| openstackgerrit | Eric Brown proposed openstack/keystone: SAML federation docs refer to old WSGIScriptAlias https://review.openstack.org/403944 | 00:06 |
|---|---|---|
| openstackgerrit | Eric Brown proposed openstack/keystone: SAML federation docs refer to old WSGIScriptAlias https://review.openstack.org/403944 | 00:08 |
| *** catintheroof has joined #openstack-keystone | 00:08 | |
| rodrigods | ayoung, yep: gate-keystone-dsvm-functional-ubuntu-xenial and gate-keystone-dsvm-functional-v3-only-ubuntu-xenial-nv | 00:29 |
| ayoung | rodrigods, OK. I am going to try and replicate | 00:29 |
| ayoung | rodrigods, and if it works, I'll try to add a devstack plugin for LDAP, and LDAP functional test | 00:29 |
| rodrigods | ayoung, if you use https://review.openstack.org/#/c/400747/ in a devstack env, you will be able to run https://review.openstack.org/#/c/324769/ | 00:30 |
| ayoung | yep, got it | 00:30 |
| rodrigods | of course you need to proper config the tempest settings (see config.py) | 00:30 |
| rodrigods | ayoung, for LDAP, i was hoping to have it done by the outreachy student | 00:31 |
| rodrigods | ayoung, the first step is to check if the LDAP plugin in devstack is ok | 00:31 |
| *** hoangcx has joined #openstack-keystone | 00:47 | |
| ayoung | rodrigods, yep. I can do that now. I have devstack running | 00:50 |
| *** gyee has joined #openstack-keystone | 00:54 | |
| *** gyee has quit IRC | 00:54 | |
| *** stevemar__ has quit IRC | 00:54 | |
| *** guoshan has joined #openstack-keystone | 00:56 | |
| *** dave-mccowan has quit IRC | 00:56 | |
| *** anush has joined #openstack-keystone | 00:59 | |
| *** guoshan has quit IRC | 01:01 | |
| *** spzala has joined #openstack-keystone | 01:05 | |
| *** guoshan has joined #openstack-keystone | 01:07 | |
| *** anush has quit IRC | 01:11 | |
| *** liujiong has joined #openstack-keystone | 01:14 | |
| ayoung | rodrigods, looks like it failed | 01:14 |
| ayoung | nope, my typo | 01:14 |
| ayoung | rodrigods, looks like the interface to LDAP has changed. Doing | 01:18 |
| ayoung | sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/ldap.23913.sk95dgWEpX/manager.ldif failed | 01:18 |
| ayoung | http://paste.openstack.org/show/590735/ | 01:18 |
| ayoung | I'll have to learn the current state of OpenLDAP... | 01:19 |
| openstackgerrit | Eric Brown proposed openstack/keystone: SAML federation docs refer to old WSGIScriptAlias https://review.openstack.org/403944 | 01:26 |
| *** guoshan has quit IRC | 01:39 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/403968 | 01:43 |
| *** browne has quit IRC | 01:55 | |
| *** anush has joined #openstack-keystone | 02:01 | |
| *** anush has quit IRC | 02:02 | |
| *** zhangjl has joined #openstack-keystone | 02:05 | |
| *** catintheroof has quit IRC | 02:16 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone-specs: User self management of TOTP credentials https://review.openstack.org/345705 | 02:16 |
| *** catintheroof has joined #openstack-keystone | 02:16 | |
| *** catintheroof has quit IRC | 02:20 | |
| *** masber has joined #openstack-keystone | 02:26 | |
| *** masber has quit IRC | 02:26 | |
| rodrigods | ayoung, hmm yep... same here, would need to understand the openldap inners | 02:30 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Upload service provider metadata to testshib https://review.openstack.org/400747 | 02:44 |
| openstackgerrit | Spencer Yu proposed openstack/keystonemiddleware: Keystonemiddleware already uses PBR:- setuptools.setup( setup_requires=['pbr>=1.8'], pbr=True) https://review.openstack.org/403987 | 02:52 |
| *** stevemar__ has joined #openstack-keystone | 02:55 | |
| *** stevemar__ has quit IRC | 03:00 | |
| *** spzala has quit IRC | 03:01 | |
| *** spzala has joined #openstack-keystone | 03:01 | |
| *** tqtran has quit IRC | 03:02 | |
| *** spzala has quit IRC | 03:08 | |
| *** links has joined #openstack-keystone | 03:10 | |
| *** links has quit IRC | 03:10 | |
| *** catintheroof has joined #openstack-keystone | 03:25 | |
| *** udesale has joined #openstack-keystone | 03:32 | |
| openstackgerrit | Spencer Yu proposed openstack/keystonemiddleware: Drop MANIFEST.in - it's not needed by pbr https://review.openstack.org/403987 | 03:34 |
| *** spzala has joined #openstack-keystone | 03:37 | |
| *** code-R has quit IRC | 03:51 | |
| *** code-R has joined #openstack-keystone | 03:51 | |
| *** code-R_ has joined #openstack-keystone | 03:53 | |
| *** stevemar__ has joined #openstack-keystone | 03:55 | |
| *** code-R has quit IRC | 03:56 | |
| *** nicolasbock has quit IRC | 04:02 | |
| stevemar__ | should be ready: https://review.openstack.org/#/c/403987/2 | 04:05 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use sha512.hash() instead of .encrypt() https://review.openstack.org/403514 | 04:08 |
| *** stevemar__ has quit IRC | 04:11 | |
| *** adriant has quit IRC | 04:19 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/403968 | 04:20 |
| *** catinthe_ has joined #openstack-keystone | 04:23 | |
| *** catintheroof has quit IRC | 04:26 | |
| *** catinthe_ has quit IRC | 04:26 | |
| *** catintheroof has joined #openstack-keystone | 04:27 | |
| *** catintheroof has quit IRC | 04:27 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Don't invalidate all user tokens of roleless group https://review.openstack.org/399728 | 04:28 |
| *** code-R has joined #openstack-keystone | 04:35 | |
| *** code-R_ has quit IRC | 04:36 | |
| openstackgerrit | Ghanshyam Mann proposed openstack/keystone: Fix title for role-assignments api-ref https://review.openstack.org/404021 | 04:43 |
| *** jrist has quit IRC | 05:03 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: WIP - Allow user to change own expired password https://review.openstack.org/404022 | 05:04 |
| *** spzala has quit IRC | 05:15 | |
| *** zhangjl has quit IRC | 05:35 | |
| *** code-R has quit IRC | 05:42 | |
| *** code-R has joined #openstack-keystone | 05:43 | |
| *** davechen_afk has quit IRC | 06:14 | |
| *** davechen_afk has joined #openstack-keystone | 06:14 | |
| *** jaosorior has joined #openstack-keystone | 06:22 | |
| *** richm has quit IRC | 06:41 | |
| *** FunTara has joined #openstack-keystone | 06:43 | |
| *** zhangjl has joined #openstack-keystone | 06:44 | |
| FunTara | Hi, We are getting timeout messages ocasionally when try to login our openstack environment. Is there anyone for help? Regards. | 06:45 |
| openstackgerrit | Merged openstack/keystone: cache_on_issue default to true https://review.openstack.org/383333 | 06:52 |
| *** josecastroleon has joined #openstack-keystone | 06:53 | |
| *** tqtran has joined #openstack-keystone | 07:01 | |
| *** masber has joined #openstack-keystone | 07:05 | |
| *** tqtran has quit IRC | 07:06 | |
| *** jaosorior has quit IRC | 07:07 | |
| *** jaosorior has joined #openstack-keystone | 07:08 | |
| *** spzala has joined #openstack-keystone | 07:16 | |
| *** spzala has quit IRC | 07:20 | |
| *** pcaruana has joined #openstack-keystone | 07:21 | |
| *** edtubill has joined #openstack-keystone | 07:58 | |
| *** edtubill has quit IRC | 08:03 | |
| *** jpich has joined #openstack-keystone | 08:16 | |
| *** amoralej|off is now known as amoralej | 08:33 | |
| *** woodster_ has quit IRC | 08:36 | |
| *** rcernin has joined #openstack-keystone | 08:56 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** spzala has joined #openstack-keystone | 09:10 | |
| *** stevemar__ has joined #openstack-keystone | 09:12 | |
| *** mvk has quit IRC | 09:13 | |
| *** spzala has quit IRC | 09:15 | |
| *** stevemar__ has quit IRC | 09:16 | |
| *** pnavarro has joined #openstack-keystone | 09:44 | |
| *** mvk has joined #openstack-keystone | 09:46 | |
| *** openstackgerrit has quit IRC | 09:48 | |
| *** openstackgerrit has joined #openstack-keystone | 09:48 | |
| *** code-R has quit IRC | 10:04 | |
| *** aloga_ has joined #openstack-keystone | 10:05 | |
| *** liujiong has quit IRC | 10:14 | |
| *** zhangjl has quit IRC | 10:15 | |
| *** hoangcx has quit IRC | 10:26 | |
| *** code-R has joined #openstack-keystone | 10:28 | |
| *** code-R_ has joined #openstack-keystone | 10:29 | |
| *** code-R has quit IRC | 10:32 | |
| *** udesale has quit IRC | 10:58 | |
| *** tqtran has joined #openstack-keystone | 11:03 | |
| *** tqtran has quit IRC | 11:07 | |
| *** mvk has quit IRC | 11:08 | |
| *** richm has joined #openstack-keystone | 11:12 | |
| *** mvk has joined #openstack-keystone | 11:20 | |
| *** nicolasbock has joined #openstack-keystone | 11:38 | |
| *** josecastroleon has quit IRC | 11:42 | |
| *** anush has joined #openstack-keystone | 12:13 | |
| *** anush has quit IRC | 12:24 | |
| *** josecastroleon has joined #openstack-keystone | 12:28 | |
| *** guoshan has joined #openstack-keystone | 12:28 | |
| *** guoshan has quit IRC | 12:29 | |
| *** guoshan has joined #openstack-keystone | 12:29 | |
| *** guoshan has quit IRC | 12:34 | |
| *** JoeStack has joined #openstack-keystone | 12:35 | |
| *** catinthe_ has joined #openstack-keystone | 12:37 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Print domain name in mapping_populate error message https://review.openstack.org/404197 | 12:39 |
| *** stevemar__ has joined #openstack-keystone | 12:44 | |
| JoeStack | Hi, I need to raise one question regarding openstack-cli usage. I've installed "python-[openstackclient, heatclient] on my local notebook and I've sourced my openrc file containing the credentials and the publicURLs of my OpenStack. Any OpenStack service is responsive except keystone! (i.e. "openstack service list" does not work, "openstack image list" and "glance image-list" does work! | 12:49 |
| JoeStack | Any hint?? | 12:49 |
| dstanek | JoeStack: what is the error? | 12:52 |
| *** dimonv has joined #openstack-keystone | 12:53 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use sha512.hash() instead of .encrypt() https://review.openstack.org/403514 | 12:54 |
| JoeStack | https://bpaste.net/show/9f92246512db | 12:54 |
| stevemar__ | lbragstad: dstanek we can punt this through now: https://review.openstack.org/#/c/403514/3 | 12:55 |
| stevemar__ | passlib has been updated in keystone reqs | 12:55 |
| stevemar__ | dstanek: this should be ready too: https://review.openstack.org/#/c/403987/ | 12:56 |
| *** dimonv has quit IRC | 12:58 | |
| breton | JoeStack: why do you think it doesn't work? | 13:02 |
| breton | JoeStack: the things in the paste are not errors, everything should work fine. | 13:04 |
| breton | (or we don't see full logs) | 13:05 |
| breton | (and output) | 13:05 |
| *** guoshan has joined #openstack-keystone | 13:06 | |
| JoeStack | breton: Please apologize my newbie state in case of asking stupid questions. I would expect the same output on my local notebook when I do a "openstack service list" as I got when I'm locally connected on the OpenStack control node. | 13:06 |
| breton | JoeStack: no problem :) | 13:07 |
| *** amoralej is now known as amoralej|lunch | 13:08 | |
| JoeStack | breton: in the paste you see no outcome from the requested command, no "service list". | 13:08 |
| *** code-R_ has quit IRC | 13:10 | |
| *** code-R has joined #openstack-keystone | 13:10 | |
| *** edmondsw has joined #openstack-keystone | 13:11 | |
| *** dimonv has joined #openstack-keystone | 13:15 | |
| *** guoshan has quit IRC | 13:18 | |
| dstanek | JoeStack: the output doesn't show any errors. what user are you using for that command? | 13:19 |
| *** stevemar__ has quit IRC | 13:19 | |
| *** pnavarro has quit IRC | 13:19 | |
