| *** hoonetorg has joined #openstack-keystone | 00:03 | |
| *** gagehugo has quit IRC | 00:20 | |
| *** gagehugo has joined #openstack-keystone | 00:23 | |
| *** zhurong has joined #openstack-keystone | 00:41 | |
| *** thorst has quit IRC | 00:43 | |
| *** ayoung has joined #openstack-keystone | 00:44 | |
| *** tobberyd_ has quit IRC | 00:50 | |
| *** tobberydberg has joined #openstack-keystone | 00:51 | |
| *** tobberydberg has quit IRC | 00:56 | |
| *** liujiong has joined #openstack-keystone | 01:24 | |
| *** ducttape_ has joined #openstack-keystone | 01:32 | |
| *** ducttape_ has quit IRC | 01:37 | |
| *** ducttape_ has joined #openstack-keystone | 01:42 | |
| *** ducttape_ has quit IRC | 01:46 | |
| *** ducttape_ has joined #openstack-keystone | 01:49 | |
| *** ducttape_ has quit IRC | 01:54 | |
| *** gyee has quit IRC | 01:58 | |
| *** edmondsw has joined #openstack-keystone | 02:38 | |
| *** edmondsw has quit IRC | 02:39 | |
| *** thorst has joined #openstack-keystone | 02:44 | |
| *** thorst has quit IRC | 02:49 | |
| *** Shunli has joined #openstack-keystone | 02:49 | |
| *** ducttape_ has joined #openstack-keystone | 02:49 | |
| *** dave-mccowan has quit IRC | 02:53 | |
| *** ducttape_ has quit IRC | 02:54 | |
| *** xuhaigang has quit IRC | 03:05 | |
| *** aojea has joined #openstack-keystone | 03:10 | |
| *** aojea has quit IRC | 03:15 | |
| *** xuhaigang has joined #openstack-keystone | 03:18 | |
| *** d0ugal has quit IRC | 03:19 | |
| *** d0ugal_ has joined #openstack-keystone | 03:19 | |
| *** markvoelker has quit IRC | 03:26 | |
| *** markvoelker has joined #openstack-keystone | 03:26 | |
| *** xuhaigang has quit IRC | 03:30 | |
| *** markvoelker has quit IRC | 03:30 | |
| *** edmondsw has joined #openstack-keystone | 03:41 | |
| *** xuhaigang has joined #openstack-keystone | 03:42 | |
| *** aselius has quit IRC | 03:43 | |
| *** edmondsw has quit IRC | 03:46 | |
| *** links has joined #openstack-keystone | 04:05 | |
| openstackgerrit | Merged openstack/python-keystoneclient master: Switch from oslosphinx to openstackdocstheme https://review.openstack.org/479270 | 04:06 |
|---|---|---|
| *** Nakato has quit IRC | 04:09 | |
| *** Nakato has joined #openstack-keystone | 04:10 | |
| *** thorst has joined #openstack-keystone | 04:45 | |
| *** iurygregory has quit IRC | 04:47 | |
| *** iurygregory has joined #openstack-keystone | 04:48 | |
| *** thorst has quit IRC | 04:51 | |
| *** Shunli has quit IRC | 05:08 | |
| *** andymccr_ has joined #openstack-keystone | 05:11 | |
| *** lamt- has joined #openstack-keystone | 05:14 | |
| *** frickler_ has joined #openstack-keystone | 05:15 | |
| *** harlowja has quit IRC | 05:22 | |
| *** andymccr has quit IRC | 05:22 | |
| *** lamt has quit IRC | 05:22 | |
| *** frickler has quit IRC | 05:22 | |
| *** lamt- is now known as lamt | 05:22 | |
| *** lamt is now known as Guest46457 | 05:22 | |
| *** Krenair has quit IRC | 05:24 | |
| *** markvoelker has joined #openstack-keystone | 05:27 | |
| *** edmondsw has joined #openstack-keystone | 05:29 | |
| *** Krenair has joined #openstack-keystone | 05:31 | |
| *** edmondsw has quit IRC | 05:33 | |
| *** aojea has joined #openstack-keystone | 05:36 | |
| *** dgonzalez has quit IRC | 05:44 | |
| *** dgonzalez has joined #openstack-keystone | 05:46 | |
| *** Shunli has joined #openstack-keystone | 05:46 | |
| openstackgerrit | Merged openstack/keystoneauth master: Optimize the link address https://review.openstack.org/473745 | 05:54 |
| *** rcernin has joined #openstack-keystone | 05:59 | |
| *** markvoelker has quit IRC | 06:00 | |
| *** baffle has quit IRC | 06:03 | |
| *** baffle has joined #openstack-keystone | 06:03 | |
| *** rcernin has quit IRC | 06:04 | |
| *** Guest46457 has quit IRC | 06:08 | |
| *** lamt has joined #openstack-keystone | 06:08 | |
| *** tobberydberg has joined #openstack-keystone | 06:11 | |
| *** aselius has joined #openstack-keystone | 06:16 | |
| *** johnthetubaguy has quit IRC | 06:21 | |
| *** rha has quit IRC | 06:24 | |
| *** Shunli has quit IRC | 06:24 | |
| *** rha has joined #openstack-keystone | 06:26 | |
| *** johnthetubaguy has joined #openstack-keystone | 06:27 | |
| openstackgerrit | Merged openstack/python-keystoneclient master: Bring back intersphinx reference to keystoneauth https://review.openstack.org/480465 | 06:40 |
| *** thorst has joined #openstack-keystone | 06:46 | |
| *** thorst has quit IRC | 06:52 | |
| *** tobberydberg has quit IRC | 06:54 | |
| *** tobberydberg has joined #openstack-keystone | 06:55 | |
| *** markvoelker has joined #openstack-keystone | 06:58 | |
| *** belmoreira has joined #openstack-keystone | 06:59 | |
| *** tobberydberg has quit IRC | 06:59 | |
| *** tesseract has joined #openstack-keystone | 07:04 | |
| *** tesseract-RH has joined #openstack-keystone | 07:04 | |
| *** tesseract has quit IRC | 07:04 | |
| *** tesseract-RH has quit IRC | 07:04 | |
| *** tesseract has joined #openstack-keystone | 07:05 | |
| *** vladiskuz has quit IRC | 07:17 | |
| *** tobberydberg has joined #openstack-keystone | 07:17 | |
| *** edmondsw has joined #openstack-keystone | 07:17 | |
| *** edmondsw has quit IRC | 07:21 | |
| *** tobberyd_ has joined #openstack-keystone | 07:28 | |
| *** markvoelker has quit IRC | 07:30 | |
| *** tobberydberg has quit IRC | 07:31 | |
| *** frickler_ is now known as frickler | 07:44 | |
| *** d0ugal_ has quit IRC | 07:46 | |
| *** d0ugal has joined #openstack-keystone | 07:46 | |
| *** d0ugal has quit IRC | 07:46 | |
| *** d0ugal has joined #openstack-keystone | 07:46 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:01 | |
