 | |
| *** lhcheng has quit IRC | 01:24 | |
| *** spandhe has quit IRC | 01:26 | |
| *** EinstCrazy has joined #openstack-keystone | 01:34 | |
| *** mylu has joined #openstack-keystone | 01:38 | |
| *** jamielennox is now known as jamielennox|away | 01:43 | |
| *** marg7175 has quit IRC | 01:47 | |
| *** woodster_ has quit IRC | 01:47 | |
| *** jamielennox|away is now known as jamielennox | 01:53 | |
| *** sdake has joined #openstack-keystone | 01:55 | |
| *** sdake_ has quit IRC | 01:56 | |
| *** EinstCra_ has joined #openstack-keystone | 02:01 | |
| *** lhcheng_ has quit IRC | 02:01 | |
| *** EinstCrazy has quit IRC | 02:04 | |
| *** mylu has quit IRC | 02:16 | |
| *** mylu has joined #openstack-keystone | 02:18 | |
| *** spandhe has joined #openstack-keystone | 02:19 | |
| stevemar | mfisch: dolphm normally the CVE / OSSN has references to the commits/ changes no? | 02:19 |
| *** zzzeek has quit IRC | 02:21 | |
| *** zzzeek has joined #openstack-keystone | 02:23 | |
| *** stingaci has joined #openstack-keystone | 02:28 | |
| *** marg7175 has joined #openstack-keystone | 02:29 | |
| *** edmondsw has quit IRC | 02:29 | |
| *** lhcheng has joined #openstack-keystone | 02:30 | |
| *** ChanServ sets mode: +v lhcheng | 02:30 | |
| *** lhcheng has quit IRC | 02:30 | |
| *** lhcheng has joined #openstack-keystone | 02:30 | |
| *** ChanServ sets mode: +v lhcheng | 02:30 | |
| *** spandhe_ has joined #openstack-keystone | 02:38 | |
| *** spandhe has quit IRC | 02:40 | |
| *** spandhe_ is now known as spandhe | 02:40 | |
| *** tobe has joined #openstack-keystone | 02:42 | |
| *** tobe has quit IRC | 02:42 | |
| *** richm has quit IRC | 02:43 | |
| *** mylu has quit IRC | 02:44 | |
| *** mylu has joined #openstack-keystone | 02:49 | |
| mfisch | lbragstad: you here? | 02:52 |
| *** zqfan has joined #openstack-keystone | 02:53 | |
| lbragstad | mfisch yo | 02:54 |
| mfisch | lbragstad: so sometime between our old code and stable/L the token format changed | 02:54 |
| mfisch | you remember that discussion we had on the old token | 02:54 |
| mfisch | "old" tokens had a %3D at the end | 02:54 |
| mfisch | and if you pass that into Stable/L it throws an exception and returns 500 | 02:54 |
| mfisch | it seems that for some reason some of my services dont like that | 02:55 |
| lbragstad | mfisch ah - we made it so that there is no padding returned on tokens | 02:55 |
| mfisch | padded tokens not throwing 500 would be nice, throwing 401 would be better | 02:55 |
| lbragstad | in mitaka | 02:55 |
| mfisch | its in stable/liberty | 02:55 |
| mfisch | also | 02:55 |
| lbragstad | a token from mitaka doesn't get validated on liberty | 02:56 |
| lbragstad | right? | 02:56 |
| lbragstad | cc dolphm ^ | 02:56 |
| lbragstad | I thought we had fixes for taht | 02:56 |
| mfisch | sorry you're off by 1 | 02:56 |
| mfisch | kilo fernet on stable/L | 02:56 |
| mfisch | == 500 | 02:56 |
| lbragstad | oh | 02:56 |
| lbragstad | what about mitaka and l? | 02:56 |
| lbragstad | liberty*? | 02:56 |
| mfisch | I just deployed stable/lib tonight like 5 min ago dont get ahead of me ;) | 02:57 |
| lbragstad | :) | 02:57 |
| lbragstad | ok - I'm pretty sure we made sure that tokens would be compatible between liberty and mitaka | 02:57 |
| mfisch | yeah I hope so | 02:58 |
| mfisch | I'm about to promise no token format changes anymore in an email to my whole team | 02:58 |
| ayoung | mfisch, fernet is it. I will not support another token change. | 02:58 |
| lbragstad | hah | 02:58 |
| lbragstad | *iff* we do another change - it has to be one named after a better booze | 02:59 |
| ayoung | lbragstad, nope. If we do anything, we go tokenless | 02:59 |
| ayoung | Fernet is the last token format. | 02:59 |
| lbragstad | ayoung I'd be in favor of that | 03:00 |
| mfisch | can we call it bourbon | 03:00 |
| mfisch | dont change fernet either by messing with padding | 03:00 |
| ayoung | mfisch, tokens are dumb. | 03:00 |
| mfisch | oh mean I need booze for this | 03:00 |
| ayoung | mfisch, MacAllans waiting for me upstairs | 03:01 |
| mfisch | I have GlenMorangie | 03:01 |
| ayoung | NIce | 03:01 |
| *** sdake_ has joined #openstack-keystone | 03:01 | |
| lbragstad | I have some listerine? | 03:01 |
| mfisch | whatever gets you though that Minnesota winter | 03:02 |
| ayoung | Actually,, I lied. I killed the MacAllans...think what I actually have is Glenfiddich? | 03:02 |
| *** dan_nguyen has quit IRC | 03:02 | |
| ayoung | Twas Glenlivet. And now it is sitting next to me in a glass as I try to learn more Rust | 03:03 |
| mfisch | ps4 for me | 03:03 |
| mfisch | no more work | 03:03 |
| *** sdake has quit IRC | 03:04 | |
| ayoung | mfisch, this is Rust...this is not work | 03:04 |
| mfisch | Rust game or Rust programming language? | 03:04 |
| ayoung | Programming language. I'm writing a tftp server to learn the network API | 03:04 |
| ayoung | actually, learning the syntax is the hard part | 03:05 |
| mfisch | intersting so far? | 03:06 |
| ayoung | yep...file transfer over UDP keeps you guessing... | 03:06 |
| ayoung | But I want a PXE server | 03:06 |
| ayoung | so once I get this, it is DHCP | 03:06 |
| *** diazjf has joined #openstack-keystone | 03:07 | |
| * lbragstad gets ready to go watch some Longmire | 03:07 | |
| mfisch | battlefront | 03:07 |
| lbragstad | mfisch ah - good game | 03:07 |
| *** marg7175 has quit IRC | 03:08 | |
| mfisch | hmu: Foco_mfisch on there | 03:08 |
| ayoung | I'm also growing two gardens on XKCD today | 03:09 |
| *** diazjf has quit IRC | 03:09 | |
| *** mylu has quit IRC | 03:10 | |
| lbragstad | ayoung do you like westerns? | 03:10 |
| lbragstad | mfisch ^ | 03:10 |
| ayoung | Movies? Yeah, sortof. | 03:11 |
| ayoung | I like John Wayne. | 03:11 |
| lbragstad | ayoung I bet you'd like Longmire - my father-in-law introduced it to me over easter | 03:11 |
| mfisch | I like longmire | 03:11 |
| mfisch | I like 45 miles from Wyoming | 03:11 |
| mfisch | ayoung would like longmire | 03:12 |
| lbragstad | i think so too... | 03:12 |
| ayoung | Probably. But I don't watch much TV these days | 03:12 |
| mfisch | its okay if you dont support me | 03:12 |
| lbragstad | nothin' can stop Walt Longmire and his 1911 | 03:12 |
| ayoung | "SHANE!" | 03:13 |
| *** mylu has joined #openstack-keystone | 03:13 | |
| mfisch | need to see Hateful 8 | 03:13 |
| lbragstad | mfisch yeah - that one's awesome | 03:13 |
| mfisch | movies cost 2x b/c I need a sitter so DVD/stream is easier | 03:14 |
| ayoung | To be honest, violence in movies is not my idea of fantasy anymore. I mean, I liked Deadpool, but more for the quips | 03:14 |
| mfisch | need to see that too | 03:14 |
| ayoung | I got date night credit for Deadpool | 03:14 |
| lbragstad | yeah - there we some good lines in that one | 03:14 |
| *** mylu has quit IRC | 03:14 | |
| ayoung | I talked her out of Zoolander 2. Knew it was not going to stand up to 1. | 03:15 |
| *** mylu has joined #openstack-keystone | 03:15 | |
| lbragstad | i never saw that one | 03:15 |
| lbragstad | Zoolander dos that is | 03:15 |
| ayoung | 2 got panned | 03:15 |
| *** roxanaghe has joined #openstack-keystone | 03:16 | |
| mfisch | the one with Leo lost in Wyoming... it was good | 03:17 |
| mfisch | cannot recall name | 03:17 |
| lbragstad | Revenant? | 03:17 |
| mfisch | yep | 03:17 |
| *** dan_nguyen has joined #openstack-keystone | 03:17 | |
| lbragstad | 13 hours was intense - my wife actually liked that one as much as i did | 03:17 |
| *** dflorea has joined #openstack-keystone | 03:19 | |
| *** dflorea has quit IRC | 03:20 | |
| lbragstad | alright - i'm clockin' out, catch you all tomorrow | 03:21 |
| crinkle | mfisch: battlefront! | 03:21 |
| mfisch | crinkle: ok! | 03:21 |
| mfisch | she found me lol | 03:21 |
| crinkle | :P | 03:21 |
| *** markvoelker has quit IRC | 03:26 | |
| *** roxanaghe has quit IRC | 03:29 | |
| *** stingaci has quit IRC | 03:32 | |
| *** dflorea has joined #openstack-keystone | 03:34 | |
| *** stingaci has joined #openstack-keystone | 03:37 | |
| morgan | oh my | 03:38 |
| *** mylu has quit IRC | 03:41 | |
| *** mylu has joined #openstack-keystone | 03:41 | |
| *** mylu has quit IRC | 03:42 | |
| *** mylu has joined #openstack-keystone | 03:42 | |
| *** dflorea has quit IRC | 03:43 | |
| *** dflorea has joined #openstack-keystone | 03:43 | |
| *** roxanaghe has joined #openstack-keystone | 03:44 | |
| *** anush_ has joined #openstack-keystone | 03:49 | |
| *** tqtran has joined #openstack-keystone | 03:49 | |
| *** links has joined #openstack-keystone | 03:52 | |
| *** dflorea has quit IRC | 03:52 | |
| *** agrebennikov has quit IRC | 04:00 | |
| *** dan_nguyen has quit IRC | 04:01 | |
| *** tqtran has quit IRC | 04:02 | |
| *** jamielennox is now known as jamielennox|away | 04:21 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/300626 | 04:25 |
| *** markvoelker has joined #openstack-keystone | 04:26 | |
| stevemar | there was chit chat going on and i didn't partake, darn! | 04:28 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Make AuthContext depend on auth_token middleware https://review.openstack.org/255686 | 04:29 |
| *** jamielennox|away is now known as jamielennox | 04:29 | |
| *** jasonsb has joined #openstack-keystone | 04:30 | |
| *** markvoelker has quit IRC | 04:32 | |
| *** Nirupama has joined #openstack-keystone | 04:41 | |
| *** woodster_ has joined #openstack-keystone | 04:44 | |
| *** furface has quit IRC | 04:51 | |
| *** browne has joined #openstack-keystone | 04:51 | |
| *** mylu has quit IRC | 04:51 | |
| *** stingaci has quit IRC | 04:55 | |
| *** stingaci has joined #openstack-keystone | 04:55 | |
| *** jaosorior has joined #openstack-keystone | 04:55 | |
| *** anush_ has quit IRC | 05:01 | |
| *** jamielennox is now known as jamielennox|away | 05:01 | |
| *** browne has quit IRC | 05:07 | |
| *** mylu has joined #openstack-keystone | 05:08 | |
| *** furface has joined #openstack-keystone | 05:09 | |
| *** jamielennox|away is now known as jamielennox | 05:11 | |
| *** mylu has quit IRC | 05:12 | |
| *** GB21 has joined #openstack-keystone | 05:14 | |
| *** browne has joined #openstack-keystone | 05:14 | |
| *** furface has quit IRC | 05:16 | |
| *** browne has quit IRC | 05:18 | |
| *** jamielennox is now known as jamielennox|away | 05:22 | |
| *** jamielennox|away is now known as jamielennox | 05:30 | |
| *** sekrit has quit IRC | 05:30 | |
| *** stingaci has quit IRC | 05:36 | |
| *** sdake has joined #openstack-keystone | 05:40 | |
| *** stingaci has joined #openstack-keystone | 05:40 | |
| *** roxanaghe has quit IRC | 05:41 | |
| *** roxanaghe has joined #openstack-keystone | 05:42 | |
| *** sdake_ has quit IRC | 05:42 | |
| *** stingaci has quit IRC | 05:43 | |
| *** sdake_ has joined #openstack-keystone | 05:49 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Make AuthContext depend on auth_token middleware https://review.openstack.org/255686 | 05:49 |
| *** sdake has quit IRC | 05:52 | |
| *** stingaci has joined #openstack-keystone | 05:54 | |
| *** stingaci has quit IRC | 05:55 | |
| *** dave-mcc_ has quit IRC | 05:56 | |
| *** stingaci has joined #openstack-keystone | 05:56 | |
| *** rcernin has joined #openstack-keystone | 05:59 | |
| *** stingaci has quit IRC | 06:01 | |
| *** fawadkhaliq has joined #openstack-keystone | 06:02 | |
| *** roxanaghe has quit IRC | 06:07 | |
| *** lhcheng has quit IRC | 06:13 | |
| *** aswadr_ has joined #openstack-keystone | 06:14 | |
| *** fawadkhaliq has quit IRC | 06:20 | |
| *** josecastroleon has joined #openstack-keystone | 06:21 | |
| *** sekrit has joined #openstack-keystone | 06:23 | |
| *** markvoelker has joined #openstack-keystone | 06:29 | |
| *** rk4n has joined #openstack-keystone | 06:29 | |
| *** belmoreira has joined #openstack-keystone | 06:30 | |
| *** dave-mcc_ has joined #openstack-keystone | 06:33 | |
| *** markvoelker has quit IRC | 06:35 | |
| *** furface has joined #openstack-keystone | 06:35 | |
| *** jamielennox is now known as jamielennox|away | 06:38 | |
| *** woodster_ has quit IRC | 06:47 | |
| *** dave-mccowan has joined #openstack-keystone | 06:49 | |
| *** dave-mcc_ has quit IRC | 06:54 | |
| *** ankur has joined #openstack-keystone | 06:54 | |
| *** lhcheng has joined #openstack-keystone | 07:00 | |
| *** ChanServ sets mode: +v lhcheng | 07:00 | |
| *** jaosorior has quit IRC | 07:00 | |
| *** openstackgerrit has quit IRC | 07:02 | |
| *** openstackgerrit has joined #openstack-keystone | 07:02 | |
| *** sheel has joined #openstack-keystone | 07:05 | |
| *** pcaruana has joined #openstack-keystone | 07:06 | |
| *** spandhe has quit IRC | 07:06 | |
| *** jaosorior has joined #openstack-keystone | 07:07 | |
| *** roxanaghe has joined #openstack-keystone | 07:08 | |
| *** rcernin has quit IRC | 07:08 | |
| *** rcernin has joined #openstack-keystone | 07:09 | |
| *** spandhe has joined #openstack-keystone | 07:10 | |
| *** roxanaghe has quit IRC | 07:13 | |
| *** stingaci has joined #openstack-keystone | 07:13 | |
| *** stingaci has quit IRC | 07:18 | |
| *** jaosorior has quit IRC | 07:22 | |
| *** jaosorior has joined #openstack-keystone | 07:22 | |
| *** jaosorior has quit IRC | 07:47 | |
| *** jaosorior has joined #openstack-keystone | 07:47 | |
| *** rdo has quit IRC | 07:47 | |
| *** spandhe has quit IRC | 07:58 | |
| *** GB21 has quit IRC | 07:58 | |
| *** daemontool has joined #openstack-keystone | 08:04 | |
| *** roxanaghe has joined #openstack-keystone | 08:14 | |
| *** rdo has joined #openstack-keystone | 08:15 | |
| *** roxanaghe has quit IRC | 08:18 | |
| *** jistr has joined #openstack-keystone | 08:22 | |
| *** brad[] has quit IRC | 08:26 | |
| *** brad[] has joined #openstack-keystone | 08:27 | |
| breton | o/ | 08:27 |