| *** stevemar__ has joined #openstack-keystone | 13:20 | |
| *** FunTara has quit IRC | 13:20 | |
| dimonv | help | 13:22 |
| *** jrist has joined #openstack-keystone | 13:23 | |
| *** stevemar__ has quit IRC | 13:24 | |
| JoeStack | dstanek: I'm using my local user on my local machine (not root) | 13:25 |
| *** spzala has joined #openstack-keystone | 13:26 | |
| dstanek | JoeStack: what openstack user? | 13:26 |
| dstanek | hi dimonv | 13:26 |
| JoeStack | dstanek: I've sourced the "admin" account | 13:27 |
| JoeStack | I've found a hint after the command runs into a timeout. | 13:29 |
| *** ayoung has quit IRC | 13:29 | |
| *** spzala has quit IRC | 13:30 | |
| JoeStack | The command was trying to contact the privateURL and not the public URL, but I don't understand way. The openrc file contains only the pubicURL API addresses. | 13:31 |
| JoeStack | my openrc file: https://bpaste.net/show/a89820d520d7 | 13:34 |
| JoeStack | the issued command after timeout: https://bpaste.net/show/63ffeb2923d4 | 13:36 |
| *** dave-mccowan has joined #openstack-keystone | 13:43 | |
| dstanek | JoeStack: if you don't have that URL in your env then it must be coming from the catalog | 13:44 |
| JoeStack | dstanek: bug or feature? :-) | 13:45 |
| *** udesale has joined #openstack-keystone | 13:47 | |
| dstanek | JoeStack: you'll have to find out where it's coming from and tell me. unlikely a bug since everyone would have the issue. | 13:50 |
| dstanek | JoeStack: what do your keystone endpoints look like? | 13:50 |
| dstanek | JoeStack: i don't use v2 anymore so i don't remember all of the port shenanigans | 13:54 |
| JoeStack | dstanek: my enpoint list: https://bpaste.net/show/8f827390b873 | 13:55 |
| *** code-R has quit IRC | 13:55 | |
| *** lamt has joined #openstack-keystone | 13:57 | |
| JoeStack | dstanek: and a more verbose "endpoint list" from my local machine: https://bpaste.net/show/b6bc09c38120 | 13:58 |
| JoeStack | As you can see at the end of this paste, there is a curl request to the privateURL of keystone, but for whatever reason?!?! | 14:00 |
| dstanek | JoeStack: looking... | 14:02 |
| dstanek | JoeStack: i think since you are doing admin things over v2 that it is pulling the admin url from the catalog | 14:03 |
| dstanek | JoeStack: v2 tried to separate out admin from user APIs based on port. v3 doesn't do this anymore and instead relies on policy | 14:06 |
| JoeStack | dstanek: One conclusion might be to use a different tenant, other than "admin" to be able to issue that command. | 14:08 |
| JoeStack | dstankek: But I got the same behavior when I changed the tenant from "admin" to something else. | 14:09 |
| openstackgerrit | Merged openstack/keystonemiddleware: Drop MANIFEST.in - it's not needed by pbr https://review.openstack.org/403987 | 14:10 |
| JoeStack | dstanek: may I'm the only one using Mirantis 8.0 (Liberty) remotely by using phython-openstackcli on my local machine :-/ | 14:11 |
| *** jperry has joined #openstack-keystone | 14:14 | |
| dstanek | JoeStack: it's not the admin tenant. it's that your doing what is considered an admin operation. | 14:15 |
| dstanek | i don't know Mirantis' stack, but breton might be able to point you in the right direction | 14:16 |
| *** stevemar__ has joined #openstack-keystone | 14:17 | |
| *** daemontool has joined #openstack-keystone | 14:19 | |
| lbragstad | dimonv hello | 14:19 |
| *** code-R has joined #openstack-keystone | 14:19 | |
| *** guoshan has joined #openstack-keystone | 14:22 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Print domain name in mapping_populate error message https://review.openstack.org/404197 | 14:23 |
| *** amoralej|lunch is now known as amoralej | 14:23 | |
| *** agrebennikov has joined #openstack-keystone | 14:24 | |
| dstanek | JoeStack: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/version/service.py#n85 {public,admin}_app_factory shows what 2.0 thinks is public and admin operation. v3_app_factory shows that everything runs under the same port. | 14:30 |
| *** guoshan has quit IRC | 14:32 | |
| *** edmondsw_ has joined #openstack-keystone | 14:38 | |
| *** Marcellin__ has joined #openstack-keystone | 14:41 | |
| openstackgerrit | Merged openstack/keystone: SAML federation docs refer to old WSGIScriptAlias https://review.openstack.org/403944 | 14:47 |
| *** edmondsw_ has quit IRC | 14:53 | |
| *** edmondsw_ has joined #openstack-keystone | 14:53 | |
| *** edmondsw has quit IRC | 14:55 | |
| *** edmondsw_ has quit IRC | 14:55 | |
| *** edmondsw has joined #openstack-keystone | 14:55 | |
| stevemar__ | lbragstad: i see you're also looking at the policy file bug | 14:59 |
| stevemar__ | is ayoung around? noooope | 14:59 |
| stevemar__ | lbragstad: is the rule just flat-out written incorrectly? | 14:59 |
| stevemar__ | in https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json | 15:00 |
| stevemar__ | should token.is_admin_project:True be target.token.is_admin_project:True ? | 15:00 |
| lbragstad | stevemar__ you're talking about https://bugs.launchpad.net/keystone/+bug/1645632 right? | 15:01 |
| openstack | Launchpad bug 1547684 in oslo.policy "duplicate for #1645632 Attribute error on Token object when using domain scoped token" [Undecided,New] | 15:01 |
| stevemar__ | yeah | 15:01 |
| lbragstad | stevemar__ i guess the rule could be written wrong, but i wouldn't expect the keystone CLI to work if that was the case. | 15:02 |
| stevemar__ | this is on the list of the horizon -> keystone bugs | 15:02 |
| stevemar__ | lbragstad: it's only the v3 sample | 15:02 |
| lbragstad | stevemar__ looks like it's on the schedule here - https://etherpad.openstack.org/p/ocata-keystone-horizon ? | 15:03 |
| lbragstad | at line 83 | 15:04 |
| *** spzala has joined #openstack-keystone | 15:04 | |
| stevemar__ | lbragstad: the schedule doesn't really change :) | 15:04 |
| *** tqtran has joined #openstack-keystone | 15:05 | |
| *** spzala has quit IRC | 15:06 | |
| *** spzala has joined #openstack-keystone | 15:06 | |
| lbragstad | stevemar__ true - i just wanted to give it visibility somewhere | 15:06 |
| *** spzala has quit IRC | 15:06 | |
| *** spzala has joined #openstack-keystone | 15:06 | |
| *** spzala has quit IRC | 15:07 | |
| *** jaosorior has quit IRC | 15:07 | |
| *** spzala has joined #openstack-keystone | 15:07 | |
| *** spzala has quit IRC | 15:07 | |
| *** jaosorior has joined #openstack-keystone | 15:08 | |
| *** spzala has joined #openstack-keystone | 15:08 | |
| *** spzala has quit IRC | 15:08 | |
| *** spzala has joined #openstack-keystone | 15:09 | |
| *** spzala has quit IRC | 15:09 | |
| *** tqtran has quit IRC | 15:09 | |
| *** spzala has joined #openstack-keystone | 15:09 | |
| *** spzala has quit IRC | 15:10 | |
| *** spzala has joined #openstack-keystone | 15:10 | |
| *** spzala has quit IRC | 15:10 | |
| *** spzala has joined #openstack-keystone | 15:11 | |
| *** spzala has quit IRC | 15:11 | |
| mfisch | lbragstad: stevemar__ morning | 15:11 |
| lbragstad | mfisch yo | 15:11 |
| mfisch | I'd love to know how my patch magically landed ;) | 15:11 |
| lbragstad | mfisch i was going to ask you the same question | 15:12 |
| mfisch | want to look this gift horse in the mouth, might be a trojan gift horse | 15:12 |
| *** spzala has joined #openstack-keystone | 15:12 | |
| lbragstad | well - i did but davechen_afk beat me to the punch | 15:12 |
| *** spzala has quit IRC | 15:12 | |
| mfisch | did you guys already discuss it? | 15:12 |
| *** spzala has joined #openstack-keystone | 15:12 | |
| *** spzala has quit IRC | 15:13 | |
| lbragstad | mfisch nope | 15:13 |
| *** spzala has joined #openstack-keystone | 15:13 | |
| *** spzala has quit IRC | 15:13 | |
| mfisch | lbragstad: well something certainly landed, had much changed? | 15:13 |
| mfisch | between Nov 16 and Nov 28 | 15:14 |
| *** spzala has joined #openstack-keystone | 15:14 | |
| *** spzala has quit IRC | 15:14 | |
| *** spzala_ has joined #openstack-keystone | 15:14 | |
| *** jaugustine has joined #openstack-keystone | 15:14 | |
| *** spzala_ has quit IRC | 15:14 | |
| lbragstad | mfisch i haven't looked specifically - just saw that it was passing... i need to dig up the error i was getting | 15:14 |
| mfisch | it was a missing field in the token I thnk | 15:15 |
| lbragstad | it was something weird - like the token reference didn't have a specific attribute | 15:15 |
| *** spzala has joined #openstack-keystone | 15:15 | |
| mfisch | lbragstad: oh hey we had a weird error I wanted to let you know about, standing up a new lab. Testers kept telling me that tokens were still valid a few seconds after they should have expired. | 15:15 |
| mfisch | they blamed caching | 15:15 |
| lbragstad | mfisch hmmm... | 15:16 |
| mfisch | I found out yesterday that the ntp ports are blocked outbound in that lab, so the issues is clocks | 15:16 |
| lbragstad | when in doubt, blame caching | 15:16 |
| mfisch | its a good go-to | 15:16 |
| lbragstad | oh - the clocks were out of sync across the keystone cluster? | 15:16 |
| mfisch | yeah | 15:16 |
| mfisch | just a bit | 15:16 |
| mfisch | and our ntp monitoring in Icinga only sees that ntp is up and listening, not that its actually working, oops | 15:17 |
| mfisch | someone just casually said "oh yeah we're working with the firewall guys on ntp access, its blocked" | 15:17 |
| lbragstad | lol | 15:17 |
| lbragstad | "move along citizen, move along" | 15:18 |
| mfisch | #notdevstackproblems I guess | 15:19 |
| mfisch | i am going through every interesting commit | 15:19 |
| lbragstad | cool | 15:20 |
| mfisch | jamie has a patch to allow fetching expired tokens | 15:21 |
| mfisch | in the same code area anyway | 15:21 |
| lbragstad | oh - good point | 15:21 |
| mfisch | d9a6ead6f5f60de6821bc33603c44d04b7e4b8e5 changes a test | 15:21 |
| mfisch | I wonder if that test change did it ^ | 15:21 |
| mfisch | lots of doc changes | 15:22 |
| lbragstad | mfisch https://github.com/openstack/keystone/commit/d9a6ead6f5f60de6821bc33603c44d04b7e4b8e5 ? | 15:23 |
| mfisch | oh wait thats a notification test change | 15:23 |
| mfisch | I thought it was in a different path | 15:24 |
| mfisch | lbragstad: what about this | 15:24 |
| mfisch | adb45134abc76c20d9ce1b8ea17bbbf94980534c | 15:24 |
| mfisch | https://github.com/openstack/keystone/commit/adb45134abc76c20d9ce1b8ea17bbbf94980534c | 15:24 |
| mfisch | that looks familiar | 15:24 |
| lbragstad | ah - possibly... | 15:25 |
| mfisch | is there a way to see old jenkins results? | 15:25 |
| lbragstad | i pulled that out because it was specific to v2 | 15:25 |
| lbragstad | mfisch yeah - you can toggle patch CI through gerrit | 15:25 |
| mfisch | sorry not sure what that means? | 15:25 |
| *** ravelar has joined #openstack-keystone | 15:26 | |
| lbragstad | mfisch if you scroll to the bottom of the page here - https://review.openstack.org/#/c/389365/ | 15:26 |
| lbragstad | you should see a 'Toggle CI' button | 15:26 |
| lbragstad | click it | 15:26 |
| mfisch | oh I had no idea what that button did | 15:26 |
| mfisch | ohh nice | 15:26 |
| lbragstad | that should expand all the jenkins results for the history of that patch | 15:26 |
| lbragstad | #protip | 15:27 |
| lbragstad | ;) | 15:27 |
| mfisch | the error was a KeyError exception on the token | 15:27 |
| *** chlong has joined #openstack-keystone | 15:27 | |
| mfisch | on the user_Id field | 15:27 |
| lbragstad | stevemar__ do we have anyone around that is familiar with multi-domain ldap configurations/ | 15:28 |
