| *** jmlowe has quit IRC | 00:14 | |
| *** jmlowe has joined #openstack-keystone | 00:15 | |
| *** openstackgerrit has joined #openstack-keystone | 00:22 | |
| openstackgerrit | Merged openstack/keystone master: Fix PCI DSS docs on change_password_after_first_use https://review.openstack.org/476235 | 00:22 |
|---|---|---|
| samueldmq | this should be easy to get in https://review.openstack.org/#/c/475460/ | 00:42 |
| *** shuyingya has joined #openstack-keystone | 00:46 | |
| *** Shunli has joined #openstack-keystone | 01:02 | |
| *** liujiong has joined #openstack-keystone | 01:31 | |
| *** chlong has joined #openstack-keystone | 01:44 | |
| *** zhurong has joined #openstack-keystone | 01:52 | |
| *** chlong has quit IRC | 02:04 | |
| *** liujiong_lj has joined #openstack-keystone | 02:10 | |
| *** liujiong has quit IRC | 02:12 | |
| *** namnh has joined #openstack-keystone | 02:22 | |
| *** gongysh has joined #openstack-keystone | 02:24 | |
| *** liujiong_lj is now known as liujiong | 02:27 | |
| *** aselius has quit IRC | 02:29 | |
| *** chlong has joined #openstack-keystone | 02:37 | |
| *** zsli_ has joined #openstack-keystone | 02:55 | |
| *** Shunli has quit IRC | 02:58 | |
| *** gyee has quit IRC | 02:58 | |
| *** markvoelker has quit IRC | 03:21 | |
| *** markvoelker has joined #openstack-keystone | 03:21 | |
| *** nicolasbock has joined #openstack-keystone | 03:22 | |
| *** edmondsw has quit IRC | 03:22 | |
| *** markvoelker has quit IRC | 03:26 | |
| *** gongysh has quit IRC | 03:39 | |
| *** gongysh has joined #openstack-keystone | 03:42 | |
| *** namnh_ has joined #openstack-keystone | 03:45 | |
| *** aselius has joined #openstack-keystone | 03:45 | |
| *** namnh has quit IRC | 03:48 | |
| *** zhurong has quit IRC | 03:49 | |
| *** gongysh has quit IRC | 03:53 | |
| *** dave-mccowan has quit IRC | 03:56 | |
| *** chlong has quit IRC | 04:02 | |
| *** chlong has joined #openstack-keystone | 04:16 | |
| *** links has joined #openstack-keystone | 04:21 | |
| *** xuhaigang has quit IRC | 04:35 | |
| *** markvoelker has joined #openstack-keystone | 05:28 | |
| *** markvoelker has quit IRC | 05:40 | |
| *** markvoelker_ has joined #openstack-keystone | 05:44 | |
| *** gongysh has joined #openstack-keystone | 05:47 | |
| *** pnavarro has joined #openstack-keystone | 05:50 | |
| *** markvoelker_ has quit IRC | 05:52 | |
| *** aselius has quit IRC | 05:55 | |
| *** Dinesh_Bhor has quit IRC | 05:57 | |
| *** ducttape_ has joined #openstack-keystone | 06:01 | |
| *** ducttape_ has quit IRC | 06:06 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 06:06 | |
| *** sjain has joined #openstack-keystone | 06:23 | |
| sjain | cmurphy: Hi!, The patch you rebased initially passed the jenkins test, then after some time it is again giving the merge conflict | 06:24 |
| sjain | and its related patches are also giving the merge conflicts | 06:25 |
| *** rcernin has joined #openstack-keystone | 06:30 | |
| *** sjain has quit IRC | 06:34 | |
| *** rcernin has quit IRC | 06:37 | |
| *** gagehugo has quit IRC | 06:40 | |
| *** markvoelker has joined #openstack-keystone | 06:40 | |
| *** gagehugo has joined #openstack-keystone | 06:42 | |
| *** markvoelker has quit IRC | 06:47 | |
| *** tbh_ has joined #openstack-keystone | 06:50 | |
| *** rcernin has joined #openstack-keystone | 06:50 | |
| *** markvoelker has joined #openstack-keystone | 06:59 | |
| *** tesseract has joined #openstack-keystone | 07:02 | |
| *** markvoelker has quit IRC | 07:04 | |
| *** pcaruana has joined #openstack-keystone | 07:05 | |
| *** markvoelker has joined #openstack-keystone | 07:08 | |
| *** markvoelker has quit IRC | 07:13 | |
| *** f13o has joined #openstack-keystone | 07:14 | |
| openstackgerrit | 龚肖 proposed openstack/keystone master: Fix token persistence driver number in configuration.rst. https://review.openstack.org/476384 | 07:18 |
| *** markvoelker has joined #openstack-keystone | 07:21 | |
| *** markvoelker has quit IRC | 07:29 | |
| *** sjain has joined #openstack-keystone | 07:47 | |
| sjain | thanks cmurphy, I'll try to rebase the patch again | 07:48 |
| cmurphy | sjain: cool | 07:48 |
| sjain | one more doubt, when I do git rebase -i master, there are a series of changes which come up, should I select all or only the changes I have made? | 07:50 |
| cmurphy | sjain: you should not use rebase -i here | 07:50 |
| sjain | okay, what does -i stand for? | 07:51 |
| cmurphy | it stands for interactive, so it's a way to go back to individual commits and reorder them or edit them or squash them into each other | 07:51 |
| sjain | okay, so I should just do git rebase master? | 07:52 |
| cmurphy | yes, and make sure your local master is up to date | 07:53 |
| sjain | okay, I'll do that | 07:53 |
| sjain | thanks! | 07:53 |
| cmurphy | no problem | 07:53 |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Updated the keystone docs to follow the docs theme https://review.openstack.org/466066 | 07:58 |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Reorganised keystone documentation structure https://review.openstack.org/475119 | 07:58 |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** sjain has quit IRC | 08:12 | |
| *** markvoelker has joined #openstack-keystone | 08:17 | |
| *** markvoelker has quit IRC | 08:22 | |
