| *** spzala has quit IRC | 00:09 | |
| *** david-lyle has quit IRC | 00:10 | |
| *** dklyle has joined #openstack-keystone | 00:10 | |
| *** spzala has joined #openstack-keystone | 00:10 | |
| *** phalmos has quit IRC | 00:19 | |
| *** esp has quit IRC | 00:25 | |
| *** esp has joined #openstack-keystone | 00:28 | |
| *** dklyle is now known as david-lyle | 00:52 | |
| openstackgerrit | Merged openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/534937 | 00:59 |
|---|---|---|
| *** pramodrj07 has joined #openstack-keystone | 01:05 | |
| *** lbragstad has joined #openstack-keystone | 01:09 | |
| *** ChanServ sets mode: +o lbragstad | 01:09 | |
| *** edmondsw has joined #openstack-keystone | 01:12 | |
| *** bigdogstl has quit IRC | 01:14 | |
| wxy | lbragstad: a lot of tests failed when i turn on FKs, http://logs.openstack.org/30/126030/17/check/openstack-tox-py27/4d7a61c/testr_results.html.gz | 01:15 |
| lbragstad | wxy: i just saw your comment on the review - sounds like i missed a step | 01:16 |
| lbragstad | I can try and recreate | 01:16 |
| lbragstad | i thought there was just one boolean to switch | 01:16 |
| *** edmondsw has quit IRC | 01:16 | |
| wxy | lbragstad: we lost the root domain <<keystone.domain.root>>. So when we enable FK, it will fail for creating the "default" domain. | 01:18 |
| wxy | lbragstad: what's more, the sqlite FK only works in one connection. It means that we should open the FK every time we connect to sqlite. Enable the FK for the global engine does nothing actually. | 01:20 |
| lbragstad | huh | 01:21 |
| lbragstad | interesting | 01:21 |
| *** daidv has quit IRC | 01:22 | |
| *** daidv has joined #openstack-keystone | 01:22 | |
| *** esp has quit IRC | 01:24 | |
| wxy | so I disable the FK for the test by default. We can enable it step by step for all the test. It's not a small work. For example, i enabled FK for limit provider. So that the test can pass now. https://review.openstack.org/#/c/524109/35/keystone/tests/unit/limit/test_backends.py L371 | 01:29 |
| *** zhurong has joined #openstack-keystone | 01:29 | |
| *** bigdogstl has joined #openstack-keystone | 01:45 | |
| *** bigdogstl has quit IRC | 01:50 | |
| openstackgerrit | Merged openstack/keystoneauth master: Updated from global requirements https://review.openstack.org/534936 | 01:53 |
| openstackgerrit | Merged openstack/keystoneauth master: Shift additional_user_agent in the stack https://review.openstack.org/456259 | 01:53 |
| *** bigdogstl has joined #openstack-keystone | 01:57 | |
| *** kukacz_ has quit IRC | 02:00 | |
| openstackgerrit | Merged openstack/oslo.policy master: Updated from global requirements https://review.openstack.org/535101 | 02:00 |
| *** kukacz_ has joined #openstack-keystone | 02:01 | |
| lbragstad | wxy: here you mean? https://review.openstack.org/#/c/524109/35/keystone/tests/unit/limit/test_backends.py@371 | 02:07 |
| wxy | lbragstad: yeah | 02:07 |
| *** pramodrj07 has quit IRC | 02:08 | |
| *** bigdogstl has quit IRC | 02:09 | |
| lbragstad | oh - so that *would* fail if https://review.openstack.org/#/c/524109/35/keystone/tests/unit/test_backend_sql.py@1271 was False? | 02:12 |
| wxy | lbragstad: yes. | 02:12 |
| lbragstad | ahh... | 02:12 |
| lbragstad | ok - i'm testing something for application credentials quick, but i should be able to pull those patches again | 02:13 |
| lbragstad | and retest | 02:13 |
| wxy | lbragstad: OK. I'm refreshing the patch as well, base on your comments. :) | 02:14 |
| lbragstad | wxy: awesome - i was finally able to go through them today | 02:14 |
| lbragstad | most of my comments were style related | 02:15 |
| wxy | lbragstad: I think they are all good. To make the code more pythonic and beautiful. I'm happy to make the patches better. | 02:16 |
| lbragstad | wxy: i noticed the tests setup a service and region for each test case... i spent some time trying to refactor them to use setUpClass instead of just setUp, which gets run for each test and not just once for the whole moduel | 02:18 |
| lbragstad | but i think we'll have to refactor more of the testing infrastructure because setUpClass is a classmethod and doesn't have access to self.post utility methods and whatnot... either way, we can do more of that in the future, just something i was tinkering with to see if we could improve perofrmnace | 02:19 |
| lbragstad | performance* | 02:19 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add system column to app cred table https://review.openstack.org/535569 | 02:19 |
| lbragstad | cmurphy: ^ | 02:20 |
| *** spzala has quit IRC | 02:20 | |
| *** spzala has joined #openstack-keystone | 02:21 | |
| *** spzala has quit IRC | 02:21 | |
| *** spzala has joined #openstack-keystone | 02:21 | |
| wxy | lbragstad: yeah. I tried move it to super class at PS14, but it influenced many other tests. It's the reason I moved them down. | 02:23 |
| lbragstad | aha - so if i set https://review.openstack.org/#/c/524109/35/keystone/tests/unit/test_backend_sql.py@1271 to False i get 3 test failures | 02:27 |
| lbragstad | which looks right - because they are expecting reference limit failures.. | 02:27 |
| lbragstad | nice | 02:27 |
| wxy | :) | 02:28 |
| *** harlowja has quit IRC | 02:31 | |
| lbragstad | wxy: you're just always two steps ahead! | 02:32 |
| lbragstad | i'll retract my -1 then | 02:32 |
| wxy | lbragstad: I spent all my last two days for digging the sqlite FK problems. lol | 02:34 |
| lbragstad | yeah... that's good because that patch has been in review for a *long* time | 02:34 |
| lbragstad | wxy: if we do merge this patch with the workaround to bypass fk because tests fail, we should open a bug to go chase those tests down and fix them | 02:38 |
| *** namnh has joined #openstack-keystone | 02:40 | |
| *** bigdogstl has joined #openstack-keystone | 02:40 | |
| *** bigdogstl has quit IRC | 02:45 | |
| *** threestrands_ has joined #openstack-keystone | 02:49 | |
| *** threestrands_ has quit IRC | 02:49 | |
| *** threestrands_ has joined #openstack-keystone | 02:49 | |
| lbragstad | wxy: do you have any other questions for me on the comments i had? | 02:50 |
| *** threestrands has quit IRC | 02:51 | |
| wxy | lbragstad: no more. Others can be dealt in the review. And agree to open a bug to track it. I'll try to fix them one by one. | 02:53 |
