| *** code-R has quit IRC | 00:00 | |
| *** thumpba has joined #openstack-keystone | 00:04 | |
| *** code-R_ has quit IRC | 00:05 | |
| *** code-R has joined #openstack-keystone | 00:05 | |
| *** ravelar159 has joined #openstack-keystone | 00:09 | |
| *** thumpba has quit IRC | 00:12 | |
| *** ravelar159 has quit IRC | 00:14 | |
| *** ravelar159 has joined #openstack-keystone | 00:19 | |
| *** pgbridge has quit IRC | 00:20 | |
| *** browne has quit IRC | 00:28 | |
| *** jdennis has quit IRC | 00:29 | |
| *** ravelar159 has quit IRC | 00:30 | |
| *** jdennis has joined #openstack-keystone | 00:32 | |
| *** ravelar159 has joined #openstack-keystone | 00:42 | |
| *** ravelar159 has quit IRC | 00:49 | |
| *** aastha has quit IRC | 00:49 | |
| *** ravelar159 has joined #openstack-keystone | 00:49 | |
| *** richm has quit IRC | 00:50 | |
| *** code-R has quit IRC | 00:54 | |
| *** ravelar159 has quit IRC | 00:54 | |
| *** spzala has quit IRC | 00:56 | |
| *** sdake has quit IRC | 00:57 | |
| *** sdake has joined #openstack-keystone | 00:59 | |
| *** code-R has joined #openstack-keystone | 01:02 | |
| stevemar | breton: ahh i miss those hours | 01:04 |
|---|---|---|
| *** tqtran has quit IRC | 01:23 | |
| *** spzala has joined #openstack-keystone | 01:24 | |
| *** browne has joined #openstack-keystone | 01:25 | |
| *** adu has joined #openstack-keystone | 01:25 | |
| *** spzala has quit IRC | 01:27 | |
| *** spzala has joined #openstack-keystone | 01:27 | |
| *** davechen has joined #openstack-keystone | 01:38 | |
| *** ravelar159 has joined #openstack-keystone | 01:40 | |
| *** sdake has quit IRC | 01:44 | |
| *** EinstCrazy has joined #openstack-keystone | 01:44 | |
| *** browne has quit IRC | 01:44 | |
| stevemar | lbragstad: is bug 1607553 a dupe of bug 1590779 ? | 01:47 |
| openstack | bug 1607553 in OpenStack Identity (keystone) "Revocation event caching is broken across processes" [High,New] https://launchpad.net/bugs/1607553 | 01:47 |
| openstack | bug 1590779 in OpenStack Identity (keystone) "Cache region invalidation works for local CacheRegion object only" [High,In progress] https://launchpad.net/bugs/1590779 - Assigned to Boris Bobrov (bbobrov) | 01:47 |
| *** ravelar159 has quit IRC | 01:47 | |
| *** itisha has quit IRC | 01:50 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move Assertion API to its own file https://review.openstack.org/350158 | 01:58 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add basic upgrade documentation https://review.openstack.org/350341 | 02:12 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone-specs: Fix the name of the "manage-migration" spec https://review.openstack.org/350343 | 02:13 |
| dolphm | stevemar: yes, i think so | 02:14 |
| *** ravelar159 has joined #openstack-keystone | 02:14 | |
| stevemar | dolphm: yeah, pretty sure too | 02:14 |
| stevemar | dolphm: i'll mark it as such | 02:14 |
| stevemar | dolphm: you missed out on a career as a writer | 02:16 |
| dolphm | stevemar: who says i'm missing out | 02:17 |
| *** ravelar159 has quit IRC | 02:19 | |
| *** code-R has quit IRC | 02:36 | |
| *** marekd2 has joined #openstack-keystone | 02:37 | |
| *** adrian_otto has joined #openstack-keystone | 02:39 | |
| *** markvoelker has joined #openstack-keystone | 02:39 | |
| *** dave-mccowan has joined #openstack-keystone | 02:41 | |
| *** marekd2 has quit IRC | 02:42 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Skip middleware request processing for admin token https://review.openstack.org/344496 | 02:47 |
| openstackgerrit | Merged openstack/keystone: Don't include openstack/common in flake8 exclude list https://review.openstack.org/349988 | 02:56 |
| *** adu has quit IRC | 02:56 | |
| *** adu has joined #openstack-keystone | 02:58 | |
| stevemar | crinkle: i was just gonna fix that comment for ya | 03:02 |
| *** code-R has joined #openstack-keystone | 03:03 | |
| crinkle | stevemar: the self.assertNotIn ? | 03:03 |
| stevemar | crinkle: aye | 03:04 |
| * crinkle too fast for stevemar | 03:04 | |
| stevemar | crinkle: had it in my env, ran the test and walked away | 03:04 |
| crinkle | ha | 03:04 |
| stevemar | crinkle: i'll take your speed any day! | 03:04 |
| *** dave-mccowan has quit IRC | 03:08 | |
| *** code-R has quit IRC | 03:14 | |
| *** code-R has joined #openstack-keystone | 03:14 | |
| openstackgerrit | Merged openstack/keystone: Adds test for SecurityError's translation behavior https://review.openstack.org/348085 | 03:15 |
| openstackgerrit | Merged openstack/keystone: Adds a custom deepcopy handler https://review.openstack.org/348086 | 03:15 |
| *** adu has quit IRC | 03:18 | |
| *** adrian_otto has quit IRC | 03:18 | |
| *** adu has joined #openstack-keystone | 03:21 | |
| *** adu has quit IRC | 03:22 | |
| *** Nakato has quit IRC | 03:27 | |
| *** Nakato has joined #openstack-keystone | 03:32 | |
| *** roxanaghe has joined #openstack-keystone | 03:35 | |
| *** spzala has quit IRC | 03:39 | |
| *** code-R has quit IRC | 03:41 | |
| *** code-R has joined #openstack-keystone | 03:41 | |
| *** ayoung has quit IRC | 03:48 | |
| *** sdake has joined #openstack-keystone | 03:50 | |
| *** sdake_ has joined #openstack-keystone | 03:54 | |
| *** markvoelker has quit IRC | 03:55 | |
| *** sdake has quit IRC | 03:58 | |
| *** sdake_ has quit IRC | 04:05 | |
| *** links has joined #openstack-keystone | 04:10 | |
| *** davechen has quit IRC | 04:13 | |
| jamielennox | ah, never look at our auth pipeline | 04:17 |
| stevemar | jamielennox: never read the comments | 04:24 |
| stevemar | jamielennox: you can take a crack at https://bugs.launchpad.net/keystone/+bug/1600393 if you want :P | 04:25 |
| openstack | Launchpad bug 1600393 in OpenStack Identity (keystone) "AttributeError: 'list' object has no attribute 'items'" [Critical,Confirmed] | 04:25 |
| jamielennox | stevemar: do we have any further clues? | 04:25 |
| stevemar | mfisch said he would get us middleware logs and his config tomorrow | 04:25 |
| stevemar | but not so much | 04:26 |
| stevemar | we have confirmation from mfisch that hes hitting this in his mitaka dev cloud and it's terrrrribad, its causing things to choke | 04:26 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Improve domain configuration API docs https://review.openstack.org/348591 | 04:29 |
| *** markvoelker has joined #openstack-keystone | 04:33 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Fix other-requirements.txt for deb based distros https://review.openstack.org/341007 | 04:35 |
| *** markvoelker has quit IRC | 04:39 | |
| *** dikonoor has joined #openstack-keystone | 04:45 | |
| jamielennox | stevemar: i'm looking at how to do the long running token thing and i don't think i can get it done for newton | 04:52 |
| jamielennox | stevemar: i'm away next week, and this is uglier than i expected | 04:52 |
| openstackgerrit | Merged openstack/keystone: Move Mapping API to its own file https://review.openstack.org/350117 | 04:57 |
| openstackgerrit | Merged openstack/keystone: Move Service Provider API to its own file https://review.openstack.org/350128 | 04:57 |
| *** julim has quit IRC | 05:02 | |
| *** jaosorior has joined #openstack-keystone | 05:03 | |
| openstackgerrit | Merged openstack/keystone: Move List Projects and Domains API to its own file https://review.openstack.org/350143 | 05:03 |
| openstackgerrit | Merged openstack/keystone: Move Federation Auth API to its own file https://review.openstack.org/350151 | 05:03 |
| openstackgerrit | Merged openstack/keystone: Test number of queries on list_users https://review.openstack.org/347967 | 05:03 |
| *** Guest53941 has joined #openstack-keystone | 05:04 | |
| *** roxanaghe has quit IRC | 05:05 | |
| *** nisha_ has joined #openstack-keystone | 05:25 | |
| *** markvoelker has joined #openstack-keystone | 05:28 | |
| *** Guest53941 has quit IRC | 05:28 | |
| *** rcernin has joined #openstack-keystone | 05:28 | |
| *** lamt_ has quit IRC | 05:31 | |
| *** markvoelker has quit IRC | 05:33 | |
| *** spzala has joined #openstack-keystone | 05:40 | |
| *** spzala has quit IRC | 05:44 | |
| openstackgerrit | Merged openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/328339 | 05:46 |
| *** julim has joined #openstack-keystone | 05:57 | |
| *** sdake has joined #openstack-keystone | 06:07 | |
| *** sdake has quit IRC | 06:07 | |
| *** sdake has joined #openstack-keystone | 06:07 | |
| *** code-R has quit IRC | 06:11 | |
| *** code-R has joined #openstack-keystone | 06:12 | |
| *** tqtran has joined #openstack-keystone | 06:21 | |
| *** markvoelker has joined #openstack-keystone | 06:22 | |
| *** sdake has quit IRC | 06:23 | |
| *** nishaYadav has joined #openstack-keystone | 06:24 | |
| *** nishaYadav is now known as Guest43978 | 06:24 | |
| *** tqtran has quit IRC | 06:25 | |
| *** nisha_ has quit IRC | 06:26 | |
| *** markvoelker has quit IRC | 06:26 | |
| *** code-R has quit IRC | 06:32 | |
| *** code-R has joined #openstack-keystone | 06:32 | |
| *** belmoreira has joined #openstack-keystone | 06:42 | |
| *** tesseract- has joined #openstack-keystone | 06:45 | |
| *** sorrison has quit IRC | 06:53 | |
| openstackgerrit | Merged openstack/keystone-specs: Fix the name of the "manage-migration" spec https://review.openstack.org/350343 | 06:54 |
| *** tangchen_ has quit IRC | 07:00 | |
| *** brancal has joined #openstack-keystone | 07:14 | |
| *** jaosorior is now known as jaosorior_brb | 07:15 | |
| *** markvoelker has joined #openstack-keystone | 07:16 | |
| *** jpena|off is now known as jpena | 07:16 | |
| *** code-R has quit IRC | 07:20 | |
| *** pcaruana has joined #openstack-keystone | 07:21 | |
| *** markvoelker has quit IRC | 07:21 | |
| *** links has quit IRC | 07:23 | |
| *** dikonoor has quit IRC | 07:23 | |
| *** code-R has joined #openstack-keystone | 07:28 | |
| *** ekarlso has quit IRC | 07:29 | |
| *** links has joined #openstack-keystone | 07:36 | |
| *** ekarlso has joined #openstack-keystone | 07:37 | |
| *** dikonoor has joined #openstack-keystone | 07:37 | |
| *** brancal has quit IRC | 07:43 | |
| *** brancal has joined #openstack-keystone | 07:45 | |
| *** Guest43978 has quit IRC | 07:50 | |
| openstackgerrit | Merged openstack/keystone: Use %()d for integer substitution https://review.openstack.org/350069 | 07:52 |