| *** sjain has joined #openstack-keystone | 08:24 | |
| *** zhurong has joined #openstack-keystone | 08:28 | |
| *** markvoelker has joined #openstack-keystone | 08:36 | |
| *** dmk0202 has joined #openstack-keystone | 08:40 | |
| *** mdavidson has quit IRC | 08:41 | |
| *** markvoelker has quit IRC | 08:42 | |
| *** f13o has quit IRC | 08:47 | |
| *** mdavidson has joined #openstack-keystone | 08:50 | |
| *** henrynash has joined #openstack-keystone | 08:53 | |
| *** shuyingya has quit IRC | 08:57 | |
| *** markvoelker has joined #openstack-keystone | 09:00 | |
| *** f13o has joined #openstack-keystone | 09:02 | |
| *** markvoelker has quit IRC | 09:05 | |
| *** zhurong has quit IRC | 09:16 | |
| *** tbh_ has quit IRC | 09:20 | |
| *** zsli_ has quit IRC | 09:25 | |
| *** sjain has quit IRC | 09:26 | |
| *** henrynash has quit IRC | 09:35 | |
| *** Administrator__ has joined #openstack-keystone | 09:37 | |
| *** Administrator_ has quit IRC | 09:40 | |
| *** dmk0202 has quit IRC | 09:40 | |
| *** liujiong has quit IRC | 09:59 | |
| *** ducttape_ has joined #openstack-keystone | 10:02 | |
| *** wasmum has quit IRC | 10:04 | |
| *** ducttape_ has quit IRC | 10:06 | |
| *** wasmum has joined #openstack-keystone | 10:06 | |
| *** wasmum has quit IRC | 10:11 | |
| *** f13o has quit IRC | 10:13 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Return 400 when trying to create trust with ambiguous role name https://review.openstack.org/476451 | 10:16 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Return 400 when trying to create trust with ambiguous role name https://review.openstack.org/476451 | 10:20 |
| *** wasmum has joined #openstack-keystone | 10:22 | |
| *** henrynash has joined #openstack-keystone | 10:26 | |
| *** f13o has joined #openstack-keystone | 10:28 | |
| *** zhurong has joined #openstack-keystone | 10:31 | |
| *** henrynash has quit IRC | 10:35 | |
| *** markvoelker has joined #openstack-keystone | 10:36 | |
| *** henrynash has joined #openstack-keystone | 10:40 | |
| *** markvoelker has quit IRC | 10:41 | |
| *** henrynash has quit IRC | 10:41 | |
| *** markvoelker has joined #openstack-keystone | 10:47 | |
| *** gongysh has quit IRC | 10:47 | |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Migrated docs from devdocs to general docs https://review.openstack.org/476162 | 10:48 |
| *** markvoelker has quit IRC | 10:55 | |
| *** ayoung has quit IRC | 10:57 | |
| *** ayoung has joined #openstack-keystone | 11:00 | |
| *** ebbex has joined #openstack-keystone | 11:00 | |
| ebbex | Does check_revocations_for_cached really only apply to PKI or fernet aswell? (documentation only mentions PKI) | 11:01 |
| *** sjain has joined #openstack-keystone | 11:13 | |
| *** vladiskuz has joined #openstack-keystone | 11:18 | |
| vladiskuz | Hello everybody! What I should use instead pki_setup right now? | 11:19 |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Migrated docs from devdocs to general docs https://review.openstack.org/476162 | 11:29 |
| breton | vladiskuz: you should not use pki at all | 11:34 |
| breton | vladiskuz: pki tokens are deprecated and afaik removed | 11:34 |
| *** sjain has quit IRC | 11:56 | |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Migrated docs from devdocs to user docs https://review.openstack.org/476200 | 11:57 |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Migrated docs from devdocs to operator docs https://review.openstack.org/476209 | 11:57 |
| *** mvk has quit IRC | 11:59 | |
| *** zhurong has quit IRC | 12:01 | |
| *** namnh_ has quit IRC | 12:07 | |
| *** edmondsw has joined #openstack-keystone | 12:10 | |
| *** zhurong has joined #openstack-keystone | 12:16 | |
| *** zhurong has quit IRC | 12:18 | |
| *** henrynash has joined #openstack-keystone | 12:26 | |
| *** chlong has quit IRC | 12:26 | |
| *** gongysh has joined #openstack-keystone | 12:27 | |
| *** mvk has joined #openstack-keystone | 12:29 | |
| *** edmondsw has quit IRC | 12:38 | |
| *** cristicalin has joined #openstack-keystone | 12:43 | |
| *** dave-mccowan has joined #openstack-keystone | 12:43 | |
| *** pooja_jadhav has joined #openstack-keystone | 12:58 | |
| *** f13o has quit IRC | 13:04 | |
| *** lucasxu has joined #openstack-keystone | 13:06 | |
| *** henrynash has quit IRC | 13:10 | |
| *** henrynash has joined #openstack-keystone | 13:11 | |
| *** edmondsw has joined #openstack-keystone | 13:11 | |
| *** henrynash has quit IRC | 13:12 | |
| *** jmlowe has quit IRC | 13:16 | |
| *** bknudson has joined #openstack-keystone | 13:17 | |
| *** f13o has joined #openstack-keystone | 13:18 | |
| *** catintheroof has joined #openstack-keystone | 13:20 | |
| *** markvoelker has joined #openstack-keystone | 13:22 | |
| *** liujiong has joined #openstack-keystone | 13:31 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystone master: WIP: Add project tags https://review.openstack.org/470317 | 13:37 |
| *** chlong has joined #openstack-keystone | 13:39 | |
| *** edmondsw_ has joined #openstack-keystone | 13:40 | |
| *** edmondsw_ has quit IRC | 13:40 | |
| *** raildo has joined #openstack-keystone | 13:49 | |
| *** wasmum has quit IRC | 13:50 | |
| *** markvoelker has quit IRC | 13:53 | |
| *** wasmum has joined #openstack-keystone | 13:53 | |
| *** ducttape_ has joined #openstack-keystone | 14:03 | |