| lbragstad | i don't think it's a huge deal to fix those immediately, just as long as we don't lose track of the work (that's the important bit) | 02:54 |
| lbragstad | IMO | 02:54 |
| wxy | sure. | 02:55 |
| *** bigdogstl has joined #openstack-keystone | 03:03 | |
| *** andreaf has quit IRC | 03:07 | |
| *** lbragstad has quit IRC | 03:08 | |
| *** bigdogstl has quit IRC | 03:13 | |
| *** andreaf has joined #openstack-keystone | 03:36 | |
| *** bigdogstl has joined #openstack-keystone | 03:37 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Force SQLite to properly deal with foreign keys https://review.openstack.org/126030 | 03:39 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add limit provider https://review.openstack.org/524109 | 03:39 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Implement policies for limits https://review.openstack.org/530143 | 03:39 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Expose unified limit APIs https://review.openstack.org/524110 | 03:39 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Improve limit sql backend https://review.openstack.org/535587 | 03:39 |
| *** AlexeyAbashkin has joined #openstack-keystone | 03:44 | |
| *** jappleii__ has joined #openstack-keystone | 03:44 | |
| *** jappleii__ has quit IRC | 03:45 | |
| *** jappleii__ has joined #openstack-keystone | 03:45 | |
| *** jappleii__ has quit IRC | 03:46 | |
| *** threestrands_ has quit IRC | 03:46 | |
| *** lbragstad has joined #openstack-keystone | 03:46 | |
| *** ChanServ sets mode: +o lbragstad | 03:46 | |
| *** jappleii__ has joined #openstack-keystone | 03:47 | |
| *** esp has joined #openstack-keystone | 03:47 | |
| *** esp has left #openstack-keystone | 03:47 | |
| *** jappleii__ has quit IRC | 03:48 | |
| *** AlexeyAbashkin has quit IRC | 03:48 | |
| *** jappleii__ has joined #openstack-keystone | 03:48 | |
| *** rcernin has quit IRC | 03:49 | |
| *** rcernin has joined #openstack-keystone | 03:49 | |
| *** bigdogstl has quit IRC | 03:51 | |
| *** abhi89 has joined #openstack-keystone | 04:01 | |
| *** lbragstad has quit IRC | 04:02 | |
| *** bigdogstl has joined #openstack-keystone | 04:17 | |
| *** ayoung has quit IRC | 04:22 | |
| *** bigdogstl has quit IRC | 04:22 | |
| *** bigdogstl has joined #openstack-keystone | 04:24 | |
| *** deepak_ has joined #openstack-keystone | 04:26 | |
| deepak_ | hey , can we use oauthlib in replace of oauthclient as https://github.com/google/oauth2client/releases/tag/v4.1.0 | 04:27 |
| *** bigdogstl has quit IRC | 04:29 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:30 | |
| *** bigdogstl has joined #openstack-keystone | 04:35 | |
| *** abhishek has joined #openstack-keystone | 04:37 | |
| *** links has joined #openstack-keystone | 04:37 | |
| *** namnh has quit IRC | 04:38 | |
| *** Dinesh_Bhor has quit IRC | 04:39 | |
| *** zhurong has quit IRC | 04:39 | |
| *** abhi89 has quit IRC | 04:39 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:45 | |
| *** Dinesh_Bhor has quit IRC | 04:53 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:55 | |
| *** bigdogstl has quit IRC | 04:57 | |
| *** zhurong has joined #openstack-keystone | 05:19 | |
| *** harlowja has joined #openstack-keystone | 05:21 | |
| openstackgerrit | Merged openstack/keystoneauth master: Use stestr in tox.ini https://review.openstack.org/534763 | 05:29 |
| *** Dinesh_Bhor has quit IRC | 05:43 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 05:43 | |
| *** Dinesh_Bhor has quit IRC | 05:47 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 05:49 | |
| *** jappleii__ has quit IRC | 05:52 | |
| *** bigdogstl has joined #openstack-keystone | 05:56 | |
| *** bigdogstl has quit IRC | 06:07 | |
| *** jaosorior has joined #openstack-keystone | 06:11 | |
| *** logan- has quit IRC | 06:16 | |
| *** harlowja has quit IRC | 06:29 | |
| *** annp has joined #openstack-keystone | 06:33 | |
| *** abhi89 has joined #openstack-keystone | 06:37 | |
| *** logan- has joined #openstack-keystone | 06:40 | |
| *** abhishek has quit IRC | 06:40 | |
| *** pcaruana has joined #openstack-keystone | 06:44 | |
| *** lamt has quit IRC | 07:02 | |
| *** bigdogstl has joined #openstack-keystone | 07:02 | |
| *** namnh has joined #openstack-keystone | 07:03 | |
| *** bigdogstl has quit IRC | 07:14 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Force SQLite to properly deal with foreign keys https://review.openstack.org/126030 | 07:17 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Improve limit sql backend https://review.openstack.org/535587 | 07:17 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add limit provider https://review.openstack.org/524109 | 07:17 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Implement policies for limits https://review.openstack.org/530143 | 07:17 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Expose unified limit APIs https://review.openstack.org/524110 | 07:17 |
| *** Dinesh_Bhor has quit IRC | 07:19 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:20 | |
| *** bigdogstl has joined #openstack-keystone | 07:25 | |
| *** bigdogstl has quit IRC | 07:30 | |
| *** daidv has quit IRC | 07:33 | |
| *** daidv has joined #openstack-keystone | 07:33 | |
| *** bigdogstl has joined #openstack-keystone | 07:37 | |
| *** rcernin has quit IRC | 07:43 | |
| *** bigdogstl has quit IRC | 07:44 | |
| *** tbh_ has joined #openstack-keystone | 07:59 | |
| *** zeus has quit IRC | 08:05 | |
| *** rm_work has quit IRC | 08:08 | |
| *** bigdogstl has joined #openstack-keystone | 08:10 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:13 | |
| *** markvoelker has quit IRC | 08:14 | |
| *** tesseract has joined #openstack-keystone | 08:16 | |
| *** harlowja has joined #openstack-keystone | 08:17 | |
| *** rm_work has joined #openstack-keystone | 08:20 | |
| *** bigdogstl has quit IRC | 08:20 | |
| *** namnh_ has joined #openstack-keystone | 08:26 | |
| *** jmccrory has quit IRC | 08:26 | |
| *** gus has quit IRC | 08:27 | |
| *** annp has quit IRC | 08:28 | |
| *** namnh has quit IRC | 08:28 | |
| *** gus has joined #openstack-keystone | 08:29 | |
| *** annp has joined #openstack-keystone | 08:29 | |
| *** jmccrory has joined #openstack-keystone | 08:33 | |
| *** jamielennox has quit IRC | 08:33 | |
| *** harlowja has quit IRC | 08:37 | |
| *** namnh has joined #openstack-keystone | 08:40 | |