| *** marekd2 has joined #openstack-keystone | 07:53 | |
| *** daemontool has joined #openstack-keystone | 07:57 | |
| *** jistr is now known as jistr|training | 07:59 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:02 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** markvoelker has joined #openstack-keystone | 08:10 | |
| *** jaosorior_brb has quit IRC | 08:12 | |
| *** jaosorior_brb has joined #openstack-keystone | 08:13 | |
| *** markvoelker has quit IRC | 08:14 | |
| *** code-R has quit IRC | 08:22 | |
| *** jaosorior_brb is now known as jaosorior | 08:23 | |
| *** tqtran has joined #openstack-keystone | 08:23 | |
| *** brancal has quit IRC | 08:25 | |
| *** danpawlik has joined #openstack-keystone | 08:27 | |
| *** tqtran has quit IRC | 08:27 | |
| *** brancal has joined #openstack-keystone | 08:28 | |
| *** pnavarro has joined #openstack-keystone | 08:37 | |
| *** gb21 has joined #openstack-keystone | 08:40 | |
| *** gb21 has quit IRC | 08:48 | |
| *** gb21 has joined #openstack-keystone | 08:48 | |
| *** jistr|training is now known as jistr | 08:49 | |
| *** code-R has joined #openstack-keystone | 08:54 | |
| *** code-R has quit IRC | 08:59 | |
| *** amitkqed has quit IRC | 09:04 | |
| *** markvoelker has joined #openstack-keystone | 09:04 | |
| *** amitkqed has joined #openstack-keystone | 09:04 | |
| *** gb21 has quit IRC | 09:05 | |
| *** markvoelker has quit IRC | 09:09 | |
| *** gb21 has joined #openstack-keystone | 09:10 | |
| *** EinstCrazy has quit IRC | 09:15 | |
| *** EinstCrazy has joined #openstack-keystone | 09:16 | |
| *** gb21 has quit IRC | 09:25 | |
| *** code-R has joined #openstack-keystone | 09:49 | |
| openstackgerrit | Merged openstack/oslo.policy: Allow policy file to not exist https://review.openstack.org/341732 | 09:49 |
| *** code-R has quit IRC | 09:53 | |
| *** Jaison has joined #openstack-keystone | 09:58 | |
| *** itsuugo has quit IRC | 09:58 | |
| *** markvoelker has joined #openstack-keystone | 09:58 | |
| *** links has quit IRC | 09:59 | |
| *** itsuugo has joined #openstack-keystone | 10:00 | |
| *** markvoelker has quit IRC | 10:04 | |
| *** serverascode has quit IRC | 10:15 | |
| *** serverascode has joined #openstack-keystone | 10:17 | |
| *** gb21 has joined #openstack-keystone | 10:18 | |
| *** alexander__ is now known as amakarov | 10:19 | |
| *** rodrigods has quit IRC | 10:30 | |
| *** rodrigods has joined #openstack-keystone | 10:30 | |
| *** marekd2 has quit IRC | 10:30 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: Retry revocation on MySQL deadlock https://review.openstack.org/344924 | 10:30 |
| *** EinstCrazy has quit IRC | 10:39 | |
| *** EinstCrazy has joined #openstack-keystone | 10:39 | |
| openstackgerrit | Merged openstack/keystone: Improve domain configuration API docs https://review.openstack.org/348591 | 10:41 |
| openstackgerrit | Merged openstack/keystone: Move Assertion API to its own file https://review.openstack.org/350158 | 10:42 |
| *** code-R has joined #openstack-keystone | 10:43 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: Retry revocation on MySQL deadlock https://review.openstack.org/344924 | 10:43 |
| *** EinstCrazy has quit IRC | 10:44 | |
| *** code-R has quit IRC | 10:47 | |
| *** Jaison has quit IRC | 10:49 | |
| *** links has joined #openstack-keystone | 10:53 | |
| *** dikonoor has quit IRC | 10:57 | |
| openstackgerrit | Merged openstack/keystone: Bump API version number and date https://review.openstack.org/350289 | 11:03 |
| *** gb21 has quit IRC | 11:17 | |
| *** gb21 has joined #openstack-keystone | 11:23 | |
| *** code-R has joined #openstack-keystone | 11:37 | |
| *** code-R has quit IRC | 11:42 | |
| *** markvoelker has joined #openstack-keystone | 11:52 | |
| *** raildo has joined #openstack-keystone | 12:11 | |
| *** adu has joined #openstack-keystone | 12:11 | |
| *** sigmavirus_away is now known as sigmavirus | 12:14 | |
| *** mnikolaenko has joined #openstack-keystone | 12:17 | |
| *** jpena is now known as jpena|lunch | 12:18 | |
| *** gb21 has quit IRC | 12:19 | |
| *** edmondsw has joined #openstack-keystone | 12:19 | |
| *** adu has quit IRC | 12:23 | |
| *** gordc has joined #openstack-keystone | 12:25 | |
| *** spzala has joined #openstack-keystone | 12:25 | |
| *** tqtran has joined #openstack-keystone | 12:25 | |
| *** tqtran has quit IRC | 12:30 | |
| *** daemontool_ has joined #openstack-keystone | 12:35 | |
| *** sdake has joined #openstack-keystone | 12:37 | |
| *** adu has joined #openstack-keystone | 12:37 | |
| *** daemontool has quit IRC | 12:37 | |
| samueldmq | oh well, couple of minutes writting a bug description, and launchpad gives me timeout error | 12:40 |
| samueldmq | ok | 12:40 |
| *** julim has quit IRC | 12:48 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: Correct test_implied_roles https://review.openstack.org/350562 | 12:50 |
| samueldmq | dstanek: you around ? | 12:50 |
| samueldmq | or henrynash | 12:50 |
| samueldmq | I'd like someone to check if bug 1609398 sounds sane | 12:54 |
| openstack | bug 1609398 in OpenStack Identity (keystone) "test_implied_roles fails intermittently" [Medium,New] https://launchpad.net/bugs/1609398 - Assigned to Samuel de Medeiros Queiroz (samueldmq) | 12:54 |
| *** jsavak has joined #openstack-keystone | 12:56 | |
| *** pauloewerton has joined #openstack-keystone | 13:04 | |
| stevemar | samueldmq: any reason that bug isn't against ksc? | 13:06 |
| samueldmq | stevemar: the reason is that I messed up :p | 13:07 |
| samueldmq | it should be | 13:07 |
| stevemar | henrynash: you still west coatin' ? | 13:07 |
| stevemar | samueldmq: fixed it for ya :) | 13:07 |
| samueldmq | stevemar: thanks, that's why the patch didn't show up in launchpad automatically | 13:07 |
| samueldmq | stevemar: thanks | 13:07 |
| stevemar | samueldmq: or as the cool kids on the internet say FTFY | 13:07 |
| samueldmq | stevemar: :D | 13:08 |
| *** jmlowe1 has joined #openstack-keystone | 13:08 | |
| samueldmq | stevemar: does the bug description sound sane ? | 13:09 |
| *** jmlowe has quit IRC | 13:10 | |
| *** dave-mccowan has joined #openstack-keystone | 13:10 | |
| dstanek | samueldmq: yes, i'm here | 13:10 |
| *** lamt_ has joined #openstack-keystone | 13:10 | |
| samueldmq | dstanek: hey | 13:10 |
| stevemar | samueldmq: didn't actually look at the bug description, i assumed it was just around the failing test | 13:11 |
| samueldmq | stevemar: yes | 13:11 |
| samueldmq | dstanek: I wanted some eyes on bug 1609398 | 13:11 |
| openstack | bug 1609398 in python-keystoneclient "test_implied_roles fails intermittently" [Medium,In progress] https://launchpad.net/bugs/1609398 - Assigned to Samuel de Medeiros Queiroz (samueldmq) | 13:11 |
| samueldmq | if the description is sane, the fix is very simple | 13:12 |
| samueldmq | and will unblock nisha so her patches will continue to merge | 13:12 |
| samueldmq | in keystoneclient | 13:12 |
| samueldmq | outreachy round ends this month, so it's important to keep moving | 13:13 |
| *** agireud has quit IRC | 13:14 | |
| dstanek | samueldmq: yuck...i always hate it when tests assert counts | 13:16 |
| *** jpena|lunch is now known as jpena | 13:16 | |
| dstanek | samueldmq: and it looks like it's using a shared user and not it's own | 13:17 |
| stevemar | samueldmq: dstanek why not assert the interence count <= | 13:17 |
| samueldmq | Specially when the count assertion is not related to what the test is supposed to test | 13:17 |
| *** agireud has joined #openstack-keystone | 13:17 | |
| samueldmq | dstanek: does that matter ? (shared user) | 13:18 |
| dstanek | i actually don't understand what that test is actually testing | 13:19 |
| samueldmq | that test isn't really meaningful | 13:19 |
| *** markvoelker has quit IRC | 13:19 | |
| samueldmq | it's just creating role inferences, and testing they were created | 13:19 |
| samueldmq | not really testing the behavior of them (which is the important part) | 13:19 |
| samueldmq | but writting more meaningful tests is a separate thing | 13:19 |
| samueldmq | (to role inference rules) | 13:20 |
| dstanek | at first glace it looks like it's just testing fixtures | 13:20 |
| *** adu has quit IRC | 13:20 | |
| samueldmq | the test was the same before fixtures | 13:20 |
| samueldmq | there were intermittent failures happening when mixing role creation with direct calls and fixtures (for other tests) | 13:21 |
| samueldmq | then nisha changed this test to use fixtures as well | 13:21 |
| samueldmq | so for me, a good would be: make that work so we unblock the other work going on in the tests | 13:22 |
| samueldmq | then fix those tests to make them more meaningful | 13:22 |
| dstanek | samueldmq: no, i don't think it's a fixtures thing. the tests just look terrible. it's a case of refactoring tests too much IMO | 13:23 |
| samueldmq | dstanek: that test for role inference that is terrible ? or all the tests? | 13:23 |
| *** akscram has quit IRC | 13:23 | |
| *** akscram has joined #openstack-keystone | 13:25 | |
| dstanek | samueldmq: i'm just not a fan of the fixtures being used that way. in order to see what is being tested i have to go somewhere else to look | 13:28 |
| dstanek | just a preference | 13:28 |
| dstanek | i like fixtures for the non-essential setup, like logging, setting up infra like DB, etc | 13:28 |
| samueldmq | dstanek: I think for those tests you'd need to just look at the fixtures code once for all the entities | 13:29 |
| dstanek | i like to see explicit setup of the things i am asserting against | 13:29 |
| samueldmq | because all the fixtures do there for functional tests is to create/cleanup the entities | 13:29 |
| samueldmq | that's all | 13:29 |
| dstanek | samueldmq: that's all right now :-) | 13:30 |
| samueldmq | dstanek: :) | 13:30 |
| dstanek | and then someone adds a boolean switch that changes the passed in args and yada, yada confusion | 13:30 |
| * samueldmq watch outs for args in fixtures | 13:31 | |
| *** belmoreira has quit IRC | 13:31 | |
| samueldmq | dstanek: I agree with you, if one does that, then the thing starts being very confusing | 13:31 |
| samueldmq | and hard to read | 13:32 |
| *** tonytan4ever has joined #openstack-keystone | 13:32 | |