| *** spzala has joined #openstack-keystone | 14:12 | |
| *** liujiong has quit IRC | 14:18 | |
| *** raildo has quit IRC | 14:27 | |
| *** raildo has joined #openstack-keystone | 14:27 | |
| *** jmlowe has joined #openstack-keystone | 14:33 | |
| *** phalmos has joined #openstack-keystone | 14:44 | |
| *** sbezverk has quit IRC | 14:44 | |
| *** links has quit IRC | 14:45 | |
| *** raildo has quit IRC | 14:51 | |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Expanded the best practices subsection in devdocs https://review.openstack.org/476541 | 14:51 |
| *** markvoelker has joined #openstack-keystone | 14:55 | |
| lbragstad | asettle: there is an openstack manuals guide for writing isn't there? | 14:56 |
| *** raildo has joined #openstack-keystone | 14:56 | |
| asettle | lbragstad: contributor guide yo | 14:56 |
| asettle | https://docs.openstack.org/contributor-guide/ | 14:56 |
| asettle | "writign documentation" and 'writing style' | 14:56 |
| lbragstad | fantastic! | 14:57 |
| lbragstad | ebbex: where do you see that? | 14:57 |
| lbragstad | ebbex: yes - that's only applies to PKI tokens, fernet tokens must be validated against the identity service directly | 14:59 |
| ebbex | Is keystone doing something totally different with tokens than the other projects when it comes to caching? tcpdumping the memcache shows "get 8de2523b4c7276ae861e477c4b66018416107d2b", whilst projects like glance have queries like "get tokens/aef1af34ab1d95cefc5ab4fe90af28147b5bc6244df683165cc512b395ef47a7". | 15:00 |
| lbragstad | ebbex: at which point the identity service will check the token against all the revocation events keystone knows about | 15:00 |
| *** bknudson1 has joined #openstack-keystone | 15:00 | |
| morgan | ebbex: keystone does build cache keys differently | 15:00 |
| *** aselius has joined #openstack-keystone | 15:00 | |
| morgan | ebbex: it also caches a LOT of extra data that other services do not | 15:01 |
| morgan | the reason for the tokens/ prefix is largly historical and older implementations (in middleware) | 15:01 |
| morgan | but in short, keystone makes an effort to cache project data, user data, domain data, etc. and the cache keys all look like sha1 hashes (by design) | 15:01 |
| ebbex | ah, so that explains when I do a "token revoke", the other projects still find a "valid" token in memcache..? | 15:02 |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Expanded the best practices subsection in devdocs https://review.openstack.org/476541 | 15:02 |
| morgan | partly | 15:02 |
| morgan | a token revoke was never invalidating caches | 15:02 |
| morgan | the risk with caching is explicitly allowing revoked tokens for the cache window (in middleware) | 15:02 |
| *** bknudson has quit IRC | 15:03 | |
| morgan | keystone doesn't control/know/understand the other services caches | 15:03 |
| morgan | keystone also doesn't use token ids for caching, it does all memoization, so it is based upon the arguments to methods. the cache in middleware is based on the token id | 15:03 |
| ebbex | morgan: but isn't it actually the keystone-middleware that does this for the other projects though? | 15:04 |
| morgan | yes | 15:04 |
| morgan | keystone service/server doesn't know middleware's cache details | 15:04 |
| morgan | keystonemiddleware should probably be renamed to openstack_auth_middleware | 15:05 |
| morgan | it handles authz validation. thats it. | 15:05 |
| ebbex | but it knows its cache key though..? | 15:05 |
| morgan | middleware is run in the processpsace of nova. | 15:05 |
| *** enriquetaso_ has joined #openstack-keystone | 15:05 | |
| morgan | keystone (Server) has no idea what the cache server/details nova is using | 15:06 |
| morgan | you might have different memcache servers because you have multiple regions | 15:06 |
| lbragstad | the cache backend the keystone server uses is different from the cache backend the middleware uses | 15:06 |
| *** rcernin has quit IRC | 15:09 | |
| ebbex | lbragstad: https://docs.openstack.org/ocata/config-reference/common-configurations/auth.html, turning check_revocations_for_cached on i see a GET to /v3/auth/tokens/OS-PKI/revoked | 15:10 |
| lbragstad | ebbex: yeah - that's middleware attempting to fetch a list of revoked tokens from keystone | 15:10 |
| ebbex | Wouldn't this also have worked nicely if it wasn't limited to just PKI? | 15:11 |
| lbragstad | ebbex: it worked for PKI because PKI tokens were persisted in the keystone database | 15:11 |
| lbragstad | (like UUID tokens) | 15:11 |
| lbragstad | which made returning a list of revoked tokens easy since keystone knows about the whole set and can reason about it | 15:12 |
| ebbex | Aren't fernet revocations persistent in database aswell? | 15:12 |
| lbragstad | Fernet tokens are completely non-persistent | 15:12 |
| morgan | the revocations are a lot less direct | 15:12 |
| morgan | in fernet | 15:12 |
| ebbex | But not the revocations tho? | 15:12 |
| lbragstad | ebbex: the revocation event is persisted in keystone | 15:13 |
| morgan | yes, they are persisted, but it's not as easy to determine revocations from that data. | 15:13 |
| lbragstad | right | 15:13 |
| morgan | it's an event that says "tokens from time X for user Y and project Z are now revoked" | 15:13 |