| *** Dinesh_Bhor has quit IRC | 08:42 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 08:42 | |
| *** namnh_ has quit IRC | 08:43 | |
| *** jmccrory has quit IRC | 08:50 | |
| *** jmccrory has joined #openstack-keystone | 08:52 | |
| *** namnh has quit IRC | 08:54 | |
| *** rm_work has quit IRC | 08:56 | |
| *** josecastroleon has joined #openstack-keystone | 08:59 | |
| *** homeski has quit IRC | 09:02 | |
| *** bigdogstl has joined #openstack-keystone | 09:13 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Expose unified limit APIs https://review.openstack.org/524110 | 09:23 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add api-ref for registered limits https://review.openstack.org/535688 | 09:23 |
| *** bigdogstl has quit IRC | 09:24 | |
| *** abhishek has joined #openstack-keystone | 09:24 | |
| *** abhi89 has quit IRC | 09:26 | |
| *** Dinesh_Bhor has quit IRC | 09:31 | |
| *** rm_work has joined #openstack-keystone | 09:36 | |
| *** jamielennox has joined #openstack-keystone | 09:46 | |
| *** pcaruana has quit IRC | 09:50 | |
| *** vishu1810 has joined #openstack-keystone | 09:52 | |
| *** bigdogstl has joined #openstack-keystone | 09:52 | |
| *** pcaruana has joined #openstack-keystone | 09:53 | |
| *** pcaruana has quit IRC | 09:53 | |
| *** pcaruana has joined #openstack-keystone | 09:54 | |
| *** vishu1810 has left #openstack-keystone | 09:54 | |
| *** bigdogstl has quit IRC | 10:01 | |
| *** tbh_ has quit IRC | 10:09 | |
| *** markvoelker has joined #openstack-keystone | 10:15 | |
| openstackgerrit | wudong proposed openstack/keystone master: Fix outdated links https://review.openstack.org/535228 | 10:34 |
| *** zhurong has quit IRC | 10:41 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Fix outdated links https://review.openstack.org/535228 | 10:48 |
| *** markvoelker has quit IRC | 10:49 | |
| *** daidv has quit IRC | 10:58 | |
| *** bigdogstl has joined #openstack-keystone | 11:03 | |
| *** bigdogstl has quit IRC | 11:14 | |
| *** markvoelker has joined #openstack-keystone | 11:46 | |
| *** raildo has joined #openstack-keystone | 11:48 | |
| *** annp has quit IRC | 11:55 | |
| *** frickler has joined #openstack-keystone | 12:00 | |
| *** bigdogstl has joined #openstack-keystone | 12:00 | |
| *** markvoelker has quit IRC | 12:20 | |
| rabel | cmurphy: do you really think it's necessary describing indentation fixes in more detail? referring to your comment on https://review.openstack.org/#/c/534860/ | 12:21 |
| rabel | these mistakes are actually quite common and if you build the docs you see it directly. but it's somehow hard to describe | 12:21 |
| cmurphy | rabel: just without context it looks like a noop change, i did have to build the docs to see the difference | 12:23 |
| cmurphy | i wasn't asking for a long paragraph, just "the extra indentation causes this section to render as a quoted section which is unintentional" | 12:24 |
| rabel | ah ok. i can do that. :) | 12:24 |
| cmurphy | sweet, and thanks for fixing it :) | 12:24 |
| *** hogepodge has quit IRC | 12:26 | |
| *** andreykurilin has quit IRC | 12:27 | |
| *** dansmith has quit IRC | 12:27 | |
| *** d34dh0r53 has quit IRC | 12:27 | |
| *** rarora has quit IRC | 12:27 | |
| *** d34dh0r53 has joined #openstack-keystone | 12:28 | |
| *** bigjools_ has joined #openstack-keystone | 12:28 | |
| *** dansmith has joined #openstack-keystone | 12:28 | |
| *** hogepodge has joined #openstack-keystone | 12:28 | |
| *** dansmith is now known as Guest86649 | 12:28 | |
| *** bigjools has quit IRC | 12:28 | |
| *** deepak_ has quit IRC | 12:28 | |
| *** andreykurilin has joined #openstack-keystone | 12:29 | |
| *** dgonzalez has quit IRC | 12:30 | |
| *** dgonzalez has joined #openstack-keystone | 12:32 | |
| *** bigdogstl has quit IRC | 12:32 | |
| *** deepak_ has joined #openstack-keystone | 12:40 | |
| *** bigdogstl has joined #openstack-keystone | 13:02 | |
| *** efried is now known as fried_rice | 13:05 | |
| *** szaher has quit IRC | 13:07 | |
| *** bigdogstl has quit IRC | 13:17 | |
| *** markvoelker has joined #openstack-keystone | 13:17 | |
| *** links has quit IRC | 13:28 | |
| *** markvoelker has quit IRC | 13:29 | |
| *** edmondsw has joined #openstack-keystone | 13:29 | |
| *** markvoelker has joined #openstack-keystone | 13:29 | |
| *** bigdogstl has joined #openstack-keystone | 13:35 | |
| *** bigdogstl has quit IRC | 13:40 | |
| *** bigdogstl has joined #openstack-keystone | 13:42 | |
| *** sambetts|afk is now known as sambetts | 13:44 | |
| *** bigdogstl has quit IRC | 13:46 | |
| *** bigdogstl has joined #openstack-keystone | 13:47 | |
| *** aojea_ has joined #openstack-keystone | 13:50 | |
| *** aojea__ has joined #openstack-keystone | 13:55 | |
| *** aojea_ has quit IRC | 13:58 | |
| *** aojea_ has joined #openstack-keystone | 14:01 | |
| *** bigdogstl has quit IRC | 14:02 | |
| *** aojea__ has quit IRC | 14:04 | |
| *** aojea__ has joined #openstack-keystone | 14:05 | |
| *** aojea_ has quit IRC | 14:08 | |
| *** lbragstad has joined #openstack-keystone | 14:10 | |
| *** ChanServ sets mode: +o lbragstad | 14:10 | |
| *** aojea_ has joined #openstack-keystone | 14:11 | |
| *** aojea__ has quit IRC | 14:13 | |
| *** bigdogstl has joined #openstack-keystone | 14:20 | |
| *** aojea__ has joined #openstack-keystone | 14:20 | |
| *** aojea_ has quit IRC | 14:24 | |
| *** bigdogstl has quit IRC | 14:25 | |
| *** david-lyle has quit IRC | 14:27 | |
| *** aojea_ has joined #openstack-keystone | 14:28 | |
| *** aojea__ has quit IRC | 14:29 | |
| *** david-lyle has joined #openstack-keystone | 14:29 | |
| *** jistr is now known as jistr|mtg | 14:30 | |
| *** aojea__ has joined #openstack-keystone | 14:30 | |
| *** aojea_ has quit IRC | 14:34 | |
| *** josecastroleon has quit IRC | 14:35 | |
| *** aojea_ has joined #openstack-keystone | 14:36 | |
| openstackgerrit | Merged openstack/keystone master: Fix indentation in docs https://review.openstack.org/534860 | 14:37 |
| openstackgerrit | Merged openstack/keystone master: Make entries in policy_mapping.rst consistent https://review.openstack.org/534885 | 14:37 |
| openstackgerrit | Merged openstack/keystone master: Fix outdated links https://review.openstack.org/535228 | 14:37 |
| openstackgerrit | Merged openstack/keystone master: Add ability to list all system role assignments https://review.openstack.org/524407 | 14:37 |