| *** markvoelker has joined #openstack-keystone | 08:30 | |
| *** mhickey has joined #openstack-keystone | 08:33 | |
| openstackgerrit | Li Yingjun proposed openstack/keystone: Fix KeyError when rename to a name is already in use https://review.openstack.org/301418 | 08:33 |
| *** markvoelker has quit IRC | 08:35 | |
| *** e0ne has joined #openstack-keystone | 08:35 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Fixes bug where the updated federated display_name is not returned https://review.openstack.org/301987 | 08:38 |
| *** dave-mccowan has quit IRC | 08:43 | |
| *** lhcheng has quit IRC | 08:43 | |
| *** e0ne has quit IRC | 09:00 | |
| *** pnavarro has joined #openstack-keystone | 09:00 | |
| *** Daviey_ has quit IRC | 09:10 | |
| *** Daviey has joined #openstack-keystone | 09:12 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone: Update the description of the role driver option https://review.openstack.org/302118 | 09:16 |
| *** GB21 has joined #openstack-keystone | 09:18 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Clean up test case for shadow users https://review.openstack.org/302123 | 09:24 |
| *** henrynash has joined #openstack-keystone | 09:24 | |
| *** ChanServ sets mode: +v henrynash | 09:24 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Clean up test case for shadow users https://review.openstack.org/302123 | 09:25 |
| *** phalmos has joined #openstack-keystone | 09:40 | |
| *** phalmos has quit IRC | 09:48 | |
| *** EinstCra_ is now known as EinstCrazy | 10:00 | |
| *** sdake_ has quit IRC | 10:02 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Fixes bug where the updated federated display_name is not returned https://review.openstack.org/301987 | 10:04 |
| openstackgerrit | henry-nash proposed openstack/keystone: Clean up test case for shadow users https://review.openstack.org/302123 | 10:04 |
| *** GB21 has quit IRC | 10:05 | |
| *** e0ne has joined #openstack-keystone | 10:06 | |
| *** ekarlso- has quit IRC | 10:09 | |
| *** EinstCrazy has quit IRC | 10:12 | |
| -openstackstatus- NOTICE: npm lint jobs are failing due to a problem with npm registry. The problem is under investigation, and we will update once the issue is solved. | 10:17 | |
| *** ChanServ changes topic to "npm lint jobs are failing due to a problem with npm registry. The problem is under investigation, and we will update once the issue is solved." | 10:17 | |
| *** ekarlso- has joined #openstack-keystone | 10:21 | |
| *** ekarlso- has quit IRC | 10:22 | |
| *** ekarlso has joined #openstack-keystone | 10:22 | |
| *** mvk_ has quit IRC | 10:23 | |
| *** markvoelker has joined #openstack-keystone | 10:31 | |
| *** markvoelker has quit IRC | 10:36 | |
| *** rodrigods has quit IRC | 10:52 | |
| *** rodrigods has joined #openstack-keystone | 10:53 | |
| *** tqtran has joined #openstack-keystone | 10:56 | |
| *** GB21 has joined #openstack-keystone | 10:57 | |
| *** GB21 has quit IRC | 10:59 | |
| *** tqtran has quit IRC | 11:01 | |
| *** tellesnobrega is now known as tellesnobrega_af | 11:04 | |
| *** henrynash has quit IRC | 11:10 | |
| *** stingaci has joined #openstack-keystone | 11:16 | |
| *** marg7175 has joined #openstack-keystone | 11:17 | |
| *** stingaci has quit IRC | 11:20 | |
| *** mvk_ has joined #openstack-keystone | 11:38 | |
| *** gordc has joined #openstack-keystone | 11:42 | |
| *** tellesnobrega_af is now known as tellesnobrega | 11:48 | |
| *** roxanaghe has joined #openstack-keystone | 11:49 | |
| *** doug-fish has joined #openstack-keystone | 11:50 | |
| *** roxanaghe has quit IRC | 11:54 | |
| openstackgerrit | venkatamahesh proposed openstack/keystone: Update the Administrator guide link https://review.openstack.org/302201 | 12:03 |
| morgan | Mornin Keystone's! | 12:04 |
| morgan | Keystoners* damn you autocorrect | 12:04 |
| morgan | ;) | 12:04 |
| breton | o/ | 12:06 |
| *** e0ne has quit IRC | 12:13 | |
| *** raildo-afk is now known as raildo | 12:14 | |
| *** markvoelker has joined #openstack-keystone | 12:15 | |
| *** hughsaunders has quit IRC | 12:16 | |
| *** e0ne has joined #openstack-keystone | 12:17 | |
| *** hughsaunders has joined #openstack-keystone | 12:18 | |
| *** Nirupama has quit IRC | 12:21 | |
| *** trown|outtypewww is now known as trown | 12:23 | |
| *** mhickey has quit IRC | 12:26 | |
| *** henrynash has joined #openstack-keystone | 12:29 | |
| *** ChanServ sets mode: +v henrynash | 12:29 | |
| dstanek | morgan: morning | 12:49 |
| samueldmq | morning | 12:51 |
| morgan | dstanek: how goes? | 12:51 |
| morgan | samueldmq: allo | 12:51 |
| samueldmq | morgan: howdy | 12:52 |
| dstanek | morgan: pretty good. slowly getting back into the swing of things after my vacation last week | 12:53 |
| morgan | dstanek: nice | 12:53 |
| morgan | Vacation ++ | 12:54 |
| dstanek | how about you? | 12:55 |
| morgan | Not too bad. Hopping on another plane | 12:56 |
| morgan | Will be in the air soon(TM) | 12:56 |
| *** links has quit IRC | 12:56 | |
| *** tellesnobrega is now known as tellesnobrega_af | 12:57 | |
| dstanek | where are you off to now? | 12:58 |
| *** mhickey has joined #openstack-keystone | 13:00 | |
| *** edmondsw has joined #openstack-keystone | 13:09 | |
| samueldmq | morgan: safe travels :) | 13:11 |
| *** pauloewerton has joined #openstack-keystone | 13:12 | |
| *** sdake has joined #openstack-keystone | 13:15 | |
| *** sdake_ has joined #openstack-keystone | 13:19 | |
| *** sdake has quit IRC | 13:19 | |
| *** jsavak has joined #openstack-keystone | 13:21 | |
| *** sdake_ has quit IRC | 13:24 | |
| *** sdake has joined #openstack-keystone | 13:27 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Restructure resource backend https://review.openstack.org/302257 | 13:31 |
| *** alex_xu has quit IRC | 13:33 | |
| *** ametts has joined #openstack-keystone | 13:35 | |
| *** alex_xu has joined #openstack-keystone | 13:35 | |
| morgan | dstanek: montreal. | 13:37 |
| morgan | dstanek: finally in the air and have wifi going :) | 13:37 |
| *** roxanaghe has joined #openstack-keystone | 13:37 | |
| morgan | but man gogo is sllloooowwww WTB viasat | 13:37 |
| *** tellesnobrega_af is now known as tellesnobrega | 13:37 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Restructure resource backend https://review.openstack.org/302257 | 13:38 |
| samueldmq | dstanek: bknudson ^ | 13:38 |
| samueldmq | in tests, it would be: test_controllers.py, test_managers.py and test_drivers.py | 13:39 |
| bknudson | we seem to have different developers all proposing different alternative layouts for the packages... | 13:39 |
| bknudson | for example, https://review.openstack.org/#/c/296140/ moves drivers to backends/base.py | 13:40 |
| patchbot | bknudson: patch 296140 - keystone - Remove backend interface and common code out of id... | 13:40 |
| samueldmq | I am not aware of other proposals | 13:40 |
| * samueldmq 's looking | 13:40 | |
| bknudson | and now https://review.openstack.org/#/c/302257/ moves drivers to keystone/resource/drivers.py | 13:40 |
| patchbot | bknudson: patch 302257 - keystone - Restructure resource backend | 13:40 |
| bknudson | I think we need a spec or a dev doc update rather than just moving things around. | 13:40 |
| samueldmq | bknudson: I agree, just would like to get opinions on it | 13:41 |
| samueldmq | bknudson: does it look better that way for you ? | 13:41 |
| *** roxanaghe has quit IRC | 13:42 | |
| morgan | bknudson: a spec or at least a developer doc for it | 13:42 |
| morgan | bknudson: so we can point to "this is the structure we want" | 13:42 |
| samueldmq | I agree on developer doc, spec isn't necessary imo | 13:42 |
| morgan | either works | 13:42 |
| bknudson | samueldmq: putting the driver interfaces in backends/base.py makes sense. | 13:43 |
| morgan | bknudson: ++ | 13:43 |
| *** jaosorior has quit IRC | 13:44 | |
| samueldmq | bknudson: yes, maybe that even makes more sense in cases like identity, where we have backends/base.py | 13:45 |
| samueldmq | mapping_backends/base.py and shadow_backends/base.py | 13:45 |
| samueldmq | rather than puttin everything inside a single drivers.py file | 13:45 |
| morgan | and also "base" is a pretty logical name for that stuff | 13:46 |
| samueldmq | morgan: ++ | 13:46 |
| morgan | it's where i'd expect that type of thing to live | 13:46 |
| samueldmq | bknudson: morgan: do you like renaming core.py to managers.py ? | 13:46 |
| samueldmq | "core" says nothing to me | 13:46 |
| morgan | "core" is no different than just what i'd expect in __init__.py | 13:46 |
| morgan | just ... not the magic file | 13:47 |
| morgan | if the file only contains managers, a rename to manager.py or managers.py would be fine [again remember deprecation of symbol locations for N cycles etc etc etc] | 13:47 |
| samueldmq | yes, managers is more explicit | 13:47 |
| samueldmq | and we name other things explicitly, like "controllers" and "routers" | 13:48 |
| morgan | so i think the steps are "propose developer doc for these things" | 13:48 |
| morgan | or a series of edits to the developer docs. | 13:48 |
| morgan | then start making sure everything is aligned with the dev. docs | 13:49 |
| morgan | it's a lot of code shuffle but we will have a target to point at. | 13:49 |
| morgan | which is good. | 13:49 |
| samueldmq | morgan: completely agree, I will propose a patch updating the docs | 13:49 |
| samueldmq | morgan: and then work on updating the subsystems (resouce, assignments, etc) with rdrose (identity, and more if he wants) | 13:50 |
| bknudson | samueldmq: thanks! | 13:50 |
| morgan | samueldmq: i'd break it up into a couple changes: 1) Tests, 2) changes (like core -> managers, core.<thing> -> Base.py) etc | 13:50 |
| morgan | bknudson: ++ | 13:50 |
| *** knikolla has joined #openstack-keystone | 13:57 | |
| *** EinstCrazy has joined #openstack-keystone | 13:59 | |
| *** EinstCrazy has quit IRC | 13:59 | |
| *** csoukup has joined #openstack-keystone | 13:59 | |
| *** EinstCrazy has joined #openstack-keystone | 13:59 | |
| *** rderose has joined #openstack-keystone | 14:00 | |
| knikolla | morning! | 14:01 |
| rderose | bknudson -2 on Remove backend interface and common code out of identity.core?? | 14:02 |
| DinaBelova | morgan fyi I filed https://bugs.launchpad.net/keystone/+bug/1566835 and https://bugs.launchpad.net/keystone/+bug/1566857 - this might be my local issue somehow, I'm debugging this with amakarov and breton now | 14:09 |
| openstack | Launchpad bug 1566835 in OpenStack Identity (keystone) "Keystone oslo_cache.memcache_pool cache seems not to work properly" [Undecided,New] | 14:09 |
| openstack | Launchpad bug 1566857 in OpenStack Identity (keystone) "Keystone authtoken middleware seems to work wrong with memcached cache" [Undecided,New] | 14:09 |
| *** EinstCrazy has quit IRC | 14:09 | |
| morgan | DinaBelova: sounds good | 14:10 |
| *** EinstCrazy has joined #openstack-keystone | 14:10 | |
| DinaBelova | morgan in fact it sounds bad now :D | 14:10 |
| DinaBelova | I really hope I'm wrong :) | 14:10 |
| morgan | lol | 14:10 |
| morgan | DinaBelova: for keystone memcache pool is almost pointless with eventlet going away | 14:11 |
| morgan | DinaBelova: if not completely pointless | 14:11 |
| morgan | DinaBelova: in middeware it's a little different | 14:12 |
| *** jaosorior has joined #openstack-keystone | 14:12 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update the description of the role driver option https://review.openstack.org/302118 | 14:12 |
| morgan | and it likely is still useful/needed/something | 14:12 |
| morgan | but i dislike that it has to touch internal interfaces. | 14:12 |
| DinaBelova | morgan well, yeah, looking on all this stuff now | 14:12 |
| morgan | DinaBelova: so.. do you mind if i mark (not the oslo.cache part) but keystone specific (server) cases as "invalid"? | 14:13 |
| morgan | uwsgi/mod_wsgi doesn't make sense to continue with it | 14:13 |
| DinaBelova | am I wrong in Mitaka oslo_cache.memcache_pool seems to be the default value? | 14:13 |
| DinaBelova | for keystone? | 14:14 |
| morgan | shouldn't be i don't think | 14:14 |
| breton | no, it's not default | 14:14 |
| morgan | again memcachepool really is pointless for non-eventlet systems | 14:14 |
| morgan | for keystone. | 14:14 |
| breton | not really | 14:14 |
| morgan | yes really. | 14:14 |
| breton | no | 14:15 |
| DinaBelova | lol | 14:15 |
| morgan | it requires hacking internal interfaces | 14:15 |
| morgan | and is generally awful | 14:15 |
| breton | yes | 14:15 |
| breton | but there are still threads | 14:15 |
| morgan | we only use memcache pool to deal with explicit threadlocal issues in memcache | 14:15 |
| morgan | that deal with eventlet | 14:15 |
| morgan | the other ones don't get slammed with the greenthread explosion (threads are strictly controlled) | 14:15 |
| morgan | so i'm going to go on a limb and say unless we make memcachepool not terrifyingly bad, it is a bad option for uwsgi/mod_Wsgi | 14:16 |
| openstackgerrit | Eyal proposed openstack/keystone: Simplify chained comparison https://review.openstack.org/302279 | 14:16 |
| DinaBelova | ok, so I'm running keystone under apache mod_wsgi - what should I be looking at? What should be my default external caching solution? | 14:16 |
| DinaBelova | should it be redis? | 14:17 |
| morgan | breton: also memcache token backend is deprecated/slated for eventual removal | 14:17 |
| morgan | breton: which is the key point in keystone server it was needed | 14:17 |
| amakarov | DinaBelova, you can try regular memcache backend | 14:18 |
| morgan | DinaBelova: well 2 things: Fernet Tokens (not using memcache backend for token store), and for caching regular memcache backend | 14:18 |
| *** slberger has joined #openstack-keystone | 14:18 | |