| lbragstad | ebbex: with PKI and UUID tokens, we could determine which tokens were revoked based on attributes of the token itself (we actually just flipped a bit in the database when revoking a PKI or UUID token) | 15:14 |
| morgan | even with PKI tokens and token revocation lists, there was often times where cached valid tokens would still work. This has all the same issues as CRLs for SSL certs. | 15:14 |
| lbragstad | but - the trade of is that you have a *massive* token table | 15:14 |
| morgan | and ^^ what lbragstad said | 15:14 |
| ebbex | morgan: But there's code already present to validate those things right? (if a fernet token is revoked or not) | 15:14 |
| morgan | right, but only if you actively ask keystone | 15:14 |
| morgan | keystone has to decode the token | 15:15 |
| lbragstad | and rebuild the authorization context | 15:15 |
| morgan | the token content itself is very stubby and is AES encrypted | 15:15 |
| lbragstad | from there - keystone compares the values of the token to all revocation events it knows about | 15:15 |
| morgan | nova (and keystonemiddleware) cannot decode it. only keystone server can | 15:15 |
| lbragstad | the revocation system in keystone comes up with an answer saying either "this token is revoked" or "this token is valid" | 15:15 |
| lbragstad | oh- right | 15:16 |
| lbragstad | yeah - we're using symmetric encryption to protect the data within the token | 15:16 |
| ebbex | We just see 404 not found when using revoked tokens... | 15:16 |
| morgan | correct, because tokens are (at least in v2, they were) a resource in REST | 15:18 |
| morgan | auth/tokens/token_id | 15:18 |
| morgan | a 404 would be correct if it was invalid. | 15:18 |
| morgan | in v3... it is different, but likely historically still 404s (ugh) | 15:18 |
| lbragstad | https://github.com/openstack/keystone/blob/6b24ba507c2a001e2b95ee598e0f0f5b66c11bff/keystone/revoke/core.py#L167-L169 | 15:18 |
| *** f13o has quit IRC | 15:19 | |
| *** tobberyd_ has joined #openstack-keystone | 15:19 | |
| lbragstad | the values of a token are passed in and if the revocation api detects an event that matches the values of that token in some way, it throws a 404 | 15:19 |
| ebbex | Ok, thanks for clarifying. | 15:20 |
| morgan | ebbex: sure thing | 15:20 |
| lbragstad | ebbex: anytime | 15:21 |
| lbragstad | ebbex: hopefully that cleared some stuff up | 15:21 |
| *** tobberydberg has quit IRC | 15:22 | |
| *** tobberyd_ has quit IRC | 15:23 | |
| ebbex | So I suppose the weirdest case we were troubleshooting was that we're querying nova, which queries neutron, neutron does a check for auth/subjet token, (meanwhile, we've changed the password for nova) so the token is revoked. Keystone sends 404 to neutron, and neutron sends 401 to nova. But nova doesn't seem to understand that it's token is revoked. And just tries using it again and again, to the same errors/effect. | 15:23 |
| *** raildo has quit IRC | 15:26 | |
| *** raildo has joined #openstack-keystone | 15:28 | |
| knikolla | o/ | 15:28 |
| morgan | ebbex: nova should give up and error after a few attempts | 15:29 |
| morgan | and pass the error back up to the user. | 15:29 |
| morgan | indicating 401, token invalid | 15:29 |
| morgan | long term we're trying to address this kind of thing with a few initiatives | 15:29 |
| *** raildo has quit IRC | 15:29 | |
| morgan | some of which are things like allowing neutron (since nova accepted the token) to know it's a service-to-service request and use a "?invalid_ok" validation | 15:30 |
| lbragstad | ideally - only validating the user token at the edge of the operation | 15:30 |
| lbragstad | and allowing service-to-service trust to happen | 15:30 |
| *** raildo has joined #openstack-keystone | 15:30 | |
| morgan | ++ | 15:34 |
| *** raildo has quit IRC | 15:35 | |
| *** jmlowe_ has joined #openstack-keystone | 15:36 | |
| *** jmlowe has quit IRC | 15:38 | |
| knikolla | FYI that I'll be UTC+2 for the next 3 weeks. | 15:42 |
| *** pcaruana has quit IRC | 15:42 | |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Reorganised developer documentation https://review.openstack.org/476606 | 15:43 |
| *** gyee has joined #openstack-keystone | 15:46 | |
| *** bknudson1 has quit IRC | 15:49 | |
| lbragstad | fwiw - once https://review.openstack.org/#/c/469515/2 merges we can really start working on removing duplicate documentation from our devref | 15:50 |
| *** bknudson has joined #openstack-keystone | 15:53 | |
| *** rderose has joined #openstack-keystone | 15:55 | |
| lbragstad | samueldmq: is sjain around? | 15:57 |
| *** cristicalin has quit IRC | 16:00 | |
| lbragstad | stepping out to get a run in over lunch | 16:02 |
| *** tobberydberg has joined #openstack-keystone | 16:03 | |
| *** gongysh has quit IRC | 16:05 | |
| *** raildo has joined #openstack-keystone | 16:06 | |
| *** tobberydberg has quit IRC | 16:08 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Return 400 when trying to create trust with ambiguous role name https://review.openstack.org/476451 | 16:25 |
| *** thorst has joined #openstack-keystone | 16:44 | |
| *** raildo has quit IRC | 16:48 | |
| *** raildo has joined #openstack-keystone | 16:48 | |
| samueldmq | lbragstad: I don't think so | 16:52 |
| samueldmq | anything I can help with? | 16:52 |
| *** eandersson has quit IRC | 16:54 | |
| *** thorst has quit IRC | 16:57 | |