| *** aojea__ has quit IRC | 14:39 | |
| *** aojea_ has quit IRC | 14:44 | |
| *** bhagyashris has quit IRC | 14:46 | |
| *** spzala has quit IRC | 14:49 | |
| lbragstad | cmurphy: just double checking here, but for project_id and application credentials, we're going to make sure the manager/controller always populates it until we're ready to open up the functionality right? | 14:50 |
| *** spzala has joined #openstack-keystone | 14:50 | |
| *** bigdogstl has joined #openstack-keystone | 14:51 | |
| cmurphy | lbragstad: yeah, the user has no control over it and it's just taken from their current scope, which right now can only be project scope. I think when system-scope is fully functional it will be easyish to make the adjustment and have it be seamless | 14:52 |
| *** jmlowe has quit IRC | 14:52 | |
| lbragstad | ++ | 14:55 |
| lbragstad | so - project_id and system should be mutually exclusive then | 14:56 |
| cmurphy | yeah | 14:56 |
| *** bigdogstl has quit IRC | 14:56 | |
| lbragstad | but we'll just control that constraint in the application credential manager? | 14:56 |
| cmurphy | i think it would be controlled befoe they even hit the create endpoint, becaues they need to get a scoped token and i assume a token can only have either project or system scope | 14:58 |
| cmurphy | so if they have a valid token then they can create a valid application credential | 14:59 |
| *** jmlowe has joined #openstack-keystone | 15:00 | |
| lbragstad | oh - sure... | 15:00 |
| lbragstad | but we won't rely on the db to make that judgement, right? | 15:00 |
| cmurphy | oh i guess we could add a constraint on the db but i don't think we really need to | 15:01 |
| lbragstad | right | 15:01 |
| lbragstad | i agree | 15:01 |
| lbragstad | it would be possible to create an application credential with both, or neither defined, but i don't think the business logic should allow that | 15:02 |
| cmurphy | right | 15:02 |
| lbragstad | cool | 15:02 |
| lbragstad | new patch on the way | 15:02 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add system column to app cred table https://review.openstack.org/535569 | 15:03 |
| *** jistr|mtg is now known as jistr | 15:04 | |
| *** bigdogstl has joined #openstack-keystone | 15:04 | |
| *** bigdogstl has quit IRC | 15:09 | |
| *** spilla has joined #openstack-keystone | 15:11 | |
| *** samuelbartel__ has quit IRC | 15:11 | |
| *** bigdogstl has joined #openstack-keystone | 15:13 | |
| *** raildo has quit IRC | 15:19 | |
| *** zeus has joined #openstack-keystone | 15:26 | |
| *** zeus is now known as Guest55337 | 15:27 | |
| *** Guest55337 is now known as zeus` | 15:29 | |
| *** zeus` is now known as Guest51542 | 15:29 | |
| *** bigdogstl has quit IRC | 15:29 | |
| *** Guest51542 is now known as zeus | 15:30 | |
| *** zeus has quit IRC | 15:30 | |
| *** zeus has joined #openstack-keystone | 15:30 | |
| *** raildo has joined #openstack-keystone | 15:36 | |
| *** bigdogstl has joined #openstack-keystone | 15:39 | |
| *** bigdogstl has quit IRC | 15:44 | |
| *** phalmos has joined #openstack-keystone | 15:44 | |
| cmurphy | lbragstad: was keystoneauth going to be released this week? did we miss that deadline? | 15:49 |
| *** phalmos has quit IRC | 15:51 | |
| lbragstad | the freeze is this week | 15:53 |
| lbragstad | https://releases.openstack.org/queens/schedule.html#q-final-lib | 15:53 |
| *** phalmos has joined #openstack-keystone | 15:54 | |
| lbragstad | so i don't think we missed it _yet_ | 15:54 |
| lbragstad | today is our last day to get things merged for oslo and ksa | 15:55 |
| cmurphy | hrm i think it was yesterday actually http://lists.openstack.org/pipermail/openstack-dev/2018-January/126147.html | 15:56 |
| cmurphy | i guess sean doesn't want to live dangerously and release on a friday | 15:56 |
| lbragstad | damn | 15:58 |
| lbragstad | i read that email, too | 15:58 |
| *** kukacz_ has quit IRC | 15:58 | |
| lbragstad | so - how do we want to approach ksa changes for things we're landing this release? | 15:59 |
| *** kukacz has joined #openstack-keystone | 15:59 | |
| cmurphy | not sure what our options are | 16:01 |
| cmurphy | I think we'll just have to land them early next release? | 16:02 |
| cmurphy | er s/release/cycle | 16:03 |
| *** bigdogstl has joined #openstack-keystone | 16:03 | |
| lbragstad | we could do that - and release early | 16:03 |
| lbragstad | like, as soon a rocky opens | 16:03 |
| lbragstad | then people will have to grab newer clients to use those features in pike | 16:04 |
| *** jlvillal has quit IRC | 16:04 | |
| cmurphy | s/pike/queens | 16:05 |
| * lbragstad shakes head | 16:05 | |
| lbragstad | yeah... queens | 16:05 |
| *** bigdogstl has quit IRC | 16:07 | |
| cmurphy | yeah not ideal but i think early adopters would mostly use the latest client releases from pypi rather than their distro packages anyways? | 16:09 |
| lbragstad | probably | 16:09 |
| lbragstad | alright - i'll go through and place procedural -2s on all ksa changes | 16:10 |
| cmurphy | could also ask the release team if they'd be willing to make an exception :) | 16:11 |
| lbragstad | i just asked smcginnis in -release :) | 16:12 |
| lbragstad | frozen unless the a fix is critical | 16:12 |
| cmurphy | i don't think we qualify | 16:13 |
| lbragstad | double checking | 16:13 |
| *** jlvillal has joined #openstack-keystone | 16:14 | |
| *** itlinux has joined #openstack-keystone | 16:16 | |
| *** bigdogstl has joined #openstack-keystone | 16:18 | |
| kmalloc | ask for an exception | 16:20 |
| kmalloc | really, we have minimal things open in ksa | 16:21 |
| kmalloc | if we missed the release by a day, it's fair to ask for an exception if we release today | 16:21 |
| kmalloc | or well... | 16:21 |
| kmalloc | monday | 16:21 |
| kmalloc | because no releases on Friday | 16:21 |
| lbragstad | right | 16:21 |
| lbragstad | we have to release next week anyway | 16:21 |
| lbragstad | afaik the only two exceptions we would need would be for app creds and system scope | 16:22 |
| kmalloc | i view "every major initiative in pike is on hold" as relativly critical | 16:22 |
| kmalloc | fwiw. | 16:22 |
| lbragstad | in pike? | 16:22 |
| lbragstad | s/pike/queens :) | 16:22 |
| kmalloc | yes | 16:22 |
| kmalloc | i need coffee | 16:22 |
| kmalloc | i was reviewing some code that referenced pikle | 16:23 |
| kmalloc | pike* | 16:23 |