| *** toddnni has quit IRC | 08:09 | |
| *** toddnni has joined #openstack-keystone | 08:10 | |
| *** aselius has quit IRC | 08:23 | |
| *** markvoelker has joined #openstack-keystone | 08:27 | |
| *** zhurong has quit IRC | 08:32 | |
| *** zhurong has joined #openstack-keystone | 08:39 | |
| *** thorst has joined #openstack-keystone | 08:48 | |
| *** toddnni has left #openstack-keystone | 08:50 | |
| *** toddnni has joined #openstack-keystone | 08:53 | |
| *** thorst has quit IRC | 08:53 | |
| *** markvoelker has quit IRC | 09:02 | |
| openstackgerrit | zhengliuyang proposed openstack/keystone master: A simple fix about explicit unscoped string https://review.openstack.org/471557 | 09:03 |
| *** andymccr_ is now known as andymccr | 09:11 | |
| *** toddnni has left #openstack-keystone | 09:14 | |
| *** toddnni has joined #openstack-keystone | 09:15 | |
| *** thorst has joined #openstack-keystone | 09:49 | |
| *** thorst has quit IRC | 09:54 | |
| *** markvoelker has joined #openstack-keystone | 09:59 | |
| *** toddnni has left #openstack-keystone | 10:03 | |
| *** toddnni has quit IRC | 10:04 | |
| *** toddnni has joined #openstack-keystone | 10:04 | |
| *** liujiong has quit IRC | 10:22 | |
| *** liujiong has joined #openstack-keystone | 10:23 | |
| *** markvoelker has quit IRC | 10:32 | |
| openstackgerrit | zhengliuyang proposed openstack/keystone master: Confusing log messages in project hierarchy checking https://review.openstack.org/480967 | 10:34 |
| *** liujiong has quit IRC | 10:42 | |
| *** edmondsw has joined #openstack-keystone | 10:53 | |
| *** edmondsw has quit IRC | 10:58 | |
| *** markvoelker has joined #openstack-keystone | 11:02 | |
| *** liujiong has joined #openstack-keystone | 11:06 | |
| *** thorst has joined #openstack-keystone | 11:12 | |
| *** thorst has quit IRC | 11:13 | |
| breton | /win 23 | 11:14 |
| breton | :( | 11:14 |
| *** thorst has joined #openstack-keystone | 11:18 | |
| *** thorst_ has joined #openstack-keystone | 11:19 | |
| *** thorst has quit IRC | 11:22 | |
| *** ducttape_ has joined #openstack-keystone | 11:41 | |
| *** sjain has joined #openstack-keystone | 11:43 | |
| *** thorst_ has quit IRC | 11:44 | |
| sjain | asettle: Hi, have the docs been shifted again? This link https://docs.openstack.org/keystone/latest/, is giving internal server error | 11:44 |
| *** ducttape_ has quit IRC | 11:46 | |
| *** raildo has joined #openstack-keystone | 11:58 | |
| *** jmlowe has joined #openstack-keystone | 12:08 | |
| *** sjain has quit IRC | 12:10 | |
| *** edmondsw has joined #openstack-keystone | 12:14 | |
| *** jmlowe has quit IRC | 12:16 | |
| *** chlong_ has joined #openstack-keystone | 12:37 | |
| samueldmq | morning keystone | 12:44 |
| *** jmlowe has joined #openstack-keystone | 12:56 | |
| openstackgerrit | Dmitry Stepanenko proposed openstack/keystone master: [WIP]: Fix keystone entities duplication error https://review.openstack.org/481020 | 12:59 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone master: Fixing flushing tokens workflow https://review.openstack.org/480287 | 13:02 |
| *** jsavak has joined #openstack-keystone | 13:03 | |
| *** lucasxu has joined #openstack-keystone | 13:19 | |
| *** zhurong has quit IRC | 13:22 | |
| *** ducttape_ has joined #openstack-keystone | 13:23 | |
| *** catintheroof has joined #openstack-keystone | 13:25 | |
| *** ducttape_ has quit IRC | 13:27 | |
| *** thorst has joined #openstack-keystone | 13:29 | |
| *** catintheroof has quit IRC | 13:36 | |
| *** ducttape_ has joined #openstack-keystone | 13:37 | |
| *** catintheroof has joined #openstack-keystone | 13:37 | |
| *** bknudson has joined #openstack-keystone | 13:37 | |
| *** ducttape_ has quit IRC | 13:37 | |
| *** ducttape_ has joined #openstack-keystone | 13:38 | |
| *** sjain has joined #openstack-keystone | 13:45 | |
| samueldmq | sjain: morning | 13:59 |
| sjain | Hi samueldmq, good morning! | 13:59 |
| samueldmq | sjain: any luck with setting up the env? | 13:59 |
| sjain | nopes, I cloned a fresh repo, started everything from the beginning, no luck yet | 14:00 |
| sjain | now I'm trying on another machine | 14:00 |
| sjain | lets c how it goes there | 14:00 |
| sjain | I had a look at the sample_data.sh, that has the same commands we were running | 14:01 |
| sjain | ideally it should set up everything :( | 14:02 |
| samueldmq | sjain: forget sample_data for now | 14:03 |
| *** aselius has joined #openstack-keystone | 14:03 | |
| samueldmq | try with bootstrap | 14:03 |
| *** spzala has joined #openstack-keystone | 14:03 | |
| samueldmq | lbragstad sent an email to the ML about removing that sample_data | 14:03 |
| sjain | okay, I tried with bootstrap, it didn't work | 14:04 |
| sjain | is it possible that the bootstrap and openstack command are working fine and the issue is communicating with the server | 14:05 |
| lbragstad | samueldmq: cmurphy brought up a good point about sample_data | 14:05 |
| samueldmq | sjain: ok somehtign is really weird :( | 14:06 |
| *** ducttape_ has quit IRC | 14:11 | |
| *** ducttape_ has joined #openstack-keystone | 14:11 | |
| samueldmq | sjain: I am creating a brand new virtual env | 14:11 |
| samueldmq | and I will try from there | 14:12 |
| sjain | okay | 14:12 |
| samueldmq | sjain: have you set up the fernet-keys repo? | 14:15 |
| sjain | no I haven't | 14:16 |
| samueldmq | that's one of the things I think | 14:16 |
| sjain | yesterday we discussed here thatit won't be required | 14:16 |
| samueldmq | sjain: why? | 14:16 |
| samueldmq | keystone is trying to use fernet, and you don't have a keys repo, it should fail | 14:17 |