| samueldmq | dstanek: we will probable ending up rewriting that test for implied roles | 13:33 |
| samueldmq | nisha asked if she should do that (from scratch), I told her that is a good idea after finishing the others that have no test | 13:34 |
| *** brancal has quit IRC | 13:34 | |
| *** richm has joined #openstack-keystone | 13:43 | |
| *** brancal has joined #openstack-keystone | 13:43 | |
| *** markvoelker has joined #openstack-keystone | 13:46 | |
| *** brancal has quit IRC | 13:49 | |
| stevemar | where's ayoung hiding at | 13:51 |
| stevemar | jamielennox: i assume you know | 13:51 |
| stevemar | henrynash: ping me when you're online, i need your help triaging https://bugs.launchpad.net/keystone/+bug/1588190 and https://bugs.launchpad.net/keystone/+bug/1607655 | 13:51 |
| openstack | Launchpad bug 1588190 in OpenStack Identity (keystone) "policy.v3cloudsample.json broken in mitaka" [High,Triaged] | 13:51 |
| openstack | Launchpad bug 1607655 in OpenStack Identity (keystone) "domain admin cannot create implied role in default v3 policy" [Medium,Triaged] - Assigned to Henry Nash (henry-nash) | 13:51 |
| stevemar | amakarov or dolphm around? | 13:53 |
| amakarov | stevemar, o/ | 13:53 |
| stevemar | amakarov: there you are | 13:53 |
| stevemar | amakarov: so, i don't recall discussing this one, even though i wrote a note in the "whiteboard" area: https://blueprints.launchpad.net/keystone/+spec/pre-cache-tokens | 13:53 |
| amakarov | stevemar, me neither ) | 13:54 |
| stevemar | amakarov: i don't remember if we approved it for newton or not, sounds like it was | 13:55 |
| amakarov | stevemar, last thing I remember about it - dolphm wanted performance comparison | 13:56 |
| amakarov | and I can't get our qa do that for me )) | 13:56 |
| stevemar | amakarov: i think that's still a good idea | 13:56 |
| amakarov | stevemar, me too | 13:56 |
| amakarov | according to our stress tests validation takes 2x of issue time | 13:57 |
| amakarov | and we can get rid of the entire operation | 13:58 |
| amakarov | Andrew Grebennikov laughed that it's a return to token persistency ) | 13:59 |
| stevemar | amakarov: hehe | 13:59 |
| stevemar | amakarov: not entirely, but that statement is not entirely inaccurate :P | 14:00 |
| amakarov | stevemar, I'd ask you you to pay attention to this improvement too: https://review.openstack.org/#/c/285521/ | 14:00 |
| patchbot | amakarov: patch 285521 - keystone - Closure table for HMT | 14:00 |
| *** krot_sickleave is now known as krotscheck | 14:00 | |
| stevemar | amakarov: i'll keep an eye on it | 14:02 |
| amakarov | stevemar, what should be in the spec :) | 14:02 |
| amakarov | ? | 14:02 |
| stevemar | amakarov: for pre-cache? | 14:02 |
| amakarov | it's completely internal change | 14:02 |
| amakarov | ++ | 14:02 |
| stevemar | amakarov: i don't think it's necessary, i just dont remember approving it | 14:02 |
| stevemar | amakarov: i approved it now in launchpad | 14:02 |
| stevemar | sorry for the confusion | 14:03 |
| *** akrzos has joined #openstack-keystone | 14:03 | |
| amakarov | stevemar, so what's to be done to merge that? | 14:03 |
| stevemar | amakarov: my lazy butt has to review it | 14:04 |
| stevemar | amakarov: removed my -1 | 14:04 |
| amakarov | Have you asked me for performance check or it's just a reminder for yourself? | 14:05 |
| *** diazjf has joined #openstack-keystone | 14:06 | |
| stevemar | amakarov: oh that's the comment to activate lbragstad's performance tests | 14:06 |
| stevemar | amakarov: https://github.com/lbragstad/keystone-performance#how-do-i-run-performance-on-a-patch-in-review | 14:08 |
| stevemar | If a comment is left on an openstack/keystone review containing check performance in the message, the bot will performance test the patch against master and leave a comment on the review when it is finished. | 14:08 |
| stevemar | amakarov: considering it just does auth calls this is the perfect test and should see a change | 14:09 |
| amakarov | stevemar, wow! | 14:09 |
| amakarov | Looks like I'm missing interesting things happening ( | 14:10 |
| stevemar | amakarov: its cool cause it's run on the same machine always | 14:10 |
| amakarov | stevemar, does this bot runs its tests with caching enabled? | 14:11 |
| lbragstad | amakarov it runs however openstack-ansible deploys keystone | 14:12 |
| stevemar | lbragstad or dstanek one of you want to take a quick look at https://review.openstack.org/#/c/344496/ ? it'll close out a bug | 14:12 |
| patchbot | stevemar: patch 344496 - keystone - Skip middleware request processing for admin token | 14:12 |
| amakarov | lbragstad, hi! Where can I find now openstack-ansible deploys keystone? ) | 14:12 |
| lbragstad | amakarov https://github.com/lbragstad/keystone-performance#osic-performance-bot | 14:12 |
| *** ayoung has joined #openstack-keystone | 14:12 | |
| *** ChanServ sets mode: +v ayoung | 14:12 | |
| lbragstad | amakarov the role that I'm consuming to stand up keystone can be found here - https://github.com/openstack/openstack-ansible-os_keystone | 14:13 |
| *** narengan has joined #openstack-keystone | 14:14 | |
| rodrigods | stevemar, ayoung is in an endless battle with tripleo, he seems to be winning now | 14:16 |
| stevemar | rodrigods: is the battle to the death? | 14:17 |
| ayoung | rodrigods, shh you will jinx me | 14:17 |
| amakarov | lbragstad, are settings in defaults/main.yml? | 14:17 |
| lbragstad | amakarov most of them, yes | 14:17 |
| stevemar | ayoung got a few minutes to look at policy bugs? | 14:17 |
| ayoung | stevemar, in a few minutes I will | 14:18 |
| stevemar | ayoung: okay, i just need opinions on https://bugs.launchpad.net/keystone/+bug/1588190 and https://bugs.launchpad.net/keystone/+bug/1607655 | 14:18 |
| openstack | Launchpad bug 1588190 in OpenStack Identity (keystone) "policy.v3cloudsample.json broken in mitaka" [High,Triaged] | 14:18 |
| openstack | Launchpad bug 1607655 in OpenStack Identity (keystone) "domain admin cannot create implied role in default v3 policy" [Medium,Triaged] - Assigned to Henry Nash (henry-nash) | 14:18 |
| * lbragstad amakarov default/main.yml is the standard defaults that osa deploys keystone with - I have to override some of them here https://github.com/lbragstad/keystone-performance/blob/master/setup_perf_host.yml | 14:18 | |
| *** narengan1 has joined #openstack-keystone | 14:18 | |
| mfisch | stevemar: when does browne typically come on? | 14:20 |
| mfisch | he's probably PSD | 14:20 |
| mfisch | PST | 14:20 |
| *** narengan has quit IRC | 14:23 | |
| *** links has quit IRC | 14:23 | |
| *** jaosorior has quit IRC | 14:25 | |
| openstackgerrit | Merged openstack/keystone: Remove configuration references to eventlet https://review.openstack.org/348555 | 14:25 |
| *** dkehn_ has quit IRC | 14:25 | |
| *** stevemar changes topic to "Newton Deadlines: http://releases.openstack.org/newton/schedule.html | Meeting Agenda https://etherpad.openstack.org/p/keystone-weekly-meeting" | 14:26 | |
| *** stevemar changes topic to "Newton Deadlines: http://releases.openstack.org/newton/schedule.html | Meeting Agenda https://etherpad.openstack.org/p/keystone-weekly-meeting" | 14:26 | |
| *** stevemar changes topic to "Newton Deadlines: http://releases.openstack.org/newton/schedule.html | Meeting Agenda https://etherpad.openstack.org/p/keystone-weekly-meeting" | 14:26 | |
| ayoung | stevemar, 1588190 sounds like role assignment inheritance | 14:26 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Drop EPHEMERAL user type https://review.openstack.org/296639 | 14:28 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Drop EPHEMERAL user type https://review.openstack.org/296639 | 14:29 |
| stevemar | rderose: poke | 14:31 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Lockout requirements https://review.openstack.org/340074 | 14:34 |
| stevemar | rderose: just to clarify, i think bug 1601929 should be the next one on your list after PCI is done :) | 14:36 |
| openstack | bug 1601929 in OpenStack Identity (keystone) "Relax the requirement for mappings to result in group memberships" [High,Triaged] https://launchpad.net/bugs/1601929 - Assigned to Ron De Rose (ronald-de-rose) | 14:36 |
| stevemar | IMO that's the nastiest of the federation bugs | 14:36 |
| samueldmq | ayoung: | 14:37 |
| samueldmq | ayoung: can you look at https://review.openstack.org/#/c/350562/ ? | 14:37 |
| patchbot | samueldmq: patch 350562 - python-keystoneclient - Correct test_implied_roles | 14:37 |
| *** code-R has joined #openstack-keystone | 14:37 | |
| samueldmq | ayoung: I didn't approve so you have a chance to take a look :) | 14:37 |
| *** dkehn_ has joined #openstack-keystone | 14:38 | |
| *** code-R_ has joined #openstack-keystone | 14:38 | |
| *** michauds has joined #openstack-keystone | 14:40 | |
| ayoung | samueldmq, I always like to write tests that check a precondition when possible | 14:40 |
| ayoung | so, just because the number of roles match at the end is not proof that the code executed in between did anything | 14:41 |
| samueldmq | ayoung: why is that a precondition? other tests ensure the roles are created appropriately | 14:41 |
| ayoung | instad, check what it is without the rule, add the rule, check what it is with the rule | 14:41 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 14:41 |
| *** code-R has quit IRC | 14:41 | |
| ayoung | samueldmq, think of it as a control in an experiment | 14:41 |
| samueldmq | ayoung: I see tests as being specific on what they want to test | 14:42 |
| ayoung | samueldmq, and this is specific | 14:42 |
| samueldmq | ayoung: let's check roles are created in the roles tests, inference rules in their own tests | 14:42 |
| ayoung | it wants to test that adding an implied role to a user increases the number of roles that user has | 14:42 |
| samueldmq | ayoung: nah, that one is just checking against global roles, no? | 14:43 |
| samueldmq | ayoung: it's checking the global roles ahve been increased | 14:43 |
| samueldmq | ayoung: which is not the intent of that test | 14:43 |
| samueldmq | ayoung: I will work with nisha to make that test more meaninful later, just want to get things moving again | 14:43 |
| ayoung | samueldmq, er, yeah, this is checking that the set of roles are created | 14:43 |