| *** thorst has joined #openstack-keystone | 16:57 | |
| *** hyakuhei has quit IRC | 17:00 | |
| *** hyakuhei has joined #openstack-keystone | 17:00 | |
| *** hyakuhei has quit IRC | 17:00 | |
| *** hyakuhei has joined #openstack-keystone | 17:00 | |
| *** tobberydberg has joined #openstack-keystone | 17:00 | |
| *** thorst_ has joined #openstack-keystone | 17:00 | |
| *** thorst has quit IRC | 17:02 | |
| *** thorst_ has quit IRC | 17:05 | |
| *** sjain has joined #openstack-keystone | 17:06 | |
| *** mvk has quit IRC | 17:06 | |
| sjain | @lbragstad, samueldmq: Hi, I'm here now, you needed to discuss anything? | 17:07 |
| *** mvk has joined #openstack-keystone | 17:08 | |
| *** tobberydberg has quit IRC | 17:09 | |
| *** tobberydberg has joined #openstack-keystone | 17:10 | |
| *** ducttape_ has quit IRC | 17:13 | |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Added new subsections to developer docs https://review.openstack.org/476635 | 17:14 |
| *** tobberydberg has quit IRC | 17:14 | |
| *** eandersson has joined #openstack-keystone | 17:16 | |
| *** thorst has joined #openstack-keystone | 17:20 | |
| lbragstad | samueldmq: sjain i started noticing just how much duplication we have across the various guides and devref | 17:23 |
| lbragstad | i was also wondering if the chain (starting at https://review.openstack.org/#/c/466066/11 ) needs to be in a series or if they can start being working in parallel? | 17:24 |
| *** mvk has quit IRC | 17:24 | |
| lbragstad | updating the theme seems like the logical first step - but do the rest need to be in a series? | 17:24 |
| sjain | there is even more with config guides I guess | 17:24 |
| sjain | yes, saw your comments | 17:24 |
| *** thorst has quit IRC | 17:24 | |
| openstackgerrit | Merged openstack/keystone master: Updated the keystone docs to follow the docs theme https://review.openstack.org/466066 | 17:25 |
| lbragstad | woo! ^ | 17:25 |
| lbragstad | speaking of docs | 17:25 |
| sjain | the other steps are after the reorganising in 4 categories | 17:25 |
| sjain | thank God this is merged! | 17:25 |
| lbragstad | :) | 17:25 |
| sjain | yeah I was saying, that chain has different docs from dev docs shifted to other 3 categories | 17:26 |
| sjain | and then reorganising dev docs internally | 17:27 |
| lbragstad | got it | 17:27 |
| lbragstad | we might be able to work some of those changes in parallel | 17:27 |
| sjain | last parts could have been done in parallel, but I have already finished those :P | 17:27 |
| lbragstad | which should hopefully get them moving a bit faster | 17:27 |
| samueldmq | lbragstad: ++ | 17:27 |
| sjain | they are very small changes | 17:27 |
| lbragstad | sjain: oh - sure, i mean proposing them in parallel | 17:28 |
| lbragstad | instead of having them dependent on each other | 17:28 |
| sjain | can it be done now btw? | 17:28 |
| samueldmq | I asked sjain to do some of those in a chain so that she gets to learn how amazing it is to maintain patches in a chain | 17:28 |
| samueldmq | :-) | 17:28 |
| lbragstad | ahh | 17:28 |
| sjain | yeah I struggled at first but now I'm fine working on them in chains | 17:29 |
| lbragstad | ok | 17:29 |
| sjain | samueldmq, all the 6 patches I have uploaded | 17:29 |
| samueldmq | lbragstad: what if we keep those in a chain but decide better for follow-ups | 17:29 |
| samueldmq | lbragstad: those should be really easy to get it, mostly moving things around | 17:30 |
| lbragstad | samueldmq: yeah - that should be fine | 17:30 |
| samueldmq | nice | 17:30 |
| lbragstad | let's get everything moved over, then start tracking works for fixing the duplication | 17:31 |
| sjain | lbragstad gave some reviews on the reorganised docs patch, should I address those on same patch or a separate review? | 17:31 |
| lbragstad | (there is so much of it) | 17:31 |
| samueldmq | sjain: lbragstad I will review all those later today | 17:31 |
| samueldmq | lbragstad: perfect | 17:31 |
| sjain | :) | 17:31 |
| samueldmq | lbragstad: duplication of what we have VS what we're migrating, correct? | 17:31 |
| lbragstad | sjain: which patch are you referencing? | 17:31 |
| sjain | just a sec | 17:32 |
| samueldmq | lbragstad: are you documentign the duplicaitons you're seeing somewhere? it'd be nice if we got a list and assignees | 17:32 |
| lbragstad | samueldmq: yeah - for example we have a section that describes caching in keystone in devref, but the admin-guide also has one | 17:32 |
| sjain | this, https://review.openstack.org/#/c/475119/ | 17:32 |
| samueldmq | docs are going to get in a great shape :) | 17:32 |
| lbragstad | this probably goes without saying, but i doubt it makes sense to have two separate sections on caching | 17:32 |
| lbragstad | sjain: my comment here can be addressed later https://review.openstack.org/#/c/475119/6/doc/source/getting-started/apache-httpd.rst,unified | 17:33 |
| lbragstad | addressing these two now might not be a bad idea - https://review.openstack.org/#/c/475119/6/doc/source/index.rst | 17:34 |
| lbragstad | and this one, too https://review.openstack.org/#/c/475119/6/doc/source/related_projects.rst | 17:34 |
| lbragstad | once we merge that we can refactor the duplication | 17:34 |
| sjain | okay I'll have a look at those | 17:34 |
| lbragstad | sjain: thanks | 17:35 |
| sjain | :) | 17:35 |
