| openstackgerrit | Adrian Turjak proposed openstack/keystone-specs: New TOTP contrib plugin for non-admin access to TOTP credentials https://review.openstack.org/345705 | 00:10 |
|---|---|---|
| openstackgerrit | Adrian Turjak proposed openstack/keystone-specs: New TOTP contrib plugin for non-admin access to TOTP credentials https://review.openstack.org/345705 | 00:12 |
| *** chrisshattuck has quit IRC | 00:12 | |
| *** ravelar has joined #openstack-keystone | 00:24 | |
| *** adrian_otto has joined #openstack-keystone | 00:47 | |
| *** adrian_otto has quit IRC | 00:50 | |
| *** code-R has joined #openstack-keystone | 00:57 | |
| *** serverascode has quit IRC | 01:10 | |
| *** jraim has quit IRC | 01:10 | |
| *** xenogear has quit IRC | 01:11 | |
| *** ctracey has quit IRC | 01:11 | |
| *** zhiyan has quit IRC | 01:11 | |
| *** gagehugo has joined #openstack-keystone | 01:13 | |
| *** ctracey has joined #openstack-keystone | 01:19 | |
| *** davechen has joined #openstack-keystone | 01:20 | |
| *** xiaoyang has joined #openstack-keystone | 01:23 | |
| *** magic has joined #openstack-keystone | 01:24 | |
| *** magic is now known as Guest47074 | 01:25 | |
| *** sdake_ has quit IRC | 01:25 | |
| *** serverascode has joined #openstack-keystone | 01:27 | |
| *** zhiyan has joined #openstack-keystone | 01:27 | |
| *** xiaoyang has quit IRC | 01:28 | |
| *** jraim has joined #openstack-keystone | 01:28 | |
| *** Guest47074 has quit IRC | 01:28 | |
| *** jamielennox is now known as jamielennox|away | 01:30 | |
| *** sdake has joined #openstack-keystone | 01:30 | |
| *** EinstCrazy has joined #openstack-keystone | 01:41 | |
| *** EinstCrazy has quit IRC | 01:42 | |
| *** EinstCrazy has joined #openstack-keystone | 01:42 | |
| *** jamielennox|away is now known as jamielennox | 01:43 | |
| *** wangqun has joined #openstack-keystone | 01:47 | |
| *** chrisshattuck has joined #openstack-keystone | 01:57 | |
| *** EinstCrazy has quit IRC | 02:00 | |
| *** EinstCrazy has joined #openstack-keystone | 02:01 | |
| *** su_zhang has joined #openstack-keystone | 02:02 | |
| stevemar | davechen: for the mapping schema update... what about linking to http://git.openstack.org/cgit/openstack/keystone/tree/keystone/federation/utils.py ? | 02:16 |
| *** EinstCrazy has quit IRC | 02:17 | |
| *** EinstCrazy has joined #openstack-keystone | 02:18 | |
| davechen | stevemar: that's what I thought it should be, link to the file should be safer although that could be updated too. | 02:20 |
| stevemar | true... | 02:20 |
| stevemar | we could just remove the reference | 02:21 |
| davechen | stevemar: agreed. | 02:21 |
| stevemar | davechen: i'll make the change | 02:21 |
| stevemar | i'll remove the sentence | 02:21 |
| davechen | stevemar: thank you sir! | 02:21 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update mapping schema in the docs. https://review.openstack.org/361252 | 02:22 |
| *** adrian_otto has joined #openstack-keystone | 02:24 | |
| *** adrian_otto has quit IRC | 02:28 | |
| stevemar | davechen: ty! | 02:29 |
| openstackgerrit | Dave Chen proposed openstack/keystone: The mapping schema is now super long and complex, and anyone interested in it can go to our code base and read about it, no need to track in the doc. https://review.openstack.org/361252 | 02:30 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove mapping schema from the doc https://review.openstack.org/361252 | 02:31 |
| davechen | stevemar: just copy and paste your comments | 02:32 |
| davechen | :) | 02:32 |
| *** ravelar has quit IRC | 02:32 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove mapping schema from the doc https://review.openstack.org/361252 | 02:33 |
| davechen | dammnnn... | 02:33 |
| *** haplo37__ has quit IRC | 02:49 | |
| stevemar | :) | 02:51 |
| stevemar | thanks davechen | 02:51 |
| *** code-R has quit IRC | 02:58 | |
| *** rkrum has joined #openstack-keystone | 03:11 | |
| *** su_zhang has quit IRC | 03:20 | |
| *** su_zhang has joined #openstack-keystone | 03:20 | |
| *** jamielennox is now known as jamielennox|away | 03:21 | |
| *** su_zhang has quit IRC | 03:24 | |
| *** markvoelker has joined #openstack-keystone | 03:27 | |
| *** markvoelker_ has joined #openstack-keystone | 03:29 | |
| *** markvoelker has quit IRC | 03:33 | |
| *** adrian_otto has joined #openstack-keystone | 03:38 | |
| *** code-R has joined #openstack-keystone | 03:38 | |
| *** adrian_otto has quit IRC | 03:39 | |
| *** chrisshattuck has quit IRC | 03:41 | |
| *** code-R has quit IRC | 03:45 | |
| *** aswadr_ has joined #openstack-keystone | 03:45 | |
| *** code-R has joined #openstack-keystone | 03:46 | |
| *** adrian_otto has joined #openstack-keystone | 03:46 | |
| *** code-R has quit IRC | 03:50 | |
| *** adrian_otto has quit IRC | 03:51 | |
| openstackgerrit | Merged openstack/keystone: [api] add relationship links to v3-ext https://review.openstack.org/356485 | 03:52 |
| *** adrian_otto has joined #openstack-keystone | 03:52 | |
| *** markvoelker_ has quit IRC | 03:53 | |
| *** markvoelker has joined #openstack-keystone | 03:54 | |
| *** adrian_otto has quit IRC | 03:56 | |
| *** jamielennox|away is now known as jamielennox | 03:56 | |
| openstackgerrit | Nam Nguyen Hoai proposed openstack/keystone: Fix formatting strings when using nultiple variables https://review.openstack.org/361822 | 03:57 |
| *** roxanaghe has joined #openstack-keystone | 03:57 | |
| *** roxanaghe has quit IRC | 04:06 | |
| *** chlong has quit IRC | 04:12 | |
| *** tonytan4ever has quit IRC | 04:13 | |
| *** roxanaghe has joined #openstack-keystone | 04:19 | |
| *** chlong has joined #openstack-keystone | 04:25 | |
| *** namnh has joined #openstack-keystone | 04:28 | |
| *** sheel has joined #openstack-keystone | 04:33 | |
| *** links has joined #openstack-keystone | 04:33 | |
| openstackgerrit | Nam Nguyen Hoai proposed openstack/keystone: Fix formatting strings when using nultiple variables https://review.openstack.org/361822 | 04:38 |
| *** code-R has joined #openstack-keystone | 04:44 | |
| openstackgerrit | Merged openstack/keystone: Remove mapping schema from the doc https://review.openstack.org/361252 | 04:46 |
| *** jaosorior has joined #openstack-keystone | 04:52 | |
| *** xiaoyang has joined #openstack-keystone | 04:52 | |
| openstackgerrit | Nam Nguyen Hoai proposed openstack/keystone: Fix formatting strings when using multiple variables https://review.openstack.org/361822 | 04:53 |
| *** magic has joined #openstack-keystone | 04:58 | |
| *** magic is now known as Guest98474 | 04:59 | |
| *** xiaoyang has quit IRC | 05:02 | |
| *** sdake_ has joined #openstack-keystone | 05:10 | |
| breton | morning keystone | 05:11 |
| dstanek | breton: ha, morning. just getting ready to go to sleep | 05:12 |
| *** sdake_ is now known as dake | 05:13 | |
| *** sdake has quit IRC | 05:13 | |
| *** dake is now known as sdake | 05:13 | |
| *** tonytan4ever has joined #openstack-keystone | 05:13 | |
| openstackgerrit | Nam Nguyen Hoai proposed openstack/keystone: Fix formatting strings when using multiple variables https://review.openstack.org/361822 | 05:16 |
| openstackgerrit | Merged openstack/keystone: Modify sql banned operations for each of the new repos https://review.openstack.org/358723 | 05:17 |
| *** code-R_ has joined #openstack-keystone | 05:17 | |
| *** chrisshattuck has joined #openstack-keystone | 05:17 | |
| *** adriant has quit IRC | 05:17 | |
| *** tonytan4ever has quit IRC | 05:18 | |
| *** code-R has quit IRC | 05:20 | |
| *** chrisshattuck has quit IRC | 05:25 | |
| *** sdake has quit IRC | 05:26 | |
| *** chrisshattuck has joined #openstack-keystone | 05:31 | |
| *** chrisshattuck has quit IRC | 05:35 | |
| *** markvoelker has quit IRC | 05:36 | |
| *** richm has quit IRC | 05:38 | |
| *** roxanaghe has quit IRC | 05:39 | |
| *** code-R_ has quit IRC | 05:39 | |
| *** code-R has joined #openstack-keystone | 05:39 | |
| *** adrian_otto has joined #openstack-keystone | 05:56 | |
| *** adrian_otto has quit IRC | 06:04 | |
| *** markvoelker has joined #openstack-keystone | 06:07 | |
| *** markvoelker has quit IRC | 06:11 | |
| *** code-R has quit IRC | 06:12 | |
| *** code-R has joined #openstack-keystone | 06:13 | |
| *** code-R has quit IRC | 06:17 | |
| openstackgerrit | Nam Nguyen Hoai proposed openstack/keystone: Fix formatting strings when using multiple variables https://review.openstack.org/361882 | 06:34 |
| *** roxanaghe has joined #openstack-keystone | 06:36 | |
| *** markvoelker has joined #openstack-keystone | 06:36 | |
| *** roxanaghe has quit IRC | 06:40 | |
| *** markvoelker has quit IRC | 06:41 | |
| *** rcernin has joined #openstack-keystone | 06:47 | |
| *** pcaruana has joined #openstack-keystone | 07:00 | |
| openstackgerrit | Tuan Luong-Anh proposed openstack/keystone: Remove import unused https://review.openstack.org/361890 | 07:01 |
| *** tesseract- has joined #openstack-keystone | 07:01 | |
| *** aswadr_ has quit IRC | 07:01 | |
| *** markvoelker has joined #openstack-keystone | 07:06 | |