| kmalloc | i also published a bug to public | 16:23 |
| kmalloc | https://bugs.launchpad.net/keystoneauth/+bug/1700751 | 16:23 |
| openstack | Launchpad bug 1638978 in keystoneauth "duplicate for #1700751 Debug data isn't sanitized" [Medium,In progress] - Assigned to Dinesh Bhor (dinesh-bhor) | 16:23 |
| *** bigdogstl has quit IRC | 16:23 | |
| kmalloc | lbragstad: system scope +2 (in KSA) | 16:24 |
| kmalloc | lbragstad: ok i need to go grab coffee and walk the dog. | 16:24 |
| lbragstad | ack - if we get exceptions, we'll need to get those merged today | 16:25 |
| *** jaosorior has quit IRC | 16:30 | |
| lbragstad | cmurphy: i think this is what gagehugo ran into yesterday, but i just hit it, too http://paste.openstack.org/show/647127/ | 16:32 |
| cmurphy | lbragstad: that usually goes away for me if i `pip install -e` again and restart keystone | 16:34 |
| * lbragstad facepalm | 16:34 | |
| gagehugo | lbragstad not that exactly, was getting unallowed auth method | 16:34 |
| *** itlinux has quit IRC | 16:34 | |
| cmurphy | i assumed there was some stevedor or setuptools magic that i don't understand but maybe it's a bug | 16:34 |
| lbragstad | nope - reinstalling worked | 16:34 |
| lbragstad | i just need to slow down :) | 16:34 |
| cmurphy | gagehugo: but that would go away when you add 'application_credential' to auth methods right? | 16:35 |
| gagehugo | yup | 16:35 |
| *** AlexeyAbashkin has quit IRC | 16:35 | |
| *** itlinux has joined #openstack-keystone | 16:41 | |
| *** bigdogstl has joined #openstack-keystone | 16:41 | |
| lbragstad | cmurphy: gagehugo kmalloc we have exceptions for app creds and system scope ksa patches | 16:47 |
| *** ayoung has joined #openstack-keystone | 16:47 | |
| lbragstad | which client freeze next week, i'll release first thing on monday and we can incorporate them into the clients where we need them | 16:47 |
| cmurphy | okay | 16:47 |
| lbragstad | with* | 16:48 |
| lbragstad | before the final library release and before client freeze | 16:48 |
| cmurphy | for application credentials at least the ksa and ksc changes are separate and independent | 16:48 |
| lbragstad | cmurphy: ok - so you don't have anything in ksc that depends on ksa? | 16:49 |
| gagehugo | ok | 16:49 |
| cmurphy | lbragstad: i don't think so, the ksc changes are just CRUD changes, they don't need to deal with the auth plugin | 16:50 |
| lbragstad | ack | 16:50 |
| lbragstad | i suppose openstack token issue doesn't really make sense for application credentials? | 16:50 |
| cmurphy | ah well it does sort of | 16:51 |
| cmurphy | i haven't started looking at osc at all yet | 16:51 |
| lbragstad | so - application credentials are mainly going to be used via ksa | 16:52 |
| lbragstad | do we expect applications to authenticate with keystone via osc? | 16:52 |
| cmurphy | yes | 16:52 |
| cmurphy | deployment tools for example shell out to ksa | 16:52 |
| cmurphy | or osc | 16:52 |
| *** bigdogstl has quit IRC | 16:52 | |
| cmurphy | i mean shell out to osc | 16:52 |
| lbragstad | ok - so in that case there might be something there... | 16:53 |
| lbragstad | but it's likely similar to what i had to do for system scope | 16:53 |
| lbragstad | or my osc patch to get system scope to work | 16:53 |
| spilla | since freeze is in a week, appreciate reviews to get tags through :) https://review.openstack.org/#/c/481284/ | 16:56 |
| lbragstad | spilla: sweet - i can review that | 16:57 |
| spilla | thanks! | 16:57 |
| *** gyee has joined #openstack-keystone | 16:58 | |
| *** fried_rice is now known as fried_rolls | 17:14 | |
| lbragstad | cmurphy: i checked out your patch locally and i can authenticate for a token with ksa | 17:16 |
| cmurphy | yay | 17:17 |
| lbragstad | cmurphy: is there a way to look at the methods from the token response using a session object? | 17:17 |
| cmurphy | not sure off the top of my head | 17:18 |
| lbragstad | hah - hell yes there is! | 17:19 |
| knikolla | o/ | 17:19 |
| lbragstad | http://paste.openstack.org/show/647169/ | 17:20 |
| lbragstad | cmurphy: whole process, top to bottom http://paste.openstack.org/show/647174/ | 17:23 |
| lbragstad | gagehugo: kmalloc knikolla ^ in case you want to try things out | 17:25 |
| knikolla | lbragstad: ooo looking nice! | 17:26 |
| lbragstad | the big thing i wanted to check was that the auth methods in the token response matched application_credentials | 17:27 |
| *** mvenesio has joined #openstack-keystone | 17:27 | |
| *** pcaruana has quit IRC | 17:36 | |
| cmurphy | lbragstad: it should work without passing in user_id to ApplicationCredentialMethod, does it? | 17:36 |
| lbragstad | let me try quick | 17:36 |
| cmurphy | knikolla: can https://review.openstack.org/#/c/452893/ be abandoned? | 17:37 |
| lbragstad | yep - it does | 17:37 |
| knikolla | cmurphy: yeah, nothing else from that spec merged. and the spec was removed. | 17:37 |
| *** bigdogstl has joined #openstack-keystone | 17:44 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystoneauth master: Add documentation and release note for app creds https://review.openstack.org/535867 | 17:48 |
| lbragstad | ^ passes everything for me locally | 17:49 |
| openstackgerrit | Merged openstack/keystone master: remove _append_null_domain_id decorator https://review.openstack.org/527848 | 17:49 |
| *** bigdogstl has quit IRC | 17:51 | |
| *** r-daneel has joined #openstack-keystone | 17:59 | |
| knikolla | after lunch i'll be in full code review mode. | 18:02 |
| lbragstad | awesome | 18:02 |
| lbragstad | i'm holding up cmurphy's work with https://review.openstack.org/#/c/535569/ | 18:03 |
| lbragstad | any reviews there would be awesome so we can get the application credential stuff back on track | 18:03 |
| lbragstad | i'm also going to straighten up the ksc patches to system assignment CRUD | 18:04 |
| lbragstad | then we can get those merged with the app cred CRUD and project tags osc patch on monday | 18:05 |
| lbragstad | or early next week | 18:05 |
| * lbragstad runs away to get lunch quick | 18:06 | |
| *** bigdogstl has joined #openstack-keystone | 18:09 | |
| *** esp has joined #openstack-keystone | 18:12 | |
| *** bigdogstl has quit IRC | 18:13 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:16 | |
| *** bigdogstl has joined #openstack-keystone | 18:17 | |
| *** AlexeyAbashkin has quit IRC | 18:20 | |