| samueldmq | ayoung: :) | 14:44 |
| ayoung | samueldmq, so, keep the intention of checking the precondition/postcondition | 14:44 |
| ayoung | you can do it by checking specific role names or what not | 14:44 |
| ayoung | if you want it as two separate tests, that is ok | 14:45 |
| samueldmq | ayoung: yes, but checking the roles are created is part of the roles tests | 14:45 |
| samueldmq | not the inference rules tests | 14:45 |
| samueldmq | and that part is just checking the roles were created (the part I removed) | 14:46 |
| samueldmq | ayoung: do you agree? | 14:46 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password expires validation https://review.openstack.org/333360 | 14:46 |
| ayoung | samueldmq, true. However, in this case, those roles are used to check the new inference rules. I don't know what it would mean if the roles were not created | 14:46 |
| samueldmq | ayoung: the role tests would fail | 14:46 |
| samueldmq | too | 14:46 |
| *** knikolla has joined #openstack-keystone | 14:47 | |
| *** code-R_ has quit IRC | 14:48 | |
| *** code-R has joined #openstack-keystone | 14:48 | |
| knikolla | hello everyone o/ | 14:48 |
| knikolla | back from vacations | 14:48 |
| stevemar | knikolla: you were gone forever :O | 14:48 |
| stevemar | o_O | 14:48 |
| ayoung | samueldmq, I'm OK with your change. I would move the role create to before any of the testing, then. | 14:49 |
| ayoung | create_roles; check rule count; create rules; check rule count; | 14:49 |
| knikolla | stevemar: nice to see i was missed :) | 14:50 |
| samueldmq | ayoung: ins't just a test creating roles and checking they were created enough? | 14:50 |
| samueldmq | I don't see what that test buy us (checking counts) | 14:50 |
| ayoung | samueldmq, this test really should be testing the rules | 14:50 |
| ayoung | the role creation is already tested | 14:50 |
| samueldmq | exactly, so why you want to check your calls to create role effectively worked? | 14:51 |
| samueldmq | that's an assumption of the test | 14:51 |
| ayoung | rule | 14:51 |
| ayoung | samueldmq, rewrite however you see fit. This was just a create test, and I would not object to clearer naming and separate of concernts | 14:52 |
| *** ravelar159 has joined #openstack-keystone | 14:52 | |
| ayoung | but importnat part here is test creating the rules, not the roles | 14:52 |
| * ayoung sghould have come up with more different nouns | 14:52 | |
| samueldmq | ayoung: exactly | 14:53 |
| ayoung | OK | 14:53 |
| samueldmq | that's the reason I am removing the ROLES part | 14:53 |
| samueldmq | and only leaving the rules cehcks | 14:53 |
| stevemar | knikolla: whered you go? | 14:55 |
| knikolla | stevemar: french alps. beautiful landscapes. | 14:57 |
| *** amakarov has quit IRC | 14:58 | |
| *** diazjf has quit IRC | 14:58 | |
| stevemar | knikolla: nice | 14:59 |
| stevemar | dolphm: do you think 1601929 should wait until https://review.openstack.org/#/c/324055/ lands? | 14:59 |
| patchbot | stevemar: patch 324055 - keystone-specs - Mapping shadow users into projects and roles | 14:59 |
| *** amakarov has joined #openstack-keystone | 15:00 | |
| stevemar | i agree that https://review.openstack.org/#/c/324055/ will solve the bug -- i guess i was hoping we could rid ourselves of that requirement sooner | 15:00 |
| patchbot | stevemar: patch 324055 - keystone-specs - Mapping shadow users into projects and roles | 15:00 |
| dolphm | stevemar: i was just re-thinking the bug, actually. i think there's two pieces to it, and for the second half-- yes. | 15:00 |
| dolphm | stevemar: to break it down... | 15:00 |
| stevemar | dolphm: jam with me | 15:00 |
| dolphm | stevemar: the first part in my mind is the "constraint" that you referred to, that we basically 401 if you don't receive a group membership, right? | 15:01 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add schema validation to create user v2 https://review.openstack.org/348531 | 15:01 |
| stevemar | dolphm: correct | 15:01 |
| dolphm | stevemar: you should still be able to auth and receive manual concrete role assignments at any time | 15:01 |
| dolphm | stevemar: that's the bug | 15:01 |
| dolphm | stevemar: right? | 15:01 |
| stevemar | dolphm: correct, and that is what I tried to state in my bug report | 15:01 |
| dolphm | stevemar: the second part is that you should be able to auth and receive authorization via some means other than group memberships, which is the spec and is not a bug, just a feature gap that we have the opportunity to fill | 15:02 |
| dolphm | stevemar: alright, let me comment on it again | 15:02 |
| stevemar | dolphm: in my mind, i want me mapping to just be: local: "user: {0}", remote: "SOME_HEADER" -- so they can authenticate and i can assign them roles | 15:02 |
| *** pgbridge has joined #openstack-keystone | 15:02 | |
| stevemar | dolphm: correct | 15:02 |
| stevemar | dolphm: now, to put a wrinkle in it... | 15:03 |
| stevemar | dolphm: is a user being able to auth all that useful if they don't have any role assignments ? :( | 15:03 |
| dolphm | stevemar: your bug description seems to describe the spec pretty well though: "we should allow for mappings to result in per-user assignments" | 15:03 |
| samueldmq | ayoung: you okay with that then? | 15:04 |
| dolphm | stevemar: yep, the only utility is that they get a local user ID and they can receive manual concrete assignments | 15:04 |
| ayoung | samueldmq, yep | 15:04 |
| stevemar | dolphm: maybe it's more logical to wait until the spec lands, cause if we remove the constraint then -- yeah ^ | 15:04 |
| stevemar | dolphm: it's definitely scaffolding for the spec, not sure how much it actually buys us | 15:04 |
| samueldmq | ayoung: thanks, I will add you to other changes (adding tests) for implied, | 15:04 |
| dolphm | stevemar: the biggest immediate benefit though is that i don't have to manage a complicated mapping in all cases.... like you suggested, a really simple mapping will get federation working for me, and i can do things the old fashioned way | 15:05 |
| stevemar | dolphm: yes, but the flow would be super wonky -- "auth, get a 401 since i have no roles, contact admin, get a role assigned to me, then re-auth" | 15:06 |
| stevemar | the admin can't assign me a role earlier since i don't have a user id yet, cause i haven't authed | 15:06 |
| stevemar | unless you have some middleware that could do auto assignment | 15:06 |
| dolphm | stevemar: but, you'd still be able to get an unscoped token | 15:07 |
| dolphm | stevemar: so, no 401 | 15:07 |
| stevemar | tru dat | 15:07 |
| *** roxanaghe has joined #openstack-keystone | 15:07 | |
| stevemar | okay | 15:07 |
| dolphm | stevemar: new bug description? "With the introduction of shadow users, we should not require mappings to result in group memberships. This should not require an API change, but would allow for much simpler mappings to be used (literally just assigning a unique ID, and nothing more), which would be sufficient to allow federated users to receive manually assigned concrete role assignments (a process that operators are | 15:07 |
| dolphm | already familiar with)." | 15:07 |
| stevemar | dolphm: ++ | 15:08 |
| stevemar | rderose: ^ | 15:08 |
| dolphm | stevemar: cool, one sec | 15:08 |
| stevemar | dolphm: thanks bud | 15:08 |
| stevemar | everyone is gonna hate me after a few weeks of this pestering | 15:09 |
| rderose | dolphm++ | 15:09 |
| dolphm | stevemar: rderose: added another comment as well | 15:10 |
| rderose | dolphm: okay, will take a look. thx | 15:10 |
| dolphm | stevemar, professional cat herder | 15:10 |
| dolphm | stevemar: and i agree with the High in this case | 15:11 |
| stevemar | dolphm: coolio | 15:16 |
| *** julim has joined #openstack-keystone | 15:16 | |
| *** ravelar159 has quit IRC | 15:16 | |
| *** diazjf has joined #openstack-keystone | 15:16 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Clean up the introductory text in the docs https://review.openstack.org/350639 | 15:16 |
| *** ravelar has joined #openstack-keystone | 15:16 | |
| stevemar | rderose: are your PCI patches ready for review or still -W? | 15:20 |
| samueldmq | stevemar: dolphm: just have a comment/question on 350639 before approving | 15:21 |
| *** jcalcote has quit IRC | 15:21 | |
| rderose | stevemar: this one is ready https://review.openstack.org/#/c/340074/ | 15:22 |
| patchbot | rderose: patch 340074 - keystone - PCI-DSS Lockout requirements | 15:22 |
| rderose | stevemar: just fixed merge conflict | 15:22 |
| *** dkehn_ has quit IRC | 15:22 | |
| *** sheel has joined #openstack-keystone | 15:23 | |
| *** dave-mccowan has quit IRC | 15:24 | |
| samueldmq | stevemar: so when it says 'distributed multi-tenant authorization', is it talking about projects/domains/assignments | 15:25 |
| samueldmq | stevemar: why distributed then? | 15:25 |
| stevemar | samueldmq: just ignore the word :P | 15:26 |
| stevemar | samueldmq: hehe, i'll let dolphm answer you then | 15:26 |
| samueldmq | hehe lol | 15:26 |
| samueldmq | stevemar: ok, just trying to understand it completely. I like the change | 15:27 |
| dolphm | samueldmq: i replied in the review | 15:27 |
| dolphm | samueldmq: just expanded on steve's answer a bit | 15:27 |
| samueldmq | dolphm: kk I thought we were only considering keystone server in that, but it includes other bits like middleware and oslo policy | 15:28 |
| samueldmq | stevemar: dolphm: agreed then, thanks for clarifying | 15:28 |
| dolphm | samueldmq: in my view, clients authenticate with keystone (federation, password auth, tokens), use the service catalog to discover the rest of openstack, and then almost the rest of our ecosystem is to facilitate authorization and tenant isolation across a whole bunch of services that we have no actual control over (distributed) | 15:29 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add schema validation to update user v2 https://review.openstack.org/345022 | 15:29 |
| stevemar | breaking for lunch, see you folks in a bit | 15:29 |
| samueldmq | dolphm: perfect, totally agree | 15:30 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 15:31 |
| *** dkehn_ has joined #openstack-keystone | 15:32 | |