| amakarov | I don't know if it will help | 14:18 |
| breton | morgan: i agree | 14:18 |
| morgan | or bmemcache or pylibmc. | 14:18 |
| morgan | (dogpile configs) | 14:18 |
| amakarov | morgan, it isn't about tokens - it's MEMOIZE that malfunctions | 14:20 |
| morgan | moved https://bugs.launchpad.net/oslo.cache/+bug/1566835 to oslo.cache | 14:20 |
| openstack | Launchpad bug 1566835 in oslo.cache "Keystone oslo_cache.memcache_pool cache seems not to work properly" [Undecided,New] | 14:20 |
| DinaBelova | ack | 14:20 |
| morgan | amakarov: right. and it's because memcache_pool is very fragile. | 14:20 |
| morgan | at best. | 14:20 |
| amakarov | morgan, I hope you are right :) | 14:21 |
| morgan | amakarov: the standard memcache interface is tested on *Every* gate run | 14:21 |
| morgan | enabled in devstack for all gate jobs | 14:21 |
| amakarov | cool | 14:21 |
| morgan | (mod_wsgi) | 14:21 |
| morgan | we'd know if that was broken ^_^ | 14:22 |
| morgan | and i think uwsgi runs are also enabling it. | 14:22 |
| morgan | bknudson: for uwsgi deploy, we just need to restart uwsgi not apache when reconfiguring keystone (we should make sure we're doing that - i assume we are, just wifi on airplane is slow to load code) | 14:22 |
| DinaBelova | morgan amakarov what should I set in my config to set standard memcache cache? | 14:23 |
| amakarov | [cache]driver=memcache | 14:23 |
| amakarov | smth like that - there have to ve an example in comments | 14:23 |
| morgan | yeah, set the memcache servers (looking for the option) and [cache]enabled=true | 14:23 |
| DinaBelova | https://github.com/openstack/keystone/blob/stable/mitaka/etc/keystone.conf.sample#L380-L384 - I just do not see this variant here? | 14:24 |
| morgan | so fwiw | 14:25 |
| morgan | memcachepool is the default for us in gate | 14:25 |
| morgan | http://paste.openstack.org/show/493169/ | 14:25 |
| morgan | taken from http://logs.openstack.org/40/296140/13/check/gate-tempest-dsvm-full/6c4f4a5/logs/etc/keystone/keystone.conf.txt.gz | 14:25 |
| DinaBelova | heh | 14:25 |
| morgan | the <11211> should be <port> | 14:25 |
| morgan | so we are gating on memcachepool working | 14:26 |
| morgan | and i can clearly point to test runs that show it working :) | 14:26 |
| DinaBelova | well, I do not say the API is not working :) | 14:26 |
| DinaBelova | it's ok | 14:26 |
| DinaBelova | it just simply goes to the DB every time instead of cache using | 14:26 |
| DinaBelova | :D | 14:26 |
| amakarov | DinaBelova, btw, are there all cache calls are misses? | 14:27 |
| *** sheel has quit IRC | 14:27 | |
| DinaBelova | amakarov can't get your question, sorry | 14:27 |
| stevemar | morgan: mtl again? you trying to get citizenship here or something? :P | 14:27 |
| morgan | cache misses will always hit the db, he's asking if the requests you're seeing are cache misses | 14:28 |
| DinaBelova | amakarov can you please rephrase? | 14:28 |
| morgan | stevemar: haha | 14:28 |
| morgan | DinaBelova: not exactly the same call to a memoized function | 14:28 |
| DinaBelova | morgan the issue is that it should be value in the cache for this case | 14:28 |
| amakarov | DinaBelova, are there successful cache requests? | 14:28 |
| DinaBelova | amakarov yes, there are some | 14:28 |
| morgan | also for a given request (http), you will only ever see [except where cache is invalidated] one request to the db *if* the caching is enabled | 14:29 |
| morgan | so .get_user('<DinaBelova's user_id') should only make one call to the db for auth if caching is enabled. and possibly never to memcache | 14:30 |
| morgan | because we cache the data in a threadlocal cache too | 14:30 |
| morgan | subsequent http requests should hit memcache 1 time, at most. | 14:30 |
| * morgan would try and do a synthetic test of this right now but can't due to low bandwidth | 14:31 | |
| DinaBelova | amakarov morgan - let's take a look on http://dinabelova.github.io/mitaka_user_list.html - if you'll click several keystone cache stuff you'll see that there are the same calls with get_user_by_name(, u'admin', 'default') - if I'll trace the keys generated for the backend it'll be the same one here | 14:32 |
| DinaBelova | morgan ack | 14:32 |
| bknudson | morgan: for uwsgi proxy, apache will return some proxy error if it can't talk to keystone. So you can restart the uwsgi servers independently | 14:32 |
| morgan | bknudson: right. | 14:32 |
| morgan | DinaBelova: i'll likely have a few minutes to poke at this tomorrow. | 14:33 |
| DinaBelova | morgan thank you sir | 14:33 |
| morgan | DinaBelova: or whaen i get to JFK between flights | 14:33 |
| DinaBelova | ack | 14:33 |
| amakarov | DinaBelova, attach the links to the code please | 14:33 |
| DinaBelova | amakarov where to attach links and to what code? | 14:33 |
| amakarov | where you inserted osprofiler magic | 14:33 |
| DinaBelova | ah | 14:33 |
| morgan | DinaBelova: but i do know it works ;) [i'll wedge in some debug output that will show the memcache hits/misses while i'm poking at this] | 14:34 |
| bknudson | rderose: we need developer docs for how the components will be laid out otherwise it's going to be a mess. | 14:34 |
| morgan | DinaBelova: so, i'm good with landing OSProfiler in this cycle like it is. eventualyl i'd like to create clear hook points that anyone can use (not just osprofiler) so we don't need any osprofiler code in keystone itself | 14:34 |
| DinaBelova | morgan ok, gotcha | 14:35 |
| morgan | DinaBelova: if you would like to discuss that at the summit, I'd like to come up with a proposal on how that should look across all openstack projects :) | 14:35 |
| DinaBelova | morgan that will be super interesting | 14:35 |
| DinaBelova | thank you sir | 14:35 |
| morgan | DinaBelova: and you're clearly the right person to discuss that with! ^_^ | 14:36 |
| DinaBelova | ;) | 14:36 |
| DinaBelova | amakarov fyi https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:osprofiler-support-in-keystone | 14:36 |
| morgan | (among other people that we should loop in like amakarov ) | 14:36 |
| amakarov | morgan, I'm in touch with the issue anyway along with breton :) | 14:37 |
| morgan | amakarov: :) | 14:38 |
| morgan | yes breton too | 14:38 |
| *** richm has joined #openstack-keystone | 14:39 | |
| rderose | bknudson finally got 2 +2s and then because Samuel puts up a patch you -2 it | 14:40 |
| rderose | bknudson come on man, it's a good change, let it go thru :) | 14:40 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:40 | |
| morgan | rderose: we need a clear set of targets, so his hold is really "put dev doc up" so we can make sure we're consistent | 14:41 |
| morgan | rderose: poke at samueldmq and i am sure we can land that quickly (dev doc) so all the code shuffling becomes consistent | 14:41 |
| *** spandhe has joined #openstack-keystone | 14:41 | |
| morgan | rderose: fwiw, i think the -2 is correct for the moment but should be clearable right post summit since the devdoc can land prob while we're there | 14:41 |
| rderose | bknudson morgan: okay, by dev doc, you mean a spec? | 14:41 |
| *** sdake_ has joined #openstack-keystone | 14:42 | |
| *** sdake has quit IRC | 14:42 | |
| morgan | rderose: no actually docs in keystone saying "code is structured like X" [updates] and structure of how tests work | 14:42 |
| morgan | a "spec" is not likely needed | 14:42 |
| bknudson | rderose: y, what morgan said | 14:42 |
| *** sdake_ is now known as sdake | 14:43 | |
| bknudson | and I hope it doesn't take until the summit. It could be done today. | 14:43 |
| rderose | morgan bknudson cool | 14:45 |
| morgan | bknudson: i am overestimating | 14:45 |
| morgan | bknudson: and will be happy if it's done today/tomorrow/nextweek | 14:45 |
| morgan | but summit is very close | 14:45 |
| morgan | sooooooooo | 14:45 |
| rderose | morgan bknudson: where in keystone to I put the docs? sorry, can you point me in the right direction | 14:46 |
| rderose | * do I | 14:46 |
| *** GB21 has joined #openstack-keystone | 14:46 | |
| bknudson | samueldmq: were you working on some docs for the component layout now? | 14:46 |
| bknudson | somewhere under Developers Documentation ... | 14:47 |
| bknudson | http://docs.openstack.org/developer/keystone/#developers-documentation | 14:47 |
| rderose | bknudson: okay, on it | 14:47 |
| bknudson | I would think in http://docs.openstack.org/developer/keystone/architecture.html would make the most sense | 14:47 |
| bknudson | or a separate file is fine | 14:47 |
| *** sdake_ has joined #openstack-keystone | 14:48 | |
| *** clenimar has quit IRC | 14:48 | |
| morgan | bknudson: ++ | 14:48 |
| rderose | bknudson: perfect, thx | 14:48 |
| *** ericksonsantos has quit IRC | 14:48 | |
| *** pauloewerton has quit IRC | 14:48 | |
| *** iurygregory has quit IRC | 14:48 | |
| *** raildo is now known as raildo-afk | 14:49 | |
| *** pauloewerton has joined #openstack-keystone | 14:49 | |
| *** rderose has quit IRC | 14:50 | |
| *** sdake has quit IRC | 14:51 | |
| *** raildo-afk is now known as raildo | 14:51 | |
| *** clenimar has joined #openstack-keystone | 14:51 | |
| *** iurygregory has joined #openstack-keystone | 14:52 | |
| *** rderose has joined #openstack-keystone | 14:52 | |
| *** jsavak has quit IRC | 14:52 | |
| *** jsavak has joined #openstack-keystone | 14:53 | |
| DinaBelova | amakarov morgan in case of backend = dogpile.cache.memcached usage the memoize decorator work seems to be the same as I had for memcached_pool - so it's something different | 14:53 |
| *** jaosorior has quit IRC | 14:54 | |
| samueldmq | rderose: are you working on the docs ? | 14:54 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add identity providers integration tests https://review.openstack.org/302299 | 14:54 |
| rderose | samuelmq yes, now in fact :) | 14:54 |
| *** diazjf has joined #openstack-keystone | 14:54 | |
| *** david_cu has joined #openstack-keystone | 14:54 | |
| rderose | * samueldmq | 14:55 |
| rodrigods | dstanek, bknudson, ayoung ^ | 14:55 |
| samueldmq | rderose: perfect, thanks! | 14:55 |
| ayoung | rodrigods, cool I will look in a moment | 14:55 |
| rderose | samueldmq: great minds think a like :) | 14:56 |
| samueldmq | rderose: could you also propose renaming core.py to managers.py in you doc change? | 14:56 |
| dstanek | rodrigods: nice | 14:56 |
| rderose | samueldmq: sure | 14:56 |
| rderose | samueldmq: will do | 14:56 |
| samueldmq | rderose: that's the only thing mine added when compared to yours, and "core" doesn't really tell anything | 14:56 |
| samueldmq | rderose: perfect, thanks | 14:56 |
| samueldmq | :) | 14:56 |
| rderose | samueldmq: agree | 14:56 |
| bknudson | we've always used core to be essentially what you would put in __init__.py. | 14:57 |
| bknudson | not sure why we decided it was bad to put stuff into __init__.py... I guess it's a little harder to find. | 14:57 |
| *** spandhe_ has joined #openstack-keystone | 14:57 | |
| morgan | bknudson: mostly because __init__ is magic | 14:57 |
| rderose | bknudson: so do you agree with the core to manager rename change? | 14:58 |
| morgan | bknudson: wecan make __init__ not import core for example, so you can do identity.core or (technically, but not practically) identity.controllers without .core [in practice this is not the case] | 14:58 |
| bknudson | rderose: I don't know... haven't had a chance to look at samueldmq's patch. | 14:58 |
| rderose | bknudson: okay | 14:59 |
| *** spandhe has quit IRC | 14:59 | |
| *** spandhe_ is now known as spandhe | 14:59 | |
| bknudson | personally, I think if you're writing up a doc just say to move the interfaces out of core. | 14:59 |
| bknudson | and then samueldmq can make his case for renaming core separately | 14:59 |
| morgan | bknudson: ++ | 15:00 |
| *** roxanaghe has joined #openstack-keystone | 15:00 | |
| rderose | bknudson morgan samueldmq: okay ^ | 15:00 |
| *** roxanaghe has quit IRC | 15:01 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 15:02 | |
| *** pushkaru has joined #openstack-keystone | 15:03 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:03 | |
| DinaBelova | morgan - quick question - local cache is cleaned for every API call to keystone? or is it shared between several API calls? | 15:04 |
| morgan | DinaBelova: the request local cache is a cache *just* for that HTTP request | 15:05 |
| morgan | DinaBelova: so it should be cleaned per-request since we reset threadlocal() context | 15:06 |
| *** roxanaghe has joined #openstack-keystone | 15:06 | |
| *** roxanaghe has quit IRC | 15:08 | |
| morgan | DinaBelova: https://review.openstack.org/#/c/272007/ | 15:08 |
| patchbot | morgan: patch 272007 - keystone - Use requst local in-process cache per request (MERGED) | 15:08 |
| DinaBelova | morgan a-ha... do you have any stats on how is this cache effective? I see that I'm using this local cache on the env and no data is written to the memcached. By cache effectiveness I mean any stats about how many fucntion calls are cached for keystone for various API calls? | 15:11 |
| morgan | DinaBelova: not off the top of my head. i profiled a bunch of devstack and it improved gate runtimes by a noticable amount | 15:12 |
| *** roxanaghe has joined #openstack-keystone | 15:12 | |
| morgan | DinaBelova: i have not had a chance to dig into the request-local offload benefits. but in short what happens is we do [check request-local], [check memcache], [get from SQL], and we populate each cache as appropriate | 15:12 |
| bknudson | for some reason I wasn't paying attention and it looks like we can switch devstack to do fernet by default ? https://review.openstack.org/#/c/195780/ | 15:13 |
| patchbot | bknudson: patch 195780 - openstack-dev/devstack - Switch fernet to be the default token provider | 15:13 |