| lbragstad | it should fail on start up | 14:17 |
| sjain | because we were hoping it would use default fernet keys | 14:17 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/core.py#L33-L45 | 14:18 |
| samueldmq | lbragstad: are tehre default fernet keys? | 14:18 |
| *** links has quit IRC | 14:18 | |
| lbragstad | no there aren't | 14:18 |
| samueldmq | if you don't set them up? I guess it will just fail | 14:18 |
| samueldmq | lbragstad: yes it should fail | 14:18 |
| samueldmq | sjain: create /etc/keystone/fernet-keys/ | 14:18 |
| lbragstad | if there aren't any keys or a location for the keys on the system - keystone won't actually start | 14:18 |
| cmurphy | o/ | 14:18 |
| sjain | okay, I'll do that | 14:18 |
| samueldmq | sjain: and create three files inside that directory, named | 14:19 |
| samueldmq | 1 | 14:19 |
| samueldmq | 2 | 14:19 |
| samueldmq | and 3 | 14:19 |
| lbragstad | cmurphy: good afternoon | 14:19 |
| lbragstad | or just use `keystone-manage fernet_setup` | 14:19 |
| samueldmq | lbragstad: hmm | 14:19 |
| samueldmq | sjain: yeah, just do keystone-manage fernet_setup | 14:19 |
| sjain | that is giving me some error | 14:20 |
| sjain | just a second | 14:20 |
| *** sjain_ has joined #openstack-keystone | 14:21 | |
| samueldmq | lbragstad: sjain: so, when running with uWSGI, it will create a keystone.db file in the current dir | 14:22 |
| samueldmq | if you want to try things again from 0. delete that thing | 14:22 |
| samueldmq | after that, I did keystone-manage db_sync && keystone-manage bootstrap --bootstrap-password admin | 14:23 |
| samueldmq | and it worked just fine | 14:23 |
| sjain_ | samueldmq: lbragstad this is the error I'm getting http://paste.openstack.org/show/614602/ | 14:23 |
| samueldmq | cmurphy: o/ | 14:23 |
| samueldmq | sjain_: sudo | 14:23 |
| lbragstad | sjain_: you need to create the directory | 14:24 |
| sjain_ | I created that | 14:24 |
| samueldmq | lbragstad: would it need sudo? | 14:24 |
| samueldmq | maybe not, otherwise keystone process would need sudo too in order to be able to read | 14:24 |
| sjain_ | yup with sudo it worked | 14:24 |
| lbragstad | make sure you set access to the directory as the user running keystone | 14:24 |
| samueldmq | lbragstad: ++ | 14:24 |
| lbragstad | whatever process is running keystone will need to have read access to that directory | 14:25 |
| samueldmq | exactly | 14:25 |
| samueldmq | sjain_: and see my comment above, you will need to delete keystone.db file | 14:25 |
| samueldmq | so you'll have a fresh env when starting uwsgi again | 14:25 |
| sjain_ | okay | 14:25 |
| samueldmq | lbragstad: sjain_: we need to add an instruction to run keystone-manage fernet_setup to https://docs.openstack.org/keystone/latest/devref/development_best_practices.html | 14:26 |
| samueldmq | in Configuring Keystone as an additional step after copying the sample config file to /etc/keystone/keystone.conf | 14:27 |
| *** sjain has quit IRC | 14:27 | |
| samueldmq | lbragstad: "samueldmq: cmurphy brought up a good point about sample_data" | 14:29 |
| samueldmq | lbragstad: what was that? sorry my brain had skipped that message | 14:29 |
| lbragstad | samueldmq: yeah - much of that section needs to be reworked | 14:30 |
| cmurphy | samueldmq: possibly this http://lists.openstack.org/pipermail/openstack-dev/2017-July/119312.html | 14:30 |
| samueldmq | cmurphy: interesting | 14:30 |
| samueldmq | keystone manage-boostrap as a command doesnt work | 14:30 |
| samueldmq | you must provide --bootstrap-password | 14:30 |
| samueldmq | so that script is technically broken | 14:30 |
| samueldmq | unless, there is an env var ... wait :-) | 14:30 |
| cmurphy | yes | 14:31 |
| lbragstad | samueldmq: it uses envs | 14:31 |
| samueldmq | I am probably hungry | 14:31 |
| samueldmq | brb | 14:31 |
| samueldmq | :) | 14:31 |
| lbragstad | samueldmq: go eat! | 14:31 |
| samueldmq | yeah, lunch time! | 14:31 |
| cmurphy | this script worked for me a year or so ago, it has probably bitrotted but i don't think keystone-manage bootstrap itself has changed very much | 14:31 |
| lbragstad | cmurphy: we had a couple fixes to make it more robust - but yeah, it shouldn't have changed much | 14:32 |
| cmurphy | nowadays i just used devstack with keystone and some of the api services turned on | 14:32 |
| *** tobberydberg has joined #openstack-keystone | 14:33 | |
| lbragstad | anyone here interested in closing an oslo.cache bug? https://review.openstack.org/#/c/465631/ | 14:34 |
| *** tobberyd_ has quit IRC | 14:36 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move caching docs into admin-guide https://review.openstack.org/477678 | 14:38 |
| *** tobberydberg has quit IRC | 14:40 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move caching docs into admin-guide https://review.openstack.org/477678 | 14:42 |
| *** ducttape_ has quit IRC | 14:46 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move caching docs into admin-guide https://review.openstack.org/477678 | 14:50 |
| *** sjain_ has quit IRC | 14:52 | |
| *** sjain has joined #openstack-keystone | 14:53 | |
| lbragstad | gagehugo: would you like to follow up on this one https://review.openstack.org/#/c/476200/ ? | 14:53 |
| sjain | lbragstad: what are the arguments that should be passed to keystone-manage fernet-setup? | 14:56 |
| lbragstad | sjain: the keystone-user and keystone-group arguments is the user and group expected to read from the key repository location | 14:57 |
| lbragstad | but they are optional | 14:57 |
| *** liujiong has quit IRC | 14:57 | |
| sjain | I tried the command without those arguments, it is giving me an error, saying they are required | 14:58 |