| lbragstad | mfisch yeah - that was it | 15:28 |
| mfisch | lbragstad: well I suspect this is the change that did it | 15:29 |
| *** code-R has quit IRC | 15:29 | |
| mfisch | i dont see anything concerning that landed | 15:29 |
| *** code-R has joined #openstack-keystone | 15:29 | |
| *** chris_hultin|AWA is now known as chris_hultin | 15:31 | |
| lbragstad | mfisch well - that's good :) | 15:33 |
| *** knasim-wrs has joined #openstack-keystone | 15:37 | |
| lbragstad | stevemar__ another question - do you know why we consider python-memcache an extra package if we enable caching by default? | 15:38 |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1645263 | 15:38 |
| openstack | Launchpad bug 1645263 in devstack "Unable to run stack.sh on fresh new Ubuntu Xenial 16.04 LTS, script fails with "No module named 'memcache' "" [Undecided,Incomplete] | 15:38 |
| dstanek | lbragstad: that's a good question | 15:39 |
| *** dimonv has quit IRC | 15:45 | |
| openstackgerrit | Merged openstack/keystone: Use sha512.hash() instead of .encrypt() https://review.openstack.org/403514 | 15:47 |
| *** hrybacki is now known as hrybacki|mtg | 15:50 | |
| stevemar__ | lbragstad: dstanek we should probably just make it required at this point, but we could ask morgan_ to be sure | 15:52 |
| *** pnavarro has joined #openstack-keystone | 15:53 | |
| stevemar__ | lbragstad: dstanek breton one of you guys want to look at https://review.openstack.org/#/c/390948/ ? it's ldap related, pretty close i think | 15:53 |
| dstanek | stevemar__: sure, just finishin up another one | 15:55 |
| *** udesale has quit IRC | 15:55 | |
| *** Tahvok has joined #openstack-keystone | 15:55 | |
| *** adrian_otto has joined #openstack-keystone | 15:55 | |
| Tahvok | Hey guys! | 15:55 |
| Tahvok | I'm trying to configure keystone with AD | 15:56 |
| Tahvok | Currently I'm on Mitaka | 15:56 |
| dstanek | Tahvok: are you having issues? | 15:56 |
| dstanek | stevemar__: actually meeting in 5 so i can take a peek after than | 15:56 |
| dstanek | err. that | 15:56 |
| Tahvok | For some reason I can't get it to work. An example of an error I get from the log: User neutron has no access to project 765d0c55f5424ba384196d242a6fa810 _populate_roles /usr/lib/python2.7/dist-packages/keystone/token/providers/common.py:454 | 15:56 |
| Tahvok | The project id is the 'service' project | 15:57 |
| Tahvok | But I did configure it as it should on AD | 15:57 |
| Tahvok | I used this (a bit outdated) guide: http://behindtheracks.com/2015/03/openstack-juno-active-directory-integration/ | 15:58 |
| *** edtubill has joined #openstack-keystone | 15:58 | |
| Tahvok | The official docs seem to be outdated as well.. So not sure what to follow | 15:58 |
| *** madorn has quit IRC | 15:59 | |
| lbragstad | stevemar__ cool - well I'l wait to hear what morgan_ has to say about it | 16:01 |
| dstanek | Tahvok: can the user authenticate properly? and you are just having an issue with a project? | 16:03 |
| *** rcernin has quit IRC | 16:03 | |
| Tahvok | dstanek: with ad authentication + keystone in general | 16:03 |
| Tahvok | Not just a project | 16:03 |
| Tahvok | And the user can authenticate fine | 16:03 |
| *** jaosorior has quit IRC | 16:05 | |
| openstackgerrit | Johannes Grassler proposed openstack/keystone-specs: Added spec on standalone trusts https://review.openstack.org/396634 | 16:05 |
| dstanek | Tahvok: does that user have a role assignment on the project? | 16:06 |
| Tahvok | dstanek: via active directory. Yes | 16:06 |
| *** chlong has quit IRC | 16:07 | |
| agrebennikov | yet another upset user who needs remote assingments :D | 16:07 |
| agrebennikov | folks, when are you restoring this functionality? | 16:08 |
| dstanek | agrebennikov: ? | 16:10 |
| agrebennikov | ^^ "assignments via AD" | 16:11 |
| dstanek | agrebennikov: i doubt we'll officially support that any time soon. we've gone to read-only ldap only | 16:12 |
| dstanek | Tahvok: what assignment driver are you using? | 16:13 |
| Tahvok | dstanek: ldap | 16:13 |
| Tahvok | Is it not supported? | 16:13 |
| dstanek | which verison of keystone? | 16:13 |
| agrebennikov | I know :) that was just a joke, sorry for being sarcastic | 16:13 |
| dstanek | no, not anymore | 16:13 |
| agrebennikov | Tahvok, it's been deprecated/removed 2 releases ago | 16:14 |
| agrebennikov | or 3 | 16:14 |
| Tahvok | dstanek: 2:9.2.0-0ubuntu1 | 16:14 |
| Tahvok | So any guide on configuring read only ldap? | 16:15 |
| stevemar__ | Tahvok: i wrote a blog on it.... 1 sec | 16:17 |
| stevemar__ | Tahvok: https://developer.ibm.com/opentech/2015/08/14/configuring-keystone-with-ibms-bluepages-ldap/ its from 2 releases ago, and i hate sharing unofficial docs, but each time i share i get good feedback: | 16:18 |
| Tahvok | stevemar__: thanks, I'll try it! | 16:19 |
| *** chlong has joined #openstack-keystone | 16:20 | |
| agrebennikov | Tahvok, just keep in mind - No way to store roles/assignments/projects anywhere but local sql. | 16:21 |
| *** knasim-wrs has quit IRC | 16:21 | |
| *** knasim-wrs has joined #openstack-keystone | 16:22 | |
| stevemar__ | bbiab | 16:22 |
| Tahvok | agrebennikov: so it's only for authorization? | 16:22 |
| Tahvok | sorry | 16:22 |
| Tahvok | Authentication | 16:22 |
| Tahvok | You still assign the roles for each user in sql? | 16:22 |
| *** knasim-wrs has quit IRC | 16:24 | |
| *** chrisplo_ has quit IRC | 16:25 | |
| agrebennikov | Tahvok, yes, always | 16:27 |
| agrebennikov | Tahvok, the alternative - use groups instead of individuals | 16:28 |
| *** knasim-wrs has joined #openstack-keystone | 16:28 | |
| Tahvok | agrebennikov: so at least I can use groups for assigning roles? | 16:28 |
| agrebennikov | Tahvok, correct | 16:29 |
| agrebennikov | and that's in stevemar__'s article | 16:30 |
| dstanek | Tahvok: in keystone we don't support the ldap driver anymore for assignments :-( | 16:34 |
| *** pcaruana has quit IRC | 16:36 | |
| *** mvk has quit IRC | 16:36 | |
| *** sayalilunkad has quit IRC | 16:38 | |
| *** browne has joined #openstack-keystone | 16:42 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Deprecate the AdminTokenAuthMiddleware https://review.openstack.org/305287 | 16:43 |
| *** josecastroleon has quit IRC | 16:44 | |
| *** hrybacki|mtg is now known as hrybacki | 16:45 | |
| *** ravelar has quit IRC | 16:51 | |
| *** adrian_otto has quit IRC | 17:01 | |
| *** aloga_ has quit IRC | 17:07 | |
| *** asettle has quit IRC | 17:08 | |
| *** chlong has quit IRC | 17:10 | |
| *** adrian_otto has joined #openstack-keystone | 17:13 | |
| *** raildo has quit IRC | 17:15 | |
| openstackgerrit | Merged openstack/keystone: Don't invalidate all user tokens of roleless group https://review.openstack.org/399728 | 17:15 |
| *** phalmos has joined #openstack-keystone | 17:17 | |
| Tahvok | stevemar__: how do I know my group_objectclass according to your guide? | 17:19 |
| *** zzzeek has quit IRC | 17:20 | |
| *** jpich has quit IRC | 17:21 | |
| *** chrisplo_ has joined #openstack-keystone | 17:22 | |
| *** chlong has joined #openstack-keystone | 17:24 | |
| *** zzzeek has joined #openstack-keystone | 17:24 | |
| *** knasim-wrs has quit IRC | 17:32 | |
| morgan_ | stevemar__: ? | 17:33 |
| lbragstad | it's a morgan_ ! | 17:35 |
| lbragstad | morgan_ i'd love to have your feedback on this - https://bugs.launchpad.net/keystone/+bug/1645263 | 17:35 |
| openstack | Launchpad bug 1645263 in devstack "Unable to run stack.sh on fresh new Ubuntu Xenial 16.04 LTS, script fails with "No module named 'memcache' "" [Undecided,Incomplete] | 17:35 |
| openstackgerrit | Sergey Nikitin proposed openstack/oslo.policy: Improved performance of parse_file_contents() method https://review.openstack.org/404357 | 17:35 |
| morgan_ | oh. lovely. something isn't installing it as exoected | 17:36 |
| morgan_ | it should have worked. | 17:36 |
| morgan_ | iirc this means optional deps [memcach] anret included. | 17:36 |
| morgan_ | you can make it a hard dep if you want. I won't block that. | 17:37 |
| lbragstad | morgan_ what was the whole backstory for not making it a hard dep in the first place/ | 17:37 |
| lbragstad | i feel like i'm missing some tribal knowledge there | 17:37 |
| morgan_ | operators complain Ed. | 17:38 |
| lbragstad | really? | 17:38 |
| morgan_ | complained* | 17:38 |
| *** daemontool has quit IRC | 17:39 | |
| lbragstad | morgan_ were there packaging issues? | 17:39 |
| morgan_ | don't think so. | 17:39 |
| morgan_ | python-memcached just is a kind of sucky library | 17:40 |
| lbragstad | ah | 17:40 |
| morgan_ | and I tried to take it over, but the current maintainer and I haven't been able to sync up. | 17:40 |
| morgan_ | I dropped the ball TBH. | 17:40 |
| lbragstad | morgan_ you just wanted to take it over since we rely on it? or are there outstanding items that need to be addressed? | 17:41 |
| lbragstad | with the library as a whole? | 17:41 |
| *** browne has quit IRC | 17:41 | |
| morgan_ | outstanding bugs. and deoendance on thread.local | 17:42 |
| morgan_ | etc. | 17:42 |
| morgan_ | I can reopen the convo. | 17:42 |
| lbragstad | this is sounding like a mailing list post | 17:42 |
| *** zzzeek has quit IRC | 17:45 | |
| *** ayoung has joined #openstack-keystone | 17:45 | |
| *** markvoelker has quit IRC | 17:45 | |
| morgan_ | we have done this multiple times. | 17:46 |
| lbragstad | morgan_ mailing list posts? | 17:47 |
| morgan_ | cones up the same most. "please don't do that" | 17:47 |
| morgan_ | iirc, yes. | 17:47 |
| lbragstad | ah | 17:47 |
| *** adriant has joined #openstack-keystone | 17:47 | |
| morgan_ | people complain about python-memcached alot in general. | 17:47 |
| lbragstad | hmm | 17:47 |
| *** edtubill has quit IRC | 17:48 | |
| *** zzzeek has joined #openstack-keystone | 17:48 | |
| *** mvk has joined #openstack-keystone | 17:50 | |
| *** markvoelker has joined #openstack-keystone | 17:50 | |
| *** code-R_ has joined #openstack-keystone | 17:51 | |
| *** cbits has joined #openstack-keystone | 17:52 | |
| *** adrian_otto has quit IRC | 17:53 | |
| morgan_ | to be fair, it has gotten better. | 17:53 |
| morgan_ | it still isn't "good" | 17:53 |
| *** code-R has quit IRC | 17:53 | |
| lbragstad | morgan_ i threw it on the meeting agenda | 17:53 |
| * stevemar__ has 6 minutes to eat lunch | 17:54 | |
| morgan_ | wfm | 17:54 |
| * lbragstad hands stevemar__ a shovel | 17:55 | |
| *** browne has joined #openstack-keystone | 17:55 | |
| *** henrynash has joined #openstack-keystone | 17:58 | |
| *** ChanServ sets mode: +v henrynash | 17:58 | |
| *** jperry has quit IRC | 17:59 | |
| stevemar__ | didn't finish :( | 17:59 |
| *** Zer0Byte__ has joined #openstack-keystone | 17:59 | |
| stevemar__ | meeting time!! | 17:59 |
| *** jperry has joined #openstack-keystone | 17:59 | |
| stevemar__ | full agenda | 17:59 |
| *** asettle has joined #openstack-keystone | 18:01 | |
| *** spilla has joined #openstack-keystone | 18:02 | |
| *** rodrigods is now known as rodrigods_ | 18:02 | |
| *** chrisplo_ is now known as chrisplo | 18:02 | |
| *** morgan_ is now known as morganfainberg | 18:03 | |
| *** morganfainberg is now known as morgan | 18:04 | |
| *** rodrigods_ is now known as rodrigods | 18:06 | |
| *** rodrigods has quit IRC | 18:07 | |
| *** rodrigods has joined #openstack-keystone | 18:07 | |
| edmondsw | does anyone know what the max token length is for fernet tokens? | 18:09 |
| stevemar__ | edmondsw: should be 255 | 18:10 |