| bknudson | any reason we shouldn't do that? | 15:13 |
| morgan | bknudson: i want to see that! :) | 15:13 |
| lbragstad | bknudson I want to say that was waiting on the whole trust + fernet + v2 thing | 15:13 |
| morgan | lbragstad: prob. | 15:13 |
| lbragstad | but I'll defer to ayoung | 15:13 |
| ayoung | reading up | 15:14 |
| bknudson | I think we wanted to have the default changed in keystone rather than in devstack? | 15:14 |
| stevemar | lbragstad: we don't need to wait for the whole `trust + fernet + v2 thing` for a devstack change | 15:14 |
| lbragstad | bknudson yeah - that's what ayoung's patch did | 15:14 |
| morgan | bknudson: yeah we do want the default in keystone changed too imo. | 15:14 |
| lbragstad | ++ | 15:14 |
| morgan | but we could do devstack today. | 15:14 |
| ayoung | ok...so some history | 15:15 |
| stevemar | morgan: definitely, no reason not to | 15:15 |
| bknudson | y, I'll lift my -1. we can cleanup devstack in a separate commit | 15:15 |
| ayoung | when "he who must not be named on IRC" rewrote Keystone, there was only a core file | 15:15 |
| ayoung | and everything ended up depending on everything | 15:15 |
| *** dave-mccowan has joined #openstack-keystone | 15:15 | |
| morgan | ayoung: termie (he's not in this channel) | 15:15 |
| morgan | ? | 15:15 |
| ayoung | morgan, where is the fun in that? | 15:15 |
| stevemar | morgan: probably | 15:15 |
| lbragstad | lol | 15:15 |
| stevemar | hehe | 15:15 |
| ayoung | Nah, he's beeen got for years now | 15:15 |
| ayoung | gone | 15:15 |
| morgan | i think he's in -dev still | 15:15 |
| morgan | he just never joined us here. | 15:16 |
| ayoung | yep | 15:16 |
| ayoung | and, actually, now that he can no longer -2 and sit on a patch, I would gladly welcome him in to a discussion | 15:16 |
| * lbragstad just started jamming out to 'since you've been gone' | 15:16 | |
| stevemar | hehe | 15:16 |
| ayoung | morgan, now walk up to a mirror and say "Bloody Mary" three times... | 15:17 |
| * morgan points people at -dev *shiftyeyes* | 15:17 | |
| *** belmoreira has quit IRC | 15:17 | |
| ayoung | N E Ways | 15:17 |
| morgan | ayoung: north east ways? | 15:17 |
| * morgan ducks. | 15:17 | |
| DinaBelova | morgan it's interesting.. It looks like now i have the following situation on my env: I have set up memcached cache, that is not (?) used in fact in benefit to local cache as working with local stuff it's just quicker. Although I can see that, for instance for Liberty fernet cache off VS cache on for user list request means 56 DB SELECTs vs 26 DB SELECTs, and for Mitaka it's 95 DB SELECTs VS 80 DB SELECTS - so this local cache logically | 15:17 |
| DinaBelova | increased the load on the DB layer - i just wonder if it was analysed the pros/cons for this step | 15:17 |
| DinaBelova | morgan sorry for being pain in the a**, I just want to understand | 15:18 |
| DinaBelova | thanks in advance | 15:18 |
| ayoung | I did refactoring back then, and split the controllers off the core files, because we had an "everything depedns on everything" problem | 15:18 |
| ayoung | so the clean up was that the routers needed the controllers, the controllers needed the manager, | 15:18 |
| morgan | DinaBelova: no worries. the main point is to offload the caching, it should still cache in memcache where possible | 15:18 |
| ayoung | at the top level, the service definitions needed the routers | 15:19 |
| morgan | DinaBelova: requestlocal is on top of normal caching, it shouldn't be increasing the DB load at all. the db selects are more reflective of the changes in the code base | 15:19 |
| *** rderose_ has joined #openstack-keystone | 15:20 | |
| ayoung | In retrospect, we could have left the routers and controllers together, but from a technology perspective, the controllers were not depending on the rest of the web etup, nor we even "web" at all | 15:20 |
| morgan | DinaBelova: requestlocal will still cause memcache to see the data - the difference is that requestlocal limits the re-request of data from memcache. it can also be used without memcache, and just offload duplicted requests from the DB | 15:20 |
| ayoung | I left the manager and driver in core, as the internals of Keystone were "token needs identity" | 15:20 |
| ayoung | remember, none of the split had happened at this point | 15:20 |
| morgan | DinaBelova: the concept is don't let keystone request the external data to the backends more than one time per HTTP request. | 15:20 |
| ayoung | identity had users, tenants, and role assignements | 15:21 |
| morgan | DinaBelova: so asking for .get_user_by_name(<name>) will not use socket code paths after the first request (uness the cache is explicitly invalidated in the .update_user()-like cases) | 15:21 |
| ayoung | but a lot of the code had from keystone import identity and that was getting the manager. Manager was already in core, and imported into __init__.py. So the origianl split was a termie-ism | 15:22 |
| morgan | DinaBelova: if multiple requests for .get_user_by_name() occur across multiple HTTP requests, it would hit memcache if it has been cached or SQL if it's a complete cache miss. Any cache miss that hits sql populates both request_local cacheand / or the memcache depending on configuration | 15:22 |
| *** rderose has quit IRC | 15:23 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Dev doc update for moving abstract base classes out of core https://review.openstack.org/302317 | 15:23 |
| *** mylu has joined #openstack-keystone | 15:24 | |
| *** roxanaghe has quit IRC | 15:24 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Dev doc update for moving abstract base classes out of core https://review.openstack.org/302317 | 15:24 |
| DinaBelova | morgan a-ha, thank you sir! So let's imagine the situation we have multiple HTTP calls and the first one get_user_by_name was called. Will it be then storeg in memcached? It looks like yes, and the next call should first time grab this value from memcached and use it later across this specific second HTTP call | 15:25 |
| DinaBelova | am I right that is the idea? | 15:25 |
| morgan | yep. | 15:25 |
| ayoung | the managers used to be just very thin wrappers around the drivers. Business logic was either in the controller or in the driver itself. We had a discussion and made a deliberate decision to use the manager as the place for common business logic, the controler was to be web binding only, and the driver was persistence only | 15:25 |
| morgan | DinaBelova: and in a single HTTP request you should never see .get_user_by_name() hit either sql or memcache (since it's request-local cache) as long as caching is enabled. | 15:26 |
| ayoung | rderose_, I guess that bit of storytelling was directed at you and your questions. | 15:26 |
| morgan | DinaBelova: after the first one that is | 15:26 |
| *** sheel has joined #openstack-keystone | 15:26 | |
| DinaBelova | morgan - ok, this looks very logical, but the results I'm seeing are telling that second time we still hit none for the same key in the memcached and are going back to the DB :( | 15:26 |
| rderose_ | ayoung: ah, okay :) | 15:27 |
| ayoung | bknudson, before we switch devstack to default to fernet, lets get the "default to fernet to pass" | 15:27 |
| DinaBelova | morgan - I see this working in terms of one HTTP call - so yes, in a single HTTP request you should never see .get_user_by_name() hit either sql or memcache (since it's request-local cache) as long as caching is enabled. | 15:27 |
| morgan | DinaBelova: so there are a few reasons that could occur, 1) make sure memcache is infact running on the interface expected and is reachable by keystone. | 15:27 |
| ayoung | lbragstad, ^^ | 15:27 |
| *** roxanaghe has joined #openstack-keystone | 15:27 | |
| morgan | DinaBelova: that is the most likely case, the network stack can't reach (port is blocked/etc, so instant fail) | 15:27 |
| morgan | DinaBelova: or memcache isn't running | 15:27 |
| DinaBelova | morgan I have all in one devstack VM with memcached running | 15:27 |
| bknudson | ayoung: I'm fine with it either way. It's passing tempest now so this will stop tempest adding any tests that don't work with fernet | 15:28 |
| DinaBelova | I can connect to it and grab stats for instance | 15:28 |
| morgan | ok, and are you accessing via 127.0.x.x or via public facing interface? | 15:28 |
| morgan | for keystone and/or when you connect to it? | 15:28 |
| ayoung | bknudson, there are still issues with trusts. THe latest patch ... | 15:28 |
| ayoung | https://review.openstack.org/#/c/258650/ | 15:28 |
| patchbot | ayoung: patch 258650 - keystone - [WIP]Make fernet default token provider | 15:28 |
| morgan | [i figure you've gotten that all sussed out but i know sometimes it's just a 2x check to be sure) | 15:28 |
| bknudson | there must not be any tempest tests for trusts | 15:28 |
| DinaBelova | morgan keystone uses public memcache_servers = 10.0.2.15:11211 | 15:28 |
| morgan | ok cool. | 15:29 |
| DinaBelova | lemme try to do the same myself | 15:29 |
| *** jsavak has quit IRC | 15:29 | |
| morgan | ok :) | 15:29 |
| ayoung | failures are on test_delete_tokens_for_user_invalidates_tokens_from_trust fail | 15:29 |
| ayoung | test_delete_trust_revokes_token test_token_from_trust_cant_get_another_token test_trust_get_token_fails_if_trustee_disabled | 15:29 |
| bknudson | https://review.openstack.org/#/c/258650/ shows that fernet is totally broken... it's not just a few minor changes | 15:29 |
| patchbot | bknudson: patch 258650 - keystone - [WIP]Make fernet default token provider | 15:29 |
| *** sdake has joined #openstack-keystone | 15:29 | |
| *** dave-mcc_ has joined #openstack-keystone | 15:30 | |
| ayoung | I thought raildo was driving that one home. raildo are you working on Fernet-by-default or do you need me to help there? | 15:30 |
| *** jsavak has joined #openstack-keystone | 15:30 | |
| bknudson | I guess it also includes a bunch of unrelated changes, too. | 15:30 |
| *** sdake_ has quit IRC | 15:30 | |
| *** EinstCrazy has quit IRC | 15:31 | |
| *** dave-mccowan has quit IRC | 15:32 | |
| DinaBelova | morgan it looks like it was something wrong with the connection from keystone to the memcached - I've restarted keystone and now it seems to connect and use memcached ok | 15:33 |
| ayoung | bknudson, yeah, there are 3 distinct issues | 15:33 |
| DinaBelova | as you explained | 15:33 |
| DinaBelova | interesting | 15:33 |
| ayoung | 1 trust revocations | 15:33 |
| ayoung | 2 group | 15:33 |
| morgan | DinaBelova: :) | 15:33 |
| ayoung | and 3 admin_token | 15:33 |
| morgan | DinaBelova: Yay, happy it is working for you now. | 15:34 |
| DinaBelova | morgan me too! | 15:34 |
| ayoung | none look horrible, I just have not addressed them yet. Trust ones are, I think, the trickiest to deal. Would love to knock that out before summit | 15:34 |
| DinaBelova | so we're left with the authtoken middleware thing | 15:34 |
| morgan | DinaBelova: that is a bit of a different beast. | 15:34 |
| DinaBelova | morgan indeed | 15:34 |
| morgan | DinaBelova: i know jamielennox|away is trying to move it to oslo.cache | 15:34 |
| morgan | DinaBelova: which would be at least a little easier | 15:35 |
| DinaBelova | morgan ack, thank you sir | 15:36 |
| *** ametts has quit IRC | 15:36 | |
| ayoung | bknudson, ah, one other issue too, now that I look: test_domain_scoped_token_is_invalid_after_deleting_grant Which is on the Fernet tests themselves. | 15:37 |
| ayoung | that one is, I think, OK, IFF the user had a second assignment on the same project. It means that the token would be valid, but have a smaller set of roles | 15:37 |
| bknudson | y, interesting | 15:38 |
| bknudson | it's different for fernet vs uuid | 15:38 |
| morgan | bknudson: i think we should make uuid store the same data as the fernet payload and just reconstruct the token like we do with fernet | 15:39 |
| *** stingaci has joined #openstack-keystone | 15:39 | |
| morgan | bknudson: the difference is that the uuid is the DB key vs the actual payload. | 15:40 |
| bknudson | morgan: me too. somebody has to do the work | 15:40 |
| morgan | bknudson: i think lbragstad was working on that and got some of it done | 15:40 |
| *** sdake_ has joined #openstack-keystone | 15:40 | |
| *** sdake has quit IRC | 15:43 | |
| jdandrea | On our cluster, adminurls are only reachable by a private network (10.1.1.1), inaccessible to VMs. Meanwhile, I have a service that is in a VM and needs to make admin requests of Keystone. If the adminurls can't be changed, are there any known workarounds? Using python-keystoneclient. | 15:45 |
| jdandrea | (By which I mean the python modules, not the CLI.) | 15:45 |
| dstanek | bknudson: so competing renaming proposals | 15:46 |
| bknudson | dstanek: there were, now there aren't as far as I know. | 15:46 |
| bknudson | unless you've got your own ideas for where to put code | 15:47 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for endpoint policy drivers https://review.openstack.org/212006 | 15:47 |
| dstanek | bknudson: ah i see that rderose_'s won. i'm not a fan of base.py, but i'll get over it | 15:51 |
| bknudson | dstanek: now is a good time to pick a better name. | 15:51 |
| rderose_ | dstanek: I'm open, what do you have in mind? | 15:51 |
| bknudson | it was renamed to interface in a different part | 15:51 |
| bknudson | and I think interface is descriptive | 15:52 |
| samueldmq | bknudson: ++ | 15:52 |
| bknudson | although it contains stuff other than the interface now like common functions | 15:52 |
| rderose_ | bknudson: yeah, I went back and forth from interface to base | 15:52 |
| dstanek | i was thinking some along interface since that's what it is. | 15:52 |