| lbragstad | oh | 14:58 |
| lbragstad | for some reason I thought they were optional | 14:58 |
| *** catintheroof has quit IRC | 14:58 | |
| lbragstad | sjain: how are you running keystone? | 14:58 |
| sjain | what should be the values of those? | 14:58 |
| lbragstad | with uwsgi? | 14:58 |
| sjain | yes | 14:58 |
| *** spzala has quit IRC | 15:01 | |
| *** catintheroof has joined #openstack-keystone | 15:02 | |
| sjain | lbragstad: what should be the user and group values? | 15:02 |
| lbragstad | sjain: i'm recreating locally | 15:02 |
| sjain | okay | 15:02 |
| gagehugo | lbragstad sure | 15:02 |
| gagehugo | lbragstad done | 15:05 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Update security compliance documentation https://review.openstack.org/479357 | 15:06 |
| *** ducttape_ has joined #openstack-keystone | 15:08 | |
| *** jsavak has quit IRC | 15:09 | |
| *** jsavak has joined #openstack-keystone | 15:09 | |
| *** ducttape_ has quit IRC | 15:10 | |
| *** ducttape_ has joined #openstack-keystone | 15:10 | |
| *** belmoreira has quit IRC | 15:11 | |
| *** jsavak has quit IRC | 15:14 | |
| *** jsavak has joined #openstack-keystone | 15:15 | |
| lbragstad | sjain: try setting it as the user your logged in as | 15:17 |
| sjain | okay and group? | 15:18 |
| lbragstad | sjain: for now - try setting it the same as your user | 15:18 |
| sjain | it gives permission denied, even with sudo :| | 15:19 |
| lbragstad | sjain: try setting the permissions of /etc/keystone/fernet-keys to your user and group manually | 15:20 |
| sjain | okay | 15:20 |
| *** aojea has quit IRC | 15:21 | |
| *** aojea has joined #openstack-keystone | 15:21 | |
| lbragstad | gagehugo: https://review.openstack.org/#/c/479357/4 looks good - just last minor suggestion from me. | 15:23 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Update security compliance documentation https://review.openstack.org/479357 | 15:26 |
| gagehugo | lbragstad done! thanks | 15:26 |
| lbragstad | gagehugo: thank you! | 15:26 |
| sjain | lbragstad: I have changed the permissions but I'm still getting this http://paste.openstack.org/show/614611/ | 15:30 |
| sjain | should I create the files too? | 15:30 |
| lbragstad | sjain: no - the tool should do that for you | 15:31 |
| lbragstad | sjain: ls -la /etc/keystone/ | 15:31 |
| lbragstad | sjain: ls -la /etc/keystone/fernet-keys | 15:31 |
| sjain | ls -lsa shows me full permission to the directory | 15:31 |
| sjain | 4 drwxrwxrwx 2 riddle riddle 4096 Jul 6 19:52 fernet-keys | 15:31 |
| lbragstad | is riddle your user? | 15:32 |
| sjain | yes | 15:32 |
| lbragstad | and you're running keystone-manage fernet_setup as riddle? | 15:32 |
| sjain | yes | 15:32 |
| sjain | I'm logged in as riddle | 15:33 |
| lbragstad | what does ls -la /etc/keystone/fernet-keys show you? | 15:33 |
| sjain | http://paste.openstack.org/show/614614/ | 15:33 |
| lbragstad | sjain: see if you can match these permissions with your user http://paste.openstack.org/show/614615/ | 15:35 |
| sjain | but I'm giving additional permissions to the ones you shared, that should not be the issue | 15:37 |
| lbragstad | sjain: it shouldn't but it's getting hung up somewhere - and i'm not sure where | 15:38 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone master: Fixing flushing tokens workflow https://review.openstack.org/480287 | 15:47 |
| *** gyee has joined #openstack-keystone | 15:51 | |
| sjain | lbragstad: there was some other way to do this fernet_setup? | 15:52 |
| lbragstad | sjain: you can manually create the keys - but that would be doing the same steps as what keystone-manage is doing | 15:53 |
| sjain | i can try that if we are not able to resolve this permission issue | 15:53 |
| sjain | any documentation for that? | 15:53 |
| lbragstad | sjain: no - not really | 15:54 |
| morgan | it's interesting that you have a directory as 777 | 15:54 |
| morgan | permissions. | 15:54 |
| *** tesseract has quit IRC | 15:54 | |
| lbragstad | sjain: the thing is that if keystone-manage can't access that directory keystone won't be able to either i don't think | 15:54 |
| morgan | lbragstad: ++ | 15:54 |
| morgan | sjain: you (as riddle) can't cd /etc/keystone/ or /etc/keystone/fernet-keys | 15:55 |
| lbragstad | we actually have two doctor checks to ensure the permissions are right https://github.com/openstack/keystone/blob/master/keystone/cmd/doctor/tokens_fernet.py#L21-L53 | 15:55 |
| morgan | lbragstad: also, is the '-' correct? | 15:55 |
| sjain | morgan: yeah but even after that it is saying permission denied | 15:55 |
| morgan | that seems... weird. | 15:55 |
| morgan | sjain: that sounds like something wonky on the filesystem | 15:55 |
| morgan | sjain: you should be able to perform operations on those direrctories. | 15:56 |
| lbragstad | morgan: https://github.com/openstack/keystone/blob/master/keystone/conf/fernet_tokens.py#L20 | 15:56 |
| sjain | and I can cd into those directories | 15:56 |
| morgan | what flavour of OS are you running? debian, ubuntu, rhel, fedora, other? | 15:56 |
| lbragstad | sjain: can you run `keystone-manage doctor` ? | 15:56 |
| * morgan is curious if there is something like SELinux getting in the way | 15:56 | |
| sjain | elementary, its linux based | 15:56 |
| lbragstad | hmm | 15:57 |
| lbragstad | interesting | 15:57 |
| morgan | this sounds like SELinux sec | 15:57 |
| sjain | lbragstad: something not good, http://paste.openstack.org/show/614619/ | 15:57 |
| morgan | can you do 'ls -z /etc/keystone' ? | 15:57 |
| sjain | it can't find that | 15:57 |