| stevemar__ | edmondsw: meeting time btw | 18:10 |
| lbragstad | edmondsw 255 | 18:10 |
| edmondsw | tx | 18:10 |
| lbragstad | edmondsw if you're running uuid like ids that can be compressed | 18:10 |
| lbragstad | into byte representations before being message packed | 18:11 |
| *** code-R_ has quit IRC | 18:14 | |
| *** code-R has joined #openstack-keystone | 18:14 | |
| *** crinkle has quit IRC | 18:23 | |
| *** henrynash has quit IRC | 18:25 | |
| *** crinkle has joined #openstack-keystone | 18:28 | |
| *** code-R has quit IRC | 18:47 | |
| adriant | morgan: I'll be around after meeting, and I would love to help fix/rework the auth layer to allow multiple enforcement as I have been thinking about that a lot. :) | 18:49 |
| morgan | adriant: absolutely :) | 18:49 |
| morgan | adriant: i've wanted multiple plugin requirements enforced since grizzly | 18:49 |
| adriant | morgan: my main problem, and why I've been waiting to write a spec, is enforcement isn't enough... | 18:49 |
| morgan | so.. i've spent a long time thinking about how we do this | 18:50 |
| adriant | it needs to be a layered approach. | 18:50 |
| adriant | with base types, and addons that require a base type | 18:50 |
| adriant | but, after meeting :) | 18:50 |
| morgan | nah. we have a canonical list of plugins we allow (it's in keystone.conf) we can store for a user (or idp/protocol) a list of required ones | 18:51 |
| morgan | if the plugin is required AND enabled in keystone.conf | 18:51 |
| morgan | we require both for auth | 18:51 |
| morgan | for that user or idp/protocol | 18:51 |
| morgan | it wont break what you'd be building too, aka passwordtotp if you needed it | 18:51 |
| morgan | because you could just limit the keystone.conf to only use that one | 18:52 |
| adriant | We run a public cloud, so we don't have esay control over what people are running | 18:52 |
| *** nishaYadav has joined #openstack-keystone | 18:52 | |
| adriant | so we need passwordtotp :( | 18:52 |
| adriant | as it just 'works' | 18:52 |
| adriant | people append their password to password and it works :( | 18:52 |
| adriant | I wanted to do multiple plugins, but keystone didn't support it, and it would break a lot for our customers | 18:53 |
| morgan | is it stritcly CLI and horizon that you're worried about then? | 18:53 |
| adriant | yeah | 18:53 |
| morgan | then we can fix that part as well with keystoneauth work. | 18:53 |
| morgan | since keystoneauth also has plugins that can make the magic happen | 18:54 |
| *** tqtran has joined #openstack-keystone | 18:54 | |
| morgan | and django-keystoneauth as well. | 18:54 |
| morgan | (which btw, would still be needed to be fixed) | 18:54 |
| adriant | indeed, but this seemed like the least hassle in the short term and appending a passcode to password was a common enough approach it seems | 18:54 |
| morgan | i'm not precluding passwordtotp, i am very much against suppoting *another* plugin when the whole push for totp was predicated on the fix i've described | 18:55 |
| adriant | my only problem with your idea is where/how do we say "this user need TOTP and password" | 18:55 |
| morgan | in user specific metadata | 18:55 |
| morgan | it becomes part of the user object | 18:55 |
| morgan | a list of required auth plugins | 18:55 |
| adriant | ok, and where is the totp secret stored? :P | 18:56 |
| adriant | there are multiple dependencies here | 18:56 |
| morgan | the totp secret is (unfortunately) stored in the creds table | 18:56 |
| morgan | like today | 18:56 |
| adriant | and that also needs to be managed somehow | 18:56 |
| *** code-R has joined #openstack-keystone | 18:57 | |
| morgan | this feels like something that should be built around the CLI and/or horizon not in keystone | 18:57 |
| morgan | the totp creation. | 18:57 |
| morgan | i don't really want keystone to be "generating" the totp secrets | 18:57 |
| adriant | yeah, but it allows us to be consistent | 18:57 |
| adriant | otherwise we NEED to validate incoming secrets | 18:57 |
| dstanek | adriant: why do you want to generate them in keystone? | 18:57 |
| morgan | your user management portal can do that. | 18:58 |
| adriant | ^ | 18:58 |
| morgan | users cannot update their own objects unless they are a domain admin with magic powers granted | 18:58 |
| adriant | it's a question of breaking | 18:58 |
| adriant | the totp secrets need to be base32 | 18:58 |
| * morgan flips back to meeting | 18:59 | |
| ayoung | agrebennikov, so, you knoiw that I proposed the projectID thing , too, right? | 19:00 |
| agrebennikov | sure I don't :) | 19:01 |
| morgan | adriant: i also think it's a mistake we ever built an api to generate the EC2 credentials in keystone | 19:01 |
| agrebennikov | where? | 19:01 |
| ayoung | and it was killed then | 19:01 |
| morgan | adriant: for what it's worth | 19:01 |
| ayoung | agrebennikov, in this same forum, about a year+ ago. | 19:01 |
| dstanek | morgan: ++ | 19:01 |
| adriant | morgan: yeah, I can understand that. | 19:01 |
| ayoung | I wanted it for cleaning up resources left hanging when a project is deleted | 19:01 |
| dstanek | adriant: so your worried that a user will add a credential that isn't correct base32? | 19:02 |
| morgan | ayoung: and as you remember i was on your side. i put a -2 on this because i want to make sure we discussed this before we allowed it in based on the previous convos | 19:02 |
| morgan | agrebennikov: ^ cc | 19:02 |
| ayoung | agrebennikov, there were other people that wanted it for keeping projects in sync between two clouds | 19:02 |
| morgan | not because i disagree with the proposal | 19:02 |
| agrebennikov | ayoung, ah, but is's different since it involves all OS projects | 19:02 |
| ayoung | agrebennikov, everything that Keystone does involves all OS projects....nature of the Beast | 19:02 |
| morgan | this has been contentious in the past and can't be snuck in. | 19:02 |
| ayoung | agrebennikov, why do you want it? | 19:02 |
| adriant | morgan: the thing though that I wanted to do with totp creation in keystone is to be able to create them, but not have them used until they've supplied a valid passcode generated from it. | 19:02 |
| agrebennikov | same as before - I need my token to be valid across regions | 19:03 |
| morgan | adriant: this is a lot of busines slogic | 19:03 |
| adriant | morgan: I can do that outside of keystone, but it means storing the secret elsewhere | 19:03 |
| adriant | morgan: until submitted and 'active' at least. | 19:03 |
| morgan | adriant: this is also why i want the multiple plugin enforcement requirements | 19:03 |
| morgan | adriant: so you could store it locally in keystone and when it's validated, you update the user to require the new (or multiple) plugins to auth | 19:04 |
| adriant | morgan: yeah, a user specific list of "use these" would help | 19:04 |
| agrebennikov | ayoung, in fact custom project IDs were always around based on the ldap groups | 19:04 |
| morgan | adriant: exactly what i want to do :) | 19:04 |
| ayoung | agrebennikov, LDAP assignment is long dead | 19:04 |
| agrebennikov | this is why I completely disagree with morgan's -2 | 19:04 |
| morgan | ayoung: ++ | 19:04 |
| agrebennikov | and so? | 19:04 |
| ayoung | agrebennikov, question still stands. why do you want it? | 19:04 |
| agrebennikov | I'm no longer asking you to bring it back:) | 19:04 |
| morgan | agrebennikov: ldap assignment is dead, and we have said in no uncertain terms keystone itself owns and generates ids | 19:05 |
| dstanek | agrebennikov: you can still use it if you really, really want | 19:05 |
| ayoung | agrebennikov, is this for cross-cloud project assignment sync for the K2K case? | 19:05 |
| cbits | I think there are use cases where you have more than one keysone (30) and you want to do show back, charge back and other tracking | 19:05 |
| agrebennikov | dstanek, this is offtopic for now.... ayoung yes | 19:05 |
| dstanek | adriant: i'm not clear on the usecase for generating the totp secrets | 19:05 |
| morgan | the only way i would accept custom ids is if it explicitly conformed to the standard id format... uuid4 -- but it opens a lot of doors to conflicting ids because ids are globally unique and domain admins can create orojects | 19:05 |
| cbits | it helps to have the same project ID in all of those keystones | 19:05 |
| ayoung | agrebennikov, no, it is very much on topic | 19:06 |
| adriant | morgan: but there is a problem to fix with the current totp plugin, even if a user has totp in their "must use" list, they should still be able to login and actually create a totp cred, so the totp plugin needs to only deny auth if the user has a totp cred and the passcode was wrong. | 19:06 |
| ayoung | it is a serious concern and should be addressed. | 19:06 |
| cbits | RE: https://review.openstack.org/#/c/403866/2 | 19:06 |
| ayoung | And, guess what, it is | 19:06 |
| ayoung | agrebennikov, there is an effort to extend FEderation to autogenerate a project for certain cases. Ithink it solves yours | 19:06 |
| ayoung | lbragstad, that is going to make it in to Ocata, right? | 19:07 |
| dstanek | adriant: morgan: i don't think that enforcement belongs there | 19:07 |
| morgan | adriant: i actually yhink we need a required list that looks like: (password, totp || password, backup_code) | 19:07 |
| lbragstad | ayoung it's accepted for ocata - i'm still working on it though | 19:07 |
| morgan | dstanek: i largely agree | 19:07 |
| dstanek | adriant: morgan: higher up something should know that certain plugins are required and deal with that | 19:07 |
| adriant | dstanek: saves it being done outside of keystone, allows admins to set a standard/min length, less hassle and problems outside of keystone, and lets the users manage things in keystone themselves rather than 'need' a separate user management service. | 19:07 |
| ayoung | lbragstad, it will work for K2k right? | 19:07 |
| dstanek | adriant: morgan: i don't know how to do that though | 19:07 |
| morgan | dstanek: i see it as user-metatdata | 19:08 |
| agrebennikov | morgan, so literally you want me to automatically convert my custom "id" in the same way you do it for domains and users? | 19:08 |
| morgan | dstanek: and the auth system sees what are required. | 19:08 |
| lbragstad | ayoung sure - it is extending the mapping engine to resolve attribute in the assertion to create specific things on first federated authenticatino | 19:08 |
| lbragstad | ayoung so it should work for k2k -but it shouldn't be specific to it by any means | 19:08 |
| ayoung | agrebennikov, there ya go...that was the answer I was given last year, too | 19:08 |
| morgan | agrebennikov: if more folks than adam and i agree to this... you would need to perform a validation to make sure it conforms (uuid) to the same format as other ids | 19:08 |
| dstanek | adriant: why wouldn't you do that with password generation then? | 19:09 |
| cbits | +1 | 19:09 |
| adriant | dstanek: but we now do have password requirements in keystone :) | 19:09 |
| cbits | I think if we can validate its a UUID (same format) and check to ensure its not already in use the project_id could be passed in | 19:09 |
| agrebennikov | morgan, but let me ask you this... WHAT is the purpose of this conversion if In Fact it is still the same? | 19:09 |
| dstanek | adriant: we don't have any generation | 19:09 |
| cbits | we dont want to do anythin unsafe. but do want to support valid use cases. | 19:09 |