| openstackgerrit | Nam Nguyen Hoai proposed openstack/keystone: Fix formatting strings when using multiple variables https://review.openstack.org/361895 | 07:06 |
| *** markvoelker has quit IRC | 07:12 | |
| *** jpena|off is now known as jpena | 07:13 | |
| *** code-R has joined #openstack-keystone | 07:29 | |
| *** EinstCrazy has quit IRC | 07:34 | |
| *** EinstCrazy has joined #openstack-keystone | 07:35 | |
| *** rkrum has quit IRC | 07:35 | |
| *** markvoelker has joined #openstack-keystone | 07:36 | |
| *** Guest98474 has quit IRC | 07:37 | |
| *** xiaoyang has joined #openstack-keystone | 07:38 | |
| *** markvoelker has quit IRC | 07:41 | |
| *** xiaoyang has quit IRC | 07:42 | |
| *** xiaoyang has joined #openstack-keystone | 07:42 | |
| *** code-R_ has joined #openstack-keystone | 07:45 | |
| *** code-R has quit IRC | 07:48 | |
| *** EinstCra_ has joined #openstack-keystone | 07:50 | |
| openstackgerrit | Tuan Luong-Anh proposed openstack/keystone: Remove import unused https://review.openstack.org/361890 | 07:51 |
| *** EinstCrazy has quit IRC | 07:53 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:01 | |
| *** code-R_ has quit IRC | 08:02 | |
| *** code-R has joined #openstack-keystone | 08:02 | |
| *** markvoelker has joined #openstack-keystone | 08:05 | |
| *** links has quit IRC | 08:06 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** markvoelker has quit IRC | 08:10 | |
| *** marekd2 has joined #openstack-keystone | 08:14 | |
| *** roxanaghe has joined #openstack-keystone | 08:24 | |
| *** roxanaghe has quit IRC | 08:29 | |
| *** markvoelker has joined #openstack-keystone | 08:33 | |
| *** code-R has quit IRC | 08:34 | |
| *** markvoelker has quit IRC | 08:38 | |
| *** marekd2 has quit IRC | 08:40 | |
| *** tonytan4ever has joined #openstack-keystone | 08:44 | |
| *** tonytan4ever has quit IRC | 08:49 | |
| *** markvoelker has joined #openstack-keystone | 09:03 | |
| openstackgerrit | Anh Tran proposed openstack/keystone: Add Response Example for 'Update credential' API https://review.openstack.org/361954 | 09:03 |
| *** markvoelker has quit IRC | 09:07 | |
| openstackgerrit | Anh Tran proposed openstack/keystone: Add Response Example for 'Passwd auth with unscoped authorization' https://review.openstack.org/361960 | 09:18 |
| openstackgerrit | Anh Tran proposed openstack/keystone: Add Response Example for 'Passwd auth with unscoped authorization' https://review.openstack.org/361960 | 09:21 |
| *** guoshan has joined #openstack-keystone | 09:30 | |
| *** markvoelker has joined #openstack-keystone | 09:31 | |
| *** flaper87 has quit IRC | 09:35 | |
| *** markvoelker has quit IRC | 09:35 | |
| *** code-R has joined #openstack-keystone | 09:37 | |
| *** code-R_ has joined #openstack-keystone | 09:39 | |
| *** code-R has quit IRC | 09:42 | |
| *** rkrum has joined #openstack-keystone | 09:42 | |
| openstackgerrit | Anh Tran proposed openstack/keystone: Fix wrong response codes in 'groups' APIs. https://review.openstack.org/361973 | 09:45 |
| *** rkrum has quit IRC | 09:47 | |
| openstackgerrit | Anh Tran proposed openstack/keystone: Add Response Example for 'Create credential' API https://review.openstack.org/361954 | 09:48 |
| *** flaper87 has joined #openstack-keystone | 09:53 | |
| *** flaper87 has quit IRC | 09:54 | |
| *** flaper87 has joined #openstack-keystone | 09:54 | |
| *** zigo_ is now known as zigo | 09:56 | |
| *** markvoelker has joined #openstack-keystone | 10:00 | |
| *** markvoelker has quit IRC | 10:05 | |
| *** namnh has quit IRC | 10:07 | |
| *** richm has joined #openstack-keystone | 10:12 | |
| *** roxanaghe has joined #openstack-keystone | 10:12 | |
| *** roxanaghe has quit IRC | 10:17 | |
| *** guoshan has quit IRC | 10:26 | |
| *** guoshan has joined #openstack-keystone | 10:26 | |
| *** markvoelker has joined #openstack-keystone | 10:28 | |
| *** amakarov_away is now known as amakarov | 10:28 | |
| *** markvoelker has quit IRC | 10:32 | |
| *** code-R_ has quit IRC | 10:43 | |
| *** guoshan has quit IRC | 10:44 | |
| *** code-R has joined #openstack-keystone | 10:44 | |
| *** wangqun has quit IRC | 10:44 | |
| *** tonytan4ever has joined #openstack-keystone | 10:45 | |
| *** _sigmavirus24 is now known as sigmavirus | 10:47 | |
| *** sigmavirus has joined #openstack-keystone | 10:47 | |
| *** tonytan4ever has quit IRC | 10:49 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move dependency-related trust logic to manager https://review.openstack.org/360735 | 10:56 |
| *** markvoelker has joined #openstack-keystone | 10:59 | |
| *** markvoelker has quit IRC | 11:03 | |
| *** EinstCra_ has quit IRC | 11:11 | |
| *** rodrigods has quit IRC | 11:13 | |
| *** rodrigods has joined #openstack-keystone | 11:13 | |
| dstanek | good morning keystone! | 11:25 |
| *** markvoelker has joined #openstack-keystone | 11:28 | |
| dstanek | breton: one last issue with caching that i need to figure out. i think it's a gate only issue. | 11:29 |
| *** markvoelker has quit IRC | 11:32 | |
| samueldmq | morning | 11:39 |
| *** code-R_ has joined #openstack-keystone | 11:55 | |
| *** code-R has quit IRC | 11:56 | |
| *** markvoelker has joined #openstack-keystone | 11:57 | |
| *** jpena is now known as jpena|lunch | 11:58 | |
| *** code-R has joined #openstack-keystone | 11:58 | |
| *** raildo has joined #openstack-keystone | 11:58 | |
| *** code-R_ has quit IRC | 12:01 | |
| *** markvoelker has quit IRC | 12:01 | |
| *** jaosorior has quit IRC | 12:02 | |
| *** jaosorior has joined #openstack-keystone | 12:03 | |
| *** aswadr_ has joined #openstack-keystone | 12:08 | |
| *** markvoelker has joined #openstack-keystone | 12:26 | |
| *** magic has joined #openstack-keystone | 12:26 | |
| *** magic is now known as Guest94048 | 12:26 | |
| *** xiaoyang has quit IRC | 12:28 | |
| *** xiaoyang has joined #openstack-keystone | 12:28 | |
| *** markvoelker has quit IRC | 12:30 | |
| *** Guest94048 has quit IRC | 12:31 | |
| breton | dstanek: awesome | 12:32 |
| *** Ephur has joined #openstack-keystone | 12:54 | |
| *** markvoelker has joined #openstack-keystone | 12:56 | |
| *** markvoelker has quit IRC | 13:00 | |
| *** eandersson__ has quit IRC | 13:02 | |
| *** pcaruana has quit IRC | 13:02 | |
| *** sdake has joined #openstack-keystone | 13:03 | |
| *** roxanaghe has joined #openstack-keystone | 13:03 | |
| *** jpena|lunch is now known as jpena | 13:04 | |
| *** tonytan4ever has joined #openstack-keystone | 13:06 | |
| *** daemontool has joined #openstack-keystone | 13:06 | |
| *** markvoelker has joined #openstack-keystone | 13:06 | |
| *** markvoelker_ has joined #openstack-keystone | 13:07 | |
| *** roxanaghe has quit IRC | 13:08 | |
| *** raildo has quit IRC | 13:08 | |
| *** markvoelker_ has quit IRC | 13:10 | |
| *** markvoelker has quit IRC | 13:10 | |
| *** markvoelker_ has joined #openstack-keystone | 13:10 | |
| *** markvoelker has joined #openstack-keystone | 13:11 | |
| rderose | rodrigods: left comments for https://review.openstack.org/#/c/360757/ and https://review.openstack.org/#/c/360737/ | 13:12 |
| rderose | rodrigods: let me know if it makes sense | 13:12 |
| *** markvoelker_ has quit IRC | 13:13 | |
| rderose | davechen: left comment for https://review.openstack.org/#/c/360737/, but I'm not sure I'm getting your concern | 13:13 |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/python-keystoneclient: Fix missing service_catalog parameter in Client object https://review.openstack.org/339150 | 13:13 |
| rderose | davechen: take a look at my last comment and let me know | 13:13 |
| *** pcaruana has joined #openstack-keystone | 13:17 | |
| *** EinstCrazy has joined #openstack-keystone | 13:18 | |
| *** erhudy has joined #openstack-keystone | 13:20 | |
| *** sdake_ has joined #openstack-keystone | 13:23 | |
| *** sdake has quit IRC | 13:25 | |
| *** BjoernT has joined #openstack-keystone | 13:26 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move dependency-related trust logic to manager https://review.openstack.org/360735 | 13:29 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add a feature support matrix for identity sources https://review.openstack.org/362113 | 13:30 |
| *** markvoelker has quit IRC | 13:30 | |
| *** hoonetorg has quit IRC | 13:33 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add credential setup command https://review.openstack.org/362122 | 13:39 |
| *** raildo has joined #openstack-keystone | 13:40 | |
| *** sc68cal_ is now known as sc68cal | 13:44 | |
| *** su_zhang has joined #openstack-keystone | 13:45 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add a feature support matrix for identity sources https://review.openstack.org/362113 | 13:46 |
| *** ayoung has joined #openstack-keystone | 13:47 | |
| *** ChanServ sets mode: +v ayoung | 13:47 | |
| *** woodburn has joined #openstack-keystone | 13:50 | |
| *** sdake_ has quit IRC | 13:50 | |
| *** sdake has joined #openstack-keystone | 13:51 | |
| *** woodster_ has joined #openstack-keystone | 13:54 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add credential setup command https://review.openstack.org/362122 | 13:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/355618 | 13:55 |