| lbragstad | whoa | 15:58 |
| sjain | morgan: -z ? | 15:58 |
| morgan | lbragstad: older than doctor | 15:58 |
| morgan | sjain: shows SELinux contexts | 15:58 |
| morgan | and elementary uses it | 15:58 |
| sjain | there is no option | 15:58 |
| morgan | hm | 15:58 |
| morgan | iirc /etc/ is locked out of writes by normal users (security reasons) | 15:58 |
| lbragstad | -Z | 15:58 |
| morgan | ah | 15:58 |
| morgan | -Z ... derp. sorry | 15:59 |
| sjain | yeah...permission denied | 15:59 |
| sjain | ls: cannot open directory '/etc/keystone': Permission denied | 15:59 |
| morgan | sestatus | 15:59 |
| morgan | might be a good other command to show status of SELinux | 15:59 |
| morgan | this really does feel like something like SELinux getting in the way | 15:59 |
| sjain | it is not installed, I'll do that | 16:00 |
| morgan | because file perms look sane | 16:00 |
| morgan | ah no need to install it | 16:00 |
| *** david-lyle has joined #openstack-keystone | 16:00 | |
| morgan | uhm let me check something else | 16:00 |
| sjain | okay | 16:00 |
| morgan | trying to think what else can be done | 16:01 |
| morgan | well you could make the config directory under riddle's home dir | 16:01 |
| sjain | the keystone directory is already under home directory | 16:01 |
| morgan | honestly, i am just not familiar with elementary | 16:02 |
| morgan | in applications like this | 16:02 |
| sjain | is there any way I can change those file permissions | 16:02 |
| morgan | it could be any number of things being built into a desktop-linux system. | 16:02 |
| morgan | tbh | 16:02 |
| morgan | which is what elementary looks to be | 16:02 |
| sjain | hmm right | 16:02 |
| morgan | you can use chmod to change permissions | 16:03 |
| morgan | but it likely will have similar issues | 16:03 |
| sjain | I have already tried chmod and chown | 16:03 |
| sjain | yeah | 16:03 |
| morgan | if you can't cd / ls / touch a file in /etc/keystone it wont really change | 16:03 |
| sjain | but I'm able to cd in that directory | 16:03 |
| morgan | is this a desktop/laptop you're trying to setup for development? | 16:03 |
| morgan | or a server... or? | 16:04 |
| sjain | laptop | 16:04 |
| morgan | i recommend not installing keystone directly. i would use a virtual machine | 16:04 |
| morgan | in that case | 16:04 |
| morgan | it means you can use ubuntu or other known-working/known-quirk type environment | 16:04 |
| morgan | it also means you don't need all the added library support in your laptop | 16:04 |
| sjain | ohkay, then I'll use ubuntu for it | 16:04 |
| morgan | it might be a lot easier :) | 16:05 |
| morgan | i have an ubuntu laptop and tend to use ubuntu VMs for development | 16:05 |
| sjain | hmm but I was using virtualenv, so I thought it would be fine | 16:05 |
| morgan | right. it helps | 16:05 |
| morgan | it doesn't mean you wont need to install c-libs and other tools | 16:05 |
| morgan | it isolates python | 16:06 |
| sjain | hmm right | 16:06 |
| morgan | i prefer to use isolated environments so i don't accidently assume something is installed because i have it for desktop purposes | 16:06 |
| morgan | also, i don't need to run apache/nginx/etc on the laptop/main machine that way if i want to test the whole stack | 16:06 |
| morgan | (if you look at running a devstack for example, i would never run stack.sh on a machine i cared about :P) | 16:07 |
| morgan | so many things are installed to make stuff work | 16:07 |
| morgan | lbragstad: i need to smack a bug down, just realized | 16:07 |
| morgan | someone proposed an oslo_* import to ksa | 16:07 |
| sjain | okay I'll try to use a VM then | 16:08 |
| sjain | lets see how it goes there | 16:08 |
| sjain | thanks morgan, lbragstad! | 16:08 |
| lbragstad | sjain: anytime - hopefully it works a little better | 16:08 |
| sjain | yeah :) | 16:08 |
| sjain | lbragstad: what happened to this, https://review.openstack.org/#/c/477632/ | 16:16 |
| lbragstad | sjain: i'd try rebasing that on master | 16:17 |
| morgan | sjain: CI issue, rebase should help | 16:17 |
| morgan | rebase/cleanup based upon any conflicts | 16:17 |
| lbragstad | there is a lot of stuff happening in the docs | 16:17 |
| morgan | nothing too crazy there :) | 16:17 |
| sjain | oh okay | 16:17 |
| sjain | yeah | 16:17 |
| lbragstad | stepping away to get a run in - biab | 16:23 |
| *** rderose has joined #openstack-keystone | 16:25 | |
| *** sjain has quit IRC | 16:26 | |
| *** jsavak has quit IRC | 16:32 | |
| *** jsavak has joined #openstack-keystone | 16:33 | |
| *** jsavak has quit IRC | 16:37 | |
| *** jsavak has joined #openstack-keystone | 16:39 | |
| openstackgerrit | Kelly Hall proposed openstack/keystone master: Trims whitespace from request headers https://review.openstack.org/470425 | 16:56 |
| openstackgerrit | Omar Tleimat proposed openstack/keystone master: WIP: Add project tags https://review.openstack.org/470317 | 17:07 |
| *** harlowja has joined #openstack-keystone | 17:13 | |
| *** zzzeek has quit IRC | 17:14 | |
| *** raildo has quit IRC | 17:19 | |
| *** raildo has joined #openstack-keystone | 17:22 | |
| *** jmlowe has quit IRC | 17:23 | |
| *** raildo has quit IRC | 17:26 | |
| *** dansmith has joined #openstack-keystone | 17:26 | |
| dansmith | morgan: hey, I have a question about ya'll's database migrationy stuff.. someone pointed me at you, are you the best person to ask? | 17:27 |
| morgan | dansmith: i can try and help | 17:27 |
| morgan | dansmith: i might know a thing or two about our migrations :P | 17:28 |
| dansmith | morgan: I see multiple migrate repos, which I assume are arranged to allow an expand/contract sort of workflow | 17:28 |