| *** itlinux has joined #openstack-keystone | 15:39 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 15:40 |
| rderose | stevemar: this one is ready as well: https://review.openstack.org/#/c/343314/ | 15:41 |
| patchbot | rderose: patch 343314 - keystone - PCI-DSS Minimum password age requirements | 15:41 |
| *** nishaYadav has joined #openstack-keystone | 15:42 | |
| *** nisha_ has joined #openstack-keystone | 15:43 | |
| samueldmq | ayoung: deleting a role will cause the deletion of all the roles implied by that first? | 15:43 |
| samueldmq | ayoung: or is it just going to delte the role inferences ? (I 'd expect this) | 15:43 |
| ayoung | no | 15:44 |
| ayoung | deleting a role should have no impace on other roles, just on the inference rules | 15:44 |
| *** pece has joined #openstack-keystone | 15:45 | |
| mnaser | sorry for jumping in with a crazy idea right away. has the idea of adding some sort of compatibility layer in v2 to use domains ever been discussed? we want to move to a domain per user model and the fact a lot of customers depend on v2.0 makes it hard :( | 15:46 |
| *** nishaYadav has quit IRC | 15:46 | |
| mnaser | maybe something crazy like OS_TENANT_NAME=tenant@domain | 15:46 |
| mnaser | (yes I know this is crazy but the # of tools built for keystone 2.0 only make it quite hard) | 15:47 |
| *** nisha_ is now known as nishaYadav | 15:47 | |
| samueldmq | ayoung: ok, so docs in https://review.openstack.org/#/c/334546/11/keystoneclient/v3/roles.py are worng (delete role docs) | 15:48 |
| patchbot | samueldmq: patch 334546 - python-keystoneclient - Improve docs for v3 roles | 15:48 |
| dstanek | mnaser: i think that would require lots of changes to the v2 code. not sure if it's possible, but it's an interesting idea | 15:48 |
| samueldmq | ayoung: thanks for confirming | 15:48 |
| mnaser | dstanek, that way we can slowly start using domains without telling customers "your software doesnt work anymore" | 15:48 |
| mnaser | ex: jcloud doesnt support v3 auth afaik, so we have customers that do CI and they wouldn't be able to do that anymore | 15:50 |
| * nishaYadav waves hello o/ | 15:50 | |
| dstanek | mnaser: sure. at a mimimum you'd have to change all the code that uses the default domain to parse the tenant info for the actual domain. i'm not sure if we have any assumptions in v2 about the default domain that would break | 15:53 |
| dstanek | mnaser: off the top of my head this feels like an invasive change | 15:54 |
| mnaser | dstanek, it is very invasive indeed! however, looking at our stats, it's kinda crazy how low the # of v3 api requests that come in | 15:54 |
| mnaser | i took a sample of ~7300 external keystone requests (not the ones from our services).. only 300 were towards v3 endpoint | 15:54 |
| *** danpawlik has quit IRC | 15:57 | |
| *** nishaYadav has quit IRC | 15:58 | |
| *** nishaYadav has joined #openstack-keystone | 15:58 | |
| samueldmq | nishaYadav: hi | 15:59 |
| *** nisha_ has joined #openstack-keystone | 16:00 | |
| samueldmq | nisha_: hi | 16:00 |
| *** nishaYadav has quit IRC | 16:00 | |
| *** nisha_ is now known as nishaYadav | 16:01 | |
| nishaYadav | samueldmq, hey | 16:01 |
| samueldmq | nishaYadav: how are you? | 16:01 |
| samueldmq | nishaYadav: I just left a couple of comments in patch 334546 | 16:01 |
| patchbot | samueldmq: https://review.openstack.org/#/c/334546/ - python-keystoneclient - Improve docs for v3 roles | 16:01 |
| dolphm | samueldmq: stevemar: fixed a tiny nit and re-approved https://review.openstack.org/#/c/350639/ | 16:02 |
| patchbot | dolphm: patch 350639 - keystone - Clean up the introductory text in the docs | 16:02 |
| samueldmq | dolphm: nice | 16:02 |
| samueldmq | nishaYadav: https://review.openstack.org/#/c/350562/ will fix the intermittent errors. see the description of the bug it fixes to understand what was going on | 16:03 |
| patchbot | samueldmq: patch 350562 - python-keystoneclient - Correct test_implied_roles | 16:03 |
| *** Gorian_ has joined #openstack-keystone | 16:03 | |
| nishaYadav | samueldmq, I am good thanks | 16:03 |
| nishaYadav | samueldmq, looking at them :) | 16:04 |
| *** ddieterly has joined #openstack-keystone | 16:04 | |
| *** itisha has joined #openstack-keystone | 16:04 | |
| *** esp has joined #openstack-keystone | 16:04 | |
| *** jistr is now known as jistr|biab | 16:06 | |
| nishaYadav | samueldmq, thanks for reviewing, doing the changes in role docs :) | 16:12 |
| samueldmq | nishaYadav: cool, also just left a couple of comments in the role tests too | 16:13 |
| nishaYadav | samueldmq, nice | 16:13 |
| *** adrian_otto has joined #openstack-keystone | 16:13 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for rolling upgrades to keystone-manage https://review.openstack.org/349716 | 16:14 |
| *** roxanaghe has quit IRC | 16:20 | |
| *** jistr|biab is now known as jistr | 16:22 | |
| *** diazjf has quit IRC | 16:24 | |
| *** tqtran has joined #openstack-keystone | 16:27 | |
| *** jpena is now known as jpena|off | 16:30 | |
| *** nisha_ has joined #openstack-keystone | 16:31 | |
| *** tqtran has quit IRC | 16:31 | |
| *** jsavak has quit IRC | 16:33 | |
| *** jsavak has joined #openstack-keystone | 16:33 | |
| *** ddieterly is now known as ddieterly[away] | 16:34 | |
| *** nishaYadav has quit IRC | 16:34 | |
| *** roxanaghe has joined #openstack-keystone | 16:35 | |
| *** nisha_ is now known as nishaYadav | 16:36 | |
| *** rcernin has quit IRC | 16:38 | |
| *** ddieterly[away] is now known as ddieterly | 16:40 | |
| *** pece has quit IRC | 16:44 | |
| *** roxanaghe has quit IRC | 16:45 | |
| *** roxanaghe has joined #openstack-keystone | 16:47 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Correct test_implied_roles https://review.openstack.org/350562 | 16:47 |
| *** krotscheck is now known as kro_focused | 16:53 | |
| *** adrian_otto has quit IRC | 16:53 | |
| *** roxanaghe has quit IRC | 16:56 | |
| *** browne has joined #openstack-keystone | 16:56 | |
| *** adrian_otto has joined #openstack-keystone | 16:56 | |
| *** roxanaghe has joined #openstack-keystone | 16:57 | |
| *** roxanaghe has quit IRC | 16:57 | |
| *** roxanaghe has joined #openstack-keystone | 16:57 | |
| breton | fg | 17:00 |
| *** pcaruana has quit IRC | 17:00 | |
| *** tqtran has joined #openstack-keystone | 17:00 | |
| *** pnavarro has quit IRC | 17:01 | |
| *** tqtran_ has joined #openstack-keystone | 17:01 | |
| *** tesseract- has quit IRC | 17:03 | |
| *** tqtran has quit IRC | 17:04 | |
| *** openstackgerrit_ has joined #openstack-keystone | 17:06 | |
| *** openstackgerrit_ has quit IRC | 17:08 | |
| *** nisha_ has joined #openstack-keystone | 17:11 | |
| *** spzala has quit IRC | 17:12 | |
| *** nishaYadav has quit IRC | 17:12 | |
| *** nisha_ is now known as nishaYadav | 17:12 | |
| *** KevinE has joined #openstack-keystone | 17:15 | |
| *** jsavak has quit IRC | 17:18 | |
| *** jsavak has joined #openstack-keystone | 17:18 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 roles https://review.openstack.org/334546 | 17:20 |
| *** narengan1 has quit IRC | 17:20 | |
| *** spzala has joined #openstack-keystone | 17:20 | |
| *** spzala has quit IRC | 17:20 | |
| *** spzala has joined #openstack-keystone | 17:20 | |
| *** dave-mccowan has joined #openstack-keystone | 17:20 | |
| KevinE | andreykurilin__: Hey, I was wondering what happened to the change? I was going to test it against our env but I saw someone added some changes and now it can't pass a single test | 17:21 |
| *** dave-mcc_ has joined #openstack-keystone | 17:22 | |
| *** amakarov is now known as amakarov_away | 17:24 | |
| *** ddieterly is now known as ddieterly[away] | 17:24 | |
| andreykurilin__ | @KevinE: it is only about db migrations, so you check this patch without it | 17:24 |
| *** dave-mccowan has quit IRC | 17:27 | |
| *** browne1 has joined #openstack-keystone | 17:27 | |
| *** browne has quit IRC | 17:27 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make all token provider behave the same with trusts https://review.openstack.org/350704 | 17:29 |
| lbragstad | breton dstanek ^ | 17:31 |
| lbragstad | breton let me know if that works for you | 17:31 |
| lbragstad | i'm going to break for lunch | 17:31 |
| breton | but... they behaved the same for me already | 17:32 |
| breton | test_validate_v3_trust_scoped_token_against_v2_succeeds is new though | 17:32 |
| *** daemontool_ has quit IRC | 17:38 | |
| stevemar | breton: just looking through open bugs, isn't https://bugs.launchpad.net/keystone/+bug/1406314 resolved now that we run migration tests on mysql and postgres? | 17:39 |
| openstack | Launchpad bug 1406314 in OpenStack Identity (keystone) "db migration tests falsely succeed" [Wishlist,Triaged] | 17:39 |
| *** jsavak has quit IRC | 17:40 | |
| breton | stevemar: looks like resolved. Thank you, closing it. | 17:40 |
| stevemar | breton: thanks | 17:40 |
| *** jsavak has joined #openstack-keystone | 17:40 | |
| *** code-R has quit IRC | 17:45 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Use URIOpt for endpoint URL options https://review.openstack.org/350713 | 17:50 |
| *** julim has quit IRC | 17:53 | |
| mordred | stevemar: heya - any chance you have a timeframe for a ksa release in mind? | 17:55 |
| stevemar | mordred: already requested one this morning ;O https://review.openstack.org/#/c/350571/ | 17:56 |
| patchbot | stevemar: patch 350571 - releases - release keystoneauth 2.11.0 | 17:56 |
| mordred | neat! | 17:56 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth: Add tests for YamlJsonSerializer https://review.openstack.org/344943 | 17:56 |
| stevemar | mordred: just waiting for dims or dhellmann | 17:56 |
| *** julim has joined #openstack-keystone | 17:56 | |
| mordred | stevemar: soo .... any chance we can get that ^^ in before hand? | 17:56 |
| stevemar | mordred: you need 344943 in there? | 17:56 |
| stevemar | aye | 17:56 |
| stevemar | lemme take a quick look | 17:57 |
| mordred | (I found a bug in the code while adding tests ... fancy that) | 17:57 |
| stevemar | i was going through the open reviews in the morning and figured it was OK to relase cause that was just test related, didn't realize it was changing a fixture | 17:57 |
| mordred | yah - it was a one-liner. I should probably have written a better commit message | 17:58 |