| *** pcaruana has quit IRC | 13:55 | |
| *** markvoelker has joined #openstack-keystone | 13:57 | |
| *** Ephur has quit IRC | 13:57 | |
| *** markvoelker has quit IRC | 14:01 | |
| stevemar | dstanek: mornin! | 14:06 |
| dstanek | stevemar: morning... it would be a good one if i could reproduce a gate issue :-) | 14:07 |
| *** lmiccini has quit IRC | 14:07 | |
| stevemar | :( | 14:07 |
| *** davechen has left #openstack-keystone | 14:08 | |
| *** pcaruana has joined #openstack-keystone | 14:09 | |
| *** iurygregory has joined #openstack-keystone | 14:12 | |
| *** lmiccini has joined #openstack-keystone | 14:14 | |
| *** adrian_otto has joined #openstack-keystone | 14:18 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Document credential encryption https://review.openstack.org/354497 | 14:18 |
| *** spzala has joined #openstack-keystone | 14:18 | |
| *** jaosorior is now known as jaosorior_away | 14:25 | |
| *** ravelar has joined #openstack-keystone | 14:25 | |
| *** rkrum has joined #openstack-keystone | 14:25 | |
| *** clenimar has joined #openstack-keystone | 14:34 | |
| *** Ephur has joined #openstack-keystone | 14:35 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move dependency-related trust logic to manager https://review.openstack.org/360735 | 14:35 |
| rodrigods | rderose, cool | 14:35 |
| *** browne has joined #openstack-keystone | 14:36 | |
| *** sheel has quit IRC | 14:36 | |
| rodrigods | rderose, how can I change my password if it gets "old" at the same time it expires? | 14:38 |
| stevemar | lbragstad: so... credential encryption, how you feeling about it? | 14:38 |
| rodrigods | rderose, (i | 14:38 |
| rodrigods | rderose, (i'm not referring to the condition in the middle) | 14:39 |
| rderose | rodrigods: the condition in the middle just checks if the settings are enabled | 14:39 |
| rderose | rodrigods: value_when_true if condition else value_when_false | 14:39 |
| rodrigods | rderose, i'm not talking about it | 14:40 |
| rderose | :) | 14:40 |
| rodrigods | i'm taking about the >= | 14:40 |
| rodrigods | the "=" part | 14:40 |
| rderose | ah, yeah, so min password age is equal to password expires, you'll never be able to change your password before it expires | 14:41 |
| rderose | so doesn't make sense | 14:41 |
| *** asettle has joined #openstack-keystone | 14:41 | |
| rderose | should be less than password expires | 14:41 |
| rderose | rodrigods: have to run, but will be back online in about an hour | 14:42 |
| lbragstad | stevemar better after yesterday | 14:42 |
| rodrigods | rderose, ahh the check fails if it returns True, right? | 14:42 |
| rodrigods | was thinking the other way around | 14:42 |
| lbragstad | stevemar want the run down? | 14:42 |
| *** tonytan_brb has joined #openstack-keystone | 14:42 | |
| stevemar | lbragstad: of course | 14:42 |
| lbragstad | stevemar sweet - so you're already familiar with https://review.openstack.org/#/c/360667/5 - which makes testing the entire upgrade much easier | 14:43 |
| lbragstad | then I broke https://review.openstack.org/#/c/362122/2 into it's own patch because we need to the ability for devstack to be able to setup a key repository | 14:43 |
| stevemar | lbragstad: the gate is in good shape, so i'm no longer worried about that, but rather about general confidence in the code; a lot of eyes have seen it, so that is positive | 14:43 |
| stevemar | ++ keep goin | 14:44 |
| lbragstad | stevemar then we have https://review.openstack.org/#/c/361536/2 which add that stuff to devstack | 14:44 |
| lbragstad | so - https://review.openstack.org/#/c/361536/2 has a dependency on https://review.openstack.org/#/c/362122/2 | 14:44 |
| stevemar | lbragstad: make use of Depends-On in the commit msg | 14:45 |
| *** tonytan4ever has quit IRC | 14:45 | |
| lbragstad | and the main implementation, https://review.openstack.org/#/c/355618/31 has a dependency on https://review.openstack.org/#/c/361536/2 | 14:45 |
| lbragstad | stevemar already did | 14:45 |
| *** tonytan_brb is now known as tonytan4ever | 14:45 | |
| stevemar | ah, i see it now... | 14:46 |
| lbragstad | stevemar make sense? | 14:46 |
| stevemar | lbragstad: yeah, how do you feel about mike bayers comments? | 14:46 |
| dstanek | n/b 27 | 14:46 |
| stevemar | has anyone from the QA team looked at the devstack patch? | 14:46 |
| lbragstad | stevemar not that I am aware of | 14:46 |
| stevemar | (no) | 14:46 |
| lbragstad | stevemar regarding zzzeek's comments - I completely agree with dropping the sqlite support | 14:47 |
| *** code-R has quit IRC | 14:47 | |
| lbragstad | just not sure how to get some of the tests to run without it | 14:47 |
| *** pauloewerton has joined #openstack-keystone | 14:48 | |
| lbragstad | stevemar dolphm had a comment on that here, too https://review.openstack.org/#/c/355618/26/keystone/common/sql/expand_repo/versions/002_add_key_hash_and_encrypted_blob_to_credential.py,unified | 14:50 |
| stevemar | lbragstad: +2 for the split | 14:50 |
| stevemar | lbragstad: and i added mtreinish and dtroyer to the devstack patch, hopefully they can take a peek | 14:50 |
| lbragstad | stevemar thanks! | 14:50 |
| stevemar | lbragstad: okay, you're in decent shape -- if it lands, it lands; but i'm okay with this thing missing the cut off | 14:51 |
| stevemar | i think that was already the expectation that was set | 14:52 |
| *** eandersson has joined #openstack-keystone | 14:52 | |
| lbragstad | stevemar according to the failures I was seeing yesterday, the current series should pass | 14:52 |
| stevemar | cool | 14:52 |
| stevemar | lbragstad: i've seen the actual encryption part a long time ago, and that looked fine | 14:52 |
| stevemar | just setting up all the other bits | 14:52 |
| lbragstad | stevemar that and the rotation policy that is now enforced | 14:53 |
| *** su_zhang has quit IRC | 14:53 | |
| lbragstad | stevemar I'd love to have some more eyes on the rotation flow just to be sure | 14:53 |
| stevemar | hmm | 14:54 |
| stevemar | lbragstad: why is it enforced here? iirc it is not enforced with tokens? | 14:54 |
| *** asettle has quit IRC | 14:55 | |
| lbragstad | stevemar correct - with tokens if we over-rotate we provide a little bit of bad user-experience | 14:55 |
| lbragstad | which is corrected by reauthenticating | 14:55 |
| lbragstad | with encrypted credentials - if we over-rotate we will never be able to recover those credentials | 14:55 |
| lbragstad | and the only way to fix it is to have the user delete the useless one and recreate it | 14:56 |
| lbragstad | so - one way we can prevent that is to store the hash of the key that was used to encrypt the credential | 14:56 |
| lbragstad | then when we go to rotate - we can ask the credential fernet provider for the hash of the current primary key and if any credentials have a key has that doesn't match - we should abort because if we continue to rotate we are going to rotate out a key that is still needed to decrypt a credential | 14:57 |
| lbragstad | if all credential key hashes match the hash of the current primary key, then we know we are good to do a rotation because there shouldn't be any credentials encrypted with that old key | 14:59 |
| *** slberger has joined #openstack-keystone | 15:00 | |
| *** spedione is now known as chris_hultin | 15:02 | |
| *** hockeynut has joined #openstack-keystone | 15:03 | |
| *** daemontool has quit IRC | 15:07 | |
| lbragstad | ravelar did you have a review posted for your revocation event + sql work? | 15:08 |
| *** daemontool has joined #openstack-keystone | 15:09 | |
| *** jaosorior_away is now known as jaosorior | 15:10 | |
| *** michauds has joined #openstack-keystone | 15:15 | |
| *** agrebennikov has joined #openstack-keystone | 15:15 | |
| *** hoonetorg has joined #openstack-keystone | 15:16 | |
| *** markvoelker has joined #openstack-keystone | 15:17 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add a feature support matrix for identity sources https://review.openstack.org/362113 | 15:17 |
| *** sdake_ has joined #openstack-keystone | 15:18 | |
| *** sdake has quit IRC | 15:20 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: [WIP] Move fernet utils to backend https://review.openstack.org/356499 | 15:21 |
| openstackgerrit | David Stanek proposed openstack/keystone: Distributed cache namespace to invalidate regions https://review.openstack.org/349704 | 15:21 |
| openstackgerrit | Merged openstack/keystone: Add Response Example for 'Create credential' API https://review.openstack.org/361954 | 15:22 |
| *** rkrum has quit IRC | 15:23 | |
| openstackgerrit | Merged openstack/keystone: Fix formatting strings when using multiple variables https://review.openstack.org/361822 | 15:23 |
| *** sdake has joined #openstack-keystone | 15:24 | |
| stevemar | lbragstad: that sounds a little fragile | 15:25 |
| *** sdake_ has quit IRC | 15:26 | |
| stevemar | lbragstad: if a deployer sets things up incorrectly, it could all go to shit, no? | 15:26 |