| dansmith | and a bunch that are no-ops | 17:28 |
| morgan | correct. | 17:29 |
| dansmith | are the expand/migrate/contract repos supposed to walk in lockstep such that one numbered migration may not have any work to do for one of those phases? | 17:29 |
| morgan | each migration number has to be mirrored (expand / migrate / contract) regardless of if we have anything to do | 17:29 |
| morgan | yes. | 17:29 |
| morgan | you may run contract at a later point. | 17:29 |
| openstackgerrit | Jaewoo Park proposed openstack/keystone master: WIP: Add project tags https://review.openstack.org/470317 | 17:29 |
| dansmith | ack, okay, and how does that overlap or not with the migrate_repo, which seems to be historical? | 17:30 |
| morgan | we did a hard break from "migrate_repo" | 17:30 |
| morgan | it is strictly historical | 17:30 |
| dansmith | okay gotcha, when did that happen? | 17:30 |
| morgan | well, iirc we use it to populate schema before we do the expand/contract stuffs | 17:30 |
| morgan | but we never touch/change it at this point | 17:30 |
| morgan | uhm... mitaka? | 17:30 |
| morgan | i think | 17:30 |
| dansmith | okay | 17:31 |
| morgan | i'd need to look at db_sync | 17:31 |
| morgan | it might be smarter, but we've kept the migrate_repo for historical reasons | 17:31 |
| dansmith | so does db sync currently do a expand && migrate && contract for the simple case or something? | 17:31 |
| morgan | i think you need to do "db_sync expand" | 17:31 |
| morgan | if you want it to run only expand operations | 17:31 |
| morgan | if you just "db_sync" it moves all of them to the latest.... but let me 2x check? | 17:32 |
| morgan | you might need to do each step | 17:32 |
| dansmith | I figured just doing db_sync would expand and contract for you, and you'd do something else if you want to only do one phase | 17:33 |
| morgan | i think it does | 17:33 |
| dansmith | okay, makes sense | 17:33 |
| morgan | and if you explicitly do --expand | 17:33 |
| morgan | --migrate | 17:33 |
| *** zzzeek has joined #openstack-keystone | 17:33 | |
| morgan | and then --contract you can break apart the actions | 17:33 |
| dansmith | so, here's the million dollar question | 17:33 |
| morgan | should i be scared? ;) | 17:34 |
| dansmith | let's say I moved from newton to ocata, did my expand, then moved from ocata to pike, did another expand, then moved to queens, did another expand and then a contract, | 17:34 |
| dansmith | theoretically that should work, but in practice do you think it will? | 17:34 |
| morgan | it should. | 17:34 |
| *** ducttape_ has quit IRC | 17:34 | |
| morgan | as long as you also --migrate in there | 17:34 |
| dansmith | right, expand/migrate, expand/migrate, expand/migrate/contract I guess | 17:35 |
| morgan | i have no reason to belive (besides the horrible choice of using triggers) that it wouldn't work | 17:35 |
| dansmith | yeah, I'm concerned about the triggers | 17:35 |
| morgan | i think it was a very bad choice, i lost the argument | 17:35 |
| morgan | i would advocate to not use triggers if at all possible | 17:35 |
| dansmith | but alas, here we are, so.. | 17:35 |
| morgan | yeah | 17:35 |
| morgan | so, besides issuees with triggers | 17:35 |
| dansmith | I saw a CONF.use_triggers or something.. is it really optional? | 17:36 |
| morgan | i see no reason why it wouldn't work | 17:36 |
| morgan | it basically is only optional if you're not doing online/rolling upgrades | 17:36 |
| morgan | if you do offline upgrades, and make sure code is deployed in lockstep with the schema changes, triggers are not needed at all | 17:36 |
| dansmith | well, if everything stays offline until the final phase, and if I'm doing my --migrate, does that mean I could avoid the triggers? | 17:36 |
| morgan | the triggers should be dropped in contract phases | 17:37 |
| morgan | if you don't do any writes, the triggers have zero impact | 17:37 |
| morgan | besides needing "SUPER" access to create them | 17:37 |
| dansmith | only writes for sure? | 17:37 |
| morgan | that is my understanding | 17:37 |
| *** zzzeek has quit IRC | 17:37 | |
| dansmith | no read-compatibility triggers? | 17:37 |
| morgan | god no | 17:37 |
| dansmith | okay, so, let me restate this again then: | 17:38 |
| dansmith | if I have CONF.use_triggers=False, then I should be able to expand/migrate/contract, expand/migrate/contract, expand/migrate/contract with everything offline and only start after all of that and be good, yes? | 17:38 |
| morgan | read triggers would... trigger me :P sorry i couldn't resist | 17:38 |
| dansmith | because I need no triggers, and the migrate/contract will move things along that the triggers would otherwise handle? | 17:39 |
| openstackgerrit | Merged openstack/keystone master: Migrated docs from devdocs to user docs https://review.openstack.org/476200 | 17:39 |
| dansmith | did I esplode your brain? | 17:40 |
| morgan | sorry have phone call | 17:40 |
| morgan | brb | 17:40 |
| dansmith | k, np | 17:41 |
| *** zzzeek has joined #openstack-keystone | 17:41 | |
| *** raildo has joined #openstack-keystone | 17:44 | |
| *** jsavak has quit IRC | 17:45 | |
| *** jsavak has joined #openstack-keystone | 17:45 | |
| openstackgerrit | Merged openstack/keystone master: Added a note for API curl examples https://review.openstack.org/478574 | 17:46 |
| *** jsavak has quit IRC | 17:50 | |
| *** jsavak has joined #openstack-keystone | 17:52 | |
| *** zzzeek has quit IRC | 17:53 | |
| *** zzzeek has joined #openstack-keystone | 18:00 | |
| morgan | dansmith: ok back in 3m | 18:00 |