| *** harlowja has quit IRC | 17:58 | |
| mordred | notmorgan: ^^ have a sec for a quick review? | 17:58 |
| *** haplo37__ has joined #openstack-keystone | 17:59 | |
| stevemar | mordred: can you fix one little typo in the sample URL | 17:59 |
| mordred | yes! | 17:59 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add role functional tests https://review.openstack.org/335118 | 17:59 |
| stevemar | its bugging me way too much that keystone is missing an e | 17:59 |
| *** ddieterly[away] is now known as ddieterly | 18:00 | |
| *** harlowja has joined #openstack-keystone | 18:00 | |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth: Add tests for YamlJsonSerializer https://review.openstack.org/344943 | 18:00 |
| mordred | stevemar: without an e, we're just a ton of keys | 18:01 |
| stevemar | mordred: i think you have to update the json too | 18:01 |
| mordred | piddle | 18:01 |
| stevemar | mordred: exactly! | 18:01 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth: Add tests for YamlJsonSerializer https://review.openstack.org/344943 | 18:02 |
| mordred | stevemar: how's that? | 18:02 |
| *** esp has quit IRC | 18:02 | |
| stevemar | mordred: poifect! | 18:03 |
| mordred | stevemar: if you haven't seen the output of this in action: https://review.openstack.org/#/c/344397/2/cassettes/citycloud/test_compute/TestCompute/test_set_and_delete_metadata.yaml | 18:06 |
| patchbot | mordred: patch 344397 - openstack-infra/shade - Migrate functional tests to betamax | 18:06 |
| stevemar | mordred: whoa thats a big file | 18:06 |
| mordred | yah. our API interactions may be a bit chatty | 18:07 |
| stevemar | city cloud is the cool new cloud provider | 18:07 |
| *** diazjf has joined #openstack-keystone | 18:08 | |
| *** tonytan4ever has quit IRC | 18:08 | |
| mordred | they're doing pretty well - although they are a floating ip cloud, which makes me a little sad | 18:08 |
| *** dave-mcc_ has quit IRC | 18:08 | |
| *** narengan has joined #openstack-keystone | 18:10 | |
| *** jaugustine has quit IRC | 18:13 | |
| *** gagehugo has quit IRC | 18:13 | |
| *** esp has joined #openstack-keystone | 18:13 | |
| *** nk2527 has quit IRC | 18:14 | |
| *** ddieterly is now known as ddieterly[away] | 18:16 | |
| *** ddieterly[away] is now known as ddieterly | 18:17 | |
| *** code-R has joined #openstack-keystone | 18:17 | |
| *** gagehugo has joined #openstack-keystone | 18:18 | |
| *** code-R_ has joined #openstack-keystone | 18:20 | |
| *** adrian_otto has quit IRC | 18:21 | |
| *** code-R has quit IRC | 18:23 | |
| *** sheel has quit IRC | 18:26 | |
| *** jaosorior has joined #openstack-keystone | 18:29 | |
| *** jaosorior has quit IRC | 18:30 | |
| *** jaugustine has joined #openstack-keystone | 18:33 | |
| notmorgan | ahahahahahaha somehow my OTP matched one of my gerrit reviews *boggle* | 18:34 |
| notmorgan | so copy/paste fail. | 18:34 |
| notmorgan | and i was wondering why you were wanting an infra change in ksa | 18:34 |
| *** jmlowe1 has quit IRC | 18:36 | |
| *** ayoung has quit IRC | 18:38 | |
| *** ddieterly is now known as ddieterly[away] | 18:40 | |
| *** ametts has joined #openstack-keystone | 18:45 | |
| *** nk2527 has joined #openstack-keystone | 18:45 | |
| *** julim has quit IRC | 18:46 | |
| mordred | :) | 18:48 |
| bknudson | Maybe notmorgan can help me with something I'm looking at... | 18:51 |
| bknudson | or anyone here. | 18:52 |
| bknudson | here's part of a stack trace: http://paste.openstack.org/show/547832/ | 18:52 |
| bknudson | so it's getting revocation event from the cache, and it's failing to parse whatever memcache returns. | 18:53 |
| bknudson | so 1) maybe something overwrote the line on us, or 2) maybe it was evicted and memcache returns a special value for that? | 18:54 |
| bknudson | Could use some more debug in this case. | 18:54 |
| bknudson | notmorgan: any idea? I'll look for docs. | 18:55 |
| *** haplo37__ has quit IRC | 18:55 | |
| *** jed56 has quit IRC | 18:55 | |
| notmorgan | bknudson: uhm, hold on. | 18:55 |
| *** adrian_otto has joined #openstack-keystone | 18:56 | |
| notmorgan | bknudson: you're running into something where the __init__ func is *not* a string. not sure what is being returned though. is this in master? some change you're working on? | 18:56 |
| bknudson | notmorgan: it's in master. We've got a team running rally on a test deployment. | 18:57 |
| bknudson | and they've been hitting this issue (it causes keystone to 500 on token validation) | 18:57 |
| notmorgan | bknudson: honestly, I have no idea what has been done to the keystone code base in the last 2+ months | 18:58 |
| notmorgan | so, i can look, but I'd also need to know what is being returned to revoke_model | 18:58 |
| stevemar | bknudson: that with liberty? | 18:58 |
| notmorgan | stevemar: master he says | 18:58 |
| bknudson | stevemar: no, this is master. | 18:58 |
| stevemar | bknudson: k | 18:58 |
| samueldmq | dstanek: asserting that a list is empty with assertFalse(list) is correct? | 18:59 |
| samueldmq | dstanek: it seems weird to me | 18:59 |
| bknudson | notmorgan: can you think of a reason why memcache wouldn't return what was stored in it? | 18:59 |
| notmorgan | bknudson: something stomping on memcache | 19:00 |
| notmorgan | bknudson: or a legit bug in the code, but we need to know what the data returned is. | 19:00 |
| bknudson | notmorgan: I wonder if we have to have code to protect ourselves from this? | 19:00 |
| notmorgan | mostly we assume keystone owns memcache keys | 19:00 |
| notmorgan | so if something is stomping on memcache, we don't really protect ourselves | 19:00 |
| bknudson | I'm trying to get on the system to see what it is... haven't done this before so not sure what the problem is. | 19:00 |
| stevemar | i was hoping you were also running into https://bugs.launchpad.net/keystone/+bug/1600393 | 19:00 |
| openstack | Launchpad bug 1600393 in OpenStack Identity (keystone) "AttributeError: 'list' object has no attribute 'items'" [Critical,Confirmed] | 19:00 |
| notmorgan | well actually | 19:01 |
| bknudson | stevemar: don't hope for us to run into bugs! | 19:01 |
| notmorgan | no this isn't memcache | 19:01 |
| notmorgan | this is in-memory dict | 19:01 |
| stevemar | bknudson: better for me to have 1 bug instead of 2 | 19:01 |
| notmorgan | this is in the request_local cache | 19:01 |
| notmorgan | so def. not memcache | 19:01 |
| bknudson | notmorgan: oh, good catch! | 19:01 |
| bknudson | might make this a little easier. | 19:02 |
| notmorgan | it's something that is occuring when msgpack is deserializing | 19:02 |
| *** gagehugo_ has joined #openstack-keystone | 19:02 | |
| notmorgan | it should make this a LOT easier :) | 19:02 |
| *** ravelar has quit IRC | 19:02 | |
| stevemar | yeah this one: https://github.com/openstack/keystone/blob/0c2fbef08c21f39998965379a9e2953c237735e4/keystone/common/cache/_context_cache.py#L24-L62 | 19:02 |
| stevemar | bknudson: maybe lbragstad's commit: https://github.com/openstack/keystone/commit/510f00f365cd988ca2a5d22413d488e8d78c9a89 ? | 19:02 |
| *** jsavak has quit IRC | 19:03 | |
| notmorgan | that shouldn't have broken things. | 19:03 |
| notmorgan | afaict | 19:03 |
| notmorgan | it's getting... oh wait ... | 19:03 |
| stevemar | the refactor could have changed a method signature | 19:03 |
| bknudson | Wish I could say if this just started happening or if it's been going on for a while. | 19:03 |
| bknudson | But I think they just started with the testing when they reported this bug and that's only been a couple weeks. | 19:04 |
| notmorgan | uhm. i ... wow this code has changed a bit. | 19:04 |
| *** dave-mccowan has joined #openstack-keystone | 19:04 | |
| stevemar | bknudson: revert that change i suggested, see if you still hit it | 19:05 |
| bknudson | stevemar: you make that sound so simple. | 19:05 |
| notmorgan | i think msgpack is storing something (object?) as a reference in **revoke_event_data | 19:06 |
| bknudson | notmorgan: is it possible for get() to return api.NO_VALUE? | 19:06 |
| *** fifieldt has quit IRC | 19:07 | |
| notmorgan | bknudson: which line? | 19:07 |
| notmorgan | also, yes. | 19:07 |
| *** haplo37__ has joined #openstack-keystone | 19:07 | |
| bknudson | I'll see if I can mock that up. | 19:07 |
| stevemar | bknudson: lol | 19:07 |
| notmorgan | bknudson: when the error occurs raise up a repr of revoke_event_data | 19:08 |
| notmorgan | bknudson: you'll know exactly what is being passed to __init__ | 19:08 |
| notmorgan | and we can more easily trace what is going on | 19:08 |
| *** tonytan4ever has joined #openstack-keystone | 19:08 | |
| notmorgan | bknudson: https://github.com/openstack/keystone/commit/510f00f365cd988ca2a5d22413d488e8d78c9a89#diff-b4c4265719691b41cde418bcfa152ee9R345 wherever that line is now. | 19:09 |
| bknudson | y, I need to figure out how to get on this system and change the code a bit. | 19:09 |
| bknudson | ok, thanks! | 19:09 |
| notmorgan | something is being stored incorrectly now in the dict, so you have keys that aren't strings, possibly an object, and the revokeevent is cranky (more specifically python is) about it | 19:10 |
| bknudson | notmorgan: do you know if there's some way for deserialize to indicate that the data it got was just bad / unexpected? | 19:13 |
| *** tonytan4ever has quit IRC | 19:13 | |
| bknudson | and just return that there's no object instead of failing? | 19:13 |
| bknudson | maybe just catch the exception and return api.NO_VALUE | 19:14 |
| *** nisha_ has joined #openstack-keystone | 19:15 | |
| *** nishaYadav has quit IRC | 19:15 | |
| *** nisha_ is now known as nishaYadav | 19:15 | |
| mordred | stevemar: don't be mad k? | 19:16 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth: Add tests for YamlJsonSerializer https://review.openstack.org/344943 | 19:17 |
| mordred | stevemar: we missed a place with keystonauth | 19:17 |
| *** ddieterly[away] is now known as ddieterly | 19:17 | |
| stevemar | mordred: those damn tons of keys! | 19:18 |
| *** diazjf has quit IRC | 19:18 | |
| *** fifieldt has joined #openstack-keystone | 19:18 | |
| mordred | stevemar: I git grepped this time :) | 19:19 |
| notmorgan | bknudson: msgpack doesn't know anything about the data besides what that serializer does | 19:19 |