| lbragstad | stevemar which part? | 15:26 |
| stevemar | lbragstad: "if we over-rotate we will never be able to recover those credentials" | 15:26 |
| ravelar | lbragstad yes, since then though I have updated and haven't merged it yet. | 15:27 |
| lbragstad | stevemar yeah - that's the tricky part | 15:28 |
| dstanek | stevemar: yeah if the over rotate they will have to recover credentials from backup | 15:28 |
| lbragstad | stevemar that's why we store a hash of the key that was used to encrypt the credential | 15:28 |
| dstanek | stevemar: ideally they are using something to manage their keys | 15:28 |
| lbragstad | stevemar but - that's also why we build a safeguard into keystone-manage credential-rotate | 15:29 |
| openstackgerrit | Merged openstack/keystone: Add Response Example for 'Passwd auth with unscoped authorization' https://review.openstack.org/361960 | 15:29 |
| openstackgerrit | Merged openstack/keystone: api-ref: Splitting status lines in API v3. https://review.openstack.org/360264 | 15:29 |
| *** browne has quit IRC | 15:29 | |
| *** adrian_otto has quit IRC | 15:29 | |
| lbragstad | stevemar keystone-manage will abort if a credential key hash doesn't match the primary key hash - https://review.openstack.org/#/c/355618/31/keystone/cmd/cli.py | 15:32 |
| *** adrian_otto has joined #openstack-keystone | 15:32 | |
| *** markvoelker has quit IRC | 15:32 | |
| *** hockeynut has quit IRC | 15:33 | |
| *** gyee has joined #openstack-keystone | 15:34 | |
| *** adrian_otto has quit IRC | 15:35 | |
| *** Ephur has quit IRC | 15:38 | |
| stevemar | lbragstad: i'll need to refamiliarise myself with the flow | 15:39 |
| stevemar | lbragstad: haven't looked at it since the introduction of the key_hash | 15:39 |
| lbragstad | stevemar ah - cool | 15:40 |
| lbragstad | stevemar let me know if you want to walk through it on google + or something, if that makes it easier | 15:40 |
| stevemar | dstanek: and yourself, just chasing down one last gate issue? | 15:40 |
| *** EinstCrazy has quit IRC | 15:40 | |
| *** browne has joined #openstack-keystone | 15:40 | |
| openstackgerrit | Merged openstack/keystone: api-ref: Splitting status lines in API v3-ext. https://review.openstack.org/360267 | 15:40 |
| stevemar | (wrt caching bug) | 15:41 |
| lbragstad | dstanek i'm looking at your caching fix again | 15:41 |
| stevemar | henrynash: o/ | 15:41 |
| *** tesseract- has quit IRC | 15:42 | |
| *** opilotte| has quit IRC | 15:43 | |
| *** pcaruana has quit IRC | 15:43 | |
| *** rcernin has quit IRC | 15:44 | |
| *** ruoyu has joined #openstack-keystone | 15:46 | |
| *** slberger has quit IRC | 15:52 | |
| *** edtubill has joined #openstack-keystone | 15:57 | |
| lbragstad | dolphm here is an easy review for you based on a comment you had on a previous patch of mine - https://review.openstack.org/#/c/362220/1 | 15:57 |
| dolphm | lbragstad: why was it not passed in during validation before? | 15:59 |
| *** su_zhang has joined #openstack-keystone | 15:59 | |
| lbragstad | dolphm it looks like it was always injected later | 15:59 |
| lbragstad | (?) | 15:59 |
| lbragstad | dolphm almost like the entire token response was formatted - then the token id was populated as it went out the door | 15:59 |
| lbragstad | but - the spot that wasn't passing it in has it in the token_ref - so I'm pulling it from there and passing it to v3_to_v2_token | 16:00 |
| dolphm | lbragstad: is that to support PKI or something, which doesn't have a token ID until everything else is ready? | 16:01 |
| lbragstad | dolphm i could see that being a possibility | 16:01 |
| *** david-lyle_ is now known as david-lyle | 16:01 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/355618 | 16:03 |
| *** browne has quit IRC | 16:04 | |
| dstanek | lbragstad: i just left some comments on your older review for credential encryption | 16:05 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: POC sql query revoked tokens https://review.openstack.org/359371 | 16:06 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Document credential encryption https://review.openstack.org/354497 | 16:07 |
| lbragstad | dstanek sweet - thanks | 16:08 |
| *** Ephur has joined #openstack-keystone | 16:08 | |
| dstanek | lbragstad: it's easy to critized when your not doing the work | 16:09 |
| lbragstad | dstanek :) | 16:09 |
| *** browne has joined #openstack-keystone | 16:09 | |
| dstanek | lbragstad: have you seen this and its spec? https://review.openstack.org/#/c/356499/ | 16:10 |
| lbragstad | browne thanks for the review on the credential encryption docs - comments have been addressed | 16:10 |
| lbragstad | dstanek just barely | 16:10 |
| browne | lbragstad: no problemo | 16:10 |
| lbragstad | dstanek it is forsure on my plate of things to review once the credential encryption work is done | 16:10 |
| *** su_zhang has quit IRC | 16:11 | |
| lbragstad | dstanek I believe I was the one who created the spec for that | 16:11 |
| *** su_zhang has joined #openstack-keystone | 16:11 | |
| dstanek | lol | 16:11 |
| lbragstad | dstanek https://github.com/openstack/keystone-specs/commit/82fde50122ae0ab3b5c795140f95ec2468a2f777 | 16:12 |
| *** mdurrant_ has quit IRC | 16:12 | |
| lbragstad | dstanek that was something a few people talked to us about after the austin fernet talk | 16:12 |
| lbragstad | dstanek dolphm and I wanted to capture it in a backlogged spec so that we wouldn't lose it | 16:13 |
| samueldmq | lbragstad: cred encryption is also in my list to review | 16:14 |
| lbragstad | samueldmq cool | 16:14 |
| samueldmq | lbragstad: I have been looking at the cache reviews | 16:14 |
| samueldmq | lbragstad: for credential, I was just not sure it was worth it to review as it is now | 16:14 |
| lbragstad | samueldmq we have a few people keeping tabs on the credential encryption work | 16:14 |
| samueldmq | lbragstad: before tomorrow's discussion about triggers vs versionedobjects | 16:14 |
| *** mdurrant has joined #openstack-keystone | 16:15 | |
| *** su_zhang has quit IRC | 16:15 | |
| stevemar | samueldmq: dolphm: dstanek lbragstad if you have a minute, i'd like to still get opinions on https://review.openstack.org/#/c/309146/ | 16:16 |
| samueldmq | stevemar: I looked at that at the beggining, but I saw some concerns about it changing the behavior | 16:17 |
| dstanek | stevemar: sure | 16:17 |
| samueldmq | I didn't really get it, I will take another look | 16:17 |
| samueldmq | "The patch uses dogpile.cache internal functionality so some calls may look strange" :-) | 16:17 |
| *** sdake has quit IRC | 16:19 | |
| lbragstad | stevemar sorry - just saw your comment about the performance bot | 16:19 |
| lbragstad | stevemar i rekicked it | 16:19 |
| lbragstad | it should be running some new tests | 16:19 |
| *** browne has quit IRC | 16:21 | |
| dstanek | stevemar: lots of new invalidations there | 16:21 |
| samueldmq | stevemar: reviewed | 16:24 |
| dstanek | stevemar: performance bot seems to disagree with amakarov's timings | 16:29 |
| samueldmq | it's just improving for the first call | 16:29 |
| samueldmq | after that it'd be cached anyways | 16:29 |
| amakarov | samueldmq, ++ | 16:29 |
| amakarov | and single validation right after issue is a very common use case | 16:30 |
| *** sdake has joined #openstack-keystone | 16:30 | |
| samueldmq | my point (and I guess haneef's too) is about if it is worth it to add more logic there just for that | 16:30 |
| samueldmq | if we want to do that, I am okay if we don't try to cache v2 validation when issuing v3 tokens (and vice-versa) to not make the code very confusing | 16:31 |
| samueldmq | amakarov: I left a review there | 16:31 |
| *** atod has joined #openstack-keystone | 16:32 | |
| dstanek | also what is the probabiltity that any of the events that now need to clear the cache will happen? | 16:32 |
| samueldmq | dstanek: amakarov: performance bot talks about the mean, so that specific review won't show up as something significant in those tests | 16:32 |
| amakarov | samueldmq, the result depends on scenario: if performance bot validates the same token N times, then mean will be the same | 16:34 |
| amakarov | My script does 1 validation per 1 issue | 16:34 |
| dstanek | oh man, i suck at life | 16:34 |
| amakarov | so the difference can be seen | 16:35 |
| samueldmq | amakarov: where are your results ? | 16:35 |
| amakarov | samueldmq, it the patch comments a bit above yours | 16:36 |
| amakarov | samueldmq, dstanek: https://gist.github.com/x-eye/8d2fc75f027b7e222284112787c8b13f | 16:37 |
| amakarov | that's the scenario | 16:37 |
| amakarov | run it as root on devstack | 16:37 |
| samueldmq | amakarov: I don't have a devstack up right now | 16:37 |
| samueldmq | amakarov: do you have some results ? | 16:38 |
| *** ruoyu has quit IRC | 16:38 | |
| amakarov | samueldmq, yes - in the patch comment @25. Aug 22:23 | 16:38 |
| *** Guest35918 is now known as mgagne | 16:39 | |
| *** mgagne has quit IRC | 16:39 | |
| *** mgagne has joined #openstack-keystone | 16:39 | |