| morgan | call is over need to check on something | 18:00 |
| *** jsavak has quit IRC | 18:01 | |
| *** ducttape_ has joined #openstack-keystone | 18:01 | |
| *** jsavak has joined #openstack-keystone | 18:02 | |
| *** ducttape_ has quit IRC | 18:02 | |
| *** ducttape_ has joined #openstack-keystone | 18:03 | |
| *** dave-mccowan has joined #openstack-keystone | 18:03 | |
| morgan | dansmith: ok back | 18:07 |
| morgan | ok so, yes expand/migrate/contract will move everything along | 18:07 |
| morgan | you don't need triggers except in the case of running old keystone (ocata) with new keystone (pike) against a common (pike) schema | 18:07 |
| dansmith | morgan: okay, so next question is what gets tested in the gate? expand/migrate + triggers no contract? | 18:08 |
| morgan | we don't test triggers atm | 18:08 |
| dansmith | orly, okay | 18:08 |
| morgan | because we don't have the test for old/new keystone | 18:08 |
| morgan | i mean we test it | 18:08 |
| morgan | like unit tests | 18:08 |
| *** zzzeek_ has joined #openstack-keystone | 18:08 | |
| morgan | but not real functional active keystones (i think) | 18:08 |
| dansmith | sure | 18:08 |
| *** zzzeek has quit IRC | 18:09 | |
| morgan | we do test the expand/migrate/contract [unit tests] | 18:09 |
| dansmith | okay, well, I was really worried the answer was going to be "embrace the triggers" so I'm in a good spot I think | 18:09 |
| dansmith | thanks for your time | 18:09 |
| morgan | np | 18:09 |
| morgan | my answer would have been "please try not to use triggers unless you really need it" | 18:09 |
| morgan | ;) | 18:09 |
| dansmith | +2 | 18:10 |
| morgan | i think waht you just described will be 100% a-ok, and triggers can be ignored. | 18:10 |
| dansmith | sweet | 18:15 |
| * dansmith puts the "morgan said it would work" sticker on it | 18:15 | |
| morgan | ^_^ | 18:16 |
| *** jsavak has quit IRC | 18:24 | |
| *** jsavak has joined #openstack-keystone | 18:25 | |
| cmurphy | morgan: i think we have rolling upgrade tests now (cc lbragstad) | 18:31 |
| lbragstad | cmurphy: we do - but it is experimental | 18:32 |
| cmurphy | lbragstad: still, > unit tests :) | 18:33 |
| lbragstad | that stuff just merged recently - let me find the commits | 18:33 |
| lbragstad | https://review.openstack.org/#/c/471419/ | 18:35 |
| morgan | cmurphy: yeah wasn't every patch | 18:35 |
| morgan | but in either case that wasn't super relevant for what dansmith was looking for in this case | 18:36 |
| dansmith | yeah I think the triggers are scary, but I thought I'd have to use them | 18:36 |
| dansmith | knowing I don't means I ignore until that changes :) | 18:36 |
| lbragstad | dansmith: you weren't interested in a rolling upgrade - correct? | 18:37 |
| dansmith | correct | 18:37 |
| lbragstad | dansmith: ok | 18:38 |
| dansmith | I mean, I'm not for this situation I'm asking about | 18:38 |
| lbragstad | dansmith: the case you were looking for was the following: | 18:40 |
| lbragstad | "<dansmith> let's say I moved from newton to ocata, did my expand, then moved from ocata to pike, did another expand, then moved to queens, did another expand and then a contract," | 18:41 |
| lbragstad | ? | 18:41 |
| lbragstad | so - only interested in additive schema changes? | 18:41 |
| dansmith | lbragstad: well, that was me guessing at the best approach | 18:41 |
| dansmith | lbragstad: what I'm looking for is: | 18:41 |
| dansmith | lbragstad: the ability to shut things down, roll through a few releases of schema/data migrations and pop up on the other side on N+X where X>1 | 18:42 |
| lbragstad | ohh | 18:42 |
| dansmith | lbragstad: for dumb old school migrations, that's pretty mechanical, so I was making sure there was some way to push the migration bit before the contract bit | 18:42 |
| lbragstad | you want to migrate through multiple release but service uptime isn't a concern | 18:43 |
| lbragstad | if i'm understanding correctly | 18:43 |
| dansmith | right | 18:44 |
| dansmith | trading service uptime for less frequent updates | 18:44 |
| dansmith | if that's your kink | 18:44 |
| *** jsavak has quit IRC | 18:51 | |
| *** jsavak has joined #openstack-keystone | 18:51 | |
| *** jsavak has quit IRC | 18:52 | |
| *** jsavak has joined #openstack-keystone | 18:53 | |
| *** tobberydberg has joined #openstack-keystone | 18:56 | |
| *** tobberydberg has quit IRC | 19:01 | |
| *** jmlowe has joined #openstack-keystone | 19:03 | |
| lbragstad | dansmith: fwiw - so long as expand/migrate/contract for a release is run in lock-step, you shouldn't have to deal with triggers, and they shouldn't exist outside of that series of events | 19:06 |
| dansmith | yeah that's what I gather | 19:06 |
| dansmith | which is what I'm shooting for here | 19:06 |
| lbragstad | dansmith: we have a patch to harden that case - https://review.openstack.org/#/c/437441/ | 19:06 |
| lbragstad | cc morgan cmurphy it'd be great to get your opinion on that ^ | 19:07 |
| lbragstad | dansmith: sorry it took me a bit to confirm - i needed to step through it. but yeah - that should be possible | 19:08 |
| lbragstad | dansmith: is that specific upgrade case something you're seeing a lot of (if i can ask)? | 19:09 |
| dansmith | lbragstad: well, there's a growing desire by a certain type of deployer to do that approach, yeah | 19:11 |
| dansmith | lbragstad: I'm highly resistant to us (as a community) saying that we support upgrades of more than one step at a time in any way | 19:12 |
| *** pcaruana has quit IRC | 19:12 | |
| dansmith | but the step-by-step approach should be a reasonable way to achieve the same result (i.e. hitting each release, even if not running) | 19:12 |