| adriant | dstanek: and passwords a user needs to actually know/remember, a totp cred needs to be random | 19:10 |
| morgan | agrebennikov: because as it stands now you can have an id called "omgmycoolproject" | 19:10 |
| agrebennikov | morgan, the only thing needs to be valdated - whether it is unique or not | 19:10 |
| agrebennikov | in the db | 19:10 |
| morgan | agrebennikov: that is not valid - we make assertions about project ids because they are used in URLs (much to my chagrin) | 19:10 |
| adriant | dstanek: no one remembers a totp cred, they add it to a passcode generation app and forget about it. | 19:10 |
| morgan | outside of keystone | 19:10 |
| *** nishaYadav has quit IRC | 19:10 | |
| morgan | adriant: this is why you provide backup codes (one time use) | 19:11 |
| morgan | adriant: ala google | 19:11 |
| agrebennikov | morgan, gotcha, agree | 19:11 |
| dstanek | adriant: i don't remember passwords (or even generate them) either. last pass does that for me. | 19:11 |
| morgan | agrebennikov: so my -2 really is about this is a repeated discussion. we need more than 2 cores here to confirm it is ok. and i'll require it to be a UUID in the db. (hex form) | 19:12 |
| morgan | agrebennikov: i will be honest, i do not dislike this and was on adam's side before | 19:12 |
| dstanek | adriant: i don't expect google to tell me what my password is...ever. and if they do they are severly broken | 19:12 |
| adriant | dstanek: yes, but using password managers sadly isn't as common as we'd all like :( | 19:12 |
| morgan | agrebennikov: this isn't a bad idea. it is an idea that needs quorum across the cores and the PTL | 19:12 |
| adriant | dstanek: I'm not sure what you mean here? when you setup MFA on google they give you a secret | 19:13 |
| *** raildo has joined #openstack-keystone | 19:13 | |
| morgan | dstanek: keepass does it for me, but i want to go back to lastpass | 19:13 |
| adriant | dstanek: they generate one, and give that to you as a QRcode | 19:13 |
| agrebennikov | morgan, ok, let me go talk to Adam :) | 19:13 |
| adriant | morgan: keepass is awful... :( | 19:13 |
| morgan | agrebennikov: that is ayoung btw | 19:13 |
| agrebennikov | I kon | 19:13 |
| agrebennikov | *know | 19:13 |
| morgan | adriant: it is easier on multiple platforms and my data is not stored in a service that has been compromised over and over. | 19:14 |
| morgan | adriant: (ok twice) | 19:14 |
| adriant | morgan: oh I agree, I use it, I just don't like it :P | 19:14 |
| morgan | adriant: keepass ui is awful | 19:14 |
| morgan | anyway.. so back on topic | 19:14 |
| morgan | google, setup totp, requires a validation step and gives one-time-use codes | 19:15 |
| morgan | as a backup | 19:15 |
| adriant | we could do that in keystone, yes | 19:15 |
| morgan | and all sorts of things we can't do (sms) | 19:15 |
| agrebennikov | morgan, same with the roles then? (just so we make it more generic) | 19:15 |
| bknudson | why not just do google federation? | 19:15 |
| morgan | agrebennikov: roles are only ever referenced by name | 19:15 |
| dstanek | we seem to be going further and further down the IdP rabbit hole | 19:16 |
| agrebennikov | morgan, not in the token | 19:16 |
| morgan | the uuids are unique for DB purposed but could have been an autoinc | 19:16 |
| morgan | agrebennikov: they should be referenced by name in the token. or they used ot be | 19:16 |
| agrebennikov | hm | 19:16 |
| agrebennikov | let me double check :/ | 19:16 |
| morgan | because policy doens't know id->name | 19:16 |
| *** code-R has quit IRC | 19:16 | |
| dstanek | morgan: yep, roles are by name | 19:17 |
| morgan | policy engine can only enforce on name | 19:17 |
| agrebennikov | dstanek, currently in the token? | 19:17 |
| morgan | agrebennikov: yes. | 19:17 |
| *** code-R has joined #openstack-keystone | 19:17 | |
| morgan | i am certain | 19:17 |
| morgan | otherwise we couldn't enforce roles for API calls | 19:17 |
| agrebennikov | morgan, ok, well, then it's a bit easier | 19:17 |
| morgan | yeah roles are a lot easier on that front | 19:17 |
| dstanek | agrebennikov: what morgan said | 19:17 |
| morgan | domain ids, project ids, and user ids | 19:18 |
| cbits | Love them! | 19:18 |
| morgan | and trust_ids (but that can be cloud specific) | 19:18 |
| morgan | are ids, roles are names. | 19:18 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add reason to notifications for PCI-DSS https://review.openstack.org/396752 | 19:18 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add reason to CADF notifications in docs https://review.openstack.org/400882 | 19:18 |
| morgan | bknudson: i mean... isn't google oidc? | 19:18 |
| morgan | we could. | 19:19 |
| morgan | adriant: the way i see it is we need to be able to specify a list of AND and ORs for required auth plugins per user | 19:19 |
| morgan | so we can do (password AND totp) OR (passwordtotp) OR (password AND onetime_code) etc | 19:19 |
| morgan | as an example | 19:20 |
| dolphm | mfisch: i just came across http://www.mattfischer.com/blog/?p=790 -- A) awesome work, B) what are you using for benchmarking nowadays? those graphs are shiny. | 19:20 |
| adriant | morgan: yeah, I could work with that | 19:20 |
| morgan | and when you generate/validate the code, you then change the required plugins for the user | 19:20 |
| morgan | and store the totp code in the db | 19:20 |
| dolphm | mfisch: i imagine you either tediously collected a LOT of data with something simple like ab or used something smarter | 19:21 |
| morgan | it also means you could disable the need for totp without removing the cred if you so desired. | 19:21 |
| *** amoralej is now known as amoralej|off | 19:21 | |
| dolphm | mfisch: specifically for the data behind the excel-looking graphs | 19:21 |
| morgan | or you could store the token and wait until it is validated to enable the requirement for the user | 19:21 |
| morgan | dolphm: mfisch has shiiiiiiney graphs | 19:21 |
| morgan | dolphm: i wish i had graphs that pretty | 19:21 |
| morgan | adriant: i know it is more work | 19:22 |
| morgan | adriant: i'll do what i can to help get this through. | 19:22 |
| adriant | morgan: a lot of work, but I'd be happy to help | 19:22 |
| morgan | adriant: so we can solve the problem more correctly and finish up the badly ignored totp stuff ... i knew i should have demanded the auth plugin work first :P | 19:23 |
| adriant | morgan: we'd need to update keystone auth to dynamically load/require the plugins based on the user thought, which could get ugly. | 19:23 |
| morgan | adriant: nah we still load based on keystone.conf | 19:23 |
| adriant | though* | 19:23 |
| bknudson | dolphm: looks like grafana | 19:23 |
| morgan | and we just enforce based upon user metadata | 19:23 |
| morgan | if the plugin is disabled in keystone.conf, it is a no-op | 19:23 |
| adriant | keystone auth those allows a user to say which plugins they want to use | 19:23 |
| morgan | and ignored. | 19:23 |
| morgan | the auth-plugins in keystone itself (server) are configured explicitly | 19:24 |
| adriant | so we need to change and make sure the whole chain works | 19:24 |
| adriant | and that errors messages are good | 19:24 |
| morgan | keystoneauth library is user-end and doesn't matter. | 19:24 |
| morgan | we will need better error messages | 19:24 |
| morgan | for sure | 19:24 |
| adriant | yes, else a user will not be able to login and have no clue why | 19:24 |
| morgan | brb | 19:25 |
| morgan | i think if someone passes a bad totp token you can say standard "bad username/password" --- if someone auths with user and password but requires totp "insufficient auth data" [will have to think of better wording] is correct | 19:27 |
| adriant | a lot of the problem will be a user logging in after someone (and admin maybe) has setup some requirements, and not knowing why they can't log in. | 19:28 |
| adriant | an* admin | 19:28 |
| adriant | but that's another problem really :/ | 19:28 |
| morgan | that is, i think, a communication issue | 19:28 |
| morgan | i am not sure we can really solve that easily with tech. | 19:29 |
| adriant | yeah, and we have no way of saying: your auth requirements have changed | 19:29 |
| morgan | without possibly leaking data that should 't be leaked. | 19:29 |
| adriant | that needs to happen outside of keystone | 19:29 |
| morgan | yah. | 19:29 |
| morgan | i don't wnat keystone to need ot learn to talk smtp to send emails :P | 19:30 |
| adriant | in my case I have a service exactly for crap like that | 19:30 |
| morgan | ^+^ | 19:30 |
| morgan | erm ^_^ | 19:30 |
| adriant | Alright, morgan, lets organise working together on this as a spec, probably... next cycle? | 19:31 |
| adriant | As I do want to allow multiple auth plugins, and I have ideas for new ones I want to add on top of password | 19:32 |
| morgan | adriant: lets ping stevemar__ ^ | 19:32 |
| morgan | next cycle spec or try and get this in now? | 19:33 |
| adriant | Not enough time I don't think this cycle :( | 19:33 |
| morgan | this is why i ask stevemar__ still. | 19:33 |
| adriant | password_totp is still probably worth keeping though ;) | 19:33 |
| morgan | it's not a ton of work, but it is a db migration and some added validation | 19:34 |
| morgan | i know where all the bits go | 19:34 |
| morgan | maybe 300-600 LOC with tests. | 19:34 |
| morgan | the only question i have is should it be a many-to-many mapping (in a db) setup... por just a column on the user | 19:35 |
| * morgan leans towards many-to-many | 19:35 | |
| adriant | many to many? So you can link multiple users to the same rule? | 19:36 |
| adriant | I guess that makes sense, but also kind of ugly' | 19:36 |
| *** code-R has quit IRC | 19:36 | |
| adriant | safer to give users each their own rules, although more data | 19:36 |
| morgan | ah yeah | 19:36 |
| adriant | You mean more just, a new metadata like table? | 19:37 |
| adriant | kind of like: https://review.openstack.org/#/c/388886/ ? | 19:37 |
| adriant | In this case, we can probably just do it as a top level user object field as it is important enough to justify it. | 19:38 |
| morgan | yeah. | 19:38 |
| morgan | my only concern is the size limit | 19:38 |
| adriant | just do user.auth_rules or something and to be safe make it a text field as char is too limiting | 19:38 |
| morgan | varchar255 is kindof the limit we have in the db | 19:39 |
| morgan | we could use a blob... but that is highly unstructured. | 19:39 |
| agrebennikov | mey morgan, one more question regarding my topic - if the user will try to create the new project with the same id, I hope the DB will not allow to store it, correct? | 19:39 |
| agrebennikov | same as name | 19:39 |
| morgan | agrebennikov: it should not allow it. | 19:39 |
| morgan | it is a unique constraint | 19:40 |
| morgan | names are unique within a domain | 19:40 |
| morgan | so new domain_id and the same name works | 19:40 |
| morgan | same domain_id and same_name is a conflict | 19:40 |
| agrebennikov | ok, tnx | 19:40 |
| adriant | morgan: is there ever a case we'd need to index on rules themselves? Wouldn't be just fetch the whole blob anyway? | 19:40 |
| morgan | ids are globally (within a keystone) unqiue | 19:40 |
| morgan | adriant: you know... i don't think we need to index it | 19:40 |
| agrebennikov | so no additional checks are required | 19:40 |
| morgan | agrebennikov: correct, we already validate that | 19:41 |