| dstanek | it really shouldn't be a base implememtation right? | 15:52 |
| rderose_ | dstanek: yeah | 15:53 |
| bknudson | it should be an interface, unfortunately the identity interface contains other junk. | 15:53 |
| dstanek | bknudson: delete it! | 15:53 |
| bknudson | I'll add it to my list of things to do... should get to it around 2020. | 15:54 |
| rderose_ | dstanek bknudson: technically, it is an abstract base class, so I was finally comfortable with base.py | 15:54 |
| rderose_ | dstanek bknudson: but if you guys feel strongly about it, I'm willing to change to interface | 15:54 |
| * morgan nitpicks. | 15:55 | |
| bknudson | I don't feel strongly about it. | 15:55 |
| jdandrea | How do I do an endpoint_override when authenticating in keystoneclient.v2_0.tokens? (Which kwargs and what values?) | 15:55 |
| morgan | i'm good with whichever | 15:55 |
| morgan | personally | 15:55 |
| * jdandrea is currently tracing through keystoneauth1/session.py ... | 15:55 | |
| rderose_ | bknudson: cool | 15:55 |
| bknudson | I feel strongly about being consistent among the different components | 15:55 |
| morgan | bknudson: +∞ | 15:56 |
| samueldmq | morgan: does '?' equals to 1, 2 or A ? | 15:56 |
| samueldmq | :) | 15:56 |
| dstanek | maybe we need a spec or something to define what the names should be and what they should hold | 15:56 |
| rderose_ | bknudson: re: docs, are you saying reference the current location keystone.assignment.core.AssignmentDriverV8 | 15:57 |
| rderose_ | instead of: keystone.assignment.core.backends.base.AssignmentDriverV8 | 15:57 |
| morgan | samueldmq: infinity | 15:57 |
| dstanek | doing a rename without a path isn't useful because it'll be renamed next cycle | 15:57 |
| samueldmq | dstanek: maybe, or just update developer docs | 15:57 |
| rderose_ | bknudson: or, are you talking about the version? | 15:57 |
| bknudson | rderose_: yes, the docs need to reference where the files are now. | 15:57 |
| samueldmq | dstanek: which is what rderose_ is doing | 15:57 |
| rderose_ | bknudson: ah, okay | 15:57 |
| dstanek | samueldmq: a spec? | 15:57 |
| rderose_ | thx | 15:57 |
| bknudson | rderose_: :class: needs to reference a class that exists, so that it's a link that I can click on. | 15:57 |
| morgan | samueldmq: your client/terminal doesn't see the utf-8 char | 15:57 |
| dstanek | oh, developer docs | 15:58 |
| samueldmq | morgan: weechat :( | 15:58 |
| samueldmq | morgan: maybe I need to configure it, if possible | 15:58 |
| samueldmq | dstanek: yep | 15:58 |
| samueldmq | dstanek: rderose_'s on it, so we can agree on the docs first, and then propagate the cahnges to all subsystems | 15:59 |
| morgan | samueldmq: depends on your terminal/etc. | 16:00 |
| morgan | samueldmq: i'm on OS X atm, so it's there. | 16:00 |
| morgan | samueldmq: and i use weechat as well | 16:00 |
| samueldmq | morgan: I use terminator | 16:01 |
| *** jsavak has quit IRC | 16:03 | |
| DinaBelova | morgan I've decided to rerun all measurements for Mitaka just in case I was affected by the same stuff for authtoken middleware | 16:03 |
| DinaBelova | morgan just in case | 16:03 |
| DinaBelova | will ping you back tomorrow | 16:04 |
| samueldmq | morgan: looks like it's my weechat, locally my terminal can print infinity symbol | 16:05 |
| samueldmq | morgan: or maybe it's the locale settings in the vm I'm connected on | 16:05 |
| *** jsavak has joined #openstack-keystone | 16:05 | |
| *** dan_nguyen has joined #openstack-keystone | 16:09 | |
| morgan | DinaBelova: sounds good | 16:09 |
| raildo | ayoung: I'm still working on that, but I appreciate any help on it. | 16:09 |
| *** jistr has quit IRC | 16:10 | |
| *** anush_ has joined #openstack-keystone | 16:13 | |
| ayoung | raildo, OK...I'll give it a hack in abit | 16:14 |
| raildo | ayoung: thank you | 16:14 |
| *** mylu has quit IRC | 16:14 | |
| *** henrynash has quit IRC | 16:15 | |
| *** real56 has joined #openstack-keystone | 16:15 | |
| *** dflorea has joined #openstack-keystone | 16:17 | |
| *** anush_ has quit IRC | 16:17 | |
| dims | DinaBelova : so...what's the summary? is there a show stopper for Mitaka? | 16:18 |
| *** dflorea has quit IRC | 16:18 | |
| DinaBelova | dims for internal keystone cache - nope | 16:19 |
| DinaBelova | for authtoken middleware I need to rerun measurement | 16:19 |
| DinaBelova | measurements* | 16:19 |
| DinaBelova | will keep you guys tuned - and I'll update you tomorrow | 16:19 |
| dims | DinaBelova : i see 2 bugs opened, is one of them invalid? | 16:19 |
| DinaBelova | yes, I'll mark it as invalid now | 16:20 |
| dims | thanks Dina! | 16:20 |
| *** mylu has joined #openstack-keystone | 16:20 | |
| dims | amakarov : DinaBelova : "authtoken middleware" is that devstack only issue? or both devstack and MOS? | 16:21 |
| DinaBelova | dims I'll install MOS tomorrow with the freshest ISO with the latest sync with stable/,itaka | 16:21 |
| DinaBelova | *mitaka | 16:21 |
| DinaBelova | so dunno yet | 16:21 |
| DinaBelova | I wanted to get todays sync in place | 16:21 |
| dims | ack thanks DinaBelova | 16:22 |
| *** dflorea has joined #openstack-keystone | 16:24 | |
| *** woodster_ has joined #openstack-keystone | 16:25 | |
| breton | i am checking the issue with cache in ksm | 16:27 |
| *** roxanaghe has quit IRC | 16:28 | |
| *** daemontool has quit IRC | 16:28 | |
| *** mhickey has quit IRC | 16:28 | |
| *** jistr has joined #openstack-keystone | 16:28 | |
| *** browne has joined #openstack-keystone | 16:28 | |
| *** diazjf has quit IRC | 16:30 | |
| *** trown is now known as trown|lunch | 16:30 | |
| breton | morgan: it seems that memcache as cache backend in ksm doesn't work. | 16:32 |
| breton | morgan: because cache set is not performed | 16:32 |
| breton | morgan: and we don't check return value of set() | 16:32 |
| *** pushkaru has quit IRC | 16:32 | |
| morgan | breton: yeah i haven't looked at the KSM bits in a while - it also is a different config from what we use (it's super super basic). | 16:33 |
| *** diazjf has joined #openstack-keystone | 16:33 | |
| morgan | in keystone server (it doesn't use dogpile). we should move it to handling things via memoization | 16:33 |
| breton | oh no, wait a minute | 16:34 |
| *** jistr is now known as jistr|off | 16:34 | |
| breton | it's a different bug | 16:34 |
| morgan | breton: it should work. but the config is very very different/weird. | 16:34 |
| morgan | comparitively | 16:34 |
| morgan | hence the move to dogpile and oslo.cache would be good. | 16:34 |
| *** roxanaghe has joined #openstack-keystone | 16:34 | |
| breton | morgan: we already moved to oslo_cache in ksm afaik | 16:35 |
| morgan | breton: no i think we haven't fully. we do some wonky interface things. | 16:39 |
| morgan | so it's not *really* using oslo_cache the way you should. | 16:39 |
| morgan | and we should move to @memoize imo | 16:39 |
| breton | when HOST_IP is set, devstack sets this ip to memcache_service and memcache doesn't listen to on this ip | 16:39 |
| *** doug-fish has quit IRC | 16:40 | |
| breton | *memcache_server | 16:40 |
| *** stingaci has quit IRC | 16:40 | |
| *** doug-fish has joined #openstack-keystone | 16:40 | |
| *** jasonsb has quit IRC | 16:42 | |
| morgan | breton: so lets look at fixing devstack :) | 16:43 |
| *** lhcheng has joined #openstack-keystone | 16:44 | |
| *** ChanServ sets mode: +v lhcheng | 16:44 | |
| *** roxanaghe has quit IRC | 16:44 | |
| *** doug-fish has quit IRC | 16:45 | |
| *** c_soukup has joined #openstack-keystone | 16:46 | |
| *** roxanaghe has joined #openstack-keystone | 16:46 | |
| *** csoukup has quit IRC | 16:49 | |
| *** c_soukup has quit IRC | 16:50 | |
| *** david_cu_ has joined #openstack-keystone | 16:54 | |
| *** mylu has quit IRC | 16:54 | |
| *** dflorea has quit IRC | 16:54 | |
| *** david_cu has quit IRC | 16:55 | |
| *** ayoung has quit IRC | 16:59 | |
| *** dflorea has joined #openstack-keystone | 17:00 | |
| *** spandhe has quit IRC | 17:03 | |
| *** diazjf has quit IRC | 17:03 | |
| *** jsavak has quit IRC | 17:04 | |
| *** stingaci has joined #openstack-keystone | 17:06 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:14 | |
| *** jsavak has joined #openstack-keystone | 17:15 | |
| *** real56 has quit IRC | 17:16 | |
| *** e0ne has quit IRC | 17:17 | |
| *** real56 has joined #openstack-keystone | 17:17 | |
| *** marg7175 has quit IRC | 17:20 | |
| *** marg7175 has joined #openstack-keystone | 17:20 | |
| *** dflorea has quit IRC | 17:20 | |
| *** sdake_ is now known as sdake | 17:21 | |
| *** doug-fish has joined #openstack-keystone | 17:24 | |
| *** dflorea has joined #openstack-keystone | 17:25 | |
| *** jsavak has quit IRC | 17:26 | |
| *** jsavak has joined #openstack-keystone | 17:26 | |
| *** sdake_ has joined #openstack-keystone | 17:29 | |
| *** sdake has quit IRC | 17:29 | |
| *** spandhe has joined #openstack-keystone | 17:30 | |
| *** tqtran has joined #openstack-keystone | 17:32 | |
| *** mylu has joined #openstack-keystone | 17:32 | |
| *** ayoung has joined #openstack-keystone | 17:33 | |
| *** ChanServ sets mode: +v ayoung | 17:33 | |
| openstackgerrit | Cristian Sava proposed openstack/keystone: Customize config file location when run as wsgi app. https://review.openstack.org/288216 | 17:37 |
| *** ayoung has quit IRC | 17:38 | |
| *** ayoung has joined #openstack-keystone | 17:39 | |
| *** ChanServ sets mode: +v ayoung | 17:39 | |
| *** pnavarro has quit IRC | 17:42 | |
| *** sdake has joined #openstack-keystone | 17:42 | |
| *** david-lyle has quit IRC | 17:44 | |
| *** sdake_ has quit IRC | 17:44 | |
| *** marg7175 has quit IRC | 17:48 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 17:52 | |
| *** ayoung has quit IRC | 17:52 | |
| *** trown|lunch is now known as trown | 17:53 | |
| *** vgridnev has joined #openstack-keystone | 17:53 | |
| *** dflorea has quit IRC | 17:55 | |
| *** rcernin has quit IRC | 17:56 | |
| openstackgerrit | Merged openstack/keystone: Remove backend interface and common code out of identity.core https://review.openstack.org/296140 | 17:56 |
| *** dflorea has joined #openstack-keystone | 17:58 | |
| *** timcline has joined #openstack-keystone | 18:02 | |
| *** david-lyle has joined #openstack-keystone | 18:02 | |
| *** timcline has quit IRC | 18:03 | |
| *** jsavak has quit IRC | 18:03 | |
| *** timcline has joined #openstack-keystone | 18:04 | |
| *** e0ne has joined #openstack-keystone | 18:04 | |
| *** stingaci has quit IRC | 18:05 | |
| *** sshen has quit IRC | 18:06 | |
| *** sshen has joined #openstack-keystone | 18:07 | |
| *** doug-fis_ has joined #openstack-keystone | 18:11 | |
| *** stingaci has joined #openstack-keystone | 18:12 | |
| *** doug-fi__ has joined #openstack-keystone | 18:12 | |
| *** e0ne has quit IRC | 18:14 | |
| *** doug-fish has quit IRC | 18:14 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Dev doc update for moving abstract base classes out of core https://review.openstack.org/302317 | 18:14 |
| *** doug-fish has joined #openstack-keystone | 18:15 | |
| *** doug-fis_ has quit IRC | 18:15 | |
| *** doug-fi__ has quit IRC | 18:17 | |
| *** zqfan has quit IRC | 18:22 | |
| *** e0ne has joined #openstack-keystone | 18:24 | |
| *** dflorea has quit IRC | 18:27 | |
| *** ayoung has joined #openstack-keystone | 18:29 | |
| *** ChanServ sets mode: +v ayoung | 18:29 | |
| openstackgerrit | Merged openstack/keystone: Update the description of the role driver option https://review.openstack.org/302118 | 18:30 |
| *** real56 has quit IRC | 18:30 | |
| *** dflorea has joined #openstack-keystone | 18:30 | |
| *** jsavak has joined #openstack-keystone | 18:31 | |
| *** GB21 has quit IRC | 18:32 | |
| *** pushkaru has joined #openstack-keystone | 18:33 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/302398 | 18:33 |
| *** rderose_ has quit IRC | 18:34 | |
| stevemar | thanks bot ^ | 18:34 |
| morgan | hehe | 18:34 |
| *** dflorea has quit IRC | 18:35 | |
| *** dflorea has joined #openstack-keystone | 18:35 | |
| *** mvk_ has quit IRC | 18:35 | |
| openstackgerrit | Merged openstack/keystone: Update the Administrator guide link https://review.openstack.org/302201 | 18:38 |
| stevemar | bknudson: you are almost done all your deployment changes | 18:39 |
| stevemar | just 2 left | 18:39 |
| *** jsavak has quit IRC | 18:39 | |
| bknudson | stevemar: then the real fun begins | 18:39 |
| *** jsavak has joined #openstack-keystone | 18:40 | |
| bknudson | e.g., no ports | 18:40 |
| bknudson | and figuring out the tls_proxy deploy | 18:40 |
| *** timcline has quit IRC | 18:45 | |
| *** e0ne has quit IRC | 18:46 | |
| dstanek | bknudson: is that request id wrapping what other projects are doing? | 18:48 |
| stevemar | bknudson: and the project-config changes | 18:48 |
| bknudson | dstanek: there's a cross-project spec... I'll see if I can find it. | 18:48 |
| bknudson | dstanek: http://specs.openstack.org/openstack/openstack-specs/specs/return-request-id.html | 18:48 |
| dstanek | thx | 18:49 |
| bknudson | I still think we need an opt-in for keystoneclient, since everything kept breaking whenever we changed the return type. | 18:50 |
| dstanek | this seems so fragile and wrong | 18:50 |
| *** tellesnobrega is now known as tellesnobrega_af | 18:50 | |
| *** tellesnobrega_af is now known as tellesnobrega | 18:51 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone-specs: Credential Encryption https://review.openstack.org/284950 | 18:51 |
| morgan | i kindof wish that could have just been baked into session | 18:52 |
| *** rderose has joined #openstack-keystone | 18:52 | |
| morgan | rather than the way it is being implemented. | 18:52 |
| bknudson | I offered up a few different ways to do it but this is what was agreed to. | 18:53 |