| samueldmq | lbragstad: I hear what you say in 475119 | 17:36 |
| samueldmq | https://review.openstack.org/#/c/475119/ | 17:36 |
| lbragstad | which part? | 17:36 |
| samueldmq | I think renaming developer to contributor makes sense | 17:36 |
| lbragstad | yeah - it sounds like keystone is going to be inheriting "developer" documentation from the openstack manuals repo | 17:37 |
| samueldmq | lbragstad: what if we get that in and rename in a follow-on ? | 17:37 |
| lbragstad | "developer" as in someone developing applications on top of keystone or openstack | 17:37 |
| lbragstad | which is different than keystone "developer" or contributor | 17:37 |
| samueldmq | the others following it should be easy to merge | 17:37 |
| samueldmq | and we reduce the burden of maintaining that chain for sjain | 17:37 |
| lbragstad | samueldmq: yeah - we can fast follow it | 17:38 |
| samueldmq | yes I asked her to do that, good experience | 17:38 |
| samueldmq | lbragstad: ++ | 17:38 |
| samueldmq | lbragstad: +2 from me. | 17:38 |
| sjain | thank you so much :P | 17:38 |
| lbragstad | sjain: thanks for the patches | 17:39 |
| sjain | no problem :) | 17:39 |
| lbragstad | sjain: i'd like to get to a point where we can have multiple folks cleaning things up at once | 17:39 |
| sjain | yeah I understand, thats why for openstack-manuals I was trying to work in parallel | 17:41 |
| *** ducttape_ has joined #openstack-keystone | 17:46 | |
| samueldmq | sjain: wow the docs are rendering really greatly at the end of the chain | 17:46 |
| samueldmq | I will take a more detailed look later today, checking against that etherpad we had | 17:47 |
| openstackgerrit | Jaewoo Park proposed openstack/keystone master: WIP: Add project tags https://review.openstack.org/470317 | 17:47 |
| *** mvk has joined #openstack-keystone | 17:53 | |
| knikolla | https://review.openstack.org/#/c/476451/ | 17:54 |
| sjain | sure samueldmq, I have added 1-2 comments in that etherpad too related to the changes | 17:54 |
| knikolla | lbragstad: for ^^ didn't know what to call the error and called it AmbiguityError | 17:54 |
| lbragstad | knikolla: checking | 17:55 |
| lbragstad | knikolla: yeah - i think that makes sense | 17:57 |
| lbragstad | knikolla: reviewed | 17:57 |
| *** sjain has quit IRC | 17:59 | |
| *** tesseract has quit IRC | 17:59 | |
| knikolla | lbragstad: going to answer here since gerrit is dreadful on an ipad. Yes, only possible when a global role conflicts with a domain one. Or two domain ones. | 17:59 |
| openstackgerrit | Jaewoo Park proposed openstack/keystone master: WIP: Add project tags https://review.openstack.org/470317 | 18:01 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Return 400 when trying to create trust with ambiguous role name https://review.openstack.org/476451 | 18:04 |
| knikolla | My patches come from the future now https://i.imgur.com/3k1pbjh_d.jpg?maxwidth=640 | 18:08 |
| lbragstad | knikolla: looks like you got yourself one of those fancy time machines | 18:09 |
| knikolla | lbragstad: too bad it can only send patches to the future and not to the past. Haha | 18:11 |
| lbragstad | knikolla: ++ | 18:11 |
| knikolla | lbragstad: thanks for the superquick review! | 18:12 |
| lbragstad | knikolla: no problem | 18:12 |
| *** raildo has quit IRC | 18:16 | |
| morgan | hmm | 18:22 |
| morgan | knikolla, lbragstad: +2, just waiting for CI before +A | 18:23 |
| *** thorst has joined #openstack-keystone | 18:23 | |
| *** thorst has quit IRC | 18:27 | |
| lbragstad | morgan: thanks | 18:34 |
| lbragstad | knikolla: actually - do you have a release note for that bug yet? | 18:35 |
| *** thorst has joined #openstack-keystone | 18:35 | |
| lbragstad | knikolla: it might be good to amend https://review.openstack.org/#/c/476451/ with a release note so that it gets generated when keystone is released | 18:35 |
| *** gus has quit IRC | 18:38 | |
| *** henrynash has joined #openstack-keystone | 18:38 | |
| *** thorst has quit IRC | 18:40 | |
| *** gus has joined #openstack-keystone | 18:40 | |
| knikolla | lbragstad: will add one | 18:47 |
| lbragstad | knikolla: that'd be great, thanks! | 18:47 |
| *** henrynash has quit IRC | 18:49 | |
| *** thorst has joined #openstack-keystone | 18:50 | |
| lbragstad | samueldmq: cmurphy want to give this a review? https://review.openstack.org/#/c/449244/ | 18:52 |
| lbragstad | morgan: thoughts on the comments here? https://review.openstack.org/#/c/449255/7/keystone/common/policies/token_revocation.py | 18:53 |
| *** nicolasbock has quit IRC | 18:54 | |
| *** thorst has quit IRC | 18:54 | |
| *** henrynash has joined #openstack-keystone | 18:56 | |
| morgan | lbragstad: commented | 19:00 |
| morgan | basically | 19:00 |
| morgan | we can't remove APIs | 19:00 |
| morgan | we can make them return an empty list | 19:01 |
| morgan | in this case | 19:01 |
| lbragstad | morgan: what about cmurphy's comment about backwards compatibility? | 19:01 |
| morgan | an empty list is compatibler | 19:01 |
| morgan | compatible* | 19:01 |
| lbragstad | is a change backwards incompatible if there is a a change in logic? | 19:01 |
| morgan | the change is not backwards incompatible if a response is valid | 19:02 |
| morgan | aka, pki tokens disappearing, if the revocation list is empty, that is a valid response | 19:02 |