| *** jsavak has joined #openstack-keystone | 19:19 | |
| notmorgan | bknudson: so the smarts have to be in the msgpack serializer/deserializer | 19:19 |
| notmorgan | bknudson: if RevokeEvent wasn't so weird, it would just work w/o magic code | 19:19 |
| mordred | notmorgan: we're msgpacking now? | 19:20 |
| bknudson | what's weird about it? | 19:20 |
| *** diazjf has joined #openstack-keystone | 19:20 | |
| notmorgan | mordred: only in the request local cache, becuase revokeevent is ... icky | 19:20 |
| mordred | ah - interesting | 19:20 |
| notmorgan | bknudson: well, json just throws it's hands up assuming circular deps among other things | 19:20 |
| mordred | I was going to suggest protobuf instead ... but maybe not for that :) | 19:20 |
| bknudson | I thought we changed it to a list... | 19:20 |
| notmorgan | bknudson: that is the issue. | 19:21 |
| notmorgan | it's not *just* a list | 19:21 |
| notmorgan | it has references to references to references in the list | 19:21 |
| notmorgan | and has added properties that make it so msgpack can't just deserialize | 19:21 |
| notmorgan | https://github.com/openstack/keystone/blob/0c2fbef08c21f39998965379a9e2953c237735e4/keystone/models/revoke_model.py#L75 | 19:21 |
| notmorgan | basically it is a bad object design at this point | 19:22 |
| bknudson | here's the commit https://github.com/openstack/keystone/commit/75abc21ecfc2a37c10be61289204b5056403dd5c | 19:23 |
| bknudson | I don't see any refs in the current revoke model. | 19:23 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 roles https://review.openstack.org/334546 | 19:23 |
| notmorgan | we still use the revokeevent object | 19:24 |
| notmorgan | according to that commit | 19:24 |
| notmorgan | it's not the "tree" it's the actual event that is na issue | 19:24 |
| bknudson | so msgpack might be useful here but not necessary, could use json | 19:24 |
| notmorgan | you can try and make json work again. | 19:24 |
| bknudson | it's not referencing other complex objects. | 19:25 |
| notmorgan | i gave up on it | 19:25 |
| notmorgan | the only reason to use msgpack was the inability to serialize the revokeevent & tree | 19:25 |
| notmorgan | json is ~13usec vs 60-100useq | 19:25 |
| notmorgan | iirc | 19:25 |
| notmorgan | for serialize/deserialize | 19:26 |
| bknudson | what does the standard serialization work with? only dicts? | 19:26 |
| notmorgan | python primitives | 19:26 |
| notmorgan | if you only use the primitives, json will work | 19:26 |
| notmorgan | so no custom classes | 19:26 |
| bknudson | so if we MEMOIZE something it can only return primitives? | 19:27 |
| bknudson | otherwise we need custom serdes. | 19:27 |
| notmorgan | well memcache uses pickle... but that aside | 19:27 |
| bknudson | yaa! | 19:27 |
| notmorgan | i had everything *but* revoke events working with json | 19:28 |
| notmorgan | and the only reason we're using msgpack / json is because deepcopy is wonky as hell and inconsistent | 19:29 |
| notmorgan | otherwise i'd just have deepcopied the objects fotr the request_local cache | 19:29 |
| notmorgan | but msgpack is easiest, if we make RevokeEvent work without the custom serializer, yay. | 19:29 |
| notmorgan | it would mean we have a lot less magic code to maintain | 19:30 |
| notmorgan | it *may* just work now to remove the handler | 19:30 |
| bknudson | easy enough to try it. | 19:30 |
| *** jsavak has quit IRC | 19:30 | |
| bknudson | I'll give it a shot. | 19:30 |
| *** jsavak has joined #openstack-keystone | 19:31 | |
| notmorgan | i think the reason we couldn't json serialize is we have datetime objects | 19:31 |
| notmorgan | and those get rehydrated as strings. | 19:31 |
| bknudson | shoot | 19:31 |
| *** tesseract- has joined #openstack-keystone | 19:31 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add role functional tests https://review.openstack.org/335118 | 19:32 |
| nishaYadav | samueldmq, ^ | 19:32 |
| notmorgan | i'm guessing at some of these because i've been trying to be not-involved in keystone things for a bit so brain has swapped most of this out | 19:32 |
| *** ametts has quit IRC | 19:32 | |
| bknudson | we'll keep dragging you back in -- https://www.youtube.com/watch?v=UPw-3e_pzqU | 19:32 |
| *** clenimar has quit IRC | 19:34 | |
| *** clenimar has joined #openstack-keystone | 19:35 | |
| *** tesseract- has quit IRC | 19:37 | |
| *** ametts has joined #openstack-keystone | 19:45 | |
| *** ayoung has joined #openstack-keystone | 19:45 | |
| *** ChanServ sets mode: +v ayoung | 19:45 | |
| *** roxanaghe has quit IRC | 19:48 | |
| *** tonytan4ever has joined #openstack-keystone | 19:49 | |
| *** gagehugo has quit IRC | 19:52 | |
| *** narengan1 has joined #openstack-keystone | 19:58 | |
| *** gagehugo_ has quit IRC | 20:00 | |
| *** narengan has quit IRC | 20:00 | |
| lbragstad | dstanek ayoung stevemar breton thoughts on my comment here - https://review.openstack.org/#/c/350704/1/keystone/tests/unit/test_auth.py | 20:00 |
| patchbot | lbragstad: patch 350704 - keystone - Make all token provider behave the same with trusts | 20:00 |
| lbragstad | it's about another inconsistency between the fernet and uuid providers | 20:01 |
| *** narengan has joined #openstack-keystone | 20:01 | |
| *** gagehugo has joined #openstack-keystone | 20:02 | |
| *** permalac has quit IRC | 20:02 | |
| *** permalac has joined #openstack-keystone | 20:03 | |
| *** narengan1 has quit IRC | 20:04 | |
| *** daemontool has joined #openstack-keystone | 20:10 | |
| *** nishaYadav has quit IRC | 20:13 | |
| stevemar | lbragstad: meant to look at it, got distracted, will do now | 20:14 |
| stevemar | lbragstad: line 250 here makes me sad: https://review.openstack.org/#/c/350704/1/keystone/models/revoke_model.py | 20:15 |
| patchbot | stevemar: patch 350704 - keystone - Make all token provider behave the same with trusts | 20:15 |
| lbragstad | stevemar what - the fact that it was completely broken? | 20:16 |
| stevemar | lbragstad: yeah, it gave me a sad | 20:17 |
| stevemar | lbragstad make my sad go away | 20:17 |
| lbragstad | stevemar yeah - that will start to happen when we get jamielennox's view stuff implemented for auth | 20:17 |
| stevemar | biab, gonna straight my legs | 20:17 |
| stevemar | lbragstad: yep | 20:18 |
| *** adrian_otto has quit IRC | 20:24 | |
| jamielennox | o/ | 20:25 |
| jamielennox | oh, i was trying to play with models as well - that's going to be a hard change | 20:26 |
| jamielennox | (code models) | 20:26 |
| jamielennox | damnit that whole sentence is terrible, might get tea and try and start the day again in a few minutes | 20:26 |
| stevemar | jamielennox: that last sentence was so aussie | 20:28 |
| *** lamt_ is now known as help | 20:29 | |
| stevemar | dayuum lbragstad you did some serious digging around | 20:29 |
| *** help is now known as Guest23344 | 20:29 | |
| stevemar | lbragstad: must be those new glasses that make you extra smart | 20:29 |
| lbragstad | stevemar yeah - i'm fried | 20:29 |
| lbragstad | what started as a "just delete this test and fix the failure" turned into a huge spiraling rabbit hole | 20:31 |
| *** Guest23344 has quit IRC | 20:31 | |
| *** Guest23344 has joined #openstack-keystone | 20:32 | |
| *** ddieterly is now known as ddieterly[away] | 20:32 | |
| *** Guest23344 is now known as LamT | 20:34 | |
| dstanek | lbragstad: good catch | 20:34 |
| bknudson | lbragstad: stevemar: is there another security bug with revocation events? (regarding https://review.openstack.org/#/c/350704/1/keystone/models/revoke_model.py ) | 20:38 |
| patchbot | bknudson: patch 350704 - keystone - Make all token provider behave the same with trusts | 20:38 |
| *** roxanaghe has joined #openstack-keystone | 20:39 | |
| bknudson | even though I don't work on security bug handling anymore I'm still paranoid. | 20:39 |
| lbragstad | bknudson well - it was completely broken | 20:39 |
| lbragstad | the build_token_values_v2 method seemed to be complete broken | 20:39 |
| *** ddieterly[away] is now known as ddieterly | 20:40 | |
| jamielennox | yea, i've been looking through the auth stuff as well, i'm not sure how it manages to work at all | 20:41 |
| bknudson | luck. | 20:41 |
| bknudson | magic? | 20:41 |
| lbragstad | yes | 20:41 |
| lbragstad | and meth | 20:41 |
| jamielennox | bknudson: history, and bad unit tests | 20:41 |
| stevemar | rule #1 of keystone, don't look at keystone.auth and keystone.token | 20:42 |
| bknudson | if we ran it through a code obfuscator, could we tell the difference? | 20:42 |
| dstanek | bknudson: yes, it would get better | 20:43 |
| stevemar | maybe a pinch, just cause we know the original from painful memories | 20:43 |
| bknudson | lol | 20:43 |
| *** jsavak has quit IRC | 20:46 | |
| *** jsavak has joined #openstack-keystone | 20:46 | |
| *** daemontool has quit IRC | 20:48 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make all token provider behave the same with trusts https://review.openstack.org/350704 | 20:51 |
| lbragstad | stevemar dstanek jamielennox bknudson updated with comments | 20:51 |
| *** ametts has quit IRC | 20:52 | |
| *** ntpttr- is now known as ntpttr | 20:56 | |
| jamielennox | lbragstad: i don't know if i want to understand that | 20:56 |
| lbragstad | jamielennox which one/ | 20:57 |
| jamielennox | token providers and trusts | 20:57 |
| lbragstad | jamielennox I have a couple short-story length comments in there that attempt to help | 20:58 |
| *** jsavak has quit IRC | 20:58 | |
| *** pauloewerton has quit IRC | 21:13 | |
| *** fifieldt has quit IRC | 21:15 | |
| *** ddieterly is now known as ddieterly[away] | 21:16 | |
| *** michauds has quit IRC | 21:23 | |
| *** fifieldt has joined #openstack-keystone | 21:25 | |
| *** narengan has quit IRC | 21:26 | |
| *** adriant has joined #openstack-keystone | 21:33 | |
| *** ddieterly[away] is now known as ddieterly | 21:36 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add rolling upgrade documentation https://review.openstack.org/350793 | 21:37 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Introduce read-only mode for the database https://review.openstack.org/349700 | 21:41 |