| dstanek | i actually see the step #1 as good enough | 18:53 |
| morgan | bknudson: yeah it just feels ... odd. | 18:53 |
| samueldmq | dstanek: hi, re: https://review.openstack.org/#/c/212957/7/keystone/tests/unit/backend/policy/test_sql.py | 18:53 |
| patchbot | samueldmq: patch 212957 - keystone - Create unit tests for the policy drivers | 18:53 |
| dstanek | if we wanted a response-style object that's what we should be returning. this is just a hack | 18:53 |
| morgan | i'd totally like to just have it be something they get as a side effect of using ksa.session | 18:53 |
| samueldmq | dstanek: are you refering to the comment? or to the test? | 18:53 |
| morgan | which the response object could have it then. | 18:54 |
| *** dflorea has quit IRC | 18:54 | |
| *** diazjf has joined #openstack-keystone | 18:54 | |
| dstanek | morgan: yep. resp.value, resp.request_id, etc.... a request_id isn't an attribute of a list | 18:54 |
| morgan | dstanek: since this was "agreed" to.. i am staying out of it. | 18:55 |
| morgan | i frankly refused to review it. | 18:55 |
| morgan | because this is so hacky. | 18:55 |
| morgan | review = score in this case. | 18:55 |
| morgan | but i also missed the comment time where it was agreed upon | 18:56 |
| morgan | so i would feel bad blocking it. | 18:56 |
| dstanek | morgan: i've been comfortable giving -1s :-) | 18:56 |
| *** jsavak has quit IRC | 18:56 | |
| morgan | hehe | 18:56 |
| morgan | lets metaclass up the low level objects. | 18:56 |
| morgan | #nope | 18:56 |
| *** jsavak has joined #openstack-keystone | 18:57 | |
| *** rderose has quit IRC | 18:57 | |
| dstanek | samueldmq: i think i was just poking fun at our need to test the table structure :-) that's why i didn't actually score it | 18:58 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for endpoint policy drivers https://review.openstack.org/212006 | 18:58 |
| *** mylu has quit IRC | 18:59 | |
| *** dflorea_ has joined #openstack-keystone | 18:59 | |
| *** vgridnev has quit IRC | 19:00 | |
| *** mylu has joined #openstack-keystone | 19:01 | |
| *** vgridnev has joined #openstack-keystone | 19:01 | |
| *** vgridnev has quit IRC | 19:02 | |
| *** diazjf has quit IRC | 19:04 | |
| *** diazjf has joined #openstack-keystone | 19:04 | |
| *** agrebennikov has joined #openstack-keystone | 19:05 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for the policy drivers https://review.openstack.org/212957 | 19:07 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move identity.backends.sql model code to sql_model.py https://review.openstack.org/292611 | 19:10 |
| mnaser | hi everyone, is there a possible way operating under the v2 model to allow a user to create other users for the same tenant? | 19:10 |
| mnaser | ex: mnaser is part of tenantA with role tenant_admin, mnaser can create a user which has access to tenantA only (and that user does not have tenant_admin role for example) | 19:11 |
| morgan | mnaser: create a user? not really in V2 since V2 only has "admin" and "member" roles, not the richer RBAC capability fo v3 | 19:16 |
| *** ayoung has quit IRC | 19:16 | |
| morgan | it's really mostly a v3 semantic you're describing | 19:16 |
| *** ayoung has joined #openstack-keystone | 19:16 | |
| *** ChanServ sets mode: +v ayoung | 19:16 | |
| morgan | with domains. | 19:16 |
| mnaser | i figured :( it's just a bit difficult to switch this particular customer to domains | 19:16 |
| *** klindgren has left #openstack-keystone | 19:17 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move identity.backends.sql model code to sql_model.py https://review.openstack.org/292611 | 19:17 |
| morgan | yeah. =/ | 19:17 |
| *** sheel has quit IRC | 19:17 | |
| mnaser | basically right now subaccounts in our billing system use the same credentials as main user | 19:17 |
| mnaser | so larger customers with multiple users would rather have credentials broken down to small sectors (domain per user would be the ideal, but we're not there yet) | 19:18 |
| mnaser | federated auth to access tenant would be ideal | 19:19 |
| * mnaser goes to read more blueprints | 19:19 | |
| samueldmq | dstanek: cool :-) | 19:19 |
| *** rderose has joined #openstack-keystone | 19:19 | |
| *** e0ne has joined #openstack-keystone | 19:20 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Define identity interface - easy cases https://review.openstack.org/291950 | 19:20 |
| *** stingaci has quit IRC | 19:20 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Opportunistic LDAP testing https://review.openstack.org/300237 | 19:22 |
| *** dflorea_ has quit IRC | 19:24 | |
| mnaser | is there a (supported or possible) way of moving a tenant into their own domain? | 19:24 |
| *** dflorea has joined #openstack-keystone | 19:25 | |
| *** stingaci has joined #openstack-keystone | 19:25 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move identity.backends.sql model code to sql_model.py https://review.openstack.org/292611 | 19:28 |
| *** dflorea_ has joined #openstack-keystone | 19:29 | |
| *** dflorea has quit IRC | 19:29 | |
| *** dancn has quit IRC | 19:31 | |
| *** ametts has joined #openstack-keystone | 19:31 | |
| *** mvk_ has joined #openstack-keystone | 19:31 | |
| *** tellesnobrega is now known as tellesnobrega_af | 19:35 | |
| *** tellesnobrega_af is now known as tellesnobrega | 19:35 | |
| raildo | mnaser: what you want to say with moving a tenant into their own domain? a tenant (in v2) only know about the domain default. we don't have the domain concept in v2 | 19:35 |
| mnaser | raildo: well, assuming that the tenant would drop v2 to v3, but we want to get them into their own domain in v3 | 19:36 |
| mnaser | instead of being on the default domain | 19:36 |
| *** mylu has quit IRC | 19:36 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for the policy drivers https://review.openstack.org/212957 | 19:36 |
| samueldmq | dstanek: ^ | 19:36 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for endpoint policy drivers https://review.openstack.org/212006 | 19:38 |
| samueldmq | dstanek: ^ this is a similar thing, but to the endpoint_policy subsystem | 19:38 |
| samueldmq | dstanek: thanks for the reviews :) | 19:38 |
| *** dflorea_ has quit IRC | 19:40 | |
| raildo | mnaser:got it, in fact, we deprecated the update the domain_id in liberty, so yes, you can update domain_id for now | 19:40 |
| raildo | mnaser: https://github.com/openstack/keystone/blob/master/keystone/resource/core.py#L373-L377 | 19:40 |
| raildo | mnaser: ops not liberty, it was deprecated in mitaka | 19:41 |
| mnaser | raildo: so a simple PUT request will let you change domain_id if i understand correctly | 19:41 |
| raildo | mnaser: yes | 19:41 |
| mnaser | interesting, the only thing is that this would break the API for the customer | 19:42 |
| mnaser | because they have to update everything to v3 | 19:42 |
| *** rk4n_ has joined #openstack-keystone | 19:42 | |
| raildo | mnaser: http://developer.openstack.org/api-ref-identity-v3.html#updateProject | 19:42 |
| *** pushkaru has quit IRC | 19:42 | |
| *** pumarani__ has joined #openstack-keystone | 19:42 | |
| mnaser | thats ideal, i think i'll get the customers to move all their endpoints to v3 | 19:43 |
| raildo | mnaser: update to v3 it's something that the customers needs to do, since API v2.0 was deprecated in mitaka too | 19:43 |
| mnaser | and once that's all done, then we can update their domain and they'll just move off the default domain | 19:43 |
| raildo | mnaser: sounds a good plan :) | 19:44 |
| *** rk4n has quit IRC | 19:44 | |
| mnaser | raildo: unfortunately the UX isn't great (or i've struggled) to have a config that worked for the openstack client as well as the other clients (nova/glance/etc) | 19:44 |
| mnaser | it's kinda been one-or-the-other | 19:44 |
| *** mylu has joined #openstack-keystone | 19:45 | |
| raildo | mnaser: can you be more specific about this UX issue? it's something related to domains, or v3? | 19:45 |
| raildo | mnaser: you just need a few changes to get v3 working on openstackclient | 19:46 |
| mnaser | for example, right now i have a file that exports OS_AUTH_URL, OS_USERNAME, OS_PASSWORD and OS_TENANT_NAME .. when i try to have OS_AUTH_URL with no suffix (v2 or v3), `openstack server list` works fine, `nova list` gives a 404 | 19:46 |
| *** timcline has joined #openstack-keystone | 19:46 | |
| mnaser | as it looks like it tries to do a GET on / with X-Auth-{Key,Project-Id,User} headers | 19:47 |
| mnaser | where the openstack client hits the /, then decides to contact /v3/auth/tokens | 19:47 |
| mnaser | Even when I upgrade to latest novaclient now, it's happening | 19:48 |
| raildo | to get openstack client with v3, you just need set the OS_IDENDITY_API_VERSION=3 and OS_AUTH_URL with v3 sufix, maybe novaclient have some internal v2 reference and you're having this problem | 19:50 |
| *** aswadr_ has quit IRC | 19:50 | |
| *** e0ne has quit IRC | 19:50 | |
| samueldmq | bknudson: about patch 289306 | 19:50 |
| patchbot | samueldmq: https://review.openstack.org/#/c/289306/ - python-keystoneclient - Add users functional tests | 19:50 |
| raildo | mnaser: but there is a couple of v3 switch tutorials on internet, which can be useful for you | 19:50 |
| bknudson | if you're using openstackclient then you should create a clouds.yaml and use that | 19:51 |
| samueldmq | bknudson: I find it bad to have 2 separate test classes: 1 that uses fixtures and other that doesn't | 19:51 |
| *** timcline has quit IRC | 19:51 | |
| bknudson | samueldmq: don't you think it's bad to have a test creating a bunch of stuff it doesn't need? | 19:51 |
| samueldmq | bknudson: I think too, then I propose we step back | 19:52 |
| bknudson | this is why the keystone unit tests take so long to run. They create all sorts of junk they don't use. | 19:52 |
| samueldmq | bknudson: and make the tests create what they need | 19:52 |
| mnaser | i tried to do my fair share of checking, couldn't find a reference for using python-{nova,glance,*}client with the v3. using OS_IDENTITY_API_VERSION=3 + OS_AUTH_URL=http://..../v3 gives a 404 as it's not trying to auth | 19:52 |
| bknudson | samueldmq: works for me... didn't I suggest that? | 19:52 |
| samueldmq | bknudson: without using fixtures | 19:52 |
| bknudson | samueldmq: individual tests can create fixtures. | 19:52 |
| samueldmq | bknudson: tests are too simple anyways | 19:52 |
| bknudson | I mean can use fixtures to create things | 19:52 |
| bknudson | tests are supposed to be simple!!!! | 19:53 |
| samueldmq | bknudson: using the 'fixtures' thing ? | 19:53 |
| bknudson | the fixture makes the test simpler since then the test doesn't have to specify the teardown | 19:53 |
| samueldmq | bknudson: if I call | 19:55 |
| bknudson | functional tests can get complicated if we want them to... it would be handy to have a sample that performs a lot of operations | 19:55 |
| samueldmq | fixture = test_fixtures.UserGroupFixture(self.client, | 19:55 |
| samueldmq | self.project_domain_id) | 19:55 |
| samueldmq | self.useFixture(fixture) | 19:55 |
| samueldmq | bknudson: in the test itself, it can't work, because setUp has already been run | 19:55 |
| bknudson | samueldmq: it does work. The fixture gets created and the cleanup is registered | 19:55 |
| samueldmq | bknudson: oh that's magic then, will update it | 19:56 |
| bknudson | it would be magic if useFixture only worked in setUp. | 19:56 |
| mnaser | should the OS_AUTH_URL be http://.../v3 or http://.../v3/auth ... because python-keystoneclient is making the request to /v3/tokens (or is it thinking it's using a v2 api?) | 19:57 |
| samueldmq | bknudson: I thought all setUp's were called at the beggining | 19:57 |
| mnaser | OS_IDENTITY_API_VERSION=3 as well | 19:57 |
| samueldmq | bknudson: but in fact fixtures' setUp may be called when we call useFixture | 19:57 |
| samueldmq | :) | 19:57 |
| bknudson | y, useFixture calls the fixture's setUp() | 19:58 |
| *** mylu has quit IRC | 19:59 | |
| *** roxanaghe has quit IRC | 20:00 | |
| *** rk4n has joined #openstack-keystone | 20:02 | |
| *** mkrcmari__ has joined #openstack-keystone | 20:03 | |
| *** mgagne_ is now known as mgagne | 20:04 | |
| *** rk4n_ has quit IRC | 20:05 | |
| *** mvk_ has quit IRC | 20:06 | |
| *** rcernin has joined #openstack-keystone | 20:09 | |
| *** pcaruana has quit IRC | 20:14 | |
| zigo | I got a big issue with the Debian packages and the keystone_authtoken. I hope someone in here can help me. | 20:18 |
| zigo | morgan: You maybe? | 20:18 |
| zigo | There's no admin_password and such in all the packages, so I'm guessing there's an issue in keystonemiddleware.auth_token and/or oslo.config | 20:19 |
| stevemar | zigo: admin_password and admin_user are old news | 20:21 |
| stevemar | we use the same arguments now as keystoneauth plugins | 20:22 |
| zigo | stevemar: Where have they gone then? | 20:22 |
| *** e0ne has joined #openstack-keystone | 20:22 | |
| zigo | stevemar: This broke all of my packages... :( | 20:22 |
| zigo | stevemar: Surprisingly, now glance-api.conf has admin_password in the [DEFAULT] section instead of [keystone_authtoken]. | 20:23 |
| zigo | stevemar: This changed over the last versions of keystonemiddleware or something? | 20:26 |
| zigo | stevemar: Like between 4.0.0 and 4.4.0 ? | 20:26 |
| stevemar | zigo: let me take a look, i'm positive we deprecated things, didn't think we removed it yet | 20:27 |
| *** mylu has joined #openstack-keystone | 20:27 | |
| *** e0ne has quit IRC | 20:28 | |
| *** dflorea has joined #openstack-keystone | 20:28 | |
| zigo | stevemar: I'm re-building Neutron with the older keystonemiddleware 4.0.0, to see if that fixes the issue. | 20:28 |