| *** ddieterly has joined #openstack-keystone | 16:39 | |
| samueldmq | amakarov: what the time unit there ? | 16:40 |
| amakarov | a second | 16:40 |
| samueldmq | amakarov: seconds ? | 16:40 |
| samueldmq | ok | 16:40 |
| samueldmq | amakarov: so it is, i naverage, 27 milliseconds faster in the first validation? | 16:42 |
| samueldmq | but now it is also 11 milliseconds slower for token generation | 16:42 |
| amakarov | samueldmq, yes. In idle environment. | 16:43 |
| samueldmq | so at the end, in average, we gain 16 milliseconds per issue/1st validate | 16:43 |
| samueldmq | amakarov: is that really worth it ? | 16:43 |
| *** chrisshattuck has joined #openstack-keystone | 16:44 | |
| samueldmq | the callbacks there will also have milliseconds added, because of the invalidation calls | 16:44 |
| samueldmq | and in terms of code, it's harder to maintain? | 16:45 |
| samueldmq | oh way, we are talking about a dozen milliseconds ... | 16:45 |
| amakarov | samueldmq, on our scale lab when we modelled peak loads token validation was the bottleneck, so I think it's needed. | 16:45 |
| samueldmq | amakarov: so I think we need the numbers, it seems like most of reviewers are not convinced it it worth it | 16:46 |
| samueldmq | at least with the numbers you provided so far | 16:46 |
| amakarov | samueldmq, ok, got it | 16:46 |
| samueldmq | also, if your scale lab is doing the same test as you are (1 issue for 1 validation), does that represent the real world ? | 16:46 |
| lbragstad | dstanek responded to your comments on the credential encryption patch | 16:48 |
| *** slberger has joined #openstack-keystone | 16:48 | |
| amakarov | samueldmq, that's most common use in real-life envs (from our guys working with customers) | 16:49 |
| samueldmq | amakarov: 1 token for a single request ? | 16:50 |
| samueldmq | ok | 16:50 |
| amakarov | samueldmq, usually is looks like equal number of issue/validations in the logs :) | 16:51 |
| amakarov | not precisely equal of course | 16:51 |
| samueldmq | that seems odd to me, I am not sure assuming 1 token is almost all the times used a single time is a good thing | 16:52 |
| samueldmq | and if that is really happening, maybe there is something else wrong with how tokens are used | 16:52 |
| samueldmq | amakarov: I am not very experienced in production, I am just sharing my thoughts on how I would expected things to work | 16:53 |
| *** ddieterly is now known as ddieterly[away] | 16:55 | |
| amakarov | samueldmq, you may be interested in how keystone client authN/Z using token: iirc it issues a new one - does not reuse the old | 16:55 |
| samueldmq | amakarov: with sessions ? | 16:57 |
| amakarov | samueldmq, so when a service needs to work with another one, is re-auth even having a token | 16:57 |
| *** tonytan4ever has quit IRC | 16:57 | |
| amakarov | s/is/it/ | 16:57 |
| samueldmq | ok, if we have designed our official clients to use 1 token per request | 16:57 |
| samueldmq | I don't know why we talk about revocation timeout, etc | 16:58 |
| *** tonytan4ever has joined #openstack-keystone | 16:58 | |
| amakarov | samueldmq, to prevent that re-auth :) | 16:58 |
| samueldmq | ok, so if it is what our client does (re-auth for every request) and that is the real case in production | 16:59 |
| samueldmq | I am quite impressed | 16:59 |
| *** jaosorior has quit IRC | 17:00 | |
| dstanek | that seems like a problem worth fixing | 17:00 |
| amakarov | samueldmq, the logic is simple: service gets called for some action - it needs some other service to do something - it auth using given token, gets a new one from keystone and uses it to call the next service in chain | 17:00 |
| *** atod has quit IRC | 17:00 | |
| amakarov | maybe now it's different, but I several times was approached with the issue that trust token doesn't work, and that re-auth was the reason | 17:01 |
| *** tonytan4ever has quit IRC | 17:01 | |
| amakarov | dstanek, it's expected: re-auth cannot exchange trust scoped token for a regular one | 17:02 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/355618 | 17:02 |
| amakarov | dstanek, the fix for that is unified delegation I'm working on | 17:02 |
| dstanek | amakarov: the client should be able to cache tokens locally | 17:02 |
| amakarov | dstanek, no problem - let him cache it | 17:03 |
| samueldmq | dstanek: and re-use them | 17:03 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Document credential encryption https://review.openstack.org/354497 | 17:03 |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: Add manager and base interface for fernet key store https://review.openstack.org/362283 | 17:03 |
| samueldmq | having 1 token per request seems insane | 17:03 |
| *** chrisshattuck has quit IRC | 17:03 | |
| amakarov | samueldmq, funny thing is that the common re-usage pattern is re-auth using this token ) | 17:03 |
| *** chrisshattuck has joined #openstack-keystone | 17:03 | |
| *** ddieterly[away] is now known as ddieterly | 17:04 | |
| samueldmq | amakarov: so it is not re-usage | 17:04 |
| *** chrisshattuck has quit IRC | 17:04 | |
| samueldmq | amakarov: so I have a keytone client | 17:05 |
| amakarov | samueldmq, why? the token is re-used as auth credential | 17:05 |
| samueldmq | I have passed my creds and auth'ed in a session | 17:05 |
| samueldmq | amakarov: called user.list() and user.get() ; that used 1 new token for each | 17:05 |
| *** browne has joined #openstack-keystone | 17:05 | |
| amakarov | samueldmq, the session itself can of course be re-used | 17:05 |
| samueldmq | session is a client side object | 17:06 |
| amakarov | I'm talking about passing tokens around between services | 17:06 |
| samueldmq | the important bit is requesting tokens excessively | 17:06 |
| *** tonytan4ever has joined #openstack-keystone | 17:08 | |
| *** jpena is now known as jpena|off | 17:09 | |
| *** ddieterly is now known as ddieterly[away] | 17:11 | |
| samueldmq | dstanek: only pep8 is failing now | 17:12 |
| samueldmq | dstanek: \o/ | 17:12 |
| samueldmq | https://review.openstack.org/#/c/349704/ | 17:13 |
| *** slberger has quit IRC | 17:13 | |
| *** esp has joined #openstack-keystone | 17:16 | |
| lbragstad | samueldmq do we want to rebase https://review.openstack.org/#/c/345688/9 on ^^ | 17:16 |
| lbragstad | ? | 17:16 |
| lbragstad | samueldmq that should fix some of the issues with the fernet default patch - right? | 17:16 |
| *** slberger has joined #openstack-keystone | 17:16 | |
| samueldmq | lbragstad: I did it already :-) | 17:17 |
| lbragstad | samueldmq nice | 17:17 |
| dstanek | samueldmq: oops, i thought i pushed that up already | 17:17 |
| samueldmq | lbragstad: just left a recheck | 17:17 |
| samueldmq | dstanek: ++ | 17:17 |
| openstackgerrit | David Stanek proposed openstack/keystone: Distributed cache namespace to invalidate regions https://review.openstack.org/349704 | 17:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make token_id a required parameter in v3_to_v2_token https://review.openstack.org/362220 | 17:18 |
| amakarov | samueldmq, I've replied your comments | 17:19 |
| dstanek | samueldmq: lbragstad: for that one i want to get confirmation from amakarov or breton that their issues are indeed fixed | 17:21 |
| *** su_zhang has joined #openstack-keystone | 17:21 | |
| lbragstad | samueldmq did you rebase it or just recheck? | 17:24 |
| samueldmq | lbragstad: I just rechecked, I had rebased already | 17:26 |
| samueldmq | lbragstad: last week | 17:26 |
| samueldmq | amakarov: kk will look | 17:26 |
| lbragstad | samueldmq it looks like it is still dependent on patch set 11 | 17:26 |
| samueldmq | dstanek: yeah makes sense | 17:26 |
| lbragstad | of the cache fix | 17:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 17:26 |
| samueldmq | lbragstad: Patch Set 9: Patch Set 8 was rebased | 17:26 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move dependency-related trust logic to manager https://review.openstack.org/360735 | 17:27 |
| samueldmq | lbragstad: ah, so it rebases in a specific patch set | 17:27 |
| samueldmq | lbragstad: vs rebasing on the change | 17:27 |
| samueldmq | lbragstad: got it | 17:27 |
| lbragstad | samueldmq yeah - i think patch set 9 was still pointing to patch set 11 from dstanek's patch | 17:27 |
| samueldmq | lbragstad: ++ | 17:27 |
| lbragstad | samueldmq so patch set 10 should be dependent on 14 now | 17:28 |
| *** chrisshattuck has joined #openstack-keystone | 17:29 | |
| samueldmq | lbragstad: 14 or 15 ? dstanek just uploaded 15 | 17:29 |
| lbragstad | samueldmq oops 15 | 17:30 |
| *** Gorian|work has joined #openstack-keystone | 17:32 | |
| *** Gorian|work has quit IRC | 17:32 | |
| *** maestropandy has joined #openstack-keystone | 17:39 | |
| *** maestropandy has left #openstack-keystone | 17:40 | |
| *** chrisshattuck has quit IRC | 17:42 | |
| *** tonytan4ever has quit IRC | 17:42 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make token_id a required parameter in v3_to_v2_token https://review.openstack.org/362220 | 17:44 |