| *** bigdogstl has quit IRC | 18:22 | |
| *** bigdogstl has joined #openstack-keystone | 18:23 | |
| *** bigdogstl has quit IRC | 18:28 | |
| openstackgerrit | Merged openstack/keystoneauth master: Implement system scope https://review.openstack.org/529665 | 18:37 |
| *** bigdogstl has joined #openstack-keystone | 18:43 | |
| *** bigdogstl has quit IRC | 18:47 | |
| * gagehugo is back from lunch | 18:48 | |
| *** sambetts is now known as sambetts|afk | 18:48 | |
| *** bigdogstl has joined #openstack-keystone | 18:50 | |
| *** dave-mcc_ has joined #openstack-keystone | 18:53 | |
| *** bigdogstl has quit IRC | 18:56 | |
| *** bigdogstl has joined #openstack-keystone | 19:01 | |
| *** mvenesio has quit IRC | 19:08 | |
| *** bigdogstl has quit IRC | 19:13 | |
| *** itlinux has quit IRC | 19:20 | |
| *** bigdogstl has joined #openstack-keystone | 19:21 | |
| *** bigdogstl has quit IRC | 19:25 | |
| *** itlinux has joined #openstack-keystone | 19:28 | |
| *** phalmos has quit IRC | 19:29 | |
| *** harlowja has joined #openstack-keystone | 19:31 | |
| lbragstad | cmurphy: i'm just noticing a bunch of things with the scope_types patches | 19:36 |
| cmurphy | lbragstad: yeah? | 19:36 |
| lbragstad | responding inline to most of them | 19:36 |
| lbragstad | but here is an example of my epiphany https://review.openstack.org/#/c/526153/ | 19:36 |
| cmurphy | lbragstad: ah yeah i was making assumptions that it was already locked down somehow | 19:39 |
| lbragstad | :( i should have been more clear about that | 19:39 |
| lbragstad | I think a lot of those APIs are going to need additional code to check project scope in the API | 19:40 |
| lbragstad | which was part of the FIXME discussion we had in the meeting recently (last week?) | 19:40 |
| lbragstad | we can close bug 968696 without all of those bits done... | 19:41 |
| openstack | bug 968696 in OpenStack Identity (keystone) ""admin"-ness not properly scoped" [High,In progress] https://launchpad.net/bugs/968696 - Assigned to Adam Young (ayoung) | 19:41 |
| lbragstad | but it will be more useful once we get the project-scoped bits check in the APIs themselves | 19:41 |
| lbragstad | (because we'll actually be giving power to project administrators without exposing too much information about the deployment | 19:42 |
| openstackgerrit | Merged openstack/keystone master: Handle TODO notes for using new_user_ref https://review.openstack.org/534879 | 19:42 |
| cmurphy | lbragstad: i guess my confusion comes from the fact that right now they have to have a project scope in order to do things like create_domain_config | 19:42 |
| lbragstad | true.. | 19:43 |
| lbragstad | i guess that would mean that the upgrade path would be; | 19:43 |
| lbragstad | 1.) admin has to grant themselves admin on the system | 19:43 |
| lbragstad | 2.) grant all admins admin on the system | 19:43 |
| lbragstad | 3.) teach them how to use system scope | 19:43 |
| lbragstad | 4.) flip the enforcement bit in configuration | 19:44 |
| cmurphy | 5) add logic to understand what "project" scope means in the new world and add back the "projec" scope_type | 19:44 |
| cmurphy | project* | 19:45 |
| lbragstad | ++ | 19:45 |
| lbragstad | step 5 is what gives the power to project administrators | 19:45 |
| *** AlexeyAbashkin has joined #openstack-keystone | 19:45 | |
| lbragstad | or administrators that are not system administrators | 19:45 |
| cmurphy | so probaby almost everything that's ADMIN_REQUIRED right now should only have a system scope_type? | 19:45 |
| lbragstad | :-/ | 19:46 |
| lbragstad | pretty much | 19:46 |
| lbragstad | because we don't really do any project-scoped token checks in code at all | 19:46 |
| lbragstad | otherwise - what would it look like if we kept scope_types as ['system', 'project']? | 19:47 |
| lbragstad | 1.) system administrators keep using project scoped tokens to do system level stuff | 19:47 |
| lbragstad | 2.) we write code to pull the project scope checking into the domain_config API | 19:47 |
| lbragstad | 3.) system administrators assign themselves admin on the system | 19:49 |
| lbragstad | 4.) they start using system scoped tokens to manage system-level resources | 19:49 |
| *** AlexeyAbashkin has quit IRC | 19:49 | |
| cmurphy | there would be a step between 2 and 3 where they are still using project-scoped tokens to do system-scoped things but the behavior changes on them | 19:50 |
| lbragstad | yeah | 19:50 |
| lbragstad | well... | 19:51 |
| lbragstad | it would be between 3 and 4 | 19:51 |
| lbragstad | because they'd still need to flip the bit in configuration? | 19:51 |
| lbragstad | to enforce scope, right? | 19:51 |
| cmurphy | ah yeah | 19:51 |
| lbragstad | so - which migration is better? | 19:52 |
| cmurphy | i think the first one is better - everything that's "admin required" right now is basically a system-scoped operation, that's an easy thing to understand and transition to | 19:52 |
| lbragstad | it also means we don't accidentally let an operator use their foot gun if they decide to flip that configuration early | 19:53 |
| cmurphy | if there's this gray area where both system and project scope work but flipping the switch makes them behave differently that's a little awkward | 19:53 |
| cmurphy | right | 19:53 |
| lbragstad | because if an operator starts assigning people admin on projects, but then flips the switch and we haven't written that code... | 19:54 |
| lbragstad | then that's a possible breach of security | 19:54 |
| cmurphy | yep | 19:54 |
| lbragstad | ok - so i need to respin a lot of these and add clearer FIXME comments | 19:55 |
| cmurphy | while we're on the subject i had a thought while reading the one for credentials | 19:57 |
| cmurphy | that some things are really not system-scoped or project-scoped | 19:57 |
| cmurphy | they're just user-scoped | 19:57 |
| lbragstad | yeah | 19:58 |
| cmurphy | it kind of came up in boston when we were talking about unified limits and wondering what to do about things like nova ssh-keys which are just user resources | 19:58 |
| cmurphy | we sort of need something to describe that | 19:58 |
| *** bigdogstl has joined #openstack-keystone | 19:58 | |
| *** raildo has quit IRC | 19:58 | |
| lbragstad | yeah - i agree | 19:58 |
| lbragstad | i guess i've been describing it as an "in-code policy check" | 19:59 |