| adriant | morgan: blob works then, as we always just fetch the whole thing, parse it, build the rules tree, and go from there | 19:41 |
| adriant | and chances are we can do that at the last stage of auth. Once all the auth plugins are done, check their status against the rules. | 19:41 |
| morgan | adriant: yeah. | 19:44 |
| morgan | that is the idea. | 19:44 |
| morgan | i kindof want to be careful about creating a new DSL just for this though.. | 19:44 |
| adriant | http://paste.openstack.org/show/590881/ | 19:45 |
| adriant | do a rules check is a tree traversal | 19:45 |
| morgan | i'm thinking a simple JSON form | 19:45 |
| *** josecastroleon has joined #openstack-keystone | 19:45 | |
| morgan | vs "natural language" style you proposed | 19:45 |
| adriant | a json tree of rules works too :) | 19:45 |
| adriant | since it is that structure pretty much | 19:46 |
| adriant | easier to read, parse and maintain | 19:46 |
| morgan | "required_plugins": [["password", "totp"], ["passwordtotp"], ["password", "ontime"]] | 19:46 |
| morgan | exactly | 19:46 |
| morgan | and i think we start with user-specific | 19:47 |
| morgan | and we can add idp/protocol enforcement after with the same pattern | 19:47 |
| *** josecastroleon has quit IRC | 19:50 | |
| *** adriant has quit IRC | 19:51 | |
| morgan | lbragstad: so .. should i re-open the convo with python-memcached maintainer? | 19:55 |
| lbragstad | morgan well - i was going to wait and see what the rest of the group wanted to do about the issue | 19:56 |
| morgan | lbragstad: i just asked the maintainer again | 19:57 |
| morgan | worst case we can simply make it better -- regardless of what we do with stack.sh | 19:58 |
| lbragstad | morgan who is the maintainer? | 19:58 |
| morgan | Sean Reifschneider | 19:58 |
| morgan | linsomniac on github | 19:58 |
| morgan | i need him to grant me the pypi and launchpad projects | 19:59 |
| morgan | and i can do the import / get it into gerrit | 19:59 |
| *** code-R has joined #openstack-keystone | 20:00 | |
| *** code-R has quit IRC | 20:01 | |
| *** code-R has joined #openstack-keystone | 20:02 | |
| mfisch | dolphm: the first set of graphs is from grafana, the 2nd is google docs | 20:04 |
| lbragstad | morgan cool - i'll keep the topic on the agenda for next weeks meeting | 20:05 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Import TaskManager from shade/nodepool https://review.openstack.org/362473 | 20:11 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Use TaskManager for all request interactions https://review.openstack.org/362474 | 20:11 |
| dolphm | mfisch: how did you collect the data? | 20:11 |
| morgan | lbragstad: ^ those could use eyes | 20:11 |
| mfisch | dolphm: the 2nd set of data is from a forked copy of that apache bench tool thing you wrote | 20:11 |
| lbragstad | morgan cool - i have one other meeting after the tc meeting i'm lingering in, but i have them opened ;0 | 20:12 |
| mfisch | the first set we have a custom python test suite that makes api calls every 60 seconds and posts to monasca | 20:12 |
| morgan | lbragstad: thnx | 20:12 |
| openstackgerrit | Sergey Nikitin proposed openstack/oslo.policy: Improved performance of parse_file_contents() method https://review.openstack.org/404357 | 20:17 |
| *** adriant has joined #openstack-keystone | 20:25 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes unused default_assignment_driver method https://review.openstack.org/404411 | 20:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes unused method from assignment core https://review.openstack.org/404412 | 20:28 |
| *** richm has left #openstack-keystone | 20:28 | |
| adriant | morgan: hey sorry internet cut out and then I realised what time it was so ran off to work. :( | 20:29 |
| *** richm has joined #openstack-keystone | 20:29 | |
| * adriant at work now | 20:29 | |
| adriant | morgan: so can talk, but I think I'll just follow up with an email :) | 20:29 |
| morgan | adriant: wfm | 20:32 |
| morgan | i need to lunch and followup on a couple other things | 20:33 |
| morgan | once the TC meeting is done we'll get stevemar__ to make a call on "try and land in ocata" or not | 20:33 |
| *** edtubill has joined #openstack-keystone | 20:34 | |
| *** edtubill has quit IRC | 20:34 | |
| *** catinthe_ has quit IRC | 20:35 | |
| stevemar__ | o/ | 20:37 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes unused exceptions https://review.openstack.org/404416 | 20:39 |
| bknudson | by the time dstanek is done we'll find out that keystone is only a few lines of bash. | 20:40 |
| morgan | stevemar__: the totp changed | 20:40 |
| lbragstad | bknudson lol | 20:40 |
| morgan | stevemar__: try for this cycle or aim for next | 20:40 |
| stevemar__ | bknudson: nice | 20:40 |
| stevemar__ | morgan: i'm still game for this cycle | 20:41 |
| morgan | bknudson: i bash? phsaw... who needs bash. it'd be 2 lines in a text document | 20:41 |
| morgan | bknudson: and still work | 20:41 |
| morgan | adriant: ^ looks like this cycle is on the table | 20:41 |
| morgan | stevemar__: https://review.openstack.org/#/c/362473/ and the dependant change need eyes. | 20:42 |
| morgan | stevemar__: if you don't mind. it would make adding application specific logic to ksa sessions much easier (and simplify shade/nodepool) | 20:42 |
| stevemar__ | morgan: added to the list | 20:44 |
| morgan | stevemar__: since you could add client/application specific logic to every request (such as rate limiting, or caching, or krb5) without needing ksa to be changed. | 20:44 |
| morgan | stevemar__: thnx | 20:44 |
| *** code-R has quit IRC | 20:51 | |
| lbragstad | morgan bknudson do it in lamdamoo! | 20:51 |
| dstanek | bknudson: :-) | 20:52 |
| adriant | morgan: I'm game for this cycle too :) Can dedicate dev time towards it. Just have to get the spec together and merged before the 12th! | 20:58 |
| *** raildo has quit IRC | 20:58 | |
| morgan | adriant: shouldn't be too hard to do | 20:59 |
| morgan | i can start on it later today... or you can publish the first pass on the spec and i can contribute | 21:00 |
| morgan | either works for me | 21:00 |
| *** adrian_otto has joined #openstack-keystone | 21:00 | |
| dstanek | adriant: plenty of time | 21:01 |
| *** adrian_otto1 has joined #openstack-keystone | 21:06 | |
| *** dave-mccowan has quit IRC | 21:06 | |
| *** adrian_otto has quit IRC | 21:07 | |
| *** edtubill has joined #openstack-keystone | 21:07 | |
| *** edtubill has quit IRC | 21:07 | |
| *** edtubill has joined #openstack-keystone | 21:08 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Drop support for IBM DB2 https://review.openstack.org/353767 | 21:10 |
| *** code-R has joined #openstack-keystone | 21:16 | |
| mfisch | just rolled newton into staging, very smooth | 21:20 |
| lbragstad | mfisch nice! | 21:20 |
| mfisch | outage was < 2 seconds this time | 21:20 |
| lbragstad | mfisch no rolling upgrade?! ;) | 21:21 |
| mfisch | I have it all automated | 21:21 |
| mfisch | maybe I should post those ansible scripts | 21:21 |
| lbragstad | mfisch i thought you TWC folks lived dangerously :) | 21:21 |
| stevemar__ | adriant: listen to morgan, he's the smart guy in the room :P | 21:22 |
| lbragstad | mfisch is that all ansible? | 21:22 |
| mfisch | yeah ansible driving puppet | 21:23 |
| lbragstad | huh - interesting | 21:23 |
| mfisch | handles teh quiescing, db backups, db cluster mgmt | 21:23 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Pass allow_expired to token validate https://review.openstack.org/382099 | 21:23 |
| mfisch | if I get to go to ATL I'll draw it out for you guys so you can see how the real world deals with your devstack experiments ;) | 21:23 |
| lbragstad | mfisch i recently saw a couple patches being proposed to openstack-ansible for rolling upgrade support (cc: odyssey4me ) | 21:23 |
| lbragstad | mfisch oo that sounds exciting! | 21:23 |
| stevemar__ | dstanek: doubt https://review.openstack.org/#/c/353767/ will pass, it wasn't passing before the rebase was necessary | 21:24 |
| mfisch | now we'll wait 1 week and then do prod | 21:24 |
| lbragstad | awesome | 21:24 |
| *** spilla has quit IRC | 21:29 | |
| bknudson | you don't rust us? | 21:30 |
| bknudson | trust | 21:30 |
| *** adrian_otto1 has quit IRC | 21:32 | |
| adriant | stevemar__, morgan: Well I've official approval from my PM to dedicate time towards a auth plugin rework (as it fits under what I want to do with MFA). :) | 21:32 |
| morgan | nice! | 21:33 |
| *** adrian_otto has joined #openstack-keystone | 21:33 | |
| *** cbits has quit IRC | 21:33 | |
| morgan | bknudson I don't trust us | 21:33 |
| adriant | morgan: may put together a rough outline of the spec based on our talk and if you submit first I can simply contribute as needed :) | 21:33 |
| adriant | morgan: but keystone is a trusts worth service! | 21:33 |
| adriant | worthy* | 21:33 |
| morgan | adriant: sounds good. | 21:33 |
| dstanek | stevemar__: i have my finger crossed :-) and if it doesn't i'll get it fixed | 21:34 |
| dstanek | stevemar__: i | 21:34 |
| dstanek | ' | 21:34 |
| *** catintheroof has joined #openstack-keystone | 21:34 | |
| dstanek | grrr... | 21:34 |
| dstanek | stevemar__: i'm taking over https://review.openstack.org/#/c/276474/5 - any disagreement with my comments? that's in my queue of stuff | 21:35 |
| *** spzala has quit IRC | 21:35 | |
| stevemar__ | dstanek: not disagreements from me | 21:35 |
| dstanek | coolio | 21:35 |
| *** spzala has joined #openstack-keystone | 21:36 | |
| *** spzala has quit IRC | 21:36 | |
| *** spzala has joined #openstack-keystone | 21:36 | |
| *** spzala has quit IRC | 21:37 | |
| *** spzala has joined #openstack-keystone | 21:37 | |
| *** spzala has quit IRC | 21:37 | |
| *** spzala has joined #openstack-keystone | 21:38 | |
| *** spzala has quit IRC | 21:38 | |
| *** spzala has joined #openstack-keystone | 21:38 | |
| *** spzala has quit IRC | 21:38 | |
| *** catintheroof has quit IRC | 21:38 | |
| *** spzala has joined #openstack-keystone | 21:39 | |
| *** spzala has quit IRC | 21:39 | |
| *** spzala has joined #openstack-keystone | 21:40 | |
| *** spzala has quit IRC | 21:40 | |
| *** spzala has joined #openstack-keystone | 21:40 | |
| *** spzala has quit IRC | 21:40 | |
| *** spzala has joined #openstack-keystone | 21:41 | |
| *** spzala has quit IRC | 21:41 | |
| *** code-R has quit IRC | 21:42 | |
| *** spzala has joined #openstack-keystone | 21:42 | |
| *** spzala has quit IRC | 21:42 | |
| *** spzala has joined #openstack-keystone | 21:42 | |
| *** spzala has quit IRC | 21:43 | |
| *** spzala has joined #openstack-keystone | 21:43 | |
| *** spzala has quit IRC | 21:43 | |
| *** spzala has joined #openstack-keystone | 21:44 | |
| *** spzala has quit IRC | 21:44 | |
| *** spzala has joined #openstack-keystone | 21:45 | |
| *** spzala has quit IRC | 21:45 | |
| *** spzala has joined #openstack-keystone | 21:45 | |
| *** spzala has quit IRC | 21:46 | |
| *** spzala has joined #openstack-keystone | 21:46 | |
| *** spzala has quit IRC | 21:46 | |
| *** spzala has joined #openstack-keystone | 21:47 | |
| *** catintheroof has joined #openstack-keystone | 21:47 | |
| *** spzala has quit IRC | 21:47 | |
| *** spzala has joined #openstack-keystone | 21:48 | |
| *** spzala has quit IRC | 21:48 | |
| *** spzala has joined #openstack-keystone | 21:48 | |
| *** spzala has quit IRC | 21:48 | |
| *** spzala has joined #openstack-keystone | 21:49 | |
| *** spzala has quit IRC | 21:49 | |