| morgan | but it would be invalid to make that api result in a 404 | 19:02 |
| lbragstad | so the only way that change is valid is because we don't support pki anymore | 19:02 |
| morgan | correct | 19:03 |
| morgan | but the API must still work as expected | 19:03 |
| lbragstad | since it's impossible to use pki tokens with that version of keystone (outside of rolling your own) that's a valid change since it's just returning an empty list | 19:03 |
| morgan | yes. | 19:03 |
| lbragstad | got it | 19:03 |
| lbragstad | thanks morgan, that makes sense | 19:03 |
| morgan | now that said, pki tokens aren't an API | 19:03 |
| morgan | so we could remove PKI tokens | 19:04 |
| morgan | it doesn't impact an api anyone using keystone | 19:04 |
| *** henrynash has quit IRC | 19:04 | |
| morgan | but rev list was an actual GET api | 19:05 |
| openstackgerrit | Merged openstack/keystone master: Reorganised keystone documentation structure https://review.openstack.org/475119 | 19:05 |
| lbragstad | morgan: right | 19:06 |
| *** ducttap__ has joined #openstack-keystone | 19:22 | |
| *** ducttape_ has quit IRC | 19:25 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move ec2 credential policies to DocumentedRuleDefault https://review.openstack.org/449235 | 19:25 |
| lbragstad | samueldmq: hrybacki ^ updated | 19:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move ec2 credential policies to DocumentedRuleDefault https://review.openstack.org/449235 | 19:26 |
| *** eandersson has quit IRC | 19:38 | |
| *** eandersson has joined #openstack-keystone | 19:38 | |
| *** thorst has joined #openstack-keystone | 19:40 | |
| *** thorst has quit IRC | 19:44 | |
| *** rderose has quit IRC | 19:44 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move related project information into main doc https://review.openstack.org/476675 | 19:45 |
| lbragstad | samueldmq: ^ | 19:46 |
| *** thorst has joined #openstack-keystone | 19:46 | |
| *** thorst has quit IRC | 19:50 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Gear documentation towards a wider audience https://review.openstack.org/476676 | 19:53 |
| *** rderose has joined #openstack-keystone | 19:57 | |
| lbragstad | morgan: quick question - it looks like admin_token_auth has been competely removed | 20:00 |
| morgan | hm | 20:00 |
| morgan | uh | 20:00 |
| morgan | maybe | 20:00 |
| lbragstad | morgan: is there anything stopping us from removing http://192.168.122.160/doc/build/html/configuration.html#bootstrapping-keystone-with-admin-token | 20:00 |
| morgan | sec | 20:00 |
| lbragstad | sure | 20:00 |
| morgan | well | 20:00 |
| morgan | we merged the functionality from the admin token middleware into the auth_context middleware | 20:01 |
| morgan | so... we can remove it | 20:01 |
| morgan | but the base functionality wont go away | 20:01 |
| morgan | (remove the docs that is) | 20:01 |
| morgan | everyone should use bootstrap. | 20:01 |
| lbragstad | https://github.com/openstack/keystone/blob/f992b1ce42d6d553146f538f7874fa40f1934cd8/keystone/middleware/core.py#L59-L71 | 20:01 |
| lbragstad | looks like we won't remove that until queens opens for development | 20:01 |
| morgan | yah | 20:02 |
| lbragstad | ok | 20:02 |
| morgan | and that is just a stub | 20:02 |
| *** sbezverk has joined #openstack-keystone | 20:02 | |
| morgan | so we don't break people's paste pipelines | 20:02 |
| lbragstad | right | 20:02 |
| morgan | again auth_token functionality is still in auth_context middleware | 20:02 |
| morgan | auth...admin token | 20:02 |
| morgan | ... bah, you know what i mean | 20:03 |
| lbragstad | oh - so it's still possible? | 20:03 |
| morgan | yes you can still use admin token | 20:03 |
| lbragstad | ah.... https://github.com/openstack/keystone/blob/f992b1ce42d6d553146f538f7874fa40f1934cd8/keystone/middleware/auth.py#L145 | 20:03 |
| morgan | https://github.com/openstack/keystone/blob/master/keystone/middleware/auth.py#L145-L153 | 20:04 |
| morgan | yeah | 20:04 |
| lbragstad | morgan: do we still need to keep the cerificate stuff around? https://docs.openstack.org/developer/keystone/configuration.html#certificates-for-pki | 20:05 |
| lbragstad | the certificates were suppose to stick around because of the revocation list API, right? | 20:05 |
| morgan | don't think so | 20:05 |
| lbragstad | ok | 20:05 |
| morgan | but... i dunno | 20:05 |
| lbragstad | I'll propose a patch to remove that since I don't think we need it anymore | 20:05 |
| *** phalmos has quit IRC | 20:06 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove PKI certificate documentation https://review.openstack.org/476688 | 20:09 |
| *** jrist has quit IRC | 20:09 | |
| *** jrist has joined #openstack-keystone | 20:17 | |
| openstackgerrit | Merged openstack/keystone master: Check log output rather than emitting in tests https://review.openstack.org/475460 | 20:18 |
| *** rderose has quit IRC | 20:26 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystone master: WIP: Add project tags https://review.openstack.org/470317 | 20:29 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Prep for is_admin_project for scoped operations https://review.openstack.org/462670 | 20:41 |
| *** jmlowe_ has quit IRC | 20:41 | |
| *** lucasxu has quit IRC | 20:49 | |