| *** pnavarro has joined #openstack-keystone | 20:30 | |
| zigo | stevemar: I'm seriously believing that this is my issue, as it matches the time where I did rebuild everything... | 20:30 |
| zigo | stevemar: BINGO !!! | 20:31 |
| zigo | stevemar: Version 4.0.0 generates the [keystone_authtoken] section correctly. | 20:31 |
| *** roxanaghe has joined #openstack-keystone | 20:32 | |
| *** dflorea has quit IRC | 20:33 | |
| zigo | stevemar: What would keystone people advise now? :/ | 20:34 |
| *** jsavak has quit IRC | 20:35 | |
| *** jsavak has joined #openstack-keystone | 20:36 | |
| *** sdake_ has joined #openstack-keystone | 20:37 | |
| stevemar | zigo: hmm, i wonder if this is related to the migration to keystoneauth | 20:37 |
| stevemar | zigo: both nova and neutron moved to keystoneauth in mitaka | 20:37 |
| *** timcline has joined #openstack-keystone | 20:37 | |
| zigo | stevemar: And Glance? | 20:37 |
| zigo | stevemar: It broke Glance too. | 20:37 |
| stevemar | not sure if others did | 20:37 |
| zigo | stevemar: And Ceilometer ? | 20:38 |
| stevemar | zigo: actually, as long as they are using keystonemiddleware it shouldn't matter | 20:38 |
| zigo | stevemar: What would you advise me to do then? | 20:39 |
| zigo | *all* is broken right now in Debian... :( | 20:39 |
| *** sdake has quit IRC | 20:39 | |
| zigo | Just the day before the release. | 20:39 |
| zigo | I'm tempted to go back to version 4.0.0 of keystonemiddleware. | 20:39 |
| stevemar | zigo: use the newer options, the ones not prefixed with "admin_" | 20:39 |
| zigo | stevemar: How do you define credentials then? | 20:40 |
| stevemar | let me pull up a working example | 20:40 |
| zigo | stevemar: Here's an example generated [keystone_authtoken] section which I currently have: http://paste.debian.net/425268/ | 20:41 |
| stevemar | zigo: http://paste.openstack.org/show/493233/ | 20:41 |
| dims | zigo : so when you run "tox -e genconfig"? | 20:41 |
| zigo | dims: That's a FAQ which I should somehow print on a t-shirt: we cannot and will never use tox in packaging. | 20:41 |
| dims | zigo : just asking what you use :) | 20:42 |
| zigo | stevemar: Here, you have a "username" directive. The thing is, it's *not* generated for glance, cinder, ceilometer, neutron, etc. | 20:42 |
| *** sdake has joined #openstack-keystone | 20:42 | |
| zigo | Which is the problem... | 20:42 |
| dims | zigo : there's a [keystone_authtoken] section but username is not there? | 20:43 |
| dims | how are you generating the config? | 20:43 |
| zigo | dims: I'm just manually calling oslo-config-generator with the correct options, and the PYTHONPATH=$(CURDIR)/debian/tmp/usr/lib/python2.7/dist-packages set correctly... | 20:43 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: Add users functional tests https://review.openstack.org/289306 | 20:43 |
| stevemar | zigo: mmm, it should be, provided they are using the recommended keystonemiddleware version | 20:44 |
| *** sdake_ has quit IRC | 20:44 | |
| zigo | Let me fetch an example... | 20:44 |
| *** trown is now known as trown|outtypewww | 20:44 | |
| *** spandhe has quit IRC | 20:44 | |
| samueldmq | bknudson: ^ updated | 20:44 |
| zigo | dims: stevemar: Here's an example of what I do to generate the config files of Glance: http://anonscm.debian.org/cgit/openstack/glance.git/tree/debian/rules | 20:45 |
| samueldmq | bknudson: I am not feeling too comfrtable with that fixture thing, and that's because I am thinking in terms of # of lines of code | 20:45 |
| zigo | I of course pickup the correct oslo-config-generator parameters from what I can see in tox.ini in the egenconfig section... | 20:45 |
| samueldmq | bknudson: rather than making the test code much simpler (because it doesnt' deal with tearDown things) | 20:45 |
| samueldmq | bknudson: and it does make sense :) | 20:45 |
| bknudson | samueldmq: don't think in terms of lines of code, think in terms of clarity and maintenance | 20:45 |
| zigo | stevemar: So, you agree we have an issue here, no? | 20:46 |
| zigo | stevemar: There should be at least "username" or something ... | 20:46 |
| samueldmq | bknudson: yes, I agree, just looking different from what I've done so far | 20:46 |
| samueldmq | bknudson: but I do agree it's a good thing | 20:46 |
| zigo | dims: Do you think you can help me fixing that issue? :) | 20:48 |
| *** bknudson has left #openstack-keystone | 20:49 | |
| *** bknudson has joined #openstack-keystone | 20:49 | |
| *** ChanServ sets mode: +v bknudson | 20:49 | |
| zigo | When I do: | 20:49 |
| zigo | oslo-config-generator --output-file test.conf --namespace keystonemiddleware.auth_token | 20:49 |
| zigo | Here's the result: | 20:49 |
| zigo | http://paste.openstack.org/show/493236/ | 20:49 |
| zigo | ie: no username, tenant-name/project-name, or password ... | 20:49 |
| zigo | IMO, there's a serious issue. | 20:49 |
| *** mvk has joined #openstack-keystone | 20:50 | |
| *** stingaci has quit IRC | 20:50 | |
| stevemar | zigo: related: https://github.com/openstack/keystonemiddleware/commit/f0965c955dba16afaf350e65de2db68dc2c35c50 | 20:51 |
| stevemar | zigo: that went into 4.4.0 and 4.3.0 | 20:51 |
| *** mkrcmari__ has quit IRC | 20:52 | |
| zigo | stevemar: Thanks. I may revert that commit in Debian for now then. | 20:52 |
| *** rderose_ has joined #openstack-keystone | 20:52 | |
| zigo | stevemar: That's super helpful, and may save my release !!! :) | 20:52 |
| stevemar | zigo: i would still like to dig in and see why you are seeing what you're seeing | 20:52 |
| zigo | stevemar: What should be the correct behavior? | 20:53 |
| zigo | stevemar: Should I expect to see, for example, a [keystone_authtoken]username ? | 20:53 |
| stevemar | zigo: basically keystonemiddleware had the old admin_ options, but we want people to be able to use any keystone plugin (from keystoneauth) | 20:53 |
| stevemar | zigo: yes, that should be the correct way | 20:54 |
| zigo | Well, it's not there ... :( | 20:54 |
| stevemar | for some reason, in your last paste, none of the auth options are there | 20:54 |
| stevemar | zigo: what are the keystoneauth, keystonemiddleware and oslo.config versions you are using? | 20:54 |
| stevemar | jamielennox could probably figure this out in 2 minutes, but $timezones, you're stuck with me | 20:55 |
| *** rderose has quit IRC | 20:55 | |
| *** rk4n has quit IRC | 20:56 | |
| zigo | python-keystoneauth1 2.4.0, keystonemiddleware 4.4.0, oslo.config 3.9.0 | 20:56 |
| *** dflorea has joined #openstack-keystone | 20:56 | |
| *** knikolla has quit IRC | 20:57 | |
| stevemar | zigo: yep... those are all good | 20:57 |
| zigo | stevemar: That's the latest from upper-constraints.txt from last week-end. | 20:57 |
| *** diazjf1 has joined #openstack-keystone | 20:58 | |
| *** spandhe has joined #openstack-keystone | 20:58 | |
| stevemar | yep, just looked at that exact file :) | 20:58 |
| zigo | stevemar: I'm trying to revert the patch you sent URL to, and see what's the behavior, if I get things working again. | 20:59 |
| stevemar | zigo: and your parameters to oslo config generator match that of here: https://github.com/openstack/glance/blob/master/etc/oslo-config-generator/glance-api.conf | 20:59 |
| zigo | stevemar: It sure does ! | 20:59 |
| *** diazjf has quit IRC | 20:59 | |
| stevemar | looking at http://paste.openstack.org/show/493236/ it seems like the keystoneauth options are not listed there | 21:00 |
| zigo | Right. | 21:01 |
| *** stingaci has joined #openstack-keystone | 21:02 | |
| *** raildo is now known as raildo-afk | 21:02 | |
| *** tlbr has joined #openstack-keystone | 21:02 | |
| *** dancn has joined #openstack-keystone | 21:02 | |
| *** diazjf1 has quit IRC | 21:03 | |
| *** jistr|off has quit IRC | 21:04 | |
| *** pauloewerton has quit IRC | 21:05 | |
| dims | zigo : i bet the actual configuration just works fine, you just don't see it in the generated sample | 21:05 |
| dims | right? | 21:05 |
| *** diazjf has joined #openstack-keystone | 21:05 | |
| zigo | dims: It doesn't work at all, as it doesn't included the needed parameters. | 21:05 |
| dims | "doesn't work at all".... i am trying to nail it down to specifics. if you use the params like you used to, does it fail? | 21:07 |
| dims | at runtime | 21:07 |
| dims | not config sample generation | 21:07 |
| *** mvk_ has joined #openstack-keystone | 21:08 | |
| *** jsavak has quit IRC | 21:09 | |
| zigo | dims: Because of the wrong config, the packages aren't deployed correctly on my Tempest CI, and it completely fails. | 21:09 |
| zigo | dims: ie, services can't auth against keystone. | 21:10 |
| dims | zigo : what's the error in tempest? | 21:10 |
| *** mvk has quit IRC | 21:10 | |
| *** jmlowe has quit IRC | 21:10 | |
| rodrigods | bknudson, thanks for the review :) | 21:10 |
| rodrigods | very thorough review | 21:11 |
| zigo | dims: It declares itself when I try to do a "neutron net-list" in my CI, though all of my packages have the issue since I upgrading keystonemiddleware last Monday, before rebuilding all service packages. | 21:12 |
| zigo | dims: https://mitaka-jessie.pkgs.mirantis.com/job/openstack-tempest-ci/65/consoleFull | 21:12 |
| *** pnavarro has quit IRC | 21:12 | |
| zigo | Neutron doing an error 500 ... | 21:12 |
| *** knikolla has joined #openstack-keystone | 21:13 | |
| *** doug-fish has quit IRC | 21:13 | |
| zigo | stevemar: Reverting that patch isn't enough to get back on my feets... | 21:13 |
| *** doug-fish has joined #openstack-keystone | 21:13 | |
| *** doug-fish has quit IRC | 21:14 | |
| *** doug-fish has joined #openstack-keystone | 21:14 | |
| dims | zigo : what's in the neutron api log? | 21:15 |
| zigo | dims: That it doesn't know the protocol. | 21:15 |
| zigo | dims: ie: auth_protocol is missing. | 21:15 |
| zigo | It should be currently set to None, or even be undefined, I guess. | 21:15 |
| zigo | ie: the default of https isn't even there... | 21:16 |
| dims | zigo : paste please? | 21:16 |
| zigo | dims: http://paste.openstack.org/show/493240/ | 21:17 |
| zigo | Same type of error when I do "glance image-list" | 21:18 |
| openstackgerrit | Merged openstack/keystone: Add py3 debugging https://review.openstack.org/294245 | 21:18 |
| *** doug-fish has quit IRC | 21:18 | |
| openstackgerrit | Merged openstack/keystone: Updating sample configuration file https://review.openstack.org/302398 | 21:19 |
| *** stingaci has quit IRC | 21:19 | |
| *** vkmc has joined #openstack-keystone | 21:19 | |
| zigo | stevemar: Reverting the commit doesn't help, do you have any suggestion? | 21:20 |
| *** stingaci has joined #openstack-keystone | 21:20 | |
| *** doug-fish has joined #openstack-keystone | 21:21 | |
| *** stingaci has quit IRC | 21:21 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/302444 | 21:21 |
| *** stingaci has joined #openstack-keystone | 21:22 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/302444 | 21:23 |
| *** mkrcmari__ has joined #openstack-keystone | 21:25 | |
| *** doug-fish has quit IRC | 21:25 | |
| stevemar | dolphm ayoung pile on the mailing list! | 21:25 |
| stevemar | dolphm: i'm too slow at writing emails apparently | 21:26 |
| *** rcernin has quit IRC | 21:27 | |
| *** knikolla has quit IRC | 21:28 | |
| *** mvk_ has quit IRC | 21:28 | |
| dims | zigo : looking at http://logs.openstack.org/38/302338/3/check/gate-neutron-dsvm-api/22ab9d3/logs/etc/neutron/neutron.conf.txt.gz the section of interest is http://paste.openstack.org/show/493241/ | 21:29 |
| *** knikolla has joined #openstack-keystone | 21:29 | |
| dims | zigo : what's in the same section in your neutron.conf? | 21:29 |
| *** david_cu_ has quit IRC | 21:29 | |
| zigo | dims: Devstack doesn't use the oslo.config generated config files. | 21:29 |
| zigo | dims: Again, I'm the only person in the whole OpenStack community to do so. | 21:30 |
| *** david_cu has joined #openstack-keystone | 21:30 | |
| zigo | dims: It's been a very long time issue that there's no gate for it. | 21:30 |
| dims | zigo : so, can you please paste me what you have :) | 21:30 |
| zigo | dims: In neutron.conf for [keystone_authtoken] ? Sure, I did many times already, but I can do once more! :) | 21:31 |
| zigo | dims: Something like this: http://paste.openstack.org/show/493236/ | 21:31 |
| dims | zigo : you mean you want to use all the defaults? | 21:32 |
| dims | as-is | 21:32 |
| zigo | dims: I mean that I insist that my Debian package have working, good, configuration files by default, yes. | 21:32 |
| zigo | dims: You should be able to just edit it, change a password here and there, then it should work. | 21:32 |
| zigo | dims: That's IMO the least we can do for our users. | 21:32 |
| dims | zigo : if that's the case, are you using SSL in your apache configuration for 35357? | 21:34 |
| dims | zigo : http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token/_auth.py#n162 | 21:34 |
| zigo | dims: I'm normally not. | 21:34 |
| zigo | dims: I'm setting http as default auth_protocol. | 21:34 |
| openstackgerrit | Merged openstack/keystone: Run federation tests under Python 3 https://review.openstack.org/294797 | 21:34 |
| *** david_cu has quit IRC | 21:34 | |
| dims | zigo : i don't see that in your paste | 21:34 |
| dims | http://paste.openstack.org/show/493236/ this one | 21:34 |
| zigo | dims: Sure, as auth_protocol isn't even present when you call oslo-config-generator !!! | 21:35 |
| zigo | IT SHOULD... | 21:35 |
| dims | that's an entirely different problem | 21:35 |
| dims | let's deal with this one first | 21:35 |
| zigo | Well, let me define the issue then. | 21:35 |
| zigo | keystonemiddleware used to have a working list_opts() function that was listing needed config options. | 21:35 |
| zigo | That's not the case anymore, and that's generating non-useable-by-default config files. | 21:36 |