| lbragstad | which isn't very useful... but it's about all i can come up with | 19:59 |
| lbragstad | since it consists of checking the attributes of the token and comparing it to what the user actually wants and making a decision based on that information | 19:59 |
| cmurphy | yeah that's kind of what i hacked into application credentials | 20:00 |
| lbragstad | right - and i think that is where that kind of stuff should be | 20:00 |
| cmurphy | okay, that makes sense at least for now | 20:01 |
| lbragstad | do you have any suggestions for what to call it? | 20:01 |
| cmurphy | but then what scope_type do we set in the policy? or should those things even have policy rules? | 20:01 |
| lbragstad | user-scope? | 20:01 |
| lbragstad | i would say that is a ['system', 'project'] scope_types thing... | 20:01 |
| lbragstad | since we're doing most of the policy enforcement in code | 20:01 |
| lbragstad | and we're using scope_types as a pass through :-/ | 20:01 |
| lbragstad | essentially... | 20:02 |
| cmurphy | i was thinking either creating a new scope called user-scope or bringing back default projects and having each user have their own implicit project | 20:02 |
| lbragstad | hmmm | 20:03 |
| *** bigdogstl has quit IRC | 20:03 | |
| lbragstad | i kinda like the user-scope thing... | 20:03 |
| lbragstad | but how do we determine that from a token? | 20:03 |
| lbragstad | or does it need to be determined from the token? | 20:03 |
| cmurphy | not sure | 20:04 |
| cmurphy | maybe we can whiteboard it at the ptg | 20:04 |
| lbragstad | yeah... | 20:04 |
| lbragstad | added it to the idea sheet | 20:05 |
| *** pramodrj07 has joined #openstack-keystone | 20:07 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add scope_types to group policies https://review.openstack.org/525706 | 20:10 |
| lbragstad | example of how i'll update the rest that have similar cases ^ | 20:11 |
| cmurphy | so - right now, with complicated mangling of policy files, it is possible for a domain admin to create a user for their domain, right? | 20:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add scope_types to domain config policies https://review.openstack.org/526153 | 20:17 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add scope_types to domain config policies https://review.openstack.org/526153 | 20:18 |
| lbragstad | how so? | 20:19 |
| *** abhishek has quit IRC | 20:20 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add scope_types to group policies https://review.openstack.org/525706 | 20:21 |
| cmurphy | i'm not sure, i assumed it could be done but i never knew how. probably a bad assumption :) | 20:22 |
| *** fried_rolls is now known as fried_rice | 20:23 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add scope_types to service provider policies https://review.openstack.org/526173 | 20:24 |
| lbragstad | maybe depending on the domain configuration? i think the default create user policy requires an admin? | 20:26 |
| *** AlexeyAbashkin has joined #openstack-keystone | 20:27 | |
| *** bigdogstl has joined #openstack-keystone | 20:29 | |
| *** AlexeyAbashkin has quit IRC | 20:31 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Document fixes needed token scope_types https://review.openstack.org/526174 | 20:34 |
| lbragstad | cmurphy: ^ that's a fun one... | 20:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Document fixes needed for token scope_types https://review.openstack.org/526174 | 20:35 |
| cmurphy | oof | 20:36 |
| lbragstad | glad that one didn't sneak through | 20:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Document fixes needed for token scope_types https://review.openstack.org/526174 | 20:40 |
| *** bigdogstl has quit IRC | 20:40 | |
| cmurphy | lbragstad: so the rule for check_token is admin_or_token_subject where token_subject has nothing to do with scope at all | 20:40 |
| lbragstad | correct | 20:40 |
| cmurphy | so could that one have a system scope, which is where 'admin' would come into play, and just not a project scope yet? | 20:41 |
| *** mvenesio has joined #openstack-keystone | 20:42 | |
| lbragstad | what would happen if enforce_scope was true though? | 20:42 |
| cmurphy | the check string is user_id:%(target.token.user_id)s - would enforce_scope break that? | 20:43 |
| cmurphy | it's not a project scope | 20:43 |
| cmurphy | it's a different property of the token | 20:44 |
| lbragstad | checking the oslo.policy logic quick | 20:44 |
| lbragstad | yeah- it would compare the scope_types before executing the check (which is an OR statement) | 20:46 |
| lbragstad | https://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L845 | 20:46 |
| cmurphy | hrm :/ | 20:46 |
| *** mvenesio has quit IRC | 20:46 | |
| lbragstad | the scope types will short circuit the check if enforce_scope is enabled | 20:46 |
| * lbragstad is starting to like the idea of user-scope more and more | 20:47 | |
| cmurphy | checking a token should be an unscoped operation | 20:47 |
| lbragstad | yeah... | 20:47 |
| lbragstad | like.. teach oslo.policy about user-scope and set that to be a user-scoped operation in keystone | 20:47 |
| *** mvenesio has joined #openstack-keystone | 20:47 | |
| lbragstad | if you have a valid token, you have user scope | 20:47 |
| cmurphy | or maybe just teach oslo.policy about unscoped | 20:48 |
| lbragstad | it's only an unscoped operation if you're validating your own token though | 20:48 |
| cmurphy | that's true | 20:48 |
| lbragstad | i guess scope starts to matter when you start doing things to other people's tokens | 20:49 |
| gagehugo | cmurphy lbragstad looking at ksa now | 20:50 |
| cmurphy | lbragstad: so what happens if we leave it without a scope type? | 20:53 |
| lbragstad | cmurphy: https://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L845 | 20:53 |
| lbragstad | it's only checked against the token scope if the scope_types attribute is set | 20:54 |
| lbragstad | so it'll just keep doing what it's doing today with the default check_str | 20:55 |
| *** aojea has joined #openstack-keystone | 20:56 | |
| cmurphy | okay | 20:57 |
| *** bigdogstl has joined #openstack-keystone | 21:02 | |
| *** aojea_ has joined #openstack-keystone | 21:02 | |
| gagehugo | cmurphy lbragstad ksa worked great for app creds | 21:03 |
| cmurphy | yay \o/ | 21:05 |
| *** aojea has quit IRC | 21:05 | |