| *** chrisshattuck has joined #openstack-keystone | 17:45 | |
| *** markvoelker has joined #openstack-keystone | 17:53 | |
| *** chrisshattuck has quit IRC | 17:56 | |
| *** chrisshattuck has joined #openstack-keystone | 17:58 | |
| *** asettle has joined #openstack-keystone | 17:58 | |
| *** adrian_otto has joined #openstack-keystone | 18:01 | |
| *** tqtran has joined #openstack-keystone | 18:01 | |
| *** asettle has quit IRC | 18:03 | |
| *** mugsie_ is now known as mugsie | 18:05 | |
| *** markvoelker has quit IRC | 18:09 | |
| *** amakarov is now known as amakarov_away | 18:12 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix wrong response codes in 'groups' APIs. https://review.openstack.org/361973 | 18:19 |
| *** ddieterly[away] is now known as ddieterly | 18:19 | |
| *** su_zhang has quit IRC | 18:23 | |
| *** su_zhang has joined #openstack-keystone | 18:25 | |
| *** esp has quit IRC | 18:26 | |
| *** chrisshattuck has quit IRC | 18:28 | |
| samueldmq | lbragstad: I have a comment in https://review.openstack.org/#/c/362220 | 18:29 |
| *** tonytan4ever has joined #openstack-keystone | 18:38 | |
| dstanek | thanks for the love jenkins....you can go back to hating all the others now | 18:39 |
| samueldmq | dstanek: lol hehehe | 18:40 |
| *** hockeynut has joined #openstack-keystone | 18:40 | |
| samueldmq | dstanek: +2ed | 18:42 |
| samueldmq | dstanek: let's wait to check with breton and amakarov_away that works for them | 18:43 |
| stevemar | dstanek: so how many different bugs does that fix? :) | 18:43 |
| *** ddieterly is now known as ddieterly[away] | 18:46 | |
| *** esp has joined #openstack-keystone | 18:46 | |
| *** su_zhang has quit IRC | 18:46 | |
| samueldmq | stevemar: well, the ones we are aware of ..... | 18:47 |
| samueldmq | > a very large number | 18:47 |
| samueldmq | :-) | 18:47 |
| *** ddieterly[away] is now known as ddieterly | 18:50 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add a feature support matrix for identity sources https://review.openstack.org/362113 | 18:56 |
| *** edtubill has quit IRC | 19:01 | |
| lbragstad | samueldmq responded - https://review.openstack.org/#/c/349704/15 | 19:15 |
| *** zhugaoxiao has quit IRC | 19:16 | |
| samueldmq | lbragstad: wrong link ? | 19:16 |
| lbragstad | samueldmq yep - https://review.openstack.org/#/c/362220/3 | 19:16 |
| lbragstad | ^ that one | 19:16 |
| *** zhugaoxiao has joined #openstack-keystone | 19:16 | |
| samueldmq | lbragstad: so you agree on keeping that as it was? | 19:17 |
| lbragstad | samueldmq nope - i updated again | 19:17 |
| samueldmq | lbragstad: and changing to token_ref['id'] in a separate patcH, | 19:17 |
| lbragstad | samueldmq the original token_id that was in the log message was wrong and actually bug | 19:17 |
| samueldmq | lbragstad: ok, you confused me ! | 19:17 |
| lbragstad | because token_ref isn't a token reference formatted in the way of v2 | 19:18 |
| samueldmq | lbragstad: so the previous one was wrong ? | 19:18 |
| lbragstad | instead its a token reference from the token_model | 19:18 |
| lbragstad | samueldmq yep | 19:18 |
| samueldmq | lbragstad: no tests for that then :/ | 19:18 |
| lbragstad | threw me for a loop too when I tried to pull it from the 'access' dictionary of token_ref originally | 19:18 |
| samueldmq | lbragstad: a followup could add a test then | 19:18 |
| lbragstad | samueldmq that would have been an issue with logging | 19:19 |
| lbragstad | yeah | 19:19 |
| samueldmq | lbragstad: commented and approved | 19:21 |
| lbragstad | samueldmq thanks | 19:23 |
| lbragstad | samueldmq I was just looking at that method in the `except exception.ValidationError` part, and I don't actually see where that exception can possibly get raised within the calls of that method | 19:24 |
| lbragstad | samueldmq which might explain why there were no tests for it! | 19:24 |
| *** su_zhang has joined #openstack-keystone | 19:25 | |
| samueldmq | lbragstad: so propose to remove the try:except clause | 19:26 |
| lbragstad | yep doing that now | 19:26 |
| *** Ephur has quit IRC | 19:26 | |
| *** jdennis1 has quit IRC | 19:30 | |
| *** su_zhang has quit IRC | 19:31 | |
| *** ddieterly has quit IRC | 19:31 | |
| *** adrian_otto has quit IRC | 19:33 | |
| *** jdennis has joined #openstack-keystone | 19:33 | |
| *** slberger has quit IRC | 19:34 | |
| *** edtubill has joined #openstack-keystone | 19:45 | |
| *** sdake has quit IRC | 19:48 | |
| dolphm | lbragstad: stevemar: are we going to be able to land this to devstack before we hit feature freeze? https://review.openstack.org/#/c/361536/ | 19:48 |
| lbragstad | dolphm I'm hoping so - right now the only thing encrypted credentials trips on is something strange in grenade | 19:49 |
| lbragstad | i'm still investigating it | 19:49 |
| dolphm | lbragstad: define strong? | 19:49 |
| dolphm | strange* | 19:49 |
| lbragstad | dolphm the patch to devstack configures keystone to point '[credential] key_repository` to /etc/keystone/credential-keys/ | 19:50 |
| *** slberger has joined #openstack-keystone | 19:50 | |
| dolphm | lbragstad: is that not keystone's default anyway? | 19:50 |
| lbragstad | dolphm it is - but we do the same thing we fernet tokens | 19:50 |
| lbragstad | so I figured we'd be consistent/explicit? | 19:51 |
| dolphm | lbragstad: sure, that's to let people override it in devstack through devstack's config | 19:51 |
| dolphm | lbragstad: is that causing problems? | 19:51 |
| *** aswadr_ has quit IRC | 19:51 | |
| * lbragstad dolphm I don't think so - but this is the problem http://logs.openstack.org/18/355618/33/check/gate-grenade-dsvm-neutron-ubuntu-trusty/b3446e3/logs/apache/keystone.txt.gz?level=ERROR | 19:51 | |
| breton | wow | 19:52 |
| breton | you merged it already! | 19:52 |
| * breton is happy that https://review.openstack.org/349704 is merged | 19:52 | |
| lbragstad | dolphm which causes http://logs.openstack.org/18/355618/33/check/gate-grenade-dsvm-neutron-ubuntu-trusty/b3446e3/console.html#_2016-08-29_17_43_31_653815 | 19:52 |
| *** markvoelker has joined #openstack-keystone | 19:52 | |
| dstanek | breton: well, it will soon. can you verify in your environment? | 19:53 |
| lbragstad | dolphm so I have a feeling figuring out why that error message happens will fix that test | 19:53 |
| stevemar | breton: you and me both | 19:53 |
| dolphm | lbragstad: maybe you should put some more detail into that error message to make it easier to debug? | 19:53 |
| breton | dstanek: i will, but tomorrow, sorry | 19:54 |
| lbragstad | dolphm yeah - I can do that | 19:54 |
| stevemar | dolphm: i am also concerned about landing the devstack patch for cred enc. | 19:54 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes small grammar mistake in docstring https://review.openstack.org/362348 | 19:54 |
| lbragstad | dolphm do you happen to know off the top of your head if devstack creates the fernet repository? Or does it just initialize it using `keystone-manage fernet_setup`? | 19:55 |
| stevemar | dolphm: lbragstad my gut is saying to bump credential encyption to O, there are still too many parts to land :\ | 19:55 |
| lbragstad | stevemar 4 patches - 3 in keystone and 1 in devstack | 19:56 |
| stevemar | lbragstad: yeah, the doc one can land during rc | 19:57 |
| stevemar | so 3 patches, 2 of which are OK by my eyes | 19:57 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove unnecessary try/except from token provider https://review.openstack.org/362352 | 20:00 |
| *** Ephur has joined #openstack-keystone | 20:01 | |
| dolphm | lbragstad: it should create the directory | 20:01 |
| lbragstad | dolphm so this is grenade right... | 20:01 |
| dolphm | lbragstad: oh wait, fernet_setup will create the dir | 20:02 |
| lbragstad | dolphm i just thought of this - but i wonder if it is because grenade might not have the required tooling in place for our new migration process! | 20:02 |
| dolphm | lbragstad: what tooling? | 20:03 |
| lbragstad | which would mean that the credentials aren't migrated when the `keystone-manage db_sync --migrate` command is run | 20:03 |
| lbragstad | mm | 20:04 |
| lbragstad | actually - that might not be the case | 20:04 |
| dolphm | lbragstad: would grenade be specifying a specific version number to upgrade to? | 20:05 |
| *** gus has quit IRC | 20:05 | |
| *** darrenc has quit IRC | 20:05 | |
| *** jhesketh has quit IRC | 20:05 | |
| lbragstad | dolphm a specific version number for `keystone-manage db_sync`? | 20:05 |
| lbragstad | that I'm not sure | 20:05 |
| dolphm | lbragstad: yes | 20:05 |
| dolphm | lbragstad: that would cause migrate not to run | 20:05 |
| *** darrenc has joined #openstack-keystone | 20:07 | |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Update reno for stable/newton https://review.openstack.org/362375 | 20:07 |
| *** markvoelker has quit IRC | 20:08 | |
| *** slberger has quit IRC | 20:10 | |
| lbragstad | dolphm so it fails creating a credential when it gets into the validate_key_repository method of keystone/common/fernet_utils.pu | 20:11 |