| *** spzala has joined #openstack-keystone | 21:50 | |
| *** spzala has quit IRC | 21:50 | |
| *** pnavarro has quit IRC | 21:50 | |
| *** spzala has joined #openstack-keystone | 21:51 | |
| *** spzala has quit IRC | 21:51 | |
| *** spzala has joined #openstack-keystone | 21:51 | |
| *** spzala has quit IRC | 21:51 | |
| *** spzala has joined #openstack-keystone | 21:52 | |
| *** spzala has quit IRC | 21:52 | |
| *** spzala has joined #openstack-keystone | 21:53 | |
| *** spzala has quit IRC | 21:53 | |
| *** spzala has joined #openstack-keystone | 21:54 | |
| *** spzala has quit IRC | 21:54 | |
| *** spzala has joined #openstack-keystone | 21:54 | |
| *** spzala has quit IRC | 21:55 | |
| *** spzala has joined #openstack-keystone | 21:55 | |
| *** spzala has quit IRC | 21:55 | |
| *** rodrigods is now known as rodrigods_ | 21:56 | |
| *** spzala has joined #openstack-keystone | 21:56 | |
| *** spzala has quit IRC | 21:56 | |
| *** spzala has joined #openstack-keystone | 21:57 | |
| *** spzala has quit IRC | 21:57 | |
| *** spzala has joined #openstack-keystone | 21:57 | |
| *** spzala has quit IRC | 21:57 | |
| *** spzala has joined #openstack-keystone | 21:58 | |
| *** spzala has quit IRC | 21:58 | |
| *** spzala has joined #openstack-keystone | 21:59 | |
| *** spzala has quit IRC | 21:59 | |
| *** spzala has joined #openstack-keystone | 21:59 | |
| *** masuberu has joined #openstack-keystone | 22:00 | |
| *** spzala has quit IRC | 22:00 | |
| openstackgerrit | Merged openstack/oslo.policy: Improved performance of parse_file_contents() method https://review.openstack.org/404357 | 22:00 |
| *** spzala has joined #openstack-keystone | 22:00 | |
| *** spzala has quit IRC | 22:00 | |
| *** spzala has joined #openstack-keystone | 22:01 | |
| *** spzala has quit IRC | 22:01 | |
| *** spzala has joined #openstack-keystone | 22:02 | |
| *** spzala has quit IRC | 22:02 | |
| *** code-R has joined #openstack-keystone | 22:02 | |
| *** spzala has joined #openstack-keystone | 22:03 | |
| *** spzala has quit IRC | 22:03 | |
| *** masber has quit IRC | 22:03 | |
| *** spzala has joined #openstack-keystone | 22:03 | |
| *** spzala has quit IRC | 22:03 | |
| *** spzala has joined #openstack-keystone | 22:04 | |
| *** spzala has quit IRC | 22:04 | |
| *** topol has joined #openstack-keystone | 22:04 | |
| *** ChanServ sets mode: +v topol | 22:04 | |
| *** spzala has joined #openstack-keystone | 22:05 | |
| *** spzala has quit IRC | 22:05 | |
| *** masuberu has quit IRC | 22:05 | |
| *** spzala has joined #openstack-keystone | 22:05 | |
| *** spzala has quit IRC | 22:06 | |
| *** chris_hultin is now known as chris_hultin|AWA | 22:06 | |
| *** spzala has joined #openstack-keystone | 22:06 | |
| *** spzala has quit IRC | 22:06 | |
| *** spzala has joined #openstack-keystone | 22:07 | |
| *** spzala has quit IRC | 22:07 | |
| *** spzala has joined #openstack-keystone | 22:08 | |
| *** spzala has quit IRC | 22:08 | |
| *** masuberu has joined #openstack-keystone | 22:08 | |
| *** jrist has quit IRC | 22:08 | |
| *** spzala has joined #openstack-keystone | 22:08 | |
| *** spzala has quit IRC | 22:09 | |
| *** spzala has joined #openstack-keystone | 22:09 | |
| *** spzala has quit IRC | 22:09 | |
| *** spzala has joined #openstack-keystone | 22:10 | |
| *** spzala has quit IRC | 22:10 | |
| *** JoeStack has quit IRC | 22:10 | |
| *** spzala has joined #openstack-keystone | 22:11 | |
| *** spzala has quit IRC | 22:11 | |
| *** code-R has quit IRC | 22:11 | |
| *** spzala has joined #openstack-keystone | 22:11 | |
| *** spzala has quit IRC | 22:12 | |
| *** chlong has quit IRC | 22:12 | |
| *** spzala has joined #openstack-keystone | 22:12 | |
| *** spzala has quit IRC | 22:12 | |
| *** spzala has joined #openstack-keystone | 22:13 | |
| *** spzala has quit IRC | 22:13 | |
| *** spzala has joined #openstack-keystone | 22:14 | |
| *** spzala has quit IRC | 22:14 | |
| stevemar__ | dstanek: oh | 22:14 |
| *** spzala has joined #openstack-keystone | 22:14 | |
| stevemar__ | dstanek: lbragstad: someone: https://review.openstack.org/#/c/390948/ | 22:15 |
| *** spzala has quit IRC | 22:15 | |
| *** spzala has joined #openstack-keystone | 22:15 | |
| *** spzala has quit IRC | 22:15 | |
| *** spzala has joined #openstack-keystone | 22:16 | |
| *** spzala has quit IRC | 22:16 | |
| *** topol has quit IRC | 22:16 | |
| *** spzala has joined #openstack-keystone | 22:17 | |
| *** spzala has quit IRC | 22:17 | |
| *** spzala has joined #openstack-keystone | 22:17 | |
| *** spzala has quit IRC | 22:18 | |
| *** spzala has joined #openstack-keystone | 22:18 | |
| *** spzala has quit IRC | 22:18 | |
| *** spzala has joined #openstack-keystone | 22:19 | |
| *** spzala has quit IRC | 22:19 | |
| *** topol has joined #openstack-keystone | 22:19 | |
| *** ChanServ sets mode: +v topol | 22:19 | |
| *** spzala has joined #openstack-keystone | 22:20 | |
| *** spzala has quit IRC | 22:20 | |
| *** spzala has joined #openstack-keystone | 22:20 | |
| *** spzala has quit IRC | 22:20 | |
| *** spzala has joined #openstack-keystone | 22:21 | |
| *** spzala has quit IRC | 22:21 | |
| *** spzala has joined #openstack-keystone | 22:22 | |
| openstackgerrit | Merged openstack/keystone: Removed unused EXTENSION_TO_ADD test declarations https://review.openstack.org/404350 | 22:22 |
| *** spzala has quit IRC | 22:22 | |
| *** spzala has joined #openstack-keystone | 22:23 | |
| *** spzala has quit IRC | 22:23 | |
| *** JoeStack has joined #openstack-keystone | 22:23 | |
| *** spzala has joined #openstack-keystone | 22:24 | |
| *** spzala has quit IRC | 22:24 | |
| *** spzala has joined #openstack-keystone | 22:24 | |
| lbragstad | stevemar__ reviewing | 22:24 |
| *** spzala has quit IRC | 22:24 | |
| lbragstad | morgan mordred i reviewed the task manager stuff - code wise i think it's good to go... just had a couple outstanding questions | 22:25 |
| *** spzala has joined #openstack-keystone | 22:25 | |
| *** spzala has quit IRC | 22:25 | |
| morgan | OK looking | 22:25 |
| *** jaugustine has quit IRC | 22:25 | |
| lbragstad | morgan it's failing on a pep8 issue | 22:26 |
| *** spzala has joined #openstack-keystone | 22:26 | |
| *** spzala has quit IRC | 22:26 | |
| *** spzala has joined #openstack-keystone | 22:26 | |
| *** spzala has quit IRC | 22:27 | |
| lbragstad | stevemar__ are we expecting to backport https://review.openstack.org/#/c/390948/7 to mitaka? | 22:27 |
| stevemar__ | lbragstad: no, i do not believe it is critical enough for n-1 release, let alone n-2 | 22:27 |
| *** spzala has joined #openstack-keystone | 22:27 | |
| morgan | lbragstad: replied | 22:27 |
| morgan | i can fix the pep8 | 22:28 |
| *** spzala has quit IRC | 22:28 | |
| morgan | lbragstad: the other comment is basically "yep there are two ways" and submit_task is more correct | 22:28 |
| *** spzala has joined #openstack-keystone | 22:28 | |
| morgan | but ... changing this interface even down the line is going to be undesierabe unless we make shade/nodepool monkey patch this in each time | 22:28 |
| *** spzala has quit IRC | 22:28 | |
| morgan | deprecation warning could exist... if needed | 22:29 |
| *** spzala has joined #openstack-keystone | 22:29 | |
| *** spzala has quit IRC | 22:29 | |
| morgan | lbragstad: in short, if the difference is a +2 with a dep warning, i'll ad it | 22:29 |
| morgan | if +2 will occur in either case, i'd rather not | 22:29 |
| *** spzala has joined #openstack-keystone | 22:30 | |
| *** spzala has quit IRC | 22:30 | |
| lbragstad | morgan certainly not a hard stop - but something we can do in a follow on commit | 22:30 |
| morgan | okie fixing pep8 now then | 22:31 |
| *** adrian_otto has quit IRC | 22:31 | |
| *** spzala has joined #openstack-keystone | 22:31 | |
| morgan | will see about deprecation warning in followup | 22:31 |
| *** spzala has quit IRC | 22:31 | |
| *** rcernin has joined #openstack-keystone | 22:31 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Import TaskManager from shade/nodepool https://review.openstack.org/362473 | 22:31 |
| lbragstad | morgan does TaskManager have developer docs? | 22:31 |
| *** spzala has joined #openstack-keystone | 22:31 | |
| lbragstad | morgan because it can be used through the keystoneauth library, can't it? | 22:32 |
| *** spzala has quit IRC | 22:32 | |
| morgan | lbragstad: that is something i need to get mordred to help with | 22:32 |
| mordred | I didn't do it | 22:32 |
| mordred | what? | 22:32 |
| * mordred hides | 22:32 | |
| morgan | no docs yet | 22:32 |
| morgan | taskmanager | 22:32 |
| lbragstad | morgan your 'i didn't do it' reaction time is on point | 22:32 |
| *** spzala has joined #openstack-keystone | 22:32 | |
| morgan | that is definitely a followup as is the larger functional tests | 22:32 |
| lbragstad | er ... mordred ^ | 22:32 |
| *** spzala has quit IRC | 22:32 | |
| morgan | mor<tab> fail ;) | 22:32 |
| lbragstad | it's happened like 3 times today | 22:33 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Use TaskManager for all request interactions https://review.openstack.org/362474 | 22:33 |
| mordred | hehe | 22:33 |
| *** spzala has joined #openstack-keystone | 22:33 | |
| *** spzala has quit IRC | 22:33 | |
| lbragstad | morgan how about a wishlist bug to add docs for taskmanager? | 22:33 |
| morgan | sure. i need to run and food | 22:33 |
| lbragstad | that way we don't lose it | 22:33 |
| morgan | mind opening it for me? | 22:34 |
| lbragstad | morgan sure | 22:34 |
| morgan | and go ahead and assign it to mor<tab> :P | 22:34 |
| *** spzala has joined #openstack-keystone | 22:34 | |
| *** spzala has quit IRC | 22:34 | |
| lbragstad | lol - it will default to one of you so that'd be fine! | 22:34 |
| morgan | the plan is to get this in so we can clean up shade quickly | 22:35 |
| *** spzala has joined #openstack-keystone | 22:35 | |
| *** spzala has quit IRC | 22:35 | |
| *** spzala has joined #openstack-keystone | 22:35 | |
| morgan | lbragstad: but the code is documentation /s :P | 22:35 |
| *** spzala has quit IRC | 22:35 | |
| *** spzala has joined #openstack-keystone | 22:36 | |
| lbragstad | psh - mmmhm... | 22:36 |
| *** spzala has quit IRC | 22:36 | |
| lbragstad | i've tried that before | 22:36 |
| *** spzala has joined #openstack-keystone | 22:36 | |
| morgan | ok i need to food and make some phone calls. | 22:36 |
| morgan | bbiab | 22:37 |
| *** spzala has quit IRC | 22:37 | |
| *** spzala has joined #openstack-keystone | 22:37 | |
| *** spzala has quit IRC | 22:37 | |
| *** spzala has joined #openstack-keystone | 22:38 | |
| *** spzala has quit IRC | 22:38 | |
| *** spzala has joined #openstack-keystone | 22:38 | |
| *** spzala has quit IRC | 22:38 | |
| *** spzala has joined #openstack-keystone | 22:39 | |
| *** spzala has quit IRC | 22:39 | |
| *** spzala has joined #openstack-keystone | 22:39 | |
| *** spzala has quit IRC | 22:39 | |
| *** spzala has joined #openstack-keystone | 22:40 | |
| *** spzala has quit IRC | 22:40 | |
| *** spzala has joined #openstack-keystone | 22:41 | |
| *** spzala has quit IRC | 22:41 | |
| openstackgerrit | Andrey Grebennikov proposed openstack/keystone: Allow to specify ID on project creation https://review.openstack.org/403866 | 22:41 |
| *** spzala has joined #openstack-keystone | 22:42 | |
| *** spzala has quit IRC | 22:42 | |
| *** spzala has joined #openstack-keystone | 22:42 | |
| *** spzala has quit IRC | 22:43 | |
| *** spzala has joined #openstack-keystone | 22:43 | |