| *** bigdogstl has quit IRC | 21:06 | |
| *** aojea has joined #openstack-keystone | 21:07 | |
| gagehugo | not sure if we should merge it now though before keystone proper? | 21:08 |
| gagehugo | I know the deadline is now | 21:09 |
| *** aojea_ has quit IRC | 21:10 | |
| cmurphy | we kind of have to do it now | 21:10 |
| cmurphy | it doesn't hurt to have it in even if there's no server that works with it yet | 21:11 |
| *** aojea_ has joined #openstack-keystone | 21:12 | |
| knikolla | as long as we don't do a release. | 21:13 |
| gagehugo | ok | 21:14 |
| *** aojea has quit IRC | 21:14 | |
| knikolla | what does lbragstad think? | 21:15 |
| *** aojea__ has joined #openstack-keystone | 21:17 | |
| *** aojea_ has quit IRC | 21:20 | |
| *** aojea_ has joined #openstack-keystone | 21:22 | |
| *** ayoung has quit IRC | 21:25 | |
| *** aojea__ has quit IRC | 21:25 | |
| *** aojea__ has joined #openstack-keystone | 21:27 | |
| lbragstad | right | 21:28 |
| lbragstad | if it is there before we merge the keystone bits that's fine | 21:28 |
| lbragstad | we did the same thing with system scope, which is still in review | 21:28 |
| *** mvenesio has quit IRC | 21:29 | |
| *** aojea_ has quit IRC | 21:30 | |
| *** aojea has joined #openstack-keystone | 21:32 | |
| *** aojea__ has quit IRC | 21:35 | |
| *** bigdogstl has joined #openstack-keystone | 21:36 | |
| *** aojea_ has joined #openstack-keystone | 21:36 | |
| *** aojea has quit IRC | 21:39 | |
| lbragstad | cc knikolla gagehugo ^ | 21:40 |
| kmalloc | knikolla: it shouldn't matter if we merge it | 21:41 |
| kmalloc | even without a release | 21:41 |
| kmalloc | we should merge KSA and release | 21:41 |
| kmalloc | then work on system side | 21:41 |
| kmalloc | (keystone server side) | 21:41 |
| kmalloc | even with* | 21:41 |
| knikolla | kmalloc: sounds good. i fully agree after putting some thought into it. since ksa will be used with older keystone server releases anyway. | 21:42 |
| kmalloc | yep | 21:42 |
| *** aojea__ has joined #openstack-keystone | 21:42 | |
| *** bigdogstl has quit IRC | 21:45 | |
| *** aojea_ has quit IRC | 21:45 | |
| gagehugo | ok | 21:48 |
| lbragstad | send it! | 21:49 |
| *** nkinder has quit IRC | 21:49 | |
| *** aojea__ has quit IRC | 21:51 | |
| *** aojea has joined #openstack-keystone | 21:52 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Move token_formatter to token https://review.openstack.org/527538 | 21:53 |
| *** aojea_ has joined #openstack-keystone | 21:57 | |
| *** aojea has quit IRC | 22:01 | |
| *** tesseract has quit IRC | 22:01 | |
| *** nkinder has joined #openstack-keystone | 22:02 | |
| *** aojea has joined #openstack-keystone | 22:03 | |
| *** aojea_ has quit IRC | 22:06 | |
| *** bigdogstl has joined #openstack-keystone | 22:06 | |
| *** aojea_ has joined #openstack-keystone | 22:07 | |
| *** spilla has quit IRC | 22:09 | |
| *** aojea has quit IRC | 22:10 | |
| *** bigdogstl has quit IRC | 22:11 | |
| *** aojea has joined #openstack-keystone | 22:13 | |
| *** aojea_ has quit IRC | 22:15 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Move token_formatter to token https://review.openstack.org/527538 | 22:17 |
| *** aojea_ has joined #openstack-keystone | 22:18 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystoneauth master: Add documentation and release note for app creds https://review.openstack.org/535867 | 22:18 |
| *** aojea has quit IRC | 22:21 | |
| *** aojea has joined #openstack-keystone | 22:23 | |
| *** aojea has quit IRC | 22:23 | |
| *** aojea_ has quit IRC | 22:26 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Document scope_types for ec2 policies https://review.openstack.org/526191 | 22:31 |
| *** edmondsw has quit IRC | 22:37 | |
| *** bigdogstl has joined #openstack-keystone | 22:37 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Document scope_types for credential policies https://review.openstack.org/526189 | 22:38 |
| *** bigdogstl has quit IRC | 22:43 | |
| openstackgerrit | Merged openstack/keystoneauth master: Add support for application credentials https://review.openstack.org/534455 | 22:45 |
| *** dave-mcc_ has quit IRC | 22:58 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add scope_types for user policies https://review.openstack.org/526203 | 23:00 |
| *** itlinux has quit IRC | 23:00 | |
| *** itlinux has joined #openstack-keystone | 23:02 | |
| lbragstad | good work this week everyone... we hammered through a lot of stuff! thanks for the bandwidth and being awesome | 23:04 |
| cmurphy | :D | 23:04 |
| *** bigdogstl has joined #openstack-keystone | 23:05 | |
| gagehugo | :) | 23:08 |
| gagehugo | I should be around this weekend if anything else needs done | 23:10 |
| * cmurphy too | 23:12 | |
| *** bigdogstl has quit IRC | 23:16 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Document scope_types for project policies https://review.openstack.org/526159 | 23:18 |
| lbragstad | same here | 23:18 |
| lbragstad | i'm going to try and have the release for ksa squared away and ready by sunday night | 23:18 |
| lbragstad | so we can get that rolling first thing monday | 23:19 |
| *** bigdogstl has joined #openstack-keystone | 23:20 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 23:22 | |
| openstackgerrit | Colleen Murphy proposed openstack/python-keystoneclient master: Add CRUD support for application credentials https://review.openstack.org/534965 | 23:22 |
| *** esp has quit IRC | 23:23 | |
| *** AlexeyAbashkin has quit IRC | 23:26 | |
| *** bigdogstl has quit IRC | 23:27 | |
| *** bigdogstl has joined #openstack-keystone | 23:27 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add functional testing gate https://review.openstack.org/531014 | 23:39 |
| *** bigdogstl has quit IRC | 23:40 | |
| -openstackstatus- NOTICE: Zuul will be offline over the next 20 minutes to perform maintenance; active changes will be reenqueued once work completes, but new patch sets or approvals during that timeframe may need to be rechecked or reapplied as appropriate | 23:42 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add functional testing gate https://review.openstack.org/531014 | 23:46 |
| *** itlinux has quit IRC | 23:47 | |
| *** bigdogstl has joined #openstack-keystone | 23:49 | |
| *** itlinux has joined #openstack-keystone | 23:50 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!