| *** roxanaghe has joined #openstack-keystone | 20:11 | |
| stevemar | i wonder where henrynash is, he didn't update any of his patches | 20:11 |
| dolphm | lbragstad: with a value or type error?? | 20:11 |
| dolphm | stevemar: since when? | 20:11 |
| *** jhesketh has joined #openstack-keystone | 20:12 | |
| dolphm | stevemar: he's got revisions within the last business day :P | 20:12 |
| stevemar | dolphm: really? | 20:13 |
| stevemar | dolphm: he didn't update https://review.openstack.org/#/c/357789/ | 20:13 |
| stevemar | since 26th | 20:13 |
| dolphm | stevemar: that was friday | 20:13 |
| lbragstad | dolphm it doesn't look like validate_key_repository will raise a ValueError or a TypeError, instead it just logs the warning saying that the repository isn't valid... I think the TypeError/ValueError is coming from the usage of self.crypto.encrypt() because load_keys will just return an empty list (signifying that there are no keys in the repository) | 20:13 |
| stevemar | dolphm: his monday was over 5 hours ago :P | 20:13 |
| lbragstad | so - even though the repository isn't valid, we will still attempt to use it to encrypt and decrypt things | 20:14 |
| stevemar | putting it out there, in case someone wants to post an alternate to https://review.openstack.org/#/c/357789/ -- rderose samueldmq ? :P | 20:14 |
| dolphm | henrynash: you forgot to punch your time card for steve | 20:14 |
| stevemar | dolphm: hehe | 20:15 |
| *** gus has joined #openstack-keystone | 20:15 | |
| stevemar | dolphm: he set my expectation too high! | 20:15 |
| dolphm | lbragstad: does that method raise an exception or anything when things are invalid? | 20:15 |
| dolphm | lbragstad: otherwise, what's the point of running it? | 20:15 |
| lbragstad | dolphm validate_key_repository? | 20:15 |
| dolphm | lbragstad: yes | 20:15 |
| lbragstad | dolphm no - it doesn't | 20:15 |
| lbragstad | just logs a warning | 20:15 |
| dolphm | lbragstad: what's it for | 20:16 |
| dolphm | lbragstad: sounds like it should be moved to doctor if it behaves that way | 20:16 |
| lbragstad | dolphm ++ | 20:16 |
| lbragstad | dolphm well - it logs this Either [fernet_tokens] key_repository does not exist or Keystone does not have sufficient permission to access it: /etc/keystone/credential-keys/ | 20:16 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Validate mapping exists when creating/updating a protocol https://review.openstack.org/362397 | 20:16 |
| lbragstad | but it is checking to make sure the key repository is there and readable | 20:17 |
| *** markvoelker has joined #openstack-keystone | 20:17 | |
| rderose | stevemar: I can take this on | 20:18 |
| rderose | stevemar: but don't want to step on henrynash's toes (as the bug is assigned to him) | 20:18 |
| *** tonytan_brb has joined #openstack-keystone | 20:18 | |
| *** su_zhang has joined #openstack-keystone | 20:19 | |
| stevemar | rderose: post an alternate patch, you have my blessing :P | 20:19 |
| rderose | :) | 20:20 |
| rderose | stevemar: okay, I'm on it | 20:20 |
| lbragstad | dolphm bah! | 20:21 |
| *** tonytan4ever has quit IRC | 20:21 | |
| dstanek | #success I posted a review where the commit message was 40 times larger than the code diff! | 20:22 |
| openstackstatus | dstanek: Added success to Success page | 20:22 |
| stevemar | dstanek: lol | 20:22 |
| dstanek | #winning | 20:22 |
| *** slberger has joined #openstack-keystone | 20:23 | |
| lbragstad | dolphm line 621 here should create the key repository https://review.openstack.org/#/c/362122/2/keystone/cmd/cli.py | 20:25 |
| lbragstad | like you were saying | 20:25 |
| openstackgerrit | Doug Hellmann proposed openstack/keystoneauth: Update reno for stable/newton https://review.openstack.org/362412 | 20:27 |
| openstackgerrit | Doug Hellmann proposed openstack/keystonemiddleware: Update reno for stable/newton https://review.openstack.org/362414 | 20:27 |
| henrynash | stevemar: and today is a public holiday in the uK (and I'm not really here) | 20:35 |
| *** spzala has quit IRC | 20:37 | |
| *** spzala has joined #openstack-keystone | 20:38 | |
| bknudson | What do you celebrate on "August Bank Holiday"? | 20:39 |
| henrynash | bknudson: the end of summer, the passing of sunshine into rain, the fading of the forbidden sun.....and the last holiday we get for (basically) the rest of the year!! | 20:40 |
| *** spzala has quit IRC | 20:42 | |
| stevemar | ah | 20:42 |
| *** spzala has joined #openstack-keystone | 20:44 | |
| * lbragstad leaves to go celebrate with henrynash | 20:45 | |
| samueldmq | stevemar: what would an alternative to that look like? | 20:45 |
| stevemar | lbragstad: good move | 20:46 |
| lbragstad | stevemar ;) | 20:46 |
| henrynash | lbragstad: I'll mix up the egg-nog right away | 20:46 |
| stevemar | samueldmq: wait and see what rderose proposes | 20:46 |
| samueldmq | stevemar: ah OK, didnt know he was on it | 20:46 |
| lbragstad | henrynash ++ | 20:46 |
| * stevemar leaves for a while | 20:46 | |
| stevemar | see you all in the evening | 20:46 |
| lbragstad | stevemar o/ | 20:46 |
| samueldmq | rderose: is the alternative using versionedobjects? | 20:47 |
| *** markvoelker has quit IRC | 20:48 | |
| *** sdake has joined #openstack-keystone | 20:52 | |
| rderose | samuelmq: no | 20:55 |
| rderose | samuelmq: I just think it's creating another migration script that sets the default and runs an update script if sqlite | 20:55 |
| lbragstad | dolphm yeah - so here is the upgrade script for keystone in grenade | 20:56 |
| lbragstad | https://github.com/openstack-dev/grenade/blob/master/projects/10_keystone/upgrade.sh | 20:56 |
| lbragstad | i don't think we're running `keystone-manage credential_setup` | 20:57 |
| lbragstad | we are on fresh devstack runs - but not the upgrade case with grenade | 20:57 |
| *** su_zhang has quit IRC | 20:59 | |
| *** su_zhang has joined #openstack-keystone | 20:59 | |
| *** ravelar has quit IRC | 20:59 | |
| *** raildo has quit IRC | 20:59 | |
| openstackgerrit | Merged openstack/keystone: Make token_id a required parameter in v3_to_v2_token https://review.openstack.org/362220 | 21:02 |
| openstackgerrit | Merged openstack/keystone: Fix wrong response codes in 'groups' APIs. https://review.openstack.org/361973 | 21:03 |
| openstackgerrit | Merged openstack/keystone: Distributed cache namespace to invalidate regions https://review.openstack.org/349704 | 21:03 |
| openstackgerrit | Merged openstack/keystone: Let upgrade tests control all 4 repositories at once https://review.openstack.org/360667 | 21:03 |
| openstackgerrit | Merged openstack/keystone: Add credential setup command https://review.openstack.org/362122 | 21:04 |
| *** hockeynut has quit IRC | 21:04 | |
| lbragstad | dolphm actually - i think it is because grenade will *install* new services, but it won't re-init them, which is where our code is to create the credential key repository | 21:05 |
| dolphm | lbragstad: isn't there an exception process in grenade? "run this script to do extra work that is required" | 21:06 |
| lbragstad | dolphm yep - patching it now | 21:07 |
| lbragstad | or, adding one for this release | 21:07 |
| *** chris_hultin is now known as spedione|AWAY | 21:08 | |
| *** pauloewerton has quit IRC | 21:08 | |
| *** su_zhang has quit IRC | 21:10 | |
| *** su_zhang has joined #openstack-keystone | 21:10 | |
| *** daemontool has quit IRC | 21:11 | |
| *** daemontool has joined #openstack-keystone | 21:13 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Add man page info for credential setup command https://review.openstack.org/362453 | 21:21 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Document credential encryption https://review.openstack.org/354497 | 21:23 |
| lbragstad | dolphm stevemar so now https://review.openstack.org/#/c/355618/ is dependent on https://review.openstack.org/#/c/361536/ and https://review.openstack.org/#/c/362450/ | 21:25 |
| dolphm | lbragstad: your implementation patch should have a release note documenting the same (or add it in a follow up, but get it into review) | 21:27 |
| dolphm | lbragstad: would be good to link to that release note (in review) in the devstack and grenade patches (which will make it easier for those projects to review things) | 21:28 |
| *** Ephur has quit IRC | 21:29 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Add man page info for credential setup command https://review.openstack.org/362453 | 21:29 |
| dolphm | lbragstad: let me know if you're posting any more revisions on 355618 today - i want to take one last review pass for the day | 21:29 |
| lbragstad | dolphm working on the release note now - I had one before but it got lost somewhere (nice catch!) | 21:30 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Add man page info for credential setup command https://review.openstack.org/362453 | 21:32 |
| *** sdake has quit IRC | 21:33 | |
| notmorgan | lbragstad: -1 on the encrypt credentials. please do not truncate the hash of the key without a solid comment on why 7 bits is sufficient/what prompted that pick | 21:33 |