| dansmith | so I figure if you want to trade uptime for (lower) upgrade frequency, that's cool, and this is how you do it | 19:13 |
| lbragstad | dansmith: sure - i agree | 19:13 |
| dansmith | if you want high uptime, you keep on top of things | 19:13 |
| lbragstad | dansmith: i ask because i wonder if a dedicated section to the upgrade docs would have cleared that up sooner https://docs.openstack.org/keystone/latest/getting-started/upgrading.html | 19:14 |
| dansmith | so, knowing keystone did this trigger deal, I just wanted to confirm that triggers wouldn't complicate the process too much | 19:14 |
| dansmith | lbragstad: if I had read the docs at all before asking, then maybe so :) | 19:14 |
| lbragstad | :) | 19:14 |
| dansmith | I think the "minimal downtime" section implies that db_sync does expand/migrate/contract in a way that would still work for this, | 19:15 |
| dansmith | but I still would have come to ask for validation :) | 19:15 |
| lbragstad | ok - good to know | 19:16 |
| *** ducttape_ has quit IRC | 19:21 | |
| *** ducttape_ has joined #openstack-keystone | 19:22 | |
| *** ducttape_ has quit IRC | 19:24 | |
| *** ducttape_ has joined #openstack-keystone | 19:24 | |
| *** ducttape_ has quit IRC | 19:31 | |
| *** ducttape_ has joined #openstack-keystone | 19:41 | |
| *** lbragstad has quit IRC | 19:58 | |
| *** lbragstad has joined #openstack-keystone | 20:03 | |
| *** ChanServ sets mode: +o lbragstad | 20:03 | |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Removed apache-httpd guide from docs https://review.openstack.org/477632 | 20:16 |
| *** ducttape_ has quit IRC | 20:19 | |
| openstackgerrit | Samuel Pilla proposed openstack/python-keystoneclient master: WIP: Add project tags to keystoneclient https://review.openstack.org/481223 | 20:24 |
| *** ducttape_ has joined #openstack-keystone | 20:27 | |
| *** raildo has quit IRC | 20:34 | |
| *** raildo has joined #openstack-keystone | 20:50 | |
| *** sghosh has joined #openstack-keystone | 20:54 | |
| *** raildo has quit IRC | 20:55 | |
| *** butt is now known as hemna | 20:57 | |
| *** lucasxu has quit IRC | 20:57 | |
| *** raildo has joined #openstack-keystone | 20:57 | |
| *** jmlowe has quit IRC | 21:01 | |
| *** jsavak has quit IRC | 21:06 | |
| *** jmlowe has joined #openstack-keystone | 21:09 | |
| *** raildo has quit IRC | 21:15 | |
| *** dgedia has joined #openstack-keystone | 21:23 | |
| dgedia | Hi, I am trying to install Senlin manually and running into this error when I try to execute the "openstack cluster build info" command : CRITICAL keystonemiddleware.auth_token [-] Unable to validate token: Identity server rejected authorization necessary to fetch token data: ServiceError: Identity server rejected authorization necessary to fetch token data | 21:24 |
| *** jmlowe has quit IRC | 21:25 | |
| *** ducttape_ has quit IRC | 21:28 | |
| *** thorst has quit IRC | 21:33 | |
| *** ducttape_ has joined #openstack-keystone | 21:33 | |
| *** bknudson has quit IRC | 21:33 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add project tags api-ref documentation and reno https://review.openstack.org/472396 | 21:38 |
| *** jmlowe has joined #openstack-keystone | 21:42 | |
| gagehugo | lbragstad do we want to try to get https://review.openstack.org/#/c/447139 moving again? | 21:54 |
| *** catintheroof has quit IRC | 21:55 | |
| *** aojea has quit IRC | 22:00 | |
| lbragstad | gagehugo: oh - yes | 22:05 |
| lbragstad | gagehugo: that would be great | 22:05 |
| *** dave-mccowan has quit IRC | 22:05 | |
| gagehugo | I think it fell to the wayside right when the whole osic thing happened :( | 22:06 |
| lbragstad | yeah - that sounds about right | 22:07 |
| *** ducttap__ has joined #openstack-keystone | 22:08 | |
| *** ductta___ has joined #openstack-keystone | 22:11 | |
| openstackgerrit | Octave Orgeron proposed openstack/keystone master: Enables MySQL Cluster support for Keystone https://review.openstack.org/431229 | 22:11 |
| *** ducttape_ has quit IRC | 22:11 | |
| *** ducttap__ has quit IRC | 22:13 | |
| openstackgerrit | Eric Fried proposed openstack/keystoneauth master: normalize_version_number([1]) => (1, 0) and docs https://review.openstack.org/481309 | 22:19 |
| *** rderose has quit IRC | 22:21 | |
| gagehugo | lbragstad I can put it on the meeting agenda for next week | 22:22 |
| lbragstad | gagehugo: that'd be great | 22:22 |
| *** edmondsw has quit IRC | 22:23 | |
| *** edmondsw has joined #openstack-keystone | 22:28 | |
| *** edmondsw has quit IRC | 22:32 | |
| *** edmondsw has joined #openstack-keystone | 22:56 | |
| *** edmondsw has quit IRC | 23:00 | |
| *** lbragstad has quit IRC | 23:03 | |
| *** thorst has joined #openstack-keystone | 23:04 | |
| *** thorst has quit IRC | 23:09 | |
| *** thorst has joined #openstack-keystone | 23:33 | |
| *** thorst has quit IRC | 23:34 | |
| *** lbragstad has joined #openstack-keystone | 23:36 | |
| *** ChanServ sets mode: +o lbragstad | 23:36 | |
| openstackgerrit | Jaewoo Park proposed openstack/keystone master: WIP: Add project tags https://review.openstack.org/470317 | 23:43 |
| -openstackstatus- NOTICE: nb03.openstack.org has been cleaned up and rebooted, and should return to building rotation | 23:44 | |
| openstackgerrit | Jaewoo Park proposed openstack/keystone master: WIP: Add project tags https://review.openstack.org/470317 | 23:51 |
| openstackgerrit | Kelly Hall proposed openstack/keystone master: Trims whitespace from request headers https://review.openstack.org/470425 | 23:56 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!