| *** ducttape_ has joined #openstack-keystone | 20:50 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add history behind why keystone has two ports https://review.openstack.org/476703 | 20:51 |
| *** enriquetaso_ has quit IRC | 20:51 | |
| *** ducttap__ has quit IRC | 20:53 | |
| cmurphy | morgan: lbragstad what happened to these other os-pki actions? https://review.openstack.org/#/c/449255/7/keystone/common/policies/token_revocation.py didn't removing those break the API? | 21:00 |
| *** thorst has joined #openstack-keystone | 21:04 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Split test_get_head_catalog_no_token https://review.openstack.org/476710 | 21:08 |
| cmurphy | lbragstad: ^ | 21:08 |
| morgan | v2? | 21:12 |
| morgan | i dunno. | 21:12 |
| *** edmondsw has quit IRC | 21:13 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Split test_get_head_catalog_no_token https://review.openstack.org/476710 | 21:16 |
| *** edmondsw has joined #openstack-keystone | 21:16 | |
| *** catintheroof has quit IRC | 21:18 | |
| lbragstad | cmurphy: those were just moved into a different module = https://review.openstack.org/#/c/449255/7/keystone/common/policies/token.py | 21:20 |
| *** edmondsw has quit IRC | 21:21 | |
| lbragstad | they were specific to the os-pki bits, and they weren't specifically token_revocation APIs | 21:21 |
| lbragstad | just general token authentication and validation APIs | 21:21 |
| lbragstad | i thought having them in a separate module that didn't group them with "revocation" would be easier | 21:22 |
| cmurphy | lbragstad: yeah i realized that after i asked, but i'm still wondering what happened to reduce https://developer.openstack.org/api-ref/identity/v3/index.html#os-pki-api to just one GET, it probably used to have more features? | 21:23 |
| lbragstad | cmurphy: i don't think it did - i'm pretty sure it was only for getting revoked PKI tokens | 21:24 |
| * lbragstad goes to dig in old code | 21:24 | |
| cmurphy | ah okay | 21:25 |
| cmurphy | i'll believe you | 21:25 |
| lbragstad | i think it was for middleware to get a list of revoked tokens so that it could do offline validation easier? | 21:25 |
| lbragstad | but - then again, that doesn't make sense to me | 21:25 |
| lbragstad | and seems counter-intuitive to doing offline validation anyway | 21:25 |
| lbragstad | cmurphy: this is mitaka - https://github.com/openstack/keystone/blob/stable/mitaka/keystone/auth/routers.py#L34-L39 | 21:27 |
| openstackgerrit | Merged openstack/keystone master: Move grant policies to DocumentedRuleDefault https://review.openstack.org/449244 | 21:35 |
| knikolla | Any patch i can review to help me get sleepy despite jetlag? :P | 21:38 |
| *** sbezverk has quit IRC | 21:39 | |
| lbragstad | knikolla: https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:bug/1696574 | 21:39 |
| lbragstad | knikolla: or any of https://review.openstack.org/#/q/owner:j.samriddhi13%2540gmail.com+status:open | 21:39 |
| openstackgerrit | Merged openstack/keystone master: Return 400 when trying to create trust with ambiguous role name https://review.openstack.org/476451 | 21:41 |
| knikolla | lbragstad: sure. I believe i have already reviewed all of HEAD previously. Will check if there's newer patches/sets. | 21:41 |
| knikolla | And with that merging one bug is closed :) | 21:42 |
| knikolla | ^^ | 21:42 |
| knikolla | Another hundred to go. | 21:42 |
| gagehugo | knikolla \o/ | 21:46 |
| *** thorst has quit IRC | 21:47 | |
| knikolla | Now if only I could make commenting in gerrit work from ipad I'd be happy. | 21:47 |
| *** spzala has quit IRC | 21:55 | |
| *** spzala has joined #openstack-keystone | 21:56 | |
| *** spzala has quit IRC | 21:56 | |
| *** spzala has joined #openstack-keystone | 21:56 | |
| *** chlong has quit IRC | 21:57 | |
| openstackgerrit | Merged openstack/python-keystoneclient master: Add support for endpoint group filtering https://review.openstack.org/182658 | 22:02 |
| openstackgerrit | Merged openstack/keystone master: Add HEAD API to auth https://review.openstack.org/472881 | 22:03 |
| *** dave-mccowan has quit IRC | 22:15 | |
| *** bknudson has quit IRC | 22:18 | |
| *** henrynash has joined #openstack-keystone | 22:36 | |
| *** adriant has quit IRC | 22:39 | |
| *** adriant has joined #openstack-keystone | 22:39 | |
| *** edmondsw has joined #openstack-keystone | 22:49 | |
| *** spzala has quit IRC | 22:49 | |
| *** thorst has joined #openstack-keystone | 22:52 | |
| *** phalmos has joined #openstack-keystone | 22:56 | |
| *** henrynash has quit IRC | 22:56 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Split test_get_head_catalog_no_token https://review.openstack.org/476710 | 22:57 |
| *** ducttape_ has quit IRC | 23:07 | |
| *** raildo has joined #openstack-keystone | 23:08 | |
| *** thorst has quit IRC | 23:09 | |
| *** chlong has joined #openstack-keystone | 23:10 | |
| *** raildo has quit IRC | 23:12 | |
| *** raildo has joined #openstack-keystone | 23:12 | |
| *** raildo has quit IRC | 23:20 | |
| *** gongysh has joined #openstack-keystone | 23:31 | |
| *** gongysh has quit IRC | 23:33 | |
| *** gongysh has joined #openstack-keystone | 23:37 | |
| *** gongysh has quit IRC | 23:38 | |
| *** aloga has quit IRC | 23:43 | |
| *** aloga has joined #openstack-keystone | 23:45 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!