| *** knikolla has quit IRC | 21:36 | |
| dims | zigo : my objective is to see if there's any problem at runtime first if the correct params are present. that's a show stopper | 21:36 |
| dims | config files, i'll let you negotiate with the teams :) | 21:37 |
| * dims wearing release hat | 21:37 | |
| *** knikolla has joined #openstack-keystone | 21:37 | |
| zigo | dims: If I add auth_protocol = http (manually in the config file), then restart the service, it will still not be able to auth, because there's no password set, as there's no such directive by default... | 21:37 |
| dims | zigo : here's the example from neutron/dsvm job | 21:38 |
| dims | zigo : http://paste.openstack.org/show/493241/ | 21:38 |
| dims | auth_type = password and password = secretservice | 21:38 |
| zigo | dims: Please stop pasting stuff from devstack, that's not relevant, as it's *not* using oslo-config-generator generated files. | 21:38 |
| zigo | dims: Devstack knows that there's a password field supported, and just writes it ... | 21:38 |
| dims | zigo : ok i am going to stop now. this is not helping me or you thanks | 21:38 |
| zigo | dims: :) | 21:39 |
| *** ayoung has quit IRC | 21:39 | |
| zigo | dims: What I need to find out is how to hack list_opts() to do what I want. I probably will end up just hacking a Debian specific patch to restore sanity. | 21:40 |
| *** dflorea has quit IRC | 21:40 | |
| dims | zigo : it's your call. all of my interest is as mentioned before. does the runtime work given correct params | 21:40 |
| zigo | dims: I believe there's no runtime issue indeed. | 21:41 |
| zigo | dims: But only a problem with generating the config files as it should. | 21:41 |
| dims | zigo : thanks for confirming! big load of my mind | 21:41 |
| dims | as stevemar mentioned your right contact is jamielennox|away | 21:41 |
| zigo | dims: I can't believe that *ALL* of the services would be broken, and still pass the DVSM gate ... :P | 21:41 |
| dims | zigo : we differ on that definition :) | 21:42 |
| *** fhubik has joined #openstack-keystone | 21:45 | |
| *** dflorea has joined #openstack-keystone | 21:45 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for endpoint policy drivers https://review.openstack.org/212006 | 21:46 |
| *** dflorea has quit IRC | 21:46 | |
| *** dflorea has joined #openstack-keystone | 21:47 | |
| dstanek | stevemar: i was going to pile on that the rational used for benefit #2 isn't correct | 21:53 |
| *** knikolla has quit IRC | 21:53 | |
| stevemar | dstanek: go ahead sir | 21:54 |
| *** sdake has quit IRC | 21:54 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:58 | |
| morgan | I <3 that the keystone team responded exactly how I was going to respond! | 22:00 |
| morgan | stevemar: I'll toss my $0.02 in but almost 100% covered. | 22:00 |
| *** diazjf has quit IRC | 22:01 | |
| morgan | zigo: deprecated for removal options may not show up in the generated sample configs. | 22:02 |
| *** rderose_ has quit IRC | 22:04 | |
| *** timcline has quit IRC | 22:04 | |
| *** pumarani__ has quit IRC | 22:05 | |
| *** timcline has joined #openstack-keystone | 22:05 | |
| morgan | dims: ^ haven't read the full backlog but that is my guess of what isngoing on. | 22:05 |
| zigo | morgan: Sure, but we may at least expect to see some kind of username and password showing up, at least, no? | 22:06 |
| zigo | morgan: Currently, there's none ... | 22:06 |
| morgan | Uhm. I can't look now. Because e_mobile. | 22:07 |
| morgan | Not sure. | 22:07 |
| zigo | morgan: No pb, I think I know how to revert and will do for now, so I have a working release tomorrow. | 22:07 |
| zigo | morgan: Though probably we should talk in Austin! :) | 22:07 |
| morgan | Sure. | 22:08 |
| morgan | Likely something you're doing is slightly different than what we test, so we should get both mechanisms in sync. ;) | 22:08 |
| morgan | (Regardless of being called with tox or not) | 22:08 |
| morgan | I'm sure we'll resolve it. | 22:09 |
| *** timcline has quit IRC | 22:09 | |
| *** dflorea has quit IRC | 22:12 | |
| *** pushkaru has joined #openstack-keystone | 22:20 | |
| *** ametts has quit IRC | 22:21 | |
| zigo | dims: stevemar: morgan: I'm adding this patch to the Debian package: http://paste.openstack.org/show/493246/ | 22:24 |
| zigo | Definitively, we should talk in Austin. | 22:24 |
| zigo | I'm ok to do whatever you guys will advise, but I have to know what direction we're heading. | 22:24 |
| zigo | (btw, this patch breaks some unit tests which I'll disable) | 22:25 |
| *** rderose has joined #openstack-keystone | 22:27 | |
| *** rderose_ has joined #openstack-keystone | 22:31 | |
| *** rderose has quit IRC | 22:32 | |
| *** dflorea has joined #openstack-keystone | 22:35 | |
| morgan | zigo: lets def. sync up in austin | 22:36 |
| morgan | :) | 22:36 |
| dims | zigo : my feeling is unless there's a job that runs default generated configuration directly with very very little modifications we cannot claim that it will be complete or working | 22:36 |
| dims | +1 to sync up in austin zigo | 22:36 |
| * morgan puts dims and zigo in the room to sync up and runs and hides in another room :P (hehe j/k) | 22:37 | |
| *** dflorea has quit IRC | 22:37 | |
| dims | LOL as long as there's micro brews :) | 22:38 |
| morgan | dims: what do you consider "micro" :P | 22:41 |
| *** rderose_ has quit IRC | 22:42 | |
| *** rderose has joined #openstack-keystone | 22:47 | |
| *** slberger has left #openstack-keystone | 22:48 | |
| *** rderose has quit IRC | 22:51 | |
| *** dflorea has joined #openstack-keystone | 22:54 | |
| *** dflorea has quit IRC | 22:56 | |
| roxanaghe | morgan: I think I found a way to mock the ldap3 calls at the socket level | 22:58 |
| * roxanaghe happy | 22:58 | |
| *** gordc has quit IRC | 22:59 | |
| *** agrebennikov has quit IRC | 23:01 | |
| *** timcline has joined #openstack-keystone | 23:06 | |
| *** ayoung has joined #openstack-keystone | 23:09 | |
| *** ChanServ sets mode: +v ayoung | 23:09 | |
| *** henrynash has joined #openstack-keystone | 23:10 | |
| *** ChanServ sets mode: +v henrynash | 23:10 | |
| *** timcline has quit IRC | 23:10 | |
| *** pushkaru has quit IRC | 23:14 | |
| rodrigods | bknudson, ping.. re: rename form keystone_tempest_plugin to tempest_plugin | 23:23 |
| *** fhubik has quit IRC | 23:29 | |
| *** jamielennox|away is now known as jamielennox | 23:34 | |
| jamielennox | zigo: i didn't read all that, but did you figure it out? | 23:37 |
| jamielennox | the old options should still be there, they will still work, we just removed them from appearing in the generated sample config files because they are deprecated | 23:37 |
| zigo | jamielennox: Kind of. I found a way to get back to generating the old type of config files:http://anonscm.debian.org/cgit/openstack/python-keystonemiddleware.git/tree/debian/patches/re-add-missing-auth-options.patch | 23:38 |
| *** stingaci has quit IRC | 23:39 | |
| zigo | jamielennox: I do agree with deprecation, but I don't agree with no valid value at all. | 23:39 |
| zigo | jamielennox: If we're switching to "username" instead of "admin_user", then "username" should appear, and it doesn't currently. | 23:39 |
| jamielennox | zigo: ah - your seeing nothing there at all? | 23:39 |
| zigo | Right. | 23:40 |
| zigo | That's what I've been saying all of tonight. | 23:40 |
| jamielennox | zigo: there's a lot of backscroll | 23:40 |
| zigo | :) | 23:40 |
| zigo | Sure. | 23:40 |
| zigo | I'm happy to repeat. | 23:40 |
| jamielennox | i'm looking for the nova bit, sec | 23:40 |
| zigo | jamielennox: Also, I've raised in the dev list that I would like the auth fragments to not be deprecated. | 23:41 |
| zigo | jamielennox: An URL is a pain to parse, having separated fields is a lot easier. | 23:41 |
| zigo | auth_protocol, auth_host and such... | 23:42 |
| zigo | I would prefer to have them stay. | 23:42 |
| zigo | jamielennox: Is there a session in Austin where we can talk about it? | 23:42 |
| zigo | I'd be happy to join such session. | 23:43 |
| jamielennox | not that i'm aware of | 23:43 |
| jamielennox | ok, so the problem with options is that we don't know ahead of time whats relevant | 23:43 |
| jamielennox | the opts that are consumed depend on the value of auth_type | 23:43 |
| jamielennox | so neutron at least does: https://github.com/openstack/neutron/blob/master/neutron/opts.py#L291-L302 | 23:43 |
| *** sdake has joined #openstack-keystone | 23:44 | |
| jamielennox | so for the sake of config generation it adds all the options for password, v2password, and v3password - which is essentially redundant and should just be password | 23:44 |
| jamielennox | by doing that you at least get the options showing up in samples | 23:44 |
| jamielennox | again whether they are used depends on the value of auth_type, but at least this way people get less confused | 23:44 |
| zigo | jamielennox: That's truth for the [neutron] section in nova, not for keystone_authtoken which is also wrong. | 23:45 |
| zigo | jamielennox: I'm just vouching for "a config file useable by default", nothing more. | 23:45 |
| zigo | Currently, that's not the case for keystone_authtoken. :( | 23:45 |
| jamielennox | i definitely see the point, it's just hard throughout the deprecation process | 23:46 |
| zigo | I can switch the debconf stuff to v3, if that's the thing we want to promote. But in this case, then a v3password auth should be generated by default when using --namespace keystonemiddleware.auth_token | 23:46 |
| jamielennox | so to add all the options for password to config you have to set auth_type = password | 23:46 |
| *** sdake_ has joined #openstack-keystone | 23:46 | |
| jamielennox | but we as upstream can't set the default for auth_type because that would break everyone who hasn't set it | 23:46 |
| zigo | Oh... | 23:47 |
| jamielennox | that's the idea here to just ship auth_type = password as default | 23:47 |
| zigo | How about mass bug filling? | 23:47 |
| zigo | There's only so many server packages... | 23:47 |
| zigo | I package 20-ish myself in Debian, and I think that's more than everyone else. | 23:47 |
| jamielennox | well the problem isn't the servers because they aren't really configuring this | 23:47 |
| jamielennox | it's the puppet and ansible and devstack and packstack and tripleo and ... | 23:48 |
| jamielennox | all the people who rolled it by hand | 23:48 |
| zigo | Well, I don't agree. | 23:48 |
| zigo | NONE of what you just wrote is using the oslo generated version of the config file. | 23:48 |
| zigo | In the whole OpenStack community, I'm the only one that does. | 23:48 |
| zigo | Everyone else pretends to "know the world" and just write a config file that they think is correct. | 23:49 |
| *** sdake has quit IRC | 23:49 | |
| jamielennox | but to make that work you are changing a default | 23:49 |
| zigo | As a package maintainer, I strongly believe it's my dutie to provide workable config files, and I insist in doing so, so that's what my CI is actually testing. | 23:49 |
| jamielennox | the sample configs that are generated have every single option commented out | 23:49 |
| zigo | Yes, but I never add an option which doesn't exist to begin with. | 23:50 |
| jamielennox | so if we change the default there such that auth_type = password and add everything then we are lying, because the actual default is not password | 23:50 |
| zigo | So the package will be shipped by default with that option. | 23:50 |
| *** roxanaghe has quit IRC | 23:50 | |
| *** sdake has joined #openstack-keystone | 23:50 | |
| zigo | The actual default is what? | 23:50 |
| zigo | v3password ? | 23:50 |
| zigo | Then do auth_type = v3password, and then correctly generate #username = None | 23:51 |
| zigo | That's fine to me as well... | 23:51 |
| jamielennox | the default is empty, if nothing is specified it falls back to the old admin_user, admin_password etc | 23:52 |
| *** sdake_ has quit IRC | 23:52 | |
| zigo | Why not just displaying everything, and writing in the help that it's deprecated? | 23:52 |
| zigo | That's what we've been doing everywhere else. | 23:53 |
| zigo | This definitively deserves a fishball room discussion ! :) | 23:54 |
| jamielennox | zigo: it was part of the cleanup from the docs perspective to remove old options | 23:55 |
| jamielennox | if you're looking for a real simple patch to fix it... | 23:56 |
| *** spandhe has quit IRC | 23:56 | |
| *** spandhe_ has joined #openstack-keystone | 23:56 | |
| jamielennox | it's the difference between this list: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/opts.py#L27 | 23:57 |
| jamielennox | and this list: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_opts.py#L20 | 23:57 |
| zigo | I don't think it's the best idea to have the docs people influence the way we generate config files in a way that they become not useable. :) | 23:57 |
| jamielennox | the first one has everything because some servers were using that public function in testing | 23:57 |
| jamielennox | the second list is what we put in the sample config | 23:57 |
| jamielennox | so you can either make those two lists the same | 23:57 |
| zigo | I'm not sure I understand this code... :/ | 23:58 |
| jamielennox | or change https://github.com/openstack/keystonemiddleware/blob/master/setup.cfg#L31 to point to the first list instead of the second | 23:58 |
| zigo | Ah, that I get it. | 23:58 |
| zigo | jamielennox: So, just changing the entry point will be enough to get *all* options? | 23:59 |
| jamielennox | zigo: yep | 23:59 |
| zigo | Cool, easy enough. | 23:59 |
| *** pushkaru has joined #openstack-keystone | 23:59 | |
| * zigo tries right away | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!