| *** sdake has quit IRC | 21:43 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Ignore errors deserializing revocation events https://review.openstack.org/350799 | 21:47 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add debug logging for RevokeEvent deserialize problem https://review.openstack.org/350804 | 21:56 |
| *** markvoelker has quit IRC | 21:58 | |
| *** markvoelker has joined #openstack-keystone | 21:59 | |
| mfisch | browne1: you around? | 22:01 |
| browne1 | yep | 22:01 |
| mfisch | browne1: which cache did you turn off? Keystone or middleware? | 22:03 |
| *** markvoelker has quit IRC | 22:03 | |
| browne1 | mfisch: turned off keystones cache | 22:03 |
| mfisch | are you using middleware cache? | 22:04 |
| browne1 | not sure, where is it set? in keystone.conf? | 22:05 |
| mfisch | so you have in effect 2 layers of cache | 22:05 |
| mfisch | 1 is keystone's own cache which it sounds like you use | 22:05 |
| mfisch | 2 is that nova (for example) can cache that a token is valid - middleware cache | 22:05 |
| browne1 | i changed [cache]/enabled=false in keystone.conf | 22:05 |
| mfisch | and then it won't need to hit keystone | 22:05 |
| mfisch | L2 and L1 cache in effect | 22:05 |
| mfisch | thats keystone cache | 22:05 |
| *** adrian_otto has joined #openstack-keystone | 22:06 | |
| mfisch | else would be in nova|cinder|glance|etc.conf | 22:06 |
| mfisch | btw - once this works, I'd recommend enabling that one ^ | 22:06 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 22:06 |
| jamielennox | middleware cache in auth_token middleware? | 22:06 |
| mfisch | y | 22:06 |
| jamielennox | that shouldn't be in play for keyston | 22:06 |
| mfisch | just confirming | 22:06 |
| mfisch | I'm getting dirty looks from the team so need to disable now | 22:07 |
| jamielennox | did you get any further on how this info got into cache? | 22:07 |
| browne1 | doesn't look like we're taking advantage of any caching in keystone_authtoken for the various services | 22:07 |
| *** spzala has quit IRC | 22:08 | |
| *** diazjf has quit IRC | 22:08 | |
| jamielennox | oh, are you sharing the memcache backend between authtoken services and keystone? | 22:08 |
| mfisch | no | 22:08 |
| mfisch | I'm asking browne1 which he meant when he said he turned off caching to make this issue go away | 22:08 |
| *** spzala has joined #openstack-keystone | 22:08 | |
| mfisch | separate boxes, separate memcache servers for me | 22:08 |
| browne1 | we only noticed problems in the caching when we ran performance/scale testing using Rally | 22:09 |
| browne1 | although the role caching we noticed broke for us right away | 22:10 |
| mfisch | if you look closely I bet its causing other issues | 22:10 |
| mfisch | we catch it on every 3rd deploy | 22:10 |
| browne1 | our ansible playbooks to configure keystone and grant roles failed. authorization failed for glance right after granted the role to the user | 22:10 |
| mfisch | puppet making api calls and 1/1000 fails and its enough | 22:10 |
| rodrigods | stevemar, kinda cool using openstackclient for SAML http://rodrigods.com/what-about-ecp/ | 22:13 |
| *** spzala has quit IRC | 22:13 | |
| *** adrian_otto has quit IRC | 22:16 | |
| * dstanek is interested and needs to read the backlog | 22:16 | |
| dstanek | browne1: what are the problems you are seeing? | 22:17 |
| browne1 | dstanek: basically, we saw various places where caching was used and received invalid data from it | 22:19 |
| browne1 | https://bugs.launchpad.net/keystone/+bugs?search=Search&field.bug_reporter=ericwb | 22:19 |
| browne1 | i opened these 3 bugs. they aren't easy to recreate. only our scale/perf testing found them. | 22:20 |
| dstanek | browne1: oh, cool, bugs. i can start taking a look. i'm actually working on a cache bug now anyway | 22:20 |
| dstanek | breton: have you run the same tests with caching off too? | 22:21 |
| browne1 | saw crazy things like v3 tokens with v2 service catalog | 22:21 |
| jamielennox | rodrigods: hey - can you test that with OSC 3? | 22:24 |
| jamielennox | rodrigods: i haven't had a usable saml environment for a while, but with the switch to keystoneauth the plugins have changed | 22:24 |
| dtroyer | rodrigods, jamielennox: (re OSC 3) that would be this review: https://review.openstack.org/346113 + current osc-lib and os-client-config | 22:26 |
| dtroyer | where current == master | 22:26 |
| jamielennox | dtroyer: oh, i thought the keystoneauth stuff was already merge | 22:27 |
| jamielennox | d | 22:27 |
| dtroyer | jamielennox: nearly done, I finished fixing o-c-c this morning. osc-lib should be ready, and that osc review needs a rebase | 22:27 |
| dtroyer | then it's test like mad ;) | 22:28 |
| dtroyer | o-c-c 1.19.0 release will be submitted in a few minutes ;) | 22:28 |
| rodrigods | jamielennox, of course, will do that today | 22:29 |
| rodrigods | jamielennox, do i need an updated keystoneauth as well? | 22:29 |
| rodrigods | and keystoneclient? | 22:29 |
| jamielennox | dtroyer: ahh o-c-c, | 22:29 |
| *** gordc has quit IRC | 22:29 | |
| dtroyer | I've been working with current release ksa and ksc, but ksc should be a don't care for this | 22:30 |
| jamielennox | rodrigods: i think most recent release of KSA and maybe os-client-config | 22:30 |
| rodrigods | jamielennox, got it | 22:30 |
| rodrigods | was worried about the entry points in ksc | 22:30 |
| jamielennox | the auth_type will change, but i want to make sure you can get a scoped token directly and do operations with it | 22:30 |
| jamielennox | rodrigods: your example uses v3unscopedsaml which is not really useful because you can't do anything with it | 22:31 |
| *** ddieterly has quit IRC | 22:31 | |
| rodrigods | jamielennox, i scope it later | 22:32 |
| rodrigods | using v3scopedsaml | 22:32 |
| rodrigods | that was the "workflow" that worked: first get unscoped -> scope | 22:32 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Removal of deprecated direct driver loading https://review.openstack.org/350815 | 22:32 |
| *** ddieterly has joined #openstack-keystone | 22:32 | |
| jamielennox | rodrigods: yep - i never liked that workflow because it involves the user having to do multiple manual steps | 22:33 |
| jamielennox | in ksa we fixed it | 22:33 |
| rodrigods | yeah | 22:33 |
| rodrigods | jamielennox, what i really don't like is that we have no idea of what auth plugins are available | 22:34 |
| jamielennox | the new one is v3samlpassword and you should be able to use it with a --project-name directly | 22:34 |
| jamielennox | hmm so i expose it with ksa | 22:34 |
| jamielennox | dtroyer: ^ | 22:34 |
| rodrigods | would be nice to have a osc command to display them | 22:34 |
| jamielennox | dtroyer: what about an osc auth-info command | 22:34 |
| jamielennox | i don't know how os-c-c would be involved, but you can easily list available plugins and the Opts they all provide | 22:35 |
| dtroyer | I thought we had something, in previous incarnations the list of plugins was in the help | 22:35 |
| *** spzala has joined #openstack-keystone | 22:35 | |
| dtroyer | it does need to be easier to find | 22:35 |
| dtroyer | and I'm not sure if the current incarnation still gets the help list right | 22:35 |
| jamielennox | dtroyer: we do that horrible thing where all the auth opts are mashed together | 22:35 |
| *** ddieterly has quit IRC | 22:35 | |
| dtroyer | I'm trying to dump that | 22:36 |
| jamielennox | dtroyer: i've had a few reviews to remove that, but i don't know if i proposed it this time around | 22:36 |
| dtroyer | may not make it for 3.0, but have gotten closer | 22:36 |
| jamielennox | yea, i don't consider that a breaking change so just whenever | 22:36 |
| dtroyer | everything is different in the arg handling now with o-c-c and osc-lib in the mix | 22:36 |
| jamielennox | yea, but o-c-c does so much now i don't know how to fix it | 22:37 |
| dtroyer | slowly, one refactor at a time ;) | 22:37 |
| *** julim has joined #openstack-keystone | 22:37 | |
| jamielennox | we can merge all the os-cloud stuff back into keystoneauth :) | 22:37 |
| dtroyer | I hacked through the major bits and use a subclass for the rest right now | 22:37 |
| *** spzala has quit IRC | 22:38 | |
| *** spzala has joined #openstack-keystone | 22:38 | |
| jamielennox | so i merged some stuff to keystoneauth to help with all this | 22:38 |
| jamielennox | Opt now has prompt so we can kill that guessing from osc | 22:39 |
| jamielennox | i did a thing where you can have a loader choose different plugins based on what options are provided | 22:39 |
| jamielennox | which should help abstract the use token_endpoint if --os-url/--os-token else use password | 22:40 |
| jamielennox | but i was going to say - can we just use straight 'password' plugin by default for OSC 3? | 22:40 |
| jamielennox | token_endpoint should be less useful with doing keystone bootstrap | 22:40 |
| dtroyer | I think we've already done that, can't remember if it was in the 2.6.0 release or not, so yes ;) | 22:41 |
| dtroyer | all of the mucking about with options in OSC has been consolidated into the o-c-c- subclass in osc-lib, so now we just sort out what belongs where and we'll have this mess cleaned up | 22:41 |
| jamielennox | i'm not touching it till you've decided you're finished | 22:43 |
| jamielennox | too much stuff happening at the same time | 22:43 |
| dtroyer | we're getting close to that point. I'm sure you'll find things that can be simplified once this settles down | 22:50 |
| *** KevinE has quit IRC | 22:54 | |
| *** sdake has joined #openstack-keystone | 23:03 | |
| *** Gorian_ has quit IRC | 23:27 | |
| *** tonytan4ever has quit IRC | 23:33 | |
| breton | dstanek: which tests? | 23:34 |
| breton | dstanek: the ones with trusts? | 23:35 |
| *** hoonetorg has quit IRC | 23:39 | |
| *** hoonetorg has joined #openstack-keystone | 23:44 | |
| *** roxanaghe has quit IRC | 23:47 | |
| *** jamielennox is now known as jamielennox|away | 23:48 | |
| *** jrist has quit IRC | 23:49 | |
| *** sdake has quit IRC | 23:51 | |
| *** ravelar has joined #openstack-keystone | 23:53 | |
| *** spzala has quit IRC | 23:55 | |
| *** code-R_ has quit IRC | 23:55 | |
| *** sdake has joined #openstack-keystone | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!