| *** spzala has quit IRC | 22:43 | |
| *** spzala has joined #openstack-keystone | 22:44 | |
| *** spzala has quit IRC | 22:44 | |
| openstackgerrit | Andrey Grebennikov proposed openstack/keystone: Allow to specify ID on project creation https://review.openstack.org/403866 | 22:45 |
| *** spzala has joined #openstack-keystone | 22:45 | |
| *** spzala has quit IRC | 22:45 | |
| *** gyee has joined #openstack-keystone | 22:45 | |
| *** spzala has joined #openstack-keystone | 22:46 | |
| *** spzala has quit IRC | 22:46 | |
| *** spzala has joined #openstack-keystone | 22:46 | |
| *** spzala has quit IRC | 22:47 | |
| *** spzala has joined #openstack-keystone | 22:47 | |
| *** spzala has quit IRC | 22:47 | |
| *** spzala has joined #openstack-keystone | 22:48 | |
| *** spzala has quit IRC | 22:48 | |
| *** spzala has joined #openstack-keystone | 22:49 | |
| *** spzala has quit IRC | 22:49 | |
| *** edmondsw has quit IRC | 22:50 | |
| *** spzala has joined #openstack-keystone | 22:50 | |
| *** spzala has quit IRC | 22:50 | |
| *** spzala has joined #openstack-keystone | 22:51 | |
| *** spzala has quit IRC | 22:51 | |
| *** spzala has joined #openstack-keystone | 22:51 | |
| *** spzala has quit IRC | 22:51 | |
| *** spzala has joined #openstack-keystone | 22:52 | |
| *** spzala has quit IRC | 22:52 | |
| *** chris_hultin|AWA is now known as chris_hultin | 22:53 | |
| *** spzala_ has joined #openstack-keystone | 22:53 | |
| *** spzala_ has quit IRC | 22:53 | |
| *** spzala_ has joined #openstack-keystone | 22:54 | |
| *** spzala_ has quit IRC | 22:54 | |
| *** spzala_ has joined #openstack-keystone | 22:55 | |
| *** spzala_ has quit IRC | 22:55 | |
| *** spzala has joined #openstack-keystone | 22:56 | |
| *** spzala has quit IRC | 22:56 | |
| *** spzala has joined #openstack-keystone | 22:56 | |
| *** spzala has quit IRC | 22:56 | |
| *** spzala has joined #openstack-keystone | 22:57 | |
| *** spzala has quit IRC | 22:57 | |
| *** spzala has joined #openstack-keystone | 22:58 | |
| *** spzala has quit IRC | 22:58 | |
| *** spzala has joined #openstack-keystone | 22:59 | |
| *** spzala has quit IRC | 22:59 | |
| *** spzala has joined #openstack-keystone | 22:59 | |
| *** spzala has quit IRC | 22:59 | |
| *** spzala has joined #openstack-keystone | 23:00 | |
| *** spzala_ has joined #openstack-keystone | 23:00 | |
| *** spzala_ has quit IRC | 23:00 | |
| *** spzala_ has joined #openstack-keystone | 23:01 | |
| *** spzala_ has quit IRC | 23:01 | |
| *** rcernin has quit IRC | 23:01 | |
| *** spzala_ has joined #openstack-keystone | 23:02 | |
| *** spzala_ has quit IRC | 23:02 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Pass allow_expired to token validate https://review.openstack.org/382099 | 23:02 |
| *** spzala_ has joined #openstack-keystone | 23:02 | |
| *** spzala has quit IRC | 23:02 | |
| *** chris_hultin is now known as chris_hultin|AWA | 23:03 | |
| *** spzala_ has quit IRC | 23:03 | |
| *** edtubill has quit IRC | 23:03 | |
| *** rcernin has joined #openstack-keystone | 23:03 | |
| *** spzala has joined #openstack-keystone | 23:03 | |
| *** catinthe_ has joined #openstack-keystone | 23:03 | |
| *** spzala has quit IRC | 23:03 | |
| *** rcernin has quit IRC | 23:04 | |
| *** rcernin has joined #openstack-keystone | 23:04 | |
| *** spzala has joined #openstack-keystone | 23:04 | |
| *** spzala has quit IRC | 23:04 | |
| *** spzala has joined #openstack-keystone | 23:05 | |
| *** spzala has quit IRC | 23:05 | |
| *** spzala has joined #openstack-keystone | 23:06 | |
| *** spzala has quit IRC | 23:06 | |
| *** catintheroof has quit IRC | 23:06 | |
| *** spzala has joined #openstack-keystone | 23:06 | |
| *** spzala has quit IRC | 23:06 | |
| *** spzala has joined #openstack-keystone | 23:07 | |
| *** spzala has quit IRC | 23:07 | |
| *** spzala has joined #openstack-keystone | 23:08 | |
| *** spzala has quit IRC | 23:08 | |
| *** asettle has quit IRC | 23:08 | |
| openstackgerrit | Andrey Grebennikov proposed openstack/keystone: Allow to specify ID on project creation https://review.openstack.org/403866 | 23:08 |
| *** spzala has joined #openstack-keystone | 23:09 | |
| *** spzala has quit IRC | 23:09 | |
| *** spzala has joined #openstack-keystone | 23:09 | |
| *** spzala has quit IRC | 23:09 | |
| *** spzala has joined #openstack-keystone | 23:10 | |
| *** spzala has quit IRC | 23:10 | |
| *** spzala has joined #openstack-keystone | 23:11 | |
| *** spzala has quit IRC | 23:11 | |
| *** spzala has joined #openstack-keystone | 23:12 | |
| *** spzala has quit IRC | 23:12 | |
| *** spzala has joined #openstack-keystone | 23:12 | |
| *** spzala has quit IRC | 23:13 | |
| *** spzala has joined #openstack-keystone | 23:13 | |
| *** spzala has quit IRC | 23:13 | |
| *** spzala has joined #openstack-keystone | 23:14 | |
| *** spzala has quit IRC | 23:14 | |
| *** spzala has joined #openstack-keystone | 23:15 | |
| *** spzala has quit IRC | 23:15 | |
| *** spzala has joined #openstack-keystone | 23:15 | |
| *** spzala has quit IRC | 23:15 | |
| *** spzala has joined #openstack-keystone | 23:16 | |
| *** spzala has quit IRC | 23:16 | |
| *** chris_hultin|AWA is now known as chris_hultin | 23:16 | |
| *** rodrigods_ is now known as rodrigods | 23:17 | |
| *** spzala has joined #openstack-keystone | 23:17 | |
| *** spzala has quit IRC | 23:17 | |
| *** jperry has quit IRC | 23:17 | |
| *** spzala has joined #openstack-keystone | 23:18 | |
| *** spzala has quit IRC | 23:18 | |
| *** spzala has joined #openstack-keystone | 23:18 | |
| *** spzala has quit IRC | 23:19 | |
| *** spzala has joined #openstack-keystone | 23:19 | |
| *** spzala has quit IRC | 23:20 | |
| *** spzala has joined #openstack-keystone | 23:20 | |
| *** spzala has quit IRC | 23:20 | |
| *** spzala has joined #openstack-keystone | 23:21 | |
| *** spzala has quit IRC | 23:21 | |
| *** spzala has joined #openstack-keystone | 23:22 | |
| *** spzala has quit IRC | 23:22 | |
| *** stevemar__ has quit IRC | 23:22 | |
| *** spzala has joined #openstack-keystone | 23:22 | |
| *** spzala has quit IRC | 23:23 | |
| *** stevemar__ has joined #openstack-keystone | 23:23 | |
| *** spzala has joined #openstack-keystone | 23:23 | |
| *** spzala has quit IRC | 23:23 | |
| *** ayoung has quit IRC | 23:23 | |
| *** phalmos has quit IRC | 23:23 | |
| *** spzala has joined #openstack-keystone | 23:24 | |
| *** spzala has quit IRC | 23:24 | |
| *** spzala has joined #openstack-keystone | 23:25 | |
| *** spzala has quit IRC | 23:25 | |
| *** spzala has joined #openstack-keystone | 23:25 | |
| *** spzala has quit IRC | 23:25 | |
| *** spzala has joined #openstack-keystone | 23:26 | |
| *** spzala has quit IRC | 23:26 | |
| *** spzala has joined #openstack-keystone | 23:27 | |
| *** spzala has quit IRC | 23:27 | |
| *** stevemar__ has quit IRC | 23:27 | |
| *** spzala has joined #openstack-keystone | 23:28 | |
| *** spzala has quit IRC | 23:29 | |
| *** JoeStack has quit IRC | 23:29 | |
| *** spzala has joined #openstack-keystone | 23:29 | |
| *** spzala has quit IRC | 23:29 | |
| *** spzala has joined #openstack-keystone | 23:30 | |
| *** spzala has quit IRC | 23:30 | |
| *** spzala has joined #openstack-keystone | 23:31 | |
| *** spzala has quit IRC | 23:31 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Force users to immediately change their password upon first use https://review.openstack.org/403916 | 23:31 |
| *** spzala has joined #openstack-keystone | 23:32 | |
| *** spzala has quit IRC | 23:32 | |
| *** spzala has joined #openstack-keystone | 23:32 | |
| *** spzala has quit IRC | 23:32 | |
| *** spzala has joined #openstack-keystone | 23:33 | |
| *** spzala has quit IRC | 23:33 | |
| *** spzala has joined #openstack-keystone | 23:34 | |
| *** spzala has quit IRC | 23:34 | |
| *** chris_hultin is now known as chris_hultin|AWA | 23:34 | |
| *** spzala has joined #openstack-keystone | 23:34 | |
| *** spzala has quit IRC | 23:35 | |
| *** spzala has joined #openstack-keystone | 23:35 | |
| *** spzala has quit IRC | 23:35 | |
| *** spzala has joined #openstack-keystone | 23:36 | |
| *** spzala has quit IRC | 23:36 | |
| *** spzala has joined #openstack-keystone | 23:37 | |
| *** agrebennikov has quit IRC | 23:40 | |
| *** rcernin has quit IRC | 23:41 | |
| jamielennox | morgan: so why isn't task_manager basically a decorator/wrapper? | 23:44 |
| jamielennox | morgan: like ksa would give you the function it was going to call and you basically do a contextmanager around it | 23:45 |
| jamielennox | mordred: ^ | 23:46 |
| *** lamt has quit IRC | 23:46 | |
| lbragstad | jamielennox that'd be interesting | 23:46 |
| jamielennox | lbragstad: i want to support the use case, and shade is a huge user - but i'm not sure the pattern makes sense for general purpose | 23:47 |
| jamielennox | like i cannot get around the fact that you get a client object passed to you - why? why not wrap that as a partial before hand and make the thing generic | 23:48 |
| lbragstad | jamielennox yeah - that kinda confused me a bit | 23:48 |
| lbragstad | seeing client passed as self | 23:48 |
| lbragstad | jamielennox so - what would be wrapped? | 23:49 |
| jamielennox | i'm not sure yet, but i'm trying to use external rate limiting as a use case and go from there | 23:51 |
| jamielennox | and keep shade's case in mind | 23:51 |
| jamielennox | like eg i don't think we should handle xcept keystoneauth1.exceptions.RetriableConnectionFailure: if every request goes through the task manager | 23:51 |
| lbragstad | shade's case is that they just want to string together events, right? | 23:51 |
| jamielennox | anyone handling that outside would be really confused | 23:52 |
| jamielennox | i think it wants to multi thread and wait for a couple of requests | 23:52 |
| lbragstad | jamielennox so - like an example? | 23:52 |
| mordred | we want to serliaze access from multiple threads and handle rate-limiting at the client side | 23:52 |
| mordred | so we have 1000 threads all trying to launch servers | 23:52 |
| mordred | but we know the cloud falls over at more than 50 requests per second | 23:53 |
| jamielennox | so it's kind of a cheap async()? | 23:53 |
| mordred | well, it's an async that uses threads so it's possible to debug :) | 23:53 |
| lbragstad | so - TaskManager mitigates that by allowing you to specific the frequency of requests? | 23:53 |
| mordred | yah | 23:53 |
| mordred | it's how nodepool works, which means shade needs to support the construct - pushing support down into ksa is mostly a "other power users might want something similar" | 23:54 |
| jamielennox | so the value coming back from session.get is an threading.event or something? | 23:54 |
| mordred | nah - we don't actually talk to a given cloud with more than one execution thread at a time | 23:55 |
| jamielennox | mordred: why not just wrap requests.Session and pass that in? | 23:55 |
| mordred | that's what we're currently doing | 23:55 |
| mordred | this is not needed on our side | 23:55 |
| mordred | it's possible to do wrappers | 23:55 |
| mordred | but it's one of those "we're higher volume api consumers than just about anyone else, trying to share the love" kind of things | 23:56 |
| jamielennox | yea, i'm happy to incorporate it, it's just the framework doesn't feel right at this level | 23:57 |
| jamielennox | like why are we having to call generate_request_class | 23:57 |
| jamielennox | the basic non-shade case seems weird | 23:57 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!