| notmorgan | lbragstad: there is no reason afaict to truncate the hash besides making it easier to collide. | 21:33 |
| dolphm | notmorgan: renaming the column is necessary to maintain consistency during the rolling upgrade | 21:37 |
| lbragstad | notmorgan updated with a comment | 21:37 |
| dolphm | notmorgan: both columns are read independently by different releases at the same time | 21:37 |
| notmorgan | oh right | 21:37 |
| notmorgan | thats fine then was a nit-pick. | 21:37 |
| notmorgan | the hash length though... | 21:37 |
| notmorgan | don't truncate cryptographic data if you're using it as an identifier. | 21:38 |
| dolphm | notmorgan: also, there's only 3 keys in play at once, so odds of 2 out of 3 random 7 bit strings colliding is much lower than 2 out of billions in play at once | 21:38 |
| notmorgan | dolphm: i am still a strong -1 on that, because you could have more keys | 21:39 |
| dolphm | notmorgan: it's hardcoded to max at 3 | 21:39 |
| notmorgan | dolphm: and the cost of a few more bytes (really) is worth futureproofing. | 21:39 |
| notmorgan | still don't do that. it is bad practice to get into. | 21:40 |
| *** edtubill has quit IRC | 21:40 | |
| dolphm | notmorgan: agree on practice | 21:40 |
| notmorgan | we shouldn't be encouraging saving a few bytes needlessly considering how much (even with 3 keys) it opens the door for colliding hashes. i will almost guarantee future looking more than 3 keys will be used. | 21:42 |
| *** spzala has quit IRC | 21:45 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: WIP: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 21:46 |
| notmorgan | lbragstad: ^ added WIP to that because the commit message needs work before it can land. | 21:47 |
| notmorgan | and clearly it's still not working "right" :P | 21:48 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Document credential encryption https://review.openstack.org/354497 | 21:51 |
| lbragstad | dolphm release note^ ' | 21:51 |
| lbragstad | notmorgan cool - thanks | 21:52 |
| *** BjoernT has quit IRC | 21:52 | |
| openstackgerrit | Merged openstack/keystone: Add a feature support matrix for identity sources https://review.openstack.org/362113 | 21:53 |
| *** gagehugo has quit IRC | 21:57 | |
| *** gagehugo has joined #openstack-keystone | 21:57 | |
| *** hockeynut has joined #openstack-keystone | 21:59 | |
| *** gagehugo_ has joined #openstack-keystone | 22:01 | |
| *** ayoung has quit IRC | 22:07 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/355618 | 22:08 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Document credential encryption https://review.openstack.org/354497 | 22:08 |
| lbragstad | dolphm notmorgan ^ | 22:09 |
| notmorgan | lbragstad: my concerns look addressed you may still want to index the hash column | 22:09 |
| notmorgan | if you ever look up anything by that | 22:10 |
| lbragstad | notmorgan sounds good - I gotta run but I'll tinker with that when I get back on tonight | 22:14 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth: Import TaskManager from shade/nodepool https://review.openstack.org/362473 | 22:17 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth: Use TaskManager for all request interactions https://review.openstack.org/362474 | 22:17 |
| mordred | notmorgan: ^^ | 22:17 |
| mordred | notmorgan: merry christmas | 22:17 |
| *** slberger has left #openstack-keystone | 22:17 | |
| *** chrichip has joined #openstack-keystone | 22:18 | |
| *** michauds has quit IRC | 22:23 | |
| *** chrichip has quit IRC | 22:25 | |
| bknudson | browne: are you using keystone with uwsgi? | 22:26 |
| browne | nope. eventlet | 22:26 |
| bknudson | browne: custom kernel? | 22:26 |
| bknudson | what distro are you using? | 22:27 |
| bknudson | this issue with caching is not making any sense. | 22:27 |
| browne | nope, unmodified ubuntu stable/mitaka | 22:27 |
| browne | bknudson: it does seem concurrency related. but i couldn't figure out how | 22:28 |
| bknudson | I haven't been able to recreate with a single client. | 22:28 |
| browne | i actually assumed at first it was because we still used eventlet and not wsgi | 22:28 |
| bknudson | Happens all the time when I have multiple clients. | 22:28 |
| browne | by clients, do you mean keystone instances? | 22:29 |
| bknudson | no, test programs running concurrently | 22:29 |
| browne | cause we do have 2 keystones behind haproxy | 22:29 |
| browne | ah | 22:29 |
| browne | we immediately saw an issue with role caching in our ansible deployment playbooks | 22:30 |
| browne | so we turned off role caching. but then under high load we saw caching problems everywhere (tokens, etc | 22:31 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth: Use TaskManager for all request interactions https://review.openstack.org/362474 | 22:34 |
| bknudson | for some reason I can't recreate this with devstack whereas it's easy with this arrrsula dev deploy in vagrant | 22:35 |
| mordred | bknudson: I blame vagrant | 22:35 |
| bknudson | could be! | 22:35 |
| bknudson | virtualbox | 22:35 |
| bknudson | should switch to docker! | 22:36 |
| browne | switch to fusion ;) | 22:36 |
| bknudson | if it solves this memcache issue I'd be willing to try just about anything | 22:37 |
| browne | bknudson: can you recreate with redis? | 22:38 |
| bknudson | good question. Haven't tried that. | 22:39 |
| bknudson | devstack doesn't use redis | 22:39 |
| *** browne has quit IRC | 22:43 | |
| *** spzala has joined #openstack-keystone | 22:46 | |
| *** daemontool has quit IRC | 22:49 | |
| *** daemontool has joined #openstack-keystone | 22:50 | |
| *** spzala has quit IRC | 22:53 | |
| *** markvoelker has joined #openstack-keystone | 23:02 | |
| notmorgan | mordred: yay | 23:05 |
| notmorgan | it's like christmas in august! | 23:05 |
| notmorgan | mordred: also... ramen place was closed today (*sigh*) so no awesome ramen for lunch | 23:05 |
| mordred | notmorgan: booo | 23:07 |
| mordred | notmorgan: I chatted with jamielennox a smidge about it in #openstack-sdks | 23:08 |
| jamielennox | notmorgan, mordred: i put up some basic comments, i just need to figure out how it fits in to the non-nodepool cases | 23:10 |
| notmorgan | jamielennox: fair enough. | 23:10 |
| jamielennox | i'm a little concerned about the wait() in the standard case, but it looks ok | 23:10 |
| *** agrebennikov has quit IRC | 23:10 | |
| mordred | jamielennox: yah - in the non-nodepool case that doesn't actually wait | 23:10 |
| jamielennox | and as per comment if we were going to make this generic i would like to remove the self._client from taskmanager and just make that a *args, **kwargs kind of deal | 23:11 |
| mordred | jamielennox: ansible modules use the passthrough there | 23:11 |
| jamielennox | i don't know if they're Task() or run() paramters though | 23:11 |
| mordred | run takes the client as a the argument, which gets passed to self.main | 23:13 |
| mordred | it allows us to have one copy of a client and pass it to each thing ... shade/_tasks.py might give a better sense of how that's used ... | 23:13 |
| mordred | http://git.openstack.org/cgit/openstack-infra/shade/tree/shade/_tasks.py#n25 for instance | 23:13 |
| jamielennox | tep, it's just weird to me that client is a run command and everything else is in self._args | 23:14 |
| jamielennox | why is client different there? | 23:14 |
| jamielennox | particularly because client in this (all?) case is just session | 23:14 |
| jamielennox | why not make it a part of self._args and remove the limitation of needing to pass only client to task | 23:15 |
| mordred | client isn't session in the non-ksa case, it allows specifying the client once at TaskManager instantiation | 23:15 |
| mordred | rather than in every invocation of a Task | 23:15 |
| mordred | it's _totally_ unneeded for the case inside of ksa Session | 23:16 |
| mordred | because of the reason you mentoin :) | 23:16 |
| mordred | but in, for instance, shade, where we have 183 different pre-defined Task objects, it's noise | 23:17 |
| mordred | also - in nodepool, we use TaskManager to manage not-OpenStack API things | 23:17 |
| mordred | for instance: http://git.openstack.org/cgit/openstack-infra/nodepool/tree/nodepool/jenkins_manager.py#n27 | 23:18 |
| *** ayoung has joined #openstack-keystone | 23:20 | |
| *** ChanServ sets mode: +v ayoung | 23:20 | |
| *** adu has joined #openstack-keystone | 23:23 | |
| *** rkrum has joined #openstack-keystone | 23:24 | |
| *** spzala has joined #openstack-keystone | 23:24 | |
| *** spzala has quit IRC | 23:25 | |
| *** spzala has joined #openstack-keystone | 23:25 | |
| *** martinus__ has quit IRC | 23:30 | |
| *** browne has joined #openstack-keystone | 23:31 | |
| *** gagehugo has quit IRC | 23:32 | |
| *** martinus__ has joined #openstack-keystone | 23:33 | |
| *** hockeynut has quit IRC | 23:39 | |
| *** martinus__ has quit IRC | 23:49 | |
| *** martinus__ has joined #openstack-keystone | 23:55 | |
| *** markvoelker has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!